From b0bbf92291bc16a06e25b9ef3640bdae3c42fb62 Mon Sep 17 00:00:00 2001
From: Ron Leizrowice <ronleizrowice@anthropic.com>
Date: Fri, 28 Aug 2026 22:05:09 -0400
Subject: [PATCH 01/12] fix(linux): pass an over-long bwrap profile through
 --args

The wrapped command is one `sh -c` argument, and Linux caps a single argv
element at 128 KiB (MAX_ARG_STRLEN), so a profile with enough mounts
failed every spawn with an opaque E2BIG before the shell started.

When the rendered line would exceed the cap, the string form hands the
options to bwrap through `--args 3 -- <shell> -c <script> 3<file`,
NUL-separated in a temporary file that is removed with the other
per-command artifacts; bwrap reads and closes the fd while parsing, before
the command starts. Below the cap the command line is unchanged, so
callers need no change either way.
---
 README.md                                  |   9 +-
 src/sandbox/linux-sandbox-utils.ts         |  51 ++++++++++-
 test/sandbox/linux-bwrap-args-file.test.ts | 101 +++++++++++++++++++++
 3 files changed, 158 insertions(+), 3 deletions(-)
 create mode 100644 test/sandbox/linux-bwrap-args-file.test.ts

diff --git a/README.md b/README.md
index 14d896861..3785c610b 100644
--- a/README.md
+++ b/README.md
@@ -215,7 +215,7 @@ child.on('exit', async code => {
 })
 ```
 
-**Violation attribution (`commandId` / `commandText`).** Violations observed while a wrapped command runs (seatbelt log lines, seccomp events, proxy denies) are stored under an attribution key, and `annotateStderrWithSandboxFailures(key, stderr)` / `getViolationsForCommand(key)` look them up by that same key. By default the key is the wrapped string itself. Pass an opaque per-invocation `commandId` (e.g. a tool-use id) to key by that instead — recommended: keys compare on their first 100 characters, so long commands sharing a prefix would otherwise cross-attribute, and a rerun of the same text would inherit the earlier run's events. If the string you *execute* is not the command the invocation *represents* (e.g. you wrap an assembled `source <snapshot> && eval '<cmd>'`), also pass `commandText: '<cmd>'`: it is what `ignoreViolations` command patterns match against and what each violation reports as its `command`.
+**Violation attribution (`commandId` / `commandText`).** Violations observed while a wrapped command runs (seatbelt log lines, seccomp events, proxy denies) are stored under an attribution key, and `annotateStderrWithSandboxFailures(key, stderr)` / `getViolationsForCommand(key)` look them up by that same key. By default the key is the wrapped string itself. Pass an opaque per-invocation `commandId` (e.g. a tool-use id) to key by that instead — recommended: keys compare on their first 100 characters, so long commands sharing a prefix would otherwise cross-attribute, and a rerun of the same text would inherit the earlier run's events. If the string you _execute_ is not the command the invocation _represents_ (e.g. you wrap an assembled `source <snapshot> && eval '<cmd>'`), also pass `commandText: '<cmd>'`: it is what `ignoreViolations` command patterns match against and what each violation reports as its `command`.
 
 ```typescript
 const wrapped = await SandboxManager.wrapWithSandbox(
@@ -226,7 +226,10 @@ const wrapped = await SandboxManager.wrapWithSandbox(
   { commandId: invocationId, commandText: rawCommand },
 )
 // ... run it ...
-const annotated = SandboxManager.annotateStderrWithSandboxFailures(invocationId, stderr)
+const annotated = SandboxManager.annotateStderrWithSandboxFailures(
+  invocationId,
+  stderr,
+)
 ```
 
 #### Available exports
@@ -680,6 +683,8 @@ $ srt 'echo "bad" > .git/hooks/pre-commit'
 
 **Note (Linux):** On Linux, mandatory deny paths only block files that already exist. Non-existent files in these patterns cannot be blocked by bubblewrap's bind-mount approach. macOS uses glob patterns which block both existing and new files.
 
+**Note (Linux):** A profile too large for one shell argument (Linux caps each at 128 KiB, `MAX_ARG_STRLEN`) is handed to bubblewrap through `--args` from a temporary file, so callers of `wrapWithSandbox` never see `E2BIG`; the file is removed with the other per-command artifacts by `cleanupAfterCommand()`. bubblewrap still caps a profile at 9000 parsed arguments (about 3000 mounts).
+
 **Linux search depth:** On Linux, the sandbox uses `ripgrep` to scan for dangerous files in subdirectories within allowed write paths. By default, it searches up to 3 levels deep for performance. You can configure this with `mandatoryDenySearchDepth`:
 
 ```json
diff --git a/src/sandbox/linux-sandbox-utils.ts b/src/sandbox/linux-sandbox-utils.ts
index e31685cfe..b2bd9da7e 100644
--- a/src/sandbox/linux-sandbox-utils.ts
+++ b/src/sandbox/linux-sandbox-utils.ts
@@ -398,6 +398,17 @@ async function linuxGetMandatoryDenyPaths(
 // be cleaned up explicitly.
 const bwrapMountPoints: Set<string> = new Set()
 
+/** Linux's per-argument cap (MAX_ARG_STRLEN, 32 pages) on 4 KiB-page kernels. */
+const LINUX_MAX_ARG_STRLEN = 128 * 1024
+
+/**
+ * Temporary directories holding a `bwrap --args` file, one per wrap whose
+ * profile would not fit a single shell argument. Removed with the mount
+ * points: bwrap reads and closes the file while parsing, before the
+ * command starts.
+ */
+const bwrapArgsDirs: Set<string> = new Set()
+
 // Number of wrapped commands that have been generated but whose cleanup has
 // not yet run. cleanupBwrapMountPoints() defers file deletion while this is
 // positive, because deleting a mount point file on the host while another
@@ -484,6 +495,11 @@ export function cleanupBwrapMountPoints(opts?: { force?: boolean }): void {
     }
   }
   bwrapMountPoints.clear()
+
+  for (const dir of bwrapArgsDirs) {
+    fs.rmSync(dir, { recursive: true, force: true })
+  }
+  bwrapArgsDirs.clear()
 }
 
 /**
@@ -1979,6 +1995,7 @@ export async function wrapCommandWithSandboxLinux(
     if (!shell) {
       throw new Error(`Shell '${shellName}' not found in PATH`)
     }
+    const trailerStart = bwrapArgs.length
     bwrapArgs.push('--', shell, '-c')
 
     // With network restrictions, route the command through buildSandboxCommand
@@ -2001,7 +2018,39 @@ export async function wrapCommandWithSandboxLinux(
       bwrapArgs.push(command)
     }
 
-    const wrappedCommand = quote([bwrapPath ?? 'bwrap', ...bwrapArgs])
+    let wrappedCommand = quote([bwrapPath ?? 'bwrap', ...bwrapArgs])
+    if (Buffer.byteLength(wrappedCommand, 'utf8') + 1 > LINUX_MAX_ARG_STRLEN) {
+      // The caller runs this string as the one argument of `sh -c`, and
+      // Linux caps a single argv element at MAX_ARG_STRLEN, so a profile
+      // this large would fail every spawn with E2BIG. Hand the options to
+      // bwrap through `--args`, which reads them NUL-separated from an fd
+      // (and closes it before the command starts); only the trailer stays
+      // on the line. bwrap still caps the number of parsed arguments
+      // (MAX_ARGS, 9000: about 3000 mounts), so a profile should still be
+      // kept small at the source.
+      const argsDir = fs.mkdtempSync(path.join(tmpdir(), 'srt-bwrap-args-'))
+      const argsFile = path.join(argsDir, 'args')
+      fs.writeFileSync(
+        argsFile,
+        bwrapArgs
+          .slice(0, trailerStart)
+          .map(arg => arg + '\0')
+          .join(''),
+        { mode: 0o600 },
+      )
+      bwrapArgsDirs.add(argsDir)
+      registerExitCleanupHandler()
+      wrappedCommand =
+        quote([
+          bwrapPath ?? 'bwrap',
+          '--args',
+          '3',
+          ...bwrapArgs.slice(trailerStart),
+        ]) + ` 3<${quote([argsFile])}`
+      logForDebugging(
+        `[Sandbox Linux] bwrap options moved to ${argsFile}: the command line would be ${Buffer.byteLength(wrappedCommand, 'utf8')} bytes as one argument`,
+      )
+    }
 
     const restrictions = []
     if (needsNetworkRestriction) restrictions.push('network')
diff --git a/test/sandbox/linux-bwrap-args-file.test.ts b/test/sandbox/linux-bwrap-args-file.test.ts
new file mode 100644
index 000000000..eb411f38f
--- /dev/null
+++ b/test/sandbox/linux-bwrap-args-file.test.ts
@@ -0,0 +1,101 @@
+import { describe, it, expect, beforeEach, afterEach } from 'bun:test'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import {
+  wrapCommandWithSandboxLinux,
+  cleanupBwrapMountPoints,
+} from '../../src/sandbox/linux-sandbox-utils.js'
+import { isLinux } from '../helpers/platform.js'
+
+/**
+ * A bwrap profile too large for one shell argument (Linux's 128 KiB
+ * MAX_ARG_STRLEN) is handed to bwrap through `--args` from a temporary
+ * file; a profile that fits stays on the command line.
+ */
+describe.if(isLinux)('bwrap --args for over-long profiles', () => {
+  let BASE: string
+  const savedCwd = process.cwd()
+
+  beforeEach(() => {
+    BASE = realpathSync(mkdtempSync(join(tmpdir(), 'bwrap-args-')))
+    // cwd outside the write allowlist keeps the mandatory-deny scan from
+    // adding mounts of its own.
+    process.chdir(BASE)
+  })
+
+  afterEach(() => {
+    process.chdir(savedCwd)
+    cleanupBwrapMountPoints({ force: true })
+    rmSync(BASE, { recursive: true, force: true })
+  })
+
+  // A flat directory of `count` files: each one is its own /dev/null mask,
+  // nothing collapses.
+  function flatFiles(count: number): string {
+    const dir = join(BASE, 'many')
+    mkdirSync(dir)
+    const stem = 'a-reasonably-long-file-name-to-fill-the-profile-'
+    for (let i = 0; i < count; i++) {
+      writeFileSync(join(dir, `${stem}${i}.log`), '')
+    }
+    return dir
+  }
+
+  it('keeps a profile that fits on the command line', async () => {
+    const dir = flatFiles(20)
+    const wrapped = await wrapCommandWithSandboxLinux({
+      command: 'echo hello',
+      needsNetworkRestriction: false,
+      readConfig: { denyOnly: [join(dir, '*.log')] },
+      writeConfig: { allowOnly: [], denyWithinAllow: [] },
+    })
+    expect(wrapped).not.toContain('--args')
+    expect(wrapped).toContain('--ro-bind /dev/null')
+  })
+
+  it('moves the options to a NUL-separated file bwrap reads through --args', async () => {
+    // 2000 masks of ~80 bytes each: well past 128 KiB as one argument.
+    const dir = flatFiles(2000)
+    const wrapped = await wrapCommandWithSandboxLinux({
+      command: 'echo hello',
+      needsNetworkRestriction: false,
+      readConfig: { denyOnly: [join(dir, '*.log')] },
+      writeConfig: { allowOnly: [], denyWithinAllow: [] },
+    })
+
+    expect(Buffer.byteLength(wrapped)).toBeLessThan(128 * 1024)
+    expect(wrapped).toMatch(/^bwrap --args 3 -- \S+ -c /)
+    const redirect = wrapped.match(/ 3<(\S+)$/)
+    expect(redirect).not.toBeNull()
+    const argsFile = redirect![1]!
+    expect(existsSync(argsFile)).toBe(true)
+
+    const words = readFileSync(argsFile, 'utf8').split('\0')
+    expect(words[words.length - 1]).toBe('') // every word NUL-terminated
+    const options = words.slice(0, -1)
+    // The profile, one word per element: 2000 masks plus the fixed plumbing.
+    expect(
+      options.filter(w => w === '--ro-bind').length,
+    ).toBeGreaterThanOrEqual(2000)
+    expect(options).toContain(
+      join(dir, 'a-reasonably-long-file-name-to-fill-the-profile-0.log'),
+    )
+    // The trailer stays on the line, not in the file.
+    expect(options).not.toContain('--')
+    expect(options).not.toContain('-c')
+
+    // The file goes with the other per-command artifacts.
+    cleanupBwrapMountPoints({ force: true })
+    expect(existsSync(argsFile)).toBe(false)
+    expect(existsSync(dirname(argsFile))).toBe(false)
+  })
+})

From 9a20371bf053873bdbf598e6a3b20492dcad5cc5 Mon Sep 17 00:00:00 2001
From: Ron Leizrowice <ronleizrowice@anthropic.com>
Date: Fri, 28 Aug 2026 22:16:47 -0400
Subject: [PATCH 02/12] test(linux): give the --args test concrete deny paths,
 not a glob

wrapCommandWithSandboxLinux takes concrete paths; glob expansion happens in
SandboxManager, so the pattern the test passed matched nothing and no
mask was emitted on Linux. Pass the created files themselves.
---
 test/sandbox/linux-bwrap-args-file.test.ts | 27 +++++++++++-----------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/test/sandbox/linux-bwrap-args-file.test.ts b/test/sandbox/linux-bwrap-args-file.test.ts
index eb411f38f..92c3c086d 100644
--- a/test/sandbox/linux-bwrap-args-file.test.ts
+++ b/test/sandbox/linux-bwrap-args-file.test.ts
@@ -38,37 +38,40 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
     rmSync(BASE, { recursive: true, force: true })
   })
 
-  // A flat directory of `count` files: each one is its own /dev/null mask,
-  // nothing collapses.
-  function flatFiles(count: number): string {
+  // `count` files, each its own /dev/null mask, as the concrete list the
+  // wrapper takes (glob expansion happens a layer up, in SandboxManager).
+  function flatFiles(count: number): string[] {
     const dir = join(BASE, 'many')
     mkdirSync(dir)
     const stem = 'a-reasonably-long-file-name-to-fill-the-profile-'
+    const files: string[] = []
     for (let i = 0; i < count; i++) {
-      writeFileSync(join(dir, `${stem}${i}.log`), '')
+      const file = join(dir, `${stem}${i}.log`)
+      writeFileSync(file, '')
+      files.push(file)
     }
-    return dir
+    return files
   }
 
   it('keeps a profile that fits on the command line', async () => {
-    const dir = flatFiles(20)
+    const files = flatFiles(20)
     const wrapped = await wrapCommandWithSandboxLinux({
       command: 'echo hello',
       needsNetworkRestriction: false,
-      readConfig: { denyOnly: [join(dir, '*.log')] },
+      readConfig: { denyOnly: files },
       writeConfig: { allowOnly: [], denyWithinAllow: [] },
     })
     expect(wrapped).not.toContain('--args')
-    expect(wrapped).toContain('--ro-bind /dev/null')
+    expect(wrapped).toContain(`--ro-bind /dev/null ${files[0]}`)
   })
 
   it('moves the options to a NUL-separated file bwrap reads through --args', async () => {
     // 2000 masks of ~80 bytes each: well past 128 KiB as one argument.
-    const dir = flatFiles(2000)
+    const files = flatFiles(2000)
     const wrapped = await wrapCommandWithSandboxLinux({
       command: 'echo hello',
       needsNetworkRestriction: false,
-      readConfig: { denyOnly: [join(dir, '*.log')] },
+      readConfig: { denyOnly: files },
       writeConfig: { allowOnly: [], denyWithinAllow: [] },
     })
 
@@ -86,9 +89,7 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
     expect(
       options.filter(w => w === '--ro-bind').length,
     ).toBeGreaterThanOrEqual(2000)
-    expect(options).toContain(
-      join(dir, 'a-reasonably-long-file-name-to-fill-the-profile-0.log'),
-    )
+    expect(options).toContain(files[0])
     // The trailer stays on the line, not in the file.
     expect(options).not.toContain('--')
     expect(options).not.toContain('-c')

From 39022d7d0e870bf3e0e4ae8881798ee332403c0c Mon Sep 17 00:00:00 2001
From: Ron Leizrowice <ronleizrowice@anthropic.com>
Date: Sat, 29 Aug 2026 02:36:50 -0400
Subject: [PATCH 03/12] fix(linux): keep the --args file in a per-process
 directory every profile ro-binds

A plain file under tmpdir could be rewritten by a running sandbox before
bwrap read it. The directory is created on the process's first wrap
(inside the try, re-created if tmpdir is cleaned, kept across reset), is
the last ro-bind of every Linux profile, and the rendered string unlinks
the file once the shell has opened it. The suite pins the file's contents,
the exact 128 KiB boundary in bytes, cleanup, and a run under bwrap.
---
 README.md                                  |   9 +-
 src/sandbox/linux-sandbox-utils.ts         | 104 +++++++++---
 test/sandbox/linux-bwrap-args-file.test.ts | 187 ++++++++++++++++++---
 3 files changed, 249 insertions(+), 51 deletions(-)

diff --git a/README.md b/README.md
index 3785c610b..20b42ba15 100644
--- a/README.md
+++ b/README.md
@@ -215,7 +215,7 @@ child.on('exit', async code => {
 })
 ```
 
-**Violation attribution (`commandId` / `commandText`).** Violations observed while a wrapped command runs (seatbelt log lines, seccomp events, proxy denies) are stored under an attribution key, and `annotateStderrWithSandboxFailures(key, stderr)` / `getViolationsForCommand(key)` look them up by that same key. By default the key is the wrapped string itself. Pass an opaque per-invocation `commandId` (e.g. a tool-use id) to key by that instead — recommended: keys compare on their first 100 characters, so long commands sharing a prefix would otherwise cross-attribute, and a rerun of the same text would inherit the earlier run's events. If the string you _execute_ is not the command the invocation _represents_ (e.g. you wrap an assembled `source <snapshot> && eval '<cmd>'`), also pass `commandText: '<cmd>'`: it is what `ignoreViolations` command patterns match against and what each violation reports as its `command`.
+**Violation attribution (`commandId` / `commandText`).** Violations observed while a wrapped command runs (seatbelt log lines, seccomp events, proxy denies) are stored under an attribution key, and `annotateStderrWithSandboxFailures(key, stderr)` / `getViolationsForCommand(key)` look them up by that same key. By default the key is the wrapped string itself. Pass an opaque per-invocation `commandId` (e.g. a tool-use id) to key by that instead — recommended: keys compare on their first 100 characters, so long commands sharing a prefix would otherwise cross-attribute, and a rerun of the same text would inherit the earlier run's events. If the string you *execute* is not the command the invocation *represents* (e.g. you wrap an assembled `source <snapshot> && eval '<cmd>'`), also pass `commandText: '<cmd>'`: it is what `ignoreViolations` command patterns match against and what each violation reports as its `command`.
 
