fix(sandbox): take Everyone out of the restricted-SID list (does not work yet)

internal/cli/sandbox.go

@@ -22,7 +22,7 @@ const permissionProfileScopeNote = "permissionProfile is derived from this proce
 
 func runSandbox(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) int {
 	if len(args) == 0 {
-		return writeExecUsageError(stderr, "sandbox subcommand required. Use `zero sandbox policy` or `zero sandbox grants list`.")
+		return writeExecUsageError(stderr, "sandbox subcommand required. Use `zero sandbox policy`, `zero sandbox exec`, or `zero sandbox grants list`.")
 	}
 	switch args[0] {
 	case "-h", "--help", "help":
@@ -36,6 +36,8 @@ func runSandbox(args []string, stdout io.Writer, stderr io.Writer, deps appDeps)
 		return runSandboxSetup(args[1:], stdout, stderr, deps)
 	case "check":
 		return runSandboxCheck(args[1:], stdout, stderr, deps)
+	case "exec":
+		return runSandboxExec(args[1:], stdout, stderr, deps)
 	case "grants":
 		return runSandboxGrants(args[1:], stdout, stderr, deps)
 	default:
@@ -174,10 +176,17 @@ func runSandboxSetup(args []string, stdout io.Writer, stderr io.Writer, deps app
 	if !setupHelper.Available() {
 		return writeAppError(stderr, "Windows sandbox setup helper is not available", exitProvider)
 	}
+	// Resolved here, in the shell the user typed `zero sandbox setup` into, and
+	// carried in the args. The helper may be launched elevated, and an elevated
+	// process does not inherit this shell's environment. Stated explicitly rather
+	// than left nil (which resolves the same way) because this is the call site
+	// the opt-in is about.
+	principalOptIn := zeroSandbox.WindowsSandboxPrincipalOptIn(nil)
 	setupArgs, err := zeroSandbox.BuildWindowsSandboxSetupArgs(zeroSandbox.WindowsSandboxSetupArgsOptions{
 		CommandCWD:        workspaceRoot,
 		WorkspaceRoots:    []string{workspaceRoot},
 		PermissionProfile: profile,
+		PrincipalOptIn:    &principalOptIn,
 	})
 	if err != nil {
 		return writeAppError(stderr, err.Error(), exitCrash)
@@ -646,6 +655,7 @@ Commands:
   policy      Inspect active sandbox policy and platform backend
   setup       Run native platform sandbox setup
   check       Evaluate the sandbox decision for a hypothetical tool action
+  exec        Run one command through the real sandbox
   grants      Manage persistent sandbox grants
 
 `)

