Skip to main content
Web Code runs your repository in an isolated Cloud guest — a headless virtual machine on the same farm as Bot computers. The guest is started for the session, attached, and prepared by the agent. Workspace tools execute inside it and nowhere else.

​
How a guest starts

1

You name a repository on the session

From Code Home or the repository picker.
2

Cortex starts and attaches a guest

One repository per runtime. The guest is isolated from other sessions and other accounts.
3

The agent prepares the environment

It installs what the repository needs, based on what it finds — not a script guessed from a filename.
4

Tools run inside the guest

Reads, edits, shell commands, tests. Never in the API process, never in Chat’s Python sandbox.
If the deployment has no Cloud compute available, Code says so. It does not run your repository on the API instead.

​
Three different machines

Do not mix them up. Chat Python cannot see a Code repository; a Code guest cannot reach a Bot’s desktop. See Security.

​
Environment and secrets

Environment for a guest belongs to that guest. Set what a session needs inside the session — the agent can create the files or export the variables the repository expects. There is no Secrets page; /code/secrets sends you home. For unattended runs, pass credentials through the environment of the machine running the CLI, never on the command line. See Headless runs.

​
Lifecycle

​
Hosts beyond the Cloud

The Cloud is the only host in the browser. This PC and SSH exist on the desktop app and the CLI — see Code on desktop. Those hosts require an already connected Code session; Cortex never silently substitutes the Cloud for a host you chose.

​
Related