chainlesschain 0.163.1 → 0.163.3

package/src/lib/process-execution-broker/index.js

@@ -36,7 +36,9 @@ const require = createRequire(import.meta.url);
 // platform-sandbox.js exports: applySandbox, postSpawnSandbox
 import {
   applySandbox as _applySandbox,
+  consumeWindowsMcpCodeSnapshotPlanBinding,
   postSpawnSandbox as _postSpawnSandbox,
+  MCP_STDIO_FD_ENTRY_BOOTSTRAP_SHA256,
   SANDBOX_BOUNDARIES,
 } from "./platform-sandbox.js";
 import {
@@ -60,6 +62,9 @@ const SUPPORTED_SANDBOX_PROFILES = new Set([
   "strict",
   "network-only",
 ]);
+// Broker-private admission state. Public runtime-probe fields are audit
+// evidence, not authority to invoke a privileged post-spawn closure.
+const admittedWindowsMcpCodeSnapshotPlans = new WeakSet();
 
 // 延迟导入避免循环依赖
 let _traceCtx = null;
@@ -1065,7 +1070,7 @@ class ProcessExecutionBroker extends EventEmitter {
     return error;
   }
 
-  _validateSandboxPlan(plan) {
+  _validateSandboxPlan(plan, launchContext = {}) {
     if (!plan || typeof plan !== "object") {
       throw this._sandboxError(
         "invalid_sandbox_plan",
@@ -1159,6 +1164,7 @@ class ProcessExecutionBroker extends EventEmitter {
     let sanitizedNetworkPolicy = null;
     let sanitizedProcessTreePolicy = null;
     let sanitizedPtyPolicy = null;
+    let windowsPlanBindingConsumed = false;
     if (plan.runtimeProbe !== null && plan.runtimeProbe !== undefined) {
       if (
         typeof plan.runtimeProbe !== "object" ||
@@ -1180,6 +1186,9 @@ class ProcessExecutionBroker extends EventEmitter {
         "contentSnapshotScope",
         "contentSnapshotMechanism",
         "runtimeLaunchMechanism",
+        "planBindingMechanism",
+        "runtimeLaunchPath",
+        "entrySnapshotPath",
         "pluginTreeContentSnapshotScope",
         "pluginTreeContentSnapshotMechanism",
         "pluginTreeSnapshotConsistency",
@@ -1208,6 +1217,7 @@ class ProcessExecutionBroker extends EventEmitter {
         "sharedLibraryClosure",
         "entrySnapshotAtomic",
         "runtimeLaunchAtomic",
+        "mcpCapsuleCodeSnapshot",
       ]) {
         if (
           plan.runtimeProbe[field] !== undefined &&
@@ -1243,6 +1253,7 @@ class ProcessExecutionBroker extends EventEmitter {
         "runtimeSnapshotSha256",
         "runtimeAttestedSha256",
         "entrySnapshotSha256",
+        "planBindingDigest",
       ]) {
         if (
           plan.runtimeProbe[field] !== undefined &&
@@ -1255,6 +1266,22 @@ class ProcessExecutionBroker extends EventEmitter {
           );
         }
       }
+      const planBindingDeclared =
+        plan.runtimeProbe.planBindingMechanism !== undefined ||
+        plan.runtimeProbe.planBindingDigest !== undefined;
+      if (
+        planBindingDeclared &&
+        (plan.platform !== "win32" ||
+          !guarantees.includes(SANDBOX_BOUNDARIES.CODE_SNAPSHOT) ||
+          plan.runtimeProbe.planBindingMechanism !==
+            "windows-mcp-code-snapshot-plan-binding-v1" ||
+          !/^[a-f0-9]{64}$/.test(plan.runtimeProbe.planBindingDigest || ""))
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Sandbox runtime probe plan binding must use the typed Windows MCP code-snapshot contract",
+        );
+      }
       if (
         plan.runtimeProbe.pluginTreeContentSnapshotDigest !== undefined &&
         (typeof plan.runtimeProbe.pluginTreeContentSnapshotDigest !==
@@ -1293,6 +1320,20 @@ class ProcessExecutionBroker extends EventEmitter {
         "pluginTreeSnapshotContractBound",
         "pluginTreeSnapshotAtomic",
       ];
+      const nodePluginTreeSnapshotEvidence =
+        plan.runtimeProbe.kind === "linux-bwrap-plugin-node-policy-v1" &&
+        plan.runtimeProbe.targetRuntime === "node" &&
+        plan.runtimeProbe.contentSnapshotScope === "plugin-entry-source";
+      const nativePluginRuntimeEvidence =
+        (plan.runtimeProbe.kind ===
+          "linux-bwrap-plugin-native-static-elf-policy-v1" &&
+          plan.runtimeProbe.targetRuntime === "native-static-elf") ||
+        (plan.runtimeProbe.kind ===
+          "linux-bwrap-plugin-native-dynamic-elf-policy-v1" &&
+          plan.runtimeProbe.targetRuntime === "native-dynamic-elf");
+      const nativePluginTreeSnapshotEvidence =
+        nativePluginRuntimeEvidence &&
+        plan.runtimeProbe.contentSnapshotScope === "plugin-entry-executable";
       if (
         pluginTreeSnapshot &&
         (plan.applied !== true ||
@@ -1307,11 +1348,10 @@ class ProcessExecutionBroker extends EventEmitter {
