[delete-cloud]

Summary

• add ADR-0066 for ACP additional workspace directories
• persist ACP additionalDirectories on sessions and apply them on session/new and session/load
• propagate additional roots through runtime creation, environment tool config, file tools, file_patch, bash_run, and native/docker/podman sandbox mounts
• keep file_patch safe-edit policy active for absolute primary/additional-root paths

Verification

• uv run pytest tests/acp -k "additional or compat" -v
• uv run pytest tests/ui/test_session_persistence.py -k "additional_directories or session_record" -v
• uv run pytest tests/coding_agent/test_runtime_preparation.py tests/coding_agent/test_bootstrap.py -k "additional_workspace_roots or runtime_preparation_service" -v
• uv run pytest tests/coding_agent/tools/test_file_ops.py tests/tools/test_shell.py -k "additional or workspace" -v
• uv run pytest tests/coding_agent/tools/test_file_patch_tool.py -v
• uv run pytest tests/cli/test_entrypoint_contract.py -k acp -v
• uv run ruff check src/coding_agent/acp/server.py src/coding_agent/app.py src/coding_agent/environment/additional_roots.py src/coding_agent/executors/local_daemon.py src/coding_agent/runs/runtime_preparation.py src/coding_agent/server/session_manager.py src/coding_agent/tools/file_ops.py src/coding_agent/tools/file_patch_tool.py src/coding_agent/tools/shell.py src/coding_agent/tools/sandbox.py tests/acp/test_server.py tests/acp/test_compat_harness.py tests/coding_agent/test_bootstrap.py tests/coding_agent/test_runtime_preparation.py tests/coding_agent/tools/test_file_ops.py tests/coding_agent/tools/test_file_patch_tool.py tests/tools/test_shell.py tests/ui/test_session_persistence.py
• uv run ruff format --check src/coding_agent/acp/server.py src/coding_agent/app.py src/coding_agent/environment/additional_roots.py src/coding_agent/executors/local_daemon.py src/coding_agent/runs/runtime_preparation.py src/coding_agent/server/session_manager.py src/coding_agent/tools/file_ops.py src/coding_agent/tools/file_patch_tool.py src/coding_agent/tools/shell.py src/coding_agent/tools/sandbox.py tests/acp/test_server.py tests/acp/test_compat_harness.py tests/coding_agent/test_bootstrap.py tests/coding_agent/test_runtime_preparation.py tests/coding_agent/tools/test_file_ops.py tests/coding_agent/tools/test_file_patch_tool.py tests/tools/test_shell.py tests/ui/test_session_persistence.py
• git diff --check

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR implements end-to-end support for "additional workspace roots" in Coding Agent: users can specify extra directories via ACP additionalDirectories parameter, which are stored durably per session, propagated through runtime setup, and validated in file operations and sandboxed execution.

Changes

Additional Workspace Roots Support

Layer / File(s)	Summary
Session metadata and persistence src/coding_agent/server/session_manager.py	SessionRecord and Session add additional_directories: list[str] fields; SessionManager.create_session accepts and persists them; new update_session_additional_directories closes runtime, updates field, and re-persists; paths validated as absolute and normalized.
ACP protocol and request parsing src/coding_agent/acp/server.py	AcpSessionManager protocol gains update_session_additional_directories method. Server parses additionalDirectories from session/new and session/load requests, validates absolute paths via _parse_additional_directories helper, and routes into session creation/update.
Environment wrapping and pipeline wiring src/coding_agent/environment/additional_roots.py, src/coding_agent/app.py	AdditionalWorkspaceRootsEnvironment wraps environments to inject additional roots into tool config. create_child_pipeline and create_agent accept additional_workspace_roots_override, resolve to Paths, wrap environment, and populate ctx_config with string paths.
Runtime executors and preparation src/coding_agent/executors/local_daemon.py, src/coding_agent/runs/runtime_preparation.py	LocalDaemonRuntimeSession adds additional_directories field; runtime preparation services forward session's additional directories as additional_workspace_roots_override when creating runtime agents.
File operations and path validation src/coding_agent/tools/file_ops.py	configure_workspace and build_file_tools support additional_roots parameter; paths validated against all allowed roots; cache keyed by (root, additional_roots) tuple; file tool wrappers call with additional roots.
File patch tool src/coding_agent/tools/file_patch_tool.py	build_file_patch_tool accepts additional_roots, resolves patch paths against union of workspace and additional roots, adjusts safe-edit validation for relative-only paths.
Sandbox config and path validation src/coding_agent/tools/sandbox.py	SandboxConfig adds additional_roots field; all backends (none, Seatbelt, bubblewrap, nsjail, Docker, Podman) validate cwd/commands against all roots and mount/expose additional roots; _validate_cwd and _validate_none_mode_command_paths refactored for multi-root checks.
Shell tool integration src/coding_agent/tools/shell.py	bash_run collects additional_workspace_roots from config, validates cd commands and path arguments against all roots, delegates cwd validation to sandbox module, extends path-escape checks for all allowed roots.
ACP and harness tests tests/acp/test_server.py, tests/acp/test_compat_harness.py	Added FakeManager.update_session_additional_directories and HarnessManager method; new tests for session/new with absolute directories, rejection of relative paths, and session/load updates; updated lifecycle test expectations.
Bootstrap and runtime preparation tests tests/coding_agent/test_bootstrap.py, tests/coding_agent/test_runtime_preparation.py	Bootstrap test verifies create_agent honors additional_workspace_roots_override and file tools access extra roots. Runtime preparation test confirms prepare_runtime forwards additional directories through to runtime config.
File operations tests tests/coding_agent/tools/test_file_ops.py	Added tests for file_read and file_write accepting absolute paths under additional roots.
Sandbox and shell tests tests/tools/test_shell.py	Tests for none-mode path/cwd access, Docker/Podman bind-mounts, macOS Seatbelt profiles, Linux bubblewrap binding; verifies additional roots mounted and commands execute correctly.
Session persistence tests tests/ui/test_session_persistence.py	Extended SessionRecord round-trip test to cover additional_directories. Added tests for missing-field default and rejection of relative paths.
Documentation docs/adr/0066-acp-additional-directories.md	ADR documents approach for supporting additionalDirectories, covering storage, propagation, tool/sandbox enforcement, and validation criteria.

