@machina.ai/cell-cli-core 1.38.1-rc2 → 1.40.1-rc2

package/dist/src/sandbox/linux/bwrapArgsBuilder.js

@@ -4,154 +4,133 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import fs from 'node:fs';
-import { join, dirname, normalize } from 'node:path';
-import { GOVERNANCE_FILES, getSecretFileFindArgs, sanitizePaths, } from '../../services/sandboxManager.js';
-import { tryRealpath, resolveGitWorktreePaths, isErrnoException, } from '../utils/fsUtils.js';
+import { join, dirname } from 'node:path';
+import { GOVERNANCE_FILES, getSecretFileFindArgs, } from '../../services/sandboxManager.js';
+import { isErrnoException } from '../utils/fsUtils.js';
 import { spawnAsync } from '../../utils/shell-utils.js';
 import { debugLogger } from '../../utils/debugLogger.js';
+import { toPathKey } from '../../utils/paths.js';
 /**
  * Builds the list of bubblewrap arguments based on the provided options.
  */
 export async function buildBwrapArgs(options) {
+    const { resolvedPaths, workspaceWrite, networkAccess, maskFilePath, isReadOnlyCommand, } = options;
+    const { workspace } = resolvedPaths;
     const bwrapArgs = [
         '--unshare-all',
         '--new-session', // Isolate session
         '--die-with-parent', // Prevent orphaned runaway processes
     ];
-    if (options.networkAccess || options.additionalPermissions.network) {
+    if (networkAccess) {
         bwrapArgs.push('--share-net');
     }
     bwrapArgs.push('--ro-bind', '/', '/', '--dev', // Creates a safe, minimal /dev (replaces --dev-bind)
     '/dev', '--proc', // Creates a fresh procfs for the unshared PID namespace
     '/proc', '--tmpfs', // Provides an isolated, writable /tmp directory
     '/tmp');
-    const workspacePath = tryRealpath(options.workspace);
-    const bindFlag = options.workspaceWrite ? '--bind-try' : '--ro-bind-try';
-    if (options.workspaceWrite) {
-        bwrapArgs.push('--bind-try', options.workspace, options.workspace);
-        if (workspacePath !== options.workspace) {
-            bwrapArgs.push('--bind-try', workspacePath, workspacePath);
-        }
-    }
-    else {
-        bwrapArgs.push('--ro-bind-try', options.workspace, options.workspace);
-        if (workspacePath !== options.workspace) {
-            bwrapArgs.push('--ro-bind-try', workspacePath, workspacePath);
-        }
+    const mounts = [];
+    const bindFlag = workspaceWrite ? '--bind-try' : '--ro-bind-try';
+    mounts.push({
+        type: bindFlag,
+        src: workspace.original,
+        dest: workspace.original,
+    });
+    if (workspace.resolved !== workspace.original) {
+        mounts.push({
+            type: bindFlag,
+            src: workspace.resolved,
+            dest: workspace.resolved,
+        });
     }
-    const { worktreeGitDir, mainGitDir } = resolveGitWorktreePaths(workspacePath);
-    if (worktreeGitDir) {
-        bwrapArgs.push(bindFlag, worktreeGitDir, worktreeGitDir);
+    for (const includeDir of resolvedPaths.globalIncludes) {
+        mounts.push({ type: '--ro-bind-try', src: includeDir, dest: includeDir });
     }
-    if (mainGitDir) {
-        bwrapArgs.push(bindFlag, mainGitDir, mainGitDir);
-    }
-    const includeDirs = sanitizePaths(options.includeDirectories);
-    for (const includeDir of includeDirs) {
-        try {
-            const resolved = tryRealpath(includeDir);
-            bwrapArgs.push('--ro-bind-try', resolved, resolved);
-        }
-        catch {
-            // Ignore
+    for (const allowedPath of resolvedPaths.policyAllowed) {
+        if (fs.existsSync(allowedPath)) {
+            mounts.push({ type: '--bind-try', src: allowedPath, dest: allowedPath });
+        }
+        else {
+            const parent = dirname(allowedPath);
+            mounts.push({
+                type: isReadOnlyCommand ? '--ro-bind-try' : '--bind-try',
+                src: parent,
+                dest: parent,
+            });
         }
     }
-    const normalizedWorkspace = normalize(workspacePath).replace(/\/$/, '');
-    for (const allowedPath of options.allowedPaths) {
-        const resolved = tryRealpath(allowedPath);
-        if (!fs.existsSync(resolved)) {
-            // If the path doesn't exist, we still want to allow access to its parent
-            // if it's explicitly allowed, to enable creating it.
