pum-agent 0.2.37-beta.1 → 0.2.38-beta.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pum-agent",
-  "version": "0.2.37-beta.1",
+  "version": "0.2.38-beta.1",
   "description": "A compact terminal coding agent powered by pi and OpenTUI.",
   "license": "MIT",
   "type": "module",

package/src/app.tsx

@@ -10,7 +10,7 @@ import { randomUUID } from "node:crypto";
 import { diagnosticsCommandText } from "./request-diagnostics-access";
 import { checkpointControllerForSession, checkpointRecoveryFailureText } from "./file-checkpoints";
 import { VALIDATION_CUSTOM_TYPE, validationForSession } from "./project-validation";
-import type { McpController } from "./mcp";
+import { mcpCommandErrorMessage, type McpController } from "./mcp";
 import type { LspController } from "./lsp";
 import { useKeyboard, usePaste, useRenderer, useTerminalDimensions } from "@opentui/react";
 import { getSupportedThinkingLevels, type Model } from "@earendil-works/pi-ai";
@@ -4877,9 +4877,9 @@ export function App({
       }
       void controller.command(promptText).then((text) => {
         if (sessionRef.current === session && mcpForSession?.(session) === controller) report(text);
-      }).catch(() => {
+      }).catch((error: unknown) => {
         if (sessionRef.current === session && mcpForSession?.(session) === controller) {
-          report("MCP request failed. Preview /mcp and check the current proposal and digests.", true);
+          report(mcpCommandErrorMessage(error), true);
         }
       });
       return;

package/src/main.tsx

@@ -329,6 +329,8 @@ export async function start(
       let mcpSession: AgentSession | undefined;
       let mcpDisposed = false;
       const mcpProcess = createMcpProcessAdapter({ configDir: AGENT_DIR });
+      // LSP keeps the reviewed Linux-only boundary; only the MCP controller uses MXC on Windows.
+      const lspProcess = createMcpProcessAdapter({ configDir: AGENT_DIR, allowWindows: false });
       const mcp: McpController = new McpController({
         cwd,
         spawn: (request) => mcpProcess.spawn(request),
@@ -337,7 +339,7 @@ export async function start(
       });
       const lsp: LspController = new LspController({
         cwd,
-        spawn: (request) => mcpProcess.spawn(request),
+        spawn: (request) => lspProcess.spawn(request),
         isIdle: () => isRuntimeIdle(mcpSession),
         isCurrent: (): boolean => !mcpDisposed && !!mcpSession && lspControllers.get(mcpSession) === lsp,
       });

package/src/mcp-config.ts

@@ -21,8 +21,18 @@ function string(value: unknown, maximum: number): value is string {
 }
 function invalid(): never { throw new Error("Invalid MCP proposal: use the documented bounded version 1 stdio configuration."); }
 
+/** One platform-native absolute executable path. Drive-qualified only on Windows:
+ * drive roots, UNC/device paths, `.`/`..` segments and trailing separators are rejected. */
+export function isAbsoluteMcpExecutable(value: string, platform: NodeJS.Platform): boolean {
+  if (platform === "win32") {
+    return /^[A-Za-z]:[\\/][^\\/]/.test(value)
+      && !value.split(/[\\/]/).slice(1).some((part) => part === "" || part === "." || part === "..");
+  }
+  return posix.isAbsolute(value) && value !== "/";
+}
+
 /** Parsing is not authorization. Unknown transport/auth/environment fields fail closed. */
-export function parseMcpConfig(text: string): McpConfig {
+export function parseMcpConfig(text: string, platform: NodeJS.Platform = process.platform): McpConfig {
   if (Buffer.byteLength(text) > MCP_MAX_CONFIG_BYTES) invalid();
   let value: unknown;
   try { value = JSON.parse(text); } catch { invalid(); }
@@ -32,8 +42,8 @@ export function parseMcpConfig(text: string): McpConfig {
   const servers = value.servers.map((entry): McpServerConfig => {
     if (!object(entry) || !keys(entry, ["name", "executable", "args"])
       || typeof entry.name !== "string" || !namePattern.test(entry.name) || names.has(entry.name)
-      || !string(entry.executable, 4096) || !posix.isAbsolute(entry.executable)
-      || entry.executable === "/" || !Array.isArray(entry.args) || entry.args.length > 16
+      || !string(entry.executable, 4096) || !isAbsoluteMcpExecutable(entry.executable, platform)
+      || !Array.isArray(entry.args) || entry.args.length > 16
       || !entry.args.every((argument) => string(argument, 1024))) invalid();
     names.add(entry.name);
     return { name: entry.name, executable: entry.executable, args: [...entry.args] as string[] };

