The Agent Harness Belongs Outside the SandboxAgent 的控制循环不该跑在沙箱里

The Setup

Every production AI agent has a harness — the loop that sends prompts, receives responses, executes tool calls, and repeats until done. The question isn’t whether you need one, but where it lives.

There are two answers, and they have fundamentally different security properties, failure modes, and scaling characteristics. If you’re building for one engineer on a laptop, the tradeoffs tip one way. If you’re building for dozens of engineers sharing the same agent, they tip the other. Mendral is in the multi-user camp, which surfaces problems single-user builders never see.

Key Takeaways

• Inside the sandbox means your credentials live alongside the code the agent is modifying. Simple to build, works out of the box with Claude Code — but the sandbox is your session, and losing it loses everything.

• Outside the sandbox means credentials stay on your backend. The loop calls into the sandbox only when it needs to run a command. Sandboxes become disposable cattle, suspended in 25ms when idle and respawned if they die mid-session.

• Multi-user breaks the filesystem model. When dozens of engineers share skills and memories, a local .claude/memory/MEMORY.md stops working. Mendral’s answer: virtualize the filesystem — one read/write/edit interface, two backends (sandbox for workspace, Postgres for memories and skills).

• Tool proliferation makes agents worse. Adding separate memory_read and memory_write tools dilutes the model’s attention. Worse, frontier models are RL-trained on the Claude Code API surface — deviating from it puts you off the trained path.

Why It Matters

Rex is building exactly this kind of system. The architecture decision Mendral is making — harness outside, sandbox as cattle, virtualized filesystem — maps directly onto the choices a multi-agent platform like Hermes faces. Their insight about keeping the tool surface identical to what models were trained on is especially sharp: every new tool you add is a tax on model performance.

The hardest unsolved problem they call out: consistency when two sessions in the same org are writing to the same memory concurrently. Last-writer-wins per key works for now, but they know it’ll break. If you’re designing an agent memory system today, this is the edge case to think about before it thinks about you.

What to watch: How Mendral handles the gap between Claude Code’s evolving conventions and their virtualization layer. Bash as a leak — the agent can bypass virtualized paths with raw shell commands — is an unsolved problem they’re patching with system prompts and tree-sitter parsing.