pub const AGY: CliBackend;Expand description
agy, measured at 1.2.3 by running it (#1339, #1340).
Disabled for the same reason as codex and not a different one: it has
execution it cannot be asked to give up — 57 built-in tools, enumerated by
its own init event, including run_command, write_to_file and a full
browser-control set — and the spawn path does not yet apply MUR’s sandbox.
Containment does not care whether a tool is “disabled”; it cares what the
process can do. So this is the same blocker, not a worse one.
Its own --sandbox is not a mitigation. Probed with the approval layer
removed, it still read outside the workspace, read $HOME, wrote outside
the workspace and reached the public internet.
home_env_var is HOME, and that is an honest value rather than a
missing one — an earlier note here called it “no honest value”, conflating
“no dedicated variable” with “no usable value”. Setting HOME does
relocate agy’s config, measured. What it also does is relocate everything
else that process resolves under HOME, which is a blunter instrument
than CODEX_HOME and is the one way this row is genuinely worse than
codex’s.