-            try {
-                const resolvedParent = tryRealpath(dirname(resolved));
-                bwrapArgs.push(options.isWriteCommand ? '--bind-try' : bindFlag, resolvedParent, resolvedParent);
-            }
-            catch {
-                // Ignore
-            }
-            continue;
-        }
-        const normalizedAllowedPath = normalize(resolved).replace(/\/$/, '');
-        if (normalizedAllowedPath !== normalizedWorkspace) {
-            bwrapArgs.push('--bind-try', resolved, resolved);
-        }
+    for (const p of resolvedPaths.policyRead) {
+        mounts.push({ type: '--ro-bind-try', src: p, dest: p });
     }
-    const additionalReads = sanitizePaths(options.additionalPermissions.fileSystem?.read);
-    for (const p of additionalReads) {
-        try {
-            const safeResolvedPath = tryRealpath(p);
-            bwrapArgs.push('--ro-bind-try', safeResolvedPath, safeResolvedPath);
-        }
-        catch (e) {
-            debugLogger.warn(e instanceof Error ? e.message : String(e));
-        }
-    }
-    const additionalWrites = sanitizePaths(options.additionalPermissions.fileSystem?.write);
-    for (const p of additionalWrites) {
-        try {
-            const safeResolvedPath = tryRealpath(p);
-            bwrapArgs.push('--bind-try', safeResolvedPath, safeResolvedPath);
-        }
-        catch (e) {
-            debugLogger.warn(e instanceof Error ? e.message : String(e));
-        }
+    // Collect explicit additional write permissions.
+    for (const p of resolvedPaths.policyWrite) {
+        mounts.push({ type: '--bind-try', src: p, dest: p });
     }
+    const policyWriteKeys = new Set(resolvedPaths.policyWrite.map(toPathKey));
     for (const file of GOVERNANCE_FILES) {
-        const filePath = join(options.workspace, file.path);
-        const realPath = tryRealpath(filePath);
-        bwrapArgs.push('--ro-bind', filePath, filePath);
-        if (realPath !== filePath) {
-            bwrapArgs.push('--ro-bind', realPath, realPath);
+        const filePath = join(workspace.original, file.path);
+        const realPath = join(workspace.resolved, file.path);
+        const isExplicitlyWritable = policyWriteKeys.has(toPathKey(filePath)) ||
+            policyWriteKeys.has(toPathKey(realPath));
+        // If the workspace is writable, we allow editing .gitignore and .geminiignore by default.
+        // .git remains protected unless explicitly requested (e.g. for git commands).
+        const isImplicitlyWritable = workspaceWrite && file.path !== '.git';
+        if (!isExplicitlyWritable && !isImplicitlyWritable) {
+            mounts.push({ type: '--ro-bind', src: filePath, dest: filePath });
+            if (realPath !== filePath) {
+                mounts.push({ type: '--ro-bind', src: realPath, dest: realPath });
+            }
         }
     }
-    for (const p of options.forbiddenPaths) {
-        let resolved;
-        try {
-            resolved = tryRealpath(p); // Forbidden paths should still resolve to block the real path
-            if (!fs.existsSync(resolved))
-                continue;
+    // Grant read-only access to git worktrees/submodules.
