@ai-sdk/harness-pi 1.0.104 → 1.0.105

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/harness-pi",
-  "version": "1.0.104",
+  "version": "1.0.105",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -26,8 +26,8 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/harness": "1.0.102",
-    "@ai-sdk/provider-utils": "5.0.36",
+    "@ai-sdk/harness": "1.0.103",
+    "@ai-sdk/provider-utils": "5.0.37",
     "@earendil-works/pi-ai": "0.74.2",
     "@earendil-works/pi-coding-agent": "^0.84.3",
     "pi-mcp-adapter": "2.12.1",
@@ -37,7 +37,7 @@
     "zod": "^3.25.76 || ^4.1.8"
   },
   "devDependencies": {
-    "@ai-sdk/sandbox-just-bash": "1.0.102",
+    "@ai-sdk/sandbox-just-bash": "1.0.103",
     "@types/node": "22.19.19",
     "@vercel/ai-tsconfig": "0.0.0",
     "tsup": "^8.5.1",

package/src/pi-session.ts

@@ -11,7 +11,8 @@ import {
   type Skill,
   type ToolDefinition,
 } from '@earendil-works/pi-coding-agent';
-import { mkdir, rm } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { mkdir, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { Type } from 'typebox';
@@ -282,6 +283,36 @@ interface DeferredRerunBarrier {
   readonly cancel: (reason?: unknown) => void;
 }
 
+async function isWorkspaceAvailableOnHost({
+  sandbox,
+  sessionWorkDir,
+}: {
+  sandbox: SandboxSession;
+  sessionWorkDir: string;
+}): Promise<boolean> {
+  // A host path existing at the same location is not enough to prove that it
+  // belongs to the sandbox. Round-trip a unique marker through the sandbox
+  // filesystem API before using the workspace directly.
+  const probePath = path.join(
+    sessionWorkDir,
+    `.ai-sdk-harness-pi-${randomUUID()}`,
+  );
+  const probeContent = randomUUID();
+
+  try {
+    await writeFile(probePath, probeContent, { flag: 'wx' });
+    const sandboxContent = await sandbox.readBinaryFile({ path: probePath });
+    return (
+      sandboxContent != null &&
+      Buffer.from(sandboxContent).equals(Buffer.from(probeContent))
+    );
+  } catch {
+    return false;
+  } finally {
+    await rm(probePath, { force: true }).catch(() => {});
+  }
+}
+
 export async function createPiSession(
   input: CreatePiSessionInput,
 ): Promise<HarnessV1Session> {
@@ -301,28 +332,34 @@ export async function createPiSession(
   // sub-directory tree on disk.
   const safeSessionId = input.sessionId.replace(/[\\/: ]/g, '-');
   const hostRoot = path.join(tmpdir(), 'ai-sdk-harness', 'pi', safeSessionId);
-  const hostWorkDir = path.join(hostRoot, 'workspace');
   const hostAgentDir = path.join(hostRoot, 'agent');
   const hostSessionDir = path.join(hostRoot, 'sessions');
+  const toolSafeSandboxSession = getRestrictedSandboxSession(
+    input.sandboxSession,
+  );
 
   // Pi runs in this host process but must behave as though it lives in the
   // sandbox workspace: its working directory is the real `sessionWorkDir`
   // (where `setup()` clones and where the sandbox-backed tools operate), so the
   // paths Pi advertises to the model — most notably the "Current working
-  // directory" line in its system prompt — resolve inside the sandbox. The
-  // workspace VFS maps that sandbox path to the host-side mirror so Pi's own
-  // `fs`-based resource loading (`.pi/`, `AGENTS.md`) still works on the host.
-  // `sessionWorkDir` is a sandbox path (e.g. `/vercel/sandbox/...`) that does
-  // not exist on the host, so it is a safe, collision-free VFS mount point.
+  // directory" line in its system prompt — resolve inside the sandbox. When
+  // the sandbox filesystem is remote, the workspace VFS maps that sandbox path
+  // to a scoped host mirror for Pi's own `fs`-based resource loading. When the
+  // sandbox and harness share a filesystem, Pi uses the workspace directly so
+  // extensions can inspect project files beyond the scoped resource paths.
   const sessionWorkDir = input.sessionWorkDir;
+  const workspaceAvailableOnHost = await isWorkspaceAvailableOnHost({
+    sandbox: toolSafeSandboxSession,
+    sessionWorkDir,
+  });
+  const hostWorkDir = workspaceAvailableOnHost
+    ? path.resolve(sessionWorkDir)
+    : path.join(hostRoot, 'workspace');
 
   await mkdir(hostWorkDir, { recursive: true });
   await mkdir(hostAgentDir, { recursive: true });
   await mkdir(hostSessionDir, { recursive: true });
 
-  const toolSafeSandboxSession = getRestrictedSandboxSession(
-    input.sandboxSession,
-  );
   const sandboxHomeDir = await resolveSandboxHomeDir({
     sandbox: toolSafeSandboxSession,
     ...(input.abortSignal ? { abortSignal: input.abortSignal } : {}),
@@ -358,11 +395,13 @@ export async function createPiSession(
 
   // Snapshot sandbox state into the host mirror BEFORE the VFS goes live so
   // Pi sees the workspace as soon as it boots.
-  await syncHostWorkspaceFromSandbox({
-    sandbox: toolSafeSandboxSession,
-    sandboxWorkDir: input.sessionWorkDir,
-    hostWorkDir,
-  });
+  if (!workspaceAvailableOnHost) {
+    await syncHostWorkspaceFromSandbox({
+      sandbox: toolSafeSandboxSession,
+      sandboxWorkDir: input.sessionWorkDir,
+      hostWorkDir,
+    });
+  }
 
   // Mount only the workspace: the model's view of the workspace lives at
   // `sessionWorkDir` and is backed by `hostWorkDir`. The agent and session
@@ -370,7 +409,9 @@ export async function createPiSession(
   // Pi state (auth, model registry, session journal) that must never surface
   // in the sandbox or the workspace mirror.
   const workspaceVfs = new PiWorkspaceVfs();
-  workspaceVfs.mount(hostWorkDir, sessionWorkDir);
+  if (!workspaceAvailableOnHost) {
+    workspaceVfs.mount(hostWorkDir, sessionWorkDir);
+  }
 
   const paths = createPiPathMapper({
     hostWorkDir,
@@ -1011,7 +1052,7 @@ export async function createPiSession(
       settingsManager,
       resourceLoader,
       customTools,
-      ...(hasMcpServers
+      ...(hasExtensionFactories
         ? { noTools: 'builtin' as const }
         : { tools: toolNames }),
       ...(input.settings.thinkingLevel
@@ -1147,11 +1188,13 @@ export async function createPiSession(
           await reloadResourcesOnly();
           turnAbortController.signal.throwIfAborted();
         }
-        await syncHostWorkspaceFromSandbox({
-          sandbox: toolSafeSandboxSession,
-          sandboxWorkDir: input.sessionWorkDir,
-          hostWorkDir,
-        });
+        if (!workspaceAvailableOnHost) {
+          await syncHostWorkspaceFromSandbox({
+            sandbox: toolSafeSandboxSession,
+            sandboxWorkDir: input.sessionWorkDir,
+            hostWorkDir,
+          });
+        }
         turnAbortController.signal.throwIfAborted();
 
         // Fresh translator state for the new turn — keep the tool sets the