From 571757e6c41bff426cf877565460df2bdb5564ec Mon Sep 17 00:00:00 2001 From: Carlos Alexandro Becker Date: Mon, 13 Jul 2026 15:52:41 -0300 Subject: [PATCH] feat(sdk): expose Windows isolation tier Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e1e98422-7d07-4a58-923f-c57be100b846 Signed-off-by: Carlos Alexandro Becker --- src/core/mxc-sdk/README.md | 4 ++- src/core/mxc-sdk/src/lib.rs | 2 +- src/core/mxc-sdk/src/platform.rs | 36 ++++++++++++++++++++++++--- src/core/mxc-sdk/tests/sdk_helpers.rs | 12 +++++++++ 4 files changed, 48 insertions(+), 6 deletions(-) diff --git a/src/core/mxc-sdk/README.md b/src/core/mxc-sdk/README.md index 6c20c0709..99d96a276 100644 --- a/src/core/mxc-sdk/README.md +++ b/src/core/mxc-sdk/README.md @@ -47,7 +47,9 @@ available to feed a policy: [`available_tools_policy`] (PATH + tool/SDK env dirs), [`user_profile_policy`], and [`temporary_files_policy`]. [`platform_support`] is the Rust port of `getPlatformSupport` — reports host -support and the available containment backends. +support and the available containment backends. On Windows, +`PlatformSupport::isolation_tier` reports the process-container tier selected +for the default policy. ## Live stdio + kill (streaming) diff --git a/src/core/mxc-sdk/src/lib.rs b/src/core/mxc-sdk/src/lib.rs index 50490f054..5b470c5bd 100644 --- a/src/core/mxc-sdk/src/lib.rs +++ b/src/core/mxc-sdk/src/lib.rs @@ -51,7 +51,7 @@ pub mod policy; mod sandbox; use dispatch::spawn_runner; -pub use platform::{platform_support, PlatformSupport}; +pub use platform::{platform_support, IsolationTier, PlatformSupport}; pub use policy::{ available_tools_policy, build_request, temporary_files_policy, user_profile_policy, FilesystemPolicyResult, SandboxPolicy, SandboxRequest, diff --git a/src/core/mxc-sdk/src/platform.rs b/src/core/mxc-sdk/src/platform.rs index 5ea7be621..dab1ee406 100644 --- a/src/core/mxc-sdk/src/platform.rs +++ b/src/core/mxc-sdk/src/platform.rs @@ -12,6 +12,11 @@ //! probing is a temporary home; it moves to the future `mxc` engine crate that //! both `mxc-sdk` and the executor binaries will share. +#[cfg(target_os = "windows")] +use appcontainer_common::fallback_detector::{self, IsolationTier as BackendIsolationTier}; +#[cfg(target_os = "windows")] +use wxc_common::models::ContainerPolicy; + /// Platform support information — the Rust analogue of the SDK /// `PlatformSupport` type. #[derive(Debug, Clone, Default)] @@ -23,14 +28,28 @@ pub struct PlatformSupport { /// Containment backends available on this host, by wire name /// (e.g. `"seatbelt"`, `"bubblewrap"`, `"processcontainer"`). pub available_methods: Vec, + /// Isolation tier selected for the default Windows process-container policy. + /// + /// `None` on non-Windows hosts or when the Windows capability probe fails. + pub isolation_tier: Option, +} + +/// Windows process-container isolation tier selected by the runtime probe. +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +pub enum IsolationTier { + /// BaseContainer via `Experimental_CreateProcessInSandbox`. + BaseContainer, + /// AppContainer with BFS filesystem isolation. + AppContainerBfs, + /// AppContainer with host DACL augmentation. + AppContainerDacl, } /// Detect MXC support on the current host. /// -/// Mirrors the SDK's `getPlatformSupport`, restricted to the backends the -/// `mxc-sdk` library can actually run. On Windows the isolation tier and UI -/// capabilities come from the in-process fallback probe rather than a -/// `wxc-exec --probe` subprocess. +/// Mirrors the SDK's `getPlatformSupport`. Available methods are restricted to +/// the backends this crate can run. On Windows the isolation tier comes from the +/// in-process fallback probe rather than a `wxc-exec --probe` subprocess. pub fn platform_support() -> PlatformSupport { #[cfg(target_os = "macos")] { @@ -68,9 +87,18 @@ pub fn platform_support() -> PlatformSupport { #[cfg(target_os = "windows")] { + let isolation_tier = fallback_detector::detect(&ContainerPolicy::default(), true) + .ok() + .map(|decision| match decision.tier { + BackendIsolationTier::BaseContainer => IsolationTier::BaseContainer, + BackendIsolationTier::AppContainerBfs => IsolationTier::AppContainerBfs, + BackendIsolationTier::AppContainerDacl => IsolationTier::AppContainerDacl, + }); + PlatformSupport { is_supported: true, available_methods: vec!["processcontainer".to_string()], + isolation_tier, ..Default::default() } } diff --git a/src/core/mxc-sdk/tests/sdk_helpers.rs b/src/core/mxc-sdk/tests/sdk_helpers.rs index 69e115393..d65bd06ac 100644 --- a/src/core/mxc-sdk/tests/sdk_helpers.rs +++ b/src/core/mxc-sdk/tests/sdk_helpers.rs @@ -12,6 +12,9 @@ use mxc_sdk::{ #[cfg(target_os = "macos")] use mxc_sdk::{spawn_sandbox, WaitOutcome}; +#[cfg(target_os = "windows")] +use mxc_sdk::IsolationTier; + fn env_pairs(pairs: &[(&str, &str)]) -> Vec<(String, String)> { pairs .iter() @@ -25,6 +28,8 @@ fn platform_support_reports_host() { // Every platform this test runs on (macOS/Linux/Windows in CI) is supported. assert!(support.is_supported, "reason: {:?}", support.reason); assert!(!support.available_methods.is_empty()); + #[cfg(not(target_os = "windows"))] + assert_eq!(support.isolation_tier, None); } #[cfg(target_os = "macos")] @@ -215,6 +220,13 @@ fn platform_support_windows_is_processcontainer() { support.available_methods, vec!["processcontainer".to_string()] ); + let isolation_tier = support + .isolation_tier + .expect("Windows probe should select an isolation tier"); + assert_eq!( + isolation_tier == IsolationTier::BaseContainer, + appcontainer_common::fallback_detector::is_base_container_usable() + ); } #[test]