[joshblack]

This PR routes our filesystem-backed tar operations through Host so scenario builds and sandbox file transfers use the selected host filesystem. As a result, virtual hosts can handle archives without reading or writing the system filesystem.

Stream-only tar-stream usage stays unchanged.

Changelog

New

• Add host-bound archive packing and extraction.
• Add a lint rule that prevents direct tar-fs imports outside the host adapter.

Changed

• Update scenario image builds and sandbox copy/download operations to use host archives.
• Update archive coverage to exercise real packing and extraction with in-memory filesystems.

Removed

[Copilot]

🟢 Approval recommended

The narrow refactor preserves archive options and adds targeted regression coverage, with no blocking issues identified in static review; tests were not executed.

No open issues 🎉

What changed in this PR

Routes filesystem-backed archives through Host, allowing scenario builds and sandbox transfers to use the selected filesystem without virtual hosts accessing system files.

Changes:

• Add host-bound archive packing and extraction while preserving existing options.
• Update scenario and sandbox callers, with tests covering archive isolation, exclusions, and renaming.
• Restrict direct tar-fs imports to the host adapter; stream-only usage remains unchanged.

File	Description
packages/​agent-eval/​src/​scenario/​scenario.ts	Pack scenario build contexts through the host.
packages/​agent-eval/​src/​scenario/​image.test.ts	Verify build-context contents using in-memory archives.
packages/​agent-eval/​src/​sandbox/​system.ts	Route copy and download archives through the host.
packages/​agent-eval/​src/​sandbox/​system.test.ts	Cover transfer contents, renaming, and exclusions.
packages/​agent-eval/​src/​host.ts	Bind archive operations to each host’s filesystem.
packages/​agent-eval/​src/​host.test.ts	Cover system archive round trips and virtual filesystem isolation.
eslint.config.js	Prohibit direct runtime tar-fs imports outside the adapter.

_{Review effort: Balanced}

[joshblack]

@copilot fix failing ci test

[Copilot]

@copilot fix failing ci test

Fixed the virtual archive mocks to use the current filesystem owner, avoiding memfs permission errors when tar-fs remaps archive ownership. Commit: 3f73ce4. Full unit tests and the build, format, lint, and type-check tasks pass.

[Copilot]

🔵 Needs a closer look

The public Host change exposes dev-only tar-fs typings to consumers and breaks existing custom hosts without migration guidance or backward compatibility.

No open issues 🎉

2 previously missed issues

In code that hasn't changed since last review

Preserve compatibility for existing custom host implementations

packages/​agent-eval/​src/​host.ts:11

This required member also changes the public injected-host contract: getScenario accepts Host (packages/agent-eval/src/scenario/get.ts:5–8) and is exported from the package root. Existing custom hosts providing fs, loadModule, and createSandbox now fail type checking, including for discovery operations that never use archives. Please add a versioned migration guide and index entry under packages/agent-eval/docs/migrations/ showing how custom hosts provide filesystem-bound pack and extract, or preserve compatibility with the previous host shape.

Expose archive typings through production dependencies

packages/​agent-eval/​src/​host.ts:11

Host is reachable through the exported getScenario options (packages/agent-eval/src/scenario/get.ts:5–8), so this member introduces a tar-fs import into consumer-facing declarations. The build externalizes dependencies (packages/agent-eval/rolldown.config.ts:9–12), but @types/tar-fs is only a devDependency (packages/agent-eval/package.json:64–72), leaving strict TypeScript consumers without the required declarations. Move the required archive typings into production dependencies, or expose an archive interface without dev-only type dependencies.

_{Review effort: Balanced}