windows-development-sandbox 1.11.7 → 1.12.0

package/dist/cli/manifest.js

@@ -386,20 +386,6 @@ const COMMAND_LIST = [
         json,
     },
     { name: 'sync', summary: 'copy conversation history back to this PC now', group: 'Data', args: [], options: [] },
-    {
-        name: 'audit',
-        summary: 'what happened in your sandboxes: programs started, files changed, sessions, repo guard (turn it on: sandbox config set audit.enabled true)',
-        group: 'Health',
-        json,
-        args: [],
-        options: [
-            { flag: '--days', type: 'number', value: 'n', description: 'the last n days (default: today)', default: 1 },
-            text('--kind', 'kind', 'only proc, file, session or guard events', {
-                choices: ['proc', 'file', 'session', 'guard'],
-            }),
-            text('--grep', 'text', 'only events containing this text'),
-        ],
-    },
     {
         name: 'logs',
         summary: 'print the newest sandbox log',

package/dist/cli/menu/pages/apps-page.js

@@ -4,7 +4,7 @@
 // (apps.toggle), so the staging stays here: "r" runs the feature's request operation, "c" stages your own programs.
 import _ from 'lodash';
 import { errMsg } from '../../../core/util/index.js';
-import { APP_GROUPS, appIsOn, appRows, customRows, CUSTOM_KEY, entriesOf, INSTALL, ISSUES_URL, requestApp, REQUEST_APP, SAVED, } from '../../../app/features/apps/index.js';
+import { APP_GROUPS, appDetails, appIsOn, appRows, customRows, CUSTOM_KEY, entriesOf, INSTALL, ISSUES_URL, requestApp, REQUEST_APP, SAVED, } from '../../../app/features/apps/index.js';
 import { action } from '../../../app/kernel/index.js';
 import { Theme } from '../../tui/index.js';
 import { ValueEditor } from '../settings/value-editor.js';
@@ -37,20 +37,7 @@ export function appsCategories(file) {
     ];
 }
 function appItem(row) {
-    const notes = [
-        Theme.muted('Download  ') +
-            '~' +
-            row.size +
-            ' once, kept in C:\\AgentData\\tools\\' +
-            (row.setting ? '' : 'apps\\') +
-            row.id,
-        Theme.muted('Starts    ') + (row.cli ? 'from a terminal (on PATH)' : 'from the desktop or Start > Sandbox apps'),
-        ...(row.mesa ? [Theme.muted('Graphics  ') + 'OpenGL on the CPU (Mesa) is added for it'] : []),
-        ...(row.fullGitOnly
-            ? [Theme.warn('Needs full git access (Settings > Projects & setup > Git): it pushes with its own git.')]
-            : []),
-        ...(row.setting ? [Theme.muted('Setting   ') + row.setting] : []),
-    ];
+    const notes = appDetails(row).map((d) => d.warn ? Theme.warn(d.text) : (d.label ? Theme.muted(d.label.padEnd(10)) : '') + d.text);
     return {
         value: row.id,
         label: row.name,

package/dist/cli/menu/pages/maintenance-page.d.ts

@@ -3,6 +3,7 @@ import { type Engines, type Leftovers } from '../../../app/features/engine/index
 import { type HealthLast } from '../../../app/features/health/index.js';
 import { type ContainedStatus, type StorageShow } from '../../../app/features/storage/index.js';
 import { type LogFiles } from '../../../app/features/logs/index.js';
+import { type AuditList } from '../../../app/features/audit/index.js';
 import { type UpdatesStatus } from '../../../app/features/updates/updates.def.js';
 import { type WebStatus } from '../../../app/features/web/index.js';
 import type { Context } from '../../commands/context.js';
@@ -31,6 +32,8 @@ export interface MaintenanceModel {
     readonly engine: Engines | null;
     /** HCS systems left running, read with the engines. */
     readonly leftovers?: Leftovers | null;
+    /** The audit log today (the audit view's query; null: not read yet or unreadable). */
+    readonly audit?: AuditList | null;
     /** The web UI's server (the web feature's status): running or not, and its address. */
     readonly web: WebStatus;
     /** The commands listed under "More commands". */
@@ -52,6 +55,7 @@ export declare class MaintenancePage extends ListPage<string> {
     private engine;
     private leftovers;
     private web;
+    private audit;
     private readonly operations;
     /** The newer version the last check found (null: none, or not looked yet). */
     private latest;

package/dist/cli/menu/pages/maintenance-page.js

@@ -1,6 +1,6 @@
 // Section 7: keeping things in shape. Updates (the program and your saved settings), Data & storage (the data folder,
-// what is stored, clean-up), Health (doctor, repair and this PC's setup together), the logs, and the less common
-// commands. Each is a category on the left and loads when you open it.
+// what is stored, clean-up), Health (doctor, repair and this PC's setup together), Activity (the audit log), the logs,
+// and the less common commands. Each is a category on the left and loads when you open it.
 import { dataPage, showData } from '../../../app/features/data/index.js';
 import { readQuery } from '../../../app/registry.js';
 import { errMsg } from '../../../core/util/index.js';
@@ -8,6 +8,7 @@ import { enginePage, engineLeftovers, engineStatus, } from '../../../app/feature
 import { healthPage, lastHealth } from '../../../app/features/health/index.js';
 import { containedStatus, showStorage, storagePage, } from '../../../app/features/storage/index.js';
 import { CRASH, listLogs, logsPage } from '../../../app/features/logs/index.js';
+import { auditArgv, auditPage, listAudit } from '../../../app/features/audit/index.js';
 import { updatesPage, updatesStatus } from '../../../app/features/updates/updates.def.js';
 import { webPage, webStatus } from '../../../app/features/web/index.js';
 import { commandSpec } from '../../manifest.js';
@@ -32,6 +33,11 @@ const CATEGORIES = [
         label: 'Health',
         description: 'Checks this PC and your settings, repairs problems, and sets up Windows Sandbox.',
     },
+    {
+        id: 'activity',
+        label: 'Activity',
+        description: 'What your agents ran, changed and committed in the last 24 hours (the audit log). Enter on a session shows all of it.',
+    },
     { id: 'logs', label: 'Logs', description: "The sandbox's own logs." },
     {
         id: 'web',
@@ -45,14 +51,13 @@ const CATEGORIES = [
     },
     { id: 'more', label: 'More commands', description: 'Less common commands.' },
 ];
-const MORE_COMMANDS = ['sync', 'audit', 'config', 'generate', 'exec', 'agent-commands'];
+const MORE_COMMANDS = ['sync', 'config', 'generate', 'exec', 'agent-commands'];
 const NO_LOGS = { folder: '', files: [], crash: false };
 /** Until the status is read: the server counts as not running. */
 const NO_WEB = { running: false, port: null, address: null };
 /** Plain names for the commands under More commands. */
 const MORE_LABELS = {
     sync: 'Copy history back now',
-    audit: 'What happened in the sandbox',
     config: 'Your settings file',
     generate: 'Preview a start',
     exec: 'Run a command in the sandbox',
@@ -107,6 +112,10 @@ const NO_UPDATES = {
 function logsMenu(files) {
     return menuView({ ...logsPage(files), empty: undefined }, { category: 'logs', refresh: false });
 }
+/** The audit view (src/app/features/audit) as the Activity category's rows and keys (none until it was read). */
+function auditMenu(m) {
+    return m.audit ? menuView(auditPage(m.audit), { category: 'activity', prefix: 'audit:', refresh: false }) : undefined;
+}
 /** The Web UI view (src/app/features/web) as the menu's rows, keys and Enter labels, for the Web UI category. */
 function webMenu(m) {
     return menuView(webPage(m.web), { category: 'web', prefix: 'web:', refresh: false });
@@ -120,6 +129,7 @@ export function maintenanceOptions(m) {
     const updates = updatesMenu(m);
     const engine = engineMenu(m);
     const web = webMenu(m);
+    const audit = auditMenu(m);
     const more = m.more.map((c) => ({
         value: 'more:' + c.name,
         label: MORE_LABELS[c.name] ?? Text.humanize(c.name),
@@ -129,7 +139,16 @@ export function maintenanceOptions(m) {
     return {
         path: [],
         categories: CATEGORIES,
-        items: [...updates.items, ...dataItems(m), ...health.items, ...logs, ...web.items, ...engine.items, ...more],
+        items: [
+            ...updates.items,
+            ...dataItems(m),
+            ...health.items,
+            ...(audit?.items ?? []),
+            ...logs,
+            ...web.items,
+            ...engine.items,
+            ...more,
+        ],
         empty: 'Nothing here yet.',
         actions: maintenanceActions(m),
         enterLabel: (category, id) => category === 'health'
@@ -140,9 +159,11 @@ export function maintenanceOptions(m) {
                     ? engine.enterLabel(category, id)
                     : category === 'web'
                         ? web.enterLabel(category, id)
-                        : (category === 'data'
-                            ? storageMenu(m.storage)?.enterLabel(category, id) || dataMenuView(m.data)?.enterLabel(category, id)
-                            : undefined) || enterLabel(id ?? ''),
+                        : category === 'activity'
+                            ? (audit?.enterLabel(category, id) ?? '')
+                            : (category === 'data'
+                                ? storageMenu(m.storage)?.enterLabel(category, id) || dataMenuView(m.data)?.enterLabel(category, id)
+                                : undefined) || enterLabel(id ?? ''),
     };
 }
 /**
@@ -201,6 +222,8 @@ function maintenanceActions(m) {
                 return [{ key: 'l', label: m.engine ? 'check again' : 'check' }, ...engineMenu(m).actions];
             case 'web':
                 return webMenu(m).actions;
+            case 'activity':
+                return auditMenu(m)?.actions ?? [];
             default:
                 return [];
         }
@@ -217,6 +240,7 @@ export class MaintenancePage extends ListPage {
     engine = null;
     leftovers = null;
     web = NO_WEB;
+    audit = null;
     operations;
     /** The newer version the last check found (null: none, or not looked yet). */
     latest = null;
@@ -235,6 +259,7 @@ export class MaintenancePage extends ListPage {
             engine: this.engine,
             leftovers: this.leftovers,
             web: this.web,
+            audit: this.audit,
             more: MORE_COMMANDS.flatMap((name) => {
                 const spec = commandSpec(name);
                 return spec ? [{ name, summary: spec.summary }] : [];
@@ -259,6 +284,13 @@ export class MaintenancePage extends ListPage {
         }
         this.last = (await readQuery(lastHealth, this.ctx)).last;
         this.updates = await readQuery(updatesStatus, this.ctx);
+        try {
+            this.audit = await readQuery(listAudit, this.ctx, { limit: 200 });
+        }
+        catch {
+            // An unreadable log: the category says there is nothing yet.
+            this.audit = null;
+        }
         try {
             this.web = await readQuery(webStatus, this.ctx);
         }
@@ -306,6 +338,17 @@ export class MaintenancePage extends ListPage {
                     return await this.operations.perform(chosen.action, [this.label], (text) => this.busy(text));
                 return {};
             }
+            // Activity: a session's row shows its events on the normal screen (sandbox audit --session ...); turning the
+            // log on runs the settings operation.
+            if (this.category === 'activity') {
+                const chosen = auditMenu(this.model())?.resolve(result);
+                if (chosen?.kind !== 'action')
+                    return {};
+                const target = chosen.action.kind === 'link' ? chosen.action.target : undefined;
+                if (target?.kind === 'view')
+                    return { exit: { kind: 'run', argv: auditArgv(target.params) } };
+                return await this.operations.perform(chosen.action, [this.label], (text) => this.busy(text));
+            }
             if (key === 'm' || id === 'data:measure')
                 return await this.measure();
             // Only the open category's rows and keys: `f` and Enter mean something else in Health.

package/dist/cli/menu/views.js

@@ -7,6 +7,7 @@ import { accountsView } from '../../app/features/accounts/index.js';
 import { appsView } from '../../app/features/apps/index.js';
 import { healthView } from '../../app/features/health/index.js';
 import { logsView } from '../../app/features/logs/index.js';
+import { auditView } from '../../app/features/audit/index.js';
 import { projectsView } from '../../app/features/projects/index.js';
 import { sandboxView } from '../../app/features/sandbox/index.js';
 import { sessionsView } from '../../app/features/sessions/index.js';
@@ -29,6 +30,7 @@ export const MENU_VIEWS = [
     { view: dataView, section: 'Maintenance' },
     { view: storageView, section: 'Maintenance' },
     { view: logsView, section: 'Maintenance' },
+    { view: auditView, section: 'Maintenance' },
     { view: updatesView, section: 'Maintenance' },
     { view: engineView, section: 'Maintenance' },
     { view: webView, section: 'Maintenance' },

package/dist/core/config/defaults.js

@@ -3,7 +3,7 @@ export const DEFAULTS = {
     guestWorkspace: 'auto',
     readOnly: false,
     workspaceFilter: { enabled: false, exclude: [], include: [] },
-    audit: { enabled: false, days: 14, maxMb: 100, processes: true, files: true },
+    audit: { enabled: true, days: 7, maxMb: 100, processes: true, files: true, commits: true },
     mappings: [],
     sandbox: {
         engine: 'windows-sandbox',

package/dist/core/schema/apps.d.ts

@@ -2,6 +2,9 @@ import { z } from 'zod';
 export declare const AppIdSchema: z.ZodEnum<{
     [x: string]: string;
 }>;
+export declare const ProjectAppIdSchema: z.ZodEnum<{
+    [x: string]: string;
+}>;
 export declare const CustomAppIdSchema: z.ZodString;
 export declare const CustomAppSchema: z.ZodObject<{
     name: z.ZodString;
@@ -18,6 +21,12 @@ export declare const CustomAppSchema: z.ZodObject<{
     exe: z.ZodString;
     cli: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
+/** What a project file may say about apps: catalogue apps it adds to yours (no add-ons that are yours only). */
+export declare const ProjectAppsSchema: z.ZodObject<{
+    install: z.ZodArray<z.ZodEnum<{
+        [x: string]: string;
+    }>>;
+}, z.core.$strict>;
 export declare const AppsSchema: z.ZodObject<{
     install: z.ZodArray<z.ZodEnum<{
         [x: string]: string;

package/dist/core/schema/apps.js

@@ -3,6 +3,9 @@ import { z } from 'zod';
 import { APPS } from '../../shared/apps/index.js';
 const CATALOGUE_IDS = APPS.filter((a) => !a.setting).map((a) => a.id);
 export const AppIdSchema = z.enum(CATALOGUE_IDS);
+/** The apps a project's .sandbox-config.json may add: not the add-ons that are yours only (they change the agents). */
+const PROJECT_IDS = APPS.filter((a) => !a.setting && !a.userOnly).map((a) => a.id);
+export const ProjectAppIdSchema = z.enum(PROJECT_IDS);
 export const CustomAppIdSchema = z.string().regex(/^[a-z0-9][a-z0-9-]{0,40}$/, 'lower-case letters, digits and - only');
 const compiles = (pattern) => {
     try {
@@ -51,6 +54,12 @@ export const CustomAppSchema = z
     .refine((a) => (a.github && a.asset ? !a.url : Boolean(a.url) && !a.github && !a.asset), {
     message: 'give github + asset, or url (not both)',
 });
+/** What a project file may say about apps: catalogue apps it adds to yours (no add-ons that are yours only). */
+export const ProjectAppsSchema = z.strictObject({
+    install: z
+        .array(ProjectAppIdSchema)
+        .describe('Apps from the catalogue this project adds to yours (agent add-ons such as rtk, Headroom and the MCP servers are set in your own settings only).'),
+});
 export const AppsSchema = z.strictObject({
     install: z
         .array(AppIdSchema)

package/dist/core/schema/config.d.ts

@@ -15,6 +15,7 @@ export declare const ConfigSchema: z.ZodObject<{
         maxMb: z.ZodNumber;
         processes: z.ZodBoolean;
         files: z.ZodBoolean;
+        commits: z.ZodBoolean;
     }, z.core.$strict>;
     mappings: z.ZodArray<z.ZodObject<{
         host: z.ZodString;

package/dist/core/schema/config.js

@@ -8,7 +8,7 @@ import { HarnessSchema } from './harness.js';
 import { AgentCommandsSchema, AttachSchema, ClaudeProfileSchema, SecretsSchema } from './profile.js';
 import { AuditSchema, DownloadsSchema, SharingSchema, GitSchema, GuestWorkspaceSchema, MappingSchema, NetworkSchema, ProvisioningSchema, SandboxSchema, WorkspaceFilterSchema, } from './sandbox.js';
 import { ToolchainsSchema } from './toolchains.js';
-import { AppsSchema } from './apps.js';
+import { AppsSchema, ProjectAppsSchema } from './apps.js';
 import { ProjectsSchema } from './projects.js';
 import { ResumeSchema } from './resume.js';
 import { WebSchema } from './web.js';
@@ -115,8 +115,8 @@ export const LocalOverridesSchema = z
     attach: AttachSchema.partial(),
     personalization: toggle('Copy your desktop look into the sandbox.').partial(),
     // Catalogue apps only (a vetted list): your own programs (apps.custom) download anything, so a repo cannot add
-    // them.
-    apps: AppsSchema.pick({ install: true }).partial(),
+    // them, nor agent add-ons that are yours only (rtk hooks every agent command, Headroom sits in its API path).
+    apps: ProjectAppsSchema.partial(),
     claudeProfile: ClaudeProfileSchema.pick({
         enabled: true,
         overwrite: true,

package/dist/core/schema/sandbox.d.ts

@@ -49,6 +49,7 @@ export declare const AuditSchema: z.ZodObject<{
     maxMb: z.ZodNumber;
     processes: z.ZodBoolean;
     files: z.ZodBoolean;
+    commits: z.ZodBoolean;
 }, z.core.$strict>;
 export declare const WorkspaceFilterSchema: z.ZodObject<{
     enabled: z.ZodBoolean;

package/dist/core/schema/sandbox.js

@@ -108,8 +108,13 @@ export const NetworkSchema = z.strictObject({
 export const AuditSchema = z.strictObject({
     enabled: z
         .boolean()
-        .describe('Keep an audit log on this PC of what happened in your sandboxes: programs started (with their command lines), files changed in the project, sessions, and what the repo guard caught. The sandbox cannot change it. Read it with sandbox audit.'),
-    days: z.number().int().min(1).max(365).describe('Days the audit log is kept.'),
+        .describe('Keep an audit log on this PC of what your agents did: programs started (with their command lines, secrets hidden), files changed in the projects, git commits, sessions, and what the repo guard caught, each linked to the agent session that did it where that can be known. The sandbox cannot change it. Read it with sandbox audit or on the Activity page.'),
+    days: z
+        .number()
+        .int()
+        .min(1)
+        .max(365)
+        .describe('Days the audit log is kept (1 to 30; a larger number keeps 30); older days are deleted when a sandbox starts and once a day.'),
     maxMb: z
         .number()
         .int()
@@ -119,7 +124,10 @@ export const AuditSchema = z.strictObject({
     processes: z
         .boolean()
         .describe('Record every program started in the sandbox with its command line (Windows process auditing; repeated runs are counted, not listed).'),
-    files: z.boolean().describe('Record the files changed in the project while the sandbox runs.'),
+    files: z.boolean().describe('Record the files changed in the projects while the sandbox runs.'),
+    commits: z
+        .boolean()
+        .describe("Record the git commits made in the projects while the sandbox runs (read from each project's .git folder on this PC)."),
 });
 export const WorkspaceFilterSchema = z.strictObject({
     enabled: z

package/dist/guest/apps/app-installer.js

@@ -5,12 +5,13 @@ import path from 'node:path';
 import { appsToInstall } from '../../shared/apps/index.js';
 import { downloader, moveIntoPlace, stagingFolder } from '../../shared/download/index.js';
 import { safeRemove } from '../../shared/io/safe-remove.js';
-import { dryRun } from '../runtime/paths.js';
+import { dryRun, launchDir } from '../runtime/paths.js';
 import { execAsync } from '../runtime/process.js';
 import { exists, mkdirp } from '../runtime/fs.js';
 import { log, warn } from '../runtime/log.js';
 import { errMsg } from '../../core/util/errors.js';
 import { tool } from '../toolchains/tool-env.js';
+import { uvVars } from '../toolchains/runtimes.js';
 import { afterInstall } from './after-install.js';
 import { findExe } from './find-exe.js';
 import { shortcuts } from './shortcuts.js';
@@ -58,9 +59,10 @@ export class AppInstaller {
             if (!exe)
                 throw new Error(entry.exe + ' not found in the download');
             await afterInstall(entry, exe);
-            if (entry.cli || entry.id === 'sysinternals')
+            // A proxy or MCP server (agent add-ons) is started by the sandbox or the agent: no PATH entry, no shortcut.
+            if (!entry.service && (entry.cli || entry.id === 'sysinternals'))
                 this.env.prepend.push(path.dirname(exe));
-            if (!entry.cli)
+            if (!entry.cli && !entry.service)
                 this.gui.push({ name: entry.name, exe });
             this.installed.push(entry.name);
         }
@@ -74,7 +76,11 @@ export class AppInstaller {
         const work = stagingFolder(dest);
         const out = path.join(work, 'out');
         try {
-            if ('npm' in entry.source) {
+            if ('locked' in entry.source) {
+                log('Installing ' + entry.name + ' ' + entry.source.version + ' (pinned, every file checked) ...');
+                await installLocked(entry.id, entry.source.locked, mkdirp(out));
+            }
+            else if ('npm' in entry.source) {
                 const npmCli = path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');
                 log('Installing ' + entry.name + ' (npm) ...');
                 await execAsync(process.execPath, [
@@ -103,6 +109,46 @@ export class AppInstaller {
         }
     }
 }
+/** The Python the uv lock files were made for (sandbox\addons\<id>\requirements.txt). */
+const LOCKED_PYTHON = '3.13';
+/**
+ * Installs a pinned package from its lock file in the launch folder (sandbox\addons\<id>) into `out`. npm: `npm ci`
+ * checks every tarball against the lock file's integrity, and runs no install scripts. uv: a relocatable venv (the
+ * folder moves into place afterwards) and `--require-hashes`, so every wheel must match its SHA-256 in the file; no
+ * source builds.
+ */
+async function installLocked(id, kind, out) {
+    const lock = path.join(launchDir, 'sandbox', 'addons', id);
+    if (kind === 'npm') {
+        for (const f of ['package.json', 'package-lock.json'])
+            fs.copyFileSync(path.join(lock, f), path.join(out, f));
+        const npmCli = path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');
+        await execAsync(process.execPath, [npmCli, 'ci', '--ignore-scripts', '--no-audit', '--no-fund', '--loglevel=error'], { cwd: out });
+        return;
+    }
+    const uv = findExe(tool('uv'), 'uv.exe');
+    if (!uv)
+        throw new Error('uv is not installed (the uv step failed)');
+    const env = { ...process.env, ...uvVars() };
+    const venv = path.join(out, 'venv');
+    await execAsync(uv, ['venv', '--relocatable', '--python', LOCKED_PYTHON, '--python-preference', 'only-managed', venv], {
+        env,
+    });
+    await execAsync(uv, [
+        'pip',
+        'install',
+        '--python',
+        path.join(venv, 'Scripts', 'python.exe'),
+        '--require-hashes',
+        '--no-deps',
+        '--only-binary',
+        ':all:',
+        '--link-mode',
+        'copy',
+        '-r',
+        path.join(lock, 'requirements.txt'),
+    ], { env });
+}
 /** Installs apps.install and apps.custom (skipped ones are listed in the summary). */
 export async function setupApps(env, apps, o) {
     const { entries, skipped } = appsToInstall(apps, o.gitAccess);

package/dist/guest/apps/index.d.ts

@@ -1,3 +1,3 @@
-export { appsNeedMesa } from '../../shared/apps/index.js';
+export { appsNeedMesa, appsNeedUv } from '../../shared/apps/index.js';
 export { setupApps, type AppsOptions } from './app-installer.js';
 export { findExe } from './find-exe.js';

package/dist/guest/apps/index.js

@@ -1,6 +1,6 @@
 // Installs the apps you chose (apps.install from the catalogue, apps.custom of your own) into C:\AgentData\tools\apps.
 // Installers are never run: archives are unpacked, NSIS installers opened with 7-Zip and MSIs extracted (msiexec /a),
 // so nothing is registered and nothing is lost when the sandbox closes.
-export { appsNeedMesa } from '../../shared/apps/index.js';
+export { appsNeedMesa, appsNeedUv } from '../../shared/apps/index.js';
 export { setupApps } from './app-installer.js';
 export { findExe } from './find-exe.js';

package/dist/guest/apps/sources.js

@@ -9,7 +9,7 @@ export async function resolve(entry) {
     }
     if ('url' in s) {
         const name = decodeURIComponent(new URL(s.url).pathname.split('/').pop() || entry.id);
-        return { url: s.url, fileName: /\.\w{2,5}$/.test(name) ? name : name + '.zip' };
+        return { url: s.url, fileName: /\.\w{2,5}$/.test(name) ? name : name + '.zip', sha256: s.sha256 };
     }
     if ('resolve' in s && RESOLVERS[s.resolve])
         return RESOLVERS[s.resolve]();

package/dist/guest/audit/parse.d.ts

@@ -1,7 +1,37 @@
 /** Background programs of Windows itself: never what an agent ran. */
 export declare const NOISE: Set<string>;
-/** The events in wevtutil's XML output as audit lines, with the newest record id seen. */
-export declare function parseProcessEvents(xml: string): {
+/** A session's ptyhost: everything it starts (and what those start) is that session's. */
+export interface SessionRoot {
+    readonly session: string;
+    readonly pid: number;
+    /** When the ptyhost started and ended (ms); a reused process id outside this window is not the session's. */
+    readonly from: number;
+    readonly to?: number;
+}
+/**
+ * Follows the process tree through the events themselves: a program belongs to a session when its parent is that
+ * session's ptyhost, or a program that belongs to it. Every new process id is recorded (as no session's when its
+ * parent is not one's), so an id Windows gives to another process later never inherits a session. A program whose
+ * parent was never seen is no session's: nothing is guessed.
+ */
+export declare class Attributor {
+    private readonly owner;
+    /** The session of a new process (pid, started by ppid at time t), or undefined. */
+    attribute(e: {
+        readonly pid: number;
+        readonly ppid: number;
+        readonly t: number;
+    }, roots: readonly SessionRoot[]): string | undefined;
+}
+/**
+ * The events in wevtutil's XML output as audit lines, with the newest record id seen. With an attributor and the
+ * sessions' roots, each line says which session started it (s), when that is known. Every event goes through the
+ * attributor, Windows' own background programs too (they are left out of the lines only afterwards).
+ */
+export declare function parseProcessEvents(xml: string, attribution?: {
+    readonly attributor: Attributor;
+    readonly roots: readonly SessionRoot[];
+}): {
     lines: string[];
     last: number;
 };

package/dist/guest/audit/parse.js

@@ -1,5 +1,5 @@
-// Reading Windows process-creation events (Security log, 4688, as wevtutil prints them) into audit lines. Pure, so
-// the self-test can check it on the PC side.
+// Reading Windows process-creation events (Security log, 4688, as wevtutil prints them) into audit lines, and which
+// agent session each program belongs to. Pure, so the self-test can check it on the PC side.
 import path from 'node:path';
 /** Background programs of Windows itself: never what an agent ran. */
 export const NOISE = new Set([
@@ -28,6 +28,29 @@ export const NOISE = new Set([
     'usoclient.exe',
     'musnotification.exe',
 ]);
+/** Windows' clocks and ours differ by a moment: a root counts this long around its window. */
+const ROOT_SLACK_MS = 5000;
+/** Most process ids remembered (the oldest are forgotten first). */
+const MAX_KNOWN = 50000;
+/**
+ * Follows the process tree through the events themselves: a program belongs to a session when its parent is that
+ * session's ptyhost, or a program that belongs to it. Every new process id is recorded (as no session's when its
+ * parent is not one's), so an id Windows gives to another process later never inherits a session. A program whose
+ * parent was never seen is no session's: nothing is guessed.
+ */
+export class Attributor {
+    owner = new Map();
+    /** The session of a new process (pid, started by ppid at time t), or undefined. */
+    attribute(e, roots) {
+        const root = roots.find((r) => r.pid === e.ppid && e.t >= r.from - ROOT_SLACK_MS && (r.to === undefined || e.t <= r.to + ROOT_SLACK_MS));
+        const session = root?.session ?? this.owner.get(e.ppid) ?? undefined;
+        this.owner.delete(e.pid);
+        this.owner.set(e.pid, session ?? null);
+        if (this.owner.size > MAX_KNOWN)
+            this.owner.delete(this.owner.keys().next().value);
+        return session;
+    }
+}
 const decode = (s) => s
     .replace(/&lt;/g, '<')
     .replace(/&gt;/g, '>')
@@ -35,8 +58,17 @@ const decode = (s) => s
     .replace(/&apos;/g, "'")
     .replace(/&amp;/g, '&');
 const field = (event, name) => decode(new RegExp("<Data Name='" + name + "'>([^<]*)</Data>").exec(event)?.[1] ?? '');
-/** The events in wevtutil's XML output as audit lines, with the newest record id seen. */
-export function parseProcessEvents(xml) {
+/** A process id as the event writes it (0x1a2c). */
+const pidOf = (text) => {
+    const n = /^0x[0-9a-f]{1,8}$/i.test(text) ? parseInt(text, 16) : /^\d{1,10}$/.test(text) ? Number(text) : 0;
+    return Number.isSafeInteger(n) ? n : 0;
+};
+/**
+ * The events in wevtutil's XML output as audit lines, with the newest record id seen. With an attributor and the
+ * sessions' roots, each line says which session started it (s), when that is known. Every event goes through the
+ * attributor, Windows' own background programs too (they are left out of the lines only afterwards).
+ */
+export function parseProcessEvents(xml, attribution) {
     const lines = [];
     let last = 0;
     for (const event of xml.split('</Event>')) {
@@ -45,15 +77,21 @@ export function parseProcessEvents(xml) {
             continue;
         last = Math.max(last, id);
         const program = field(event, 'NewProcessName');
+        const t = /SystemTime='([^']+)'/.exec(event)?.[1] ?? new Date().toISOString();
+        const pid = pidOf(field(event, 'NewProcessId'));
+        const ppid = pidOf(field(event, 'ProcessId'));
+        const session = attribution && pid && ppid
+            ? attribution.attributor.attribute({ pid, ppid, t: Date.parse(t) || Date.now() }, attribution.roots)
+            : undefined;
         if (!program || NOISE.has(path.win32.basename(program).toLowerCase()))
             continue;
-        const t = /SystemTime='([^']+)'/.exec(event)?.[1] ?? new Date().toISOString();
         lines.push(JSON.stringify({
             t,
             k: 'proc',
             p: program.slice(0, 1024),
             c: field(event, 'CommandLine').slice(0, 2000),
             pp: field(event, 'ParentProcessName').slice(0, 1024),
+            ...(session ? { s: session } : {}),
         }));
     }
     return { lines, last };

package/dist/guest/audit/process-audit.d.ts

@@ -1,6 +1,8 @@
+import { type SessionRoot } from './parse.js';
 /** Turns on process-creation auditing with command lines (the registry is new every boot). */
 export declare function enableProcessAudit(): void;
 /**
  * Reads new process events every 15 s for the daemon's life (from the moment it started: older ones are boot noise).
+ * `roots` gives the sessions' ptyhosts, so each program is linked to the session that started it (parse.ts).
  */
-export declare function startProcessCollector(): void;
+export declare function startProcessCollector(roots?: () => readonly SessionRoot[]): void;