@inflexa-ai/harness 0.26.3 → 0.27.0

package/dist/app/data-profile-orientation.d.ts

@@ -13,6 +13,13 @@
  *
  * A pure function over the record — no I/O, no LLM, no pipeline. It is the whole
  * mechanism.
+ *
+ * Every path it renders is projected into the frame-independent
+ * `/{analysisId}/…` form. The record stores a path relative to the analysis
+ * root, which is the correct form to store; but a step agent resolves a relative
+ * path against its own working directory, thus the stored form names a file that
+ * does not exist there. The absolute form resolves to the same file in every
+ * frame, including the conversation agent's, so the projection is unconditional.
  */
 import type { DataProfileResult } from "../state/data-profile.js";
 /** The character budget the projection guarantees it will not exceed. */
@@ -30,5 +37,9 @@ export declare const DATA_PROFILE_ORIENTATION_MAX_CHARS = 1200;
  * A snapshot written before the record was widened carries none of the structured
  * fields. Rather than emit a bare file list, that case falls back to the narrative
  * summary — the one orientation a legacy row does have.
+ *
+ * `analysisId` roots each rendered file path (see the module header). It is the
+ * id of the analysis the profile belongs to, and it is what the sandbox mounts
+ * the tree at.
  */
-export declare function buildDataProfileOrientation(result: DataProfileResult, maxChars?: number): string;
+export declare function buildDataProfileOrientation(result: DataProfileResult, analysisId: string, maxChars?: number): string;

package/dist/app/data-profile-orientation.js

@@ -13,7 +13,15 @@
  *
  * A pure function over the record — no I/O, no LLM, no pipeline. It is the whole
  * mechanism.
+ *
+ * Every path it renders is projected into the frame-independent
+ * `/{analysisId}/…` form. The record stores a path relative to the analysis
+ * root, which is the correct form to store; but a step agent resolves a relative
+ * path against its own working directory, thus the stored form names a file that
+ * does not exist there. The absolute form resolves to the same file in every
+ * frame, including the conversation agent's, so the projection is unconditional.
  */
+import { toAnalysisRootPath } from "../workspace/paths.js";
 /** The character budget the projection guarantees it will not exceed. */
 export const DATA_PROFILE_ORIENTATION_MAX_CHARS = 1200;
 /** Files listed before the tail is elided (the count still reports the total). */
@@ -81,8 +89,12 @@ function formatFileFacts(file) {
  * A snapshot written before the record was widened carries none of the structured
  * fields. Rather than emit a bare file list, that case falls back to the narrative
  * summary — the one orientation a legacy row does have.
+ *
+ * `analysisId` roots each rendered file path (see the module header). It is the
+ * id of the analysis the profile belongs to, and it is what the sandbox mounts
+ * the tree at.
  */
-export function buildDataProfileOrientation(result, maxChars = DATA_PROFILE_ORIENTATION_MAX_CHARS) {
+export function buildDataProfileOrientation(result, analysisId, maxChars = DATA_PROFILE_ORIENTATION_MAX_CHARS) {
     const lines = [];
     const identity = [
         [present(result.domain), present(result.subtype)].filter((f) => f !== undefined).join(" / ") || undefined,
@@ -139,7 +151,7 @@ export function buildDataProfileOrientation(result, maxChars = DATA_PROFILE_ORIE
         const header = shown.length < result.files.length ? `${label} (${shown.length} of ${result.files.length}):` : `${label} (${result.files.length}):`;
         lines.push(header);
         for (const file of shown) {
-            lines.push(`- ${file.path} — ${clip(file.description, MAX_FILE_DESCRIPTION_CHARS)}${formatFileFacts(file)}`);
+            lines.push(`- ${toAnalysisRootPath(analysisId, file.path)} — ${clip(file.description, MAX_FILE_DESCRIPTION_CHARS)}${formatFileFacts(file)}`);
         }
     }
     return clamp(lines.join("\n"), maxChars);

