windows-development-sandbox 1.11.7 → 1.13.0

package/dist/runtime/db.js

@@ -25517,14 +25517,19 @@ var NetworkSchema = external_exports.strictObject({
 });
 var AuditSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "Keep an audit log on this PC of what happened in your sandboxes: programs started (with their command lines), files changed in the project, sessions, and what the repo guard caught. The sandbox cannot change it. Read it with sandbox audit."
+    "Keep an audit log on this PC of what your agents did: programs started (with their command lines, secrets hidden), files changed in the projects, git commits, sessions, and what the repo guard caught, each linked to the agent session that did it where that can be known. The sandbox cannot change it. Read it with sandbox audit or on the Activity page."
+  ),
+  days: external_exports.number().int().min(1).max(365).describe(
+    "Days the audit log is kept (1 to 30; a larger number keeps 30); older days are deleted when a sandbox starts and once a day."
   ),
-  days: external_exports.number().int().min(1).max(365).describe("Days the audit log is kept."),
   maxMb: external_exports.number().int().min(5).max(5e3).describe("Most space the audit log may take, in MB (older days go first). Days before today are compressed."),
   processes: external_exports.boolean().describe(
     "Record every program started in the sandbox with its command line (Windows process auditing; repeated runs are counted, not listed)."
   ),
-  files: external_exports.boolean().describe("Record the files changed in the project while the sandbox runs.")
+  files: external_exports.boolean().describe("Record the files changed in the projects while the sandbox runs."),
+  commits: external_exports.boolean().describe(
+    "Record the git commits made in the projects while the sandbox runs (read from each project's .git folder on this PC)."
+  )
 });
 var WorkspaceFilterSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
@@ -25727,7 +25732,100 @@ var ToolchainsSchema = external_exports.strictObject({
 
