Unsloth has restored an operating-system sandbox around Studio’s Python and Terminal tools in unslothai/unsloth, eight days after reverting the earlier implementation. The Linux and macOS replacement merged on September 25 in UTC; a Windows MXC backend followed minutes later. For people allowing local models to execute code, that closes the source-level gap we reported last week. It does not make every successful tool call an isolated one.
The new code preserves a way to work on computers where operating-system isolation is unavailable. In automatic mode, those machines retain software safeguards and continue executing. A stricter mode refuses. That puts the consequential question below the success message: which protection did this particular process receive?
The author found the cost of saying yes
In the reopened public discussion, contributor oobabooga measured the replacement against ordinary Studio work. The earlier revision isolated files, but repeatedly walked the model cache and could strand a conversation after package installations pushed its working folder over a scan limit. Once every tool call was refused, the model could not use a tool to clean up the folder.
A boundary that blocks useful work invites users to disable it; a permissive recovery path can undermine the boundary. The review therefore had to examine ordinary installations, temporary files and accelerator access alongside attempts to read protected files.
Reviewer danielhanchen recorded fixes for the permanently blocked conversation and repeated cache walks. Subsequent macOS comparison work found another failure: different spellings of the same filesystem path prevented a working-folder exception from matching the Studio-home restriction. A probe could pass while a real conversation still could not run. These are reports about named revisions, not evidence that every earlier failure survives in the merged code.
Fallback has a boundary too
The merged launch planner separates requested mode from effective result. When its capability check says isolation is unavailable, auto returns a software-safeguard launch with os_isolation: false. required raises an error instead. Installing bubblewrap alone is insufficient: the host must also permit the namespaces it needs.
But automatic does not mean run despite every error. The tool wrapper rethrows unsafe-working-folder and sandbox-construction failures. Otherwise, model-written code could damage the conditions for isolation and earn a less restricted retry. The wrapper also has an explicit automatic-mode path for user-approved host access, recorded as such. A prior approval is another reason a completed command alone cannot establish confinement.
The scan-budget case receives its own treatment. If a working-folder scan cannot finish, automatic mode records that limitation; required mode refuses the prepared launch. That distinguishes finding a hazard from failing to inspect everything. The execution record’s limitations matter alongside its isolation flag.
For Linux and macOS, the new OS layer does not confine outbound network access. Its record says the network is unrestricted. Hiding a credential file from a process and preventing that process from sending information are separate protections; this change should not be read as supplying both.
Windows adds another conditional promise
The Windows change adds Microsoft’s MXC runtime, pinned with integrity checks, and tests capability before using it. Its source describes a Preview boundary. On systems without the required BaseContainer support, the default configuration cannot assume that installing the executable supplies isolation.
An optional AppContainer fallback modifies folder permissions temporarily and keeps a recovery journal. It is off by default. The authors report remaining costs and compatibility limits, including package installation trouble in that tier. WSL-backed Bash is outside the supported Windows boundary. “Windows support” is therefore a poor substitute for identifying the actual shell, host and backend.
The backend distinction is ahead of the ordinary controls: the Linux/macOS pull request leaves request wiring and the per-call interface to follow-up work. We inspected the merged planner, wrapper, platform changes and public reviews; we did not run kernel-confinement tests or establish which downloadable Studio release contains these commits. Nor does the return explain the original revert’s motive.
The useful next check is a disposable test of the pinned build with harmless canary files, comparing an allowed working-folder operation with a denied outside read and checking the recorded execution mode. No real credential is needed. The next product milestone is equally concrete: make the boundary of an actual call legible where the user sees its result. A restored sandbox earns trust when users can tell when it ran.