package/dist/prompts/briefing.d.ts

@@ -48,20 +48,30 @@ export declare const STEP_NON_TASK_FIELDS: readonly ["id", "track", "step_type",
  * improvises the rest.
  */
 export declare function renderTask(step: AnalysisStep): string;
-/** The two in-sandbox paths that anchor every path the agent writes or reads. */
+/**
+ * What anchors every path the agent writes or reads: the id the tree is mounted
+ * at, and the step's writable directory.
+ *
+ * The frame carries the id rather than the analysis root, because the root is
+ * `/{analysisId}` and two fields for one value can disagree. The id is also what
+ * every other path in the briefing is rooted with, thus one field serves the
+ * workspace section and the orientation alike.
+ */
 export interface WorkspaceFrame {
-    /** In-sandbox analysis root — the read-only mount of the whole analysis tree. */
-    readonly analysisRoot: string;
+    /** The analysis id. The sandbox mounts the read-only analysis tree at `/{analysisId}`. */
+    readonly analysisId: string;
     /** In-sandbox working directory — this step's writable artifact directory, and its cwd. */
     readonly workingDir: string;
 }
+/** The in-sandbox analysis root of a frame — the read-only mount of the whole tree. */
+export declare function analysisRootOf(frame: WorkspaceFrame): string;
 export declare function renderWorkspace(frame: WorkspaceFrame): string;
 /**
  * What dataset the analysis is holding, projected from the persisted profile.
  * Absent or not-yet-profiled → `""`, and the agent falls back to its always-on
  * `inspect_data_profile` tool.
  */
-export declare function renderOrientation(profile: DataProfileResult | null | undefined): string;
+export declare function renderOrientation(profile: DataProfileResult | null | undefined, analysisId: string): string;
 /**
  * One completed dependency's handoff. The seed carries the gist plus the PATHS
  * to the rest — an agent that needs more than the excerpt reads the summary at

package/dist/prompts/briefing.js

@@ -104,12 +104,17 @@ export function renderTask(step) {
     }
     return parts.join("\n\n");
 }
+/** The in-sandbox analysis root of a frame — the read-only mount of the whole tree. */
+export function analysisRootOf(frame) {
+    return `/${frame.analysisId}`;
+}
 export function renderWorkspace(frame) {
-    if (!frame.analysisRoot.trim() || !frame.workingDir.trim())
+    if (!frame.analysisId.trim() || !frame.workingDir.trim())
         return "";
+    const analysisRoot = analysisRootOf(frame);
     return section("Workspace", bullets([
         `Working directory (writable, your cwd): \`${frame.workingDir}\` — write outputs to \`output/\`, \`figures/\`, \`scripts/\`, \`logs/\` under it.`,
-        `Analysis root (read-only): \`${frame.analysisRoot}\` — inputs at \`${frame.analysisRoot}/data/inputs/\`, prior runs at \`${frame.analysisRoot}/runs/\`.`,
+        `Analysis root (read-only): \`${analysisRoot}\` — inputs at \`${analysisRoot}/data/inputs/\`, prior runs at \`${analysisRoot}/runs/\`.`,
     ]));
 }
 // ── (3) Data orientation ──────────────────────────────────────────────
@@ -118,10 +123,10 @@ export function renderWorkspace(frame) {
  * Absent or not-yet-profiled → `""`, and the agent falls back to its always-on
  * `inspect_data_profile` tool.
  */
-export function renderOrientation(profile) {
+export function renderOrientation(profile, analysisId) {
     if (!profile)
         return "";
-    const orientation = buildDataProfileOrientation(profile, DATA_PROFILE_ORIENTATION_MAX_CHARS);
+    const orientation = buildDataProfileOrientation(profile, analysisId, DATA_PROFILE_ORIENTATION_MAX_CHARS);
     if (orientation.trim().length === 0)
         return "";
     return section("Data orientation", `${orientation}\n\nThis is a bounded projection — call \`inspect_data_profile\` for the full profile.`);
@@ -160,7 +165,12 @@ function renderHandoff(handoff) {
  * caller's durable step replay-stable.
  */
 export function composeStepBriefing(briefing) {
-    return [renderTask(briefing.step), renderWorkspace(briefing.workspace), renderOrientation(briefing.profile), renderUpstream(briefing.upstream)]
+    return [
+        renderTask(briefing.step),
+        renderWorkspace(briefing.workspace),
+        renderOrientation(briefing.profile, briefing.workspace.analysisId),
+        renderUpstream(briefing.upstream),
+    ]
         .filter(Boolean)
         .join("\n\n");
 }

