@ai-sdk/harness 1.0.122 → 1.0.124

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @ai-sdk/harness
 
+## 1.0.124
+
+### Patch Changes
+
+- 40231b6: fix(harness): enforce tool input schemas at execution and consistently reject invalid inputs
+- Updated dependencies [b5679a7]
+- Updated dependencies [ca31b89]
+  - ai@7.0.114
+
+## 1.0.123
+
+### Patch Changes
+
+- 9c8c0c1: feat (harness): keep harness-generated state out of the sandbox workspace. The framework and every bridge adapter now resolve their generated state — bootstrap recipes and their dependencies (`.harness-bootstrap/…`) and per-session run state (`.agent-runs/…`) — through the new `harnessV1StateDirectory()` helper, which always resolves to a fixed directory (`~/.ai-sdk-harness`) under the sandbox's own HOME, never the sandbox's working directory. This is not configurable: every sandbox provider gets the same layout, so harness infrastructure never lands in a user-owned workspace. This changes the on-disk layout for every provider (a breaking change, acceptable given the experimental nature of this API) — sandboxes bootstrapped under the previous layout re-bootstrap once under the new path.
+- 771e74b: chore: enable dead code lint rules
+- 7115a3f: fix(harness): preserve buffered SandboxChannel event order without blocking selective listeners and forward Claude Code compaction events
+- Updated dependencies [dcdb011]
+- Updated dependencies [8f72832]
+- Updated dependencies [fe07867]
+- Updated dependencies [b74c0cb]
+- Updated dependencies [a4b0940]
+- Updated dependencies [2693319]
+- Updated dependencies [c93ee90]
+- Updated dependencies [771e74b]
+  - ai@7.0.113
+  - @ai-sdk/provider-utils@5.0.47
+
 ## 1.0.122
 
 ### Patch Changes

package/dist/agent/index.d.ts

@@ -8,7 +8,7 @@ import { JSONSchema7, JSONValue, LanguageModelV4StreamPart, LanguageModelV4ToolC
 /**
  * One file to write into the sandbox as part of an adapter's bootstrap recipe.
  * Absolute paths are used as-is. Relative paths are resolved against the
- * sandbox's default working directory. Paths should live under
+ * harness state directory (`$HOME/.ai-sdk-harness`). Paths should live under
  * {@link HarnessV1Bootstrap.bootstrapDir}.
  */
 interface HarnessV1BootstrapFile {
@@ -37,10 +37,10 @@ interface HarnessV1Bootstrap {
     readonly harnessId: string;
     /**
      * Path inside the sandbox where this recipe writes its state. Absolute paths
-     * are used as-is. Relative paths are resolved against the sandbox's default
-     * working directory. The marker file lives directly under it. Files
-     * declared in {@link files} should also use this prefix so an adapter upgrade
-     * can sweep stale state by clearing the directory.
+     * are used as-is. Relative paths are resolved against the harness state
+     * directory (`$HOME/.ai-sdk-harness`). The marker file lives directly under
+     * it. Files declared in {@link files} should also use this prefix so an
+     * adapter upgrade can sweep stale state by clearing the directory.
      */
     readonly bootstrapDir: string;
     /** Files to write into the sandbox before any command runs. */

package/dist/agent/index.js

@@ -38,6 +38,34 @@ var HarnessCapabilityUnsupportedError = class extends (_b2 = HarnessError, _a2 =
   }
 };
 
+// src/v1/harness-v1-network-sandbox-session.ts
+import { posix } from "path";
+var HARNESS_V1_STATE_DIRECTORY_NAME = ".ai-sdk-harness";
+function harnessStateDirectoryPath({
+  sandboxHomeDir
+}) {
+  return posix.join(sandboxHomeDir, HARNESS_V1_STATE_DIRECTORY_NAME);
+}
+
+// src/v1/harness-session-data-directory-path.ts
+import { posix as posix2 } from "path";
+function encodeHarnessPathSegment(value) {
+  const encoded = encodeURIComponent(value);
+  if (encoded === "") return "%";
+  if (encoded === ".") return "%2E";
+  if (encoded === "..") return "%2E%2E";
+  return encoded;
+}
+
+// src/v1/harness-v1-tool-filtering.ts
+function isHarnessV1BuiltinToolIncluded(input) {
+  if (input.toolFiltering == null) return true;
+  return input.toolFiltering.mode === "allow" ? input.toolFiltering.toolNames.includes(input.toolName) : !input.toolFiltering.toolNames.includes(input.toolName);
+}
+function getHarnessV1BuiltinToolFilteringDenialReason(input) {
+  return `Tool '${input.toolName}' is inactive due to the HarnessAgent tool filtering policy.`;
+}
+
 // src/agent/harness-agent.ts
 import {
   asArray as asArray2,
@@ -115,15 +143,6 @@ async function validateLifecycleStateData(input) {
   };
 }
 
