1. src/agents/sandbox/context.ts, line 44-64 (link)

   Skill sync still unreachable in rw mode

   The skill sync block is nested inside if (workspaceDir === sandboxWorkspaceDir). When workspaceAccess === "rw", workspaceDir is set to agentWorkspaceDir (line 42), so this outer condition is false and the else branch runs instead — no skill sync happens. The inner if (cfg.workspaceAccess !== "rw") guard that was removed was a redundant check inside a block that was already unreachable in rw mode (unless agentWorkspaceDir happens to equal sandboxWorkspaceDir, e.g. in scope: "shared" configurations).

   To actually fix skill access for the rw case, the sync needs to target sandboxWorkspaceDir unconditionally (so bundled/managed skills land inside the sandbox root), separate from the workspaceDir selection:

   // Always ensure sandboxWorkspaceDir layout and skill sync
   await ensureSandboxWorkspace(
     sandboxWorkspaceDir,
     agentWorkspaceDir,
     params.config?.agents?.defaults?.skipBootstrap,
   );
   try {
     await syncSkillsToWorkspace({
       sourceWorkspaceDir: agentWorkspaceDir,
       targetWorkspaceDir: sandboxWorkspaceDir,
       config: params.config,
       managedSkillsDir: path.join(CONFIG_DIR, "skills"),
       bundledSkillsDir: resolveBundledSkillsDir(),
     });
   } catch (error) {
     const message = error instanceof Error ? error.message : JSON.stringify(error);
     defaultRuntime.error?.(`Sandbox skill sync failed: ${message}`);
   }
   
   // In rw mode, agent uses the real workspace dir directly
   if (workspaceDir !== sandboxWorkspaceDir) {
     await fs.mkdir(workspaceDir, { recursive: true });
   }

   Without this change, the error described in the PR — skills escaping the sandbox root in rw mode — will persist for non-shared-scope configurations.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: src/agents/sandbox/context.ts
   Line: 44-64
   
   Comment:
   **Skill sync still unreachable in `rw` mode**
   
   The skill sync block is nested inside `if (workspaceDir === sandboxWorkspaceDir)`. When `workspaceAccess === "rw"`, `workspaceDir` is set to `agentWorkspaceDir` (line 42), so this outer condition is false and the `else` branch runs instead — no skill sync happens. The inner `if (cfg.workspaceAccess !== "rw")` guard that was removed was a redundant check inside a block that was already unreachable in `rw` mode (unless `agentWorkspaceDir` happens to equal `sandboxWorkspaceDir`, e.g. in `scope: "shared"` configurations).
   
   To actually fix skill access for the `rw` case, the sync needs to target `sandboxWorkspaceDir` unconditionally (so bundled/managed skills land inside the sandbox root), separate from the `workspaceDir` selection:
   
   ```typescript
   // Always ensure sandboxWorkspaceDir layout and skill sync
   await ensureSandboxWorkspace(
     sandboxWorkspaceDir,
     agentWorkspaceDir,
     params.config?.agents?.defaults?.skipBootstrap,
   );
   try {
     await syncSkillsToWorkspace({
       sourceWorkspaceDir: agentWorkspaceDir,
       targetWorkspaceDir: sandboxWorkspaceDir,
       config: params.config,
       managedSkillsDir: path.join(CONFIG_DIR, "skills"),
       bundledSkillsDir: resolveBundledSkillsDir(),
     });
   } catch (error) {
     const message = error instanceof Error ? error.message : JSON.stringify(error);
     defaultRuntime.error?.(`Sandbox skill sync failed: ${message}`);
   }
   
   // In rw mode, agent uses the real workspace dir directly
   if (workspaceDir !== sandboxWorkspaceDir) {
     await fs.mkdir(workspaceDir, { recursive: true });
   }
   ```
   
   Without this change, the error described in the PR — skills escaping the sandbox root in `rw` mode — will persist for non-shared-scope configurations.
   
   How can I resolve this? If you propose a fix, please make it concise.

Best possible solution:

Close this stale PR. The latest review rated it F, the branch still lacks merge-ready proof, and there has been no human follow-up after the durable review.

Do we have a high-confidence way to reproduce the issue?

Yes, by source inspection rather than a live run. Current main selects the agent workspace for rw mode and only syncs skills inside the sandbox-workspace branch, so non-shared rw sessions do not materialize managed or bundled skills into a readable workspace path.

Is this the best way to solve the issue?

No. The intent is useful, but this patch is not the best fix because it leaves the sync unreachable, imports from the wrong module, omits current eligibility inputs, and conflicts with current main and the open read-only skill mount design.

Security review:

Security review needs attention: The patch touches sandbox skill exposure and path-boundary behavior, and the current diff is incorrect enough that the boundary cannot be considered safe.

• [medium] Skill sync omits current eligibility filtering — src/agents/sandbox/context.ts:52
  The PR's sync call does not pass the current agentId and remote eligibility context, so a naive conflict resolution can materialize skills that current main would filter out for that agent/session.
  Confidence: 0.89
• [medium] Copy-based skill exposure overlaps an open immutability design — src/agents/sandbox/context.ts:52
  The branch would copy managed/bundled skills into a writable workspace path while the related read-only mount issue remains open, so maintainers need to decide the sandbox security direction before accepting this shape.
  Confidence: 0.82

What I checked:

• stale F-rated PR: PR was opened 2026-03-16T08:27:39Z, is older than 60 days, and the latest review rated it F.
• proof blocker: real behavior proof is missing and proof tier is F, so this branch is not merge-ready without contributor follow-up.
• no human follow-up: live comments and timeline hydrated by apply contain no non-automation activity after the ClawSweeper review.

Likely related people:

• steipete: Peter Steinberger introduced or heavily refactored central sandbox context/layout behavior, including refactor(sandbox): share workspace layout setup and feat: add openshell sandbox backend. (role: feature owner and adjacent sandbox owner; confidence: high; commits: 182afe9f594d, d8b927ee6a9f; files: src/agents/sandbox/context.ts, src/agents/sandbox)
• gumadeiras: Gustavo Madeira Santana added inherited agent skill allowlists and preserved remote skill sync eligibility in the same sandbox skill-sync path. (role: recent skills/sandbox contributor; confidence: high; commits: ddd250d13075, 5e365a8ec4a5; files: src/agents/sandbox/context.ts, src/agents/skills/workspace.ts)
• WhatsSkiLL: Recent current-main blame for the central ensureSandboxWorkspaceLayout block points to a broad agent reply/tool change, so they are a current nearby contributor even if not the original sandbox owner. (role: recent area contributor; confidence: medium; commits: 0a4de3de5761; files: src/agents/sandbox/context.ts)

Codex review notes: model gpt-5.5, reasoning high; reviewed against 25e489395ab0.

• The egg game starts only after the PR passes the real-behavior proof check.
• Before that, no creature or rarity is rolled. The treat waits for real proof.
• This is still just collectible flavor: proof affects review readiness, not creature quality.