feat(sandbox): presets — additive workload allowance bundles (#387)

* feat(sandbox): introduce presets - additive workload allowance bundles Presets are named, additive-only bundles of sandbox allowances for a specific workload (git hooks tooling, Astro/Vite/Next.js dev servers). They solve the per-workload tuning friction from #384 without weakening the default posture: no built-in profile references a preset, presets cannot carry deny rules or profile booleans (strict YAML decoding), and mandatory denies still win everywhere except the existing exact-match suppression. - Preset schema with metadata (author, labels) and schema_version gating - Registry over ordered sources (embedded builtin, user dir); builtin wins name collisions; source abstraction is the extension point for a future hosted registry and SafeDep cloud sync - Official presets: git, astro, vite, nextjs (with threat notes) - Overlay/runtime integration: pmg sandbox allow preset=<name> and --sandbox-allow preset=<name>, stored by reference, resolved at apply time, missing presets warn (fail closed) instead of aborting - Profile integration: presets: [...] list resolved after inherits - CLI: pmg sandbox preset list (metadata filters, --json), show (prints YAML with threat notes), lint - Docs: user guide (docs/sandbox-presets.md) and design spec Closes #384 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn * fix(sandbox): address review findings on presets - Presets never modify deny lists: a profile authored deny now survives a preset allowing the same path (deny-beats-allow keeps it enforced). Regression test added. - Profile inspection commands (show, diff, lint) construct the profile registry with the user-aware preset registry so they agree with runtime resolution of custom profiles referencing user presets. - Handle stderr write error when warning about unresolvable presets. - Compute preset show underline from the uncolored header. - Use path.Join for embed.FS reads (slash-separated on all platforms). - Clarify in docs that lint-staged/astro are examples of preset workloads. - Drop the design spec from the PR per review. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn * fix(sandbox): harden preset precedence against authored denies Addresses external security review findings on the preset mechanism: - Bubblewrap: a mandatory write-denied path listed in allow_read lost its protection when a later writable parent bind covered it (bwrap last mount wins) - exactly the git preset shape (allow_read .git/config + allow_write .git/**). The mandatory deny now re-binds the path read-only after all writable mounts instead of being skipped. Regression test asserts mount ordering. Landlock and Seatbelt were unaffected (tests added for the same policy shape on Landlock). - Environment: ScrubEnv is allow-wins, so a preset environment allowance could override a profile-authored deny. Preset env allowances overlapping an authored deny pattern are now dropped at application time (conservative bidirectional glob overlap, fail closed). Surviving entries still opt out of built-in credential scrubbing as intended. - Network: removed allow_outbound from the preset schema. Both platform translators are all-or-nothing for outbound (one allow rule means blanket network access), so a preset outbound entry would silently change network posture far beyond what its YAML conveys. Strict decoding rejects the key. - Added a dual-path expansion equivalence test (profile presets: field vs overlay/--sandbox-allow) and documented the precedence guarantees in docs/sandbox-presets.md. Explicit --sandbox-allow and pmg sandbox allow overrides keep their existing semantics. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn * docs(sandbox): document env and preset allowances in allow command and overlay docs pmg sandbox allow help, the --sandbox-allow flag usage, and the project overlay docs enumerated only read/write/exec/net types. Add env and preset to all of them, with an overlay example for persisting an env allowance and a note on why env entries are not auto-promoted by --last. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn * chore(sandbox): trim preset code comments to corner cases and minimal godocs Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn * fix(sandbox): exact glob intersection for preset env deny overlap The bidirectional literal-text heuristic missed overlapping globs with different literal structure: preset allow AWS_*_KEY and authored deny AWS_SECRET_* both match AWS_SECRET_ACCESS_KEY but neither pattern matches the other's text, so the allowance merged and allow-wins scrubbing exposed the variable. EnvPatternsOverlap now computes exact intersection non-emptiness for the name glob dialect (case-insensitive, '*' any sequence, '?' single char) via memoized DP. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn * fix(sandbox): preset env allowances are exact names, not globs Glob-vs-glob intersection is a losing game: every dialect extension (character classes today) silently reopens the deny-bypass hole. Restricting preset environment allowances to literal variable names makes the authored-deny precedence check exact by construction: each deny pattern is evaluated against the concrete name with the same matcher ScrubEnv uses at runtime, so the decision cannot diverge from enforcement regardless of deny dialect. Removes the glob intersection machinery. Profile and --sandbox-allow env globs are unaffected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn * fix(sandbox): reject mandatory-deny targets in preset paths Preset validation relied on IsSensitiveProjectTarget, which covers fewer files than util.DANGEROUS_FILES. A preset naming .git-credentials, .pgpass, .docker/config.json or .config/gh exactly would exact-match suppress the mandatory deny; .git/config in allow_write would suppress the write protection. Preset paths are now checked against DANGEROUS_FILES (single source of truth), .git/hooks is rejected in any direction, and .git/config is rejected for write/exec while read stays allowed for git repo discovery. Docs state the two deliberate opt-outs precisely. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn * feat(sandbox): preset init and edit commands for community authoring pmg sandbox preset init scaffolds a valid user preset (metadata flags, threat-note template, starter rule) and refuses built-in names since builtins win resolution. pmg sandbox preset edit opens the file via the shared editor package and validates the result, warning when a user preset is shadowed by a built-in. Docs lead with the scaffolded flow and spell out builtin-vs-community provenance in preset list. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn * refactor(sandbox): move mandatory-target matching into util Preset path validation re-encoded knowledge util already owns: the dangerous-files comparison and hardcoded .git/config and .git/hooks strings. util now exports GitConfigPath, GitHooksPath (also used by GetMandatoryDenyPatterns), PathCoveredBy and DangerousFileMatch, and preset validation consumes them so the mandatory deny policy has a single definition. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn --------- Co-authored-by: Claude <noreply@anthropic.com>
2026-08-03 07:24:09 +02:00 · 2026-07-21 15:14:07 +05:30
parent 695a1d739d
commit ee684a29a9
39 changed files with 2895 additions and 49 deletions
@@ -59,7 +59,15 @@ func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string, opts ...app
 		opt(applyConfig)
 	}

