fix(tools): allow remembered low-risk external write retries

Generated with [codeagent](https://github.com/qbox/codeagent)
Co-authored-by: Cai-Tang-www <106404101+Cai-Tang-www@users.noreply.github.com>

Author: xgopilot

internal/tools/manager.go

@@ -338,16 +338,15 @@ func (m *DefaultManager) Execute(ctx context.Context, input ToolCallInput) (Tool
 				result := blockedToolResult(input, decision)
 				return result, permissionErrorFromDecision(decision)
 			}
+		} else {
+			result := NewErrorResult(input.Name, "workspace sandbox rejected action", sandboxErrorDetails(action, err), actionMetadata(action))
+			result.ToolCallID = input.ID
+			return result, err
 		}
-		result := NewErrorResult(input.Name, "workspace sandbox rejected action", sandboxErrorDetails(action, err), actionMetadata(action))
-		result.ToolCallID = input.ID
-		return result, err
-	}
-	m.auditCapabilityDecision(action, string(security.DecisionAllow), "")
-
-	if plan != nil {
+	} else if plan != nil {
 		input.WorkspacePlan = plan
 	}
+	m.auditCapabilityDecision(action, string(security.DecisionAllow), "")
 
 	return m.executor.Execute(ctx, input)
 }

internal/tools/manager_test.go

@@ -452,11 +452,11 @@ func TestDefaultManagerSandboxOutsideWriteSessionMemory(t *testing.T) {
 	}
 
 	_, err = manager.Execute(context.Background(), input)
-	if err == nil || !strings.Contains(err.Error(), "escapes workspace root") {
-		t.Fatalf("expected sandbox rejection after remembered allow, got %v", err)
+	if err != nil {
+		t.Fatalf("expected remembered allow retry to pass, got %v", err)
 	}
-	if writeTool.callCount != 0 {
-		t.Fatalf("expected write tool not to execute after remembered allow, got %d", writeTool.callCount)
+	if writeTool.callCount != 1 {
+		t.Fatalf("expected write tool to execute after remembered allow, got %d", writeTool.callCount)
 	}
 }