@hachej/boring-agent 0.1.54 → 0.1.55

package/dist/server/index.js

@@ -2337,6 +2337,8 @@ function createRemoteWorkerModeAdapter(opts = {}) {
       await sandbox.init?.({ workspace, sessionId: ctx.sessionId });
       return {
         runtimeContext: { runtimeCwd: REMOTE_WORKER_RUNTIME_CWD },
+        bash: { kind: "remote" },
+        filesystem: { kind: "remote-workspace" },
         workspace,
         sandbox,
         fileSearch: createServerFileSearch(workspace, sandbox)
@@ -2957,8 +2959,8 @@ function fileRoutes(app, opts, done) {
       const dir = isImage ? normalizeUploadDir(body.directory) ?? normalizeUploadDir(settings.markdown?.imageUploadDir) ?? DEFAULT_MARKDOWN_IMAGE_UPLOAD_DIR : DEFAULT_FILE_UPLOAD_DIR;
       const ext = extForUpload(filename, contentType);
       const base = basenameForUpload(filename);
-      const unique = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
-      const path4 = `${dir}/${base}-${unique}.${ext}`;
+      const unique2 = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+      const path4 = `${dir}/${base}-${unique2}.${ext}`;
       const estimatedBytes = Math.ceil(contentBase64.length * 0.75);
       if (estimatedBytes === 0 || estimatedBytes > MAX_UPLOAD_BYTES) {
         return reply.code(400).send({
@@ -4872,6 +4874,8 @@ var directModeAdapter = {
     return {
       runtimeContext,
       storageRoot: ctx.workspaceRoot,
+      bash: { kind: "host", preserveHostHome: true },
+      filesystem: { kind: "host" },
       workspace,
       sandbox,
       fileSearch: createServerFileSearch(workspace, sandbox)
@@ -4901,6 +4905,8 @@ var localModeAdapter = {
     return {
       runtimeContext,
       storageRoot: ctx.workspaceRoot,
+      bash: { kind: "local-sandbox", sandboxRoot: "/workspace" },
+      filesystem: { kind: "host" },
       workspace,
       sandbox,
       fileSearch: createServerFileSearch(workspace, sandbox)
@@ -5168,6 +5174,38 @@ var ORPHAN_GUARD_MAX_IDLE_MS = 24 * 60 * 60 * 1e3;
 var VERCEL_SANDBOX_TIMEOUT_MS_ENV = "BORING_AGENT_VERCEL_SANDBOX_TIMEOUT_MS";
 var VERCEL_SANDBOX_RUNTIME_ENV = "BORING_AGENT_VERCEL_SANDBOX_RUNTIME";
 var DEFAULT_VERCEL_SANDBOX_RUNTIME = "node24";
+var VERCEL_BINDING_HEALTHCHECK_INTERVAL_MS = 15e3;
+var VERCEL_SAFE_DEFAULT_PATH = "/vercel/runtimes/node24/bin:/vercel/runtimes/node22/bin:/usr/local/bin:/usr/bin:/bin";
+function vercelRemoteWorkspacePathOptions() {
+  return {
+    rootAliases: [VERCEL_SANDBOX_REMOTE_ROOT, "/vercel/sandbox"],
+    toRemotePath(value) {
+      if (value === VERCEL_SANDBOX_WORKSPACE_ROOT) return VERCEL_SANDBOX_REMOTE_ROOT;
+      if (value.startsWith(`${VERCEL_SANDBOX_WORKSPACE_ROOT}/`)) {
+        return `${VERCEL_SANDBOX_REMOTE_ROOT}${value.slice(VERCEL_SANDBOX_WORKSPACE_ROOT.length)}`;
+      }
+      if (value === "/vercel/sandbox") return VERCEL_SANDBOX_REMOTE_ROOT;
+      if (value.startsWith("/vercel/sandbox/")) {
+        return `${VERCEL_SANDBOX_REMOTE_ROOT}${value.slice("/vercel/sandbox".length)}`;
+      }
+      return value;
+    },
+    toRuntimePath(value) {
+      if (value === VERCEL_SANDBOX_REMOTE_ROOT) return VERCEL_SANDBOX_WORKSPACE_ROOT;
+      if (value.startsWith(`${VERCEL_SANDBOX_REMOTE_ROOT}/`)) {
+        return `${VERCEL_SANDBOX_WORKSPACE_ROOT}${value.slice(VERCEL_SANDBOX_REMOTE_ROOT.length)}`;
+      }
+      if (value === "/vercel/sandbox") return VERCEL_SANDBOX_WORKSPACE_ROOT;
+      if (value.startsWith("/vercel/sandbox/")) {
+        return `${VERCEL_SANDBOX_WORKSPACE_ROOT}${value.slice("/vercel/sandbox".length)}`;
+      }
+      return value;
+    },
+    sanitizeErrorText(value) {
+      return value.replaceAll("/vercel/sandbox", VERCEL_SANDBOX_WORKSPACE_ROOT);
+    }
+  };
+}
 function sandboxTelemetryProperties(ctx, extra = {}) {
   return {
     runtimeMode: "vercel-sandbox",
@@ -5471,6 +5509,22 @@ var DEFAULT_MODE_LOGGER = {
 `);
   }
 };
+function extractHttpStatus2(error) {
+  const statusCode = error?.statusCode;
+  if (typeof statusCode === "number") return statusCode;
+  const status = error?.status;
+  if (typeof status === "number") return status;
+  const responseStatus = error?.response?.status;
+  return typeof responseStatus === "number" ? responseStatus : null;
+}
+function isExpiredSandboxRuntimeError(error) {
+  const code = error?.code;
+  if (code === ErrorCode.enum.SANDBOX_EXPIRED) return true;
+  const status = extractHttpStatus2(error);
+  if (status === 404 || status === 410) return true;
+  const message = error instanceof Error ? error.message : String(error);
+  return /status code (404|410) is not ok/i.test(message);
+}
 function requireEnvVar(name, getEnvVar) {
   const value = getEnvVar(name)?.trim();
   if (!value) {
@@ -5510,6 +5564,33 @@ function createVercelSandboxModeAdapter(opts = {}) {
   return {
     id: "vercel-sandbox",
     workspaceFsCapability: "best-effort",
+    readiness: {
+      initialSandboxReady: false,
+      initialWorkspaceReadiness: { state: "preparing" },
+      onTrackerCreated: (tracker) => {
+        queueMicrotask(() => tracker.markSandboxReady());
+      }
+    },
+    cachedBindingHealthCheck: {
+      intervalMs: VERCEL_BINDING_HEALTHCHECK_INTERVAL_MS,
+      async check({ runtimeBundle }) {
+        try {
+          await runtimeBundle.workspace.stat(".");
+          return { state: "ok" };
+        } catch (error) {
+          if (!isExpiredSandboxRuntimeError(error)) throw error;
+          return {
+            state: "recreate",
+            message: "[sandbox] cached runtime expired; recreating from persisted handle",
+            error
+          };
+        }
+      }
+    },
+    getRuntimeLayoutRoot: () => VERCEL_SANDBOX_WORKSPACE_ROOT,
+    evictCachedRuntime: ({ workspaceId }) => {
+      evictSandboxHandleCacheForWorkspace(workspaceId);
+    },
     async dispose() {
       await snapshotScheduler?.shutdown();
     },
@@ -5692,7 +5773,9 @@ function createVercelSandboxModeAdapter(opts = {}) {
           workspace,
           sandbox,
           fileSearch: createServerFileSearch(workspace, sandbox),
-          runtimeContext: workspace.runtimeContext
+          runtimeContext: workspace.runtimeContext,
+          bash: { kind: "remote", defaultPath: VERCEL_SAFE_DEFAULT_PATH },
+          filesystem: { kind: "remote-workspace", pathOptions: vercelRemoteWorkspacePathOptions() }
         };
       } catch (error) {
         const code = error?.code;
@@ -5736,7 +5819,13 @@ function autoDetectMode() {
   }
   return "direct";
 }
-function resolveMode(mode = autoDetectMode()) {
+function resolveMode(mode = autoDetectMode(), opts = {}) {
+  if (mode === "vercel-sandbox" && opts.sandboxHandleStore) {
+    return createVercelSandboxModeAdapter({
+      store: opts.sandboxHandleStore,
+      orphanGuardMaxIdleMs: null
+    });
+  }
   if (isBuiltinRuntimeModeId(mode)) return MODE_ADAPTERS[mode];
   throw new Error(`Runtime mode "${mode}" has no built-in adapter. Pass runtimeModeAdapter to use a custom sandbox mode.`);
 }
@@ -5745,15 +5834,48 @@ function resolveMode(mode = autoDetectMode()) {
 import Fastify from "fastify";
 
