windows-development-sandbox 1.11.7 → 1.13.0

package/dist/runtime/daemon.js

@@ -25560,14 +25560,19 @@ var NetworkSchema = external_exports.strictObject({
 });
 var AuditSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "Keep an audit log on this PC of what happened in your sandboxes: programs started (with their command lines), files changed in the project, sessions, and what the repo guard caught. The sandbox cannot change it. Read it with sandbox audit."
+    "Keep an audit log on this PC of what your agents did: programs started (with their command lines, secrets hidden), files changed in the projects, git commits, sessions, and what the repo guard caught, each linked to the agent session that did it where that can be known. The sandbox cannot change it. Read it with sandbox audit or on the Activity page."
+  ),
+  days: external_exports.number().int().min(1).max(365).describe(
+    "Days the audit log is kept (1 to 30; a larger number keeps 30); older days are deleted when a sandbox starts and once a day."
   ),
-  days: external_exports.number().int().min(1).max(365).describe("Days the audit log is kept."),
   maxMb: external_exports.number().int().min(5).max(5e3).describe("Most space the audit log may take, in MB (older days go first). Days before today are compressed."),
   processes: external_exports.boolean().describe(
     "Record every program started in the sandbox with its command line (Windows process auditing; repeated runs are counted, not listed)."
   ),
-  files: external_exports.boolean().describe("Record the files changed in the project while the sandbox runs.")
+  files: external_exports.boolean().describe("Record the files changed in the projects while the sandbox runs."),
+  commits: external_exports.boolean().describe(
+    "Record the git commits made in the projects while the sandbox runs (read from each project's .git folder on this PC)."
+  )
 });
 var WorkspaceFilterSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
@@ -25770,7 +25775,100 @@ var ToolchainsSchema = external_exports.strictObject({
 
 // src/shared/apps/catalogue.ts
 var gh = (github, asset) => ({ github, asset });
+var RTK_VERSION = "1.0.1";
+var RTK_URL = "https://github.com/rtk-ai/rtk/releases/download/v" + RTK_VERSION + "/rtk-oss-x86_64-pc-windows-msvc.zip";
+var RTK_SHA256 = "0e53e2eca471e15fbd3636e64e6bc0b182cbc278ed0339c80450a2dd03f4cd6b";
+var HEADROOM_VERSION = "0.41.0";
+var CCUSAGE_VERSION = "20.0.36";
+var PLAYWRIGHT_MCP_VERSION = "0.0.83";
+var CONTEXT7_MCP_VERSION = "4.4.2";
 var APPS = [
+  // ---- agent add-ons
+  {
+    id: "rtk",
+    name: "rtk (Rust Token Killer)",
+    category: "agents",
+    about: "Compacts the output of shell commands (git, tests, builds, ls ...) before the agent reads it, so it uses fewer tokens. Claude Code's Bash commands go through it on their own.",
+    size: "6 MB",
+    source: { url: RTK_URL, sha256: RTK_SHA256 },
+    exe: "rtk.exe",
+    cli: true,
+    plugsInto: "Claude Code through a hook in the sandbox's managed settings; other agents are told to use it",
+    userOnly: true
+  },
+  {
+    id: "headroom",
+    name: "Headroom",
+    category: "agents",
+    about: "Compresses what Claude Code sends to the model (tool output, logs, files) so it uses fewer tokens: a local proxy on 127.0.0.1:8787 that sits in Claude Code's API path, offline apart from forwarding to api.anthropic.com.",
+    size: "150 MB",
+    source: { locked: "uv", package: "headroom-ai", version: HEADROOM_VERSION },
+    exe: "headroom.exe",
+    service: true,
+    plugsInto: "Claude Code: the sandbox starts the proxy and points Claude Code at it (managed settings)",
+    userOnly: true
+  },
+  {
+    id: "ccusage",
+    name: "ccusage",
+    category: "agents",
+    about: "Reports the agents' token use and cost by day, month or session from their logs in the sandbox (`ccusage daily`; add --offline to skip fetching prices).",
+    size: "5 MB",
+    source: { locked: "npm", package: "ccusage", version: CCUSAGE_VERSION },
+    exe: "ccusage.cmd",
+    cli: true,
+    plugsInto: "Reads Claude Code's session logs in the sandbox; changes nothing",
+    userOnly: true
+  },
+  {
+    id: "playwright-mcp",
+    name: "Playwright MCP",
+    category: "agents",
+    about: "Lets Claude Code drive a browser (Microsoft Edge, already in the sandbox) to open pages, click, fill forms and take screenshots: the MCP server of microsoft/playwright-mcp.",
+    size: "20 MB",
+    source: { locked: "npm", package: "@playwright/mcp", version: PLAYWRIGHT_MCP_VERSION },
+    exe: "playwright-mcp.cmd",
+    service: true,
+    mcp: { name: "sbx-playwright", script: "node_modules/@playwright/mcp/cli.js", args: ["--browser", "msedge"] },
+    plugsInto: "Claude Code as the MCP server sbx-playwright (the sandbox's Claude settings)",
+    userOnly: true
+  },
+  {
+    id: "context7",
+    name: "Context7 MCP",
+    category: "agents",
+    about: "Up-to-date documentation and code examples for libraries, looked up by Claude Code while it works (upstash/context7). The library names and questions go to Upstash's context7.com.",
+    size: "55 MB",
+    source: { locked: "npm", package: "@upstash/context7-mcp", version: CONTEXT7_MCP_VERSION },
+    exe: "context7-mcp.cmd",
+    service: true,
+    mcp: { name: "sbx-context7", script: "node_modules/@upstash/context7-mcp/dist/index.js" },
+    plugsInto: "Claude Code as the MCP server sbx-context7 (the sandbox's Claude settings)",
+    userOnly: true
+  },
+  {
+    id: "claude-mem",
+    name: "claude-mem",
+    category: "agents",
+    about: "Persistent memory for Claude Code (a plugin you install on this PC): its database is brought into the sandbox.",
+    size: "",
+    source: { resolve: "setting" },
+    exe: "",
+    setting: "claudeProfile.syncClaudeMem",
+    plugsInto: "Claude Code, with your Claude settings copied from this PC",
+    userOnly: true
+  },
+  {
+    id: "rea",
+    name: "REA (Reverse Engineer Anything)",
+    category: "agents",
+    about: "Agent-driven reverse engineering (MCP server and CLI, by morluto). Run `rea setup` once to add it to Claude Code and Codex. Native binaries need Ghidra; needs Node 22.19+.",
+    size: "8 MB",
+    source: { npm: "rea-agents" },
+    exe: "rea.cmd",
+    cli: true,
+    plugsInto: "Claude Code and Codex as an MCP server, after `rea setup`"
+  },
   // ---- editors
   {
     id: "vscode",
@@ -26232,16 +26330,6 @@ var APPS = [
     cli: true
   },
   // ---- reverse engineering
-  {
-    id: "rea",
-    name: "REA (Reverse Engineer Anything)",
-    category: "reversing",
-    about: "Agent-driven reverse engineering (MCP server and CLI, by morluto). Run `rea setup` once to add it to Claude Code and Codex. Native binaries need Ghidra; needs Node 22.19+.",
-    size: "8 MB",
-    source: { npm: "rea-agents" },
-    exe: "rea.cmd",
-    cli: true
-  },
   {
     id: "ghidra",
     name: "Ghidra",
@@ -26554,13 +26642,39 @@ function appsToInstall(apps, gitAccess) {
   const needs7zip = allowed.some((e) => e.needs?.includes("7zip") || e.unpack === "nsis") && !allowed.some((e) => e.id === "7zip");
   return { entries: [...needs7zip ? [appById("7zip")] : [], ...allowed], skipped };
 }
+function appsNeedUv(apps) {
+  return Boolean(
+    apps?.install.some((id) => {
+      const source = appById(id)?.source;
+      return source !== void 0 && "locked" in source && source.locked === "uv";
+    })
+  );
+}
 function appsNeedMesa(apps) {
   return Boolean(apps?.install.some((id) => appById(id)?.needs?.includes("mesa")));
 }
 
+// src/shared/apps/agent-addons.ts
+var RTK_GUIDE_LINE = "- rtk is on PATH and compacts command output: Claude Code's Bash commands go through it on their own; in other agents prefix shell commands with `rtk` (`rtk git status`, `rtk cargo test`, `rtk ls`).";
+var HEADROOM_PORT = 8787;
+function headroomUrl(port = HEADROOM_PORT) {
+  return "http://127.0.0.1:" + port;
+}
+function headroomGuideLine(logFile2) {
+  return "- Headroom compresses Claude Code's requests: Claude Code reaches the API through its proxy on " + headroomUrl() + " (log: `" + logFile2 + "`). If Claude Code cannot reach the API, the proxy stopped: it starts again with the next sandbox, or turn Headroom off in Apps.";
+}
+function addonGuideLine(mcpNames, ccusage) {
+  return [
+    ...mcpNames.length ? ["- MCP servers in Claude Code from Apps: " + mcpNames.join(", ") + "."] : [],
+    ...ccusage ? ["- ccusage is on PATH: `ccusage daily` (or `monthly`, `session`) reports token use and cost."] : []
+  ];
+}
+
 // src/core/schema/apps.ts
 var CATALOGUE_IDS = APPS.filter((a) => !a.setting).map((a) => a.id);
 var AppIdSchema = external_exports.enum(CATALOGUE_IDS);
+var PROJECT_IDS = APPS.filter((a) => !a.setting && !a.userOnly).map((a) => a.id);
+var ProjectAppIdSchema = external_exports.enum(PROJECT_IDS);
 var CustomAppIdSchema = external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,40}$/, "lower-case letters, digits and - only");
 var compiles = (pattern) => {
   try {
@@ -26584,6 +26698,11 @@ var CustomAppSchema = external_exports.strictObject({
 }).refine((a) => a.github && a.asset ? !a.url : Boolean(a.url) && !a.github && !a.asset, {
   message: "give github + asset, or url (not both)"
 });
+var ProjectAppsSchema = external_exports.strictObject({
+  install: external_exports.array(ProjectAppIdSchema).describe(
+    "Apps from the catalogue this project adds to yours (agent add-ons such as rtk, Headroom and the MCP servers are set in your own settings only)."
+  )
+});
 var AppsSchema = external_exports.strictObject({
   install: external_exports.array(AppIdSchema).describe(
     "Apps from the catalogue to install in every sandbox (the Apps screen in the menu lists them by category). Each is downloaded once and kept."
@@ -26624,12 +26743,39 @@ var ResumeSchema = external_exports.strictObject({
 });
 
 // src/core/schema/web.ts
+var REMOTE_ROLES = ["view", "control"];
+var WindowsUserNameSchema = external_exports.string().trim().min(1).max(120).regex(
+  /^(?:[A-Za-z0-9][A-Za-z0-9._ -]{0,62}\\)?[^\\/"[\]:;|=,+*?<>@]{1,64}$/,
+  "a Windows user name (name or DOMAIN\\name)"
+);
+var RemoteUserSchema = external_exports.strictObject({
+  name: WindowsUserNameSchema.describe("The Windows user (name, or DOMAIN\\name)"),
+  role: external_exports.enum(REMOTE_ROLES).describe("view: sees everything, terminals read-only. control: everything but remote access, logins and tokens.")
+});
+var WebLanSchema = external_exports.strictObject({
+  enabled: external_exports.boolean().describe(
+    "(Beta) Devices on your network (a phone): an HTTPS address on this PC for devices you pair with a one-time code (sandbox web pair). Needs a firewall rule (sandbox web lan on asks Windows once). Off: every paired device is signed out."
+  ),
+  port: external_exports.number().int().min(1024).max(65535).describe("HTTPS port for paired devices on your network."),
+  address: external_exports.string().trim().max(15).regex(/^$|^\d{1,3}(\.\d{1,3}){3}$/, "an IPv4 address or empty").describe("This PC's private address to listen on. Empty: the one of its network adapter (never a public one).")
+});
+var WebRemoteSchema = external_exports.strictObject({
+  windowsSignIn: external_exports.boolean().describe(
+    "(Beta) Other Windows users of this PC named in web.remote.users sign in to your web UI (and sandbox remote) with their own Windows account: no password, no link."
+  ),
+  users: external_exports.array(RemoteUserSchema).max(32).describe("Who else may sign in with Windows, and their role (view or control)."),
+  rememberDays: external_exports.number().int().min(1).max(90).describe(
+    "How many days a paired device or a Windows sign-in stays signed in (from when it signed in, not renewed)."
+  ),
+  lan: WebLanSchema
+});
 var WebSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
     "(Beta) The web UI: your sandbox sessions in a browser on this PC (http://127.0.0.1:<port>, this PC only). On: every sandbox start also starts it in the background (it keeps running until sandbox web stop or a restart of the PC). Off: only sandbox web start runs it. Open it signed in with sandbox web open."
   ),
   port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken."),
-  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts.")
+  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts."),
+  remote: WebRemoteSchema.describe("(Beta) Access for other Windows users of this PC and for paired devices.")
 });
 
