open-managed-agents 0.1.1 → 0.2.0

package/dist/src/control-plane/models/credential-store.js

@@ -0,0 +1,203 @@
+import { execSync } from "node:child_process";
+export class InMemoryAuthStorageBackend {
+    content;
+    // Serializes async read-modify-writes, as Pi's in-memory backend does.
+    chain = Promise.resolve();
+    constructor(data) {
+        if (data !== undefined)
+            this.content = JSON.stringify(data, null, 2);
+    }
+    withLock(fn) {
+        const { result, next } = fn(this.content);
+        if (next !== undefined)
+            this.content = next;
+        return result;
+    }
+    withLockAsync(fn) {
+        const run = this.chain.then(async () => {
+            const { result, next } = await fn(this.content);
+            if (next !== undefined)
+                this.content = next;
+            return result;
+        });
+        this.chain = run.catch(() => { });
+        return run;
+    }
+}
+export class OmaCredentialStore {
+    backend;
+    inflightRead;
+    commands;
+    constructor(backend, options = {}) {
+        this.backend = backend;
+        this.commands = options.commands ?? "deny";
+    }
+    async read(providerId, options) {
+        const credential = (await this.readAll(options))[providerId];
+        if (credential?.type !== "api_key" || credential.key === undefined)
+            return credential;
+        if (credential.key.startsWith("!")) {
+            if (this.commands === "unresolved")
+                return credential;
+            if (this.commands === "deny") {
+                throw new Error(`auth.json.${providerId}.key uses command-backed auth; set OMA_ALLOW_MODEL_AUTH_COMMANDS=true to allow it`);
+            }
+        }
+        return { ...credential, key: resolveConfigValue(credential.key, credential.env) };
+    }
+    async list(options) {
+        return Object.entries(await this.readAll(options)).map(([providerId, credential]) => ({
+            providerId,
+            type: credential.type,
+        }));
+    }
+    async modify(providerId, fn, options) {
+        options?.signal?.throwIfAborted();
+        return this.backend.withLockAsync(async (content) => {
+            const data = parseAuthData(content);
+            const next = await fn(data[providerId]);
+            if (next === undefined)
+                return { result: data[providerId] };
+            return { result: next, next: JSON.stringify({ ...data, [providerId]: next }, null, 2) };
+        });
+    }
+    async delete(providerId, options) {
+        options?.signal?.throwIfAborted();
+        await this.backend.withLockAsync(async (content) => {
+            const data = parseAuthData(content);
+            delete data[providerId];
+            return { result: undefined, next: JSON.stringify(data, null, 2) };
+        });
+    }
+    // Pi's availability refresh reads every provider in parallel; concurrent
+    // readers share one locked read instead of contending for the file lock.
+    readAll(options) {
+        options?.signal?.throwIfAborted();
+        this.inflightRead ??= this.backend
+            .withLockAsync(async (content) => ({ result: parseAuthData(content) }))
+            .finally(() => {
+            this.inflightRead = undefined;
+        });
+        return this.inflightRead;
+    }
+}
+/**
+ * OMA never enables Pi's network model catalogs, so the cache Pi would keep
+ * in models-store.json is unnecessary; an in-memory store avoids creating
+ * that file next to models.json (Pi's file stores create on first lock).
+ */
+export class InMemoryModelsStore {
+    entries = new Map();
+    async read(providerId) {
+        return this.entries.get(providerId);
+    }
+    async write(providerId, entry) {
+        this.entries.set(providerId, entry);
+    }
+    async delete(providerId) {
+        this.entries.delete(providerId);
+    }
+}
+function parseAuthData(content) {
+    if (!content)
+        return {};
+    return JSON.parse(content.replace(/^/, ""));
+}
+// ---------------------------------------------------------------------------
+// Config-value resolution, ported from Pi's core/resolve-config-value.ts
+// (MIT, (c) Mario Zechner; unchanged from 0.80.6 through 0.85.1) because Pi no
+// longer exports it. Semantics:
+// - "!cmd" runs cmd in a shell and uses trimmed stdout (cached per process);
+//   OMA only admits these when OMA_ALLOW_MODEL_AUTH_COMMANDS=true
+//   (config-security.ts);
+// - "$VAR" / "${VAR}" interpolate the environment ("$$" and "$!" escape);
+// - anything else is a literal.
+// Omitted: Pi's Windows configured-shell path; OMA does not target Windows.
+// ---------------------------------------------------------------------------
+const ENV_VAR_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const ENV_VAR_NAME_PREFIX_RE = /^[A-Za-z_][A-Za-z0-9_]*/;
+const commandResultCache = new Map();
+export function resolveConfigValue(config, env) {
+    if (config.startsWith("!"))
+        return executeCommand(config);
+    let resolved = "";
+    for (const part of parseTemplate(config)) {
+        if (part.type === "literal") {
+            resolved += part.value;
+            continue;
+        }
+        const value = env?.[part.name] || process.env[part.name] || undefined;
+        if (value === undefined)
+            return undefined;
+        resolved += value;
+    }
+    return resolved;
+}
+function parseTemplate(config) {
+    const parts = [];
+    const literal = (value) => {
+        if (!value)
+            return;
+        const last = parts[parts.length - 1];
+        if (last?.type === "literal")
+            last.value += value;
+        else
+            parts.push({ type: "literal", value });
+    };
+    let index = 0;
+    while (index < config.length) {
+        const dollar = config.indexOf("$", index);
+        if (dollar < 0) {
+            literal(config.slice(index));
+            break;
+        }
+        literal(config.slice(index, dollar));
+        const next = config[dollar + 1];
+        if (next === "$" || next === "!") {
+            literal(next);
+            index = dollar + 2;
+            continue;
+        }
+        if (next === "{") {
+            const end = config.indexOf("}", dollar + 2);
+            if (end < 0) {
+                literal("$");
+                index = dollar + 1;
+                continue;
+            }
+            const name = config.slice(dollar + 2, end);
+            if (ENV_VAR_NAME_RE.test(name))
+                parts.push({ type: "env", name });
+            else
+                literal(config.slice(dollar, end + 1));
+            index = end + 1;
+            continue;
+        }
+        const match = config.slice(dollar + 1).match(ENV_VAR_NAME_PREFIX_RE);
+        if (match) {
+            parts.push({ type: "env", name: match[0] });
+            index = dollar + 1 + match[0].length;
+            continue;
+        }
+        literal("$");
+        index = dollar + 1;
+    }
+    return parts;
+}
+function executeCommand(config) {
+    if (commandResultCache.has(config))
+        return commandResultCache.get(config);
+    let result;
+    try {
+        result = execSync(config.slice(1), {
+            encoding: "utf-8",
+            timeout: 10_000,
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim() || undefined;
+    }
+    catch {
+        result = undefined;
+    }
+    commandResultCache.set(config, result);
+    return result;
+}

