windows-development-sandbox 1.0.5 → 1.4.0

package/dist/guest/setup/agents.js

@@ -2,14 +2,15 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { SYSTEM } from '../../shared/system.js';
-import { dryRun, exec, exists, hostToolsDir, isWin, log, mkdirp, session, toolsDir, warn } from '../env.js';
+import { uvVars } from '../toolchains/runtimes.js';
+import { dryRun, execAsync, exists, hostToolsDir, isWin, log, mkdirp, session, toolsDir, warn } from '../env.js';
 const harnessPaths = (name, harness) => {
     const dir = path.join(toolsDir, 'agents', name);
     const exe = harness.hostExecutable ?? (harness.uvBin ? harness.uvBin + '.exe' : null);
     return { dir, exe: exe ? path.join(dir, exe) : null, cmd: harness.npmBin ? path.join(dir, harness.npmBin + '.cmd') : null };
 };
 /** npm install with the runner's own npm into tools\agents\<name> (no global state outside persistent storage). */
-const installViaNpm = (name, harness, dir, env) => {
+const installViaNpm = async (name, harness, dir, env) => {
     if (!harness.npmPackage)
         throw new Error('No npmPackage configured for ' + name + ' and no host executable was available.');
     const npmCli = path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');
@@ -21,10 +22,10 @@ const installViaNpm = (name, harness, dir, env) => {
     }
     if (!exists(npmCli))
         throw new Error('npm not found at ' + npmCli);
-    exec(process.execPath, args, { env });
+    await execAsync(process.execPath, args, { env });
 };
 /** `uv tool install` with its command put straight into tools\agents\<name> (Python agents such as aider). */
-const installViaUv = (name, harness, dir, env) => {
+const installViaUv = async (name, harness, dir, env) => {
     const uv = path.join(toolsDir, 'uv', 'uv.exe');
     log('Installing ' + harness.uvPackage + ' with uv (this can take a minute)...');
     if (dryRun) {
@@ -33,10 +34,23 @@ const installViaUv = (name, harness, dir, env) => {
     }
     if (!exists(uv))
         throw new Error(name + ' is installed with uv; enable toolchains.uv');
-    exec(uv, ['tool', 'install', '--force', '--python', '3.12', harness.uvPackage], { env: { ...env, UV_TOOL_BIN_DIR: dir, UV_TOOL_DIR: path.join(toolsDir, 'uv-tools'), UV_PYTHON_INSTALL_DIR: path.join(toolsDir, 'uv-python'), UV_CACHE_DIR: path.join(toolsDir, 'uv-cache') } });
+    await execAsync(uv, ['tool', 'install', '--force', '--python', '3.12', harness.uvPackage], { env: { ...env, ...uvVars(), UV_TOOL_BIN_DIR: dir } });
 };
-/** Copies the agent from this PC when it was mapped in (primary agent only), otherwise installs it with npm or uv. */
+/** One install per agent at a time: two sessions asking for a new agent at once share the first one's install. */
+const installing = new Map();
+/**
+ * Copies the agent from this PC when it was mapped in (primary agent only), otherwise installs it with npm or uv.
+ * Asynchronous, so the session daemon keeps serving other requests while an agent installs.
+ */
 export const provisionHarness = (name, harness, env, refresh = session.provisioning.refresh) => {
+    const current = installing.get(name);
+    if (current)
+        return current;
+    const work = installHarness(name, harness, env, refresh).finally(() => installing.delete(name));
+    installing.set(name, work);
+    return work;
+};
+const installHarness = async (name, harness, env, refresh) => {
     const p = harnessPaths(name, harness);
     const cached = (p.exe !== null && exists(p.exe)) || (p.cmd !== null && exists(p.cmd));
     if (cached && !refresh) {
@@ -56,9 +70,9 @@ export const provisionHarness = (name, harness, env, refresh = session.provision
         warn('Host copy of ' + name + ' not available; installing instead.');
     }
     if (harness.uvPackage && !harness.npmPackage)
-        installViaUv(name, harness, p.dir, env);
+        await installViaUv(name, harness, p.dir, env);
     else
-        installViaNpm(name, harness, p.dir, env);
+        await installViaNpm(name, harness, p.dir, env);
 };
 /** Program + arguments that start the agent (an npm .cmd shim has to go through cmd.exe). */
 export const resolveLaunch = (name, harness) => {

package/dist/guest/setup/claude.d.ts

@@ -14,8 +14,4 @@ export declare const claudeMemPaths: {
     local: string;
 };
 export declare const restoreClaudeMem: () => void;
-/**
- * Copies the live claude-mem folder back to persistent storage (staging folder + swap, never a half copy). Called from
- * the daemon tick: when no database changed since the last save it does nothing (no copy of the whole folder).
- */
 export declare const saveClaudeMem: () => void;

