windows-development-sandbox 1.1.0 → 1.4.0

package/dist/cli/tui/theme.d.ts

@@ -0,0 +1,45 @@
+export declare class Theme {
+    /** Colour is decided once per run: the menu only runs in a terminal. */
+    static readonly colour: boolean;
+    static readonly bold: (text: string) => string;
+    static readonly dim: (text: string) => string;
+    static readonly italic: (text: string) => string;
+    static readonly accent: (text: string) => string;
+    static readonly accentBold: (t: string) => string;
+    static readonly ok: (text: string) => string;
+    static readonly warn: (text: string) => string;
+    static readonly error: (text: string) => string;
+    static readonly muted: (text: string) => string;
+    static readonly changed: (text: string) => string;
+    /** The highlighted row: a soft background bar across the whole width. */
+    static readonly selected: (t: string) => string;
+    /** The header bar. */
+    static readonly bar: (t: string) => string;
+    /** The two settings scopes: your own (blue) and the project's (purple). */
+    static readonly scopeGlobal: (t: string) => string;
+    static readonly scopeProject: (t: string) => string;
+    static readonly project: (text: string) => string;
+    static readonly key: (t: string) => string;
+    static readonly glyph: {
+        pointer: string;
+        bullet: string;
+        on: string;
+        off: string;
+        checked: string;
+        unchecked: string;
+        dot: string;
+        arrow: string;
+        back: string;
+        more: string;
+        folder: string;
+        open: string;
+        line: string;
+        vline: string;
+        search: string;
+        changed: string;
+        lock: string;
+        ok: string;
+        cross: string;
+        star: string;
+    };
+}

package/dist/cli/tui/theme.js

@@ -0,0 +1,30 @@
+// The look of every screen: colours (off with NO_COLOR, like the rest of the CLI) and the line-drawing characters.
+import { colorEnabled } from '../colors.js';
+const sgr = (open, close = '0') => (text) => (Theme.colour ? '\x1b[' + open + 'm' + text + '\x1b[' + close + 'm' : text);
+export class Theme {
+    /** Colour is decided once per run: the menu only runs in a terminal. */
+    static colour = colorEnabled(process.env, Boolean(process.stdout.isTTY));
+    static bold = sgr('1', '22');
+    static dim = sgr('2', '22');
+    static italic = sgr('3', '23');
+    static accent = sgr('38;5;75', '39');
+    static accentBold = (t) => Theme.bold(Theme.accent(t));
+    static ok = sgr('38;5;78', '39');
+    static warn = sgr('38;5;214', '39');
+    static error = sgr('38;5;203', '39');
+    static muted = sgr('38;5;245', '39');
+    static changed = sgr('38;5;221', '39');
+    /** The highlighted row: a soft background bar across the whole width. */
+    static selected = (t) => (Theme.colour ? '\x1b[48;5;24m\x1b[97m' + t.replace(/\x1b\[0m/g, '\x1b[0m\x1b[48;5;24m\x1b[97m') + '\x1b[0m' : t);
+    /** The header bar. */
+    static bar = (t) => (Theme.colour ? '\x1b[48;5;236m\x1b[97m' + t.replace(/\x1b\[0m/g, '\x1b[0m\x1b[48;5;236m\x1b[97m') + '\x1b[0m' : t);
+    /** The two settings scopes: your own (blue) and the project's (purple). */
+    static scopeGlobal = (t) => (Theme.colour ? '\x1b[48;5;25m\x1b[97m\x1b[1m' + t + '\x1b[0m' : '[' + t + ']');
+    static scopeProject = (t) => (Theme.colour ? '\x1b[48;5;91m\x1b[97m\x1b[1m' + t + '\x1b[0m' : '[' + t + ']');
+    static project = sgr('38;5;177', '39');
+    static key = (t) => (Theme.colour ? '\x1b[48;5;238m\x1b[97m ' + t + ' \x1b[0m' : '[' + t + ']');
+    static glyph = {
+        pointer: '›', bullet: '•', on: '●', off: '○', checked: '◉', unchecked: '◯', dot: '·', arrow: '→', back: '←', more: '…',
+        folder: '▸', open: '▾', line: '─', vline: '│', search: '⌕', changed: '✎', lock: '⚿', ok: '✔', cross: '✘', star: '★',
+    };
+}

