fix(tools): do not adopt a stale cwd after an interrupted command

[ethernet8023]

What does this PR do?

A chat adopted the working directory of a different chat, and every later
command in that chat ran there.

The command wrapper prints the __HERMES_CWD_* marker after the command
returns (tools/environments/base.py:924). A killed or timed-out command never
prints it, so env.cwd still holds the directory of the last command that
FINISHED. One local environment serves every session, because
_resolve_container_task_id (tools/terminal_tool.py:1384) collapses cwd-only
overrides to "default". That leftover directory is therefore routinely
another session's.

Three call sites trusted a directory that the command never reported:

• The post-command dual-write (tools/terminal_tool.py:3315) copied env.cwd
  into the interrupted session's durable record.
• The cwd echo (tools/terminal_tool.py:3422) read the same value and told
  the model that it had moved.
• The reaped-environment rescue (tools/file_tools.py:1443) copied a cached
  snapshot of the same shared value into the session record. Review found
  this sibling after the first version of this PR.

This PR reports the observation instead of inferring it. The marker parse sets
result["cwd_observed"], and the two terminal-tool call sites read that flag.
The file-tools rescue becomes fill-only: it writes the snapshot when the
session has no record, and it never overwrites a record that the session wrote
for itself. When a command reports no directory, the session keeps the
directory that it already had.

This approach is correct because the marker is the only evidence that a command
finished somewhere. The parse already knows whether it found one, so the flag
adds no new state and no new resolver. It also removes the last reads of the
shared env.cwd on the session-record path, which the comment at
tools/terminal_tool.py:1180 asks for.

Related Issue

Fixes #85658

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• tools/environments/base.py — _extract_cwd_from_output sets
  result["cwd_observed"] when the marker gives a directory for this command.
  The docstring states why an unobserved cwd belongs to no session.
• tools/environments/local.py — the local override clears the flag when it
  rolls back a path that does not exist. The restored value is also unobserved.
• tools/terminal_tool.py — the record write (line 3315) and the cwd echo
  (line 3422) both read the flag.
• tools/file_tools.py — the rescue for a reaped environment ([Bug]: File creation fails silently in long-running conversations #26211) writes
  the cached snapshot only when the session has no record. The snapshot comes
  from the shared environment, so it is not attributable to the session.
• tests/tools/test_interrupted_command_cwd.py — new. Eight tests against a
  real LocalEnvironment. Two of them drive terminal_tool itself through an
  interrupt, so the gates at the call sites have direct coverage.
• tests/tools/test_session_cwd_store.py — two fakes simulate the marker
  parse. They moved cwd but did not report the observation, so they no longer
  modelled a completed command. They now return the flag. Two new tests pin the
  fill-only contract of the file-tools rescue.
• tests/tools/test_vercel_sandbox_environment.py — two assertions compared the
  whole result dictionary against a literal. They now read the two fields that
  they test.

How to Test

1. Run the changed test files. All 22 pass:

   scripts/run_tests.sh tests/tools/test_interrupted_command_cwd.py tests/tools/test_session_cwd_store.py -q

2. Prove that the tests detect each fault. Each row reverts one change, runs
   the tests, and fails. I ran all four:

   Mutation	Result
   Delete result["cwd_observed"] = True in base.py	6 of 8 fail in test_interrupted_command_cwd.py
   Revert the record write to if not workdir:	1 of 8 fails (test_interrupt_keeps_record_and_echoes_no_cwd)
   Revert the echo to the ungated getattr(env, "cwd", None)	1 of 8 fails (test_interrupt_keeps_record_and_echoes_no_cwd)
   Remove the get_session_cwd(...) is None guard in file_tools.py	1 of 14 fails (test_existing_record_survives_the_rescue)

   The first version of this PR gated the two terminal-tool call sites but
   tested them through a copy of the gate inside the test file. Review showed
   that a revert of either call site passed every test. The two
   TestTerminalToolReadsTheFlag tests close that gap: they call
   tt.terminal_tool() itself.

