workspace-identity git:20261004.4bb7222A

Immutable. This exact content never changes and is served at /api/v1/blob/f2846e10e0f29ad4.

---
description: Canonical workspace identity across ownership and trust boundaries
globs:
  - "internal/session/**/*.go"
  - "internal/remote/**/*.go"
  - "internal/mcp/**/*.go"
  - "internal/subagents/**/*.go"
  - "internal/hooks/**/*.go"
  - "internal/skills/**/*.go"
  - "external/httpserver/**/*.go"
alwaysApply: false
---
# Workspace identity

- Compare workspace ownership, filtering, trust, and cache identity through `SameWorkspacePath` or the canonical form, never raw strings.
- Account for symlinks, `/tmp` versus `/private/tmp`, and case-insensitive Windows and macOS paths.
- Keep the logical path for display and the canonical key for identity.
- Remote adapters forward workspace filters.