{"record":{"id":"32b640027e1da0cf","repo":"vercel/ai","slug":"pi-private-session-directory-json-stringify-priv","errorCode":null,"errorMessage":"Pi private session directory ${JSON.stringify(privateSessionDir)} must be outside sessionWorkDir ${JSON.stringify(input.sessionWorkDir)}.","messagePattern":"Pi private session directory (.+?) must be outside sessionWorkDir (.+?)\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/harness-pi/src/pi-resume-state.ts","lineNumber":56,"sourceCode":"  readonly sessionWorkDir: string;\n  readonly sessionId: string;\n}): string {\n  const sessionKey = createHash('sha256').update(input.sessionId).digest('hex');\n  const privateSessionDir = path.posix.join(\n    input.sandboxHomeDir,\n    '.ai-sdk',\n    'harness-pi',\n    sessionKey,\n  );\n  const relativePath = path.posix.relative(\n    input.sessionWorkDir,\n    privateSessionDir,\n  );\n  if (\n    relativePath === '' ||\n    (!relativePath.startsWith('../') && !path.posix.isAbsolute(relativePath))\n  ) {\n    throw new Error(\n      `Pi private session directory ${JSON.stringify(privateSessionDir)} must be outside sessionWorkDir ${JSON.stringify(input.sessionWorkDir)}.`,\n    );\n  }\n  return privateSessionDir;\n}\n\nfunction resolveContainedHostPath(input: {\n  readonly baseDir: string;\n  readonly sessionFileName: string;\n}): string {\n  const baseDir = path.resolve(input.baseDir);\n  const filePath = path.resolve(\n    baseDir,\n    safePiSessionFileName(input.sessionFileName),\n  );\n  const relativePath = path.relative(baseDir, filePath);\n  if (\n    relativePath === '' ||","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/harness-pi/src/pi-resume-state.ts#L38-L74","documentation":"The adapter computes a private directory under the sandbox HOME where Pi session files are stored, and verifies that it does not live inside the agent's session work directory (so session state never leaks into the agent workspace). It throws when the private dir resolves to, or inside, sessionWorkDir. This is a configuration-invariant failure of resolvePiPrivateSessionDirectory.","triggerScenarios":"Calling resolvePiPrivateSessionDirectory (directly or via resume lifecycle code) with a sandboxHomeDir laid out such that `<sandboxHomeDir>/.ai-sdk/harness-pi/<hash>` equals or is nested within the given sessionWorkDir — e.g. sessionWorkDir set to the sandbox home itself, to `<home>/.ai-sdk`, or to `<home>/.ai-sdk/harness-pi`.","commonSituations":"Misconfiguring the sandbox so the agent workspace and sandbox HOME point at the same directory, or intentionally pointing sessionWorkDir at the home dir to 'simplify' pathing; also occurs when a custom sessionWorkDir overlaps the .ai-sdk state folder.","solutions":["Move sessionWorkDir to a dedicated agent workspace directory that is not inside sandboxHomeDir","Ensure sandboxHomeDir is not a parent (or equal) of sessionWorkDir","If using defaults, do not override sessionWorkDir to point under the home directory"],"exampleFix":"// before\nresolvePiPrivateSessionDirectory({\n  sandboxHomeDir: '/home/agent',\n  sessionWorkDir: '/home/agent', // collides: private dir is inside work dir\n  sessionId,\n});\n// after\nresolvePiPrivateSessionDirectory({\n  sandboxHomeDir: '/home/agent',\n  sessionWorkDir: '/home/agent/workspace', // outside the state path\n  sessionId,\n});","handlingStrategy":"validation","validationCode":"import path from 'node:path';\nexport function assertWorkDirOutsideHome(sandboxHomeDir: string, sessionWorkDir: string): void {\n  const rel = path.posix.relative(sessionWorkDir, path.posix.join(sandboxHomeDir, '.ai-sdk'));\n  if (rel === '' || (!rel.startsWith('../') && !path.posix.isAbsolute(rel))) {\n    throw new Error('sessionWorkDir must not overlap the sandbox home .ai-sdk directory');\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the agent workspace and sandbox HOME in disjoint directory trees","Never set sessionWorkDir to the home dir or any ancestor of <home>/.ai-sdk","Add the containment assertion to config loading so failures surface at startup"],"tags":["configuration","path-validation","sandbox"],"backgroundTag":"invalid-directory-configuration","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}