windows-development-sandbox 1.1.0 → 1.4.1

package/dist/core/config.js

@@ -8,11 +8,13 @@ export const DEFAULTS = {
     defaultHarness: 'claude',
     guestWorkspace: 'auto',
     readOnly: false,
+    workspaceFilter: { enabled: false, exclude: [], include: [] },
+    audit: { enabled: false, days: 14, maxMb: 100, processes: true, files: true },
     mappings: [],
-    sandbox: { memoryMb: 'auto', maxMemoryMb: 32768, maxMemoryPercent: 80, cpuLimit: 80, reserveHostMb: 8192, vGpu: false, networking: true, clipboard: true, audioInput: false, videoInput: false, printerRedirection: false, protectedClient: true, headless: false },
-    storage: { root: '%LOCALAPPDATA%\\AgentSandbox', persistAgentState: true, dataName: 'default' },
-    network: { blockPrivateRanges: true },
-    provisioning: { copyFromHost: true, fallbackToInstall: true, refresh: false, git: { enabled: true, access: 'full' }, terminal: { enabled: true } },
+    sandbox: { memoryMb: 'auto', maxMemoryMb: 32768, maxMemoryPercent: 80, cpuLimit: 80, pageFileMb: 16384, reserveHostMb: 8192, vGpu: false, networking: true, clipboard: true, audioInput: false, videoInput: false, printerRedirection: false, protectedClient: true, headless: false, keepAwake: true },
+    storage: { root: '%LOCALAPPDATA%\\AgentSandbox', persistAgentState: true, dataName: 'default', markSandboxFiles: true, warnDataGb: 50 },
+    network: { blockPrivateRanges: true, allowOnly: [], blockHosts: [], forwardPorts: [], dns: [], proxy: '' },
+    provisioning: { copyFromHost: true, fallbackToInstall: true, refresh: false, git: { enabled: true, access: 'full' }, terminal: { enabled: true }, conpty: { enabled: true } },
     downloads: { requireChecksum: false },
     toolchains: {
         node: { version: 'host', extraVersions: [], corepack: true, volta: 'auto', globalPackages: [] },
@@ -33,7 +35,7 @@ export const DEFAULTS = {
         uv: { enabled: true },
         vcRuntime: { enabled: false },
         mesa: { enabled: false, vulkan: false },
-        vscode: { enabled: true },
+        vscode: { enabled: true, setup: true, recommended: true, extensions: [] },
         environment: {},
     },
     databases: {
@@ -48,7 +50,8 @@ export const DEFAULTS = {
     agentCommands: { enabled: false, agents: 'auto' },
     secrets: { strip: true, allow: [], patterns: [], warnFiles: true },
     personalization: { enabled: true },
-    claudeProfile: { enabled: true, hostDir: 'auto', include: ['settings.json', 'CLAUDE.md', 'commands', 'agents', 'skills', 'plugins'], globalStateFile: 'auto', copyCredentials: false, overwrite: true, syncHistory: true, syncClaudeMem: true },
+    apps: { install: [], custom: {} },
+    claudeProfile: { enabled: true, hostDir: 'auto', include: ['settings.json', 'CLAUDE.md', 'commands', 'agents', 'skills', 'plugins'], globalStateFile: 'auto', copyCredentials: false, overwrite: true, syncHistory: true, historyScope: 'project', syncClaudeMem: true, syncClaudeMemBack: false },
     harnesses: {
         claude: { hostExecutable: 'claude.exe', hostDir: 'auto', npmPackage: '@anthropic-ai/claude-code@latest', npmBin: 'claude', arguments: [], environment: { DISABLE_AUTOUPDATER: '1' }, resumeArguments: ['--continue'] },
         codex: { npmPackage: '@openai/codex@latest', npmBin: 'codex', arguments: [], environment: {}, resumeArguments: ['resume', '--last'] },
@@ -69,7 +72,7 @@ export const DEFAULTS = {
         aider: { uvPackage: 'aider-chat', uvBin: 'aider', arguments: [], environment: {}, resumeArguments: ['--restore-chat-history'] },
     },
     hooks: { failFast: false },
-    projects: { all: false, exclude: [], roots: [], askToAddRoot: true, declinedRoots: [], wsbShare: true },
+    projects: { all: false, exclude: [], roots: [], askToAddRoot: true, declinedRoots: [], allowOutsideMappings: 'ask', wsbShare: true },
 };
 /** Per-user folder for config and hooks. Survives reinstalling the npm package. */
 export const userDir = () => process.env.AGENT_SANDBOX_HOME ?? path.join(homeDir(), '.agent-sandbox');

