@openclaw/mxc-sandbox 2026.9.8 → 2026.10.1-beta.2

package/README.md

@@ -38,7 +38,9 @@ readiness behavior to change as MXC host support matures.
 
 - Plugin id: `mxc`
 - Package: `@openclaw/mxc-sandbox`
-- Minimum OpenClaw host: `2026.6.11`
+- Minimum OpenClaw install host: `2026.6.11`
+- Plugin API host requirement: `2026.9.6` or newer. An older host cannot run
+  the current plugin even if the MXC executor is updated.
 
 ## Plugin config
 
@@ -48,7 +50,7 @@ and out-of-range values fail plugin activation with an actionable error
 
 | Field            | Type                              | Default                                | Notes                                                                                                                                                         |
 | ---------------- | --------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `mxcBinaryPath`  | `string`                          | unset                                  | Non-empty override for the `wxc-exec.exe` executor path; see [SDK-only executor discovery](#supported).                                                       |
+| `mxcBinaryPath`  | `string`                          | unset                                  | Non-empty override for a compatible `wxc-exec.exe` supporting `--probe`; see [Host readiness](#host-readiness).                                               |
 | `containment`    | `"process" \| "processcontainer"` | `"process"`                            | Both currently resolve to Windows ProcessContainer.                                                                                                           |
 | `network`        | `"none" \| "default"`             | `"none"`                               | `"default"` allows outbound network via the `internetClient` capability.                                                                                      |
 | `timeoutSeconds` | `number`                          | unset (baseline default `300` applies) | Must be `>= 1` and `<= 2147000` (the largest Node-safe `setTimeout` delay in whole seconds). Capped to the sandbox policy baseline timeout when both are set. |
@@ -86,7 +88,7 @@ help stay in sync with plugin runtime validation.
 - OpenClaw passes per-run command, environment, and filesystem config to the
   plugin's Node launcher through a short-lived local payload file, and deletes
   that file and its temp directory when the launcher or run finishes.
-- `@microsoft/mxc-sdk@0.7.0` then carries the full base64 request envelope on
+- `@microsoft/mxc-sdk@0.8.0` then carries the full base64 request envelope on
   the native `wxc-exec` process argv. A host user with process-inspection rights
   can observe that command, environment, and policy data while the process is
   running. Do not put secrets in MXC command arguments or environment values
@@ -257,8 +259,33 @@ agents may still use them.
 
 ## Host readiness
 
-IsoEnvBroker must be available on the host OS. The plugin checks this before
-registering the sandbox backend.
+Before registering the sandbox backend, the plugin runs the MXC executor's own
+host probe (`wxc-exec --probe`) and requires it to select an isolation tier
+(`base-container`, `appcontainer-bfs`, or `appcontainer-dacl`). It probes the
+same executor it launches, including an `mxcBinaryPath` override. MXC's tier
+degradation warnings are logged but do not block activation. To inspect a host,
+run the executor directly:
+
+```powershell
+& node_modules\@microsoft\mxc-sdk\bin\x64\wxc-exec.exe --probe
+```
+
+Use `bin\arm64` on Arm64 hosts.
+
+An existing `mxcBinaryPath` override must point to an MXC 0.8.0-compatible
+executor that supports `--probe`. An older executor stops plugin activation;
+the plugin cannot safely infer readiness from a Windows service name or probe a
+different binary. If the override fails, run that exact executable with
+`--probe` to see its error. Update the override to a compatible executor, or
+remove it to use the `@microsoft/mxc-sdk@0.8.0` executor installed with the
+plugin:
+
+```powershell
+openclaw config unset plugins.entries.mxc.config.mxcBinaryPath
+```
+
+Restart the Gateway after changing the override. If the SDK executor also
+fails `--probe`, address the reported host-readiness error before retrying.
