windows-development-sandbox 1.11.7 → 1.13.0

package/dist/host/guard/agent-files.js

@@ -17,8 +17,11 @@ const CLAUDE_RISKY_KEYS = [
     'enableAllProjectMcpServers',
     'enabledMcpjsonServers',
     'disableAllHooks',
+    // Plugins bring their own hooks and MCP servers.
+    'enabledPlugins',
+    'extraKnownMarketplaces',
 ];
-const VSCODE_RISKY_KEY = /path|executable|command|interpreter|shell|profile|args|env|exec|program|server|launch|runtime|binary/i;
+const VSCODE_RISKY_KEY = /path|executable|command|interpreter|shell|profile|args|env|exec|program|server|launch|runtime|binary|alternatetools|home|goroot|tsdk|sdk/i;
 const MAX_AGENT_FILE_BYTES = 1024 * 1024;
 function claudeRisk(d) {
     const s = (_.isPlainObject(d) ? d : {});
@@ -26,6 +29,9 @@ function claudeRisk(d) {
     return {
         ..._.pick(s, CLAUDE_RISKY_KEYS),
         permissions: _.pick(permissions, ['defaultMode', 'additionalDirectories']),
+        // A whole-tool rule ("Bash", "Bash(*)") lets Claude Code on this PC run any command without asking; narrow rules
+        // (Bash(npm test), what "always allow" writes) are ordinary edits.
+        broadAllow: (Array.isArray(permissions.allow) ? permissions.allow : []).filter((r) => typeof r !== 'string' || !r.includes('(') || /\(\s*:?\*\s*\)\s*$/.test(r)),
     };
 }
 /**

package/dist/host/guard/commands.js

@@ -1,5 +1,15 @@
 import { filesIn } from './file-hash.js';
 import { quarantine } from './quarantine.js';
+/** What cmd runs from the current folder: a fixed list plus this PC's PATHEXT (the Python installer adds .PY, .PYW). */
+const EXTENSIONS = [
+    ...new Set([
+        ...['exe', 'com', 'bat', 'cmd', 'vbs', 'vbe', 'js', 'jse', 'wsf', 'wsh', 'msc', 'ps1', 'cpl'],
+        ...(process.env.PATHEXT ?? '')
+            .split(';')
+            .map((e) => e.replace(/^\./, '').toLowerCase())
+            .filter((e) => /^[a-z0-9]{1,8}$/.test(e)),
+    ]),
+];
 /** Names you are likely to run in a project folder; with any of these extensions Windows would pick the local copy. */
 export const COMMANDS = new RegExp('^(' +
     [
@@ -108,7 +118,9 @@ export const COMMANDS = new RegExp('^(' +
         'ssh',
         'scp',
     ].join('|') +
-    ')\\.(exe|com|bat|cmd|vbs|vbe|js|jse|wsf|wsh|msc|ps1)$', 'i');
+    ')\\.(' +
+    EXTENSIONS.join('|') +
+    ')$', 'i');
 /** Fingerprints of the files in the project root named like one of COMMANDS. */
 export function plantedCommands(workspace) {
     return filesIn(workspace, (n) => COMMANDS.test(n));