internal/cli/sandbox_exec.go

@@ -0,0 +1,204 @@
+package cli
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+
+	"github.com/Gitlawb/zero/internal/config"
+	zeroSandbox "github.com/Gitlawb/zero/internal/sandbox"
+)
+
+// runSandboxExec runs ONE command through the real sandbox and exits with its
+// status.
+//
+// This exists because until now the sandbox could only be exercised through a
+// full agent turn with a model in the loop. `zero sandbox policy` reports what
+// the posture would be and `zero sandbox check` evaluates a hypothetical
+// decision, but nothing actually ran a command and let you look at what
+// happened on disk afterwards. The practical result is that enforcement is
+// covered almost entirely by tests asserting the shape of an ACL plan, and
+// almost not at all by tests asserting a write was refused.
+//
+// A plan can be perfectly correct and never reach the filesystem. That is not
+// hypothetical here: the .git rename guard was emitted correctly by the planner
+// and silently skipped by the applier, and four tests covering the plan all
+// passed while the ACE was absent from disk. Something that runs the real
+// binary and then stats the file is the only thing that catches that class.
+//
+// Deliberately NOT a debug curiosity: it takes the same path a shell tool
+// takes, through SandboxManager.BuildCommandPlan, so what it proves is what
+// users get. It prints the resolved backend and enforcement level to stderr
+// before running, so a harness can assert the sandbox was actually engaged
+// rather than quietly downgraded.
+func runSandboxExec(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) int {
+	command, err := parseSandboxExecArgs(args)
+	if err != nil {
+		if errors.Is(err, errSandboxExecHelp) {
+			if writeErr := writeSandboxExecHelp(stdout); writeErr != nil {
+				return exitCrash
+			}
+			return exitSuccess
+		}
+		return writeExecUsageError(stderr, err.Error())
+	}
+
+	workspaceRoot, err := resolveWorkspaceRoot("", deps)
+	if err != nil {
+		return writeExecUsageError(stderr, err.Error())
+	}
+	resolved, err := deps.resolveConfig(workspaceRoot, config.Overrides{})
+	if err != nil {
+		return writeAppError(stderr, err.Error(), exitProvider)
+	}
+	policy := applyConfiguredSandboxPolicy(zeroSandbox.DefaultPolicy(), resolved.Sandbox)
+
+	scope, err := zeroSandbox.NewScope(workspaceRoot, resolved.Sandbox.AdditionalWriteRoots)
+	if err != nil {
+		return writeAppError(stderr, fmt.Sprintf("resolve sandbox write roots: %v", err), exitCrash)
+	}
+
+	// Through the ENGINE, not a SandboxManager built here.
+	//
+	// The engine is what a real tool call goes through, and it does more than
+	// hand the manager a request: it resolves the permission profile, calls
+	// prepareSandboxRuntime, and folds the runtime state into that profile
+	// before planning. Building a manager directly skipped all of it, so the
+	// command ran without the runtime write root, and cache or temp writes could
+	// pass or fail differently from the sandboxed command this exists to imitate.
+	// A harness that exercises the wrong path is worse than no harness, because
+	// its result still reads as evidence.
+	engine := zeroSandbox.NewEngine(zeroSandbox.EngineOptions{
+		WorkspaceRoot: workspaceRoot,
+		Policy:        policy,
+		Scope:         scope,
+		Backend:       deps.selectSandboxBackend(zeroSandbox.BackendOptions{}),
+		// The same scrub list a real tool call gets. Without it the engine keeps an
+		// empty set, and only the hardcoded names plus the provider catalog's own
+		// AuthEnvVars are removed from the child's environment: a key named by
+		// `apiKeyEnv` in the user's config would be scrubbed for every sandboxed
+		// tool call and handed to this one. Reproducing the production environment
+		// is the entire point of the command, and a credential is the last part of
+		// it that may differ.
+		SensitiveEnvKeys: providerSensitiveEnvKeys(resolved),
+	})
+	plan, err := engine.BuildCommandPlan(zeroSandbox.CommandSpec{
+		Name: command[0],
+		Args: command[1:],
+		Dir:  workspaceRoot,
+		Env:  os.Environ(),
+	})
+	if err != nil {
+		return writeAppError(stderr, fmt.Sprintf("build sandbox command plan: %v", err), exitCrash)
+	}
+	// The plan owns resources beyond its construction: on Linux it allocates a
+	// policy-report file and registers the removal here, so without this every
