windows-development-sandbox 0.0.0-stage → 1.0.5

package/dist/cli/settings.js

@@ -0,0 +1,156 @@
+// The settings screen in the menu: every setting, generated from the zod schema (so nothing needs to be listed by
+// hand), shown with its current value and description, edited with a fitting prompt and saved to the user config
+// file. Edits go through jsonc-parser, so comments and formatting in the file are kept, and nothing is written unless
+// the whole config is still valid.
+import fs from 'node:fs';
+import path from 'node:path';
+import { input, select, Separator } from '@inquirer/prompts';
+import { applyEdits, modify, parse } from 'jsonc-parser';
+import _ from 'lodash';
+import { DEFAULTS, loadConfig, mergeConfig, userConfigPath } from '../core/config.js';
+import { Config as ConfigSchema, describeIssues } from '../core/schema.js';
+const c = { dim: (s) => '\x1b[2m' + s + '\x1b[0m', cyan: (s) => '\x1b[36m' + s + '\x1b[0m', green: (s) => '\x1b[32m' + s + '\x1b[0m', yellow: (s) => '\x1b[33m' + s + '\x1b[0m', red: (s) => '\x1b[31m' + s + '\x1b[0m' };
+/** optional()/default() wrappers hide the real type. */
+const unwrap = (s) => (['optional', 'default', 'nullable'].includes(s._zod.def.type) && s._zod.def.innerType ? unwrap(s._zod.def.innerType) : s);
+const kind = (s) => unwrap(s)._zod.def.type;
+const isSection = (s) => kind(s) === 'object' && Boolean(unwrap(s).shape);
+/** Settings not worth editing here (the schema link) or better edited in the file (agent definitions). */
+const HIDDEN = new Set(['$schema']);
+/** A value in one short line: maps as their keys, long lists shortened. */
+const show = (value) => {
+    if (value === undefined)
+        return c.dim('(not set)');
+    if (typeof value === 'string')
+        return value;
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        const keys = Object.keys(value);
+        return keys.length ? '{ ' + _.truncate(keys.join(', '), { length: 60 }) + ' }' : '{}';
+    }
+    return _.truncate(JSON.stringify(value), { length: 70 });
+};
+/** What the value is in the file the user owns (undefined when it comes from the built-in defaults). */
+const fileValue = (text, key) => _.get(parse(text) ?? {}, key);
+/**
+ * Applies one change (undefined = back to the default) to the config text and returns the new text, or the problems
+ * that make the result invalid. Pure: the caller writes the file.
+ */
+export const editConfigText = (text, key, value) => {
+    const edits = modify(text || '{}', key, value, { formattingOptions: { insertSpaces: true, tabSize: 2, eol: '\n' } });
+    const next = applyEdits(text || '{}', edits);
+    const parsed = ConfigSchema.safeParse(mergeConfig(DEFAULTS, parse(next) ?? {}));
+    return parsed.success ? { text: next.endsWith('\n') ? next : next + '\n' } : { problems: describeIssues(parsed.error) };
+};
+/** A prompt that fits the setting's type; returns the new value, or undefined to change nothing. */
+const askValue = async (schema, label, current, config) => {
+    const s = unwrap(schema);
+    // The default agent is one of the configured ones: a list, not free text.
+    if (label === 'defaultHarness' && config) {
+        const v = await select({ message: label, choices: [...Object.keys(config.harnesses).map((h) => ({ name: h, value: h })), { name: c.dim('< cancel'), value: '@cancel' }], default: current });
+        return v === '@cancel' ? undefined : { value: v };
+    }
+    const t = s._zod.def.type;
+    const back = { name: c.dim('< cancel'), value: '@cancel' };
+    const pick = async (choices) => {
+        const v = await select({ message: label, choices: [...choices, back], default: current });
+        return v === '@cancel' ? undefined : { value: v };
+    };
+    if (t === 'boolean')
+        return pick([{ name: 'true', value: true }, { name: 'false', value: false }]);
+    if (t === 'enum')
+        return pick(Object.values(s._zod.def.entries ?? {}).map((v) => ({ name: String(v), value: v })));
+    if (t === 'union') {
+        const options = s._zod.def.options ?? [];
+        const literals = options.filter((o) => kind(o) === 'literal').flatMap((o) => unwrap(o)._zod.def.values ?? []);
+        const hasBool = options.some((o) => kind(o) === 'boolean');
+        const other = options.find((o) => !['literal', 'boolean'].includes(kind(o)));
+        const choices = [...(hasBool ? [{ name: 'true', value: true }, { name: 'false', value: false }] : []), ...literals.map((v) => ({ name: String(v), value: v }))];
+        if (!other)
+            return pick(choices);
+        const chosen = await pick([...choices, { name: 'a ' + kind(other) + ' ...', value: '@other' }]);
+        return chosen?.value === '@other' ? askValue(other, label, current) : chosen;
+    }
+    const typed = async (validate, convert) => {
+        const answer = await input({ message: label + c.dim(' (empty = cancel)'), default: current === undefined ? '' : typeof current === 'string' ? current : JSON.stringify(current), validate: (v) => (v === '' ? true : validate(v)) });
+        return answer === '' ? undefined : { value: convert(answer) };
+    };
+    if (t === 'number')
+        return typed((v) => (Number.isFinite(Number(v)) ? true : 'a number'), Number);
+    if (t === 'string')
+        return typed(() => true, (v) => v);
+    if (t === 'array' && kind(s._zod.def.element) === 'string') {
+        return typed(() => true, (v) => (v.trim() === '[]' ? [] : v.split(',').map((x) => x.trim()).filter(Boolean)));
+    }
+    // Lists of objects and maps (mappings, harnesses, environment): edited as JSON.
+    return typed((v) => { try {
+        JSON.parse(v);
+        return true;
+    }
+    catch {
+        return 'valid JSON';
+    } }, (v) => JSON.parse(v));
+};
+/** Edits one setting: shows it, asks, saves (or resets it to the default). */
+const editSetting = async (schema, key, config, file) => {
+    const text = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
+    const inFile = fileValue(text, key);
+    console.log('\n' + c.cyan(key.join('.')) + (schema.description ? '\n' + c.dim(schema.description) : ''));
+    console.log('Now: ' + show(_.get(config, key)) + (inFile === undefined ? c.dim('  (built-in default)') : c.dim('  (set in ' + file + ')')));
+    const action = inFile === undefined ? 'change' : await select({ message: 'What now?', choices: [{ name: 'Change it', value: 'change' }, { name: 'Reset to the default (' + show(_.get(DEFAULTS, key)) + ')', value: 'reset' }, { name: c.dim('< back'), value: 'back' }] });
+    if (action === 'back')
+        return;
+    const answer = action === 'reset' ? { value: undefined } : await askValue(schema, key.join('.'), _.get(config, key), config);
+    if (!answer)
+        return;
+    // The default needs no line in the file; an unchanged value needs no save.
+    const value = _.isEqual(answer.value, _.get(DEFAULTS, key)) ? undefined : answer.value;
+    if (value === inFile && _.isEqual(answer.value, _.get(config, key))) {
+        console.log(c.dim('Unchanged.'));
+        return;
+    }
+    const result = editConfigText(text, key, value);
+    if ('problems' in result) {
+        console.log(c.red('Not saved: ') + result.problems.join('; '));
+        return;
+    }
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, result.text, 'utf8');
+    console.log(c.green('Saved') + c.dim(' to ' + file + '. New sandboxes use it.'));
+};
+const SECTION_TITLES = {
+    toolchains: 'Languages and tools', databases: 'Databases', sandbox: 'The sandbox machine (memory, window, GPU, network)', attach: 'Attaching (auto attach, auto hide)',
+    provisioning: 'Provisioning and git', secrets: 'Secrets', claudeProfile: 'Your Claude settings and history', storage: 'Storage', network: 'Network', hooks: 'Hooks', personalization: 'Desktop look',
+};
+/** Browses one level of settings; sections open, leaves are edited. */
+const browse = async (schema, key, file) => {
+    for (;;) {
+        const config = loadConfig().config;
+        const entries = Object.entries(unwrap(schema).shape ?? {}).filter(([name]) => !HIDDEN.has(name));
+        const text = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
+        const pickName = await select({
+            message: key.length ? key.join('.') : 'Settings ' + c.dim('(saved to ' + file + ')'),
+            pageSize: 18,
+            choices: [
+                ...entries.map(([name, s]) => {
+                    const full = [...key, name];
+                    const changed = fileValue(text, full) !== undefined;
+                    const label = isSection(s) ? (key.length ? name : SECTION_TITLES[name] ?? name) + c.dim(' ...') : name.padEnd(18) + ' ' + (changed ? c.yellow(show(_.get(config, full))) : show(_.get(config, full)));
+                    return { name: label, value: name, description: s.description };
+                }),
+                new Separator(),
+                { name: c.dim('< back'), value: '@back' },
+            ],
+        });
+        if (pickName === '@back')
+            return;
+        const child = unwrap(schema).shape[pickName];
+        if (isSection(child))
+            await browse(child, [...key, pickName], file);
+        else
+            await editSetting(child, [...key, pickName], config, file);
+    }
+};
+/** The settings screen. Changes are saved to the user config file (created when missing). */
+export const settingsMenu = async (configPath) => {
+    const file = configPath ?? userConfigPath();
+    await browse(ConfigSchema, [], file);
+};

