Phase 0: Agent Harness · ~90 minutes · Python (stdlib)

Capstone Lesson 26: Sandbox Runner with Denylist and Path Jail

The verification gate decides whether a tool call should run.

Hiring signal: Can build capstone lesson 26: sandbox runner with denylist and path jail end to end

What you will learn

Build a `Sandbox` class wrapping `subprocess.run` with timeout, capture, and truncation.
Refuse a command by name against a denylist and by structure against an argv inspector.
Refuse any path argument that resolves outside a declared project root.
Refuse shell metacharacters when shell mode is off.
Return a structured `SandboxResult` that downstream observability and the eval harness can ingest.

Introduction

The sandbox decides what happens when it does. This lesson ships a subprocess runner that refuses dangerous executables, refuses dangerous argv shapes, jails every file path to a project root, truncates oversized output, and kills runaway processes on a wall-clock timeout. It is the second of two layers that sit between the model and the operating system.

Type: Build Languages: Python (stdlib) Prerequisites: Phase 19 · 25 (verification gates and observation budget), Phase 14 · 33 (instructions as constraints), Phase 14 · 38 (verification gates) Time: ~90 minutes

Objective

Learning objectives

Build a Sandbox class wrapping subprocess.run with timeout, capture, and truncation.
Refuse a command by name against a denylist and by structure against an argv inspector.
Refuse any path argument that resolves outside a declared project root.
Refuse shell metacharacters when shell mode is off.
Return a structured SandboxResult that downstream observability and the eval harness can ingest.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers The Problem, The Concept, Build, Check Yourself, Key Terms & Next — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.

Key terms in this lesson

Agent