chainlesschain 0.163.2 → 0.163.4

package/src/lib/process-execution-broker/platform-sandbox.js

@@ -108,6 +108,13 @@ const WINDOWS_APPCONTAINER_BACKEND =
   "windows-appcontainer-job-restricted-token";
 const MCP_STDIO_CAPSULE_SANDBOX_CONTRACT_KIND = "strict-mcp-node-capsule";
 const WINDOWS_ADAPTER_IDLE_TTL_MS = 60_000;
+const WINDOWS_ADAPTER_HELPER_NAME = "windows-sandbox-helper.exe";
+const WINDOWS_ADAPTER_IDLE_TTL_ENV = "CC_WINDOWS_SANDBOX_ADAPTER_IDLE_TTL_MS";
+const WINDOWS_ADAPTER_TEMP_ROOT_ENV = "CC_WINDOWS_SANDBOX_ADAPTER_TEMP_ROOT";
+const WINDOWS_ADAPTER_TEMP_ROOT_UNTRUSTED_REASON =
+  "windows_adapter_temp_root_untrusted";
+const WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON =
+  "windows_adapter_temp_root_changed";
 // Every native helper operation starts a trusted System32 PowerShell host and
 // byte-loads the checked-in assembly. Hosted Windows runners can spend well
 // over ten seconds in that bootstrap before the managed operation begins.
@@ -152,6 +159,9 @@ const LINUX_BWRAP_PATH = "/usr/bin/bwrap";
 const LINUX_LDD_PATH = "/usr/bin/ldd";
 const LINUX_BWRAP_BACKEND = "linux-bwrap";
 const LINUX_BWRAP_NODE_PROBE_SENTINEL = "chainless-linux-bwrap-plugin-node-v1";
+const LINUX_BWRAP_CHILD_RUNTIME_PROBE_SENTINEL =
+  "chainless-linux-bwrap-child-runtime-v1";
+const LINUX_BWRAP_CHILD_RUNTIME_PROBE_FAILURE_STATUS = 86;
 const LINUX_BWRAP_MAX_PLUGIN_ENTRIES = 512;
 const LINUX_PLUGIN_TREE_SNAPSHOT_MAX_FILES = 256;
 const LINUX_PLUGIN_TREE_SNAPSHOT_MAX_BYTES = 256 * 1024 * 1024;
@@ -179,8 +189,8 @@ export const MCP_STDIO_FD_ENTRY_BOOTSTRAP_SHA256 = crypto
   .digest("hex");
 const LINUX_NODE_ENTRY_SNAPSHOT_SCOPE = "plugin-entry-source";
 const LINUX_NATIVE_ENTRY_SNAPSHOT_SCOPE = "plugin-entry-executable";
-const LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE = "all-pinned-plugin-regular-files";
-const LINUX_NODE_PLUGIN_TREE_SNAPSHOT_CONSISTENCY = "per-file-pin-to-launch";
+const LINUX_PLUGIN_TREE_SNAPSHOT_SCOPE = "all-pinned-plugin-regular-files";
+const LINUX_PLUGIN_TREE_SNAPSHOT_CONSISTENCY = "per-file-pin-to-launch";
 const LINUX_NODE_ENTRY_SNAPSHOT_TARGET_MODE = "0400";
 const LINUX_NATIVE_ENTRY_SNAPSHOT_TARGET_MODE = "0500";
 const LINUX_ELF64_HEADER_BYTES = 64;
@@ -311,6 +321,325 @@ function resolveRuntime(overrides = {}) {
   return { ...DEFAULT_RUNTIME, ...overrides };
 }
 
