TUI terminal sandbox does not grant write access to the session workspace (print mode does)

[liandong00]

Environment

• agy 1.1.27
• macOS (x86_64)
• enableTerminalSandbox: true
• toolPermission: "proceed-in-sandbox"
• agentMode: "accept-edits"

Summary

In the interactive TUI, a sandboxed run_command cannot write under the session workspace (operation not permitted). The same command succeeds in print mode (agy -p) with the same settings.json and cwd.

Adding an explicit write_file(/absolute/workspace) allow rule unblocks TUI writes. That contradicts the sandbox docs: the project tree is writable without extra write_file rules; those rules are extra mounts, not a requirement for the current workspace.

File tools (write_to_file) are unaffected (they do not go through the OS sandbox).

trustedWorkspaces does not fix this.

Reproduction

1. cd /absolute/workspace so the TUI workspace is this directory (banner shows it).
2. Do not put write_file(/absolute/workspace) in permissions.allow.
3. Use the settings above. Start TUI agy.
4. Ask the agent to run exactly:

   echo 'hhhh' > /absolute/workspace/probe.txt

   (A which cat && echo … > … form fails the same way; the failure is the redirect.)

Actual (TUI)

First run_command uses BypassSandbox: false. Result:

zsh:1: operation not permitted: /absolute/workspace/probe.txt

The model retries with BypassSandbox: true and the TUI prompts “Allow sandbox bypass”.

Actual (print mode, same settings, same cwd)

agy -p '… run the same command with BypassSandbox false …'

The write succeeds. A write to a path under $HOME outside the workspace correctly fails with operation not permitted, so the sandbox is actually enabled in print mode.

Workaround

"permissions": { "allow": ["write_file(/absolute/workspace)"] }

TUI then allows the write without a bypass prompt. TUI honors write_file mounts; it never auto-mounts the session workspace as RW.

Expected

The session workspace is writable inside the terminal sandbox in both TUI and print mode, without write_file(workspace).