package/dist/core/config.js

@@ -8,11 +8,13 @@ export const DEFAULTS = {
     defaultHarness: 'claude',
     guestWorkspace: 'auto',
     readOnly: false,
+    workspaceFilter: { enabled: false, exclude: [], include: [] },
+    audit: { enabled: false, days: 14, maxMb: 100, processes: true, files: true },
     mappings: [],
-    sandbox: { memoryMb: 'auto', maxMemoryMb: 32768, maxMemoryPercent: 80, cpuLimit: 80, reserveHostMb: 8192, vGpu: false, networking: true, clipboard: true, audioInput: false, videoInput: false, printerRedirection: false, protectedClient: true, headless: false },
-    storage: { root: '%LOCALAPPDATA%\\AgentSandbox', persistAgentState: true, dataName: 'default' },
-    network: { blockPrivateRanges: true },
-    provisioning: { copyFromHost: true, fallbackToInstall: true, refresh: false, git: { enabled: true, access: 'full' }, terminal: { enabled: true } },
+    sandbox: { memoryMb: 'auto', maxMemoryMb: 32768, maxMemoryPercent: 80, cpuLimit: 80, pageFileMb: 16384, reserveHostMb: 8192, vGpu: false, networking: true, clipboard: true, audioInput: false, videoInput: false, printerRedirection: false, protectedClient: true, headless: false, keepAwake: true },
+    storage: { root: '%LOCALAPPDATA%\\AgentSandbox', persistAgentState: true, dataName: 'default', markSandboxFiles: true, warnDataGb: 50 },
+    network: { blockPrivateRanges: true, allowOnly: [], blockHosts: [], forwardPorts: [], dns: [], proxy: '' },
+    provisioning: { copyFromHost: true, fallbackToInstall: true, refresh: false, git: { enabled: true, access: 'full' }, terminal: { enabled: true }, conpty: { enabled: true } },
     downloads: { requireChecksum: false },
     toolchains: {
         node: { version: 'host', extraVersions: [], corepack: true, volta: 'auto', globalPackages: [] },
@@ -33,7 +35,7 @@ export const DEFAULTS = {
         uv: { enabled: true },
         vcRuntime: { enabled: false },
         mesa: { enabled: false, vulkan: false },
-        vscode: { enabled: true },
+        vscode: { enabled: true, setup: true, recommended: true, extensions: [] },
         environment: {},
     },
     databases: {
@@ -48,7 +50,8 @@ export const DEFAULTS = {
     agentCommands: { enabled: false, agents: 'auto' },
     secrets: { strip: true, allow: [], patterns: [], warnFiles: true },
     personalization: { enabled: true },
-    claudeProfile: { enabled: true, hostDir: 'auto', include: ['settings.json', 'CLAUDE.md', 'commands', 'agents', 'skills', 'plugins'], globalStateFile: 'auto', copyCredentials: false, overwrite: true, syncHistory: true, syncClaudeMem: true },
+    apps: { install: [], custom: {} },
+    claudeProfile: { enabled: true, hostDir: 'auto', include: ['settings.json', 'CLAUDE.md', 'commands', 'agents', 'skills', 'plugins'], globalStateFile: 'auto', copyCredentials: false, overwrite: true, syncHistory: true, historyScope: 'project', syncClaudeMem: true, syncClaudeMemBack: false },
     harnesses: {
         claude: { hostExecutable: 'claude.exe', hostDir: 'auto', npmPackage: '@anthropic-ai/claude-code@latest', npmBin: 'claude', arguments: [], environment: { DISABLE_AUTOUPDATER: '1' }, resumeArguments: ['--continue'] },
         codex: { npmPackage: '@openai/codex@latest', npmBin: 'codex', arguments: [], environment: {}, resumeArguments: ['resume', '--last'] },

package/dist/core/local-config.d.ts

@@ -10,6 +10,12 @@ export declare const ON_IS_SAFER: string[];
 export declare const OFF_IS_SAFER: string[];
 export declare const GIT_STRICTNESS: Record<string, number>;
 export declare const NEVER_LOOSER: string[];
+/** What a project file asks for that would loosen one of your protections (so it is not used). */
+export declare const loosenedRequests: (config: Config, ov: Overrides) => {
+    key: string;
+    wanted: unknown;
+    yours: unknown;
+}[];
 /** Applies validated overrides. Mappings with the same guest folder replace the configured ones. */
 export declare const applyOverrides: (config: Config, ov: Overrides) => Config;
 /** Human-readable list of what a local config changes, with risky items flagged. */
@@ -18,3 +24,12 @@ export declare const readLocalConfig: (dir: string) => LocalConfigFile | null;
 export declare const trustStorePath: (storageRoot: string) => string;
 export declare const isTrusted: (store: string, file: string, hash: string) => boolean;
 export declare const saveTrust: (store: string, file: string, hash: string) => void;
+export declare const allowStorePath: (storageRoot: string) => string;
+/** true = you allowed it, false = you said no (not asked again), null = not asked yet. */
+export declare const allowedAnswer: (store: string, file: string, setting: string, value: unknown) => boolean | null;
+export declare const saveAllowed: (store: string, file: string, setting: string, value: unknown, allow: boolean) => void;
+/** Your config with these requests let through, so applyOverrides' "strictest wins" keeps the project's value. */
+export declare const allowRequests: (config: Config, allowed: {
+    key: string;
+    wanted: unknown;
+}[]) => Config;

