@questpie/sandbox 3.16.0 → 3.17.0

package/src/sandbox-server.ts

@@ -20,7 +20,8 @@
  *
  *   Per-subprocess flags:
  *     --v8-flags=--max-old-space-size=<memoryMb>   hard memory bound
- *     --allow-net=<hosts>     scoped fetch() allowlist   (INDEPENDENT axis)
+ *     --allow-net=<hosts>     compute-only direct fetch allowlist
+ *     --allow-net=[]          all bindings guests (network stays host-brokered)
  *     --allow-import=<hosts>  scoped module-import allowlist (INDEPENDENT axis)
  *     --no-prompt             never block on a permission prompt
  *     (no --allow-read/write/env/run/ffi/sys → all DENIED by default)
@@ -32,9 +33,10 @@
  *
  * EGRESS / SSRF: net + import hosts are validated against the private-IP policy
  * (`net-validation.ts`) at request time — a host that IS or RESOLVES TO a
- * private/link-local/loopback/metadata IP is rejected before spawn. The BASELINE
- * runtime defense is the brokered `http.fetch` path (guest runs `--allow-net=[]`,
- * so it cannot open sockets at all → no DNS-rebind surface).
+ * private/link-local/loopback/metadata IP is rejected before spawn. Bindings
+ * guests always run with `--allow-net=[]`; their declared `net` capability stays
+ * host-side and only the brokered, resolve/validate/pin `http.fetch` can use it.
+ * Legacy compute-only guests retain direct Deno networking for compatibility.
  *
  * DEFENSE-IN-DEPTH (LINUX cloud workers only): on a capable Linux host the guest
  * subprocess is additionally wrapped in a NETWORK NAMESPACE with an nftables
@@ -61,12 +63,30 @@
 
 // @ts-nocheck — Deno runtime file; not part of the Bun/tsc typecheck graph.
 
+import { spawn } from "node:child_process";
+import { Readable, Writable } from "node:stream";
+
+import {
+	BROKER_FRAME_CAP_BYTES,
+	BROKER_HTTP_BODY_CAP_BYTES,
+	BROKER_TOTAL_OUTPUT_CAP_BYTES,
+	brokerRequestWireCap,
+	brokerResultValueCap,
+	brokerResponseWireCap,
+} from "./broker-wire.ts";
 import {
 	type EgressFirewallPlan,
 	planEgressFirewall,
 	wrapWithNetns,
 } from "./egress-firewall.ts";
-import { resolveAllowedEndpoints, validateEgressHosts } from "./net-validation.ts";
+import {
+	bundleGuestRuntimeSource,
+	guestRuntimeDataUrl,
+} from "./guest-runtime-source.ts";
+import {
+	resolveAllowedEndpoints,
+	validateEgressHosts,
+} from "./net-validation.ts";
 import {
 	RESULT_MARKER,
 	brokerUrlRejection,
@@ -74,14 +94,33 @@ import {
 	extractResult,
 	importFlags,
 	netFlag,
+	normalizeBrokerUrl,
+	parseBrokerResponse,
+	parseSandboxRunResult,
 	type RunOutcome,
 } from "./server-internals.ts";
-import { BINDINGS_TOKEN_HEADER, FRAME_MARKER } from "./types.ts";
+import {
+	BINDINGS_TOKEN_HEADER,
+	FRAME_MARKER,
+	HOST_ADMISSION_HEADER,
+	WORKLOAD_ADMISSION_HEADER,
+} from "./types.ts";
 import type {
 	SandboxCapabilities,
 	SandboxRunRequest,
 	SandboxRunResult,
 } from "./types.ts";
+import {
+	SandboxWorkloadReplayCache,
+	assertSandboxWorkloadAdmissionKey,
+	verifySandboxWorkloadAdmission,
+	type SandboxWorkloadAdmissionClaims,
+	type SandboxWorkloadAdmissionDenialReason,
+} from "./workload-admission.ts";
+import {
+	SANDBOX_WORKLOAD_DENIAL_MESSAGE,
+	parseSandboxRunRequest,
+} from "./workload.ts";
 
 /** Bound on a single binding RPC round-trip to the host broker. */
 const BROKER_FETCH_TIMEOUT_MS = 10_000;
@@ -91,11 +130,27 @@ const MAX_TIMEOUT_MS = 30_000;
 const DEFAULT_MEMORY_MB = 128;
 const MIN_MEMORY_MB = 16;
 const MAX_MEMORY_MB = 1024;
+const MAX_REQUEST_BODY_BYTES = 2 * 1024 * 1024;
+const MAX_CONSUMED_WORKLOAD_ADMISSIONS = 10_000;
+const MAX_STDERR_BYTES = 256 * 1024;
+const MAX_RPC_COUNT = 256;
+const MAX_INFLIGHT_RPCS = 16;
 /** Grace period after wall-timeout before SIGKILL (SIGTERM first). */
 const KILL_GRACE_MS = 250;
 
 const GUEST_ENTRY_URL = new URL("./guest-entry.ts", import.meta.url);
 const GUEST_ENTRY_PATH = GUEST_ENTRY_URL.pathname;
+const GUEST_BINDINGS_PATH = new URL("./guest-bindings.ts", import.meta.url)
+	.pathname;
+const GUEST_ENTRY_SOURCE = await Deno.readTextFile(GUEST_ENTRY_PATH);
+const GUEST_BINDINGS_SOURCE = await Deno.readTextFile(GUEST_BINDINGS_PATH);
+const GUEST_RUNTIME_MODULE = guestRuntimeDataUrl(
+	bundleGuestRuntimeSource(
+		GUEST_ENTRY_SOURCE,
+		GUEST_BINDINGS_SOURCE,
+		BROKER_HTTP_BODY_CAP_BYTES,
+	),
+);
 const DENO_BIN = Deno.env.get("DENO_BIN") ?? Deno.execPath();
 
