name the sandbox's working directory, and drive phases through it

Two features, one shared reason: what the sandbox calls things decides
what a run tells you afterwards.

The cwd is now mounted at the path it has on the host and that is the
working directory, so pwd, an error the agent quotes, a commit message and
the window title a harness derives from the cwd all name this project
instead of reading the same as every sandbox in the session. The mount is
unchanged: same directory, same rw, same :z, still the only writable one.

Only the destination changed, and a destination is where a bind mount can
do damage -- it hides whatever the image already had there. So
mirror_block_of() refuses the paths the image or the sandbox owns (/usr,
/etc, /var, /opt, /bin, /sbin, /lib*, /boot, /proc, /sys, /dev, /root,
/run, /tmp, /home, /home/sandbox*) and / itself, while /home/<user>/...
mirrors: the one standard hierarchy where work lives, and the one whose
per-user tree never meets the container's /home/sandbox volume or the
read-only .agents share inside it.

/tmp is what set the shape, and it was measured rather than assumed: with
--tmpfs /tmp and -v /tmp/x:/tmp/x in one run podman puts the tmpfs on top,
so pwd prints the right path, writes succeed, and the project is not there.
A failure that quiet earns a refusal plus a line of output instead:
workdir_note in --print-policy, a comment in --dry-run, one log line on a
real run. --workdir DIR still chooses the mount point; onto a refused path
it is honoured (it was asked for) and warned about. /project, the one
directory baked into the image, is every fallback, so a workdir always
exists -- --no-cwd included.

ai-sandbox-autophase runs a .agents/phases/ pipeline with the split the
sandbox forces: every executor agent and the .agents/validate.sh gate
inside, the commits and the pushes outside. The gate is in the writable
mount, so running it on the host is running agent-editable bash on the
host; the git remote is deliberately unreachable in there, because an agent
that can push can ship what you are about to review. It runs your launcher,
not a copy of it -- the definition is read out of your rc files and never
called, which is what lets --status and --dry-run promise no token fetch,
no build, no container. Host git runs with an empty hooks path and no ext::
transport, and delivery is refused if a sandboxed unit rewrote .git/config
or planted a hook. Needs --no-interactive to go with --no-tty: an
unattended run must not leave stdin open on your keyboard, and the two are
now separate choices on both sides.

Tests and tooling, most of it forced by what the two changes exposed:
mirror_block_of is extracted from the script and asked about /usr and
/home/sandbox, which a test cannot create (the 06_entrypoint.sh pattern),
and both real branches are driven from a scratch dir under $HOME, since
$TMPDIR is always the fallback -- which is why the whole suite had only
ever seen /project. e2e/12 holds a real container to the same promise,
including that /project, /home/sandbox and a home-volume marker survive a
mirrored run. The "nothing was started" checks now compare the set of
container ids before and after instead of counting every sandbox on the
machine, so a session you have open is not a test failure; the pty cases
fall back to python3 where util-linux's script is not installed.
shellcheck covers both programs, the completion file and the fixtures, so
the completion builds are word-by-word now, and a colon in the project path
is refused with the reason instead of podman's "invalid option type".

558 unit assertions, 719 with e2e; lint and bash -n clean.

LLM-Generated: true

tests/e2e/11_net.sh

@@ -22,7 +22,9 @@ trap 'kill '"$SRV"' 2>/dev/null' EXIT
 sleep 1
 
 t_name "allow mode: enforcement in one run"
-sb $GATE --env AISB_PROBE_HOSTSVC="$HOSTPORT" -- bash /project/egress_probe.sh
+# the probe is a file in the project, reached at whatever path the container mounts it at
+PROJ_DEST="$([[ -n "$(mirror_block_of "$PROJ")" ]] && echo /project || echo "$PROJ")"
+sb $GATE --env AISB_PROBE_HOSTSVC="$HOSTPORT" -- bash "$PROJ_DEST/egress_probe.sh"
 assert_contains "ok_allowed_http=200"      "allowlisted http works (through the gate)"
 assert_contains "ok_allowed_https=200"     "allowlisted https works (CONNECT)"
 assert_contains "ok_gate_denied_domain=403" "a non-allowlisted domain is refused by the gate"

tests/e2e/12_sandbox.sh

@@ -22,17 +22,51 @@ sb $DARK --harness pi -- bash -lc "command -v pi"
 assert_rc 0 "the default pi binary exists in the image"
 
