How do you debug a Bazel sandboxing failure?

Question

Repo with full code example.

When I try to run a test with Bazel involving the tree-sitter binary, I get an Operation not permitted error without any further information.

❯ bazel test --test_output=errors --verbose_failures --sandbox_debug //tree-sitter-nbts:check-generated
INFO: Analyzed target //tree-sitter-nbts:check-generated (0 packages loaded, 0 targets configured).
INFO: Found 1 test target...
FAIL: //tree-sitter-nbts:check-generated (see /private/var/tmp/_bazel_varun/e55142ab9bc72292b8c54fb9627025eb/execroot/__main__/bazel-out/darwin_arm64-fastbuild/testlogs/tree-sitter-nbts/check-generated/test.log)
INFO: From Testing //tree-sitter-nbts:check-generated:
==================== Test output for //tree-sitter-nbts:check-generated:
++ dirname /private/var/tmp/_bazel_varun/e55142ab9bc72292b8c54fb9627025eb/sandbox/darwin-sandbox/17/execroot/__main__/bazel-out/darwin_arm64-fastbuild/bin/tree-sitter-nbts/check-generated.runfiles/__main__/tree-sitter-nbts/check-generated
+ cd /private/var/tmp/_bazel_varun/e55142ab9bc72292b8c54fb9627025eb/sandbox/darwin-sandbox/17/execroot/__main__/bazel-out/darwin_arm64-fastbuild/bin/tree-sitter-nbts/check-generated.runfiles/__main__/tree-sitter-nbts
+ git init -b main
Initialized empty Git repository in /private/var/tmp/_bazel_varun/e55142ab9bc72292b8c54fb9627025eb/sandbox/darwin-sandbox/17/execroot/__main__/bazel-out/darwin_arm64-fastbuild/bin/tree-sitter-nbts/check-generated.runfiles/__main__/tree-sitter-nbts/.git/
+ git add .
+ GIT_AUTHOR_EMAIL=_
+ GIT_AUTHOR_NAME=_
+ GIT_COMMITTER_EMAIL=_
+ GIT_COMMITTER_NAME=_
+ git commit -m 'Initial commit'
[main (root-commit) 1f79ef2] Initial commit
 11 files changed, 11 insertions(+)
 create mode 120000 Cargo.lock
 create mode 120000 Cargo.toml
 create mode 120000 bindings/rust/build.rs
 create mode 120000 bindings/rust/lib.rs
 create mode 120000 check-generated
 create mode 120000 check-generated.sh
 create mode 120000 grammar.js
 create mode 120000 src/grammar.json
 create mode 120000 src/node-types.json
 create mode 120000 src/parser.c
 create mode 120000 src/tree_sitter/parser.h
+ tree-sitter generate
Operation not permitted (os error 1)
================================================================================
Target //tree-sitter-nbts:check-generated up-to-date:
  bazel-bin/tree-sitter-nbts/check-generated
INFO: Elapsed time: 0.220s, Critical Path: 0.11s
INFO: 2 processes: 2 darwin-sandbox.
INFO: Build completed, 1 test FAILED, 2 total actions
//tree-sitter-nbts:check-generated                                       FAILED in 0.1s
  /private/var/tmp/_bazel_varun/e55142ab9bc72292b8c54fb9627025eb/execroot/__main__/bazel-out/darwin_arm64-fastbuild/testlogs/tree-sitter-nbts/check-generated/test.log

INFO: Build completed, 1 test FAILED, 2 total actions

What is a good way of debugging this? So far, I know the following:

• Running tree-sitter generate directly in the source tree works fine.
• The bazel test command works fine with --spawn_strategy=standalone, which I think confirms that this is a sandboxing issue.
• The bazel test command works fine inside the Nix environment (see the linked repo). This one is a little weird, not sure what's going on here.

Configuration information:

• macOS 12.4 on an M1 Mac
• Bazel v5.2.0 (both in Nix and outside)
• tree-sitter v0.20.6 (both in Nix and outside) (I tried using the Nix-installed binary with Bazel and that didn't seem to make any difference)
• OpenJDK v11.0.15 in the global environment vs OpenJDK v11.0.11 in Nix.

GitHub issues which seem related:

• ln call fails with "operation not permitted" during bazel test - This comment mentions there is no command printed with --verbose_failures --sandbox_debug.
• Strange "Operation not permitted" problem for test program accessing files in the sand box on MacOS