windows-development-sandbox 1.11.7 → 1.12.0

package/dist/host/audit/log.d.ts

@@ -1,11 +1,19 @@
 import { z } from 'zod';
-/** One event. k: proc (a program started), file (changed in a project), session, guard (repo guard), note. */
+export declare const AUDIT_KINDS: readonly ["proc", "file", "commit", "session", "guard", "note"];
+export type AuditKind = (typeof AUDIT_KINDS)[number];
+/** A session id as the sandbox's run folder names them. */
+export declare const AuditSessionIdSchema: z.ZodString;
+/**
+ * One event. k: proc (a program started), file (changed in a project), commit (a git commit in a project), session,
+ * guard (repo guard), note.
+ */
 export declare const AuditEventSchema: z.ZodObject<{
     t: z.ZodString;
     k: z.ZodEnum<{
         file: "file";
         session: "session";
         note: "note";
+        commit: "commit";
         proc: "proc";
         guard: "guard";
     }>;
@@ -15,8 +23,23 @@ export declare const AuditEventSchema: z.ZodObject<{
     a: z.ZodOptional<z.ZodString>;
     w: z.ZodOptional<z.ZodString>;
     n: z.ZodOptional<z.ZodNumber>;
+    s: z.ZodOptional<z.ZodString>;
+    ag: z.ZodOptional<z.ZodString>;
+    pj: z.ZodOptional<z.ZodString>;
+    sv: z.ZodOptional<z.ZodEnum<{
+        p: "p";
+        t: "t";
+    }>>;
+    h: z.ZodOptional<z.ZodString>;
+    au: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type AuditEvent = z.output<typeof AuditEventSchema>;
+/** An event with every text field cut to its limit. */
+export declare function clipEvent(e: AuditEvent): AuditEvent;
+/** The audit log keeps at most this many days, whatever audit.days says (older settings allowed up to 365). */
+export declare const MAX_AUDIT_DAYS = 30;
+/** The first day (YYYY-MM-DD, UTC like the day files) of a window of `days` days ending today. */
+export declare function firstDay(days: number, now?: number): string;
 export declare class AuditLog {
     readonly dir: string;
     private readonly limits;
@@ -27,20 +50,34 @@ export declare class AuditLog {
     /** <storage>\audit\<data set name>. */
     static dirFor(storageRoot: string, dataPath: string): string;
     private dayFile;
-    append(events: AuditEvent[]): void;
+    private dayFiles;
+    /**
+     * Writes events (each cut to its fields' limits and checked, so every line written can be read back). Past
+     * audit.maxMb nothing more is written but one note saying so, until old days are deleted.
+     */
+    append(events: readonly AuditEvent[]): void;
+    private fullNoted;
+    /** One line saying the log is full (once until it has room again). */
+    private noteFull;
     /** Compresses finished days, then deletes days past the limits. Cheap when there is nothing to do. */
     maintain(today?: string): void;
-    /** Events of the last `days` days (newest last), optionally of some kinds and containing a text. */
+    /** The text of one day's file, or '' when it cannot be read within the limits. */
+    private dayText;
+    /**
+     * Events of the last `days` days (never older than audit.days), oldest first, optionally of some kinds and
+     * containing a text. At most MAX_READ_EVENTS (the newest).
+     */
     read(o?: {
         days?: number;
-        kinds?: AuditEvent['k'][];
+        kinds?: readonly AuditKind[];
         grep?: string;
     }): AuditEvent[];
     /** Total size on disk. */
     bytes(): number;
 }
 /**
- * Folds repeats: the same event (kind, program/path, command line, action, project) within one minute becomes one line
- * with n = how many times; after `cap` distinct lines a minute, the rest of that minute is one "note" line.
+ * Folds repeats: the same event (kind, program/path, command line, action, project, session) within one minute becomes
+ * one line with n = how many times; after `cap` distinct lines a minute, the rest of that minute is one "note" line.
+ * Commits are never folded or dropped.