 /**
@@ -105,9 +160,149 @@ const DENO_BIN = Deno.env.get("DENO_BIN") ?? Deno.execPath();
  * but if a future/spoofed caller hands a stray `bindings.url`, the supervisor
  * must NOT mail the token to it. Set this env to the SAME trusted internal broker
  * URL the app uses; any `bindings.url` that does not match is rejected before any
- * relay. When UNSET, this check is skipped (back-compat) — set it in production.
+ * relay. Bindings fail closed when this canonical URL is missing or malformed.
  */
 const EXPECTED_BROKER_URL = Deno.env.get("SANDBOX_BROKER_URL")?.trim();
+const WORKLOAD_ADMISSION_SECRET = Deno.env
+	.get("SANDBOX_WORKLOAD_ADMISSION_SECRET")
+	?.trim();
+const WORKLOAD_ADMISSION_KEY_ID =
+	Deno.env.get("SANDBOX_WORKLOAD_ADMISSION_KEY_ID")?.trim() ??
+	"sandbox-workload-v1";
+const SANDBOX_INSTANCE_ID = Deno.env.get("SANDBOX_INSTANCE_ID")?.trim() ?? "";
+const HOST_ADMISSION_SECRET = Deno.env
+	.get("SANDBOX_HOST_ADMISSION_SECRET")
+	?.trim();
+if (WORKLOAD_ADMISSION_SECRET) {
+	assertSandboxWorkloadAdmissionKey({
+		keyId: WORKLOAD_ADMISSION_KEY_ID,
+		secret: new TextEncoder().encode(WORKLOAD_ADMISSION_SECRET),
+		instanceId: SANDBOX_INSTANCE_ID,
+	});
+}
+const consumedWorkloadAdmissions = new SandboxWorkloadReplayCache(
+	MAX_CONSUMED_WORKLOAD_ADMISSIONS,
+);
+
+interface SandboxChildProcess {
+	readonly stdin: WritableStream<Uint8Array>;
+	readonly stdout: ReadableStream<Uint8Array>;
+	readonly stderr: ReadableStream<Uint8Array>;
+	readonly exited: Promise<void>;
+	kill(signal: "SIGKILL" | "SIGTERM"): void;
+}
+
+class SandboxOutputLimitError extends Error {}
+
+interface OutputBudget {
+	total: number;
+}
+
+async function readStream(
+	stream: ReadableStream<Uint8Array>,
+	budget: OutputBudget,
+	maximumBytes: number,
+	onLimit: () => void,
+): Promise<Uint8Array> {
+	const reader = stream.getReader();
+	const chunks: Uint8Array[] = [];
+	let streamTotal = 0;
+	while (true) {
+		const { value, done } = await reader.read();
+		if (done) break;
+		streamTotal += value.byteLength;
+		budget.total += value.byteLength;
+		if (
+			streamTotal > maximumBytes ||
+			budget.total > BROKER_TOTAL_OUTPUT_CAP_BYTES
+		) {
+			onLimit();
+			await reader.cancel();
+			throw new SandboxOutputLimitError();
+		}
+		chunks.push(value);
+	}
+	const output = new Uint8Array(streamTotal);
+	let offset = 0;
+	for (const chunk of chunks) {
+		output.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return output;
+}
+
+function spawnSandboxChild(
+	command: string,
+	args: string[],
+	argv0: string,
+): SandboxChildProcess {
+	const child = spawn(command, args, {
+		argv0,
+		cwd: "/",
+		env: {},
+		stdio: ["pipe", "pipe", "pipe"],
+	});
+	const exited = new Promise<void>((resolve, reject) => {
+		child.once("error", reject);
+		child.once("close", () => resolve());
+	});
+	void exited.catch(() => {});
+	return {
+		stdin: Writable.toWeb(child.stdin),
+		stdout: Readable.toWeb(child.stdout),
+		stderr: Readable.toWeb(child.stderr),
+		exited,
+		kill: (signal) => {
+			child.kill(signal);
+		},
+	};
+}
+
+function authenticatesHost(value: string | null): boolean {
+	if (
+		!value ||
+		!HOST_ADMISSION_SECRET ||
+		new TextEncoder().encode(HOST_ADMISSION_SECRET).byteLength < 32
+	) {
+		return false;
+	}
+	const expected = new TextEncoder().encode(HOST_ADMISSION_SECRET);
+	const actual = new TextEncoder().encode(value);
+	if (actual.byteLength !== expected.byteLength) return false;
+	let difference = 0;
+	for (let index = 0; index < expected.byteLength; index += 1) {
+		difference |= expected[index] ^ actual[index];
+	}
+	return difference === 0;
+}
+
+type WorkloadAdmissionReason =
+	| SandboxWorkloadAdmissionDenialReason
+	| "authorized"
+	| "host_unauthorized"
+	| "missing"
+	| "replay"
+	| "unknown_mode";
+
+function auditWorkloadAdmission(
+	decision: "allowed" | "denied",
+	reason: WorkloadAdmissionReason,
+	claims?: SandboxWorkloadAdmissionClaims,
+): void {
+	console.log(
+		JSON.stringify(
+			Object.freeze({
+				event: "questpie.sandbox.workload_admission",
+				boundary: "sandbox.runtime_admission",
+				decision,
+				reason,
+				...(claims
+					? { supervisorInstanceId: claims.supervisorInstanceId }
+					: {}),
+			}),
+		),
+	);
+}
 
 // ──────────────────────────────────────────────────────────────────────────
 // DEFENSE-IN-DEPTH: kernel egress firewall (LINUX-ONLY, cloud workers). S6 of
@@ -125,24 +320,51 @@ const EXPECTED_BROKER_URL = Deno.env.get("SANDBOX_BROKER_URL")?.trim();
 // on a capable Linux host (e.g. when the orchestrator already provides netns).
 // ──────────────────────────────────────────────────────────────────────────
 
-const NETNS_FIREWALL_DISABLED = Deno.env.get("SANDBOX_DISABLE_NETNS_FIREWALL") === "1";
+const NETNS_FIREWALL_DISABLED =
+	Deno.env.get("SANDBOX_DISABLE_NETNS_FIREWALL") === "1";
 
