Clarify Claude Code sandbox activation and storage access

[j5ik2o]

Summary

• Clarify in both READMEs and the Claude Code command template that sandbox.filesystem.allowWrite does not enable sandboxing by itself.
• Explain that users can select a sandbox mode with /sandbox or enable it in settings with "enabled": true.
• Strengthen the Claude Code instructions so agents use the provided scripts instead of guessing internal storage paths or invoking sqlite3 directly.
• Add Bats coverage to keep these safeguards in the generated command template.

Background

sandbox.filesystem.allowWrite grants access to additional write locations only when sandboxing is enabled. A configuration that defines the allowlist while enabling the sandbox separately is valid, but the existing documentation did not clearly distinguish these settings. This could lead users to assume that adding the allowlist also enables sandboxing.

The message store location is also an internal detail resolved by the scripts, including any AGMSG_STORAGE_PATH override. If an agent guesses a database path and accesses it directly, it can target a nonexistent file and fail with unable to open database file. The command template now explicitly prevents this unsupported path.

Impact

This change does not alter runtime behavior or existing configuration. It clarifies the setup guidance and agent instructions for Claude Code users.

Validation

• npx --yes bats@1.13.0 tests/test_claude_template.bats
• npx --yes bats@1.13.0 --filter '[Cc]laude' tests/test_install.bats
• git diff --check