chainlesschain 0.163.0 → 0.163.2

package/src/lib/process-execution-broker/index.js

@@ -36,7 +36,9 @@ const require = createRequire(import.meta.url);
 // platform-sandbox.js exports: applySandbox, postSpawnSandbox
 import {
   applySandbox as _applySandbox,
+  consumeWindowsMcpCodeSnapshotPlanBinding,
   postSpawnSandbox as _postSpawnSandbox,
+  MCP_STDIO_FD_ENTRY_BOOTSTRAP_SHA256,
   SANDBOX_BOUNDARIES,
 } from "./platform-sandbox.js";
 import {
@@ -60,6 +62,9 @@ const SUPPORTED_SANDBOX_PROFILES = new Set([
   "strict",
   "network-only",
 ]);
+// Broker-private admission state. Public runtime-probe fields are audit
+// evidence, not authority to invoke a privileged post-spawn closure.
+const admittedWindowsMcpCodeSnapshotPlans = new WeakSet();
 
 // 延迟导入避免循环依赖
 let _traceCtx = null;
@@ -1065,7 +1070,7 @@ class ProcessExecutionBroker extends EventEmitter {
     return error;
   }
 
-  _validateSandboxPlan(plan) {
+  _validateSandboxPlan(plan, launchContext = {}) {
     if (!plan || typeof plan !== "object") {
       throw this._sandboxError(
         "invalid_sandbox_plan",
@@ -1159,6 +1164,7 @@ class ProcessExecutionBroker extends EventEmitter {
     let sanitizedNetworkPolicy = null;
     let sanitizedProcessTreePolicy = null;
     let sanitizedPtyPolicy = null;
+    let windowsPlanBindingConsumed = false;
     if (plan.runtimeProbe !== null && plan.runtimeProbe !== undefined) {
       if (
         typeof plan.runtimeProbe !== "object" ||
@@ -1179,6 +1185,10 @@ class ProcessExecutionBroker extends EventEmitter {
         "targetRuntime",
         "contentSnapshotScope",
         "contentSnapshotMechanism",
+        "runtimeLaunchMechanism",
+        "planBindingMechanism",
+        "runtimeLaunchPath",
+        "entrySnapshotPath",
         "pluginTreeContentSnapshotScope",
         "pluginTreeContentSnapshotMechanism",
         "pluginTreeSnapshotConsistency",
@@ -1207,6 +1217,7 @@ class ProcessExecutionBroker extends EventEmitter {
         "sharedLibraryClosure",
         "entrySnapshotAtomic",
         "runtimeLaunchAtomic",
+        "mcpCapsuleCodeSnapshot",
       ]) {
         if (
           plan.runtimeProbe[field] !== undefined &&
@@ -1242,6 +1253,7 @@ class ProcessExecutionBroker extends EventEmitter {
         "runtimeSnapshotSha256",
         "runtimeAttestedSha256",
         "entrySnapshotSha256",
+        "planBindingDigest",
       ]) {
         if (
           plan.runtimeProbe[field] !== undefined &&
@@ -1254,6 +1266,22 @@ class ProcessExecutionBroker extends EventEmitter {
           );
         }
       }
+      const planBindingDeclared =
+        plan.runtimeProbe.planBindingMechanism !== undefined ||
+        plan.runtimeProbe.planBindingDigest !== undefined;
+      if (
+        planBindingDeclared &&
+        (plan.platform !== "win32" ||
+          !guarantees.includes(SANDBOX_BOUNDARIES.CODE_SNAPSHOT) ||
+          plan.runtimeProbe.planBindingMechanism !==
+            "windows-mcp-code-snapshot-plan-binding-v1" ||
+          !/^[a-f0-9]{64}$/.test(plan.runtimeProbe.planBindingDigest || ""))
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Sandbox runtime probe plan binding must use the typed Windows MCP code-snapshot contract",
+        );
+      }
       if (
         plan.runtimeProbe.pluginTreeContentSnapshotDigest !== undefined &&
         (typeof plan.runtimeProbe.pluginTreeContentSnapshotDigest !==
@@ -1559,15 +1587,97 @@ class ProcessExecutionBroker extends EventEmitter {
         SANDBOX_BOUNDARIES.CODE_SNAPSHOT,
       );
       if (codeSnapshotGuaranteed) {
+        const executionContract = launchContext.executionContract;
+        const launchArgs = Array.isArray(launchContext.args)
+          ? launchContext.args
+          : [];
+        const windowsPlanBindingDeclared =
+          plan.platform === "win32" &&
+          (plan.runtimeProbe.planBindingMechanism !== undefined ||
+            plan.runtimeProbe.planBindingDigest !== undefined);
+        // Consume before evaluating any other Windows evidence. A genuine
+        // one-launch plan is therefore burned by its first admission attempt,
+        // including an attempt with a mismatched command or contract.