+    if (resolvedPaths.gitWorktree) {
+        const { worktreeGitDir, mainGitDir } = resolvedPaths.gitWorktree;
+        if (worktreeGitDir && !policyWriteKeys.has(toPathKey(worktreeGitDir))) {
+            mounts.push({
+                type: '--ro-bind-try',
+                src: worktreeGitDir,
+                dest: worktreeGitDir,
+            });
+        }
+        if (mainGitDir && !policyWriteKeys.has(toPathKey(mainGitDir))) {
+            mounts.push({
+                type: '--ro-bind-try',
+                src: mainGitDir,
+                dest: mainGitDir,
+            });
         }
-        catch (e) {
-            debugLogger.warn(`Failed to resolve forbidden path ${p}: ${e instanceof Error ? e.message : String(e)}`);
-            bwrapArgs.push('--ro-bind', '/dev/null', p);
+    }
+    for (const p of resolvedPaths.forbidden) {
+        if (!fs.existsSync(p))
             continue;
-        }
         try {
-            const stat = fs.statSync(resolved);
+            const stat = fs.statSync(p);
             if (stat.isDirectory()) {
-                bwrapArgs.push('--tmpfs', resolved, '--remount-ro', resolved);
+                mounts.push({ type: '--tmpfs-ro', dest: p });
             }
             else {
-                bwrapArgs.push('--ro-bind', '/dev/null', resolved);
+                mounts.push({ type: '--ro-bind', src: '/dev/null', dest: p });
             }
         }
         catch (e) {
             if (isErrnoException(e) && e.code === 'ENOENT') {
-                bwrapArgs.push('--symlink', '/dev/null', resolved);
+                mounts.push({ type: '--symlink', src: '/dev/null', dest: p });
             }
             else {
-                debugLogger.warn(`Failed to stat forbidden path ${resolved}: ${e instanceof Error ? e.message : String(e)}`);
-                bwrapArgs.push('--ro-bind', '/dev/null', resolved);
+                debugLogger.warn(`Failed to secure forbidden path ${p}: ${e instanceof Error ? e.message : String(e)}`);
+                mounts.push({ type: '--ro-bind', src: '/dev/null', dest: p });
             }
         }
     }
     // Mask secret files (.env, .env.*)
-    const secretArgs = await getSecretFilesArgs(options.workspace, options.allowedPaths, options.maskFilePath);
-    bwrapArgs.push(...secretArgs);
-    return bwrapArgs;
-}
-/**
- * Generates bubblewrap arguments to mask secret files.
- */
-async function getSecretFilesArgs(workspace, allowedPaths, maskPath) {
-    const args = [];
-    const searchDirs = new Set([workspace, ...allowedPaths]);
+    const searchDirs = new Set([
+        resolvedPaths.workspace.original,
+        resolvedPaths.workspace.resolved,
+        ...resolvedPaths.policyAllowed,
+        ...resolvedPaths.globalIncludes,
+    ]);
     const findPatterns = getSecretFileFindArgs();
     for (const dir of searchDirs) {
         try {
-            // Use the native 'find' command for performance and to catch nested secrets.
-            // We limit depth to 3 to keep it fast while covering common nested structures.
-            // We use -prune to skip heavy directories efficiently while matching dotfiles.
             const findResult = await spawnAsync('find', [
                 dir,
                 '-maxdepth',
@@ -187,7 +166,7 @@ async function getSecretFilesArgs(workspace, allowedPaths, maskPath) {
             const files = findResult.stdout.toString().split('\0');
             for (const file of files) {
                 if (file.trim()) {
-                    args.push('--bind', maskPath, file.trim());
+                    mounts.push({ type: '--bind', src: maskFilePath, dest: file.trim() });
                 }
             }
         }
@@ -195,6 +174,18 @@ async function getSecretFilesArgs(workspace, allowedPaths, maskPath) {
             debugLogger.log(`LinuxSandboxManager: Failed to find or mask secret files in ${dir}`, e);
         }
     }
-    return args;
+    // Sort mounts by destination path length to ensure parents are bound before children.
+    // This prevents hierarchical masking where a parent mount would hide a child mount.