package/dist/guest/setup/claude.js

@@ -3,6 +3,8 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { translatePaths } from '../../shared/paths.js';
+import { writeJsonAtomic } from '../../shared/rundir.js';
+import { safeRemove } from '../../shared/safe-remove.js';
 import { claudeDir, dryRun, exists, launchDir, log, mkdirp, robocopy, session, stateDir, warn, workspace } from '../env.js';
 /** The sandbox keeps its own login and global state; everything else is refreshed from this PC each boot. */
 const KEEP_SANDBOX_COPY = ['.claude.json', '.credentials.json'];
@@ -41,7 +43,7 @@ export const mergeMcpServers = (hostFile, guestFile, hostWorkspace, guestWorkspa
     const guestKey = Object.keys(projects).find((key) => sameFolder(key, guestWorkspace)) ?? guestWorkspace.replace(/\\/g, '/');
     projects[guestKey] = { ...(projects[guestKey] ?? {}), mcpServers: { ...(projects[guestKey]?.mcpServers ?? {}), ...hostProject } };
     const merged = { ...guest, mcpServers: { ...(guest.mcpServers ?? {}), ...(host.mcpServers ?? {}) }, projects };
-    fs.writeFileSync(guestFile, JSON.stringify(merged, null, 2) + '\n', 'utf8');
+    writeJsonAtomic(guestFile, merged);
     return Object.keys(host.mcpServers ?? {}).length + Object.keys(hostProject).length;
 };
 export const syncClaudeProfile = () => {
@@ -63,7 +65,7 @@ export const syncClaudeProfile = () => {
         }
         // Folders (skills, commands, plugins) are mirrored: what was removed on this PC goes here too.
         if (fs.statSync(from).isDirectory())
-            fs.rmSync(to, { recursive: true, force: true });
+            safeRemove(to, claudeDir);
         fs.cpSync(from, to, { recursive: true, force: true });
         log('Claude settings: copied ' + name + ' from this PC');
     }
@@ -81,7 +83,24 @@ export const syncClaudeProfile = () => {
 export const claudeMemPaths = { store: path.join(stateDir, 'claude-mem'), local: path.join(os.homedir(), '.claude-mem') };
 const claudeMemEnabled = () => session.claudeProfile.syncClaudeMem && !dryRun;
 export const restoreClaudeMem = () => {
-    if (!claudeMemEnabled() || !exists(claudeMemPaths.store))
+    if (!claudeMemEnabled())
+        return;
+    // A save cut off between its two renames (see saveClaudeMem) leaves only the aside copy: it is the newest data.
+    const previous = claudeMemPaths.store + '.previous';
+    if (!exists(claudeMemPaths.store) && exists(previous))
+        fs.renameSync(previous, claudeMemPaths.store);
+    // A store that is gone or damaged: the newest backup that is a real database.
+    const backups = claudeMemPaths.store + '.backups';
+    if (!looksLikeSqlite(path.join(claudeMemPaths.store, 'claude-mem.db')) || !exists(claudeMemPaths.store)) {
+        const good = (exists(backups) ? fs.readdirSync(backups).sort().reverse() : []).find((b) => exists(path.join(backups, b, 'claude-mem.db')) && looksLikeSqlite(path.join(backups, b, 'claude-mem.db')));
+        if (good) {
+            if (exists(claudeMemPaths.store))
+                fs.renameSync(claudeMemPaths.store, claudeMemPaths.store + '.damaged-' + Date.now());
+            fs.cpSync(path.join(backups, good), claudeMemPaths.store, { recursive: true });
+            warn('claude-mem: the stored database was missing or damaged; restored the backup from ' + new Date(Number(good)).toISOString() + '.');
+        }
+    }
+    if (!exists(claudeMemPaths.store))
         return;
     robocopy(claudeMemPaths.store, claudeMemPaths.local);
     log('claude-mem data restored from persistent storage.');
@@ -109,6 +128,36 @@ let lastSaved = null;
  * Copies the live claude-mem folder back to persistent storage (staging folder + swap, never a half copy). Called from
  * the daemon tick: when no database changed since the last save it does nothing (no copy of the whole folder).
  */
+const SQLITE_HEADER = 'SQLite format 3\0';
+/** A database file that starts like SQLite and is not empty (a missing one counts as fine: nothing to protect yet). */
+const looksLikeSqlite = (file) => {
+    if (!exists(file))
+        return true;
+    const fd = fs.openSync(file, 'r');
+    try {
+        const head = Buffer.alloc(16);
+        return fs.readSync(fd, head, 0, 16, 0) === 16 && head.toString('latin1') === SQLITE_HEADER;
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+};
+const MAX_BACKUPS = 3;
+const BACKUP_EVERY_MS = 6 * 3600 * 1000;
+/** Moves the replaced copy into `dir` as a dated backup (at most one per 6 hours, the newest 3 kept); else deletes it. */
+const keepBackup = (previous, dir) => {
+    if (!exists(previous))
+        return;
+    const backups = exists(dir) ? fs.readdirSync(dir).filter((n) => /^\d{13}$/.test(n)).sort() : [];
+    const newest = Number(backups[backups.length - 1] ?? 0);
+    if (Date.now() - newest < BACKUP_EVERY_MS) {
+        fs.rmSync(previous, { recursive: true, force: true });
+        return;
+    }
+    fs.renameSync(previous, path.join(mkdirp(dir), String(Date.now())));
+    for (const old of [...backups, String(Date.now())].slice(0, -MAX_BACKUPS))
+        fs.rmSync(path.join(dir, old), { recursive: true, force: true });
+};
 export const saveClaudeMem = () => {
     if (!claudeMemEnabled() || !exists(claudeMemPaths.local))
         return;
@@ -116,12 +165,17 @@ export const saveClaudeMem = () => {
     const fingerprint = databaseFingerprint(local);
     if (fingerprint === lastSaved && exists(store))
         return;
+    // A damaged copy (zero-filled after a crash, cut short) must never replace the store: that once destroyed the only copy.
+    if (!looksLikeSqlite(path.join(local, 'claude-mem.db'))) {
+        warn('claude-mem: the local database does not look valid, so it was not saved over the stored copy (' + local + ').');
+        return;
+    }
     const incoming = store + '.incoming';
     const previous = store + '.previous';
     fs.rmSync(incoming, { recursive: true, force: true });
     // The database, its -wal and -shm files are copied together, so the copy is consistent with itself.
     fs.cpSync(local, incoming, { recursive: true, filter: (src) => !/\.(pid|lock)$/i.test(src) });
-    // Swap without a window where no copy exists: old aside, new in, then drop the old one.
+    // Swap without a window where no copy exists: old aside, new in, then keep the old one as a dated backup.
     fs.rmSync(previous, { recursive: true, force: true });
     if (exists(store))
         fs.renameSync(store, previous);
@@ -133,6 +187,6 @@ export const saveClaudeMem = () => {
             fs.renameSync(previous, store);
         throw e;
     }
-    fs.rmSync(previous, { recursive: true, force: true });
+    keepBackup(previous, store + '.backups');
     lastSaved = fingerprint;
 };

