chainlesschain 0.165.4 → 0.165.6

package/src/lib/dynamic-workflow-runtime.js

@@ -71,6 +71,7 @@ const MAX_CALLS_PER_EFFECT = 128;
 const MAX_INPUT_REQUESTS = 64;
 const MAX_INPUT_OPTIONS = 32;
 const MAX_INPUT_RESPONSE_BYTES = 64 * 1024;
+const MAX_WORKBENCH_RUN_FILES = 1024;
 const MAX_PROJECTED_ARTIFACTS_PER_EFFECT = 256;
 const MAX_PROVIDER_TOKEN_COUNT = 1_000_000_000;
 const MAX_PROVIDER_USD_RATE_PER_MILLION = 1_000_000;
@@ -1518,6 +1519,31 @@ export function verifyDynamicWorkflowRuntimeState(value) {
   ) {
     issues.push("authority-binding-invalid");
   }
+  if (state.executionBudget !== undefined && state.executionBudget !== null) {
+    const budget = state.executionBudget;
+    const fields = [
+      "maxExpandedTasks",
+      "maxParallel",
+      "maxTokens",
+      "maxUsd",
+      "maxDurationMs",
+    ];
+    const validBudget =
+      budget &&
+      typeof budget === "object" &&
+      !Array.isArray(budget) &&
+      Object.keys(budget).length === fields.length &&
+      fields.every((field) => Object.hasOwn(budget, field)) &&
+      fields.every((field) => {
+        const amount = budget[field];
+        if (amount === null) return true;
+        if (!Number.isFinite(amount) || amount < 0) return false;
+        return (
+          field === "maxUsd" || (Number.isSafeInteger(amount) && amount >= 1)
+        );
+      });
+    if (!validBudget) issues.push("execution-budget-invalid");
+  }
   if (
     !Number.isSafeInteger(state.revision) ||
     state.revision < 1 ||
@@ -1981,6 +2007,11 @@ function stateBindings(execution, runId) {
       "workflow execution policy",
       64 * 1024,
     ),
+    executionBudget: snapshotJson(
+      execution.workflow?.facade?.budget || null,
+      "workflow execution budget",
+      16 * 1024,
+    ),
   };
 }
 
@@ -1994,7 +2025,10 @@ function bindingsMatch(state, bindings) {
       "executionAuthoritySessionId",
     ].every((field) => state[field] === bindings[field]) &&
     canonicalJson(state.executionPolicy) ===
-      canonicalJson(bindings.executionPolicy)
+      canonicalJson(bindings.executionPolicy) &&
+    (state.executionBudget === undefined ||
+      canonicalJson(state.executionBudget) ===
+        canonicalJson(bindings.executionBudget))
   );
 }
 