           plan.runtimeProbe.attempted !== true ||
           plan.runtimeProbe.runnable !== true ||
           plan.runtimeProbe.reason !== null ||
-          plan.runtimeProbe.kind !== "linux-bwrap-plugin-node-policy-v1" ||
+          (!nodePluginTreeSnapshotEvidence &&
+            !nativePluginTreeSnapshotEvidence) ||
           plan.runtimeProbe.probeRuntime !== "node" ||
-          plan.runtimeProbe.targetRuntime !== "node" ||
           plan.runtimeProbe.contentSnapshot !== true ||
-          plan.runtimeProbe.contentSnapshotScope !== "plugin-entry-source" ||
           plan.runtimeProbe.contentSnapshotMechanism !==
             "verified-o_tmpfile-copy-bwrap-ro-bind-data-v1" ||
           plan.runtimeProbe.handleAtomic !== false ||
@@ -1355,6 +1395,18 @@ class ProcessExecutionBroker extends EventEmitter {
           "Sandbox runtime probe plugin tree snapshot evidence requires pluginTreeContentSnapshot",
         );
       }
+      const successfulNativeProbe =
+        plan.applied === true &&
+        plan.runtimeProbe.attempted === true &&
+        plan.runtimeProbe.runnable === true &&
+        plan.runtimeProbe.reason === null &&
+        nativePluginRuntimeEvidence;
+      if (successfulNativeProbe && !pluginTreeSnapshot) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Successful Linux native plugin evidence requires a complete plugin tree snapshot",
+        );
+      }
       const supervisorStringFields = [
         "supervisorBindingScope",
         "supervisorDescriptorBindingMechanism",
@@ -1560,15 +1612,97 @@ class ProcessExecutionBroker extends EventEmitter {
         SANDBOX_BOUNDARIES.CODE_SNAPSHOT,
       );
       if (codeSnapshotGuaranteed) {
+        const executionContract = launchContext.executionContract;
+        const launchArgs = Array.isArray(launchContext.args)
+          ? launchContext.args
+          : [];
+        const windowsPlanBindingDeclared =
+          plan.platform === "win32" &&
+          (plan.runtimeProbe.planBindingMechanism !== undefined ||
+            plan.runtimeProbe.planBindingDigest !== undefined);
+        // Consume before evaluating any other Windows evidence. A genuine
+        // one-launch plan is therefore burned by its first admission attempt,
+        // including an attempt with a mismatched command or contract.
+        windowsPlanBindingConsumed = windowsPlanBindingDeclared
+          ? consumeWindowsMcpCodeSnapshotPlanBinding(plan, {
+              command: launchContext.command,
+              args: launchArgs,
+              cwd: launchContext.cwd,
+              shell: launchContext.shell,
+              detached: launchContext.detached,
+              executionContract,
+              profile: launchContext.profile,
+              requiredBoundaries: launchContext.requiredBoundaries,
+              sync: launchContext.sync,
+            })
+          : false;
+        const passthroughArgsMatch = (candidateArgs) =>
+          candidateArgs.length === Math.max(0, launchArgs.length - 1) &&
+          candidateArgs.every(
+            (candidateArg, index) => candidateArg === launchArgs[index + 1],
+          );
+        const contractBoundSnapshotEvidence =
+          executionContract?.contractVersion === 1 &&
+          executionContract.kind === MCP_STDIO_CAPSULE_SANDBOX_CONTRACT_KIND &&
+          typeof launchContext.command === "string" &&
+          launchContext.command === executionContract.runtimePath &&
+          launchContext.command ===
+            executionContract.runtimeIdentity?.realPath &&
+          launchArgs.length >= 1 &&
+          launchArgs[0] === executionContract.entryIdentity?.realPath &&
+          /^[a-f0-9]{64}$/.test(
+            executionContract.runtimeIdentity?.sha256 || "",
+          ) &&
+          Number.isSafeInteger(executionContract.runtimeIdentity?.bytes) &&
+          executionContract.runtimeIdentity.bytes > 0 &&
+          /^[a-f0-9]{64}$/.test(
+            executionContract.entryIdentity?.sha256 || "",
+          ) &&
+          Number.isSafeInteger(executionContract.entryIdentity?.bytes) &&
+          executionContract.entryIdentity.bytes >= 0 &&
+          plan.runtimeProbe.entrySnapshotSha256 ===
+            executionContract.entryIdentity.sha256 &&
+          plan.runtimeProbe.entrySnapshotBytes ===
+            executionContract.entryIdentity.bytes;
+        const linuxRuntimeSnapshotContractBound =
+          plan.runtimeProbe.runtimeSnapshotSha256 ===
