@holoscript/holosystem 0.2.3 → 0.2.5

package/native/windows-sandbox/README.md

@@ -0,0 +1,30 @@
+# Windows low-integrity Job launcher
+
+`Program.cs` is the auditable source for the Windows AMD64 launcher consumed by
+`vm-launch-whpx-sandboxed`. `Canary.c` is the native zero-capability file and
+loopback probe consumed only by `vm-launch-whpx-appcontainer`. `build.ps1`
+compiles the launcher with the inbox .NET
+Framework AMD64 compiler and writes the measured artifact to
+`../windows-x64/holosystem-sandbox-launcher.exe`; it compiles the canary with
+the installed Visual C++ AMD64 tools into
+`../windows-x64/holosystem-appcontainer-canary.exe`.
+
+The release contract pins the executable digest, not an unverified source-build
+claim. The inbox compiler does not offer deterministic output, so a rebuild is
+expected to change the binary digest even when the source is unchanged. Review
+the source and binary delta, update the plan fixture, run the HoloSystem package
+checks, and complete a real two-launch WHPX receipt before publishing a rebuilt
+launcher.
+
+The low-integrity adapter applies only the process controls it reports: maximum-privilege
+filtering, low integrity, an explicit three-handle inheritance list, and a
+pre-resume Job Object with kill, process-count, memory, and UI limits. It is not
+an AppContainer and does not claim filesystem confidentiality or network
+capability isolation.
+
+The AppContainer adapter creates an ephemeral zero-capability identity, applies
+fixed snapshot/temp grants, and runs the measured native canary under the same
+restricted AppContainer token before starting QEMU. Both binaries are pinned by
+the plan and remeasured around each launch. A successful canary is not enough:
+the launcher requires exact file and Winsock access-denied evidence and verifies
+the suspended QEMU token independently.

package/native/windows-sandbox/build.ps1

@@ -0,0 +1,48 @@
+$ErrorActionPreference = 'Stop'
+
+$source = Join-Path $PSScriptRoot 'Program.cs'
+$outputDirectory = Join-Path (Split-Path $PSScriptRoot -Parent) 'windows-x64'
+$output = Join-Path $outputDirectory 'holosystem-sandbox-launcher.exe'
+$canarySource = Join-Path $PSScriptRoot 'Canary.c'
+$canaryOutput = Join-Path $outputDirectory 'holosystem-appcontainer-canary.exe'
+$compiler = Join-Path $env:SystemRoot 'Microsoft.NET\Framework64\v4.0.30319\csc.exe'
+
+if (-not (Test-Path -LiteralPath $compiler -PathType Leaf)) {
+  throw 'The Windows .NET Framework AMD64 compiler is unavailable.'
+}
+
+New-Item -ItemType Directory -Path $outputDirectory -Force | Out-Null
+& $compiler /nologo /target:exe /platform:x64 /optimize+ /debug- /out:$output $source
+if ($LASTEXITCODE -ne 0) {
+  throw "Native sandbox launcher compilation failed with exit code $LASTEXITCODE."
+}
+
+$vswhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
+$visualStudio = & $vswhere -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath
+if (-not $visualStudio) {
+  throw 'The Visual C++ AMD64 build tools are unavailable.'
+}
+$msvc = Get-ChildItem (Join-Path $visualStudio 'VC\Tools\MSVC') -Directory | Sort-Object Name -Descending | Select-Object -First 1
+$kitsRoot = Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10'
+$kit = Get-ChildItem (Join-Path $kitsRoot 'Include') -Directory | Sort-Object Name -Descending | Select-Object -First 1
+if (-not $msvc -or -not $kit) {
+  throw 'The Visual C++ or Windows SDK directories are unavailable.'
+}
+$env:Path = "$(Join-Path $msvc.FullName 'bin\Hostx64\x64');$env:Path"
+$env:Include = @(
+  (Join-Path $msvc.FullName 'include'),
+  (Join-Path $kit.FullName 'ucrt'),
+  (Join-Path $kit.FullName 'shared'),
+  (Join-Path $kit.FullName 'um')
+) -join ';'
+$env:Lib = @(
+  (Join-Path $msvc.FullName 'lib\x64'),
+  (Join-Path $kitsRoot "Lib\$($kit.Name)\ucrt\x64"),
+  (Join-Path $kitsRoot "Lib\$($kit.Name)\um\x64")
+) -join ';'
+& cl.exe /nologo /O2 /MT /W4 /WX /DUNICODE /D_UNICODE "/Fe:$canaryOutput" $canarySource /link ws2_32.lib advapi32.lib
+if ($LASTEXITCODE -ne 0) {
+  throw "Native AppContainer canary compilation failed with exit code $LASTEXITCODE."
+}
+
+Get-FileHash -LiteralPath $output, $canaryOutput -Algorithm SHA256 | Select-Object Path, Hash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holoscript/holosystem",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Portable bootstrap, consumption catalog, lineage, and bounded-work contract for HoloSystem consumers.",
   "releaseLane": "v0-preview",
   "keywords": [
@@ -34,6 +34,7 @@
   "files": [
     "bin",
     "docs",
+    "native",
     "src",
     "README.md",
     "LICENSE"

package/src/index.mjs

@@ -30,11 +30,31 @@ export {
   HOLOSYSTEM_VM_LAUNCH_RECEIPT_SCHEMA,
   HOLOSYSTEM_WHPX_VM_LAUNCH_PLAN_SCHEMA,
   HOLOSYSTEM_WHPX_VM_LAUNCH_RECEIPT_SCHEMA,
+  HOLOSYSTEM_WHPX_SANDBOXED_VM_LAUNCH_PLAN_SCHEMA,
+  HOLOSYSTEM_WHPX_SANDBOXED_VM_LAUNCH_RECEIPT_SCHEMA,
+  HOLOSYSTEM_WHPX_APPCONTAINER_VM_LAUNCH_PLAN_SCHEMA,
+  HOLOSYSTEM_WHPX_APPCONTAINER_VM_LAUNCH_RECEIPT_SCHEMA,
+  HOLOSYSTEM_APPCONTAINER_VM_LAUNCH_PLAN_SCHEMA,
+  HOLOSYSTEM_APPCONTAINER_VM_LAUNCH_RECEIPT_SCHEMA,
+  HOLOSYSTEM_WINDOWS_APPCONTAINER_PROTOCOL,
+  HOLOSYSTEM_WINDOWS_APPCONTAINER_CANARY_DIGEST,
+  HOLOSYSTEM_WINDOWS_APPCONTAINER_CANARY_SCHEMA,
+  HOLOSYSTEM_WINDOWS_SANDBOX_LAUNCHER_DIGEST,
+  HOLOSYSTEM_WINDOWS_SANDBOX_LAUNCHER_SCHEMA,
+  HOLOSYSTEM_WINDOWS_SANDBOX_PROTOCOL,
   inspectVmExecutor,
+  inspectAppContainerVmLaunchPlan,
   inspectVmLaunchAsset,
   inspectVmLaunchPlan,
+  inspectWindowsVmSandboxLauncher,
+  inspectWindowsVmAppContainerCanary,
+  inspectWhpxSandboxedVmLaunchPlan,
+  inspectWhpxAppContainerVmLaunchPlan,
   inspectWhpxVmLaunchPlan,
   runVmLaunch,
+  runAppContainerVmLaunch,
+  runWhpxSandboxedVmLaunch,
+  runWhpxAppContainerVmLaunch,
   runWhpxVmLaunch,
 } from './vm-launch.mjs';