comisai 1.0.34 → 1.0.36

package/node_modules/@comis/skills/dist/builtin/file-tools/grep-tool.js

@@ -148,22 +148,22 @@ function buildRipgrepArgs(pattern, outputMode, options = {}) {
     }
     // Pattern (use -e to avoid pattern being confused with flags)
     args.push("-e", pattern);
-    // Phase 9: filtering
+    // Filtering
     if (options.glob)
         args.push("--glob", options.glob);
     if (options.type)
         args.push("--type", options.type);
-    // Phase 9: case-insensitive
+    // Case-insensitive
     if (options.caseInsensitive)
         args.push("-i");
     // Literal mode (fixed-strings)
     if (options.literal) {
         args.push("--fixed-strings");
     }
-    // Phase 9: multiline
+    // Multiline
     if (options.multiline)
         args.push("-U", "--multiline-dotall");
-    // Phase 9: context lines (content mode only -- ignored for other modes)
+    // Context lines (content mode only -- ignored for other modes)
     if (outputMode === "content") {
         if (options.afterContext !== undefined)
             args.push("-A", String(options.afterContext));
@@ -172,7 +172,7 @@ function buildRipgrepArgs(pattern, outputMode, options = {}) {
         if (options.context !== undefined)
             args.push("-C", String(options.context));
     }
-    // Phase 9: per-file match limit for pagination efficiency (content mode only)
+    // Per-file match limit for pagination efficiency (content mode only)
     if (outputMode === "content") {
         const headLimit = options.headLimit ?? 250;
         const offset = options.offset ?? 0;
@@ -327,7 +327,7 @@ export function createComisGrepTool(workspacePath, logger, readOnlyPaths, shared
                 const outputMode = outputModeRaw && OUTPUT_MODES.includes(outputModeRaw)
                     ? outputModeRaw
                     : "content";
-                // Phase 9: new parameters
+                // Optional filter / formatting parameters
                 const glob = readStringParam(params, "glob", false);
                 const type = readStringParam(params, "type", false);
                 const caseInsensitive = readBooleanParam(params, "-i", false) ?? false;

package/node_modules/@comis/skills/dist/builtin/platform/agents-manage-tool.d.ts

@@ -42,6 +42,7 @@ export declare const AgentsManageToolParams: Type.TObject<{
                 browser: Type.TOptional<Type.TBoolean>;
             }>>;
         }>>;
+        oauthProfiles: Type.TOptional<Type.TRecord<"^.*$", Type.TString>>;
     }>, Type.TString]>>;
 }>;
 export interface AgentInlineWritesValue {
@@ -68,13 +69,13 @@ export interface AgentInlineWritesError {
  * Pure string composition. No I/O, no Result<T,E> needed (per AGENTS.md
  * §2.1: Result is for fallible paths only; this is infallible).
  *
- * Three branches keyed on `inlineWritesResult` (260428-vyf):
+ * Three branches keyed on `inlineWritesResult`:
  *  - BOTH written → SHORT contract: "No further setup needed — agent is
  *    operationally ready". Skips the post-create write() roundtrip.
  *  - PARTIAL (only one of role/identity written) → mixed contract pointing
  *    only at the still-template file with a single "Next required action".
- *  - NEITHER (or write failure / undefined) → existing 260428-sw2 2-step
- *    contract verbatim, telling the LLM to call write() for ROLE.md.
+ *  - NEITHER (or write failure / undefined) → existing 2-step contract
+ *    verbatim, telling the LLM to call write() for ROLE.md.
  *
  * Case B (workspaceDir absent — defensive fallback): shorter form pinning
  * "Customize {agentId}'s workspace ROLE.md and IDENTITY.md before using."
@@ -94,7 +95,7 @@ export declare function buildCreateContract(agentId: string, workspaceDir: strin
  *
  * @param rpcCall - RPC call function for delegating to the daemon backend
  * @param logger - Required structured logger. Used to emit a per-create
- *   INFO log pinning the next-step contract emission (260428-sw2 Layer 1).
+ *   INFO log pinning the next-step contract emission.
  *   Mirrors the gateway-tool required-logger position; no overload-with-
  *   default-logger compat shim (per `feedback_no_backward_compat.md`).
  * @param approvalGate - Optional approval gate for create/delete actions

