@ai-sdk/harness 1.0.76 → 1.0.78

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @ai-sdk/harness
 
+## 1.0.78
+
+### Patch Changes
+
+- eace6fb: feat(harness): add experimental support for steering agent conversations mid-turn
+- c0595b4: feat(harness): support passing a filesystem and process restricted sandbox session to `HarnessAgentSession`, using fallbacks in favor of the preferred network sandbox session methods
+
+## 1.0.77
+
+### Patch Changes
+
+- Updated dependencies [e6087c9]
+- Updated dependencies [9566914]
+- Updated dependencies [b181020]
+- Updated dependencies [7054073]
+- Updated dependencies [a828527]
+- Updated dependencies [d3cc3fe]
+  - @ai-sdk/provider-utils@5.0.28
+  - ai@7.0.70
+
 ## 1.0.76
 
 ### Patch Changes

package/bridge/index.ts

@@ -10,4 +10,6 @@ export type {
   BridgeHandle,
   BridgeDebugConfig,
   BridgeDebugLevel,
+  Experimental_BridgeUserMessage,
+  Experimental_BridgeUserMessageQueue,
 } from '../src/bridge';

package/dist/agent/index.d.ts

@@ -692,20 +692,16 @@ type HarnessV1StartOptions = {
      */
     readonly observability?: HarnessV1Observability;
     /**
-     * Network sandbox session the adapter operates against. It is owned and
-     * lifecycled by `HarnessAgent`. Adapters call `restricted()` for the
-     * tool-safe filesystem/exec/spawn surface, and use the infra methods
-     * (`getPortEndpoint`, `ports`, `setNetworkPolicy`,
-     * `setRequestTransformations`, `addRequestTransformations`) for bridge
-     * wiring. Adapters must not call `stop()` themselves; the agent does that
-     * during cleanup.
+     * Sandbox session the adapter operates against. Network sandbox sessions
+     * expose optional infrastructure capabilities for bridge wiring; caller-
+     * provided basic sandbox sessions expose only filesystem and process APIs.
+     * Adapters must not stop or destroy the sandbox themselves.
      */
-    readonly sandboxSession: HarnessV1NetworkSandboxSession;
+    readonly sandboxSession: HarnessV1NetworkSandboxSession | Experimental_SandboxSession;
     /**
-     * Absolute path the adapter runs the agent in for this session. Composed by
-     * the framework as `<sandboxSession.defaultWorkingDirectory>/<harnessId>-<sessionId>`
-     * and created before `doStart`, so the adapter uses it directly instead of
-     * deriving its own provider-specific path.
+     * Absolute path the adapter runs the agent in for this session. Composed
+     * underneath the sandbox's resolved default working directory and created
+     * before `doStart`.
      */
     readonly sessionWorkDir: string;
 };
@@ -1402,7 +1398,7 @@ type HarnessAgentTurnState = 'idle' | 'running' | 'awaiting-approval' | 'awaitin
  * Live harness session held by the caller.
  *
  * Created by {@link import('./harness-agent').HarnessAgent.createSession}.
- * Owns the underlying adapter session and the network sandbox session.
+ * Owns the underlying adapter session and holds its sandbox session.
  *
  * Pass the instance back to `agent.generate` / `agent.stream` on every
  * call; end the local handle with `detach()`, `stop()`, or `destroy()`.
@@ -1429,6 +1425,7 @@ declare class HarnessAgentSession {
     private turnState;
     private turnSequence;
     private activeTurnSequence;
+    private activePromptControl;
     private suspendedTurnState;
     /**
      * Whether this session was created from `resumeFrom` or `continueFrom`.
@@ -1439,7 +1436,7 @@ declare class HarnessAgentSession {
         sessionId: string;
         harness: HarnessAgentAdapter;
         underlyingSession: HarnessAgentAdapterSession;
-        sandboxSession: HarnessV1NetworkSandboxSession;
+        sandboxSession: HarnessV1NetworkSandboxSession | Experimental_SandboxSession;
         ownsSandboxLifecycle?: boolean;
         sessionWorkDir: string;
         toolApproval: HarnessAgentToolApprovalConfiguration | undefined;
@@ -1488,6 +1485,13 @@ declare class HarnessAgentSession {
      * the hood). Throws if the session has ended.
