Problem

The extension sandbox (SandboxHost ↔ sandboxWorker) has two message routing bugs that make the Worker→Host communication channel non-functional:

Bug 1: aion.storage API calls hang indefinitely

When a sandboxed extension calls aion.storage.get/set/delete, the Worker sends an api-call message to the Host. But SandboxHost.handleMessage() has no case 'api-call' — the message falls through to default: break and is silently dropped. The Worker's pendingMainCalls Promise never resolves or rejects, causing the extension code to hang forever.

Root cause: sandbox.ts:218-247 — handleMessage() only handles api-response, log, and event, not api-call.

Bug 2: Extension events and UI messages silently dropped

When a sandboxed extension calls aion.emitEvent() or aion.postToUI(), the Worker sends an event message. But the Host's case 'event' is an empty break — events are never forwarded to extensionEventBus or the renderer process.

Root cause: sandbox.ts:241-243 — comment says "handled by event bus" but no code exists.

Additional issue: No timeout on Worker→Host calls

callMainThread() in sandboxWorker.ts creates Promises without timeouts. Combined with Bug 1, this means any aion.storage.* call will hang forever with no error.

Summary

Fix

• Add case 'api-call' to handleMessage() with generic apiHandlers routing
• Forward event messages: ext:* → extensionEventBus, ui-message → onUIMessage callback
• Add 30s timeout to callMainThread()
• Create ExtensionStorage as backing KV store for aion.storage API