-/** Probe PATH for a tool by exec'ing `<tool> --version` (no shell). Never throws. */
-async function hasTool(tool: string, versionArg = "--version"): Promise<boolean> {
+async function runProbe(
+	command: string,
+	args: string[],
+	signal?: AbortSignal,
+): Promise<boolean> {
+	if (signal?.aborted) return false;
+	let child;
 	try {
-		const out = await new Deno.Command(tool, {
-			args: [versionArg],
+		child = new Deno.Command(command, {
+			args,
 			stdin: "null",
 			stdout: "null",
 			stderr: "null",
-		}).output();
-		// `unshare --version` / `nft --version` / `ip -V` all exit 0 when present.
-		return out.success;
+		}).spawn();
+		const onAbort = () => {
+			try {
+				child.kill("SIGKILL");
+			} catch {
+				/* already exited */
+			}
+		};
+		signal?.addEventListener("abort", onAbort, { once: true });
+		if (signal?.aborted) onAbort();
+		try {
+			return (await child.output()).success && !signal?.aborted;
+		} finally {
+			signal?.removeEventListener("abort", onAbort);
+		}
 	} catch {
-		return false; // ENOENT (not on PATH) or spawn denied
+		return false;
 	}
 }
 
+/** Probe PATH for a tool by exec'ing `<tool> --version` (no shell). Never throws. */
+function hasTool(
+	tool: string,
+	versionArg = "--version",
+	signal?: AbortSignal,
+): Promise<boolean> {
+	return runProbe(tool, [versionArg], signal);
+}
+
 /**
  * Probe whether the supervisor can actually CREATE a filtered netns. We don't
  * parse capability bitmasks — we just attempt the real operation cheaply:
@@ -150,18 +372,13 @@ async function hasTool(tool: string, versionArg = "--version"): Promise<boolean>
  * (unprivileged-userns or root) network namespace; if it EPERMs, we no-op.
  * This is the most honest probe: it tests the exact syscall path we'll use.
  */
-async function canCreateNetns(): Promise<boolean> {
-	try {
-		const out = await new Deno.Command("unshare", {
-			args: ["--net", "--map-root-user", "true"],
-			stdin: "null",
-			stdout: "null",
-			stderr: "null",
-		}).output();
-		return out.success;
-	} catch {
-		return false;
-	}
+function canCreateNetns(signal?: AbortSignal): Promise<boolean> {
+	return runProbe("unshare", ["--net", "--map-root-user", "true"], signal);
+}
+
+/** GNU env can set argv[0] for the Deno process inside the netns wrapper. */
+function supportsVirtualArgv0Env(signal?: AbortSignal): Promise<boolean> {
+	return runProbe("env", ["--argv0=/runtime/deno", "true"], signal);
 }
 
 /**
@@ -173,25 +390,41 @@ async function canCreateNetns(): Promise<boolean> {
 async function buildEgressFirewallPlan(
 	netHosts: string[],
 	importHosts: string[],
+	signal?: AbortSignal,
 ): Promise<EgressFirewallPlan> {
 	if (NETNS_FIREWALL_DISABLED) {
-		return { applied: false, reason: "disabled via SANDBOX_DISABLE_NETNS_FIREWALL=1" };
+		return {
+			applied: false,
+			reason: "disabled via SANDBOX_DISABLE_NETNS_FIREWALL=1",
+		};
 	}
 	const os = Deno.build.os; // "linux" | "darwin" | "windows" — Deno's vocabulary
 	// Cheap OS gate FIRST: skip the (slowish) tool/cap probes entirely off Linux.
 	if (os !== "linux") {
-		return planEgressFirewall({ os, allow: [], tools: { unshare: false, nft: false, ip: false }, hasCaps: false });
+		return planEgressFirewall({
+			os,
+			allow: [],
+			tools: { unshare: false, nft: false, ip: false },
+			hasCaps: false,
+		});
 	}
 	const [unshare, nft, ip] = await Promise.all([
-		hasTool("unshare"),
-		hasTool("nft"),
-		hasTool("ip", "-V"),
+		hasTool("unshare", "--version", signal),
+		hasTool("nft", "--version", signal),
+		hasTool("ip", "-V", signal),
 	]);
-	const hasCaps = unshare ? await canCreateNetns() : false;
+	const hasCaps = unshare ? await canCreateNetns(signal) : false;
 	// Resolve the allowlist to public IPs (best-effort; never throws). For the
 	// brokered path netHosts is [] → pure default-deny netns.
-	const allow = await resolveAllowedEndpoints([...netHosts, ...importHosts]);
-	return planEgressFirewall({ os, allow, tools: { unshare, nft, ip }, hasCaps });
+	const allow = await resolveAllowedEndpoints([...netHosts, ...importHosts], {
+		signal,
+	});
+	return planEgressFirewall({
+		os,
+		allow,
+		tools: { unshare, nft, ip },
+		hasCaps,
+	});
 }
 
