[nedtwigg]

Adds two entries to "What is not defended" in docs/specs/security.md, and corrects the "Spawned programs" guarantee in docs/specs/security-local.md to match them: a Tool's own browser can bind to a project as well as a dor command. No code changes.

• A terminal can choose where the next split opens. Output can report any local directory as the terminal's own. A split starts its shell there, and so does a helper where Dormouse cannot read the shell's directory itself. A prompt that runs git there is subject to that repository's config, as it would be after a cd.
• A Tool opened from a terminal link takes the directory that terminal reports. A Tool's browser on agent-browser or Playwright reads its config from that directory, and the config can name the program it launches.

Both behaviours are kept on purpose. Splits following the reported directory is how a split opens where you are working, and reading the process directory instead would not help on Windows and could open the wrong place in a nested shell. Telling link-opened Tools apart from ones launched with dor would cost those Tools' browsers the project's config.

security.md's word budget is re-baselined for the two entries. Both descriptions come from reading the code; neither was run.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	c633521
Status:	✅  Deploy successful!
Preview URL:	https://425d1d83.mouseterm.pages.dev
Branch Preview URL:	https://disclose-reported-directory.mouseterm.pages.dev

View logs

[dormouse-bot]

The second new entry contradicts a guarantee that /security publishes from the section it links. docs/specs/security-local.md → "Spawned programs" has a Guarantee row that ends "only your own dor command binds a browser to a project". A Tool opened by clicking a terminal's OSC 8 link is bound through the Tool's own browser, which S302 allows. That browser gets the cwd that linkCwd takes from getInheritableCwd, which is the directory the terminal output reported. So the page would state both that only your own dor command binds a browser to a project and that link output can choose the project a Tool's browser reads. Narrowing that clause to match S302 would fix this, for example: "only a dor command, or a Tool's own browser, binds a browser to a project". The edit is outside this diff, so there is no inline suggestion.