Extensible Software — Gemini 3.8 Flash one-shot demo

CHAPTER 01 The Economics of Features

The Long Tail of Unmet Needs

Most web software is stubbornly static. Product teams obsess over the head of the demand curve: features that appeal to the fat middle of the market. They build Google OAuth, CSV export, dark mode, and multi-factor authentication.

Meanwhile, thousands of individual, idiosyncratic workflows remain permanently stranded in the long tail. Why? Because product development is an act of triage. Every additional setting, toggle, or secondary button introduced to appease a single user adds cognitive friction, maintenance debt, and confusion for everyone else.

Interactive Model: The Demand Curve vs. Feature Bloat

Scrub along the user distribution curve or inject tail features to witness usability collapse.

Mode:

The Mass Market Head (Served by Developers)

The Stranded Long Tail (Unmet Needs)

Position along Demand Curve: Rank #12: The Fat Middle

BUILT IN CORE Dark Mode & Full-Text Search

Requested by 78% of user base. High ROI for developers to build and maintain into the core product.

Economic Status

Core Product ROI > 50x

CHAPTER 02 Malleable Logic

Software Has Gotten “Squishy”

Historically, software was cast in bronze. Product requirements took quarters to spec, weeks to code, and days to deploy. But in 2026, software has become malleable—almost squishy.

Pete Koomen introduced the idea of “Small Software”: hyper-personalized, single-purpose software written for an audience of exactly one. Inflection’s Pi showcased what an LLM-native application feels like when a battle-tested core can be endlessly molded simply by chatting with it.

Yet today, virtually all pluggable software lives inside local desktop applications: Neovim scripts, VS Code extensions, Obsidian vaults, Blender Python add-ons, or Minecraft mods. These tools empower power users because their runtime boundary is local. The web—the single greatest distribution engine in human history—remains largely locked out.

Rigid SaaS (The Monolith)

Vote on Roadmap, Wait 18 Months

01. Submit feature request to Canny; gather 45 upvotes over two years.
02. PM rejects it because it serves < 0.2% of Total Addressable Market.
03. User forced into janky Zapier workflows, fragile webhooks, or spreadsheet copy-pasting.

Squishy Software (Software for One)

Describe It, Extrude It, Run It

01. User asks LLM: “Whenever I star a post > 4,000 words, push it to my Kindle.”
02. LLM extrudes 15 lines of safe, typed TypeScript implementing the extension hook.
03. The web app mounts the code inside an isolated sandbox instantly. Customization is shareable via URL.

CHAPTER 03 The Core Hypothesis

The Hypothesis: A New Web Opportunity

Two distinct technological arcs are converging to unlock something brand new:

Generative LLMs collapse the authoring cost of bespoke code to near zero. Anyone can express a desire in natural language and receive working code.
Modern Sandbox Primitives collapse the hosting, isolation, and runtime cost to fractions of a millisecond and pennies per million invocations.

The opportunity is clear: Build a rock-solid, accountable core product, and let users safely extend it by having an AI extrude the missing pieces.

Contrast this with the status quo: Webhooks. If you want to customize an app today, you must stand up an external service on AWS or Render, manage TLS certs, rotate webhook secrets, handle retries, pay idle server bills, and suffer network round-trip latencies.

Architectural Comparison: Webhook vs. In-App Extension

HOST APPLICATION

Read-It-Later App

1. Fires HTTP POST Webhook

Payload: 250KB Article JSON

THE PUBLIC INTERNET

DNS • TLS Handshake • Latency (180ms)

⚠️ Network drops, retry storms, queue delays

USER-MANAGED INFRA

AWS Lambda / VPS

2. Parses secret signature

Cost: $5-15/mo idle or cold start penalties

The Friction: Requires a developer mindset, credit card for cloud hosting, DNS management, and uptime monitoring for a simple 10-line personal rule.

Three Concrete Read-It-Later Extensions Powered by this Model:

01. The E-Reader Push

“Send every article I fave longer than 4,000 words directly to my Kindle at 10 PM.”

02. ArXiv Semantic Tagger

“Summarize new machine learning papers in my subfield weekly, tag citations, and categorize.”

03. Custom DOM Cleaner

“Run a custom HTML parser for paywalled news blogs whose JS scrambles article paragraphs.”

