Claude6/5/2026, 1:45:40 PM

Codex/Bugbot review (commit 65a4a6f): the macOS Seatbelt backend passed raw
writableRoots into -D params, while Linux bwrap resolves each root with realpath
before binding. A symlinked root could therefore point outside the intended
scope while Seatbelt granted writes on the logical path.

Extract bwrap's realpath-with-fallback as the shared canonicalizeRoot (in
policy.ts) and apply it to the seatbelt explicit roots before scratch dirs are
layered on. Scratch dirs stay literal; the macOS /tmp↔/private/tmp alias skip
still applies. Removes the duplicate canonicalize in bwrap.

Parent65a4a6f