chainlesschain 0.166.89 → 0.166.91

package/src/lib/process-execution-broker/windows-sandbox.cs

@@ -6,6 +6,8 @@ using System.IO;
 using Microsoft.Win32.SafeHandles;
 using System.Runtime.InteropServices;
 using System.Security.Cryptography;
+using System.Security.AccessControl;
+using System.Security.Principal;
 using System.Runtime.Serialization;
 using System.Runtime.Serialization.Json;
 using System.Text;
@@ -404,6 +406,45 @@ namespace ChainlessChain.WindowsSandbox
         private static extern Int32 DeleteAppContainerProfile(
             string appContainerName);
 
+        [DllImport("FirewallAPI.dll")]
+        private static extern UInt32 NetworkIsolationGetAppContainerConfig(out UInt32 count, out IntPtr sids);
+
+        [DllImport("kernel32.dll")]
+        private static extern IntPtr GetProcessHeap();
+
+        [DllImport("kernel32.dll")]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        private static extern bool HeapFree(IntPtr heap, UInt32 flags, IntPtr memory);
+
+        private static void AssertNoLoopbackExemption(IntPtr appSid)
+        {
+            UInt32 count;
+            IntPtr entries;
+            UInt32 result = NetworkIsolationGetAppContainerConfig(out count, out entries);
+            if (result != 0) throw new Win32Exception(checked((int)result), "Cannot attest AppContainer loopback exclusions");
+            // SID_AND_ATTRIBUTES contains a pointer and DWORD; x64 tail padding
+            // makes each entry two pointer widths. Free each SID and the array
+            // with the process heap, as documented by this API.
+            int stride = IntPtr.Size == 8 ? 16 : 8;
+            try
+            {
+                if (count > 65536 || (count > 0 && entries == IntPtr.Zero))
+                    throw new InvalidDataException("Invalid AppContainer loopback configuration");
+                for (UInt32 index = 0; index < count; index++)
+                    if (EqualSid(Marshal.ReadIntPtr(entries, checked((int)index * stride)), appSid))
+                        throw new InvalidDataException("Native evaluator SID has a loopback exemption");
+            }
+            finally
+            {
+                if (entries != IntPtr.Zero)
+                {
+                    for (UInt32 index = 0; index < Math.Min(count, 65536U); index++)
+                        HeapFree(GetProcessHeap(), 0, Marshal.ReadIntPtr(entries, checked((int)index * stride)));
+                    HeapFree(GetProcessHeap(), 0, entries);
+                }
+            }
+        }
+
         [DllImport("msvcrt.dll", CallingConvention = CallingConvention.Cdecl)]
         private static extern IntPtr _get_osfhandle(Int32 fileDescriptor);
 
@@ -584,6 +625,13 @@ namespace ChainlessChain.WindowsSandbox
             UInt32 desiredAccess,
             out IntPtr token);
 
+        [DllImport("advapi32.dll", EntryPoint = "SetFileSecurityW", CharSet = CharSet.Unicode, SetLastError = true)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        private static extern bool SetFileSecurity(
+            string path,
+            UInt32 securityInformation,
+            byte[] securityDescriptor);
+
         [DllImport("advapi32.dll", SetLastError = true)]
         [return: MarshalAs(UnmanagedType.Bool)]
         private static extern bool CreateRestrictedToken(
@@ -995,7 +1043,7 @@ namespace ChainlessChain.WindowsSandbox
                 "restriction status");
         }
 