3. Reproduce the original defect with the script in [Bug]: An interrupted command adopts another session's working directory #85658. Before the change
   the record holds the other chat's directory. After the change it holds its
   own.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass — see the detail below
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: NixOS, Linux 7.1.0

Test detail: I ran the directories that this change touches, not the whole
suite. CI owns the full run.

• tests/tools/ reports 27 failures. I ran the same directory on ac9b9f54c
  in a clean worktree and compared the failure names. The sets are identical,
  so this branch adds no failure. One of the 27 needs the network
  (test_web_providers.py, "DNS resolution failed").
• tests/tui_gateway/ reports 421 passed and 0 failed.
• The changed test files report 22 passed
  (test_interrupted_command_cwd.py: 8, test_session_cwd_store.py: 14).
• tests/tools/test_file_tools_cwd_resolution.py and
  tests/tools/test_file_tools.py report 56 passed and 2 skipped, so the
  fill-only rescue does not regress the [Bug]: File creation fails silently in long-running conversations #26211 paths.

I started a full scripts/run_tests.sh run and stopped it before it finished,
so I make no claim about the directories that I did not run.

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — the
  docstrings of the changed functions state the new contract
• I've updated cli-config.yaml.example if I added/changed config keys — N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide
• I've updated tool descriptions/schemas if I changed tool behavior — N/A

Cross-platform detail: the flag rides the result dictionary, so it is
independent of the host. scripts/check-windows-footguns.py --diff origin/main
reports nothing on the lines that this PR adds. The Windows-specific path is
the local override in local.py, which clears the flag on a rollback. The
rollback exists for the MSYS path normalization that Git Bash needs.

Screenshots / Logs

The defect, before the change:

shared env.cwd after other chat: /tmp/…/otherchat_4tfd78l7
my interrupted command: {'out': '[Command timed out after 2s]', 'exit': 124}
   my record became   : /tmp/…/otherchat_4tfd78l7      <-- the other chat
   (repo was          : /tmp/…/repo_217_imog )

The same sequence, after the change:

A: my chat cds into its repo   : {'exit': 0, 'cwd': '/tmp/…/repo_jwnktgnz'}
   my record: True /tmp/…/repo_jwnktgnz

B: OTHER chat works elsewhere  : {'exit': 0, 'cwd': '/tmp/…/otherchat__i3317hp'}
   shared env.cwd is now other : True

C: my chat's command INTERRUPTED: {'exit': 124}
   my record after interrupt   : /tmp/…/repo_jwnktgnz
   STILL MINE (not other)?     : True

D: my next plain command runs in: /tmp/…/repo_jwnktgnz

Notes for review

This PR adds one key to the execute() result dictionary. A test that compares
that dictionary against a literal will see it. Two such tests are in this diff.

This PR corrects one of two defects behind the original report. The second
defect is separate. _completion_cwd (tui_gateway/server.py:2411) gives a
detached desktop session the value of TERMINAL_CWD, which the app pins to the
home directory. The database row correctly records no workspace, but the prompt
and the terminal disagree with it. That correction touches a different resolver
and a race in the renderer, so it belongs in its own PR.

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 90a21fe — fix(tools): do not adopt a stale cwd after an interrupted co}

⚠️ Warnings

OSV vulnerability scan · View job

5 known vulnerabilities found in pinned dependencies.

• CVE-2026-67213 in package-lock.json
• CVE-2026-67213 in website/package-lock.json
• CVE-2026-70608 in package-lock.json
• CVE-2026-56876 in package-lock.json
• CVE-2026-70606 in package-lock.json

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

---

debug info

CI timings

CI timings · View report · View job

Wall time 5m25s vs 7m9s (-24.2%). 12 job(s) slower, 9 faster, 3 unchanged.

• Python tests / Run tests slice 2/12: -48.0s
• Python tests / Run tests slice 6/12: +38.0s
• Python tests / Run tests slice 9/12: +13.0s
• OS-specific tests / Windows-only tests: +13.0s
• Python tests / Run tests slice 4/12: +8.0s

[teknium1]

Deep review

Checked out 90a21fe locally and re-ran the three touched test files against the repo venv: 38/38 pass (test_interrupted_command_cwd.py 8, test_session_cwd_store.py 16, test_vercel_sandbox_environment.py 14 relevant). CI is green on the full matrix. Findings below.