 ```typescript
 const wrapped = await SandboxManager.wrapWithSandbox(
@@ -226,10 +226,7 @@ const wrapped = await SandboxManager.wrapWithSandbox(
   { commandId: invocationId, commandText: rawCommand },
 )
 // ... run it ...
-const annotated = SandboxManager.annotateStderrWithSandboxFailures(
-  invocationId,
-  stderr,
-)
+const annotated = SandboxManager.annotateStderrWithSandboxFailures(invocationId, stderr)
 ```
 
 #### Available exports
@@ -683,7 +680,7 @@ $ srt 'echo "bad" > .git/hooks/pre-commit'
 
 **Note (Linux):** On Linux, mandatory deny paths only block files that already exist. Non-existent files in these patterns cannot be blocked by bubblewrap's bind-mount approach. macOS uses glob patterns which block both existing and new files.
 
-**Note (Linux):** A profile too large for one shell argument (Linux caps each at 128 KiB, `MAX_ARG_STRLEN`) is handed to bubblewrap through `--args` from a temporary file, so callers of `wrapWithSandbox` never see `E2BIG`; the file is removed with the other per-command artifacts by `cleanupAfterCommand()`. bubblewrap still caps a profile at 9000 parsed arguments (about 3000 mounts).
+**Note (Linux):** The wrapped string becomes the one argument of `sh -c`, and Linux caps a single argument at 128 KiB (`MAX_ARG_STRLEN` on 4 KiB-page kernels). A profile past that is handed to bubblewrap through `--args` from a file in a per-process temporary directory (created under `os.tmpdir()` on the process's first sandboxed wrap) that every profile of that process ro-binds over itself, so a sandboxed command it launched cannot rewrite a profile bubblewrap has yet to read; a sandbox launched by another `srt` process with tmpdir writable is not covered. The string then opens the file on fd 3, unlinks it, and runs bubblewrap, so it must run under a POSIX `sh`, and fd 3 is consumed (pass extra fds on 4 and above); a file never spawned is removed with the other per-command artifacts (`cleanupAfterCommand()`, process exit). The command itself must still fit one argument, and bubblewrap caps a profile at 9000 parsed arguments (about 3000 mounts).
 
 **Linux search depth:** On Linux, the sandbox uses `ripgrep` to scan for dangerous files in subdirectories within allowed write paths. By default, it searches up to 3 levels deep for performance. You can configure this with `mandatoryDenySearchDepth`:
 
diff --git a/src/sandbox/linux-sandbox-utils.ts b/src/sandbox/linux-sandbox-utils.ts
index b2bd9da7e..2099dd22d 100644
--- a/src/sandbox/linux-sandbox-utils.ts
+++ b/src/sandbox/linux-sandbox-utils.ts
@@ -402,12 +402,43 @@ const bwrapMountPoints: Set<string> = new Set()
 const LINUX_MAX_ARG_STRLEN = 128 * 1024
 
 /**
- * Temporary directories holding a `bwrap --args` file, one per wrap whose
- * profile would not fit a single shell argument. Removed with the mount
- * points: bwrap reads and closes the file while parsing, before the
- * command starts.
+ * Per-process directory for the `bwrap --args` files of profiles too large
+ * for one shell argument, created on the first sandboxed wrap and ro-bound
+ * over itself in EVERY profile this process generates (the INVARIANT at the
+ * end of generateFilesystemArgs). bwrap reads a file only when the embedder
+ * spawns the string; until then no sandbox this process launched may be
+ * able to write there, or a sandboxed command could rewrite the next
+ * command's profile. The rendered string unlinks its file as soon as the
+ * shell has opened it, so a file lives from the wrap to the spawn; one never
+ * spawned goes with the mount points. The directory lives for the whole
+ * process — never removed at reset(), since a sandbox launched before a
+ * reset may still be running with it bound — and goes at exit.
  */
-const bwrapArgsDirs: Set<string> = new Set()
+let bwrapArgsDir: string | undefined
+const bwrapArgsFiles: Set<string> = new Set()
+let bwrapArgsFileCount = 0
+
+function ensureBwrapArgsDir(): string {
+  if (bwrapArgsDir !== undefined && fs.existsSync(bwrapArgsDir)) {
+    return bwrapArgsDir
+  }
+  // First wrap of the process, or the directory was removed under us (an
+  // age-based clean of os.tmpdir()): a profile binding a gone path would
+  // never start.
+  bwrapArgsDir = fs.mkdtempSync(path.join(tmpdir(), 'srt-bwrap-args-'))
+  registerExitCleanupHandler()
+  return bwrapArgsDir
+}
+
+function removeBwrapArgsDir(): void {
+  if (bwrapArgsDir === undefined) return
+  try {
+    fs.rmSync(bwrapArgsDir, { recursive: true, force: true })
+  } catch {
+    // Unremovable: nothing left to do at exit.
+  }
+  bwrapArgsDir = undefined
+}
 
 // Number of wrapped commands that have been generated but whose cleanup has
 // not yet run. cleanupBwrapMountPoints() defers file deletion while this is
@@ -428,6 +459,7 @@ function registerExitCleanupHandler(): void {
 
   process.on('exit', () => {
     cleanupBwrapMountPoints({ force: true })
+    removeBwrapArgsDir()
   })
 
   exitHandlerRegistered = true
@@ -496,10 +528,15 @@ export function cleanupBwrapMountPoints(opts?: { force?: boolean }): void {
   }
   bwrapMountPoints.clear()
 
-  for (const dir of bwrapArgsDirs) {
-    fs.rmSync(dir, { recursive: true, force: true })
+  for (const argsFile of bwrapArgsFiles) {
+    try {
+      fs.rmSync(argsFile, { force: true })
+    } catch {
+      // Unremovable (a permission change under the directory): cleanup
+      // must not throw at the caller, as for the mount points above.
+    }
   }
-  bwrapArgsDirs.clear()
+  bwrapArgsFiles.clear()
 }
 
 /**
@@ -1647,6 +1684,16 @@ async function generateFilesystemArgs(
   if (maskedFileStoreDir !== undefined) {
     args.push('--ro-bind', maskedFileStoreDir, maskedFileStoreDir)
   }
+  // The same invariant for the --args directory (bwrapArgsDir): a profile
+  // bwrap has yet to read sits there, and an earlier sandbox of this
+  // process may still be running with the directory's parent writable.
+  // Like the store's bind, this one lands even beneath a denyRead tmpfs
+  // over tmpdir, so the pending profiles (deny paths, --setenv values) are
+  // readable there — the same bytes a sandbox already sees in its own
+  // /proc/1/cmdline and environment.
+  if (bwrapArgsDir !== undefined) {
+    args.push('--ro-bind', bwrapArgsDir, bwrapArgsDir)
+  }
 
   return args
 }
@@ -1768,6 +1815,9 @@ export async function wrapCommandWithSandboxLinux(
   let applySeccompPrefix: string | undefined
 
   try {
+    // Before the profile is generated, so this one ro-binds it too; inside
+    // the try, so a failure gives the count back.
+    ensureBwrapArgsDir()
     // ========== SECCOMP FILTER (Unix Socket Blocking) ==========
     // apply-seccomp wraps the workload and applies the baked-in BPF filter
     // that blocks socket(AF_UNIX, ...). Skipped when allowAllUnixSockets is true.
@@ -2019,36 +2069,44 @@ export async function wrapCommandWithSandboxLinux(
     }
 
     let wrappedCommand = quote([bwrapPath ?? 'bwrap', ...bwrapArgs])
-    if (Buffer.byteLength(wrappedCommand, 'utf8') + 1 > LINUX_MAX_ARG_STRLEN) {
+    const oneArgumentBytes = Buffer.byteLength(wrappedCommand, 'utf8')
+    if (oneArgumentBytes + 1 > LINUX_MAX_ARG_STRLEN) {
       // The caller runs this string as the one argument of `sh -c`, and
-      // Linux caps a single argv element at MAX_ARG_STRLEN, so a profile
-      // this large would fail every spawn with E2BIG. Hand the options to
-      // bwrap through `--args`, which reads them NUL-separated from an fd
-      // (and closes it before the command starts); only the trailer stays
-      // on the line. bwrap still caps the number of parsed arguments
-      // (MAX_ARGS, 9000: about 3000 mounts), so a profile should still be
-      // kept small at the source.
-      const argsDir = fs.mkdtempSync(path.join(tmpdir(), 'srt-bwrap-args-'))
-      const argsFile = path.join(argsDir, 'args')
+      // Linux caps a single argv element at MAX_ARG_STRLEN (the byte count
+      // plus its NUL), so a profile this large would fail every spawn with
+      // E2BIG. Hand the options to bwrap through `--args`, which reads them
+      // NUL-separated from an fd (and closes it before the command starts);
+      // only the trailer stays on the line. bwrap still caps the number of
+      // parsed arguments (MAX_ARGS, 9000: about 3000 mounts), so a profile
+      // should still be kept small at the source.
+      const argsFile = path.join(
+        ensureBwrapArgsDir(),
+        `args-${process.pid}-${++bwrapArgsFileCount}`,
+      )
       fs.writeFileSync(
         argsFile,
         bwrapArgs
           .slice(0, trailerStart)
           .map(arg => arg + '\0')
           .join(''),
-        { mode: 0o600 },
+        { mode: 0o600, flag: 'wx' },
       )
-      bwrapArgsDirs.add(argsDir)
-      registerExitCleanupHandler()
+      bwrapArgsFiles.add(argsFile)
+      // The redirect opens the file before the group runs, and rm unlinks
+      // it at once (the open fd keeps it readable for bwrap), so the file
+      // lives only until the spawn — the window the ro-bind covers — and
+      // never accumulates while a sandbox stays active.
       wrappedCommand =
+        `{ rm -f ${quote([argsFile])}; exec ` +
         quote([
           bwrapPath ?? 'bwrap',
           '--args',
           '3',
           ...bwrapArgs.slice(trailerStart),
-        ]) + ` 3<${quote([argsFile])}`
+        ]) +
+        `; } 3<${quote([argsFile])}`
       logForDebugging(
-        `[Sandbox Linux] bwrap options moved to ${argsFile}: the command line would be ${Buffer.byteLength(wrappedCommand, 'utf8')} bytes as one argument`,
+        `[Sandbox Linux] bwrap options moved to ${argsFile}: the command line would be ${oneArgumentBytes} bytes as one argument`,
       )
     }
 
diff --git a/test/sandbox/linux-bwrap-args-file.test.ts b/test/sandbox/linux-bwrap-args-file.test.ts
index 92c3c086d..d2a2e1d91 100644
--- a/test/sandbox/linux-bwrap-args-file.test.ts
+++ b/test/sandbox/linux-bwrap-args-file.test.ts
@@ -8,6 +8,7 @@ import {
   rmSync,
   writeFileSync,
 } from 'node:fs'
+import { spawnSync } from 'node:child_process'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import {
@@ -18,13 +19,34 @@ import { isLinux } from '../helpers/platform.js'
 
 /**
  * A bwrap profile too large for one shell argument (Linux's 128 KiB
- * MAX_ARG_STRLEN) is handed to bwrap through `--args` from a temporary
- * file; a profile that fits stays on the command line.
+ * MAX_ARG_STRLEN) is handed to bwrap through `--args` from a file in a
+ * per-process directory that every profile ro-binds over itself; a profile
+ * that fits stays on the command line.
  */
 describe.if(isLinux)('bwrap --args for over-long profiles', () => {
   let BASE: string
   const savedCwd = process.cwd()
 
+  // Runtime arm, as in readonly-deny-dir-stubs.test.ts: only where bwrap can
+  // run the namespace/proc surface the wrapped commands use.
+  const BWRAP_CAN_NAMESPACE =
+    spawnSync(
+      'bwrap',
+      [
+        '--unshare-pid',
+        '--unshare-user',
+        '--cap-drop',
+        'ALL',
+        '--ro-bind',
+        '/',
+        '/',
+        '--proc',
+        '/proc',
+        'true',
+      ],
+      { timeout: 5000 },
+    ).status === 0
+
   beforeEach(() => {
     BASE = realpathSync(mkdtempSync(join(tmpdir(), 'bwrap-args-')))
     // cwd outside the write allowlist keeps the mandatory-deny scan from
@@ -42,61 +64,182 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
   // wrapper takes (glob expansion happens a layer up, in SandboxManager).
   function flatFiles(count: number): string[] {
     const dir = join(BASE, 'many')
-    mkdirSync(dir)
+    mkdirSync(dir, { recursive: true })
     const stem = 'a-reasonably-long-file-name-to-fill-the-profile-'
     const files: string[] = []
     for (let i = 0; i < count; i++) {
       const file = join(dir, `${stem}${i}.log`)
-      writeFileSync(file, '')
+      // Content, so a masked read of 0 bytes proves the mask applied.
+      writeFileSync(file, 'secret\n')
       files.push(file)
     }
     return files
   }
 
-  it('keeps a profile that fits on the command line', async () => {
-    const files = flatFiles(20)
-    const wrapped = await wrapCommandWithSandboxLinux({
-      command: 'echo hello',
+  async function wrap(
+    files: string[],
+    opts: {
+      command?: string
+      allowOnly?: string[]
+      setEnvVars?: Record<string, string>
+    } = {},
+  ): Promise<string> {
+    return wrapCommandWithSandboxLinux({
+      command: opts.command ?? 'echo hello',
       needsNetworkRestriction: false,
       readConfig: { denyOnly: files },
-      writeConfig: { allowOnly: [], denyWithinAllow: [] },
+      writeConfig: { allowOnly: opts.allowOnly ?? [], denyWithinAllow: [] },
+      setEnvVars: opts.setEnvVars,
     })
+  }
+
+  // The per-process --args directory, from the trailing ro-bind every
+  // profile that fits the command line carries (an over-long profile
+  // carries it inside the file).
+  function argsDirOf(wrapped: string): string {
+    const bind = wrapped.match(/--ro-bind (\S*srt-bwrap-args-\S+) \1(?: |$)/)
+    expect(bind).not.toBeNull()
+    return bind![1]!
+  }
+
+  // The file an over-long profile was written to, from the redirect.
+  function argsFileOf(wrapped: string): string {
+    const redirect = wrapped.match(/ 3<(\S+)$/)
+    expect(redirect).not.toBeNull()
+    return redirect![1]!
+  }
+
+  it('keeps a profile that fits on the command line and still ro-binds the --args directory', async () => {
+    const files = flatFiles(20)
+    const wrapped = await wrap(files)
     expect(wrapped).not.toContain('--args')
     expect(wrapped).toContain(`--ro-bind /dev/null ${files[0]}`)
+    // Ro-bound in every profile, not only the ones that use it: a sandbox
+    // launched with a small profile may still be running when a later
+    // over-long one is written there.
+    const argsDir = argsDirOf(wrapped)
+    expect(existsSync(argsDir)).toBe(true)
+    expect(wrapped.lastIndexOf(`--ro-bind ${argsDir} ${argsDir}`)).toBe(
+      wrapped.lastIndexOf('--ro-bind'),
+    )
   })
 
   it('moves the options to a NUL-separated file bwrap reads through --args', async () => {
     // 2000 masks of ~80 bytes each: well past 128 KiB as one argument.
     const files = flatFiles(2000)
-    const wrapped = await wrapCommandWithSandboxLinux({
-      command: 'echo hello',
-      needsNetworkRestriction: false,
-      readConfig: { denyOnly: files },
-      writeConfig: { allowOnly: [], denyWithinAllow: [] },
+    const wrapped = await wrap(files, {
+      setEnvVars: { SRT_TEST_VAR: "value with spaces and 'quotes'" },
     })
 
     expect(Buffer.byteLength(wrapped)).toBeLessThan(128 * 1024)
-    expect(wrapped).toMatch(/^bwrap --args 3 -- \S+ -c /)
-    const redirect = wrapped.match(/ 3<(\S+)$/)
-    expect(redirect).not.toBeNull()
-    const argsFile = redirect![1]!
+    // The shell opens the file on fd 3, unlinks it, and execs bwrap.
+    expect(wrapped).toMatch(/^\{ rm -f (\S+); exec bwrap --args 3 -- \S+ -c /)
+    const argsFile = argsFileOf(wrapped)
+    expect(wrapped.match(/^\{ rm -f (\S+); /)![1]).toBe(argsFile)
     expect(existsSync(argsFile)).toBe(true)
+    // Inside the per-process directory.
+    const argsDir = dirname(argsFile)
+    expect(argsDir).toMatch(/srt-bwrap-args-/)
 
     const words = readFileSync(argsFile, 'utf8').split('\0')
     expect(words[words.length - 1]).toBe('') // every word NUL-terminated
     const options = words.slice(0, -1)
-    // The profile, one word per element: 2000 masks plus the fixed plumbing.
+    // The profile, one word per element, unquoted: 2000 masks between the
+    // fixed plumbing at either end, and a value bwrap must receive verbatim.
+    expect(options.slice(0, 2)).toEqual(['--new-session', '--die-with-parent'])
+    expect(options.slice(-2)).toEqual(['--proc', '/proc'])
+    // The directory's own ro-bind, last of the binds, rides in the file.
+    const lastBind = options.lastIndexOf('--ro-bind')
+    expect(options.slice(lastBind, lastBind + 3)).toEqual([
+      '--ro-bind',
+      argsDir,
+      argsDir,
+    ])
     expect(
       options.filter(w => w === '--ro-bind').length,
     ).toBeGreaterThanOrEqual(2000)
     expect(options).toContain(files[0])
+    const setenv = options.indexOf('--setenv')
+    expect(options.slice(setenv, setenv + 3)).toEqual([
+      '--setenv',
+      'SRT_TEST_VAR',
+      "value with spaces and 'quotes'",
+    ])
     // The trailer stays on the line, not in the file.
     expect(options).not.toContain('--')
     expect(options).not.toContain('-c')
 
-    // The file goes with the other per-command artifacts.
-    cleanupBwrapMountPoints({ force: true })
+    // A file never spawned goes with the other per-command artifacts; the
+    // directory stays for the process (a sandbox launched earlier may still
+    // have it bound) and goes at exit.
+    cleanupBwrapMountPoints()
     expect(existsSync(argsFile)).toBe(false)
-    expect(existsSync(dirname(argsFile))).toBe(false)
+    expect(existsSync(argsDir)).toBe(true)
+    cleanupBwrapMountPoints({ force: true })
+    expect(existsSync(argsDir)).toBe(true)
   })
+
+  it('switches to --args exactly where one argument would exceed 128 KiB', async () => {
+    // The command is the last word on the line; a trailing two-byte
+    // character keeps the shell quoter's output constant while every
+    // added 'a' adds one byte, so the padding sets the rendered size byte
+    // for byte — and a regression to string length (UTF-16 units) would
+    // miscount it by one.
+    const files = flatFiles(20)
+    const base = await wrap(files, { command: 'é' })
+    expect(base).not.toContain('--args')
+    const renderedAt = (bytes: number) =>
+      wrap(files, {
+        command: 'a'.repeat(bytes - Buffer.byteLength(base)) + 'é',
+      })
+
+    const fits = await renderedAt(128 * 1024 - 1)
+    expect(Buffer.byteLength(fits)).toBe(128 * 1024 - 1)
+    expect(fits).not.toContain('--args')
+
+    const overflows = await renderedAt(128 * 1024)
+    expect(overflows).toMatch(/^\{ rm -f \S+; exec bwrap --args 3 -- /)
+  })
+
+  it.if(BWRAP_CAN_NAMESPACE)(
+    'e2e: bwrap applies the profile from the file, and the command sees neither the fd nor a writable --args directory',
+    async () => {
+      // The directory is created by the first wrap of the process, so a
+      // small one names it for the command below.
+      const argsDir = argsDirOf(await wrap(flatFiles(1)))
+      const probe = join(argsDir, 'srt-args-probe')
+      // tmpdir writable inside the sandbox: the case the trailing ro-bind
+      // exists for.
+      const files = flatFiles(2000)
+      const wrapped = await wrap(files, {
+        allowOnly: [tmpdir()],
+        command: [
+          // The mask is a bind of /dev/null: a character device in place
+          // of the file (opening a device node inside the user namespace
+          // is not portable across hosts, so its type is the oracle).
+          `[ -c ${files[0]} ] && echo MASKED || echo UNMASKED`,
+          '[ -e /proc/self/fd/3 ] && echo FD3_OPEN || echo FD3_CLOSED',
+          `touch ${probe} 2>/dev/null && echo ARGS_WRITABLE || echo ARGS_READONLY`,
+        ].join('; '),
+      })
+      const argsFile = argsFileOf(wrapped)
+      expect(dirname(argsFile)).toBe(argsDir)
+      const run = spawnSync(wrapped, {
+        shell: true,
+        encoding: 'utf8',
+        timeout: 60000,
+        cwd: BASE,
+      })
+      expect(run.stderr ?? '').not.toMatch(/--args|Exceeded maximum/)
+      expect(run.status).toBe(0)
+      const lines = run.stdout.trim().split('\n')
+      expect(lines[0]).toBe('MASKED') // the mask from the file applied
+      expect(readFileSync(files[0]!, 'utf8')).toBe('secret\n') // host intact
+      expect(lines[1]).toBe('FD3_CLOSED')
+      expect(lines[2]).toBe('ARGS_READONLY')
+      expect(existsSync(probe)).toBe(false)
+      // Unlinked by the spawn itself.
+      expect(existsSync(argsFile)).toBe(false)
+    },
+  )
 })

From 712e5c489c892386442084256b4c8ea847047a31 Mon Sep 17 00:00:00 2001
From: Ron Leizrowice <ronleizrowice@anthropic.com>
Date: Sat, 29 Aug 2026 02:50:24 -0400
Subject: [PATCH 04/12] test(linux): give the --args e2e fewer mounts and its
 own timeout

The 2000-mount sandbox took longer than bun's 5 s default on the x86-64
runner, so the synchronous spawn was cut off with a null status. Fewer,
longer-named masks still overflow one argument, the runner's tmpdir is
scanned one level deep, and the case gets a 60 s budget.
---
 test/sandbox/linux-bwrap-args-file.test.ts | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/test/sandbox/linux-bwrap-args-file.test.ts b/test/sandbox/linux-bwrap-args-file.test.ts
index d2a2e1d91..39d3ac7ec 100644
--- a/test/sandbox/linux-bwrap-args-file.test.ts
+++ b/test/sandbox/linux-bwrap-args-file.test.ts
@@ -62,10 +62,12 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
 
   // `count` files, each its own /dev/null mask, as the concrete list the
   // wrapper takes (glob expansion happens a layer up, in SandboxManager).
-  function flatFiles(count: number): string[] {
+  function flatFiles(
+    count: number,
+    stem = 'a-reasonably-long-file-name-to-fill-the-profile-',
+  ): string[] {
     const dir = join(BASE, 'many')
     mkdirSync(dir, { recursive: true })
-    const stem = 'a-reasonably-long-file-name-to-fill-the-profile-'
     const files: string[] = []
     for (let i = 0; i < count; i++) {
       const file = join(dir, `${stem}${i}.log`)
@@ -82,6 +84,7 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
       command?: string
       allowOnly?: string[]
       setEnvVars?: Record<string, string>
+      mandatoryDenySearchDepth?: number
     } = {},
   ): Promise<string> {
     return wrapCommandWithSandboxLinux({
@@ -90,6 +93,7 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
       readConfig: { denyOnly: files },
       writeConfig: { allowOnly: opts.allowOnly ?? [], denyWithinAllow: [] },
       setEnvVars: opts.setEnvVars,
+      mandatoryDenySearchDepth: opts.mandatoryDenySearchDepth,
     })
   }
 
@@ -209,10 +213,13 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
       const argsDir = argsDirOf(await wrap(flatFiles(1)))
       const probe = join(argsDir, 'srt-args-probe')
       // tmpdir writable inside the sandbox: the case the trailing ro-bind
-      // exists for.
-      const files = flatFiles(2000)
+      // exists for. Fewer, longer-named masks than the shape test: every
+      // mount costs bwrap time, and the runner's tmpdir is scanned shallowly
+      // for the same reason.
+      const files = flatFiles(700, `${'a'.repeat(150)}-`)
       const wrapped = await wrap(files, {
         allowOnly: [tmpdir()],
+        mandatoryDenySearchDepth: 1,
         command: [
           // The mask is a bind of /dev/null: a character device in place
           // of the file (opening a device node inside the user namespace
@@ -241,5 +248,6 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
       // Unlinked by the spawn itself.
       expect(existsSync(argsFile)).toBe(false)
     },
+    60_000,
   )
 })

From 5bbd0649d2bba8b50f990d0affa0e29b1cbe27f9 Mon Sep 17 00:00:00 2001
From: Ron Leizrowice <ronleizrowice@anthropic.com>
Date: Sat, 29 Aug 2026 15:32:18 -0400
Subject: [PATCH 05/12] fix(linux): feed the --args file on fd 9, and refuse a
 command that cannot fit one argument

dash takes single-digit redirection fds only, and low fds belong to the
embedder (an extra stdio pipe, or a helper binary handed over as
/proc/self/fd/N), so an fd-3 redirect could take away a descriptor the
command needs. fd 9 is used (8 when seccompConfig.applyPath names 9). A
command still past 128 KiB with the options moved out now fails at wrap
time with the sizes named instead of E2BIG at spawn; the args directory
is re-created with a warning if a tmpdir cleaner removed it; the unlink
uses `command rm -f --`.
---
 README.md                                  |  2 +-
 src/sandbox/linux-sandbox-utils.ts         | 71 ++++++++++++++++------
 test/sandbox/linux-bwrap-args-file.test.ts | 43 ++++++++++---
 3 files changed, 91 insertions(+), 25 deletions(-)

diff --git a/README.md b/README.md
index 20b42ba15..3b2071cf2 100644
--- a/README.md
+++ b/README.md
@@ -680,7 +680,7 @@ $ srt 'echo "bad" > .git/hooks/pre-commit'
 
 **Note (Linux):** On Linux, mandatory deny paths only block files that already exist. Non-existent files in these patterns cannot be blocked by bubblewrap's bind-mount approach. macOS uses glob patterns which block both existing and new files.
 
-**Note (Linux):** The wrapped string becomes the one argument of `sh -c`, and Linux caps a single argument at 128 KiB (`MAX_ARG_STRLEN` on 4 KiB-page kernels). A profile past that is handed to bubblewrap through `--args` from a file in a per-process temporary directory (created under `os.tmpdir()` on the process's first sandboxed wrap) that every profile of that process ro-binds over itself, so a sandboxed command it launched cannot rewrite a profile bubblewrap has yet to read; a sandbox launched by another `srt` process with tmpdir writable is not covered. The string then opens the file on fd 3, unlinks it, and runs bubblewrap, so it must run under a POSIX `sh`, and fd 3 is consumed (pass extra fds on 4 and above); a file never spawned is removed with the other per-command artifacts (`cleanupAfterCommand()`, process exit). The command itself must still fit one argument, and bubblewrap caps a profile at 9000 parsed arguments (about 3000 mounts).
+**Note (Linux):** The wrapped string becomes the one argument of `sh -c`, and Linux caps a single argument at 128 KiB (`MAX_ARG_STRLEN` on 4 KiB-page kernels). A profile past that is handed to bubblewrap through `--args` from a file in a per-process temporary directory (created under `os.tmpdir()` on the process's first sandboxed wrap) that every profile of that process ro-binds over itself, so a sandboxed command it launched cannot rewrite a profile bubblewrap has yet to read; a sandbox launched by another `srt` process with tmpdir writable is not covered. The string then opens the file on fd 9, unlinks it, and runs bubblewrap, so it must be run unmodified as the whole `sh -c` script under a POSIX `sh`, and fd 9 is consumed there (fd 8 instead when `seccompConfig.applyPath` is `/proc/self/fd/9`); a file never spawned is removed with the other per-command artifacts (`cleanupAfterCommand()`, process exit). The command itself must still fit one argument, and bubblewrap caps a profile at 9000 parsed arguments (about 3000 mounts).
 
 **Linux search depth:** On Linux, the sandbox uses `ripgrep` to scan for dangerous files in subdirectories within allowed write paths. By default, it searches up to 3 levels deep for performance. You can configure this with `mandatoryDenySearchDepth`:
 
diff --git a/src/sandbox/linux-sandbox-utils.ts b/src/sandbox/linux-sandbox-utils.ts
index 2099dd22d..dd0634f4b 100644
--- a/src/sandbox/linux-sandbox-utils.ts
+++ b/src/sandbox/linux-sandbox-utils.ts
@@ -401,6 +401,25 @@ const bwrapMountPoints: Set<string> = new Set()
 /** Linux's per-argument cap (MAX_ARG_STRLEN, 32 pages) on 4 KiB-page kernels. */
 const LINUX_MAX_ARG_STRLEN = 128 * 1024
 
+/**
+ * The fd an over-long profile's `--args` file is opened on. A single digit,
+ * since dash (Debian/Ubuntu's /bin/sh) rejects multi-digit redirections, and
+ * high, since embedders hand the command low fds of their own (an extra
+ * stdio pipe, or a helper binary passed as `/proc/self/fd/3`). When the
+ * caller's seccompConfig.applyPath names this very fd, the next one down is
+ * used instead.
+ */
+const BWRAP_ARGS_FD = 9
+
+function bwrapArgsFdFor(seccompApplyPath: string | undefined): number {
+  const taken = seccompApplyPath?.match(/^\/(?:proc\/self|dev)\/fd\/(\d+)$/)
+  return taken !== null &&
+    taken !== undefined &&
+    Number(taken[1]) === BWRAP_ARGS_FD
+    ? BWRAP_ARGS_FD - 1
+    : BWRAP_ARGS_FD
+}
+
 /**
  * Per-process directory for the `bwrap --args` files of profiles too large
  * for one shell argument, created on the first sandboxed wrap and ro-bound
@@ -422,9 +441,16 @@ function ensureBwrapArgsDir(): string {
   if (bwrapArgsDir !== undefined && fs.existsSync(bwrapArgsDir)) {
     return bwrapArgsDir
   }
-  // First wrap of the process, or the directory was removed under us (an
-  // age-based clean of os.tmpdir()): a profile binding a gone path would
-  // never start.
+  if (bwrapArgsDir !== undefined) {
+    // Removed under us (an age-based clean of os.tmpdir()): a profile
+    // binding a gone path would never start, so a fresh one is made — but
+    // a sandbox launched earlier that is still running never bound it, and
+    // could write there. Say so.
+    logForDebugging(
+      `[Sandbox Linux] --args directory ${bwrapArgsDir} was removed; re-creating it. Sandboxes started before this point do not have the new directory read-only.`,
+      { level: 'warn' },
+    )
+  }
   bwrapArgsDir = fs.mkdtempSync(path.join(tmpdir(), 'srt-bwrap-args-'))
   registerExitCleanupHandler()
   return bwrapArgsDir
@@ -2079,10 +2105,33 @@ export async function wrapCommandWithSandboxLinux(
       // only the trailer stays on the line. bwrap still caps the number of
       // parsed arguments (MAX_ARGS, 9000: about 3000 mounts), so a profile
       // should still be kept small at the source.
+      const argsFd = bwrapArgsFdFor(seccompConfig?.applyPath)
       const argsFile = path.join(
         ensureBwrapArgsDir(),
         `args-${process.pid}-${++bwrapArgsFileCount}`,
       )
+      // The redirect opens the file before the group runs, and rm unlinks
+      // it at once (the open fd keeps it readable for bwrap), so the file
+      // lives only until the spawn — the window the ro-bind covers — and
+      // never accumulates while a sandbox stays active. `command` keeps an
+      // rm alias of the embedder's shell (zsh reads .zshenv for -c) out of
+      // the way.
+      const viaArgsFile =
+        `{ command rm -f -- ${quote([argsFile])}; exec ` +
+        quote([
+          bwrapPath ?? 'bwrap',
+          '--args',
+          String(argsFd),
+          ...bwrapArgs.slice(trailerStart),
+        ]) +
+        `; } ${argsFd}<${quote([argsFile])}`
+      if (Buffer.byteLength(viaArgsFile, 'utf8') + 1 > LINUX_MAX_ARG_STRLEN) {
+        // The command itself does not fit one argument; nothing here can
+        // help, and the caller's spawn would fail with an opaque E2BIG.
+        throw new Error(
+          `Sandboxed command is too long for one shell argument (${Buffer.byteLength(viaArgsFile, 'utf8')} bytes with the bwrap options already moved to a file; the limit is ${LINUX_MAX_ARG_STRLEN - 1})`,
+        )
+      }
       fs.writeFileSync(
         argsFile,
         bwrapArgs
@@ -2092,21 +2141,9 @@ export async function wrapCommandWithSandboxLinux(
         { mode: 0o600, flag: 'wx' },
       )
       bwrapArgsFiles.add(argsFile)
-      // The redirect opens the file before the group runs, and rm unlinks
-      // it at once (the open fd keeps it readable for bwrap), so the file
-      // lives only until the spawn — the window the ro-bind covers — and
-      // never accumulates while a sandbox stays active.
-      wrappedCommand =
-        `{ rm -f ${quote([argsFile])}; exec ` +
-        quote([
-          bwrapPath ?? 'bwrap',
-          '--args',
-          '3',
-          ...bwrapArgs.slice(trailerStart),
-        ]) +
-        `; } 3<${quote([argsFile])}`
+      wrappedCommand = viaArgsFile
       logForDebugging(
-        `[Sandbox Linux] bwrap options moved to ${argsFile}: the command line would be ${oneArgumentBytes} bytes as one argument`,
+        `[Sandbox Linux] bwrap options moved to ${argsFile} (fd ${argsFd}): the command line would be ${oneArgumentBytes} bytes as one argument`,
       )
     }
 
diff --git a/test/sandbox/linux-bwrap-args-file.test.ts b/test/sandbox/linux-bwrap-args-file.test.ts
index 39d3ac7ec..2edf9b3dd 100644
--- a/test/sandbox/linux-bwrap-args-file.test.ts
+++ b/test/sandbox/linux-bwrap-args-file.test.ts
@@ -85,6 +85,7 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
       allowOnly?: string[]
       setEnvVars?: Record<string, string>
       mandatoryDenySearchDepth?: number
+      seccompConfig?: { applyPath: string; argv0?: string }
     } = {},
   ): Promise<string> {
     return wrapCommandWithSandboxLinux({
@@ -94,6 +95,7 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
       writeConfig: { allowOnly: opts.allowOnly ?? [], denyWithinAllow: [] },
       setEnvVars: opts.setEnvVars,
       mandatoryDenySearchDepth: opts.mandatoryDenySearchDepth,
+      seccompConfig: opts.seccompConfig,
     })
   }
 
@@ -108,7 +110,7 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
 
   // The file an over-long profile was written to, from the redirect.
   function argsFileOf(wrapped: string): string {
-    const redirect = wrapped.match(/ 3<(\S+)$/)
+    const redirect = wrapped.match(/ 9<(\S+)$/)
     expect(redirect).not.toBeNull()
     return redirect![1]!
   }
@@ -136,10 +138,13 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
     })
 
     expect(Buffer.byteLength(wrapped)).toBeLessThan(128 * 1024)
-    // The shell opens the file on fd 3, unlinks it, and execs bwrap.
-    expect(wrapped).toMatch(/^\{ rm -f (\S+); exec bwrap --args 3 -- \S+ -c /)
+    // The shell opens the file on fd 9 (dash takes single-digit fds only;
+    // low fds belong to the embedder), unlinks it, and execs bwrap.
+    expect(wrapped).toMatch(
+      /^\{ command rm -f -- (\S+); exec bwrap --args 9 -- \S+ -c /,
+    )
     const argsFile = argsFileOf(wrapped)
-    expect(wrapped.match(/^\{ rm -f (\S+); /)![1]).toBe(argsFile)
+    expect(wrapped.match(/^\{ command rm -f -- (\S+); /)![1]).toBe(argsFile)
     expect(existsSync(argsFile)).toBe(true)
     // Inside the per-process directory.
     const argsDir = dirname(argsFile)
@@ -202,7 +207,31 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
     expect(fits).not.toContain('--args')
 
     const overflows = await renderedAt(128 * 1024)
-    expect(overflows).toMatch(/^\{ rm -f \S+; exec bwrap --args 3 -- /)
+    expect(overflows).toMatch(
+      /^\{ command rm -f -- \S+; exec bwrap --args 9 -- /,
+    )
+  })
+
+  it('steps aside from an fd the seccomp helper is passed on, and refuses a command that cannot fit at all', async () => {
+    // An embedder that hands its helper binary over as /proc/self/fd/9
+    // would lose it to the redirect; the args move to fd 8.
+    const files = flatFiles(2000)
+    const wrapped = await wrap(files, {
+      seccompConfig: { applyPath: '/proc/self/fd/9', argv0: 'apply-seccomp' },
+    })
+    expect(wrapped).toMatch(/^\{ command rm -f -- \S+; exec bwrap --args 8 -- /)
+    expect(wrapped).toMatch(/ 8<\S+$/)
+    expect(wrapped).toContain('/proc/self/fd/9')
+
+    // The options are already in the file; a command past 128 KiB on its
+    // own has nowhere to go, and the caller hears why instead of E2BIG.
+    let thrown: unknown
+    try {
+      await wrap(files, { command: 'a'.repeat(128 * 1024) })
+    } catch (err) {
+      thrown = err
+    }
+    expect(String(thrown)).toMatch(/too long for one shell argument/)
   })
 
   it.if(BWRAP_CAN_NAMESPACE)(
@@ -225,7 +254,7 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
           // of the file (opening a device node inside the user namespace
           // is not portable across hosts, so its type is the oracle).
           `[ -c ${files[0]} ] && echo MASKED || echo UNMASKED`,
-          '[ -e /proc/self/fd/3 ] && echo FD3_OPEN || echo FD3_CLOSED',
+          '[ -e /proc/self/fd/9 ] && echo FD9_OPEN || echo FD9_CLOSED',
           `touch ${probe} 2>/dev/null && echo ARGS_WRITABLE || echo ARGS_READONLY`,
         ].join('; '),
       })
@@ -242,7 +271,7 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
       const lines = run.stdout.trim().split('\n')
       expect(lines[0]).toBe('MASKED') // the mask from the file applied
       expect(readFileSync(files[0]!, 'utf8')).toBe('secret\n') // host intact
-      expect(lines[1]).toBe('FD3_CLOSED')
+      expect(lines[1]).toBe('FD9_CLOSED')
       expect(lines[2]).toBe('ARGS_READONLY')
       expect(existsSync(probe)).toBe(false)
       // Unlinked by the spawn itself.

From 83416715526d62ed343e50e83f500979c1930bdd Mon Sep 17 00:00:00 2001
From: Ron Leizrowice <ronleizrowice@anthropic.com>
Date: Wed, 2 Sep 2026 08:36:49 +0100
Subject: [PATCH 06/12] refactor(linux): reuse the --args directory this
 profile bound; simpler fd check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The overflow branch names the directory returned by the ensureBwrapArgsDir()
call made before the filesystem arguments were generated — the one this
profile ro-binds — instead of calling it a second time, and the fd
collision test reads the optional match in one expression.
---
 src/sandbox/linux-sandbox-utils.ts | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/sandbox/linux-sandbox-utils.ts b/src/sandbox/linux-sandbox-utils.ts
index dd0634f4b..2c13f18eb 100644
--- a/src/sandbox/linux-sandbox-utils.ts
+++ b/src/sandbox/linux-sandbox-utils.ts
@@ -413,9 +413,7 @@ const BWRAP_ARGS_FD = 9
 
 function bwrapArgsFdFor(seccompApplyPath: string | undefined): number {
   const taken = seccompApplyPath?.match(/^\/(?:proc\/self|dev)\/fd\/(\d+)$/)
-  return taken !== null &&
-    taken !== undefined &&
-    Number(taken[1]) === BWRAP_ARGS_FD
+  return Number(taken?.[1]) === BWRAP_ARGS_FD
     ? BWRAP_ARGS_FD - 1
     : BWRAP_ARGS_FD
 }
@@ -1843,7 +1841,7 @@ export async function wrapCommandWithSandboxLinux(
   try {
     // Before the profile is generated, so this one ro-binds it too; inside
     // the try, so a failure gives the count back.
-    ensureBwrapArgsDir()
+    const argsDir = ensureBwrapArgsDir()
     // ========== SECCOMP FILTER (Unix Socket Blocking) ==========
     // apply-seccomp wraps the workload and applies the baked-in BPF filter
     // that blocks socket(AF_UNIX, ...). Skipped when allowAllUnixSockets is true.
@@ -2106,8 +2104,10 @@ export async function wrapCommandWithSandboxLinux(
       // parsed arguments (MAX_ARGS, 9000: about 3000 mounts), so a profile
       // should still be kept small at the source.
       const argsFd = bwrapArgsFdFor(seccompConfig?.applyPath)
+      // The directory this profile ro-binds (created above, before the
+      // filesystem arguments were generated).
       const argsFile = path.join(
-        ensureBwrapArgsDir(),
+        argsDir,
         `args-${process.pid}-${++bwrapArgsFileCount}`,
       )
       // The redirect opens the file before the group runs, and rm unlinks

From 8bf4437ee45eb4ce8ac72f0eed482d38b6251f53 Mon Sep 17 00:00:00 2001
From: Ron Leizrowice <ronleizrowice@anthropic.com>
Date: Thu, 10 Sep 2026 00:37:46 +0000
Subject: [PATCH 07/12] fix(linux): fail closed on a replaced --args directory;
 leave the command-size cap to the kernel

The --args directory reaches generateFilesystemArgs as a required
parameter and is ro-bound unconditionally, instead of a skip-if-unset
read of module state. Rendering the invocation (inline, or through the
file) moves into renderBwrapInvocation, out of the wrap function.

When the directory has been removed under the process (an age-based
tmpdir clean), a fresh one is still made so profiles that fit the
command line keep starting, but an over-long profile is refused while a
sandbox that predates the new directory, and so never bound it, may
still be running: such a sandbox could rewrite the next command's
profile between the write and the spawn. The refusal lifts once no
sandbox is active.

The second size check is gone. MAX_ARG_STRLEN is 32 pages, so the
"limit is 131071" error was false on 16 KiB and 64 KiB-page kernels and
refused commands that spawned before; switching to --args at 128 KiB is
harmless everywhere, and a command that alone exceeds the kernel's cap
fails at spawn as it always did.

The fd 9 to 8 step-aside had no caller: nothing in the tree hands the
seccomp helper over on fd 9, and the README already documents fd 9 as
taken. An args file is tracked before it is written, so a failed write
is cleaned up. Docstrings are cut to the invariants; the README note
moves to Filesystem Isolation, where it applies.

Tests: one behaviour per case; the cleanup lifecycle, the over-long
command and the replaced directory get their own.
---
 README.md                                  |   4 +-
 src/sandbox/linux-sandbox-utils.ts         | 196 ++++++++++-----------
 test/sandbox/linux-bwrap-args-file.test.ts | 148 ++++++++--------
 3 files changed, 170 insertions(+), 178 deletions(-)

diff --git a/README.md b/README.md
index 3b2071cf2..6e96163a6 100644
--- a/README.md
+++ b/README.md
@@ -652,6 +652,8 @@ Filesystem restrictions are enforced at the OS level:
 
 **Precedence is intentionally opposite for reads vs writes:** `allowRead` overrides `denyRead`, while `denyWrite` overrides `allowWrite`. This lets you carve out readable regions within denied areas, and carve out protected regions within writable areas.
 
+**Note (Linux, large profiles):** The wrapped string runs as the one argument of `sh -c`, which Linux caps at 32 pages (128 KiB with 4 KiB pages). A profile past 128 KiB reaches bubblewrap through `--args` instead: the string opens a file on fd 9, unlinks it and runs bubblewrap, so it must run unmodified as the whole `sh -c` script under a POSIX `sh`, with fd 9 free. The file sits in a per-process directory under `os.tmpdir()` that every profile of the process binds read-only, so a command it sandboxed cannot rewrite a pending profile; a sandbox started by another `srt` process with tmpdir writable is not covered. If that directory is removed while a sandboxed command is running, an over-long profile is refused until the earlier commands have finished. The command itself must still fit one argument, and bubblewrap parses at most 9000 arguments (about 3000 mounts).
+
 ### Mandatory Deny Paths (Auto-Protected Files)
 
 Certain sensitive files and directories are **always blocked from writes**, even if they fall within an allowed write path. This provides defense-in-depth against sandbox escapes and configuration tampering.
@@ -680,8 +682,6 @@ $ srt 'echo "bad" > .git/hooks/pre-commit'
 
 **Note (Linux):** On Linux, mandatory deny paths only block files that already exist. Non-existent files in these patterns cannot be blocked by bubblewrap's bind-mount approach. macOS uses glob patterns which block both existing and new files.
 
-**Note (Linux):** The wrapped string becomes the one argument of `sh -c`, and Linux caps a single argument at 128 KiB (`MAX_ARG_STRLEN` on 4 KiB-page kernels). A profile past that is handed to bubblewrap through `--args` from a file in a per-process temporary directory (created under `os.tmpdir()` on the process's first sandboxed wrap) that every profile of that process ro-binds over itself, so a sandboxed command it launched cannot rewrite a profile bubblewrap has yet to read; a sandbox launched by another `srt` process with tmpdir writable is not covered. The string then opens the file on fd 9, unlinks it, and runs bubblewrap, so it must be run unmodified as the whole `sh -c` script under a POSIX `sh`, and fd 9 is consumed there (fd 8 instead when `seccompConfig.applyPath` is `/proc/self/fd/9`); a file never spawned is removed with the other per-command artifacts (`cleanupAfterCommand()`, process exit). The command itself must still fit one argument, and bubblewrap caps a profile at 9000 parsed arguments (about 3000 mounts).
-
 **Linux search depth:** On Linux, the sandbox uses `ripgrep` to scan for dangerous files in subdirectories within allowed write paths. By default, it searches up to 3 levels deep for performance. You can configure this with `mandatoryDenySearchDepth`:
 