-        private static bool TokenHasUnexpectedEnabledPrivileges(IntPtr token)
+        private static bool TokenHasUnexpectedEnabledPrivileges(IntPtr token, bool includeDisabled = false)
         {
             IntPtr privilegesBuffer = IntPtr.Zero;
             try
@@ -1049,11 +1097,11 @@ namespace ChainlessChain.WindowsSandbox
                         privilegeName.ToString(),
                         "SeChangeNotifyPrivilege",
                         StringComparison.Ordinal) &&
-                        (
+                        (includeDisabled || (
                             privilege.Attributes &
                             (
                                 SE_PRIVILEGE_ENABLED |
-                                SE_PRIVILEGE_ENABLED_BY_DEFAULT)) != 0)
+                                SE_PRIVILEGE_ENABLED_BY_DEFAULT)) != 0))
                     {
                         return true;
                     }
@@ -1244,7 +1292,8 @@ namespace ChainlessChain.WindowsSandbox
                         StringComparison.Ordinal))
                     {
                         throw new InvalidDataException(
-                            "Target AppContainer token retained an unexpected privilege");
+                            "Target AppContainer token retained an unexpected privilege: " + privilegeName +
+                            " (attributes=" + privilege.Attributes + ")");
                     }
                 }
                 return SidToString(actualAppContainerSid);
@@ -2102,6 +2151,7 @@ namespace ChainlessChain.WindowsSandbox
             string finalPath,
             FILE_ID_INFO handleIdentity,
             UInt64 handlePathStatFileId,
+            bool allowDirectory,
             out NodeFileIdentityProjection fixedProjection,
             out NodeFileIdentityProjection node22Projection)
         {
@@ -2131,8 +2181,10 @@ namespace ChainlessChain.WindowsSandbox
             }
 
             UInt64 pathStatFileId = unchecked((UInt64)information.FileId);
+            // Evaluator guards also attest directories. Keep the caller's
+            // type restriction consistent across fast and legacy stat paths.
             if (
-                (information.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0 ||
+                (!allowDirectory && (information.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0) ||
                 (information.FileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0 ||
                 information.VolumeSerialNumber !=
                     handleIdentity.VolumeSerialNumber ||
@@ -2165,13 +2217,14 @@ namespace ChainlessChain.WindowsSandbox
         }
 
         private static LaunchPathFileIdentity ReadLaunchPathFileIdentity(
-            IntPtr handle)
+            IntPtr handle,
+            bool allowDirectory = false)
         {
             BY_HANDLE_FILE_INFORMATION basic;
             if (!GetFileInformationByHandle(handle, out basic))
                 ThrowLastError("GetFileInformationByHandle(launch path)");
             if (
-                (basic.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0 ||
+                (!allowDirectory && (basic.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0) ||
                 (basic.FileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0)
             {
                 throw new InvalidDataException(
@@ -2201,6 +2254,7 @@ namespace ChainlessChain.WindowsSandbox
                     finalPath,
                     fileId,
                     handlePathStatFileId,
+                    allowDirectory,
                     out fixedFastNodeIdentity,
                     out node22FastNodeIdentity);
             }
@@ -3203,6 +3257,248 @@ namespace ChainlessChain.WindowsSandbox
             }
         }
 