package/dist/src/control-plane/sessions/pi/mcp/client.js

@@ -15,7 +15,11 @@ export const DEFAULT_MCP_OPERATION_TIMEOUT_MS = 60_000;
 // structured mcp_connection_failed_error), never a silent partial register.
 const MAX_DISCOVERED_TOOLS = 256;
 const MAX_TOOL_NAME_LENGTH = 256;
-const MAX_TOOL_DESCRIPTION_LENGTH = 4_096;
+// Notion's official server currently publishes several detailed tool
+// descriptions above 4 KiB (the largest observed in the OAuth acceptance
+// flow is 7,602 characters). Keep a per-tool bound, but leave enough room for
+// standards-compliant first-party servers to describe complex operations.
+const MAX_TOOL_DESCRIPTION_LENGTH = 16_384;
 const MAX_TOOL_SCHEMA_BYTES = 64 * 1024;
 const MAX_TOOL_LIST_PAGES = 16;
 export class McpConnection {

package/dist/src/control-plane/sessions/pi/runner.js

@@ -1,4 +1,5 @@
-import { AuthStorage, createAgentSession, createSyntheticSourceInfo, DefaultResourceLoader, ModelRegistry, SessionManager, } from "@earendil-works/pi-coding-agent";
+import { createAgentSession, createSyntheticSourceInfo, DefaultResourceLoader, ModelRegistry, ModelRuntime, SessionManager, } from "@earendil-works/pi-coding-agent";
+import { InMemoryAuthStorageBackend, InMemoryModelsStore, OmaCredentialStore, } from "../../models/credential-store.js";
 import { RuntimeUnsupportedSessionFileResourcesError } from "../../events/types.js";
 import { PiCustomToolBridge, } from "./custom-tools.js";
 import { PiToolPermissionBridge, } from "./tool-permissions.js";
@@ -35,16 +36,27 @@ export function buildSessionSkillsResourceLoader(skills, systemPrompt) {
 }
 const DEFAULT_MCP_MAX_CONSECUTIVE_FAILURES = 5;
 const MCP_UNAUTHENTICATED_FINGERPRINT = "none";
-function createPrivatePiModelCatalog(provider = "anthropic", modelId = "claude-haiku-4-5") {
-    const authStorage = AuthStorage.create();
-    const modelRegistry = ModelRegistry.create(authStorage);
+async function createPrivatePiModelCatalog(provider = "anthropic", modelId = "claude-haiku-4-5") {
+    // No stored credentials: provider auth comes from the environment. This
+    // seam never reads the operator's personal Pi auth.json.
+    const credentials = new OmaCredentialStore(new InMemoryAuthStorageBackend());
+    // modelsPath null: no models.json either (Pi would otherwise read the
+    // operator's ~/.pi/agent/models.json, which no OMA policy scan covers).
+    const modelRuntime = await ModelRuntime.create({
+        credentials,
+        modelsPath: null,
+        modelsStore: new InMemoryModelsStore(),
+    });
+    const modelRegistry = new ModelRegistry(modelRuntime);
     const allowedProviders = new Set([provider]);
     return {
         defaultModel: { provider, id: modelId },
         allowedProviders,
-        authStorage,
+        credentials,
+        modelRuntime,
         modelRegistry,
         securityReport: { warnings: [] },
+        assertConfigSecurity: () => { },
         // Standalone runners are an internal/test seam without deployment
         // admission policy. Production always receives the shared allowlisted
         // catalog from the composition root.
@@ -67,9 +79,7 @@ function createPrivatePiModelCatalog(provider = "anthropic", modelId = "claude-h
 }
 export class PiSessionRunner {
     opts;
-    authStorage;
-    modelRegistry;
-    modelCatalog;
+    modelCatalogPromise;
     sessions = new Map();
     pendingSessions = new Map();
     pendingInterrupts = new Map();
@@ -91,10 +101,9 @@ export class PiSessionRunner {
     closed = false;
     constructor(opts = {}) {
         this.opts = opts;
-        const catalog = opts.modelCatalog ?? createPrivatePiModelCatalog(opts.provider, opts.model);
-        this.modelCatalog = catalog;
-        this.authStorage = catalog.authStorage;
-        this.modelRegistry = catalog.modelRegistry;
+        if (opts.modelCatalog !== undefined) {
+            this.modelCatalogPromise = Promise.resolve(opts.modelCatalog);
+        }
         this.resolveSandboxProviderFactory();
         this.idleTtlMs = opts.idleTtlMs ?? DEFAULT_IDLE_TTL_MS;
         this.now = opts.now ?? Date.now;
@@ -254,7 +263,7 @@ export class PiSessionRunner {
         this.touch(sessionId, handle);
         if (handle.running && !handle.needsFreshPromptAfterInterrupt) {
             try {
-                await handle.session.followUp(text);
+                steerVerbatim(handle.session, text);
                 this.touch(sessionId, handle);
             }
             catch (error) {
@@ -269,7 +278,7 @@ export class PiSessionRunner {
         const activeSandboxedToolCalls = new Map();
         let done = false;
         let failure;
-        let becameFollowUp = false;
+        let queuedOnRunningTurn = false;
         let wake;
         const stop = handle.session.subscribe((event) => {
             updateRunning(handle, event);
@@ -325,16 +334,19 @@ export class PiSessionRunner {
         };
         signal?.addEventListener("abort", onAbort, { once: true });
         const run = handle.session
-            .prompt(text)
+            // Verbatim, as hosted: Pi's default expands "/skill:<name>" by reading
+            // the skill file from the control-plane host, not the sandbox (#255).
+            .prompt(text, { expandPromptTemplates: false })
             .catch(async (error) => {
             if (isAlreadyProcessing(error)) {
-                await handle.session.followUp(text);
-                // Best effort for the losing prompt race: once Pi confirms this turn
-                // is a follow-up, discard overlap events captured by this temporary
-                // subscriber. A pre-rejection event can still escape; in practice that
-                // should be limited to early status frames, while the winning prompt
-                // subscriber owns the full turn and follow-up output.
-                becameFollowUp = true;
