@inflexa-ai/harness 0.26.3 → 0.28.0

package/dist/app/data-profile-orientation.d.ts

@@ -13,6 +13,13 @@
  *
  * A pure function over the record — no I/O, no LLM, no pipeline. It is the whole
  * mechanism.
+ *
+ * Every path it renders is projected into the frame-independent
+ * `/{analysisId}/…` form. The record stores a path relative to the analysis
+ * root, which is the correct form to store; but a step agent resolves a relative
+ * path against its own working directory, thus the stored form names a file that
+ * does not exist there. The absolute form resolves to the same file in every
+ * frame, including the conversation agent's, so the projection is unconditional.
  */
 import type { DataProfileResult } from "../state/data-profile.js";
 /** The character budget the projection guarantees it will not exceed. */
@@ -30,5 +37,9 @@ export declare const DATA_PROFILE_ORIENTATION_MAX_CHARS = 1200;
  * A snapshot written before the record was widened carries none of the structured
  * fields. Rather than emit a bare file list, that case falls back to the narrative
  * summary — the one orientation a legacy row does have.
+ *
+ * `analysisId` roots each rendered file path (see the module header). It is the
+ * id of the analysis the profile belongs to, and it is what the sandbox mounts
+ * the tree at.
  */
-export declare function buildDataProfileOrientation(result: DataProfileResult, maxChars?: number): string;
+export declare function buildDataProfileOrientation(result: DataProfileResult, analysisId: string, maxChars?: number): string;

package/dist/app/data-profile-orientation.js

@@ -13,7 +13,15 @@
  *
  * A pure function over the record — no I/O, no LLM, no pipeline. It is the whole
  * mechanism.
+ *
+ * Every path it renders is projected into the frame-independent
+ * `/{analysisId}/…` form. The record stores a path relative to the analysis
+ * root, which is the correct form to store; but a step agent resolves a relative
+ * path against its own working directory, thus the stored form names a file that
+ * does not exist there. The absolute form resolves to the same file in every
+ * frame, including the conversation agent's, so the projection is unconditional.
  */
+import { toAnalysisRootPath } from "../workspace/paths.js";
 /** The character budget the projection guarantees it will not exceed. */
 export const DATA_PROFILE_ORIENTATION_MAX_CHARS = 1200;
 /** Files listed before the tail is elided (the count still reports the total). */
@@ -81,8 +89,12 @@ function formatFileFacts(file) {
  * A snapshot written before the record was widened carries none of the structured
  * fields. Rather than emit a bare file list, that case falls back to the narrative
  * summary — the one orientation a legacy row does have.
+ *
+ * `analysisId` roots each rendered file path (see the module header). It is the
+ * id of the analysis the profile belongs to, and it is what the sandbox mounts
+ * the tree at.
  */
-export function buildDataProfileOrientation(result, maxChars = DATA_PROFILE_ORIENTATION_MAX_CHARS) {
+export function buildDataProfileOrientation(result, analysisId, maxChars = DATA_PROFILE_ORIENTATION_MAX_CHARS) {
     const lines = [];
     const identity = [
         [present(result.domain), present(result.subtype)].filter((f) => f !== undefined).join(" / ") || undefined,
@@ -139,7 +151,7 @@ export function buildDataProfileOrientation(result, maxChars = DATA_PROFILE_ORIE
         const header = shown.length < result.files.length ? `${label} (${shown.length} of ${result.files.length}):` : `${label} (${result.files.length}):`;
         lines.push(header);
         for (const file of shown) {
-            lines.push(`- ${file.path} — ${clip(file.description, MAX_FILE_DESCRIPTION_CHARS)}${formatFileFacts(file)}`);
+            lines.push(`- ${toAnalysisRootPath(analysisId, file.path)} — ${clip(file.description, MAX_FILE_DESCRIPTION_CHARS)}${formatFileFacts(file)}`);
         }
     }
     return clamp(lines.join("\n"), maxChars);

package/dist/prompts/briefing.d.ts

@@ -48,20 +48,30 @@ export declare const STEP_NON_TASK_FIELDS: readonly ["id", "track", "step_type",
  * improvises the rest.
  */
 export declare function renderTask(step: AnalysisStep): string;
-/** The two in-sandbox paths that anchor every path the agent writes or reads. */
+/**
+ * What anchors every path the agent writes or reads: the id the tree is mounted
+ * at, and the step's writable directory.
+ *
+ * The frame carries the id rather than the analysis root, because the root is
+ * `/{analysisId}` and two fields for one value can disagree. The id is also what
+ * every other path in the briefing is rooted with, thus one field serves the
+ * workspace section and the orientation alike.
+ */
 export interface WorkspaceFrame {
-    /** In-sandbox analysis root — the read-only mount of the whole analysis tree. */
-    readonly analysisRoot: string;
+    /** The analysis id. The sandbox mounts the read-only analysis tree at `/{analysisId}`. */
+    readonly analysisId: string;
     /** In-sandbox working directory — this step's writable artifact directory, and its cwd. */
     readonly workingDir: string;
 }
+/** The in-sandbox analysis root of a frame — the read-only mount of the whole tree. */
+export declare function analysisRootOf(frame: WorkspaceFrame): string;
 export declare function renderWorkspace(frame: WorkspaceFrame): string;
 /**
  * What dataset the analysis is holding, projected from the persisted profile.
  * Absent or not-yet-profiled → `""`, and the agent falls back to its always-on
  * `inspect_data_profile` tool.
  */
-export declare function renderOrientation(profile: DataProfileResult | null | undefined): string;
+export declare function renderOrientation(profile: DataProfileResult | null | undefined, analysisId: string): string;
 /**
  * One completed dependency's handoff. The seed carries the gist plus the PATHS
  * to the rest — an agent that needs more than the excerpt reads the summary at

package/dist/prompts/briefing.js

@@ -104,12 +104,17 @@ export function renderTask(step) {
     }
     return parts.join("\n\n");
 }
+/** The in-sandbox analysis root of a frame — the read-only mount of the whole tree. */
+export function analysisRootOf(frame) {
+    return `/${frame.analysisId}`;
+}
 export function renderWorkspace(frame) {
-    if (!frame.analysisRoot.trim() || !frame.workingDir.trim())
+    if (!frame.analysisId.trim() || !frame.workingDir.trim())
         return "";
+    const analysisRoot = analysisRootOf(frame);
     return section("Workspace", bullets([
         `Working directory (writable, your cwd): \`${frame.workingDir}\` — write outputs to \`output/\`, \`figures/\`, \`scripts/\`, \`logs/\` under it.`,
-        `Analysis root (read-only): \`${frame.analysisRoot}\` — inputs at \`${frame.analysisRoot}/data/inputs/\`, prior runs at \`${frame.analysisRoot}/runs/\`.`,
+        `Analysis root (read-only): \`${analysisRoot}\` — inputs at \`${analysisRoot}/data/inputs/\`, prior runs at \`${analysisRoot}/runs/\`.`,
     ]));
 }
 // ── (3) Data orientation ──────────────────────────────────────────────
@@ -118,10 +123,10 @@ export function renderWorkspace(frame) {
  * Absent or not-yet-profiled → `""`, and the agent falls back to its always-on
  * `inspect_data_profile` tool.
  */
-export function renderOrientation(profile) {
+export function renderOrientation(profile, analysisId) {
     if (!profile)
         return "";
-    const orientation = buildDataProfileOrientation(profile, DATA_PROFILE_ORIENTATION_MAX_CHARS);
+    const orientation = buildDataProfileOrientation(profile, analysisId, DATA_PROFILE_ORIENTATION_MAX_CHARS);
     if (orientation.trim().length === 0)
         return "";
     return section("Data orientation", `${orientation}\n\nThis is a bounded projection — call \`inspect_data_profile\` for the full profile.`);
@@ -160,7 +165,12 @@ function renderHandoff(handoff) {
  * caller's durable step replay-stable.
  */
 export function composeStepBriefing(briefing) {
-    return [renderTask(briefing.step), renderWorkspace(briefing.workspace), renderOrientation(briefing.profile), renderUpstream(briefing.upstream)]
+    return [
+        renderTask(briefing.step),
+        renderWorkspace(briefing.workspace),
+        renderOrientation(briefing.profile, briefing.workspace.analysisId),
+        renderUpstream(briefing.upstream),
+    ]
         .filter(Boolean)
         .join("\n\n");
 }