 ```json
diff --git a/src/sandbox/linux-sandbox-utils.ts b/src/sandbox/linux-sandbox-utils.ts
index b52069b6f..4d179600b 100644
--- a/src/sandbox/linux-sandbox-utils.ts
+++ b/src/sandbox/linux-sandbox-utils.ts
@@ -441,40 +441,31 @@ function capabilityArgs(usesSeccompHelper: boolean): string[] {
   return args
 }
 
-/** Linux's per-argument cap (MAX_ARG_STRLEN, 32 pages) on 4 KiB-page kernels. */
+/**
+ * Size at which the profile moves to a `--args` file: Linux's per-argument
+ * cap (MAX_ARG_STRLEN, 32 pages) on a 4 KiB-page kernel, the smallest there is.
+ */
 const LINUX_MAX_ARG_STRLEN = 128 * 1024
 
 /**
- * The fd an over-long profile's `--args` file is opened on. A single digit,
- * since dash (Debian/Ubuntu's /bin/sh) rejects multi-digit redirections, and
- * high, since embedders hand the command low fds of their own (an extra
- * stdio pipe, or a helper binary passed as `/proc/self/fd/3`). When the
- * caller's seccompConfig.applyPath names this very fd, the next one down is
- * used instead.
+ * The fd the `--args` file is opened on: a single digit, since dash rejects
+ * multi-digit redirections, and high, since embedders hand the command low
+ * fds of their own (an extra stdio pipe, a helper as `/proc/self/fd/3`).
  */
 const BWRAP_ARGS_FD = 9
 
-function bwrapArgsFdFor(seccompApplyPath: string | undefined): number {
-  const taken = seccompApplyPath?.match(/^\/(?:proc\/self|dev)\/fd\/(\d+)$/)
-  return Number(taken?.[1]) === BWRAP_ARGS_FD
-    ? BWRAP_ARGS_FD - 1
-    : BWRAP_ARGS_FD
-}
-
 /**
- * Per-process directory for the `bwrap --args` files of profiles too large
- * for one shell argument, created on the first sandboxed wrap and ro-bound
- * over itself in EVERY profile this process generates (the INVARIANT at the
- * end of generateFilesystemArgs). bwrap reads a file only when the embedder
- * spawns the string; until then no sandbox this process launched may be
- * able to write there, or a sandboxed command could rewrite the next
- * command's profile. The rendered string unlinks its file as soon as the
- * shell has opened it, so a file lives from the wrap to the spawn; one never
- * spawned goes with the mount points. The directory lives for the whole
- * process — never removed at reset(), since a sandbox launched before a
- * reset may still be running with it bound — and goes at exit.
+ * Per-process directory for `--args` files. INVARIANT: every profile this
+ * process generates ro-binds it (generateFilesystemArgs), so no sandbox it
+ * launched can rewrite a profile bwrap has yet to read. Removed at exit, not
+ * at reset(): a sandbox launched before a reset may still have it bound.
  */
 let bwrapArgsDir: string | undefined
+/**
+ * The directory was re-created while an earlier sandbox, which never bound
+ * the new one, may still be running. Cleared once no sandbox is active.
+ */
+let bwrapArgsDirUnboundInLiveSandbox = false
 const bwrapArgsFiles: Set<string> = new Set()
 let bwrapArgsFileCount = 0
 
@@ -482,21 +473,75 @@ function ensureBwrapArgsDir(): string {
   if (bwrapArgsDir !== undefined && fs.existsSync(bwrapArgsDir)) {
     return bwrapArgsDir
   }
-  if (bwrapArgsDir !== undefined) {
-    // Removed under us (an age-based clean of os.tmpdir()): a profile
-    // binding a gone path would never start, so a fresh one is made — but
-    // a sandbox launched earlier that is still running never bound it, and
-    // could write there. Say so.
-    logForDebugging(
-      `[Sandbox Linux] --args directory ${bwrapArgsDir} was removed; re-creating it. Sandboxes started before this point do not have the new directory read-only.`,
-      { level: 'warn' },
-    )
+  // Removed under us (an age-based clean of os.tmpdir()). Profiles that fit
+  // the command line only bind the directory, so a fresh one keeps them
+  // starting; writing a file into it is what renderBwrapInvocation refuses
+  // while the flag is set. The count includes the wrap in progress.
+  if (bwrapArgsDir !== undefined && activeSandboxCount > 1) {
+    bwrapArgsDirUnboundInLiveSandbox = true
   }
   bwrapArgsDir = fs.mkdtempSync(path.join(tmpdir(), 'srt-bwrap-args-'))
   registerExitCleanupHandler()
   return bwrapArgsDir
 }
 
