chainlesschain 0.162.179 → 0.162.181

package/src/lib/process-execution-broker/platform-sandbox.js

@@ -3,9 +3,9 @@
  *
  * Platform enforcement currently available:
  * - macOS: Seatbelt sandbox-exec profiles
- * - Linux: prlimit resource-limit wrapper
- * - Windows: explicitly unavailable until a native Job Object + restricted
- *   token adapter is installed
+ * - Linux: prlimit resource-limit wrapper, plus a non-promoting bubblewrap
+ *   runtime probe for explicitly requested filesystem/network boundaries
+ * - Windows: Win32 Job Object + restricted-token wrapper
  *
  * Security model:
  * Adapters return a truthful spawn plan. An unavailable primitive is never
@@ -19,6 +19,60 @@ import os from "node:os";
 import path from "node:path";
 import * as fs from "node:fs";
 import crypto from "node:crypto";
+import { spawnSync as nativeSpawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+/**
+ * Stable boundary identifiers shared by broker policies, platform plans, and
+ * audit records. A guarantee means that the named restriction is enforced by
+ * the selected backend; it does not merely describe a configured intent.
+ */
+export const SANDBOX_BOUNDARIES = Object.freeze({
+  FILESYSTEM: "filesystem",
+  NETWORK: "network",
+  PROCESS_EXEC: "process-exec",
+  PROCESS_TREE: "process-tree",
+  RESOURCE_LIMITS: "resource-limits",
+  PRIVILEGE_REDUCTION: "privilege-reduction",
+});
+
+/**
+ * @typedef {typeof SANDBOX_BOUNDARIES[keyof typeof SANDBOX_BOUNDARIES]} SandboxBoundary
+ *
+ * @typedef {Object} SandboxGuaranteePlan
+ * @property {1} contractVersion
+ * @property {boolean} applied
+ * @property {string} platform
+ * @property {string} profile
+ * @property {string} command
+ * @property {readonly string[]} args
+ * @property {Readonly<Object>} options
+ * @property {string|null} enforcement
+ * @property {string|null} backend
+ * @property {readonly SandboxBoundary[]} guarantees
+ * @property {string|null} reason
+ * @property {{required: boolean, mode: "none"|"sync"|"async"}} postSpawn
+ */
+
+const MODULE_DIR = path.dirname(fileURLToPath(import.meta.url));
+const WINDOWS_IDENTITY_WAIT = new Int32Array(new SharedArrayBuffer(4));
+const LINUX_BWRAP_PATH = "/usr/bin/bwrap";
+const LINUX_BWRAP_RUNTIME_PROBE_ARGS = Object.freeze([
+  "--die-with-parent",
+  "--new-session",
+  "--unshare-all",
+  "--ro-bind",
+  "/",
+  "/",
+  "--proc",
+  "/proc",
+  "--dev",
+  "/dev",
+  "--tmpfs",
+  "/tmp",
+  "--",
+  "/bin/true",
+]);
 const DEFAULT_RUNTIME = Object.freeze({
   platform: os.platform(),
   fs,
@@ -27,12 +81,49 @@ const DEFAULT_RUNTIME = Object.freeze({
   randomBytes: (size) => crypto.randomBytes(size),
   resolvePath: (value) => path.resolve(value),
   joinPath: (...parts) => path.join(...parts),
+  windowsDir: () => process.env.WINDIR || "C:\\Windows",
+  moduleDir: MODULE_DIR,
+  now: () => Date.now(),
+  sleepSync: (milliseconds) =>
+    Atomics.wait(WINDOWS_IDENTITY_WAIT, 0, 0, milliseconds),
+  spawnSync: nativeSpawnSync,
 });
 
 function resolveRuntime(overrides = {}) {
   return { ...DEFAULT_RUNTIME, ...overrides };
 }
 