+            executionContract?.runtimeIdentity?.sha256 &&
+          plan.runtimeProbe.runtimeSnapshotBytes ===
+            executionContract?.runtimeIdentity?.bytes &&
+          plan.runtimeProbe.runtimeAttestedSha256 === undefined &&
+          plan.runtimeProbe.runtimeAttestedBytes === undefined;
+        const windowsRuntimeAttestationContractBound =
+          plan.runtimeProbe.runtimeAttestedSha256 ===
+            executionContract?.runtimeIdentity?.sha256 &&
+          plan.runtimeProbe.runtimeAttestedBytes ===
+            executionContract?.runtimeIdentity?.bytes &&
+          plan.runtimeProbe.runtimeSnapshotSha256 === undefined &&
+          plan.runtimeProbe.runtimeSnapshotBytes === undefined;
+        const contractEntryRelative = executionContract
+          ? path.posix.relative(
+              executionContract.pluginRoot,
+              executionContract.entryIdentity.realPath,
+            )
+          : null;
+        const expectedLinuxBubblewrapEntry =
+          contractEntryRelative &&
+          contractEntryRelative !== ".." &&
+          !contractEntryRelative.startsWith("../") &&
+          !path.posix.isAbsolute(contractEntryRelative)
+            ? path.posix.join("/opt/chainless/plugin", contractEntryRelative)
+            : null;
         const exactSnapshotEvidence =
           plan.applied === true &&
           candidateBackend === null &&
+          contractBoundSnapshotEvidence &&
           plan.runtimeProbe.attempted === true &&
           plan.runtimeProbe.runnable === true &&
           plan.runtimeProbe.reason === null &&
           plan.runtimeProbe.probeRuntime === "node" &&
           plan.runtimeProbe.targetRuntime === "node" &&
           plan.runtimeProbe.contentSnapshot === true &&
+          plan.runtimeProbe.entrySnapshotAtomic === true &&
+          plan.runtimeProbe.runtimeLaunchAtomic === true &&
           plan.runtimeProbe.sharedLibraryClosure === false &&
           /^[a-f0-9]{64}$/.test(plan.runtimeProbe.entrySnapshotSha256 || "") &&
           Number.isSafeInteger(plan.runtimeProbe.entrySnapshotBytes) &&
@@ -1584,8 +1718,54 @@ class ProcessExecutionBroker extends EventEmitter {
           plan.runtimeProbe.contentSnapshotScope ===
             "mcp-capsule-entry-and-node-runtime" &&
           plan.runtimeProbe.contentSnapshotMechanism ===
-            "verified-o_tmpfile-copy-inherited-fd-exec-v1" &&
+            "verified-o_tmpfile-copy-inherited-fd-module-compile-v1" &&
           plan.runtimeProbe.handleAtomic === true &&
+          plan.runtimeProbe.entrySnapshotAtomic === true &&
+          plan.runtimeProbe.runtimeLaunchAtomic === true &&
+          plan.runtimeProbe.runtimeLaunchMechanism ===
+            "inherited-executable-fd-v1" &&
+          plan.runtimeProbe.entrySnapshotBootstrapSha256 ===
+            MCP_STDIO_FD_ENTRY_BOOTSTRAP_SHA256 &&
+          linuxRuntimeSnapshotContractBound &&
+          /^[a-f0-9]{64}$/.test(
+            plan.runtimeProbe.runtimeSnapshotSha256 || "",
+          ) &&
+          Number.isSafeInteger(plan.runtimeProbe.runtimeSnapshotBytes) &&
+          plan.runtimeProbe.runtimeSnapshotBytes > 0 &&
+          plan.runtimeProbe.runtimeSnapshotBytes <= 256 * 1024 * 1024 &&
+          /^\/proc\/self\/fd\/\d+$/.test(plan.command) &&
+          plan.args[0] === "-e" &&
+          crypto
+            .createHash("sha256")
+            .update(plan.args[1] || "")
+            .digest("hex") === MCP_STDIO_FD_ENTRY_BOOTSTRAP_SHA256 &&
+          plan.args[2] === "--" &&
+          passthroughArgsMatch(plan.args.slice(3));
+        const linuxBubblewrapTargetSeparator = plan.args.indexOf("--");
+        const linuxBubblewrapSnapshotEvidence =
+          plan.platform === "linux" &&
+          backend === "linux-bwrap" &&
+          plan.enforcement === "linux-bwrap" &&
+          policyAttested === true &&
+          policyDigest !== null &&
+          plan.runtimeProbe.kind === "linux-bwrap-plugin-node-policy-v1" &&
+          plan.runtimeProbe.mcpCapsuleCodeSnapshot === true &&
+          plan.runtimeProbe.contentSnapshotScope === "plugin-entry-source" &&
+          plan.runtimeProbe.contentSnapshotMechanism ===
+            "verified-o_tmpfile-copy-bwrap-ro-bind-data-v1" &&
+          plan.runtimeProbe.handleAtomic === false &&
+          plan.runtimeProbe.entrySnapshotAtomic === true &&
+          plan.runtimeProbe.runtimeLaunchAtomic === true &&
+          plan.runtimeProbe.runtimeLaunchMechanism ===
