Function in_session_scratchpad 

pub fn in_session_scratchpad(path: &str) -> bool

Whether path lies inside THIS session’s scratchpad — the harness’s own per-session working directory (e.g. Claude Code’s /private/tmp/claude-<uid>/<project-slug>/<session-id>/scratchpad).

The anchor is the session id as a whole path component, not the surrounding layout. That is deliberate and is what makes this safe and durable:

• Unforgeable. The session id arrives in the harness’s own hook envelope, never from the agent’s shell. An attacker cannot pre-plant /tmp/<this-session-id>/evil.sh because the id is unknown until the session exists (and it is unique per session). Compare a layout pattern (“anything under /tmp/claude-*”), which anyone can create.
• Durable. It survives the harness reorganizing the parts around the id — the uid suffix, the slug, /tmp vs /private/tmp, the trailing directory name. Those are internal details (Claude Code does not document or expose the scratchpad path, and declined to; see docs/design/agent-scratchpad.md), so matching them exactly would be brittle.
• Fail-closed. No session id, or a path that does not contain it, simply does not match: the path keeps its ordinary classification (/tmp → temp, i.e. foreign). A harness that supplies no id, or whose scratchpad omits it, is exactly as restricted as before — never worse.

Requiring a TEMP-root prefix as well keeps the id from blessing something outside the scratch area on a harness that happens to embed the id elsewhere (a log path under $HOME, say).