 
 Host preparation is advisory. If directory listing inside the sandbox fails with
 `Access is denied`, run this once from an elevated prompt:

package/dist/index.js

@@ -192,14 +192,14 @@ var MxcFsBridge = class {
 	}
 	async readFile(params) {
 		const target = this.resolveTarget(params);
-		return await (await root(target.mount.hostRoot)).readBytes(target.mountRelativePath, {
+		return await (await root(target.mount.hostRoot)).readBytes(target.relativePath, {
 			hardlinks: "reject",
 			...params.maxBytes === void 0 ? {} : { maxBytes: params.maxBytes }
 		});
 	}
 	async readDirectory(params) {
 		const target = this.resolveTarget(params);
-		return (await (await root(target.mount.hostRoot)).list(target.mountRelativePath, { withFileTypes: true })).map(({ name, isDirectory }) => ({
+		return (await (await root(target.mount.hostRoot)).list(target.relativePath, { withFileTypes: true })).map(({ name, isDirectory }) => ({
 			name,
 			isDirectory
 		}));
@@ -208,14 +208,14 @@ var MxcFsBridge = class {
 		const target = this.resolveTarget(params);
 		this.ensureWritable(target, "write files");
 		const buffer = Buffer.isBuffer(params.data) ? params.data : Buffer.from(params.data, params.encoding ?? "utf8");
-		await (await root(target.mount.hostRoot)).write(target.mountRelativePath, buffer, { mkdir: params.mkdir !== false });
+		await (await root(target.mount.hostRoot)).write(target.relativePath, buffer, { mkdir: params.mkdir !== false });
 	}
 	async createFileExclusive(params) {
 		const target = this.resolveTarget(params);
 		this.ensureWritable(target, "create files");
 		const buffer = Buffer.isBuffer(params.data) ? params.data : Buffer.from(params.data, params.encoding ?? "utf8");
 		try {
-			await (await root(target.mount.hostRoot)).create(target.mountRelativePath, buffer, { mkdir: params.mkdir !== false });
+			await (await root(target.mount.hostRoot)).create(target.relativePath, buffer, { mkdir: params.mkdir !== false });
 			return "created";
 		} catch (error) {
 			if (error instanceof FsSafeError && error.code === "already-exists") return "exists";
@@ -225,32 +225,32 @@ var MxcFsBridge = class {
 	async mkdirp(params) {
 		const target = this.resolveTarget(params);
 		this.ensureWritable(target, "create directories");
-		if (target.mountRelativePath.length === 0) return;
-		await (await root(target.mount.hostRoot)).mkdir(target.mountRelativePath);
+		if (target.relativePath.length === 0) return;
+		await (await root(target.mount.hostRoot)).mkdir(target.relativePath);
 	}
 	async remove(params) {
 		const target = this.resolveTarget(params);
 		this.ensureWritable(target, "remove files");
 		await removePathWithinRoot({
 			rootDir: target.mount.hostRoot,
-			relativePath: target.mountRelativePath,
+			relativePath: target.relativePath,
 			recursive: params.recursive,
 			force: params.force ?? false
 		});
 	}
 	async rename(params) {
 		const { from: source, to: target } = this.resolveRenameTargets(params);
-		if (!isSameMountRoot(source.mount.hostRoot, target.mount.hostRoot)) throw new Error(`Sandbox rename must stay within the same mounted root: ${source.containerPath} -> ${target.containerPath}`);
+		if (normalizeMxcPathForComparison(source.mount.hostRoot) !== normalizeMxcPathForComparison(target.mount.hostRoot)) throw new Error(`Sandbox rename must stay within the same mounted root: ${source.containerPath} -> ${target.containerPath}`);
 		const root$1 = await root(source.mount.hostRoot);
-		const targetParent = resolveRelativeParentPath(target.mountRelativePath);
-		if (targetParent) await root$1.mkdir(targetParent);
-		await root$1.move(source.mountRelativePath, target.mountRelativePath, { overwrite: true });
+		const targetParent = path.dirname(target.relativePath);
+		if (targetParent !== "." && targetParent !== "") await root$1.mkdir(targetParent);
+		await root$1.move(source.relativePath, target.relativePath, { overwrite: true });
 	}
 	async stat(params) {
 		const target = this.resolveTarget(params);
 		const root$2 = await root(target.mount.hostRoot);