 // src/shared/apps/catalogue.ts
 var gh = (github, asset) => ({ github, asset });
+var RTK_VERSION = "1.0.1";
+var RTK_URL = "https://github.com/rtk-ai/rtk/releases/download/v" + RTK_VERSION + "/rtk-oss-x86_64-pc-windows-msvc.zip";
+var RTK_SHA256 = "0e53e2eca471e15fbd3636e64e6bc0b182cbc278ed0339c80450a2dd03f4cd6b";
+var HEADROOM_VERSION = "0.41.0";
+var CCUSAGE_VERSION = "20.0.36";
+var PLAYWRIGHT_MCP_VERSION = "0.0.83";
+var CONTEXT7_MCP_VERSION = "4.4.2";
 var APPS = [
+  // ---- agent add-ons
+  {
+    id: "rtk",
+    name: "rtk (Rust Token Killer)",
+    category: "agents",
+    about: "Compacts the output of shell commands (git, tests, builds, ls ...) before the agent reads it, so it uses fewer tokens. Claude Code's Bash commands go through it on their own.",
+    size: "6 MB",
+    source: { url: RTK_URL, sha256: RTK_SHA256 },
+    exe: "rtk.exe",
+    cli: true,
+    plugsInto: "Claude Code through a hook in the sandbox's managed settings; other agents are told to use it",
+    userOnly: true
+  },
+  {
+    id: "headroom",
+    name: "Headroom",
+    category: "agents",
+    about: "Compresses what Claude Code sends to the model (tool output, logs, files) so it uses fewer tokens: a local proxy on 127.0.0.1:8787 that sits in Claude Code's API path, offline apart from forwarding to api.anthropic.com.",
+    size: "150 MB",
+    source: { locked: "uv", package: "headroom-ai", version: HEADROOM_VERSION },
+    exe: "headroom.exe",
+    service: true,
+    plugsInto: "Claude Code: the sandbox starts the proxy and points Claude Code at it (managed settings)",
+    userOnly: true
+  },
+  {
+    id: "ccusage",
+    name: "ccusage",
+    category: "agents",
+    about: "Reports the agents' token use and cost by day, month or session from their logs in the sandbox (`ccusage daily`; add --offline to skip fetching prices).",
+    size: "5 MB",
+    source: { locked: "npm", package: "ccusage", version: CCUSAGE_VERSION },
+    exe: "ccusage.cmd",
+    cli: true,
+    plugsInto: "Reads Claude Code's session logs in the sandbox; changes nothing",
+    userOnly: true
+  },
+  {
+    id: "playwright-mcp",
+    name: "Playwright MCP",
+    category: "agents",
+    about: "Lets Claude Code drive a browser (Microsoft Edge, already in the sandbox) to open pages, click, fill forms and take screenshots: the MCP server of microsoft/playwright-mcp.",
+    size: "20 MB",
+    source: { locked: "npm", package: "@playwright/mcp", version: PLAYWRIGHT_MCP_VERSION },
+    exe: "playwright-mcp.cmd",
+    service: true,
+    mcp: { name: "sbx-playwright", script: "node_modules/@playwright/mcp/cli.js", args: ["--browser", "msedge"] },
+    plugsInto: "Claude Code as the MCP server sbx-playwright (the sandbox's Claude settings)",
+    userOnly: true
+  },
+  {
+    id: "context7",
+    name: "Context7 MCP",
+    category: "agents",
+    about: "Up-to-date documentation and code examples for libraries, looked up by Claude Code while it works (upstash/context7). The library names and questions go to Upstash's context7.com.",
+    size: "55 MB",
+    source: { locked: "npm", package: "@upstash/context7-mcp", version: CONTEXT7_MCP_VERSION },
+    exe: "context7-mcp.cmd",
+    service: true,
+    mcp: { name: "sbx-context7", script: "node_modules/@upstash/context7-mcp/dist/index.js" },
+    plugsInto: "Claude Code as the MCP server sbx-context7 (the sandbox's Claude settings)",
+    userOnly: true
+  },
+  {
+    id: "claude-mem",
+    name: "claude-mem",
+    category: "agents",
+    about: "Persistent memory for Claude Code (a plugin you install on this PC): its database is brought into the sandbox.",
+    size: "",
+    source: { resolve: "setting" },
+    exe: "",
+    setting: "claudeProfile.syncClaudeMem",
+    plugsInto: "Claude Code, with your Claude settings copied from this PC",
+    userOnly: true
+  },
+  {
+    id: "rea",
+    name: "REA (Reverse Engineer Anything)",
+    category: "agents",
+    about: "Agent-driven reverse engineering (MCP server and CLI, by morluto). Run `rea setup` once to add it to Claude Code and Codex. Native binaries need Ghidra; needs Node 22.19+.",
+    size: "8 MB",
+    source: { npm: "rea-agents" },
+    exe: "rea.cmd",
+    cli: true,
+    plugsInto: "Claude Code and Codex as an MCP server, after `rea setup`"
+  },
   // ---- editors
   {
     id: "vscode",
@@ -26189,16 +26287,6 @@ var APPS = [
     cli: true
   },
   // ---- reverse engineering
-  {
-    id: "rea",
-    name: "REA (Reverse Engineer Anything)",
-    category: "reversing",
-    about: "Agent-driven reverse engineering (MCP server and CLI, by morluto). Run `rea setup` once to add it to Claude Code and Codex. Native binaries need Ghidra; needs Node 22.19+.",
-    size: "8 MB",
-    source: { npm: "rea-agents" },
-    exe: "rea.cmd",
-    cli: true
-  },
   {
     id: "ghidra",
     name: "Ghidra",
@@ -26478,6 +26566,8 @@ var APPS = [
 // src/core/schema/apps.ts
 var CATALOGUE_IDS = APPS.filter((a) => !a.setting).map((a) => a.id);
 var AppIdSchema = external_exports.enum(CATALOGUE_IDS);
+var PROJECT_IDS = APPS.filter((a) => !a.setting && !a.userOnly).map((a) => a.id);
+var ProjectAppIdSchema = external_exports.enum(PROJECT_IDS);
 var CustomAppIdSchema = external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,40}$/, "lower-case letters, digits and - only");
 var compiles = (pattern) => {
   try {
@@ -26501,6 +26591,11 @@ var CustomAppSchema = external_exports.strictObject({
 }).refine((a) => a.github && a.asset ? !a.url : Boolean(a.url) && !a.github && !a.asset, {
   message: "give github + asset, or url (not both)"
 });
+var ProjectAppsSchema = external_exports.strictObject({
+  install: external_exports.array(ProjectAppIdSchema).describe(
+    "Apps from the catalogue this project adds to yours (agent add-ons such as rtk, Headroom and the MCP servers are set in your own settings only)."
+  )
+});
 var AppsSchema = external_exports.strictObject({
   install: external_exports.array(AppIdSchema).describe(
     "Apps from the catalogue to install in every sandbox (the Apps screen in the menu lists them by category). Each is downloaded once and kept."
@@ -26541,12 +26636,39 @@ var ResumeSchema = external_exports.strictObject({
 });
 
