[Yiannis128]

A chat working in a repository outside the workspace set `unsandboxed` 105 times, raised 72 approval banners, had 12 commands refused in never mode, and never called `add_directory`. The model did what its descriptions told it to: `unsandboxed` said to call again with it set whenever a command had to write elsewhere, and `add_directory` only fired on a folder the user had named.

Descriptions

• `bash`'s `unsandboxed`: work that keeps writing in one folder (a repository, a worktree, a build directory) is `add_directory` once. `unsandboxed` is for one-off needs: installers, container tools, setuid programs.
• `add_directory`: fires when the work is in a folder outside the workspaces, whether the user named it or the task led there, and grants the folder the work is in (the repository root, say).

What the sandbox refused (`lib/domain/sandbox_denials.dart`, read in `LocalShell`)
Neither enforcer reports a denial:

• macOS: Seatbelt logs nothing for a `sandbox-exec` profile nested under another sandbox. I tried `(debug deny)` and `log show --info --debug`, and `(with report)` is refused on a deny. A `log show` over the run's window also costs 1–2s per failing command.
• Linux: Landlock logs nothing, and the helper has already exec'd the command by the time the write happens.

Both leave the kernel's errno in the output: Seatbelt's EPERM ("Operation not permitted") and Landlock's EACCES ("Permission denied"). The output is read where the confined run ends, in `LocalShell`'s one-shot run, so every run under a sandbox reports them on its `ShellResult`. Output with neither errno returns before anything is resolved. A path counts as refused when it:

• is the quoted string on the line, or the field just before the error;
• contains a slash;
• lies outside `CommandSandbox.writes` (the list Seatbelt grants from), symlinks resolved;
• lies outside the read-only directories and `/dev`.

Those paths fill `violations` (at most five), so the observation says "Denied by the sandbox" and the activity draws its Sandbox row. The model can now tell that the sandbox caused the failure.

The nudge (`tools/grant_nudge.dart`, carried on `ToolResult.notes`)

• It fires on a sandbox refusal, naming the denied path's folder, or on a second `unsandboxed` request for the same folder in one turn. The second case is unchanged: the folder comes from the command's leading `cd`, the directory the shell was left in, or the one it stood in before.
• Either folder is widened to the nearest directory above it holding a `.git`, stopping short of home.
• A command that only failed (a test, a `grep` with no match, `false`) gets no note.
• It names each folder once per turn.
• It is left off where `add_directory` is not the turn's to call, where the user denied the banner, and where `add_directory` itself would refuse the folder. Both read `refuseFolder` from `lib/domain/work_folders.dart`, so they always agree.

Also: `ShellResult.copyWith` replaces the hand-written copy. The start directory is worked out once per command and passed to the gate and the run. `AgentTool.handed` is the predicate the tool list is built from, and `grantsDirectories` reads it. `repositoryRootOf` is the `.git` walk shared by the instruction files, a worktree's git directory and the note.

Folders granted up front by project setting are another PR. The `lib/data/builtin/AGENTS.md` sandbox and Approvals sections are updated.

Tests

• `permission_gate_test.dart`: a refused write yields `violations` and a note naming the repository root. A `grep` with no match, `false`, and a failing `flutter test` in an outside folder yield neither. The second unsandboxed request gets the note and the first does not. No note where `add_directory` is not offered.
• `sandbox_denials_test.dart`: the error shapes of BSD and GNU tools, the shell, git, Python and Dart. Relative paths and `~`. Granted paths, read-only paths and program names are not counted.
• `local_shell_test.dart` runs the platform's real sandbox through `LocalShell`: a refused `touch` comes back in `violations`, and a `grep` with no match comes back with none.
• `seatbelt_test.dart` (macOS) and `landlock_test.dart` (Linux) run the real sandbox: a refused `touch` is found, and a plain failure is not.