feat(seatbelt): add system power access

docs/schema.md

@@ -84,7 +84,7 @@ cannot mix both formats in one request.
 
 ```json
 {
-    "version": "0.6.0-alpha",              // Schema version (semver). Minimum supported: "0.6.0-alpha"; current stable: "0.8.0-alpha".
+    "version": "0.9.0-alpha",              // Schema version (semver). Minimum supported: "0.6.0-alpha"; current development: "0.9.0-alpha".
     "containerId": "my-container",         // Externally assigned container ID
     "containment": "processcontainer",     // Backend (see table below)
 
@@ -196,6 +196,7 @@ cannot mix both formats in one request.
         "launchMethod": "exec",            // "exec" or "open" (LaunchServices, for Apple-constrained apps)
         "nestedPty": true,                 // Allow inner process to allocate its own pty (posix_openpt)
         "keychainAccess": false,           // Allow Keychain via securityd / trustd / cfprefsd / lsd.*
+        "systemPowerAccess": false,        // Allow sleep/wake notifications and power assertions
         "extraMachLookups": []             // Additional Mach service global-names the inner process may resolve
     },
 

docs/seatbelt/seatbelt-backend.md

@@ -326,6 +326,7 @@ Set under a top-level `"seatbelt"` key.
 | `nestedPty` | bool | `true` | Lets the inner process allocate its own ptys. Needed by anything that spawns a shell — test runners, `git`, `gh`, REPLs, agent tools. Set `false` for a tighter sandbox. |
 | `guiAccess` | bool | `false` | Adds Mach/IOKit rules so GUI apps can create windows. **Requires UI to be enabled**, which is spelled `ui.disable: false` (there is no `ui.enable`). |
 | `keychainAccess` | bool | `false` | Opens the sandbox enough for `keytar` / Security.framework to reach the Keychain. Opt in only if genuinely needed. |
+| `systemPowerAccess` | bool | `false` | Allows sleep/wake notification registration and power assertions through the RootDomain IOKit user client and power-management services. The user client also exposes other host power-management operations, so opt in only when needed. Requires schema 0.9 or later. |
 | `launchMethod` | `"exec"` \| `"open"` | `"exec"` | `"exec"` applies `sandbox_init()` then execs directly. `"open"` launches Terminal.app via LaunchServices and sandboxes the inner shell — required only for Terminal.app. |
 | `profileOverride` | string | unset | Replaces the generated profile with raw TinyScheme. **All `filesystem`/`network`/`ui` policy is ignored for profile generation.** Last resort. |
 | `extraMachLookups` | string[] | `[]` | Additional Mach services the sandbox may look up, as exact `global-name` values. The escape hatch for an app that needs one XPC service without resorting to `profileOverride`. |

schemas/dev/mxc-config.schema.0.9.0-alpha.json

@@ -1273,6 +1273,10 @@
         "profileOverride": {
           "description": "Optional override of the generated sandbox profile.",
           "type": "string"
+        },
+        "systemPowerAccess": {
+          "description": "Whether system sleep/wake notifications and power assertions are allowed.",
+          "type": "boolean"
         }
       },
       "type": "object"

schemas/dev/mxc-config.schema.0.9.0-dev.json

@@ -956,6 +956,13 @@
             "string",
             "null"
           ]
+        },
+        "systemPowerAccess": {
+          "description": "Allow system sleep/wake notifications and power assertions.",
+          "type": [
+            "boolean",
+            "null"
+          ]
         }
       },
       "type": "object"

sdk/node/README.md

@@ -284,6 +284,11 @@ Backend-specific tuning lives on the returned `ContainerConfig`. The full set of
 
 Open the schema file matching your `policy.version` (e.g. `mxc-config.schema.0.6.0-alpha.json`) and look up `processContainer`, `lxc`, `experimental.wslc`, `experimental.windows_sandbox`, etc.
 
+On macOS, set `seatbelt.systemPowerAccess: true` when a workload must prevent
+sleep or receive sleep/wake notifications. This option is available with schema
+`0.9.0-alpha` or later and is off by default because it opens host
+power-management services.
+
 For Windows ProcessContainer configs, `processContainer.learningMode: true`
 enables deny-and-record learning mode: failed accesses are logged but remain
 denied. The internal `learningModeLogging` and `permissiveLearningMode`

sdk/node/src/generated/v0_9_0_alpha/wire.ts

@@ -701,6 +701,10 @@ export interface Seatbelt {
    * Optional override of the generated sandbox profile.
    */
   profileOverride?: string;
+  /**
+   * Whether system sleep/wake notifications and power assertions are allowed.
