windows-development-sandbox 0.0.0-stage → 1.0.5

package/schemas/sandbox-config.schema.json

@@ -0,0 +1,952 @@
+{
+  "title": "windows-development-sandbox project config (.sandbox-config.json)",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "Path or URL of the JSON Schema for editor autocomplete and docs."
+    },
+    "harness": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_-]+$",
+      "description": "Agent for this project."
+    },
+    "guestWorkspace": {
+      "anyOf": [
+        {
+          "type": "string",
+          "const": "auto"
+        },
+        {
+          "type": "string",
+          "const": "mirror"
+        },
+        {
+          "type": "string"
+        }
+      ],
+      "description": "Where the workspace appears inside the sandbox. \"auto\" = C:\\Workspace\\<folder name>. \"mirror\" = the same path as on this PC, so absolute paths in configs and build caches match (another drive letter such as F: is a subst drive onto C:\\Mirror\\F); paths the sandbox reserves (C:\\Users\\..., C:\\Program Files\\...) fall back to \"auto\"."
+    },
+    "readOnly": {
+      "type": "boolean",
+      "description": "Map this project read-only."
+    },
+    "mappings": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "host": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Folder on this PC (relative paths are relative to the config file)."
+          },
+          "guest": {
+            "type": "string",
+            "description": "Where it appears inside the sandbox, e.g. C:\\Assets, or on another drive letter (D: to Z:) such as F:\\SteamLibrary\\steamapps\\common\\Game: mapped to C:\\Mirror\\F\\... and shown as F: (subst) at boot."
+          },
+          "readOnly": {
+            "type": "boolean",
+            "description": "true = the agent can only read it."
+          },
+          "optional": {
+            "description": "true = skip it quietly when the host folder does not exist.",
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "host",
+          "guest",
+          "readOnly"
+        ],
+        "additionalProperties": false
+      },
+      "description": "Extra folders (relative to this file)."
+    },
+    "scripts": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "Scripts (.ps1 / .mjs / .cmd, relative to this file) run inside the sandbox before the agent."
+    },
+    "sandbox": {
+      "type": "object",
+      "properties": {
+        "memoryMb": {
+          "anyOf": [
+            {
+              "type": "string",
+              "const": "auto"
+            },
+            {
+              "type": "integer",
+              "minimum": 2048,
+              "maximum": 9007199254740991
+            }
+          ],
+          "description": "Sandbox RAM in MB (>= 2048), or \"auto\": free RAM minus reserveHostMb, capped at maxMemoryMb."
+        },
+        "maxMemoryMb": {
+          "type": "integer",
+          "exclusiveMinimum": 0,
+          "maximum": 9007199254740991,
+          "description": "Upper limit for memoryMb \"auto\"."
+        },
+        "reserveHostMb": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 9007199254740991,
+          "description": "RAM always left for this PC when memoryMb is \"auto\"."
+        },
+        "vGpu": {
+          "type": "boolean",
+          "description": "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface."
+        },
+        "networking": {
+          "type": "boolean",
+          "description": "Internet access. false is the only hard network isolation Windows Sandbox offers."
+        },
+        "clipboard": {
+          "type": "boolean",
+          "description": "Shared clipboard between this PC and the sandbox."
+        },
+        "audioInput": {
+          "type": "boolean",
+          "description": "Microphone access."
+        },
+        "videoInput": {
+          "type": "boolean",
+          "description": "Camera access."
+        },
+        "printerRedirection": {
+          "type": "boolean",
+          "description": "Printers from this PC."
+        },
+        "protectedClient": {
+          "type": "boolean",
+          "description": "Run the sandbox window in Protected Client mode (recommended)."
+        },
+        "headless": {
+          "type": "boolean",
+          "description": "Hide the sandbox window (sbx-show brings it back). A headless sandbox shuts down when its last session ends."
+        }
+      },
+      "additionalProperties": false
+    },
+    "network": {
+      "type": "object",
+      "properties": {
+        "blockPrivateRanges": {
+          "type": "boolean"
+        }
+      },
+      "additionalProperties": false
+    },
+    "provisioning": {
+      "type": "object",
+      "properties": {
+        "copyFromHost": {
+          "type": "boolean",
+          "description": "Copy Node, Git, nvm and the agent from this PC when they are installed here."
+        },
+        "fallbackToInstall": {
+          "type": "boolean",
+          "description": "Download anything that cannot be copied from this PC."
