A Workspace Boundary Is Not a Path

The first public Beta 7 Claude failure test did exactly what a boundary test should do: it asked the owned adapter to work one directory outside its workspace. Claude Code never launched. The tool rejected the request in less than a millisecond.

Then the browser printed the Host's absolute workspace path.

The rejection was correct, but its explanation crossed the boundary it was describing. The adapter had formatted the resolved root into its JSON error, and the parent agent faithfully repeated that error in O Chat. No credential was exposed, yet a private machine path had become browser data. A safe action with an unsafe description is still an information leak.

Keeping the absolute path seemed useful for debugging. It was not useful to the person who could act on the error: the browser user cannot change the Host's configured root, and does not need to know its spelling. The actionable fact is only that the requested directory is outside the configured workspace. Detailed local diagnostics belong in Host-owned logs, not in the provider's public envelope.

The adapter now returns categorical messages for four boundary failures: the configured workspace is unavailable, the requested directory is unavailable, the target is not a directory, or the target escapes the configured workspace. None includes the configured root, requested path, resolved symlink target, or raw operating-system exception.

The regression tests deliberately use names such as customer-secret-workspace and private-host-directory. They cover a direct escape, a symlink escape, a missing directory, a file used as a directory, and an invalid operator workspace. Each assertion checks both the useful public category and the absence of every sensitive-looking path. The Claude adapter suite passes 56 tests; the related provider, approval, error, and Work Room suites pass another 92.

The lesson is smaller than “hide errors.” Errors are part of the product and must remain specific enough to recover from. But a boundary message should name the rule that failed, not disclose the private value used to enforce it.

The next immutable Beta exposed a second lesson. Hosted Work Rooms validate their directory once in the first-class coding-agent plugin and again in the native adapter. The first fix covered the adapter; the public browser run used the plugin and found its older path-bearing message. The plugin now uses the same categorical contract for both Codex and Claude Code, and its own tests assert that missing paths, files, workspace roots, and symlink targets never enter the result. A privacy contract has to cover every public writer, not only the deepest implementation.