package/dist/core/local-config.d.ts

@@ -2,6 +2,15 @@ import type { Config, LocalConfigFile, Overrides } from './types.js';
 export declare const LOCAL_CONFIG_NAME = ".sandbox-config.json";
 /** Validates a folder's settings and resolves its relative paths against that folder. */
 export declare const normalizeOverrides: (data: unknown, dir: string, source: string) => Overrides;
+/**
+ * The project file's mappings of folders outside the project (%VAR% expanded, links and short names followed). A repo
+ * ships this file, so these reach the rest of this PC: projects.allowOutsideMappings in YOUR settings decides.
+ */
+export declare const outsideMappings: <M extends {
+    host: string;
+}>(dir: string, mappings?: M[]) => M[];
+/** `folder` (also where it really is, through links) is inside the project folder `dir`. */
+export declare const insideProject: (dir: string, folder: string) => boolean;
 /**
  * Protections a project file may only make stricter, never looser. A repo can ship the file, so it must not be able to
  * switch off what you turned on (or turn on what you turned off). The strictest of the two values always wins.
@@ -10,11 +19,32 @@ export declare const ON_IS_SAFER: string[];
 export declare const OFF_IS_SAFER: string[];
 export declare const GIT_STRICTNESS: Record<string, number>;
 export declare const NEVER_LOOSER: string[];
+/** What a project file asks for that would loosen one of your protections (so it is not used). */
+export declare const loosenedRequests: (config: Config, ov: Overrides) => {
+    key: string;
+    wanted: unknown;
+    yours: unknown;
+}[];
 /** Applies validated overrides. Mappings with the same guest folder replace the configured ones. */
 export declare const applyOverrides: (config: Config, ov: Overrides) => Config;
 /** Human-readable list of what a local config changes, with risky items flagged. */
-export declare const describeOverrides: (ov: Overrides) => string[];
+export declare const describeOverrides: (ov: Overrides, dir?: string) => string[];
 export declare const readLocalConfig: (dir: string) => LocalConfigFile | null;
 export declare const trustStorePath: (storageRoot: string) => string;
 export declare const isTrusted: (store: string, file: string, hash: string) => boolean;
 export declare const saveTrust: (store: string, file: string, hash: string) => void;
+export declare const allowStorePath: (storageRoot: string) => string;
+/** true = you allowed it, false = you said no (not asked again), null = not asked yet. */
+export declare const allowedAnswer: (store: string, file: string, setting: string, value: unknown) => boolean | null;
+export declare const saveAllowed: (store: string, file: string, setting: string, value: unknown, allow: boolean) => void;
+/** Answers for folders outside the project are kept with the others, one per folder (and read-only or not). */
+export declare const OUTSIDE_FOLDER = "folder outside the project";
+export declare const outsideKey: (m: {
+    host: string;
+    readOnly: boolean;
+}) => string;
+/** Your config with these requests let through, so applyOverrides' "strictest wins" keeps the project's value. */
+export declare const allowRequests: (config: Config, allowed: {
+    key: string;
+    wanted: unknown;
+}[]) => Config;

