fix: run local user commands in a dedicated workspace (closes the 2026-07-27 wipe mechanism)

Dockerfile

@@ -9,6 +9,14 @@ RUN pip install --no-cache-dir .
 # Copy application source
 COPY src/ src/
 COPY ui/ ui/
+
+# Working directory for local user commands (tools.local_working_dir).
+# Deliberately OUTSIDE the install root (/app here) and outside the data dir:
+# local commands run here so a bare relative path — e.g. cleaning up after
+# extracting an archive whose internal layout starts with data/ — cannot
+# resolve against the live install. Validation fails closed if it is missing
+# or not 0700, so this must exist in the image.
+RUN mkdir -p /var/lib/odin-workspace && chmod 0700 /var/lib/odin-workspace
 COPY config.yml .
 
 CMD ["python", "-m", "src"]

README.md

@@ -117,6 +117,17 @@ playwright install chromium          # optional — enables browser_* tools
 
 cp .env.example .env                 # set DISCORD_TOKEN
 $EDITOR config.yml                   # hosts, LLM, permissions
+
+# Local commands run in a workspace OUTSIDE the install, so a bare relative
+# path (e.g. cleaning up after extracting an archive whose internal layout
+# starts with `data/`) can never resolve against your live data. It must
+# exist, be private, and be owned by you — validation fails closed rather
+# than silently falling back to the install directory.
+sudo install -d -m 0700 -o "$USER" -g "$(id -gn)" /var/lib/odin-workspace
+# …or point `tools.local_working_dir` in config.yml at any private directory
+# outside the checkout, e.g.:
+#   mkdir -p -m 0700 ~/.local/share/odin-workspace
+
 python -m src
 ```
 

config.yml

@@ -92,6 +92,15 @@ sessions:
 
 tools:
   enabled: true
+  # Working directory for local user commands (run_command, run_script,
+  # run_command_multi, background processes, skill run_on_host). A bare
+  # relative path in a command resolves HERE, not in the install directory —
+  # which is what stopped an extracted archive's `rm -rf data` from deleting
+  # Odin's own live state. Must be an absolute path, owned by the service
+  # account, mode 0700, and outside the install and data directories.
+  # Provisioned automatically on start; if it is unusable, local commands
+  # refuse to run rather than falling back to the install directory.
+  local_working_dir: /var/lib/odin-workspace
   # Customize SSH key path for your deployment
   ssh_key_path: /app/.ssh/id_ed25519
   # Customize SSH known hosts path for your deployment

docker-compose.yml

@@ -10,6 +10,11 @@ services:
     volumes:
       - ./config.yml:/app/config.yml:ro
       - ./data:/app/data
+      # NAMED volume, not a bind mount: Docker initializes a named volume from
+      # the image directory, preserving the 0700 ownership the resolver
+      # requires. A fresh bind mount is created 755 root:root, which fails
+      # closed and costs local-command capability on first run (PR #239 r2).
+      - odin-workspace:/var/lib/odin-workspace
       - ./data/context:/app/data/context:ro
       - ./ssh:/app/.ssh:ro
     extra_hosts:
@@ -57,3 +62,8 @@ services:
               capabilities: [gpu]
     networks:
       - default
+
+volumes:
+  # Local command workspace (tools.local_working_dir). Initialized from the
+  # image's 0700 directory so a fresh deployment satisfies the resolver.
+  odin-workspace:

packaging/odin.service

@@ -9,6 +9,15 @@ Type=simple
 User=odin
 Group=odin
 WorkingDirectory=/opt/odin
+# Local command workspace (tools.local_working_dir). systemd creates
+# /var/lib/odin-workspace on EVERY start, owned by User= with mode 0700, so
+# fresh installs, package upgrades, and restarts after a self-update all get a
+# valid workspace with no manual step. Local commands run there instead of the
+# install directory, so a bare relative path — e.g. cleaning up after
+# extracting an archive whose internal layout starts with data/ — cannot
+# resolve against live data.
+StateDirectory=odin-workspace
+StateDirectoryMode=0700
 ExecStart=/opt/odin/.venv/bin/python -m src
 EnvironmentFile=/etc/odin/.env
 Restart=always

packaging/postinstall.sh

@@ -14,6 +14,10 @@ SERVICE_GROUP="odin"
 APP_DIR="/opt/odin"
 CONFIG_DIR="/etc/odin"
 DATA_DIR="/var/lib/odin"
+# Working directory for local user commands (tools.local_working_dir).
+# A SIBLING of DATA_DIR, never inside it: local commands run here so a bare
+# relative path cannot resolve against the install or the live data.
