fix(sandbox): tolerate unreadable directories during Linux writable-root scan

[marius-kilocode]

On Linux, the bubblewrap backend prepares every sandboxed process launch by scanning each writable root for deny-name matches (.git) that must be re-mounted read-only. That scan used a bare recursive readdirSync, so a single unreadable directory anywhere beneath a writable path (for example a restricted folder like /kilo/secrets) threw EACCES ... scandir and aborted the entire launch preparation. Every sandboxed tool call then failed with an access error, no matter which path the agent actually tried to write.

The deny-name scan in packages/kilo-sandbox now tolerates per-directory failures instead of aborting setup:

• An unreadable nested directory (EACCES/EPERM) is itself re-bound read-only via --ro-bind. This fails closed: a directory that cannot be enumerated might hide a .git, so the whole subtree is protected rather than silently skipped. Bind-mounting only needs search permission on the ancestors, so the launch succeeds while the directory stays inaccessible and read-only inside the sandbox. Silently skipping would have left a .git writable in the execute-only directory corner.
• A directory that vanishes mid-scan (ENOENT/ENOTDIR race) is skipped.
• An unreadable writable root still fails setup, now with a clear Writable root is not readable: <path> instead of a raw scandir error.
• Any other error still aborts the launch, so nothing ever falls back to unsandboxed execution.

The macOS seatbelt backend is unaffected (deny names are enforced by a kernel-level regex, no filesystem scan), so this only changes the Linux bubblewrap path. Writes inside the restricted directory itself remain impossible: a permission-denied directory rejects writes at the OS level regardless of sandbox setup.

The generated mount layout is covered by new tests that build a writable tree containing a permission-denied subdirectory and assert the launch still constructs, with both the discovered .git and the unreadable directory mounted read-only. Actual bwrap execution has not been exercised yet (development machine is macOS), so one quick smoke check on Linux is worthwhile before merge: create project/ plus a restricted secrets/ inside a writable path, enable the sandbox, and confirm sandboxed writes into project/ succeed while secrets/ stays inaccessible.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (3 files)

• .changeset/sandbox-unreadable-directory-scan.md
• packages/kilo-sandbox/src/bubblewrap.ts
• packages/kilo-sandbox/test/backend.test.ts

---

_{Reviewed by claude-sonnet-5 · Input: 16 · Output: 5.3K · Cached: 308K}

_{Review guidance: REVIEW.md from base branch main}