windows-development-sandbox 1.0.5 → 1.1.0

package/sandbox/openssl.cs

@@ -0,0 +1,42 @@
+// openssl.exe stand-in on the sandbox's PATH (tools\shims), running the copy Git for Windows ships in
+// <tools>\git\mingw64\bin. A real .exe, so CreateProcess callers (Rust's Command::new("openssl"), Node's spawn) find it,
+// which a .cmd would not be; and mingw64\bin itself stays off PATH, where it would shadow the MinGW gcc.
+// It finds Git relative to itself (<tools>\shims\openssl.exe -> <tools>\git\...) and sets OPENSSL_CONF for the child
+// only when the caller has none. C# 5 (compiled in the sandbox by the .NET Framework csc).
+using System;
+using System.Diagnostics;
+using System.IO;
+
+static class OpensslShim
+{
+    static int Main()
+    {
+        string here = Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().Location);
+        string mingw = Path.GetFullPath(Path.Combine(here, "..\\git\\mingw64"));
+        string exe = Path.Combine(mingw, "bin\\openssl.exe");
+        if (!File.Exists(exe))
+        {
+            Console.Error.WriteLine("openssl is not available: Git for Windows is not installed in this sandbox.");
+            return 127;
+        }
+        var start = new ProcessStartInfo(exe, ArgumentsOf(Environment.CommandLine)) { UseShellExecute = false };
+        string conf = Path.Combine(mingw, "etc\\ssl\\openssl.cnf");
+        if (string.IsNullOrEmpty(Environment.GetEnvironmentVariable("OPENSSL_CONF")) && File.Exists(conf))
+            start.EnvironmentVariables["OPENSSL_CONF"] = conf;
+        using (Process p = Process.Start(start))
+        {
+            p.WaitForExit();
+            return p.ExitCode;
+        }
+    }
+
+    // Everything after the program name, untouched, so quoting survives exactly as the caller wrote it.
+    static string ArgumentsOf(string commandLine)
+    {
+        string s = commandLine.TrimStart();
+        int end;
+        if (s.StartsWith("\"")) { end = s.IndexOf('"', 1); end = end < 0 ? s.Length : end + 1; }
+        else { end = s.IndexOf(' '); if (end < 0) end = s.Length; }
+        return s.Substring(end).TrimStart();
+    }
+}

package/sandbox/ptyhost.cs

@@ -181,6 +181,8 @@ sealed class Client
     public readonly NetworkStream Stream;
     public readonly BlockingCollection<byte[]> Outbox = new BlockingCollection<byte[]>(4096);
     public readonly bool Remote;
+    /** Set by the writer thread once everything queued has been written and the connection is closed. */
+    public readonly ManualResetEvent Finished = new ManualResetEvent(false);
     public bool ControlOnly, Query;
     public short Cols, Rows;
     long lastSeen = DateTime.UtcNow.Ticks;
@@ -203,7 +205,11 @@ sealed class Client
     {
         try { foreach (byte[] frame in Outbox.GetConsumingEnumerable()) Stream.Write(frame, 0, frame.Length); }
         catch (Exception) { }
-        finally { try { Tcp.Close(); } catch (Exception) { } }
+        finally
+        {
+            try { Tcp.Close(); } catch (Exception) { }
+            Finished.Set();
+        }
     }
 }
 
@@ -323,7 +329,7 @@ sealed class ClientHub
         var everyone = Snapshot();
         foreach (Client c in everyone) { Send(c, Frame.Exit, code); Retire(c); }
         // Give the writer threads a moment to deliver the EXIT frame before the process ends.
-        foreach (Client c in everyone) for (int i = 0; i < 20 && c.Outbox.Count > 0; i++) Thread.Sleep(50);
+        foreach (Client c in everyone) c.Finished.WaitOne(1000);
     }
 
     /** Stops sending to a client after what is already queued (its writer closes the connection when done). */
@@ -343,11 +349,16 @@ sealed class ClientHub
         if (next != null) TakeOwnership(next);
     }
 