+        [DataContract]
+        public sealed class EvaluatorPathSpec
+        {
+            [DataMember] public string path { get; set; }
+            [DataMember] public string dev { get; set; }
+            [DataMember] public string ino { get; set; }
+            [DataMember] public long bytes { get; set; }
+            [DataMember] public string sha256 { get; set; }
+        }
+
+        [DataContract]
+        public sealed class NativeEvaluatorSpec
+        {
+            [DataMember] public int version { get; set; }
+            [DataMember] public string root { get; set; }
+            [DataMember] public string workspace { get; set; }
+            [DataMember] public string control { get; set; }
+            [DataMember] public string scratch { get; set; }
+            [DataMember] public string check { get; set; }
+            [DataMember] public int wallTimeMs { get; set; }
+            [DataMember] public string manifestDigest { get; set; }
+            [DataMember] public EvaluatorPathSpec runtime { get; set; }
+            [DataMember] public EvaluatorPathSpec[] directories { get; set; }
+            [DataMember] public EvaluatorPathSpec[] files { get; set; }
+        }
+
+        private static bool SameEvaluatorPath(string left, string right)
+        {
+            return String.Equals(Path.GetFullPath(left), Path.GetFullPath(right), StringComparison.OrdinalIgnoreCase);
+        }
+
+        private static IntPtr HoldEvaluatorPath(string file, bool directory, List<IntPtr> guards)
+        {
+            ValidateExistingLocalPath(file, "Native evaluator path", false);
+            SECURITY_ATTRIBUTES attributes = new SECURITY_ATTRIBUTES();
+            attributes.nLength = checked((UInt32)Marshal.SizeOf(typeof(SECURITY_ATTRIBUTES)));
+            // Directory handles block rename/deletion; read-only file handles
+            // block writes and deletion for the complete target Job lifetime.
+            IntPtr handle = CreateFile(file, directory ? FILE_READ_ATTRIBUTES : GENERIC_READ,
+                directory ? FILE_SHARE_READ | FILE_SHARE_WRITE : FILE_SHARE_READ,
+                ref attributes, OPEN_EXISTING, directory ? 0x02200000U : 0x00200000U, IntPtr.Zero);
+            if (IsInvalidHandle(handle)) ThrowLastError("CreateFile(native evaluator guard)");
+            guards.Add(handle);
+            return handle;
+        }
+
+        private static void VerifyEvaluatorPath(EvaluatorPathSpec expected, IntPtr handle, bool directory)
+        {
+            LaunchPathFileIdentity actual = ReadLaunchPathFileIdentity(handle, directory);
+            UInt64 device, inode;
+            if (!UInt64.TryParse(expected.dev, out device) || !UInt64.TryParse(expected.ino, out inode) ||
+                !MatchesExpectedNodeFileIdentity(actual, device, inode) ||
+                !SameEvaluatorPath(NormalizeFinalPath(actual.FinalPath), expected.path) ||
+                (((actual.Attributes & FILE_ATTRIBUTE_DIRECTORY) != 0) != directory))
+                throw new InvalidDataException("Native evaluator path identity changed");
+            if (directory) return;
+            if (actual.Links != 1 || actual.Bytes != (UInt64)expected.bytes || !IsLowercaseSha256(expected.sha256))
+                throw new InvalidDataException("Native evaluator file identity or link count changed");
+            using (SafeFileHandle safe = new SafeFileHandle(handle, false))
+            using (FileStream stream = new FileStream(safe, FileAccess.Read))
+            using (SHA256 algorithm = SHA256.Create())
+            {
+                string digest = BitConverter.ToString(algorithm.ComputeHash(stream)).Replace("-", "").ToLowerInvariant();
+                if (digest != expected.sha256) throw new InvalidDataException("Native evaluator file digest changed");
+            }
+        }
+
+        private static void PrepareNativeEvaluator(NativeEvaluatorSpec spec, string application,
+            string[] arguments, string workingDirectory, string appSid, int wallTimeMs,
+            List<IntPtr> guards, ref bool rootAttested)
+        {
+            if (spec.version != 1 || !IsLowercaseSha256(spec.manifestDigest) || spec.runtime == null ||
+                spec.directories == null || spec.directories.Length < 4 || spec.directories.Length > 128 ||
+                spec.files == null || spec.files.Length < 2 || spec.files.Length > 65 ||
+                wallTimeMs < 1 || spec.wallTimeMs != wallTimeMs || String.IsNullOrWhiteSpace(appSid))
+                throw new InvalidDataException("Native evaluator manifest is incomplete");
+            string root = NormalizeLocalDosPath(spec.root, null, "Native evaluator stage");
+            string expectedParent = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "Temp");
+            if (!SameEvaluatorPath(Path.GetDirectoryName(root), expectedParent) ||
+                !System.Text.RegularExpressions.Regex.IsMatch(Path.GetFileName(root), "^cc-native-evaluator-[A-Za-z0-9_-]{6}$") ||
+                !SameEvaluatorPath(spec.workspace, Path.Combine(root, "workspace")) ||
+                !SameEvaluatorPath(spec.control, Path.Combine(root, "control")) ||
+                !SameEvaluatorPath(spec.scratch, Path.Combine(root, "scratch")) ||
+                !SameEvaluatorPath(spec.check, Path.Combine(spec.control, "check.cjs")) ||
+                !SameEvaluatorPath(spec.runtime.path, Path.Combine(spec.control, "node.exe")) ||
+                !SameEvaluatorPath(application, spec.runtime.path) || arguments.Length != 5 ||
+                arguments[0] != "--preserve-symlinks" || arguments[1] != "--preserve-symlinks-main" ||
+                !SameEvaluatorPath(arguments[2], spec.check) || !SameEvaluatorPath(arguments[3], spec.workspace) ||
+                !SameEvaluatorPath(arguments[4], spec.scratch) || !SameEvaluatorPath(workingDirectory, spec.scratch) ||
+                !SameEvaluatorPath(spec.directories[0].path, root))
+                throw new InvalidDataException("Native evaluator launch or private stage binding changed");
+            string ancestor = Path.GetPathRoot(root);
+            foreach (string part in root.Substring(ancestor.Length).Split(Path.DirectorySeparatorChar))
+            {
+                ancestor = Path.Combine(ancestor, part);
+                if (!SameEvaluatorPath(ancestor, root)) HoldEvaluatorPath(ancestor, true, guards);
+            }
+            HashSet<string> expected = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+            foreach (EvaluatorPathSpec directory in spec.directories)
+            {
+                string full = Path.GetFullPath(directory.path);
+                if ((!SameEvaluatorPath(full, root) && !full.StartsWith(root + "\\", StringComparison.OrdinalIgnoreCase)) || !expected.Add(full))
+                    throw new InvalidDataException("Native evaluator directory is outside the private stage or duplicated");
+                VerifyEvaluatorPath(directory, HoldEvaluatorPath(full, true, guards), true);
+                if (SameEvaluatorPath(full, root)) rootAttested = true;
+            }
+            long total = 0;
+            foreach (EvaluatorPathSpec file in spec.files)
+            {
+                string full = Path.GetFullPath(file.path);
+                if ((!full.StartsWith(spec.workspace + "\\", StringComparison.OrdinalIgnoreCase) && !SameEvaluatorPath(full, spec.check)) ||
+                    !expected.Add(full) || file.bytes < 0 || file.bytes > 1024 * 1024)
+                    throw new InvalidDataException("Native evaluator file is outside its read-only roots or exceeds bounds");
+                total = checked(total + file.bytes);
+                if (total > 8 * 1024 * 1024) throw new InvalidDataException("Native evaluator tree exceeds byte bound");
+                VerifyEvaluatorPath(file, HoldEvaluatorPath(full, false, guards), false);
+            }
+            if (!expected.Contains(spec.check) || !expected.Contains(spec.workspace) || !expected.Contains(spec.control) || !expected.Contains(spec.scratch))
