Skip to main content

I/O overview

An inferlet runs inside a WASI sandbox. From inside, it can:

  • Stream events to the client that launched it.
  • Read from a sandboxed view of the host filesystem.
  • Issue HTTP requests.
  • Connect to MCP servers the host has registered.

This page lists those surfaces and where each is supported today. The pages that follow cover each surface in detail. Read this after Generation overview.

The four surfaces​

SurfaceWhat it doesRustPythonJavaScript
SessionStream events to the launching client. Receive client messages, files, signals.✓✓✓
FilesystemRead/write the sandboxed file tree the host granted.✓✓✓
HTTPIssue HTTP requests to external services.✓pendingpending
MCPConnect to host-registered MCP servers.✓✓✓

The HTTP path is fully supported in Rust today via wstd::http. The Python and JavaScript SDKs do not yet bind WASI HTTP. The Tutorial shows the intended Python and JS API shape.

Where each runs​

These surfaces share one event loop. An inferlet that fetches a URL, listens for client messages, and runs a generation loop concurrently is normal: each await yields to the others.

The model's forward passes do not stall waiting for I/O. The engine schedules forward passes from one inferlet alongside passes from every other inferlet, regardless of what each is awaiting.

What goes where​

A rough map of which surface fits which job:

  • "Stream tokens to the user as they generate." → Session: session.send from inside the chat decoder loop.
  • "Cache reasoning state across runs." → Filesystem: write a JSON file the next run reads.
  • "Look up a fact from Wikipedia mid-generation." → HTTP: wstd::http::Client::send (Rust today).

Tool calls in particular often combine two surfaces: HTTP for the actual request, plus the tool-call parser to parse the model's structured calls.

Sandbox boundaries​

Inferlets cannot:

  • Access files outside the directories the host explicitly grants.
  • Open arbitrary network sockets. HTTP goes through the engine-mediated client.
  • See processes, environment variables, or filesystems on the host.

These restrictions are by design: a Pie engine can run untrusted inferlets from many tenants concurrently without privilege escalation between them.

Next​