[MikeMcQuaid]

• Let archive tools read files in the sandbox's temporary directory without granting read access to its parent.
• Cover the read exception and retained parent restriction.

Fixes #24348

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Codex with GPT 6 Astra at Extra High effort, with local review and testing.

---

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: e5b99e06-4704-4c52-90da-a9489738ed96

Commits

Reviewing files that changed from the base of the PR and between ad6e682 and 9e05a54.

Files selected for processing: 1

• Library/Homebrew/test/sandbox_shared_spec.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • Commands running in the sandbox can create and read files in their own temporary directory, even when its parent directory is denied access.
  • Access to separate files under that denied parent remains blocked, preserving the sandbox’s access restrictions.

sandbox_environment now allows reads within its temporary directory. A capture test checks that reads from a denied parent remain blocked while reads from the command’s private temporary directory succeed.

Changes: Sandbox temporary-directory access

Layer / File(s)	Summary
Temporary-directory read rules Library/Homebrew/sandbox.rb, Library/Homebrew/test/sandbox_shared_spec.rb	sandbox_environment adds a read allowance for its temporary directory. The capture test checks that reads from the denied parent are blocked and reads from the command’s temporary directory are allowed.

Priority: Normal

Severity of issue fixed: Medium

Merge Risk: Minimal · up to 9e05a

No actionable merge-blocking risk remains from the reviewed change.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: allowing reads from private sandbox temporary files.
Description check		The description directly explains the sandbox permission change, the retained parent restriction, the added test coverage, and the linked issue.
Linked Issues check		The change addresses [#24348]. Sandbox#sandbox_environment now grants read access to the temporary directory as a :subpath while retaining the existing write and network rules. The new sandbox spe…
Out of Scope Changes check		The pull request changes only Library/Homebrew/sandbox.rb and its shared sandbox specification. The production rule and the regression test directly support [#24348]. No unrelated change is shown.

Full details: Linked Issues check

Explanation

The change addresses [#24348]. Sandbox#sandbox_environment now grants read access to the temporary directory as a :subpath while retaining the existing write and network rules. The new sandbox specification denies the parent directory, verifies that a file in the private temporary directory can be written and read, and verifies that a separate parent file remains unreadable. This covers the unzip archive-read failure and the retained parent restriction.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 453eb451-24fa-484f-aed2-d8307db83b43

Commits

Reviewing files that changed from the base of the PR and between 39b07ff and ad6e682.

Files selected for processing: 2

• Library/Homebrew/sandbox.rb
• Library/Homebrew/test/sandbox_shared_spec.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.