fix: pass streamStdin through KernelInterface.spawn, add pnpm store to overlay roots, transitive dep resolution

Author: NathanFlurry

packages/core/src/kernel/kernel.ts

@@ -1068,6 +1068,7 @@ class KernelImpl implements Kernel {
 				return this.spawnManaged(command, args, {
 					env: ctx.env,
 					cwd: ctx.cwd,
+					streamStdin: ctx.streamStdin,
 					onStdout: ctx.onStdout,
 					onStderr: ctx.onStderr,
 					stdinFd: ctx.stdinFd,

packages/core/src/types.ts

@@ -18,6 +18,7 @@ export interface CommandExecutor {
 		options: {
 			cwd?: string;
 			env?: Record<string, string>;
+			streamStdin?: boolean;
 			onStdout?: (data: Uint8Array) => void;
 			onStderr?: (data: Uint8Array) => void;
 		},

packages/nodejs/src/bridge-handlers.ts

@@ -2855,6 +2855,8 @@ export interface ModuleResolutionBridgeDeps {
 	sandboxToHostPath: (sandboxPath: string) => string | null;
 	/** Translate host path back to sandbox path. */
 	hostToSandboxPath: (hostPath: string) => string;
+	/** Additional host directories used as require.resolve paths for transitive deps. */
+	additionalResolvePaths?: string[];
 }
 
 function normalizeModuleResolveContext(referrer: string): string {
@@ -3032,6 +3034,7 @@ export function buildModuleResolutionBridgeHandlers(
 
 		// Handle #-prefixed subpath imports (package.json "imports" field)
 		if (req.startsWith("#")) {
+			// Try host-side resolution first with the translated hostDir.
 			let resolved = resolvePackageImportSync(req, hostDir, resolveMode);
 			if (!resolved) {
 				// Fallback: try resolving from the realpath of hostDir.
@@ -3044,6 +3047,31 @@ export function buildModuleResolutionBridgeHandlers(
 					}
 				} catch { /* realpath failed, skip */ }
 			}
+			if (!resolved) {
+				// hostDir translation may have failed (e.g. transitive deps not
+				// in packageRoots). Try using require.resolve with additional
+				// resolve paths to find the owning package on the host.
+				const nmPrefix = "/root/node_modules/";
+				if (sandboxDir.startsWith(nmPrefix)) {
+					const rest = sandboxDir.slice(nmPrefix.length);
+					const parts = rest.split("/");
+					const pkgName = parts[0].startsWith("@")
+						? parts.slice(0, 2).join("/")
+						: parts[0];
+					const paths = deps.additionalResolvePaths ?? [];
+					for (const searchPath of paths) {
+						try {
+							const pkgJsonPath = hostRequire.resolve(
+								`${pkgName}/package.json`,
+								{ paths: [searchPath] },
+							);
+							const pkgDir = pathDirname(pkgJsonPath);
+							resolved = resolvePackageImportSync(req, pkgDir, resolveMode);
+							if (resolved) break;
+						} catch { /* not found in this path */ }
+					}
+				}
+			}
 			return resolved ? deps.hostToSandboxPath(resolved) : null;
 		}
 
@@ -3849,6 +3877,7 @@ export function buildChildProcessBridgeHandlers(deps: ChildProcessBridgeDeps): B
 		const proc = deps.commandExecutor.spawn(String(command), args, {
 			cwd: options.cwd,
 			env: childEnv,
+			streamStdin: true,
 			onStdout: (data) => dispatchEvent(sessionId, "stdout", data),
 			onStderr: (data) => dispatchEvent(sessionId, "stderr", data),
 		});

packages/nodejs/src/execution-driver.ts

@@ -1162,6 +1162,22 @@ export class NodeExecutionDriver implements RuntimeDriver {
 							const fs = s.filesystem as any;
 							return typeof fs.toSandboxPath === "function" ? fs.toSandboxPath(p) : p;
 						},
+						additionalResolvePaths: (() => {
+							// Collect host paths from package roots for transitive dep resolution.
+							// Each package root's parent node_modules is a valid search path.
+							const fs = s.filesystem as any;
+							const roots: string[] = [];
+							if (Array.isArray(fs?.packageRoots)) {
+								for (const root of fs.packageRoots) {
+									if (root.hostPath) roots.push(root.hostPath);
+								}
+							}
+							// Also include moduleAccessCwd's node_modules
+							if (fs?.hostNodeModulesRoot) {
+								roots.push(fs.hostNodeModulesRoot);
+							}
+							return roots.length > 0 ? roots : undefined;
+						})(),
 					}),
 					...buildPtyBridgeHandlers({
 						onPtySetRawMode: s.onPtySetRawMode,

packages/nodejs/src/kernel-runtime.ts

@@ -219,6 +219,7 @@ export function createKernelCommandExecutor(kernel: KernelInterface, parentPid:
       options: {
         cwd?: string;
         env?: Record<string, string>;
+        streamStdin?: boolean;
         onStdout?: (data: Uint8Array) => void;
         onStderr?: (data: Uint8Array) => void;
       },
@@ -229,6 +230,7 @@ export function createKernelCommandExecutor(kernel: KernelInterface, parentPid:
         ppid: parentPid,
         env: options.env ?? {},
         cwd: options.cwd ?? kernel.getcwd(parentPid),
+        streamStdin: options.streamStdin,
         onStdout: options.onStdout,
         onStderr: options.onStderr,
       });

packages/nodejs/src/module-access.ts

@@ -225,7 +225,8 @@ export class ModuleAccessFileSystem implements VirtualFileSystem {
 			(a, b) => b.vmPath.length - a.vmPath.length,
 		);
 