package/dist/core/config.d.ts

@@ -0,0 +1,17 @@
+import type { Config, LoadedConfig } from './types.js';
+export declare const DEFAULTS: Config;
+/** Per-user folder for config and hooks. Survives reinstalling the npm package. */
+export declare const userDir: () => string;
+export declare const userConfigPath: () => string;
+/** Deep merge where arrays (and anything that is not a plain object) replace instead of merging element by element. */
+export declare const mergeConfig: <T>(base: T, extra: unknown) => T;
+/** Validates a full config; throws one readable error listing every problem. */
+export declare const validateConfig: (config: unknown, source: string) => Config;
+/**
+ * Lookup order: --config, %AGENT_SANDBOX_CONFIG%, ~/.agent-sandbox/config.json, built-in defaults.
+ * Whatever file is found (JSON with comments) is merged over the defaults, so it only needs the keys you change.
+ */
+export declare const loadConfig: (explicitPath?: string) => LoadedConfig;
+export declare const assertNoGuestOverlap: (mappings: {
+    guest: string;
+}[]) => void;

package/dist/core/config.js

@@ -0,0 +1,103 @@
+// Built-in defaults and loading the user config (~/.agent-sandbox/config.json). Shapes live in schema.ts.
+import fs from 'node:fs';
+import path from 'node:path';
+import _ from 'lodash';
+import { Config as ConfigSchema, describeIssues } from './schema.js';
+import { fail, homeDir, readJsonc } from './util.js';
+export const DEFAULTS = {
+    defaultHarness: 'claude',
+    guestWorkspace: 'auto',
+    readOnly: false,
+    mappings: [],
+    sandbox: { memoryMb: 'auto', maxMemoryMb: 32768, reserveHostMb: 8192, vGpu: false, networking: true, clipboard: true, audioInput: false, videoInput: false, printerRedirection: false, protectedClient: true, headless: false },
+    storage: { root: '%LOCALAPPDATA%\\AgentSandbox', persistAgentState: true, dataName: 'default' },
+    network: { blockPrivateRanges: true },
+    provisioning: { copyFromHost: true, fallbackToInstall: true, refresh: false, git: { enabled: true, access: 'full' }, terminal: { enabled: true } },
+    toolchains: {
+        node: { version: 'host', extraVersions: [], corepack: true, volta: 'auto', globalPackages: [] },
+        python: { enabled: 'auto', version: '3', python2: true, pyenv: 'auto', tools: [] },
+        rust: { enabled: 'auto', toolchain: 'stable', host: 'auto', components: [], targets: [], crates: [], targetDir: 'separate' },
+        msvc: { enabled: 'auto', acceptLicense: false, msvcVersion: 'latest', sdkVersion: 'latest' },
+        cpp: { enabled: 'auto', flexBison: true },
+        dotnet: { enabled: 'auto', channels: ['LTS'], tools: [], workloads: [], frameworkTargets: ['net48', 'net472'], netfx35: false },
+        // Bigger downloads only for projects that use them.
+        go: { enabled: 'auto', version: 'stable', tools: [] },
+        java: { enabled: 'auto', version: 'lts', maven: true, gradle: true },
+        ruby: { enabled: 'auto', version: '3', gems: [] },
+        php: { enabled: 'auto', version: '8', composer: true },
+        deno: { enabled: 'auto' },
+        pwsh: { enabled: 'auto' },
+        cli: { gh: 'auto', zstd: false, openssl: 'auto' },
+        bun: { enabled: true },
+        uv: { enabled: true },
+        vcRuntime: { enabled: false },
+        mesa: { enabled: false, vulkan: false },
+        vscode: { enabled: true },
+        environment: {},
+    },
+    databases: {
+        postgres: { enabled: 'auto', version: 'latest', port: 5432 },
+        mysql: { enabled: 'auto', version: 'lts', port: 3306 },
+        mongodb: { enabled: 'auto', version: 'latest', port: 27017 },
+        redis: { enabled: 'auto', port: 6379 },
+        dynamodb: { enabled: 'auto', port: 8000, adminPort: 8001, admin: true },
+        sqlserver: { enabled: 'auto' },
+    },
+    attach: { enabled: true, reuseSession: true, auto: false, autoHide: false },
+    secrets: { strip: true, allow: [], patterns: [], warnFiles: true },
+    personalization: { enabled: true },
+    claudeProfile: { enabled: true, hostDir: 'auto', include: ['settings.json', 'CLAUDE.md', 'commands', 'agents', 'skills', 'plugins'], globalStateFile: 'auto', copyCredentials: false, overwrite: true, syncHistory: true, syncClaudeMem: true },
+    harnesses: {
