fix(core): the agent loop gives its turns the profile cache the parent bound reads

After the main merge the worker's turns resolve the parent run's bound
(resolveParentBound) with SessionProfileCache, which the loop's runtime
context no longer carried. It is now one of the loop's runtime services.
A snapshot child of a path-confined parent stays bounded by the parent's
scopes in the parent's cwd, so its file calls in its copy are refused:
core has no copy relation, and moving relative entries into any cwd a
create names would widen a confined run. A merged workspaces test reads
the parent from the calling session, as Session.create names none.

Author: cevr

ARCHITECTURE.md

@@ -1253,7 +1253,12 @@ Do not rebuild business logic from inspection events. They are receipts, not inp
 - Snapshot children: `delegate.start` takes `isolation` (`shared`, the
   default, or `snapshot`). `@gent/workspaces` (`packages/extensions/src/workspaces.ts`)
   owns the copies and uses only the public extension API, `runProcess` and
-  the platform services. Core has no workspace concept: the seam is
+  the platform services. A path-confined parent run bounds its snapshot
+  child by its scopes in the parent's cwd, so the child's file calls in its
+  copy are refused (decided in the narrow-only batch, Round 6, on least
+  authority): core has no copy relation, and moving a parent's relative
+  entries into whatever cwd a create names would let a confined run reach
+  any directory by naming it. Core has no workspace concept: the seam is
   `Session.create({ cwd })`, and the child's profile is the copy's.
   - The backend: `rift rpc` with `copyAll` (one snapshot, an exact copy) only
     when the origin is a rift workspace on btrfs. Everywhere else, and for any

docs/extensions.md

@@ -1099,6 +1099,12 @@ every tool of the child works there.
 - A start is refused outside a git repository, and when less than 2 GB is
   free where the copy goes or `df` cannot say; start the child with
   `isolation: "shared"` then.
+- A parent run with `paths` bounds its snapshot child by those paths as they
+  resolve in the parent's cwd, not in the copy: the copy lies outside them,
+  so the child's file tools refuse every path in its copy. gent does not move
+  the parent's paths into the copy, since core cannot tell a copy from any
+  other cwd a create names. Give such a child no `paths` parent, or use
+  `isolation: "shared"`.
 
 A copy is not a sandbox. The child's `bash`, the cell and every other tool can
 still reach your repository and every other path, as with `paths`. A snapshot

packages/core/src/runtime/agent-loop.ts

@@ -1610,8 +1610,14 @@ export const closeBranchGenerations = (retired: ReadonlyArray<BranchGeneration>)
 
 // ── behavior ────────────────────────────────────────────────────────────────
 
+/**
+ * What the loop's own fibers run with. `SessionProfileCache` is here for the
+ * turn's dispatch binding: it resolves the parent run's bound
+ * (`resolveParentBound`) at each turn, so the worker's turns need it.
+ */
 type AgentLoopRuntimeServices =
   | SessionStorage
+  | SessionProfileCache
   | RelationshipStorage
   | ToolCallBindingStorage
   | GentPlatform

packages/extensions/tests/workspaces.test.ts

@@ -1044,7 +1044,11 @@ const snapshotModel = () =>
   })
 
 /** The shipped extensions, with the workspaces extension on a rift that is not there. */
-const harnessIn = (origin: string, home: string) =>
+const harnessIn = (
+  origin: string,
+  home: string,
+  admission?: Parameters<typeof createRpcHarness>[0]["admission"],
+) =>
   createRpcHarness({
     ...e2ePreset,
     extensionInputs: [
@@ -1056,6 +1060,7 @@ const harnessIn = (origin: string, home: string) =>
     providerLayer: snapshotModel(),
     cwd: origin,
     home,
+    admission,
   })
 
 const completionOf = <
@@ -1083,6 +1088,8 @@ const WorkOfCompletion = Schema.Struct({
   workspace: Schema.Struct({ path: Schema.String, branch: Schema.String }),
 })
 
+const encodeJson = Schema.encodeSync(Schema.fromJsonString(Schema.Unknown))
+
 type CreateParams = Parameters<ReturnType<typeof testToolContext>["Session"]["create"]>[0]
 
 describe("a snapshot child", () => {
@@ -1153,6 +1160,55 @@ describe("a snapshot child", () => {
     30_000,
   )
 
+  it.live(
+    "of a path-confined parent is refused file calls in its copy, which lies outside the parent's paths",
+    () =>
+      Effect.gen(function* () {
+        const origin = yield* dirtyRepository
+        const home = yield* makeTempDirectoryScoped("ws-home-")
+        // The parent run may write anywhere in its own cwd, and nowhere else.
+        const harness = yield* harnessIn(origin, home, {
+          runSpec: { overrides: { paths: [{ path: ".", access: "write" }] } },
+        })
+        yield* harness.client.message.send({
+          sessionId: harness.sessionId,
+          branchId: harness.branchId,
+          content: "delegate it in a copy",
+        })
+        yield* waitFor(
+          harness.client.session.getSnapshot({
+            sessionId: harness.sessionId,
+            branchId: harness.branchId,
+          }),
+          (current) =>
+            Predicate.isNotUndefined(completionOf(current.messages)) &&
+            current.runtime._tag === "Idle",
+          15_000,
+          "the child's completion woke the parent",
+        )
+        const child = (yield* harness.client.session.list()).find(
+          (session) => session.parentSessionId === harness.sessionId,
+        )
+        expect(child?.cwd).not.toBe(origin)
+        const copy = child?.cwd ?? ""
+        // The parent's scopes resolve against the parent's cwd, not the copy.
+        expect(yield* exists(`${copy}/child.txt`)).toBe(false)
+        expect(yield* exists(`${origin}/child.txt`)).toBe(false)
+        const branches = yield* harness.client.branch.list({
+          sessionId: child?.id ?? harness.sessionId,
+        })
+        const messages = yield* harness.client.message.list({
+          branchId: branches[0]?.id ?? harness.branchId,
+        })
+        const results = messages
+          .flatMap((message) => message.parts)
+          .filter((part) => part.type === "tool-result")
+        expect(results.map((part) => part.isFailure)).toEqual([true])
+        expect(encodeJson(results[0]?.result)).toContain("outside this agent's paths")
+      }).pipe(Effect.scoped, Effect.provide(BunServices.layer), Effect.timeout("25 seconds")),
+    30_000,
+  )
+
   it.live(
     "whose session cannot be created leaves no copy behind",
     () =>
@@ -1264,7 +1320,8 @@ describe("a snapshot child", () => {
               const session = new Session({
                 id: sessionId,
                 cwd: params.cwd,
-                parentSessionId: params.parentSessionId,
+                // The calling session is always the parent (`Session.create` names none).
+                parentSessionId: parentA.sessionId,
                 parentBranchId: params.parentBranchId,
                 createdAt: now,
                 updatedAt: now,