fix(isolation): address containment review gates

Author: shixi-li

AGENTS.md

@@ -24,6 +24,9 @@ Operational rules and references for automated agents working on this repo. Inst
   npm version or GitHub Release.
 - Provider output-silence liveness checks are opt-in (`enableLivenessCheck: true`). Recovery tests
   that exercise stale-agent termination must enable the watchdog explicitly.
+- Isolation copies must reuse the shared pinned-root boundary in `src/copy-containment.js` for
+  traversal, directory creation, synchronous copies, and worker copies. Revalidate the source and
+  destination immediately before every filesystem effect; never reconstruct unchecked effect paths.
 
 Worker git operations are allowed only with isolation (`--worktree`, `--docker`, `--pr`, `--ship`). They are forbidden without isolation.
 

CLAUDE.md

@@ -6,13 +6,14 @@ Message-passing primitives for multi-agent workflows. **Install:** `npm i -g @th
 
 ## 🔴 CRITICAL RULES
 
-| Rule                               | Why                          | Forbidden                                    | Required                                         |
-| ---------------------------------- | ---------------------------- | -------------------------------------------- | ------------------------------------------------ |
-| **GENERAL PURPOSE ONLY**           | Zeroshot runs on ANY repo    | Hardcoded paths, scripts, languages, domains | Discover from target repo's CLAUDE.md/README     |
-| **Never spawn without permission** | Consumes API credits         | "I'll run zeroshot on 123"                   | User says "run zeroshot"                         |
-| **Never use git in validators**    | Git state unreliable         | `git diff`, `git status` in prompts          | Validate files directly                          |
-| **Never ask questions**            | Agents run non-interactively | `AskUserQuestion`, waiting for confirmation  | Make autonomous decisions                        |
-| **Never edit CLAUDE.md**           | Context file for Claude Code | Editing this file                            | Read-only unless explicitly asked to update docs |
+| Rule                               | Why                               | Forbidden                                    | Required                                                                                 |
+| ---------------------------------- | --------------------------------- | -------------------------------------------- | ---------------------------------------------------------------------------------------- |
+| **GENERAL PURPOSE ONLY**           | Zeroshot runs on ANY repo         | Hardcoded paths, scripts, languages, domains | Discover from target repo's CLAUDE.md/README                                             |
+| **Never spawn without permission** | Consumes API credits              | "I'll run zeroshot on 123"                   | User says "run zeroshot"                                                                 |
+| **Never use git in validators**    | Git state unreliable              | `git diff`, `git status` in prompts          | Validate files directly                                                                  |
+| **Never ask questions**            | Agents run non-interactively      | `AskUserQuestion`, waiting for confirmation  | Make autonomous decisions                                                                |
+| **Never edit CLAUDE.md**           | Context file for Claude Code      | Editing this file                            | Read-only unless explicitly asked to update docs                                         |
+| **Preserve copy containment**      | Copy paths cross trust boundaries | Independent path joins or one-time checks    | Reuse the pinned-root boundary and revalidate immediately before every filesystem effect |
 
 ### 🔴 GENERAL PURPOSE REQUIREMENT (CRITICAL)
 

tests/isolation-copy-containment.test.js

@@ -1,7 +1,7 @@
-const assert = require('assert');
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
 
 const IsolationManager = require('../src/isolation-manager');
 const {
@@ -23,14 +23,14 @@ function isContainmentError(error) {
 }
 
 async function captureContainmentError(copyPromise) {
-  try {
-    await copyPromise;
-    assert.fail('expected copy containment to reject');
-  } catch (error) {
+  let containmentError;
+  await assert.rejects(copyPromise, (error) => {
     assert.ok(error instanceof CopyContainmentError, error.stack || error.message);
     assert.strictEqual(isContainmentError(error), true);
-    return error;
-  }
+    containmentError = error;
+    return true;
+  });
+  return containmentError;
 }
 
 describe('isolation copy containment', function () {