comisai 1.0.34 → 1.0.37

package/node_modules/@comis/skills/dist/builtin/platform/background-tasks-tool.js

@@ -72,7 +72,7 @@ export function createBackgroundTasksTool(deps) {
                 case "get": {
                     const taskId = readStringParam(p, "taskId");
                     const task = deps.manager.getTask(taskId);
-                    if (!task || task.agentId !== deps.agentId) {
+                    if (!task || task.origin.agentId !== deps.agentId) {
                         return {
                             content: [{ type: "text", text: `Error: Task not found: ${taskId}` }],
                             details: null,
@@ -96,7 +96,7 @@ export function createBackgroundTasksTool(deps) {
                 case "cancel": {
                     const taskId = readStringParam(p, "taskId");
                     const task = deps.manager.getTask(taskId);
-                    if (!task || task.agentId !== deps.agentId) {
+                    if (!task || task.origin.agentId !== deps.agentId) {
                         return {
                             content: [{ type: "text", text: `Error: Task not found: ${taskId}` }],
                             details: null,
@@ -117,7 +117,7 @@ export function createBackgroundTasksTool(deps) {
                 case "read_output": {
                     const taskId = readStringParam(p, "taskId");
                     const task = deps.manager.getTask(taskId);
-                    if (!task || task.agentId !== deps.agentId) {
+                    if (!task || task.origin.agentId !== deps.agentId) {
                         return {
                             content: [{ type: "text", text: `Error: Task not found: ${taskId}` }],
                             details: null,

package/node_modules/@comis/skills/dist/builtin/platform/cron-tool.js

@@ -39,7 +39,7 @@ const CronToolParams = Type.Object({
     payload_text: Type.Optional(Type.String({ description: "Payload text or message content" })),
     // session strategy params
     session_strategy: Type.Optional(Type.Union([Type.Literal("fresh"), Type.Literal("rolling"), Type.Literal("accumulate")], {
-        description: "Session history strategy for recurring jobs. Valid values: fresh (new session each run), rolling (keep last N turns), accumulate (keep all history). Default: fresh",
+        description: "Session history strategy for recurring jobs. Valid values: fresh (new session each run; default and STRONGLY PREFERRED for cadences ≥ 10 minutes), rolling (keep last N turns; ONLY use when cadence < 5 minutes), accumulate (keep all history; rarely correct, leaks across runs). Rationale: cron uses a 5-minute prompt cache TTL, so any cadence longer than that wastes cache-write spend on rolling/accumulate — the cache is always cold by the next tick. Pick fresh unless cross-tick session memory is essential and cadence is < 5 minutes. Default: fresh",
     })),
     max_history_turns: Type.Optional(Type.Integer({ description: "Number of recent turns to keep for rolling strategy (default 3)" })),
     model: Type.Optional(Type.String({

package/node_modules/@comis/skills/dist/builtin/platform/gateway-tool.js

@@ -165,16 +165,16 @@ export function createGatewayTool(rpcCall, logger) {
                             hint: "Ask the user to confirm this restart, then call again with _confirmed: true.",
                         };
                     }
-                    // 260428-qrn: Inside Docker the restart relies entirely on the
-                    // container's restart policy to bring the daemon back. Surface
-                    // a structured WARN so the operator gets a breadcrumb in
-                    // `docker logs` pointing at `--restart unless-stopped`. Tool
-                    // result schema unchanged (Pino-only -- no extra content blocks).
+                    // Inside Docker the restart relies entirely on the container's
+                    // restart policy to bring the daemon back. Surface a structured
+                    // WARN so the operator gets a breadcrumb in `docker logs`
+                    // pointing at `--restart unless-stopped`. Tool result schema
+                    // unchanged (Pino-only -- no extra content blocks).
                     if (isDocker()) {
                         logger.warn({
                             hint: "Container must have --restart unless-stopped (or compose restart: unless-stopped) for the restart to bring it back. Otherwise run 'docker restart <name>' from your host after the daemon exits.",
                             errorKind: "config",
-                            module: "skill.gateway",
+                            submodule: "skill.gateway",
                         }, "Daemon restart requested inside Docker container — relies on container restart policy");
                     }
                     return rpcCall("gateway.restart", { _trustLevel });

