windows-development-sandbox 1.1.0 → 1.4.1

package/dist/selftest/audit.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './suite.js';
+export declare const auditSuite: Suite;

package/dist/selftest/audit.test.js

@@ -0,0 +1,57 @@
+// The audit log: kept small (repeats folded, a cap per minute, old days compressed, limits on days and size), read back
+// filtered, and what the sandbox reports is checked like everything else that comes from it.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import zlib from 'node:zlib';
+import { AuditCollector } from '../host/audit/collect.js';
+import { AuditLog, fold } from '../host/audit/log.js';
+import { parseProcessEvents } from '../guest/audit-parse.js';
+import { runPaths } from '../shared/rundir.js';
+const ev = (t, extra = {}) => ({ t, k: 'proc', p: 'C:\\x\\cargo.exe', c: 'cargo build', ...extra });
+export const auditSuite = {
+    name: 'audit',
+    title: 'audit log (folding, compression, limits, untrusted reports)',
+    run: (t) => {
+        t.section('small');
+        const folded = fold([ev('2026-01-01T10:00:01Z'), ev('2026-01-01T10:00:02Z'), ev('2026-01-01T10:00:03Z', { c: 'cargo test' }), ev('2026-01-01T10:01:00Z')]);
+        t.equal(folded.map((e) => [e.c, e.n ?? 1]), [['cargo build', 2], ['cargo test', 1], ['cargo build', 1]], 'repeats within a minute become one line with a count');
+        const flood = fold(Array.from({ length: 50 }, (_, i) => ev('2026-01-01T10:00:00Z', { c: 'step ' + i })), 10);
+        t.check(flood.length === 11 && flood[10].k === 'note' && flood[10].p.startsWith('40 more'), 'past the per-minute cap the rest is one note');
+        const dir = t.at('audit-log');
+        const log = new AuditLog(dir, { days: 3, maxMb: 5 });
+        log.append([ev('2026-01-01T10:00:00Z'), ev('2026-01-02T10:00:00Z'), ev('2026-01-04T10:00:00Z', { k: 'file', p: 'src/a.ts', a: 'change', w: 'C:\\app' })]);
+        log.maintain('2026-01-04');
+        t.equal(fs.readdirSync(dir).sort(), ['2026-01-02.jsonl.gz', '2026-01-04.jsonl'], 'finished days are compressed and days past audit.days are deleted');
+        t.includes(zlib.gunzipSync(fs.readFileSync(path.join(dir, '2026-01-02.jsonl.gz'))).toString(), 'cargo build', 'a compressed day still holds its events');
+        const big = new AuditLog(t.at('audit-big'), { days: 30, maxMb: 5 });
+        // Random text: compression must not make the test data fit after all.
+        const line = (day) => ev(day + 'T00:00:00Z', { c: crypto.randomBytes(900).toString('hex') });
+        for (const day of ['2026-02-01', '2026-02-02', '2026-02-03'])
+            big.append(Array.from({ length: 1400 }, () => line(day)));
+        big.maintain('2026-02-03');
+        t.check(big.bytes() <= 5 * 1024 * 1024 && fs.readdirSync(big.dir).length < 3, 'past audit.maxMb the oldest days go', String(big.bytes()));
+        t.section('reading');
+        t.equal(log.read({ days: 10000, kinds: ['file'] }).map((e) => e.p), ['src/a.ts'], 'events can be filtered by kind');
+        t.equal(log.read({ days: 10000, grep: 'SRC/A.TS' }).length, 1, '... and by text (any case)');
+        t.section('what the sandbox reports');
+        const xml = "<Event><System><TimeCreated SystemTime='2026-01-05T09:00:00.000Z'/><EventRecordID>41</EventRecordID></System><EventData><Data Name='NewProcessName'>C:\\AgentData\\tools\\git\\cmd\\git.exe</Data><Data Name='CommandLine'>git push --force &quot;origin&quot;</Data><Data Name='ParentProcessName'>C:\\nvm\\nodejs\\node.exe</Data></EventData></Event>"
+            + "<Event><System><EventRecordID>42</EventRecordID></System><EventData><Data Name='NewProcessName'>C:\\Windows\\System32\\conhost.exe</Data></EventData></Event>";
+        const parsed = parseProcessEvents(xml);
+        t.equal({ last: parsed.last, lines: parsed.lines.map((l) => JSON.parse(l)).map((e) => [e.p, e.c, e.pp]) }, { last: 42, lines: [['C:\\AgentData\\tools\\git\\cmd\\git.exe', 'git push --force "origin"', 'C:\\nvm\\nodejs\\node.exe']] }, 'Windows process events become audit lines; Windows\' own background programs are left out');
+        const data = t.at('audit-data', 'data', 'd');
+        const storage = t.at('audit-data');
+        const reports = runPaths(data).audit;
+        t.write(path.join(reports, '1-1.jsonl'), [
+            JSON.stringify({ t: '2026-01-05T09:00:00Z', k: 'guard', p: 'fake: all clear' }),
+            JSON.stringify({ t: '2026-01-05T09:00:01Z', k: 'proc', p: 'C:\\x.exe', c: 'x --y', w: 'C:\\Users\\me' }),
+            'not json', JSON.stringify({ t: '2026-01-05T09:00:02Z', k: 'proc', p: 'x'.repeat(5000) }),
+        ].join('\n'));
+        t.write(path.join(reports, 'not-a-report.txt'), 'ignored');
+        const collector = new AuditCollector(data, storage, { enabled: true, days: 14, maxMb: 50, processes: true, files: false, projects: [] });
+        collector.flush();
+        const got = new AuditLog(AuditLog.dirFor(storage, data), { days: 14, maxMb: 50 }).read({ days: 100000 });
+        t.equal(got.map((e) => [e.k, e.p, e.w]), [['proc', 'fake: all clear', undefined], ['proc', 'C:\\x.exe', undefined]], 'sandbox reports can only be programs: other kinds are recorded as such, fields it may not set are dropped, oversized lines are refused');
+        t.check(!fs.existsSync(path.join(reports, '1-1.jsonl')), 'reports are deleted once taken in');
+    },
+};