package/src/mcp-process.ts

@@ -1,11 +1,12 @@
-import { lstat, opendir, realpath } from "node:fs/promises";
+import { lstat, mkdtemp, opendir, realpath, rm } from "node:fs/promises";
 import { existsSync } from "node:fs";
-import { homedir } from "node:os";
-import { posix } from "node:path";
+import { homedir, tmpdir } from "node:os";
+import { posix, win32, join } from "node:path";
 import { AGENT_DIR } from "./config";
 import { isCredentialSensitivePath } from "./credential-path";
 import { createBubblewrapBackend } from "./sandbox/linux";
-import type { SandboxPolicy, SandboxProcessHandle } from "./sandbox/types";
+import { createWindowsSandboxBackend } from "./sandbox/windows";
+import type { SandboxBackend, SandboxPolicy, SandboxProcessHandle } from "./sandbox/types";
 
 export interface McpProcessRequest {
   executable: string;
@@ -28,13 +29,17 @@ export const MCP_MAX_PENDING_WRITES = 64;
 export const MCP_WRITE_TIMEOUT_MS = 5_000;
 export const MCP_CLOSE_GRACE_MS = 1_000;
 const failure = () => new Error("MCP process unavailable or blocked by native policy");
+/** Only the adapter may identify an unavailable mandatory native boundary. */
+export class McpNativeUnavailableError extends Error {
+  constructor() { super("MCP native enforcement unavailable (Linux Bubblewrap or Windows MXC BaseContainer)"); }
+}
 
 export const MCP_SCAN_MAX_ENTRIES = 50_000;
 export const MCP_SCAN_MAX_DEPTH = 32;
 export const MCP_SCAN_MAX_MASKS = 2_048;
 export const MCP_SCAN_MAX_PATH_BYTES = 256 * 1024;
 export const MCP_SCAN_TIMEOUT_MS = 5_000;
-export interface McpProcessAdapterOptions { configDir?: string }
+export interface McpProcessAdapterOptions { configDir?: string; platform?: NodeJS.Platform; allowWindows?: boolean; windowsBackend?: SandboxBackend }
 
 const within = (root: string, path: string) => path === root || path.startsWith(root === "/" ? "/" : `${root}/`);
 /** Pure comparison after caller validation/canonicalization; no authority grant. */
@@ -157,24 +162,184 @@ export async function buildMcpProcessPolicy(
   } catch { throw failure(); }
 }
 