+	// invocation leaves a /tmp/zero-sandbox-report-* behind.
+	defer plan.Cleanup()
+
+	// Printed before the command runs and on stderr, so it survives a command
+	// that writes to stdout and stays greppable by a test harness. A downgrade
+	// is reported loudly for the same reason: a smoke test that passes because
+	// the sandbox quietly stood down is worse than no smoke test.
+	fmt.Fprintf(stderr, "sandbox: backend=%s enforcement=%s wrapped=%t workspace=%s\n",
+		plan.Backend.Name, plan.EnforcementLevel, plan.Wrapped, plan.WorkspaceRoot)
+	if strings.TrimSpace(plan.DowngradeReason) != "" {
+		fmt.Fprintf(stderr, "sandbox: DOWNGRADED: %s\n", plan.DowngradeReason)
+	}
+
+	return runSandboxPlannedCommand(plan, stdout, stderr)
+}
+
+func runSandboxPlannedCommand(plan zeroSandbox.CommandPlan, stdout io.Writer, stderr io.Writer) int {
+	process := exec.Command(plan.Name, plan.Args...)
+	process.Dir = plan.Dir
+	if process.Dir == "" {
+		process.Dir = plan.WorkspaceRoot
+	}
+	if len(plan.Env) > 0 {
+		process.Env = plan.Env
+	}
+	process.Stdin = os.Stdin
+	process.Stdout = stdout
+	process.Stderr = stderr
+
+	if err := process.Run(); err != nil {
+		var exitErr *exec.ExitError
+		if errors.As(err, &exitErr) {
+			// The command's own status, not ours. A harness asserting "the write
+			// was refused" needs the refusal's exit code, not a wrapper's.
+			// A SIGNALED CHILD HAS NO EXIT CODE TO REPORT. ExitCode() answers -1
+			// there, and os.Exit truncates that to 255, so a child that took SIGTERM
+			// became indistinguishable from one that chose to exit 255. Fold the
+			// signal into the conventional 128+n a shell would report, which needs
+			// the ProcessState rather than the integer.
+			if status, signaled := signaledExitStatus(exitErr.ProcessState); signaled {
+				return status
+			}
+			return exitErr.ExitCode()
+		}
+		fmt.Fprintf(stderr, "sandbox exec: %v\n", err)
+		return exitCrash
+	}
+	return exitSuccess
+}
+
+var errSandboxExecHelp = errors.New("help requested")
+
+// parseSandboxExecArgs takes everything after `--` as the command, so the
+// command's own flags are never mistaken for ours.
+func parseSandboxExecArgs(args []string) ([]string, error) {
+	if len(args) == 0 {
+		return nil, errors.New("usage: zero sandbox exec -- <command> [args...]")
+	}
+	// Only the FIRST token is ours to interpret. Everything from the second
+	// onwards belongs to the child, help flags included.
+	//
+	// Written as a straight-line decision on args[0] rather than a loop, because
+	// a loop here is a lie. An earlier version scanned for `--` "up front" and
+	// said so in its comment, but every branch of its body returned, so it only
+	// ever examined index 0 and the promised scan did not exist. The rule below
+	// is what that code actually implemented, and it is the rule we want: it is
+	// the wrapper's own prefix that can ask for the wrapper's help, and the
+	// prefix is at most one token long.
+	switch args[0] {
+	case "--":
+		// Everything after the separator is the command, verbatim, including
+		// `--help`. That is the documented contract: `zero sandbox exec -- cmd
+		// --help` must run cmd's help, not ours.
+		command := args[1:]
+		if len(command) == 0 {
+			return nil, errors.New("usage: zero sandbox exec -- <command> [args...]")
+		}
+		return command, nil
+	case "-h", "--help", "help":
+		return nil, errSandboxExecHelp
+	}
+	// The separator-less form, tolerated for interactive use: the first token is
+	// the command, so nothing after it is ours to read. Without this,
+	// `zero sandbox exec mycmd --help` printed OUR help and never ran mycmd,
+	// which is the same contract break as reading past `--`. The help text still
+	// shows the separator, because anything with a leading dash needs it.
+	return args, nil
+}
+
+func writeSandboxExecHelp(w io.Writer) error {
+	_, err := fmt.Fprint(w, `Usage:
+  zero sandbox exec -- <command> [args...]
+
+Runs one command through the real sandbox and exits with its status.
+
+Everything after the -- separator is the command, so its own flags are not
+parsed as Zero's. The resolved backend and enforcement level are written to
+stderr before the command runs, and a downgrade is reported there explicitly.
+
+Examples:
+  zero sandbox exec -- cmd /c echo hello
+  zero sandbox exec -- powershell -Command "Set-Content out.txt x"
+
+`)
+	return err
+}