package/node_modules/@comis/skills/dist/builtin/platform/mcp-manage-tool.d.ts

@@ -13,7 +13,7 @@ import type { ApprovalGate } from "@comis/core";
 import type { RpcCall } from "./cron-tool.js";
 declare const McpManageToolParams: Type.TObject<{
     action: Type.TUnion<[Type.TLiteral<"list">, Type.TLiteral<"status">, Type.TLiteral<"connect">, Type.TLiteral<"disconnect">, Type.TLiteral<"reconnect">]>;
-    name: Type.TOptional<Type.TString>;
+    server_name: Type.TOptional<Type.TString>;
     transport: Type.TOptional<Type.TString>;
     command: Type.TOptional<Type.TString>;
     args: Type.TOptional<Type.TArray<Type.TString>>;

package/node_modules/@comis/skills/dist/builtin/platform/mcp-manage-tool.js

@@ -22,7 +22,7 @@ const McpManageToolParams = Type.Object({
         Type.Literal("disconnect"),
         Type.Literal("reconnect"),
     ], { description: "MCP server management action. Valid values: list (all servers with status), status (detailed single server info), connect (add new server), disconnect (remove server), reconnect (restart server connection)" }),
-    name: Type.Optional(Type.String({
+    server_name: Type.Optional(Type.String({
         description: "MCP server name. Required for status/connect/disconnect/reconnect.",
     })),
     transport: Type.Optional(Type.String({
@@ -72,14 +72,14 @@ export function createMcpManageTool(rpcCall, approvalGate) {
                 return rpcCall("mcp.list", { _trustLevel: ctx.trustLevel });
             },
             async status(p, rpcCall, ctx) {
-                const name = readStringParam(p, "name");
-                return rpcCall("mcp.status", { name, _trustLevel: ctx.trustLevel });
+                const name = readStringParam(p, "server_name");
+                return rpcCall("mcp.status", { server_name: name, _trustLevel: ctx.trustLevel });
             },
             async connect(p, rpcCall, ctx) {
-                const name = readStringParam(p, "name");
+                const name = readStringParam(p, "server_name");
                 const transport = readStringParam(p, "transport");
                 return rpcCall("mcp.connect", {
-                    name,
+                    server_name: name,
                     transport,
                     command: p.command,
                     args: p.args,
@@ -89,13 +89,13 @@ export function createMcpManageTool(rpcCall, approvalGate) {
                 });
             },
             async disconnect(p, rpcCall, ctx) {
-                const name = readStringParam(p, "name");
-                return rpcCall("mcp.disconnect", { name, _trustLevel: ctx.trustLevel });
+                const name = readStringParam(p, "server_name");
+                return rpcCall("mcp.disconnect", { server_name: name, _trustLevel: ctx.trustLevel });
             },
             async reconnect(p, rpcCall, ctx) {
-                const name = readStringParam(p, "name");
+                const name = readStringParam(p, "server_name");
                 return rpcCall("mcp.reconnect", {
-                    name,
+                    server_name: name,
                     transport: p.transport,
                     command: p.command,
                     args: p.args,

package/node_modules/@comis/skills/dist/builtin/platform/message-tool.js

@@ -186,5 +186,23 @@ export function createMessageTool(rpcCall) {
                 }
             }
         },
+        // Capture visibleDelivery on attach.
+        // The augmenter writes to JSONL `details` only — never to `content` —
+        // so the OpenAI Responses converter strips it before re-injection.
+        augmentDetails: {
+            attach: (params, _result) => {
+                const channelType = typeof params.channel_type === "string" ? params.channel_type : "";
+                const channelId = typeof params.channel_id === "string" ? params.channel_id : "";
+                const caption = typeof params.caption === "string" ? params.caption : undefined;
+                const record = {
+                    kind: "attachment",
+                    channelType,
+                    channelId,
+                    ...(caption !== undefined && { caption }),
+                    deliveredAt: Date.now(),
+                };
+                return { visibleDelivery: record };
+            },
+        },
     }, rpcCall);
 }