package/dist/selftest/channel.test.js

@@ -1,8 +1,9 @@
 // The host <-> sandbox channel and the terminal protocol: everything arriving from the sandbox is validated, sized and
 // filtered before this PC acts on it.
 import { safeId } from '../shared/rundir.js';
-import { GuestRequest, SessionStatus } from '../shared/schema.js';
-import { encodeFrame, FrameReader, FrameType, fixWindowsKeys, helloFrame, MAX_FRAME_BYTES, OutputFilter } from '../shared/pty-client.js';
+import { GuestRequest, SandboxStatus, SessionStatus } from '../shared/schema.js';
+import { bootLine, firstStartNotice, pendingDownloads, readyIn, stillWorking } from '../cli/boot-progress.js';
+import { encodeFrame, FrameReader, FrameType, fixWindowsKeys, helloFrame, InputJoiner, MAX_FRAME_BYTES, MOUSE_OFF, OutputFilter } from '../shared/pty-client.js';
 export const channelSuite = {
     name: 'channel',
     title: 'request/status validation and the terminal protocol (frames, OSC 52, keys)',
@@ -19,6 +20,32 @@ export const channelSuite = {
         t.check(validSession(goodSession), 'a well-formed session status is accepted');
         t.check(!validSession({ ...goodSession, attach: { ...goodSession.attach, port: 70000 } }), 'a session status with an impossible port is rejected');
         t.check(!validSession({ ...goodSession, phase: 'pwned' }), 'a session status with an unknown phase is rejected');
+        t.section('boot progress');
+        const goodStatus = { launchId: 'l1', phase: 'provisioning', message: '[3/8] Developer tools', updatedAt: 'x', workspaceHost: 'C:\\p', guestWorkspace: 'C:\\Workspace', headless: false };
+        const progress = { step: 3, steps: 8, title: 'Developer tools', active: [{ name: 'Rust', percent: 40 }, { name: 'Go' }], done: 2, total: 6 };
+        const parsed = (s) => SandboxStatus.safeParse(s);
+        t.equal(parsed({ ...goodStatus, progress }).data?.progress, progress, 'a well-formed boot progress is accepted');
+        t.check(parsed(goodStatus).success && parsed(goodStatus).data?.progress === undefined, 'a status without progress (an older sandbox) is accepted');
+        const hostile = [
+            { ...progress, title: 'x'.repeat(5000) }, { ...progress, active: Array.from({ length: 100 }, () => ({ name: 'a' })) },
+            { ...progress, active: [{ name: 'a', percent: 500 }] }, { ...progress, step: -1 }, { ...progress, done: 1e9 }, { ...progress, extra: 1 }, 'pwned',
+        ];
+        t.equal(hostile.map((p) => { const r = parsed({ ...goodStatus, progress: p }); return r.success && r.data.progress === undefined; }), hostile.map(() => true), 'an oversized or malformed progress is dropped, the status itself still counts');
+        t.check(!parsed({ ...goodStatus, phase: 'pwned', progress }).success, 'a status with an unknown phase is still rejected');
+        const line = (p) => bootLine(parsed({ ...goodStatus, progress: p }).data ?? null).line;
+        t.equal(line(progress), '[3/8] Developer tools: downloading Rust 40%; setting up Go (2 of 6 done)', 'the line shows the step, the download and what is set up');
+        t.equal(line({ ...progress, title: 'Agent: claude', step: 6, active: [], done: 0, total: 0 }), '[6/8] Agent: claude', 'a step without tools is just its title');
+        t.equal(line({ ...progress, active: [{ name: '\x1b]52;c;ZXZpbA==\x07Ru\x1b[2Jst\r\n', percent: 99 }] }), '[3/8] Developer tools: downloading Rust 99% (2 of 6 done)', 'escape sequences and control characters from the sandbox never reach the terminal');
+        t.equal(bootLine(null).line, 'Starting Windows Sandbox', 'before the sandbox writes anything');
+        t.equal(bootLine(parsed({ ...goodStatus, message: 'Installing Go (1 of 3 done)' }).data).line, 'Installing Go (1 of 3 done)', 'an older sandbox: its message');
+        t.equal(bootLine(parsed({ ...goodStatus, progress: { ...progress, active: [{ name: 'Rust', percent: 50 }] } }).data).key, bootLine(parsed({ ...goodStatus, progress: { ...progress, active: [{ name: 'Rust', percent: 60 }] } }).data).key, 'a download moving on is no new plain line (only a new step or tool is)');
+        t.equal(stillWorking('Rust', 3 * 60 * 1000), 'Still working on Rust (3 min). Full log: sandbox logs -f', 'the notice after a long quiet spell');
+        t.equal(readyIn(432_000), 'Ready in 7 min 12 s.', 'the time a first start took');
+        const pending = pendingDownloads(['node', 'rust', 'cpp', 'postgres', 'node', 'constructor'], (dir) => dir === 'nvm');
