windows-development-sandbox 0.0.0-stage → 1.1.0

package/dist/cli/settings/schema.js

@@ -0,0 +1,29 @@
+/** optional()/default() wrappers hide the real type. */
+export const unwrap = (s) => (['optional', 'default', 'nullable'].includes(s._zod.def.type) && s._zod.def.innerType ? unwrap(s._zod.def.innerType) : s);
+export const kind = (s) => unwrap(s)._zod.def.type;
+export const isSection = (s) => kind(s) === 'object' && Boolean(unwrap(s).shape);
+/** Settings not worth editing here (the schema link). */
+const HIDDEN = new Set(['$schema']);
+/** The settings one level below a section (or the top level), in schema order. */
+export const childrenOf = (schema) => Object.entries(unwrap(schema).shape ?? {}).filter(([name]) => !HIDDEN.has(name));
+/** The description, which `.partial()` and `.optional()` wrappers may carry on the inner schema instead. */
+export const describeSetting = (s) => s.description ?? unwrap(s).description;
+/** Every setting that is edited with a prompt of its own (everything that is not a section), with its path. */
+export const leavesOf = (schema, key = []) => childrenOf(schema).flatMap(([name, child]) => (isSection(child) ? leavesOf(child, [...key, name]) : [{ key: [...key, name], schema: child }]));
+/** Which prompt edits this setting. Lists of objects and maps (mappings, harnesses, environment) fall back to JSON. */
+export const promptKind = (schema) => {
+    const s = unwrap(schema);
+    const type = s._zod.def.type;
+    if (type === 'boolean' || type === 'enum' || type === 'union' || type === 'number' || type === 'string')
+        return type;
+    if (type === 'array' && s._zod.def.element && kind(s._zod.def.element) === 'string')
+        return 'string-list';
+    return 'json';
+};
+const JSON_EXAMPLES = {
+    harnesses: '{"mytool": {"npmPackage": "my-cli", "npmBin": "my-cli", "arguments": [], "environment": {}}}',
+    mappings: '[{"host": "C:\\\\data", "guest": "C:\\\\Data", "readOnly": true}]',
+    environment: '{"NPM_CONFIG_REGISTRY": "https://registry.example.com"}',
+};
+/** A one-line example of the JSON a setting expects, shown in its prompt. */
+export const jsonExample = (key, schema) => JSON_EXAMPLES[key[key.length - 1]] ?? (unwrap(schema)._zod.def.type === 'array' ? '["value", ...]' : '{"name": "value"}');

package/dist/cli/validate.d.ts

@@ -0,0 +1,17 @@
+import type { Context } from './commands/context.js';
+/** Edit distance, for "did you mean". */
+export declare const distance: (a: string, b: string) => number;
+/** The closest of `choices` to `input`, when it is close enough to be a typo. */
+export declare const closest: (input: string, choices: readonly string[]) => string | undefined;
+/** "Unknown agent "cluade". Did you mean claude?" with the valid values as the fix. */
+export declare const unknownValue: (what: string, input: string, choices: readonly string[], howToList: string) => never;
+/** Node: 22, 22.1, v22.1.0, lts, lts/*, lts/iron, latest, current, node. */
+export declare const validNodeSpec: (spec: string) => boolean;
+/** Python 3: 3, 3.12, 3.12.4. */
+export declare const validPythonSpec: (spec: string) => boolean;
+export declare const checkHarness: (name: string | undefined, harnesses: string[]) => void;
+export declare const PROJECT_ACTIONS: readonly ["list", "choose", "add", "remove", "include", "exclude", "all", "roots"];
+/** `sandbox projects <action> [value] [folder]`: the action, then what it needs. Pure (no file checks). */
+export declare const validateProjectsArgs: (args: string[]) => void;
+/** Fails with what is wrong and what is valid, before anything is started. */
+export declare const validateOptions: (ctx: Context) => void;

