land: confined-sessions

[aft-alfonso]

Accepted agent delivery; branch-keyed search descriptor included.

---

Summary by cubic

Adds confine: "root" support to scoped worker catalogs, keeping a read-only worker session inside its own checkout even after an AFT restart or catalog epoch rebind. Previously a worker catalog could only request remote execution routing; now it can opt into a root-only filesystem surface.

• Confined sessions offer only read, grep, glob, and aft_outline; all other tools are refused with tool_not_offered_confined.
• Paths outside the checkout are refused with path_outside_confined_root without permission prompts, regardless of grants or owned bash outputs.
• Grep and glob bypass the trigram index and use bounded filesystem walks so no results leak outside the root; replies disclose the fallback.
• Symlinks pointing outside the root are not followed, including ignore-file symlinks and implicit Rust module include probes.
• Confinement is monotonic: later catalog updates or epoch re-fetches cannot remove it; malformed saved policies fail closed.
• Existing in-root credential and deny floors still apply.

^{Written for commit f3a34c0. Summary will update on new commits.}

Confidence Score: 5/5

The PR appears safe to merge; both previous findings are fixed and no new blocking issue was found.

Summary

Adds confine: "root" for scoped workers, with four read-only tools and checkout-only paths.

• Scoped worker catalogs can save a root-only read fence.
• Read tools refuse paths outside the worker's checkout.
• Confined searches walk only the worker's checkout.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Worker catalog] --> B[Save confinement across epochs]
  B --> C[Tool call]
  C --> D{Read-only tool?}
  D -->|No| E[Refuse tool]
  D -->|Yes| F{Path inside checkout?}
  F -->|No| G[Refuse path]
  F -->|Yes| H[Read or walk checkout]

Loading

_{Reviews (2) · Last reviewed commit: "mason: preserve confinement across epoch..." · Reviewed by Greptile}