+        t.equal(pending, { names: ['rust', 'C/C++', 'PostgreSQL'], mb: 900 }, 'only what is not downloaded yet counts, once each');
+        t.equal(firstStartNotice(false, { names: [], mb: 0 }), null, 'a later start with everything downloaded says nothing');
+        t.check(/^First start: .*\(about 900 MB: rust, C\/C\+\+, PostgreSQL\)\. This can take 5-20 minutes/.test(firstStartNotice(true, pending) ?? ''), 'the first start says what it downloads, roughly how much, and how long it can take');
+        t.check(/^New tools for this project: .*about 1\.8 GB: MSVC, rust/.test(firstStartNotice(false, pendingDownloads(['msvc', 'rust'], () => false)) ?? ''), 'a new toolchain later on gets its own heads-up');
         t.section('terminal frames');
         const filter = new OutputFilter();
         const filtered = Buffer.concat([
@@ -27,11 +54,27 @@ export const channelSuite = {
             filter.push(Buffer.from('2;c;cGF5\x1b\\d')),
         ]).toString('latin1');
         t.equal(filtered, 'a' + 'b\x1b]0;title\x07' + 'c' + 'd', 'clipboard writes (OSC 52) from the sandbox are stripped, even split across chunks; titles pass');
+        const through = (...chunks) => { const f = new OutputFilter(); return Buffer.concat(chunks.map((s) => f.push(Buffer.from(s, 'latin1')))).toString('latin1'); };
+        t.equal(through('x\x1b]52;c;QUFB\x1b', '\\y'), 'xy', 'an OSC 52 whose terminator is split between chunks is still stripped');
+        t.equal(through('x\x1b]052;c;QUFB\x07y'), 'xy', 'OSC 052 (leading zero) is stripped too');
+        t.equal(through('x\x1b]52;c;' + 'A'.repeat(70000), 'B'.repeat(100), '\x07y'), 'xy', 'a huge OSC 52 stays stripped across chunks');
+        t.equal(through('x\xc2\x9d52;c;QUFB\xc2\x9cy\x1bP1$qm\x1b\\z'), 'xyz', 'C1 (UTF-8) OSC and DCS strings are stripped');
+        t.equal(through('\x1b]8;;https://a.b\x1b\\link\x1b]8;;\x1b\\ \x1b[31mred\x1b[0m é\xc2\xa0'), '\x1b]8;;https://a.b\x1b\\link\x1b]8;;\x1b\\ \x1b[31mred\x1b[0m é\xc2\xa0', 'links, colours and ordinary UTF-8 (incl. U+00A0) pass unchanged');
+        t.equal(through('\x1b]9;9;macro\x07\x1b]9;4;1;50\x07'), '\x1b]9;4;1;50\x07', 'only the progress form of OSC 9 passes (ConEmu macros do not)');
         const oversizedHeader = Buffer.concat([Buffer.from([16]), Buffer.from([0, 0, 0, 0x7f])]);
         await t.throws(() => new FrameReader().push(oversizedHeader), 'frame too large', 'a frame announcing too much data is rejected instead of buffered');
         t.equal(new FrameReader().push(encodeFrame(16, Buffer.alloc(MAX_FRAME_BYTES))).length, 1, 'a frame of exactly the maximum size is accepted');
         const hello = new FrameReader().push(helloFrame('tok', 100, 30, 2))[0];
         t.equal({ type: hello.type, cols: hello.payload.readInt16LE(0), rows: hello.payload.readInt16LE(2), flags: hello.payload[4], token: hello.payload.subarray(5).toString() }, { type: FrameType.Hello, cols: 100, rows: 30, flags: 2, token: 'tok' }, 'a hello frame carries size, flags and token');
         t.equal(fixWindowsKeys(Buffer.from([0x61, 0x08, 0x7f, 0x1b])), Buffer.from([0x61, 0x7f, 0x08, 0x1b]), 'Windows console Backspace (^H) reaches the agent as DEL, so it deletes one character, not a word');
+        t.section('typed input keeps escape sequences whole');
+        const joined = (...chunks) => { const j = new InputJoiner(); const out = chunks.map((c) => j.push(Buffer.from(c, 'latin1')).toString('latin1')); out.push(j.flush().toString('latin1')); return out.filter(Boolean); };
+        t.equal(joined('ab\x1b[', 'C'), ['ab', '\x1b[C'], 'a Right arrow split after ESC[ is sent whole (ConPTY would read Alt+[ and a typed "C")');
+        t.equal(joined('\x1b', '[<0;10;', '5M', 'x'), ['\x1b[<0;10;5M', 'x'], 'a mouse report split three ways is sent as one');
+        t.equal(joined('\x1bO', 'A'), ['\x1bOA'], 'an SS3 key split after ESC O is sent whole');
+        t.equal(joined('a\x1b'), ['a', '\x1b'], 'a lone Esc key is held, then sent by the flush');
+        t.equal(joined('\x1b[A\x1bx\x7f'), ['\x1b[A\x1bx\x7f'], 'complete keys (arrows, Alt+x, Backspace) pass at once');
+        t.equal(joined('\x1b[' + '1;'.repeat(40)), ['\x1b[' + '1;'.repeat(40)], 'an endless "sequence" is not held back');
+        t.check(MOUSE_OFF.includes('\x1b[?1000l') && MOUSE_OFF.includes('\x1b[?1003l') && MOUSE_OFF.includes('\x1b[?1006l'), 'leaving a session turns every mouse tracking mode off in your terminal');
     },
 };