package/dist/core/local-config.js

@@ -4,9 +4,10 @@ import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import _ from 'lodash';
+import { z } from 'zod';
 import { mergeConfig } from './config.js';
 import { describeIssues, LocalOverrides } from './schema.js';
-import { expandPath, fail, fileExists, parseJsonc, tryReadJson, writeJson } from './util.js';
+import { expandPath, fail, fileExists, isInsideOrEqual, parseJsonc, tryReadJson, writeJson } from './util.js';
 export const LOCAL_CONFIG_NAME = '.sandbox-config.json';
 /** Validates a folder's settings and resolves its relative paths against that folder. */
 export const normalizeOverrides = (data, dir, source) => {
@@ -18,14 +19,33 @@ export const normalizeOverrides = (data, dir, source) => {
     const missing = scripts?.filter((s) => !fileExists(s)) ?? [];
     if (missing.length)
         fail(source + ' is not valid:\n  - scripts: file not found: ' + missing.join(', '));
-    return { ...overrides, scripts, mappings: overrides.mappings?.map((m) => ({ ...m, host: expandPath(m.host, dir) })) };
+    const mappings = overrides.mappings?.map((m) => ({ ...m, host: expandPath(m.host, dir) }));
+    // A repo ships this file, so it must not reach the rest of this PC: its extra folders stay inside the project.
+    const outside = mappings?.filter((m) => !insideProject(dir, m.host)) ?? [];
+    if (outside.length)
+        fail(source + ' is not valid:\n  - mappings: a project file may only map folders inside the project, not ' + outside.map((m) => m.host).join(', '), 'Map other folders in your own settings (sandbox config path shows where they are).');
+    return { ...overrides, scripts, mappings };
+};
+/** `folder` (also where it really is, through links) is inside the project folder `dir`. */
+const insideProject = (dir, folder) => {
+    // Where a path really is: the nearest existing folder resolved (links, 8.3 short names), plus the part not created yet.
+    const real = (p) => {
+        const full = path.resolve(p);
+        try {
+            return fs.realpathSync.native(full);
+        }
+        catch {
+            return path.dirname(full) === full ? full : path.join(real(path.dirname(full)), path.basename(full));
+        }
+    };
+    return isInsideOrEqual(dir, folder) && isInsideOrEqual(real(dir), real(folder));
 };
 /**
  * Protections a project file may only make stricter, never looser. A repo can ship the file, so it must not be able to
  * switch off what you turned on (or turn on what you turned off). The strictest of the two values always wins.
  */
-export const ON_IS_SAFER = ['readOnly', 'network.blockPrivateRanges', 'sandbox.protectedClient', 'downloads.requireChecksum'];
-export const OFF_IS_SAFER = ['sandbox.networking', 'sandbox.clipboard', 'sandbox.audioInput', 'sandbox.videoInput', 'sandbox.printerRedirection', 'sandbox.vGpu', 'claudeProfile.copyCredentials'];
+export const ON_IS_SAFER = ['readOnly', 'workspaceFilter.enabled', 'network.blockPrivateRanges', 'sandbox.protectedClient', 'downloads.requireChecksum'];
+export const OFF_IS_SAFER = ['sandbox.networking', 'sandbox.clipboard', 'sandbox.audioInput', 'sandbox.videoInput', 'sandbox.printerRedirection', 'sandbox.vGpu', 'claudeProfile.copyCredentials', 'claudeProfile.enabled', 'claudeProfile.syncHistory', 'claudeProfile.syncClaudeMem'];
 export const GIT_STRICTNESS = { full: 0, readonly: 1, none: 2 };
 export const NEVER_LOOSER = [...ON_IS_SAFER, ...OFF_IS_SAFER, 'provisioning.git.access'];
 const keepStrictest = (yours, merged) => {
@@ -34,6 +54,12 @@ const keepStrictest = (yours, merged) => {
     if (GIT_STRICTNESS[yours.provisioning.git.access] > GIT_STRICTNESS[merged.provisioning.git.access])
         merged.provisioning.git.access = yours.provisioning.git.access;
 };
+/** What a project file asks for that would loosen one of your protections (so it is not used). */
+export const loosenedRequests = (config, ov) => [
+    ...ON_IS_SAFER.filter((p) => _.has(ov, p) && !_.get(ov, p) && _.get(config, p)),
+    ...OFF_IS_SAFER.filter((p) => _.has(ov, p) && _.get(ov, p) && !_.get(config, p)),
+    ...(_.has(ov, 'provisioning.git.access') && GIT_STRICTNESS[_.get(ov, 'provisioning.git.access')] < GIT_STRICTNESS[config.provisioning.git.access] ? ['provisioning.git.access'] : []),
+].map((key) => ({ key, wanted: _.get(ov, key), yours: _.get(config, key) }));
 /** Applies validated overrides. Mappings with the same guest folder replace the configured ones. */
 export const applyOverrides = (config, ov) => {
     const { harness, mappings, scripts: _scripts, $schema: _schema, ...rest } = ov;
@@ -41,6 +67,14 @@ export const applyOverrides = (config, ov) => {
     keepStrictest(config, next);
     if (harness)
         next.defaultHarness = harness;
+    // A project adds catalogue apps to yours; it never removes the ones you chose.
+    if (rest.apps?.install)
+        next.apps.install = _.union(config.apps.install, rest.apps.install);
+    // Its patterns keep more out on top of yours; yours stay.
+    if (rest.network?.blockHosts)
+        next.network.blockHosts = _.union(config.network.blockHosts, rest.network.blockHosts);
+    if (rest.workspaceFilter?.exclude)
+        next.workspaceFilter.exclude = _.union(config.workspaceFilter.exclude, rest.workspaceFilter.exclude);
     if (mappings)
         next.mappings = [..._.reject(config.mappings, (m) => mappings.some((o) => o.guest.toLowerCase() === m.guest.toLowerCase())), ...mappings];
     return next;
@@ -75,3 +109,28 @@ const loadTrust = (store) => tryReadJson(store) ?? {};
 const key = (file) => path.resolve(file).toLowerCase();
 export const isTrusted = (store, file, hash) => loadTrust(store)[key(file)] === hash;
 export const saveTrust = (store, file, hash) => writeJson(store, { ...loadTrust(store), [key(file)]: hash });
+// ---- looser settings you allowed for one project (host-only: <storage>\allowed-requests.json) ----------------------
+// A project file can never loosen a protection by itself. When it asks, you are asked once (interactively); a "yes"
+// is kept here, per project file and per "setting = value", so only that value is ever let through for that project.
+export const allowStorePath = (storageRoot) => path.join(storageRoot, 'allowed-requests.json');
+const loadAllowed = (store) => {
+    const parsed = z.record(z.string(), z.array(z.string().max(300)).max(50)).safeParse(tryReadJson(store) ?? {});
+    return parsed.success ? parsed.data : {};
+};
+const allowKey = (setting, value) => setting + ' = ' + JSON.stringify(value);
+/** true = you allowed it, false = you said no (not asked again), null = not asked yet. */
+export const allowedAnswer = (store, file, setting, value) => {
+    const answers = loadAllowed(store)[key(file)] ?? [];
+    return answers.includes(allowKey(setting, value)) ? true : answers.includes('no: ' + allowKey(setting, value)) ? false : null;
+};
+export const saveAllowed = (store, file, setting, value, allow) => {
+    const all = loadAllowed(store);
+    const entry = allowKey(setting, value);
+    writeJson(store, { ...all, [key(file)]: _.union(_.without(all[key(file)] ?? [], entry, 'no: ' + entry), [(allow ? '' : 'no: ') + entry]) });
+};
+/** Your config with these requests let through, so applyOverrides' "strictest wins" keeps the project's value. */
+export const allowRequests = (config, allowed) => {
+    const next = _.cloneDeep(config);
+    allowed.forEach((a) => _.set(next, a.key, a.wanted));
+    return next;
+};