-// src/v1/harness-v1-tool-filtering.ts
-function isHarnessV1BuiltinToolIncluded(input) {
-  if (input.toolFiltering == null) return true;
-  return input.toolFiltering.mode === "allow" ? input.toolFiltering.toolNames.includes(input.toolName) : !input.toolFiltering.toolNames.includes(input.toolName);
-}
-function getHarnessV1BuiltinToolFilteringDenialReason(input) {
-  return `Tool '${input.toolName}' is inactive due to the HarnessAgent tool filtering policy.`;
-}
-
 // src/agent/internal/to-harness-stream.ts
 async function toHarnessStream(options) {
   let controller;
@@ -764,9 +783,7 @@ var HarnessStreamTextResult = class {
         this.currentStepContent.push({
           ...part
         });
-        return;
       default:
-        return;
     }
   }
 };
@@ -1086,6 +1103,45 @@ function stripWorkDir(part, sessionWorkDir) {
       return part;
   }
 }
+function stripParsedToolInputWorkDir({
+  value,
+  sessionWorkDir
+}) {
+  if (sessionWorkDir.length === 0) return value;
+  const projected = /* @__PURE__ */ new WeakMap();
+  const pending = [];
+  const project = (item) => {
+    if (typeof item === "string") return stripString(item, sessionWorkDir);
+    if (item === null || typeof item !== "object") return item;
+    if (!Array.isArray(item) && Object.getPrototypeOf(item) !== Object.prototype && Object.getPrototypeOf(item) !== null) {
+      return item;
+    }
+    if (projected.has(item)) return projected.get(item);
+    const target = Array.isArray(item) ? new Array(item.length) : {};
+    projected.set(item, target);
+    pending.push({ source: item, target });
+    return target;
+  };
+  const result = project(value);
+  while (pending.length > 0) {
+    const { source, target } = pending.pop();
+    if (Array.isArray(source) && Array.isArray(target)) {
+      for (let index = 0; index < source.length; index++) {
+        if (index in source) target[index] = project(source[index]);
+      }
+    } else {
+      for (const [key, item] of Object.entries(source)) {
+        Object.defineProperty(target, key, {
+          value: project(item),
+          enumerable: true,
+          writable: true,
+          configurable: true
+        });
+      }
+    }
+  }
+  return result;
+}
 function stripString(value, workDir) {
   return stripStreamingString({
     value,
@@ -1514,6 +1570,7 @@ function pinSandboxChannelEventCheckpoint(event) {
 }
 
