fix: filter directory-only Landlock rights for non-directory paths (#17)

internal/sandbox/integration_linux_test.go

@@ -246,19 +246,6 @@ func TestLinux_NetworkBlocksCurl(t *testing.T) {
 	assertNetworkBlocked(t, result)
 }
 
-// TestLinux_NetworkBlocksWget verifies that wget cannot reach the network.
-func TestLinux_NetworkBlocksWget(t *testing.T) {
-	skipIfAlreadySandboxed(t)
-	skipIfCommandNotFound(t, "wget")
-
-	workspace := createTempWorkspace(t)
-	cfg := testConfigWithWorkspace(workspace)
-
-	result := runUnderSandboxWithTimeout(t, cfg, "wget -q --timeout=2 -O /dev/null http://example.com", workspace, 10*time.Second)
-
-	assertBlocked(t, result)
-}
-
 // TestLinux_NetworkBlocksPing verifies that ping cannot reach the network.
 func TestLinux_NetworkBlocksPing(t *testing.T) {
 	skipIfAlreadySandboxed(t)
@@ -482,6 +469,41 @@ func TestLinux_ProcSelfEnvReadable(t *testing.T) {
 	assertAllowed(t, result)
 }
 
+// TestLinux_GlobPatternAllowsWriteToMatchingFile verifies that glob patterns
+// like "~/.claude*" correctly allow writes to matching files (not just directories).
+// The bug was that Landlock rules for files were silently failing because
+// directory-only access rights (MAKE_*, REFER, etc.) were being applied.
+func TestLinux_GlobPatternAllowsWriteToMatchingFile(t *testing.T) {
+	skipIfAlreadySandboxed(t)
+
+	workspace := createTempWorkspace(t)
+
+	testFile := filepath.Join(workspace, ".testglob.json")
+	if err := os.WriteFile(testFile, []byte(`{"initial": true}`), 0o600); err != nil {
+		t.Fatalf("failed to create test file: %v", err)
+	}
+
+	// Configure allowWrite with a glob pattern that matches the file
+	cfg := testConfigWithWorkspace(workspace)
+	cfg.Filesystem.AllowWrite = []string{
+		workspace,
+		filepath.Join(workspace, ".testglob*"),
+	}
+
+	// Try to append to the file (shouldn't fail)
+	result := runUnderSandbox(t, cfg, "echo 'appended' >> "+testFile, workspace)
+
+	assertAllowed(t, result)
+
+	content, err := os.ReadFile(testFile) //nolint:gosec
+	if err != nil {
+		t.Fatalf("failed to read file: %v", err)
+	}
+	if !strings.Contains(string(content), "appended") {
+		t.Errorf("expected file to contain 'appended', got: %s", string(content))
+	}
+}
+
 // ============================================================================
 // Helper functions
 // ============================================================================