Add per-session workspace sandbox

.gitignore

@@ -6,6 +6,12 @@ out/
 .next/
 coverage/
 *.tsbuildinfo
+
+# Monet local development runtime state
+apps/controller/.monet-dev/
+apps/controller/session-workspaces/
+session-workspaces/
+
 apps/controller/sqlite/*.db
 apps/controller/sqlite/*.db-shm
 apps/controller/sqlite/*.db-wal

README.md

@@ -64,6 +64,14 @@ From the repository root:
 - Desktop packaging is configured in `apps/desktop/package.json`: Electron Builder packages `apps/desktop/dist`, bundles controller, renderer, and migration assets into `app.asar`, runs native dependency alignment via `electron-builder install-app-deps`, and flips Electron fuses for packaged builds.
 - Managed desktop launches pin SQLite to `app.getPath('userData')/sqlite/monet.db`; on POSIX hosts Monet best-effort chmods the database directory to `0700` and the database, WAL, and SHM files to `0600`.
 
+## Session Workspaces and File Tools
+
+- Each session has a dedicated workspace for files the agent creates or reads during that chat. In desktop builds the workspace base is under the app user-data directory; local controller-only development falls back to `session-workspaces/` under the controller working directory unless `MONET_SESSION_WORKSPACE_DIR` or `MONET_USER_DATA_DIR` is set.
+- Relative `read_file` and `write_file` paths now resolve inside the current session workspace. For example, `write_file("hello.html")` writes to that session's workspace, not the repository root, controller `cwd`, home directory, or the first authorized directory.
+- Writes inside the current session workspace do not require confirmation. Reads and writes outside the workspace are denied unless the target is inside an authorized directory; authorized-directory writes still require confirmation.
+- Existing sessions are migration-compatible: they do not need pre-created workspace records. Monet derives a stable workspace path from the existing session ID and creates the directory lazily the first time a file operation or “Open workspace folder” action needs it.
+- Existing persisted authorized directories and `MONET_TOOL_ALLOWED_DIRECTORIES` remain supported for real user/project files. The unsafe historical fallback that treated `process.cwd()` as authorized by default has been removed, so external access must come from persisted settings or environment configuration.
+
 ## Release Notes
 
 - macOS signing/notarization settings live in `apps/desktop/package.json` and use entitlements from `apps/desktop/resources/`.

apps/controller/openapi.json

@@ -227,6 +227,13 @@
           {
             "type": "object",
             "properties": {
+              "workspacePath": {
+                "type": [
+                  "string",
+                  "null"
+                ],
+                "example": "/Users/example/Library/Application Support/Monet/session-workspaces/ses_abc123/workspace"
+              },
               "messages": {
                 "type": "array",
                 "items": {
@@ -235,6 +242,7 @@
               }
             },
             "required": [
+              "workspacePath",
               "messages"
             ]
           }
@@ -264,6 +272,26 @@
           "session"
         ]
       },
+      "OpenWorkspaceDirectoryResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean",
+            "enum": [
+              true
+            ],
+            "example": true
+          },
+          "workspacePath": {
+            "type": "string",
+            "example": "/Users/example/Library/Application Support/Monet/session-workspaces/ses_abc123/workspace"
+          }
+        },
+        "required": [
+          "ok",
+          "workspacePath"
+        ]
+      },
       "Provider": {
         "type": "object",
         "properties": {
@@ -970,6 +998,49 @@
             }
           }
         }
+      },
+      "delete": {
+        "tags": [
+          "Sessions"
+        ],
+        "summary": "Delete session",
+        "description": "Deletes a session and recursively removes its session workspace.",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "example": "ses_123"
+            },
+            "required": true,
+            "name": "sessionId",
+            "in": "path"
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Session deleted successfully."
+          },
+          "404": {
+            "description": "The requested session was not found.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "The session could not be deleted.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        }
       }
     },
     "/api/sessions/{sessionId}/archive": {
@@ -1024,6 +1095,58 @@
         }
       }
     },
+    "/api/sessions/{sessionId}/workspace/open": {
+      "post": {
+        "tags": [
+          "Sessions"
+        ],
+        "summary": "Open session workspace directory",
+        "description": "Validates the session, derives its workspace path server-side, and ensures the workspace directory exists before desktop opening.",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "example": "ses_123"
+            },
+            "required": true,
+            "name": "sessionId",
+            "in": "path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Session workspace directory is ready to open.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OpenWorkspaceDirectoryResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "The requested session was not found.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "The session workspace directory could not be prepared.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/api/providers": {
       "get": {
         "tags": [

apps/controller/scripts/generate-openapi.ts

@@ -28,7 +28,8 @@ async function main() {
       defaultModel: "openai/gpt-4.1-mini",
       timeoutMs: null
     },
-    port: 42831
+    port: 42831,
+    sessionWorkspaceBaseDirectory: "/tmp/monet-openapi-session-workspaces"
   });
   const document = app.getOpenAPI31Document({
     openapi: "3.1.0",