@openclaw/mxc-sandbox 2026.9.6 → 2026.9.7

package/dist/index.js

@@ -10,11 +10,11 @@ import { createWritableRenameTargetResolver, registerSandboxBackend, resolvePref
 import * as fs$1 from "node:fs";
 import fs, { lstatSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { createHash, randomBytes } from "node:crypto";
-import { isPathInside, removePathWithinRoot, root } from "openclaw/plugin-sdk/file-access-runtime";
+import { extractErrorCode, formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { isPathInside, removePathWithinRoot, resolvePathPrefixSync, root } from "openclaw/plugin-sdk/file-access-runtime";
 import { runCommandBuffered } from "openclaw/plugin-sdk/process-runtime";
 import { FsSafeError } from "openclaw/plugin-sdk/security-runtime";
 import { fileURLToPath } from "node:url";
-import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { execFileSync } from "node:child_process";
 //#region extensions/mxc/src/config.ts
 const MXC_CONTAINMENTS = ["process", "processcontainer"];
@@ -102,23 +102,6 @@ function resolveSdkBinDir() {
 	} catch {}
 	return null;
 }
-function buildSearchPaths(binary, sdkBinDir) {
-	return sdkBinDir ? [path$1.join(sdkBinDir, binary)] : [];
-}
-/** SDK-owned search paths for wxc-exec on Windows. */
-function wxcSearchPaths() {
-	return buildSearchPaths("wxc-exec.exe", resolveSdkBinDir());
-}
-function findBinary(searchPaths) {
-	for (const p of searchPaths) if (fs$1.existsSync(p)) return p;
-	return null;
-}
-/**
-* Resolves the MXC executor binary path.
-* @param configOverride Optional user-configured path override.
-* @returns Absolute path to the binary.
-* @throws If the binary cannot be found.
-*/
 function resolveMxcBinaryPath(configOverride) {
 	if (configOverride) {
 		const resolvedOverride = path$1.win32.isAbsolute(configOverride) ? configOverride : path$1.resolve(configOverride);
@@ -126,9 +109,10 @@ function resolveMxcBinaryPath(configOverride) {
 		return resolvedOverride;
 	}
 	const binaryName = "wxc-exec.exe";
-	const found = findBinary(wxcSearchPaths());
-	if (!found) throw new Error(`MXC executor "${binaryName}" not found. Install @microsoft/mxc-sdk or set mxcBinaryPath in config.`);
-	return found;
+	const sdkBinDir = resolveSdkBinDir();
+	const binaryPath = sdkBinDir ? path$1.join(sdkBinDir, binaryName) : void 0;
+	if (!binaryPath || !fs$1.existsSync(binaryPath)) throw new Error(`MXC executor "${binaryName}" not found. Install @microsoft/mxc-sdk or set mxcBinaryPath in config.`);
+	return binaryPath;
 }
 //#endregion
 //#region extensions/mxc/src/path-comparison.ts
@@ -192,7 +176,7 @@ var MxcFsBridge = class {
 		this.sandbox = sandbox;
 		this.resolveRenameTargets = createWritableRenameTargetResolver((target) => this.resolveTarget(target), (target, action) => this.ensureWritable(target, action));
 		this.defaultContainerRoot = path.resolve(sandbox.containerWorkdir);
-		this.protectedSkillMounts = resolveMxcProtectedSkillMounts$1(sandbox);
+		this.protectedSkillMounts = resolveMxcProtectedSkillMounts(sandbox);
 		this.workspaceMounts = resolveWorkspaceMounts(sandbox);
 	}
 	resolvePath(params) {
@@ -306,14 +290,11 @@ function resolveWorkspaceMounts(sandbox) {
 	const containerRoot = path.resolve(sandbox.containerWorkdir);
 	const workspaceDir = path.resolve(sandbox.workspaceDir);
 	const agentWorkspaceDir = path.resolve(sandbox.agentWorkspaceDir);
-	const mounts = sandbox.workspaceAccess === "rw" ? [{
-		hostRoot: agentWorkspaceDir,
-		containerRoot,
-		writable: true
-	}] : [{
-		hostRoot: workspaceDir,
+	const writable = sandbox.workspaceAccess === "rw";
+	const mounts = [{