      */
     compact(customInstructions?: string): Promise<void>;
+    /**
+     * Submit another user message to the active turn.
+     *
+     * The runtime accepts the message for its next safe input boundary. Output
+     * caused by the message remains part of the active turn's result stream.
+     */
+    experimental_steerTurn(text: string): Promise<void>;
     /**
      * Park the session, returning a payload the caller can persist and later
      * pass to `agent.createSession({ sessionId, resumeFrom })` to reconnect.
@@ -1531,6 +1535,9 @@ declare class HarnessAgentSession {
     private markAwaitingApprovalIfActive;
     private markAwaitingToolResultIfActive;
     private startTrackedTurn;
+    private setPromptControl;
+    private settleActivePromptControl;
+    private clearActivePromptControl;
     private finishTrackedTurn;
     private endLocalHandle;
     private requireReusableSession;
@@ -1576,12 +1583,13 @@ interface HarnessAgentCallExtensions {
  *    Adapter builtin tools (e.g. Claude Code's `Bash`) pass through
  *    untouched.
  *  - **Sandbox propagation.** On `createSession`, the agent uses a
- *    caller-provided network sandbox session when present; otherwise it calls
- *    the configured provider's `createSession()` (or `resumeSession()`). It
- *    passes the selected session into `doStart`. Its `restricted()` view (a tool-safe
- *    `Experimental_SandboxSession`) is handed to user-tool `execute()` calls
- *    via `experimental_sandbox`. Caller-provided sandboxes remain owned by the
- *    caller and are not stopped or destroyed by the harness layer.
+ *    caller-provided network or basic sandbox session when present; otherwise
+ *    it calls the configured provider's `createSession()` (or
+ *    `resumeSession()`). It passes the selected session into `doStart`. A
+ *    tool-safe `SandboxSession` is handed to user-tool
+ *    `execute()` calls via `experimental_sandbox`. Caller-provided sandboxes
+ *    remain owned by the caller and are not stopped or destroyed by the
+ *    harness layer.
  */
 declare class HarnessAgent<THarness extends HarnessAgentAdapter<any> = HarnessAgentAdapter, TUserTools extends ToolSet = {}, RUNTIME_CONTEXT extends Context = Context, OUTPUT extends OutputInterface = never> implements Agent<never, HarnessAllTools<THarness, TUserTools>, RUNTIME_CONTEXT, OUTPUT> {
     readonly version: "agent-v1";
@@ -1631,10 +1639,10 @@ declare class HarnessAgent<THarness extends HarnessAgentAdapter<any> = HarnessAg
          */
         continueFrom?: HarnessAgentContinueTurnState;
         /**
-         * Existing network sandbox session to run the harness in. When provided,
-         * the caller retains ownership of the sandbox lifecycle.
+         * Existing sandbox session to run the harness in. When provided, the
+         * caller retains ownership of the sandbox lifecycle.
          */
-        sandboxSession?: HarnessV1NetworkSandboxSession;
+        sandboxSession?: HarnessV1NetworkSandboxSession | Experimental_SandboxSession;
         abortSignal?: AbortSignal;
     }): Promise<HarnessAgentSession>;
     generate(options: AgentCallParameters<never, HarnessAllTools<THarness, TUserTools>, RUNTIME_CONTEXT> & HarnessAgentCallExtensions): Promise<GenerateTextResult<HarnessAllTools<THarness, TUserTools>, RUNTIME_CONTEXT, OUTPUT>>;
@@ -1664,6 +1672,17 @@ declare class HarnessAgent<THarness extends HarnessAgentAdapter<any> = HarnessAg
         toolResultContinuations?: readonly HarnessAgentToolResultContinuation[];
         abortSignal?: AbortSignal;
     }): Promise<StreamTextResult<HarnessAllTools<THarness, TUserTools>, RUNTIME_CONTEXT, OUTPUT>>;
+    /**
+     * Submit another user message to a currently running session turn.
