Harden state_key and package mount error handling

Sharp edge fixes found during review of the three prior changes:

- state_key: reject keys containing '..', '/', or '\' (path traversal)
- state_key: create_dir_all now returns error instead of .ok() (was
  silently failing when project dir was unwritable)
- needs_packages: create_dir_all for container mount point now returns
  actionable error instead of .ok()
- sandbox-init Phase 2b: check bm.host.is_dir() not bm.container
  (container path may not exist yet on host)

New proptest: state_key_rejects_traversal (arbitrary strings containing
.. / \ are always rejected). Updated state_key_produces_valid_sandbox
to use a real writable path.

14 proptests + 19 e2e tests pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: bryanegan

crates/gleisner-container/src/task.rs

@@ -319,16 +319,33 @@ impl TaskSandbox {
             // Ensure the container mount point exists on the host so
             // sandbox-init doesn't skip it as "nonexistent path".
             if pkg.host_path != pkg.container_path {
-                std::fs::create_dir_all(&pkg.container_path).ok();
+                if let Err(e) = std::fs::create_dir_all(&pkg.container_path) {
+                    return Err(ContainerError::Config(format!(
+                        "cannot create package mount point {}: {e} \
+                         (the container_path must be writable on the host)",
+                        pkg.container_path.display()
+                    )));
+                }
             }
             sb.mount_readonly(&pkg.host_path, &pkg.container_path);
         }
 
         // ── State persistence ─────────────────────────────────
 
         if let Some(ref key) = self.state_key {
+            // Validate: reject path traversal in state keys
+            if key.contains("..") || key.contains('/') || key.contains('\\') {
+                return Err(ContainerError::Config(format!(
+                    "state_key '{key}' contains path separator or traversal"
+                )));
+            }
             let state_dir = self.project_dir.join(format!(".gleisner/state/{key}"));
-            std::fs::create_dir_all(&state_dir).ok();
+            std::fs::create_dir_all(&state_dir).map_err(|e| {
+                ContainerError::Config(format!(
+                    "cannot create state dir {}: {e}",
+                    state_dir.display()
+                ))
+            })?;
             sb.bind_rw(&state_dir);
         }
 

crates/gleisner-container/tests/proptests.rs

@@ -250,10 +250,28 @@ proptest! {
     fn state_key_produces_valid_sandbox(
         key in "[a-z][a-z0-9_-]{0,15}",
     ) {
-        let task = TaskSandbox::new("/workspace")
+        // Use a real writable path (not /workspace which doesn't exist)
+        let dir = std::path::PathBuf::from("/datar/workspace/claude_code_experiments/gleisner/target/proptest-state");
+        std::fs::create_dir_all(&dir).ok();
+        let task = TaskSandbox::new(&dir)
             .state_key(&key);
         let sb = task.build();
         prop_assert!(sb.is_ok(), "state_key '{key}' should produce valid sandbox");
+        // Clean up state dirs
+        std::fs::remove_dir_all(dir.join(".gleisner")).ok();
+    }
+
+    // ── Property: state_key rejects traversal ──────────────────────
+
+    #[test]
+    fn state_key_rejects_traversal(
+        key in "\\PC{1,30}",
+    ) {
+        let task = TaskSandbox::new("/workspace").state_key(&key);
+        let result = task.build();
+        if key.contains("..") || key.contains('/') || key.contains('\\') {
+            prop_assert!(result.is_err(), "state_key '{key}' with traversal should be rejected");
+        }
     }
 
     // ── Property: minimal_toml parse never panics ─────────────────

crates/gleisner-sandbox-init/src/runtime.rs

@@ -388,7 +388,7 @@ fn setup_filesystem(spec: &SandboxSpec) -> Result<(), String> {
             continue;
         }
         let target = new_root.join(bm.container.strip_prefix("/").unwrap_or(&bm.container));
-        if bm.container.is_dir() || bm.host.is_dir() {
+        if bm.host.is_dir() {
             fs::create_dir_all(&target).map_err(|e| format!("mkdir {}: {e}", target.display()))?;
         } else if let Some(parent) = target.parent() {
             fs::create_dir_all(parent)