Module workdir_guard 

Confirming a workdir that is somewhere an agent probably should not write.

lev run’s workdir defaults to wherever it was invoked, and running from a home directory is an easy accident. Issue #252 is a machine that lost 115 GB to an agent writing under a profile root; the agent was doing what it was told, in the directory it was given.

So this asks - once, and only about the two shapes that are alarming:

• a home directory (~, /home/x, /Users/x, C:\Users\x), where an agent’s writes land among everything the user owns, and
• a filesystem root (/, C:\), where they land among everything.

Anything else - a project directory, a scratch dir, a repo checkout - passes without a word. This is deliberately not an allowlist that must be populated before leviath is usable: a tool that asks about everything trains people to say yes to everything, which is the failure mode it would be trying to stop.

With no terminal to ask on - CI, a pipe, --yolo - the run proceeds with a warning rather than being refused; breaking every unattended caller to enforce a prompt would trade one failure mode for a worse one.

The decision is a pure function over paths (assess) so it can be tested without a filesystem or a terminal; asking the question is the caller’s.

Enums

WorkdirConcern

Why a workdir was questioned. Separate from the message so the caller can render it as a prompt, a refusal, or a log line without re-deriving it.

WorkdirVerdict

What to do about a run’s workdir.

Functions

assess

Decide whether workdir needs confirming.

check

The whole check, for lev run: assess, then ask or warn.

confirm_core

Put the question on screen and wait for an answer.

non_interactive_warning

What to warn when there is no terminal to ask on.