+            "bwrap-descriptor-mount-node-runtime-exec-v1" &&
+          plan.runtimeProbe.supervisorDescriptorBound === true &&
+          plan.runtimeProbe.pluginTreeContentSnapshot === true &&
+          plan.runtimeProbe.runtimeLaunchPath ===
+            "/opt/chainless/runtime/node" &&
+          expectedLinuxBubblewrapEntry !== null &&
+          plan.runtimeProbe.entrySnapshotPath ===
+            expectedLinuxBubblewrapEntry &&
+          linuxRuntimeSnapshotContractBound &&
           /^[a-f0-9]{64}$/.test(
             plan.runtimeProbe.runtimeSnapshotSha256 || "",
           ) &&
@@ -1593,7 +1773,14 @@ class ProcessExecutionBroker extends EventEmitter {
           plan.runtimeProbe.runtimeSnapshotBytes > 0 &&
           plan.runtimeProbe.runtimeSnapshotBytes <= 256 * 1024 * 1024 &&
           /^\/proc\/self\/fd\/\d+$/.test(plan.command) &&
-          /^\/proc\/self\/fd\/\d+$/.test(plan.args[0] || "");
+          linuxBubblewrapTargetSeparator >= 0 &&
+          plan.args[linuxBubblewrapTargetSeparator + 1] ===
+            plan.runtimeProbe.runtimeLaunchPath &&
+          plan.args[linuxBubblewrapTargetSeparator + 2] ===
+            plan.runtimeProbe.entrySnapshotPath &&
+          passthroughArgsMatch(
+            plan.args.slice(linuxBubblewrapTargetSeparator + 3),
+          );
         const windowsSnapshotEvidence =
           plan.platform === "win32" &&
           [
@@ -1601,10 +1788,14 @@ class ProcessExecutionBroker extends EventEmitter {
             "windows-appcontainer-job-restricted-token",
           ].includes(backend) &&
           plan.enforcement === backend &&
-          [
-            "windows-plugin-node-entry-snapshot-v1",
-            "windows-appcontainer-launch-attestation-v1",
-          ].includes(plan.runtimeProbe.kind) &&
+          ((backend === "windows-job-restricted-token" &&
+            plan.runtimeProbe.kind ===
+              "windows-plugin-node-entry-snapshot-v1") ||
+            (backend === "windows-appcontainer-job-restricted-token" &&
+              plan.runtimeProbe.kind ===
+                "windows-appcontainer-launch-attestation-v1" &&
+              policyAttested === true &&
+              policyDigest !== null)) &&
           plan.runtimeProbe.contentSnapshotScope ===
             "mcp-capsule-entry-source" &&
           plan.runtimeProbe.contentSnapshotMechanism ===
@@ -1614,15 +1805,23 @@ class ProcessExecutionBroker extends EventEmitter {
           plan.runtimeProbe.runtimeLaunchAtomic === true &&
           plan.runtimeProbe.runtimeLaunchMechanism ===
             "filter-oplock-locked-createprocess-suspended-image-v1" &&
+          plan.runtimeProbe.planBindingMechanism ===
+            "windows-mcp-code-snapshot-plan-binding-v1" &&
+          /^[a-f0-9]{64}$/.test(plan.runtimeProbe.planBindingDigest || "") &&
+          windowsRuntimeAttestationContractBound &&
           /^[a-f0-9]{64}$/.test(
             plan.runtimeProbe.runtimeAttestedSha256 || "",
           ) &&
           Number.isSafeInteger(plan.runtimeProbe.runtimeAttestedBytes) &&
           plan.runtimeProbe.runtimeAttestedBytes > 0 &&
-          plan.runtimeProbe.runtimeAttestedBytes <= 256 * 1024 * 1024;
+          plan.runtimeProbe.runtimeAttestedBytes <= 256 * 1024 * 1024 &&
+          launchContext.builtInSandboxAdapter === true &&
+          windowsPlanBindingConsumed;
         if (
           !exactSnapshotEvidence ||
-          (!linuxSnapshotEvidence && !windowsSnapshotEvidence)
+          (!linuxSnapshotEvidence &&
+            !linuxBubblewrapSnapshotEvidence &&
+            !windowsSnapshotEvidence)
         ) {
           throw this._sandboxError(
             "invalid_sandbox_plan",
@@ -1910,6 +2109,22 @@ class ProcessExecutionBroker extends EventEmitter {
         ...(plan.runtimeProbe.handleAtomic !== undefined
           ? { handleAtomic: plan.runtimeProbe.handleAtomic }
           : {}),
+        ...(plan.runtimeProbe.entrySnapshotAtomic !== undefined
+          ? { entrySnapshotAtomic: plan.runtimeProbe.entrySnapshotAtomic }
+          : {}),
+        ...(plan.runtimeProbe.runtimeLaunchAtomic !== undefined
+          ? { runtimeLaunchAtomic: plan.runtimeProbe.runtimeLaunchAtomic }
+          : {}),
+        ...(plan.runtimeProbe.runtimeLaunchMechanism !== undefined
+          ? {
+              runtimeLaunchMechanism: plan.runtimeProbe.runtimeLaunchMechanism,
+            }
+          : {}),
+        ...(plan.runtimeProbe.sharedLibraryClosure !== undefined
+          ? {
