chainlesschain 0.163.2 → 0.163.3

package/src/lib/mcp-stdio-workspace-authority.js

@@ -0,0 +1,252 @@
+import fs from "node:fs";
+import path from "node:path";
+import { isProxy } from "node:util/types";
+import { resolveHostHooksV2WorkspaceBinding } from "./hooks-v2-workspace-context.js";
+import { normalizeMcpSandboxPolicy } from "./mcp-sandbox-policy.js";
+import { resolvePluginWorkspaceAuthority } from "./plugin-runtime/sandbox-policy.js";
+import { resolveProjectMcpWorkspaceAuthority } from "./project-mcp-trust.js";
+
+export const MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE =
+  "CC_MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED";
+export const MCP_STDIO_SANDBOX_CWD_INVALID_CODE =
+  "CC_MCP_STDIO_SANDBOX_CWD_INVALID";
+
+function workspaceError(code, message, cause) {
+  const error = new Error(message, cause ? { cause } : undefined);
+  error.code = code;
+  return error;
+}
+
+function dataProperty(owner, key, fallback) {
+  if (!owner || typeof owner !== "object" || isProxy(owner)) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+      "MCP stdio sandbox config must be a non-Proxy object",
+    );
+  }
+  const descriptor = Object.getOwnPropertyDescriptor(owner, key);
+  if (!descriptor) return fallback;
+  if (!("value" in descriptor)) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+      `MCP stdio sandbox config.${key} must be an own data property`,
+    );
+  }
+  return descriptor.value;
+}
+
+function canonicalDirectory(value, label) {
+  if (typeof value !== "string" || value.length === 0 || value.includes("\0")) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_CWD_INVALID_CODE,
+      `${label} must be a non-empty directory path`,
+    );
+  }
+  try {
+    const canonical = fs.realpathSync.native(path.resolve(value));
+    if (!fs.statSync(canonical).isDirectory()) {
+      throw new Error("not a directory");
+    }
+    return canonical;
+  } catch (cause) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_CWD_INVALID_CODE,
+      `${label} must resolve to an existing directory`,
+      cause,
+    );
+  }
+}
+
+function isPathInside(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return (
+    relative === "" ||
+    (relative !== ".." &&
+      !relative.startsWith(`..${path.sep}`) &&
+      !path.isAbsolute(relative))
+  );
+}
+
+function sandboxPolicyFromConfig(config, serverName) {
+  const raw = dataProperty(config, "sandboxPolicy", null);
+  return normalizeMcpSandboxPolicy(raw, {
+    label: `MCP stdio server "${serverName}" sandboxPolicy`,
+  });
+}
+
+function pluginRootFromConfig(config, deps) {
+  if (dataProperty(config, "origin", null) !== "plugin:mcp") return null;
+  const resolvePlugin =
+    deps.resolvePluginWorkspaceAuthority || resolvePluginWorkspaceAuthority;
+  return resolvePlugin(dataProperty(config, "pluginWorkspaceAuthority", null), {
+    origin: "plugin:mcp",
+    pluginId: dataProperty(config, "pluginId", null),
+    pluginVersion: dataProperty(config, "pluginVersion", null),
+    pluginSource: dataProperty(config, "pluginSource", null),
+  });
+}
+
+function isProjectFileSource(configScope, configSource) {
+  return (
+    configScope === "project" &&
+    typeof configSource === "string" &&
+    path.basename(configSource).toLowerCase() === ".mcp.json"
+  );
+}
+
+function requirePublicWorkspaceRoot(
+  serverName,
+  config,
+  workspaceBinding,
+  deps,
+) {
+  const resolveHost =
+    deps.resolveHostWorkspaceBinding || resolveHostHooksV2WorkspaceBinding;
+  const binding = resolveHost(workspaceBinding);
+  if (!binding?.workspaceRoot) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+      `Policy-bearing MCP stdio server "${serverName}" requires a trusted host workspace`,
+    );
+  }
+  const hostRoot = canonicalDirectory(
+    binding.workspaceRoot,
+    `MCP stdio server "${serverName}" host workspace`,
+  );
+  const configScope = dataProperty(config, "configScope", null);
+  const projectPath = dataProperty(config, "projectPath", null);
+  const configSource = dataProperty(config, "configSource", null);
+  const projectAuthority = dataProperty(
+    config,
+    "projectMcpWorkspaceAuthority",
+    null,
+  );
+  const projectFileSource = isProjectFileSource(configScope, configSource);
+
+  if (
+    configScope === "project" &&