+                steerVerbatim(handle.session, text);
+                // Best effort for the losing prompt race: once Pi confirms this
+                // message is queued on the running turn, discard overlap events
+                // captured by this temporary subscriber. A pre-rejection event can
+                // still escape; in practice that should be limited to early status
+                // frames, while the winning prompt subscriber owns the full turn,
+                // including the steered message's output.
+                queuedOnRunningTurn = true;
                 queue.length = 0;
                 return;
             }
@@ -346,12 +358,12 @@ export class PiSessionRunner {
         });
         try {
             while (!done || queue.length > 0) {
-                if (becameFollowUp)
+                if (queuedOnRunningTurn)
                     break;
                 if (queue.length === 0) {
                     await new Promise((resolve) => {
                         wake = resolve;
-                        if (done || becameFollowUp || queue.length > 0) {
+                        if (done || queuedOnRunningTurn || queue.length > 0) {
                             wake = undefined;
                             resolve();
                         }
@@ -462,15 +474,16 @@ export class PiSessionRunner {
         const created = (async () => {
             const customToolContext = this.preparingSessionAgentContext(workspaceId, sessionId);
             const agentRevision = this.opts.agentRevision?.(workspaceId, sessionId, customToolContext);
+            const modelCatalog = await this.modelCatalog();
             const revisionModel = agentRevision === undefined
                 ? undefined
-                : this.modelCatalog.resolve(agentRevision.model);
+                : modelCatalog.resolve(agentRevision.model);
             if (agentRevision !== undefined && revisionModel === undefined) {
                 throw new Error(`Pi model not available: ${agentRevision.model.provider}/${agentRevision.model.id}`);
             }
             if (agentRevision !== undefined &&
                 revisionModel !== undefined &&
-                !this.modelCatalog.hasConfiguredAuth(revisionModel)) {
+                !modelCatalog.hasConfiguredAuth(revisionModel)) {
                 throw new Error(`Credentials for model provider ${agentRevision.model.provider} are not configured on this deployment`);
             }
             const customToolNames = new Set((this.opts.customTools?.(workspaceId, sessionId, customToolContext) ?? []).map((tool) => tool.name));
@@ -735,12 +748,14 @@ export class PiSessionRunner {
         }
     }
     async createPiSession(workspaceId, sessionId, sandbox, context, revision, revisionModel, mcpTools = []) {
-        const provider = revision?.model.provider ?? this.modelCatalog.defaultModel.provider;
-        const modelId = revision?.model.id ?? this.modelCatalog.defaultModel.id;
-        const model = revisionModel ?? this.modelCatalog.resolve({ provider, id: modelId });
+        const modelCatalog = await this.modelCatalog();
+        const provider = revision?.model.provider ?? modelCatalog.defaultModel.provider;
+        const modelId = revision?.model.id ?? modelCatalog.defaultModel.id;
+        const model = revisionModel ?? modelCatalog.resolve({ provider, id: modelId });
         if (!model) {
             throw new Error(`Pi model not available: ${provider}/${modelId}`);
         }
+        modelCatalog.assertConfigSecurity();
         const customToolNames = (this.opts.customTools?.(workspaceId, sessionId, context) ?? []).map((tool) => tool.name);
         const sandboxTools = this.enabledSandboxTools(workspaceId, sessionId, sandbox);
         const customTools = [
@@ -761,8 +776,7 @@ export class PiSessionRunner {
                 ]
                 : [...customToolNames, ...mcpToolNames],
             customTools,
-            authStorage: this.authStorage,
-            modelRegistry: this.modelRegistry,
+            modelRuntime: modelCatalog.modelRuntime,
             sessionManager: SessionManager.inMemory(),
             resourceLoader: await this.createResourceLoader(workspaceId, sessionId, revision?.system ?? undefined),
         });
@@ -778,6 +792,16 @@ export class PiSessionRunner {
         await loader.reload();
         return loader;
     }
+    // Pi's ModelRuntime can only be built asynchronously, so the standalone
+    // default catalog is created on first use rather than in the constructor.
+    modelCatalog() {
+        // Reset on failure so one bad attempt is not cached for the runner's life.
+        this.modelCatalogPromise ??= createPrivatePiModelCatalog(this.opts.provider, this.opts.model).catch((error) => {
+            this.modelCatalogPromise = undefined;
+            throw error;
+        });
+        return this.modelCatalogPromise;
+    }
     preparingSessionAgentContext(workspaceId, sessionId) {
         const preparing = this.preparingSessionAgents.get(sessionId);
         if (preparing?.workspaceId !== workspaceId)
@@ -876,7 +900,7 @@ export class PiSessionRunner {
         }
         catch {
             // interruptSession callers observe abort errors; message delivery waits only
-            // for the abort window to close before deciding prompt vs follow-up.
+            // for the abort window to close before deciding prompt vs steer.
         }
     }
     evict(sessionId, handle) {
@@ -930,6 +954,9 @@ function updateRunning(handle, event) {
     if (type === "agent_end")
         handle.running = false;
 }
+function steerVerbatim(session, text) {
+    session.agent.steer({ role: "user", content: [{ type: "text", text }], timestamp: Date.now() });
+}
 function isAlreadyProcessing(error) {
     return (error instanceof Error &&
         error.message.includes(ALREADY_PROCESSING_MESSAGE));