+   */
+  systemPowerAccess?: boolean;
 }
 
 /**

sdk/node/src/generated/wire.ts

@@ -467,6 +467,10 @@ export interface Seatbelt {
    * Replace the generated profile entirely (advanced/testing escape hatch).
    */
   profileOverride?: string | null;
+  /**
+   * Allow system sleep/wake notifications and power assertions.
+   */
+  systemPowerAccess?: boolean | null;
 }
 
 /**

sdk/node/src/types.ts

@@ -518,6 +518,13 @@ export interface SeatbeltConfig {
    * needs Keychain access.
    */
   keychainAccess?: boolean;
+  /**
+   * Allow system sleep/wake notifications and power assertions. Adds
+   * access to the RootDomain IOKit user client and the macOS power
+   * management services. Requires schema `0.9.0-alpha` or later and
+   * defaults to `false`.
+   */
+  systemPowerAccess?: boolean;
   /**
    * Additional Mach service global-names to allow `mach-lookup` for.
    * Escape hatch for callers that need a specific system service the

src/backends/seatbelt/common/Cargo.toml

@@ -9,6 +9,7 @@ license.workspace = true
 # the ScriptRunner trait that seatbelt_runner implements. Same dep that
 # lxc_common uses.
 wxc_common = { workspace = true }
+semver = "1"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 libc = { workspace = true }

src/backends/seatbelt/common/src/lib.rs

@@ -6,7 +6,7 @@
 //! - [`profile_builder`] is platform-agnostic (pure string generation) so it
 //!   compiles and is fully unit-tested on every host. This lets reviewers
 //!   validate profile generation without a Mac.
-//! - [`seatbelt_policy`] owns the backend's network invariants and effective-
+//! - [`seatbelt_policy`] owns the backend's policy invariants and effective
 //!   policy helpers. Also platform-agnostic, so the rules are unit-tested
 //!   everywhere even though only macOS can execute them.
 //! - [`seatbelt_runner`] is gated to `target_os = "macos"` since it spawns

src/backends/seatbelt/common/src/profile_builder.rs

@@ -79,6 +79,7 @@ pub fn build_profile_with_proxy(
     write_network_rules(&mut out, request, proxy_address);
     write_nested_pty_rules(&mut out, request);
     write_keychain_rules(&mut out, request)?;
+    write_system_power_rules(&mut out, request);
     write_extra_seatbelt_rules(&mut out, request);
     write_ui_rules(&mut out, request);
 
@@ -590,6 +591,26 @@ fn write_keychain_rules(out: &mut String, request: &ExecutionRequest) -> Result<
     Ok(())
 }
 
+/// Emit the narrow Seatbelt capability needed for system power notifications
+/// and assertions. Off by default because opening `RootDomainUserClient` also
+/// exposes host power-management operations beyond notification registration.
+fn write_system_power_rules(out: &mut String, request: &ExecutionRequest) {
+    let enabled = request
+        .seatbelt
+        .as_ref()
+        .is_some_and(|c| c.system_power_access);
+    if !enabled {
+        return;
+    }
+
+    out.push_str(";; --- systemPowerAccess: sleep/wake notifications and assertions ---\n");
+    out.push_str("(allow mach-lookup\n");
+    out.push_str("    (global-name \"com.apple.PowerManagement.control\")\n");
+    out.push_str("    (global-name \"com.apple.iokit.powerdxpc\"))\n");
+    out.push_str("(allow iokit-open\n");
+    out.push_str("    (iokit-user-client-class \"RootDomainUserClient\"))\n");
+}
+
 /// Emit caller-provided `extraMachLookups` rules: additional Mach service
 /// global-names the inner process may resolve. No-op when the list is empty.
