如何调试Bazel沙箱环境下tree-sitter生成失败问题？

有包含完整代码示例的仓库。

运行涉及tree-sitter二进制文件的Bazel测试时，出现「Operation not permitted」错误，且无更多详细信息。

❯ bazel test --test_output=errors --verbose_failures --sandbox_debug //tree-sitter-nbts:check-generated
INFO: Analyzed target //tree-sitter-nbts:check-generated (0 packages loaded, 0 targets configured).
INFO: Found 1 test target...
FAIL: //tree-sitter-nbts:check-generated (see /private/var/tmp/_bazel_varun/e55142ab9bc72292b8c54fb9627025eb/execroot/__main__/bazel-out/darwin_arm64-fastbuild/testlogs/tree-sitter-nbts/check-generated/test.log)
INFO: From Testing //tree-sitter-nbts:check-generated:
==================== Test output for //tree-sitter-nbts:check-generated:
++ dirname /private/var/tmp/_bazel_varun/e55142ab9bc72292b8c54fb9627025eb/sandbox/darwin-sandbox/17/execroot/__main__/bazel-out/darwin_arm64-fastbuild/bin/tree-sitter-nbts/check-generated.runfiles/__main__/tree-sitter-nbts/check-generated
+ cd /private/var/tmp/_bazel_varun/e55142ab9bc72292b8c54fb9627025eb/sandbox/darwin-sandbox/17/execroot/__main__/bazel-out/darwin_arm64-fastbuild/bin/tree-sitter-nbts/check-generated.runfiles/__main__/tree-sitter-nbts
+ git init -b main
Initialized empty Git repository in /private/var/tmp/_bazel_varun/e55142ab9bc72292b8c54fb9627025eb/sandbox/darwin-sandbox/17/execroot/__main__/bazel-out/darwin_arm64-fastbuild/bin/tree-sitter-nbts/check-generated.runfiles/__main__/tree-sitter-nbts/.git/
+ git add .
+ GIT_AUTHOR_EMAIL=_
+ GIT_AUTHOR_NAME=_
+ GIT_COMMITTER_EMAIL=_
+ GIT_COMMITTER_NAME=_
+ git commit -m 'Initial commit'
[main (root-commit) 1f79ef2] Initial commit
 11 files changed, 11 insertions(+)
 create mode 120000 Cargo.lock
 create mode 120000 Cargo.toml
 create mode 120000 bindings/rust/build.rs
 create mode 120000 bindings/rust/lib.rs
 create mode 120000 check-generated
 create mode 120000 check-generated.sh
 create mode 120000 grammar.js
 create mode 120000 src/grammar.json
 create mode 120000 src/node-types.json
 create mode 120000 src/parser.c
 create mode 120000 src/tree_sitter/parser.h
+ tree-sitter generate
Operation not permitted (os error 1)
================================================================================
Target //tree-sitter-nbts:check-generated up-to-date:
  bazel-bin/tree-sitter-nbts/check-generated
INFO: Elapsed time: 0.220s, Critical Path: 0.11s
INFO: 2 processes: 2 darwin-sandbox.
INFO: Build completed, 1 test FAILED, 2 total actions
//tree-sitter-nbts:check-generated                                       FAILED in 0.1s
  /private/var/tmp/_bazel_varun/e55142ab9bc72292b8c54fb9627025eb/execroot/__main__/bazel-out/darwin_arm64-fastbuild/testlogs/tree-sitter-nbts/check-generated/test.log

INFO: Build completed, 1 test FAILED, 2 total actions

已知信息 #

• 直接在源码目录运行tree-sitter generate可正常执行
• 使用--spawn_strategy=standalone参数运行bazel test可正常执行，确认这是沙箱环境问题
• 在Nix环境中运行bazel test可正常执行，此情况较为特殊，暂不清楚原因

配置信息 #

• M1 Mac，系统版本macOS 12.4
• Bazel v5.2.0（Nix环境和全局环境均使用此版本）
• tree-sitter v0.20.6（Nix环境和全局环境均使用此版本，尝试用Nix安装的二进制文件也无改善）
• 全局环境使用OpenJDK v11.0.15，Nix环境使用OpenJDK v11.0.11

相关问题 #

• ln调用在bazel test中失败，报“operation not permitted”，其中有评论提到使用--verbose_failures --sandbox_debug未打印命令
• macOS沙箱中测试程序访问文件时出现奇怪的“Operation not permitted”问题

请问有什么好的调试方法？

内容的提问来源于stack exchange，提问作者typesanitizer