+                throw new InvalidDataException("Native evaluator manifest omits a required path");
+            if (spec.runtime.bytes < 1 || spec.runtime.bytes > 128 * 1024 * 1024 || !expected.Add(spec.runtime.path))
+                throw new InvalidDataException("Native evaluator runtime exceeds byte bound or duplicates a path");
+            VerifyEvaluatorPath(spec.runtime, HoldEvaluatorPath(application, false, guards), false);
+            foreach (EvaluatorPathSpec directory in spec.directories)
+                foreach (string child in Directory.GetFileSystemEntries(directory.path))
+                    if (!expected.Contains(child)) throw new InvalidDataException("Native evaluator tree has an unlisted entry");
+            if (Directory.GetFileSystemEntries(spec.scratch).Length != 0)
+                throw new InvalidDataException("Native evaluator scratch must start empty");
+            SecurityIdentifier sid = new SecurityIdentifier(appSid);
+            SecurityIdentifier owner = WindowsIdentity.GetCurrent().User;
+            SecurityIdentifier system = new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null);
+            foreach (EvaluatorPathSpec directory in spec.directories)
+            {
+                DirectorySecurity security = new DirectorySecurity();
+                security.SetAccessRuleProtection(true, false);
+                security.AddAccessRule(new FileSystemAccessRule(owner, FileSystemRights.FullControl,
+                    InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit, PropagationFlags.None, AccessControlType.Allow));
+                security.AddAccessRule(new FileSystemAccessRule(system, FileSystemRights.FullControl,
+                    InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit, PropagationFlags.None, AccessControlType.Allow));
+                bool scratch = SameEvaluatorPath(directory.path, spec.scratch);
+                security.AddAccessRule(new FileSystemAccessRule(sid,
+                    scratch ? FileSystemRights.Modify : FileSystemRights.ReadAndExecute,
+                    scratch ? InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit : InheritanceFlags.None,
+                    PropagationFlags.None, AccessControlType.Allow));
+                SetEvaluatorAccessControl(directory.path, security);
+            }
+            foreach (EvaluatorPathSpec file in spec.files)
+            {
+                FileSecurity security = new FileSecurity();
+                security.SetAccessRuleProtection(true, false);
+                security.AddAccessRule(new FileSystemAccessRule(owner, FileSystemRights.FullControl, AccessControlType.Allow));
+                security.AddAccessRule(new FileSystemAccessRule(system, FileSystemRights.FullControl, AccessControlType.Allow));
+                security.AddAccessRule(new FileSystemAccessRule(sid, FileSystemRights.ReadAndExecute, AccessControlType.Allow));
+                SetEvaluatorAccessControl(file.path, security);
+            }
+            FileSecurity runtimeSecurity = new FileSecurity();
+            runtimeSecurity.SetAccessRuleProtection(true, false);
+            runtimeSecurity.AddAccessRule(new FileSystemAccessRule(owner, FileSystemRights.FullControl, AccessControlType.Allow));
+            runtimeSecurity.AddAccessRule(new FileSystemAccessRule(system, FileSystemRights.FullControl, AccessControlType.Allow));
+            runtimeSecurity.AddAccessRule(new FileSystemAccessRule(sid, FileSystemRights.ReadAndExecute, AccessControlType.Allow));
+            SetEvaluatorAccessControl(spec.runtime.path, runtimeSecurity);
+        }
+
+        private static void SetEvaluatorAccessControl(string path, FileSystemSecurity security)
+        {
+            // Directory/File.SetAccessControl exist only in .NET Framework.
+            // Persist the same protected DACL through Win32 so the byte-loaded
+            // assembly enforces identical ACLs in Windows PowerShell and pwsh.
+            if (!security.AreAccessRulesProtected)
+                throw new InvalidDataException("Native evaluator DACL must be protected");
+            const UInt32 DACL_SECURITY_INFORMATION = 0x00000004;
+            const UInt32 PROTECTED_DACL_SECURITY_INFORMATION = 0x80000000;
+            if (!SetFileSecurity(path,
+                DACL_SECURITY_INFORMATION | PROTECTED_DACL_SECURITY_INFORMATION,
+                security.GetSecurityDescriptorBinaryForm()))
+                ThrowLastError("SetFileSecurity(native evaluator protected DACL)");
+        }
+
+        // This timer belongs to the native supervisor, not the JavaScript
+        // caller. It also covers a target that stops reading its entry pipe.
+        // The gate prevents a queued callback from touching a closed/reused
+        // Job handle after Dispose. Cleanup still requires an empty-Job fence.
+        private sealed class JobWallTimeWatchdog : IDisposable
+        {
+            private readonly object gate = new object();
+            private readonly IntPtr job;
+            private readonly int milliseconds;
+            private readonly System.Diagnostics.Stopwatch clock;
+            private readonly Timer timer;
+            private bool stopped;
+            private bool expired;
+            private int terminationError;
+
+            public JobWallTimeWatchdog(IntPtr jobHandle, int wallTimeMs)
+            {
+                job = jobHandle;
+                milliseconds = wallTimeMs;
+                clock = System.Diagnostics.Stopwatch.StartNew();
+                timer = new Timer(Expire, null, wallTimeMs, Timeout.Infinite);
+            }
+
+            private void Expire(object state)
+            {
+                lock (gate)
+                {
+                    if (stopped) return;
+                    expired = true;
+                    if (!TerminateJobObject(job, 125))
+                        terminationError = Marshal.GetLastWin32Error();
+                }
+            }
+
+            public UInt32 RemainingMilliseconds
+            {
+                get
+                {
+                    return checked((UInt32)Math.Max(
+                        0L, milliseconds - clock.ElapsedMilliseconds));
+                }
+            }
+
+            public void ThrowIfExpired()
+            {
+                lock (gate)
+                {
+                    if (expired || clock.ElapsedMilliseconds >= milliseconds)
+                        throw new TimeoutException(
+                            "Windows sandbox wall-time limit exceeded" +
+                            (terminationError == 0 ? String.Empty :
+                                " (Job termination error " + terminationError + ")"));
+                }
+            }
+
+            public void Dispose()
+            {
+                lock (gate)
+                {
+                    stopped = true;
+                    timer.Dispose();
+                }
+            }
+        }
+
         public static int Run(
             string application,
             string[] arguments,
@@ -3222,8 +3518,12 @@ namespace ChainlessChain.WindowsSandbox
             LaunchPathLockSpec[] launchPathLockSpecs,
             byte[] entrySnapshotOverride,
             string snapshotTestGateToken,
-            string snapshotTestGateReleasePath)
+            string snapshotTestGateReleasePath,
+            int wallTimeMs = 0,
+            NativeEvaluatorSpec nativeEvaluator = null)
         {
+            if (wallTimeMs < 0 || wallTimeMs > 3600000)
+                throw new ArgumentOutOfRangeException("wallTimeMs");
             targetEnvironment =
                 targetEnvironment ?? CaptureCurrentEnvironment();
             workingDirectory = NormalizeLocalDosPath(
@@ -3290,6 +3590,9 @@ namespace ChainlessChain.WindowsSandbox
             bool targetExited = false;
             int targetExitCode = 125;
             Exception launchError = null;
+            JobWallTimeWatchdog wallTimeWatchdog = null;
+            List<IntPtr> evaluatorGuards = new List<IntPtr>();
+            bool evaluatorRootAttested = false;
 
