The sandbox is the execution boundary for customer-authored commands and extensions. It is replaceable compute attached to a durable run, not the durable source of truth itself.

​
Filesystem boundaries

SurfaceOwnerExpected access
/workspaceRunMutable agent work; checkpointed
/workspace/.salambo/agent/skillsDeployment projectionRead-only skills
Agent and extension resourcesDeploymentRead-only through the supported runtime
Platform runtime filesSalamboUnavailable through managed agent file tools
Managed file tools are confined to the workspace boundary and reject symlink escapes. The extension process runs inside the sandbox and can access the workspace and projected resources needed by its module. Do not treat an extension as isolated from the rest of its sandbox; treat the entire sandbox as untrusted relative to the worker.

​
Secrets

Salambo projects only secrets explicitly declared for the relevant runtime or sandbox target. Platform storage credentials, worker memory, and integration credentials remain outside customer extension context. Never write secrets into /workspace: checkpoints preserve that directory.

​
Network access

Deployment egress policy controls reachable hosts. Restricted mode allows only configured destinations and platform-required control paths. A connection failure may therefore be an intentional policy denial rather than a provider outage.

​
Replaceable compute

A sandbox may stop after cancellation, cleanup, inactivity, or infrastructure failure. Salambo restores the run from its latest ready workspace checkpoint when a replacement is required. See sandbox security architecture for secret and network enforcement, then security for builder controls.