+function windowsNativeRealpath(runtime, candidate) {
+  const nativeRealpath = runtime.fs.realpathSync?.native;
+  if (typeof nativeRealpath !== "function") {
+    throw new Error("Native Windows realpath is unavailable");
+  }
+  const nativePath = nativeRealpath.call(runtime.fs, candidate);
+  const withoutExtendedPrefix = String(nativePath).replace(
+    /^\\\\\?\\(?=[A-Za-z]:\\)/,
+    "",
+  );
+  return path.win32.resolve(withoutExtendedPrefix);
+}
+
+function windowsPathHasReparseSemantics(stat) {
+  return (
+    stat.isSymbolicLink?.() ||
+    stat.isReparsePoint?.() ||
+    stat.reparsePoint === true
+  );
+}
+
+function windowsLocalPathAncestors(candidate) {
+  const resolved = path.win32.resolve(candidate);
+  const volumeRoot = path.win32.parse(resolved).root;
+  if (!/^[A-Za-z]:\\$/.test(volumeRoot)) return null;
+  const relative = path.win32.relative(volumeRoot, resolved);
+  if (
+    path.win32.isAbsolute(relative) ||
+    relative === ".." ||
+    relative.startsWith(`..${path.win32.sep}`)
+  ) {
+    return null;
+  }
+  const ancestors = [volumeRoot];
+  let current = volumeRoot;
+  for (const segment of relative.split(path.win32.sep).filter(Boolean)) {
+    current = path.win32.join(current, segment);
+    ancestors.push(current);
+  }
+  return ancestors;
+}
+
+function windowsDirectoryIdentity(stat) {
+  const birthtimeNs =
+    stat.birthtimeNs !== undefined
+      ? String(stat.birthtimeNs)
+      : String(Math.trunc(Number(stat.birthtimeMs || 0) * 1_000_000));
+  if (
+    stat.dev === undefined ||
+    stat.ino === undefined ||
+    stat.mode === undefined
+  ) {
+    throw new Error("Windows directory identity is unavailable");
+  }
+  return Object.freeze({
+    dev: String(stat.dev),
+    ino: String(stat.ino),
+    mode: String(stat.mode),
+    birthtimeNs,
+  });
+}
+
+function sameWindowsDirectoryIdentity(left, right) {
+  return (
+    left?.dev === right?.dev &&
+    left?.ino === right?.ino &&
+    left?.mode === right?.mode &&
+    left?.birthtimeNs === right?.birthtimeNs
+  );
+}
+
+function inspectWindowsAdapterTempRoot(runtime, candidate) {
+  if (
+    typeof candidate !== "string" ||
+    candidate.length === 0 ||
+    candidate.includes("\0") ||
+    !path.win32.isAbsolute(candidate)
+  ) {
+    return null;
+  }
+  const sourcePath = path.win32.resolve(candidate);
+  const sourceAncestors = windowsLocalPathAncestors(sourcePath);
+  if (!sourceAncestors) return null;
+
+  try {
+    // Keep the caller-visible path in the trust decision even when Windows
+    // exposes it through a legitimate 8.3 alias (for example RUNNER~1 on a
+    // hosted runner). Every raw ancestor must be a plain directory before the
+    // native real path is accepted as the path used for mutations.
+    let sourceRootStat = null;
+    for (const ancestor of sourceAncestors) {
+      const stat = runtime.fs.lstatSync(ancestor, { bigint: true });
+      if (windowsPathHasReparseSemantics(stat) || !stat.isDirectory?.()) {
+        return null;
+      }
+      sourceRootStat = stat;
+    }
+
+    const rootPath = windowsNativeRealpath(runtime, sourcePath);
+    const rootAncestors = windowsLocalPathAncestors(rootPath);
+    if (!rootAncestors) return null;
+    let canonicalRootStat = null;
+    for (const ancestor of rootAncestors) {
+      const stat = runtime.fs.lstatSync(ancestor, { bigint: true });
+      if (windowsPathHasReparseSemantics(stat) || !stat.isDirectory?.()) {
+        return null;
+      }
+      canonicalRootStat = stat;
+    }
+
+    const sourceIdentity = windowsDirectoryIdentity(sourceRootStat);
+    const identity = windowsDirectoryIdentity(canonicalRootStat);
+    if (!sameWindowsDirectoryIdentity(sourceIdentity, identity)) return null;
+
+    const sourceAfter = runtime.fs.lstatSync(sourcePath, { bigint: true });
+    const rootAfter = runtime.fs.lstatSync(rootPath, { bigint: true });
+    if (
+      windowsPathHasReparseSemantics(sourceAfter) ||
+      !sourceAfter.isDirectory?.() ||
+      windowsPathHasReparseSemantics(rootAfter) ||
+      !rootAfter.isDirectory?.() ||
+      windowsCanonicalPathKey(windowsNativeRealpath(runtime, sourcePath)) !==
+        windowsCanonicalPathKey(rootPath) ||
+      windowsCanonicalPathKey(windowsNativeRealpath(runtime, rootPath)) !==
+        windowsCanonicalPathKey(rootPath) ||
+      !sameWindowsDirectoryIdentity(
+        sourceIdentity,
+        windowsDirectoryIdentity(sourceAfter),
+      ) ||
+      !sameWindowsDirectoryIdentity(
+        identity,
+        windowsDirectoryIdentity(rootAfter),
+      )
+    ) {
+      return null;
+    }
+    return Object.freeze({
+      sourcePath,
+      sourceCanonicalPathKey: windowsCanonicalPathKey(sourcePath),
+      rootPath,
+      canonicalPathKey: windowsCanonicalPathKey(rootPath),
+      volumeRoot: path.win32.parse(rootPath).root.toLowerCase(),
+      identity,
+      attestation: Object.freeze({
+        kind: "windows-adapter-temp-root-path-reattestation-v1",
+        localVolume: true,
+        nativeRealpathMatched: true,
+        sourceAliasCanonicalized:
+          windowsCanonicalPathKey(sourcePath) !==
+          windowsCanonicalPathKey(rootPath),
+        ancestorReparsePointsRejected: true,
+        rootIdentityBound: true,
+        criticalOperationReattestation: true,
+        descriptorRelativeOperations: false,
+        handleAtomic: false,
+        residualRace:
+          "same-principal-path-swap-between-reattestation-and-filesystem-call",
+        residualHandling: "fail-closed-on-detected-path-or-identity-change",
+      }),
+    });
+  } catch {
+    return null;
+  }
+}
+
+function sameWindowsAdapterTempRootBinding(left, right) {
+  return (
+    left?.sourceCanonicalPathKey === right?.sourceCanonicalPathKey &&
+    left?.canonicalPathKey === right?.canonicalPathKey &&
+    left?.volumeRoot === right?.volumeRoot &&
+    sameWindowsDirectoryIdentity(left?.identity, right?.identity)
+  );
+}
+
+function verifyWindowsAdapterTempRootBinding(runtime, binding) {
+  const current = inspectWindowsAdapterTempRoot(
+    runtime,
+    binding?.sourcePath || binding?.rootPath,
+  );
+  return Boolean(
+    current && sameWindowsAdapterTempRootBinding(binding, current),
+  );
+}
+
+function windowsAdapterTempRootChangedError() {
+  const error = new Error(
+    "Windows sandbox adapter temp root changed after attestation",
+  );
+  error.code = "ERR_WINDOWS_SANDBOX_ADAPTER_TEMP_ROOT_CHANGED";
+  error.adapterReason = WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON;
+  return error;
+}
+
+function assertWindowsAdapterTempRoot(runtime) {
+  const binding = runtime.windowsAdapterTempRootBinding;
+  if (!binding || !verifyWindowsAdapterTempRootBinding(runtime, binding)) {
+    throw windowsAdapterTempRootChangedError();
+  }
+  return binding;
+}
+
+function inspectWindowsAdapterBoundPath(
+  runtime,
+  targetPath,
+  expectedKind,
+  { allowMissing = false } = {},
+) {
+  const binding = assertWindowsAdapterTempRoot(runtime);
+  if (
+    typeof targetPath !== "string" ||
+    targetPath.includes("\0") ||
+    !path.win32.isAbsolute(targetPath)
+  ) {
+    throw windowsAdapterTempRootChangedError();
+  }
+  const resolved = path.win32.resolve(targetPath);
+  const relative = path.win32.relative(binding.rootPath, resolved);
+  if (
+    !relative ||
+    path.win32.isAbsolute(relative) ||
+    relative === ".." ||
+    relative.startsWith(`..${path.win32.sep}`)
+  ) {
+    throw windowsAdapterTempRootChangedError();
+  }
+
+  const segments = relative.split(path.win32.sep).filter(Boolean);
+  let current = binding.rootPath;
+  for (let index = 0; index < segments.length; index += 1) {
+    current = path.win32.join(current, segments[index]);
+    const isTarget = index === segments.length - 1;
+    let stat;
+    try {
+      stat = runtime.fs.lstatSync(current, { bigint: true });
+    } catch (error) {
+      if (isTarget && allowMissing && error?.code === "ENOENT") {
+        return Object.freeze({ exists: false, resolvedPath: resolved });
+      }
+      throw error;
+    }
+    if (
+      windowsPathHasReparseSemantics(stat) ||
+      windowsCanonicalPathKey(windowsNativeRealpath(runtime, current)) !==
+        windowsCanonicalPathKey(current)
+    ) {
+      throw windowsAdapterTempRootChangedError();
+    }
+    if (!isTarget && !stat.isDirectory?.()) {
+      throw windowsAdapterTempRootChangedError();
+    }
+    if (isTarget) {
+      if (
+        (expectedKind === "file" && !stat.isFile?.()) ||
+        (expectedKind === "directory" && !stat.isDirectory?.())
+      ) {
+        throw windowsAdapterTempRootChangedError();
+      }
+      return Object.freeze({
+        exists: true,
+        resolvedPath: resolved,
+        identity:
+          expectedKind === "directory"
+            ? windowsDirectoryIdentity(stat)
+            : windowsFileIdentity(stat),
+      });
+    }
+  }
+  throw windowsAdapterTempRootChangedError();
+}
+
+function assertWindowsAdapterBoundPathIdentity(
+  runtime,
+  targetPath,
+  expectedKind,
+  expectedIdentity,
+) {
+  const inspected = inspectWindowsAdapterBoundPath(
+    runtime,
+    targetPath,
+    expectedKind,
+  );
+  const matches =
+    expectedKind === "directory"
+      ? sameWindowsDirectoryIdentity(inspected.identity, expectedIdentity)
+      : sameWindowsFileIdentity(inspected.identity, expectedIdentity);
+  if (!matches) throw windowsAdapterTempRootChangedError();
+  return inspected;
+}
+
+function resolveWindowsAdapterTempRoot(runtime, runtimeOverrides = {}) {
+  const hasExplicitTmpdir = Object.prototype.hasOwnProperty.call(
+    runtimeOverrides,
+    "tmpdir",
+  );
+  const hasExplicitAdapterRoot = Object.prototype.hasOwnProperty.call(
+    runtimeOverrides,
+    "windowsAdapterTempRoot",
+  );
+  let candidate;
+  try {
+    if (hasExplicitTmpdir) {
+      if (typeof runtime.tmpdir !== "function") return null;
+      candidate = runtime.tmpdir();
+    } else if (hasExplicitAdapterRoot) {
+      candidate = runtimeOverrides.windowsAdapterTempRoot;
+    } else {
+      const environmentRoot =
+        runtime.env?.[WINDOWS_ADAPTER_TEMP_ROOT_ENV] ??
+        process.env[WINDOWS_ADAPTER_TEMP_ROOT_ENV];
+      candidate =
+        environmentRoot === undefined ? runtime.tmpdir() : environmentRoot;
+    }
+  } catch {
+    return null;
+  }
+
+  return inspectWindowsAdapterTempRoot(runtime, candidate);
+}
+
 function normalizeSandboxRequest(profileOrRequest, explicitRequest) {
   const legacyRequest =
     profileOrRequest &&
@@ -788,14 +1117,42 @@ function cleanupWindowsTemporaryPath(
   targetPath,
   attempts = 100,
   delayMs = 10,
+  expectedIdentity = null,
 ) {
   if (!targetPath) return true;
   for (let attempt = 0; attempt < attempts; attempt += 1) {
     try {
+      const inspected = inspectWindowsAdapterBoundPath(
+        runtime,
+        targetPath,
+        "file",
+        { allowMissing: true },
+      );
+      if (!inspected.exists) {
+        assertWindowsAdapterTempRoot(runtime);
+        return true;
+      }
+      if (
+        !expectedIdentity ||
+        !sameWindowsFileIdentity(inspected.identity, expectedIdentity)
+      ) {
+        return false;
+      }
       runtime.fs.unlinkSync(targetPath);
+      assertWindowsAdapterTempRoot(runtime);
       return true;
     } catch (error) {
-      if (error?.code === "ENOENT") return true;
+      if (error?.adapterReason === WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON) {
+        return false;
+      }
+      if (error?.code === "ENOENT") {
+        try {
+          assertWindowsAdapterTempRoot(runtime);
+          return true;
+        } catch {
+          return false;
+        }
+      }
     }
     if (attempt + 1 < attempts) runtime.sleepSync(delayMs);
   }
@@ -806,13 +1163,32 @@ function cleanupOrTrackWindowsTemporaryPath(
   runtime,
   targetPath,
   attempts = 100,
+  entry = null,
+  expectedIdentity = null,
 ) {
-  if (cleanupWindowsTemporaryPath(runtime, targetPath, attempts)) {
+  if (
+    cleanupWindowsTemporaryPath(
+      runtime,
+      targetPath,
+      attempts,
+      10,
+      expectedIdentity,
+    )
+  ) {
+    const residualEntries = new Set();
     for (const residual of [...windowsTemporaryCleanupBacklog]) {
-      if (residual.runtime === runtime && residual.targetPath === targetPath) {
+      if (
+        residual.kind === "file" &&
+        residual.runtime === runtime &&
+        residual.targetPath === targetPath
+      ) {
         windowsTemporaryCleanupBacklog.delete(residual);
+        if (residual.entry) residualEntries.add(residual.entry);
       }
     }
+    for (const residualEntry of residualEntries) {
+      finalizeWindowsTemporaryCleanupEntry(residualEntry);
+    }
     if (
       windowsTemporaryCleanupBacklog.size === 0 &&
       windowsTemporaryCleanupRetryTimer
@@ -822,13 +1198,25 @@ function cleanupOrTrackWindowsTemporaryPath(
     }
     return true;
   }
-  if (
-    ![...windowsTemporaryCleanupBacklog].some(
-      (residual) =>
-        residual.runtime === runtime && residual.targetPath === targetPath,
-    )
-  ) {
-    windowsTemporaryCleanupBacklog.add({ runtime, targetPath });
+  const existing = [...windowsTemporaryCleanupBacklog].find(
+    (residual) =>
+      residual.kind === "file" &&
+      residual.runtime === runtime &&
+      residual.targetPath === targetPath,
+  );
+  if (existing) {
+    if (entry) existing.entry = entry;
+    if (!existing.expectedIdentity && expectedIdentity) {
+      existing.expectedIdentity = expectedIdentity;
+    }
+  } else {
+    windowsTemporaryCleanupBacklog.add({
+      kind: "file",
+      runtime,
+      targetPath,
+      entry,
+      expectedIdentity,
+    });
   }
   registerWindowsAdapterExitCleanup();
   scheduleWindowsTemporaryCleanupRetry();
@@ -838,14 +1226,25 @@ function cleanupOrTrackWindowsTemporaryPath(
 function retryWindowsTemporaryCleanupBacklog(attempts = 100) {
   let cleaned = true;
   for (const residual of [...windowsTemporaryCleanupBacklog]) {
-    if (
-      cleanupWindowsTemporaryPath(
-        residual.runtime,
-        residual.targetPath,
-        attempts,
-      )
-    ) {
+    const residualCleaned =
+      residual.kind === "directory"
+        ? cleanupWindowsTemporaryDirectory(
+            residual.runtime,
+            residual.targetPath,
+            attempts,
+            10,
+            residual.expectedIdentity,
+          )
+        : cleanupWindowsTemporaryPath(
+            residual.runtime,
+            residual.targetPath,
+            attempts,
+            10,
+            residual.expectedIdentity,
+          );
+    if (residualCleaned) {
       windowsTemporaryCleanupBacklog.delete(residual);
+      if (residual.entry) finalizeWindowsTemporaryCleanupEntry(residual.entry);
     } else {
       cleaned = false;
     }
@@ -860,6 +1259,18 @@ function retryWindowsTemporaryCleanupBacklog(attempts = 100) {
   return cleaned;
 }
 
