Toolsmith Weekly

Issue #3

Sandboxes, Interrogations and a Billiards Bot

Friday, Nov 6, 2026

Two sandboxes turned out less sealed than their names suggested. Also: an iPhone app that wants to replace your laptop for app building, three agent tools for builders, and two small games that get creative with AI.

Toolsmith Weekly #3 · Oct 30 to Nov 6, 2026 · Website edition

Two sandboxes this week turned out to be less sealed than their names suggested, and that's where the security section starts. The rest is lighter. There's an iPhone app that wants to replace your laptop for app building, three agent tools for builders, and two small games that get creative with AI: one borrows the chatbot you already have, the other runs a tiny model in your browser.

Mobile-First

ProductOS Mobile 1.1

Mobile tier: Cloud-Powered Mobile (per the App Store listing). Now live on the App Store for iPhone and iPad. ProductOS says a coding agent does the building in a cloud sandbox while you direct it from the phone.

ProductOS Mobile tries to fit a whole app studio onto an iPhone. You describe a mobile app, website or web app by typing, dictating or photographing a sketch, and the agent builds it. ProductOS says you can then preview the live app, manage Git, the database, secrets and storage, and deploy to the web, all from the phone. It also says you can build Expo apps and submit them to the App Store or Google Play, with "no Xcode, no Android Studio, no laptop." The app has been on the App Store since Oct 30, 2026. Version 1.1.0 arrived on Nov 4 and adds what ProductOS calls a hands-free voice mode for talking to the agent.

The app is free and runs on ProductOS plan credits, and new accounts start on the free Hobby plan with 200 credits. Store submission needs a paid plan. Paid plans start at $20/month for Pro (pricing, checked Nov 5, 2026). Apple and Google developer-account fees are separate.

ProductOS Mobile · Our listing

Builders

OpenCode v2.2.3

OpenCode, the open-source coding agent, added a Claude Agent provider in v2.2.3 on Oct 30. It runs Claude models through your own Claude Code login, using the Claude Agent SDK. To set it up, install Claude Code, run claude auth login, then choose Claude Agent in /connect. Claude Code has to be installed on the same machine as the OpenCode server, and the provider isn't available in remote workspaces. It's for people who already use Claude Code. According to OpenCode, a Claude subscription adds no cost because "your plan covers it." An OpenCode developer said on the pull request that the project has Anthropic's permission, and Anthropic hasn't publicly confirmed that. Anthropic's legal and compliance page bars third-party developers from routing requests "through Free, Pro, Max, or Ultra plan credentials on behalf of their users," but allows a user to sign in to "the unmodified Claude Code binary" with their own subscription. Its Agent SDK docs bar offering claude.ai login in third-party products "unless previously approved." Whether this setup complies is unconfirmed.

dsh-superagent-prototype

dsh-superagent-prototype is a research prototype from DeepSeek, first committed on Oct 31. Its README describes it as "a proactive coding agent for one GitHub repository, packaged as a bundle for DeepSeek Harness." It listens to GitHub and, optionally, Feishu. When someone allowed asks it for work, it answers in the original conversation, for example with a pull request. A web panel shows what needs a person. The README is upfront that this is a "research prototype for reference only, not an official DeepSeek product" and "not production-ready software." It's for builders curious about how a proactive repo agent can be put together.

  • Price: free and open source (MIT)
  • Mobile tier: Unknown. The README and SETUP don't describe any phone use, and setup needs a self-hosted server with a terminal toolchain.
  • Docs: README
  • Listing: Toolsmith Weekly listing

agent-desktop v1.0.2

agent-desktop from Vercel Labs has been around since February 2026, and v1.0.2 shipped on Oct 30. It's written in Rust and lets agents operate desktop apps through the OS accessibility tree. In its developers' words, it "sees any app's real UI structure through OS accessibility trees," so element references "stay stable and actions stay safe to retry, instead of guessing from pixels." Most computer-use agents still work from screenshots, so this is a different bet worth watching. It's for developers building agents that need to work with ordinary desktop software.