+		hostRoot: writable ? agentWorkspaceDir : workspaceDir,
 		containerRoot,
-		writable: false
+		writable
 	}];
 	if (sandbox.workspaceAccess === "ro" && normalizeMxcPathForComparison(agentWorkspaceDir) !== normalizeMxcPathForComparison(workspaceDir)) mounts.push({
 		hostRoot: agentWorkspaceDir,
@@ -322,20 +303,17 @@ function resolveWorkspaceMounts(sandbox) {
 	});
 	return dedupeAndSortMounts(mounts);
 }
-function resolveMxcProtectedSkillMounts$1(sandbox) {
+function resolveMxcProtectedSkillMounts(sandbox) {
 	return dedupeAndSortMounts(resolveMxcReadOnlySkillMounts({
 		agentWorkspaceDir: sandbox.agentWorkspaceDir,
 		skillsWorkspaceDir: sandbox.skillsWorkspaceDir,
 		workdir: sandbox.containerWorkdir,
 		workspaceAccess: sandbox.workspaceAccess
-	}).map(normalizeMxcProtectedSkillMount));
-}
-function normalizeMxcProtectedSkillMount(mount) {
-	return {
+	}).map((mount) => ({
 		hostRoot: path.resolve(mount.hostPath),
 		containerRoot: path.resolve(mount.containerPath),
 		writable: false
-	};
+	})));
 }
 function dedupeAndSortMounts(mounts) {
 	const deduped = /* @__PURE__ */ new Map();
@@ -400,22 +378,14 @@ function resolveSandboxTempDir(env = {}) {
 }
 function resolveBaselineReadonlyPaths(env) {
 	const systemRoot = firstNonBlankEnv(env.SystemRoot, env.WINDIR) ?? "C:\\Windows";
-	return dedupeStable([
-		firstNonBlankEnv(env.ProgramFiles, env.ProgramW6432) ?? "C:\\Program Files",
-		firstNonBlankEnv(env["ProgramFiles(x86)"]) ?? "C:\\Program Files (x86)",
+	const programFiles = firstNonBlankEnv(env.ProgramFiles, env.ProgramW6432) ?? "C:\\Program Files";
+	const programFilesX86 = firstNonBlankEnv(env["ProgramFiles(x86)"]) ?? "C:\\Program Files (x86)";
+	return [.../* @__PURE__ */ new Set([
+		programFiles,
+		programFilesX86,
 		win32.join(systemRoot, "System32"),
 		win32.join(systemRoot, "SysWOW64")
-	]);
-}
-function dedupeStable(values) {
-	const deduped = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const value of values) {
-		if (seen.has(value)) continue;
-		seen.add(value);
-		deduped.push(value);
-	}
-	return deduped;
+	])];
 }
 //#endregion
 //#region extensions/mxc/src/windows-command.ts
@@ -592,7 +562,7 @@ function buildMxcContainerConfig(params) {
 		lifecycle: { destroyOnExit: true },
 		process: {
 			commandLine: buildCommandLine(params.command, params.args ?? []),
-			cwd: resolveProcessCwd(params.workdir),
+			cwd: params.workdir,
 			env: processEnv,
 			timeout: resolveProcessTimeoutSeconds(params.config, params.baseline) * 1e3
 		},
@@ -666,7 +636,7 @@ function resolveBaselineReadonlyPathSpecs(baseline, context) {
 }
 function resolveMxcProtectedSkillPolicyPaths(context) {
 	const deduped = /* @__PURE__ */ new Map();
-	for (const mount of resolveMxcProtectedSkillMounts(context)) {
+	for (const mount of resolveMxcReadOnlySkillMounts(context)) {
 		const hostPath = path.resolve(mount.hostPath);
 		deduped.set(normalizeMxcPathForComparison(hostPath), hostPath);
 		const containerPath = path.resolve(mount.containerPath);
@@ -677,14 +647,6 @@ function resolveMxcProtectedSkillPolicyPaths(context) {
 function resolveProtectedSkillPolicyPathSpecs(context) {
 	return resolveMxcProtectedSkillPolicyPaths(context).map((candidatePath) => optionalFilesystemPath(candidatePath));
 }
-function resolveMxcProtectedSkillMounts(context) {
-	return resolveMxcReadOnlySkillMounts({
-		agentWorkspaceDir: context.agentWorkspaceDir,
-		skillsWorkspaceDir: context.skillsWorkspaceDir,
-		workdir: context.workdir,
-		workspaceAccess: context.workspaceAccess
-	});
-}
 function resolveExistingFilesystemPaths(pathSpecs, accessLabel) {