package/dist/guest/setup/environment.d.ts

@@ -1,6 +1,16 @@
 import type { ToolEnv } from '../toolchains/index.js';
-export declare const agentEnv: (tools: Pick<ToolEnv, "vars" | "prepend" | "append">) => NodeJS.ProcessEnv;
+/** Whose environment: the launch folder's at boot, or a project registered later (with the boot's base environment). */
+export interface EnvTarget {
+    workspace: string;
+    project: string;
+    base: NodeJS.ProcessEnv;
+}
+export declare const agentEnv: (tools: Pick<ToolEnv, "vars" | "prepend" | "append">, target?: EnvTarget) => NodeJS.ProcessEnv;
 /** Makes the agent environment machine-wide, so new terminal tabs and anything the agent starts see the same tools. */
 export declare const persistEnvironment: (env: NodeJS.ProcessEnv, toolVars: string[]) => void;
-/** Adds variables and PATH folders machine-wide after boot (`sbx-db start`): new terminal tabs see them. */
-export declare const addMachineEnvironment: (vars: Record<string, string>, dirs: string[]) => void;
+/**
+ * Adds variables and PATH folders machine-wide after boot (`sbx-db start`): new terminal tabs see them.
+ * additive: for a project registered later. Only variables not set yet, and folders go to the END of PATH, so what
+ * the boot project's terminals see never changes; the project's own sessions get its full environment anyway.
+ */
+export declare const addMachineEnvironment: (vars: Record<string, string>, dirs: string[], additive?: boolean) => void;