+function normalizeSandboxRequest(profileOrRequest, explicitRequest) {
+  const legacyRequest =
+    profileOrRequest &&
+    typeof profileOrRequest === "object" &&
+    !Array.isArray(profileOrRequest)
+      ? profileOrRequest
+      : { profile: profileOrRequest };
+  const request =
+    explicitRequest &&
+    typeof explicitRequest === "object" &&
+    !Array.isArray(explicitRequest)
+      ? explicitRequest
+      : legacyRequest;
+  const profile =
+    typeof request.profile === "string"
+      ? request.profile
+      : typeof legacyRequest.profile === "string"
+        ? legacyRequest.profile
+        : "default";
+  const requiredBoundaries = Array.isArray(request.requiredBoundaries)
+    ? [
+        ...new Set(
+          request.requiredBoundaries.filter(
+            (boundary) => typeof boundary === "string",
+          ),
+        ),
+      ]
+    : [];
+  return { profile, requiredBoundaries };
+}
+
 /**
  * A native `spawn(..., { shell: true })` asks Node to execute one command
  * string through the platform shell. Once a sandbox wrapper becomes the
@@ -45,7 +136,7 @@ function resolveRuntime(overrides = {}) {
  * sandbox executable itself is always spawned directly.
  */
 function normalizeWrappedInvocation(command, args, spawnOpts, platform) {
-  if (!spawnOpts?.shell || platform === "win32") {
+  if (!spawnOpts?.shell) {
     return {
       command,
       args: [...(args || [])],
@@ -53,6 +144,19 @@ function normalizeWrappedInvocation(command, args, spawnOpts, platform) {
     };
   }
 
+  if (platform === "win32") {
+    const shell =
+      typeof spawnOpts.shell === "string"
+        ? spawnOpts.shell
+        : process.env.ComSpec || "C:\\Windows\\System32\\cmd.exe";
+    const shellCommand = [command, ...(args || [])].map(String).join(" ");
+    return {
+      command: shell,
+      args: ["/d", "/s", "/c", shellCommand],
+      options: { ...spawnOpts, shell: false },
+    };
+  }
+
   const shell =
     typeof spawnOpts.shell === "string" ? spawnOpts.shell : "/bin/sh";
   const shellCommand = [command, ...(args || [])].map(String).join(" ");
@@ -82,6 +186,8 @@ function normalizeWrappedInvocation(command, args, spawnOpts, platform) {
  *   args: string[],
  *   options: Object,
  *   enforcement: string|null,
+ *   backend: string|null,
+ *   guarantees: readonly SandboxBoundary[],
  *   reason: string|null,
  *   cleanup?: Function,
  *   postSpawn: {required: boolean, mode: "none"|"sync"|"async"}
@@ -97,10 +203,16 @@ function createSandboxPlan(input) {
     contractVersion: 1,
     applied: false,
     enforcement: null,
+    backend: null,
+    guarantees: Object.freeze([]),
     reason: null,
     ...input,
     args: Object.freeze([...(input.args || [])]),
     options: Object.freeze({ ...(input.options || {}) }),
+    guarantees: Object.freeze([...(input.guarantees || [])]),
+    runtimeProbe: input.runtimeProbe
+      ? Object.freeze({ ...input.runtimeProbe })
+      : null,
     postSpawn,
   });
 }
@@ -132,6 +244,10 @@ export function generateMacSeatbeltProfile(opts = {}, runtimeOverrides = {}) {
   const lines = [
     "(version 1)",
     "(deny default)",
+    // Apple's system baseline supplies the loader/device primitives required
+    // for ordinary command startup. Our explicit rules below still own
+    // process, filesystem write, and network policy.
+    '(import "system.sb")',
     // Basic system operations always allowed
     "(allow signal (target self))",
     '(allow process-exec (literal "/usr/bin/env"))',
@@ -148,6 +264,10 @@ export function generateMacSeatbeltProfile(opts = {}, runtimeOverrides = {}) {
 
   if (allowNetwork) {
     lines.push("(allow network*)");
+  } else {
+    // Keep the imported system baseline from widening the caller's explicit
+    // no-network policy.
+    lines.push("(deny network*)");
   }
 
