chainlesschain 0.163.8 → 0.165.1

package/src/lib/process-execution-broker/linux-generic-bwrap.js

@@ -21,6 +21,12 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import {
+  buildLinuxBwrapDescriptorScrubbedLaunch,
+  LINUX_BWRAP_DESCRIPTOR_SCRUBBER_PATH,
+  linuxBwrapDescriptorScrubberPolicyBinding,
+  parseLinuxBwrapDescriptorScrubbedLaunch,
+} from "./linux-bwrap-descriptor-launch.js";
 
 export const LINUX_GENERIC_BWRAP_BACKEND = "linux-bwrap-workspace";
 export const LINUX_GENERIC_CONTRACT_KIND = "strict-workspace-command";
@@ -86,6 +92,8 @@ const ENV_DENYLIST = new Set([
   "LD_DEBUG",
   "LD_LIBRARY_PATH",
   "LD_PRELOAD",
+  "NODE_CHANNEL_FD",
+  "NODE_CHANNEL_SERIALIZATION_MODE",
   "NODE_OPTIONS",
   "NODE_PATH",
   "PERL5OPT",
@@ -165,12 +173,18 @@ function assertString(value, label) {
 }
 
 function normalizeArgs(args) {
-  if (!Array.isArray(args)) {
+  if (!Array.isArray(args) || Object.getPrototypeOf(args) !== Array.prototype) {
     throw new TypeError("args must be an array");
   }
-  return Object.freeze(
-    args.map((value, index) => assertString(String(value), `args[${index}]`)),
-  );
+  const normalized = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const descriptor = Object.getOwnPropertyDescriptor(args, index);
+    if (!descriptor || !("value" in descriptor)) {
+      throw new TypeError(`args[${index}] must be an own data property`);
+    }
+    normalized.push(assertString(descriptor.value, `args[${index}]`));
+  }
+  return Object.freeze(normalized);
 }
 
 function normalizeBoundaries(boundaries) {
@@ -209,7 +223,19 @@ function normalizeStdio(stdio) {
   } else if (stdio === "ignore") {
     entries = ["ignore", "ignore", "ignore"];
   } else if (Array.isArray(stdio)) {
-    entries = [...stdio];
+    if (Object.getPrototypeOf(stdio) !== Array.prototype) {
+      throw new TypeError("stdio must use the canonical array prototype");
+    }
+    entries = [];
+    for (let index = 0; index < stdio.length; index += 1) {
+      const descriptor = Object.getOwnPropertyDescriptor(stdio, index);
+      if (!descriptor || !("value" in descriptor)) {
+        throw new TypeError(
+          `strong Linux workspace sandbox rejects sparse/accessor stdio at fd ${index}`,
+        );
+      }
+      entries.push(descriptor.value);
+    }
     while (entries.length < 3) entries.push(undefined);
   } else {
     throw new TypeError(
@@ -220,9 +246,17 @@ function normalizeStdio(stdio) {
   let ipcCount = 0;
   const normalized = entries.map((entry, index) => {
     if (entry === undefined || entry === null) {
-      return index < 3 ? "pipe" : "ignore";
+      if (index < 3) return "pipe";
+      throw new TypeError(
+        `strong Linux workspace sandbox rejects non-overwriting stdio at fd ${index}`,
+      );
+    }
+    if (entry === "pipe" || (entry === "ignore" && index < 3)) return entry;
+    if (entry === "ignore") {
+      throw new TypeError(
+        `strong Linux workspace sandbox rejects non-overwriting stdio at fd ${index}`,
+      );
     }
-    if (entry === "pipe" || entry === "ignore") return entry;
     if (entry === "ipc" && index >= 3) {
       ipcCount += 1;
       return entry;
@@ -337,6 +371,9 @@ export function issueLinuxGenericSandboxExecutionContract(
     throw new TypeError("strong Linux workspace PTY cannot be synchronous");
   }
   const stdio = normalizeStdio(spec?.stdio);