-	registry, err := sandbox.NewProfileRegistry(sandbox.WithUserProfileDir(cfg.SandboxProfileDir()))
+	presetRegistry, err := sandbox.NewPresetRegistry(sandbox.WithUserPresetDir(cfg.SandboxPresetDir()))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create preset registry: %w", err)
+	}
+
+	registry, err := sandbox.NewProfileRegistry(
+		sandbox.WithUserProfileDir(cfg.SandboxProfileDir()),
+		sandbox.WithPresetRegistry(presetRegistry),
+	)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create profile registry: %w", err)
 	}
@@ -136,7 +144,7 @@ func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string, opts ...app
 	cwd, _ := os.Getwd()
 	if repoRoot, repoErr := sandbox.ResolveRepoRoot(cwd); repoErr != nil {
 		log.Warnf("Project overlay: resolve repo root: %v", repoErr)
-	} else if _, err := applyProjectOverlay(policy, cfg.SandboxOverlayDir(), repoRoot, cfg.IsLocked()); err != nil {
+	} else if _, err := applyProjectOverlay(policy, cfg.SandboxOverlayDir(), repoRoot, cfg.IsLocked(), presetRegistry); err != nil {
 		log.Warnf("Project overlay: apply: %v", err)
 		// A failed overlay load means the user's saved allowances were silently
 		// dropped. Echo to stderr so users at normal verbosity see why their
@@ -146,7 +154,7 @@ func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string, opts ...app

 	// Apply runtime --sandbox-allow overrides to the policy before execution
 	if len(cfg.SandboxAllowOverrides) > 0 {
-		applyRuntimeOverrides(policy, cfg.SandboxAllowOverrides)
+		applyRuntimeOverrides(policy, cfg.SandboxAllowOverrides, presetRegistry)
 		logSandboxOverrides(policy.Name, cfg.SandboxAllowOverrides)
 	}

