@hachej/boring-agent 0.1.80 → 0.1.82

package/dist/{chunk-URRIDA6O.js → chunk-7V3E6KHX.js}

@@ -3,16 +3,18 @@ import {
   AgentDeploymentValidationError,
   OpaqueRefSchema,
   Sha256DigestSchema,
+  canonicalStringify,
   createAgentAssetDigest,
   createAgentDefinitionDigest,
   createAgentDeploymentDigest,
+  sha256Bytes,
   validateAgentDefinition,
   validateAgentDeployment,
   validateTool
-} from "./chunk-CUF7ELFO.js";
+} from "./chunk-WODTQBXR.js";
 import {
   createAgentRuntimeBridge
-} from "./chunk-BNZIE26N.js";
+} from "./chunk-TNN3LPXE.js";
 import {
   sessionStreamPath
 } from "./chunk-WSQ5QNIY.js";
@@ -27,7 +29,7 @@ import {
   StopReceiptSchema,
   extractToolUiMetadata,
   sanitizeToolUiMetadata2 as sanitizeToolUiMetadata
-} from "./chunk-UJQXCOHR.js";
+} from "./chunk-DC3S7SZG.js";
 import {
   createLogger,
   createPiCodingAgentHarness,
@@ -38,7 +40,7 @@ import {
   registerConfiguredModelProviders,
   setEnvDefault,
   withPiHarnessDefaults
-} from "./chunk-N4ES6PVX.js";
+} from "./chunk-5NAN3TAR.js";
 import {
   safeCapture
 } from "./chunk-AQBXNPMD.js";
@@ -46,7 +48,7 @@ import {
   AgentDefinitionErrorCode,
   AgentDeploymentErrorCode,
   ErrorCode
-} from "./chunk-CCNXYCD5.js";
+} from "./chunk-PG2WOJ22.js";
 
 // src/server/sandbox/direct/createDirectSandbox.ts
 import { spawn } from "child_process";
@@ -186,7 +188,7 @@ function createDirectSandbox(opts = {}) {
       const maxOutputBytes = opts2?.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
       const workspaceRoot = runtimeContext.runtimeCwd;
       const cwd = opts2?.cwd ?? workspaceRoot;
-      return await new Promise((resolve12, reject) => {
+      return await new Promise((resolve13, reject) => {
         const child = spawn(cmd, {
           cwd,
           env: withWorkspacePythonEnv({ workspaceRoot, env: opts2?.env, preserveHostHome: true }),
@@ -215,7 +217,7 @@ function createDirectSandbox(opts = {}) {
           if (settled) return;
           settled = true;
           cleanup();
-          resolve12({
+          resolve13({
             stdout: new Uint8Array(Buffer.concat(stdoutChunks)),
             stderr: new Uint8Array(Buffer.concat(stderrChunks)),
             exitCode: typeof exitCode === "number" ? exitCode : timedOut ? 124 : 1,
@@ -564,9 +566,9 @@ function createNodeWatcher(root) {
       }
       startFsw();
       if (fsw) {
-        await new Promise((resolve12) => {
-          fsw.once("ready", resolve12);
-          fsw.once("error", () => resolve12());
+        await new Promise((resolve13) => {
+          fsw.once("ready", resolve13);
+          fsw.once("error", () => resolve13());
         });
       }
       if (closed) return { ok: false, reason: "closed" };
@@ -975,7 +977,7 @@ function createBwrapSandbox(opts = {}) {
         ...withSandboxCwd(baseArgs, sandboxCwd),
         ...buildCommandArgs(cmd, sandboxOptions.resourceLimits)
       ];
-      return await new Promise((resolve12, reject) => {
+      return await new Promise((resolve13, reject) => {
         const child = spawn2("bwrap", args, {
           env: {
             ...withWorkspacePythonEnv({ workspaceRoot, env: opts2?.env, sandboxRoot: SANDBOX_HOME2 }),
@@ -1005,7 +1007,7 @@ function createBwrapSandbox(opts = {}) {
           if (settled) return;
           settled = true;
           cleanup();
-          resolve12({
+          resolve13({
             stdout: new Uint8Array(Buffer.concat(stdoutChunks)),
             stderr: new Uint8Array(Buffer.concat(stderrChunks)),
             exitCode: typeof exitCode === "number" ? exitCode : timedOut ? 124 : 1,
@@ -2295,7 +2297,8 @@ function createRemoteWorkerModeAdapter(opts = {}) {
 }
 
 // src/server/http/routes/file.ts
-import { dirname as dirname5, extname as extname2, relative as relative4 } from "path/posix";
+import { dirname as dirname5, extname as extname2, relative as relative5 } from "path/posix";
+import { getAgentDir } from "@mariozechner/pi-coding-agent";
 
 // src/server/http/middleware.ts
 var ERROR_CODE_AUTH_REQUIRED = "auth_required";
@@ -2568,13 +2571,33 @@ function buildFileRecordsResult(args) {
 