+  if (sync && stdio.includes("ipc")) {
+    throw new TypeError("strong Linux workspace IPC cannot be synchronous");
+  }
   const requiredBoundaries = normalizeBoundaries(spec?.requiredBoundaries);
   if (
     spec?.detached === true ||
@@ -611,6 +648,32 @@ function validateResourceContract(resources, issued) {
   ) {
     throw new Error("bubblewrap supervisor is not root-owned and pinned");
   }
+  if (
+    resources.descriptorScrubber?.identity?.realPath !==
+      LINUX_BWRAP_DESCRIPTOR_SCRUBBER_PATH ||
+    !validateRootOwnedIdentity(resources.descriptorScrubber?.identity, {
+      directory: false,
+    }) ||
+    (Number(resources.descriptorScrubber.identity.mode) & 0o111) === 0 ||
+    !/^[a-f0-9]{64}$/.test(resources.descriptorScrubber?.sha256 || "") ||
+    !Number.isSafeInteger(resources.descriptorScrubber?.bytes) ||
+    resources.descriptorScrubber.bytes <= 0 ||
+    !Number.isFinite(resources.descriptorScrubber?.mtimeMs) ||
+    !Number.isInteger(resources.descriptorScrubber?.probeFd) ||
+    !Number.isInteger(resources.descriptorScrubber?.finalFd)
+  ) {
+    throw new Error("descriptor scrubber is not root-owned and pinned");
+  }
+  const descriptorScrubber = {
+    path: resources.descriptorScrubber.identity.realPath,
+    fileId: resources.descriptorScrubber.identity.fileId,
+    sha256: resources.descriptorScrubber.sha256,
+    bytes: resources.descriptorScrubber.bytes,
+    mtimeMs: resources.descriptorScrubber.mtimeMs,
+    mode: Number(resources.descriptorScrubber.identity.mode),
+    uid: Number(resources.descriptorScrubber.identity.uid),
+    gid: Number(resources.descriptorScrubber.identity.gid),
+  };
   let ptyLauncher = null;
   if (issued.pty) {
     if (
@@ -713,6 +776,7 @@ function validateResourceContract(resources, issued) {
       sha256: resources.supervisor.sha256,
       bytes: resources.supervisor.bytes,
     },
+    descriptorScrubber,
     ptyLauncher,
     system,
     symlinks,
@@ -732,6 +796,8 @@ function sanitizedEnvironment(environment, stdio) {
     if (
       !/^[A-Za-z_][A-Za-z0-9_]*$/.test(key) ||
       ENV_DENYLIST.has(key) ||
+      key.startsWith("LD_") ||
+      key.startsWith("BASH_FUNC_") ||
       value === undefined ||
       value === null ||
       String(value).includes("\0")
@@ -840,6 +906,11 @@ function descriptorLayout(stdio, resources, validated, workspaceRoot, phase) {
       fd: resources.seccomp[`${phase}Fd`],
       destination: null,
     },
+    {
+      kind: "descriptorScrubber",
+      fd: resources.descriptorScrubber[`${phase}Fd`],
+      destination: null,
+    },
   ];
   const seen = new Set();
   for (const descriptor of descriptors) {
@@ -988,12 +1059,14 @@ function policyBinding({
   environment,
   requiredBoundaries,
   policyArgs,
+  descriptorScrubber,
 }) {
   return {
     version: PLAN_VERSION,
     backend: LINUX_GENERIC_BWRAP_BACKEND,
     contractDigest: issued.contractDigest,
     supervisor: validated.supervisor,
+    descriptorScrubber,
     workspace: {
       root: issued.workspaceRoot,
       cwd: issued.workingDirectory,
@@ -1144,6 +1217,23 @@ export function planLinuxGenericBubblewrap(
     environment: targetEnvironment,
     requiredBoundaries,
     policyArgs,
+    descriptorScrubber: linuxBwrapDescriptorScrubberPolicyBinding(
+      validated.descriptorScrubber,
+      {
+        scrubberChildFd: finalDescriptors.find(