 // src/server/runtime/mode.ts
+function getOptionalRuntimeBundleStorageRoot(bundle) {
+  return bundle.storageRoot ?? getNodeWorkspaceHostRoot(bundle.workspace) ?? void 0;
+}
 function getRuntimeBundleStorageRoot(bundle) {
-  const hostRoot = bundle.storageRoot ?? getNodeWorkspaceHostRoot(bundle.workspace);
+  const hostRoot = getOptionalRuntimeBundleStorageRoot(bundle);
   if (hostRoot) return hostRoot;
-  if (bundle.sandbox.provider === "vercel-sandbox") return bundle.workspace.root;
   throw new Error(
     `RuntimeBundle.storageRoot is required for host-filesystem tools. Mode adapters must set storageRoot to the host workspace path. Got workspace.root=${bundle.workspace.root}, sandbox.provider=${bundle.sandbox.provider}`
   );
 }
 
+// src/server/runtimeEnvContributions.ts
+function withRuntimeEnvContributions(runtimeBundle, baseContext, contributions, telemetry) {
+  const getRuntimeEnv = async () => {
+    const contributedEnv = {};
+    for (const contribution of contributions) {
+      Object.assign(contributedEnv, await contribution.getEnv(baseContext));
+    }
+    if (telemetry) {
+      safeCapture(telemetry, {
+        name: "agent.runtime.env_contributed",
+        properties: {
+          runtimeMode: baseContext.runtimeMode,
+          contributionIds: contributions.map((contribution) => contribution.id)
+        }
+      });
+    }
+    return contributedEnv;
+  };
+  const sandbox = {
+    ...runtimeBundle.sandbox,
+    exec: async (cmd, execOpts = {}) => {
+      const contributedEnv = await getRuntimeEnv();
+      return runtimeBundle.sandbox.exec(cmd, {
+        ...execOpts,
+        env: { ...contributedEnv, ...execOpts.env ?? {} }
+      });
+    }
+  };
+  return { ...runtimeBundle, sandbox, getRuntimeEnv };
+}
+
 // src/server/harness/pi-coding-agent/createHarness.ts
 import { existsSync, readFileSync as readFileSync2 } from "fs";
 import { extname as extname3, join as join11 } from "path";
@@ -6273,10 +6395,34 @@ var PiSessionStore = class {
     }
   }
   async loadPiSessionFile(_ctx, sessionId) {
+    if (!SAFE_ID.test(sessionId)) return null;
     try {
-      const filepath = await this.resolveSessionFile(sessionId);
-      const content = await readFile9(filepath, "utf-8");
-      return extractPiSessionFilePath(safeParseEntries(content)) ?? (isTimestampNamedPiSessionFile(filepath, sessionId) ? filepath : null);
+      const direct = join10(this.sessionDir, `${sessionId}.jsonl`);
+      let filepath = direct;
+      let content;
+      try {
+        content = await readFile9(direct, "utf-8");
+      } catch {
+        const files = await readdir7(this.sessionDir).catch(() => []);
+        const match = files.find(
+          (f) => f.endsWith(`_${sessionId}.jsonl`) || f === `${sessionId}.jsonl`
+        );
+        if (!match) return null;
+        filepath = join10(this.sessionDir, match);
+        content = await readFile9(filepath, "utf-8");
+      }
+      const entries = safeParseEntries(content);
+      const linkedPiFile = extractPiSessionFilePath(entries);
+      if (linkedPiFile) return linkedPiFile;
+      if (!isTimestampNamedPiSessionFile(filepath, sessionId)) return null;
+      const existingWrapper = await this.findWrapperReferencingNativeSession(filepath);
+      if (existingWrapper) {
+        const wrapperSessionId = await this.readSessionFileId(existingWrapper);
+        if (wrapperSessionId !== sessionId) return null;
+        const wrapperEntries = parseJsonlPrefixEntries(await readJsonlPrefix(existingWrapper));
+        return extractPiSessionFilePath(wrapperEntries);
+      }
+      return await this.ensureWrapperForNativeSession(sessionId, filepath);
     } catch {
       return null;
     }
@@ -7182,8 +7328,8 @@ function createPiCodingAgentHarness(opts) {
     const { session: piSession } = await createAgentSession({
       cwd: runtimeCwd,
       // Suppress Pi's built-in filesystem/shell tools while keeping Boring's
-      // adapted tool catalog active. Passing `tools: []` is an allowlist of
-      // zero tools in Pi v0.75+, which disables customTools too.
+      // adapted tool catalog active. Do NOT pass an explicit empty tool-name
+      // allowlist: in the current Pi SDK that disables custom tools too.
       noTools: "builtin",
       customTools: adaptToolsForPi(opts.tools, input.sessionId, opts.telemetry),
       model,
@@ -7450,12 +7596,12 @@ async function loadPlugins(options) {
 
 // src/server/tools/filesystem/index.ts
 import {
-  createEditToolDefinition,
-  createFindToolDefinition,
+  createEditToolDefinition as createEditToolDefinition2,
+  createFindToolDefinition as createFindToolDefinition2,
   createGrepToolDefinition as createGrepToolDefinition2,
-  createLsToolDefinition,
-  createReadToolDefinition,
-  createWriteToolDefinition
+  createLsToolDefinition as createLsToolDefinition2,
+  createReadToolDefinition as createReadToolDefinition2,
+  createWriteToolDefinition as createWriteToolDefinition2
 } from "@mariozechner/pi-coding-agent";
 
 // src/server/tools/operations/bound.ts
@@ -7596,7 +7742,7 @@ function boundFs(workspaceRoot, opts = {}) {
     }
     return absolutePath;
   };
-  const toRuntimePath2 = (absolutePath) => {
+  const toRuntimePath = (absolutePath) => {
     if (!shouldMapRuntimeRoot || !runtimeRoot) return absolutePath;
     const rel = relative10(workspaceRoot, absolutePath);
     if (rel === "") return runtimeRoot;
@@ -7662,7 +7808,7 @@ function boundFs(workspaceRoot, opts = {}) {
       await assertWithinWorkspace(workspaceRoot, storageCwd);
       const matches = [];
       await walkMatches(storageCwd, storageCwd, pattern, options.ignore, options.limit, matches);
-      return matches.map(toRuntimePath2);
+      return matches.map(toRuntimePath);
     }
   };
   const grep = {
@@ -7702,20 +7848,28 @@ function boundFs(workspaceRoot, opts = {}) {
   return { read, write, edit, find, grep, ls };
 }
 