+WORKSPACE_DIR="/var/lib/odin-workspace"
 LOG_DIR="/var/log/odin"
 WEB_PORT="3000"  # matches config.yml default web.port
 
@@ -34,6 +38,7 @@ fi
 mkdir -p "$CONFIG_DIR"
 mkdir -p "$DATA_DIR"/{sessions,context,skills,search,knowledge,trajectories}
 mkdir -p "$LOG_DIR"
+mkdir -p "$WORKSPACE_DIR"
 
 # Enable passwordless sudo for the odin user (Odin runs privileged host
 # operations; scope this down in /etc/sudoers.d/99-odin-passwordless if you
@@ -99,6 +104,11 @@ fi
 
 # Set ownership and permissions
 chown -R "$SERVICE_USER:$SERVICE_GROUP" "$APP_DIR" "$DATA_DIR" "$LOG_DIR"
+# Odin refuses to run local commands unless this is 0700 and owned by the
+# service account — validation fails closed rather than falling back to the
+# install directory, which is what allowed the 2026-07-27 data wipe.
+chown "$SERVICE_USER:$SERVICE_GROUP" "$WORKSPACE_DIR"
+chmod 0700 "$WORKSPACE_DIR"
 chown -R "$SERVICE_USER:$SERVICE_GROUP" "$CONFIG_DIR"
 chmod 600 "$CONFIG_DIR/.env"
 chown root:root /usr/lib/systemd/system/odin.service

scripts/incus-deploy.sh

@@ -71,6 +71,12 @@ incus exec "$INSTANCE" -- bash -c "
     id odin &>/dev/null || useradd -m -s /bin/bash odin
     mkdir -p /app/src /app/data/context /app/data/sessions /app/data/logs \
              /app/data/usage /app/data/skills /app/data/chromadb /app/.ssh
+    # Local command workspace (tools.local_working_dir). OUTSIDE /app so a bare
+    # relative path in a command cannot resolve against the install or its data.
+    # The unprivileged odin user cannot create it under /var/lib itself.
+    mkdir -p /var/lib/odin-workspace
+    chown odin:odin /var/lib/odin-workspace
+    chmod 0700 /var/lib/odin-workspace
     chown -R odin:odin /app
     chmod 700 /app/.ssh
 "
@@ -118,6 +124,8 @@ After=network.target
 Type=simple
 User=odin
 WorkingDirectory=/app
+StateDirectory=odin-workspace
+StateDirectoryMode=0700
 EnvironmentFile=/app/.env
 ExecStart=/usr/bin/python3 -m src
 Restart=on-failure

src/__main__.py

@@ -32,6 +32,11 @@ def _wire_observability(health, bot, log) -> None:
     tool_executor = getattr(bot, "tool_executor", None)
     if tool_executor is not None and hasattr(tool_executor, "get_metrics"):
         metrics.register_source("tools", tool_executor.get_metrics)
+    if tool_executor is not None and hasattr(tool_executor, "get_workspace_metrics"):
+        # Paired with the deliberate absence of auto-pruning: growth in the
+        # local command workspace must be alertable rather than silently
+        # unbounded (PR #239 round-2 review).
+        metrics.register_source("workspace", tool_executor.get_workspace_metrics)
 
     cost_tracker = getattr(bot, "cost_tracker", None)
     if cost_tracker is not None and hasattr(cost_tracker, "get_prometheus_metrics"):
@@ -108,6 +113,57 @@ def main() -> None:
     log = get_logger("main")
     log.info("Starting Odin")
 
+    # STARTUP MIGRATION — must run after the real configuration is loaded and
+    # before any command service begins.
+    #
+    # Local user commands run in a validated workspace outside the install and
+    # refuse to run without one. A preflight in the self-updater cannot
+    # bootstrap that: the update which INTRODUCES the preflight is executed by
+    # the previous release's handler, which has none, so the very first upgrade
+    # would re-exec into code whose workspace was never created (PR #239
+    # round-5 review, verified against a live install). Provisioning here runs
+    # in the NEW code on the restart that follows any update, however the
+    # update arrived.
+    #
+    # Failure is logged, not fatal: an unusable workspace must not prevent
+    # Odin from starting and answering on Discord. Local commands then fail
+    # closed individually, with the same actionable error.
+    try:
+        from src.tools.workspace import (
+            WorkspaceError,
+            provision_startup_workspace,
+            provisioning_hint,
+        )
+
+        def _warn_fallback(path, configured, reason) -> None:
+            # A fallback is not a failure, but it must never look like normal
+            # operation: on a packaged install it means the packaged default
+            # could not be provisioned, which the operator needs to know
+            # (cross-review of PR #239 round 13).