+        },
+        "refresh": {
+          "type": "boolean",
+          "description": "Re-copy / re-download everything on the next launch."
+        },
+        "git": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "Provide Git for Windows (and Git Bash, which Claude Code needs)."
+            },
+            "access": {
+              "type": "string",
+              "enum": [
+                "full",
+                "readonly",
+                "none"
+              ],
+              "description": "full: normal git. readonly: status/log/diff/show/blame only (no commit, push, checkout, ...). none: no git at all; .git is hidden from the agent."
+            }
+          },
+          "additionalProperties": false
+        },
+        "terminal": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "Windows Terminal as the sandbox window."
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    "toolchains": {
+      "type": "object",
+      "properties": {
+        "node": {
+          "type": "object",
+          "properties": {
+            "version": {
+              "type": "string",
+              "minLength": 1,
+              "description": "Default Node version for nvm. \"host\" = the Node on this PC. A project's .nvmrc / .node-version wins."
+            },
+            "extraVersions": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "More Node versions to install (switch with nvm use). On top of the up to 3 versions copied from this PC's nvm, not counted towards that limit."
+            },
+            "corepack": {
+              "type": "boolean",
+              "description": "pnpm and yarn through corepack (a project's \"packageManager\" in package.json picks the version)."
+            },
+            "volta": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "Volta: true, false, or \"auto\" = when the project's package.json has \"volta\" pins or this PC uses Volta. With pins, Volta's node/npm/yarn/pnpm come first on PATH."
+            },
+            "globalPackages": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "npm packages installed globally into the default Node version, installed once and kept (e.g. [\"typescript\", \"npm-check-updates\"])."
+            }
+          },
+          "additionalProperties": false
+        },
+        "python": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "Python 3 (CPython with pip). true, false, or \"auto\" = only when the project has pyproject.toml, requirements.txt, setup.py, Pipfile or .python-version."
+            },
+            "version": {
+              "type": "string",
+              "minLength": 1,
+              "description": "Python 3 version prefix, e.g. \"3\" or \"3.12\". A project's .python-version wins."
+            },
+            "python2": {
+              "type": "boolean",
+              "description": "Also install Python 2.7 as python2 / pip2."
+            },
+            "pyenv": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "pyenv-win (pyenv install / local / global): true, false, or \"auto\" = when this PC uses pyenv. .python-version is honoured either way, and `uv python install` always works."
+            },
+            "tools": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "Python command-line tools installed with `uv tool install` (needs uv), installed once and kept (e.g. [\"poetry\", \"ruff\", \"pre-commit\"])."
+            }
+          },
+          "additionalProperties": false
+        },
+        "rust": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "Rust via rustup (cargo, rustc). true, false, or \"auto\" = only when the project has Cargo.toml or rust-toolchain(.toml)."
+            },
+            "toolchain": {
+              "type": "string",
+              "minLength": 1,
+              "description": "Default toolchain, e.g. \"stable\". rust-toolchain.toml in a project wins."
+            },
+            "host": {
+              "type": "string",
+              "minLength": 1,
+              "description": "Host triple, or \"auto\": x86_64-pc-windows-msvc when the MSVC toolchain is on (like most PCs), else x86_64-pc-windows-gnu (MinGW is its linker)."
+            },
+            "components": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "Extra rustup components, installed once and kept (e.g. [\"rust-src\", \"llvm-tools\"])."
+            },
+            "targets": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "Extra rustup targets, installed once and kept (e.g. [\"wasm32-unknown-unknown\"])."
+            },
+            "crates": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "Binaries for cargo: prebuilt via cargo-binstall when the crate publishes a Windows build, else compiled with `cargo install --locked` (slow the first time), installed once and kept (e.g. [\"sccache\", \"cargo-nextest\", \"cargo-deny\"])."
+            },
+            "targetDir": {
+              "type": "string",
+              "minLength": 1,
+              "description": "\"shared\": cargo's default target\\ (shared with builds on this PC, so builds on either side invalidate the other), \"separate\": <workspace>\\target\\sandbox (kept, no cross-talk), \"local\": on the sandbox's own disk (fastest, lost every boot), or a guest path."
