AI agents and the sandbox

Limn’s AI reads text written by other people: pull request descriptions, comments, tickets, and the code itself. Any of it could try to give the AI instructions. Limn therefore treats everything an agent reads from a pull request or ticket as untrusted, and limits what each agent can do. Most agents can only read. The two that can run commands, AI Fix and Implement story, run inside a sandbox that holds none of your credentials.

#What each agent can do

Reviews and chats: read only

AI Review and every chat can read files, but cannot run commands or change anything. They read only the repository they were given. Their instructions tell them that text from a pull request is data, not instructions.

Codex is locked down further

When Codex runs a review, Limn turns off its shell, web access, images, plugins and memories, and gives it only Limn’s own read-only file tools. Limn also checks that its safety check really runs before each run, and refuses to start if it cannot prove it. Codex uses Limn’s own Codex folder, never yours.

#The sandbox

AI Fix and Implement story give the AI a full shell, so it can build and test the code. That shell is inside a container on your computer, started by your container runtime. See Sandbox for its settings.

• No GitHub credentials. The sandbox holds no GitHub token or sign-in of any kind.
• No AI credentials. The sandbox holds only a stand-in. Limn’s network filter puts the real Claude or Codex credential on the request as it leaves, so the AI cannot read it.
• No way out but Limn’s network filter. The sandbox can reach only the hosts allowed for it. Every request shows in the session’s Network list, and a blocked host opens only when you press Allow for this session or Always allow. Local, cloud metadata and other reserved addresses are always refused.
• No way into your computer. No folder of yours is writable from the sandbox, and it has no access to your container runtime. It runs as an ordinary user with limits on CPU, memory and processes.
• Services are checked. A compose file that asks for privileged mode, extra rights, host folders or the container runtime is refused.
• Your notes, copied. Only the Claude notes and skills you tick are copied in. Past AI sessions are never copied in.

#How work leaves the sandbox

Work leaves only as a patch for each repository. Limn checks it on your computer, then pushes it with your GitHub access when you press Push:

• AI Fix pushes only to the pull request’s own branch, and never forces a push.
• Implement story pushes a new branch and opens a draft pull request by default.
• A merge made in the sandbox is checked and rebuilt by Limn before it is pushed: the AI’s own commits are never sent.

The only pushes without a press are the ones you switch on: Push automatically for an auto fix on your own pull request, and dependency automation for a trusted bot’s pull request. Both are off by default.

#When a sandbox is removed

A sandbox runs only while its session is open. When the session ends, Limn stops and removes its container or virtual machine, its proxy, its services, its network and its storage. A session ends when:

• you discard it, or push an AI Fix;
• an automatic run finishes, or you stop it;
• nothing happens for 15 minutes (closing the browser counts as nothing happening);
• one turn of the AI runs for more than 2 hours;
• the AI stops, or the session fails to start;
• you select Stop all in Settings → Sandbox;
• Limn stops, or restarts.

Changes the session stored are kept: you can push them, or resume the session, which starts a new sandbox. Every few minutes, and when it starts, Limn also removes any sandbox of its own that no open session uses. It never removes a sandbox of another Limn on the same computer, or anything it did not create.