+async function spawnLinuxMcp(request: McpProcessRequest, options: McpProcessAdapterOptions): Promise<McpProcessHandle> {
+  const bubblewrap = ["/usr/bin/bwrap", "/bin/bwrap"].find(existsSync);
+  if (!bubblewrap) throw new McpNativeUnavailableError();
+  const backend = createBubblewrapBackend({ executable: bubblewrap, systemMounts: MCP_SYSTEM_MOUNTS });
+  if ((await backend.probe()).state !== "enforced") throw new McpNativeUnavailableError();
+  if (request.signal?.aborted) throw failure();
+  const policy = await buildMcpProcessPolicy(request, options);
+  if (request.signal?.aborted) throw failure();
+  return manageMcpProcessHandle(backend.spawn(policy, {
+    persistentStdin: true, signal: request.signal,
+    onStdout: request.onStdout, onStderr: request.onStderr,
+  }), request.signal ?? new AbortController().signal);
+}
+
+const WINDOWS_DRIVE = /^[A-Za-z]:[\\/]/;
+const pathControls = /[\x00-\x1f\x7f\u202a-\u202e\u2066-\u2069]/;
+/** Drive-qualified absolute only: drive roots, UNC/device, `.`/`..` and separators fail. */
+function windowsSafe(value: string): boolean {
+  return typeof value === "string" && WINDOWS_DRIVE.test(value) && !pathControls.test(value)
+    && !value.split(/[\\/]/).slice(1).some((part) => part === "" || part === "." || part === "..");
+}
+function windowsSame(a: string, b: string): boolean {
+  return win32.normalize(a).toLowerCase() === win32.normalize(b).toLowerCase();
+}
+function windowsWithin(root: string, path: string): boolean {
+  const r = win32.normalize(root).toLowerCase();
+  const p = win32.normalize(path).toLowerCase();
+  const base = r.endsWith("\\") ? r : `${r}\\`;
+  return p === r || p.startsWith(base);
+}
+/** Canonical path without link/junction components; checks compare lowercased spellings. */
+async function windowsExactPath(value: string, directory: boolean): Promise<string> {
+  if (!windowsSafe(value)) throw failure();
+  const normalized = win32.normalize(value);
+  const parts = normalized.split(/[\\/]+/).slice(1);
+  let prefix = /^[A-Za-z]:/.exec(normalized)![0];
+  for (let index = 0; index < parts.length; index++) {
+    const part = parts[index]!;
+    if (!part) continue;
+    prefix = `${prefix}\\${part}`;
+    const stat = await lstat(prefix);
+    // Only ancestors must be directories; the final component may be the file.
+    if (stat.isSymbolicLink() || (index < parts.length - 1 && !stat.isDirectory())) throw failure();
+  }
+  const final = await lstat(normalized);
+  if (final.isSymbolicLink() || (directory ? !final.isDirectory() : !final.isFile())) throw failure();
+  const canonical = (await realpath(normalized)).replace(/^\\\\\?\\/u, "");
+  if (!windowsSame(canonical, normalized)) throw failure();
+  return win32.normalize(canonical);
+}
+/** Bind the config directory and every ancestor for this policy build; never guessed. */
+async function windowsConfigBoundary(path: string): Promise<{ path: string; identity: string }> {
+  const canonical = await windowsExactPath(path, true);
+  const identities: string[] = [];
+  let prefix = /^[A-Za-z]:/.exec(canonical)![0];
+  for (const part of canonical.split(/[\\/]+/).slice(1)) {
+    if (!part) continue;
+    prefix = `${prefix}\\${part}`;
+    const stat = await lstat(prefix);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) throw failure();
+    identities.push(`${prefix.toLowerCase()}:${stat.dev}:${stat.ino}`);
+  }
+  if (!windowsSame(await windowsExactPath(path, true), canonical)) throw failure();
+  return { path: canonical, identity: identities.join("\n") };
+}
+
+/** Windows MCP policy: exact cwd and executable file readonly, config denied, no network.
+ * The adapter owns the real private temp; this builder only validates and records it. */
+export async function buildWindowsMcpProcessPolicy(
+  request: Pick<McpProcessRequest, "cwd" | "executable" | "args" | "signal">,
+  options: McpProcessAdapterOptions & { privateTemp?: string } = {},
+): Promise<SandboxPolicy> {
+  try {
+    const start = Date.now();
+    const check = () => { if (request.signal?.aborted || Date.now() - start > MCP_SCAN_TIMEOUT_MS) throw failure(); };
+    check();
+    const cwd = await windowsExactPath(request.cwd, true);
+    const executable = await windowsExactPath(request.executable, false);
+    const configInput = options.configDir ?? AGENT_DIR;
+    const boundary = await windowsConfigBoundary(configInput);
+    const forbidden = [...new Set([win32.normalize(configInput), boundary.path])];
+    const home = await realpath(homedir());
+    const systemRoot = process.env.SystemRoot ?? process.env.WINDIR ?? "C:\\Windows";
+    const privateTemp = options.privateTemp ?? "";
+    if (!windowsSafe(privateTemp) || home === cwd || windowsWithin(cwd, home)
+      || isCredentialSensitivePath(cwd) || isCredentialSensitivePath(executable)
+      || forbidden.some((path) => windowsWithin(path, cwd) || windowsWithin(path, executable))
+      || windowsWithin(systemRoot, cwd) || windowsWithin(systemRoot, configInput) || windowsWithin(configInput, systemRoot)
+      || windowsWithin(privateTemp, cwd) || windowsWithin(privateTemp, executable)
+      || windowsWithin(cwd, privateTemp) || windowsWithin(executable, privateTemp)) throw failure();
+    const tempStat = await lstat(privateTemp);
+    if (!tempStat.isDirectory() || tempStat.isSymbolicLink()) throw failure();