package/dist/host/guard/git-config.js

@@ -5,13 +5,28 @@ import _ from 'lodash';
 import { writeFileAtomic } from '../../shared/io/index.js';
 import { fileExists, isLink } from '../../core/util/index.js';
 /** Config keys that make git run a program, or load more config. */
-const DANGEROUS_KEY = /^(fsmonitor|hookspath|sshcommand|pager|editor|askpass|program|gpgprogram|textconv|command|cmd|clean|smudge|process|driver|helper|uploadpack|receivepack|path|attributesfile|excludesfile|worktree|worktreeconfig|gitproxy|proxycommand|sendemailvalidate|tool|external|difffilter|defaultkeycommand|alternaterefscommand)\s*=/i;
-const SECTION = /^\s*\[([^\]]*)\]\s*/;
+const DANGEROUS_KEY = /^(fsmonitor|hookspath|sshcommand|pager|editor|askpass|program|gpgprogram|textconv|command|cmd|tocmd|cccmd|smtpserver|httpd|vcs|packobjectshook|clean|smudge|process|driver|helper|uploadpack|receivepack|path|attributesfile|excludesfile|worktree|worktreeconfig|gitproxy|proxycommand|sendemailvalidate|tool|external|difffilter|defaultkeycommand|alternaterefscommand)\s*(=|$)/i;
+/**
+ * A section header as git reads it: a name (the old [section.sub] form included), then an optional quoted subsection
+ * in which `]` and escaped quotes are allowed ([filter "a]b"] must not hide the key after it).
+ */
+const SECTION = /^\s*\[\s*([A-Za-z0-9.-]+)(\s+"(?:[^"\\]|\\.)*")?\s*\]\s*/;
+/** Sections where any key is risky: [protocol] turns on transports that run commands (ext::), [url] rewrites URLs. */
+const RISKY_SECTIONS = new Set(['pager', 'protocol', 'url']);
 const MARK = '# [agent-sandbox] disabled, added inside the sandbox: ';
 const MAX_CONFIG_BYTES = 4 * 1024 * 1024;
-/** Sections where any key runs a program ([pager] log = x), or where a "!" value does ([alias] st = !x). */
+/**
+ * Sections where any key runs a program ([pager] log = x), where a "!" value does ([alias] st = !x, also quoted or on a
+ * continued line: every new alias line with a "!" counts), or a "!" submodule update command.
+ */
 function dangerousInSection(section, keyPart) {
-    return (section === 'pager' && keyPart.includes('=')) || (section === 'alias' && /^[^=]+=\s*"?\s*!/.test(keyPart));
+    if (keyPart === '' || /^[#;]/.test(keyPart))
+        return false;
+    if (RISKY_SECTIONS.has(section))
+        return true;
+    if (section === 'alias')
+        return keyPart.includes('!');
+    return section === 'submodule' && /^update\s*=/i.test(keyPart) && keyPart.includes('!');
 }
 /** The lines of <dir>\config (none for a link or a file over 4 MB). */
 export function configLines(dir) {
@@ -30,16 +45,21 @@ export function disableConfig(dir, before) {
     let section = '';
     const fixed = lines.map((line) => {
         const header = SECTION.exec(line);
+        // A line that starts like a header but is not one git would accept: treat it as unknown (risky) below.
+        const badHeader = !header && /^\s*\[/.test(line);
         if (header) {
-            section = header[1].trim().toLowerCase().split(/\s/)[0];
-            inInclude = /^include(if\s+"[^"]*")?$/i.test(header[1].trim());
+            section = header[1].toLowerCase().split('.')[0];
+            inInclude = section === 'include' || section === 'includeif';
         }
         seen[line] = (seen[line] ?? 0) + 1;
         if (line.startsWith(MARK) || seen[line] <= (known[line] ?? 0))
             return line;
         // git also accepts "[core] fsmonitor = x" on one line, so look past a leading section header.
         const keyPart = line.replace(SECTION, '').trim();
-        if (!(DANGEROUS_KEY.test(keyPart) || (inInclude && keyPart.includes('=')) || dangerousInSection(section, keyPart)))
+        if (!(badHeader ||
+            DANGEROUS_KEY.test(keyPart) ||
+            (inInclude && keyPart.includes('=')) ||
+            dangerousInSection(section, keyPart)))
             return line;
         findings.push({ kind: 'config', detail: line.trim() });
         return MARK + line.trim();