 // src/server/http/readonlySkillFiles.ts
 import { readFile as readFile4, stat as stat4 } from "fs/promises";
+import { isAbsolute as isAbsolute4, relative as relative4, resolve as resolve5 } from "path";
 function isReadonlySkillFilePath(path4) {
   if (!path4.startsWith("/")) return false;
   if (path4.includes("\0")) return false;
   if (!path4.endsWith("/SKILL.md")) return false;
+  if (path4.split("/").some((segment) => segment === "..")) return false;
   return path4.includes("/.pi/agent/") && path4.includes("/skills/");
 }
-async function readReadonlySkillFile(path4) {
+function isLexicallyInside(root, resolvedPath) {
+  if (!root) return false;
+  const rel = relative4(resolve5(root), resolvedPath);
+  return !rel.startsWith("..") && !isAbsolute4(rel);
+}
+async function assertReadonlySkillFileConfined(path4, allowedRoots) {
+  const resolved = resolve5(path4);
+  const lexicalRoot = allowedRoots.find((root) => isLexicallyInside(root, resolved));
+  if (!lexicalRoot) {
+    throw Object.assign(new Error("read-only skill file escapes allowed roots"), {
+      statusCode: 403,
+      reason: "path-escape",
+      requestedPath: path4
+    });
+  }
+  await assertRealPathWithinWorkspace(lexicalRoot, resolved);
+}
+async function readReadonlySkillFile(path4, allowedRoots) {
+  await assertReadonlySkillFileConfined(path4, allowedRoots);
   const [content, fsStat] = await Promise.all([
     readFile4(path4, "utf-8"),
     stat4(path4)
@@ -2588,7 +2611,8 @@ async function readReadonlySkillFile(path4) {
     }
   };
 }
-async function statReadonlySkillFile(path4) {
+async function statReadonlySkillFile(path4, allowedRoots) {
+  await assertReadonlySkillFileConfined(path4, allowedRoots);
   const fsStat = await stat4(path4);
   return {
     kind: fsStat.isDirectory() ? "directory" : "file",
@@ -2681,6 +2705,9 @@ function classifyError(err, reply, subject) {
 function requestedFilesystem(value) {
   return typeof value === "string" && value.length > 0 ? value : USER_FILESYSTEM_ID;
 }
+function readonlySkillRoots(workspace) {
+  return [workspace.root, getAgentDir()];
+}
 function sendNotFoundOrDenied(reply) {
   return reply.code(404).send({
     error: { code: ERROR_CODE_NOT_FOUND_OR_DENIED, message: "not found or denied" }
@@ -2752,7 +2779,7 @@ function basenameForUpload(filename) {
 function markdownUrlFor(sourcePath, assetPath) {
   if (!sourcePath) return assetPath;
   const fromDir = dirname5(sourcePath.replace(/\\/g, "/"));
-  const rel = relative4(fromDir === "." ? "" : fromDir, assetPath);
+  const rel = relative5(fromDir === "." ? "" : fromDir, assetPath);
   return rel && !rel.startsWith(".") ? rel : rel || assetPath;
 }
 function contentTypeForPath(path4) {
@@ -2905,8 +2932,9 @@ function fileRoutes(app, opts, done) {
       }
     }
     try {
+      const workspace = await resolveWorkspace(request);
       if (isReadonlySkillFilePath(path4)) {
-        const { content: content2, stat: stat14 } = await readReadonlySkillFile(path4);
+        const { content: content2, stat: stat14 } = await readReadonlySkillFile(path4, readonlySkillRoots(workspace));
         if (stat14.kind !== "file") {
           return reply.code(400).send({
             error: { code: ERROR_CODE_VALIDATION_ERROR, message: "path is not a file", field: "path" }
@@ -2914,7 +2942,6 @@ function fileRoutes(app, opts, done) {
         }
         return { content: content2, mtimeMs: stat14.mtimeMs };
       }
-      const workspace = await resolveWorkspace(request);
       if (workspace.readFileWithStat) {
         const { content: content2, stat: stat14 } = await workspace.readFileWithStat(path4);
         return { content: content2, mtimeMs: stat14.kind === "file" ? stat14.mtimeMs : void 0, access: "readwrite" };
@@ -3184,10 +3211,10 @@ function fileRoutes(app, opts, done) {
       }
     }
     try {
+      const workspace = await resolveWorkspace(request);
       if (isReadonlySkillFilePath(path4)) {
-        return await statReadonlySkillFile(path4);
+        return await statReadonlySkillFile(path4, readonlySkillRoots(workspace));
       }
-      const workspace = await resolveWorkspace(request);
       const stat13 = await workspace.stat(path4);
       return stat13;
     } catch (err) {
@@ -3201,7 +3228,7 @@ function fileRoutes(app, opts, done) {
 import { createHash as createHash3 } from "crypto";
 import { constants as constants2 } from "fs";
 import { access as access2, chmod as chmod3, cp, mkdir as mkdir4, readdir as readdir3, readFile as readFile5, realpath as realpath2, stat as stat5, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname6, isAbsolute as isAbsolute4, join as join4, relative as relative5, resolve as resolve5 } from "path";
+import { dirname as dirname6, isAbsolute as isAbsolute5, join as join4, relative as relative6, resolve as resolve6 } from "path";
 import { fileURLToPath } from "url";
 import { execFile } from "child_process";
 import { promisify } from "util";
@@ -3310,10 +3337,10 @@ function resolveTemplateTarget(workspaceRoot, target) {
   if (rawTarget.length === 0 || rawTarget.includes("\0") || rawTarget.includes("\\") || rawTarget.startsWith("/") || rawTarget.startsWith("//") || /^[A-Za-z]:[\\/]/.test(rawTarget) || rawTarget.split("/").includes("..")) {
     throw new Error(`Unsafe runtime template target: ${JSON.stringify(rawTarget)}. Template targets must be relative paths inside the workspace.`);
   }
-  const root = resolve5(workspaceRoot);
-  const resolved = resolve5(root, rawTarget);
-  const rel = relative5(root, resolved);
-  if (rel.startsWith("..") || isAbsolute4(rel)) {
+  const root = resolve6(workspaceRoot);
+  const resolved = resolve6(root, rawTarget);
+  const rel = relative6(root, resolved);
+  if (rel.startsWith("..") || isAbsolute5(rel)) {
     throw new Error(`Unsafe runtime template target: ${JSON.stringify(rawTarget)} resolves outside the workspace.`);
   }
   return resolved;
@@ -3338,7 +3365,7 @@ function nodePackageTarget(workspaceRoot, packageName) {
 }
 async function copyIfExists(source, target) {
   if (!await exists(source)) return false;
-  if (resolve5(source) === resolve5(target)) return true;
+  if (resolve6(source) === resolve6(target)) return true;
   if (await exists(target) && await realpath2(source) === await realpath2(target)) return true;
   await cp(source, target, {
     recursive: true,
@@ -3899,7 +3926,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
 // src/server/workspace/provisioning/packArtifact.ts
 import { execFile as execFile2 } from "child_process";
 import { mkdir as mkdir5, mkdtemp, rename as rename4 } from "fs/promises";
-import { dirname as dirname7, isAbsolute as isAbsolute5, join as join5 } from "path";
+import { dirname as dirname7, isAbsolute as isAbsolute6, join as join5 } from "path";
 import { tmpdir } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { promisify as promisify2 } from "util";
@@ -3944,7 +3971,7 @@ async function packProvisioningArtifact(request) {
     ], { maxBuffer: 1024 * 1024 * 20 });
     const packedName = stdout.trim().split(/\r?\n/).filter(Boolean).at(-1);
     if (!packedName) throw new Error(`pnpm pack produced no artifact for ${sourcePath}`);
-    const packedPath = isAbsolute5(packedName) ? packedName : join5(dirname7(request.outputPath), packedName);
+    const packedPath = isAbsolute6(packedName) ? packedName : join5(dirname7(request.outputPath), packedName);
     await rename4(packedPath, request.outputPath);
     return;
   }
@@ -4074,7 +4101,7 @@ function createPythonRuntimeFingerprint(input) {
 }
 
