chainlesschain 0.162.183 → 0.162.184

package/src/lib/process-execution-broker/index.js

@@ -38,7 +38,13 @@ import {
   postSpawnSandbox as _postSpawnSandbox,
   SANDBOX_BOUNDARIES,
 } from "./platform-sandbox.js";
+import {
+  admitLinuxGenericSandboxExecutionContract,
+  issueLinuxGenericSandboxExecutionContract,
+  LINUX_GENERIC_CONTRACT_KIND,
+} from "./linux-generic-bwrap.js";
 import { consumeIssuedPluginSandboxExecutionContract } from "../plugin-runtime/bin.js";
+import runtimeProvenanceLedger from "../runtime-provenance-ledger.js";
 import { credentialAgent } from "./credential-agent.js";
 
 const SUPPORTED_SANDBOX_BOUNDARIES = new Set(Object.values(SANDBOX_BOUNDARIES));
@@ -50,7 +56,6 @@ const SUPPORTED_SANDBOX_PROFILES = new Set([
 
 // 延迟导入避免循环依赖
 let _traceCtx = null;
-let _rpl = null;
 let _hooksV2 = null;
 const _ipcBus = null;
 
@@ -66,14 +71,7 @@ function getTraceCtx() {
 }
 
 function getRpl() {
-  if (!_rpl) {
-    try {
-      _rpl = require("../runtime-provenance-ledger.js");
-    } catch {
-      _rpl = null;
-    }
-  }
-  return _rpl;
+  return runtimeProvenanceLedger;
 }
 
 function getHooksV2() {
@@ -271,6 +269,24 @@ class ProcessExecutionBroker extends EventEmitter {
         },
       );
     };
+    if (raw?.kind === LINUX_GENERIC_CONTRACT_KIND) {
+      const admitted = admitLinuxGenericSandboxExecutionContract(raw, {
+        origin: options.origin || "unknown",
+        command: launch?.command,
+        args: launch?.args,
+        cwd: options.cwd || process.cwd(),
+        shell: options.shell,
+        sync: launch?.sync === true,
+        stdio: options.stdio,
+        requiredBoundaries,
+      });
+      if (!admitted) {
+        return invalid(
+          "sandboxExecutionContract was not issued for this workspace launch provenance",
+        );
+      }
+      return admitted;
+    }
     if (
       !consumeIssuedPluginSandboxExecutionContract(raw, {
         origin: options.origin,
@@ -315,6 +331,7 @@ class ProcessExecutionBroker extends EventEmitter {
       ![
         "strict-plugin-node-bin",
         "strict-plugin-native-static-elf-bin",
+        "strict-plugin-native-elf-bin",
       ].includes(raw.kind)
     ) {
       return invalid("unsupported sandboxExecutionContract kind or version");
@@ -407,6 +424,57 @@ class ProcessExecutionBroker extends EventEmitter {
     });
   }
 
+  /**
+   * Issue a private one-launch Linux workspace authority for trusted host
+   * call-sites. The writable root is a positional host value, never read from
+   * a manifest/spawn option. Unsupported platforms and mixed boundary sets
+   * return null so the normal fail-closed adapter path remains authoritative.