@@ -199,9 +207,28 @@ func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string, opts ...app
 // Overrides append to allow lists and remove exact matches from corresponding deny lists
 // so that deny rules don't shadow the explicit override. Only full-path exact matches are
 // removed — glob and wildcard deny patterns are never modified to stay secure by default.
-func applyRuntimeOverrides(policy *sandbox.SandboxPolicy, overrides []config.SandboxAllowOverride) {
+func applyRuntimeOverrides(policy *sandbox.SandboxPolicy, overrides []config.SandboxAllowOverride, presets sandbox.PresetRegistry) {
 	for _, override := range overrides {
 		switch override.Type {
+		case config.SandboxAllowPreset:
+			// A missing preset means fewer allowances (fail closed), so warn
+			// instead of aborting the run.
+			if presets == nil {
+				log.Warnf("Sandbox override: preset %s ignored, no preset registry available", override.Value)
+				continue
+			}
+
+			info, err := presets.Get(override.Value)
+			if err != nil {
+				log.Warnf("Sandbox override: preset %s could not be resolved: %v", override.Value, err)
+				if _, werr := fmt.Fprintf(os.Stderr, "pmg: warning: sandbox preset %q could not be applied: %v\n", override.Value, err); werr != nil {
+					log.Warnf("failed to write preset warning to stderr: %v", werr)
+				}
+				continue
+			}
+
+			log.Infof("Sandbox override: applying preset %s (%s)", override.Value, info.Source)
+			info.Preset.ApplyToPolicy(policy)
 		case config.SandboxAllowRead:
 			log.Infof("Sandbox override: allowing read access to %s", override.Value)
 			policy.Filesystem.AllowRead = append(policy.Filesystem.AllowRead, override.Value)
@@ -286,7 +313,7 @@ func removeExactMatch(slice []string, value string) []string {
 // its entries through applyRuntimeOverrides. Returns the number of entries
 // applied. A nil/missing overlay is a clean no-op. When locked, the overlay
 // is ignored entirely.
-func applyProjectOverlay(policy *sandbox.SandboxPolicy, overlayDir, repoRoot string, locked bool) (int, error) {
+func applyProjectOverlay(policy *sandbox.SandboxPolicy, overlayDir, repoRoot string, locked bool, presets sandbox.PresetRegistry) (int, error) {
 	if locked {
 		log.Debugf("Project overlay: skipping under global_lockdown")
 		return 0, nil
@@ -301,7 +328,7 @@ func applyProjectOverlay(policy *sandbox.SandboxPolicy, overlayDir, repoRoot str
 	}