package/dist/cli/validate.js

@@ -0,0 +1,89 @@
+// Checks what the user typed before anything starts, so a typo fails at once with the list of valid values
+// instead of halfway into a sandbox boot. Pure helpers first, then validateOptions (the one call from the dispatcher).
+import fs from 'node:fs';
+import path from 'node:path';
+import { DATABASES } from '../core/detect-databases.js';
+import { fail } from '../core/util.js';
+import { listAccounts } from '../host/accounts.js';
+/** Edit distance, for "did you mean". */
+export const distance = (a, b) => {
+    let row = Array.from({ length: b.length + 1 }, (_, i) => i);
+    for (let i = 1; i <= a.length; i++) {
+        const next = [i];
+        for (let j = 1; j <= b.length; j++)
+            next[j] = Math.min(row[j] + 1, next[j - 1] + 1, row[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+        row = next;
+    }
+    return row[b.length];
+};
+/** The closest of `choices` to `input`, when it is close enough to be a typo. */
+export const closest = (input, choices) => {
+    const best = choices.map((c) => ({ c, d: distance(input.toLowerCase(), c.toLowerCase()) })).sort((x, y) => x.d - y.d)[0];
+    return best && best.d <= Math.max(2, Math.floor(input.length / 3)) ? best.c : undefined;
+};
+/** "Unknown agent "cluade". Did you mean claude?" with the valid values as the fix. */
+export const unknownValue = (what, input, choices, howToList) => {
+    const hint = closest(input, choices);
+    return fail('Unknown ' + what + ' "' + input + '".' + (hint ? ' Did you mean ' + hint + '?' : ''), (choices.length ? 'Choose one of: ' + choices.join(', ') + '. ' : '') + howToList);
+};
+/** Node: 22, 22.1, v22.1.0, lts, lts/*, lts/iron, latest, current, node. */
+export const validNodeSpec = (spec) => /^(v?\d+(\.\d+){0,2}|node|latest|current|stable|lts(\/(\*|[a-z]+))?)$/i.test(spec.trim());
+/** Python 3: 3, 3.12, 3.12.4. */
+export const validPythonSpec = (spec) => /^v?3(\.\d+){0,2}$/.test(spec.trim());
+export const checkHarness = (name, harnesses) => {
+    if (name !== undefined && !harnesses.includes(name))
+        unknownValue('agent', name, harnesses, 'Add your own under "harnesses" in your settings (sandbox config).');
+};
+/** Commands that read these options; checked only for them (restart/doctor take --harness too). */
+const LAUNCHING = new Set(['launch', 'generate', 'host-claude']);
+export const PROJECT_ACTIONS = ['list', 'choose', 'add', 'remove', 'include', 'exclude', 'all', 'roots'];
+/** `sandbox projects <action> [value] [folder]`: the action, then what it needs. Pure (no file checks). */
+export const validateProjectsArgs = (args) => {
+    const [action = 'list', value, folder] = args;
+    if (!PROJECT_ACTIONS.includes(action))
+        unknownValue('projects action', action, PROJECT_ACTIONS, 'sandbox projects with no action lists your projects.');
+    if (['add', 'remove', 'include', 'exclude'].includes(action) && !value)
+        fail('Which folder?', 'Usage: sandbox projects ' + action + ' <folder>   (. = this folder)');
+    if (action === 'all' && value !== undefined && !['on', 'off'].includes(value))
+        unknownValue('value for projects all', value, ['on', 'off'], 'sandbox projects all on|off');
+    if (action === 'roots' && value !== undefined && !['list', 'add', 'remove'].includes(value))
+        unknownValue('projects roots action', value, ['list', 'add', 'remove'], 'sandbox projects roots add|remove <folder>');
+    if (action === 'roots' && (value === 'add' || value === 'remove') && !folder)
+        fail('Which folder?', 'Usage: sandbox projects roots ' + value + ' <folder>');
+};
+/** Fails with what is wrong and what is valid, before anything is started. */
+export const validateOptions = (ctx) => {
+    const o = ctx.options;
+    const harnesses = Object.keys(ctx.loaded.config.harnesses);
+    if (['launch', 'generate', 'restart', 'doctor'].includes(o.command))
+        checkHarness(o.harness, harnesses);
+    if (o.command === 'projects')
+        validateProjectsArgs(o.positionals);
+    if (!LAUNCHING.has(o.command))
+        return;
+    if (o.node !== undefined && !validNodeSpec(o.node))
+        fail('"' + o.node + '" is not a Node version.', 'Use a number like 22 or 22.11.0, or lts, latest.');
+    if (o.python !== undefined && !validPythonSpec(o.python))
+        fail('"' + o.python + '" is not a Python 3 version.', 'Use 3, 3.12 or 3.12.4.');
+    for (const db of o.databases.flatMap((d) => d.split(',')).map((d) => d.trim()).filter(Boolean)) {
+        if (!DATABASES.includes(db))
+            unknownValue('database', db, DATABASES, 'Repeat --database for several.');
+    }
+    if (o.account !== undefined) {
+        const names = listAccounts(ctx.storageRoot, ctx.dataPath).map((a) => a.name);
+        if (!names.includes(o.account))
+            unknownValue('account', o.account, names, names.length ? 'See them with: sandbox account list' : 'None saved yet: sign in inside the sandbox, then run sandbox account save <name>.');
+    }
+    for (const s of o.sessions) {
+        checkHarness(s.harness, harnesses);
+        if (!fs.existsSync(s.folder) || !fs.statSync(s.folder).isDirectory())
+            fail('The folder ' + s.folder + ' (--session ' + s.harness + '@...) does not exist.', 'Check the path after the @.');
+    }
+    if (o.sessions.length && (o.harness !== undefined || o.workspace !== undefined))
+        fail('--session names the agent and folder of each session, so --harness and --workspace do not apply.', 'Use only --session <agent>@<folder> (repeatable).');
+    if (o.workspace !== undefined && !fs.existsSync(path.resolve(o.workspace)))
+        fail('The folder ' + path.resolve(o.workspace) + ' does not exist.', 'Check the --workspace path (or leave it out to use the current folder).');
+    for (const script of o.scripts)
+        if (!fs.existsSync(path.resolve(script)))
+            fail('The script ' + path.resolve(script) + ' does not exist.', 'Check the --script path.');
+};

package/dist/core/config.d.ts

@@ -0,0 +1,17 @@
+import type { Config, LoadedConfig } from './types.js';
+export declare const DEFAULTS: Config;
+/** Per-user folder for config and hooks. Survives reinstalling the npm package. */
+export declare const userDir: () => string;
+export declare const userConfigPath: () => string;
+/** Deep merge where arrays (and anything that is not a plain object) replace instead of merging element by element. */
+export declare const mergeConfig: <T>(base: T, extra: unknown) => T;
+/** Validates a full config; throws one readable error listing every problem. */
+export declare const validateConfig: (config: unknown, source: string) => Config;
+/**
+ * Lookup order: --config, %AGENT_SANDBOX_CONFIG%, ~/.agent-sandbox/config.json, built-in defaults.
+ * Whatever file is found (JSON with comments) is merged over the defaults, so it only needs the keys you change.
+ */
+export declare const loadConfig: (explicitPath?: string) => LoadedConfig;
+export declare const assertNoGuestOverlap: (mappings: {
+    guest: string;
+}[]) => void;