+        claude: { hostExecutable: 'claude.exe', hostDir: 'auto', npmPackage: '@anthropic-ai/claude-code@latest', npmBin: 'claude', arguments: [], environment: { DISABLE_AUTOUPDATER: '1' }, resumeArguments: ['--continue'] },
+        codex: { npmPackage: '@openai/codex@latest', npmBin: 'codex', arguments: [], environment: {}, resumeArguments: ['resume', '--last'] },
+        gemini: { npmPackage: '@google/gemini-cli@latest', npmBin: 'gemini', arguments: [], environment: {}, resumeArguments: ['--resume'] },
+        // Not tested by us; installed from each project's official npm / PyPI package.
+        opencode: { npmPackage: 'opencode-ai@latest', npmBin: 'opencode', arguments: [], environment: {}, resumeArguments: ['--continue'] },
+        qwen: { npmPackage: '@qwen-code/qwen-code@latest', npmBin: 'qwen', arguments: [], environment: {}, resumeArguments: ['--continue'] },
+        crush: { npmPackage: '@charmland/crush@latest', npmBin: 'crush', arguments: [], environment: {}, resumeArguments: ['--continue'] },
+        copilot: { npmPackage: '@github/copilot@latest', npmBin: 'copilot', arguments: [], environment: {}, resumeArguments: ['--continue'] },
+        kilo: { npmPackage: '@kilocode/cli@latest', npmBin: 'kilo', arguments: [], environment: {}, resumeArguments: ['--continue'] },
+        amp: { npmPackage: '@ampcode/cli@latest', npmBin: 'amp', arguments: [], environment: {} },
+        cline: { npmPackage: 'cline@latest', npmBin: 'cline', arguments: [], environment: {} },
+        continue: { npmPackage: '@continuedev/cli@latest', npmBin: 'cn', arguments: [], environment: {}, resumeArguments: ['--resume'] },
+        kimi: { npmPackage: '@moonshot-ai/kimi-code@latest', npmBin: 'kimi', arguments: [], environment: {}, resumeArguments: ['-c'] },
+        // DeepSeek has no official coding CLI; these two community agents are built for it.
+        reasonix: { npmPackage: 'reasonix@latest', npmBin: 'reasonix', arguments: [], environment: {} },
+        deepseek: { npmPackage: 'codewhale@latest', npmBin: 'codewhale', arguments: [], environment: {} },
+        aider: { uvPackage: 'aider-chat', uvBin: 'aider', arguments: [], environment: {}, resumeArguments: ['--restore-chat-history'] },
+    },
+    hooks: { failFast: false },
+};
+/** Per-user folder for config and hooks. Survives reinstalling the npm package. */
+export const userDir = () => process.env.AGENT_SANDBOX_HOME ?? path.join(homeDir(), '.agent-sandbox');
+export const userConfigPath = () => path.join(userDir(), 'config.json');
+/** Deep merge where arrays (and anything that is not a plain object) replace instead of merging element by element. */
+export const mergeConfig = (base, extra) => _.mergeWith(_.cloneDeep(base), extra, (_target, source) => (Array.isArray(source) ? source : undefined));
+/** Validates a full config; throws one readable error listing every problem. */
+export const validateConfig = (config, source) => {
+    const parsed = ConfigSchema.safeParse(config);
+    if (!parsed.success)
+        fail(source + ' is not valid:\n  - ' + describeIssues(parsed.error).join('\n  - '));
+    return parsed.data;
+};
+/**
+ * Lookup order: --config, %AGENT_SANDBOX_CONFIG%, ~/.agent-sandbox/config.json, built-in defaults.
+ * Whatever file is found (JSON with comments) is merged over the defaults, so it only needs the keys you change.
+ */
+export const loadConfig = (explicitPath) => {
+    const requested = explicitPath ?? process.env.AGENT_SANDBOX_CONFIG;
+    const full = path.resolve(requested ?? userConfigPath());
+    if (!fs.existsSync(full)) {
+        if (requested)
+            fail('Config file not found: ' + full, 'Check the --config path or AGENT_SANDBOX_CONFIG, or create one with: sandbox config init');
+        return { config: structuredClone(DEFAULTS), configPath: null, base: userDir() };
+    }
+    return { config: validateConfig(mergeConfig(DEFAULTS, readJsonc(full)), full), configPath: full, base: path.dirname(full) };
+};
+export const assertNoGuestOverlap = (mappings) => {
+    const normal = mappings.map((m) => m.guest.replace(/\\+$/, '').toLowerCase());
+    normal.forEach((a, i) => normal.slice(i + 1).forEach((b, j) => {
+        if (a === b || a.startsWith(b + '\\') || b.startsWith(a + '\\'))
+            fail('Two folders map to overlapping places in the sandbox: ' + mappings[i].guest + ' and ' + mappings[i + 1 + j].guest + '.', 'Give each mapping its own guest folder (one must not be inside the other).');
+    }));
+};

