Validate MXC SDK 0.7.0 on Windows build 26200.8728

[TheAngryPit]

Tracking issue: #784
Base includes: #785, #822
Followed by: #787

Stack note: PR1 #785 and the separate build.ps1 Windows host-detection fix #822 are now both in main. This PR is rebased on the current main baseline and carries only the PR2 MXC SDK/runtime-policy slice. Full Gateway installed-app proof remains in the follow-up PR #787.

Summary

This PR updates the Windows MXC dependency and runtime policy for the current MXC 0.7 path:

• Update @microsoft/mxc-sdk from 0.6.1 to 0.7.0.
• Add processcontainer/AppContainer-DACL support for Windows build 26200.8728+.
• Preserve processcontainer support for Windows build 26300.8289+.
• Keep isolation_session separately gated to 26300.8553+, matching SDK 0.7.0 documentation/source.
• Emit MXC config schema 0.7.0-alpha for SDK 0.7.0.
• Keep AppContainer-DACL fallback compatible by avoiding protected PATH-directory grants, omitting nonexistent denied-path roots, and granting only backend-safe PATH directories.
• Bootstrap TEMP, TMP, TMPDIR, and PATH inside the launched shell because non-empty MXC process.env is not usable on this backend.
• Preserve compatibility host fallback by default when MXC is unavailable.
• Add SystemRunBlockHostFallbackWhenMxcUnavailable=true as the strict opt-in mode that blocks/fails closed when MXC is unavailable.
• Reject custom system.run environment variables before any sandbox-unavailable host fallback while sandboxing is enabled.
• Keep MXC omitted-shell execution on cmd; normal uncontained host fallback still resolves through the host runner.
• Resolve explicit shell="pwsh" to an absolute pwsh.exe path before launching with an empty MXC process environment.
• Require shell-scoped approval before using an uncontained host fallback shell.
• Update Sandbox page status/InfoBar text so unavailable MXC distinguishes blocked mode, compatibility host fallback, and sandbox-off host execution.
• Add/extend unit coverage for SDK 0.7.0, build/UBR gates, config generation, fallback compatibility, strict blocking, diagnostics, shell resolution, policy grants, and installer MXC SDK restore assertions.

Why

The local validation machine is Windows Release Preview 25H2 build 26200.8737. MXC SDK 0.7.0 can run the processcontainer/AppContainer-DACL path there, but the older OpenClaw availability gate rejected this family because it only allowed the 26300 line.

This PR keeps the gate explicit and narrow. It does not add a broad >= 26200 rule and does not enable isolation_session on 26200.

Behavior Contract

This PR intentionally separates behavior by containment boundary:

• MXC available + sandbox enabled: use contained MXC execution.
• MXC unavailable + default settings: preserve compatibility host fallback.
• MXC unavailable + SystemRunBlockHostFallbackWhenMxcUnavailable=true: block/fail closed.
• Sandbox disabled: explicit host execution.

The stricter security work in this PR is inside that compatibility contract: fallback shell approval alignment, unsupported-shell fail-closed behavior, no custom sandbox env before fallback, filtered readonly grants, and explicit UI diagnostics.

Validation

Final local validation for PR2 head 442de02a on Windows build 26200.8737:

• .\build.ps1 passed without setting $env:OS.
• dotnet test tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --filter "FullyQualifiedName~MxcCommandRunnerTests|FullyQualifiedName~MxcConfigBuilderTests|FullyQualifiedName~MxcPolicyBuilderTests|FullyQualifiedName~SystemRunTests" --logger "trx;LogFileName=Shared.pr2-pr3-current-26200-8737.trx" passed: 141 passed, 0 failed, 0 skipped.
• dotnet test tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --filter "FullyQualifiedName~SettingsRoundTripTests|FullyQualifiedName~InstallerIssAssertionTests" --logger "trx;LogFileName=Tray.pr2-current-26200-8737.trx" passed: 28 passed, 0 failed, 0 skipped.

