Haruno does its work in an isolated space on the PC. It is always on, in both views, and nothing in the app turns it off.
Mac appAvailableAlways on. There is no setting to turn it off.
Windows appAvailableAlways on, in both views. There is no setting to turn it off.
The sandbox is an isolated space on the PC where Haruno does its work. Inside it, Haruno can use the folder a chat was given and a private scratch area of its own. It cannot wander through the rest of your files.
It is the way Haruno is meant to be used. It is on for everyone from the first launch, in the normal view and in the advanced view. No switch, setting or view turns it off.
What it means for a customer
Haruno works in the folder of the chat, or in the folders added to a project. Your other documents stay out of reach unless a folder is given to the chat. See Which files Haruno can reach.
A command Haruno runs cannot open an internet connection by itself. Settings ▸ Advanced says Generic network access is blocked. Web pages and git are handled in controlled ways. See Web access and Git inside the sandbox.
If the sandbox cannot start, the chat does not start. Haruno never quietly runs without it.
Normal view and advanced view
Normal view
Advanced view
Sandbox
Always on.
Always on.
Where to look
Settings shows no Advanced tab.
Settings ▸ Advanced, card Secure engine sandbox. It shows the state and has no switch.
In the normal view Settings has three tabs and no Advanced tab. The sandbox is on all the same.
In the advanced view the card says Always on. Every session runs in the protected sandbox. Under it is a status line, which says Available when all is well, and Generic network access is blocked.
There is no way to turn it off
The sandbox is the product's safety posture. Older versions of the app let the advanced view turn it off. That switch is gone. If a customer asks how to turn it off, say that it cannot be turned off, and that it is what keeps a task inside the folders it was given.
A customer who had turned it off
Someone who turned the sandbox off in an older version sees a note once, at the top of Settings, after updating: Secure mode is now always on. Haruno runs in its protected sandbox in every view. The Dismiss button closes it, and it does not come back. A customer who never turned it off sees no note. The old choice is cleared when the app starts.
The one-time note, with a Dismiss button.
Your own servers and the browser
Custom servers that a person adds in Settings work in the sandbox. Haruno connects to the server itself. The server's address, header and sign-in stay in Haruno on the PC and are never handed to the sandbox. Only the tools set to On or Confirm are offered. A server that cannot be used says why on its row. See Adding your own connector.
The browser tools are offered when the browser is switched on in Settings. They are missing when it is switched off, or when every browser step is set to Off. See Agent browser settings.
If the sandbox shows a problem
The card has a status line. These are the messages and what to tell the customer:
The line says
What to do
The sandbox runtime is not installed. Reinstall or update Haruno.
Update or reinstall Haruno.
The sandbox runtime is invalid. Reinstall or update Haruno.
Update or reinstall Haruno.
Sandboxing is unavailable on this Windows architecture.
This PC type cannot run the sandbox. Contact support.