package/dist/core/schema/apps.d.ts

@@ -0,0 +1,40 @@
+import { z } from 'zod';
+export declare const AppId: z.ZodEnum<{
+    [x: string]: string;
+}>;
+export declare const CustomAppId: z.ZodString;
+export declare const CustomApp: z.ZodObject<{
+    name: z.ZodString;
+    github: z.ZodOptional<z.ZodString>;
+    asset: z.ZodOptional<z.ZodString>;
+    url: z.ZodOptional<z.ZodString>;
+    sha256: z.ZodOptional<z.ZodString>;
+    unpack: z.ZodOptional<z.ZodEnum<{
+        file: "file";
+        archive: "archive";
+        nsis: "nsis";
+        msi: "msi";
+    }>>;
+    exe: z.ZodString;
+    cli: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const Apps: z.ZodObject<{
+    install: z.ZodArray<z.ZodEnum<{
+        [x: string]: string;
+    }>>;
+    custom: z.ZodRecord<z.ZodString, z.ZodObject<{
+        name: z.ZodString;
+        github: z.ZodOptional<z.ZodString>;
+        asset: z.ZodOptional<z.ZodString>;
+        url: z.ZodOptional<z.ZodString>;
+        sha256: z.ZodOptional<z.ZodString>;
+        unpack: z.ZodOptional<z.ZodEnum<{
+            file: "file";
+            archive: "archive";
+            nsis: "nsis";
+            msi: "msi";
+        }>>;
+        exe: z.ZodString;
+        cli: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;