 // src/agent/internal/run-prompt.ts
+var invalidToolInputMessage = "Tool input validation failed.";
 function unwrapToolResultOutput(toolResult) {
   switch (toolResult.output.type) {
     case "text":
@@ -1928,7 +1985,7 @@ function runPrompt(input) {
     };
     const processPendingApprovalContinuation = async (approval, continuation) => {
       var _a6;
-      const rawToolCall = (_a6 = rawToolCallsByToolCallId.get(approval.toolCallId)) != null ? _a6 : {
+      const rawToolCall = (_a6 = approval.kind === "builtin" ? rawToolCallsByToolCallId.get(approval.toolCallId) : void 0) != null ? _a6 : {
         type: "tool-call",
         toolCallId: approval.toolCallId,
         toolName: approval.toolName,
@@ -1936,14 +1993,29 @@ function runPrompt(input) {
         providerExecuted: approval.providerExecuted,
         nativeName: approval.nativeName
       };
-      const parsedInput = await safeParseJSON2({ text: rawToolCall.input });
-      const toolCall = {
-        type: "tool-call",
-        toolCallId: rawToolCall.toolCallId,
-        toolName: rawToolCall.toolName,
-        input: parsedInput.success ? parsedInput.value : rawToolCall.input,
-        ...rawToolCall.providerExecuted !== void 0 ? { providerExecuted: rawToolCall.providerExecuted } : {}
-      };
+      let validatedToolCall;
+      let toolCall;
+      if (approval.kind === "custom" && continuation.approved) {
+        validatedToolCall = asToolCallTextStreamPart({
+          part: await validateToolCall({
+            event: rawToolCall,
+            tools: input.tools
+          })
+        });
+        toolCall = displayHostToolCall({
+          toolCall: validatedToolCall,
+          sessionWorkDir: input.sessionWorkDir
+        });
+      } else {
+        const parsedInput = await safeParseJSON2({ text: rawToolCall.input });
+        toolCall = {
+          type: "tool-call",
+          toolCallId: rawToolCall.toolCallId,
+          toolName: rawToolCall.toolName,
+          input: parsedInput.success ? parsedInput.value : rawToolCall.input,
+          ...rawToolCall.providerExecuted !== void 0 ? { providerExecuted: rawToolCall.providerExecuted } : {}
+        };
+      }
       enqueueApprovalResponse(approval, continuation, toolCall);
       onToolApprovalSettled(approval.approvalId);
       pendingApprovalsByApprovalId.delete(approval.approvalId);
@@ -1973,6 +2045,27 @@ function runPrompt(input) {
         });
         return "continued";
       }
+      if (validatedToolCall == null) {
+        throw new Error(
+          `Harness '${input.harness.harnessId}' could not validate approved host tool '${approval.toolName}'.`
+        );
+      }
+      if (validatedToolCall.invalid) {
+        const error = new Error(invalidToolInputMessage);
+        await submitToolResult({
+          toolCallId: approval.toolCallId,
+          output: { error: invalidToolInputMessage },
+          isError: true
+        });
+        bufferedToolOutcomes.push(() => {
+          enqueueHostToolOutcome({
+            toolCall,
+            outcome: { ok: false, error }
+          });
+        });
+        await publishToolExecutions();
+        return "continued";
+      }
       await lifecycle.start(input.model);
       toolExecutions.set(rawToolCall.toolCallId, {
         toolCall
@@ -1980,6 +2073,7 @@ function runPrompt(input) {
       const executionStartedAt = Date.now();
       const execution = await maybeExecuteHostTool({
         event: rawToolCall,
+        parsedToolCall: validatedToolCall,
         tools: activeTools,
         toolsContext,
         wrappedExecuteTool: lifecycle.executeTool,
@@ -2174,15 +2268,25 @@ function runPrompt(input) {
         } else {
           for (const part of translatedParts) result.enqueue(part);
         }
+        let validatedHostToolCall;
         if (displayValue.type === "tool-call") {
+          const isHostTool = value.type === "tool-call" && !value.providerExecuted && hasTool({ tools: activeTools, toolName: value.toolName }) && !(value.toolName === "askUserQuestions" && hasTool({
+            tools: input.harness.builtinTools,
+            toolName: value.toolName
+          }));
           const parsed = await validateToolCall({