package/dist/sandbox/await-exec.js

@@ -55,6 +55,7 @@
  * varied between replays would desynchronise the recorded function-ID sequence.
  */
 import { DBOS } from "@dbos-inc/dbos-sdk";
+import { digestBody } from "./digest.js";
 import { signCallback, verifyCallback } from "./hmac.js";
 import { createEscalationPolicy, probeLiveness, syntheticFailureReason, syntheticFailureResult } from "./liveness.js";
 import { ExecResultSchema, isDoneMarker, isSyntheticFailure, PollResponseSchema, } from "./types.js";
@@ -233,13 +234,16 @@ export async function awaitExecCallback(ref, execId, emit, deadlineMs, options =
             throw new HardCancelError(execId, "synthetic-without-marker");
         }
         // Verify against the exact bytes sandbox-server signed. The route
-        // preserves them as `payloadRaw`; the JSON.stringify fallback exists
-        // only for messages persisted before that field was added — re-
-        // serializing diverges from Go's HTML-escaping encoder.
-        const bodyBytes = Buffer.from(msg.payloadRaw ?? JSON.stringify(msg.payload), "utf8");
+        // reduces them to `payloadDigest` at ingress — the signature covers that
+        // digest, so it is all verification needs and the message never carries
+        // a second copy of the body. `payloadRaw` is the superseded form, and
+        // the JSON.stringify fallback covers messages persisted before either
+        // field existed — re-serializing diverges from Go's HTML-escaping
+        // encoder, so it is a last resort, not a normal path.
+        const bodyDigest = msg.payloadDigest ?? digestBody(Buffer.from(msg.payloadRaw ?? JSON.stringify(msg.payload), "utf8"));
         const result = verifyCallback({
             execId,
-            body: bodyBytes,
+            bodyDigest,
             signature: msg.signature,
             timestamp: msg.timestamp,
             secret: callbackSecret,

package/dist/sandbox/create-sandbox.d.ts

@@ -45,6 +45,13 @@ export interface CreateSandboxClientConfig {
     transport?: SandboxTransport;
     /** Default sandbox-base image when the workflow doesn't override per-step. */
     image: string;
+    /**
+     * Per-stream retention budget sent with every exec, so the sandbox drops
+     * output past it instead of shipping it. Defaults to `EXEC_STREAM_BYTE_CAP`,
+     * the same value the host truncates to on receipt — sending more than the
+     * host will keep buys nothing.
+     */
+    execStreamByteCap?: number;
     /** Cluster resource ceilings; every sandbox request is clamped to these. */
     resourceLimits: ResourceLimits;
     /** K8s namespace; only used by the k8s backend. */

package/dist/sandbox/create-sandbox.js

@@ -18,6 +18,7 @@ import { tailWritePrefix } from "../workspace/paths.js";
 import { tryMutation } from "../lib/db-result.js";
 import { unwrapOrThrow } from "../lib/result.js";
 import { clearSandboxRef, setSandboxRef } from "../state/index.js";
+import { capExecStreams, EXEC_STREAM_BYTE_CAP } from "../tools/workspace/result-bounds.js";
 import { awaitExec } from "./await-exec.js";
 import { createDockerSandboxOps } from "./docker-client.js";
 import { createK8sSandboxOps } from "./k8s-client.js";
@@ -145,8 +146,16 @@ export function createSandboxClient(config) {
             const resources = clampResources(meta.resources, config.resourceLimits);
             return unwrapOrThrow(await ops.createSandbox({ ...meta, resources }, identity));
         },
-        submitExec: async (ref, body) => submitExec(ref, body, config.submitDeps),
-        awaitExec: (ref, execId, emit, deadline) => awaitExec(ref, execId, emit, deadline, composeAwaitOptions(config.awaitOptions, transport, isAlive)),
+        submitExec: async (ref, body) => submitExec(ref, body, {
+            ...config.submitDeps,
+            execStreamByteCap: config.submitDeps?.execStreamByteCap ?? config.execStreamByteCap,
+        }),
+        // The one place an ExecResult crosses from the wire into the process, so
+        // the cap lands here rather than at each consumer. Every downstream use —
+        // tool results, workflow return values, durable step outputs — is bounded
+        // by construction, including against a sandbox image that predates the
+        // retention budget and still returns whole streams.
+        awaitExec: async (ref, execId, emit, deadline) => capExecStreams(await awaitExec(ref, execId, emit, deadline, composeAwaitOptions(config.awaitOptions, transport, isAlive)), config.execStreamByteCap ?? EXEC_STREAM_BYTE_CAP),
         isAlive,
         isAliveById: async (sandboxId) => unwrapOrThrow(await ops.isAliveById(sandboxId)),
         teardown,

package/dist/sandbox/digest.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Body digest for sandbox callbacks.
+ *
+ * The callback signature is taken over the hex SHA-256 of the POSTed body
+ * rather than over the body itself, so the digest is a value the ingress can
+ * compute and forward while the bytes themselves are dropped — verification
+ * downstream needs nothing more.
+ *
+ * This lives apart from `hmac.ts` on purpose. Hashing carries no secret and
+ * decides nothing, so the route that only forwards can depend on it without
+ * taking on the verification machinery it is required to stay clear of.
+ */
+/** Hex SHA-256 of the POSTed bytes — the value the callback signature covers. */
+export declare function digestBody(input: Buffer | string): string;

package/dist/sandbox/digest.js

@@ -0,0 +1,17 @@
+/**
+ * Body digest for sandbox callbacks.
+ *
+ * The callback signature is taken over the hex SHA-256 of the POSTed body
+ * rather than over the body itself, so the digest is a value the ingress can
+ * compute and forward while the bytes themselves are dropped — verification
+ * downstream needs nothing more.
+ *
+ * This lives apart from `hmac.ts` on purpose. Hashing carries no secret and
+ * decides nothing, so the route that only forwards can depend on it without
+ * taking on the verification machinery it is required to stay clear of.
+ */
+import { createHash } from "node:crypto";
+/** Hex SHA-256 of the POSTed bytes — the value the callback signature covers. */
+export function digestBody(input) {
+    return createHash("sha256").update(input).digest("hex");
+}

