Product guides

Sandboxed Analysis

Run bounded Python or read-only SQL against selected Library files without exposing the API host, credentials, or private network.

Library-first inputs

Select authorized file IDs from Library. AverQel stages a temporary copy after tenant, user, and conversation checks; raw host paths and arbitrary URLs are never accepted.

Supported analysis

CSV and JSON analysis, pandas/OpenPyXL transformations, read-only SQL, and Matplotlib chart generation are supported in the isolated image.

Bounded execution

The executor uses a private Docker network, no host mounts, dropped capabilities, import checks, CPU/memory/time limits, and capped output.

Automatic cleanup

Staged inputs, generated files, and temporary working directories are removed after each run. Persisted outputs become private, authenticated artifacts only when requested.

Request flow

Library file IDs → authorization → temporary staging
                  → sandbox-executor → result validation
                  → optional private artifact → DeepSpace panel

Limits and safe usage

  1. Up to five input files per execution, with per-file and aggregate size limits.
  2. Execution time and generated output are capped; failures return a visible status.
  3. Network access, host filesystem access, secrets, and unsafe imports are blocked.
  4. Use this for calculations, transformations, validation, and charts—not arbitrary server administration.

Deployment contract

The API remains compatible when the feature is disabled. To execute locally, start the sandbox Compose profile and set the API's sandbox URL, token, and enabled flag. Keep the token unique per environment and do not place it in frontend code or chat prompts.