+              sharedLibraryClosure: plan.runtimeProbe.sharedLibraryClosure,
+            }
+          : {}),
         ...(plan.runtimeProbe.contentSnapshotScope !== undefined
           ? {
               contentSnapshotScope: plan.runtimeProbe.contentSnapshotScope,
@@ -1921,12 +2136,35 @@ class ProcessExecutionBroker extends EventEmitter {
                 plan.runtimeProbe.contentSnapshotMechanism,
             }
           : {}),
+        ...(plan.runtimeProbe.planBindingMechanism !== undefined
+          ? {
+              planBindingMechanism: plan.runtimeProbe.planBindingMechanism,
+              planBindingDigest: plan.runtimeProbe.planBindingDigest,
+            }
+          : {}),
         ...(plan.runtimeProbe.runtimeSnapshotSha256 !== undefined
           ? {
               runtimeSnapshotSha256: plan.runtimeProbe.runtimeSnapshotSha256,
               runtimeSnapshotBytes: plan.runtimeProbe.runtimeSnapshotBytes,
               entrySnapshotSha256: plan.runtimeProbe.entrySnapshotSha256,
               entrySnapshotBytes: plan.runtimeProbe.entrySnapshotBytes,
+              entrySnapshotAtomic: plan.runtimeProbe.entrySnapshotAtomic,
+              runtimeLaunchAtomic: plan.runtimeProbe.runtimeLaunchAtomic,
+              runtimeLaunchMechanism: plan.runtimeProbe.runtimeLaunchMechanism,
+              ...(plan.runtimeProbe.runtimeLaunchPath !== undefined
+                ? { runtimeLaunchPath: plan.runtimeProbe.runtimeLaunchPath }
+                : {}),
+              ...(plan.runtimeProbe.entrySnapshotPath !== undefined
+                ? { entrySnapshotPath: plan.runtimeProbe.entrySnapshotPath }
+                : {}),
+              ...(plan.runtimeProbe.mcpCapsuleCodeSnapshot !== undefined
+                ? {
+                    mcpCapsuleCodeSnapshot:
+                      plan.runtimeProbe.mcpCapsuleCodeSnapshot,
+                  }
+                : {}),
+              entrySnapshotBootstrapSha256:
+                plan.runtimeProbe.entrySnapshotBootstrapSha256,
               sharedLibraryClosure: plan.runtimeProbe.sharedLibraryClosure,
             }
           : {}),
@@ -1988,6 +2226,15 @@ class ProcessExecutionBroker extends EventEmitter {
         };
       }
     }
+    if (
+      guarantees.includes(SANDBOX_BOUNDARIES.CODE_SNAPSHOT) &&
+      runtimeProbe === null
+    ) {
+      throw this._sandboxError(
+        "invalid_sandbox_plan",
+        "Code snapshot guarantee requires typed atomic MCP capsule evidence",
+      );
+    }
     if (backend === "linux-bwrap-workspace" && !genericWorkspaceProbe) {
       throw this._sandboxError(
         "invalid_sandbox_plan",
@@ -2005,7 +2252,7 @@ class ProcessExecutionBroker extends EventEmitter {
         "Required post-spawn enforcement must declare sync or async mode",
       );
     }
-    return {
+    const validatedPlan = {
       ...plan,
       args: [...plan.args],
       options: { ...plan.options },
@@ -2025,6 +2272,15 @@ class ProcessExecutionBroker extends EventEmitter {
         : {}),
       postSpawn: { ...postSpawn },
     };
+    if (windowsPlanBindingConsumed) {
+      const upstreamCleanup = validatedPlan.cleanup;
+      validatedPlan.cleanup = (...args) => {
+        admittedWindowsMcpCodeSnapshotPlans.delete(validatedPlan);
+        return upstreamCleanup?.(...args);
+      };
+      admittedWindowsMcpCodeSnapshotPlans.add(validatedPlan);
+    }
+    return validatedPlan;
   }
 
   _assertRequiredSandboxBoundaries(plan, requiredBoundaries) {
@@ -2059,10 +2315,20 @@ class ProcessExecutionBroker extends EventEmitter {
         },
       );
     }
-    return {
+    const assertedPlan = {
       ...plan,
       requiredBoundaries: [...requiredBoundaries],
     };
+    if (admittedWindowsMcpCodeSnapshotPlans.has(plan)) {
+      admittedWindowsMcpCodeSnapshotPlans.delete(plan);
+      const upstreamCleanup = assertedPlan.cleanup;
+      assertedPlan.cleanup = (...args) => {
+        admittedWindowsMcpCodeSnapshotPlans.delete(assertedPlan);
+        return upstreamCleanup?.(...args);
+      };
+      admittedWindowsMcpCodeSnapshotPlans.add(assertedPlan);
+    }
+    return assertedPlan;
   }
 
   _prepareSandboxPlan(
@@ -2116,17 +2382,44 @@ class ProcessExecutionBroker extends EventEmitter {
     // Keep the legacy string profile in argument four. The built-in adapter
     // reserves argument five for runtime injection, so the typed request is
     // additive in argument six and legacy injected adapters can ignore it.