 // src/core/schema/vpn.ts
@@ -26659,6 +26805,36 @@ var GithubSchema = external_exports.strictObject({
 });
 
 // src/core/schema/config.ts
+var RESERVED_ENV_PREFIX = /^(AGENT_|GIT_|GH_|GITHUB_|NODE_|NPM_CONFIG_(USERCONFIG|GLOBALCONFIG|PREFIX|SCRIPT_SHELL)|SSL_|CLAUDE|ANTHROPIC_|OPENAI_|CODEX_|GEMINI_|GOOGLE_|COPILOT_|AWS_|AZURE_)/i;
+var RESERVED_ENV_SUFFIX = /(_PROXY|_BASE_URL|_ENDPOINT|_CA_BUNDLE|_CA_CERTS)$/i;
+var RESERVED_ENV_NAMES = new Set(
+  [
+    "PATH",
+    "PATHEXT",
+    "BASH_ENV",
+    "ENV",
+    "COMSPEC",
+    "PSMODULEPATH",
+    "PYTHONPATH",
+    "PYTHONSTARTUP",
+    "PERL5OPT",
+    "RUBYOPT",
+    "JAVA_TOOL_OPTIONS",
+    "LD_PRELOAD",
+    "SYSTEMROOT",
+    "WINDIR",
+    "HOME",
+    "USERPROFILE",
+    "APPDATA",
+    "LOCALAPPDATA",
+    "PROGRAMDATA",
+    "TEMP",
+    "TMP"
+  ].map((n) => n.toUpperCase())
+);
+function reservedEnvName(name) {
+  return RESERVED_ENV_PREFIX.test(name) || RESERVED_ENV_SUFFIX.test(name) || RESERVED_ENV_NAMES.has(name.toUpperCase());
+}
 var ConfigSchema = external_exports.strictObject({
   $schema: SchemaRefSchema.optional(),
   defaultHarness: NameSchema.describe("Agent started by `sandbox launch` (sandbox claude always runs claude)."),
@@ -26725,10 +26901,14 @@ var LocalOverridesSchema = external_exports.strictObject({
   scripts: StringsSchema.describe(
     "Scripts (.ps1 / .mjs / .cmd, relative to this file) run inside the sandbox before the agent."
   ),
-  // This PC's resources are yours to share: CPU and paging file (this PC's disk) are not a project's to set.
+  // This PC's resources are yours to share: CPU, paging file (this PC's disk) and the RAM kept for this PC are not a
+  // project's to set.
   sandbox: SandboxSchema.omit({
     cpuLimit: true,
     pageFileMb: true,
+    reserveHostMb: true,
+    maxMemoryPercent: true,
+    maxMemoryMb: true,
     engine: true,
     agentMemoryHeadroomMb: true,
     pressureResponse: true
@@ -26742,14 +26922,17 @@ var LocalOverridesSchema = external_exports.strictObject({
   // Every toolchain setting, each one optional (a project usually only switches languages on or pins a version).
   toolchains: external_exports.strictObject({
     ...import_lodash.default.mapValues(import_lodash.default.omit(ToolchainsSchema.shape, "environment"), (shape) => shape.partial()),
-    environment: ToolchainsSchema.shape.environment
+    environment: ToolchainsSchema.shape.environment.refine(
+      (env) => !Object.keys(env).some(reservedEnvName),
+      "names the sandbox sets or that carry logins (AGENT_*, GIT_*, PATH, BASH_ENV, NODE_*, proxies, ANTHROPIC_*, CLAUDE_* ...) cannot be set by a project"
+    )
   }).partial(),
   databases: external_exports.strictObject(import_lodash.default.mapValues(DatabasesSchema.shape, (shape) => shape.partial())).partial(),
   attach: AttachSchema.partial(),
   personalization: toggle("Copy your desktop look into the sandbox.").partial(),
   // Catalogue apps only (a vetted list): your own programs (apps.custom) download anything, so a repo cannot add
-  // them.
-  apps: AppsSchema.pick({ install: true }).partial(),
+  // them, nor agent add-ons that are yours only (rtk hooks every agent command, Headroom sits in its API path).
+  apps: ProjectAppsSchema.partial(),
   claudeProfile: ClaudeProfileSchema.pick({
     enabled: true,
     overwrite: true,
@@ -26812,6 +26995,7 @@ var ProjectSpecSchema = external_exports.strictObject({
   /** Its hooks were staged in C:\AgentLaunch\projects\<name>\hooks. */
   hooks: external_exports.boolean()
 });
+var ShellChoiceSchema = external_exports.enum(["auto", "pwsh", "powershell", "cmd"]);
 var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
   external_exports.strictObject({
     kind: external_exports.literal("session"),
@@ -26821,8 +27005,12 @@ var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
     cwd: Text(),
     project: ProjectSpecSchema.optional(),
     harnessSpec: HarnessSchema.optional(),
+    /** A plain shell instead of an agent (harness is then "shell" and args are ignored). */
+    shell: ShellChoiceSchema.optional(),
     createdAt: TimeSchema
   }),
+  /** End a running session (an agent or a shell) and everything it started. */
+  external_exports.strictObject({ kind: external_exports.literal("close"), id: IdSchema, session: IdSchema, createdAt: TimeSchema }),
   /** Provision a registered project without starting an agent (sandbox start / exec / db from its folder). */
   external_exports.strictObject({ kind: external_exports.literal("project"), id: IdSchema, project: ProjectSpecSchema, createdAt: TimeSchema }),
   external_exports.strictObject({
@@ -26888,6 +27076,8 @@ var SessionStatusSchema = external_exports.object({
   id: IdSchema,
   launchId: Text(64),
   harness: Text(64),
+  /** A plain shell (harness is then the shell: pwsh, powershell or cmd); absent: an agent. */
+  kind: external_exports.enum(["agent", "shell"]).optional(),
   cwd: Text(),
   /** The project it runs in: its hub name, or the launch folder's for the first project. */
   project: Text(64).optional(),
@@ -27599,9 +27789,29 @@ var NOISE = /* @__PURE__ */ new Set([
   "usoclient.exe",
   "musnotification.exe"
 ]);
+var ROOT_SLACK_MS = 5e3;
+var MAX_KNOWN = 5e4;
+var Attributor = class {
+  owner = /* @__PURE__ */ new Map();
+  /** The session of a new process (pid, started by ppid at time t), or undefined. */
+  attribute(e, roots) {
+    const root = roots.find(
+      (r) => r.pid === e.ppid && e.t >= r.from - ROOT_SLACK_MS && (r.to === void 0 || e.t <= r.to + ROOT_SLACK_MS)
+    );
+    const session2 = root?.session ?? this.owner.get(e.ppid) ?? void 0;
+    this.owner.delete(e.pid);
+    this.owner.set(e.pid, session2 ?? null);
+    if (this.owner.size > MAX_KNOWN) this.owner.delete(this.owner.keys().next().value);
+    return session2;
+  }
+};
 var decode3 = (s) => s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&");
 var field = (event, name) => decode3(new RegExp("<Data Name='" + name + "'>([^<]*)</Data>").exec(event)?.[1] ?? "");
-function parseProcessEvents(xml) {
+var pidOf = (text) => {
+  const n = /^0x[0-9a-f]{1,8}$/i.test(text) ? parseInt(text, 16) : /^\d{1,10}$/.test(text) ? Number(text) : 0;
+  return Number.isSafeInteger(n) ? n : 0;
+};
+function parseProcessEvents(xml, attribution) {
   const lines = [];
   let last = 0;
   for (const event of xml.split("</Event>")) {
@@ -27609,15 +27819,19 @@ function parseProcessEvents(xml) {
     if (!id) continue;
     last = Math.max(last, id);
     const program = field(event, "NewProcessName");
-    if (!program || NOISE.has(path15.win32.basename(program).toLowerCase())) continue;
     const t = /SystemTime='([^']+)'/.exec(event)?.[1] ?? (/* @__PURE__ */ new Date()).toISOString();
+    const pid = pidOf(field(event, "NewProcessId"));
+    const ppid = pidOf(field(event, "ProcessId"));
+    const session2 = attribution && pid && ppid ? attribution.attributor.attribute({ pid, ppid, t: Date.parse(t) || Date.now() }, attribution.roots) : void 0;
+    if (!program || NOISE.has(path15.win32.basename(program).toLowerCase())) continue;
     lines.push(
       JSON.stringify({
         t,
         k: "proc",
         p: program.slice(0, 1024),
         c: field(event, "CommandLine").slice(0, 2e3),
-        pp: field(event, "ParentProcessName").slice(0, 1024)
+        pp: field(event, "ParentProcessName").slice(0, 1024),
+        ...session2 ? { s: session2 } : {}
       })
     );
   }
@@ -27645,9 +27859,10 @@ var newestRecord = () => {
   });
   return parseProcessEvents(r.stdout ?? "").last;
 };
-function startProcessCollector() {
+function startProcessCollector(roots = () => []) {
   if (!auditOn()) return;
   let last = newestRecord();
+  const attributor = new Attributor();
   const pass = () => {
     try {
       const r = spawnSync(
@@ -27661,7 +27876,7 @@ function startProcessCollector() {
         ],
         { encoding: "utf8", windowsHide: true, maxBuffer: 64 * 1024 * 1024 }
       );
-      const { lines, last: newest } = parseProcessEvents(r.stdout ?? "");
+      const { lines, last: newest } = parseProcessEvents(r.stdout ?? "", { attributor, roots: roots() });
       if (newest) last = newest;
       if (lines.length)
         fs12.writeFileSync(
@@ -27795,7 +28010,7 @@ function withRequestSecrets(req) {
 }
 
 // src/guest/daemon/daemon.ts
-import fs54 from "node:fs";
+import fs55 from "node:fs";
 
 // src/guest/setup/claude-mem.ts
 import fs15 from "node:fs";
@@ -28281,18 +28496,76 @@ function readBootEnv() {
 }
 