package/dist/guest/setup/environment.js

@@ -3,28 +3,28 @@ import path from 'node:path';
 import { claudeDir, dataDir, dryRun, errMsg, isWin, testMode, mkdirp, powershell, session, stateDir, toolsDir, warn, workspace } from '../env.js';
 /** Variables agent-sandbox itself sets (besides the toolchains' own). */
 const AGENT_VARS = ['CLAUDE_CONFIG_DIR', 'CODEX_HOME', 'GEMINI_CLI_HOME', 'npm_config_cache', 'npm_config_update_notifier', 'AGENT_WORKSPACE', 'AGENT_DATA', 'AGENT_TOOLS', 'AGENT_PROJECT', 'AGENT_SANDBOX', 'AGENT_SANDBOX_WORKSPACE'];
-export const agentEnv = (tools) => {
+export const agentEnv = (tools, target = { workspace, project: session.project, base: process.env }) => {
     const env = {
-        ...process.env,
+        ...target.base,
         ...tools.vars,
         CLAUDE_CONFIG_DIR: claudeDir,
         CODEX_HOME: path.join(stateDir, 'codex'),
         GEMINI_CLI_HOME: path.join(stateDir, 'gemini'),
         npm_config_cache: path.join(toolsDir, 'npm-cache'),
         npm_config_update_notifier: 'false',
-        AGENT_WORKSPACE: workspace,
+        AGENT_WORKSPACE: target.workspace,
         AGENT_DATA: dataDir,
         AGENT_TOOLS: toolsDir,
-        AGENT_PROJECT: session.project,
+        AGENT_PROJECT: target.project,
         // For project scripts: "am I in the sandbox, and where is the project?" (stable names; documented).
         AGENT_SANDBOX: '1',
-        AGENT_SANDBOX_WORKSPACE: workspace,
+        AGENT_SANDBOX_WORKSPACE: target.workspace,
     };
     for (const dir of [env.CLAUDE_CONFIG_DIR, env.CODEX_HOME, env.GEMINI_CLI_HOME, env.npm_config_cache])
         mkdirp(dir);
     // The runner's own Node (bootstrap.ps1 puts it first on PATH) is not exposed: `node` is whatever nvm selected.
     const runners = [path.join(toolsDir, 'node'), path.dirname(process.execPath)].map((d) => d.toLowerCase());
-    const base = (process.env.PATH ?? '').split(path.delimiter).filter((d) => d && !runners.includes(d.toLowerCase()));
+    const base = (target.base.PATH ?? '').split(path.delimiter).filter((d) => d && !runners.includes(d.toLowerCase()));
     env.PATH = [...new Set([...tools.prepend, ...base, ...tools.append])].join(path.delimiter);
     return env;
 };
@@ -45,16 +45,20 @@ export const persistEnvironment = (env, toolVars) => {
         warn('Could not persist the environment machine-wide: ' + errMsg(e));
     }
 };
-/** Adds variables and PATH folders machine-wide after boot (`sbx-db start`): new terminal tabs see them. */
-export const addMachineEnvironment = (vars, dirs) => {
+/**
+ * Adds variables and PATH folders machine-wide after boot (`sbx-db start`): new terminal tabs see them.
+ * additive: for a project registered later. Only variables not set yet, and folders go to the END of PATH, so what
+ * the boot project's terminals see never changes; the project's own sessions get its full environment anyway.
+ */
+export const addMachineEnvironment = (vars, dirs, additive = false) => {
     if (!isWin || dryRun || testMode)
         return;
     const script = [
         "$vars = '" + JSON.stringify(vars).replace(/'/g, "''") + "' | ConvertFrom-Json",
-        "foreach ($p in $vars.PSObject.Properties) { [Environment]::SetEnvironmentVariable($p.Name, [string]$p.Value, 'Machine') }",
+        "foreach ($p in $vars.PSObject.Properties) { " + (additive ? "if ([Environment]::GetEnvironmentVariable($p.Name, 'Machine')) { continue }; " : '') + "[Environment]::SetEnvironmentVariable($p.Name, [string]$p.Value, 'Machine') }",
         "$path = [Environment]::GetEnvironmentVariable('Path', 'Machine') -split ';'",
         "$add = '" + JSON.stringify(dirs).replace(/'/g, "''") + "' | ConvertFrom-Json | Where-Object { $path -notcontains $_ }",
-        "if ($add) { [Environment]::SetEnvironmentVariable('Path', ((@($add) + $path) -join ';'), 'Machine') }",
+        "if ($add) { [Environment]::SetEnvironmentVariable('Path', (" + (additive ? '($path + @($add))' : '(@($add) + $path)') + " -join ';'), 'Machine') }",
     ].join('\n');
     try {
         powershell(script);

package/dist/guest/setup/hooks.d.ts

@@ -1 +1,9 @@
-export declare const runHooks: (stage: string, env: NodeJS.ProcessEnv) => void;
+/** Hooks of the launch folder (C:\AgentLaunch\hooks), or of a project registered later (...\projects\<name>\hooks). */
+export interface HookTarget {
+    root: string;
+    cwd: string;
+}
+export declare const projectHooks: (name: string, cwd: string) => HookTarget;
+export declare const runHooks: (stage: string, env: NodeJS.ProcessEnv, target?: HookTarget) => void;
+/** The same without blocking: the session daemon keeps answering other requests while a project's hooks run. */
+export declare const runHooksAsync: (stage: string, env: NodeJS.ProcessEnv, target: HookTarget) => Promise<void>;

package/dist/guest/setup/hooks.js

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { SYSTEM } from '../../shared/system.js';
+import { spawnAsync } from '../../shared/download.js';
 import { exists, isWin, launchDir, log, session, warn, workspace } from '../env.js';
 const commandFor = (file) => {
     const ext = path.extname(file).toLowerCase();
@@ -16,21 +17,34 @@ const commandFor = (file) => {
         return [SYSTEM.cmd(), ['/d', '/c', file]];
     return null;
 };
-export const runHooks = (stage, env) => {
-    const dir = path.join(launchDir, 'hooks', stage);
+const BOOT = { root: path.join(launchDir, 'hooks'), cwd: workspace };
+export const projectHooks = (name, cwd) => ({ root: path.join(launchDir, 'projects', name, 'hooks'), cwd });
+const hooksOf = (stage, target) => {
+    const dir = path.join(target.root, stage);
     if (!exists(dir))
-        return;
-    for (const name of fs.readdirSync(dir).sort()) {
-        const command = commandFor(path.join(dir, name));
-        if (!command)
-            continue;
+        return [];
+    return fs.readdirSync(dir).sort().flatMap((name) => { const command = commandFor(path.join(dir, name)); return command ? [{ name, command }] : []; });
+};
+const failed = (stage, name, status) => {
+    const message = 'Hook failed (' + stage + '/' + name + ', exit ' + status + ')';
+    if (session.hooks.failFast)
+        throw new Error(message);
+    warn(message);
+};
+export const runHooks = (stage, env, target = BOOT) => {
+    for (const { name, command } of hooksOf(stage, target)) {
+        log('Hook [' + stage + ']: ' + name);
+        const result = spawnSync(command[0], command[1], { stdio: 'inherit', cwd: target.cwd, env });
+        if (result.status !== 0)
+            failed(stage, name, result.status);
+    }
+};
+/** The same without blocking: the session daemon keeps answering other requests while a project's hooks run. */
+export const runHooksAsync = async (stage, env, target) => {
+    for (const { name, command } of hooksOf(stage, target)) {
         log('Hook [' + stage + ']: ' + name);
-        const result = spawnSync(command[0], command[1], { stdio: 'inherit', cwd: workspace, env });
-        if (result.status === 0)
-            continue;
-        const message = 'Hook failed (' + stage + '/' + name + ', exit ' + result.status + ')';
-        if (session.hooks.failFast)
-            throw new Error(message);
-        warn(message);
+        const status = await spawnAsync(command[0], command[1], { stdio: 'ignore', cwd: target.cwd, env, windowsHide: true });
+        if (status !== 0)
+            failed(stage, name, status);
     }
 };