-    const rawPlan = this._sandboxAdapter.applySandbox(
-      command,
-      args || [],
-      options,
-      profile,
-      undefined,
-      adapterRequest,
-    );
+    const sandboxAdapter = this._sandboxAdapter;
+    const applySandboxAdapter = sandboxAdapter.applySandbox;
+    const builtInSandboxAdapter = applySandboxAdapter === _applySandbox;
+    // Never dispatch the built-in through a mutable Function property or a
+    // global reflective helper after consulting an injected adapter getter.
+    // The lexical import is the identity we checked and the implementation we
+    // invoke. Legacy adapters retain their historical `this` receiver.
+    const rawPlan = builtInSandboxAdapter
+      ? _applySandbox(
+          command,
+          args || [],
+          options,
+          profile,
+          undefined,
+          adapterRequest,
+        )
+      : Reflect.apply(applySandboxAdapter, sandboxAdapter, [
+          command,
+          args || [],
+          options,
+          profile,
+          undefined,
+          adapterRequest,
+        ]);
     let plan;
     try {
-      plan = this._validateSandboxPlan(rawPlan);
+      plan = this._validateSandboxPlan(rawPlan, {
+        command,
+        args: Object.freeze([...(args || [])]),
+        cwd: options.cwd,
+        shell: options.shell,
+        detached: options.detached,
+        executionContract: sandboxPolicy.executionContract || null,
+        profile,
+        requiredBoundaries: Object.freeze([...requiredBoundaries]),
+        sync,
+        builtInSandboxAdapter,
+      });
       plan = this._assertRequiredSandboxBoundaries(plan, requiredBoundaries);
 
       if (!plan.applied && strict) {
@@ -2139,7 +2432,12 @@ class ProcessExecutionBroker extends EventEmitter {
       }
 
       if (plan.applied && plan.postSpawn.required) {
-        if (typeof this._sandboxAdapter.postSpawnSandbox !== "function") {
+        const builtInWindowsMcpPostSpawn =
+          admittedWindowsMcpCodeSnapshotPlans.has(plan);
+        if (
+          !builtInWindowsMcpPostSpawn &&
+          typeof this._sandboxAdapter.postSpawnSandbox !== "function"
+        ) {
           throw this._sandboxError(
             "post_spawn_adapter_unavailable",
             "Required post-spawn sandbox adapter is unavailable",
@@ -2312,12 +2610,6 @@ class ProcessExecutionBroker extends EventEmitter {
   }
 
   _createWorkspaceProcessCloseFence(auditEntry, proc) {
-    if (
-      !Array.isArray(auditEntry.workspaceTransactionIds) ||
-      auditEntry.workspaceTransactionIds.length === 0
-    ) {
-      return null;
-    }
     return new Promise((resolve) => {
       if (typeof proc?.once === "function") {
         proc.once("close", (exitCode, signal) => {
@@ -2339,6 +2631,54 @@ class ProcessExecutionBroker extends EventEmitter {
     });
   }
 
+  _postSpawnOwnershipError(
+    error,
+    { proc, auditEntry, workspaceProcessClosed, cleanup },
+  ) {
+    let failure =
+      error instanceof Error
+        ? error
+        : new Error(String(error || "spawn failed"));
+    if (
+      failure.processTerminationRequested !== true &&
+      failure.workspaceTerminationRequested !== true
+    ) {
+      try {
+        if (typeof proc?.once === "function") proc.once("error", () => {});
+      } catch {
+        // Listener installation failure is itself post-spawn evidence.
+      }
+      try {
+        proc?.kill?.("SIGKILL");
+      } catch {
+        // The close fence remains the only settlement authority.
+      }
+    }
+    try {
+      cleanup?.();
+    } catch {
+      // Ownership evidence must survive cleanup reporting failures.
+    }
+    const attach = (target) => {
+      target.auditEntry = auditEntry;
+      target.spawnedProcess = proc;
+      target.workspaceProcessClosed = workspaceProcessClosed;
+      target.workspaceTerminationRequested = true;
+      return target;
+    };
+    try {
+      return attach(failure);
+    } catch {
+      const wrapped = new Error(failure.message || "post-spawn failure", {
+        cause: failure,
+      });
+      wrapped.name = failure.name || wrapped.name;
+      if (failure.code !== undefined) wrapped.code = failure.code;
+      failure = wrapped;
+      return attach(failure);
+    }
+  }
+
   _runPostSpawnSandbox(proc, plan, auditEntry) {
     if (!plan.applied || !plan.postSpawn.required) {
       this._applySandboxAudit(auditEntry, plan, plan.applied);
@@ -2354,7 +2694,28 @@ class ProcessExecutionBroker extends EventEmitter {
 
     let postSpawnResult;
     try {
-      postSpawnResult = this._sandboxAdapter.postSpawnSandbox(proc, plan);
+      const windowsMcpPlanBindingDeclared =
+        plan.platform === "win32" &&
+        plan.runtimeProbe?.planBindingMechanism ===
+          "windows-mcp-code-snapshot-plan-binding-v1";
+      const builtInWindowsMcpPlan =
+        admittedWindowsMcpCodeSnapshotPlans.has(plan);
+      if (windowsMcpPlanBindingDeclared && !builtInWindowsMcpPlan) {
+        throw this._sandboxError(
+          "windows_mcp_plan_binding_consumed",
+          "Windows MCP sandbox plan binding is unavailable or already consumed",
+        );
+      }
+      if (builtInWindowsMcpPlan) {
+        // Burn the one-launch post-spawn authority before invoking untrusted
+        // process-facing code. Success, failure, cleanup, and reentry all
+        // observe the capability as consumed.