+function finalizeWindowsTemporaryCleanupEntry(entry) {
+  if (
+    [...windowsTemporaryCleanupBacklog].some(
+      (residual) => residual.entry === entry,
+    )
+  ) {
+    return;
+  }
+  entry.cleaned = true;
+  windowsAdapterCacheEntries.delete(entry);
+}
+
 function scheduleWindowsTemporaryCleanupRetry() {
   if (
     windowsTemporaryCleanupRetryTimer ||
@@ -882,20 +1293,112 @@ function cleanupWindowsTemporaryDirectory(
   targetPath,
   attempts = 100,
   delayMs = 10,
+  expectedIdentity = null,
 ) {
   if (!targetPath) return true;
   for (let attempt = 0; attempt < attempts; attempt += 1) {
     try {
+      const inspected = inspectWindowsAdapterBoundPath(
+        runtime,
+        targetPath,
+        "directory",
+        { allowMissing: true },
+      );
+      if (!inspected.exists) {
+        assertWindowsAdapterTempRoot(runtime);
+        return true;
+      }
+      if (
+        !expectedIdentity ||
+        !sameWindowsDirectoryIdentity(inspected.identity, expectedIdentity)
+      ) {
+        return false;
+      }
       runtime.fs.rmdirSync(targetPath);
+      assertWindowsAdapterTempRoot(runtime);
       return true;
     } catch (error) {
-      if (error?.code === "ENOENT") return true;
+      if (error?.adapterReason === WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON) {
+        return false;
+      }
+      if (error?.code === "ENOENT") {
+        try {
+          assertWindowsAdapterTempRoot(runtime);
+          return true;
+        } catch {
+          return false;
+        }
+      }
     }
     if (attempt + 1 < attempts) runtime.sleepSync(delayMs);
   }
   return false;
 }
 
+function cleanupOrTrackWindowsTemporaryDirectory(
+  runtime,
+  targetPath,
+  attempts = 100,
+  entry = null,
+  expectedIdentity = null,
+) {
+  if (
+    cleanupWindowsTemporaryDirectory(
+      runtime,
+      targetPath,
+      attempts,
+      10,
+      expectedIdentity,
+    )
+  ) {
+    const residualEntries = new Set();
+    for (const residual of [...windowsTemporaryCleanupBacklog]) {
+      if (
+        residual.kind === "directory" &&
+        residual.runtime === runtime &&
+        residual.targetPath === targetPath
+      ) {
+        windowsTemporaryCleanupBacklog.delete(residual);
+        if (residual.entry) residualEntries.add(residual.entry);
+      }
+    }
+    for (const residualEntry of residualEntries) {
+      finalizeWindowsTemporaryCleanupEntry(residualEntry);
+    }
+    if (
+      windowsTemporaryCleanupBacklog.size === 0 &&
+      windowsTemporaryCleanupRetryTimer
+    ) {
+      clearTimeout(windowsTemporaryCleanupRetryTimer);
+      windowsTemporaryCleanupRetryTimer = null;
+    }
+    return true;
+  }
+  const existing = [...windowsTemporaryCleanupBacklog].find(
+    (residual) =>
+      residual.kind === "directory" &&
+      residual.runtime === runtime &&
+      residual.targetPath === targetPath,
+  );
+  if (existing) {
+    if (entry) existing.entry = entry;
+    if (!existing.expectedIdentity && expectedIdentity) {
+      existing.expectedIdentity = expectedIdentity;
+    }
+  } else {
+    windowsTemporaryCleanupBacklog.add({
+      kind: "directory",
+      runtime,
+      targetPath,
+      entry,
+      expectedIdentity,
+    });
+  }
+  registerWindowsAdapterExitCleanup();
+  scheduleWindowsTemporaryCleanupRetry();
+  return false;
+}
+
 function sha256(value) {
   return crypto.createHash("sha256").update(value).digest("hex");
 }
@@ -1143,15 +1646,11 @@ function sameWindowsFileIdentity(left, right) {
 }
 
 function inspectWindowsAdapterAssembly(runtime, assemblyPath) {
-  if (typeof runtime.fs.lstatSync === "function") {
-    const linkStat = runtime.fs.lstatSync(assemblyPath, { bigint: true });
-    if (
-      linkStat.isSymbolicLink?.() ||
-      (typeof linkStat.isFile === "function" && !linkStat.isFile())
-    ) {
-      throw new Error("Windows in-memory adapter is not a regular file");
-    }
-  }
+  const boundBefore = inspectWindowsAdapterBoundPath(
+    runtime,
+    assemblyPath,
+    "file",
+  );
   const before = runtime.fs.statSync(assemblyPath, { bigint: true });
   if (typeof before.isFile === "function" && !before.isFile()) {
     throw new Error("Windows in-memory adapter is not a regular file");
@@ -1164,6 +1663,15 @@ function inspectWindowsAdapterAssembly(runtime, assemblyPath) {
   if (!sameWindowsFileIdentity(beforeIdentity, afterIdentity)) {
     throw new Error("Windows in-memory adapter changed during attestation");
   }
+  const boundAfter = assertWindowsAdapterBoundPathIdentity(
+    runtime,
+    assemblyPath,
+    "file",
+    boundBefore.identity,
+  );
+  if (!sameWindowsFileIdentity(afterIdentity, boundAfter.identity)) {
+    throw new Error("Windows in-memory adapter changed during attestation");
+  }
   return { assemblyDigest, fileIdentity: afterIdentity };
 }
 