-            event: displayValue,
+            event: isHostTool ? value : displayValue,
             tools: input.tools
           });
           const parsedToolCall = asToolCallTextStreamPart({ part: parsed });
+          validatedHostToolCall = isHostTool ? parsedToolCall : void 0;
+          const displayToolCall = isHostTool ? displayHostToolCall({
+            toolCall: parsedToolCall,
+            sessionWorkDir: input.sessionWorkDir
+          }) : parsedToolCall;
           rawToolCallsByToolCallId.set(displayValue.toolCallId, displayValue);
-          toolCallsByToolCallId.set(displayValue.toolCallId, parsedToolCall);
-          result.enqueue(parsed);
+          toolCallsByToolCallId.set(displayValue.toolCallId, displayToolCall);
+          result.enqueue(displayToolCall);
         }
         if (value.type === "text-delta") {
           stepText += value.delta;
@@ -2328,6 +2432,31 @@ function runPrompt(input) {
             await finishForHostInputPause({ completeCurrentStep: true });
             return;
           }
+          if (validatedHostToolCall == null) {
+            throw new Error(
+              `Harness '${input.harness.harnessId}' could not validate host tool '${toolCall.toolName}'.`
+            );
+          }
+          if (validatedHostToolCall.invalid) {
+            settledHostToolCallIds.add(toolCall.toolCallId);
+            toolExecutions.delete(toolCall.toolCallId);
+            bufferedToolOutcomes.push(() => {
+              result.enqueue({
+                type: "tool-error",
+                toolCallId: toolCall.toolCallId,
+                toolName: toolCall.toolName,
+                input: parsedToolCall.input,
+                error: new Error(invalidToolInputMessage),
+                dynamic: true
+              });
+            });
+            await submitToolResult({
+              toolCallId: toolCall.toolCallId,
+              output: { error: invalidToolInputMessage },
+              isError: true
+            });
+            continue;
+          }
           const customToolApprovalDecision = resolveCustomToolApproval({
             toolName: toolCall.toolName,
             toolApproval: input.toolApproval
@@ -2427,6 +2556,7 @@ function runPrompt(input) {
               const executionStartedAt = Date.now();
               const execution = await maybeExecuteHostTool({
                 event: toolCall,
+                parsedToolCall: validatedHostToolCall,
                 tools: activeTools,
                 toolsContext,
                 wrappedExecuteTool: lifecycle.executeTool,
@@ -2532,14 +2662,31 @@ function asToolCallTextStreamPart(input) {
   }
   return input.part;
 }
+function displayHostToolCall(input) {
+  return {
+    ...input.toolCall,
+    input: stripParsedToolInputWorkDir({
+      value: input.toolCall.input,
+      sessionWorkDir: input.sessionWorkDir
+    }),
+    ...input.toolCall.invalid ? { error: new Error(invalidToolInputMessage) } : {}
+  };
+}
 function hasTool(input) {
   return Object.prototype.hasOwnProperty.call(input.tools, input.toolName);
 }
 async function maybeExecuteHostTool(input) {
   const tool = input.tools[input.event.toolName];
   if (!isExecutableTool(tool)) return { executed: false };
-  const parsed = await safeParseJSON2({ text: input.event.input });
-  const args = parsed.success ? parsed.value : input.event.input;
+  if (input.parsedToolCall.invalid) {
+    const error = new Error(invalidToolInputMessage);
+    await input.submitToolResult({
+      toolCallId: input.event.toolCallId,
+      output: { error: invalidToolInputMessage },
+      isError: true
+    });
+    return { executed: true, outcome: { ok: false, error } };
+  }
   let context;
   try {
     context = await validateToolContext({
@@ -2562,7 +2709,7 @@ async function maybeExecuteHostTool(input) {
         let output2;
         const stream = executeTool({
           tool,
-          input: args,
+          input: input.parsedToolCall.input,
           options: {
             toolCallId: input.event.toolCallId,
             messages: [],
@@ -3251,7 +3398,7 @@ function collectHarnessAgentToolResultContinuations(input) {
 }
 
