chainlesschain 0.166.93 → 0.166.96

package/src/lib/process-execution-broker/windows-native-evaluator.js

@@ -8,9 +8,77 @@ const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
 const MAX_FILE_BYTES = 1024 * 1024;
 const MAX_TOTAL_BYTES = 8 * MAX_FILE_BYTES;
 const MAX_FILES = 64;
+const V1_LIMITS = Object.freeze({
+  version: 1,
+  files: MAX_FILES,
+  fileBytes: MAX_FILE_BYTES,
+  totalBytes: MAX_TOTAL_BYTES,
+  directories: 128,
+  pathBytes: 180,
+  depth: 8,
+});
+const V2_LIMITS = Object.freeze({
+  version: 2,
+  files: 20000,
+  fileBytes: 32 * MAX_FILE_BYTES,
+  totalBytes: 512 * MAX_FILE_BYTES,
+  directories: 20000,
+  pathBytes: 1024,
+  depth: 32,
+});
 function requireCondition(condition, message) {
   if (!condition) throw new Error(`Windows native evaluator: ${message}`);
 }
+function readBoundedBytes(file, maxBytes) {
+  const named = fs.lstatSync(file, { bigint: true });
+  requireCondition(
+    named.isFile() &&
+      !named.isSymbolicLink() &&
+      named.nlink === 1n &&
+      named.size <= BigInt(maxBytes),
+    "plain bounded file required",
+  );
+  const fd = fs.openSync(file, fs.constants.O_RDONLY);
+  try {
+    const before = fs.fstatSync(fd, { bigint: true });
+    requireCondition(
+      before.isFile() && before.nlink === 1n && before.size <= BigInt(maxBytes),
+      "opened file exceeds byte limit or is linked",
+    );
+    const bytes = Buffer.alloc(Number(before.size) + 1);
+    let count = 0;
+    while (count < bytes.length) {
+      const read = fs.readSync(fd, bytes, count, bytes.length - count, count);
+      if (!read) break;
+      count += read;
+    }
+    const after = fs.fstatSync(fd, { bigint: true });
+    const current = fs.lstatSync(file, { bigint: true });
+    const reopened = fs.openSync(file, fs.constants.O_RDONLY);
+    let second;
+    try {
+      second = fs.fstatSync(reopened, { bigint: true });
+    } finally {
+      fs.closeSync(reopened);
+    }
+    const same = (left, right) =>
+      ["dev", "ino", "size", "mtimeNs", "ctimeNs", "nlink"].every(
+        (key) => left[key] === right[key],
+      );
+    // Compare pathname identities and descriptor identities in their own
+    // domains; on Windows their inode representations can differ.
+    requireCondition(
+      count === Number(before.size) &&
+        same(named, current) &&
+        same(before, after) &&
+        same(after, second),
+      "file changed during bounded capture",
+    );
+    return bytes.subarray(0, count);
+  } finally {
+    fs.closeSync(fd);
+  }
+}
 function identity(file, directory = false, maxBytes = MAX_FILE_BYTES) {
   const stat = fs.lstatSync(file, { bigint: true });
   requireCondition(
@@ -32,20 +100,28 @@ function identity(file, directory = false, maxBytes = MAX_FILE_BYTES) {
     ino: String(stat.ino),
     ...(directory
       ? {}
-      : { bytes: Number(stat.size), sha256: hash(fs.readFileSync(file)) }),
+      : {
+          bytes: Number(stat.size),
+          sha256: hash(readBoundedBytes(file, maxBytes)),
+        }),
   };
 }
-function relativeFile(value) {
+function relativeFile(value, limits = V1_LIMITS) {
   requireCondition(
-    typeof value === "string" && value.length <= 180,
+    typeof value === "string" && value.length <= limits.pathBytes,
     "invalid relative file",
   );
   const parts = value.split("/");
   requireCondition(
-    parts.length <= 8 &&
+    parts.length <= limits.depth &&
       parts.every(
         (part) =>
-          /^[A-Za-z0-9_-][A-Za-z0-9_.-]*$/u.test(part) &&
+          (limits.version === 1
+            ? /^[A-Za-z0-9_-][A-Za-z0-9_.-]*$/u
+            : /^(?!\.{1,2}$)[^\\:*?<>|"]+$/u
+          ).test(part) &&
+          [...part].every((character) => character.charCodeAt(0) >= 32) &&
+          !part.endsWith(" ") &&
           !part.endsWith(".") &&
           !/^(?:con|prn|aux|nul|com[0-9]|lpt[0-9])(?:\.|$)/iu.test(part),
       ),
@@ -53,17 +129,20 @@ function relativeFile(value) {
   );
   return parts;
 }
-function snapshotFile(root, relative) {
