wr-agent: register workroom roots and refuse paths outside them, before any shared host #357

Parent

Part of #154 (remote agent sessions).

The gap

wr-agent serves any path a peer names. vcs.rs's absolute() and read() check a request's root and shared_root only for shape (absolute, no .., no NUL), and the File service's containment is relative to the root the client supplies. Nothing ties a request to the workroom roots the agent was told to serve: serve takes no root and the agent holds no path state. The design doc records this as "the deferred remote-registration work" (docs/designs/remote-workrooms.md, the #211 entry).

Why not now

Today the only peer is the box's own user. Locally the agent is a same-user Unix socket; on boxd it is reached over ssh with the user's boxd key, and its socket belongs to the boxd user, who can already read every file the agent would serve. An allowlist blocks nothing that user cannot do directly. The owner deferred it again on 2026-10-06, while planning the boxd wiring (eng review decision D6).

When it is needed

Before any host where something other than the workroom's own user can reach the agent: a shared or multi-user host, a team box, or a provider that runs other tenants' processes as the same user.

What to build then

• A Control-service frame with which the app registers the roots the agent may serve (the agent outlives connections and serves many workrooms, so a launch-time root does not fit).
• The VCS, File and exec services refuse any root, shared_root or path outside a registered root, after symlink resolution on the host.
• Registration survives an agent hand-off and restart, or the app registers again on connect.

Acceptance criteria

• A request naming a path outside every registered root is refused, including through a symlink and a .. that resolves outside.
• Registered roots keep working across an agent hand-off and a reconnect.
• An agent that predates the frame is handled by version negotiation, not by failing open silently.

Filed by Claude Code at the owner's request, 2026-10-06.