feat(fork): multi-root workspace_roots authorization infrastructure (runtime lanes) on v0.9.12

crates/cli/src/lib.rs

@@ -4991,6 +4991,7 @@ fn run_sandbox_command(command: SandboxCommand) -> Result<()> {
                 path: None,
                 ask_for_approval: ask.into(),
                 sandbox_mode: Some("workspace-write"),
+                workspace_roots: Vec::new(),
             })?;
             println!("{}", serde_json::to_string_pretty(&decision)?);
             Ok(())

crates/command-contract/src/facets.rs

@@ -937,6 +937,29 @@ pub trait CommandSkillGroupContext {
     /// `/restore <N>`: host restores by snapshot id; handler composes the
     /// exact success message from its list entry.
     fn restore_snapshot(&mut self, id: &str) -> Result<(), String>;
+    /// `/restore` rollback scope: true when the session root set has entries
+    /// beyond the primary workspace. Snapshots are primary-bound, so the
+    /// handler must name the boundary instead of implying every accessible
+    /// root was reverted.
+    fn restore_covers_primary_only(&self) -> bool;
     /// `/restore` trust gate posture (yolo / trust_mode).
     fn approval_state(&self) -> CommandApprovalState;
+    /// `/restore` rollback-boundary disclosure text. The default is the
+    /// stable English sentence shared verbatim with the model/API lanes
+    /// ([`ATTACHED_ROOTS_NOT_REVERTED_NOTE`]); hosts with a localized
+    /// human-facing surface (the TUI) override it with their translated
+    /// form so the same disclosure is not English-only on one face
+    /// (round-45 R45-3).
+    fn attached_roots_not_reverted_note(&self) -> String {
+        ATTACHED_ROOTS_NOT_REVERTED_NOTE.to_string()
+    }
 }
+
+/// Honesty clause for revert/undo/restore reports when the session root set
+/// extends beyond the primary workspace: the snapshot side-repo is rooted at
+/// the primary, so a restore rolls back only the primary while attached-root
+/// writes persist. Owned here (single source) so the portable `/restore`
+/// handler and the host's model/API lanes can never drift; the TUI re-exports
+/// it from `crate::snapshot` and layers the localized form on top.
+pub const ATTACHED_ROOTS_NOT_REVERTED_NOTE: &str =
+    "Only the primary workspace was reverted; attached workspace roots were not rolled back.";

crates/command-contract/src/tests.rs

@@ -1492,6 +1492,10 @@ impl CommandSkillGroupContext for FakeSkillGroup {
         }
     }
 
+    fn restore_covers_primary_only(&self) -> bool {
+        false
+    }
+
     fn approval_state(&self) -> CommandApprovalState {
         self.approval
     }

crates/config/src/tests.rs

@@ -722,6 +722,7 @@ fn config_store_exec_policy_engine_uses_sibling_permissions() {
             path: None,
             ask_for_approval: codewhale_execpolicy::AskForApproval::UnlessTrusted,
             sandbox_mode: Some("workspace-write"),
+            workspace_roots: Vec::new(),
         })
         .expect("policy check");
 
@@ -854,6 +855,7 @@ fn config_store_appends_exact_workspace_allow_rules() {
             path: None,
             ask_for_approval: codewhale_execpolicy::AskForApproval::OnRequest,
             sandbox_mode: Some("workspace-write"),
+            workspace_roots: Vec::new(),
         })
         .expect("check exact grant");
     assert_eq!(
@@ -871,6 +873,7 @@ fn config_store_appends_exact_workspace_allow_rules() {
             path: None,
             ask_for_approval: codewhale_execpolicy::AskForApproval::OnRequest,
             sandbox_mode: Some("workspace-write"),
+            workspace_roots: Vec::new(),
         })
         .expect("check extra args");
     assert!(extra_args.requires_approval);