feat(sandbox): actionable violation message for lockdown network denials (#373)

sandbox/platform/seatbelt_diagnostics_darwin.go

@@ -143,6 +143,14 @@ func extractSeatbeltViolations(entries []seatbeltLogEntry, runID string) []sandb
 			target = extractSeatbeltDeniedToken(entry.EventMessage, payload)
 		}
 
+		// The lockdown deny marker (target=direct) is authoritative for the
+		// human message even when the raw operand is path-shaped (e.g. the
+		// mDNSResponder unix socket); Target keeps the denied operand.
+		labelTarget := target
+		if labelKind == seatbeltKindNetworkOutbound && payload.Target == seatbeltLockdownTargetDirect {
+			labelTarget = payload.Target
+		}
+
 		violations = append(violations, sandbox.Violation{
 			Kind:       kind,
 			RawKind:    payload.Kind,
@@ -150,7 +158,7 @@ func extractSeatbeltViolations(entries []seatbeltLogEntry, runID string) []sandb
 			RuleTarget: payload.Target,
 			Process:    process,
 			RawLog:     strings.TrimSpace(entry.EventMessage),
-			RuleLabel:  summarizeSeatbeltViolation(labelKind, target),
+			RuleLabel:  summarizeSeatbeltViolation(labelKind, labelTarget),
 		})
 	}
 
@@ -196,8 +204,8 @@ func inferSeatbeltKindFromRawLog(raw string) (sandbox.ViolationKind, string, boo
 		return sandbox.ViolationKindExec, "process-exec", true
 	case verb == "network-bind":
 		return sandbox.ViolationKindNetworkBind, "network-bind", true
-	case verb == "network-outbound":
-		return sandbox.ViolationKindNetworkConnect, "network-outbound", true
+	case verb == seatbeltKindNetworkOutbound:
+		return sandbox.ViolationKindNetworkConnect, seatbeltKindNetworkOutbound, true
 	}
 
 	return sandbox.ViolationKindGenericDeny, "", false
@@ -323,7 +331,10 @@ func summarizeSeatbeltViolation(kind, target string) string {
 			return "network bind denied"
 		}
 		return fmt.Sprintf("network bind denied: %s", target)
-	case "network-outbound":
+	case seatbeltKindNetworkOutbound:
+		if target == seatbeltLockdownTargetDirect {
+			return "direct network access blocked by network_via_proxy_only — traffic must flow through the PMG proxy (a tool may have ignored HTTP_PROXY/HTTPS_PROXY)"
+		}
 		if target == "" {
 			return "network connect denied"
 		}