package/node_modules/@comis/skills/dist/builtin/platform/agents-manage-tool.js

@@ -48,19 +48,19 @@ export const AgentsManageToolParams = Type.Object({
                     "Default: full. Can be changed later via update action. " +
                     "Alternative shape: nested workspace.profile (see `workspace` field).",
             })),
-            // 260428-oyc: declare nested workspace shape explicitly. The LLM
-            // sometimes emits `workspace: {profile: "specialist"}` directly
-            // (mirroring the downstream Zod schema-agent.ts:733-738 shape).
-            // Without this declaration, the unknown nested object slipped past
-            // TypeBox structurally but the enum was never validated -- invalid
-            // values would only be caught later at the Zod layer with a less
+            // Declare nested workspace shape explicitly. The LLM sometimes
+            // emits `workspace: {profile: "specialist"}` directly (mirroring
+            // the downstream Zod schema-agent.ts:733-738 shape). Without this
+            // declaration, the unknown nested object slipped past TypeBox
+            // structurally but the enum was never validated -- invalid values
+            // would only be caught later at the Zod layer with a less
             // actionable error path. Declaring it here makes both shapes
             // first-class and gates the enum at the tool-validation boundary.
             workspace: Type.Optional(Type.Object({
                 profile: Type.Union([Type.Literal("full"), Type.Literal("specialist")], {
                     description: "Workspace profile (alternative to flat workspace_profile). Valid: full | specialist ONLY. NO other values accepted.",
                 }),
-                // 260428-vyf L2: inline ROLE.md / IDENTITY.md content. The tool
+                // Inline ROLE.md / IDENTITY.md content. The tool
                 // handler strips these from the config payload BEFORE the RPC
                 // and forwards them as a separate top-level `inlineContent`
                 // param. The daemon writes them as files (write-once side-
@@ -95,6 +95,17 @@ export const AgentsManageToolParams = Type.Object({
                     browser: Type.Optional(Type.Boolean({ description: "Enable headless browser control" })),
                 }, { description: "Built-in tool toggles (true=enabled, false=disabled)" })),
             }, { description: "Skills and tool configuration" })),
+            // Per-agent OAuth profile preference. Map of provider → profile-id
+            // (e.g. { "openai-codex": "openai-codex:user@example.com" }).
+            // The downstream Zod schema (PerAgentConfigSchema) is the
+            // canonical format gate via `validateProfileId`; the daemon-side
+            // `agents.update` handler additionally rejects unknown profile IDs
+            // via `OAuthCredentialStore.has()`.
+            oauthProfiles: Type.Optional(Type.Record(Type.String(), Type.String({
+                description: "<provider>:<identity> profile ID. Run `comis auth list` first to discover stored profiles.",
+            }), {
+                description: "OAuth profile preferences per provider (e.g., openai-codex). Each value must match an existing stored profile ID — the daemon rejects nonexistent IDs with a 'not found in store' error.",
+            })),
         }, { description: "Agent configuration for create/update actions" }),
         Type.String({
             description: "Agent configuration as a JSON string (fallback when the LLM stringifies the object). " +
@@ -110,9 +121,9 @@ const VALID_ACTIONS = ["create", "get", "update", "delete", "suspend", "resume",
  * Map flat workspace_profile param to nested workspace.profile config.
  * Mutates config in place.
  *
- * 260428-oyc: precedence is "flat wins" -- when both flat workspace_profile
- * and nested workspace.profile are present, the flat field overwrites the
- * nested one. This matches the existing spread semantics
+ * Precedence is "flat wins" -- when both flat workspace_profile and nested
+ * workspace.profile are present, the flat field overwrites the nested one.
+ * This matches the existing spread semantics
  * (`{...existing, profile}`) and keeps a single deterministic rule. When only
  * nested is present (no `workspace_profile` key), this is a no-op and the
  * nested shape flows through unchanged to the downstream Zod validator.
@@ -145,13 +156,13 @@ function mapWorkspaceProfile(config) {
  * Pure string composition. No I/O, no Result<T,E> needed (per AGENTS.md
  * §2.1: Result is for fallible paths only; this is infallible).
  *
- * Three branches keyed on `inlineWritesResult` (260428-vyf):
+ * Three branches keyed on `inlineWritesResult`:
  *  - BOTH written → SHORT contract: "No further setup needed — agent is
  *    operationally ready". Skips the post-create write() roundtrip.