+     *
+     * The returned promise resolves after the runtime has accepted the message
+     * for its next safe input boundary. Output caused by the message remains in
+     * the current turn's stream.
+     */
+    experimental_steer(options: {
+        session: HarnessAgentSession;
+        text: string;
+    }): Promise<void>;
     private _startTurn;
     private _resolveTurnInput;
     private _toToolSpecs;

package/dist/agent/index.js

@@ -1511,7 +1511,7 @@ function runPrompt(input) {
     result.fail(err);
   };
   const done = (async () => {
-    var _a5, _b5, _c2, _d2, _e2, _f2, _g2, _h, _i, _j, _k, _l;
+    var _a5, _b5, _c2, _d2, _e2, _f2, _g2, _h, _i, _j, _k, _l, _m;
     let bridge;
     try {
       bridge = await toHarnessStream({
@@ -1549,6 +1549,7 @@ function runPrompt(input) {
       return;
     }
     const { stream, control } = bridge;
+    (_a5 = input.onPromptControlAvailable) == null ? void 0 : _a5.call(input, control);
     const reader = stream.getReader();
     const toolCallsByToolCallId = /* @__PURE__ */ new Map();
     const rawToolCallsByToolCallId = /* @__PURE__ */ new Map();
@@ -1565,7 +1566,7 @@ function runPrompt(input) {
       pendingToolApprovals.map((approval) => [approval.toolCallId, approval])
     );
     const continuationsByApprovalId = new Map(
-      ((_a5 = input.toolApprovalContinuations) != null ? _a5 : []).map((continuation) => [
+      ((_b5 = input.toolApprovalContinuations) != null ? _b5 : []).map((continuation) => [
         continuation.approvalResponse.approvalId,
         continuation
       ])
@@ -1577,7 +1578,7 @@ function runPrompt(input) {
       ])
     );
     const continuationsByToolCallId = new Map(
-      ((_b5 = input.toolResultContinuations) != null ? _b5 : []).map((continuation) => [
+      ((_c2 = input.toolResultContinuations) != null ? _c2 : []).map((continuation) => [
         continuation.toolCallId,
         continuation
       ])
@@ -1870,7 +1871,7 @@ function runPrompt(input) {
               (condition) => condition({ steps: completedSteps })
             )
           )).some(Boolean)) {
-            await ((_c2 = input.onStopConditionMet) == null ? void 0 : _c2.call(input));
+            await ((_d2 = input.onStopConditionMet) == null ? void 0 : _d2.call(input));
             const { finishReason, usage } = pendingStopBoundary;
             releasePendingStopBoundary();
             await telemetry.end({ finishReason, usage });
@@ -1881,7 +1882,7 @@ function runPrompt(input) {
           }
         }
         if (value.type === "stream-start") {
-          await telemetry.start((_d2 = value.modelId) != null ? _d2 : input.session.modelId);
+          await telemetry.start((_e2 = value.modelId) != null ? _e2 : input.session.modelId);
         }
         if (value.type !== "stream-start" && value.type !== "finish-step" && value.type !== "finish" && value.type !== "error") {
           await telemetry.ensureStepOpen();
@@ -1907,7 +1908,7 @@ function runPrompt(input) {
           const rawToolCall = rawToolCallsByToolCallId.get(
             displayValue.toolCallId
           );
-          const toolName = (_e2 = rawToolCall == null ? void 0 : rawToolCall.toolName) != null ? _e2 : toolCall.toolName;
+          const toolName = (_f2 = rawToolCall == null ? void 0 : rawToolCall.toolName) != null ? _f2 : toolCall.toolName;
           if (!isHarnessV1BuiltinToolIncluded({