package/dist/selftest/cli.test.js

@@ -5,13 +5,14 @@ import path from 'node:path';
 import { buildProgram, parseCli } from '../cli/args.js';
 import { COMMANDS } from '../cli/manifest.js';
 import { commandLine, readHistory, recordHistory } from '../cli/history.js';
-import { optionProblem, splitArgs } from '../cli/menu.js';
+import { splitArgs } from '../cli/args.js';
+import { optionProblem } from '../cli/menu/index.js';
 import { cleanTargetOf } from '../cli/commands/data/collect.js';
 import { ago, colorEnabled, shorten, shortenMiddle } from '../cli/colors.js';
 import { hoistConfig, withoutConfig } from '../cli/index.js';
 import { closest, validNodeSpec, validPythonSpec } from '../cli/validate.js';
-import { editConfigText, SECTION_TITLES } from '../cli/settings/index.js';
-import { childrenOf, isSection, jsonExample, leavesOf, promptKind } from '../cli/settings/schema.js';
+import { CATEGORIES, editConfigText, nameOf, SchemaNode } from '../cli/menu/settings/index.js';
+import { Frame, ListScreen, Text, TextScreen } from '../cli/tui/index.js';
 import { Config, LocalOverrides } from '../core/schema.js';
 export const cliSuite = {
     name: 'cli',
@@ -99,20 +100,49 @@ export const cliSuite = {
         const projectBad = editConfigText('{}', ['storage', 'root'], 'C:\\x', 'project');
         t.check('text' in projectEdit && projectEdit.text.includes('requireChecksum'), 'settings screen: a project file accepts project settings');
         t.check('problems' in projectBad, 'settings screen: a project file is validated against the project schema (storage cannot be set there)');
-        // Every setting must be reachable in the settings screen: each leaf has a prompt, each top-level section a title.
-        const userLeaves = leavesOf(Config);
-        const projectLeaves = leavesOf(LocalOverrides);
-        const sectionNames = (schema) => childrenOf(schema).filter(([, s]) => isSection(s)).map(([name]) => name);
-        const kinds = new Set(userLeaves.map((l) => promptKind(l.schema)));
+        // Every setting must be reachable in the settings screen, in a category, with an editor that fits it.
+        const userSchema = new SchemaNode(Config);
+        const projectSchema = new SchemaNode(LocalOverrides);
+        const userLeaves = userSchema.leaves();
+        const projectLeaves = projectSchema.leaves();
         t.check(userLeaves.length > 100 && projectLeaves.length > 50, 'settings screen: every setting is a leaf (' + userLeaves.length + ' settings, ' + projectLeaves.length + ' in a project file)');
-        const missingKinds = ['boolean', 'enum', 'union', 'number', 'string', 'string-list', 'json'].filter((k) => !kinds.has(k));
-        t.equal(missingKinds, [], 'settings screen: every kind of setting has a prompt');
-        t.check(userLeaves.some((l) => l.key.join('.') === 'downloads.requireChecksum'), 'settings screen: downloads.requireChecksum is reachable in your settings');
-        t.check(projectLeaves.some((l) => l.key.join('.') === 'downloads.requireChecksum'), 'settings screen: downloads.requireChecksum is reachable in a project file');
-        const untitled = [...sectionNames(Config), ...sectionNames(LocalOverrides)].filter((name) => !SECTION_TITLES[name]);
-        t.equal(untitled, [], 'settings screen: every top-level section has a title');
-        const jsonLeaves = userLeaves.filter((l) => promptKind(l.schema) === 'json');
-        t.check(jsonLeaves.length > 0 && jsonLeaves.every((l) => jsonExample(l.key, l.schema).length > 5), 'settings screen: JSON settings show an example of the expected shape');
-        t.includes(jsonExample(['harnesses'], jsonLeaves[0].schema), 'npmPackage', 'settings screen: the agent definition example shows its fields');
+        const uncategorised = [...userSchema.children(), ...projectSchema.children()].map(([name]) => name).filter((name) => !CATEGORIES.some((c) => c.keys.includes(name)));