package/dist/core/detect-databases.d.ts

@@ -0,0 +1,15 @@
+export declare const DATABASES: readonly ["postgres", "mysql", "sqlserver", "mongodb", "redis", "dynamodb"];
+export type Database = (typeof DATABASES)[number];
+export interface ProjectFile {
+    path: string;
+    text: string;
+}
+/** Files worth reading, by name (lower case). Everything else is ignored, so a scan stays fast on big repos. */
+export declare const INTERESTING_FILE: RegExp;
+export interface Detection {
+    database: Database;
+    reasons: string[];
+}
+export declare const detectDatabases: (input: ProjectFile[], hostHas?: Database[] | (() => Database[])) => Detection[];
+/** Windows service names of databases installed on this PC (from `sc query`), e.g. postgresql-x64-16, MySQL80. */
+export declare const databasesFromServices: (serviceNames: string[]) => Database[];

package/dist/core/detect-databases.js

@@ -0,0 +1,147 @@
+// Which databases a project needs, worked out from its files: compose files, dependency manifests of every ecosystem,
+// ORM schemas, connection strings and .env templates. Pure (file contents in, verdicts out), so the host can run it at
+// launch and the tests can feed it fixtures.
+export const DATABASES = ['postgres', 'mysql', 'sqlserver', 'mongodb', 'redis', 'dynamodb'];
+/** Files worth reading, by name (lower case). Everything else is ignored, so a scan stays fast on big repos. */
+export const INTERESTING_FILE = /^(package\.json|requirements[\w.-]{0,40}\.txt|pyproject\.toml|pipfile|setup\.py|setup\.cfg|gemfile|go\.mod|cargo\.toml|composer\.json|pom\.xml|build\.gradle(\.kts)?|[\w.-]+\.(cs|fs|vb)proj|directory\.packages\.props|packages\.config|schema\.prisma|(docker-)?compose[\w.-]{0,40}\.ya?ml|\.env(\.[\w.-]+)?|appsettings[\w.-]{0,40}\.json|database\.yml|application[\w.-]{0,40}\.(properties|ya?ml)|knexfile\.[jt]s|ormconfig\.(json|[jt]s)|drizzle\.config\.[jt]s|alembic\.ini|settings\.py|mix\.exs|deno\.json|serverless\.ya?ml|template\.ya?ml|samconfig\.toml|[\w.-]+\.tf|cdk\.json)$/i;
+const manifests = /^(package\.json|deno\.json)$/i;
+const python = /^(requirements[\w.-]{0,40}\.txt|pyproject\.toml|pipfile|setup\.py|setup\.cfg)$/i;
+const dotnet = /\.(cs|fs|vb)proj$|^directory\.packages\.props$|^packages\.config$/i;
+const jvm = /^(pom\.xml|build\.gradle(\.kts)?)$/i;
+const compose = /^(docker-)?compose[\w.-]{0,40}\.ya?ml$/i;
+const config = /^(\.env(\.[\w.-]+)?|appsettings[\w.-]{0,40}\.json|database\.yml|application[\w.-]{0,40}\.(properties|ya?ml)|knexfile\.[jt]s|ormconfig\.(json|[jt]s)|drizzle\.config\.[jt]s|alembic\.ini|settings\.py)$/i;
+const infra = /^(serverless\.ya?ml|template\.ya?ml|[\w.-]+\.tf)$/i;
+const dep = (names) => new RegExp('["\'\\s/=]?(' + names + ')["\'\\s@=<>~^:,\\]\\n]', 'i');
+const RULES = {
+    postgres: [
+        [compose, /image:\s*["']?[\w./-]{0,80}(postgres|postgis|timescaledb|supabase\/postgres|pgvector)[\w.-]{0,40}(:|\s|["']|$)/im, 'a compose service runs Postgres'],
+        [manifests, dep('pg|postgres|pg-promise|@neondatabase/serverless|@vercel/postgres|slonik|postgres-js|@electric-sql/pglite'), 'a Postgres driver in package.json'],
+        [python, dep('psycopg2?(-binary)?|psycopg\\[[\\w,]+\\]|asyncpg|pg8000|django\\.db\\.backends\\.postgresql'), 'a Postgres driver in the Python dependencies'],
+        [/^gemfile$/i, /gem\s+["']pg["']/, 'the pg gem'],
+        [/^go\.mod$/i, /github\.com\/(jackc\/pgx|lib\/pq)/, 'a Postgres driver in go.mod'],
+        [/^cargo\.toml$/i, /tokio-postgres|postgres\s*=|sqlx[^\n]{0,200}postgres|diesel[^\n]{0,200}postgres|sea-orm[^\n]{0,200}postgres/i, 'a Postgres driver in Cargo.toml'],
+        [dotnet, /Npgsql/i, 'Npgsql in a .NET project'],
+        [jvm, /org\.postgresql|postgresql:postgresql|r2dbc-postgresql/i, 'the Postgres JDBC driver'],
+        [/^composer\.json$/i, /ext-pgsql|ext-pdo_pgsql/i, 'the PHP Postgres extension'],
+        [/^mix\.exs$/i, /:postgrex/, 'Postgrex'],
+        [/^schema\.prisma$/i, /provider\s*=\s*"(postgresql|postgres|cockroachdb)"/, 'Prisma uses PostgreSQL'],
+        [config, /postgres(ql)?(\+\w+)?:\/\/|DB_CONNECTION\s*=\s*pgsql|adapter:\s*postgres|\bHost=[^;\s]{1,200};\s*(Port=\d{1,5};\s*)?Database=|jdbc:postgresql:/i, 'a Postgres connection string'],
+    ],
+    mysql: [
+        [compose, /image:\s*["']?[\w./-]{0,80}(mysql|mariadb|percona)[\w.-]{0,40}(:|\s|["']|$)/im, 'a compose service runs MySQL / MariaDB'],
+        [manifests, dep('mysql2?|mariadb|@planetscale/database'), 'a MySQL driver in package.json'],
