[Alexandre Zollinger Chohfi (azchohfi)]

Summary

Moves Widget Creator off the vendored prerelease wxc-exec binaries (MXC v0.7.0-rc1) onto the stable, public Microsoft.Mxc.Sdk 1.0.1 NuGet package and its in-process Microsoft.Mxc.Sdk.V1 API. MXC v1.0.1 is a non-prerelease GitHub release, and the package is author-signed by Microsoft and countersigned by nuget.org. Supersedes #906. From #906 this keeps only Widget Creator's run-time Copilot CLI fallback (CopilotSdkClient.ResolveCliPath). Its build-time CLI acquisition targets are not included: GitHub.Copilot.SDK 1.0.28 already downloads the CLI from github/copilot-cli releases, checks it against SHA256SUMS.txt, and supports mirrors.

Sandbox (MxcSandbox)

• Widgets launch through MxcContainer.SpawnAsync on the Containment.ProcessContainer backend; wxc-exec is no longer run.
• stdout/stderr stream into the log. MXC warnings are logged at spawn and again after the wait, because MXC can add more during finalization.
• MXC timeouts and host cancellation are reported with the existing WIDGET_SANDBOX_TIMEOUT marker.
• These are reported as sandbox errors, never as widget crashes, so they never trigger the AI repair loop:
  • MxcException and SDK argument errors at spawn;
  • an MxcException from the wait;
  • an unexpected output-reader failure;
  • a failed containment check, including one that races with cancellation.
• If the sandbox can't run a widget's self-test, the widget is saved but not launched, and the reason is shown.
• The stream closers used during the drain grace period are disposed after use; each closer access returns a new native handle.

Runtime integrity (C-3, MxcNativeRuntime)

• Package signing only authenticates at restore time. The SDK's own native loader also honors MXC_FFI_DIR and developer build paths without verifying them.
• So at startup, before any MXC call, the host:
  • claims the SDK assembly's DllImport resolver;
  • resolves mxc_ffi only from the app's packaged native assets;
  • requires mxc_ffi.dll and every companion native (plm.exe, wslcsdk.dll, wxc-wslc-daemon.exe) to be present as regular files at the expected path. The canonical path is taken from the open handle, so symbolic links, junctions and redirected paths are rejected;
  • holds them open read-share-only, so neither they nor their folders can be swapped, renamed or deleted;
  • requires a valid Authenticode signature (WinVerifyTrust) whose leaf is O=Microsoft Corporation, with a chain that ends in a genuine Microsoft root. The root is checked by public key using CERT_CHAIN_POLICY_MICROSOFT_ROOT, not by name;
  • loads exactly that file.
• Any failure leaves the sandbox unavailable (fail closed). This replaces the removed hash pins without pinning anything.
• Trust boundary (documented): the app's own folder must not be writable by untrusted users. The .NET runtime itself probes it for bare-named native libraries before any app code runs, and anyone who can write there could replace WidgetCreator.dll anyway.

Policy (MxcPolicy)

• The per-widget policy JSON uses MXC 1.0 field names: filesystem.*, network.egress{default,allow,deny}, network.ingress{default,hostLoopback}, ui.*, and processContainer.capabilities.
• It is validated as a closed document, like the MXC contract, and mapped to the typed ContainerRequest. Validation rejects:
  • unknown fields, explicit null values, and duplicate keys;
  • CIDRs MXC wouldn't parse. This mirrors Rust cidr::IpCidr: strict IPv4 and IPv6 text, host bits zero, each except inside its cidr;
  • empty to / ports lists;
  • invalid port selectors (endPort needs port and must be ≥ it; ICMP takes no ports).
• Policies saved in the old 0.6.0-alpha format are migrated when read. The old default policy migrates exactly to the new default.
• Migration fails closed: a legacy policy is reported as invalid when it uses settings MXC 1.0 can't express (for example network.blockedHosts or leastPrivilege: true), or when its known fields are malformed. The widget then runs with the default policy, and the run log shows a visible warning naming the settings that were not applied.

Containment checks (C-2, MxcContainmentVerifier)

• Strict mode (WIDGET_CREATOR_REQUIRE_BASE_CONTAINER) uses MxcContainer.Probe(request).Tier == BaseContainer.
• The out-of-band token check inspects the contained process ID reported by the SDK.

Permissions dialog

• Removed the "least privilege" toggle; MXC 1.0 doesn't expose that setting.
• Local-network access is offered only together with internet access. MXC's AppContainer fallback rejects inbound-only private-network access.
• Clipboard options now include write-only and all.
• "No network access" clears egress.allow / egress.deny and closes ingress.