-		if (!await root$2.exists(target.mountRelativePath)) return null;
-		const stats = await root$2.stat(target.mountRelativePath);
+		if (!await root$2.exists(target.relativePath)) return null;
+		const stats = await root$2.stat(target.relativePath);
 		return {
 			type: stats.isDirectory ? "directory" : stats.isFile ? "file" : "other",
 			size: stats.size,
@@ -261,29 +261,21 @@ var MxcFsBridge = class {
 		const input = params.filePath.trim();
 		const cwd = params.cwd?.trim() ? path.resolve(params.cwd) : this.defaultContainerRoot;
 		const containerPath = path.isAbsolute(input) ? path.resolve(input) : path.resolve(cwd, input);
-		return this.resolveMountedTarget(containerPath, this.protectedSkillMounts) ?? this.resolveMountedTarget(containerPath, this.workspaceMounts) ?? this.throwSandboxRootEscape(params.filePath);
-	}
-	resolveMountedTarget(containerPath, mounts) {
-		for (const mount of mounts) {
+		for (const mount of [...this.protectedSkillMounts, ...this.workspaceMounts]) {
 			if (!isPathInside(mount.containerRoot, containerPath)) continue;
 			const mountRelativePath = path.relative(mount.containerRoot, containerPath);
 			return {
 				hostPath: path.join(mount.hostRoot, mountRelativePath),
 				relativePath: mountRelativePath,
 				containerPath,
-				mount,
-				mountRelativePath,
-				writable: mount.writable
+				mount
 			};
 		}
-		return null;
-	}
-	throwSandboxRootEscape(filePath) {
 		const allowedRoots = [...new Set(this.workspaceMounts.map((mount) => mount.containerRoot))].join(", ");
-		throw new Error(`Path escapes sandbox root (${allowedRoots}; container root ${this.sandbox.containerWorkdir}): ${filePath}. Use a path under ${this.sandbox.containerWorkdir}\\ instead.`);
+		throw new Error(`Path escapes sandbox root (${allowedRoots}; container root ${this.sandbox.containerWorkdir}): ${params.filePath}. Use a path under ${this.sandbox.containerWorkdir}\\ instead.`);
 	}
 	ensureWritable(target, action) {
-		if (!target.writable) throw new Error(`Sandbox path is read-only; cannot ${action}: ${target.containerPath}`);
+		if (!target.mount.writable) throw new Error(`Sandbox path is read-only; cannot ${action}: ${target.containerPath}`);
 	}
 };
 function resolveWorkspaceMounts(sandbox) {
@@ -321,58 +313,13 @@ function dedupeAndSortMounts(mounts) {
 		const key = `${normalizeMxcPathForComparison(mount.hostRoot)}::${normalizeMxcPathForComparison(mount.containerRoot)}`;
 		if (!deduped.has(key)) deduped.set(key, mount);
 	}
-	return [...deduped.values()].toSorted((left, right) => {
-		const lengthDiff = right.containerRoot.length - left.containerRoot.length;
-		if (lengthDiff !== 0) return lengthDiff;
-		return right.hostRoot.length - left.hostRoot.length;
-	});
-}
-function resolveRelativeParentPath(relativePath) {
-	const parent = path.dirname(relativePath);
-	return parent === "." || parent === "" ? null : parent;
-}
-function isSameMountRoot(first, second) {
-	return normalizeMxcPathForComparison(first) === normalizeMxcPathForComparison(second);
+	return [...deduped.values()].toSorted((left, right) => right.containerRoot.length - left.containerRoot.length || right.hostRoot.length - left.hostRoot.length);
 }
 //#endregion
 //#region extensions/mxc/src/sandbox-baseline.ts
-/**
-* Deterministic MXC sandbox baseline policy helpers.
-*
-* These helpers only include policy surfaces the Windows ProcessContainer path
-* currently enforces: workspace/read-only/read-write paths and process timeout.
-*/
-const BASELINE_TIMEOUT_SECONDS = 300;
-const DEFAULT_SANDBOX_BASELINE = {
-	filesystem: {
-		restrictToProjectDir: true,
-		additionalReadonlyPaths: [],
-		additionalReadwritePaths: []
-	},
-	process: {
-		timeoutSeconds: BASELINE_TIMEOUT_SECONDS,
-		timeoutSecondsConfigured: false
-	}
-};
 function firstNonBlankEnv(...values) {
 	return values.find((value) => value?.trim());
 }
-function resolveSandboxBaseline(input = {}) {
-	const timeoutSecondsConfigured = input.process?.timeoutSeconds !== void 0;
-	const timeoutSeconds = input.process?.timeoutSeconds ?? BASELINE_TIMEOUT_SECONDS;
