chainlesschain 0.163.1 → 0.163.2

package/src/lib/process-execution-broker/platform-sandbox.js

@@ -169,7 +169,14 @@ const LINUX_EXECUTABLE_SNAPSHOT_SOURCE_MODE = 0o500;
 const LINUX_MCP_CAPSULE_BACKEND = "linux-fd-code-snapshot";
 const LINUX_MCP_RUNTIME_SNAPSHOT_SCOPE = "mcp-node-runtime-executable";
 const LINUX_MCP_CAPSULE_SNAPSHOT_MECHANISM =
-  "verified-o_tmpfile-copy-inherited-fd-exec-v1";
+  "verified-o_tmpfile-copy-inherited-fd-module-compile-v1";
+const MACOS_MCP_CAPSULE_BACKEND = "macos-fd-code-snapshot";
+export const MCP_STDIO_FD_ENTRY_BOOTSTRAP =
+  'const fs=require("node:fs");const Module=require("node:module");const filename="/chainlesschain/mcp-capsule.cjs";const source=fs.readFileSync(4,"utf8");process.argv.splice(1,0,filename);const target=new Module(filename,module);target.filename=filename;target.paths=[];target._compile(source,filename);';
+export const MCP_STDIO_FD_ENTRY_BOOTSTRAP_SHA256 = crypto
+  .createHash("sha256")
+  .update(MCP_STDIO_FD_ENTRY_BOOTSTRAP)
+  .digest("hex");
 const LINUX_NODE_ENTRY_SNAPSHOT_SCOPE = "plugin-entry-source";
 const LINUX_NATIVE_ENTRY_SNAPSHOT_SCOPE = "plugin-entry-executable";
 const LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE = "all-pinned-plugin-regular-files";
@@ -283,6 +290,14 @@ const windowsAdapterCacheEntries = new Set();
 const windowsTemporaryCleanupBacklog = new Set();
 let windowsTemporaryCleanupRetryTimer = null;
 const windowsAppContainerCleanupBacklog = new Set();
+const issuedWindowsMcpCodeSnapshotPlans = new WeakMap();
+// Only the unified production adapter can register a Windows MCP launch
+// capability. Direct callers of the exported platform-specific helper (and
+// callers that inject a test/runtime facade into applySandbox) may exercise
+// plan construction, but cannot mint a Broker-admissible capability.
+const WINDOWS_MCP_CODE_SNAPSHOT_ISSUER = Symbol(
+  "windows-mcp-code-snapshot-issuer",
+);
 // Each AppContainer retry starts a synchronous, digest-attested PowerShell
 // helper. Bound automatic retries so a permanently unsupported Windows host
 // cannot repeatedly block a long-lived CLI; explicit cleanup/reset and process
@@ -453,6 +468,8 @@ export function generateMacSeatbeltProfile(opts = {}, runtimeOverrides = {}) {
     allowNetwork = false,
     allowExec = true,
   } = opts;
+  const seatbeltLiteral = (value) =>
+    String(value).replace(/\\/g, "\\\\").replace(/"/g, '\\"');
 
   const lines = [
     "(version 1)",
@@ -485,12 +502,12 @@ export function generateMacSeatbeltProfile(opts = {}, runtimeOverrides = {}) {
 
   // Allow read/write to specific paths
   for (const p of allowRead) {
-    const abs = runtime.resolvePath(p);
+    const abs = seatbeltLiteral(runtime.resolvePath(p));
     lines.push(`(allow file-read* (subpath "${abs}"))`);
   }
 
   for (const p of allowWrite) {
-    const abs = runtime.resolvePath(p);
+    const abs = seatbeltLiteral(runtime.resolvePath(p));
     lines.push(`(allow file-read* file-write* (subpath "${abs}"))`);
   }
 
@@ -511,6 +528,144 @@ export function generateMacSeatbeltProfile(opts = {}, runtimeOverrides = {}) {
   return lines.join("\n");
 }
 