package/dist/src/control-plane/sessions/pi/sandbox/container-engine.js

@@ -0,0 +1,32 @@
+import { spawnSync } from "node:child_process";
+const detected = new Map();
+/**
+ * Which engine answers to `command`. Podman (directly, via the podman-docker
+ * shim, or via a `docker` symlink) accepts the Docker CLI except for a few
+ * flags, so docker-local speaks a small dialect instead of a separate provider.
+ * Detected once per command; anything that is not Podman is treated as Docker.
+ */
+export function detectContainerEngine(command) {
+    let engine = detected.get(command);
+    if (engine === undefined) {
+        // Not `--version`: Podman names itself after argv[0], so a `docker`
+        // symlink prints "docker version …". `version` always reports the client
+        // engine. Match the client only: a Docker CLI pointed at a Podman socket
+        // still sends Docker flags.
+        const result = spawnSync(command, ["version"], { encoding: "utf8" });
+        engine = /^Client:\s*Podman/m.test(result.stdout ?? "") ? "podman" : "docker";
+        detected.set(command, engine);
+    }
+    return engine;
+}
+/**
+ * tmpfs ownership option for a mount owned by `uid` (same gid). Docker takes
+ * `uid=`/`gid=`; Podman 4.x rejects them ("unknown mount option") and instead
+ * offers `U`, which chowns the mount to the container's `--user`. Root
+ * ownership is Podman's default, so uid 0 needs no option there.
+ */
+export function tmpfsOwnerOption(engine, uid) {
+    if (engine === "podman")
+        return uid === 0 ? "" : ",U";
+    return `,uid=${uid},gid=${uid}`;
+}

