Partial-Sandboxing for Plugins

[TMS-Namespace]

I have some concerns currently with what plugins can do on my device: basically everything...

While doing a full sandboxing is definitely out of scope, maybe requiring proxing some dangerous operations through Dux API will add much more control over this, for example:

1. Requiring all outbound network connections to go through the proxy.
2. Requiring all file operations to go through the proxy.
3. Or providing some simple API to manage plugin cached assets.
4. Providing end user with history of all proxied operations.

For example during development my plugins, I found that there is even no kind of a hook that I can register to to perform cache cleanup before the plugin fully uninstalled.