Root cause — confirmed on main

The premise holds up exactly as described:

• tools/environments/base.py builds the command wrapper so the __HERMES_CWD_* marker prints after the command returns. A killed/timed-out command therefore emits no marker, and env.cwd keeps whatever the last finished command left there.
• _resolve_container_task_id collapses cwd-only local sessions to "default", so one LocalEnvironment is genuinely shared across sessions — the leftover env.cwd is routinely another session's directory.
• Pre-PR, the dual-write at tools/terminal_tool.py:3315 was gated only on not workdir, so an interrupt stamped the foreign directory into the interrupted session's durable record, and every subsequent bare command in that session ran there. Reproduced the shape of this with the shared-env test in the PR; it fails on main and passes on the branch.

Design — the right fix for this class

Deriving the gate from the marker parse itself (result["cwd_observed"]) is the correct mechanism: the marker is the only evidence a command finished somewhere, the parse already knows whether it found one, and the flag adds no new state, resolver, or ownership model. It also converges on the direction the rearch comment at terminal_tool.py:~1180 asks for (stop reading shared env.cwd on the session-record path).

Setting the flag in the base _extract_cwd_from_output means every backend that uses the marker parse (local, Docker, SSH, Modal, Daytona, Singularity) gets the fix for free — no per-backend duplication.

Sibling-site audit (the "fix the class, not the site" check)

I grepped every env.cwd → session-record path on the branch:

Site	Status
terminal_tool.py:3315 record dual-write	gated ✅
terminal_tool.py:3422 cwd echo to the model	gated ✅
file_tools.py:1443 reaped-env rescue (#26211)	fill-only ✅
terminal_tool.py:1260 (register_task_env_overrides)	write path from an explicit workspace override — correctly untouched
terminal_tool.py:2805 (guard_cwd_base)	pre-command guard resolution, not a durable record — correctly untouched
delegate_tool.py worktree seeding	reads get_session_cwd (the record store), not shared env.cwd — unaffected

No ungated sibling remains. The file_tools change also preserves the #26211 contract (recordless sessions still get the rescue) and the new TestReapedEnvFallbackIsFillOnly pins both directions.

Edge cases checked

• Windows/MSYS rollback (local.py:1666-1671): clearing cwd_observed when the normalized path doesn't exist is right — the restored value is the previous cwd, which this command didn't observe either. Same reasoning as the interrupt case, consistently applied.
• New result-dict key: cwd_observed rides the execute() result, so whole-dict literal comparisons see it. The two such tests in test_vercel_sandbox_environment.py were converted to field asserts; green CI across the full matrix indicates no other literal comparisons exist.
• (result or {}).get(...): defensively correct — at both call sites result is always a dict by the time the gate runs, so this is belt-and-suspenders, not a behavior change.
• Same-session interrupt (no second chat): covered by test_single_session_keeps_its_own_prior_directory — the session keeps its own prior record rather than adopting the shared env's drift. Good catch; this is the case a narrower fix would have missed.

Test quality

The mutation table in the PR body is the standout here — each gate has a test that fails when that gate alone is reverted, and the TestTerminalToolReadsTheFlag class drives tt.terminal_tool() itself rather than a reimplementation of the gate (closing the exact gap the first version of this PR had). This is the falsification discipline we want in every fix PR.

Scope note

The PR body correctly identifies the second, independent defect behind the original report (_completion_cwd in tui_gateway/server.py handing detached desktop sessions the app-pinned TERMINAL_CWD) and leaves it for its own PR. Agreed — different resolver, different surface, keep it out of this diff.

Verdict

Correct root cause, minimal mechanism, class-wide (all backends + all three call sites), well-falsified tests, no regression to #26211, green CI. No changes requested. Pending maintainer merge decision.