State that terminal output can choose a split's and a linked Tool's directory

docs/specs/security-local.md

@@ -204,7 +204,7 @@ Source of truth: `context` in `standalone/sidecar/pty-core.js`; `attachRouter` i
 | Guarantee | Feature | Pinned by |
 | --- | --- | --- |
 | **A folder you open cannot get Dormouse to run a program it planted.** On Windows no program is spawned by bare name, and git in a repository you have not trusted runs no program its config names. Nor does Dormouse run git in a repository that names a network share. Terminal Context types nothing into its helper. |  | `standalone/sidecar/pty-core.test.js`, `lib/src/host/git-cli.test.ts`, `vscode-ext/test/pty-manager.test.ts`, `dor-lib-common/test/git.test.mjs`, `standalone/sidecar/helper-terminal.test.js`, `lib/src/lib/helper-terminal.test.ts` |
-| **A browser you open from a terminal's port, or a Tool's Break, reads no project's config.** It runs from a directory Dormouse owns; only your own `dor` command binds a browser to a project. |  | `lib/src/components/Wall.test.tsx`, `lib/src/components/wall/tool-run-end.test.tsx`, `lib/src/host/browser-host.test.ts`, `lib/src/host/agent-browser-host.test.ts`, `lib/src/host/playwright-host.lifecycle.test.ts` |
+| **A browser you open from a terminal's port, or a Tool's Break, reads no project's config.** It runs from a directory Dormouse owns; only your own `dor` command, or a Tool's own browser, binds a browser to a project. |  | `lib/src/components/Wall.test.tsx`, `lib/src/components/wall/tool-run-end.test.tsx`, `lib/src/host/browser-host.test.ts`, `lib/src/host/agent-browser-host.test.ts`, `lib/src/host/playwright-host.lifecycle.test.ts` |
 
 The attacker is a file planted in a folder the user opens: Windows looks a bare program name up in the working directory before `PATH` (rationale). For a browser's `binaryPath` it is also the webview realm, which writes a pane's saved params (rationale). For the Playwright installation it is also another local account, which may create folders at a Windows drive root (rationale).
 

docs/specs/security.md

@@ -54,6 +54,8 @@ Source of truth: root scripts in `package.json`; native jobs in `.github/workflo
 - **A Tool trust grant on an upstream URL trusts the URL a checkout claims.** Any directory whose own `.git/config` claims an already-granted upstream shares that grant, and so does any `dormouse.yml` nested in such a checkout, one in `node_modules` included, because a Tool resolves from the nearest file; a folder-only grant is not shared ([Dor Tool configuration](./security-local.md#dor-tool-configuration)).
 - **Output already flowing into a Tool's terminal at launch** can, between Dormouse typing the command and the shell reporting it, make that run's OSC 367 `open` requests ([Terminal output](./security-local.md#terminal-output)).
 - **A terminal can choose which of your own agent sessions resumes.** Output a pane prints as Dormouse quits can name any session of a supported agent, which the next restore resumes in that pane's directory without asking; it can type nothing else ([Terminal output](./security-local.md#terminal-output)).
+- **A terminal can choose where the next split opens.** Its output can report any local directory as its own, and a split from it starts its shell there, as does a helper where Dormouse cannot read the shell's directory itself (always on Windows). A prompt that runs git there is then subject to that repository's config, which can run a program, just as after you `cd` into it yourself ([Spawned programs](./security-local.md#spawned-programs)).
+- **A Tool opened from a terminal link takes the directory that terminal reports.** If the Tool's browser runs on agent-browser or Playwright, whether the Tool declares it or you switch its display, that CLI reads its config there, and the config can name the program it launches ([Spawned programs](./security-local.md#spawned-programs)).
 - **What VS Code does with the pane state it stores.** Structure persists in VS Code's own storage under its modes, never a transcript ([Persisted state](./security-local.md#persisted-state)).
 - *One-time link, Hosted phone, Self-hosted Relay.* **A compromised browser or operating system, on either end.** Active XSS in the Pocket origin can use the phone's key and, with encrypted fallback storage, extract its private bytes ([Client statics](./remote-security-model.md#client-statics)). Exactly two endpoints are trusted: the distributed Burrow binaries and the exact Pocket artifact the origin serves ([Trust Model](./remote-security-model.md#trust-model)); a one-time session also trusts the page Hosted serves ([One-time connection](./remote-security-model.md#one-time-connection)).
 - *Hosted phone, Self-hosted Relay.* **Presence inside an open window.** While this computer holds an open presence window for a phone, it connects without a new prompt, so script running in the Pocket origin, or anyone holding the unlocked phone, reaches a terminal unprompted ([Presence window](./remote-security-model.md#presence-window)).

scripts/spec-word-budgets.json

@@ -30,7 +30,7 @@
   "docs/specs/security-local.md": 7150,
   "docs/specs/security-remote.md": 8250,
   "docs/specs/security-supply-chain.md": 1650,
-  "docs/specs/security.md": 3400,
+  "docs/specs/security.md": 3500,
   "docs/specs/shortcuts.md": 1200,
   "docs/specs/standalone.md": 6750,
   "docs/specs/terminal-context.md": 850,