   // Allow read/write to specific paths
@@ -162,9 +282,17 @@ export function generateMacSeatbeltProfile(opts = {}, runtimeOverrides = {}) {
   }
 
   // Always allow read access to system paths needed for basic execution
+  lines.push('(allow file-read* (subpath "/bin"))');
+  lines.push('(allow file-read* (subpath "/usr/bin"))');
   lines.push('(allow file-read* (subpath "/usr/lib"))');
+  lines.push('(allow file-read* (subpath "/usr/libexec"))');
   lines.push('(allow file-read* (subpath "/System/Library"))');
+  lines.push('(allow file-read* (subpath "/Library/Frameworks"))');
   lines.push('(allow file-read* (subpath "/usr/local/lib"))');
+  lines.push(
+    '(allow file-read* file-write* (literal "/dev/null") (literal "/dev/stdin") (literal "/dev/stdout") (literal "/dev/stderr"))',
+  );
+  lines.push('(allow file-read* (literal "/dev/urandom"))');
   lines.push('(allow file-read* (literal "/etc/passwd"))');
 
   return lines.join("\n");
@@ -199,6 +327,7 @@ export function applyMacSandbox(
   const base = {
     platform: runtime.platform,
     profile: sandboxOpts.profileName || "default",
+    backend: "macos-seatbelt",
     command,
     args,
     options: { ...(spawnOpts || {}) },
@@ -250,6 +379,11 @@ export function applyMacSandbox(
     ...base,
     applied: true,
     enforcement: "macos-seatbelt",
+    guarantees: [
+      SANDBOX_BOUNDARIES.FILESYSTEM,
+      ...(sandboxOpts.allowNetwork ? [] : [SANDBOX_BOUNDARIES.NETWORK]),
+      ...(sandboxOpts.allowExec ? [] : [SANDBOX_BOUNDARIES.PROCESS_EXEC]),
+    ],
     command: sandboxExecutable,
     args: newArgs,
     options: invocation.options,
@@ -264,12 +398,137 @@ export function applyMacSandbox(
 }
 
 // ---------------------------------------------------------------------------
-// Windows Job Object availability
+// Windows Job Object + Restricted Token
 // ---------------------------------------------------------------------------
 