+/**
+ * The shell string that runs bwrap with `bwrapArgs`; the words from
+ * `trailerStart` on are the `-- <shell> -c <command>` trailer. The caller
+ * runs it as the one argument of `sh -c`, so past the per-argument cap the
+ * options go through `--args` from a file under `argsDir` and only the
+ * trailer stays on the line (a command that alone exceeds the kernel's cap
+ * still fails at spawn). Throws when the file cannot be written safely.
+ */
+function renderBwrapInvocation(
+  bwrapBinary: string,
+  bwrapArgs: string[],
+  trailerStart: number,
+  argsDir: string,
+): string {
+  const inline = quote([bwrapBinary, ...bwrapArgs])
+  const inlineBytes = Buffer.byteLength(inline, 'utf8')
+  if (inlineBytes + 1 <= LINUX_MAX_ARG_STRLEN) {
+    return inline
+  }
+  if (bwrapArgsDirUnboundInLiveSandbox) {
+    throw new Error(
+      `Sandbox profile is too long for one shell argument (${inlineBytes} bytes) and cannot be passed through a file yet: ${argsDir} replaced a directory that was removed while an earlier sandboxed command, which does not have the new one read-only, may still be running. Retry once earlier sandboxed commands have finished.`,
+    )
+  }
+  const argsFile = path.join(
+    argsDir,
+    `args-${process.pid}-${++bwrapArgsFileCount}`,
+  )
+  // Tracked before the write, so a failed write is cleaned up as well.
+  bwrapArgsFiles.add(argsFile)
+  fs.writeFileSync(
+    argsFile,
+    bwrapArgs
+      .slice(0, trailerStart)
+      .map(arg => arg + '\0')
+      .join(''),
+    { mode: 0o600, flag: 'wx' },
+  )
+  logForDebugging(
+    `[Sandbox Linux] bwrap options moved to ${argsFile} (fd ${BWRAP_ARGS_FD}): the command line would be ${inlineBytes} bytes as one argument`,
+  )
+  // The redirect opens the file before the group runs and rm unlinks it at
+  // once (bwrap reads the open fd), so a file lives only from the wrap to
+  // the spawn. `command` bypasses an rm alias or function of the embedder's
+  // shell (zsh reads .zshenv for -c).
+  return (
+    `{ command rm -f -- ${quote([argsFile])}; exec ` +
+    quote([
+      bwrapBinary,
+      '--args',
+      String(BWRAP_ARGS_FD),
+      ...bwrapArgs.slice(trailerStart),
+    ]) +
+    `; } ${BWRAP_ARGS_FD}<${quote([argsFile])}`
+  )
+}
+
 function removeBwrapArgsDir(): void {
   if (bwrapArgsDir === undefined) return
   try {
@@ -552,6 +597,8 @@ function registerExitCleanupHandler(): void {
  *
  * Pass `{ force: true }` to delete unconditionally — used by the process-exit
  * handler and reset() where deferral is not meaningful.
+ *
+ * Also removes the `--args` files of wraps that were never spawned.
  */
 export function cleanupBwrapMountPoints(opts?: { force?: boolean }): void {
   if (!opts?.force) {
@@ -600,10 +647,11 @@ export function cleanupBwrapMountPoints(opts?: { force?: boolean }): void {
       fs.rmSync(argsFile, { force: true })
     } catch {
       // Unremovable (a permission change under the directory): cleanup
-      // must not throw at the caller, as for the mount points above.
+      // must not throw at the caller.
     }
   }
   bwrapArgsFiles.clear()
+  bwrapArgsDirUnboundInLiveSandbox = false
 }
 
 /**
@@ -1027,6 +1075,7 @@ async function generateFilesystemArgs(
   writeConfig: FsWriteRestrictionConfig | undefined,
   maskedFileBinds: Array<{ realPath: string; fakePath: string }> | undefined,
   maskedFileStoreDir: string | undefined,
+  argsDir: string,
   ripgrepConfig: { command: string; args?: string[] } = { command: 'rg' },
   mandatoryDenySearchDepth: number = DEFAULT_MANDATORY_DENY_SEARCH_DEPTH,
   allowGitConfig = false,
@@ -1795,16 +1844,9 @@ async function generateFilesystemArgs(
   if (maskedFileStoreDir !== undefined) {
     args.push('--ro-bind', maskedFileStoreDir, maskedFileStoreDir)
   }
-  // The same invariant for the --args directory (bwrapArgsDir): a profile
-  // bwrap has yet to read sits there, and an earlier sandbox of this
-  // process may still be running with the directory's parent writable.
-  // Like the store's bind, this one lands even beneath a denyRead tmpfs
-  // over tmpdir, so the pending profiles (deny paths, --setenv values) are
-  // readable there — the same bytes a sandbox already sees in its own
-  // /proc/1/cmdline and environment.
-  if (bwrapArgsDir !== undefined) {
-    args.push('--ro-bind', bwrapArgsDir, bwrapArgsDir)
-  }
+  // Lands even beneath a denyRead tmpfs over tmpdir, so another command's
+  // profile is readable there between its wrap and its spawn.
+  args.push('--ro-bind', argsDir, argsDir)
 
   return args
 }
@@ -1926,8 +1968,7 @@ export async function wrapCommandWithSandboxLinux(
   let applySeccompPrefix: string | undefined
 
   try {
-    // Before the profile is generated, so this one ro-binds it too; inside
-    // the try, so a failure gives the count back.
+    // Inside the try, so a failure gives the count back.
     const argsDir = ensureBwrapArgsDir()
     // ========== SECCOMP FILTER (Unix Socket Blocking) ==========
     // apply-seccomp wraps the workload and applies the baked-in BPF filter
@@ -2102,6 +2143,7 @@ export async function wrapCommandWithSandboxLinux(
       writeConfig,
       maskedFileBinds,
       maskedFileStoreDir,
+      argsDir,
       ripgrepConfig,
       mandatoryDenySearchDepth,
       allowGitConfig,
@@ -2181,60 +2223,12 @@ export async function wrapCommandWithSandboxLinux(
       bwrapArgs.push(command)
     }
 
-    let wrappedCommand = quote([bwrapPath ?? 'bwrap', ...bwrapArgs])
-    const oneArgumentBytes = Buffer.byteLength(wrappedCommand, 'utf8')
-    if (oneArgumentBytes + 1 > LINUX_MAX_ARG_STRLEN) {
-      // The caller runs this string as the one argument of `sh -c`, and
-      // Linux caps a single argv element at MAX_ARG_STRLEN (the byte count
-      // plus its NUL), so a profile this large would fail every spawn with
-      // E2BIG. Hand the options to bwrap through `--args`, which reads them
-      // NUL-separated from an fd (and closes it before the command starts);
-      // only the trailer stays on the line. bwrap still caps the number of
-      // parsed arguments (MAX_ARGS, 9000: about 3000 mounts), so a profile
-      // should still be kept small at the source.
-      const argsFd = bwrapArgsFdFor(seccompConfig?.applyPath)
-      // The directory this profile ro-binds (created above, before the
-      // filesystem arguments were generated).
-      const argsFile = path.join(
-        argsDir,
-        `args-${process.pid}-${++bwrapArgsFileCount}`,
-      )
-      // The redirect opens the file before the group runs, and rm unlinks
-      // it at once (the open fd keeps it readable for bwrap), so the file
-      // lives only until the spawn — the window the ro-bind covers — and
-      // never accumulates while a sandbox stays active. `command` keeps an
-      // rm alias of the embedder's shell (zsh reads .zshenv for -c) out of
-      // the way.
-      const viaArgsFile =
-        `{ command rm -f -- ${quote([argsFile])}; exec ` +
-        quote([
-          bwrapPath ?? 'bwrap',
-          '--args',
-          String(argsFd),
-          ...bwrapArgs.slice(trailerStart),
-        ]) +
-        `; } ${argsFd}<${quote([argsFile])}`
-      if (Buffer.byteLength(viaArgsFile, 'utf8') + 1 > LINUX_MAX_ARG_STRLEN) {
-        // The command itself does not fit one argument; nothing here can
-        // help, and the caller's spawn would fail with an opaque E2BIG.
-        throw new Error(
-          `Sandboxed command is too long for one shell argument (${Buffer.byteLength(viaArgsFile, 'utf8')} bytes with the bwrap options already moved to a file; the limit is ${LINUX_MAX_ARG_STRLEN - 1})`,
-        )
-      }
-      fs.writeFileSync(
-        argsFile,
-        bwrapArgs
-          .slice(0, trailerStart)
-          .map(arg => arg + '\0')
-          .join(''),
-        { mode: 0o600, flag: 'wx' },
-      )
-      bwrapArgsFiles.add(argsFile)
-      wrappedCommand = viaArgsFile
-      logForDebugging(
-        `[Sandbox Linux] bwrap options moved to ${argsFile} (fd ${argsFd}): the command line would be ${oneArgumentBytes} bytes as one argument`,
-      )
-    }
+    const wrappedCommand = renderBwrapInvocation(
+      bwrapPath ?? 'bwrap',
+      bwrapArgs,
+      trailerStart,
+      argsDir,
+    )
 
     const restrictions = []
     if (needsNetworkRestriction) restrictions.push('network')
diff --git a/test/sandbox/linux-bwrap-args-file.test.ts b/test/sandbox/linux-bwrap-args-file.test.ts
index 2edf9b3dd..fc1f5e19b 100644
--- a/test/sandbox/linux-bwrap-args-file.test.ts
+++ b/test/sandbox/linux-bwrap-args-file.test.ts
@@ -18,17 +18,19 @@ import {
 import { isLinux } from '../helpers/platform.js'
 
 /**
- * A bwrap profile too large for one shell argument (Linux's 128 KiB
- * MAX_ARG_STRLEN) is handed to bwrap through `--args` from a file in a
- * per-process directory that every profile ro-binds over itself; a profile
- * that fits stays on the command line.
+ * A bwrap profile too large for one shell argument (128 KiB on a 4 KiB-page
+ * kernel) is handed to bwrap through `--args` from a file in a per-process
+ * directory that every profile ro-binds over itself; a profile that fits
+ * stays on the command line.
  */
 describe.if(isLinux)('bwrap --args for over-long profiles', () => {
+  const MAX_ARG_STRLEN = 128 * 1024
+  const VIA_ARGS_FILE = /^\{ command rm -f -- (\S+); exec bwrap --args 9 -- /
+
   let BASE: string
   const savedCwd = process.cwd()
 
-  // Runtime arm, as in readonly-deny-dir-stubs.test.ts: only where bwrap can
-  // run the namespace/proc surface the wrapped commands use.
+  // Only where bwrap can create the user and pid namespaces and mount /proc.
   const BWRAP_CAN_NAMESPACE =
     spawnSync(
       'bwrap',
@@ -71,13 +73,16 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
     const files: string[] = []
     for (let i = 0; i < count; i++) {
       const file = join(dir, `${stem}${i}.log`)
-      // Content, so a masked read of 0 bytes proves the mask applied.
+      // Content, so the e2e case can tell the host file was left alone.
       writeFileSync(file, 'secret\n')
       files.push(file)
     }
     return files
   }
 
+  // 2000 masks of ~80 bytes each: well past 128 KiB as one argument.
+  const overLongProfile = (): string[] => flatFiles(2000)
+
   async function wrap(
     files: string[],
     opts: {
@@ -85,7 +90,6 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
       allowOnly?: string[]
       setEnvVars?: Record<string, string>
       mandatoryDenySearchDepth?: number
-      seccompConfig?: { applyPath: string; argv0?: string }
     } = {},
   ): Promise<string> {
     return wrapCommandWithSandboxLinux({
@@ -95,7 +99,6 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
       writeConfig: { allowOnly: opts.allowOnly ?? [], denyWithinAllow: [] },
       setEnvVars: opts.setEnvVars,
       mandatoryDenySearchDepth: opts.mandatoryDenySearchDepth,
-      seccompConfig: opts.seccompConfig,
     })
   }
 
@@ -108,21 +111,20 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
     return bind![1]!
   }
 
-  // The file an over-long profile was written to, from the redirect.
   function argsFileOf(wrapped: string): string {
     const redirect = wrapped.match(/ 9<(\S+)$/)
     expect(redirect).not.toBeNull()
     return redirect![1]!
   }
 
-  it('keeps a profile that fits on the command line and still ro-binds the --args directory', async () => {
+  it('keeps a profile that fits on the command line and still ro-binds the --args directory last', async () => {
     const files = flatFiles(20)
     const wrapped = await wrap(files)
     expect(wrapped).not.toContain('--args')
     expect(wrapped).toContain(`--ro-bind /dev/null ${files[0]}`)
-    // Ro-bound in every profile, not only the ones that use it: a sandbox
-    // launched with a small profile may still be running when a later
-    // over-long one is written there.
+    // In every profile, not only the ones that use it: a sandbox launched
+    // with a small profile may still be running when a later over-long one
+    // is written there.
     const argsDir = argsDirOf(wrapped)
     expect(existsSync(argsDir)).toBe(true)
     expect(wrapped.lastIndexOf(`--ro-bind ${argsDir} ${argsDir}`)).toBe(
@@ -130,69 +132,62 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
     )
   })
 
-  it('moves the options to a NUL-separated file bwrap reads through --args', async () => {
-    // 2000 masks of ~80 bytes each: well past 128 KiB as one argument.
-    const files = flatFiles(2000)
+  it('moves every option, and only the options, to a NUL-separated file the string opens on fd 9 and unlinks', async () => {
+    const files = overLongProfile()
     const wrapped = await wrap(files, {
       setEnvVars: { SRT_TEST_VAR: "value with spaces and 'quotes'" },
     })
 
-    expect(Buffer.byteLength(wrapped)).toBeLessThan(128 * 1024)
-    // The shell opens the file on fd 9 (dash takes single-digit fds only;
-    // low fds belong to the embedder), unlinks it, and execs bwrap.
+    expect(Buffer.byteLength(wrapped)).toBeLessThan(MAX_ARG_STRLEN)
+    // `--args 9` is followed at once by the trailer: no option is left on
+    // the line.
     expect(wrapped).toMatch(
-      /^\{ command rm -f -- (\S+); exec bwrap --args 9 -- \S+ -c /,
+      /^\{ command rm -f -- \S+; exec bwrap --args 9 -- \S+ -c .+; \} 9<\S+$/s,
     )
     const argsFile = argsFileOf(wrapped)
-    expect(wrapped.match(/^\{ command rm -f -- (\S+); /)![1]).toBe(argsFile)
-    expect(existsSync(argsFile)).toBe(true)
-    // Inside the per-process directory.
+    expect(wrapped.match(VIA_ARGS_FILE)![1]).toBe(argsFile)
     const argsDir = dirname(argsFile)
     expect(argsDir).toMatch(/srt-bwrap-args-/)
 
     const words = readFileSync(argsFile, 'utf8').split('\0')
-    expect(words[words.length - 1]).toBe('') // every word NUL-terminated
+    expect(words[words.length - 1]).toBe('')
     const options = words.slice(0, -1)
-    // The profile, one word per element, unquoted: 2000 masks between the
-    // fixed plumbing at either end, and a value bwrap must receive verbatim.
-    expect(options.slice(0, 2)).toEqual(['--new-session', '--die-with-parent'])
-    expect(options.slice(-2)).toEqual(['--proc', '/proc'])
-    // The directory's own ro-bind, last of the binds, rides in the file.
+    expect(options).not.toContain('--')
+    expect(options).not.toContain('-c')
+    expect(
+      options.filter(w => w === '--ro-bind').length,
+    ).toBeGreaterThanOrEqual(files.length)
+    expect(options).toContain(files[0])
     const lastBind = options.lastIndexOf('--ro-bind')
     expect(options.slice(lastBind, lastBind + 3)).toEqual([
       '--ro-bind',
       argsDir,
       argsDir,
     ])
-    expect(
-      options.filter(w => w === '--ro-bind').length,
-    ).toBeGreaterThanOrEqual(2000)
-    expect(options).toContain(files[0])
+    // A value bwrap must receive verbatim: one word, unquoted.
     const setenv = options.indexOf('--setenv')
     expect(options.slice(setenv, setenv + 3)).toEqual([
       '--setenv',
       'SRT_TEST_VAR',
       "value with spaces and 'quotes'",
     ])
-    // The trailer stays on the line, not in the file.
-    expect(options).not.toContain('--')
-    expect(options).not.toContain('-c')
+  })
 
-    // A file never spawned goes with the other per-command artifacts; the
-    // directory stays for the process (a sandbox launched earlier may still
-    // have it bound) and goes at exit.
+  it('removes a file that was never spawned at cleanup and keeps the directory for the process', async () => {
+    const argsFile = argsFileOf(await wrap(overLongProfile()))
+    expect(existsSync(argsFile)).toBe(true)
     cleanupBwrapMountPoints()
     expect(existsSync(argsFile)).toBe(false)
-    expect(existsSync(argsDir)).toBe(true)
+    // A sandbox launched earlier may still have the directory bound.
     cleanupBwrapMountPoints({ force: true })
-    expect(existsSync(argsDir)).toBe(true)
+    expect(existsSync(dirname(argsFile))).toBe(true)
   })
 
   it('switches to --args exactly where one argument would exceed 128 KiB', async () => {
     // The command is the last word on the line; a trailing two-byte
     // character keeps the shell quoter's output constant while every
     // added 'a' adds one byte, so the padding sets the rendered size byte
-    // for byte — and a regression to string length (UTF-16 units) would
+    // for byte, and a regression to string length (UTF-16 units) would
     // miscount it by one.
     const files = flatFiles(20)
     const base = await wrap(files, { command: 'é' })
@@ -202,43 +197,46 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
         command: 'a'.repeat(bytes - Buffer.byteLength(base)) + 'é',
       })
 
-    const fits = await renderedAt(128 * 1024 - 1)
-    expect(Buffer.byteLength(fits)).toBe(128 * 1024 - 1)
+    const fits = await renderedAt(MAX_ARG_STRLEN - 1)
+    expect(Buffer.byteLength(fits)).toBe(MAX_ARG_STRLEN - 1)
     expect(fits).not.toContain('--args')
 
-    const overflows = await renderedAt(128 * 1024)
-    expect(overflows).toMatch(
-      /^\{ command rm -f -- \S+; exec bwrap --args 9 -- /,
-    )
+    expect(await renderedAt(MAX_ARG_STRLEN)).toMatch(VIA_ARGS_FILE)
   })
 
-  it('steps aside from an fd the seccomp helper is passed on, and refuses a command that cannot fit at all', async () => {
-    // An embedder that hands its helper binary over as /proc/self/fd/9
-    // would lose it to the redirect; the args move to fd 8.
-    const files = flatFiles(2000)
-    const wrapped = await wrap(files, {
-      seccompConfig: { applyPath: '/proc/self/fd/9', argv0: 'apply-seccomp' },
+  it('leaves a command that alone exceeds 128 KiB to the kernel, whose cap grows with the page size', async () => {
+    const wrapped = await wrap(flatFiles(20), {
+      command: 'a'.repeat(MAX_ARG_STRLEN),
     })
-    expect(wrapped).toMatch(/^\{ command rm -f -- \S+; exec bwrap --args 8 -- /)
-    expect(wrapped).toMatch(/ 8<\S+$/)
-    expect(wrapped).toContain('/proc/self/fd/9')
+    expect(wrapped).toMatch(VIA_ARGS_FILE)
+    expect(Buffer.byteLength(wrapped)).toBeGreaterThan(MAX_ARG_STRLEN)
+  })
 
-    // The options are already in the file; a command past 128 KiB on its
-    // own has nowhere to go, and the caller hears why instead of E2BIG.
-    let thrown: unknown
-    try {
-      await wrap(files, { command: 'a'.repeat(128 * 1024) })
-    } catch (err) {
-      thrown = err
-    }
-    expect(String(thrown)).toMatch(/too long for one shell argument/)
+  it('refuses an over-long profile after the directory was replaced under a sandbox that may still be running', async () => {
+    const removed = argsDirOf(await wrap(flatFiles(1)))
+    rmSync(removed, { recursive: true, force: true })
+
+    const refusal = await wrap(overLongProfile()).then(
+      () => undefined,
+      (err: unknown) => err,
+    )
+    expect(String(refusal)).toMatch(
+      /removed while an earlier sandboxed command/,
+    )
+    // A profile that fits only binds the directory, so it still wraps.
+    const replacement = argsDirOf(await wrap(flatFiles(1)))
+    expect(replacement).not.toBe(removed)
+    expect(existsSync(replacement)).toBe(true)
+
+    // Once no sandbox is active, no sandbox predates the new directory.
+    cleanupBwrapMountPoints({ force: true })
+    const wrapped = await wrap(overLongProfile())
+    expect(dirname(argsFileOf(wrapped))).toBe(replacement)
   })
 
   it.if(BWRAP_CAN_NAMESPACE)(
     'e2e: bwrap applies the profile from the file, and the command sees neither the fd nor a writable --args directory',
     async () => {
-      // The directory is created by the first wrap of the process, so a
-      // small one names it for the command below.
       const argsDir = argsDirOf(await wrap(flatFiles(1)))
       const probe = join(argsDir, 'srt-args-probe')
       // tmpdir writable inside the sandbox: the case the trailing ro-bind
@@ -266,13 +264,13 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
         timeout: 60000,
         cwd: BASE,
       })
-      expect(run.stderr ?? '').not.toMatch(/--args|Exceeded maximum/)
       expect(run.status).toBe(0)
-      const lines = run.stdout.trim().split('\n')
-      expect(lines[0]).toBe('MASKED') // the mask from the file applied
-      expect(readFileSync(files[0]!, 'utf8')).toBe('secret\n') // host intact
-      expect(lines[1]).toBe('FD9_CLOSED')
-      expect(lines[2]).toBe('ARGS_READONLY')
+      expect(run.stdout.trim().split('\n')).toEqual([
+        'MASKED',
+        'FD9_CLOSED',
+        'ARGS_READONLY',
+      ])
+      expect(readFileSync(files[0]!, 'utf8')).toBe('secret\n')
       expect(existsSync(probe)).toBe(false)
       // Unlinked by the spawn itself.
       expect(existsSync(argsFile)).toBe(false)

From edfda8eb64572aeb349745be2cb08e248ff2a87b Mon Sep 17 00:00:00 2001
From: Ron Leizrowice <ronleizrowice@anthropic.com>
Date: Thu, 10 Sep 2026 02:49:11 +0000
Subject: [PATCH 08/12] fix(linux): create the --args directory once, keep the
 rendering a simple command, and refuse what bwrap cannot run

The directory is created before the first sandbox is wrapped and never a
second time. A sandbox wrapped earlier would lack a new directory's bind,
and the library cannot tell whether it is still running: reset() does not
end sandboxes and the active count is only as exact as its caller, so the
latch that waited for the count to drain could be cleared by reset(),
skipped when reset() came first, or left set for good by the wrap's own
catch. Now the directory is identified by device, inode, owner and mode
(a same-path replacement was accepted by existsSync), and once it cannot
be created or is found removed or replaced, profiles stop binding it and
an over-long one is refused, with the reason, until the process restarts.
A profile that fits no longer fails because tmpdir is unusable.

