Correct sandbox tool-note wording that overstated filesystem and network isolation

On this branch the code tools run on the host with only cwd set (no Landlock
filesystem confinement, no network namespace), so parts of the sandbox note
misdirected the model:

- The code-execution tip claimed the sandbox cannot access the user's own
  computer, but an exact local path the user supplies is readable, so the model
  would wrongly refuse or request an upload. Reword to frame the working
  directory as the default location for your work rather than asserting the
  user's files are inaccessible, while still steering to an exact path.

- The blocked-network-command message asserted private and arbitrary hosts are
  unreachable, but the block is by command name only and git/pip keep the
  network namespace, so a git clone of a private host still works. Scope the
  claim to the blocked download commands.

- The same message told the user to upload the files to chat, but attachments
  land in the retrieval store, not the sandbox workdir, so it was a dead end.
  Direct the user to place the file in the working directory or give a readable
  path instead.

Add tests pinning the command-scoped claim, the no-chat-upload remedy, and the
code-execution tip framing.

studio/backend/core/inference/tools.py

@@ -5853,12 +5853,12 @@ def _bash_exec(
             base = f"Blocked command(s) for safety: {', '.join(sorted(blocked))}."
             if blocked & _NETWORK_BLOCKED_COMMANDS:
                 return (
-                    base + " Direct network commands are blocked in the "
-                    "terminal. Public files on allowlisted sites (such as "
-                    "github.com, huggingface.co, or pypi.org) can be downloaded "
-                    "from Python code instead; the user's own machine and other "
-                    "private or arbitrary hosts are not reachable, so for those "
-                    "ask the user to upload the files they want you to work with."
+                    base + " These download commands are blocked by name in "
+                    "the terminal. Public files on allowlisted sites (such as "
+                    "github.com, huggingface.co, or pypi.org) can be fetched "
+                    "from Python code instead. If you need files from another "
+                    "location, ask the user to place them in the working "
+                    "directory or give a path the sandbox can read."
                 )
             return base
     elif not _harden_parent_against_proc_env_leak():

studio/backend/routes/inference.py

@@ -2405,12 +2405,13 @@ _TOOL_WEB_EXPANDED_TIP = (
 _TOOL_CODE_TIP = (
     "Use code execution for math, calculations, data processing, or to parse "
     "and analyze information from tool results. It runs in a sandbox whose "
-    "working directory is an isolated scratch space that may already hold files "
-    "from earlier work; it cannot access the user's own computer, and its "
-    "internet access is limited, so do not assume a file, folder, or repository "
-    "the user mentions is already present. List the working directory to see "
-    "what is there; if what you need is not present, ask the user to provide it "
-    "or give an exact path rather than running commands against a guessed one."
+    "working directory is an isolated scratch space that is the default "
+    "location for your work and may already hold files from earlier work; it "
+    "is not a copy of the user's computer, and its internet access is limited, "
+    "so do not assume a file, folder, or repository the user mentions is "
+    "already present. List the working directory to see what is there; if what "
+    "you need is not present, ask the user to provide it or give an exact path "
+    "rather than running commands against a guessed one."
 )
 _TOOL_ARTIFACT_TIP = (
     "For HTML, CSS, or JavaScript canvas requests, call render_html once when "

studio/backend/tests/test_sandbox_paths_note.py

@@ -95,3 +95,37 @@ def test_blocked_network_command_message_points_to_python_egress():
     assert "cannot reach other machines or remote hosts" not in msg
     assert "python" in msg
     assert "github.com" in msg
+
+
+def test_blocked_network_command_message_scopes_claim_to_the_command():
+    # The block is by command name; the terminal keeps its network namespace and
+    # does not block git/pip, so `git clone http://<private-host>/repo` can still
+    # reach a private host. The message must not assert the destination itself is
+    # unreachable, and must attribute the block to the command by name.
+    msg = _bash_exec("wget http://10.0.0.5/internal/repo.tar.gz").lower()
+    assert "by name" in msg
+    assert "not reachable" not in msg
+    assert "are not reachable" not in msg
+    assert "hosts are not reachable" not in msg
+
+
+def test_blocked_network_command_message_does_not_recommend_chat_upload():
+    # Chat attachments land in the RAG store, not the sandbox workdir, so telling
+    # the user to upload the file to chat is a dead end. The message must instead
+    # point at an accessible path or placing the file in the working directory.
+    msg = _bash_exec("curl https://raw.githubusercontent.com/foo/bar/main/x.py").lower()
+    assert "upload" not in msg
+    assert "working directory" in msg or "path the sandbox can read" in msg
+
+
+def test_code_execution_nudge_does_not_deny_local_file_access():
+    # On this no-Landlock branch the child runs on the host with only cwd set, so an
+    # exact local path the user supplies is readable. The code-execution nudge must
+    # frame the workdir as the default work location, not assert the user's own
+    # computer is inaccessible, and it must still allow an exact path.
+    from routes.inference import _TOOL_CODE_TIP
+
+    lowered = _TOOL_CODE_TIP.lower()
+    assert "cannot access the user's own computer" not in lowered
+    assert "default" in lowered and "location for your work" in lowered
+    assert "give an exact path" in lowered