+          (entry) => entry.kind === "descriptorScrubber",
+        ).childFd,
+        preservedMaxFd:
+          finalDescriptors.find((entry) => entry.kind === "descriptorScrubber")
+            .childFd - 1,
+        activeStdioThrough: issued.stdio.length - 1,
+        nodeIpcChildFd:
+          issued.stdio.indexOf("ipc") >= 3 ? issued.stdio.indexOf("ipc") : null,
+        executableChildFd: finalDescriptors.find(
+          (entry) => entry.kind === "supervisor",
+        ).childFd,
+      },
+    ),
   });
   const policyDigest = sha256(stableJson(binding));
   const probePolicyArgs = buildPolicyArgs({
@@ -1152,9 +1242,6 @@ export function planLinuxGenericBubblewrap(
     descriptors: probeDescriptors,
     environment: targetEnvironment,
   });
-  const probeCommand = `/proc/self/fd/${
-    probeDescriptors.find((entry) => entry.kind === "supervisor").childFd
-  }`;
   const probeOptions = {
     cwd: "/",
     shell: false,
@@ -1162,19 +1249,31 @@ export function planLinuxGenericBubblewrap(
     timeout: 10_000,
     stdio: [
       ...issued.stdio.map((_, index) =>
-        index === 1 || index === 2 ? "pipe" : "ignore",
+        index === 1 || index === 2 || index >= 3 ? "pipe" : "ignore",
       ),
       ...probeDescriptors.map((descriptor) => descriptor.fd),
     ],
     env: { PATH: "/usr/bin:/bin", LANG: "C", LC_ALL: "C" },
   };
+  const probeLaunch = buildLinuxBwrapDescriptorScrubbedLaunch({
+    scrubberChildFd: probeDescriptors.find(
+      (entry) => entry.kind === "descriptorScrubber",
+    ).childFd,
+    preservedMaxFd:
+      probeDescriptors.find((entry) => entry.kind === "descriptorScrubber")
+        .childFd - 1,
+    executableChildFd: probeDescriptors.find(
+      (entry) => entry.kind === "supervisor",
+    ).childFd,
+    executableArgs: probePolicyArgs,
+  });
   let probeResult;
   try {
     probeResult =
       typeof probe === "function"
         ? probe({
-            command: probeCommand,
-            args: probePolicyArgs,
+            command: probeLaunch.command,
+            args: probeLaunch.args,
             options: probeOptions,
             policyDigest,
             contractDigest: issued.contractDigest,
@@ -1237,18 +1336,28 @@ export function planLinuxGenericBubblewrap(
   const ptyLauncher = finalDescriptors.find(
     (entry) => entry.kind === "ptyLauncher",
   );
-  const supervisorCommand = `/proc/self/fd/${supervisor.childFd}`;
-  const command = issued.pty
-    ? `/proc/self/fd/${ptyLauncher.childFd}`
-    : supervisorCommand;
+  const descriptorScrubber = finalDescriptors.find(
+    (entry) => entry.kind === "descriptorScrubber",
+  );
   const bwrapArgs = [
     ...policyArgs,
     "--",
     validated.target.resolvedCommand,
     ...validated.target.args,
   ];
+  const scrubbedLaunch = buildLinuxBwrapDescriptorScrubbedLaunch({
+    scrubberChildFd: descriptorScrubber.childFd,
+    preservedMaxFd: descriptorScrubber.childFd - 1,
+    executableChildFd: supervisor.childFd,
+    executableArgs: bwrapArgs,
+  });
+  const command = issued.pty
+    ? `/proc/self/fd/${ptyLauncher.childFd}`
+    : scrubbedLaunch.command;
   const args = Object.freeze(
-    issued.pty ? ["--ctty", supervisorCommand, ...bwrapArgs] : bwrapArgs,
+    issued.pty
+      ? ["--ctty", scrubbedLaunch.command, ...scrubbedLaunch.args]
+      : [...scrubbedLaunch.args],
   );
