synabun 2.0.7 → 2.0.10

package/neural-interface/lib/assistant-runtime.js

@@ -9,7 +9,7 @@
 // obligation nudges. All server dependencies are injected.
 
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
-import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { createClaudeBrain } from './assistant-brains/claude.js';
 import { createCodexBrain } from './assistant-brains/codex.js';
@@ -246,10 +246,14 @@ export function createAssistantRuntime({
   // (capability) → boolean, the verifier of lib/remote-policy.js createPhoneAuthority(): is this the
   // capability of the one WhatsApp bridge? Without a verifier nothing can grant computer use remotely.
   phoneAuthority = null,
+  // The Admin sandbox setting (lib/agent-sandbox-setting.js): global, shown in every session view.
+  adminSandbox = null,
 } = {}) {
   if (!dataDir) throw new Error('createAssistantRuntime requires dataDir');
   const settings = {
     idleDisposeMs: Math.max(60_000, Number(config.idleDisposeMinutes || 120) * 60_000),
+    // A draft (a session the panel opened, before its first prompt) with no socket attached goes after this.
+    draftIdleMs: Math.max(60_000, Number(config.draftIdleMinutes || 10) * 60_000),
     // A remote session on OpenCode waits this long for its gate plugin's hello before a turn (else refused).
     remoteGateHelloMs: Math.max(0, Number(config.remoteGateHelloMs ?? 5000)),
     // An OpenCode turn's end waits this long for the serve's stored messages (the usage meter's
@@ -293,11 +297,30 @@ export function createAssistantRuntime({
 