+            log.warning(
+                "Local command workspace fell back to %s — the configured "
+                "default could not be provisioned (%s). Local commands work, "
+                "but this indicates a packaging or permissions problem. %s",
+                path,
+                reason,
+                provisioning_hint(configured),
+            )
+
+        workspace = provision_startup_workspace(
+            config.tools,
+            protected_roots=_command_protected_roots(config),
+            on_fallback=_warn_fallback,
+        )
+        log.info("Local command workspace ready: %s", workspace)
+    except WorkspaceError as exc:
+        log.error(
+            "Local command workspace unusable — local commands will refuse to run: %s. %s",
+            exc,
+            provisioning_hint(config.tools.local_working_dir),
+        )
+    except Exception as exc:  # never block startup on provisioning
+        log.error("Local command workspace provisioning failed unexpectedly: %s", exc)
+
     health = HealthServer(
         port=config.web.port,
         webhook_config=config.webhook,
@@ -273,5 +329,31 @@ async def shutdown() -> None:
         sys.exit(exit_code)
 
 
+def _command_protected_roots(config) -> list[str]:
+    """Install root plus canonical live-data roots for the startup migration.
+
+    Delegates to the ONE shared derivation so startup, the self-update
+    preflight, and the executor protect exactly the same directories. Deriving
+    them separately here silently protected nothing (``Config`` has no
+    ``memory`` section) while the executor protected live memory.json — so a
+    workspace beside it was provisioned at startup and then refused on every
+    command (PR #239 round-6 review).
+
+    The FULL config is passed so every independently relocatable live-state
+    path is covered. ``memory_path`` is left at its default: production wiring
+    hardcodes that path, and startup runs before wiring exists.
+    """
+    from src.tools.workspace import command_protected_roots
+
+    return command_protected_roots(Path(__file__).absolute().parents[1], config)
+
+
+# The entrypoint guard MUST stay the last statement in this module. Python
+# executes a module top-to-bottom, so a guard placed above a helper runs main()
+# before that helper's `def` is reached: the startup migration raised NameError
+# and its own nonfatal handler swallowed it, leaving the workspace uncreated and
+# resurrecting the first-update bootstrap failure this migration exists to fix
+# (PR #239 round-6 review). tests/test_local_workspace.py executes `python -m src`
+# for real to keep this honest.
 if __name__ == "__main__":
     main()

src/config/schema.py

@@ -187,6 +187,12 @@ class GovernorConfig(BaseModel):
     host_overrides: dict[str, str] = Field(default_factory=dict)
 
 
+# The default local command workspace, spelled ONCE: the field default, the
+# blank-value normalizer, the tracked config.yml template and the packaging
+# scripts must never drift apart.
+DEFAULT_LOCAL_WORKING_DIR = "/var/lib/odin-workspace"
+
+
 class ToolsConfig(BaseModel):
     enabled: bool = True
     governor: GovernorConfig = GovernorConfig()
@@ -217,6 +223,45 @@ class ToolsConfig(BaseModel):
     # Loops typically need more budget for exploration + execution + verify + commit.
     max_tool_iterations_chat: int = 500
     max_tool_iterations_loop: int = 500
+    # Working directory for USER-COMMAND local execution (run_command,
+    # run_script, manage_process). Before this existed, those subprocesses
+    # inherited systemd's WorkingDirectory=/opt/odin, so a bare relative path
+    # in a command resolved against the live install — on 2026-07-27 an AE2 jar
+    # whose internal layout is `data/` was extracted and cleaned up with
+    # `rm -rf data`, which deleted /opt/odin/data.
+    #
+    # Deliberately a SIBLING of /var/lib/odin, not a child: packaged installs
+    # use /var/lib/odin as the live data directory behind /opt/odin/data.
+    # Not /tmp or /var/tmp (tmpfiles policy can age those out) and not $HOME
+    # (packaged Odin declares /opt/odin as the service account's home).
+    #
+    # Stable and persistent BY DESIGN: a fresh directory per command would
+    # break two-step workflows that write a relative file in one command and
+    # read it in the next, which would cost capability. Restart-required, not
+    # hot-reloadable — swapping workspaces at runtime would break exactly the
+    # cross-command continuity this preserves.
+    local_working_dir: str = DEFAULT_LOCAL_WORKING_DIR
+
+    @field_validator("local_working_dir")
+    @classmethod
+    def _workspace_blank_means_default(cls, v):
+        """Blank or whitespace-only normalizes to the default, here at the
+        boundary, so every consumer sees the same value.
+
+        The field accepts free strings and can be blanked through
+        PUT /api/config. Left un-normalized, the self-update preflight
+        substituted the default and approved, while the restarted process
+        loaded the blank value and failed closed on every local command —
+        preflight and runtime disagreeing about the very path being validated
+        (PR #239 round-7 review, reproduced).