Other

• Self-test output is treated as untrusted data in the repair prompt.
• ResolveCliPath also checks the WinGet GitHub.Copilot command links (user and machine scope). It still never scans PATH.

Removed

• tools/mxc/** (x64 and arm64 executables plus README).
• The MxcBinaryManifest.cs SHA-256 pins and the csproj copy item.
• The WIDGET_CREATOR_WXC_EXEC, WIDGET_CREATOR_MXC_BIN, WIDGET_CREATOR_USE_LOCAL_MXC, and WIDGET_CREATOR_MXC_ROOT overrides.
• The branch history adds no binaries.

Linked issue / spec

Supersedes #906.

Test plan

Validated on Windows 11 26100.9711 x64. MXC's tier probe reports BaseContainer on this host.

• dotnet build samples/apps/widget-creator/widget-creator.csproj -c Release -p:Platform=x64: passed, 0 warnings, 0 errors
• dotnet build samples/apps/widget-creator/widget-creator.csproj -c Release -p:Platform=ARM64: passed. Only built; not run on arm64 hardware.
• pwsh tests/build_props/ci/CopilotSdkContract.Tests.ps1: passed (6/6)
• dotnet test tests/Reactor.Tests -p:Platform=x64 -p:SkipSignaturesGen=true --filter "FullyQualifiedName~WinAppSDKReferenceGuardTests": passed (86/86)
• Real app startup: WidgetCreator.exe --check-runtime (RID-less runtimes\win-x64\native layout) logs "MXC native runtime verified (Microsoft-signed) and bound".
• NativeAOT: an earlier full WidgetCreator publish opened its window and loaded MXC native 1.0.1. That publish needed -p:WarningsNotAsErrors=CA1416 for a pre-existing error in WindowsAppRuntimeCheck.cs, unchanged from main. The native gate (resolver claim, Authenticode, Microsoft-root policy, final-path check) was also re-run in a NativeAOT build of the harness below.
• Local scratch harness (not committed). It compiles the real MxcPolicy / MxcSandbox / MxcContainmentVerifier / MxcNativeRuntime sources and runs real sandboxed processes. All checks passed:
  • Policy:
    • mapping of default, mutated and legacy policies;
    • rejection of unknown fields, nulls, duplicate keys, bad clipboard values, ports, CIDRs, except entries and empty selectors;
    • fail-closed legacy migration, including malformed fields;
    • a visible warning when a stored policy is replaced.
  • CIDR parity with real MXC: a set of tricky IPv4/IPv6 peers (mapped, cross-family except, bracketed or short forms) was checked with both our validator and a real MXC 1.0.1 spawn, and every case agreed.
  • Run behavior:
    • stdout streaming and exit codes;
    • MXC timeout (about 2s);
    • host cancellation (kill, 0xC000013A).
  • Filesystem and network:
    • a file under the user profile can't be read by default, and becomes readable when granted;
    • curl to nuget.org fails by default and returns HTTP 200 with Internet access.
  • Native gate (C-3):
    • with a decoy signed mxc_ffi.dll in MXC_FFI_DIR, only the verified app-local DLL loads;
    • a tampered mxc_ffi.dll or plm.exe fails (0x80096010);
    • a validly signed non-Microsoft binary fails the Microsoft-root policy (0x800B0109);
    • launching through a junction, a symlinked mxc_ffi.dll, and a missing wslcsdk.dll are all rejected;
    • Windows refuses to rename a parent folder while the files are pinned.
  • Token check: every run was verified as AppContainer at low integrity.
• Real window: a framework-dependent Reactor/WinUI app (the shape of generated widgets) launched under the default policy and created its top-level window.
• Not run: the full generate → build → run flow with Copilot.
• Needs human validation: running on arm64 hardware, and a specialist review of the Windows security mechanisms (Authenticode, native loading, file pinning). Copilot's latest review flags these as needing a closer look; it has no open issues.
• Note: a self-contained WinUI app fails at Application.Start (CLASS_E_CLASSNOTAVAILABLE) under ProcessContainer. The old vendored wxc-exec 0.7.0-rc1 fails the same way, so this is not a regression. Generated widgets are framework-dependent and are not affected.

Risk / breaking changes

• Sample only. No public Reactor API changes. Adds one central PackageVersion (Microsoft.Mxc.Sdk 1.0.1). No build-wide changes: Directory.Build.targets and the pipeline templates are unchanged from main.
• Stored policies: existing per-widget policies are migrated in memory when read. A legacy policy with unsupported or malformed settings runs with the default policy, with a visible warning, until the user reviews and saves it. Hand-edited policies with nulls, duplicate keys or lax CIDR syntax are now reported as invalid.
• Fail-closed sandbox availability: if the MXC natives are missing, modified, linked, or not Microsoft-signed, the sandbox reports itself as unavailable instead of running widgets. Launching the app through a junction or symbolic link to its folder also makes the sandbox unavailable.
• Removed overrides: the WIDGET_CREATOR_*MXC* / WXC_EXEC environment overrides and the least-privilege toggle are gone. MXC 1.0 always runs with least privilege off.

