mosaicstack/stack
1
0
Fork 0
Code Issues 13 Pull Requests Actions Packages Projects Releases 11 Wiki Activity

fix: agent session needs cwd sandboxing, system prompt, and tool restrictions #64

New Issue
Open
opened 2026-03-13 01:48:53 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-03-13 01:48:53 +00:00
Owner
Copy Link

Problem

Pi SDK agent sessions inherit the gateway process cwd (apps/gateway) and have full filesystem access via built-in tools (read, bash, edit, write). The agent identifies as 'Claude Code' with no Mosaic-specific system prompt.

Observed behavior

> who are you?
I'm Claude Code... working in /home/jwoltje/src/mosaic-mono-v1/apps/gateway

Required changes

  1. Working directory: createAgentSession should use a configurable/sandboxed cwd (not the gateway's own directory)
  2. System prompt: Define a Mosaic-specific system prompt so the agent identifies as the Mosaic assistant, not Claude Code
  3. Tool restrictions: Restrict or configure the tool set — the default Pi tools give full shell/filesystem access which is inappropriate for a chat assistant
  4. Workspace isolation: Each conversation may need its own workspace directory

References

  • apps/gateway/src/agent/agent.service.ts — createAgentSession({ tools: [] }) currently passes empty tools array but Pi SDK adds defaults
  • Pi SDK AgentOptions supports tools, systemPrompt, and working directory config

Found by

End-to-end testing of communication spine

## Problem Pi SDK agent sessions inherit the gateway process cwd (`apps/gateway`) and have full filesystem access via built-in tools (read, bash, edit, write). The agent identifies as 'Claude Code' with no Mosaic-specific system prompt. ## Observed behavior ``` > who are you? I'm Claude Code... working in /home/jwoltje/src/mosaic-mono-v1/apps/gateway ``` ## Required changes 1. **Working directory**: `createAgentSession` should use a configurable/sandboxed cwd (not the gateway's own directory) 2. **System prompt**: Define a Mosaic-specific system prompt so the agent identifies as the Mosaic assistant, not Claude Code 3. **Tool restrictions**: Restrict or configure the tool set — the default Pi tools give full shell/filesystem access which is inappropriate for a chat assistant 4. **Workspace isolation**: Each conversation may need its own workspace directory ## References - `apps/gateway/src/agent/agent.service.ts` — `createAgentSession({ tools: [] })` currently passes empty tools array but Pi SDK adds defaults - Pi SDK `AgentOptions` supports `tools`, `systemPrompt`, and working directory config ## Found by End-to-end testing of communication spine
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#64
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?