  *  - PARTIAL (only one of role/identity written) → mixed contract pointing
  *    only at the still-template file with a single "Next required action".
- *  - NEITHER (or write failure / undefined) → existing 260428-sw2 2-step
- *    contract verbatim, telling the LLM to call write() for ROLE.md.
+ *  - NEITHER (or write failure / undefined) → existing 2-step contract
+ *    verbatim, telling the LLM to call write() for ROLE.md.
  *
  * Case B (workspaceDir absent — defensive fallback): shorter form pinning
  * "Customize {agentId}'s workspace ROLE.md and IDENTITY.md before using."
@@ -179,7 +190,7 @@ export function buildCreateContract(agentId, workspaceDir, inlineWritesResult) {
         ].join("\n");
     }
     // NEITHER (no inlineContent supplied, write failure, or undefined): fall
-    // through to the existing 260428-sw2 2-step contract verbatim.
+    // through to the existing 2-step contract verbatim.
     if (workspaceDir !== undefined) {
         return [
             `✓ Agent ${agentId} created at ${workspaceDir}.`,
@@ -222,7 +233,7 @@ function coerceConfig(p) {
  *
  * @param rpcCall - RPC call function for delegating to the daemon backend
  * @param logger - Required structured logger. Used to emit a per-create
- *   INFO log pinning the next-step contract emission (260428-sw2 Layer 1).
+ *   INFO log pinning the next-step contract emission.
  *   Mirrors the gateway-tool required-logger position; no overload-with-
  *   default-logger compat shim (per `feedback_no_backward_compat.md`).
  * @param approvalGate - Optional approval gate for create/delete actions
@@ -260,16 +271,16 @@ export function createAgentsManageTool(rpcCall, logger, approvalGate, callbacks)
                         }
                     }
                 }
-                // 260428-vyf L2 (Path A): strip workspace.role / workspace.identity
-                // from the config payload BEFORE the RPC and forward them as a
-                // separate top-level `inlineContent` parameter. Rationale: the
-                // downstream Zod schema (PerAgentConfigSchema.workspace at
+                // Strip workspace.role / workspace.identity from the config
+                // payload BEFORE the RPC and forward them as a separate top-level
+                // `inlineContent` parameter. Rationale: the downstream Zod schema
+                // (PerAgentConfigSchema.workspace at
                 // packages/core/src/config/schema-agent.ts) is z.strictObject —
                 // unknown keys would trigger Zod `unrecognized_keys` rejection.
                 // role/identity are write-once side-effects (ROLE.md / IDENTITY.md
                 // file writes), NOT durable state — they MUST NOT leak into
-                // config.yaml. Path B (extending Zod schema-agent.ts) was
-                // rejected because it would persist them.
+                // config.yaml. Extending the Zod schema instead would persist
+                // them and was rejected.
                 let inlineContent;
                 if (config && typeof config === "object") {
                     const ws = config.workspace;
@@ -295,11 +306,11 @@ export function createAgentsManageTool(rpcCall, logger, approvalGate, callbacks)
                     const aid = agentId;
                     const workspaceDir = result?.workspaceDir;
                     const inlineWritesResult = result?.inlineWritesResult;
-                    // 260428-sw2 Layer 1 + 260428-vyf Layer 2: emit the next-step
-                    // contract on the freshest, uncached surface the LLM reads each
-                    // turn (the tool_result text). The contract has 3 branches keyed
-                    // on inlineWritesResult (see buildCreateContract). One structured
-                    // INFO log pins this happened.
+                    // Emit the next-step contract on the freshest, uncached surface
+                    // the LLM reads each turn (the tool_result text). The contract
+                    // has 3 branches keyed on inlineWritesResult (see
+                    // buildCreateContract). One structured INFO log pins this
+                    // happened.
                     const contractText = buildCreateContract(aid, workspaceDir, inlineWritesResult);
                     // Distinguish the 3 inline-write outcomes for observability.
                     // "none"    — caller did not supply inlineContent
@@ -311,7 +322,7 @@ export function createAgentsManageTool(rpcCall, logger, approvalGate, callbacks)
                             ? "written"
                             : "failed";
                     logger.info({
-                        module: "skill.agents-manage",
+                        submodule: "skill.agents-manage",
                         action: "create",
                         agentId: aid,
                         workspaceDir: workspaceDir ?? null,