@@ -1173,6 +1681,11 @@ function verifyWindowsAdapterEntry(entry, runtime, source) {
     entry.cleaned ||
     entry.runtimeFs !== runtime.fs ||
     entry.tempDirectory !== source.tempDirectory ||
+    entry.idleTtlMs !== source.idleTtlMs ||
+    !sameWindowsAdapterTempRootBinding(
+      entry.tempRootBinding,
+      source.tempRootBinding,
+    ) ||
     entry.sourceDigest !== source.sourceDigest ||
     entry.sourceContractDigest !== source.sourceContractDigest ||
     entry.loaderMode !== source.loaderMode
@@ -1180,6 +1693,15 @@ function verifyWindowsAdapterEntry(entry, runtime, source) {
     return false;
   }
   try {
+    assertWindowsAdapterTempRoot(runtime);
+    if (entry.adapterDirectory) {
+      assertWindowsAdapterBoundPathIdentity(
+        runtime,
+        entry.adapterDirectory,
+        "directory",
+        entry.adapterDirectoryIdentity,
+      );
+    }
     const attestation = inspectWindowsAdapterAssembly(
       runtime,
       entry.assemblyPath,
@@ -1203,14 +1725,18 @@ function cleanupWindowsAdapterEntry(entry, attempts = 100) {
     entry.runtime,
     entry.assemblyPath,
     attempts,
+    entry,
+    entry.fileIdentity,
   );
-  const directoryDeleted =
-    deleted &&
-    cleanupWindowsTemporaryDirectory(
-      entry.runtime,
-      entry.adapterDirectory,
-      attempts,
-    );
+  const directoryDeleted = entry.adapterDirectory
+    ? cleanupOrTrackWindowsTemporaryDirectory(
+        entry.runtime,
+        entry.adapterDirectory,
+        attempts,
+        entry,
+        entry.adapterDirectoryIdentity,
+      )
+    : true;
   if (deleted && directoryDeleted) {
     entry.cleaned = true;
     windowsAdapterCacheEntries.delete(entry);
@@ -1253,15 +1779,35 @@ function registerWindowsAdapterExitCleanup() {
  * this hook at a known quiescent point to prove cleanup.
  */
 export function resetWindowsSandboxAdapterCache() {
-  let cleaned = retryWindowsAppContainerCleanupBacklog();
+  const appContainerCleaned = retryWindowsAppContainerCleanupBacklog();
   windowsAdapterCache = null;
   for (const entry of [...windowsAdapterCacheEntries]) {
     entry.retired = true;
     entry.refCount = 0;
-    if (!cleanupWindowsAdapterEntry(entry)) cleaned = false;
+    cleanupWindowsAdapterEntry(entry);
   }
-  if (!retryWindowsTemporaryCleanupBacklog()) cleaned = false;
-  return cleaned;
+  retryWindowsTemporaryCleanupBacklog();
+  return (
+    appContainerCleaned &&
+    windowsTemporaryCleanupBacklog.size === 0 &&
+    windowsAdapterCacheEntries.size === 0
+  );
+}
+
+function normalizeWindowsAdapterIdleTtlMs(runtime) {
+  const explicitTtl = runtime.windowsAdapterIdleTtlMs;
+  const environmentTtl =
+    runtime.env?.[WINDOWS_ADAPTER_IDLE_TTL_ENV] ??
+    process.env[WINDOWS_ADAPTER_IDLE_TTL_ENV];
+  const configuredTtl =
+    explicitTtl === undefined ? environmentTtl : explicitTtl;
+  const numericTtl =
+    configuredTtl === "" || configuredTtl === null
+      ? Number.NaN
+      : Number(configuredTtl);
+  return Number.isFinite(numericTtl) && numericTtl >= 0
+    ? numericTtl
+    : WINDOWS_ADAPTER_IDLE_TTL_MS;
 }
 
 function scheduleWindowsAdapterIdleCleanup(entry) {
@@ -1273,11 +1819,11 @@ function scheduleWindowsAdapterIdleCleanup(entry) {
   ) {
     return;
   }
-  const configuredTtl = Number(entry.runtime.windowsAdapterIdleTtlMs);
-  const idleTtlMs =
-    Number.isFinite(configuredTtl) && configuredTtl >= 0
-      ? configuredTtl
-      : WINDOWS_ADAPTER_IDLE_TTL_MS;
+  const idleTtlMs = entry.idleTtlMs;
+  if (idleTtlMs === 0) {
+    retireWindowsAdapterEntry(entry);
+    return;
+  }
   entry.idleTimer = setTimeout(() => {
     entry.idleTimer = null;
     if (
@@ -1293,6 +1839,7 @@ function scheduleWindowsAdapterIdleCleanup(entry) {
 }
 
 function loadWindowsAdapterSource(runtime, loaderMode) {
+  const tempRootBinding = assertWindowsAdapterTempRoot(runtime);
   const bundled = runtime.windowsAdapterContent === undefined;
   const content = bundled
     ? loaderMode === "managed-executable"
@@ -1307,7 +1854,10 @@ function loadWindowsAdapterSource(runtime, loaderMode) {
         : WINDOWS_SANDBOX_HELPER_ASSEMBLY_DIGEST
       : sha256(content),
     sourceContractDigest: bundled ? WINDOWS_SANDBOX_HELPER_SOURCE_DIGEST : null,
-    tempDirectory: runtime.tmpdir(),
+    tempDirectory: tempRootBinding.rootPath,
+    tempRootBinding,
+    tempRootAttestation: tempRootBinding.attestation,
+    idleTtlMs: runtime.windowsAdapterIdleTtlMs,
     loaderMode,
   };
 }
@@ -1329,54 +1879,121 @@ function materializeWindowsAdapter(runtime, source) {
   const assemblyPath = runtime.joinPath(
     adapterDirectory || source.tempDirectory,
     source.loaderMode === "managed-executable"
-      ? "windows-sandbox-helper.exe"
+      ? WINDOWS_ADAPTER_HELPER_NAME
       : `${adapterBaseName}.dll`,
   );
-  if (
-    (adapterDirectory && runtime.fs.existsSync(adapterDirectory)) ||
-    runtime.fs.existsSync(assemblyPath)
-  ) {
-    return { reason: "windows_native_adapter_random_path_collision" };
-  }
+  let adapterDirectoryIdentity = null;
+  let assemblyFileIdentity = null;
   try {
+    assertWindowsAdapterTempRoot(runtime);
     if (adapterDirectory) {
+      if (
+        inspectWindowsAdapterBoundPath(runtime, adapterDirectory, "directory", {
+          allowMissing: true,
+        }).exists
+      ) {
+        return { reason: "windows_native_adapter_random_path_collision" };
+      }
       runtime.fs.mkdirSync(adapterDirectory, {
         mode: 0o700,
         recursive: false,
       });
+      adapterDirectoryIdentity = inspectWindowsAdapterBoundPath(
+        runtime,
+        adapterDirectory,
+        "directory",
+      ).identity;
+    }
+    if (
+      inspectWindowsAdapterBoundPath(runtime, assemblyPath, "file", {
+        allowMissing: true,
+      }).exists
+    ) {
+      const collision = new Error(
+        "Windows native adapter random path collision",
+      );
+      collision.code = "EEXIST";
+      throw collision;
     }
     runtime.fs.writeFileSync(assemblyPath, source.content, {
       mode: adapterDirectory ? 0o500 : 0o600,
       flag: "wx",
     });
+    assemblyFileIdentity = inspectWindowsAdapterAssembly(
+      runtime,
+      assemblyPath,
+    ).fileIdentity;
   } catch (error) {
+    if (error?.code === "EEXIST") {
+      const directoryDeleted = cleanupOrTrackWindowsTemporaryDirectory(
+        runtime,
+        adapterDirectory,
+        100,
+        null,
+        adapterDirectoryIdentity,
+      );
+      return {
+        reason: directoryDeleted
+          ? "windows_native_adapter_random_path_collision"
+          : "windows_native_adapter_compile_cleanup_unverified",
+      };
+    }
+    if (!assemblyFileIdentity) {
+      try {
+        const inspected = inspectWindowsAdapterBoundPath(
+          runtime,
+          assemblyPath,
+          "file",
+          { allowMissing: true },
+        );
+        assemblyFileIdentity = inspected.exists ? inspected.identity : null;
+      } catch {
+        assemblyFileIdentity = null;
+      }
+    }
     const assemblyDeleted = cleanupOrTrackWindowsTemporaryPath(
       runtime,
       assemblyPath,
+      100,
+      null,
+      assemblyFileIdentity,
+    );
+    const directoryDeleted = cleanupOrTrackWindowsTemporaryDirectory(
+      runtime,
+      adapterDirectory,
+      100,
+      null,
+      adapterDirectoryIdentity,
     );
-    const directoryDeleted =
-      assemblyDeleted &&
-      cleanupWindowsTemporaryDirectory(runtime, adapterDirectory);
+    if (error?.adapterReason === WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON) {
+      return { reason: WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON };
+    }
     if (!assemblyDeleted || !directoryDeleted) {
       return { reason: "windows_native_adapter_compile_cleanup_unverified" };
     }
-    if (error?.code === "EEXIST") {
-      return { reason: "windows_native_adapter_random_path_collision" };
-    }
     return { reason: "windows_native_adapter_materialize_failed" };
   }
   return {
     adapterDirectory,
+    adapterDirectoryIdentity,
     assemblyPath,
+    assemblyFileIdentity,
     cleanupAssembly: () => {
       const assemblyDeleted = cleanupOrTrackWindowsTemporaryPath(
         runtime,
         assemblyPath,
+        100,
+        null,
+        assemblyFileIdentity,
       );
-      return (
-        assemblyDeleted &&
-        cleanupWindowsTemporaryDirectory(runtime, adapterDirectory)
+      const directoryDeleted = cleanupOrTrackWindowsTemporaryDirectory(
+        runtime,
+        adapterDirectory,
+        100,
+        null,
+        adapterDirectoryIdentity,
       );
+      return assemblyDeleted && directoryDeleted;
     },
   };
 }
@@ -1388,9 +2005,7 @@ function materializeWindowsAdapterInvocation(runtime, helperArgs) {
       .randomBytes(24)
       .toString("hex")}.json`,
   );
-  if (runtime.fs.existsSync(payloadPath)) {
-    return { reason: "windows_adapter_invocation_random_path_collision" };
-  }
+  let fileIdentity = null;
   let content;
   try {
     content = Buffer.from(
@@ -1410,16 +2025,57 @@ function materializeWindowsAdapterInvocation(runtime, helperArgs) {
     return { reason: "windows_adapter_invocation_too_large" };
   }
   try {
+    if (
+      inspectWindowsAdapterBoundPath(runtime, payloadPath, "file", {
+        allowMissing: true,
+      }).exists
+    ) {
+      return { reason: "windows_adapter_invocation_random_path_collision" };
+    }
     runtime.fs.writeFileSync(payloadPath, content, {
       mode: 0o600,
       flag: "wx",
     });
+    const inspected = inspectWindowsAdapterAssembly(runtime, payloadPath);
+    if (inspected.assemblyDigest !== sha256(content)) {
+      throw new Error("Windows adapter invocation changed after creation");
+    }
+    fileIdentity = inspected.fileIdentity;
   } catch (error) {
+    if (!fileIdentity) {
+      try {
+        const inspected = inspectWindowsAdapterBoundPath(
+          runtime,
+          payloadPath,
+          "file",
+          { allowMissing: true },
+        );
+        fileIdentity = inspected.exists ? inspected.identity : null;
+      } catch {
+        fileIdentity = null;
+      }
+    }
+    if (error?.adapterReason === WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON) {
+      cleanupOrTrackWindowsTemporaryPath(
+        runtime,
+        payloadPath,
+        100,
+        null,
+        fileIdentity,
+      );
+      return { reason: WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON };
+    }
     if (error?.code === "EEXIST") {
       return { reason: "windows_adapter_invocation_random_path_collision" };
     }
     return {
-      reason: cleanupOrTrackWindowsTemporaryPath(runtime, payloadPath)
+      reason: cleanupOrTrackWindowsTemporaryPath(
+        runtime,
+        payloadPath,
+        100,
+        null,
+        fileIdentity,
+      )
         ? "windows_adapter_invocation_materialize_failed"
         : "windows_adapter_invocation_cleanup_unverified",
     };
@@ -1427,7 +2083,24 @@ function materializeWindowsAdapterInvocation(runtime, helperArgs) {
   return {
     payloadPath,
     payloadDigest: sha256(content),
-    cleanup: () => cleanupOrTrackWindowsTemporaryPath(runtime, payloadPath),
+    fileIdentity,
+    verify: () => {
+      const inspected = assertWindowsAdapterBoundPathIdentity(
+        runtime,
+        payloadPath,
+        "file",
+        fileIdentity,
+      );
+      return inspected.exists;
+    },
+    cleanup: () =>
+      cleanupOrTrackWindowsTemporaryPath(
+        runtime,
+        payloadPath,
+        100,
+        null,
+        fileIdentity,
+      ),
   };
 }
 