package/dist/state/init.js

@@ -428,6 +428,7 @@ CREATE TABLE IF NOT EXISTS cortex_working_memory (
 CREATE TABLE IF NOT EXISTS cortex_asks (
   id           TEXT PRIMARY KEY,
   analysis_id  TEXT NOT NULL,
+  user_id      TEXT,
   thread_id    TEXT,
   title        TEXT NOT NULL,
   command      TEXT NOT NULL,
@@ -451,16 +452,17 @@ CREATE INDEX IF NOT EXISTS idx_cortex_asks_analysis
 CREATE INDEX IF NOT EXISTS idx_cortex_asks_pending
   ON cortex_asks(status) WHERE status = 'pending';
 
--- Standing approval grants behind an 'always' reply — keyed by the analysis and
--- the ask's grant key (the displayed command when the tool supplied no broader
--- key), so a later matching ask auto-approves without pausing. Lives for the
--- analysis lifecycle, surviving process restarts, and never applies to another
--- analysis.
+-- Standing approval grants behind an 'always' reply — keyed by the analysis, the
+-- user, and the ask's grant key (the displayed command when the tool supplied no
+-- broader key), so a later matching ask auto-approves without pausing. Lives for
+-- the analysis lifecycle, surviving process restarts, and never applies to
+-- another analysis or another user.
 CREATE TABLE IF NOT EXISTS cortex_ask_grants (
   analysis_id  TEXT NOT NULL,
+  user_id      TEXT NOT NULL,
   grant_key    TEXT NOT NULL,
   created_at   TEXT NOT NULL,
-  PRIMARY KEY (analysis_id, grant_key)
+  PRIMARY KEY (analysis_id, user_id, grant_key)
 );
 `;
 /**
@@ -640,6 +642,21 @@ export async function initCortexState(pool, injected) {
                     ALTER TABLE cortex_ask_grants RENAME COLUMN command TO grant_key;
                   END IF;
                 END $$`,
+                "ALTER TABLE cortex_asks ADD COLUMN IF NOT EXISTS user_id TEXT",
+                // The user joins the grant key. Guarded and scoped like the rename
+                // above. An existing row keeps the empty default, which matches no real
+                // identity, so it is inert rather than deleted.
+                `DO $$ BEGIN
+                  IF NOT EXISTS (
+                    SELECT 1 FROM information_schema.columns
+                    WHERE table_schema = current_schema() AND table_name = 'cortex_ask_grants' AND column_name = 'user_id'
+                  ) THEN
+                    ALTER TABLE cortex_ask_grants ADD COLUMN user_id TEXT NOT NULL DEFAULT '';
+                    ALTER TABLE cortex_ask_grants ALTER COLUMN user_id DROP DEFAULT;
+                    ALTER TABLE cortex_ask_grants DROP CONSTRAINT IF EXISTS cortex_ask_grants_pkey;
+                    ALTER TABLE cortex_ask_grants ADD PRIMARY KEY (analysis_id, user_id, grant_key);
+                  END IF;
+                END $$`,
             ];
             for (const sql of addMigrations) {
                 await client.query(sql);

package/dist/tasks/data-profile.js

@@ -290,7 +290,7 @@ export async function runDataProfileBody(input, deps) {
                 `Profile the input data for this analysis: say what the dataset IS, so planning can proceed.`,
                 ``,
                 renderWorkspace({
-                    analysisRoot: `/${analysisId}`,
+                    analysisId,
                     workingDir: toSandboxPath(workspaceRoot, analysisId, profileWritePrefix),
                 }),
                 ``,

package/dist/tools/ad-hoc-router.js

@@ -53,7 +53,7 @@ async function profileOrientation(pool, analysisId, logger) {
         const status = unwrapOrThrow(await loadDataProfileStatus(pool, analysisId));
         if (!status?.result)
             return "No persisted data-profile facts are available.";
-        return buildDataProfileOrientation(status.result, DATA_PROFILE_ORIENTATION_MAX_CHARS);
+        return buildDataProfileOrientation(status.result, analysisId, DATA_PROFILE_ORIENTATION_MAX_CHARS);
     }
     catch (error) {
         logger.warn("could not load data profile for ad hoc routing", { error: error instanceof Error ? error.message : String(error) });

