fix(sandbox): strip group-write from staged Docker payloads

[senthilr-nv]

Summary

A normal 0002 checkout can stage executable Docker payloads as 0775, so the exact metadata gate added by #7486 aborts a sandbox replacement build. This change clears group and other write bits while preserving owner write and executable intent, so permissive and restrictive source modes both produce canonical Docker payload modes without weakening the gate.

Changes

• Clear group and other write bits in normalizeReadModesForDockerCopy() before adding the read, traverse, and executable permissions required by Docker.
• Cover optimized and legacy staging with 0775 directory and executable fixtures plus a 0664 non-executable fixture. The tests assert exact staged modes of 0755 and 0644.
• Retain coverage that normalizes restrictive 0700 directories and executables plus 0600 ordinary files.
• Confirm the regression history: fix(onboard): normalize blueprint build permissions #3664 introduced read-mode normalization, fix(sandbox): normalize staged script permissions #7072 applied it to scripts with restrictive-mode coverage, fix(images): remove vulnerable node-tar copies #7332 added patch-bundled-npm-tar.mts, and perf(openclaw): collapse final image payload layers #7486 made its preserved 0775 mode fail the exact 0755 assertion.
• Validate the fix on Brev instance nc-july26 from base SHA 3b2f6d557. A transactional rebuild with 0775 and 0664 source inputs completed the strict payload metadata stage, replacement creation, state restore, policy restore, and deployment health checks.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: The fix restores the existing staged-payload permission contract and does not change commands, configuration, or supported workflows.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: No documentation files changed. The fix restores canonical staged modes without changing commands, configuration, or supported workflows. The reviewer found no actionable wording issues.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run test/sandbox-build-context.test.ts src/lib/onboard/build-context-stage.test.ts src/lib/actions/sandbox/rebuild-managed-image-preparation.test.ts (22/22 passed); npm run typecheck:cli passed; Brev nc-july26 rebuild passed the strict Docker payload metadata stage and completed successfully.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Senthil Ravichandran senthilr@nvidia.com

[coderabbitai]

📝 Walkthrough

Walkthrough

Updated Docker-copy permission normalization to remove group and other write bits from directories and files while preserving readable and executable semantics. Expanded sandbox tests cover direct normalization and optimized and legacy staging.

Changes

Sandbox permissions

Layer / File(s)	Summary
Normalize Docker-copy modes src/lib/sandbox/build-context.ts	Directory and file chmod calculations clear group and other write bits before applying read and execute permissions.
Validate normalized staging modes test/sandbox-build-context.test.ts	Group-writable fixtures and assertions verify direct normalization plus optimized and legacy staging results.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: area: sandbox, bug-fix

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: stripping group-write permissions from staged Docker payloads in sandbox.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

1 optional E2E recommendation

• sandbox-operations

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cjagwani]

Lgtm