I built a Claude Code-like harness you can embed in your own API —

I kept running into the same problem building agent features: you want to give a model real tools — bash, file edits, grep — but you don't want it anywhere near your host, and spinning up a container/VM per session is heavy, slow, and a pain to snapshot.

So I built ork: a sandboxed agent runtime where the entire sandbox is a data structure. Themodel gets the same 6 tools Claude Code has (Bash, Read, Write, Edit, Glob, Grep), but they execute against an in-process virtual filesystem and a POSIX-ish shell I wrote from scratch (lexer → parser → interpreter). No disk, no child_process, no network. The agent literallycannot touch your machine.

What that buys you:

- A real shell, not a toy. Pipes, globs, redirections, heredocs, for loops — the agent can run

awk-style pipelines over files it just wrote, all interpreted in-memory.

- Snapshots for free. Since the whole session (FS + conversation) is in-process state, it

snapshots to a content-addressed store and restores byte-for-byte. Pause an agent, resume it

next week, fork it.

- It's a server too. Hono HTTP API with SSE streaming, Bearer auth, per-tenant isolation,

per-session turn locks. POST /v1/sessions, send a prompt, watch tool_call / tool_result events

stream back.

- Deterministic testing. Because nothing touches the host, the full stack — HTTP → session

manager → agent loop → tools → shell → VFS → snapshot — runs end-to-end with a scripted mock

model. 500+ tests, zero side effects.

Quick taste:

const session = createSession({

model: "anthropic/claude-sonnet-4.5",

files: { "/workspace/data.csv": "name,score\nAlice,91\nBob,72\n" },

});

for await (const ev of session.send("Compute the average score and write summary.md")) {

if (ev.type === "tool_call") console.log(ev.tool, ev.input);

}

const { snapshotId } = await session.snapshot(store); // resume anytime

Obvious tradeoff: it's not a full Linux userland. You can't npm install or compile C in there —

it's a POSIX-ish shell with builtins on a virtual FS. For "agent that reads/transforms/writes

files and scripts its way through a task," that's plenty, and it's why sessions are ~free to

create and snapshot. If you need real processes, you still want Firecracker/containers.

TypeScript, model-agnostic via the AI SDK (Anthropic direct or any provider through a gateway).

Repo: https://github.com/GitHamza0206/ork

Would love brutal feedback — especially from anyone who's solved agent sandboxing differently.

Curious where the in-memory approach breaks down for your use cases.