-// src/server/tools/operations/vercel.ts
+// src/server/tools/filesystem/remoteWorkspaceTools.ts
+import {
+  createEditToolDefinition,
+  createFindToolDefinition,
+  createLsToolDefinition,
+  createReadToolDefinition,
+  createWriteToolDefinition
+} from "@mariozechner/pi-coding-agent";
+
+// src/server/tools/operations/remoteWorkspace.ts
 import { isAbsolute as isAbsolute8, relative as relative11 } from "path";
-var VERCEL_SANDBOX_LEGACY_ROOT = "/vercel/sandbox";
-function rootAliases(workspace) {
-  const aliases = [workspace.root];
-  if (workspace.root === VERCEL_SANDBOX_WORKSPACE_ROOT) aliases.push(VERCEL_SANDBOX_LEGACY_ROOT);
-  if (workspace.root === VERCEL_SANDBOX_LEGACY_ROOT) aliases.push(VERCEL_SANDBOX_WORKSPACE_ROOT);
-  return Array.from(new Set(aliases));
+function unique(values) {
+  return Array.from(new Set(values));
+}
+function rootsFor(workspace, opts = {}) {
+  return unique([workspace.root, ...opts.rootAliases ?? []]);
 }
 function isOutsideWorkspaceRel(rel) {
   return rel === ".." || rel.startsWith("../") || rel.startsWith("..\\") || isAbsolute8(rel);
 }
-function toRelPath(workspace, absolutePath) {
-  for (const root of rootAliases(workspace)) {
+function toRelPath(workspace, absolutePath, opts = {}) {
+  for (const root of rootsFor(workspace, opts)) {
     const rel = relative11(root, absolutePath);
     if (!isOutsideWorkspaceRel(rel)) return rel;
   }
@@ -7732,113 +7886,92 @@ function toRelPath(workspace, absolutePath) {
     `path "${absolutePath}" is outside workspace; use a path relative to the workspace root or under ${workspace.root}`
   );
 }
-function vercelBashOps(sandbox, opts = {}) {
-  return {
-    exec(command, cwd, { onData, signal, timeout, env }) {
-      const effectiveEnv = opts.mergeEnv ? opts.mergeEnv(env) : env;
-      const filteredEnv2 = effectiveEnv ? Object.fromEntries(Object.entries(effectiveEnv).filter((e) => e[1] != null)) : void 0;
-      return sandbox.exec(command, {
-        cwd,
-        env: filteredEnv2,
-        signal,
-        timeoutMs: timeout ? timeout * 1e3 : void 0,
-        onStdout: (chunk) => onData(Buffer.from(chunk)),
-        onStderr: (chunk) => onData(Buffer.from(chunk))
-      }).then((result) => ({ exitCode: result.exitCode }));
-    }
-  };
+function shellEscape(s) {
+  return `'${s.replace(/'/g, "'\\''")}'`;
+}
+function findPredicate(pattern) {
+  const isPathShaped = pattern.includes("/") || pattern.includes("**");
+  if (!isPathShaped) return `-name ${shellEscape(pattern)}`;
+  let translated = pattern.replaceAll("**", "*").replace(/^\/+/, "");
+  if (!translated.startsWith("*")) translated = `*${translated}`;
+  return `-path ${shellEscape(translated)}`;
+}
+function findIgnoreArgs(cwd, ignore) {
+  return ignore.map((pattern) => `! -path ${shellEscape(`${cwd}/${pattern.replace(/^\/+/, "")}/*`)}`).join(" ");
 }
-function vercelReadOps(workspace) {
+function fallbackFindCommand(pattern, cwd, options) {
+  return [
+    "find",
+    shellEscape(cwd),
+    "-maxdepth 20",
+    "-type f",
+    findIgnoreArgs(cwd, options.ignore),
+    findPredicate(pattern),
+    `| head -n ${Math.max(1, Math.trunc(options.limit))}`
+  ].filter(Boolean).join(" ");
+}
+function isFdMissing(result) {
+  if (result.exitCode !== 127) return false;
+  const stderr = Buffer.from(result.stderr).toString("utf-8");
+  return /\bfd: (?:not found|command not found)\b/i.test(stderr);
+}
+function remotePath(value, opts) {
+  return opts.toRemotePath?.(value) ?? value;
+}
+function runtimePath(value, opts) {
+  return opts.toRuntimePath?.(value) ?? value;
+}
+function sanitizeErrorText(value, opts) {
+  return opts.sanitizeErrorText?.(value) ?? value;
+}
+function remoteWorkspaceReadOps(workspace, opts = {}) {
   return {
     async readFile(absolutePath) {
-      const rel = toRelPath(workspace, absolutePath);
+      const rel = toRelPath(workspace, absolutePath, opts);
       const content = await workspace.readFile(rel);
       return Buffer.from(content, "utf-8");
     },
     async access(absolutePath) {
-      const rel = toRelPath(workspace, absolutePath);
+      const rel = toRelPath(workspace, absolutePath, opts);
       await workspace.stat(rel);
     }
   };
 }
-function vercelWriteOps(workspace) {
+function remoteWorkspaceWriteOps(workspace, opts = {}) {
   return {
     async writeFile(absolutePath, content) {
-      const rel = toRelPath(workspace, absolutePath);
+      const rel = toRelPath(workspace, absolutePath, opts);
       await workspace.writeFile(rel, content);
     },
     async mkdir(dir) {
-      const rel = toRelPath(workspace, dir);
+      const rel = toRelPath(workspace, dir, opts);
       await workspace.mkdir(rel, { recursive: true });
     }
   };
 }
-function vercelEditOps(workspace) {
+function remoteWorkspaceEditOps(workspace, opts = {}) {
   return {
     async readFile(absolutePath) {
-      const rel = toRelPath(workspace, absolutePath);
+      const rel = toRelPath(workspace, absolutePath, opts);
       const content = await workspace.readFile(rel);
       return Buffer.from(content, "utf-8");
     },
     async writeFile(absolutePath, content) {
-      const rel = toRelPath(workspace, absolutePath);
+      const rel = toRelPath(workspace, absolutePath, opts);
       await workspace.writeFile(rel, content);
     },
     async access(absolutePath) {
-      const rel = toRelPath(workspace, absolutePath);
+      const rel = toRelPath(workspace, absolutePath, opts);
       await workspace.stat(rel);
     }
   };
 }
-function toRemotePath(value) {
-  if (value === VERCEL_SANDBOX_LEGACY_ROOT) return VERCEL_SANDBOX_REMOTE_ROOT;
-  if (value.startsWith(`${VERCEL_SANDBOX_LEGACY_ROOT}/`)) {
-    return `${VERCEL_SANDBOX_REMOTE_ROOT}${value.slice(VERCEL_SANDBOX_LEGACY_ROOT.length)}`;
-  }
-  return value;
-}
-function toRuntimePath(value) {
-  if (value === VERCEL_SANDBOX_LEGACY_ROOT) return VERCEL_SANDBOX_WORKSPACE_ROOT;
-  if (value.startsWith(`${VERCEL_SANDBOX_LEGACY_ROOT}/`)) {
-    return `${VERCEL_SANDBOX_WORKSPACE_ROOT}${value.slice(VERCEL_SANDBOX_LEGACY_ROOT.length)}`;
-  }
-  return value;
-}
-function sanitizeRuntimeText(value) {
-  return value.replaceAll(VERCEL_SANDBOX_LEGACY_ROOT, VERCEL_SANDBOX_WORKSPACE_ROOT);
-}
-function findPredicate(pattern) {
-  const isPathShaped = pattern.includes("/") || pattern.includes("**");
-  if (!isPathShaped) return `-name ${shellEscape(pattern)}`;
-  let translated = pattern.replaceAll("**", "*").replace(/^\/+/, "");
-  if (!translated.startsWith("*")) translated = `*${translated}`;
-  return `-path ${shellEscape(translated)}`;
-}
-function findIgnoreArgs(cwd, ignore) {
-  return ignore.map((pattern) => `! -path ${shellEscape(`${cwd}/${pattern.replace(/^\/+/, "")}/*`)}`).join(" ");
-}
-function fallbackFindCommand(pattern, cwd, options) {
-  return [
-    "find",
-    shellEscape(cwd),
-    "-maxdepth 20",
-    "-type f",
-    findIgnoreArgs(cwd, options.ignore),
-    findPredicate(pattern),
-    `| head -n ${Math.max(1, Math.trunc(options.limit))}`
-  ].filter(Boolean).join(" ");
-}
-function isFdMissing(result) {
-  if (result.exitCode !== 127) return false;
-  const stderr = Buffer.from(result.stderr).toString("utf-8");
-  return /\bfd: (?:not found|command not found)\b/i.test(stderr);
-}
-function vercelFindOps(sandbox, workspace) {
+function remoteWorkspaceFindOps(sandbox, workspace, opts = {}) {
   return {
     async exists(absolutePath) {
       if (workspace) {
         try {
-          const rel = toRelPath(workspace, absolutePath);
+          const rel = toRelPath(workspace, absolutePath, opts);
           await workspace.stat(rel);
           return true;
         } catch {
@@ -7851,11 +7984,9 @@ function vercelFindOps(sandbox, workspace) {
       return result.exitCode === 0;
     },
     async glob(pattern, cwd, options) {
-      const remoteCwd = toRemotePath(cwd);
+      const remoteCwd = remotePath(cwd, opts);
       const args = ["fd", "--glob", "--no-require-git", "--max-results", String(options.limit)];
-      for (const ig of options.ignore) {
-        args.push("--exclude", ig);
-      }
+      for (const ig of options.ignore) args.push("--exclude", ig);
       args.push(pattern, remoteCwd);
       let result = await sandbox.exec(args.map(shellEscape).join(" "), {
         timeoutMs: 3e4,
@@ -7868,19 +7999,19 @@ function vercelFindOps(sandbox, workspace) {
         });
       }
       if (result.exitCode !== 0 && result.exitCode !== 1) {
-        const stderr = sanitizeRuntimeText(Buffer.from(result.stderr).toString("utf-8").trim());
+        const stderr = sanitizeErrorText(Buffer.from(result.stderr).toString("utf-8").trim(), opts);
         throw new Error(`file search failed (exit ${result.exitCode}): ${stderr}`);
       }
       const stdout = Buffer.from(result.stdout).toString("utf-8");
-      return stdout.split("\n").filter(Boolean).map(toRuntimePath);
+      return stdout.split("\n").filter(Boolean).map((value) => runtimePath(value, opts));
     }
   };
 }
-function vercelLsOps(workspace) {
+function remoteWorkspaceLsOps(workspace, opts = {}) {
   return {
     async exists(absolutePath) {
       try {
-        const rel = toRelPath(workspace, absolutePath);
+        const rel = toRelPath(workspace, absolutePath, opts);
         await workspace.stat(rel);
         return true;
       } catch {
@@ -7888,22 +8019,18 @@ function vercelLsOps(workspace) {
       }
     },
     async stat(absolutePath) {
-      const rel = toRelPath(workspace, absolutePath);
-      const s = await workspace.stat(rel);
-      return { isDirectory: () => s.kind === "dir" };
+      const rel = toRelPath(workspace, absolutePath, opts);
+      const stat11 = await workspace.stat(rel);
+      return { isDirectory: () => stat11.kind === "dir" };
     },
     async readdir(absolutePath) {
-      const rel = toRelPath(workspace, absolutePath);
-      const entries = await workspace.readdir(rel);
-      return entries.map((e) => e.name);
+      const rel = toRelPath(workspace, absolutePath, opts);
+      return (await workspace.readdir(rel)).map((entry) => entry.name);
     }
   };
 }
-function shellEscape(arg) {
-  return `'${arg.replace(/'/g, "'\\''")}'`;
-}
 
