Sandbox local execution and guest files

Local computer transport

Core resolves only the Sandbox control. For an explicit local target, Sandbox delegates local target discovery, binding, file I/O and process preparation to the local execution control that core registers in the daemon for paired Elowen CLI computers. The control is resolved live at the call boundary, and core always registers it, so a missing owner is a broken host and every local call, discovery included, fails. Local paths never pass through the host's realpath or confinement helpers. Runner-local requests cross the inherited host connection and use the same file and process contracts. Daemon and runner process preparations share one session helper for streams, stdin and exit status; Sandbox owns the local metadata and lease wrapper, and cancellation aborts the same original request. File, editor, terminal, MCP and LSP process preparations are supported; any other lease is refused as unsupported. Local target metadata is transient execution context, while durable conversation identity contains only the kind and the Project ID.

Sites from a paired computer

Sites can publish an application from a paired computer Project through the same publication control used for managed Projects. The publishing account must remain a member of that computer. Sandbox retains the port and publisher in its existing publication record; core owns the private socket and forwards each visitor to 127.0.0.1 on the computer. HTTP and WebSocket connections use the same transport. An offline computer makes the publication unavailable until it reconnects. Update the CLI if publishing reports LOCAL_CLIENT_OUTDATED. Removing the publishing member closes that member's live publications. The publication contract for integration work is in docs/plugin-author/controls.md, section project-publication-transport.

Guest file frames

The internal file connection uses length-prefixed JSON frames: a request body is at most 1 MiB and a reply body at most 16 MiB, on both sides of the connection. These bounds apply to the encoded frame body, excluding its four-byte length prefix; oversized or malformed frames are refused. The guest helper is delivered by content and digest through the existing helper binding, so this contract does not require a new root filesystem image.