+    mounts.sort((a, b) => a.dest.length - b.dest.length);
+    // Emit final bwrap arguments
+    for (const m of mounts) {
+        if (m.type === '--tmpfs-ro') {
+            bwrapArgs.push('--tmpfs', m.dest, '--remount-ro', m.dest);
+        }
+        else {
+            bwrapArgs.push(m.type, m.src, m.dest);
+        }
+    }
+    return bwrapArgs;
 }
 //# sourceMappingURL=bwrapArgsBuilder.js.map

package/dist/src/sandbox/linux/bwrapArgsBuilder.js.map

@@ -1 +1 @@
-{"version":3,"file":"bwrapArgsBuilder.js","sourceRoot":"","sources":["../../../../src/sandbox/linux/bwrapArgsBuilder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAEL,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,GACd,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAiBzD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAyB;IAEzB,MAAM,SAAS,GAAa;QAC1B,eAAe;QACf,eAAe,EAAE,kBAAkB;QACnC,mBAAmB,EAAE,qCAAqC;KAC3D,CAAC;IAEF,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,CAAC;QACnE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAChC,CAAC;IAED,SAAS,CAAC,IAAI,CACZ,WAAW,EACX,GAAG,EACH,GAAG,EACH,OAAO,EAAE,qDAAqD;IAC9D,MAAM,EACN,QAAQ,EAAE,wDAAwD;IAClE,OAAO,EACP,SAAS,EAAE,gDAAgD;IAC3D,MAAM,CACP,CAAC;IAEF,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC;IAEzE,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,aAAa,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;YACxC,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,aAAa,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;YACxC,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAC;IAC9E,IAAI,cAAc,EAAE,CAAC;QACnB,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9D,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;YACzC,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxE,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,yEAAyE;YACzE,qDAAqD;YACrD,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACtD,SAAS,CAAC,IAAI,CACZ,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAChD,cAAc,EACd,cAAc,CACf,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,qBAAqB,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,qBAAqB,KAAK,mBAAmB,EAAE,CAAC;YAClD,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,aAAa,CACnC,OAAO,CAAC,qBAAqB,CAAC,UAAU,EAAE,IAAI,CAC/C,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YACxC,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,WAAW,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,aAAa,CACpC,OAAO,CAAC,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAChD,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YACxC,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,WAAW,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACvC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QACvC,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,8DAA8D;YACzF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,SAAS;QACzC,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,WAAW,CAAC,IAAI,CACd,oCAAoC,CAAC,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACvF,CAAC;YACF,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,IAAI,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/C,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,IAAI,CACd,iCAAiC,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAC3F,CAAC;gBACF,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CACzC,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,YAAY,CACrB,CAAC;IACF,SAAS,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;IAE9B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,kBAAkB,CAC/B,SAAiB,EACjB,YAAsB,EACtB,QAAgB;IAEhB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAE7C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,6EAA6E;YAC7E,+EAA+E;YAC/E,+EAA+E;YAC/E,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE;gBAC1C,GAAG;gBACH,WAAW;gBACX,GAAG;gBACH,OAAO;gBACP,GAAG;gBACH,GAAG;gBACH,OAAO;gBACP,MAAM;gBACN,IAAI;gBACJ,OAAO;gBACP,cAAc;gBACd,IAAI;gBACJ,OAAO;gBACP,OAAO;gBACP,IAAI;gBACJ,OAAO;gBACP,aAAa;gBACb,IAAI;gBACJ,OAAO;gBACP,MAAM;gBACN,IAAI;gBACJ,OAAO;gBACP,OAAO;gBACP,GAAG;gBACH,QAAQ;gBACR,IAAI;gBACJ,OAAO;gBACP,GAAG;gBACH,GAAG,YAAY;gBACf,SAAS;aACV,