-    /** Disconnects a client (after at most half a second for frames already queued, e.g. "access denied"). */
+    /**
+     * Disconnects a client. Frames already queued (e.g. "access denied", STATUS) are written first: the client's writer
+     * thread closes the connection when it is done, so wait for that rather than for an empty queue (the writer takes a
+     * frame off the queue before it has written it, so an empty queue does not mean "sent"), and only force the close
+     * if the peer is not reading.
+     */
     public void Kill(Client client)
     {
         Retire(client);
-        for (int i = 0; i < 20 && client.Outbox.Count > 0; i++) Thread.Sleep(25);
+        client.Finished.WaitOne(3000);
         try { client.Tcp.Close(); } catch (Exception) { }
     }
 

package/sandbox/trust.cmd

@@ -1,35 +1,35 @@
-@echo off
-rem Runs first at logon, INSIDE the disposable sandbox only (the host PC is never touched).
-rem Lets the sandbox's own tools run without "Open File - Security Warning", SmartScreen, script-policy or UAC prompts.
-rem The security boundary is Windows Sandbox itself plus workspace-only write access and the LAN block; these prompts add
-rem nothing inside a throwaway VM except interruptions.
-set "POL=HKCU\Software\Microsoft\Windows\CurrentVersion\Policies"
-reg add "%POL%\Associations" /v LowRiskFileTypes /t REG_SZ /d ".exe;.com;.cmd;.bat;.ps1;.psm1;.msi;.vbs;.js;.zip;.7z" /f >nul
-reg add "%POL%\Attachments" /v SaveZoneInformation /t REG_DWORD /d 1 /f >nul
-rem Mapped folders and UNC paths count as Local Intranet, where launching programs is allowed without asking.
-reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" /v UNCAsIntranet /t REG_DWORD /d 1 /f >nul
-reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" /v IntranetName /t REG_DWORD /d 1 /f >nul
-rem Files copied from this PC keep their "downloaded from the internet" mark, so launching is allowed in every zone
-rem (1806 = 0), for this user and machine-wide, and ShellExecute skips the zone check altogether.
-for %%Z in (0 1 2 3 4) do (
-  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%%Z" /v 1806 /t REG_DWORD /d 0 /f >nul
-  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%%Z" /v 1806 /t REG_DWORD /d 0 /f >nul 2>&1
-)
-reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v SEE_MASK_NOZONECHECKS /t REG_SZ /d 1 /f >nul 2>&1
-set "SEE_MASK_NOZONECHECKS=1"
-rem Paths over 260 characters (deep node_modules, Gradle and NuGet caches) work for every program.
-reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v LongPathsEnabled /t REG_DWORD /d 1 /f >nul 2>&1
-rem "Windows Defender Firewall has blocked some features of this app" pops up whenever a program (node, a dev server,
-rem the session host) listens on the network. Inbound stays blocked, just silently; the attach rule lets this PC in.
-netsh advfirewall set allprofiles settings inboundusernotification disable >nul 2>&1
-for %%P in (DomainProfile PrivateProfile PublicProfile) do reg add "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\%%P" /v DisableNotifications /t REG_DWORD /d 1 /f >nul 2>&1
-rem SmartScreen ("Windows protected your PC") for downloaded, unsigned tools.
-reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableSmartScreen /t REG_DWORD /d 0 /f >nul 2>&1
-reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d Off /f >nul 2>&1
-rem PowerShell scripts (hooks, installers) run without the "Do you want to run ..." question.