+   */
+  issueLinuxWorkspaceSandboxExecutionContract(
+    command,
+    args = [],
+    options = {},
+    trustedWorkspaceRoot = process.cwd(),
+    { sync = false } = {},
+  ) {
+    const requiredBoundaries = [
+      ...new Set([
+        ...(options.requiredBoundaries || []),
+        ...(options.sandboxPolicy?.requiredBoundaries || []),
+      ]),
+    ];
+    if (
+      process.platform !== "linux" ||
+      requiredBoundaries.length === 0 ||
+      (options.shell !== undefined &&
+        options.shell !== null &&
+        options.shell !== false) ||
+      requiredBoundaries.some(
+        (boundary) =>
+          boundary !== SANDBOX_BOUNDARIES.FILESYSTEM &&
+          boundary !== SANDBOX_BOUNDARIES.NETWORK,
+      )
+    ) {
+      return null;
+    }
+    return issueLinuxGenericSandboxExecutionContract({
+      origin: options.origin || "unknown",
+      command,
+      args,
+      cwd: options.cwd || trustedWorkspaceRoot,
+      workspaceRoot: trustedWorkspaceRoot,
+      shell: options.shell,
+      sync,
+      stdio: options.stdio,
+      requiredBoundaries,
+      detached: options.detached,
+      uid: options.uid,
+      gid: options.gid,
+      argv0: options.argv0,
+      serialization: options.serialization,
+    });
+  }
+
   _stripPluginControlOptions(options) {
     delete options.pluginId;
     delete options.pluginVersion;
@@ -636,6 +704,9 @@ class ProcessExecutionBroker extends EventEmitter {
       );
     }
     let runtimeProbe = null;
+    let genericWorkspaceProbe = false;
+    let sanitizedFilesystemPolicy = null;
+    let sanitizedNetworkPolicy = null;
     if (plan.runtimeProbe !== null && plan.runtimeProbe !== undefined) {
       if (
         typeof plan.runtimeProbe !== "object" ||
@@ -659,6 +730,9 @@ class ProcessExecutionBroker extends EventEmitter {
         "pluginTreeContentSnapshotScope",
         "pluginTreeContentSnapshotMechanism",
         "pluginTreeSnapshotConsistency",
+        "initialDynamicLoadClosureScope",
+        "initialDynamicLoadClosureMechanism",
+        "initialDynamicInterpreter",
       ]) {
         if (
           plan.runtimeProbe[field] !== undefined &&
@@ -677,6 +751,7 @@ class ProcessExecutionBroker extends EventEmitter {
         "pluginTreeContentSnapshot",
         "pluginTreeSnapshotContractBound",
         "pluginTreeSnapshotAtomic",
+        "initialDynamicLoadClosureDescriptorBound",
       ]) {
         if (
           plan.runtimeProbe[field] !== undefined &&
@@ -691,6 +766,8 @@ class ProcessExecutionBroker extends EventEmitter {
       for (const field of [
         "pluginTreeContentSnapshotFiles",
         "pluginTreeContentSnapshotBytes",
+        "initialDynamicDependencyCount",
+        "initialDynamicRuntimeFileCount",
       ]) {
         if (
           plan.runtimeProbe[field] !== undefined &&
@@ -716,6 +793,19 @@ class ProcessExecutionBroker extends EventEmitter {
           "Sandbox runtime probe pluginTreeContentSnapshotDigest must be a lowercase SHA-256 value",
         );
       }
+      if (
+        plan.runtimeProbe.initialDynamicLoadClosureDigest !== undefined &&
+        (typeof plan.runtimeProbe.initialDynamicLoadClosureDigest !==
+          "string" ||
+          !/^[a-f0-9]{64}$/.test(
+            plan.runtimeProbe.initialDynamicLoadClosureDigest,
+          ))
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Sandbox runtime probe initialDynamicLoadClosureDigest must be a lowercase SHA-256 value",
+        );
+      }
       const pluginTreeSnapshot =
         plan.runtimeProbe.pluginTreeContentSnapshot === true;
       const pluginTreeEvidenceFields = [