-// src/server/tools/vercelGrepTool.ts
+// src/server/tools/remoteWorkspaceGrepTool.ts
 import {
   createGrepToolDefinition,
   formatSize,
@@ -7927,7 +8054,7 @@ function decode(bytes) {
   return decoder.decode(bytes);
 }
 
-// src/server/tools/vercelGrepTool.ts
+// src/server/tools/remoteWorkspaceGrepTool.ts
 var PI_GREP_TOOL = createGrepToolDefinition("/");
 var DEFAULT_LIMIT2 = 100;
 var GREP_MAX_LINE_LENGTH = 500;
@@ -7943,7 +8070,7 @@ function numberParam(value, fallback, min = 1) {
 function optionalStringParam(value) {
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
-function buildRgCommand(params) {
+function buildRgCommand(params, searchPath) {
   const args = ["--json", "--line-number", "--color=never", "--hidden"];
   if (params.ignoreCase === true) args.push("--ignore-case");
   if (params.literal === true) args.push("--fixed-strings");
@@ -7952,11 +8079,10 @@ function buildRgCommand(params) {
   const context = numberParam(params.context, 0, 0);
   if (context > 0) args.push("--context", String(context));
   const pattern = params.pattern;
-  const searchPath = optionalStringParam(params.path) ?? ".";
   args.push("--", quoteShell(pattern), quoteShell(searchPath));
   return `rg ${args.join(" ")}`;
 }
-function parseRgJson(stdout, limit) {
+function parseRgJson(stdout, limit, pathOptions) {
   const outputLines = [];
   let matchCount = 0;
   let matchLimitReached = false;
@@ -7989,7 +8115,7 @@ function parseRgJson(stdout, limit) {
     const { text, wasTruncated } = truncateLine(sanitized);
     if (wasTruncated) linesTruncated = true;
     const separator = isMatch ? ":" : "-";
-    outputLines.push(`${filePath}${separator}${lineNumber}${separator} ${text}`);
+    outputLines.push(`${pathOptions?.toRuntimePath?.(filePath) ?? filePath}${separator}${lineNumber}${separator} ${text}`);
   }
   return { outputLines, matchCount, matchLimitReached, linesTruncated };
 }
@@ -8010,6 +8136,29 @@ function syntheticExecTruncation(output) {
     maxBytes: GREP_MAX_OUTPUT_BYTES
   };
 }
+function isOutsideWorkspace(rel) {
+  return rel === ".." || rel.startsWith("../") || rel.startsWith("..\\") || rel.startsWith("/");
+}
+function isUnderRoot(root, path4) {
+  const rel = relative12(root, path4);
+  return !isOutsideWorkspace(rel);
+}
+function normalizeSearchPath(rawPath, workspaceRoot, pathOptions) {
+  const path4 = optionalStringParam(rawPath) ?? ".";
+  if (!workspaceRoot) return { ok: true, path: pathOptions?.toRemotePath?.(path4) ?? path4 };
+  if (!path4.startsWith("/")) {
+    const resolved = resolve10(workspaceRoot, path4);
+    const rel = relative12(workspaceRoot, resolved);
+    if (isOutsideWorkspace(rel)) return { ok: false, message: `path "${path4}" is outside workspace` };
+    return { ok: true, path: path4 };
+  }
+  const roots = [workspaceRoot, ...pathOptions?.rootAliases ?? []];
+  if (!roots.some((root) => isUnderRoot(root, path4))) return { ok: false, message: `path "${path4}" is outside workspace` };
+  return { ok: true, path: pathOptions?.toRemotePath?.(path4) ?? path4 };
+}
+function sanitizeErrorMessage(message, pathOptions) {
+  return pathOptions?.sanitizeErrorText?.(message) ?? message;
+}
 function buildSuccessResult(parsed, effectiveLimit, sandboxTruncated) {
   if (parsed.matchCount === 0) {
     return {
@@ -8047,7 +8196,7 @@ function buildSuccessResult(parsed, effectiveLimit, sandboxTruncated) {
     details: Object.keys(details).length > 0 ? details : void 0
   };
 }
-function vercelGrepTool(sandbox, workspaceRoot) {
+function remoteWorkspaceGrepTool(sandbox, workspaceRoot, pathOptions) {
   return {
     name: PI_GREP_TOOL.name,
     description: PI_GREP_TOOL.description,
@@ -8061,36 +8210,31 @@ function vercelGrepTool(sandbox, workspaceRoot) {
       if (typeof params.pattern !== "string" || params.pattern.length === 0) {
         return makeError("pattern is required");
       }
-      if (workspaceRoot && typeof params.path === "string" && params.path.length > 0) {
-        const resolved = resolve10(workspaceRoot, params.path);
-        const rel = relative12(workspaceRoot, resolved);
-        if (rel.startsWith("..") || rel.startsWith("/")) {
-          return makeError(`path "${params.path}" is outside workspace`);
-        }
-      }
+      const searchPath = normalizeSearchPath(params.path, workspaceRoot, pathOptions);
+      if (!searchPath.ok) return makeError(searchPath.message);
       try {
-        const result = await sandbox.exec(buildRgCommand(params), {
+        const result = await sandbox.exec(buildRgCommand(params, searchPath.path), {
           signal: ctx.abortSignal,
           timeoutMs: GREP_TIMEOUT_MS,
           maxOutputBytes: GREP_MAX_OUTPUT_BYTES
         });
         if (result.exitCode !== 0 && result.exitCode !== 1) {
-          const stderr = decode(result.stderr).trim();
+          const stderr = sanitizeErrorMessage(decode(result.stderr).trim(), pathOptions);
           const message = stderr || `ripgrep exited with code ${result.exitCode}`;
           return makeError(`grep failed: ${message}`);
         }
         const limit = numberParam(params.limit, DEFAULT_LIMIT2);
-        const parsed = parseRgJson(decode(result.stdout), limit);
+        const parsed = parseRgJson(decode(result.stdout), limit, pathOptions);
         return buildSuccessResult(parsed, limit, result.truncated);
       } catch (error) {
-        const message = error instanceof Error ? error.message : "unknown error";
+        const message = error instanceof Error ? sanitizeErrorMessage(error.message, pathOptions) : "unknown error";
         return makeError(`grep failed: ${message}`);
       }
     }
   };
 }
 
