@clear-capabilities/agentic-security-scanner 0.164.0 → 0.165.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-cca41fc14779bcf557d1a825a32e919b51bcd4c59d73e814d37ab2ed93ca8278  agentic-security.mjs
+5a4520f3bff6f1e77c0bb2bfaa0346b11c1447eb3a8433bc1661d2f58c03537a  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.164.0",
+  "version": "0.165.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",

package/src/capabilities/CLAUDE.md

@@ -74,13 +74,18 @@ declared roots and multi-root writes on the namespace backend (a pivoted tmpfs
 root; protected paths absent or masked; a PID namespace the kernel tears down).
 NOT verified: **mediated network** is not implemented on Linux (an empty network
 namespace has no path to a proxy), so a task that declares a destination is
-`blocked` there with `network-mediation is unsupported`, never allowed; and
-**process-count caps** are never asserted on any backend (on Linux the cause of
-the earlier non-refusal is that the resource prelude runs under dash, whose
-`ulimit` has no `-u`; no replacement is proved). `maxProcesses` is carried and
-reported `unverified`, memory caps `not-enforced`. The execution suites under
-`test/capabilities/` still skip on Linux (their helpers select the userspace
-backend only and several assertions encode macOS semantics); see the gaps below.
+`blocked` there with `network-mediation is unsupported`, never allowed. The
+**process-count cap** IS proved on Linux (the `sandbox-linux` job's `process-cap`
+probe): the resource prelude runs under dash, whose `ulimit` has no `-u`, so the
+namespace backend applies the cap with `prlimit --nproc` to the task's command
+after the confinement is built, and `maxProcesses` in a manifest is passed through
+and reported `enforced` when the run is at the `enforced` level (on macOS it stays
+`unverified`: the cap is per-user and system-wide there). Memory caps are
+`not-enforced`. The capability, trust-boundary and corpus suites RUN on the Linux
+backend and assert Linux semantics (an undeclared path has no name, so a refusal
+is ENOENT or EROFS rather than `denied`; liveness is judged by heartbeat, not host
+pid; a declared network destination blocks the task); `sandbox-linux` fails if any
+of them skips.
 
 ## Known limits (also in `REPORT_LIMITATIONS`)
 
@@ -112,7 +117,5 @@ attempts were stopped on this backend in this run; it does not show the sandbox
 ### What is still not claimed
 
 Tool and delegation checks are policy at the tool boundary (the tool then runs in the server process): the
-runner remains the only enforcement layer. Linux is `partially-verified` in the platform statement (the controls listed there, on the hosted job only) and the attack-coverage record still says `unverified` for Linux, because the corpus is not run on Linux. No process-count cap is asserted. The corpus is not wired into the
-`sandbox-linux` CI job: it would need execution cases that skip loudly (never silently pass) on Linux, and that
-has not been shown from this workspace. The enforced-mode release gate (`enforcedModeReleaseGate`) is a library
+runner remains the only enforcement layer. Linux is `partially-verified` in the platform statement (the controls listed there, on the hosted job only) and the attack-coverage record keeps `platforms.linux: 'unverified'` as a standing statement even though the corpus now runs on the hosted Linux runner inside the capabilities suite: turning that into a verified claim is a decision for the owners, not a side effect of the suite passing. The enforced-mode release gate (`enforcedModeReleaseGate`) is a library
 function used by the suite; it is not yet called from `scripts/release-check.mjs`.

package/src/capabilities/attack-coverage.js

@@ -34,7 +34,7 @@ export const KNOWN_LIMITS = Object.freeze([
   'HTTPS to a declared destination is an opaque tunnel: its payload is not inspected.',
   'The mediation proxy accepts connections from any local process, and forwards only to the declared destinations.',
   'Tool and delegation checks are policy at the tool boundary (in-process); only the runner enforces.',
-  'Process-count caps are not asserted on any backend.',
+  'A process-count cap is claimed only on the Linux namespace backend, where an active probe proved it on the hosted job; it is not claimed on macOS.',
 ]);
 
 /**

package/src/capabilities/manifest.js

@@ -44,8 +44,8 @@ const MANIFEST_REQUIRED = ['schema', 'schemaVersion', 'taskId', 'repository', 'p
 