+    if (!Array.isArray(request.args) || request.args.length > 16 || request.args.some((arg) =>
+      typeof arg !== "string" || Buffer.byteLength(arg) > 1024
+      || /[\x00-\x1f\x7f\u202a-\u202e\u2066-\u2069]/.test(arg))) throw failure();
+    let entries = 0;
+    let maskBytes = 0;
+    const deniedPaths: string[] = [];
+    const mask = (path: string) => {
+      deniedPaths.push(path);
+      maskBytes += Buffer.byteLength(path);
+      if (deniedPaths.length > MCP_SCAN_MAX_MASKS || maskBytes > MCP_SCAN_MAX_PATH_BYTES) throw failure();
+    };
+    const scan = async (directory: string, depth: number): Promise<void> => {
+      check();
+      if (depth > MCP_SCAN_MAX_DEPTH || (await lstat(directory)).isSymbolicLink()
+        || !windowsSame(await realpath(directory), directory)) throw failure();
+      for await (const entry of await opendir(directory)) {
+        check();
+        if (++entries > MCP_SCAN_MAX_ENTRIES) throw failure();
+        const path = win32.join(directory, entry.name);
+        const sensitive = isCredentialSensitivePath(`${path}\\`) || isCredentialSensitivePath(path)
+          || forbidden.some((root) => windowsWithin(root, path));
+        const stat = await lstat(path);
+        if (sensitive) {
+          if (stat.isSymbolicLink()) throw failure();
+          mask(path);
+        } else if (stat.isDirectory()) await scan(path, depth + 1);
+        else if (!stat.isFile() && !stat.isSymbolicLink()) throw failure();
+      }
+    };
+    await scan(cwd, 0);
+    const currentBoundary = await windowsConfigBoundary(configInput);
+    if (currentBoundary.path !== boundary.path || currentBoundary.identity !== boundary.identity) throw failure();
+    check();
+    if (deniedPaths.some((path) => windowsWithin(path, executable))) throw failure();
+    return {
+      version: 1, exactCommand: "MCP approved stdio process", executable, args: [...request.args], cwd,
+      readOnlyPaths: [cwd, executable], readWritePaths: [], deniedPaths,
+      privateTemp,
+      environment: {
+        PATH: `${win32.join(systemRoot, "System32")};${systemRoot}`,
+        SystemRoot: systemRoot, HOME: privateTemp, USERPROFILE: privateTemp,
+      },
+      network: "deny",
+      rationale: "Explicitly approved readonly live-project Windows MCP (MXC BaseContainer); masks are check-time defense in depth",
+      accesses: [],
+    };
+  } catch { throw failure(); }
+}
+
+async function spawnWindowsMcp(request: McpProcessRequest, options: McpProcessAdapterOptions): Promise<McpProcessHandle> {
+  const backend = options.windowsBackend ?? createWindowsSandboxBackend();
+  const capability = await backend.probe();
+  if (capability.state !== "enforced") throw new McpNativeUnavailableError();
+  if (request.signal?.aborted) throw failure();
+  const privateTemp = await mkdtemp(join(tmpdir(), "pum-mcp-private-"));
+  let child: SandboxProcessHandle;
+  try {
+    const policy = await buildWindowsMcpProcessPolicy(request, { ...options, privateTemp });
+    if (request.signal?.aborted) throw failure();
+    child = backend.spawn(policy, {
+      persistentStdin: true, signal: request.signal, onStdout: request.onStdout, onStderr: request.onStderr,
+    });
+  } catch (error) {
+    await rm(privateTemp, { recursive: true, force: true }).catch(() => {});
+    throw error;
+  }
+  const completed = child.completed.finally(() => rm(privateTemp, { recursive: true, force: true }).catch(() => {}));
+  return manageMcpProcessHandle({ ...child, completed }, request.signal ?? new AbortController().signal);
+}
+
 /** No startup work until spawn. The controller, not this adapter, owns consent.
- * Mandatory Linux Bubblewrap regardless of Check mode; never a direct fallback. */
+ * Mandatory platform-native enforcement regardless of Check mode; never a direct fallback.
+ * Linux requires Bubblewrap; Windows requires MXC BaseContainer (never AppContainer+DACL). */
 export function createMcpProcessAdapter(options: McpProcessAdapterOptions = {}): McpProcessAdapter {
+  const platform = options.platform ?? process.platform;
   return {
     async spawn(request) {
       try {
-        if (process.platform !== "linux" || request.signal?.aborted) throw failure();
-        const bubblewrap = ["/usr/bin/bwrap", "/bin/bwrap"].find(existsSync);
-        if (!bubblewrap) throw failure();
-        const backend = createBubblewrapBackend({ executable: bubblewrap, systemMounts: MCP_SYSTEM_MOUNTS });
-        if ((await backend.probe()).state !== "enforced" || request.signal?.aborted) throw failure();
-        const policy = await buildMcpProcessPolicy(request, options);
         if (request.signal?.aborted) throw failure();
-        return manageMcpProcessHandle(backend.spawn(policy, {
-          persistentStdin: true, signal: request.signal,
-          onStdout: request.onStdout, onStderr: request.onStderr,
-        }), request.signal ?? new AbortController().signal);
-      } catch { throw failure(); }
+        if (platform === "linux") return spawnLinuxMcp(request, options);
+        if (platform === "win32" && options.allowWindows !== false) return spawnWindowsMcp(request, options);
+        throw new McpNativeUnavailableError();
+      } catch (error) {
+        if (error instanceof McpNativeUnavailableError && !request.signal?.aborted) throw error;
+        throw failure();
+      }
     },
   };
 }