@@ -6045,3 +6079,376 @@ export function projectDynamicWorkflowRuntime(stateOrPath, options = {}) {
     stateDigest: state.stateDigest,
   });
 }
+
+function checkpointRecoverySummary(state, options = {}) {
+  const checkpointStore =
+    options.checkpointStore || new WorkspaceTransactionManager();
+  let prepared = 0;
+  let terminal = 0;
+  let pending = 0;
+  let unavailable = 0;
+  for (const effect of state.effects) {
+    if (effect.status !== "pending") continue;
+    for (const call of effect.calls || []) {
+      if (
+        call.kind !== "tool" ||
+        call.status !== "started" ||
+        Object.hasOwn(call, "artifactReadback") ||
+        !validCheckpointBinding(call.checkpointBinding)
+      ) {
+        continue;
+      }
+      prepared += 1;
+      try {
+        if (
+          checkpointReadbackFromPreparedBinding(
+            call.checkpointBinding,
+            checkpointStore,
+          ) === null
+        ) {
+          pending += 1;
+        } else {
+          terminal += 1;
+        }
+      } catch {
+        unavailable += 1;
+      }
+    }
+  }
+  return Object.freeze({ prepared, terminal, pending, unavailable });
+}
+
+function observedBudgetStatus(observed, limit, complete) {
+  if (!Number.isFinite(limit) || !Number.isFinite(observed) || !complete) {
+    return "unknown";
+  }
+  return observed > limit ? "exceeded" : "within";
+}
+
+const WORKFLOW_RECOVERY_BACKOFF_MS = Object.freeze([
+  15_000,
+  60_000,
+  5 * 60_000,
+  15 * 60_000,
+]);
+
+function dynamicWorkflowRecoveryPolicy(state, recovery) {
+  const pendingInput = runtimeInputRequests(state).filter(
+    (request) => request.status === "pending",
+  ).length;
+  const pendingEffects = state.effects.filter(
+    (effect) => effect.status === "pending",
+  );
+  const uncertainEffects = pendingEffects.filter(
+    (effect) => !isKnownUndispatched(effect),
+  ).length;
+  let risk = "none";
+  let severity = "info";
+  let recommendedAction = "none";
+  let requiresApproval = false;
+  let automaticallyExecutable = false;
+
+  if (recovery.terminal > 0) {
+    risk = "terminal_checkpoint_recovery";
+    severity = "warning";
+    recommendedAction = "recover";
+    requiresApproval = true;
+    automaticallyExecutable = true;
+  } else if (pendingInput > 0) {
+    risk = "input_required";
+    severity = "warning";
+    recommendedAction = "reply";
+    requiresApproval = true;
+  } else if (uncertainEffects > 0) {
+    risk = "operator_adjudication_required";
+    severity = "critical";
+    recommendedAction = "reconcile";
+    requiresApproval = true;
+  } else if (state.status === "pause_requested") {
+    risk = "settlement_barrier_pending";
+    severity = "info";
+    recommendedAction = "wait";
+  } else if (
+    ["paused", "failed", "blocked"].includes(state.status) &&
+    pendingEffects.length === 0
+  ) {
+    risk = "restart_ready";
+    severity = "warning";
+    recommendedAction = "resume";
+    requiresApproval = true;
+    automaticallyExecutable = true;
+  }
+
+  const notificationKey = digest(
+    "chainlesschain.dynamic-workflow.recovery-notification.v1\0",
+    {
+      runId: state.runId,
+      revision: state.revision,
+      stateDigest: state.stateDigest,
+      risk,
+      recommendedAction,
+    },
+  );
+  return Object.freeze({
+    schema: "cc-dynamic-workflow-recovery-policy/v1",
+    risk,
+    severity,
+    recommendedAction,
+    requiresApproval,
+    automaticallyExecutable,
+    unattendedMutationAllowed: false,
+    pendingInput,
+    pendingEffects: pendingEffects.length,
+    uncertainEffects,
+    notification: Object.freeze({
+      key: notificationKey,
+      backoffMs: WORKFLOW_RECOVERY_BACKOFF_MS,
+      resetOnStateDigestChange: true,
+    }),
+  });
+}
+
+/**
+ * Bounded, content-free view used by the cross-IDE Sessions Workbench. Tool
+ * arguments, prompts, provider output, result bodies, and filesystem bindings
+ * deliberately never cross this projection boundary.
+ */
+export function projectDynamicWorkflowWorkbenchState(
+  stateOrPath,
+  options = {},
+) {
+  const state =
+    typeof stateOrPath === "string"
+      ? readDynamicWorkflowRuntimeState(stateOrPath)