+function validateMacMcpCapsuleContract(
+  command,
+  args,
+  spawnOpts,
+  contract,
+  runtime,
+  sync,
+) {
+  if (
+    contract?.kind !== MCP_STDIO_CAPSULE_SANDBOX_CONTRACT_KIND ||
+    contract.contractVersion !== 1 ||
+    (sync !== true && sync !== false) ||
+    spawnOpts?.shell !== false ||
+    !linuxStdioIsNarrow(spawnOpts?.stdio) ||
+    spawnOpts?.serialization !== undefined ||
+    spawnOpts?.argv0 !== undefined ||
+    spawnOpts?.uid !== undefined ||
+    spawnOpts?.gid !== undefined ||
+    !Array.isArray(args) ||
+    args.length < 1 ||
+    args.some((value) => typeof value !== "string" || value.includes("\0")) ||
+    command !== contract.runtimePath ||
+    command !== contract.runtimeIdentity?.realPath ||
+    args[0] !== contract.entryIdentity?.realPath ||
+    ![".js", ".cjs", ".mjs"].includes(
+      path.posix.extname(contract.entryIdentity?.realPath || "").toLowerCase(),
+    )
+  ) {
+    return { ok: false, reason: "launch_identity_mismatch" };
+  }
+  for (const value of [
+    contract.pluginRoot,
+    contract.workingDirectory,
+    contract.rootIdentity?.realPath,
+    contract.entryIdentity?.realPath,
+    contract.runtimeIdentity?.realPath,
+  ]) {
+    if (
+      typeof value !== "string" ||
+      !path.posix.isAbsolute(value) ||
+      value.includes("\0")
+    ) {
+      return { ok: false, reason: "noncanonical_contract_path" };
+    }
+  }
+  try {
+    if (
+      linuxRealpath(runtime, contract.pluginRoot) !== contract.pluginRoot ||
+      linuxRealpath(runtime, contract.workingDirectory) !==
+        contract.workingDirectory ||
+      linuxRealpath(runtime, spawnOpts.cwd) !== contract.pluginRoot ||
+      contract.workingDirectory !== contract.pluginRoot ||
+      contract.rootIdentity?.realPath !== contract.pluginRoot ||
+      !linuxPathWithin(contract.pluginRoot, contract.entryIdentity.realPath)
+    ) {
+      return { ok: false, reason: "noncanonical_contract_path" };
+    }
+  } catch {
+    return { ok: false, reason: "contract_path_unavailable" };
+  }
+  if (
+    !linuxDirectoryIdentityMatches(runtime, contract.rootIdentity) ||
+    !linuxIdentityMatches(runtime, contract.runtimeIdentity, {
+      executable: true,
+    }) ||
+    !linuxIdentityMatches(runtime, contract.entryIdentity)
+  ) {
+    return { ok: false, reason: "execution_identity_changed" };
+  }
+  return { ok: true };
+}
+
+function applyMacMcpCapsuleCodeSnapshot(
+  command,
+  args,
+  spawnOpts,
+  sandboxOpts,
+  runtime,
+  base,
+) {
+  const contract = sandboxOpts.executionContract;
+  const validation = validateMacMcpCapsuleContract(
+    command,
+    args,
+    spawnOpts,
+    contract,
+    runtime,
+    sandboxOpts.sync,
+  );
+  const unavailable = (reason, runtimeProbe = null) =>
+    createSandboxPlan({
+      ...base,
+      backend: null,
+      candidateBackend: MACOS_MCP_CAPSULE_BACKEND,
+      policyAttested: false,
+      runtimeProbe: runtimeProbe
+        ? {
+            kind: "darwin-mcp-capsule-code-snapshot-v1",
+            attempted: runtimeProbe.attempted !== false,
+            probeRuntime: "node",
+            targetRuntime: "node",
+            ...runtimeProbe,
+          }
+        : null,
+      reason,
+      guarantees: [],
+    });
+  if (!validation.ok) {
+    return unavailable("macos_mcp_capsule_execution_contract_invalid", {
+      attempted: false,
+      runnable: false,
+      reason: validation.reason,
+      contentSnapshot: false,
+      handleAtomic: false,
+      entrySnapshotAtomic: false,
+      runtimeLaunchAtomic: false,
+      sharedLibraryClosure: false,
+    });
+  }
+
+  // Darwin exposes only pathname-based exec/spawn APIs to an unprivileged
+  // process. An inherited descriptor can bind the entry source, but public
+  // APIs cannot bind the verified Node runtime descriptor to the image that
+  // executes. Private temporary paths and Seatbelt still leave a same-UID
+  // pathname-replacement window, so they cannot satisfy CODE_SNAPSHOT.
+  return unavailable("macos_atomic_runtime_exec_unavailable", {
+    attempted: true,
+    runnable: false,
+    reason: "public_api_has_no_descriptor_bound_exec",
+    contentSnapshot: false,
+    handleAtomic: false,
+    entrySnapshotAtomic: false,
+    runtimeLaunchAtomic: false,
+    runtimeLaunchMechanism: "darwin-public-api-pathname-exec-only-v1",
+    sharedLibraryClosure: false,
+  });
+}
+
 /**
  * Apply macOS sandbox via SBWritableProfile or sandbox-exec wrapper.
  *
@@ -552,6 +707,20 @@ export function applyMacSandbox(
     });
   }
 
