@hachej/boring-agent 0.1.23 → 0.1.26

package/dist/server/index.js

@@ -1,9 +1,11 @@
 import {
-  ErrorCode,
   noopTelemetry,
   safeCapture,
   validateTool
-} from "../chunk-6R7O6BHW.js";
+} from "../chunk-HDOSWEXG.js";
+import {
+  ErrorCode
+} from "../chunk-UBWQ5LT4.js";
 
 // src/server/sandbox/direct/createDirectSandbox.ts
 import { spawn } from "child_process";
@@ -17,7 +19,8 @@ function getEnvSnapshot() {
 }
 
 // src/server/workspace/runtimeLayout.ts
-import { join, resolve } from "path";
+import { mkdirSync, writeFileSync } from "fs";
+import { dirname, join, resolve } from "path";
 var BORING_AGENT_DIR = ".boring-agent";
 var BORING_AGENT_GITIGNORE_CONTENT = "*\n";
 var BORING_AGENT_RUNTIME_DIR_NAMES = [
@@ -81,8 +84,10 @@ function withWorkspacePythonEnv(opts) {
   return {
     ...baseEnv,
     PATH: pathParts.join(":"),
-    VIRTUAL_ENV: baseEnv.VIRTUAL_ENV ?? paths.venv,
-    BORING_AGENT_WORKSPACE_ROOT: baseEnv.BORING_AGENT_WORKSPACE_ROOT ?? runtimeRoot
+    HOME: runtimeRoot,
+    VIRTUAL_ENV: paths.venv,
+    PYTHONHOME: void 0,
+    BORING_AGENT_WORKSPACE_ROOT: runtimeRoot
   };
 }
 
@@ -123,29 +128,34 @@ function terminateProcess(child, signal) {
   } catch {
   }
 }
-function createDirectSandbox() {
+function createDirectSandbox(opts = {}) {
   let workspace = null;
+  let runtimeContext = opts.runtimeContext ?? { runtimeCwd: process.cwd() };
   return {
     id: "direct",
     placement: "server",
     provider: "direct",
     capabilities: ["exec"],
+    get runtimeContext() {
+      return runtimeContext;
+    },
     async init(ctx) {
       workspace = ctx.workspace;
+      runtimeContext = opts.runtimeContext ?? ctx.workspace.runtimeContext;
     },
-    async exec(cmd, opts) {
+    async exec(cmd, opts2) {
       if (!workspace) {
         throw new Error("DirectSandbox not initialized");
       }
       const start = Date.now();
-      const timeoutMs = opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-      const maxOutputBytes = opts?.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
-      const workspaceRoot = workspace.root;
-      const cwd = opts?.cwd ?? workspaceRoot;
-      return await new Promise((resolve9, reject) => {
+      const timeoutMs = opts2?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+      const maxOutputBytes = opts2?.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
+      const workspaceRoot = runtimeContext.runtimeCwd;
+      const cwd = opts2?.cwd ?? workspaceRoot;
+      return await new Promise((resolve10, reject) => {
         const child = spawn(cmd, {
           cwd,
-          env: withWorkspacePythonEnv({ workspaceRoot, env: opts?.env }),
+          env: withWorkspacePythonEnv({ workspaceRoot, env: opts2?.env }),
           shell: true,
           windowsHide: true,
           detached: process.platform !== "win32"
@@ -171,7 +181,7 @@ function createDirectSandbox() {
           if (settled) return;
           settled = true;
           cleanup();
-          resolve9({
+          resolve10({
             stdout: new Uint8Array(Buffer.concat(stdoutChunks)),
             stderr: new Uint8Array(Buffer.concat(stderrChunks)),
             exitCode: typeof exitCode === "number" ? exitCode : timedOut ? 124 : 1,
@@ -182,10 +192,10 @@ function createDirectSandbox() {
           });
         };
         child.stdout?.on("data", (chunk2) => {
-          appendOutput(stdoutChunks, chunk2, captureState, opts?.onStdout);
+          appendOutput(stdoutChunks, chunk2, captureState, opts2?.onStdout);
         });
         child.stderr?.on("data", (chunk2) => {
-          appendOutput(stderrChunks, chunk2, captureState, opts?.onStderr);
+          appendOutput(stderrChunks, chunk2, captureState, opts2?.onStderr);
         });
         child.on("error", (error) => {
           if (settled) return;
@@ -203,24 +213,24 @@ function createDirectSandbox() {
             if (!settled) terminateProcess(child, "SIGKILL");
           }, TERMINATION_GRACE_MS);
         }, timeoutMs);
-        if (opts?.onHeartbeat) {
+        if (opts2?.onHeartbeat) {
           heartbeatHandle = setInterval(() => {
-            opts.onHeartbeat?.(Date.now() - start);
+            opts2.onHeartbeat?.(Date.now() - start);
           }, 1e3);
         }
-        if (opts?.signal) {
+        if (opts2?.signal) {
           const abort = () => {
             terminateProcess(child, "SIGTERM");
             killHandle = setTimeout(() => {
               if (!settled) terminateProcess(child, "SIGKILL");
             }, TERMINATION_GRACE_MS);
           };
-          if (opts.signal.aborted) {
+          if (opts2.signal.aborted) {
             abort();
           } else {
-            opts.signal.addEventListener("abort", abort, { once: true });
+            opts2.signal.addEventListener("abort", abort, { once: true });
             child.on("close", () => {
-              opts.signal?.removeEventListener("abort", abort);
+              opts2.signal?.removeEventListener("abort", abort);
             });
           }
         }
@@ -230,10 +240,10 @@ function createDirectSandbox() {
 }
 
 // src/server/sandbox/bwrap/createBwrapSandbox.ts
-import { access } from "fs/promises";
+import { access, stat as stat3 } from "fs/promises";
 import { constants } from "fs";
 import { spawn as spawn2 } from "child_process";
-import { dirname, isAbsolute as isAbsolute2, join as join2, relative, resolve as resolve2, sep } from "path";
+import { dirname as dirname4, isAbsolute as isAbsolute3, join as join2, posix, relative as relative3, resolve as resolve4, sep as sep2 } from "path";
 
 // src/server/sandbox/bwrap/buildBwrapArgs.ts
 import { isAbsolute } from "path";
@@ -251,6 +261,12 @@ var RO_BIND_DIRS = [
   "/etc/ssl",
   "/etc/ca-certificates"
 ];
+var RO_BIND_TRY_DIRS = [
+  // Ubuntu/systemd commonly makes /etc/resolv.conf a symlink to this
+  // directory. The sandbox already shares the network namespace, but DNS
+  // still fails if the symlink target is hidden by the tmpfs root.
+  "/run/systemd/resolve"
+];
 function validateWorkspaceRoot(workspaceRoot) {
   if (workspaceRoot.length === 0) {
     throw new Error("workspaceRoot must not be empty");
@@ -291,6 +307,9 @@ function buildBwrapArgs(workspaceRoot, options) {
   for (const dir of RO_BIND_DIRS) {
     args.push("--ro-bind", dir, dir);
   }
+  for (const dir of RO_BIND_TRY_DIRS) {
+    args.push("--ro-bind-try", dir, dir);
+  }
   if (options?.extraArgs) {
     args.push(...options.extraArgs);
   }
@@ -311,6 +330,292 @@ function buildBwrapArgs(workspaceRoot, options) {
   return args;
 }
 