-  const parts = relativeFile(relative);
+function snapshotFile(root, relative, limits = V1_LIMITS) {
+  const parts = relativeFile(relative, limits);
   let current = root;
   for (const [index, part] of parts.entries()) {
     current = path.join(current, part);
-    identity(current, index < parts.length - 1);
+    identity(current, index < parts.length - 1, limits.fileBytes);
   }
-  const before = identity(current);
-  requireCondition(before.bytes <= MAX_FILE_BYTES, "source file exceeds 1 MiB");
-  const bytes = fs.readFileSync(current);
-  const after = identity(current);
+  const before = identity(current, false, limits.fileBytes);
+  requireCondition(
+    before.bytes <= limits.fileBytes,
+    "source file exceeds byte limit",
+  );
+  const bytes = readBoundedBytes(current, limits.fileBytes);
+  const after = identity(current, false, limits.fileBytes);
   requireCondition(
     JSON.stringify(before) === JSON.stringify(after) &&
       hash(bytes) === before.sha256,
@@ -77,6 +156,84 @@ function snapshotFile(root, relative) {
  * Source bytes and the trusted evaluator are copied before any policy exists.
  */
 export function createWindowsNativeEvaluator(options) {
+  return createEvaluator(options, V1_LIMITS);
+}
+
+// Experimental Null transport only; never an admission capability.
+export function createWindowsNativeNullEvaluator(options) {
+  requireCondition(
+    process.arch === "x64",
+    "experimental Null requires Windows x64",
+  );
+  return createEvaluator(
+    options,
+    V1_LIMITS,
+    null,
+    "chainlesschain/windows-node-runtime-adapter@3",
+  );
+}
+
+/** Explicit v2 capsule transport. Snapshots bind every copied byte; these
+ * bindings never grant review admission, registry trust, or model access.
+ * v1's size/identity/one-shot contract remains independent.
+ */
+export function createWindowsNativeCapsuleEvaluator(options) {
+  requireCondition(
+    options && Array.isArray(options.snapshots),
+    "capsule snapshots required",
+  );
+  const { snapshots, binding, ...base } = options;
+  requireCondition(
+    base.files === undefined,
+    "capsule paths must come from snapshots",
+  );
+  requireCondition(
+    binding &&
+      Object.keys(binding).sort().join(",") ===
+        "inventoryDigest,lockDigest,planDigest,projectCommit,runtime",
+    "capsule binding incomplete",
+  );
+  for (const key of ["inventoryDigest", "lockDigest", "planDigest"])
+    requireCondition(
+      /^sha256:[a-f0-9]{64}$/u.test(binding[key] || ""),
+      "capsule digest invalid",
+    );
+  requireCondition(
+    /^[a-f0-9]{40}$/u.test(binding.projectCommit || ""),
+    "capsule project identity invalid",
+  );
+  const runtime = binding.runtime;
+  requireCondition(
+    runtime &&
+      runtime.platform === process.platform &&
+      runtime.architecture === process.arch &&
+      runtime.nodeVersion === process.version &&
+      runtime.modulesAbi === process.versions.modules &&
+      /^sha256:[a-f0-9]{64}$/u.test(runtime.executableDigest || ""),
+    "capsule runtime binding differs",
+  );
+  for (const snapshot of snapshots)
+    requireCondition(
+      snapshot &&
+        Number.isSafeInteger(snapshot.bytes) &&
+        snapshot.bytes >= 0 &&
+        snapshot.bytes <= V2_LIMITS.fileBytes &&
+        /^sha256:[a-f0-9]{64}$/u.test(snapshot.digest || ""),
+      "capsule file binding invalid",
+    );
+  return createEvaluator(
+    { ...base, files: snapshots.map((item) => item.path) },
+    V2_LIMITS,
+    { snapshots, binding },
+  );
+}
+
+function createEvaluator(
+  options,
+  limits,
+  capsule = null,
+  experimentalNullDeviceProfile = null,
+) {
   requireCondition(process.platform === "win32", "Windows host required");
   requireCondition(
     options &&
@@ -93,8 +250,8 @@ export function createWindowsNativeEvaluator(options) {
     "invalid wall-time limit",
   );
   requireCondition(
-    Array.isArray(files) && files.length > 0 && files.length <= MAX_FILES,
-    "expected 1..64 source files",