package/dist/host/guard/git-dirs.js

@@ -1,22 +1,84 @@
 // A git folder's hooks, config and redirect files, and the rule that guards the project's own .git.
 import fs from 'node:fs';
 import path from 'node:path';
-import { dirExists, isLink } from '../../core/util/index.js';
+import { dirExists, isInsideOrEqual, isLink } from '../../core/util/index.js';
 import { filesIn } from './file-hash.js';
 import { configLines, disableConfig } from './git-config.js';
 import { quarantine } from './quarantine.js';
 /** Files in .git that make git read config/hooks from somewhere else. */
 const REDIRECTS = ['commondir', 'config.worktree'];
 const isHook = (name) => !name.endsWith('.sample');
-export const EMPTY_GIT = { config: [], hooks: {}, redirects: [] };
+export const EMPTY_GIT = { config: [], hooks: {}, redirects: [], pathHooks: {} };
+/** The names git runs as hooks (a core.hooksPath folder inside the project holds other files too). */
+const HOOK_NAMES = new Set([
+    'applypatch-msg',
+    'pre-applypatch',
+    'post-applypatch',
+    'pre-commit',
+    'pre-merge-commit',
+    'prepare-commit-msg',
+    'commit-msg',
+    'post-commit',
+    'pre-rebase',
+    'post-checkout',
+    'post-merge',
+    'pre-push',
+    'pre-receive',
+    'update',
+    'proc-receive',
+    'post-receive',
+    'post-update',
+    'reference-transaction',
+    'push-to-checkout',
+    'pre-auto-gc',
+    'post-rewrite',
+    'sendemail-validate',
+    'fsmonitor-watchman',
+    'p4-changelist',
+    'p4-prepare-changelist',
+    'p4-post-changelist',
+    'p4-pre-submit',
+    'post-index-change',
+]);
+/**
+ * Folders inside the work tree that the repo's own core.hooksPath points at (husky: .husky/_, whose stubs run the
+ * hooks in .husky/). The sandbox can write them, and git on this PC runs them at the next commit.
+ */
+function hooksPathDirs(dir, config) {
+    if (path.basename(dir).toLowerCase() !== '.git')
+        return [];
+    const workTree = path.dirname(dir);
+    let section = '';
+    let value = null;
+    for (const line of config) {
+        const header = /^\s*\[\s*([A-Za-z0-9.-]+)/.exec(line);
+        if (header)
+            section = header[1].toLowerCase();
+        const pair = /^\s*(?:\[[^\]]*\]\s*)?hookspath\s*=\s*"?([^"]*?)"?\s*$/i.exec(line);
+        if (pair && section === 'core')
+            value = pair[1];
+    }
+    if (!value || value.startsWith('~'))
+        return [];
+    const target = path.resolve(workTree, value);
+    if (!isInsideOrEqual(workTree, target) || !dirExists(target) || isLink(target))
+        return [];
+    return path.basename(target) === '_' ? [target, path.dirname(target)] : [target];
+}
+const hooksIn = (dirs, workTree) => Object.fromEntries(dirs.flatMap((d) => Object.entries(filesIn(d, (n) => HOOK_NAMES.has(n))).map(([n, h]) => [
+    path.relative(workTree, path.join(d, n)),
+    h,
+])));
 /** <workspace>\.git when it is a real folder (not a link or a "gitdir:" file). */
 export function plainGitDir(workspace) {
     const dir = path.join(workspace, '.git');
     return dirExists(dir) && !isLink(dir) ? dir : null;
 }
 export function gitState(dir) {
+    const config = dir ? configLines(dir) : [];
     return {
-        config: dir ? configLines(dir) : [],
+        config,
+        pathHooks: dir ? hooksIn(hooksPathDirs(dir, config), path.dirname(dir)) : {},
         hooks: dir ? filesIn(path.join(dir, 'hooks'), isHook) : {},
         redirects: dir ? REDIRECTS.filter((n) => fs.existsSync(path.join(dir, n))) : [],
     };
@@ -29,8 +91,21 @@ export function guardGitDir(dir, before) {
         ...quarantine(hooksDir, Object.keys(hooksNow).filter((n) => before.hooks[n] !== hooksNow[n]), dir, 'hook'),
         ...quarantine(dir, REDIRECTS.filter((n) => fs.existsSync(path.join(dir, n)) && !before.redirects.includes(n)), dir, 'git'),
         ...disableConfig(dir, before.config),
+        ...guardPathHooks(dir, before),
     ];
 }
+/** New or changed hooks in a core.hooksPath folder inside the project (not checked against older snapshots). */
+function guardPathHooks(dir, before) {
+    if (!before.pathHooks)
+        return [];
+    const workTree = path.dirname(dir);
+    const now = hooksIn(hooksPathDirs(dir, before.config), workTree);
+    const changed = Object.keys(now).filter((rel) => before.pathHooks?.[rel] !== now[rel]);
+    return changed.flatMap((rel) => quarantine(path.dirname(path.join(workTree, rel)), [path.basename(rel)], dir, 'hook').map((f) => ({
+        ...f,
+        detail: rel + ' (core.hooksPath): ' + f.detail,
+    })));
+}
 /** The project's own .git; a .git replaced by a link or a "gitdir:" file is reported, never followed. */
 export class GitDirRule {
     kind = 'git-dir';