+  if (
+    Array.isArray(sandboxOpts.requiredBoundaries) &&
+    sandboxOpts.requiredBoundaries.includes(SANDBOX_BOUNDARIES.CODE_SNAPSHOT)
+  ) {
+    return applyMacMcpCapsuleCodeSnapshot(
+      command,
+      args,
+      spawnOpts,
+      sandboxOpts,
+      runtime,
+      base,
+    );
+  }
+
   // A deny-by-default Seatbelt profile cannot safely infer the filesystem,
   // IPC, and inherited-descriptor access required by an arbitrary command.
   // Keep the boundary truthful for the broker's implicit default profile:
@@ -731,6 +900,218 @@ function sha256(value) {
   return crypto.createHash("sha256").update(value).digest("hex");
 }
 
+function sameStringArray(left, right) {
+  return (
+    Array.isArray(left) &&
+    Array.isArray(right) &&
+    left.length === right.length &&
+    left.every((value, index) => value === right[index])
+  );
+}
+
+function captureWindowsStdio(stdio) {
+  if (Array.isArray(stdio)) return Object.freeze([...stdio]);
+  return stdio ?? null;
+}
+
+function sameWindowsStdio(left, right) {
+  const normalizedRight = right ?? null;
+  if (Array.isArray(left) || Array.isArray(normalizedRight)) {
+    return (
+      Array.isArray(left) &&
+      Array.isArray(normalizedRight) &&
+      left.length === normalizedRight.length &&
+      left.every((entry, index) => Object.is(entry, normalizedRight[index]))
+    );
+  }
+  return Object.is(left, normalizedRight);
+}
+
+function windowsStdioDigestContract(stdio) {
+  const normalizeEntry = (entry) => {
+    if (entry === null || entry === undefined) return ["null"];
+    if (typeof entry === "string") return ["string", entry];
+    if (Number.isInteger(entry)) return ["fd", entry];
+    return [typeof entry];
+  };
+  return Array.isArray(stdio)
+    ? ["array", ...stdio.map(normalizeEntry)]
+    : ["scalar", ...normalizeEntry(stdio)];
+}
+
+function windowsEnvironmentDigest(env) {
+  const entries = Object.entries(env || {})
+    .map(([key, value]) => [key, String(value)])
+    .sort(([leftKey, leftValue], [rightKey, rightValue]) => {
+      if (leftKey !== rightKey) return leftKey < rightKey ? -1 : 1;
+      if (leftValue === rightValue) return 0;
+      return leftValue < rightValue ? -1 : 1;
+    });
+  return sha256(JSON.stringify(entries));
+}
+
+function windowsMcpBindingIdentity(identity) {
+  if (!identity) return null;
+  return {
+    contractVersion: identity.contractVersion ?? null,
+    realPath: identity.realPath ?? null,
+    sha256: identity.sha256 ?? null,
+    bytes: identity.bytes ?? null,
+    fileId: identity.fileId
+      ? {
+          dev: identity.fileId.dev ?? null,
+          ino: identity.fileId.ino ?? null,
+        }
+      : null,
+    mtimeMs: identity.mtimeMs ?? null,
+    attestation: identity.attestation ?? null,
+  };
+}
+
+function windowsMcpBindingContract(contract) {
+  return {
+    contractVersion: contract?.contractVersion ?? null,
+    kind: contract?.kind ?? null,
+    pluginRoot: contract?.pluginRoot ?? null,
+    workingDirectory: contract?.workingDirectory ?? null,
+    runtimePath: contract?.runtimePath ?? null,
+    rootIdentity: contract?.rootIdentity
+      ? {
+          realPath: contract.rootIdentity.realPath ?? null,
+          fileId: contract.rootIdentity.fileId
+            ? {
+                dev: contract.rootIdentity.fileId.dev ?? null,
+                ino: contract.rootIdentity.fileId.ino ?? null,
+              }
+            : null,
+          attestation: contract.rootIdentity.attestation ?? null,
+        }
+      : null,
+    entryIdentity: windowsMcpBindingIdentity(contract?.entryIdentity),
+    runtimeIdentity: windowsMcpBindingIdentity(contract?.runtimeIdentity),
+  };
+}
+
+function createWindowsMcpCodeSnapshotPlanBinding({
+  executionContract,
+  command,
+  args,
+  spawnOpts,
+  profile,
+  requiredBoundaries,
+  sync,
+  backend,
+  policyAttested,
+  policyDigest,
+  adapterSource,
+  helperInvocation,
+  helperOptions,
+  postSpawn,
+  postSpawnWindows,
+}) {
+  const helperEnvDigest = windowsEnvironmentDigest(helperOptions.env);