package/dist/guest/setup/network.d.ts

@@ -6,5 +6,14 @@ export type LanState = 'blocked' | 'open' | 'offline';
  * all, the block stays in place: being offline is never a reason to open the LAN.
  */
 export declare const applyNetworkPolicy: (ptyHostExe: string | null) => Promise<LanState>;
+/** HTTP_PROXY & co. for everything in the sandbox: its own proxy (allowOnly) or yours (network.proxy). */
+export declare const proxyEnv: () => Record<string, string>;
+/**
+ * network.allowOnly, after the tools are installed: the sandbox's proxy (a copy of Node named sbx-netproxy.exe, so the
+ * firewall can tell it apart) is the only program allowed out, besides DNS and DHCP; Windows and browsers use it as
+ * the system proxy, everything else through HTTP_PROXY. A guardrail for agents that behave: an admin in the sandbox
+ * could undo it, which is why sandbox.networking false is the only hard isolation.
+ */
+export declare const applyAllowOnly: () => Promise<boolean>;
 /** Guest IPv4 addresses the host can use to reach session ports. */
 export declare const guestAddresses: () => string[];

package/dist/guest/setup/network.js

@@ -1,10 +1,13 @@
 // Guest firewall: block the host's LAN (keeping DNS/DHCP to the gateway) and let the host reach session ports.
 import dns from 'node:dns';
+import fs from 'node:fs';
 import os from 'node:os';
-import { spawnSync } from 'node:child_process';
-import { buildFirewallCommands, ipv4DnsServers, parseDefaultGateways, parseDnsServers } from '../../shared/netrules.js';
+import path from 'node:path';
+import { spawn, spawnSync } from 'node:child_process';
+import { expandAllowList, PROXY_PORT, relayPort, withBlockedHosts } from '../../shared/netpolicy.js';
+import { buildFirewallCommands, ipv4DnsServers, isIPv4, parseDefaultGateways, parseDnsServers } from '../../shared/netrules.js';
 import { SYSTEM } from '../../shared/system.js';
-import { dryRun, isWin, log, session, warn } from '../env.js';
+import { dryRun, errMsg, isWin, launchDir, log, session, toolsDir, warn } from '../env.js';
 const ATTACH_RULE = 'AgentSandbox-Attach';
 const netsh = (args) => {
     const r = spawnSync(SYSTEM.netsh(), args, { encoding: 'utf8', windowsHide: true });
@@ -68,7 +71,21 @@ export const applyNetworkPolicy = async (ptyHostExe) => {
     const block = session.network.blockPrivateRanges;
     const exempt = block ? discoverExemptIps() : [];
     const lanRules = block ? buildFirewallCommands(exempt) : [];
-    const commands = [...lanRules, ...(ptyHostExe && session.attach.enabled ? attachRule(ptyHostExe) : [])];
+    const commands = [...lanRules, ...(ptyHostExe && session.attach.enabled ? attachRule(ptyHostExe) : []), ...forwardRule()];
+    if (isWin && !dryRun) {
+        try {
+            applyBlockedHosts();
+        }
+        catch (e) {
+            warn('network.blockHosts could not be applied: ' + errMsg(e));
+        }
+        try {
+            applyDns();
+        }
+        catch (e) {
+            warn('network.dns could not be applied: ' + errMsg(e));
+        }
+    }
     if (!block)
         log('Private-range blocking disabled by config.');
     if (block)
@@ -95,5 +112,81 @@ export const applyNetworkPolicy = async (ptyHostExe) => {
     log('LAN blocked in the guest firewall (10/8, 172.16/12, 192.168/16, 100.64/10, link-local, multicast, IPv6 local, SMB); DNS/DHCP to the gateway allowed.');
     return 'blocked';
 };
+// ---- the rest of the network settings -----------------------------------------------------------------------------
+const FORWARD_RULE = 'AgentSandbox-Forward';
+const ALLOW_RULES = ['AgentSandbox-Proxy-Out', 'AgentSandbox-DNS-Out-UDP', 'AgentSandbox-DNS-Out-TCP', 'AgentSandbox-DHCP-Out'];
+const HOSTS_FILE = path.join(process.env.WINDIR ?? 'C:\\Windows', 'System32', 'drivers', 'etc', 'hosts');
+/** network.blockHosts: those names go nowhere (the sandbox's hosts file; the registry and files are new every boot). */
+const applyBlockedHosts = () => {
+    const hosts = session.network.blockHosts ?? [];
+    if (!hosts.length)
+        return;
+    const text = fs.existsSync(HOSTS_FILE) ? fs.readFileSync(HOSTS_FILE, 'utf8') : '';
+    fs.writeFileSync(HOSTS_FILE, withBlockedHosts(text, hosts));
+    log('Blocked hosts (network.blockHosts): ' + hosts.join(', '));
+};
+/** network.dns: these servers on every connected adapter. */
+const applyDns = () => {