             try
             {
@@ -3359,6 +3662,19 @@ namespace ChainlessChain.WindowsSandbox
                     }
                     ConfigureAppContainerEnvironment(targetEnvironment);
                 }
+                if (nativeEvaluator != null)
+                {
+                    if (!useAppContainer || nodeIpcFd >= 0 || detached || entrySnapshot != null)
+                        throw new InvalidDataException("Native evaluator requires a synchronous AppContainer launch");
+                    AssertNoLoopbackExemption(appContainerSid);
+                    PrepareNativeEvaluator(nativeEvaluator, application, arguments, workingDirectory,
+                        expectedAppContainerSid, wallTimeMs, evaluatorGuards, ref evaluatorRootAttested);
+                    targetEnvironment = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+                    targetEnvironment["SystemRoot"] = Path.GetDirectoryName(Environment.SystemDirectory);
+                    targetEnvironment["WINDIR"] = Path.GetDirectoryName(Environment.SystemDirectory);
+                    targetEnvironment["PATH"] = Path.GetDirectoryName(application);
+                    ConfigureAppContainerEnvironment(targetEnvironment);
+                }
                 environmentBuffer =
                     BuildEnvironmentBlock(targetEnvironment);
 
@@ -3387,8 +3703,12 @@ namespace ChainlessChain.WindowsSandbox
                 // an exact primary-token duplicate instead of filtering again.
                 bool sourceTokenWasFiltered =
                     TokenWasFiltered(sourceToken);
+                // A UAC-filtered token can retain disabled privileges. The
+                // AppContainer attestation requires their removal, not merely
+                // that they are disabled. Compatibility workers retain their
+                // existing enabled-only predicate for nested token support.
                 bool sourceTokenHasUnexpectedEnabledPrivileges =
-                    TokenHasUnexpectedEnabledPrivileges(sourceToken);
+                    TokenHasUnexpectedEnabledPrivileges(sourceToken, useAppContainer);
                 bool sourceTokenHasEnabledAdministratorSid =
                     disableAdministratorSids &&
                     TokenHasEnabledAdministratorSid(sourceToken);
@@ -3627,6 +3947,8 @@ namespace ChainlessChain.WindowsSandbox
                 // atomic handoff; release the stream guards before resume so
                 // target code cannot deadlock on a break owned by the helper.
                 ReleaseLaunchPathLocks(launchPathLocks);
+                if (wallTimeMs > 0)
+                    wallTimeWatchdog = new JobWallTimeWatchdog(job, wallTimeMs);
                 if (ResumeThread(processInfo.hThread) == UInt32.MaxValue)
                 {
                     TerminateProcess(processInfo.hProcess, 125);
@@ -3668,7 +3990,13 @@ namespace ChainlessChain.WindowsSandbox
 