   const options = Object.freeze({
     ...passthroughSpawnOptions(spawnOptions),
@@ -1298,6 +1407,7 @@ export function planLinuxGenericBubblewrap(
       mountTopologyAtomic: false,
       contractDigest: issued.contractDigest,
       policyDigest,
+      descriptorScrubber: binding.descriptorScrubber,
       mountTopologyDigest: validated.workspaceMountTopology.digest,
       sourceMountSetDigest:
         validated.workspaceMountTopology.sourceMountSetDigest,
@@ -1384,8 +1494,39 @@ export function planLinuxGenericBubblewrap(
 }
 
 export function verifyLinuxGenericBubblewrapPlan(plan) {
+  const descriptorScrubber = plan?.runtimeProbe?.descriptorScrubber;
+  const scrubbedLaunch = plan?.ptyPolicy
+    ? parseLinuxBwrapDescriptorScrubbedLaunch(
+        plan.args?.[1],
+        plan.args?.slice(2),
+        plan.options,
+        { activeStdioThrough: descriptorScrubber?.activeStdioThrough },
+      )
+    : parseLinuxBwrapDescriptorScrubbedLaunch(
+        plan?.command,
+        plan?.args,
+        plan?.options,
+        { activeStdioThrough: descriptorScrubber?.activeStdioThrough },
+      );
   return (
     plannedPolicies.get(plan) === plan?.policyDigest &&
+    scrubbedLaunch !== null &&
+    descriptorScrubber?.scrubberChildFd === scrubbedLaunch.scrubberChildFd &&
+    descriptorScrubber?.preservedMaxFd === scrubbedLaunch.preservedMaxFd &&
+    descriptorScrubber?.activeStdioThrough ===
+      scrubbedLaunch.activeStdioThrough &&
+    descriptorScrubber?.nodeIpcChildFd === scrubbedLaunch.nodeIpcChildFd &&
+    descriptorScrubber?.nodeIpcSerializationMode ===
+      (scrubbedLaunch.nodeIpcChildFd === null ? null : "json") &&
+    descriptorScrubber?.nodeRuntimeEnvironmentInjection ===
+      (scrubbedLaunch.nodeIpcChildFd === null
+        ? "none"
+        : "node-child-process-exact-ipc-v1") &&
+    descriptorScrubber?.executableChildFd ===
+      scrubbedLaunch.executableChildFd &&
+    Object.isFrozen(descriptorScrubber) &&
+    Object.isFrozen(descriptorScrubber.executableIdentity) &&
+    Object.isFrozen(descriptorScrubber.executableIdentity.fileId) &&
     Object.isFrozen(plan) &&
     Object.isFrozen(plan.args) &&
     Object.isFrozen(plan.options) &&

package/src/lib/process-execution-broker/macos-mcp-launcher-contract.js

@@ -0,0 +1,278 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  MCP_STDIO_MACOS_GATED_ENTRY_BOOTSTRAP,
+  MCP_STDIO_MACOS_GATED_ENTRY_BOOTSTRAP_SHA256,
+} from "./mcp-fd-entry-bootstrap.js";
+
+const MODULE_DIR = path.dirname(fileURLToPath(import.meta.url));
+const PROTOCOL_PATH = path.join(MODULE_DIR, "macos-mcp-launcher-protocol.json");
+const SOURCE_PATH = path.join(MODULE_DIR, "macos-mcp-launcher.c");
+
+export function isMacosMcpLauncherPackageVersion(value) {
+  return /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/u.test(value || "");
+}
+
+function sha256(bytes) {
+  return crypto.createHash("sha256").update(bytes).digest("hex");
+}
+
+function strictObjectKeys(value, expected, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new TypeError(`${label} must be an object`);
+  }
+  const actual = Object.keys(value).sort();
+  const wanted = [...expected].sort();
+  if (JSON.stringify(actual) !== JSON.stringify(wanted)) {
+    throw new Error(`${label} fields do not match the fixed contract`);
+  }
+}
+
+function loadProtocolInputs() {
+  const sourceBytes = fs.readFileSync(SOURCE_PATH);