   // ── persistence ────────────────────────────────────────────────────────────
   function transcriptPath(id) { return resolve(dataDir, 'assistant', id, 'transcript.jsonl'); }
+  function transcriptHasEntries(id) { try { return statSync(transcriptPath(id)).size > 0; } catch { return false; } }
+  function transcriptHasPrompt(id) { try { return readFileSync(transcriptPath(id), 'utf8').includes('"synabun.user_prompt"'); } catch { return false; } }
+  /**
+   * A record from before `chatStartedAt`: its chat started when it ran a turn, adopted a provider
+   * conversation or holds a human prompt (the time is its best guess). One that never did is listed
+   * nowhere; with nothing in it at all (no transcript, no runs, not remote, no spend) it is dropped.
+   */
+  function settleLegacyRow(row) {
+    if (row.chatStartedAt) return 'started';
+    if (Number(row.turns) > 0 || row.providerSessionId || row.providerThreadId || transcriptHasPrompt(row.id)) {
+      row.chatStartedAt = row.lastActiveAt || row.updatedAt || row.createdAt || iso(now());
+      return 'started';
+    }
+    const holds = transcriptHasEntries(row.id) || (Array.isArray(row.dispatchRunIds) && row.dispatchRunIds.length > 0)
+      || !!row.remote || !!row.channel || Number(row.costUsd) > 0;
+    return holds ? 'unstarted' : 'empty';
+  }
   function loadIndex() {
     const rows = readJson(indexPath, []);
     if (!Array.isArray(rows)) return;
+    let dropped = 0;
     for (const row of rows) {
       if (!row?.id) continue;
+      if (settleLegacyRow(row) === 'empty') { dropped += 1; continue; }
       sessions.set(row.id, makeLive({ ...row, status: row.status === 'ended' ? 'ended' : 'idle', windowIds: [] }));
       // A remote session nobody registered again since the restart reads as read-only.
       if (row.remote) {
@@ -305,11 +328,14 @@ export function createAssistantRuntime({
         try { remotePolicy?.setSessionBrain?.(row.id, row.brain?.provider || null); } catch {}
       }
     }
+    // The index is written again without them (and with the started marks).
+    if (dropped) { log('assistant:index', `${dropped} session record(s) without a conversation dropped`); persist(); }
   }
   let persistTimer = null;
   function persist({ force = false } = {}) {
     const write = () => {
-      const rows = [...sessions.values()].map((live) => publicRecord(live.record, { withLive: false, persisted: true }))
+      // A draft is never written: it exists on disk only once its first prompt was sent (startChat).
+      const rows = [...sessions.values()].filter((live) => !live.draft).map((live) => publicRecord(live.record, { withLive: false, persisted: true }))
         .sort((a, b) => String(b.updatedAt || '').localeCompare(String(a.updatedAt || '')))
         .slice(0, settings.retention);
       try { writeJsonAtomic(indexPath, rows); } catch (error) { log('assistant:index-error', error?.message || String(error)); }
@@ -339,6 +365,9 @@ export function createAssistantRuntime({
   function makeLive(record) {
     return {
       record, brain: null, brainProvider: null, brainMeter: null, brainMeterProvider: null, turnTaskId: null, turnTasks: [], sockets: new Set(), buffer: [], running: false, pendingControls: new Map(), controlTimers: new Map(),
+      // A draft: opened by a panel and not chatted in yet. Kept in memory only, listed nowhere, and
+      // gone when it is closed or left without a socket (draftTimer); its first prompt stores it (startChat).
+      draft: false, draftTimer: null,
       mailbox: [], mailboxTimer: null, obligations: new Set(), rememberedThisTurn: false, disposeTimer: null, personaText: '',
       // The last human prompt and where it came from ('ui', 'whatsapp', 'api'): a route continuation
       // answers there (lastPromptOrigin; the transcript's after a restart).
@@ -906,7 +935,11 @@ export function createAssistantRuntime({
       out.testDensity = testDensityOf(record);
       out.testDensityExplicit = normalizeTestDensity(record.testDensity, null);
       // `rename`: this server keeps a rename on the record (userRenamed), so a panel writes it here.
-      out.features = { routing: !!router, computer: computerSupported(), testDensity: true, rename: true };
+      // `adminSandbox`: the global setting is served here (PUT /api/assistant/admin-sandbox).
+      // `drafts`: a session is stored and listed from its first prompt on; `remove`: DELETE stops its work and purges it.
+      out.features = { routing: !!router, computer: computerSupported(), testDensity: true, rename: true, adminSandbox: !!adminSandbox, drafts: true, remove: true };
+      out.draft = live.draft === true;
+      if (adminSandbox) { try { out.adminSandbox = adminSandbox.enabled() === true; } catch { out.adminSandbox = false; } }
       out.budget = sessionMoney(record.id);
       out.remoteLevel = policy ? effectiveLevel(policy, { untrusted: live.turnUntrusted === true, now: now() }) : null;
     }
@@ -2298,6 +2331,8 @@ export function createAssistantRuntime({
       live.lastPromptOrigin = origin ? String(origin) : null;
       // A prompt from elsewhere (WhatsApp, the API) is news to the panel: it goes live too.
       const promptPacket = { type: 'event', event: { type: 'synabun.user_prompt', text: prompt, images: images.length, ...(origin && origin !== 'ui' ? { origin: String(origin) } : {}) } };
+      // The chat starts with its first human prompt: from here on the session is stored and listed.
+      startChat(live);
       appendTranscript(live.record.id, { at: iso(now()), packet: promptPacket });
       if (origin && origin !== 'ui') sendToSockets(live, promptPacket);
       if (live.brainProvider !== 'claude-code' && memory?.recallForPrompt) {
@@ -2668,8 +2703,56 @@ export function createAssistantRuntime({
   }
 
