--- title: "Bounded Python and JavaScript code execution during a Task" description: "Code Execution is a built-in Tool that runs bounded Python or JavaScript during a Task, with Platform-controlled time, memory, dependencies, and network access." lang: en status: public-preview lastUpdated: 2026-09-26 url: https://duale.ai/en/docs/agent-harness/code-execution --- ## AI-generated summary Code Execution is a built-in Tool for bounded Python or JavaScript work during a Task, with platform-controlled time, memory, dependencies, and network access. - Each attempt receives fresh writable state; files or process state do not carry over. - Outbound network access starts off for every run; allow_network=true enables it. - Source code is limited to 100,000 characters; timeout defaults to 30 seconds. - The Tool Result reports observed status but does not independently prove an external Effect occurred. - A syntax-valid dependency can still be refused by the enforced package policy. Summaries were generated by AI. --- Use Code Execution when an eligible Executor needs bounded Python or JavaScript work during a Task. The Platform hosts this built-in Tool and controls its time, memory, dependencies, environment variables, and network access. Your application does not call it through a public SDK method or an SDK Tool endpoint. ## Treat Code Execution as one Tool Call, not an Agent During execution, the Agent Runtime can dispatch one logical Code Execution Tool Call with the selected code and options. The call can settle before any code attempt, or the Platform can make one or more attempts before it supplies one terminal Tool Result to the execution. An attempt, also called a code run, is not an Agent, Agent Identity, Task, Executor, Context, or SDK Tool. Each attempt receives fresh writable state. Files or process state left by one attempt do not become the next attempt's state. The [Threat model](https://duale.ai/en/docs/security/threat-model.md) describes the package-snapshot and Tenant-isolation boundary. ## Keep every request within the published bounds The built-in Tool accepts these values: | Input | Current contract | | --------------------- | ----------------------------------------------------------------------------------------------------------------- | | Language | `python` or `javascript` | | Source code | At most 100,000 characters | | Packages | At most 50 dependencies; each specifier is 3 to 214 characters and contains a version delimiter | | Timeout | 1 to 300 seconds; 30 seconds when omitted | | Working memory limit | 128 to 2,048 MiB; 512 MiB when omitted | | Environment variables | At most 50 string values | | Network | Off when omitted; when enabled, the domain setting selects registry-default, unrestricted, or named-domain access | The published package grammar accepts empty and wildcard version selectors. Use an exact reviewed version when reproducibility matters. A syntax-valid dependency can still be refused by the enforced package policy or because the requested version is unavailable. A package name or version is not evidence that its contents or license were reviewed. The [Threat model](https://duale.ai/en/docs/security/threat-model.md) describes package-preparation network access outside an attempt. ## Keep network access explicit Outbound access starts off for every run. Set `allow_network=true` to enable it; the domain setting is optional. Omitted or `null` domains restrict access to the runtime's language package-registry defaults. `allow_network=false` is the only current block-all setting. For enabled runs, the domain setting has three meanings: | Domain setting | Result | | --------------------- | --------------------------------------------------------------------- | | Omitted or `null` | Restrict access to the runtime's language package-registry defaults | | Empty list | Allow unrestricted outbound access | | Non-empty domain list | Restrict outbound access to the named host names and their subdomains | Network access can let agent-written code read or change an external system. Treat each enabled destination and every value the code sends as an external-action boundary. Do not put credentials or other secrets in the model-supplied environment variables. An infrastructure failure can cause another isolated execution attempt before a terminal Tool Result settles. Use Code Execution for a material external Effect only when the code uses an independently stable idempotency key that the destination enforces. Otherwise use a custom SDK Tool or remote service that owns authorization, the business-operation identifier, and reconciliation. Fresh writable state is not exactly-once execution. ## Interpret the result as a report, not an Effect When the Code Execution host reports a result, its status is `success`, `error`, `timeout`, or `killed`. It can carry up to 1,000,000 characters of standard output and 100,000 characters of standard error. The wire contract permits an optional structured return value, but the current host path does not populate it; print values that the execution must observe. If the host does not answer before the Tool deadline, the Platform can instead supply the generic timeout Tool Result described in [Authoring SDK Tools](https://duale.ai/en/docs/sdk/tools.md). If the Tool Result settles, the Platform records it in Conversation History and can select it for a later Model Input Context. It reports what the code-execution path observed; it does not independently prove that an external request ran, succeeded, failed, or produced an Effect. Validate any material state change at the system that owns it. [Threat model](https://duale.ai/en/docs/security/threat-model.md) explains the isolation, risks from output content, and external-network implications. [Agent harness](https://duale.ai/en/docs/agent-harness.md) defines Tool Call, Tool Result, Action, and Effect. ## Related content - [AI at the scale of work for enterprise teams](https://duale.ai/index.md) - [The execution model from Task contract to typed outcome](https://duale.ai/en/product.md) - [One application contract while execution evolves behind it](https://duale.ai/en/solutions/platform.md) - [Documentation for building and operating agent integrations](https://duale.ai/en/docs.md) - [Web research for source-linked public evidence](https://duale.ai/en/docs/web.md) - [Executor scopes and the runtime work tree](https://duale.ai/en/docs/agent-harness/executors.md) --- ## Sitemap See the full [Markdown sitemap](https://duale.ai/sitemap.md) for all pages.