@@ -899,6 +989,277 @@ class ProcessExecutionBroker extends EventEmitter {
           );
         }
       }
+      const initialDynamicLoadClosureBound =
+        plan.runtimeProbe.initialDynamicLoadClosureDescriptorBound === true;
+      const initialDynamicEvidenceFields = [
+        "initialDynamicLoadClosureScope",
+        "initialDynamicLoadClosureMechanism",
+        "initialDynamicInterpreter",
+        "initialDynamicDependencyCount",
+        "initialDynamicRuntimeFileCount",
+        "initialDynamicLoadClosureDigest",
+      ];
+      const initialDynamicInterpreter =
+        plan.runtimeProbe.initialDynamicInterpreter;
+      const initialDynamicDependencyCount =
+        plan.runtimeProbe.initialDynamicDependencyCount;
+      const initialDynamicRuntimeFileCount =
+        plan.runtimeProbe.initialDynamicRuntimeFileCount;
+      const successfulDynamicProbe =
+        plan.applied === true &&
+        plan.runtimeProbe.kind ===
+          "linux-bwrap-plugin-native-dynamic-elf-policy-v1" &&
+        plan.runtimeProbe.runnable === true;
+      if (
+        initialDynamicLoadClosureBound &&
+        (plan.applied !== true ||
+          plan.platform !== "linux" ||
+          plan.enforcement !== "linux-bwrap" ||
+          backend !== "linux-bwrap" ||
+          candidateBackend !== null ||
+          policyAttested !== true ||
+          policyDigest === null ||
+          !guarantees.includes(SANDBOX_BOUNDARIES.FILESYSTEM) ||
+          !guarantees.includes(SANDBOX_BOUNDARIES.NETWORK) ||
+          plan.runtimeProbe.attempted !== true ||
+          plan.runtimeProbe.runnable !== true ||
+          plan.runtimeProbe.reason !== null ||
+          plan.runtimeProbe.kind !==
+            "linux-bwrap-plugin-native-dynamic-elf-policy-v1" ||
+          plan.runtimeProbe.probeRuntime !== "node" ||
+          plan.runtimeProbe.targetRuntime !== "native-dynamic-elf" ||
+          plan.runtimeProbe.contentSnapshot !== true ||
+          plan.runtimeProbe.contentSnapshotScope !==
+            "plugin-entry-executable" ||
+          plan.runtimeProbe.contentSnapshotMechanism !==
+            "verified-o_tmpfile-copy-bwrap-ro-bind-data-v1" ||
+          plan.runtimeProbe.handleAtomic !== false ||
+          !supervisorBound ||
+          plan.runtimeProbe.initialDynamicLoadClosureScope !==
+            "initial-pt_interp-and-direct-dt_needed-attested-system-set" ||
+          plan.runtimeProbe.initialDynamicLoadClosureMechanism !==
+            "parsed-elf-direct-system-set-to-attested-node-runtime-fds-v1" ||
+          typeof initialDynamicInterpreter !== "string" ||
+          !path.posix.isAbsolute(initialDynamicInterpreter) ||
+          path.posix.normalize(initialDynamicInterpreter) !==
+            initialDynamicInterpreter ||
+          !["/lib/", "/lib64/", "/usr/lib/", "/usr/lib64/"].some((prefix) =>
+            initialDynamicInterpreter.startsWith(prefix),
+          ) ||
+          !Number.isSafeInteger(initialDynamicDependencyCount) ||
+          initialDynamicDependencyCount < 0 ||
+          initialDynamicDependencyCount > 128 ||
+          !Number.isSafeInteger(initialDynamicRuntimeFileCount) ||
+          initialDynamicRuntimeFileCount < 1 ||
+          initialDynamicRuntimeFileCount > 129 ||
+          initialDynamicRuntimeFileCount <
+            Math.max(1, initialDynamicDependencyCount) ||
+          initialDynamicRuntimeFileCount > initialDynamicDependencyCount + 1 ||
+          !/^[a-f0-9]{64}$/.test(
+            plan.runtimeProbe.initialDynamicLoadClosureDigest || "",
+          ))
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Sandbox runtime probe initial dynamic direct system set evidence must use the typed descriptor-bound contract",
