windows-development-sandbox 1.11.7 → 1.13.0

package/dist/runtime/main.js

@@ -1363,11 +1363,11 @@ var require_lodash = __commonJS({
             return isFunction(object2[key]);
           });
         }
-        function baseGet(object2, path75) {
-          path75 = castPath(path75, object2);
-          var index = 0, length = path75.length;
+        function baseGet(object2, path77) {
+          path77 = castPath(path77, object2);
+          var index = 0, length = path77.length;
           while (object2 != null && index < length) {
-            object2 = object2[toKey(path75[index++])];
+            object2 = object2[toKey(path77[index++])];
           }
           return index && index == length ? object2 : undefined2;
         }
@@ -1431,10 +1431,10 @@ var require_lodash = __commonJS({
           });
           return accumulator;
         }
-        function baseInvoke(object2, path75, args) {
-          path75 = castPath(path75, object2);
-          object2 = parent(object2, path75);
-          var func = object2 == null ? object2 : object2[toKey(last(path75))];
+        function baseInvoke(object2, path77, args) {
+          path77 = castPath(path77, object2);
+          object2 = parent(object2, path77);
+          var func = object2 == null ? object2 : object2[toKey(last(path77))];
           return func == null ? undefined2 : apply(func, object2, args);
         }
         function baseIsArguments(value) {
@@ -1590,13 +1590,13 @@ var require_lodash = __commonJS({
             return object2 === source || baseIsMatch(object2, source, matchData);
           };
         }
-        function baseMatchesProperty(path75, srcValue) {
-          if (isKey(path75) && isStrictComparable(srcValue)) {
-            return matchesStrictComparable(toKey(path75), srcValue);
+        function baseMatchesProperty(path77, srcValue) {
+          if (isKey(path77) && isStrictComparable(srcValue)) {
+            return matchesStrictComparable(toKey(path77), srcValue);
           }
           return function(object2) {
-            var objValue = get(object2, path75);
-            return objValue === undefined2 && objValue === srcValue ? hasIn(object2, path75) : baseIsEqual(srcValue, objValue, COMPARE_PARTIAL_FLAG | COMPARE_UNORDERED_FLAG);
+            var objValue = get(object2, path77);
+            return objValue === undefined2 && objValue === srcValue ? hasIn(object2, path77) : baseIsEqual(srcValue, objValue, COMPARE_PARTIAL_FLAG | COMPARE_UNORDERED_FLAG);
           };
         }
         function baseMerge(object2, source, srcIndex, customizer, stack) {
@@ -1693,23 +1693,23 @@ var require_lodash = __commonJS({
           });
         }
         function basePick(object2, paths) {
-          return basePickBy(object2, paths, function(value, path75) {
-            return hasIn(object2, path75);
+          return basePickBy(object2, paths, function(value, path77) {
+            return hasIn(object2, path77);
           });
         }
         function basePickBy(object2, paths, predicate) {
           var index = -1, length = paths.length, result2 = {};
           while (++index < length) {
-            var path75 = paths[index], value = baseGet(object2, path75);
-            if (predicate(value, path75)) {
-              baseSet(result2, castPath(path75, object2), value);
+            var path77 = paths[index], value = baseGet(object2, path77);
+            if (predicate(value, path77)) {
+              baseSet(result2, castPath(path77, object2), value);
             }
           }
           return result2;
         }
-        function basePropertyDeep(path75) {
+        function basePropertyDeep(path77) {
           return function(object2) {
-            return baseGet(object2, path75);
+            return baseGet(object2, path77);
           };
         }
         function basePullAll(array2, values2, iteratee2, comparator) {
@@ -1783,14 +1783,14 @@ var require_lodash = __commonJS({
           var array2 = values(collection);
           return shuffleSelf(array2, baseClamp(n, 0, array2.length));
         }
-        function baseSet(object2, path75, value, customizer) {
+        function baseSet(object2, path77, value, customizer) {
           if (!isObject2(object2)) {
             return object2;
           }
-          path75 = castPath(path75, object2);
-          var index = -1, length = path75.length, lastIndex = length - 1, nested = object2;
+          path77 = castPath(path77, object2);
+          var index = -1, length = path77.length, lastIndex = length - 1, nested = object2;
           while (nested != null && ++index < length) {
-            var key = toKey(path75[index]), newValue = value;
+            var key = toKey(path77[index]), newValue = value;
             if (key === "__proto__" || key === "constructor" || key === "prototype") {
               return object2;
             }
@@ -1798,7 +1798,7 @@ var require_lodash = __commonJS({
               var objValue = nested[key];
               newValue = customizer ? customizer(objValue, key, nested) : undefined2;
               if (newValue === undefined2) {
-                newValue = isObject2(objValue) ? objValue : isIndex(path75[index + 1]) ? [] : {};
+                newValue = isObject2(objValue) ? objValue : isIndex(path77[index + 1]) ? [] : {};
               }
             }
             assignValue(nested, key, newValue);
@@ -1964,14 +1964,14 @@ var require_lodash = __commonJS({
             }
           return result2;
         }
-        function baseUnset(object2, path75) {
-          path75 = castPath(path75, object2);
-          var index = -1, length = path75.length;
+        function baseUnset(object2, path77) {
+          path77 = castPath(path77, object2);
+          var index = -1, length = path77.length;
           if (!length) {
             return true;
           }
           while (++index < length) {
-            var key = toKey(path75[index]);
+            var key = toKey(path77[index]);
             if (key === "__proto__" && !hasOwnProperty.call(object2, "__proto__")) {
               return false;
             }
@@ -1979,11 +1979,11 @@ var require_lodash = __commonJS({
               return false;
             }
           }
-          var obj = parent(object2, path75);
-          return obj == null || delete obj[toKey(last(path75))];
+          var obj = parent(object2, path77);
+          return obj == null || delete obj[toKey(last(path77))];
         }
-        function baseUpdate(object2, path75, updater, customizer) {
-          return baseSet(object2, path75, updater(baseGet(object2, path75)), customizer);
+        function baseUpdate(object2, path77, updater, customizer) {
+          return baseSet(object2, path77, updater(baseGet(object2, path77)), customizer);
         }
         function baseWhile(array2, predicate, isDrop, fromRight) {
           var length = array2.length, index = fromRight ? length : -1;
@@ -2866,11 +2866,11 @@ var require_lodash = __commonJS({
           var match = source.match(reWrapDetails);
           return match ? match[1].split(reSplitDetails) : [];
         }
-        function hasPath(object2, path75, hasFunc) {
-          path75 = castPath(path75, object2);
-          var index = -1, length = path75.length, result2 = false;
+        function hasPath(object2, path77, hasFunc) {
+          path77 = castPath(path77, object2);
+          var index = -1, length = path77.length, result2 = false;
           while (++index < length) {
-            var key = toKey(path75[index]);
+            var key = toKey(path77[index]);
             if (!(result2 = object2 != null && hasFunc(object2, key))) {
               break;
             }
@@ -3072,8 +3072,8 @@ var require_lodash = __commonJS({
             return apply(func, this, otherArgs);
           };
         }
-        function parent(object2, path75) {
-          return path75.length < 2 ? object2 : baseGet(object2, baseSlice(path75, 0, -1));
+        function parent(object2, path77) {
+          return path77.length < 2 ? object2 : baseGet(object2, baseSlice(path77, 0, -1));
         }
         function reorder(array2, indexes) {
           var arrLength = array2.length, length = nativeMin(indexes.length, arrLength), oldArray = copyArray(array2);
@@ -3708,10 +3708,10 @@ var require_lodash = __commonJS({
           }
           return isString(collection) ? fromIndex <= length && collection.indexOf(value, fromIndex) > -1 : !!length && baseIndexOf(collection, value, fromIndex) > -1;
         }
-        var invokeMap = baseRest(function(collection, path75, args) {
-          var index = -1, isFunc = typeof path75 == "function", result2 = isArrayLike(collection) ? Array2(collection.length) : [];
+        var invokeMap = baseRest(function(collection, path77, args) {
+          var index = -1, isFunc = typeof path77 == "function", result2 = isArrayLike(collection) ? Array2(collection.length) : [];
           baseEach(collection, function(value) {
-            result2[++index] = isFunc ? apply(path75, value, args) : baseInvoke(value, path75, args);
+            result2[++index] = isFunc ? apply(path77, value, args) : baseInvoke(value, path77, args);
           });
           return result2;
         });
@@ -4363,15 +4363,15 @@ var require_lodash = __commonJS({
         function functionsIn(object2) {
           return object2 == null ? [] : baseFunctions(object2, keysIn(object2));
         }
-        function get(object2, path75, defaultValue) {
-          var result2 = object2 == null ? undefined2 : baseGet(object2, path75);
+        function get(object2, path77, defaultValue) {
+          var result2 = object2 == null ? undefined2 : baseGet(object2, path77);
           return result2 === undefined2 ? defaultValue : result2;
         }
-        function has(object2, path75) {
-          return object2 != null && hasPath(object2, path75, baseHas);
+        function has(object2, path77) {
+          return object2 != null && hasPath(object2, path77, baseHas);
         }
-        function hasIn(object2, path75) {
-          return object2 != null && hasPath(object2, path75, baseHasIn);
+        function hasIn(object2, path77) {
+          return object2 != null && hasPath(object2, path77, baseHasIn);
         }
         var invert = createInverter(function(result2, value, key) {
           if (value != null && typeof value.toString != "function") {
@@ -4424,10 +4424,10 @@ var require_lodash = __commonJS({
             return result2;
           }
           var isDeep = false;
-          paths = arrayMap(paths, function(path75) {
-            path75 = castPath(path75, object2);
-            isDeep || (isDeep = path75.length > 1);
-            return path75;
+          paths = arrayMap(paths, function(path77) {
+            path77 = castPath(path77, object2);
+            isDeep || (isDeep = path77.length > 1);
+            return path77;
           });
           copyObject(object2, getAllKeysIn(object2), result2);
           if (isDeep) {
@@ -4453,19 +4453,19 @@ var require_lodash = __commonJS({
             return [prop];
           });
           predicate = getIteratee(predicate);
-          return basePickBy(object2, props, function(value, path75) {
-            return predicate(value, path75[0]);
+          return basePickBy(object2, props, function(value, path77) {
+            return predicate(value, path77[0]);
           });
         }
-        function result(object2, path75, defaultValue) {
-          path75 = castPath(path75, object2);
-          var index = -1, length = path75.length;
+        function result(object2, path77, defaultValue) {
+          path77 = castPath(path77, object2);
+          var index = -1, length = path77.length;
           if (!length) {
             length = 1;
             object2 = undefined2;
           }
           while (++index < length) {
-            var value = object2 == null ? undefined2 : object2[toKey(path75[index])];
+            var value = object2 == null ? undefined2 : object2[toKey(path77[index])];
             if (value === undefined2) {
               index = length;
               value = defaultValue;
@@ -4474,12 +4474,12 @@ var require_lodash = __commonJS({
           }
           return object2;
         }
-        function set2(object2, path75, value) {
-          return object2 == null ? object2 : baseSet(object2, path75, value);
+        function set2(object2, path77, value) {
+          return object2 == null ? object2 : baseSet(object2, path77, value);
         }
-        function setWith(object2, path75, value, customizer) {
+        function setWith(object2, path77, value, customizer) {
           customizer = typeof customizer == "function" ? customizer : undefined2;
-          return object2 == null ? object2 : baseSet(object2, path75, value, customizer);
+          return object2 == null ? object2 : baseSet(object2, path77, value, customizer);
         }
         var toPairs = createToPairs(keys);
         var toPairsIn = createToPairs(keysIn);
@@ -4501,15 +4501,15 @@ var require_lodash = __commonJS({
           });
           return accumulator;
         }
-        function unset(object2, path75) {
-          return object2 == null ? true : baseUnset(object2, path75);
+        function unset(object2, path77) {
+          return object2 == null ? true : baseUnset(object2, path77);
         }
-        function update(object2, path75, updater) {
-          return object2 == null ? object2 : baseUpdate(object2, path75, castFunction(updater));
+        function update(object2, path77, updater) {
+          return object2 == null ? object2 : baseUpdate(object2, path77, castFunction(updater));
         }
-        function updateWith(object2, path75, updater, customizer) {
+        function updateWith(object2, path77, updater, customizer) {
           customizer = typeof customizer == "function" ? customizer : undefined2;
-          return object2 == null ? object2 : baseUpdate(object2, path75, castFunction(updater), customizer);
+          return object2 == null ? object2 : baseUpdate(object2, path77, castFunction(updater), customizer);
         }
         function values(object2) {
           return object2 == null ? [] : baseValues(object2, keys(object2));
@@ -4895,17 +4895,17 @@ var require_lodash = __commonJS({
         function matches(source) {
           return baseMatches(baseClone(source, CLONE_DEEP_FLAG));
         }
-        function matchesProperty(path75, srcValue) {
-          return baseMatchesProperty(path75, baseClone(srcValue, CLONE_DEEP_FLAG));
+        function matchesProperty(path77, srcValue) {
+          return baseMatchesProperty(path77, baseClone(srcValue, CLONE_DEEP_FLAG));
         }
-        var method = baseRest(function(path75, args) {
+        var method = baseRest(function(path77, args) {
           return function(object2) {
-            return baseInvoke(object2, path75, args);
+            return baseInvoke(object2, path77, args);
           };
         });
         var methodOf = baseRest(function(object2, args) {
-          return function(path75) {
-            return baseInvoke(object2, path75, args);
+          return function(path77) {
+            return baseInvoke(object2, path77, args);
           };
         });
         function mixin(object2, source, options) {
@@ -4952,12 +4952,12 @@ var require_lodash = __commonJS({
         var over = createOver(arrayMap);
         var overEvery = createOver(arrayEvery);
         var overSome = createOver(arraySome);
-        function property(path75) {
-          return isKey(path75) ? baseProperty(toKey(path75)) : basePropertyDeep(path75);
+        function property(path77) {
+          return isKey(path77) ? baseProperty(toKey(path77)) : basePropertyDeep(path77);
         }
         function propertyOf(object2) {
-          return function(path75) {
-            return object2 == null ? undefined2 : baseGet(object2, path75);
+          return function(path77) {
+            return object2 == null ? undefined2 : baseGet(object2, path77);
           };
         }
         var range = createRange();
@@ -5410,12 +5410,12 @@ var require_lodash = __commonJS({
         LazyWrapper.prototype.findLast = function(predicate) {
           return this.reverse().find(predicate);
         };
-        LazyWrapper.prototype.invokeMap = baseRest(function(path75, args) {
-          if (typeof path75 == "function") {
+        LazyWrapper.prototype.invokeMap = baseRest(function(path77, args) {
+          if (typeof path77 == "function") {
             return new LazyWrapper(this);
           }
           return this.map(function(value) {
-            return baseInvoke(value, path75, args);
+            return baseInvoke(value, path77, args);
           });
         });
         LazyWrapper.prototype.reject = function(predicate) {
@@ -5532,8 +5532,8 @@ var require_lodash = __commonJS({
 });
 