package/src/mcp-protocol.ts

@@ -3,6 +3,8 @@
  * basic/lifecycle,basic/utilities/cancellation,server/tools}.
  * This deliberately rejects unsupported JSON Schema keywords rather than claiming full coverage.
  */
+import { McpNativeUnavailableError } from "./mcp-process";
+
 export const MCP_PROTOCOL_VERSION = "2025-11-25";
 export const MCP_LIMITS = Object.freeze({ frameBytes: 256 * 1024, stdoutBytes: 16 * 1024 * 1024,
   discoveryBytes: 256 * 1024, tools: 32, pages: 4, schemaBytes: 16 * 1024,
@@ -228,7 +230,12 @@ export class McpProtocolClient {
       return client;
     };
     try { return await Promise.race([start(), stopped]); }
-    catch { client.closeWith("MCP connection failed."); throw new Error("MCP connection failed."); }
+    catch (error) {
+      const nativeUnavailable = !signal?.aborted && error instanceof McpNativeUnavailableError;
+      client.closeWith("MCP connection failed.");
+      if (nativeUnavailable) throw new McpNativeUnavailableError();
+      throw new Error("MCP connection failed.");
+    }
     finally { clearTimeout(timer); }
   }
   private assertOpen(): void { if (this.closed || !this.handle) throw new Error("MCP connection closed."); }

package/src/mcp.ts

@@ -4,6 +4,7 @@ import { dirname, join, resolve } from "node:path";
 import { Type } from "typebox";
 import { defineTool, type AgentSession, type ToolDefinition } from "@earendil-works/pi-coding-agent";
 import { readMcpProposal, type McpProposal } from "./mcp-config";
+import { McpNativeUnavailableError } from "./mcp-process";
 import { McpProtocolClient, type McpSpawn, type McpTool } from "./mcp-protocol";
 
