sandbox network grants don't persist after approving — network access stays denied, fails with context canceled

[Svector-anu]

i think i found a bug with zero's sandbox network permissions.

i was trying to run git push to a gitlawb:// remote. zero prompted me for network access, i clicked allow, but the command still failed with context canceled. i retried several times and approved it each time, but it kept failing.

i checked the sandbox state:

zero sandbox policy
network: deny
backend: macos-seatbelt

and zero sandbox grants list returns:

No persistent sandbox grants.

~/.config/zero/sandbox-grants.json also doesn't exist.

so it looks like clicking allow isn't actually persisting or applying the network grant, and the sandbox continues blocking the network request. the context canceled error also makes it pretty difficult to tell that the sandbox is the cause.

running the same git push outside of zero's sandbox worked fine.

environment

• zero 0.1.0
• macos 15.7.7, sandbox backend macos-seatbelt

repro

$ zero sandbox policy
mode: enforce
network: deny
backend: macos-seatbelt
grants: /Users/macbook/.config/zero/sandbox-grants.json

$ zero sandbox grants list
No persistent sandbox grants.

$ cat ~/.config/zero/sandbox-grants.json
cat: No such file or directory

screenshot

(adding below — will drop it in as a comment)

[Svector-anu]

[PierrunoYT]

Checking now!

[PierrunoYT]

Confirmed a network-classification gap affecting this repro: Zero classified git clone as network-sensitive, but not git push. As a result, the initial approval for git push did not enable network access in the sandbox and the command depended on post-failure denial detection, which is unreliable when a custom transport exits with context canceled.

I opened #726 to classify git push as network access before execution, so approving the prompt applies the temporary network-enabled sandbox profile immediately.

Regression coverage includes the reported custom-remote shape (git push gitlawb main) at both analyzer and risk-classifier layers. Full tests and vet pass; govulncheck reports no vulnerabilities; diff-scoped lint reports 0 issues.

One clarification: an absent sandbox-grants.json, an empty sandbox grants list, and the base policy continuing to show network: deny are expected for allow-once/session network approvals. Network grants are temporary in-memory overlays rather than persistent shell grants.