+    Array.isArray(files) && files.length > 0 && files.length <= limits.files,
+    `expected 1..${limits.files} source files`,
   );
   requireCondition(
     new Set(files.map((file) => String(file).toLowerCase())).size ===
@@ -109,31 +266,68 @@ export function createWindowsNativeEvaluator(options) {
   );
   const source = path.resolve(sourceRoot);
   identity(source, true);
-  const captures = files.map((relative) => ({
-    relative,
-    bytes: snapshotFile(source, relative),
-  }));
+  const captures = [];
+  let capturedBytes = Buffer.byteLength(checkSource);
+  for (const relative of files) {
+    const parts = relativeFile(relative, limits);
+    let file = source;
+    for (const [index, part] of parts.entries()) {
+      file = path.join(file, part);
+      identity(file, index < parts.length - 1, limits.fileBytes);
+    }
+    const descriptor = identity(file, false, limits.fileBytes);
+    requireCondition(
+      capturedBytes + descriptor.bytes <= limits.totalBytes,
+      "stage exceeds byte limit",
+    );
+    const bytes = snapshotFile(source, relative, limits);
+    requireCondition(
+      bytes.length === descriptor.bytes && hash(bytes) === descriptor.sha256,
+      "source changed before capture",
+    );
+    capturedBytes += bytes.length;
+    captures.push({ relative, bytes });
+  }
+  if (capsule)
+    for (const [index, capture] of captures.entries())
+      requireCondition(
+        capture.bytes.length === capsule.snapshots[index].bytes &&
+          `sha256:${hash(capture.bytes)}` === capsule.snapshots[index].digest,
+        "capsule source changed after inventory",
+      );
   const directoryNames = new Set(["", "workspace", "control", "scratch"]);
   for (const file of files) {
-    const parts = relativeFile(file);
+    const parts = relativeFile(file, limits);
     for (let depth = 1; depth < parts.length; depth++)
       directoryNames.add(`workspace/${parts.slice(0, depth).join("/")}`);
   }
-  requireCondition(directoryNames.size <= 128, "too many stage directories");
+  requireCondition(
+    directoryNames.size <= limits.directories,
+    "too many stage directories",
+  );
   requireCondition(
     captures.reduce(
       (total, file) => total + file.bytes.length,
       Buffer.byteLength(checkSource),
-    ) <= MAX_TOTAL_BYTES,
-    "stage exceeds 8 MiB",
+    ) <= limits.totalBytes,
+    "stage exceeds byte limit",
   );
   const sourceRuntime = identity(
     fs.realpathSync.native(process.execPath),
     false,
     128 * MAX_FILE_BYTES,
   );
+  if (capsule)
+    requireCondition(
+      `sha256:${sourceRuntime.sha256}` ===
+        capsule.binding.runtime.executableDigest,
+      "runtime bytes changed after inventory",
+    );
   const root = fs.mkdtempSync(
-    path.join(fs.realpathSync.native(os.tmpdir()), "cc-native-evaluator-"),
+    path.join(
+      fs.realpathSync.native(os.tmpdir()),
+      limits.version === 1 ? "cc-native-evaluator-" : "cc-native-capsule-",
+    ),
   );
   const directories = new Set([root]);
   const ensure = (directory) => {
@@ -158,17 +352,32 @@ export function createWindowsNativeEvaluator(options) {
   );
   const stagedFiles = [];
   for (const capture of captures) {
-    const target = path.join(workspace, ...relativeFile(capture.relative));
+    const target = path.join(
+      workspace,
+      ...relativeFile(capture.relative, limits),
+    );
     ensure(path.dirname(target));
     fs.writeFileSync(target, capture.bytes, { flag: "wx", mode: 0o600 });
-    stagedFiles.push(identity(target));
+    stagedFiles.push(identity(target, false, limits.fileBytes));
   }
   const check = path.join(control, "check.cjs");
   fs.writeFileSync(check, checkSource, { flag: "wx", mode: 0o600 });
   stagedFiles.push(identity(check));
-  requireCondition(directories.size <= 128, "too many stage directories");
+  requireCondition(
+    directories.size <= limits.directories,
+    "too many stage directories",
+  );
   const manifest = Object.freeze({
-    version: 1,