+  const protocolBytes = fs.readFileSync(PROTOCOL_PATH);
+  const protocol = JSON.parse(protocolBytes.toString("utf8"));
+  strictObjectKeys(
+    protocol,
+    [
+      "schema",
+      "protocolVersion",
+      "backend",
+      "packageIdentifier",
+      "helperInstallPath",
+      "installContractPath",
+      "snapshotRoot",
+      "snapshotLockName",
+      "sandboxExecutable",
+      "runtimeFd",
+      "entryFd",
+      "capsuleRootFd",
+      "gateFd",
+      "readyFd",
+      "callerLifelineFd",
+      "maximumRuntimeBytes",
+      "maximumEntryBytes",
+      "maximumPassthroughArgs",
+      "maximumStaleSnapshots",
+      "readyTimeoutMs",
+      "profileTemplateVersion",
+    ],
+    "macOS MCP launcher protocol",
+  );
+  if (
+    protocol.schema !== "chainlesschain.macos-mcp-launcher-protocol.v1" ||
+    protocol.protocolVersion !== 1 ||
+    protocol.backend !== "macos-signed-root-fd-launcher" ||
+    protocol.packageIdentifier !== "com.chainlesschain.cli.mcp-launcher.pkg" ||
+    protocol.helperInstallPath !==
+      "/Library/PrivilegedHelperTools/com.chainlesschain.cli.mcp-launcher" ||
+    protocol.installContractPath !==
+      "/Library/PrivilegedHelperTools/com.chainlesschain.cli.mcp-launcher.json" ||
+    protocol.snapshotRoot !==
+      "/Library/Application Support/ChainlessChain/McpLauncher/runtime" ||
+    protocol.snapshotLockName !== "launcher.lock" ||
+    protocol.sandboxExecutable !== "/usr/bin/sandbox-exec" ||
+    protocol.runtimeFd !== 3 ||
+    protocol.entryFd !== 4 ||
+    protocol.capsuleRootFd !== 5 ||
+    protocol.gateFd !== 6 ||
+    protocol.readyFd !== 7 ||
+    protocol.callerLifelineFd !== 8 ||
+    protocol.maximumRuntimeBytes !== 256 * 1024 * 1024 ||
+    protocol.maximumEntryBytes !== 64 * 1024 * 1024 ||
+    protocol.maximumPassthroughArgs !== 128 ||
+    protocol.maximumStaleSnapshots !== 8 ||
+    protocol.readyTimeoutMs !== 15_000 ||
+    protocol.profileTemplateVersion !== 1
+  ) {
+    throw new Error("macOS MCP launcher protocol contains unsupported values");
+  }
+  return Object.freeze({
+    sourcePath: SOURCE_PATH,
+    sourceBytes,
+    sourceSha256: sha256(sourceBytes),
+    protocolPath: PROTOCOL_PATH,
+    protocolBytes,
+    protocol,
+    protocolSha256: sha256(protocolBytes),
+    gateBootstrap: MCP_STDIO_MACOS_GATED_ENTRY_BOOTSTRAP,
+    gateBootstrapSha256: MCP_STDIO_MACOS_GATED_ENTRY_BOOTSTRAP_SHA256,
+  });
+}
+
+export const MACOS_MCP_LAUNCHER_INPUTS = loadProtocolInputs();
+export const MACOS_MCP_LAUNCHER_INSTALL_CONTRACT_SCHEMA =
+  "chainlesschain.macos-mcp-launcher-install.v1";
+
+function designatedRequirementMatchesReleaseIdentity(contract) {
+  const requirement = contract.designatedRequirement;
+  const team = contract.teamIdentifier;
+  return (
+    typeof requirement === "string" &&
+    requirement.length <= 4096 &&
+    !requirement.includes("\0") &&
+    !/[\r\n]/u.test(requirement) &&
+    !/\bor\b/iu.test(requirement) &&
+    requirement.includes('identifier "com.chainlesschain.cli.mcp-launcher"') &&
+    requirement.includes("anchor apple generic") &&
+    requirement.includes(
+      "certificate 1[field.1.2.840.113635.100.6.2.6] exists",
+    ) &&
+    requirement.includes(
+      "certificate leaf[field.1.2.840.113635.100.6.1.13] exists",
+    ) &&
+    requirement.includes(`certificate leaf[subject.OU] = ${team}`)
+  );
