land: confined-sessions

[aft-alfonso]

Accepted agent delivery; branch-keyed search descriptor included.

---

Summary by cubic

Adds confine: "root" support to scoped worker catalogs, keeping a read-only worker session inside its own checkout even after an AFT restart or catalog epoch rebind. Previously a worker catalog could only request remote execution routing; now it can opt into a root-only filesystem surface.

• Confined sessions offer only read, grep, glob, and aft_outline on every route and call mode; all other tools are refused with tool_not_offered_confined.
• Paths outside the checkout are refused with path_outside_confined_root without permission prompts, regardless of grants, owned bash outputs, or symlink targets.
• Grep and glob bypass the trigram index and use bounded filesystem walks, with the fence inherited by helper and Rayon scan workers so no results leak outside the root; replies disclose the fallback.
• Confined walks check their starting path and every walk entry against the read policy; denied entries are skipped and counted as skipped_denied, never opened or returned.
• Symlinks pointing outside the root are not followed, including ignore-file symlinks and implicit Rust module include probes; the checkout's own regular ignore files still apply.
• Confinement is monotonic: later catalog updates or epoch re-fetches cannot remove it, malformed saved policies fail closed, and a confining save marks the key confined in memory before the fence commits.
• Confinement reads never take the frame-loop aft.db lock; a bounded retry drops stale answers, a call with neither a remembered nor a read answer is refused rather than run unconfined, and ordinary unconfined worker keys are remembered so they skip aft.db.
• Workers without a saved confinement are never refused for an unopened policy store, and the containment check normalizes Windows paths on both sides.

^{Written for commit e402cbd. Summary will update on new commits.}

Confidence Score: 5/5

No new blocking issue was established in the changes since the previous review.

Summary

Adds saved, root-only worker sessions with four read-only tools.

• Scoped worker catalogs can lock sessions to root-only tools.
• Confined workers keep file access inside their checkout.
• Confined searches walk only files the worker is allowed to see.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Worker tool call] --> B{Policy known in memory?}
    B -->|No| C[Read saved policy off the frame loop]
    C --> D{Policy changed during read?}
    D -->|Yes| E[Retry up to three times]
    E --> C
    D -->|No| F[Check offered tool]
    B -->|Yes| F
    F --> G{Confined?}
    G -->|Yes| H[Check paths and apply root fence]
    G -->|No| I[Normal dispatch]
    H --> J[Read-only dispatch]

Loading

_{Reviews (6) · Last reviewed commit: "mason: keep confinement reads nonblockin..." · Reviewed by Greptile}