-	if (!Number.isFinite(timeoutSeconds) || timeoutSeconds < 1) throw new RangeError("Sandbox baseline timeoutSeconds must be at least 1.");
-	return {
-		filesystem: {
-			restrictToProjectDir: input.filesystem?.restrictToProjectDir ?? true,
-			additionalReadonlyPaths: [...input.filesystem?.additionalReadonlyPaths ?? []],
-			additionalReadwritePaths: [...input.filesystem?.additionalReadwritePaths ?? []]
-		},
-		process: {
-			timeoutSeconds,
-			timeoutSecondsConfigured
-		}
-	};
-}
 function resolveSandboxTempDir(env = {}) {
 	return firstNonBlankEnv(env.TEMP, env.TMP) ?? "C:\\Windows\\Temp";
 }
@@ -509,7 +456,6 @@ function buildLauncherEnv(hostEnv = process.env) {
 //#endregion
 //#region extensions/mxc/src/mxc-container-config.ts
 const MXC_SCHEMA_VERSION = "0.7.0-alpha";
-const PROCESS_CONTAINER_NAME_MAX_LEN = 64;
 function resolveCurrentBaselineContext(projectDir) {
 	return {
 		projectDir: path.resolve(projectDir),
@@ -559,7 +505,10 @@ function buildMxcContainerConfig(params) {
 		version: MXC_SCHEMA_VERSION,
 		containerId: params.containerId,
 		containment: params.config.containment,
-		lifecycle: { destroyOnExit: true },
+		lifecycle: {
+			destroyOnExit: true,
+			preservePolicy: false
+		},
 		process: {
 			commandLine: buildCommandLine(params.command, params.args ?? []),
 			cwd: params.workdir,
@@ -577,7 +526,6 @@ function buildMxcContainerConfig(params) {
 			enforcementMode: "capabilities"
 		},
 		processContainer: {
-			name: processContainerName(params.runtimeId),
 			leastPrivilege: true,
 			capabilities: networkAllowed ? ["internetClient"] : [],
 			ui: {
@@ -590,19 +538,20 @@ function buildMxcContainerConfig(params) {
 	};
 }
 function buildFilesystemConfig(params) {
-	const readwritePathSpecs = resolveWorkspaceReadwritePathSpecs(params.workspace);
-	const readonlyPathSpecs = [
-		...resolveWorkspaceReadonlyPathSpecs(params.workspace),
-		...resolveBaselineReadonlyPathSpecs(params.baseline, params.context),
-		...resolveProtectedSkillPolicyPathSpecs(params.workspace)
-	];
-	if (params.baseline.filesystem.restrictToProjectDir) {
-		const projectDirPath = params.context.projectDir;
-		if (params.workspace.workspaceAccess === "rw") readwritePathSpecs.push(requiredFilesystemPath(projectDirPath));
-		else readonlyPathSpecs.push(requiredFilesystemPath(projectDirPath));
-		readwritePathSpecs.push(requiredFilesystemPath(path.resolve(params.sandboxTempDir)));
-		readwritePathSpecs.push(...params.baseline.configuredPaths.readwritePaths.map(createConfiguredFilesystemPath));
+	const readwritePathSpecs = [];
+	const readonlyPathSpecs = [];
+	const workspace = params.workspace;
+	if (workspace.workspaceAccess === "rw") readwritePathSpecs.push(requiredFilesystemPath(workspace.activeWorkspaceDir));
+	else {
+		readonlyPathSpecs.push(requiredFilesystemPath(workspace.workspaceDir));
+		if (workspace.workspaceAccess === "ro" && normalizeMxcPathForComparison(workspace.agentWorkspaceDir) !== normalizeMxcPathForComparison(workspace.workspaceDir)) readonlyPathSpecs.push(requiredFilesystemPath(workspace.agentWorkspaceDir));
 	}
+	readonlyPathSpecs.push(...resolveBaselineReadonlyPaths(params.context.hostEnv).map((candidatePath) => optionalFilesystemPath(path.resolve(candidatePath))), ...params.baseline.configuredPaths.readonlyPaths.map(createConfiguredFilesystemPath), ...resolveMxcProtectedSkillPolicyPaths(workspace).map(optionalFilesystemPath));
+	const projectDirPath = params.context.projectDir;
+	if (params.workspace.workspaceAccess === "rw") readwritePathSpecs.push(requiredFilesystemPath(projectDirPath));
+	else readonlyPathSpecs.push(requiredFilesystemPath(projectDirPath));
+	readwritePathSpecs.push(requiredFilesystemPath(path.resolve(params.sandboxTempDir)));
+	readwritePathSpecs.push(...params.baseline.configuredPaths.readwritePaths.map(createConfiguredFilesystemPath));
 	const protectedSkillPolicyPaths = resolveMxcProtectedSkillPolicyPaths(params.workspace);
 	assertNoMxcReadwriteReadonlyOverlap({
 		readwritePaths: resolveExistingFilesystemPaths(readwritePathSpecs, "readwrite"),