CHAPTER 04 Real-World Frontiers

Where This Matters

Safe, programmatic extensibility isn't an academic novelty. It is becoming the linchpin across four major software verticals:

Self-Extending Agent Runtimes

Agents That Author Their Own Tools

Platforms like Pi, DeepSeek, and OpenCode are experimenting with prompt-driven self-extension. When an agent discovers it lacks a specific capability, it doesn't wait for a core app update—it writes an extension on the fly.

"In OpenCode, nearly everything is an internal plugin — 68 of them — which means any behavior can be disabled and the plugin APIs are properly dogfooded."

— OpenCode Architectural Pattern

OpenCode Plugin Bus 68 Registered

plugin-git-blame ACTIVE

plugin-ast-grep ACTIVE

plugin-linter-rules ACTIVE

plugin-auto-test-runner ACTIVE

CHAPTER 05 Security & Sandboxing

Why It’s Hard: The Threat Wall

If extensibility is so powerful, why hasn't every web app adopted it? Because running untrusted, arbitrary user code on your servers is one of the most perilous engineering challenges in computer science.

Consider Obsidian. Obsidian’s open plugin ecosystem is beloved, but it rests on a premise of total trust: every community plugin has unfettered access to your local filesystem and network. That works for a local markdown notes vault. It is an immediate catastrophe for multi-tenant web applications holding customer credit cards, HIPAA records, or private messages.

The Untrusted Code Gauntlet: 6 Critical Vectors

Select an attack payload to simulate what happens without proper sandbox boundaries.

THREAT SIMULATOR

Ready to Test Vector

HOST STATUS: NORMAL

// Click an attack button above to inspect malicious user code

Without Sandboxing (The Naive Host)

Click an attack above to evaluate consequences.

Required Architectural Primitive

Hardware & runtime boundaries that defuse this attack vector.

CHAPTER 06 Historical Precedent

The Existence Proof: Salesforce (2007)

Whenever engineers proclaim that running arbitrary customer code inside a multi-tenant web application is impossible, there is a giant counter-example standing in the middle of San Francisco: Salesforce.

In 2007—before AWS S3 or EC2 had even celebrated their first birthdays—Salesforce rolled out Apex. They proved that thousands of enterprises could run custom logic directly in response to database triggers, scheduled batch jobs, and REST endpoints on shared infrastructure.

To make this work in 2007, Salesforce had to construct an entire world by hand: a custom compiler, custom AST validator, custom bytecode, strict transactional governor limits, and a massive certification ecosystem.

Apex Code (Circa 2007–Present)

Scheduled 2:00 AM Account Renewal Batch

global class RenewalBatchJob implements Schedulable {
  global void execute(SchedulableContext ctx) {
    // Governor Limit: Max 100 SOQL queries per transaction
    List<Account> expiring = [
      SELECT Id, Name, OwnerId 
      FROM Account 
      WHERE Renewal_Date__c = NEXT_N_DAYS:30
      LIMIT 200
    ];

    for (Account acc : expiring) {
      acc.Needs_Review__c = true;
    }
    
    // Atomic DML within transactional boundary
    update expiring;
  }
}

Salesforce Governor Limits Check

SOQL Queries: 1 / 100 max

CPU Time: 14ms / 10,000ms max

Heap Allocation: 0.4MB / 6.0MB max

In 2007, building this required a custom runtime. In 2026, modern primitives offer this out of the box.

CHAPTER 07 The Runtime Architecture

The New Primitive: 5 Required Properties

What does a modern runtime primitive look like if it is to succeed where 2010s webhooks failed? Jeremy Morrell identifies five non-negotiable architectural properties that any extensible system must satisfy.

1

Cheap to Run (~$0 Idle, High Density)

< 5MB / Tenant

Most user extensions will sit idle 99.9% of the day, waiting for an event. If hosting a user extension requires provisioning a persistent Docker container taking 200MB of RAM, the business model dies instantly. The runtime must pack tens of thousands of idle tenants onto a single machine with zero idle cost.

DOCKER CONTAINER

~250MB Base

MICRO-VM (FIRECRACKER)

~5MB Base

WASM RUNTIME

< 2MB Base

V8 ISOLATE

< 3MB Base

2

Fast Cold Starts (< 5 Milliseconds)

Critical Path Safe

If an extension executes on the critical request path (such as transforming an article’s HTML before rendering to the reader), a 300ms serverless container cold start feels like a frozen web page. The primitive must start in single-digit milliseconds.