 // Resource limits a manifest can carry. The first three come straight from the
 // assurance config (same ranges), the file-size cap is enforced by the sandbox
-// prelude, and the last two are CARRIED but never claimed enforced: see
-// `RESOURCE_ENFORCEMENT` in runner.js.
+// prelude, the process-count cap is enforced on the Linux namespace backend only (prlimit, proved by an
+// active probe), and the memory cap is CARRIED but never claimed enforced.
 export const RESOURCE_RANGES = Object.freeze({
   timeoutMs: { min: LIMITS.timeoutMs.min, max: LIMITS.timeoutMs.max },
   maxOutputBytes: { min: LIMITS.maxOutputBytes.min, max: LIMITS.maxOutputBytes.max },

package/src/capabilities/probes.js

@@ -208,11 +208,11 @@ export function platformStatements() {
       evidence: 'sandbox-linux CI job (hosted ubuntu-latest, x86_64); scripts/sandbox-linux-verify.mjs',
       verifiedControls: Object.freeze([
         'write-confinement', 'read-denial', 'env-scrub', 'network', 'tree-termination', 'file-size-limit',
-        'fs-read-confinement', 'fs-multi-root-write',
+        'fs-read-confinement', 'fs-multi-root-write', 'process-cap',
       ]),
       unsupportedControls: Object.freeze(['network-mediation']),
-      unassertedControls: Object.freeze(['process-cap']),
-      note: 'advertised for enforced mode. Proved by active probes on the hosted Linux runner (not on every Linux host): write-confinement, read-denial, env-scrub, network, tree-termination, file-size-limit, fs-read-confinement, fs-multi-root-write. Mediated network is NOT implemented on the namespace backend (an empty network namespace has no path to a proxy), so a task that declares a network destination is blocked on Linux, never allowed. Process-count caps are never claimed: the cause of the earlier non-refusal was found (the shell used for the resource prelude has no process-limit option, so the cap was never applied) and no replacement has been proved. The attack corpus is not run in the sandbox-linux job, so corpus coverage stays unverified on Linux.',
+      unassertedControls: Object.freeze([]),
+      note: 'advertised for enforced mode. Proved by active probes on the hosted Linux runner (not on every Linux host): write-confinement, read-denial, env-scrub, network, tree-termination, file-size-limit, fs-read-confinement, fs-multi-root-write, process-cap (a per-user-namespace process-count cap applied with prlimit after the confinement is built; the shell ulimit it replaces does not exist in dash). Mediated network is NOT implemented on the namespace backend (an empty network namespace has no path to a proxy), so a task that declares a network destination is blocked on Linux, never allowed. Process-count caps are claimed on Linux only, and only as that probe shows them; memory caps are not enforced. The attack corpus is not run in the sandbox-linux job, so corpus coverage stays unverified on Linux.',
     },
     darwin: {
       backend: 'userspace', status: 'host-proved-not-advertised',

package/src/capabilities/report.js

@@ -13,8 +13,9 @@
 //
 // A capability that only an in-process check covers (tools, delegation) says so
 // and is never `enforced`; that check explains a decision, it does not stop the
-// task. Process-count caps are carried and reported `unverified`, on every
-// backend.
+// task. A process-count cap is `enforced` only on a run whose process-cap probe
+// proved it (the Linux namespace backend); on the macOS backend it is carried and
+// reported `unverified`.
 import { platformStatements } from './probes.js';
 
 const FS_READ = ['fs-read-confinement', 'read-denial'];
@@ -28,7 +29,7 @@ export const REPORT_LIMITATIONS = Object.freeze([
   'HTTPS is an opaque tunnel to a declared destination: its payload is not inspected. Plaintext HTTP is filtered for secrets before it is forwarded.',
   'The mediation proxy accepts connections from any local process. It only forwards to declared destinations, so the exposure is the declared set.',
   'A process that double-forks and calls setsid between two supervisor sweeps can outlive the task; only a PID namespace or cgroup closes that gap.',
-  'Process-count caps are per-user and system-wide on the host and did not refuse on a hosted Linux runner in a previous release; none is claimed enforced on any backend.',
+  'A process-count cap is enforced only on the Linux namespace backend, where it is applied by prlimit after the confinement is built and was proved by an active probe; on macOS it is per-user and system-wide on the host, a soft brake that is carried and not claimed.',
   'Address-space (memory) caps are not enforceable on macOS and are carried, not enforced.',
 ]);
 