package/dist/core/config.js

@@ -0,0 +1,106 @@
+// Built-in defaults and loading the user config (~/.agent-sandbox/config.json). Shapes live in schema.ts.
+import fs from 'node:fs';
+import path from 'node:path';
+import _ from 'lodash';
+import { Config as ConfigSchema, describeIssues } from './schema.js';
+import { fail, homeDir, readJsonc } from './util.js';
+export const DEFAULTS = {
+    defaultHarness: 'claude',
+    guestWorkspace: 'auto',
+    readOnly: false,
+    mappings: [],
+    sandbox: { memoryMb: 'auto', maxMemoryMb: 32768, maxMemoryPercent: 80, cpuLimit: 80, reserveHostMb: 8192, vGpu: false, networking: true, clipboard: true, audioInput: false, videoInput: false, printerRedirection: false, protectedClient: true, headless: false },
+    storage: { root: '%LOCALAPPDATA%\\AgentSandbox', persistAgentState: true, dataName: 'default' },
+    network: { blockPrivateRanges: true },
+    provisioning: { copyFromHost: true, fallbackToInstall: true, refresh: false, git: { enabled: true, access: 'full' }, terminal: { enabled: true } },
+    downloads: { requireChecksum: false },
+    toolchains: {
+        node: { version: 'host', extraVersions: [], corepack: true, volta: 'auto', globalPackages: [] },
+        python: { enabled: 'auto', version: '3', python2: true, pyenv: 'auto', tools: [] },
+        rust: { enabled: 'auto', toolchain: 'stable', host: 'auto', components: [], targets: [], crates: [], targetDir: 'separate' },
+        msvc: { enabled: 'auto', acceptLicense: false, msvcVersion: 'latest', sdkVersion: 'latest' },
+        cpp: { enabled: 'auto', flexBison: true },
+        dotnet: { enabled: 'auto', channels: ['LTS'], tools: [], workloads: [], frameworkTargets: ['net48', 'net472'], netfx35: false },
+        // Bigger downloads only for projects that use them.
+        go: { enabled: 'auto', version: 'stable', tools: [] },
+        java: { enabled: 'auto', version: 'lts', maven: true, gradle: true },
+        ruby: { enabled: 'auto', version: '3', gems: [] },
+        php: { enabled: 'auto', version: '8', composer: true },
+        deno: { enabled: 'auto' },
+        pwsh: { enabled: 'auto' },
+        cli: { gh: 'auto', zstd: false, openssl: 'auto' },
+        bun: { enabled: true },
+        uv: { enabled: true },
+        vcRuntime: { enabled: false },
+        mesa: { enabled: false, vulkan: false },
+        vscode: { enabled: true },
+        environment: {},
+    },
+    databases: {
+        postgres: { enabled: 'auto', version: 'latest', port: 5432 },
+        mysql: { enabled: 'auto', version: 'lts', port: 3306 },
+        mongodb: { enabled: 'auto', version: 'latest', port: 27017 },
+        redis: { enabled: 'auto', port: 6379 },
+        dynamodb: { enabled: 'auto', port: 8000, adminPort: 8001, admin: true },
+        sqlserver: { enabled: 'auto' },
+    },
+    attach: { enabled: true, reuseSession: true, auto: false, autoHide: false },
+    agentCommands: { enabled: false, agents: 'auto' },
+    secrets: { strip: true, allow: [], patterns: [], warnFiles: true },
+    personalization: { enabled: true },
+    claudeProfile: { enabled: true, hostDir: 'auto', include: ['settings.json', 'CLAUDE.md', 'commands', 'agents', 'skills', 'plugins'], globalStateFile: 'auto', copyCredentials: false, overwrite: true, syncHistory: true, syncClaudeMem: true },
+    harnesses: {
+        claude: { hostExecutable: 'claude.exe', hostDir: 'auto', npmPackage: '@anthropic-ai/claude-code@latest', npmBin: 'claude', arguments: [], environment: { DISABLE_AUTOUPDATER: '1' }, resumeArguments: ['--continue'] },
+        codex: { npmPackage: '@openai/codex@latest', npmBin: 'codex', arguments: [], environment: {}, resumeArguments: ['resume', '--last'] },
+        gemini: { npmPackage: '@google/gemini-cli@latest', npmBin: 'gemini', arguments: [], environment: {}, resumeArguments: ['--resume'] },
+        // Not tested by us; installed from each project's official npm / PyPI package.
+        opencode: { npmPackage: 'opencode-ai@latest', npmBin: 'opencode', arguments: [], environment: {}, resumeArguments: ['--continue'] },
+        qwen: { npmPackage: '@qwen-code/qwen-code@latest', npmBin: 'qwen', arguments: [], environment: {}, resumeArguments: ['--continue'] },
+        crush: { npmPackage: '@charmland/crush@latest', npmBin: 'crush', arguments: [], environment: {}, resumeArguments: ['--continue'] },
+        copilot: { npmPackage: '@github/copilot@latest', npmBin: 'copilot', arguments: [], environment: {}, resumeArguments: ['--continue'] },
+        kilo: { npmPackage: '@kilocode/cli@latest', npmBin: 'kilo', arguments: [], environment: {}, resumeArguments: ['--continue'] },
+        amp: { npmPackage: '@ampcode/cli@latest', npmBin: 'amp', arguments: [], environment: {} },
+        cline: { npmPackage: 'cline@latest', npmBin: 'cline', arguments: [], environment: {} },
+        continue: { npmPackage: '@continuedev/cli@latest', npmBin: 'cn', arguments: [], environment: {}, resumeArguments: ['--resume'] },
+        kimi: { npmPackage: '@moonshot-ai/kimi-code@latest', npmBin: 'kimi', arguments: [], environment: {}, resumeArguments: ['-c'] },
+        // DeepSeek has no official coding CLI; these two community agents are built for it.
+        reasonix: { npmPackage: 'reasonix@latest', npmBin: 'reasonix', arguments: [], environment: {} },
+        deepseek: { npmPackage: 'codewhale@latest', npmBin: 'codewhale', arguments: [], environment: {} },
+        aider: { uvPackage: 'aider-chat', uvBin: 'aider', arguments: [], environment: {}, resumeArguments: ['--restore-chat-history'] },
+    },
+    hooks: { failFast: false },
+    projects: { all: false, exclude: [], roots: [], askToAddRoot: true, declinedRoots: [], wsbShare: true },
+};
+/** Per-user folder for config and hooks. Survives reinstalling the npm package. */
+export const userDir = () => process.env.AGENT_SANDBOX_HOME ?? path.join(homeDir(), '.agent-sandbox');
+export const userConfigPath = () => path.join(userDir(), 'config.json');
+/** Deep merge where arrays (and anything that is not a plain object) replace instead of merging element by element. */
+export const mergeConfig = (base, extra) => _.mergeWith(_.cloneDeep(base), extra, (_target, source) => (Array.isArray(source) ? source : undefined));
+/** Validates a full config; throws one readable error listing every problem. */
+export const validateConfig = (config, source) => {
+    const parsed = ConfigSchema.safeParse(config);
+    if (!parsed.success)
+        fail(source + ' is not valid:\n  - ' + describeIssues(parsed.error).join('\n  - '));
+    return parsed.data;
+};
+/**
+ * Lookup order: --config, %AGENT_SANDBOX_CONFIG%, ~/.agent-sandbox/config.json, built-in defaults.
+ * Whatever file is found (JSON with comments) is merged over the defaults, so it only needs the keys you change.
+ */
+export const loadConfig = (explicitPath) => {
+    const requested = explicitPath ?? process.env.AGENT_SANDBOX_CONFIG;
+    const full = path.resolve(requested ?? userConfigPath());
+    if (!fs.existsSync(full)) {
+        if (requested)
+            fail('Config file not found: ' + full, 'Check the --config path or AGENT_SANDBOX_CONFIG, or create one with: sandbox config init');
+        return { config: structuredClone(DEFAULTS), configPath: null, base: userDir() };
+    }
+    return { config: validateConfig(mergeConfig(DEFAULTS, readJsonc(full)), full), configPath: full, base: path.dirname(full) };
+};
+export const assertNoGuestOverlap = (mappings) => {
+    const normal = mappings.map((m) => m.guest.replace(/\\+$/, '').toLowerCase());
+    normal.forEach((a, i) => normal.slice(i + 1).forEach((b, j) => {
+        if (a === b || a.startsWith(b + '\\') || b.startsWith(a + '\\'))
+            fail('Two folders map to overlapping places in the sandbox: ' + mappings[i].guest + ' and ' + mappings[i + 1 + j].guest + '.', 'Give each mapping its own guest folder (one must not be inside the other).');
+    }));
+};

