From 60d558e9a7eb1944fc58ee88e121a5db5248a332 Mon Sep 17 00:00:00 2001
From: tanaka takashi <isazaka@gmail.com>
Date: Mon, 10 Aug 2026 01:39:40 +0900
Subject: fix(agent): fail fast on sandbox policy denial

Treat Policy Engine denials and UnauthorizedAccessException results as terminal tool failures by adding RetryAllowed metadata to ToolExecutionResult.

Stop the Agent loop immediately after recording the denied tool result, transition the Task to failed, and run normal Task resource cleanup instead of returning the same failure to the LLM for another iteration. Correctable validation and process failures retain the existing bounded retry behavior.

Expose RetryAllowed in llm.jsonl and document the fail-fast security invariant in Specifications, Design, and ImplementationPlan.

Tests: Agent.Core.Tests 50/50 passed with skip 0; Release build passed with 0 warnings and 0 errors. The full Windows suite remained environment-blocked outside an elevated token: 14 tests failed while creating/deriving the fixed AppContainer or creating symlinks; 11 passed and none were skipped.

Release: refreshed the win-x64 self-contained folder binaries, publish manifest, ZIP, and checksum while preserving the local agent.yaml. The clean ZIP contains no runtime logs or Task state.
---
 tests/Agent.Core.Tests/InternalToolTests.cs     |  1 +
 tests/Agent.Core.Tests/PromptAndRuntimeTests.cs | 49 +++++++++++++++++++++++++
 2 files changed, 50 insertions(+)

(limited to 'tests/Agent.Core.Tests')

diff --git a/tests/Agent.Core.Tests/InternalToolTests.cs b/tests/Agent.Core.Tests/InternalToolTests.cs
index 1e241ce..e452cab 100644
--- a/tests/Agent.Core.Tests/InternalToolTests.cs
+++ b/tests/Agent.Core.Tests/InternalToolTests.cs
@@ -36,6 +36,7 @@ public sealed class InternalToolTests
 
         Assert.False(result.Success);
         Assert.False(result.ExternalEffect);
+        Assert.False(result.RetryAllowed);
         Assert.Empty(backend.Calls);
     }
 
diff --git a/tests/Agent.Core.Tests/PromptAndRuntimeTests.cs b/tests/Agent.Core.Tests/PromptAndRuntimeTests.cs
index 23ad2d2..c3c634d 100644
--- a/tests/Agent.Core.Tests/PromptAndRuntimeTests.cs
+++ b/tests/Agent.Core.Tests/PromptAndRuntimeTests.cs
@@ -144,6 +144,29 @@ public sealed class PromptAndRuntimeTests
         Assert.Contains("iteration limit", failed.Result, StringComparison.OrdinalIgnoreCase);
     }
 
+    [Fact]
+    public async Task Runtime_does_not_retry_a_sandbox_policy_denial()
+    {
+        TaskRegistry registry = new();
+        var backend = new UnauthorizedBackend();
+        var dispatcher = new InternalToolDispatcher(
+            new DenyByDefaultPolicy(new HashSet<string>(["file_search"], StringComparer.Ordinal)), backend);
+        var ollama = new FileSearchOllamaClient();
+        var runtime = new AgentRuntime(registry, ollama, new AgentRuntimeSettings("", "en", [], "sandbox"), dispatcher);
+        TaskSnapshot task = registry.Enqueue("research regional curry", null, null);
+        registry.Transition(task.TaskId, AgentTaskState.Planning);
+        registry.Transition(task.TaskId, AgentTaskState.Running);
+
+        await runtime.ExecuteAsync(task.TaskId, TestContext.Current.CancellationToken);
+
+        Assert.True(registry.TryGet(task.TaskId, null, out TaskSnapshot? failed));
+        Assert.Equal(AgentTaskState.Failed, failed!.State);
+        Assert.Contains("denied by sandbox policy", failed.Result, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("not approved for Read", failed.Result, StringComparison.OrdinalIgnoreCase);
+        Assert.Equal(1, ollama.CallCount);
+        Assert.Equal(1, backend.CallCount);
+    }
+
     private sealed class RecordingOllamaClient : IOllamaClient
     {
         public List<IReadOnlyList<OllamaMessage>> Calls { get; } = [];
@@ -217,4 +240,30 @@ public sealed class PromptAndRuntimeTests
             return Task.FromResult(new OllamaResult("", 1, 1, [new OllamaToolCall(new OllamaFunctionCall("process_run", arguments.RootElement.Clone()))]));
         }
     }
+
+    private sealed class UnauthorizedBackend : IInternalToolBackend
+    {
+        public int CallCount { get; private set; }
+
+        public Task<ToolExecutionResult> ExecuteAsync(Guid taskId, string toolName, JsonElement arguments, CancellationToken cancellationToken)
+        {
+            CallCount++;
+            throw new UnauthorizedAccessException("'C:\\Users' is not approved for Read.");
+        }
+    }
+
+    private sealed class FileSearchOllamaClient : IOllamaClient
+    {
+        public int CallCount { get; private set; }
+
+        public Task<OllamaResult> ChatAsync(IReadOnlyList<OllamaMessage> messages, double? temperatureOverride, CancellationToken cancellationToken) =>
+            Task.FromResult(new OllamaResult("unexpected", 1, 1));
+
+        public Task<OllamaResult> ChatWithToolsAsync(IReadOnlyList<OllamaMessage> messages, double? temperatureOverride, IReadOnlyList<InternalToolDefinition> tools, CancellationToken cancellationToken)
+        {
+            CallCount++;
+            using JsonDocument arguments = JsonDocument.Parse("""{"root":"C:\\Users","mode":"name","query":"*.txt"}""");
+            return Task.FromResult(new OllamaResult("", 1, 1, [new OllamaToolCall(new OllamaFunctionCall("file_search", arguments.RootElement.Clone()))]));
+        }
+    }
 }
-- 
cgit v1.2.3