Complete runtime diagnostics and verification coverage

1 files changed, 13 insertions, 4 deletions

diff --git a/src/Agent.Windows/Tools/WindowsToolBackend.cs b/src/Agent.Windows/Tools/WindowsToolBackend.cs
index 5c1fe49..c432894 100644
--- a/src/Agent.Windows/Tools/WindowsToolBackend.cs
+++ b/src/Agent.Windows/Tools/WindowsToolBackend.cs
@@ -93,7 +93,9 @@ public sealed class WindowsToolBackend(WindowsSandboxSettings settings, ISecurit
             audit.Write(new(DateTimeOffset.UtcNow, taskId, "policy.deny", "denied",
                 new Dictionary<string, string> { ["tool"] = toolName, ["message"] = ex.Message },
                 SessionId: context.SessionId, ErrorCode: ex.Code));
-            return Task.FromResult(new ToolExecutionResult(false, ex.Message, false, $"{toolName}:{ex.Code}:{ex.Message}", RetryAllowed: false));
+            return Task.FromResult(new ToolExecutionResult(false, ex.Message, false, $"{toolName}:{ex.Code}:{ex.Message}", RetryAllowed: false,
+                ErrorCode: ex.Code, ErrorCategory: ex.Category, TargetPath: ex.TargetPath,
+                RequiredPermission: ex.RequiredPermission, Resolution: ex.Resolution));
         }
     }
 
@@ -255,9 +257,7 @@ public sealed class WindowsToolBackend(WindowsSandboxSettings settings, ISecurit
         string[] args = arguments.GetProperty("args").EnumerateArray().Select(static item => item.GetString()!).ToArray();
         string? managedEntryPoint = ExecutablePolicy.ManagedEntryPoint(executable, args);
         if (managedEntryPoint is not null) _paths.Demand(managedEntryPoint, FileCapability.Execute);
-        int seconds = arguments.TryGetProperty("timeout_seconds", out JsonElement timeout) ? timeout.GetInt32() : settings.ProcessTimeoutSeconds;
-        if (seconds > settings.ProcessTimeoutSeconds)
-            throw new ToolValidationException($"timeout_seconds exceeds configured sandbox.resources.process_timeout_seconds ({settings.ProcessTimeoutSeconds}).");
+        int seconds = ResolveProcessTimeout(arguments, settings.ProcessTimeoutSeconds);
         string? stdin = arguments.TryGetProperty("stdin", out JsonElement stdinElement) && stdinElement.ValueKind == JsonValueKind.String ? stdinElement.GetString() : null;
         RestrictedProcessResult result = new RestrictedProcessLauncher(_executables, audit, AppContainerProfile.EnsureFixed().Sid, settings.JobLimits)
             .Run(taskId, executable, args, cwd, TimeSpan.FromSeconds(seconds), stdin, context.SessionId);
@@ -266,6 +266,15 @@ public sealed class WindowsToolBackend(WindowsSandboxSettings settings, ISecurit
             result.ExitCode == 0 ? null : $"process:{executable}:{result.ExitCode}");
     }
 
+    internal static int ResolveProcessTimeout(JsonElement arguments, int configuredTimeoutSeconds)
+    {
+        int seconds = arguments.TryGetProperty("timeout_seconds", out JsonElement timeout) ? timeout.GetInt32() : configuredTimeoutSeconds;
+        if (seconds <= 0) throw new ToolValidationException("timeout_seconds must be positive.");
+        if (seconds > configuredTimeoutSeconds)
+            throw new ToolValidationException($"timeout_seconds exceeds configured sandbox.resources.process_timeout_seconds ({configuredTimeoutSeconds}).");
+        return seconds;
+    }
+
     private async Task CleanupAsync(Guid taskId, TaskContext context)
     {
         List<Exception> failures = [];