Experimental

The Teahouse Watch

The Teahouse Watch is a detective game for Chinese learners at about HSK 3, and it uses the AI chat app you already have instead of shipping its own AI. Each suspect comes as a text file. You paste it into your chat app, then question that character in Chinese, by typing or by voice. It's a clever way to turn an open-ended chatbot into structured speaking practice with a reason to keep asking questions. According to the developer, it works on the free plans of popular chat apps, and about 99% of the words the characters used fell within HSK 1 to 3. Both are the developer's own claims. It came out on itch.io on Oct 31 and is $9.74 in a 25%-off Halloween sale (regular price $12.99).

Mobile tier: Unknown. The game runs inside your own chat app, but the store page gives no clear evidence of a phone setup.

Midgey's Midnight Mash

Midgey's Midnight Mash is a physics billiards game where five chatty AI bots talk while you play. A small language model, Qwen 2.5 0.5B, runs right in your browser over WebGPU, with a CPU (WASM) fallback and an offline physics-only mode. The interesting part is the project behind it. Bring Your Own Brain is open source under Apache 2.0 (commercial use allowed), offers a one-shot prompt template for building your own local-AI game, and runs an itch.io game jam. The developer says your prompts stay on your device, the model cache is shared across sites, and the game is mobile friendly; all three are the developer's own claims. The AI connector does load from the developer's server each time, so that server can see basic visit details like your IP address. It came out on itch.io on Nov 2.

Mobile tier: Unknown. The developer calls it mobile friendly, but that hasn't been confirmed.

Security

Prefab UI's Generative UI sandbox wasn't isolated (CVE-2026-120338, CVSS 3.1 score 10.0)

Mobile tier: Desktop Required

Who's affected: People running prefab-ui versions 0.14.0 through 0.20.2 with the Generative UI feature turned on. According to the GitHub advisory, Generative UI is opt-in and needs Deno installed on the host. The usual remote path is FastMCP's GenerativeUI provider, which registers the MCP tool generate_prefab_ui. The advisory says that on a FastMCP server with no authentication, any client that can reach the server can call the tool; with authentication, any client allowed to call tools can.

What happened: Prefab UI runs caller-supplied Python in Pyodide inside a Deno subprocess, and the advisory notes the feature is documented as isolation for untrusted code, including LLM-written UI. In the affected versions, the advisory says Deno started with unrestricted read, write and network permissions, and the Deno API stayed reachable from the Python code. As a result, that code could read and write files as the server's OS user, and could keep running code later by writing a .pth file into the virtualenv's site-packages. The advisory was published to the GitHub Advisory Database on Nov 1 and, as of Nov 3, hasn't been reviewed by GitHub.

What to do: Upgrade to prefab-ui 0.21.0, released Oct 26 per GitHub releases and PyPI. Per the advisory, 0.21.0 revokes Deno's read, write and network permissions before it accepts code, starts Deno with --no-prompt so those permissions can't be granted again, and limits bootstrap network access to cdn.jsdelivr.net.

Toolsmith Take: A sandbox is only as good as the permissions it starts with. If you've wired LLM-written code into an MCP tool, this is a good week to check what that code can actually reach.

Also this week: Beta9 sandbox escapes

Beta9, Beam Cloud's open-source serverless runtime, has three critical sandbox escapes, each rated CVSS 9.9 and each requiring a workspace token: CVE-2026-120306, CVE-2026-120307 and CVE-2026-120308. In the -120307 advisory, a read-only proof retrieved the worker's Kubernetes service account token, and the advisory notes that the shipped remote-node manifests bind that account to cluster-admin. All three are fixed in worker 0.1.756; -120308 also needs gateway 0.1.776. The advisories don't give affected version ranges (-120308 was confirmed against gateway 0.1.769 and worker 0.1.745). All three were published Nov 1 and haven't been reviewed by GitHub.

Mobile tier: Desktop Required

Researched, drafted and fact-checked with AI help; reviewed and approved by a human before publishing.

In the directory

These tools from the letter are listed at toolsmithweekly.com.