 fn write_extra_seatbelt_rules(out: &mut String, request: &ExecutionRequest) {
@@ -1748,6 +1769,31 @@ mod tests {
         assert!(!p.contains("/private/var/db/mds"));
     }
 
+    #[test]
+    fn system_power_access_default_off_omits_power_services() {
+        let r = req();
+        let p = build_profile(&r).unwrap();
+        assert!(!p.contains("systemPowerAccess"));
+        assert!(!p.contains("com.apple.PowerManagement.control"));
+        assert!(!p.contains("com.apple.iokit.powerdxpc"));
+        assert!(!p.contains("RootDomainUserClient"));
+    }
+
+    #[test]
+    fn system_power_access_true_allows_power_services() {
+        let mut r = req();
+        r.seatbelt = Some(SeatbeltConfig {
+            system_power_access: true,
+            ..Default::default()
+        });
+        let p = build_profile(&r).unwrap();
+        assert!(p.contains("systemPowerAccess"));
+        assert!(p.contains("(global-name \"com.apple.PowerManagement.control\")"));
+        assert!(p.contains("(global-name \"com.apple.iokit.powerdxpc\")"));
+        assert!(p.contains("(iokit-user-client-class \"RootDomainUserClient\")"));
+        assert!(!p.contains("(allow iokit-open)\n"));
+    }
+
     // Keychain rules expand `~/Library/Keychains` from $HOME at build
     // time, so the tests that exercise `keychain_access: true` are gated
     // to macOS (the only OS where this code path is actually used and

src/backends/seatbelt/common/src/seatbelt_policy.rs

@@ -15,6 +15,32 @@ use wxc_common::models::{
     ContainerPolicy, ExecutionRequest, NetworkAction, NetworkEnforcementMode, NetworkPolicy,
 };
 
+const SYSTEM_POWER_ACCESS_VERSION_ERROR: &str =
+    "seatbelt.systemPowerAccess requires schema version 0.9 or later";
+
+fn system_power_access_support(version: &str) -> Option<bool> {
+    semver::Version::parse(version)
+        .ok()
+        .map(|version| version.major > 0 || version.minor >= 9)
+}
+
+/// Reject system power access when the request predates its 0.9 contract.
+///
+/// This validation runs at execution time so requests changed after parsing,
+/// including through the Rust SDK setters, cannot bypass the version boundary.
+pub fn validate_system_power_access(request: &ExecutionRequest) -> Result<(), String> {
+    let enabled = request
+        .seatbelt
+        .as_ref()
+        .is_some_and(|seatbelt| seatbelt.system_power_access);
+
+    if enabled && !system_power_access_support(&request.schema_version).unwrap_or(false) {
+        return Err(SYSTEM_POWER_ACCESS_VERSION_ERROR.to_string());
+    }
+
+    Ok(())
+}
+
 /// Effective GUI posture: `seatbelt.guiAccess` only means anything when the UI
 /// policy leaves UI enabled, since every GUI grant is emitted alongside the
 /// WindowServer allows. Single source of truth so the profile builder and the
@@ -233,6 +259,28 @@ mod tests {
         }
     }
 
+    #[test]
+    fn system_power_access_support_starts_at_v09() {
+        assert_eq!(system_power_access_support("0.8.0-alpha"), Some(false));
+        assert_eq!(system_power_access_support("0.9.0-alpha"), Some(true));
+        assert_eq!(system_power_access_support("invalid"), None);
+    }
+
+    #[test]
+    fn system_power_access_validation_rejects_pre_v09_requests() {
+        let request = ExecutionRequest {
+            schema_version: "0.8.0-alpha".to_string(),
+            seatbelt: Some(SeatbeltConfig {
+                system_power_access: true,
+                ..Default::default()
+            }),
+            ..Default::default()
+        };
+
+        let error = validate_system_power_access(&request).unwrap_err();
+        assert!(error.contains("schema version 0.9"), "got: {error}");
+    }
+
     #[test]
     fn rejects_proxy_with_default_allow() {
         // Outbound is already unrestricted under 'allow' — a proxy adds no

src/backends/seatbelt/common/src/seatbelt_runner.rs

@@ -124,6 +124,7 @@ impl SandboxBackend for SeatbeltScriptRunner {
 
         // Seatbelt's own invariants — the only home for them, so a caller that
         // builds an ExecutionRequest directly gets the same rules.
+        crate::seatbelt_policy::validate_system_power_access(request).map_err(error_response)?;
         crate::seatbelt_policy::validate_seatbelt_network_policy(&request.policy)
             .map_err(error_response)?;
         crate::seatbelt_policy::validate_seatbelt_ui_policy(request).map_err(error_response)?;
@@ -855,6 +856,23 @@ mod tests {
         assert!(response.error_message.contains("cannot be enforced"));
     }
 
+    #[test]
+    fn rejects_system_power_access_before_v09() {
+        let mut request = base_request();
+        request.schema_version = "0.8.0-alpha".to_string();
+        request
+            .seatbelt
+            .as_mut()
+            .expect("Seatbelt config")
+            .system_power_access = true;
+
+        let error = SeatbeltScriptRunner::new().validate(&request).unwrap_err();
+        assert!(
+            error.error_message.contains("schema version 0.9"),
+            "{error:?}"
+        );
+    }
+
     /// The parser is not a door at all for these rules: `validate` is the only
     /// place they live, and `mxc_engine` will happily take an `ExecutionRequest`
     /// built by hand. These assert `validate` rejects them without any help from

src/core/mxc-sdk/README.md

@@ -388,6 +388,20 @@ default):
 `Containment` is `#[non_exhaustive]`, so a `match` on it needs a wildcard arm.