+    version: limits.version,
+    ...(capsule
+      ? {
+          capsuleBinding: Object.freeze({
+            ...capsule.binding,
+            runtime: Object.freeze({ ...capsule.binding.runtime }),
+          }),
+        }
+      : {}),
+    ...(experimentalNullDeviceProfile ? { experimentalNullDeviceProfile } : {}),
     root,
     workspace,
     control,
@@ -183,9 +392,19 @@ export function createWindowsNativeEvaluator(options) {
     ),
     files: Object.freeze(stagedFiles.map(Object.freeze)),
   });
+  // The existing byte-loaded helper transports an integrity-bound invocation
+  // file (8 MiB), never an expanded command line. Reserve space for Base64 and
+  // launch metadata, and reject oversize before any policy can be issued.
+  requireCondition(
+    Buffer.byteLength(JSON.stringify(manifest)) <= 4 * MAX_FILE_BYTES,
+    "native manifest exceeds transport bound",
+  );
   const manifestDigest = hash(JSON.stringify(manifest));
   const token = Object.freeze({
-    kind: "windows-native-evaluator-v1",
+    kind:
+      limits.version === 1
+        ? "windows-native-evaluator-v1"
+        : "windows-native-capsule-v2",
     manifestDigest,
   });
   issued.set(token, { manifest, manifestDigest });

package/src/lib/process-execution-broker/windows-sandbox.cs

@@ -484,6 +484,64 @@ namespace ChainlessChain.WindowsSandbox
         [DllImport("kernel32.dll", SetLastError = true)]
         private static extern UInt32 GetFileType(IntPtr handle);
 
+        [DllImport("ntdll.dll")]
+        private static extern Int32 NtQueryObject(IntPtr handle, Int32 informationClass,
+            IntPtr information, UInt32 size, out UInt32 returned);
+
+        [DllImport("ntdll.dll", EntryPoint = "NtQueryInformationFile")]
+        private static extern Int32 NtQueryFileMode(IntPtr handle, out IO_STATUS_BLOCK status,
+            out UInt32 mode, UInt32 size, Int32 informationClass);
+
+        // This path is reachable only for the separately gated experimental v3.
+        // Kernel object identity, exact rights, and synchronous mode are proved
+        // before either extra handle is placed in the root inheritance list.
+        private static void VerifyNullObjectString(IntPtr handle, int kind, string expected)
+        {
+            IntPtr buffer = Marshal.AllocHGlobal(4096);
+            try
+            {
+                UInt32 returned;
+                if (NtQueryObject(handle, kind, buffer, 4096, out returned) != 0 || returned > 4096)
+                    throw new InvalidDataException("Null object query failed");
+                int length = (UInt16)Marshal.ReadInt16(buffer);
+                int maximum = (UInt16)Marshal.ReadInt16(buffer, 2);
+                IntPtr value = Marshal.ReadIntPtr(buffer, IntPtr.Size == 8 ? 8 : 4);
+                long offset = value.ToInt64() - buffer.ToInt64();
+                if (length != expected.Length * 2 || maximum < length || offset < IntPtr.Size * 2 ||
+                    offset > 4096 - maximum || Marshal.PtrToStringUni(value, length / 2) != expected)
+                    throw new InvalidDataException("Null object identity differs");
+            }
+            finally { Marshal.FreeHGlobal(buffer); }
+        }
+
+        private static IntPtr PrepareExperimentalNull(UInt32 access, List<IntPtr> owned)
+        {
+            SECURITY_ATTRIBUTES attributes = new SECURITY_ATTRIBUTES();
+            attributes.nLength = checked((UInt32)Marshal.SizeOf(typeof(SECURITY_ATTRIBUTES)));
+            attributes.bInheritHandle = true;
+            IntPtr handle = CreateFile("NUL", access, FILE_SHARE_READ | FILE_SHARE_WRITE,
+                ref attributes, OPEN_EXISTING, 0, IntPtr.Zero);
+            if (IsInvalidHandle(handle)) ThrowLastError("CreateFile(experimental Null)");
+            owned.Add(handle);
+            if (GetFileType(handle) != 2) throw new InvalidDataException("Null is not a character device");
+            VerifyNullObjectString(handle, 1, "\\Device\\Null");