             toolName,
             toolFiltering: input.builtinToolFiltering
@@ -1987,13 +1988,13 @@ function runPrompt(input) {
             );
           }
           const rawToolCall = rawToolCallsByToolCallId.get(value.toolCallId);
-          const pendingApproval = (_h = pendingApprovalsByApprovalId.get(value.approvalId)) != null ? _h : {
+          const pendingApproval = (_i = pendingApprovalsByApprovalId.get(value.approvalId)) != null ? _i : {
             approvalId: value.approvalId,
             toolCallId: value.toolCallId,
             toolName: toolCall.toolName,
-            input: (_f2 = rawToolCall == null ? void 0 : rawToolCall.input) != null ? _f2 : JSON.stringify(toolCall.input),
+            input: (_g2 = rawToolCall == null ? void 0 : rawToolCall.input) != null ? _g2 : JSON.stringify(toolCall.input),
             kind: "builtin",
-            providerExecuted: (_g2 = rawToolCall == null ? void 0 : rawToolCall.providerExecuted) != null ? _g2 : true,
+            providerExecuted: (_h = rawToolCall == null ? void 0 : rawToolCall.providerExecuted) != null ? _h : true,
             ...(rawToolCall == null ? void 0 : rawToolCall.nativeName) !== void 0 ? { nativeName: rawToolCall.nativeName } : {}
           };
           pendingApprovalsByApprovalId.set(
@@ -2098,7 +2099,7 @@ function runPrompt(input) {
             await telemetry.toolEnd(toolCall.toolCallId, { ok: true, output });
             continue;
           }
-          const pendingApproval = (_i = pendingApprovalsByToolCallId.get(toolCall.toolCallId)) != null ? _i : customToolApprovalDecision.type === "request" ? {
+          const pendingApproval = (_j = pendingApprovalsByToolCallId.get(toolCall.toolCallId)) != null ? _j : customToolApprovalDecision.type === "request" ? {
             approvalId: generateId4(),
             toolCallId: toolCall.toolCallId,
             toolName: toolCall.toolName,
@@ -2189,15 +2190,15 @@ function runPrompt(input) {
         }
       }
       await waitForOutstandingHostToolExecutions();
-      const isTurnSuspending = ((_j = input.isTurnSuspending) == null ? void 0 : _j.call(input)) === true;
+      const isTurnSuspending = ((_k = input.isTurnSuspending) == null ? void 0 : _k.call(input)) === true;
       if (isTurnSuspending) {
         if (finalFinish == null) {
           result.discardCurrentStepContent();
         }
       } else if (finalFinish != null) {
-        (_k = input.onTurnFinished) == null ? void 0 : _k.call(input);
+        (_l = input.onTurnFinished) == null ? void 0 : _l.call(input);
       } else {
-        (_l = input.onTurnFailed) == null ? void 0 : _l.call(input);
+        (_m = input.onTurnFailed) == null ? void 0 : _m.call(input);
       }
       await result.finish(
         finalFinish ? {
@@ -2317,6 +2318,11 @@ function promptToText(prompt) {
   return "";
 }
 
+// src/utils/get-restricted-sandbox-session.ts
+function getRestrictedSandboxSession(sandboxSession) {
+  return "restricted" in sandboxSession ? sandboxSession.restricted() : sandboxSession;
+}
+
 // src/agent/harness-agent-session.ts
 var HarnessAgentSession = class {
   constructor(options) {
@@ -2343,7 +2349,7 @@ var HarnessAgentSession = class {
     this.isResume = options.underlyingSession.isResume;
   }
   /**
-   * Active network sandbox session.
+   * Active sandbox session.
    *
    * @internal — accessed by session turn and lifecycle drivers.