@@ -1483,6 +2156,7 @@ function buildWindowsAdapterInvocation(entry, invocation) {
         invocation.payloadPath,
         invocation.payloadDigest,
       ],
+      verify: invocation.verify,
       cleanup: invocation.cleanup,
     };
   }
@@ -1497,6 +2171,7 @@ function buildWindowsAdapterInvocation(entry, invocation) {
       "-EncodedCommand",
       windowsPowerShellBootstrap(entry, invocation),
     ],
+    verify: invocation.verify,
     cleanup: invocation.cleanup,
   };
 }
@@ -1583,11 +2258,14 @@ function createFreshWindowsAdapter(runtime, source, hostEnvironment) {
     runtime,
     runtimeFs: runtime.fs,
     tempDirectory: source.tempDirectory,
+    tempRootBinding: source.tempRootBinding,
+    idleTtlMs: source.idleTtlMs,
     sourceDigest: source.sourceDigest,
     sourceContractDigest: source.sourceContractDigest,
     loaderMode: source.loaderMode,
     powershellPath: powershellHosts[0] || null,
     adapterDirectory: materialized.adapterDirectory,
+    adapterDirectoryIdentity: materialized.adapterDirectoryIdentity,
     assemblyPath: materialized.assemblyPath,
     assemblyDigest: attestation.assemblyDigest,
     fileIdentity: attestation.fileIdentity,
@@ -1743,7 +2421,9 @@ function createWindowsAdapterController(runtime, source, hostEnvironment) {
       error.adapterReason = payload.reason;
       throw error;
     }
-    return buildWindowsAdapterInvocation(entry, payload);
+    const invocation = buildWindowsAdapterInvocation(entry, payload);
+    invocation.verify();
+    return invocation;
   };
 
   return {
@@ -1754,6 +2434,7 @@ function createWindowsAdapterController(runtime, source, hostEnvironment) {
       let result;
       let failure;
       try {
+        invocation.verify();
         result = runtime.spawnSync(invocation.command, invocation.args, {
           ...options,
           cwd: runtime.joinPath(runtime.windowsDir(), "System32"),
@@ -1781,20 +2462,40 @@ function createWindowsAdapterController(runtime, source, hostEnvironment) {
   };
 }
 
