Sandbox

Let the agent run commands without asking, inside a sandbox: what it can change and reach, how to allow websites and folders, which computers have it, and what an organisation can enforce.

When the agent runs commands for you, such as a Python script, an R analysis or a LaTeX build, each one normally waits for your yes. With the sandbox on, commands run straight away inside walls set by your computer’s operating system. Inside them a command can change only your project, and it reaches only websites you allow.

Use it for long data-processing runs, builds and analyses, where answering a card for every command would slow you down.

Turn it on

Type /sandbox in chat, or open Settings › Agent and turn on Run commands in a sandbox.

It’s off until you turn it on. It applies in Approve and Autopilot alike. If your organisation or a settings file has set it, the switch shows Set by the … settings. and can’t be changed there.

What a sandboxed command can do

	Inside the sandbox
Read files	Anywhere on your computer, except folders a rule or setting blocks
Change files	Only in the project, the agent’s scratch folder and temporary folders
Settings folders	`.git`, `.multilo` and other tool settings folders stay read-only, even inside the project
Websites	Only through Multilo, which checks each address. A new one asks you first.

A command that needs more than this asks before it runs outside the sandbox, with the usual approval card.

Some things still ask even with the sandbox on: Ask and Deny permission rules, deleting files, and protected paths. Plan mode still holds the agent to planning.

Allow a website

The first time a command connects to a new address, a card says “A command wants to connect to … which is not on the allowed list.” Choose:

Allow … for this chat: only until the chat ends.
Always allow … in project: saved as an Allow rule in the project’s personal settings file, so you aren’t asked again there. With no project open, the button is Always allow … and the rule goes in your own settings file.

To set the list yourself, add sandbox.network.allowedDomains and deniedDomains to a settings file:

{
  "sandbox": {
    "enabled": true,
    "network": {
      "allowedDomains": ["api.crossref.org", "*.ncbi.nlm.nih.gov", "pypi.org"],
      "deniedDomains": ["example-tracker.com"]
    }
  }
}

*.example.org matches every address under example.org. A denied address always wins.
An address that leads only to your own computer or local network is refused.
In your own settings file, "strictAllowlist": true under network refuses every address not on the list, instead of asking.

Allow or block folders

By default a command can change only the project. To change that, add sandbox.filesystem to a settings file:

{
  "sandbox": {
    "filesystem": {
      "allowWrite": ["~/Data/results"],
      "denyRead": ["~/Documents/Private"]
    }
  }
}

Key	What it does
`allowWrite`	More folders commands may change
`denyWrite`	Folders commands may never change
`denyRead`	Folders commands may never read
`allowRead`	A folder inside a `denyRead` that can be read again
`disabled`	`true` turns off the folder walls. The website checks stay.

Paths can start with / or ~/. A relative path starts from the settings file’s place: the project, for a project’s file.
Lists from different settings files are added together.
Your permission rules count too. An Allow rule for Edit(…) lets commands change that path, and a Deny rule for Read(…) or Edit(…) blocks it.
Settings folders stay read-only even where allowWrite covers them.

Which computers have it

Computer	Sandbox
Mac	Yes, built into macOS
Linux	Yes, with bubblewrap. Install the `bubblewrap` package. On Ubuntu 24.04 and later, bubblewrap also needs an AppArmor profile.
Windows	Not yet. The setting says it isn’t available, and every command asks as usual.

When the sandbox can’t run, Settings › Agent says Not available on this computer with the reason, and commands keep asking.

In a project

A project’s .multilo/settings.json can turn the sandbox on and set its websites and folders for everyone, but only once you trust the folder. A project file can never turn the sandbox off where your organisation has turned it on.

For organisations

Policy can force the sandbox on or off with sandbox.enabled, set the websites, and make its own list the only one with sandbox.network.allowManagedDomainsOnly. While the organisation’s sandbox is on, a project’s settings can’t add places to write. See Managed settings.

Troubleshoot

You see	What to do
Not available on this computer (bubblewrap is not installed)	On Linux, install the `bubblewrap` package, then restart Multilo.
Not available on this computer (bubblewrap cannot create a sandbox here)	On Ubuntu 24.04 or later, add an AppArmor profile for bwrap, or ask your IT team.
A command fails inside the sandbox but works on its own	It probably writes outside the project or reaches an address that isn’t allowed. Add the folder or address to the lists above, or let it run outside the sandbox when the card asks.
A project’s sandbox settings are ignored	The folder isn’t trusted yet. Trust it, and they apply.
A website card keeps coming back	Choose Always allow instead of for this chat, or add the address to `allowedDomains`.

PermissionsApproval cards and Allow, Ask and Deny rules.Permission modesApprove, Autopilot and Bypass permissions.Settings filesEvery sandbox key and where it works.Managed settingsWhat an organisation can enforce.