 	const deduped = /* @__PURE__ */ new Map();
 	for (const pathSpec of pathSpecs) {
@@ -741,9 +703,6 @@ function processContainerName(runtimeId) {
 	const hash = createHash("sha256").update(runtimeId).digest("hex").slice(0, 8);
 	return `${runtimeId.slice(0, PROCESS_CONTAINER_NAME_MAX_LEN - hash.length - 1)}-${hash}`;
 }
-function resolveProcessCwd(workdir) {
-	return workdir;
-}
 function resolveProcessTimeoutSeconds(config, baseline) {
 	if (config.timeoutSecondsConfigured === true) return Math.min(config.timeoutSeconds, baseline.process.timeoutSeconds);
 	return baseline.process.timeoutSeconds;
@@ -761,11 +720,11 @@ function hostPathExists(candidatePath) {
 		statSync(candidatePath);
 		return true;
 	} catch (err) {
-		if (isNodeError$2(err)) return false;
+		if (isNodeError$1(err)) return false;
 		throw err;
 	}
 }
-function isNodeError$2(err) {
+function isNodeError$1(err) {
 	return err instanceof Error && "code" in err;
 }
 //#endregion
@@ -808,31 +767,21 @@ const SandboxPolicyLayerSchema = z.object({
 	process: processPolicySchema.optional()
 }).strict();
 function loadSandboxBaselinePolicy(options = {}) {
-	const sources = [];
-	for (const policyPath of options.policyPaths ?? []) sources.push({
-		label: policyPath,
-		policy: readSandboxPolicyFile(policyPath)
-	});
-	const merged = mergeSandboxPolicyLayers(sources);
+	const layers = (options.policyPaths ?? []).map(readSandboxPolicyFile);
+	const merged = mergeSandboxPolicyLayers(layers);
 	const resolved = resolveSandboxBaseline(merged);
 	return {
 		...resolved,
 		process: {
 			...resolved.process,
-			timeoutSecondsConfigured: sources.some(({ policy }) => policy.process?.timeoutSeconds !== void 0)
+			timeoutSecondsConfigured: layers.some((policy) => policy.process?.timeoutSeconds !== void 0)
 		},
 		configuredPaths: merged.configuredPaths
 	};
 }
 function readSandboxPolicyFile(policyPath) {
-	let parsed;
 	try {
-		parsed = JSON.parse(readFileSync(policyPath, "utf-8"));
-	} catch (err) {
-		throw policyFileError(policyPath, err);
-	}
-	try {
-		return parseSandboxPolicyLayer(parsed, policyPath);
+		return parseSandboxPolicyLayer(JSON.parse(readFileSync(policyPath, "utf-8")), policyPath);
 	} catch (err) {
 		throw policyFileError(policyPath, err);
 	}
@@ -845,41 +794,27 @@ function parseSandboxPolicyLayer(value, sourceLabel) {
 	const readwritePaths = normalizeConfiguredPaths(filesystem?.additionalReadwritePaths, sourceLabel, "filesystem.additionalReadwritePaths");
 	return {
 		...parsed.data,
-		filesystem: filesystem ? {
-			...filesystem,
-			...readonlyPaths.length > 0 ? { additionalReadonlyPaths: readonlyPaths.map((entry) => entry.path) } : {},
-			...readwritePaths.length > 0 ? { additionalReadwritePaths: readwritePaths.map((entry) => entry.path) } : {}
-		} : void 0,
 		configuredPaths: {
 			readonlyPaths,
 			readwritePaths
 		}
 	};
 }
-function mergeSandboxPolicyLayers(sources) {
+function mergeSandboxPolicyLayers(layers) {
 	const timeoutCandidates = [DEFAULT_SANDBOX_BASELINE.process.timeoutSeconds];
-	const filesystem = {
-		restrictToProjectDir: DEFAULT_SANDBOX_BASELINE.filesystem.restrictToProjectDir,
-		additionalReadonlyPaths: [],
-		additionalReadwritePaths: []
-	};
 	const configuredPathMaps = {
 		readonlyPaths: /* @__PURE__ */ new Map(),
 		readwritePaths: /* @__PURE__ */ new Map()
 	};
-	for (const { policy, label } of sources) {
-		mergeFilesystemPolicy(filesystem, policy.filesystem);
+	for (const policy of layers) {
 		mergeConfiguredPathEntries(configuredPathMaps.readonlyPaths, policy.configuredPaths.readonlyPaths);