 // src/guest/entries/main.ts
-import fs61 from "node:fs";
-import path74 from "node:path";
+import fs63 from "node:fs";
+import path76 from "node:path";
 
 // src/guest/runtime/paths.ts
 import path7 from "node:path";
@@ -6358,10 +6358,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path75) {
-  if (!path75)
+function getElementAtPath(obj, path77) {
+  if (!path77)
     return obj;
-  return path75.reduce((acc, key) => acc?.[key], obj);
+  return path77.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -6701,11 +6701,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path75, issues) {
+function prefixIssues(path77, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path75);
+    iss.path.unshift(path77);
     return iss;
   });
 }
@@ -7155,16 +7155,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path75 = []) => {
+  const processError = (error63, path77 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path75, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path77, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path75, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path77, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path75, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path77, ...issue2.path]);
       } else {
-        const fullpath = [...path75, ...issue2.path];
+        const fullpath = [...path77, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -7203,17 +7203,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path75 = []) => {
+  const processError = (error63, path77 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path75, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path77, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path75, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path77, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path75, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path77, ...issue2.path]);
       } else {
-        const fullpath = [...path75, ...issue2.path];
+        const fullpath = [...path77, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -7252,8 +7252,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path75 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path75) {
+  const path77 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path77) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -24355,13 +24355,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path75 = ref.slice(1).split("/").filter(Boolean);
-  if (path75.length === 0) {
+  const path77 = ref.slice(1).split("/").filter(Boolean);
+  if (path77.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path75[0] === defsKey) {
-    const key = path75[1] === void 0 ? void 0 : decodeJSONPointerSegment(path75[1]);
+  if (path77[0] === defsKey) {
+    const key = path77[1] === void 0 ? void 0 : decodeJSONPointerSegment(path77[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -25534,14 +25534,19 @@ var NetworkSchema = external_exports.strictObject({
 });
 var AuditSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "Keep an audit log on this PC of what happened in your sandboxes: programs started (with their command lines), files changed in the project, sessions, and what the repo guard caught. The sandbox cannot change it. Read it with sandbox audit."
+    "Keep an audit log on this PC of what your agents did: programs started (with their command lines, secrets hidden), files changed in the projects, git commits, sessions, and what the repo guard caught, each linked to the agent session that did it where that can be known. The sandbox cannot change it. Read it with sandbox audit or on the Activity page."
+  ),
+  days: external_exports.number().int().min(1).max(365).describe(
+    "Days the audit log is kept (1 to 30; a larger number keeps 30); older days are deleted when a sandbox starts and once a day."
   ),
-  days: external_exports.number().int().min(1).max(365).describe("Days the audit log is kept."),
   maxMb: external_exports.number().int().min(5).max(5e3).describe("Most space the audit log may take, in MB (older days go first). Days before today are compressed."),
   processes: external_exports.boolean().describe(
     "Record every program started in the sandbox with its command line (Windows process auditing; repeated runs are counted, not listed)."
   ),
-  files: external_exports.boolean().describe("Record the files changed in the project while the sandbox runs.")
+  files: external_exports.boolean().describe("Record the files changed in the projects while the sandbox runs."),
+  commits: external_exports.boolean().describe(
+    "Record the git commits made in the projects while the sandbox runs (read from each project's .git folder on this PC)."
+  )
 });
 var WorkspaceFilterSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
@@ -25744,7 +25749,100 @@ var ToolchainsSchema = external_exports.strictObject({
 
 // src/shared/apps/catalogue.ts
 var gh = (github, asset) => ({ github, asset });
+var RTK_VERSION = "1.0.1";
+var RTK_URL = "https://github.com/rtk-ai/rtk/releases/download/v" + RTK_VERSION + "/rtk-oss-x86_64-pc-windows-msvc.zip";
+var RTK_SHA256 = "0e53e2eca471e15fbd3636e64e6bc0b182cbc278ed0339c80450a2dd03f4cd6b";
+var HEADROOM_VERSION = "0.41.0";
+var CCUSAGE_VERSION = "20.0.36";
+var PLAYWRIGHT_MCP_VERSION = "0.0.83";
+var CONTEXT7_MCP_VERSION = "4.4.2";
 var APPS = [
+  // ---- agent add-ons
+  {
+    id: "rtk",
+    name: "rtk (Rust Token Killer)",
+    category: "agents",
+    about: "Compacts the output of shell commands (git, tests, builds, ls ...) before the agent reads it, so it uses fewer tokens. Claude Code's Bash commands go through it on their own.",
+    size: "6 MB",
+    source: { url: RTK_URL, sha256: RTK_SHA256 },
+    exe: "rtk.exe",
+    cli: true,
+    plugsInto: "Claude Code through a hook in the sandbox's managed settings; other agents are told to use it",
+    userOnly: true
+  },
+  {
+    id: "headroom",
+    name: "Headroom",
+    category: "agents",
+    about: "Compresses what Claude Code sends to the model (tool output, logs, files) so it uses fewer tokens: a local proxy on 127.0.0.1:8787 that sits in Claude Code's API path, offline apart from forwarding to api.anthropic.com.",
+    size: "150 MB",
+    source: { locked: "uv", package: "headroom-ai", version: HEADROOM_VERSION },
+    exe: "headroom.exe",
+    service: true,
+    plugsInto: "Claude Code: the sandbox starts the proxy and points Claude Code at it (managed settings)",
+    userOnly: true
+  },
+  {
+    id: "ccusage",
+    name: "ccusage",
+    category: "agents",
+    about: "Reports the agents' token use and cost by day, month or session from their logs in the sandbox (`ccusage daily`; add --offline to skip fetching prices).",
+    size: "5 MB",
+    source: { locked: "npm", package: "ccusage", version: CCUSAGE_VERSION },
+    exe: "ccusage.cmd",
+    cli: true,
+    plugsInto: "Reads Claude Code's session logs in the sandbox; changes nothing",
+    userOnly: true
+  },
+  {
+    id: "playwright-mcp",
+    name: "Playwright MCP",
+    category: "agents",
+    about: "Lets Claude Code drive a browser (Microsoft Edge, already in the sandbox) to open pages, click, fill forms and take screenshots: the MCP server of microsoft/playwright-mcp.",
+    size: "20 MB",
+    source: { locked: "npm", package: "@playwright/mcp", version: PLAYWRIGHT_MCP_VERSION },
+    exe: "playwright-mcp.cmd",
+    service: true,
+    mcp: { name: "sbx-playwright", script: "node_modules/@playwright/mcp/cli.js", args: ["--browser", "msedge"] },
+    plugsInto: "Claude Code as the MCP server sbx-playwright (the sandbox's Claude settings)",
+    userOnly: true
+  },
+  {
+    id: "context7",
+    name: "Context7 MCP",
+    category: "agents",
+    about: "Up-to-date documentation and code examples for libraries, looked up by Claude Code while it works (upstash/context7). The library names and questions go to Upstash's context7.com.",
+    size: "55 MB",
+    source: { locked: "npm", package: "@upstash/context7-mcp", version: CONTEXT7_MCP_VERSION },
+    exe: "context7-mcp.cmd",
+    service: true,
+    mcp: { name: "sbx-context7", script: "node_modules/@upstash/context7-mcp/dist/index.js" },
+    plugsInto: "Claude Code as the MCP server sbx-context7 (the sandbox's Claude settings)",
+    userOnly: true
+  },
+  {
+    id: "claude-mem",
+    name: "claude-mem",
+    category: "agents",
+    about: "Persistent memory for Claude Code (a plugin you install on this PC): its database is brought into the sandbox.",
+    size: "",
+    source: { resolve: "setting" },
+    exe: "",
+    setting: "claudeProfile.syncClaudeMem",
+    plugsInto: "Claude Code, with your Claude settings copied from this PC",
+    userOnly: true
+  },
+  {
+    id: "rea",
+    name: "REA (Reverse Engineer Anything)",
+    category: "agents",
+    about: "Agent-driven reverse engineering (MCP server and CLI, by morluto). Run `rea setup` once to add it to Claude Code and Codex. Native binaries need Ghidra; needs Node 22.19+.",
+    size: "8 MB",
+    source: { npm: "rea-agents" },
+    exe: "rea.cmd",
+    cli: true,
+    plugsInto: "Claude Code and Codex as an MCP server, after `rea setup`"
+  },
   // ---- editors
   {
     id: "vscode",
@@ -26206,16 +26304,6 @@ var APPS = [
     cli: true
   },
   // ---- reverse engineering
-  {
-    id: "rea",
-    name: "REA (Reverse Engineer Anything)",
-    category: "reversing",
-    about: "Agent-driven reverse engineering (MCP server and CLI, by morluto). Run `rea setup` once to add it to Claude Code and Codex. Native binaries need Ghidra; needs Node 22.19+.",
-    size: "8 MB",
-    source: { npm: "rea-agents" },
-    exe: "rea.cmd",
-    cli: true
-  },
   {
     id: "ghidra",
     name: "Ghidra",
@@ -26528,13 +26616,87 @@ function appsToInstall(apps, gitAccess) {
   const needs7zip = allowed.some((e) => e.needs?.includes("7zip") || e.unpack === "nsis") && !allowed.some((e) => e.id === "7zip");
   return { entries: [...needs7zip ? [appById("7zip")] : [], ...allowed], skipped };
 }
+function appsNeedUv(apps) {
+  return Boolean(
+    apps?.install.some((id) => {
+      const source = appById(id)?.source;
+      return source !== void 0 && "locked" in source && source.locked === "uv";
+    })
+  );
+}
 function appsNeedMesa(apps) {
   return Boolean(apps?.install.some((id) => appById(id)?.needs?.includes("mesa")));
 }
 