+    const servers = (session.network.dns ?? []).filter(isIPv4);
+    if (!servers.length)
+        return;
+    const r = spawnSync(SYSTEM.powershell(), ['-NoLogo', '-NoProfile', '-Command', "Get-NetAdapter | Where-Object Status -eq 'Up' | Set-DnsClientServerAddress -ServerAddresses " + servers.map((s) => "'" + s + "'").join(',')], { encoding: 'utf8', windowsHide: true });
+    if (r.status !== 0)
+        throw new Error('could not set the DNS servers: ' + (r.stderr ?? '').trim().slice(0, 300));
+    log('DNS servers (network.dns): ' + servers.join(', '));
+};
+/** network.forwardPorts: the relays (in the daemon) take connections from the PC only, i.e. the sandbox's own subnet. */
+const forwardRule = () => {
+    const forwards = session.network.forwardPorts ?? [];
+    return forwards.length ? [
+        ['advfirewall', 'firewall', 'delete', 'rule', 'name=' + FORWARD_RULE],
+        ['advfirewall', 'firewall', 'add', 'rule', 'name=' + FORWARD_RULE, 'dir=in', 'action=allow', 'enable=yes', 'profile=any', 'protocol=tcp', 'remoteip=LocalSubnet', 'localport=' + forwards.map((_f, i) => relayPort(i)).join(',')],
+    ] : [];
+};
+/** HTTP_PROXY & co. for everything in the sandbox: its own proxy (allowOnly) or yours (network.proxy). */
+export const proxyEnv = () => {
+    const own = (session.network.allowOnly ?? []).length > 0;
+    const url = own ? 'http://127.0.0.1:' + PROXY_PORT : session.network.proxy ?? '';
+    if (!url)
+        return {};
+    const noProxy = 'localhost,127.0.0.1,::1';
+    return { HTTP_PROXY: url, HTTPS_PROXY: url, http_proxy: url, https_proxy: url, NO_PROXY: noProxy, no_proxy: noProxy };
+};
+/**
+ * network.allowOnly, after the tools are installed: the sandbox's proxy (a copy of Node named sbx-netproxy.exe, so the
+ * firewall can tell it apart) is the only program allowed out, besides DNS and DHCP; Windows and browsers use it as
+ * the system proxy, everything else through HTTP_PROXY. A guardrail for agents that behave: an admin in the sandbox
+ * could undo it, which is why sandbox.networking false is the only hard isolation.
+ */
+export const applyAllowOnly = async () => {
+    const hosts = session.network.allowOnly ?? [];
+    if (!session.networking || !hosts.length)
+        return false;
+    if (!isWin || dryRun) {
+        log('(dry run) would allow only: ' + hosts.join(', '));
+        return false;
+    }
+    const exe = path.join(toolsDir, 'netproxy', 'sbx-netproxy.exe');
+    fs.mkdirSync(path.dirname(exe), { recursive: true });
+    if (!fs.existsSync(exe) || fs.statSync(exe).size !== fs.statSync(process.execPath).size)
+        fs.copyFileSync(process.execPath, exe);
+    spawn(exe, [path.join(launchDir, 'runtime', 'netproxy.js')], { detached: true, stdio: 'ignore', windowsHide: true }).unref();
+    const add = (name, extra) => ['advfirewall', 'firewall', 'add', 'rule', 'name=' + name, 'dir=out', 'action=allow', 'enable=yes', 'profile=any', ...extra];
+    run([
+        ...ALLOW_RULES.map((n) => ['advfirewall', 'firewall', 'delete', 'rule', 'name=' + n]),
+        add('AgentSandbox-Proxy-Out', ['program=' + exe]),
+        add('AgentSandbox-DNS-Out-UDP', ['protocol=udp', 'remoteport=53']),
+        add('AgentSandbox-DNS-Out-TCP', ['protocol=tcp', 'remoteport=53']),
+        add('AgentSandbox-DHCP-Out', ['protocol=udp', 'remoteport=67', 'localport=68']),
+        ['advfirewall', 'set', 'allprofiles', 'firewallpolicy', 'blockinbound,blockoutbound'],
+        ['winhttp', 'set', 'proxy', '127.0.0.1:' + PROXY_PORT, '<local>'],
+    ]);
+    const internet = 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings';
+    for (const [name, type, value] of [['ProxyEnable', 'REG_DWORD', '1'], ['ProxyServer', 'REG_SZ', '127.0.0.1:' + PROXY_PORT], ['ProxyOverride', 'REG_SZ', '<local>']]) {
+        spawnSync(SYSTEM.reg(), ['add', internet, '/v', name, '/t', type, '/d', value, '/f'], { windowsHide: true, stdio: 'ignore' });
+    }
+    log('Only these hosts can be reached now (network.allowOnly): ' + expandAllowList(hosts).join(', ') + '. Refused ones are listed in logs\\netproxy.log.');
+    return true;
+};
 /** Guest IPv4 addresses the host can use to reach session ports. */
 export const guestAddresses = () => Object.values(os.networkInterfaces()).flat().filter((i) => Boolean(i) && i.family === 'IPv4' && !i.internal).map((i) => i.address);