+function readWindowsAdapterBoundFile(runtime, filePath, encoding = null) {
+  const before = inspectWindowsAdapterBoundPath(runtime, filePath, "file");
+  const content = runtime.fs.readFileSync(filePath, encoding || undefined);
+  const after = assertWindowsAdapterBoundPathIdentity(
+    runtime,
+    filePath,
+    "file",
+    before.identity,
+  );
+  if (!sameWindowsFileIdentity(before.identity, after.identity)) {
+    throw windowsAdapterTempRootChangedError();
+  }
+  return { content, fileIdentity: after.identity };
+}
+
 function waitForWindowsTargetIdentity(
   proc,
   identityPath,
   runtime,
   expectedAppContainer = null,
   timeoutMs = 30_000,
+  onIdentityFileAttested = null,
 ) {
   const deadline = runtime.now() + timeoutMs;
   let lastError;
   while (runtime.now() < deadline) {
     try {
-      const identity = JSON.parse(
-        runtime.fs.readFileSync(identityPath, "utf8"),
+      const identityFile = readWindowsAdapterBoundFile(
+        runtime,
+        identityPath,
+        "utf8",
       );
+      onIdentityFileAttested?.(identityFile.fileIdentity);
+      const identity = JSON.parse(identityFile.content);
       if (identity?.error) {
         throw new Error(
           `Windows sandbox helper rejected the target: ${identity.error}`,
@@ -1846,6 +2547,7 @@ function waitForWindowsTargetIdentity(
         proc.sandboxAppContainerProfile =
           expectedAppContainer.appContainerProfileName;
         proc.sandboxAppContainerSid = expectedAppContainer.appContainerSid;
+        proc.sandboxAppContainerCapabilityCount = identity.capabilityCount;
       }
       // ChildProcess.pid is a writable data property. The native ChildProcess
       // handle still points at the helper, so kill()/ref()/unref() retain Job
@@ -2049,6 +2751,7 @@ function appContainerReadinessResult(
       ...runtimeProbe,
       runnable: true,
       reason: null,
+      capabilityCount: readiness.capabilityCount,
       ...(targetRuntime
         ? {
             probeRuntime: targetRuntime,
@@ -2610,11 +3313,33 @@ export function applyWindowsSandbox(
   ) {
     return unavailablePlan("windows_git_nested_process_compatibility");
   }
+  const windowsAdapterTempRootBinding = resolveWindowsAdapterTempRoot(
+    runtime,
+    runtimeOverrides,
+  );
+  if (!windowsAdapterTempRootBinding) {
+    return unavailablePlan(WINDOWS_ADAPTER_TEMP_ROOT_UNTRUSTED_REASON);
+  }
+  const windowsAdapterIdleTtlMs = normalizeWindowsAdapterIdleTtlMs(runtime);
+  runtime = {
+    ...runtime,
+    windowsAdapterTempRoot: windowsAdapterTempRootBinding.rootPath,
+    windowsAdapterTempRootBinding,
+    windowsAdapterIdleTtlMs,
+    tmpdir: () => windowsAdapterTempRootBinding.rootPath,
+  };
   const loaderMode =
     profile !== "strict" && !requiresAppContainer && !entrySnapshot.locks
       ? "managed-executable"
       : "powershell-byte-assembly";
-  const adapterSource = loadWindowsAdapterSource(runtime, loaderMode);
+  let adapterSource;
+  try {
+    adapterSource = loadWindowsAdapterSource(runtime, loaderMode);
+  } catch (error) {
+    return unavailablePlan(
+      error?.adapterReason || WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON,
+    );
+  }
   if (!adapterSource.content) {
     return unavailablePlan(adapterSource.reason);
   }
@@ -2659,6 +3384,22 @@ export function applyWindowsSandbox(
             .toString("hex")}.json`,
         )
       : null;
+  let identityFileIdentity = null;
+  if (identityPath) {
+    try {
+      if (
+        inspectWindowsAdapterBoundPath(runtime, identityPath, "file", {
+          allowMissing: true,
+        }).exists
+      ) {
+        return unavailablePlan("windows_identity_random_path_collision");
+      }
+    } catch (error) {
+      return unavailablePlan(
+        error?.adapterReason || WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON,
+      );
+    }
+  }
   const launchSpec = {
     cpuSeconds: Number(limits.cpu || 0),
     processMemoryBytes: Number(
@@ -2699,7 +3440,13 @@ export function applyWindowsSandbox(
   if (identityPath) launchSpec.identityPath = identityPath;
   const cleanupIdentity = () => {
     if (!identityPath) return true;
-    return cleanupOrTrackWindowsTemporaryPath(runtime, identityPath);
+    return cleanupOrTrackWindowsTemporaryPath(
+      runtime,
+      identityPath,
+      100,
+      null,
+      identityFileIdentity,
+    );
   };
   const appContainerProfileName = requiresAppContainer
     ? `ChainlessChain.CliSandbox.${runtime.randomBytes(12).toString("hex")}`
@@ -2973,6 +3720,10 @@ export function applyWindowsSandbox(
               identityPath,
               runtime,
               appContainer,
+              30_000,
+              (fileIdentity) => {
+                identityFileIdentity = fileIdentity;
+              },
             );
             if (!cleanupIdentity()) {
               throw new Error(
@@ -3064,6 +3815,7 @@ export function applyWindowsSandbox(
     enforcement: backend,
     policyAttested: requiresAppContainer ? true : null,
     policyDigest: appContainerPolicyDigest,
+    adapterTempRootAttestation: adapterSource.tempRootAttestation,
     runtimeProbe: entrySnapshotRuntimeProbe,
     guarantees: [
       ...(requiresAppContainer
@@ -3130,6 +3882,7 @@ function linuxBubblewrapProbe(
   supervisorBinding = null,
   pluginTreeSnapshot = null,
   nativeDynamicClosure = null,
+  runtimeDetachedChildSpawnVerified = false,
 ) {
   const native =
     typeof targetRuntime === "string" && targetRuntime.startsWith("native-");
@@ -3143,13 +3896,12 @@ function linuxBubblewrapProbe(
   const supervisorDescriptorBound =
     supervisorBinding?.mechanism === LINUX_BWRAP_SUPERVISOR_BINDING_MECHANISM;
   const pluginTreeContentSnapshot =
-    !native &&
     attempted &&
     snapshot &&
     runnable &&
     reason === null &&
     supervisorDescriptorBound &&
-    pluginTreeSnapshot?.scope === LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE &&
+    pluginTreeSnapshot?.scope === LINUX_PLUGIN_TREE_SNAPSHOT_SCOPE &&
     pluginTreeSnapshot?.mechanism === LINUX_ENTRY_SNAPSHOT_MECHANISM &&
     Number.isSafeInteger(pluginTreeSnapshot?.files) &&
     pluginTreeSnapshot.files > 0 &&
@@ -3160,7 +3912,7 @@ function linuxBubblewrapProbe(
     typeof pluginTreeSnapshot?.digest === "string" &&
     /^[a-f0-9]{64}$/.test(pluginTreeSnapshot.digest) &&
     pluginTreeSnapshot?.consistency ===
-      LINUX_NODE_PLUGIN_TREE_SNAPSHOT_CONSISTENCY &&
+      LINUX_PLUGIN_TREE_SNAPSHOT_CONSISTENCY &&
     pluginTreeSnapshot?.contractBound === false &&
     pluginTreeSnapshot?.atomic === false;
   const initialDynamicLoadClosureDescriptorBound =
@@ -3196,6 +3948,7 @@ function linuxBubblewrapProbe(
     reason,
     probeRuntime: "node",
     targetRuntime,
+    runtimeDetachedChildSpawnVerified,
     contentSnapshot: snapshot,
     ...(snapshot
       ? {
@@ -3775,16 +4528,20 @@ function linuxEntrySnapshotContract(targetRuntime) {
   throw new Error("entry_snapshot_runtime_unsupported");
 }
 
-function linuxNodePluginTreeFileSnapshotContract(sourceMode) {
+function linuxPluginTreeFileSnapshotContract(sourceMode, targetRuntime) {
+  const native = targetRuntime?.startsWith("native-");
+  const errorPrefix = native
+    ? "native_plugin_tree_snapshot"
+    : "node_plugin_tree_snapshot";
   if (!Number.isSafeInteger(sourceMode) || sourceMode < 0) {
-    throw new Error("node_plugin_tree_snapshot_source_mode_invalid");
+    throw new Error(`${errorPrefix}_source_mode_invalid`);
   }
   return {
-    scope: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE,
+    scope: LINUX_PLUGIN_TREE_SNAPSHOT_SCOPE,
     targetMode: (sourceMode & 0o111) !== 0 ? "0500" : "0400",
     sourceMode: LINUX_ENTRY_SNAPSHOT_SOURCE_MODE,
     minimumBytes: 0,
-    errorPrefix: "node_plugin_tree_snapshot",
+    errorPrefix,
   };
 }
 
@@ -3865,9 +4622,9 @@ function createLinuxRegularFileSnapshot(
       throw snapshotError("source_changed");
     }
     if (
-      snapshotContract.scope === LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE &&
+      snapshotContract.scope === LINUX_PLUGIN_TREE_SNAPSHOT_SCOPE &&
       snapshotContract.targetMode !==
-        linuxNodePluginTreeFileSnapshotContract(sourceFileMode).targetMode
+        ((sourceFileMode & 0o111) !== 0 ? "0500" : "0400")
     ) {
       throw snapshotError("source_mode_changed");
     }
@@ -4328,7 +5085,21 @@ function applyLinuxMcpCapsuleCodeSnapshot(
   });
 }
 
-function buildLinuxNodePluginTreeSnapshotAttestation(mounts, entryDestination) {
+/**
+ * Bind the synthetic plugin tree to the anonymous content snapshots mounted
+ * for launch. Directory membership is fixed by pinLinuxPluginTree; contents
+ * are copied and sealed per file, so the evidence deliberately remains
+ * `atomic: false` rather than claiming one filesystem-wide transaction.
+ */
+function buildLinuxPluginTreeSnapshotAttestation(
+  mounts,
+  entryDestination,
+  targetRuntime,
+) {
+  const native = targetRuntime?.startsWith("native-");
+  const errorPrefix = native
+    ? "native_plugin_tree_snapshot"
+    : "node_plugin_tree_snapshot";
   const members = [];
   const destinations = new Set();
   for (const mount of mounts || []) {
@@ -4337,18 +5108,23 @@ function buildLinuxNodePluginTreeSnapshotAttestation(mounts, entryDestination) {
       path.posix.normalize(mount.destination) !== mount.destination ||
       destinations.has(mount.destination)
     ) {
-      throw new Error("node_plugin_tree_snapshot_destination_invalid");
+      throw new Error(`${errorPrefix}_destination_invalid`);
     }
     destinations.add(mount.destination);
     const snapshot = mount.contentSnapshot;
     const entry = mount.destination === entryDestination;
     const expectedScope = entry
-      ? LINUX_NODE_ENTRY_SNAPSHOT_SCOPE
-      : LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE;
+      ? native
+        ? LINUX_NATIVE_ENTRY_SNAPSHOT_SCOPE
+        : LINUX_NODE_ENTRY_SNAPSHOT_SCOPE
+      : LINUX_PLUGIN_TREE_SNAPSHOT_SCOPE;
     const sourceMode = Number.parseInt(snapshot?.sourceFileMode, 8);
     const expectedTargetMode = entry
-      ? LINUX_NODE_ENTRY_SNAPSHOT_TARGET_MODE
-      : linuxNodePluginTreeFileSnapshotContract(sourceMode).targetMode;
+      ? native
+        ? LINUX_NATIVE_ENTRY_SNAPSHOT_TARGET_MODE
+        : LINUX_NODE_ENTRY_SNAPSHOT_TARGET_MODE
+      : linuxPluginTreeFileSnapshotContract(sourceMode, targetRuntime)
+          .targetMode;
     if (
       snapshot?.scope !== expectedScope ||
       snapshot?.mechanism !== LINUX_ENTRY_SNAPSHOT_MECHANISM ||
@@ -4371,7 +5147,7 @@ function buildLinuxNodePluginTreeSnapshotAttestation(mounts, entryDestination) {
       mount.mountMode !== "ro-bind-data" ||
       mount.mountPermissions !== expectedTargetMode
     ) {
-      throw new Error("node_plugin_tree_snapshot_member_invalid");
+      throw new Error(`${errorPrefix}_member_invalid`);
     }
     members.push({
       destination: mount.destination,
@@ -4398,58 +5174,66 @@ function buildLinuxNodePluginTreeSnapshotAttestation(mounts, entryDestination) {
     members.length > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_FILES ||
     !members.some((member) => member.destination === entryDestination)
   ) {
-    throw new Error("node_plugin_tree_snapshot_file_count_invalid");
+    throw new Error(`${errorPrefix}_file_count_invalid`);
   }
   const bytes = members.reduce((total, member) => total + member.bytes, 0);
   if (
     !Number.isSafeInteger(bytes) ||
     bytes > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_BYTES
   ) {
-    throw new Error("node_plugin_tree_snapshot_bytes_exceeded");
+    throw new Error(`${errorPrefix}_bytes_exceeded`);
   }
   const digest = crypto
     .createHash("sha256")
     .update(
       JSON.stringify({
         version: 1,
-        scope: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE,
-        consistency: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_CONSISTENCY,
+        scope: LINUX_PLUGIN_TREE_SNAPSHOT_SCOPE,
+        ...(native ? { targetRuntime } : {}),
+        consistency: LINUX_PLUGIN_TREE_SNAPSHOT_CONSISTENCY,
         members,
       }),
     )
     .digest("hex");
   return Object.freeze({
-    scope: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE,
+    scope: LINUX_PLUGIN_TREE_SNAPSHOT_SCOPE,
     mechanism: LINUX_ENTRY_SNAPSHOT_MECHANISM,
     files: members.length,
     bytes,
     digest,
-    consistency: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_CONSISTENCY,
+    consistency: LINUX_PLUGIN_TREE_SNAPSHOT_CONSISTENCY,
     contractBound: false,
     atomic: false,
   });
 }
 