package/dist/core/detect-databases.d.ts

@@ -0,0 +1,15 @@
+export declare const DATABASES: readonly ["postgres", "mysql", "sqlserver", "mongodb", "redis", "dynamodb"];
+export type Database = (typeof DATABASES)[number];
+export interface ProjectFile {
+    path: string;
+    text: string;
+}
+/** Files worth reading, by name (lower case). Everything else is ignored, so a scan stays fast on big repos. */
+export declare const INTERESTING_FILE: RegExp;
+export interface Detection {
+    database: Database;
+    reasons: string[];
+}
+export declare const detectDatabases: (input: ProjectFile[], hostHas?: Database[] | (() => Database[])) => Detection[];
+/** Windows service names of databases installed on this PC (from `sc query`), e.g. postgresql-x64-16, MySQL80. */
+export declare const databasesFromServices: (serviceNames: string[]) => Database[];

package/dist/core/detect-databases.js

@@ -0,0 +1,147 @@
+// Which databases a project needs, worked out from its files: compose files, dependency manifests of every ecosystem,
+// ORM schemas, connection strings and .env templates. Pure (file contents in, verdicts out), so the host can run it at
+// launch and the tests can feed it fixtures.
+export const DATABASES = ['postgres', 'mysql', 'sqlserver', 'mongodb', 'redis', 'dynamodb'];
+/** Files worth reading, by name (lower case). Everything else is ignored, so a scan stays fast on big repos. */
+export const INTERESTING_FILE = /^(package\.json|requirements[\w.-]{0,40}\.txt|pyproject\.toml|pipfile|setup\.py|setup\.cfg|gemfile|go\.mod|cargo\.toml|composer\.json|pom\.xml|build\.gradle(\.kts)?|[\w.-]+\.(cs|fs|vb)proj|directory\.packages\.props|packages\.config|schema\.prisma|(docker-)?compose[\w.-]{0,40}\.ya?ml|\.env(\.[\w.-]+)?|appsettings[\w.-]{0,40}\.json|database\.yml|application[\w.-]{0,40}\.(properties|ya?ml)|knexfile\.[jt]s|ormconfig\.(json|[jt]s)|drizzle\.config\.[jt]s|alembic\.ini|settings\.py|mix\.exs|deno\.json|serverless\.ya?ml|template\.ya?ml|samconfig\.toml|[\w.-]+\.tf|cdk\.json)$/i;
+const manifests = /^(package\.json|deno\.json)$/i;
+const python = /^(requirements[\w.-]{0,40}\.txt|pyproject\.toml|pipfile|setup\.py|setup\.cfg)$/i;
+const dotnet = /\.(cs|fs|vb)proj$|^directory\.packages\.props$|^packages\.config$/i;
+const jvm = /^(pom\.xml|build\.gradle(\.kts)?)$/i;
+const compose = /^(docker-)?compose[\w.-]{0,40}\.ya?ml$/i;
+const config = /^(\.env(\.[\w.-]+)?|appsettings[\w.-]{0,40}\.json|database\.yml|application[\w.-]{0,40}\.(properties|ya?ml)|knexfile\.[jt]s|ormconfig\.(json|[jt]s)|drizzle\.config\.[jt]s|alembic\.ini|settings\.py)$/i;
+const infra = /^(serverless\.ya?ml|template\.ya?ml|[\w.-]+\.tf)$/i;
+const dep = (names) => new RegExp('["\'\\s/=]?(' + names + ')["\'\\s@=<>~^:,\\]\\n]', 'i');
+const RULES = {
+    postgres: [
+        [compose, /image:\s*["']?[\w./-]{0,80}(postgres|postgis|timescaledb|supabase\/postgres|pgvector)[\w.-]{0,40}(:|\s|["']|$)/im, 'a compose service runs Postgres'],
+        [manifests, dep('pg|postgres|pg-promise|@neondatabase/serverless|@vercel/postgres|slonik|postgres-js|@electric-sql/pglite'), 'a Postgres driver in package.json'],
+        [python, dep('psycopg2?(-binary)?|psycopg\\[[\\w,]+\\]|asyncpg|pg8000|django\\.db\\.backends\\.postgresql'), 'a Postgres driver in the Python dependencies'],
+        [/^gemfile$/i, /gem\s+["']pg["']/, 'the pg gem'],
+        [/^go\.mod$/i, /github\.com\/(jackc\/pgx|lib\/pq)/, 'a Postgres driver in go.mod'],
+        [/^cargo\.toml$/i, /tokio-postgres|postgres\s*=|sqlx[^\n]{0,200}postgres|diesel[^\n]{0,200}postgres|sea-orm[^\n]{0,200}postgres/i, 'a Postgres driver in Cargo.toml'],
+        [dotnet, /Npgsql/i, 'Npgsql in a .NET project'],
+        [jvm, /org\.postgresql|postgresql:postgresql|r2dbc-postgresql/i, 'the Postgres JDBC driver'],
+        [/^composer\.json$/i, /ext-pgsql|ext-pdo_pgsql/i, 'the PHP Postgres extension'],
+        [/^mix\.exs$/i, /:postgrex/, 'Postgrex'],
+        [/^schema\.prisma$/i, /provider\s*=\s*"(postgresql|postgres|cockroachdb)"/, 'Prisma uses PostgreSQL'],
+        [config, /postgres(ql)?(\+\w+)?:\/\/|DB_CONNECTION\s*=\s*pgsql|adapter:\s*postgres|\bHost=[^;\s]{1,200};\s*(Port=\d{1,5};\s*)?Database=|jdbc:postgresql:/i, 'a Postgres connection string'],
+    ],
+    mysql: [
+        [compose, /image:\s*["']?[\w./-]{0,80}(mysql|mariadb|percona)[\w.-]{0,40}(:|\s|["']|$)/im, 'a compose service runs MySQL / MariaDB'],
+        [manifests, dep('mysql2?|mariadb|@planetscale/database'), 'a MySQL driver in package.json'],