 // src/guest/boot/guide.ts
+import fs19 from "node:fs";
+import path27 from "node:path";
+
+// src/guest/apps/find-exe.ts
 import fs18 from "node:fs";
 import path25 from "node:path";
+var MAX_DEPTH = 7;
+var MAX_ENTRIES = 5e4;
+var X64_FOLDER = /(^|[\\/])(amd64|x64|x86_64|win64)([\\/]|$)/i;
+function findExe(root, exe) {
+  const match = exeMatcher(exe);
+  const best = (hits) => hits.find((h) => X64_FOLDER.test(path25.relative(root, h))) ?? hits[0] ?? null;
+  let queue = [root];
+  let seen = 0;
+  for (let depth = 0; depth < MAX_DEPTH && queue.length; depth++) {
+    const next = [];
+    const hits = [];
+    for (const dir of queue) {
+      let entries2;
+      try {
+        entries2 = fs18.readdirSync(dir, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      const hit = entries2.find((e) => e.isFile() && match(e.name));
+      if (hit) hits.push(path25.join(dir, hit.name));
+      else
+        next.push(...entries2.filter((e) => e.isDirectory() && !e.isSymbolicLink()).map((e) => path25.join(dir, e.name)));
+      if ((seen += entries2.length) > MAX_ENTRIES) return best(hits);
+    }
+    if (hits.length) return best(hits);
+    queue = next;
+  }
+  return null;
+}
+
+// src/guest/toolchains/tool-env.ts
+import path26 from "node:path";
+function emptyEnv() {
+  return { vars: {}, prepend: [], append: [], summary: [] };
+}
+var arch = process.arch === "arm64" ? "arm64" : "x64";
+function tool(...parts2) {
+  return path26.join(toolsDir, ...parts2);
+}
+function versionOf(exe, args = ["--version"], options = {}) {
+  return /\d+\.\d+\.\d+\S*/.exec(execOutput(exe, args, options))?.[0] ?? "installed";
+}
+
+// src/guest/setup/agent-addons.ts
+function installedAddon(id) {
+  const entry = appById(id);
+  if (dryRun || !entry || !(session.apps?.install ?? []).includes(id)) return null;
+  return findExe(tool("apps", id), entry.exe);
+}
+function installedRtk() {
+  return installedAddon("rtk");
+}
+
+// src/guest/boot/guide.ts
 var BEGIN = "<!-- agent-sandbox:begin (generated every boot, do not edit) -->";
 var END = "<!-- agent-sandbox:end -->";
 var mirrorLine = () => {
-  const drives = (session.substDrives ?? []).filter((d) => fs18.existsSync(d.letter + ":\\"));
+  const drives = (session.substDrives ?? []).filter((d) => fs19.existsSync(d.letter + ":\\"));
   if (!drives.length) return [];
   return [
     "- " + drives.map((d) => d.letter + ":").join(", ") + " = mapped folders at their PC paths (subst onto `" + drives.map((d) => d.target).join("`, `") + "`; real-path tools may print that form)."
   ];
 };
-function sandboxGuide(toolSummary, lan = "blocked", projects = []) {
+function sandboxGuide(toolSummary, lan = "blocked", projects = [], addons = []) {
   return [
     BEGIN,
     "## Sandbox manifest \u2014 you are in a DISPOSABLE Windows Sandbox",
@@ -28302,11 +28575,13 @@ function sandboxGuide(toolSummary, lan = "blocked", projects = []) {
     ...projects.map(
       (p) => "- RW, persists: `" + p.guest + "` = host folder " + p.host + " (another project in this sandbox; your own is `%AGENT_WORKSPACE%`)"
     ),
-    "- RW, persists: `" + toolsDir + "` (toolchains) \u2014 put portable exes in `" + path25.join(toolsDir, "bin") + "` (on PATH)",
-    "- RW, persists: `" + stateDir + "` (agent config/history; do not edit logins) \xB7 logs: `" + path25.join(dataDir, "logs") + "`",
+    "- RW, persists: `" + toolsDir + "` (toolchains) \u2014 put portable exes in `" + path27.join(toolsDir, "bin") + "` (on PATH)",
+    "- RW, persists: `" + stateDir + "` (agent config/history; do not edit logins) \xB7 logs: `" + path27.join(dataDir, "logs") + "`",
     "- RO: `" + launchDir + "` (this boot's scripts) \xB7 lost on close: everything else, incl. `C:\\nvm` (Node symlink)",
     ...mirrorLine(),
     "- Tools: " + toolSummary.join(" \xB7 "),
+    // Agent add-ons that change how the agent works (rtk, Headroom, MCP servers, ccusage).
+    ...addons,
     "- Persistent installs: `npm i -g` (per nvm version), `pip`, `cargo install`, `dotnet tool -g`, `uv tool`, `bun add -g`. Real installers must re-run each boot via a hook (ask the user).",
     "- Mapped folders (workspace, C:\\AgentData) allow NO symlinks or junctions: pnpm runs hoisted (set), npm workspaces / `file:` deps and deno node_modules dirs fail there (use a folder on C:\\ outside them), bun cannot save its lockfile there (`bun install --no-save`).",
     "- Network: " + (lan === "offline" ? "OFF" : lan === "blocked" ? "internet yes, host LAN blocked" : "internet yes, host LAN NOT blocked this time") + ". Other sessions may share this workspace; the user may be typing from the host.",
@@ -28314,37 +28589,54 @@ function sandboxGuide(toolSummary, lan = "blocked", projects = []) {
   ].join("\n");
 }
 function upsertGuide(file3, guide) {
-  fs18.mkdirSync(path25.dirname(file3), { recursive: true });
-  const current = fs18.existsSync(file3) ? fs18.readFileSync(file3, "utf8") : "";
+  fs19.mkdirSync(path27.dirname(file3), { recursive: true });
+  const current = fs19.existsSync(file3) ? fs19.readFileSync(file3, "utf8") : "";
   const start = current.indexOf(BEGIN);
   const end = current.indexOf(END);
   const without = start >= 0 && end > start ? current.slice(0, start) + current.slice(end + END.length) : current;
-  fs18.writeFileSync(file3, without.trimEnd() + (without.trim() ? "\n\n" : "") + guide + "\n", "utf8");
+  fs19.writeFileSync(file3, without.trimEnd() + (without.trim() ? "\n\n" : "") + guide + "\n", "utf8");
 }
 function managedClaudeMd() {
-  return path25.join(
-    process.env.AGENT_MANAGED_DIR ?? path25.join(process.env.ProgramFiles ?? "C:\\Program Files", "ClaudeCode"),
+  return path27.join(
+    process.env.AGENT_MANAGED_DIR ?? path27.join(process.env.ProgramFiles ?? "C:\\Program Files", "ClaudeCode"),
     "CLAUDE.md"
   );
 }
+var headroomRuns = () => {
+  try {
+    const file3 = path27.join(path27.dirname(managedClaudeMd()), "managed-settings.json");
+    const settings = JSON.parse(fs19.readFileSync(file3, "utf8"));
+    return typeof settings.env?.ANTHROPIC_BASE_URL === "string";
+  } catch {
+    return false;
+  }
+};
+function addonLines() {
+  const mcp = APPS.flatMap((a) => a.mcp && installedAddon(a.id) ? [a.mcp.name] : []);
+  return [
+    ...installedRtk() ? [RTK_GUIDE_LINE] : [],
+    ...installedAddon("headroom") && headroomRuns() ? [headroomGuideLine(path27.join(logsDir, "headroom.log"))] : [],
+    ...addonGuideLine(mcp, Boolean(installedAddon("ccusage")))
+  ];
+}
 function writeGuides(toolSummary, lan, projects = []) {
-  const guide = sandboxGuide(toolSummary, lan, projects);
+  const guide = sandboxGuide(toolSummary, lan, projects, addonLines());
   const managed = managedClaudeMd();
-  fs18.mkdirSync(path25.dirname(managed), { recursive: true });
-  fs18.writeFileSync(managed, guide + "\n", "utf8");
-  fs18.writeFileSync(path25.join(dataDir, "SANDBOX.md"), guide + "\n", "utf8");
-  upsertGuide(path25.join(stateDir, "codex", "AGENTS.md"), guide);
-  upsertGuide(path25.join(stateDir, "gemini", ".gemini", "GEMINI.md"), guide);
-  removeGuide(path25.join(claudeDir, "CLAUDE.md"));
+  fs19.mkdirSync(path27.dirname(managed), { recursive: true });
+  fs19.writeFileSync(managed, guide + "\n", "utf8");
+  fs19.writeFileSync(path27.join(dataDir, "SANDBOX.md"), guide + "\n", "utf8");
+  upsertGuide(path27.join(stateDir, "codex", "AGENTS.md"), guide);
+  upsertGuide(path27.join(stateDir, "gemini", ".gemini", "GEMINI.md"), guide);
+  removeGuide(path27.join(claudeDir, "CLAUDE.md"));
   return managed;
 }
 var removeGuide = (file3) => {
-  if (!fs18.existsSync(file3)) return;
-  const current = fs18.readFileSync(file3, "utf8");
+  if (!fs19.existsSync(file3)) return;
+  const current = fs19.readFileSync(file3, "utf8");
   const start = current.indexOf(BEGIN);
   const end = current.indexOf(END);
   if (start >= 0 && end > start)
-    fs18.writeFileSync(file3, (current.slice(0, start) + current.slice(end + END.length)).trim() + "\n", "utf8");
+    fs19.writeFileSync(file3, (current.slice(0, start) + current.slice(end + END.length)).trim() + "\n", "utf8");
 };
 
 // src/guest/runtime/project-context.ts
@@ -28381,11 +28673,11 @@ function saveProjectStatus(name, workspace2, phase, message, databases, summary)
 }
 
 // src/guest/setup/hooks.ts
-import fs19 from "node:fs";
-import path26 from "node:path";
+import fs20 from "node:fs";
+import path28 from "node:path";
 import { spawnSync as spawnSync3 } from "node:child_process";
 var commandFor = (file3) => {
-  const ext = path26.extname(file3).toLowerCase();
+  const ext = path28.extname(file3).toLowerCase();
   if (ext === ".mjs" || ext === ".js") return [process.execPath, [file3]];
   if (!isWin) return null;
   if (ext === ".ps1")
@@ -28393,18 +28685,18 @@ var commandFor = (file3) => {
   if (ext === ".cmd" || ext === ".bat") return [SYSTEM.cmd(), ["/d", "/c", file3]];
   return null;
 };
-var BOOT = { root: path26.join(launchDir, "hooks"), cwd: workspace };
+var BOOT = { root: path28.join(launchDir, "hooks"), cwd: workspace };
 function projectHooks(name, cwd) {
   return {
-    root: path26.join(launchDir, "projects", name, "hooks"),
+    root: path28.join(launchDir, "projects", name, "hooks"),
     cwd
   };
 }
 var hooksOf = (stage, target) => {
-  const dir = path26.join(target.root, stage);
+  const dir = path28.join(target.root, stage);
   if (!exists(dir)) return [];
-  return fs19.readdirSync(dir).sort().flatMap((name) => {
-    const command = commandFor(path26.join(dir, name));
+  return fs20.readdirSync(dir).sort().flatMap((name) => {
+    const command = commandFor(path28.join(dir, name));
     return command ? [{ name, command }] : [];
   });
 };
@@ -28433,26 +28725,109 @@ async function runHooksAsync(stage, env, target) {
   }
 }
 
-// src/guest/toolchains/tool-env.ts
-import path27 from "node:path";
-function emptyEnv() {
-  return { vars: {}, prepend: [], append: [], summary: [] };
-}
-var arch = process.arch === "arm64" ? "arm64" : "x64";
-function tool(...parts2) {
-  return path27.join(toolsDir, ...parts2);
+// src/guest/apps/app-installer.ts
+import fs24 from "node:fs";
+import path33 from "node:path";
+
+// src/guest/toolchains/runtimes.ts
+import path29 from "node:path";
+
+// src/guest/toolchains/install.ts
+import fs21 from "node:fs";
+async function downloadFile(url2, file3, sha256 = null) {
+  const part = file3 + ".part";
+  try {
+    await downloader.file(url2, part, sha256);
+    fs21.rmSync(file3, { force: true });
+    fs21.renameSync(part, file3);
+  } finally {
+    fs21.rmSync(part, { force: true });
+  }
 }
-function versionOf(exe, args = ["--version"], options = {}) {
-  return /\d+\.\d+\.\d+\S*/.exec(execOutput(exe, args, options))?.[0] ?? "installed";
+async function installFromGithub(repo, pattern, o) {
+  const asset = await githubAsset(repo, pattern, o.searchOlder);
+  log("Downloading " + (typeof o.what === "string" ? o.what : o.what(asset)) + " ...");
+  await downloader.archive(asset.url, o.dest, {
+    sha256: asset.sha256,
+    fileName: asset.name,
+    ...o.locate ? { locate: o.locate } : {},
+    ...o.up ? { up: o.up } : {}
+  });
 }
 
-// src/guest/apps/app-installer.ts
-import fs23 from "node:fs";
-import path32 from "node:path";
+// src/guest/toolchains/runtimes.ts
+async function setupSingleExe(env, name, repo, pattern, exeName, dir, options = {}) {
+  if (dryRun) {
+    log("(dry run) would provision " + name);
+    return;
+  }
+  const bin = options.subdir ? path29.join(dir, options.subdir) : dir;
+  const exe = path29.join(bin, exeName);
+  if (!exists(exe) || options.refresh) {
+    const size = options.size ? ", ~" + options.size : "";
+    await installFromGithub(repo, pattern, {
+      dest: dir,
+      what: (a) => name + " (" + a.name + size + " once)",
+      ...options.subdir ? {} : { locate: exeName }
+    });
+  }
+  if (!exists(exe)) throw new Error(exeName + " missing after installing " + name);
+  env.prepend.push(bin);
+  env.summary.push(name + ": " + versionOf(exe, options.versionArgs) + (options.note ?? ""));
+}
+async function setupBun(env) {
+  await setupSingleExe(
+    env,
+    "bun",
+    "oven-sh/bun",
+    arch === "arm64" ? /^bun-windows-aarch64\.zip$/ : /^bun-windows-x64\.zip$/,
+    "bun.exe",
+    tool("bun", "bin"),
+    { size: "35 MB" }
+  );
+  Object.assign(env.vars, {
+    BUN_INSTALL: tool("bun"),
+    BUN_INSTALL_CACHE_DIR: path29.join(localDir, "bun-cache"),
+    BUN_TMPDIR: path29.join(localDir, "bun-tmp")
+  });
+}
+async function setupDeno(env) {
+  await setupSingleExe(
+    env,
+    "deno",
+    "denoland/deno",
+    arch === "arm64" ? /^deno-aarch64-pc-windows-msvc[.]zip$/ : /^deno-x86_64-pc-windows-msvc[.]zip$/,
+    "deno.exe",
+    tool("deno", "bin"),
+    { size: "40 MB" }
+  );
+  Object.assign(env.vars, { DENO_DIR: tool("deno-cache"), DENO_INSTALL_ROOT: tool("deno"), DENO_NO_UPDATE_CHECK: "1" });
+}
+function uvVars() {
+  return {
+    UV_CACHE_DIR: tool("uv-cache"),
+    UV_PYTHON_INSTALL_DIR: tool("uv-python"),
+    UV_TOOL_DIR: tool("uv-tools"),
+    UV_TOOL_BIN_DIR: tool("uv-bin")
+  };
+}
+async function setupUv(env) {
+  await setupSingleExe(
+    env,
+    "uv",
+    "astral-sh/uv",
+    arch === "arm64" ? /^uv-aarch64-pc-windows-msvc\.zip$/ : /^uv-x86_64-pc-windows-msvc\.zip$/,
+    "uv.exe",
+    tool("uv"),
+    { size: "20 MB" }
+  );
+  Object.assign(env.vars, uvVars());
+  env.prepend.push(mkdirp(tool("uv-bin")));
+}
 
