read_file(/abs/dir) is recursive for file tools but is not mounted recursively in the terminal sandbox

[liandong00]

Environment

• agy 1.1.27
• macOS (x86_64)
• enableTerminalSandbox: true
• toolPermission: "proceed-in-sandbox"

Summary

Docs: read_file paths are mounted read-only, recursively on that tree.

Observed:

• read_file(/absolute/extra-tree) → view_file of a nested file is auto-allowed (file tools are recursive).
• Sandboxed cat /absolute/extra-tree/nested/file → Operation not permitted (TUI and agy -p).
• read_file(/absolute/extra-tree/nested/file) (exact file) → sandboxed cat of that file succeeds.
• write_file(/absolute/workspace) is recursive for shell writes under that directory.

Directory read_file does not become a recursive OS-sandbox RO grant. Only exact-file read_file rules are visible to run_command.

Reproduction

• Workspace: /absolute/workspace
• Extra tree, not a workspace folder: /absolute/extra-tree/nested/file.txt

"permissions": {
  "allow": [
    "write_file(/absolute/workspace)",
    "read_file(/absolute/extra-tree)"
  ]
}

1. TUI view_file of /absolute/extra-tree/nested/file.txt — no prompt, content returned.
2. TUI or agy -p, BypassSandbox: false:

   cat /absolute/extra-tree/nested/file.txt

Actual

cat: /absolute/extra-tree/nested/file.txt: Operation not permitted

The model retries with BypassSandbox: true. A compound command that only reads the extra tree and writes the workspace (e.g. cat extra >> workspace/out.txt) fails on the cat, not on the append.

Contrast: allow read_file(/absolute/extra-tree/nested/file.txt) (the file) and the same cat succeeds in the sandbox. head /etc/hosts and reads under the workspace succeed.

Expected

read_file(/absolute/dir) mounts that directory tree read-only in the terminal sandbox (same recursive meaning as file tools). Then:

cat /absolute/extra-tree/nested/file.txt >> /absolute/workspace/out.txt

runs sandboxed without bypass. Writes under /absolute/extra-tree stay denied.

--add-dir / write_file(/absolute/extra-tree) are the wrong workaround: they make the extra tree writable.