 		mergeConfiguredPathEntries(configuredPathMaps.readwritePaths, policy.configuredPaths.readwritePaths);
 		const timeoutSeconds = policy.process?.timeoutSeconds;
-		if (timeoutSeconds !== void 0) {
-			assertPositiveFiniteNumber(timeoutSeconds, `${label}.process.timeoutSeconds`);
-			timeoutCandidates.push(timeoutSeconds);
-		}
+		if (timeoutSeconds !== void 0) timeoutCandidates.push(timeoutSeconds);
 	}
 	return {
 		filesystem: {
-			...filesystem,
+			restrictToProjectDir: DEFAULT_SANDBOX_BASELINE.filesystem.restrictToProjectDir,
 			additionalReadonlyPaths: [...configuredPathMaps.readonlyPaths.values()].map((entry) => entry.path),
 			additionalReadwritePaths: [...configuredPathMaps.readwritePaths.values()].map((entry) => entry.path)
 		},
@@ -890,10 +825,6 @@ function mergeSandboxPolicyLayers(sources) {
 		}
 	};
 }
-function mergeFilesystemPolicy(target, layer) {
-	if (!target || !layer) return;
-	target.restrictToProjectDir = mostRestrictiveBoolean(DEFAULT_SANDBOX_BASELINE.filesystem.restrictToProjectDir, target.restrictToProjectDir, layer.restrictToProjectDir);
-}
 function mergeConfiguredPathEntries(target, entries) {
 	for (const entry of entries) {
 		const existing = target.get(entry.path);
@@ -936,21 +867,15 @@ function assertConfiguredPathExists(pathValue, source) {
 	try {
 		statSync(pathValue);
 	} catch (err) {
-		if (isNodeError$1(err)) {
+		if (isNodeError(err)) {
 			if (err.code === "ENOENT") throw new Error(`Sandbox policy path ${pathValue} configured by ${source} does not exist on the host. Create the path or update the policy file.`, { cause: err });
 			throw new Error(`Sandbox policy path ${pathValue} configured by ${source} is not accessible on the host: ${formatErrorMessage(err)}`, { cause: err });
 		}
 		throw err;
 	}
 }
-function mostRestrictiveBoolean(defaultValue, ...values) {
-	return defaultValue || values.some((value) => value === true);
-}
-function assertPositiveFiniteNumber(value, label) {
-	if (typeof value !== "number" || !Number.isFinite(value) || value < 1) throw new TypeError(`Sandbox policy field ${label} must be a positive number.`);
-}
 function policyFileError(policyPath, err) {
-	if (isNodeError$1(err) && err.code === "ENOENT") return new Error(`Configured sandbox policy file ${policyPath} does not exist. Remove it from mxcPolicyPaths or create the file.`, { cause: err });
+	if (isNodeError(err) && err.code === "ENOENT") return new Error(`Configured sandbox policy file ${policyPath} does not exist. Remove it from mxcPolicyPaths or create the file.`, { cause: err });
 	return new Error(`Failed to load sandbox policy file at ${policyPath}: ${formatErrorMessage(err)}`, { cause: err instanceof Error ? err : void 0 });
 }
 function formatSandboxPolicyIssue(sourceLabel, issue) {
@@ -974,7 +899,7 @@ function formatIssuePath(pathSegments) {
 	}
 	return label;
 }
-function isNodeError$1(err) {
+function isNodeError(err) {
 	return err instanceof Error && "code" in err;
 }
 //#endregion
@@ -1019,15 +944,12 @@ function cleanupLauncherPayloadFile(token) {
 function createSandboxTempDir(hostEnv) {
 	return mkdtempSync(path.join(resolveSandboxTempDir(hostEnv), "openclaw-mxc-sandbox-"));
 }
-function assertWorkdirInsideWorkspace(workspaceDir, workdir) {
-	const workspace = realpathForExistingPath(workspaceDir, "sandbox workspace");
-	const candidate = realpathForPotentialPath(workdir);
-	if (isPathInside(workspace, candidate)) return candidate;
-	throw new Error(`MXC sandbox workdir ${workdir} is outside the sandbox workspace ${workspaceDir}. Use a workdir inside the sandbox workspace.`);
-}