   // ── public API ─────────────────────────────────────────────────────────────
+  /**
+   * Every session list (REST, the socket's list_sessions, the catalog view) reads this: only sessions
+   * whose chat started. A draft, or a record nobody ever prompted, is in none of them. `activeRuns`:
+   * the workers it dispatched that still run (a removal stops them, and its question says so).
+   */
   function listSessions() {
-    return [...sessions.values()].map((live) => view(live)).sort((a, b) => String(b.updatedAt || '').localeCompare(String(a.updatedAt || '')));
+    const runs = new Map();
+    try {
+      for (const run of dispatcher?.list?.({ activeOnly: true, limit: 500 }) || []) {
+        if (run?.assistantSessionId) runs.set(run.assistantSessionId, (runs.get(run.assistantSessionId) || 0) + 1);
+      }
+    } catch {}
+    return [...sessions.values()].filter((live) => !live.draft && !!live.record.chatStartedAt)
+      .map((live) => ({ ...view(live), activeRuns: runs.get(live.record.id) || 0 }))
+      .sort((a, b) => String(b.updatedAt || '').localeCompare(String(a.updatedAt || '')));
+  }
+  /**
+   * The first human prompt (or a provider conversation adopted with `resume`) starts the chat: the
+   * record is marked, and a draft becomes a stored session (written now, listed from now on).
+   */
+  function startChat(live) {
+    if (live.record.chatStartedAt && !live.draft) return;
+    live.record.chatStartedAt ||= iso(now());
+    const wasDraft = live.draft;
+    live.draft = false;
+    if (live.draftTimer) { clearTimeout(live.draftTimer); live.draftTimer = null; }
+    persist({ force: true });
+    if (wasDraft) broadcast('assistant:session-created', live);
+  }
+  /** A draft with no socket attached is removed after settings.draftIdleMs (a page that went and never came back). */
+  function armDraftExpiry(live) {
+    if (live.draftTimer) { clearTimeout(live.draftTimer); live.draftTimer = null; }
+    if (!live.draft || live.sockets.size || shuttingDown || sessions.get(live.record.id) !== live) return;
+    live.draftTimer = setTimeout(() => {
+      live.draftTimer = null;
+      if (!live.draft || live.sockets.size || sessions.get(live.record.id) !== live || sessionBusy(live) || live.closing) return;
+      destroySession(live.record.id).catch((error) => log('assistant:draft-expiry', error?.message || String(error)));
+    }, settings.draftIdleMs);
+    live.draftTimer.unref?.();
+  }
+  /**
+   * Whether closing a session keeps its record (ended, reopenable) or removes it: a session that
+   * never held a conversation (no prompt, no turn, no runs, nothing in its transcript, not remote,
+   * no work under way) leaves nothing behind.
+   */
+  function holdsConversation(live) {
+    const r = live.record;
+    return !!r.chatStartedAt || Number(r.turns) > 0 || (Array.isArray(r.dispatchRunIds) && r.dispatchRunIds.length > 0)
+      || !!r.providerSessionId || !!r.providerThreadId || !!r.remote || !!r.channel || Number(r.costUsd) > 0
+      || sessionBusy(live) || !!workReserved(live) || transcriptHasEntries(r.id);
   }
   function getSession(id, { transcript = true, limit = 400 } = {}) {
     const live = sessions.get(id);
@@ -2694,7 +2777,7 @@ export function createAssistantRuntime({
     if (!row) throw Object.assign(new Error('Auto requires a signed-in subscription account.'), { code: 'ACCOUNT_NO_SUBSCRIPTION', status: 409 });
     return { ...brain, accountId: row.id };
   }
-  async function createSession({ brain = {}, label = null, cwd = null, windowId = null, fallback = false, channel = null } = {}, internal = {}) {
+  async function createSession({ brain = {}, label = null, cwd = null, windowId = null, fallback = false, channel = null, draft = false } = {}, internal = {}) {
     const id = `assistant-${randomUUID()}`;
     const requested = normalizeBrain({ ...brain, cwd: brain?.cwd || cwd || settings.defaultBrain.cwd || PACKAGE_ROOT }, settings.defaultBrain, { catalog: catalog?.peek?.() || null });
     const enabled = await enabledBrain(requested, { fallback: fallback === true, named: !!brain?.model });
@@ -2725,8 +2808,16 @@ export function createAssistantRuntime({
       live.creating = false;
       record.brain = clampedBrain(live, record.brain);
     }
-    persist({ force: true });
-    broadcast('assistant:session-created', live);
+    // `draft` (a panel's new session, POST /sessions): stored and announced by its first prompt
+    // (startChat); until then it lives here only, and is removed when it is closed or left (armDraftExpiry).
+    // A remote session is never one: its bridge sends the prompt it was made for.
+    if (draft === true && !remote && !record.channel) {
+      live.draft = true;
+      armDraftExpiry(live);
+    } else {
+      persist({ force: true });
+      broadcast('assistant:session-created', live);
+    }