package/dist/src/control-plane/sessions/pi/sandbox/docker-egress.js

@@ -23,6 +23,7 @@ import { spawnSync } from "node:child_process";
 import { mkdirSync, mkdtempSync, readdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { detectContainerEngine, } from "./container-engine.js";
 const SIDECAR_LABEL_KEY = "open-managed-agents.egress-sidecar";
 const SIDECAR_LABEL_VALUE = "docker-local";
 const DEFAULT_READINESS_TIMEOUT_MS = 20_000;
@@ -95,6 +96,7 @@ export async function createEgressSidecar(opts) {
             repoMount: opts.sidecarRepoMount,
             user: currentUserSpec(),
             labels: sidecarLabels(opts.labels, opts.sessionId),
+            engine: detectContainerEngine(opts.dockerCommand),
         }), opts.operationTimeoutMs);
         containerStarted = true;
         // Dual-home: the run above put the sidecar on the default bridge (upstream
@@ -173,6 +175,12 @@ export function buildSidecarRunArgs(opts) {
         `/tmp:rw,nosuid,nodev,size=${opts.tmpfsSize ?? DEFAULT_SIDECAR_TMPFS_SIZE}`,
         "--user",
         opts.user,
+        // Rootless Podman maps the host uid to container root, so `--user <uid>`
+        // alone could not read the 0600 bundle; keep-id preserves the mapping.
+        ...(opts.engine === "podman" ? ["--userns=keep-id"] : []),
+        // Node as PID 1 does not exit on SIGTERM; keep `rm -f` immediate.
+        "--stop-timeout",
+        "0",
         "--memory",
         opts.memory ?? DEFAULT_SIDECAR_MEMORY,
         "--pids-limit",

package/dist/src/control-plane/sessions/pi/sandbox/docker.js

@@ -10,6 +10,7 @@ import { matchGlob } from "./glob.js";
 import { createEgressSidecar, egressProxyUrl, reapEgressSidecars, } from "./docker-egress.js";
 import { createSandboxInvocationStats, createSandboxToolDefinitions, recordSandboxInvocation, } from "./provider.js";
 import { MAX_SESSION_OUTPUT_BYTES, MAX_SESSION_OUTPUT_FILE_BYTES, MAX_SESSION_OUTPUT_FILES, } from "../../../files/types.js";
+import { detectContainerEngine, tmpfsOwnerOption, } from "./container-engine.js";
 import { DEFAULT_OMA_SANDBOX_IMAGE } from "./image.js";
 export const DEFAULT_DOCKER_SANDBOX_IMAGE = DEFAULT_OMA_SANDBOX_IMAGE;
 const DEFAULT_WORKSPACE = "/workspace";
@@ -115,6 +116,7 @@ export async function createDockerSandboxProvider(workspaceId, sessionId, opts =
             tmpfsSize: resolved.tmpfsSize,
             outputsTmpfsSize: resolved.outputsTmpfsSize,
             egress: opts.egress?.wiring,
+            engine: detectContainerEngine(resolved.dockerCommand),
             labels: {
                 [SANDBOX_LABEL_KEY]: SANDBOX_LABEL_VALUE,
                 [OWNER_LABEL_KEY]: OWNER_LABEL_VALUE,
@@ -611,6 +613,8 @@ export function buildDockerRunArgs(opts) {
     // Default deny (ADR 0016 §2): no egress wiring -> --network none, no proxy.
     const network = opts.egress ? opts.egress.networkName : "none";
     const egressArgs = opts.egress ? buildEgressRunArgs(opts.egress) : [];
+    const engine = opts.engine ?? "docker";
+    const sandboxOwner = tmpfsOwnerOption(engine, 65534);
     return [
         "run",
         "-d",
@@ -631,14 +635,18 @@ export function buildDockerRunArgs(opts) {