@@ -73,7 +74,7 @@ export function buildCapabilityReport({ bound, probeReport, level, required }) {
       timeoutMs: { requested: m.resources.timeoutMs ?? null, enforced: level === 'enforced', by: 'supervisor deadline with process-tree termination' },
       maxOutputBytes: { requested: m.resources.maxOutputBytes ?? null, enforced: level === 'enforced', by: 'supervisor output cap with process-tree termination' },
       maxFileSizeKb: { requested: m.resources.maxFileSizeKb ?? null, enforced: level === 'enforced' && fileLimitProved, state: c['file-size-limit']?.state ?? 'not-probed' },
-      maxProcesses: { requested: m.resources.maxProcesses ?? null, enforced: false, state: 'unverified' },
+      maxProcesses: { requested: m.resources.maxProcesses ?? null, enforced: m.resources.maxProcesses != null && level === 'enforced' && c['process-cap']?.state === 'proved', state: c['process-cap']?.state === 'proved' ? 'proved' : 'unverified' },
       maxMemoryMiB: { requested: m.resources.maxMemoryMiB ?? null, enforced: false, state: 'not-enforced' },
     },
     limitations: [...REPORT_LIMITATIONS],

package/src/capabilities/runner.js

@@ -190,7 +190,12 @@ export async function runCapabilityTask(bound, request, opts = {}) {
       denyReadPaths: protectedPaths,
       env: taskEnv, networkProxyPort: proxy ? proxy.port : null,
       timeoutMs, graceMs: 1000, maxOutputBytes, signal, force,
-      limits: m.resources.maxFileSizeKb ? { maxFileSizeKb: m.resources.maxFileSizeKb } : {},
+      limits: {
+        ...(m.resources.maxFileSizeKb ? { maxFileSizeKb: m.resources.maxFileSizeKb } : {}),
+        // Only the namespace backend applies it (prlimit, after the confinement is built). The macOS backend keeps its own ambient-relative
+        // default: a requested cap there would be per-user and system-wide, which is not what the manifest asked for.
+        ...(m.resources.maxProcesses && backend === 'namespace' ? { maxProcs: m.resources.maxProcesses } : {}),
+      },
     });
     const executed = r.supervised === true;
     if (!executed) {

package/src/sandbox/CLAUDE.md

@@ -383,13 +383,24 @@ then runs supervised with protected paths read-denied.
   where `--kill-child` is available (see above).
 - **Active probes**: write confinement, read denial, env scrub, network, tree
   termination and the file-size limit each run an attack plus a positive
-  control through the real backend. `process-cap` is reported `unverified` on
-  every backend and must not be claimed enforced. Per-uid and system-wide on
-  macOS. On Linux the cause of the earlier non-refusal is now known: the
-  resource prelude is run by `/bin/sh`, which is dash on the hosted runner, and
-  dash's `ulimit` has no `-u` option (`ulimit: Illegal option -u` appears in
-  the `sandbox-linux` log), so the cap was never applied at all. No replacement
-  (for example `prlimit`) has been proved, so the cap stays unasserted.
+  control through the real backend. `process-cap` is `unverified` on the macOS
+  backend and must not be claimed enforced there: the cap is per-uid and
+  system-wide, a soft brake. On Linux the earlier non-refusal had a known cause:
+  the resource prelude is run by `/bin/sh`, which is dash on the hosted runner,
+  and dash's `ulimit` has no `-u` option (`ulimit: Illegal option -u` appears in
+  the `sandbox-linux` log), so the cap was never applied at all. The namespace
+  backend now applies it with `prlimit --nproc=N --` (util-linux), in the final
+  stage and to the caller's command alone (`FINAL_SCRIPT`; a cap applied earlier
+  would starve the confinement setup of processes). Inside the user namespace the
+  limit binds: the kernel waives RLIMIT_NPROC only for a process holding
+  CAP_SYS_RESOURCE or CAP_SYS_ADMIN in the INITIAL namespace, and a namespace root
+  has neither (its capability set is dropped as well). With no requested cap none
+  is applied (the old ambient-relative default never took effect on Linux), and a
+  host without `prlimit` declares `maxProcs` in `unsupported` rather than dropping
+  it. `probeProcessCap` (`control-probes.js`) is the proof: six concurrent
+  children all start under a generous cap and the kernel refuses some under a cap
+  of 3, in default and in capability mode; `linux-enforcement.test.js` runs it
+  against runners that ignore the cap and that cap everything.
   `capabilityReport()` carries the standing note that Linux enforcement is
   evidenced only where the `sandbox-linux` CI job ran the same probes.
 - **Status**: target output is returned labelled `untrusted` and is never parsed

