glove-foundry 0.2.0 → 0.3.1

package/docs/README.md

@@ -6,6 +6,7 @@ These package-local documents provide the implementation-level companion referen
 
 - [Building with Foundry](./building-with-foundry.md): project layout and complete authoring flow.
 - [Architecture](./architecture.md): definitions, instances, subscriptions, connections, and adapter boundaries.
+- [HTTP files and host secrets](../../glove-working-environment/HTTP-AND-SECRETS.md): secure downloads/uploads, HTTP calls, keystore references, and per-instance storage.
 - [Inspector](./inspector.md): page hierarchy, run traces, live updates, and the operator API.
 - [Evaluation checklist](./evaluation-checklist.md): concrete review criteria and verification commands.
 - [Implementation backlog](./implementation-backlog.md): remaining follow-up work, if any.

package/docs/building-with-foundry.md

@@ -194,6 +194,8 @@ export default defineAgent({
 
 The working environment is closed after every Foundry run. Add a persistence adapter to restore its VFS on the next run. `foundryDataEnvironmentPersistence` uses the data adapter's private snapshot seam, derives ownership from the definition and instance or conversation, and never exposes VFS contents as workspace entries. It requires a durable `FoundryDataAdapter` shared by execution workers. For high-concurrency or large trees, provide a native persistent `Vfs` such as `cachedRemote` in the environment options and let that adapter own locking and storage credentials.
 
+For HTTP requests and file transfers, put `fetchFiles()` from `glove-env-fetch` in the environment options’ `stdlib`. Mount `secret()` from `glove-env-secret` when scripts need scoped key metadata or references, and supply the same instance-scoped host store to fetch credential aliases. Neither credentials nor the store are included in the VFS snapshot; re-supply them each run. The [HTTP and secrets guide](../../glove-working-environment/HTTP-AND-SECRETS.md) covers the complete setup, private-network opt-ins, cancellation, and persistent store boundaries.
+
 REPL bindings persist for the duration of the assembled run. Glove's native REPL packages intentionally do not define a cross-process snapshot format, so durable artifacts belong in the working environment VFS rather than hidden interpreter variables.
 
 ## Definitions reference definitions

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "glove-foundry",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "An Effect-native, file-routed framework for typed, observable Glove agent applications",
   "type": "module",
   "license": "MIT",
@@ -63,14 +63,14 @@
     "station-schedules": "^2.2.0",
     "tsx": "^4.21.0",
     "zod": "^4.3.6",
-    "glove-mcp": "1.1.0",
-    "glove-js": "0.4.0",
-    "glove-memory": "1.1.0",
-    "glove-core": "3.6.0",
-    "glove-lisp": "0.4.0",
-    "glove-mesh": "0.1.1",
-    "glove-python": "0.3.0",
-    "glove-working-environment": "0.6.0"
+    "glove-core": "3.7.1",
+    "glove-js": "0.4.2",
+    "glove-memory": "1.1.2",
+    "glove-lisp": "0.4.2",
+    "glove-mcp": "1.1.2",
+    "glove-python": "0.3.2",
+    "glove-working-environment": "0.6.1",
+    "glove-mesh": "0.1.3"
   },
   "devDependencies": {
     "@types/node": "^25.2.3",