+            VerifyNullObjectString(handle, 2, "File");
+            IntPtr basic = Marshal.AllocHGlobal(256);
+            try
+            {
+                UInt32 returned;
+                if (NtQueryObject(handle, 0, basic, 56, out returned) != 0 || returned < 8 || returned > 256 ||
+                    unchecked((UInt32)Marshal.ReadInt32(basic, 4)) != access)
+                    throw new InvalidDataException("Null granted access differs");
+            }
+            finally { Marshal.FreeHGlobal(basic); }
+            IO_STATUS_BLOCK status;
+            UInt32 mode;
+            if (NtQueryFileMode(handle, out status, out mode, 4, 16) != 0 || mode != 0x20)
+                throw new InvalidDataException("Null synchronous mode differs");
+            return handle;
+        }
+
         [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
         private static extern IntPtr CreateFile(
             string fileName,
@@ -3029,9 +3087,19 @@ namespace ChainlessChain.WindowsSandbox
             IntPtr standardError,
             int nodeIpcFd,
             IntPtr entrySnapshotHandle,
+            IntPtr experimentalNullRead,
+            IntPtr experimentalNullWrite,
             out IntPtr handleBytes)
         {
             List<IntPtr> handles = new List<IntPtr>();
+            if (!IsInvalidHandle(experimentalNullRead) || !IsInvalidHandle(experimentalNullWrite))
+            {
+                if (IsInvalidHandle(experimentalNullRead) || IsInvalidHandle(experimentalNullWrite) ||
+                    experimentalNullRead == experimentalNullWrite)
+                    throw new InvalidDataException("Experimental Null pair is incomplete");
+                handles.Add(experimentalNullRead);
+                handles.Add(experimentalNullWrite);
+            }
             handles.Add(standardInput);
             if (!handles.Contains(standardOutput))
                 handles.Add(standardOutput);
@@ -3267,6 +3335,26 @@ namespace ChainlessChain.WindowsSandbox
             [DataMember] public string sha256 { get; set; }
         }
 
+        [DataContract]
+        public sealed class NativeCapsuleRuntimeSpec
+        {
+            [DataMember] public string platform { get; set; }
+            [DataMember] public string architecture { get; set; }
+            [DataMember] public string nodeVersion { get; set; }
+            [DataMember] public string modulesAbi { get; set; }
+            [DataMember] public string executableDigest { get; set; }
+        }
+
+        [DataContract]
+        public sealed class NativeCapsuleBindingSpec
+        {
+            [DataMember] public string inventoryDigest { get; set; }
+            [DataMember] public string lockDigest { get; set; }
+            [DataMember] public string planDigest { get; set; }
+            [DataMember] public string projectCommit { get; set; }
+            [DataMember] public NativeCapsuleRuntimeSpec runtime { get; set; }
+        }
+
         [DataContract]
         public sealed class NativeEvaluatorSpec
         {
@@ -3281,6 +3369,8 @@ namespace ChainlessChain.WindowsSandbox
             [DataMember] public EvaluatorPathSpec runtime { get; set; }
             [DataMember] public EvaluatorPathSpec[] directories { get; set; }
             [DataMember] public EvaluatorPathSpec[] files { get; set; }
+            [DataMember] public NativeCapsuleBindingSpec capsuleBinding { get; set; }
+            [DataMember] public string experimentalNullDeviceProfile { get; set; }
         }
 
         private static bool SameEvaluatorPath(string left, string right)
@@ -3328,15 +3418,39 @@ namespace ChainlessChain.WindowsSandbox
             string[] arguments, string workingDirectory, string appSid, int wallTimeMs,
             List<IntPtr> guards, ref bool rootAttested)
         {
-            if (spec.version != 1 || !IsLowercaseSha256(spec.manifestDigest) || spec.runtime == null ||
-                spec.directories == null || spec.directories.Length < 4 || spec.directories.Length > 128 ||