@@ -617,23 +566,9 @@ function buildFilesystemConfig(params) {
 	return {
 		readonlyPaths,
 		deniedPaths: void 0,
-		readwritePaths,
-		clearPolicyOnExit: true
+		readwritePaths
 	};
 }
-function resolveWorkspaceReadwritePathSpecs(workspace) {
-	if (workspace.workspaceAccess !== "rw") return [];
-	return [requiredFilesystemPath(workspace.activeWorkspaceDir)];
-}
-function resolveWorkspaceReadonlyPathSpecs(workspace) {
-	if (workspace.workspaceAccess === "rw") return [];
-	const readonlyPathSpecs = [requiredFilesystemPath(workspace.workspaceDir)];
-	if (workspace.workspaceAccess === "ro" && normalizeMxcPathForComparison(workspace.agentWorkspaceDir) !== normalizeMxcPathForComparison(workspace.workspaceDir)) readonlyPathSpecs.push(requiredFilesystemPath(workspace.agentWorkspaceDir));
-	return readonlyPathSpecs;
-}
-function resolveBaselineReadonlyPathSpecs(baseline, context) {
-	return [...resolveBaselineReadonlyPaths(context.hostEnv).map((candidatePath) => optionalFilesystemPath(path.resolve(candidatePath))), ...baseline.configuredPaths.readonlyPaths.map(createConfiguredFilesystemPath)];
-}
 function resolveMxcProtectedSkillPolicyPaths(context) {
 	const deduped = /* @__PURE__ */ new Map();
 	for (const mount of resolveMxcReadOnlySkillMounts(context)) {
@@ -644,9 +579,6 @@ function resolveMxcProtectedSkillPolicyPaths(context) {
 	}
 	return [...deduped.values()];
 }
-function resolveProtectedSkillPolicyPathSpecs(context) {
-	return resolveMxcProtectedSkillPolicyPaths(context).map((candidatePath) => optionalFilesystemPath(candidatePath));
-}
 function resolveExistingFilesystemPaths(pathSpecs, accessLabel) {
 	const deduped = /* @__PURE__ */ new Map();
 	for (const pathSpec of pathSpecs) {
@@ -698,11 +630,6 @@ function buildMissingFilesystemPathMessage(pathValue, accessLabel, sources) {
 	if (sourceLabel) return `MXC sandbox ${accessLabel} path ${pathValue} configured by ${sourceLabel} is missing on the host. Recreate the path or update the policy file before launching the sandbox.`;
 	return `MXC sandbox ${accessLabel} path ${pathValue} does not exist on the host.`;
 }
-function processContainerName(runtimeId) {
-	if (runtimeId.length <= PROCESS_CONTAINER_NAME_MAX_LEN) return runtimeId;
-	const hash = createHash("sha256").update(runtimeId).digest("hex").slice(0, 8);
-	return `${runtimeId.slice(0, PROCESS_CONTAINER_NAME_MAX_LEN - hash.length - 1)}-${hash}`;
-}
 function resolveProcessTimeoutSeconds(config, baseline) {
 	if (config.timeoutSecondsConfigured === true) return Math.min(config.timeoutSeconds, baseline.process.timeoutSeconds);
 	return baseline.process.timeoutSeconds;
@@ -767,17 +694,7 @@ const SandboxPolicyLayerSchema = z.object({
 	process: processPolicySchema.optional()
 }).strict();
 function loadSandboxBaselinePolicy(options = {}) {
-	const layers = (options.policyPaths ?? []).map(readSandboxPolicyFile);
-	const merged = mergeSandboxPolicyLayers(layers);
-	const resolved = resolveSandboxBaseline(merged);
-	return {
-		...resolved,
-		process: {
-			...resolved.process,
-			timeoutSecondsConfigured: layers.some((policy) => policy.process?.timeoutSeconds !== void 0)
-		},
-		configuredPaths: merged.configuredPaths
-	};
+	return mergeSandboxPolicyLayers((options.policyPaths ?? []).map(readSandboxPolicyFile));
 }
 function readSandboxPolicyFile(policyPath) {
 	try {
@@ -793,7 +710,7 @@ function parseSandboxPolicyLayer(value, sourceLabel) {
 	const readonlyPaths = normalizeConfiguredPaths(filesystem?.additionalReadonlyPaths, sourceLabel, "filesystem.additionalReadonlyPaths");
 	const readwritePaths = normalizeConfiguredPaths(filesystem?.additionalReadwritePaths, sourceLabel, "filesystem.additionalReadwritePaths");
 	return {
-		...parsed.data,
+		process: parsed.data.process,
 		configuredPaths: {
 			readonlyPaths,
 			readwritePaths
@@ -801,7 +718,7 @@ function parseSandboxPolicyLayer(value, sourceLabel) {
 	};
 }
 function mergeSandboxPolicyLayers(layers) {
-	const timeoutCandidates = [DEFAULT_SANDBOX_BASELINE.process.timeoutSeconds];