package/src/sandbox/backend-namespace.js

@@ -20,7 +20,8 @@
 //      same shape the userspace backend produces, which is the main reason
 //      this shape was chosen over `pivot_root` (see below).
 //
-//   3. RESOURCE CAPS — the shared `ulimit` prelude.
+//   3. RESOURCE CAPS — the shared `ulimit` prelude for the file-size and
+//      address-space caps; the process-count cap is applied by `prlimit` (below).
 //
 // WHY READ-ONLY REBIND RATHER THAN pivot_root. `pivot_root` into the sandbox
 // root is the stronger primitive: after detaching the old root, out-of-root
@@ -127,10 +128,10 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import {
-  resolveNamespaceBin, resolveMountBin, resolvePrivDropBin, resolvePivotBin, resolveUmountBin,
+  resolveNamespaceBin, resolveMountBin, resolvePrivDropBin, resolvePivotBin, resolveUmountBin, resolvePrlimitBin,
   cachedNamespaceVariant, cacheNamespaceVariant,
 } from './capabilities.js';
-import { buildLimitPrelude, ambientRelativeMaxProcs } from './limits.js';
+import { buildLimitPrelude, validateMaxProcs } from './limits.js';
 import { buildResult, errorResult, buildConfinedEnv } from './result.js';
 import {
   buildRootPlan, serializePlan, PIVOT_SETUP_SCRIPT, FINAL_SCRIPT, MARK_SETUP_FAILED, MARK_NO_PRIVDROP,
@@ -308,7 +309,7 @@ export function buildNamespaceInvocation(argv, {
 } = {}, deps = {}) {
   const d = {
     nsBin: resolveNamespaceBin, mountBin: resolveMountBin, privDropBin: resolvePrivDropBin,
-    pivotBin: resolvePivotBin, umountBin: resolveUmountBin, nsArgs: resolveNamespaceArgs, ...deps,
+    pivotBin: resolvePivotBin, umountBin: resolveUmountBin, prlimitBin: resolvePrlimitBin, nsArgs: resolveNamespaceArgs, ...deps,
   };
   if (!root) return { error: errorResult('namespace', 'runNamespace requires a sandbox root') };
   if (networkProxyPort != null) {
@@ -358,18 +359,31 @@ export function buildNamespaceInvocation(argv, {
     if (wd !== resolvedRoot) return { error: errorResult('namespace', 'a working directory other than the sandbox root needs capability mode (readRoots); refusing to execute') };
   }
 
-  // Same per-uid RLIMIT_NPROC trap as the userspace backend, and worse here:
-  // the confined shell has to fork several helpers to BUILD its confinement,
-  // so a fixed cap below the ambient count for this uid makes the setup itself
-  // fail and the sandbox look broken. See `ambientRelativeMaxProcs`.
-  const effectiveLimits = { ...limits, maxProcs: limits.maxProcs ?? ambientRelativeMaxProcs() };
+  // PROCESS-COUNT CAP. Not part of the shell prelude on this backend: that shell is
+  // often dash, whose `ulimit` has no `-u`, so a cap written there was never applied
+  // (found in the hosted log: `ulimit: Illegal option -u`). The cap is applied to the
+  // caller's command alone, by `prlimit` in the final stage, AFTER the confinement is
+  // built, because the setup itself forks and a cap below its needs would break it.
+  // It can bind inside the user namespace: RLIMIT_NPROC is waived only for a process
+  // holding CAP_SYS_RESOURCE or CAP_SYS_ADMIN in the INITIAL namespace, which a
+  // namespace root does not have (and the capability set is dropped anyway). There is
+  // no default cap (the old ambient-relative default was never applied here either);
+  // a caller that asks for one gets it, or an honest `unsupported` entry.
+  let nproc = null; let prlimitBin = null;
+  if (limits.maxProcs != null) {
+    try { nproc = validateMaxProcs(limits.maxProcs); } catch (e) {
+      return { error: errorResult('namespace', `invalid resource limit: ${e.message}`) };
+    }
+    prlimitBin = d.prlimitBin();
+  }
 