 /**
- * Report Windows sandbox availability. Node's child_process API cannot create
- * and synchronously assign a Job Object or restricted token by itself.
+ * Materialize the shipped PowerShell/Win32 adapter into a physical temporary
+ * file. This is required for pkg builds where source assets live in a virtual
+ * snapshot that an external powershell.exe process cannot open directly.
+ */
+function materializeWindowsAdapter(runtime) {
+  const sourcePath =
+    runtime.windowsAdapterScriptPath ||
+    runtime.joinPath(runtime.moduleDir, "windows-sandbox.ps1");
+  let content = runtime.windowsAdapterContent;
+  if (content === undefined) {
+    if (!runtime.fs.existsSync(sourcePath)) {
+      return { reason: "windows_native_adapter_missing" };
+    }
+    try {
+      content = runtime.fs.readFileSync(sourcePath, "utf8");
+    } catch {
+      return { reason: "windows_native_adapter_unreadable" };
+    }
+  }
+  const adapterHash = crypto
+    .createHash("sha256")
+    .update(String(content))
+    .digest("hex")
+    .slice(0, 24);
+  const cacheExecutable = runtime.joinPath(
+    runtime.tmpdir(),
+    `chainless-win-sandbox-${adapterHash}.exe`,
+  );
+  if (runtime.fs.existsSync(cacheExecutable)) {
+    return {
+      cacheExecutable,
+      bootstrapRequired: false,
+    };
+  }
+  const scriptPath = runtime.joinPath(
+    runtime.tmpdir(),
+    `chainless-win-sandbox-${runtime.randomBytes(12).toString("hex")}.ps1`,
+  );
+  try {
+    runtime.fs.writeFileSync(scriptPath, content, { mode: 0o600 });
+  } catch {
+    return { reason: "windows_native_adapter_materialize_failed" };
+  }
+  return {
+    scriptPath,
+    cacheExecutable,
+    bootstrapRequired: true,
+    cleanup: () => {
+      try {
+        runtime.fs.unlinkSync(scriptPath);
+      } catch {
+        // The temporary adapter may already have been removed.
+      }
+    },
+  };
+}
+
+function waitForWindowsTargetIdentity(
+  proc,
+  identityPath,
+  runtime,
+  timeoutMs = 10_000,
+) {
+  const deadline = runtime.now() + timeoutMs;
+  let lastError;
+  while (runtime.now() < deadline) {
+    try {
+      const identity = JSON.parse(
+        runtime.fs.readFileSync(identityPath, "utf8"),
+      );
+      if (identity?.error) {
+        throw new Error(
+          `Windows sandbox helper rejected the target: ${identity.error}`,
+        );
+      }
+      const targetPid = Number(identity?.targetPid);
+      const helperPid = Number(identity?.helperPid);
+      if (!Number.isSafeInteger(targetPid) || targetPid <= 0) {
+        throw new Error("Windows sandbox identity omitted a valid target PID");
+      }
+      if (
+        Number.isSafeInteger(helperPid) &&
+        helperPid > 0 &&
+        helperPid !== proc.pid
+      ) {
+        throw new Error(
+          `Windows sandbox identity named unexpected helper PID ${helperPid}`,
+        );
+      }
+      if (targetPid === proc.pid) {
+        throw new Error(
+          "Windows sandbox target PID unexpectedly equals its helper PID",
+        );
+      }
+
+      const wrapperPid = proc.pid;
+      proc.sandboxWrapperPid = wrapperPid;
+      proc.sandboxTargetPid = targetPid;
+      // ChildProcess.pid is a writable data property. The native ChildProcess
+      // handle still points at the helper, so kill()/ref()/unref() retain Job
+      // lifetime semantics while callers observe and persist the real target.
+      proc.pid = targetPid;
+      return { targetPid, wrapperPid };
+    } catch (error) {
+      lastError = error;
+      if (
+        error?.code !== "ENOENT" &&
+        !(error instanceof SyntaxError) &&
+        !String(error?.message || "").includes("omitted a valid target PID")
+      ) {
+        throw error;
+      }
+    }
+    runtime.sleepSync(10);
+  }
+  throw new Error(
+    `Timed out waiting for Windows sandbox target identity${
+      lastError?.message ? `: ${lastError.message}` : ""
+    }`,
+  );
+}
+
+/**
+ * Wrap a target with the built-in Windows PowerShell host. The shipped script
+ * P/Invokes Win32 to create a restricted primary token, starts the target
+ * suspended, assigns it to a kill-on-close Job Object, then resumes it. The
+ * target therefore cannot run before both native boundaries are active.
  *
  * @param {string} command
  * @param {string[]} args
@@ -287,6 +546,7 @@ export function applyWindowsSandbox(
   const base = {
     platform: runtime.platform,
     profile: sandboxOpts.profileName || "default",
+    backend: "windows-job-restricted-token",
     command,
     args,
     options: spawnOpts,
@@ -298,19 +558,196 @@ export function applyWindowsSandbox(
     });
   }
 