+// src/shared/apps/agent-addons.ts
+function rtkHookCommand(exe) {
+  return '"' + exe.replace(/\\/g, "/") + '" hook claude';
+}
+function claudeManagedSettings(deny, rtkExe, headroomUrl2 = null) {
+  if (!deny.length && !rtkExe && !headroomUrl2) return null;
+  return {
+    ...deny.length ? { permissions: { deny } } : {},
+    ...rtkExe ? { hooks: { PreToolUse: [{ matcher: "Bash", hooks: [{ type: "command", command: rtkHookCommand(rtkExe) }] }] } } : {},
+    ...headroomUrl2 ? { env: { ANTHROPIC_BASE_URL: headroomUrl2 } } : {}
+  };
+}
+var RTK_GUIDE_LINE = "- rtk is on PATH and compacts command output: Claude Code's Bash commands go through it on their own; in other agents prefix shell commands with `rtk` (`rtk git status`, `rtk cargo test`, `rtk ls`).";
+var HEADROOM_PORT = 8787;
+var HEADROOM_UPSTREAM = "https://api.anthropic.com";
+function headroomUrl(port = HEADROOM_PORT) {
+  return "http://127.0.0.1:" + port;
+}
+function headroomArgs(port = HEADROOM_PORT) {
+  return [
+    "proxy",
+    "--host",
+    "127.0.0.1",
+    "--port",
+    String(port),
+    "--anthropic-api-url",
+    HEADROOM_UPSTREAM,
+    "--no-telemetry"
+  ];
+}
+var HEADROOM_ENV = {
+  HEADROOM_OFFLINE: "1",
+  HEADROOM_TELEMETRY: "off",
+  HEADROOM_BEACON: "off",
+  HEADROOM_UPDATE_CHECK: "off",
+  DO_NOT_TRACK: "1",
+  HF_HUB_OFFLINE: "1",
+  PYTHONIOENCODING: "utf-8"
+};
+var SECRET_NAME = /(KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)/i;
+function headroomEnv(base) {
+  const env = {};
+  for (const [name, value] of Object.entries(base))
+    if (value !== void 0 && !SECRET_NAME.test(name) && !/^(ANTHROPIC|OPENAI|CLAUDE)_/i.test(name)) env[name] = value;
+  return { ...env, ...HEADROOM_ENV };
+}
+function headroomGuideLine(logFile2) {
+  return "- Headroom compresses Claude Code's requests: Claude Code reaches the API through its proxy on " + headroomUrl() + " (log: `" + logFile2 + "`). If Claude Code cannot reach the API, the proxy stopped: it starts again with the next sandbox, or turn Headroom off in Apps.";
+}
+function addonMcpServer(folder, mcp) {
+  const script = folder.replace(/[\\/]+$/, "") + "\\" + mcp.script.replace(/\//g, "\\");
+  return { type: "stdio", command: "node", args: [script, ...mcp.args ?? []], env: {} };
+}
+function withAddonMcpServers(current, servers, known) {
+  const kept = Object.fromEntries(Object.entries(current).filter(([name]) => !known.includes(name) || name in servers));
+  return { ...kept, ...servers };
+}
+function addonGuideLine(mcpNames, ccusage) {
+  return [
+    ...mcpNames.length ? ["- MCP servers in Claude Code from Apps: " + mcpNames.join(", ") + "."] : [],
+    ...ccusage ? ["- ccusage is on PATH: `ccusage daily` (or `monthly`, `session`) reports token use and cost."] : []
+  ];
+}
+
 // src/core/schema/apps.ts
 var CATALOGUE_IDS = APPS.filter((a) => !a.setting).map((a) => a.id);
 var AppIdSchema = external_exports.enum(CATALOGUE_IDS);
+var PROJECT_IDS = APPS.filter((a) => !a.setting && !a.userOnly).map((a) => a.id);
+var ProjectAppIdSchema = external_exports.enum(PROJECT_IDS);
 var CustomAppIdSchema = external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,40}$/, "lower-case letters, digits and - only");
 var compiles = (pattern) => {
   try {
@@ -26558,6 +26720,11 @@ var CustomAppSchema = external_exports.strictObject({
 }).refine((a) => a.github && a.asset ? !a.url : Boolean(a.url) && !a.github && !a.asset, {
   message: "give github + asset, or url (not both)"
 });
+var ProjectAppsSchema = external_exports.strictObject({
+  install: external_exports.array(ProjectAppIdSchema).describe(
+    "Apps from the catalogue this project adds to yours (agent add-ons such as rtk, Headroom and the MCP servers are set in your own settings only)."
+  )
+});
 var AppsSchema = external_exports.strictObject({
   install: external_exports.array(AppIdSchema).describe(
     "Apps from the catalogue to install in every sandbox (the Apps screen in the menu lists them by category). Each is downloaded once and kept."
@@ -26598,12 +26765,39 @@ var ResumeSchema = external_exports.strictObject({
 });
 
 // src/core/schema/web.ts
+var REMOTE_ROLES = ["view", "control"];
+var WindowsUserNameSchema = external_exports.string().trim().min(1).max(120).regex(
+  /^(?:[A-Za-z0-9][A-Za-z0-9._ -]{0,62}\\)?[^\\/"[\]:;|=,+*?<>@]{1,64}$/,
+  "a Windows user name (name or DOMAIN\\name)"
+);
+var RemoteUserSchema = external_exports.strictObject({
+  name: WindowsUserNameSchema.describe("The Windows user (name, or DOMAIN\\name)"),
+  role: external_exports.enum(REMOTE_ROLES).describe("view: sees everything, terminals read-only. control: everything but remote access, logins and tokens.")
+});
+var WebLanSchema = external_exports.strictObject({
+  enabled: external_exports.boolean().describe(
+    "(Beta) Devices on your network (a phone): an HTTPS address on this PC for devices you pair with a one-time code (sandbox web pair). Needs a firewall rule (sandbox web lan on asks Windows once). Off: every paired device is signed out."
+  ),
+  port: external_exports.number().int().min(1024).max(65535).describe("HTTPS port for paired devices on your network."),
+  address: external_exports.string().trim().max(15).regex(/^$|^\d{1,3}(\.\d{1,3}){3}$/, "an IPv4 address or empty").describe("This PC's private address to listen on. Empty: the one of its network adapter (never a public one).")
+});
+var WebRemoteSchema = external_exports.strictObject({
+  windowsSignIn: external_exports.boolean().describe(
+    "(Beta) Other Windows users of this PC named in web.remote.users sign in to your web UI (and sandbox remote) with their own Windows account: no password, no link."
+  ),
+  users: external_exports.array(RemoteUserSchema).max(32).describe("Who else may sign in with Windows, and their role (view or control)."),
+  rememberDays: external_exports.number().int().min(1).max(90).describe(
+    "How many days a paired device or a Windows sign-in stays signed in (from when it signed in, not renewed)."
+  ),
+  lan: WebLanSchema
+});
 var WebSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
     "(Beta) The web UI: your sandbox sessions in a browser on this PC (http://127.0.0.1:<port>, this PC only). On: every sandbox start also starts it in the background (it keeps running until sandbox web stop or a restart of the PC). Off: only sandbox web start runs it. Open it signed in with sandbox web open."
   ),
   port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken."),
-  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts.")
+  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts."),
+  remote: WebRemoteSchema.describe("(Beta) Access for other Windows users of this PC and for paired devices.")
 });
 
 // src/core/schema/vpn.ts
@@ -26633,6 +26827,36 @@ var GithubSchema = external_exports.strictObject({
 });
 
