HOTFIX: refuse coder project_root that contains .springdrift/

[seamus-brady]

Summary

The auto-wire I added in v0.10.0 (#168 family) defaulted [coder] project_root to cwd when not explicitly set, with the goal of making fresh installs "just work". Springdrift's cwd contains its own .springdrift/ data dir — and when the operator runs the agent from inside its own source repo, the OpenCode container is bind-mounted at /workspace/project over the Springdrift checkout. The coder agent was actively scribbling on the running source code.

This is critical-severity. Hot-fix.

Fix

Two changes to maybe_build_real_coder_deps in src/springdrift.gleam:

1. Drop the cwd fallback. project_root must be explicitly configured under [coder] project_root. When unset, real-coder mode is disabled with a clear startup message pointing the operator at the config option.

2. New project_root_safe/1 guard. Refuses any project_root that:

   • is empty or "."
   • contains a .springdrift/ subdirectory (the load-bearing case — operator pointed the coder at the directory the agent is running in)
   • is itself a .springdrift/ directory

Refusal logs to startup output AND slog with the exact reason so the operator can see what triggered.

What's now impossible

• Coder agent editing the running Springdrift's source code
• Coder agent editing the running agent's .springdrift/ memory / cycle log / identity / planner state
• Coder agent operating on a parent dir of the running data dir (would let it cd in and edit)

What changes for operators

Fresh installs no longer auto-enable real-coder. The startup message now reads:

Coder    : [coder] project_root not set — coder agent disabled. Add it to .springdrift/config.toml and restart to enable. Use a directory that does NOT contain a .springdrift/ subdir (e.g. an empty scratch dir, or a project repo of yours).

Once operators set [coder] project_root = "/path/to/some-project" and that path doesn't contain .springdrift/, the coder activates normally.

Test plan

• gleam build clean
• gleam format clean
• gleam test — 2190 passing
• Run from inside /Users/seamus/Repos/springdrift: confirm the startup message names the missing config and real-coder is disabled
• Set [coder] project_root = "/Users/seamus/Repos/springdrift" explicitly: confirm the guard refuses with the contains-.springdrift/ reason
• Set [coder] project_root = "/Users/seamus/coder-scratch" (a clean dir): confirm real-coder activates normally

🤖 Generated with Claude Code