fix(sandbox): web_search/web_fetch hard-denied under default network policy

[gnanam1990]

Problem

With the default sandbox policy (network: deny), web_search (and web_fetch) are hard-denied before they run:

denied · web_search · risk:high — network access is blocked by sandbox policy
Sandbox violation [network] for web_search: network access is blocked by sandbox policy

#199 added EnforceToolNetwork (off by default) to exempt the first-party in-process network tools, but it only relaxed NetworkHostAllowed — the per-host check inside the tool's RunWithSandbox. The actual deny happens earlier, at the engine-level gate in Evaluate (run by the tool registry): a request whose risk includes network under NetworkDeny is rejected before the tool executes. So the tool never reached the relaxed check. (#199 merged at the commit just before this follow-up, so the gap shipped to main.)

Fix

Evaluate now skips the network-deny for a request that declares SideEffectNetwork (the first-party in-process tools web_search/web_fetch) when EnforceToolNetwork is off — mirroring the NetworkHostAllowed exemption so the engine-level gate and the per-tool gate agree. A shell command merely classified as network (SideEffect=shell, e.g. curl) is not exempt, so sandboxed-shell egress stays blocked under deny. Setting EnforceToolNetwork: true restores the strict deny for the tools.

Net effect: web_search/web_fetch are no longer hard-blocked by the sandbox; they follow the normal permission flow (prompt in ask mode → run on allow; run in auto mode).

Tests

• TestEvaluateExemptsNetworkToolsFromDenyByDefault — full path: default → not denied; granted → allow; EnforceToolNetwork=true → denied; network shell command → stays denied.
• TestEngineDeniesNetworkSideEffectWhenPolicyBlocksNetwork and TestScopedNetworkGateInEvaluate updated to opt into EnforceToolNetwork (they test the strict gate).

Gates (local)

gofmt -l . empty · go vet · go build · go test ./... (incl. -race on sandbox+tools) · staticcheck no new findings · govulncheck 0 · deadcode -test=false no new unreachable funcs.

Scoped to the sandbox fix only — 3 files (engine.go, engine_test.go, runner_scoped_test.go).

Summary by CodeRabbit

• Bug Fixes
  • Network tools are now exempt from network-deny policies by default.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3d7c3c69-2e80-4c8d-9e3d-59743988b117

📥 Commits

Reviewing files that changed from the base of the PR and between 6a9f44a and 59f27a1.

📒 Files selected for processing (3)

• internal/sandbox/engine.go
• internal/sandbox/engine_test.go
• internal/sandbox/runner_scoped_test.go

---

Walkthrough

Engine.Evaluate gains a new toolNetworkExempt helper that bypasses the engine-level NetworkDeny block for requests with SideEffectNetwork when Policy.EnforceToolNetwork is not set. Tests are added and updated across engine_test.go and runner_scoped_test.go to cover both the default-exempt and explicitly-enforced postures.

Changes

Network Tool Exemption from Engine-Level Deny

Layer / File(s)	Summary
toolNetworkExempt helper and Evaluate deny gate internal/sandbox/engine.go	Adds Engine.toolNetworkExempt returning true when EnforceToolNetwork is false and SideEffect is SideEffectNetwork; updates the NetworkDeny branch in Engine.Evaluate to skip denial for exempted tool requests.
Engine tests: default-exempt and strict-enforce internal/sandbox/engine_test.go	Adds TestEvaluateExemptsNetworkToolsFromDenyByDefault covering the web_search exemption and bash shell denial; updates TestEngineDeniesNetworkSideEffectWhenPolicyBlocksNetwork to set EnforceToolNetwork = true for the strict-gate path.
Scoped runner tests: enforce flag required internal/sandbox/runner_scoped_test.go	Adds enforcedScoped helper with EnforceToolNetwork = true; switches all engine constructions in TestScopedNetworkGateInEvaluate to use it so denial expectations remain valid under the new default-exempt behavior.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• Gitlawb/zero#199: Implements the same Policy.EnforceToolNetwork default-exemption pattern in engine.go's network-deny/host-allow gating and corresponding tests, directly overlapping with this PR's changes.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly describes the core fix: exempting web_search/web_fetch tools from hard denial under default network policy, which is the main problem addressed by the PR.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/sandbox-web-search-network

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Zero automated PR review

Verdict: No blockers found

Blockers

• None found.

Validation

• [pass] Diff hygiene: git diff --check
• [pass] Tests: go test ./...
• [pass] Build: go run ./cmd/zero-release build
• [pass] Smoke build: go run ./cmd/zero-release smoke

Scope

Head: 59f27a1c96cb
Changed files (3): internal/sandbox/engine.go, internal/sandbox/engine_test.go, internal/sandbox/runner_scoped_test.go

This deterministic review checks validation status and basic diff hygiene. A human reviewer still owns product judgment and design quality.

[anandh8x]

Reviewed locally. No blocking findings.

The change keeps Evaluate aligned with NetworkHostAllowed: first-party SideEffectNetwork tools remain exempt by default when EnforceToolNetwork is off, while shell network risk and explicit EnforceToolNetwork still deny. The added tests cover the default exemption, strict opt-in, shell non-exemption, and scoped gate behavior.

Tests:

• GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestEvaluateExemptsNetworkToolsFromDenyByDefault|TestEngineDeniesNetworkSideEffectWhenPolicyBlocksNetwork|TestScopedNetworkGateInEvaluate': pass
• GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/tools: pass
• GOCACHE=/tmp/zero-go-cache go test ./...: fails in internal/imageinput TestLoadDocumentTruncatesLongText, outside this PR changed files.