Cold Start Latency Target: 1.5ms (Isolates) vs. 450ms (Node Container)

3

Fine-Grained Limit Controls (The Heroku Lesson)

Gas & Quotas

You must be able to strictly cap: CPU wall time, memory bytes, network request counts, response buffer sizes, and log volume. Morrell recounts the famous Heroku incident: a beginner tutorial app ran while True: print("hello world!") and immediately spewed millions of log lines per second, knocking down shared logging aggregators.

Heroku Log Disaster Safeguard: Max 100 log lines / sec burst limiter

4

Solid Isolation Boundary (Fault & Security)

Spectre Resistant

Fault Isolation: A memory bomb or segfault in user A’s extension must never kill user B’s thread.
Security Isolation: Untrusted code must not escape its sandbox or read CPU cache states across tenants via speculative execution attacks (Spectre).

5

Safe Action Through Capabilities

The Subtlest & Most Critical Idea

POLA ARCHITECTURE

How do you let code do useful work without giving away the farm?

The Pure Function Model: Input in, answer out (like a function deciding if you should order pizza based on weather). Completely safe, but completely useless for real web apps that need to send an email, write a row, or notify a Slack channel.
The Raw API Key Model: Pass the user's Twitter or Stripe API key into the script. Catastrophic: the script can silently POST the key to an attacker's server.
The Validating Proxy Model: Route requests through an internal proxy that allowlists domains. But regex path filtering quickly devolves into an unmaintainable tangle of edge-case bypasses.
The Capability Model (The Winning Answer): Strip ambient I/O entirely (no global fetch, no process.env). Instead, pass in an object of narrow, high-level function handles—like IFTTT giving you twitter.postTweet(text) rather than a bearer token.

Architectural Deep Dive:

The Evolution of Extensibility Code

SAFE BUT LIMITING

The Pure Function Paradigm

Inputs in, outputs out. Impossible to leak secrets or crash hosts, but unable to mutate databases or perform HTTP interactions.

Verdict: Inadequate for real SaaS apps.

Interactive Hacker Challenge:

Attempt to Steal Stripe Secret Key (sk_live_9921...)

Untrusted Extension Code Ambient I/O Active

// Code will display based on model

Sandbox Security Monitor

[Sandbox initialized]

Waiting for execution trigger...

Status: Ready

LLM Token Bonus: Typed capabilities (TypeScript interface) require ~120 tokens for an LLM to generate against, compared to ~18,000 tokens for a sprawling OpenAPI JSON spec!

CHAPTER 08 Pragmatic Comparison

The Technology Options

There is no single silver bullet. Morrell surveys the landscape of realistic sandbox primitives, presenting an honest evaluation of trade-offs rather than a sales pitch.

RUNTIME PRIMITIVE	COLD START	MEM / TENANT	ISOLATION	CAPABILITY MODEL	ECOSYSTEM / COMPILATION
Interpreters Lua, QuickJS, Custom AST	< 0.5ms (Instant)	< 1MB	Host Memory Safety	Native (Inject Host Objects)	Custom Dialect / No npm
V8 Isolates Cloudflare, isolated-vm, celld	1–5ms	2–5MB	Process/Isolate Boundary	Zero ambient I/O by default	Full JS/TS, massive npm base
MicroVMs Firecracker, libkrun, Daytona	150–800ms	5–15MB	Hardware Hypervisor (KVM)	Requires gRPC / proxy layer	Real Linux kernel, any binary
WASM + WASI Wasmtime, Extism, Cap'n Web	< 1ms	< 2MB	Linear Memory Isolation	Explicit Host Imports Only	Compilation toolchain cost

💡 Key Architectural Takeaway: These options compose. For example, WASM modules can execute inside V8 Isolates or MicroVMs. And where primitives lack fine-grained object capabilities, protocols like Cap’n Web provide distributed object capability routing.

CHAPTER 09 State of the Art

Cloudflare Dynamic Workers (2026)

⚠️

Author Disclosure: Jeremy Morrell is an engineer at Cloudflare and explicitly discloses this in his essay. He highlights Cloudflare Dynamic Workers not as an exclusive product pitch, but because it represents the closest turnkey production framework uniting all five required properties today.