+}
+
+export function verifyMacosMcpLauncherInstallContract(
+  contract,
+  inputs = MACOS_MCP_LAUNCHER_INPUTS,
+) {
+  strictObjectKeys(
+    contract,
+    [
+      "schema",
+      "protocolVersion",
+      "protocolSha256",
+      "sourceSha256",
+      "gateBootstrapSha256",
+      "helperSha256",
+      "helperBytes",
+      "packageIdentifier",
+      "packageVersion",
+      "helperInstallPath",
+      "installContractPath",
+      "snapshotRoot",
+      "snapshotLockName",
+      "sandboxExecutable",
+      "ownerUid",
+      "ownerGid",
+      "helperMode",
+      "contractMode",
+      "snapshotRootMode",
+      "snapshotLockMode",
+      "snapshotLockMechanism",
+      "signingIdentifier",
+      "teamIdentifier",
+      "designatedRequirement",
+      "hardenedRuntimeRequired",
+      "notarizedPackageRequired",
+      "rootInstallRequired",
+      "runtimeSnapshotMechanism",
+      "entrySnapshotMechanism",
+      "targetDescriptorMechanism",
+      "callerLifelineFd",
+      "globalLaunchSerialization",
+      "maximumStaleSnapshots",
+      "sandboxExecLiveGateRequired",
+      "parentDeathLiveGateRequired",
+      "inPlaceOverwriteLiveGateRequired",
+      "signalFloodLiveGateRequired",
+      "snapshotLockUpgradeLiveGateRequired",
+    ],
+    "macOS MCP launcher install contract",
+  );
+  if (
+    contract.schema !== MACOS_MCP_LAUNCHER_INSTALL_CONTRACT_SCHEMA ||
+    contract.protocolVersion !== 1 ||
+    contract.protocolSha256 !== inputs.protocolSha256 ||
+    contract.sourceSha256 !== inputs.sourceSha256 ||
+    contract.gateBootstrapSha256 !== inputs.gateBootstrapSha256 ||
+    !/^[a-f0-9]{64}$/u.test(contract.helperSha256 || "") ||
+    !Number.isSafeInteger(contract.helperBytes) ||
+    contract.helperBytes <= 0 ||
+    contract.helperBytes > 16 * 1024 * 1024 ||
+    contract.packageIdentifier !== inputs.protocol.packageIdentifier ||
+    !isMacosMcpLauncherPackageVersion(contract.packageVersion) ||
+    contract.helperInstallPath !== inputs.protocol.helperInstallPath ||
+    contract.installContractPath !== inputs.protocol.installContractPath ||
+    contract.snapshotRoot !== inputs.protocol.snapshotRoot ||
+    contract.snapshotLockName !== inputs.protocol.snapshotLockName ||
+    contract.sandboxExecutable !== inputs.protocol.sandboxExecutable ||
+    contract.ownerUid !== 0 ||
+    contract.ownerGid !== 0 ||
+    contract.helperMode !== "4555" ||
+    contract.contractMode !== "0444" ||
+    contract.snapshotRootMode !== "0711" ||
+    contract.snapshotLockMode !== "0600" ||
+    contract.snapshotLockMechanism !==
+      "root-helper-openat-o_excl-preserve-inode-across-upgrade-v1" ||
+    contract.signingIdentifier !== "com.chainlesschain.cli.mcp-launcher" ||
+    !/^[A-Z0-9]{10}$/u.test(contract.teamIdentifier || "") ||
+    !designatedRequirementMatchesReleaseIdentity(contract) ||
+    contract.hardenedRuntimeRequired !== true ||
+    contract.notarizedPackageRequired !== true ||
+    contract.rootInstallRequired !== true ||
+    contract.runtimeSnapshotMechanism !==
+      "root-copy-hash-protected-path-ready-unlink-v1" ||
+    contract.entrySnapshotMechanism !==
+      "root-copy-hash-readonly-reopen-unlink-fsync-fd4-v1" ||
+    contract.targetDescriptorMechanism !==
+      "stdio-fd3-null-fd4-entry-fd5-null-fd6-gate-fd7-ready-bootstrap-close-v1" ||
+    contract.callerLifelineFd !== inputs.protocol.callerLifelineFd ||
