Sandbox: seccomp user-notify fallback for Termux and kernels without Landlock

- Child installs a seccomp filter with a listener; a supervisor thread
  resolves the path of write-type syscalls (cwd, dirfd, .., symlinks,
  /proc/self, /dev/stdout, both ends of rename/link) and answers
  CONTINUE or EACCES; IPv4/IPv6 sockets are refused
- Probe order Landlock -> seccomp -> none, checked in a throwaway child;
  CST_SANDBOX=landlock|seccomp|off
- curl connect failures count as sandbox refusals
- test_sandbox runs the detected sandbox and forced seccomp, with escape,
  symlink, rename, link, chmod, stdout, ENOENT, background and network cases
- Docs: platform matrix, limits (not a security boundary, Yama and
  background jobs)

docs/compat.md

@@ -46,17 +46,35 @@ write beneath the workspace, the temp directory, `/dev/null` and `/dev/tty`.
 | Platform | Sandbox | Notes |
 |---|---|---|
 | Linux 5.13+ | Landlock (raw syscalls, no extra library) | ABI ≥ 4 (6.7+) also blocks TCP connect/bind |
+| Linux 5.5+ without Landlock (Android / Termux, WSL, older distros), x86_64 / aarch64 | seccomp user-notify | refuses IPv4/IPv6 sockets; see below |
 | macOS | `sandbox_init` profile | also denies network |
-| Android / Termux | none | falls back to the read-only rules |
-| WSL 2 | Landlock when the WSL kernel enables it | otherwise rules |
 | Older kernels, Windows | none | falls back to the read-only rules |
 
-The status bar and sidebar show `auto · landlock`, `auto · seatbelt` or
-`auto · rules`. `CST_SANDBOX=off` disables the sandbox. When a sandboxed
-command looks blocked, the TUI asks whether to rerun it outside the sandbox.
-The ruleset is built in the parent; the forked child only calls `prctl` and
-`landlock_restrict_self` (async-signal-safe), so the agent itself is never
-confined.
+The status bar and sidebar show `auto · landlock`, `auto · seccomp`,
+`auto · seatbelt` or `auto · rules`. `CST_SANDBOX=off` disables the
+sandbox; `CST_SANDBOX=landlock` or `CST_SANDBOX=seccomp` allows only that
+kind. When a sandboxed command looks blocked, the TUI asks whether to rerun
+it outside the sandbox. The policy is built in the parent; the forked child
+only makes a few async-signal-safe syscalls before `exec`, so the agent
+itself is never confined.
+
+**seccomp.** Used when Landlock is missing, e.g. Android GKI kernels. The
+child installs a seccomp filter with a user-notify listener and passes the
+listener to a supervisor thread in the agent. Opens with write flags and
+every create / remove / rename / link / chmod / chown / utimes / xattr call
+stop until the supervisor has read the path from the child's memory,
+resolved it (cwd, dirfd, `..`, symlinks, `/proc/self`, `/dev/stdout`) and
+answered: continue when it lands in the allowed places, `EACCES` otherwise.
+Reads, exec and writes to already-open files are not checked. Background
+jobs that outlive their shell are no longer the agent's descendants: with
+Yama `ptrace_scope` ≥ 1 (common on desktop distros, absent on Android) the
+supervisor cannot read their memory and their checked writes fail with
+`EACCES`; once the run has finished they get `ENOSYS`. This keeps
+mistakes out of the rest of the disk but is not a security boundary: the
+kernel reads the path again after the check, so a hostile multi-threaded
+program can swap it in between. The availability check runs in a
+throwaway child, so a platform seccomp policy that kills the caller cannot
+take the agent down.
 
 ## Terminal notes
 
@@ -106,7 +124,7 @@ TUI:
 - [ ] Tab toggles Build/Plan, Shift+Tab cycles ask/auto/yolo, Ctrl+P opens the palette
 - [ ] `/model` lists the provider's `/models` (marked `(api)`); a wrong key is re-asked
 - [ ] `auto` mode: `echo x > ~/outside` in run_shell asks "Rerun outside the
-      sandbox?" (Linux 5.13+/macOS); with `CST_SANDBOX=off`, `ls` runs and `touch x` asks
+      sandbox?" (Linux/Termux/macOS); with `CST_SANDBOX=off`, `ls` runs and `touch x` asks
 - [ ] Resize the terminal during streaming: layout recovers
 - [ ] `NO_COLOR=1` and `CST_ASCII=1` render readable screens