                 UInt32 targetWait = WaitForSingleObject(
                     processInfo.hProcess,
-                    INFINITE);
+                    wallTimeWatchdog == null ? INFINITE :
+                        wallTimeWatchdog.RemainingMilliseconds);
+                if (targetWait == WAIT_TIMEOUT && wallTimeWatchdog != null)
+                    throw new TimeoutException(
+                        "Windows sandbox wall-time limit exceeded");
+                if (wallTimeWatchdog != null)
+                    wallTimeWatchdog.ThrowIfExpired();
                 if (targetWait != WAIT_OBJECT_0)
                     ThrowLastError("WaitForSingleObject(target)");
                 targetExited = true;
@@ -3684,6 +4012,12 @@ namespace ChainlessChain.WindowsSandbox
             finally
             {
                 Exception cleanupError = null;
+                if (wallTimeWatchdog != null)
+                {
+                    wallTimeWatchdog.Dispose();
+                    try { wallTimeWatchdog.ThrowIfExpired(); }
+                    catch (TimeoutException error) { launchError = error; }
+                }
                 if (processInfo.hProcess != IntPtr.Zero && !targetExited)
                     TerminateProcess(processInfo.hProcess, 125);
                 if (job != IntPtr.Zero)
@@ -3742,6 +4076,11 @@ namespace ChainlessChain.WindowsSandbox
                 foreach (IntPtr handle in ownedStandardHandles)
                     CloseHandle(handle);
                 if (limitBuffer != IntPtr.Zero) Marshal.FreeHGlobal(limitBuffer);
+                if (nativeEvaluator != null && !IsInvalidHandle(appContainerSid))
+                {
+                    try { AssertNoLoopbackExemption(appContainerSid); }
+                    catch (Exception error) { cleanupError = error; }
+                }
                 if (!IsInvalidHandle(appContainerSid)) FreeSid(appContainerSid);
                 if (restrictedToken != IntPtr.Zero) CloseHandle(restrictedToken);
                 if (sourceToken != IntPtr.Zero) CloseHandle(sourceToken);
@@ -3776,11 +4115,38 @@ namespace ChainlessChain.WindowsSandbox
                                 launchError,
                                 cleanupError);
                 }
+                if (nativeEvaluator != null && evaluatorRootAttested && cleanupError == null)
+                {
+                    try
+                    {
+                        PublishTargetIdentity(Path.Combine(nativeEvaluator.root, "settlement.json"),
+                            JsonCodec.SerializeObject("manifestDigest", nativeEvaluator.manifestDigest,
+                                "cleanupConfirmed", true, "capabilityCount", 0,
+                                "loopbackExemptionAbsent", true,
+                                "targetPid", processInfo.dwProcessId,
+                                "appContainerSid", expectedAppContainerSid,
+                                "wallTimeMs", wallTimeMs,
+                                "targetExitCode", targetExitCode,
+                                "supervisorUserSidSha256", HashEvaluatorUserSid(),
+                                "executionFailed", launchError != null));
+                    }
+                    catch (Exception error) { launchError = error; }
+                }
+                foreach (IntPtr guard in evaluatorGuards) CloseHandle(guard);
+                evaluatorGuards.Clear();
             }
             if (launchError != null)
                 throw launchError;
             return targetExitCode;
         }
+
+        private static string HashEvaluatorUserSid()
+        {
+            using (WindowsIdentity identity = WindowsIdentity.GetCurrent())
+            using (SHA256 algorithm = SHA256.Create())
+                return BitConverter.ToString(algorithm.ComputeHash(Encoding.UTF8.GetBytes(identity.User.Value)))
+                    .Replace("-", "").ToLowerInvariant();
+        }
     }
 
