chainlesschain 0.166.89 → 0.166.91

package/src/lib/process-execution-broker/platform-sandbox.js

@@ -783,6 +783,8 @@ function normalizeSandboxRequest(profileOrRequest, explicitRequest) {
     profile,
     requiredBoundaries,
     sync: request.sync === true,
+    wallTimeMs: request.limits?.wallTimeMs,
+    windowsNativeEvaluator: request.windowsNativeEvaluator || null,
     pty: request.pty === true,
     linuxCgroup: normalizeLinuxCgroupPolicy(request.linuxCgroup),
     executionContract:
@@ -2106,6 +2108,12 @@ export function applyMacSandbox(
       reason: "platform_mismatch",
     });
   }
+  if (sandboxOpts.limits?.wallTimeMs !== undefined) {
+    return createSandboxPlan({
+      ...base,
+      reason: "native_wall_time_limit_unsupported",
+    });
+  }
 
   if (
     Array.isArray(sandboxOpts.requiredBoundaries) &&
@@ -4205,10 +4213,14 @@ function windowsAppContainerPolicyDigest({
       },
       job: {
         killOnClose: true,
+        wallTimeMs: launchSpec.wallTimeMs,
         activeProcessLimit: launchSpec.activeProcessLimit,
         cpuSeconds: launchSpec.cpuSeconds,
         processMemoryBytes: launchSpec.processMemoryBytes,
       },
+      ...(launchSpec.nativeEvaluator
+        ? { nativeEvaluator: launchSpec.nativeEvaluator }
+        : {}),
       execution: {
         contractKind: executionContract?.kind || null,
         contentSnapshot: snapshotLocks.length > 0,
@@ -4310,6 +4322,15 @@ export function applyWindowsSandbox(
   if (runtime.platform !== "win32") {
     return unavailablePlan("platform_mismatch");
   }
+  const wallTimeMs = sandboxOpts.limits?.wallTimeMs ?? 0;
+  if (
+    sandboxOpts.limits?.wallTimeMs !== undefined &&
+    (!Number.isSafeInteger(wallTimeMs) ||
+      wallTimeMs < 1 ||
+      wallTimeMs > 3600000)
+  ) {
+    return unavailablePlan("windows_wall_time_limit_invalid");
+  }
   let windowsDirectory;
   try {
     windowsDirectory = path.win32.resolve(runtime.windowsDir());
@@ -4499,6 +4520,7 @@ export function applyWindowsSandbox(
     }
   }
   const launchSpec = {
+    wallTimeMs,
     cpuSeconds: Number(limits.cpu || 0),
     processMemoryBytes: Number(
       limits.as || (profile === "strict" ? 256 * 1024 * 1024 : 0),
@@ -4516,6 +4538,9 @@ export function applyWindowsSandbox(
     windowsHide: invocation.options.windowsHide === true,
     workingDirectory: targetWorkingDirectory,
     environment: targetEnvironment,
+    ...(sandboxOpts.windowsNativeEvaluator
+      ? { nativeEvaluator: sandboxOpts.windowsNativeEvaluator }
+      : {}),
   };
   if (entrySnapshot.locks) {
     launchSpec.launchPathLocks = entrySnapshot.locks;
@@ -4917,6 +4942,9 @@ export function applyWindowsSandbox(
     policyAttested: requiresAppContainer ? true : null,
     policyDigest: appContainerPolicyDigest,
     adapterTempRootAttestation: adapterSource.tempRootAttestation,
+    windowsWallTimeMs: wallTimeMs || null,
+    windowsNativeEvaluatorDigest:
+      sandboxOpts.windowsNativeEvaluator?.manifestDigest || null,
     runtimeProbe: entrySnapshotRuntimeProbe,
     guarantees: [
       ...(requiresAppContainer
@@ -8896,6 +8924,13 @@ export function applyLinuxSandbox(
     });
   }
 
+  if (sandboxOpts.limits?.wallTimeMs !== undefined) {
+    return createSandboxPlan({
+      ...base,
+      reason: "native_wall_time_limit_unsupported",
+    });
+  }
+
   const { limits = {} } = sandboxOpts;
   const requiredBoundaries = Array.isArray(sandboxOpts.requiredBoundaries)
     ? sandboxOpts.requiredBoundaries
@@ -9984,7 +10019,14 @@ export function applySandbox(
     pty: sandboxRequest.pty,
     linuxCgroup: sandboxRequest.linuxCgroup,
     executionContract: sandboxRequest.executionContract,
+    windowsNativeEvaluator: sandboxRequest.windowsNativeEvaluator,
   };
+  if (sandboxRequest.wallTimeMs !== undefined) {
+    profile.limits = {
+      ...profile.limits,
+      wallTimeMs: sandboxRequest.wallTimeMs,
+    };
+  }
 
   const applyRequestedLinuxCgroup = (plan) =>
     applyLinuxCgroupV2ToPlan(plan, sandboxRequest.linuxCgroup, {