   let prelude, unsupported;
   try {
-    ({ prelude, unsupported } = buildLimitPrelude(effectiveLimits));
+    ({ prelude, unsupported } = buildLimitPrelude({ ...limits, maxProcs: null }));
   } catch (e) {
     return { error: errorResult('namespace', `invalid resource limit: ${e.message}`) };
   }
+  if (nproc != null && !prlimitBin) unsupported = [...unsupported, 'maxProcs'];
 
   // Fail closed: no usable variant means the confinement cannot be
   // established, so nothing is executed. There is deliberately no path that
@@ -401,6 +415,7 @@ export function buildNamespaceInvocation(argv, {
     SBX_CANARY: canary,
     SBX_FINAL: FINAL_SCRIPT,
   };
+  if (nproc != null && prlimitBin) { sbxEnv.SBX_NPROC = String(nproc); sbxEnv.SBX_PRLIMIT = prlimitBin; }
   let script;
   if (strict) {
     Object.assign(sbxEnv, {

package/src/sandbox/capabilities.js

@@ -77,6 +77,15 @@ export const CONFINE_BINS_UMOUNT = Object.freeze([
   '/usr/bin/umount', '/bin/umount', '/sbin/umount', '/usr/sbin/umount',
 ]);
 
+// The process-limit utility. The resource prelude runs under `/bin/sh`, which is dash on
+// many Linux hosts, and dash's `ulimit` has no `-u`: a process-count cap written there is
+// never applied. The namespace backend therefore applies the cap with this tool, in the
+// final stage and only to the caller's command (a cap applied earlier would starve the
+// confinement setup of the processes it needs). Absent => the cap is declared unsupported.
+export const CONFINE_BINS_PRLIMIT = Object.freeze([
+  '/usr/bin/prlimit', '/bin/prlimit', '/usr/local/bin/prlimit', '/usr/sbin/prlimit', '/sbin/prlimit',
+]);
+
 // Back-compat single-path exports: the first (canonical) candidate.
 export const CONFINE_BIN_USERSPACE = CONFINE_BINS_USERSPACE[0];
 export const CONFINE_BIN_NAMESPACE = CONFINE_BINS_NAMESPACE[0];
@@ -107,6 +116,7 @@ export function resolveNamespaceBin() { return resolveConfineBin(CONFINE_BINS_NA
 export function resolveMountBin() { return resolveConfineBin(CONFINE_BINS_MOUNT); }
 export function resolvePrivDropBin() { return resolveConfineBin(CONFINE_BINS_PRIVDROP); }
 export function resolvePivotBin() { return resolveConfineBin(CONFINE_BINS_PIVOT); }
+export function resolvePrlimitBin() { return resolveConfineBin(CONFINE_BINS_PRLIMIT); }
 export function resolveUmountBin() { return resolveConfineBin(CONFINE_BINS_UMOUNT); }
 
 // Bounded on purpose: a capability check must never hang a scan. The probe is

package/src/sandbox/control-probes.js

@@ -195,9 +195,41 @@ function probeFileSize() {
 
 const UNPROBED_PROCESS_CAP = {
   state: 'unverified',
-  reason: 'a process-count cap is per-uid and system-wide on macOS (a soft brake, not a wall) and did not refuse on the hosted Linux runner in the last release; no enforcement is claimed on any backend',
+  reason: 'a process-count cap is per-uid and system-wide on macOS (a soft brake, not a wall); no enforcement is claimed on that backend. On the Linux namespace backend the cap is probed (see probeProcessCap)',
 };
 
