[nt-nerdtechnic]

Slice S1 of DESIGN-C (cross-workspace child panes): an agent can never close its own pane, its own workspace or its own window. Refused at the tool/backend side and again in the window. Includes the review #534 fixes and review #541 MED-1.

The self scope (backend, from the credential only)

_self_scope / _self_scope_refusal in mcp_server/server.py:

• pane: the id the caller's token names, followed through re-attach aliases.
• workspace: the registry's record for that pane. Compared by folder identity (os.stat → (st_dev, st_ino), _same_directory). A case variant on macOS/Windows, a symlink, a trailing slash or ~ all match. String compare is used only when a path cannot be stat'ed.
• windows, the union of:
  • the window mirroring the caller;
  • every window mirroring any pane of the caller's workspace;
  • every main window that holds the caller's workspace, even with none of its panes in it. Windows now announce what they hold in ui.invoke.ready (new optional workspaces field, re-sent on change; a detached group window sends []).

When a path cannot be stat'ed (a folder that is gone), the fallback string compare is case-folded on macOS and Windows.

Case variants are stopped by the backend. The window only knows its own spelling of a path, so its second check compares case-folded strings and cannot see symlinks. The backend's stat comparison catches case variants and symlinks. Tests: test_a_case_variant_of_your_own_workspace_is_still_yours and test_a_case_variant_registration_still_counts_its_window_as_yours; they run on this APFS volume and skip on a case-sensitive one.

Inventory: registered commands that act on the caller's own window, workspace or pane

Main-window command registry (App.vue), reachable through ui_invoke. Editor, Git and plugin windows do not answer ui.invoke.request.

Command	What it does	Guard
ui.pane.close	kills the named pane	backend + window: self-close when the named pane (or an alias of it) is the caller
ui.pane.reclaim	ends the CLI, keeps the card	backend + window: the caller's id is taken out of the batch and returned as a refused row (reason: "self"), kept on an error reply too
workbench.action.closeWindow (⌘⇧W)	window.close(), which tears down that window's PTYs	backend: ui_invoke answers ui_dedicated_tool and points at window_close for ANY window, so closing someone else's window also leaves a record (R2 MED-1). The self check (self-window-close when it lands in one of the caller's windows) stays in _self_scope_refusal. Window: refused when it hosts the caller or holds its workspace
workbench.action.closeActivePane (⌘W)	closes the focused pane	window: self-close while the focused pane is the caller (only the window knows focus)
workbench.action.rebuildFocusedPane	kills and resumes the focused pane	window: self-close while the focused pane is the caller
ui.pipeline.reset	onKillAll(): ends EVERY pane in the window, manual ones included, with no confirmation and no run needed	backend: self-close in both pipeline_reset and ui_invoke when the request lands in one of the caller's windows (_lands_in_own_window, which now also reads announced held workspaces). Window: refused whenever it hosts the caller (R2 HIGH-1)
ui.pipeline.abort / restart / restart_from	tear down or restart the run's slot panes	window: self-close when the caller is a pipeline slot pane in that window (review LOW-1). Window only: the backend does not know slot membership
ui.window.close / ui.workspace.close (registered by S4)	close a window / a workspace	ui_invoke answers ui_dedicated_tool; only window_close / workspace_close (S4) may do it, because they record the action and show which pane did it. Those tools call _self_scope_refusal, which refuses self-window-close / self-workspace-close

Checked and not guarded, because none of them closes or ends the caller:

• workbench.action.reloadWindow: the PTYs live in the backend and are reattached.
• ui.workspace.switch: switching does not disturb panes.
• ui.pane.interrupt: aborts a turn, closes nothing.
• ui.pane.focus, ui.pane.place, ui.settings.close, workbench.action.closeModal and the open* / focus* / zoom* commands.

The existing cli_close_agent (self-close) and cli_reclaim_agent (self-reclaim) are unchanged.

Contract left for S4 (review MED-3): S4 must use exactly the arg names path and windowId, and must either require path or treat an empty one as the caller's own workspace. This is recorded as a TODO in _self_scope_refusal and as a skipped test in test_mcp_self_scope.py.

Red → green

Every behaviour was red first. Each round's tests were run against the previous commit with the source change reverted (git apply -R):

Round	Backend	Renderer
Round 1 (initial)	9 red	6 red
Round 2 (#534 review)	5 red	6 red
Round 3 (held windows, dedicated tools)	3 red	1 red
Round 4 (R2: reset, closeWindow, fallback casefold)	4 red	1 red

All green now.

Local verification (targeted only)

• safe-pytest.sh <wt> -k "test_mcp_self_scope or test_plan_mcp_ui_invoke or test_plan_mcp_reclaim_agent or close_agent or test_share_mcp_tools or pipeline or ui_invoke_ready or window_id" -n 2 → 322 passed, 1 skipped (the S4 TODO), fake-security calls 0. This includes the golden tools/list test.
• That run had one failure, test_plan_mcp_subdir_workspace::test_pipeline_window_requests_address_the_panes_own_workspace: its pane resets its own window's pipeline, which is now refused by design. The test now asserts self-close for that step; re-run → 27 passed together with the self-scope file.
• pnpm vitest run src/renderer/src/composables/__tests__/useUiActionBus.test.ts --maxWorkers 1 → 67/67.
• pnpm typecheck:web → 0 errors.
• ruff → clean.

RULE ZERO

• Host and external callers: no self scope, so behaviour is as on main.
• Acting on another pane, workspace or window: same path as main. Locked by the …still_goes_through / …not_refused tests and the existing ui_invoke, reclaim and pipeline suites.
• No tool description changed (golden test green).
• Wire changes only add fields: the request gains caller_workspace_path; ui.invoke.ready gains optional workspaces.
• Intended behaviour changes:
  • a pane cannot close, reclaim or rebuild itself through ui_invoke;
  • ui_invoke no longer runs ui.window.close / ui.workspace.close (neither exists on main yet), nor workbench.action.closeWindow (use window_close);
  • a pane cannot reset the pipeline of a window it is in (that ended every pane there, itself included).

Protection check

• Credential, account-switching and quota paths (credential_*, quota_*, usage_*): diff vs origin/main is empty.
• No function deleted. The diff's only removed def lines are a signature change and two tests turned from async to sync under the same names.
• Signature changes:
  • _self_scope_refusal(caller, action, args) → (caller, action, args, workspace_path="") (new in this PR).
• Added:
  • backend: _same_directory, _lands_in_own_window, _DEDICATED_CLOSE_ACTIONS, app.main_window_sessions(), Session.held_workspaces;
  • renderer bus options hostsPane, focusedPaneIds, isPipelineSlot, heldWorkspaces (all optional).
• No new limits.

Known boundary (documented, unchanged)

A same-user process that reads another pane's token can act as that pane (architecture.md, "Trust boundaries"). These guards stop argument-level and tool-level self-close, not token theft.

Security-related: second review requested after this round.

🤖 Generated with Claude Code

[nt-nerdtechnic]

Squash-merged into main as 5ca9fc8.