+// src/server/workspace/createNodeWorkspace.ts
+import { lstat as lstat2, mkdir, readdir, readFile, rename, rm, stat as stat2, unlink, writeFile } from "fs/promises";
+import { dirname as dirname3, relative as relative2, resolve as resolve3, sep } from "path";
+import chokidar from "chokidar";
+
+// src/server/workspace/paths.ts
+import { lstat, realpath, stat } from "fs/promises";
+import { dirname as dirname2, isAbsolute as isAbsolute2, relative, resolve as resolve2 } from "path";
+function createPathValidationError(reason, requestedPath, message) {
+  return Object.assign(new Error(message), {
+    statusCode: 400,
+    reason,
+    requestedPath
+  });
+}
+function normalizeForTraversalChecks(requestedPath) {
+  let decoded = requestedPath;
+  try {
+    decoded = decodeURIComponent(requestedPath);
+  } catch {
+  }
+  return decoded.replace(/\\/g, "/");
+}
+function hasTraversalSegment(requestedPath) {
+  return requestedPath.split("/").some((segment) => segment === ".." || segment.startsWith(".."));
+}
+function isWindowsAbsolutePath(requestedPath) {
+  return /^[A-Za-z]:[\\/]/.test(requestedPath) || requestedPath.startsWith("\\\\");
+}
+function validatePath(workspaceRoot, relPath) {
+  if (relPath.includes("\0")) {
+    throw createPathValidationError("null-byte", relPath, "Null byte in path");
+  }
+  const normalized = normalizeForTraversalChecks(relPath);
+  if (isAbsolute2(relPath) || normalized.startsWith("/") || isWindowsAbsolutePath(relPath) || isWindowsAbsolutePath(normalized)) {
+    throw createPathValidationError("absolute-path", relPath, "Absolute paths are not allowed");
+  }
+  if (hasTraversalSegment(normalized) || normalized.startsWith("~") || normalized.startsWith("$") || /[\r\n]/.test(normalized)) {
+    throw createPathValidationError("path-escape", relPath, "Path escapes workspace root");
+  }
+  const resolvedRoot = resolve2(workspaceRoot);
+  const resolvedPath = resolve2(workspaceRoot, relPath);
+  if (resolvedPath !== resolvedRoot && !resolvedPath.startsWith(`${resolvedRoot}/`)) {
+    throw createPathValidationError("path-escape", relPath, "Path escapes workspace root");
+  }
+  return resolvedPath;
+}
+async function assertRealPathWithinWorkspace(workspaceRoot, absPath) {
+  const realRoot = await realpath(resolve2(workspaceRoot));
+  const realCandidate = await realpath(absPath);
+  const rel = relative(realRoot, realCandidate);
+  if (rel.startsWith("..") || isAbsolute2(rel)) {
+    throw createPathValidationError(
+      "symlink-escape",
+      absPath,
+      "Resolved path escapes workspace root"
+    );
+  }
+}
+async function ensureExistingWorkspacePath(workspaceRoot, relPath) {
+  const absPath = validatePath(workspaceRoot, relPath);
+  await assertRealPathWithinWorkspace(workspaceRoot, absPath);
+  await stat(absPath);
+  return absPath;
+}
+async function ensureWritableWorkspacePath(workspaceRoot, relPath) {
+  const absPath = validatePath(workspaceRoot, relPath);
+  const parentPath = dirname2(absPath);
+  await stat(parentPath);
+  await assertRealPathWithinWorkspace(workspaceRoot, parentPath);
+  try {
+    const pathStat = await lstat(absPath);
+    if (pathStat.isSymbolicLink()) {
+      throw createPathValidationError("symlink-escape", relPath, "Target path is a symlink");
+    }
+  } catch (error) {
+    const code = error.code;
+    if (code !== "ENOENT") {
+      throw error;
+    }
+  }
+  return absPath;
+}
+
+// src/server/workspace/createNodeWorkspace.ts
+var EPERM_CODE = "EPERM";
+var DEFAULT_WATCH_IGNORES = [
+  "node_modules",
+  ".git",
+  ".DS_Store",
+  "dist",
+  ".next",
+  ".turbo",
+  "test-results"
+];
+function shouldIgnoreWatchPath(path4) {
+  const parts = path4.split(sep);
+  return parts.some(
+    (part) => DEFAULT_WATCH_IGNORES.includes(part) || part.endsWith(".tsbuildinfo")
+  );
+}
+function createNodeWatcher(root) {
+  const listeners = /* @__PURE__ */ new Set();
+  let fsw = null;
+  let closed = false;
+  const ensureFsw = () => {
+    if (fsw) return fsw;
+    fsw = chokidar.watch(root, {
+      ignored: shouldIgnoreWatchPath,
+      ignoreInitial: true,
+      persistent: true,
+      followSymlinks: false
+      // Avoid chokidar's awaitWriteFinish polling loop in long-lived app
+      // servers. Consumers already reconcile by mtime after invalidation.
+      // No native renames from chokidar — `unlinkDir`/`addDir`/
+      // `unlink`/`add` are the primitives we get. We surface them as
+      // separate `unlink` + `write`/`mkdir` events; renames are best
+      // recovered at the consumer level if needed.
+    });
+    fsw.on("add", (p, s) => emit({ op: "write", path: rel(p), mtimeMs: s?.mtimeMs }));
+    fsw.on("change", (p, s) => emit({ op: "write", path: rel(p), mtimeMs: s?.mtimeMs }));
+    fsw.on("addDir", (p) => emit({ op: "mkdir", path: rel(p) }));
+    fsw.on("unlink", (p) => emit({ op: "unlink", path: rel(p) }));
+    fsw.on("unlinkDir", (p) => emit({ op: "unlink", path: rel(p) }));
+    fsw.on("error", () => {
+    });
+    return fsw;
+  };
+  const rel = (abs) => {
+    const r = relative2(root, abs);
+    return r.split(sep).join("/");
+  };
+  const emit = (event) => {
+    if (closed) return;
+    if (event.path === "" || event.path.startsWith("..")) return;
+    for (const l of [...listeners]) {
+      try {
+        l(event);
+      } catch {
+      }
+    }
+  };
+  return {
+    subscribe(listener) {
+      if (closed) return () => {
+      };
+      listeners.add(listener);
+      ensureFsw();
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    close() {
+      if (closed) return;
+      closed = true;
+      listeners.clear();
+      fsw?.close().catch(() => {
+      });
+      fsw = null;
+    }
+  };
+}
+var nodeWorkspaceHostRoots = /* @__PURE__ */ new WeakMap();
+function getNodeWorkspaceHostRoot(workspace) {
+  return nodeWorkspaceHostRoots.get(workspace);
+}
+function createNodeWorkspace(root, opts = {}) {
+  const runtimeContext = opts.runtimeContext ?? { runtimeCwd: root };
+  let cachedWatcher = null;
+  const workspace = {
+    root: runtimeContext.runtimeCwd,
+    runtimeContext,
+    fsCapability: "strong",
+    watch() {
+      if (!cachedWatcher) cachedWatcher = createNodeWatcher(root);
+      return cachedWatcher;
+    },
+    async readFile(relPath) {
+      const absPath = await ensureExistingWorkspacePath(root, relPath);
+      return await readFile(absPath, "utf-8");
+    },
+    async readBinaryFile(relPath) {
+      const absPath = await ensureExistingWorkspacePath(root, relPath);
+      return new Uint8Array(await readFile(absPath));
+    },
+    async writeFile(relPath, data) {
+      const absPath = await ensureWritableWorkspacePath(root, relPath);
+      await writeFile(absPath, data, "utf-8");
+    },
+    async writeBinaryFile(relPath, data) {
+      const absPath = await ensureWritableWorkspacePath(root, relPath);
+      await writeFile(absPath, data);
+    },
+    async readFileWithStat(relPath) {
+      const absPath = await ensureExistingWorkspacePath(root, relPath);
+      const [content, fileStat] = await Promise.all([
+        readFile(absPath, "utf-8"),
+        stat2(absPath)
+      ]);
+      return {
+        content,
+        stat: {
+          size: fileStat.size,
+          mtimeMs: fileStat.mtimeMs,
+          kind: fileStat.isDirectory() ? "dir" : "file"
+        }
+      };
+    },
+    async writeFileWithStat(relPath, data) {
+      const absPath = await ensureWritableWorkspacePath(root, relPath);
+      await writeFile(absPath, data, "utf-8");
+      const fileStat = await stat2(absPath);
+      return {
+        size: fileStat.size,
+        mtimeMs: fileStat.mtimeMs,
+        kind: fileStat.isDirectory() ? "dir" : "file"
+      };
+    },
+    async writeBinaryFileWithStat(relPath, data) {
+      const absPath = await ensureWritableWorkspacePath(root, relPath);
+      await writeFile(absPath, data);
+      const fileStat = await stat2(absPath);
+      return {
+        size: fileStat.size,
+        mtimeMs: fileStat.mtimeMs,
+        kind: fileStat.isDirectory() ? "dir" : "file"
+      };
+    },
+    async unlink(relPath) {
+      const absPath = await ensureExistingWorkspacePath(root, relPath);
+      if (absPath === resolve3(root)) {
+        throw Object.assign(new Error("cannot remove workspace root"), { code: EPERM_CODE });
+      }
+      const pathStat = await lstat2(absPath);
+      if (pathStat.isDirectory()) {
+        await rm(absPath, { recursive: true, force: false });
+        return;
+      }
+      await unlink(absPath);
+    },
+    async readdir(relPath) {
+      const absPath = await ensureExistingWorkspacePath(root, relPath);
+      const entries = await readdir(absPath, { withFileTypes: true });
+      return entries.map((entry) => ({
+        name: entry.name,
+        kind: entry.isDirectory() ? "dir" : "file"
+      }));
+    },
+    async stat(relPath) {
+      const absPath = await ensureExistingWorkspacePath(root, relPath);
+      const fileStat = await stat2(absPath);
+      return {
+        size: fileStat.size,
+        mtimeMs: fileStat.mtimeMs,
+        kind: fileStat.isDirectory() ? "dir" : "file"
+      };
+    },
+    async mkdir(relPath, opts2) {
+      const absPath = validatePath(root, relPath);
+      let existingAncestor = absPath;
+      while (true) {
+        try {
+          await stat2(existingAncestor);
+          break;
+        } catch (error) {
+          const code = error.code;
+          if (code !== "ENOENT") throw error;
+          const parent = dirname3(existingAncestor);
+          if (parent === existingAncestor) throw error;
+          existingAncestor = parent;
+        }
+      }
+      await assertRealPathWithinWorkspace(root, existingAncestor);
+      await mkdir(absPath, { recursive: opts2?.recursive ?? false });
+    },
+    async rename(fromRelPath, toRelPath2) {
+      validatePath(root, toRelPath2);
+      const fromAbsPath = await ensureExistingWorkspacePath(root, fromRelPath);
+      const toAbsPath = await ensureWritableWorkspacePath(root, toRelPath2);
+      await rename(fromAbsPath, toAbsPath);
+    }
+  };
+  nodeWorkspaceHostRoots.set(workspace, root);
+  return workspace;
+}
+
 // src/server/sandbox/bwrap/createBwrapSandbox.ts
 var DEFAULT_TIMEOUT_MS2 = BWRAP_TIMEOUT_SECONDS * 1e3;
 var DEFAULT_MAX_OUTPUT_BYTES2 = 1048576;
@@ -348,16 +653,24 @@ function terminateProcess2(child, signal) {
   } catch {
   }
 }
-function computeSandboxCwd(workspaceRoot, cwd) {
-  if (!cwd) return SANDBOX_HOME2;
-  const absoluteCwd = isAbsolute2(cwd) ? cwd : resolve2(workspaceRoot, cwd);
-  const relPath = relative(workspaceRoot, absoluteCwd);
-  if (relPath === "") return SANDBOX_HOME2;
-  if (relPath === ".." || relPath.startsWith(`..${sep}`)) {
+function computeSandboxCwd(workspaceRoot, runtimeCwd, cwd) {
+  if (!cwd) return runtimeCwd;
+  const normalizedRuntimeCwd = posix.normalize(runtimeCwd).replace(/\/+$/, "") || "/";
+  if (cwd === normalizedRuntimeCwd) return normalizedRuntimeCwd;
+  if (cwd.startsWith(`${normalizedRuntimeCwd}/`)) {
+    const normalizedCwd = posix.normalize(cwd);
+    if (normalizedCwd === normalizedRuntimeCwd) return normalizedRuntimeCwd;
+    if (normalizedCwd.startsWith(`${normalizedRuntimeCwd}/`)) return normalizedCwd;
+    throw new Error("cwd must stay within workspace root");
+  }
+  const absoluteCwd = isAbsolute3(cwd) ? cwd : resolve4(workspaceRoot, cwd);
+  const relPath = relative3(workspaceRoot, absoluteCwd);
+  if (relPath === "") return normalizedRuntimeCwd;
+  if (relPath === ".." || relPath.startsWith(`..${sep2}`)) {
     throw new Error("cwd must stay within workspace root");
   }
-  const posixRelPath = relPath.split(sep).join("/");
-  return `${SANDBOX_HOME2}/${posixRelPath}`;
+  const posixRelPath = relPath.split(sep2).join("/");
+  return `${normalizedRuntimeCwd}/${posixRelPath}`;
 }
 function withSandboxCwd(baseArgs, sandboxCwd) {
   const args = [...baseArgs];
@@ -402,7 +715,7 @@ async function assertBwrapAvailable() {
     });
   });
 }
-async function dirAccessible(path4) {
+async function pathExists(path4) {
   try {
     await access(path4, constants.F_OK);
     return true;
@@ -410,38 +723,58 @@ async function dirAccessible(path4) {
     return false;
   }
 }
+async function dirExists(path4) {
+  try {
+    return (await stat3(path4)).isDirectory();
+  } catch {
+    return false;
+  }
+}
 async function buildGlobalToolMounts(workspaceRoot) {
-  const globalRoot = dirname(workspaceRoot);
+  const globalRoot = dirname4(workspaceRoot);
   if (globalRoot === workspaceRoot) return [];
   const args = [];
-  if (await dirAccessible(join2(globalRoot, ".boring-agent"))) {
-    args.push("--ro-bind", join2(globalRoot, ".boring-agent"), `${SANDBOX_HOME2}/.boring-agent`);
-  }
-  if (await dirAccessible(join2(globalRoot, ".venv"))) {
-    args.push("--ro-bind", join2(globalRoot, ".venv"), `${SANDBOX_HOME2}/.venv`);
+  const mountIfChildLacks = async (runtimeRelPath) => {
+    const parentRuntimePath = join2(globalRoot, runtimeRelPath);
+    const childRuntimePath = join2(workspaceRoot, runtimeRelPath);
+    if (!await dirExists(parentRuntimePath)) return false;
+    if (await pathExists(childRuntimePath)) return false;
+    args.push("--ro-bind", parentRuntimePath, `${SANDBOX_HOME2}/${runtimeRelPath}`);
+    return true;
+  };
+  const mountedParentAgentDir = await mountIfChildLacks(".boring-agent");
+  if (!mountedParentAgentDir) {
+    await mountIfChildLacks(".boring-agent/venv");
   }
   return args;
 }
-function createBwrapSandbox() {
+function createBwrapSandbox(opts = {}) {
   let workspace = null;
+  let hostWorkspaceRoot = opts.hostWorkspaceRoot;
+  let runtimeContext = opts.runtimeContext ?? { runtimeCwd: SANDBOX_HOME2 };
   return {
     id: "bwrap",
     placement: "server",
     provider: "bwrap",
     capabilities: ["exec"],
+    get runtimeContext() {
+      return runtimeContext;
+    },
     async init(ctx) {
       workspace = ctx.workspace;
+      hostWorkspaceRoot = opts.hostWorkspaceRoot ?? getNodeWorkspaceHostRoot(ctx.workspace) ?? ctx.workspace.root;
+      runtimeContext = opts.runtimeContext ?? { runtimeCwd: SANDBOX_HOME2 };
       await assertBwrapAvailable();
     },
-    async exec(cmd, opts) {
+    async exec(cmd, opts2) {
       if (!workspace) {
         throw new Error("BwrapSandbox not initialized");
       }
       const start = Date.now();
-      const timeoutMs = opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
-      const maxOutputBytes = opts?.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES2;
-      const workspaceRoot = workspace.root;
-      const sandboxCwd = computeSandboxCwd(workspaceRoot, opts?.cwd);
+      const timeoutMs = opts2?.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+      const maxOutputBytes = opts2?.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES2;
+      const workspaceRoot = hostWorkspaceRoot ?? workspace.root;
+      const sandboxCwd = computeSandboxCwd(workspaceRoot, runtimeContext.runtimeCwd, opts2?.cwd);
       const postWorkspaceArgs = await buildGlobalToolMounts(workspaceRoot);
       const baseArgs = buildBwrapArgs(workspaceRoot, { postWorkspaceArgs });
       const args = [
@@ -450,9 +783,12 @@ function createBwrapSandbox() {
         "-c",
         cmd
       ];
-      return await new Promise((resolve9, reject) => {
+      return await new Promise((resolve10, reject) => {
         const child = spawn2("bwrap", args, {
-          env: withWorkspacePythonEnv({ workspaceRoot, env: opts?.env, sandboxRoot: SANDBOX_HOME2 }),
+          env: {
+            ...withWorkspacePythonEnv({ workspaceRoot, env: opts2?.env, sandboxRoot: SANDBOX_HOME2 }),
+            PWD: sandboxCwd
+          },
           stdio: ["ignore", "pipe", "pipe"],
           detached: process.platform !== "win32"
         });
@@ -477,7 +813,7 @@ function createBwrapSandbox() {
           if (settled) return;
           settled = true;
           cleanup();
-          resolve9({
+          resolve10({
             stdout: new Uint8Array(Buffer.concat(stdoutChunks)),
             stderr: new Uint8Array(Buffer.concat(stderrChunks)),
             exitCode: typeof exitCode === "number" ? exitCode : timedOut ? 124 : 1,
@@ -488,10 +824,10 @@ function createBwrapSandbox() {
           });
         };
         child.stdout?.on("data", (chunk2) => {
-          appendOutput2(stdoutChunks, chunk2, captureState, opts?.onStdout);
+          appendOutput2(stdoutChunks, chunk2, captureState, opts2?.onStdout);
         });
         child.stderr?.on("data", (chunk2) => {
-          appendOutput2(stderrChunks, chunk2, captureState, opts?.onStderr);
+          appendOutput2(stderrChunks, chunk2, captureState, opts2?.onStderr);
         });
         child.on("error", (error) => {
           if (settled) return;
@@ -509,24 +845,24 @@ function createBwrapSandbox() {
             if (!settled) terminateProcess2(child, "SIGKILL");
           }, KILL_GRACE_SECONDS * 1e3);
         }, timeoutMs);
-        if (opts?.onHeartbeat) {
+        if (opts2?.onHeartbeat) {
           heartbeatHandle = setInterval(() => {
-            opts.onHeartbeat?.(Date.now() - start);
+            opts2.onHeartbeat?.(Date.now() - start);
           }, 1e3);
         }
-        if (opts?.signal) {
+        if (opts2?.signal) {
           const abort = () => {
             terminateProcess2(child, "SIGTERM");
             killHandle = setTimeout(() => {
               if (!settled) terminateProcess2(child, "SIGKILL");
             }, KILL_GRACE_SECONDS * 1e3);
           };
-          if (opts.signal.aborted) {
+          if (opts2.signal.aborted) {
             abort();
           } else {
-            opts.signal.addEventListener("abort", abort, { once: true });
+            opts2.signal.addEventListener("abort", abort, { once: true });
             child.on("close", () => {
-              opts.signal?.removeEventListener("abort", abort);
+              opts2.signal?.removeEventListener("abort", abort);
             });
           }
         }
@@ -536,7 +872,7 @@ function createBwrapSandbox() {
 }
 
 // src/server/sandbox/vercel-sandbox/FileHandleStore.ts
-import { chmod, mkdir, readFile, rename, unlink, writeFile } from "fs/promises";
+import { chmod, mkdir as mkdir2, readFile as readFile2, rename as rename2, unlink as unlink2, writeFile as writeFile2 } from "fs/promises";
 import { homedir } from "os";
 import path from "path";
 var DEFAULT_STORE_PATH = path.join(
@@ -573,7 +909,7 @@ var FileHandleStore = class {
   }
   async readStore() {
     try {
-      const raw = await readFile(this.storePath, "utf8");
+      const raw = await readFile2(this.storePath, "utf8");
       if (!raw.trim()) {
         return {};
       }
@@ -587,23 +923,23 @@ var FileHandleStore = class {
     }
   }
   async writeStore(store) {
-    await mkdir(path.dirname(this.storePath), { recursive: true, mode: 448 });
+    await mkdir2(path.dirname(this.storePath), { recursive: true, mode: 448 });
     const tmpPath = `${this.storePath}.tmp-${process.pid}-${Date.now()}`;
     const content = `${JSON.stringify(store, null, 2)}
 `;
     let tmpWritten = false;
     let renamed = false;
     try {
-      await writeFile(tmpPath, content, { encoding: "utf8", mode: 384 });
+      await writeFile2(tmpPath, content, { encoding: "utf8", mode: 384 });
       tmpWritten = true;
       await chmod(tmpPath, 384);
-      await rename(tmpPath, this.storePath);
+      await rename2(tmpPath, this.storePath);
       renamed = true;
       await chmod(this.storePath, 384);
     } finally {
       if (tmpWritten && !renamed) {
         try {
-          await unlink(tmpPath);
+          await unlink2(tmpPath);
         } catch {
         }
       }
@@ -997,7 +1333,7 @@ function evictSandboxHandleCacheForWorkspace(workspaceId) {
 