 // src/core/schema/config.ts
+var RESERVED_ENV_PREFIX = /^(AGENT_|GIT_|GH_|GITHUB_|NODE_|NPM_CONFIG_(USERCONFIG|GLOBALCONFIG|PREFIX|SCRIPT_SHELL)|SSL_|CLAUDE|ANTHROPIC_|OPENAI_|CODEX_|GEMINI_|GOOGLE_|COPILOT_|AWS_|AZURE_)/i;
+var RESERVED_ENV_SUFFIX = /(_PROXY|_BASE_URL|_ENDPOINT|_CA_BUNDLE|_CA_CERTS)$/i;
+var RESERVED_ENV_NAMES = new Set(
+  [
+    "PATH",
+    "PATHEXT",
+    "BASH_ENV",
+    "ENV",
+    "COMSPEC",
+    "PSMODULEPATH",
+    "PYTHONPATH",
+    "PYTHONSTARTUP",
+    "PERL5OPT",
+    "RUBYOPT",
+    "JAVA_TOOL_OPTIONS",
+    "LD_PRELOAD",
+    "SYSTEMROOT",
+    "WINDIR",
+    "HOME",
+    "USERPROFILE",
+    "APPDATA",
+    "LOCALAPPDATA",
+    "PROGRAMDATA",
+    "TEMP",
+    "TMP"
+  ].map((n) => n.toUpperCase())
+);
+function reservedEnvName(name) {
+  return RESERVED_ENV_PREFIX.test(name) || RESERVED_ENV_SUFFIX.test(name) || RESERVED_ENV_NAMES.has(name.toUpperCase());
+}
 var ConfigSchema = external_exports.strictObject({
   $schema: SchemaRefSchema.optional(),
   defaultHarness: NameSchema.describe("Agent started by `sandbox launch` (sandbox claude always runs claude)."),
@@ -26699,10 +26923,14 @@ var LocalOverridesSchema = external_exports.strictObject({
   scripts: StringsSchema.describe(
     "Scripts (.ps1 / .mjs / .cmd, relative to this file) run inside the sandbox before the agent."
   ),
-  // This PC's resources are yours to share: CPU and paging file (this PC's disk) are not a project's to set.
+  // This PC's resources are yours to share: CPU, paging file (this PC's disk) and the RAM kept for this PC are not a
+  // project's to set.
   sandbox: SandboxSchema.omit({
     cpuLimit: true,
     pageFileMb: true,
+    reserveHostMb: true,
+    maxMemoryPercent: true,
+    maxMemoryMb: true,
     engine: true,
     agentMemoryHeadroomMb: true,
     pressureResponse: true
@@ -26716,14 +26944,17 @@ var LocalOverridesSchema = external_exports.strictObject({
   // Every toolchain setting, each one optional (a project usually only switches languages on or pins a version).
   toolchains: external_exports.strictObject({
     ...import_lodash.default.mapValues(import_lodash.default.omit(ToolchainsSchema.shape, "environment"), (shape) => shape.partial()),
-    environment: ToolchainsSchema.shape.environment
+    environment: ToolchainsSchema.shape.environment.refine(
+      (env) => !Object.keys(env).some(reservedEnvName),
+      "names the sandbox sets or that carry logins (AGENT_*, GIT_*, PATH, BASH_ENV, NODE_*, proxies, ANTHROPIC_*, CLAUDE_* ...) cannot be set by a project"
+    )
   }).partial(),
   databases: external_exports.strictObject(import_lodash.default.mapValues(DatabasesSchema.shape, (shape) => shape.partial())).partial(),
   attach: AttachSchema.partial(),
   personalization: toggle("Copy your desktop look into the sandbox.").partial(),
   // Catalogue apps only (a vetted list): your own programs (apps.custom) download anything, so a repo cannot add
-  // them.
-  apps: AppsSchema.pick({ install: true }).partial(),
+  // them, nor agent add-ons that are yours only (rtk hooks every agent command, Headroom sits in its API path).
+  apps: ProjectAppsSchema.partial(),
   claudeProfile: ClaudeProfileSchema.pick({
     enabled: true,
     overwrite: true,
@@ -26786,6 +27017,7 @@ var ProjectSpecSchema = external_exports.strictObject({
   /** Its hooks were staged in C:\AgentLaunch\projects\<name>\hooks. */
   hooks: external_exports.boolean()
 });
+var ShellChoiceSchema = external_exports.enum(["auto", "pwsh", "powershell", "cmd"]);
 var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
   external_exports.strictObject({
     kind: external_exports.literal("session"),
@@ -26795,8 +27027,12 @@ var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
     cwd: Text(),
     project: ProjectSpecSchema.optional(),
     harnessSpec: HarnessSchema.optional(),
+    /** A plain shell instead of an agent (harness is then "shell" and args are ignored). */
+    shell: ShellChoiceSchema.optional(),
     createdAt: TimeSchema
   }),
+  /** End a running session (an agent or a shell) and everything it started. */
+  external_exports.strictObject({ kind: external_exports.literal("close"), id: IdSchema, session: IdSchema, createdAt: TimeSchema }),
   /** Provision a registered project without starting an agent (sandbox start / exec / db from its folder). */
   external_exports.strictObject({ kind: external_exports.literal("project"), id: IdSchema, project: ProjectSpecSchema, createdAt: TimeSchema }),
   external_exports.strictObject({
@@ -26862,6 +27098,8 @@ var SessionStatusSchema = external_exports.object({
   id: IdSchema,
   launchId: Text(64),
   harness: Text(64),
+  /** A plain shell (harness is then the shell: pwsh, powershell or cmd); absent: an agent. */
+  kind: external_exports.enum(["agent", "shell"]).optional(),
   cwd: Text(),
   /** The project it runs in: its hub name, or the launch folder's for the first project. */
   project: Text(64).optional(),
@@ -27531,92 +27769,52 @@ function writeStatus(phase, message) {
 }
 
 // src/guest/boot/boot.ts
-import fs60 from "node:fs";
-import path73 from "node:path";
-import { spawn as spawn9 } from "node:child_process";
+import fs62 from "node:fs";
+import path75 from "node:path";
+import { spawn as spawn10 } from "node:child_process";
 
 // src/guest/boot/guide.ts
+import fs12 from "node:fs";
+import path17 from "node:path";
+
+// src/guest/apps/find-exe.ts
 import fs10 from "node:fs";
 import path14 from "node:path";
-var BEGIN = "<!-- agent-sandbox:begin (generated every boot, do not edit) -->";
-var END = "<!-- agent-sandbox:end -->";
-var mirrorLine = () => {
-  const drives = (session.substDrives ?? []).filter((d) => fs10.existsSync(d.letter + ":\\"));
-  if (!drives.length) return [];
-  return [
-    "- " + drives.map((d) => d.letter + ":").join(", ") + " = mapped folders at their PC paths (subst onto `" + drives.map((d) => d.target).join("`, `") + "`; real-path tools may print that form)."
-  ];
-};
-function sandboxGuide(toolSummary, lan = "blocked", projects = []) {
-  return [
-    BEGIN,
-    "## Sandbox manifest \u2014 you are in a DISPOSABLE Windows Sandbox",
-    "Wiped on close: everything except the paths below (installers, winget/choco, C:\\Users, Program Files, registry).",
-    "- RW, persists: `" + workspace + "` = host folder " + session.workspaceHost,
-    // Projects started from other folders while this sandbox runs: every agent here can see them.
-    ...projects.map(
-      (p) => "- RW, persists: `" + p.guest + "` = host folder " + p.host + " (another project in this sandbox; your own is `%AGENT_WORKSPACE%`)"
-    ),
-    "- RW, persists: `" + toolsDir + "` (toolchains) \u2014 put portable exes in `" + path14.join(toolsDir, "bin") + "` (on PATH)",
-    "- RW, persists: `" + stateDir + "` (agent config/history; do not edit logins) \xB7 logs: `" + path14.join(dataDir, "logs") + "`",
-    "- RO: `" + launchDir + "` (this boot's scripts) \xB7 lost on close: everything else, incl. `C:\\nvm` (Node symlink)",
-    ...mirrorLine(),
-    "- Tools: " + toolSummary.join(" \xB7 "),
-    "- Persistent installs: `npm i -g` (per nvm version), `pip`, `cargo install`, `dotnet tool -g`, `uv tool`, `bun add -g`. Real installers must re-run each boot via a hook (ask the user).",
-    "- Mapped folders (workspace, C:\\AgentData) allow NO symlinks or junctions: pnpm runs hoisted (set), npm workspaces / `file:` deps and deno node_modules dirs fail there (use a folder on C:\\ outside them), bun cannot save its lockfile there (`bun install --no-save`).",
-    "- Network: " + (lan === "offline" ? "OFF" : lan === "blocked" ? "internet yes, host LAN blocked" : "internet yes, host LAN NOT blocked this time") + ". Other sessions may share this workspace; the user may be typing from the host.",
-    END
-  ].join("\n");
-}
-function upsertGuide(file3, guide) {
-  fs10.mkdirSync(path14.dirname(file3), { recursive: true });
-  const current = fs10.existsSync(file3) ? fs10.readFileSync(file3, "utf8") : "";
-  const start = current.indexOf(BEGIN);
-  const end = current.indexOf(END);
-  const without = start >= 0 && end > start ? current.slice(0, start) + current.slice(end + END.length) : current;
-  fs10.writeFileSync(file3, without.trimEnd() + (without.trim() ? "\n\n" : "") + guide + "\n", "utf8");
-}
-function managedClaudeMd() {
-  return path14.join(
-    process.env.AGENT_MANAGED_DIR ?? path14.join(process.env.ProgramFiles ?? "C:\\Program Files", "ClaudeCode"),
-    "CLAUDE.md"
-  );
-}
-function writeGuides(toolSummary, lan, projects = []) {
-  const guide = sandboxGuide(toolSummary, lan, projects);
-  const managed = managedClaudeMd();
-  fs10.mkdirSync(path14.dirname(managed), { recursive: true });
-  fs10.writeFileSync(managed, guide + "\n", "utf8");
-  fs10.writeFileSync(path14.join(dataDir, "SANDBOX.md"), guide + "\n", "utf8");
-  upsertGuide(path14.join(stateDir, "codex", "AGENTS.md"), guide);
-  upsertGuide(path14.join(stateDir, "gemini", ".gemini", "GEMINI.md"), guide);
-  removeGuide(path14.join(claudeDir, "CLAUDE.md"));
-  return managed;
-}
-var removeGuide = (file3) => {
-  if (!fs10.existsSync(file3)) return;
-  const current = fs10.readFileSync(file3, "utf8");
-  const start = current.indexOf(BEGIN);
-  const end = current.indexOf(END);
-  if (start >= 0 && end > start)
-    fs10.writeFileSync(file3, (current.slice(0, start) + current.slice(end + END.length)).trim() + "\n", "utf8");
-};
-
-// src/guest/runtime/fs.ts
-import fs11 from "node:fs";
-function exists(p) {
-  return fs11.existsSync(p);
-}
-function mkdirp(p) {
-  fs11.mkdirSync(p, { recursive: true });
-  return p;
+var MAX_DEPTH = 7;
+var MAX_ENTRIES = 5e4;
+var X64_FOLDER = /(^|[\\/])(amd64|x64|x86_64|win64)([\\/]|$)/i;
+function findExe(root, exe) {
+  const match = exeMatcher(exe);
+  const best = (hits) => hits.find((h) => X64_FOLDER.test(path14.relative(root, h))) ?? hits[0] ?? null;
+  let queue = [root];
+  let seen = 0;
+  for (let depth = 0; depth < MAX_DEPTH && queue.length; depth++) {
+    const next = [];
+    const hits = [];
+    for (const dir of queue) {
+      let entries3;
+      try {
+        entries3 = fs10.readdirSync(dir, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      const hit = entries3.find((e) => e.isFile() && match(e.name));
+      if (hit) hits.push(path14.join(dir, hit.name));
+      else
+        next.push(...entries3.filter((e) => e.isDirectory() && !e.isSymbolicLink()).map((e) => path14.join(dir, e.name)));
+      if ((seen += entries3.length) > MAX_ENTRIES) return best(hits);
+    }
+    if (hits.length) return best(hits);
+    queue = next;
+  }
+  return null;
 }
 
 // src/guest/toolchains/tool-env.ts
 import path16 from "node:path";
 
 // src/guest/runtime/process.ts
-import fs12 from "node:fs";
+import fs11 from "node:fs";
 import os4 from "node:os";
 import path15 from "node:path";
 import { spawnSync } from "node:child_process";
@@ -27651,24 +27849,24 @@ function scriptOutput(name, args = [], options = {}) {
   return execOutput(SYSTEM.powershell(), scriptArgs(name, args), options);
 }
 function runScriptWithJson(name, param, data, args = []) {
-  const dir = fs12.mkdtempSync(path15.join(os4.tmpdir(), "sbx-"));
+  const dir = fs11.mkdtempSync(path15.join(os4.tmpdir(), "sbx-"));
   const file3 = path15.join(dir, "input.json");
   try {
-    fs12.writeFileSync(file3, JSON.stringify(data), "utf8");
+    fs11.writeFileSync(file3, JSON.stringify(data), "utf8");
     runScript(name, ["-" + param, file3, ...args]);
   } finally {
-    fs12.rmSync(dir, { recursive: true, force: true });
+    fs11.rmSync(dir, { recursive: true, force: true });
   }
 }
 function robocopy(from, to, files = []) {
   if (!isWin) {
     if (!files.length) {
-      fs12.cpSync(from, to, { recursive: true });
+      fs11.cpSync(from, to, { recursive: true });
       return;
     }
-    fs12.mkdirSync(to, { recursive: true });
-    for (const f of files.filter((f2) => fs12.existsSync(path15.join(from, f2))))
-      fs12.copyFileSync(path15.join(from, f), path15.join(to, f));
+    fs11.mkdirSync(to, { recursive: true });
+    for (const f of files.filter((f2) => fs11.existsSync(path15.join(from, f2))))
+      fs11.copyFileSync(path15.join(from, f), path15.join(to, f));
     return;
   }
   const what = files.length ? files : ["/E"];
@@ -27729,13 +27927,216 @@ function versionOf(exe, args = ["--version"], options = {}) {
   return /\d+\.\d+\.\d+\S*/.exec(execOutput(exe, args, options))?.[0] ?? "installed";
 }
 