 // src/server/workspace/provisioning/node.ts
-import { join as join6, relative as relative6, sep as sep3 } from "path";
+import { join as join6, relative as relative7, sep as sep3 } from "path";
 var NODE_RUNTIME_REL = ".boring-agent/node";
 var NODE_PACKAGE_JSON_REL = `${NODE_RUNTIME_REL}/package.json`;
 var NODE_FINGERPRINT_REL = `${NODE_RUNTIME_REL}/.fingerprint`;
@@ -4119,7 +4146,7 @@ function expectedNodeOutputs(paths, packages) {
   ];
 }
 function toWorkspaceRel(paths, absolutePath) {
-  return relative6(paths.workspaceRoot, absolutePath).split(sep3).join("/");
+  return relative7(paths.workspaceRoot, absolutePath).split(sep3).join("/");
 }
 async function shouldInstallNodeRuntime(options) {
   const currentFingerprint = (await options.adapter.workspaceFs.readText(NODE_FINGERPRINT_REL))?.trim();
@@ -4205,7 +4232,7 @@ async function ensureNodeRuntime(options) {
 }
 
 // src/server/workspace/provisioning/python.ts
-import { dirname as dirname9, join as join7, relative as relative7, sep as sep4 } from "path";
+import { dirname as dirname9, join as join7, relative as relative8, sep as sep4 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var VENV_REL = ".boring-agent/venv";
 var VENV_FINGERPRINT_REL = `${VENV_REL}/.fingerprint`;
@@ -4298,7 +4325,7 @@ function collectPythonEnv(packages) {
   return env;
 }
 function toWorkspaceRel2(paths, absolutePath) {
-  return relative7(paths.workspaceRoot, absolutePath).split(sep4).join("/");
+  return relative8(paths.workspaceRoot, absolutePath).split(sep4).join("/");
 }
 async function shouldInstallPythonRuntime(options) {
   const currentFingerprint = (await options.adapter.workspaceFs.readText(VENV_FINGERPRINT_REL))?.trim();
@@ -4764,7 +4791,7 @@ async function copyTemplate(templatePath, workspaceRoot) {
 // src/server/runtime/modes/provisioningAdapter.ts
 import { spawn as spawn3 } from "child_process";
 import { cp as cp3, lstat as lstat3, mkdir as mkdir7, readFile as readFile7, realpath as realpath3, rm as rm3, stat as stat8, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname10, isAbsolute as isAbsolute6, relative as relative8, resolve as resolve6, sep as sep5 } from "path";
+import { dirname as dirname10, isAbsolute as isAbsolute7, relative as relative9, resolve as resolve7, sep as sep5 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 var LOCAL_SANDBOX_WORKSPACE_ROOT = "/workspace";
 function sourceToPath4(source) {
@@ -4852,8 +4879,8 @@ function defaultExecOptions(paths, opts) {
   };
 }
 function mapWorkspacePathToLocalSandbox(paths, value) {
-  const absolute = isAbsolute6(value) ? value : resolve6(paths.workspaceRoot, value);
-  const relPath = relative8(paths.workspaceRoot, absolute);
+  const absolute = isAbsolute7(value) ? value : resolve7(paths.workspaceRoot, value);
+  const relPath = relative9(paths.workspaceRoot, absolute);
   if (relPath === "") return LOCAL_SANDBOX_WORKSPACE_ROOT;
   if (relPath === ".." || relPath.startsWith(`..${sep5}`)) return value;
   return `${LOCAL_SANDBOX_WORKSPACE_ROOT}/${relPath.split(sep5).join("/")}`;
@@ -4957,9 +4984,9 @@ function createLocalProvisioningAdapter(paths, runner = spawnCommand) {
       const hostPath = sourceToPath4(source);
       const realWorkspaceRoot = await realpath3(paths.workspaceRoot);
       const realSource = await realpath3(hostPath);
-      const relPath = relative8(realWorkspaceRoot, realSource);
+      const relPath = relative9(realWorkspaceRoot, realSource);
       if (relPath === "") return LOCAL_SANDBOX_WORKSPACE_ROOT;
-      if (!relPath.startsWith("..") && !isAbsolute6(relPath)) {
+      if (!relPath.startsWith("..") && !isAbsolute7(relPath)) {
         return `${LOCAL_SANDBOX_WORKSPACE_ROOT}/${relPath.split(sep5).join("/")}`;
       }
       return await resolveArtifactInstallSource({
@@ -5248,11 +5275,11 @@ async function buildTarGz(files) {
   }
   chunks.push(Buffer.alloc(1024));
   const tarBuffer = Buffer.concat(chunks);
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     const gzip = createGzip({ level: 6 });
     const gzChunks = [];
     gzip.on("data", (chunk) => gzChunks.push(chunk));
-    gzip.on("end", () => resolve12(Buffer.concat(gzChunks)));
+    gzip.on("end", () => resolve13(Buffer.concat(gzChunks)));
     gzip.on("error", reject);
     Readable.from(tarBuffer).pipe(gzip);
   });
@@ -7612,11 +7639,11 @@ function bindingDisposedError() {
   });
 }
 function deferred() {
-  let resolve12;
+  let resolve13;
   const promise = new Promise((nextResolve) => {
-    resolve12 = () => nextResolve();
+    resolve13 = () => nextResolve();
   });
-  return { promise, resolve: resolve12 };
+  return { promise, resolve: resolve13 };
 }
 
