Measure a relative path from the directory its own tool call ran in — and refuse the command when that cannot be proven - #180

Measure a relative path from the directory its own tool call ran in — and refuse the command when that cannot be proven

A relative path means something different in every directory. The containment fence only ever
knew the directory the session started in, so when a command moved, the shell read one file
and the fence measured another:

cd packages/api && cat src/config.ts
  shell reads   packages/api/src/config.ts
  fence measured             src/config.ts      # at the top of the repo

Where the directory moved into is a link out of the repo — or is another repository outright
(cd ../other-project) — that is another project's file recorded under this one's name.

Two signals were on hand and unread: the agent stamps a working directory on every record
(present on 73,281 of 73,281 shell tool-use records, while the input.cwd field this was
expected to arrive in appears on 0 of 110,141 tool inputs), and a cd sits in the command
text already being scanned (71.9% of ~73,800 real commands contain one).

The load-bearing part: knowing when not to trust that reading

The first version of this PR looked for cd and, finding none, confidently used the record's
directory. Two rounds of adversarial review found twenty-two ways to move a shell it did
not recognise. The sharpest are not exotic:

c\d sub && cat src/config.ts      # runs `cd`. contains no "cd".
c"d" sub && …                     # same
c${EMPTY}d sub && …               # same, via expansion
source ./setup.sh && …            # the script cd's; the line says nothing about where
cd "s3"x && …                     # the target is s3x, not s3

The shell strips quoting and performs expansion before it looks the command word up, so a
scan of the text as written is reading something that never runs. That is not twenty-two bugs;
it is one, and it is the same shape the path fence kept losing to before it started asking the
filesystem.

So the question asked is now the closed one: can we prove the command did not move?

• Detection runs over the command as the shell will see it — quoting removed, expansions
  collapsed — and is deliberately over-eager (cd/pushd/popd/chdir/source/.,
  -C/--chdir/--directory). Over-detecting costs paths; under-detecting leaks them.
• The reader must account for every detection. Whatever it cannot explain makes the command
  unplaceable, and an unplaceable relative path is dropped rather than attributed to a
  directory nobody can name.

The refusal lives in sessionPaths itself, so a consumer that supplies no escapesRepo gets
the same answer — the absence of a check must never be why something leaks.

C1 is NOT claimed, and this PR does not close it

The criterion this line of work inherits is stated absolutely: no path belonging to another
repository can reach the wire. This change does not establish that, and does not claim to.

Detecting whether a command changed directory, from the command's text, is undecidable against
a shell — quoting, expansion and aliasing can spell a command word in unbounded ways. That is a
property of the problem, not of how hard anyone looked, so further adversarial rounds narrow a
residual that cannot reach zero. The residual class: a directory change whose command word
cannot be recovered from the text at all — an alias, or an expansion whose value is not in the
transcript. Measured cost of what is closed: 8.1% of relative shell paths dropped as
unplaceable, plus ~1.2% dropped for resolving outside the repository.

C1 stays open. Neither this PR nor the issue it inherits from should be read as closing it.

The absolute version was considered and rejected — recorded so it is not re-proposed

Dropping every relative path scraped from a shell command would close the class completely.
It would also discard about 84% of the file paths shell commands contribute, and those are
the reason a decision can be anchored to code at all: on one measured machine, harvesting them
moved the share of decisions anchored to real files from 5.3% to 93.0%. Buying a
completeness claim with the capability the product exists to provide is the wrong trade.

Evidence

Real git init repos, a real git worktree, real symlinks, the real runCapture with only
the wire stubbed; filePaths read off the real POST body; every escaping row given its own
colliding filename, and each one confirmed by running it under a real shell and reading the
other repository's bytes.

91 spellings, all refused, each first run under a real shell and scored only where it genuinely reads the other repository. Round 3's honest-path controls also went from 2/7 held to 7/7.

Non-regression, re-proven: sibling-worktree path IN; different repo OUT; every 0.24.0 and
0.25.0 spelling still closed (the existing 28-spelling table is unchanged and green); the
deliberate laundering trade-off (one root saying "outside" is enough) untouched.

Mutation battery: 26/27 killed. Guards no test could turn red were removed rather than
given a fake test — a duplicate caller-side check, and a !moved branch in admit whose two
roads both ended in a drop. Several survivors produced real tests once I found why they were
masked: a conditional cd hidden by the session cwd already being among the bases, a Codex
argv row whose name another record also supplied, a phantom base that happened to land inside
the repo, and a memo pairing that needed the same spelling in both records with the refusal
evaluated first. One documented survivor remains: the declaredCache key's roots component,
which cannot vary within a capture and is kept for symmetry with its two sibling caches.

