Infer sandbox from sources and outputs

[jrandolf]

If inputs or outputs are declared, we should expect that:

• the inputs are automatically allow_read and
• the outputs are automatically allow_write.

And when tasks depend on other tasks, we should expect that:

• the outputs of dependencies are automatically allow_read for the main task.

[jdx]

I like the direction, but there are a few blockers that would need answers before this could land:

1. allow_read being non-empty is what turns the sandbox on. SandboxConfig::is_active() / effective_deny_read() treat any allow entry as "deny everything else", so inferring from sources would silently sandbox every task that declares them — and on Linux without Landlock mise hard-fails rather than running unsandboxed. People declare sources for staleness/caching, so this would have to be gated: only augment a sandbox that's already active for the task, or an explicit opt-in.

2. sources/outputs are globs, allow_read/allow_write are paths. Passing src/**/*.txt to Landlock just warns that the path doesn't exist and then denies the read. Reducing to the literal prefix works but widens the grant — outputs = ["README.md"] (which render:help in this repo declares) reduces to the config root, i.e. write access to the whole project. !-negated entries also have no Landlock equivalent (allow-list only, no deny-within-allow), so the semantics would differ from macOS.

3. Outputs don't exist on the first run. Landlock needs an existing path, so outputs = ["dist/out.txt"] gives you the "path does not exist" warning and then mkdir: cannot create directory 'dist': Permission denied. We'd have to create output prefixes before applying rules, or fall back to the nearest existing ancestor, which over-grants.

4. The inferred set isn't enough to run anything. Minimal crate with sources = ["Cargo.toml", "src/**/*.rs"] and outputs = ["target/debug/demo"], inferred exactly: sh: 1: cargo: Permission denied — only the mise installs dir and system paths are implicitly readable, so a rustup cargo, ~/.cargo/registry, node_modules etc. are all invisible. Formatters are worse: they declare the files they mutate as sources, so read-only inference breaks them.

The dependency-outputs half is the cleanest piece — Task::all_depends already gives resolved dep tasks, it just has to anchor each dep's outputs at that dep's own cwd. That one I'd be happy to see on its own.

Also worth knowing: there's no e2e coverage for filesystem sandboxing because our CI runners don't have Landlock, so this would be unit-tested against the derived SandboxConfig rather than actual behavior. And cache.audit is the inverse of this idea (strace, reports accesses not covered by sources/outputs) — probably the right tool for figuring out how big the gap in (4) is.

I'd consider a PR but I'd have to look at it. If you take a run at it, I'd keep it opt-in and frame it as ergonomics rather than a security boundary, since the derived set is simultaneously broader than declared and insufficient.

AI-assisted — Tool: Claude Code; model: anthropic/claude-opus-5; version: unavailable.

[jrandolf]

I've upped a PR here: #12266

1. We added a flag.
2. Reads resolve globs. For writes, see below.
3. See below.
4. We made allow_read additive, so users can add other files if they need.

Writes in mise are currently bugged under a sandbox in Linux so this needs to be resolved separately.