The WASM dual-metered sandbox is interesting — how do you handle tools that need network access? Host function imports with capability-gated permissions?