Introducing Run SDK: secure eval for your agents

The Run SDK addresses a fundamental tension in agent development: generated code needs to coordinate real application operations, but giving it direct access creates security and observability problems. By moving execution into a QuickJS sandbox inside a worker thread, the SDK removes eval's ambient authority. The application retains control over what the code can do through host functions, which act as narrow gates between the sandbox and the rest of the system.

Host functions serve as both capability boundaries and audit points. Each exposed function becomes a potential interruption point where the application can enforce policy, request human approval, or inject authentication. The SDK's interruption mechanism preserves completed work through result replay, allowing workflows to pause without restarting from scratch. This design pattern shifts security from runtime monitoring to interface design - sensitive operations must be explicitly exposed as host functions rather than being accessible through ambient authority.

The sandbox model imposes practical constraints that engineers must account for. Host functions communicate through serialization, which limits what can be passed across the boundary. The QuickJS environment lacks Node.js APIs, requiring host functions to handle any necessary filesystem or network operations. While the SDK provides timeout controls, engineers must still design host functions to be idempotent and safe for replay. These constraints make the SDK better suited for orchestration logic than for arbitrary code execution.

For agent developers, the SDK changes how they structure multi-step operations. Instead of generating sequences of API calls that the application executes, agents can now generate complete programs that express both the calls and the logic connecting them. This enables more sophisticated coordination patterns, like concurrent requests with local filtering, while keeping the agent's context window focused on the final result. The tradeoff is that generated code must stay within the sandbox's capabilities and the host function interface.