Lathe: sandbox tools for Open WebUI

Lathe connects a model in Open WebUI to a Linux sandbox. The model can run commands, edit files, use a persistent Python session, delegate longer jobs, and give the user browser access. An admin installs one Python tool; Lathe provisions and reconnects one Daytona sandbox per user.

System

Four parts, with distinct jobs

Open WebUI

Hosts the conversation, model connection, and Lathe tool code.

Lathe

Translates tool calls, manages sandbox lifecycle, and returns results.

Daytona

Hosts the sandbox VM, filesystem, network access, and signed service URLs.

Your model

Chooses and calls the tools. Lathe works with models Open WebUI can use.

This arrangement puts a coding-agent workspace behind a chat interface. It does not make the workspace local or provider-free: Open WebUI, the selected model runtime, and Daytona remain part of the trust boundary.

Demo

From request to working environment

A live conversation on a deployed Open WebUI instance: enable Lathe, inspect a repository, open its sandbox in VS Code, stop the service, and delegate a focused code review. Capture source

Working model

Files persist; processes do not

A user returns to the same sandbox across conversations. Files, repositories, and installed packages on its filesystem survive ordinary stops and archives. A new tool call starts the sandbox again when needed.

Running servers, shell processes, and in-memory Python state are lost when the sandbox stops or archives. The default configuration stops an idle sandbox after about 15 minutes and archives it 60 minutes later. Administrators can change these intervals.

Conversation context is separate from sandbox state. handoff() prepares a compact record for a new conversation; it does not copy or preserve model context automatically.

Tools

A small interface to the sandbox

bash

Run non-interactive shell commands. Long commands continue in the background.

read · write · edit

Inspect numbered line ranges and make explicit file changes.

glob · grep

Find files and search text contents with comma-separated globs, ! exclusions, and ** path-component recursion. Brace expansion is not supported.

view

See images from the sandbox: screenshots, charts, rendered pages.

interpret

Run Python in a chat-scoped REPL whose variables survive between calls.

delegate

Give a bounded, multi-step task to a sub-agent working in the same sandbox.

expose

Create temporary browser access to a static site, web service, file browser, private lightweight terminal, or browser IDE.

onboard · lathe

Load project instructions and consult the model-facing manual.

handoff · destroy

Prepare a fresh-chat handoff or, with confirmation, remove the sandbox VM.

Workflows

What to ask for

Users describe the outcome. The model decides which tools to call.

Inspect a repository “Clone this repo, run its tests, and explain the first failure.”
Build and open a service “Make a small FastAPI app and expose it so I can try it.”
Explore data “Load this CSV, inspect missing values, and plot the useful distributions.”
Transfer files “Give me a browser where I can upload files to the workspace.”
Continue elsewhere “Prepare a handoff for a fresh conversation.”

Trust and retention

Know where the work goes

Sandbox data lives in Daytona. Lathe labels each sandbox with the Open WebUI user's email. When persistent volumes are enabled, /home/daytona/volume is backed by Daytona's S3/FUSE storage.
User environment variables are credentials entrusted to the agent. Lathe injects them into model-directed shell commands. The model can print them, inspect process environments, or read generated command wrappers. Use scoped, revocable credentials.
Choose the preview's access mode. Every HTTP exposure is explicitly public or private. Public requests may fall back to a direct signed bearer URL if wrapping is unavailable; private requests require owner authentication and never downgrade to public. Upstream access defaults to 24 hours; the tool reports wrapper expiry separately.
Auto-delete and volume retention are separate. By default, neither the sandbox nor its persistent volume is automatically deleted. An admin can set sandbox deletion intervals, but a separately managed persistent volume survives sandbox destruction.
Updates are manual. Open WebUI stores the uploaded copy of lathe.py. An installed deployment does not receive fixes merely because the GitHub repository changed, and Lathe has no built-in update or notification mechanism.

Administration

Install deliberately

Lathe is a single Python file installed as an Open WebUI Tool. It runs inside Open WebUI and receives an account-wide Daytona API key, so administrators should review the source and record the installed version. The installed copy reports it through lathe(manpage="version"); administrators can also inspect the source frontmatter's version: field.

The administrator README covers installation, manual updates, valves, security, and verification. The security policy defines support and explains how to obtain security fixes.