Remaining Publication Limits

• Full Gateway-mode installed-app runtime proof is intentionally in PR3 Add Gateway system.run MXC runtime E2E proof #787.
• Broad full-suite green status is not claimed.
• Full installed Companion replacement/profile migration proof is not claimed in PR2.
• Local external autoreview was attempted for this stack earlier, but the local approval layer blocked external disclosure of local branch code; it was not bypassed, so this PR does not claim clean external autoreview proof.

Notes

The separate build.ps1 Windows host-detection issue was fixed upstream in #822 and is now part of the current main baseline. This PR is rebased on that baseline but does not include the #822 code.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed June 25, 2026, 2:58 PM ET / 18:58 UTC.

Summary
The branch updates MXC system.run shell/env/fallback handling, MXC config generation, Sandbox status UI, settings persistence, installer assertions, and focused MXC/system.run regression coverage.

Reproducibility: not applicable. as a bug reproduction; this is a PR changing MXC runtime policy. The contributor supplied Windows 26200.8737 validation and direct MXC/runtime proof for the changed behavior.

Review metrics: 2 noteworthy metrics.

• Diff Size: 28 files, +2963/-381. The PR spans runner behavior, MXC config, settings, UI, and tests, so maintainer review should focus on cross-surface policy effects.
• Persisted Settings: 1 setting added. SystemRunBlockHostFallbackWhenMxcUnavailable changes upgrade and operator-policy behavior.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #784
Summary: This PR is the PR2 implementation candidate in the open Windows 25H2/MXC validation stack tracked by the canonical issue.

Members:

• canonical: Track Windows 25H2 build 26200.8728 MXC validation #784 - The issue explicitly tracks the staged Windows 25H2/MXC validation stack and lists this PR as PR2.
• fixed_by_candidate: Add Gateway system.run MXC runtime E2E proof #787 - The follow-up PR is stacked after this PR and carries the full Gateway system.run MXC E2E proof for the same tracking issue.
• partial_overlap: Use wxc-exec --probe for MXC host support; bump mxc-sdk to 0.7.0 #776 - The merged PR owns the SDK 0.7/probe-based availability baseline but does not cover this PR's runtime-policy slice.
• adjacent_distinct: Fix locale-sensitive Windows tests and technical token formatting #785 - The merged PR is the PR1 locale/test baseline in the same stack, but it intentionally does not change MXC runtime behavior.
• adjacent_distinct: Fix Windows build detection without OS env var #822 - The merged build.ps1 fix is now part of this PR's base and only removes a Windows host-detection blocker.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P1] Get explicit maintainer acceptance for the compatibility-default versus strict fail-closed sandbox policy.
• Confirm the exact-head win-arm64 build before merge if it is a required check.

Risk before merge

• [P2] Compatibility: existing system.run users may observe different behavior for omitted-shell defaults, custom env requests, PowerShell-family shells under sandboxing, and MXC-unavailable fallback.
• [P1] Security boundary: the PR intentionally decides when sandbox-enabled execution may fall back to uncontained host execution versus fail closed, which is a maintainer policy decision rather than a purely mechanical fix.
• [P1] Availability: SDK restore/copy, PATH/TEMP bootstrapping, DACL grant filtering, and processcontainer config changes can affect command startup and packaging on Windows hosts.
• [P1] Exact-head win-arm64 build was still in progress at the latest GitHub check, and full Gateway installed-app E2E proof is intentionally tracked in Add Gateway system.run MXC runtime E2E proof #787.

Maintainer options:

1. Accept Compatibility Default
   Maintainers can accept the branch's default host fallback when MXC is unavailable, with strict fail-closed reserved for the explicit setting.
2. Tighten Before Merge
   Maintainers can require a stricter default, clearer migration behavior, or additional upgrade proof before landing the fallback policy.
3. Wait For Stack Proof
   Maintainers can pause PR2 merge until the stacked Gateway proof in Add Gateway system.run MXC runtime E2E proof #787 is reviewed or landed.

