Capstone Lesson 26: Sandbox Runner with Denylist and Path Jail
The verification gate decides whether a tool call should run. The sandbox decides what happens when it does. This lesson ships a subprocess runner that refuses dangerous executables, refuses dangerous argv shapes, jails every file path to a project root, truncates oversized output, and kills runaway processes on a wall-clock timeout. It is the second of two layers that sit between the model and the operating system. Build a Sandbox class wrapping subprocess.run with timeout, capture, and truncation. Refuse a command by name against a denylist and by structure against an argv inspector. Refuse any path argument that resolves outside a declared project root. Refuse shell metacharacters when shell mode is off. Return a structured SandboxResult that downstream observability and the eval harness can ingest. A coding agent that can shell out can install backdoors, exfiltrate keys, brick a developer laptop, and rack up a cloud bill in a single turn. The least costly defense is to not give it shell. The second least costly is a sandbox that says no to a precise list of patterns. Three classes of failure recur in agent traces. The first is dangerous executables. A model under pressure to fix a path issue will try sudo, chmod -R 777, rm -rf, mkfs, dd. None of these belong in an agent run. The denylist catches…
Capstone Lesson 26: Sandbox Runner with Denylist and Path Jail: The verification gate decides whether a tool call should run. The sandbox decides what happens…
This free lesson is part of the AI Engineering from Scratch curriculum. Read the full explanation, run the lesson code, and verify the result in the interactive reader or from the repository source.
Browse the complete course catalog or open this lesson on GitHub.