+    (projectFileSource || projectAuthority) &&
+    !projectPath
+  ) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+      `Project MCP stdio server "${serverName}" is missing its project workspace`,
+    );
+  }
+
+  if ((configScope === "local" || configScope === "project") && projectPath) {
+    const projectRoot = canonicalDirectory(
+      projectPath,
+      `MCP stdio server "${serverName}" project workspace`,
+    );
+    if (!isPathInside(projectRoot, hostRoot)) {
+      throw workspaceError(
+        MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+        `MCP stdio server "${serverName}" does not belong to the trusted host workspace`,
+      );
+    }
+
+    if (projectAuthority || projectFileSource) {
+      const resolveProject =
+        deps.resolveProjectMcpWorkspaceAuthority ||
+        resolveProjectMcpWorkspaceAuthority;
+      const authorityRoot = resolveProject(projectAuthority, {
+        configSource,
+        serverName,
+        url: dataProperty(config, "url", null),
+        transport: dataProperty(config, "transport", null),
+        headersHelper: dataProperty(config, "headersHelper", null),
+      });
+      let canonicalAuthorityRoot = null;
+      try {
+        canonicalAuthorityRoot = authorityRoot
+          ? canonicalDirectory(
+              authorityRoot,
+              `MCP stdio server "${serverName}" project authority`,
+            )
+          : null;
+      } catch {
+        canonicalAuthorityRoot = null;
+      }
+      if (canonicalAuthorityRoot !== projectRoot) {
+        throw workspaceError(
+          MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+          `Project MCP stdio server "${serverName}" is missing its trusted file authority`,
+        );
+      }
+    }
+  }
+
+  return hostRoot;
+}
+
+function requestedWorkingDirectory(config, trustedRoot, serverName) {
+  const requested = dataProperty(config, "cwd", null);
+  if (requested == null || requested === "") return trustedRoot;
+  if (typeof requested !== "string" || requested.includes("\0")) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_CWD_INVALID_CODE,
+      `MCP stdio server "${serverName}" cwd must be a path`,
+    );
+  }
+  const candidate = canonicalDirectory(
+    path.isAbsolute(requested)
+      ? requested
+      : path.resolve(trustedRoot, requested),
+    `MCP stdio server "${serverName}" cwd`,
+  );
+  if (!isPathInside(trustedRoot, candidate)) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_CWD_INVALID_CODE,
+      `MCP stdio server "${serverName}" cwd escapes its trusted workspace`,
+    );
+  }
+  return candidate;
+}
+
+/**
+ * Resolve source-declared MCP isolation against an opaque host/plugin
+ * workspace capability. A policy-bearing launch never derives authority from
+ * process.cwd(); the selected cwd is canonical, existing, and contained by the
+ * trusted root before executable identity or Broker contract issuance.
+ */
+export function resolveMcpStdioSandboxContext(
+  { serverName, config, workspaceBinding },
+  deps = {},
+) {
+  const name = String(serverName || "unknown");
+  const sandboxPolicy = sandboxPolicyFromConfig(config, name);
+  const pluginWorkspaceRoot = pluginRootFromConfig(config, deps);
+
+  if (!sandboxPolicy) {
+    return Object.freeze({
+      sandboxPolicy: null,
+      pluginWorkspaceRoot,
+      workingDirectory: pluginWorkspaceRoot,
+    });
+  }
+
+  if (
+    dataProperty(config, "origin", null) === "plugin:mcp" &&
+    !pluginWorkspaceRoot
+  ) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+      `Plugin MCP stdio server "${name}" is missing its trusted workspace authority`,
+    );
+  }
+
+  const trustedRoot = pluginWorkspaceRoot
+    ? canonicalDirectory(
+        pluginWorkspaceRoot,
+        `Plugin MCP stdio server "${name}" workspace`,
+      )
+    : requirePublicWorkspaceRoot(name, config, workspaceBinding, deps);
+  const workingDirectory = requestedWorkingDirectory(config, trustedRoot, name);
+
+  return Object.freeze({
+    sandboxPolicy,
+    pluginWorkspaceRoot,
+    workingDirectory,
+  });
+}

package/src/lib/plugin-runtime/sandbox-policy.js

@@ -20,6 +20,28 @@ const SUPPORTED_BOUNDARIES = new Set(PLUGIN_SANDBOX_BOUNDARIES);
 const PLUGIN_WORKSPACE_AUTHORITY_KIND = "trusted-plugin-workspace";
 const pluginWorkspaceAuthorities = new WeakMap();
 