-reg add "HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v ExecutionPolicy /t REG_SZ /d Bypass /f >nul 2>&1
-reg add "HKCU\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v ExecutionPolicy /t REG_SZ /d Bypass /f >nul
-rem Elevation requests from the (already admin) sandbox user are granted without a dialog.
-reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f >nul 2>&1
-reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f >nul 2>&1
-exit /b 0
+@echo off
+rem Runs first at logon, INSIDE the disposable sandbox only (the host PC is never touched).
+rem Lets the sandbox's own tools run without "Open File - Security Warning", SmartScreen, script-policy or UAC prompts.
+rem The security boundary is Windows Sandbox itself plus workspace-only write access and the LAN block; these prompts add
+rem nothing inside a throwaway VM except interruptions.
+set "POL=HKCU\Software\Microsoft\Windows\CurrentVersion\Policies"
+reg add "%POL%\Associations" /v LowRiskFileTypes /t REG_SZ /d ".exe;.com;.cmd;.bat;.ps1;.psm1;.msi;.vbs;.js;.zip;.7z" /f >nul
+reg add "%POL%\Attachments" /v SaveZoneInformation /t REG_DWORD /d 1 /f >nul
+rem Mapped folders and UNC paths count as Local Intranet, where launching programs is allowed without asking.
+reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" /v UNCAsIntranet /t REG_DWORD /d 1 /f >nul
+reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" /v IntranetName /t REG_DWORD /d 1 /f >nul
+rem Files copied from this PC keep their "downloaded from the internet" mark, so launching is allowed in every zone
+rem (1806 = 0), for this user and machine-wide, and ShellExecute skips the zone check altogether.
+for %%Z in (0 1 2 3 4) do (
+  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%%Z" /v 1806 /t REG_DWORD /d 0 /f >nul
+  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%%Z" /v 1806 /t REG_DWORD /d 0 /f >nul 2>&1
+)
+reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v SEE_MASK_NOZONECHECKS /t REG_SZ /d 1 /f >nul 2>&1
+set "SEE_MASK_NOZONECHECKS=1"
+rem Paths over 260 characters (deep node_modules, Gradle and NuGet caches) work for every program.
+reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v LongPathsEnabled /t REG_DWORD /d 1 /f >nul 2>&1
+rem "Windows Defender Firewall has blocked some features of this app" pops up whenever a program (node, a dev server,
+rem the session host) listens on the network. Inbound stays blocked, just silently; the attach rule lets this PC in.
+netsh advfirewall set allprofiles settings inboundusernotification disable >nul 2>&1
+for %%P in (DomainProfile PrivateProfile PublicProfile) do reg add "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\%%P" /v DisableNotifications /t REG_DWORD /d 1 /f >nul 2>&1
+rem SmartScreen ("Windows protected your PC") for downloaded, unsigned tools.
+reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableSmartScreen /t REG_DWORD /d 0 /f >nul 2>&1
+reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d Off /f >nul 2>&1
+rem PowerShell scripts (hooks, installers) run without the "Do you want to run ..." question.
+reg add "HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v ExecutionPolicy /t REG_SZ /d Bypass /f >nul 2>&1
+reg add "HKCU\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v ExecutionPolicy /t REG_SZ /d Bypass /f >nul
+rem Elevation requests from the (already admin) sandbox user are granted without a dialog.
+reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f >nul 2>&1
+reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f >nul 2>&1
+exit /b 0