package/node_modules/@comis/skills/dist/builtin/platform/background-tasks-tool.d.ts

@@ -14,13 +14,16 @@ type TaskStatus = "running" | "completed" | "failed" | "cancelled";
 /** Minimal task shape used by this tool. */
 interface TaskInfo {
     id: string;
-    agentId: string;
     toolName: string;
     status: TaskStatus;
     startedAt: number;
     completedAt?: number;
     result?: string;
     error?: string;
+    /** agentId is nested under origin.agentId */
+    origin: {
+        agentId: string;
+    };
 }
 /** Subset of BackgroundTaskManager consumed by this tool. */
 export interface BackgroundTaskManagerLike {

package/node_modules/@comis/skills/dist/builtin/platform/background-tasks-tool.js

@@ -72,7 +72,7 @@ export function createBackgroundTasksTool(deps) {
                 case "get": {
                     const taskId = readStringParam(p, "taskId");
                     const task = deps.manager.getTask(taskId);
-                    if (!task || task.agentId !== deps.agentId) {
+                    if (!task || task.origin.agentId !== deps.agentId) {
                         return {
                             content: [{ type: "text", text: `Error: Task not found: ${taskId}` }],
                             details: null,
@@ -96,7 +96,7 @@ export function createBackgroundTasksTool(deps) {
                 case "cancel": {
                     const taskId = readStringParam(p, "taskId");
                     const task = deps.manager.getTask(taskId);
-                    if (!task || task.agentId !== deps.agentId) {
+                    if (!task || task.origin.agentId !== deps.agentId) {
                         return {
                             content: [{ type: "text", text: `Error: Task not found: ${taskId}` }],
                             details: null,
@@ -117,7 +117,7 @@ export function createBackgroundTasksTool(deps) {
                 case "read_output": {
                     const taskId = readStringParam(p, "taskId");
                     const task = deps.manager.getTask(taskId);
-                    if (!task || task.agentId !== deps.agentId) {
+                    if (!task || task.origin.agentId !== deps.agentId) {
                         return {
                             content: [{ type: "text", text: `Error: Task not found: ${taskId}` }],
                             details: null,

package/node_modules/@comis/skills/dist/builtin/platform/cron-tool.js

@@ -39,7 +39,7 @@ const CronToolParams = Type.Object({
     payload_text: Type.Optional(Type.String({ description: "Payload text or message content" })),
     // session strategy params
     session_strategy: Type.Optional(Type.Union([Type.Literal("fresh"), Type.Literal("rolling"), Type.Literal("accumulate")], {
-        description: "Session history strategy for recurring jobs. Valid values: fresh (new session each run), rolling (keep last N turns), accumulate (keep all history). Default: fresh",
+        description: "Session history strategy for recurring jobs. Valid values: fresh (new session each run; default and STRONGLY PREFERRED for cadences ≥ 10 minutes), rolling (keep last N turns; ONLY use when cadence < 5 minutes), accumulate (keep all history; rarely correct, leaks across runs). Rationale: cron uses a 5-minute prompt cache TTL, so any cadence longer than that wastes cache-write spend on rolling/accumulate — the cache is always cold by the next tick. Pick fresh unless cross-tick session memory is essential and cadence is < 5 minutes. Default: fresh",
     })),
     max_history_turns: Type.Optional(Type.Integer({ description: "Number of recent turns to keep for rolling strategy (default 3)" })),
     model: Type.Optional(Type.String({

package/node_modules/@comis/skills/dist/builtin/platform/gateway-tool.js

@@ -165,16 +165,16 @@ export function createGatewayTool(rpcCall, logger) {
                             hint: "Ask the user to confirm this restart, then call again with _confirmed: true.",
                         };
                     }
-                    // 260428-qrn: Inside Docker the restart relies entirely on the
-                    // container's restart policy to bring the daemon back. Surface
-                    // a structured WARN so the operator gets a breadcrumb in
-                    // `docker logs` pointing at `--restart unless-stopped`. Tool
-                    // result schema unchanged (Pino-only -- no extra content blocks).
+                    // Inside Docker the restart relies entirely on the container's
+                    // restart policy to bring the daemon back. Surface a structured
+                    // WARN so the operator gets a breadcrumb in `docker logs`
+                    // pointing at `--restart unless-stopped`. Tool result schema
+                    // unchanged (Pino-only -- no extra content blocks).
                     if (isDocker()) {
                         logger.warn({
                             hint: "Container must have --restart unless-stopped (or compose restart: unless-stopped) for the restart to bring it back. Otherwise run 'docker restart <name>' from your host after the daemon exits.",
                             errorKind: "config",
-                            module: "skill.gateway",
+                            submodule: "skill.gateway",
                         }, "Daemon restart requested inside Docker container — relies on container restart policy");
                     }
                     return rpcCall("gateway.restart", { _trustLevel });