+  const helperStdio = captureWindowsStdio(helperOptions.stdio);
+  const originalArgs = Object.freeze([...(args || [])]);
+  const helperArgs = Object.freeze([...(helperInvocation.args || [])]);
+  const normalizedPostSpawn = Object.freeze({
+    required: postSpawn?.required === true,
+    mode: postSpawn?.mode || "none",
+  });
+  const digestPayload = {
+    version: 1,
+    kind: "windows-mcp-code-snapshot-plan-binding-v1",
+    executionContract: windowsMcpBindingContract(executionContract),
+    originalLaunch: {
+      command,
+      args: originalArgs,
+      cwd: spawnOpts?.cwd ?? null,
+      shell: spawnOpts?.shell ?? null,
+      detached: spawnOpts?.detached ?? null,
+      profile,
+      requiredBoundaries: [...requiredBoundaries],
+      sync,
+    },
+    policy: { backend, policyAttested, policyDigest },
+    adapter: {
+      loaderMode: adapterSource.loaderMode,
+      sourceDigest: adapterSource.sourceDigest,
+      sourceContractDigest: adapterSource.sourceContractDigest,
+    },
+    helperInvocation: {
+      command: helperInvocation.command,
+      args: helperArgs,
+      cwd: helperOptions.cwd ?? null,
+      shell: helperOptions.shell ?? null,
+      detached: helperOptions.detached ?? null,
+      envDigest: helperEnvDigest,
+      stdio: windowsStdioDigestContract(helperStdio),
+    },
+    postSpawn: normalizedPostSpawn,
+  };
+  return Object.freeze({
+    executionContract,
+    originalCommand: command,
+    originalArgs,
+    originalCwd: spawnOpts?.cwd ?? null,
+    originalShell: spawnOpts?.shell ?? null,
+    originalDetached: spawnOpts?.detached ?? null,
+    profile,
+    requiredBoundaries: Object.freeze([...requiredBoundaries]),
+    sync,
+    backend,
+    policyAttested,
+    policyDigest,
+    helperCommand: helperInvocation.command,
+    helperArgs,
+    helperCwd: helperOptions.cwd ?? null,
+    helperShell: helperOptions.shell ?? null,
+    helperDetached: helperOptions.detached ?? null,
+    helperEnvDigest,
+    helperStdio,
+    postSpawn: normalizedPostSpawn,
+    postSpawnWindows: postSpawnWindows || null,
+    planBindingDigest: sha256(JSON.stringify(digestPayload)),
+  });
+}
+
+/**
+ * Consume the one-launch capability attached to a real built-in Windows MCP
+ * code-snapshot plan. The issuer stays module-private so an injected adapter
+ * cannot make a structurally similar helper payload authoritative.
+ */
+export function consumeWindowsMcpCodeSnapshotPlanBinding(plan, expected = {}) {
+  const issued = issuedWindowsMcpCodeSnapshotPlans.get(plan);
+  if (!issued) return false;
+  issuedWindowsMcpCodeSnapshotPlans.delete(plan);
+  return (
+    issued.executionContract === expected.executionContract &&
+    issued.originalCommand === expected.command &&
+    sameStringArray(issued.originalArgs, expected.args) &&
+    issued.originalCwd === (expected.cwd ?? null) &&
+    issued.originalShell === (expected.shell ?? null) &&
+    issued.originalDetached === (expected.detached ?? null) &&
+    issued.profile === expected.profile &&
+    sameStringArray(issued.requiredBoundaries, expected.requiredBoundaries) &&
+    issued.sync === (expected.sync === true) &&
+    plan.backend === issued.backend &&
+    plan.policyAttested === issued.policyAttested &&
+    plan.policyDigest === issued.policyDigest &&
+    plan.command === issued.helperCommand &&
+    sameStringArray(plan.args, issued.helperArgs) &&
+    plan.options?.cwd === issued.helperCwd &&
+    plan.options?.shell === issued.helperShell &&
+    plan.options?.detached === issued.helperDetached &&
+    windowsEnvironmentDigest(plan.options?.env) === issued.helperEnvDigest &&
+    sameWindowsStdio(issued.helperStdio, plan.options?.stdio) &&
+    plan.postSpawn?.required === issued.postSpawn.required &&
+    plan.postSpawn?.mode === issued.postSpawn.mode &&
+    (plan.postSpawnWindows || null) === issued.postSpawnWindows &&
+    plan.runtimeProbe?.planBindingMechanism ===
+      "windows-mcp-code-snapshot-plan-binding-v1" &&
+    plan.runtimeProbe?.planBindingDigest === issued.planBindingDigest