 // src/agent/internal/bootstrap-recipe.ts
-import { posix } from "path";
+import { posix as posix3 } from "path";
 var BOOTSTRAP_SCHEMA_VERSION = 1;
 async function hashHarnessBootstrap(recipe) {
   const encoder = new TextEncoder();
@@ -3260,6 +3407,7 @@ async function hashHarnessBootstrap(recipe) {
     chunks.push(encoder.encode(value));
     chunks.push(encoder.encode("\0"));
   };
+  pushString(harnessStateDirectoryPath({ sandboxHomeDir: "$HOME" }));
   pushString(recipe.harnessId);
   pushString(recipe.bootstrapDir);
   const sortedFiles = [...recipe.files].sort(
@@ -3289,12 +3437,12 @@ async function hashHarnessBootstrap(recipe) {
 function bootstrapMarkerPath({
   recipe,
   identity,
-  defaultWorkingDirectory
+  stateDirectory
 }) {
-  return posix.join(
+  return posix3.join(
     resolveBootstrapPath({
       path: recipe.bootstrapDir,
-      defaultWorkingDirectory
+      stateDirectory
     }),
     `.bootstrap-${identity}.ok`
   );
@@ -3303,13 +3451,13 @@ async function applyBootstrapRecipe({
   session,
   recipe,
   identity,
-  defaultWorkingDirectory,
+  stateDirectory,
   abortSignal
 }) {
   const markerPath = bootstrapMarkerPath({
     recipe,
     identity,
-    defaultWorkingDirectory
+    stateDirectory
   });
   const existingMarker = await session.readTextFile({
     path: markerPath,
@@ -3320,11 +3468,10 @@ async function applyBootstrapRecipe({
   }
   const bootstrapDir = resolveBootstrapPath({
     path: recipe.bootstrapDir,
-    defaultWorkingDirectory
+    stateDirectory
   });
   const mkdirResult = await session.run({
     command: 'mkdir -p "$BOOTSTRAP_DIR"',
-    workingDirectory: defaultWorkingDirectory,
     env: { BOOTSTRAP_DIR: bootstrapDir },
     abortSignal
   });
@@ -3338,7 +3485,7 @@ ${mkdirResult.stderr || mkdirResult.stdout}`
     await session.writeTextFile({
       path: resolveBootstrapPath({
         path: file.path,
-        defaultWorkingDirectory
+        stateDirectory
       }),
       content: file.content,
       abortSignal
@@ -3364,17 +3511,17 @@ ${result.stderr || result.stdout}`
   });
 }
 function resolveBootstrapPath({
-  path,
-  defaultWorkingDirectory
+  path: path2,
+  stateDirectory
 }) {
-  return posix.isAbsolute(path) ? path : posix.resolve(defaultWorkingDirectory, path);
+  return posix3.isAbsolute(path2) ? path2 : posix3.resolve(stateDirectory, path2);
 }
 