package/node_modules/@comis/skills/dist/builtin/platform/mcp-manage-tool.d.ts

@@ -13,7 +13,7 @@ import type { ApprovalGate } from "@comis/core";
 import type { RpcCall } from "./cron-tool.js";
 declare const McpManageToolParams: Type.TObject<{
     action: Type.TUnion<[Type.TLiteral<"list">, Type.TLiteral<"status">, Type.TLiteral<"connect">, Type.TLiteral<"disconnect">, Type.TLiteral<"reconnect">]>;
-    name: Type.TOptional<Type.TString>;
+    server_name: Type.TOptional<Type.TString>;
     transport: Type.TOptional<Type.TString>;
     command: Type.TOptional<Type.TString>;
     args: Type.TOptional<Type.TArray<Type.TString>>;

package/node_modules/@comis/skills/dist/builtin/platform/mcp-manage-tool.js

@@ -22,7 +22,7 @@ const McpManageToolParams = Type.Object({
         Type.Literal("disconnect"),
         Type.Literal("reconnect"),
     ], { description: "MCP server management action. Valid values: list (all servers with status), status (detailed single server info), connect (add new server), disconnect (remove server), reconnect (restart server connection)" }),
-    name: Type.Optional(Type.String({
+    server_name: Type.Optional(Type.String({
         description: "MCP server name. Required for status/connect/disconnect/reconnect.",
     })),
     transport: Type.Optional(Type.String({
@@ -72,14 +72,14 @@ export function createMcpManageTool(rpcCall, approvalGate) {
                 return rpcCall("mcp.list", { _trustLevel: ctx.trustLevel });
             },
             async status(p, rpcCall, ctx) {
-                const name = readStringParam(p, "name");
-                return rpcCall("mcp.status", { name, _trustLevel: ctx.trustLevel });
+                const name = readStringParam(p, "server_name");
+                return rpcCall("mcp.status", { server_name: name, _trustLevel: ctx.trustLevel });
             },
             async connect(p, rpcCall, ctx) {
-                const name = readStringParam(p, "name");
+                const name = readStringParam(p, "server_name");
                 const transport = readStringParam(p, "transport");
                 return rpcCall("mcp.connect", {
-                    name,
+                    server_name: name,
                     transport,
                     command: p.command,
                     args: p.args,
@@ -89,13 +89,13 @@ export function createMcpManageTool(rpcCall, approvalGate) {
                 });
             },
             async disconnect(p, rpcCall, ctx) {
-                const name = readStringParam(p, "name");
-                return rpcCall("mcp.disconnect", { name, _trustLevel: ctx.trustLevel });
+                const name = readStringParam(p, "server_name");
+                return rpcCall("mcp.disconnect", { server_name: name, _trustLevel: ctx.trustLevel });
             },
             async reconnect(p, rpcCall, ctx) {
-                const name = readStringParam(p, "name");
+                const name = readStringParam(p, "server_name");
                 return rpcCall("mcp.reconnect", {
-                    name,
+                    server_name: name,
                     transport: p.transport,
                     command: p.command,
                     args: p.args,

package/node_modules/@comis/skills/dist/builtin/sandbox/bwrap-provider.d.ts

@@ -7,6 +7,17 @@
  * @module
  */
 import type { SandboxOptions, SandboxProvider } from "./types.js";
+/**
+ * System paths to bind read-only. Filtered by existsSync once at
+ * first buildArgs() call and cached for the provider's lifetime.
+ *
+ * Exported so the bwrap smoke test in detect-provider.ts consumes the
+ * same list — drift between smoke and production binds caused a real
+ * false-negative on usrmerge x86-64 hosts (smoke test missed /lib64
+ * → /bin/true's dynamic linker unreachable → smoke EPERMs while the
+ * production sandbox actually works fine).
+ */
+export declare const SYSTEM_RO_PATHS: readonly ["/usr", "/bin", "/sbin", "/lib", "/lib64", "/lib32", "/etc/resolv.conf", "/etc/hosts", "/etc/hostname", "/etc/ssl", "/etc/ca-certificates", "/etc/pki", "/etc/ld.so.cache", "/etc/ld.so.conf", "/etc/ld.so.conf.d", "/etc/alternatives", "/etc/localtime", "/etc/passwd", "/etc/group", "/etc/nsswitch.conf"];
 export declare class BwrapProvider implements SandboxProvider {
     readonly name = "bwrap";
     private bwrapPath;