+  );
+}
+
 function windowsFileIdentity(stat) {
   const timestamp = (nanosecondsKey, millisecondsKey) => {
     if (stat[nanosecondsKey] !== undefined) {
@@ -2077,6 +2458,7 @@ export function applyWindowsSandbox(
   spawnOpts,
   sandboxOpts = {},
   runtimeOverrides = {},
+  planBindingAuthority = null,
 ) {
   let runtime = resolveRuntime(runtimeOverrides);
   const requiredBoundaries = Array.isArray(sandboxOpts.requiredBoundaries)
@@ -2097,6 +2479,10 @@ export function applyWindowsSandbox(
     SANDBOX_BOUNDARIES.RESOURCE_LIMITS,
     SANDBOX_BOUNDARIES.PRIVILEGE_REDUCTION,
   ];
+  const appContainerSupportedBoundaries = [
+    ...appContainerGuarantees,
+    SANDBOX_BOUNDARIES.CODE_SNAPSHOT,
+  ];
   const base = {
     platform: runtime.platform,
     profile: sandboxOpts.profileName || "default",
@@ -2143,7 +2529,7 @@ export function applyWindowsSandbox(
   if (
     requiresAppContainer &&
     requiredBoundaries.some(
-      (boundary) => !appContainerGuarantees.includes(boundary),
+      (boundary) => !appContainerSupportedBoundaries.includes(boundary),
     )
   ) {
     return unavailablePlan("windows_appcontainer_boundary_unsupported");
@@ -2503,10 +2889,14 @@ export function applyWindowsSandbox(
     detached: false,
     shell: false,
     cwd: helperWorkingDirectory,
-    env: hostEnvironment,
+    env: Object.freeze({ ...hostEnvironment }),
+    stdio: Array.isArray(invocation.options.stdio)
+      ? Object.freeze([...invocation.options.stdio])
+      : invocation.options.stdio,
   };
   let appContainerCleanupVerified = false;
   let appContainerCleanupRecord = null;
+  let issuedWindowsMcpPlan = null;
   const cleanupAppContainer = () => {
     if (!appContainer || appContainerCleanupVerified) return true;
     if (appContainerCleanupRecord) {
@@ -2544,6 +2934,10 @@ export function applyWindowsSandbox(
     return false;
   };
   const cleanup = () => {
+    if (issuedWindowsMcpPlan) {
+      issuedWindowsMcpCodeSnapshotPlans.delete(issuedWindowsMcpPlan);
+      issuedWindowsMcpPlan = null;
+    }
     const failures = [];
     const attempt = (label, action) => {
       try {
@@ -2604,6 +2998,28 @@ export function applyWindowsSandbox(
         },
       }
     : {};
+  const windowsMcpPlanBinding =
+    entrySnapshot.locks &&
+    sandboxOpts.executionContract?.kind ===
+      MCP_STDIO_CAPSULE_SANDBOX_CONTRACT_KIND
+      ? createWindowsMcpCodeSnapshotPlanBinding({
+          executionContract: sandboxOpts.executionContract,
+          command,
+          args,
+          spawnOpts,
+          profile,
+          requiredBoundaries,
+          sync: sandboxOpts.sync === true,
+          backend,
+          policyAttested: requiresAppContainer ? true : null,
+          policyDigest: appContainerPolicyDigest,
+          adapterSource,
+          helperInvocation,
+          helperOptions: options,
+          postSpawn: identityContract.postSpawn,
+          postSpawnWindows: identityContract.postSpawnWindows,
+        })
+      : null;
   const entrySnapshotRuntimeProbe = entrySnapshot.locks
     ? {
         ...(appContainerRuntimeProbe || nodeSnapshotRuntimeProbe),
@@ -2636,11 +3052,13 @@ export function applyWindowsSandbox(
               runtimeLaunchMechanism:
                 "filter-oplock-locked-createprocess-suspended-image-v1",
               sharedLibraryClosure: false,
+              planBindingMechanism: "windows-mcp-code-snapshot-plan-binding-v1",
+              planBindingDigest: windowsMcpPlanBinding.planBindingDigest,
             }
           : {}),
       }
     : appContainerRuntimeProbe;
-  return createSandboxPlan({
+  const plan = createSandboxPlan({
     ...base,
     applied: true,
     enforcement: backend,
@@ -2667,6 +3085,14 @@ export function applyWindowsSandbox(
     ...identityContract,
     cleanup,
   });
+  if (
+    windowsMcpPlanBinding &&
+    planBindingAuthority === WINDOWS_MCP_CODE_SNAPSHOT_ISSUER
+  ) {
+    issuedWindowsMcpPlan = plan;
+    issuedWindowsMcpCodeSnapshotPlans.set(plan, windowsMcpPlanBinding);
+  }
+  return plan;
 }
 