package/dist/host/guard/mark-of-the-web.js

@@ -15,7 +15,9 @@ export function markFromSandbox(file) {
         return false;
     try {
         const stat = fs.lstatSync(file);
-        if (!stat.isFile())
+        // Already marked: writing the mark again would fire another change event for this file, so every marked file was
+        // marked (and reported) again every second for as long as the sandbox ran.
+        if (!stat.isFile() || isMarked(file))
             return false;
         fs.writeFileSync(file + ':Zone.Identifier', MARK);
         return true;

package/dist/host/guard/nested-repos.js

@@ -16,6 +16,7 @@ const SKIP_DIRS = new Set([
     '.venv',
     'venv',
 ]);
+const NEVER_CHECKED = new Set(['node_modules', '.git', 'agent-sandbox-quarantine']);
 const notSkipped = (d) => !SKIP_DIRS.has(path.basename(d).toLowerCase());
 function plainDirs(dir, limit) {
     try {
@@ -57,8 +58,12 @@ export function otherGitDirs(workspace) {
     };
     if (main)
         walk(path.join(main, 'modules'), 0);
-    for (const sub of plainDirs(workspace, 500).filter(notSkipped)) {
-        for (const candidate of [sub, ...plainDirs(sub, 200).filter(notSkipped)]) {
+    // A repository directly in build\, dist\, bin\ ... is still one VS Code's repository scan opens (it skips only
+    // node_modules), so those folders are checked themselves; only their insides are skipped.
+    const neverChecked = (d) => NEVER_CHECKED.has(path.basename(d).toLowerCase());
+    for (const sub of plainDirs(workspace, 500).filter((d) => !neverChecked(d))) {
+        const inside = notSkipped(sub) ? plainDirs(sub, 200).filter(notSkipped) : [];
+        for (const candidate of [sub, ...inside]) {
             if (found.length >= MAX_OTHER_REPOS)
                 return found;
             const git = plainGitDir(candidate);

package/dist/host/guard/store.js

@@ -18,6 +18,7 @@ const GitStateSchema = z.object({
     config: z.array(z.string()),
     hooks: z.record(z.string(), z.string()),
     redirects: z.array(z.string()),
+    pathHooks: z.record(z.string(), z.string()).optional(),
 });
 const SavedSchema = z.object({
     workspace: z

package/dist/host/guard/types.d.ts

@@ -6,6 +6,8 @@ export interface GitState {
     readonly config: string[];
     readonly hooks: Record<string, string>;
     readonly redirects: string[];
+    /** Hooks in a core.hooksPath folder inside the project, by relative path (missing in older snapshots). */
+    readonly pathHooks?: Record<string, string>;
 }
 export interface RepoSnapshot extends GitState {
     readonly gitDir: boolean;