+// src/guest/setup/agent-addons.ts
+function installedAddon(id) {
+  const entry = appById(id);
+  if (dryRun || !entry || !(session.apps?.install ?? []).includes(id)) return null;
+  return findExe(tool("apps", id), entry.exe);
+}
+function installedRtk() {
+  return installedAddon("rtk");
+}
+function installedMcpAddons() {
+  return APPS.filter((a) => a.mcp && installedAddon(a.id)).map((a) => ({ id: a.id, folder: tool("apps", a.id) }));
+}
+
+// src/guest/boot/guide.ts
+var BEGIN = "<!-- agent-sandbox:begin (generated every boot, do not edit) -->";
+var END = "<!-- agent-sandbox:end -->";
+var mirrorLine = () => {
+  const drives = (session.substDrives ?? []).filter((d) => fs12.existsSync(d.letter + ":\\"));
+  if (!drives.length) return [];
+  return [
+    "- " + drives.map((d) => d.letter + ":").join(", ") + " = mapped folders at their PC paths (subst onto `" + drives.map((d) => d.target).join("`, `") + "`; real-path tools may print that form)."
+  ];
+};
+function sandboxGuide(toolSummary, lan = "blocked", projects = [], addons = []) {
+  return [
+    BEGIN,
+    "## Sandbox manifest \u2014 you are in a DISPOSABLE Windows Sandbox",
+    "Wiped on close: everything except the paths below (installers, winget/choco, C:\\Users, Program Files, registry).",
+    "- RW, persists: `" + workspace + "` = host folder " + session.workspaceHost,
+    // Projects started from other folders while this sandbox runs: every agent here can see them.
+    ...projects.map(
+      (p) => "- RW, persists: `" + p.guest + "` = host folder " + p.host + " (another project in this sandbox; your own is `%AGENT_WORKSPACE%`)"
+    ),
+    "- RW, persists: `" + toolsDir + "` (toolchains) \u2014 put portable exes in `" + path17.join(toolsDir, "bin") + "` (on PATH)",
+    "- RW, persists: `" + stateDir + "` (agent config/history; do not edit logins) \xB7 logs: `" + path17.join(dataDir, "logs") + "`",
+    "- RO: `" + launchDir + "` (this boot's scripts) \xB7 lost on close: everything else, incl. `C:\\nvm` (Node symlink)",
+    ...mirrorLine(),
+    "- Tools: " + toolSummary.join(" \xB7 "),
+    // Agent add-ons that change how the agent works (rtk, Headroom, MCP servers, ccusage).
+    ...addons,
+    "- Persistent installs: `npm i -g` (per nvm version), `pip`, `cargo install`, `dotnet tool -g`, `uv tool`, `bun add -g`. Real installers must re-run each boot via a hook (ask the user).",
+    "- Mapped folders (workspace, C:\\AgentData) allow NO symlinks or junctions: pnpm runs hoisted (set), npm workspaces / `file:` deps and deno node_modules dirs fail there (use a folder on C:\\ outside them), bun cannot save its lockfile there (`bun install --no-save`).",
+    "- Network: " + (lan === "offline" ? "OFF" : lan === "blocked" ? "internet yes, host LAN blocked" : "internet yes, host LAN NOT blocked this time") + ". Other sessions may share this workspace; the user may be typing from the host.",
+    END
+  ].join("\n");
+}
+function upsertGuide(file3, guide) {
+  fs12.mkdirSync(path17.dirname(file3), { recursive: true });
+  const current = fs12.existsSync(file3) ? fs12.readFileSync(file3, "utf8") : "";
+  const start = current.indexOf(BEGIN);
+  const end = current.indexOf(END);
+  const without = start >= 0 && end > start ? current.slice(0, start) + current.slice(end + END.length) : current;
+  fs12.writeFileSync(file3, without.trimEnd() + (without.trim() ? "\n\n" : "") + guide + "\n", "utf8");
+}
+function managedClaudeMd() {
+  return path17.join(
+    process.env.AGENT_MANAGED_DIR ?? path17.join(process.env.ProgramFiles ?? "C:\\Program Files", "ClaudeCode"),
+    "CLAUDE.md"
+  );
+}
+var headroomRuns = () => {
+  try {
+    const file3 = path17.join(path17.dirname(managedClaudeMd()), "managed-settings.json");
+    const settings = JSON.parse(fs12.readFileSync(file3, "utf8"));
+    return typeof settings.env?.ANTHROPIC_BASE_URL === "string";
+  } catch {
+    return false;
+  }
+};
+function addonLines() {
+  const mcp = APPS.flatMap((a) => a.mcp && installedAddon(a.id) ? [a.mcp.name] : []);
+  return [
+    ...installedRtk() ? [RTK_GUIDE_LINE] : [],
+    ...installedAddon("headroom") && headroomRuns() ? [headroomGuideLine(path17.join(logsDir, "headroom.log"))] : [],
+    ...addonGuideLine(mcp, Boolean(installedAddon("ccusage")))
+  ];
+}
+function writeGuides(toolSummary, lan, projects = []) {
+  const guide = sandboxGuide(toolSummary, lan, projects, addonLines());
+  const managed = managedClaudeMd();
+  fs12.mkdirSync(path17.dirname(managed), { recursive: true });
+  fs12.writeFileSync(managed, guide + "\n", "utf8");
+  fs12.writeFileSync(path17.join(dataDir, "SANDBOX.md"), guide + "\n", "utf8");
+  upsertGuide(path17.join(stateDir, "codex", "AGENTS.md"), guide);
+  upsertGuide(path17.join(stateDir, "gemini", ".gemini", "GEMINI.md"), guide);
+  removeGuide(path17.join(claudeDir, "CLAUDE.md"));
+  return managed;
+}
+var removeGuide = (file3) => {
+  if (!fs12.existsSync(file3)) return;
+  const current = fs12.readFileSync(file3, "utf8");
+  const start = current.indexOf(BEGIN);
+  const end = current.indexOf(END);
+  if (start >= 0 && end > start)
+    fs12.writeFileSync(file3, (current.slice(0, start) + current.slice(end + END.length)).trim() + "\n", "utf8");
+};
+
+// src/guest/runtime/fs.ts
+import fs13 from "node:fs";
+function exists(p) {
+  return fs13.existsSync(p);
+}
+function mkdirp(p) {
+  fs13.mkdirSync(p, { recursive: true });
+  return p;
+}
+
 // src/guest/apps/app-installer.ts
-import fs16 from "node:fs";
-import path21 from "node:path";
+import fs17 from "node:fs";
+import path22 from "node:path";
+
+// src/guest/toolchains/runtimes.ts
+import path18 from "node:path";
+
+// src/guest/toolchains/install.ts
+import fs14 from "node:fs";
+async function downloadFile(url2, file3, sha256 = null) {
+  const part = file3 + ".part";
+  try {
+    await downloader.file(url2, part, sha256);
+    fs14.rmSync(file3, { force: true });
+    fs14.renameSync(part, file3);
+  } finally {
+    fs14.rmSync(part, { force: true });
+  }
+}
+async function installFromGithub(repo, pattern, o) {
+  const asset = await githubAsset(repo, pattern, o.searchOlder);
+  log("Downloading " + (typeof o.what === "string" ? o.what : o.what(asset)) + " ...");
+  await downloader.archive(asset.url, o.dest, {
+    sha256: asset.sha256,
+    fileName: asset.name,
+    ...o.locate ? { locate: o.locate } : {},
+    ...o.up ? { up: o.up } : {}
+  });
+}
+
+// src/guest/toolchains/runtimes.ts
+async function setupSingleExe(env, name, repo, pattern, exeName, dir, options = {}) {
+  if (dryRun) {
+    log("(dry run) would provision " + name);
+    return;
+  }
+  const bin = options.subdir ? path18.join(dir, options.subdir) : dir;
+  const exe = path18.join(bin, exeName);
+  if (!exists(exe) || options.refresh) {
+    const size = options.size ? ", ~" + options.size : "";
+    await installFromGithub(repo, pattern, {
+      dest: dir,
+      what: (a) => name + " (" + a.name + size + " once)",
+      ...options.subdir ? {} : { locate: exeName }
+    });
+  }
+  if (!exists(exe)) throw new Error(exeName + " missing after installing " + name);
+  env.prepend.push(bin);
+  env.summary.push(name + ": " + versionOf(exe, options.versionArgs) + (options.note ?? ""));
+}
+async function setupBun(env) {
+  await setupSingleExe(
+    env,
+    "bun",
+    "oven-sh/bun",
+    arch === "arm64" ? /^bun-windows-aarch64\.zip$/ : /^bun-windows-x64\.zip$/,
+    "bun.exe",
+    tool("bun", "bin"),
+    { size: "35 MB" }
+  );
+  Object.assign(env.vars, {
+    BUN_INSTALL: tool("bun"),
+    BUN_INSTALL_CACHE_DIR: path18.join(localDir, "bun-cache"),
+    BUN_TMPDIR: path18.join(localDir, "bun-tmp")
+  });
+}
+async function setupDeno(env) {
+  await setupSingleExe(
+    env,
+    "deno",
+    "denoland/deno",
+    arch === "arm64" ? /^deno-aarch64-pc-windows-msvc[.]zip$/ : /^deno-x86_64-pc-windows-msvc[.]zip$/,
+    "deno.exe",
+    tool("deno", "bin"),
+    { size: "40 MB" }
+  );
+  Object.assign(env.vars, { DENO_DIR: tool("deno-cache"), DENO_INSTALL_ROOT: tool("deno"), DENO_NO_UPDATE_CHECK: "1" });
+}
+function uvVars() {
+  return {
+    UV_CACHE_DIR: tool("uv-cache"),
+    UV_PYTHON_INSTALL_DIR: tool("uv-python"),
+    UV_TOOL_DIR: tool("uv-tools"),
+    UV_TOOL_BIN_DIR: tool("uv-bin")
+  };
+}
+async function setupUv(env) {
+  await setupSingleExe(
+    env,
+    "uv",
+    "astral-sh/uv",
+    arch === "arm64" ? /^uv-aarch64-pc-windows-msvc\.zip$/ : /^uv-x86_64-pc-windows-msvc\.zip$/,
+    "uv.exe",
+    tool("uv"),
+    { size: "20 MB" }
+  );
+  Object.assign(env.vars, uvVars());
+  env.prepend.push(mkdirp(tool("uv-bin")));
+}
 
 // src/guest/apps/after-install.ts
-import fs13 from "node:fs";
-import path17 from "node:path";
+import fs15 from "node:fs";
+import path19 from "node:path";
 var SYSINTERNALS_TOOLS = [
   "Process Explorer",
   "Process Monitor",
@@ -27756,16 +28157,16 @@ var SYSINTERNALS_TOOLS = [
   "ZoomIt"
 ];
 async function afterInstall(entry, exe) {
-  const dir = path17.dirname(exe);
+  const dir = path19.dirname(exe);
   if (entry.needs?.includes("mesa")) {
     const mesa = tool("mesa", arch === "arm64" ? "arm64" : "x64");
     for (const dll of ["opengl32.dll", "libgallium_wgl.dll", "dxil.dll"]) {
-      if (exists(path17.join(mesa, dll)) && !exists(path17.join(dir, dll)))
-        fs13.copyFileSync(path17.join(mesa, dll), path17.join(dir, dll));
+      if (exists(path19.join(mesa, dll)) && !exists(path19.join(dir, dll)))
+        fs15.copyFileSync(path19.join(mesa, dll), path19.join(dir, dll));
     }
   }
-  if (entry.id === "godot" && !exists(path17.join(dir, "._sc_"))) fs13.writeFileSync(path17.join(dir, "._sc_"), "");
-  if (entry.id === "sublime") mkdirp(path17.join(dir, "Data"));
+  if (entry.id === "godot" && !exists(path19.join(dir, "._sc_"))) fs15.writeFileSync(path19.join(dir, "._sc_"), "");
+  if (entry.id === "sublime") mkdirp(path19.join(dir, "Data"));
   if (entry.id === "sysinternals") {
     for (const name of SYSINTERNALS_TOOLS) {
       await execAsync(
@@ -27777,47 +28178,14 @@ async function afterInstall(entry, exe) {
   }
 }
 
