[Bubblewrap] Add optional type discriminator to deniedPaths entries

[Soham Das (SohamDas2021)]

📖 Description

Builds on #623 (denied-path masking). A denied path must be masked differently depending on whether it is a file (--ro-bind /dev/null) or a directory (--tmpfs). When a denied path does not exist on the host, the runner has no way to know which kind of stub to create, so this change lets a caller declare the kind explicitly.

deniedPaths entries may now be either a plain string (unchanged) or an object with an optional type discriminator:

"deniedPaths": [
"/etc/secret", // string form, unchanged
{ "path": "/var/run/app.sock", "type": "file" },
{ "path": "/opt/cache", "type": "directory" }
]

🔗 References

🔍 Validation

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see docs/pull-requests.md)

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHub
Actions build; it runs on merge to main, and Microsoft reviewers with write access can trigger it
on a PR with /azp run. See docs/pull-requests.md.

If the dependency-feed-check check fails on a new dependency, the crate must be added to
the feed before the PR can pass. See docs/pull-requests.md
for the steps.

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Pull request overview

Adds an optional "type": "file" | "directory" discriminator for filesystem.deniedPaths entries (string form still supported) so Linux Bubblewrap masking can be deterministic even when the denied path doesn’t exist on the host. This flows from Rust wire/schema → SDK types → Bubblewrap runner behavior, and includes new Bubblewrap tests and docs updates.

Changes:

• Extend the wire model + dev schema so deniedPaths accepts string | { path, type? }, and update TS wire emitter to handle anyOf union definitions.
• Plumb declared kinds through parsing (denied_path_kinds) and use them in Bubblewrap denied-path classification + symlink resolution + post-run stub cleanup.
• Add Bubblewrap regression test config + script and document the new behavior in schema and Bubblewrap backend docs.

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/scripts/run_bwrap_denied_kind_test.sh	New end-to-end Bubblewrap test for missing denied file vs missing denied dir with declared kinds
tests/scripts/run_bwrap_all_tests.sh	Includes the new denied-kind test in the Bubblewrap test suite
tests/configs/bubblewrap_denied_kind.json	Test config exercising typed deniedPaths entries
src/core/wxc_common/src/wire.rs	Wire model: introduce PathKind, DeniedPathObject, DeniedPathEntry; widen denied_paths type
src/core/wxc_common/src/ts_emit.rs	TS emitter: handle anyOf definitions as unions; unwrap $ref wrapped in allOf
src/core/wxc_common/src/models.rs	Domain model: add PathKind and denied_path_kinds map to ContainerPolicy
src/core/wxc_common/src/config_parser.rs	Parse typed denied entries into denied_paths + denied_path_kinds, with unit tests
src/backends/bubblewrap/common/src/bwrap_runner.rs	Use declared kinds for masking classification; re-key kinds on symlink resolution; stub cleanup logic
sdk/src/types.ts	Public SDK types: DeniedPathEntry/DeniedPathObject; widen deniedPaths fields accordingly
sdk/src/index.ts	Export the new denied-path types
sdk/src/generated/wire.ts	Generated wire TS updated for new denied-path union + PathKind
schemas/dev/mxc-config.schema.0.8.0-dev.json	Dev schema updated for denied-path union/object + PathKind
docs/schema.md	Document widened deniedPaths syntax and Bubblewrap honoring behavior
docs/sandbox-policy/v1/policy.md	Update policy type + table docs for typed denied paths
docs/bwrap-support/bubblewrap-backend.md	Document deterministic masking via type, conflict behavior, and host-stub cleanup

[Soham Das (SohamDas2021)]

Copilot resolve the merge conflicts in this pull request

[Copilot]

Copilot resolve the merge conflicts in this pull request

Resolved. The base branch (user/sodas/bwrap-denied-path-masking) had a new commit (5fbede8) that refactored resolve_denied_symlinks → resolve_denied_paths (returning a DeniedPlan struct) and moved the file/dir classification into that single pass. I integrated that refactor with my PathKind-aware changes in commit 02213e1, and addressed the code review feedback in commit 8de3a04:

• Merged DeniedPlan now carries a kinds field (re-keyed denied_path_kinds when symlinks are resolved)
• resolve_denied_paths now uses denied_masks_as_file (PathKind-aware) for classification instead of the old is_file_mask_target
• Added diagnostic log when two denied paths resolve to the same target with conflicting declared kinds
• Renamed changed → any_path_rewritten, updated UTF-8 error message wording
• Moved classify_denied_files helper into the test module (it was only used in tests)

[Soham Das (SohamDas2021)]

Copilot resolve the merge conflicts in this pull request

[Copilot]

Copilot resolve the merge conflicts in this pull request

Resolved in commit e501a6e. The base branch had a new commit (5fbede8) that independently refactored resolve_denied_symlinks → resolve_denied_paths with a DeniedPlan struct (using is_file_mask_target). I merged it by keeping the PathKind-aware denied_masks_as_file (a superset of is_file_mask_target) along with the DeniedPlan.kinds field, kinds re-keying logic, warn_denied_kind_mismatches, missing_denied_stub_candidates, and cleanup_denied_stubs. Also adopted the base branch's improved non-UTF-8 error message ("cannot be safely masked; refusing to start.").

[Gudge (MGudgin)]

I think we should do the work to add 'type' to the policy language at the same time as we do the work to add 'leaf' vs 'tree'. And I think we should do it independently of work on any given back-end.