+function directoryGeneration(stat) {
+  return stat.birthtimeNs > 0n
+    ? `birth:${stat.birthtimeNs.toString()}`
+    : `ctime:${stat.ctimeNs.toString()}`;
+}
+
+function directoryIdentity(stat) {
+  return Object.freeze({
+    device: stat.dev,
+    inode: stat.ino,
+    generation: directoryGeneration(stat),
+  });
+}
+
+function sameDirectoryIdentity(left, right) {
+  return (
+    left.device === right.dev &&
+    left.inode === right.ino &&
+    left.generation === directoryGeneration(right)
+  );
+}
+
 function invalidPolicy(message) {
   const error = new Error(message);
   error.code = "ERR_PLUGIN_SANDBOX_POLICY_INVALID";
@@ -69,7 +91,7 @@ export function issuePluginWorkspaceAuthority(value = {}) {
   try {
     const implementation = fs.realpathSync.native || fs.realpathSync;
     canonicalRoot = implementation.call(fs.realpathSync, requestedRoot);
-    stat = fs.statSync(canonicalRoot);
+    stat = fs.statSync(canonicalRoot, { bigint: true });
   } catch {
     throw invalidPolicy("trusted plugin workspace root is unavailable");
   }
@@ -92,7 +114,11 @@ export function issuePluginWorkspaceAuthority(value = {}) {
   });
   pluginWorkspaceAuthorities.set(
     authority,
-    Object.freeze({ root: canonicalRoot, provenance }),
+    Object.freeze({
+      root: canonicalRoot,
+      identity: directoryIdentity(stat),
+      provenance,
+    }),
   );
   return authority;
 }
@@ -117,6 +143,20 @@ export function resolvePluginWorkspaceAuthority(authority, provenance = {}) {
   ) {
     return null;
   }
+  try {
+    const implementation = fs.realpathSync.native || fs.realpathSync;
+    const currentRoot = implementation.call(fs.realpathSync, binding.root);
+    const currentStat = fs.statSync(currentRoot, { bigint: true });
+    if (
+      currentRoot !== binding.root ||
+      !currentStat.isDirectory() ||
+      !sameDirectoryIdentity(binding.identity, currentStat)
+    ) {
+      return null;
+    }
+  } catch {
+    return null;
+  }
   return binding.root;
 }
 

package/src/lib/process-execution-broker/index.js

@@ -1320,6 +1320,20 @@ class ProcessExecutionBroker extends EventEmitter {
         "pluginTreeSnapshotContractBound",
         "pluginTreeSnapshotAtomic",
       ];
+      const nodePluginTreeSnapshotEvidence =
+        plan.runtimeProbe.kind === "linux-bwrap-plugin-node-policy-v1" &&
+        plan.runtimeProbe.targetRuntime === "node" &&
+        plan.runtimeProbe.contentSnapshotScope === "plugin-entry-source";
+      const nativePluginRuntimeEvidence =
+        (plan.runtimeProbe.kind ===
+          "linux-bwrap-plugin-native-static-elf-policy-v1" &&
+          plan.runtimeProbe.targetRuntime === "native-static-elf") ||
+        (plan.runtimeProbe.kind ===
+          "linux-bwrap-plugin-native-dynamic-elf-policy-v1" &&
+          plan.runtimeProbe.targetRuntime === "native-dynamic-elf");
+      const nativePluginTreeSnapshotEvidence =
+        nativePluginRuntimeEvidence &&
+        plan.runtimeProbe.contentSnapshotScope === "plugin-entry-executable";
       if (
         pluginTreeSnapshot &&
         (plan.applied !== true ||
@@ -1334,11 +1348,10 @@ class ProcessExecutionBroker extends EventEmitter {
           plan.runtimeProbe.attempted !== true ||
           plan.runtimeProbe.runnable !== true ||
           plan.runtimeProbe.reason !== null ||
-          plan.runtimeProbe.kind !== "linux-bwrap-plugin-node-policy-v1" ||
+          (!nodePluginTreeSnapshotEvidence &&
+            !nativePluginTreeSnapshotEvidence) ||
           plan.runtimeProbe.probeRuntime !== "node" ||
-          plan.runtimeProbe.targetRuntime !== "node" ||
           plan.runtimeProbe.contentSnapshot !== true ||
-          plan.runtimeProbe.contentSnapshotScope !== "plugin-entry-source" ||
           plan.runtimeProbe.contentSnapshotMechanism !==
             "verified-o_tmpfile-copy-bwrap-ro-bind-data-v1" ||
           plan.runtimeProbe.handleAtomic !== false ||
@@ -1382,6 +1395,18 @@ class ProcessExecutionBroker extends EventEmitter {
           "Sandbox runtime probe plugin tree snapshot evidence requires pluginTreeContentSnapshot",
         );
       }
+      const successfulNativeProbe =
+        plan.applied === true &&
+        plan.runtimeProbe.attempted === true &&
+        plan.runtimeProbe.runnable === true &&
+        plan.runtimeProbe.reason === null &&
+        nativePluginRuntimeEvidence;
+      if (successfulNativeProbe && !pluginTreeSnapshot) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Successful Linux native plugin evidence requires a complete plugin tree snapshot",
+        );
+      }
       const supervisorStringFields = [
         "supervisorBindingScope",
         "supervisorDescriptorBindingMechanism",
@@ -2585,12 +2610,6 @@ class ProcessExecutionBroker extends EventEmitter {
   }
 