 /**
@@ -203,11 +436,28 @@ async function buildEgressFirewallPlan(
 async function applyEgressFirewall(
 	guestArgv: string[],
 	ruleset: string,
-): Promise<{ cmd: string; args: string[]; cleanup: () => Promise<void> } | null> {
+	signal?: AbortSignal,
+): Promise<{
+	cmd: string;
+	args: string[];
+	cleanup: () => Promise<void>;
+} | null> {
 	let rulesetPath: string;
 	try {
-		rulesetPath = await Deno.makeTempFile({ prefix: "qp-sandbox-egress-", suffix: ".nft" });
+		if (signal?.aborted) return null;
+		rulesetPath = await Deno.makeTempFile({
+			prefix: "qp-sandbox-egress-",
+			suffix: ".nft",
+		});
+		if (signal?.aborted) {
+			await Deno.remove(rulesetPath);
+			return null;
+		}
 		await Deno.writeTextFile(rulesetPath, ruleset);
+		if (signal?.aborted) {
+			await Deno.remove(rulesetPath);
+			return null;
+		}
 	} catch (err) {
 		console.warn(
 			`[sandbox] egress firewall: failed to stage ruleset (${err instanceof Error ? err.message : String(err)}); spawning without netns`,
@@ -243,12 +493,21 @@ async function brokerCall(
 	bindings: { url: string; token: string },
 	method: string,
 	args: unknown,
-): Promise<{ ok: boolean; value?: unknown; error?: { code: string; message: string } }> {
+	parentSignal?: AbortSignal,
+): Promise<{
+	ok: boolean;
+	value?: unknown;
+	error?: { code: string; message: string };
+}> {
 	const controller = new AbortController();
+	const onAbort = () => controller.abort();
+	if (parentSignal?.aborted) controller.abort();
+	else parentSignal?.addEventListener("abort", onAbort, { once: true });
 	const t = setTimeout(() => controller.abort(), BROKER_FETCH_TIMEOUT_MS);
 	try {
 		const res = await fetch(bindings.url, {
 			method: "POST",
+			redirect: "error",
 			headers: {
 				"content-type": "application/json",
 				[BINDINGS_TOKEN_HEADER]: bindings.token,
@@ -256,28 +515,79 @@ async function brokerCall(
 			body: JSON.stringify({ method, args }),
 			signal: controller.signal,
 		});
-		const text = await res.text();
+		const reader = res.body?.getReader();
+		const chunks: Uint8Array[] = [];
+		let total = 0;
+		if (reader) {
+			while (true) {
+				const { value, done } = await reader.read();
+				if (done) break;
+				total += value.byteLength;
+				if (total > brokerResponseWireCap(method)) {
+					await reader.cancel();
+					return {
+						ok: false,
+						error: {
+							code: "execution_error",
+							message: "sandbox broker returned an invalid response",
+						},
+					};
+				}
+				chunks.push(value);
+			}
+		}
+		const bytes = new Uint8Array(total);
+		let offset = 0;
+		for (const chunk of chunks) {
+			bytes.set(chunk, offset);
+			offset += chunk.byteLength;
+		}
+		const text = new TextDecoder().decode(bytes);
 		try {
-			return JSON.parse(text);
+			const parsed = parseBrokerResponse(
+				JSON.parse(text),
+				brokerResultValueCap(method),
+			);
+			if (!res.ok) {
+				return parsed && !parsed.ok
+					? parsed
+					: {
+							ok: false,
+							error: {
+								code: "execution_error",
+								message: "sandbox binding operation failed",
+							},
+						};
+			}
+			return (
+				parsed ?? {
+					ok: false,
+					error: {
+						code: "execution_error",
+						message: "sandbox broker returned an invalid response",
+					},
+				}
+			);
 		} catch {
 			return {
 				ok: false,
 				error: {
 					code: "execution_error",
-					message: `broker returned non-JSON (HTTP ${res.status})`,
+					message: "sandbox broker returned an invalid response",
 				},
 			};
 		}
-	} catch (err) {
+	} catch {
 		return {
 			ok: false,
 			error: {
 				code: "execution_error",
-				message: `broker request failed: ${err instanceof Error ? err.message : String(err)}`,
+				message: "sandbox broker request failed",
 			},
 		};
 	} finally {
 		clearTimeout(t);
+		parentSignal?.removeEventListener("abort", onAbort);
 	}
 }
 
@@ -293,11 +603,20 @@ async function brokerCall(
  * Non-framed stdout lines (stray guest prints) are ignored.
  */
 async function relayBindingsRun(
-	child: Deno.ChildProcess,
+	child: SandboxChildProcess,
 	req: SandboxRunRequest,
 	timedOut: () => boolean,
+	stderrPromise: Promise<Uint8Array>,
+	outputBudget: OutputBudget,
+	onLimit: () => void,
+	onTerminal: () => void,
+	signal?: AbortSignal,
 ): Promise<RunOutcome> {
-	const bindings = req.bindings as { url: string; token: string };
+	const requestedBindings = req.bindings as { url: string; token: string };
+	const bindings = {
+		...requestedBindings,
+		url: normalizeBrokerUrl(requestedBindings.url)!,
+	};
 	const encoder = new TextEncoder();
 	const decoder = new TextDecoder();
 	const stdinWriter = child.stdin.getWriter();
@@ -315,7 +634,9 @@ async function relayBindingsRun(
 	const writeLine = async (obj: unknown) => {
 		if (!stdinOpen) return;
 		try {
-			await stdinWriter.write(encoder.encode(FRAME_MARKER + JSON.stringify(obj) + "\n"));
+			await stdinWriter.write(
+				encoder.encode(FRAME_MARKER + JSON.stringify(obj) + "\n"),
+			);
 		} catch {
 			/* guest gone */
 		}
@@ -333,8 +654,22 @@ async function relayBindingsRun(
 	// 2. Stream stdout, demuxing frames. Outstanding RPCs run concurrently so a
 	//    slow broker call doesn't block reading further frames.
 	let outcome: RunOutcome | null = null;
-	let pending = "";
-	const inflight: Array<Promise<void>> = [];
+	let terminalFailure: string | null = null;
+	let pendingChunks: Uint8Array[] = [];
+	let pendingBytes = 0;
+	let rpcCount = 0;
+	const inflight = new Set<Promise<void>>();
+	const takePendingLine = (): string => {
+		const bytes = new Uint8Array(pendingBytes);
+		let offset = 0;
+		for (const chunk of pendingChunks) {
+			bytes.set(chunk, offset);
+			offset += chunk.byteLength;
+		}
+		pendingChunks = [];
+		pendingBytes = 0;
+		return decoder.decode(bytes);
+	};
 
