windows-development-sandbox 1.0.5 → 1.4.0

package/dist/selftest/host.test.js

@@ -1,71 +0,0 @@
-// Runs every command and shortcut binary as a separate process in a simulated HOST: none of the sandbox-only folders
-// or variables exist (C:\AgentLaunch, C:\AgentData, CLAUDE_CONFIG_DIR, ...), with a fresh home and storage. Tests
-// usually run inside a sandbox, where those exist, so this is what catches code that only works there. Every command
-// must either succeed or fail with a friendly "Error:" message; a crash or stack trace fails.
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { ensureDir } from '../core/util.js';
-const SANDBOX_ONLY_VARS = ['CLAUDE_CONFIG_DIR', 'CODEX_HOME', 'GEMINI_CLI_HOME', 'AGENT_WORKSPACE', 'AGENT_DATA', 'AGENT_TOOLS', 'AGENT_PROJECT', 'NVM_HOME', 'NVM_SYMLINK', 'BASH_ENV', 'CLAUDE_CODE_GIT_BASH_PATH', 'AGENT_GIT_ACCESS', 'AGENT_REAL_GIT', 'AGENT_SANDBOX_CONFIG'];
-export const hostTests = (t) => {
-    t.section('simulated host: every command, outside a sandbox');
-    const home = path.join(t.temp, 'host-sim-home');
-    const project = path.join(t.temp, 'host-sim-project');
-    const storage = path.join(t.temp, 'host-sim-storage');
-    for (const dir of [home, project, storage])
-        ensureDir(dir);
-    const config = t.write(path.join(t.temp, 'host-sim-config.json'), JSON.stringify({ storage: { root: storage }, personalization: { enabled: false }, provisioning: { terminal: { enabled: false } } }));
-    const env = {
-        ...Object.fromEntries(Object.entries(process.env).filter(([k]) => !SANDBOX_ONLY_VARS.includes(k))),
-        AGENT_SANDBOX_HOME: home,
-        AGENT_LAUNCH_DIR: path.join(t.temp, 'no-agent-launch'),
-        AGENT_DATA_DIR: path.join(t.temp, 'no-agent-data'),
-        AGENT_HOST_TOOLS_DIR: path.join(t.temp, 'no-host-tools'),
-        NO_COLOR: '1',
-        // This test may itself run inside a sandbox: the CLI must behave as it would on a PC.
-        AGENT_SANDBOX_HOST_ONLY: '1',
-    };
-    const bin = (name) => path.join(t.packageRoot, 'dist', 'bin', name + '.js');
-    const runs = [
-        ['agent-sandbox', '--help', ['--help']],
-        ['agent-sandbox', 'status', ['status', '--config', config]],
-        ['agent-sandbox', 'status --json', ['status', '--json', '--config', config]],
-        ['agent-sandbox', 'sessions', ['sessions', '--config', config]],
-        ['agent-sandbox', 'doctor', ['doctor', '--config', config]],
-        ['agent-sandbox', 'account list', ['account', 'list', '--config', config]],
-        ['agent-sandbox', 'account use nobody', ['account', 'use', 'nobody', '--config', config]],
-        ['agent-sandbox', 'config path', ['config', 'path']],
-        ['agent-sandbox', 'config show', ['config', 'show', '--config', config]],
-        ['agent-sandbox', 'config schema', ['config', 'schema']],
-        ['agent-sandbox', 'config init', ['config', 'init']],
-        ['agent-sandbox', 'config init (again)', ['config', 'init']],
-        ['agent-sandbox', 'clean', ['clean', '--config', config]],
-        ['agent-sandbox', 'sync', ['sync', '--config', config]],
-        ['agent-sandbox', 'logs', ['logs', '--config', config]],
-        ['agent-sandbox', 'attach', ['attach', '--config', config]],
-        ['agent-sandbox', 'exec', ['exec', '--config', config, '--', 'echo', 'hi']],
-        ['agent-sandbox', 'restart', ['restart', '--config', config]],
-        ['agent-sandbox', 'stop', ['stop', '--config', config]],
-        ['agent-sandbox', 'show', ['show', '--config', config]],
-        ['agent-sandbox', 'hide', ['hide', '--config', config]],
-        ['agent-sandbox', 'generate', ['generate', '--config', config]],
-        ['agent-sandbox', 'launch', ['launch', '--config', config]],
-        ['agent-sandbox', 'unknown command', ['frobnicate']],
-        ['claude-sbx', 'claude-sbx --headless --continue', ['--headless', '--continue', '--config', config]],
-        ['codex-sbx', 'codex-sbx', ['--config', config]],
-        ['gemini-sbx', 'gemini-sbx', ['--config', config]],
-        ['sbx-show', 'sbx-show', ['--config', config]],