 function resolveWorkdirInsideWorkspace(workspaceDir, workdir) {
-	const candidate = assertWorkdirInsideWorkspace(workspaceDir, workdir);
+	const workspace = realpathForExistingPath(workspaceDir, "sandbox workspace");
 	try {
+		const { existingPath, unresolvedSegments } = resolvePathPrefixSync(workdir);
+		const candidate = path.join(existingPath, ...unresolvedSegments);
+		if (!isPathInside(workspace, candidate)) throw new Error(`MXC sandbox workdir ${workdir} is outside the sandbox workspace ${workspaceDir}. Use a workdir inside the sandbox workspace.`);
 		if (statSync(candidate).isDirectory()) return candidate;
 	} catch (err) {
 		if (isMissingPathError(err)) throw new Error(`MXC sandbox workdir ${workdir} does not exist.`, { cause: err });
@@ -1043,22 +965,9 @@ function realpathForExistingPath(value, label) {
 		throw err;
 	}
 }
-function realpathForPotentialPath(value) {
-	const resolved = path.resolve(value);
-	try {
-		return realpathSync(resolved);
-	} catch (err) {
-		if (!isMissingPathError(err)) throw err;
-		const parent = path.dirname(resolved);
-		if (parent === resolved) throw new Error(`MXC sandbox workdir ${value} does not exist.`, { cause: err });
-		return path.join(realpathForPotentialPath(parent), path.basename(resolved));
-	}
-}
-function isNodeError(err) {
-	return err instanceof Error && "code" in err;
-}
 function isMissingPathError(err) {
-	return isNodeError(err) && (err.code === "ENOENT" || err.code === "ENOTDIR");
+	const code = extractErrorCode(err);
+	return code === "ENOENT" || code === "ENOTDIR";
 }
 function buildMxcLauncherOptions(config, usePty) {
 	const options = {
@@ -1162,13 +1071,14 @@ function createMxcSandboxBackendHandle(params) {
 			const runtimeWorkdir = resolveMxcRuntimeWorkdir(workspace, effectiveWorkdir);
 			const baselineContext = resolveCurrentBaselineContext(workspace.activeWorkspaceDir);
 			const sandboxTempDir = createSandboxTempDir(baselineContext.hostEnv);
-			const commandBridge = createWindowsCommandBridge({
-				args: cmdParams.args,
-				script: cmdParams.script,
-				tempDir: sandboxTempDir
-			});
-			const execInput = cmdParams.stdin === void 0 ? Buffer.alloc(0) : toBuffer(cmdParams.stdin);
+			let commandBridge;
 			try {
+				commandBridge = createWindowsCommandBridge({
+					args: cmdParams.args,
+					script: cmdParams.script,
+					tempDir: sandboxTempDir
+				});
+				const execInput = cmdParams.stdin === void 0 ? Buffer.alloc(0) : toBuffer(cmdParams.stdin);
 				const payloadFile = createMxcLauncherPayload(restrictiveConfig, buildMxcContainerConfig({
 					config: restrictiveConfig,
 					baseline,
@@ -1214,7 +1124,7 @@ function createMxcSandboxBackendHandle(params) {
 					cleanupLauncherPayloadFile(payloadFile);
 				}
 			} finally {
-				commandBridge.cleanup();
+				commandBridge?.cleanup();
 				rmSync(sandboxTempDir, {
 					force: true,
 					recursive: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/mxc-sandbox",
-  "version": "2026.9.6",
+  "version": "2026.9.7",
   "description": "OpenClaw MXC sandbox execution plugin for MXC-capable hosts",
   "repository": {
     "type": "git",
@@ -22,10 +22,10 @@
       "minHostVersion": ">=2026.6.11"
     },
     "compat": {
-      "pluginApi": ">=2026.9.6"
+      "pluginApi": ">=2026.9.7"
     },
     "build": {
-      "openclawVersion": "2026.9.6",
+      "openclawVersion": "2026.9.7",
       "bundledDist": false,
       "staticAssets": [
         {
@@ -50,7 +50,7 @@
     "assets/activity.svg"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.9.6"
+    "openclaw": ">=2026.9.7"
   },
   "peerDependenciesMeta": {
     "openclaw": {