beads: add sandbox: default to all tool examples

skills/beads/SKILL.md

@@ -33,10 +33,13 @@ args: ["--mount", "<mount>", "--prefix", "<prefix>"]
 
 All tools require `--mount <mount>`. Exceptions: `list_mounts.sh`, `mount_beads.sh`, `umount_beads.sh`.
 
+**CRITICAL:** Always use `sandbox: default` with beads tools. The tools derive scope from cwd, which must match the project directory.
+
 List mounts:
 ```
 Tool: execute_code
 tool: list_mounts.sh
+sandbox: default
 ```
 
 Wait for a bead on your mount (blocks until one is ready, returns full bead JSON including comments, then exits — bot decides whether to claim):
@@ -44,6 +47,7 @@ Wait for a bead on your mount (blocks until one is ready, returns full bead JSON
 Tool: execute_code
 tool: wait_for_bead.sh
 args: ["--mount", "<mount>"]
+sandbox: default
 ```
 
 List ready beads (open, unblocked):
@@ -51,6 +55,7 @@ List ready beads (open, unblocked):
 Tool: execute_code
 tool: list_ready_beads.sh
 args: ["--mount", "<mount>"]
+sandbox: default
 ```
 
 List all open beads (excludes closed):
@@ -58,6 +63,7 @@ List all open beads (excludes closed):
 Tool: execute_code
 tool: list_beads.sh
 args: ["--mount", "<mount>"]
+sandbox: default
 ```
 
 Search beads by id, title, or description (includes closed):
@@ -65,6 +71,7 @@ Search beads by id, title, or description (includes closed):
 Tool: execute_code
 tool: search_beads.sh
 args: ["--mount", "<mount>", "--query", "<query>"]
+sandbox: default
 ```
 
 **Note:** `list_beads.sh` and `list_ready_beads.sh` only return open beads. To find closed beads, use `search_beads.sh`.
@@ -74,6 +81,7 @@ Read bead JSON:
 Tool: execute_code
 tool: read_bead.sh
 args: ["--mount", "<mount>", "--id", "<id>", "--property", "json"]
+sandbox: default
 ```
 
 Read bead comments:
@@ -81,6 +89,7 @@ Read bead comments:
 Tool: execute_code
 tool: read_bead_comments.sh
 args: ["--mount", "<mount>", "--id", "<id>"]
+sandbox: default
 ```
 
 **IMPORTANT:** When working on a bead, always check `comment_count` in the JSON output. If > 0, read comments for additional context, decisions, or blockers.
@@ -90,6 +99,7 @@ Claim bead:
 Tool: execute_code
 tool: claim_bead.sh
 args: ["--mount", "<mount>", "--id", "<id>"]
+sandbox: default
 ```
 
 Complete bead:
@@ -97,6 +107,7 @@ Complete bead:
 Tool: execute_code
 tool: complete_bead.sh
 args: ["--mount", "<mount>", "--id", "<id>"]
+sandbox: default
 ```
 
 Fail bead:
@@ -104,6 +115,7 @@ Fail bead:
 Tool: execute_code
 tool: fail_bead.sh
 args: ["--mount", "<mount>", "--id", "<id>", "--reason", "<reason>"]
+sandbox: default
 ```
 
 Create bead (starts deferred — use open_bead.sh when ready):
@@ -111,6 +123,7 @@ Create bead (starts deferred — use open_bead.sh when ready):
 Tool: execute_code
 tool: create_bead.sh
 args: ["--mount", "<mount>", "--title", "<title>", "--desc", "<desc>", "--parent", "<id>"]
+sandbox: default
 ```
 `--desc`, `--parent`, `--no-lint`, `--capability low|standard|high` are all optional.
 
@@ -119,6 +132,7 @@ Update bead field:
 Tool: execute_code
 tool: update_bead.sh
 args: ["--mount", "<mount>", "--id", "<id>", "--field", "<field>", "--value", "<value>"]
+sandbox: default
 ```
 Valid fields: `title`, `description`, `design`, `acceptance_criteria`, `notes`, `issue_type`, `estimated_minutes`, `external_ref`, `spec_id`, `priority`, `due_at`, `work_type`. Status and assignee are managed by atomic operations only.
 
@@ -127,6 +141,7 @@ Open (promote deferred to ready):
 Tool: execute_code
 tool: open_bead.sh
 args: ["--mount", "<mount>", "--id", "<id>"]
+sandbox: default
 ```
 
 Defer bead:
@@ -134,6 +149,7 @@ Defer bead:
 Tool: execute_code
 tool: defer_bead.sh
 args: ["--mount", "<mount>", "--id", "<id>"]
+sandbox: default
 ```
 Optional: append `"--until", "<RFC3339-time>"` to defer until a specific time.
 
@@ -142,6 +158,7 @@ Reopen closed bead:
 Tool: execute_code
 tool: reopen_bead.sh
 args: ["--mount", "<mount>", "--id", "<id>"]
+sandbox: default
 ```
 
 Relate two beads (soft link, no blocking):
@@ -149,6 +166,7 @@ Relate two beads (soft link, no blocking):
 Tool: execute_code
 tool: relate_beads.sh
 args: ["--mount", "<mount>", "--bead1", "<id-1>", "--bead2", "<id-2>"]
+sandbox: default
 ```
 
 Add dependency (child blocked by parent):
@@ -156,6 +174,7 @@ Add dependency (child blocked by parent):
 Tool: execute_code
 tool: add_dependency.sh
 args: ["--mount", "<mount>", "--child", "<child>", "--parent", "<parent>"]
+sandbox: default
 ```
 
 Comment on bead:
@@ -163,6 +182,7 @@ Comment on bead:
 Tool: execute_code
 tool: comment_bead.sh
 args: ["--mount", "<mount>", "--id", "<id>", "--text", "<text>"]
+sandbox: default
 ```
 
 Label bead:
@@ -170,6 +190,7 @@ Label bead:
 Tool: execute_code
 tool: label_bead.sh
 args: ["--mount", "<mount>", "--id", "<id>", "--label", "<label>"]
+sandbox: default
 ```
 
 Delete bead:
@@ -177,6 +198,7 @@ Delete bead:
 Tool: execute_code
 tool: delete_bead.sh
 args: ["--mount", "<mount>", "--id", "<id>"]
+sandbox: default
 ```
 
 **Note:** Delete does not cascade. To delete a parent and all children, delete children first, then parent.
@@ -186,6 +208,7 @@ Unmount project:
 Tool: execute_code
 tool: umount_beads.sh
 args: ["--mount", "<mount>"]
+sandbox: default
 ```
 **Note:** Unmounting is an emergency stop. The orphan recovery cron will not spawn agents for unmounted projects. Remount to resume recovery.
 
@@ -194,6 +217,7 @@ Sync project:
 Tool: execute_code
 tool: sync_beads.sh
 args: ["--mount", "<mount>"]
+sandbox: default
 ```
 
 ## Rules