 /**
@@ -3829,7 +4255,6 @@ function applyLinuxMcpCapsuleCodeSnapshot(
   ]);
   const descriptors = [runtimeSnapshot.finalMount, entrySnapshot.finalMount];
   const runtimeFd = 3;
-  const entryFd = 4;
   const snapshotIdentity = Object.freeze({
     runtimeSnapshotSha256: runtimeSnapshot.attestation.sha256,
     runtimeSnapshotBytes: runtimeSnapshot.attestation.bytes,
@@ -3846,6 +4271,8 @@ function applyLinuxMcpCapsuleCodeSnapshot(
       ].sort(),
       identity: snapshotIdentity,
       cwd: invocation.options.cwd,
+      entrySnapshotBootstrapSha256: MCP_STDIO_FD_ENTRY_BOOTSTRAP_SHA256,
+      runtimeLaunchMechanism: "inherited-executable-fd-v1",
       passthroughArgsDigest: sha256(JSON.stringify(invocation.args.slice(1))),
     }),
   );
@@ -3874,13 +4301,22 @@ function applyLinuxMcpCapsuleCodeSnapshot(
       contentSnapshotScope: "mcp-capsule-entry-and-node-runtime",
       contentSnapshotMechanism: LINUX_MCP_CAPSULE_SNAPSHOT_MECHANISM,
       handleAtomic: true,
+      entrySnapshotAtomic: true,
+      runtimeLaunchAtomic: true,
+      runtimeLaunchMechanism: "inherited-executable-fd-v1",
+      entrySnapshotBootstrapSha256: MCP_STDIO_FD_ENTRY_BOOTSTRAP_SHA256,
       sharedLibraryClosure: false,
       ...snapshotIdentity,
     },
     reason: null,
     guarantees: [SANDBOX_BOUNDARIES.CODE_SNAPSHOT],
     command: `/proc/self/fd/${runtimeFd}`,
-    args: [`/proc/self/fd/${entryFd}`, ...invocation.args.slice(1)],
+    args: [
+      "-e",
+      MCP_STDIO_FD_ENTRY_BOOTSTRAP,
+      "--",
+      ...invocation.args.slice(1),
+    ],
     options: {
       ...invocation.options,
       shell: false,
@@ -5707,7 +6143,10 @@ export function applyLinuxSandbox(
       boundary === SANDBOX_BOUNDARIES.PROCESS_TREE,
   );
 