+        windowsPlanBindingConsumed = windowsPlanBindingDeclared
+          ? consumeWindowsMcpCodeSnapshotPlanBinding(plan, {
+              command: launchContext.command,
+              args: launchArgs,
+              cwd: launchContext.cwd,
+              shell: launchContext.shell,
+              detached: launchContext.detached,
+              executionContract,
+              profile: launchContext.profile,
+              requiredBoundaries: launchContext.requiredBoundaries,
+              sync: launchContext.sync,
+            })
+          : false;
+        const passthroughArgsMatch = (candidateArgs) =>
+          candidateArgs.length === Math.max(0, launchArgs.length - 1) &&
+          candidateArgs.every(
+            (candidateArg, index) => candidateArg === launchArgs[index + 1],
+          );
+        const contractBoundSnapshotEvidence =
+          executionContract?.contractVersion === 1 &&
+          executionContract.kind === MCP_STDIO_CAPSULE_SANDBOX_CONTRACT_KIND &&
+          typeof launchContext.command === "string" &&
+          launchContext.command === executionContract.runtimePath &&
+          launchContext.command ===
+            executionContract.runtimeIdentity?.realPath &&
+          launchArgs.length >= 1 &&
+          launchArgs[0] === executionContract.entryIdentity?.realPath &&
+          /^[a-f0-9]{64}$/.test(
+            executionContract.runtimeIdentity?.sha256 || "",
+          ) &&
+          Number.isSafeInteger(executionContract.runtimeIdentity?.bytes) &&
+          executionContract.runtimeIdentity.bytes > 0 &&
+          /^[a-f0-9]{64}$/.test(
+            executionContract.entryIdentity?.sha256 || "",
+          ) &&
+          Number.isSafeInteger(executionContract.entryIdentity?.bytes) &&
+          executionContract.entryIdentity.bytes >= 0 &&
+          plan.runtimeProbe.entrySnapshotSha256 ===
+            executionContract.entryIdentity.sha256 &&
+          plan.runtimeProbe.entrySnapshotBytes ===
+            executionContract.entryIdentity.bytes;
+        const linuxRuntimeSnapshotContractBound =
+          plan.runtimeProbe.runtimeSnapshotSha256 ===
+            executionContract?.runtimeIdentity?.sha256 &&
+          plan.runtimeProbe.runtimeSnapshotBytes ===
+            executionContract?.runtimeIdentity?.bytes &&
+          plan.runtimeProbe.runtimeAttestedSha256 === undefined &&
+          plan.runtimeProbe.runtimeAttestedBytes === undefined;
+        const windowsRuntimeAttestationContractBound =
+          plan.runtimeProbe.runtimeAttestedSha256 ===
+            executionContract?.runtimeIdentity?.sha256 &&
+          plan.runtimeProbe.runtimeAttestedBytes ===
+            executionContract?.runtimeIdentity?.bytes &&
+          plan.runtimeProbe.runtimeSnapshotSha256 === undefined &&
+          plan.runtimeProbe.runtimeSnapshotBytes === undefined;
+        const contractEntryRelative = executionContract
+          ? path.posix.relative(
+              executionContract.pluginRoot,
+              executionContract.entryIdentity.realPath,
+            )
+          : null;
+        const expectedLinuxBubblewrapEntry =
+          contractEntryRelative &&
+          contractEntryRelative !== ".." &&
+          !contractEntryRelative.startsWith("../") &&
