CodeMode Sandbox and Recovery¶

CodeMode is bounded execution over hydrated tools, not general host Python. The model must discover a tool and request its schema before using it. See Discovery and Execution for that protocol.

Supported Sandbox Subset¶

The shared CodeMode instruction teaches the verified Monty subset:

scalar, list, tuple, dictionary, and string literals;
indexing and read-only slicing;
arithmetic, comparisons, boolean expressions, and f-strings;
if/elif/else, for, while, break, and continue;
range, enumerate, zip, comprehensions, sorting, filtering, grouping, joining, and aggregation;
small helper functions;
asyncio.gather for independent hydrated tool calls.

Read mapping values with mapping[key]. Monty does not expose mapping methods such as mapping.get(...).

CodeMode does not provide host filesystem, environment, process, unrestricted network, third-party package, eval, or exec access. It is not general CPython execution.

Lifecycle and Limits¶

Every agent run receives an isolated catalog, hydration set, Monty process checkout, and variable state. Kedi closes the session and cancels active host callbacks on normal completion, errors, cancellation, and early close.

The runtime bounds search pages, discovery payload bytes, hydrated tools, code characters, nested call count, nested concurrency, individual result bytes, aggregate result bytes, captured output, and execution time. Invalid cursors, unhydrated calls, non-JSON nested values, denials, and budget failures are model-correctable errors rather than silent fallbacks.

Setting	Default	Meaning
`default_search_limit`	`10`	Tool names returned when `search_tools` omits `limit`.
`max_search_limit`	`50`	Maximum accepted search page size.
`max_hydrated_tools`	`64`	Exact schemas that may be hydrated in one run.
`max_discovery_result_bytes`	`256000`	Serialized bound for search and schema results.
`max_code_chars`	`20000`	Maximum source length for one snippet.
`max_nested_calls`	`64`	Host tool calls allowed in one execution.
`max_concurrent_calls`	`8`	Concurrent host tool calls allowed in one execution.
`max_tool_result_bytes`	`256000`	Serialized bound for one nested result.
`max_total_tool_result_bytes`	`1000000`	Aggregate nested-result bound per execution.
`max_print_bytes`	`256000`	Captured standard-output bound.
`request_timeout`	`60`	Timeout in seconds for one nested host tool call.

CodeMode telemetry records payload-free search tools, get tool schema, and execute code spans. It records counts, byte totals, restart state, duration, and outcome without recording query text, code, arguments, or tool results.

Recover Without Repeating Effects¶

A Monty-language error returns captured output and an error separately. Variables assigned before the failure remain available for the next execute_code call. Inspect that checkpoint before repeating host calls; a write that completed before a later expression failed is still a real write.

restart=True resets sandbox variables, not external effects. Application-tool failures, policy denials, and execution-limit errors remain failed tool calls. Do not treat an empty printed output as evidence that nothing ran.

Different From an Artifact Query¶

execute_code consumes hydrated tools. run_artifact_code consumes values already stored as artifacts. Dynamic workflows consume child-agent functions. These contracts share a sandbox implementation but not the same capabilities.