-function attestLinuxNodePluginTreeSnapshot(
+function attestLinuxPluginTreeSnapshot(
   runtime,
   mounts,
   entryDestination,
+  targetRuntime,
   expected,
 ) {
+  const native = targetRuntime?.startsWith("native-");
+  const errorPrefix = native
+    ? "native_plugin_tree_snapshot"
+    : "node_plugin_tree_snapshot";
   for (const mount of mounts || []) {
     if (!linuxPathWithin("/opt/chainless/plugin", mount?.destination)) continue;
     const snapshot = mount.contentSnapshot;
     const contract =
       mount.destination === entryDestination
-        ? linuxEntrySnapshotContract("node")
-        : linuxNodePluginTreeFileSnapshotContract(
+        ? linuxEntrySnapshotContract(targetRuntime)
+        : linuxPluginTreeFileSnapshotContract(
             Number.parseInt(snapshot?.sourceFileMode, 8),
+            targetRuntime,
           );
     attestLinuxRegularFileSnapshot(runtime, mount, snapshot, contract);
   }
-  const actual = buildLinuxNodePluginTreeSnapshotAttestation(
+  const actual = buildLinuxPluginTreeSnapshotAttestation(
     mounts,
     entryDestination,
+    targetRuntime,
   );
   for (const field of [
     "scope",
@@ -4462,7 +5246,7 @@ function attestLinuxNodePluginTreeSnapshot(
     "atomic",
   ]) {
     if (actual[field] !== expected?.[field]) {
-      throw new Error("node_plugin_tree_snapshot_identity_changed");
+      throw new Error(`${errorPrefix}_identity_changed`);
     }
   }
 }
@@ -6014,8 +6798,22 @@ function probeLinuxBubblewrapPolicy(
     ino: supervisorBinding.fileId.ino,
     bytes: supervisorBinding.bytes,
   });
+  const childProbeSource = [
+    'const fs = require("node:fs");',
+    "const sentinel = process.argv[1];",
+    'const raw = fs.readFileSync("/proc/self/stat", "utf8");',
+    'const close = raw.lastIndexOf(")");',
+    'const pid = Number(raw.slice(0, raw.indexOf(" ")));',
+    "const fields = raw.slice(close + 2).trim().split(/\\s+/);",
+    "const processGroupPid = Number(fields[2]);",
+    "const sessionPid = Number(fields[3]);",
+    "fs.writeSync(1, JSON.stringify({ sentinel, pid, processGroupPid, sessionPid }));",
+    "if (processGroupPid !== pid || sessionPid !== pid) process.exit(2);",
+  ].join("\n");
   const probeSource = [
     'const fs = require("node:fs");',
+    'const crypto = require("node:crypto");',
+    'const { spawnSync } = require("node:child_process");',
     `const expected = ${supervisorIdentity};`,
     'for (const name of fs.readdirSync("/proc/self/fd")) {',
     "  let current;",
@@ -6032,10 +6830,62 @@ function probeLinuxBubblewrapPolicy(
     "} catch (error) {",
     '  if (error?.code !== "ENOENT") throw error;',
     "}",
+    "// /tmp is a fresh private bwrap tmpfs; read the same O_EXCL inode by fd.",
+    'const childReportPath = "/tmp/.chainless-runtime-child-probe.json";',
+    `const expectedChildSentinel = ${JSON.stringify(
+      `${LINUX_BWRAP_CHILD_RUNTIME_PROBE_SENTINEL}:`,
+    )} + crypto.randomBytes(16).toString("hex");`,
+    "let reportFd;",
+    "let runtimeDetachedChildSpawnVerified = false;",
+    "try {",
+    '  reportFd = fs.openSync(childReportPath, "wx+", 0o600);',
+    `  const child = spawnSync("/opt/chainless/runtime/node", ["-e", ${JSON.stringify(
+      childProbeSource,
+    )}, expectedChildSentinel], {`,
+    '    cwd: "/",',
+    "    detached: true,",
+    "    env: process.env,",
+    "    shell: false,",
+    '    stdio: ["ignore", reportFd, "ignore"],',
+    "    timeout: 5_000,",
+    "  });",
+    "  const reportStat = fs.fstatSync(reportFd);",
+    "  const reportBytes = Number(reportStat.size);",
+    "  if (!child.error && child.status === 0 && child.signal === null &&",
+    "      Number.isSafeInteger(child.pid) && child.pid > 0 &&",
+    "      reportStat.isFile() && Number.isSafeInteger(reportBytes) &&",
+    "      reportBytes > 0 && reportBytes <= 1_024) {",
+    "    const reportBuffer = Buffer.alloc(reportBytes);",
+    "    const reportRead = fs.readSync(reportFd, reportBuffer, 0, reportBytes, 0);",
+    "    if (reportRead === reportBytes) {",
+    '      const reportText = reportBuffer.toString("utf8");',
+    "      const report = JSON.parse(reportText);",
+    "      const canonicalReport = JSON.stringify({ sentinel: report.sentinel,",
+    "        pid: report.pid, processGroupPid: report.processGroupPid,",
+    "        sessionPid: report.sessionPid });",
+    "      runtimeDetachedChildSpawnVerified = reportText === canonicalReport &&",
+    "        report.sentinel === expectedChildSentinel &&",
+    "        Number.isSafeInteger(report.pid) && report.pid > 0 &&",
+    "        report.pid === child.pid && report.processGroupPid === report.pid &&",
+    "        report.sessionPid === report.pid;",
+    "    }",
+    "  }",
+    "} catch {} finally {",
+    "  try { if (Number.isInteger(reportFd)) fs.closeSync(reportFd); } catch {",
+    "    runtimeDetachedChildSpawnVerified = false;",
+    "  }",
+    "  try { fs.unlinkSync(childReportPath); } catch {",
+    "    runtimeDetachedChildSpawnVerified = false;",
+    "  }",
+    "}",
+    `if (!runtimeDetachedChildSpawnVerified) process.exit(${LINUX_BWRAP_CHILD_RUNTIME_PROBE_FAILURE_STATUS});`,
     `process.stdout.write(${JSON.stringify(LINUX_BWRAP_NODE_PROBE_SENTINEL)});`,
   ].join("\n");
   let result;
   try {
+    // These pipes connect the host Broker to bwrap and are created before
+    // bwrap installs the target seccomp filter. The nested runtime probe above
+    // inherits a regular-file descriptor and never requests UV_CREATE_PIPE.
     result = runtime.spawnSync(
       supervisorLaunch.command,
       [...policyArgs, "--", "/opt/chainless/runtime/node", "-e", probeSource],
@@ -6069,7 +6919,11 @@ function probeLinuxBubblewrapPolicy(
     return linuxBubblewrapProbe(
       true,
       false,
-      result?.error ? "probe_spawn_failed" : "probe_failed",
+      result?.error
+        ? "probe_spawn_failed"
+        : result?.status === LINUX_BWRAP_CHILD_RUNTIME_PROBE_FAILURE_STATUS
+          ? "detached_child_runtime_probe_failed"
+          : "probe_failed",
       targetRuntime,
       contentSnapshot,
       supervisorBinding,
@@ -6092,6 +6946,9 @@ function probeLinuxBubblewrapPolicy(
     targetRuntime,
     contentSnapshot,
     supervisorBinding,
+    null,
+    null,
+    true,
   );
 }
 
