Best possible solution:

Land this PR after maintainer review, green CI/Testbox, and real sandbox output showing <available_skills> points at the sandbox workspace copy for non-rw runs.

Do we have a high-confidence way to reproduce the issue?

No live high-confidence reproduction was established in this read-only review. Source inspection gives a clear current-main path: non-rw sandbox runs use the sandbox workspace while snapshot prompt/env data can still come from host-path skill snapshots.

Is this the best way to solve the issue?

Yes, the code direction appears to be the narrowest maintainable fix: bypass saved snapshots only for sandboxed non-rw runs and keep existing snapshot behavior elsewhere. Merge should still wait for real behavior proof and normal validation.

Acceptance criteria:

• pnpm test src/agents/pi-embedded-runner/run/attempt.spawn-workspace.context-engine.test.ts -t "rebuilds skill prompt inputs"
• pnpm test src/agents/pi-embedded-runner/run/attempt.spawn-workspace.context-engine.test.ts -t "sends transcriptPrompt visibly"
• git diff --check origin/main..HEAD
• pnpm check

What I checked:

• Current main reuses snapshot in sandbox attempts: Current main switches non-rw sandbox attempts to effectiveWorkspace, but still passes params.skillsSnapshot into skill entry resolution, env setup, and prompt resolution. (src/agents/pi-embedded-runner/run/attempt.ts:716, 70f34bf1779c)
• Current main reuses snapshot in direct compaction: The direct compaction path has the same shape: it uses effectiveWorkspace while continuing to use params.skillsSnapshot for entries, env overrides, and prompt resolution. (src/agents/pi-embedded-runner/compact.ts:579, 70f34bf1779c)
• Snapshot prompt has precedence: resolveSkillsPromptForRun returns a non-empty snapshot prompt before rebuilding from current workspace skill entries, which explains how host-only skill locations survive the sandbox workspace switch. (src/agents/skills/workspace.ts:1032, 70f34bf1779c)
• Sandbox skill copy is available: For non-rw sandbox workspace access, sandbox context setup syncs eligible skills from the agent workspace into the sandbox workspace before returning that workspace for the run. (src/agents/sandbox/context.ts:45, 70f34bf1779c)
• PR applies the narrow bypass: The remote PR diff introduces skillsSnapshotForRun and sets it to undefined only when sandboxing is enabled with workspace access other than rw, preserving snapshot behavior otherwise. (src/agents/pi-embedded-runner/run/attempt.ts:713, 9db6f4f1e382)
• Real behavior proof missing: The PR body lists pnpm check, git diff --check, and targeted tests, but it does not include terminal output, logs, screenshots, or other after-fix proof from an actual sandboxed non-rw run. (9db6f4f1e382)

Likely related people:

• vincentkoc: Local blame on the affected attempt, compaction, skills prompt, and sandbox sync paths points to commit b378a91, and related recent skills work is also by Vincent Koc. (role: current path maintainer; confidence: high; commits: b378a912573e, a093b5b2de98; files: src/agents/pi-embedded-runner/run/attempt.ts, src/agents/pi-embedded-runner/compact.ts, src/agents/skills/workspace.ts)
• steipete: Recent current-main history on the embedded runner includes adjacent changes to runtime tool allowlists and post-compaction guard wiring near this surface. (role: recent adjacent maintainer; confidence: medium; commits: 25b30c95200d, 1af6855bb0a6; files: src/agents/pi-embedded-runner/run/attempt.ts, src/agents/pi-embedded-runner/compact.ts)
• zhangguiping-xydt: Recent merged work changed plugin-declared skill discovery paths, adjacent to the skill entry and prompt discovery surface involved here. (role: adjacent skills discovery owner; confidence: low; commits: 1df2ac442a75; files: src/agents/skills/workspace.ts)

Remaining risk / open question:

• This read-only review did not run the PR’s targeted tests, pnpm check, or a live sandbox scenario.
• The PR still needs after-fix real behavior proof showing a sandboxed non-rw run no longer exposes host-only skill paths.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 70f34bf1779c.