-        ['claude-host', 'claude-host --version', ['--version']],
-    ];
-    const broken = [];
-    for (const [name, label, args] of runs) {
-        const r = spawnSync(process.execPath, [bin(name), ...args], { cwd: project, env, encoding: 'utf8', timeout: 120000 });
-        const output = ((r.stdout ?? '') + (r.stderr ?? '')).replace(/\x1b\[[0-9;]*m/g, '');
-        const crashed = r.status === null || r.status > 1 || /Unexpected error|node:internal|^\s+at .+:\d+:\d+\)?$/m.test(output);
-        const unexplained = r.status === 1 && !/(^|\n)(Error: |error: )/.test(output) && name !== 'claude-host';
-        if (crashed || unexplained)
-            broken.push(label + ' (exit ' + r.status + '): ' + output.trim().split('\n').slice(0, 4).join(' | '));
-    }
-    t.check(broken.length === 0, 'all ' + runs.length + ' commands work or fail with a clear message when run outside a sandbox' + (broken.length ? ':\n    ' + broken.join('\n    ') : ''));
-    t.check(fs.existsSync(path.join(home, 'config.json')) && fs.existsSync(path.join(home, 'config.schema.json')) && fs.existsSync(path.join(home, 'sandbox-config.schema.json')), 'on a fresh PC, config init and the local schema files are created');
-};

package/dist/selftest/live.test.d.ts

@@ -1,7 +0,0 @@
-import type { Fixtures } from './fixtures.js';
-import type { Harness } from './harness.js';
-export declare const liveTestsAvailable: () => boolean;
-/** Drives the real daemon through the run folder exactly like the host does, with cmd.exe standing in for claude. */
-export declare const daemonTests: (t: Harness, f: Fixtures, launchPath: string) => Promise<void>;
-/** Compiles gitshim.cs and runs real git through it in a scratch repository, as git.exe and through Git Bash. */
-export declare const gitGuardTests: (t: Harness, f: Fixtures, launchPath: string) => Promise<void>;

package/dist/selftest/live.test.js

@@ -1,127 +0,0 @@
-// Live tests on Windows: the real guest session daemon + ptyhost (ConPTY), and the compiled git guard on a real repo.
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawn, spawnSync } from 'node:child_process';
-import { ensureDir, findOnPath, sleep } from '../core/util.js';
-import { connect, encodeFrame, fixWindowsKeys, FrameReader, FrameType, helloFrame, queryViewers } from '../shared/pty-client.js';
-import { readJsonFile, writeJsonAtomic } from '../shared/rundir.js';
-const CSC = path.join(process.env.WINDIR ?? 'C:\\Windows', 'Microsoft.NET', 'Framework64', 'v4.0.30319', 'csc.exe');
-export const liveTestsAvailable = () => process.platform === 'win32' && fs.existsSync(CSC);
-/** Drives the real daemon through the run folder exactly like the host does, with cmd.exe standing in for claude. */
-export const daemonTests = async (t, f, launchPath) => {
-    const { check, waitFor } = t;
-    t.section('live: session daemon + ptyhost');
-    const data = f.at('live-data');
-    const workspace = f.workA;
-    ensureDir(path.join(data, 'tools', 'agents', 'claude'));
-    fs.copyFileSync(path.join(process.env.WINDIR ?? 'C:\\Windows', 'System32', 'cmd.exe'), path.join(data, 'tools', 'agents', 'claude', 'claude.exe'));
-    const sessionFile = path.join(launchPath, 'session.json');
-    const session = f.readJson(sessionFile);
-    Object.assign(session, { workspace, attach: { enabled: true } });
-    Object.assign(session.harness, { arguments: ['/d', '/k', 'echo LIVE-AGENT-READY'], resumeArguments: ['/d', '/k', 'echo LIVE-AGENT-RESUMED'] });
-    fs.writeFileSync(sessionFile, JSON.stringify(session));
-    const env = { ...process.env, AGENT_LAUNCH_DIR: launchPath, AGENT_DATA_DIR: data, AGENT_WORKSPACE: workspace, AGENT_LOCAL_DIR: f.at('local'), AGENT_LOG_PREFIX: 'daemon', AGENT_NO_TABS: '1' };
-    const daemon = spawn(process.execPath, [path.join(launchPath, 'runtime', 'daemon.js')], { env, stdio: 'ignore', windowsHide: true });
-    const run = path.join(data, 'run');
-    const request = (body) => writeJsonAtomic(path.join(run, 'requests', body.id + '.json'), { createdAt: new Date().toISOString(), ...body });