Full suite: 950 + 363 + 2201 green. No existing test replaced.

Cost, stated rather than inherited

Measured over ~73,800 real shell commands:

• 8.1% of relative shell paths dropped as unplaceable. Mostly source/. running a
  script, plus function definitions and CDPATH. Two over-detections were removed after
  measuring them: a bare -C is an everyday flag of grep/git/tar/sort, and source
  as an argument is not a command — together they were refusing 1,800 commands for nothing.
• ~1.2% dropped because the directory they were written in resolves outside the repository —
  about seven in ten of those are the misattribution being corrected, not a loss.

Also fixed here

• A cd to a directory that does not exist moves nothing, because a real shell's cd
  fails and stays put. v1 walked through the absent segment and invented a phantom directory,
  which drops honest paths when the phantom lands outside the repo.
• A mis-read target composed a base that was not where the command went; because an
  unresolvable base is skipped, that fell back to the session's own directory — the one place
  the command definitely was not.
• A failed cd after a successful one (cd sub; cd nonexist) sent the token back to the
  repo root instead of leaving it in sub. The chain now crosses the boundary and the caller
  walks back to the deepest link that exists.
• The declared directory is authoritative: appending the session cwd and roots to it put
  the guess back and dropped paths that were honest where the command actually stood.
• A record working inside a different repository had its directory discarded, and our own
  root then vouched for the path. An out-of-repo directory now contradicts whether or not a
  command moved to it.
• @backthread/redact bumped to 0.1.6 — it had changed twice without one.

Deliberately not fixed

A path that stays inside the repository but was written from a subdirectory is still recorded
under the spelling used, not the repository-relative name. Nothing foreign escapes through it;
the file named may be the wrong one. It is an anchoring problem rather than a containment one
and wants its own change. Deleted files still lose their paths, unchanged.

If an agent's shell kept its working directory between commands, a cd in one would govern the
next. Measured across 4,055 real cases where the two readings disagree, the shell had
reset in 96.1%, so each command is read from its own stamped directory.

Reasoning

_{written by the agent in-session via backthread/add-reasoning-to-prs}

Decisions

• Rejected replacing the containment check with a git-backed allowlist (send a path only if git ls-files vouches for it). Measured on a fixture where each escaping spelling reduces to a genuinely tracked name: the batched form admits every collision case, and per-candidate git ls-files --error-unmatch still admits the ..-through-symlink escape 0.25.0 closed, because git cancels .. lexically too. Git's index answers which names a repo has; every escape in this family is about where a spelling lands. It also costs 5.36 ms per candidate and drops untracked-new and staged-delete files.
• Inverted the cwd determination instead, which is where the open-ended question actually was. The containment walk was already a closed allowlist of physical destinations; it was being handed the wrong starting point.
• Ran detection over the command after quote removal and expansion collapsing rather than over the text as written. This was forced by measurement, not taste: c\d, c"d" and c${EMPTY}d contain no cd and run one.
• A cd target that does not resolve is skipped, because a real shell's cd fails and does not move. A target we cannot reduce the way the shell does refuses the command instead — those are different cases and were previously conflated.

Assumptions

• Assumes a record's stamped cwd is the directory that record's tool call ran in. If an agent stamps the session directory instead, relative paths from subdirectories are measured from the wrong place and dropped rather than leaked. Check: confirm on a non-Claude-Code agent before relying on the recall figures.
• Assumes each command starts from its own stamped directory; measured true in 96.1% of 4,055 decisive real cases. If an agent's shell does persist, a cd in one command would govern the next and could leak.

Trade-offs

• Accepted 8.1% of relative shell paths dropped as unplaceable, up from 2.5% before source, quote-aware detection, CDPATH and function definitions were added. The alternative — trusting the reader when it finds no literal cd — is what produced twenty-two confident wrong answers.
• Removed two guards no test could turn red rather than writing tests that only appeared to cover them. Kept one documented survivor, because removing it would trade a correctness property for a mutation score.

Limitations

• Not a proof. A shell can name a command in more ways than a text scan can enumerate; the claim is bounded to the constructs found across four adversarial rounds plus the two hiding mechanisms. Check: re-run an adversarial enumeration before widening any claim about this.
• A path written from a subdirectory is still recorded under the spelling used, so a decision can attach to the wrong file inside the same repository.
• The recall measurements come from one machine's transcripts, where sibling worktrees are the normal workflow. Check: re-measure before quoting 6.8% or 1.2% as general figures.

_{↳ generated by backthread/add-reasoning-to-prs · an open-source Claude Code hook · edit or delete freely}