Next step before merge

• [P2] Human review is needed for sandbox policy, compatibility, and exact-head release acceptance; there is no narrow automated repair finding.

Security
Cleared: No concrete line-level security or supply-chain defect was found, but the sandbox fallback policy remains a maintainer security-boundary decision.

Review details

Best possible solution:

Have maintainers explicitly accept the MXC fallback/security policy and merge only after exact-head platform checks are green; use #787 for the full Gateway E2E proof layer.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug reproduction; this is a PR changing MXC runtime policy. The contributor supplied Windows 26200.8737 validation and direct MXC/runtime proof for the changed behavior.

Is this the best way to solve the issue?

Unclear from product-policy perspective: the implementation path is coherent and covered by focused tests, but maintainers still need to accept the compatibility-default versus stricter sandbox policy.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 7a7f39df2397.

Label changes

Label justifications:

• P2: This is a normal-priority security/compatibility improvement for Windows MXC system.run behavior with limited platform scope.
• merge-risk: 🚨 compatibility: The PR changes system.run fallback, shell, env, and persisted setting behavior that existing users may notice during upgrade.
• merge-risk: 🚨 security-boundary: The diff changes when sandbox-enabled commands are contained, denied, or allowed to fall back to uncontained host execution.
• merge-risk: 🚨 availability: MXC SDK restore, processcontainer config, PATH/TEMP bootstrapping, and DACL filtering can affect build and runtime command availability.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (logs): Contributor comments and PR body include after-change Windows validation, direct MXC backend/runtime markers, and redacted terminal-style proof for the PR2 scope.
• proof: sufficient: Contributor real behavior proof is sufficient. Contributor comments and PR body include after-change Windows validation, direct MXC backend/runtime markers, and redacted terminal-style proof for the PR2 scope.

Evidence reviewed

What I checked:

• Repository policy read and applied: AGENTS.md was read fully; its MXC/system.run/tray guidance and validation expectations are relevant to this PR review. (AGENTS.md:1, 7a7f39df2397)
• PR diff is still substantive: The exact PR head differs from current main by 28 files with 2963 insertions and 381 deletions across MXC runner/config/settings/UI/tests, so the branch is not already implemented on main. (442de02ab13d)
• Runtime-policy change: The PR adds effective-shell resolution, strict host-fallback blocking, custom-env denial before fallback, and approved fallback-shell handling in MxcCommandRunner. (src/OpenClaw.Shared/Mxc/MxcCommandRunner.cs:52, 442de02ab13d)
• MXC config boundary change: The PR changes MXC config building to default sandbox execution to cmd, reject PowerShell-family shells under UI-deny policy, reject explicit env, bootstrap PATH/TEMP in the shell, and filter backend grants. (src/OpenClaw.Shared/Mxc/MxcConfigBuilder.cs:73, 442de02ab13d)
• New persisted setting: The branch adds SystemRunBlockHostFallbackWhenMxcUnavailable as a persisted settings field, making the fallback policy upgrade-sensitive. (src/OpenClaw.Shared/SettingsData.cs:143, 442de02ab13d)
• Current main baseline: Current main still has the earlier MXC fallback behavior and direct-argv guard from prior merged work, so the stricter shell/env/fallback policy remains unique to this PR. (src/OpenClaw.Shared/Mxc/MxcCommandRunner.cs:54, 7a7f39df2397)

Likely related people:

• bkudiess: Authored the merged MXC probe/SDK 0.7.0 PR and current main port commit that owns the closest MXC availability/config baseline touched by this PR. (role: recent area contributor; confidence: high; commits: d86a96c33071, 9f4d23804122; files: src/OpenClaw.Shared/Mxc/MxcAvailability.cs, src/OpenClaw.Shared/Mxc/MxcCommandRunner.cs, src/OpenClaw.Shared/Mxc/MxcConfigBuilder.cs)
• AlexAlves87: Authored the merged direct-argv exec-approval work that this PR preserves and guards in the MXC sandbox/fallback path. (role: adjacent owner; confidence: medium; commits: 3e003463c9e2; files: src/OpenClaw.Shared/Mxc/MxcCommandRunner.cs, src/OpenClaw.Shared/LocalCommandRunner.cs, src/OpenClaw.Shared/Capabilities/SystemCapability.cs)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[TheAngryPit]