 // src/server/sandbox/vercel-sandbox/bake.ts
 import { createHash as createHash2 } from "crypto";
-import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, rename as rename2, unlink as unlink2, writeFile as writeFile2 } from "fs/promises";
+import { chmod as chmod2, mkdir as mkdir3, readFile as readFile3, rename as rename3, unlink as unlink3, writeFile as writeFile3 } from "fs/promises";
 import { homedir as homedir2 } from "os";
 import path2 from "path";
 var DEFAULT_RUNTIME = "python3.13";
@@ -1033,7 +1369,7 @@ function defaultCacheStore() {
 }
 async function readCache(cachePath) {
   try {
-    const raw = await readFile2(cachePath, "utf8");
+    const raw = await readFile3(cachePath, "utf8");
     if (!raw.trim()) {
       return defaultCacheStore();
     }
@@ -1054,23 +1390,23 @@ async function readCache(cachePath) {
   }
 }
 async function writeCache(cachePath, store) {
-  await mkdir2(path2.dirname(cachePath), { recursive: true, mode: 448 });
+  await mkdir3(path2.dirname(cachePath), { recursive: true, mode: 448 });
   const tmpPath = `${cachePath}.tmp-${process.pid}-${Date.now()}`;
   const content = `${JSON.stringify(store, null, 2)}
 `;
   let tmpWritten = false;
   let renamed = false;
   try {
-    await writeFile2(tmpPath, content, { encoding: "utf8", mode: 384 });
+    await writeFile3(tmpPath, content, { encoding: "utf8", mode: 384 });
     tmpWritten = true;
     await chmod2(tmpPath, 384);
-    await rename2(tmpPath, cachePath);
+    await rename3(tmpPath, cachePath);
     renamed = true;
     await chmod2(cachePath, 384);
   } finally {
     if (tmpWritten && !renamed) {
       try {
-        await unlink2(tmpPath);
+        await unlink3(tmpPath);
       } catch {
       }
     }
@@ -1229,318 +1565,44 @@ function buildDeploymentSnapshotRecipe(opts = {}) {
     ]
   };
 }
-async function prepareDeploymentSnapshot(provider, recipe) {
-  return await provider.prepareDeploymentSnapshot(recipe);
-}
-
-// src/server/sandbox/vercel-sandbox/deploymentSnapshot.ts
-function createVercelDeploymentSnapshotProvider(opts) {
-  return {
-    async prepareDeploymentSnapshot(recipe) {
-      return await bakeSnapshotIfNeeded({
-        client: opts.client,
-        snapshotId: opts.snapshotId,
-        runtime: recipe.runtime,
-        cachePath: opts.cachePath,
-        logger: opts.logger,
-        now: opts.now,
-        setupCommands: recipe.setupCommands,
-        pythonPackages: recipe.pythonPackages,
-        systemPackages: recipe.systemPackages
-      });
-    }
-  };
-}
-async function prepareVercelDeploymentSnapshot(opts) {
-  return await bakeSnapshotIfNeeded({
-    client: opts.client,
-    snapshotId: opts.snapshotId,
-    runtime: opts.runtime,
-    cachePath: opts.cachePath,
-    logger: opts.logger,
-    now: opts.now,
-    setupCommands: opts.setupCommands,
-    pythonPackages: opts.pythonPackages,
-    systemPackages: opts.systemPackages
-  });
-}
-
-// src/server/workspace/createNodeWorkspace.ts
-import { lstat as lstat2, mkdir as mkdir3, readdir, readFile as readFile3, rename as rename3, rmdir, stat as stat2, unlink as unlink3, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname3, relative as relative3, sep as sep2 } from "path";
-import chokidar from "chokidar";
-
-// src/server/workspace/paths.ts
-import { lstat, realpath, stat } from "fs/promises";
-import { dirname as dirname2, isAbsolute as isAbsolute3, relative as relative2, resolve as resolve3 } from "path";
-function createPathValidationError(reason, requestedPath, message) {
-  return Object.assign(new Error(message), {
-    statusCode: 400,
-    reason,
-    requestedPath
-  });
-}
-function normalizeForTraversalChecks(requestedPath) {
-  let decoded = requestedPath;
-  try {
-    decoded = decodeURIComponent(requestedPath);
-  } catch {
-  }
-  return decoded.replace(/\\/g, "/");
-}
-function hasTraversalSegment(requestedPath) {
-  return requestedPath.split("/").some((segment) => segment === ".." || segment.startsWith(".."));
-}
-function isWindowsAbsolutePath(requestedPath) {
-  return /^[A-Za-z]:[\\/]/.test(requestedPath) || requestedPath.startsWith("\\\\");
-}
-function validatePath(workspaceRoot, relPath) {
-  if (relPath.includes("\0")) {
-    throw createPathValidationError("null-byte", relPath, "Null byte in path");
-  }
-  const normalized = normalizeForTraversalChecks(relPath);
-  if (isAbsolute3(relPath) || normalized.startsWith("/") || isWindowsAbsolutePath(relPath) || isWindowsAbsolutePath(normalized)) {
-    throw createPathValidationError("absolute-path", relPath, "Absolute paths are not allowed");
-  }
-  if (hasTraversalSegment(normalized) || normalized.startsWith("~") || normalized.startsWith("$") || /[\r\n]/.test(normalized)) {
-    throw createPathValidationError("path-escape", relPath, "Path escapes workspace root");
-  }
-  const resolvedRoot = resolve3(workspaceRoot);
-  const resolvedPath = resolve3(workspaceRoot, relPath);
-  if (resolvedPath !== resolvedRoot && !resolvedPath.startsWith(`${resolvedRoot}/`)) {
-    throw createPathValidationError("path-escape", relPath, "Path escapes workspace root");
-  }
-  return resolvedPath;
-}
-async function assertRealPathWithinWorkspace(workspaceRoot, absPath) {
-  const realRoot = await realpath(resolve3(workspaceRoot));
-  const realCandidate = await realpath(absPath);
-  const rel = relative2(realRoot, realCandidate);
-  if (rel.startsWith("..") || isAbsolute3(rel)) {
-    throw createPathValidationError(
-      "symlink-escape",
-      absPath,
-      "Resolved path escapes workspace root"
-    );
-  }
-}
-async function ensureExistingWorkspacePath(workspaceRoot, relPath) {
-  const absPath = validatePath(workspaceRoot, relPath);
-  await assertRealPathWithinWorkspace(workspaceRoot, absPath);
-  await stat(absPath);
-  return absPath;
-}
-async function ensureWritableWorkspacePath(workspaceRoot, relPath) {
-  const absPath = validatePath(workspaceRoot, relPath);
-  const parentPath = dirname2(absPath);
-  await stat(parentPath);
-  await assertRealPathWithinWorkspace(workspaceRoot, parentPath);
-  try {
-    const pathStat = await lstat(absPath);
-    if (pathStat.isSymbolicLink()) {
-      throw createPathValidationError("symlink-escape", relPath, "Target path is a symlink");
-    }
-  } catch (error) {
-    const code = error.code;
-    if (code !== "ENOENT") {
-      throw error;
-    }
-  }
-  return absPath;
-}
-
-// src/server/workspace/createNodeWorkspace.ts
-var DEFAULT_WATCH_IGNORES = [
-  "node_modules",
-  ".git",
-  ".DS_Store",
-  "dist",
-  ".next",
-  ".turbo",
-  "test-results"
-];
-function shouldIgnoreWatchPath(path4) {
-  const parts = path4.split(sep2);
-  return parts.some(
-    (part) => DEFAULT_WATCH_IGNORES.includes(part) || part.endsWith(".tsbuildinfo")
-  );
-}
-function createNodeWatcher(root) {
-  const listeners = /* @__PURE__ */ new Set();
-  let fsw = null;
-  let closed = false;
-  const ensureFsw = () => {
-    if (fsw) return fsw;
-    fsw = chokidar.watch(root, {
-      ignored: shouldIgnoreWatchPath,
-      ignoreInitial: true,
-      persistent: true,
-      followSymlinks: false
-      // Avoid chokidar's awaitWriteFinish polling loop in long-lived app
-      // servers. Consumers already reconcile by mtime after invalidation.
-      // No native renames from chokidar — `unlinkDir`/`addDir`/
-      // `unlink`/`add` are the primitives we get. We surface them as
-      // separate `unlink` + `write`/`mkdir` events; renames are best
-      // recovered at the consumer level if needed.
-    });
-    fsw.on("add", (p, s) => emit({ op: "write", path: rel(p), mtimeMs: s?.mtimeMs }));
-    fsw.on("change", (p, s) => emit({ op: "write", path: rel(p), mtimeMs: s?.mtimeMs }));
-    fsw.on("addDir", (p) => emit({ op: "mkdir", path: rel(p) }));
-    fsw.on("unlink", (p) => emit({ op: "unlink", path: rel(p) }));
-    fsw.on("unlinkDir", (p) => emit({ op: "unlink", path: rel(p) }));
-    fsw.on("error", () => {
-    });
-    return fsw;
-  };
-  const rel = (abs) => {
-    const r = relative3(root, abs);
-    return r.split(sep2).join("/");
-  };
-  const emit = (event) => {
-    if (closed) return;
-    if (event.path === "" || event.path.startsWith("..")) return;
-    for (const l of [...listeners]) {
-      try {
-        l(event);
-      } catch {
-      }
-    }
-  };
-  return {
-    subscribe(listener) {
-      if (closed) return () => {
-      };
-      listeners.add(listener);
-      ensureFsw();
-      return () => {
-        listeners.delete(listener);
-      };
-    },
-    close() {
-      if (closed) return;
-      closed = true;
-      listeners.clear();
-      fsw?.close().catch(() => {
-      });
-      fsw = null;
-    }
-  };
-}
-function createNodeWorkspace(root) {
-  let cachedWatcher = null;
+async function prepareDeploymentSnapshot(provider, recipe) {
+  return await provider.prepareDeploymentSnapshot(recipe);
+}
+
+// src/server/sandbox/vercel-sandbox/deploymentSnapshot.ts
+function createVercelDeploymentSnapshotProvider(opts) {
   return {
-    root,
-    fsCapability: "strong",
-    watch() {
-      if (!cachedWatcher) cachedWatcher = createNodeWatcher(root);
-      return cachedWatcher;
-    },
-    async readFile(relPath) {
-      const absPath = await ensureExistingWorkspacePath(root, relPath);
-      return await readFile3(absPath, "utf-8");
-    },
-    async readBinaryFile(relPath) {
-      const absPath = await ensureExistingWorkspacePath(root, relPath);
-      return new Uint8Array(await readFile3(absPath));
-    },
-    async writeFile(relPath, data) {
-      const absPath = await ensureWritableWorkspacePath(root, relPath);
-      await writeFile3(absPath, data, "utf-8");
-    },
-    async writeBinaryFile(relPath, data) {
-      const absPath = await ensureWritableWorkspacePath(root, relPath);
-      await writeFile3(absPath, data);
-    },
-    async readFileWithStat(relPath) {
-      const absPath = await ensureExistingWorkspacePath(root, relPath);
-      const [content, fileStat] = await Promise.all([
-        readFile3(absPath, "utf-8"),
-        stat2(absPath)
-      ]);
-      return {
-        content,
-        stat: {
-          size: fileStat.size,
-          mtimeMs: fileStat.mtimeMs,
-          kind: fileStat.isDirectory() ? "dir" : "file"
-        }
-      };
-    },
-    async writeFileWithStat(relPath, data) {
-      const absPath = await ensureWritableWorkspacePath(root, relPath);
-      await writeFile3(absPath, data, "utf-8");
-      const fileStat = await stat2(absPath);
-      return {
-        size: fileStat.size,
-        mtimeMs: fileStat.mtimeMs,
-        kind: fileStat.isDirectory() ? "dir" : "file"
-      };
-    },
-    async writeBinaryFileWithStat(relPath, data) {
-      const absPath = await ensureWritableWorkspacePath(root, relPath);
-      await writeFile3(absPath, data);
-      const fileStat = await stat2(absPath);
-      return {
-        size: fileStat.size,
-        mtimeMs: fileStat.mtimeMs,
-        kind: fileStat.isDirectory() ? "dir" : "file"
-      };
-    },
-    async unlink(relPath) {
-      const absPath = await ensureExistingWorkspacePath(root, relPath);
-      const pathStat = await lstat2(absPath);
-      if (pathStat.isDirectory()) {
-        await rmdir(absPath);
-        return;
-      }
-      await unlink3(absPath);
-    },
-    async readdir(relPath) {
-      const absPath = await ensureExistingWorkspacePath(root, relPath);
-      const entries = await readdir(absPath, { withFileTypes: true });
-      return entries.map((entry) => ({
-        name: entry.name,
-        kind: entry.isDirectory() ? "dir" : "file"
-      }));
-    },
-    async stat(relPath) {
-      const absPath = await ensureExistingWorkspacePath(root, relPath);
-      const fileStat = await stat2(absPath);
-      return {
-        size: fileStat.size,
-        mtimeMs: fileStat.mtimeMs,
-        kind: fileStat.isDirectory() ? "dir" : "file"
-      };
-    },
-    async mkdir(relPath, opts) {
-      const absPath = validatePath(root, relPath);
-      let existingAncestor = absPath;
-      while (true) {
-        try {
-          await stat2(existingAncestor);
-          break;
-        } catch (error) {
-          const code = error.code;
-          if (code !== "ENOENT") throw error;
-          const parent = dirname3(existingAncestor);
-          if (parent === existingAncestor) throw error;
-          existingAncestor = parent;
-        }
-      }
-      await assertRealPathWithinWorkspace(root, existingAncestor);
-      await mkdir3(absPath, { recursive: opts?.recursive ?? false });
-    },
-    async rename(fromRelPath, toRelPath2) {
-      validatePath(root, toRelPath2);
-      const fromAbsPath = await ensureExistingWorkspacePath(root, fromRelPath);
-      const toAbsPath = await ensureWritableWorkspacePath(root, toRelPath2);
-      await rename3(fromAbsPath, toAbsPath);
+    async prepareDeploymentSnapshot(recipe) {
+      return await bakeSnapshotIfNeeded({
+        client: opts.client,
+        snapshotId: opts.snapshotId,
+        runtime: recipe.runtime,
+        cachePath: opts.cachePath,
+        logger: opts.logger,
+        now: opts.now,
+        setupCommands: recipe.setupCommands,
+        pythonPackages: recipe.pythonPackages,
+        systemPackages: recipe.systemPackages
+      });
     }
   };
 }
+async function prepareVercelDeploymentSnapshot(opts) {
+  return await bakeSnapshotIfNeeded({
+    client: opts.client,
+    snapshotId: opts.snapshotId,
+    runtime: opts.runtime,
+    cachePath: opts.cachePath,
+    logger: opts.logger,
+    now: opts.now,
+    setupCommands: opts.setupCommands,
+    pythonPackages: opts.pythonPackages,
+    systemPackages: opts.systemPackages
+  });
+}
 
 // src/server/http/routes/file.ts
-import { dirname as dirname4, extname, relative as relative4 } from "path/posix";
+import { dirname as dirname5, extname, relative as relative4 } from "path/posix";
 
 // src/server/http/middleware.ts
 var ERROR_CODE_AUTH_REQUIRED = "auth_required";
@@ -1739,6 +1801,17 @@ function classifyError(err, reply, subject) {
       error: { code: ERROR_CODE_ALREADY_EXISTS, message: `${subject} already exists` }
     });
   }
+  const statusCode = err?.statusCode;
+  const stableCode = err?.code;
+  if (typeof statusCode === "number" && statusCode >= 400 && statusCode < 600) {
+    return reply.code(statusCode).send({
+      error: {
+        code: typeof stableCode === "string" ? stableCode : ERROR_CODE_INTERNAL,
+        message,
+        details: err?.details
+      }
+    });
+  }
   return reply.code(500).send({
     error: { code: ERROR_CODE_INTERNAL, message }
   });
@@ -1809,7 +1882,7 @@ function basenameForUpload(filename) {
 }
 function markdownUrlFor(sourcePath, assetPath) {
   if (!sourcePath) return assetPath;
-  const fromDir = dirname4(sourcePath.replace(/\\/g, "/"));
+  const fromDir = dirname5(sourcePath.replace(/\\/g, "/"));
   const rel = relative4(fromDir === "." ? "" : fromDir, assetPath);
   return rel && !rel.startsWith(".") ? rel : rel || assetPath;
 }
@@ -1860,8 +1933,8 @@ function fileRoutes(app, opts, done) {
           error: { code: ERROR_CODE_INTERNAL, message: "workspace does not support binary reads" }
         });
       }
-      const stat10 = await workspace.stat(path4);
-      if (stat10.kind !== "file") {
+      const stat11 = await workspace.stat(path4);
+      if (stat11.kind !== "file") {
         return reply.code(400).send({
           error: { code: ERROR_CODE_VALIDATION_ERROR, message: "path is not a file", field: "path" }
         });
@@ -1879,12 +1952,12 @@ function fileRoutes(app, opts, done) {
     try {
       const workspace = await resolveWorkspace(request);
       if (workspace.readFileWithStat) {
-        const { content: content2, stat: stat11 } = await workspace.readFileWithStat(path4);
-        return { content: content2, mtimeMs: stat11.kind === "file" ? stat11.mtimeMs : void 0 };
+        const { content: content2, stat: stat12 } = await workspace.readFileWithStat(path4);
+        return { content: content2, mtimeMs: stat12.kind === "file" ? stat12.mtimeMs : void 0 };
       }
       const content = await workspace.readFile(path4);
-      const stat10 = await workspace.stat(path4);
-      return { content, mtimeMs: stat10.kind === "file" ? stat10.mtimeMs : void 0 };
+      const stat11 = await workspace.stat(path4);
+      return { content, mtimeMs: stat11.kind === "file" ? stat11.mtimeMs : void 0 };
     } catch (err) {
       return classifyError(err, reply, "file");
     }
@@ -1933,11 +2006,11 @@ function fileRoutes(app, opts, done) {
         if (dir) await workspace.mkdir(dir, { recursive: true });
       }
       const content = body.content;
-      const stat10 = workspace.writeFileWithStat ? await workspace.writeFileWithStat(path4, content) : await (async () => {
+      const stat11 = workspace.writeFileWithStat ? await workspace.writeFileWithStat(path4, content) : await (async () => {
         await workspace.writeFile(path4, content);
         return await workspace.stat(path4);
       })();
-      return { ok: true, mtimeMs: stat10.kind === "file" ? stat10.mtimeMs : void 0 };
+      return { ok: true, mtimeMs: stat11.kind === "file" ? stat11.mtimeMs : void 0 };
     } catch (err) {
       return classifyError(err, reply, "file");
     }
@@ -1970,7 +2043,7 @@ function fileRoutes(app, opts, done) {
       }
       const bytes = Buffer.from(contentBase64, "base64");
       await workspace.mkdir(dir, { recursive: true });
-      const stat10 = workspace.writeBinaryFileWithStat ? await workspace.writeBinaryFileWithStat(path4, bytes) : await (async () => {
+      const stat11 = workspace.writeBinaryFileWithStat ? await workspace.writeBinaryFileWithStat(path4, bytes) : await (async () => {
         if (!workspace.writeBinaryFile) {
           throw new Error("workspace does not support binary uploads");
         }
@@ -1984,7 +2057,7 @@ function fileRoutes(app, opts, done) {
         ok: true,
         path: path4,
         markdownUrl: markdownUrlFor(sourcePath, path4),
-        mtimeMs: stat10.kind === "file" ? stat10.mtimeMs : void 0
+        mtimeMs: stat11.kind === "file" ? stat11.mtimeMs : void 0
       };
     } catch (err) {
       return classifyError(err, reply, "upload");
@@ -2071,8 +2144,8 @@ function fileRoutes(app, opts, done) {
     if (path4 === null) return;
     try {
       const workspace = await resolveWorkspace(request);
-      const stat10 = await workspace.stat(path4);
-      return stat10;
+      const stat11 = await workspace.stat(path4);
+      return stat11;
     } catch (err) {
       return classifyError(err, reply, "path");
     }
@@ -2083,8 +2156,8 @@ function fileRoutes(app, opts, done) {
 // src/server/workspace/provisionRuntime.ts
 import { createHash as createHash3 } from "crypto";
 import { constants as constants2 } from "fs";
-import { access as access2, chmod as chmod3, cp, mkdir as mkdir4, readdir as readdir2, readFile as readFile4, realpath as realpath2, stat as stat3, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname5, isAbsolute as isAbsolute4, join as join3, relative as relative5, resolve as resolve4 } from "path";
+import { access as access2, chmod as chmod3, cp, mkdir as mkdir4, readdir as readdir2, readFile as readFile4, realpath as realpath2, stat as stat4, writeFile as writeFile4 } from "fs/promises";
+import { dirname as dirname6, isAbsolute as isAbsolute4, join as join3, relative as relative5, resolve as resolve5 } from "path";
 import { fileURLToPath } from "url";
 import { execFile } from "child_process";
 import { promisify } from "util";
@@ -2118,7 +2191,7 @@ async function commandExists(cmd) {
   }
 }
 async function hashPath(path4, hash) {
-  const info = await stat3(path4);
+  const info = await stat4(path4);
   if (info.isDirectory()) {
     const entries = (await readdir2(path4)).filter((entry) => entry !== "__pycache__" && entry !== "build" && !entry.endsWith(".egg-info")).sort();
     for (const entry of entries) {
@@ -2151,7 +2224,7 @@ async function fingerprint(contributions) {
 `);
       hash.update(JSON.stringify(spec.extraLibs ?? []));
       hash.update(JSON.stringify(Object.fromEntries(Object.entries(spec.env ?? {}).map(([k, v]) => [k, String(v)]))));
-      if (await exists(projectFile)) await hashPath(dirname5(projectFile), hash);
+      if (await exists(projectFile)) await hashPath(dirname6(projectFile), hash);
     }
     for (const spec of provisioning.nodePackages ?? []) {
       const packageRoot = toPath(spec.packageRoot);
@@ -2193,8 +2266,8 @@ function resolveTemplateTarget(workspaceRoot, target) {
   if (rawTarget.length === 0 || rawTarget.includes("\0") || rawTarget.includes("\\") || rawTarget.startsWith("/") || rawTarget.startsWith("//") || /^[A-Za-z]:[\\/]/.test(rawTarget) || rawTarget.split("/").includes("..")) {
     throw new Error(`Unsafe runtime template target: ${JSON.stringify(rawTarget)}. Template targets must be relative paths inside the workspace.`);
   }
-  const root = resolve4(workspaceRoot);
-  const resolved = resolve4(root, rawTarget);
+  const root = resolve5(workspaceRoot);
+  const resolved = resolve5(root, rawTarget);
   const rel = relative5(root, resolved);
   if (rel.startsWith("..") || isAbsolute4(rel)) {
     throw new Error(`Unsafe runtime template target: ${JSON.stringify(rawTarget)} resolves outside the workspace.`);
@@ -2221,7 +2294,7 @@ function nodePackageTarget(workspaceRoot, packageName) {
 }
 async function copyIfExists(source, target) {
   if (!await exists(source)) return false;
-  if (resolve4(source) === resolve4(target)) return true;
+  if (resolve5(source) === resolve5(target)) return true;
   if (await exists(target) && await realpath2(source) === await realpath2(target)) return true;
   await cp(source, target, {
     recursive: true,
@@ -2262,7 +2335,7 @@ async function ensurePython(workspaceRoot, specs) {
     else await run("/usr/bin/python3", ["-m", "venv", ".boring-agent/venv"], workspaceRoot);
   }
   for (const spec of specs) {
-    const projectDir = dirname5(toPath(spec.projectFile));
+    const projectDir = dirname6(toPath(spec.projectFile));
     if (uv) {
       await run("uv", ["pip", "install", "--python", venvPython, projectDir], workspaceRoot);
       if (spec.extraLibs?.length) {
@@ -2324,7 +2397,7 @@ VENV_BIN="$WORKSPACE_ROOT/.boring-agent/venv/bin"
     for (const entry of await readdir2(venvBin)) {
       if (["python", "python3", "pip", "pip3"].includes(entry)) continue;
       const full = join3(venvBin, entry);
-      const info = await stat3(full).catch(() => null);
+      const info = await stat4(full).catch(() => null);
       if (!info?.isFile()) continue;
       await writeExecutable(join3(shimDir, entry), `${base}TARGET="$VENV_BIN"/${bashSingleQuote(entry)}
 SHEBANG="$(head -n 1 "$TARGET" 2>/dev/null || true)"
@@ -2365,14 +2438,16 @@ async function provisionRuntimeWorkspace({
   await ensureNodePackages(workspaceRoot, active.flatMap(({ provisioning }) => provisioning.nodePackages ?? []));
   await ensurePython(workspaceRoot, active.flatMap(({ provisioning }) => provisioning.python ?? []));
   const actualBinDir = await writeShims(workspaceRoot, env);
-  await mkdir4(dirname5(markerPath), { recursive: true });
+  await mkdir4(dirname6(markerPath), { recursive: true });
   await writeFile4(markerPath, JSON.stringify({ v: PROVISIONING_VERSION, fingerprint: hash }, null, 2), "utf8");
   return { fingerprint: hash, changed: true, env, binDir: actualBinDir };
 }
 
