[houko]

What changed

On the web every js.Runtime is a hidden iframe of the page's origin, and a sandboxed package runs in such a realm. Nothing removes the realm's own browser globals, so package code reaches the page's XMLHttpRequest, WebSocket, navigator (clipboard included), localStorage and parent without going through Go. Capabilities and Sandbox.Grant therefore held only the requests the runtime and core make; a package's storage partition and a pkg.Trust kept in the page's localStorage (accepted builds, revocations) were open to it. The docs promised capability enforcement on every target with no web exception.

This makes the web fail closed:

• Sandbox.start (and so tsx.Sandboxed, tsx.View and tsx.Load) refuses on the web a sandbox with non-nil Capabilities or Grant with the new tsx.ErrUnisolated, whose message names the missing isolation, unless the host sets the new Sandbox.WebUnisolated, which states the package runs with the page's authority. View and Load always set Capabilities (the package's own), so every package is refused on the web by default. Other targets ignore the field.
• A sandbox with neither Capabilities nor Grant still runs on the web: its contract is already "reaches what the app's code does" on every target, which is exactly what the page's realm gives it. This keeps nsgo dev -limits without capabilities and tsx.Sandboxed used for limits alone working. On the web such a sandbox's Storage partition and Host do not confine it either, which docs/architecture/tsx.md now says.
• nsgo dev -limits -target web for an app whose nsgo.yaml declares capabilities: now shows the ErrUnisolated refusal, as a host's View of the published package would, instead of running the app.
• tsx.Load checks before running the package and returns the refusal to its caller. (Inside the child scope's Run, a panic goes to the nearest core.Catch instead.)
• The decision is one function, Sandbox.isolation(browser bool), tested on every target headless; a web-target test shows View and Load refusing and the opted-in view running.
• examples/plugins does not opt in: on the web it shows the refusal for both packages; its tests assert that on the web and skip the older-build test there (no build is ever accepted).
• docs/architecture/tsx.md lists the exception in "The page's engine", the Sandbox and Signed packages sections and the departures table; the public TSX guide (en, zh) says how the web behaves and what WebUnisolated gives up; the roadmap gains "Packages isolated on the web".

Left out: proposal item 2, real isolation on the web (an opaque-origin sandbox="allow-scripts" iframe or a Worker, with the runtime's Go-backed APIs over postMessage / MessageChannel). The browser engine's Value API is synchronous and would need an asynchronous bridge for sandboxed realms, which is a separate project; it is recorded on the roadmap.

Verification

• go tool nsgo test ./tsx
• go tool nsgo test -target web ./tsx (every sandbox, view and plugin test passes; TestDevToolsNameTSXLines fails on the web on main too)
• go tool nsgo test ./examples/plugins
• go tool nsgo test -target web ./examples/plugins
• go tool nsgo check
• go tool nsgo check -target all

TestTheWebRefusesWhatItCannotIsolate fails on the web target without the check in Sandbox.start (both packages run).

Screenshots

None