package/dist/core/schema/apps.js

@@ -0,0 +1,27 @@
+// Apps installed in the sandbox: entries from the catalogue (shared/apps.ts) and programs of your own.
+import { z } from 'zod';
+import { APPS } from '../../shared/apps.js';
+const CATALOGUE_IDS = APPS.filter((a) => !a.setting).map((a) => a.id);
+export const AppId = z.enum(CATALOGUE_IDS);
+export const CustomAppId = z.string().regex(/^[a-z0-9][a-z0-9-]{0,40}$/, 'lower-case letters, digits and - only');
+const compiles = (pattern) => { try {
+    new RegExp(pattern);
+    return true;
+}
+catch {
+    return false;
+} };
+export const CustomApp = z.strictObject({
+    name: z.string().min(1).max(80).describe('The name on the desktop shortcut, e.g. "My Tool".'),
+    github: z.string().regex(/^[\w.-]+\/[\w.-]+$/, 'owner/repo, e.g. sharkdp/bat').optional().describe('GitHub repository (owner/repo): the file comes from its latest release.'),
+    asset: z.string().max(200).refine(compiles, 'not a valid pattern').optional().describe('With github: a pattern (regular expression) matching the release file, e.g. windows.*x64\\.zip$'),
+    url: z.string().url().startsWith('https://', 'https:// only').optional().describe('Or a direct https:// download link (zip, 7z, exe or msi).'),
+    sha256: z.string().regex(/^[0-9a-fA-F]{64}$/, '64 hex characters').optional().describe('SHA-256 of the download (GitHub releases usually publish one; then this is not needed).'),
+    unpack: z.enum(['archive', 'file', 'nsis', 'msi']).optional().describe('archive (zip, 7z, tar: the default), file (a single .exe), nsis (an installer 7-Zip can open) or msi.'),
+    exe: z.string().min(1).max(200).describe('The program to start (found anywhere in the download), e.g. mytool.exe.'),
+    cli: z.boolean().optional().describe('A command-line tool: its folder goes on PATH instead of getting a desktop shortcut.'),
+}).refine((a) => (a.github && a.asset ? !a.url : Boolean(a.url) && !a.github && !a.asset), { message: 'give github + asset, or url (not both)' });
+export const Apps = z.strictObject({
+    install: z.array(AppId).describe('Apps from the catalogue to install in every sandbox (the Apps screen in the menu lists them by category). Each is downloaded once and kept.'),
+    custom: z.record(CustomAppId, CustomApp).describe('Programs of your own: a GitHub release or a download link, and the program to start. Installed like the catalogue apps.'),
+});