 // src/server/workspace/createVercelSandboxWorkspace.ts
-var VERCEL_SANDBOX_REMOTE_ROOT = "/vercel/sandbox";
 var VERCEL_SANDBOX_WORKSPACE_ROOT = "/workspace";
+var VERCEL_SANDBOX_REMOTE_ROOT = VERCEL_SANDBOX_WORKSPACE_ROOT;
+var VERCEL_SANDBOX_RUNTIME_CONTEXT = { runtimeCwd: VERCEL_SANDBOX_WORKSPACE_ROOT };
+var EPERM_CODE2 = "EPERM";
 var CACHE_TTL_MS = 15e3;
 var CACHE_MAX_ENTRIES = 512;
 var MAX_INLINE_WRITE_BYTES = 128 * 1024;
@@ -2409,11 +2484,11 @@ function createTimedLruCache(ttlMs, maxEntries) {
     }
   };
 }
-function cloneStat(stat10) {
+function cloneStat(stat11) {
   return {
-    size: stat10.size,
-    mtimeMs: stat10.mtimeMs,
-    kind: stat10.kind
+    size: stat11.size,
+    mtimeMs: stat11.mtimeMs,
+    kind: stat11.kind
   };
 }
 function cloneEntries(entries) {
@@ -2496,8 +2571,44 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
   registerMetadataInvalidator(sandbox, invalidateMetadataCache);
   const { emit: emitChange, watcher } = createSandboxBroadcaster();
   const remote = sandbox;
+  async function assertRealPathWithinSandboxRoot(sandboxPath) {
+    const isWithinRoot = await runJson(
+      remote,
+      `node -e ${shellQuote2(`const fs=require('fs'); const path=require('path'); const root=fs.realpathSync(process.argv[1]); const target=fs.realpathSync(process.argv[2]); const rel=path.relative(root,target); process.stdout.write(JSON.stringify(rel===''||(!rel.startsWith('..')&&!path.isAbsolute(rel))))`)} ${shellQuote2(VERCEL_SANDBOX_REMOTE_ROOT)} ${shellQuote2(sandboxPath)}`
+    );
+    if (!isWithinRoot) {
+      throw Object.assign(new Error("resolved path escapes workspace root"), { code: EPERM_CODE2 });
+    }
+  }
+  async function isSandboxSymlink(sandboxPath) {
+    return await runJson(
+      remote,
+      `node -e ${shellQuote2(`const fs=require('fs'); process.stdout.write(JSON.stringify(fs.lstatSync(process.argv[1]).isSymbolicLink()))`)} ${shellQuote2(sandboxPath)}`
+    );
+  }
+  async function listDescendantPaths(relPath, sandboxPath) {
+    if (remote.fs?.stat && remote.fs.readdir) {
+      const fileStat = await remote.fs.stat(sandboxPath);
+      if (!fileStat.isDirectory()) return [];
+      const entries = await remote.fs.readdir(sandboxPath, { withFileTypes: true });
+      const descendants = [];
+      for (const entry of entries) {
+        const childRelPath = relPath === "." ? entry.name : `${relPath}/${entry.name}`;
+        descendants.push(childRelPath);
+        if (entry.isDirectory()) {
+          descendants.push(...await listDescendantPaths(childRelPath, `${sandboxPath}/${entry.name}`));
+        }
+      }
+      return descendants;
+    }
+    return await runJson(
+      remote,
+      `node -e ${shellQuote2(`const fs=require('fs'); const path=require('path'); const root=process.argv[1]; const relRoot=process.argv[2]; function walk(abs,rel){ const s=fs.statSync(abs); if(!s.isDirectory()) return []; const out=[]; for (const entry of fs.readdirSync(abs,{withFileTypes:true})) { const childRel=rel==='.'?entry.name:rel+'/'+entry.name; out.push(childRel); if(entry.isDirectory()) out.push(...walk(path.join(abs,entry.name),childRel)); } return out; } process.stdout.write(JSON.stringify(walk(root,relRoot)))`)} ${shellQuote2(sandboxPath)} ${shellQuote2(relPath)}`
+    );
+  }
   return {
-    root: VERCEL_SANDBOX_WORKSPACE_ROOT,
+    root: VERCEL_SANDBOX_RUNTIME_CONTEXT.runtimeCwd,
+    runtimeContext: VERCEL_SANDBOX_RUNTIME_CONTEXT,
     fsCapability: "best-effort",
     watch() {
       return watcher;
@@ -2512,7 +2623,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
       }
       const content = await remote.readFileToBuffer?.({ path: sandboxPath });
       if (!content) {
-        const err = new Error(`ENOENT: file not found, open '${sandboxPath}'`);
+        const err = new Error(`ENOENT: file not found, open '${validatePath(VERCEL_SANDBOX_WORKSPACE_ROOT, relPath)}'`);
         err.code = "ENOENT";
         throw err;
       }
@@ -2526,7 +2637,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
       }
       const content = await remote.readFileToBuffer?.({ path: sandboxPath });
       if (!content) {
-        const err = new Error(`ENOENT: file not found, open '${sandboxPath}'`);
+        const err = new Error(`ENOENT: file not found, open '${validatePath(VERCEL_SANDBOX_WORKSPACE_ROOT, relPath)}'`);
         err.code = "ENOENT";
         throw err;
       }
@@ -2571,15 +2682,15 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
           remote.fs.readFile(sandboxPath, "utf8"),
           remote.fs.stat(sandboxPath)
         ]);
-        const stat10 = {
+        const stat11 = {
           size: fileStat.size,
           mtimeMs: fileStat.mtimeMs,
           kind: fileStat.isDirectory() ? "dir" : "file"
         };
-        statCache.set(sandboxPath, stat10);
+        statCache.set(sandboxPath, stat11);
         return {
           content: typeof content === "string" ? content : Buffer.from(content).toString("utf-8"),
-          stat: cloneStat(stat10)
+          stat: cloneStat(stat11)
         };
       }
       const version = metadataVersion;
@@ -2670,11 +2781,19 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
     },
     async unlink(relPath) {
       const sandboxPath = toSandboxPath(relPath);
-      if (remote.fs?.rm) await remote.fs.rm(sandboxPath, { recursive: false, force: false });
-      else await runShell(remote, `rm -- ${shellQuote2(sandboxPath)}`);
+      if (sandboxPath === VERCEL_SANDBOX_REMOTE_ROOT) {
+        throw Object.assign(new Error("cannot remove workspace root"), { code: EPERM_CODE2 });
+      }
+      await assertRealPathWithinSandboxRoot(sandboxPath);
+      const descendantPaths = await isSandboxSymlink(sandboxPath) ? [] : await listDescendantPaths(relPath, sandboxPath);
+      if (remote.fs?.rm) await remote.fs.rm(sandboxPath, { recursive: true, force: false });
+      else await runShell(remote, `rm -r -- ${shellQuote2(sandboxPath)}`);
       invalidateMetadataCache();
       workspaceOpts.onMutation?.();
       emitChange({ op: "unlink", path: relPath });
+      for (const path4 of descendantPaths) {
+        emitChange({ op: "unlink", path: path4 });
+      }
     },
     async readdir(relPath) {
       const sandboxPath = toSandboxPath(relPath);
@@ -2777,7 +2896,8 @@ function artifactExtension(kind) {
 function artifactName(kind, id, fingerprint2) {
   const safeId = id.replace(/[^A-Za-z0-9._-]/g, "-");
   const safeFingerprint = fingerprint2.replace(/^sha256:/, "");
-  return `${safeId}-${safeFingerprint}${artifactExtension(kind)}`;
+  const formatVersion = kind === "node" ? "pnpm-pack-v2" : "v1";
+  return `${safeId}-${formatVersion}-${safeFingerprint}${artifactExtension(kind)}`;
 }
 function createVercelProvisioningAdapter(options) {
   return {
@@ -2826,8 +2946,8 @@ function createVercelProvisioningAdapter(options) {
 // src/server/workspace/provisioning/fingerprint.ts
 import { createHash as createHash4 } from "crypto";
 import { constants as constants3 } from "fs";
-import { access as access3, mkdir as mkdir5, open, readFile as readFile5, rename as rename4, rm } from "fs/promises";
-import { dirname as dirname6 } from "path";
+import { access as access3, mkdir as mkdir5, open, readFile as readFile5, rename as rename4, rm as rm2 } from "fs/promises";
+import { dirname as dirname7 } from "path";
 var FINGERPRINT_RE = /^sha256:[a-f0-9]{64}$/;
 function isValidFingerprint(value) {
   return FINGERPRINT_RE.test(value.trim());
@@ -2996,7 +3116,8 @@ async function ensureNodeRuntime(options) {
       env: getBoringAgentRuntimeEnv(
         options.runtimeLayout,
         options.adapter.getRuntimeCacheRoot()
-      )
+      ),
+      timeoutMs: 3e5
     });
   } catch (error) {
     throw toProvisioningError(
@@ -3016,7 +3137,7 @@ async function ensureNodeRuntime(options) {
 }
 
 // src/server/workspace/provisioning/python.ts
-import { dirname as dirname7, join as join6, relative as relative7, sep as sep4 } from "path";
+import { dirname as dirname8, join as join6, relative as relative7, sep as sep4 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var VENV_REL = ".boring-agent/venv";
 var VENV_FINGERPRINT_REL = `${VENV_REL}/.fingerprint`;
@@ -3075,7 +3196,7 @@ function pythonInstallSource(spec) {
 }
 function sourceRootForPythonSpec(spec) {
   if (spec.packageRoot) return spec.packageRoot;
-  if (spec.projectFile) return dirname7(sourceToPath(spec.projectFile));
+  if (spec.projectFile) return dirname8(sourceToPath(spec.projectFile));
   return null;
 }
 function expectedPythonOutputs(paths, packages) {
@@ -3193,7 +3314,7 @@ async function ensurePythonRuntime(options) {
 }
 
 // src/server/workspace/provisioning/skills.ts
-import { stat as stat4 } from "fs/promises";
+import { stat as stat5 } from "fs/promises";
 import { join as join7 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var GENERATED_SKILLS_REL = ".boring-agent/skills";
@@ -3224,7 +3345,7 @@ async function mirrorPluginSkills(options) {
       }
       seen.add(key);
       const sourcePath = sourceToPath2(skill.source);
-      const sourceStat = await stat4(sourcePath);
+      const sourceStat = await stat5(sourcePath);
       const skillTarget = `${GENERATED_SKILLS_REL}/${plugin.id}/${skill.name}`;
       const target = sourceStat.isDirectory() ? skillTarget : `${skillTarget}/SKILL.md`;
       await options.adapter.workspaceFs.copyFromHost(skill.source, target);
@@ -3239,21 +3360,21 @@ async function mirrorPluginSkills(options) {
 
 // src/server/workspace/provisioning/workspaceFiles.ts
 import { basename, join as joinPath } from "path";
-import { posix } from "path";
-import { readdir as readdir3, stat as stat5 } from "fs/promises";
+import { posix as posix2 } from "path";
+import { readdir as readdir3, stat as stat6 } from "fs/promises";
 import { fileURLToPath as fileURLToPath4, pathToFileURL } from "url";
 function sourceToPath3(source) {
   return source instanceof URL ? fileURLToPath4(source) : source;
 }
 function toWorkspaceRel3(...parts) {
-  return posix.normalize(parts.filter(Boolean).join("/"));
+  return posix2.normalize(parts.filter(Boolean).join("/"));
 }
 function sourceForChild(rootSource, childPath) {
   return rootSource instanceof URL ? pathToFileURL(childPath) : childPath;
 }
 async function collectTemplateWorkItems(template) {
   const sourcePath = sourceToPath3(template.path);
-  const sourceStat = await stat5(sourcePath);
+  const sourceStat = await stat6(sourcePath);
   const targetPrefix = template.target ?? "";
   if (!sourceStat.isDirectory()) {
     const targetRel = toWorkspaceRel3(targetPrefix || basename(sourcePath));
@@ -3570,7 +3691,7 @@ function createServerFileSearch(workspace, sandbox) {
       const command = [
         "find .",
         "-maxdepth 10",
-        "-path './.boring-agent' -prune -o",
+        "\\( -path './.boring-agent' -o -path './.git' -o -path './node_modules' \\) -prune -o",
         buildFindArgs(glob),
         "-type f",
         "-print",
@@ -3611,8 +3732,8 @@ async function copyTemplate(templatePath, workspaceRoot) {
 