-  // Node does not expose Job Object or restricted-token primitives. Mark the
-  // platform unavailable instead of treating CREATE_NO_WINDOW or an
-  // environment marker as a security boundary. A future native adapter may
-  // return an applied plan with a synchronous postSpawn step.
+  // The hosted Windows restricted-token path cannot reliably preserve file
+  // descriptor backed stdout/stderr when its helper is itself detached. Mark
+  // that combination unavailable before launch: strict/required callers fail
+  // closed, while ordinary trusted control-plane callers retain the broker's
+  // explicit audited fallback instead of receiving a phantom target PID.
+  if (
+    spawnOpts?.detached === true &&
+    Array.isArray(spawnOpts?.stdio) &&
+    spawnOpts.stdio.slice(0, 3).some((entry) => Number.isInteger(entry))
+  ) {
+    return createSandboxPlan({
+      ...base,
+      reason: "windows_detached_file_stdio_unsupported",
+    });
+  }
+
+  const nodeIpcFd = Array.isArray(spawnOpts?.stdio)
+    ? spawnOpts.stdio.findIndex((entry) => entry === "ipc")
+    : -1;
+  if (
+    Array.isArray(spawnOpts?.stdio) &&
+    spawnOpts.stdio
+      .slice(3)
+      .some(
+        (entry, offset) =>
+          offset + 3 !== nodeIpcFd &&
+          entry !== "ignore" &&
+          entry !== null &&
+          entry !== undefined,
+      )
+  ) {
+    return createSandboxPlan({
+      ...base,
+      reason: "windows_extra_descriptor_unsupported",
+    });
+  }
+
+  const adapter = materializeWindowsAdapter(runtime);
+  if (!adapter.cacheExecutable) {
+    return createSandboxPlan({
+      ...base,
+      reason: adapter.reason,
+    });
+  }
+
+  const invocation = normalizeWrappedInvocation(
+    command,
+    args,
+    spawnOpts,
+    runtime.platform,
+  );
+  const profile = sandboxOpts.profileName || "default";
+  const limits = sandboxOpts.limits || {};
+  const identityPath =
+    spawnOpts?.detached === true
+      ? runtime.joinPath(
+          runtime.tmpdir(),
+          `chainless-win-sandbox-identity-${runtime
+            .randomBytes(24)
+            .toString("hex")}.json`,
+        )
+      : null;
+  const launchSpec = {
+    cpuSeconds: Number(limits.cpu || 0),
+    processMemoryBytes: Number(
+      limits.as || (profile === "strict" ? 256 * 1024 * 1024 : 0),
+    ),
+    activeProcessLimit: profile === "strict" ? 16 : 64,
+    command: invocation.command,
+    args: invocation.args,
+    nodeIpcFd,
+    detached: invocation.options.detached === true,
+    windowsHide: invocation.options.windowsHide === true,
+  };
+  if (identityPath) launchSpec.identityPath = identityPath;
+  const payload = Buffer.from(JSON.stringify(launchSpec), "utf8").toString(
+    "base64",
+  );
+  const helperArgs = [payload];
+  const options = {
+    ...invocation.options,
+    shell: false,
+    env: {
+      ...(invocation.options.env || process.env),
+      CC_WINDOWS_SANDBOXED: "1",
+      CC_WINDOWS_SANDBOX_PROFILE: profile,
+    },
+  };
+  const cleanupIdentity = () => {
+    if (!identityPath) return;
+    try {
+      runtime.fs.unlinkSync(identityPath);
+    } catch {
+      // The post-spawn handshake normally removes this file first.
+    }
+  };
+  const identityContract = identityPath
+    ? {
+        postSpawn: { required: true, mode: "sync" },
+        postSpawnWindows: (proc) => {
+          try {
+            return waitForWindowsTargetIdentity(proc, identityPath, runtime);
+          } catch (error) {
+            try {
+              proc.kill?.();
+            } catch {
+              // Closing the helper is best-effort; the thrown failure remains
+              // authoritative and strict mode will fail closed.
+            }
+            throw error;
+          } finally {
+            cleanupIdentity();
+          }
+        },
+      }
+    : {};
+
+  if (adapter.bootstrapRequired) {
+    const powershell = runtime.joinPath(
+      runtime.windowsDir(),
+      "System32",
+      "WindowsPowerShell",
+      "v1.0",
+      "powershell.exe",
+    );
+    if (!runtime.fs.existsSync(powershell)) {
+      adapter.cleanup?.();
+      cleanupIdentity();
+      return createSandboxPlan({
+        ...base,
+        reason: "windows_powershell_host_unavailable",
+      });
+    }
+    const compileResult = runtime.spawnSync(
+      powershell,
+      [
+        "-NoLogo",
+        "-NoProfile",
+        "-NonInteractive",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-File",
+        adapter.scriptPath,
+        "-CacheExecutable",
+        adapter.cacheExecutable,
+        "-CompileOnly",
+      ],
+      {
+        shell: false,
+        windowsHide: true,
+        encoding: "utf8",
+        timeout: 30_000,
+        env: invocation.options.env || process.env,
+      },
+    );
+    adapter.cleanup?.();
+    if (
+      compileResult?.error ||
+      compileResult?.status !== 0 ||
+      !runtime.fs.existsSync(adapter.cacheExecutable)
+    ) {
+      cleanupIdentity();
+      return createSandboxPlan({
+        ...base,
+        reason: "windows_native_adapter_compile_failed",
+      });
+    }
+  }
+
   return createSandboxPlan({
     ...base,
-    reason: "windows_native_job_object_unavailable",
+    applied: true,
+    enforcement: "windows-job-restricted-token",
+    guarantees: [
+      SANDBOX_BOUNDARIES.PROCESS_TREE,
+      SANDBOX_BOUNDARIES.RESOURCE_LIMITS,
+      SANDBOX_BOUNDARIES.PRIVILEGE_REDUCTION,
+    ],
+    command: adapter.cacheExecutable,
+    args: helperArgs,
+    options,
+    ...identityContract,
+    cleanup: cleanupIdentity,
   });
 }
 