 	const handleLine = async (line: string) => {
 		if (!line.startsWith(FRAME_MARKER)) return; // stray output → ignore
@@ -353,10 +688,42 @@ async function relayBindingsRun(
 		} catch {
 			return;
 		}
-		if (msg.type === "rpc" && typeof msg.id === "number" && typeof msg.method === "string") {
+		if (
+			msg.type === "rpc" &&
+			typeof msg.id === "number" &&
+			typeof msg.method === "string"
+		) {
+			if (
+				encoder.encode(line).byteLength >
+				brokerRequestWireCap(msg.method) + FRAME_MARKER.length
+			) {
+				onLimit();
+				throw new SandboxOutputLimitError();
+			}
+			rpcCount += 1;
+			if (rpcCount > MAX_RPC_COUNT) {
+				onLimit();
+				throw new SandboxOutputLimitError();
+			}
+			while (inflight.size >= MAX_INFLIGHT_RPCS) {
+				await Promise.race(inflight);
+			}
 			const id = msg.id;
 			const p = (async () => {
-				const r = await brokerCall(bindings, msg.method as string, msg.args);
+				const r = await brokerCall(
+					bindings,
+					msg.method as string,
+					msg.args,
+					signal,
+				);
+				if (!r.ok) {
+					if (!terminalFailure && !outcome) {
+						terminalFailure = r.error.message;
+						onTerminal();
+					}
+					return;
+				}
+				if (signal?.aborted || terminalFailure || outcome) return;
 				await writeLine({
 					type: "rpc-result",
 					id,
@@ -365,14 +732,35 @@ async function relayBindingsRun(
 					error: r.error,
 				});
 			})();
-			inflight.push(p);
+			inflight.add(p);
+			void p.finally(() => inflight.delete(p));
 		} else if (msg.type === "result") {
-			outcome = {
-				ok: !!msg.ok,
-				output: msg.output,
-				error: msg.error,
-				logs: Array.isArray(msg.logs) ? msg.logs : [],
-			};
+			const keys = Object.keys(msg);
+			if (
+				keys.every((key) =>
+					["type", "ok", "output", "error", "logs"].includes(key),
+				)
+			) {
+				const parsed = parseSandboxRunResult({
+					ok: msg.ok,
+					...(Object.hasOwn(msg, "output") ? { output: msg.output } : {}),
+					...(Object.hasOwn(msg, "error") ? { error: msg.error } : {}),
+					logs: msg.logs,
+				});
+				if (!parsed) {
+					terminalFailure = "sandbox guest returned an invalid result";
+					onTerminal();
+				} else if (inflight.size > 0) {
+					terminalFailure = "sandbox result raced binding calls";
+					onTerminal();
+				} else {
+					outcome = parsed;
+					onTerminal();
+				}
+			} else {
+				terminalFailure = "sandbox guest returned an invalid result";
+				onTerminal();
+			}
 		}
 	};
 
@@ -381,22 +769,39 @@ async function relayBindingsRun(
 		while (true) {
 			const { value, done } = await reader.read();
 			if (done) break;
-			pending += decoder.decode(value, { stream: true });
-			let idx: number;
-			while ((idx = pending.indexOf("\n")) !== -1) {
-				const line = pending.slice(0, idx);
-				pending = pending.slice(idx + 1);
-				await handleLine(line);
+			outputBudget.total += value.byteLength;
+			if (outputBudget.total > BROKER_TOTAL_OUTPUT_CAP_BYTES) {
+				onLimit();
+				throw new SandboxOutputLimitError();
+			}
+			let start = 0;
+			while (start < value.byteLength) {
+				const newline = value.indexOf(0x0a, start);
+				const end = newline === -1 ? value.byteLength : newline;
+				const segment = value.subarray(start, end);
+				if (segment.byteLength > 0) {
+					pendingChunks.push(segment);
+					pendingBytes += segment.byteLength;
+				}
+				if (pendingBytes > BROKER_FRAME_CAP_BYTES) {
+					onLimit();
+					throw new SandboxOutputLimitError();
+				}
+				if (newline === -1) break;
+				await handleLine(takePendingLine());
+				if (outcome || terminalFailure) break;
+				start = newline + 1;
 			}
-			if (outcome) break; // final result seen
+			if (outcome || terminalFailure) break;
 			if (timedOut()) break;
 		}
 		// Flush a trailing line without newline (the final result frame may not
 		// be newline-terminated before exit).
-		if (!outcome && pending.length > 0) {
-			await handleLine(pending.trim());
+		if (!outcome && !terminalFailure && pendingBytes > 0) {
+			await handleLine(takePendingLine().trim());
 		}
-	} catch {
+	} catch (error) {
+		if (error instanceof SandboxOutputLimitError) throw error;
 		/* stdout closed abruptly — fall through to the no-result handling */
 	}
 
@@ -408,12 +813,16 @@ async function relayBindingsRun(
 	// Drain remaining stdout + collect stderr for diagnostics, then reap.
 	let stderrText = "";
 	try {
-		const { stderr } = await child.output();
+		const stderr = await stderrPromise;
+		await child.exited;
 		stderrText = decoder.decode(stderr).trim();
 	} catch {
 		/* already consumed/killed */
 	}
 
+	if (terminalFailure) {
+		return { ok: false, error: terminalFailure, logs: [] };
+	}
 	if (outcome) return outcome;
 	return {
 		ok: false,
@@ -429,38 +838,95 @@ async function relayBindingsRun(
  * Execute one untrusted request in a fresh, hardened Deno subprocess.
  * Never throws — spawn/IO failures are caught and returned as structured errors.
  */
-async function runInSubprocess(req: SandboxRunRequest): Promise<SandboxRunResult> {
+async function runInSubprocess(
+	req: SandboxRunRequest,
+	signal?: AbortSignal,
+): Promise<SandboxRunResult> {
 	const started = performance.now();
-	// Best-effort teardown for any per-run resource (e.g. the egress-firewall
-	// ruleset temp file). Set when the firewall is applied; fired on every return.
-	let onFinish: (() => void) | undefined;
+	const caps: SandboxCapabilities = req.capabilities ?? {
+		net: [],
+		import: [],
+		timeoutMs: DEFAULT_TIMEOUT_MS,
+		memoryMb: DEFAULT_MEMORY_MB,
+	};
+	const timeoutMs = clampInt(
+		caps.timeoutMs,
+		DEFAULT_TIMEOUT_MS,
+		1,
+		MAX_TIMEOUT_MS,
+	);
+	let deadlineTimedOut = false;
+	let parentCancelled = signal?.aborted ?? false;
+	const executionController = new AbortController();
+	const onParentAbort = () => {
+		parentCancelled = true;
+		executionController.abort();
+	};
+	if (signal?.aborted) executionController.abort();
+	else signal?.addEventListener("abort", onParentAbort, { once: true });
+	const absoluteTimer = setTimeout(() => {
+		deadlineTimedOut = true;
+		executionController.abort();
+	}, timeoutMs);
+	const executionSignal = executionController.signal;
+	// Best-effort teardown for per-run resources (work root, firewall ruleset).
+	const cleanup: Array<() => void> = [
+		() => clearTimeout(absoluteTimer),
+		() => signal?.removeEventListener("abort", onParentAbort),
+	];
 	const finish = (r: RunOutcome): SandboxRunResult => {
-		if (onFinish) {
+		for (const dispose of cleanup.splice(0)) {
 			try {
-				onFinish();
+				dispose();
 			} catch {
 				/* best-effort cleanup */
 			}
-			onFinish = undefined;
 		}
 		return { ...r, ms: Math.round(performance.now() - started) };
 	};
+	const interrupted = (): SandboxRunResult =>
+		finish(
+			deadlineTimedOut
+				? {
+						ok: false,
+						timedOut: true,
+						error: `wall-time exceeded (${timeoutMs}ms)`,
+						logs: [],
+					}
+				: {
+						ok: false,
+						error: "sandbox request cancelled",
+						logs: [],
+					},
+		);
+	if (executionSignal.aborted) {
+		return interrupted();
+	}
 
