Sandbox modes and file policy

While DataMind Oda works, it changes files and runs commands on your computer, and a file sandbox limits the file changes that work may make. This page is the reference for the sandbox modes: the three modes and their names in messages, how a chat gets its mode, how completely the limits can be applied, and what Oda does when no sandbox is usable. To switch a chat's mode, see Permission presets; the folders behind it are in Workspaces, files and permissions.

The three modes

The file sandbox works in one of three modes. Messages and notes use a short name for each:

• The modes limit file changes only: reading is not limited, and network use is outside the file sandbox.
• The chat's workspace folder is the writable boundary, and it stays fixed for the chat; Workspaces, files and permissions covers the folders.
• Full access is offered only while your DataMind account allows it; Permissions, approvals and feature controls covers the rule.
• Auto review is not one of the modes: a chat in it runs without the file limits while a model reviews each call before it runs. See Auto review.

How a chat gets its mode

The mode a chat runs under is chosen in one order: a mode set for a specific piece of work, then the chat's newest switch, then the default set for new chats.

• One mode per chat. Each chat keeps its own mode. Switching the mode in one chat does not change any other chat.
• The newest switch wins. A switch is recorded with the chat and applies from the chat's next step that touches files. The chat reopens in its mode after a restart.
• Before a chat chooses. A chat with no mode of its own uses the default set for new chats; the setting is covered in Permission presets.
• Set by the work itself. Work that starts outside your chat carries its own access: a scheduled run uses the access choice saved with its task, and a delegated run keeps the access it started with. See Schedule recurring tasks and Subagent permissions and sandboxing.
• Narrowed choices. Where your account or your company narrows which modes a chat may use, a chat falls back to the widest mode still allowed, and nothing runs wider than the allowance.

How the limits are applied

• The limits are applied by mechanisms of your operating system. Oda works out which mechanism suits your computer and checks that it works; the check is not repeated for every command.
• Processes can be hidden too. Where the sandbox runs through a container-style profile, a confined command also cannot see or signal the other programs on your computer, including ones running as your user. Where the limits rest on file rules alone, process visibility is unchanged, as on Windows (Sandbox boundaries on Windows).
• Every confined step records how completely the limits could be applied, as full or partial: full when the boundary holds completely, and partial when the system can apply only part of it. The current partial cases are the write restriction on Windows and older Linux systems; the Windows effects are collected in Sandbox boundaries on Windows.
• A partial result is not the same as full, and it does not mean the limits were dropped: changes the mode does not allow are still stopped, and Oda reports the difference rather than treating the limits as complete. A program whose limits were only partly applied reports File sandbox enforcement is partial on this host.
• A denial and a sandbox failure are told apart: a denial means the limits worked and stopped a change; a sandbox failure means the command never ran, and the result says the problem is the sandbox rather than the command. Denials and their one wider retry are covered in When Oda is denied access.

When no sandbox is available

Oda refuses to run a command without its limits. When the mode a chat asks for cannot be enforced on this computer, the command does not run: the result says no sandbox is usable for that mode and that Oda would not run the command without one. Nothing is dropped quietly, and nothing is changed.

This is a sandbox problem, not a command failure. Where the limits cannot be set up for a folder, Oda may instead ask you to run that one command without restrictions; that flow and its answers are in Command sandboxing and approvals and When Oda needs more access.

Questions, answered

Do my other chats change when I switch the mode in one chat?

No. Each chat keeps its own mode. The newest switch applies to the chat where it was made, from that chat's next step that touches files, and every other chat stays as it was.

Does a chat keep its mode after I restart Oda?

Yes. A switch is recorded with the chat, so the chat reopens in the mode it last used.

What do the mode names in Oda's messages mean?

The modes appear in messages and records under short names: read-only is Read Only, workspace-write is Workspace Write, and danger-full-access is Full access. A note that names a mode tells you which mode the step ran under.

How does Oda apply the limits on my computer?

With mechanisms of your operating system. Oda works out which mechanism suits your computer and checks that it works; the check is not repeated for every command. If a mechanism fails to start, the result reports a sandbox problem, not a command failure.

Are the file limits applied the same way on every computer?

The rule is the same everywhere: a change the mode does not allow is stopped. How completely a computer can apply the limits differs, and a step records it as full or partial. The current partial cases are the write restriction on Windows and older Linux systems. A partial result does not mean the limits were dropped.

Is a denied change the same as a failed command?

No. A denial means the limits worked: the change was stopped and not made. A failed command is a failure of the command itself; when the sandbox itself fails, the command does not run at all and the result says the problem is the sandbox. Oda reports the two differently so you can tell them apart.

Does Oda ever run a command without its limits?

Not on its own. Oda refuses to run a command unconfined: when the limits cannot be applied for a chat's mode, the command does not run and nothing is changed. A command runs without the limits only in a mode that removes them, or through the one-command approval Oda asks for when the limits cannot be set up for a folder (Command sandboxing and approvals).

Why did a scheduled run use a mode different from my chat's?

A scheduled run does not take up your chat's mode: it uses the access choice saved with its task, and its runs never change the default for your chats. See Schedule recurring tasks.

Is Auto review one of the sandbox modes?

No. Auto review is the experimental option in the same menu, not a mode of the file sandbox: a chat in it runs without the file limits, like Full access, while a model reviews each call before it runs. See Auto review.