 	entries := overlay.ToAllowOverrides()
-	applyRuntimeOverrides(policy, entries)
+	applyRuntimeOverrides(policy, entries, presets)
 	// The "+overlay" suffix tags audit events as overlay-sourced.
 	logSandboxOverrides(policy.Name+"+overlay", entries)
 	log.Infof("Project overlay: applied %d saved allowance(s) for %s", len(entries), repoRoot)
@@ -0,0 +1,107 @@
+package executor
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/safedep/dry/utils"
+	"github.com/safedep/pmg/config"
+	"github.com/safedep/pmg/sandbox"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestApplyRuntimeOverridesPreset(t *testing.T) {
+	registry, err := sandbox.NewPresetRegistry()
+	require.NoError(t, err)
+
+	t.Run("expands preset allowances into the policy", func(t *testing.T) {
+		policy := &sandbox.SandboxPolicy{Name: "test"}
+		applyRuntimeOverrides(policy, []config.SandboxAllowOverride{
+			{Type: config.SandboxAllowPreset, Value: "git", Raw: "preset=git"},
+			{Type: config.SandboxAllowPreset, Value: "astro", Raw: "preset=astro"},
+		}, registry)
+
+		assert.Contains(t, policy.Filesystem.AllowRead, "${CWD}/.git/config")
+		assert.Contains(t, policy.Filesystem.AllowWrite, "${CWD}/.git/**")
+		assert.Contains(t, policy.Filesystem.AllowWrite, "${CWD}/.astro/**")
+		assert.Contains(t, policy.Network.AllowBind, "localhost:4321")
+		assert.True(t, utils.SafelyGetValue(policy.AllowNetworkBind))
+	})
+
+	t.Run("unknown preset is a warning, never fatal", func(t *testing.T) {
+		policy := &sandbox.SandboxPolicy{Name: "test"}
+		applyRuntimeOverrides(policy, []config.SandboxAllowOverride{
+			{Type: config.SandboxAllowPreset, Value: "does-not-exist", Raw: "preset=does-not-exist"},
+		}, registry)
+
+		assert.Empty(t, policy.Filesystem.AllowRead)
+		assert.Empty(t, policy.Filesystem.AllowWrite)
+	})
+
+	t.Run("nil registry skips preset entries", func(t *testing.T) {
+		policy := &sandbox.SandboxPolicy{Name: "test"}
+		applyRuntimeOverrides(policy, []config.SandboxAllowOverride{
+			{Type: config.SandboxAllowPreset, Value: "git", Raw: "preset=git"},
+		}, nil)
+
+		assert.Empty(t, policy.Filesystem.AllowRead)
+	})
+}
+
+func TestApplyProjectOverlayWithPresets(t *testing.T) {
+	dir := t.TempDir()
+	repo := "/repo/example"
+	_, err := sandbox.SaveOverlay(dir, repo, &sandbox.Overlay{
+		Allow: []sandbox.OverlayAllow{
+			{Type: config.SandboxAllowPreset, Value: "git"},
+			{Type: config.SandboxAllowWrite, Value: "/repo/example/.astro"},
+		},
+	})
+	require.NoError(t, err)
+
+	registry, err := sandbox.NewPresetRegistry()
+	require.NoError(t, err)
+
+	policy := &sandbox.SandboxPolicy{Name: "test"}
+	applied, err := applyProjectOverlay(policy, dir, repo, false, registry)
+	require.NoError(t, err)
+
+	assert.Equal(t, 2, applied)
+	assert.Contains(t, policy.Filesystem.AllowRead, "${CWD}/.git/config")
+	assert.Contains(t, policy.Filesystem.AllowWrite, "${CWD}/.git/**")
+	assert.Contains(t, policy.Filesystem.AllowWrite, "/repo/example/.astro")
+}
+
+func TestPresetExpansionEquivalentAcrossEntryPaths(t *testing.T) {
+	presetRegistry, err := sandbox.NewPresetRegistry()
+	require.NoError(t, err)
+
+	viaOverride := &sandbox.SandboxPolicy{Name: "test", PackageManagers: []string{"pnpm"}}
+	applyRuntimeOverrides(viaOverride, []config.SandboxAllowOverride{
+		{Type: config.SandboxAllowPreset, Value: "git", Raw: "preset=git"},
+		{Type: config.SandboxAllowPreset, Value: "astro", Raw: "preset=astro"},
+	}, presetRegistry)
+
+	dir := t.TempDir()
+	profilePath := filepath.Join(dir, "via-profile.yml")
+	require.NoError(t, os.WriteFile(profilePath, []byte(`
+name: via-profile
+package_managers: [pnpm]
+presets: [git, astro]
+`), 0o600))
+
+	profileRegistry, err := sandbox.NewProfileRegistry()
+	require.NoError(t, err)
+	viaProfile, err := profileRegistry.LoadCustomProfile(profilePath)
+	require.NoError(t, err)
+
+	assert.Equal(t, viaProfile.Filesystem.AllowRead, viaOverride.Filesystem.AllowRead)
+	assert.Equal(t, viaProfile.Filesystem.AllowWrite, viaOverride.Filesystem.AllowWrite)
+	assert.Equal(t, viaProfile.Network.AllowBind, viaOverride.Network.AllowBind)
+	assert.Equal(t, viaProfile.Environment.Allow, viaOverride.Environment.Allow)
+	assert.Equal(t,
+		utils.SafelyGetValue(viaProfile.AllowNetworkBind),
+		utils.SafelyGetValue(viaOverride.AllowNetworkBind))
+}
@@ -23,7 +23,7 @@ func TestApplyRuntimeOverrides_Read(t *testing.T) {

 	applyRuntimeOverrides(policy, []config.SandboxAllowOverride{
 		{Type: config.SandboxAllowRead, Value: "/new/path", Raw: "read=/new/path"},
-	})
+	}, nil)

 	assert.Contains(t, policy.Filesystem.AllowRead, "/existing")
 	assert.Contains(t, policy.Filesystem.AllowRead, "/new/path")
@@ -38,7 +38,7 @@ func TestApplyRuntimeOverrides_Write(t *testing.T) {

 	applyRuntimeOverrides(policy, []config.SandboxAllowOverride{
 		{Type: config.SandboxAllowWrite, Value: "/new/file", Raw: "write=/new/file"},
-	})
+	}, nil)

 	assert.Contains(t, policy.Filesystem.AllowWrite, "/existing")
 	assert.Contains(t, policy.Filesystem.AllowWrite, "/new/file")
@@ -53,7 +53,7 @@ func TestApplyRuntimeOverrides_Exec(t *testing.T) {