+        t.equal(uncategorised, [], 'settings screen: every top-level setting belongs to a category');
+        const kinds = new Set(userLeaves.map((l) => l.node.editor));
+        t.equal(['boolean', 'choice', 'union', 'number', 'string', 'string-list', 'choice-list', 'object-list', 'string-map', 'object-map'].filter((k) => !kinds.has(k)), [], 'settings screen: every kind of editor is used');
+        t.equal(userLeaves.filter((l) => l.node.editor === 'json').map((l) => l.key.join('.')), [], 'settings screen: no setting falls back to typing JSON');
+        t.check(userLeaves.some((l) => l.key.join('.') === 'downloads.requireChecksum') && projectLeaves.some((l) => l.key.join('.') === 'downloads.requireChecksum'), 'settings screen: downloads.requireChecksum is reachable in both files');
+        const harness = userSchema.child('harnesses').element;
+        t.includes(String(harness.check(harness.initial())), 'npmPackage', 'settings screen: a new agent says what it still needs (a package to install)');
+        t.equal(harness.check({ ...harness.initial(), npmPackage: 'my-cli', npmBin: 'my-cli' }), true, '... and is valid once it has one');
+        const mapping = userSchema.child('mappings').element;
+        t.check(mapping.check(mapping.initial()) !== true, 'settings screen: a new mapped folder needs its folders filled in before it is valid');
+        t.equal([Text.humanize('memoryMb'), Text.humanize('vGpu'), nameOf('node')], ['Memory MB', 'V GPU', 'Node.js'], 'settings screen: readable names');
+        t.section('screens');
+        const fit = Text.fit('\x1b[31mred text\x1b[0m', 5);
+        t.equal([Text.width(fit), Text.strip(fit)], [5, 'red …'], 'a coloured label is cut to the width without breaking its colour');
+        t.equal(Text.width('日本'), 4, 'wide characters take two columns');
+        const screen = new ListScreen({ path: ['T'], items: [{ value: 'a', label: 'Alpha', category: 'x' }, { value: 'b', label: 'Beta', category: 'y', description: 'second' }], categories: [{ id: 'x', label: 'X' }, { id: 'y', label: 'Y' }] });
+        const key = (name, text = '') => ({ name, text, ctrl: false, meta: false, shift: false });
+        screen.handle(key('left'));
+        screen.handle(key('down'));
+        screen.handle(key('right'));
+        t.equal(screen.handle(key('return')), { done: { kind: 'pick', value: 'b' } }, 'list screen: arrows switch category, Enter picks');
+        const search = new ListScreen({ path: ['T'], items: [{ value: 'a', label: 'Alpha' }, { value: 'b', label: 'Beta' }] });
+        for (const k of [key('', '/'), key('b', 'b'), key('e', 'e')])
+            search.handle(k);
+        t.equal(search.handle(key('return')), { done: { kind: 'pick', value: 'b' } }, 'list screen: / searches');
+        const lines = Frame.render(screen.render({ width: 60, height: Frame.bodyHeight(20) }), 60, 20);
+        t.equal(lines.length, 20, 'a frame fills the terminal height exactly');
+        const multi = new ListScreen({ path: ['T'], multi: true, items: [{ value: 'a', label: 'A' }, { value: 'b', label: 'B', checked: true }] });
+        multi.handle(key('space'));
+        t.equal(multi.handle(key('return')), { done: { kind: 'multi', values: ['a', 'b'] } }, 'list screen: space ticks several');
+        const typed = new TextScreen({ path: ['T'], label: 'Port', validate: (v) => (Number(v) > 0 ? true : 'a number') });
+        for (const ch of 'x')
+            typed.handle(key(ch, ch));
+        t.equal(typed.handle(key('return')), undefined, 'text field: an invalid value is not accepted');
+        typed.handle(key('backspace'));
+        typed.handle(key('8', '8'));
+        t.equal(typed.handle(key('return')), { done: '8' }, 'text field: a valid value is');
     },
 };