 // src/agent/internal/sandbox-bootstrap.ts
-import { posix as posix3 } from "path";
+import { posix as posix5 } from "path";
 
 // src/utils/resolve-sandbox-default-working-directory.ts
-import { posix as posix2 } from "path";
+import { posix as posix4 } from "path";
 async function resolveSandboxDefaultWorkingDirectory({
   sandboxSession,
   abortSignal
@@ -3392,7 +3539,7 @@ async function resolveSandboxDefaultWorkingDirectory({
     );
   }
   const cwd = result.stdout.trim();
-  if (!posix2.isAbsolute(cwd)) {
+  if (!posix4.isAbsolute(cwd)) {
     throw new Error(
       `Failed to resolve sandbox default working directory: expected an absolute path, got ${JSON.stringify(cwd)}.`
     );
@@ -3400,6 +3547,25 @@ async function resolveSandboxDefaultWorkingDirectory({
   return cwd === "/" ? cwd : cwd.replace(/\/+$/, "");
 }
 
+// src/utils/sandbox-home-dir.ts
+import path from "path";
+async function resolveSandboxHomeDir({
+  sandbox,
+  abortSignal
+}) {
+  const result = await sandbox.run({
+    command: 'printf "%s" "$HOME"',
+    abortSignal
+  });
+  const homeDir = result.stdout.trim();
+  if (result.exitCode !== 0 || !homeDir || !path.posix.isAbsolute(homeDir)) {
+    throw new Error(
+      `Unable to resolve sandbox HOME directory: ${result.stderr || result.stdout}`
+    );
+  }
+  return homeDir;
+}
+
 // src/agent/internal/sandbox-bootstrap.ts
 var SANDBOX_BOOTSTRAP_IDENTITY_VERSION = 1;
 function validateSandboxBootstrapSettings(settings) {
@@ -3426,10 +3592,10 @@ function normalizeSandboxWorkDir(workDir) {
       "HarnessAgent: `sandboxConfig.workDir` must use POSIX path separators."
     );
   }
-  if (posix3.isAbsolute(workDir)) {
+  if (posix5.isAbsolute(workDir)) {
     throw new Error("HarnessAgent: `sandboxConfig.workDir` must be relative.");
   }
-  const normalized = posix3.normalize(workDir);
+  const normalized = posix5.normalize(workDir);
   if (normalized === "." || normalized === ".." || normalized.startsWith("../")) {
     throw new Error(
       "HarnessAgent: `sandboxConfig.workDir` must stay inside the sandbox default working directory."
@@ -3445,7 +3611,7 @@ function resolveSessionWorkDir({
 }) {
   return joinSandboxPath({
     base: defaultWorkingDirectory,
-    path: workDir != null ? workDir : `${harnessId}-${sessionId}`
+    path: workDir != null ? workDir : `${encodeHarnessPathSegment(harnessId)}-${encodeHarnessPathSegment(sessionId)}`
   });
 }
 async function createSandboxBootstrapPlan({
@@ -3488,20 +3654,30 @@ async function runSandboxBootstrap({
   abortSignal
 }) {
   if (recipe == null && onBootstrap == null) return;
-  const resolvedDefaultWorkingDirectory = defaultWorkingDirectory != null ? defaultWorkingDirectory : await resolveSandboxDefaultWorkingDirectory({
-    sandboxSession: session,
-    abortSignal
-  });
   if (recipe != null && recipeIdentity != null) {
     await applyBootstrapRecipe({
       session,
       recipe,
       identity: recipeIdentity,
-      defaultWorkingDirectory: resolvedDefaultWorkingDirectory,
+      // Harness infrastructure always lives under the sandbox's own HOME,
+      // never the working directory resolved below for the caller's own
+      // `onBootstrap` hook. Resolved directly from `session` — this runs
+      // from a provider's `onFirstCreate`, before a
+      // `HarnessV1NetworkSandboxSession` even exists.
+      stateDirectory: harnessStateDirectoryPath({
+        sandboxHomeDir: await resolveSandboxHomeDir({
+          sandbox: session,
+          abortSignal
+        })
+      }),
       abortSignal
     });
   }
   if (onBootstrap == null) return;
+  const resolvedDefaultWorkingDirectory = defaultWorkingDirectory != null ? defaultWorkingDirectory : await resolveSandboxDefaultWorkingDirectory({
+    sandboxSession: session,
+    abortSignal
+  });
   const bootstrapWorkDir = workDir == null ? resolvedDefaultWorkingDirectory : joinSandboxPath({
     base: resolvedDefaultWorkingDirectory,
     path: workDir
@@ -3561,9 +3737,9 @@ async function hashSandboxBootstrapIdentity({
 }
 function joinSandboxPath({
   base,
-  path
+  path: path2
 }) {
-  return posix3.join(base, path);
+  return posix5.join(base, path2);
 }
 