[github-actions]

📦 Build metrics

Artifact sizes for ea7a596 vs the base branch (57a5106).

Packages (compressed .nupkg)

Artifact	base	PR	Δ
Microsoft.UI.Reactor.nupkg	2.00 MB	2.00 MB	-6 B (0.00%)	≈
Microsoft.UI.Reactor.Advanced.nupkg	495.8 KB	495.8 KB	-3 B (0.00%)	≈
Microsoft.UI.Reactor.Devtools.nupkg	287.8 KB	287.8 KB	-4 B (0.00%)	≈

Assemblies in Microsoft.UI.Reactor

Artifact	base	PR	Δ
Reactor.Analyzers.dll	411.5 KB	411.5 KB	+0 B (0.00%)	≈
Reactor.dll	2.75 MB	2.75 MB	+0 B (0.00%)	≈
Reactor.Localization.Generator.dll	16.0 KB	16.0 KB	+0 B (0.00%)	≈
Reactor.Wrappers.Abstractions.dll	10.5 KB	10.5 KB	+0 B (0.00%)	≈
Reactor.Wrappers.Generator.dll	145.5 KB	145.5 KB	+0 B (0.00%)	≈

Assemblies in Microsoft.UI.Reactor.Advanced

Artifact	base	PR	Δ
Reactor.Advanced.dll	1.00 MB	1.00 MB	+0 B (0.00%)	≈

Assemblies in Microsoft.UI.Reactor.Devtools

Artifact	base	PR	Δ
Microsoft.UI.Reactor.Devtools.dll	787.5 KB	787.5 KB	+0 B (0.00%)	≈

No size change beyond the noise floor. ✅

_{✅ smaller / ⚠️ larger / ≈ within noise. Sizes come from a Release dotnet pack on the CI runner: packages are the compressed .nupkg download size, assemblies the uncompressed DLL inside it.
workflow run.}

[github-actions]

🧪 Merged coverage

Coverage for ea7a596 vs the base branch (8ef5f38) — unit + selftest merged.

Metric	base	PR	Δ
Line	88.37%	88.38%	+0.01 pp	≈
Branch	47.01% (17571/37374)	47.02% (17572/37374)	+0.01 pp	≈

No coverage change beyond the noise floor. ✅

_{✅ higher / ⚠️ lower / ≈ within noise. Δ is in percentage points; coverage is unit + selftest merged (Debug x64) on the CI runner. Cobertura reports attached to the workflow run as artifacts.}

[Copilot]

🟡 Changes recommended

The first SDK call can load a substituted native DLL into the unsandboxed host before later checks, leaving a critical runtime-substitution vulnerability.

6 open issues

• Verify the native DLL before the first SDK call · New
• Clear deny rules when selecting no network access · New
• Validate CIDR addresses and prefix lengths · New
• Reject invalid port ranges and ICMP port selectors · New
• Show policy migration failures in the visible run log · New
• Propagate stream pump failures as sandbox errors · New

What changed in this PR

Migrates Widget Creator from vendored prerelease MXC executables to the stable Microsoft.Mxc.Sdk 1.0.1 in-process sandbox API, superseding #906 without its build-time CLI acquisition changes.

Changes:

• Replaces executable-based sandboxing with SDK requests, streamed output, and updated containment checks.
• Adds policy migration and validation, updates permissions controls, and prevents sandbox launch failures from triggering repair or automatic relaunch.
• Retains runtime Copilot CLI fallback and removes obsolete MXC binaries, integrity pins, and deployment instructions.

File	Description
samples/​apps/​widget-creator/​WidgetCreatorShell.cs	Updates permissions controls and handles self-test launch failures.
samples/​apps/​widget-creator/​widget-creator.csproj	References the MXC SDK and removes executable-copy packaging.
samples/​apps/​widget-creator/​tools/​mxc/​README.md	Removes obsolete vendored-runtime instructions.
samples/​apps/​widget-creator/​Services/​MxcSandbox.cs	Launches and monitors widgets through the in-process SDK.
samples/​apps/​widget-creator/​Services/​MxcPolicy.cs	Validates, migrates, and maps policies to typed SDK requests.
samples/​apps/​widget-creator/​Services/​MxcContainmentVerifier.cs	Uses SDK tier probes and contained process IDs.
samples/​apps/​widget-creator/​Services/​MxcBinaryManifest.cs	Removes vendored-binary integrity pins.
samples/​apps/​widget-creator/​Services/​GenerationPipeline.cs	Separates sandbox failures from repairable failures and sanitizes self-test output.
samples/​apps/​widget-creator/​Services/​CopilotSdkClient.cs	Adds runtime CLI resolution when no bundled CLI exists.
samples/​apps/​widget-creator/​README.md	Documents SDK sandboxing, policies, and CLI fallback.
Directory.Packages.props	Pins Microsoft.Mxc.Sdk to version 1.0.1.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Process completion and cleanup warnings are silently dropped, and the CLI fallback misses the standard user-scoped WinGet location, causing generation to fail despite an installed CLI.