package/dist/core/schema/config.d.ts

@@ -4,6 +4,18 @@ export declare const Config: z.ZodObject<{
     defaultHarness: z.ZodString;
     guestWorkspace: z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodLiteral<"mirror">, z.ZodString]>;
     readOnly: z.ZodBoolean;
+    workspaceFilter: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        exclude: z.ZodArray<z.ZodString>;
+        include: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    audit: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        days: z.ZodNumber;
+        maxMb: z.ZodNumber;
+        processes: z.ZodBoolean;
+        files: z.ZodBoolean;
+    }, z.core.$strict>;
     mappings: z.ZodArray<z.ZodObject<{
         host: z.ZodString;
         guest: z.ZodString;
@@ -15,6 +27,7 @@ export declare const Config: z.ZodObject<{
         maxMemoryMb: z.ZodNumber;
         maxMemoryPercent: z.ZodNumber;
         cpuLimit: z.ZodUnion<readonly [z.ZodLiteral<"none">, z.ZodNumber]>;
+        pageFileMb: z.ZodNumber;
         reserveHostMb: z.ZodNumber;
         vGpu: z.ZodBoolean;
         networking: z.ZodBoolean;
@@ -24,14 +37,25 @@ export declare const Config: z.ZodObject<{
         printerRedirection: z.ZodBoolean;
         protectedClient: z.ZodBoolean;
         headless: z.ZodBoolean;
+        keepAwake: z.ZodBoolean;
     }, z.core.$strict>;
     storage: z.ZodObject<{
         root: z.ZodString;
         persistAgentState: z.ZodBoolean;
         dataName: z.ZodString;
+        markSandboxFiles: z.ZodBoolean;
+        warnDataGb: z.ZodNumber;
     }, z.core.$strict>;
     network: z.ZodObject<{
         blockPrivateRanges: z.ZodBoolean;
+        allowOnly: z.ZodArray<z.ZodString>;
+        blockHosts: z.ZodArray<z.ZodString>;
+        forwardPorts: z.ZodArray<z.ZodObject<{
+            pc: z.ZodNumber;
+            sandbox: z.ZodNumber;
+        }, z.core.$strict>>;
+        dns: z.ZodArray<z.ZodString>;
+        proxy: z.ZodString;
     }, z.core.$strict>;
     provisioning: z.ZodObject<{
         copyFromHost: z.ZodBoolean;
@@ -48,6 +72,9 @@ export declare const Config: z.ZodObject<{
         terminal: z.ZodObject<{
             enabled: z.ZodBoolean;
         }, z.core.$strict>;
+        conpty: z.ZodObject<{
+            enabled: z.ZodBoolean;
+        }, z.core.$strict>;
     }, z.core.$strict>;
     downloads: z.ZodObject<{
         requireChecksum: z.ZodBoolean;
@@ -141,6 +168,9 @@ export declare const Config: z.ZodObject<{
         }, z.core.$strict>;
         vscode: z.ZodObject<{
             enabled: z.ZodBoolean;
+            setup: z.ZodBoolean;
+            recommended: z.ZodBoolean;
+            extensions: z.ZodArray<z.ZodString>;
         }, z.core.$strict>;
         environment: z.ZodRecord<z.ZodString, z.ZodString>;
     }, z.core.$strict>;
@@ -193,6 +223,26 @@ export declare const Config: z.ZodObject<{
     personalization: z.ZodObject<{
         enabled: z.ZodBoolean;
     }, z.core.$strict>;
+    apps: z.ZodObject<{
+        install: z.ZodArray<z.ZodEnum<{
+            [x: string]: string;
+        }>>;
+        custom: z.ZodRecord<z.ZodString, z.ZodObject<{
+            name: z.ZodString;
+            github: z.ZodOptional<z.ZodString>;
+            asset: z.ZodOptional<z.ZodString>;
+            url: z.ZodOptional<z.ZodString>;
+            sha256: z.ZodOptional<z.ZodString>;
+            unpack: z.ZodOptional<z.ZodEnum<{
+                file: "file";
+                archive: "archive";
+                nsis: "nsis";
+                msi: "msi";
+            }>>;
+            exe: z.ZodString;
+            cli: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
     claudeProfile: z.ZodObject<{
         enabled: z.ZodBoolean;
         hostDir: z.ZodString;
@@ -201,7 +251,12 @@ export declare const Config: z.ZodObject<{
         copyCredentials: z.ZodBoolean;
         overwrite: z.ZodBoolean;
         syncHistory: z.ZodBoolean;
+        historyScope: z.ZodEnum<{
+            project: "project";
+            all: "all";
+        }>;
         syncClaudeMem: z.ZodBoolean;
+        syncClaudeMemBack: z.ZodBoolean;
     }, z.core.$strict>;
     harnesses: z.ZodRecord<z.ZodString, z.ZodObject<{
         hostExecutable: z.ZodOptional<z.ZodString>;
@@ -235,6 +290,10 @@ export declare const LocalOverrides: z.ZodObject<{
     harness: z.ZodOptional<z.ZodString>;
     guestWorkspace: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodLiteral<"mirror">, z.ZodString]>>;
     readOnly: z.ZodOptional<z.ZodBoolean>;
+    workspaceFilter: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        exclude: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
     mappings: z.ZodOptional<z.ZodArray<z.ZodObject<{
         host: z.ZodString;
         guest: z.ZodString;
@@ -255,9 +314,11 @@ export declare const LocalOverrides: z.ZodObject<{
         printerRedirection: z.ZodOptional<z.ZodBoolean>;
         protectedClient: z.ZodOptional<z.ZodBoolean>;
         headless: z.ZodOptional<z.ZodBoolean>;
+        keepAwake: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
     network: z.ZodOptional<z.ZodObject<{
         blockPrivateRanges: z.ZodOptional<z.ZodBoolean>;
+        blockHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
     provisioning: z.ZodOptional<z.ZodObject<{
         copyFromHost: z.ZodOptional<z.ZodBoolean>;
@@ -580,9 +641,13 @@ export declare const LocalOverrides: z.ZodObject<{
     personalization: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
+    apps: z.ZodOptional<z.ZodObject<{
+        install: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            [x: string]: string;
+        }>>>;
+    }, z.core.$strict>>;
     claudeProfile: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
-        include: z.ZodOptional<z.ZodArray<z.ZodString>>;
         copyCredentials: z.ZodOptional<z.ZodBoolean>;
         overwrite: z.ZodOptional<z.ZodBoolean>;
         syncHistory: z.ZodOptional<z.ZodBoolean>;

