test(core): improve sandbox integration test coverage and fix OS-specific failures

packages/core/src/sandbox/linux/LinuxSandboxManager.ts

@@ -268,7 +268,6 @@ export class LinuxSandboxManager implements SandboxManager {
       workspaceWrite,
       networkAccess: mergedAdditional.network ?? false,
       maskFilePath: this.getMaskFilePath(),
-      isWriteCommand: req.command === '__write',
     });
 
     const bpfPath = getSeccompBpfPath();

packages/core/src/sandbox/linux/bwrapArgsBuilder.test.ts

@@ -92,7 +92,6 @@ describe.skipIf(os.platform() === 'win32')('buildBwrapArgs', () => {
     workspaceWrite: false,
     networkAccess: false,
     maskFilePath: '/tmp/mask',
-    isWriteCommand: false,
   };
 
   it('should correctly format the base arguments', async () => {
@@ -188,7 +187,7 @@ describe.skipIf(os.platform() === 'win32')('buildBwrapArgs', () => {
     expect(args[args.indexOf('/opt/tools') - 1]).toBe('--bind-try');
   });
 
-  it('should bind the parent directory of a non-existent path', async () => {
+  it('should bind the parent directory of a non-existent path with --bind-try', async () => {
     vi.mocked(fs.existsSync).mockImplementation((p) => {
       if (p === '/home/user/workspace/new-file.txt') return false;
       return true;
@@ -199,7 +198,6 @@ describe.skipIf(os.platform() === 'win32')('buildBwrapArgs', () => {
       resolvedPaths: createResolvedPaths({
         policyAllowed: ['/home/user/workspace/new-file.txt'],
       }),
-      isWriteCommand: true,
     });
 
     const parentDir = '/home/user/workspace';

packages/core/src/sandbox/linux/bwrapArgsBuilder.ts

@@ -23,7 +23,6 @@ export interface BwrapArgsOptions {
   workspaceWrite: boolean;
   networkAccess: boolean;
   maskFilePath: string;
-  isWriteCommand: boolean;
 }
 
 /**
@@ -32,13 +31,8 @@ export interface BwrapArgsOptions {
 export async function buildBwrapArgs(
   options: BwrapArgsOptions,
 ): Promise<string[]> {
-  const {
-    resolvedPaths,
-    workspaceWrite,
-    networkAccess,
-    maskFilePath,
-    isWriteCommand,
-  } = options;
+  const { resolvedPaths, workspaceWrite, networkAccess, maskFilePath } =
+    options;
   const { workspace } = resolvedPaths;
 
   const bwrapArgs: string[] = [
@@ -78,11 +72,9 @@ export async function buildBwrapArgs(
     if (fs.existsSync(allowedPath)) {
       bwrapArgs.push('--bind-try', allowedPath, allowedPath);
     } else {
-      // If the path doesn't exist, we still want to allow access to its parent
-      // to enable creating it. Since allowedPath is already resolved by resolveSandboxPaths,
-      // its parent is also correctly resolved.
+      // Bind the parent directory as read-write to allow creating the non-existent path.
       const parent = dirname(allowedPath);
-      bwrapArgs.push(isWriteCommand ? '--bind-try' : bindFlag, parent, parent);
+      bwrapArgs.push('--bind-try', parent, parent);
     }
   }