Make VM sandboxing optional

I know this may be controversial, but considering that VM may not be foolproof, perhaps an option to not use VM may be useful? E.g., if the host app only allows running vetted plugins.

VM causes issues with plugins intended to run in window context. I have troubles accessing setTimeout, Blob and other native window features. Also it breaks React’s useEffect, although that can be worked around by passing the plugin useEffect implementation from the host (so far I can’t find workarounds for native window features).

(Context: I’m working on a project that uses plugins in Electron, and plugins provide both components that run in Node context and components that run in browser window context.)

[strogonoff]

I should withdraw this request, as no-VM loading of trusted code is actually straightforward to do per my previous comment. Plugin manager is still handy for installing plugins from NPM and running plugin’s Node (main thread) code within VM sandbox.

[strogonoff]

I think by running VM-loaded module in browser context I was stretching what VM was intended to do, and passing native window functions to VM sandbox would not be possible any time soon. Considering plugin code is trusted, plain require() may be the way to go in browser context. Conveniently, PluginManager’s getInfo()?.location can be used to construct the path to require. Thanks for this useful package!