    */
@@ -2382,7 +2388,7 @@ var HarnessAgentSession = class {
         activeTools: options.activeTools,
         toolSpecs: options.toolSpecs,
         builtinToolFiltering: options.builtinToolFiltering,
-        sandboxSession: sandboxSession.restricted(),
+        sandboxSession: getRestrictedSandboxSession(sandboxSession),
         sessionWorkDir: this.sessionWorkDir,
         runtimeContext: options.runtimeContext,
         abortSignal: options.abortSignal,
@@ -2413,6 +2419,9 @@ var HarnessAgentSession = class {
         onTurnFailed: () => {
           this.finishTrackedTurn({ turnId });
         },
+        onPromptControlAvailable: (control) => {
+          this.setPromptControl({ turnId, control });
+        },
         isTurnSuspending: () => this.activeTurnSequence === turnId && this.suspendedTurnState != null,
         onStopConditionMet: () => this.captureStopConditionBoundary({ session, turnId })
       });
@@ -2437,7 +2446,7 @@ var HarnessAgentSession = class {
         activeTools: options.activeTools,
         toolSpecs: options.toolSpecs,
         builtinToolFiltering: options.builtinToolFiltering,
-        sandboxSession: sandboxSession.restricted(),
+        sandboxSession: getRestrictedSandboxSession(sandboxSession),
         sessionWorkDir: this.sessionWorkDir,
         runtimeContext: options.runtimeContext,
         abortSignal: options.abortSignal,
@@ -2470,6 +2479,9 @@ var HarnessAgentSession = class {
         onTurnFailed: () => {
           this.finishTrackedTurn({ turnId });
         },
+        onPromptControlAvailable: (control) => {
+          this.setPromptControl({ turnId, control });
+        },
         isTurnSuspending: () => this.activeTurnSequence === turnId && this.suspendedTurnState != null,
         onStopConditionMet: () => this.captureStopConditionBoundary({ session, turnId })
       });
@@ -2492,6 +2504,34 @@ var HarnessAgentSession = class {
   async compact(customInstructions) {
     await this.requireReusableSession().doCompact(customInstructions);
   }
+  /**
+   * Submit another user message to the active turn.
+   *
+   * The runtime accepts the message for its next safe input boundary. Output
+   * caused by the message remains part of the active turn's result stream.
+   */
+  async experimental_steerTurn(text) {
+    this.requireReusableSession();
+    const activePromptControl = this.activePromptControl;
+    if (this.turnState !== "running" || this.suspendedTurnState != null || activePromptControl == null) {
+      throw new Error(
+        `Harness session ${this.sessionId} has no running turn to steer.`
+      );
+    }
+    const control = await activePromptControl.promise;
+    if (control == null || this.sessionState !== "active" || this.turnState !== "running" || this.suspendedTurnState != null || this.activePromptControl !== activePromptControl || this.activeTurnSequence !== activePromptControl.turnId) {
+      throw new Error(
+        `Harness session ${this.sessionId} no longer has the running turn targeted for steering.`
+      );
+    }
+    if (control.submitUserMessage == null) {
+      throw new HarnessCapabilityUnsupportedError({
+        message: `Harness '${this.harness.harnessId}' does not support steering active turns.`,
+        harnessId: this.harness.harnessId
+      });
+    }
+    await control.submitUserMessage(text);
+  }
   /**
    * Park the session, returning a payload the caller can persist and later
    * pass to `agent.createSession({ sessionId, resumeFrom })` to reconnect.
@@ -2551,7 +2591,7 @@ var HarnessAgentSession = class {
       return validated;
     } finally {
       this.endLocalHandle({ sessionState: "stopped" });
-      if (this.ownsSandboxLifecycle) {
+      if (this.ownsSandboxLifecycle && "stop" in sandboxSession) {
         await Promise.resolve(sandboxSession.stop()).catch(() => {
         });
       }
@@ -2572,10 +2612,12 @@ var HarnessAgentSession = class {
       });
     }
     if (!this.ownsSandboxLifecycle) return;
-    await Promise.resolve(
-      (_b4 = (_a4 = sandboxSession.destroy) == null ? void 0 : _a4.call(sandboxSession)) != null ? _b4 : sandboxSession.stop()
-    ).catch(() => {
-    });
+    if ("stop" in sandboxSession) {
+      await Promise.resolve(