-// src/server/tools/filesystem/index.ts
+// src/server/tools/filesystem/remoteWorkspaceTools.ts
 function isTextContent(content) {
   return content.type === "text" && typeof content.text === "string";
 }
@@ -8121,35 +8265,73 @@ function adaptPiTool(piTool) {
     }
   };
 }
+function buildRemoteWorkspaceFilesystemAgentTools(bundle, pathOptions) {
+  const cwd = bundle.workspace.root;
+  return [
+    adaptPiTool(createReadToolDefinition(cwd, { operations: remoteWorkspaceReadOps(bundle.workspace, pathOptions) })),
+    adaptPiTool(createWriteToolDefinition(cwd, { operations: remoteWorkspaceWriteOps(bundle.workspace, pathOptions) })),
+    adaptPiTool(createEditToolDefinition(cwd, { operations: remoteWorkspaceEditOps(bundle.workspace, pathOptions) })),
+    adaptPiTool(createFindToolDefinition(cwd, { operations: remoteWorkspaceFindOps(bundle.sandbox, bundle.workspace, pathOptions) })),
+    { ...remoteWorkspaceGrepTool(bundle.sandbox, cwd, pathOptions), readinessRequirements: ["workspace-fs"] },
+    adaptPiTool(createLsToolDefinition(cwd, { operations: remoteWorkspaceLsOps(bundle.workspace, pathOptions) }))
+  ];
+}
+
+// src/server/tools/filesystem/index.ts
+function isTextContent2(content) {
+  return content.type === "text" && typeof content.text === "string";
+}
+function adaptPiTool2(piTool) {
+  return {
+    name: piTool.name,
+    readinessRequirements: ["workspace-fs"],
+    description: piTool.description,
+    promptSnippet: piTool.promptSnippet,
+    parameters: piTool.parameters,
+    async execute(params, ctx) {
+      const result = await piTool.execute(
+        ctx.toolCallId,
+        params,
+        ctx.abortSignal,
+        ctx.onUpdate ? (update) => {
+          const text = update.content?.filter(isTextContent2).map((c) => c.text).join("");
+          if (text) ctx.onUpdate?.(text);
+        } : void 0,
+        {}
+      );
+      const textContent = (result.content ?? []).filter(isTextContent2).map((c) => ({ type: "text", text: c.text }));
+      return {
+        content: textContent.length > 0 ? textContent : [{ type: "text", text: "" }],
+        isError: false,
+        details: result.details
+      };
+    }
+  };
+}
+function defaultFilesystemStrategyForBundle(bundle) {
+  return bundle.sandbox.placement === "remote" ? { kind: "remote-workspace" } : { kind: "host" };
+}
 function buildFilesystemAgentTools(bundle) {
   const cwd = bundle.workspace.root;
-  if (bundle.sandbox.provider === "vercel-sandbox" || bundle.sandbox.provider === "remote-worker") {
-    return [
-      adaptPiTool(createReadToolDefinition(cwd, { operations: vercelReadOps(bundle.workspace) })),
-      adaptPiTool(createWriteToolDefinition(cwd, { operations: vercelWriteOps(bundle.workspace) })),
-      adaptPiTool(createEditToolDefinition(cwd, { operations: vercelEditOps(bundle.workspace) })),
-      adaptPiTool(createFindToolDefinition(cwd, { operations: vercelFindOps(bundle.sandbox, bundle.workspace) })),
-      { ...vercelGrepTool(bundle.sandbox, cwd), readinessRequirements: ["workspace-fs"] },
-      adaptPiTool(createLsToolDefinition(cwd, { operations: vercelLsOps(bundle.workspace) }))
-    ];
+  const strategy = bundle.filesystem ?? defaultFilesystemStrategyForBundle(bundle);
+  if (strategy.kind === "remote-workspace") {
+    return buildRemoteWorkspaceFilesystemAgentTools(bundle, strategy.pathOptions);
   }
   const storageRoot = getRuntimeBundleStorageRoot(bundle);
   const ops = boundFs(storageRoot, { runtimeRoot: cwd });
   return [
-    adaptPiTool(createReadToolDefinition(cwd, { operations: ops.read })),
-    adaptPiTool(createWriteToolDefinition(cwd, { operations: ops.write })),
-    adaptPiTool(createEditToolDefinition(cwd, { operations: ops.edit })),
-    adaptPiTool(createFindToolDefinition(cwd, { operations: ops.find })),
-    adaptPiTool(createGrepToolDefinition2(cwd, { operations: ops.grep })),
-    adaptPiTool(createLsToolDefinition(cwd, { operations: ops.ls }))
+    adaptPiTool2(createReadToolDefinition2(cwd, { operations: ops.read })),
+    adaptPiTool2(createWriteToolDefinition2(cwd, { operations: ops.write })),
+    adaptPiTool2(createEditToolDefinition2(cwd, { operations: ops.edit })),
+    adaptPiTool2(createFindToolDefinition2(cwd, { operations: ops.find })),
+    adaptPiTool2(createGrepToolDefinition2(cwd, { operations: ops.grep })),
+    adaptPiTool2(createLsToolDefinition2(cwd, { operations: ops.ls }))
   ];
 }
 
 // src/server/tools/harness/index.ts
-import {
-  createBashToolDefinition,
-  createLocalBashOperations
-} from "@mariozechner/pi-coding-agent";
+import { unlink as unlink4 } from "fs/promises";
+import { createBashToolDefinition } from "@mariozechner/pi-coding-agent";
 
 // src/server/catalog/toolReadiness.ts
 var WORKSPACE_PREPARING_MESSAGE = "Workspace is still preparing. Try again in a moment.";
@@ -8227,11 +8409,13 @@ function wrapToolForReadiness(tool, checkReadiness) {
   };
 }
 