package/schemas/config.schema.json

@@ -82,6 +82,26 @@
           "maximum": 9007199254740991,
           "description": "Upper limit for memoryMb \"auto\"."
         },
+        "maxMemoryPercent": {
+          "type": "integer",
+          "minimum": 10,
+          "maximum": 100,
+          "description": "memoryMb \"auto\" never takes more than this share of this PC's total RAM (percent)."
+        },
+        "cpuLimit": {
+          "anyOf": [
+            {
+              "type": "string",
+              "const": "none"
+            },
+            {
+              "type": "integer",
+              "minimum": 5,
+              "maximum": 100
+            }
+          ],
+          "description": "Most of this PC's CPU the sandbox may use, in percent (5-100), e.g. 50 keeps half free for you; \"none\" = no cap (Windows Sandbox would take every processor). Covers everything this tool starts in the sandbox (agents, installs, builds, its terminal)."
+        },
         "reserveHostMb": {
           "type": "integer",
           "minimum": 0,
@@ -200,6 +220,16 @@
       },
       "additionalProperties": false
     },
+    "downloads": {
+      "type": "object",
+      "properties": {
+        "requireChecksum": {
+          "type": "boolean",
+          "description": "Refuse any toolchain, database or tool download that has no published checksum (SHA-256/SHA-512) to verify it against. false = allow those, as before. Downloads that do have a published checksum are always verified. A project's .sandbox-config.json can only turn this on."
+        }
+      },
+      "additionalProperties": false
+    },
     "toolchains": {
       "type": "object",
       "properties": {
@@ -874,7 +904,7 @@
                   "const": "auto"
                 }
               ],
-              "description": "SQL Server. It cannot run inside Windows Sandbox; when a project needs it you get a hint to reach the one on this PC through hostAccess.forwards: true, false, or \"auto\" = only when the project needs it (found from compose files, dependencies of every language, Prisma/ORM config and connection strings)."
+              "description": "SQL Server. It cannot run inside Windows Sandbox; when a project needs it you get a note to use Postgres or SQLite for local work: true, false, or \"auto\" = only when the project needs it (found from compose files, dependencies of every language, Prisma/ORM config and connection strings)."
             }
           },
           "additionalProperties": false
@@ -905,6 +935,32 @@
       },
       "additionalProperties": false
     },
+    "agentCommands": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "(Beta) Typing an agent's own command on this PC (claude, codex, ...) starts it in a hidden sandbox for the folder you are in and attaches that terminal. Adds one folder to the start of YOUR PATH; off removes it. SANDBOX_AGENT_DIRECT=1 runs the real agent instead."
+        },
+        "agents": {
+          "anyOf": [
+            {
+              "type": "string",
+              "const": "auto"
+            },
+            {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "pattern": "^[A-Za-z0-9_-]+$"
+              }
+            }
+          ],
+          "description": "\"auto\" = every agent installed on this PC, or a list of agent names, e.g. [\"claude\", \"codex\"]."
+        }
+      },
+      "additionalProperties": false
+    },
     "secrets": {
       "type": "object",
       "properties": {
@@ -1056,6 +1112,49 @@
         }
       },
       "additionalProperties": false
+    },
+    "projects": {
+      "type": "object",
+      "properties": {
+        "all": {
+          "type": "boolean",
+          "description": "Map every project you have started before (and every folder in your roots) at every start, except those in exclude, so all of them open in the running sandbox without a restart. Every agent in the sandbox can then see all of them. Each one is still only set up when you first use it."
+        },
+        "exclude": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "description": "Projects left out when \"all\" is on (folders on this PC)."
+        },
+        "roots": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "description": "Folders whose subfolders are your projects (e.g. \"F:\\\\Code\"), mapped read/write at every start. Any project inside one, including ones you create later, opens in the running sandbox at once, without a restart. Every agent in the sandbox can see all of them."
+        },
+        "askToAddRoot": {
+          "type": "boolean",
+          "description": "When you start a project whose parent folder is not a root yet, ask once whether to add it."
+        },
+        "declinedRoots": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "description": "Parent folders you said no to (not asked again)."
+        },
+        "wsbShare": {
+          "type": "boolean",
+          "description": "On Windows 11 24H2+ with the Windows Sandbox command line (wsb), add other folders to the running sandbox with `wsb share` (untested). Otherwise starting a project outside every root offers a restart."
+        }
+      },
+      "additionalProperties": false,
+      "description": "Several projects in one sandbox: folders of projects mapped at every start, and adding folders while it runs."
     }
   },
   "additionalProperties": false

package/schemas/sandbox-config.schema.json

@@ -94,6 +94,12 @@
           "maximum": 9007199254740991,
           "description": "Upper limit for memoryMb \"auto\"."
         },
+        "maxMemoryPercent": {
+          "type": "integer",
+          "minimum": 10,
+          "maximum": 100,
+          "description": "memoryMb \"auto\" never takes more than this share of this PC's total RAM (percent)."
+        },
         "reserveHostMb": {
           "type": "integer",
           "minimum": 0,
@@ -191,6 +197,16 @@
       },
       "additionalProperties": false
     },
+    "downloads": {
+      "type": "object",
+      "properties": {
+        "requireChecksum": {
+          "type": "boolean",
+          "description": "Refuse any toolchain, database or tool download that has no published checksum (SHA-256/SHA-512) to verify it against. false = allow those, as before. Downloads that do have a published checksum are always verified. A project's .sandbox-config.json can only turn this on."
+        }
+      },
+      "additionalProperties": false
+    },
     "toolchains": {
       "type": "object",
       "properties": {
@@ -864,7 +880,7 @@
                   "const": "auto"
                 }
               ],
-              "description": "SQL Server. It cannot run inside Windows Sandbox; when a project needs it you get a hint to reach the one on this PC through hostAccess.forwards: true, false, or \"auto\" = only when the project needs it (found from compose files, dependencies of every language, Prisma/ORM config and connection strings)."
+              "description": "SQL Server. It cannot run inside Windows Sandbox; when a project needs it you get a note to use Postgres or SQLite for local work: true, false, or \"auto\" = only when the project needs it (found from compose files, dependencies of every language, Prisma/ORM config and connection strings)."
             }
           },
           "additionalProperties": false