         "--security-opt",
         "no-new-privileges",
         "--read-only",
+        // PID 1 is `tail -f /dev/null`, which ignores SIGTERM: without this,
+        // Podman's `rm -f` waits the full 10 s stop timeout before SIGKILL.
+        "--stop-timeout",
+        "0",
         "--tmpfs",
-        `${opts.workspacePath}:rw,exec,nosuid,nodev,uid=65534,gid=65534,mode=700,size=${opts.tmpfsSize}`,
+        `${opts.workspacePath}:rw,exec,nosuid,nodev${sandboxOwner},mode=700,size=${opts.tmpfsSize}`,
         "--tmpfs",
         `${uploadsPath}:rw,nosuid,nodev,noexec,mode=755,size=${opts.tmpfsSize}`,
         "--tmpfs",
-        `${outputsPath}:rw,nosuid,nodev,noexec,uid=65534,gid=65534,mode=700,size=${outputsTmpfsSize}`,
+        `${outputsPath}:rw,nosuid,nodev,noexec${sandboxOwner},mode=700,size=${outputsTmpfsSize}`,
         "--tmpfs",
-        `${DEFAULT_SKILLS_PATH}:rw,exec,nosuid,nodev,uid=0,gid=0,mode=755,size=${opts.tmpfsSize}`,
+        `${DEFAULT_SKILLS_PATH}:rw,exec,nosuid,nodev${tmpfsOwnerOption(engine, 0)},mode=755,size=${opts.tmpfsSize}`,
         "--workdir",
         opts.workspacePath,
         "--user",
@@ -694,10 +702,15 @@ export function buildDockerExtractIntoContainerArgs(containerName, destinationDi
     ];
 }
 export function buildDockerNormalizeUploadsArgs(containerName, uploadsPath) {
+    // --workdir /: the container workdir is /workspace (mode 700, uid 65534) and
+    // root has no CAP_DAC_OVERRIDE under --cap-drop ALL, so GNU find in the OMA
+    // image fails to save/restore a /workspace cwd.
     return [
         "exec",
         "--user",
         "0:0",
+        "--workdir",
+        "/",
         containerName,
         "sh",
         "-c",
@@ -707,7 +720,7 @@ export function buildDockerNormalizeUploadsArgs(containerName, uploadsPath) {
     ];
 }
 export function buildDockerNormalizeSkillsArgs(containerName, skillsPath) {
-    return ["exec", "--user", "0:0", containerName, "sh", "-c", "chown -R 0:0 \"$1\" && find \"$1\" -type d -exec chmod 755 {} + && find \"$1\" -type f -exec chmod 644 {} + && find \"$1\" -path '*/scripts/*' -type f -exec chmod 755 {} +", "sh", skillsPath];
+    return ["exec", "--user", "0:0", "--workdir", "/", containerName, "sh", "-c", "chown -R 0:0 \"$1\" && find \"$1\" -type d -exec chmod 755 {} + && find \"$1\" -type f -exec chmod 644 {} + && find \"$1\" -path '*/scripts/*' -type f -exec chmod 755 {} +", "sh", skillsPath];
 }
 export function buildDockerExecShellArgs(containerName, script, args, opts = {}) {
     const out = ["exec"];
@@ -905,7 +918,9 @@ export function buildDockerCmaGrepSearchCommand(root, ownershipToken, pattern, g
     return {
         script: [
             "set -eu",
-            "exec setsid env \"OMA_GREP_OWNER=$2\" bash -c '",
+            // -w: when the exec'd shell is already a process-group leader (Podman's
+            // exec), plain setsid forks and exits at once, dropping rg's output.
+            "exec setsid -w env \"OMA_GREP_OWNER=$2\" bash -c '",
             "set -euo pipefail",
             "printf \"%s\\0\" __OMA_GREP_READY__",
             "emit_text_matches() {",