 // src/core/schema/web.ts
+var REMOTE_ROLES = ["view", "control"];
+var WindowsUserNameSchema = external_exports.string().trim().min(1).max(120).regex(
+  /^(?:[A-Za-z0-9][A-Za-z0-9._ -]{0,62}\\)?[^\\/"[\]:;|=,+*?<>@]{1,64}$/,
+  "a Windows user name (name or DOMAIN\\name)"
+);
+var RemoteUserSchema = external_exports.strictObject({
+  name: WindowsUserNameSchema.describe("The Windows user (name, or DOMAIN\\name)"),
+  role: external_exports.enum(REMOTE_ROLES).describe("view: sees everything, terminals read-only. control: everything but remote access, logins and tokens.")
+});
+var WebLanSchema = external_exports.strictObject({
+  enabled: external_exports.boolean().describe(
+    "(Beta) Devices on your network (a phone): an HTTPS address on this PC for devices you pair with a one-time code (sandbox web pair). Needs a firewall rule (sandbox web lan on asks Windows once). Off: every paired device is signed out."
+  ),
+  port: external_exports.number().int().min(1024).max(65535).describe("HTTPS port for paired devices on your network."),
+  address: external_exports.string().trim().max(15).regex(/^$|^\d{1,3}(\.\d{1,3}){3}$/, "an IPv4 address or empty").describe("This PC's private address to listen on. Empty: the one of its network adapter (never a public one).")
+});
+var WebRemoteSchema = external_exports.strictObject({
+  windowsSignIn: external_exports.boolean().describe(
+    "(Beta) Other Windows users of this PC named in web.remote.users sign in to your web UI (and sandbox remote) with their own Windows account: no password, no link."
+  ),
+  users: external_exports.array(RemoteUserSchema).max(32).describe("Who else may sign in with Windows, and their role (view or control)."),
+  rememberDays: external_exports.number().int().min(1).max(90).describe(
+    "How many days a paired device or a Windows sign-in stays signed in (from when it signed in, not renewed)."
+  ),
+  lan: WebLanSchema
+});
 var WebSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
     "(Beta) The web UI: your sandbox sessions in a browser on this PC (http://127.0.0.1:<port>, this PC only). On: every sandbox start also starts it in the background (it keeps running until sandbox web stop or a restart of the PC). Off: only sandbox web start runs it. Open it signed in with sandbox web open."
   ),
   port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken."),
-  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts.")
+  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts."),
+  remote: WebRemoteSchema.describe("(Beta) Access for other Windows users of this PC and for paired devices.")
 });
 
 // src/core/schema/vpn.ts
@@ -26576,6 +26698,36 @@ var GithubSchema = external_exports.strictObject({
 });
 