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;oBAChB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,WAAW,CAAC,GAAG,CACb,+DAA+D,GAAG,EAAE,EACpE,CAAC,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"bwrapArgsBuilder.js","sourceRoot":"","sources":["../../../../src/sandbox/linux/bwrapArgsBuilder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,gBAAgB,EAChB,qBAAqB,GAEtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAajD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAyB;IAEzB,MAAM,EACJ,aAAa,EACb,cAAc,EACd,aAAa,EACb,YAAY,EACZ,iBAAiB,GAClB,GAAG,OAAO,CAAC;IACZ,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC;IAEpC,MAAM,SAAS,GAAa;QAC1B,eAAe;QACf,eAAe,EAAE,kBAAkB;QACnC,mBAAmB,EAAE,qCAAqC;KAC3D,CAAC;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAChC,CAAC;IAED,SAAS,CAAC,IAAI,CACZ,WAAW,EACX,GAAG,EACH,GAAG,EACH,OAAO,EAAE,qDAAqD;IAC9D,MAAM,EACN,QAAQ,EAAE,wDAAwD;IAClE,OAAO,EACP,SAAS,EAAE,gDAAgD;IAC3D,MAAM,CACP,CAAC;IAiBF,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,MAAM,QAAQ,GAAc,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC;IAC5E,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,SAAS,CAAC,QAAQ;QACvB,IAAI,EAAE,SAAS,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,SAAS,CAAC,QAAQ;YACvB,IAAI,EAAE,SAAS,CAAC,QAAQ;SACzB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,aAAa,CAAC,cAAc,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,aAAa,CAAC,aAAa,EAAE,CAAC;QACtD,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY;gBACxD,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,iDAAiD;IACjD,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAE1E,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAErD,MAAM,oBAAoB,GACxB,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACxC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE3C,0FAA0F;QAC1F,8EAA8E;QAC9E,MAAM,oBAAoB,GAAG,cAAc,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC;QAEpE,IAAI,CAAC,oBAAoB,IAAI,CAAC,oBAAoB,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAClE,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,WAAW,CAAC;QACjE,IAAI,cAAc,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,cAAc;gBACnB,IAAI,EAAE,cAAc;aACrB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,UAAU;gBACf,IAAI,EAAE,UAAU;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,SAAS;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,IAAI,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,IAAI,CACd,mCAAmC,CAAC,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACtF,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;QACzB,aAAa,CAAC,SAAS,CAAC,QAAQ;QAChC,aAAa,CAAC,SAAS,CAAC,QAAQ;QAChC,GAAG,aAAa,CAAC,aAAa;QAC9B,GAAG,aAAa,CAAC,cAAc;KAChC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAE7C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE;gBAC1C,GAAG;gBACH,WAAW;gBACX,GAAG;gBACH,OAAO;gBACP,GAAG;gBACH,GAAG;gBACH,OAAO;gBACP,MAAM;gBACN,IAAI;gBACJ,OAAO;gBACP,cAAc;gBACd,IAAI;gBACJ,OAAO;gBACP,OAAO;gBACP,IAAI;gBACJ,OAAO;gBACP,aAAa;gBACb,IAAI;gBACJ,OAAO;gBACP,MAAM;gBACN,IAAI;gBACJ,OAAO;gBACP,OAAO;gBACP,GAAG;gBACH,QAAQ;gBACR,IAAI;gBACJ,OAAO;gBACP,GAAG;gBACH,GAAG,YAAY;gBACf,SAAS;aACV,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;oBAChB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,WAAW,CAAC,GAAG,CACb,+DAA+D,GAAG,EAAE,EACpE,CAAC,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sFAAsF;IACtF,oFAAoF;IACpF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAErD,6BAA6B;IAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC5B,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/src/sandbox/linux/bwrapArgsBuilder.test.js

@@ -8,6 +8,7 @@ import { buildBwrapArgs } from './bwrapArgsBuilder.js';
 import fs from 'node:fs';
 import * as shellUtils from '../../utils/shell-utils.js';
 import os from 'node:os';
+import {} from '../../services/sandboxManager.js';
 vi.mock('node:fs', async () => {
     const actual = await vi.importActual('node:fs');
     return {
@@ -53,6 +54,18 @@ vi.mock('../../utils/shell-utils.js', async (importOriginal) => {
 });
 describe.skipIf(os.platform() === 'win32')('buildBwrapArgs', () => {
     const workspace = '/home/user/workspace';
