Sandboxes

Every task runs in its own sandbox — an isolated environment with a fresh checkout of your repo, scoped credentials, and a place for the agent to run commands and your test suite. When the task finishes, the sandbox is shut down, and idle sandboxes are archived automatically within 24 hours.

Sandboxes are fully managed and isolated per task and per workspace, so one run can never see another's code or credentials. The agent only ever works inside the sandbox on a branch; Sinatra never connects to your production systems. One thing to know: anything you put in sandbox.env in .sinatrarc is available to the agent inside the sandbox, so scope those values accordingly.