package/dist/core/schema/config.js

@@ -6,22 +6,27 @@ import { Name, SchemaRef, Strings, toggle } from './common.js';
 import { Databases } from './databases.js';
 import { Harness } from './harness.js';
 import { AgentCommands, Attach, ClaudeProfile, Secrets } from './profile.js';
-import { Downloads, Git, GuestWorkspace, Mapping, Provisioning, Sandbox } from './sandbox.js';
+import { Audit, Downloads, Git, GuestWorkspace, Mapping, Network, Provisioning, Sandbox, WorkspaceFilter } from './sandbox.js';
 import { Toolchains } from './toolchains.js';
+import { Apps } from './apps.js';
 import { Projects } from './projects.js';
 export const Config = z.strictObject({
     $schema: SchemaRef.optional(),
     defaultHarness: Name.describe('Agent started by `sandbox launch` (sandbox claude always runs claude).'),
     guestWorkspace: GuestWorkspace,
     readOnly: z.boolean().describe('Map the workspace read-only.'),
+    workspaceFilter: WorkspaceFilter,
+    audit: Audit,
     mappings: z.array(Mapping).describe('Extra folders from this PC.'),
     sandbox: Sandbox,
     storage: z.strictObject({
         root: z.string().min(1).describe('Where everything is kept on this PC (tools, databases, logins, launches).'),
         persistAgentState: z.boolean().describe('Keep agent logins and history between sandboxes.'),
         dataName: Name.describe('Name of the persistent data set (C:\\AgentData) shared by all workspaces.'),
+        markSandboxFiles: z.boolean().describe('Programs and scripts (.exe, .ps1, .bat, .cmd, .msi, .lnk ...) that appear or change in your project while a sandbox runs get Windows\' "downloaded from the internet" mark, so SmartScreen and PowerShell ask before they run on this PC.'),
+        warnDataGb: z.number().min(0).describe('Say at launch when the persisted data (tools, databases, logins) is bigger than this many GB; 0 = never. sandbox data shows what takes the space.'),
     }),
-    network: z.strictObject({ blockPrivateRanges: z.boolean().describe('Block your LAN (10/8, 172.16/12, 192.168/16, SMB) from inside the sandbox.') }),
+    network: Network,
     provisioning: Provisioning,
     downloads: Downloads,
     toolchains: Toolchains,
@@ -30,6 +35,7 @@ export const Config = z.strictObject({
     agentCommands: AgentCommands,
     secrets: Secrets,
     personalization: toggle('Copy your desktop look (theme, accent, taskbar, wallpaper, ...) into the sandbox.'),
+    apps: Apps,
     claudeProfile: ClaudeProfile,
     harnesses: z.record(Name, Harness).describe('Agents that can run in the sandbox.'),
     hooks: z.strictObject({ failFast: z.boolean().describe('Stop when a hook script fails.') }),
@@ -44,10 +50,14 @@ export const LocalOverrides = z.strictObject({
     harness: Name.describe('Agent for this project.'),
     guestWorkspace: GuestWorkspace,
     readOnly: z.boolean().describe('Map this project read-only.'),
-    mappings: z.array(Mapping).describe('Extra folders (relative to this file).'),
+    // A project may turn the filter on and keep more out, never let ignored files in.
+    workspaceFilter: WorkspaceFilter.pick({ enabled: true, exclude: true }).partial(),
+    mappings: z.array(Mapping).describe('Extra folders inside this project (relative to this file), e.g. a read-only data folder at another place in the sandbox.'),
     scripts: Strings.describe('Scripts (.ps1 / .mjs / .cmd, relative to this file) run inside the sandbox before the agent.'),
-    sandbox: Sandbox.omit({ cpuLimit: true }).partial(),
-    network: z.strictObject({ blockPrivateRanges: z.boolean() }).partial(),
+    // This PC's resources are yours to share: CPU and paging file (this PC's disk) are not a project's to set.
+    sandbox: Sandbox.omit({ cpuLimit: true, pageFileMb: true }).partial(),
+    // A project may block more (the LAN, hosts); it never opens hosts, ports, DNS or a proxy.
+    network: Network.pick({ blockPrivateRanges: true, blockHosts: true }).partial(),
     provisioning: Provisioning.pick({ copyFromHost: true, fallbackToInstall: true, refresh: true }).extend({ git: Git.partial(), terminal: toggle('Windows Terminal as the sandbox window.').partial() }).partial(),
     downloads: Downloads.partial(),
     // Every toolchain setting, each one optional (a project usually only switches languages on or pins a version).
@@ -58,6 +68,8 @@ export const LocalOverrides = z.strictObject({
     databases: z.strictObject(_.mapValues(Databases.shape, (shape) => shape.partial())).partial(),
     attach: Attach.partial(),
     personalization: toggle('Copy your desktop look into the sandbox.').partial(),
-    claudeProfile: ClaudeProfile.pick({ enabled: true, include: true, overwrite: true, copyCredentials: true, syncHistory: true, syncClaudeMem: true }).partial(),
+    // Catalogue apps only (a vetted list): your own programs (apps.custom) download anything, so a repo cannot add them.
+    apps: Apps.pick({ install: true }).partial(),
+    claudeProfile: ClaudeProfile.pick({ enabled: true, overwrite: true, copyCredentials: true, syncHistory: true, syncClaudeMem: true }).partial(),
     hooks: z.strictObject({ failFast: z.boolean() }).partial(),
 }).partial();