The directory is bound by its resolved path, since bwrap before 0.12
cannot follow an absolute symlink in a bind destination, and its name
starts with a dot, so `rm -rf "$TMPDIR"/*` inside a sandbox does not trip
on the mount point. The bind is pushed at the call site;
generateFilesystemArgs is as it was.

Past the cap the string was a brace group that exec'd the caller's shell:
a prefix was a syntax error, a suffix was skipped, csh could not run it,
and `command rm` was looked up in PATH by the unsandboxed shell. It is now
`/bin/sh -c '<open, unlink, exec>' srt-args <file> bwrap ...`, a simple
command like the inline form, with rm from /usr/bin or /bin. Only the
mounts go to the file, which is readable in the process's other
sandboxes; the environment and the command stay on the line, with
`--args` at the mounts' position.

The cap is 32 pages, read from AT_PAGESZ, so a 64 KiB-page kernel keeps
its 2 MiB, and the switch leaves 4 KiB for a prefix of the caller's own.
A command too long for one argument by itself, a profile past bwrap's
9000 arguments, and a mount path containing NUL (which bwrap would split
into several options) fail at wrap time with an error, before a file is
written.

Tests: every case fails on the previous commit. Process-wide state (a
replaced directory, one that vanishes mid-wrap, an unusable or symlinked
tmpdir) runs in a fresh process; the end-to-end case runs the string
between `timeout 60` and `&& echo AFTER`. The bwrap capability probe
moves to test/helpers.
---
 src/sandbox/linux-sandbox-utils.ts         | 274 ++++++++++++-----
 test/helpers/bwrap.ts                      |  29 ++
 test/sandbox/linux-bwrap-args-file.test.ts | 328 ++++++++++++++-------
 3 files changed, 452 insertions(+), 179 deletions(-)
 create mode 100644 test/helpers/bwrap.ts

diff --git a/src/sandbox/linux-sandbox-utils.ts b/src/sandbox/linux-sandbox-utils.ts
index 4d179600b..d8daf42a9 100644
--- a/src/sandbox/linux-sandbox-utils.ts
+++ b/src/sandbox/linux-sandbox-utils.ts
@@ -5,7 +5,7 @@ import { randomBytes } from 'node:crypto'
 import * as fs from 'fs'
 import { spawn } from 'node:child_process'
 import type { ChildProcess } from 'node:child_process'
-import { tmpdir } from 'node:os'
+import { endianness, tmpdir } from 'node:os'
 import path, { join } from 'node:path'
 import { ripGrep } from '../utils/ripgrep.js'
 import { buildJavaToolOptions } from './java-proxy-agent.js'
@@ -442,10 +442,48 @@ function capabilityArgs(usesSeccompHelper: boolean): string[] {
 }
 
 /**
- * Size at which the profile moves to a `--args` file: Linux's per-argument
- * cap (MAX_ARG_STRLEN, 32 pages) on a 4 KiB-page kernel, the smallest there is.
+ * Linux's per-argument cap, MAX_ARG_STRLEN: 32 pages, so 128 KiB on most
+ * kernels and up to 2 MiB with 64 KiB pages. The page size is AT_PAGESZ in
+ * /proc/self/auxv (pairs of native words); 4 KiB, the smallest, if unreadable.
  */
-const LINUX_MAX_ARG_STRLEN = 128 * 1024
+let linuxMaxArgStrlen: number | undefined
+function maxArgStrlen(): number {
+  if (linuxMaxArgStrlen === undefined) {
+    const AT_PAGESZ = 6
+    let pageSize = 4096
+    try {
+      const auxv = fs.readFileSync('/proc/self/auxv')
+      const wordBytes = /64|s390x/.test(process.arch) ? 8 : 4
+      // Buffer reads at most 6 bytes as a number; no value needed here is wider.
+      const low = Math.min(wordBytes, 6)
+      const word = (at: number): number =>
+        endianness() === 'BE'
+          ? auxv.readUIntBE(at + wordBytes - low, low)
+          : auxv.readUIntLE(at, low)
+      for (let at = 0; at + 2 * wordBytes <= auxv.length; at += 2 * wordBytes) {
+        if (word(at) === AT_PAGESZ) {
+          pageSize = word(at + wordBytes)
+          break
+        }
+      }
+    } catch {
+      // No /proc: the smallest page size only moves a profile to the file
+      // sooner than it had to.
+    }
+    linuxMaxArgStrlen = 32 * pageSize
+  }
+  return linuxMaxArgStrlen
+}
+
+/**
+ * Room left below the cap when deciding whether the profile stays on the
+ * command line: the embedder may put a prefix of its own (`exec`, `cd x &&`,
+ * an assignment) in the same argument.
+ */
+const ARG_HEADROOM_BYTES = 4096
+
+/** bwrap's cap on parsed words, the command line and `--args` file together. */
+const BWRAP_MAX_ARGS = 9000
 
 /**
  * The fd the `--args` file is opened on: a single digit, since dash rejects
@@ -455,97 +493,188 @@ const LINUX_MAX_ARG_STRLEN = 128 * 1024
 const BWRAP_ARGS_FD = 9
 
 /**
- * Per-process directory for `--args` files. INVARIANT: every profile this
- * process generates ro-binds it (generateFilesystemArgs), so no sandbox it
- * launched can rewrite a profile bwrap has yet to read. Removed at exit, not
- * at reset(): a sandbox launched before a reset may still have it bound.
- */
-let bwrapArgsDir: string | undefined
-/**
- * The directory was re-created while an earlier sandbox, which never bound
- * the new one, may still be running. Cleared once no sandbox is active.
+ * The directory `--args` files are written to, or why there is none.
+ *
+ * INVARIANT: the directory is created before this process wraps its first
+ * sandbox and every profile ro-binds it, so no sandbox the process launched
+ * can rewrite a profile bwrap has yet to read. It is never created a second
+ * time: a sandbox wrapped earlier would lack the new one's bind, and the
+ * library cannot tell whether that sandbox is still running (reset() does
+ * not end sandboxes, and cleanupBwrapMountPoints() is only as exact as its
+ * caller). So once the directory cannot be created, or is found removed or
+ * replaced, profiles stop binding it and an over-long one is refused until
+ * the process restarts. Removed at exit, not at reset().
  */
-let bwrapArgsDirUnboundInLiveSandbox = false
+type BwrapArgsDir =
+  | { kind: 'dir'; path: string; identity: string }
+  | { kind: 'unavailable'; why: string }
+let bwrapArgsDir: BwrapArgsDir | undefined
 const bwrapArgsFiles: Set<string> = new Set()
 let bwrapArgsFileCount = 0
 
-function ensureBwrapArgsDir(): string {
-  if (bwrapArgsDir !== undefined && fs.existsSync(bwrapArgsDir)) {
-    return bwrapArgsDir
-  }
-  // Removed under us (an age-based clean of os.tmpdir()). Profiles that fit
-  // the command line only bind the directory, so a fresh one keeps them
-  // starting; writing a file into it is what renderBwrapInvocation refuses
-  // while the flag is set. The count includes the wrap in progress.
-  if (bwrapArgsDir !== undefined && activeSandboxCount > 1) {
-    bwrapArgsDirUnboundInLiveSandbox = true
+function directoryIdentity(dir: string): string {
+  const { dev, ino, uid, mode } = fs.statSync(dir)
+  return `${dev}:${ino}:${uid}:${mode}`
+}
+
+/** bwrapArgsDir, created on the first call and checked on every later one. */
+function checkedBwrapArgsDir(): BwrapArgsDir {
+  if (bwrapArgsDir === undefined) {
+    try {
+      // Dot-prefixed: the bind is a mount point the sandbox cannot delete,
+      // and `rm -rf "$TMPDIR"/*` in a sandboxed build step should not trip
+      // on it. Resolved: bwrap before 0.12 cannot follow an absolute
+      // symlink (/tmp -> /scratch/tmp) in a bind destination.
+      const dir = fs.realpathSync(
+        fs.mkdtempSync(path.join(tmpdir(), '.srt-bwrap-args-')),
+      )
+      bwrapArgsDir = {
+        kind: 'dir',
+        path: dir,
+        identity: directoryIdentity(dir),
+      }
+      registerExitCleanupHandler()
+    } catch (error) {
+      bwrapArgsDir = {
+        kind: 'unavailable',
+        why: `it could not be created under ${tmpdir()} (${error instanceof Error ? error.message : String(error)})`,
+      }
+    }
+  } else if (bwrapArgsDir.kind === 'dir') {
+    let found: string | undefined
+    try {
+      found = directoryIdentity(bwrapArgsDir.path)
+    } catch {
+      // Gone, or no longer reachable: the same as replaced.
+    }
+    if (found !== bwrapArgsDir.identity) {
+      bwrapArgsDir = {
+        kind: 'unavailable',
+        why: `${bwrapArgsDir.path} was removed or replaced after this process created it`,
+      }
+    }
   }
-  bwrapArgsDir = fs.mkdtempSync(path.join(tmpdir(), 'srt-bwrap-args-'))
-  registerExitCleanupHandler()
   return bwrapArgsDir
 }
 
+/** `rm` at a fixed system location, never from PATH; undefined if absent. */
+let systemRm: string | null | undefined
+function systemRmPath(): string | undefined {
+  if (systemRm === undefined) {
+    systemRm =
+      ['/usr/bin/rm', '/bin/rm'].find(candidate => {
+        try {
+          fs.accessSync(candidate, fs.constants.X_OK)
+          return true
+        } catch {
+          return false
+        }
+      }) ?? null
+  }
+  return systemRm ?? undefined
+}
+
 /**
- * The shell string that runs bwrap with `bwrapArgs`; the words from
- * `trailerStart` on are the `-- <shell> -c <command>` trailer. The caller
- * runs it as the one argument of `sh -c`, so past the per-argument cap the
- * options go through `--args` from a file under `argsDir` and only the
- * trailer stays on the line (a command that alone exceeds the kernel's cap
- * still fails at spawn). Throws when the file cannot be written safely.
+ * The shell string that runs bwrap with `bwrapArgs`, which the caller runs
+ * as one argument of `sh -c`. When that would not fit the kernel's
+ * per-argument cap, the words in `mounts` (a slice of `bwrapArgs`) are
+ * written NUL-separated to a file and bwrap reads them through `--args` at
+ * the same position. Every other word, the per-command environment and the
+ * command among them, stays on the line, because the file is readable in
+ * every sandbox of this process. The result stays a simple command, so a
+ * prefix (`exec`, `timeout 30`) or a suffix (`&& next`) still composes.
+ * Throws when the profile cannot run: too many words for bwrap, no usable
+ * directory for the file, or a line too long even without the mounts.
  */
 function renderBwrapInvocation(
   bwrapBinary: string,
   bwrapArgs: string[],
-  trailerStart: number,
-  argsDir: string,
+  mounts: { start: number; end: number },
+  argsDir: BwrapArgsDir,
 ): string {
+  if (bwrapArgs.length > BWRAP_MAX_ARGS) {
+    throw new Error(
+      `Sandbox profile has ${bwrapArgs.length} bwrap arguments and bwrap accepts at most ${BWRAP_MAX_ARGS} (about ${BWRAP_MAX_ARGS / 3} mounts); reduce the number of paths the configuration expands to`,
+    )
+  }
   const inline = quote([bwrapBinary, ...bwrapArgs])
   const inlineBytes = Buffer.byteLength(inline, 'utf8')
-  if (inlineBytes + 1 <= LINUX_MAX_ARG_STRLEN) {
+  const limit = maxArgStrlen() - 1
+  if (inlineBytes <= limit - ARG_HEADROOM_BYTES) {
     return inline
   }
-  if (bwrapArgsDirUnboundInLiveSandbox) {
+
+  const tooLong = `Sandbox profile is too long for the command line (${inlineBytes} bytes; past ${limit - ARG_HEADROOM_BYTES} it goes through a file)`
+  // `--args <fd>` are two more words.
+  if (bwrapArgs.length + 2 > BWRAP_MAX_ARGS) {
     throw new Error(
-      `Sandbox profile is too long for one shell argument (${inlineBytes} bytes) and cannot be passed through a file yet: ${argsDir} replaced a directory that was removed while an earlier sandboxed command, which does not have the new one read-only, may still be running. Retry once earlier sandboxed commands have finished.`,
+      `${tooLong} and, passed through a file, would exceed the ${BWRAP_MAX_ARGS} arguments bwrap accepts`,
+    )
+  }
+  if (argsDir.kind === 'unavailable') {
+    throw new Error(
+      `${tooLong} and cannot be passed through a file until this process restarts: ${argsDir.why}`,
+    )
+  }
+  const mountWords = bwrapArgs.slice(mounts.start, mounts.end)
+  if (mountWords.some(word => word.includes('\0'))) {
+    // bwrap splits the file on NUL: the word would become several options.
+    throw new Error(
+      `${tooLong} and contains a path with a NUL byte, which a file of bwrap arguments cannot carry`,
     )
   }
   const argsFile = path.join(
-    argsDir,
+    argsDir.path,
     `args-${process.pid}-${++bwrapArgsFileCount}`,
   )
+  // /bin/sh opens the file on the fd, unlinks it at once (bwrap reads the
+  // open fd) and execs bwrap, so a file lives only from the wrap to the
+  // spawn; one never spawned goes at cleanup.
+  const rm = systemRmPath()
+  const viaArgsFile = quote([
+    '/bin/sh',
+    '-c',
+    `exec ${BWRAP_ARGS_FD}<"$1" && ${rm === undefined ? '' : `${rm} -f -- "$1" && `}shift && exec "$@"`,
+    'srt-args',
+    argsFile,
+    bwrapBinary,
+    ...bwrapArgs.slice(0, mounts.start),
+    '--args',
+    String(BWRAP_ARGS_FD),
+    ...bwrapArgs.slice(mounts.end),
+  ])
+  const viaArgsFileBytes = Buffer.byteLength(viaArgsFile, 'utf8')
+  if (viaArgsFileBytes > limit) {
+    throw new Error(
+      `Sandboxed command is too long for one shell argument even with the mounts passed through a file (${viaArgsFileBytes} bytes; the limit here is ${limit})`,
+    )
+  }
   // Tracked before the write, so a failed write is cleaned up as well.
   bwrapArgsFiles.add(argsFile)
-  fs.writeFileSync(
-    argsFile,
-    bwrapArgs
-      .slice(0, trailerStart)
-      .map(arg => arg + '\0')
-      .join(''),
-    { mode: 0o600, flag: 'wx' },
-  )
+  try {
+    fs.writeFileSync(argsFile, mountWords.map(word => word + '\0').join(''), {
+      mode: 0o600,
+      flag: 'wx',
+    })
+  } catch (error) {
+    bwrapArgsDir = {
+      kind: 'unavailable',
+      why: `writing ${argsFile} failed (${error instanceof Error ? error.message : String(error)})`,
+    }
+    throw new Error(
+      `${tooLong} and cannot be passed through a file until this process restarts: ${bwrapArgsDir.why}`,
+    )
+  }
   logForDebugging(
-    `[Sandbox Linux] bwrap options moved to ${argsFile} (fd ${BWRAP_ARGS_FD}): the command line would be ${inlineBytes} bytes as one argument`,
-  )
-  // The redirect opens the file before the group runs and rm unlinks it at
-  // once (bwrap reads the open fd), so a file lives only from the wrap to
-  // the spawn. `command` bypasses an rm alias or function of the embedder's
-  // shell (zsh reads .zshenv for -c).
-  return (
-    `{ command rm -f -- ${quote([argsFile])}; exec ` +
-    quote([
-      bwrapBinary,
-      '--args',
-      String(BWRAP_ARGS_FD),
-      ...bwrapArgs.slice(trailerStart),
-    ]) +
-    `; } ${BWRAP_ARGS_FD}<${quote([argsFile])}`
+    `[Sandbox Linux] bwrap mounts moved to ${argsFile} (fd ${BWRAP_ARGS_FD}): the command line would be ${inlineBytes} bytes as one argument`,
   )
+  return viaArgsFile
 }
 
 function removeBwrapArgsDir(): void {
-  if (bwrapArgsDir === undefined) return
+  if (bwrapArgsDir?.kind !== 'dir') return
   try {
-    fs.rmSync(bwrapArgsDir, { recursive: true, force: true })
+    fs.rmSync(bwrapArgsDir.path, { recursive: true, force: true })
   } catch {
     // Unremovable: nothing left to do at exit.
   }
@@ -651,7 +780,6 @@ export function cleanupBwrapMountPoints(opts?: { force?: boolean }): void {
     }
   }
   bwrapArgsFiles.clear()
-  bwrapArgsDirUnboundInLiveSandbox = false
 }
 
 /**
@@ -1075,7 +1203,6 @@ async function generateFilesystemArgs(
   writeConfig: FsWriteRestrictionConfig | undefined,
   maskedFileBinds: Array<{ realPath: string; fakePath: string }> | undefined,
   maskedFileStoreDir: string | undefined,
-  argsDir: string,
   ripgrepConfig: { command: string; args?: string[] } = { command: 'rg' },
   mandatoryDenySearchDepth: number = DEFAULT_MANDATORY_DENY_SEARCH_DEPTH,
   allowGitConfig = false,
@@ -1844,9 +1971,6 @@ async function generateFilesystemArgs(
   if (maskedFileStoreDir !== undefined) {
     args.push('--ro-bind', maskedFileStoreDir, maskedFileStoreDir)
   }
-  // Lands even beneath a denyRead tmpfs over tmpdir, so another command's
-  // profile is readable there between its wrap and its spawn.
-  args.push('--ro-bind', argsDir, argsDir)
 
   return args
 }
@@ -1968,8 +2092,6 @@ export async function wrapCommandWithSandboxLinux(
   let applySeccompPrefix: string | undefined
 
   try {
-    // Inside the try, so a failure gives the count back.
-    const argsDir = ensureBwrapArgsDir()
     // ========== SECCOMP FILTER (Unix Socket Blocking) ==========
     // apply-seccomp wraps the workload and applies the baked-in BPF filter
     // that blocks socket(AF_UNIX, ...). Skipped when allowAllUnixSockets is true.
@@ -2143,13 +2265,20 @@ export async function wrapCommandWithSandboxLinux(
       writeConfig,
       maskedFileBinds,
       maskedFileStoreDir,
-      argsDir,
       ripgrepConfig,
       mandatoryDenySearchDepth,
       allowGitConfig,
       abortSignal,
     )
+    const mountsStart = bwrapArgs.length
     bwrapArgs.push(...fsArgs)
+    const argsDir = checkedBwrapArgsDir()
+    if (argsDir.kind === 'dir') {
+      // Last of the binds, so it lands over an allowWrite of tmpdir (and
+      // beneath a denyRead tmpfs over it: a pending file is readable).
+      bwrapArgs.push('--ro-bind', argsDir.path, argsDir.path)
+    }
+    const mounts = { start: mountsStart, end: bwrapArgs.length }
 
     // Always bind /dev
     bwrapArgs.push('--dev', '/dev')
@@ -2200,7 +2329,6 @@ export async function wrapCommandWithSandboxLinux(
     if (!shell) {
       throw new Error(`Shell '${shellName}' not found in PATH`)
     }
-    const trailerStart = bwrapArgs.length
     bwrapArgs.push('--', shell, '-c')
 
     // With network restrictions, route the command through buildSandboxCommand
@@ -2226,7 +2354,7 @@ export async function wrapCommandWithSandboxLinux(
     const wrappedCommand = renderBwrapInvocation(
       bwrapPath ?? 'bwrap',
       bwrapArgs,
-      trailerStart,
+      mounts,
       argsDir,
     )
 
diff --git a/test/helpers/bwrap.ts b/test/helpers/bwrap.ts
new file mode 100644
index 000000000..6b891137d
--- /dev/null
+++ b/test/helpers/bwrap.ts
@@ -0,0 +1,29 @@
+import { spawnSync } from 'node:child_process'
+
+/**
+ * Whether bwrap can run the namespace/proc surface the wrapped commands use
+ * (--unshare-pid, --unshare-user, --proc): a bare --ro-bind probe passes on
+ * hosts where mounting a fresh /proc in the new PID namespace still EPERMs.
+ * No --unshare-net, so a netns-restricted host does not skip tests that
+ * never create one.
+ */
+export function bwrapCanNamespace(): boolean {
+  return (
+    spawnSync(
+      'bwrap',
+      [
+        '--unshare-pid',
+        '--unshare-user',
+        '--cap-drop',
+        'ALL',
+        '--ro-bind',
+        '/',
+        '/',
+        '--proc',
+        '/proc',
+        'true',
+      ],
+      { timeout: 5000 },
+    ).status === 0
+  )
+}
diff --git a/test/sandbox/linux-bwrap-args-file.test.ts b/test/sandbox/linux-bwrap-args-file.test.ts
index fc1f5e19b..dc0efba4f 100644
--- a/test/sandbox/linux-bwrap-args-file.test.ts
+++ b/test/sandbox/linux-bwrap-args-file.test.ts
@@ -3,53 +3,51 @@ import {
   existsSync,
   mkdirSync,
   mkdtempSync,
+  readdirSync,
   readFileSync,
   realpathSync,
   rmSync,
+  symlinkSync,
   writeFileSync,
 } from 'node:fs'
 import { spawnSync } from 'node:child_process'
 import { tmpdir } from 'node:os'
-import { dirname, join } from 'node:path'
+import { basename, dirname, join } from 'node:path'
 import {
   wrapCommandWithSandboxLinux,
   cleanupBwrapMountPoints,
 } from '../../src/sandbox/linux-sandbox-utils.js'
 import { isLinux } from '../helpers/platform.js'
+import { bwrapCanNamespace } from '../helpers/bwrap.js'
 