+        (_b4 = (_a4 = sandboxSession.destroy) == null ? void 0 : _a4.call(sandboxSession)) != null ? _b4 : sandboxSession.stop()
+      ).catch(() => {
+      });
+    }
   }
   /**
    * Gracefully freeze the active turn at the slice boundary and return the
@@ -2632,6 +2674,7 @@ var HarnessAgentSession = class {
   }
   async suspendCurrentTurn(options) {
     var _a4;
+    this.clearActivePromptControl();
     (_a4 = this.suspendedTurnState) != null ? _a4 : this.suspendedTurnState = (async () => {
       const raw = await options.session.doSuspendTurn();
       const validated = await validateLifecycleStateData({
@@ -2687,11 +2730,13 @@ var HarnessAgentSession = class {
   }
   markAwaitingApprovalIfActive() {
     if (this.sessionState === "active") {
+      this.clearActivePromptControl();
       this.turnState = "awaiting-approval";
     }
   }
   markAwaitingToolResultIfActive() {
     if (this.sessionState === "active") {
+      this.clearActivePromptControl();
       this.turnState = "awaiting-tool-result";
     }
   }
@@ -2700,17 +2745,52 @@ var HarnessAgentSession = class {
     this.activeTurnSequence = turnId;
     this.suspendedTurnState = void 0;
     this.turnState = "running";
+    this.clearActivePromptControl();
+    let resolve;
+    const promise = new Promise(
+      (resolvePromise) => {
+        resolve = resolvePromise;
+      }
+    );
+    this.activePromptControl = {
+      turnId,
+      promise,
+      resolve,
+      settled: false
+    };
     return turnId;
   }
+  setPromptControl(options) {
+    const activePromptControl = this.activePromptControl;
+    if (this.sessionState !== "active" || this.turnState !== "running" || this.activeTurnSequence !== options.turnId || (activePromptControl == null ? void 0 : activePromptControl.turnId) !== options.turnId) {
+      return;
+    }
+    this.settleActivePromptControl(options.control);
+  }
+  settleActivePromptControl(control) {
+    const activePromptControl = this.activePromptControl;
+    if (activePromptControl == null || activePromptControl.settled) return;
+    activePromptControl.settled = true;
+    activePromptControl.resolve(control);
+  }
+  clearActivePromptControl(turnId) {
+    if (turnId != null && this.activePromptControl != null && this.activePromptControl.turnId !== turnId) {
+      return;
+    }
+    this.settleActivePromptControl(void 0);
+    this.activePromptControl = void 0;
+  }
   finishTrackedTurn(options) {
     if (this.sessionState !== "active") return;
     if (this.activeTurnSequence !== options.turnId) return;
+    this.clearActivePromptControl(options.turnId);
     this.pendingToolApprovals.clear();
     this.pendingToolResults.clear();
     this.suspendedTurnState = void 0;
     this.turnState = "idle";
   }
   endLocalHandle(options) {
+    this.clearActivePromptControl();
     this.sessionState = options.sessionState;
     this.underlyingSession = void 0;
     this.sandboxSession = void 0;
@@ -2942,7 +3022,36 @@ function resolveBootstrapPath({
 }
 
 // src/agent/internal/sandbox-bootstrap.ts
+import { posix as posix3 } from "path";
+
+// src/utils/resolve-sandbox-default-working-directory.ts
 import { posix as posix2 } from "path";
+async function resolveSandboxDefaultWorkingDirectory({
+  sandboxSession,
+  abortSignal
+}) {
+  if ("defaultWorkingDirectory" in sandboxSession) {
+    return sandboxSession.defaultWorkingDirectory;
+  }
+  const result = await sandboxSession.run({
+    command: "pwd",
+    abortSignal
+  });
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `Failed to resolve sandbox default working directory (exit ${result.exitCode}): ${result.stderr || result.stdout}`
+    );
+  }
+  const cwd = result.stdout.trim();
+  if (!posix2.isAbsolute(cwd)) {
+    throw new Error(
+      `Failed to resolve sandbox default working directory: expected an absolute path, got ${JSON.stringify(cwd)}.`
+    );
+  }
+  return cwd === "/" ? cwd : cwd.replace(/\/+$/, "");
+}
+
+// src/agent/internal/sandbox-bootstrap.ts
 var SANDBOX_BOOTSTRAP_IDENTITY_VERSION = 1;
 function validateSandboxBootstrapSettings(settings) {
   if (settings.onBootstrap == null !== (settings.bootstrapHash == null)) {
@@ -2968,10 +3077,10 @@ function normalizeSandboxWorkDir(workDir) {
       "HarnessAgent: `sandboxConfig.workDir` must use POSIX path separators."