+        );
+      }
+      if (
+        !initialDynamicLoadClosureBound &&
+        initialDynamicEvidenceFields.some(
+          (field) => plan.runtimeProbe[field] !== undefined,
+        )
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Sandbox runtime probe initial dynamic direct system set evidence requires initialDynamicLoadClosureDescriptorBound",
+        );
+      }
+      if (successfulDynamicProbe && !initialDynamicLoadClosureBound) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Sandbox runtime probe successful dynamic ELF evidence requires a descriptor-bound initial direct system set",
+        );
+      }
+      const genericWorkspaceEvidenceFields = [
+        "contractDigest",
+        "policyDigest",
+        "mountTopologyDigest",
+        "emptyRoot",
+        "undeclaredRootReadOnly",
+        "workspaceReadWrite",
+        "workspaceMountTopologyAttested",
+        "workspaceRootAliasAttested",
+        "anonymousDevWritable",
+        "systemReadOnly",
+        "hostHomeHidden",
+        "outsideMarkerHidden",
+        "networkNamespace",
+        "networkNamespaceChanged",
+        "socketCreationDenied",
+        "descriptorMounts",
+        "mountTopologyAtomic",
+      ];
+      for (const field of [
+        "contractDigest",
+        "policyDigest",
+        "mountTopologyDigest",
+      ]) {
+        if (
+          plan.runtimeProbe[field] !== undefined &&
+          (typeof plan.runtimeProbe[field] !== "string" ||
+            !/^[a-f0-9]{64}$/.test(plan.runtimeProbe[field]))
+        ) {
+          throw this._sandboxError(
+            "invalid_sandbox_plan",
+            `Sandbox runtime probe ${field} must be a lowercase SHA-256 value`,
+          );
+        }
+      }
+      for (const field of genericWorkspaceEvidenceFields.slice(3)) {
+        if (
+          plan.runtimeProbe[field] !== undefined &&
+          typeof plan.runtimeProbe[field] !== "boolean"
+        ) {
+          throw this._sandboxError(
+            "invalid_sandbox_plan",
+            `Sandbox runtime probe ${field} must be boolean`,
+          );
+        }
+      }
+      const genericWorkspaceKind =
+        plan.runtimeProbe.kind === "linux-bwrap-generic-workspace-policy-v1";
+      if (
+        !genericWorkspaceKind &&
+        genericWorkspaceEvidenceFields.some(
+          (field) => plan.runtimeProbe[field] !== undefined,
+        )
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Linux generic workspace evidence requires its typed runtime probe kind",
+        );
+      }
+      if (genericWorkspaceKind) {
+        const filesystemPolicy = plan.filesystemPolicy;
+        const networkPolicy = plan.networkPolicy;
+        const workspaceRoot = filesystemPolicy?.workspaceRoot;
+        const workingDirectory = filesystemPolicy?.workingDirectory;
+        const workspaceRelative =
+          typeof workspaceRoot === "string" &&
+          typeof workingDirectory === "string"
+            ? path.posix.relative(workspaceRoot, workingDirectory)
+            : "..";
+        genericWorkspaceProbe =
+          plan.applied === true &&
+          plan.platform === "linux" &&
+          plan.enforcement === "linux-bwrap-workspace" &&
+          backend === "linux-bwrap-workspace" &&
+          candidateBackend === null &&
+          policyAttested === true &&
+          policyDigest !== null &&
+          plan.runtimeProbe.policyDigest === policyDigest &&
+          /^[a-f0-9]{64}$/.test(plan.runtimeProbe.contractDigest || "") &&
+          guarantees.includes(SANDBOX_BOUNDARIES.FILESYSTEM) &&
+          guarantees.includes(SANDBOX_BOUNDARIES.NETWORK) &&