package/dist/sandbox/hmac.d.ts

@@ -16,8 +16,16 @@
  */
 export interface VerifyCallbackInput {
     execId: string;
-    /** The bytes the sandbox-server POSTed. The dumb route preserves them. */
-    body: Buffer | string;
+    /**
+     * The bytes the sandbox-server POSTed. Supply this or `bodyDigest`.
+     *
+     * The signature covers the hex SHA-256 of the body, never the body itself,
+     * so a caller that has already hashed the bytes can verify from the digest
+     * alone — which is what keeps a large payload from being carried twice.
+     */
+    body?: Buffer | string;
+    /** Hex SHA-256 of the POSTed bytes. Takes precedence over `body`. */
+    bodyDigest?: string;
     /** `X-Sandbox-Signature` value (lowercase hex). */
     signature: string | null;
     /** `X-Sandbox-Timestamp` value (unix seconds). */

package/dist/sandbox/hmac.js

@@ -14,7 +14,8 @@
  * NetworkPolicy isolation a forged event implies a bug or a breach,
  * neither of which should keep a 3-hour sandbox burning.
  */
-import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { digestBody } from "./digest.js";
 /**
  * Decode the per-sandbox secret. sandbox-server accepts both raw UTF-8
  * and `base64:` prefixed values (change 4 spec); we mirror the same
@@ -28,7 +29,7 @@ function decodeSecret(secret) {
     return Buffer.from(secret, "utf8");
 }
 function sha256Hex(input) {
-    return createHash("sha256").update(input).digest("hex");
+    return digestBody(input);
 }
 /**
  * Recompute the HMAC and compare in constant time, then check the
@@ -43,8 +44,12 @@ export function verifyCallback(input) {
     if (input.signature === null || input.timestamp === null) {
         return { valid: false, reason: "missing" };
     }
+    const digest = input.bodyDigest ?? (input.body !== undefined ? sha256Hex(input.body) : undefined);
+    if (digest === undefined) {
+        return { valid: false, reason: "missing" };
+    }
     const secretBytes = decodeSecret(input.secret);
-    const message = `${input.execId}:${input.timestamp}:${sha256Hex(input.body)}`;
+    const message = `${input.execId}:${input.timestamp}:${digest}`;
     const expected = createHmac("sha256", secretBytes).update(message).digest("hex");
     const provided = input.signature;
     if (provided.length !== expected.length) {

package/dist/sandbox/submit-exec.d.ts

@@ -24,6 +24,11 @@ export interface SubmitExecDeps {
     runStep?: <T>(fn: () => Promise<T>, config: {
         name: string;
     }) => Promise<T>;
+    /**
+     * Per-stream retention budget to send when the body does not carry one.
+     * Defaults to `EXEC_STREAM_BYTE_CAP`.
+     */
+    execStreamByteCap?: number;
 }
 /**
  * Submit an exec as a DBOS step. The step name is unique per execId, so

package/dist/sandbox/submit-exec.js

@@ -17,6 +17,7 @@
  * untouched.
  */
 import { DBOS } from "@dbos-inc/dbos-sdk";
+import { EXEC_STREAM_BYTE_CAP } from "../tools/workspace/result-bounds.js";
 import { signCallback } from "./hmac.js";
 const SUBMIT_HTTP_TIMEOUT_MS = 30_000;
 async function postExec(fetchImpl, ref, body) {
@@ -62,7 +63,15 @@ async function postExec(fetchImpl, ref, body) {
 export async function submitExec(ref, body, deps = {}) {
     const fetchImpl = deps.fetch ?? fetch;
     const runStep = deps.runStep ?? ((fn, c) => DBOS.runStep(fn, c));
-    await runStep(() => postExec(fetchImpl, ref, body), {
+    // Every exec in the process funnels through here, so this is where the
+    // retention budget is attached rather than at each of the callers that build
+    // a body. Applied before signing, since the signature covers these bytes.
+    const capped = {
+        ...body,
+        stdoutByteCap: body.stdoutByteCap ?? deps.execStreamByteCap ?? EXEC_STREAM_BYTE_CAP,
+        stderrByteCap: body.stderrByteCap ?? deps.execStreamByteCap ?? EXEC_STREAM_BYTE_CAP,
+    };
+    await runStep(() => postExec(fetchImpl, ref, capped), {
         name: `sandbox.submit-exec.${body.execId}`,
     });
 }

package/dist/sandbox/types.d.ts

@@ -103,6 +103,10 @@ export declare const ExecResultSchema: z.ZodObject<{
     stderr: z.ZodDefault<z.ZodString>;
     durationMs: z.ZodNullable<z.ZodNumber>;
     timedOut: z.ZodDefault<z.ZodBoolean>;
+    stdoutTruncated: z.ZodOptional<z.ZodBoolean>;
+    stderrTruncated: z.ZodOptional<z.ZodBoolean>;
+    stdoutTotalBytes: z.ZodOptional<z.ZodNumber>;
+    stderrTotalBytes: z.ZodOptional<z.ZodNumber>;
     syntheticFailure: z.ZodOptional<z.ZodObject<{
         reason: z.ZodString;
     }, z.core.$strip>>;
@@ -128,15 +132,21 @@ export type ExecResult = z.infer<typeof ExecResultSchema>;
  * a non-null `signature` and `timestamp`; the in-process watchdog uses a
  * `null` signature + a `synthetic-failure` payload (see `await-exec.ts`).
  *
- * `payloadRaw` is the exact bytes sandbox-server POSTed — sandbox-server's
- * HMAC signs the raw body, and Go's `encoding/json` HTML-escapes `<`, `>`,
- * `&` by default, so verifying against a JS re-serialization of the parsed
- * payload would diverge for any output containing those characters
- * (common in bioinformatics: FASTA headers, shell stderr, command pipelines).
- * Optional only for back-compat with messages that pre-date this field.
+ * `payloadDigest` is the hex SHA-256 of the exact bytes sandbox-server POSTed.
+ * The HMAC signs that digest rather than the body itself, so the digest is all
+ * verification needs — and carrying it instead of the bytes keeps the message
+ * from holding a second copy of a payload that can be arbitrarily large.
+ * Re-serializing the parsed payload would not do: Go's `encoding/json`
+ * HTML-escapes `<`, `>`, `&` by default, so a JS re-serialization diverges for
+ * any output containing those characters (common in bioinformatics: FASTA
+ * headers, shell stderr, command pipelines).
+ *
+ * `payloadRaw` is the superseded form, kept optional so messages already in
+ * flight or persisted still verify.
  */
 export declare const ExecEventMessageSchema: z.ZodObject<{
     payload: z.ZodUnknown;
+    payloadDigest: z.ZodOptional<z.ZodString>;
     payloadRaw: z.ZodOptional<z.ZodString>;
     signature: z.ZodNullable<z.ZodString>;
     timestamp: z.ZodNullable<z.ZodNumber>;
@@ -175,6 +185,10 @@ export declare const PollResponseSchema: z.ZodObject<{
         stderr: z.ZodDefault<z.ZodString>;
         durationMs: z.ZodNullable<z.ZodNumber>;
         timedOut: z.ZodDefault<z.ZodBoolean>;
+        stdoutTruncated: z.ZodOptional<z.ZodBoolean>;
+        stderrTruncated: z.ZodOptional<z.ZodBoolean>;
+        stdoutTotalBytes: z.ZodOptional<z.ZodNumber>;
+        stderrTotalBytes: z.ZodOptional<z.ZodNumber>;
         syntheticFailure: z.ZodOptional<z.ZodObject<{
             reason: z.ZodString;
         }, z.core.$strip>>;
@@ -220,6 +234,14 @@ export interface SubmitExecBody {
     cwd?: string;
     env?: Record<string, string>;
     timeoutSeconds?: number;
+    /**
+     * Per-stream retention budget for the sandbox. Omitting them leaves the
+     * sandbox unbounded, which is how a server that pre-dates the fields
+     * behaves; the host caps on receipt regardless, so the difference is how
+     * many bytes cross the wire, not what the caller ends up with.
+     */
+    stdoutByteCap?: number;
+    stderrByteCap?: number;
 }
 /** Step-meta passed to `createSandbox` — what the registry row needs. */
 export interface CreateSandboxMeta {

