feat(task): add inferred sandbox reads

Author: Randolf Jung

docs/sandboxing.md

@@ -72,6 +72,22 @@ allow_write = ["./node_modules"]
 allow_net = ["registry.npmjs.org"]
 ```
 
+Tasks can also opt in to inferred filesystem reads:
+
+```toml
+[tasks.build]
+run = "npm run build"
+depends = ["generate"]
+sources = ["src/**/*.ts"]
+outputs = ["dist/**"]
+sandbox = true
+```
+
+With `sandbox = true`, matched source files and the task file are readable, and outputs from all
+prerequisite dependencies are readable. Explicit `allow_read` paths extend those inferred reads;
+other sandbox settings, including `allow_write`, continue to compose normally. Declaring `sources`
+without `sandbox = true` does not enable sandboxing.
+
 CLI flags on `mise run` override task-level config:
 
 ```bash
@@ -101,6 +117,21 @@ When filesystem restrictions are active, certain paths remain accessible so tool
 
 - `--allow-write` paths are implicitly readable
 - `--allow-read` paths include system essentials above
+- With task `sandbox = true`, declared `sources` enable read restrictions and are automatically
+  readable
+- With task `sandbox = true`, declared outputs of all prerequisite dependencies enable read
+  restrictions and are automatically readable
+
+Explicit `allow_read` paths extend these inferred permissions. Output writes are not inferred; use
+`allow_write` when a task also needs write restrictions.
+
+Source globs are resolved to the files they match, including source exclusions. Dependency output
+globs grant read access to the static path before the first wildcard.
+
+Inferred permissions are an ergonomics feature, not a hermetic build boundary. Tools may need
+additional explicit access for configuration, caches, formatters, or undeclared inputs. The task
+working directory is not implicitly readable; add `allow_read = ["."]` when a tool needs to inspect
+it.
 
 ## Platform Support
 

docs/tasks/task-configuration.md

@@ -1080,6 +1080,28 @@ When both a global timeout and a per-task timeout are set, the shorter of the tw
 timeout cannot extend beyond the global timeout. The `--timeout` CLI flag overrides the global
 setting.
 
+### `sandbox`
+
+- **Type**: `bool`
+- **Default**: `false`
+
+Infer filesystem sandbox reads from the task's declared inputs. Matched `sources` and the task file
+become readable, and outputs of all prerequisite dependencies become readable. Explicit
+`allow_read` paths extend the inferred reads; other sandbox settings continue to compose normally.
+
+```mise-toml
+[tasks.build]
+run = "npm run build"
+depends = ["generate"]
+sources = ["src/**/*.ts"]
+outputs = ["dist/**"]
+sandbox = true
+```
+
+Source globs resolve to the files they currently match. Dependency output globs grant read access
+to their static prefix. Output writes are not inferred; use `allow_write` when needed. See
+[Sandboxing](/sandboxing.html) for platform behavior and limitations.
+
 ### `deny_all`
 
 - **Type**: `bool`

docs/tasks/templates.md

@@ -55,7 +55,7 @@ When a task extends a template, fields are merged according to these rules:
 | `dir`                                             | Local overrides; defaults to config_root if not in template |
 | `sources`, `outputs`, `cache`                     | Local overrides completely                                  |
 | `output`                                          | Local overrides template (if set)                           |
-| Sandbox deny fields                               | Compose with task-local settings                            |
+| `sandbox` and sandbox deny fields                 | Compose with task-local settings                            |
 | Sandbox allow fields                              | Template and task-local values are combined                 |
 | `description`, `shell`, `timeout`, etc.           | Local overrides template (if set)                           |
 | `quiet`, `hide`, `raw`, `interactive`, `raw_args` | Not supported on templates (set explicitly on each task)    |