+          !path.posix.isAbsolute(contractEntryRelative)
+            ? path.posix.join("/opt/chainless/plugin", contractEntryRelative)
+            : null;
         const exactSnapshotEvidence =
           plan.applied === true &&
           candidateBackend === null &&
+          contractBoundSnapshotEvidence &&
           plan.runtimeProbe.attempted === true &&
           plan.runtimeProbe.runnable === true &&
           plan.runtimeProbe.reason === null &&
           plan.runtimeProbe.probeRuntime === "node" &&
           plan.runtimeProbe.targetRuntime === "node" &&
           plan.runtimeProbe.contentSnapshot === true &&
+          plan.runtimeProbe.entrySnapshotAtomic === true &&
+          plan.runtimeProbe.runtimeLaunchAtomic === true &&
           plan.runtimeProbe.sharedLibraryClosure === false &&
           /^[a-f0-9]{64}$/.test(plan.runtimeProbe.entrySnapshotSha256 || "") &&
           Number.isSafeInteger(plan.runtimeProbe.entrySnapshotBytes) &&
@@ -1583,8 +1693,15 @@ class ProcessExecutionBroker extends EventEmitter {
           plan.runtimeProbe.contentSnapshotScope ===
             "mcp-capsule-entry-and-node-runtime" &&
           plan.runtimeProbe.contentSnapshotMechanism ===
-            "verified-o_tmpfile-copy-inherited-fd-exec-v1" &&
+            "verified-o_tmpfile-copy-inherited-fd-module-compile-v1" &&
           plan.runtimeProbe.handleAtomic === true &&
+          plan.runtimeProbe.entrySnapshotAtomic === true &&
+          plan.runtimeProbe.runtimeLaunchAtomic === true &&
+          plan.runtimeProbe.runtimeLaunchMechanism ===
+            "inherited-executable-fd-v1" &&
+          plan.runtimeProbe.entrySnapshotBootstrapSha256 ===
+            MCP_STDIO_FD_ENTRY_BOOTSTRAP_SHA256 &&
+          linuxRuntimeSnapshotContractBound &&
           /^[a-f0-9]{64}$/.test(
             plan.runtimeProbe.runtimeSnapshotSha256 || "",
           ) &&
@@ -1592,7 +1709,53 @@ class ProcessExecutionBroker extends EventEmitter {
           plan.runtimeProbe.runtimeSnapshotBytes > 0 &&
           plan.runtimeProbe.runtimeSnapshotBytes <= 256 * 1024 * 1024 &&
           /^\/proc\/self\/fd\/\d+$/.test(plan.command) &&
-          /^\/proc\/self\/fd\/\d+$/.test(plan.args[0] || "");
+          plan.args[0] === "-e" &&
+          crypto
+            .createHash("sha256")
+            .update(plan.args[1] || "")
+            .digest("hex") === MCP_STDIO_FD_ENTRY_BOOTSTRAP_SHA256 &&
+          plan.args[2] === "--" &&
+          passthroughArgsMatch(plan.args.slice(3));
+        const linuxBubblewrapTargetSeparator = plan.args.indexOf("--");
+        const linuxBubblewrapSnapshotEvidence =
+          plan.platform === "linux" &&
+          backend === "linux-bwrap" &&
+          plan.enforcement === "linux-bwrap" &&
+          policyAttested === true &&
+          policyDigest !== null &&
+          plan.runtimeProbe.kind === "linux-bwrap-plugin-node-policy-v1" &&
+          plan.runtimeProbe.mcpCapsuleCodeSnapshot === true &&
+          plan.runtimeProbe.contentSnapshotScope === "plugin-entry-source" &&
+          plan.runtimeProbe.contentSnapshotMechanism ===
+            "verified-o_tmpfile-copy-bwrap-ro-bind-data-v1" &&
+          plan.runtimeProbe.handleAtomic === false &&