package/dist/sandbox/types.js

@@ -79,6 +79,19 @@ export const ExecResultSchema = z.object({
     stderr: z.string().default(""),
     durationMs: z.number().nullable(),
     timedOut: z.boolean().default(false),
+    /**
+     * Set when sandbox-server dropped output past the per-stream cap it was
+     * given. The total is what the command actually produced, which is what
+     * separates "printed nothing" from "printed more than we kept" — without it
+     * a capped stream and an empty one are indistinguishable downstream.
+     *
+     * Optional because a sandbox image that pre-dates the cap omits both, and
+     * because the watchdog's synthetic failures carry neither.
+     */
+    stdoutTruncated: z.boolean().optional(),
+    stderrTruncated: z.boolean().optional(),
+    stdoutTotalBytes: z.number().int().nonnegative().optional(),
+    stderrTotalBytes: z.number().int().nonnegative().optional(),
     /** Set when the watchdog synthesises a completion for a dead sandbox. */
     syntheticFailure: z
         .object({
@@ -97,15 +110,21 @@ export const ExecResultSchema = z.object({
  * a non-null `signature` and `timestamp`; the in-process watchdog uses a
  * `null` signature + a `synthetic-failure` payload (see `await-exec.ts`).
  *
- * `payloadRaw` is the exact bytes sandbox-server POSTed — sandbox-server's
- * HMAC signs the raw body, and Go's `encoding/json` HTML-escapes `<`, `>`,
- * `&` by default, so verifying against a JS re-serialization of the parsed
- * payload would diverge for any output containing those characters
- * (common in bioinformatics: FASTA headers, shell stderr, command pipelines).
- * Optional only for back-compat with messages that pre-date this field.
+ * `payloadDigest` is the hex SHA-256 of the exact bytes sandbox-server POSTed.
+ * The HMAC signs that digest rather than the body itself, so the digest is all
+ * verification needs — and carrying it instead of the bytes keeps the message
+ * from holding a second copy of a payload that can be arbitrarily large.
+ * Re-serializing the parsed payload would not do: Go's `encoding/json`
+ * HTML-escapes `<`, `>`, `&` by default, so a JS re-serialization diverges for
+ * any output containing those characters (common in bioinformatics: FASTA
+ * headers, shell stderr, command pipelines).
+ *
+ * `payloadRaw` is the superseded form, kept optional so messages already in
+ * flight or persisted still verify.
  */
 export const ExecEventMessageSchema = z.object({
     payload: z.unknown(),
+    payloadDigest: z.string().optional(),
     payloadRaw: z.string().optional(),
     signature: z.string().nullable(),
     timestamp: z.number().int().nullable(),

package/dist/state/init.js

@@ -428,6 +428,7 @@ CREATE TABLE IF NOT EXISTS cortex_working_memory (
 CREATE TABLE IF NOT EXISTS cortex_asks (
   id           TEXT PRIMARY KEY,
   analysis_id  TEXT NOT NULL,
+  user_id      TEXT,
   thread_id    TEXT,
   title        TEXT NOT NULL,
   command      TEXT NOT NULL,
@@ -451,16 +452,17 @@ CREATE INDEX IF NOT EXISTS idx_cortex_asks_analysis
 CREATE INDEX IF NOT EXISTS idx_cortex_asks_pending
   ON cortex_asks(status) WHERE status = 'pending';
 
--- Standing approval grants behind an 'always' reply — keyed by the analysis and
--- the ask's grant key (the displayed command when the tool supplied no broader
--- key), so a later matching ask auto-approves without pausing. Lives for the
--- analysis lifecycle, surviving process restarts, and never applies to another
--- analysis.
+-- Standing approval grants behind an 'always' reply — keyed by the analysis, the
+-- user, and the ask's grant key (the displayed command when the tool supplied no
+-- broader key), so a later matching ask auto-approves without pausing. Lives for
+-- the analysis lifecycle, surviving process restarts, and never applies to
+-- another analysis or another user.
 CREATE TABLE IF NOT EXISTS cortex_ask_grants (
   analysis_id  TEXT NOT NULL,
+  user_id      TEXT NOT NULL,
   grant_key    TEXT NOT NULL,
   created_at   TEXT NOT NULL,
-  PRIMARY KEY (analysis_id, grant_key)
+  PRIMARY KEY (analysis_id, user_id, grant_key)
 );
 `;
 /**
@@ -640,6 +642,21 @@ export async function initCortexState(pool, injected) {
                     ALTER TABLE cortex_ask_grants RENAME COLUMN command TO grant_key;
                   END IF;
                 END $$`,
+                "ALTER TABLE cortex_asks ADD COLUMN IF NOT EXISTS user_id TEXT",
+                // The user joins the grant key. Guarded and scoped like the rename
+                // above. An existing row keeps the empty default, which matches no real
+                // identity, so it is inert rather than deleted.
+                `DO $$ BEGIN
+                  IF NOT EXISTS (
+                    SELECT 1 FROM information_schema.columns
+                    WHERE table_schema = current_schema() AND table_name = 'cortex_ask_grants' AND column_name = 'user_id'
+                  ) THEN
+                    ALTER TABLE cortex_ask_grants ADD COLUMN user_id TEXT NOT NULL DEFAULT '';
+                    ALTER TABLE cortex_ask_grants ALTER COLUMN user_id DROP DEFAULT;
+                    ALTER TABLE cortex_ask_grants DROP CONSTRAINT IF EXISTS cortex_ask_grants_pkey;
+                    ALTER TABLE cortex_ask_grants ADD PRIMARY KEY (analysis_id, user_id, grant_key);
+                  END IF;
+                END $$`,
             ];
             for (const sql of addMigrations) {
                 await client.query(sql);

package/dist/tasks/data-profile.js

@@ -290,7 +290,7 @@ export async function runDataProfileBody(input, deps) {
                 `Profile the input data for this analysis: say what the dataset IS, so planning can proceed.`,
                 ``,
                 renderWorkspace({
-                    analysisRoot: `/${analysisId}`,
+                    analysisId,
                     workingDir: toSandboxPath(workspaceRoot, analysisId, profileWritePrefix),
                 }),
                 ``,

