Sandboxing

Preview

Isolation guarantees for code execution, dynamic tools and untrusted content.

Anything executable runs in an isolated environment with an explicit egress profile, a resource ceiling and a lifetime bound to the run.

Isolation properties#

Dimension	Default
Filesystem	Ephemeral, per-run, no host mounts
Network	Deny-all egress; allowlist per capability
Credentials	Injected as short-lived broker tokens, never long-lived secrets
CPU / memory	Capped per environment class
Wall clock	Bounded by step and task budget
Persistence	Destroyed at run end unless snapshotted
Inter-run access	None — runs cannot observe each other

Egress profiles#

yaml

profiles:
  offline:
    egress: none
  package-install:
    egress: [class="tok-str">"registry.npmjs.org", class="tok-str">"pypi.org", class="tok-str">"files.pythonhosted.org"]
  research:
    egress: [class="tok-str">"*"]
    inspect: true          # responses recorded for provenance
  connector-only:
    egress: [class="tok-str">"api.github.com"]

Last updated 2026-09-08