     );
   }
-  if (posix2.isAbsolute(workDir)) {
+  if (posix3.isAbsolute(workDir)) {
     throw new Error("HarnessAgent: `sandboxConfig.workDir` must be relative.");
   }
-  const normalized = posix2.normalize(workDir);
+  const normalized = posix3.normalize(workDir);
   if (normalized === "." || normalized === ".." || normalized.startsWith("../")) {
     throw new Error(
       "HarnessAgent: `sandboxConfig.workDir` must stay inside the sandbox default working directory."
@@ -3030,8 +3139,8 @@ async function runSandboxBootstrap({
   abortSignal
 }) {
   if (recipe == null && onBootstrap == null) return;
-  const resolvedDefaultWorkingDirectory = defaultWorkingDirectory != null ? defaultWorkingDirectory : await resolveDefaultWorkingDirectory({
-    session,
+  const resolvedDefaultWorkingDirectory = defaultWorkingDirectory != null ? defaultWorkingDirectory : await resolveSandboxDefaultWorkingDirectory({
+    sandboxSession: session,
     abortSignal
   });
   if (recipe != null && recipeIdentity != null) {
@@ -3055,27 +3164,6 @@ async function runSandboxBootstrap({
   });
   await onBootstrap({ session, workDir: bootstrapWorkDir, abortSignal });
 }
-async function resolveDefaultWorkingDirectory({
-  session,
-  abortSignal
-}) {
-  const result = await session.run({
-    command: "pwd",
-    abortSignal
-  });
-  if (result.exitCode !== 0) {
-    throw new Error(
-      `Failed to resolve sandbox default working directory (exit ${result.exitCode}): ${result.stderr || result.stdout}`
-    );
-  }
-  const cwd = result.stdout.trim();
-  if (!posix2.isAbsolute(cwd)) {
-    throw new Error(
-      `Failed to resolve sandbox default working directory: expected an absolute path, got ${JSON.stringify(cwd)}.`
-    );
-  }
-  return cwd === "/" ? cwd : cwd.replace(/\/+$/, "");
-}
 async function ensureSandboxDirectory({
   session,
   workDir,
@@ -3126,7 +3214,7 @@ function joinSandboxPath({
   base,
   path
 }) {
-  return posix2.join(base, path);
+  return posix3.join(base, path);
 }
 
 // src/agent/internal/resolve-observability.ts
@@ -3347,8 +3435,13 @@ var HarnessAgent = class {
     let sessionWorkDir;
     if (providedSandboxSession != null) {
       sandboxSession = providedSandboxSession;
+      const toolSafeSandboxSession = getRestrictedSandboxSession(sandboxSession);
+      const defaultWorkingDirectory = await resolveSandboxDefaultWorkingDirectory({
+        sandboxSession,
+        abortSignal
+      });
       sessionWorkDir = resolveSessionWorkDir({
-        defaultWorkingDirectory: sandboxSession.defaultWorkingDirectory,
+        defaultWorkingDirectory,
         harnessId: harness.harnessId,
         sessionId,
         workDir: this.sandboxConfig.workDir
@@ -3358,10 +3451,10 @@ var HarnessAgent = class {
         const recipeIdentity = await hashHarnessBootstrap(recipe);
         try {
           await applyBootstrapRecipe({
-            session: sandboxSession.restricted(),
+            session: toolSafeSandboxSession,
             recipe,
             identity: recipeIdentity,
-            defaultWorkingDirectory: sandboxSession.defaultWorkingDirectory,
+            defaultWorkingDirectory,
             abortSignal
           });
         } catch (err) {
@@ -3385,12 +3478,13 @@ var HarnessAgent = class {
             harnessId: harness.harnessId
           });
         }
-        sandboxSession = await sandboxProvider.resumeSession({
+        const resumedSandboxSession = await sandboxProvider.resumeSession({
           sessionId,
           abortSignal
         });
+        sandboxSession = resumedSandboxSession;
         sessionWorkDir = resolveSessionWorkDir({
-          defaultWorkingDirectory: sandboxSession.defaultWorkingDirectory,
