@faustine-ai/browser-sandbox

@faustine-ai/browser-sandbox runs JavaScript written by a model in the browser, inside a Worker in a sandboxed iframe with an opaque origin. The code has no network, no DOM and no storage. It can call only the functions you hand it.

What it is

A Web Agent can act by writing a short program that calls your app's actions, and that program runs in the user's browser. Faustine built this library for that case and published it as a library of its own. It has no server part and does not depend on the rest of Faustine. You do not install it to use a Web Agent.

The functions the program calls run in your page, with the user's session. The program itself runs in a frame that has no cookies and whose content security policy refuses every network request. Text that the model read cannot make the program send data anywhere or touch the page.

A function can be marked as needing approval, and the call is then held until a person decides. Runs have limits on time, on the number of calls and on input and output size, and a run that exceeds the time limit is terminated.

When to use it

Use it in your own product when a model writes code that has to run in the user's browser: a code mode of your own, or one built with the AI SDK, Cloudflare codemode or TanStack AI. The package has an adapter for each of the three.

Install

npm install @faustine-ai/browser-sandbox

The documentation, the security model and the API reference are at browser-sandbox.faustine.ai. To run code in the sandbox without installing anything, open the playground.

Next steps

• Actions: what a Web Agent's program calls in your app.
• @faustine-ai/web-agent: the loader that installs the widget.