Function record_launch_workspace 

pub(crate) fn record_launch_workspace(
    block_id: &str,
    env_vars: &HashMap<String, String>,
)

Remember the workspace the agent on block_id was started in: the AGENTMUX_AGENT_WORKDIR srv just put in its spawn env (host agents only; a container agent has none). Called by every spawn path right after agent_handlers::input::carry_agent_workdir_env.

Uploads are checked against this record, not the block’s cmd:cwd: any client with the instance auth key can rewrite that meta, so an agent could otherwise point its “workspace” at / and upload anything.