Sequence Diagram

sequenceDiagram
  participant Client
  participant ACP Server
  participant SessionManager
  participant Runtime
  participant FileTools
  participant SandboxTools

  Client->>ACP Server: session/new (additionalDirectories=["/extra"])
  ACP Server->>ACP Server: _parse_additional_directories
  ACP Server->>SessionManager: create_session(additional_directories)
  SessionManager->>SessionManager: normalize & persist session
  
  Client->>ACP Server: run command in /extra
  ACP Server->>Runtime: create runtime with additional_workspace_roots_override
  Runtime->>FileTools: configure with additional roots
  Runtime->>SandboxTools: mount additional roots
  
  Client->>FileTools: file_read(/extra/file.txt)
  FileTools->>FileTools: validate path in [workspace, /extra]
  FileTools-->>Client: file contents
  
  Client->>SandboxTools: bash in /extra
  SandboxTools->>SandboxTools: validate cwd against allowed roots
  SandboxTools-->>Client: command result

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~75 minutes

Possibly related PRs

• delete-cloud/Coding-Agent-Loop#401: Both PRs modify bash_run/_validate_no_path_escape in shell.py for path-escape validation logic; main PR extends with additional-roots-aware checking.
• delete-cloud/Coding-Agent-Loop#532: Main PR builds on sandbox backend changes from PR #532 by extending Seatbelt/bubblewrap/Podman runners to support additional root mounting and validation.
• delete-cloud/Coding-Agent-Loop#89: Both PRs extend the Environment abstraction and CoreTools wiring in agent/runtime setup; main PR's AdditionalWorkspaceRootsEnvironment builds on those foundational changes.

Poem

🐰 Additional roots now bloom so bright,
Workspaces expand—no walls in sight!
Sandbox mounts, file tools aligned,
Extra directories, no constraints binding minds.
Paths validated, all safe and sound—
More gardens for the agent to explore around!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 2.82% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'feat(acp): support additional directories' directly and clearly summarizes the main change - adding support for additional directories in ACP sessions.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/acp-additional-directories

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[delete-cloud]

Manual fallback review while CodeRabbit remains pending.

Scope reviewed: ACP additionalDirectories parsing/persistence, runtime propagation, local file/file_patch/bash_run access checks, native/docker/podman sandbox mount/profile changes, and focused regression tests.

Findings: no P1/P2 blockers found after fixing the file_patch absolute-path safe-edit edge in c71a6d6.

Verification checked locally:

• uv run pytest tests/acp -k "additional or compat" -v
• uv run pytest tests/ui/test_session_persistence.py -k "additional_directories or session_record" -v
• uv run pytest tests/coding_agent/test_runtime_preparation.py tests/coding_agent/test_bootstrap.py -k "additional_workspace_roots or runtime_preparation_service" -v
• uv run pytest tests/coding_agent/tools/test_file_ops.py tests/tools/test_shell.py -k "additional or workspace" -v
• uv run pytest tests/coding_agent/tools/test_file_patch_tool.py -v
• uv run pytest tests/cli/test_entrypoint_contract.py -k acp -v
• uv run ruff check touched files
• uv run ruff format --check touched files
• git diff --check