+        [python, dep('pymysql|mysqlclient|mysql-connector-python|aiomysql|asyncmy|mariadb'), 'a MySQL driver in the Python dependencies'],
+        [/^gemfile$/i, /gem\s+["'](mysql2|trilogy)["']/, 'a MySQL gem'],
+        [/^go\.mod$/i, /github\.com\/go-sql-driver\/mysql/, 'the MySQL driver in go.mod'],
+        [/^cargo\.toml$/i, /mysql_async|mysql\s*=|sqlx[^\n]{0,200}mysql|diesel[^\n]{0,200}mysql/i, 'a MySQL driver in Cargo.toml'],
+        [dotnet, /MySqlConnector|MySql\.Data|Pomelo\.EntityFrameworkCore\.MySql/i, 'a MySQL driver in a .NET project'],
+        [jvm, /mysql-connector|mariadb-java-client|com\.mysql/i, 'the MySQL JDBC driver'],
+        [/^composer\.json$/i, /ext-mysqli|ext-pdo_mysql/i, 'the PHP MySQL extension'],
+        [/^mix\.exs$/i, /:myxql/, 'MyXQL'],
+        [/^schema\.prisma$/i, /provider\s*=\s*"mysql"/, 'Prisma uses MySQL'],
+        [config, /(mysql|mariadb)(\+\w+)?:\/\/|DB_CONNECTION\s*=\s*(mysql|mariadb)|adapter:\s*(mysql2|trilogy)|jdbc:(mysql|mariadb):/i, 'a MySQL connection string'],
+    ],
+    sqlserver: [
+        [compose, /image:\s*["']?(mcr\.microsoft\.com\/(mssql|azure-sql-edge)|[\w./-]{0,80}mssql)[\w./:-]{0,80}/im, 'a compose service runs SQL Server'],
+        [manifests, dep('mssql|tedious|msnodesqlv8'), 'a SQL Server driver in package.json'],
+        [python, dep('pyodbc|pymssql|aioodbc|mssql-django'), 'a SQL Server driver in the Python dependencies'],
+        [/^go\.mod$/i, /(denisenkom|microsoft)\/go-mssqldb/, 'the SQL Server driver in go.mod'],
+        [/^cargo\.toml$/i, /tiberius|sqlx[^\n]{0,200}mssql/i, 'a SQL Server driver in Cargo.toml'],
+        [dotnet, /Microsoft\.Data\.SqlClient|System\.Data\.SqlClient|EntityFrameworkCore\.SqlServer|Dapper\.SqlBuilder|LocalDb/i, 'SQL Server in a .NET project'],
+        [jvm, /mssql-jdbc|com\.microsoft\.sqlserver/i, 'the SQL Server JDBC driver'],
+        [/^composer\.json$/i, /ext-sqlsrv|ext-pdo_sqlsrv/i, 'the PHP SQL Server extension'],
+        [/^schema\.prisma$/i, /provider\s*=\s*"sqlserver"/, 'Prisma uses SQL Server'],
+        [config, /\(localdb\)|mssql(\+\w+)?:\/\/|sqlserver:\/\/|DB_CONNECTION\s*=\s*sqlsrv|jdbc:sqlserver:|Initial Catalog=|Trusted_Connection=|TrustServerCertificate=|Integrated Security=/i, 'a SQL Server connection string'],
+    ],
+    mongodb: [
+        [compose, /image:\s*["']?[\w./-]{0,80}mongo(db)?[\w.-]{0,40}(:|\s|["']|$)/im, 'a compose service runs MongoDB'],
+        [manifests, dep('mongodb|mongoose|@typegoose/typegoose|mongodb-memory-server'), 'a MongoDB driver in package.json'],
+        [python, dep('pymongo|motor|mongoengine|beanie|djongo'), 'a MongoDB driver in the Python dependencies'],
+        [/^gemfile$/i, /gem\s+["'](mongoid|mongo)["']/, 'a MongoDB gem'],
+        [/^go\.mod$/i, /go\.mongodb\.org\/mongo-driver/, 'the MongoDB driver in go.mod'],
+        [/^cargo\.toml$/i, /^\s*mongodb\s*=/m, 'the MongoDB crate'],
+        [dotnet, /MongoDB\.Driver|MongoDB\.EntityFrameworkCore/i, 'the MongoDB driver in a .NET project'],
+        [jvm, /mongodb-driver|spring-boot-starter-data-mongodb/i, 'the MongoDB Java driver'],
+        [/^schema\.prisma$/i, /provider\s*=\s*"mongodb"/, 'Prisma uses MongoDB'],
+        [config, /mongodb(\+srv)?:\/\//i, 'a MongoDB connection string'],
+    ],
+    dynamodb: [
+        [compose, /image:\s*["']?(amazon\/dynamodb-local|[\w./-]{0,80}dynamodb-local|instructure\/dynamo-local-admin)[\w.:-]{0,40}/im, 'a compose service runs DynamoDB Local'],
+        [manifests, dep('@aws-sdk/client-dynamodb|@aws-sdk/lib-dynamodb|dynamoose|electrodb|dynamodb-toolbox|@typedorm/core|dynamodb-onetable'), 'a DynamoDB client in package.json'],
+        [python, dep('pynamodb|boto3-stubs\\[[^\\]]{0,80}dynamodb[^\\]]{0,80}\\]|types-aiobotocore-dynamodb|mypy-boto3-dynamodb|dynamorm'), 'a DynamoDB client in the Python dependencies'],
+        [/^gemfile$/i, /gem\s+["'](aws-sdk-dynamodb|dynamoid|aws-record)["']/, 'a DynamoDB gem'],
+        [/^go\.mod$/i, /aws-sdk-go-v2\/service\/dynamodb|github\.com\/guregu\/dynamo/, 'a DynamoDB client in go.mod'],
+        [/^cargo\.toml$/i, /^\s*(aws-sdk-dynamodb|serde_dynamo|modyne)\s*=/m, 'a DynamoDB crate'],
+        [dotnet, /AWSSDK\.DynamoDBv2/i, 'AWSSDK.DynamoDBv2 in a .NET project'],
+        [jvm, /software\.amazon\.awssdk[^\n]{0,200}dynamodb|aws-java-sdk-dynamodb|dynamodb-enhanced/i, 'the DynamoDB Java SDK'],
+        [infra, /AWS::DynamoDB::(Global)?Table|aws_dynamodb_table/, 'a DynamoDB table in the infrastructure code'],
+        [config, /AWS_ENDPOINT_URL_DYNAMODB|DYNAMO(DB)?_(ENDPOINT|URL|TABLE)|dynamodb\.[\w-]+\.amazonaws\.com|localhost:8000/i, 'DynamoDB settings in the config'],