+      : verifyDynamicWorkflowRuntimeState(stateOrPath);
+  const observability = projectDynamicWorkflowObservability(state);
+  const recovery = checkpointRecoverySummary(state, options);
+  const recoveryPolicy = dynamicWorkflowRecoveryPolicy(state, recovery);
+  const recentEffect = state.effects.at(-1) || null;
+  const recentCall = recentEffect?.calls?.at(-1) || null;
+  const lastTransition = state.lineage.at(-1) || null;
+  const budget = state.executionBudget || null;
+  const providerTokens = observability.tokens.providerReported?.totalTokens;
+  const observedTokens = Number.isFinite(providerTokens)
+    ? providerTokens
+    : observability.tokens.missingEffects === 0
+      ? observability.tokens.estimated
+      : null;
+  const tokenComplete =
+    Number.isFinite(providerTokens) ||
+    observability.tokens.missingEffects === 0;
+  const observedUsd = Number.isFinite(observability.cost.estimatedUsd)
+    ? observability.cost.estimatedUsd
+    : null;
+  const costComplete =
+    observability.cost.providerCalls === observability.cost.pricedCalls;
+  const observedDurationMs = observability.duration.totalMs;
+  const durationComplete = observability.effects.pending === 0;
+  const budgetStatus = {
+    tokens: observedBudgetStatus(
+      observedTokens,
+      budget?.maxTokens,
+      tokenComplete,
+    ),
+    usd: observedBudgetStatus(observedUsd, budget?.maxUsd, costComplete),
+    duration: observedBudgetStatus(
+      observedDurationMs,
+      budget?.maxDurationMs,
+      durationComplete,
+    ),
+  };
+  const overallBudgetStatus = Object.values(budgetStatus).includes("exceeded")
+    ? "exceeded"
+    : Object.values(budgetStatus).includes("unknown")
+      ? "unknown"
+      : "within";
+
+  return Object.freeze({
+    schema: "cc-dynamic-workflow-workbench-state/v1",
+    runId: state.runId,
+    workflowId: state.workflowId,
+    status: state.status,
+    revision: state.revision,
+    stateDigest: state.stateDigest,
+    definitionDigest: state.definitionDigest,
+    admissionDigest: state.admissionDigest,
+    executionAuthoritySessionId: state.executionAuthoritySessionId,
+    createdAt: state.createdAt,
+    updatedAt: state.updatedAt,
+    phase: Object.freeze({
+      status: state.status,
+      transition: lastTransition?.type || "run-created",
+      at: lastTransition?.at || state.createdAt,
+    }),
+    agents: Object.freeze({
+      requested: observability.effects.requested,
+      settled: observability.effects.settled,
+      pending: observability.effects.pending,
+      completed: observability.effects.completedTasks,
+      failed: observability.effects.failedTasks,
+    }),
+    input: Object.freeze({
+      requested: runtimeInputRequests(state).length,
+      pending: runtimeInputRequests(state).filter(
+        (request) => request.status === "pending",
+      ).length,
+    }),
+    budget: Object.freeze({
+      limits: budget,
+      observed: Object.freeze({
+        tokens: observedTokens,
+        usd: observedUsd,
+        durationMs: observedDurationMs,
+      }),
+      status: Object.freeze(budgetStatus),
+      overall: overallBudgetStatus,
+    }),
+    artifacts: Object.freeze({ count: observability.artifacts.count }),
+    checkpoints: Object.freeze({ count: observability.checkpoints.count }),
+    recovery,
+    recoveryPolicy,
+    recent: recentEffect
+      ? Object.freeze({
+          effectId: recentEffect.id,
+          stepId: recentEffect.stepId,
+          status: recentEffect.status,
+          taskStatus:
+            recentEffect.result?.status === "completed" ||
+            recentEffect.result?.status === "failed"
+              ? recentEffect.result.status
+              : null,
+          requestedAt: recentEffect.requestedAt,
+          settledAt: recentEffect.settledAt || null,
+          resultDigest: recentEffect.resultDigest || null,
+          call: recentCall
+            ? Object.freeze({
+                id: recentCall.id,
+                kind: recentCall.kind,
+                name: recentCall.name,
+                status: recentCall.status,
+                settlementCode: recentCall.settlementCode,