+	const timeoutCandidates = [300];
 	const configuredPathMaps = {
 		readonlyPaths: /* @__PURE__ */ new Map(),
 		readwritePaths: /* @__PURE__ */ new Map()
@@ -813,11 +730,6 @@ function mergeSandboxPolicyLayers(layers) {
 		if (timeoutSeconds !== void 0) timeoutCandidates.push(timeoutSeconds);
 	}
 	return {
-		filesystem: {
-			restrictToProjectDir: DEFAULT_SANDBOX_BASELINE.filesystem.restrictToProjectDir,
-			additionalReadonlyPaths: [...configuredPathMaps.readonlyPaths.values()].map((entry) => entry.path),
-			additionalReadwritePaths: [...configuredPathMaps.readwritePaths.values()].map((entry) => entry.path)
-		},
 		process: { timeoutSeconds: Math.min(...timeoutCandidates) },
 		configuredPaths: {
 			readonlyPaths: [...configuredPathMaps.readonlyPaths.values()],
@@ -884,7 +796,6 @@ function formatSandboxPolicyIssue(sourceLabel, issue) {
 	const fieldLabel = `${sourceLabel}${formatIssuePath(issue.path)}`;
 	if (issue.code === "unrecognized_keys" && issue.keys.length > 0) return `Sandbox policy field ${fieldLabel}.${issue.keys[0]} is not supported.`;
 	if (issue.code === "invalid_type" && issue.path.length === 1) return `Sandbox policy section ${fieldLabel} must be a JSON object.`;
-	if (issue.code === "invalid_type") return `Sandbox policy field ${fieldLabel} ${issue.message}.`;
 	if (issue.code === "too_small") return `Sandbox policy field ${fieldLabel} must be a positive number.`;
 	return `Sandbox policy field ${fieldLabel} ${issue.message}.`;
 }
@@ -904,31 +815,11 @@ function isNodeError(err) {
 }
 //#endregion
 //#region extensions/mxc/src/mxc-backend.ts
-const CONTAINER_ID_MAX_LEN = 80;
+const CONTAINER_ID_MAX_LEN = 64;
 function uniqueContainerId(runtimeId) {
 	const suffix = randomBytes(4).toString("hex");
 	return `${runtimeId.length + suffix.length + 1 > CONTAINER_ID_MAX_LEN ? runtimeId.slice(0, CONTAINER_ID_MAX_LEN - suffix.length - 1) : runtimeId}-${suffix}`;
 }
-function createLauncherPayloadFile(payloadJson) {
-	const payloadDir = mkdtempSync(path.join(resolvePreferredOpenClawTmpDir(), "openclaw-mxc-payload-"));
-	const payloadFile = path.join(payloadDir, "payload.json");
-	try {
-		writeFileSync(payloadFile, payloadJson, {
-			flag: "wx",
-			mode: 384
-		});
-	} catch (err) {
-		rmSync(payloadDir, {
-			force: true,
-			recursive: true
-		});
-		throw err;
-	}
-	return {
-		payloadDir,
-		payloadFile
-	};
-}
 function cleanupLauncherPayloadFile(token) {
 	if (token && typeof token === "object" && "payloadDir" in token && typeof token.payloadDir === "string") {
 		rmSync(token.payloadDir, {
@@ -969,29 +860,34 @@ function isMissingPathError(err) {
 	const code = extractErrorCode(err);
 	return code === "ENOENT" || code === "ENOTDIR";
 }
-function buildMxcLauncherOptions(config, usePty) {
-	const options = {
-		debug: config.debug ?? false,
-		executablePath: resolveMxcBinaryPath(config.mxcBinaryPath)
-	};
-	if (!usePty) options.usePty = false;
-	return options;
-}
 function createMxcLauncherPayload(config, payload, usePty, sandboxTempDir) {
-	const token = createLauncherPayloadFile(JSON.stringify({
+	const payloadJson = JSON.stringify({
 		config: payload,
-		options: buildMxcLauncherOptions(config, usePty)
-	}));
-	token.sandboxTempDir = sandboxTempDir;
-	return token;
-}
-function buildMxcLauncherArgv(payloadFile) {
-	return [
-		process.execPath,
-		resolveMxcLauncherPath(),
-		"--payload-file",
-		payloadFile
-	];
+		options: {
+			debug: config.debug ?? false,
+			executablePath: resolveMxcBinaryPath(config.mxcBinaryPath),
+			...!usePty ? { usePty: false } : {}
+		}
+	});
+	const payloadDir = mkdtempSync(path.join(resolvePreferredOpenClawTmpDir(), "openclaw-mxc-payload-"));
+	const payloadFile = path.join(payloadDir, "payload.json");
+	try {
+		writeFileSync(payloadFile, payloadJson, {
+			flag: "wx",
+			mode: 384
+		});
+	} catch (err) {
+		rmSync(payloadDir, {
+			force: true,
+			recursive: true
+		});
+		throw err;
+	}
+	return {
+		payloadDir,
+		payloadFile,
+		sandboxTempDir
+	};
 }
 /**
 * Creates a SandboxBackendHandle for a specific session.