package/dist/cli/commands/data.d.ts

@@ -1,46 +0,0 @@
-import { type Context } from './context.js';
-export type DataArea = 'tools' | 'databases' | 'state' | 'logs' | 'data' | 'host';
-export interface DataEntry {
-    area: DataArea;
-    name: string;
-    path: string;
-    bytes: number;
-}
-/** 1536 -> "1.5 KB". */
-export declare const humanBytes: (bytes: number) => string;
-/** Size on disk, never following links or junctions (a link counts as 0). */
-export declare const sizeOf: (p: string) => number;
-/**
- * Deletes a folder or file without ever following a link: links found anywhere inside are removed themselves first,
- * then the (now link-free) tree is deleted. A link in place of `p` is removed itself.
- */
-/** Deletes p (strictly inside root): links inside are removed first and never followed; see shared/safe-remove.ts. */
-export declare const removeTree: (p: string, root: string) => void;
-/** Every row of `sandbox data`: the sandbox's data folder by area, then what this PC keeps for it. */
-export declare const collectDataEntries: (dataPath: string, storageRoot: string) => DataEntry[];
-export interface DiskUsage {
-    drive: string;
-    totalBytes: number;
-    freeBytes: number;
-    usedBytes: number;
-    holdsStorage: boolean;
-}
-/** Every local drive's size and free space, and which one holds the sandbox storage. */
-export declare const diskUsage: (storageRoot: string) => DiskUsage[];
-export declare const dataInfo: (ctx: Context) => number;
-export interface CleanTarget {
-    /** The target as normalised (forward slashes), e.g. "tools/go". */
-    target: string;
-    path: string;
-    /** Folder the target must stay inside, with no links between the two. */
-    root: string;
-    warning?: string;
-}
-/**
- * Turns `sandbox data clean` arguments into folders. Pure (no disk access); throws a UserError for anything that is
- * not a plain relative target inside the data folder: absolute paths, drive letters, `..`, wildcards, unknown areas.
- */
-export declare const resolveCleanTargets: (inputs: string[], dataPath: string, storageRoot: string) => CleanTarget[];
-export declare const dataClean: (ctx: Context) => Promise<number>;
-/** `sandbox data [info|clean] [targets...]`. */
-export declare const data: (ctx: Context) => number | Promise<number>;