+                settledAt: recentCall.settledAt,
+              })
+            : null,
+        })
+      : null,
+  });
+}
+
+/** Securely discover durable workflow state files below one project root. */
+export function listDynamicWorkflowWorkbenchStates(cwd, options = {}) {
+  const limit = Math.max(1, Math.min(256, Number(options.limit) || 100));
+  const projectionOptions = Object.hasOwn(options, "checkpointStore")
+    ? options
+    : { ...options, checkpointStore: new WorkspaceTransactionManager() };
+  const directory = path.join(
+    path.resolve(cwd),
+    ".chainlesschain",
+    "cowork",
+    "workflow-runs",
+  );
+  let stat;
+  try {
+    stat = fs.lstatSync(directory);
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      return Object.freeze({ runs: Object.freeze([]), invalidCount: 0 });
+    }
+    throw error;
+  }
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error("dynamic workflow runtime directory is not trusted");
+  }
+  const entries = fs.readdirSync(directory, { withFileTypes: true });
+  if (entries.length > MAX_WORKBENCH_RUN_FILES) {
+    throw new Error("dynamic workflow runtime directory exceeds safe limits");
+  }
+  const runs = [];
+  let invalidCount = 0;
+  for (const entry of entries) {
+    if (
+      !entry.isFile() ||
+      entry.isSymbolicLink() ||
+      !/^[A-Za-z0-9][A-Za-z0-9._-]{0,255}\.json$/u.test(entry.name)
+    ) {
+      continue;
+    }
+    const runId = entry.name.slice(0, -".json".length);
+    try {
+      const statePath = dynamicWorkflowRunStatePath(cwd, runId);
+      const state = readDynamicWorkflowRuntimeState(statePath);
+      if (state.runId !== runId) throw new Error("run identity mismatch");
+      runs.push(projectDynamicWorkflowWorkbenchState(state, projectionOptions));
+    } catch {
+      invalidCount += 1;
+    }
+  }
+  runs.sort(
+    (left, right) =>
+      (Date.parse(right.updatedAt) || 0) - (Date.parse(left.updatedAt) || 0) ||
+      left.runId.localeCompare(right.runId),
+  );
+  return Object.freeze({
+    runs: Object.freeze(runs.slice(0, limit)),
+    invalidCount,
+  });
+}
+
+/** Deterministic, non-mutating batch inventory for startup/periodic recovery. */
+export function buildDynamicWorkflowRecoveryPlan(cwd, options = {}) {
+  const discovered = listDynamicWorkflowWorkbenchStates(cwd, options);
+  const policy = Object.freeze({
+    schema: "cc-dynamic-workflow-recovery-policy-set/v1",
+    unattendedMutationAllowed: false,
+    approvalRequiredFor: Object.freeze([
+      "recover",
+      "resume",
+      "reply",
+      "reconcile",
+    ]),
+    backoffMs: WORKFLOW_RECOVERY_BACKOFF_MS,
+  });
+  const items = discovered.runs.map((run) =>
+    Object.freeze({
+      runId: run.runId,
+      workflowId: run.workflowId,
+      revision: run.revision,
+      stateDigest: run.stateDigest,
+      status: run.status,
+      updatedAt: run.updatedAt,
+      risk: run.recoveryPolicy.risk,
+      severity: run.recoveryPolicy.severity,
+      recommendedAction: run.recoveryPolicy.recommendedAction,
+      requiresApproval: run.recoveryPolicy.requiresApproval,
+      automaticallyExecutable: run.recoveryPolicy.automaticallyExecutable,
+      notificationKey: run.recoveryPolicy.notification.key,
+      recovery: run.recovery,
+    }),
+  );
+  const summary = Object.freeze({
+    total: items.length,
+    invalid: discovered.invalidCount,
+    attention: items.filter((item) => item.risk !== "none").length,
+    critical: items.filter((item) => item.severity === "critical").length,
+    approvalRequired: items.filter((item) => item.requiresApproval).length,
+    automaticallyExecutable: items.filter(
+      (item) => item.automaticallyExecutable,
+    ).length,
+  });
+  const planMaterial = { policy, summary, items };
+  return Object.freeze({
+    schema: "cc-dynamic-workflow-recovery-plan/v1",
+    authority: "cli",
+    mode: "dry-run",
+    generatedAt: isoNow(options.now),
+    projectDigest: digest(
+      "chainlesschain.dynamic-workflow.recovery-project.v1\0",
+      path.resolve(cwd),
+    ),
+    planDigest: digest(
+      "chainlesschain.dynamic-workflow.recovery-plan.v1\0",
+      planMaterial,
+    ),
+    ...planMaterial,
+  });
+}

