fix(sandbox): close metadata permission escape paths from Seatbelt review

crates/orca-provider/src/lib.rs

@@ -734,9 +734,21 @@ fn mock_call(conversation: &Conversation) -> ProviderResponse {
         };
     }
 
-    if let Some(command) = prompt.trim().strip_prefix("force_bash ") {
+    if !has_tool_results && let Some(command) = prompt.trim().strip_prefix("force_bash ") {
+        let tool_id = (1_u64..)
+            .map(|index| format!("mock-tool-{index}"))
+            .find(|candidate| {
+                !conversation.messages.iter().any(|message| match message {
+                    Message::Assistant { tool_calls, .. } => tool_calls
+                        .iter()
+                        .any(|tool_call| tool_call.id == *candidate),
+                    Message::Tool { tool_call_id, .. } => tool_call_id == candidate,
+                    Message::System { .. } | Message::User { .. } => false,
+                })
+            })
+            .expect("mock tool id space is not exhausted");
         let bash = ToolRequest {
-            id: "mock-tool-1".to_string(),
+            id: tool_id,
             name: ToolName::Bash,
             action: ActionKind::Shell,
             target: Some(command.to_string()),
@@ -1684,6 +1696,32 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn mock_force_bash_uses_fresh_tool_ids_across_turns_and_stops_after_result() {
+        let mut conversation = Conversation::new();
+        conversation.add_user("force_bash printf first".to_string());
+        let first = mock_call(&conversation);
+        let first_call = first.tool_calls.first().unwrap().clone();
+        assert_eq!(first_call.id, "mock-tool-1");
+        conversation.add_assistant(None, None, vec![first_call.clone()]);
+        conversation.add_tool_result(first_call.id, "first".to_string());
+        conversation.add_assistant(Some("first done".to_string()), None, Vec::new());
+        conversation.add_user("force_bash printf second".to_string());
+
+        let second = mock_call(&conversation);
+        let second_call = second.tool_calls.first().unwrap().clone();
+        assert_eq!(second_call.id, "mock-tool-2");
+        conversation.add_assistant(None, None, vec![second_call.clone()]);
+        conversation.add_tool_result(second_call.id, "second".to_string());
+
+        let completed = mock_call(&conversation);
+        assert!(completed.tool_calls.is_empty());
+        assert_eq!(
+            completed.assistant_content.as_deref(),
+            Some("Mock completed after tool execution.")
+        );
+    }
+
     #[test]
     fn mock_provider_can_request_network_permissions() {
         let mut conversation = Conversation::new();

crates/orca-runtime/src/runtime_bash.rs

@@ -87,6 +87,26 @@ pub(crate) fn execute_bash_with_shell_session(
         Ok(sandbox) => sandbox,
         Err(error) => return ToolResult::failed(request, error, None),
     };
+    let mut ordinary_additional_roots = Vec::new();
+    for directory in &config.additional_working_directories {
+        if directory.source == crate::runtime_permission::SESSION_METADATA_DIRECTORY_SOURCE {
+            if orca_tools::sandbox::is_safe_metadata_writable_root(&directory.path) {
+                push_unique_path(&mut sandbox.metadata_writable_roots, directory.path.clone());
+            }
+            continue;
+        }
+        if !orca_tools::sandbox::is_protected_metadata_root(&directory.path) {
+            push_unique_path(&mut ordinary_additional_roots, directory.path.clone());
+        }
+    }
+    for root in additional_roots {
+        // Protected metadata paths only gain write authority through the
+        // dedicated overlay/session channel below. Their presence in ordinary
+        // runtime settings must not mint an escalation by path shape alone.
+        if !orca_tools::sandbox::is_protected_metadata_root(root) {
+            push_unique_path(&mut ordinary_additional_roots, root.clone());
+        }
+    }
     for (domain, access) in permission_overlay.network_domain_permissions() {
         match access {
             PermissionProfileNetworkAccess::Deny => {
@@ -111,7 +131,7 @@ pub(crate) fn execute_bash_with_shell_session(
     let result = execute_bash_with_sandbox(RuntimeBashSandboxContext {
         command,
         cwd,
-        additional_roots,
+        additional_roots: &ordinary_additional_roots,
         sandbox: &sandbox,
         shell_timeout_secs,
         task_registry,
@@ -148,7 +168,7 @@ pub(crate) fn execute_bash_with_shell_session(
         return execute_bash_with_sandbox(RuntimeBashSandboxContext {
             command,
             cwd,
-            additional_roots,
+            additional_roots: &ordinary_additional_roots,
             sandbox: &retry_sandbox,
             shell_timeout_secs,
             task_registry,
@@ -191,7 +211,7 @@ pub(crate) fn execute_bash_with_shell_session(
             return execute_bash_with_sandbox(RuntimeBashSandboxContext {
                 command,
                 cwd,
-                additional_roots,
+                additional_roots: &ordinary_additional_roots,
                 sandbox: &retry_sandbox,
                 shell_timeout_secs,
                 task_registry,
@@ -223,7 +243,7 @@ pub(crate) fn execute_bash_with_shell_session(
                 command,
                 cwd,
                 additional_readable_directories: Vec::new(),
-                additional_working_directories: additional_roots.to_vec(),
+                additional_working_directories: ordinary_additional_roots,
                 metadata_writable_directories: Vec::new(),
                 denied_working_directories: Vec::new(),
                 allowed_unix_socket_roots: Vec::new(),