package/dist/host/launch/mappings.js

@@ -9,6 +9,7 @@ import { deriveGuest, isValidGuestPath, guestConflict, guestFix, PROJECTS_GUEST,
 import { dataMapping } from '../storage/providers/index.js';
 import { GUEST } from './wsb-file.js';
 import { guestGitDir, planView } from '../workspace-view/index.js';
+import { insideProject } from '../../core/local-config/index.js';
 /**
  * Every mapping, placed. An extra folder appears at its `guest` path, or at the same path as on this PC when it has
  * none. A folder that cannot appear there (a reserved or relative path, one already in use, a folder that is not
@@ -72,6 +73,15 @@ export function collectMappings(o, launchPath, boot = { roots: [], projects: [],
                 '.');
             continue;
         }
+        // A second mapping of (part of) the project would show it without the filter (the git-ignored .env files) and
+        // writable when the project is read-only: a repo's .sandbox-config.json must not undo either.
+        const inProject = insideProject(workspaceHost, host);
+        if (inProject && view) {
+            problems.push(host +
+                ': it is inside the project, and workspaceFilter.enabled keeps git-ignored files out of the sandbox. Fix: remove the mapping, or turn the filter off in your own settings.');
+            continue;
+        }
+        const readOnly = m.readOnly || (inProject && config.readOnly);
         const wanted = tidyGuestPath(m.guest ?? deriveGuest(host, workspaceHost, config.guestWorkspace));
         // The same folder at the same place twice (your settings and the project file): once is enough.
         if (extra.some((x) => x.host.toLowerCase() === host.toLowerCase() && x.guest.toLowerCase() === wanted.toLowerCase()))
@@ -82,7 +92,7 @@ export function collectMappings(o, launchPath, boot = { roots: [], projects: [],
             continue;
         }
         const label = outside.has(path.resolve(host).toLowerCase()) ? 'outside the project, allowed' : undefined;
-        extra.push({ host, guest: wanted, readOnly: m.readOnly, ...(label ? { label } : {}) });
+        extra.push({ host, guest: wanted, readOnly, ...(label ? { label } : {}) });
     }
     if (problems.length)
         fail((problems.length === 1

package/dist/host/launch/project-scan.js

@@ -2,30 +2,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { INTERESTING_FILE } from '../../core/detect/index.js';
+import { readSmallFile } from '../../core/util/index.js';
 const SKIP = /^(node_modules|\.git|\.hg|\.svn|vendor|target|bin|obj|dist|build|out|\.next|\.nuxt|\.venv|venv|env|__pycache__|\.gradle|\.idea|\.vs|coverage|packages)$/i;
 const MAX_FILES = 400;
 const MAX_BYTES = 256 * 1024;
 const MAX_FOLDERS = 2000;
-/** Reads a file through one handle, only if that handle is a regular file of at most MAX_BYTES. */
-function readSmallFile(file) {
-    let fd = null;
-    try {
-        fd = fs.openSync(file, 'r');
-        const stat = fs.fstatSync(fd);
-        if (!stat.isFile() || stat.size > MAX_BYTES)
-            return null;
-        const buffer = Buffer.alloc(stat.size);
-        fs.readSync(fd, buffer, 0, stat.size, 0);
-        return buffer.toString('utf8');
-    }
-    catch {
-        return null;
-    }
-    finally {
-        if (fd !== null)
-            fs.closeSync(fd);
-    }
-}
 /** Manifest-type files in the project, up to 3 folders deep. Links are not followed (the guest may have written it). */
 export function readProjectFiles(root, depth = 3) {
     const files = [];
@@ -45,7 +26,7 @@ export function readProjectFiles(root, depth = 3) {
                 return;
             const full = path.join(dir, entry.name);
             if (entry.isFile() && INTERESTING_FILE.test(entry.name)) {
-                const text = readSmallFile(full);
+                const text = readSmallFile(full, MAX_BYTES);
                 if (text !== null)
                     files.push({ path: path.relative(root, full), text });
             }