+const PROC_CAP_FORKS = 6;
+/** Forks `PROC_CAP_FORKS` concurrent children; each child announces itself, so a refusal shows as missing announcements. */
+export const PROC_CAP_SCRIPT = `i=0; while [ $i -lt ${PROC_CAP_FORKS} ]; do i=$((i+1)); ( echo CHILD_$i; sleep 1 ) & done; wait; echo DONE`;
+
+const countChildren = (r) => (String(r.stdout || '').match(/CHILD_\d/g) || []).length;
+
+/**
+ * The process-count cap on the namespace backend. A command that forks six
+ * concurrent children is run twice through the real backend: under a generous cap
+ * every child must start (the positive control: the probe can succeed, and the cap
+ * mechanism itself does not break ordinary forking), and under a cap far below
+ * what it needs the kernel must refuse some of them. RLIMIT_NPROC is not enforced
+ * for a process holding CAP_SYS_RESOURCE in the initial namespace, so whether it
+ * binds inside the user namespace is exactly what this measures rather than assumes.
+ *
+ * `run` is a seam so a test can hand it a runner that ignores the cap (or one that
+ * refuses everything) and see the probe say so.
+ */
+export function probeProcessCap({ run = runConfined, mode = {} } = {}) {
+  const root = mk('agsec-probe-p-');
+  try {
+    const cmd = ['/bin/sh', '-c', PROC_CAP_SCRIPT];
+    const generous = run(cmd, { root, ...mode, timeoutMs: 10000, limits: { maxProcs: 512 } });
+    const gOk = countChildren(generous);
+    if (gOk !== PROC_CAP_FORKS) return notProved(`positive control failed: only ${gOk} of ${PROC_CAP_FORKS} children started under a generous cap (${generous.status})`);
+    const tight = run(cmd, { root, ...mode, timeoutMs: 10000, limits: { maxProcs: 3 } });
+    const tOk = countChildren(tight);
+    if (tOk >= PROC_CAP_FORKS) return notProved(`the process-count cap did not refuse: all ${tOk} children started under a cap of 3`);
+    return proved(`${gOk} of ${PROC_CAP_FORKS} children started under a cap of 512; only ${tOk} under a cap of 3`);
+  } finally { rm(root); }
+}
+
 const _cache = new Map();
 export function resetProbeCache() { _cache.clear(); }
 
@@ -229,7 +261,9 @@ export async function probeControls({ force, probes = {} } = {}) {
     await run('network', probeNetwork);
     await run('tree-termination', () => probeTree(backend));
     await run('file-size-limit', probeFileSize);
-    controls['process-cap'] = probes['process-cap'] ? await probes['process-cap']() : UNPROBED_PROCESS_CAP;
+    if (probes['process-cap']) controls['process-cap'] = await probes['process-cap']();
+    else if (backend === 'namespace') await run('process-cap', () => probeProcessCap());
+    else controls['process-cap'] = UNPROBED_PROCESS_CAP;
   }
   const report = { platform: process.platform, backend, controls };
   if (!Object.keys(probes).length) _cache.set(backend, report);
@@ -259,7 +293,7 @@ export function capabilityReport(report) {
     notes: [
       'A state of proved was established by an active probe on THIS host in THIS process; it is not inherited from another platform.',
       'Linux enforcement cannot be exercised on a macOS host. It is evidenced only where the sandbox-linux CI job ran this same probe set.',
-      'Process-count caps are not claimed enforced on any backend.',
+      'A process-count cap is claimed only where its probe reports proved (the Linux namespace backend, on the hosted job); it is never claimed on the macOS backend.',
     ],
   };
 }

package/src/sandbox/limits.js

@@ -54,6 +54,8 @@ export function buildLimitPrelude({
  * e.g. `'0 2>/dev/null; true'` swallows the failure. Coerce and reject
  * anything that is not a finite, non-negative number.
  */
+export function validateMaxProcs(v) { return _num('maxProcs', v); }
+
 function _num(name, v) {
   const n = Number(v);
   if (!Number.isFinite(n) || n < 0) {

package/src/sandbox/linux-probes.js

@@ -27,7 +27,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { runConfined } from './index.js';
 import { buildNamespaceInvocation } from './backend-namespace.js';
-import { heartbeatShell } from './control-probes.js';
+import { heartbeatShell, probeProcessCap } from './control-probes.js';
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 const NODE = process.execPath;
@@ -174,5 +174,6 @@ export async function runLinuxProbes() {
   await step('protected-canary-masked:default', () => probeProtectedCanaryMasked({ run: (a, o) => runConfined(a, { ...o, readRoots: undefined }) }));
   await step('protected-canary-masked:capability', () => probeProtectedCanaryMasked());
   await step('capability-network', () => probeCapabilityNetwork());
+  await step('process-cap:capability', () => probeProcessCap({ mode: { readRoots: [] } }));
   return out;
 }