     return enabled.fallback ? { ...view(live), fallback: enabled.fallback } : view(live);
   }
   function applyRouteMode(live, mode) {
@@ -2826,6 +2917,12 @@ export function createAssistantRuntime({
   }
   async function closeSession(id) {
     const live = requireLive(id);
+    // Never chatted in (a draft, a record nobody prompted): closing it leaves nothing behind.
+    if (!holdsConversation(live)) {
+      const gone = { ...view(live), status: 'destroyed', removed: true };
+      await destroySession(id);
+      return gone;
+    }
     const closed = await endSessionWork(live);
     try {
       await disposeBrain(live, 'closed');
@@ -2843,6 +2940,9 @@ export function createAssistantRuntime({
     if (!live) return false;
     const closed = await endSessionWork(live);
     try {
+      if (sessions.get(id) !== live) return false; // another removal got there first
+      if (live.draftTimer) { clearTimeout(live.draftTimer); live.draftTimer = null; }
+      if (live.disposeTimer) { clearTimeout(live.disposeTimer); live.disposeTimer = null; }
       await disposeBrain(live, 'closed');
       for (const ws of live.sockets) { try { ws.close(1000, 'session destroyed'); } catch {} }
       sessions.delete(id);
@@ -2859,6 +2959,24 @@ export function createAssistantRuntime({
     } finally { closed(); }
     return true;
   }
+  /**
+   * The Sessions menu's Remove (DELETE /api/assistant/sessions/:id): the session goes for good, in
+   * every host and list, and its work goes with it: the workers it dispatched that still run are
+   * stopped (no orphaned run is left), then the running turn and the brain (destroySession). Only
+   * the record, its transcript and its usage journal are removed: memories made from it (its
+   * assistant-threads record included) stay, and so do the dispatcher's records of its runs.
+   */
+  async function removeSession(id) {
+    const live = sessions.get(String(id || ''));
+    if (!live) return { removed: false, stoppedRuns: [] };
+    let stoppedRuns = [];
+    try {
+      const result = await dispatcher?.killAll?.({ assistantSessionId: live.record.id, reason: 'session_removed' });
+      stoppedRuns = Array.isArray(result?.stopped) ? result.stopped : [];
+    } catch (error) { log('assistant:remove', `${live.record.id}: stopping its runs failed (${error?.message || error})`); }
+    const removed = await destroySession(live.record.id);
+    return { removed, stoppedRuns };
+  }
   /**
    * MCP terminal pin → assistant session id. Claude brains pin the session id
    * itself; the OpenCode brain pins `assistant-oc-<24>` (its isolated serve).
@@ -3123,6 +3241,7 @@ export function createAssistantRuntime({
     ws.on('close', () => {
       live.sockets.delete(ws);
       scheduleDispose(live);
+      armDraftExpiry(live);
     });
     if (held) {
       while (live.closing) await live.closing;
@@ -3133,6 +3252,7 @@ export function createAssistantRuntime({
       if (ws.readyState !== 1) return; // gone while it waited
     }
     if (live.disposeTimer) { clearTimeout(live.disposeTimer); live.disposeTimer = null; }
+    if (live.draftTimer) { clearTimeout(live.draftTimer); live.draftTimer = null; }
     live.sockets.add(ws);
     live.record.status = live.record.status === 'ended' ? 'idle' : live.record.status;
     const engine = live.brain ? { type: 'engine', engine: live.brainProvider === 'claude-code' ? 'sdk' : live.brainProvider, brain: live.brainProvider, sdkVersion } : { type: 'engine', engine: 'assistant', brain: live.record.brain.provider, sdkVersion };
@@ -3264,6 +3384,8 @@ export function createAssistantRuntime({
         if (msg.providerSessionId) {
           const moved = msg.providerSessionId !== live.record.providerSessionId;
           live.record.providerSessionId = msg.providerSessionId;
+          // A provider conversation adopted (/resume <id>): the session holds a chat now.
+          startChat(live);
           // Another provider session: the meter's baseline was the old one's.
           if (moved) resetMeterIdentity(live, msg.providerSessionId);
           // …and so was the frozen user-context digest.
@@ -3724,6 +3846,7 @@ export function createAssistantRuntime({
     for (const live of sessions.values()) {
       if (live.mailboxTimer) clearTimeout(live.mailboxTimer);
       if (live.disposeTimer) clearTimeout(live.disposeTimer);
+      if (live.draftTimer) clearTimeout(live.draftTimer);
       if (live.workTimer) clearTimeout(live.workTimer);
       await disposeBrain(live, 'shutdown').catch(() => {});
       live.record.status = 'idle';
@@ -3750,7 +3873,7 @@ export function createAssistantRuntime({
   broadcastSync = (message) => { try { originalBroadcast(message); } catch {} if (message?.type === 'assistant:permission-request' || message?.type === 'assistant:permission-resolved') onPermissionBroadcast(message); };
 