package/dist/core/local-config.js

@@ -4,9 +4,10 @@ import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import _ from 'lodash';
+import { z } from 'zod';
 import { mergeConfig } from './config.js';
 import { describeIssues, LocalOverrides } from './schema.js';
-import { expandPath, fail, fileExists, parseJsonc, tryReadJson, writeJson } from './util.js';
+import { expandPath, fail, fileExists, isInsideOrEqual, parseJsonc, tryReadJson, writeJson } from './util.js';
 export const LOCAL_CONFIG_NAME = '.sandbox-config.json';
 /** Validates a folder's settings and resolves its relative paths against that folder. */
 export const normalizeOverrides = (data, dir, source) => {
@@ -18,14 +19,34 @@ export const normalizeOverrides = (data, dir, source) => {
     const missing = scripts?.filter((s) => !fileExists(s)) ?? [];
     if (missing.length)
         fail(source + ' is not valid:\n  - scripts: file not found: ' + missing.join(', '));
-    return { ...overrides, scripts, mappings: overrides.mappings?.map((m) => ({ ...m, host: expandPath(m.host, dir) })) };
+    const mappings = overrides.mappings?.map((m) => ({ ...m, host: expandPath(m.host, dir) }));
+    return { ...overrides, scripts, mappings };
+};
+/**
+ * The project file's mappings of folders outside the project (%VAR% expanded, links and short names followed). A repo
+ * ships this file, so these reach the rest of this PC: projects.allowOutsideMappings in YOUR settings decides.
+ */
+export const outsideMappings = (dir, mappings = []) => mappings.filter((m) => !insideProject(dir, m.host));
+/** `folder` (also where it really is, through links) is inside the project folder `dir`. */
+export const insideProject = (dir, folder) => {
+    // Where a path really is: the nearest existing folder resolved (links, 8.3 short names), plus the part not created yet.
+    const real = (p) => {
+        const full = path.resolve(p);
+        try {
+            return fs.realpathSync.native(full);
+        }
+        catch {
+            return path.dirname(full) === full ? full : path.join(real(path.dirname(full)), path.basename(full));
+        }
+    };
+    return isInsideOrEqual(dir, folder) && isInsideOrEqual(real(dir), real(folder));
 };
 /**
  * Protections a project file may only make stricter, never looser. A repo can ship the file, so it must not be able to
  * switch off what you turned on (or turn on what you turned off). The strictest of the two values always wins.
  */
-export const ON_IS_SAFER = ['readOnly', 'network.blockPrivateRanges', 'sandbox.protectedClient', 'downloads.requireChecksum'];
-export const OFF_IS_SAFER = ['sandbox.networking', 'sandbox.clipboard', 'sandbox.audioInput', 'sandbox.videoInput', 'sandbox.printerRedirection', 'sandbox.vGpu', 'claudeProfile.copyCredentials'];
+export const ON_IS_SAFER = ['readOnly', 'workspaceFilter.enabled', 'network.blockPrivateRanges', 'sandbox.protectedClient', 'downloads.requireChecksum'];
+export const OFF_IS_SAFER = ['sandbox.networking', 'sandbox.clipboard', 'sandbox.audioInput', 'sandbox.videoInput', 'sandbox.printerRedirection', 'sandbox.vGpu', 'claudeProfile.copyCredentials', 'claudeProfile.enabled', 'claudeProfile.syncHistory', 'claudeProfile.syncClaudeMem'];
 export const GIT_STRICTNESS = { full: 0, readonly: 1, none: 2 };
 export const NEVER_LOOSER = [...ON_IS_SAFER, ...OFF_IS_SAFER, 'provisioning.git.access'];
 const keepStrictest = (yours, merged) => {
@@ -34,6 +55,12 @@ const keepStrictest = (yours, merged) => {
     if (GIT_STRICTNESS[yours.provisioning.git.access] > GIT_STRICTNESS[merged.provisioning.git.access])
         merged.provisioning.git.access = yours.provisioning.git.access;
 };
+/** What a project file asks for that would loosen one of your protections (so it is not used). */
+export const loosenedRequests = (config, ov) => [
+    ...ON_IS_SAFER.filter((p) => _.has(ov, p) && !_.get(ov, p) && _.get(config, p)),
+    ...OFF_IS_SAFER.filter((p) => _.has(ov, p) && _.get(ov, p) && !_.get(config, p)),
+    ...(_.has(ov, 'provisioning.git.access') && GIT_STRICTNESS[_.get(ov, 'provisioning.git.access')] < GIT_STRICTNESS[config.provisioning.git.access] ? ['provisioning.git.access'] : []),
+].map((key) => ({ key, wanted: _.get(ov, key), yours: _.get(config, key) }));
 /** Applies validated overrides. Mappings with the same guest folder replace the configured ones. */
 export const applyOverrides = (config, ov) => {
     const { harness, mappings, scripts: _scripts, $schema: _schema, ...rest } = ov;
@@ -41,17 +68,27 @@ export const applyOverrides = (config, ov) => {
     keepStrictest(config, next);
     if (harness)
         next.defaultHarness = harness;
+    // A project adds catalogue apps to yours; it never removes the ones you chose.
+    if (rest.apps?.install)
+        next.apps.install = _.union(config.apps.install, rest.apps.install);
+    // Its patterns keep more out on top of yours; yours stay.
+    if (rest.network?.blockHosts)
+        next.network.blockHosts = _.union(config.network.blockHosts, rest.network.blockHosts);
+    if (rest.workspaceFilter?.exclude)
+        next.workspaceFilter.exclude = _.union(config.workspaceFilter.exclude, rest.workspaceFilter.exclude);
+    const sameGuest = (a, b) => Boolean(a && b && a.toLowerCase() === b.toLowerCase());
     if (mappings)
-        next.mappings = [..._.reject(config.mappings, (m) => mappings.some((o) => o.guest.toLowerCase() === m.guest.toLowerCase())), ...mappings];
+        next.mappings = [..._.reject(config.mappings, (m) => mappings.some((o) => sameGuest(o.guest, m.guest))), ...mappings];
     return next;
 };
 const flatten = (value, prefix = '') => _.isPlainObject(value) ? Object.entries(value).flatMap(([k, v]) => flatten(v, prefix ? prefix + '.' + k : k)) : [prefix + ' = ' + JSON.stringify(value)];
 /** Human-readable list of what a local config changes, with risky items flagged. */
-export const describeOverrides = (ov) => {
+export const describeOverrides = (ov, dir) => {
     const { harness, mappings = [], scripts = [], $schema: _schema, ...sections } = ov;
+    const outside = dir ? outsideMappings(dir, mappings) : [];
     const lines = [
         ...(harness ? ['agent = ' + harness] : []),
-        ...mappings.map((m) => (m.readOnly ? 'read-only' : 'READ/WRITE') + ' folder ' + m.host + '  ->  ' + m.guest),
+        ...mappings.map((m) => (m.readOnly ? 'read-only' : 'READ/WRITE') + ' folder ' + m.host + '  ->  ' + (m.guest ?? 'the same path') + (outside.includes(m) ? '  (outside the project)' : '')),
         ...scripts.map((s) => 'runs inside the sandbox: ' + s),
         ...flatten(sections),
     ];
@@ -75,3 +112,31 @@ const loadTrust = (store) => tryReadJson(store) ?? {};
 const key = (file) => path.resolve(file).toLowerCase();
 export const isTrusted = (store, file, hash) => loadTrust(store)[key(file)] === hash;
 export const saveTrust = (store, file, hash) => writeJson(store, { ...loadTrust(store), [key(file)]: hash });
+// ---- looser settings you allowed for one project (host-only: <storage>\allowed-requests.json) ----------------------
+// A project file can never loosen a protection by itself. When it asks, you are asked once (interactively); a "yes"
+// is kept here, per project file and per "setting = value", so only that value is ever let through for that project.
+export const allowStorePath = (storageRoot) => path.join(storageRoot, 'allowed-requests.json');
+const loadAllowed = (store) => {
+    const parsed = z.record(z.string(), z.array(z.string().max(2000)).max(500)).safeParse(tryReadJson(store) ?? {});
+    return parsed.success ? parsed.data : {};
+};
+const allowKey = (setting, value) => setting + ' = ' + JSON.stringify(value);
+/** true = you allowed it, false = you said no (not asked again), null = not asked yet. */
+export const allowedAnswer = (store, file, setting, value) => {
+    const answers = loadAllowed(store)[key(file)] ?? [];
+    return answers.includes(allowKey(setting, value)) ? true : answers.includes('no: ' + allowKey(setting, value)) ? false : null;
+};
+export const saveAllowed = (store, file, setting, value, allow) => {
+    const all = loadAllowed(store);
+    const entry = allowKey(setting, value);
+    writeJson(store, { ...all, [key(file)]: _.union(_.without(all[key(file)] ?? [], entry, 'no: ' + entry), [(allow ? '' : 'no: ') + entry]) });
+};
+/** Answers for folders outside the project are kept with the others, one per folder (and read-only or not). */
+export const OUTSIDE_FOLDER = 'folder outside the project';
+export const outsideKey = (m) => (m.readOnly ? 'read-only ' : 'read/write ') + path.resolve(m.host).toLowerCase();
+/** Your config with these requests let through, so applyOverrides' "strictest wins" keeps the project's value. */
+export const allowRequests = (config, allowed) => {
+    const next = _.cloneDeep(config);
+    allowed.forEach((a) => _.set(next, a.key, a.wanted));
+    return next;
+};