package/src/lib/execution-location-target.js

@@ -814,9 +814,11 @@ function transferTargetSessionStore(
     receipt.targetFactsDigest !== receiptMaterial.targetFactsDigest ||
     receipt.profileDigest !== receiptMaterial.profileDigest ||
     receipt.targetEvidenceId !== receiptMaterial.targetEvidenceId ||
+    // Target prepare records a fresh observedAt, so its attestation digest is
+    // expected to differ from the earlier source-side probe. The receipt is
+    // rehashed here and the next target `location show` validates that digest
+    // against the canonical handoff binding before resume.
     !SHA256_RE.test(receipt.attestationDigest || "") ||
-    (receipt.handoffAppended === true &&
-      receipt.attestationDigest !== attestation.attestationDigest) ||
     typeof receipt.replicaInstalled !== "boolean" ||
     typeof receipt.handoffAppended !== "boolean" ||
     receipt.receiptDigest !== expectedReceiptDigest

package/src/lib/mcp-client.js

@@ -23,5 +23,7 @@ export {
   isMcpAuthenticationError,
   isMcpRpcError,
   isTransientMcpError,
+  SUPPORTED_MCP_PROTOCOL_VERSIONS,
+  assertSupportedMcpProtocolVersion,
   _deps,
 } from "../harness/mcp-client.js";

package/src/lib/mcp-headers-helper.js

@@ -17,8 +17,8 @@ const { buildExplicitHookShellInvocation } = hookShellCommand;
 export const MCP_HEADERS_HELPER_TIMEOUT_MS = 10_000;
 export const MCP_HEADERS_HELPER_MAX_OUTPUT_BYTES = 64 * 1024;
 const MAX_HELPER_COMMAND_BYTES = 32 * 1024;
-const MAX_HEADER_COUNT = 128;
-const MAX_HEADER_VALUE_BYTES = 16 * 1024;
+export const MCP_HEADERS_HELPER_MAX_HEADER_COUNT = 128;
+export const MCP_HEADERS_HELPER_MAX_HEADER_VALUE_BYTES = 16 * 1024;
 const HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 const TRANSPORT_OWNED_HEADERS = new Set([
   "accept",
@@ -37,6 +37,25 @@ const TRANSPORT_OWNED_HEADERS = new Set([
   "upgrade",
 ]);
 const PUBLIC_CONFIG_SCOPES = new Set(["local", "project", "user", "managed"]);
+const HELPER_ENVIRONMENT_ALLOWLIST = new Set([
+  "COMSPEC",
+  "HOME",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "NODE_EXTRA_CA_CERTS",
+  "PATH",
+  "PATHEXT",
+  "SSL_CERT_DIR",
+  "SSL_CERT_FILE",
+  "SYSTEMROOT",
+  "TEMP",
+  "TMP",
+  "TMPDIR",
+  "USERPROFILE",
+  "WINDIR",
+  "XDG_CONFIG_HOME",
+]);
 
 function helperError(code, message) {
   const error = new Error(message);
@@ -98,6 +117,28 @@ function normalizeHelperCommand(value) {
   return value;
 }
 
