Context

PR #1407 (open as of filing; implements #1406) adds global --contain and threads GlobalFlags::workspace_guard through:

• src/cmd/output.rs → run_write / stage_for_write (engine-backed writes: create, delete, replace, tidy fix, patch, most md, etc.)
• src/cmd/tx.rs → execute_and_collect(..., guard)

During implementation we grepped write_dispatch.rs / rename.rs and saw no PathGuard usage, then shipped the PR body as covering "CLI workspace path guarding" without tracking the gap.

Gap (partial containment)

With --contain set, paths that go through the binary / case-only rename path (src/cmd/write_dispatch.rs / execute_write) and any other non-stage_for_write CLI mutation path may still escape the workspace, while engine-backed creates are blocked.

That is worse than no flag: agents may believe --contain is a full sandbox when it is only partial.

Acceptance criteria

• Audit every CLI mutation entrypoint for workspace_guard / PathGuard when global.contain is true:
  • write_dispatch / binary rename
  • text rename if separate from engine
  • any remaining direct atomic_write / fs:: mutators under src/cmd/
• Integration or unit tests: rename (and any other non-engine path) with --contain and ../ fails with a clear containment error
• Docs for --contain state which commands are covered (or claim full write coverage only after the audit passes)
• Update enhancement: optional CLI path containment for agent --cwd workspaces #1406 acceptance if needed so "all write modes" is explicit

Related

• enhancement: optional CLI path containment for agent --cwd workspaces #1406 enhancement: optional CLI path containment
• PR feat: add --contain for optional CLI workspace path guarding #1407 feat: add --contain
• docs: clarify CLI is not a sandbox; MCP enforces path containment #1405 docs: CLI is not a sandbox by default; MCP is

How found

MPI adversarial cycle: create ../ escape under --cwd. Fixed for default docs + opt-in --contain on the engine path; incomplete command coverage noticed via grep of write_dispatch during the same implementation and not filed.