Claude6/5/2026, 1:20:43 PM

Codex/Bugbot follow-up to the targetPaths clamp (commit 7c4c5f1): when every
targetPath was dropped (outside the workspace or under .git/.cowork),
deriveWritableRoots returned an empty set while the policy stayed workspace-write,
so the OS sandbox left only temp scratch writable and scoped bash tasks failed
without a clear error.

- policy.ts: extract the clamp as filterTargetPathsToWorkspace (single source of
  truth, reused by deriveWritableRoots).
- spawnAgent.ts: fail fast at spawn with a clear, actionable error when targetPaths
  resolve to no usable in-workspace scope, instead of silently running a child
  that can write nowhere useful.
- docs/sandbox.md: document the clamp + spawn-time rejection.

Verified: bun run check, typecheck, docs:check, sandbox + spawnAgent + bash tests.

Parent975e72f