+export function sanitizeMcpHeadersHelperEnvironment(environment = process.env) {
+  if (!environment || typeof environment !== "object" || isProxy(environment)) {
+    throw helperError(
+      "CC_MCP_HEADERS_HELPER_ENV_INVALID",
+      "MCP headersHelper environment must be a non-Proxy object",
+    );
+  }
+  const sanitized = {};
+  for (const key of Object.keys(environment)) {
+    if (!HELPER_ENVIRONMENT_ALLOWLIST.has(key.toUpperCase())) continue;
+    const descriptor = Object.getOwnPropertyDescriptor(environment, key);
+    if (!descriptor || !("value" in descriptor)) {
+      throw helperError(
+        "CC_MCP_HEADERS_HELPER_ENV_INVALID",
+        "MCP headersHelper environment values must be own data properties",
+      );
+    }
+    if (typeof descriptor.value === "string") sanitized[key] = descriptor.value;
+  }
+  return sanitized;
+}
+
 function canonicalHelperCwd(value, realpath = fs.realpathSync.native) {
   if (
     typeof value !== "string" ||
@@ -148,7 +189,7 @@ function normalizeHeaderMap(value, source) {
     );
   }
   const entries = Object.entries(value);
-  if (entries.length > MAX_HEADER_COUNT) {
+  if (entries.length > MCP_HEADERS_HELPER_MAX_HEADER_COUNT) {
     throw helperError(
       "CC_MCP_HEADERS_HELPER_OUTPUT_INVALID",
       `MCP ${source} headers exceed the allowed entry count`,
@@ -160,7 +201,8 @@ function normalizeHeaderMap(value, source) {
       !HEADER_NAME.test(name) ||
       typeof headerValue !== "string" ||
       hasInvalidHeaderValueCharacter(headerValue) ||
-      Buffer.byteLength(headerValue, "utf8") > MAX_HEADER_VALUE_BYTES ||
+      Buffer.byteLength(headerValue, "utf8") >
+        MCP_HEADERS_HELPER_MAX_HEADER_VALUE_BYTES ||
       (source === "dynamic" && TRANSPORT_OWNED_HEADERS.has(name.toLowerCase()))
     ) {
       throw helperError(
@@ -486,7 +528,7 @@ export function runMcpHeadersHelper(spec, deps = {}) {
     ),
   );
   const env = {
-    ...(spec?.env || process.env),
+    ...sanitizeMcpHeadersHelperEnvironment(spec?.env || process.env),
     CLAUDE_CODE_MCP_SERVER_NAME: String(spec?.serverName || ""),
     CLAUDE_CODE_MCP_SERVER_URL: String(spec?.serverUrl || ""),
     ...(spec?.pluginRoot

package/src/lib/mcp-oauth.js

@@ -52,6 +52,56 @@ export const _deps = {
   withStoreLock,
 };
 
+/**
+ * Resolve the exact IPv4-loopback redirect used by both the listener and the
+ * OAuth wire exchange. Pre-registered clients need byte-for-byte redirect URI
+ * stability, so explicit values are accepted only in canonical form.
+ */
+export function resolveOAuthLoopbackRedirect({
+  redirectUri,
+  host = "127.0.0.1",
+  port = 53682,
+  redirectPath = "/callback",
+} = {}) {
+  if (redirectUri != null && typeof redirectUri !== "string") {
+    throw new Error("OAuth redirectUri must be a string");
+  }
+  const candidate =
+    redirectUri == null ? `http://${host}:${port}${redirectPath}` : redirectUri;
+  let parsed;
+  try {
+    parsed = new URL(candidate);
+  } catch {
+    throw new Error("OAuth redirectUri must be a valid loopback URL");
+  }
+  const parsedPort = Number(parsed.port);
+  const canonical = `http://127.0.0.1:${parsed.port}${parsed.pathname}`;
+  if (
+    parsed.protocol !== "http:" ||
+    parsed.hostname !== "127.0.0.1" ||
+    !parsed.port ||
+    !Number.isInteger(parsedPort) ||
+    parsedPort < 1 ||
+    parsedPort > 65535 ||
+    parsed.username ||
+    parsed.password ||
+    parsed.search ||
+    parsed.hash ||
+    !parsed.pathname.startsWith("/") ||
+    candidate !== canonical
+  ) {
+    throw new Error(
+      "OAuth redirectUri must be an exact canonical http://127.0.0.1:<port>/<path> URL",
+    );
+  }
+  return {
+    redirectUri: candidate,
+    host: "127.0.0.1",
+    port: parsedPort,
+    redirectPath: parsed.pathname,
+  };
+}
+
 /** Discovery/token requests retry ONCE after a transient error (CC 2.1.191). */
 const MCP_OAUTH_RETRY_BACKOFF_MS = 300;
 
@@ -794,23 +844,22 @@ export function waitForCallback({
  * Run the full interactive Authorization Code + PKCE flow and persist the token.
  *
  * @param {string} serverUrl
- * @param {object} [opts] { scope, clientId, port=53682, host, redirectPath,
- *                          timeout, writeOut }
+ * @param {object} [opts] { scope, clientId, redirectUri, port=53682, host,
+ *                          redirectPath, timeout, writeOut }
  * @returns {Promise<{server, access_token, ...}>}  the stored record
  */
 export async function authorizeInteractive(serverUrl, opts = {}) {
   const {
     scope,
     clientId: cfgClientId,
-    port = 53682,
-    host = "127.0.0.1",
-    redirectPath = "/callback",
     timeout = 300_000,
     writeOut = (s) => process.stdout.write(s),
   } = opts;
 