-    const response = (id) => waitFor(() => readJsonFile(path.join(run, 'responses', id + '.json')));
-    try {
-        request({ kind: 'session', id: 'live1', harness: 'claude', args: [], cwd: workspace });
-        const s = await waitFor(() => { const v = readJsonFile(path.join(run, 'sessions', 'live1.json')); return v && v.phase !== 'starting' ? v : null; }, 60000);
-        check(s?.phase === 'running' && Boolean(s.attach?.port), 'daemon compiles ptyhost and starts a session on request' + (s?.phase === 'failed' ? ' (' + s.message + ')' : ''));
-        if (!s?.attach)
-            return;
-        const socket = await connect({ ...s.attach, addresses: ['127.0.0.1'] });
-        const reader = new FrameReader();
-        let out = '';
-        let exitCode = null;
-        socket.on('data', (c) => { for (const fr of reader.push(c)) {
-            if (fr.type === FrameType.Output)
-                out += fr.payload.toString();
-            if (fr.type === FrameType.Exit)
-                exitCode = fr.payload.readInt32LE(0);
-        } });
-        socket.write(helloFrame(s.attach.token, 100, 30));
-        check(Boolean(await waitFor(() => out.includes('LIVE-AGENT-READY'), 10000)), 'an attached client sees the agent\'s screen');
-        socket.write(encodeFrame(FrameType.Input, Buffer.from('echo TYPED-%USERNAME:~0,0%OK\r')));
-        check(Boolean(await waitFor(() => out.includes('TYPED-OK'), 10000)), 'keystrokes reach the agent');
-        const badClient = await connect({ ...s.attach, addresses: ['127.0.0.1'] });
-        const badReader = new FrameReader();
-        let denied = '';
-        badClient.on('data', (c) => { for (const fr of badReader.push(c))
-            if (fr.type === FrameType.Error)
-                denied = fr.payload.toString(); });
-        badClient.write(helloFrame('wrong-token', 80, 24));
-        check(Boolean(await waitFor(() => denied, 20000)) && denied.includes('denied'), 'a client with the wrong token is refused');
-        const local = { ...s.attach, addresses: ['127.0.0.1'] };
-        const first = await queryViewers(local);
-        const second = await connect(local);
-        second.on('data', () => undefined);
-        second.write(helloFrame(s.attach.token, 60, 20));
-        const both = await waitFor(async () => ((await queryViewers(local))?.viewers === 2 ? true : null), 5000);
-        second.destroy();
-        const after = await waitFor(async () => { const v = await queryViewers(local); return v?.viewers === 1 ? v : null; }, 5000);
-        const still = readJsonFile(path.join(run, 'sessions', 'live1.json'));
-        check(first?.viewers === 1 && first.remote === 0 && Boolean(both) && after?.remote === 0 && still?.phase === 'running', 'viewers are counted live: a closed terminal stops counting at once and the session keeps running');
-        check(await queryViewers({ ...local, token: 'wrong-token' }) === null, 'the viewer query needs the session token too');
-        check(fixWindowsKeys(Buffer.from([0x61, 0x08, 0x7f, 0x1b])).equals(Buffer.from([0x61, 0x7f, 0x08, 0x1b])), 'Windows console Backspace (^H) reaches the agent as DEL, so it deletes one character, not a word');
-        request({ kind: 'exec', id: 'exec1', command: ['echo', 'hello from exec'], cwd: workspace, timeoutSeconds: 30 });
-        const ex = await response('exec1');
-        check(Boolean(ex?.ok && ex.stdout?.includes('hello from exec')), 'exec runs a command in the sandbox and returns its output');
-        request({ kind: 'exec', id: 'exec2', command: ['dir'], cwd: 'C:\\Windows', timeoutSeconds: 30 });
-        const ex2 = await response('exec2');
-        check(ex2?.ok === false && ex2.message.includes('not inside the sandbox workspace'), 'exec refuses folders outside the workspace');
-        request({ kind: 'shell', id: 'evil', command: 'calc' });
-        request({ kind: 'ping', id: 'ping1' });
-        const ping = await response('ping1');
-        check(Boolean(ping?.ok) && !fs.existsSync(path.join(run, 'responses', 'evil.json')) && !fs.existsSync(path.join(run, 'requests', 'evil.json')), 'ping answers; unknown request kinds are deleted unanswered');