package/node_modules/@comis/skills/dist/builtin/platform/messaging-factory.d.ts

@@ -60,13 +60,30 @@ export interface MultiActionDispatchConfig<T extends TSchema> {
     /** Per-action handler. Called with validated action, raw params, and rpcCall.
      *  Must return the result to be wrapped in jsonResult. */
     actionHandler: (action: string, params: Record<string, unknown>, rpcCall: RpcCall) => Promise<unknown>;
+    /**
+     * Optional per-action callback to AUGMENT the `details` field of the returned
+     * AgentToolResult. Called AFTER the actionHandler resolves; receives the raw
+     * params, the actionHandler's result, and returns an object whose entries are
+     * merged into `jsonResult(result).details`.
+     *
+     * Used by `message(action='attach')` to capture `visibleDelivery` for JSONL
+     * persistence. Caller-driven — the factory itself does not assume any
+     * specific augmentation shape.
+     *
+     * The augmenter MUST NOT touch `wrapped.content` — the OpenAI Responses
+     * converter strips `msg.content` only, so anything in `details` is
+     * JSONL-only and never re-enters the prompt context.
+     */
+    augmentDetails?: Partial<Record<string, (params: Record<string, unknown>, result: unknown) => Record<string, unknown>>>;
 }
 /**
  * Create a multi-action tool that validates the action parameter then
  * delegates to an action handler.
  *
  * Handles the common pattern: action validation via readEnumParam +
- * action handler dispatch + jsonResult + error handling.
+ * action handler dispatch + jsonResult + error handling. Optionally
+ * augments the returned `details` field via `config.augmentDetails[action]`
+ * (see `MultiActionDispatchConfig.augmentDetails`).
  *
  * @param config - Tool configuration
  * @param rpcCall - RPC call function

package/node_modules/@comis/skills/dist/builtin/platform/messaging-factory.js

@@ -54,7 +54,9 @@ export function createRpcDispatchTool(config, rpcCall) {
  * delegates to an action handler.
  *
  * Handles the common pattern: action validation via readEnumParam +
- * action handler dispatch + jsonResult + error handling.
+ * action handler dispatch + jsonResult + error handling. Optionally
+ * augments the returned `details` field via `config.augmentDetails[action]`
+ * (see `MultiActionDispatchConfig.augmentDetails`).
  *
  * @param config - Tool configuration
  * @param rpcCall - RPC call function
@@ -71,7 +73,21 @@ export function createMultiActionDispatchTool(config, rpcCall) {
                 const p = params;
                 const action = readEnumParam(p, "action", config.validActions);
                 const result = await config.actionHandler(action, p, rpcCall);
-                return jsonResult(result);
+                const wrapped = jsonResult(result);
+                // Opt-in details augmentation. Caller registers a per-action
+                // augmenter; the factory merges its output into details.
+                // The augmenter MUST NOT touch `wrapped.content` — the OpenAI Responses
+                // converter strips msg.content only, so anything in details is
+                // JSONL-only and never re-enters the prompt context.
+                const augmenter = config.augmentDetails?.[action];
+                if (augmenter) {
+                    const augmented = augmenter(p, result);
+                    return {
+                        ...wrapped,
+                        details: { ...(wrapped.details ?? {}), ...augmented },
+                    };
+                }
+                return wrapped;
             }
             catch (err) {
                 if (err instanceof Error && err.message.startsWith("["))

package/node_modules/@comis/skills/dist/builtin/platform/models-manage-tool.js

@@ -72,9 +72,9 @@ export function createModelsManageTool(rpcCall) {
                 const provider = readStringParam(p, "provider");
                 return rpcCall("models.test", { provider, _trustLevel: ctx.trustLevel });
             },
-            // Layer 1F (260430-vwt): live native-catalog provider list for
-            // agent self-discovery. Pairs with the tool-guide pointer so the
-            // agent can confirm which names auto-promote in providers.create.
+            // Live native-catalog provider list for agent self-discovery.
+            // Pairs with the tool-guide pointer so the agent can confirm which
+            // names auto-promote in providers.create.
             async list_providers(_p, rpcCall, ctx) {
                 return rpcCall("models.list_providers", { _trustLevel: ctx.trustLevel });
             },