package/dist/tools/ad-hoc-router.js

@@ -53,7 +53,7 @@ async function profileOrientation(pool, analysisId, logger) {
         const status = unwrapOrThrow(await loadDataProfileStatus(pool, analysisId));
         if (!status?.result)
             return "No persisted data-profile facts are available.";
-        return buildDataProfileOrientation(status.result, DATA_PROFILE_ORIENTATION_MAX_CHARS);
+        return buildDataProfileOrientation(status.result, analysisId, DATA_PROFILE_ORIENTATION_MAX_CHARS);
     }
     catch (error) {
         logger.warn("could not load data profile for ad hoc routing", { error: error instanceof Error ? error.message : String(error) });

package/dist/tools/approval/gateway.d.ts

@@ -20,11 +20,13 @@ export interface AskGatewayDeps {
 }
 /**
  * Per-turn context an embedder binds into the `Ask` seam. It scopes the ask to an
- * analysis/thread, carries the turn's abort `signal`, and supplies the `emit` sink
- * the `data-ask` part flows through.
+ * analysis/thread and to one user, carries the turn's abort `signal`, and supplies
+ * the `emit` sink the `data-ask` part flows through.
  */
 export interface AskContext {
     readonly analysisId: string;
+    /** The opaque identity of the person the ask goes to. The harness never reads it. */
+    readonly userId: string;
     readonly threadId?: string;
     readonly signal: AbortSignal;
     readonly emit: EmitFn;

package/dist/tools/approval/gateway.js

@@ -29,6 +29,7 @@ export function createAskGateway(deps) {
         const row = {
             id,
             analysisId: ctx.analysisId,
+            userId: ctx.userId,
             threadId: ctx.threadId ?? null,
             title: request.title,
             command: request.command,
@@ -36,10 +37,10 @@ export function createAskGateway(deps) {
             grantKey: request.grantKey ?? null,
             createdAt: now,
         };
-        // A standing grant for this ask's grant key — the command unless the tool
-        // supplied a broader key — short-circuits the prompt: record the invocation as
-        // `resolved` for the audit trail and return without pausing.
-        if (unwrapOrThrow(await selectGrant(pool, ctx.analysisId, request.grantKey ?? request.command))) {
+        // A standing grant this user holds for this ask's grant key — the command
+        // unless the tool supplied a broader key — short-circuits the prompt: record
+        // the invocation as `resolved` for the audit trail and return without pausing.
+        if (unwrapOrThrow(await selectGrant(pool, ctx.analysisId, ctx.userId, request.grantKey ?? request.command))) {
             unwrapOrThrow(await insertGrantedAsk(pool, row, now));
             return { kind: "always" };
         }

package/dist/tools/approval/queries.d.ts

@@ -21,6 +21,7 @@ export type AnswerOutcome = "applied" | "not_found" | "already_terminal";
 export interface PendingAsk {
     readonly id: string;
     readonly analysisId: string;
+    readonly userId: string;
     readonly threadId: string | null;
     readonly title: string;
     readonly command: string;
@@ -36,6 +37,7 @@ export interface AskResolution {
 export interface AskRow {
     readonly id: string;
     readonly analysisId: string;
+    readonly userId: string;
     readonly threadId: string | null;
     readonly title: string;
     readonly command: string;
@@ -52,8 +54,8 @@ export declare function insertPendingAsk(querier: Querier, row: AskRow): ResultA
  * every approval-gated action. The recorded reply is `{ kind: "always" }`.
  */
 export declare function insertGrantedAsk(querier: Querier, row: AskRow, resolvedAt: string): ResultAsync<void, DbError>;
-/** Does a standing grant cover `(analysisId, grantKey)` in this analysis? */
-export declare function selectGrant(querier: Querier, analysisId: string, grantKey: string): ResultAsync<boolean, DbError>;
+/** Does a standing grant cover `(analysisId, userId, grantKey)` for this person? */
+export declare function selectGrant(querier: Querier, analysisId: string, userId: string, grantKey: string): ResultAsync<boolean, DbError>;
 /** Read a row's current status + recorded reply. `null` when no such row exists. */
 export declare function selectAskResolution(querier: Querier, id: string): ResultAsync<AskResolution | null, DbError>;
 /**

package/dist/tools/approval/queries.js

@@ -15,9 +15,9 @@ export function insertPendingAsk(querier, row) {
     return tryMutation("asks.insertPending", async () => {
         await querier.query({
             text: `INSERT INTO cortex_asks
-              (id, analysis_id, thread_id, title, command, detail, grant_key, status, created_at)
-              VALUES ($1, $2, $3, $4, $5, $6, $7, 'pending', $8)`,
-            values: [row.id, row.analysisId, row.threadId, row.title, row.command, row.detail, row.grantKey ?? row.command, row.createdAt],
+              (id, analysis_id, user_id, thread_id, title, command, detail, grant_key, status, created_at)
+              VALUES ($1, $2, $3, $4, $5, $6, $7, $8, 'pending', $9)`,
+            values: [row.id, row.analysisId, row.userId, row.threadId, row.title, row.command, row.detail, row.grantKey ?? row.command, row.createdAt],
         });
     });
 }
@@ -30,11 +30,12 @@ export function insertGrantedAsk(querier, row, resolvedAt) {
     return tryMutation("asks.insertGranted", async () => {
         await querier.query({
             text: `INSERT INTO cortex_asks
-              (id, analysis_id, thread_id, title, command, detail, grant_key, status, reply, created_at, resolved_at)
-              VALUES ($1, $2, $3, $4, $5, $6, $7, 'resolved', $8::jsonb, $9, $10)`,
+              (id, analysis_id, user_id, thread_id, title, command, detail, grant_key, status, reply, created_at, resolved_at)
+              VALUES ($1, $2, $3, $4, $5, $6, $7, $8, 'resolved', $9::jsonb, $10, $11)`,
             values: [
                 row.id,
                 row.analysisId,
+                row.userId,
                 row.threadId,
                 row.title,
                 row.command,
@@ -47,12 +48,12 @@ export function insertGrantedAsk(querier, row, resolvedAt) {
         });
     });
 }
-/** Does a standing grant cover `(analysisId, grantKey)` in this analysis? */
-export function selectGrant(querier, analysisId, grantKey) {
+/** Does a standing grant cover `(analysisId, userId, grantKey)` for this person? */
+export function selectGrant(querier, analysisId, userId, grantKey) {
     return tryQuery("asks.selectGrant", async () => {
         const result = await querier.query({
-            text: `SELECT 1 FROM cortex_ask_grants WHERE analysis_id = $1 AND grant_key = $2`,
-            values: [analysisId, grantKey],
+            text: `SELECT 1 FROM cortex_ask_grants WHERE analysis_id = $1 AND user_id = $2 AND grant_key = $3`,
+            values: [analysisId, userId, grantKey],
         });
         return (result.rowCount ?? 0) > 0;
     });
@@ -86,12 +87,13 @@ export function markAborted(querier, id, resolvedAt) {
 export function selectPending(querier) {
     return tryQuery("asks.selectPending", async () => {
         const result = await querier.query({
-            text: `SELECT id, analysis_id, thread_id, title, command, detail, created_at
+            text: `SELECT id, analysis_id, COALESCE(user_id, '') AS user_id, thread_id, title, command, detail, created_at
               FROM cortex_asks WHERE status = 'pending' ORDER BY created_at ASC`,
         });
         return result.rows.map((row) => ({
             id: row.id,
             analysisId: row.analysis_id,
+            userId: row.user_id,
             threadId: row.thread_id ?? null,
             title: row.title,
             command: row.command,
@@ -133,7 +135,7 @@ export function answerAsk(pool, id, reply, now) {
     return withTransaction(pool, "asks.answer", (client) => tryMutation("asks.answer:update", () => client.query({
         text: `UPDATE cortex_asks SET status = $1, reply = $2::jsonb, resolved_at = $3
                   WHERE id = $4 AND status = 'pending'
-                  RETURNING analysis_id, COALESCE(grant_key, command) AS grant_key`,
+                  RETURNING analysis_id, COALESCE(user_id, '') AS user_id, COALESCE(grant_key, command) AS grant_key`,
         values: [status, JSON.stringify(reply), now, id],
     })).andThen((updated) => {
         if ((updated.rowCount ?? 0) === 0)
@@ -144,12 +146,14 @@ export function answerAsk(pool, id, reply, now) {
         // caveat: every insert writes grant_key (command when the tool supplied
         // none), and the COALESCE above covers any pending row that predates
         // the column — `command` is NOT NULL, so the key can never be null.
+        // `user_id` reads the same way: its COALESCE gives the empty string for a
+        // row that predates the column, and that identity matches no real user.
         const granted = updated.rows[0];
         return tryMutation("asks.answer:grant", async () => {
             await client.query({
-                text: `INSERT INTO cortex_ask_grants (analysis_id, grant_key, created_at)
-                      VALUES ($1, $2, $3) ON CONFLICT (analysis_id, grant_key) DO NOTHING`,
-                values: [granted.analysis_id, granted.grant_key, now],
+                text: `INSERT INTO cortex_ask_grants (analysis_id, user_id, grant_key, created_at)
+                      VALUES ($1, $2, $3, $4) ON CONFLICT (analysis_id, user_id, grant_key) DO NOTHING`,
+                values: [granted.analysis_id, granted.user_id, granted.grant_key, now],
             });
         }).map(() => "applied");
     }));