+        [python, dep('pymysql|mysqlclient|mysql-connector-python|aiomysql|asyncmy|mariadb'), 'a MySQL driver in the Python dependencies'],
+        [/^gemfile$/i, /gem\s+["'](mysql2|trilogy)["']/, 'a MySQL gem'],
+        [/^go\.mod$/i, /github\.com\/go-sql-driver\/mysql/, 'the MySQL driver in go.mod'],
+        [/^cargo\.toml$/i, /mysql_async|mysql\s*=|sqlx[^\n]{0,200}mysql|diesel[^\n]{0,200}mysql/i, 'a MySQL driver in Cargo.toml'],
+        [dotnet, /MySqlConnector|MySql\.Data|Pomelo\.EntityFrameworkCore\.MySql/i, 'a MySQL driver in a .NET project'],
+        [jvm, /mysql-connector|mariadb-java-client|com\.mysql/i, 'the MySQL JDBC driver'],
+        [/^composer\.json$/i, /ext-mysqli|ext-pdo_mysql/i, 'the PHP MySQL extension'],
+        [/^mix\.exs$/i, /:myxql/, 'MyXQL'],
+        [/^schema\.prisma$/i, /provider\s*=\s*"mysql"/, 'Prisma uses MySQL'],
+        [config, /(mysql|mariadb)(\+\w+)?:\/\/|DB_CONNECTION\s*=\s*(mysql|mariadb)|adapter:\s*(mysql2|trilogy)|jdbc:(mysql|mariadb):/i, 'a MySQL connection string'],
+    ],
+    sqlserver: [
+        [compose, /image:\s*["']?(mcr\.microsoft\.com\/(mssql|azure-sql-edge)|[\w./-]{0,80}mssql)[\w./:-]{0,80}/im, 'a compose service runs SQL Server'],
+        [manifests, dep('mssql|tedious|msnodesqlv8'), 'a SQL Server driver in package.json'],
+        [python, dep('pyodbc|pymssql|aioodbc|mssql-django'), 'a SQL Server driver in the Python dependencies'],
+        [/^go\.mod$/i, /(denisenkom|microsoft)\/go-mssqldb/, 'the SQL Server driver in go.mod'],
+        [/^cargo\.toml$/i, /tiberius|sqlx[^\n]{0,200}mssql/i, 'a SQL Server driver in Cargo.toml'],
+        [dotnet, /Microsoft\.Data\.SqlClient|System\.Data\.SqlClient|EntityFrameworkCore\.SqlServer|Dapper\.SqlBuilder|LocalDb/i, 'SQL Server in a .NET project'],
+        [jvm, /mssql-jdbc|com\.microsoft\.sqlserver/i, 'the SQL Server JDBC driver'],
+        [/^composer\.json$/i, /ext-sqlsrv|ext-pdo_sqlsrv/i, 'the PHP SQL Server extension'],
+        [/^schema\.prisma$/i, /provider\s*=\s*"sqlserver"/, 'Prisma uses SQL Server'],
+        [config, /\(localdb\)|mssql(\+\w+)?:\/\/|sqlserver:\/\/|DB_CONNECTION\s*=\s*sqlsrv|jdbc:sqlserver:|Initial Catalog=|Trusted_Connection=|TrustServerCertificate=|Integrated Security=/i, 'a SQL Server connection string'],
+    ],
+    mongodb: [
+        [compose, /image:\s*["']?[\w./-]{0,80}mongo(db)?[\w.-]{0,40}(:|\s|["']|$)/im, 'a compose service runs MongoDB'],
+        [manifests, dep('mongodb|mongoose|@typegoose/typegoose|mongodb-memory-server'), 'a MongoDB driver in package.json'],
+        [python, dep('pymongo|motor|mongoengine|beanie|djongo'), 'a MongoDB driver in the Python dependencies'],
+        [/^gemfile$/i, /gem\s+["'](mongoid|mongo)["']/, 'a MongoDB gem'],
+        [/^go\.mod$/i, /go\.mongodb\.org\/mongo-driver/, 'the MongoDB driver in go.mod'],
+        [/^cargo\.toml$/i, /^\s*mongodb\s*=/m, 'the MongoDB crate'],
+        [dotnet, /MongoDB\.Driver|MongoDB\.EntityFrameworkCore/i, 'the MongoDB driver in a .NET project'],
+        [jvm, /mongodb-driver|spring-boot-starter-data-mongodb/i, 'the MongoDB Java driver'],
+        [/^schema\.prisma$/i, /provider\s*=\s*"mongodb"/, 'Prisma uses MongoDB'],
+        [config, /mongodb(\+srv)?:\/\//i, 'a MongoDB connection string'],
+    ],
+    dynamodb: [
+        [compose, /image:\s*["']?(amazon\/dynamodb-local|[\w./-]{0,80}dynamodb-local|instructure\/dynamo-local-admin)[\w.:-]{0,40}/im, 'a compose service runs DynamoDB Local'],
+        [manifests, dep('@aws-sdk/client-dynamodb|@aws-sdk/lib-dynamodb|dynamoose|electrodb|dynamodb-toolbox|@typedorm/core|dynamodb-onetable'), 'a DynamoDB client in package.json'],
+        [python, dep('pynamodb|boto3-stubs\\[[^\\]]{0,80}dynamodb[^\\]]{0,80}\\]|types-aiobotocore-dynamodb|mypy-boto3-dynamodb|dynamorm'), 'a DynamoDB client in the Python dependencies'],
+        [/^gemfile$/i, /gem\s+["'](aws-sdk-dynamodb|dynamoid|aws-record)["']/, 'a DynamoDB gem'],
+        [/^go\.mod$/i, /aws-sdk-go-v2\/service\/dynamodb|github\.com\/guregu\/dynamo/, 'a DynamoDB client in go.mod'],
+        [/^cargo\.toml$/i, /^\s*(aws-sdk-dynamodb|serde_dynamo|modyne)\s*=/m, 'a DynamoDB crate'],
+        [dotnet, /AWSSDK\.DynamoDBv2/i, 'AWSSDK.DynamoDBv2 in a .NET project'],
+        [jvm, /software\.amazon\.awssdk[^\n]{0,200}dynamodb|aws-java-sdk-dynamodb|dynamodb-enhanced/i, 'the DynamoDB Java SDK'],
+        [infra, /AWS::DynamoDB::(Global)?Table|aws_dynamodb_table/, 'a DynamoDB table in the infrastructure code'],
+        [config, /AWS_ENDPOINT_URL_DYNAMODB|DYNAMO(DB)?_(ENDPOINT|URL|TABLE)|dynamodb\.[\w-]+\.amazonaws\.com|localhost:8000/i, 'DynamoDB settings in the config'],
