Module protected_execution 

Supervised execution channel for protected sessions (macOS refuses nested Seatbelt profiles, so command children are started by the launcher’s wrapper, outside the MCP sandbox). Supervised execution channel for protected Codex sessions.

macOS refuses a nested sandbox_apply as soon as the outer profile is anything but (allow default): one (deny mach-task-read) — or a single unrelated file-read denial — in the whole-MCP profile makes every inner sandbox-exec fail with Operation not permitted. This was measured on the running system, not inferred. A protected MCP server therefore cannot wrap its own command children in the launcher’s store profile, and the previous per-child sandbox-exec prefix could only ever fail closed — which is a broken shell, not a security result.

The launcher’s wrapper process already runs outside the MCP sandbox and is the MCP server’s parent. This module turns it into a narrowly scoped supervisor. One anonymous UnixStream pair is inherited by the MCP child at a fixed descriptor, sealed FD_CLOEXEC before any thread, TCC probe or tool can observe it, and never reaches a command child. The supervisor is the only process that starts command children, and it applies the complete launcher-owned profile once, at spawn, from an unsandboxed parent.

What this file is responsible for:

• the combined profile is launcher-owned — a request can never select, weaken or drop it; a Program request may only narrow it;
• a missing, invalid or closed channel fails closed — there is no unsandboxed fallback shell;
• frames, live-output snapshots, wall time and concurrency are bounded;
• diagnostics carry no command text, environment value or file content.

Not in scope, deliberately: no named listener, no TCP service, no daemon delegation, no durable key. The channel is a process capability that dies with the wrapper.

Structs

Client

LaunchProfile

The immutable boundary the supervisor applies. Built once, in the wrapper, from the rules the launcher pinned into the environment — never from a request, an extra_env entry or a writable file.

Enums

Event

Mode

Functions

launch_mode

How the calling thread must start a command child.

register_shell_runner

Register the shell executor of brokered commands. The first registration wins. Without one, a brokered shell request fails; nothing runs.

sandbox_prefix

Program and leading arguments for a broker-private child.

serve

Serve supervised execution for one protected MCP server until it disconnects. Returns when the channel ends; in-flight children are then cancelled and their process groups terminated.

Type Aliases

ShellRunner

The shared shell executor the supervisor runs a brokered ctx_shell command with: (command, cwd, extra_env, timeout_ms, cancel, idle_keyed, live) → (text, exit_code). It lives in the server layer above the engine (server::execute), which registers it; the CLI does so at start-up.