 /**
- * Reject an attempted Windows post-spawn association until a native adapter is
- * available.
+ * Retained for injected adapters that elect to perform synchronous post-spawn
+ * enforcement. The built-in wrapper completes enforcement before target resume
+ * and therefore does not require this path.
  *
  * @param {ChildProcess} proc - The spawned child process
  * @param {Object} sandboxResult - Result from applyWindowsSandbox
@@ -324,17 +761,83 @@ export function postSpawnWindowsSandbox(
   if (runtime.platform !== "win32" || !sandboxResult?.postSpawn?.required) {
     return;
   }
-  const error = new Error(
-    "Windows native Job Object enforcement is unavailable",
-  );
-  error.code = "ERR_WINDOWS_SANDBOX_UNAVAILABLE";
-  throw error;
+  if (typeof sandboxResult.postSpawnWindows === "function") {
+    return sandboxResult.postSpawnWindows(proc);
+  }
 }
 
 // ---------------------------------------------------------------------------
 // Linux resource-limit enforcement
 // ---------------------------------------------------------------------------
 
+/**
+ * Prove only that the installed bubblewrap binary can create the namespace and
+ * mount primitives needed by a future policy backend. This deliberately does
+ * not attest any filesystem/network policy and therefore must never promote a
+ * sandbox guarantee.
+ */
+function probeLinuxBubblewrapRuntime(runtime) {
+  let binaryPresent = false;
+  try {
+    binaryPresent = runtime.fs.existsSync(LINUX_BWRAP_PATH);
+  } catch {
+    return {
+      kind: "linux-bwrap-runtime-smoke-v1",
+      attempted: false,
+      runnable: false,
+      reason: "binary_probe_failed",
+    };
+  }
+  if (!binaryPresent) {
+    return {
+      kind: "linux-bwrap-runtime-smoke-v1",
+      attempted: false,
+      runnable: false,
+      reason: "binary_missing",
+    };
+  }
+
+  let result;
+  try {
+    result = runtime.spawnSync(
+      LINUX_BWRAP_PATH,
+      [...LINUX_BWRAP_RUNTIME_PROBE_ARGS],
+      {
+        shell: false,
+        stdio: "ignore",
+        timeout: 5_000,
+        env: {
+          PATH: "/usr/bin:/bin",
+          LANG: "C",
+          LC_ALL: "C",
+        },
+      },
+    );
+  } catch {
+    return {
+      kind: "linux-bwrap-runtime-smoke-v1",
+      attempted: true,
+      runnable: false,
+      reason: "probe_spawn_failed",
+    };
+  }
+
+  if (result?.error || result?.status !== 0) {
+    return {
+      kind: "linux-bwrap-runtime-smoke-v1",
+      attempted: true,
+      runnable: false,
+      reason: result?.error ? "probe_spawn_failed" : "probe_failed",
+    };
+  }
+  return {
+    kind: "linux-bwrap-runtime-smoke-v1",
+    attempted: true,
+    runnable: true,
+    reason: null,
+  };
+}
+
 /**
  * Apply Linux resource limits through the util-linux `prlimit` wrapper.
  *
@@ -360,6 +863,7 @@ export function applyLinuxSandbox(
   const base = {
     platform: runtime.platform,
     profile: sandboxOpts.profileName || "default",
+    backend: "linux-prlimit",
     command,
     args,
     options: { ...(spawnOpts || {}) },
@@ -372,6 +876,29 @@ export function applyLinuxSandbox(
   }
 
