Workspace

A workspace gives an agent a sandboxed computer for running commands, reading and editing files, and processing data. It is separate from the user's device and your application's API actions.

Enable the workspace

Open the agent's Workspace settings and enable Sandboxed computer. This grants a shell and file editor together; there is no separate read-only workspace grant.

• Allow: commands and file edits run without an approval request.
• Ask: commands and file edits pause for the user's approval.

Save and publish the agent to apply changes to users. If delegation is also enabled, dispatched subagents can use a workspace under the parent's grant and repository-access setting.

Files and lifecycle

The workspace is scratch space, not permanent storage. Its scratch area is kept for the life of the conversation: the sandbox session itself is reaped once it has sat idle for a few hours, and the platform drops the session's filesystem with it, but the scratch files are copied out after each turn and written back the next time the agent attaches. Scratch files therefore carry work between turns, even across a reaped session. Only the scratch area is restored that way — the rest of the environment comes back fresh. The saved copies live with the conversation and are cleared about a day after it ends. None of this is a durability guarantee: a copy cut short at the wrong moment loses that turn's unsaved changes.

Writing a file does not automatically deliver it to the user.

Repository access

Repository access is a separate switch, off by default. Enabling it clones your organization's connected GitHub repositories into the workspace so the agent can inspect the code. You would normally never want to turn this on, unless you want your end users be able to have access to your codebase.

Network restrictions

Each sandbox runs on an isolated network that is separate from Teaflask’s own infrastructure. A sandbox can’t reach Teaflask’s internal services or databases, and it can’t reach other sandboxes.

Outbound internet access is blocked by default. A sandbox can reach only:

• GitHub, read-only. It can clone, fetch and download files and releases. Pushes, API writes and uploads are blocked at the network level, even if the agent has a token.
• Public packages from PyPI and npm. pip, uv and npm work as usual through a mirror that Teaflask manages.
• Common language runtimes (Python, Node.js, Java, Go), installed on demand.

Every other destination is blocked, and that includes DNS lookups for it. If your agent needs to call your application’s API, use Actions.