Struct BoundEnvironment 

pub struct BoundEnvironment {
    pub substrate: Arc<dyn Substrate>,
    pub root: PathBuf,
    pub tier: PermissionTier,
    pub description: String,
    pub sandboxed: bool,
    pub fallback_notice: Option<String>,
    pub mount: Option<WorkspaceMount>,
    pub project_car_dir: Option<PathBuf>,
    pub clamp_reads: bool,
}

The bound environment plus the safety metadata the caller needs to render a system prompt and set up gating.

Fields

substrate: Arc<dyn Substrate>

The execution substrate the runtime binds (sandbox or local host).

root: PathBuf

The working-directory root (shell cwd on the local path; the clamp boundary for local file writes).

tier: PermissionTier

Standing permission tier granted to the session. In the sandbox the container is the boundary, so file/shell edits auto-allow (SandboxEdit); on the local host the default is ReadOnly so writes/shell need approval. --full-access lifts either to FullAccess.

description: String

One-line environment description for the system prompt.

sandboxed: bool

Whether execution is isolated in a container.

fallback_notice: Option<String>

If the sandbox was requested but unavailable, the actionable reason we fell back to the local host (Docker missing/stopped, image not pulled).

mount: Option<WorkspaceMount>

The bind mount, when it is WIDER than Self::root: the git repository root a session standing in a subdirectory was widened to (car#1269). None when the mount is root itself, and on every local run.

Separate from root because the two answer different questions — what the container can reach, versus where it stands and where host-side tools write.

Reported rather than assumed, because the widening is READ-WRITE and not a small thing. In the sandbox the mount is the only path boundary (the host-side clamp is off precisely because the container is the boundary), so widening it grants writes to every sibling directory the operator excluded by standing in a subdirectory — and to .git itself, where config and hooks/ execute on the HOST the next time the operator runs git there. That is the trade being made to give the session real history; it is not “no more than what git already reads”, and every surface that describes the bound posture has to be able to say so.

project_car_dir: Option<PathBuf>

The project .car/ directory governing this run, found by walking up from Self::root to the git worktree root (car#1288).

None when there is none, or when the run is not in a repository — there is no boundary to stop an upward search at, and the first .car above an arbitrary directory is likely CAR’s own state root.

Callers must use this rather than root.join(".car"): that form is why a .car/ at a repository root governed only runs started from that exact directory.

clamp_reads: bool

Pin the READ tools inside Self::root too, not just the writes.

false everywhere bind_default_substrate returns: the general assistant is allowed to read the wider filesystem. The coder.discuss surface sets it true after binding, because a conversation grounded in one repo has no business reading outside it — and its tool output streams to every subscriber, so an open read is an exfiltration path.