No open issues 🎉

2 previously missed issues

In code that hasn't changed since last review

Add the user-scoped WinGet Copilot CLI path

samples/​apps/​widget-creator/​Services/​CopilotSdkClient.cs:109

A standard user-scoped winget install GitHub.Copilot exposes the executable at %LOCALAPPDATA%\Microsoft\WinGet\Links\copilot.exe, not this location. With CopilotSkipCliDownload=true and no COPILOT_CLI_PATH, this fallback therefore returns null despite an installed CLI, and generation still fails looking for the missing bundled binary. Include the fixed WinGet location without scanning PATH.

Log warnings added during process finalization

samples/​apps/​widget-creator/​Services/​MxcSandbox.cs:250

MXC's MxcProcess.Warnings includes diagnostics added during terminal wait/finalization, not just spawn warnings. Reading it only here silently drops completion and cleanup warnings when the process is later disposed, so the shell can report a clean exit without showing that cleanup failed. Re-read and log newly added warnings after WaitAsync completes, before disposal, while retaining the early warnings for long-running widgets.

6 resolved since last review

• Verify the native DLL before the first SDK call
• Propagate stream pump failures as sandbox errors
• Show policy migration failures in the visible run log
• Reject invalid port ranges and ICMP port selectors
• Validate CIDR addresses and prefix lengths
• Clear deny rules when selecting no network access

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The DLL trust gate matches certificate names rather than cryptographic identity, allowing an attacker-controlled CA installed in CurrentUser\Root to authorize a non-Microsoft DLL for loading into the unsandboxed host.

No open issues 🎉

3 previously missed issues

In code that hasn't changed since last review

Validate signer against trusted Microsoft root identities

samples/​apps/​widget-creator/​Services/​MxcNativeRuntime.cs:208

The Microsoft-root check uses a certificate display name, not a cryptographic identity. A replacement DLL signed by an attacker-controlled CA installed in CurrentUser\Root can pass WinVerifyTrust while using a root named “Microsoft Root Certificate Authority …” and a leaf with O=Microsoft Corporation. This would let a non-Microsoft DLL pass the C-3 gate and load into the unsandboxed host. Validate the chain with the Windows Microsoft-root chain policy (without test-root allowances), or verify approved Microsoft root public keys, rather than matching subject names.

Reject empty destination and port selector arrays

samples/​apps/​widget-creator/​Services/​MxcPolicy.cs:558

Explicit empty selectors such as {"to":[]} or {"ports":[]} pass validation, but MXC 1.0.1 rejects them before launch. Users can therefore save a policy that prevents the widget from running. Reject empty selector arrays; users can omit the field to match all destinations or ports.

Handle MXC wait failures without aborting widget saves

samples/​apps/​widget-creator/​Services/​MxcSandbox.cs:308

MxcProcess.WaitAsync can throw MxcException from its status poll or native wait/finalization, but this block handles only cancellation. That host-side failure escapes RunAsync; during generation or refinement it aborts the pipeline before _library.SaveAsync, rather than saving the built widget without launching it. Handle MXC wait failures as sandbox results too, cleaning up the verifier and output pumps before returning a result with LaunchError set.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because legacy-policy migration can silently discard access denials while retaining broad grants, expanding access without triggering the intended default-policy fallback.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because a cancellation race can discard a confirmed sandbox containment failure and misclassify it as a repairable widget error.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because a critical native-library substitution risk could allow attacker-controlled code to execute in the unsandboxed host before runtime verification.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because duplicate policy keys can trigger an uncaught validation exception that faults rendering instead of displaying an invalid-policy message.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because the grace-period cleanup has subtle native-handle disposal behavior that can retain resources across repeated slow-drain runs.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because an unpublished validation finding indicates that accepted IPv6 input can produce a saved policy that fails at launch.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The security-boundary changes rely on Windows-specific Authenticode, native-loader, and file-pinning guarantees that could not be independently exercised and require specialist validation, particularly on ARM64.

No open issues 🎉

_{Review effort: Balanced}