 // src/server/pi-chat/harnessPiChatService.ts
@@ -8290,13 +8317,13 @@ function promptCancelledError() {
   });
 }
 function deferred2() {
-  let resolve12;
+  let resolve13;
   let reject;
   const promise = new Promise((nextResolve, nextReject) => {
-    resolve12 = nextResolve;
+    resolve13 = nextResolve;
     reject = nextReject;
   });
-  return { promise, resolve: resolve12, reject };
+  return { promise, resolve: resolve13, reject };
 }
 function rejectedReasons(results) {
   return results.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
@@ -8457,7 +8484,7 @@ function createAgentRuntimeBridge2(config, options = {}) {
   });
 }
 async function createRuntime(config, options) {
-  const harnessFactory = config.harnessFactory ?? (await import("./createHarness-EEA63XRC.js")).createPiCodingAgentHarness;
+  const harnessFactory = config.harnessFactory ?? (await import("./createHarness-TGBJZISM.js")).createPiCodingAgentHarness;
   const harnessInput = {
     tools: config.tools ?? [],
     cwd: config.workdir ?? DEFAULT_WORKDIR,
@@ -8497,7 +8524,7 @@ function stableAgentError(code, message) {
 // src/server/agentDefinition/compileAgentDirectory.ts
 import { constants as constants4 } from "fs";
 import { open as open2, realpath as realpath4, stat as stat10 } from "fs/promises";
-import { isAbsolute as isAbsolute7, relative as relative9, resolve as resolve7, sep as sep6 } from "path";
+import { isAbsolute as isAbsolute8, relative as relative10, resolve as resolve8, sep as sep6 } from "path";
 var AGENT_MANIFEST = "agent.json";
 var AGENT_INSTRUCTIONS = "instructions.md";
 var AgentDirectoryCompilerError = class extends Error {
@@ -8516,8 +8543,8 @@ function isNotFound(error) {
   return error?.code === "ENOENT";
 }
 function isInsideRoot(root, target) {
-  const pathFromRoot = relative9(root, target);
-  return pathFromRoot === "" || pathFromRoot !== ".." && !pathFromRoot.startsWith(`..${sep6}`) && !isAbsolute7(pathFromRoot);
+  const pathFromRoot = relative10(root, target);
+  return pathFromRoot === "" || pathFromRoot !== ".." && !pathFromRoot.startsWith(`..${sep6}`) && !isAbsolute8(pathFromRoot);
 }
 async function resolveAgentRoot(directory) {
   if (typeof directory !== "string" || directory.length === 0) {
@@ -8530,7 +8557,7 @@ async function resolveAgentRoot(directory) {
   }
   let root;
   try {
-    root = await realpath4(resolve7(directory));
+    root = await realpath4(resolve8(directory));
   } catch (error) {
     throw new AgentDirectoryCompilerError({
       code: isNotFound(error) ? ErrorCode.enum.PATH_NOT_FOUND : ErrorCode.enum.CONFIG_INVALID,
@@ -8567,7 +8594,7 @@ async function readContainedFile({
   field,
   kind
 }) {
-  const candidate = resolve7(root, path4);
+  const candidate = resolve8(root, path4);
   if (!isInsideRoot(root, candidate)) {
     throw new AgentDirectoryCompilerError({
       code: ErrorCode.enum.PATH_SYMLINK_ESCAPE,
@@ -8717,6 +8744,22 @@ var AuthorizedAgentDeploymentBindingSchema = z.object({
   workspaceCompositionDigest: Sha256DigestSchema
 });
 var RESOLVED_AGENT_DIGEST_DOMAIN = "boring-agent/resolved-agent:v1";
+var ResolvedAgentDigestInputSchema = z.object({
+  workspaceId: OpaqueRefSchema,
+  defaultDeploymentId: OpaqueRefSchema,
+  workspaceCompositionDigest: Sha256DigestSchema,
+  definitionDigest: Sha256DigestSchema,
+  deploymentDigest: Sha256DigestSchema
+}).strict();
+async function createResolvedAgentDigest(input) {
+  const parsed = ResolvedAgentDigestInputSchema.safeParse(input);
+  if (!parsed.success) {
+    const field = parsed.error.issues[0]?.path[0];
+    const digestField = typeof field === "string" ? field : "workspaceId";
+    throw invalidDeployment(digestField, `${digestField} is invalid`);
+  }
+  return createAgentAssetDigest(canonicalStringify({ domain: RESOLVED_AGENT_DIGEST_DOMAIN, ...parsed.data }));
+}
 function invalidDefinition(field, message) {
   return new AgentDefinitionValidationError({
     code: AgentDefinitionErrorCode.enum.AGENT_DEFINITION_INVALID,
@@ -8791,14 +8834,13 @@ async function resolveAgentDeployment(bundle, deployment, authorizedBinding) {
       "instructionsRef must name an included verified asset"
     );
   }
-  const resolvedDigest = await createAgentAssetDigest(JSON.stringify({
-    domain: RESOLVED_AGENT_DIGEST_DOMAIN,
+  const resolvedDigest = await createResolvedAgentDigest({
     workspaceId: binding.workspaceId,
     defaultDeploymentId: binding.defaultDeploymentId,
     workspaceCompositionDigest: binding.workspaceCompositionDigest,
     definitionDigest,
     deploymentDigest
-  }));
+  });
   const workspace = Object.freeze({
     workspaceId: binding.workspaceId,
     defaultDeploymentId: binding.defaultDeploymentId,
@@ -8830,7 +8872,7 @@ async function resolveAgentDeployment(bundle, deployment, authorizedBinding) {
 }
 