Update after addressing the ClawSweeper P1:

• Changed the sandbox default shell to cmd so default system.run no longer selects PowerShell.
• Kept MXC UI containment tied only to explicit UiPolicy.AllowWindows=true; explicit pwsh/powershell no longer silently switches to desktop/UI isolation.
• Added/updated scoped tests for default cmd, explicit PowerShell preserving UI-deny/container isolation, and AllowWindows=true enabling desktop isolation.

Proof run on Windows build 26200.8728:

• git diff --check 2402a60..HEAD -- <4 MXC files> passed.
• dotnet test tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore --filter FullyQualifiedNameMxcConfigBuilderTests|FullyQualifiedNameMxcCommandRunnerTests passed: 57 passed.
• dotnet build src/OpenClaw.Tray.WinUI/OpenClaw.Tray.WinUI.csproj --no-restore -p:Platform=x64 passed.
• �uild.ps1 passed: Shared, Cli, WinNodeCli, SetupEngine, WinUI.
• Crabbox provider=mxc doctor passed with crabbox 0.32.0; MXC cmd smoke printed CRABBOX_MXC_CMD_OK and exited 0. DACL recovery warnings referenced stale temp dirs but did not fail the run.
• Installed Gateway runtime proof passed: �rtifacts/runtime-proof-pr3/20260618-224234/summary.json reports
  esult=passed, node paired/connected, system.run invoked, marker seen, �xitCode=0, stdout marker OPENCLAW_GATEWAY_SYSTEM_RUN_MXC_OK.
• Independent autoreview subagent reported no findings and agreed the P1 is resolved.

Windows Sandbox note:

• provider=windows-sandbox doctor passed with no pre-existing Sandbox session.
• I am not using Windows Sandbox smoke as PR2 proof. Follow-up smoke attempts were invalidated by --keep-on-failure leaving Sandbox sessions open and Windows Sandbox single-instance behavior. This PR is about MXC/processcontainer behavior, and the MXC/Gateway proof above is the relevant runtime evidence.

[TheAngryPit]

@clawsweeper re-review

Update after the ClawSweeper review and scoped autoreview follow-up:

• Took ClawSweeper maintainer option 2: Preserve Compatibility By Default.
• SystemRunSandboxEnabled=true now uses MXC when available, but preserves the existing host fallback when MXC is unavailable.
• Added SystemRunBlockHostFallbackWhenMxcUnavailable=false as the explicit opt-in strict/fail-closed policy.
• Kept sandbox-enabled custom request.Env fail-closed before any availability fallback, so env-bearing requests do not silently downgrade to host execution.
• Fixed strict-mode shell resolution: when MXC is unavailable and strict fallback blocking is enabled, ResolveEffectiveShell(null) stays on sandbox cmd instead of producing host-shell approval state.
• Fixed shell="pwsh" launch resolution by resolving pwsh.exe before clearing the MXC launch environment.
• Updated Sandbox diagnostics so unavailable-MXC UI distinguishes host fallback, strict blocked mode, and sandbox-off host execution.

Proof from the final local pass on Windows build 26200.8728:

• git diff --cached --check passed before commit.
• dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore --filter "FullyQualifiedName~MxcCommandRunner|FullyQualifiedName~MxcConfigBuilder" passed: 63 passed, 4 skipped.
• dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore --filter "FullyQualifiedName~SettingsRoundTripTests" passed: 16 passed.
• dotnet build .\src\OpenClaw.Tray.WinUI\OpenClaw.Tray.WinUI.csproj --no-restore --configuration Debug --runtime win-x64 --verbosity minimal passed.
• openclaw-autoreview --mode local --engine codex --model gpt-5.5 --thinking high was rerun with PR2 contract context and ended clean: no accepted/actionable findings, overall patch is correct.