-// src/guest/apps/find-exe.ts
-import fs14 from "node:fs";
-import path18 from "node:path";
-var MAX_DEPTH = 7;
-var MAX_ENTRIES = 5e4;
-var X64_FOLDER = /(^|[\\/])(amd64|x64|x86_64|win64)([\\/]|$)/i;
-function findExe(root, exe) {
-  const match = exeMatcher(exe);
-  const best = (hits) => hits.find((h) => X64_FOLDER.test(path18.relative(root, h))) ?? hits[0] ?? null;
-  let queue = [root];
-  let seen = 0;
-  for (let depth = 0; depth < MAX_DEPTH && queue.length; depth++) {
-    const next = [];
-    const hits = [];
-    for (const dir of queue) {
-      let entries3;
-      try {
-        entries3 = fs14.readdirSync(dir, { withFileTypes: true });
-      } catch {
-        continue;
-      }
-      const hit = entries3.find((e) => e.isFile() && match(e.name));
-      if (hit) hits.push(path18.join(dir, hit.name));
-      else
-        next.push(...entries3.filter((e) => e.isDirectory() && !e.isSymbolicLink()).map((e) => path18.join(dir, e.name)));
-      if ((seen += entries3.length) > MAX_ENTRIES) return best(hits);
-    }
-    if (hits.length) return best(hits);
-    queue = next;
-  }
-  return null;
-}
-
 // src/guest/apps/shortcuts.ts
 import os5 from "node:os";
-import path19 from "node:path";
+import path20 from "node:path";
 function shortcuts(apps) {
   if (!apps.length) return;
-  const desktop = path19.join(os5.homedir(), "Desktop");
-  const start = path19.join(
-    process.env.APPDATA ?? path19.join(os5.homedir(), "AppData", "Roaming"),
+  const desktop = path20.join(os5.homedir(), "Desktop");
+  const start = path20.join(
+    process.env.APPDATA ?? path20.join(os5.homedir(), "AppData", "Roaming"),
     "Microsoft",
     "Windows",
     "Start Menu",
@@ -27827,9 +28195,9 @@ function shortcuts(apps) {
   const links = apps.flatMap((app) => {
     const name = app.name.replace(/[\\/:*?"<>|]/g, "");
     return [desktop, start].map((folder) => ({
-      link: path19.join(folder, name + ".lnk"),
+      link: path20.join(folder, name + ".lnk"),
       target: app.exe,
-      workingDirectory: path19.dirname(app.exe)
+      workingDirectory: path20.dirname(app.exe)
     }));
   });
   runScriptWithJson("new-shortcuts.ps1", "ListFile", links);
@@ -27954,19 +28322,19 @@ async function resolve(entry) {
   }
   if ("url" in s) {
     const name = decodeURIComponent(new URL(s.url).pathname.split("/").pop() || entry.id);
-    return { url: s.url, fileName: /\.\w{2,5}$/.test(name) ? name : name + ".zip" };
+    return { url: s.url, fileName: /\.\w{2,5}$/.test(name) ? name : name + ".zip", sha256: s.sha256 };
   }
   if ("resolve" in s && RESOLVERS[s.resolve]) return RESOLVERS[s.resolve]();
   throw new Error("no download source for " + entry.name);
 }
 
 // src/guest/apps/unpack.ts
-import fs15 from "node:fs";
-import path20 from "node:path";
+import fs16 from "node:fs";
+import path21 from "node:path";
 var sevenZip = () => tool("apps", "7zip", "7z.exe");
 async function unpack(entry, file3, out, d) {
   if (entry.id === "7zip") {
-    const sevenZr = path20.join(path20.dirname(file3), "7zr.exe");
+    const sevenZr = path21.join(path21.dirname(file3), "7zr.exe");
     const zr = await githubAsset("ip7z/7zip", /^7zr\.exe$/);
     await downloader.file(zr.url, sevenZr, zr.sha256);
     await execAsync(sevenZr, ["x", "-y", "-o" + out, file3], { stdio: "ignore" });
@@ -27975,17 +28343,17 @@ async function unpack(entry, file3, out, d) {
   switch (entry.unpack ?? "archive") {
     case "file": {
       mkdirp(out);
-      fs15.renameSync(file3, path20.join(out, /^\//.test(entry.exe) ? path20.basename(file3) : entry.exe));
+      fs16.renameSync(file3, path21.join(out, /^\//.test(entry.exe) ? path21.basename(file3) : entry.exe));
       return;
     }
     case "nsis": {
       if (!exists(sevenZip()))
         throw new Error("7-Zip is needed to unpack " + entry.name + " and could not be installed");
-      const raw = path20.join(path20.dirname(out), "raw");
+      const raw = path21.join(path21.dirname(out), "raw");
       await execAsync(sevenZip(), ["x", "-y", "-o" + raw, file3], { stdio: "ignore" });
       const inner = findExe(raw, "/^app-64\\.7z$/");
       if (inner) await execAsync(sevenZip(), ["x", "-y", "-o" + out, inner], { stdio: "ignore" });
-      else fs15.renameSync(raw, out);
+      else fs16.renameSync(raw, out);
       return;
     }
     case "msi": {
@@ -28035,12 +28403,12 @@ var AppInstaller = class {
   async installOne(entry) {
     try {
       const dest = tool("apps", ...entry.id.split("/"));
-      if (!exists(path21.join(dest, MARKER)) || this.options.refresh) await this.download(entry, dest);
+      if (!exists(path22.join(dest, MARKER)) || this.options.refresh) await this.download(entry, dest);
       const exe = findExe(dest, entry.exe);
       if (!exe) throw new Error(entry.exe + " not found in the download");
       await afterInstall(entry, exe);
-      if (entry.cli || entry.id === "sysinternals") this.env.prepend.push(path21.dirname(exe));
-      if (!entry.cli) this.gui.push({ name: entry.name, exe });
+      if (!entry.service && (entry.cli || entry.id === "sysinternals")) this.env.prepend.push(path22.dirname(exe));
+      if (!entry.cli && !entry.service) this.gui.push({ name: entry.name, exe });
       this.installed.push(entry.name);
     } catch (e) {
       warn(
@@ -28052,10 +28420,13 @@ var AppInstaller = class {
   /** Downloads and unpacks one entry into its folder (replaced in one step: never half there). */
   async download(entry, dest) {
     const work = stagingFolder(dest);
-    const out = path21.join(work, "out");
+    const out = path22.join(work, "out");
     try {
-      if ("npm" in entry.source) {
-        const npmCli = path21.join(path21.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+      if ("locked" in entry.source) {
+        log("Installing " + entry.name + " " + entry.source.version + " (pinned, every file checked) ...");
+        await installLocked(entry.id, entry.source.locked, mkdirp(out));
+      } else if ("npm" in entry.source) {
+        const npmCli = path22.join(path22.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
         log("Installing " + entry.name + " (npm) ...");
         await execAsync(process.execPath, [
           npmCli,
@@ -28070,17 +28441,60 @@ var AppInstaller = class {
       } else {
         const d = await resolve(entry);
         log("Downloading " + entry.name + " (" + d.fileName + ", ~" + entry.size + " once) ...");
-        const file3 = path21.join(mkdirp(work), d.fileName.replace(/[\\/:*?"<>|]/g, "_"));
+        const file3 = path22.join(mkdirp(work), d.fileName.replace(/[\\/:*?"<>|]/g, "_"));
         await downloader.file(d.url, file3, { sha256: d.sha256 ?? null });
         await unpack(entry, file3, out, d);
       }
-      fs16.writeFileSync(path21.join(out, MARKER), JSON.stringify({ id: entry.id, at: (/* @__PURE__ */ new Date()).toISOString() }));
+      fs17.writeFileSync(path22.join(out, MARKER), JSON.stringify({ id: entry.id, at: (/* @__PURE__ */ new Date()).toISOString() }));
       moveIntoPlace(out, dest);
     } finally {
-      safeRemove(work, path21.dirname(work));
+      safeRemove(work, path22.dirname(work));
     }
   }
 };
+var LOCKED_PYTHON = "3.13";
+async function installLocked(id, kind, out) {
+  const lock = path22.join(launchDir, "sandbox", "addons", id);
+  if (kind === "npm") {
+    for (const f of ["package.json", "package-lock.json"]) fs17.copyFileSync(path22.join(lock, f), path22.join(out, f));
+    const npmCli = path22.join(path22.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+    await execAsync(
+      process.execPath,
+      [npmCli, "ci", "--ignore-scripts", "--no-audit", "--no-fund", "--loglevel=error"],
+      { cwd: out }
+    );
+    return;
+  }
+  const uv = findExe(tool("uv"), "uv.exe");
+  if (!uv) throw new Error("uv is not installed (the uv step failed)");
+  const env = { ...process.env, ...uvVars() };
+  const venv = path22.join(out, "venv");
+  await execAsync(
+    uv,
+    ["venv", "--relocatable", "--python", LOCKED_PYTHON, "--python-preference", "only-managed", venv],
+    {
+      env
+    }
+  );
+  await execAsync(
+    uv,
+    [
+      "pip",
+      "install",
+      "--python",
+      path22.join(venv, "Scripts", "python.exe"),
+      "--require-hashes",
+      "--no-deps",
+      "--only-binary",
+      ":all:",
+      "--link-mode",
+      "copy",
+      "-r",
+      path22.join(lock, "requirements.txt")
+    ],
+    { env }
+  );
+}
 async function setupApps(env, apps, o) {
   const { entries: entries3, skipped } = appsToInstall(apps, o.gitAccess);
   for (const s of skipped) env.summary.push("app skipped: " + s);
@@ -28092,8 +28506,8 @@ async function setupApps(env, apps, o) {
 }
 
 // src/guest/toolchains/detect.ts
-import fs17 from "node:fs";
-import path22 from "node:path";
+import fs18 from "node:fs";
+import path23 from "node:path";
 
 // src/guest/runtime/project-context.ts
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -28235,14 +28649,14 @@ function workspaceEntries() {
   if (known) return known;
   const list = (dir) => {
     try {
-      return fs17.readdirSync(dir, { withFileTypes: true });
+      return fs18.readdirSync(dir, { withFileTypes: true });
     } catch {
       return [];
     }
   };
   const top = list(workspace2);
   const below = top.filter((d) => d.isDirectory() && !d.name.startsWith(".") && !SKIP_DIRS.has(d.name.toLowerCase())).flatMap(
-    (d) => list(path22.join(workspace2, d.name)).filter((f) => f.isFile()).map((f) => d.name + "/" + f.name)
+    (d) => list(path23.join(workspace2, d.name)).filter((f) => f.isFile()).map((f) => d.name + "/" + f.name)
   );
   const found = [...top.filter((d) => d.isFile()).map((d) => d.name), ...below];
   entries.set(workspace2.toLowerCase(), found);
@@ -28253,9 +28667,9 @@ function wanted(setting, toolchain) {
 }
 function versionFromFiles(files, parse5 = (t) => specFromVersionFile(t)) {
   for (const name of files) {
-    const file3 = path22.join(projectWorkspace(), name);
+    const file3 = path23.join(projectWorkspace(), name);
     if (!exists(file3)) continue;
-    const spec = parse5(fs17.readFileSync(file3, "utf8"), name);
+    const spec = parse5(fs18.readFileSync(file3, "utf8"), name);
     if (spec) return { spec, source: name };
   }
   return null;
@@ -28318,22 +28732,22 @@ var DatabaseServer = class {
 };
 
