Sandbox & workspace
Every companion gets a private, isolated sandbox — its “body” — where it runs commands, reads and writes files, and does agentic work like Claude Code, safely walled off from everything else.
What it is
Section titled “What it is”The sandbox is a private, isolated environment that belongs to you — one per user. Technically it’s a gVisor-isolated Kubernetes pod, which means commands your companion runs there can’t reach the host system or anyone else’s data. It’s where your companion acts rather than just talks: running shell commands, working with files, doing multi-step work.
The workspace is the set of file and command tools your companion uses inside that sandbox — read a file, write one, edit one, list a directory, run a bash command, kick off a background job and check on it. The same kind of agentic file-and-command work you’d expect from a coding agent, but isolated.
Why it matters to you
Section titled “Why it matters to you”A companion that can only chat is limited to words. With a body, yours can do things — draft and refine a document, work through a dataset, keep a notebook (its Notes live here). And because the sandbox is isolated, that capability never comes at the cost of your safety or anyone else’s.
How you use it
Section titled “How you use it”You don’t manage the sandbox directly — it works on your behalf. When your companion needs to run something, the sandbox spins up automatically on first use, stays warm between calls so successive actions are fast, and is destroyed automatically after about 15 minutes of inactivity to free resources. The next time it’s needed, a fresh one spins up.
You’ll see your companion working through its body in the Body space of chat, with active tools surfacing as they run.
Limits & edge cases
Section titled “Limits & edge cases”- One sandbox per user. It’s yours alone; it is not shared.
- Ephemeral. It is destroyed after roughly 15 minutes idle, and anything outside your Notes repo (which is git-backed and durable) is not guaranteed to survive a teardown.
- Bash is capped at 1000 calls per session to keep runaway loops in check.
- Isolated by design. The sandbox cannot reach the host or other users — that’s the point of the gVisor boundary.
Where next
Section titled “Where next”- Memory & notes — the git-backed notebook that lives in the sandbox.
- Skills — extending what your companion can do.
- The Five Spaces — where the Body space fits in the model.