package/node_modules/@comis/skills/dist/builtin/process-registry.d.ts

@@ -7,6 +7,7 @@
  * @module
  */
 import type { ChildProcess } from "node:child_process";
+import type { InstallDetourDecision } from "./install-detour.js";
 export interface ProcessSession {
     readonly id: string;
     readonly command: string;
@@ -21,6 +22,19 @@ export interface ProcessSession {
     readonly sandboxed: boolean;
     readonly autoBackgrounded?: boolean;
     readonly description?: string;
+    /**
+     * Install-detour decision captured at spawn time. Populated at the three
+     * exec-tool spawn sites (auto-bg, explicit-bg, foreground escalating to
+     * background) when the spawn-time parser detected overlap AND the mode was
+     * `advise`. Soft-stop refuses pre-spawn — no session exists for those
+     * calls; this field is never populated for soft-stop refusals.
+     *
+     * `process.status` reads this back on retroactive hint augmentation rather
+     * than re-deriving from current connected-server state — the connected
+     * server set may have drifted since spawn, which would produce an
+     * inconsistent hint vs the spawn-time event.
+     */
+    readonly installDetourDecision?: InstallDetourDecision;
 }
 export interface ProcessRegistry {
     add(session: ProcessSession): void;

package/node_modules/@comis/skills/dist/builtin/process-tool.d.ts

@@ -14,6 +14,7 @@
 import type { AgentTool } from "@mariozechner/pi-agent-core";
 import { Type } from "typebox";
 import type { ProcessRegistry } from "./process-registry.js";
+import type { ToolCapabilityPort } from "@comis/core";
 declare const ProcessParams: Type.TObject<{
     action: Type.TUnion<[Type.TLiteral<"list">, Type.TLiteral<"kill">, Type.TLiteral<"status">, Type.TLiteral<"log">]>;
     sessionId: Type.TOptional<Type.TString>;
@@ -25,12 +26,31 @@ interface ToolLogger {
     debug(obj: Record<string, unknown>, msg: string): void;
     info(obj: Record<string, unknown>, msg: string): void;
 }
+/**
+ * Dependencies for the process tool factory. Backward compatibility is NOT
+ * preserved (see CLAUDE.md user-memory `feedback_no_backward_compat`).
+ *
+ * `toolCapabilityPort` is REQUIRED — read inside the `case "status":` branch
+ * to decide whether to augment the result envelope with the retroactive
+ * install-detour hint (read the spawn-time `session.installDetourDecision`
+ * rather than re-deriving from current connected-server state, since the
+ * connected set may have drifted since spawn). Daemon wiring injects
+ * `createNoOpCapabilityPort()` until the real adapter is available.
+ */
+export interface ProcessToolDeps {
+    readonly registry: ProcessRegistry;
+    readonly logger?: ToolLogger;
+    /** REQUIRED for the v1.1 capability layer — used by `process.status` augmentation. */
+    readonly toolCapabilityPort: ToolCapabilityPort;
+}
 /**
  * Create a process management tool that delegates to a ProcessRegistry.
  *
- * @param registry - ProcessRegistry for session CRUD operations
- * @param logger - Optional structured logger for DEBUG-level operation logging
- * @returns AgentTool implementing the process management interface
+ * Uses a deps-object signature; backward compat with the prior positional
+ * `(registry, logger?)` shape is NOT preserved.
+ *
+ * @param deps - Dependencies bundle. See `ProcessToolDeps` for field semantics.
+ * @returns AgentTool implementing the process management interface.
  */
-export declare function createProcessTool(registry: ProcessRegistry, logger?: ToolLogger): AgentTool<typeof ProcessParams>;
+export declare function createProcessTool(deps: ProcessToolDeps): AgentTool<typeof ProcessParams>;
 export {};