package/dist/selftest/fixtures.d.ts

@@ -31,10 +31,22 @@ export declare const createFixtures: (t: Harness) => {
         defaultHarness: string;
         guestWorkspace: string;
         readOnly: boolean;
+        workspaceFilter: {
+            enabled: boolean;
+            exclude: string[];
+            include: string[];
+        };
+        audit: {
+            enabled: boolean;
+            days: number;
+            maxMb: number;
+            processes: boolean;
+            files: boolean;
+        };
         mappings: {
             host: string;
-            guest: string;
             readOnly: boolean;
+            guest?: string | undefined;
             optional?: boolean | undefined;
         }[];
         sandbox: {
@@ -42,6 +54,7 @@ export declare const createFixtures: (t: Harness) => {
             maxMemoryMb: number;
             maxMemoryPercent: number;
             cpuLimit: number | "none";
+            pageFileMb: number;
             reserveHostMb: number;
             vGpu: boolean;
             networking: boolean;
@@ -51,14 +64,25 @@ export declare const createFixtures: (t: Harness) => {
             printerRedirection: boolean;
             protectedClient: boolean;
             headless: boolean;
+            keepAwake: boolean;
         };
         storage: {
             root: string;
             persistAgentState: boolean;
             dataName: string;
+            markSandboxFiles: boolean;
+            warnDataGb: number;
         };
         network: {
             blockPrivateRanges: boolean;
+            allowOnly: string[];
+            blockHosts: string[];
+            forwardPorts: {
+                pc: number;
+                sandbox: number;
+            }[];
+            dns: string[];
+            proxy: string;
         };
         provisioning: {
             copyFromHost: boolean;
@@ -71,6 +95,9 @@ export declare const createFixtures: (t: Harness) => {
             terminal: {
                 enabled: boolean;
             };
+            conpty: {
+                enabled: boolean;
+            };
         };
         downloads: {
             requireChecksum: boolean;
@@ -164,6 +191,9 @@ export declare const createFixtures: (t: Harness) => {
             };
             vscode: {
                 enabled: boolean;
+                setup: boolean;
+                recommended: boolean;
+                extensions: string[];
             };
             environment: Record<string, string>;
         };
@@ -216,6 +246,19 @@ export declare const createFixtures: (t: Harness) => {
         personalization: {
             enabled: boolean;
         };
+        apps: {
+            install: string[];
+            custom: Record<string, {
+                name: string;
+                exe: string;
+                github?: string | undefined;
+                asset?: string | undefined;
+                url?: string | undefined;
+                sha256?: string | undefined;
+                unpack?: "file" | "archive" | "nsis" | "msi" | undefined;
+                cli?: boolean | undefined;
+            }>;
+        };
         claudeProfile: {
             enabled: boolean;
             hostDir: string;
@@ -224,7 +267,9 @@ export declare const createFixtures: (t: Harness) => {
             copyCredentials: boolean;
             overwrite: boolean;
             syncHistory: boolean;
+            historyScope: "project" | "all";
             syncClaudeMem: boolean;
+            syncClaudeMemBack: boolean;
         };
         harnesses: Record<string, {
             arguments: string[];
@@ -246,6 +291,7 @@ export declare const createFixtures: (t: Harness) => {
             roots: string[];
             askToAddRoot: boolean;
             declinedRoots: string[];
+            allowOutsideMappings: boolean | "ask";
             wsbShare: boolean;
         };
         $schema?: string | undefined;

package/dist/selftest/fixtures.js

@@ -62,7 +62,9 @@ export const createFixtures = (t) => {
     const probe = { nodeDir: hostNode, harnessExe: { dir: hostClaude, file: 'claude.exe' }, gitDir: null, nvmDir: null, hostNodeVersion: HOST_NODE_VERSION };
     /** Resolves a run for `workA` (or whatever `over` says). */
     const run = (over = {}, config = baseConfig) => resolveRun({ packageRoot: install, loaded: { config, configPath: null, base: t.temp }, cwd: workA, noAgent: false, noLocalConfig: false, trustConfig: false, scripts: [], ...over }, HOST_NODE_VERSION);
-    const generate = (r, args = [], p = probe) => generateSandbox({ packageRoot: t.packageRoot, run: r, harnessArgs: args, probe: p });
+    const generate = (r, args = [], p = probe) => 
+    // A fixed "this PC has" list, so "auto" toolchains decide the same on every machine the tests run on.
+    generateSandbox({ packageRoot: t.packageRoot, run: r, harnessArgs: args, probe: p, pcLanguages: ['python', 'rust', 'cpp', 'dotnet'] });
     /** Resolves a run and generates its sandbox (.wsb + launch folder + session.json) in one step. */
     const launch = async (over = {}, options = {}) => generate(await run(over, options.config ?? baseConfig), options.args, options.probe);
     /** Writes a project's `.sandbox-config.json` (objects are serialised; strings are written as they are). */