package/dist/tools/approval/gateway.d.ts

@@ -20,11 +20,13 @@ export interface AskGatewayDeps {
 }
 /**
  * Per-turn context an embedder binds into the `Ask` seam. It scopes the ask to an
- * analysis/thread, carries the turn's abort `signal`, and supplies the `emit` sink
- * the `data-ask` part flows through.
+ * analysis/thread and to one user, carries the turn's abort `signal`, and supplies
+ * the `emit` sink the `data-ask` part flows through.
  */
 export interface AskContext {
     readonly analysisId: string;
+    /** The opaque identity of the person the ask goes to. The harness never reads it. */
+    readonly userId: string;
     readonly threadId?: string;
     readonly signal: AbortSignal;
     readonly emit: EmitFn;

package/dist/tools/approval/gateway.js

@@ -29,6 +29,7 @@ export function createAskGateway(deps) {
         const row = {
             id,
             analysisId: ctx.analysisId,
+            userId: ctx.userId,
             threadId: ctx.threadId ?? null,
             title: request.title,
             command: request.command,
@@ -36,10 +37,10 @@ export function createAskGateway(deps) {
             grantKey: request.grantKey ?? null,
             createdAt: now,
         };
-        // A standing grant for this ask's grant key — the command unless the tool
-        // supplied a broader key — short-circuits the prompt: record the invocation as
-        // `resolved` for the audit trail and return without pausing.
-        if (unwrapOrThrow(await selectGrant(pool, ctx.analysisId, request.grantKey ?? request.command))) {
+        // A standing grant this user holds for this ask's grant key — the command
+        // unless the tool supplied a broader key — short-circuits the prompt: record
+        // the invocation as `resolved` for the audit trail and return without pausing.
+        if (unwrapOrThrow(await selectGrant(pool, ctx.analysisId, ctx.userId, request.grantKey ?? request.command))) {
             unwrapOrThrow(await insertGrantedAsk(pool, row, now));
             return { kind: "always" };
         }

package/dist/tools/approval/queries.d.ts

@@ -21,6 +21,7 @@ export type AnswerOutcome = "applied" | "not_found" | "already_terminal";
 export interface PendingAsk {
     readonly id: string;
     readonly analysisId: string;
+    readonly userId: string;
     readonly threadId: string | null;
     readonly title: string;
     readonly command: string;
@@ -36,6 +37,7 @@ export interface AskResolution {
 export interface AskRow {
     readonly id: string;
     readonly analysisId: string;
+    readonly userId: string;
     readonly threadId: string | null;
     readonly title: string;
     readonly command: string;
@@ -52,8 +54,8 @@ export declare function insertPendingAsk(querier: Querier, row: AskRow): ResultA
  * every approval-gated action. The recorded reply is `{ kind: "always" }`.
  */
 export declare function insertGrantedAsk(querier: Querier, row: AskRow, resolvedAt: string): ResultAsync<void, DbError>;
-/** Does a standing grant cover `(analysisId, grantKey)` in this analysis? */
-export declare function selectGrant(querier: Querier, analysisId: string, grantKey: string): ResultAsync<boolean, DbError>;
+/** Does a standing grant cover `(analysisId, userId, grantKey)` for this person? */
+export declare function selectGrant(querier: Querier, analysisId: string, userId: string, grantKey: string): ResultAsync<boolean, DbError>;
 /** Read a row's current status + recorded reply. `null` when no such row exists. */
 export declare function selectAskResolution(querier: Querier, id: string): ResultAsync<AskResolution | null, DbError>;
 /**

