Working environments

Mount a durable virtual filesystem and a request-scoped REPL when an agent needs to research, compute, write code, make documents, generate media, inspect its output, and pass real artifacts to another agent.

Mount the VFS

export const makerWorkspace = defineWorkingEnvironment({
  options: ({ assembly }) => ({
    limits: {
      maxVfsBytes: 64 * 1024 * 1024,
      maxFileBytes: 12 * 1024 * 1024,
    },
    execution: {
      onProgress: (event) => assembly.controls.emit({
        type: "maker.workspace.progress",
        data: event,
      }),
    },
    onVerb: (event) => assembly.controls.emit({
      type: "maker.workspace.verb",
      data: event,
    }),
  }),
});

glove-working-environment owns the sandbox, VFS, script runner, limits, and model-facing verbs. Foundry owns instance- and message-aware mounting, correlation, persistence boundaries, and inspection.

One tree, several consumers

filesystem takes any glove-vfs tree, and the same tree can back a glove-memory resource store and a REPL session at the same time. That matters most in Foundry, where an instance already owns memory, an environment and often a REPL: without a shared tree each one keeps its own copy and the agent cannot file what it just made.

import { mountFs, inMemoryFs, cachedRemote, withAccess, withMeta } from "glove-vfs";
import { vfsResources } from "glove-vfs/resources";
import { fsFns } from "glove-vfs/fns";

export function makerTree(instanceId: string) {
  return withAccess(
    withMeta(mountFs([
      { at: "/",       fs: inMemoryFs() },
      { at: "/memory", fs: await cachedRemote(store, { prefix: `instances/${instanceId}/` }) },
    ]), { lexical: true }),
    { rules: [{ path: "/corpus", access: "read", note: "curated upstream" }] },
  );
}

Pass it as the working environment's filesystem, hand vfsResources(tree, { schema, root: "/memory" }) to the instance's resource curator, and fsFns(tree) to the REPL session. A script's output is a memory resource at the same path, immediately.

Access policy is enforced on the filesystem, not per surface, so one rule binds the model's verbs, a script's env:fs calls, REPL functions and host handles alike — and it governs metadata too, so a fenced subtree does not leak through a summary or a semantic hit. Mount only the per-instance prefix: the tree is the tenancy boundary, and a shared prefix is a cross-instance read.

Foundry closes the environment after each run, so persist with snapshot() and restore with fromSnapshot(). Both unwrap the layer stack first, so the metadata index survives the round trip rather than coming back empty with the bytes intact.

HTTP and credentials

Put fetchFiles() and secret() in the working environment options' stdlib. Supply the owning instance's host store and narrow origin/credential grants. The native transport blocks non-public DNS/IP destinations unless the host grants an exact private origin; custom transports must implement equivalent protections.

Foundry closes its environment after each run. Re-supply the same scoped persistent store on the next run: VFS snapshots contain neither secret values nor network policy. Default memory stores are ephemeral. See the HTTP and secrets guide for setup, script recipes and cancellation behavior.

Build the REPL for this request

export function makerRepl(actor: string, brief: Brief) {
  const session = JsSession.create({ actor });
  session.register(defineFn({
    name: "brief__current",
    description: "Read the current campaign brief",
    input: z.object({}),
    readOnlyHint: true,
    handler: () => brief,
  }));
  return defineRepl({
    language: "javascript",
    session,
    mount: { frame: "repl", discovery: "auto" },
  });
}

The next message may expose different functions. This is intentional: the REPL becomes a small task-specific computer, not a permanent catalog of every API.

Add artifact capabilities

Load skills into the environment

A skill can install instructions, scripts, templates, and adapter requirements into the mounted environment. Resolve skills from the current instance and message just like tools. Keep third-party skill code reviewable and pin the source revision used by a production instance.

Choose persistence deliberately

The in-memory adapter is for development. Production workbenches need durable backing, size limits, read-only zones, egress policy, and an artifact export strategy. Mount shared paths read-only when several agents consume the same source material; write new work into agent- or conversation-owned paths.