+    contract.globalLaunchSerialization !== true ||
+    contract.maximumStaleSnapshots !== inputs.protocol.maximumStaleSnapshots ||
+    contract.sandboxExecLiveGateRequired !== true ||
+    contract.parentDeathLiveGateRequired !== true ||
+    contract.inPlaceOverwriteLiveGateRequired !== true ||
+    contract.signalFloodLiveGateRequired !== true ||
+    contract.snapshotLockUpgradeLiveGateRequired !== true
+  ) {
+    throw new Error("macOS MCP launcher install contract is invalid");
+  }
+  return contract;
+}
+
+function seatbeltLiteral(value) {
+  const text = String(value);
+  if (
+    [...text].some((character) => {
+      const codePoint = character.codePointAt(0);
+      return codePoint <= 0x1f || codePoint === 0x7f;
+    })
+  ) {
+    throw new Error("macOS MCP launcher path contains a control character");
+  }
+  return text.replace(/\\/gu, "\\\\").replace(/"/gu, '\\"');
+}
+
+/** Must remain byte-for-byte equivalent to build_fixed_profile() in C. */
+export function generateMacosMcpLauncherSeatbeltProfile({
+  snapshotPath,
+  capsulePath,
+}) {
+  const snapshot = seatbeltLiteral(snapshotPath);
+  const capsule = seatbeltLiteral(capsulePath);
+  return [
+    "(version 1)",
+    "(deny default)",
+    '(import "system.sb")',
+    "(allow signal (target self))",
+    "(allow sysctl-read)",
+    "(allow mach-lookup)",
+    "(deny network*)",
+    "(deny process-fork)",
+    `(allow process-exec (literal "${snapshot}"))`,
+    `(allow file-read* (literal "${snapshot}"))`,
+    '(allow file-read* (subpath "/bin"))',
+    '(allow file-read* (subpath "/usr/bin"))',
+    '(allow file-read* (subpath "/usr/lib"))',
+    '(allow file-read* (subpath "/usr/libexec"))',
+    '(allow file-read* (subpath "/System/Library"))',
+    '(allow file-read* (subpath "/Library/Frameworks"))',
+    '(allow file-read* (subpath "/usr/local/lib"))',
+    `(allow file-read* file-write* (subpath "${capsule}"))`,
+    '(allow file-read* file-write* (literal "/dev/null") (literal "/dev/stdin") (literal "/dev/stdout") (literal "/dev/stderr"))',
+    '(allow file-read* (literal "/dev/urandom"))',
+    '(allow file-read* (literal "/etc/passwd"))',
+  ].join("\n");
+}
+
+export function macosMcpLauncherPolicyDigest({ snapshotPath, capsulePath }) {
+  return sha256(
+    generateMacosMcpLauncherSeatbeltProfile({ snapshotPath, capsulePath }),
+  );
+}

package/src/lib/process-execution-broker/macos-mcp-launcher-protocol.json

@@ -0,0 +1,23 @@
+{
+  "schema": "chainlesschain.macos-mcp-launcher-protocol.v1",
+  "protocolVersion": 1,
+  "backend": "macos-signed-root-fd-launcher",
+  "packageIdentifier": "com.chainlesschain.cli.mcp-launcher.pkg",
+  "helperInstallPath": "/Library/PrivilegedHelperTools/com.chainlesschain.cli.mcp-launcher",
+  "installContractPath": "/Library/PrivilegedHelperTools/com.chainlesschain.cli.mcp-launcher.json",
+  "snapshotRoot": "/Library/Application Support/ChainlessChain/McpLauncher/runtime",
+  "snapshotLockName": "launcher.lock",
+  "sandboxExecutable": "/usr/bin/sandbox-exec",
+  "runtimeFd": 3,
+  "entryFd": 4,
+  "capsuleRootFd": 5,
+  "gateFd": 6,
+  "readyFd": 7,
+  "callerLifelineFd": 8,
+  "maximumRuntimeBytes": 268435456,
+  "maximumEntryBytes": 67108864,
+  "maximumPassthroughArgs": 128,
+  "maximumStaleSnapshots": 8,
+  "readyTimeoutMs": 15000,
+  "profileTemplateVersion": 1
+}