+    ],
+    redis: [
+        [compose, /image:\s*["']?[\w./-]{0,80}(redis|valkey|keydb|dragonfly)[\w.-]{0,40}(:|\s|["']|$)/im, 'a compose service runs Redis'],
+        [manifests, dep('redis|ioredis|bullmq|bull|@upstash/redis|connect-redis|rate-limit-redis'), 'a Redis client in package.json'],
+        [python, dep('redis|aioredis|rq|celery\\[redis\\]|django-redis|arq'), 'a Redis client in the Python dependencies'],
+        [/^gemfile$/i, /gem\s+["'](redis|sidekiq|resque)["']/, 'a Redis gem'],
+        [/^go\.mod$/i, /github\.com\/(redis\/go-redis|go-redis\/redis|gomodule\/redigo)/, 'a Redis client in go.mod'],
+        [/^cargo\.toml$/i, /^\s*(redis|deadpool-redis|bb8-redis)\s*=/m, 'a Redis crate'],
+        [dotnet, /StackExchange\.Redis|Microsoft\.Extensions\.Caching\.StackExchangeRedis/i, 'StackExchange.Redis in a .NET project'],
+        [jvm, /jedis|lettuce-core|spring-boot-starter-data-redis|redisson/i, 'a Redis Java client'],
+        [/^composer\.json$/i, /predis\/predis|ext-redis/i, 'a PHP Redis client'],
+        [config, /rediss?:\/\/|REDIS_(URL|HOST)\s*=|CACHE_DRIVER\s*=\s*redis/i, 'a Redis connection string'],
+    ],
+};
+/** Libraries that talk to "a SQL database" without saying which: then this PC's own database decides (see below). */
+const GENERIC_SQL = [
+    [manifests, dep('knex|sequelize|typeorm|drizzle-orm|kysely|@mikro-orm/core|objection|prisma'), 'an SQL ORM'],
+    [python, dep('sqlalchemy|django|peewee|tortoise-orm|sqlmodel|alembic'), 'an SQL ORM'],
+    [dotnet, /Microsoft\.EntityFrameworkCore(?!\.(Sqlite|InMemory))|Dapper/i, 'Entity Framework / Dapper'],
+    [/^gemfile$/i, /gem\s+["'](rails|activerecord|sequel)["']/, 'ActiveRecord'],
+    [jvm, /spring-boot-starter-data-jpa|hibernate-core|jooq/i, 'JPA / Hibernate'],
+    [/^go\.mod$/i, /gorm\.io\/gorm|entgo\.io\/ent|github\.com\/jmoiron\/sqlx/, 'an SQL ORM'],
+    [/^cargo\.toml$/i, /^\s*(sqlx|diesel|sea-orm)\s*=/m, 'an SQL ORM'],
+    [/^composer\.json$/i, /laravel\/framework|doctrine\/orm/i, 'Laravel / Doctrine'],
+];
+const fileName = (p) => p.split(/[\\/]/).pop() ?? p;
+const SQL = ['postgres', 'mysql', 'sqlserver'];
+/**
+ * The databases a project needs, each with the evidence ("compose.yaml: a compose service runs Postgres"). `hostHas` is
+ * what this PC has installed: when the project only shows a database-agnostic ORM, the SQL database you use here is
+ * taken (Postgres first if several), so an ORM project still gets a database.
+ */
+/** Longest line and file looked at: bounded work per file whatever a (sandbox-written) file contains. */
+const MAX_LINE = 1000;
+const MAX_TEXT = 256 * 1024;
+const bounded = (text) => text.slice(0, MAX_TEXT).split('\n').filter((line) => line.length <= MAX_LINE).join('\n');
+export const detectDatabases = (input, hostHas = []) => {
+    const files = input.map((f) => ({ path: f.path, text: bounded(f.text) }));
+    const found = new Map();
+    const add = (db, reason) => { const list = found.get(db) ?? []; if (!list.includes(reason))
+        list.push(reason); found.set(db, list); };
+    for (const file of files) {
+        const name = fileName(file.path);
+        for (const db of DATABASES)
+            for (const [test, pattern, reason] of RULES[db])
+                if (test.test(name) && pattern.test(file.text))
+                    add(db, file.path + ': ' + reason);
+    }
+    if (!SQL.some((db) => found.has(db))) {
+        const orm = files.flatMap((file) => GENERIC_SQL.filter(([test, pattern]) => test.test(fileName(file.path)) && pattern.test(file.text)).map(([, , reason]) => file.path + ': ' + reason));
+        const host = orm.length ? (typeof hostHas === 'function' ? hostHas() : hostHas) : [];
+        const mine = SQL.find((db) => host.includes(db));
+        if (orm.length && mine)
+            add(mine, orm[0] + ', and this PC has ' + mine + ' installed');
+    }
+    return DATABASES.filter((db) => found.has(db)).map((database) => ({ database, reasons: found.get(database) }));
+};
+/** Windows service names of databases installed on this PC (from `sc query`), e.g. postgresql-x64-16, MySQL80. */
+export const databasesFromServices = (serviceNames) => {
+    const has = (r) => serviceNames.some((s) => r.test(s));
+    return DATABASES.filter((db) => ({
+        postgres: has(/^postgresql/i),
+        mysql: has(/^(mysql|mariadb)/i),
+        sqlserver: has(/^(MSSQLSERVER|MSSQL\$|SQLServer)/i),
+        mongodb: has(/^mongodb/i),
+        redis: has(/^(redis|memurai)/i),
+        dynamodb: false,
+    })[db]);
+};