+    const createResolvedPaths = (overrides = {}) => ({
+        workspace: {
+            original: workspace,
+            resolved: workspace,
+        },
+        forbidden: [],
+        globalIncludes: [],
+        policyAllowed: [],
+        policyRead: [],
+        policyWrite: [],
+        ...overrides,
+    });
     beforeEach(() => {
         vi.clearAllMocks();
         vi.mocked(fs.existsSync).mockReturnValue(true);
@@ -62,15 +75,11 @@ describe.skipIf(os.platform() === 'win32')('buildBwrapArgs', () => {
         vi.restoreAllMocks();
     });
     const defaultOptions = {
-        workspace,
+        resolvedPaths: createResolvedPaths(),
         workspaceWrite: false,
         networkAccess: false,
-        allowedPaths: [],
-        forbiddenPaths: [],
-        additionalPermissions: {},
-        includeDirectories: [],
         maskFilePath: '/tmp/mask',
-        isWriteCommand: false,
+        isReadOnlyCommand: false,
     };
     it('should correctly format the base arguments', async () => {
         const args = await buildBwrapArgs(defaultOptions);
@@ -91,14 +100,14 @@ describe.skipIf(os.platform() === 'win32')('buildBwrapArgs', () => {
             workspace,
             workspace,
             '--ro-bind',
+            `${workspace}/.git`,
+            `${workspace}/.git`,
+            '--ro-bind',
             `${workspace}/.gitignore`,
             `${workspace}/.gitignore`,
             '--ro-bind',
             `${workspace}/.geminiignore`,
             `${workspace}/.geminiignore`,
-            '--ro-bind',
-            `${workspace}/.git`,
-            `${workspace}/.git`,
         ]);
     });
     it('binds workspace read-write when workspaceWrite is true', async () => {
@@ -120,35 +129,40 @@ describe.skipIf(os.platform() === 'win32')('buildBwrapArgs', () => {
     it('maps explicit write permissions to --bind-try', async () => {
         const args = await buildBwrapArgs({
             ...defaultOptions,
-            additionalPermissions: {
-                fileSystem: { write: ['/home/user/workspace/out/dir'] },
-            },
+            resolvedPaths: createResolvedPaths({
+                policyWrite: ['/home/user/workspace/out/dir'],
+            }),
         });
         const index = args.indexOf('--bind-try');
         expect(index).not.toBe(-1);
         expect(args[index + 1]).toBe('/home/user/workspace/out/dir');
     });
     it('should protect both the symlink and the real path of governance files', async () => {
-        vi.mocked(fs.realpathSync).mockImplementation((p) => {
-            if (p.toString() === `${workspace}/.gitignore`)
-                return '/shared/global.gitignore';
-            return p.toString();
+        const args = await buildBwrapArgs({
+            ...defaultOptions,
+            resolvedPaths: createResolvedPaths({
+                workspace: {
+                    original: workspace,
+                    resolved: '/shared/global-workspace',
+                },
+            }),
         });
-        const args = await buildBwrapArgs(defaultOptions);
         expect(args).toContain('--ro-bind');
         expect(args).toContain(`${workspace}/.gitignore`);
-        expect(args).toContain('/shared/global.gitignore');
+        expect(args).toContain('/shared/global-workspace/.gitignore');
     });
-    it('should parameterize allowed paths and normalize them', async () => {
+    it('should parameterize allowed paths', async () => {
         const args = await buildBwrapArgs({
             ...defaultOptions,
-            allowedPaths: ['/tmp/cache', '/opt/tools', workspace],
+            resolvedPaths: createResolvedPaths({
+                policyAllowed: ['/tmp/cache', '/opt/tools'],
+            }),
         });
         expect(args).toContain('--bind-try');
         expect(args[args.indexOf('/tmp/cache') - 1]).toBe('--bind-try');
         expect(args[args.indexOf('/opt/tools') - 1]).toBe('--bind-try');
     });
-    it('should bind the parent directory of a non-existent path', async () => {
+    it('should bind the parent directory of a non-existent path with --bind-try when isReadOnlyCommand is false', async () => {