-	const caps: SandboxCapabilities = req.capabilities ?? {
-		net: [],
-		import: [],
-		timeoutMs: DEFAULT_TIMEOUT_MS,
-		memoryMb: DEFAULT_MEMORY_MB,
-	};
-	const timeoutMs = clampInt(caps.timeoutMs, DEFAULT_TIMEOUT_MS, 1, MAX_TIMEOUT_MS);
-	const memoryMb = clampInt(caps.memoryMb, DEFAULT_MEMORY_MB, MIN_MEMORY_MB, MAX_MEMORY_MB);
+	const memoryMb = clampInt(
+		caps.memoryMb,
+		DEFAULT_MEMORY_MB,
+		MIN_MEMORY_MB,
+		MAX_MEMORY_MB,
+	);
 	const netHosts = Array.isArray(caps.net) ? caps.net : [];
 	const importHosts = Array.isArray(caps.import) ? caps.import : [];
 
 	// ── EGRESS VALIDATION (SSRF / private-IP rejection) — before spawn. ──
-	const egress = await validateEgressHosts([...netHosts, ...importHosts]);
+	const egress = await validateEgressHosts([...netHosts, ...importHosts], {
+		signal: executionSignal,
+		timeoutMs,
+		concurrency: 4,
+	});
+	if (executionSignal.aborted) {
+		return interrupted();
+	}
 	if (!egress.ok) {
-		return finish({ ok: false, error: `egress blocked: ${egress.reason}`, logs: [] });
+		return finish({
+			ok: false,
+			error: `egress blocked: ${egress.reason}`,
+			logs: [],
+		});
 	}
 
 	// BINDINGS URL VALIDATION (token-exfiltration defense) — before spawn.
@@ -480,19 +946,36 @@ async function runInSubprocess(req: SandboxRunRequest): Promise<SandboxRunResult
 		}
 	}
 
+	// Every subprocess receives a fresh host-private cwd. The guest has no file
+	// permissions for it and guest-entry exposes only the virtual `/work` name.
+	let guestWorkRoot: string;
+	try {
+		if (executionSignal.aborted) return interrupted();
+		guestWorkRoot = await Deno.makeTempDir({ prefix: "qp-sandbox-work-" });
+		cleanup.push(() => Deno.removeSync(guestWorkRoot, { recursive: true }));
+		if (executionSignal.aborted) return interrupted();
+	} catch {
+		return finish({
+			ok: false,
+			error: "failed to create sandbox work root",
+			logs: [],
+		});
+	}
 	// ── BUILD THE HARDENED SUBPROCESS COMMAND. ──
+	// Bindings guests keep their declared `net` allowlist on the trusted broker.
+	// Giving the subprocess the same `--allow-net` grant would let raw sockets
+	// bypass the resolve/validate/pin/redirect checks enforced by `http.fetch`.
+	const directNetHosts = req.bindings ? [] : netHosts;
 	const args = [
 		"run",
 		"--no-prompt",
 		`--v8-flags=--max-old-space-size=${memoryMb}`,
 		// net + import are INDEPENDENT axes from the manifest (do NOT alias import=net).
-		...netFlag(netHosts),
+		...netFlag(directNetHosts),
 		...importFlags(importHosts),
-		// Guest-entry needs to read ITS OWN file. We grant read scoped to that one
-		// path; the guest source runs as a blob module (no fs), and fs ops inside the
-		// guest still fail because the guest cannot widen this scope.
-		`--allow-read=${GUEST_ENTRY_PATH}`,
-		GUEST_ENTRY_PATH,
+		// A self-contained data module needs neither a host path nor a socket, so it
+		// remains loadable after the Linux network namespace is created.
+		GUEST_RUNTIME_MODULE,
 	];
 
 	// ── DEFENSE-IN-DEPTH: wrap the spawn in a filtered netns on capable Linux. ──
@@ -503,16 +986,31 @@ async function runInSubprocess(req: SandboxRunRequest): Promise<SandboxRunResult
 	let spawnCmd = DENO_BIN;
 	let spawnArgs = args;
 	try {
-		const plan = await buildEgressFirewallPlan(netHosts, importHosts);
+		const plan = await buildEgressFirewallPlan(
+			directNetHosts,
+			importHosts,
+			executionSignal,
+		);
 		if (plan.applied) {
-			const wrapped = await applyEgressFirewall([DENO_BIN, ...args], plan.nftRuleset);
+			const canVirtualizeArgv0 = await supportsVirtualArgv0Env(executionSignal);
+			const wrapped = canVirtualizeArgv0
+				? await applyEgressFirewall(
+						["env", "--argv0=/runtime/deno", DENO_BIN, ...args],
+						plan.nftRuleset,
+						executionSignal,
+					)
+				: null;
 			if (wrapped) {
 				spawnCmd = wrapped.cmd;
 				spawnArgs = wrapped.args;
-				onFinish = () => void wrapped.cleanup();
+				cleanup.push(() => void wrapped.cleanup());
 				console.log(
 					`[sandbox] egress firewall: ACTIVE (netns + nftables, ${plan.allowCount} allow rule(s))`,
 				);
+			} else if (!canVirtualizeArgv0) {
+				console.log(
+					"[sandbox] egress firewall: skipped — env lacks argv0 virtualization; baseline isolation remains active",
+				);
 			}
 			// wrapped === null → staging failed; fall through to the un-wrapped spawn.
 		} else {
@@ -526,19 +1024,13 @@ async function runInSubprocess(req: SandboxRunRequest): Promise<SandboxRunResult
 			`[sandbox] egress firewall: probe failed (${err instanceof Error ? err.message : String(err)}); spawning without netns`,
 		);
 	}
+	if (executionSignal.aborted) {
+		return interrupted();
+	}
 