 /**
- * A bwrap profile too large for one shell argument (128 KiB on a 4 KiB-page
- * kernel) is handed to bwrap through `--args` from a file in a per-process
- * directory that every profile ro-binds over itself; a profile that fits
- * stays on the command line.
+ * A bwrap profile too large for one shell argument (32 pages) has its mounts
+ * handed to bwrap through `--args` from a file in a per-process directory
+ * that every profile ro-binds over itself; a profile that fits stays on the
+ * command line.
  */
 describe.if(isLinux)('bwrap --args for over-long profiles', () => {
-  const MAX_ARG_STRLEN = 128 * 1024
-  const VIA_ARGS_FILE = /^\{ command rm -f -- (\S+); exec bwrap --args 9 -- /
+  const MAX_ARG_STRLEN =
+    32 * Number(spawnSync('getconf', ['PAGESIZE'], { encoding: 'utf8' }).stdout)
+  // The largest rendering kept on the command line: the kernel's limit less
+  // the NUL, less the 4 KiB left for a prefix of the caller's own.
+  const INLINE_MAX = MAX_ARG_STRLEN - 1 - 4096
+  // The one rendered shape: file, then the options left before and the words
+  // left after `--args 9`.
+  const VIA_ARGS_FILE =
+    /^\/bin\/sh -c 'exec 9<"\$1" && (?:\/\S+ -f -- "\$1" && )?shift && exec "\$@"' srt-args (\S+) bwrap (.*?) ?--args 9 (.*)$/s
+  const MODULE = join(
+    import.meta.dir,
+    '../../src/sandbox/linux-sandbox-utils.ts',
+  )
 
   let BASE: string
   const savedCwd = process.cwd()
-
-  // Only where bwrap can create the user and pid namespaces and mount /proc.
-  const BWRAP_CAN_NAMESPACE =
-    spawnSync(
-      'bwrap',
-      [
-        '--unshare-pid',
-        '--unshare-user',
-        '--cap-drop',
-        'ALL',
-        '--ro-bind',
-        '/',
-        '/',
-        '--proc',
-        '/proc',
-        'true',
-      ],
-      { timeout: 5000 },
-    ).status === 0
+  const BWRAP_CAN_NAMESPACE = bwrapCanNamespace()
 
   beforeEach(() => {
+    // Other suites wrap without cleaning up, and the active count is shared.
+    cleanupBwrapMountPoints({ force: true })
     BASE = realpathSync(mkdtempSync(join(tmpdir(), 'bwrap-args-')))
     // cwd outside the write allowlist keeps the mandatory-deny scan from
     // adding mounts of its own.
@@ -62,17 +60,15 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
     rmSync(BASE, { recursive: true, force: true })
   })
 
-  // `count` files, each its own /dev/null mask, as the concrete list the
-  // wrapper takes (glob expansion happens a layer up, in SandboxManager).
-  function flatFiles(
-    count: number,
-    stem = 'a-reasonably-long-file-name-to-fill-the-profile-',
-  ): string[] {
+  // `count` files with names near the 255-byte limit, each its own /dev/null
+  // mask, as the concrete list the wrapper takes (glob expansion happens a
+  // layer up, in SandboxManager).
+  function maskedFiles(count: number): string[] {
     const dir = join(BASE, 'many')
     mkdirSync(dir, { recursive: true })
     const files: string[] = []
     for (let i = 0; i < count; i++) {
-      const file = join(dir, `${stem}${i}.log`)
+      const file = join(dir, `${'a'.repeat(240)}-${i}.log`)
       // Content, so the e2e case can tell the host file was left alone.
       writeFileSync(file, 'secret\n')
       files.push(file)
@@ -80,15 +76,18 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
     return files
   }
 
-  // 2000 masks of ~80 bytes each: well past 128 KiB as one argument.
-  const overLongProfile = (): string[] => flatFiles(2000)
+  // Each mask renders as about 300 bytes: comfortably past the cap.
+  const overLongProfile = (): string[] =>
+    maskedFiles(Math.ceil(MAX_ARG_STRLEN / 300) + 50)
 
   async function wrap(
     files: string[],
     opts: {
       command?: string
       allowOnly?: string[]
+      denyWithinAllow?: string[]
       setEnvVars?: Record<string, string>
+      unsetEnvVars?: string[]
       mandatoryDenySearchDepth?: number
     } = {},
   ): Promise<string> {
@@ -96,29 +95,76 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
       command: opts.command ?? 'echo hello',
       needsNetworkRestriction: false,
       readConfig: { denyOnly: files },
-      writeConfig: { allowOnly: opts.allowOnly ?? [], denyWithinAllow: [] },
+      writeConfig: {
+        allowOnly: opts.allowOnly ?? [],
+        denyWithinAllow: opts.denyWithinAllow ?? [],
+      },
       setEnvVars: opts.setEnvVars,
+      unsetEnvVars: opts.unsetEnvVars,
       mandatoryDenySearchDepth: opts.mandatoryDenySearchDepth,
     })
   }
 
+  function rejection(wrapping: Promise<string>): Promise<string> {
+    return wrapping.then(
+      () => 'resolved',
+      (error: unknown) => String(error),
+    )
+  }
+
   // The per-process --args directory, from the trailing ro-bind every
   // profile that fits the command line carries (an over-long profile
   // carries it inside the file).
   function argsDirOf(wrapped: string): string {
-    const bind = wrapped.match(/--ro-bind (\S*srt-bwrap-args-\S+) \1(?: |$)/)
+    const bind = wrapped.match(/--ro-bind (\S*\.srt-bwrap-args-\S+) \1(?: |$)/)
     expect(bind).not.toBeNull()
     return bind![1]!
   }
 
   function argsFileOf(wrapped: string): string {
-    const redirect = wrapped.match(/ 9<(\S+)$/)
-    expect(redirect).not.toBeNull()
-    return redirect![1]!
+    const rendered = wrapped.match(VIA_ARGS_FILE)
+    expect(rendered).not.toBeNull()
+    return rendered![1]!
+  }
+
+  // A fresh process for what depends on the module's per-process state (the
+  // directory is created once and never again) or on TMPDIR at first use.
+  // `body` runs after the prelude and prints one JSON value.
+  function isolated(body: string, env: Record<string, string> = {}): unknown {
+    const files = overLongProfile()
+    const script = `
+      import { wrapCommandWithSandboxLinux, cleanupBwrapMountPoints } from ${JSON.stringify(MODULE)}
+      import * as fs from 'node:fs'
+      const overLong = ${JSON.stringify(files)}
+      const small = overLong.slice(0, 1)
+      const wrap = denyOnly => wrapCommandWithSandboxLinux({
+        command: 'echo hello',
+        needsNetworkRestriction: false,
+        readConfig: { denyOnly },
+        writeConfig: { allowOnly: [], denyWithinAllow: [] },
+      })
+      const outcome = wrapping => wrapping.then(() => 'resolved', error => String(error))
+      const argsDirOf = wrapped => wrapped.match(/--ro-bind (\\S*\\.srt-bwrap-args-\\S+) \\1(?: |$)/)?.[1]
+      ${body}
+    `
+    // A file, not `-e`: the script names every fixture path, and would not
+    // fit one argument itself.
+    const scriptFile = join(BASE, 'isolated.ts')
+    writeFileSync(scriptFile, script)
+    // A tmpdir of its own, so what a scenario leaves there goes with BASE.
+    mkdirSync(join(BASE, 'tmp'), { recursive: true })
+    const run = spawnSync(process.execPath, ['run', scriptFile], {
+      cwd: BASE,
+      encoding: 'utf8',
+      env: { ...process.env, TMPDIR: join(BASE, 'tmp'), ...env },
+      timeout: 60000,
+    })
+    expect(run.stderr).toBe('')
+    return JSON.parse(run.stdout)
   }
 
   it('keeps a profile that fits on the command line and still ro-binds the --args directory last', async () => {
-    const files = flatFiles(20)
+    const files = maskedFiles(20)
     const wrapped = await wrap(files)
     expect(wrapped).not.toContain('--args')
     expect(wrapped).toContain(`--ro-bind /dev/null ${files[0]}`)
@@ -130,47 +176,42 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
     expect(wrapped.lastIndexOf(`--ro-bind ${argsDir} ${argsDir}`)).toBe(
       wrapped.lastIndexOf('--ro-bind'),
     )
+    // Dot-prefixed, so a sandboxed `rm -rf "$TMPDIR"/*` does not trip on the
+    // mount point.
+    expect(basename(argsDir).startsWith('.')).toBe(true)
   })
 
-  it('moves every option, and only the options, to a NUL-separated file the string opens on fd 9 and unlinks', async () => {
+  it('moves the mounts, and only the mounts, to a NUL-separated file and stays a simple command', async () => {
     const files = overLongProfile()
     const wrapped = await wrap(files, {
       setEnvVars: { SRT_TEST_VAR: "value with spaces and 'quotes'" },
     })
 
     expect(Buffer.byteLength(wrapped)).toBeLessThan(MAX_ARG_STRLEN)
-    // `--args 9` is followed at once by the trailer: no option is left on
-    // the line.
-    expect(wrapped).toMatch(
-      /^\{ command rm -f -- \S+; exec bwrap --args 9 -- \S+ -c .+; \} 9<\S+$/s,
-    )
-    const argsFile = argsFileOf(wrapped)
-    expect(wrapped.match(VIA_ARGS_FILE)![1]).toBe(argsFile)
-    const argsDir = dirname(argsFile)
-    expect(argsDir).toMatch(/srt-bwrap-args-/)
+    const [, argsFile, before, after] = wrapped.match(VIA_ARGS_FILE)!
+    const argsDir = dirname(argsFile!)
+    expect(basename(argsDir)).toMatch(/^\.srt-bwrap-args-/)
 
-    const words = readFileSync(argsFile, 'utf8').split('\0')
+    const words = readFileSync(argsFile!, 'utf8').split('\0')
     expect(words[words.length - 1]).toBe('')
-    const options = words.slice(0, -1)
-    expect(options).not.toContain('--')
-    expect(options).not.toContain('-c')
+    const mounts = words.slice(0, -1)
+    expect(mounts.filter(w => w === '/dev/null').length).toBe(files.length)
+    expect(mounts).toContain(files[0])
+    expect(mounts.slice(-3)).toEqual(['--ro-bind', argsDir, argsDir])
+    // The file is readable in every sandbox of the process: nothing about
+    // the command or its environment goes there.
     expect(
-      options.filter(w => w === '--ro-bind').length,
-    ).toBeGreaterThanOrEqual(files.length)
-    expect(options).toContain(files[0])
-    const lastBind = options.lastIndexOf('--ro-bind')
-    expect(options.slice(lastBind, lastBind + 3)).toEqual([
-      '--ro-bind',
-      argsDir,
-      argsDir,
-    ])
-    // A value bwrap must receive verbatim: one word, unquoted.
-    const setenv = options.indexOf('--setenv')
-    expect(options.slice(setenv, setenv + 3)).toEqual([
-      '--setenv',
-      'SRT_TEST_VAR',
-      "value with spaces and 'quotes'",
-    ])
+      mounts.filter(
+        w => w.startsWith('--') && !/^--(ro-bind|bind|tmpfs)$/.test(w),
+      ),
+    ).toEqual([])
+    expect(before).toContain(
+      `--setenv SRT_TEST_VAR 'value with spaces and '"'"'quotes'"'"''`,
+    )
+    expect(before).toContain('--new-session')
+    expect(before).not.toContain('--ro-bind /dev/null')
+    // What followed the mounts still follows them.
+    expect(after).toMatch(/--unshare-pid .* -- \S+ -c /s)
   })
 
   it('removes a file that was never spawned at cleanup and keeps the directory for the process', async () => {
@@ -183,13 +224,13 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
     expect(existsSync(dirname(argsFile))).toBe(true)
   })
 
-  it('switches to --args exactly where one argument would exceed 128 KiB', async () => {
+  it('switches to the file exactly where one argument would come within 4 KiB of the cap', async () => {
     // The command is the last word on the line; a trailing two-byte
     // character keeps the shell quoter's output constant while every
     // added 'a' adds one byte, so the padding sets the rendered size byte
     // for byte, and a regression to string length (UTF-16 units) would
     // miscount it by one.
-    const files = flatFiles(20)
+    const files = maskedFiles(20)
     const base = await wrap(files, { command: 'é' })
     expect(base).not.toContain('--args')
     const renderedAt = (bytes: number) =>
@@ -197,53 +238,127 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
         command: 'a'.repeat(bytes - Buffer.byteLength(base)) + 'é',
       })
 
-    const fits = await renderedAt(MAX_ARG_STRLEN - 1)
-    expect(Buffer.byteLength(fits)).toBe(MAX_ARG_STRLEN - 1)
+    const fits = await renderedAt(INLINE_MAX)
+    expect(Buffer.byteLength(fits)).toBe(INLINE_MAX)
     expect(fits).not.toContain('--args')
 
-    expect(await renderedAt(MAX_ARG_STRLEN)).toMatch(VIA_ARGS_FILE)
+    expect(await renderedAt(INLINE_MAX + 1)).toMatch(VIA_ARGS_FILE)
+  })
+
+  it('refuses a command that is too long for one argument by itself, and writes no file for it', async () => {
+    const argsDir = argsDirOf(await wrap(maskedFiles(1)))
+    expect(
+      await rejection(
+        wrap(maskedFiles(20), { command: 'a'.repeat(MAX_ARG_STRLEN) }),
+      ),
+    ).toMatch(/too long for one shell argument even with the mounts/)
+    expect(readdirSync(argsDir)).toEqual([])
+  })
+
+  it('refuses a profile past the 9000 arguments bwrap accepts', async () => {
+    const names = Array.from({ length: 4500 }, (_, i) => `V${i}`)
+    expect(
+      await rejection(wrap(maskedFiles(1), { unsetEnvVars: names })),
+    ).toMatch(/bwrap accepts at most 9000/)
+  })
+
+  it('refuses a mount path with a NUL byte, which bwrap would split into several options', async () => {
+    expect(
+      await rejection(
+        wrap(overLongProfile(), {
+          allowOnly: [BASE],
+          denyWithinAllow: [join(BASE, 'x\0--cap-add\0ALL')],
+        }),
+      ),
+    ).toMatch(/NUL byte/)
   })
 
-  it('leaves a command that alone exceeds 128 KiB to the kernel, whose cap grows with the page size', async () => {
-    const wrapped = await wrap(flatFiles(20), {
-      command: 'a'.repeat(MAX_ARG_STRLEN),
+  it('refuses over-long profiles for the rest of the process once the directory has been replaced', () => {
+    const seen = isolated(`
+      const made = argsDirOf(await wrap(small))
+      // Same path, another inode: what a sandbox with the parent writable,
+      // or a tmp cleaner followed by anyone, can arrange.
+      fs.renameSync(made, made + '.aside')
+      fs.mkdirSync(made, { mode: 0o700 })
+      const refused = await outcome(wrap(overLong))
+      const afterRefusal = await wrap(small)
+      cleanupBwrapMountPoints()
+      cleanupBwrapMountPoints({ force: true })
+      console.log(JSON.stringify({
+        refused,
+        planted: fs.readdirSync(made),
+        stillBinds: argsDirOf(afterRefusal) !== undefined,
+        refusedAfterReset: await outcome(wrap(overLong)),
+      }))
+    `)
+    expect(seen).toEqual({
+      refused: expect.stringMatching(
+        /cannot be passed through a file until this process restarts: \S+ was removed or replaced/,
+      ),
+      planted: [],
+      stillBinds: false,
+      refusedAfterReset: expect.stringMatching(/was removed or replaced/),
     })
-    expect(wrapped).toMatch(VIA_ARGS_FILE)
-    expect(Buffer.byteLength(wrapped)).toBeGreaterThan(MAX_ARG_STRLEN)
   })
 
-  it('refuses an over-long profile after the directory was replaced under a sandbox that may still be running', async () => {
-    const removed = argsDirOf(await wrap(flatFiles(1)))
-    rmSync(removed, { recursive: true, force: true })
+  it('says so, rather than ENOENT, when the directory vanishes while a profile is being generated', () => {
+    const seen = isolated(`
+      const made = argsDirOf(await wrap(small))
+      const wrapping = outcome(wrap(overLong))
+      fs.rmSync(made, { recursive: true })
+      console.log(JSON.stringify(await wrapping))
+    `)
+    expect(seen).toMatch(/until this process restarts: \S+ was removed/)
+  })
 
-    const refusal = await wrap(overLongProfile()).then(
-      () => undefined,
-      (err: unknown) => err,
-    )
-    expect(String(refusal)).toMatch(
-      /removed while an earlier sandboxed command/,
+  it('wraps a profile that fits when tmpdir is unusable, and refuses only the over-long one', () => {
+    // A file where the directory should be: not creatable by root either.
+    writeFileSync(join(BASE, 'not-a-directory'), '')
+    const seen = isolated(
+      `
+      const fits = await wrap(small)
+      console.log(JSON.stringify({
+        fits: fits.includes('--ro-bind /dev/null') && !fits.includes('srt-bwrap-args'),
+        refused: await outcome(wrap(overLong)),
+      }))
+    `,
+      { TMPDIR: join(BASE, 'not-a-directory') },
     )
-    // A profile that fits only binds the directory, so it still wraps.
-    const replacement = argsDirOf(await wrap(flatFiles(1)))
-    expect(replacement).not.toBe(removed)
-    expect(existsSync(replacement)).toBe(true)
-
-    // Once no sandbox is active, no sandbox predates the new directory.
-    cleanupBwrapMountPoints({ force: true })
-    const wrapped = await wrap(overLongProfile())
-    expect(dirname(argsFileOf(wrapped))).toBe(replacement)
+    expect(seen).toEqual({
+      fits: true,
+      refused: expect.stringMatching(/it could not be created under \S+/),
+    })
   })
 
   it.if(BWRAP_CAN_NAMESPACE)(
-    'e2e: bwrap applies the profile from the file, and the command sees neither the fd nor a writable --args directory',
+    'e2e: binds the directory by its resolved path, which bwrap before 0.12 needs when tmpdir is behind an absolute symlink',
+    () => {
+      mkdirSync(join(BASE, 'real-tmp'))
+      symlinkSync(join(BASE, 'real-tmp'), join(BASE, 'link-tmp'))
+      const seen = isolated(
+        `
+        const { spawnSync } = await import('node:child_process')
+        const wrapped = await wrap(small)
+        const run = spawnSync(wrapped, { shell: true, encoding: 'utf8' })
+        console.log(JSON.stringify({ argsDir: argsDirOf(wrapped), status: run.status, stdout: run.stdout }))
+      `,
+        { TMPDIR: join(BASE, 'link-tmp') },
+      ) as { argsDir: string; status: number; stdout: string }
+      expect(dirname(seen.argsDir)).toBe(join(BASE, 'real-tmp'))
+      expect(seen).toMatchObject({ status: 0, stdout: 'hello\n' })
+    },
+    60_000,
+  )
+
+  it.if(BWRAP_CAN_NAMESPACE)(
+    'e2e: bwrap applies the mounts from the file, the string composes with a prefix and a suffix, and the command sees neither the fd nor a writable --args directory',
     async () => {
-      const argsDir = argsDirOf(await wrap(flatFiles(1)))
+      const argsDir = argsDirOf(await wrap(maskedFiles(1)))
       const probe = join(argsDir, 'srt-args-probe')
+      const files = overLongProfile()
       // tmpdir writable inside the sandbox: the case the trailing ro-bind
-      // exists for. Fewer, longer-named masks than the shape test: every
-      // mount costs bwrap time, and the runner's tmpdir is scanned shallowly
-      // for the same reason.
-      const files = flatFiles(700, `${'a'.repeat(150)}-`)
+      // exists for. The runner's tmpdir is scanned shallowly, since every
+      // mount costs bwrap time.
       const wrapped = await wrap(files, {
         allowOnly: [tmpdir()],
         mandatoryDenySearchDepth: 1,
@@ -258,7 +373,7 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
       })
       const argsFile = argsFileOf(wrapped)
       expect(dirname(argsFile)).toBe(argsDir)
-      const run = spawnSync(wrapped, {
+      const run = spawnSync(`timeout 60 ${wrapped} && echo AFTER`, {
         shell: true,
         encoding: 'utf8',
         timeout: 60000,
@@ -269,6 +384,7 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
         'MASKED',
         'FD9_CLOSED',
         'ARGS_READONLY',
+        'AFTER',
       ])
       expect(readFileSync(files[0]!, 'utf8')).toBe('secret\n')
       expect(existsSync(probe)).toBe(false)

From fe8791382ef3044cb4275e778b054e656308e91e Mon Sep 17 00:00:00 2001
From: Ron Leizrowice <ronleizrowice@anthropic.com>
Date: Thu, 10 Sep 2026 02:49:11 +0000
Subject: [PATCH 09/12] docs(linux): say what the --args file exposes, when it
 is refused, and what does not protect it

The note now states that a pending file is readable in the process's
other sandboxes, that the directory shows up as an undeletable entry
under a writable tmpdir, that it is created once and an over-long profile
is refused until restart when it is gone, and the two cases the read-only
bind does not cover (another process's sandbox, and a tmpdir below a
writable directory) with what closes them.
---
 README.md | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 6e96163a6..ba5592562 100644
--- a/README.md
+++ b/README.md
@@ -652,7 +652,13 @@ Filesystem restrictions are enforced at the OS level:
 
 **Precedence is intentionally opposite for reads vs writes:** `allowRead` overrides `denyRead`, while `denyWrite` overrides `allowWrite`. This lets you carve out readable regions within denied areas, and carve out protected regions within writable areas.
 
-**Note (Linux, large profiles):** The wrapped string runs as the one argument of `sh -c`, which Linux caps at 32 pages (128 KiB with 4 KiB pages). A profile past 128 KiB reaches bubblewrap through `--args` instead: the string opens a file on fd 9, unlinks it and runs bubblewrap, so it must run unmodified as the whole `sh -c` script under a POSIX `sh`, with fd 9 free. The file sits in a per-process directory under `os.tmpdir()` that every profile of the process binds read-only, so a command it sandboxed cannot rewrite a pending profile; a sandbox started by another `srt` process with tmpdir writable is not covered. If that directory is removed while a sandboxed command is running, an over-long profile is refused until the earlier commands have finished. The command itself must still fit one argument, and bubblewrap parses at most 9000 arguments (about 3000 mounts).
+**Note (Linux, large profiles):** The wrapped string runs as one argument of `sh -c`, which Linux caps at 32 pages (128 KiB with 4 KiB pages). A profile that would not fit, with 4 KiB to spare for a prefix of the caller's own, has its mounts written to a file that bubblewrap reads through `--args`. The string then reads `/bin/sh -c '…' srt-args <file> bwrap … --args 9 …`: still a simple command, which opens the file on fd 9, unlinks it and runs bubblewrap, so it can be run once. The environment and the command stay on the command line; the file holds mount paths only.
+
+- The file sits in a per-process directory, `<os.tmpdir()>/.srt-bwrap-args-*`, that every profile of the process binds read-only over itself, so a command the process sandboxed cannot rewrite a pending profile. It can read one: the mount paths of a command that is wrapped but not yet started are visible to the process's other sandboxes.
+- A sandbox with tmpdir writable sees that directory as an entry it cannot delete. `rm -rf "$TMPDIR"/*` skips it (the name starts with a dot); `find "$TMPDIR" -mindepth 1 -delete` does not.
+- The directory is created once. If it cannot be created, or is later removed or replaced (an age-based tmp cleaner), profiles that fit are unaffected and an over-long one is refused with an error until the process restarts: a sandbox started earlier would not have a new directory read-only, and the library cannot tell whether it is still running.
+- Not covered: a sandbox started by another process of the same user with tmpdir writable never bound this directory, and can swap a pending file so that the command runs with bubblewrap options of its choosing. The same holds when `os.tmpdir()` lies below a directory a sandbox may write (`TMPDIR=/tmp/work` with `/tmp` writable): a sandboxed command can rename that parent and put its own directory at the path. Where profiles can be over-long, keep tmpdir out of `allowWrite`, which closes both, or at least point `TMPDIR` at a directory that is itself an `allowWrite` entry, which closes the second.
+- bubblewrap parses at most 9000 arguments (about 3000 mounts). A profile past that, or a command too long for one argument by itself, fails at wrap time with an error.
 