         vi.mocked(fs.existsSync).mockImplementation((p) => {
             if (p === '/home/user/workspace/new-file.txt')
                 return false;
@@ -156,14 +170,34 @@ describe.skipIf(os.platform() === 'win32')('buildBwrapArgs', () => {
         });
         const args = await buildBwrapArgs({
             ...defaultOptions,
-            allowedPaths: ['/home/user/workspace/new-file.txt'],
-            isWriteCommand: true,
+            isReadOnlyCommand: false,
+            resolvedPaths: createResolvedPaths({
+                policyAllowed: ['/home/user/workspace/new-file.txt'],
+            }),
         });
         const parentDir = '/home/user/workspace';
         const bindIndex = args.lastIndexOf(parentDir);
         expect(bindIndex).not.toBe(-1);
         expect(args[bindIndex - 2]).toBe('--bind-try');
     });
+    it('should bind the parent directory of a non-existent path with --ro-bind-try when isReadOnlyCommand is true', async () => {
+        vi.mocked(fs.existsSync).mockImplementation((p) => {
+            if (p === '/home/user/workspace/new-file.txt')
+                return false;
+            return true;
+        });
+        const args = await buildBwrapArgs({
+            ...defaultOptions,
+            isReadOnlyCommand: true,
+            resolvedPaths: createResolvedPaths({
+                policyAllowed: ['/home/user/workspace/new-file.txt'],
+            }),
+        });
+        const parentDir = '/home/user/workspace';
+        const bindIndex = args.lastIndexOf(parentDir);
+        expect(bindIndex).not.toBe(-1);
+        expect(args[bindIndex - 2]).toBe('--ro-bind-try');
+    });
     it('should parameterize forbidden paths and explicitly deny them', async () => {
         vi.mocked(fs.statSync).mockImplementation((p) => {
             if (p.toString().includes('cache')) {
@@ -173,7 +207,9 @@ describe.skipIf(os.platform() === 'win32')('buildBwrapArgs', () => {
         });
         const args = await buildBwrapArgs({
             ...defaultOptions,
-            forbiddenPaths: ['/tmp/cache', '/opt/secret.txt'],
+            resolvedPaths: createResolvedPaths({
+                forbidden: ['/tmp/cache', '/opt/secret.txt'],
+            }),
         });
         const cacheIndex = args.indexOf('/tmp/cache');
         expect(args[cacheIndex - 1]).toBe('--tmpfs');
@@ -181,41 +217,37 @@ describe.skipIf(os.platform() === 'win32')('buildBwrapArgs', () => {
         expect(args[secretIndex - 2]).toBe('--ro-bind');
         expect(args[secretIndex - 1]).toBe('/dev/null');
     });
-    it('resolves forbidden symlink paths to their real paths', async () => {
+    it('handles resolved forbidden paths', async () => {
         vi.mocked(fs.statSync).mockImplementation(() => ({ isDirectory: () => false }));
-        vi.mocked(fs.realpathSync).mockImplementation((p) => {
-            if (p === '/tmp/forbidden-symlink')
-                return '/opt/real-target.txt';
-            return p.toString();
-        });
         const args = await buildBwrapArgs({
             ...defaultOptions,
-            forbiddenPaths: ['/tmp/forbidden-symlink'],
+            resolvedPaths: createResolvedPaths({
+                forbidden: ['/opt/real-target.txt'],
+            }),
         });
         const secretIndex = args.indexOf('/opt/real-target.txt');
         expect(args[secretIndex - 2]).toBe('--ro-bind');
         expect(args[secretIndex - 1]).toBe('/dev/null');
     });
-    it('masks directory symlinks with tmpfs for both paths', async () => {
+    it('masks directory paths with tmpfs', async () => {
         vi.mocked(fs.statSync).mockImplementation(() => ({ isDirectory: () => true }));
-        vi.mocked(fs.realpathSync).mockImplementation((p) => {
-            if (p === '/tmp/dir-link')
-                return '/opt/real-dir';
-            return p.toString();
-        });
         const args = await buildBwrapArgs({
             ...defaultOptions,
-            forbiddenPaths: ['/tmp/dir-link'],
+            resolvedPaths: createResolvedPaths({
+                forbidden: ['/opt/real-dir'],
+            }),
         });