e2e/tasks/test_task_sandbox_inferred_io

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+
+# https://github.com/jdx/mise/discussions/12264
+# Filesystem sandboxing is unavailable on Windows and on Linux kernels without Landlock.
+case "$(uname -s)" in
+  Darwin) ;;
+  Linux)
+    if ! mise x --deny-read -- true >/dev/null 2>&1; then
+      echo "skipping: task sandbox inference requires Landlock"
+      return 0
+    fi
+    ;;
+  *)
+    echo "skipping: task sandbox inference is unsupported on this platform"
+    return 0
+    ;;
+esac
+
+mkdir -p input work/scratch seed-output dep-output output
+echo source >input/source.txt
+echo private >input/private.md
+
+cat <<'EOF' >source-task.sh
+#!/usr/bin/env bash
+echo source-file
+EOF
+chmod +x source-task.sh
+
+cat <<'EOF' >mise.toml
+[tasks.seed]
+dir = "work"
+run = "echo seed > ../seed-output/result.txt"
+outputs = ["../seed-output/**"]
+
+[tasks.prepare]
+dir = "work"
+run = "echo dependency > ../dep-output/result.txt"
+depends = ["seed"]
+outputs = ["../dep-output/**"]
+
+[tasks.build]
+dir = "work"
+run = "cat ../input/source.txt ../seed-output/result.txt ../dep-output/result.txt > ../output/result.txt && echo explicit > scratch/result.txt"
+depends = ["prepare"]
+sources = ["../input/*.txt"]
+outputs = ["../output/**"]
+sandbox = true
+allow_read = ["."]
+allow_write = ["../output", "scratch"]
+
+[tasks.undeclared-read]
+dir = "work"
+run = "cat ../input/private.md"
+sources = ["../input/*.txt"]
+sandbox = true
+allow_read = ["."]
+
+[tasks.not-sandboxed]
+dir = "work"
+run = "cat ../input/private.md"
+sources = ["../input/*.txt"]
+
+[tasks.source-file]
+file = "source-task.sh"
+dir = "work"
+sandbox = true
+allow_read = ["."]
+EOF
+
+assert "mise run build" ""
+assert "cat output/result.txt" $'source\nseed\ndependency'
+assert "cat work/scratch/result.txt" "explicit"
+assert_fail "mise run undeclared-read"
+assert "mise run --force not-sandboxed" "private"
+assert "mise run source-file" "source-file"

schema/mise-task.json

@@ -3347,6 +3347,11 @@
           "description": "timeout for this task",
           "type": "string"
         },
+        "sandbox": {
+          "default": false,
+          "description": "infer filesystem reads from sources and prerequisite outputs",
+          "type": "boolean"
+        },
         "deny_all": {
           "default": false,
           "description": "block reads, writes, network, and env vars",

schema/mise.json

@@ -69,8 +69,10 @@ impl fmt::Display for TaskCycleError {
 impl std::error::Error for TaskCycleError {}
 