 t_name "the project directory is mounted, writable, and owned by the host user"
-sb $DARK -- bash -c 'pwd; touch /project/from-container.txt; echo wrote'
-assert_contains "/project" "working directory is /project"
+# Where it is mounted depends on the host path; see the mirroring block below, which is
+# the other branch of the same decision.
+DEST="$([[ -n "$(mirror_block_of "$WORK_DIR")" ]] && echo /project || echo "$WORK_DIR")"
+sb $DARK -- bash -c "pwd; touch '$DEST/from-container.txt'; echo wrote"
+assert_contains "$DEST" "working directory is the project mount"
 [[ -f "$WORK_DIR/from-container.txt" ]] && _ok "writes land on the host" || _bad "writes land on the host"
 if [[ "$(stat -c %u "$WORK_DIR/from-container.txt")" == "$(id -u)" ]]; then
   _ok "the file is owned by the host uid, not by root"
 else
   _bad "the file is owned by the host uid" "owner=$(stat -c %u "$WORK_DIR/from-container.txt") expected=$(id -u)"
 fi
-sb $DARK -- bash -c 'cat /project/host-file.txt'
+sb $DARK -- bash -c "cat '$DEST/host-file.txt'"
 assert_contains "hello from the host" "existing project files are readable"
 
+t_name "the container names the directory what the host calls it"
+# The reason for mirroring: pwd, an error message and a harness' window title name *this*
+# project instead of every sandbox alike. Only a real container answers the question --
+# podman decides what a bind hides, and it is the one thing about the arrangement that can
+# go quietly wrong.
+if [[ "$DEST" == "/project" ]]; then
+  assert_contains "cannot mirror" "the fallback is announced rather than silent"
+fi
+mirrorable_dir || true
+if [[ -z "$USER_MIRROR_DIR" ]]; then
+  _ok "no path on this host may be mirrored ($HOME is inside a sandbox?) -- skipped"
+else
+  MD="$USER_MIRROR_DIR"
+  echo "hello from the host" > "$MD/host-file.txt"
+  cd "$MD" || exit 1
+  sb $DARK -- bash -c 'pwd; cat host-file.txt; touch from-container.txt; echo wrote; ls -d /project; test -w /home/sandbox && echo home_writable && echo marked > /home/sandbox/mirror-marker'
+  assert_contains "$MD"  "pwd is the host path, not /project"
+  assert_contains "hello from the host" "the mirrored mount is the project, not an empty directory"
+  assert_contains "wrote" "and it is writable"
+  [[ -f "$MD/from-container.txt" ]] \
+    && _ok "writes land on the host through the mirrored path" || _bad "writes land on the host"
+  assert_absent "cannot mirror" "nothing is announced when the path mirrors"
+  assert_contains "/project" "the image's own /project is still there"
+  assert_contains "home_writable" "the home volume is still mounted at /home/sandbox"
+  # The home volume is the state the next run expects, so check it survived the mirror.
+  sb $DARK -- bash -c 'cat /home/sandbox/mirror-marker 2>&1; ls'
+  assert_contains "marked" "and the marker written through a mirrored run is still there"
+  assert_contains "host-file.txt" "a mirrored run sees its own project, not the previous one"
+  cd "$WORK_DIR" || exit 1
+fi
+
 t_name "nothing else on the host is visible"
 echo secret > "$WORK/not-shared.txt"
 sb $DARK -- bash -c "cat '$WORK/not-shared.txt' 2>&1 || echo NOT_VISIBLE"
@@ -145,12 +179,12 @@ assert_absent "demo-skill" "not even as a directory name"
 # visible at once, which is what a harness that reads both (pi) expects.
 mkdir -p "$WORK_DIR/.agents/skills/project-skill"
 printf 'name: project-skill\ninstructions: project only\n' > "$WORK_DIR/.agents/skills/project-skill/SKILL.md"
-sb $DARK -- bash -c 'cat /project/.agents/skills/project-skill/SKILL.md; ls "$HOME/.agents/skills" | tr "\n" " "'
+sb $DARK -- bash -c "cat '$DEST/.agents/skills/project-skill/SKILL.md'; ls \"\$HOME/.agents/skills\" | tr '\n' ' '"
 assert_contains "project only" "the project's own .agents comes in with the project mount"
 assert_contains "demo-skill" "and the user-level one is still alongside it"
 
 t_name "read-only root filesystem"
-sb $DARK --read-only -- bash -c 'touch /usr/bin/nope 2>/dev/null && echo "BAD: wrote to rootfs" || echo rootfs_locked=ok; touch /project/rw-still-works && echo project_still_writable'
+sb $DARK --read-only -- bash -c "touch /usr/bin/nope 2>/dev/null && echo 'BAD: wrote to rootfs' || echo rootfs_locked=ok; touch '$DEST/rw-still-works' && echo project_still_writable"
 assert_contains "rootfs_locked=ok" "--read-only blocks writes outside mounts"
 assert_contains "project_still_writable" "the project mount stays writable"