package/dist/src/control-plane/sessions/pi/sandbox/microsandbox.js

@@ -1065,11 +1065,26 @@ export function microsandboxResourceName(opts) {
 export function execMicrosandboxCommand(command, args, opts = {}) {
     return new Promise((resolve, reject) => {
         const maxBuffer = opts.maxBuffer ?? DEFAULT_MICROSANDBOX_MAX_BUFFER;
+        // Own process group, so a kill reaches grandchildren too. Otherwise a
+        // forked descendant (Linux /bin/sh does not exec its last command) keeps
+        // the stdio pipes open and "close" waits for it to exit on its own.
         const child = spawn(command, [...args], {
             cwd: opts.cwd,
             env: opts.env,
             stdio: ["pipe", "pipe", "pipe"],
+            detached: process.platform !== "win32",
         });
+        const killTree = () => {
+            try {
+                if (child.pid !== undefined && process.platform !== "win32")
+                    process.kill(-child.pid, "SIGKILL");
+                else
+                    child.kill("SIGKILL");
+            }
+            catch {
+                child.kill("SIGKILL");
+            }
+        };
         const stdout = [];
         const stderr = [];
         let outputBytes = 0;
@@ -1102,14 +1117,14 @@ export function execMicrosandboxCommand(command, args, opts = {}) {
                 return;
             terminalError = new Error("aborted");
             terminalError.name = "AbortError";
-            child.kill("SIGKILL");
+            killTree();
         };
         const collect = (target, chunk, onStreamData) => {
             outputBytes += chunk.byteLength;
             if (outputBytes > maxBuffer) {
                 if (!terminalError) {
                     terminalError = new Error(`Microsandbox command output exceeded ${maxBuffer} bytes`);
-                    child.kill("SIGKILL");
+                    killTree();
                 }
                 return;
             }
@@ -1143,7 +1158,7 @@ export function execMicrosandboxCommand(command, args, opts = {}) {
             fail(error);
         }
         if (opts.timeoutMs !== undefined) {
-            timeout = setTimeout(() => child.kill("SIGKILL"), opts.timeoutMs);
+            timeout = setTimeout(killTree, opts.timeoutMs);
         }
     });
 }

