Enum DisplayPolicy 

pub enum DisplayPolicy {
    WorkspaceAlias,
    BackendNative,
}

How MountFs presents primary-workspace paths to the model, narration, prompts, and persisted output pointers.

Why this is a policy seam and not a hardcoded rule

/workspace plays two independent roles in MountFs, and they must not be conflated:

1. Routing / cwd — the model addresses files at /workspace/... and relative paths resolve there. This is a runtime mechanism: it is the same for every embedder (models are trained on cloud-agent layouts), so it stays hardcoded as WORKSPACE_MOUNT.
2. Display presentation — the path string shown to the model, emitted in tool narration, and persisted in output pointers. This is policy, and it legitimately differs per embedder. That is what this enum selects.

History (do not re-collapse these two roles)

• PR #2776 made MountFs present /workspace unconditionally, deleting the old delegation to backend.display_path(...). The motivation was real: a mounted real-disk server session leaked the host checkout path (/private/var/.../checkout/src/lib.rs) to the model and into persisted, agent-visible output — a host-disclosure issue (threat model TM-FS). In a multi-tenant server the host is infrastructure the model must not see, so WorkspaceAlias is the correct, safe default.
• But #2776 baked that policy into the mechanism, in shared everruns-core. That broke local single-user embedders (e.g. the yolop coding CLI, PR #258 “expose real workspace paths”), where the “host” is the user’s own machine. There, showing /Users/me/proj/src/lib.rs is not a disclosure — it is the desired behavior: paths are clickable and match what bash pwd prints. Such embedders still need MountFs for routing (relative resolution, the default cwd, extra mounts), so they cannot simply drop it; they need presentation to be overridable.

The resolution: keep the safe alias as the default so no server code changes and #2776’s security property is preserved, but expose BackendNative so a local embedder can opt back into its backend’s real identity. The runtime no longer hardcodes presentation — it defaults it, and lets the embedder decide. See specs/file-store.md (EVE-660, “Display policy”).

Variants

WorkspaceAlias

Present primary paths under the stable, host-agnostic /workspace namespace, regardless of what the backend physically is. The default; required for multi-tenant/server hosts so host paths never reach the model or persisted output.

BackendNative

Delegate presentation of primary paths to the backend, exposing its native identity (real host paths for a real-disk store). For local, single-user embedders where the host is the user’s own machine and real paths are the intended, useful output.

Trait Implementations

impl Clone for DisplayPolicy

fn clone(&self) -> DisplayPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for DisplayPolicy

impl Debug for DisplayPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for DisplayPolicy

fn default() -> DisplayPolicy

Returns the “default value” for a type.

impl Eq for DisplayPolicy

impl PartialEq for DisplayPolicy

fn eq(&self, other: &DisplayPolicy) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for DisplayPolicy