+            }
+          },
+          "additionalProperties": false
+        },
+        "msvc": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "MSVC (cl, link) and the Windows SDK, portable from Microsoft's Visual Studio manifest (~1-2 GB once), with vcvars64.bat and vswhere. true, false, or \"auto\" = only when the project has a .vcxproj, CMakePresets.json, a script calling vcvars/vswhere, or a Rust project when this PC builds Rust with MSVC."
+            },
+            "acceptLicense": {
+              "type": "boolean",
+              "description": "Required to install MSVC: you accept the Visual Studio licence terms (https://visualstudio.microsoft.com/license-terms/), which need a Visual Studio licence."
+            },
+            "msvcVersion": {
+              "type": "string",
+              "minLength": 1,
+              "description": "\"latest\" or an MSVC tools version prefix, e.g. \"14.44\"."
+            },
+            "sdkVersion": {
+              "type": "string",
+              "minLength": 1,
+              "description": "\"latest\" or a Windows SDK build, e.g. \"26100\" or \"10.0.22621\"."
+            }
+          },
+          "additionalProperties": false
+        },
+        "cpp": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "MinGW-w64 GCC with CMake, Ninja, premake5 and mingw32-make (also Rust's linker). true, false, or \"auto\" = only when the project has CMakeLists.txt, Makefile, meson.build, premake5.lua or Cargo.toml."
+            },
+            "flexBison": {
+              "type": "boolean",
+              "description": "win_flex / win_bison, the parser generators many C/C++ projects (game engines among them) need; CMake finds them."
+            }
+          },
+          "additionalProperties": false
+        },
+        "dotnet": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": ".NET SDK (C#, F#). true, false, or \"auto\" = only when the project has a .sln, .slnx, .csproj, .fsproj or global.json."
+            },
+            "channels": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "SDK channels, e.g. [\"LTS\", \"8.0\"]. A project's global.json is installed too."
+            },
+            "tools": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "Global .NET tools (`dotnet tool install -g`), installed once and kept (e.g. [\"dotnet-ef\", \"csharpier\"])."
+            },
+            "workloads": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "SDK workloads (`dotnet workload install`), installed once and kept (e.g. [\"aspire\", \"wasm-tools\"])."
+            },
+            "frameworkTargets": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": ".NET Framework reference assemblies (targeting packs) from NuGet, so net4x and old-style .csproj projects build without Visual Studio, e.g. [\"net48\", \"net472\", \"net462\"]. The 4.8 runtime itself ships with Windows."
+            },
+            "netfx35": {
+              "type": "boolean",
+              "description": ".NET Framework 3.5 runtime (a Windows feature, enabled from Windows Update on every boot; a few minutes)."
+            }
+          },
+          "additionalProperties": false
+        },
+        "go": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "Go. true, false, or \"auto\" = only when the project has go.mod or go.work."
+            },
+            "version": {
+              "type": "string",
+              "minLength": 1,
+              "description": "\"stable\" or a version prefix such as \"1.23\". A go.mod asking for newer fetches it itself (GOTOOLCHAIN=auto)."
+            },
+            "tools": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "Go tools (`go install <path>@<version>`), installed once and kept (e.g. [\"golang.org/x/tools/gopls@latest\"])."
+            }
+          },
+          "additionalProperties": false
+        },
+        "java": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "Java: Eclipse Temurin JDK. true, false, or \"auto\" = only when the project has pom.xml, build.gradle(.kts), settings.gradle(.kts), mvnw, gradlew or .java-version."
+            },
+            "version": {
+              "type": "string",
+              "minLength": 1,
+              "description": "\"lts\" (newest LTS) or a major version such as \"21\". A project's .java-version or .sdkmanrc wins."
+            },
+            "maven": {
+              "type": "boolean",
+              "description": "Apache Maven (mvn). A project's mvnw works either way."
+            },
+            "gradle": {
+              "type": "boolean",
+              "description": "Gradle (gradle). A project's gradlew works either way."
+            }
+          },
+          "additionalProperties": false
+        },
+        "ruby": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "Ruby (RubyInstaller, with gem and bundler). Gems with C extensions need MSYS2, which is not included. true, false, or \"auto\" = only when the project has Gemfile, a .gemspec or .ruby-version."
+            },
+            "version": {
+              "type": "string",
+              "minLength": 1,
+              "description": "Version prefix, e.g. \"3\" or \"3.3\". A project's .ruby-version wins."
+            },
+            "gems": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "Gems installed globally, installed once and kept (e.g. [\"rubocop\"])."