  */
-export declare function fold(events: AuditEvent[], cap?: number): AuditEvent[];
+export declare function fold(events: readonly AuditEvent[], cap?: number): AuditEvent[];

package/dist/host/audit/log.js

@@ -1,29 +1,77 @@
 // The audit log (audit.enabled): one file per day of JSON lines in host-only storage (<storage>\audit\<data set>),
 // which the sandbox cannot reach. Days before today are gzipped; days past audit.days and, past audit.maxMb, the
-// oldest days are deleted. Lines are short (field names are one or two letters) and capped in length.
+// oldest days are deleted. Lines are short (field names are one or two letters) and capped in length; reading back is
+// bounded too (a day's file, the events read).
 import fs from 'node:fs';
 import path from 'node:path';
 import zlib from 'node:zlib';
 import { z } from 'zod';
-/** One event. k: proc (a program started), file (changed in a project), session, guard (repo guard), note. */
+export const AUDIT_KINDS = ['proc', 'file', 'commit', 'session', 'guard', 'note'];
+/** A session id as the sandbox's run folder names them. */
+export const AuditSessionIdSchema = z.string().regex(/^[A-Za-z0-9_-]{1,64}$/);
+/**
+ * One event. k: proc (a program started), file (changed in a project), commit (a git commit in a project), session,
+ * guard (repo guard), note.
+ */
 export const AuditEventSchema = z.object({
     /** ISO time. */
     t: z.string().max(40),
-    k: z.enum(['proc', 'file', 'session', 'guard', 'note']),
-    /** proc: program; file: path in the project; session: agent; guard/note: what happened. */
+    k: z.enum(AUDIT_KINDS),
+    /** proc: program; file: path in the project; commit: its message (first line); session: agent; guard/note: what. */
     p: z.string().max(1024).optional(),
-    /** proc: its command line (capped). */
+    /** proc: its command line (capped, secrets hidden). */
     c: z.string().max(2048).optional(),
     /** proc: the program that started it. */
     pp: z.string().max(1024).optional(),
-    /** file: change | rename; session: start | end. */
+    /** file: change | rename; session: start | end; commit: commit | amend | merge | cherry-pick | revert | rebase. */
     a: z.string().max(32).optional(),
-    /** project folder (file, session). */
+    /** project folder on this PC (file, commit, session). */
     w: z.string().max(1024).optional(),
     /** how many times it happened in this line's minute (repeats are counted, not repeated). */
     n: z.number().int().min(1).max(1e9).optional(),
+    /** The agent session it belongs to, when known. */
+    s: AuditSessionIdSchema.optional(),
+    /** That session's agent and project (kept here: the session's own record goes with the sandbox). */
+    ag: z.string().max(64).optional(),
+    pj: z.string().max(128).optional(),
+    /**
+     * How it was linked to the session: p = by the programs the session started (as the sandbox reported them); t = it
+     * was the only session running in that project at the time (likely, not proven).
+     */
+    sv: z.enum(['p', 't']).optional(),
+    /** commit: its id. */
+    h: z
+        .string()
+        .regex(/^[0-9a-f]{7,64}$/)
+        .optional(),
+    /** commit: who git says made it ("Name <email>"). */
+    au: z.string().max(256).optional(),
 });
+/** Each text field's limit (the schema's): text is cut to it before writing, so a line is never refused on reading. */
+const FIELD_MAX = { p: 1024, c: 2048, pp: 1024, a: 32, w: 1024, ag: 64, pj: 128, au: 256 };
+/** An event with every text field cut to its limit. */
+export function clipEvent(e) {
+    const out = { ...e };
+    for (const [key, max] of Object.entries(FIELD_MAX)) {
+        const v = out[key];
+        if (typeof v === 'string' && v.length > max)
+            out[key] = v.slice(0, max - 1) + '…';
+    }
+    return out;
+}
 const DAY_FILE = /^(\d{4}-\d{2}-\d{2})\.jsonl(\.gz)?$/;
+const DAY_MS = 86400000;
+/** A day's file is never unpacked past this (a damaged or planted file cannot take all memory). */
+const MAX_DAY_BYTES = 128 * 1024 * 1024;
+/** Most events one read returns (the newest ones). */
+const MAX_READ_EVENTS = 400000;
+/** The audit log keeps at most this many days, whatever audit.days says (older settings allowed up to 365). */
+export const MAX_AUDIT_DAYS = 30;
+/** The first day (YYYY-MM-DD, UTC like the day files) of a window of `days` days ending today. */
+export function firstDay(days, now = Date.now()) {
+    const kept = Math.min(MAX_AUDIT_DAYS, Math.max(1, days));
+    return new Date(now - (kept - 1) * DAY_MS).toISOString().slice(0, 10);
+}
 export class AuditLog {
     dir;
     limits;
@@ -38,19 +86,55 @@ export class AuditLog {
     dayFile(day, gz = false) {
         return path.join(this.dir, day + '.jsonl' + (gz ? '.gz' : ''));
     }
+    dayFiles() {
+        if (!fs.existsSync(this.dir))
+            return [];
+        return fs
+            .readdirSync(this.dir)
+            .filter((n) => DAY_FILE.test(n))
+            .sort();
+    }
+    /**
+     * Writes events (each cut to its fields' limits and checked, so every line written can be read back). Past
+     * audit.maxMb nothing more is written but one note saying so, until old days are deleted.
+     */
     append(events) {
         if (!events.length)
             return;
         fs.mkdirSync(this.dir, { recursive: true });
+        const limit = this.limits.maxMb * 1024 * 1024;
+        let size = this.bytes();
+        if (size >= limit) {
+            this.noteFull(events[events.length - 1].t);
+            return;
+        }
         const byDay = new Map();
         for (const e of events) {
             const day = e.t.slice(0, 10);
-            if (!/^\d{4}-\d{2}-\d{2}$/.test(day))
+            const checked = AuditEventSchema.safeParse(clipEvent(e));
+            if (!/^\d{4}-\d{2}-\d{2}$/.test(day) || !checked.success)
                 continue;
-            byDay.set(day, [...(byDay.get(day) ?? []), JSON.stringify(e)]);
+            const line = JSON.stringify(checked.data);
+            size += line.length + 1;
+            if (size > limit) {
+                this.noteFull(e.t);
+                break;
+            }
+            byDay.set(day, [...(byDay.get(day) ?? []), line]);
         }
         for (const [day, lines] of byDay)
             fs.appendFileSync(this.dayFile(day), lines.join('\n') + '\n');
+        if (size <= limit)
+            this.fullNoted = false;
+    }
+    fullNoted = false;
+    /** One line saying the log is full (once until it has room again). */
+    noteFull(t) {
+        if (this.fullNoted)
+            return;
+        this.fullNoted = true;
+        const note = { t, k: 'note', p: 'the audit log reached audit.maxMb: nothing more is recorded for now' };
+        fs.appendFileSync(this.dayFile(t.slice(0, 10)), JSON.stringify(note) + '\n');
     }
     /** Compresses finished days, then deletes days past the limits. Cheap when there is nothing to do. */
     maintain(today = new Date().toISOString().slice(0, 10)) {
@@ -61,41 +145,58 @@ export class AuditLog {
             if (!m || m[2] || m[1] >= today)
                 continue;
             const file = path.join(this.dir, name);
-            fs.writeFileSync(file + '.gz', zlib.gzipSync(fs.readFileSync(file)));
+            // Lines that arrived for a day already compressed (late reports) are added as another gzip member: the day's
+            // compressed file is never written over.
+            fs.appendFileSync(file + '.gz', zlib.gzipSync(fs.readFileSync(file)));
             fs.rmSync(file);
         }
-        const oldest = new Date(Date.parse(today) - (this.limits.days - 1) * 86400000).toISOString().slice(0, 10);
-        const files = fs
-            .readdirSync(this.dir)
-            .filter((n) => DAY_FILE.test(n))
-            .sort();
-        for (const name of files.filter((n) => DAY_FILE.exec(n)[1] < oldest))
+        const oldest = firstDay(this.limits.days, Date.parse(today));
+        for (const name of this.dayFiles().filter((n) => DAY_FILE.exec(n)[1] < oldest))
             fs.rmSync(path.join(this.dir, name), { force: true });
-        let left = fs
-            .readdirSync(this.dir)
-            .filter((n) => DAY_FILE.test(n))
-            .sort();
+        let left = this.dayFiles();
         const size = () => left.reduce((sum, n) => sum + fs.statSync(path.join(this.dir, n)).size, 0);
         while (left.length > 1 && size() > this.limits.maxMb * 1024 * 1024) {
             fs.rmSync(path.join(this.dir, left[0]), { force: true });
             left = left.slice(1);
         }
     }
-    /** Events of the last `days` days (newest last), optionally of some kinds and containing a text. */
+    /** The text of one day's file, or '' when it cannot be read within the limits. */
+    dayText(name) {
+        try {
+            const file = path.join(this.dir, name);
+            const stat = fs.lstatSync(file);
+            if (!stat.isFile() || stat.size > MAX_DAY_BYTES)
+                return '';
+            const raw = fs.readFileSync(file);
+            return name.endsWith('.gz')
+                ? zlib.gunzipSync(raw, { maxOutputLength: MAX_DAY_BYTES }).toString('utf8')
+                : raw.toString('utf8');
+        }
+        catch {
+            // Damaged or too big once unpacked: that day is left out rather than failing the whole read.
+            return '';
+        }
+    }
+    /**
+     * Events of the last `days` days (never older than audit.days), oldest first, optionally of some kinds and
+     * containing a text. At most MAX_READ_EVENTS (the newest).
+     */
     read(o = {}) {
-        if (!fs.existsSync(this.dir))
-            return [];
-        const since = new Date(Date.now() - ((o.days ?? 1) - 1) * 86400000).toISOString().slice(0, 10);
+        const since = firstDay(Math.min(o.days ?? 1, this.limits.days));
         const needle = o.grep?.toLowerCase();
-        const events = [];
-        for (const name of fs
-            .readdirSync(this.dir)
-            .filter((n) => DAY_FILE.test(n) && DAY_FILE.exec(n)[1] >= since)
-            .sort()) {
-            const raw = fs.readFileSync(path.join(this.dir, name));
-            const text = name.endsWith('.gz') ? zlib.gunzipSync(raw).toString('utf8') : raw.toString('utf8');
-            for (const line of text.split('\n')) {
-                if (!line.trim())
+        const days = [];
+        let count = 0;
+        // Newest day first, so the cap keeps the newest events.
+        for (const name of this.dayFiles()
+            .filter((n) => DAY_FILE.exec(n)[1] >= since)
+            .reverse()) {
+            if (count >= MAX_READ_EVENTS)
+                break;
+            const events = [];
+            for (const line of this.dayText(name).split('\n')) {
+                if (!line.trim() || line.length > 16384)
+                    continue;
+                if (needle && !line.toLowerCase().includes(needle))
                     continue;
                 let parsed;
                 try {
@@ -109,26 +210,24 @@ export class AuditLog {
                     continue;
                 if (o.kinds?.length && !o.kinds.includes(e.data.k))
                     continue;
-                if (needle && !line.toLowerCase().includes(needle))
-                    continue;
                 events.push(e.data);
             }
+            const room = MAX_READ_EVENTS - count;
+            const kept = events.length > room ? events.slice(events.length - room) : events;
+            count += kept.length;
+            days.push(kept);
         }
-        return events;
+        return days.reverse().flat();
     }
     /** Total size on disk. */
     bytes() {
-        if (!fs.existsSync(this.dir))
-            return 0;
-        return fs
-            .readdirSync(this.dir)
-            .filter((n) => DAY_FILE.test(n))
-            .reduce((sum, n) => sum + fs.statSync(path.join(this.dir, n)).size, 0);
+        return this.dayFiles().reduce((sum, n) => sum + fs.statSync(path.join(this.dir, n)).size, 0);
     }
 }
 /**
- * Folds repeats: the same event (kind, program/path, command line, action, project) within one minute becomes one line
- * with n = how many times; after `cap` distinct lines a minute, the rest of that minute is one "note" line.
+ * Folds repeats: the same event (kind, program/path, command line, action, project, session) within one minute becomes
+ * one line with n = how many times; after `cap` distinct lines a minute, the rest of that minute is one "note" line.
+ * Commits are never folded or dropped.
  */
 export function fold(events, cap = 300) {
     const out = [];
@@ -136,8 +235,12 @@ export function fold(events, cap = 300) {
     const perMinute = new Map();
     const dropped = new Map();
     for (const e of events) {
+        if (e.k === 'commit') {
+            out.push({ ...e });
+            continue;
+        }
         const minute = e.t.slice(0, 16);
-        const key = [minute, e.k, e.p, e.c, e.a, e.w].join('\0');
+        const key = [minute, e.k, e.p, e.c, e.a, e.w, e.s].join('\0');
         const seen = index.get(key);
         if (seen) {
             seen.n = (seen.n ?? 1) + (e.n ?? 1);

package/dist/host/audit/redact.d.ts

@@ -0,0 +1,2 @@
+/** `text` with every credential in it replaced by ***. */
+export declare function redactCommandLine(text: string): string;

package/dist/host/audit/redact.js

@@ -0,0 +1,67 @@
+// Secrets never reach the audit log: a command line (or a commit message) is scrubbed before it is written. Values that
+// are credentials whatever they are called (tokens, keys, passwords in URLs: secret-patterns.ts), and the value after
+// a name that says it holds one (--password x, --token=x, API_KEY=x, -p<pw> for mysql, Authorization: ...), become ***.
+// The text is already capped (2 KB), so these simple patterns stay cheap.
+import { REDACTED } from '../../core/schema/index.js';
+import { SECRET_VALUES, SECRET_WORDS } from '../profile/secret-patterns.js';
+/** The value patterns, each finding every match; a match runs on to the end of its word (the rest of the secret). */
+const VALUES = SECRET_VALUES.map((r) => new RegExp('(?:' + r.source + ')[^\\s"\'`]*', r.flags.includes('g') ? r.flags : r.flags + 'g'));
+/**
+ * `--name value`, `--name=value`, `/name:value`, `NAME=value`, `$env:NAME = "value"`: the flag's dashes (a value after
+ * a space only counts for a flag), the name, the separator, and the value (looked at, not taken: the next word may be
+ * a name of its own).
+ */
+const NAMED = /(?<=^|[\s"'`;&|(])(?:\$env:)?(--?|\/)?([A-Za-z][\w.-]{1,63})(\s*[=:]\s*|\s+)(?=("[^"]*"|'[^']*'|[^\s"'`;&|)]+))/g;
+/** Headers whose whole value is a credential. */
+const HEADERS = /\b(authorization|proxy-authorization|x-api-key|api-key|x-auth-token|cookie|private-token)(\s*:\s*)[^"'\r\n]+/gi;
+/** mysql -p<password> / -pPASSWORD (no space), and user:password for curl (-u x:y, -ux:y, --user=x:y). */
+const SHORT = /(\s-p)(?!\s)([^\s"'`]+)|(\s(?:-u|--user)(?:\s+|=)?)([^\s:"'`]+):([^\s"'`]+)/g;
+/** A token as a URL's user name (https://<token>@host), and PowerShell's ConvertTo-SecureString "<password>". */
+const MORE = [
+    /\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@:"'`]{8,}@/gi,
+    /(ConvertTo-SecureString\s+(?:-String\s+)?)("[^"]*"|'[^']*'|[^\s"'`)]+)/gi,
+    // `-p <password>` only where it means one (docker/podman/npm login, sshpass): elsewhere -p is a port or a package.
+    /(\blogin\b[^&|;\r\n]{0,200}?\s-p\s+|\bsshpass\s+-p\s+)("[^"]*"|'[^']*'|[^\s"'`]+)/gi,
+];
+/** Words that make any name a secret's wherever they stand in it (PGPASSWORD, accessToken, mySecretKey). */
+const ANYWHERE = /PASSW(OR)?D|TOKEN|SECRET|APIKEY|API_KEY|ACCESS_?KEY|PRIVATE_?KEY|CREDENTIAL/;
+/** Does a name (a flag or a variable) say it holds a secret? camelCase counts as words. */
+function secretName(name) {
+    const upper = name
+        .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+        .toUpperCase()
+        .replace(/[-.]/g, '_');
+    return SECRET_WORDS.test(upper) || ANYWHERE.test(upper);
+}
+/** The values after names that say they hold a secret, as *** (see NAMED). */
+function redactNamed(text) {
+    const cuts = [];
+    for (const m of text.matchAll(NAMED)) {
+        const [whole, dashes, name, sep, value] = m;
+        if (!secretName(name) || !(dashes || sep.trim()) || value === REDACTED || value.startsWith('-'))
+            continue;
+        const start = (m.index ?? 0) + whole.length;
+        cuts.push([start, start + value.length]);
+    }
+    let out = '';
+    let from = 0;
+    for (const [start, end] of cuts) {
+        if (start < from)
+            continue;
+        out += text.slice(from, start) + REDACTED;
+        from = end;
+    }
+    return out + text.slice(from);
+}
+/** `text` with every credential in it replaced by ***. */
+export function redactCommandLine(text) {
+    let out = text;
+    for (const r of VALUES)
+        out = out.replace(r, REDACTED);
+    out = out.replace(HEADERS, (_m, name, sep) => name + sep + REDACTED);
+    for (const r of MORE)
+        out = out.replace(r, (_m, lead) => lead + REDACTED + (r === MORE[0] ? '@' : ''));
+    out = redactNamed(out);
+    out = out.replace(SHORT, (m, p, _pw, u, user) => p ? p + REDACTED : u ? u + user + ':' + REDACTED : m);
+    return out;
+}

package/dist/runtime/agent.js

@@ -25541,14 +25541,19 @@ var NetworkSchema = external_exports.strictObject({
 });
 var AuditSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "Keep an audit log on this PC of what happened in your sandboxes: programs started (with their command lines), files changed in the project, sessions, and what the repo guard caught. The sandbox cannot change it. Read it with sandbox audit."
+    "Keep an audit log on this PC of what your agents did: programs started (with their command lines, secrets hidden), files changed in the projects, git commits, sessions, and what the repo guard caught, each linked to the agent session that did it where that can be known. The sandbox cannot change it. Read it with sandbox audit or on the Activity page."
+  ),
+  days: external_exports.number().int().min(1).max(365).describe(
+    "Days the audit log is kept (1 to 30; a larger number keeps 30); older days are deleted when a sandbox starts and once a day."
   ),
-  days: external_exports.number().int().min(1).max(365).describe("Days the audit log is kept."),
   maxMb: external_exports.number().int().min(5).max(5e3).describe("Most space the audit log may take, in MB (older days go first). Days before today are compressed."),
   processes: external_exports.boolean().describe(
     "Record every program started in the sandbox with its command line (Windows process auditing; repeated runs are counted, not listed)."
   ),
-  files: external_exports.boolean().describe("Record the files changed in the project while the sandbox runs.")
+  files: external_exports.boolean().describe("Record the files changed in the projects while the sandbox runs."),
+  commits: external_exports.boolean().describe(
+    "Record the git commits made in the projects while the sandbox runs (read from each project's .git folder on this PC)."
+  )
 });
 var WorkspaceFilterSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
@@ -25751,7 +25756,100 @@ var ToolchainsSchema = external_exports.strictObject({
 
 // src/shared/apps/catalogue.ts
 var gh = (github, asset) => ({ github, asset });
+var RTK_VERSION = "1.0.1";
+var RTK_URL = "https://github.com/rtk-ai/rtk/releases/download/v" + RTK_VERSION + "/rtk-oss-x86_64-pc-windows-msvc.zip";
+var RTK_SHA256 = "0e53e2eca471e15fbd3636e64e6bc0b182cbc278ed0339c80450a2dd03f4cd6b";
+var HEADROOM_VERSION = "0.41.0";
+var CCUSAGE_VERSION = "20.0.36";
+var PLAYWRIGHT_MCP_VERSION = "0.0.83";
+var CONTEXT7_MCP_VERSION = "4.4.2";
 var APPS = [
+  // ---- agent add-ons
+  {
+    id: "rtk",
+    name: "rtk (Rust Token Killer)",
+    category: "agents",
+    about: "Compacts the output of shell commands (git, tests, builds, ls ...) before the agent reads it, so it uses fewer tokens. Claude Code's Bash commands go through it on their own.",
+    size: "6 MB",
+    source: { url: RTK_URL, sha256: RTK_SHA256 },
+    exe: "rtk.exe",
+    cli: true,
+    plugsInto: "Claude Code through a hook in the sandbox's managed settings; other agents are told to use it",
+    userOnly: true
+  },
+  {
+    id: "headroom",
+    name: "Headroom",
+    category: "agents",
+    about: "Compresses what Claude Code sends to the model (tool output, logs, files) so it uses fewer tokens: a local proxy on 127.0.0.1:8787 that sits in Claude Code's API path, offline apart from forwarding to api.anthropic.com.",
+    size: "150 MB",
+    source: { locked: "uv", package: "headroom-ai", version: HEADROOM_VERSION },
+    exe: "headroom.exe",
+    service: true,
+    plugsInto: "Claude Code: the sandbox starts the proxy and points Claude Code at it (managed settings)",
+    userOnly: true
+  },
+  {
+    id: "ccusage",
+    name: "ccusage",
+    category: "agents",
+    about: "Reports the agents' token use and cost by day, month or session from their logs in the sandbox (`ccusage daily`; add --offline to skip fetching prices).",
+    size: "5 MB",
+    source: { locked: "npm", package: "ccusage", version: CCUSAGE_VERSION },
+    exe: "ccusage.cmd",
+    cli: true,
+    plugsInto: "Reads Claude Code's session logs in the sandbox; changes nothing",
+    userOnly: true
+  },
+  {
+    id: "playwright-mcp",
+    name: "Playwright MCP",
+    category: "agents",
+    about: "Lets Claude Code drive a browser (Microsoft Edge, already in the sandbox) to open pages, click, fill forms and take screenshots: the MCP server of microsoft/playwright-mcp.",
+    size: "20 MB",
+    source: { locked: "npm", package: "@playwright/mcp", version: PLAYWRIGHT_MCP_VERSION },
+    exe: "playwright-mcp.cmd",
+    service: true,
+    mcp: { name: "sbx-playwright", script: "node_modules/@playwright/mcp/cli.js", args: ["--browser", "msedge"] },
+    plugsInto: "Claude Code as the MCP server sbx-playwright (the sandbox's Claude settings)",
+    userOnly: true
+  },
+  {
+    id: "context7",
+    name: "Context7 MCP",
+    category: "agents",
+    about: "Up-to-date documentation and code examples for libraries, looked up by Claude Code while it works (upstash/context7). The library names and questions go to Upstash's context7.com.",
+    size: "55 MB",
+    source: { locked: "npm", package: "@upstash/context7-mcp", version: CONTEXT7_MCP_VERSION },
+    exe: "context7-mcp.cmd",
+    service: true,
+    mcp: { name: "sbx-context7", script: "node_modules/@upstash/context7-mcp/dist/index.js" },
+    plugsInto: "Claude Code as the MCP server sbx-context7 (the sandbox's Claude settings)",
+    userOnly: true
+  },
+  {
+    id: "claude-mem",
+    name: "claude-mem",
+    category: "agents",
+    about: "Persistent memory for Claude Code (a plugin you install on this PC): its database is brought into the sandbox.",
+    size: "",
+    source: { resolve: "setting" },
+    exe: "",
+    setting: "claudeProfile.syncClaudeMem",
+    plugsInto: "Claude Code, with your Claude settings copied from this PC",
+    userOnly: true
+  },
+  {
+    id: "rea",
+    name: "REA (Reverse Engineer Anything)",
+    category: "agents",
+    about: "Agent-driven reverse engineering (MCP server and CLI, by morluto). Run `rea setup` once to add it to Claude Code and Codex. Native binaries need Ghidra; needs Node 22.19+.",
+    size: "8 MB",
+    source: { npm: "rea-agents" },
+    exe: "rea.cmd",
+    cli: true,
+    plugsInto: "Claude Code and Codex as an MCP server, after `rea setup`"
+  },
   // ---- editors
   {
     id: "vscode",
@@ -26213,16 +26311,6 @@ var APPS = [
     cli: true
   },
   // ---- reverse engineering
-  {
-    id: "rea",
-    name: "REA (Reverse Engineer Anything)",
-    category: "reversing",
-    about: "Agent-driven reverse engineering (MCP server and CLI, by morluto). Run `rea setup` once to add it to Claude Code and Codex. Native binaries need Ghidra; needs Node 22.19+.",
-    size: "8 MB",
-    source: { npm: "rea-agents" },
-    exe: "rea.cmd",
-    cli: true
-  },
   {
     id: "ghidra",
     name: "Ghidra",
@@ -26502,6 +26590,8 @@ var APPS = [
 // src/core/schema/apps.ts
 var CATALOGUE_IDS = APPS.filter((a) => !a.setting).map((a) => a.id);
 var AppIdSchema = external_exports.enum(CATALOGUE_IDS);
+var PROJECT_IDS = APPS.filter((a) => !a.setting && !a.userOnly).map((a) => a.id);
+var ProjectAppIdSchema = external_exports.enum(PROJECT_IDS);
 var CustomAppIdSchema = external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,40}$/, "lower-case letters, digits and - only");
 var compiles = (pattern) => {
   try {
@@ -26525,6 +26615,11 @@ var CustomAppSchema = external_exports.strictObject({
 }).refine((a) => a.github && a.asset ? !a.url : Boolean(a.url) && !a.github && !a.asset, {
   message: "give github + asset, or url (not both)"
 });
+var ProjectAppsSchema = external_exports.strictObject({
+  install: external_exports.array(ProjectAppIdSchema).describe(
+    "Apps from the catalogue this project adds to yours (agent add-ons such as rtk, Headroom and the MCP servers are set in your own settings only)."
+  )
+});
 var AppsSchema = external_exports.strictObject({
   install: external_exports.array(AppIdSchema).describe(
     "Apps from the catalogue to install in every sandbox (the Apps screen in the menu lists them by category). Each is downloaded once and kept."
@@ -26689,8 +26784,8 @@ var LocalOverridesSchema = external_exports.strictObject({
   attach: AttachSchema.partial(),
   personalization: toggle("Copy your desktop look into the sandbox.").partial(),
   // Catalogue apps only (a vetted list): your own programs (apps.custom) download anything, so a repo cannot add
-  // them.
-  apps: AppsSchema.pick({ install: true }).partial(),
+  // them, nor agent add-ons that are yours only (rtk hooks every agent command, Headroom sits in its API path).
+  apps: ProjectAppsSchema.partial(),
   claudeProfile: ClaudeProfileSchema.pick({
     enabled: true,
     overwrite: true,