package/dist/core/project-policy.d.ts

@@ -1,4 +1,4 @@
-import type { Config } from './types.js';
+import type { Config, ResolvedMapping } from './types.js';
 /** The protections of a running sandbox, by setting path (`sandbox.networking`, `provisioning.git.access`, ...). */
 export type Protections = Record<string, boolean | string>;
 export declare const protectionsOf: (config: Config) => Protections;
@@ -7,9 +7,56 @@ export interface JoinCheck {
     stricter: string[];
     /** Settings it would have looser: it gets the sandbox's (stricter) value; shown as a note. */
     looser: string[];
+    /** Settings the sandbox turned on at its start for another project you allowed them for: shared, shown as a note. */
+    shared: string[];
 }
 /**
  * Compares a project's effective protections with the running sandbox's. Hub projects are always read/write
- * (Windows Sandbox maps the hub once, read/write), so a read-only project counts as stricter.
+ * (Windows Sandbox maps the hub once, read/write), so a read-only project counts as stricter. `widened`: the boot
+ * settings the sandbox turned on for another of its projects (with your consent); a project that has them off
+ * shares them instead of being refused.
  */
-export declare const checkJoin: (running: Protections, wanted: Protections) => JoinCheck;
+export declare const checkJoin: (running: Protections, wanted: Protections, widened?: string[]) => JoinCheck;
+/** .wsb devices a project may want on (only when your settings or your answer for that project allow it). */
+export declare const BOOT_SETTINGS: string[];
+/** What the running sandbox booted with (host-only registry). */
+export interface BootRecord {
+    memoryMb: number | null;
+    mappings: ResolvedMapping[];
+}
+/** What a project wants that the running sandbox started without. */
+export interface Missing {
+    settings: string[];
+    memoryMb: number | null;
+    mappings: ResolvedMapping[];
+}
+/**
+ * The boot-only things `config` (a project's effective config: your settings, its approved file, your answers) asks
+ * for that the running sandbox lacks. `exists`: optional mappings whose folder is missing are no wish.
+ */
+export declare const missingAtBoot: (running: Protections, boot: BootRecord, config: Config, exists?: (folder: string) => boolean) => Missing;
+export declare const nothingMissing: (m: Missing) => boolean;
+/** "mw2-agent wants vGPU and 2 folders (C:\Steam\..., F:\SteamLibrary\...), but this sandbox started without them." */
+export declare const describeMissing: (project: string, m: Missing) => string;
+/** "Set sandbox.vGpu (or the mappings) in your own settings to have them in every sandbox." */
+export declare const missingTip: (m: Missing) => string;
+/** A project mapped at boot besides the launch folder, with its effective config. */
+export interface BootWant {
+    name: string;
+    config: Config;
+}
+export interface Widened {
+    config: Config;
+    /** Setting -> the project it was turned on for. */
+    widened: Record<string, string>;
+    notes: string[];
+}
+/**
+ * The launch folder's config plus what the other projects mapped at boot want: their allowed .wsb devices, a fixed
+ * memory size larger than the launch's, and their mappings (placed with every other mapping at launch).
+ * `keepOff`: devices the launch folder's own .sandbox-config.json switched off; they stay off.
+ */
+export declare const widenForProjects: (launch: Config, others: BootWant[], opts?: {
+    keepOff?: string[];
+    exists?: (folder: string) => boolean;
+}) => Widened;

