Sandboxed Script Runner

The sandboxed script runner is the VibeControls concept for testing code you do not fully trust yet. A script written by a coding agent, a snippet lifted from a pull request or a one-off maintenance task can run inside an isolated, short-lived sandbox with fixed CPU and memory limits, instead of on a developer laptop or a shared server.

Coding agents now produce scripts faster than people can read them, and the quickest way to learn what a script does is to run it. Running it directly on a real target risks side effects that are hard to undo. The design separates the trial run from the real one: the script executes in a sandbox first, its output is reviewed, and only then is it promoted to the machine it was meant for.

The illustration shows a single sandbox page. A header card gives the sandbox name with a running status, a copyable identifier, a copyable sandbox URL and a countdown of the time remaining, with an Extend link, a Refresh button and a menu to extend the time to live, stop or delete the sandbox. Three cards summarize its resources (CPU and memory in use against their limits, and the number of containers), its lifecycle (time to live, time until expiry and creation time) and its details (the runtime template, the run mode and who created it). Below, the Script Runner section offers an interpreter picker, a name for the run and a code editor, shown holding a short Python command that runs a test suite.

Sandboxes sit in the Infrastructure section beside managed tunnels and are designed to pair with the AI Workbench, giving scripts proposed by coding agents a safe place to prove themselves. Because each sandbox belongs to the workspace and expires on its own schedule, experiments do not pile up as forgotten machines, and the time limit can be extended when a run needs longer.