Enforce session workspace boundaries

tests/test_python_exec_tool.py

@@ -51,6 +51,26 @@ class PythonExecToolTests(TestCase):
         self.assertIn(str(scratchpad), result.content)
         self.assertEqual(result.metadata.get('scratchpad_directory'), str(scratchpad))
 
+    def test_python_exec_runs_from_session_scratchpad(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp_dir:
+            root = Path(tmp_dir)
+            scratchpad = (root / 'session' / 'scratchpad').resolve()
+            scratchpad.mkdir(parents=True)
+            config = AgentRuntimeConfig(
+                cwd=root,
+                permissions=AgentPermissions(allow_shell_commands=True),
+            )
+            context = build_tool_context(config, scratchpad_directory=scratchpad)
+            result = execute_tool(
+                default_tool_registry(),
+                'python_exec',
+                {'code': 'import os\nprint(os.getcwd())'},
+                context,
+            )
+
+        self.assertTrue(result.ok)
+        self.assertIn(str(scratchpad), result.content)
+
     def test_python_exec_prefers_user_python_env(self) -> None:
         with tempfile.TemporaryDirectory() as tmp_dir:
             root = Path(tmp_dir)