[cramforce]

Adds a new skill, Offloading work to a Vercel Sandbox (skills/offload-to-sandbox). It's about using the vercel sandbox CLI as remote workers for heavy builds, full test suites and many parallel (agent) tasks, so they don't load the local machine. It complements vercel-sandbox, which covers running untrusted code through the SDK.

The content comes from a multi-week performance program in which a dozen coding agents shared one laptop and offloaded builds and sharded test suites to Vercel Sandboxes. It is written to be project-agnostic:

• when to offload and what to keep local
• a base snapshot built once (pinned toolchain, pre-built baseline tree, helper scripts)
• one sandbox per task: naming, sizing (2 GB per vCPU and the OOM risk), lifetime vs exec timeouts, tags
• pushing source as a tarball of git-known files while keeping node_modules and build artifacts
• running commands: quoting pitfalls (zsh globs and modifiers), script files, detached long jobs with an exit-status file
• getting results back as small files
• sharding suites; separating pre-existing failures from new ones against an untouched baseline
• auth, a small wrapper script plus a SANDBOX.md for agents, cost and cleanup, and designing for restarts

Also adds the required ⤳ skill: offload-to-sandbox node to the ecosystem graph in vercel.md.

bun run validate passes. The CLI flags were checked against vercel sandbox --help from Vercel CLI 62.1.0.

---

Update (@molebox)

Merged main and fixed the review findings against the Sandbox CLI source (vercel/sandbox packages/sandbox, the sandbox@4.4.0 that vercel@64.5.0 bundles), the vercel sandbox wrapper in vercel/vercel, and the Sandbox pricing and persistence docs.

• Lifetime and cleanup: sandboxes are persistent by default. Task sandboxes are now created with --non-persistent, and cleanup uses remove. stop only ends a session, and a stopped sandbox's name stays taken. The orphan sweep uses list --all --tag …, because list shows only running sandboxes by default.
• Plan limits: added a table (Hobby 4 vCPU / 45 min, Pro 8 / 24 h, Enterprise 32 / 24 h, 2 GB per vCPU, --vcpus must be 1 or even). Examples use Pro sizes and say so. --timeout is described as the session length. The OOM advice respects the vCPU cap.
• vercel sandbox exec always exits 0, even when the remote command fails. The vercel wrapper hands off to the Sandbox CLI and returns 0 (confirmed against 64.5.0). The sbx wrapper now returns the real remote status.
• snapshot prints its ID only to stderr (spinner), so > BASE_SNAPSHOT wrote an empty file. The skill now reads stderr.
• copy needs a file path destination. A missing source exits 0, so sbx get checks that the file arrived.
• Auth and scope: the order is --token, VERCEL_AUTH_TOKEN, VERCEL_TOKEN, then the login session, with OIDC only as a fallback. vercel sandbox doesn't read .env.local.
• Wrapper script: now a complete POSIX script (push defined inside), and it refuses to push from outside a git repo. All shell blocks pass sh -n/dash -n/bash -n and shellcheck.
• Companion files: README row, counts set to 37 (assumes [skills] Add vercel-tracing skill #336 merges first), and tests/offload-to-sandbox-skill.test.ts. The test covers prompt routing (with negatives), the split with vercel-sandbox (offload/shard added to its noneOf), shell parsing, plan-limit and persistence checks, and the sbx script run against a stub vercel.

Checks: validate, build:*:check, and bun run test (1157 pass). I didn't create real sandboxes; behaviour was verified from source, docs and stubs.

[vercel-security-reviewer]

Security review details