package/dist/cli/commands/data.js

@@ -1,249 +0,0 @@
-// `sandbox data`: what persists between sandboxes (toolchains, databases, agent state, logs, host storage) and
-// removing chosen parts of it. Everything under the data folder is sandbox-writable: sizes and deletes never follow
-// links, and targets resolve strictly inside the data folder.
-import fs from 'node:fs';
-import path from 'node:path';
-import readline from 'node:readline';
-import _ from 'lodash';
-import { removeRefusal, safeRemove } from '../../shared/safe-remove.js';
-import { assertNoLinks, dirExists, fail, isInsideOrEqual, isLink, removeLink } from '../../core/util.js';
-import { askYesNo } from '../../core/workspace.js';
-import { isSandboxRunning } from '../../host/platform.js';
-import { printJson, table } from './context.js';
-const AREA_ORDER = ['tools', 'databases', 'state', 'logs', 'data', 'host'];
-/** Folders of the data folder that get one row per child; anything else at the top level is listed as itself. */
-const PER_CHILD = ['tools', 'databases', 'state'];
-/** 1536 -> "1.5 KB". */
-export const humanBytes = (bytes) => {
-    const units = ['B', 'KB', 'MB', 'GB', 'TB'];
-    const i = bytes <= 0 ? 0 : Math.min(units.length - 1, Math.floor(Math.log(bytes) / Math.log(1024)));
-    const value = bytes / 1024 ** i;
-    return (i === 0 ? String(bytes) : value.toFixed(value < 10 ? 1 : 0)) + ' ' + units[i];
-};
-/** Size on disk, never following links or junctions (a link counts as 0). */
-export const sizeOf = (p) => {
-    try {
-        const stat = fs.lstatSync(p);
-        if (stat.isSymbolicLink())
-            return 0;
-        if (!stat.isDirectory())
-            return stat.size;
-        return _.sumBy(fs.readdirSync(p, { withFileTypes: true }), (d) => (d.isSymbolicLink() ? 0 : sizeOf(path.join(p, d.name))));
-    }
-    catch {
-        return 0;
-    }
-};
-/**
- * Deletes a folder or file without ever following a link: links found anywhere inside are removed themselves first,
- * then the (now link-free) tree is deleted. A link in place of `p` is removed itself.
- */
-/** Deletes p (strictly inside root): links inside are removed first and never followed; see shared/safe-remove.ts. */
-export const removeTree = (p, root) => {
-    const unlinkInside = (dir) => {
-        for (const d of fs.readdirSync(dir, { withFileTypes: true })) {
-            const child = path.join(dir, d.name);
-            if (d.isSymbolicLink() || isLink(child))
-                removeLink(child);
-            else if (d.isDirectory())
-                unlinkInside(child);
-        }
-    };
-    if (isLink(p)) {
-        removeLink(p);
-        return;
-    }
-    if (!fs.existsSync(p))
-        return;
-    // Refused before anything is touched (safeRemove below checks again).
-    const refusal = removeRefusal(p, root);
-    if (refusal)
-        throw new Error('Refusing to delete ' + p + ': ' + refusal);
-    if (dirExists(p))
-        unlinkInside(p);
-    safeRemove(p, root);
-};
-/** Real (non-link) children of a real folder; a link in place of the folder yields nothing. */
-const entriesOf = (dir) => (dirExists(dir) && !isLink(dir) ? fs.readdirSync(dir, { withFileTypes: true }).filter((d) => !d.isSymbolicLink()) : []);
-const toolRows = (toolsDir) => {
-    const entries = entriesOf(toolsDir);
-    const folders = entries.filter((d) => d.isDirectory());
-    const files = entries.filter((d) => !d.isDirectory());
-    const row = (name, p) => ({ area: 'tools', name, path: p, bytes: sizeOf(p) });
-    return [
-        ...folders.flatMap((d) => (d.name.toLowerCase() === 'agents'
-            ? entriesOf(path.join(toolsDir, d.name)).map((a) => row('agents/' + a.name, path.join(toolsDir, d.name, a.name)))
-            : [row(d.name, path.join(toolsDir, d.name))])),
-        ...(files.length ? [{ area: 'tools', name: '(files in tools)', path: toolsDir, bytes: _.sumBy(files, (f) => sizeOf(path.join(toolsDir, f.name))) }] : []),
-    ];
-};
-/** Every row of `sandbox data`: the sandbox's data folder by area, then what this PC keeps for it. */
-export const collectDataEntries = (dataPath, storageRoot) => {
-    const inData = entriesOf(dataPath);
-    const rows = inData.flatMap((d) => {
-        const p = path.join(dataPath, d.name);
-        const area = d.name.toLowerCase();
-        if (area === 'tools')
-            return toolRows(p);
-        if (PER_CHILD.includes(area))
-            return entriesOf(p).map((c) => ({ area, name: area + '/' + c.name, path: path.join(p, c.name), bytes: sizeOf(path.join(p, c.name)) }));
-        return [{ area: area === 'logs' ? 'logs' : 'data', name: d.name, path: p, bytes: sizeOf(p) }];
-    });
-    const otherData = entriesOf(path.join(storageRoot, 'data')).filter((d) => d.isDirectory() && path.join(storageRoot, 'data', d.name).toLowerCase() !== path.resolve(dataPath).toLowerCase());