package/dist/selftest/generate.test.js

@@ -3,6 +3,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { LocalOverrides } from '../core/schema.js';
+import { logonEnv } from '../host/generate.js';
 import { gitIdentity } from '../host/launch/stage.js';
 import { buildWsb, resolveMemoryMb } from '../host/launch/wsb.js';
 export const generateSuite = {
@@ -21,14 +22,17 @@ export const generateSuite = {
         t.includes(wsb, '<vGPU>Disable</vGPU>', 'wsb: vGPU is off');
         t.includes(buildWsb(f.baseConfig, 4096, [{ host: 'C:\\a&b', guest: 'C:\\X', readOnly: true }]), 'C:\\a&amp;b', 'wsb values are XML-escaped');
         t.section('the launch folder');
-        const expectedFiles = ['package.json', 'runtime/main.js', 'runtime/daemon.js', 'runtime/view.js', 'runtime/gitguard.js', 'sandbox/bootstrap.ps1', 'sandbox/logon.cmd', 'sandbox/trust.cmd', 'sandbox/ptyhost.cs', 'sandbox/gitshim.cs'];
+        const expectedFiles = ['package.json', 'runtime/main.js', 'runtime/daemon.js', 'runtime/view.js', 'runtime/gitguard.js', 'sandbox/bootstrap.ps1', 'sandbox/logon.cmd', 'sandbox/trust.cmd', 'sandbox/ptyhost.cs', 'sandbox/gitshim.cs', 'sandbox/cpucap.ps1', 'sandbox/cpucap.cs', 'sandbox/pagefile.ps1', 'sandbox/pagefile.cs', 'sandbox/memlog.ps1'];
         const missing = expectedFiles.filter((file) => !fs.existsSync(path.join(gen.launchPath, file)));
         t.equal(missing, [], 'the launch folder has the runtime, the C# sources and the boot scripts');
-        t.equal(fs.readdirSync(path.join(gen.launchPath, 'runtime')).length, 5, 'the runtime is 5 self-contained files');
+        t.equal(fs.readdirSync(path.join(gen.launchPath, 'runtime')).length, 6, 'the runtime is 6 self-contained files');
         const logon = fs.readFileSync(path.join(gen.launchPath, 'sandbox', 'logon.cmd'), 'utf8');
         t.check(logon.indexOf('trust.cmd') < logon.indexOf('wt.exe'), 'logon.cmd applies the sandbox trust settings before opening Windows Terminal');
         t.includes(logon, 'tools\\terminal\\wt.exe', 'logon.cmd opens Windows Terminal from the tools folder');
         t.includes(logon, '-NoExit', 'logon.cmd falls back to a PowerShell window');
+        t.check(logon.indexOf('env.cmd') > 0 && logon.indexOf('env.cmd') < logon.indexOf('wt.exe'), 'logon.cmd sets AGENT_WORKSPACE (env.cmd) before Windows Terminal starts, so new tabs can open in it');
+        t.includes(fs.readFileSync(path.join(gen.launchPath, 'env.cmd'), 'utf8'), 'AGENT_WORKSPACE=', 'env.cmd names the workspace');
+        t.equal(logonEnv('C:\\Workspace\\100%\\x'), '@set "AGENT_WORKSPACE=C:\\Workspace\\100%%\\x"\r\n', 'a % in the workspace path is escaped for cmd');
         t.section('session.json');
         const session = f.readJson(gen.sessionPath);
         t.equal({
@@ -43,6 +47,7 @@ export const generateSuite = {
         }, { launchId: true, workspace: 'C:\\Workspace\\work-a', workspaceHost: f.workA, firstArgument: '--version', gitFromHost: true, nvmFromHost: true, nodeSpec: '22.3.0', gitAccess: 'full' }, 'session.json carries the id, paths, agent arguments, host tools, versions and git access');
         t.matches(session.hostTools.nodeVersion ?? '', /^\d+\.\d+\.\d+$/, 'session.json: the host Node version is a plain version');
         t.equal(session.cpuLimitPercent, 80, 'session.json carries the CPU cap for cpucap.ps1 (default 80 %)');
+        t.equal(session.pageFileMb, 16384, 'session.json carries the paging file limit for pagefile.ps1 (default 16 GB)');
         t.check(!LocalOverrides.safeParse({ sandbox: { cpuLimit: 'none' } }).success, "a project's .sandbox-config.json cannot lift your CPU cap (sandbox.cpuLimit is yours only)");
         t.section('what is copied from this PC');
         const staged = path.join(gen.launchPath, 'claude-profile');

package/dist/selftest/index.js

@@ -40,6 +40,10 @@ import { syncSuite } from './sync.test.js';
 import { testGuardSuite } from './test-guard.test.js';
 import { toolchainsSuite } from './toolchains.test.js';
 import { workspaceSuite } from './workspace.test.js';
+import { workspaceViewSuite } from './workspace-view.test.js';
+import { liveNetworkSuite } from './live-network.test.js';
+import { liveTerminalSuite } from './live-terminal.test.js';
+import { auditSuite } from './audit.test.js';
 /** Every suite, in the order they run. The live ones come last: they are the slowest and need Windows. */
 export const SUITES = [
     // settings and project files
@@ -47,7 +51,7 @@ export const SUITES = [
     // the generated sandbox and the guest that boots it
     generateSuite, guestBootSuite, mirrorSuite, projectsSuite,
     // syncing with this PC
-    syncSuite, accountsSuite,
+    syncSuite, accountsSuite, workspaceViewSuite, auditSuite,
     // an untrusted sandbox: what the host refuses to do with what it finds
     linksSuite, channelSuite, gitAccessSuite, repoGuardSuite, secretsSuite, hostileInputSuite, testGuardSuite,
     // pure helpers and the command line
@@ -55,7 +59,7 @@ export const SUITES = [
     // every command as its own process
     hostSimSuite,
     // real processes
-    liveDaemonSuite, liveProjectsSuite, liveGitSuite,
+    liveDaemonSuite, liveProjectsSuite, liveGitSuite, liveNetworkSuite, liveTerminalSuite,
 ];
 /** Windows Sandbox (its user is always WDAGUtilityAccount) or a GitHub Actions runner: never someone's PC. */
 export const onThrowawayMachine = () => os.userInfo().username.toLowerCase() === 'wdagutilityaccount' || process.env.GITHUB_ACTIONS === 'true';