package/node_modules/@comis/skills/dist/builtin/sandbox/bwrap-provider.js

@@ -14,8 +14,14 @@ import path from "node:path";
 /**
  * System paths to bind read-only. Filtered by existsSync once at
  * first buildArgs() call and cached for the provider's lifetime.
+ *
+ * Exported so the bwrap smoke test in detect-provider.ts consumes the
+ * same list — drift between smoke and production binds caused a real
+ * false-negative on usrmerge x86-64 hosts (smoke test missed /lib64
+ * → /bin/true's dynamic linker unreachable → smoke EPERMs while the
+ * production sandbox actually works fine).
  */
-const SYSTEM_RO_PATHS = [
+export const SYSTEM_RO_PATHS = [
     "/usr",
     "/bin",
     "/sbin",
@@ -73,6 +79,40 @@ function getClaudeCodeRwPaths(home) {
         /* eslint-enable no-restricted-syntax */
     ].filter((p) => existsSync(p));
 }
+/**
+ * Per-user XDG paths that need read-write access for language package managers.
+ *
+ * These paths MUST match the systemd ReadWritePaths in
+ * packages/daemon/systemd/comis.service.template. Without RW access here,
+ * package managers writing to standard XDG paths (npm, uv, pipx, cargo, go,
+ * deno, bun) fail with EROFS at the bwrap mount layer even when the outer
+ * systemd sandbox permits the write.
+ *
+ * Why these specific paths:
+ * - ~/.npm     -- npm/npx default cache + global modules root.
+ * - ~/.cache   -- XDG_CACHE_HOME default; uv archives, deno cache, bun cache,
+ *                pip wheel cache, cargo registry cache, go module cache.
+ *                wrapEnv() also redirects most caches into the workspace, but
+ *                some tools (e.g. uv's archive cache) still touch ~/.cache
+ *                during early bootstrap before env vars take effect.
+ * - ~/.local/share -- XDG_DATA_HOME default; uvx tool installs, pipx venvs,
+ *                    rustup toolchains, generic XDG_DATA consumers.
+ *
+ * Note: this returns a subset of paths bound RO by getUserRoPaths
+ * (specifically ~/.local). The RW bind is emitted AFTER the RO bind in
+ * buildArgs, which causes bwrap to apply the more-permissive RW mount on
+ * top of the RO mount for the ~/.local/share subpath. ~/.local itself
+ * remains RO; only ~/.local/share becomes RW.
+ */
+function getDevToolRwPaths(home) {
+    /* eslint-disable no-restricted-syntax -- Trusted: constant subpaths of homedir, no user input */
+    return [
+        path.join(home, ".npm"),
+        path.join(home, ".cache"),
+        path.join(home, ".local", "share"),
+        /* eslint-enable no-restricted-syntax */
+    ].filter((p) => existsSync(p));
+}
 export class BwrapProvider {
     name = "bwrap";
     bwrapPath = null;
@@ -124,6 +164,14 @@ export class BwrapProvider {
         for (const cp of getClaudeCodeRwPaths(os.homedir())) {
             args.push("--bind", cp, cp);
         }
+        // -- Dev tool RW paths (read-write) --
+        // MUST come after getUserRoPaths above so the RW bind for ~/.local/share
+        // overrides the RO bind for ~/.local. MUST come before the discovery
+        // readOnlyPaths loop below so caller-supplied RO can't shadow these.
+        // Mirror of systemd ReadWritePaths in comis.service.template.
+        for (const dp of getDevToolRwPaths(os.homedir())) {
+            args.push("--bind", dp, dp);
+        }
         // -- Read-only paths (discovery paths, custom) --
         for (const ro of opts.readOnlyPaths) {
             if (existsSync(ro)) {
@@ -139,6 +187,24 @@ export class BwrapProvider {
     wrapEnv(env, workspacePath) {
         // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
         const cacheDir = path.join(workspacePath, ".cache");
+        // Workspace-rooted bin dirs that hold CLIs installed by sandboxed package
+        // managers. Prepended to PATH so a binary installed by `cargo install <crate>`
+        // (or pipx, go install, bun add -g, deno install, pnpm add -g) on one exec
+        // call is invocable on the NEXT exec call. Ordering: highest-frequency first.
+        const toolBinPaths = [
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            path.join(workspacePath, ".local", "bin"), // PYTHONUSERBASE/bin + PIPX_BIN_DIR
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            path.join(cacheDir, "cargo", "bin"), // cargo install
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            path.join(cacheDir, "go", "bin"), // go install
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            path.join(cacheDir, "bun", "bin"), // bun add -g