package/dist/host/launch/stage.js

@@ -17,12 +17,16 @@ export function stageHooks(packageRoot, launchPath, scripts) {
     }
     stageScripts(path.join(launchPath, 'hooks', 'pre-agent'), scripts);
 }
+const MAX_SCRIPT_BYTES = 4 * 1024 * 1024;
 /** --script / "scripts" files, run before the agent in this order. */
 export function stageScripts(target, scripts) {
     ensureDir(target);
     scripts.forEach((script, index) => {
         if (!fileExists(script))
             fail('Script file not found: ' + script, 'Check the --script path.');
+        const stat = fs.statSync(script);
+        if (!stat.isFile() || stat.size > MAX_SCRIPT_BYTES)
+            fail('Script ' + script + ' is not a plain file of at most 4 MB.', 'Check the --script path.');
         fs.copyFileSync(script, path.join(target, '90-extra-' + index + '-' + path.basename(script)));
     });
 }

package/dist/host/life/session-ledger.js

@@ -106,7 +106,8 @@ export class SessionLedger {
         const mapped = [...registry.projects, ...registry.roots];
         const before = new Map(ledger.sessions.map((s) => [key(s), s]));
         const noted = sessions
-            .filter((s) => s.phase === 'running')
+            // A shell is not reopened: what it was doing is gone with the sandbox.
+            .filter((s) => s.phase === 'running' && s.kind !== 'shell')
             .flatMap((s) => {
             const project = projectForGuestDir(mapped, s.cwd);
             if (!project)