package/dist/src/control-plane/sessions/pi/sandbox/provider.js

@@ -311,13 +311,16 @@ function createCmaGrepToolDefinition(_cwd, operations) {
 }
 export function createSandboxToolDefinitions(cwd, operations, invocations, disposed) {
     return [
-        withToolCallAccounting("bash", createBashToolDefinition(cwd, { operations: operations.bash }), invocations, disposed),
-        withToolCallAccounting("read", createReadToolDefinition(cwd, { operations: operations.read }), invocations, disposed),
-        withToolCallAccounting("write", createWriteToolDefinition(cwd, { operations: operations.write }), invocations, disposed),
-        withToolCallAccounting("edit", createEditToolDefinition(cwd, { operations: operations.edit }), invocations, disposed),
-        withToolCallAccounting("glob", createCmaGlobToolDefinition(cwd, operations.glob), invocations, disposed),
-        withToolCallAccounting("grep", createCmaGrepToolDefinition(cwd, operations.grep), invocations, disposed),
-        withToolCallAccounting("ls", createLsToolDefinition(cwd, { operations: operations.ls }), invocations, disposed),
+        withToolCallAccounting("bash", 
+        // Pi >= 0.82 exports PI_SESSION_ID/PI_MODEL/... into bash by default;
+        // control-plane session metadata does not belong in the sandbox.
+        createBashToolDefinition(cwd, { operations: operations.bash, exposeSessionEnvironment: false }), invocations, disposed, cwd),
+        withToolCallAccounting("read", createReadToolDefinition(cwd, { operations: operations.read }), invocations, disposed, cwd),
+        withToolCallAccounting("write", createWriteToolDefinition(cwd, { operations: operations.write }), invocations, disposed, cwd),
+        withToolCallAccounting("edit", createEditToolDefinition(cwd, { operations: operations.edit }), invocations, disposed, cwd),
+        withToolCallAccounting("glob", createCmaGlobToolDefinition(cwd, operations.glob), invocations, disposed, cwd),
+        withToolCallAccounting("grep", createCmaGrepToolDefinition(cwd, operations.grep), invocations, disposed, cwd),
+        withToolCallAccounting("ls", createLsToolDefinition(cwd, { operations: operations.ls }), invocations, disposed, cwd),
     ];
 }
 function emptyToolCounts() {
@@ -344,14 +347,18 @@ function emptyToolCallIds() {
         ls: new Set(),
     };
 }
-function withToolCallAccounting(toolName, tool, invocations, disposed) {
+function withToolCallAccounting(toolName, tool, invocations, disposed, cwd) {
     return {
         ...tool,
         execute: async (toolCallId, params, signal, onUpdate, ctx) => {
             if (disposed.value) {
                 throw new Error("Sandbox provider is disposed");
             }
-            return toolExecutionContext.run({ toolName, toolCallId }, () => tool.execute(toolCallId, params, signal, onUpdate, ctx));
+            // Pi >= 0.85 resolves paths against ctx.cwd ahead of the tool's own
+            // cwd, and ctx.cwd is the control plane's process.cwd(). Pin it to the
+            // sandbox so relative paths and bash never land on the host directory.
+            const sandboxCtx = ctx === undefined ? ctx : { ...ctx, cwd };
+            return toolExecutionContext.run({ toolName, toolCallId }, () => tool.execute(toolCallId, params, signal, onUpdate, sandboxCtx));
         },
     };
 }