fix(tool-sandbox): grant command interpreter read of its script

[kipz]

Linked Issue

Closes #1466

Summary

On Linux, when the tool-sandbox is engaged, a #!/usr/bin/env <interp> script's interpreter is launched to run the script inside a per-exec child sandbox that grants the interpreter + its runtime baseline but not the script — which is an argv path, not the launched binary — so the interpreter gets EACCES reading its own script (and its module tree), even when the caller's session already grants the script's directory. This grants the child read of argv paths the agent's outer sandbox already permits, re-using the covering outer read grant so dependency trees resolve; bounded by outer_caps, so the child gains nothing the caller lacked. When such a script is matched, it also grants the session TLS-intercept trust bundle (otherwise given only to commands with their own proxy route), so the interpreter can make the caller's HTTPS calls.

Agent Disclosure (if applicable)

• This PR was authored by an AI agent (Claude) on behalf of the repository owner.
• Areas changed: crates/nono-cli/src/tool-sandbox/platform/linux.rs (build_child_caps + new add_interpreted_script_read/_inner); reviewed CLAUDE.md coding/security rules and the sibling handling from fix(tool-sandbox): grant env-shebang scripts their re-exec interpreter #1394.
• The grant is bounded by outer_caps (path_covered_with_access) so it never widens the child beyond the caller's own read set; argv paths are canonicalized before use.

Test Plan

• New unit test interpreted_script_read_grants_covered_script_and_trust_bundle (Linux): asserts a covered script's enclosing outer read grant + the trust bundle are granted, and that an argv path outside outer_caps is not granted. Passes (cargo test -p nono-cli, Linux container).
• Built nono for Linux and verified manually: a #!/usr/bin/env node script run under a profile with command policies now executes (was EACCES on the script before); reads outside the caller's grants remain denied.
• Change is #[cfg(target_os = "linux")]; host make ci clippy/fmt/tests pass (one unrelated attestation-signing test is a known parallel-run flake — passes in isolation).

Checklist

• An issue exists and is linked above
• All commits are signed-off, using DCO
• All new code follows the project's coding standards (CLAUDE.md) and is covered by tests
• Public-facing changes are paired with documentation updates
• Release note has been added to CHANGELOG.md if needed

Agent Compliance Check (Required for AI/Automated PRs)

• I am not prohibited from contributing under this policy
• An issue already exists
• I disclosed that I am an agent in the issue discussion
• I described my intent and approach in the issue discussion
• I reviewed repository coding and security rules for the affected area
• I provided required attribution for reused or adapted code
• I did not use forbidden patterns such as unwrap/expect
• I used NonoError where required
• I validated and canonicalized all relevant paths
• This PR matches the approved or disclosed issue scope

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+306
Lines removed	-2
Total changed	308
Classification	Large (> 300 lines)

Affected crates

• crates/nono-cli — CLI changes. Verify argument parsing, flag documentation, and UX behaviour across supported platforms.

Blast radius — Contained

This PR touches: source code

---

_{Updated automatically on each push to this PR.}

[nogent-nolabs-ai]

nogent code review

1 medium severity bug found.

Findings (not tied to a changed line):

• 🐛 [LOW · bug] crates/nono-cli/src/tool-sandbox/platform/macos.rs:2590 — There is a platform divergence where shebang script interpreter read support (add_interpreted_script_read) is entirely absent on macOS. This causes shebang script execution to fail with EACCES on macOS under restricted policies even when the agent's outer sandbox has read access. Implement equivalent shebang script read capability handling in macOS build_child_caps.

_{Automated code + security review. CI already covers clippy, rustfmt, tests, cargo-audit and commit-lint.}

[kipz]

Thanks — addressed the findings:

• [HIGH · security] CA/grant leaked to any command via argv file path. Real concern, fixed. Note the suggested binary.shape.kind == ShebangScript gate wouldn't work here: the launched binary is the interpreter (/usr/bin/node, kind == Elf) with the script as an argv path, so that gate would disable the fix entirely. Instead the grant now fires only when an argv path is a shebang script whose resolved interpreter is the launched binary (classify_executable_shape + env_shebang_target_interpreter, basename match). curl /path/file (plain file) and curl script.sh (shebang for a different interpreter) both match nothing, so they get neither the read grant nor the trust bundle. Covered by new negative test cases.

• [MEDIUM · bug] path_covered_with_access precheck ignores file capabilities. Removed the precheck entirely; coverage is now decided in the per-capability loop, which handles both file and directory caps.

• [MEDIUM · design] called for all commands. The call stays in build_child_caps, but the shebang-interpreter check above scopes it precisely — ordinary (non-interpreter) commands match nothing, so no argv read grant or trust bundle is added for them.

• [LOW · bug] macOS divergence. This is Linux/Landlock-specific — under macOS Seatbelt the interpreter reads its script without this failure in our testing, so no macOS change is included here. Happy to add the equivalent if a macOS repro surfaces.

[nogent-nolabs-ai]

nogent code review

2 medium findings: relative path skip bug and missing macOS platform implementation.

Findings (not tied to a changed line):

• 🏗️ [MEDIUM · design] crates/nono-cli/src/tool-sandbox/platform/macos.rs:2590 — The script read grant and trust bundle delegation is only implemented for Linux. Sibling handling is missing on macOS under crates/nono-cli/src/tool-sandbox/platform/macos.rs, causing interpreted scripts to still fail with EACCES on macOS.

_{Automated code + security review. CI already covers clippy, rustfmt, tests, cargo-audit and commit-lint.}

[kipz]

Fixed both — the coverage check now runs before the file is opened/classified (is_shebang_script_for is only called once a covering outer_caps grant is found), and relative argv paths are now resolved against request.cwd before canonicalizing instead of being skipped. Added regression tests for both (interpreted_script_read_grants_nothing_for_an_uncovered_script, interpreted_script_read_resolves_relative_argv_against_cwd).