package/dist/tools/research/generate-plan.js

@@ -209,7 +209,7 @@ const NO_FACTS_GUIDANCE = "Plan from the research question alone, do not invent
  *
  * Pure — the same grounding renders the same string.
  */
-function renderDataContext(grounding) {
+function renderDataContext(grounding, analysisId) {
     switch (grounding.kind) {
         case "absent":
             return "";
@@ -230,7 +230,7 @@ function renderDataContext(grounding) {
                 "From this analysis's persisted data profile — the authoritative record of what the input data " +
                     "is, derived by profiling the files themselves. Nobody typed it; ground your plan in it.",
                 "",
-                buildDataProfileOrientation(grounding.result, DATA_PROFILE_ORIENTATION_MAX_CHARS),
+                buildDataProfileOrientation(grounding.result, analysisId, DATA_PROFILE_ORIENTATION_MAX_CHARS),
             ];
             if (grounding.kind === "provisional") {
                 lines.push("", `PROVISIONAL — this profile may not describe the analysis's current inputs: ${grounding.reasons.join("; ")}. ` +
@@ -748,7 +748,7 @@ export function createGeneratePlanTool(deps) {
                 return null;
             });
             const grounding = classifyGrounding(profileStatus);
-            const dataContextBlock = renderDataContext(grounding);
+            const dataContextBlock = renderDataContext(grounding, analysisId);
             // Reference data and package availability are mandatory grounding,
             // not optional planner lookups. Read both inventories host-side before
             // the loop and put their rendered content in the planner's seed.

package/dist/tools/research/inspect-data-profile.d.ts

@@ -19,6 +19,12 @@
  * Lifecycle states are data variants, not errors (the `defineTool` contract): a missing,
  * in-flight, failed, or stale profile is an ordinary, expected outcome the model must be
  * able to reason about, so each returns in the ok channel.
+ *
+ * Every path it serves is projected into the frame-independent `/{analysisId}/…`
+ * form. The record stores a path relative to the analysis root, and a step agent
+ * resolves a relative path against its own working directory — thus the stored
+ * form names a file that does not exist in the frame of the caller. The same
+ * projection guards the step briefing (`app/data-profile-orientation.ts`).
  */
 import type { Pool } from "pg";
 import { type DataProfileFile, type DataProfileResult } from "../../state/index.js";

package/dist/tools/research/inspect-data-profile.js

@@ -19,12 +19,19 @@
  * Lifecycle states are data variants, not errors (the `defineTool` contract): a missing,
  * in-flight, failed, or stale profile is an ordinary, expected outcome the model must be
  * able to reason about, so each returns in the ok channel.
+ *
+ * Every path it serves is projected into the frame-independent `/{analysisId}/…`
+ * form. The record stores a path relative to the analysis root, and a step agent
+ * resolves a relative path against its own working directory — thus the stored
+ * form names a file that does not exist in the frame of the caller. The same
+ * projection guards the step briefing (`app/data-profile-orientation.ts`).
  */
 import { ok } from "neverthrow";
 import { z } from "zod";
 import { scopeResource } from "../../auth/types.js";
 import { unwrapOrThrow } from "../../lib/result.js";
 import { loadDataProfileStatus } from "../../state/index.js";
+import { toAnalysisRootPath } from "../../workspace/paths.js";
 import { defineTool } from "../define-tool.js";
 /** Per-file records returned per page when the caller names none. */
 const DEFAULT_PAGE_SIZE = 20;
@@ -44,6 +51,20 @@ function datasetFileCount(result) {
         return result.kinds.reduce((sum, kind) => sum + kind.count, 0);
     return null;
 }
+/** Serve each per-file record with a path that resolves in the frame of the caller. */
+function rootFilePaths(files, analysisId) {
+    return files.map((file) => ({ ...file, path: toAnalysisRootPath(analysisId, file.path) }));
+}
+/**
+ * Serve each kind with a glob that resolves in the frame of the caller.
+ *
+ * A `pathPattern` is a path with a wildcard segment, thus it takes the same
+ * projection as a file path. The wildcard characters survive it: the projection
+ * only re-roots the pattern.
+ */
+function rootKindPatterns(kinds, analysisId) {
+    return kinds.map((kind) => ({ ...kind, pathPattern: toAnalysisRootPath(analysisId, kind.pathPattern) }));
+}
 /**
  * Name every reason the served profile may not describe the current inputs.
  *
@@ -212,7 +233,7 @@ export function createInspectDataProfileTool(pool) {
                     ...envelope,
                     scope: "kinds",
                     available: true,
-                    kinds: result.kinds,
+                    kinds: rootKindPatterns(result.kinds, resourceId),
                     ...(result.axes ? { axes: result.axes } : {}),
                     ...(result.coverage ? { coverage: result.coverage } : {}),
                 });
@@ -229,7 +250,7 @@ export function createInspectDataProfileTool(pool) {
                 pageSize,
                 total,
                 hasMore: start + files.length < total,
-                files,
+                files: rootFilePaths(files, resourceId),
             });
         },
     });