package/dist/tools/approval/queries.js

@@ -15,9 +15,9 @@ export function insertPendingAsk(querier, row) {
     return tryMutation("asks.insertPending", async () => {
         await querier.query({
             text: `INSERT INTO cortex_asks
-              (id, analysis_id, thread_id, title, command, detail, grant_key, status, created_at)
-              VALUES ($1, $2, $3, $4, $5, $6, $7, 'pending', $8)`,
-            values: [row.id, row.analysisId, row.threadId, row.title, row.command, row.detail, row.grantKey ?? row.command, row.createdAt],
+              (id, analysis_id, user_id, thread_id, title, command, detail, grant_key, status, created_at)
+              VALUES ($1, $2, $3, $4, $5, $6, $7, $8, 'pending', $9)`,
+            values: [row.id, row.analysisId, row.userId, row.threadId, row.title, row.command, row.detail, row.grantKey ?? row.command, row.createdAt],
         });
     });
 }
@@ -30,11 +30,12 @@ export function insertGrantedAsk(querier, row, resolvedAt) {
     return tryMutation("asks.insertGranted", async () => {
         await querier.query({
             text: `INSERT INTO cortex_asks
-              (id, analysis_id, thread_id, title, command, detail, grant_key, status, reply, created_at, resolved_at)
-              VALUES ($1, $2, $3, $4, $5, $6, $7, 'resolved', $8::jsonb, $9, $10)`,
+              (id, analysis_id, user_id, thread_id, title, command, detail, grant_key, status, reply, created_at, resolved_at)
+              VALUES ($1, $2, $3, $4, $5, $6, $7, $8, 'resolved', $9::jsonb, $10, $11)`,
             values: [
                 row.id,
                 row.analysisId,
+                row.userId,
                 row.threadId,
                 row.title,
                 row.command,
@@ -47,12 +48,12 @@ export function insertGrantedAsk(querier, row, resolvedAt) {
         });
     });
 }
-/** Does a standing grant cover `(analysisId, grantKey)` in this analysis? */
-export function selectGrant(querier, analysisId, grantKey) {
+/** Does a standing grant cover `(analysisId, userId, grantKey)` for this person? */
+export function selectGrant(querier, analysisId, userId, grantKey) {
     return tryQuery("asks.selectGrant", async () => {
         const result = await querier.query({
-            text: `SELECT 1 FROM cortex_ask_grants WHERE analysis_id = $1 AND grant_key = $2`,
-            values: [analysisId, grantKey],
+            text: `SELECT 1 FROM cortex_ask_grants WHERE analysis_id = $1 AND user_id = $2 AND grant_key = $3`,
+            values: [analysisId, userId, grantKey],
         });
         return (result.rowCount ?? 0) > 0;
     });
@@ -86,12 +87,13 @@ export function markAborted(querier, id, resolvedAt) {
 export function selectPending(querier) {
     return tryQuery("asks.selectPending", async () => {
         const result = await querier.query({
-            text: `SELECT id, analysis_id, thread_id, title, command, detail, created_at
+            text: `SELECT id, analysis_id, COALESCE(user_id, '') AS user_id, thread_id, title, command, detail, created_at
               FROM cortex_asks WHERE status = 'pending' ORDER BY created_at ASC`,
         });
         return result.rows.map((row) => ({
             id: row.id,
             analysisId: row.analysis_id,
+            userId: row.user_id,
             threadId: row.thread_id ?? null,
             title: row.title,
             command: row.command,
@@ -133,7 +135,7 @@ export function answerAsk(pool, id, reply, now) {
     return withTransaction(pool, "asks.answer", (client) => tryMutation("asks.answer:update", () => client.query({
         text: `UPDATE cortex_asks SET status = $1, reply = $2::jsonb, resolved_at = $3
                   WHERE id = $4 AND status = 'pending'
-                  RETURNING analysis_id, COALESCE(grant_key, command) AS grant_key`,
+                  RETURNING analysis_id, COALESCE(user_id, '') AS user_id, COALESCE(grant_key, command) AS grant_key`,
         values: [status, JSON.stringify(reply), now, id],
     })).andThen((updated) => {
         if ((updated.rowCount ?? 0) === 0)
@@ -144,12 +146,14 @@ export function answerAsk(pool, id, reply, now) {
         // caveat: every insert writes grant_key (command when the tool supplied
         // none), and the COALESCE above covers any pending row that predates
         // the column — `command` is NOT NULL, so the key can never be null.
+        // `user_id` reads the same way: its COALESCE gives the empty string for a
+        // row that predates the column, and that identity matches no real user.
         const granted = updated.rows[0];
         return tryMutation("asks.answer:grant", async () => {
             await client.query({
-                text: `INSERT INTO cortex_ask_grants (analysis_id, grant_key, created_at)
-                      VALUES ($1, $2, $3) ON CONFLICT (analysis_id, grant_key) DO NOTHING`,
-                values: [granted.analysis_id, granted.grant_key, now],
+                text: `INSERT INTO cortex_ask_grants (analysis_id, user_id, grant_key, created_at)
+                      VALUES ($1, $2, $3, $4) ON CONFLICT (analysis_id, user_id, grant_key) DO NOTHING`,
+                values: [granted.analysis_id, granted.user_id, granted.grant_key, now],
             });
         }).map(() => "applied");
     }));