-        request({ kind: 'restart', id: 'restart1', harness: 'claude' });
-        check(Boolean(await waitFor(() => out.includes('LIVE-AGENT-RESUMED'), 15000)), 'restart relaunches the agent with its resume arguments while attached');
-        socket.write(encodeFrame(FrameType.Input, Buffer.from('exit 3\r')));
-        await waitFor(() => exitCode !== null, 10000);
-        const ended = await waitFor(() => { const v = readJsonFile(path.join(run, 'sessions', 'live1.json')); return v?.phase === 'exited' ? v : null; });
-        check(exitCode === 3 && ended?.exitCode === 3, 'the agent\'s exit code reaches the client and the session status');
-        socket.destroy();
-        badClient.destroy();
-    }
-    finally {
-        daemon.kill();
-        await sleep(500);
-    }
-};
-/** Compiles gitshim.cs and runs real git through it in a scratch repository, as git.exe and through Git Bash. */
-export const gitGuardTests = async (t, f, launchPath) => {
-    const realGit = findOnPath(['git.exe']);
-    t.section('live: git access guard');
-    if (!realGit) {
-        console.log('SKIP  git guard (no git.exe on PATH)');
-        return;
-    }
-    const shimDir = f.at('gitshim');
-    ensureDir(shimDir);
-    const compiled = spawnSync(CSC, ['/nologo', '/optimize', '/out:' + path.join(shimDir, 'git.exe'), path.join(launchPath, 'sandbox', 'gitshim.cs')], { encoding: 'utf8' });
-    t.check(compiled.status === 0, 'gitshim.cs compiles with the .NET Framework compiler' + (compiled.status === 0 ? '' : ': ' + compiled.stdout));
-    if (compiled.status !== 0)
-        return;
-    const repo = f.at('guard-repo');
-    ensureDir(repo);
-    spawnSync(realGit, ['init', '-q'], { cwd: repo });
-    fs.writeFileSync(path.join(repo, 'a.txt'), 'hello');
-    const guard = path.join(launchPath, 'runtime', 'gitguard.js');
-    const env = (access) => ({ ...process.env, PATH: shimDir + path.delimiter + process.env.PATH, AGENT_GIT_ACCESS: access, AGENT_REAL_GIT: access === 'readonly' ? realGit : '', AGENT_GUARD_NODE: process.execPath, AGENT_GUARD_SCRIPT: guard, GIT_CONFIG_NOSYSTEM: '1' });
-    const git = (access, args) => spawnSync('git', args, { cwd: repo, env: env(access), encoding: 'utf8' });
-    const status = git('readonly', ['status', '--porcelain']);
-    t.check(status.status === 0 && status.stdout.includes('a.txt'), 'readonly: `git status` works through the git.exe stand-in (exact arguments preserved)');
-    const add = git('readonly', ['add', 'a.txt']);
-    t.check(add.status === 128 && add.stderr.includes('read-only') && git('readonly', ['status', '--porcelain']).stdout.includes('??'), 'readonly: `git add` is refused and nothing changes');
-    const none = git('none', ['status']);
-    t.check(none.status === 128 && none.stderr.includes('disabled'), 'none: every git call is refused');
-    const bash = [path.join(path.dirname(path.dirname(realGit)), 'bin', 'bash.exe'), path.join(path.dirname(path.dirname(realGit)), 'usr', 'bin', 'bash.exe')].find((b) => fs.existsSync(b));
-    if (bash) {
-        const bashEnv = t.write(f.at('gitshim', 'bashenv.sh'), 'git() { "' + process.execPath.replace(/\\/g, '/') + '" "' + guard.replace(/\\/g, '/') + '" "$@"; }\nexport -f git\n');
-        const viaBash = spawnSync(bash, ['-c', 'git commit -m x'], { cwd: repo, env: { ...env('readonly'), BASH_ENV: bashEnv.replace(/\\/g, '/') }, encoding: 'utf8' });
-        t.check(viaBash.status === 128 && viaBash.stderr.includes('read-only'), 'readonly: git inside Git Bash goes through the guard too (BASH_ENV)');
-    }
-    else
-        console.log('SKIP  Git Bash check (no bash.exe next to git)');
-};

package/dist/selftest/security.test.d.ts

@@ -1,3 +0,0 @@
-import type { Fixtures } from './fixtures.js';
-import type { Harness } from './harness.js';
-export declare const securityTests: (t: Harness, f: Fixtures) => Promise<void>;

package/dist/selftest/security.test.js

@@ -1,143 +0,0 @@
-// Attacks a compromised sandbox could try against this PC, and the guards that stop them.