package/dist/core/project-policy.js

@@ -3,6 +3,9 @@
 // A second project may never loosen them, and a project that needs a STRICTER setting than the running sandbox has
 // cannot get it there without changing it for the sessions already running, so that launch is refused with a clear
 // message. A project asking for less than the sandbox has simply runs with the sandbox's (stricter) setting.
+// The other direction: what a project WANTS at boot (a .wsb device you allowed for it, more memory, its mappings) and
+// the running sandbox started without. Those can only come with a restart, so they are named (missingAtBoot), and a
+// sandbox started with several projects boots with all of their allowed wants (widenForProjects).
 // Pure: the host checks it before registering a project, the tests drive it directly.
 import _ from 'lodash';
 import { GIT_STRICTNESS, NEVER_LOOSER, OFF_IS_SAFER, ON_IS_SAFER } from './local-config.js';
@@ -19,17 +22,100 @@ const compare = (setting, running, wanted) => {
 };
 /**
  * Compares a project's effective protections with the running sandbox's. Hub projects are always read/write
- * (Windows Sandbox maps the hub once, read/write), so a read-only project counts as stricter.
+ * (Windows Sandbox maps the hub once, read/write), so a read-only project counts as stricter. `widened`: the boot
+ * settings the sandbox turned on for another of its projects (with your consent); a project that has them off
+ * shares them instead of being refused.
  */
-export const checkJoin = (running, wanted) => {
+export const checkJoin = (running, wanted, widened = []) => {
     const stricter = [];
     const looser = [];
+    const shared = [];
     for (const setting of NEVER_LOOSER) {
         const result = compare(setting, setting === 'readOnly' ? false : running[setting], wanted[setting]);
-        if (result > 0)
+        if (result > 0 && widened.includes(setting))
+            shared.push(setting);
+        else if (result > 0)
             stricter.push(setting + ' = ' + JSON.stringify(wanted[setting]) + ' (the running sandbox has ' + JSON.stringify(setting === 'readOnly' ? false : running[setting]) + ')');
         if (result < 0)
             looser.push(setting + ' stays ' + JSON.stringify(running[setting]));
     }
-    return { stricter, looser };
+    return { stricter, looser, shared };
+};
+// ---- what a project wants at boot ---------------------------------------------------------------------------------
+/** .wsb devices a project may want on (only when your settings or your answer for that project allow it). */
+export const BOOT_SETTINGS = ['sandbox.vGpu', 'sandbox.networking', 'sandbox.clipboard', 'sandbox.audioInput', 'sandbox.videoInput', 'sandbox.printerRedirection'];
+const LABELS = {
+    'sandbox.vGpu': 'vGPU', 'sandbox.networking': 'networking', 'sandbox.clipboard': 'the shared clipboard',
+    'sandbox.audioInput': 'the microphone', 'sandbox.videoInput': 'the camera', 'sandbox.printerRedirection': 'printers',
+};
+const sameHost = (a, b) => a.toLowerCase().replace(/\\+$/, '') === b.toLowerCase().replace(/\\+$/, '');
+/** `m`'s folder is mapped, wherever the launch placed it (read-only is enough for a read-only wish). */
+const isMapped = (mapped, m) => mapped.some((x) => sameHost(x.host, m.host) && (m.readOnly || !x.readOnly));
+/**
+ * The boot-only things `config` (a project's effective config: your settings, its approved file, your answers) asks
+ * for that the running sandbox lacks. `exists`: optional mappings whose folder is missing are no wish.
+ */
+export const missingAtBoot = (running, boot, config, exists = () => true) => ({
+    settings: BOOT_SETTINGS.filter((s) => _.get(config, s) === true && running[s] === false),
+    memoryMb: typeof config.sandbox.memoryMb === 'number' && boot.memoryMb !== null && config.sandbox.memoryMb > boot.memoryMb ? config.sandbox.memoryMb : null,
+    mappings: config.mappings.filter((m) => (!m.optional || exists(m.host)) && !isMapped(boot.mappings, m)).map((m) => ({ host: m.host, guest: m.guest ?? m.host, readOnly: m.readOnly })),
+});
+export const nothingMissing = (m) => m.settings.length === 0 && m.memoryMb === null && m.mappings.length === 0;
+const listing = (items) => items.length <= 1 ? items.join('') : items.slice(0, -1).join(', ') + ' and ' + items[items.length - 1];
+/** "mw2-agent wants vGPU and 2 folders (C:\Steam\..., F:\SteamLibrary\...), but this sandbox started without them." */
+export const describeMissing = (project, m) => {
+    const items = [
+        ...m.settings.map((s) => LABELS[s] ?? s),
+        ...(m.memoryMb !== null ? [m.memoryMb + ' MB of memory'] : []),
+        ...(m.mappings.length ? [m.mappings.length + ' folder' + (m.mappings.length === 1 ? '' : 's') + ' (' + m.mappings.map((x) => x.host).join(', ') + ')'] : []),
+    ];
+    return project + ' wants ' + listing(items) + ', but this sandbox started without ' + (items.length === 1 && !m.mappings.length ? 'it' : 'them') + '.';
+};
+/** "Set sandbox.vGpu (or the mappings) in your own settings to have them in every sandbox." */
+export const missingTip = (m) => {
+    const keys = [...m.settings, ...(m.memoryMb !== null ? ['sandbox.memoryMb'] : [])];
+    const what = keys.length ? listing(keys) + (m.mappings.length ? ' (or the mappings)' : '') : 'the mappings';
+    return 'Set ' + what + ' in your own settings to have them in every sandbox.';
+};
+/**
+ * The launch folder's config plus what the other projects mapped at boot want: their allowed .wsb devices, a fixed
+ * memory size larger than the launch's, and their mappings (placed with every other mapping at launch).
+ * `keepOff`: devices the launch folder's own .sandbox-config.json switched off; they stay off.
+ */
+export const widenForProjects = (launch, others, opts = {}) => {
+    const keepOff = opts.keepOff ?? [];
+    const exists = opts.exists ?? (() => true);
+    const config = _.cloneDeep(launch);
+    const widened = {};
+    const notes = [];
+    for (const setting of BOOT_SETTINGS) {
+        const by = others.find((o) => _.get(o.config, setting) === true);
+        if (!by || _.get(config, setting) === true)
+            continue;
+        if (keepOff.includes(setting)) {
+            notes.push(by.name + ' wants ' + (LABELS[setting] ?? setting) + ', but the launch folder\'s .sandbox-config.json switches it off, so it stays off.');
+            continue;
+        }
+        _.set(config, setting, true);
+        widened[setting] = by.name;
+        notes.push((LABELS[setting] ?? setting) + ' is on in this sandbox (for every project in it): ' + by.name + ' asks for it and you allowed it.');
+    }
+    for (const o of others) {
+        const mem = o.config.sandbox.memoryMb;
+        if (typeof mem === 'number' && typeof config.sandbox.memoryMb === 'number' && mem > config.sandbox.memoryMb)
+            config.sandbox.memoryMb = mem;
+        for (const m of o.config.mappings) {
+            if (config.mappings.some((x) => sameHost(x.host, m.host)))
+                continue;
+            if (m.optional && !exists(m.host))
+                continue;
+            if (!exists(m.host)) {
+                notes.push(o.name + ': mapped folder not found, skipped: ' + m.host);
+                continue;
+            }
+            // Where it appears (and moving it when that place is taken) is decided with every other mapping at launch.
+            config.mappings.push({ ...m, optional: true });
+        }
+    }
+    return { config, widened, notes };
 };