+          plan.runtimeProbe.attempted === true &&
+          plan.runtimeProbe.runnable === true &&
+          plan.runtimeProbe.reason === null &&
+          plan.runtimeProbe.probeRuntime === "posix-sh" &&
+          plan.runtimeProbe.targetRuntime === "generic-command" &&
+          plan.runtimeProbe.contentSnapshot === false &&
+          plan.runtimeProbe.handleAtomic === false &&
+          plan.runtimeProbe.mountTopologyAtomic === false &&
+          plan.runtimeProbe.mountTopologyDigest ===
+            filesystemPolicy?.mountTopologyDigest &&
+          [
+            "emptyRoot",
+            "undeclaredRootReadOnly",
+            "workspaceReadWrite",
+            "workspaceMountTopologyAttested",
+            "workspaceRootAliasAttested",
+            "anonymousDevWritable",
+            "systemReadOnly",
+            "hostHomeHidden",
+            "outsideMarkerHidden",
+            "networkNamespace",
+            "networkNamespaceChanged",
+            "socketCreationDenied",
+            "descriptorMounts",
+          ].every((field) => plan.runtimeProbe[field] === true) &&
+          typeof workspaceRoot === "string" &&
+          path.posix.isAbsolute(workspaceRoot) &&
+          workspaceRoot !== "/" &&
+          typeof workingDirectory === "string" &&
+          path.posix.isAbsolute(workingDirectory) &&
+          workspaceRelative !== ".." &&
+          !workspaceRelative.startsWith("../") &&
+          !path.posix.isAbsolute(workspaceRelative) &&
+          filesystemPolicy.workspaceAccess === "read-write" &&
+          filesystemPolicy.systemAccess === "read-only" &&
+          filesystemPolicy.undeclaredRootAccess === "read-only" &&
+          filesystemPolicy.hostRootMapped === false &&
+          filesystemPolicy.hostHomeMapped === false &&
+          filesystemPolicy.workspaceDescriptorBound === true &&
+          filesystemPolicy.systemDescriptorBound === true &&
+          filesystemPolicy.exactEtcFileDescriptors === true &&
+          filesystemPolicy.workspaceRecursiveBind === true &&
+          filesystemPolicy.workspaceMountTopology ===
+            "no-strict-descendants-or-forbidden-root-aliases-at-attestation" &&
+          filesystemPolicy.mountTopologySource === "proc-self-mountinfo" &&
+          /^[a-f0-9]{64}$/.test(filesystemPolicy.mountTopologyDigest || "") &&
+          filesystemPolicy.mountTopologyAtomic === false &&
+          Array.isArray(filesystemPolicy.anonymousWritablePaths) &&
+          filesystemPolicy.anonymousWritablePaths.length === 5 &&
+          ["/home/sandbox", "/dev", "/run", "/tmp", "/var/tmp"].every(
+            (value, index) =>
+              filesystemPolicy.anonymousWritablePaths[index] === value,
+          ) &&
+          networkPolicy?.namespace === "new" &&
+          networkPolicy?.namespaceIdentityChanged === true &&
+          networkPolicy?.seccomp === "deny-network-creation" &&
+          plan.command.startsWith("/proc/self/fd/") &&
+          plan.options?.cwd === "/" &&
+          plan.options?.shell === false &&
+          Array.isArray(plan.options?.stdio) &&
+          plan.args.includes("--bind-fd") &&
+          plan.args.includes("--ro-bind-fd") &&
+          plan.args.includes("--remount-ro") &&
+          plan.args.includes("--unshare-net") &&
+          plan.args.includes("--seccomp") &&
+          !plan.args.includes("--ro-bind");
+        if (!genericWorkspaceProbe) {
+          throw this._sandboxError(
+            "invalid_sandbox_plan",
+            "Linux generic workspace evidence must use the typed descriptor-bound empty-root contract",
+          );
+        }
+        sanitizedFilesystemPolicy = Object.freeze({