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { activateAccount, saveAccount } from '../host/accounts.js';
-import { isSandboxAddress, resetRunDir, sendRequest } from '../host/channel.js';
-import { pruneStorage } from '../host/cleanup.js';
-import { guardRepo, snapshotRepo } from '../host/repo-guard.js';
-import { assertNoLinks, ensureDir, safeText } from '../core/util.js';
-import { assertSafeMapping } from '../core/workspace.js';
-import { sandboxGlobalState } from '../host/claude-profile.js';
-import { findSecretFiles, stripMcpServers, stripSettings } from '../host/secrets.js';
-import { detectDatabases } from '../core/detect-databases.js';
-import { removeRefusal, safeRemove } from '../shared/safe-remove.js';
-import { gitDecision } from '../guest/gitguard.js';
-import { gitDenyRules } from '../guest/gitrules.js';
-import { encodeFrame, FrameReader, MAX_FRAME_BYTES, OutputFilter } from '../shared/pty-client.js';
-import { safeId } from '../shared/rundir.js';
-import { GuestRequest, SessionStatus } from '../shared/schema.js';
-import { syncHistoryIn } from '../sync/history.js';
-export const securityTests = async (t, f) => {
-    const { check, rejects, write } = t;
-    const at = f.at;
-    t.section('links planted by the sandbox');
-    const victim = at('victim');
-    write(path.join(victim, 'precious.txt'), 'keep me');
-    const data = at('evil-storage', 'data', 'd');
-    ensureDir(path.join(data, 'state'));
-    fs.symlinkSync(victim, path.join(data, 'state', 'claude'), 'junction');
-    check(await rejects(() => assertNoLinks(data, path.join(data, 'state', 'claude', 'x.json')), 'is a link'), 'any host write under the data folder through a junction is refused');
-    check(await rejects(() => activateAccount(at('evil-storage'), data, 'any'), 'Unknown account') && await rejects(() => saveAccount(at('evil-storage'), data, 'a', null), 'is a link'), 'accounts never read or write through a sandbox junction');
-    const guestDot = at('link-guest');
-    ensureDir(path.join(guestDot, 'projects'));
-    fs.symlinkSync(victim, path.join(guestDot, 'projects', 'C--Workspace-my-app'), 'junction');
-    write(at('link-host', 'projects', 'D--Code-my-app', 's.jsonl'), '{}\n');
-    syncHistoryIn({ hostClaudeDir: at('link-host'), guestClaudeDir: guestDot, hostWorkspace: 'D:\\Code\\my-app', guestWorkspace: 'C:\\Workspace\\my-app' });
-    check(!fs.existsSync(path.join(victim, 's.jsonl')), 'history sync never writes through a junction inside the sandbox state');
-    fs.symlinkSync(path.join(victim, 'precious.txt'), path.join(guestDot, 'history.jsonl'), 'file');
-    write(at('link-host', 'history.jsonl'), '{"display":"x","timestamp":1}\n');
-    syncHistoryIn({ hostClaudeDir: at('link-host'), guestClaudeDir: guestDot, hostWorkspace: 'D:\\Code\\my-app', guestWorkspace: 'C:\\Workspace\\my-app' });
-    check(fs.readFileSync(path.join(victim, 'precious.txt'), 'utf8') === 'keep me', 'a file symlink planted in place of history.jsonl is replaced, not written through');
-    ensureDir(path.join(data, 'run'));
-    fs.symlinkSync(victim, path.join(data, 'run', 'requests'), 'junction');
-    check(await rejects(() => sendRequest(data, { kind: 'ping', id: 'p1', createdAt: '' }), 'is a link') && !fs.existsSync(path.join(victim, 'p1.json')), 'requests are never written through a junction');
-    fs.symlinkSync(victim, path.join(data, 'run', 'sessions'), 'junction');
-    resetRunDir(data);
-    check(fs.existsSync(path.join(victim, 'precious.txt')) && !fs.existsSync(path.join(data, 'run', 'sessions')), 'resetting the run folder removes a junction itself, never its target');
-    fs.symlinkSync(victim, path.join(data, 'logs'), 'junction');
-    const old = new Date(Date.now() - 60 * 86400000);
-    fs.utimesSync(path.join(victim, 'precious.txt'), old, old);
-    pruneStorage(at('evil-storage'));
-    check(fs.existsSync(path.join(victim, 'precious.txt')), 'cleanup never walks into a junction (old files on this PC stay)');
-    t.section('host <-> sandbox channel');
-    const validRequest = (r) => GuestRequest.safeParse(r).success;
-    const validSession = (s) => SessionStatus.safeParse(s).success;