 type Connection = { digest: string; abort: AbortController; client?: McpProtocolClient; tools?: McpTool[]; toolset?: string; approved: boolean };
@@ -12,7 +13,18 @@ const digestPattern = /^[a-f0-9]{64}$/;
 const serverPattern = /^[a-z][a-z0-9_-]{0,31}$/;
 const textResult = (text: string) => ({ content: [{ type: "text" as const, text }], details: {} });
 const unavailable = () => new Error("MCP access unavailable: direct main-TUI connection and exact toolset approval are required.");
-const scope = "Linux native Bubblewrap required, even with Check Off; no fallback or network. Live project read-only, private scratch writable; filtered environment, no auth passthrough, PUM configuration/credentials denied. Sensitive-name masks are defense in depth only: arbitrary secrets, aliases and future files may be read and returned to the model. Approval trusts current/future server and project code. No startup/resume trust.";
+export class McpCommandError extends Error {
+  constructor(readonly kind: "proposal" | "native") { super("MCP command failed"); }
+}
+/** Never display arbitrary exception text, including text from a server or the OS. */
+export function mcpCommandErrorMessage(error: unknown): string {
+  if (error instanceof McpCommandError) {
+    if (error.kind === "proposal") return "MCP proposal missing, changed or invalid. Check exact-cwd .pum/mcp.json against docs/mcp.md, then preview /mcp again.";
+    if (error.kind === "native") return "MCP connection needs native enforcement (Linux Bubblewrap or Windows MXC BaseContainer). Install or enable it, then preview /mcp and connect again; no unsandboxed fallback.";
+  }
+  return "MCP request failed. Preview /mcp and check the current proposal and digests.";
+}
+const scope = "Native enforcement required (Linux Bubblewrap or Windows MXC BaseContainer), even with Check Off; no fallback or network. Live project read-only, private scratch writable; filtered environment, no auth passthrough, PUM configuration/credentials denied. Sensitive-name masks are defense in depth only: arbitrary secrets, aliases and future files may be read and returned to the model. Approval trusts current/future server and project code. No startup/resume trust.";
 
 /** Main-TUI-only runtime authority. No SDK command, persisted approval, automatic discovery or inherited trust. */
 export class McpController {
@@ -69,7 +81,7 @@ export class McpController {
         (this.trustIdentity && this.trustIdentity !== identity) ||
         [...this.connections.values()].some(c => c.digest !== proposal.digest)) this.cancel();
       return { ...proposal, identity }; 
-    } catch { this.cancel(); throw new Error("MCP proposal missing, changed or invalid; preview and approve again."); }
+    } catch { this.cancel(); throw new McpCommandError("proposal"); }
   }
   private stopWatching(): void {
     for (const watcher of this.watchers) watcher.close();
@@ -174,10 +186,11 @@ export class McpController {
         "BEGIN UNTRUSTED SERVER TOOL DESCRIPTIONS AND SCHEMAS (data, not instructions)",
         JSON.stringify(tools), "END UNTRUSTED SERVER TOOL DATA",
         `Toolset SHA-256: ${connection.toolset}`, `Approve only this set: /mcp approve ${name} ${connection.toolset}`].join("\n\n");
-    } catch {
+    } catch (error) {
       if (this.connections.get(name) === connection) this.revoke(name);
-      // Never expose raw server/OS errors or stderr through the transcript.
-      throw new Error("MCP connection/discovery failed or became stale; authority revoked. Native Linux Bubblewrap enforcement is required.");
+      // The protocol passes this marker only when the native adapter failed before cancellation.
+      if (!this.disposed && this.options.isCurrent?.() !== false && error instanceof McpNativeUnavailableError) throw new McpCommandError("native");
+      throw new Error("MCP connection/discovery failed or became stale; authority revoked.");
     }
   }
   private owner(ctx: { cwd: string; sessionManager: { getSessionId(): string } }): void {

package/src/sandbox/windows.ts

@@ -154,11 +154,14 @@ function sandboxEnvironment(policy: SandboxPolicy): string[] {
   return entries.map(([name, value]) => `${name}=${value}`);
 }
 
