Workspaces and tools
Know where commands run, how tools are loaded, and what their permissions mean.
Jian gives the model catalogs of capabilities and loads tool groups when needed. Tool availability is separate from authorization: a listed tool may still need a configured service, a reachable machine, or approval for its action.
Execution targets
| Target | Files and commands run… | Account/boundary |
|---|---|---|
| Gateway workspace | On the gateway host or inside its container | Profile workspace with gateway-side isolation |
| Connected machine | On that worker's computer | The worker's OS account, with that account's privileges |
| MCP service | Wherever the MCP server operates | The credentials and access granted to that integration |
| GitHub API | On repositories the App can access | The connected GitHub App installation |
Select the machine/project intentionally in the conversation. A browser displaying a server's panel does not make commands run in the browser's computer.
Gateway workspace
Each profile has its own workspace. Gateway shell commands use it as HOME, their starting directory, and their temporary-file location. Use TMPDIR instead of assuming /tmp is writable. Files, attachments saved to disk, and shell work follow the workspace boundary.
The shell receives a reduced environment containing system execution paths and necessary locale/install settings, not the gateway's database URL or provider secrets. A project's environment variables must be supplied for that project's command.
Filesystem isolation uses OS facilities where supported. It is not a general network sandbox: commands can reach the network. Connected-machine tools have a different privilege model and do not inherit this workspace confinement.
What the gateway image includes
The published gateway image includes Node/npm, pnpm/yarn through Corepack, Python with uv, Go, Git, SSH, common network and text tools, build tools, PostgreSQL/SQLite clients, and FFmpeg. A gateway running directly from source on your own OS may have a different tool inventory.
Inside the image, agent-installed tools belong in the persistent workspace's user directories. The process runs as node, without root or sudo; installing system packages through apt is not an agent workflow. A custom image is the right place for required system dependencies.
Temporary graphical commands
jian-display -- COMMAND in the image starts a fresh authenticated Xvfb display with software rendering. Run the application and any capture in the same invocation. The wrapper cleans up its processes and has a 110-second lifetime limit; it does not create a reusable desktop across tool calls.
For a real connected computer, use Computer Use instead.
Discovering tools
Built-in groups include files, shell, web, media, remote machines, memories, skills, conversations, schedules, and task coordination. The agent uses load_tools for deferred groups. MCP has its own discovery through search_mcp_tools and load_mcp_tools.
A skill explains when and how to use tools. It does not install those tools, grant new credentials, or override an approval requirement.
Result handling
A command's exit code, stdout, stderr, and timeout state are evidence of what happened. A long output may become an artifact that the agent reads in pages. Reading an artifact is preferable to flooding the context with an entire log.
A successful shell command does not automatically prove a deploy, message, or remote API action finished. Inspect the downstream result when the task requires that evidence.
Continue with GitHub, MCP, Jian Remote, or media.