🔒 slopjail

slopjail is a sandbox for running untrusted JavaScript in the browser. It can be used to safely implement a code execution tool for browser-based AI agents, among other use cases.

> Status: Alpha ⚡

Features

- Tiny (~3 KB gzipped)
- Simple API: createSandbox() → run() → dispose().
- Expose variables and functions for untrusted code to access.
- Pretty good security:
* Code runs in a Web Worker on an opaque origin: no access to the host page's storage, cookies, or DOM.
* Network access is blocked by default using a strict Content-Security-Policy.
* Disables APIs like navigator to resist device fingerprinting.

Quickstart

Install:

``
npm install slopjail
`

Create a sandbox, run some code, and clean up:

`typescript
import { createSandbox } from 'slopjail'

const sandbox = await createSandbox({
globals: {
twenty: 20,
add: (a: number, b: number) => a + b,
},
})

try {
await sandbox.run('console.log(await add(twenty, 5))') // 25
} finally {
sandbox.dispose()
}
`

How it works

slopjail creates a hidden