package/dist/core/detect-pwsh.d.ts

@@ -0,0 +1,18 @@
+import type { ProjectFile } from './detect-databases.js';
+/** Scripts looked at: the workspace root and one folder down, at most this many, only their start. */
+export declare const PWSH_MAX_SCRIPTS = 40;
+export declare const PWSH_MAX_BYTES: number;
+/** The first script that needs PowerShell 7 and why ("moh.ps1: #Requires -Version 7"), or null. */
+export declare const usesPwsh: (files: readonly ProjectFile[]) => string | null;
+/** *.ps1 / *.psm1 / *.psd1 in the workspace root and its direct sub-folders (root first), capped. Links are skipped. */
+export declare const readPwshScripts: (root: string) => ProjectFile[];
+/** PowerShell 7 installed on this PC (the MSI's folder, or a pwsh.exe on PATH other than a Store alias). */
+export declare const pcHasPwsh: (env?: NodeJS.ProcessEnv, exists?: (p: string) => boolean) => boolean;
+/**
+ * The decision for toolchains.pwsh.enabled: true/false are kept; "auto" is on when a script needs PowerShell 7, or, in
+ * a folder that is no project yet (`fresh`), when this PC has it.
+ */
+export declare const decidePwsh: (setting: boolean | "auto", scripts: readonly ProjectFile[], fresh: boolean, pcHas: boolean) => {
+    on: boolean;
+    reason: string;
+};