Why does Dynamic Workers stand out in 2026? Because it bridges the entire lifecycle of an AI-extruded extension without requiring you to stitch together five disparate cloud vendors:

01. OBSERVABILITY

Built-in OpenTelemetry

Trace spans for every micro-execution with zero custom SDK instrumentation.

02. PER-USER STORAGE

Durable Object Facets & SQLite

Each user extension gets an isolated embedded SQLite database or R2 bucket facet.

03. DURABLE EXECUTION

Dynamic Workflows

Sleep for 7 days or await human review without burning CPU memory.

04. ITERATION & DIFFS

Built-in Source Control

Roll back bad extension edits instantly with immutable versioned asset trees.

05. EMBEDDED AI

Workers AI with Token Quotas

Inference on Llama/Mistral directly at the edge with hard-capped usage budgets.

06. ZERO DOCKER BUILD

Self-Hosted JS Tooling

Transpiling, bundling, and type-checking user TS happens in-isolate in milliseconds.

CHAPTER 10 Synthesis & Playground

The Joy of Surprising Software

“Platforms are hard to design, run, and debug — but worth it, because you can be genuinely surprised by what your users build.”

Experience the complete workflow right here in your browser. Choose an app domain, state your desire, let the simulated LLM extrude the capability-bounded TypeScript, and run it safely in our simulated isolate:

The Extensible Software Playground

From Natural Language Prompt to Sandboxed Execution

Target App:

1. User Natural Language Intent (What do you want the app to do?):

Extruded Safe TypeScript Zero Ambient I/O

// Click "Extrude Code" to generate capability-bounded script

Isolate Execution Output

[Ready] Isolate memory initialized (<2.1MB).

Awaiting trigger event...

Live Host Application DOM Mutation:

PocketMark Status: Extension Hook Active: Kindle Auto-Sync On

Extensible Software
in the Age of LLMs

The Long Tail of Unmet Needs

Interactive Model: The Demand Curve vs. Feature Bloat

Software Has Gotten “Squishy”

Vote on Roadmap, Wait 18 Months

Describe It, Extrude It, Run It

The Hypothesis: A New Web Opportunity

Architectural Comparison: Webhook vs. In-App Extension

Where This Matters

Agents That Author Their Own Tools

Governance for Shadow AI Tools

From Static Forms to Programmable Desks

Programmable Ingestion & Triage

Why It’s Hard: The Threat Wall

The Untrusted Code Gauntlet: 6 Critical Vectors

The Existence Proof: Salesforce (2007)

The New Primitive: 5 Required Properties

Cheap to Run (~$0 Idle, High Density)

Fast Cold Starts (< 5 Milliseconds)

Fine-Grained Limit Controls (The Heroku Lesson)

Solid Isolation Boundary (Fault & Security)

Safe Action Through Capabilities

The Evolution of Extensibility Code

The Pure Function Paradigm

The Technology Options

Cloudflare Dynamic Workers (2026)

The Joy of Surprising Software

Extensible Software in the Age of LLMs

The Long Tail of Unmet Needs

Interactive Model: The Demand Curve vs. Feature Bloat

Software Has Gotten “Squishy”

Vote on Roadmap, Wait 18 Months

Describe It, Extrude It, Run It

The Hypothesis: A New Web Opportunity

Architectural Comparison: Webhook vs. In-App Extension

Where This Matters

Agents That Author Their Own Tools

Governance for Shadow AI Tools

From Static Forms to Programmable Desks

Programmable Ingestion & Triage

Why It’s Hard: The Threat Wall

The Untrusted Code Gauntlet: 6 Critical Vectors

The Existence Proof: Salesforce (2007)

The New Primitive: 5 Required Properties

Cheap to Run (~$0 Idle, High Density)

Fast Cold Starts (< 5 Milliseconds)

Fine-Grained Limit Controls (The Heroku Lesson)

Solid Isolation Boundary (Fault & Security)

Safe Action Through Capabilities

The Evolution of Extensibility Code

The Pure Function Paradigm

The Technology Options

Cloudflare Dynamic Workers (2026)

The Joy of Surprising Software

Extensible Software
in the Age of LLMs