@@ -87,6 +87,10 @@ const filesystem = (remote: Remote, execTimeout: number | undefined): SandboxFil
 			// same shape `fs.stat` rejects with, so `isNotFoundError` recognises it
 			throw Object.assign(new Error(`ENOENT: no such file or directory, realpath '${path}'`), { code: "ENOENT" });
 		},
+		scanLines: SandboxFileSystem.Scan.viaShell(async (argv) => {
+			const result = await (await command(remote, execTimeout, argv)).wait();
+			return { exitCode: result.exitCode, stdout: await result.stdout(), stderr: await result.stderr() };
+		}),
 	});
 
 const command = (
 
@@ -1,4 +1,4 @@
-/* oxlint-disable effecttsgo/async-function -- VFS operations implement a Promise-based adapter contract. */
+/* oxlint-disable effecttsgo/async-function, effecttsgo/new-promise -- VFS operations implement a Promise-based adapter contract. */
 import type { VirtualFileSystem, VirtualStats } from "@platformatic/vfs";
 import { Context, Effect, Layer } from "effect";
 import { Buffer } from "node:buffer";
@@ -23,6 +23,8 @@ const toFileStat = (stats: VirtualStats): SandboxFileSystem.FileStat => ({
 // lifts it into the Effect service the harness consumes.
 export interface Interface extends SandboxFileSystem.Provider {}
 
+const SCAN_CHUNK = 64 * 1024;
+
 const bytes = (content: string | Uint8Array) =>
 	typeof content === "string" ? Buffer.from(content, "utf8") : Buffer.from(content);
 
@@ -91,6 +93,34 @@ const make = (vfs: VirtualFileSystem): Interface => {
 		// Every VFS provider resolves symlinks itself (the host one via
 		// `fs.realpath`) and rejects with ENOENT for a missing path.
 		realpath: (path) => vfs.promises.realpath(path),
+		scanLines: async (path, options) => {
+			const scanner = new SandboxFileSystem.Scan.LineScanner(options);
+			// Bounded by the size seen now, so a file that keeps growing ends the scan.
+			const { size } = await vfs.promises.stat(path);
+			if (size === 0) return scanner.finish();
+			// Positional reads through a descriptor: the VFS read stream loads the
+			// whole file first, and the host provider reads only what is asked.
+			const fd = await new Promise<number>((resolve, reject) =>
+				vfs.open(path, "r", (error, value) => (error ? reject(error) : resolve(value!))),
+			);
+			try {
+				const buffer = Buffer.alloc(Math.min(SCAN_CHUNK, size));
+				for (let position = 0; position < size;) {
+					const length = Math.min(buffer.length, size - position);
+					const read = await new Promise<number>((resolve, reject) =>
+						vfs.read(fd, buffer, 0, length, position, (error, bytesRead) =>
+							error ? reject(error) : resolve(bytesRead),
+						),
+					);
+					if (read === 0) break;
+					scanner.push(buffer.subarray(0, read));
+					position += read;
+				}
+			} finally {
+				await new Promise<void>((resolve) => vfs.close(fd, () => resolve()));
+			}
+			return scanner.finish();
+		},
 	};
 };
 
 
@@ -32,6 +32,7 @@ export const make = (provider: Interface, options?: Options): SandboxFileSystem.
 		mkdir: (path, mkdirOptions) => provider.mkdir(resolve(path), mkdirOptions),
 		rm: (path, rmOptions) => provider.rm(resolve(path), rmOptions),
 		realpath: (path) => provider.realpath(resolve(path)),
+		scanLines: (path, scanOptions) => provider.scanLines(resolve(path), scanOptions),
 	};
 };
 
 
@@ -150,7 +150,17 @@ export const statsFrom = (info: FileInfo): RemoteFileSystem.FileStat => {
 
 type RemoteFilesystemProvider = Pick<
 	RemoteFileSystem.Interface,
-	"readFile" | "readFileBuffer" | "writeFile" | "stat" | "lstat" | "readdir" | "exists" | "mkdir" | "rm" | "realpath"
+	| "readFile"
+	| "readFileBuffer"
+	| "writeFile"
+	| "stat"
+	| "lstat"
+	| "readdir"
+	| "exists"
+	| "mkdir"
+	| "rm"
+	| "realpath"
+	| "scanLines"
 >;
 
 const providerFrom = (sandbox: RemoteSandbox, options: Options) => {
@@ -215,6 +225,15 @@ const providerFrom = (sandbox: RemoteSandbox, options: Options) => {
 			// same shape `fs.stat` rejects with, so `isNotFoundError` recognises it
 			throw Object.assign(new Error(`ENOENT: no such file or directory, realpath '${path}'`), { code: "ENOENT" });
 		},
+		scanLines: SandboxFileSystem.Scan.viaShell(async (argv) => {
+			const result = await sandbox.process.executeCommand(
+				quoteArgv(argv),
+				options.cwd,
+				undefined,
+				options.execTimeout,
+			);
+			return { exitCode: result.exitCode, stdout: result.result ?? "" };
+		}),
 	};
 
 	return filesystem;
 
@@ -51,6 +51,7 @@ export const make = (provider: Interface, options?: Options): SandboxFileSystem.
 		// option validation happens in `fromProvider`, before any mutation
 		rm: (path, rmOptions) => provider.rm(resolve(path), rmOptions),
 		realpath: (path) => provider.realpath(resolve(path)),
+		scanLines: (path, scanOptions) => provider.scanLines(resolve(path), scanOptions),
 	};
 };
 
 
@@ -193,7 +193,17 @@ export const statsFrom = (stats: Stats): RemoteFileSystem.FileStat => {
 
 type RemoteFilesystemProvider = Pick<
 	RemoteFileSystem.Interface,
-	"readFile" | "readFileBuffer" | "writeFile" | "stat" | "lstat" | "readdir" | "exists" | "mkdir" | "rm" | "realpath"
+	| "readFile"
+	| "readFileBuffer"
+	| "writeFile"
+	| "stat"
+	| "lstat"
+	| "readdir"
+	| "exists"
+	| "mkdir"
+	| "rm"
+	| "realpath"
+	| "scanLines"
 >;
 
 // The Vercel `fs` surface is `node:fs/promises`-compatible, so the provider
@@ -244,6 +254,10 @@ const providerFrom = (sandbox: RemoteSandbox, options: Options): RemoteFilesyste
 			// same shape `fs.stat` rejects with, so `isNotFoundError` recognises it
 			throw Object.assign(new Error(`ENOENT: no such file or directory, realpath '${path}'`), { code: "ENOENT" });
 		},
+		scanLines: SandboxFileSystem.Scan.viaShell(async (argv) => {
+			const result = await (await spawnArgv(sandbox, options, argv)).wait();
+			return { exitCode: result.exitCode, stdout: await result.stdout(), stderr: await result.stderr() };
+		}),
 	};
 
 	return filesystem;