 // src/server/runtime/modes/provisioningAdapter.ts
 import { spawn as spawn3 } from "child_process";
-import { cp as cp3, lstat as lstat3, mkdir as mkdir6, readFile as readFile6, realpath as realpath3, rm as rm2, stat as stat6, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname8, isAbsolute as isAbsolute5, relative as relative8, resolve as resolve5, sep as sep5 } from "path";
+import { cp as cp3, lstat as lstat3, mkdir as mkdir6, readFile as readFile6, realpath as realpath3, rm as rm3, stat as stat7, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname9, isAbsolute as isAbsolute5, relative as relative8, resolve as resolve6, sep as sep5 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 var LOCAL_SANDBOX_WORKSPACE_ROOT = "/workspace";
 function sourceToPath4(source) {
@@ -3630,8 +3751,8 @@ async function assertExistingInsideWorkspace(root, relPath) {
 }
 async function prepareWritablePath(root, relPath) {
   const absPath = validatePath(root, relPath);
-  await mkdir6(dirname8(absPath), { recursive: true });
-  await assertRealPathWithinWorkspace(root, dirname8(absPath));
+  await mkdir6(dirname9(absPath), { recursive: true });
+  await assertRealPathWithinWorkspace(root, dirname9(absPath));
   try {
     const targetStat = await lstat3(absPath);
     if (targetStat.isSymbolicLink()) {
@@ -3694,7 +3815,7 @@ function defaultExecOptions(paths, opts) {
   };
 }
 function mapWorkspacePathToLocalSandbox(paths, value) {
-  const absolute = isAbsolute5(value) ? value : resolve5(paths.workspaceRoot, value);
+  const absolute = isAbsolute5(value) ? value : resolve6(paths.workspaceRoot, value);
   const relPath = relative8(paths.workspaceRoot, absolute);
   if (relPath === "") return LOCAL_SANDBOX_WORKSPACE_ROOT;
   if (relPath === ".." || relPath.startsWith(`..${sep5}`)) return value;
@@ -3716,10 +3837,10 @@ async function copyExternalSourceIntoWorkspace(paths, sourcePath, opts) {
   const fingerprint2 = opts.fingerprint.replace(/^sha256:/, "");
   const relTarget = `.boring-agent/tmp/${sanitizeInstallSourcePart(opts.kind)}-${sanitizeInstallSourcePart(opts.id)}-${sanitizeInstallSourcePart(fingerprint2)}-source`;
   const absTarget = validatePath(paths.workspaceRoot, relTarget);
-  await rm2(absTarget, { recursive: true, force: true });
-  await mkdir6(dirname8(absTarget), { recursive: true });
-  await assertRealPathWithinWorkspace(paths.workspaceRoot, dirname8(absTarget));
-  const sourceStat = await stat6(sourcePath);
+  await rm3(absTarget, { recursive: true, force: true });
+  await mkdir6(dirname9(absTarget), { recursive: true });
+  await assertRealPathWithinWorkspace(paths.workspaceRoot, dirname9(absTarget));
+  const sourceStat = await stat7(sourcePath);
   await cp3(sourcePath, absTarget, {
     recursive: sourceStat.isDirectory(),
     force: false,
@@ -3738,7 +3859,7 @@ function createWorkspaceFs(workspaceRoot) {
     async rm(workspaceRelativePath) {
       const absPath = await assertExistingInsideWorkspace(workspaceRoot, workspaceRelativePath);
       if (!absPath) return;
-      await rm2(absPath, { recursive: true, force: true });
+      await rm3(absPath, { recursive: true, force: true });
     },
     async mkdir(workspaceRelativePath) {
       const absPath = validatePath(workspaceRoot, workspaceRelativePath);
@@ -3757,7 +3878,7 @@ function createWorkspaceFs(workspaceRoot) {
     async copyFromHost(hostSourcePath, workspaceRelativeTarget) {
       const sourcePath = sourceToPath4(hostSourcePath);
       const absTarget = await prepareWritablePath(workspaceRoot, workspaceRelativeTarget);
-      const sourceStat = await stat6(sourcePath);
+      const sourceStat = await stat7(sourcePath);
       await cp3(sourcePath, absTarget, {
         recursive: sourceStat.isDirectory(),
         force: false,
@@ -3832,10 +3953,13 @@ var directModeAdapter = {
   async create(ctx) {
     await mkdir7(ctx.workspaceRoot, { recursive: true });
     await copyTemplate(ctx.templatePath, ctx.workspaceRoot);
-    const workspace = createNodeWorkspace(ctx.workspaceRoot);
-    const sandbox = createDirectSandbox();
+    const runtimeContext = { runtimeCwd: ctx.workspaceRoot };
+    const workspace = createNodeWorkspace(ctx.workspaceRoot, { runtimeContext });
+    const sandbox = createDirectSandbox({ runtimeContext });
     await sandbox.init?.({ workspace, sessionId: ctx.sessionId });
     return {
+      runtimeContext,
+      storageRoot: ctx.workspaceRoot,
       workspace,
       sandbox,
       fileSearch: createServerFileSearch(workspace, sandbox)
@@ -3855,10 +3979,16 @@ var localModeAdapter = {
     }
     await mkdir8(ctx.workspaceRoot, { recursive: true });
     await copyTemplate(ctx.templatePath, ctx.workspaceRoot);
-    const workspace = createNodeWorkspace(ctx.workspaceRoot);
-    const sandbox = createBwrapSandbox();
+    const runtimeContext = { runtimeCwd: "/workspace" };
+    const workspace = createNodeWorkspace(ctx.workspaceRoot, { runtimeContext });
+    const sandbox = createBwrapSandbox({
+      hostWorkspaceRoot: ctx.workspaceRoot,
+      runtimeContext
+    });
     await sandbox.init?.({ workspace, sessionId: ctx.sessionId });
     return {
+      runtimeContext,
+      storageRoot: ctx.workspaceRoot,
       workspace,
       sandbox,
       fileSearch: createServerFileSearch(workspace, sandbox)
@@ -3868,16 +3998,18 @@ var localModeAdapter = {
 
 // src/server/runtime/modes/vercel-sandbox.ts
 import { execFile as execFile2 } from "child_process";
-import { mkdir as mkdir9, readFile as readFile8, readdir as readdir5, rename as rename5, stat as stat7 } from "fs/promises";
-import { dirname as dirname9, join as join8 } from "path";
+import { mkdir as mkdir9, readFile as readFile8, readdir as readdir5, rename as rename5, stat as stat8 } from "fs/promises";
+import { dirname as dirname10, isAbsolute as isAbsolute6, join as join8 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 import { promisify as promisify2 } from "util";
 import { Sandbox as VercelSandbox } from "@vercel/sandbox";
 
 // src/server/sandbox/vercel-sandbox/createVercelSandboxExec.ts
+import { posix as posix3 } from "path";
 import { Writable } from "stream";
 var DEFAULT_TIMEOUT_MS3 = 3e4;
 var DEFAULT_MAX_OUTPUT_BYTES3 = 1048576;
+var VERCEL_SANDBOX_DEFAULT_PATH = "/vercel/runtimes/node24/bin:/vercel/runtimes/node22/bin:/vercel/runtimes/python/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 function createStreamWritable(collector, shared, onChunk) {
   return new Writable({
     write(chunk2, _enc, cb) {
@@ -3914,39 +4046,25 @@ function timeoutResult(durationMs) {
     stderrEncoding: "utf-8"
   };
 }
-function toRemotePath(value) {
-  if (value === VERCEL_SANDBOX_WORKSPACE_ROOT) return VERCEL_SANDBOX_REMOTE_ROOT;
-  if (value.startsWith(`${VERCEL_SANDBOX_WORKSPACE_ROOT}/`)) {
-    return `${VERCEL_SANDBOX_REMOTE_ROOT}${value.slice(VERCEL_SANDBOX_WORKSPACE_ROOT.length)}`;
+function normalizeVercelCwd(cwd) {
+  const requested = cwd ?? VERCEL_SANDBOX_WORKSPACE_ROOT;
+  if (!posix3.isAbsolute(requested)) throw new Error(`Vercel sandbox cwd must be absolute: ${requested}`);
+  const normalized = posix3.normalize(requested);
+  if (normalized !== VERCEL_SANDBOX_WORKSPACE_ROOT && !normalized.startsWith(`${VERCEL_SANDBOX_WORKSPACE_ROOT}/`)) {
+    throw new Error(`Vercel sandbox cwd must stay under ${VERCEL_SANDBOX_WORKSPACE_ROOT}: ${requested}`);
   }
-  return value;
-}
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-var WORKSPACE_ALIAS_PREFIX_BOUNDARY = String.raw`(^|[\s"'=:;,\[({<>&|])`;
-var WORKSPACE_ALIAS_SUFFIX_BOUNDARY = String.raw`(?=/|$|[\s"'=:;,)\]}> &|])`;
-var WORKSPACE_ALIAS_PATTERN = new RegExp(
-  `${WORKSPACE_ALIAS_PREFIX_BOUNDARY}${escapeRegExp(VERCEL_SANDBOX_WORKSPACE_ROOT)}${WORKSPACE_ALIAS_SUFFIX_BOUNDARY}`,
-  "g"
-);
-function replaceWorkspaceAliases(value) {
-  return value.replace(
-    WORKSPACE_ALIAS_PATTERN,
-    (_match, prefix) => `${prefix}${VERCEL_SANDBOX_REMOTE_ROOT}`
-  );
-}
-function toRemoteCwd(cwd) {
-  if (!cwd) return cwd;
-  return toRemotePath(cwd);
-}
-function toRemoteCommand(command) {
-  return replaceWorkspaceAliases(command);
+  return normalized;
 }
 function toRemoteEnv(env) {
-  if (!env) return void 0;
+  const baseEnv = {
+    ...env ?? {},
+    PATH: env?.PATH ? `${env.PATH}:${VERCEL_SANDBOX_DEFAULT_PATH}` : VERCEL_SANDBOX_DEFAULT_PATH
+  };
   return Object.fromEntries(
-    Object.entries(env).map(([key, value]) => [key, replaceWorkspaceAliases(toRemotePath(value))])
+    Object.entries(withWorkspacePythonEnv({
+      workspaceRoot: VERCEL_SANDBOX_WORKSPACE_ROOT,
+      env: baseEnv
+    })).filter((entry) => entry[1] != null)
   );
 }
 function createVercelSandboxExec(sandbox, execOpts = {}) {
@@ -3955,6 +4073,7 @@ function createVercelSandboxExec(sandbox, execOpts = {}) {
     placement: "remote",
     provider: "vercel-sandbox",
     capabilities: ["exec"],
+    runtimeContext: VERCEL_SANDBOX_RUNTIME_CONTEXT,
     async init() {
     },
     async exec(cmd, opts) {
@@ -3993,8 +4112,8 @@ function createVercelSandboxExec(sandbox, execOpts = {}) {
         }
         const result = await sandbox.runCommand({
           cmd: "sh",
-          args: ["-c", toRemoteCommand(cmd)],
-          cwd: toRemoteCwd(opts?.cwd),
+          args: ["-c", cmd],
+          cwd: normalizeVercelCwd(opts?.cwd),
           env: toRemoteEnv(opts?.env),
           signal: controller.signal,
           stdout: createStreamWritable(stdoutCollector, captureState, opts?.onStdout),
@@ -4095,11 +4214,11 @@ async function buildTarGz(files) {
   }
   chunks.push(Buffer.alloc(1024));
   const tarBuffer = Buffer.concat(chunks);
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     const gzip = createGzip({ level: 6 });
     const gzChunks = [];
     gzip.on("data", (chunk2) => gzChunks.push(chunk2));
-    gzip.on("end", () => resolve9(Buffer.concat(gzChunks)));
+    gzip.on("end", () => resolve10(Buffer.concat(gzChunks)));
     gzip.on("error", reject);
     Readable.from(tarBuffer).pipe(gzip);
   });
@@ -4273,17 +4392,19 @@ function provisioningSourceToPath(source) {
 }
 async function prepareVercelProvisioningArtifact(request) {
   const sourcePath = provisioningSourceToPath(request.source);
-  await mkdir9(dirname9(request.outputPath), { recursive: true });
+  await mkdir9(dirname10(request.outputPath), { recursive: true });
   if (request.kind === "node") {
-    const { stdout } = await execFileAsync2("npm", [
-      "pack",
+    const { stdout } = await execFileAsync2("pnpm", [
+      "--dir",
       sourcePath,
+      "pack",
       "--pack-destination",
-      dirname9(request.outputPath)
+      dirname10(request.outputPath)
     ], { maxBuffer: 1024 * 1024 * 20 });
     const packedName = stdout.trim().split(/\r?\n/).filter(Boolean).at(-1);
-    if (!packedName) throw new Error(`npm pack produced no artifact for ${sourcePath}`);
-    await rename5(join8(dirname9(request.outputPath), packedName), request.outputPath);
+    if (!packedName) throw new Error(`pnpm pack produced no artifact for ${sourcePath}`);
+    const packedPath = isAbsolute6(packedName) ? packedName : join8(dirname10(request.outputPath), packedName);
+    await rename5(packedPath, request.outputPath);
     return;
   }
   await execFileAsync2("tar", ["-czf", request.outputPath, "-C", sourcePath, "."], {
@@ -4295,7 +4416,7 @@ function shellSingleQuote(value) {
 }
 async function copyHostPathToVercelWorkspace(options) {
   const sourcePath = provisioningSourceToPath(options.source);
-  const sourceStat = await stat7(sourcePath);
+  const sourceStat = await stat8(sourcePath);
   if (sourceStat.isDirectory()) {
     await options.workspace.mkdir(options.targetRel, { recursive: true });
     for (const entry of await readdir5(sourcePath, { withFileTypes: true })) {
@@ -4656,7 +4777,8 @@ function createVercelSandboxModeAdapter(opts = {}) {
         return {
           workspace,
           sandbox,
-          fileSearch: createServerFileSearch(workspace, sandbox)
+          fileSearch: createServerFileSearch(workspace, sandbox),
+          runtimeContext: workspace.runtimeContext
         };
       } catch (error) {
         const code = error?.code;
@@ -4724,6 +4846,18 @@ import {
 } from "@mariozechner/pi-coding-agent";
 
