fix(capture): report scenario path search denial as access denied (#6244)

Electron and process scenario path admission caught every realpath or
stat failure as an invalid_value input issue, so a correct path beneath a
directory without search permission returned invalid_request with
schema-correction recovery instead of a host access denial.

Admission now classifies EACCES/EPERM from path resolution and metadata
reads as the existing AnalysisAccessDeniedError (selected path,
system_code, filesystem-read boundary). Missing, looping or otherwise
unresolvable paths and reachable files without execute permission keep
their input-error semantics. Electron reports invalid selections before a
denial on another field. Process PATH search still continues past a
denied directory; only an explicitly selected executable reports denial.

Fixes #6117

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

src/process/capture/ProcessScenarioRuntimeValidation.test.ts

@@ -7,10 +7,13 @@ import {
   writeFile,
 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { delimiter, join } from "node:path";
 import { expect, it } from "vitest";
 
-import { AnalysisInputError } from "../../domain/analysisErrorCore.js";
+import {
+  AnalysisAccessDeniedError,
+  AnalysisInputError,
+} from "../../domain/analysisErrorCore.js";
 import { projectAnalysisError } from "../../domain/analysisErrorProjection.js";
 import {
   resolveExecutable,
@@ -172,6 +175,121 @@ it.skipIf(process.platform === "win32")(
   },
 );
 
+const SKIP_PERMISSIONS =
+  process.platform === "win32" || process.getuid?.() === 0;
+
+/** Remove search permission from `directory` for the duration of `run`. */
+const withoutSearchPermission = async <T>(
+  directory: string,
+  run: () => Promise<T>,
+): Promise<T> => {
+  await chmod(directory, 0o000);
+  try {
+    return await run();
+  } finally {
+    await chmod(directory, 0o700);
+  }
+};
+
+const deniedFixture = async () => {
+  const root = await createTestTempDirectory("rea-process-denied-");
+  const denied = join(root, "denied");
+  await mkdir(join(denied, "cwd"), { recursive: true });
+  const tool = join(denied, "tool");
+  await writeFile(tool, "#!/bin/sh\n", { mode: 0o755 });
+  return { root, denied, tool };
+};
+
+const runtimePathOutcome = async (
+  scenario: Parameters<typeof parseProcessScenario>[0],
+): Promise<unknown> => {
+  try {
+    return await resolveProcessScenarioRuntimePaths(
+      parseProcessScenario(scenario),
+    );
+  } catch (cause: unknown) {
+    return cause;
+  }
+};
+
+it.skipIf(SKIP_PERMISSIONS)(
+  "reports a search-denied working directory as host access denial",
+  async () => {
+    const { denied } = await deniedFixture();
+    const selected = join(denied, "cwd");
+    const failure = await withoutSearchPermission(denied, () =>
+      runtimePathOutcome({
+        executable: process.execPath,
+        working_directory: selected,
+      }),
+    );
+    expect(failure).toBeInstanceOf(AnalysisAccessDeniedError);
+    if (!(failure instanceof AnalysisAccessDeniedError)) return;
+    expect(projectAnalysisError(failure)).toMatchObject({
+      code: "access_denied",
+      details: {
+        operation: "capture_process_scenario",
+        path: selected,
+        system_code: "EACCES",
+        boundary: "filesystem-read",
+      },
+    });
+  },
+);
+
+it.skipIf(SKIP_PERMISSIONS)(
+  "reports a search-denied explicit executable as host access denial",
+  async () => {
+    const { root, denied, tool } = await deniedFixture();
+    const failure = await withoutSearchPermission(denied, () =>
+      runtimePathOutcome({
+        executable: "denied/tool",
+        working_directory: root,
+      }),
+    );
+    expect(failure).toBeInstanceOf(AnalysisAccessDeniedError);
+    if (!(failure instanceof AnalysisAccessDeniedError)) return;
+    expect(projectAnalysisError(failure)).toMatchObject({
+      code: "access_denied",
+      details: { path: tool, system_code: "EACCES" },
+    });
+  },
+);
+
+it.skipIf(SKIP_PERMISSIONS)(
+  "continues a PATH search past a search-denied directory",
+  async () => {
+    const { root, denied } = await deniedFixture();
+    const bin = join(root, "bin");
+    await mkdir(bin);
+    const tool = join(bin, "tool");
+    await writeFile(tool, "#!/bin/sh\n", { mode: 0o755 });
+    await withoutSearchPermission(denied, async () => {
+      await expect(
+        resolveExecutable("tool", root, [denied, bin].join(delimiter)),
+      ).resolves.toBe(tool);
+      const failure = await runtimePathOutcome({
+        executable: "tool",
+        working_directory: root,
+        environment: { PATH: denied },
+      });
+      expect(failure).toBeInstanceOf(AnalysisInputError);
+      if (!(failure instanceof AnalysisInputError)) return;
+      expect(projectAnalysisError(failure)).toMatchObject({
+        code: "invalid_request",
+        details: {
+          issues: [
+            {
+              path: ["executable"],
+              message: `executable could not be resolved: tool; checked ${join(denied, "tool")} (EACCES)`,
+            },
+          ],
+        },
+      });
+    });
+  },
+);
+
 const runtimePathFailure = async (
   scenario: Parameters<typeof parseProcessScenario>[0],
 ): Promise<AnalysisInputError> => {