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
-/// State contributed by a task's completed direct dependencies.
+/// State contributed by a task's completed dependencies.
 pub(crate) struct TaskDependencyState {
+    /// Prerequisite tasks whose declared outputs may be read by this task.
+    pub(crate) dependencies: Vec<Task>,
     /// Stable artifact identities to include in the task's cache key.
     pub cache_keys: Vec<String>,
     /// Whether any dependency executed or restored outputs.
@@ -104,6 +106,7 @@ pub(crate) struct Deps {
     executed: HashSet<TaskKey>, // tasks that actually began executing (not just scheduled)
     did_work: HashSet<TaskKey>, // tasks that executed or restored outputs (not freshness-skipped)
     cache_keys: HashMap<TaskKey, String>, // stable artifact identities published by completed tasks
+    tasks: HashMap<TaskKey, Task>, // resolved definitions retained after graph nodes are removed
     dep_edges: HashMap<TaskKey, HashSet<TaskKey>>, // maps each task to its direct dependency task keys
     post_dep_parents: HashMap<TaskKey, HashSet<TaskKey>>, // maps each post-subtree task to its triggering parents
     tx: mpsc::UnboundedSender<Option<Task>>,
@@ -306,6 +309,10 @@ impl Deps {
         let executed = HashSet::new();
         let did_work = HashSet::new();
         let cache_keys = HashMap::new();
+        let tasks = graph
+            .node_indices()
+            .map(|idx| (task_key(&graph[idx]), graph[idx].clone()))
+            .collect();
         Ok(Self {
             graph,
             tx,
@@ -314,6 +321,7 @@ impl Deps {
             executed,
             did_work,
             cache_keys,
+            tasks,
             dep_edges,
             post_dep_parents,
         })
@@ -450,7 +458,23 @@ impl Deps {
             .collect::<Vec<_>>();
         cache_keys.sort();
         cache_keys.dedup();
+        let mut prerequisite_keys = deps.clone();
+        let mut pending = deps.iter().copied().collect_vec();
+        while let Some(key) = pending.pop() {
+            for dependency in self.dep_edges.get(key).into_iter().flatten() {
+                if prerequisite_keys.insert(dependency) {
+                    pending.push(dependency);
+                }
+            }
+        }
+        let mut dependencies = prerequisite_keys
+            .iter()
+            .filter_map(|key| self.tasks.get(*key).cloned())
+            .collect_vec();
+        dependencies.sort();
+        dependencies.dedup();
         TaskDependencyState {
+            dependencies,
             cache_keys,
             any_did_work: deps.iter().any(|dep_key| self.did_work.contains(dep_key)),
             any_unkeyed_did_work: deps.iter().any(|dep_key| {
@@ -669,6 +693,7 @@ mod tests {
             executed: HashSet::new(),
             did_work: HashSet::new(),
             cache_keys: HashMap::new(),
+            tasks: HashMap::new(),
             dep_edges,
             post_dep_parents,
             tx,
@@ -706,6 +731,7 @@ mod tests {
         assert_eq!(
             deps.dependency_state(&c),
             TaskDependencyState {
+                dependencies: vec![],
                 cache_keys: vec![],
                 any_did_work: true,
                 any_unkeyed_did_work: true,
@@ -716,13 +742,56 @@ mod tests {
         assert_eq!(
             deps.dependency_state(&c),
             TaskDependencyState {
+                dependencies: vec![],
                 cache_keys: vec!["b-key".to_string()],
                 any_did_work: true,
                 any_unkeyed_did_work: false,
             }
         );
     }
 
+    // https://github.com/jdx/mise/discussions/12264
+    #[test]
+    fn dependency_state_retains_direct_dependency_tasks() {
+        let dependency = Task {
+            outputs: crate::task::TaskOutputs::Files(vec!["dist".to_string()]),
+            ..task("dependency")
+        };
+        let parent = task("parent");
+        let mut deps = deps_with_relationships(
+            HashMap::from([(task_key(&parent), HashSet::from([task_key(&dependency)]))]),
+            HashMap::new(),
+        );
+        deps.tasks.insert(task_key(&dependency), dependency.clone());
+
+        assert_eq!(deps.dependency_state(&parent).dependencies, [dependency]);
+    }
+
+    // https://github.com/jdx/mise/discussions/12264
+    #[test]
+    fn dependency_state_retains_transitive_prerequisite_tasks() {
+        let first = Task {
+            outputs: crate::task::TaskOutputs::Files(vec!["first-output".to_string()]),
+            ..task("first")
+        };
+        let second = Task {
+            outputs: crate::task::TaskOutputs::Files(vec!["second-output".to_string()]),
+            ..task("second")
+        };
+        let parent = task("parent");
+        let mut deps = deps_with_relationships(
+            HashMap::from([
+                (task_key(&parent), HashSet::from([task_key(&second)])),
+                (task_key(&second), HashSet::from([task_key(&first)])),
+            ]),
+            HashMap::new(),
+        );
+        deps.tasks.insert(task_key(&first), first.clone());
+        deps.tasks.insert(task_key(&second), second.clone());
+
+        assert_eq!(deps.dependency_state(&parent).dependencies, [first, second]);
+    }
+
     #[test]
     fn dependency_state_includes_post_dependency_parents() {
         let parent = task("parent");
@@ -737,6 +806,7 @@ mod tests {
         assert_eq!(
             deps.dependency_state(&post),
             TaskDependencyState {
+                dependencies: vec![],
                 cache_keys: vec!["parent-key".to_string()],
                 any_did_work: true,
                 any_unkeyed_did_work: false,