Vercel puts agent-written TypeScript in QuickJS and makes host functions the real boundary

What `eval` actually hands a generated program is ambient authority. Vercel's framing is that evaluated code gets the same access as the application around it, secrets and internal services included, with no durable way to pause at the points where an auth check or a human should intervene ^[2]. The QuickJS interpreter is the advertised fix, but the boundary doing the work is serialization: calls leave the sandbox as serialized values, and a host function may return a promise, so an existing service client sits behind the interface rather than being passed across it ^[5].

The resumption contract deserves a slow read. Replay is how a resumed run gets back to where it stopped. The program body runs again, and settled host function calls return their recorded results instead of repeating the work ^[8]. A run with one approval gate therefore executes its program body twice, once up to the interrupt and once after the decision ^[15]. The memoization covers only calls that had settled, which means a call still in flight when the interrupt fires has no recorded result and executes a second time on resume ^[9]. That is a property of the design rather than a defect in it, and it decides which host functions can safely sit next to an interrupting one.

The interrupt itself is a call inside the host function: read the context, and if no resume value is present, raise an approval with a message ^[6]. That is a sound shape, and it also marks what the sandbox declines to do. It governs what the program can reach, not whether reaching is correct. Vercel concedes as much in recommending `orders.refund(id)` over a generic request function, on the grounds that the specific function gives the application a clear place to check the user and the order ^[10]. A program written under the influence of a hostile document is inside the boundary the moment it calls a function you chose to expose. What stands there is the check you wrote, plus a person for the expensive operations.

The efficiency case is separate from the security case and will probably close faster. One model response can carry several calls and the logic joining them, two lookups run concurrently, filtering stays inside the program, and only the result returns ^[12]. Vercel's example is a support agent inspecting an account without the entire billing response landing back in its context ^[13].

The playground is the honest summary: code you run there can reach only the host functions on that page ^[14]. Everything this buys you is the size of that list.