-	let child: Deno.ChildProcess;
+	let child: SandboxChildProcess;
 	try {
-		const command = new Deno.Command(spawnCmd, {
-			args: spawnArgs,
-			stdin: "piped",
-			stdout: "piped",
-			stderr: "piped",
-			// Do NOT leak the supervisor's env into the guest process.
-			clearEnv: true,
-			env: {},
-		});
-		child = command.spawn();
+		child = spawnSandboxChild(spawnCmd, spawnArgs, "/runtime/deno");
 	} catch (err) {
 		// Spawn-throw → structured error, never a bare 500.
 		return finish({
@@ -548,35 +1040,81 @@ async function runInSubprocess(req: SandboxRunRequest): Promise<SandboxRunResult
 		});
 	}
 
-	let timedOut = false;
-	let killTimer: number | undefined;
-	let graceTimer: number | undefined;
-
-	try {
-		// HARD wall-time: SIGTERM, then SIGKILL after a grace period. Shared by
-		// both the legacy and the bindings I/O paths.
-		killTimer = setTimeout(() => {
-			timedOut = true;
+	let outputLimitExceeded = false;
+	let cancelGraceTimer: number | undefined;
+	const relayController = new AbortController();
+	let terminationStarted = false;
+	const terminateChild = () => {
+		if (terminationStarted) return;
+		terminationStarted = true;
+		try {
+			child.kill("SIGTERM");
+		} catch {
+			/* already gone */
+		}
+		cancelGraceTimer = setTimeout(() => {
 			try {
-				child.kill("SIGTERM");
+				child.kill("SIGKILL");
 			} catch {
 				/* already gone */
 			}
-			graceTimer = setTimeout(() => {
-				try {
-					child.kill("SIGKILL");
-				} catch {
-					/* already gone */
-				}
-			}, KILL_GRACE_MS);
-		}, timeoutMs);
+		}, KILL_GRACE_MS);
+	};
+	const onExecutionAbort = () => {
+		relayController.abort();
+		terminateChild();
+	};
+	const onOutputLimit = () => {
+		if (outputLimitExceeded) return;
+		outputLimitExceeded = true;
+		relayController.abort();
+		terminateChild();
+	};
+	if (executionSignal.aborted) onExecutionAbort();
+	else
+		executionSignal.addEventListener("abort", onExecutionAbort, { once: true });
+	const outputBudget: OutputBudget = { total: 0 };
+	const stderrPromise = readStream(
+		child.stderr,
+		outputBudget,
+		MAX_STDERR_BYTES,
+		onOutputLimit,
+	);
+	void stderrPromise.catch(() => {});
 
+	try {
 		// ── BINDINGS PATH: framed stdio relay to the host broker. ──
 		if (req.bindings) {
-			const outcome = await relayBindingsRun(child, req, () => timedOut);
-			clearTimeout(killTimer);
-			if (graceTimer !== undefined) clearTimeout(graceTimer);
-			if (timedOut) {
+			const outcome = await relayBindingsRun(
+				child,
+				req,
+				() => deadlineTimedOut,
+				stderrPromise,
+				outputBudget,
+				onOutputLimit,
+				() => {
+					relayController.abort();
+					terminateChild();
+				},
+				relayController.signal,
+			);
+			if (cancelGraceTimer !== undefined) clearTimeout(cancelGraceTimer);
+			executionSignal.removeEventListener("abort", onExecutionAbort);
+			if (parentCancelled) {
+				return finish({
+					ok: false,
+					error: "sandbox request cancelled",
+					logs: outcome?.logs ?? [],
+				});
+			}
+			if (outputLimitExceeded) {
+				return finish({
+					ok: false,
+					error: "sandbox output limit exceeded",
+					logs: [],
+				});
+			}
+			if (deadlineTimedOut) {
 				return finish({
 					ok: false,
 					timedOut: true,
@@ -597,11 +1135,34 @@ async function runInSubprocess(req: SandboxRunRequest): Promise<SandboxRunResult
 		await writer.write(new TextEncoder().encode(envelope));
 		await writer.close();
 
-		const { stdout, stderr } = await child.output();
-		clearTimeout(killTimer);
-		if (graceTimer !== undefined) clearTimeout(graceTimer);
+		const [stdout, stderr] = await Promise.all([
+			readStream(
+				child.stdout,
+				outputBudget,
+				BROKER_TOTAL_OUTPUT_CAP_BYTES,
+				onOutputLimit,
+			),
+			stderrPromise,
+			child.exited,
+		]);
+		if (cancelGraceTimer !== undefined) clearTimeout(cancelGraceTimer);
+		executionSignal.removeEventListener("abort", onExecutionAbort);
 
-		if (timedOut) {
+		if (parentCancelled) {
+			return finish({
+				ok: false,
+				error: "sandbox request cancelled",
+				logs: [],
+			});
+		}
+		if (outputLimitExceeded) {
+			return finish({
+				ok: false,
+				error: "sandbox output limit exceeded",
+				logs: [],
+			});
+		}
+		if (deadlineTimedOut) {
 			return finish({
 				ok: false,
 				timedOut: true,
@@ -626,16 +1187,20 @@ async function runInSubprocess(req: SandboxRunRequest): Promise<SandboxRunResult
 			logs: [],
 		});
 	} catch (err) {
-		if (killTimer !== undefined) clearTimeout(killTimer);
-		if (graceTimer !== undefined) clearTimeout(graceTimer);
+		if (cancelGraceTimer !== undefined) clearTimeout(cancelGraceTimer);
+		executionSignal.removeEventListener("abort", onExecutionAbort);
 		try {
 			child.kill("SIGKILL");
 		} catch {
 			/* noop */
 		}
+		if (parentCancelled || deadlineTimedOut) return interrupted();
 		return finish({
 			ok: false,
-			error: `sandbox IO error: ${err instanceof Error ? err.message : String(err)}`,
+			error:
+				outputLimitExceeded || err instanceof SandboxOutputLimitError
+					? "sandbox output limit exceeded"
+					: `sandbox IO error: ${err instanceof Error ? err.message : String(err)}`,
 			logs: [],
 		});
 	}
@@ -648,32 +1213,183 @@ function jsonResponse(body: unknown, status = 200): Response {
 	});
 }
 