+    ],
+    redis: [
+        [compose, /image:\s*["']?[\w./-]{0,80}(redis|valkey|keydb|dragonfly)[\w.-]{0,40}(:|\s|["']|$)/im, 'a compose service runs Redis'],
+        [manifests, dep('redis|ioredis|bullmq|bull|@upstash/redis|connect-redis|rate-limit-redis'), 'a Redis client in package.json'],
+        [python, dep('redis|aioredis|rq|celery\\[redis\\]|django-redis|arq'), 'a Redis client in the Python dependencies'],
+        [/^gemfile$/i, /gem\s+["'](redis|sidekiq|resque)["']/, 'a Redis gem'],
+        [/^go\.mod$/i, /github\.com\/(redis\/go-redis|go-redis\/redis|gomodule\/redigo)/, 'a Redis client in go.mod'],
+        [/^cargo\.toml$/i, /^\s*(redis|deadpool-redis|bb8-redis)\s*=/m, 'a Redis crate'],
+        [dotnet, /StackExchange\.Redis|Microsoft\.Extensions\.Caching\.StackExchangeRedis/i, 'StackExchange.Redis in a .NET project'],
+        [jvm, /jedis|lettuce-core|spring-boot-starter-data-redis|redisson/i, 'a Redis Java client'],
+        [/^composer\.json$/i, /predis\/predis|ext-redis/i, 'a PHP Redis client'],
+        [config, /rediss?:\/\/|REDIS_(URL|HOST)\s*=|CACHE_DRIVER\s*=\s*redis/i, 'a Redis connection string'],
+    ],
+};
+/** Libraries that talk to "a SQL database" without saying which: then this PC's own database decides (see below). */
+const GENERIC_SQL = [
+    [manifests, dep('knex|sequelize|typeorm|drizzle-orm|kysely|@mikro-orm/core|objection|prisma'), 'an SQL ORM'],
+    [python, dep('sqlalchemy|django|peewee|tortoise-orm|sqlmodel|alembic'), 'an SQL ORM'],
+    [dotnet, /Microsoft\.EntityFrameworkCore(?!\.(Sqlite|InMemory))|Dapper/i, 'Entity Framework / Dapper'],
+    [/^gemfile$/i, /gem\s+["'](rails|activerecord|sequel)["']/, 'ActiveRecord'],
+    [jvm, /spring-boot-starter-data-jpa|hibernate-core|jooq/i, 'JPA / Hibernate'],
+    [/^go\.mod$/i, /gorm\.io\/gorm|entgo\.io\/ent|github\.com\/jmoiron\/sqlx/, 'an SQL ORM'],
+    [/^cargo\.toml$/i, /^\s*(sqlx|diesel|sea-orm)\s*=/m, 'an SQL ORM'],
+    [/^composer\.json$/i, /laravel\/framework|doctrine\/orm/i, 'Laravel / Doctrine'],
+];
+const fileName = (p) => p.split(/[\\/]/).pop() ?? p;
+const SQL = ['postgres', 'mysql', 'sqlserver'];
+/**
+ * The databases a project needs, each with the evidence ("compose.yaml: a compose service runs Postgres"). `hostHas` is
+ * what this PC has installed: when the project only shows a database-agnostic ORM, the SQL database you use here is
+ * taken (Postgres first if several), so an ORM project still gets a database.
+ */
+/** Longest line and file looked at: bounded work per file whatever a (sandbox-written) file contains. */
+const MAX_LINE = 1000;
+const MAX_TEXT = 256 * 1024;
+const bounded = (text) => text.slice(0, MAX_TEXT).split('\n').filter((line) => line.length <= MAX_LINE).join('\n');
+export const detectDatabases = (input, hostHas = []) => {
+    const files = input.map((f) => ({ path: f.path, text: bounded(f.text) }));
+    const found = new Map();
+    const add = (db, reason) => { const list = found.get(db) ?? []; if (!list.includes(reason))
+        list.push(reason); found.set(db, list); };
+    for (const file of files) {
+        const name = fileName(file.path);
+        for (const db of DATABASES)
+            for (const [test, pattern, reason] of RULES[db])
+                if (test.test(name) && pattern.test(file.text))
+                    add(db, file.path + ': ' + reason);
+    }
+    if (!SQL.some((db) => found.has(db))) {
+        const orm = files.flatMap((file) => GENERIC_SQL.filter(([test, pattern]) => test.test(fileName(file.path)) && pattern.test(file.text)).map(([, , reason]) => file.path + ': ' + reason));
+        const host = orm.length ? (typeof hostHas === 'function' ? hostHas() : hostHas) : [];
+        const mine = SQL.find((db) => host.includes(db));
+        if (orm.length && mine)
+            add(mine, orm[0] + ', and this PC has ' + mine + ' installed');
+    }
+    return DATABASES.filter((db) => found.has(db)).map((database) => ({ database, reasons: found.get(database) }));
+};
+/** Windows service names of databases installed on this PC (from `sc query`), e.g. postgresql-x64-16, MySQL80. */
+export const databasesFromServices = (serviceNames) => {
+    const has = (r) => serviceNames.some((s) => r.test(s));
+    return DATABASES.filter((db) => ({
+        postgres: has(/^postgresql/i),
+        mysql: has(/^(mysql|mariadb)/i),
+        sqlserver: has(/^(MSSQLSERVER|MSSQL\$|SQLServer)/i),
+        mongodb: has(/^mongodb/i),
+        redis: has(/^(redis|memurai)/i),
+        dynamodb: false,
+    })[db]);
+};