package/src/sandbox/linux-rootfs.js

@@ -251,6 +251,13 @@ if ! ( : > "$ROOT/.agsec-sbx-wcheck" ) 2>/dev/null; then
 fi
 rm -f "$ROOT/.agsec-sbx-wcheck"
 _cwd="\${SBX_CWD:-$ROOT}"
-unset SBX_PLAN SBX_FINAL SBX_MOUNT SBX_UMOUNT SBX_PIVOT SBX_PRIVDROP SBX_NEWROOT SBX_MASKS SBX_CANARY SBX_STRICT SBX_CWD
+_nproc="$SBX_NPROC"; _prlimit="$SBX_PRLIMIT"
+unset SBX_PLAN SBX_FINAL SBX_MOUNT SBX_UMOUNT SBX_PIVOT SBX_PRIVDROP SBX_NEWROOT SBX_MASKS SBX_CANARY SBX_STRICT SBX_CWD SBX_NPROC SBX_PRLIMIT
+# The process-count cap is applied last, to the caller's command only: the checks
+# above fork, and so does the setup before them. A prlimit that cannot run stops
+# the command (the exec fails), never lets it run uncapped.
+if [ -n "$_nproc" ]; then
+  cd "$_cwd" && exec "$_prlimit" --nproc="$_nproc" -- "$@"
+fi
 cd "$_cwd" && exec "$@"
 `;

package/src/sandbox/supervise.js

@@ -87,7 +87,10 @@ export function superviseSpawn(bin, args, {
     let timer = null;
 
     const sweep = () => { if (pgid) for (const p of snapshotTree(pgid)) tracked.add(p); };
-    const sweeper = setInterval(sweep, sweepMs);
+    // sweepMs <= 0 turns the periodic sweep off. Each sweep is a SYNCHRONOUS `ps`, which blocks the controller's event loop for as long as
+    // it runs; on the namespace backend the kernel ends every member with the supervisor (--kill-child), so the periodic sweep adds nothing
+    // there and only costs responsiveness. The cleanup below still takes its own snapshots.
+    const sweeper = sweepMs > 0 ? setInterval(sweep, sweepMs) : null;
 
     const survivors = () => {
       sweep();
@@ -126,7 +129,8 @@ export function superviseSpawn(bin, args, {
     function finish() {
       if (finishing) return finishing;
       finishing = (async () => {
-        clearInterval(sweeper); clearTimeout(timer);
+        if (sweeper) clearInterval(sweeper);
+        clearTimeout(timer);
         const termination = await terminate();
         try { child.stdout?.destroy(); child.stderr?.destroy(); } catch { /* ignore */ }
         resolve({ spawnError, exitCode, exitSignal, stdout, stderr, timedOut, cancelled, outputCapped, termination });
@@ -180,7 +184,7 @@ export async function runConfinedSupervised(argv, opts = {}) {
   if (backend !== 'userspace' && backend !== 'namespace') {
     return errorResult(backend, `process-tree termination is not implemented or verified on the ${backend} backend; refusing to execute`);
   }
-  const inv = backend === 'userspace' ? buildUserspaceInvocation(argv, opts) : buildNamespaceInvocation(argv, opts);
+  const inv = backend === 'userspace' ? buildUserspaceInvocation(argv, opts) : buildNamespaceInvocation(argv, opts, opts.deps);
   if (inv.error) return inv.error;
   if (backend === 'namespace' && !inv.treeKill) {
     inv.dispose();
@@ -188,7 +192,7 @@ export async function runConfinedSupervised(argv, opts = {}) {
   }
   const r = await superviseSpawn(inv.bin, inv.args, {
     cwd: inv.cwd, env: inv.env, timeoutMs: opts.timeoutMs ?? 10000, graceMs: opts.graceMs ?? 1000,
-    signal: opts.signal, maxOutputBytes: opts.maxOutputBytes,
+    signal: opts.signal, maxOutputBytes: opts.maxOutputBytes, ...(backend === 'namespace' ? { sweepMs: 0 } : {}),
   });
   let rawStderr = r.stderr;
   let unsupported = inv.unsupported;