package/dist/guest/setup/user.js

@@ -44,4 +44,8 @@ export const setupGitConfig = (env) => {
     spawnSync(git, ['config', '--global', '--add', 'safe.directory', '*'], { env: rest, windowsHide: true, stdio: 'ignore' });
     // Windows long paths are on in the sandbox, but git skips files over 260 characters unless told.
     spawnSync(git, ['config', '--global', 'core.longpaths', 'true'], { env: rest, windowsHide: true, stdio: 'ignore' });
+    // Git for Windows' system config says autocrlf=true: checkouts made in the sandbox (worktrees, clones) got CRLF and
+    // tools that want LF (rustfmt, shellcheck, prettier) failed on every file. "input" keeps the line endings the repo
+    // has, and a checkout from your PC (CRLF in the folder) still shows as unchanged.
+    spawnSync(git, ['config', '--global', 'core.autocrlf', 'input'], { env: rest, windowsHide: true, stdio: 'ignore' });
 };

package/dist/guest/toolchains/catalogue.d.ts

@@ -17,6 +17,8 @@ export interface CliTool {
     subdir?: string;
     /** What the tool is for (summary and docs). */
     about: string;
+    /** Rough download size for the progress line. */
+    size: string;
 }
 export declare const CLI_TOOLS: readonly [{
     readonly name: "gh";
@@ -24,12 +26,14 @@ export declare const CLI_TOOLS: readonly [{
     readonly asset: (arch: Arch) => RegExp;
     readonly exe: "gh.exe";
     readonly about: "GitHub CLI";
+    readonly size: "15 MB";
 }, {
     readonly name: "zstd";
     readonly repo: "facebook/zstd";
     readonly asset: () => RegExp;
     readonly exe: "zstd.exe";
     readonly about: "Zstandard compression";
+    readonly size: "2 MB";
 }];
 export type CliName = (typeof CLI_TOOLS)[number]['name'] | 'openssl';
 export declare const CLI_NAMES: readonly CliName[];

package/dist/guest/toolchains/catalogue.js

@@ -4,9 +4,9 @@ export const pwshAsset = (arch) => (arch === 'arm64' ? /^PowerShell-\d+\.\d+\.\d
 export const binstallAsset = (arch) => (arch === 'arm64' ? /^cargo-binstall-aarch64-pc-windows-msvc\.zip$/ : /^cargo-binstall-x86_64-pc-windows-msvc\.zip$/);
 export const CLI_TOOLS = [
     // gh_2.102.0_windows_amd64.zip holds bin\gh.exe.
-    { name: 'gh', repo: 'cli/cli', asset: (arch) => (arch === 'arm64' ? /^gh_\d+\.\d+\.\d+_windows_arm64\.zip$/ : /^gh_\d+\.\d+\.\d+_windows_amd64\.zip$/), exe: 'gh.exe', about: 'GitHub CLI' },
+    { name: 'gh', repo: 'cli/cli', asset: (arch) => (arch === 'arm64' ? /^gh_\d+\.\d+\.\d+_windows_arm64\.zip$/ : /^gh_\d+\.\d+\.\d+_windows_amd64\.zip$/), exe: 'gh.exe', about: 'GitHub CLI', size: '15 MB' },
     // zstd-v1.5.7-win64.zip; there is no arm64 build, and Windows on Arm runs the x64 one.
-    { name: 'zstd', repo: 'facebook/zstd', asset: () => /^zstd-v\d+\.\d+\.\d+-win64\.zip$/, exe: 'zstd.exe', about: 'Zstandard compression' },
+    { name: 'zstd', repo: 'facebook/zstd', asset: () => /^zstd-v\d+\.\d+\.\d+-win64\.zip$/, exe: 'zstd.exe', about: 'Zstandard compression', size: '2 MB' },
 ];
 export const CLI_NAMES = [...CLI_TOOLS.map((t) => t.name), 'openssl'];
 /**