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            path.join(cacheDir, "pnpm"), // pnpm global (PNPM_HOME itself is the bin dir)
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            path.join(cacheDir, "deno", "bin"), // deno install
+        ];
         return {
             ...env,
             // Temp files: heredocs, wheel builds, etc.
@@ -150,6 +216,15 @@ export class BwrapProvider {
             // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
             PIP_CACHE_DIR: path.join(cacheDir, "pip"),
             XDG_CACHE_HOME: cacheDir,
+            // XDG_STATE_HOME (~/.local/state by default): pipx logs, some Python
+            // tools, runtime state. The ~/.local parent bind is RO (getUserRoPaths)
+            // and getDevToolRwPaths only carves out ~/.local/share, so anything
+            // defaulting to ~/.local/state would EROFS without this redirect.
+            // pipx happens to survive (PIPX_HOME captures all pipx state) but other
+            // XDG-state-using tools would not. Defensive belt-and-suspenders matching
+            // the existing XDG_CACHE_HOME pattern.
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            XDG_STATE_HOME: path.join(workspacePath, ".local", "state"),
             // Python: redirect user packages into workspace.
             // PYTHONNOUSERSITE is NOT set — sandbox read paths cover dirs that
             // pip needs to scan. Removing it lets Python find packages installed
@@ -176,6 +251,44 @@ export class BwrapProvider {
             GEM_HOME: path.join(cacheDir, "gems"),
             // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
             BUNDLE_PATH: path.join(cacheDir, "bundle"),
+            // Rust: rustup multiplexer needs RUSTUP_HOME to locate the toolchain.
+            // Pointed at the system rustup install (written by install.sh's
+            // install_rust at /usr/local/rustup). A workspace-rooted RUSTUP_HOME
+            // would be empty on first call, breaking `cargo install <crate>` with
+            // "rustup could not choose a version of cargo to run, because no default
+            // is configured" — confirmed on a real VPS during the dev-sandbox matrix
+            // test. CARGO_HOME stays workspace-rooted (above) so `cargo install`
+            // outputs land in <workspace>/.cache/cargo/bin and survive.
+            // Tradeoff: agent loses the ability to `rustup install <toolchain>` from
+            // inside exec (would need RW to /usr/local/rustup). Acceptable — the
+            // canonical use case is `cargo install <crate>`, which works.
+            RUSTUP_HOME: "/usr/local/rustup",
+            // uv: tool install dir for `uvx` / `uv tool install` (paired with UV_PYTHON_INSTALL_DIR above).
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            UV_TOOL_DIR: path.join(cacheDir, "uv", "tools"),
+            // pipx: venvs root + bin dir. PIPX_BIN_DIR aligns with PYTHONUSERBASE/bin
+            // (PYTHONUSERBASE = workspace/.local) so user-installed and pipx-installed
+            // CLIs share a single PATH entry: workspace/.local/bin.
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            PIPX_HOME: path.join(cacheDir, "pipx"),
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            PIPX_BIN_DIR: path.join(workspacePath, ".local", "bin"),
+            // pnpm global store + bin dir (PNPM_HOME is on PATH below).
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            PNPM_HOME: path.join(cacheDir, "pnpm"),
+            // bun: install root; binaries land in $BUN_INSTALL/bin.
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            BUN_INSTALL: path.join(cacheDir, "bun"),
+            // deno: cache + installed CLI dir ($DENO_DIR/bin via `deno install`).
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            DENO_DIR: path.join(cacheDir, "deno"),
+            // yarn cache; mirrors the others for completeness even though yarn is rare in agent flows.
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            YARN_CACHE_FOLDER: path.join(cacheDir, "yarn"),
+            // PATH augmentation MUST come after the spread above so it overrides
+            // any PATH carried in `env`. Empty entries are filtered to avoid
+            // trailing/duplicate colons when env.PATH is undefined.
+            PATH: [...toolBinPaths, env.PATH ?? ""].filter(Boolean).join(":"),
         };
     }
 }