 // src/guest/apps/after-install.ts
-import fs20 from "node:fs";
-import path28 from "node:path";
+import fs22 from "node:fs";
+import path30 from "node:path";
 var SYSINTERNALS_TOOLS = [
   "Process Explorer",
   "Process Monitor",
@@ -28473,16 +28848,16 @@ var SYSINTERNALS_TOOLS = [
   "ZoomIt"
 ];
 async function afterInstall(entry, exe) {
-  const dir = path28.dirname(exe);
+  const dir = path30.dirname(exe);
   if (entry.needs?.includes("mesa")) {
     const mesa = tool("mesa", arch === "arm64" ? "arm64" : "x64");
     for (const dll of ["opengl32.dll", "libgallium_wgl.dll", "dxil.dll"]) {
-      if (exists(path28.join(mesa, dll)) && !exists(path28.join(dir, dll)))
-        fs20.copyFileSync(path28.join(mesa, dll), path28.join(dir, dll));
+      if (exists(path30.join(mesa, dll)) && !exists(path30.join(dir, dll)))
+        fs22.copyFileSync(path30.join(mesa, dll), path30.join(dir, dll));
     }
   }
-  if (entry.id === "godot" && !exists(path28.join(dir, "._sc_"))) fs20.writeFileSync(path28.join(dir, "._sc_"), "");
-  if (entry.id === "sublime") mkdirp(path28.join(dir, "Data"));
+  if (entry.id === "godot" && !exists(path30.join(dir, "._sc_"))) fs22.writeFileSync(path30.join(dir, "._sc_"), "");
+  if (entry.id === "sublime") mkdirp(path30.join(dir, "Data"));
   if (entry.id === "sysinternals") {
     for (const name of SYSINTERNALS_TOOLS) {
       await execAsync(
@@ -28494,47 +28869,14 @@ async function afterInstall(entry, exe) {
   }
 }
 
-// src/guest/apps/find-exe.ts
-import fs21 from "node:fs";
-import path29 from "node:path";
-var MAX_DEPTH = 7;
-var MAX_ENTRIES = 5e4;
-var X64_FOLDER = /(^|[\\/])(amd64|x64|x86_64|win64)([\\/]|$)/i;
-function findExe(root, exe) {
-  const match = exeMatcher(exe);
-  const best = (hits) => hits.find((h) => X64_FOLDER.test(path29.relative(root, h))) ?? hits[0] ?? null;
-  let queue = [root];
-  let seen = 0;
-  for (let depth = 0; depth < MAX_DEPTH && queue.length; depth++) {
-    const next = [];
-    const hits = [];
-    for (const dir of queue) {
-      let entries2;
-      try {
-        entries2 = fs21.readdirSync(dir, { withFileTypes: true });
-      } catch {
-        continue;
-      }
-      const hit = entries2.find((e) => e.isFile() && match(e.name));
-      if (hit) hits.push(path29.join(dir, hit.name));
-      else
-        next.push(...entries2.filter((e) => e.isDirectory() && !e.isSymbolicLink()).map((e) => path29.join(dir, e.name)));
-      if ((seen += entries2.length) > MAX_ENTRIES) return best(hits);
-    }
-    if (hits.length) return best(hits);
-    queue = next;
-  }
-  return null;
-}
-
 // src/guest/apps/shortcuts.ts
 import os5 from "node:os";
-import path30 from "node:path";
+import path31 from "node:path";
 function shortcuts(apps) {
   if (!apps.length) return;
-  const desktop = path30.join(os5.homedir(), "Desktop");
-  const start = path30.join(
-    process.env.APPDATA ?? path30.join(os5.homedir(), "AppData", "Roaming"),
+  const desktop = path31.join(os5.homedir(), "Desktop");
+  const start = path31.join(
+    process.env.APPDATA ?? path31.join(os5.homedir(), "AppData", "Roaming"),
     "Microsoft",
     "Windows",
     "Start Menu",
@@ -28544,9 +28886,9 @@ function shortcuts(apps) {
   const links = apps.flatMap((app) => {
     const name = app.name.replace(/[\\/:*?"<>|]/g, "");
     return [desktop, start].map((folder) => ({
-      link: path30.join(folder, name + ".lnk"),
+      link: path31.join(folder, name + ".lnk"),
       target: app.exe,
-      workingDirectory: path30.dirname(app.exe)
+      workingDirectory: path31.dirname(app.exe)
     }));
   });
   runScriptWithJson("new-shortcuts.ps1", "ListFile", links);
@@ -28671,19 +29013,19 @@ async function resolve(entry) {
   }
   if ("url" in s) {
     const name = decodeURIComponent(new URL(s.url).pathname.split("/").pop() || entry.id);
-    return { url: s.url, fileName: /\.\w{2,5}$/.test(name) ? name : name + ".zip" };
+    return { url: s.url, fileName: /\.\w{2,5}$/.test(name) ? name : name + ".zip", sha256: s.sha256 };
   }
   if ("resolve" in s && RESOLVERS[s.resolve]) return RESOLVERS[s.resolve]();
   throw new Error("no download source for " + entry.name);
 }
 
 // src/guest/apps/unpack.ts
-import fs22 from "node:fs";
-import path31 from "node:path";
+import fs23 from "node:fs";
+import path32 from "node:path";
 var sevenZip = () => tool("apps", "7zip", "7z.exe");
 async function unpack(entry, file3, out, d) {
   if (entry.id === "7zip") {
-    const sevenZr = path31.join(path31.dirname(file3), "7zr.exe");
+    const sevenZr = path32.join(path32.dirname(file3), "7zr.exe");
     const zr = await githubAsset("ip7z/7zip", /^7zr\.exe$/);
     await downloader.file(zr.url, sevenZr, zr.sha256);
     await execAsync(sevenZr, ["x", "-y", "-o" + out, file3], { stdio: "ignore" });
@@ -28692,17 +29034,17 @@ async function unpack(entry, file3, out, d) {
   switch (entry.unpack ?? "archive") {
     case "file": {
       mkdirp(out);
-      fs22.renameSync(file3, path31.join(out, /^\//.test(entry.exe) ? path31.basename(file3) : entry.exe));
+      fs23.renameSync(file3, path32.join(out, /^\//.test(entry.exe) ? path32.basename(file3) : entry.exe));
       return;
     }
     case "nsis": {
       if (!exists(sevenZip()))
         throw new Error("7-Zip is needed to unpack " + entry.name + " and could not be installed");
-      const raw = path31.join(path31.dirname(out), "raw");
+      const raw = path32.join(path32.dirname(out), "raw");
       await execAsync(sevenZip(), ["x", "-y", "-o" + raw, file3], { stdio: "ignore" });
       const inner = findExe(raw, "/^app-64\\.7z$/");
       if (inner) await execAsync(sevenZip(), ["x", "-y", "-o" + out, inner], { stdio: "ignore" });
-      else fs22.renameSync(raw, out);
+      else fs23.renameSync(raw, out);
       return;
     }
     case "msi": {
@@ -28752,12 +29094,12 @@ var AppInstaller = class {
   async installOne(entry) {
     try {
       const dest = tool("apps", ...entry.id.split("/"));
-      if (!exists(path32.join(dest, MARKER)) || this.options.refresh) await this.download(entry, dest);
+      if (!exists(path33.join(dest, MARKER)) || this.options.refresh) await this.download(entry, dest);
       const exe = findExe(dest, entry.exe);
       if (!exe) throw new Error(entry.exe + " not found in the download");
       await afterInstall(entry, exe);
-      if (entry.cli || entry.id === "sysinternals") this.env.prepend.push(path32.dirname(exe));
-      if (!entry.cli) this.gui.push({ name: entry.name, exe });
+      if (!entry.service && (entry.cli || entry.id === "sysinternals")) this.env.prepend.push(path33.dirname(exe));
+      if (!entry.cli && !entry.service) this.gui.push({ name: entry.name, exe });
       this.installed.push(entry.name);
     } catch (e) {
       warn(
@@ -28769,10 +29111,13 @@ var AppInstaller = class {
   /** Downloads and unpacks one entry into its folder (replaced in one step: never half there). */
   async download(entry, dest) {
     const work = stagingFolder(dest);
-    const out = path32.join(work, "out");
+    const out = path33.join(work, "out");
     try {
-      if ("npm" in entry.source) {
-        const npmCli = path32.join(path32.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+      if ("locked" in entry.source) {
+        log("Installing " + entry.name + " " + entry.source.version + " (pinned, every file checked) ...");
+        await installLocked(entry.id, entry.source.locked, mkdirp(out));
+      } else if ("npm" in entry.source) {
+        const npmCli = path33.join(path33.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
         log("Installing " + entry.name + " (npm) ...");
         await execAsync(process.execPath, [
           npmCli,
@@ -28787,17 +29132,60 @@ var AppInstaller = class {
       } else {
         const d = await resolve(entry);
         log("Downloading " + entry.name + " (" + d.fileName + ", ~" + entry.size + " once) ...");
-        const file3 = path32.join(mkdirp(work), d.fileName.replace(/[\\/:*?"<>|]/g, "_"));
+        const file3 = path33.join(mkdirp(work), d.fileName.replace(/[\\/:*?"<>|]/g, "_"));
         await downloader.file(d.url, file3, { sha256: d.sha256 ?? null });
         await unpack(entry, file3, out, d);
       }
-      fs23.writeFileSync(path32.join(out, MARKER), JSON.stringify({ id: entry.id, at: (/* @__PURE__ */ new Date()).toISOString() }));
+      fs24.writeFileSync(path33.join(out, MARKER), JSON.stringify({ id: entry.id, at: (/* @__PURE__ */ new Date()).toISOString() }));
       moveIntoPlace(out, dest);
     } finally {
-      safeRemove(work, path32.dirname(work));
+      safeRemove(work, path33.dirname(work));
     }
   }
 };
+var LOCKED_PYTHON = "3.13";
+async function installLocked(id, kind, out) {
+  const lock = path33.join(launchDir, "sandbox", "addons", id);
+  if (kind === "npm") {
+    for (const f of ["package.json", "package-lock.json"]) fs24.copyFileSync(path33.join(lock, f), path33.join(out, f));
+    const npmCli = path33.join(path33.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+    await execAsync(
+      process.execPath,
+      [npmCli, "ci", "--ignore-scripts", "--no-audit", "--no-fund", "--loglevel=error"],
+      { cwd: out }
+    );
+    return;
+  }
+  const uv = findExe(tool("uv"), "uv.exe");
+  if (!uv) throw new Error("uv is not installed (the uv step failed)");
+  const env = { ...process.env, ...uvVars() };
+  const venv = path33.join(out, "venv");
+  await execAsync(
+    uv,
+    ["venv", "--relocatable", "--python", LOCKED_PYTHON, "--python-preference", "only-managed", venv],
+    {
+      env
+    }
+  );
+  await execAsync(
+    uv,
+    [
+      "pip",
+      "install",
+      "--python",
+      path33.join(venv, "Scripts", "python.exe"),
+      "--require-hashes",
+      "--no-deps",
+      "--only-binary",
+      ":all:",
+      "--link-mode",
+      "copy",
+      "-r",
+      path33.join(lock, "requirements.txt")
+    ],
+    { env }
+  );
+}
 async function setupApps(env, apps, o) {
   const { entries: entries2, skipped } = appsToInstall(apps, o.gitAccess);
   for (const s of skipped) env.summary.push("app skipped: " + s);
@@ -28809,8 +29197,8 @@ async function setupApps(env, apps, o) {
 }
 
 // src/guest/toolchains/detect.ts
-import fs24 from "node:fs";
-import path33 from "node:path";
+import fs25 from "node:fs";
+import path34 from "node:path";
 
