Agent Context Gets Filesystem Boundaries

Reporter Notes

The interesting movement is not "agents have memory." It is that the runtime

now has to distinguish global user preference files, project-specific context,

sandbox cwd values, memory prompt registration, and project copy directories.

Those objects carry different risk and lifetime assumptions.

The most reader-friendly version is: context has a border. Builders need to

know which side of the border an instruction, path, or project copy came from.

Reporter Notes

This article groups independent patches around one operating pressure: agent

runtimes need to know whether context came from the user, the project, a

sandboxed working directory, a registered memory prompt, or a project copy.

Primary Evidence

• Crush commit "feat(config): load user-level context files": https://github.com/charmbracelet/crush/commit/6242e4f47743190fe60a27ba881ba3d6a9b36deb
  • Evidence used: adds default global context paths, separates global context

files from project context files in prompt data, and documents

global_context_paths.

• OpenAI Codex commit "sandboxing: migrate cwd inputs to PathUri": https://github.com/openai/codex/commit/52a50aec709d1934522d7ebdd9ceb4dc75c198f9
  • Evidence used: carries sandbox cwd values as URI semantics until validation

and extends sandbox, protocol, and runtime tests.

• OpenClaw commit "fix(codex): preserve memory prompt registration": https://github.com/openclaw/openclaw/commit/7387083a9574a0b7a79579790f09e0f3510fda36
  • Evidence used: preserves memory prompt registration in the Codex runtime

plugin and adds tests around runtime plugin behavior.

• OpenCode commit "feat(core): refactor project copies for v2": https://github.com/anomalyco/opencode/commit/c2e6b1807d1e17c7ac0f019b2b1e270065a6d996
  • Evidence used: adds project directory strategy and project-copy handling

surfaces with database, server, TUI, and test changes.

Evidence Limits

• These are independent changes, not a coordinated standard.
• The Crush commit concerns configured context-file loading, not all memory.
• The Codex commit is path and sandbox transport groundwork, not a complete

policy for every file access.

• The OpenClaw and OpenCode commits support the broader context-boundary arc

but do not prove the same implementation choice as Crush or Codex.