 Constructing the listed variants is unaffected.
 
+Seatbelt system power access is off by default. Enable it when a workload must
+prevent sleep or receive sleep/wake notifications:
+
+```rust,no_run
+# use mxc_sdk::{build_request, SandboxPolicy};
+# let policy = SandboxPolicy {
+#     version: "0.9.0-alpha".to_string(),
+#     filesystem: None, network: None, ui: None, timeout_ms: None,
+# };
+let mut request = build_request(&policy, None)?;
+request.set_seatbelt_system_power_access(true);
+# Ok::<(), mxc_sdk::Error>(())
+```
+
 `Containment::IsolationSession` names that backend, but no entry point taking a
 `Containment` serves it: `run` and `spawn_sandbox` both return
 [`ErrorCode::UnsupportedContainment`]. Reach it through the state-aware

src/core/mxc_config_contract/src/dev/stable.rs

@@ -348,6 +348,9 @@ pub struct Seatbelt {
     /// Whether macOS Keychain access is allowed.
     #[serde(default)]
     pub keychain_access: OptionalField<bool>,
+    /// Whether system sleep/wake notifications and power assertions are allowed.
+    #[serde(default)]
+    pub system_power_access: OptionalField<bool>,
     /// Additional Mach service global names the process may resolve.
     #[serde(default)]
     pub extra_mach_lookups: OptionalField<Vec<String>>,

src/core/mxc_config_contract/tests/v0_9_0_alpha/fixtures/one_shot/valid/seatbelt_complete.json

@@ -10,6 +10,7 @@
     "launchMethod": "open",
     "nestedPty": false,
     "keychainAccess": true,
+    "systemPowerAccess": true,
     "extraMachLookups": [
       "com.apple.SecurityServer",
       "com.apple.coreservices.launchservicesd"

src/core/mxc_config_contract/tests/v0_9_0_alpha/optional_fields.rs

@@ -156,6 +156,11 @@ fn rejects_null_optional_fields() {
                 version_and_process.as_str(),
                 r#""seatbelt": {"keychainAccess": null}"#,
             ),
+            (
+                "seatbelt.systemPowerAccess",
+                version_and_process.as_str(),
+                r#""seatbelt": {"systemPowerAccess": null}"#,
+            ),
             (
                 "seatbelt.extraMachLookups",
                 version_and_process.as_str(),

src/core/mxc_config_contract/tests/v0_9_0_alpha/seatbelt.rs

@@ -12,6 +12,7 @@ fn accepts_complete_seatbelt_object() {
             "launchMethod": "exec",
             "nestedPty": false,
             "keychainAccess": false,
+            "systemPowerAccess": false,
             "extraMachLookups": ["com.apple.securityd", "com.apple.coreservices.launchservicesd"]
         },
         "process": {"commandLine": "echo"}
@@ -165,6 +166,23 @@ fn rejects_non_boolean_keychain_access_values() {
     }
 }
 
+#[test]
+fn rejects_non_boolean_system_power_access_values() {
+    for system_power_access in ["0", "1", "\"string\"", "[]", "{}"] {
+        let json = format!(
+            r#"{{
+                "version": "0.9.0-alpha",
+                "seatbelt": {{
+                    "systemPowerAccess": {system_power_access}
+                }},
+                "process": {{"commandLine": "echo"}}
+            }}"#
+        );
+
+        assert_invalid(&json);
+    }
+}
+
 #[test]
 fn rejects_unknown_seatbelt_field() {
     let json = r#"{

src/core/mxc_config_contract/tests/version_boundaries/seatbelt.rs

@@ -1,7 +1,7 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT License.
 
-use crate::common::assert_v07_introduces;
+use crate::common::{assert_v07_introduces, assert_v09_introduces};
 
 #[test]
 fn seatbelt_section_is_introduced_in_v07() {
@@ -22,3 +22,8 @@ fn macos_sandbox_section_alias_is_introduced_in_v07() {
 fn macos_sandbox_containment_value_alias_is_introduced_in_v07() {
     assert_v07_introduces(r#""containment": "macos_sandbox", "macos_sandbox": {}"#);
 }
+
+#[test]
+fn system_power_access_is_introduced_in_v09() {
+    assert_v09_introduces(r#""seatbelt": {"systemPowerAccess": true}"#);
+}