Execution Environment

Every Agent Ops project runs its tasks inside a real, persistent Linux sandbox. This page describes what the agent can do there.

Preinstalled tooling

The sandbox image ships ready for data, document, and code work:

Layer	Included
Runtimes	Python 3.12, Node.js 22, TypeScript (tsx)
Data & documents	pandas, openpyxl (Excel), python-docx (Word), python-pptx (PowerPoint), pdfplumber (PDF reading), reportlab (PDF writing), matplotlib (charts)
Developer tools	git, ripgrep, jq, build essentials

Anything else the agent needs it installs on demand (pip, npm, system packages) — and records why in project Memory, so later runs don't rediscover the same dependency.

What the agent can do in the sandbox

• Run commands and code — arbitrary shell commands, plus direct execution of Python, JavaScript, TypeScript, and Bash snippets.
• Work with files — read (whole files or line ranges), write, append, search-and-replace, move, delete, create directories, inspect metadata, and search file contents across the workspace.
• Use git — clone, commit, and push as first-class operations. Pushes are approval-gated by default (see Approvals); private repositories are reached with a token from the project's environment variables.

Long or risky operations follow the project's tool policy — safe, read-only operations auto-approve by default, while destructive or outward-facing ones pause for you.

Files: one source of truth

All file work happens under the sandbox's /workspace:

• Uploads — files you add to the project land in the workspace for the agent to use.
• Deliverables — files the agent creates are indexed into the project's Files tab automatically after each run and surfaced on the task's output panel.
• Persistence — the workspace survives across runs and tasks; the sandbox suspends when idle and resumes with everything intact.

Document generation

Because the office stack is preinstalled, "produce a real file" is a normal outcome, not an export step:

Build a quarterly review deck: one slide per product line with a
revenue chart, plus an executive summary slide. Use our template
colors (see the brand skill). Deliver as QBR-Q2.pptx.

The agent writes the generating code, runs it, and validates the output by reopening the file before finishing. The same applies to Excel workbooks (formulas, multiple sheets, charts), Word documents, and PDFs.

Web access

Two levels, independent of each other:

• Always available — web search and page extraction for research tasks, plus SSRF-protected HTTP requests to external APIs.
• Opt-in browser capability — an interactive browser (navigate, snapshot, click, type, wait, extract, screenshot) for tasks that must interact with a page rather than just read it. Enable it per project; the agent will ask for it when a task needs it.

Boundaries

• The sandbox is isolated from your machine and network position; it reaches the outside world through its own controlled network access.
• Secrets flow through environment variables, never through prompts or logs.
• The agent cannot approve its own gated actions — approvals always come from a human.