+          workspaceRoot,
+          workingDirectory,
+          workspaceAccess: filesystemPolicy.workspaceAccess,
+          systemAccess: filesystemPolicy.systemAccess,
+          undeclaredRootAccess: filesystemPolicy.undeclaredRootAccess,
+          anonymousWritablePaths: Object.freeze([
+            ...filesystemPolicy.anonymousWritablePaths,
+          ]),
+          hostRootMapped: filesystemPolicy.hostRootMapped,
+          hostHomeMapped: filesystemPolicy.hostHomeMapped,
+          workspaceDescriptorBound: filesystemPolicy.workspaceDescriptorBound,
+          systemDescriptorBound: filesystemPolicy.systemDescriptorBound,
+          exactEtcFileDescriptors: filesystemPolicy.exactEtcFileDescriptors,
+          workspaceRecursiveBind: filesystemPolicy.workspaceRecursiveBind,
+          workspaceMountTopology: filesystemPolicy.workspaceMountTopology,
+          mountTopologySource: filesystemPolicy.mountTopologySource,
+          mountTopologyDigest: filesystemPolicy.mountTopologyDigest,
+          mountTopologyAtomic: filesystemPolicy.mountTopologyAtomic,
+        });
+        sanitizedNetworkPolicy = Object.freeze({
+          namespace: networkPolicy.namespace,
+          namespaceIdentityChanged: networkPolicy.namespaceIdentityChanged,
+          seccomp: networkPolicy.seccomp,
+        });
+      }
       runtimeProbe = {
         kind: plan.runtimeProbe.kind,
         attempted: plan.runtimeProbe.attempted,
@@ -944,6 +1305,19 @@ class ProcessExecutionBroker extends EventEmitter {
           runtimeProbe[field] = plan.runtimeProbe[field];
         }
       }
+      for (const field of [
+        "initialDynamicLoadClosureDescriptorBound",
+        ...initialDynamicEvidenceFields,
+      ]) {
+        if (plan.runtimeProbe[field] !== undefined) {
+          runtimeProbe[field] = plan.runtimeProbe[field];
+        }
+      }
+      for (const field of genericWorkspaceEvidenceFields) {
+        if (plan.runtimeProbe[field] !== undefined) {
+          runtimeProbe[field] = plan.runtimeProbe[field];
+        }
+      }
       if (supervisorIdentity !== undefined) {
         runtimeProbe.supervisorExecutableIdentity = {
           path: supervisorIdentity.path,
@@ -960,6 +1334,12 @@ class ProcessExecutionBroker extends EventEmitter {
         };
       }
     }
+    if (backend === "linux-bwrap-workspace" && !genericWorkspaceProbe) {
+      throw this._sandboxError(
+        "invalid_sandbox_plan",
+        "Applied Linux generic workspace plans require typed runtime evidence",
+      );
+    }
     const postSpawn = plan.postSpawn || { required: false, mode: "none" };
     if (
       postSpawn.required &&
@@ -981,6 +1361,12 @@ class ProcessExecutionBroker extends EventEmitter {
       policyAttested,
       policyDigest,
       runtimeProbe,
+      ...(sanitizedFilesystemPolicy
+        ? {
+            filesystemPolicy: sanitizedFilesystemPolicy,
+            networkPolicy: sanitizedNetworkPolicy,
+          }
+        : {}),
       postSpawn: { ...postSpawn },
     };
   }
@@ -1135,6 +1521,39 @@ class ProcessExecutionBroker extends EventEmitter {
     auditEntry.sandboxPolicyAttested =
       typeof plan?.policyAttested === "boolean" ? plan.policyAttested : null;
     auditEntry.sandboxPolicyDigest = plan?.policyDigest || null;
+    const genericPolicy =
+      applied === true && plan?.backend === "linux-bwrap-workspace";
+    auditEntry.sandboxFilesystemPolicy = genericPolicy
+      ? {
+          workspaceRoot: plan.filesystemPolicy.workspaceRoot,
+          workingDirectory: plan.filesystemPolicy.workingDirectory,
+          workspaceAccess: plan.filesystemPolicy.workspaceAccess,