-// src/server/tools/harness/index.ts
-function shellEscape2(s) {
-  return `'${s.replace(/'/g, "'\\''")}'`;
-}
-function mergeRuntimeEnv(runtime, commandEnv) {
+// src/server/tools/harness/bashToolOptions.ts
+import {
+  createLocalBashOperations
+} from "@mariozechner/pi-coding-agent";
+
+// src/server/runtime/env.ts
+function mergeRuntimeProvisioningEnv(runtime, commandEnv) {
   const current = runtime?.getCurrent?.() ?? runtime;
   if (!current?.env && !current?.pathEntries?.length) return commandEnv;
   const merged = {
@@ -8244,7 +8428,38 @@ function mergeRuntimeEnv(runtime, commandEnv) {
   if (pathParts.length > 0) merged.PATH = pathParts.join(":");
   return merged;
 }
-function bwrapSpawnHook(workspaceRoot, runtime) {
+
+// src/server/tools/operations/remoteSandbox.ts
+var REMOTE_SAFE_DEFAULT_PATH = "/usr/local/bin:/usr/bin:/bin";
+function mergeRemoteBashRuntimeEnv(runtime, executionRuntimeEnv, defaultPath) {
+  const { PATH: executionPath, ...executionEnv } = executionRuntimeEnv ?? {};
+  return mergeRuntimeProvisioningEnv(runtime, {
+    ...executionEnv,
+    PATH: executionPath ? `${executionPath}:${defaultPath}` : defaultPath
+  });
+}
+function remoteSandboxBashOps(sandbox, opts = {}) {
+  return {
+    exec(command, cwd, { onData, signal, timeout, env }) {
+      const effectiveEnv = opts.mergeEnv ? opts.mergeEnv(env) : opts.runtime || opts.executionRuntimeEnv ? mergeRemoteBashRuntimeEnv(opts.runtime, opts.executionRuntimeEnv, opts.defaultPath ?? REMOTE_SAFE_DEFAULT_PATH) : env;
+      const filteredEnv2 = effectiveEnv ? Object.fromEntries(Object.entries(effectiveEnv).filter((e) => e[1] != null)) : void 0;
+      return sandbox.exec(command, {
+        cwd,
+        env: filteredEnv2,
+        signal,
+        timeoutMs: timeout ? timeout * 1e3 : void 0,
+        onStdout: (chunk) => onData(Buffer.from(chunk)),
+        onStderr: (chunk) => onData(Buffer.from(chunk))
+      }).then((result) => ({ exitCode: result.exitCode }));
+    }
+  };
+}
+
+// src/server/tools/harness/bashToolOptions.ts
+function shellEscape2(s) {
+  return `'${s.replace(/'/g, "'\\''")}'`;
+}
+function bwrapSpawnHook(workspaceRoot, runtime, sandboxRoot = "/workspace") {
   const args = buildBwrapArgs(workspaceRoot);
   const bwrapPrefix = ["bwrap", ...args].map(shellEscape2).join(" ");
   return (context) => ({
@@ -8252,50 +8467,94 @@ function bwrapSpawnHook(workspaceRoot, runtime) {
     command: `${bwrapPrefix} bash -lc ${shellEscape2(context.command)}`,
     env: withWorkspacePythonEnv({
       workspaceRoot,
-      env: mergeRuntimeEnv(runtime, context.env),
-      sandboxRoot: "/workspace"
+      env: mergeRuntimeProvisioningEnv(runtime, context.env),
+      sandboxRoot
     })
   });
 }
-function directSpawnHook(workspaceRoot, runtime) {
+function directSpawnHook(workspaceRoot, runtime, preserveHostHome = true) {
   return (context) => ({
     ...context,
     env: withWorkspacePythonEnv({
       workspaceRoot,
-      env: mergeRuntimeEnv(runtime, context.env),
-      preserveHostHome: true
+      env: mergeRuntimeProvisioningEnv(runtime, context.env),
+      preserveHostHome
     })
   });
 }
-var VERCEL_SAFE_DEFAULT_PATH = "/vercel/runtimes/node24/bin:/vercel/runtimes/node22/bin:/usr/local/bin:/usr/bin:/bin";
-function bashOptionsForMode(bundle, runtime) {
-  switch (bundle.sandbox.provider) {
-    case "vercel-sandbox":
-    case "remote-worker":
-      return {
-        operations: vercelBashOps(bundle.sandbox, {
-          // The pi bash tool's env may include the host process env. Never
-          // forward host secrets into a remote sandbox; provide only the
-          // provisioned runtime env plus a conservative remote PATH tail.
-          mergeEnv: () => mergeRuntimeEnv(runtime, { PATH: VERCEL_SAFE_DEFAULT_PATH })
-        })
-      };
-    case "bwrap": {
-      const storageRoot = getRuntimeBundleStorageRoot(bundle);
-      return {
-        operations: createLocalBashOperations(),
-        spawnHook: bwrapSpawnHook(storageRoot, runtime)
-      };
-    }
-    default: {
-      const storageRoot = getRuntimeBundleStorageRoot(bundle);
-      return {
-        operations: createLocalBashOperations(),
-        spawnHook: directSpawnHook(storageRoot, runtime)
-      };
+function localBashOperationsWithRuntimeEnv(bundle) {
+  const local = createLocalBashOperations();
+  return {
+    async exec(command, cwd, options) {
+      const runtimeEnv = await bundle.getRuntimeEnv?.();
+      return local.exec(command, cwd, {
+        ...options,
+        env: { ...options.env ?? {}, ...runtimeEnv ?? {} }
+      });
     }
+  };
+}
+function hostBashToolOptions(bundle, runtime, strategy) {
+  const storageRoot = getRuntimeBundleStorageRoot(bundle);
+  return {
+    operations: localBashOperationsWithRuntimeEnv(bundle),
+    spawnHook: directSpawnHook(storageRoot, runtime, strategy.preserveHostHome ?? true)
+  };
+}
+function localSandboxBashToolOptions(bundle, runtime, strategy) {
+  const storageRoot = getRuntimeBundleStorageRoot(bundle);
+  return {
+    // localBashOperationsWithRuntimeEnv() injects bundle.getRuntimeEnv()
+    // into the outer shell env before the spawned sandbox shell command runs,
+    // so bridge runtime env reaches local sandboxed commands without relying
+    // on provisioning PATH/env alone.
+    operations: localBashOperationsWithRuntimeEnv(bundle),
+    spawnHook: bwrapSpawnHook(storageRoot, runtime, strategy.sandboxRoot)
+  };
+}
+function remoteBashToolOptions(bundle, runtime, executionRuntimeEnv, strategy) {
+  return {
+    operations: remoteSandboxBashOps(bundle.sandbox, {
+      defaultPath: strategy.defaultPath,
+      runtime,
+      executionRuntimeEnv
+    })
+  };
+}
+function defaultBashStrategyForBundle(bundle) {
+  return bundle.sandbox.placement === "remote" ? { kind: "remote" } : { kind: "host", preserveHostHome: true };
+}
+function createBashToolOptionsForRuntime(bundle, runtime, executionRuntimeEnv) {
+  const strategy = bundle.bash ?? defaultBashStrategyForBundle(bundle);
+  switch (strategy.kind) {
+    case "host":
+      return hostBashToolOptions(bundle, runtime, strategy);
+    case "local-sandbox":
+      return localSandboxBashToolOptions(bundle, runtime, strategy);
+    case "remote":
+      return remoteBashToolOptions(bundle, runtime, executionRuntimeEnv, strategy);
   }
 }
+
+// src/server/tools/harness/index.ts
+function bashOptionsForBundle(bundle, runtime, executionRuntimeEnv) {
+  return createBashToolOptionsForRuntime(bundle, runtime, executionRuntimeEnv);
+}
+function runtimeSecretValues(env) {