   _createWorkspaceProcessCloseFence(auditEntry, proc) {
-    if (
-      !Array.isArray(auditEntry.workspaceTransactionIds) ||
-      auditEntry.workspaceTransactionIds.length === 0
-    ) {
-      return null;
-    }
     return new Promise((resolve) => {
       if (typeof proc?.once === "function") {
         proc.once("close", (exitCode, signal) => {
@@ -2612,6 +2631,54 @@ class ProcessExecutionBroker extends EventEmitter {
     });
   }
 
+  _postSpawnOwnershipError(
+    error,
+    { proc, auditEntry, workspaceProcessClosed, cleanup },
+  ) {
+    let failure =
+      error instanceof Error
+        ? error
+        : new Error(String(error || "spawn failed"));
+    if (
+      failure.processTerminationRequested !== true &&
+      failure.workspaceTerminationRequested !== true
+    ) {
+      try {
+        if (typeof proc?.once === "function") proc.once("error", () => {});
+      } catch {
+        // Listener installation failure is itself post-spawn evidence.
+      }
+      try {
+        proc?.kill?.("SIGKILL");
+      } catch {
+        // The close fence remains the only settlement authority.
+      }
+    }
+    try {
+      cleanup?.();
+    } catch {
+      // Ownership evidence must survive cleanup reporting failures.
+    }
+    const attach = (target) => {
+      target.auditEntry = auditEntry;
+      target.spawnedProcess = proc;
+      target.workspaceProcessClosed = workspaceProcessClosed;
+      target.workspaceTerminationRequested = true;
+      return target;
+    };
+    try {
+      return attach(failure);
+    } catch {
+      const wrapped = new Error(failure.message || "post-spawn failure", {
+        cause: failure,
+      });
+      wrapped.name = failure.name || wrapped.name;
+      if (failure.code !== undefined) wrapped.code = failure.code;
+      failure = wrapped;
+      return attach(failure);
+    }
+  }
+
   _runPostSpawnSandbox(proc, plan, auditEntry) {
     if (!plan.applied || !plan.postSpawn.required) {
       this._applySandboxAudit(auditEntry, plan, plan.applied);
@@ -3328,6 +3395,7 @@ class ProcessExecutionBroker extends EventEmitter {
     // Use native spawn from _native (set by patch-child-process.js)
     const nativeSpawnFn = this._native?.spawn || nativeSpawn;
     let proc;
+    let workspaceProcessClosed = null;
     try {
       if (mcpStdioExecutableIdentityAuthority !== undefined) {
         const admitted = consumeMcpStdioExecutableIdentityAuthority(
@@ -3341,16 +3409,20 @@ class ProcessExecutionBroker extends EventEmitter {
         auditEntry.mcpStdioExecutableIdentityDigest = admitted.identityDigest;
       }
       proc = nativeSpawnFn(command, args, optsForSpawn);
+      workspaceProcessClosed = this._createWorkspaceProcessCloseFence(
+        auditEntry,
+        proc,
+      );
       this._bindWorkspaceTransactionProcess(auditEntry, proc);
     } catch (spawnError) {
-      if (proc && typeof proc.kill === "function") {
-        try {
-          proc.kill("SIGKILL");
-        } catch {
-          // The transaction remains unsettled if shutdown cannot be proven.
-        }
-      }
-      if (!proc) {
+      if (proc) {
+        throw this._postSpawnOwnershipError(spawnError, {
+          proc,
+          auditEntry,
+          workspaceProcessClosed,
+          cleanup: sandboxPlan.cleanup,
+        });
+      } else {
         try {
           this._settleWorkspaceTransactionSpawn(auditEntry, {
             error: spawnError.message,
@@ -3363,102 +3435,105 @@ class ProcessExecutionBroker extends EventEmitter {
       throw spawnError;
     }
     auditEntry.pid = proc.pid;
-    const workspaceProcessClosed = this._createWorkspaceProcessCloseFence(
-      auditEntry,
-      proc,
-    );
-    const cleanupSandbox = this._scheduleSandboxCleanup(
-      proc,
-      sandboxPlan.cleanup,
-    );
-    if (
-      sandboxPlan.applied === true &&
-      (sandboxPlan.backend === "linux-bwrap-workspace" ||