+  const { redirectUri, host, port, redirectPath } =
+    resolveOAuthLoopbackRedirect(opts);
+
   const metadata = await discoverAuthMetadata(serverUrl);
-  const redirectUri = `http://${host}:${port}${redirectPath}`;
 
   let clientId = cfgClientId;
   let clientSecret = null;

package/src/lib/mcp-stdio-executable-identity.js

@@ -24,6 +24,10 @@ import {
   reattestMcpStdioPackageMaterialization,
   resolveMcpStdioPackageMaterialization,
 } from "./mcp-stdio-package-materialization.js";
+import {
+  isMcpStdioCapsuleNativeCodePolicy,
+  mcpStdioCapsuleNativeCodePolicyDigest,
+} from "./mcp-stdio-native-code-policy.js";
 import {
   isMcpStdioCodeInjectionEnvironmentKey,
   sanitizeMcpStdioHostEnvironment,
@@ -48,11 +52,13 @@ export const MCP_STDIO_RUNTIME_KIND_INVALID_CODE =
 export const MCP_STDIO_CAPSULE_SANDBOX_CONTRACT_KIND =
   "strict-mcp-node-capsule";
 export const MCP_STDIO_CAPSULE_CODE_SNAPSHOT_BOUNDARY = "code-snapshot";
+export const MCP_STDIO_CAPSULE_NATIVE_ADDON_BOUNDARY = "native-addon-loading";
 export const MCP_STDIO_CAPSULE_REQUIRED_BOUNDARIES = Object.freeze([
   MCP_STDIO_CAPSULE_CODE_SNAPSHOT_BOUNDARY,
   "filesystem",
   "network",
   "process-tree",
+  MCP_STDIO_CAPSULE_NATIVE_ADDON_BOUNDARY,
 ]);
 
 const STORE_LABEL = "MCP stdio executable identity";
@@ -852,6 +858,10 @@ function issueCapsuleSandboxExecutionContract({
   materialization,
 }) {
   if (!materialization) return null;
+  const nativeCodePolicy = materialization.identity?.capsule?.nativeCodePolicy;
+  if (!isMcpStdioCapsuleNativeCodePolicy(nativeCodePolicy)) {
+    throw new Error("MCP materialized capsule native-code policy is invalid");
+  }
   const capsuleRoot = attestCapsuleRoot(materialization.capsuleRoot);
   const entryIdentity = attestation.identity.entrypoints.find(
     (entry) => entry.argIndex === 0,
@@ -878,6 +888,7 @@ function issueCapsuleSandboxExecutionContract({
       attestation.identity.command,
       path.resolve(process.execPath),
     ),
+    nativeCodePolicy: Object.freeze({ ...nativeCodePolicy }),
   });
   issuedCapsuleSandboxContracts.set(
     contract,
@@ -888,6 +899,8 @@ function issueCapsuleSandboxExecutionContract({
       cwd: capsuleRoot.realPath,
       identityDigest: attestation.identityDigest,
       requiredBoundaries: MCP_STDIO_CAPSULE_REQUIRED_BOUNDARIES,
+      nativeCodePolicyDigest:
+        mcpStdioCapsuleNativeCodePolicyDigest(nativeCodePolicy),
     }),
   );
   return contract;
@@ -918,6 +931,9 @@ export function consumeMcpStdioCapsuleSandboxExecutionContract(
     issued.requiredBoundaries.every((boundary) =>
       requiredBoundaries.includes(boundary),
     ) &&
+    isMcpStdioCapsuleNativeCodePolicy(contract.nativeCodePolicy) &&
+    mcpStdioCapsuleNativeCodePolicyDigest(contract.nativeCodePolicy) ===
+      issued.nativeCodePolicyDigest &&
     args.length === issued.args.length &&
     args.every((value, index) => value === issued.args[index])
   );