package/dist/tools/research/generate-plan.js

@@ -209,7 +209,7 @@ const NO_FACTS_GUIDANCE = "Plan from the research question alone, do not invent
  *
  * Pure — the same grounding renders the same string.
  */
-function renderDataContext(grounding) {
+function renderDataContext(grounding, analysisId) {
     switch (grounding.kind) {
         case "absent":
             return "";
@@ -230,7 +230,7 @@ function renderDataContext(grounding) {
                 "From this analysis's persisted data profile — the authoritative record of what the input data " +
                     "is, derived by profiling the files themselves. Nobody typed it; ground your plan in it.",
                 "",
-                buildDataProfileOrientation(grounding.result, DATA_PROFILE_ORIENTATION_MAX_CHARS),
+                buildDataProfileOrientation(grounding.result, analysisId, DATA_PROFILE_ORIENTATION_MAX_CHARS),
             ];
             if (grounding.kind === "provisional") {
                 lines.push("", `PROVISIONAL — this profile may not describe the analysis's current inputs: ${grounding.reasons.join("; ")}. ` +
@@ -748,7 +748,7 @@ export function createGeneratePlanTool(deps) {
                 return null;
             });
             const grounding = classifyGrounding(profileStatus);
-            const dataContextBlock = renderDataContext(grounding);
+            const dataContextBlock = renderDataContext(grounding, analysisId);
             // Reference data and package availability are mandatory grounding,
             // not optional planner lookups. Read both inventories host-side before
             // the loop and put their rendered content in the planner's seed.

package/dist/tools/research/inspect-data-profile.d.ts

@@ -19,6 +19,12 @@
  * Lifecycle states are data variants, not errors (the `defineTool` contract): a missing,
  * in-flight, failed, or stale profile is an ordinary, expected outcome the model must be
  * able to reason about, so each returns in the ok channel.
+ *
+ * Every path it serves is projected into the frame-independent `/{analysisId}/…`
+ * form. The record stores a path relative to the analysis root, and a step agent
+ * resolves a relative path against its own working directory — thus the stored
+ * form names a file that does not exist in the frame of the caller. The same
+ * projection guards the step briefing (`app/data-profile-orientation.ts`).
  */
 import type { Pool } from "pg";
 import { type DataProfileFile, type DataProfileResult } from "../../state/index.js";