+            }
+          },
+          "additionalProperties": false
+        },
+        "php": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "PHP (with the Visual C++ runtime it needs, installed on every boot). true, false, or \"auto\" = only when the project has composer.json, artisan or .php-version."
+            },
+            "version": {
+              "type": "string",
+              "minLength": 1,
+              "description": "Version prefix, e.g. \"8\" or \"8.3\". A project's .php-version wins."
+            },
+            "composer": {
+              "type": "boolean",
+              "description": "Composer."
+            }
+          },
+          "additionalProperties": false
+        },
+        "deno": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "Deno. true, false, or \"auto\" = only when the project has deno.json, deno.jsonc or deno.lock."
+            }
+          },
+          "additionalProperties": false
+        },
+        "pwsh": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "PowerShell 7 (pwsh), portable (~110 MB once); `powershell` stays Windows PowerShell 5.1. true, false, or \"auto\" = when a .ps1 at the root or one folder down has #Requires -Version 7 / -PSEdition Core or a `pwsh ...` usage line, or, in a folder that is no project yet, when this PC has PowerShell 7."
+            }
+          },
+          "additionalProperties": false
+        },
+        "cli": {
+          "type": "object",
+          "properties": {
+            "gh": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "GitHub CLI (gh). Only with provisioning.git.access \"full\": gh can push and merge through the GitHub API, past a read-only git. Your PC's gh login is never copied; `gh auth login` inside persists (GH_CONFIG_DIR). \"auto\" = when the project has a .github folder."
+            },
+            "zstd": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "Zstandard (zstd). \"auto\" = off; set true to get it."
+            },
+            "openssl": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "`openssl` on PATH, from the copy Git for Windows ships (its mingw64\\bin is not put on PATH, so it cannot shadow MinGW's gcc). \"auto\" = on."
+            }
+          },
+          "additionalProperties": false
+        },
+        "bun": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "Bun runtime (claude-mem needs it)."
+            }
+          },
+          "additionalProperties": false
+        },
+        "uv": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "uv, the Python package manager (claude-mem needs it)."
+            }
+          },
+          "additionalProperties": false
+        },
+        "vcRuntime": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "Microsoft Visual C++ runtime for tools that need it (a real installer, so it runs on every boot, ~15 s). PHP installs it regardless."
+            }
+          },
+          "additionalProperties": false
+        },
+        "mesa": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "Mesa 3D (llvmpipe): OpenGL 4.5 in software for games and apps when there is no GPU (sandbox.vGpu off). Copy opengl32.dll and libgallium_wgl.dll from %MESA_DIR% next to the program's .exe."
+            },
+            "vulkan": {
+              "type": "boolean",
+              "description": "Also software Vulkan 1.4 (Mesa lavapipe) with the Khronos loader, registered for every program; for wgpu set WGPU_BACKEND=vulkan."
+            }
+          },
+          "additionalProperties": false
+        },
+        "vscode": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "Portable VS Code inside the sandbox (code on PATH, desktop shortcut); its settings and extensions persist."
+            }
+          },
+          "additionalProperties": false
+        },
+        "environment": {
+          "type": "object",
+          "propertyNames": {
+            "type": "string",
+            "pattern": "^[A-Za-z_][A-Za-z0-9_]*$"
+          },
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "Extra environment variables for the agent and every terminal, e.g. registry mirrors: {\"NPM_CONFIG_REGISTRY\": \"https://...\", \"PIP_INDEX_URL\": \"https://...\"}."
+        }
+      },
+      "additionalProperties": false
+    },
+    "databases": {
+      "type": "object",
+      "properties": {
+        "postgres": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "PostgreSQL (with psql, pg_dump). User postgres, no password, localhost only: true, false, or \"auto\" = only when the project needs it (found from compose files, dependencies of every language, Prisma/ORM config and connection strings)."
+            },
+            "version": {
+              "type": "string",
+              "minLength": 1,
+              "description": "\"latest\" or a major version such as \"16\". A compose file pinning postgres:<major> wins."
+            },
+            "port": {
+              "type": "integer",
+              "minimum": 1024,
+              "maximum": 65535,
+              "description": "Port inside the sandbox."
+            }
+          },
+          "additionalProperties": false
+        },
+        "mysql": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "MySQL-compatible database (MariaDB). User root, no password, localhost only: true, false, or \"auto\" = only when the project needs it (found from compose files, dependencies of every language, Prisma/ORM config and connection strings)."