package/dist/core/schema/apps.d.ts

@@ -0,0 +1,40 @@
+import { z } from 'zod';
+export declare const AppId: z.ZodEnum<{
+    [x: string]: string;
+}>;
+export declare const CustomAppId: z.ZodString;
+export declare const CustomApp: z.ZodObject<{
+    name: z.ZodString;
+    github: z.ZodOptional<z.ZodString>;
+    asset: z.ZodOptional<z.ZodString>;
+    url: z.ZodOptional<z.ZodString>;
+    sha256: z.ZodOptional<z.ZodString>;
+    unpack: z.ZodOptional<z.ZodEnum<{
+        file: "file";
+        archive: "archive";
+        nsis: "nsis";
+        msi: "msi";
+    }>>;
+    exe: z.ZodString;
+    cli: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const Apps: z.ZodObject<{
+    install: z.ZodArray<z.ZodEnum<{
+        [x: string]: string;
+    }>>;
+    custom: z.ZodRecord<z.ZodString, z.ZodObject<{
+        name: z.ZodString;
+        github: z.ZodOptional<z.ZodString>;
+        asset: z.ZodOptional<z.ZodString>;
+        url: z.ZodOptional<z.ZodString>;
+        sha256: z.ZodOptional<z.ZodString>;
+        unpack: z.ZodOptional<z.ZodEnum<{
+            file: "file";
+            archive: "archive";
+            nsis: "nsis";
+            msi: "msi";
+        }>>;
+        exe: z.ZodString;
+        cli: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;

