MGS2002: path write denied by sandbox

A spell tried to write to a file outside the workspace and outside the configured allowlist.

[MGS2002] fs write denied: /home/user/.bashrc

Why

The sandbox denies writes outside the workspace, its private temp dir, and the caches of the tools magus drives. This blocks the supply-chain attack pattern of modifying shell startup files, sudoers, or cron tables for persistence.

Resolution

1. If the write target is a legitimate cache the default footprint does not know (a Bazel spell writing to ~/.cache/bazel): add it to magus.yaml:

   sandbox:
     allow:
       - path: ~/.cache/bazel
         mode: rw
   

2. If the spell should be writing inside the workspace but is using an absolute path: the spell has a bug. File an issue with the spell author; in the meantime grant the path explicitly or disable sandbox mode.

3. If this is a malicious spell: do not grant the path. Uninstall.