package/node_modules/@comis/skills/dist/builtin/process-tool.js

@@ -14,6 +14,10 @@
  */
 import { Type } from "typebox";
 import { jsonResult, throwToolError, readEnumParam, readStringParam, readNumberParam, } from "./platform/tool-helpers.js";
+import { buildInstallDetourHint } from "./exec-tool.js";
+// `InstallDetourDecision` is imported transitively via
+// ProcessSession.installDetourDecision (process-registry.ts type-only import);
+// no direct import here — never re-derive at status-query time.
 // ---------------------------------------------------------------------------
 // Parameter schema
 // ---------------------------------------------------------------------------
@@ -30,17 +34,19 @@ const ProcessParams = Type.Object({
     offset: Type.Optional(Type.Integer({ description: "Line offset for log pagination (0-indexed)" })),
     limit: Type.Optional(Type.Integer({ description: "Max lines to return for log (default 200)" })),
 });
-// ---------------------------------------------------------------------------
-// Factory
-// ---------------------------------------------------------------------------
 /**
  * Create a process management tool that delegates to a ProcessRegistry.
  *
- * @param registry - ProcessRegistry for session CRUD operations
- * @param logger - Optional structured logger for DEBUG-level operation logging
- * @returns AgentTool implementing the process management interface
+ * Uses a deps-object signature; backward compat with the prior positional
+ * `(registry, logger?)` shape is NOT preserved.
+ *
+ * @param deps - Dependencies bundle. See `ProcessToolDeps` for field semantics.
+ * @returns AgentTool implementing the process management interface.
  */
-export function createProcessTool(registry, logger) {
+export function createProcessTool(deps) {
+    const { registry, logger,
+    // toolCapabilityPort is read inside execute(...) below
+     } = deps;
     return {
         name: "process",
         label: "Process",
@@ -76,6 +82,18 @@ export function createProcessTool(registry, logger) {
                         if (!details) {
                             throwToolError("not_found", `Process session not found: ${sessionId}`);
                         }
+                        // Retroactive advise-mode hint augmentation. Read the spawn-time
+                        // decision back from the session rather than re-deriving from current
+                        // connected-server state (the connected set may have drifted since
+                        // spawn, producing an inconsistent hint vs the spawn-time event).
+                        // No current-mode check — operators can switch modes mid-session via
+                        // daemon restart; advise-spawned sessions keep their hint.
+                        const session = registry.get(sessionId);
+                        if (session?.installDetourDecision &&
+                            session.installDetourDecision.overlaps.length > 0) {
+                            const hint = buildInstallDetourHint(session.installDetourDecision);
+                            return jsonResult({ ...details, installDetourHint: hint.installDetourHint });
+                        }
                         return jsonResult(details);
                     }
                     case "log": {

package/node_modules/@comis/skills/dist/builtin/sandbox/bwrap-provider.d.ts

@@ -7,6 +7,17 @@
  * @module
  */
 import type { SandboxOptions, SandboxProvider } from "./types.js";
+/**
+ * System paths to bind read-only. Filtered by existsSync once at
+ * first buildArgs() call and cached for the provider's lifetime.
+ *
+ * Exported so the bwrap smoke test in detect-provider.ts consumes the
+ * same list — drift between smoke and production binds caused a real
+ * false-negative on usrmerge x86-64 hosts (smoke test missed /lib64
+ * → /bin/true's dynamic linker unreachable → smoke EPERMs while the
+ * production sandbox actually works fine).
+ */
+export declare const SYSTEM_RO_PATHS: readonly ["/usr", "/bin", "/sbin", "/lib", "/lib64", "/lib32", "/etc/resolv.conf", "/etc/hosts", "/etc/hostname", "/etc/ssl", "/etc/ca-certificates", "/etc/pki", "/etc/ld.so.cache", "/etc/ld.so.conf", "/etc/ld.so.conf.d", "/etc/alternatives", "/etc/localtime", "/etc/passwd", "/etc/group", "/etc/nsswitch.conf", "/etc/fonts"];
 export declare class BwrapProvider implements SandboxProvider {
     readonly name = "bwrap";
     private bwrapPath;