+        admittedWindowsMcpCodeSnapshotPlans.delete(plan);
+      }
+      const postSpawnAdapter = builtInWindowsMcpPlan
+        ? (child, boundPlan) => boundPlan.postSpawnWindows(child)
+        : this._sandboxAdapter.postSpawnSandbox;
+      postSpawnResult = postSpawnAdapter(proc, plan);
     } catch (error) {
       this._applySandboxAudit(auditEntry, plan, false);
       auditEntry.sandboxState = "failed";
@@ -3034,6 +3395,7 @@ class ProcessExecutionBroker extends EventEmitter {
     // Use native spawn from _native (set by patch-child-process.js)
     const nativeSpawnFn = this._native?.spawn || nativeSpawn;
     let proc;
+    let workspaceProcessClosed = null;
     try {
       if (mcpStdioExecutableIdentityAuthority !== undefined) {
         const admitted = consumeMcpStdioExecutableIdentityAuthority(
@@ -3047,16 +3409,20 @@ class ProcessExecutionBroker extends EventEmitter {
         auditEntry.mcpStdioExecutableIdentityDigest = admitted.identityDigest;
       }
       proc = nativeSpawnFn(command, args, optsForSpawn);
+      workspaceProcessClosed = this._createWorkspaceProcessCloseFence(
+        auditEntry,
+        proc,
+      );
       this._bindWorkspaceTransactionProcess(auditEntry, proc);
     } catch (spawnError) {
-      if (proc && typeof proc.kill === "function") {
-        try {
-          proc.kill("SIGKILL");
-        } catch {
-          // The transaction remains unsettled if shutdown cannot be proven.
-        }
-      }
-      if (!proc) {
+      if (proc) {
+        throw this._postSpawnOwnershipError(spawnError, {
+          proc,
+          auditEntry,
+          workspaceProcessClosed,
+          cleanup: sandboxPlan.cleanup,
+        });
+      } else {
         try {
           this._settleWorkspaceTransactionSpawn(auditEntry, {
             error: spawnError.message,
@@ -3069,102 +3435,105 @@ class ProcessExecutionBroker extends EventEmitter {
       throw spawnError;
     }
     auditEntry.pid = proc.pid;
-    const workspaceProcessClosed = this._createWorkspaceProcessCloseFence(
-      auditEntry,
-      proc,
-    );
-    const cleanupSandbox = this._scheduleSandboxCleanup(
-      proc,
-      sandboxPlan.cleanup,
-    );
-    if (
-      sandboxPlan.applied === true &&
-      (sandboxPlan.backend === "linux-bwrap-workspace" ||
-        sandboxPlan.backend === "linux-bwrap" ||
-        sandboxPlan.backend === "linux-fd-code-snapshot") &&
-      sandboxPlan.postSpawn.required === false
-    ) {
-      // child_process.spawn() has synchronously duplicated every stdio entry
-      // into the launched process before returning. The generic/direct bwrap
-      // backends and the MCP anonymous-code snapshot backend are complete
-      // pre-spawn plans with no parent-side enforcement handle. Retaining
-      // their pinned descriptors until a long-lived process exits would turn
-      // each child into an avoidable FD leak.
-      cleanupSandbox();
-    }
+    let cleanupSandbox = sandboxPlan.cleanup;
     try {
-      this._runPostSpawnSandbox(proc, sandboxPlan, auditEntry);
-      this._updateWorkspaceTransactionProcessGuarantees(auditEntry);
-      auditEntry.pid = proc.pid;
-      if (Number.isSafeInteger(proc.sandboxWrapperPid)) {
-        auditEntry.sandboxWrapperPid = proc.sandboxWrapperPid;
-      }
-      if (Number.isSafeInteger(proc.sandboxTargetPid)) {
-        auditEntry.sandboxTargetPid = proc.sandboxTargetPid;
+      cleanupSandbox = this._scheduleSandboxCleanup(proc, sandboxPlan.cleanup);
+      if (
+        sandboxPlan.applied === true &&
+        (sandboxPlan.backend === "linux-bwrap-workspace" ||
+          sandboxPlan.backend === "linux-bwrap" ||
+          sandboxPlan.backend === "linux-fd-code-snapshot") &&
+        sandboxPlan.postSpawn.required === false
+      ) {
+        // child_process.spawn() has synchronously duplicated every stdio entry
+        // into the launched process before returning. The generic/direct bwrap
+        // backends and the MCP anonymous-code snapshot backend are complete
+        // pre-spawn plans with no parent-side enforcement handle. Retaining
+        // their pinned descriptors until a long-lived process exits would turn
+        // each child into an avoidable FD leak.
+        cleanupSandbox();
       }
-    } catch (postSpawnError) {
-      if (postSpawnError.processTerminationRequested !== true) {
-        try {
-          proc.kill?.("SIGKILL");
-        } catch {
-          // The close fence remains pending and recovery stays fail-closed.