 ### Mandatory Deny Paths (Auto-Protected Files)
 

From 96f3e9c3b3546cba938303f054ddd3ae9bbc684f Mon Sep 17 00:00:00 2001
From: Ron Leizrowice <ronleizrowice@anthropic.com>
Date: Fri, 11 Sep 2026 17:16:16 +0000
Subject: [PATCH 10/12] fix(linux): pass the --args mounts through an open
 descriptor, not a file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The file the wrapper opened at execution time was reachable by name. A
sandbox that can rename a writable directory above TMPDIR, or one launched
by another process of the same user with that tmpdir writable, could put
its own profile at that name between the wrap and the open: the read-only
bind this process placed on the directory covered neither case, and the
identity check ran at wrap time, before the window it had to cover.

The mounts now go to an unnamed file: O_TMPFILE under os.tmpdir(), or
/dev/shm when that takes none. The process keeps the descriptor open and
the string reopens it through /proc/<pid>/fd/<n>, a fresh read-only
description of the same inode at offset 0. Nothing is named at any point,
so there is nothing to substitute; reaching the descriptor needs the
wrapping process's own /proc entry, and every sandbox this library starts
has --unshare-pid and a fresh --proc /proc, so none of them sees it. That
ends the exposure the directory came with as well — a pending profile was
readable in the process's other sandboxes — along with the bind every
profile carried for it, the identity check, the latch that refused
over-long profiles until restart, and the rm in the wrapper.

When no directory takes an unnamed file, or the profile cannot be opened
again through /proc, an over-long profile is refused at wrap time with the
reason. There is no fallback to a named file: such a profile failed with
E2BIG before any of this existed, so refusing takes nothing away.

Descriptors are released where the files were removed before — when the
last sandbox of a batch is cleaned up, and at exit. A string run after
that fails in the redirection and never reaches the command.
---
 src/sandbox/linux-sandbox-utils.ts | 231 ++++++++++++-----------------
 1 file changed, 97 insertions(+), 134 deletions(-)

diff --git a/src/sandbox/linux-sandbox-utils.ts b/src/sandbox/linux-sandbox-utils.ts
index d8daf42a9..26ac1bce1 100644
--- a/src/sandbox/linux-sandbox-utils.ts
+++ b/src/sandbox/linux-sandbox-utils.ts
@@ -493,104 +493,109 @@ const BWRAP_MAX_ARGS = 9000
 const BWRAP_ARGS_FD = 9
 
 /**
- * The directory `--args` files are written to, or why there is none.
+ * Linux's O_TMPFILE, which neither Node nor Bun exposes in `fs.constants`:
+ * the asm-generic __O_TMPFILE, the value on every architecture they build
+ * for Linux, together with the O_DIRECTORY the flag is defined to carry — a
+ * kernel or filesystem that does not know it therefore fails the open on the
+ * directory rather than creating a named file.
+ */
+const O_TMPFILE = 0o20000000 | fs.constants.O_DIRECTORY
+
+/**
+ * The `--args` profiles this process holds open.
+ *
+ * A profile is an unnamed file (O_TMPFILE): written at wrap time, kept open
+ * here, and opened again by the string bwrap runs through
+ * `/proc/<pid>/fd/<n>`, which is a fresh read-only description of the same
+ * inode at offset 0. Nothing is named at any point, so there is nothing for
+ * anyone to substitute between the wrap and the execution — not a sandbox
+ * that renames an ancestor of tmpdir, not a sandbox another process of the
+ * same user launched with tmpdir writable. Every sandbox this library starts
+ * has its own PID namespace and a fresh /proc, so none of them can reach
+ * /proc/<this pid> either.
  *
- * INVARIANT: the directory is created before this process wraps its first
- * sandbox and every profile ro-binds it, so no sandbox the process launched
- * can rewrite a profile bwrap has yet to read. It is never created a second
- * time: a sandbox wrapped earlier would lack the new one's bind, and the
- * library cannot tell whether that sandbox is still running (reset() does
- * not end sandboxes, and cleanupBwrapMountPoints() is only as exact as its
- * caller). So once the directory cannot be created, or is found removed or
- * replaced, profiles stop binding it and an over-long one is refused until
- * the process restarts. Removed at exit, not at reset().
+ * Fds close when the sandboxes of a batch are cleaned up, and fd numbers are
+ * reused: a string kept past its cleanup and run later opens whatever the
+ * number means by then — nothing (the redirection fails and the command does
+ * not run), something bwrap refuses, or another profile of this process,
+ * never one from outside it.
  */
-type BwrapArgsDir =
-  | { kind: 'dir'; path: string; identity: string }
-  | { kind: 'unavailable'; why: string }
-let bwrapArgsDir: BwrapArgsDir | undefined
-const bwrapArgsFiles: Set<string> = new Set()
-let bwrapArgsFileCount = 0
-
-function directoryIdentity(dir: string): string {
-  const { dev, ino, uid, mode } = fs.statSync(dir)
-  return `${dev}:${ino}:${uid}:${mode}`
+const bwrapArgsFds: Set<number> = new Set()
+
+/** Where the string bwrap runs opens the profile held on `fd`. */
+function bwrapArgsProfilePath(fd: number): string {
+  return `/proc/${process.pid}/fd/${fd}`
 }
 
-/** bwrapArgsDir, created on the first call and checked on every later one. */
-function checkedBwrapArgsDir(): BwrapArgsDir {
-  if (bwrapArgsDir === undefined) {
+/**
+ * Writes `mountWords` NUL-separated to an unnamed file and returns the fd it
+ * stays open on. Throws when no directory takes an O_TMPFILE file, or when
+ * the profile cannot be opened again through /proc: there is no named-file
+ * fallback, and before any of this an over-long profile failed with E2BIG
+ * anyway. The check is this process's own open; a child's can still be
+ * refused (a process made non-dumpable owns its /proc entries as root), and
+ * the string then fails in the redirection and runs no command.
+ */
+function openBwrapArgsProfile(mountWords: string[]): number {
+  const contents = mountWords.map(word => word + '\0').join('')
+  const failures: string[] = []
+  for (const dir of new Set([tmpdir(), '/dev/shm'])) {
+    let fd: number
     try {
-      // Dot-prefixed: the bind is a mount point the sandbox cannot delete,
-      // and `rm -rf "$TMPDIR"/*` in a sandboxed build step should not trip
-      // on it. Resolved: bwrap before 0.12 cannot follow an absolute
-      // symlink (/tmp -> /scratch/tmp) in a bind destination.
-      const dir = fs.realpathSync(
-        fs.mkdtempSync(path.join(tmpdir(), '.srt-bwrap-args-')),
-      )
-      bwrapArgsDir = {
-        kind: 'dir',
-        path: dir,
-        identity: directoryIdentity(dir),
-      }
-      registerExitCleanupHandler()
+      fd = fs.openSync(dir, O_TMPFILE | fs.constants.O_RDWR, 0o600)
     } catch (error) {
-      bwrapArgsDir = {
-        kind: 'unavailable',
-        why: `it could not be created under ${tmpdir()} (${error instanceof Error ? error.message : String(error)})`,
-      }
+      failures.push(`${dir}: ${errorText(error)}`)
+      continue
     }
-  } else if (bwrapArgsDir.kind === 'dir') {
-    let found: string | undefined
     try {
-      found = directoryIdentity(bwrapArgsDir.path)
-    } catch {
-      // Gone, or no longer reachable: the same as replaced.
-    }
-    if (found !== bwrapArgsDir.identity) {
-      bwrapArgsDir = {
-        kind: 'unavailable',
-        why: `${bwrapArgsDir.path} was removed or replaced after this process created it`,
-      }
+      fs.writeFileSync(fd, contents)
+      // Read-only from here: this process is done writing it.
+      fs.fchmodSync(fd, 0o400)
+      // The string opens this path. Fail now, where the caller is told why,
+      // rather than when the command runs.
+      fs.closeSync(fs.openSync(bwrapArgsProfilePath(fd), fs.constants.O_RDONLY))
+    } catch (error) {
+      failures.push(`${dir}: ${errorText(error)}`)
+      fs.closeSync(fd)
+      continue
     }
+    bwrapArgsFds.add(fd)
+    return fd
   }
-  return bwrapArgsDir
+  throw new Error(
+    `no unnamed file could be opened for it (${failures.join('; ')})`,
+  )
 }
 
-/** `rm` at a fixed system location, never from PATH; undefined if absent. */
-let systemRm: string | null | undefined
-function systemRmPath(): string | undefined {
-  if (systemRm === undefined) {
-    systemRm =
-      ['/usr/bin/rm', '/bin/rm'].find(candidate => {
-        try {
-          fs.accessSync(candidate, fs.constants.X_OK)
-          return true
-        } catch {
-          return false
-        }
-      }) ?? null
+function closeBwrapArgsProfile(fd: number): void {
+  bwrapArgsFds.delete(fd)
+  try {
+    fs.closeSync(fd)
+  } catch {
+    // Already closed: nothing left to release.
   }
-  return systemRm ?? undefined
+}
+
+function errorText(error: unknown): string {
+  return error instanceof Error ? error.message : String(error)
 }
 
 /**
  * The shell string that runs bwrap with `bwrapArgs`, which the caller runs
  * as one argument of `sh -c`. When that would not fit the kernel's
- * per-argument cap, the words in `mounts` (a slice of `bwrapArgs`) are
- * written NUL-separated to a file and bwrap reads them through `--args` at
- * the same position. Every other word, the per-command environment and the
- * command among them, stays on the line, because the file is readable in
- * every sandbox of this process. The result stays a simple command, so a
- * prefix (`exec`, `timeout 30`) or a suffix (`&& next`) still composes.
- * Throws when the profile cannot run: too many words for bwrap, no usable
- * directory for the file, or a line too long even without the mounts.
+ * per-argument cap, the words in `mounts` (a slice of `bwrapArgs`) go to an
+ * unnamed file this process holds open (see `bwrapArgsFds`) and bwrap reads
+ * them through `--args` at the same position; the string opens that file
+ * again through /proc. Every other word, the per-command environment and the
+ * command among them, stays on the line. The result stays a simple command,
+ * so a prefix (`exec`, `timeout 30`) or a suffix (`&& next`) still composes.
+ * Throws when the profile cannot run: too many words for bwrap, no unnamed
+ * file to put the mounts in, or a line too long even without them.
  */
 function renderBwrapInvocation(
   bwrapBinary: string,
   bwrapArgs: string[],
   mounts: { start: number; end: number },
-  argsDir: BwrapArgsDir,
 ): string {
   if (bwrapArgs.length > BWRAP_MAX_ARGS) {
     throw new Error(
@@ -611,11 +616,6 @@ function renderBwrapInvocation(
       `${tooLong} and, passed through a file, would exceed the ${BWRAP_MAX_ARGS} arguments bwrap accepts`,
     )
   }
-  if (argsDir.kind === 'unavailable') {
-    throw new Error(
-      `${tooLong} and cannot be passed through a file until this process restarts: ${argsDir.why}`,
-    )
-  }
   const mountWords = bwrapArgs.slice(mounts.start, mounts.end)
   if (mountWords.some(word => word.includes('\0'))) {
     // bwrap splits the file on NUL: the word would become several options.
@@ -623,20 +623,22 @@ function renderBwrapInvocation(
       `${tooLong} and contains a path with a NUL byte, which a file of bwrap arguments cannot carry`,
     )
   }
-  const argsFile = path.join(
-    argsDir.path,
-    `args-${process.pid}-${++bwrapArgsFileCount}`,
-  )
-  // /bin/sh opens the file on the fd, unlinks it at once (bwrap reads the
-  // open fd) and execs bwrap, so a file lives only from the wrap to the
-  // spawn; one never spawned goes at cleanup.
-  const rm = systemRmPath()
+  let argsFd: number
+  try {
+    argsFd = openBwrapArgsProfile(mountWords)
+  } catch (error) {
+    throw new Error(
+      `${tooLong} and cannot be passed through a file: ${errorText(error)}`,
+    )
+  }
+  // /bin/sh opens the profile on the fd and execs bwrap, which reads it to
+  // EOF and closes it before running the command.
   const viaArgsFile = quote([
     '/bin/sh',
     '-c',
-    `exec ${BWRAP_ARGS_FD}<"$1" && ${rm === undefined ? '' : `${rm} -f -- "$1" && `}shift && exec "$@"`,
+    `exec ${BWRAP_ARGS_FD}<"$1" && shift && exec "$@"`,
     'srt-args',
-    argsFile,
+    bwrapArgsProfilePath(argsFd),
     bwrapBinary,
     ...bwrapArgs.slice(0, mounts.start),
     '--args',
@@ -645,42 +647,17 @@ function renderBwrapInvocation(
   ])
   const viaArgsFileBytes = Buffer.byteLength(viaArgsFile, 'utf8')
   if (viaArgsFileBytes > limit) {
+    closeBwrapArgsProfile(argsFd)
     throw new Error(
       `Sandboxed command is too long for one shell argument even with the mounts passed through a file (${viaArgsFileBytes} bytes; the limit here is ${limit})`,
     )
   }
-  // Tracked before the write, so a failed write is cleaned up as well.
-  bwrapArgsFiles.add(argsFile)
-  try {
-    fs.writeFileSync(argsFile, mountWords.map(word => word + '\0').join(''), {
-      mode: 0o600,
-      flag: 'wx',
-    })
-  } catch (error) {
-    bwrapArgsDir = {
-      kind: 'unavailable',
-      why: `writing ${argsFile} failed (${error instanceof Error ? error.message : String(error)})`,
-    }
-    throw new Error(
-      `${tooLong} and cannot be passed through a file until this process restarts: ${bwrapArgsDir.why}`,
-    )
-  }
   logForDebugging(
-    `[Sandbox Linux] bwrap mounts moved to ${argsFile} (fd ${BWRAP_ARGS_FD}): the command line would be ${inlineBytes} bytes as one argument`,
+    `[Sandbox Linux] bwrap mounts moved to an unnamed file, read through ${bwrapArgsProfilePath(argsFd)} on bwrap's fd ${BWRAP_ARGS_FD}: the command line would be ${inlineBytes} bytes as one argument`,
   )
   return viaArgsFile
 }
 
-function removeBwrapArgsDir(): void {
-  if (bwrapArgsDir?.kind !== 'dir') return
-  try {
-    fs.rmSync(bwrapArgsDir.path, { recursive: true, force: true })
-  } catch {
-    // Unremovable: nothing left to do at exit.
-  }
-  bwrapArgsDir = undefined
-}
-
 // Number of wrapped commands that have been generated but whose cleanup has
 // not yet run. cleanupBwrapMountPoints() defers file deletion while this is
 // positive, because deleting a mount point file on the host while another
@@ -700,7 +677,6 @@ function registerExitCleanupHandler(): void {
 
   process.on('exit', () => {
     cleanupBwrapMountPoints({ force: true })
-    removeBwrapArgsDir()
   })
 
   exitHandlerRegistered = true
@@ -727,7 +703,7 @@ function registerExitCleanupHandler(): void {
  * Pass `{ force: true }` to delete unconditionally — used by the process-exit
  * handler and reset() where deferral is not meaningful.
  *
- * Also removes the `--args` files of wraps that were never spawned.
+ * Also closes the `--args` profiles the wraps of this batch opened.
  */
 export function cleanupBwrapMountPoints(opts?: { force?: boolean }): void {
   if (!opts?.force) {
@@ -771,15 +747,9 @@ export function cleanupBwrapMountPoints(opts?: { force?: boolean }): void {
   }
   bwrapMountPoints.clear()
 
-  for (const argsFile of bwrapArgsFiles) {
-    try {
-      fs.rmSync(argsFile, { force: true })
-    } catch {
-      // Unremovable (a permission change under the directory): cleanup
-      // must not throw at the caller.
-    }
+  for (const argsFd of [...bwrapArgsFds]) {
+    closeBwrapArgsProfile(argsFd)
   }
-  bwrapArgsFiles.clear()
 }
 
 /**
@@ -2272,12 +2242,6 @@ export async function wrapCommandWithSandboxLinux(
     )
     const mountsStart = bwrapArgs.length
     bwrapArgs.push(...fsArgs)
-    const argsDir = checkedBwrapArgsDir()
-    if (argsDir.kind === 'dir') {
-      // Last of the binds, so it lands over an allowWrite of tmpdir (and
-      // beneath a denyRead tmpfs over it: a pending file is readable).
-      bwrapArgs.push('--ro-bind', argsDir.path, argsDir.path)
-    }
     const mounts = { start: mountsStart, end: bwrapArgs.length }
 
     // Always bind /dev
@@ -2355,7 +2319,6 @@ export async function wrapCommandWithSandboxLinux(
       bwrapPath ?? 'bwrap',
       bwrapArgs,
       mounts,
-      argsDir,
     )
 
     const restrictions = []

From 4bf05606f976bd186fd219ebeaf9f2d886360029 Mon Sep 17 00:00:00 2001
From: Ron Leizrowice <ronleizrowice@anthropic.com>
Date: Fri, 11 Sep 2026 17:16:17 +0000
Subject: [PATCH 11/12] test: cover the unnamed --args profile
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The case the transport exists for: a wrap in a fresh process whose TMPDIR
sits under a scratch directory, then that directory renamed aside and a
profile binding / read-write planted at every path the string could still
name, then the string run. The sandbox stays under the profile it was
wrapped with — its write is still denied — and the string names only
/proc/<pid>/fd/<n>, with nothing of ours left under TMPDIR.

Also: the wrap-time refusal when neither candidate directory takes an
O_TMPFILE file; one descriptor per pending profile, all of them back at
cleanup and none held by a rendering that was refused; a string run after
its cleanup running no command; and, end to end, a sandboxed command that
reaches neither fd 9 nor the wrapping process's /proc.

Dropped with the directory they pinned: the replaced-directory and
vanishing-directory cases, the file left by a wrap that was never spawned,
the trailing read-only bind, and tmpdir behind an absolute symlink — no
path is bound now, so there is nothing for bubblewrap to resolve.
---
 test/sandbox/linux-bwrap-args-file.test.ts | 259 +++++++++++----------
 1 file changed, 141 insertions(+), 118 deletions(-)

diff --git a/test/sandbox/linux-bwrap-args-file.test.ts b/test/sandbox/linux-bwrap-args-file.test.ts
index dc0efba4f..0cc9dadbf 100644
--- a/test/sandbox/linux-bwrap-args-file.test.ts
+++ b/test/sandbox/linux-bwrap-args-file.test.ts
@@ -3,16 +3,15 @@ import {
   existsSync,
   mkdirSync,
   mkdtempSync,
-  readdirSync,
   readFileSync,
+  readlinkSync,
   realpathSync,
   rmSync,
-  symlinkSync,
   writeFileSync,
 } from 'node:fs'
 import { spawnSync } from 'node:child_process'
 import { tmpdir } from 'node:os'
-import { basename, dirname, join } from 'node:path'
+import { join } from 'node:path'
 import {
   wrapCommandWithSandboxLinux,
   cleanupBwrapMountPoints,
@@ -22,8 +21,8 @@ import { bwrapCanNamespace } from '../helpers/bwrap.js'
 
 /**
  * A bwrap profile too large for one shell argument (32 pages) has its mounts
- * handed to bwrap through `--args` from a file in a per-process directory
- * that every profile ro-binds over itself; a profile that fits stays on the
+ * handed to bwrap through `--args`, from an unnamed file this process holds
+ * open and the string reopens through /proc; a profile that fits stays on the
  * command line.
  */
 describe.if(isLinux)('bwrap --args for over-long profiles', () => {
@@ -32,10 +31,10 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
   // The largest rendering kept on the command line: the kernel's limit less
   // the NUL, less the 4 KiB left for a prefix of the caller's own.
   const INLINE_MAX = MAX_ARG_STRLEN - 1 - 4096
-  // The one rendered shape: file, then the options left before and the words
-  // left after `--args 9`.
+  // The one rendered shape: the profile's path, then the options left before
+  // and the words left after `--args 9`.
   const VIA_ARGS_FILE =
-    /^\/bin\/sh -c 'exec 9<"\$1" && (?:\/\S+ -f -- "\$1" && )?shift && exec "\$@"' srt-args (\S+) bwrap (.*?) ?--args 9 (.*)$/s
+    /^\/bin\/sh -c 'exec 9<"\$1" && shift && exec "\$@"' srt-args (\S+) bwrap (.*?) ?--args 9 (.*)$/s
   const MODULE = join(
     import.meta.dir,
     '../../src/sandbox/linux-sandbox-utils.ts',
@@ -112,39 +111,36 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
     )
   }
 
-  // The per-process --args directory, from the trailing ro-bind every
-  // profile that fits the command line carries (an over-long profile
-  // carries it inside the file).
-  function argsDirOf(wrapped: string): string {
-    const bind = wrapped.match(/--ro-bind (\S*\.srt-bwrap-args-\S+) \1(?: |$)/)
-    expect(bind).not.toBeNull()
-    return bind![1]!
-  }
-
-  function argsFileOf(wrapped: string): string {
+  function argsPathOf(wrapped: string): string {
     const rendered = wrapped.match(VIA_ARGS_FILE)
     expect(rendered).not.toBeNull()
     return rendered![1]!
   }
 
