Published · 1h agoBuild2 min read
Vercel puts agent-written TypeScript in QuickJS and makes host functions the real boundary
The Run SDK swaps eval's ambient authority for a worker-thread sandbox with narrow host functions and resumable interrupts. The replay semantics are the part to read twice.
Written for builders.See today for builders
What happened
- Vercel shipped the Run SDK, a package for executing untrusted JavaScript and TypeScript without handing it access to the surrounding application or system.
- Code is evaluated in a fresh QuickJS context inside a worker thread, with no direct route to Node.js or the network.
- Applications expose named host functions as sandbox globals, so a program can call store.listOrders() while the database client and its credentials stay outside.
- An interrupted run returns a signed token the application saves with the approval request and later uses to resume the run.
- The same package is the internal module behind code mode tool execution in the AI SDK.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraintAny host function that writes and can be in flight when an approval fires needs an idempotency key, because replay will not have a recorded result for it.
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Vercel released the Run SDK, a package for executing untrusted JavaScript and TypeScript without giving it direct access to the application or system, installed with `pnpm add run`.
- [2]
Vercel states that executing agent-written code with eval gives it the same access as the application around it, including its secrets and internal services, and leaves no durable way to pause at authentication or approval boundaries.
- [3]
The Run SDK evaluates JavaScript or type-stripped TypeScript in a fresh QuickJS context inside a worker thread, with no direct route to Node.js or the network.
- [4]
Applications expose selected operations through hostFunctions, which become callable globals inside the sandbox; in Vercel's example the program calls store.listOrders() while the database client and its credentials remain in the application.
- [5]
Calls cross the sandbox boundary through serialization, and a host function may return a promise, so existing service clients can sit behind the interface without being passed into the sandbox.
- [6]
A host function can obtain a context via getHostFunctionContext() and, when no resume value is present, call context.interrupt() with a kind such as 'approval' and a message when generated code reaches a sensitive operation.
Sources & coverage · 1 publisher
The reporting this story was synthesized from, earliest first. Every link goes to the original.
- blog.vercel.comAayush Kapoorjust nowIntroducing Run SDK: secure eval for your agents
Additional citations
- Vercel blog
