[inanna-malick]

Fixes #790

Summary

This PR resolves two macOS Seatbelt profile compilation bugs in src/sandbox/macos-sandbox-utils.ts following cc3d45c:

1. Expand denyEntries in generateWriteRules through inBothSpellings('deny', entry):

   • resolveReadConfig expands read-deny entries through callerEntries(...).flatMap(entry => inBothSpellings('deny', entry)) so that symlinked deny paths emit both the link spelling and the resolved realpath spelling.
   • generateWriteRules previously omitted inBothSpellings('deny', entry), leaving the resolved target of an intra-workspace symlink (e.g., <workspace>/.mcp.json -> <workspace>/real_config/mcp.json or a symlink in denyWithinAllow) writable under allowOnly: [<workspace>].
   • Passing denyEntries through .flatMap(entry => inBothSpellings('deny', entry)) ensures both spellings are emitted in (deny file-write* ...) and move-blocking rules.

2. Check structural glob containment in denyGlobCovers:

   • denyGlobCovers previously tested denyRegex.test(entrySamplePath(entry)) (where entrySamplePath substituted every glob wildcard with 'x'), causing denyGlobCovers to return true whenever a narrower denyOnly glob happened to match 'x' (such as /work/pub/x*, /work/pub/[u-z]*, /work/pub/[a-zA-Z]*, or /work/pub/?) under a broader allowWithinDeny glob (/work/pub/*).
   • Checking structural containment over the parsed glob atoms (globEntryAtoms + rangesCover) when entry.glob is true ensures denyGlobCovers only carves out an allow/writeRoot entry when the subtree-extended deny glob genuinely covers the allow glob's wildcard region.

Test Plan

• Added regression tests in test/sandbox/trailing-slash-deny-spellings.test.ts covering:
  • Intra-workspace symlink in denyWithinAllow emitting both link and resolved target spellings in the ; File write section.
  • Narrower denyOnly globs (/work/pub/x*, /work/pub/[u-z]*, /work/pub/[a-zA-Z]*, /work/pub/?) under allowWithinDeny: ['/work/pub/*'] remaining un-carved and landing after the allow rule.
  • Covered character-class allow (/work/pub/[a-z]safe* under denyOnly: ['/work/pub/[a-z]*']) still being carved out.

[Copilot]

🟡 Changes recommended

Unsound glob containment checks can leave denied files readable and weaken unlink protection, while the write-deny regression is masked by read-deny rules and does not establish that the fix works.

3 open issues

• Use sound containment checks for deny and allow globs · New
• Respect character classes when checking glob containment · New
• Isolate write-deny regression from read-deny rules · New

What changed in this PR

This PR addresses #790 by updating macOS Seatbelt profile generation to protect symlinked write-deny targets and reduce incorrect glob carve-outs.

Changes:

• Expand write-deny entries to include both original and resolved path spellings.
• Add a second wildcard sample when checking deny-glob coverage.
• Add regression tests for symlink write protection and narrower deny globs.

File	Description
test/​sandbox/​trailing-slash-deny-spellings.test.ts	Adds symlink and glob carve-out regression tests.
src/​sandbox/​macos-sandbox-utils.ts	Expands write-deny path spellings and updates glob coverage probes.

_{Review effort: Balanced}

[inanna-malick]

Addressed in 42cc65c: replaced sample probing in denyGlobCovers with a sound structural containment check over parseGlob tokens (globEntryAtoms + rangesCover), and added /work/pub/[a-zA-Z]* under allowWithinDeny: ['/work/pub/*'] to the regression suite.

[inanna-malick]

Addressed in 42cc65c: character-class sets (GlobTokenKind.Set) are now compared by interval containment (rangesCover), and added the denyOnly: ['/work/pub/[a-z]*'] + allowWithinDeny: ['/work/pub/[a-z]safe*'] regression test.

[inanna-malick]

Addressed in 42cc65c: set readConfig: undefined in the symlink write-deny test to isolate generateWriteRules from generateReadDenyUnlinkRules.