Inspiration: Unsloth
Unsloth Studio lets models run Bash and Python (not just JavaScript) in a sandbox, similar to Claude Artifacts. This lets models test code, generate files, and verify answers with real computation — making outputs more reliable.
Unsloth also connects to provider-side sandboxes (OpenAI's code interpreter, Anthropic's code execution tool) when using cloud models.
Current RustyClaw state
RustyClaw has:
execute_command / exec tool — general shell execution (potentially dangerous)- Sandbox support (Bubblewrap, Landlock, sandbox-exec) — but configured at the exec level
- No dedicated "safe code execution" tool optimized for model-generated code
What RustyClaw could do
Add a code_exec tool specifically designed for running model-generated code safely:
- Language auto-detection: Detects code blocks (
python, bash) and routes to the right runtime
- Sandbox by default: Runs in bubblewrap/landlock with no filesystem access except a temp dir
- Resource limits: CPU time, memory, wall-clock timeout per execution
- Output capture: stdout, stderr, exit code, any generated files
- Persistent workspace: Option to keep files between calls (like a Jupyter notebook)
- Package allowlist: Optionally allow pip/npm install from a curated list
- Network disabled by default: Can be toggled for specific use cases
Why this matters
Agents frequently generate code to solve problems. The current exec tool is powerful but scary — it can do anything. A dedicated code_exec tool with sensible defaults would let agents use code execution freely without risking the host.
Scope
rustyclaw-core: code_exec tool implementation- Reuses existing sandbox infrastructure (Bubblewrap/Landlock)
- Python runtime detection (system python or uv-managed venv)
- Configurable: allowed languages, resource limits, network policy
Prior art
Inspiration: Unsloth
Unsloth Studio lets models run Bash and Python (not just JavaScript) in a sandbox, similar to Claude Artifacts. This lets models test code, generate files, and verify answers with real computation — making outputs more reliable.
Unsloth also connects to provider-side sandboxes (OpenAI's code interpreter, Anthropic's code execution tool) when using cloud models.
Current RustyClaw state
RustyClaw has:
execute_command/exectool — general shell execution (potentially dangerous)What RustyClaw could do
Add a
code_exectool specifically designed for running model-generated code safely:python,bash) and routes to the right runtimeWhy this matters
Agents frequently generate code to solve problems. The current
exectool is powerful but scary — it can do anything. A dedicatedcode_exectool with sensible defaults would let agents use code execution freely without risking the host.Scope
rustyclaw-core:code_exectool implementationPrior art