Knock shipped the Knock Agent in March 2026, an AI assistant for managing customer messaging resources across workflows, templates, and audiences. The team initially prototyped a tool-per-type pattern mirroring their management API but found it would bloat the agent's context window without a sophisticated routing layer. They pivoted after reading Vercel's blog on building agents with filesystems and bash for their internal tool d0.

Instead of exposing dozens of API-mapped tools, Knock gave the agent a virtual filesystem populated with the account's resources — workflows, templates, channels — and a bash environment to script against it. The agent explores the filesystem for context, modifies files in place, and calls `upsert_resource` to persist changes back to Knock. This mirrors the local-first philosophy of their existing CLI and aligns with coding agents like Claude Code.

Knock runs on Elixir, so they ported Vercel's TypeScript `just-bash` library — a virtual bash interpreter with a test suite covering jq, ls, cat, and other commands — to Elixir in a "nerd snipe" effort by Ivar Vong. The port reuses Vercel's fixtures verbatim and includes a robust security model. The agent loop runs on Anthropic's API backed by Oban workflows on Postgres for durable retries. Sandboxes are Elixir processes started lazily; the filesystem bootstraps with resource metadata first, then lazy-loads full objects via a `load_resources` tool when the agent needs to operate on them.

This architecture avoids the latency and synchronization complexity of full sandbox vendors while keeping the option to swap in a real sandbox later. The virtual filesystem approach scales context discovery naturally — the agent finds what it needs through standard Unix primitives — and the long-lived sandbox process preserves state across multi-turn conversations. Knock's bet: decouple the agent's reasoning from its execution environment so the hands can be upgraded without rewiring the brain.