-                spec.files == null || spec.files.Length < 2 || spec.files.Length > 65 ||
+            bool capsule = spec.version == 2;
+            if (spec.experimentalNullDeviceProfile != null &&
+                (capsule || spec.experimentalNullDeviceProfile != "chainlesschain/windows-node-runtime-adapter@3"))
+                throw new InvalidDataException("Unsupported experimental Null profile");
+            int maxDirectories = capsule ? 20000 : 128;
+            int maxFiles = capsule ? 20001 : 65;
+            long maxFileBytes = capsule ? 32L * 1024 * 1024 : 1024 * 1024;
+            long maxTotalBytes = capsule ? 512L * 1024 * 1024 : 8 * 1024 * 1024;
+            if ((spec.version != 1 && !capsule) || !IsLowercaseSha256(spec.manifestDigest) || spec.runtime == null ||
+                spec.directories == null || spec.directories.Length < 4 || spec.directories.Length > maxDirectories ||
+                spec.files == null || spec.files.Length < 2 || spec.files.Length > maxFiles ||
                 wallTimeMs < 1 || spec.wallTimeMs != wallTimeMs || String.IsNullOrWhiteSpace(appSid))
                 throw new InvalidDataException("Native evaluator manifest is incomplete");
+            if (capsule)
+            {
+                NativeCapsuleBindingSpec binding = spec.capsuleBinding;
+                if (binding == null || binding.runtime == null ||
+                    !IsPrefixedSha256(binding.inventoryDigest) || !IsPrefixedSha256(binding.lockDigest) ||
+                    !IsPrefixedSha256(binding.planDigest) ||
+                    !System.Text.RegularExpressions.Regex.IsMatch(binding.projectCommit ?? "", "^[a-f0-9]{40}$") ||
+                    binding.runtime.platform != "win32" ||
+                    (binding.runtime.architecture != "x64" && binding.runtime.architecture != "arm64" && binding.runtime.architecture != "ia32") ||
+                    !System.Text.RegularExpressions.Regex.IsMatch(binding.runtime.nodeVersion ?? "", "^v[0-9]+\\.[0-9]+\\.[0-9]+$") ||
+                    !System.Text.RegularExpressions.Regex.IsMatch(binding.runtime.modulesAbi ?? "", "^[0-9]+$") ||
+                    binding.runtime.executableDigest != "sha256:" + spec.runtime.sha256)
+                    throw new InvalidDataException("Native capsule inventory/runtime binding is incomplete");
+            }
+            else if (spec.capsuleBinding != null)
+                throw new InvalidDataException("v1 evaluator cannot accept a capsule binding");
             string root = NormalizeLocalDosPath(spec.root, null, "Native evaluator stage");
             string expectedParent = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "Temp");
             if (!SameEvaluatorPath(Path.GetDirectoryName(root), expectedParent) ||
-                !System.Text.RegularExpressions.Regex.IsMatch(Path.GetFileName(root), "^cc-native-evaluator-[A-Za-z0-9_-]{6}$") ||
+                !System.Text.RegularExpressions.Regex.IsMatch(Path.GetFileName(root), capsule ? "^cc-native-capsule-[A-Za-z0-9_-]{6}$" : "^cc-native-evaluator-[A-Za-z0-9_-]{6}$") ||
                 !SameEvaluatorPath(spec.workspace, Path.Combine(root, "workspace")) ||
                 !SameEvaluatorPath(spec.control, Path.Combine(root, "control")) ||
                 !SameEvaluatorPath(spec.scratch, Path.Combine(root, "scratch")) ||
@@ -3368,10 +3482,11 @@ namespace ChainlessChain.WindowsSandbox
             {
                 string full = Path.GetFullPath(file.path);
                 if ((!full.StartsWith(spec.workspace + "\\", StringComparison.OrdinalIgnoreCase) && !SameEvaluatorPath(full, spec.check)) ||
-                    !expected.Add(full) || file.bytes < 0 || file.bytes > 1024 * 1024)
+                    !expected.Add(full) || file.bytes < 0 || file.bytes > maxFileBytes ||
+                    (SameEvaluatorPath(full, spec.check) && file.bytes > 1024 * 1024))
                     throw new InvalidDataException("Native evaluator file is outside its read-only roots or exceeds bounds");