   // A fresh process for what depends on the module's per-process state (the
-  // directory is created once and never again) or on TMPDIR at first use.
-  // `body` runs after the prelude and prints one JSON value.
-  function isolated(body: string, env: Record<string, string> = {}): unknown {
+  // open profiles, the fd baseline) or on TMPDIR at first use. `body` runs
+  // after the prelude and prints one JSON value; `launcher` runs the runtime
+  // itself under something (bwrap, to take away the directories an unnamed
+  // file can go in).
+  function isolated(
+    body: string,
+    env: Record<string, string> = {},
+    launcher: string[] = [],
+  ): unknown {
     const files = overLongProfile()
     const script = `
       import { wrapCommandWithSandboxLinux, cleanupBwrapMountPoints } from ${JSON.stringify(MODULE)}
       import * as fs from 'node:fs'
       const overLong = ${JSON.stringify(files)}
       const small = overLong.slice(0, 1)
-      const wrap = denyOnly => wrapCommandWithSandboxLinux({
-        command: 'echo hello',
+      const wrap = (denyOnly, command = 'echo hello') => wrapCommandWithSandboxLinux({
+        command,
         needsNetworkRestriction: false,
         readConfig: { denyOnly },
         writeConfig: { allowOnly: [], denyWithinAllow: [] },
       })
       const outcome = wrapping => wrapping.then(() => 'resolved', error => String(error))
-      const argsDirOf = wrapped => wrapped.match(/--ro-bind (\\S*\\.srt-bwrap-args-\\S+) \\1(?: |$)/)?.[1]
+      const argsPathOf = wrapped => wrapped.match(/' srt-args (\\S+) /)?.[1]
       ${body}
     `
     // A file, not `-e`: the script names every fixture path, and would not
@@ -153,7 +149,8 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
     writeFileSync(scriptFile, script)
     // A tmpdir of its own, so what a scenario leaves there goes with BASE.
     mkdirSync(join(BASE, 'tmp'), { recursive: true })
-    const run = spawnSync(process.execPath, ['run', scriptFile], {
+    const argv = [...launcher, process.execPath, 'run', scriptFile]
+    const run = spawnSync(argv[0]!, argv.slice(1), {
       cwd: BASE,
       encoding: 'utf8',
       env: { ...process.env, TMPDIR: join(BASE, 'tmp'), ...env },
@@ -163,43 +160,34 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
     return JSON.parse(run.stdout)
   }
 
-  it('keeps a profile that fits on the command line and still ro-binds the --args directory last', async () => {
+  it('keeps a profile that fits on the command line, and names no file for it', async () => {
     const files = maskedFiles(20)
     const wrapped = await wrap(files)
     expect(wrapped).not.toContain('--args')
+    expect(wrapped).not.toContain('srt-args')
     expect(wrapped).toContain(`--ro-bind /dev/null ${files[0]}`)
-    // In every profile, not only the ones that use it: a sandbox launched
-    // with a small profile may still be running when a later over-long one
-    // is written there.
-    const argsDir = argsDirOf(wrapped)
-    expect(existsSync(argsDir)).toBe(true)
-    expect(wrapped.lastIndexOf(`--ro-bind ${argsDir} ${argsDir}`)).toBe(
-      wrapped.lastIndexOf('--ro-bind'),
-    )
-    // Dot-prefixed, so a sandboxed `rm -rf "$TMPDIR"/*` does not trip on the
-    // mount point.
-    expect(basename(argsDir).startsWith('.')).toBe(true)
   })
 
-  it('moves the mounts, and only the mounts, to a NUL-separated file and stays a simple command', async () => {
+  it('moves the mounts, and only the mounts, to an unnamed file the string reopens through /proc', async () => {
     const files = overLongProfile()
     const wrapped = await wrap(files, {
       setEnvVars: { SRT_TEST_VAR: "value with spaces and 'quotes'" },
     })
 
     expect(Buffer.byteLength(wrapped)).toBeLessThan(MAX_ARG_STRLEN)
-    const [, argsFile, before, after] = wrapped.match(VIA_ARGS_FILE)!
-    const argsDir = dirname(argsFile!)
-    expect(basename(argsDir)).toMatch(/^\.srt-bwrap-args-/)
+    const [, argsPath, before, after] = wrapped.match(VIA_ARGS_FILE)!
+    // This process's own fd: the profile has no name anywhere, so nothing
+    // can be put in its place between here and the execution.
+    expect(argsPath).toMatch(new RegExp(`^/proc/${process.pid}/fd/\\d+$`))
+    expect(readlinkSync(argsPath!)).toMatch(/\(deleted\)$/)
 
-    const words = readFileSync(argsFile!, 'utf8').split('\0')
+    const words = readFileSync(argsPath!, 'utf8').split('\0')
     expect(words[words.length - 1]).toBe('')
     const mounts = words.slice(0, -1)
     expect(mounts.filter(w => w === '/dev/null').length).toBe(files.length)
     expect(mounts).toContain(files[0])
-    expect(mounts.slice(-3)).toEqual(['--ro-bind', argsDir, argsDir])
-    // The file is readable in every sandbox of the process: nothing about
-    // the command or its environment goes there.
+    // Only mounts go to the file: nothing about the command or its
+    // environment is in it.
     expect(
       mounts.filter(
         w => w.startsWith('--') && !/^--(ro-bind|bind|tmpfs)$/.test(w),
@@ -214,16 +202,6 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
     expect(after).toMatch(/--unshare-pid .* -- \S+ -c /s)
   })
 
-  it('removes a file that was never spawned at cleanup and keeps the directory for the process', async () => {
-    const argsFile = argsFileOf(await wrap(overLongProfile()))
-    expect(existsSync(argsFile)).toBe(true)
-    cleanupBwrapMountPoints()
-    expect(existsSync(argsFile)).toBe(false)
-    // A sandbox launched earlier may still have the directory bound.
-    cleanupBwrapMountPoints({ force: true })
-    expect(existsSync(dirname(argsFile))).toBe(true)
-  })
-
   it('switches to the file exactly where one argument would come within 4 KiB of the cap', async () => {
     // The command is the last word on the line; a trailing two-byte
     // character keeps the shell quoter's output constant while every
@@ -245,14 +223,12 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
     expect(await renderedAt(INLINE_MAX + 1)).toMatch(VIA_ARGS_FILE)
   })
 
-  it('refuses a command that is too long for one argument by itself, and writes no file for it', async () => {
-    const argsDir = argsDirOf(await wrap(maskedFiles(1)))
+  it('refuses a command that is too long for one argument by itself', async () => {
     expect(
       await rejection(
         wrap(maskedFiles(20), { command: 'a'.repeat(MAX_ARG_STRLEN) }),
       ),
     ).toMatch(/too long for one shell argument even with the mounts/)
-    expect(readdirSync(argsDir)).toEqual([])
   })
 
   it('refuses a profile past the 9000 arguments bwrap accepts', async () => {
@@ -273,92 +249,139 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
     ).toMatch(/NUL byte/)
   })
 
-  it('refuses over-long profiles for the rest of the process once the directory has been replaced', () => {
+  it('holds one fd per pending profile and gives them all back at cleanup, a refused wrap included', () => {
     const seen = isolated(`
-      const made = argsDirOf(await wrap(small))
-      // Same path, another inode: what a sandbox with the parent writable,
-      // or a tmp cleaner followed by anyone, can arrange.
-      fs.renameSync(made, made + '.aside')
-      fs.mkdirSync(made, { mode: 0o700 })
-      const refused = await outcome(wrap(overLong))
-      const afterRefusal = await wrap(small)
-      cleanupBwrapMountPoints()
+      const openFds = () => fs.readdirSync('/proc/self/fd').length
+      // The runtime opens event-loop fds of its own on the first wrap.
+      await wrap(small)
+      const baseline = openFds()
+      await wrap(overLong)
+      await wrap(overLong)
+      const held = openFds() - baseline
+      // A rendering that cannot be run releases its profile too.
+      const refused = await outcome(wrap(overLong, 'a'.repeat(${MAX_ARG_STRLEN})))
+      const afterRefusal = openFds() - baseline
       cleanupBwrapMountPoints({ force: true })
-      console.log(JSON.stringify({
-        refused,
-        planted: fs.readdirSync(made),
-        stillBinds: argsDirOf(afterRefusal) !== undefined,
-        refusedAfterReset: await outcome(wrap(overLong)),
-      }))
+      console.log(JSON.stringify({ held, refused, afterRefusal, afterCleanup: openFds() - baseline }))
     `)
     expect(seen).toEqual({
-      refused: expect.stringMatching(
-        /cannot be passed through a file until this process restarts: \S+ was removed or replaced/,
-      ),
-      planted: [],
-      stillBinds: false,
-      refusedAfterReset: expect.stringMatching(/was removed or replaced/),
+      held: 2,
+      refused: expect.stringMatching(/too long for one shell argument/),
+      afterRefusal: 2,
+      afterCleanup: 0,
     })
   })
 
-  it('says so, rather than ENOENT, when the directory vanishes while a profile is being generated', () => {
-    const seen = isolated(`
-      const made = argsDirOf(await wrap(small))
-      const wrapping = outcome(wrap(overLong))
-      fs.rmSync(made, { recursive: true })
-      console.log(JSON.stringify(await wrapping))
-    `)
-    expect(seen).toMatch(/until this process restarts: \S+ was removed/)
-  })
-
-  it('wraps a profile that fits when tmpdir is unusable, and refuses only the over-long one', () => {
-    // A file where the directory should be: not creatable by root either.
-    writeFileSync(join(BASE, 'not-a-directory'), '')
+  it('refuses at wrap time, with the reason, when no directory takes an unnamed file', () => {
+    // Both candidates read-only: tmpdir and /dev/shm. A profile that fits
+    // needs neither and is unaffected.
+    const roTmp = join(BASE, 'ro-tmp')
+    mkdirSync(roTmp)
     const seen = isolated(
       `
       const fits = await wrap(small)
       console.log(JSON.stringify({
-        fits: fits.includes('--ro-bind /dev/null') && !fits.includes('srt-bwrap-args'),
+        fits: fits.includes('--ro-bind /dev/null') && !fits.includes('srt-args'),
         refused: await outcome(wrap(overLong)),
       }))
     `,
-      { TMPDIR: join(BASE, 'not-a-directory') },
+      { TMPDIR: roTmp },
+      [
+        'bwrap',
+        '--dev-bind',
+        '/',
+        '/',
+        '--ro-bind',
+        '/etc',
+        '/dev/shm',
+        '--ro-bind',
+        '/etc',
+        roTmp,
+      ],
     )
     expect(seen).toEqual({
       fits: true,
-      refused: expect.stringMatching(/it could not be created under \S+/),
+      refused: expect.stringMatching(
+        /cannot be passed through a file: no unnamed file could be opened for it \(.*read-only/s,
+      ),
     })
   })
 
+  it('fails in the redirection, and does not run the command, when the string is run after its cleanup', async () => {
+    const marker = join(BASE, 'ran')
+    const wrapped = await wrap(overLongProfile(), {
+      command: `touch ${marker}`,
+    })
+    cleanupBwrapMountPoints({ force: true })
+    // No pipes for the run: a parent-side fd would take the number the
+    // profile just gave up.
+    const run = spawnSync(wrapped, {
+      shell: true,
+      stdio: 'ignore',
+      timeout: 60000,
+    })
+    expect(run.status).not.toBe(0)
+    expect(existsSync(marker)).toBe(false)
+  })
+
   it.if(BWRAP_CAN_NAMESPACE)(
-    'e2e: binds the directory by its resolved path, which bwrap before 0.12 needs when tmpdir is behind an absolute symlink',
+    'e2e: a pending profile survives a tmpdir whose parent is replaced, because no path leads to it',
     () => {
-      mkdirSync(join(BASE, 'real-tmp'))
-      symlinkSync(join(BASE, 'real-tmp'), join(BASE, 'link-tmp'))
+      const parent = join(BASE, 'scratch')
+      mkdirSync(join(parent, 'tmp'), { recursive: true })
+      const marker = join(BASE, 'written-by-the-sandbox')
       const seen = isolated(
         `
         const { spawnSync } = await import('node:child_process')
-        const wrapped = await wrap(small)
-        const run = spawnSync(wrapped, { shell: true, encoding: 'utf8' })
-        console.log(JSON.stringify({ argsDir: argsDirOf(wrapped), status: run.status, stdout: run.stdout }))
+        const wrapped = await wrap(overLong, 'touch ${marker} 2>/dev/null && echo WROTE || echo DENIED')
+        const argsPath = argsPathOf(wrapped)
+        // The runtime leaves a cache of its own there; nothing of ours.
+        const namedUnderTmpdir = fs.readdirSync(process.env.TMPDIR, { recursive: true })
+          .filter(entry => /srt|args|bwrap/.test(entry))
+        // What a sandbox with the parent writable, or another process of
+        // this user sandboxing with tmpdir writable, can arrange: the
+        // directory goes aside, and a profile that binds / read-write takes
+        // the place of every path the string could still open.
+        fs.renameSync(${JSON.stringify(parent)}, ${JSON.stringify(parent + '.aside')})
+        let planted = null
+        if (!argsPath.startsWith('/proc/')) {
+          fs.mkdirSync(argsPath.slice(0, argsPath.lastIndexOf('/')), { recursive: true })
+          fs.writeFileSync(argsPath, '--bind\\0/\\0/\\0')
+          planted = argsPath
+        }
+        const run = spawnSync(wrapped, { shell: true, encoding: 'utf8', timeout: 60000 })
+        console.log(JSON.stringify({
+          argsPath,
+          namedUnderTmpdir,
+          planted,
+          status: run.status,
+          stdout: run.stdout.trim(),
+          marker: fs.existsSync(${JSON.stringify(marker)}),
+        }))
       `,
-        { TMPDIR: join(BASE, 'link-tmp') },
-      ) as { argsDir: string; status: number; stdout: string }
-      expect(dirname(seen.argsDir)).toBe(join(BASE, 'real-tmp'))
-      expect(seen).toMatchObject({ status: 0, stdout: 'hello\n' })
+        { TMPDIR: join(parent, 'tmp') },
+      )
+      expect(seen).toEqual({
+        argsPath: expect.stringMatching(/^\/proc\/\d+\/fd\/\d+$/),
+        namedUnderTmpdir: [],
+        planted: null,
+        status: 0,
+        // The command ran under the profile that was wrapped, not one
+        // planted after it.
+        stdout: 'DENIED',
+        marker: false,
+      })
     },
     60_000,
   )
 
   it.if(BWRAP_CAN_NAMESPACE)(
-    'e2e: bwrap applies the mounts from the file, the string composes with a prefix and a suffix, and the command sees neither the fd nor a writable --args directory',
+    'e2e: bwrap applies the mounts from the file, the string composes with a prefix and a suffix, and the command reaches neither fd 9 nor the profile',
     async () => {
-      const argsDir = argsDirOf(await wrap(maskedFiles(1)))
-      const probe = join(argsDir, 'srt-args-probe')
       const files = overLongProfile()
-      // tmpdir writable inside the sandbox: the case the trailing ro-bind
-      // exists for. The runner's tmpdir is scanned shallowly, since every
-      // mount costs bwrap time.
+      // tmpdir writable inside the sandbox: with nothing named there, that
+      // is no longer a way to the pending profile. The runner's tmpdir is
+      // scanned shallowly, since every mount costs bwrap time.
       const wrapped = await wrap(files, {
         allowOnly: [tmpdir()],
         mandatoryDenySearchDepth: 1,
@@ -368,11 +391,14 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
           // is not portable across hosts, so its type is the oracle).
           `[ -c ${files[0]} ] && echo MASKED || echo UNMASKED`,
           '[ -e /proc/self/fd/9 ] && echo FD9_OPEN || echo FD9_CLOSED',
-          `touch ${probe} 2>/dev/null && echo ARGS_WRITABLE || echo ARGS_READONLY`,
+          // A fresh /proc in its own PID namespace: the wrapping process,
+          // and so the fd its profiles are on, is not there at all.
+          `[ -e /proc/${process.pid} ] && echo RUNTIME_PROC_VISIBLE || echo RUNTIME_PROC_HIDDEN`,
         ].join('; '),
       })
-      const argsFile = argsFileOf(wrapped)
-      expect(dirname(argsFile)).toBe(argsDir)
+      expect(argsPathOf(wrapped)).toMatch(
+        new RegExp(`^/proc/${process.pid}/fd/\\d+$`),
+      )
       const run = spawnSync(`timeout 60 ${wrapped} && echo AFTER`, {
         shell: true,
         encoding: 'utf8',
@@ -383,13 +409,10 @@ describe.if(isLinux)('bwrap --args for over-long profiles', () => {
       expect(run.stdout.trim().split('\n')).toEqual([
         'MASKED',
         'FD9_CLOSED',
-        'ARGS_READONLY',
+        'RUNTIME_PROC_HIDDEN',
         'AFTER',
       ])
       expect(readFileSync(files[0]!, 'utf8')).toBe('secret\n')
-      expect(existsSync(probe)).toBe(false)
-      // Unlinked by the spawn itself.
-      expect(existsSync(argsFile)).toBe(false)
     },
     60_000,
   )

From 016a66877c34278960c7272fafc10df76952a3e2 Mon Sep 17 00:00:00 2001
From: Ron Leizrowice <ronleizrowice@anthropic.com>
Date: Fri, 11 Sep 2026 17:16:17 +0000
Subject: [PATCH 12/12] docs(linux): describe the unnamed --args profile

What carries the mounts now and why nothing can be put in its place; the
one thing that is not covered, another process of the same user outside a
sandbox reading a pending profile through /proc, which it could already
get by reading this process's memory; that the string must be run while
the wrapping process is alive and before the runtime cleans up after that
command; and what an over-long profile needs in order to be accepted at
all.
---
 README.md | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index ba5592562..9d3963dfb 100644
--- a/README.md
+++ b/README.md
@@ -215,7 +215,7 @@ child.on('exit', async code => {
 })
 ```
 
-**Violation attribution (`commandId` / `commandText`).** Violations observed while a wrapped command runs (seatbelt log lines, seccomp events, proxy denies) are stored under an attribution key, and `annotateStderrWithSandboxFailures(key, stderr)` / `getViolationsForCommand(key)` look them up by that same key. By default the key is the wrapped string itself. Pass an opaque per-invocation `commandId` (e.g. a tool-use id) to key by that instead — recommended: keys compare on their first 100 characters, so long commands sharing a prefix would otherwise cross-attribute, and a rerun of the same text would inherit the earlier run's events. If the string you *execute* is not the command the invocation *represents* (e.g. you wrap an assembled `source <snapshot> && eval '<cmd>'`), also pass `commandText: '<cmd>'`: it is what `ignoreViolations` command patterns match against and what each violation reports as its `command`.
+**Violation attribution (`commandId` / `commandText`).** Violations observed while a wrapped command runs (seatbelt log lines, seccomp events, proxy denies) are stored under an attribution key, and `annotateStderrWithSandboxFailures(key, stderr)` / `getViolationsForCommand(key)` look them up by that same key. By default the key is the wrapped string itself. Pass an opaque per-invocation `commandId` (e.g. a tool-use id) to key by that instead — recommended: keys compare on their first 100 characters, so long commands sharing a prefix would otherwise cross-attribute, and a rerun of the same text would inherit the earlier run's events. If the string you _execute_ is not the command the invocation _represents_ (e.g. you wrap an assembled `source <snapshot> && eval '<cmd>'`), also pass `commandText: '<cmd>'`: it is what `ignoreViolations` command patterns match against and what each violation reports as its `command`.
 
 ```typescript
 const wrapped = await SandboxManager.wrapWithSandbox(
@@ -226,7 +226,10 @@ const wrapped = await SandboxManager.wrapWithSandbox(
   { commandId: invocationId, commandText: rawCommand },
 )
 // ... run it ...
-const annotated = SandboxManager.annotateStderrWithSandboxFailures(invocationId, stderr)
+const annotated = SandboxManager.annotateStderrWithSandboxFailures(
+  invocationId,
+  stderr,
+)
 ```
 
 #### Available exports
@@ -652,12 +655,12 @@ Filesystem restrictions are enforced at the OS level:
 
 **Precedence is intentionally opposite for reads vs writes:** `allowRead` overrides `denyRead`, while `denyWrite` overrides `allowWrite`. This lets you carve out readable regions within denied areas, and carve out protected regions within writable areas.
 
-**Note (Linux, large profiles):** The wrapped string runs as one argument of `sh -c`, which Linux caps at 32 pages (128 KiB with 4 KiB pages). A profile that would not fit, with 4 KiB to spare for a prefix of the caller's own, has its mounts written to a file that bubblewrap reads through `--args`. The string then reads `/bin/sh -c '…' srt-args <file> bwrap … --args 9 …`: still a simple command, which opens the file on fd 9, unlinks it and runs bubblewrap, so it can be run once. The environment and the command stay on the command line; the file holds mount paths only.
+**Note (Linux, large profiles):** The wrapped string runs as one argument of `sh -c`, which Linux caps at 32 pages (128 KiB with 4 KiB pages). A profile that would not fit, with 4 KiB to spare for a prefix of the caller's own, has its mounts written to an unnamed file (`O_TMPFILE`) that the wrapping process holds open and bubblewrap reads through `--args`. The string then reads `/bin/sh -c '…' srt-args /proc/<wrapping pid>/fd/<n> bwrap … --args 9 …`: still a simple command, which opens the profile on fd 9 and runs bubblewrap. The environment and the command stay on the command line; the file holds mount paths only.
 
-- The file sits in a per-process directory, `<os.tmpdir()>/.srt-bwrap-args-*`, that every profile of the process binds read-only over itself, so a command the process sandboxed cannot rewrite a pending profile. It can read one: the mount paths of a command that is wrapped but not yet started are visible to the process's other sandboxes.
-- A sandbox with tmpdir writable sees that directory as an entry it cannot delete. `rm -rf "$TMPDIR"/*` skips it (the name starts with a dot); `find "$TMPDIR" -mindepth 1 -delete` does not.
-- The directory is created once. If it cannot be created, or is later removed or replaced (an age-based tmp cleaner), profiles that fit are unaffected and an over-long one is refused with an error until the process restarts: a sandbox started earlier would not have a new directory read-only, and the library cannot tell whether it is still running.
-- Not covered: a sandbox started by another process of the same user with tmpdir writable never bound this directory, and can swap a pending file so that the command runs with bubblewrap options of its choosing. The same holds when `os.tmpdir()` lies below a directory a sandbox may write (`TMPDIR=/tmp/work` with `/tmp` writable): a sandboxed command can rename that parent and put its own directory at the path. Where profiles can be over-long, keep tmpdir out of `allowWrite`, which closes both, or at least point `TMPDIR` at a directory that is itself an `allowWrite` entry, which closes the second.
+- The profile is never given a name, so nothing can be put in its place between the wrap and the execution — not a command the process sandboxed, not a sandbox another process of the same user started with tmpdir writable, not a rename of a directory above `TMPDIR`. Every sandbox this library starts has its own PID namespace and a fresh `/proc`, so none of them can reach `/proc/<wrapping pid>` either.
+- Not covered: another process of the same user running outside a sandbox can read a pending profile through `/proc`. It can already read the wrapping process's memory, so this gives it nothing new.
+- The string must be run while the process that produced it is alive, and before the runtime cleans up after that command (`cleanupAfterCommand()`), which is when the profile is released.
+- The profile needs a directory that takes an `O_TMPFILE` file — `os.tmpdir()`, else `/dev/shm` — and a readable `/proc/self/fd`. Without them an over-long profile is refused at wrap time with the reason; there is no fallback to a named file. Profiles that fit the command line do not use any of this.
 - bubblewrap parses at most 9000 arguments (about 3000 mounts). A profile past that, or a command too long for one argument by itself, fails at wrap time with an error.
 
 ### Mandatory Deny Paths (Auto-Protected Files)