 // src/guest/databases/dynamodb.ts
-import fs22 from "node:fs";
-import path25 from "node:path";
+import fs23 from "node:fs";
+import path26 from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 
 // src/guest/toolchains/languages/java.ts
-import fs20 from "node:fs";
-import path23 from "node:path";
+import fs21 from "node:fs";
+import path24 from "node:path";
 
 // src/guest/toolchains/version-cache.ts
-import fs19 from "node:fs";
+import fs20 from "node:fs";
 
 // src/guest/toolchains/state-file.ts
-import fs18 from "node:fs";
+import fs19 from "node:fs";
 function readState(file3, schema, empty) {
   try {
-    return schema.safeParse(JSON.parse(fs18.readFileSync(file3, "utf8").replace(/^\uFEFF/, ""))).data ?? empty;
+    return schema.safeParse(JSON.parse(fs19.readFileSync(file3, "utf8").replace(/^\uFEFF/, ""))).data ?? empty;
   } catch {
     return empty;
   }
@@ -28368,7 +28782,7 @@ var VersionCache = class {
       return cached2.value;
     try {
       const value = await resolve2();
-      fs19.mkdirSync(toolsDir, { recursive: true });
+      fs20.mkdirSync(toolsDir, { recursive: true });
       writeJsonAtomic(this.file(), { ...this.remembered(), [key]: { value, at: Date.now() } });
       return value;
     } catch (e) {
@@ -28421,7 +28835,7 @@ var setupJdk = async (env, config2) => {
   const { major, source } = await javaMajor(config2);
   const release = await resolveCached("java:" + major, async () => (await temurin(major)).release_name);
   const home = tool("java", release.replace(/[^A-Za-z0-9.-]/g, "_"));
-  if (!exists(path23.join(home, "bin", "java.exe"))) {
+  if (!exists(path24.join(home, "bin", "java.exe"))) {
     const asset = await temurin(major);
     log("Downloading Java " + release + " (JDK, ~200 MB once) ...");
     await downloader.archive(asset.binary.package.link, home, {
@@ -28431,13 +28845,13 @@ var setupJdk = async (env, config2) => {
     });
   }
   env.vars.JAVA_HOME = home;
-  env.prepend.push(path23.join(home, "bin"));
+  env.prepend.push(path24.join(home, "bin"));
   env.summary.push("java: " + release + " (Temurin, from " + source + ")");
 };
 async function ensureJdk() {
   const root = tool("java");
-  const installed = exists(root) ? fs20.readdirSync(root).filter((d) => exists(path23.join(root, d, "bin", "java.exe"))).sort((a, b) => b.localeCompare(a, void 0, { numeric: true })) : [];
-  if (installed.length) return path23.join(root, installed[0]);
+  const installed = exists(root) ? fs21.readdirSync(root).filter((d) => exists(path24.join(root, d, "bin", "java.exe"))).sort((a, b) => b.localeCompare(a, void 0, { numeric: true })) : [];
+  if (installed.length) return path24.join(root, installed[0]);
   const scratch = emptyEnv();
   await setupJdk(scratch, { enabled: true, version: "lts", maven: false, gradle: false });
   return scratch.vars.JAVA_HOME;
@@ -28450,7 +28864,7 @@ var setupMaven = async (env) => {
     return pickPackageVersion(versions, "3") ?? Promise.reject(new Error("No Maven 3 release found"));
   });
   const home = tool("maven", version2);
-  if (!exists(path23.join(home, "bin", "mvn.cmd"))) {
+  if (!exists(path24.join(home, "bin", "mvn.cmd"))) {
     const url2 = MAVEN + version2 + "/apache-maven-" + version2 + "-bin.zip";
     log("Downloading Maven " + version2 + " (~10 MB once) ...");
     await downloader.archive(url2, home, {
@@ -28460,7 +28874,7 @@ var setupMaven = async (env) => {
   }
   const repo = tool("maven-repository");
   Object.assign(env.vars, { MAVEN_HOME: home, M2_HOME: home, MAVEN_OPTS: "-Dmaven.repo.local=" + repo });
-  env.prepend.push(path23.join(home, "bin"));
+  env.prepend.push(path24.join(home, "bin"));
   env.summary.push("maven: " + version2);
 };
 var setupGradle = async (env) => {
@@ -28472,7 +28886,7 @@ var setupGradle = async (env) => {
     async () => current?.version ?? Promise.reject(new Error("Gradle version lookup failed"))
   );
   const home = tool("gradle", version2);
-  if (!exists(path23.join(home, "bin", "gradle.bat"))) {
+  if (!exists(path24.join(home, "bin", "gradle.bat"))) {
     if (!current || current.version !== version2)
       throw new Error("Gradle " + version2 + " is not installed and cannot be downloaded right now");
     log("Downloading Gradle " + version2 + " (~130 MB once) ...");
@@ -28483,13 +28897,13 @@ var setupGradle = async (env) => {
     });
   }
   const userHome = tool("gradle-home");
-  fs20.mkdirSync(userHome, { recursive: true });
+  fs21.mkdirSync(userHome, { recursive: true });
   Object.assign(env.vars, {
     GRADLE_HOME: home,
     GRADLE_USER_HOME: userHome,
     GRADLE_OPTS: "-Dorg.gradle.vfs.watch=false"
   });
-  env.prepend.push(path23.join(home, "bin"));
+  env.prepend.push(path24.join(home, "bin"));
   env.summary.push("gradle: " + version2);
 };
 async function setupJava(env, config2) {
@@ -28513,29 +28927,29 @@ async function setupJava(env, config2) {
 }
 
 // src/guest/databases/server.ts
-import fs21 from "node:fs";
-import path24 from "node:path";
+import fs22 from "node:fs";
+import path25 from "node:path";
 import { spawn as spawn2 } from "node:child_process";
 function dataFor(name) {
-  return path24.join(dataDir, "databases", name);
+  return path25.join(dataDir, "databases", name);
 }
 async function startServer(name, exe, args, port) {
   if (await portOpen(port)) throw new Error("port " + port + " is already in use (change databases." + name + ".port)");
-  const logFile2 = path24.join(logsDir, name + ".log");
-  const out = fs21.openSync(logFile2, "a");
+  const logFile2 = path25.join(logsDir, name + ".log");
+  const out = fs22.openSync(logFile2, "a");
   spawn2(exe, args, { detached: true, stdio: ["ignore", out, out], windowsHide: true }).unref();
-  fs21.closeSync(out);
+  fs22.closeSync(out);
   if (!await waitForPort(port, 60))
     throw new Error(name + " did not start listening on port " + port + "; see " + logFile2);
 }
 async function clearStaleLocks(dir, files, port) {
   if (await portOpen(port)) return;
-  for (const f of files) fs21.rmSync(path24.join(dir, f), { force: true });
+  for (const f of files) fs22.rmSync(path25.join(dir, f), { force: true });
 }
 async function createOnce(data, marker, create) {
-  if (exists(path24.join(data, marker))) return;
+  if (exists(path25.join(data, marker))) return;
   const existed = exists(data);
-  mkdirp(path24.dirname(data));
+  mkdirp(path25.dirname(data));
   try {
     await create();
   } catch (e) {
@@ -28559,9 +28973,9 @@ var DynamoServer = class extends DatabaseServer {
    * local endpoint up from AWS_ENDPOINT_URL_DYNAMODB, with dummy credentials (real ones never reach the sandbox).
    */
   async start(env, plan2) {
-    const java = path25.join(await ensureJdk(), "bin", "java.exe");
+    const java = path26.join(await ensureJdk(), "bin", "java.exe");
     const home = tool("dynamodb-local");
-    if (!exists(path25.join(home, "DynamoDBLocal.jar"))) {
+    if (!exists(path26.join(home, "DynamoDBLocal.jar"))) {
       log("Downloading DynamoDB Local (~60 MB once) ...");
       const sha256 = (await fetchText(DYNAMO_ZIP + ".sha256")).trim().split(/\s+/)[0];
       await downloader.archive(DYNAMO_ZIP, home, {
@@ -28575,9 +28989,9 @@ var DynamoServer = class extends DatabaseServer {
       "dynamodb",
       java,
       [
-        "-Djava.library.path=" + path25.join(home, "DynamoDBLocal_lib"),
+        "-Djava.library.path=" + path26.join(home, "DynamoDBLocal_lib"),
         "-jar",
-        path25.join(home, "DynamoDBLocal.jar"),
+        path26.join(home, "DynamoDBLocal.jar"),
         "-sharedDb",
         "-dbPath",
         data,
@@ -28601,10 +29015,10 @@ var DynamoServer = class extends DatabaseServer {
     );
     if (!plan2.adminPort) return;
     const prefix = tool("dynamodb-admin");
-    const script = path25.join(prefix, "node_modules", "dynamodb-admin", "dist", "dynamodb-admin.js");
+    const script = path26.join(prefix, "node_modules", "dynamodb-admin", "dist", "dynamodb-admin.js");
     if (!exists(script)) {
       log("Installing dynamodb-admin, the DynamoDB web UI (~20 MB once) ...");
-      const npmCli = path25.join(path25.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+      const npmCli = path26.join(path26.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
       await execAsync(
         process.execPath,
         [npmCli, "install", "--global", "--prefix", prefix, "dynamodb-admin", "--no-fund", "--no-audit"],
@@ -28617,15 +29031,15 @@ var DynamoServer = class extends DatabaseServer {
       );
       return;
     }
-    const out = fs22.openSync(path25.join(logsDir, "dynamodb-admin.log"), "a");
+    const out = fs23.openSync(path26.join(logsDir, "dynamodb-admin.log"), "a");
     spawn3(
       process.execPath,
       [script, "--port", String(plan2.adminPort), "--dynamo-endpoint", endpoint, "--skip-default-credentials"],
       { detached: true, stdio: ["ignore", out, out], windowsHide: true, env: { ...process.env, ...aws } }
     ).unref();
-    fs22.closeSync(out);
+    fs23.closeSync(out);
     if (!await waitForPort(plan2.adminPort, 30))
-      throw new Error("dynamodb-admin did not start; see " + path25.join(logsDir, "dynamodb-admin.log"));
+      throw new Error("dynamodb-admin did not start; see " + path26.join(logsDir, "dynamodb-admin.log"));
     env.summary.push(
       "dynamodb-admin: http://localhost:" + plan2.adminPort + " (browse and edit tables in the sandbox's browser)"
     );
@@ -28633,32 +29047,7 @@ var DynamoServer = class extends DatabaseServer {
 };
 
