fix(sandbox): deny SSH keys and GPG stores with fail-closed discovery

README.md

@@ -272,6 +272,21 @@ zero sandbox policy
 zero sandbox grants list
 ```
 
+On Unix, the credential baseline discovers SSH private keys and GPG stores.
+SSH discovery reads directories in pages and walks nested directories with cycle
+detection. Large or deeply nested directories do not trigger a discovery limit.
+Exceeding a config-size or Include limit, or failing to inspect a required input,
+refuses sandboxed execution rather than using a partial list of protected keys.
+
+Linux's mount-based backend refuses selective SSH-key denies, including key paths
+that do not exist yet, and credential denies through mutable symlinks. This also
+applies on machines without SSH keys: a key created later must remain protected.
+An explicit deny of an existing containing directory can cover the keys, but also
+hides that directory's public files,
+including SSH configuration and known hosts. Explicit Linux `denyRead` paths
+must already exist. macOS uses pathname rules; automatic credential discovery
+remains disabled on Windows.
+
 ## Web And Local Control
 
 Zero includes local file/search/edit/shell tools, `web_fetch` for public URLs,

internal/cli/sandbox_test.go

@@ -561,14 +561,22 @@ func normalizeSandboxPolicyGoldenTempRoots(t *testing.T, gotBytes []byte, worksp
 	profile, _ := plan["permissionProfile"].(map[string]any)
 	fileSystem, _ := profile["fileSystem"].(map[string]any)
 	wantDenyRead := []string(nil)
-	credentialHome := emptyHome
+	wantSSHFiles := []string(nil)
 	if runtime.GOOS != "windows" {
+		credentialHome := emptyHome
 		if resolved, err := filepath.EvalSymlinks(emptyHome); err == nil {
 			credentialHome = resolved
 		}
 		wantDenyRead = []string{
 			filepath.Join(credentialHome, ".aws"),
 			filepath.Join(credentialHome, ".azure"),
+			filepath.Join(credentialHome, ".gnupg"),
+			filepath.Join(credentialHome, ".ssh", "id_rsa"),
+			filepath.Join(credentialHome, ".ssh", "id_dsa"),
+			filepath.Join(credentialHome, ".ssh", "id_ecdsa"),
+			filepath.Join(credentialHome, ".ssh", "id_ed25519"),
+			filepath.Join(credentialHome, ".ssh", "id_ecdsa_sk"),
+			filepath.Join(credentialHome, ".ssh", "id_ed25519_sk"),
 			// git's cleartext credential stores, in both the home and XDG
 			// layouts (#816). Listed here so the exported policy JSON is what
 			// catches a regression: this baseline is the contract a user reads
@@ -583,16 +591,45 @@ func normalizeSandboxPolicyGoldenTempRoots(t *testing.T, gotBytes []byte, worksp
 			filepath.Join(credentialHome, ".config", "gcloud"),
 			filepath.Join(credentialHome, ".config", "zero"),
 		}
+		for _, path := range wantDenyRead {
+			if filepath.Dir(path) == filepath.Join(credentialHome, ".ssh") {
+				wantSSHFiles = append(wantSSHFiles, path)
+			}
+		}
+		if emptyHome != credentialHome {
+			for _, rel := range []string{
+				".git-credentials",
+				".gnupg",
+				filepath.Join(".ssh", "id_rsa"),
+				filepath.Join(".ssh", "id_dsa"),
+				filepath.Join(".ssh", "id_ecdsa"),
+				filepath.Join(".ssh", "id_ed25519"),
+				filepath.Join(".ssh", "id_ecdsa_sk"),
+				filepath.Join(".ssh", "id_ed25519_sk"),
+			} {
+				wantDenyRead = append(wantDenyRead, filepath.Join(emptyHome, rel))
+			}
+		}
 	}
 	gotDenyRead := jsonStringSlice(fileSystem["denyReadIfExists"])
 	sort.Strings(gotDenyRead)
 	sort.Strings(wantDenyRead)
 	if !reflect.DeepEqual(gotDenyRead, wantDenyRead) {
 		t.Fatalf("manager credential deny baseline = %#v, want %#v", gotDenyRead, wantDenyRead)
 	}
+	gotSSHFiles := jsonStringSlice(fileSystem["sshDenyReadFiles"])
+	sort.Strings(gotSSHFiles)
+	sort.Strings(wantSSHFiles)
+	if !reflect.DeepEqual(gotSSHFiles, wantSSHFiles) {
+		t.Fatalf("manager absent SSH key protection = %#v, want %#v", gotSSHFiles, wantSSHFiles)
+	}
 	wantCarveouts := []string(nil)
 	wantEnsureDirs := []string(nil)
 	if runtime.GOOS != "windows" {
+		credentialHome := emptyHome
+		if resolved, err := filepath.EvalSymlinks(emptyHome); err == nil {
+			credentialHome = resolved
+		}
 		zeroDir := filepath.Join(credentialHome, ".config", "zero")
 		wantCarveouts = []string{
 			filepath.Join(zeroDir, "plugins"),
@@ -601,13 +638,20 @@ func normalizeSandboxPolicyGoldenTempRoots(t *testing.T, gotBytes []byte, worksp
 		}
 		wantEnsureDirs = []string{zeroDir}
 	}
-	if gotCarveouts := jsonStringSlice(fileSystem["denyReadCarveouts"]); !reflect.DeepEqual(gotCarveouts, wantCarveouts) {
