Relative read_file/write_file rules abort sandbox setup (non-absolute file path) despite docs allowing workspace-relative paths

[liandong00]

Environment

• agy 1.1.27
• macOS (x86_64)
• enableTerminalSandbox: true
• toolPermission: "proceed-in-sandbox"

Summary

Fine-grained permissions document read_file / write_file targets as absolute or workspace-relative. read_file(.env) is a valid rule and matches file tools.

With terminal sandbox on, those rules are also fed into sandbox mount generation. That path requires absolute paths and fails the whole sandbox:

sandbox configuration error: readonly .env.local: non-absolute file path

The command never runs. The model is hinted to retry with BypassSandbox: true.

Related but different: #600 / #798 (globs not supported). This report is relative paths, not **.

Reproduction

Put a workspace-relative rule in permissions.allow, for example:

"read_file(.env.local)"

Start TUI (or print mode) in a workspace with sandbox enabled and run any run_command (even pwd).

Actual

Sandbox never starts. Observed step output (allow rule read_file(.env.local)):

sandbox configuration error: readonly .env.local: non-absolute file path

Removing all relative read_file / write_file rules lets the sandbox start. File-tool matching for those relative rules was fine; only mount setup fails.

Expected

Either:

1. Resolve workspace-relative targets against the session workspace before building mounts, or
2. Ignore relative rules for mounts (keep them for file tools) and still start the sandbox.

A documented-legal permission rule must not abort sandbox setup.

Impact

Workspace-relative denies such as write_file(.env.local) cannot coexist with the terminal sandbox. Absolute-only rules are not portable across projects.