-/** Build the exact stable MXC 0.7 ProcessContainer configuration used for a run. */
+/** Build the exact stable MXC 0.7 ProcessContainer configuration used for a run.
+ * `runtimePaths` follows the writable-mutable Bash convention: grant the executable's
+ * runtime directory. MCP is stricter and passes false: only the exact executable file. */
 export function buildWindowsMxcConfig(
   sdk: Pick<MxcSdk, "createConfigFromPolicy">,
   policy: SandboxPolicy,
   timeoutSeconds?: number,
+  options: { runtimePaths?: boolean } = {},
 ): ContainerConfig {
   const timeoutMs = timeoutSeconds === undefined ? 0 : Math.ceil(timeoutSeconds * 1000);
   if (timeoutSeconds !== undefined && (!Number.isFinite(timeoutSeconds) || timeoutSeconds <= 0)) {
@@ -168,10 +171,11 @@ export function buildWindowsMxcConfig(
     throw new Error("Invalid timeout: maximum is 2147483.647 seconds");
   }
 
+  const runtimePaths = options.runtimePaths === false ? [] : windowsRuntimePaths(policy.executable);
   const mxcPolicy: MxcPolicy = {
     version: "0.7.0-alpha",
     filesystem: {
-      readonlyPaths: uniqueWindowsPaths([...policy.readOnlyPaths, ...windowsRuntimePaths(policy.executable)]),
+      readonlyPaths: uniqueWindowsPaths([...policy.readOnlyPaths, ...runtimePaths]),
       readwritePaths: uniqueWindowsPaths([...policy.readWritePaths, policy.privateTemp]),
       deniedPaths: uniqueWindowsPaths(policy.deniedPaths),
       clearPolicyOnExit: true,
@@ -295,7 +299,10 @@ function startSandboxProcess(
     });
 
     child.stdin?.on("error", () => {});
-    child.stdin?.end(options.stdin ? Buffer.from(options.stdin) : undefined);
+    // A persistent protocol owns the stdin pipe after spawn; one-shot stdin closes now.
+    if (!options.persistentStdin) {
+      child.stdin?.end(options.stdin ? Buffer.from(options.stdin) : undefined);
+    }
   });
 }
 
@@ -316,6 +323,23 @@ export class MxcSandboxBackend implements SandboxBackend {
   spawn(policy: SandboxPolicy, options: SandboxProcessOptions): SandboxProcessHandle {
     let child: ChildProcess | undefined;
     let killRequested = false;
+    let stdinClosed = false;
+    const pendingWrites: { data: string; resolve(): void; reject(error: Error): void }[] = [];
+    const rejectWrites = (error: Error) => {
+      for (const write of pendingWrites.splice(0)) write.reject(error);
+    };
+    const dispatch = (entry: { data: string; resolve(): void; reject(error: Error): void }) => {
+      const stdin = child?.stdin;
+      if (!stdin || stdin.destroyed || stdin.writableEnded || stdinClosed) {
+        entry.reject(new Error("Persistent process input is closed"));
+        return;
+      }
+      try {
+        stdin.write(entry.data, "utf8", (error) => error ? entry.reject(error) : entry.resolve());
+      } catch (error) {
+        entry.reject(error instanceof Error ? error : new Error(String(error)));
+      }
+    };
     const completed = (async () => {
       if (this.#platform !== "win32") throw new Error("MXC ProcessContainer requires Windows");
       if (options.signal?.aborted) throw new Error("aborted");
@@ -325,14 +349,30 @@ export class MxcSandboxBackend implements SandboxBackend {
       return startSandboxProcess(sdk, policy, options, (spawned) => {
         child = spawned;
         if (killRequested) child.kill();
+        for (const entry of pendingWrites.splice(0)) dispatch(entry);
+        if (stdinClosed) child.stdin?.end();
       });
     })();
+    void completed.catch(() => rejectWrites(new Error("Persistent process input is closed")));
     return {
       completed,
       kill: () => {
         killRequested = true;
         child?.kill();
       },
+      ...(options.persistentStdin ? {
+        write(data: string): Promise<void> {
+          return new Promise<void>((resolve, reject) => {
+            const entry = { data, resolve, reject };
+            if (child?.stdin) dispatch(entry);
+            else pendingWrites.push(entry);
+          });
+        },
+        closeInput(): void {
+          stdinClosed = true;
+          child?.stdin?.end();
+        },
+      } : {}),
     };
   }
 }