     public static class Program
@@ -3791,6 +4157,10 @@ namespace ChainlessChain.WindowsSandbox
         [DataContract]
         public sealed class LaunchSpec
         {
+            [DataMember]
+            public Native.NativeEvaluatorSpec nativeEvaluator { get; set; }
+            [DataMember]
+            public int wallTimeMs { get; set; }
             [DataMember]
             public int cpuSeconds { get; set; }
             [DataMember]
@@ -4159,7 +4529,9 @@ namespace ChainlessChain.WindowsSandbox
                     spec.launchPathLocks,
                     null,
                     spec.snapshotTestGateToken,
-                    spec.snapshotTestGateReleasePath);
+                    spec.snapshotTestGateReleasePath,
+                    spec.wallTimeMs,
+                    spec.nativeEvaluator);
             }
             catch (Exception error)
             {

package/src/lib/scheduler-kernel/automation-adapter.js

@@ -779,7 +779,7 @@ function existingExecutionResult(db, occurrence, expected, now) {
   }
   if (execution.status !== EXECUTION_STATUS.SUCCESS) {
     throw automationError(
-      "AUTOMATION_SCHEDULER_EXECUTION_FAILED",
+      executionFailureCode(execution.status),
       `Automation execution did not succeed: ${execution.id}`,
       { executionId: execution.id, status: execution.status },
     );
@@ -790,6 +790,14 @@ function existingExecutionResult(db, occurrence, expected, now) {
   return execution;
 }
 