package/dist/core/schema/apps.js

@@ -0,0 +1,27 @@
+// Apps installed in the sandbox: entries from the catalogue (shared/apps.ts) and programs of your own.
+import { z } from 'zod';
+import { APPS } from '../../shared/apps.js';
+const CATALOGUE_IDS = APPS.filter((a) => !a.setting).map((a) => a.id);
+export const AppId = z.enum(CATALOGUE_IDS);
+export const CustomAppId = z.string().regex(/^[a-z0-9][a-z0-9-]{0,40}$/, 'lower-case letters, digits and - only');
+const compiles = (pattern) => { try {
+    new RegExp(pattern);
+    return true;
+}
+catch {
+    return false;
+} };
+export const CustomApp = z.strictObject({
+    name: z.string().min(1).max(80).describe('The name on the desktop shortcut, e.g. "My Tool".'),
+    github: z.string().regex(/^[\w.-]+\/[\w.-]+$/, 'owner/repo, e.g. sharkdp/bat').optional().describe('GitHub repository (owner/repo): the file comes from its latest release.'),
+    asset: z.string().max(200).refine(compiles, 'not a valid pattern').optional().describe('With github: a pattern (regular expression) matching the release file, e.g. windows.*x64\\.zip$'),
+    url: z.string().url().startsWith('https://', 'https:// only').optional().describe('Or a direct https:// download link (zip, 7z, exe or msi).'),
+    sha256: z.string().regex(/^[0-9a-fA-F]{64}$/, '64 hex characters').optional().describe('SHA-256 of the download (GitHub releases usually publish one; then this is not needed).'),
+    unpack: z.enum(['archive', 'file', 'nsis', 'msi']).optional().describe('archive (zip, 7z, tar: the default), file (a single .exe), nsis (an installer 7-Zip can open) or msi.'),
+    exe: z.string().min(1).max(200).describe('The program to start (found anywhere in the download), e.g. mytool.exe.'),
+    cli: z.boolean().optional().describe('A command-line tool: its folder goes on PATH instead of getting a desktop shortcut.'),
+}).refine((a) => (a.github && a.asset ? !a.url : Boolean(a.url) && !a.github && !a.asset), { message: 'give github + asset, or url (not both)' });
+export const Apps = z.strictObject({
+    install: z.array(AppId).describe('Apps from the catalogue to install in every sandbox (the Apps screen in the menu lists them by category). Each is downloaded once and kept.'),
+    custom: z.record(CustomAppId, CustomApp).describe('Programs of your own: a GitHub release or a download link, and the program to start. Installed like the catalogue apps.'),
+});