package/dist/core/schema/profile.d.ts

@@ -23,5 +23,10 @@ export declare const ClaudeProfile: z.ZodObject<{
     copyCredentials: z.ZodBoolean;
     overwrite: z.ZodBoolean;
     syncHistory: z.ZodBoolean;
+    historyScope: z.ZodEnum<{
+        project: "project";
+        all: "all";
+    }>;
     syncClaudeMem: z.ZodBoolean;
+    syncClaudeMemBack: z.ZodBoolean;
 }, z.core.$strict>;

package/dist/core/schema/profile.js

@@ -24,6 +24,8 @@ export const ClaudeProfile = z.strictObject({
     globalStateFile: z.string().describe('Your .claude.json, or "auto". Empty string = do not copy.'),
     copyCredentials: z.boolean().describe('Copy your Claude LOGIN into the sandbox. Prefer sandbox account instead.'),
     overwrite: z.boolean().describe('Refresh these settings from this PC on every launch.'),
-    syncHistory: z.boolean().describe('Bring all conversation history in, and sync new history back (path-translated).'),
-    syncClaudeMem: z.boolean().describe('Bring claude-mem data in, and its database back when the sandbox closes.'),
+    syncHistory: z.boolean().describe('Bring conversation history in, and sync new history back (path-translated).'),
+    historyScope: z.enum(['project', 'all']).describe('Which history comes in: "project" = only the projects in this sandbox (other projects\' conversations, file backups and prompts stay on this PC), "all" = everything. Only this sandbox\'s projects ever sync back.'),
+    syncClaudeMem: z.boolean().describe('Bring claude-mem data into the sandbox (its settings and backups stay on this PC).'),
+    syncClaudeMemBack: z.boolean().describe('Also copy claude-mem\'s database back to this PC when the sandbox closes. Off by default: what is in it is loaded into every Claude session on this PC, so a compromised agent could plant instructions there.'),
 });

package/dist/core/schema/sandbox.d.ts

@@ -11,6 +11,7 @@ export declare const Sandbox: z.ZodObject<{
     maxMemoryMb: z.ZodNumber;
     maxMemoryPercent: z.ZodNumber;
     cpuLimit: z.ZodUnion<readonly [z.ZodLiteral<"none">, z.ZodNumber]>;
+    pageFileMb: z.ZodNumber;
     reserveHostMb: z.ZodNumber;
     vGpu: z.ZodBoolean;
     networking: z.ZodBoolean;
@@ -20,6 +21,30 @@ export declare const Sandbox: z.ZodObject<{
     printerRedirection: z.ZodBoolean;
     protectedClient: z.ZodBoolean;
     headless: z.ZodBoolean;
+    keepAwake: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const Network: z.ZodObject<{
+    blockPrivateRanges: z.ZodBoolean;
+    allowOnly: z.ZodArray<z.ZodString>;
+    blockHosts: z.ZodArray<z.ZodString>;
+    forwardPorts: z.ZodArray<z.ZodObject<{
+        pc: z.ZodNumber;
+        sandbox: z.ZodNumber;
+    }, z.core.$strict>>;
+    dns: z.ZodArray<z.ZodString>;
+    proxy: z.ZodString;
+}, z.core.$strict>;
+export declare const Audit: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    days: z.ZodNumber;
+    maxMb: z.ZodNumber;
+    processes: z.ZodBoolean;
+    files: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const WorkspaceFilter: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    exclude: z.ZodArray<z.ZodString>;
+    include: z.ZodArray<z.ZodString>;
 }, z.core.$strict>;
 export declare const Git: z.ZodObject<{
     enabled: z.ZodBoolean;
@@ -44,6 +69,9 @@ export declare const Provisioning: z.ZodObject<{
     terminal: z.ZodObject<{
         enabled: z.ZodBoolean;
     }, z.core.$strict>;
+    conpty: z.ZodObject<{
+        enabled: z.ZodBoolean;
+    }, z.core.$strict>;
 }, z.core.$strict>;
 export declare const Downloads: z.ZodObject<{
     requireChecksum: z.ZodBoolean;