+          defaultWorkingDirectory: resumedSandboxSession.defaultWorkingDirectory,
           harnessId: harness.harnessId,
           sessionId,
           workDir: this.sandboxConfig.workDir
@@ -3404,14 +3498,15 @@ var HarnessAgent = class {
           recipe,
           settings: this.sandboxConfig
         });
-        sandboxSession = await sandboxProvider.createSession({
+        const createdSandboxSession = await sandboxProvider.createSession({
           sessionId,
           abortSignal,
           identity: sandboxBootstrapPlan.identity,
           onFirstCreate: sandboxBootstrapPlan.onFirstCreate
         });
+        sandboxSession = createdSandboxSession;
         sessionWorkDir = resolveSessionWorkDir({
-          defaultWorkingDirectory: sandboxSession.defaultWorkingDirectory,
+          defaultWorkingDirectory: createdSandboxSession.defaultWorkingDirectory,
           harnessId: harness.harnessId,
           sessionId,
           workDir: sandboxBootstrapPlan.workDir
@@ -3419,10 +3514,10 @@ var HarnessAgent = class {
         if (sandboxBootstrapPlan.recipe != null && sandboxBootstrapPlan.recipeIdentity != null) {
           try {
             await applyBootstrapRecipe({
-              session: sandboxSession.restricted(),
+              session: createdSandboxSession.restricted(),
               recipe: sandboxBootstrapPlan.recipe,
               identity: sandboxBootstrapPlan.recipeIdentity,
-              defaultWorkingDirectory: sandboxSession.defaultWorkingDirectory,
+              defaultWorkingDirectory: createdSandboxSession.defaultWorkingDirectory,
               abortSignal
             });
           } catch (err) {
@@ -3443,7 +3538,7 @@ var HarnessAgent = class {
       });
       if (this.sandboxConfig.onSession != null) {
         await this.sandboxConfig.onSession({
-          session: sandboxSession.restricted(),
+          session: getRestrictedSandboxSession(sandboxSession),
           sessionWorkDir,
           abortSignal
         });
@@ -3566,6 +3661,16 @@ var HarnessAgent = class {
     });
     return result;
   }
+  /**
+   * Submit another user message to a currently running session turn.
+   *
+   * The returned promise resolves after the runtime has accepted the message
+   * for its next safe input boundary. Output caused by the message remains in
+   * the current turn's stream.
+   */
+  async experimental_steer(options) {
+    await options.session.experimental_steerTurn(options.text);
+  }
   // ─── Internals ──────────────────────────────────────────────────────
   _startTurn(input) {
     if (input.turnInput.mode === "continue") {
@@ -3768,8 +3873,10 @@ function resolveSandboxConfig(settings) {
 }
 async function cleanupAfterStartFailure(input) {
   if (!input.ownsSandboxLifecycle) return;
-  await Promise.resolve(input.sandboxSession.stop()).catch(() => {
-  });
+  if ("stop" in input.sandboxSession) {
+    await Promise.resolve(input.sandboxSession.stop()).catch(() => {
+    });
+  }
 }
 
 // src/agent/prepare-harness-sandbox-template.ts
@@ -3841,8 +3948,8 @@ async function prepareSandboxForHarness(options) {
     }
     const recipeIdentity = await hashHarnessBootstrap(recipe);
     recipeIdentities[harness.harnessId] = recipeIdentity;
-    defaultWorkingDirectory != null ? defaultWorkingDirectory : defaultWorkingDirectory = await resolveDefaultWorkingDirectory({
-      session: options.session,
+    defaultWorkingDirectory != null ? defaultWorkingDirectory : defaultWorkingDirectory = await resolveSandboxDefaultWorkingDirectory({
+      sandboxSession: options.session,
       abortSignal: options.abortSignal
     });
     await applyBootstrapRecipe({