Add --keep-fd to pass chosen inherited descriptors into the sandbox

tests/unit/config.rs

@@ -1255,6 +1255,43 @@ fn build_mask_accumulates() {
     assert_eq!(config.mask.len(), 3);
 }
 
+#[test]
+fn build_keep_fd_accumulates_globals_then_profile_then_cli() {
+    let file_config = FileConfig {
+        options: Options {
+            keep_fd: vec![3],
+            ..Options::default()
+        },
+        profiles: HashMap::from([(
+            "extra".into(),
+            Options {
+                keep_fd: vec![4],
+                ..Options::default()
+            },
+        )]),
+        ..FileConfig::default()
+    };
+    let args = Args {
+        profile: vec!["extra".into()],
+        keep_fd: vec![5],
+        ..args_with_command()
+    };
+    let config = build(args, Some(file_config)).unwrap();
+    assert_eq!(config.keep_fds, vec![3, 4, 5]);
+}
+
+#[test]
+fn keep_fd_parsed_from_config() {
+    let config = FileConfig::parse("keep-fd = [3, 4]").unwrap();
+    assert_eq!(config.options.keep_fd, vec![3, 4]);
+}
+
+#[test]
+fn keep_fd_parsed_from_repeated_cli_flag() {
+    let args = Args::try_parse_from(["agent-sandbox", "--keep-fd", "3", "--keep-fd", "4"]).unwrap();
+    assert_eq!(args.keep_fd, vec![3, 4]);
+}
+
 #[test]
 fn unknown_option_rejected() {
     let toml = r#"
@@ -1460,16 +1497,19 @@ fn merge_options_lists_append_base_then_extra() {
     let base = Options {
         rw: vec!["/a".into()],
         env: vec!["A=1".into()],
+        keep_fd: vec![3],
         ..Options::default()
     };
     let extra = Options {
         rw: vec!["/b".into()],
         env: vec!["B=2".into()],
+        keep_fd: vec![4],
         ..Options::default()
     };
     let merged = base.merge_with(extra);
     assert_eq!(merged.rw, vec!["/a", "/b"]);
     assert_eq!(merged.env, vec!["A=1", "B=2"]);
+    assert_eq!(merged.keep_fd, vec![3, 4]);
 }
 
 #[test]