internal/cli/sandbox_exec_signal_other.go

@@ -0,0 +1,28 @@
+//go:build !windows
+
+package cli
+
+import (
+	"os"
+	"syscall"
+)
+
+// signaledExitStatus reports the conventional shell status for a child that was
+// terminated by a signal, which exec.ExitError cannot represent.
+//
+// ExitCode() returns -1 for a signaled child, and the top level hands that to
+// os.Exit, which truncates it to 255. A child that takes SIGTERM is then
+// indistinguishable from one that exited 255 of its own accord, which breaks the
+// documented status contract for a command whose whole job is to report the
+// child's own status faithfully. 128+signal is what a shell reports and what a
+// harness comparing statuses expects.
+func signaledExitStatus(state *os.ProcessState) (int, bool) {
+	if state == nil {
+		return 0, false
+	}
+	status, ok := state.Sys().(syscall.WaitStatus)
+	if !ok || !status.Signaled() {
+		return 0, false
+	}
+	return 128 + int(status.Signal()), true
+}

internal/cli/sandbox_exec_signal_other_test.go

@@ -0,0 +1,65 @@
+//go:build !windows
+
+package cli
+
+import (
+	"errors"
+	"os/exec"
+	"syscall"
+	"testing"
+)
+
+// A SIGNALED CHILD MUST NOT LOOK LIKE ONE THAT CHOSE TO EXIT 255.
+//
+// `sandbox exec` exists to report the child's own status faithfully, and
+// exec.ExitError cannot represent signal termination: ExitCode() answers -1, and
+// the top level hands that to os.Exit, which truncates it to 255. So a child
+// killed by SIGTERM was indistinguishable from an ordinary exit of 255, and a
+// harness comparing statuses could not tell a refusal from a kill.
+//
+// Driven with a real subprocess and a real signal rather than a synthetic
+// WaitStatus, because the mapping is only correct if the OS agrees with it.
+func TestSignaledChildReportsTheConventionalStatus(t *testing.T) {
+	for _, testCase := range []struct {
+		name   string
+		script string
+		want   int
+	}{
+		{name: "SIGTERM", script: "kill -TERM $$; sleep 5", want: 128 + int(syscall.SIGTERM)},
+		{name: "SIGINT", script: "kill -INT $$; sleep 5", want: 128 + int(syscall.SIGINT)},
+	} {
+		t.Run(testCase.name, func(t *testing.T) {
+			err := exec.Command("/bin/sh", "-c", testCase.script).Run()
+			var exitErr *exec.ExitError
+			if !errors.As(err, &exitErr) {
+				t.Fatalf("SETUP INVALID: the child did not end with an ExitError: %v", err)
+			}
+			// The behaviour being corrected: the integer alone cannot say this.
+			if code := exitErr.ExitCode(); code != -1 {
+				t.Fatalf("SETUP INVALID: a signaled child reported exit code %d, expected -1 on this platform", code)
+			}
+			status, signaled := signaledExitStatus(exitErr.ProcessState)
+			if !signaled {
+				t.Fatal("a signaled child was not recognised as signaled, so it would be reported as exit 255")
+			}
+			if status != testCase.want {
+				t.Fatalf("status = %d, want %d (128 + signal), which is what a shell reports", status, testCase.want)
+			}
+		})
+	}
+}
+
+// An ordinary non-zero exit is untouched: it has a real code and must keep it.
+func TestOrdinaryExitIsNotTreatedAsSignaled(t *testing.T) {
+	err := exec.Command("/bin/sh", "-c", "exit 3").Run()
+	var exitErr *exec.ExitError
+	if !errors.As(err, &exitErr) {
+		t.Fatalf("SETUP INVALID: the child did not end with an ExitError: %v", err)
+	}
+	if _, signaled := signaledExitStatus(exitErr.ProcessState); signaled {
+		t.Fatal("an ordinary exit was reported as signaled, which would rewrite its status")
+	}
+	if code := exitErr.ExitCode(); code != 3 {
+		t.Fatalf("exit code = %d, want the child's own 3", code)
+	}
+}

internal/cli/sandbox_exec_signal_windows.go

@@ -0,0 +1,12 @@
+//go:build windows
+
+package cli
+
+import "os"
+
+// signaledExitStatus has no Windows counterpart: a process there ends with an
+// exit code, and there is no signal to fold into one. Windows keeps the exit
+// code exec.ExitError already reports.
+func signaledExitStatus(*os.ProcessState) (int, bool) {
+	return 0, false
+}