package/dist/selftest/live-network.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './suite.js';
+export declare const liveNetworkSuite: Suite;

package/dist/selftest/live-network.test.js

@@ -0,0 +1,63 @@
+// Live: the sandbox's allowOnly proxy (the real bundled runtime\netproxy.js) and the PC-side port forwarder, on
+// loopback only; and that the cargo shim compiles with the compiler that ships with Windows.
+import net from 'node:net';
+import path from 'node:path';
+import { spawn, spawnSync } from 'node:child_process';
+import { startPortForwards } from '../host/port-forward.js';
+import { PROXY_PORT, relayPort } from '../shared/netpolicy.js';
+import { CSC } from './live.js';
+/** A TCP server that answers every line with "echo:<line>". */
+const echoServer = (port = 0) => new Promise((resolve) => {
+    const server = net.createServer((s) => s.on('data', (d) => s.write('echo:' + d.toString())));
+    server.listen(port, '127.0.0.1', () => resolve(server));
+});
+const portOf = (server) => server.address().port;
+/** Sends `text` after `preamble` (a CONNECT) and resolves with everything received within a short while. */
+const talk = (port, preamble, text) => new Promise((resolve) => {
+    const socket = net.connect(port, '127.0.0.1');
+    let got = '';
+    socket.on('data', (d) => { got += d.toString(); if (preamble && got.includes('\r\n\r\n') && got.startsWith('HTTP/1.1 200') && !got.includes('echo:'))
+        socket.write(text); });
+    socket.on('error', () => resolve(got));
+    socket.on('connect', () => socket.write(preamble || text));
+    setTimeout(() => { socket.destroy(); resolve(got); }, 1500);
+});
+export const liveNetworkSuite = {
+    name: 'live-network',
+    title: 'live: allowOnly proxy, port forwarding, cargo shim',
+    live: true,
+    run: async (t, f) => {
+        t.section('allowOnly proxy');
+        const gen = await f.launch({}, { config: { ...f.baseConfig, network: { ...f.baseConfig.network, allowOnly: ['localhost'] } } });
+        const echo = await echoServer();
+        const proxy = spawn(process.execPath, [path.join(gen.launchPath, 'runtime', 'netproxy.js')], { env: { ...process.env, AGENT_LAUNCH_DIR: gen.launchPath, AGENT_DATA_DIR: t.dir('netproxy-data') }, stdio: 'ignore' });
+        try {
+            const up = await t.waitFor(() => new Promise((resolve) => { const s = net.connect(PROXY_PORT, '127.0.0.1', () => { s.destroy(); resolve(true); }); s.on('error', () => resolve(false)); }), 10000, 200);
+            t.check(Boolean(up), 'the proxy listens on localhost');
+            const allowed = await talk(PROXY_PORT, 'CONNECT localhost:' + portOf(echo) + ' HTTP/1.1\r\nHost: localhost\r\n\r\n', 'hi');
+            t.check(allowed.startsWith('HTTP/1.1 200') && allowed.includes('echo:hi'), 'an allowed host is tunnelled through', allowed);
+            const blocked = await talk(PROXY_PORT, 'CONNECT example.com:443 HTTP/1.1\r\nHost: example.com\r\n\r\n', '');
+            t.check(blocked.startsWith('HTTP/1.1 403'), 'any other host is refused (403)', blocked);
+        }
+        finally {
+            proxy.kill();
+            echo.close();
+        }
+        t.section('port forwarding');
+        const relay = await echoServer(relayPort(0));
+        const free = await echoServer();
+        const pcPort = portOf(free);
+        free.close();
+        await new Promise((r) => setTimeout(r, 200));
+        const stop = startPortForwards([{ pc: pcPort, sandbox: 3000 }], () => '127.0.0.1');
+        await new Promise((r) => setTimeout(r, 300));
+        const forwarded = await talk(pcPort, '', 'ping');
+        stop();
+        relay.close();
+        t.equal(forwarded, 'echo:ping', 'localhost:<pc> on this PC reaches the sandbox\'s relay');
+        t.section('cargo shim');
+        const out = path.join(t.dir('cargoshim'), 'cargo.exe');
+        const compiled = spawnSync(CSC, ['/nologo', '/optimize', '/out:' + out, path.join(gen.launchPath, 'sandbox', 'cargoshim.cs')], { encoding: 'utf8' });
+        t.check(compiled.status === 0, 'cargoshim.cs compiles with the .NET Framework compiler (C# 5)', compiled.stdout + compiled.stderr);
+    },
+};

package/dist/selftest/live-terminal.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './suite.js';
+export declare const liveTerminalSuite: Suite;