fix(sandbox): drop the unfollowable sandbox override from ACL failures

Both unelevated ACL failures told the reader to re-run with `--sandbox
forbid`. There is no such option: SandboxPreferenceForbid is an internal
engine state with no flag behind it, so acting on it produced an unknown
option and left them stuck on the failure they had just been told how to
clear. Advice that does not work costs more than none, because finding
that out takes the reader's time.

Name the real way out instead, the user config key, which is honored
from global config only so a cloned repo cannot set it. The
elevated-setup remedy beside it was already correct and stays.

Reported by jatmn against the same string on #640. It predates this
branch, having arrived with the unelevated fallback tier in #427, and
the copy on #886 is fixed separately in 1b304e1.

Also covers the secret write with the junction regression it was owed:
the caller owns the sandbox home, so they can put a reparse point where
the secret directory is expected, and the pathname version followed it
in an elevated process. The test asserts the refusal names the reparse
point and that nothing survives on the far side, since refusing while
still creating the file would leave the caller holding it.

Author: Vasanthdev2004

internal/sandbox/windows_command_runner_windows.go

@@ -229,15 +229,23 @@ func ensureWindowsUnelevatedSetup(config WindowsSandboxCommandConfig) error {
 		// is only recorded on success, so the same plan fails identically on
 		// every later command until the offending root leaves it. A reader who
 		// cannot tell which root is at fault has no way out of that.
+		// Every remedy named below is one the reader can actually carry out.
+		// Both messages used to offer `--sandbox forbid`, which is not an option
+		// at all: SandboxPreferenceForbid is an internal engine state with no flag
+		// behind it, so acting on it produced an unknown option and left the reader
+		// stuck on the failure they had just been told how to clear. Advice that
+		// does not work costs more than none, since finding that out takes time.
 		if denied := windowsACLPlanDeniedPath(err); denied != "" {
 			return fmt.Errorf("apply unelevated workspace ACLs: %w; %s cannot have its permissions changed by this user, "+
 				"so the sandbox cannot enforce a write boundary there and will not run the command. "+
 				"That path is one of this workspace's sandbox roots, usually a system directory that arrived via TEMP or TMP. "+
-				"Check those, or re-run with `--sandbox forbid` to skip OS sandboxing. "+
+				"Check those, or turn the sandbox off in your user config with "+
+				`"sandbox": {"enabled": false}. `+
 				"Running `zero sandbox setup` elevated will NOT fix this", err, denied)
 		}
 		return fmt.Errorf("apply unelevated workspace ACLs: %w — the workspace may be on a filesystem the current user does not own; "+
-			"run `zero sandbox setup` from an elevated (Administrator) terminal, or re-run with `--sandbox forbid` to skip OS sandboxing", err)
+			"run `zero sandbox setup` from an elevated (Administrator) terminal, "+
+			`or turn the sandbox off in your user config with "sandbox": {"enabled": false}`, err)
 	}
 	return recordWindowsUnelevatedAppliedPlan(config.SandboxHome, applied)
 }

internal/sandbox/windows_identity_secret_junction_windows_test.go

@@ -0,0 +1,71 @@
+//go:build windows
+
+package sandbox
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// THE SECRET MUST NOT BE WRITTEN THROUGH A REPARSE POINT.
+//
+// The sandbox home belongs to the invoking user, who is the party this sandbox
+// exists to contain, so they can put a junction where the secret directory is
+// expected before elevated setup runs. The pathname version resolved the path
+// four times over (MkdirAll, an O_TRUNC open, SetNamedSecurityInfo by name, then
+// WriteFile by name) and every one of them followed it, so an Administrator
+// process created the principal's password in a directory of the caller's
+// choosing and then granted them control of it.
+//
+// A junction rather than a symlink on purpose: it needs no privilege, so it is
+// reachable by exactly the unprivileged user this guards against. os.Symlink
+// would need SeCreateSymbolicLinkPrivilege and would skip on an ordinary
+// developer or CI account, which is where this most needs to run.
+func TestWriteWindowsSandboxSecretRefusesAJunctionedDirectory(t *testing.T) {
+	base := t.TempDir()
+	outside := filepath.Join(base, "outside")
+	if err := os.MkdirAll(outside, 0o700); err != nil {
+		t.Fatalf("MkdirAll: %v", err)
+	}
+	// The swap: the directory the secret is addressed into is a junction that
+	// leads out of the sandbox home. The pathname never changes.
+	cfg := filepath.Join(base, "cfg")
+	makeJunction(t, cfg, outside)
+
+	path := filepath.Join(cfg, "zero-sbx-test.secret")
+	err := writeWindowsSandboxSecret(path, "Zs1!EXAMPLEPASSWORDVALUE")
+	if err == nil {
+		t.Fatal("wrote the principal secret through a junction, so an elevated setup would have placed it in a directory the caller controls")
+	}
+	if !strings.Contains(err.Error(), "reparse") {
+		t.Fatalf("refused for the wrong reason: %v", err)
+	}
+	// Refusing is only half of it. Nothing may survive on the other side, or the
+	// caller still ends up holding a file the sandbox created for them.
+	entries, readErr := os.ReadDir(outside)
+	if readErr != nil {
+		t.Fatalf("ReadDir: %v", readErr)
+	}
+	if len(entries) != 0 {
+		t.Fatalf("junction target holds %d entries after the refusal, want none", len(entries))
+	}
+}
+
+// The ordinary path must still work, or the refusal above proves only that the
+// function fails.
+func TestWriteWindowsSandboxSecretStillWritesAnOrdinaryDirectory(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "cfg", "zero-sbx-test.secret")
+	const password = "Zs1!EXAMPLEPASSWORDVALUE"
+	if err := writeWindowsSandboxSecret(path, password); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	got, err := readWindowsSandboxSecret(path)
+	if err != nil {
+		t.Fatalf("read: %v", err)
+	}
+	if got != password {
+		t.Fatalf("read %q, want the stored password", got)
+	}
+}