 // src/server/harness/pi-coding-agent/tool-adapter.ts
+var BORING_TOOL_ERROR_MARKER = "__boringToolError";
+function markToolResultErrorDetails(details) {
+  return details && typeof details === "object" && !Array.isArray(details) ? { ...details, [BORING_TOOL_ERROR_MARKER]: true } : { [BORING_TOOL_ERROR_MARKER]: true, details };
+}
+function unmarkToolResultErrorDetails(details) {
+  if (!details || typeof details !== "object" || Array.isArray(details)) return { isMarked: false, details };
+  const record = { ...details };
+  if (record[BORING_TOOL_ERROR_MARKER] !== true) return { isMarked: false, details };
+  delete record[BORING_TOOL_ERROR_MARKER];
+  if (Object.keys(record).length === 1 && "details" in record) return { isMarked: true, details: record.details };
+  return { isMarked: true, details: record };
+}
 function toolTelemetryProperties(toolName2, sessionId, status, startedAt, result) {
   const properties = {
     toolName: toolName2,
@@ -4766,7 +4900,10 @@ function adaptToolForPi(tool, sessionId, telemetry = noopTelemetry) {
         });
         if (result.isError) {
           emittedFailure = true;
-          throw new Error(result.content.map((c) => c.text).join("\n"));
+          return {
+            content: result.content,
+            details: markToolResultErrorDetails(result.details)
+          };
         }
         return {
           content: result.content,
@@ -4976,7 +5113,7 @@ import {
   readdir as readdir6,
   readFile as readFile9,
   stat as fsStat,
-  rm as rm3,
+  rm as rm4,
   mkdir as mkdir10,
   writeFile as writeFile6,
   appendFile,
@@ -5012,7 +5149,10 @@ var PiSessionStore = class {
       this.sessionDir = options;
       return;
     }
-    this.sessionDir = options?.sessionDir ?? (options?.sessionNamespace ? sessionDirForNamespace(options.sessionNamespace) : defaultSessionDir(cwd));
+    this.sessionDir = options?.sessionDir ?? (options?.sessionNamespace ? sessionDirForNamespace(options.sessionNamespace) : defaultSessionDir(options?.storageCwd ?? cwd));
+  }
+  getSessionDir() {
+    return this.sessionDir;
   }
   async list(ctx) {
     const files = await readdir6(this.sessionDir).catch(() => []);
@@ -5155,7 +5295,7 @@ var PiSessionStore = class {
     const filepath = await this.resolveSessionFile(sessionId).catch(
       () => null
     );
-    if (filepath) await rm3(filepath, { force: true });
+    if (filepath) await rm4(filepath, { force: true });
   }
   touchSession(sessionId, title) {
     this.resolveSessionFile(sessionId).then((filepath) => {
@@ -5345,7 +5485,7 @@ var DEFAULT_POLL_MS = 250;
 var MAX_PROMPT_CHARS = 1200;
 var MAX_TITLE_CHARS = 80;
 function sleep(ms) {
-  return new Promise((resolve9) => setTimeout(resolve9, ms));
+  return new Promise((resolve10) => setTimeout(resolve10, ms));
 }
 function truncateForPrompt(text) {
   const trimmed = text.trim();
@@ -5677,7 +5817,7 @@ function mergePiPackageSources(base = [], additional = []) {
 var WORKSPACE_PATHS_GUIDELINE = [
   "## Workspace paths",
   "",
-  '- The "Current working directory" above is the workspace root. Tool path arguments must be relative to it (e.g. `README.md`, `src/foo.ts`).',
+  '- The "Current working directory" line in this prompt is the workspace root. Tool path arguments must be relative to it (e.g. `README.md`, `src/foo.ts`).',
   "- Never pass an absolute path or a path that walks outside the workspace (no leading `/`, no `..` that escapes the root). The sandbox will reject it and the call is wasted.",
   "- For `find`/`grep`/`ls`: omit the `path` argument to search from the workspace root. Pass `path` only when you need to restrict to a subdirectory, and only as a workspace-relative path.",
   "- For `read`/`edit`/`write`: pass workspace-relative paths only."
@@ -5696,6 +5836,18 @@ ${extra}` };
     });
   };
 }
+function buildToolErrorResultExtension() {
+  return (pi) => {
+    pi.on("tool_result", async (event) => {
+      const marked = unmarkToolResultErrorDetails(event.details);
+      if (!marked.isMarked) return;
+      return {
+        details: marked.details,
+        isError: true
+      };
+    });
+  };
+}
 function extractUserMessageText(message) {
   const record = message;
   if (record?.role !== "user") return "";
@@ -5816,9 +5968,10 @@ function basenameForAttachment(filename) {
   return safe || "image";
 }
 function createPiCodingAgentHarness(opts) {
-  const sessionStore = new PiSessionStore(opts.cwd, {
+  const sessionStore = new PiSessionStore(opts.runtimeCwd ?? opts.cwd, {
     sessionNamespace: opts.sessionNamespace,
-    sessionDir: opts.sessionDir
+    sessionDir: opts.sessionDir,
+    storageCwd: opts.cwd
   });
   const piSessions = /* @__PURE__ */ new Map();
   const effectiveSkillPaths = [];
@@ -5864,15 +6017,17 @@ function createPiCodingAgentHarness(opts) {
     const savedPiFile = sessionStore.loadPiSessionFileSync(sessionId);
     let sessionManager;
     let isNewPiSession = false;
+    const runtimeCwd = opts.runtimeCwd ?? ctx.workdir;
+    const nativeSessionDir = sessionStore.getSessionDir();
     if (savedPiFile) {
       try {
-        sessionManager = SessionManager.open(savedPiFile, void 0, ctx.workdir);
+        sessionManager = SessionManager.open(savedPiFile, void 0, runtimeCwd);
       } catch {
-        sessionManager = SessionManager.create(ctx.workdir);
+        sessionManager = SessionManager.create(runtimeCwd, nativeSessionDir);
         isNewPiSession = true;
       }
     } else {
-      sessionManager = SessionManager.create(ctx.workdir);
+      sessionManager = SessionManager.create(runtimeCwd, nativeSessionDir);
       isNewPiSession = true;
     }
     const resolvedModel = resolveRequestedModel(modelRegistry, input);
@@ -5881,17 +6036,19 @@ function createPiCodingAgentHarness(opts) {
     const composedSystemPromptAppend = composeSystemPromptAppend(opts.systemPromptAppend);
     const dynamicPromptExtension = opts.systemPromptDynamic ? buildDynamicPromptExtension(opts.systemPromptDynamic) : void 0;
     const agentDir = getAgentDir2();
+    const toolErrorResultExtension = buildToolErrorResultExtension();
     const extensionFactories = [
+      toolErrorResultExtension,
       ...dynamicPromptExtension ? [dynamicPromptExtension] : [],
       ...opts.pi?.extensionFactories ?? []
     ];
     const settingsManager = createResourceSettingsManager(
-      ctx.workdir,
+      opts.cwd,
       agentDir,
       effectivePackages
     );
     const resourceLoader = new DefaultResourceLoader({
-      cwd: ctx.workdir,
+      cwd: opts.cwd,
       agentDir,
       settingsManager,
       appendSystemPromptOverride: (base) => [...base, composedSystemPromptAppend],
@@ -5909,7 +6066,7 @@ function createPiCodingAgentHarness(opts) {
       // and merge with the additional paths.
       ...opts.pi?.noSkills ? {
         skillsOverride: () => loadSkills({
-          cwd: ctx.workdir,
+          cwd: opts.cwd,
           agentDir,
           skillPaths: effectiveSkillPaths,
           includeDefaults: false
@@ -5918,8 +6075,11 @@ function createPiCodingAgentHarness(opts) {
     });
     await resourceLoader?.reload();
     const { session: piSession } = await createAgentSession({
-      cwd: ctx.workdir,
-      tools: [],
+      cwd: runtimeCwd,
+      // Suppress Pi's built-in filesystem/shell tools while keeping Boring's
+      // adapted tool catalog active. Passing `tools: []` is an allowlist of
+      // zero tools in Pi v0.75+, which disables customTools too.
+      noTools: "builtin",
       customTools: adaptToolsForPi(opts.tools, input.sessionId, opts.telemetry),
       model,
       thinkingLevel: input.thinkingLevel ?? "off",
@@ -6115,6 +6275,7 @@ function createPiCodingAgentHarness(opts) {
       let sawTextChunk = false;
       let inlineTurnIndex = 0;
       let currentPiAssistantMessageId = null;
+      let pendingTerminalErrorChunks = [];
       const messageIdsWithStreamedReasoning = /* @__PURE__ */ new Set();
       let piSeq = 0;
       const nextPiSeq = () => ++piSeq;
@@ -6302,7 +6463,16 @@ function createPiCodingAgentHarness(opts) {
           converted = piHistoryChunks;
         } else {
           const sdkChunks = namespaceInlinePartIds(dedupStartChunks(piEventToChunks(event)));
-          const sdkChunksForTurn = filterSdkChunksForCurrentSegment(sdkChunks);
+          const shouldBufferTerminalError = event.type === "message_update" && event.assistantMessageEvent?.type === "error";
+          const visibleSdkChunks = shouldBufferTerminalError ? sdkChunks.filter((chunk2) => {
+            const type = chunk2.type;
+            if (type === "error" || type === "finish") {
+              pendingTerminalErrorChunks.push(chunk2);
+              return false;
+            }
+            return true;
+          }) : sdkChunks;
+          const sdkChunksForTurn = filterSdkChunksForCurrentSegment(visibleSdkChunks);
           converted = [...piHistoryChunks, ...sdkChunksForTurn];
         }
         for (const chunk2 of converted) {
@@ -6317,7 +6487,17 @@ function createPiCodingAgentHarness(opts) {
         }
         chunks.push(...converted);
         if (event.type === "agent_end") {
-          if (!sawTextChunk) {
+          const willRetry = Boolean(event.willRetry);
+          if (willRetry) {
+            pendingTerminalErrorChunks = [];
+            sawTextChunk = false;
+            currentPiAssistantMessageId = null;
+            messageIdsWithStreamedReasoning.clear();
+          } else if (pendingTerminalErrorChunks.length > 0) {
+            chunks.push(...pendingTerminalErrorChunks);
+            pendingTerminalErrorChunks = [];
+            sawTextChunk = true;
+          } else if (!sawTextChunk) {
             const { role, text, errorText } = extractAssistantMessageText(
               findLastAssistantMessage(
                 event.messages
@@ -6336,7 +6516,8 @@ function createPiCodingAgentHarness(opts) {
               assistantText += text;
             }
           }
-          if (nativeFollowUpPending.has(input.sessionId) && !ctx.abortSignal.aborted) {
+          if (willRetry) {
+          } else if (nativeFollowUpPending.has(input.sessionId) && !ctx.abortSignal.aborted) {
           } else {
             done = true;
             stopHeartbeat();
@@ -6368,12 +6549,12 @@ function createPiCodingAgentHarness(opts) {
             const base = basenameForAttachment(a.filename ?? "image");
             const unique = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
             const relPath = `${DEFAULT_ATTACHMENT_DIR}/${base}-${unique}.${ext}`;
-            await mkdir11(join10(ctx.workdir, DEFAULT_ATTACHMENT_DIR), { recursive: true });
-            await writeFile7(join10(ctx.workdir, relPath), bytes);
+            await mkdir11(join10(opts.cwd, DEFAULT_ATTACHMENT_DIR), { recursive: true });
+            await writeFile7(join10(opts.cwd, relPath), bytes);
             savedPaths.push(relPath);
           } catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
-            log3.error("attachment write failed", { workdir: ctx.workdir, error: msg });
+            log3.error("attachment write failed", { workdir: opts.cwd, error: msg });
             writeErrors.push(`${a.filename ?? "image"}: ${msg}`);
           }
         }
@@ -6458,17 +6639,17 @@ ${attachmentNotes.join("\n")}` : message,
 }
 
 // src/server/harness/pi-coding-agent/pluginLoader.ts
-import { readdir as readdir7, stat as stat8, readFile as readFile10 } from "fs/promises";
-import { join as join11, extname as extname3, resolve as resolve6, sep as sep6, relative as relative9 } from "path";
+import { readdir as readdir7, stat as stat9, readFile as readFile10 } from "fs/promises";
+import { join as join11, extname as extname3, resolve as resolve7, sep as sep6, relative as relative9 } from "path";
 import { homedir as homedir4 } from "os";
 import { pathToFileURL as pathToFileURL2 } from "url";
 var VALID_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".mjs"]);
 var GLOBAL_DIR = join11(homedir4(), ".pi", "agent", "extensions");
 var LOCAL_DIR = ".pi/extensions";
 var EXTENSIONS_JSON = ".pi/extensions.json";
-async function dirExists(path4) {
+async function dirExists2(path4) {
   try {
-    const s = await stat8(path4);
+    const s = await stat9(path4);
     return s.isDirectory();
   } catch {
     return false;
@@ -6476,14 +6657,14 @@ async function dirExists(path4) {
 }
 async function fileExists(path4) {
   try {
-    const s = await stat8(path4);
+    const s = await stat9(path4);
     return s.isFile();
   } catch {
     return false;
   }
 }
 async function discoverFromDir(dir, source) {
-  if (!await dirExists(dir)) return [];
+  if (!await dirExists2(dir)) return [];
   const entries = await readdir7(dir);
   return entries.filter((e) => VALID_EXTENSIONS.has(extname3(e))).map((e) => ({ path: join11(dir, e), source }));
 }
@@ -6516,7 +6697,7 @@ async function loadModule(filePath, importFn) {
 }
 async function discoverNpmPlugins(cwd) {
   const nodeModulesDir = join11(cwd, "node_modules");
-  if (!await dirExists(nodeModulesDir)) return [];
+  if (!await dirExists2(nodeModulesDir)) return [];
   try {
     const entries = await readdir7(nodeModulesDir);
     return entries.filter((e) => e.startsWith("pi-plugin-")).map((e) => join11(nodeModulesDir, e));
@@ -6529,8 +6710,8 @@ async function loadNpmPlugin(pkgDir, importFn) {
   if (!await fileExists(pkgJsonPath)) return [];
   const pkgJson = JSON.parse(await readFile10(pkgJsonPath, "utf-8"));
   const main = pkgJson.main ?? "index.js";
-  const resolvedMain = resolve6(pkgDir, main);
-  const resolvedPkgDir = resolve6(pkgDir);
+  const resolvedMain = resolve7(pkgDir, main);
+  const resolvedPkgDir = resolve7(pkgDir);
   if (resolvedMain !== resolvedPkgDir && !resolvedMain.startsWith(resolvedPkgDir + sep6)) {
     return [];
   }
@@ -6570,7 +6751,7 @@ async function loadPlugins(options) {
   if (config?.npm) {
     for (const pkg of config.npm) {
       const pkgDir = join11(options.cwd, "node_modules", pkg);
-      if (await dirExists(pkgDir)) {
+      if (await dirExists2(pkgDir)) {
         const already = candidates.some((c) => c.path === pkgDir);
         if (!already) {
           candidates.push({ path: pkgDir, source: "npm" });
@@ -6616,10 +6797,20 @@ import {
   createWriteToolDefinition
 } from "@mariozechner/pi-coding-agent";
 