 // src/agent/internal/resolve-observability.ts
@@ -3829,7 +4005,14 @@ var HarnessAgent = class {
             session: toolSafeSandboxSession,
             recipe,
             identity: recipeIdentity,
-            defaultWorkingDirectory,
+            // Harness infrastructure always lives under the sandbox's own
+            // HOME, never the session's working directory.
+            stateDirectory: harnessStateDirectoryPath({
+              sandboxHomeDir: await resolveSandboxHomeDir({
+                sandbox: toolSafeSandboxSession,
+                abortSignal
+              })
+            }),
             abortSignal
           });
         } catch (err) {
@@ -3872,7 +4055,14 @@ var HarnessAgent = class {
               session: resumedSandboxSession.restricted(),
               recipe,
               identity: recipeIdentity,
-              defaultWorkingDirectory: resumedSandboxSession.defaultWorkingDirectory,
+              // Harness infrastructure always lives under the sandbox's own
+              // HOME, never the working directory.
+              stateDirectory: harnessStateDirectoryPath({
+                sandboxHomeDir: await resolveSandboxHomeDir({
+                  sandbox: resumedSandboxSession,
+                  abortSignal
+                })
+              }),
               abortSignal
             });
           } catch (err) {
@@ -3907,7 +4097,14 @@ var HarnessAgent = class {
               session: createdSandboxSession.restricted(),
               recipe: sandboxBootstrapPlan.recipe,
               identity: sandboxBootstrapPlan.recipeIdentity,
-              defaultWorkingDirectory: createdSandboxSession.defaultWorkingDirectory,
+              // Harness infrastructure always lives under the sandbox's own
+              // HOME, never the working directory.
+              stateDirectory: harnessStateDirectoryPath({
+                sandboxHomeDir: await resolveSandboxHomeDir({
+                  sandbox: createdSandboxSession,
+                  abortSignal
+                })
+              }),
               abortSignal
             });
           } catch (err) {
@@ -4147,7 +4344,6 @@ var HarnessAgent = class {
         };
       }
     }
-    return void 0;
   }
   /*
    * Reduce AI SDK input to the single user message the harness should run
@@ -4451,11 +4647,19 @@ async function prepareHarnessSandboxTemplate(options) {
   });
   try {
     if (bootstrapPlan.recipe != null && bootstrapPlan.recipeIdentity != null) {
+      const restrictedSession = sandboxSession.restricted();
       await applyBootstrapRecipe({
-        session: sandboxSession.restricted(),
+        session: restrictedSession,
         recipe: bootstrapPlan.recipe,
         identity: bootstrapPlan.recipeIdentity,
-        defaultWorkingDirectory: sandboxSession.defaultWorkingDirectory,
+        // Harness infrastructure always lives under the sandbox's own HOME,
+        // never the working directory.
+        stateDirectory: harnessStateDirectoryPath({
+          sandboxHomeDir: await resolveSandboxHomeDir({
+            sandbox: restrictedSession,
+            abortSignal
+          })
+        }),
         abortSignal
       });
     }
@@ -4485,7 +4689,7 @@ async function prepareSandboxForHarness(options) {
   const workDir = sandboxConfig.workDir == null ? void 0 : normalizeSandboxWorkDir(sandboxConfig.workDir);
   const recipeIdentities = {};
   const skippedHarnessIds = [];
-  let defaultWorkingDirectory;
+  let stateDirectory;
   for (const harness of harnesses) {
     const recipe = await ((_b4 = harness.getBootstrap) == null ? void 0 : _b4.call(harness, {
       abortSignal: options.abortSignal
@@ -4496,19 +4700,24 @@ async function prepareSandboxForHarness(options) {
     }
     const recipeIdentity = await hashHarnessBootstrap(recipe);
     recipeIdentities[harness.harnessId] = recipeIdentity;
-    defaultWorkingDirectory != null ? defaultWorkingDirectory : defaultWorkingDirectory = await resolveSandboxDefaultWorkingDirectory({
-      sandboxSession: options.session,
-      abortSignal: options.abortSignal
+    stateDirectory != null ? stateDirectory : stateDirectory = harnessStateDirectoryPath({
+      sandboxHomeDir: await resolveSandboxHomeDir({
+        sandbox: options.session,
+        abortSignal: options.abortSignal
+      })
     });
     await applyBootstrapRecipe({
       session: options.session,
       recipe,
       identity: recipeIdentity,
-      defaultWorkingDirectory,
+      stateDirectory,
       abortSignal: options.abortSignal
     });
   }
   if (sandboxConfig.onBootstrap != null) {
+    const defaultWorkingDirectory = await resolveSandboxDefaultWorkingDirectory(
+      { sandboxSession: options.session, abortSignal: options.abortSignal }
+    );
     await runSandboxBootstrap({
       session: options.session,
       workDir,
@@ -4604,7 +4813,7 @@ import { appendFileSync, mkdirSync } from "fs";
 function createFileReporter(options) {
   var _a4, _b4;
   const fileName = (_a4 = options.fileName) != null ? _a4 : "events.jsonl";
-  const path = `${options.dir}/${fileName}`;
+  const path2 = `${options.dir}/${fileName}`;
   const failOnly = (_b4 = options.failOnly) != null ? _b4 : false;
   const turns = /* @__PURE__ */ new Map();
   let lastOpenCallId;
@@ -4632,7 +4841,7 @@ function createFileReporter(options) {
         mkdirSync(options.dir, { recursive: true });
         dirReady = true;
       }
-      appendFileSync(path, lines.map((l) => JSON.stringify(l)).join("\n") + "\n");
+      appendFileSync(path2, lines.map((l) => JSON.stringify(l)).join("\n") + "\n");
     } catch (e) {
     }
   };