Sandbox
Every scene has a computer. When no tool fits, the agent writes code and runs it there, and what it writes to disk is still there the next time something runs.
The agent writes code when no tool fits
Most work goes through provider tools, which are typed, named and gated. The sandbox covers the rest: reshape a file no tool reshapes, install a library and run it, clone a repository and build it, start a small server and look at the result. Inside a script, sandbox runs are ops like any other, with bindings in and out.
The computer belongs to the scene and keeps its files
A scene's computer is created the first time something runs in it, not before. Files, installed packages and cloned repositories stay between jobs; a job that starts tomorrow finds yesterday's work where it was left. Processes do not survive between jobs: a server started today is started again tomorrow. An idle computer pauses, and the next run resumes it. There is nothing to add to a scene to get one, and nothing on the scene shows for it unless you pin it there yourself.
What the computer can reach is what the scene holds
An account is available inside the sandbox only when its tile is in the scene. A GitHub repository pinned to the scene means the sandbox can clone it with the account that owns it; a workspace account that is not in the scene is not in the sandbox either, and neither is your own sign-in. The job tells the agent which accounts it has, so it does not guess.
Anything it serves gets an address
A process started in the background that listens on a port is reachable at an address of its own, and the run that started it returns that address. Files cross the same boundary in both directions: the agent can publish a file from the sandbox as a link, and pull a link into the sandbox. Every computer has its own origin; two scenes never share one.
A workspace can switch it off
A scene or a whole workspace can have code execution turned off. In that scene the agent has no sandbox: the tools are absent, not gated. A workspace setting applies to every scene in it, and a scene can only be stricter than its workspace.
Every run is recorded
The command, what it printed, what it returned and how long it took land in the job's trace like any tool call. You can read exactly what ran, not just what came back.
Where the computer runs
By default a scene's computer runs on machines we operate. A workspace can add its own; see Nodes.
What's next
- Nodes: run a scene's computer on a machine of yours.
- Scripts: sandbox runs as script ops.
- Traces: what a recorded run contains.
Updated 2026-08-23