package/dist/tools/research/inspect-data-profile.js

@@ -19,12 +19,19 @@
  * Lifecycle states are data variants, not errors (the `defineTool` contract): a missing,
  * in-flight, failed, or stale profile is an ordinary, expected outcome the model must be
  * able to reason about, so each returns in the ok channel.
+ *
+ * Every path it serves is projected into the frame-independent `/{analysisId}/…`
+ * form. The record stores a path relative to the analysis root, and a step agent
+ * resolves a relative path against its own working directory — thus the stored
+ * form names a file that does not exist in the frame of the caller. The same
+ * projection guards the step briefing (`app/data-profile-orientation.ts`).
  */
 import { ok } from "neverthrow";
 import { z } from "zod";
 import { scopeResource } from "../../auth/types.js";
 import { unwrapOrThrow } from "../../lib/result.js";
 import { loadDataProfileStatus } from "../../state/index.js";
+import { toAnalysisRootPath } from "../../workspace/paths.js";
 import { defineTool } from "../define-tool.js";
 /** Per-file records returned per page when the caller names none. */
 const DEFAULT_PAGE_SIZE = 20;
@@ -44,6 +51,20 @@ function datasetFileCount(result) {
         return result.kinds.reduce((sum, kind) => sum + kind.count, 0);
     return null;
 }
+/** Serve each per-file record with a path that resolves in the frame of the caller. */
+function rootFilePaths(files, analysisId) {
+    return files.map((file) => ({ ...file, path: toAnalysisRootPath(analysisId, file.path) }));
+}
+/**
+ * Serve each kind with a glob that resolves in the frame of the caller.
+ *
+ * A `pathPattern` is a path with a wildcard segment, thus it takes the same
+ * projection as a file path. The wildcard characters survive it: the projection
+ * only re-roots the pattern.
+ */
+function rootKindPatterns(kinds, analysisId) {
+    return kinds.map((kind) => ({ ...kind, pathPattern: toAnalysisRootPath(analysisId, kind.pathPattern) }));
+}
 /**
  * Name every reason the served profile may not describe the current inputs.
  *
@@ -212,7 +233,7 @@ export function createInspectDataProfileTool(pool) {
                     ...envelope,
                     scope: "kinds",
                     available: true,
-                    kinds: result.kinds,
+                    kinds: rootKindPatterns(result.kinds, resourceId),
                     ...(result.axes ? { axes: result.axes } : {}),
                     ...(result.coverage ? { coverage: result.coverage } : {}),
                 });
@@ -229,7 +250,7 @@ export function createInspectDataProfileTool(pool) {
                 pageSize,
                 total,
                 hasMore: start + files.length < total,
-                files,
+                files: rootFilePaths(files, resourceId),
             });
         },
     });

package/dist/workflows/execute-analysis.js

@@ -214,7 +214,7 @@ export async function composeStepSeed(args) {
     // through the same helpers the sandbox mount and the mutate tools use, so
     // the seed cannot disagree with the container about where anything is.
     const workspace = {
-        analysisRoot: `/${analysisId}`,
+        analysisId,
         workingDir: toSandboxPath(workspaceRoot, analysisId, stepWritePrefix({ workspaceRoot, runId, stepId })),
     };
     // A DB failure here throws (house rules): a swallowed error would be frozen

package/dist/workspace/paths.d.ts

@@ -159,6 +159,25 @@ export declare function tailWritePrefix(args: {
  * a step briefing names (see the harness-workspace-tools spec).
  */
 export declare function toSandboxPath(workspaceRoot: string, resourceId: string, hostAbsPath: string): string;
+/**
+ * Map an analysis-root-relative path to the frame-independent `/{resourceId}/…`
+ * form this module defines at the top of the file.
+ *
+ * A record that outlives one agent stores the root-relative form, because that
+ * form does not depend on where a host puts the root. But a reader always reads
+ * inside a frame, and an agent whose working directory is a step directory
+ * resolves `data/inputs/x.csv` against that step directory. Thus one stored path
+ * is correct in the store and wrong in the message. This is the projection that a
+ * renderer applies before a stored path reaches an agent.
+ *
+ * The input comes from a record and it is a POSIX path, thus it normalizes under
+ * POSIX rules. The read is tolerant of the near-misses that a model writes: a
+ * leading slash, a `./` prefix, and a doubled separator all name the same file,
+ * and a path that already carries the correct root passes through. A tail that
+ * climbs above the root is returned as it is, because such a path must fail at
+ * the resolver as `out_of_scope`. A prefix would only make it look canonical.
+ */
+export declare function toAnalysisRootPath(resourceId: string, path: string): string;
 /**
  * Parent of every report session, workspace-root-relative. Callers that
  * enumerate the sessions join this. Callers that address one join