-    check(await rejects(() => safeId('../evil'), 'invalid id') && !validRequest({ kind: 'shell', id: 'a' }) && !validRequest({ kind: 'exec', id: 'a/b', command: ['x'], cwd: 'C:\\', timeoutSeconds: 1 }) && validRequest({ kind: 'ping', id: 'abc', createdAt: 'x' }) && !validRequest({ kind: 'ping', id: 'abc', createdAt: 'x', extra: 1 }), 'only known request kinds with safe ids are accepted');
-    const goodSession = { id: 's1', launchId: 'l', harness: 'claude', cwd: 'C:\\Workspace', message: 'ok', phase: 'running', updatedAt: 'x', startedAt: 'x', attach: { addresses: ['172.20.1.5'], port: 5000, token: 't' } };
-    check(validSession(goodSession) && !validSession({ ...goodSession, attach: { ...goodSession.attach, port: 70000 } }) && !validSession({ ...goodSession, phase: 'pwned' }), 'guest session status is shape-checked');
-    const ifaces = { 'vEthernet (Default Switch)': [{ address: '172.20.0.1', netmask: '255.255.240.0', family: 'IPv4', internal: false, mac: '', cidr: null }], Ethernet: [{ address: '192.168.1.10', netmask: '255.255.255.0', family: 'IPv4', internal: false, mac: '', cidr: null }] };
-    check(isSandboxAddress('172.20.5.9', ifaces) && !isSandboxAddress('192.168.1.20', ifaces) && !isSandboxAddress('127.0.0.1', ifaces) && !isSandboxAddress('8.8.8.8', ifaces) && !isSandboxAddress('172.20.0.1', ifaces), 'attach only connects into the sandbox\'s Hyper-V subnet (not LAN, loopback, internet or this PC itself)');
-    const filter = new OutputFilter();
-    const filtered = Buffer.concat([filter.push(Buffer.from('a\x1b]52;c;ZXZpbA==\x07b\x1b]0;title\x07')), filter.push(Buffer.from('c\x1b]5')), filter.push(Buffer.from('2;c;cGF5\x1b\\d'))]).toString('latin1');
-    check(filtered === 'a' + 'b\x1b]0;title\x07' + 'c' + 'd', 'clipboard writes (OSC 52) from the sandbox are stripped, even split across chunks; titles pass');
-    check(await rejects(() => new FrameReader().push(Buffer.concat([Buffer.from([16]), Buffer.from([0, 0, 0, 0x7f])])), 'frame too large') && new FrameReader().push(encodeFrame(16, Buffer.alloc(MAX_FRAME_BYTES))).length === 1, 'oversized frames are rejected instead of buffered');
-    t.section('git access modes');
-    const allowed = (args, mode = 'readonly') => gitDecision(args, mode).allow;
-    check(['status', 'log --oneline', 'diff HEAD~1', 'show HEAD', 'blame a.ts', 'branch', 'branch -a', 'branch --contains HEAD', 'tag', 'tag -l v*', 'remote -v', 'config --get user.name', 'stash list', '-C sub status', '--no-pager log'].every((a) => allowed(a.split(' '))), 'readonly: reading commands are allowed');
-    check(['commit -m x', 'push', 'add .', 'checkout main', 'switch -c x', 'reset --hard', 'stash', 'stash pop', 'branch new', 'branch -D x', 'tag v1', 'merge x', 'rebase main', 'fetch', 'pull', 'config user.name x', 'remote add o u', '-c core.hooksPath=x status', '--git-dir=x status', 'clean -fd', 'apply p.diff'].every((a) => !allowed(a.split(' '))), 'readonly: anything that writes (or overrides config) is refused');
-    check(!allowed(['status'], 'none') && !allowed(['--version'], 'none') && allowed(['commit'], 'full'), 'none: every git call is refused; full: everything allowed');
-    const roRules = gitDenyRules('readonly');
-    const noneRules = gitDenyRules('none');
-    check(gitDenyRules('full').length === 0 && roRules.includes('Bash(git push:*)') && !roRules.some((r) => r.startsWith('Read(')) && noneRules.includes('Bash(git:*)') && noneRules.includes('Read(**/.git/**)'), 'Claude managed deny rules match each mode');
-    t.section('repository guard (zero-click code execution on this PC)');
-    const repo = at('repo');
-    write(path.join(repo, '.git', 'config'), '[core]\n\trepositoryformatversion = 0\n[remote "origin"]\n\turl = https://example.com/x.git\n');
-    write(path.join(repo, '.git', 'hooks', 'pre-commit.sample'), 'sample');
-    write(path.join(repo, '.git', 'hooks', 'pre-push'), 'existing hook');
-    const before = snapshotRepo(repo);
-    write(path.join(repo, '.git', 'hooks', 'post-checkout'), 'calc.exe');
-    write(path.join(repo, '.git', 'hooks', 'pre-push'), 'changed hook');