 // src/core/schema/config.ts
+var RESERVED_ENV_PREFIX = /^(AGENT_|GIT_|GH_|GITHUB_|NODE_|NPM_CONFIG_(USERCONFIG|GLOBALCONFIG|PREFIX|SCRIPT_SHELL)|SSL_|CLAUDE|ANTHROPIC_|OPENAI_|CODEX_|GEMINI_|GOOGLE_|COPILOT_|AWS_|AZURE_)/i;
+var RESERVED_ENV_SUFFIX = /(_PROXY|_BASE_URL|_ENDPOINT|_CA_BUNDLE|_CA_CERTS)$/i;
+var RESERVED_ENV_NAMES = new Set(
+  [
+    "PATH",
+    "PATHEXT",
+    "BASH_ENV",
+    "ENV",
+    "COMSPEC",
+    "PSMODULEPATH",
+    "PYTHONPATH",
+    "PYTHONSTARTUP",
+    "PERL5OPT",
+    "RUBYOPT",
+    "JAVA_TOOL_OPTIONS",
+    "LD_PRELOAD",
+    "SYSTEMROOT",
+    "WINDIR",
+    "HOME",
+    "USERPROFILE",
+    "APPDATA",
+    "LOCALAPPDATA",
+    "PROGRAMDATA",
+    "TEMP",
+    "TMP"
+  ].map((n) => n.toUpperCase())
+);
+function reservedEnvName(name) {
+  return RESERVED_ENV_PREFIX.test(name) || RESERVED_ENV_SUFFIX.test(name) || RESERVED_ENV_NAMES.has(name.toUpperCase());
+}
 var ConfigSchema = external_exports.strictObject({
   $schema: SchemaRefSchema.optional(),
   defaultHarness: NameSchema.describe("Agent started by `sandbox launch` (sandbox claude always runs claude)."),
@@ -26642,10 +26794,14 @@ var LocalOverridesSchema = external_exports.strictObject({
   scripts: StringsSchema.describe(
     "Scripts (.ps1 / .mjs / .cmd, relative to this file) run inside the sandbox before the agent."
   ),
-  // This PC's resources are yours to share: CPU and paging file (this PC's disk) are not a project's to set.
+  // This PC's resources are yours to share: CPU, paging file (this PC's disk) and the RAM kept for this PC are not a
+  // project's to set.
   sandbox: SandboxSchema.omit({
     cpuLimit: true,
     pageFileMb: true,
+    reserveHostMb: true,
+    maxMemoryPercent: true,
+    maxMemoryMb: true,
     engine: true,
     agentMemoryHeadroomMb: true,
     pressureResponse: true
@@ -26659,14 +26815,17 @@ var LocalOverridesSchema = external_exports.strictObject({
   // Every toolchain setting, each one optional (a project usually only switches languages on or pins a version).
   toolchains: external_exports.strictObject({
     ...import_lodash.default.mapValues(import_lodash.default.omit(ToolchainsSchema.shape, "environment"), (shape) => shape.partial()),
-    environment: ToolchainsSchema.shape.environment
+    environment: ToolchainsSchema.shape.environment.refine(
+      (env) => !Object.keys(env).some(reservedEnvName),
+      "names the sandbox sets or that carry logins (AGENT_*, GIT_*, PATH, BASH_ENV, NODE_*, proxies, ANTHROPIC_*, CLAUDE_* ...) cannot be set by a project"
+    )
   }).partial(),
   databases: external_exports.strictObject(import_lodash.default.mapValues(DatabasesSchema.shape, (shape) => shape.partial())).partial(),
   attach: AttachSchema.partial(),
   personalization: toggle("Copy your desktop look into the sandbox.").partial(),
   // Catalogue apps only (a vetted list): your own programs (apps.custom) download anything, so a repo cannot add
-  // them.
-  apps: AppsSchema.pick({ install: true }).partial(),
+  // them, nor agent add-ons that are yours only (rtk hooks every agent command, Headroom sits in its API path).
+  apps: ProjectAppsSchema.partial(),
   claudeProfile: ClaudeProfileSchema.pick({
     enabled: true,
     overwrite: true,
@@ -26729,6 +26888,7 @@ var ProjectSpecSchema = external_exports.strictObject({
   /** Its hooks were staged in C:\AgentLaunch\projects\<name>\hooks. */
   hooks: external_exports.boolean()
 });
+var ShellChoiceSchema = external_exports.enum(["auto", "pwsh", "powershell", "cmd"]);
 var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
   external_exports.strictObject({
     kind: external_exports.literal("session"),
@@ -26738,8 +26898,12 @@ var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
     cwd: Text(),
     project: ProjectSpecSchema.optional(),
     harnessSpec: HarnessSchema.optional(),
+    /** A plain shell instead of an agent (harness is then "shell" and args are ignored). */
+    shell: ShellChoiceSchema.optional(),
     createdAt: TimeSchema
   }),
+  /** End a running session (an agent or a shell) and everything it started. */
+  external_exports.strictObject({ kind: external_exports.literal("close"), id: IdSchema, session: IdSchema, createdAt: TimeSchema }),
   /** Provision a registered project without starting an agent (sandbox start / exec / db from its folder). */
   external_exports.strictObject({ kind: external_exports.literal("project"), id: IdSchema, project: ProjectSpecSchema, createdAt: TimeSchema }),
   external_exports.strictObject({
@@ -26805,6 +26969,8 @@ var SessionStatusSchema = external_exports.object({
   id: IdSchema,
   launchId: Text(64),
   harness: Text(64),
+  /** A plain shell (harness is then the shell: pwsh, powershell or cmd); absent: an agent. */
+  kind: external_exports.enum(["agent", "shell"]).optional(),
   cwd: Text(),
   /** The project it runs in: its hub name, or the launch folder's for the first project. */
   project: Text(64).optional(),

package/dist/runtime/gitguard.js

@@ -62,6 +62,7 @@ var LISTING = {
 };
 var WITH_VALUE = /* @__PURE__ */ new Set(["-C", "--namespace"]);
 var FORBIDDEN_GLOBAL = /^(-c|--config-env|--exec-path|--git-dir|--work-tree|--super-prefix)(=|$)/;
+var RUNS_OR_WRITES = /^(--open-files-in-pager|--upload-pack|--output|--ext-diff)(=|$)/;
 function gitDecision(args, access) {
   if (access === "full") return { allow: true };
   if (access !== "readonly")
@@ -76,6 +77,11 @@ function gitDecision(args, access) {
     i += WITH_VALUE.has(args[i]) ? 2 : 1;
   }
   const [command, ...rest] = args.slice(i);
+  const runsOrWrites = rest.find(
+    (a) => RUNS_OR_WRITES.test(a) || command === "ls-remote" && /^-u(.|$)/.test(a) || command === "grep" && /^-O/.test(a)
+  );
+  if (runsOrWrites)
+    return { allow: false, reason: "git " + runsOrWrites + " is not allowed: git is read-only in this sandbox." };
   if (command === void 0 || command === "--version" || READ_ONLY.has(command) || (LISTING[command]?.(rest) ?? false))
     return { allow: true };
   return {