Computer

Agents with computer access can execute code, run shell commands, and read/write files in sandboxed Linux environments. Enable it in your agent's settings under Capabilities > Computer.

Providers

Flapjack supports three sandbox providers. Choose based on your workload:

Tensorlake (default)

Sandbox runs alongside your agent on Tensorlake infrastructure. Named sandboxes persist across tool calls within a conversation.

• Startup: Fast — sandbox runs in the same environment as the agent
• Persistence: Filesystem persists across tool calls within a turn
• Runtime: Python 3.13, Node.js, common tools pre-installed
• Best for: Short tasks, quick scripts, file manipulation

Vercel Sandbox

Firecracker microVM managed by the Flapjack control plane. Each sandbox is an isolated Linux VM with its own filesystem and network.

• Startup: Sub-second with snapshots, ~5s without
• Persistence: Reliable filesystem persistence across tool calls
• Runtime: Amazon Linux 2023, Node.js 24, Python 3.13, sudo access
• Best for: Longer builds, git operations, tasks requiring strong isolation

HeyVM

Self-hosted Firecracker microVMs managed via the heyvm CLI. Each sandbox runs in a dedicated microVM with full Linux access.

• Startup: Sub-second with snapshots
• Persistence: Full filesystem persistence across turns (cross-thread persistence depends on scope)
• Runtime: Custom rootfs images built from Dockerfiles
• Best for: Persistent development environments, agent-scoped sandboxes that outlive individual threads

See the HeyVM Setup Guide for installation and configuration.

Scope

The scope field controls how sandbox lifetime maps to conversations:

Scope	Behavior
thread	One sandbox per thread. Destroyed when the thread ends.
agent	One sandbox shared across all threads for this agent. Persists indefinitely.
resource	One sandbox per external resource binding. Useful for per-customer or per-project isolation.

Configuration

Dashboard

In your agent's settings, enable Computer and select a provider. The mode, scope, and size options depend on the provider.

API

curl -X PUT https://flapjack.chat/api/agents/{agentId}/computer \
  -H "Authorization: Bearer fj_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "enabled": true,
    "provider": "tensorlake",
    "mode": "ephemeral",
    "scope": "thread"
  }'

SDK

When sending messages, you can override computer settings per-message:

await fj.sendMessage(threadId, content, {
  computerOverrides: { enabled: true },
});

Tools

When computer is enabled, your agent gets three tools:

• computer_run — Execute a shell command. Returns stdout, stderr, and exit code.
• computer_write_file — Write content to a file path.
• computer_read_file — Read content from a file path.

The agent decides when to use these based on the conversation. You don't need to invoke them directly.

Lifecycle

• Ephemeral mode: A fresh sandbox is created for each conversation and destroyed when the conversation ends.
• Thread scope: The sandbox persists across messages within the same thread but not across threads.
• Cross-turn persistence: On Tensorlake, named sandboxes can be reconnected across turns. On Vercel, the sandbox ID is stored and the VM is reconnected via the API.

Runtime Provider Compatibility

The computer sandbox provider is separate from the agent's runtime provider. However, if your agent uses the Modal runtime, ephemeral Tensorlake sandboxes are not available — the sandbox runs alongside the Tensorlake runtime process, which Modal does not use. Agents on Modal that need computer access should use the Vercel Sandbox provider instead.