[code-review] file_ops and batch_replace bypass sandbox in Auto mode — arbitrary file deletion outside workspace

[topcheer]

File: internal/permission/config_policy.go
Lines: 182-189
Severity: Critical

Problem

In Auto mode, only tools matching isFileTool() get sandbox checks. Neither file_ops nor batch_replace is in isFileTool() (line 366-372). They fall through to return Allow, nil at line 189 with zero sandbox enforcement. Meanwhile isWriteFileTool() (line 380-386) correctly includes both, but is only used in BypassMode/AutopilotMode (line 131), never in AutoMode.

Trigger Scenario

1. Agent in Auto mode calls file_ops(delete, "/etc/passwd")
2. isCommandTool("file_ops") → false (line 167)
3. isFileTool("file_ops") → false (line 182) — file_ops not in list
4. Falls through to return Allow, nil (line 189) — sandbox never checked
5. File deleted outside workspace sandbox

Same applies to batch_replace — agent can modify files anywhere on filesystem (e.g., ~/.ssh/authorized_keys) without sandbox enforcement.

Expected vs Actual

• Expected: file_ops and batch_replace get sandbox checks in Auto mode (matching Bypass/Autopilot behavior)
• Actual: Both bypass sandbox entirely in Auto mode — arbitrary file operations outside workspace

Fix

Line 182: change isFileTool(toolName) to isFileTool(toolName) || isWriteFileTool(toolName), or add "file_ops" and "batch_replace" to isFileTool().

[topcheer]

Fixed in 6da4121. Auto mode sandbox check now includes isWriteFileTool(toolName) alongside isFileTool(toolName). file_ops and batch_replace now get sandbox enforcement in Auto mode, matching their existing Bypass/Autopilot behavior.