package/dist/workspace/paths.js

@@ -25,7 +25,7 @@
  * comes back `out_of_prefix` (the read surface skips that — it roams the tree
  * read-only).
  */
-import { relative as relativePath, resolve as resolvePath, sep } from "node:path";
+import { posix as posixPath, relative as relativePath, resolve as resolvePath, sep } from "node:path";
 /**
  * Resolve an agent-supplied path against the analysis tree under the
  * frame-aware model.
@@ -149,8 +149,54 @@ export function toSandboxPath(workspaceRoot, resourceId, hostAbsPath) {
     if (tail === ".." || tail.startsWith("../")) {
         throw new Error(`toSandboxPath: host path escapes the workspace root: ${hostAbsPath}`);
     }
+    return joinAnalysisRoot(resourceId, tail);
+}
+/**
+ * Map an analysis-root-relative path to the frame-independent `/{resourceId}/…`
+ * form this module defines at the top of the file.
+ *
+ * A record that outlives one agent stores the root-relative form, because that
+ * form does not depend on where a host puts the root. But a reader always reads
+ * inside a frame, and an agent whose working directory is a step directory
+ * resolves `data/inputs/x.csv` against that step directory. Thus one stored path
+ * is correct in the store and wrong in the message. This is the projection that a
+ * renderer applies before a stored path reaches an agent.
+ *
+ * The input comes from a record and it is a POSIX path, thus it normalizes under
+ * POSIX rules. The read is tolerant of the near-misses that a model writes: a
+ * leading slash, a `./` prefix, and a doubled separator all name the same file,
+ * and a path that already carries the correct root passes through. A tail that
+ * climbs above the root is returned as it is, because such a path must fail at
+ * the resolver as `out_of_scope`. A prefix would only make it look canonical.
+ */
+export function toAnalysisRootPath(resourceId, path) {
+    const trimmed = path.trim();
+    if (trimmed === "")
+        return `/${resourceId}`;
+    // Already rooted at this analysis: normalize the tail, then attach the root again.
+    const rooted = trimmed.startsWith("/") ? stripAnalysisRoot(trimmed, resourceId) : null;
+    if (rooted !== null)
+        return joinAnalysisRoot(resourceId, normalizeTail(rooted));
+    // A record holds no host path. Thus a leading slash is how a model writes the
+    // same root-relative path, and the remainder is the tail.
+    const tail = normalizeTail(trimmed.replace(/^\/+/, ""));
+    if (tail === ".." || tail.startsWith("../"))
+        return trimmed;
+    return joinAnalysisRoot(resourceId, tail);
+}
+/** `/{resourceId}` plus a tail. An empty tail gives the bare root. */
+function joinAnalysisRoot(resourceId, tail) {
     return tail === "" ? `/${resourceId}` : `/${resourceId}/${tail}`;
 }
+/** Collapse `.`, `..`, and a doubled separator in a POSIX tail. A bare `.` becomes empty. */
+function normalizeTail(tail) {
+    if (tail === "")
+        return "";
+    const normalized = posixPath.normalize(tail);
+    if (normalized === "." || normalized === "./")
+        return "";
+    return normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
+}
 /**
  * Parent of every report session, workspace-root-relative. Callers that
  * enumerate the sessions join this. Callers that address one join

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@inflexa-ai/harness",
-    "version": "0.26.3",
+    "version": "0.27.0",
     "description": "Host-agnostic bioinformatics agent harness — hand-rolled agent loop, DBOS-durable workflows, sandboxed compute.",
     "license": "Apache-2.0",
     "type": "module",
@@ -69,8 +69,8 @@
         "cheerio": "^1.2.0",
         "dockerode": "^4.0.12",
         "echarts": "5.5.1",
-        "fast-xml-parser": "^5.10.0",
-        "hono": "^4.12.30",
+        "fast-xml-parser": "^5.10.1",
+        "hono": "^4.12.34",
         "hyparquet": "^1.28.1",
         "js-tiktoken": "^1.0.21",
         "mime": "^4.1.0",
@@ -83,6 +83,13 @@
         "puppeteer-core": "^23.11.1",
         "zod": "^4.4.3"
     },
+    "overrides": {
+        "ip-address": "^10.3.1",
+        "js-yaml": "^4.3.1",
+        "protobufjs": "^7.6.5",
+        "undici": "^7.29.0",
+        "uuid": "^11.1.1"
+    },
     "devDependencies": {
         "@eslint/js": "^10.0.1",
         "@types/bun": "latest",