FlowManner
Chat
Sign InGet Started
Flowmanner
Menu
  • Chat
  • Agents
  • Pricing
  • Docs
  • About
Products
  • Workflows
  • Templates
  • Changelog
  • Missions
Resources
  • Blog
  • API Reference
More
  • Careers
  • Contact
  • Security
  • Start
    • Quickstart
    • Your First Mission
    • Your First Eval
  • How-to
    • Connect Your Own Keys (BYOK)
    • Switch Models Per Task
    • Publish a Template
    • Run Evaluations
    • Chat with Artifacts & Previews
    • Automate via the API
    • Webhooks & Triggers
  • Concepts
    • Glossary
    • Execution Model
    • Models & Routing
    • Sandboxes & Previews
    • Memory & Privacy
    • Trust Model
  • Reference
    • Reference · API
      • Authentication
      • Missions & Runs
      • Chat & Sandboxes
      • Blueprints, Graphs & Templates
      • Evaluations & Feedback
      • Marketplace & Community
      • Files & Exports
      • Integrations & Webhooks
      • Agents & Orchestration
      • Auth, Workspaces & Billing
      • Memory & Knowledge
      • Notifications
      • Platform Services
    • Errors
    • Models
    • Limits

Sandboxes & Previews

Sandbox ownership, preview-domain isolation, and artifact delivery.

Sandboxes belong to someone

A sandbox is a short-lived runtime where generated code executes. Sandboxes created from chat register to their owner (control/runtime split-brain fixed in commit a838d249, 2026-08-25) — orphaned runtimes without an owner are reaped by a maintenance job rather than left running.

Previews are origin-isolated

Live previews render inside the app but are served from a dedicated wildcard origin, *.preview.flowmanner.com. The frontend Content-Security-Policy restricts embedded frames to exactly that domain (frontend/next.config.ts, CSP frame-src) — a preview cannot reach app cookies or storage because it is a different origin entirely.

Artifacts

Files a sandbox produces surface as chat artifacts attached to the message that created them; download them from there. Snapshotting endpoints (v2-sandbox-snapshots) let you checkpoint and restore sandbox state via the API.

Last updated 2026-08-25 (git-derived)

  • Sandboxes belong to someone
  • Previews are origin-isolated
  • Artifacts