compiler: fail closed past sandbox stack capacity

new_changelogs/20261029T093650Z-security-sandbox-depth-overflow.md

@@ -0,0 +1,5 @@
+- **Deeply nested sandbox blocks now fail closed.** The generated permission
+  stack silently dropped pushes beyond its 64-slot capacity, so an inner
+  policy could run under only its outer grants. The logical depth now
+  continues past the storage limit and refuses checks until matching pops or
+  unwind restoration returns it to a representable level.

tests/integration/sandbox_depth_overflow/prog.ae

@@ -0,0 +1,35 @@
+import std.os
+import std.sandbox
+
+fn descend(level: int, allow: sandbox.Grants, deny: sandbox.Grants) -> int {
+    visible = 1
+    if level == 0 {
+        sandbox.enforce(deny) callback {
+            if os.getenv("AE_SANDBOX_DEPTH_SECRET") == null { visible = 0 }
+        }
+        return visible
+    }
+
+    sandbox.enforce(allow) callback {
+        visible = descend(level - 1, allow, deny)
+    }
+    return visible
+}
+
+main() {
+    allow = sandbox.new("allow env") {
+        grant_env("AE_SANDBOX_DEPTH_SECRET")
+    }
+    deny = sandbox.new("deny env") {}
+
+    visible = descend(64, allow, deny)
+    println("overflow-visible=${visible}")
+
+    restored = 0
+    if os.getenv("AE_SANDBOX_DEPTH_SECRET") != null { restored = 1 }
+    println("after-visible=${restored}")
+
+    sandbox.free(deny)
+    sandbox.free(allow)
+    return visible + (1 - restored)
+}

tests/integration/sandbox_depth_overflow/test_sandbox_depth_overflow.sh

@@ -0,0 +1,36 @@
+#!/bin/sh
+# A grant pushed past the fixed stack capacity must refuse checks instead of
+# letting the block run under only its less restrictive outer grants.
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+AE="$ROOT/build/ae"
+
+if [ ! -x "$AE" ]; then
+    echo "  [SKIP] sandbox_depth_overflow: build/ae not built"
+    exit 0
+fi
+
+TMP="$(cd "$(mktemp -d)" && pwd -P)"
+trap 'rm -rf "$TMP"' EXIT
+if ! "$AE" build "$SCRIPT_DIR/prog.ae" -o "$TMP/prog" >"$TMP/build.log" 2>&1; then
+    echo "  [FAIL] sandbox_depth_overflow: probe did not build"
+    sed 's/^/          /' "$TMP/build.log" | tail -20
+    exit 1
+fi
+
+set +e
+out="$(AE_SANDBOX_DEPTH_SECRET=visible "$TMP/prog" 2>&1)"
+rc=$?
+set -e
+if [ "$rc" -eq 0 ] && printf '%s' "$out" | grep -q '^overflow-visible=0$' &&
+        printf '%s' "$out" | grep -q '^after-visible=1$'; then
+    echo "  [PASS] sandbox stack overflow refuses the inner check"
+    echo "PASS: sandbox_depth_overflow"
+    exit 0
+fi
+
+echo "  [FAIL] sandbox stack overflow dropped the inner policy"
+printf '%s\n' "$out" | sed 's/^/          /' | head -10
+echo "FAIL: sandbox_depth_overflow (rc=$rc)"
+exit 1