+// src/server/runtime/mode.ts
+function getRuntimeBundleStorageRoot(bundle) {
+  const hostRoot = bundle.storageRoot ?? getNodeWorkspaceHostRoot(bundle.workspace);
+  if (hostRoot) return hostRoot;
+  if (bundle.sandbox.provider === "vercel-sandbox") return bundle.workspace.root;
+  throw new Error(
+    `RuntimeBundle.storageRoot is required for host-filesystem tools. Mode adapters must set storageRoot to the host workspace path. Got workspace.root=${bundle.workspace.root}, sandbox.provider=${bundle.sandbox.provider}`
+  );
+}
+
 // src/server/tools/operations/bound.ts
 import { constants as constants4 } from "fs";
-import { access as access4, lstat as lstat4, mkdir as mkdir12, readFile as readFile11, readdir as readdir8, readlink, realpath as realpath4, stat as stat9, writeFile as writeFile8 } from "fs/promises";
-import { dirname as dirname10, isAbsolute as isAbsolute6, relative as relative10, resolve as resolve7 } from "path";
+import { access as access4, lstat as lstat4, mkdir as mkdir12, readFile as readFile11, readdir as readdir8, readlink, realpath as realpath4, stat as stat10, writeFile as writeFile8 } from "fs/promises";
+import { dirname as dirname11, isAbsolute as isAbsolute7, join as join12, relative as relative10, resolve as resolve8 } from "path";
 function toPosixPath(value) {
   return value.split("\\").join("/");
 }
@@ -6675,7 +6866,7 @@ async function walkMatches(root, current, pattern, ignore, limit, out) {
   const entries = await readdir8(current, { withFileTypes: true });
   for (const entry of entries) {
     if (out.length >= limit) return;
-    const absolutePath = resolve7(current, entry.name);
+    const absolutePath = resolve8(current, entry.name);
     const relativePath = toPosixPath(relative10(root, absolutePath));
     if (entry.isDirectory() && shouldSkipDir(relativePath, ignore)) continue;
     if (matchesGlob(relativePath, pattern)) {
@@ -6690,26 +6881,26 @@ async function findNearestExistingAncestor(absPath) {
   let current = absPath;
   for (; ; ) {
     try {
-      await stat9(current);
+      await stat10(current);
       return current;
     } catch {
-      const parent = dirname10(current);
+      const parent = dirname11(current);
       if (parent === current) return current;
       current = parent;
     }
   }
 }
 async function assertWithinWorkspace(workspaceRoot, absPath) {
-  const realRoot = await realpath4(resolve7(workspaceRoot));
+  const realRoot = await realpath4(resolve8(workspaceRoot));
   try {
     const s = await lstat4(absPath);
     if (s.isSymbolicLink()) {
       const target = await readlink(absPath);
-      const resolvedTarget = resolve7(dirname10(absPath), target);
+      const resolvedTarget = resolve8(dirname11(absPath), target);
       const nearestAncestor = await findNearestExistingAncestor(resolvedTarget);
       const realAncestor = await realpath4(nearestAncestor);
       const rel2 = relative10(realRoot, realAncestor);
-      if (rel2.startsWith("..") || isAbsolute6(rel2)) {
+      if (rel2.startsWith("..") || isAbsolute7(rel2)) {
         throw new Error(`path "${absPath}" is outside workspace`);
       }
       return;
@@ -6727,10 +6918,10 @@ async function assertWithinWorkspace(workspaceRoot, absPath) {
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      const nearestAncestor = await findNearestExistingAncestor(dirname10(absPath));
+      const nearestAncestor = await findNearestExistingAncestor(dirname11(absPath));
       const realAncestor = await realpath4(nearestAncestor);
       const rel2 = relative10(realRoot, realAncestor);
-      if (rel2.startsWith("..") || isAbsolute6(rel2)) {
+      if (rel2.startsWith("..") || isAbsolute7(rel2)) {
         throw new Error(`path "${absPath}" is outside workspace`);
       }
       return;
@@ -6738,51 +6929,77 @@ async function assertWithinWorkspace(workspaceRoot, absPath) {
     throw err;
   }
   const rel = relative10(realRoot, realCandidate);
-  if (rel.startsWith("..") || isAbsolute6(rel)) {
+  if (rel.startsWith("..") || isAbsolute7(rel)) {
     throw new Error(`path "${absPath}" is outside workspace`);
   }
 }
-function boundFs(workspaceRoot) {
+function boundFs(workspaceRoot, opts = {}) {
+  const runtimeRoot = opts.runtimeRoot ? opts.runtimeRoot.replace(/\/+$/, "") || "/" : void 0;
+  const shouldMapRuntimeRoot = Boolean(runtimeRoot && runtimeRoot !== workspaceRoot);
+  const toStoragePath = (absolutePath) => {
+    if (!shouldMapRuntimeRoot || !runtimeRoot) return absolutePath;
+    const normalized = toPosixPath(absolutePath);
+    if (normalized === runtimeRoot) return workspaceRoot;
+    if (normalized.startsWith(`${runtimeRoot}/`)) {
+      return join12(workspaceRoot, ...normalized.slice(runtimeRoot.length + 1).split("/"));
+    }
+    return absolutePath;
+  };
+  const toRuntimePath2 = (absolutePath) => {
+    if (!shouldMapRuntimeRoot || !runtimeRoot) return absolutePath;
+    const rel = relative10(workspaceRoot, absolutePath);
+    if (rel === "") return runtimeRoot;
+    if (rel.startsWith("..") || isAbsolute7(rel)) return absolutePath;
+    return `${runtimeRoot}/${toPosixPath(rel)}`;
+  };
   const read = {
     async readFile(absolutePath) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      return await readFile11(absolutePath);
+      const storagePath = toStoragePath(absolutePath);
+      await assertWithinWorkspace(workspaceRoot, storagePath);
+      return await readFile11(storagePath);
     },
     async access(absolutePath) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      await access4(absolutePath, constants4.R_OK);
+      const storagePath = toStoragePath(absolutePath);
+      await assertWithinWorkspace(workspaceRoot, storagePath);
+      await access4(storagePath, constants4.R_OK);
     }
   };
   const write = {
     async writeFile(absolutePath, content) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      await mkdir12(dirname10(absolutePath), { recursive: true });
-      await writeFile8(absolutePath, content);
+      const storagePath = toStoragePath(absolutePath);
+      await assertWithinWorkspace(workspaceRoot, storagePath);
+      await mkdir12(dirname11(storagePath), { recursive: true });
+      await writeFile8(storagePath, content);
     },
     async mkdir(dir) {
-      await assertWithinWorkspace(workspaceRoot, dir);
-      await mkdir12(dir, { recursive: true });
+      const storagePath = toStoragePath(dir);
+      await assertWithinWorkspace(workspaceRoot, storagePath);
+      await mkdir12(storagePath, { recursive: true });
     }
   };
   const edit = {
     async readFile(absolutePath) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      return await readFile11(absolutePath);
+      const storagePath = toStoragePath(absolutePath);
+      await assertWithinWorkspace(workspaceRoot, storagePath);
+      return await readFile11(storagePath);
     },
     async writeFile(absolutePath, content) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      await writeFile8(absolutePath, content);
+      const storagePath = toStoragePath(absolutePath);
+      await assertWithinWorkspace(workspaceRoot, storagePath);
+      await writeFile8(storagePath, content);
     },
     async access(absolutePath) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      await access4(absolutePath, constants4.R_OK | constants4.W_OK);
+      const storagePath = toStoragePath(absolutePath);
+      await assertWithinWorkspace(workspaceRoot, storagePath);
+      await access4(storagePath, constants4.R_OK | constants4.W_OK);
     }
   };
   const find = {
     async exists(absolutePath) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
+      const storagePath = toStoragePath(absolutePath);
+      await assertWithinWorkspace(workspaceRoot, storagePath);
       try {
-        await stat9(absolutePath);
+        await stat10(storagePath);
         return true;
       } catch (err) {
         if (err.code === "ENOENT") return false;
@@ -6790,54 +7007,61 @@ function boundFs(workspaceRoot) {
       }
     },
     async glob(pattern, cwd, options) {
-      await assertWithinWorkspace(workspaceRoot, cwd);
+      const storageCwd = toStoragePath(cwd);
+      await assertWithinWorkspace(workspaceRoot, storageCwd);
       const matches = [];
-      await walkMatches(cwd, cwd, pattern, options.ignore, options.limit, matches);
-      return matches;
+      await walkMatches(storageCwd, storageCwd, pattern, options.ignore, options.limit, matches);
+      return matches.map(toRuntimePath2);
     }
   };
   const grep = {
     async isDirectory(absolutePath) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      return (await stat9(absolutePath)).isDirectory();
+      const storagePath = toStoragePath(absolutePath);
+      await assertWithinWorkspace(workspaceRoot, storagePath);
+      return (await stat10(storagePath)).isDirectory();
     },
     async readFile(absolutePath) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      return await readFile11(absolutePath, "utf8");
+      const storagePath = toStoragePath(absolutePath);
+      await assertWithinWorkspace(workspaceRoot, storagePath);
+      return await readFile11(storagePath, "utf8");
     }
   };
   const ls = {
     async exists(absolutePath) {
+      const storagePath = toStoragePath(absolutePath);
       try {
-        await assertWithinWorkspace(workspaceRoot, absolutePath);
-        await stat9(absolutePath);
+        await assertWithinWorkspace(workspaceRoot, storagePath);
+        await stat10(storagePath);
         return true;
       } catch {
         return false;
       }
     },
     async stat(absolutePath) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      return await stat9(absolutePath);
+      const storagePath = toStoragePath(absolutePath);
+      await assertWithinWorkspace(workspaceRoot, storagePath);
+      return await stat10(storagePath);
     },
     async readdir(absolutePath) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      return await readdir8(absolutePath);
+      const storagePath = toStoragePath(absolutePath);
+      await assertWithinWorkspace(workspaceRoot, storagePath);
+      return await readdir8(storagePath);
     }
   };
   return { read, write, edit, find, grep, ls };
 }
 
 // src/server/tools/operations/vercel.ts
-import { isAbsolute as isAbsolute7, relative as relative11 } from "path";
+import { isAbsolute as isAbsolute8, relative as relative11 } from "path";
+var VERCEL_SANDBOX_LEGACY_ROOT = "/vercel/sandbox";
 function rootAliases(workspace) {
   const aliases = [workspace.root];
-  if (workspace.root === VERCEL_SANDBOX_WORKSPACE_ROOT) aliases.push(VERCEL_SANDBOX_REMOTE_ROOT);
-  if (workspace.root === VERCEL_SANDBOX_REMOTE_ROOT) aliases.push(VERCEL_SANDBOX_WORKSPACE_ROOT);
-  return aliases;
+  if (workspace.root === VERCEL_SANDBOX_WORKSPACE_ROOT) aliases.push(VERCEL_SANDBOX_LEGACY_ROOT);
+  if (workspace.root === VERCEL_SANDBOX_LEGACY_ROOT) aliases.push(VERCEL_SANDBOX_WORKSPACE_ROOT);
+  return Array.from(new Set(aliases));
 }
 function isOutsideWorkspaceRel(rel) {
-  return rel === ".." || rel.startsWith("../") || rel.startsWith("..\\") || isAbsolute7(rel);
+  return rel === ".." || rel.startsWith("../") || rel.startsWith("..\\") || isAbsolute8(rel);
 }
 function toRelPath(workspace, absolutePath) {
   for (const root of rootAliases(workspace)) {
@@ -6854,7 +7078,7 @@ function toRelPath(workspace, absolutePath) {
     return `.agents/skills/${skillPath}`;
   }
   throw new Error(
-    `path "${absolutePath}" is outside workspace; use a path relative to the workspace root or under ${rootAliases(workspace).join(" / ")}`
+    `path "${absolutePath}" is outside workspace; use a path relative to the workspace root or under ${workspace.root}`
   );
 }
 function vercelBashOps(sandbox, opts = {}) {
@@ -6915,13 +7139,23 @@ function vercelEditOps(workspace) {
     }
   };
 }
-function toRemotePath2(value) {
-  if (value === VERCEL_SANDBOX_WORKSPACE_ROOT) return VERCEL_SANDBOX_REMOTE_ROOT;
-  if (value.startsWith(`${VERCEL_SANDBOX_WORKSPACE_ROOT}/`)) {
-    return `${VERCEL_SANDBOX_REMOTE_ROOT}${value.slice(VERCEL_SANDBOX_WORKSPACE_ROOT.length)}`;
+function toRemotePath(value) {
+  if (value === VERCEL_SANDBOX_LEGACY_ROOT) return VERCEL_SANDBOX_REMOTE_ROOT;
+  if (value.startsWith(`${VERCEL_SANDBOX_LEGACY_ROOT}/`)) {
+    return `${VERCEL_SANDBOX_REMOTE_ROOT}${value.slice(VERCEL_SANDBOX_LEGACY_ROOT.length)}`;
+  }
+  return value;
+}
+function toRuntimePath(value) {
+  if (value === VERCEL_SANDBOX_LEGACY_ROOT) return VERCEL_SANDBOX_WORKSPACE_ROOT;
+  if (value.startsWith(`${VERCEL_SANDBOX_LEGACY_ROOT}/`)) {
+    return `${VERCEL_SANDBOX_WORKSPACE_ROOT}${value.slice(VERCEL_SANDBOX_LEGACY_ROOT.length)}`;
   }
   return value;
 }
+function sanitizeRuntimeText(value) {
+  return value.replaceAll(VERCEL_SANDBOX_LEGACY_ROOT, VERCEL_SANDBOX_WORKSPACE_ROOT);
+}
 function findPredicate(pattern) {
   const isPathShaped = pattern.includes("/") || pattern.includes("**");
   if (!isPathShaped) return `-name ${shellEscape(pattern)}`;
@@ -6966,7 +7200,7 @@ function vercelFindOps(sandbox, workspace) {
       return result.exitCode === 0;
     },
     async glob(pattern, cwd, options) {
-      const remoteCwd = toRemotePath2(cwd);
+      const remoteCwd = toRemotePath(cwd);
       const args = ["fd", "--glob", "--no-require-git", "--max-results", String(options.limit)];
       for (const ig of options.ignore) {
         args.push("--exclude", ig);
@@ -6983,11 +7217,11 @@ function vercelFindOps(sandbox, workspace) {
         });
       }
       if (result.exitCode !== 0 && result.exitCode !== 1) {
-        const stderr = Buffer.from(result.stderr).toString("utf-8").trim();
+        const stderr = sanitizeRuntimeText(Buffer.from(result.stderr).toString("utf-8").trim());
         throw new Error(`file search failed (exit ${result.exitCode}): ${stderr}`);
       }
       const stdout = Buffer.from(result.stdout).toString("utf-8");
-      return stdout.split("\n").filter(Boolean);
+      return stdout.split("\n").filter(Boolean).map(toRuntimePath);
     }
   };
 }
@@ -7025,7 +7259,7 @@ import {
   truncateHead,
   truncateLine
 } from "@mariozechner/pi-coding-agent";
-import { resolve as resolve8, relative as relative12 } from "path";
+import { resolve as resolve9, relative as relative12 } from "path";
 
 // src/server/catalog/tools/_shared.ts
 function makeError(message) {
@@ -7177,7 +7411,7 @@ function vercelGrepTool(sandbox, workspaceRoot) {
         return makeError("pattern is required");
       }
       if (workspaceRoot && typeof params.path === "string" && params.path.length > 0) {
-        const resolved = resolve8(workspaceRoot, params.path);
+        const resolved = resolve9(workspaceRoot, params.path);
         const rel = relative12(workspaceRoot, resolved);
         if (rel.startsWith("..") || rel.startsWith("/")) {
           return makeError(`path "${params.path}" is outside workspace`);
@@ -7212,6 +7446,7 @@ function isTextContent(content) {
 function adaptPiTool(piTool) {
   return {
     name: piTool.name,
+    readinessRequirements: ["workspace-fs"],
     description: piTool.description,
     promptSnippet: piTool.promptSnippet,
     parameters: piTool.parameters,
@@ -7237,17 +7472,18 @@ function adaptPiTool(piTool) {
 }
 function buildFilesystemAgentTools(bundle) {
   const cwd = bundle.workspace.root;
+  const storageRoot = getRuntimeBundleStorageRoot(bundle);
   if (bundle.sandbox.provider === "vercel-sandbox") {
     return [
       adaptPiTool(createReadToolDefinition(cwd, { operations: vercelReadOps(bundle.workspace) })),
       adaptPiTool(createWriteToolDefinition(cwd, { operations: vercelWriteOps(bundle.workspace) })),
       adaptPiTool(createEditToolDefinition(cwd, { operations: vercelEditOps(bundle.workspace) })),
       adaptPiTool(createFindToolDefinition(cwd, { operations: vercelFindOps(bundle.sandbox, bundle.workspace) })),
-      vercelGrepTool(bundle.sandbox, cwd),
+      { ...vercelGrepTool(bundle.sandbox, cwd), readinessRequirements: ["workspace-fs"] },
       adaptPiTool(createLsToolDefinition(cwd, { operations: vercelLsOps(bundle.workspace) }))
     ];
   }
-  const ops = boundFs(cwd);
+  const ops = boundFs(storageRoot, { runtimeRoot: cwd });
   return [
     adaptPiTool(createReadToolDefinition(cwd, { operations: ops.read })),
     adaptPiTool(createWriteToolDefinition(cwd, { operations: ops.write })),
@@ -7303,6 +7539,7 @@ function directSpawnHook(workspaceRoot, runtime) {
 }
 var VERCEL_SAFE_DEFAULT_PATH = "/vercel/runtimes/node24/bin:/vercel/runtimes/node22/bin:/usr/local/bin:/usr/bin:/bin";
 function bashOptionsForMode(bundle, runtime) {
+  const storageRoot = getRuntimeBundleStorageRoot(bundle);
   switch (bundle.sandbox.provider) {
     case "vercel-sandbox":
       return {
@@ -7316,12 +7553,12 @@ function bashOptionsForMode(bundle, runtime) {
     case "bwrap":
       return {
         operations: createLocalBashOperations(),
-        spawnHook: bwrapSpawnHook(bundle.workspace.root, runtime)
+        spawnHook: bwrapSpawnHook(storageRoot, runtime)
       };
     default:
       return {
         operations: createLocalBashOperations(),
-        spawnHook: directSpawnHook(bundle.workspace.root, runtime)
+        spawnHook: directSpawnHook(storageRoot, runtime)
       };
   }
 }
@@ -7703,7 +7940,8 @@ function treeRoutes(app, opts, done) {
           return reply.code(statusCode).send({
             error: {
               code: typeof stableCode === "string" ? stableCode : ERROR_CODE_INTERNAL,
-              message
+              message,
+              details: err?.details
             }
           });
         }
@@ -8118,6 +8356,17 @@ function chatRoutes(app, opts, done) {
         });
         buf.markComplete(() => buffers.evict(sessionId, turnId));
         if (streamStarted) return;
+        const statusCode = err?.statusCode;
+        const stableCode = err?.code;
+        if (typeof statusCode === "number" && statusCode >= 400 && statusCode < 600) {
+          return reply.code(statusCode).send({
+            error: {
+              code: typeof stableCode === "string" ? stableCode : ERROR_CODE_INTERNAL,
+              message: err instanceof Error ? err.message : "chat route failed",
+              details: err?.details
+            }
+          });
+        }
         return reply.code(500).send({
           error: { code: ERROR_CODE_INTERNAL, message: "internal error" }
         });
@@ -8160,17 +8409,17 @@ function chatRoutes(app, opts, done) {
           const replayed = buf.replay(cursor);
           for (const e of replayed) writer.write(e.chunk);
           if (buf.complete) return;
-          await new Promise((resolve9) => {
+          await new Promise((resolve10) => {
             const unsub = buf.subscribe(
               (e) => writer.write(e.chunk),
               () => {
                 unsub();
-                resolve9();
+                resolve10();
               }
             );
             request.raw.on("close", () => {
               unsub();
-              resolve9();
+              resolve10();
             });
           });
         }
@@ -8510,6 +8759,18 @@ function isNotFoundError(err) {
   return err instanceof SessionNotFoundError || err instanceof Error && /not found/i.test(err.message);
 }
 function classifySessionError(err, reply) {
+  const statusCode = err?.statusCode;
+  const stableCode = err?.code;
+  if (typeof statusCode === "number" && statusCode >= 400 && statusCode < 600) {
+    const message2 = err instanceof Error ? err.message : "session route failed";
+    return reply.code(statusCode).send({
+      error: {
+        code: typeof stableCode === "string" ? stableCode : ERROR_CODE_INTERNAL,
+        message: message2,
+        details: err?.details
+      }
+    });
+  }
   if (isNotFoundError(err)) {
     return reply.code(404).send({
       error: {
@@ -8908,8 +9169,9 @@ function catalogRoutes(app, opts, done) {
 