+
+        Normalizing rather than rejecting keeps the update seamless: a blanked
+        value costs no capability and cannot brick startup, which a hard
+        validation error on a persisted config would.
+        """
+        if not isinstance(v, str) or not v.strip():
+            return DEFAULT_LOCAL_WORKING_DIR
+        return v.strip()
 
     @field_validator("command_timeout_seconds")
     @classmethod
@@ -866,6 +911,18 @@ def replacer(match: re.Match) -> str:
 # (a test or one-off script that never called load_config) cannot silently
 # overwrite a real deployment's config.yml from the wrong working directory.
 _ACTIVE_CONFIG_PATH: Path | None = None
+# The path AS GIVEN (absolutized, symlinks intact). restart.reexec() replays
+# sys.argv, so an alias like /etc/odin/config.yml -> /srv/real/odin.yml is what
+# the restarted process opens — protecting only the canonical target would let
+# a relative command delete the alias and break the next restart (PR #239
+# round-10 review, reproduced).
+_LAUNCH_CONFIG_PATH: Path | None = None
+
+
+def active_config_launch_path() -> Path | None:
+    """The config path as given on the command line, absolutized but with
+    symlinks intact — what ``restart.reexec()`` will hand the next process."""
+    return _LAUNCH_CONFIG_PATH
 
 
 def active_config_path() -> Path | None:
@@ -878,8 +935,9 @@ def set_active_config_path(path: str | Path | None) -> None:
     """Record (or clear) the active config path. ``load_config`` calls this on a
     successful load; tests/tools that persist a hand-built Config point it at
     their own file."""
-    global _ACTIVE_CONFIG_PATH
+    global _ACTIVE_CONFIG_PATH, _LAUNCH_CONFIG_PATH
     _ACTIVE_CONFIG_PATH = Path(path).resolve() if path is not None else None
+    _LAUNCH_CONFIG_PATH = Path(os.path.abspath(path)) if path is not None else None
 
 
 def load_config(path: str | Path = "config.yml") -> Config:

src/discord/wiring.py

@@ -46,6 +46,7 @@
 from ..sessions import SessionManager
 from ..tools import SkillManager, ToolExecutor
 from ..tools.autonomous_loop import LoopManager
+from ..tools.workspace import DEFAULT_MEMORY_PATH
 from ..trajectories.saver import TrajectorySaver
 from .channel_config import ChannelConfigManager
 from .channel_logger import ChannelLogger
@@ -206,7 +207,10 @@ def build_services(config: Config) -> BotServices:  # noqa: PLR0915 — linear c
     )
     sessions.load()
 
-    memory_path = "./data/memory.json"
+    # Imported, not re-spelled: the startup migration and the self-update
+    # preflight protect this file before/without wiring, and three
+    # independent spellings is how they fell out of sync (PR #239 round 6).
+    memory_path = DEFAULT_MEMORY_PATH
     channel_config = ChannelConfigManager("./data/channel_config.json")
 
     # Passive channel logger — writes ALL guild messages to JSONL (zero LLM tokens)
@@ -257,6 +261,9 @@ def build_services(config: Config) -> BotServices:  # noqa: PLR0915 — linear c
     tool_executor = ToolExecutor(
         config.tools,
         memory_path=memory_path,
+        # Full config so the workspace's protected roots cover every relocatable
+        # live-state path, not just the ones ToolsConfig declares.
+        app_config=config,
         browser_manager=browser_manager,
         output_streamer=output_streamer,
         host_access_manager=host_access_manager,

src/health/metrics.py

@@ -118,6 +118,38 @@ def render(self) -> str:
             except Exception:
                 pass
 
+        # -- Local command workspace (no auto-prune, so growth is observable) --
+        ws_source = self._sources.get("workspace")
+        if ws_source:
+            try:
+                ws = ws_source() or {}
+                if ws:
+                    gauges = {
+                        "bytes": (
+                            "odin_workspace_bytes",
+                            "Bytes stored in the local command workspace",
+                        ),
+                        "files": (
+                            "odin_workspace_files",
+                            "Files in the local command workspace",
+                        ),
+                        "free_bytes": (
+                            "odin_workspace_free_bytes",
+                            "Free bytes on the workspace filesystem",
+                        ),
+                        "free_inodes": (
+                            "odin_workspace_free_inodes",
+                            "Free inodes on the workspace filesystem",
+                        ),
+                    }
+                    for key, (name, helptext) in gauges.items():
+                        if key in ws:
+                            sections.append(f"# HELP {name} {helptext}")
+                            sections.append(f"# TYPE {name} gauge")
+                            sections.append(_format_metric(name, ws[key], include_header=False))
+            except Exception:
+                pass
+
         # -- Tool execution metrics --
         tool_source = self._sources.get("tools")
         if tool_source: