windows-development-sandbox 1.11.6 → 1.12.0

package/dist/host/audit/git-commits.js

@@ -0,0 +1,157 @@
+// audit.commits: the git commits made in the projects while the sandbox runs, seen from this PC. Git appends a line
+// to <project>\.git\logs\HEAD (and to each worktree's) for every commit; only what was added since the last look is
+// read, a bounded amount each time. The sandbox can write these files (the project is mapped into it), so they are
+// read as untrusted text: no links followed, sizes capped, every line checked, and a reflog that shrank is not read
+// again from the start (that would report old commits as new).
+import fs from 'node:fs';
+import path from 'node:path';
+/** Most new bytes read from one reflog per look (the rest waits for the next look). */
+const MAX_READ = 256 * 1024;
+/** A reflog bigger than this is not read at all (it is not a project's). */
+const MAX_REFLOG = 512 * 1024 * 1024;
+const MAX_LINE = 4096;
+/** Worktrees of one project looked at, at most. */
+const MAX_WORKTREES = 32;
+const LINE = /^([0-9a-f]{40,64}) ([0-9a-f]{40,64}) (.{0,300}?) (\d{1,12}) ([+-]\d{4})\t(.*)$/;
+/** The reflog messages that are new commits: what made it, and its subject. */
+const COMMIT = /^(commit(?: \((initial|amend|merge)\))?|cherry-pick|revert|merge [^:]{1,200}|rebase(?: -i)? \((pick|reword|squash|fixup|edit)\)): ?(.*)$/;
+/** A reflog line as a commit, or null when it is not one (a checkout, a reset, a pull without a merge commit ...). */
+export function parseReflogLine(line, project) {
+    const m = LINE.exec(line);
+    if (!m)
+        return null;
+    const c = COMMIT.exec(m[6]);
+    if (!c || /^0+$/.test(m[2]))
+        return null;
+    const action = c[2] ?? (c[1].startsWith('merge') ? 'merge' : c[1].startsWith('rebase') ? 'rebase' : c[1]);
+    const seconds = Number(m[4]);
+    const time = new Date(seconds * 1000);
+    if (Number.isNaN(time.getTime()))
+        return null;
+    return {
+        t: time.toISOString(),
+        sha: m[2],
+        author: m[3].slice(0, 256),
+        action: action === 'commit' || action === 'initial' ? action : action.slice(0, 32),
+        message: (c[4] || '').slice(0, 1024),
+        project,
+    };
+}
+/** Is this path a plain folder or file (not a link), every step from `root` down? */
+function plainPath(root, target, kind) {
+    const rel = path.relative(root, target);
+    if (rel.startsWith('..') || path.isAbsolute(rel))
+        return false;
+    let current = root;
+    const parts = rel.split(path.sep).filter(Boolean);
+    try {
+        if (fs.lstatSync(current).isSymbolicLink())
+            return false;
+        for (let i = 0; i < parts.length; i++) {
+            current = path.join(current, parts[i]);
+            const stat = fs.lstatSync(current);
+            if (stat.isSymbolicLink())
+                return false;
+            const last = i === parts.length - 1;
+            if (last ? (kind === 'file' ? !stat.isFile() : !stat.isDirectory()) : !stat.isDirectory())
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Follows the projects' reflogs: commits() returns the commits added since the last call. */
+export class CommitWatcher {
+    /** Reflog file -> bytes already read. */
+    offsets = new Map();
+    /** The reflogs of a project: the main one and each worktree's. */
+    reflogs(project) {
+        const git = path.join(project, '.git');
+        if (!plainPath(project, git, 'dir'))
+            return [];
+        const files = [path.join(git, 'logs', 'HEAD')];
+        const worktrees = path.join(git, 'worktrees');
+        if (plainPath(project, worktrees, 'dir'))
+            try {
+                for (const name of fs.readdirSync(worktrees).slice(0, MAX_WORKTREES))
+                    files.push(path.join(worktrees, name, 'logs', 'HEAD'));
+            }
+            catch {
+                /* no worktrees to read */
+            }
+        return files.filter((f) => plainPath(project, f, 'file'));
+    }
+    /** Starts from what is there now: only commits made from here on are reported. */
+    prime(projects) {
+        for (const project of projects)
+            for (const file of this.reflogs(project))
+                if (!this.offsets.has(file))
+                    this.offsets.set(file, this.sizeOf(file));
+    }
+    sizeOf(file) {
+        try {
+            return fs.lstatSync(file).size;
+        }
+        catch {
+            return 0;
+        }
+    }
+    /** The commits added to the projects' reflogs since the last call. A reflog seen for the first time is primed. */
+    commits(projects) {
+        const found = [];
+        for (const project of projects)
+            for (const file of this.reflogs(project)) {
+                const size = this.sizeOf(file);
+                const done = this.offsets.get(file);
+                // New (a worktree made since): from its end. Shrunk (expired or rewritten): from its new end.
+                if (done === undefined || size < done || size > MAX_REFLOG) {
+                    this.offsets.set(file, size);
+                    continue;
+                }
+                if (size === done)
+                    continue;
+                const length = Math.min(size - done, MAX_READ);
+                const bytes = this.readRange(file, done, length);
+                if (bytes === null)
+                    continue;
+                // Only whole lines (counted in bytes); a line cut by the read limit is read next time, one longer than the
+                // limit is skipped.
+                const end = bytes.lastIndexOf(0x0a);
+                if (end < 0) {
+                    if (length === MAX_READ)
+                        this.offsets.set(file, done + length);
+                    continue;
+                }
+                this.offsets.set(file, done + end + 1);
+                for (const line of bytes.subarray(0, end).toString('utf8').split('\n')) {
+                    if (line.length > MAX_LINE)
+                        continue;
+                    const commit = parseReflogLine(line.replace(/\r$/, ''), project);
+                    if (commit)
+                        found.push(commit);
+                }
+            }
+        return found;
+    }
+    readRange(file, from, length) {
+        let fd;
+        try {
+            fd = fs.openSync(file, 'r');
+            // What was opened must still be a plain file (not swapped for something else after the check).
+            if (!fs.fstatSync(fd).isFile())
+                return null;
+            const buffer = Buffer.alloc(length);
+            const read = fs.readSync(fd, buffer, 0, length, from);
+            return buffer.subarray(0, read);
+        }
+        catch {
+            return null;
+        }
+        finally {
+            if (fd !== undefined)
+                fs.closeSync(fd);
+        }
+    }
+}

package/dist/host/audit/index.d.ts

@@ -0,0 +1,5 @@
+export * from './attribute.js';
+export * from './collect.js';
+export * from './git-commits.js';
+export * from './log.js';
+export * from './redact.js';

package/dist/host/audit/index.js

@@ -0,0 +1,6 @@
+// The audit log: what agents did in the sandbox (programs, files, commits, sessions, repo guard), kept on this PC.
+export * from './attribute.js';
+export * from './collect.js';
+export * from './git-commits.js';
+export * from './log.js';
+export * from './redact.js';

package/dist/host/audit/log.d.ts

@@ -1,11 +1,19 @@
 import { z } from 'zod';
-/** One event. k: proc (a program started), file (changed in a project), session, guard (repo guard), note. */
+export declare const AUDIT_KINDS: readonly ["proc", "file", "commit", "session", "guard", "note"];
+export type AuditKind = (typeof AUDIT_KINDS)[number];
+/** A session id as the sandbox's run folder names them. */
+export declare const AuditSessionIdSchema: z.ZodString;
+/**
+ * One event. k: proc (a program started), file (changed in a project), commit (a git commit in a project), session,
+ * guard (repo guard), note.
+ */
 export declare const AuditEventSchema: z.ZodObject<{
     t: z.ZodString;
     k: z.ZodEnum<{
         file: "file";
         session: "session";
         note: "note";
+        commit: "commit";
         proc: "proc";
         guard: "guard";
     }>;
@@ -15,8 +23,23 @@ export declare const AuditEventSchema: z.ZodObject<{
     a: z.ZodOptional<z.ZodString>;
     w: z.ZodOptional<z.ZodString>;
     n: z.ZodOptional<z.ZodNumber>;
+    s: z.ZodOptional<z.ZodString>;
+    ag: z.ZodOptional<z.ZodString>;
+    pj: z.ZodOptional<z.ZodString>;
+    sv: z.ZodOptional<z.ZodEnum<{
+        p: "p";
+        t: "t";
+    }>>;
+    h: z.ZodOptional<z.ZodString>;
+    au: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type AuditEvent = z.output<typeof AuditEventSchema>;
+/** An event with every text field cut to its limit. */
+export declare function clipEvent(e: AuditEvent): AuditEvent;
+/** The audit log keeps at most this many days, whatever audit.days says (older settings allowed up to 365). */
+export declare const MAX_AUDIT_DAYS = 30;
+/** The first day (YYYY-MM-DD, UTC like the day files) of a window of `days` days ending today. */
+export declare function firstDay(days: number, now?: number): string;
 export declare class AuditLog {
     readonly dir: string;
     private readonly limits;
@@ -27,20 +50,34 @@ export declare class AuditLog {
     /** <storage>\audit\<data set name>. */
     static dirFor(storageRoot: string, dataPath: string): string;
     private dayFile;
-    append(events: AuditEvent[]): void;
+    private dayFiles;
+    /**
+     * Writes events (each cut to its fields' limits and checked, so every line written can be read back). Past
+     * audit.maxMb nothing more is written but one note saying so, until old days are deleted.
+     */
+    append(events: readonly AuditEvent[]): void;
+    private fullNoted;
+    /** One line saying the log is full (once until it has room again). */
+    private noteFull;
     /** Compresses finished days, then deletes days past the limits. Cheap when there is nothing to do. */
     maintain(today?: string): void;
-    /** Events of the last `days` days (newest last), optionally of some kinds and containing a text. */
+    /** The text of one day's file, or '' when it cannot be read within the limits. */
+    private dayText;
+    /**
+     * Events of the last `days` days (never older than audit.days), oldest first, optionally of some kinds and
+     * containing a text. At most MAX_READ_EVENTS (the newest).
+     */
     read(o?: {
         days?: number;
-        kinds?: AuditEvent['k'][];
+        kinds?: readonly AuditKind[];
         grep?: string;
     }): AuditEvent[];
     /** Total size on disk. */
     bytes(): number;
 }
 /**
- * Folds repeats: the same event (kind, program/path, command line, action, project) within one minute becomes one line
- * with n = how many times; after `cap` distinct lines a minute, the rest of that minute is one "note" line.
+ * Folds repeats: the same event (kind, program/path, command line, action, project, session) within one minute becomes
+ * one line with n = how many times; after `cap` distinct lines a minute, the rest of that minute is one "note" line.
+ * Commits are never folded or dropped.
  */
-export declare function fold(events: AuditEvent[], cap?: number): AuditEvent[];
+export declare function fold(events: readonly AuditEvent[], cap?: number): AuditEvent[];

package/dist/host/audit/log.js

@@ -1,29 +1,77 @@
 // The audit log (audit.enabled): one file per day of JSON lines in host-only storage (<storage>\audit\<data set>),
 // which the sandbox cannot reach. Days before today are gzipped; days past audit.days and, past audit.maxMb, the
-// oldest days are deleted. Lines are short (field names are one or two letters) and capped in length.
+// oldest days are deleted. Lines are short (field names are one or two letters) and capped in length; reading back is
+// bounded too (a day's file, the events read).
 import fs from 'node:fs';
 import path from 'node:path';
 import zlib from 'node:zlib';
 import { z } from 'zod';
-/** One event. k: proc (a program started), file (changed in a project), session, guard (repo guard), note. */
+export const AUDIT_KINDS = ['proc', 'file', 'commit', 'session', 'guard', 'note'];
+/** A session id as the sandbox's run folder names them. */
+export const AuditSessionIdSchema = z.string().regex(/^[A-Za-z0-9_-]{1,64}$/);
+/**
+ * One event. k: proc (a program started), file (changed in a project), commit (a git commit in a project), session,
+ * guard (repo guard), note.
+ */
 export const AuditEventSchema = z.object({
     /** ISO time. */
     t: z.string().max(40),
-    k: z.enum(['proc', 'file', 'session', 'guard', 'note']),
-    /** proc: program; file: path in the project; session: agent; guard/note: what happened. */
+    k: z.enum(AUDIT_KINDS),
+    /** proc: program; file: path in the project; commit: its message (first line); session: agent; guard/note: what. */
     p: z.string().max(1024).optional(),
-    /** proc: its command line (capped). */
+    /** proc: its command line (capped, secrets hidden). */
     c: z.string().max(2048).optional(),
     /** proc: the program that started it. */
     pp: z.string().max(1024).optional(),
-    /** file: change | rename; session: start | end. */
+    /** file: change | rename; session: start | end; commit: commit | amend | merge | cherry-pick | revert | rebase. */
     a: z.string().max(32).optional(),
-    /** project folder (file, session). */
+    /** project folder on this PC (file, commit, session). */
     w: z.string().max(1024).optional(),
     /** how many times it happened in this line's minute (repeats are counted, not repeated). */
     n: z.number().int().min(1).max(1e9).optional(),
+    /** The agent session it belongs to, when known. */
+    s: AuditSessionIdSchema.optional(),
+    /** That session's agent and project (kept here: the session's own record goes with the sandbox). */
+    ag: z.string().max(64).optional(),
+    pj: z.string().max(128).optional(),
+    /**
+     * How it was linked to the session: p = by the programs the session started (as the sandbox reported them); t = it
+     * was the only session running in that project at the time (likely, not proven).
+     */
+    sv: z.enum(['p', 't']).optional(),
+    /** commit: its id. */
+    h: z
+        .string()
+        .regex(/^[0-9a-f]{7,64}$/)
+        .optional(),
+    /** commit: who git says made it ("Name <email>"). */
+    au: z.string().max(256).optional(),
 });
+/** Each text field's limit (the schema's): text is cut to it before writing, so a line is never refused on reading. */
+const FIELD_MAX = { p: 1024, c: 2048, pp: 1024, a: 32, w: 1024, ag: 64, pj: 128, au: 256 };
+/** An event with every text field cut to its limit. */
+export function clipEvent(e) {
+    const out = { ...e };
+    for (const [key, max] of Object.entries(FIELD_MAX)) {
+        const v = out[key];
+        if (typeof v === 'string' && v.length > max)
+            out[key] = v.slice(0, max - 1) + '…';
+    }
+    return out;
+}
 const DAY_FILE = /^(\d{4}-\d{2}-\d{2})\.jsonl(\.gz)?$/;
+const DAY_MS = 86400000;
+/** A day's file is never unpacked past this (a damaged or planted file cannot take all memory). */
+const MAX_DAY_BYTES = 128 * 1024 * 1024;
+/** Most events one read returns (the newest ones). */
+const MAX_READ_EVENTS = 400000;
+/** The audit log keeps at most this many days, whatever audit.days says (older settings allowed up to 365). */
+export const MAX_AUDIT_DAYS = 30;
+/** The first day (YYYY-MM-DD, UTC like the day files) of a window of `days` days ending today. */
+export function firstDay(days, now = Date.now()) {
+    const kept = Math.min(MAX_AUDIT_DAYS, Math.max(1, days));
+    return new Date(now - (kept - 1) * DAY_MS).toISOString().slice(0, 10);
+}
 export class AuditLog {
     dir;
     limits;
@@ -38,19 +86,55 @@ export class AuditLog {
     dayFile(day, gz = false) {
         return path.join(this.dir, day + '.jsonl' + (gz ? '.gz' : ''));
     }
+    dayFiles() {
+        if (!fs.existsSync(this.dir))
+            return [];
+        return fs
+            .readdirSync(this.dir)
+            .filter((n) => DAY_FILE.test(n))
+            .sort();
+    }
+    /**
+     * Writes events (each cut to its fields' limits and checked, so every line written can be read back). Past
+     * audit.maxMb nothing more is written but one note saying so, until old days are deleted.
+     */
     append(events) {
         if (!events.length)
             return;
         fs.mkdirSync(this.dir, { recursive: true });
+        const limit = this.limits.maxMb * 1024 * 1024;
+        let size = this.bytes();
+        if (size >= limit) {
+            this.noteFull(events[events.length - 1].t);
+            return;
+        }
         const byDay = new Map();
         for (const e of events) {
             const day = e.t.slice(0, 10);
-            if (!/^\d{4}-\d{2}-\d{2}$/.test(day))
+            const checked = AuditEventSchema.safeParse(clipEvent(e));
+            if (!/^\d{4}-\d{2}-\d{2}$/.test(day) || !checked.success)
                 continue;
-            byDay.set(day, [...(byDay.get(day) ?? []), JSON.stringify(e)]);
+            const line = JSON.stringify(checked.data);
+            size += line.length + 1;
+            if (size > limit) {
+                this.noteFull(e.t);
+                break;
+            }
+            byDay.set(day, [...(byDay.get(day) ?? []), line]);
         }
         for (const [day, lines] of byDay)
             fs.appendFileSync(this.dayFile(day), lines.join('\n') + '\n');
+        if (size <= limit)
+            this.fullNoted = false;
+    }
+    fullNoted = false;
+    /** One line saying the log is full (once until it has room again). */
+    noteFull(t) {
+        if (this.fullNoted)
+            return;
+        this.fullNoted = true;
+        const note = { t, k: 'note', p: 'the audit log reached audit.maxMb: nothing more is recorded for now' };
+        fs.appendFileSync(this.dayFile(t.slice(0, 10)), JSON.stringify(note) + '\n');
     }
     /** Compresses finished days, then deletes days past the limits. Cheap when there is nothing to do. */
     maintain(today = new Date().toISOString().slice(0, 10)) {
@@ -61,41 +145,58 @@ export class AuditLog {
             if (!m || m[2] || m[1] >= today)
                 continue;
             const file = path.join(this.dir, name);
-            fs.writeFileSync(file + '.gz', zlib.gzipSync(fs.readFileSync(file)));
+            // Lines that arrived for a day already compressed (late reports) are added as another gzip member: the day's
+            // compressed file is never written over.
+            fs.appendFileSync(file + '.gz', zlib.gzipSync(fs.readFileSync(file)));
             fs.rmSync(file);
         }
-        const oldest = new Date(Date.parse(today) - (this.limits.days - 1) * 86400000).toISOString().slice(0, 10);
-        const files = fs
-            .readdirSync(this.dir)
-            .filter((n) => DAY_FILE.test(n))
-            .sort();
-        for (const name of files.filter((n) => DAY_FILE.exec(n)[1] < oldest))
+        const oldest = firstDay(this.limits.days, Date.parse(today));
+        for (const name of this.dayFiles().filter((n) => DAY_FILE.exec(n)[1] < oldest))
             fs.rmSync(path.join(this.dir, name), { force: true });
-        let left = fs
-            .readdirSync(this.dir)
-            .filter((n) => DAY_FILE.test(n))
-            .sort();
+        let left = this.dayFiles();
         const size = () => left.reduce((sum, n) => sum + fs.statSync(path.join(this.dir, n)).size, 0);
         while (left.length > 1 && size() > this.limits.maxMb * 1024 * 1024) {
             fs.rmSync(path.join(this.dir, left[0]), { force: true });
             left = left.slice(1);
         }
     }
-    /** Events of the last `days` days (newest last), optionally of some kinds and containing a text. */
+    /** The text of one day's file, or '' when it cannot be read within the limits. */
+    dayText(name) {
+        try {
+            const file = path.join(this.dir, name);
+            const stat = fs.lstatSync(file);
+            if (!stat.isFile() || stat.size > MAX_DAY_BYTES)
+                return '';
+            const raw = fs.readFileSync(file);
+            return name.endsWith('.gz')
+                ? zlib.gunzipSync(raw, { maxOutputLength: MAX_DAY_BYTES }).toString('utf8')
+                : raw.toString('utf8');
+        }
+        catch {
+            // Damaged or too big once unpacked: that day is left out rather than failing the whole read.
+            return '';
+        }
+    }
+    /**
+     * Events of the last `days` days (never older than audit.days), oldest first, optionally of some kinds and
+     * containing a text. At most MAX_READ_EVENTS (the newest).
+     */
     read(o = {}) {
-        if (!fs.existsSync(this.dir))
-            return [];
-        const since = new Date(Date.now() - ((o.days ?? 1) - 1) * 86400000).toISOString().slice(0, 10);
+        const since = firstDay(Math.min(o.days ?? 1, this.limits.days));
         const needle = o.grep?.toLowerCase();
-        const events = [];
-        for (const name of fs
-            .readdirSync(this.dir)
-            .filter((n) => DAY_FILE.test(n) && DAY_FILE.exec(n)[1] >= since)
-            .sort()) {
-            const raw = fs.readFileSync(path.join(this.dir, name));
-            const text = name.endsWith('.gz') ? zlib.gunzipSync(raw).toString('utf8') : raw.toString('utf8');
-            for (const line of text.split('\n')) {
-                if (!line.trim())
+        const days = [];
+        let count = 0;
+        // Newest day first, so the cap keeps the newest events.
+        for (const name of this.dayFiles()
+            .filter((n) => DAY_FILE.exec(n)[1] >= since)
+            .reverse()) {
+            if (count >= MAX_READ_EVENTS)
+                break;
+            const events = [];
+            for (const line of this.dayText(name).split('\n')) {
+                if (!line.trim() || line.length > 16384)
+                    continue;
+                if (needle && !line.toLowerCase().includes(needle))
                     continue;
                 let parsed;
                 try {
@@ -109,26 +210,24 @@ export class AuditLog {
                     continue;
                 if (o.kinds?.length && !o.kinds.includes(e.data.k))
                     continue;
-                if (needle && !line.toLowerCase().includes(needle))
-                    continue;
                 events.push(e.data);
             }
+            const room = MAX_READ_EVENTS - count;
+            const kept = events.length > room ? events.slice(events.length - room) : events;
+            count += kept.length;
+            days.push(kept);
         }
-        return events;
+        return days.reverse().flat();
     }
     /** Total size on disk. */
     bytes() {
-        if (!fs.existsSync(this.dir))
-            return 0;
-        return fs
-            .readdirSync(this.dir)
-            .filter((n) => DAY_FILE.test(n))
-            .reduce((sum, n) => sum + fs.statSync(path.join(this.dir, n)).size, 0);
+        return this.dayFiles().reduce((sum, n) => sum + fs.statSync(path.join(this.dir, n)).size, 0);
     }
 }
 /**
- * Folds repeats: the same event (kind, program/path, command line, action, project) within one minute becomes one line
- * with n = how many times; after `cap` distinct lines a minute, the rest of that minute is one "note" line.
+ * Folds repeats: the same event (kind, program/path, command line, action, project, session) within one minute becomes
+ * one line with n = how many times; after `cap` distinct lines a minute, the rest of that minute is one "note" line.
+ * Commits are never folded or dropped.
  */
 export function fold(events, cap = 300) {
     const out = [];
@@ -136,8 +235,12 @@ export function fold(events, cap = 300) {
     const perMinute = new Map();
     const dropped = new Map();
     for (const e of events) {
+        if (e.k === 'commit') {
+            out.push({ ...e });
+            continue;
+        }
         const minute = e.t.slice(0, 16);
-        const key = [minute, e.k, e.p, e.c, e.a, e.w].join('\0');
+        const key = [minute, e.k, e.p, e.c, e.a, e.w, e.s].join('\0');
         const seen = index.get(key);
         if (seen) {
             seen.n = (seen.n ?? 1) + (e.n ?? 1);

package/dist/host/audit/redact.d.ts

@@ -0,0 +1,2 @@
+/** `text` with every credential in it replaced by ***. */
+export declare function redactCommandLine(text: string): string;

package/dist/host/audit/redact.js

@@ -0,0 +1,67 @@
+// Secrets never reach the audit log: a command line (or a commit message) is scrubbed before it is written. Values that
+// are credentials whatever they are called (tokens, keys, passwords in URLs: secret-patterns.ts), and the value after
+// a name that says it holds one (--password x, --token=x, API_KEY=x, -p<pw> for mysql, Authorization: ...), become ***.
+// The text is already capped (2 KB), so these simple patterns stay cheap.
+import { REDACTED } from '../../core/schema/index.js';
+import { SECRET_VALUES, SECRET_WORDS } from '../profile/secret-patterns.js';
+/** The value patterns, each finding every match; a match runs on to the end of its word (the rest of the secret). */
+const VALUES = SECRET_VALUES.map((r) => new RegExp('(?:' + r.source + ')[^\\s"\'`]*', r.flags.includes('g') ? r.flags : r.flags + 'g'));
+/**
+ * `--name value`, `--name=value`, `/name:value`, `NAME=value`, `$env:NAME = "value"`: the flag's dashes (a value after
+ * a space only counts for a flag), the name, the separator, and the value (looked at, not taken: the next word may be
+ * a name of its own).
+ */
+const NAMED = /(?<=^|[\s"'`;&|(])(?:\$env:)?(--?|\/)?([A-Za-z][\w.-]{1,63})(\s*[=:]\s*|\s+)(?=("[^"]*"|'[^']*'|[^\s"'`;&|)]+))/g;
+/** Headers whose whole value is a credential. */
+const HEADERS = /\b(authorization|proxy-authorization|x-api-key|api-key|x-auth-token|cookie|private-token)(\s*:\s*)[^"'\r\n]+/gi;
+/** mysql -p<password> / -pPASSWORD (no space), and user:password for curl (-u x:y, -ux:y, --user=x:y). */
+const SHORT = /(\s-p)(?!\s)([^\s"'`]+)|(\s(?:-u|--user)(?:\s+|=)?)([^\s:"'`]+):([^\s"'`]+)/g;
+/** A token as a URL's user name (https://<token>@host), and PowerShell's ConvertTo-SecureString "<password>". */
+const MORE = [
+    /\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@:"'`]{8,}@/gi,
+    /(ConvertTo-SecureString\s+(?:-String\s+)?)("[^"]*"|'[^']*'|[^\s"'`)]+)/gi,
+    // `-p <password>` only where it means one (docker/podman/npm login, sshpass): elsewhere -p is a port or a package.
+    /(\blogin\b[^&|;\r\n]{0,200}?\s-p\s+|\bsshpass\s+-p\s+)("[^"]*"|'[^']*'|[^\s"'`]+)/gi,
+];
+/** Words that make any name a secret's wherever they stand in it (PGPASSWORD, accessToken, mySecretKey). */
+const ANYWHERE = /PASSW(OR)?D|TOKEN|SECRET|APIKEY|API_KEY|ACCESS_?KEY|PRIVATE_?KEY|CREDENTIAL/;
+/** Does a name (a flag or a variable) say it holds a secret? camelCase counts as words. */
+function secretName(name) {
+    const upper = name
+        .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+        .toUpperCase()
+        .replace(/[-.]/g, '_');
+    return SECRET_WORDS.test(upper) || ANYWHERE.test(upper);
+}
+/** The values after names that say they hold a secret, as *** (see NAMED). */
+function redactNamed(text) {
+    const cuts = [];
+    for (const m of text.matchAll(NAMED)) {
+        const [whole, dashes, name, sep, value] = m;
+        if (!secretName(name) || !(dashes || sep.trim()) || value === REDACTED || value.startsWith('-'))
+            continue;
+        const start = (m.index ?? 0) + whole.length;
+        cuts.push([start, start + value.length]);
+    }
+    let out = '';
+    let from = 0;
+    for (const [start, end] of cuts) {
+        if (start < from)
+            continue;
+        out += text.slice(from, start) + REDACTED;
+        from = end;
+    }
+    return out + text.slice(from);
+}
+/** `text` with every credential in it replaced by ***. */
+export function redactCommandLine(text) {
+    let out = text;
+    for (const r of VALUES)
+        out = out.replace(r, REDACTED);
+    out = out.replace(HEADERS, (_m, name, sep) => name + sep + REDACTED);
+    for (const r of MORE)
+        out = out.replace(r, (_m, lead) => lead + REDACTED + (r === MORE[0] ? '@' : ''));
+    out = redactNamed(out);
+    out = out.replace(SHORT, (m, p, _pw, u, user) => p ? p + REDACTED : u ? u + user + ':' + REDACTED : m);
+    return out;
+}

package/dist/host/update/decision.d.ts

@@ -1,6 +1,6 @@
 import type { ReleaseInfo } from './release-source.js';
 import type { UpdateState } from './update-state.js';
-export type SkipReason = 'no-release' | 'up-to-date' | 'failed-before' | 'sandbox-running' | 'too-soon';
+export type SkipReason = 'no-release' | 'up-to-date' | 'failed-before' | 'too-soon';
 export type UpdateDecision = {
     kind: 'install';
     release: ReleaseInfo;
@@ -24,6 +24,7 @@ export interface DecisionInput {
 export declare function isTooSoon(state: UpdateState, now: Date, minHours: number): boolean;
 /**
  * Install only a version newer than the current one, and never a version that failed before (or an older one than
- * the failure). The sandbox must not be running: its files are in use.
+ * the failure). A running sandbox is no reason to wait: each version has its own folder, the sandbox and this PC's
+ * helpers keep running the version they started with, and old versions are only removed when no sandbox runs.
  */
 export declare function decideUpdate(input: DecisionInput): UpdateDecision;

package/dist/host/update/decision.js

@@ -12,14 +12,13 @@ export function isTooSoon(state, now, minHours) {
 }
 /**
  * Install only a version newer than the current one, and never a version that failed before (or an older one than
- * the failure). The sandbox must not be running: its files are in use.
+ * the failure). A running sandbox is no reason to wait: each version has its own folder, the sandbox and this PC's
+ * helpers keep running the version they started with, and old versions are only removed when no sandbox runs.
  */
 export function decideUpdate(input) {
     const skip = (reason) => ({ kind: 'skip', reason });
     if (!input.force && isTooSoon(input.state, input.now, input.minHoursBetweenChecks))
         return skip('too-soon');
-    if (input.sandboxRunning)
-        return skip('sandbox-running');
     if (!input.latest)
         return skip('no-release');
     const latest = input.latest;

package/dist/host/update/updater.d.ts

@@ -70,7 +70,10 @@ export declare class Updater {
     private checkEntry;
     /** Through the shim, as a user runs it: the pointers now name this version. */
     private checkShim;
-    /** Records the update, keeps the replaced version for a rollback and removes the rest. */
+    /**
+     * Records the update, keeps the replaced version for a rollback and removes the rest, but only when no sandbox runs:
+     * its helpers on this PC may still run an older version from its folder.
+     */
     private finish;
     private discard;
     private recordFailure;