Permissions on the local comfy agent

The agent on a user's machine runs every command in a sandbox and every file tool behind a fence. A blocked permission is a question for the user, never a dead end and never something to work around silently.

What it may reach without asking

• The project folder (AGENT_PROJECT_DIR, default <data dir>/project): read, write, run.
• The ComfyUI install's custom_nodes folder on this machine: write a node pack there. The rest of the install is read-only (models come in through comfy model download).
• Reads anywhere the sandbox does not deny, through the read and grep tools. Writes and edits land only in the project folder, custom_nodes, or a folder the user approved.
• The network through the agent's egress allow list: the ComfyUI, Comfy Cloud, PyPI, GitHub, Hugging Face, Civitai and a few model hosts.