         const idx = args.indexOf('/opt/real-dir');
         expect(args[idx - 1]).toBe('--tmpfs');
     });
-    it('should override allowed paths if a path is also in forbidden paths', async () => {
+    it('should apply forbidden paths after allowed paths', async () => {
         vi.mocked(fs.statSync).mockImplementation(() => ({ isDirectory: () => true }));
         const args = await buildBwrapArgs({
             ...defaultOptions,
-            forbiddenPaths: ['/tmp/conflict'],
-            allowedPaths: ['/tmp/conflict'],
+            resolvedPaths: createResolvedPaths({
+                policyAllowed: ['/tmp/conflict'],
+                forbidden: ['/tmp/conflict'],
+            }),
         });
         const bindIndex = args.findIndex((a, i) => a === '--bind-try' && args[i + 1] === '/tmp/conflict');
         const tmpfsIndex = args.findIndex((a, i) => a === '--tmpfs' && args[i + 1] === '/tmp/conflict');
@@ -243,5 +275,76 @@ describe.skipIf(os.platform() === 'win32')('buildBwrapArgs', () => {
         expect(args[envIndex - 2]).toBe('--bind');
         expect(args[envIndex - 1]).toBe('/tmp/mask');
     });
+    it('scans globalIncludes for secret files', async () => {
+        const includeDir = '/opt/tools';
+        vi.mocked(shellUtils.spawnAsync).mockImplementation((cmd, args) => {
+            if (cmd === 'find' && args?.[0] === includeDir) {
+                return Promise.resolve({
+                    status: 0,
+                    stdout: Buffer.from(`${includeDir}/.env\0`),
+                });
+            }
+            return Promise.resolve({
+                status: 0,
+                stdout: Buffer.from(''),
+            });
+        });
+        const args = await buildBwrapArgs({
+            ...defaultOptions,
+            resolvedPaths: createResolvedPaths({
+                globalIncludes: [includeDir],
+            }),
+        });
+        expect(args).toContain(`${includeDir}/.env`);
+        const envIndex = args.indexOf(`${includeDir}/.env`);
+        expect(args[envIndex - 2]).toBe('--bind');
+    });
+    it('binds git worktree directories if present', async () => {
+        const worktreeGitDir = '/path/to/worktree/.git';
+        const mainGitDir = '/path/to/main/.git';
+        const args = await buildBwrapArgs({
+            ...defaultOptions,
+            resolvedPaths: createResolvedPaths({
+                gitWorktree: {
+                    worktreeGitDir,
+                    mainGitDir,
+                },
+            }),
+        });
+        expect(args).toContain(worktreeGitDir);
+        expect(args).toContain(mainGitDir);
+        expect(args[args.indexOf(worktreeGitDir) - 1]).toBe('--ro-bind-try');
+        expect(args[args.indexOf(mainGitDir) - 1]).toBe('--ro-bind-try');
+    });
+    it('enforces read-only binding for git worktrees even if workspaceWrite is true', async () => {
+        const worktreeGitDir = '/path/to/worktree/.git';
+        const args = await buildBwrapArgs({
+            ...defaultOptions,
+            workspaceWrite: true,
+            resolvedPaths: createResolvedPaths({
+                gitWorktree: {
+                    worktreeGitDir,
+                },
+            }),
+        });
+        expect(args[args.indexOf(worktreeGitDir) - 1]).toBe('--ro-bind-try');
+    });
+    it('git worktree read-only bindings should override previous policyWrite bindings', async () => {
+        const worktreeGitDir = '/custom/worktree/.git';
+        const args = await buildBwrapArgs({
+            ...defaultOptions,
+            resolvedPaths: createResolvedPaths({
+                policyWrite: ['/custom/worktree'],
+                gitWorktree: {
+                    worktreeGitDir,
+                },
+            }),
+        });
+        const writeBindIndex = args.indexOf('/custom/worktree');
+        const worktreeBindIndex = args.lastIndexOf(worktreeGitDir);
+        expect(writeBindIndex).toBeGreaterThan(-1);
+        expect(worktreeBindIndex).toBeGreaterThan(-1);
+        expect(worktreeBindIndex).toBeGreaterThan(writeBindIndex);
+    });
 });
 //# sourceMappingURL=bwrapArgsBuilder.test.js.map