I have a totally weird question -- please do push back if my premise is wrong Imagine a BAML function where instead of sending a prompt to an LLM, you send it to a sandboxed claude-code/codex where it has permissions to write only to a .json file inside the sandbox (everything else is read-only) (or just “claude -p” style), this then gets parsed by BAML, integrated with the rest of the ecosystem did anyone experiment with anything like it?

you are going to like sandbox mode 🙂

CC @Antonio Sarosi (BAML 🐑)

I do have a proposal for that, it's not yet implemented, and there's no direct API for sandboxing a single file, but there is a primitive that allows you to do that. It'll work something like this:

ts
function example() {
    // Allow read/write, all else forbidden.
    let sb = sandbox.new(allow = [
        sandbox.IoClass.FsRead,
        sandbox.IoClass.FsWrite,
    ]);

    // Block writes to any file other than the target JSON file
    let write_guard = sb.wrap(baml.fs.write);

    write_guard.replace((path: string, content: string) -> {
        if (path != "allowed.json") {
            throw baml.errors.Io { 
                message: "You don't have permissions to write to this file" 
            };
        }
    
        // Call original fs write
        write_guard.super(path, content);
    });

    // Run agent code in the sandbox
    let result = sb.run(() -> {
        // Agent code
    });
}

Similar to just-bash? I believe that based on the BAML runtime, an implementation surpassing just-bash can be built

Similar in how it works, we parse the shell command ourselves and have our own implementation of commands

really interesting idea. For the sandbox shell permissions, maybe you could implement a whitelisting system (deny * by default) selectively allowing specific bash commands to be run. I'm looking forward seeing more interesting new ideas popup for BAML , it must be fun being able to experiment with these.

Yeah deny by default with allow parameter, at that point it's API design, the complicated part is building the functionality

We used something that seems a similar concept. (for our prod environment because we were selling into enterprise) We created a Python REPL for the BAML portion of the loop. This enabled robust scaffolding along with the BAML goodness. It was also relatively cheap from a infra standpoint (we used Railway for this incarnation) Not sure what you're aiming to do but we had to consider our client's legal/technical team's requirements. Also, and more importantly, because we were not "venture scale" we were shooting for an acquisition of some sort. And that means thinking through the cost structure and "pain in the ass factor" for the buyers CTO/CISO/CFO