   return {
-    handleWebSocket, listSessions, getSession, createSession, updateSession, closeSession, destroySession,
+    handleWebSocket, listSessions, getSession, createSession, updateSession, closeSession, destroySession, removeSession,
     resolveTerminal, accountInUse, ownsIsolatedServe, noteDispatch, subscribe, shutdown,
     observeBroadcast: onPermissionBroadcast,
     testDensityFor, routerSession, routerSend, routerEvent, routerMailbox, routerContinue, routerSinks, routerRouted, routerRouteFailed, routerComputerApproved, gateCheck, isPlanning, isPlanReadOnly,

package/neural-interface/lib/claude-model-catalog.js

@@ -43,7 +43,39 @@ const DISCOVERY_TIMEOUT_MS = 15000;
 const CACHE_TTL_MS = 10 * 60 * 1000;
 
 let _cache = { at: 0, key: '', models: [] };
-let _inflight = null;
+const _inflight = new Map(); // cache key → the discovery running for it
+// Where the last verified list is kept across restarts ({ read(), write(entry) },
+// lib/launch-cache.js createSnapshotStore): a start answers with it at once and
+// asks the CLI again in the background.
+let _store = null;
+let _storeRead = false;
+
+export function setClaudeModelStore(store) {
+  _store = store && typeof store.read === 'function' && typeof store.write === 'function' ? store : null;
+  _storeRead = false;
+}
+
+// The list the last run verified, for this very binary and account: given at once
+// after a restart (as an old answer, so the first read asks the CLI again).
+function adoptStoredModels(key) {
+  if (_storeRead || !_store) return;
+  _storeRead = true;
+  if (_cache.models.length) return;
+  try {
+    const saved = _store.read();
+    const models = saved?.key === key && Array.isArray(saved.models)
+      ? saved.models.filter(m => m && typeof m === 'object' && typeof m.id === 'string' && m.id)
+      : [];
+    if (models.length) _cache = { at: 0, key, models };
+  } catch { /* nothing kept: the first read asks the CLI */ }
+}
+
+// What the list depends on: the binary (an update changes it, binaryIdentity) and
+// the account it was read under (another account can be entitled to other models).
+function cacheKeyOf(bin, account) {
+  const who = String(account || '');
+  return who ? `${binaryIdentity(bin)}#${who}` : binaryIdentity(bin);
+}
 
 // Who else keeps a copy of this list (the Assistant's model catalog). Told when a
 // discovery returns a list that differs from the one before it, so a copy is
@@ -286,37 +318,55 @@ export function queryClaudeCliModels(claudeBin, { cwd, timeoutMs = DISCOVERY_TIM
 }
 