package/node_modules/@comis/skills/dist/builtin/sandbox/bwrap-provider.js

@@ -14,8 +14,14 @@ import path from "node:path";
 /**
  * System paths to bind read-only. Filtered by existsSync once at
  * first buildArgs() call and cached for the provider's lifetime.
+ *
+ * Exported so the bwrap smoke test in detect-provider.ts consumes the
+ * same list — drift between smoke and production binds caused a real
+ * false-negative on usrmerge x86-64 hosts (smoke test missed /lib64
+ * → /bin/true's dynamic linker unreachable → smoke EPERMs while the
+ * production sandbox actually works fine).
  */
-const SYSTEM_RO_PATHS = [
+export const SYSTEM_RO_PATHS = [
     "/usr",
     "/bin",
     "/sbin",
@@ -36,6 +42,15 @@ const SYSTEM_RO_PATHS = [
     "/etc/passwd",
     "/etc/group",
     "/etc/nsswitch.conf",
+    // fontconfig config (font.conf, conf.d/). Without this, libfontconfig prints
+    // "Cannot load default config file" to stderr on every text-rendering call
+    // (matplotlib, Pango, Pillow TTF, ImageMagick, headless Chromium, weasyprint,
+    // ffmpeg drawtext, LibreOffice headless) and falls back to a minimal compiled-in
+    // config — which silently breaks the substitution chain for non-Latin scripts
+    // (CJK/Arabic/devanagari render as Tofu boxes even when the fonts are present
+    // under /usr/share/fonts). Per-user cache lives in XDG_CACHE_HOME/fontconfig,
+    // which is already RW via the workspace .cache bind in wrapEnv().
+    "/etc/fonts",
 ];
 /**
  * Per-user config paths to bind read-only. Resolved against the daemon
@@ -73,6 +88,40 @@ function getClaudeCodeRwPaths(home) {
         /* eslint-enable no-restricted-syntax */
     ].filter((p) => existsSync(p));
 }
+/**
+ * Per-user XDG paths that need read-write access for language package managers.
+ *
+ * These paths MUST match the systemd ReadWritePaths in
+ * packages/daemon/systemd/comis.service.template. Without RW access here,
+ * package managers writing to standard XDG paths (npm, uv, pipx, cargo, go,
+ * deno, bun) fail with EROFS at the bwrap mount layer even when the outer
+ * systemd sandbox permits the write.
+ *
+ * Why these specific paths:
+ * - ~/.npm     -- npm/npx default cache + global modules root.
+ * - ~/.cache   -- XDG_CACHE_HOME default; uv archives, deno cache, bun cache,
+ *                pip wheel cache, cargo registry cache, go module cache.
+ *                wrapEnv() also redirects most caches into the workspace, but
+ *                some tools (e.g. uv's archive cache) still touch ~/.cache
+ *                during early bootstrap before env vars take effect.
+ * - ~/.local/share -- XDG_DATA_HOME default; uvx tool installs, pipx venvs,
+ *                    rustup toolchains, generic XDG_DATA consumers.
+ *
+ * Note: this returns a subset of paths bound RO by getUserRoPaths
+ * (specifically ~/.local). The RW bind is emitted AFTER the RO bind in
+ * buildArgs, which causes bwrap to apply the more-permissive RW mount on
+ * top of the RO mount for the ~/.local/share subpath. ~/.local itself
+ * remains RO; only ~/.local/share becomes RW.
+ */
+function getDevToolRwPaths(home) {
+    /* eslint-disable no-restricted-syntax -- Trusted: constant subpaths of homedir, no user input */
+    return [
+        path.join(home, ".npm"),
+        path.join(home, ".cache"),
+        path.join(home, ".local", "share"),
+        /* eslint-enable no-restricted-syntax */
+    ].filter((p) => existsSync(p));
+}
 export class BwrapProvider {
     name = "bwrap";
     bwrapPath = null;
@@ -124,6 +173,14 @@ export class BwrapProvider {
         for (const cp of getClaudeCodeRwPaths(os.homedir())) {
             args.push("--bind", cp, cp);
         }
+        // -- Dev tool RW paths (read-write) --
+        // MUST come after getUserRoPaths above so the RW bind for ~/.local/share
+        // overrides the RO bind for ~/.local. MUST come before the discovery
+        // readOnlyPaths loop below so caller-supplied RO can't shadow these.
+        // Mirror of systemd ReadWritePaths in comis.service.template.
+        for (const dp of getDevToolRwPaths(os.homedir())) {
+            args.push("--bind", dp, dp);
+        }
         // -- Read-only paths (discovery paths, custom) --
         for (const ro of opts.readOnlyPaths) {
             if (existsSync(ro)) {
@@ -139,6 +196,24 @@ export class BwrapProvider {
     wrapEnv(env, workspacePath) {
         // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
         const cacheDir = path.join(workspacePath, ".cache");
+        // Workspace-rooted bin dirs that hold CLIs installed by sandboxed package
+        // managers. Prepended to PATH so a binary installed by `cargo install <crate>`
+        // (or pipx, go install, bun add -g, deno install, pnpm add -g) on one exec
+        // call is invocable on the NEXT exec call. Ordering: highest-frequency first.
+        const toolBinPaths = [