package/dist/tools/workspace/result-bounds.d.ts

@@ -8,9 +8,14 @@
  * The cap is well below the loop's overall result budget so a chatty
  * command cannot blow the context window even when stdout AND stderr both
  * cap out at the limit.
+ *
+ * The same value is sent to the sandbox as a retention budget, so the bytes are
+ * dropped at the producer and never cross the wire. Capping here as well is not
+ * redundant: a sandbox image that pre-dates the budget returns the whole stream,
+ * and this is the boundary that keeps it out of the process either way.
  */
 import type { ExecResult } from "../../sandbox/types.js";
-/** Per-stream cap. 8 KiB — multi-KB but well under the loop result budget. */
+/** Per-stream cap. 32 KiB — roomy for real output, well under the loop result budget. */
 export declare const EXEC_STREAM_BYTE_CAP: number;
 export interface BoundedStream {
     readonly content: string;
@@ -33,10 +38,24 @@ export interface BoundedExecResult {
         readonly reason: string;
     };
 }
+/**
+ * Bound an `ExecResult`'s streams while keeping its shape.
+ *
+ * `boundExecResult` produces the tool-facing form; this is for the boundaries
+ * that have to forward an `ExecResult` onward — notably a workflow return value,
+ * which DBOS serializes into its durable step output. Returns the input
+ * unchanged when nothing needed cutting, so the common path allocates nothing.
+ */
+export declare function capExecStreams(result: ExecResult, cap?: number): ExecResult;
 /**
  * Apply per-stream truncation to an `ExecResult`. `exitCode`, `durationMs`,
  * `timedOut`, and `syntheticFailure` pass through unchanged regardless of
  * stream truncation — the discriminants the loop and the model rely on are
  * preserved.
+ *
+ * When the sandbox already truncated at the producer, what arrives here is the
+ * retained slice, not the stream — so its length is the wrong number to report.
+ * The sandbox's own totals win where present, and truncation is the union of the
+ * two cuts: either side having dropped bytes makes the result truncated.
  */
 export declare function boundExecResult(result: ExecResult, cap?: number): BoundedExecResult;

package/dist/tools/workspace/result-bounds.js

@@ -8,16 +8,46 @@
  * The cap is well below the loop's overall result budget so a chatty
  * command cannot blow the context window even when stdout AND stderr both
  * cap out at the limit.
+ *
+ * The same value is sent to the sandbox as a retention budget, so the bytes are
+ * dropped at the producer and never cross the wire. Capping here as well is not
+ * redundant: a sandbox image that pre-dates the budget returns the whole stream,
+ * and this is the boundary that keeps it out of the process either way.
+ */
+/** Per-stream cap. 32 KiB — roomy for real output, well under the loop result budget. */
+export const EXEC_STREAM_BYTE_CAP = 32 * 1024;
+/**
+ * Decode `buf` as UTF-8, dropping a trailing partial sequence rather than
+ * letting it decode to U+FFFD. Only the last few bytes can be partial, so the
+ * scan is bounded by the maximum UTF-8 sequence length.
  */
-/** Per-stream cap. 8 KiB — multi-KB but well under the loop result budget. */
-export const EXEC_STREAM_BYTE_CAP = 8 * 1024;
+function trimPartialSequence(buf) {
+    const MAX_UTF8_SEQUENCE = 4;
+    for (let drop = 0; drop < MAX_UTF8_SEQUENCE && drop < buf.length; drop++) {
+        const candidate = buf.subarray(0, buf.length - drop);
+        const decoded = candidate.toString("utf8");
+        if (!decoded.endsWith("�")) {
+            return decoded;
+        }
+    }
+    // A stream that genuinely ends in U+FFFD is returned as-is; dropping more
+    // would start eating real characters.
+    return buf.toString("utf8");
+}
 function boundStream(stream, cap = EXEC_STREAM_BYTE_CAP) {
     const totalLength = Buffer.byteLength(stream, "utf8");
     if (totalLength <= cap) {
         return { content: stream, truncated: false, totalLength, returnedBytes: totalLength };
     }
-    const buf = Buffer.from(stream, "utf8").subarray(0, cap);
-    const content = buf.toString("utf8");
+    // Slice the string before encoding. Encoding first allocates a Buffer the
+    // size of the whole stream in order to keep `cap` bytes of it, which makes
+    // the function that exists to bound a stream the largest allocation on the
+    // path. One UTF-16 code unit encodes to at most 3 UTF-8 bytes, so `cap`
+    // units always cover `cap` bytes and the encode stays bounded.
+    const buf = Buffer.from(stream.slice(0, cap), "utf8").subarray(0, cap);
+    // The byte cut can land mid-sequence, and decoding that directly ends the
+    // content in U+FFFD. Trim back to the last whole character instead.
+    const content = trimPartialSequence(buf);
     return {
         content,
         truncated: true,
@@ -25,11 +55,40 @@ function boundStream(stream, cap = EXEC_STREAM_BYTE_CAP) {
         returnedBytes: Buffer.byteLength(content, "utf8"),
     };
 }
+/**
+ * Bound an `ExecResult`'s streams while keeping its shape.
+ *
+ * `boundExecResult` produces the tool-facing form; this is for the boundaries
+ * that have to forward an `ExecResult` onward — notably a workflow return value,
+ * which DBOS serializes into its durable step output. Returns the input
+ * unchanged when nothing needed cutting, so the common path allocates nothing.
+ */
+export function capExecStreams(result, cap = EXEC_STREAM_BYTE_CAP) {
+    const out = boundStream(result.stdout, cap);
+    const err = boundStream(result.stderr, cap);
+    if (!out.truncated && !err.truncated) {
+        return result;
+    }
+    return {
+        ...result,
+        stdout: out.content,
+        stderr: err.content,
+        stdoutTruncated: out.truncated || (result.stdoutTruncated ?? false),
+        stderrTruncated: err.truncated || (result.stderrTruncated ?? false),
+        stdoutTotalBytes: result.stdoutTotalBytes ?? out.totalLength,
+        stderrTotalBytes: result.stderrTotalBytes ?? err.totalLength,
+    };
+}
 /**
  * Apply per-stream truncation to an `ExecResult`. `exitCode`, `durationMs`,
  * `timedOut`, and `syntheticFailure` pass through unchanged regardless of
  * stream truncation — the discriminants the loop and the model rely on are
  * preserved.
+ *
+ * When the sandbox already truncated at the producer, what arrives here is the
+ * retained slice, not the stream — so its length is the wrong number to report.
+ * The sandbox's own totals win where present, and truncation is the union of the
+ * two cuts: either side having dropped bytes makes the result truncated.
  */
 export function boundExecResult(result, cap = EXEC_STREAM_BYTE_CAP) {
     const outStream = boundStream(result.stdout, cap);
@@ -39,10 +98,10 @@ export function boundExecResult(result, cap = EXEC_STREAM_BYTE_CAP) {
         exitCode: result.exitCode,
         stdout: outStream.content,
         stderr: errStream.content,
-        stdoutTruncated: outStream.truncated,
-        stderrTruncated: errStream.truncated,
-        stdoutTotalLength: outStream.totalLength,
-        stderrTotalLength: errStream.totalLength,
+        stdoutTruncated: outStream.truncated || (result.stdoutTruncated ?? false),
+        stderrTruncated: errStream.truncated || (result.stderrTruncated ?? false),
+        stdoutTotalLength: result.stdoutTotalBytes ?? outStream.totalLength,
+        stderrTotalLength: result.stderrTotalBytes ?? errStream.totalLength,
         durationMs: result.durationMs,
         timedOut: result.timedOut,
         ...(result.syntheticFailure ? { syntheticFailure: result.syntheticFailure } : {}),