+            },
+            "version": {
+              "type": "string",
+              "minLength": 1,
+              "description": "\"lts\" (newest MariaDB LTS) or a MariaDB series such as \"11.4\"."
+            },
+            "port": {
+              "type": "integer",
+              "minimum": 1024,
+              "maximum": 65535,
+              "description": "Port inside the sandbox."
+            }
+          },
+          "additionalProperties": false
+        },
+        "mongodb": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "MongoDB with mongosh, localhost only: true, false, or \"auto\" = only when the project needs it (found from compose files, dependencies of every language, Prisma/ORM config and connection strings)."
+            },
+            "version": {
+              "type": "string",
+              "minLength": 1,
+              "description": "\"latest\" or a version prefix such as \"8.0\"."
+            },
+            "port": {
+              "type": "integer",
+              "minimum": 1024,
+              "maximum": 65535,
+              "description": "Port inside the sandbox."
+            }
+          },
+          "additionalProperties": false
+        },
+        "redis": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "Redis (community Windows build), localhost only: true, false, or \"auto\" = only when the project needs it (found from compose files, dependencies of every language, Prisma/ORM config and connection strings)."
+            },
+            "port": {
+              "type": "integer",
+              "minimum": 1024,
+              "maximum": 65535,
+              "description": "Port inside the sandbox."
+            }
+          },
+          "additionalProperties": false
+        },
+        "dynamodb": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "DynamoDB Local (Amazon's official emulator, on the Java toolchain) with dynamodb-admin, a web UI to browse and edit tables: true, false, or \"auto\" = only when the project needs it (found from compose files, dependencies of every language, Prisma/ORM config and connection strings)."
+            },
+            "port": {
+              "type": "integer",
+              "minimum": 1024,
+              "maximum": 65535,
+              "description": "DynamoDB endpoint port inside the sandbox (http://localhost:<port>)."
+            },
+            "adminPort": {
+              "type": "integer",
+              "minimum": 1024,
+              "maximum": 65535,
+              "description": "dynamodb-admin web UI port (open http://localhost:<adminPort> in the sandbox's browser)."
+            },
+            "admin": {
+              "type": "boolean",
+              "description": "Run dynamodb-admin next to DynamoDB Local."
+            }
+          },
+          "additionalProperties": false
+        },
+        "sqlserver": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "SQL Server. It cannot run inside Windows Sandbox; when a project needs it you get a hint to reach the one on this PC through hostAccess.forwards: true, false, or \"auto\" = only when the project needs it (found from compose files, dependencies of every language, Prisma/ORM config and connection strings)."
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    "attach": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Allow sandbox claude --terminal / sandbox attach from this PC."
+        },
+        "reuseSession": {
+          "type": "boolean",
+          "description": "sandbox claude -t in a running sandbox reattaches to this folder's session when no terminal on this PC is attached to it (--new always starts another)."
+        },
+        "auto": {
+          "type": "boolean",
+          "description": "Starting an agent attaches this terminal automatically, as if you passed -t (only in an interactive terminal)."
+        },
+        "autoHide": {
+          "type": "boolean",
+          "description": "Hide the Windows Sandbox window whenever this terminal attaches; it keeps running (sandbox show brings it back)."
+        }
+      },
+      "additionalProperties": false
+    },
+    "personalization": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Copy your desktop look into the sandbox."
+        }
+      },
+      "additionalProperties": false
+    },
+    "claudeProfile": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Copy selected Claude settings from this PC into the sandbox."
+        },
+        "include": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9._-]+$"
+          },
+          "description": "Files and folders copied from it."
+        },
+        "overwrite": {
+          "type": "boolean",
+          "description": "Refresh these settings from this PC on every launch."
+        },
+        "copyCredentials": {
+          "type": "boolean",
+          "description": "Copy your Claude LOGIN into the sandbox. Prefer sandbox account instead."
+        },
+        "syncHistory": {
+          "type": "boolean",
+          "description": "Bring all conversation history in, and sync new history back (path-translated)."
+        },
+        "syncClaudeMem": {
+          "type": "boolean",
+          "description": "Bring claude-mem data in, and its database back when the sandbox closes."
+        }
+      },
+      "additionalProperties": false
+    },
+    "hooks": {
+      "type": "object",
+      "properties": {
+        "failFast": {
+          "type": "boolean"
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  "additionalProperties": false
+}