+      try {
+        this._runPostSpawnSandbox(proc, sandboxPlan, auditEntry);
+        this._updateWorkspaceTransactionProcessGuarantees(auditEntry);
+        auditEntry.pid = proc.pid;
+        if (Number.isSafeInteger(proc.sandboxWrapperPid)) {
+          auditEntry.sandboxWrapperPid = proc.sandboxWrapperPid;
+        }
+        if (Number.isSafeInteger(proc.sandboxTargetPid)) {
+          auditEntry.sandboxTargetPid = proc.sandboxTargetPid;
+        }
+      } catch (postSpawnError) {
+        if (postSpawnError.processTerminationRequested !== true) {
+          try {
+            proc.kill?.("SIGKILL");
+          } catch {
+            // The close fence remains pending and recovery stays fail-closed.
+          }
         }
+        cleanupSandbox();
+        this._recordSandboxDenial(auditEntry, postSpawnError, startTime);
+        postSpawnError.auditEntry = auditEntry;
+        postSpawnError.spawnedProcess = proc;
+        postSpawnError.workspaceProcessClosed = workspaceProcessClosed;
+        postSpawnError.workspaceTerminationRequested = true;
+        throw postSpawnError;
       }
-      cleanupSandbox();
-      this._recordSandboxDenial(auditEntry, postSpawnError, startTime);
-      postSpawnError.auditEntry = auditEntry;
-      postSpawnError.spawnedProcess = proc;
-      postSpawnError.workspaceProcessClosed = workspaceProcessClosed;
-      postSpawnError.workspaceTerminationRequested = true;
-      throw postSpawnError;
-    }
 
-    this._recordAudit(auditEntry);
-    this._writeRplEntry(auditEntry, "started");
-    this._emitHooksEvent("tool:start", {
-      executionId,
-      toolName: origin,
-      command,
-      args: [...auditEntry.args],
-      cwd,
-      pid: proc.pid,
-      component: origin,
-    });
-
-    proc.on("exit", (code, signal) => {
-      const endTime = Date.now();
-      auditEntry.exitCode = code;
-      auditEntry.signal = signal;
-      auditEntry.endTime = endTime;
-      auditEntry.durationMs = endTime - startTime;
-      this._writeRplEntry(auditEntry, "completed");
-      this._emitHooksEvent("tool:end", {
+      this._recordAudit(auditEntry);
+      this._writeRplEntry(auditEntry, "started");
+      this._emitHooksEvent("tool:start", {
         executionId,
-        success: code === 0,
-        exitCode: code,
-        signal,
-        durationMs: auditEntry.durationMs,
+        toolName: origin,
+        command,
+        args: [...auditEntry.args],
+        cwd,
+        pid: proc.pid,
         component: origin,
       });
-      this.emit("exit", auditEntry);
-    });
-    proc.on("error", (err) => {
-      auditEntry.error = err.message;
-      auditEntry.endTime = Date.now();
-      auditEntry.durationMs = auditEntry.endTime - startTime;
-      this._writeRplEntry(auditEntry, "error", err);
-      this._emitHooksEvent("tool:end", {
-        executionId,
-        success: false,
-        error: err.message,
-        component: origin,
+
+      proc.on("exit", (code, signal) => {
+        const endTime = Date.now();
+        auditEntry.exitCode = code;
+        auditEntry.signal = signal;
+        auditEntry.endTime = endTime;
+        auditEntry.durationMs = endTime - startTime;
+        this._writeRplEntry(auditEntry, "completed");
+        this._emitHooksEvent("tool:end", {
+          executionId,
+          success: code === 0,
+          exitCode: code,
+          signal,
+          durationMs: auditEntry.durationMs,
+          component: origin,
+        });
+        this.emit("exit", auditEntry);
       });
-      // EventEmitter treats an unhandled `error` event as an exception. A
-      // process ENOENT must reach the child-process listener/callback instead
-      // of crashing callers that did not subscribe to broker diagnostics.
-      if (this.listenerCount("error") > 0) this.emit("error", auditEntry);
-    });
-    return proc;
+      proc.on("error", (err) => {
+        auditEntry.error = err.message;
+        auditEntry.endTime = Date.now();
+        auditEntry.durationMs = auditEntry.endTime - startTime;
+        this._writeRplEntry(auditEntry, "error", err);
+        this._emitHooksEvent("tool:end", {
+          executionId,
+          success: false,
+          error: err.message,
+          component: origin,
+        });
+        // EventEmitter treats an unhandled `error` event as an exception. A
+        // process ENOENT must reach the child-process listener/callback instead
+        // of crashing callers that did not subscribe to broker diagnostics.
+        if (this.listenerCount("error") > 0) this.emit("error", auditEntry);
+      });
+      return proc;
+    } catch (postNativeError) {
+      throw this._postSpawnOwnershipError(postNativeError, {
+        proc,
+        auditEntry,
+        workspaceProcessClosed,
+        cleanup: cleanupSandbox,
+      });
+    }
   }
 
   spawnSync(command, args, options = {}) {