 	applyRuntimeOverrides(policy, []config.SandboxAllowOverride{
 		{Type: config.SandboxAllowExec, Value: "/usr/bin/curl", Raw: "exec=/usr/bin/curl"},
-	})
+	}, nil)

 	assert.Contains(t, policy.Process.AllowExec, "/usr/bin/node")
 	assert.Contains(t, policy.Process.AllowExec, "/usr/bin/curl")
@@ -68,7 +68,7 @@ func TestApplyRuntimeOverrides_Env(t *testing.T) {

 	applyRuntimeOverrides(policy, []config.SandboxAllowOverride{
 		{Type: config.SandboxAllowEnv, Value: "AWS_PROFILE", Raw: "env=AWS_PROFILE"},
-	})
+	}, nil)

 	assert.Contains(t, policy.Environment.Allow, "NPM_TOKEN")
 	assert.Contains(t, policy.Environment.Allow, "AWS_PROFILE")
@@ -104,7 +104,7 @@ func TestScrubEnv_AllowOverrideUnscrubs(t *testing.T) {
 	// Simulate a --sandbox-allow env=AWS_SESSION_TOKEN override having been merged.
 	applyRuntimeOverrides(policy, []config.SandboxAllowOverride{
 		{Type: config.SandboxAllowEnv, Value: "AWS_SESSION_TOKEN", Raw: "env=AWS_SESSION_TOKEN"},
-	})
+	}, nil)

 	cmd := &exec.Cmd{Env: []string{"AWS_SESSION_TOKEN=kept"}}
 	scrubbed := scrubEnv(cmd, policy)
@@ -136,7 +136,7 @@ func TestApplyRuntimeOverrides_NetConnect(t *testing.T) {

 	applyRuntimeOverrides(policy, []config.SandboxAllowOverride{
 		{Type: config.SandboxAllowNetConnect, Value: "example.com:443", Raw: "net-connect=example.com:443"},
-	})
+	}, nil)

 	assert.Contains(t, policy.Network.AllowOutbound, "registry.npmjs.org:443")
 	assert.Contains(t, policy.Network.AllowOutbound, "example.com:443")
@@ -151,7 +151,7 @@ func TestApplyRuntimeOverrides_NetBind(t *testing.T) {

 	applyRuntimeOverrides(policy, []config.SandboxAllowOverride{
 		{Type: config.SandboxAllowNetBind, Value: "127.0.0.1:3000", Raw: "net-bind=127.0.0.1:3000"},
-	})
+	}, nil)

 	assert.Contains(t, policy.Network.AllowBind, "127.0.0.1:3000")
 	assert.NotNil(t, policy.AllowNetworkBind)
@@ -168,7 +168,7 @@ func TestApplyRuntimeOverrides_NetBindPreservesExistingTrue(t *testing.T) {

 	applyRuntimeOverrides(policy, []config.SandboxAllowOverride{
 		{Type: config.SandboxAllowNetBind, Value: "127.0.0.1:3000", Raw: "net-bind=127.0.0.1:3000"},
-	})
+	}, nil)

 	assert.Contains(t, policy.Network.AllowBind, "localhost:8080")
 	assert.Contains(t, policy.Network.AllowBind, "127.0.0.1:3000")
@@ -189,7 +189,7 @@ func TestApplyRuntimeOverrides_MultipleOverrides(t *testing.T) {
 		{Type: config.SandboxAllowNetConnect, Value: "example.com:443", Raw: "net-connect=example.com:443"},
 	}

-	applyRuntimeOverrides(policy, overrides)
+	applyRuntimeOverrides(policy, overrides, nil)

 	assert.Len(t, policy.Filesystem.AllowWrite, 2)
 	assert.Len(t, policy.Process.AllowExec, 1)
@@ -203,7 +203,7 @@ func TestApplyRuntimeOverrides_EmptyOverrides(t *testing.T) {
 		},
 	}

-	applyRuntimeOverrides(policy, []config.SandboxAllowOverride{})
+	applyRuntimeOverrides(policy, []config.SandboxAllowOverride{}, nil)