-    const host = [
-        ...['launches', 'accounts', 'sync', 'logs', 'run', 'host'].map((name) => ({ area: 'host', name, path: path.join(storageRoot, name), bytes: sizeOf(path.join(storageRoot, name)) })),
-        ...otherData.map((d) => ({ area: 'host', name: 'other data folder: ' + d.name, path: path.join(storageRoot, 'data', d.name), bytes: sizeOf(path.join(storageRoot, 'data', d.name)) })),
-    ].filter((r) => fs.existsSync(r.path));
-    return _.sortBy([...rows, ...host], (r) => AREA_ORDER.indexOf(r.area), (r) => -r.bytes, (r) => r.name.toLowerCase());
-};
-const AREA_LABEL = { tools: 'Toolchains', databases: 'Databases', state: 'Agent state', logs: 'Logs', data: 'Other', host: 'On this PC' };
-/** Every local drive's size and free space, and which one holds the sandbox storage. */
-export const diskUsage = (storageRoot) => {
-    const storageDrive = path.parse(path.resolve(storageRoot)).root.toUpperCase();
-    return 'CDEFGHIJKLMNOPQRSTUVWXYZ'.split('').map((letter) => letter + ':\\').flatMap((drive) => {
-        try {
-            const s = fs.statfsSync(drive);
-            const totalBytes = s.blocks * s.bsize;
-            if (!totalBytes)
-                return [];
-            return [{ drive, totalBytes, freeBytes: s.bavail * s.bsize, usedBytes: totalBytes - s.bfree * s.bsize, holdsStorage: drive.toUpperCase() === storageDrive }];
-        }
-        catch {
-            return [];
-        }
-    });
-};
-export const dataInfo = (ctx) => {
-    const entries = collectDataEntries(ctx.dataPath, ctx.storageRoot);
-    const total = _.sumBy(entries, 'bytes');
-    const disks = diskUsage(ctx.storageRoot);
-    if (printJson(ctx, { dataPath: ctx.dataPath, storageRoot: ctx.storageRoot, totalBytes: total, entries, disks }))
-        return 0;
-    console.log('Disks\n');
-    table([['DRIVE', 'USED', 'FREE', 'SIZE', ''], ...disks.map((d) => [d.drive, humanBytes(d.usedBytes) + ' (' + Math.round((d.usedBytes / d.totalBytes) * 100) + '%)', humanBytes(d.freeBytes), humanBytes(d.totalBytes), d.holdsStorage ? '<- sandbox storage (' + humanBytes(total) + ' of it)' : ''])]);
-    console.log('');
-    console.log('Persistent data for the sandbox: ' + ctx.dataPath + ' (C:\\AgentData inside)\n');
-    if (!entries.length) {
-        console.log('Nothing stored yet. Toolchains, databases and agent logins appear here after the first start.');
-        return 0;
-    }
-    const rows = _.flatMap(_.groupBy(entries, 'area'), (group, area) => [
-        [AREA_LABEL[area], humanBytes(_.sumBy(group, 'bytes')), ''],
-        ...group.map((e) => ['  ' + e.name, humanBytes(e.bytes), e.path]),
-    ]);
-    table([...rows, ['', '', ''], ['Total', humanBytes(total), '']]);
-    console.log('\nFree space with: sandbox data clean <target...>  (e.g. tools/go, databases/postgres-18, logs, launches)');
-    return 0;
-};
-const DATA_AREAS = ['tools', 'databases', 'state', 'logs'];
-const SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._ +@-]*$/;
-const LOGIN_WARNING = 'removes the agent logins, settings and history inside the sandbox (save a Claude login first with: sandbox account save <name>)';
-const ALL_WARNING = 'removes EVERYTHING the sandbox keeps: toolchains, databases, agent logins and history, logs and launch folders';
-/**
- * Turns `sandbox data clean` arguments into folders. Pure (no disk access); throws a UserError for anything that is
- * not a plain relative target inside the data folder: absolute paths, drive letters, `..`, wildcards, unknown areas.
- */
-export const resolveCleanTargets = (inputs, dataPath, storageRoot) => {
-    const usage = 'Targets: all | tools | tools/<name> | tools/agents/<name> | databases | databases/<name> | state | state/<agent> | logs | launches. See them with: sandbox data';
-    if (!inputs.length)
-        fail('Say what to remove.', usage);
-    const resolved = inputs.map((raw) => {
-        const input = raw.trim();
-        if (!input)
-            fail('Empty target.', usage);
-        if (path.win32.isAbsolute(input) || path.posix.isAbsolute(input) || /^[A-Za-z]:/.test(input) || input.includes(':'))
-            fail('Refusing "' + raw + '": targets are relative to the data folder, not paths on this PC.', usage);
-        const parts = input.replace(/\\/g, '/').split('/').filter(Boolean);
-        const bad = parts.find((p) => !SEGMENT.test(p) || /^\.+$/.test(p) || /[. ]$/.test(p));
-        if (bad !== undefined)
-            fail('Refusing "' + raw + '": "' + bad + '" is not a plain folder name (no .., wildcards or special characters).', usage);
-        const [head, ...rest] = parts;
-        const area = head.toLowerCase();
-        if (parts.length > 3)
-            fail('Refusing "' + raw + '": too deep.', usage);