 // Cached discovery. `source` lets the UI distinguish a verified list from the
-// baked-in fallback. Cache is keyed on the binary's identity, so switching the
-// configured CLI (Settings > Terminal) or updating it re-discovers.
-export async function discoverClaudeModels(claudeBin, { force = false, cwd, query = queryClaudeCliModels } = {}) {
+// baked-in fallback. Cache is keyed on the binary's identity (and the account
+// the list was read under, `account`), so switching the configured CLI
+// (Settings > Terminal), updating it or signing in to another account
+// re-discovers. A list that is merely old is still given at once, and the CLI is
+// asked again in the background (one discovery at a time): only a first read, a
+// changed key or `force` waits for the CLI.
+export async function discoverClaudeModels(claudeBin, { force = false, cwd, query = queryClaudeCliModels, account = '' } = {}) {
   const bin = String(claudeBin || '');
-  const key = binaryIdentity(bin);
-  const fresh = _cache.models.length
-    && _cache.key === key
-    && Date.now() - _cache.at < CACHE_TTL_MS;
-  if (!force && fresh) return { source: 'cache', models: _cache.models };
-  if (_inflight) return _inflight;
-
-  _inflight = (async () => {
+  const key = cacheKeyOf(bin, account);
+  adoptStoredModels(key);
+  const known = _cache.models.length && _cache.key === key;
+  if (!force && known) {
+    if (Date.now() - _cache.at >= CACHE_TTL_MS) discover(bin, key, cwd, query).catch(() => {});
+    return { source: 'cache', models: _cache.models };
+  }
+  return discover(bin, key, cwd, query);
+}
+
+function discover(bin, key, cwd, query) {
+  if (_inflight.has(key)) return _inflight.get(key);
+  const job = (async () => {
     try {
       const raw = await query(bin, { cwd });
       const models = normalizeClaudeModels(raw);
       if (models.length) {
         const changed = claudeModelsSignature(models) !== claudeModelsSignature(_cache.models);
         _cache = { at: Date.now(), key, models };
+        try { _store?.write({ key, at: _cache.at, models }); } catch { /* kept in memory still */ }
         if (changed) notifyModelsChanged(models);
         return { source: 'cli', models };
       }
       return { source: 'fallback', models: [...CLAUDE_FALLBACK_MODELS] };
     } finally {
-      _inflight = null;
+      if (_inflight.get(key) === job) _inflight.delete(key);
     }
   })();
-  return _inflight;
+  _inflight.set(key, job);
+  return job;
+}
+
+/** The kept list is due again: the next read still answers with it and asks the CLI in the background. */
+export function markClaudeModelsStale() {
+  _cache = { ..._cache, at: 0 };
 }
 
 export function clearClaudeModelCache() {
   _cache = { at: 0, key: '', models: [] };
+  _inflight.clear();
+  _storeRead = !!_store;
   _skewCache = { key: null, result: undefined };
   _skewInflight.clear();
 }

package/neural-interface/lib/codex-account-auth.js

@@ -9,7 +9,7 @@
 import { spawn } from 'node:child_process';
 import { verifyOpenAiApiKey } from './claude-profile-api-key.js';
 import { validateProviderApiKey } from './provider-panel-api-key-auth.js';
-import { applyCodexLaunchEnv } from './codex-accounts.js';
+import { applyCodexLaunchEnv, codexLaunchArgs } from './codex-accounts.js';
 
 const fail = (message, status = 409, code = null) => Object.assign(new Error(message), { status, ...(code ? { code } : {}) });
 
