fix: keep builder artifacts inside workspace grant

tests/test_builder_prompt.py

@@ -5,10 +5,13 @@ import unittest
 
 from agent_builder.builder import (
     BUILDER_SKILL_SOURCE,
+    BuilderContext,
     SYSTEM_PROMPT,
+    _build_project_backend,
     _builder_skill_files,
     _with_builder_skills,
 )
+from agent_builder.config import Settings
 from agent_builder.tools import A2A_PACK_MIN_VERSION
 from deepagents.backends import StateBackend
 
@@ -128,3 +131,31 @@ class BuilderPromptTests(unittest.TestCase):
         paths = [entry["path"] for entry in (listing.entries or [])]
         for skill_name in expected:
             self.assertIn(f"{BUILDER_SKILL_SOURCE}{skill_name}/", paths)
+
+    def test_project_backend_keeps_deepagents_artifacts_inside_project_grant(self) -> None:
+        backend = _build_project_backend(
+            BuilderContext(
+                bucket="user-1-files",
+                project_prefix="agents/svgwrite-agent",
+                workspace=object(),
+            ),
+            settings=Settings(
+                sandbox_url="http://sandbox",
+                sandbox_timeout_s=1200,
+                sandbox_token=None,
+                deploy_wait_timeout_s=900,
+                litellm_url="http://litellm",
+                litellm_key="",
+                litellm_model="gpt-5.5",
+                cp_url="http://control-plane",
+                minio_endpoint="http://minio",
+                minio_access_key="",
+                minio_secret_key="",
+                image="python:3.11-slim",
+            ),
+        )
+
+        self.assertEqual(
+            backend.artifacts_root,
+            "/agents/svgwrite-agent/.agent-builder",
+        )