+	gotCarveouts := jsonStringSlice(fileSystem["denyReadCarveouts"])
+	sort.Strings(gotCarveouts)
+	sort.Strings(wantCarveouts)
+	if !reflect.DeepEqual(gotCarveouts, wantCarveouts) {
 		t.Fatalf("manager credential carveouts = %#v, want %#v", gotCarveouts, wantCarveouts)
 	}
-	if gotEnsureDirs := jsonStringSlice(fileSystem["ensureDenyReadDirs"]); !reflect.DeepEqual(gotEnsureDirs, wantEnsureDirs) {
+	gotEnsureDirs := jsonStringSlice(fileSystem["ensureDenyReadDirs"])
+	sort.Strings(gotEnsureDirs)
+	sort.Strings(wantEnsureDirs)
+	if !reflect.DeepEqual(gotEnsureDirs, wantEnsureDirs) {
 		t.Fatalf("manager credential ensure dirs = %#v, want %#v", gotEnsureDirs, wantEnsureDirs)
 	}
 	delete(fileSystem, "denyReadIfExists")
+	delete(fileSystem, "sshDenyReadFiles")
 	delete(fileSystem, "denyReadCarveouts")
 	delete(fileSystem, "ensureDenyReadDirs")
 	fileSystem["readRoots"] = filterJSONStringRoots(fileSystem["readRoots"], tempRoots)

internal/sandbox/architecture_baseline_test.go

@@ -76,7 +76,7 @@ func TestCommandPlanCarriesSandboxMetadata(t *testing.T) {
 	root := t.TempDir()
 	engine := NewEngine(EngineOptions{
 		WorkspaceRoot: root,
-		Policy:        DefaultPolicy(),
+		Policy:        testPolicyWithSSHDirectoryDeny(t),
 		Backend: Backend{
 			Name:            BackendLinuxBwrap,
 			Available:       true,
@@ -90,6 +90,7 @@ func TestCommandPlanCarriesSandboxMetadata(t *testing.T) {
 	if err != nil {
 		t.Fatalf("BuildCommandPlan: %v", err)
 	}
+	t.Cleanup(plan.Cleanup)
 
 	if plan.TargetBackend != BackendLinuxBwrap || !plan.Wrapped || plan.EnforcementLevel != EnforcementNative || plan.DowngradeReason != "" {
 		t.Fatalf("wrapped command metadata = %#v, want native linux-bwrap", plan)
@@ -107,6 +108,7 @@ func TestCommandPlanCarriesSandboxMetadata(t *testing.T) {
 	if err != nil {
 		t.Fatalf("BuildCommandPlan unavailable auto plan: %v", err)
 	}
+	t.Cleanup(degraded.Cleanup)
 	if degraded.Wrapped || degraded.EnforcementLevel != EnforcementDegraded || degraded.DowngradeReason != "native sandbox unavailable" {
 		t.Fatalf("unavailable command metadata = %#v, want degraded direct plan", degraded)
 	}

internal/sandbox/command_policy_test.go

@@ -0,0 +1,34 @@
+package sandbox
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// testPolicyWithSSHDirectoryDeny gives command-planning tests a maskable SSH
+// policy so they reach their intended network, runtime, or other credential
+// checks. Supplied homes must belong to the test; otherwise create an isolated
+// home and redirect all credential roots before constructing the profile.
+func testPolicyWithSSHDirectoryDeny(t *testing.T, homes ...string) Policy {
+	t.Helper()
+	if len(homes) == 0 {
+		home := t.TempDir()
+		homes = []string{home}
+		for _, name := range []string{"HOME", "USERPROFILE", "XDG_CONFIG_HOME", "XDG_CACHE_HOME", "XDG_STATE_HOME", "APPDATA", "LOCALAPPDATA"} {
+			t.Setenv(name, home)
+		}
+	}
+	for _, name := range []string{"ZERO_OAUTH_TOKENS_PATH", "ZERO_MCP_OAUTH_TOKENS_PATH", "GNUPGHOME", "ZERO_OAUTH_STORAGE", "CLOUDSDK_CONFIG", "GH_CONFIG_DIR", "DOCKER_CONFIG", "KUBECONFIG", "NETRC", "GOOGLE_APPLICATION_CREDENTIALS", "NPM_CONFIG_USERCONFIG", "npm_config_userconfig"} {
+		t.Setenv(name, "")
+	}
+	policy := DefaultPolicy()
+	for _, home := range homes {
+		sshDir := filepath.Join(home, ".ssh")
+		if err := os.MkdirAll(sshDir, 0700); err != nil {
+			t.Fatal(err)
+		}
+		policy.DenyRead = append(policy.DenyRead, sshDir)
+	}
+	return policy
+}

internal/sandbox/git_credential_deny_test.go

@@ -16,12 +16,10 @@ import (
 // git's credential store holds host passwords and personal access tokens in
 // cleartext, in one of two locations depending on whether the user is on the
 // XDG layout. Neither was denied, so a sandboxed command could read them
-// (#815).
-//
-// Scoped to the credential files on purpose. Denying ~/.ssh as well would stop
-// a sandboxed git push over SSH from working, which is a functional trade that
-// issue tracks separately; these two cost nothing, because git reads them for
-// authentication rather than identity.
+// (#815). #816 closed this half: the stores are denied as files, not the
+// surrounding git config directory. SSH private keys and the GPG keyring are
+// the remaining #815 scope and are covered in ssh_gpg_deny_test.go (key
+// material, not the whole of ~/.ssh).
 func TestCredentialDenyReadPathsCoversGitCredentialStores(t *testing.T) {
 	home := t.TempDir()
 	configHome := filepath.Join(home, ".config")