@@ -32,13 +32,15 @@ export function createCodexAccountAuth({
   }
   // Codex run under the account's own store: inherited credentials out, its
   // CODEX_HOME in, never the key SynaBun holds (that is not Codex's store).
-  function launch(id, args) {
+  // The launch's overrides (the Windows sandbox of the Admin sandbox setting) follow the subcommand.
+  function launch(id, words) {
     account(id);
     const plan = accounts.launchFor(id);
     if (!plan.ok) throw fail(plan.message, 404);
     prepareConfig(plan.home);
     let file = codexBin();
     if (!file) throw fail('Codex CLI not found. Install Codex to sign in.', 503);
+    const args = [...words, ...codexLaunchArgs(plan)];
     const script = /\.[cm]?js$/i.test(file);
     const shell = process.platform === 'win32' && /\.(cmd|bat)$/i.test(file);
     const proc = spawnProcess(script ? process.execPath : file, script ? [file, ...args] : args, {

package/neural-interface/lib/codex-accounts.js

@@ -32,6 +32,7 @@ import { dirname, join, resolve, sep } from 'node:path';
 import { homedir } from 'node:os';
 import { readProfileApiKey, saveProfileApiKey, clearProfileApiKey } from './claude-profile-api-key.js';
 import { apiKeyHint, resolveClaudeAuth } from './claude-accounts.js';
+import { normalizeAdminSandbox, sandboxElevationFor } from './agent-sandbox-elevation.js';
 
 export const CODEX_DEFAULT_ACCOUNT_ID = 'default';
 export const CODEX_AUTH_MODES = Object.freeze(['subscription', 'apiKey']);
@@ -123,9 +124,13 @@ export function applyCodexLaunchEnv(base, launch) {
 export function codexExecEnv(launch) {
   return { ...(launch?.env || {}), ...(launch?.apiKey ? { CODEX_API_KEY: launch.apiKey } : {}) };
 }
+/** The `-c` overrides every Codex process of the launch starts with: the Windows sandbox the Admin sandbox setting allows. */
+export function codexLaunchArgs(launch) {
+  return [...(launch?.configArgs || [])];
+}
 /** The `-c` overrides an app-server of the account starts with (before the subcommand). */
 export function codexAppServerArgs(launch) {
-  return launch?.apiKey ? [...CODEX_EPHEMERAL_STORE_ARGS] : [];
+  return [...codexLaunchArgs(launch), ...(launch?.apiKey ? CODEX_EPHEMERAL_STORE_ARGS : [])];
 }
 
 export function createCodexAccounts({
@@ -141,6 +146,8 @@ export function createCodexAccounts({
   statusTimeoutMs = 20_000,
   // Called before a new account links Default's config.toml (server.js repairs it there).
   prepareDefaultConfig = () => {},
+  // () => the Admin sandbox setting (lib/agent-sandbox-setting.js): which Windows sandbox every launch may use.
+  adminSandbox = () => false,
 } = {}) {
   if (!dataHome) throw new Error('createCodexAccounts requires dataHome');
   const registryPath = resolve(dataHome, 'data', 'codex-accounts.json');
@@ -273,11 +280,17 @@ export function createCodexAccounts({
     }
     const { row, key } = describeProfile(profile, data);
     const apiKey = row.mode === 'apiKey' && row.apiKey.source === 'synabun' && key ? key : null;
+    // A launch override, never written into config.toml: Default's home is the user's own ~/.codex.
+    let on = false;
+    try { on = normalizeAdminSandbox(adminSandbox()); } catch { on = false; }
+    const sandbox = sandboxElevationFor('codex', on);
     return {
       ok: true, accountId: wanted, label: row.label, mode: row.mode, signedIn: row.signedIn, identity: row.identity, home: row.home,
       env: { CODEX_HOME: row.home }, unset: [...CODEX_CREDENTIAL_ENV], apiKey,
       // Which credential a process started with: a change means the account's idle processes restart.
       credential: [row.mode || 'none', row.apiKey.source || '', row.apiKey.hint || '', row.subscription.email || ''].join(':'),
+      // The Windows sandbox it may use ('elevated' | 'unelevated'): a change restarts idle app-servers too.
+      windowsSandbox: sandbox.value, configArgs: sandbox.args,
     };
   }