fix(sandbox): unblock git fetch/commit/add under the write-restricted sandbox

[euxaristia]

Summary

• The sandbox denied every write under .git for shell-executed commands, so git fetch, commit, add, pull, merge, and stash all failed under the default sandbox since they need to write FETCH_HEAD, the index, objects, and refs.
• Narrows the write block to .git/hooks (auto-executing scripts) and .git/config (remote URLs, credential.helper, core.hooksPath), the two subpaths that are actually dangerous to write. The rest of .git is now writable to git subprocesses, since those writes go through git's own consistency checks.
• The separate app-level auto-allow gate for direct file-tool writes (write_file, edit_file, apply_patch) is untouched and still treats all of .git as protected, since a raw byte-level write to .git bypasses git's invariants in a way a git subprocess write does not.

Test plan

• go test ./... passes
• Added TestSeatbeltProfileAllowsGitWritesExceptHooksAndConfig verifying the generated seatbelt profile no longer blanket-denies .git and still denies .git/hooks / .git/config
• Added TestSeatbeltAllowsGitMetadataWritesExceptHooksAndConfig, a real sandbox-exec integration test proving a write to .git/FETCH_HEAD succeeds while writes to .git/hooks/* and .git/config are kernel-denied
• Manually verified git fetch origin on a real clone succeeds end to end through the sandbox engine
• Updated the CLI golden JSON fixture for zero sandbox policy --json

Summary by CodeRabbit

• Bug Fixes
  • Improved workspace sandbox permissions to allow safe Git metadata updates while keeping .git/hooks and .git/config protected.
  • Strengthened protection for sensitive metadata directories, including .zero and .agents.
  • Improved consistency of filesystem restrictions across sandbox environments.

[euxaristia]

Opened against upstream instead: Gitlawb#654

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0170878e-362a-4ff5-94b9-3b9a8fb5c1ba

📥 Commits

Reviewing files that changed from the base of the PR and between aa73a76 and 05719be.

📒 Files selected for processing (5)

• internal/cli/testdata/sandbox_policy_windows_unavailable.golden.json
• internal/sandbox/manager_test.go
• internal/sandbox/profile.go
• internal/sandbox/runner_test.go
• internal/sandbox/seatbelt_integration_darwin_test.go

---

Walkthrough

The sandbox permission profile now allows general .git metadata writes while protecting .git/hooks, .git/config, .zero, and .agents. Unit, golden-file, Seatbelt profile, and Darwin integration tests cover the updated behavior.

Changes

Git metadata protection

Layer / File(s)	Summary
Profile carve-outs internal/sandbox/profile.go, internal/sandbox/manager_test.go, internal/cli/testdata/sandbox_policy_windows_unavailable.golden.json	Workspace write roots now use fully protected metadata names and Git-specific read-only subpaths for .git/hooks and .git/config; profile and golden-file expectations are updated.
Seatbelt enforcement validation internal/sandbox/runner_test.go, internal/sandbox/seatbelt_integration_darwin_test.go	Tests verify general Git metadata writes succeed while hook and config writes are denied.
Estimated code review effort: 3 (Moderate)	~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PermissionProfileFromPolicy
  participant SeatbeltProfile
  participant sandbox-exec
  participant GitWorkspace
  PermissionProfileFromPolicy->>SeatbeltProfile: configure writable root and Git carve-outs
  SeatbeltProfile->>sandbox-exec: generate deny rules for hooks and config
  sandbox-exec->>GitWorkspace: allow .git metadata write
  GitWorkspace-->>sandbox-exec: create FETCH_HEAD
  sandbox-exec->>GitWorkspace: deny .git/hooks and .git/config writes

Loading

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/sandbox-git-metadata-write

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Zero automated PR review

Verdict: No blockers found

Blockers

• None found.

Validation

• [pass] Diff hygiene: git diff --check
• [pass] Tests: go test ./...
• [pass] Build: go run ./cmd/zero-release build
• [pass] Smoke build: go run ./cmd/zero-release smoke

Scope

Head: 05719beabeb5
Changed files (5): internal/cli/testdata/sandbox_policy_windows_unavailable.golden.json, internal/sandbox/manager_test.go, internal/sandbox/profile.go, internal/sandbox/runner_test.go, internal/sandbox/seatbelt_integration_darwin_test.go

This deterministic review checks validation status and basic diff hygiene. A human reviewer still owns product judgment and design quality.