Terminal and Sandbox
The interactive terminal uses a PTY for real shell input and output. PTY support does not mean every command passes through five-level risk classification, approval or a sandbox. AI tools, interactive shells and task paths have different checks.
Before Execution
Review commands, working directory, network requests, writes and dependency sources. Some tool paths require confirmation, but manual shell input is not a unified approval executor. Avoid untrusted commands and secrets in output. Cancellation does not undo previous writes.
Sandbox Defaults
Current sandbox defaults are enabled, Docker mode, 60-second timeout, image lxz-sandbox:latest and Docker network none. Docker and the image must be available. Configuration permits fallback to Process, so check the actual backend rather than assuming an enabled switch means container execution.
Process mode uses subprocess execution, command allow/block lists, environment filtering and URL/IP argument checks. It is not operating-system-level network isolation and does not promise Linux namespaces/seccomp or Windows Job Object strong isolation. Docker isolation also depends on mounts, permissions, networking and the host; the default writable workspace mount can still modify project files.
Recommendations
Save code and inspect workspace changes first. Use a separate environment for unknown dependencies, then review files and output. A worktree separates a code directory, not security boundaries.