package/dist/guest/toolchains/cli.js

@@ -2,39 +2,40 @@
 // `openssl` shim onto the copy Git for Windows already ships.
 import fs from 'node:fs';
 import path from 'node:path';
-import { dryRun, errMsg, exists, log, mkdirp, stateDir, warn, workspace } from '../env.js';
+import { dryRun, errMsg, exists, log, mkdirp, stateDir, warn } from '../env.js';
+import { projectWorkspace } from '../project-context.js';
 import { CLI_TOOLS, decideCli } from './catalogue.js';
 import { arch, tool } from './common.js';
 import { setupSingleExe } from './runtimes.js';
+import { ensureCompiled } from '../helpers.js';
 /** gh keeps `gh auth login` here, under the agent state (persists like Claude's own login; never copied from the PC). */
 export const ghConfigDir = () => path.join(stateDir, 'gh');
 const toolVars = {
     gh: () => ({ GH_CONFIG_DIR: mkdirp(ghConfigDir()), GH_NO_UPDATE_NOTIFIER: '1', GH_NO_EXTENSION_UPDATE_NOTIFIER: '1' }),
 };
 /**
- * openssl.cmd in tools\shims, running Git's mingw64\bin\openssl.exe. Only the shim: putting mingw64\bin itself on PATH
- * would bring Git's own gcc-runtime DLLs, curl, and friends along and could shadow MinGW's gcc from the C/C++ step.
- * setlocal keeps OPENSSL_CONF from leaking into a cmd prompt that runs `openssl`. (A .cmd is found by shells and
- * by programs that use cmd /c; Rust's Command::new("openssl") looks only for openssl.exe.)
+ * tools\shims\openssl.exe (sandbox/openssl.cs), a launcher for Git's mingw64\bin\openssl.exe. A real .exe so programs
+ * that call CreateProcess directly (Rust's Command::new("openssl")) find it, and only the shim is on PATH: mingw64\bin
+ * itself would bring Git's runtime DLLs along and could shadow MinGW's gcc from the C/C++ step.
  */
 const shimOpenssl = (env) => {
-    const exe = tool('git', 'mingw64', 'bin', 'openssl.exe');
-    if (!exists(exe)) {
+    if (!exists(tool('git', 'mingw64', 'bin', 'openssl.exe'))) {
         env.summary.push('openssl: not in this Git for Windows (skipped)');
         return;
     }
-    const conf = tool('git', 'mingw64', 'etc', 'ssl', 'openssl.cnf');
-    const lines = ['@echo off', 'setlocal', ...(exists(conf) ? ['if not defined OPENSSL_CONF set "OPENSSL_CONF=' + conf + '"'] : []), '"' + exe + '" %*'];
-    fs.writeFileSync(path.join(mkdirp(tool('shims')), 'openssl.cmd'), lines.join('\r\n') + '\r\n');
-    env.prepend.push(tool('shims'));
-    env.summary.push('openssl: Git for Windows\' copy (shim)');
+    const shims = mkdirp(tool('shims'));
+    fs.copyFileSync(ensureCompiled('openssl'), path.join(shims, 'openssl.exe'));
+    // An earlier version wrote a .cmd; it would still win for shells that prefer it.
+    fs.rmSync(path.join(shims, 'openssl.cmd'), { force: true });
+    env.prepend.push(shims);
+    env.summary.push('openssl: Git for Windows\' copy');
 };
 /**
  * Installs the tools toolchains.cli asks for. Settings still "auto" here (normally the host decides) use the same
  * rules on the workspace as the host would. The gh rule is enforced here again, whatever the host sent.
  */
 export const setupCli = async (env, settings, gitAccess, refresh = false) => {
-    const decisions = decideCli(settings, { gitAccess, hasGithubDir: exists(path.join(workspace, '.github')) });
+    const decisions = decideCli(settings, { gitAccess, hasGithubDir: exists(path.join(projectWorkspace(), '.github')) });
     if (settings.gh && !decisions.gh.on) {
         env.summary.push('gh: off (' + decisions.gh.reason + ')');
         // A login from an earlier full-access sandbox is still on disk; the agent could read the token from there.
@@ -50,15 +51,22 @@ export const setupCli = async (env, settings, gitAccess, refresh = false) => {
         if (!decisions[name].on)
             continue;
         try {
-            await setupSingleExe(env, name, entry.repo, entry.asset(arch), entry.exe, tool('cli', name), { refresh, subdir: entry.subdir });
+            await setupSingleExe(env, name, entry.repo, entry.asset(arch), entry.exe, tool('cli', name), { refresh, subdir: entry.subdir, size: entry.size });
             Object.assign(env.vars, toolVars[name]?.() ?? {});
         }
         catch (e) {
             // One tool failing never takes the others down.
-            warn(name + ' setup failed (continuing without it): ' + errMsg(e));
+            warn(name + ' could not be set up and is skipped; the other tools are not affected. Reason: ' + errMsg(e));
             env.summary.push(entry.name + ': FAILED');
         }
     }
-    if (decisions.openssl.on)
-        shimOpenssl(env);
+    if (decisions.openssl.on) {
+        try {
+            shimOpenssl(env);
+        }
+        catch (e) {
+            warn('openssl could not be set up and is skipped (Git Bash still has its own). Reason: ' + errMsg(e));
+            env.summary.push('openssl: FAILED');
+        }
+    }
 };