+  return Object.entries(env ?? {}).filter(([key, value]) => key !== "PATH" && /TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY/i.test(key) && value.length > 0).map(([, value]) => value);
+}
+function redactSecretsInString(text, secrets) {
+  return secrets.reduce((current, secret) => current.split(secret).join("[REDACTED]"), text);
+}
+function redactSecrets(value, secrets) {
+  if (secrets.length === 0) return value;
+  if (typeof value === "string") return redactSecretsInString(value, secrets);
+  if (Array.isArray(value)) return value.map((item) => redactSecrets(item, secrets));
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([key, child]) => [key, redactSecrets(child, secrets)])
+  );
+}
 function isRuntimeReady(readiness) {
   return readiness === void 0 || readiness === true || typeof readiness === "object" && readiness !== null && readiness.ready === true;
 }
@@ -8313,23 +8572,38 @@ function runtimeRequirementForFailure(text) {
   if (/(?:^|\n)(?:[^\n:]+:\s*)?(?:line \d+:\s*)?[A-Za-z0-9_.-]+: command not found/i.test(text)) return "runtime-dependencies";
   return void 0;
 }
-function adaptPiTool2(piTool, runtime) {
+function runtimeNotReadyFromState(requirement, readiness) {
+  return runtimeNotReadyToolResult(
+    requirement,
+    readiness && typeof readiness === "object" && readiness.ready === false ? readiness : { ready: false, state: "preparing", retryable: true }
+  );
+}
+function adaptPiTool3(bundle, runtime) {
+  const template = createBashToolDefinition(bundle.workspace.root, bashOptionsForBundle(bundle, runtime));
   return {
-    name: piTool.name,
-    description: piTool.description,
-    promptSnippet: piTool.promptSnippet,
-    parameters: piTool.parameters,
+    name: template.name,
+    description: template.description,
+    promptSnippet: template.promptSnippet,
+    parameters: template.parameters,
     readinessRequirements: ["sandbox-exec"],
     async execute(params, ctx) {
       const command = typeof params.command === "string" ? params.command : "";
       const readiness = runtime?.getReadiness?.();
       const commandRuntimeRequirement = command ? runtimeRequirementForCommand(command) : void 0;
       if (commandRuntimeRequirement && !isRuntimeReady(readiness)) {
-        return runtimeNotReadyToolResult(
-          commandRuntimeRequirement,
-          readiness && typeof readiness === "object" && readiness.ready === false ? readiness : { ready: false, state: "preparing", retryable: true }
-        );
+        return runtimeNotReadyFromState(commandRuntimeRequirement, readiness);
       }
+      const runtimeEnv = await bundle.getRuntimeEnv?.();
+      const secrets = runtimeSecretValues(runtimeEnv);
+      const executionBundle = runtimeEnv === void 0 ? bundle : {
+        ...bundle,
+        getRuntimeEnv: async () => runtimeEnv
+      };
+      const piTool = createBashToolDefinition(
+        bundle.workspace.root,
+        bashOptionsForBundle(executionBundle, runtime, runtimeEnv)
+      );
+      let emittedRedactionNotice = false;
       let result;
       try {
         result = await piTool.execute(
@@ -8338,7 +8612,14 @@ function adaptPiTool2(piTool, runtime) {
           ctx.abortSignal,
           ctx.onUpdate ? (update) => {
             const text2 = update.content.filter((c) => c.type === "text").map((c) => c.text).join("");
-            ctx.onUpdate(text2);
+            if (secrets.length === 0) {
+              ctx.onUpdate(text2);
+              return;
+            }
+            if (!emittedRedactionNotice) {
+              emittedRedactionNotice = true;
+              ctx.onUpdate("[streaming output redacted while runtime secrets are in scope]");
+            }
           } : void 0,
           {}
         );
@@ -8347,27 +8628,29 @@ function adaptPiTool2(piTool, runtime) {
         const latestReadiness2 = runtime?.getReadiness?.();
         const failureRuntimeRequirement2 = runtimeRequirementForFailure(message);
         if (command && failureRuntimeRequirement2 && !isRuntimeReady(latestReadiness2)) {
-          return runtimeNotReadyToolResult(
-            failureRuntimeRequirement2,
-            latestReadiness2 && typeof latestReadiness2 === "object" && latestReadiness2.ready === false ? latestReadiness2 : { ready: false, state: "preparing", retryable: true }
-          );
+          return runtimeNotReadyFromState(failureRuntimeRequirement2, latestReadiness2);
         }
-        throw error;
+        return {
+          content: [{ type: "text", text: redactSecretsInString(message, secrets) }],
+          isError: true,
+          details: {}
+        };
       }
-      const textContent = (result.content ?? []).filter((c) => c.type === "text").map((c) => ({ type: "text", text: c.text }));
+      if (secrets.length > 0 && result.details && typeof result.details === "object" && "fullOutputPath" in result.details && typeof result.details.fullOutputPath === "string") {
+        await unlink4(result.details.fullOutputPath).catch(() => void 0);
+        delete result.details.fullOutputPath;
+      }
+      const textContent = (result.content ?? []).filter((c) => c.type === "text").map((c) => ({ type: "text", text: redactSecretsInString(c.text, secrets) }));
       const text = textContent.map((part) => part.text).join("\n");
       const latestReadiness = runtime?.getReadiness?.();
       const failureRuntimeRequirement = runtimeRequirementForFailure(text);
       if (command && failureRuntimeRequirement && !isRuntimeReady(latestReadiness)) {
-        return runtimeNotReadyToolResult(
-          failureRuntimeRequirement,
-          latestReadiness && typeof latestReadiness === "object" && latestReadiness.ready === false ? latestReadiness : { ready: false, state: "preparing", retryable: true }
-        );
+        return runtimeNotReadyFromState(failureRuntimeRequirement, latestReadiness);
       }
       return {
         content: textContent.length > 0 ? textContent : [{ type: "text", text: "" }],
         isError: Boolean(result.isError),
-        details: result.details
+        details: redactSecrets(result.details, secrets)
       };
     }
   };
@@ -8427,7 +8710,7 @@ function createExecuteIsolatedCodeTool(sandbox) {
 }
 function buildHarnessAgentTools(bundle, runtime) {
   const tools = [
-    adaptPiTool2(createBashToolDefinition(bundle.workspace.root, bashOptionsForMode(bundle, runtime)), runtime)
+    adaptPiTool3(bundle, runtime)
   ];
   if (bundle.sandbox.capabilities.includes("isolated-code")) {
     tools.push(createExecuteIsolatedCodeTool(bundle.sandbox));
@@ -9727,7 +10010,7 @@ function gitRoutes(app, opts, done) {
   done();
 }
 