 // src/server/mcp/managedAgentDelegate.ts
-import { createHash as createHash6, randomUUID } from "crypto";
+import { randomUUID } from "crypto";
 var MANAGED_AGENT_MCP_ORIGIN_SURFACE = "mcp-managed-agent";
 var MANAGED_AGENT_MCP_DELIVERY_RULE = "M1 DELIVERY v0: delegate_task returns bounded final assistant text and at most one complete authorized inline Markdown artifact; no artifact paths, truncation, or share-link delivery.";
 var MAX_FINAL_ASSISTANT_TEXT_BYTES = 96 * 1024;
@@ -9326,7 +9368,7 @@ async function resolveMarkdownArtifact(candidate, workspace) {
   validateMarkdownContent(content);
   const artifact = {
     content,
-    sha256: sha256(bytes),
+    sha256: await sha256Bytes(bytes),
     byteSize,
     mediaType: MARKDOWN_MEDIA_TYPE,
     ...candidate.title ? { title: candidate.title } : {}
@@ -9419,9 +9461,6 @@ function validateMarkdownContent(content) {
 function sameStat(left, right) {
   return left.kind === right.kind && left.size === right.size && left.mtimeMs === right.mtimeMs;
 }
-function sha256(bytes) {
-  return `sha256:${createHash6("sha256").update(bytes).digest("hex")}`;
-}
 function safeDecodeArtifactPath(path4) {
   try {
     return decodeURIComponent(path4);
@@ -9586,13 +9625,13 @@ function resultTool(result) {
   };
 }
 function deferred3() {
-  let resolve12;
+  let resolve13;
   let reject;
   const promise = new Promise((res, rej) => {
-    resolve12 = res;
+    resolve13 = res;
     reject = rej;
   });
-  return { promise, resolve: resolve12, reject };
+  return { promise, resolve: resolve13, reject };
 }
 function errorTool(error) {
   const safe = safeError(error);
@@ -9659,7 +9698,7 @@ function withRuntimeEnvContributions(runtimeBundle, baseContext, contributions,
 