+class RequestBodyTooLargeError extends Error {}
+
+async function readBoundedRequestBody(request: Request): Promise<string> {
+	const declared = request.headers.get("content-length");
+	if (
+		declared !== null &&
+		Number.isFinite(Number(declared)) &&
+		Number(declared) > MAX_REQUEST_BODY_BYTES
+	) {
+		throw new RequestBodyTooLargeError();
+	}
+	if (!request.body) return "";
+	const reader = request.body.getReader();
+	const chunks: Uint8Array[] = [];
+	let total = 0;
+	while (true) {
+		const { value, done } = await reader.read();
+		if (done) break;
+		total += value.byteLength;
+		if (total > MAX_REQUEST_BODY_BYTES) {
+			await reader.cancel();
+			throw new RequestBodyTooLargeError();
+		}
+		chunks.push(value);
+	}
+	const body = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		body.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return new TextDecoder().decode(body);
+}
+
 const port = Number(Deno.env.get("PORT") ?? 8787);
 
 Deno.serve(
-	{ port, onListen: ({ port }) => console.log(`sandbox-server listening on :${port}`) },
+	{
+		port,
+		onListen: ({ port }) => {
+			console.log(`sandbox-server listening on :${port}`);
+		},
+	},
 	async (request) => {
 		const url = new URL(request.url);
-
 		if (request.method === "GET" && url.pathname === "/health") {
-			return jsonResponse({ ok: true, runtime: "deno", version: Deno.version.deno });
+			return jsonResponse({
+				ok: true,
+				runtime: "deno",
+				version: Deno.version.deno,
+			});
 		}
 
 		if (request.method === "POST" && url.pathname === "/run") {
 			let req: SandboxRunRequest;
+			let requestBody: string;
 			try {
-				req = (await request.json()) as SandboxRunRequest;
-			} catch {
-				return jsonResponse({ ok: false, error: "invalid JSON body", logs: [] }, 400);
+				requestBody = await readBoundedRequestBody(request);
+				req = JSON.parse(requestBody) as SandboxRunRequest;
+			} catch (error) {
+				if (error instanceof RequestBodyTooLargeError) {
+					return jsonResponse(
+						{ ok: false, error: "request body too large", logs: [] },
+						413,
+					);
+				}
+				return jsonResponse(
+					{ ok: false, error: "invalid JSON body", logs: [] },
+					400,
+				);
+			}
+			let workloadAdmission: SandboxWorkloadAdmissionClaims | null = null;
+			let workloadDenialReason: WorkloadAdmissionReason = "missing";
+			let workloadDenialClaims: SandboxWorkloadAdmissionClaims | undefined;
+			if (
+				req?.mode === "host" &&
+				!authenticatesHost(request.headers.get(HOST_ADMISSION_HEADER))
+			) {
+				auditWorkloadAdmission("denied", "host_unauthorized");
+				return jsonResponse(
+					{
+						ok: false,
+						error: SANDBOX_WORKLOAD_DENIAL_MESSAGE,
+						logs: [],
+					},
+					403,
+				);
+			}
+			if (req?.mode === "workload") {
+				const envelope = request.headers.get(WORKLOAD_ADMISSION_HEADER);
+				if (envelope && WORKLOAD_ADMISSION_SECRET) {
+					try {
+						const verification = await verifySandboxWorkloadAdmission(
+							{
+								keyId: WORKLOAD_ADMISSION_KEY_ID,
+								secret: new TextEncoder().encode(WORKLOAD_ADMISSION_SECRET),
+								instanceId: SANDBOX_INSTANCE_ID,
+							},
+							envelope,
+							requestBody,
+						);
+						if (verification.ok) {
+							workloadAdmission = verification.claims;
+						} else {
+							workloadDenialReason = verification.reason;
+							workloadDenialClaims = verification.claims;
+						}
+					} catch {
+						workloadAdmission = null;
+						workloadDenialReason = "invalid";
+					}
+				}
 			}
-			if (typeof req?.source !== "string" || !req?.capabilities) {
+			if (req?.mode === "workload" && !workloadAdmission) {
+				auditWorkloadAdmission(
+					"denied",
+					workloadDenialReason,
+					workloadDenialClaims,
+				);
 				return jsonResponse(
-					{ ok: false, error: "missing 'source' or 'capabilities'", logs: [] },
+					{
+						ok: false,
+						error: SANDBOX_WORKLOAD_DENIAL_MESSAGE,
+						logs: [],
+					},
+					403,
+				);
+			}
+			if (req?.mode !== "workload" && req?.mode !== "host") {
+				auditWorkloadAdmission("denied", "unknown_mode");
+				return jsonResponse(
+					{
+						ok: false,
+						error: SANDBOX_WORKLOAD_DENIAL_MESSAGE,
+						logs: [],
+					},
+					403,
+				);
+			}
+			const validatedRequest = parseSandboxRunRequest(req);
+			if (!validatedRequest) {
+				return jsonResponse(
+					{ ok: false, error: "invalid sandbox request", logs: [] },
 					400,
 				);
 			}
+			req = validatedRequest;
+			if (
+				workloadAdmission &&
+				!consumedWorkloadAdmissions.consume(workloadAdmission)
+			) {
+				auditWorkloadAdmission("denied", "replay", workloadAdmission);
+				return jsonResponse(
+					{
+						ok: false,
+						error: SANDBOX_WORKLOAD_DENIAL_MESSAGE,
+						logs: [],
+					},
+					403,
+				);
+			}
+			if (workloadAdmission) {
+				auditWorkloadAdmission("allowed", "authorized", workloadAdmission);
+			}
 			// runInSubprocess never throws — always a structured result.
-			const result = await runInSubprocess(req);
+			const result = await runInSubprocess(req, request.signal);
+			if (
+				req.mode === "workload" &&
+				!result.ok &&
+				!result.timedOut &&
+				result.error !== "sandbox request cancelled"
+			) {
+				return jsonResponse({
+					...result,
+					error: "sandbox execution failed",
+				});
+			}
 			return jsonResponse(result);
 		}