+function executionFailureCode(status) {
+  if (status === EXECUTION_STATUS.UNSUPPORTED)
+    return "AUTOMATION_EXECUTION_UNSUPPORTED";
+  if (status === EXECUTION_STATUS.SIMULATED)
+    return "AUTOMATION_EXECUTION_SIMULATED";
+  return "AUTOMATION_SCHEDULER_EXECUTION_FAILED";
+}
+
 export function createAutomationSchedulerAdapter({ db, now = Date.now } = {}) {
   if (!db || typeof db.prepare !== "function") {
     throw automationError(
@@ -930,9 +938,13 @@ export function createAutomationSchedulerAdapter({ db, now = Date.now } = {}) {
       }
       if (execution.status !== EXECUTION_STATUS.SUCCESS) {
         throw automationError(
-          "AUTOMATION_SCHEDULER_EXECUTION_FAILED",
+          executionFailureCode(execution.status),
           `Automation execution failed: ${execution.id}`,
-          { executionId: execution.id, error: execution.error },
+          {
+            executionId: execution.id,
+            status: execution.status,
+            error: execution.error,
+          },
         );
       }
       resolveAutomationExecutionIncidentsForSucceededRun(db, execution.id, {

package/src/lib/scheduler-kernel/automation-event-adapter.js

@@ -576,7 +576,7 @@ function existingExecutionResult(db, occurrence, expectedFlow, now) {
   }
   if (execution.status !== EXECUTION_STATUS.SUCCESS) {
     throw eventError(
-      "AUTOMATION_EVENT_EXECUTION_FAILED",
+      executionFailureCode(execution.status),
       `automation event execution did not succeed: ${execution.id}`,
       { executionId: execution.id, status: execution.status },
     );
@@ -587,6 +587,14 @@ function existingExecutionResult(db, occurrence, expectedFlow, now) {
   return execution;
 }
 
+function executionFailureCode(status) {
+  if (status === EXECUTION_STATUS.UNSUPPORTED)
+    return "AUTOMATION_EXECUTION_UNSUPPORTED";
+  if (status === EXECUTION_STATUS.SIMULATED)
+    return "AUTOMATION_EXECUTION_SIMULATED";
+  return "AUTOMATION_EVENT_EXECUTION_FAILED";
+}
+
 export function createAutomationEventAdapter({ db, now = Date.now } = {}) {
   if (!db || typeof db.prepare !== "function") {
     throw eventError(
@@ -729,9 +737,13 @@ export function createAutomationEventAdapter({ db, now = Date.now } = {}) {
       }
       if (execution.status !== EXECUTION_STATUS.SUCCESS) {
         throw eventError(
-          "AUTOMATION_EVENT_EXECUTION_FAILED",
+          executionFailureCode(execution.status),
           `automation event execution failed: ${execution.id}`,
-          { executionId: execution.id, error: execution.error },
+          {
+            executionId: execution.id,
+            status: execution.status,
+            error: execution.error,
+          },
         );
       }
       resolveAutomationExecutionIncidentsForSucceededRun(db, execution.id, {

package/src/assets/web-panel/assets/devWarning-D90arbUg.js

@@ -1 +0,0 @@
-import{Q as r}from"./index-ClsJN8sW.js";const o=((n,a,e)=>{r(n,`[ant-design-vue: ${a}] ${e}`)});export{o as d};

package/src/assets/web-panel/assets/index-CeP1oROI.js

@@ -1 +0,0 @@
-import{A as o}from"./Row-4Jj6JyXN.js";import{a0 as t}from"./index-ClsJN8sW.js";import"./vendor-Bn1JzzAn.js";import"./responsiveObserve-B4xDxO7Q.js";import"./useFlexGapSupport-WChWQURv.js";import"./styleChecker-BYOJOyqL.js";import"./index-KWt8Owo8.js";import"./icons-DG5UD-6K.js";const l=t(o);export{l as default};

package/src/assets/web-panel/assets/index-Cu9gkyRc.js

@@ -1 +0,0 @@
-import{C as o}from"./Col-4M6bKRRO.js";import{a0 as t}from"./index-ClsJN8sW.js";import"./vendor-Bn1JzzAn.js";import"./index-KWt8Owo8.js";import"./icons-DG5UD-6K.js";const s=t(o);export{s as default};