-    fs.appendFileSync(path.join(repo, '.git', 'config'), '[core]\n\tfsmonitor = calc.exe\n\tsshCommand = evil\n[include]\n\tpath = C:/evil.cfg\n[branch "feature"]\n\tremote = origin\n');
-    const findings = guardRepo(repo, before);
-    const config = fs.readFileSync(path.join(repo, '.git', 'config'), 'utf8');
-    check(!fs.existsSync(path.join(repo, '.git', 'hooks', 'post-checkout')) && !fs.existsSync(path.join(repo, '.git', 'hooks', 'pre-push')) && fs.existsSync(path.join(repo, '.git', 'hooks', 'pre-commit.sample')) && findings.filter((x) => x.kind === 'hook').length === 2, 'new or changed git hooks are quarantined (samples untouched)');
-    check(/# \[agent-sandbox\] disabled.*fsmonitor/.test(config) && /# \[agent-sandbox\] disabled.*sshCommand/.test(config) && /# \[agent-sandbox\] disabled.*path = C:\/evil/.test(config) && /^\tremote = origin$/m.test(config) && /^\turl = https/m.test(config), 'dangerous git config added in the sandbox is disabled; harmless changes and existing lines stay');
-    check(guardRepo(repo, before).length === 0, 'the guard is idempotent');
-    const repo2 = at('repo2');
-    write(path.join(repo2, '.git', 'config'), '[core]\n\tbare = false\n');
-    write(path.join(repo2, 'build.cmd'), 'echo legit');
-    const before2 = snapshotRepo(repo2);
-    write(path.join(repo2, 'node.exe'), 'MZ');
-    write(path.join(repo2, 'git.cmd'), 'calc');
-    write(path.join(repo2, 'sandbox.cmd'), 'calc');
-    write(path.join(repo2, 'opencode.ps1'), 'calc');
-    write(path.join(repo2, '.git', 'commondir'), 'C:/evil');
-    fs.appendFileSync(path.join(repo2, '.git', 'config'), '[core] fsmonitor = calc.exe\n');
-    const found2 = guardRepo(repo2, before2);
-    check(!fs.existsSync(path.join(repo2, 'node.exe')) && !fs.existsSync(path.join(repo2, 'git.cmd')) && fs.existsSync(path.join(repo2, 'build.cmd')) && !fs.existsSync(path.join(repo2, 'sandbox.cmd')) && found2.filter((x) => x.kind === 'command').length === 4, 'executables planted under command names (node.exe, git.cmd, sandbox.cmd, opencode.ps1) are quarantined; other scripts stay');
-    check(!fs.existsSync(path.join(repo2, '.git', 'commondir')) && /# \[agent-sandbox\] disabled.*fsmonitor/.test(fs.readFileSync(path.join(repo2, '.git', 'config'), 'utf8')), 'a planted commondir and a key on the same line as its [section] are neutralised');
-    const repo3 = at('repo3');
-    write(path.join(repo3, '.git', 'config'), '[core]\n');
-    const before3 = snapshotRepo(repo3);
-    fs.rmSync(path.join(repo3, '.git'), { recursive: true });
-    fs.symlinkSync(victim, path.join(repo3, '.git'), 'junction');
-    check(guardRepo(repo3, before3).some((x) => x.kind === 'git' && x.detail.includes('replaced')), '.git replaced by a link is reported loudly');
-    t.section('what reaches the sandbox, and what reaches your terminal');
-    const state = sandboxGlobalState({ primaryApiKey: 'sk-secret', oauthAccount: { emailAddress: 'me' }, mcpServers: { a: {} }, theme: 'dark', projects: { 'D:/Code/app': { mcpServers: { db: { env: { TOKEN: 'mine' } } } }, 'D:/Other': { mcpServers: { x: { env: { TOKEN: 'other' } } } } } }, 'D:\\Code\\app');
-    check(!('primaryApiKey' in state) && !('oauthAccount' in state) && JSON.stringify(state).includes('mine') && !JSON.stringify(state).includes('other') && state.theme === 'dark', 'the sandbox gets your MCP servers and this project, never API keys, your account or other projects');
-    const secrets = { strip: true, allow: ['AWS_REGION'], patterns: ['ACME_*'], warnFiles: true };
-    const removed = [];
-    const settings = stripSettings({ apiKeyHelper: 'aws-vault exec prod -- get-key', model: 'opus', env: {
-            AWS_ACCESS_KEY_ID: 'x', AWS_SECRET_ACCESS_KEY: 'y', AWS_REGION: 'eu-west-2', AZURE_CLIENT_SECRET: 'z', ARM_CLIENT_ID: 'id', CLOUDFLARE_API_TOKEN: 't',
-            GOOGLE_APPLICATION_CREDENTIALS: 'C:\\key.json', PROD_DB_HOST: 'db.internal', STRIPE_KEY: 'k', ACME_THING: 'a', DATABASE_URL: 'postgres://u:p@h/db',
-            INNOCENT: 'AKIAABCDEFGHIJKLMNOP', SAFE_URL: 'https://example.com', DISABLE_TELEMETRY: '1', CLAUDE_CODE_USE_BEDROCK: '1',
-        } }, secrets, removed);
-    const env = settings.env;