                 total = checked(total + file.bytes);
-                if (total > 8 * 1024 * 1024) throw new InvalidDataException("Native evaluator tree exceeds byte bound");
+                if (total > maxTotalBytes) throw new InvalidDataException("Native evaluator tree exceeds byte bound");
                 VerifyEvaluatorPath(file, HoldEvaluatorPath(full, false, guards), false);
             }
             if (!expected.Contains(spec.check) || !expected.Contains(spec.workspace) || !expected.Contains(spec.control) || !expected.Contains(spec.scratch))
@@ -3419,6 +3534,12 @@ namespace ChainlessChain.WindowsSandbox
             SetEvaluatorAccessControl(spec.runtime.path, runtimeSecurity);
         }
 
+        private static bool IsPrefixedSha256(string value)
+        {
+            return value != null && value.StartsWith("sha256:", StringComparison.Ordinal) &&
+                IsLowercaseSha256(value.Substring(7));
+        }
+
         private static void SetEvaluatorAccessControl(string path, FileSystemSecurity security)
         {
             // Directory/File.SetAccessControl exist only in .NET Framework.
@@ -3582,6 +3703,7 @@ namespace ChainlessChain.WindowsSandbox
             int entrySnapshotFd = -1;
             byte[] entrySnapshot = null;
             List<IntPtr> ownedStandardHandles = new List<IntPtr>();
+            IntPtr experimentalNullRead = IntPtr.Zero, experimentalNullWrite = IntPtr.Zero;
             List<LaunchPathLock> launchPathLocks = new List<LaunchPathLock>();
             PROCESS_INFORMATION processInfo = new PROCESS_INFORMATION();
             bool useAppContainer =
@@ -3673,6 +3795,16 @@ namespace ChainlessChain.WindowsSandbox
                     targetEnvironment["SystemRoot"] = Path.GetDirectoryName(Environment.SystemDirectory);
                     targetEnvironment["WINDIR"] = Path.GetDirectoryName(Environment.SystemDirectory);
                     targetEnvironment["PATH"] = Path.GetDirectoryName(application);
+                    // Only the guarded evaluator exposes this attested identity;
+                    // an inherited caller value is never used as its authority.
+                    targetEnvironment["CC_WINDOWS_APPCONTAINER_SID"] = expectedAppContainerSid;
+                    if (nativeEvaluator.experimentalNullDeviceProfile != null)
+                    {
+                        experimentalNullRead = PrepareExperimentalNull(0x120089, ownedStandardHandles);
+                        experimentalNullWrite = PrepareExperimentalNull(0x120196, ownedStandardHandles);
+                        targetEnvironment["CC_WINDOWS_NULL_READ_V3"] = experimentalNullRead.ToInt64().ToString("x");
+                        targetEnvironment["CC_WINDOWS_NULL_WRITE_V3"] = experimentalNullWrite.ToInt64().ToString("x");
+                    }
                     ConfigureAppContainerEnvironment(targetEnvironment);
                 }
                 environmentBuffer =
@@ -3855,6 +3987,8 @@ namespace ChainlessChain.WindowsSandbox
                     startup.StartupInfo.hStdError,
                     nodeIpcFd,
                     entrySnapshotReadHandle,
+                    experimentalNullRead,
+                    experimentalNullWrite,
                     out inheritedHandleBytes);
                 attributeList = BuildProcessAttributeList(
                     inheritedHandleBuffer,

package/src/lib/settings-loader.cjs

@@ -491,7 +491,16 @@ function addRule({
         committed = true;
         return { file, added: true };
       },
-      { failIfUnavailable: true },
+      {
+        failIfUnavailable: true,
+        // Keep the existing two-second acquisition deadline. A writer doing
+        // several synchronous addRule calls must give existing contenders a
+        // retry window after each release instead of immediately reacquiring.
+        retryMs: 5,
+        maxRetryMs: 25,
+        retryJitterMs: 5,
+        yieldAfterReleaseMs: 32,
+      },
     );
     if (began) finishSettingsMutation("ready");
     return result;