+          plan.runtimeProbe.entrySnapshotAtomic === true &&
+          plan.runtimeProbe.runtimeLaunchAtomic === true &&
+          plan.runtimeProbe.runtimeLaunchMechanism ===
+            "bwrap-descriptor-mount-node-runtime-exec-v1" &&
+          plan.runtimeProbe.supervisorDescriptorBound === true &&
+          plan.runtimeProbe.pluginTreeContentSnapshot === true &&
+          plan.runtimeProbe.runtimeLaunchPath ===
+            "/opt/chainless/runtime/node" &&
+          expectedLinuxBubblewrapEntry !== null &&
+          plan.runtimeProbe.entrySnapshotPath ===
+            expectedLinuxBubblewrapEntry &&
+          linuxRuntimeSnapshotContractBound &&
+          /^[a-f0-9]{64}$/.test(
+            plan.runtimeProbe.runtimeSnapshotSha256 || "",
+          ) &&
+          Number.isSafeInteger(plan.runtimeProbe.runtimeSnapshotBytes) &&
+          plan.runtimeProbe.runtimeSnapshotBytes > 0 &&
+          plan.runtimeProbe.runtimeSnapshotBytes <= 256 * 1024 * 1024 &&
+          /^\/proc\/self\/fd\/\d+$/.test(plan.command) &&
+          linuxBubblewrapTargetSeparator >= 0 &&
+          plan.args[linuxBubblewrapTargetSeparator + 1] ===
+            plan.runtimeProbe.runtimeLaunchPath &&
+          plan.args[linuxBubblewrapTargetSeparator + 2] ===
+            plan.runtimeProbe.entrySnapshotPath &&
+          passthroughArgsMatch(
+            plan.args.slice(linuxBubblewrapTargetSeparator + 3),
+          );
         const windowsSnapshotEvidence =
           plan.platform === "win32" &&
           [
@@ -1600,26 +1763,40 @@ class ProcessExecutionBroker extends EventEmitter {
             "windows-appcontainer-job-restricted-token",
           ].includes(backend) &&
           plan.enforcement === backend &&
-          [
-            "windows-plugin-node-entry-snapshot-v1",
-            "windows-appcontainer-launch-attestation-v1",
-          ].includes(plan.runtimeProbe.kind) &&
+          ((backend === "windows-job-restricted-token" &&
+            plan.runtimeProbe.kind ===
+              "windows-plugin-node-entry-snapshot-v1") ||
+            (backend === "windows-appcontainer-job-restricted-token" &&
+              plan.runtimeProbe.kind ===
+                "windows-appcontainer-launch-attestation-v1" &&
+              policyAttested === true &&
+              policyDigest !== null)) &&
           plan.runtimeProbe.contentSnapshotScope ===
             "mcp-capsule-entry-source" &&
           plan.runtimeProbe.contentSnapshotMechanism ===
             "verified-handle-inherited-pipe-module-compile-v1" &&
           plan.runtimeProbe.handleAtomic === false &&
           plan.runtimeProbe.entrySnapshotAtomic === true &&
-          plan.runtimeProbe.runtimeLaunchAtomic === false &&
+          plan.runtimeProbe.runtimeLaunchAtomic === true &&
+          plan.runtimeProbe.runtimeLaunchMechanism ===
+            "filter-oplock-locked-createprocess-suspended-image-v1" &&
+          plan.runtimeProbe.planBindingMechanism ===
+            "windows-mcp-code-snapshot-plan-binding-v1" &&
+          /^[a-f0-9]{64}$/.test(plan.runtimeProbe.planBindingDigest || "") &&
+          windowsRuntimeAttestationContractBound &&
           /^[a-f0-9]{64}$/.test(
             plan.runtimeProbe.runtimeAttestedSha256 || "",