package/dist/workflows/execute-analysis.js

@@ -214,7 +214,7 @@ export async function composeStepSeed(args) {
     // through the same helpers the sandbox mount and the mutate tools use, so
     // the seed cannot disagree with the container about where anything is.
     const workspace = {
-        analysisRoot: `/${analysisId}`,
+        analysisId,
         workingDir: toSandboxPath(workspaceRoot, analysisId, stepWritePrefix({ workspaceRoot, runId, stepId })),
     };
     // A DB failure here throws (house rules): a swallowed error would be frozen

package/dist/workspace/paths.d.ts

@@ -159,6 +159,25 @@ export declare function tailWritePrefix(args: {
  * a step briefing names (see the harness-workspace-tools spec).
  */
 export declare function toSandboxPath(workspaceRoot: string, resourceId: string, hostAbsPath: string): string;
+/**
+ * Map an analysis-root-relative path to the frame-independent `/{resourceId}/…`
+ * form this module defines at the top of the file.
+ *
+ * A record that outlives one agent stores the root-relative form, because that
+ * form does not depend on where a host puts the root. But a reader always reads
+ * inside a frame, and an agent whose working directory is a step directory
+ * resolves `data/inputs/x.csv` against that step directory. Thus one stored path
+ * is correct in the store and wrong in the message. This is the projection that a
+ * renderer applies before a stored path reaches an agent.
+ *
+ * The input comes from a record and it is a POSIX path, thus it normalizes under
+ * POSIX rules. The read is tolerant of the near-misses that a model writes: a
+ * leading slash, a `./` prefix, and a doubled separator all name the same file,
+ * and a path that already carries the correct root passes through. A tail that
+ * climbs above the root is returned as it is, because such a path must fail at
+ * the resolver as `out_of_scope`. A prefix would only make it look canonical.
+ */
+export declare function toAnalysisRootPath(resourceId: string, path: string): string;
 /**
  * Parent of every report session, workspace-root-relative. Callers that
  * enumerate the sessions join this. Callers that address one join

package/dist/workspace/paths.js

@@ -25,7 +25,7 @@
  * comes back `out_of_prefix` (the read surface skips that — it roams the tree
  * read-only).
  */
-import { relative as relativePath, resolve as resolvePath, sep } from "node:path";
+import { posix as posixPath, relative as relativePath, resolve as resolvePath, sep } from "node:path";
 /**
  * Resolve an agent-supplied path against the analysis tree under the
  * frame-aware model.
@@ -149,8 +149,54 @@ export function toSandboxPath(workspaceRoot, resourceId, hostAbsPath) {
     if (tail === ".." || tail.startsWith("../")) {
         throw new Error(`toSandboxPath: host path escapes the workspace root: ${hostAbsPath}`);
     }
+    return joinAnalysisRoot(resourceId, tail);
+}
+/**
+ * Map an analysis-root-relative path to the frame-independent `/{resourceId}/…`
+ * form this module defines at the top of the file.
+ *
+ * A record that outlives one agent stores the root-relative form, because that
+ * form does not depend on where a host puts the root. But a reader always reads
+ * inside a frame, and an agent whose working directory is a step directory
+ * resolves `data/inputs/x.csv` against that step directory. Thus one stored path
+ * is correct in the store and wrong in the message. This is the projection that a
+ * renderer applies before a stored path reaches an agent.
+ *
+ * The input comes from a record and it is a POSIX path, thus it normalizes under
+ * POSIX rules. The read is tolerant of the near-misses that a model writes: a
+ * leading slash, a `./` prefix, and a doubled separator all name the same file,
+ * and a path that already carries the correct root passes through. A tail that
+ * climbs above the root is returned as it is, because such a path must fail at
+ * the resolver as `out_of_scope`. A prefix would only make it look canonical.
+ */
+export function toAnalysisRootPath(resourceId, path) {
+    const trimmed = path.trim();
+    if (trimmed === "")
+        return `/${resourceId}`;
+    // Already rooted at this analysis: normalize the tail, then attach the root again.
+    const rooted = trimmed.startsWith("/") ? stripAnalysisRoot(trimmed, resourceId) : null;
+    if (rooted !== null)
+        return joinAnalysisRoot(resourceId, normalizeTail(rooted));
+    // A record holds no host path. Thus a leading slash is how a model writes the
+    // same root-relative path, and the remainder is the tail.
+    const tail = normalizeTail(trimmed.replace(/^\/+/, ""));
+    if (tail === ".." || tail.startsWith("../"))
+        return trimmed;
+    return joinAnalysisRoot(resourceId, tail);
+}
+/** `/{resourceId}` plus a tail. An empty tail gives the bare root. */
+function joinAnalysisRoot(resourceId, tail) {
     return tail === "" ? `/${resourceId}` : `/${resourceId}/${tail}`;
 }
+/** Collapse `.`, `..`, and a doubled separator in a POSIX tail. A bare `.` becomes empty. */
+function normalizeTail(tail) {
+    if (tail === "")
+        return "";
+    const normalized = posixPath.normalize(tail);
+    if (normalized === "." || normalized === "./")
+        return "";
+    return normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
+}
 /**
  * Parent of every report session, workspace-root-relative. Callers that
  * enumerate the sessions join this. Callers that address one join

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@inflexa-ai/harness",
-    "version": "0.26.3",
+    "version": "0.28.0",
     "description": "Host-agnostic bioinformatics agent harness — hand-rolled agent loop, DBOS-durable workflows, sandboxed compute.",
     "license": "Apache-2.0",
     "type": "module",
@@ -69,8 +69,8 @@
         "cheerio": "^1.2.0",
         "dockerode": "^4.0.12",
         "echarts": "5.5.1",
-        "fast-xml-parser": "^5.10.0",
-        "hono": "^4.12.30",
+        "fast-xml-parser": "^5.10.1",
+        "hono": "^4.12.34",
         "hyparquet": "^1.28.1",
         "js-tiktoken": "^1.0.21",
         "mime": "^4.1.0",
@@ -83,6 +83,13 @@
         "puppeteer-core": "^23.11.1",
         "zod": "^4.4.3"
     },
+    "overrides": {
+        "ip-address": "^10.3.1",
+        "js-yaml": "^4.3.1",
+        "protobufjs": "^7.6.5",
+        "undici": "^7.29.0",
+        "uuid": "^11.1.1"
+    },
     "devDependencies": {
         "@eslint/js": "^10.0.1",
         "@types/bun": "latest",