package/dist/core/detect-pwsh.d.ts

@@ -0,0 +1,18 @@
+import type { ProjectFile } from './detect-databases.js';
+/** Scripts looked at: the workspace root and one folder down, at most this many, only their start. */
+export declare const PWSH_MAX_SCRIPTS = 40;
+export declare const PWSH_MAX_BYTES: number;
+/** The first script that needs PowerShell 7 and why ("moh.ps1: #Requires -Version 7"), or null. */
+export declare const usesPwsh: (files: readonly ProjectFile[]) => string | null;
+/** *.ps1 / *.psm1 / *.psd1 in the workspace root and its direct sub-folders (root first), capped. Links are skipped. */
+export declare const readPwshScripts: (root: string) => ProjectFile[];
+/** PowerShell 7 installed on this PC (the MSI's folder, or a pwsh.exe on PATH other than a Store alias). */
+export declare const pcHasPwsh: (env?: NodeJS.ProcessEnv, exists?: (p: string) => boolean) => boolean;
+/**
+ * The decision for toolchains.pwsh.enabled: true/false are kept; "auto" is on when a script needs PowerShell 7, or, in
+ * a folder that is no project yet (`fresh`), when this PC has it.
+ */
+export declare const decidePwsh: (setting: boolean | "auto", scripts: readonly ProjectFile[], fresh: boolean, pcHas: boolean) => {
+    on: boolean;
+    reason: string;
+};