-        const target = [area, ...rest].join('/');
-        if (area === 'all' && !rest.length)
-            return { target: 'all', path: dataPath, root: path.join(storageRoot, 'data'), warning: ALL_WARNING };
-        if (area === 'launches')
-            return { target, path: path.join(storageRoot, 'launches', ...rest), root: storageRoot };
-        if (area === 'accounts' || area === 'sync')
-            fail('"' + area + '" is kept on this PC on purpose and is not removed here.', area === 'accounts' ? 'Remove a saved login with: sandbox account remove <name>' : usage);
-        if (!DATA_AREAS.includes(area))
-            fail('Unknown target "' + raw + '".', usage);
-        if (area === 'logs' && rest.length)
-            fail('Remove all logs ("logs"), not single files.', usage);
-        if (rest.length > (area === 'tools' && rest[0]?.toLowerCase() === 'agents' ? 2 : 1))
-            fail('Refusing "' + raw + '": too deep.', usage);
-        return { target, path: path.join(dataPath, area, ...rest), root: dataPath, ...(area === 'state' ? { warning: LOGIN_WARNING } : {}) };
-    });
-    // "all" covers everything; otherwise drop targets inside another target (tools + tools/go = tools).
-    const all = resolved.find((t) => t.target === 'all');
-    if (all)
-        return [all, { target: 'launches', path: path.join(storageRoot, 'launches'), root: storageRoot }];
-    const unique = _.uniqBy(resolved, (t) => t.path.toLowerCase());
-    return unique.filter((t) => !unique.some((o) => o !== t && isInsideOrEqual(o.path, t.path)));
-};
-/** Asks the user to type `expected` (a stronger confirmation than y/N). */
-const askTyped = async (question, expected) => {
-    if (!process.stdin.isTTY)
-        return false;
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    const answer = await new Promise((resolve) => rl.question(question + ' Type "' + expected + '" to confirm: ', resolve));
-    rl.close();
-    return answer.trim().toLowerCase() === expected;
-};
-export const dataClean = async (ctx) => {
-    const targets = resolveCleanTargets(ctx.options.positionals.slice(1), ctx.dataPath, ctx.storageRoot);
-    if (isSandboxRunning())
-        fail('A Windows Sandbox is running, and it uses these folders.', 'Close it first (sandbox stop), then run this again.');
-    // Every folder from the root down to the target's parent must be real; a link in place of the target is removed itself.
-    for (const t of targets)
-        assertNoLinks(t.root, path.dirname(t.path));
-    const present = targets.filter((t) => fs.existsSync(t.path) || isLink(t.path));
-    if (!present.length) {
-        console.log('Nothing to remove: ' + targets.map((t) => t.target).join(', ') + ' do(es) not exist.');
-        return 0;
-    }
-    const sized = present.map((t) => ({ ...t, bytes: sizeOf(t.path) }));
-    const total = _.sumBy(sized, 'bytes');
-    table(sized.map((t) => ['  ' + t.target, humanBytes(t.bytes), t.path]));
-    for (const t of sized)
-        if (t.warning)
-            console.log('Warning: ' + t.target + ' ' + t.warning + '.');
-    const yes = Boolean(ctx.options.yes);
-    if (!yes) {
-        const ok = sized.some((t) => t.target === 'all')
-            ? await askTyped('This cannot be undone; the next sandbox starts from scratch and reinstalls everything.', 'all')
-            : await askYesNo('Remove ' + (sized.length === 1 ? 'this' : 'these ' + sized.length) + ' (' + humanBytes(total) + ')?');
-        if (!ok) {
-            console.log('Nothing removed.' + (process.stdin.isTTY ? '' : ' Pass --yes to confirm without a prompt.'));
-            return 1;
-        }
-    }
-    const failed = [];
-    for (const t of sized) {
-        try {
-            removeTree(t.path, t.root);
-        }
-        catch (e) {
-            failed.push(t.target + ' (' + (e instanceof Error ? e.message : String(e)) + ')');
-        }
-    }
-    const freed = total - _.sumBy(sized, (t) => sizeOf(t.path));
-    console.log('Freed ' + humanBytes(freed) + '. ' + (sized.some((t) => t.root === ctx.dataPath || t.target === 'all') ? 'The next sandbox reinstalls what it needs.' : ''));
-    if (failed.length)
-        fail('Could not remove everything: ' + failed.join('; '), 'Close programs using those folders and run the same command again.');
-    return 0;
-};
-/** `sandbox data [info|clean] [targets...]`. */
-export const data = (ctx) => {
-    const [action = 'info'] = ctx.options.positionals;
-    switch (action) {
-        case 'info':
-        case 'show':
-        case 'list': return dataInfo(ctx);
-        case 'clean':
-        case 'remove': return dataClean(ctx);
-        default: return fail('Unknown data action "' + action + '".', 'Use: sandbox data  (what is stored)  or  sandbox data clean <target...>');
-    }
-};