package/dist/host/remote/access-store.d.ts

@@ -0,0 +1,156 @@
+import { z } from 'zod';
+import type { RemoteRole } from '../../core/schema/web.js';
+import type { SecretStore } from '../secrets/index.js';
+/** A device code is good for this long. */
+export declare const CODE_LIFETIME_MS: number;
+/** A code that has seen this many wrong tries is void (the PC says so). */
+export declare const CODE_MAX_WRONG = 10;
+/** Most devices and Windows sign-ins kept (the oldest go first). */
+export declare const MAX_DEVICES = 50;
+export declare const MAX_WINDOWS_GRANTS = 100;
+export declare const DeviceSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    role: z.ZodEnum<{
+        view: "view";
+        control: "control";
+    }>;
+    address: z.ZodString;
+    createdAt: z.ZodString;
+    expiresAt: z.ZodString;
+    lastSeen: z.ZodOptional<z.ZodString>;
+    tokenHash: z.ZodString;
+}, z.core.$strict>;
+export type Device = z.output<typeof DeviceSchema>;
+export declare const WindowsGrantSchema: z.ZodObject<{
+    id: z.ZodString;
+    sid: z.ZodString;
+    user: z.ZodString;
+    createdAt: z.ZodString;
+    expiresAt: z.ZodString;
+    tokenHash: z.ZodString;
+}, z.core.$strict>;
+export type WindowsGrant = z.output<typeof WindowsGrantSchema>;
+export declare const PendingCodeSchema: z.ZodObject<{
+    hash: z.ZodString;
+    role: z.ZodEnum<{
+        view: "view";
+        control: "control";
+    }>;
+    createdAt: z.ZodString;
+    expiresAt: z.ZodString;
+    wrong: z.ZodNumber;
+}, z.core.$strict>;
+export type PendingCode = z.output<typeof PendingCodeSchema>;
+export declare const AccessDataSchema: z.ZodObject<{
+    epoch: z.ZodNumber;
+    devices: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodEnum<{
+            view: "view";
+            control: "control";
+        }>;
+        address: z.ZodString;
+        createdAt: z.ZodString;
+        expiresAt: z.ZodString;
+        lastSeen: z.ZodOptional<z.ZodString>;
+        tokenHash: z.ZodString;
+    }, z.core.$strict>>;
+    windows: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        sid: z.ZodString;
+        user: z.ZodString;
+        createdAt: z.ZodString;
+        expiresAt: z.ZodString;
+        tokenHash: z.ZodString;
+    }, z.core.$strict>>;
+    code: z.ZodNullable<z.ZodObject<{
+        hash: z.ZodString;
+        role: z.ZodEnum<{
+            view: "view";
+            control: "control";
+        }>;
+        createdAt: z.ZodString;
+        expiresAt: z.ZodString;
+        wrong: z.ZodNumber;
+    }, z.core.$strict>>;
+    network: z.ZodNullable<z.ZodString>;
+    codeVoided: z.ZodBoolean;
+}, z.core.$strict>;
+export type AccessData = z.output<typeof AccessDataSchema>;
+export declare const EMPTY_ACCESS: AccessData;
+/** SHA-256 of a code or token, hex. */
+export declare function secretHash(value: string): string;
+/** A new code: 8 characters (40 bits), shown as ABCD-EFGH. */
+export declare function newCode(random?: (n: number) => Buffer): string;
+/** ABCDEFGH -> ABCD-EFGH. */
+export declare function showCode(code: string): string;
+/** What a person typed, as a code: upper case, no dashes or spaces, O as 0, I or L as 1; null when it is not one. */
+export declare function normalizeCode(typed: unknown): string | null;
+/** A credential as the cookie carries it: `<id>.<token>`. */
+export declare function credentialValue(id: string, token: string): string;
+/** `<16 hex>.<64 hex>`, or null. */
+export declare function parseCredential(value: string | undefined): {
+    id: string;
+    token: string;
+} | null;
+export type RedeemResult = {
+    readonly ok: true;
+    readonly device: Device;
+    readonly credential: string;
+} | {
+    readonly ok: false;
+    readonly reason: 'none' | 'wrong' | 'expired' | 'void';
+};
+export interface AccessStoreOptions {
+    readonly now?: () => number;
+    readonly random?: (n: number) => Buffer;
+    /** Makes the folder private (the web state folder already is; tests pass a no-op). */
+    readonly protect?: (dir: string) => void;
+}
+export declare class AccessStore {
+    readonly dir: string;
+    private readonly secrets;
+    private readonly options;
+    private readonly file;
+    private cache;
+    private readonly now;
+    private readonly random;
+    constructor(dir: string, secrets: SecretStore, options?: AccessStoreOptions);
+    /** <storage>\web. */
+    static at(storageRoot: string, secrets: SecretStore, options?: AccessStoreOptions): AccessStore;
+    private stamp;
+    /** The list as it is now (read again only when the file changed). A damaged or foreign file counts as empty. */
+    read(): AccessData;
+    private write;
+    /** Changes the list (expired credentials are dropped on the way). */
+    update(change: (data: AccessData) => AccessData): AccessData;
+    private iso;
+    private alive;
+    private withoutExpired;
+    private newId;
+    private newToken;
+    /** A new device code for this role (replaces a pending one). Returns the code; only its hash is kept. */
+    newDeviceCode(role: RemoteRole): {
+        code: string;
+        expiresAt: string;
+    };
+    /** Whether a code is pending (attempts with none pending are not counted anywhere). */
+    codePending(): boolean;
+    /** Trades the pending code for a new device credential (one use); counts a wrong code. */
+    redeem(typed: unknown, name: string, address: string, rememberDays: number): RedeemResult;
+    /** The device a cookie value stands for: known id, same token, not expired. */
+    device(value: string | undefined): Device | null;
+    /** Notes when a device was last seen (at most every 10 minutes per device: each write seals the list again). */
+    seen(id: string): void;
+    /** A credential for a Windows user (after the pipe sign-in): the cookie value. */
+    issueWindows(sid: string, user: string, rememberDays: number): string;
+    windowsGrant(value: string | undefined): WindowsGrant | null;
+    /** Ends one device or Windows sign-in; false when there is no such id. */
+    revoke(id: string): boolean;
+    /** Ends every device (and, unless only devices are asked for, every Windows sign-in); voids the pending code. */
+    revokeAll(what?: 'devices' | 'everything'): void;
+    /** Remembers which network LAN mode was turned on for (null: forget it). */
+    setNetwork(network: string | null): void;
+}