docs: sandbox is the default; mark full-trust samples explicitly

docs/README.md

@@ -1,6 +1,6 @@
 # Glyph Plugin Docs
 
-Glyph plugins are small JavaScript modules that extend the app: command-palette commands, status bar items, sidebar and settings panels, markdown rendering, exporters, styles, translations, and notifications. They run through a single capability object (`ctx`), never with direct filesystem or shell access, and can opt into a network-fenced worker sandbox.
+Glyph plugins are small JavaScript modules that extend the app: command-palette commands, status bar items, sidebar and settings panels, markdown rendering, exporters, styles, translations, and notifications. They run through a single capability object (`ctx`), never with direct filesystem or shell access, and run in a network-fenced worker sandbox by default.
 
 ## Where to go
 

docs/api-reference.md

@@ -185,7 +185,7 @@ ctx.registerTranslations("de", "myplugin", { greeting: "Hallo" });
 
 ## Sandboxed plugins
 
-Declare `"sandbox": true` in `manifest.json` to run your plugin in an isolated worker instead of the app context:
+Plugins run sandboxed by default: a `manifest.json` without a `sandbox` flag (or with `"sandbox": true`) runs in an isolated worker instead of the app context. Declaring `"sandbox": false` opts out into full trust; Glyph shows users a separate full-access warning they must explicitly accept before the plugin runs (persisted per plugin), and updates that request new permissions ask again. Only declare `"sandbox": false` when your plugin genuinely needs the main-context APIs listed below.
 
 ```json
 {
@@ -205,9 +205,9 @@ Inside the sandbox:
 - The available API subset is: `ctx.commands`, `ctx.ui.addStyles`, `ctx.exporters`, `ctx.workspace` (still requires `workspace:read`), `ctx.assets`, `ctx.settings`, `ctx.notify`, and `ctx.registerTranslations`.
 - Not available: `ctx.markdown` and the DOM-mount APIs (`addStatusBarItem`, `addSidebarPanel`, `addSettingsPanel`), because they cannot cross the worker boundary.
 
-Prefer the sandbox when your plugin needs network access or doesn't touch the UI; users can trust it with less.
+Prefer the sandbox (the default) when your plugin needs network access or doesn't touch the UI; users can trust it with less.
 
 ## Not available yet
 
-No shell or `invoke` access; filesystem access only through the permission-gated `ctx.workspace`. In the main (non-sandboxed) context there is no network gating, so network-using plugins should opt into the sandbox. More capabilities are tracked on the [roadmap](https://github.com/hamidfzm/glyph/issues/109).
+No shell or `invoke` access; filesystem access only through the permission-gated `ctx.workspace`. In the full-trust (`"sandbox": false`) context there is no network gating, which is exactly why that mode requires an explicit user grant. More capabilities are tracked on the [roadmap](https://github.com/hamidfzm/glyph/issues/109).
 

docs/contributing.md

@@ -25,7 +25,7 @@ The delivery plan lived in [hamidfzm/glyph#109](https://github.com/hamidfzm/glyp
 - **A: Markdown pipeline**: remark/rehype plugins, fenced code-block renderers
 - **B: Trust**: declared permissions, install consent, permission-gated workspace API
 - **C/D: Surface growth**: sidebar panels, settings panels, exporters, per-plugin settings, translations, `addStyles`, spell-check dictionaries
-- **E: Distribution hardening**: index CI validation, sha256 download verification, and the opt-in worker sandbox
+- **E: Distribution hardening**: index CI validation, sha256 download verification, and the worker sandbox (now the default; full trust is an explicit, user-granted opt-out)
 
 All phases are complete; new work is incremental API/proposal-driven.
 

docs/getting-started.md

@@ -71,4 +71,4 @@ Use **Manage Plugins…** to enable/disable or remove it. To ship it to other us
 | `main` | no | Entry file name, defaults to `main.js` |
 | `files` | no | Every file the plugin consists of (must include `main`), e.g. `["main.js", "assets/fa.dic"]`. Required to ship assets: installs copy exactly this list and `ctx.assets` reads are limited to it |
 | `permissions` | no | Capabilities you request (e.g. `workspace:read`, `network:api.example.com`); shown to users for consent |
-| `sandbox` | no | `true` runs the plugin in an isolated worker with network fenced to its `network:` permissions; see the [API reference](api-reference.md#sandboxed-plugins) |
+| `sandbox` | no | Defaults to `true`: an isolated worker with network fenced to your `network:` permissions. Declare `false` only if you need main-context APIs (markdown, DOM mounts); users must then accept a full-access warning. See the [API reference](api-reference.md#sandboxed-plugins) |

docs/recipes.md

@@ -210,7 +210,7 @@ export default {
 
 ## Sandboxed network plugin
 
-Set `"sandbox": true` and declare the hosts you call; `fetch` is fenced to them and the plugin runs in a worker with no DOM. See [the API reference](api-reference.md#sandboxed-plugins) for the available ctx subset.
+Plugins run sandboxed by default (a worker with no DOM); just declare the hosts you call and `fetch` is fenced to them. See [the API reference](api-reference.md#sandboxed-plugins) for the available ctx subset.
 
 ```json
 {

index.schema.json

@@ -68,7 +68,7 @@
         },
         "sandbox": {
           "type": "boolean",
-          "description": "Run the plugin in an isolated worker (no DOM, network fenced to its network: permissions). Only the non-UI API subset is available; see the docs."
+          "description": "Run the plugin in an isolated worker (no DOM, network fenced to its network: permissions). Defaults to true when absent; only an explicit false marks a full-trust plugin, which users must approve through a separate full-access warning. Only the non-UI API subset is available in the sandbox; see the docs."
         },
         "packageUrl": {
           "type": "string",

plugin.schema.json

@@ -57,7 +57,7 @@
     },
     "sandbox": {
       "type": "boolean",
-      "description": "Run the plugin in an isolated worker (no DOM, network fenced to its network: permissions)."
+      "description": "Run the plugin in an isolated worker (no DOM, network fenced to its network: permissions). Defaults to true when absent; only an explicit false opts into full trust, which users must approve through a separate full-access warning."
     },
     "packageUrl": {
       "type": "string",

plugins/com.glyph.dictionary-fa/manifest.json

@@ -4,6 +4,7 @@
   "description": "Persian (Farsi) spell-check dictionary, based on the Lilak project.",
   "version": "1.0.0",
   "apiVersion": "0.16.0",
+  "sandbox": false,
   "main": "main.js",
   "files": ["main.js", "assets/fa.aff", "assets/fa.dic"],
   "permissions": []

plugins/com.glyph.hello-status/manifest.json

@@ -3,6 +3,7 @@
   "name": "Hello Status",
   "version": "1.0.0",
   "apiVersion": "0.16.0",
+  "sandbox": false,
   "files": ["main.js"],
   "description": "Sample plugin: a status bar greeting and a command palette entry."
 }