Autoreview initially found two implementation issues after applying the compatibility-default policy: a stale InfoBar state for strict+toggle-off, and host-shell approval semantics in strict unavailable mode. Both were fixed before the final clean rerun.

Commit pushed: ddba6f8 (fix: preserve MXC fallback compatibility).

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ddba6f8628

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[TheAngryPit]

@clawsweeper re-review

PR body was updated after the ddba6f8 push so the public description now matches the compatibility-default behavior: MXC when available, host fallback by default when unavailable, and strict fail-closed only via SystemRunBlockHostFallbackWhenMxcUnavailable=true.

[TheAngryPit]

Status update after latest push (ca99562):

• Fixed the settings-directory deny regression: the settings directory stays in the logical deny policy even before it exists; backend MXC emission filters only non-existent denied paths MXC cannot consume.
• Fixed the process-wide PATH mutation tests: LocalCommandRunner path resolution is now testable through injected PATH input instead of mutating process environment state.
• Fixed the origin/main zero-test/no-op risk by marking shared test projects explicitly with IsTestProject=true.
• Resolved both review threads for the deny-path and PATH-mutation findings.
• Local CI-equivalent proof: Shared.Tests executed 2299/passed 2299; Tray.Tests executed 1088/passed 1088.
• Autoreview rerun: clean, no accepted/actionable findings.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[TheAngryPit]

@clawsweeper re-review

Status update for rebased PR2 head 442de02a:

• Rebased PR2 on current upstream main (7a7f39df), which now includes the separate Windows build.ps1 environment-detection fix from Fix Windows build detection without OS env var #822.
• Kept Fix Windows build detection without OS env var #822 isolated; this PR does not carry the build.ps1 change.
• Preserved the maintainer-requested compatibility fallback contract:
  • MXC available + sandbox enabled: run through contained MXC.
  • MXC unavailable + default settings: preserve compatibility host fallback.
  • MXC unavailable + SystemRunBlockHostFallbackWhenMxcUnavailable=true: block/fail closed.
  • Sandbox disabled: explicit host execution.
• Kept the stricter PR2 safety fixes inside that contract: shell approval alignment for fallback, unsupported-shell fail-closed behavior, no custom sandbox env before fallback, filtered readonly grants, incremental MXC SDK restore, and current installer assertions.
• Updated the installer assertion to match the current incremental restore stamp contract: MxcSdkRestoreStamp, Outputs="$(MxcSdkRestoreStamp)", and Touch Files="$(MxcSdkRestoreStamp)".

Fresh validation on Windows 26200.8737:

• .\build.ps1 -> passed without setting $env:OS.
• dotnet test tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --filter "FullyQualifiedName~MxcCommandRunnerTests|FullyQualifiedName~MxcConfigBuilderTests|FullyQualifiedName~MxcPolicyBuilderTests|FullyQualifiedName~SystemRunTests" --logger "trx;LogFileName=Shared.pr2-pr3-current-26200-8737.trx" -> 141 passed, 0 failed, 0 skipped.
• dotnet test tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --filter "FullyQualifiedName~SettingsRoundTripTests|FullyQualifiedName~InstallerIssAssertionTests" --logger "trx;LogFileName=Tray.pr2-current-26200-8737.trx" -> 28 passed, 0 failed, 0 skipped.

Scope note:

• Full Gateway/installed-app runtime proof is intentionally in stacked PR3 Add Gateway system.run MXC runtime E2E proof #787, not claimed as PR2-only proof.
• Broad full-suite green is still not claimed.
• Local external autoreview was attempted for this stack earlier, but the local approval layer blocked external disclosure of local branch code; it was not bypassed, so I am not claiming a clean autoreview result here.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.