           ) &&
           Number.isSafeInteger(plan.runtimeProbe.runtimeAttestedBytes) &&
           plan.runtimeProbe.runtimeAttestedBytes > 0 &&
-          plan.runtimeProbe.runtimeAttestedBytes <= 256 * 1024 * 1024;
+          plan.runtimeProbe.runtimeAttestedBytes <= 256 * 1024 * 1024 &&
+          launchContext.builtInSandboxAdapter === true &&
+          windowsPlanBindingConsumed;
         if (
           !exactSnapshotEvidence ||
-          (!linuxSnapshotEvidence && !windowsSnapshotEvidence)
+          (!linuxSnapshotEvidence &&
+            !linuxBubblewrapSnapshotEvidence &&
+            !windowsSnapshotEvidence)
         ) {
           throw this._sandboxError(
             "invalid_sandbox_plan",
@@ -1907,6 +2084,22 @@ class ProcessExecutionBroker extends EventEmitter {
         ...(plan.runtimeProbe.handleAtomic !== undefined
           ? { handleAtomic: plan.runtimeProbe.handleAtomic }
           : {}),
+        ...(plan.runtimeProbe.entrySnapshotAtomic !== undefined
+          ? { entrySnapshotAtomic: plan.runtimeProbe.entrySnapshotAtomic }
+          : {}),
+        ...(plan.runtimeProbe.runtimeLaunchAtomic !== undefined
+          ? { runtimeLaunchAtomic: plan.runtimeProbe.runtimeLaunchAtomic }
+          : {}),
+        ...(plan.runtimeProbe.runtimeLaunchMechanism !== undefined
+          ? {
+              runtimeLaunchMechanism: plan.runtimeProbe.runtimeLaunchMechanism,
+            }
+          : {}),
+        ...(plan.runtimeProbe.sharedLibraryClosure !== undefined
+          ? {
+              sharedLibraryClosure: plan.runtimeProbe.sharedLibraryClosure,
+            }
+          : {}),
         ...(plan.runtimeProbe.contentSnapshotScope !== undefined
           ? {
               contentSnapshotScope: plan.runtimeProbe.contentSnapshotScope,
@@ -1918,12 +2111,35 @@ class ProcessExecutionBroker extends EventEmitter {
                 plan.runtimeProbe.contentSnapshotMechanism,
             }
           : {}),
+        ...(plan.runtimeProbe.planBindingMechanism !== undefined
+          ? {
+              planBindingMechanism: plan.runtimeProbe.planBindingMechanism,
+              planBindingDigest: plan.runtimeProbe.planBindingDigest,
+            }
+          : {}),
         ...(plan.runtimeProbe.runtimeSnapshotSha256 !== undefined
           ? {
               runtimeSnapshotSha256: plan.runtimeProbe.runtimeSnapshotSha256,
               runtimeSnapshotBytes: plan.runtimeProbe.runtimeSnapshotBytes,
               entrySnapshotSha256: plan.runtimeProbe.entrySnapshotSha256,
               entrySnapshotBytes: plan.runtimeProbe.entrySnapshotBytes,
+              entrySnapshotAtomic: plan.runtimeProbe.entrySnapshotAtomic,
+              runtimeLaunchAtomic: plan.runtimeProbe.runtimeLaunchAtomic,
+              runtimeLaunchMechanism: plan.runtimeProbe.runtimeLaunchMechanism,
+              ...(plan.runtimeProbe.runtimeLaunchPath !== undefined
+                ? { runtimeLaunchPath: plan.runtimeProbe.runtimeLaunchPath }
+                : {}),
+              ...(plan.runtimeProbe.entrySnapshotPath !== undefined
+                ? { entrySnapshotPath: plan.runtimeProbe.entrySnapshotPath }
+                : {}),
+              ...(plan.runtimeProbe.mcpCapsuleCodeSnapshot !== undefined