+          systemAccess: plan.filesystemPolicy.systemAccess,
+          undeclaredRootAccess: plan.filesystemPolicy.undeclaredRootAccess,
+          anonymousWritablePaths: [
+            ...plan.filesystemPolicy.anonymousWritablePaths,
+          ],
+          hostRootMapped: plan.filesystemPolicy.hostRootMapped,
+          hostHomeMapped: plan.filesystemPolicy.hostHomeMapped,
+          workspaceDescriptorBound:
+            plan.filesystemPolicy.workspaceDescriptorBound,
+          systemDescriptorBound: plan.filesystemPolicy.systemDescriptorBound,
+          exactEtcFileDescriptors:
+            plan.filesystemPolicy.exactEtcFileDescriptors,
+          workspaceRecursiveBind: plan.filesystemPolicy.workspaceRecursiveBind,
+          workspaceMountTopology: plan.filesystemPolicy.workspaceMountTopology,
+          mountTopologySource: plan.filesystemPolicy.mountTopologySource,
+          mountTopologyDigest: plan.filesystemPolicy.mountTopologyDigest,
+          mountTopologyAtomic: plan.filesystemPolicy.mountTopologyAtomic,
+        }
+      : null;
+    auditEntry.sandboxNetworkPolicy = genericPolicy
+      ? {
+          namespace: plan.networkPolicy.namespace,
+          namespaceIdentityChanged: plan.networkPolicy.namespaceIdentityChanged,
+          seccomp: plan.networkPolicy.seccomp,
+        }
+      : null;
     auditEntry.sandboxCandidateReason = plan?.candidateBackend
       ? plan?.reason || null
       : null;
@@ -1396,12 +1815,13 @@ class ProcessExecutionBroker extends EventEmitter {
 
   _writeRplEntry(auditEntry, status = "started", error = null) {
     const rpl = getRpl();
-    if (!rpl || !rpl.default) return;
+    if (!rpl) return;
     try {
       const traceCtx = this._getTraceContext();
-      rpl.default.append(
+      if (typeof rpl.record !== "function") return;
+      rpl.record(
+        "process.execution",
         {
-          kind: "process.execution",
           component: auditEntry.origin,
           action: "spawn",
           artifactId: auditEntry.executionId,
@@ -1422,6 +1842,15 @@ class ProcessExecutionBroker extends EventEmitter {
             policy: auditEntry.policy,
             scope: auditEntry.scope,
           },
+          sandbox: {
+            applied: auditEntry.sandboxed === true,
+            backend: auditEntry.sandboxBackend || null,
+            guarantees: [...(auditEntry.sandboxGuarantees || [])],
+            policyAttested: auditEntry.sandboxPolicyAttested === true,
+            policyDigest: auditEntry.sandboxPolicyDigest || null,
+            filesystemPolicy: auditEntry.sandboxFilesystemPolicy || null,
+            networkPolicy: auditEntry.sandboxNetworkPolicy || null,
+          },
           traceId:
             traceCtx?.traceId || auditEntry.traceId || `trace-${Date.now()}`,
           parentSpanId: traceCtx?.spanId || null,
@@ -1607,6 +2036,18 @@ class ProcessExecutionBroker extends EventEmitter {
       proc,
       sandboxPlan.cleanup,
     );
+    if (
+      sandboxPlan.applied === true &&
+      sandboxPlan.backend === "linux-bwrap-workspace" &&
+      sandboxPlan.postSpawn.required === false
+    ) {
+      // child_process.spawn() has synchronously duplicated every stdio entry
+      // into the launched bwrap process before returning. Generic workspace
+      // plans do not need a parent-side post-spawn handle, so retaining their
+      // pinned mount/seccomp descriptors until a long-lived MCP/LSP/monitor
+      // exits would turn each child into an avoidable FD leak.
+      cleanupSandbox();
+    }
     try {
       this._runPostSpawnSandbox(proc, sandboxPlan, auditEntry);
       auditEntry.pid = proc.pid;