 // src/server/harness/pi-coding-agent/pluginLoader.ts
 import { readdir as readdir7, stat as stat11, readFile as readFile10 } from "fs/promises";
-import { join as join10, extname as extname3, resolve as resolve8, sep as sep7, relative as relative10 } from "path";
+import { join as join10, extname as extname3, resolve as resolve9, sep as sep7, relative as relative11 } from "path";
 import { homedir as homedir3 } from "os";
 import { pathToFileURL as pathToFileURL2 } from "url";
 var VALID_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".mjs"]);
@@ -9729,12 +9768,12 @@ async function loadNpmPlugin(pkgDir, importFn) {
   if (!await fileExists(pkgJsonPath)) return [];
   const pkgJson = JSON.parse(await readFile10(pkgJsonPath, "utf-8"));
   const main = pkgJson.main ?? "index.js";
-  const resolvedMain = resolve8(pkgDir, main);
-  const resolvedPkgDir = resolve8(pkgDir);
+  const resolvedMain = resolve9(pkgDir, main);
+  const resolvedPkgDir = resolve9(pkgDir);
   if (resolvedMain !== resolvedPkgDir && !resolvedMain.startsWith(resolvedPkgDir + sep7)) {
     return [];
   }
-  const relPath = relative10(resolvedPkgDir, resolvedMain);
+  const relPath = relative11(resolvedPkgDir, resolvedMain);
   if (relPath.startsWith("..")) {
     return [];
   }
@@ -9819,7 +9858,7 @@ import {
 // src/server/tools/operations/bound.ts
 import { constants as constants5 } from "fs";
 import { access as access4, lstat as lstat4, mkdir as mkdir11, readFile as readFile11, readdir as readdir8, readlink, realpath as realpath5, stat as stat12, writeFile as writeFile6 } from "fs/promises";
-import { dirname as dirname11, isAbsolute as isAbsolute8, join as join11, relative as relative11, resolve as resolve9 } from "path";
+import { dirname as dirname11, isAbsolute as isAbsolute9, join as join11, relative as relative12, resolve as resolve10 } from "path";
 function toPosixPath(value) {
   return value.split("\\").join("/");
 }
@@ -9875,8 +9914,8 @@ async function walkMatches(root, current, pattern, ignore, limit, out) {
   const entries = await readdir8(current, { withFileTypes: true });
   for (const entry of entries) {
     if (out.length >= limit) return;
-    const absolutePath = resolve9(current, entry.name);
-    const relativePath = toPosixPath(relative11(root, absolutePath));
+    const absolutePath = resolve10(current, entry.name);
+    const relativePath = toPosixPath(relative12(root, absolutePath));
     if (entry.isDirectory() && shouldSkipDir(relativePath, ignore)) continue;
     if (matchesGlob(relativePath, pattern)) {
       out.push(absolutePath);
@@ -9900,16 +9939,16 @@ async function findNearestExistingAncestor(absPath) {
   }
 }
 async function assertWithinWorkspace(workspaceRoot, absPath) {
-  const realRoot = await realpath5(resolve9(workspaceRoot));
+  const realRoot = await realpath5(resolve10(workspaceRoot));
   try {
     const s = await lstat4(absPath);
     if (s.isSymbolicLink()) {
       const target = await readlink(absPath);
-      const resolvedTarget = resolve9(dirname11(absPath), target);
+      const resolvedTarget = resolve10(dirname11(absPath), target);
       const nearestAncestor = await findNearestExistingAncestor(resolvedTarget);
       const realAncestor = await realpath5(nearestAncestor);
-      const rel2 = relative11(realRoot, realAncestor);
-      if (rel2.startsWith("..") || isAbsolute8(rel2)) {
+      const rel2 = relative12(realRoot, realAncestor);
+      if (rel2.startsWith("..") || isAbsolute9(rel2)) {
         throw new Error(`path "${absPath}" is outside workspace`);
       }
       return;
@@ -9929,16 +9968,16 @@ async function assertWithinWorkspace(workspaceRoot, absPath) {
     if (code === "ENOENT") {
       const nearestAncestor = await findNearestExistingAncestor(dirname11(absPath));
       const realAncestor = await realpath5(nearestAncestor);
-      const rel2 = relative11(realRoot, realAncestor);
-      if (rel2.startsWith("..") || isAbsolute8(rel2)) {
+      const rel2 = relative12(realRoot, realAncestor);
+      if (rel2.startsWith("..") || isAbsolute9(rel2)) {
         throw new Error(`path "${absPath}" is outside workspace`);
       }
       return;
     }
     throw err;
   }
-  const rel = relative11(realRoot, realCandidate);
-  if (rel.startsWith("..") || isAbsolute8(rel)) {
+  const rel = relative12(realRoot, realCandidate);
+  if (rel.startsWith("..") || isAbsolute9(rel)) {
     throw new Error(`path "${absPath}" is outside workspace`);
   }
 }
@@ -9956,9 +9995,9 @@ function boundFs(workspaceRoot, opts = {}) {
   };
   const toRuntimePath = (absolutePath) => {
     if (!shouldMapRuntimeRoot || !runtimeRoot) return absolutePath;
-    const rel = relative11(workspaceRoot, absolutePath);
+    const rel = relative12(workspaceRoot, absolutePath);
     if (rel === "") return runtimeRoot;
-    if (rel.startsWith("..") || isAbsolute8(rel)) return absolutePath;
+    if (rel.startsWith("..") || isAbsolute9(rel)) return absolutePath;
     return `${runtimeRoot}/${toPosixPath(rel)}`;
   };
   const read = {
@@ -10070,7 +10109,7 @@ import {
 } from "@mariozechner/pi-coding-agent";
 
 // src/server/tools/operations/remoteWorkspace.ts
-import { isAbsolute as isAbsolute9, relative as relative12 } from "path";
+import { isAbsolute as isAbsolute10, relative as relative13 } from "path";
 function unique(values) {
   return Array.from(new Set(values));
 }
@@ -10078,11 +10117,11 @@ function rootsFor(workspace, opts = {}) {
   return unique([workspace.root, ...opts.rootAliases ?? []]);
 }
 function isOutsideWorkspaceRel(rel) {
-  return rel === ".." || rel.startsWith("../") || rel.startsWith("..\\") || isAbsolute9(rel);
+  return rel === ".." || rel.startsWith("../") || rel.startsWith("..\\") || isAbsolute10(rel);
 }
 function toRelPath(workspace, absolutePath, opts = {}) {
   for (const root of rootsFor(workspace, opts)) {
-    const rel = relative12(root, absolutePath);
+    const rel = relative13(root, absolutePath);
     if (!isOutsideWorkspaceRel(rel)) return rel;
   }
   const skillMarker = "/.agents/skills/";
@@ -10249,7 +10288,7 @@ import {
   truncateHead,
   truncateLine
 } from "@mariozechner/pi-coding-agent";
-import { resolve as resolve10, relative as relative13 } from "path";
+import { resolve as resolve11, relative as relative14 } from "path";
 