 // src/core/detect/versions.ts
 function pickNodeVersion(releases, spec) {
@@ -28942,14 +29330,14 @@ function workspaceEntries() {
   if (known) return known;
   const list = (dir) => {
     try {
-      return fs24.readdirSync(dir, { withFileTypes: true });
+      return fs25.readdirSync(dir, { withFileTypes: true });
     } catch {
       return [];
     }
   };
   const top = list(workspace2);
   const below = top.filter((d) => d.isDirectory() && !d.name.startsWith(".") && !SKIP_DIRS.has(d.name.toLowerCase())).flatMap(
-    (d) => list(path33.join(workspace2, d.name)).filter((f) => f.isFile()).map((f) => d.name + "/" + f.name)
+    (d) => list(path34.join(workspace2, d.name)).filter((f) => f.isFile()).map((f) => d.name + "/" + f.name)
   );
   const found = [...top.filter((d) => d.isFile()).map((d) => d.name), ...below];
   entries.set(workspace2.toLowerCase(), found);
@@ -28960,9 +29348,9 @@ function wanted(setting, toolchain) {
 }
 function versionFromFiles(files, parse5 = (t) => specFromVersionFile(t)) {
   for (const name of files) {
-    const file3 = path33.join(projectWorkspace(), name);
+    const file3 = path34.join(projectWorkspace(), name);
     if (!exists(file3)) continue;
-    const spec = parse5(fs24.readFileSync(file3, "utf8"), name);
+    const spec = parse5(fs25.readFileSync(file3, "utf8"), name);
     if (spec) return { spec, source: name };
   }
   return null;
@@ -29035,22 +29423,22 @@ var DatabaseServer = class {
 };
 
 // src/guest/databases/dynamodb.ts
-import fs29 from "node:fs";
-import path36 from "node:path";
+import fs30 from "node:fs";
+import path37 from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 
 // src/guest/toolchains/languages/java.ts
-import fs27 from "node:fs";
-import path34 from "node:path";
+import fs28 from "node:fs";
+import path35 from "node:path";
 
 // src/guest/toolchains/version-cache.ts
-import fs26 from "node:fs";
+import fs27 from "node:fs";
 
 // src/guest/toolchains/state-file.ts
-import fs25 from "node:fs";
+import fs26 from "node:fs";
 function readState(file3, schema, empty) {
   try {
-    return schema.safeParse(JSON.parse(fs25.readFileSync(file3, "utf8").replace(/^\uFEFF/, ""))).data ?? empty;
+    return schema.safeParse(JSON.parse(fs26.readFileSync(file3, "utf8").replace(/^\uFEFF/, ""))).data ?? empty;
   } catch {
     return empty;
   }
@@ -29085,7 +29473,7 @@ var VersionCache = class {
       return cached2.value;
     try {
       const value = await resolve2();
-      fs26.mkdirSync(toolsDir, { recursive: true });
+      fs27.mkdirSync(toolsDir, { recursive: true });
       writeJsonAtomic(this.file(), { ...this.remembered(), [key2]: { value, at: Date.now() } });
       return value;
     } catch (e) {
@@ -29138,7 +29526,7 @@ var setupJdk = async (env, config2) => {
   const { major, source } = await javaMajor(config2);
   const release = await resolveCached("java:" + major, async () => (await temurin(major)).release_name);
   const home = tool("java", release.replace(/[^A-Za-z0-9.-]/g, "_"));
-  if (!exists(path34.join(home, "bin", "java.exe"))) {
+  if (!exists(path35.join(home, "bin", "java.exe"))) {
     const asset = await temurin(major);
     log("Downloading Java " + release + " (JDK, ~200 MB once) ...");
     await downloader.archive(asset.binary.package.link, home, {
@@ -29148,13 +29536,13 @@ var setupJdk = async (env, config2) => {
     });
   }
   env.vars.JAVA_HOME = home;
-  env.prepend.push(path34.join(home, "bin"));
+  env.prepend.push(path35.join(home, "bin"));
   env.summary.push("java: " + release + " (Temurin, from " + source + ")");
 };
 async function ensureJdk() {
   const root = tool("java");
-  const installed = exists(root) ? fs27.readdirSync(root).filter((d) => exists(path34.join(root, d, "bin", "java.exe"))).sort((a, b) => b.localeCompare(a, void 0, { numeric: true })) : [];
-  if (installed.length) return path34.join(root, installed[0]);
+  const installed = exists(root) ? fs28.readdirSync(root).filter((d) => exists(path35.join(root, d, "bin", "java.exe"))).sort((a, b) => b.localeCompare(a, void 0, { numeric: true })) : [];
+  if (installed.length) return path35.join(root, installed[0]);
   const scratch = emptyEnv();
   await setupJdk(scratch, { enabled: true, version: "lts", maven: false, gradle: false });
   return scratch.vars.JAVA_HOME;
@@ -29167,7 +29555,7 @@ var setupMaven = async (env) => {
     return pickPackageVersion(versions, "3") ?? Promise.reject(new Error("No Maven 3 release found"));
   });
   const home = tool("maven", version2);
-  if (!exists(path34.join(home, "bin", "mvn.cmd"))) {
+  if (!exists(path35.join(home, "bin", "mvn.cmd"))) {
     const url2 = MAVEN + version2 + "/apache-maven-" + version2 + "-bin.zip";
     log("Downloading Maven " + version2 + " (~10 MB once) ...");
     await downloader.archive(url2, home, {
@@ -29177,7 +29565,7 @@ var setupMaven = async (env) => {
   }
   const repo = tool("maven-repository");
   Object.assign(env.vars, { MAVEN_HOME: home, M2_HOME: home, MAVEN_OPTS: "-Dmaven.repo.local=" + repo });
-  env.prepend.push(path34.join(home, "bin"));
+  env.prepend.push(path35.join(home, "bin"));
   env.summary.push("maven: " + version2);
 };
 var setupGradle = async (env) => {
@@ -29189,7 +29577,7 @@ var setupGradle = async (env) => {
     async () => current?.version ?? Promise.reject(new Error("Gradle version lookup failed"))
   );
   const home = tool("gradle", version2);
-  if (!exists(path34.join(home, "bin", "gradle.bat"))) {
+  if (!exists(path35.join(home, "bin", "gradle.bat"))) {
     if (!current || current.version !== version2)
       throw new Error("Gradle " + version2 + " is not installed and cannot be downloaded right now");
     log("Downloading Gradle " + version2 + " (~130 MB once) ...");
@@ -29200,13 +29588,13 @@ var setupGradle = async (env) => {
     });
   }
   const userHome = tool("gradle-home");
-  fs27.mkdirSync(userHome, { recursive: true });
+  fs28.mkdirSync(userHome, { recursive: true });
   Object.assign(env.vars, {
     GRADLE_HOME: home,
     GRADLE_USER_HOME: userHome,
     GRADLE_OPTS: "-Dorg.gradle.vfs.watch=false"
   });
-  env.prepend.push(path34.join(home, "bin"));
+  env.prepend.push(path35.join(home, "bin"));
   env.summary.push("gradle: " + version2);
 };
 async function setupJava(env, config2) {
@@ -29230,29 +29618,29 @@ async function setupJava(env, config2) {
 }
 
 // src/guest/databases/server.ts
-import fs28 from "node:fs";
-import path35 from "node:path";
+import fs29 from "node:fs";
+import path36 from "node:path";
 import { spawn as spawn2 } from "node:child_process";
 function dataFor(name) {
-  return path35.join(dataDir, "databases", name);
+  return path36.join(dataDir, "databases", name);
 }
 async function startServer(name, exe, args, port) {
   if (await portOpen(port)) throw new Error("port " + port + " is already in use (change databases." + name + ".port)");
-  const logFile2 = path35.join(logsDir, name + ".log");
-  const out = fs28.openSync(logFile2, "a");
+  const logFile2 = path36.join(logsDir, name + ".log");
+  const out = fs29.openSync(logFile2, "a");
   spawn2(exe, args, { detached: true, stdio: ["ignore", out, out], windowsHide: true }).unref();
-  fs28.closeSync(out);
+  fs29.closeSync(out);
   if (!await waitForPort(port, 60))
     throw new Error(name + " did not start listening on port " + port + "; see " + logFile2);
 }
 async function clearStaleLocks(dir, files, port) {
   if (await portOpen(port)) return;
-  for (const f of files) fs28.rmSync(path35.join(dir, f), { force: true });
+  for (const f of files) fs29.rmSync(path36.join(dir, f), { force: true });
 }
 async function createOnce(data, marker, create) {
-  if (exists(path35.join(data, marker))) return;
+  if (exists(path36.join(data, marker))) return;
   const existed = exists(data);
-  mkdirp(path35.dirname(data));
+  mkdirp(path36.dirname(data));
   try {
     await create();
   } catch (e) {
@@ -29276,9 +29664,9 @@ var DynamoServer = class extends DatabaseServer {
    * local endpoint up from AWS_ENDPOINT_URL_DYNAMODB, with dummy credentials (real ones never reach the sandbox).
    */
   async start(env, plan2) {
-    const java = path36.join(await ensureJdk(), "bin", "java.exe");
+    const java = path37.join(await ensureJdk(), "bin", "java.exe");
     const home = tool("dynamodb-local");
-    if (!exists(path36.join(home, "DynamoDBLocal.jar"))) {
+    if (!exists(path37.join(home, "DynamoDBLocal.jar"))) {
       log("Downloading DynamoDB Local (~60 MB once) ...");
       const sha256 = (await fetchText(DYNAMO_ZIP + ".sha256")).trim().split(/\s+/)[0];
       await downloader.archive(DYNAMO_ZIP, home, {
@@ -29292,9 +29680,9 @@ var DynamoServer = class extends DatabaseServer {
       "dynamodb",
       java,
       [
-        "-Djava.library.path=" + path36.join(home, "DynamoDBLocal_lib"),
+        "-Djava.library.path=" + path37.join(home, "DynamoDBLocal_lib"),
         "-jar",
-        path36.join(home, "DynamoDBLocal.jar"),
+        path37.join(home, "DynamoDBLocal.jar"),
         "-sharedDb",
         "-dbPath",
         data,
@@ -29318,10 +29706,10 @@ var DynamoServer = class extends DatabaseServer {
     );
     if (!plan2.adminPort) return;
     const prefix = tool("dynamodb-admin");
-    const script = path36.join(prefix, "node_modules", "dynamodb-admin", "dist", "dynamodb-admin.js");
+    const script = path37.join(prefix, "node_modules", "dynamodb-admin", "dist", "dynamodb-admin.js");
     if (!exists(script)) {
       log("Installing dynamodb-admin, the DynamoDB web UI (~20 MB once) ...");
-      const npmCli = path36.join(path36.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+      const npmCli = path37.join(path37.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
       await execAsync(
         process.execPath,
         [npmCli, "install", "--global", "--prefix", prefix, "dynamodb-admin", "--no-fund", "--no-audit"],
@@ -29334,15 +29722,15 @@ var DynamoServer = class extends DatabaseServer {
       );
       return;
     }
-    const out = fs29.openSync(path36.join(logsDir, "dynamodb-admin.log"), "a");
+    const out = fs30.openSync(path37.join(logsDir, "dynamodb-admin.log"), "a");
     spawn3(
       process.execPath,
       [script, "--port", String(plan2.adminPort), "--dynamo-endpoint", endpoint, "--skip-default-credentials"],
       { detached: true, stdio: ["ignore", out, out], windowsHide: true, env: { ...process.env, ...aws } }
     ).unref();
-    fs29.closeSync(out);
+    fs30.closeSync(out);
     if (!await waitForPort(plan2.adminPort, 30))
-      throw new Error("dynamodb-admin did not start; see " + path36.join(logsDir, "dynamodb-admin.log"));
+      throw new Error("dynamodb-admin did not start; see " + path37.join(logsDir, "dynamodb-admin.log"));
     env.summary.push(
       "dynamodb-admin: http://localhost:" + plan2.adminPort + " (browse and edit tables in the sandbox's browser)"
     );
@@ -29350,32 +29738,7 @@ var DynamoServer = class extends DatabaseServer {
 };
 
 // src/guest/databases/mongodb.ts
-import path37 from "node:path";
-
-// src/guest/toolchains/install.ts
-import fs30 from "node:fs";
-async function downloadFile(url2, file3, sha256 = null) {
-  const part = file3 + ".part";
-  try {
-    await downloader.file(url2, part, sha256);
-    fs30.rmSync(file3, { force: true });
-    fs30.renameSync(part, file3);
-  } finally {
-    fs30.rmSync(part, { force: true });
-  }
-}
-async function installFromGithub(repo, pattern, o) {
-  const asset = await githubAsset(repo, pattern, o.searchOlder);
-  log("Downloading " + (typeof o.what === "string" ? o.what : o.what(asset)) + " ...");
-  await downloader.archive(asset.url, o.dest, {
-    sha256: asset.sha256,
-    fileName: asset.name,
-    ...o.locate ? { locate: o.locate } : {},
-    ...o.up ? { up: o.up } : {}
-  });
-}
-
-// src/guest/databases/mongodb.ts
+import path38 from "node:path";
 var MongoServer = class extends DatabaseServer {
   id = "mongodb";
   async start(env, plan2) {
@@ -29390,13 +29753,13 @@ var MongoServer = class extends DatabaseServer {
     };
     const version2 = await resolveCached("mongodb:" + plan2.version, async () => (await find()).version);
     const home = tool("mongodb", version2);
-    if (!exists(path37.join(home, "bin", "mongod.exe"))) {
+    if (!exists(path38.join(home, "bin", "mongod.exe"))) {
       const { archive } = await find();
       log("Downloading MongoDB " + version2 + " (~400 MB once) ...");
       await downloader.archive(archive.url, home, { sha256: archive.sha256, locate: "mongod.exe", up: 1 });
     }
     const shell = tool("mongosh");
-    if (!exists(path37.join(shell, "mongosh.exe"))) {
+    if (!exists(path38.join(shell, "mongosh.exe"))) {
       await installFromGithub("mongodb-js/mongosh", /^mongosh-[\d.]+-win32-x64\.zip$/, {
         dest: shell,
         what: "mongosh, the MongoDB shell (~50 MB once)",
@@ -29407,17 +29770,17 @@ var MongoServer = class extends DatabaseServer {
     await clearStaleLocks(data, ["mongod.lock"], plan2.port);
     await startServer(
       "mongodb",
-      path37.join(home, "bin", "mongod.exe"),
+      path38.join(home, "bin", "mongod.exe"),
       ["--dbpath", data, "--bind_ip", "127.0.0.1", "--port", String(plan2.port)],
       plan2.port
     );
-    env.prepend.push(path37.join(home, "bin"), shell);
+    env.prepend.push(path38.join(home, "bin"), shell);
     env.summary.push("mongodb " + version2 + ": mongodb://127.0.0.1:" + plan2.port + " (mongosh on PATH)");
   }
 };
 
 // src/guest/databases/mysql.ts
-import path38 from "node:path";
+import path39 from "node:path";
 var MARIA = "https://downloads.mariadb.org/rest-api/mariadb/";
 var MysqlServer = class extends DatabaseServer {
   id = "mysql";
@@ -29435,8 +29798,8 @@ var MysqlServer = class extends DatabaseServer {
     };
     const version2 = await resolveCached("mariadb-version:" + series, async () => (await latest()).version);
     const home = tool("mariadb", version2);
-    const bin = path38.join(home, "bin");
-    if (!exists(path38.join(bin, "mariadbd.exe"))) {
+    const bin = path39.join(home, "bin");
+    if (!exists(path39.join(bin, "mariadbd.exe"))) {
       const { zip } = await latest();
       log("Downloading MariaDB " + version2 + " (~90 MB once) ...");
       await downloader.archive(zip.file_download_url.replace(/^http:/, "https:"), home, {
@@ -29449,13 +29812,13 @@ var MysqlServer = class extends DatabaseServer {
     const data = dataFor("mariadb");
     await createOnce(data, "mysql", async () => {
       log("Creating the MariaDB database (first start) ...");
-      await execAsync(path38.join(bin, "mariadb-install-db.exe"), ["--datadir=" + data, "--port=" + plan2.port], {
+      await execAsync(path39.join(bin, "mariadb-install-db.exe"), ["--datadir=" + data, "--port=" + plan2.port], {
         stdio: "ignore"
       });
     });
     await startServer(
       "mysql",
-      path38.join(bin, "mariadbd.exe"),
+      path39.join(bin, "mariadbd.exe"),
       ["--datadir=" + data, "--port=" + plan2.port, "--bind-address=127.0.0.1", "--console"],
       plan2.port
     );
@@ -29469,7 +29832,7 @@ var MysqlServer = class extends DatabaseServer {
 
 // src/guest/databases/postgres.ts
 import fs31 from "node:fs";
-import path39 from "node:path";
+import path40 from "node:path";
 function postgresData(version2) {
   return dataFor("postgres-" + version2.split(".")[0]);
 }
@@ -29484,8 +29847,8 @@ var PostgresServer = class extends DatabaseServer {
       return hit ? hit.major + "." + hit.latestMinor : Promise.reject(new Error("No supported PostgreSQL " + plan2.version));
     });
     const home = tool("postgres", exact);
-    const bin = path39.join(home, "bin");
-    if (!exists(path39.join(bin, "pg_ctl.exe"))) {
+    const bin = path40.join(home, "bin");
+    if (!exists(path40.join(bin, "pg_ctl.exe"))) {
       log("Downloading PostgreSQL " + exact + " (~330 MB once) ...");
       await downloader.archive(
         "https://get.enterprisedb.com/postgresql/postgresql-" + exact + "-1-windows-x64-binaries.zip",
@@ -29502,7 +29865,7 @@ var PostgresServer = class extends DatabaseServer {
     await createOnce(data, "PG_VERSION", async () => {
       log("Creating the PostgreSQL database (first start) ...");
       await execAsync(
-        path39.join(bin, "initdb.exe"),
+        path40.join(bin, "initdb.exe"),
         ["-D", data, "-U", "postgres", "-A", "trust", "-E", "UTF8", "--locale=C"],
         { stdio: "ignore" }
       );
@@ -29511,7 +29874,7 @@ var PostgresServer = class extends DatabaseServer {
       throw new Error("port " + plan2.port + " is already in use (change databases.postgres.port)");
     await clearStaleLocks(data, ["postmaster.pid"], plan2.port);
     await execAsync(
-      path39.join(bin, "pg_ctl.exe"),
+      path40.join(bin, "pg_ctl.exe"),
       [
         "start",
         "-D",
@@ -29520,7 +29883,7 @@ var PostgresServer = class extends DatabaseServer {
         "-t",
         "60",
         "-l",
-        path39.join(logsDir, "postgres.log"),
+        path40.join(logsDir, "postgres.log"),
         "-o",
         "-p " + plan2.port + " -c listen_addresses=localhost"
       ],
@@ -29537,8 +29900,8 @@ var PostgresServer = class extends DatabaseServer {
     if (exists(tool("postgres"))) {
       for (const version2 of fs31.readdirSync(tool("postgres"))) {
         const data = postgresData(version2);
-        const pgCtl = path39.join(tool("postgres", version2), "bin", "pg_ctl.exe");
-        if (exists(path39.join(data, "postmaster.pid")) && exists(pgCtl))
+        const pgCtl = path40.join(tool("postgres", version2), "bin", "pg_ctl.exe");
+        if (exists(path40.join(data, "postmaster.pid")) && exists(pgCtl))
           await execAsync(pgCtl, ["stop", "-D", data, "-m", "fast", "-w"], { stdio: "ignore" });
       }
     }
@@ -29547,12 +29910,12 @@ var PostgresServer = class extends DatabaseServer {
 };
 
 // src/guest/databases/redis.ts
-import path40 from "node:path";
+import path41 from "node:path";
 var RedisServer = class extends DatabaseServer {
   id = "redis";
   async start(env, plan2) {
     const home = tool("redis");
-    if (!exists(path40.join(home, "redis-server.exe"))) {
+    if (!exists(path41.join(home, "redis-server.exe"))) {
       await installFromGithub("redis-windows/redis-windows", /^Redis-[\d.]+-Windows-x64-msys2\.zip$/, {
         dest: home,
         what: (a) => "Redis (" + a.name + ", ~10 MB once)",
@@ -29562,7 +29925,7 @@ var RedisServer = class extends DatabaseServer {
     const data = mkdirp(dataFor("redis"));
     await startServer(
       "redis",
-      path40.join(home, "redis-server.exe"),
+      path41.join(home, "redis-server.exe"),
       ["--port", String(plan2.port), "--bind", "127.0.0.1", "--dir", data.replace(/\\/g, "/"), "--appendonly", "yes"],
       plan2.port
     );
@@ -29601,15 +29964,15 @@ async function setupDatabase(env, plan2) {
 
 // src/guest/toolchains/tools/git.ts
 import fs33 from "node:fs";
-import path42 from "node:path";
+import path43 from "node:path";
 
 // src/guest/runtime/csc.ts
 import fs32 from "node:fs";
 import os6 from "node:os";
-import path41 from "node:path";
+import path42 from "node:path";
 import crypto3 from "node:crypto";
 import { spawnSync as spawnSync5 } from "node:child_process";
-var CSC = path41.join(process.env.WINDIR ?? "C:\\Windows", "Microsoft.NET", "Framework64", "v4.0.30319", "csc.exe");
+var CSC = path42.join(process.env.WINDIR ?? "C:\\Windows", "Microsoft.NET", "Framework64", "v4.0.30319", "csc.exe");
 var SOURCES = {
   ptyhost: "PtyHost.cs",
   gitshim: "GitShim.cs",
@@ -29621,17 +29984,17 @@ var SOURCES = {
   memgov: "MemGov.cs"
 };
 function sourceOf(name) {
-  return path41.join(launchDir, "sandbox", "csharp", SOURCES[name]);
+  return path42.join(launchDir, "sandbox", "csharp", SOURCES[name]);
 }
 function sourceHash(name) {
   return crypto3.createHash("sha256").update(fs32.readFileSync(sourceOf(name))).digest("hex").slice(0, 12);
 }
 function ensureCompiled(name) {
-  const exe = path41.join(os6.tmpdir(), "agent-sandbox", name + "-" + sourceHash(name) + ".exe");
+  const exe = path42.join(os6.tmpdir(), "agent-sandbox", name + "-" + sourceHash(name) + ".exe");
   if (exists(exe)) return exe;
   if (!exists(CSC))
     throw new Error("The .NET Framework C# compiler was not found at " + CSC + " (it ships with Windows 10/11).");
-  mkdirp(path41.dirname(exe));
+  mkdirp(path42.dirname(exe));
   const result = spawnSync5(CSC, ["/nologo", "/optimize", "/target:exe", "/out:" + exe, sourceOf(name)], {
     encoding: "utf8",
     windowsHide: true
@@ -29670,18 +30033,18 @@ var installPortableGit = async (root) => {
 };
 var installGuard = (env, access, realGit) => {
   const dir = mkdirp(tool("gitguard"));
-  const guard = path42.join(launchDir, "runtime", "gitguard.js");
-  if (duringSession() && (exists(path42.join(dir, "git.exe")) || exists(path42.join(dir, "git.cmd")))) {
+  const guard = path43.join(launchDir, "runtime", "gitguard.js");
+  if (duringSession() && (exists(path43.join(dir, "git.exe")) || exists(path43.join(dir, "git.cmd")))) {
   } else
     try {
-      fs33.copyFileSync(ensureCompiled("gitshim"), path42.join(dir, "git.exe"));
-      fs33.rmSync(path42.join(dir, "git.cmd"), { force: true });
+      fs33.copyFileSync(ensureCompiled("gitshim"), path43.join(dir, "git.exe"));
+      fs33.rmSync(path43.join(dir, "git.cmd"), { force: true });
     } catch (e) {
       warn("git guard: falling back to git.cmd (" + errMsg(e) + ")");
-      fs33.writeFileSync(path42.join(dir, "git.cmd"), '@"' + process.execPath + '" "' + guard + '" %*\r\n');
+      fs33.writeFileSync(path43.join(dir, "git.cmd"), '@"' + process.execPath + '" "' + guard + '" %*\r\n');
     }
   fs33.writeFileSync(
-    path42.join(dir, "bashenv.sh"),
+    path43.join(dir, "bashenv.sh"),
     'git() { "' + posix(process.execPath) + '" "' + posix(guard) + '" "$@"; }\nexport -f git\n'
   );
   env.prepend.unshift(dir);
@@ -29690,13 +30053,13 @@ var installGuard = (env, access, realGit) => {
     AGENT_REAL_GIT: access === "readonly" ? realGit : "",
     AGENT_GUARD_NODE: process.execPath,
     AGENT_GUARD_SCRIPT: guard,
-    BASH_ENV: posix(path42.join(dir, "bashenv.sh"))
+    BASH_ENV: posix(path43.join(dir, "bashenv.sh"))
   });
   if (access === "readonly") {
-    const hooks = mkdirp(path42.join(dir, "hooks"));
+    const hooks = mkdirp(path43.join(dir, "hooks"));
     for (const hook of BLOCKED_HOOKS)
       fs33.writeFileSync(
-        path42.join(hooks, hook),
+        path43.join(hooks, hook),
         '#!/bin/sh\necho "git is read-only in this sandbox: ' + hook + ' refused." >&2\nexit 1\n'
       );
     Object.assign(env.vars, {
@@ -29705,12 +30068,12 @@ var installGuard = (env, access, realGit) => {
       GIT_CONFIG_VALUE_0: posix(hooks)
     });
   } else {
-    env.vars.GIT_DIR = path42.join(dataDir, "git-disabled");
+    env.vars.GIT_DIR = path43.join(dataDir, "git-disabled");
   }
 };
 var pointAtOwnCertificates = (root) => {
-  const config2 = path42.join(root, "etc", "gitconfig");
-  const bundle = path42.join(root, "mingw64", "etc", "ssl", "certs", "ca-bundle.crt");
+  const config2 = path43.join(root, "etc", "gitconfig");
+  const bundle = path43.join(root, "mingw64", "etc", "ssl", "certs", "ca-bundle.crt");
   if (!exists(config2) || !exists(bundle)) return;
   const text = fs33.readFileSync(config2, "utf8");
   const fixed = text.replace(/^(\s*sslCAInfo\s*=\s*).*$/gim, (_m, key2) => key2 + posix(bundle));
@@ -29718,9 +30081,9 @@ var pointAtOwnCertificates = (root) => {
 };
 async function setupGit(env, hostCopy, refresh, access) {
   const root = tool("git");
-  const bash = path42.join(root, "bin", "bash.exe");
-  const gitExe = path42.join(root, "cmd", "git.exe");
-  const hostGit = path42.join(hostToolsDir, "git");
+  const bash = path43.join(root, "bin", "bash.exe");
+  const gitExe = path43.join(root, "cmd", "git.exe");
+  const hostGit = path43.join(hostToolsDir, "git");
   if (exists(root) && !exists(bash)) {
     log("Replacing the old MinGit (no bash) with full Git for Windows.");
     safeRemove(root, toolsDir);
@@ -29734,11 +30097,11 @@ async function setupGit(env, hostCopy, refresh, access) {
     }
     const work = stagingFolder(root);
     try {
-      if (hostCopy && exists(path42.join(hostGit, "bin", "bash.exe"))) {
+      if (hostCopy && exists(path43.join(hostGit, "bin", "bash.exe"))) {
         log("Copying Git for Windows from this PC ...");
         robocopy(hostGit, work);
       } else await installPortableGit(work);
-      if (!exists(path42.join(work, "bin", "bash.exe"))) throw new Error("bash.exe missing after installing Git");
+      if (!exists(path43.join(work, "bin", "bash.exe"))) throw new Error("bash.exe missing after installing Git");
       moveIntoPlace(work, root);
     } finally {
       safeRemove(work, toolsDir);
@@ -29747,10 +30110,10 @@ async function setupGit(env, hostCopy, refresh, access) {
   if (!exists(bash)) throw new Error("bash.exe missing after installing Git");
   pointAtOwnCertificates(root);
   env.vars.CLAUDE_CODE_GIT_BASH_PATH = bash;
-  env.append.push(path42.join(root, "usr", "bin"));
+  env.append.push(path43.join(root, "usr", "bin"));
   const version2 = execOutput(gitExe, ["--version"]).replace(/^git version /, "");
   if (access === "full") {
-    env.prepend.push(path42.join(root, "cmd"));
+    env.prepend.push(path43.join(root, "cmd"));
     env.summary.push("git: " + version2);
     return;
   }
@@ -29762,7 +30125,7 @@ async function setupGit(env, hostCopy, refresh, access) {
 
 // src/guest/toolchains/languages/go.ts
 import fs34 from "node:fs";
-import path43 from "node:path";
+import path44 from "node:path";
 
 // src/guest/toolchains/package-ledger.ts
 var LedgerSchema = external_exports.record(external_exports.string(), external_exports.string());
@@ -29816,7 +30179,7 @@ async function setupGo(env, config2) {
   }
   const version2 = await resolveCached("go:" + config2.version, async () => (await findRelease(config2.version)).version);
   const root = tool("go", version2);
-  if (!exists(path43.join(root, "bin", "go.exe"))) {
+  if (!exists(path44.join(root, "bin", "go.exe"))) {
     const goArch = arch === "arm64" ? "arm64" : "amd64";
     const file3 = (await findRelease(version2)).files.find(
       (f) => f.os === "windows" && f.arch === goArch && f.kind === "archive"
@@ -29833,16 +30196,16 @@ async function setupGo(env, config2) {
   const vars = {
     GOROOT: root,
     GOPATH,
-    GOBIN: path43.join(GOPATH, "bin"),
-    GOMODCACHE: path43.join(GOPATH, "pkg", "mod"),
+    GOBIN: path44.join(GOPATH, "bin"),
+    GOMODCACHE: path44.join(GOPATH, "pkg", "mod"),
     GOCACHE: tool("go-cache"),
     GOTOOLCHAIN: "auto",
     GOTELEMETRY: "off"
   };
   fs34.mkdirSync(vars.GOBIN, { recursive: true });
   Object.assign(env.vars, vars);
-  env.prepend.push(path43.join(root, "bin"), vars.GOBIN);
-  const go = path43.join(root, "bin", "go.exe");
+  env.prepend.push(path44.join(root, "bin"), vars.GOBIN);
+  const go = path44.join(root, "bin", "go.exe");
   env.summary.push("go: " + versionOf(go, ["version"]));
   await installOnce(
     env,
@@ -29900,77 +30263,6 @@ function decideCli(settings, ctx) {
   return Object.fromEntries(CLI_NAMES.map((name) => [name, decide2(name)]));
 }
 
-// src/guest/toolchains/runtimes.ts
-import path44 from "node:path";
-async function setupSingleExe(env, name, repo, pattern, exeName, dir, options = {}) {
-  if (dryRun) {
-    log("(dry run) would provision " + name);
-    return;
-  }
-  const bin = options.subdir ? path44.join(dir, options.subdir) : dir;
-  const exe = path44.join(bin, exeName);
-  if (!exists(exe) || options.refresh) {
-    const size = options.size ? ", ~" + options.size : "";
-    await installFromGithub(repo, pattern, {
-      dest: dir,
-      what: (a) => name + " (" + a.name + size + " once)",
-      ...options.subdir ? {} : { locate: exeName }
-    });
-  }
-  if (!exists(exe)) throw new Error(exeName + " missing after installing " + name);
-  env.prepend.push(bin);
-  env.summary.push(name + ": " + versionOf(exe, options.versionArgs) + (options.note ?? ""));
-}
-async function setupBun(env) {
-  await setupSingleExe(
-    env,
-    "bun",
-    "oven-sh/bun",
-    arch === "arm64" ? /^bun-windows-aarch64\.zip$/ : /^bun-windows-x64\.zip$/,
-    "bun.exe",
-    tool("bun", "bin"),
-    { size: "35 MB" }
-  );
-  Object.assign(env.vars, {
-    BUN_INSTALL: tool("bun"),
-    BUN_INSTALL_CACHE_DIR: path44.join(localDir, "bun-cache"),
-    BUN_TMPDIR: path44.join(localDir, "bun-tmp")
-  });
-}
-async function setupDeno(env) {
-  await setupSingleExe(
-    env,
-    "deno",
-    "denoland/deno",
-    arch === "arm64" ? /^deno-aarch64-pc-windows-msvc[.]zip$/ : /^deno-x86_64-pc-windows-msvc[.]zip$/,
-    "deno.exe",
-    tool("deno", "bin"),
-    { size: "40 MB" }
-  );
-  Object.assign(env.vars, { DENO_DIR: tool("deno-cache"), DENO_INSTALL_ROOT: tool("deno"), DENO_NO_UPDATE_CHECK: "1" });
-}
-function uvVars() {
-  return {
-    UV_CACHE_DIR: tool("uv-cache"),
-    UV_PYTHON_INSTALL_DIR: tool("uv-python"),
-    UV_TOOL_DIR: tool("uv-tools"),
-    UV_TOOL_BIN_DIR: tool("uv-bin")
-  };
-}
-async function setupUv(env) {
-  await setupSingleExe(
-    env,
-    "uv",
-    "astral-sh/uv",
-    arch === "arm64" ? /^uv-aarch64-pc-windows-msvc\.zip$/ : /^uv-x86_64-pc-windows-msvc\.zip$/,
-    "uv.exe",
-    tool("uv"),
-    { size: "20 MB" }
-  );
-  Object.assign(env.vars, uvVars());
-  env.prepend.push(mkdirp(tool("uv-bin")));
-}
-
 // src/guest/toolchains/tools/cli.ts
 function ghConfigDir() {
   return path45.join(stateDir, "gh");
@@ -31610,7 +31902,12 @@ function plan(config2, versions, o) {
     },
     { name: "Deno", enabled: wanted(config2.deno.enabled, "deno"), install: (env) => setupDeno(env) },
     { name: "Bun", enabled: wanted(config2.bun.enabled, "bun"), install: (env) => setupBun(env) },
-    { name: "uv", enabled: wanted(config2.uv.enabled, "uv"), install: (env) => setupUv(env) },
+    // Headroom (an agent add-on) installs with uv: the uv step runs for it too, before the apps.
+    {
+      name: "uv",
+      enabled: wanted(config2.uv.enabled, "uv") || appsNeedUv(o.apps),
+      install: (env) => setupUv(env)
+    },
     { name: "PowerShell 7", enabled: wanted(config2.pwsh.enabled, "pwsh"), install: (env) => setupPwsh(env, o.refresh) },
     // The openssl tool comes from Git's install: after Git.
     {
@@ -31636,7 +31933,7 @@ function plan(config2, versions, o) {
       name: "Apps",
       enabled: apps,
       shared: true,
-      after: ["Mesa 3D", "Visual C++ runtime"],
+      after: ["Mesa 3D", "Visual C++ runtime", "uv"],
       install: (env) => setupApps(env, o.apps, { gitAccess: o.gitAccess, refresh: o.refresh })
     },
     {
@@ -31820,6 +32117,7 @@ async function setupToolchains(config2, versions, options, run2 = {}) {
     env.summary.push(...part.summary);
   }
   Object.assign(env.vars, config2.environment);
+  Object.assign(env.vars, envs.get("Git")?.vars);
   log("Set up " + steps.length + " toolchains and databases.");
   return env;
 }
@@ -32016,6 +32314,7 @@ function execCommand(req) {
 }
 
 // src/guest/daemon/sessions.ts
+import fs53 from "node:fs";
 import path68 from "node:path";
 import crypto4 from "node:crypto";
 import os11 from "node:os";
@@ -32028,6 +32327,8 @@ var FrameType = {
   Resize: 3,
   Restart: 4,
   Ping: 5,
+  /** Ends the program and everything it started, and with it the session. */
+  Close: 6,
   Output: 16,
   Exit: 17,
   Error: 18,
@@ -32111,6 +32412,16 @@ function cmdArgs(args) {
 function commandLine(file3, args) {
   return path64.win32.basename(file3).toLowerCase() === "cmd.exe" ? [quoteArg(file3), cmdArgs(args)].filter(Boolean).join(" ") : [file3, ...args].map(quoteArg).join(" ");
 }
+function shellLaunch(asked, paths) {
+  if (asked === "cmd") return { name: "cmd", file: paths.cmd, args: [] };
+  if (asked === "powershell" || asked === "auto" && !paths.pwsh)
+    return { name: "powershell", file: paths.powershell, args: ["-NoLogo"] };
+  if (!paths.pwsh)
+    throw new Error(
+      "PowerShell 7 is not installed in this sandbox (toolchains.pwsh). Open powershell or cmd instead, or turn pwsh on."
+    );
+  return { name: "pwsh", file: paths.pwsh, args: ["-NoLogo"] };
+}
 
 // src/guest/sessions/pty-host.ts
 import fs50 from "node:fs";
@@ -32330,6 +32641,8 @@ var IdleShutdown = class {
 };
 
