02 / PROJECTS
Giving coding agents room to work
Several AI coding agents work on one codebase in separate working copies. A supervisor can retry a failed task, reassign it or ask a person to step in.
Separate working copies, with explicit file boundaries.
Setting an agent’s working directory didn’t stop it from passing an absolute path outside that directory to a file tool. Comparing path strings wasn’t enough either: a symlink could point somewhere else.
The check now resolves the real path of each path-bearing file-tool argument before comparing it with the assigned working copy. The list of path fields comes from configuration, so the check isn’t tied to a hardcoded list of tools.
The Claude Agent SDK handles the agent sessions; the surrounding code manages working copies, execution and recovery. The changes address path-based escapes and document the separate requirements for shell isolation.
Scope and context
The containment checks cover file-tool arguments, including paths reached through symlinks. Arbitrary Bash commands can still reach outside the assigned working copy through commands such as cd or cp. Shell isolation requires an OS-level sandbox and remains a documented, deferred part of the design.