   const { limits = {} } = sandboxOpts;
+  const requiredBoundaries = Array.isArray(sandboxOpts.requiredBoundaries)
+    ? sandboxOpts.requiredBoundaries
+    : [];
+  const requiresStrongLinuxBoundary = requiredBoundaries.some(
+    (boundary) =>
+      boundary === SANDBOX_BOUNDARIES.FILESYSTEM ||
+      boundary === SANDBOX_BOUNDARIES.NETWORK,
+  );
+
+  if (requiresStrongLinuxBoundary) {
+    const runtimeProbe = probeLinuxBubblewrapRuntime(runtime);
+    return createSandboxPlan({
+      ...base,
+      backend: null,
+      candidateBackend: "linux-bwrap",
+      policyAttested: false,
+      runtimeProbe,
+      reason: runtimeProbe.runnable
+        ? "linux_bwrap_policy_unattested"
+        : "linux_bwrap_unavailable",
+      guarantees: [],
+    });
+  }
 
   const prlimitParts = [];
   if (limits.cpu) prlimitParts.push(`--cpu=${limits.cpu}`);
@@ -404,6 +931,7 @@ export function applyLinuxSandbox(
     ...base,
     applied: true,
     enforcement: "linux-prlimit",
+    guarantees: [SANDBOX_BOUNDARIES.RESOURCE_LIMITS],
     command: "/usr/bin/prlimit",
     args: [...prlimitParts, "--", invocation.command, ...invocation.args],
     options,
@@ -420,17 +948,28 @@ export function applyLinuxSandbox(
  * @param {string} command
  * @param {string[]} args
  * @param {Object} spawnOpts - Original spawn options
- * @param {"default"|"strict"|"network-only"} profileName
+ * @param {"default"|"strict"|"network-only"|{
+ *   profile?: "default"|"strict"|"network-only",
+ *   requiredBoundaries?: string[]
+ * }} profileOrRequest
+ * @param {Object} runtimeOverrides
+ * @param {{profile?: string, requiredBoundaries?: string[]}|null} explicitRequest
  * @returns {ReturnType<typeof createSandboxPlan>}
  */
 export function applySandbox(
   command,
   args,
   spawnOpts,
-  profileName = "default",
+  profileOrRequest = "default",
   runtimeOverrides = {},
+  explicitRequest = null,
 ) {
   const runtime = resolveRuntime(runtimeOverrides);
+  const sandboxRequest = normalizeSandboxRequest(
+    profileOrRequest,
+    explicitRequest,
+  );
+  const profileName = sandboxRequest.profile;
   const profiles = {
     default: {
       allowNetwork: false,
@@ -471,6 +1010,7 @@ export function applySandbox(
   const profile = {
     ...(profiles[profileName] || profiles.default),
     profileName: profiles[profileName] ? profileName : "default",
+    requiredBoundaries: sandboxRequest.requiredBoundaries,
   };
 
   // Dispatch to platform handler