[ig-ant]

Adds Microsoft's MXC BaseContainer as an opt-in second Windows sandbox backend, where the OS enforces filesystem and network policy with no install step. Callers choose it with windows.backend: 'mxc'; unset means srt-win, so existing callers see no change.

Status

Commands under 'mxc' now start through the MXC SDK in process, with SandboxManager.spawnSandboxed(). The wxc-exec runner is no longer used, and the temporary CI probe step is gone. This lands so it is clear what works on MXC today and what doesn't.

What works: the network fence (only the proxy is reachable; raw TCP, other loopback ports and direct DNS are blocked), reads except the deny-list, writes only inside allowWrite and the host's temp folder (by its full path), per-command allowRead/allowWrite, env var masking, kill of the whole process tree, and cmd, PowerShell, git, node and whoami.

What doesn't:

• MSYS2 programs: anything built on the MSYS2 runtime (msys-2.0.dll) crashes at startup with 0xC0000005 in a BaseContainer, even true.exe, and Windows writes no crash record. That covers Git Bash, the Unix tools in Git for Windows' usr\bin, and git hooks or aliases that run through sh. Native git.exe, x64 programs under emulation, cmd and PowerShell all start. Callers should use cmd or PowerShell as the shell with this backend. The Git Bash test row is marked failing, so it turns red once it works.
• Visible windows: UI is on for every command, so a sandboxed program can open a window on the desktop. With UI off, any program that loads user32/gdi32 fails with 0xC0000142. Clipboard and input injection stay blocked.
• Refused settings (backend_unsupported), because MXC cannot express them with the meaning they have elsewhere: tlsTerminate (so request-header credential masking is unavailable), session-level filesystem.disabled, and allowLocalBinding: true (nothing outside the container can connect in).
• Loopback with a proxy is closed by measurement, not by promise: MXC 1.0 refuses a host proxy unless ingress.default is allow (and one without an app identity needs host loopback allowed too). On Windows 11 25H2 (build 26200.9711) that request admitted no inbound connection from loopback or the LAN, and blocked outbound to loopback ports other than the proxy's, but MXC documents no guarantee.

Grants beneath a denied path are sent as they are: on the same build MXC resolves overlapping paths by specificity, whatever the list order, so a nested grant is accessible and the rest of the deny stays denied, matching srt's ranking. Because the most specific entry wins, a read-only entry must never sit at or beneath a write grant: until 84147e4 the working directory was always sent read-only, so a command run inside an allowWrite folder could not write to it (found on the VM). Read-only entries governed by a write grant are now left out, and the working directory is no longer granted for reading beneath a deny. On the VM at 84147e4, writes inside an allowWrite folder reach the host with the working directory inside or outside it, and task 66's deny-parent / write-child / nested-denyWrite config works fully.

• %TEMP%, %TMP% and %LOCALAPPDATA% are per-command scratch: MXC ignores the values srt sends and points them at its own folder for each command (…\AppData\Local\Packages\sandbox.{GUID}\AC), deleted when the command ends. A write there succeeds but is not seen by the next command or on the host, and caches under LOCALAPPDATA (npm, pip and similar) do not persist. The raw SDK behaves the same.
• Host I/O stall: host file operations can stall for several seconds while several sandboxed commands run.
• Bun: spawn() needs fs streams that accept windowsHandle (fs: add windowsHandle option to file streams oven-sh/bun#47087, merged, not yet in a release). A temporary CI step ran the boundary suite on mxc under Bun canary 1.4.4-canary.1+da867c60b, built before that merge: initialize() and the probe passed on the arm64 runner, and every row that starts a command failed with EISDIR, as expected without the fix. The step is removed, so CI runs the boundary suite on srt-win on both Windows legs until the pinned Bun has the fix; then set SRT_BOUNDARY_BACKEND to mxc on arm64.

Moving downstream callers to spawnSandboxed(), with PowerShell as the shell under 'mxc', is a separate follow-up.

Summary

• spawnSandboxed(command, { binShell, customConfig, cwd, timeoutMs, commandId, commandText }) returns the running process: stdout, stderr, stdin, wait() (exit code and timedOut), kill() and dispose(). wrapWithSandboxArgv() throws under 'mxc', and the srt CLI uses spawnSandboxed() there.
• Fail closed: every spawn first runs the SDK's probe() on its own request. It refuses unless the tier is base-container and the host can enforce every part of the request: denied paths, the host proxy, and clipboard and input-injection blocking. Nothing retries with a weaker request or falls back to srt-win; refusals throw WindowsSandboxError with code backend_unsupported.
• The child's environment is an explicit list (Windows base variables, proxy settings, git config, masked sentinels). The user's profile environment is never layered in, since it can hold secrets.
• windows.mxc.path and MXC_BIN_DIR are removed. @microsoft/mxc-sdk stays an optional dependency (Node 24+).
• spawnSandboxed() puts the command's attribution key in the proxy username and registers its text, as srt-win does, so per-command network lists and violation attribution apply.
• checkDependencies()/checkDependenciesAsync() take an optional { windowsBackend }, so a caller checking before initialize() gets the mxc check, not srt-win's.
• The srt CLI waits for the command's output to be written before it exits.
• mxc.test.ts runs on srt-win on both Windows legs until the pinned Bun has the windowsHandle fix; only the arm64 image has the BaseContainer API.
• Per-command mode: 'mask' credential files are denied in the request, as on srt-win (also under filesystem.disabled), and per-command denies keep missing literal paths.
• Also: the HTTP proxy now logs only fixed fields of every upstream error, since a message or stack can carry a proxy URL with credentials. The tests workflow runs with a read-only token.
• windows.backend should become required in the next breaking release; a TODO marks it.

Test plan

Typecheck and lint pass. The request builder and the probe gate have unit tests on every platform, including a refusal test for each unsupported capability and for a probe that throws; the request types were checked against the SDK's own ContainerRequest and ProbeOutput. Platform-spy tests check that a masked credential file lands in the request's denied paths (and fail without the fix), that the refused settings are refused before the SDK loads, that the command text is registered under the command id, and the dependency check's backend option; unit tests check the command id in the proxy username, that a grant beneath a deny is sent in both lists and not refused, and that a deny beneath a grant lands in the denied paths. On 7da4d4c, CI passed on every job except Windows arm64, which failed only on the canary mxc rows described above (the srt-win path, including the reworked B1/B2 on x64, passed). A platform-spy test sends the write-grant case through initialize() and spawnSandboxed() and checks the grant is in neither the read-only nor the denied list (it fails before 84147e4); the boundary suite gains an mxc-only row that writes from inside an allowWrite folder and reads it back on the host. On 80e3c06 and bafe1a7 every CI job passed; on 84147e4 every job passed too. The current head (b0f9008) changes only docs and comments.

Supersedes #765.