 // src/server/http/routes/readyStatus.ts
 function readyStatusRoutes(app, opts, done) {
-  const { tracker } = opts;
   app.get("/api/v1/ready-status", async (request, reply) => {
+    const tracker = opts.getTracker ? await opts.getTracker(request) : opts.tracker;
+    if (!tracker) throw new Error("ready-status route requires tracker or getTracker");
     reply.raw.writeHead(200, {
       "Content-Type": "text/event-stream",
       "Cache-Control": "no-cache",
@@ -8930,7 +9192,7 @@ function readyStatusRoutes(app, opts, done) {
 data: ${JSON.stringify(event)}
 
 `);
-      if (event.state === "ready") closeStream();
+      if (event.state === "ready" || event.state === "degraded") closeStream();
     });
     request.raw.on("close", closeStream);
     reply.hijack();
@@ -9009,6 +9271,18 @@ function searchRoutes(app, opts, done) {
       const results = await fileSearch.search(q, limit);
       return reply.send({ results });
     } catch (err) {
+      const statusCode = err?.statusCode;
+      const stableCode = err?.code;
+      if (typeof statusCode === "number" && statusCode >= 400 && statusCode < 600) {
+        const message = err instanceof Error ? err.message : "search failed";
+        return reply.code(statusCode).send({
+          error: {
+            code: typeof stableCode === "string" ? stableCode : ERROR_CODE_INTERNAL,
+            message,
+            details: err?.details
+          }
+        });
+      }
       request.log.error({ err }, "[search] error");
       return reply.code(500).send({
         error: { code: ERROR_CODE_INTERNAL, message: "search failed" }
@@ -9227,6 +9501,36 @@ function applyCspHeaders(response, opts = {}) {
 import { basename as basename3 } from "path";
 import { AuthStorage as AuthStorage3, ModelRegistry as ModelRegistry3 } from "@mariozechner/pi-coding-agent";
 
+// src/server/catalog/toolReadiness.ts
+var WORKSPACE_PREPARING_MESSAGE = "Workspace is still preparing. Try again in a moment.";
+function workspaceNotReadyToolResult(requirement) {
+  return {
+    content: [{ type: "text", text: WORKSPACE_PREPARING_MESSAGE }],
+    isError: true,
+    details: {
+      code: ErrorCode.enum.WORKSPACE_NOT_READY,
+      retryable: true,
+      requirement
+    }
+  };
+}
+function withReadinessRequirements(tool, readinessRequirements) {
+  if (tool.readinessRequirements === readinessRequirements) return tool;
+  return { ...tool, readinessRequirements };
+}
+function wrapToolForReadiness(tool, checkReadiness) {
+  if (!checkReadiness || !tool.readinessRequirements || tool.readinessRequirements.length === 0) return tool;
+  return {
+    ...tool,
+    async execute(params, ctx) {
+      for (const requirement of tool.readinessRequirements ?? []) {
+        if (!checkReadiness(requirement, tool)) return workspaceNotReadyToolResult(requirement);
+      }
+      return await tool.execute(params, ctx);
+    }
+  };
+}
+
 // src/server/catalog/mergeTools.ts
 function setLastRegistered(merged, tool) {
   merged.delete(tool.name);
@@ -9252,15 +9556,16 @@ function mergeTools(options) {
           `[catalog] Tool "${tool.name}" overridden by plugin ${plugin.pluginName}`
         );
       }
-      setLastRegistered(merged, tool);
+      const pluginTool = tool.readinessRequirements === void 0 ? withReadinessRequirements(tool, ["workspace-fs"]) : tool;
+      setLastRegistered(merged, pluginTool);
     }
   }
-  return [...merged.values()];
+  return [...merged.values()].map((tool) => wrapToolForReadiness(tool, options.checkReadiness));
 }
 
 // src/server/tools/upload/index.ts
 import { readFile as readFile12 } from "fs/promises";
-import { extname as extname4, join as join12 } from "path";
+import { extname as extname4, join as join13 } from "path";
 var DEFAULT_UPLOAD_DIR = "assets/images";
 var MAX_UPLOAD_BYTES2 = 10 * 1024 * 1024;
 function contentTypeFromExt(path4) {
@@ -9300,10 +9605,11 @@ function basenameForUpload2(filename) {
 }
 function buildUploadAgentTools(bundle) {
   const { workspace } = bundle;
-  const cwd = workspace.root;
+  const storageRoot = getRuntimeBundleStorageRoot(bundle);
   return [
     {
       name: "upload_file",
+      readinessRequirements: ["workspace-fs"],
       description: "Copy a workspace file into artifact storage (assets/images by default) and return its workspace-relative path. Use this when you want to embed an image in markdown or make a generated file accessible as a stable artifact. The returned path can be used directly in markdown image syntax: ![](returned-path)",
       parameters: {
         type: "object",
@@ -9328,7 +9634,7 @@ function buildUploadAgentTools(bundle) {
         const rawDir = typeof input.directory === "string" ? input.directory.trim() : "";
         const dir = rawDir ? rawDir.replace(/^\.\/+/, "").replace(/\/+$/, "") : DEFAULT_UPLOAD_DIR;
         try {
-          const bytes = await readFile12(join12(cwd, filePath));
+          const bytes = workspace.readBinaryFile ? Buffer.from(await workspace.readBinaryFile(filePath)) : await readFile12(join13(storageRoot, filePath));
           if (bytes.byteLength === 0 || bytes.byteLength > MAX_UPLOAD_BYTES2) {
             return {
               content: [{ type: "text", text: `file must be between 1 byte and ${MAX_UPLOAD_BYTES2} bytes` }],
@@ -9396,9 +9702,10 @@ function selectRuntimeModeAdapter(mode, sandboxHandleStore) {
 function getRequestWorkspaceId(request) {
   return request.workspaceContext?.workspaceId ?? DEFAULT_WORKSPACE_ID3;
 }
-function isWorkspaceAgnosticAgentRequest(request) {
+function isWorkspaceAgnosticAgentRequest(request, options) {
   const pathname = request.url.split("?")[0] ?? request.url;
-  return pathname === "/health" || pathname === "/ready" || pathname === "/api/v1/agent/models" || pathname === "/api/v1/ready-status";
+  if (pathname === "/api/v1/ready-status") return !options?.readyStatusWorkspaceScoped;
+  return pathname === "/health" || pathname === "/ready" || pathname === "/api/v1/agent/models";
 }
 function extractHttpStatus2(error) {
   const statusCode = error?.statusCode;
@@ -9421,6 +9728,32 @@ function isExpiredSandboxRuntimeError(error) {
   const message = error instanceof Error ? error.message : String(error);
   return /status code (404|410) is not ok/i.test(message);
 }
+function createHttpError(code, message, details = {}) {
+  const error = new Error(message);
+  error.code = code;
+  error.statusCode = 503;
+  error.details = details;
+  return error;
+}
+function createAgentRuntimeNotReadyError(workspaceId) {
+  return createHttpError(
+    ErrorCode.enum.AGENT_RUNTIME_NOT_READY,
+    "Agent runtime is still preparing. Try again in a moment.",
+    { workspaceId, retryable: true }
+  );
+}
+function createRuntimeProvisioningFailedError(workspaceId, cause) {
+  const causeCode = cause?.code;
+  return createHttpError(
+    ErrorCode.enum.RUNTIME_PROVISIONING_FAILED,
+    "Agent runtime provisioning failed. Reload the workspace and try again.",
+    {
+      workspaceId,
+      retryable: true,
+      ...typeof causeCode === "string" ? { causeCode } : {}
+    }
+  );
+}
 var registerAgentRoutes = async (app, opts) => {
   const workspaceRoot = opts.workspaceRoot ?? process.cwd();
   const sessionId = opts.sessionId ?? DEFAULT_WORKSPACE_ID3;
@@ -9430,7 +9763,7 @@ var registerAgentRoutes = async (app, opts) => {
   app.addHook("onClose", async () => {
     await modeAdapter.dispose?.();
   });
-  const requestScopedRuntime = typeof opts.getWorkspaceId === "function" || typeof opts.getWorkspaceRoot === "function" || typeof opts.getTemplatePath === "function" || typeof opts.getPi === "function" || typeof opts.getSessionNamespace === "function";
+  const requestScopedRuntime = typeof opts.getWorkspaceId === "function" || typeof opts.getWorkspaceRoot === "function" || typeof opts.getTemplatePath === "function" || typeof opts.getPi === "function" || typeof opts.getSessionNamespace === "function" || typeof opts.getSystemPromptDynamic === "function";
   const sessionChangesTracker = new InMemorySessionChangesTracker();
   const runtimeBindings = /* @__PURE__ */ new Map();
   const MAX_RUNTIME_BINDINGS = 256;
@@ -9464,7 +9797,25 @@ var registerAgentRoutes = async (app, opts) => {
   async function resolveSkillScope(workspaceId, request) {
     const root = request && opts.getWorkspaceRoot ? await opts.getWorkspaceRoot(workspaceId, request) : workspaceRoot;
     const pi = opts.getPi ? await opts.getPi({ workspaceId, workspaceRoot: root, request }) : opts.pi;
-    return { root, pi };
+    const hot = pi?.getHotReloadableResources?.();
+    return {
+      root,
+      pi: hot ? {
+        ...pi,
+        additionalSkillPaths: [
+          ...pi?.additionalSkillPaths ?? [],
+          ...hot.additionalSkillPaths ?? []
+        ],
+        packages: [
+          ...pi?.packages ?? [],
+          ...hot.packages ?? []
+        ],
+        extensionPaths: [
+          ...pi?.extensionPaths ?? [],
+          ...hot.extensionPaths ?? []
+        ]
+      } : pi
+    };
   }
   async function runRuntimeProvisioning(workspaceId, scope, request) {
     if (opts.provisionWorkspace === false || !opts.provisionRuntime) return void 0;
@@ -9557,6 +9908,7 @@ var registerAgentRoutes = async (app, opts) => {
       cwd: root,
       sessionNamespace: scope.sessionNamespace,
       systemPromptAppend: opts.systemPromptAppend,
+      systemPromptDynamic: opts.getSystemPromptDynamic ? () => opts.getSystemPromptDynamic?.({ workspaceId, workspaceRoot: root }) : opts.systemPromptDynamic,
       telemetry: opts.telemetry
     });
     const readyTracker = new ReadyStatusTracker({
@@ -9578,24 +9930,55 @@ var registerAgentRoutes = async (app, opts) => {
       readyTracker
     };
   }
-  async function getOrCreateRuntimeBinding(workspaceId, request) {
+  function createRuntimeBindingEntry(workspaceId, scope, request) {
+    const entry = {
+      state: "pending",
+      promise: Promise.resolve(null)
+    };
+    entry.promise = createRuntimeBinding(workspaceId, scope, request).then(
+      (binding) => {
+        entry.state = "ready";
+        return binding;
+      },
+      (error) => {
+        entry.state = "failed";
+        entry.error = error;
+        throw error;
+      }
+    );
+    entry.promise.catch(() => {
+    });
+    return entry;
+  }
+  async function getOrCreateRuntimeBinding(workspaceId, request, options = {}) {
     const scope = await resolveRuntimeScope(workspaceId, request);
     const existing = runtimeBindings.get(scope.key);
     if (existing) {
-      return await ensureRuntimeBindingReady(
-        workspaceId,
-        scope,
-        await existing
-      );
+      if (options.failIfPending && existing.state === "pending") {
+        throw createAgentRuntimeNotReadyError(workspaceId);
+      }
+      if (existing.state === "failed") {
+        if (options.failIfPending) throw createRuntimeProvisioningFailedError(workspaceId, existing.error);
+        runtimeBindings.delete(scope.key);
+      } else {
+        return await ensureRuntimeBindingReady(
+          workspaceId,
+          scope,
+          await existing.promise
+        );
+      }
     }
-    const created = createRuntimeBinding(workspaceId, scope, request);
+    const created = createRuntimeBindingEntry(workspaceId, scope, request);
     runtimeBindings.set(scope.key, created);
     evictRuntimeBindings();
+    if (options.failIfPending) {
+      throw createAgentRuntimeNotReadyError(workspaceId);
+    }
     try {
       return await ensureRuntimeBindingReady(
         workspaceId,
         scope,
-        await created
+        await created.promise
       );
     } catch (error) {
       if (runtimeBindings.get(scope.key) === created) runtimeBindings.delete(scope.key);
@@ -9605,11 +9988,11 @@ var registerAgentRoutes = async (app, opts) => {
   async function recreateRuntimeBinding(workspaceId, scope) {
     runtimeBindings.delete(scope.key);
     evictSandboxHandleCacheForWorkspace(workspaceId);
-    const created = createRuntimeBinding(workspaceId, scope);
+    const created = createRuntimeBindingEntry(workspaceId, scope);
     runtimeBindings.set(scope.key, created);
     evictRuntimeBindings();
     try {
-      const binding = await created;
+      const binding = await created.promise;
       binding.lastHealthCheckMs = Date.now();
       return binding;
     } catch (error) {
@@ -9647,9 +10030,9 @@ var registerAgentRoutes = async (app, opts) => {
     }
     return promise;
   }
-  async function getBindingForRequest(request) {
+  async function getBindingForRequest(request, options = {}) {
     if (staticBinding) return staticBinding;
-    return await getOrCreateRuntimeBinding(getRequestWorkspaceId(request), request);
+    return await getOrCreateRuntimeBinding(getRequestWorkspaceId(request), request, options);
   }
   const agentToolNames = staticBinding ? staticBinding.tools.map((tool) => tool.name) : [
     ...STANDARD_AGENT_TOOL_NAMES,
@@ -9671,7 +10054,7 @@ var registerAgentRoutes = async (app, opts) => {
   app.addHook("onRequest", async (request, reply) => {
     const user = request.user;
     let workspaceId = DEFAULT_WORKSPACE_ID3;
-    if (opts.getWorkspaceId && !isWorkspaceAgnosticAgentRequest(request)) {
+    if (opts.getWorkspaceId && !isWorkspaceAgnosticAgentRequest(request, { readyStatusWorkspaceScoped: requestScopedRuntime })) {
       try {
         workspaceId = (await opts.getWorkspaceId(request)).trim();
       } catch (error) {
@@ -9719,7 +10102,7 @@ var registerAgentRoutes = async (app, opts) => {
   });
   await app.register(chatRoutes, {
     getRuntime: async (request) => {
-      const binding = await getBindingForRequest(request);
+      const binding = await getBindingForRequest(request, { failIfPending: hasRuntimeProvisioningInput });
       return {
         harness: binding.harness,
         workdir: binding.runtimeBundle.workspace.root
@@ -9800,12 +10183,10 @@ var registerAgentRoutes = async (app, opts) => {
     catalogRoutes,
     staticBinding ? { tools: staticBinding.tools } : { getTools: async (request) => (await getBindingForRequest(request)).tools }
   );
-  await app.register(readyStatusRoutes, {
-    tracker: staticBinding?.readyTracker ?? new ReadyStatusTracker({
-      sandboxReady: true,
-      harnessReady: true
-    })
-  });
+  await app.register(
+    readyStatusRoutes,
+    staticBinding ? { tracker: staticBinding.readyTracker } : { getTracker: async (request) => (await getBindingForRequest(request)).readyTracker }
+  );
 };
 export {
   FileHandleStore,