package/dist/core/detect-pwsh.js

@@ -0,0 +1,111 @@
+// Does a project need PowerShell 7 (pwsh)? Windows PowerShell 5.1 ships with Windows, so a plain *.ps1 says nothing;
+// a script that asks for 7 (#Requires -Version 7 / -PSEdition Core) or tells you to run it with `pwsh` does.
+// usesPwsh is pure; readPwshScripts reads a bounded sample of the workspace (no links followed, files and bytes capped).
+import fs from 'node:fs';
+import path from 'node:path';
+/** Scripts looked at: the workspace root and one folder down, at most this many, only their start. */
+export const PWSH_MAX_SCRIPTS = 40;
+export const PWSH_MAX_BYTES = 64 * 1024;
+const MAX_LINES = 400;
+const MAX_LINE = 400;
+const SKIP = /^(node_modules|\.git|vendor|target|bin|obj|dist|build|out|\.venv|venv|packages)$/i;
+/** Why one line asks for PowerShell 7, or null. Plain string work per line (no regex that can backtrack). */
+const pwshLine = (raw) => {
+    const line = raw.trimStart().slice(0, MAX_LINE).toLowerCase();
+    if (line.startsWith('#requires')) {
+        const words = line.slice('#requires'.length).split(/\s+/).filter(Boolean);
+        const after = (flag) => words[words.indexOf(flag) + 1];
+        const version = words.includes('-version') ? Number.parseInt(after('-version') ?? '', 10) : NaN;
+        if (version >= 7)
+            return '#Requires -Version ' + version;
+        if (words.includes('-psedition') && after('-psedition') === 'core')
+            return '#Requires -PSEdition Core';
+        return null;
+    }
+    // "Usage: pwsh scripts/build.ps1", "& pwsh -File x.ps1", "pwsh.exe -NoProfile ...": the word pwsh, then an option
+    // or a script (so prose like "works in pwsh too" does not count).
+    // At most a few occurrences per line, each looking at a short window: linear in the (capped) input.
+    for (let at = line.indexOf('pwsh'), n = 0; at !== -1 && n < 4; at = line.indexOf('pwsh', at + 4), n++) {
+        const end = at + (line.startsWith('pwsh.exe', at) ? 8 : 4);
+        if (at > 0 && /[\w.$-]/.test(line[at - 1]))
+            continue;
+        if (line[end] !== ' ' && line[end] !== '\t')
+            continue;
+        const next = line.slice(end, end + 80).trimStart().split(/\s/, 1)[0] ?? '';
+        if (next.startsWith('-') || next.includes('.ps1'))
+            return 'pwsh usage';
+    }
+    return null;
+};
+/** The first script that needs PowerShell 7 and why ("moh.ps1: #Requires -Version 7"), or null. */
+export const usesPwsh = (files) => {
+    for (const file of files.slice(0, PWSH_MAX_SCRIPTS)) {
+        if (!/\.ps[dm]?1$/i.test(file.path))
+            continue;
+        const lines = file.text.slice(0, PWSH_MAX_BYTES).split(/\r?\n/, MAX_LINES);
+        for (const line of lines) {
+            const why = pwshLine(line);
+            if (why)
+                return file.path.replace(/\\/g, '/') + ': ' + why;
+        }
+    }
+    return null;
+};
+/** The start of a file, through one handle, only when that handle is a regular file. */
+const readStart = (file) => {
+    let fd = null;
+    try {
+        fd = fs.openSync(file, 'r');
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile())
+            return null;
+        const buffer = Buffer.alloc(Math.min(stat.size, PWSH_MAX_BYTES));
+        const read = fs.readSync(fd, buffer, 0, buffer.length, 0);
+        return buffer.subarray(0, read).toString('utf8');
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== null)
+            fs.closeSync(fd);
+    }
+};
+/** *.ps1 / *.psm1 / *.psd1 in the workspace root and its direct sub-folders (root first), capped. Links are skipped. */
+export const readPwshScripts = (root) => {
+    const list = (dir) => { try {
+        return fs.readdirSync(dir, { withFileTypes: true }).slice(0, 2000);
+    }
+    catch {
+        return [];
+    } };
+    const isScript = (d) => d.isFile() && /\.ps[dm]?1$/i.test(d.name);
+    const top = list(root);
+    const names = [
+        ...top.filter(isScript).map((d) => d.name),
+        ...top.filter((d) => d.isDirectory() && !d.name.startsWith('.') && !SKIP.test(d.name)).slice(0, 200)
+            .flatMap((d) => list(path.join(root, d.name)).filter(isScript).map((f) => d.name + '/' + f.name)),
+    ].slice(0, PWSH_MAX_SCRIPTS);
+    return names.flatMap((name) => { const text = readStart(path.join(root, name)); return text === null ? [] : [{ path: name, text }]; });
+};
+/** PowerShell 7 installed on this PC (the MSI's folder, or a pwsh.exe on PATH other than a Store alias). */
+export const pcHasPwsh = (env = process.env, exists = fs.existsSync) => {
+    const programFiles = env.ProgramFiles ?? 'C:\\Program Files';
+    if (exists(path.win32.join(programFiles, 'PowerShell', '7', 'pwsh.exe')))
+        return true;
+    return (env.PATH ?? env.Path ?? '').split(';').some((d) => d && !/WindowsApps/i.test(d) && exists(path.win32.join(d, 'pwsh.exe')));
+};
+/**
+ * The decision for toolchains.pwsh.enabled: true/false are kept; "auto" is on when a script needs PowerShell 7, or, in
+ * a folder that is no project yet (`fresh`), when this PC has it.
+ */
+export const decidePwsh = (setting, scripts, fresh, pcHas) => {
+    if (setting !== 'auto')
+        return { on: setting, reason: setting ? 'enabled in config' : 'disabled in config' };
+    const why = usesPwsh(scripts);
+    if (why)
+        return { on: true, reason: why };
+    if (fresh && pcHas)
+        return { on: true, reason: 'installed on this PC (new folder)' };
+    return { on: false, reason: 'no script needs PowerShell 7' };
+};

package/dist/core/detect-toolchains.d.ts

@@ -0,0 +1,30 @@
+import type { Toolchains } from './types.js';
+/** Files that show a project uses a language (looked for in the workspace and one folder down). */
+export declare const MARKERS: {
+    readonly python: readonly ["pyproject.toml", "requirements.txt", "setup.py", "setup.cfg", "Pipfile", "uv.lock", "poetry.lock", ".python-version", "*.py", "*.ipynb"];
+    readonly rust: readonly ["Cargo.toml", "rust-toolchain", "rust-toolchain.toml"];
+    readonly msvc: readonly ["*.vcxproj", "CMakePresets.json", "CMakeUserPresets.json"];
+    readonly cpp: readonly ["CMakeLists.txt", "Makefile", "meson.build", "premake5.lua", "Cargo.toml", "*.vcxproj", "*.c", "*.cpp", "*.cc", "*.h", "*.hpp"];
+    readonly dotnet: readonly ["*.sln", "*.slnx", "*.csproj", "*.fsproj", "*.vbproj", "global.json", "*.cs"];
+    readonly go: readonly ["go.mod", "go.work", "*.go"];
+    readonly java: readonly ["pom.xml", "build.gradle", "build.gradle.kts", "settings.gradle", "settings.gradle.kts", "mvnw", "gradlew", ".java-version", ".sdkmanrc", "*.java"];
+    readonly ruby: readonly ["Gemfile", "*.gemspec", ".ruby-version", "*.rb"];
+    readonly php: readonly ["composer.json", "artisan", ".php-version", "*.php"];
+    readonly deno: readonly ["deno.json", "deno.jsonc", "deno.lock"];
+    readonly pwsh: readonly [];
+};
+export type AutoToolchain = keyof typeof MARKERS;
+export declare const AUTO_TOOLCHAINS: AutoToolchain[];
+export interface ToolchainDecision {
+    on: boolean;
+    reason: string;
+}
+/**
+ * The decision per toolchain. true/false are kept; "auto" is on when the project has one of its marker files, or, in
+ * a folder that is no project yet, when this PC has the language installed. Rust needs a linker (MSVC or C/C++).
+ * hints: reasons found by reading files (a script that calls vcvars/vswhere) or about this PC ("builds Rust with MSVC"),
+ * which turn an "auto" toolchain on like a marker file does.
+ */
+export declare const decideToolchains: (settings: Toolchains, entries: string[], pcHas: AutoToolchain[], hints?: Partial<Record<AutoToolchain, string>>) => Record<AutoToolchain, ToolchainDecision>;
+/** The settings with every "auto" replaced by the decision (what the sandbox receives). */
+export declare const resolveToolchains: (settings: Toolchains, decisions: Record<AutoToolchain, ToolchainDecision>) => Toolchains;