-        sandboxPlan.backend === "linux-bwrap" ||
-        sandboxPlan.backend === "linux-fd-code-snapshot") &&
-      sandboxPlan.postSpawn.required === false
-    ) {
-      // child_process.spawn() has synchronously duplicated every stdio entry
-      // into the launched process before returning. The generic/direct bwrap
-      // backends and the MCP anonymous-code snapshot backend are complete
-      // pre-spawn plans with no parent-side enforcement handle. Retaining
-      // their pinned descriptors until a long-lived process exits would turn
-      // each child into an avoidable FD leak.
-      cleanupSandbox();
-    }
+    let cleanupSandbox = sandboxPlan.cleanup;
     try {
-      this._runPostSpawnSandbox(proc, sandboxPlan, auditEntry);
-      this._updateWorkspaceTransactionProcessGuarantees(auditEntry);
-      auditEntry.pid = proc.pid;
-      if (Number.isSafeInteger(proc.sandboxWrapperPid)) {
-        auditEntry.sandboxWrapperPid = proc.sandboxWrapperPid;
-      }
-      if (Number.isSafeInteger(proc.sandboxTargetPid)) {
-        auditEntry.sandboxTargetPid = proc.sandboxTargetPid;
+      cleanupSandbox = this._scheduleSandboxCleanup(proc, sandboxPlan.cleanup);
+      if (
+        sandboxPlan.applied === true &&
+        (sandboxPlan.backend === "linux-bwrap-workspace" ||
+          sandboxPlan.backend === "linux-bwrap" ||
+          sandboxPlan.backend === "linux-fd-code-snapshot") &&
+        sandboxPlan.postSpawn.required === false
+      ) {
+        // child_process.spawn() has synchronously duplicated every stdio entry
+        // into the launched process before returning. The generic/direct bwrap
+        // backends and the MCP anonymous-code snapshot backend are complete
+        // pre-spawn plans with no parent-side enforcement handle. Retaining
+        // their pinned descriptors until a long-lived process exits would turn
+        // each child into an avoidable FD leak.
+        cleanupSandbox();
       }
-    } catch (postSpawnError) {
-      if (postSpawnError.processTerminationRequested !== true) {
-        try {
-          proc.kill?.("SIGKILL");
-        } catch {
-          // The close fence remains pending and recovery stays fail-closed.
+      try {
+        this._runPostSpawnSandbox(proc, sandboxPlan, auditEntry);
+        this._updateWorkspaceTransactionProcessGuarantees(auditEntry);
+        auditEntry.pid = proc.pid;
+        if (Number.isSafeInteger(proc.sandboxWrapperPid)) {
+          auditEntry.sandboxWrapperPid = proc.sandboxWrapperPid;
+        }
+        if (Number.isSafeInteger(proc.sandboxTargetPid)) {
+          auditEntry.sandboxTargetPid = proc.sandboxTargetPid;
+        }
+      } catch (postSpawnError) {
+        if (postSpawnError.processTerminationRequested !== true) {
+          try {
+            proc.kill?.("SIGKILL");
+          } catch {
+            // The close fence remains pending and recovery stays fail-closed.
+          }
         }
+        cleanupSandbox();
+        this._recordSandboxDenial(auditEntry, postSpawnError, startTime);
+        postSpawnError.auditEntry = auditEntry;
+        postSpawnError.spawnedProcess = proc;
+        postSpawnError.workspaceProcessClosed = workspaceProcessClosed;
+        postSpawnError.workspaceTerminationRequested = true;
+        throw postSpawnError;
       }
-      cleanupSandbox();
-      this._recordSandboxDenial(auditEntry, postSpawnError, startTime);
-      postSpawnError.auditEntry = auditEntry;
-      postSpawnError.spawnedProcess = proc;
-      postSpawnError.workspaceProcessClosed = workspaceProcessClosed;
-      postSpawnError.workspaceTerminationRequested = true;
-      throw postSpawnError;
-    }
-
-    this._recordAudit(auditEntry);
-    this._writeRplEntry(auditEntry, "started");
-    this._emitHooksEvent("tool:start", {
-      executionId,
-      toolName: origin,
-      command,
-      args: [...auditEntry.args],
-      cwd,
-      pid: proc.pid,
-      component: origin,
-    });
 
