metal-kompanion/docs/JS-ENGINE.md

Optional JavaScript Engine (QuickJS)

Goal: lightweight scripting for tools and creative transforms without pulling QtQml. Design:\n- Link QuickJS as an optional component (BUILD_JS=ON).\n- Expose sandboxed functions: readText(path allowlist), writeJournal(text), httpFetch(allowlist).\n- Per-aspect capability gates via capabilities.json. Security:\n- No require() to filesystem; no dynamic dlopen; memory/time limits per eval.\n- Network only via allowlisted httpFetch; inherits Tor proxy if set. API sketch:\n- tools/js.eval {code, args} -> result or error; logs to ledger.