src/process/capture/ProcessScenarioRuntimeValidation.ts

@@ -3,7 +3,10 @@ import { access, realpath, stat } from "node:fs/promises";
 import { delimiter, isAbsolute, join, resolve, sep } from "node:path";
 
 import type { ProcessScenario } from "../../domain/process/processScenario.js";
-import { AnalysisInputError } from "../../domain/analysisErrorCore.js";
+import {
+  AnalysisAccessDeniedError,
+  AnalysisInputError,
+} from "../../domain/analysisErrorCore.js";
 import { snapshotEnvironment } from "../snapshotEnvironment.js";
 import { processCaptureCancelled } from "./ProcessCaptureError.js";
 
@@ -18,20 +21,26 @@ export const resolveProcessScenarioRuntimePaths = async (
   try {
     workingDirectory = await realpath(selectedWorkingDirectory);
   } catch (cause: unknown) {
-    throw invalidScenarioPath(
-      "working_directory",
-      `working directory could not be resolved: ${selectedWorkingDirectory}${osFailure(cause)}`,
-      cause,
+    throw (
+      hostAccessDenial(selectedWorkingDirectory, cause) ??
+      invalidScenarioPath(
+        "working_directory",
+        `working directory could not be resolved: ${selectedWorkingDirectory}${osFailure(cause)}`,
+        cause,
+      )
     );
   }
   let workingDirectoryStat;
   try {
     workingDirectoryStat = await stat(workingDirectory);
   } catch (cause: unknown) {
-    throw invalidScenarioPath(
-      "working_directory",
-      `working directory could not be inspected: ${workingDirectory}${osFailure(cause)}`,
-      cause,
+    throw (
+      hostAccessDenial(selectedWorkingDirectory, cause) ??
+      invalidScenarioPath(
+        "working_directory",
+        `working directory could not be inspected: ${workingDirectory}${osFailure(cause)}`,
+        cause,
+      )
     );
   }
   if (!workingDirectoryStat.isDirectory())
@@ -57,7 +66,12 @@ export const resolveProcessScenarioRuntimePaths = async (
   };
 };
 
-/** Resolve a selected executable through the caller's effective PATH. */
+/**
+ * Resolve a selected executable through the caller's effective PATH. A denied
+ * lookup of an explicitly selected path is a host access failure; PATH search
+ * continues past denied directories, and an existing file without execute
+ * permission remains an invalid selection.
+ */
 export const resolveExecutable = async (
   command: string,
   workingDirectory: string,
@@ -70,22 +84,34 @@ export const resolveExecutable = async (
         ? workingDirectory
         : resolve(workingDirectory, directory),
     );
-  const candidates =
+  const explicit =
     isAbsolute(command) ||
     command.includes("/") ||
-    (sep === "\\" && command.includes("\\"))
-      ? [resolve(workingDirectory, command)]
-      : directories.map((directory) => join(directory, command));
+    (sep === "\\" && command.includes("\\"));
+  const candidates = explicit
+    ? [resolve(workingDirectory, command)]
+    : directories.map((directory) => join(directory, command));
   const failures: string[] = [];
   for (const candidate of candidates) {
+    let metadata;
     try {
-      await access(candidate, fsConstants.X_OK);
-      if ((await stat(candidate)).isFile()) return candidate;
-      failures.push(`${candidate} (not a regular file)`);
+      metadata = await stat(candidate);
     } catch (cause: unknown) {
+      const denial = explicit ? hostAccessDenial(candidate, cause) : undefined;
+      if (denial !== undefined) throw denial;
       failures.push(`${candidate}${osFailure(cause)}`);
       continue;
     }
+    if (!metadata.isFile()) {
+      failures.push(`${candidate} (not a regular file)`);
+      continue;
+    }
+    try {
+      await access(candidate, fsConstants.X_OK);
+      return candidate;
+    } catch (cause: unknown) {
+      failures.push(`${candidate}${osFailure(cause)}`);
+    }
   }
   throw invalidScenarioPath(
     "executable",
@@ -104,6 +130,24 @@ const invalidScenarioPath = (
     [{ path: [field], reason: "invalid_value", message }],
   );
 
+/** Host permissions denied resolving a selected path; not malformed input. */
+const hostAccessDenial = (
+  selected: string,
+  cause: unknown,
+): AnalysisAccessDeniedError | undefined => {
+  const code = osErrorCode(cause);
+  return code === "EACCES" || code === "EPERM"
+    ? new AnalysisAccessDeniedError(
+        "capture_process_scenario",
+        selected,
+        code,
+        {
+          cause,
+        },
+      )
+    : undefined;
+};
+
 const osErrorCode = (cause: unknown): string | undefined =>
   typeof cause === "object" &&
   cause !== null &&