-  if (requiredBoundaries.includes(SANDBOX_BOUNDARIES.CODE_SNAPSHOT)) {
+  if (
+    requiredBoundaries.includes(SANDBOX_BOUNDARIES.CODE_SNAPSHOT) &&
+    !requiresStrongLinuxBoundary
+  ) {
     return applyLinuxMcpCapsuleCodeSnapshot(
       command,
       args,
@@ -6369,17 +6808,36 @@ export function applyLinuxSandbox(
     const supervisorBinding = supervisorPin.attestation;
     closeLinuxPinnedMounts(runtime, [supervisorPin]);
     supervisorPin = null;
+    const capsuleContract =
+      validation.contract.kind === MCP_STDIO_CAPSULE_SANDBOX_CONTRACT_KIND;
+    const baseRuntimeProbe = linuxBubblewrapProbe(
+      true,
+      true,
+      null,
+      validation.entryRuntime,
+      entrySnapshot?.attestation,
+      supervisorBinding,
+      pluginTreeSnapshot,
+      nativeDynamicClosure,
+    );
     const runtimeProbe = Object.freeze(
-      linuxBubblewrapProbe(
-        true,
-        true,
-        null,
-        validation.entryRuntime,
-        entrySnapshot?.attestation,
-        supervisorBinding,
-        pluginTreeSnapshot,
-        nativeDynamicClosure,
-      ),
+      capsuleContract
+        ? {
+            ...baseRuntimeProbe,
+            mcpCapsuleCodeSnapshot: true,
+            entrySnapshotAtomic: true,
+            runtimeLaunchAtomic: true,
+            runtimeLaunchMechanism:
+              "bwrap-descriptor-mount-node-runtime-exec-v1",
+            sharedLibraryClosure: false,
+            runtimeSnapshotSha256: validation.contract.runtimeIdentity.sha256,
+            runtimeSnapshotBytes: validation.contract.runtimeIdentity.bytes,
+            entrySnapshotSha256: entrySnapshot.attestation.sha256,
+            entrySnapshotBytes: entrySnapshot.attestation.bytes,
+            runtimeLaunchPath: "/opt/chainless/runtime/node",
+            entrySnapshotPath: sandboxEntry,
+          }
+        : baseRuntimeProbe,
     );
     const options = {
       ...spawnOpts,
@@ -6417,6 +6875,7 @@ export function applyLinuxSandbox(
         SANDBOX_BOUNDARIES.FILESYSTEM,
         SANDBOX_BOUNDARIES.NETWORK,
         SANDBOX_BOUNDARIES.PROCESS_TREE,
+        ...(capsuleContract ? [SANDBOX_BOUNDARIES.CODE_SNAPSHOT] : []),
       ],
       command: finalLaunch.command,
       args: [...policyArgs, "--", ...targetArgs],
@@ -6492,9 +6951,10 @@ export function applySandbox(
   args,
   spawnOpts,
   profileOrRequest = "default",
-  runtimeOverrides = {},
+  runtimeOverrides = undefined,
   explicitRequest = null,
 ) {
+  const runtimeInjected = runtimeOverrides !== undefined;
   const runtime = resolveRuntime(runtimeOverrides);
   const sandboxRequest = normalizeSandboxRequest(
     profileOrRequest,
@@ -6558,6 +7018,7 @@ export function applySandbox(
       spawnOpts,
       profile,
       runtimeOverrides,
+      runtimeInjected ? null : WINDOWS_MCP_CODE_SNAPSHOT_ISSUER,
     );
   }
   if (runtime.platform === "linux") {

package/src/lib/process-execution-broker/windows-sandbox.cs

@@ -3540,10 +3540,11 @@ namespace ChainlessChain.WindowsSandbox
                     ThrowLastError("AssignProcessToJobObject");
                 }
                 ReattestLaunchPaths(launchPathLocks);
-                // The suspended process has already created its image section.
-                // Release all remaining runtime stream guards before resume so
-                // target code can never deadlock waiting for a break owned by
-                // the helper. This is not a pathname-atomic runtime launch.
+                // The suspended process has already created its image section
+                // while the attested pathname remained protected by its Filter
+                // oplock. Reattestation above completes the pathname-to-image
+                // atomic handoff; release the stream guards before resume so
+                // target code cannot deadlock on a break owned by the helper.
                 ReleaseLaunchPathLocks(launchPathLocks);
                 if (ResumeThread(processInfo.hThread) == UInt32.MaxValue)
                 {