 	// Policy should be unchanged
 	assert.Equal(t, []string{"/existing"}, policy.Filesystem.AllowWrite)
@@ -228,7 +228,7 @@ func TestApplyRuntimeOverrides_DenyListsUnmodifiedWhenNoConflict(t *testing.T) {
 		{Type: config.SandboxAllowNetConnect, Value: "example.com:443", Raw: "net-connect=example.com:443"},
 	}

-	applyRuntimeOverrides(policy, overrides)
+	applyRuntimeOverrides(policy, overrides, nil)

 	// Deny lists should be unchanged when overrides don't conflict
 	assert.Equal(t, []string{"/protected"}, policy.Filesystem.DenyWrite)
@@ -253,7 +253,7 @@ func TestApplyRuntimeOverrides_RemovesExactDenyConflict(t *testing.T) {
 		{Type: config.SandboxAllowExec, Value: "/bin/bash", Raw: "exec=/bin/bash"},
 	}

-	applyRuntimeOverrides(policy, overrides)
+	applyRuntimeOverrides(policy, overrides, nil)

 	// Exact matches should be removed from deny lists
 	assert.Equal(t, []string{"/other"}, policy.Filesystem.DenyRead)
@@ -283,7 +283,7 @@ func TestApplyRuntimeOverrides_PreservesGlobDenyPatterns(t *testing.T) {
 		{Type: config.SandboxAllowExec, Value: "/usr/bin/git", Raw: "exec=/usr/bin/git"},
 	}

-	applyRuntimeOverrides(policy, overrides)
+	applyRuntimeOverrides(policy, overrides, nil)

 	// Glob/wildcard deny patterns must NOT be removed — only exact matches are removed
 	assert.Equal(t, []string{"/etc/**"}, policy.Filesystem.DenyRead)
@@ -310,7 +310,7 @@ func TestApplyRuntimeOverrides_VariableDenyNotRemovedByAbsoluteOverride(t *testi

 	applyRuntimeOverrides(policy, []config.SandboxAllowOverride{
 		{Type: config.SandboxAllowWrite, Value: absolutePath, Raw: "write=./blocked.txt"},
-	})
+	}, nil)

 	// The override is added to the allow list
 	assert.Contains(t, policy.Filesystem.AllowWrite, absolutePath)
@@ -332,7 +332,7 @@ func TestApplyProjectOverlayAppendsEntries(t *testing.T) {
 	require.NoError(t, err)

 	policy := &sandbox.SandboxPolicy{Name: "test"}
-	applied, err := applyProjectOverlay(policy, dir, repo, false)
+	applied, err := applyProjectOverlay(policy, dir, repo, false, nil)
 	assert.NoError(t, err)
 	assert.Equal(t, 2, applied)
 	assert.Contains(t, policy.Filesystem.AllowWrite, "/repo/example/.astro")
@@ -351,7 +351,7 @@ func TestApplyProjectOverlaySkippedWhenLocked(t *testing.T) {
 	require.NoError(t, err)

 	policy := &sandbox.SandboxPolicy{Name: "test"}
-	applied, err := applyProjectOverlay(policy, dir, repo, true)
+	applied, err := applyProjectOverlay(policy, dir, repo, true, nil)
 	assert.NoError(t, err)
 	assert.Equal(t, 0, applied)
 	assert.Empty(t, policy.Filesystem.AllowWrite)
@@ -360,7 +360,7 @@ func TestApplyProjectOverlaySkippedWhenLocked(t *testing.T) {
 func TestApplyProjectOverlayMissingFileIsNoop(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "no-such")
 	policy := &sandbox.SandboxPolicy{Name: "test"}
-	applied, err := applyProjectOverlay(policy, dir, "/repo/example", false)
+	applied, err := applyProjectOverlay(policy, dir, "/repo/example", false, nil)
 	assert.NoError(t, err)
 	assert.Equal(t, 0, applied)
 	_, statErr := os.Stat(dir)
@@ -369,7 +369,7 @@ func TestApplyProjectOverlayMissingFileIsNoop(t *testing.T) {

 func TestApplyProjectOverlayEmptyArgsNoop(t *testing.T) {
 	policy := &sandbox.SandboxPolicy{Name: "test"}
-	applied, err := applyProjectOverlay(policy, "", "", false)
+	applied, err := applyProjectOverlay(policy, "", "", false, nil)
 	assert.NoError(t, err)
 	assert.Equal(t, 0, applied)
 }