package/dist/core/detect-pwsh.js

@@ -0,0 +1,111 @@
+// Does a project need PowerShell 7 (pwsh)? Windows PowerShell 5.1 ships with Windows, so a plain *.ps1 says nothing;
+// a script that asks for 7 (#Requires -Version 7 / -PSEdition Core) or tells you to run it with `pwsh` does.
+// usesPwsh is pure; readPwshScripts reads a bounded sample of the workspace (no links followed, files and bytes capped).
+import fs from 'node:fs';
+import path from 'node:path';
+/** Scripts looked at: the workspace root and one folder down, at most this many, only their start. */
+export const PWSH_MAX_SCRIPTS = 40;
+export const PWSH_MAX_BYTES = 64 * 1024;
+const MAX_LINES = 400;
+const MAX_LINE = 400;
+const SKIP = /^(node_modules|\.git|vendor|target|bin|obj|dist|build|out|\.venv|venv|packages)$/i;
+/** Why one line asks for PowerShell 7, or null. Plain string work per line (no regex that can backtrack). */
+const pwshLine = (raw) => {
+    const line = raw.trimStart().slice(0, MAX_LINE).toLowerCase();
+    if (line.startsWith('#requires')) {
+        const words = line.slice('#requires'.length).split(/\s+/).filter(Boolean);
+        const after = (flag) => words[words.indexOf(flag) + 1];
+        const version = words.includes('-version') ? Number.parseInt(after('-version') ?? '', 10) : NaN;
+        if (version >= 7)
+            return '#Requires -Version ' + version;
+        if (words.includes('-psedition') && after('-psedition') === 'core')
+            return '#Requires -PSEdition Core';
+        return null;
+    }
+    // "Usage: pwsh scripts/build.ps1", "& pwsh -File x.ps1", "pwsh.exe -NoProfile ...": the word pwsh, then an option
+    // or a script (so prose like "works in pwsh too" does not count).
+    // At most a few occurrences per line, each looking at a short window: linear in the (capped) input.
+    for (let at = line.indexOf('pwsh'), n = 0; at !== -1 && n < 4; at = line.indexOf('pwsh', at + 4), n++) {
+        const end = at + (line.startsWith('pwsh.exe', at) ? 8 : 4);
+        if (at > 0 && /[\w.$-]/.test(line[at - 1]))
+            continue;
+        if (line[end] !== ' ' && line[end] !== '\t')
+            continue;
+        const next = line.slice(end, end + 80).trimStart().split(/\s/, 1)[0] ?? '';
+        if (next.startsWith('-') || next.includes('.ps1'))
+            return 'pwsh usage';
+    }
+    return null;
+};
+/** The first script that needs PowerShell 7 and why ("moh.ps1: #Requires -Version 7"), or null. */
+export const usesPwsh = (files) => {
+    for (const file of files.slice(0, PWSH_MAX_SCRIPTS)) {
+        if (!/\.ps[dm]?1$/i.test(file.path))
+            continue;
+        const lines = file.text.slice(0, PWSH_MAX_BYTES).split(/\r?\n/, MAX_LINES);
+        for (const line of lines) {
+            const why = pwshLine(line);
+            if (why)
+                return file.path.replace(/\\/g, '/') + ': ' + why;
+        }
+    }
+    return null;
+};
+/** The start of a file, through one handle, only when that handle is a regular file. */
+const readStart = (file) => {
+    let fd = null;
+    try {
+        fd = fs.openSync(file, 'r');
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile())
+            return null;
+        const buffer = Buffer.alloc(Math.min(stat.size, PWSH_MAX_BYTES));
+        const read = fs.readSync(fd, buffer, 0, buffer.length, 0);
+        return buffer.subarray(0, read).toString('utf8');
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== null)
+            fs.closeSync(fd);
+    }
+};
+/** *.ps1 / *.psm1 / *.psd1 in the workspace root and its direct sub-folders (root first), capped. Links are skipped. */
+export const readPwshScripts = (root) => {
+    const list = (dir) => { try {
+        return fs.readdirSync(dir, { withFileTypes: true }).slice(0, 2000);
+    }
+    catch {
+        return [];
+    } };
+    const isScript = (d) => d.isFile() && /\.ps[dm]?1$/i.test(d.name);
+    const top = list(root);
+    const names = [
+        ...top.filter(isScript).map((d) => d.name),
+        ...top.filter((d) => d.isDirectory() && !d.name.startsWith('.') && !SKIP.test(d.name)).slice(0, 200)
+            .flatMap((d) => list(path.join(root, d.name)).filter(isScript).map((f) => d.name + '/' + f.name)),
+    ].slice(0, PWSH_MAX_SCRIPTS);
+    return names.flatMap((name) => { const text = readStart(path.join(root, name)); return text === null ? [] : [{ path: name, text }]; });
+};
+/** PowerShell 7 installed on this PC (the MSI's folder, or a pwsh.exe on PATH other than a Store alias). */
+export const pcHasPwsh = (env = process.env, exists = fs.existsSync) => {
+    const programFiles = env.ProgramFiles ?? 'C:\\Program Files';
+    if (exists(path.win32.join(programFiles, 'PowerShell', '7', 'pwsh.exe')))
+        return true;
+    return (env.PATH ?? env.Path ?? '').split(';').some((d) => d && !/WindowsApps/i.test(d) && exists(path.win32.join(d, 'pwsh.exe')));
+};
+/**
+ * The decision for toolchains.pwsh.enabled: true/false are kept; "auto" is on when a script needs PowerShell 7, or, in
+ * a folder that is no project yet (`fresh`), when this PC has it.
+ */
+export const decidePwsh = (setting, scripts, fresh, pcHas) => {
+    if (setting !== 'auto')
+        return { on: setting, reason: setting ? 'enabled in config' : 'disabled in config' };
+    const why = usesPwsh(scripts);
+    if (why)
+        return { on: true, reason: why };
+    if (fresh && pcHas)
+        return { on: true, reason: 'installed on this PC (new folder)' };
+    return { on: false, reason: 'no script needs PowerShell 7' };
+};

package/dist/core/detect-toolchains.d.ts

@@ -0,0 +1,30 @@
+import type { Toolchains } from './types.js';
+/** Files that show a project uses a language (looked for in the workspace and one folder down). */
+export declare const MARKERS: {
+    readonly python: readonly ["pyproject.toml", "requirements.txt", "setup.py", "setup.cfg", "Pipfile", "uv.lock", "poetry.lock", ".python-version", "*.py", "*.ipynb"];
+    readonly rust: readonly ["Cargo.toml", "rust-toolchain", "rust-toolchain.toml"];
+    readonly msvc: readonly ["*.vcxproj", "CMakePresets.json", "CMakeUserPresets.json"];
+    readonly cpp: readonly ["CMakeLists.txt", "Makefile", "meson.build", "premake5.lua", "Cargo.toml", "*.vcxproj", "*.c", "*.cpp", "*.cc", "*.h", "*.hpp"];
+    readonly dotnet: readonly ["*.sln", "*.slnx", "*.csproj", "*.fsproj", "*.vbproj", "global.json", "*.cs"];
+    readonly go: readonly ["go.mod", "go.work", "*.go"];
+    readonly java: readonly ["pom.xml", "build.gradle", "build.gradle.kts", "settings.gradle", "settings.gradle.kts", "mvnw", "gradlew", ".java-version", ".sdkmanrc", "*.java"];
+    readonly ruby: readonly ["Gemfile", "*.gemspec", ".ruby-version", "*.rb"];
+    readonly php: readonly ["composer.json", "artisan", ".php-version", "*.php"];
+    readonly deno: readonly ["deno.json", "deno.jsonc", "deno.lock"];
+    readonly pwsh: readonly [];
+};
+export type AutoToolchain = keyof typeof MARKERS;
+export declare const AUTO_TOOLCHAINS: AutoToolchain[];
+export interface ToolchainDecision {
+    on: boolean;
+    reason: string;
+}
+/**
+ * The decision per toolchain. true/false are kept; "auto" is on when the project has one of its marker files, or, in
+ * a folder that is no project yet, when this PC has the language installed. Rust needs a linker (MSVC or C/C++).
+ * hints: reasons found by reading files (a script that calls vcvars/vswhere) or about this PC ("builds Rust with MSVC"),
+ * which turn an "auto" toolchain on like a marker file does.
+ */
+export declare const decideToolchains: (settings: Toolchains, entries: string[], pcHas: AutoToolchain[], hints?: Partial<Record<AutoToolchain, string>>) => Record<AutoToolchain, ToolchainDecision>;
+/** The settings with every "auto" replaced by the decision (what the sandbox receives). */
+export declare const resolveToolchains: (settings: Toolchains, decisions: Record<AutoToolchain, ToolchainDecision>) => Toolchains;