-// src/server/sandbox/vercel-sandbox/readyStatus.ts
+// src/server/runtime/readyStatus.ts
 function defaultCapabilities(sandboxReady, harnessReady) {
   return {
     chat: { state: harnessReady ? "ready" : "preparing" },
@@ -9829,6 +10112,21 @@ var ReadyStatusTracker = class {
   }
 };
 
+// src/server/runtime/modeReadiness.ts
+function createRuntimeReadyStatusTracker(modeAdapter, opts) {
+  const readiness = modeAdapter.readiness;
+  const tracker = new ReadyStatusTracker({
+    sandboxReady: readiness?.initialSandboxReady ?? true,
+    harnessReady: opts.harnessReady,
+    capabilities: {
+      ...readiness?.initialWorkspaceReadiness ? { workspace: readiness.initialWorkspaceReadiness } : {},
+      ...opts.capabilities ?? {}
+    }
+  });
+  readiness?.onTrackerCreated?.(tracker);
+  return tracker;
+}
+
 // src/server/pi-chat/piChatHistory.ts
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -11879,11 +12177,24 @@ async function createAgentApp(opts = {}) {
   const app = Fastify({ logger: opts.logger ?? true, bodyLimit: 16 * 1024 * 1024 });
   const resolvedMode = opts.runtimeModeAdapter?.id ?? opts.mode ?? autoDetectMode();
   const modeAdapter = opts.runtimeModeAdapter ?? resolveMode(resolvedMode);
-  const runtimeBundle = await modeAdapter.create({
+  let runtimeBundle = await modeAdapter.create({
     workspaceRoot,
     sessionId,
     templatePath
   });
+  if (opts.runtimeEnvContributions && opts.runtimeEnvContributions.length > 0) {
+    runtimeBundle = withRuntimeEnvContributions(runtimeBundle, {
+      workspaceId: sessionId,
+      workspaceRoot,
+      runtimeMode: resolvedMode,
+      runtimeBundle
+    }, opts.runtimeEnvContributions, opts.telemetry);
+  }
+  await opts.runtimeProvisioner?.({
+    workspaceRoot,
+    runtimeMode: resolvedMode,
+    runtimeBundle
+  });
   const pluginTools = [];
   const externalPluginsEnabled = opts.externalPlugins !== false;
   if (externalPluginsEnabled && modeAdapter.workspaceFsCapability === "strong") {
@@ -11940,13 +12251,9 @@ async function createAgentApp(opts = {}) {
   });
   harnessRef = harness;
   const sessionChangesTracker = new InMemorySessionChangesTracker();
-  const readyTracker = new ReadyStatusTracker({
-    sandboxReady: resolvedMode !== "vercel-sandbox",
+  const readyTracker = createRuntimeReadyStatusTracker(modeAdapter, {
     harnessReady: true
   });
-  if (resolvedMode === "vercel-sandbox") {
-    queueMicrotask(() => readyTracker.markSandboxReady());
-  }
   app.addHook(
     "onRequest",
     createAuthMiddleware({
@@ -11963,10 +12270,7 @@ async function createAgentApp(opts = {}) {
   await app.register(treeRoutes, { workspace: runtimeBundle.workspace });
   await app.register(searchRoutes, { fileSearch: runtimeBundle.fileSearch });
   await app.register(gitRoutes, {
-    getWorkspaceRoot: () => {
-      if (runtimeBundle.sandbox.provider === "remote-worker") return void 0;
-      return getRuntimeBundleStorageRoot(runtimeBundle);
-    }
+    getWorkspaceRoot: () => getOptionalRuntimeBundleStorageRoot(runtimeBundle)
   });
   const piChatService = new HarnessPiChatService({
     harness,
@@ -12148,8 +12452,8 @@ function buildUploadAgentTools(bundle) {
           const contentType = contentTypeFromExt(filePath);
           const ext = extForUpload2(filePath, contentType);
           const base = basenameForUpload2(filePath);
-          const unique = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
-          const destPath = `${dir}/${base}-${unique}.${ext}`;
+          const unique2 = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+          const destPath = `${dir}/${base}-${unique2}.${ext}`;
           await workspace.mkdir(dir, { recursive: true });
           if (workspace.writeBinaryFile) {
             await workspace.writeBinaryFile(destPath, bytes);
@@ -12179,7 +12483,6 @@ function buildUploadAgentTools(bundle) {
 var DEFAULT_VERSION2 = "0.1.0-dev";
 var DEFAULT_WORKSPACE_ID3 = "default";
 var STANDARD_AGENT_TOOL_NAMES = ["bash", "read", "write", "edit", "find", "grep", "ls"];
-var VERCEL_BINDING_HEALTHCHECK_INTERVAL_MS = 15e3;
 function pluginNameFromPath(path4) {
   const fileName = basename3(path4);
   if (fileName.endsWith(".mjs")) return fileName.slice(0, -4);
@@ -12198,15 +12501,6 @@ function getAvailableModelProviders() {
     new Set(availableModels.map((model) => model.provider))
   ).sort((a, b) => a.localeCompare(b));
 }
-function selectRuntimeModeAdapter(mode, sandboxHandleStore) {
-  if (mode === "vercel-sandbox" && sandboxHandleStore) {
-    return createVercelSandboxModeAdapter({
-      store: sandboxHandleStore,
-      orphanGuardMaxIdleMs: null
-    });
-  }
-  return resolveMode(mode);
-}
 function getRequestWorkspaceId(request) {
   return request.workspaceContext?.workspaceId ?? DEFAULT_WORKSPACE_ID3;
 }
@@ -12226,27 +12520,11 @@ function isWorkspaceAgnosticAgentRequest(request, options) {
   if (pathname === "/api/v1/ready-status") return !options?.readyStatusWorkspaceScoped;
   return pathname === "/health" || pathname === "/ready" || pathname === "/api/v1/agent/models";
 }
-function extractHttpStatus2(error) {
-  const statusCode = error?.statusCode;
-  if (typeof statusCode === "number") return statusCode;
-  const status = error?.status;
-  if (typeof status === "number") return status;
-  const responseStatus = error?.response?.status;
-  return typeof responseStatus === "number" ? responseStatus : null;
-}
 function normalizeSessionNamespace(value) {
   if (typeof value !== "string") return void 0;
   const trimmed = value.trim();
   return trimmed.length > 0 ? trimmed : void 0;
 }
-function isExpiredSandboxRuntimeError(error) {
-  const code = error?.code;
-  if (code === ErrorCode.enum.SANDBOX_EXPIRED) return true;
-  const status = extractHttpStatus2(error);
-  if (status === 404 || status === 410) return true;
-  const message = error instanceof Error ? error.message : String(error);
-  return /status code (404|410) is not ok/i.test(message);
-}
 function createHttpError(code, message, details = {}) {
   const error = new Error(message);
   error.code = code;
@@ -12301,7 +12579,7 @@ var registerAgentRoutes = async (app, opts) => {
   const sessionId = opts.sessionId ?? DEFAULT_WORKSPACE_ID3;
   const templatePath = opts.templatePath ?? getEnv("BORING_AGENT_TEMPLATE_PATH");
   const resolvedMode = opts.runtimeModeAdapter?.id ?? opts.mode ?? autoDetectMode();
-  const modeAdapter = opts.runtimeModeAdapter ?? selectRuntimeModeAdapter(resolvedMode, opts.sandboxHandleStore);
+  const modeAdapter = opts.runtimeModeAdapter ?? resolveMode(resolvedMode, { sandboxHandleStore: opts.sandboxHandleStore });
   app.addHook("onClose", async () => {
     await modeAdapter.dispose?.();
   });
@@ -12373,9 +12651,7 @@ var registerAgentRoutes = async (app, opts) => {
       requestId: request?.id,
       telemetry: opts.telemetry
     };
-    const runtimeLayout = getBoringAgentRuntimePaths(
-      resolvedMode === "vercel-sandbox" ? VERCEL_SANDBOX_WORKSPACE_ROOT : scope.root
-    );
+    const runtimeLayout = getBoringAgentRuntimePaths(modeAdapter.getRuntimeLayoutRoot?.(modeCtx) ?? scope.root);
     return await opts.provisionRuntime({
       workspaceId,
       workspaceRoot: scope.root,
@@ -12403,19 +12679,22 @@ var registerAgentRoutes = async (app, opts) => {
       retryable: true
     } : { state: "ready" };
     let provisioningGeneration = 0;
-    const runtimeBundle = await modeAdapter.create(modeCtx);
-    const readyTracker = new ReadyStatusTracker({
-      sandboxReady: resolvedMode !== "vercel-sandbox",
+    let runtimeBundle = await modeAdapter.create(modeCtx);
+    if (opts.runtimeEnvContributions && opts.runtimeEnvContributions.length > 0) {
+      runtimeBundle = withRuntimeEnvContributions(runtimeBundle, {
+        workspaceId,
+        workspaceRoot: root,
+        runtimeMode: resolvedMode,
+        runtimeBundle
+      }, opts.runtimeEnvContributions, opts.telemetry);
+    }
+    const readyTracker = createRuntimeReadyStatusTracker(modeAdapter, {
       harnessReady: false,
       capabilities: {
         chat: { state: "preparing" },
-        workspace: { state: resolvedMode !== "vercel-sandbox" ? "ready" : "preparing" },
         runtimeDependencies
       }
     });
-    if (resolvedMode === "vercel-sandbox") {
-      queueMicrotask(() => readyTracker.markSandboxReady());
-    }
     let binding;
     const updateRuntimeDependencies = (next) => {
       runtimeDependencies = next;
@@ -12633,7 +12912,7 @@ var registerAgentRoutes = async (app, opts) => {
   }
   async function recreateRuntimeBinding(workspaceId, scope) {
     runtimeBindings.delete(scope.key);
-    evictSandboxHandleCacheForWorkspace(workspaceId);
+    modeAdapter.evictCachedRuntime?.({ workspaceId });
     const created = createRuntimeBindingEntry(workspaceId, scope);
     runtimeBindings.set(scope.key, created);
     evictRuntimeBindings();
@@ -12647,23 +12926,23 @@ var registerAgentRoutes = async (app, opts) => {
     }
   }
   async function ensureRuntimeBindingReady(workspaceId, scope, binding) {
-    if (resolvedMode !== "vercel-sandbox") return binding;
+    const healthCheck = modeAdapter.cachedBindingHealthCheck;
+    if (!healthCheck) return binding;
     const now = Date.now();
-    if (binding.lastHealthCheckMs !== void 0 && now - binding.lastHealthCheckMs < VERCEL_BINDING_HEALTHCHECK_INTERVAL_MS) {
+    const intervalMs = healthCheck.intervalMs ?? 15e3;
+    if (binding.lastHealthCheckMs !== void 0 && now - binding.lastHealthCheckMs < intervalMs) {
       return binding;
     }
-    try {
-      await binding.runtimeBundle.workspace.stat(".");
+    const result = await healthCheck.check({ runtimeBundle: binding.runtimeBundle, workspaceId });
+    if (result.state === "ok") {
       binding.lastHealthCheckMs = now;
       return binding;
-    } catch (error) {
-      if (!isExpiredSandboxRuntimeError(error)) throw error;
-      app.log.warn({
-        err: error,
-        workspaceId
-      }, "[sandbox] cached runtime expired; recreating from persisted handle");
-      return await recreateRuntimeBinding(workspaceId, scope);
     }
+    app.log.warn({
+      err: result.error,
+      workspaceId
+    }, result.message ?? "[runtime] cached runtime invalid; recreating");
+    return await recreateRuntimeBinding(workspaceId, scope);
   }
   const hasRuntimeProvisioningInput = opts.provisionWorkspace !== false && Boolean(opts.provisionRuntime);
   const staticBinding = requestScopedRuntime ? null : await getOrCreateRuntimeBinding(sessionId);
@@ -12761,11 +13040,7 @@ var registerAgentRoutes = async (app, opts) => {
     getFileSearch: async (request) => (await getBindingForRequest(request)).runtimeBundle.fileSearch
   });
   await app.register(gitRoutes, {
-    getWorkspaceRoot: async (request) => {
-      const bundle = (await getBindingForRequest(request)).runtimeBundle;
-      if (bundle.sandbox.provider === "remote-worker") return void 0;
-      return getRuntimeBundleStorageRoot(bundle);
-    }
+    getWorkspaceRoot: async (request) => getOptionalRuntimeBundleStorageRoot((await getBindingForRequest(request)).runtimeBundle)
   });
   await app.register(piChatRoutes, {
     getService: async (request) => {