improve sandboxing, remake the externals system a bit