Architecture

Composition

LM Studio chat
├── context-compressor (optional)
│   └── prediction loop, exact token accounting, tool-session continuity, compaction
└── Agentic Workspace
    ├── tools provider
    ├── prompt preprocessor (/accept, /deny, mode and workflow hints)
    ├── workspace boundary
    ├── permission gate, approvals and plans
    ├── notes and workspace memory
    ├── transaction manager
    ├── command jobs
    ├── To-Do boards
    ├── research projects
    ├── browser sessions
    └── bounded agent runs

Agentic Workspace deliberately does not register a prediction-loop handler.

Durable storage

.agentic/
├── artifacts/
├── journal.ndjson
├── MEMORY.md
├── approvals/state.json
├── plans/<plan-id>/plan.md
├── notes/<name>.md
├── transactions/<tx-id>/
├── jobs/<job-id>/
├── runs/<run-id>/
├── tasks/<todo-id>/
└── research/<research-id>/

.agentic/** is always protected from model-authored workspace edits. Plugin-owned storage validates every nested path and rejects symbolic-link redirection. Notes and MEMORY.md are written only through workspace_notes, never through workspace_edit.

Permission gate

policy/permissions.ts is a pure decision over the permission mode (manual / plan / auto), the mutation kind (transaction, command, vcs, browser, web, agent), the destructive flag and ceiling, whether a plan is approved, and any approval record for the same operation hash. policy/gateRuntime.ts applies it: it looks the record up in the ApprovalStore, throws PROTECTED_PATH / APPROVAL_REQUIRED / APPROVAL_DENIED on refusal, and on a "stage" decision writes an approval_* record and returns the pending_approval envelope with the exact resume call. Tools call applyGate and either proceed or return that envelope untouched; after the mutation succeeds they mark the approval consumed. Plans (plan_*) are records in the same store; workspace_plan proposes, completes and lists them, and the prompt preprocessor turns /accept and /deny into decisions and adds the <agentic-mode> hint.

Public result protocol

All tools return agentic-workspace/v1 envelopes. Recovery fields are deliberately serialized before bulky data. retention.facts carries stable state; retention.omit_when_summarizing identifies previews that may be removed once their artifact paths and hashes are retained.

Workspace boundary

Read and write resolution combines lexical containment with realpath/symbolic-link checks. Existing symbolic-link components are rejected for writes. .git/**, .agentic/**, and configured protected globs are denied for writes; reads are allowed — protection here is integrity, not confidentiality, and recovery after compaction depends on reading .agentic/ state back.

Transactions

A transaction stores normalized operations, before/after snapshots, hashes, modes, diff, and review receipt before mutation. Commit revalidates all preconditions under a workspace-wide lock. Failed multi-file commits perform verified compensating restoration and remain inspectable.

Process execution

The runner receives executable plus argument array and uses shell: false. It enforces a bare-name allowlist, workspace cwd, a finite timeout for run and for start with a positive timeout_seconds, bounded stdin/output, reduced environment, durable status, and cancellation. start with timeout_seconds: 0 deliberately arms no timer so a dev server or watcher can outlive the turn; it is bounded by cancel, by the process exiting, or by a plugin restart (after which the job reports orphaned), not by a clock.

Tasks and research

Task-board and research-project mutations are serialized across runtime instances sharing a workspace. Task dependencies are validated as an acyclic graph. Research sources are content-addressed by hash and tied to durable source IDs.

Agents

The orchestrator uses bounded passes. Each pass receives a projection of durable state rather than the entire prior internal transcript. Coding runs may inspect/edit/verify; research runs may search/fetch/note but cannot edit files; general runs combine the minimum enabled capabilities. Whether a run commits its own transactions (commitEdits) follows the permission mode — Auto and an approved Plan commit, Manual only previews — and commit_edits=false can lower it; commitEdits is part of the run's idempotency specification.

Browser

Browser sessions are process-memory objects and therefore do not survive a plugin restart. Page text snapshots can be stored as artifacts. Every HTTP request is intercepted and checked against the web network policy; browser execution is still not an OS sandbox.