Root cause: CTASK_WORKSPACE env var only exists inside the child session spawned
by ctask resume. A separate terminal window does not inherit it, so the env-var
check was bypassed entirely. os.RemoveAll then deleted all accessible files while
the root dir was locked by the active cmd.exe process.
Fix: Add a second protection check for .ctask/manifest-start.json, which is only
present during a live session. Both checks run before any mutation (summary scan,
confirmation, or deletion). Either check triggers immediate refusal.
Tests: 4 new tests covering manifest-based protection, no-file-mutation on refusal,
env-var protection, and normal deletion of inactive workspaces.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
typebasedio
37a1c69e26