+                ? {
+                    mcpCapsuleCodeSnapshot:
+                      plan.runtimeProbe.mcpCapsuleCodeSnapshot,
+                  }
+                : {}),
+              entrySnapshotBootstrapSha256:
+                plan.runtimeProbe.entrySnapshotBootstrapSha256,
               sharedLibraryClosure: plan.runtimeProbe.sharedLibraryClosure,
             }
           : {}),
@@ -1935,6 +2151,7 @@ class ProcessExecutionBroker extends EventEmitter {
               entrySnapshotBytes: plan.runtimeProbe.entrySnapshotBytes,
               entrySnapshotAtomic: plan.runtimeProbe.entrySnapshotAtomic,
               runtimeLaunchAtomic: plan.runtimeProbe.runtimeLaunchAtomic,
+              runtimeLaunchMechanism: plan.runtimeProbe.runtimeLaunchMechanism,
               sharedLibraryClosure: plan.runtimeProbe.sharedLibraryClosure,
             }
           : {}),
@@ -1984,6 +2201,15 @@ class ProcessExecutionBroker extends EventEmitter {
         };
       }
     }
+    if (
+      guarantees.includes(SANDBOX_BOUNDARIES.CODE_SNAPSHOT) &&
+      runtimeProbe === null
+    ) {
+      throw this._sandboxError(
+        "invalid_sandbox_plan",
+        "Code snapshot guarantee requires typed atomic MCP capsule evidence",
+      );
+    }
     if (backend === "linux-bwrap-workspace" && !genericWorkspaceProbe) {
       throw this._sandboxError(
         "invalid_sandbox_plan",
@@ -2001,7 +2227,7 @@ class ProcessExecutionBroker extends EventEmitter {
         "Required post-spawn enforcement must declare sync or async mode",
       );
     }
-    return {
+    const validatedPlan = {
       ...plan,
       args: [...plan.args],
       options: { ...plan.options },
@@ -2021,6 +2247,15 @@ class ProcessExecutionBroker extends EventEmitter {
         : {}),
       postSpawn: { ...postSpawn },
     };
+    if (windowsPlanBindingConsumed) {
+      const upstreamCleanup = validatedPlan.cleanup;
+      validatedPlan.cleanup = (...args) => {
+        admittedWindowsMcpCodeSnapshotPlans.delete(validatedPlan);
+        return upstreamCleanup?.(...args);
+      };
+      admittedWindowsMcpCodeSnapshotPlans.add(validatedPlan);
+    }
+    return validatedPlan;
   }
 
   _assertRequiredSandboxBoundaries(plan, requiredBoundaries) {
@@ -2055,10 +2290,20 @@ class ProcessExecutionBroker extends EventEmitter {
         },
       );
     }
-    return {
+    const assertedPlan = {
       ...plan,
       requiredBoundaries: [...requiredBoundaries],
     };
+    if (admittedWindowsMcpCodeSnapshotPlans.has(plan)) {
+      admittedWindowsMcpCodeSnapshotPlans.delete(plan);
+      const upstreamCleanup = assertedPlan.cleanup;
+      assertedPlan.cleanup = (...args) => {
+        admittedWindowsMcpCodeSnapshotPlans.delete(assertedPlan);
+        return upstreamCleanup?.(...args);
+      };
+      admittedWindowsMcpCodeSnapshotPlans.add(assertedPlan);
+    }
+    return assertedPlan;
   }
 
   _prepareSandboxPlan(
@@ -2112,17 +2357,44 @@ class ProcessExecutionBroker extends EventEmitter {
     // Keep the legacy string profile in argument four. The built-in adapter
     // reserves argument five for runtime injection, so the typed request is
     // additive in argument six and legacy injected adapters can ignore it.