@@ -1028,7 +924,6 @@ function createMxcSandboxBackendHandle(params) {
 					config: params.config,
 					baseline,
 					baselineContext,
-					runtimeId: params.runtimeId,
 					containerId: uniqueContainerId(params.runtimeId),
 					command,
 					sandboxTempDir,
@@ -1038,7 +933,12 @@ function createMxcSandboxBackendHandle(params) {
 				});
 				const payloadFile = createMxcLauncherPayload(params.config, payload, usePty, sandboxTempDir);
 				return {
-					argv: buildMxcLauncherArgv(payloadFile.payloadFile),
+					argv: [
+						process.execPath,
+						resolveMxcLauncherPath(),
+						"--payload-file",
+						payloadFile.payloadFile
+					],
 					env: buildLauncherEnv(),
 					stdinMode: usePty ? "pipe-open" : "pipe-closed",
 					finalizeToken: payloadFile
@@ -1078,12 +978,11 @@ function createMxcSandboxBackendHandle(params) {
 					script: cmdParams.script,
 					tempDir: sandboxTempDir
 				});
-				const execInput = cmdParams.stdin === void 0 ? Buffer.alloc(0) : toBuffer(cmdParams.stdin);
+				const execInput = Buffer.isBuffer(cmdParams.stdin) ? cmdParams.stdin : Buffer.from(cmdParams.stdin ?? "", "utf-8");
 				const payloadFile = createMxcLauncherPayload(restrictiveConfig, buildMxcContainerConfig({
 					config: restrictiveConfig,
 					baseline,
 					baselineContext,
-					runtimeId: params.runtimeId,
 					containerId: uniqueContainerId(params.runtimeId),
 					command: commandBridge.command,
 					args: cmdParams.args,
@@ -1092,7 +991,12 @@ function createMxcSandboxBackendHandle(params) {
 					workspace,
 					env: {}
 				}), false, sandboxTempDir);
-				const argv = buildMxcLauncherArgv(payloadFile.payloadFile);
+				const argv = [
+					process.execPath,
+					resolveMxcLauncherPath(),
+					"--payload-file",
+					payloadFile.payloadFile
+				];
 				try {
 					const result = await runCommandBuffered(argv, {
 						baseEnv: buildLauncherEnv(),
@@ -1133,10 +1037,6 @@ function createMxcSandboxBackendHandle(params) {
 		}
 	};
 }
-function toBuffer(value) {
-	if (Buffer.isBuffer(value)) return value;
-	return Buffer.from(value, "utf-8");
-}
 /** Manager for `openclaw sandbox list` and `openclaw sandbox remove`. */
 const mxcSandboxBackendManager = {
 	async describeRuntime() {
@@ -1172,29 +1072,52 @@ function createMxcSandboxBackendFactory(config) {
 }
 //#endregion
 //#region extensions/mxc/src/readiness.ts
-const DEFAULT_DEPS = { execFileSync };
+const MxcProbeOutputSchema = z.object({
+	tier: z.enum([
+		"base-container",
+		"appcontainer-bfs",
+		"appcontainer-dacl"
+	]).optional(),
+	warnings: z.array(z.string()).default([]),
+	error: z.string().optional()
+});
 function resolveWindowsSystemExecutable(name) {
 	const systemRoot = process.env.SystemRoot || process.env.WINDIR;
 	return path.win32.join(systemRoot || "C:\\Windows", "System32", name);
 }
-function assertWindowsIsoEnvBrokerInstalled(deps) {
+function probeMxcIsolationTier(executablePath) {
+	const notReady = (reason, cause) => new Error(`[mxc] MXC Windows ProcessContainer sandbox is not ready: ${reason}. Run "${executablePath}" --probe for host details. The selected executor must be compatible with MXC 0.8.0 and support --probe. If mxcBinaryPath points to an older executor, update it or unset plugins.entries.mxc.config.mxcBinaryPath and restart the Gateway to use the bundled SDK executor.`, cause === void 0 ? void 0 : { cause });
+	let output;
 	try {
-		deps.execFileSync(resolveWindowsSystemExecutable("sc.exe"), ["query", "IsoEnvBroker"], {
+		output = execFileSync(executablePath, ["--probe"], {
 			encoding: "utf-8",
 			stdio: "pipe",
-			timeout: 5e3,
+			timeout: 15e3,
 			windowsHide: true
 		});
 	} catch (error) {
-		const detail = error instanceof Error && error.message ? `: ${error.message.trim()}` : "";
-		throw new Error(`[mxc] MXC Windows ProcessContainer sandbox is not ready: IsoEnvBroker service is not installed${detail}. Install the IsoEnvBroker service before enabling MXC sandbox execution.`, { cause: error });
