Declare exportable workspace paths

[jdchawla29]

What changed

• declare the workspace root on the existing filetracking/1 capability
• exclude credential-shaped paths from the existing snapshot manifest

Why

Build introspection already calls setup and then snapshot. The platform builder only needs the declared root and export-safe path set to copy the post-setup workspace from the built image into its immutable S3 prefix.

The SDK does not upload file bytes, add an export path, change hashing semantics, or introduce another transfer protocol.

Validation

• uv run ruff format --check hud/environment/file_tracker.py hud/environment/workspace.py hud/environment/tests/test_capability_backing.py hud/environment/tests/test_file_tracker.py
• uv run ruff check hud/environment/file_tracker.py hud/environment/workspace.py hud/environment/tests/test_capability_backing.py hud/environment/tests/test_file_tracker.py
• uv run pyright hud/environment/file_tracker.py hud/environment/workspace.py
• uv run pytest hud/environment/tests -q — 74 passed

---

Note

Low Risk
Manifest and capability metadata changes only; tightens secret exclusion and adds a declared root path with no auth or RPC behavior changes in this diff.

Overview
Post-setup workspace manifests no longer list credential-shaped paths: FileTracker.current_manifest() skips entries marked redacted, so a snapshot RPC returns only verifiable, non-secret files (paths, sizes, hashes). Secret files remain in the tracker for change detection and redacted diffs, but they are not published as manifest rows.

The filetracking/1 capability now includes the semantic workspace root (resolved POSIX path) in params, alongside setup_diff, so platform builders can locate the tracked tree on the host without inferring it from SSH cwd alone.

Tests lock in an empty manifest when only .env exists at baseline, and expect the served capability params to include root.

^{Reviewed by Cursor Bugbot for commit df3e243. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f71e190308

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 278c80079b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 278c80079b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 82e4d9a438

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8a7e234f65

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8a7e234. Configure here.}