 // src/server/catalog/tools/_shared.ts
 function makeError(message) {
@@ -10352,15 +10391,15 @@ function isOutsideWorkspace(rel) {
   return rel === ".." || rel.startsWith("../") || rel.startsWith("..\\") || rel.startsWith("/");
 }
 function isUnderRoot(root, path4) {
-  const rel = relative13(root, path4);
+  const rel = relative14(root, path4);
   return !isOutsideWorkspace(rel);
 }
 function normalizeSearchPath(rawPath, workspaceRoot, pathOptions) {
   const path4 = optionalStringParam(rawPath) ?? ".";
   if (!workspaceRoot) return { ok: true, path: pathOptions?.toRemotePath?.(path4) ?? path4 };
   if (!path4.startsWith("/")) {
-    const resolved = resolve10(workspaceRoot, path4);
-    const rel = relative13(workspaceRoot, resolved);
+    const resolved = resolve11(workspaceRoot, path4);
+    const rel = relative14(workspaceRoot, resolved);
     if (isOutsideWorkspace(rel)) return { ok: false, message: `path "${path4}" is outside workspace` };
     return { ok: true, path: path4 };
   }
@@ -11706,16 +11745,16 @@ function modelsRoutes(app, opts, done) {
 }
 
 // src/server/http/routes/skills.ts
-import { isAbsolute as isAbsolute10, relative as relative14, resolve as resolve11, sep as sep8 } from "path";
+import { isAbsolute as isAbsolute11, relative as relative15, resolve as resolve12, sep as sep8 } from "path";
 import {
   DefaultPackageManager,
-  getAgentDir,
+  getAgentDir as getAgentDir2,
   loadSkills
 } from "@mariozechner/pi-coding-agent";
 var CACHE_TTL_MS2 = 3e4;
 function pathForWorkspaceEditor(workspaceRoot, filePath) {
-  const pathWithinWorkspace = relative14(resolve11(workspaceRoot), resolve11(filePath));
-  if (pathWithinWorkspace === "" || pathWithinWorkspace === ".." || pathWithinWorkspace.startsWith(`..${sep8}`) || isAbsolute10(pathWithinWorkspace)) {
+  const pathWithinWorkspace = relative15(resolve12(workspaceRoot), resolve12(filePath));
+  if (pathWithinWorkspace === "" || pathWithinWorkspace === ".." || pathWithinWorkspace.startsWith(`..${sep8}`) || isAbsolute11(pathWithinWorkspace)) {
     return filePath;
   }
   return pathWithinWorkspace.split(sep8).join("/");
@@ -11723,7 +11762,9 @@ function pathForWorkspaceEditor(workspaceRoot, filePath) {
 function skillsRoutes(app, opts, done) {
   const cached = /* @__PURE__ */ new Map();
   async function resolveSkillsForRequest(request, refresh = false) {
-    const workspaceRoot = opts.getWorkspaceRoot ? await opts.getWorkspaceRoot(request) : opts.workspaceRoot;
+    const workspace = opts.getWorkspace ? await opts.getWorkspace(request) : opts.workspace;
+    if (!workspace) throw new Error("skills route requires workspace or getWorkspace");
+    const workspaceRoot = workspace.root;
     const additionalSkillPaths = opts.getAdditionalSkillPaths ? await opts.getAdditionalSkillPaths(request) : opts.additionalSkillPaths;
     const piPackages = opts.getPiPackages ? await opts.getPiPackages(request) : opts.piPackages;
     const noSkills = (opts.getNoSkills ? await opts.getNoSkills(request) : opts.noSkills) ?? withPiHarnessDefaults().noSkills;
@@ -11734,7 +11775,7 @@ function skillsRoutes(app, opts, done) {
     }
     const cachedEntry = cached.get(cacheKey);
     if (!refresh && cachedEntry && cachedEntry.expiresAt > now) return cachedEntry;
-    const agentDir = getAgentDir();
+    const agentDir = getAgentDir2();
     const packageSkillPaths = noSkills ? [] : await (async () => {
       const settingsManager = createResourceSettingsManager(
         workspaceRoot,
@@ -12489,7 +12530,7 @@ function searchRoutes(app, opts, done) {
 }
 
 // src/server/git/gitFileUrl.ts
-import { dirname as dirname12, relative as relative15 } from "path";
+import { dirname as dirname12, relative as relative16 } from "path";
 import { execFile as execFile3 } from "child_process";
 import { promisify as promisify3 } from "util";
 