 // src/guest/daemon/sessions.ts
+var CLOSE_WAIT_MS = 8e3;
+var ROOTS_KEPT_MS = 10 * 60 * 1e3;
 function terminalTab(id, title, cwd) {
   const view = [process.execPath, path68.join(path68.dirname(process.argv[1]), "view.js"), id];
   const wt = path68.join(toolsDir, "terminal", "wt.exe");
@@ -32374,14 +32687,38 @@ function writeBudget(cpus, memoryGb, jobs, env) {
     warn("budget.json could not be written: " + errMsg(e));
   }
 }
-var launchPtyHost = async (req, remote, env, say, sessions2) => {
+var agentProgram = async (req, env, say) => {
   const harness = harnessFor(req);
   say("Preparing " + req.harness);
   await agents.provision(req.harness, harness, env, false);
   const launch = agents.resolveLaunch(req.harness, harness);
   const base = [...launch.args, ...harness.arguments];
+  return {
+    command: commandLine(launch.file, [...base, ...req.args]),
+    restartCommand: commandLine(launch.file, [...base, ...harness.resumeArguments ?? []]),
+    environment: harness.environment
+  };
+};
+function shellPaths() {
+  const candidates = [
+    path68.join(pwshDir(), "pwsh.exe"),
+    path68.join(process.env.ProgramFiles ?? "C:\\Program Files", "PowerShell", "7", "pwsh.exe")
+  ];
+  return { pwsh: candidates.find((f) => fs53.existsSync(f)) ?? null, powershell: SYSTEM.powershell(), cmd: SYSTEM.cmd() };
+}
+var shellProgram = (shell) => {
+  const line = commandLine(shell.file, shell.args);
+  return { command: line, restartCommand: line, environment: {} };
+};
+var launchPtyHost = async (req, program, remote, env, sessions2, onSpawn) => {
   const port = await freePort();
   const token = crypto4.randomBytes(24).toString("base64url");
+  const sessionEnv = {
+    ...withRegistryPath(env),
+    ...program.environment,
+    ...memoryEnv(env, sessions2)
+  };
+  if (req.shell) delete sessionEnv.PSModulePath;
   const child = startPtyHost({
     exe: ensurePtyHost(),
     port,
@@ -32390,11 +32727,12 @@ var launchPtyHost = async (req, remote, env, say, sessions2) => {
     rows: 32,
     id: req.id,
     cwd: req.cwd,
-    env: { ...withRegistryPath(env), ...harness.environment, ...memoryEnv(env, sessions2) },
+    env: sessionEnv,
     remote,
-    command: commandLine(launch.file, [...base, ...req.args]),
-    restartCommand: commandLine(launch.file, [...base, ...harness.resumeArguments ?? []])
+    command: program.command,
+    restartCommand: program.restartCommand
   });
+  onSpawn(child);
   try {
     await waitForPtyHost(child, port, 15e3);
   } catch (e) {
@@ -32407,6 +32745,17 @@ var launchPtyHost = async (req, remote, env, say, sessions2) => {
 };
 var placeFor = async (req, say) => {
   if (!req.project) {
+    const known = insidePrimary(req.cwd) ? null : provisioner.provisionedFor(req.cwd);
+    if (known && exists(req.cwd))
+      return {
+        env: known.env,
+        hooks: known.spec.hooks ? projectHooks(known.spec.name, known.spec.workspace) : null,
+        project: known.spec.name
+      };
+    if (!insidePrimary(req.cwd) && insideWorkspace(req.cwd))
+      throw new Error(
+        "The project in " + req.cwd + " is not set up in the sandbox yet: run sandbox start in its folder first."
+      );
     if (!insidePrimary(req.cwd) || !exists(req.cwd))
       throw new Error("Folder is not inside the sandbox workspace " + workspace + ": " + req.cwd);
     return { env: process.env, hooks: null, project: primaryProject() };
@@ -32434,20 +32783,49 @@ var SessionManager = class {
   /** Sessions and projects being set up right now (a headless sandbox must not shut down under them). */
   starting = 0;
   idle = new IdleShutdown(() => this.live.size > 0 || this.starting > 0);
+  /** Each session's ptyhost (process id and when it ran), for linking the programs it starts to it (audit). */
+  ptyHosts = /* @__PURE__ */ new Map();
   /** How many sessions are running. */
   get count() {
     return this.live.size;
   }
-  /** `session` requests: an agent in its own ptyhost, in the launch folder's project or a registered one. */
+  /** The sessions' ptyhosts, running or ended within ROOTS_KEPT_MS (audit events arrive after they happen). */
+  roots() {
+    const cutoff = Date.now() - ROOTS_KEPT_MS;
+    for (const [id, r] of this.ptyHosts) if (r.to !== void 0 && r.to < cutoff) this.ptyHosts.delete(id);
+    return [...this.ptyHosts.values()];
+  }
+  rootStarted(id, child, from) {
+    if (child.pid) this.ptyHosts.set(id, { session: id, pid: child.pid, from });
+    child.once("exit", () => this.rootEnded(id));
+  }
+  rootEnded(id) {
+    const r = this.ptyHosts.get(id);
+    if (r && r.to === void 0) this.ptyHosts.set(id, { ...r, to: Date.now() });
+  }
+  /**
+   * `session` requests: an agent (or a plain shell) in its own ptyhost, in the launch folder's project or a registered
+   * one.
+   */
   async start(req) {
+    let shell = null;
+    let problem = null;
+    if (req.shell)
+      try {
+        shell = shellLaunch(req.shell, shellPaths());
+      } catch (e) {
+        problem = errMsg(e);
+      }
+    const name = shell?.name ?? (req.shell ? "shell" : req.harness);
     let status = {
       id: req.id,
       launchId: session.launchId,
-      harness: req.harness,
+      harness: name,
+      ...req.shell ? { kind: "shell" } : {},
       cwd: req.cwd,
       ...req.project ? { project: req.project.name } : {},
       phase: "starting",
-      message: "Starting " + req.harness,
+      message: "Starting " + name,
       updatedAt: now(),
       startedAt: now()
     };
@@ -32458,28 +32836,40 @@ var SessionManager = class {
     };
     this.starting++;
     if (req.id !== session.launchId && process.env.AGENT_NO_TABS !== "1")
-      safely("terminal tab", () => terminalTab(req.id, req.harness + " " + path68.basename(req.cwd), req.cwd));
+      safely("terminal tab", () => terminalTab(req.id, name + " " + path68.basename(req.cwd), req.cwd));
     try {
+      if (problem) throw new Error(problem);
       const place = await placeFor(req, say);
+      const program = shell ? shellProgram(shell) : await agentProgram(req, place.env, say);
       const remote = session.networking && session.attach.enabled;
-      const { child, port, token } = await launchPtyHost(req, remote, place.env, say, this.live.size + 1);
-      const resumed = req.harness === "claude" ? resumedConversation(req.args) : void 0;
+      const from = Date.now();
+      const { child, port, token } = await launchPtyHost(
+        req,
+        program,
+        remote,
+        place.env,
+        this.live.size + 1,
+        (c) => this.rootStarted(req.id, c, from)
+      );
+      const agent = shell === null;
+      const resumed = agent && req.harness === "claude" ? resumedConversation(req.args) : void 0;
       const running = {
         ...status,
         ...resumed ? { conversation: resumed } : {},
         project: place.project,
         phase: "running",
-        message: req.harness + " is running",
+        message: name + " is running",
         attach: { addresses: remote ? guestAddresses() : [], port, token }
       };
       this.live.set(req.id, { status: running, child });
       child.once("exit", (code) => this.onExit(running, place, code));
       saveStatus(running);
-      if (req.harness === "claude") this.trackConversation(running.id, resumed);
+      if (agent && req.harness === "claude") this.trackConversation(running.id, resumed);
       log(
-        "Session " + req.id + " started (" + req.harness + " in " + req.cwd + ", project " + place.project + ", port " + port + ")"
+        "Session " + req.id + " started (" + name + " in " + req.cwd + ", project " + place.project + ", port " + port + ")"
       );
     } catch (e) {
+      this.rootEnded(req.id);
       saveStatus({ ...status, phase: "failed", message: errMsg(e) });
       warn("Session " + req.id + " failed: " + errMsg(e));
       this.idle.check();
@@ -32505,10 +32895,13 @@ var SessionManager = class {
       this.idle.check();
     }
   }
-  /** `restart` requests: the matching sessions restart their agent (continuing the conversation where it can). */
+  /**
+   * `restart` requests: the matching sessions restart their agent (continuing the conversation where it can). Shells
+   * are left alone: restarting one would only throw away what it was doing.
+   */
   async restart(req) {
     const targets = [...this.live.values()].filter(
-      (s) => s.status.attach && (req.harness === null || s.status.harness === req.harness) && (!req.cwd || isWithin(req.cwd, s.status.cwd))
+      (s) => s.status.attach && s.status.kind !== "shell" && (req.harness === null || s.status.harness === req.harness) && (!req.cwd || isWithin(req.cwd, s.status.cwd))
     );
     for (const s of targets)
       await sendControl(
@@ -32517,6 +32910,41 @@ var SessionManager = class {
       );
     respond(req.id, { ok: true, message: "restarted " + targets.length + " session(s)" });
   }
+  /**
+   * `close` requests: the session's ptyhost ends its program and everything it started (ProcessTree), then exits as
+   * if the program had. One that does not end in time has its ptyhost ended instead (closing the pseudo console ends
+   * what is attached to it).
+   */
+  async close(req) {
+    const entry = this.live.get(req.session);
+    if (!entry?.status.attach) {
+      respond(req.id, { ok: false, message: "Session " + req.session + " is not running." });
+      return;
+    }
+    const { child, status } = entry;
+    const ended = new Promise((resolve2) => {
+      if (child.exitCode !== null || child.signalCode !== null) return resolve2(true);
+      const timer = setTimeout(() => resolve2(false), CLOSE_WAIT_MS);
+      child.once("exit", () => {
+        clearTimeout(timer);
+        resolve2(true);
+      });
+    });
+    try {
+      await sendControl(
+        { addresses: ["127.0.0.1"], port: status.attach.port, token: status.attach.token },
+        FrameType.Close
+      );
+    } catch (e) {
+      warn("Session " + req.session + " did not take the close request: " + errMsg(e));
+    }
+    if (!await ended) {
+      warn("Session " + req.session + " did not end in time; ending its session host.");
+      safely("ending a session host", () => child.kill());
+    }
+    log("Session " + req.session + " closed on request");
+    respond(req.id, { ok: true, message: "Closed " + status.harness + " session " + req.session + "." });
+  }
   /**
    * Finds out which of Claude's conversation files this session writes (it appears with the first message) and puts
    * it in the status, so the host can reopen this very conversation. A reopened session starts with the one it was
@@ -32559,6 +32987,10 @@ var SessionManager = class {
       attach: void 0
     });
     log("Session " + running.id + " ended (exit " + code + ")");
+    if (running.kind === "shell") {
+      this.idle.check();
+      return;
+    }
     if (place.hooks)
       void runHooksAsync("post-agent", place.env, place.hooks).catch(
         (e) => warn("post-agent hooks failed: " + errMsg(e))
@@ -32898,7 +33330,7 @@ var GovernorCore = class {
 };
 
 // src/guest/governor/governor.ts
-import fs53 from "node:fs";
+import fs54 from "node:fs";
 import os12 from "node:os";
 import path69 from "node:path";
 import { spawn as spawn8 } from "node:child_process";
@@ -32971,11 +33403,11 @@ var MemGovProcess = class {
 function appendToMemoryLog(line) {
   try {
     const logs = path69.join(dataDir, "logs");
-    const newest = fs53.readdirSync(logs).filter((f) => /^memory-\d{8}-\d{6}\.log$/.test(f)).sort().pop();
+    const newest = fs54.readdirSync(logs).filter((f) => /^memory-\d{8}-\d{6}\.log$/.test(f)).sort().pop();
     if (!newest) return;
     const t = /* @__PURE__ */ new Date();
     const stamp = [t.getHours(), t.getMinutes(), t.getSeconds()].map((n) => String(n).padStart(2, "0")).join(":");
-    fs53.appendFileSync(path69.join(logs, newest), stamp + " | " + line + "\r\n");
+    fs54.appendFileSync(path69.join(logs, newest), stamp + " | " + line + "\r\n");
   } catch {
   }
 }
@@ -33032,9 +33464,9 @@ var Daemon = class {
   tick() {
     const { valid, invalid } = run.scanRequests();
     for (const file3 of invalid)
-      safely("removing an invalid request", () => fs54.rmSync(file3, { recursive: true, force: true }));
+      safely("removing an invalid request", () => fs55.rmSync(file3, { recursive: true, force: true }));
     for (const req of valid) {
-      safely("claiming a request", () => fs54.rmSync(run.requestFile(req.id), { force: true }));
+      safely("claiming a request", () => fs55.rmSync(run.requestFile(req.id), { force: true }));
       if (run.readSession(req.id)) continue;
       void Promise.resolve(this.handle(withRequestSecrets(req))).catch(
         (e) => respond(req.id, { ok: false, message: errMsg(e) })
@@ -33056,6 +33488,8 @@ var Daemon = class {
         return execCommand(req);
       case "restart":
         return sessions.restart(req);
+      case "close":
+        return sessions.close(req);
       case "pressure":
         return governor.hostPressure(req.seconds, req.reason, req.level ?? "slow");
       case "ping":
@@ -33070,7 +33504,7 @@ process.on("unhandledRejection", (e) => warn("daemon: unexpected error (continui
 adoptBootSecrets();
 log("Session daemon started (pid " + process.pid + ").");
 safely("port forwards", startRelays);
-safely("audit", startProcessCollector);
+safely("audit", () => startProcessCollector(() => sessions.roots()));
 safely("memory governor", () => governor.start());
 log("Memory governor: " + governor.describe());
 new Daemon().start();