-    const rawPlan = this._sandboxAdapter.applySandbox(
-      command,
-      args || [],
-      options,
-      profile,
-      undefined,
-      adapterRequest,
-    );
+    const sandboxAdapter = this._sandboxAdapter;
+    const applySandboxAdapter = sandboxAdapter.applySandbox;
+    const builtInSandboxAdapter = applySandboxAdapter === _applySandbox;
+    // Never dispatch the built-in through a mutable Function property or a
+    // global reflective helper after consulting an injected adapter getter.
+    // The lexical import is the identity we checked and the implementation we
+    // invoke. Legacy adapters retain their historical `this` receiver.
+    const rawPlan = builtInSandboxAdapter
+      ? _applySandbox(
+          command,
+          args || [],
+          options,
+          profile,
+          undefined,
+          adapterRequest,
+        )
+      : Reflect.apply(applySandboxAdapter, sandboxAdapter, [
+          command,
+          args || [],
+          options,
+          profile,
+          undefined,
+          adapterRequest,
+        ]);
     let plan;
     try {
-      plan = this._validateSandboxPlan(rawPlan);
+      plan = this._validateSandboxPlan(rawPlan, {
+        command,
+        args: Object.freeze([...(args || [])]),
+        cwd: options.cwd,
+        shell: options.shell,
+        detached: options.detached,
+        executionContract: sandboxPolicy.executionContract || null,
+        profile,
+        requiredBoundaries: Object.freeze([...requiredBoundaries]),
+        sync,
+        builtInSandboxAdapter,
+      });
       plan = this._assertRequiredSandboxBoundaries(plan, requiredBoundaries);
 
       if (!plan.applied && strict) {
@@ -2135,7 +2407,12 @@ class ProcessExecutionBroker extends EventEmitter {
       }
 
       if (plan.applied && plan.postSpawn.required) {
-        if (typeof this._sandboxAdapter.postSpawnSandbox !== "function") {
+        const builtInWindowsMcpPostSpawn =
+          admittedWindowsMcpCodeSnapshotPlans.has(plan);
+        if (
+          !builtInWindowsMcpPostSpawn &&
+          typeof this._sandboxAdapter.postSpawnSandbox !== "function"
+        ) {
           throw this._sandboxError(
             "post_spawn_adapter_unavailable",
             "Required post-spawn sandbox adapter is unavailable",
@@ -2350,7 +2627,28 @@ class ProcessExecutionBroker extends EventEmitter {
 
     let postSpawnResult;
     try {
-      postSpawnResult = this._sandboxAdapter.postSpawnSandbox(proc, plan);
+      const windowsMcpPlanBindingDeclared =
+        plan.platform === "win32" &&
+        plan.runtimeProbe?.planBindingMechanism ===
+          "windows-mcp-code-snapshot-plan-binding-v1";
+      const builtInWindowsMcpPlan =
+        admittedWindowsMcpCodeSnapshotPlans.has(plan);
+      if (windowsMcpPlanBindingDeclared && !builtInWindowsMcpPlan) {
+        throw this._sandboxError(
+          "windows_mcp_plan_binding_consumed",
+          "Windows MCP sandbox plan binding is unavailable or already consumed",
+        );
+      }
+      if (builtInWindowsMcpPlan) {
+        // Burn the one-launch post-spawn authority before invoking untrusted
+        // process-facing code. Success, failure, cleanup, and reentry all
+        // observe the capability as consumed.
+        admittedWindowsMcpCodeSnapshotPlans.delete(plan);
+      }
+      const postSpawnAdapter = builtInWindowsMcpPlan
+        ? (child, boundPlan) => boundPlan.postSpawnWindows(child)
+        : this._sandboxAdapter.postSpawnSandbox;
+      postSpawnResult = postSpawnAdapter(proc, plan);
     } catch (error) {
       this._applySandboxAudit(auditEntry, plan, false);
       auditEntry.sandboxState = "failed";