+		throw notReady(`the MXC host probe failed${error instanceof Error && error.message ? `: ${error.message.trim()}` : ""}`, error);
 	}
+	let probe;
+	try {
+		probe = JSON.parse(output);
+	} catch (error) {
+		throw notReady("the MXC host probe did not return JSON", error);
+	}
+	const parsed = MxcProbeOutputSchema.safeParse(probe);
+	if (!parsed.success) throw notReady("the MXC host probe returned an unexpected result", parsed.error);
+	const { tier, warnings, error } = parsed.data;
+	if (!tier) throw notReady(`MXC cannot select an isolation tier on this host (${error || "the probe reported no isolation tier"})`);
+	return {
+		tier,
+		warnings
+	};
 }
-function isSystemDrivePrepared(deps) {
+function isSystemDrivePrepared() {
 	const systemDrive = process.env.SystemDrive || "C:";
 	let output;
 	try {
-		output = deps.execFileSync(resolveWindowsSystemExecutable("icacls.exe"), [`${systemDrive}\\`], {
+		output = execFileSync(resolveWindowsSystemExecutable("icacls.exe"), [`${systemDrive}\\`], {
 			encoding: "utf-8",
 			stdio: "pipe",
 			timeout: 5e3,
@@ -1212,19 +1135,19 @@ function systemDrivePrepWarning(systemDrive) {
 * Emits an advisory warning when the system drive is not prepared for
 * AppContainer directory access. Non-fatal: the sandbox still activates.
 */
-function warnMxcHostPrepIfNeeded(params = {}) {
-	if ((params.platform ?? process.platform) !== "win32") return;
-	if (!isSystemDrivePrepared({
-		...DEFAULT_DEPS,
-		...params.deps
-	})) (params.warn ?? ((message) => console.warn(message)))(systemDrivePrepWarning(process.env.SystemDrive || "C:"));
-}
-function assertMxcReadiness(params = {}) {
-	if ((params.platform ?? process.platform) !== "win32") return;
-	assertWindowsIsoEnvBrokerInstalled({
-		...DEFAULT_DEPS,
-		...params.deps
-	});
+function warnMxcHostPrepIfNeeded() {
+	if (process.platform !== "win32") return;
+	if (!isSystemDrivePrepared()) console.warn(systemDrivePrepWarning(process.env.SystemDrive || "C:"));
+}
+/**
+* Fails plugin activation unless MXC's host probe selects an isolation tier for
+* `executablePath`. Degradation warnings from the probe are reported but do not
+* block activation.
+*/
+function assertMxcReadiness(params) {
+	if (process.platform !== "win32") return;
+	const probe = probeMxcIsolationTier(params.executablePath);
+	if (probe.warnings.length > 0) console.warn(`[mxc] MXC sandbox is using the ${probe.tier} isolation tier: ${probe.warnings.join("; ")}`);
 }
 //#endregion
 //#region extensions/mxc/src/plugin.ts
@@ -1235,13 +1158,14 @@ function registerMxcPlugin(api) {
 		console.warn(`[mxc] Sandbox backend is Windows-only and not available on ${process.platform}. Plugin will be dormant.`);
 		return;
 	}
+	let mxcBinaryPath;
 	try {
-		resolveMxcBinaryPath(config.mxcBinaryPath);
+		mxcBinaryPath = resolveMxcBinaryPath(config.mxcBinaryPath);
 	} catch (err) {
 		const reason = err instanceof Error ? err.message : String(err);
 		throw new Error(`[mxc] MXC sandbox backend cannot load: ${reason}. Install @microsoft/mxc-sdk or set mxcBinaryPath.`, { cause: err });
 	}
-	assertMxcReadiness();
+	assertMxcReadiness({ executablePath: mxcBinaryPath });
 	warnMxcHostPrepIfNeeded();
 	const unregister = registerSandboxBackend("mxc", {
 		factory: createMxcSandboxBackendFactory(config),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/mxc-sandbox",
-  "version": "2026.9.8",
+  "version": "2026.10.1-beta.2",
   "description": "OpenClaw MXC sandbox execution plugin for MXC-capable hosts",
   "repository": {
     "type": "git",
@@ -22,10 +22,10 @@
       "minHostVersion": ">=2026.6.11"
     },
     "compat": {
-      "pluginApi": ">=2026.9.8"
+      "pluginApi": ">=2026.10.1-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.9.8",
+      "openclawVersion": "2026.10.1-beta.2",
       "bundledDist": false,
       "staticAssets": [
         {
@@ -50,7 +50,7 @@
     "assets/activity.svg"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.9.8"
+    "openclaw": ">=2026.10.1-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {