typebasedio
37a1c69e26
Root cause: CTASK_WORKSPACE env var only exists inside the child session spawned by ctask resume. A separate terminal window does not inherit it, so the env-var check was bypassed entirely. os.RemoveAll then deleted all accessible files while the root dir was locked by the active cmd.exe process. Fix: Add a second protection check for .ctask/manifest-start.json, which is only present during a live session. Both checks run before any mutation (summary scan, confirmation, or deletion). Either check triggers immediate refusal. Tests: 4 new tests covering manifest-based protection, no-file-mutation on refusal, env-var protection, and normal deletion of inactive workspaces. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>