session/new crashes ("File name too long") when any pi extension is present — OS instructions passed as a filesystem path

Summary

Creating a pi session (AgentOs.createSession("pi") via @rivet-dev/agentos) crashes during session/new as soon as any pi extension is present in the VM's agent extensions directory (/home/agentos/.pi/agent/extensions/). With no extension present, session creation succeeds.

The kernel error indicates the built‑in OS‑instructions / tool‑reference text is being passed to a filesystem "inspect mapped host path" call, so it fails with File name too long (os error 63):

ERR_AGENTOS_NODE_SYNC_RPC: failed to inspect mapped host path for
# agentOS

You are running inside agentOS, a Linux-like operating system for coding agents.
... (the full built-in OS instructions / "## Tools CLI" text) ...
--- -> /private/var/folders/.../agentos-native-sidecar-shadow-vm-1-.../workspace/# agentOS

You are running inside agentOS ...
---: File name too long (os error 63)

(The client surfaces this as a generic RivetError: An internal error occurred; the detail above is from the engine/sidecar log.)

Why this matters

Extensions are the documented way to customize a pi agent — e.g. hooking before_agent_start to set the agent's system prompt. This bug makes any extension unusable, which (as far as I can tell) blocks the only clean path to overriding the adapter's hardcoded "expert coding assistant" system prompt. additionalInstructions doesn't surface as pi's system prompt, and the adapter's --append-system-prompt argv isn't reachable through the host API, so extensions are the remaining lever — and they crash session/new.

Environment

• @rivet-dev/agentos 0.2.7, @rivet-dev/agentos-core 0.2.7, @agentos-software/pi 0.2.7
• Bun 1.3.14, macOS 26.5.1, arm64 (Apple Silicon)
• napi mode, setup({ startEngine: true }) (self-booted engine)

Minimal reproduction (no model/API key needed — the crash is in session/new, before any model call)

import { agentOS, setup } from "@rivet-dev/agentos";
import { createClient } from "@rivet-dev/agentos/client";
import pi from "@agentos-software/pi";

const vm = agentOS({
  software: [pi],
  permissions: { fs: "allow", childProcess: "allow", process: "allow", env: "allow", network: "allow" },
});
const registry = setup({ use: { vm }, startEngine: true });
registry.start();
await Bun.sleep(7000);

const client = createClient({ endpoint: "http://127.0.0.1:6420" });
const EXT_DIR = "/home/agentos/.pi/agent/extensions";

async function tryCase(label, extension) {
  const agent = client.vm.getOrCreate(`case-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`);
  for (let i = 0; i < 40; i++) { try { await agent.exec("true"); break; } catch { await Bun.sleep(700); } }
  if (extension !== null) {
    await agent.exec(`mkdir -p ${EXT_DIR}`);
    await agent.writeFile(`${EXT_DIR}/x.mjs`, extension);
  }
  try {
    const s = await agent.createSession("pi", {});
    console.log(`${label}: OK — session created`);
  } catch (e) {
    console.log(`${label}: CRASH — ${String(e?.message ?? e)}`);
  }
}

await tryCase("A (no extension)", null);
await tryCase("B (no-op extension)", "export default function () {}\n");
await tryCase("C (before_agent_start extension)",
  'export default function (pi) { pi.on("before_agent_start", (e) => ({ systemPrompt: "You are a test agent." })); }\n');
process.exit(0);

Use a fresh VM key each case (as above) — a stable/re-used key can wedge separately and confuse results.

Actual output

A (no extension): OK — session created
B (no-op extension): CRASH — An internal error occurred
C (before_agent_start extension): CRASH — An internal error occurred

So it is the mere presence of a discovered extension (.js/.mjs/.cjs under <agentDir>/extensions) that triggers the crash — not any particular hook. A no-op extension is enough.

Expected

createSession("pi") should succeed with an extension present (and before_agent_start should be able to override the system prompt), just as it does without one.

Notes toward a root cause (from reading the shipped code)

• @agentos-software/pi/dist/adapter.js newSession() uses MinimalResourceLoader when no extensions are discovered, and switches to DefaultResourceLoader when extensionFactories.length > 0.
• The crash is a sidecar/kernel "inspect mapped host path" call whose path argument is the OS‑instructions text itself (# agentOS\n\nYou are running inside agentOS ... ## Tools CLI ...). It looks like, on the DefaultResourceLoader path, the combined OS‑instructions / tool‑reference string is being routed into a host‑path resolution/mapping step instead of being used as prompt text.

Happy to provide the full engine log or test other configurations.

Start with @agentos-software/pi/dist/adapter.js, comparing the MinimalResourceLoader and DefaultResourceLoader paths in newSession(). Run the minimal reproduction with fresh VM keys, then trace how the OS-instructions/tool-reference text reaches host-path inspection. Done means createSession("pi") succeeds with no-op and hook extensions, while before_agent_start can provide its system prompt.