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            path.join(workspacePath, ".local", "bin"), // PYTHONUSERBASE/bin + PIPX_BIN_DIR
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            path.join(cacheDir, "cargo", "bin"), // cargo install
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            path.join(cacheDir, "go", "bin"), // go install
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            path.join(cacheDir, "bun", "bin"), // bun add -g
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            path.join(cacheDir, "pnpm"), // pnpm global (PNPM_HOME itself is the bin dir)
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            path.join(cacheDir, "deno", "bin"), // deno install
+        ];
         return {
             ...env,
             // Temp files: heredocs, wheel builds, etc.
@@ -150,6 +225,15 @@ export class BwrapProvider {
             // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
             PIP_CACHE_DIR: path.join(cacheDir, "pip"),
             XDG_CACHE_HOME: cacheDir,
+            // XDG_STATE_HOME (~/.local/state by default): pipx logs, some Python
+            // tools, runtime state. The ~/.local parent bind is RO (getUserRoPaths)
+            // and getDevToolRwPaths only carves out ~/.local/share, so anything
+            // defaulting to ~/.local/state would EROFS without this redirect.
+            // pipx happens to survive (PIPX_HOME captures all pipx state) but other
+            // XDG-state-using tools would not. Defensive belt-and-suspenders matching
+            // the existing XDG_CACHE_HOME pattern.
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            XDG_STATE_HOME: path.join(workspacePath, ".local", "state"),
             // Python: redirect user packages into workspace.
             // PYTHONNOUSERSITE is NOT set — sandbox read paths cover dirs that
             // pip needs to scan. Removing it lets Python find packages installed
@@ -176,6 +260,44 @@ export class BwrapProvider {
             GEM_HOME: path.join(cacheDir, "gems"),
             // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
             BUNDLE_PATH: path.join(cacheDir, "bundle"),
+            // Rust: rustup multiplexer needs RUSTUP_HOME to locate the toolchain.
+            // Pointed at the system rustup install (written by install.sh's
+            // install_rust at /usr/local/rustup). A workspace-rooted RUSTUP_HOME
+            // would be empty on first call, breaking `cargo install <crate>` with
+            // "rustup could not choose a version of cargo to run, because no default
+            // is configured" — confirmed on a real VPS during the dev-sandbox matrix
+            // test. CARGO_HOME stays workspace-rooted (above) so `cargo install`
+            // outputs land in <workspace>/.cache/cargo/bin and survive.
+            // Tradeoff: agent loses the ability to `rustup install <toolchain>` from
+            // inside exec (would need RW to /usr/local/rustup). Acceptable — the
+            // canonical use case is `cargo install <crate>`, which works.
+            RUSTUP_HOME: "/usr/local/rustup",
+            // uv: tool install dir for `uvx` / `uv tool install` (paired with UV_PYTHON_INSTALL_DIR above).
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            UV_TOOL_DIR: path.join(cacheDir, "uv", "tools"),
+            // pipx: venvs root + bin dir. PIPX_BIN_DIR aligns with PYTHONUSERBASE/bin
+            // (PYTHONUSERBASE = workspace/.local) so user-installed and pipx-installed
+            // CLIs share a single PATH entry: workspace/.local/bin.
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            PIPX_HOME: path.join(cacheDir, "pipx"),
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            PIPX_BIN_DIR: path.join(workspacePath, ".local", "bin"),
+            // pnpm global store + bin dir (PNPM_HOME is on PATH below).
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            PNPM_HOME: path.join(cacheDir, "pnpm"),
+            // bun: install root; binaries land in $BUN_INSTALL/bin.
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            BUN_INSTALL: path.join(cacheDir, "bun"),
+            // deno: cache + installed CLI dir ($DENO_DIR/bin via `deno install`).
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            DENO_DIR: path.join(cacheDir, "deno"),
+            // yarn cache; mirrors the others for completeness even though yarn is rare in agent flows.
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            YARN_CACHE_FOLDER: path.join(cacheDir, "yarn"),
+            // PATH augmentation MUST come after the spread above so it overrides
+            // any PATH carried in `env`. Empty entries are filtered to avoid
+            // trailing/duplicate colons when env.PATH is undefined.
+            PATH: [...toolBinPaths, env.PATH ?? ""].filter(Boolean).join(":"),
         };
     }
 }