-    check(!('apiKeyHelper' in settings) && settings.model === 'opus' && Object.keys(env).sort().join() === 'AWS_REGION,CLAUDE_CODE_USE_BEDROCK,DISABLE_TELEMETRY,SAFE_URL' && removed.some((r) => r.endsWith('AWS_SECRET_ACCESS_KEY')), 'settings.json: AWS, Azure, Google, Cloudflare, prod, payment and database credentials (by name or by value) stay on this PC; secrets.allow and ordinary settings pass');
-    const mcp = stripMcpServers({ mcpServers: { gh: { command: 'npx', args: ['server', '--api-key', 'plain', '--verbose', 'ghp_abcdefghijklmnopqrstuvwxyz0123456789'], env: { GITHUB_TOKEN: 'g', LOG_LEVEL: 'debug' } } },
-        projects: { 'D:/app': { mcpServers: { api: { type: 'http', url: 'https://x', headers: { Authorization: 'Bearer abcdefghijklmnopqrstuvwxyz', Accept: 'json' } } } } } }, secrets, []);
-    const gh = mcp.mcpServers.gh;
-    const api = (mcp.projects['D:/app']).mcpServers.api;
-    check(JSON.stringify(gh.args) === '["server","--api-key","[removed by agent-sandbox]","--verbose","[removed by agent-sandbox]"]' && JSON.stringify(gh.env) === '{"LOG_LEVEL":"debug"}' && JSON.stringify(api.headers) === '{"Accept":"json"}', 'MCP servers: token env vars, Authorization headers and key arguments are removed, the rest of the server works as before');
-    check(JSON.stringify(stripSettings({ env: { AWS_SECRET_ACCESS_KEY: 'y' } }, { ...secrets, strip: false }, [])) === '{"env":{"AWS_SECRET_ACCESS_KEY":"y"}}', 'secrets.strip = false copies settings unchanged');
-    const sneaky = stripMcpServers({ mcpServers: { r: { type: 'http', url: 'https://mcp.example.com/mcp?api_key=0123456789abcdef&region=eu', headers: { 'X-API-Key': 'k', 'x-auth-token': 't', Accept: 'json' }, args: ['--api-key=deadbeefdeadbeef', '--header', 'Authorization: Bearer abcdefghijklmnopqrstuvwxyz', '--port=8080'] } } }, secrets, []);
-    const r = sneaky.mcpServers.r;
-    check(r.url === 'https://mcp.example.com/mcp?api_key=REMOVED&region=eu' && JSON.stringify(r.headers) === '{"Accept":"json"}' && r.args[0] === '[removed by agent-sandbox]' && r.args[2] === '[removed by agent-sandbox]' && r.args[3] === '--port=8080', 'MCP servers: X-API-Key headers, ?api_key= in URLs, --flag=value keys and "Authorization: Bearer" arguments are removed too');
-    const evil = ['Server=a;Database=a;'.repeat(12000), 'services:\n  x:\n    image: ' + 'postgres'.repeat(20000) + '!\n', 'Host=a;'.repeat(30000)].map((text, i) => ({ path: ['.env', 'compose.yaml', 'appsettings.json'][i], text }));
-    const started = Date.now();
-    detectDatabases(evil);
-    check(Date.now() - started < 2000, 'database detection stays fast on hostile workspace files (no catastrophic backtracking): ' + (Date.now() - started) + ' ms');
-    const profile = os.homedir();
-    const refused = [profile, path.dirname(profile), 'C:\\', 'C:\\Windows', '', 'relative\\folder', at('outside-root', 'x')].map((p) => removeRefusal(p, at('safe-root')));
-    const allowedTarget = at('safe-root', 'tools', 'go');
-    t.write(path.join(allowedTarget, 'go.exe'), 'x');
-    safeRemove(allowedTarget, at('safe-root'));
-    check(refused.every((r) => r !== null) && !fs.existsSync(allowedTarget), 'deletes can never reach your profile, a folder above it, a drive root, Windows, a relative path or anything outside their root');
-    const ws = at('secret-ws');
-    for (const file of ['.env', '.env.example', 'server.pem', 'README.md', 'api/credentials.json', 'node_modules/x/.env'])
-        t.write(path.join(ws, file), 'x');
-    check(findSecretFiles(ws).sort().join() === '.env,api\\credentials.json,server.pem', 'secret-looking workspace files are found for the launch warning (templates and dependencies ignored)');
-    check(safeText('ok \x1b[31mred\x1b[0m \x1b]52;c;ZXZpbA==\x07\x1b]0;title\x07\x1b[2J\x07end') === 'ok \x1b[31mred\x1b[0m end', 'sandbox text printed on this PC keeps colours but loses every other escape sequence');
-    check(await rejects(() => assertSafeMapping(path.join(t.packageRoot, 'dist'), t.packageRoot, at('storage')), 'overlaps') && await rejects(() => assertSafeMapping(at('storage', 'data'), t.packageRoot, at('storage')), 'overlaps'), 'extra mappings may not reach agent-sandbox\'s own folders');
-};