When pi-chat runs in sandbox mode (Gondolin VM), the agent's system prompt contains <available_skills> entries referencing host-local paths (e.g. /Users/me/.agents/skills/brave-search/SKILL.md). These are injected into event.systemPrompt by pi's core runtime, which scans the host's skills directories. The paths don't exist inside the VM, so the agent sees the skills listed, tries to read them, and fails.

Root cause

In index.ts, the before_agent_start handler receives event.systemPrompt which already includes an <available_skills> block generated by pi's core from the host's skills directories. When sandbox is true, pi-chat patches the working directory path but passes the host skills block through unchanged (~line 1372):

const systemPrompt = sandbox
    ? event.systemPrompt.replace(
        `Current working directory: ${process.cwd()}`,
        `Current working directory: ${GONDOLIN_WORKSPACE} ...`,
    )
    : event.systemPrompt;

pi-chat's own skill loading (buildSkillsPromptSuffix) correctly scans /shared/skills/ and /workspace/skills/ and converts paths via hostToGuestPath. But the host's <available_skills> block from the base prompt is never stripped, so the final prompt contains two skill sections -- one with unreachable host paths and one with valid VM paths.

Expected behavior

When running in sandbox mode, the host-injected <available_skills>...</available_skills> block should be removed from event.systemPrompt before it's forwarded to the agent, since only VM-internal skills (from /shared/skills/ and /workspace/skills/) are accessible.

Reproduction

1. Have skills configured on the host (e.g. in ~/.agents/skills/)
2. Connect a channel with pi-chat (/chat-connect)
3. Observe the system prompt contains host skill paths the VM agent cannot access