-		// Expand allowed roots to include package root host paths.
+		// Expand allowed roots to include package root host paths and their
+		// sibling node_modules (for transitive dep resolution in pnpm).
 		for (const root of this.packageRoots) {
 			try {
 				const canonical = fsSync.realpathSync(root.hostPath);
@@ -242,6 +243,24 @@ export class ModuleAccessFileSystem implements VirtualFileSystem {
 						}
 					}
 				}
+				// Add the pnpm store root if the package is inside a .pnpm directory.
+				// This makes all transitive deps in the store accessible.
+				const canonicalParts = canonical.split(path.sep);
+				const pnpmIdx = canonicalParts.indexOf(".pnpm");
+				if (pnpmIdx >= 0) {
+					const pnpmStoreRoot = canonicalParts.slice(0, pnpmIdx + 1).join(path.sep);
+					if (!this.overlayAllowedRoots.includes(pnpmStoreRoot)) {
+						this.overlayAllowedRoots.push(pnpmStoreRoot);
+					}
+				}
+				// Also add the parent node_modules directory for non-pnpm setups.
+				const parentNm = path.dirname(root.hostPath);
+				try {
+					const canonicalParent = fsSync.realpathSync(parentNm);
+					if (!this.overlayAllowedRoots.includes(canonicalParent)) {
+						this.overlayAllowedRoots.push(canonicalParent);
+					}
+				} catch { /* skip */ }
 			} catch {
 				// Package root doesn't exist on host; skip.
 			}
@@ -310,19 +329,62 @@ export class ModuleAccessFileSystem implements VirtualFileSystem {
 		}
 
 		// Fall back to CWD-based node_modules.
-		if (!this.hostNodeModulesRoot) {
-			return null;
-		}
-		if (virtualPath === SANDBOX_NODE_MODULES_ROOT) {
-			return this.hostNodeModulesRoot;
+		if (this.hostNodeModulesRoot) {
+			if (virtualPath === SANDBOX_NODE_MODULES_ROOT) {
+				return this.hostNodeModulesRoot;
+			}
+			const relative = path.posix
+				.relative(SANDBOX_NODE_MODULES_ROOT, virtualPath)
+				.replace(/^\/+/, "");
+			if (!relative) {
+				return this.hostNodeModulesRoot;
+			}
+			const candidate = path.join(this.hostNodeModulesRoot, ...relative.split("/"));
+			if (fsSync.existsSync(candidate)) {
+				return candidate;
+			}
 		}
-		const relative = path.posix
+
+		// Fall back: resolve transitive dependencies from package root siblings.
+		// In pnpm, each package root sits in a node_modules/ dir alongside
+		// its transitive deps (e.g., .pnpm/pi-agent@.../node_modules/chalk).
+		// Check each package root's sibling node_modules for the requested package.
+		const nmRelative = path.posix
 			.relative(SANDBOX_NODE_MODULES_ROOT, virtualPath)
 			.replace(/^\/+/, "");
-		if (!relative) {
-			return this.hostNodeModulesRoot;
+		if (nmRelative) {
+			const relParts = nmRelative.split("/");
+			const pkgName = relParts[0].startsWith("@")
+				? relParts.slice(0, 2).join("/")
+				: relParts[0];
+			const subPath = relParts[0].startsWith("@")
+				? relParts.slice(2).join("/")
+				: relParts.slice(1).join("/");
+			for (const root of this.packageRoots) {
+				// root.hostPath is e.g. .../node_modules/@mariozechner/pi-coding-agent
+				// Its parent node_modules dir may contain chalk, undici, etc.
+				const siblingPkg = path.join(path.dirname(root.hostPath), pkgName);
+				try {
+					if (fsSync.existsSync(siblingPkg)) {
+						const realPkg = fsSync.realpathSync(siblingPkg);
+						return subPath ? path.join(realPkg, ...subPath.split("/")) : realPkg;
+					}
+				} catch { /* skip */ }
+				// Also try the parent's parent for scoped packages
+				const parentNm = path.dirname(path.dirname(root.hostPath));
+				if (parentNm !== path.dirname(root.hostPath)) {
+					const parentSibling = path.join(parentNm, pkgName);
+					try {
+						if (fsSync.existsSync(parentSibling)) {
+							const realPkg = fsSync.realpathSync(parentSibling);
+							return subPath ? path.join(realPkg, ...subPath.split("/")) : realPkg;
+						}
+					} catch { /* skip */ }
+				}
+			}
 		}
-		return path.join(this.hostNodeModulesRoot, ...relative.split("/"));
+
+		return null;
 	}
 
 	private isProjectedHostPath(pathValue: string): boolean {