package/dist/core/schema/config.d.ts

@@ -4,9 +4,21 @@ export declare const Config: z.ZodObject<{
     defaultHarness: z.ZodString;
     guestWorkspace: z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodLiteral<"mirror">, z.ZodString]>;
     readOnly: z.ZodBoolean;
+    workspaceFilter: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        exclude: z.ZodArray<z.ZodString>;
+        include: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    audit: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        days: z.ZodNumber;
+        maxMb: z.ZodNumber;
+        processes: z.ZodBoolean;
+        files: z.ZodBoolean;
+    }, z.core.$strict>;
     mappings: z.ZodArray<z.ZodObject<{
         host: z.ZodString;
-        guest: z.ZodString;
+        guest: z.ZodOptional<z.ZodString>;
         readOnly: z.ZodBoolean;
         optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
@@ -15,6 +27,7 @@ export declare const Config: z.ZodObject<{
         maxMemoryMb: z.ZodNumber;
         maxMemoryPercent: z.ZodNumber;
         cpuLimit: z.ZodUnion<readonly [z.ZodLiteral<"none">, z.ZodNumber]>;
+        pageFileMb: z.ZodNumber;
         reserveHostMb: z.ZodNumber;
         vGpu: z.ZodBoolean;
         networking: z.ZodBoolean;
@@ -24,14 +37,25 @@ export declare const Config: z.ZodObject<{
         printerRedirection: z.ZodBoolean;
         protectedClient: z.ZodBoolean;
         headless: z.ZodBoolean;
+        keepAwake: z.ZodBoolean;
     }, z.core.$strict>;
     storage: z.ZodObject<{
         root: z.ZodString;
         persistAgentState: z.ZodBoolean;
         dataName: z.ZodString;
+        markSandboxFiles: z.ZodBoolean;
+        warnDataGb: z.ZodNumber;
     }, z.core.$strict>;
     network: z.ZodObject<{
         blockPrivateRanges: z.ZodBoolean;
+        allowOnly: z.ZodArray<z.ZodString>;
+        blockHosts: z.ZodArray<z.ZodString>;
+        forwardPorts: z.ZodArray<z.ZodObject<{
+            pc: z.ZodNumber;
+            sandbox: z.ZodNumber;
+        }, z.core.$strict>>;
+        dns: z.ZodArray<z.ZodString>;
+        proxy: z.ZodString;
     }, z.core.$strict>;
     provisioning: z.ZodObject<{
         copyFromHost: z.ZodBoolean;
@@ -48,6 +72,9 @@ export declare const Config: z.ZodObject<{
         terminal: z.ZodObject<{
             enabled: z.ZodBoolean;
         }, z.core.$strict>;
+        conpty: z.ZodObject<{
+            enabled: z.ZodBoolean;
+        }, z.core.$strict>;
     }, z.core.$strict>;
     downloads: z.ZodObject<{
         requireChecksum: z.ZodBoolean;
@@ -141,6 +168,9 @@ export declare const Config: z.ZodObject<{
         }, z.core.$strict>;
         vscode: z.ZodObject<{
             enabled: z.ZodBoolean;
+            setup: z.ZodBoolean;
+            recommended: z.ZodBoolean;
+            extensions: z.ZodArray<z.ZodString>;
         }, z.core.$strict>;
         environment: z.ZodRecord<z.ZodString, z.ZodString>;
     }, z.core.$strict>;
@@ -193,6 +223,26 @@ export declare const Config: z.ZodObject<{
     personalization: z.ZodObject<{
         enabled: z.ZodBoolean;
     }, z.core.$strict>;
+    apps: z.ZodObject<{
+        install: z.ZodArray<z.ZodEnum<{
+            [x: string]: string;
+        }>>;
+        custom: z.ZodRecord<z.ZodString, z.ZodObject<{
+            name: z.ZodString;
+            github: z.ZodOptional<z.ZodString>;
+            asset: z.ZodOptional<z.ZodString>;
+            url: z.ZodOptional<z.ZodString>;
+            sha256: z.ZodOptional<z.ZodString>;
+            unpack: z.ZodOptional<z.ZodEnum<{
+                file: "file";
+                archive: "archive";
+                nsis: "nsis";
+                msi: "msi";
+            }>>;
+            exe: z.ZodString;
+            cli: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
     claudeProfile: z.ZodObject<{
         enabled: z.ZodBoolean;
         hostDir: z.ZodString;
@@ -201,7 +251,12 @@ export declare const Config: z.ZodObject<{
         copyCredentials: z.ZodBoolean;
         overwrite: z.ZodBoolean;
         syncHistory: z.ZodBoolean;
+        historyScope: z.ZodEnum<{
+            project: "project";
+            all: "all";
+        }>;
         syncClaudeMem: z.ZodBoolean;
+        syncClaudeMemBack: z.ZodBoolean;
     }, z.core.$strict>;
     harnesses: z.ZodRecord<z.ZodString, z.ZodObject<{
         hostExecutable: z.ZodOptional<z.ZodString>;
@@ -223,6 +278,7 @@ export declare const Config: z.ZodObject<{
         roots: z.ZodArray<z.ZodString>;
         askToAddRoot: z.ZodBoolean;
         declinedRoots: z.ZodArray<z.ZodString>;
+        allowOutsideMappings: z.ZodUnion<readonly [z.ZodLiteral<"ask">, z.ZodBoolean]>;
         wsbShare: z.ZodBoolean;
     }, z.core.$strict>;
 }, z.core.$strict>;
@@ -235,9 +291,13 @@ export declare const LocalOverrides: z.ZodObject<{
     harness: z.ZodOptional<z.ZodString>;
     guestWorkspace: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodLiteral<"mirror">, z.ZodString]>>;
     readOnly: z.ZodOptional<z.ZodBoolean>;
+    workspaceFilter: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        exclude: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
     mappings: z.ZodOptional<z.ZodArray<z.ZodObject<{
         host: z.ZodString;
-        guest: z.ZodString;
+        guest: z.ZodOptional<z.ZodString>;
         readOnly: z.ZodBoolean;
         optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>>;
@@ -255,9 +315,11 @@ export declare const LocalOverrides: z.ZodObject<{
         printerRedirection: z.ZodOptional<z.ZodBoolean>;
         protectedClient: z.ZodOptional<z.ZodBoolean>;
         headless: z.ZodOptional<z.ZodBoolean>;
+        keepAwake: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
     network: z.ZodOptional<z.ZodObject<{
         blockPrivateRanges: z.ZodOptional<z.ZodBoolean>;
+        blockHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
     provisioning: z.ZodOptional<z.ZodObject<{
         copyFromHost: z.ZodOptional<z.ZodBoolean>;
@@ -580,9 +642,13 @@ export declare const LocalOverrides: z.ZodObject<{
     personalization: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
+    apps: z.ZodOptional<z.ZodObject<{
+        install: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            [x: string]: string;
+        }>>>;
+    }, z.core.$strict>>;
     claudeProfile: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
-        include: z.ZodOptional<z.ZodArray<z.ZodString>>;
         copyCredentials: z.ZodOptional<z.ZodBoolean>;
         overwrite: z.ZodOptional<z.ZodBoolean>;
         syncHistory: z.ZodOptional<z.ZodBoolean>;