Silent fallback from the anvilmcp sandbox to the default sandbox on
permission errors undermined the sandbox policy — a restriction firing
is the sandbox working correctly, not a failure to recover from.
Sandbox selection is now explicit: the requested policy runs, and
failure surfaces as an error.
Also removes the now-unused IsPermissionError helper from ollie/exec.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaces the inline execution, validation, and rate-limiting logic with
calls to ollie/exec. Keeps only the 9P-dependent MCP glue (executor
init, tool call dispatch). go.mod now depends on ollie only; anvillm
and 9fans are transitive.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Levi Neely
Levi Neely