@@ -12572,7 +12613,7 @@ async function resolveGitFileUrl(workspaceRoot, path4) {
       commitSha = null;
     }
   }
-  const repoRelativePath = relative15(repoRoot, absolutePath).replace(/\\/g, "/");
+  const repoRelativePath = relative16(repoRoot, absolutePath).replace(/\\/g, "/");
   const url = buildGitFileUrl({ remoteUrl, repoRelativePath, branch, commitSha });
   if (!url) {
     return disabled("Only GitHub SSH/HTTPS remotes are supported right now.");
@@ -12598,8 +12639,8 @@ function requirePath(value, reply) {
 }
 function gitRoutes(app, opts, done) {
   async function resolveWorkspaceRoot(request) {
-    if (opts.getWorkspaceRoot) return await opts.getWorkspaceRoot(request);
-    return request.workspaceRoot;
+    const workspace = opts.getWorkspace ? await opts.getWorkspace(request) : opts.workspace;
+    return workspace === void 0 ? void 0 : getNodeWorkspaceHostRoot(workspace);
   }
   app.get("/api/v1/git/file-url", async (request, reply) => {
     const query = request.query;
@@ -13038,6 +13079,8 @@ async function createWorkspaceAgentAppProfile(opts, sessionId, resolvedMode, app
       requestId: request.id
     });
   } : void 0;
+  const gitStorageRoot = getOptionalRuntimeBundleStorageRoot(runtimeBundle);
+  const gitWorkspace = gitStorageRoot === void 0 ? runtimeBundle.workspace : createNodeWorkspace(gitStorageRoot);
   return {
     runtimeMode: resolvedMode,
     capabilities: { tools: toolNames(tools) },
@@ -13061,12 +13104,12 @@ async function createWorkspaceAgentAppProfile(opts, sessionId, resolvedMode, app
       // File search shares the same bound implementation as the model tool.
       search: { fileSearch: runtimeBundle.fileSearch },
       // Git metadata resolves against host storage, not a sandbox-internal cwd.
-      git: { getWorkspaceRoot: () => getOptionalRuntimeBundleStorageRoot(runtimeBundle) }
+      git: { workspace: gitWorkspace }
     },
     chat: { service: agentRuntime.service },
     systemPrompt: { harness },
     skills: {
-      workspaceRoot,
+      workspace: createNodeWorkspace(workspaceRoot),
       additionalSkillPaths: runtimePi.additionalSkillPaths,
       piPackages: runtimePi.packages,
       noSkills: runtimePi.noSkills,
@@ -13277,20 +13320,20 @@ function createRuntimeBindingLifecycle(options) {
   const requestLeaseLifetimes = /* @__PURE__ */ new WeakMap();
   let admissionTail = Promise.resolve();
   let resolveEntryChange;
-  let entryChange = new Promise((resolve12) => {
-    resolveEntryChange = resolve12;
+  let entryChange = new Promise((resolve13) => {
+    resolveEntryChange = resolve13;
   });
   function notifyEntryChange() {
     resolveEntryChange();
-    entryChange = new Promise((resolve12) => {
-      resolveEntryChange = resolve12;
+    entryChange = new Promise((resolve13) => {
+      resolveEntryChange = resolve13;
     });
   }
   async function withAdmissionLock(operation) {
     const previous = admissionTail;
     let release;
-    admissionTail = new Promise((resolve12) => {
-      release = resolve12;
+    admissionTail = new Promise((resolve13) => {
+      release = resolve13;
     });
     await previous;
     try {
@@ -13390,8 +13433,8 @@ function createRuntimeBindingLifecycle(options) {
   }
   function waitForLeases(entry) {
     if (entry.activeLeases === 0) return Promise.resolve();
-    entry.leaseDrainPromise ??= new Promise((resolve12) => {
-      entry.resolveLeaseDrain = resolve12;
+    entry.leaseDrainPromise ??= new Promise((resolve13) => {
+      entry.resolveLeaseDrain = resolve13;
     });
     return entry.leaseDrainPromise;
   }
@@ -14285,6 +14328,9 @@ var registerAgentRoutes = async (app, opts) => {
       try {
         workspaceId = (await opts.getWorkspaceId(request)).trim();
       } catch (error) {
+        if (typeof error === "object" && error !== null && "status" in error && error.status === 421 && "code" in error && error.code === ErrorCode.enum.D1_HOST_SCOPE_VIOLATION) {
+          throw error;
+        }
         const statusCode = typeof error?.statusCode === "number" ? error.statusCode : 400;
         const message = statusCode >= 500 ? "workspace scope failed" : error instanceof Error ? error.message : "workspace id is required";
         return reply.code(statusCode).send({
@@ -14331,7 +14377,11 @@ var registerAgentRoutes = async (app, opts) => {
     getFileSearch: async (request) => (await getBindingForRequest(request)).runtimeBundle.fileSearch
   });
   await app.register(gitRoutes, {
-    getWorkspaceRoot: async (request) => getOptionalRuntimeBundleStorageRoot((await getBindingForRequest(request)).runtimeBundle)
+    getWorkspace: async (request) => {
+      const runtimeBundle = (await getBindingForRequest(request)).runtimeBundle;
+      const storageRoot = getOptionalRuntimeBundleStorageRoot(runtimeBundle);
+      return storageRoot === void 0 ? runtimeBundle.workspace : createNodeWorkspace(storageRoot);
+    }
   });
   await app.register(piChatRoutes, {
     getService: async (request) => {
@@ -14347,7 +14397,7 @@ var registerAgentRoutes = async (app, opts) => {
     filterModels: opts.filterModels
   });
   await app.register(skillsRoutes, {
-    workspaceRoot,
+    workspace: staticBinding ? createNodeWorkspace(workspaceRoot) : void 0,
     additionalSkillPaths: [
       ...staticBinding?.runtimeProvisioning?.skillPaths ?? [],
       ...opts.pi?.additionalSkillPaths ?? []
@@ -14356,7 +14406,7 @@ var registerAgentRoutes = async (app, opts) => {
     // Undefined is fine: skillsRoutes resolves it through the canonical
     // harness policy (withPiHarnessDefaults), same as the factory above.
     noSkills: opts.pi?.noSkills,
-    getWorkspaceRoot: staticBinding ? void 0 : async (request) => (await getSkillsScopeForRequest(request)).root,
+    getWorkspace: staticBinding ? void 0 : async (request) => createNodeWorkspace((await getSkillsScopeForRequest(request)).root),
     getAdditionalSkillPaths: staticBinding && !hasRuntimeProvisioningInput ? void 0 : async (request) => {
       const scope = await getSkillsScopeForRequest(request);
       if (!hasRuntimeProvisioningInput) return scope.pi.additionalSkillPaths;
@@ -14488,6 +14538,7 @@ export {
   createAgent,
   AgentDirectoryCompilerError,
   compileAgentDirectory,
+  createResolvedAgentDigest,
   resolveAgentDeployment,
   MANAGED_AGENT_MCP_ORIGIN_SURFACE,
   MANAGED_AGENT_MCP_DELIVERY_RULE,