@@ -6360,30 +7217,33 @@ export function applyLinuxSandbox(
       const rawPluginMounts = pluginMountIndexes.map(
         (index) => pinnedMounts[index],
       );
-      if (validation.entryRuntime === "node") {
-        if (
-          pluginMountIndexes.length < 1 ||
-          pluginMountIndexes.length > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_FILES
-        ) {
-          throw new Error("node_plugin_tree_snapshot_file_count_invalid");
-        }
-        const pluginBytes = pluginMountIndexes.reduce((total, index) => {
-          const bytes = pinnedMounts[index]?.bytes;
-          if (
-            !Number.isSafeInteger(bytes) ||
-            bytes < 0 ||
-            bytes > LINUX_ATTESTED_FILE_MAX_BYTES
-          ) {
-            throw new Error("node_plugin_tree_snapshot_member_size_invalid");
-          }
-          return total + bytes;
-        }, 0);
+      const pluginSnapshotErrorPrefix = validation.entryRuntime.startsWith(
+        "native-",
+      )
+        ? "native_plugin_tree_snapshot"
+        : "node_plugin_tree_snapshot";
+      if (
+        pluginMountIndexes.length < 1 ||
+        pluginMountIndexes.length > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_FILES
+      ) {
+        throw new Error(`${pluginSnapshotErrorPrefix}_file_count_invalid`);
+      }
+      const pluginBytes = pluginMountIndexes.reduce((total, index) => {
+        const bytes = pinnedMounts[index]?.bytes;
         if (
-          !Number.isSafeInteger(pluginBytes) ||
-          pluginBytes > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_BYTES
+          !Number.isSafeInteger(bytes) ||
+          bytes < 0 ||
+          bytes > LINUX_ATTESTED_FILE_MAX_BYTES
         ) {
-          throw new Error("node_plugin_tree_snapshot_bytes_exceeded");
+          throw new Error(`${pluginSnapshotErrorPrefix}_member_size_invalid`);
         }
+        return total + bytes;
+      }, 0);
+      if (
+        !Number.isSafeInteger(pluginBytes) ||
+        pluginBytes > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_BYTES
+      ) {
+        throw new Error(`${pluginSnapshotErrorPrefix}_bytes_exceeded`);
       }
       const rawEntryMount = entryMount;
       const snapshot = createLinuxEntrySnapshot(
@@ -6397,37 +7257,36 @@ export function applyLinuxSandbox(
       finalMounts[entryIndex] = snapshot.finalMount;
       probeMounts[entryIndex] = snapshot.probeMount;
       entrySnapshot = snapshot;
-      if (validation.entryRuntime === "node") {
-        for (const index of pluginMountIndexes) {
-          if (index === entryIndex) continue;
-          const rawMount = pinnedMounts[index];
-          const source = runtime.fs.fstatSync(rawMount.fd);
-          const fileSnapshot = createLinuxRegularFileSnapshot(
-            runtime,
-            rawMount,
-            {
-              fileId: rawMount.fileId,
-              bytes: rawMount.bytes,
-              mtimeMs: rawMount.mtimeMs,
-            },
-            linuxNodePluginTreeFileSnapshotContract(Number(source.mode)),
-          );
-          pluginTreeFileSnapshots.push(fileSnapshot);
-          finalMounts[index] = fileSnapshot.finalMount;
-          probeMounts[index] = fileSnapshot.probeMount;
-        }
-        pluginTreeSnapshot = buildLinuxNodePluginTreeSnapshotAttestation(
-          finalMounts,
-          sandboxEntry,
+      for (const index of pluginMountIndexes) {
+        if (index === entryIndex) continue;
+        const rawMount = pinnedMounts[index];
+        const source = runtime.fs.fstatSync(rawMount.fd);
+        const fileSnapshot = createLinuxRegularFileSnapshot(
+          runtime,
+          rawMount,
+          {
+            fileId: rawMount.fileId,
+            bytes: rawMount.bytes,
+            mtimeMs: rawMount.mtimeMs,
+          },
+          linuxPluginTreeFileSnapshotContract(
+            Number(source.mode),
+            validation.entryRuntime,
+          ),
         );
+        pluginTreeFileSnapshots.push(fileSnapshot);
+        finalMounts[index] = fileSnapshot.finalMount;
+        probeMounts[index] = fileSnapshot.probeMount;
       }
+      pluginTreeSnapshot = buildLinuxPluginTreeSnapshotAttestation(
+        finalMounts,
+        sandboxEntry,
+        validation.entryRuntime,
+      );
       pinnedMounts = finalMounts;
       probePinnedMounts = probeMounts;
       entryMount = entrySnapshot.finalMount;
-      closeLinuxPinnedMounts(
-        runtime,
-        validation.entryRuntime === "node" ? rawPluginMounts : [rawEntryMount],
-      );
+      closeLinuxPinnedMounts(runtime, rawPluginMounts);
     } catch (error) {
       closeLinuxPinnedMounts(runtime, pinnedMounts);
       closeLinuxPinnedMounts(runtime, [
@@ -6607,7 +7466,7 @@ export function applyLinuxSandbox(
       .createHash("sha256")
       .update(
         JSON.stringify({
-          version: validation.entryRuntime === "node" ? 4 : 3,
+          version: 4,
           backend: LINUX_BWRAP_BACKEND,
           supervisor: supervisorPin.attestation,
           contract: {
@@ -6651,9 +7510,7 @@ export function applyLinuxSandbox(
           ...(nativeDynamicClosure
             ? { initialDynamicLoadClosure: nativeDynamicClosure }
             : {}),
-          ...(validation.entryRuntime === "node"
-            ? { pluginTreeContentSnapshot: pluginTreeSnapshot }
-            : {}),
+          pluginTreeContentSnapshot: pluginTreeSnapshot,
           seccomp: {
             arch: seccompFilter.arch,
             policy: seccompFilter.policy,
@@ -6726,21 +7583,13 @@ export function applyLinuxSandbox(
       });
     }
     try {
-      if (validation.entryRuntime === "node") {
-        attestLinuxNodePluginTreeSnapshot(
-          runtime,
-          pinnedMounts,
-          sandboxEntry,
-          pluginTreeSnapshot,
-        );
-      } else {
-        attestLinuxEntrySnapshot(
-          runtime,
-          entryMount,
-          entrySnapshot.attestation,
-          validation.entryRuntime,
-        );
-      }
+      attestLinuxPluginTreeSnapshot(
+        runtime,
+        pinnedMounts,
+        sandboxEntry,
+        validation.entryRuntime,
+        pluginTreeSnapshot,
+      );
     } catch (error) {
       closeStrongLinuxResources(supervisorPin, finalLaunch);
       return createSandboxPlan({
@@ -6819,6 +7668,7 @@ export function applyLinuxSandbox(
       supervisorBinding,
       pluginTreeSnapshot,
       nativeDynamicClosure,
+      policyProbe.runtimeDetachedChildSpawnVerified === true,
     );
     const runtimeProbe = Object.freeze(
       capsuleContract
@@ -6961,12 +7811,17 @@ export function applySandbox(
     explicitRequest,
   );
   const profileName = sandboxRequest.profile;
+  // Windows does not consume the POSIX allow-write lists. Avoid invoking an
+  // embedding temp-directory hook while eagerly constructing three unused
+  // profiles; applyWindowsSandbox resolves and pins that hook exactly once.
+  const profileTempDirectory =
+    runtime.platform === "win32" ? null : runtime.tmpdir();
   const profiles = {
     default: {
       allowNetwork: false,
       allowExec: true,
       allowRead: [runtime.homedir(), "/tmp"],
-      allowWrite: [runtime.tmpdir()],
+      allowWrite: profileTempDirectory ? [profileTempDirectory] : [],
       limits: {
         // RLIMIT_NPROC is intentionally omitted. Linux applies it per real
         // user ID rather than to this child tree, so it can starve unrelated
@@ -6979,7 +7834,7 @@ export function applySandbox(
       allowNetwork: false,
       allowExec: false,
       allowRead: [],
-      allowWrite: [runtime.tmpdir()],
+      allowWrite: profileTempDirectory ? [profileTempDirectory] : [],
       limits: {
         cpu: 10,
         as: 256 * 1024 * 1024, // 256MB address space
@@ -6990,7 +7845,7 @@ export function applySandbox(
       allowNetwork: true,
       allowExec: true,
       allowRead: [runtime.homedir()],
-      allowWrite: [runtime.tmpdir()],
+      allowWrite: profileTempDirectory ? [profileTempDirectory] : [],
       limits: {
         cpu: 60,
         nofile: 512,