-    proc.on("exit", (code, signal) => {
-      const endTime = Date.now();
-      auditEntry.exitCode = code;
-      auditEntry.signal = signal;
-      auditEntry.endTime = endTime;
-      auditEntry.durationMs = endTime - startTime;
-      this._writeRplEntry(auditEntry, "completed");
-      this._emitHooksEvent("tool:end", {
+      this._recordAudit(auditEntry);
+      this._writeRplEntry(auditEntry, "started");
+      this._emitHooksEvent("tool:start", {
         executionId,
-        success: code === 0,
-        exitCode: code,
-        signal,
-        durationMs: auditEntry.durationMs,
+        toolName: origin,
+        command,
+        args: [...auditEntry.args],
+        cwd,
+        pid: proc.pid,
         component: origin,
       });
-      this.emit("exit", auditEntry);
-    });
-    proc.on("error", (err) => {
-      auditEntry.error = err.message;
-      auditEntry.endTime = Date.now();
-      auditEntry.durationMs = auditEntry.endTime - startTime;
-      this._writeRplEntry(auditEntry, "error", err);
-      this._emitHooksEvent("tool:end", {
-        executionId,
-        success: false,
-        error: err.message,
-        component: origin,
+
+      proc.on("exit", (code, signal) => {
+        const endTime = Date.now();
+        auditEntry.exitCode = code;
+        auditEntry.signal = signal;
+        auditEntry.endTime = endTime;
+        auditEntry.durationMs = endTime - startTime;
+        this._writeRplEntry(auditEntry, "completed");
+        this._emitHooksEvent("tool:end", {
+          executionId,
+          success: code === 0,
+          exitCode: code,
+          signal,
+          durationMs: auditEntry.durationMs,
+          component: origin,
+        });
+        this.emit("exit", auditEntry);
       });
-      // EventEmitter treats an unhandled `error` event as an exception. A
-      // process ENOENT must reach the child-process listener/callback instead
-      // of crashing callers that did not subscribe to broker diagnostics.
-      if (this.listenerCount("error") > 0) this.emit("error", auditEntry);
-    });
-    return proc;
+      proc.on("error", (err) => {
+        auditEntry.error = err.message;
+        auditEntry.endTime = Date.now();
+        auditEntry.durationMs = auditEntry.endTime - startTime;
+        this._writeRplEntry(auditEntry, "error", err);
+        this._emitHooksEvent("tool:end", {
+          executionId,
+          success: false,
+          error: err.message,
+          component: origin,
+        });
+        // EventEmitter treats an unhandled `error` event as an exception. A
+        // process ENOENT must reach the child-process listener/callback instead
+        // of crashing callers that did not subscribe to broker diagnostics.
+        if (this.listenerCount("error") > 0) this.emit("error", auditEntry);
+      });
+      return proc;
+    } catch (postNativeError) {
+      throw this._postSpawnOwnershipError(postNativeError, {
+        proc,
+        auditEntry,
+        workspaceProcessClosed,
+        cleanup: cleanupSandbox,
+      });
+    }
   }
 
   spawnSync(command, args, options = {}) {