 // src/guest/databases/mongodb.ts
-import path26 from "node:path";
-
-// src/guest/toolchains/install.ts
-import fs23 from "node:fs";
-async function downloadFile(url2, file3, sha256 = null) {
-  const part = file3 + ".part";
-  try {
-    await downloader.file(url2, part, sha256);
-    fs23.rmSync(file3, { force: true });
-    fs23.renameSync(part, file3);
-  } finally {
-    fs23.rmSync(part, { force: true });
-  }
-}
-async function installFromGithub(repo, pattern, o) {
-  const asset = await githubAsset(repo, pattern, o.searchOlder);
-  log("Downloading " + (typeof o.what === "string" ? o.what : o.what(asset)) + " ...");
-  await downloader.archive(asset.url, o.dest, {
-    sha256: asset.sha256,
-    fileName: asset.name,
-    ...o.locate ? { locate: o.locate } : {},
-    ...o.up ? { up: o.up } : {}
-  });
-}
-
-// src/guest/databases/mongodb.ts
+import path27 from "node:path";
 var MongoServer = class extends DatabaseServer {
   id = "mongodb";
   async start(env, plan2) {
@@ -28673,13 +29062,13 @@ var MongoServer = class extends DatabaseServer {
     };
     const version2 = await resolveCached("mongodb:" + plan2.version, async () => (await find()).version);
     const home = tool("mongodb", version2);
-    if (!exists(path26.join(home, "bin", "mongod.exe"))) {
+    if (!exists(path27.join(home, "bin", "mongod.exe"))) {
       const { archive } = await find();
       log("Downloading MongoDB " + version2 + " (~400 MB once) ...");
       await downloader.archive(archive.url, home, { sha256: archive.sha256, locate: "mongod.exe", up: 1 });
     }
     const shell = tool("mongosh");
-    if (!exists(path26.join(shell, "mongosh.exe"))) {
+    if (!exists(path27.join(shell, "mongosh.exe"))) {
       await installFromGithub("mongodb-js/mongosh", /^mongosh-[\d.]+-win32-x64\.zip$/, {
         dest: shell,
         what: "mongosh, the MongoDB shell (~50 MB once)",
@@ -28690,17 +29079,17 @@ var MongoServer = class extends DatabaseServer {
     await clearStaleLocks(data, ["mongod.lock"], plan2.port);
     await startServer(
       "mongodb",
-      path26.join(home, "bin", "mongod.exe"),
+      path27.join(home, "bin", "mongod.exe"),
       ["--dbpath", data, "--bind_ip", "127.0.0.1", "--port", String(plan2.port)],
       plan2.port
     );
-    env.prepend.push(path26.join(home, "bin"), shell);
+    env.prepend.push(path27.join(home, "bin"), shell);
     env.summary.push("mongodb " + version2 + ": mongodb://127.0.0.1:" + plan2.port + " (mongosh on PATH)");
   }
 };
 
 // src/guest/databases/mysql.ts
-import path27 from "node:path";
+import path28 from "node:path";
 var MARIA = "https://downloads.mariadb.org/rest-api/mariadb/";
 var MysqlServer = class extends DatabaseServer {
   id = "mysql";
@@ -28718,8 +29107,8 @@ var MysqlServer = class extends DatabaseServer {
     };
     const version2 = await resolveCached("mariadb-version:" + series, async () => (await latest()).version);
     const home = tool("mariadb", version2);
-    const bin = path27.join(home, "bin");
-    if (!exists(path27.join(bin, "mariadbd.exe"))) {
+    const bin = path28.join(home, "bin");
+    if (!exists(path28.join(bin, "mariadbd.exe"))) {
       const { zip } = await latest();
       log("Downloading MariaDB " + version2 + " (~90 MB once) ...");
       await downloader.archive(zip.file_download_url.replace(/^http:/, "https:"), home, {
@@ -28732,13 +29121,13 @@ var MysqlServer = class extends DatabaseServer {
     const data = dataFor("mariadb");
     await createOnce(data, "mysql", async () => {
       log("Creating the MariaDB database (first start) ...");
-      await execAsync(path27.join(bin, "mariadb-install-db.exe"), ["--datadir=" + data, "--port=" + plan2.port], {
+      await execAsync(path28.join(bin, "mariadb-install-db.exe"), ["--datadir=" + data, "--port=" + plan2.port], {
         stdio: "ignore"
       });
     });
     await startServer(
       "mysql",
-      path27.join(bin, "mariadbd.exe"),
+      path28.join(bin, "mariadbd.exe"),
       ["--datadir=" + data, "--port=" + plan2.port, "--bind-address=127.0.0.1", "--console"],
       plan2.port
     );
@@ -28752,7 +29141,7 @@ var MysqlServer = class extends DatabaseServer {
 
 // src/guest/databases/postgres.ts
 import fs24 from "node:fs";
-import path28 from "node:path";
+import path29 from "node:path";
 function postgresData(version2) {
   return dataFor("postgres-" + version2.split(".")[0]);
 }
@@ -28767,8 +29156,8 @@ var PostgresServer = class extends DatabaseServer {
       return hit ? hit.major + "." + hit.latestMinor : Promise.reject(new Error("No supported PostgreSQL " + plan2.version));
     });
     const home = tool("postgres", exact);
-    const bin = path28.join(home, "bin");
-    if (!exists(path28.join(bin, "pg_ctl.exe"))) {
+    const bin = path29.join(home, "bin");
+    if (!exists(path29.join(bin, "pg_ctl.exe"))) {
       log("Downloading PostgreSQL " + exact + " (~330 MB once) ...");
       await downloader.archive(
         "https://get.enterprisedb.com/postgresql/postgresql-" + exact + "-1-windows-x64-binaries.zip",
@@ -28785,7 +29174,7 @@ var PostgresServer = class extends DatabaseServer {
     await createOnce(data, "PG_VERSION", async () => {
       log("Creating the PostgreSQL database (first start) ...");
       await execAsync(
-        path28.join(bin, "initdb.exe"),
+        path29.join(bin, "initdb.exe"),
         ["-D", data, "-U", "postgres", "-A", "trust", "-E", "UTF8", "--locale=C"],
         { stdio: "ignore" }
       );
@@ -28794,7 +29183,7 @@ var PostgresServer = class extends DatabaseServer {
       throw new Error("port " + plan2.port + " is already in use (change databases.postgres.port)");
     await clearStaleLocks(data, ["postmaster.pid"], plan2.port);
     await execAsync(
-      path28.join(bin, "pg_ctl.exe"),
+      path29.join(bin, "pg_ctl.exe"),
       [
         "start",
         "-D",
@@ -28803,7 +29192,7 @@ var PostgresServer = class extends DatabaseServer {
         "-t",
         "60",
         "-l",
-        path28.join(logsDir, "postgres.log"),
+        path29.join(logsDir, "postgres.log"),
         "-o",
         "-p " + plan2.port + " -c listen_addresses=localhost"
       ],
@@ -28820,8 +29209,8 @@ var PostgresServer = class extends DatabaseServer {
     if (exists(tool("postgres"))) {
       for (const version2 of fs24.readdirSync(tool("postgres"))) {
         const data = postgresData(version2);
-        const pgCtl = path28.join(tool("postgres", version2), "bin", "pg_ctl.exe");
-        if (exists(path28.join(data, "postmaster.pid")) && exists(pgCtl))
+        const pgCtl = path29.join(tool("postgres", version2), "bin", "pg_ctl.exe");
+        if (exists(path29.join(data, "postmaster.pid")) && exists(pgCtl))
           await execAsync(pgCtl, ["stop", "-D", data, "-m", "fast", "-w"], { stdio: "ignore" });
       }
     }
@@ -28830,12 +29219,12 @@ var PostgresServer = class extends DatabaseServer {
 };
 
 // src/guest/databases/redis.ts
-import path29 from "node:path";
+import path30 from "node:path";
 var RedisServer = class extends DatabaseServer {
   id = "redis";
   async start(env, plan2) {
     const home = tool("redis");
-    if (!exists(path29.join(home, "redis-server.exe"))) {
+    if (!exists(path30.join(home, "redis-server.exe"))) {
       await installFromGithub("redis-windows/redis-windows", /^Redis-[\d.]+-Windows-x64-msys2\.zip$/, {
         dest: home,
         what: (a) => "Redis (" + a.name + ", ~10 MB once)",
@@ -28845,7 +29234,7 @@ var RedisServer = class extends DatabaseServer {
     const data = mkdirp(dataFor("redis"));
     await startServer(
       "redis",
-      path29.join(home, "redis-server.exe"),
+      path30.join(home, "redis-server.exe"),
       ["--port", String(plan2.port), "--bind", "127.0.0.1", "--dir", data.replace(/\\/g, "/"), "--appendonly", "yes"],
       plan2.port
     );
@@ -28884,15 +29273,15 @@ async function setupDatabase(env, plan2) {
 
 // src/guest/toolchains/tools/git.ts
 import fs26 from "node:fs";
-import path31 from "node:path";
+import path32 from "node:path";
 
 // src/guest/runtime/csc.ts
 import fs25 from "node:fs";
 import os6 from "node:os";
-import path30 from "node:path";
+import path31 from "node:path";
 import crypto3 from "node:crypto";
 import { spawnSync as spawnSync3 } from "node:child_process";
-var CSC = path30.join(process.env.WINDIR ?? "C:\\Windows", "Microsoft.NET", "Framework64", "v4.0.30319", "csc.exe");
+var CSC = path31.join(process.env.WINDIR ?? "C:\\Windows", "Microsoft.NET", "Framework64", "v4.0.30319", "csc.exe");
 var SOURCES = {
   ptyhost: "PtyHost.cs",
   gitshim: "GitShim.cs",
@@ -28904,17 +29293,17 @@ var SOURCES = {
   memgov: "MemGov.cs"
 };
 function sourceOf(name) {
-  return path30.join(launchDir, "sandbox", "csharp", SOURCES[name]);
+  return path31.join(launchDir, "sandbox", "csharp", SOURCES[name]);
 }
 function sourceHash(name) {
   return crypto3.createHash("sha256").update(fs25.readFileSync(sourceOf(name))).digest("hex").slice(0, 12);
 }
 function ensureCompiled(name) {
-  const exe = path30.join(os6.tmpdir(), "agent-sandbox", name + "-" + sourceHash(name) + ".exe");
+  const exe = path31.join(os6.tmpdir(), "agent-sandbox", name + "-" + sourceHash(name) + ".exe");
   if (exists(exe)) return exe;
   if (!exists(CSC))
     throw new Error("The .NET Framework C# compiler was not found at " + CSC + " (it ships with Windows 10/11).");
-  mkdirp(path30.dirname(exe));
+  mkdirp(path31.dirname(exe));
   const result = spawnSync3(CSC, ["/nologo", "/optimize", "/target:exe", "/out:" + exe, sourceOf(name)], {
     encoding: "utf8",
     windowsHide: true
@@ -28953,18 +29342,18 @@ var installPortableGit = async (root) => {
 };
 var installGuard = (env, access, realGit) => {
   const dir = mkdirp(tool("gitguard"));
-  const guard = path31.join(launchDir, "runtime", "gitguard.js");
-  if (duringSession() && (exists(path31.join(dir, "git.exe")) || exists(path31.join(dir, "git.cmd")))) {
+  const guard = path32.join(launchDir, "runtime", "gitguard.js");
+  if (duringSession() && (exists(path32.join(dir, "git.exe")) || exists(path32.join(dir, "git.cmd")))) {
   } else
     try {
-      fs26.copyFileSync(ensureCompiled("gitshim"), path31.join(dir, "git.exe"));
-      fs26.rmSync(path31.join(dir, "git.cmd"), { force: true });
+      fs26.copyFileSync(ensureCompiled("gitshim"), path32.join(dir, "git.exe"));
+      fs26.rmSync(path32.join(dir, "git.cmd"), { force: true });
     } catch (e) {
       warn("git guard: falling back to git.cmd (" + errMsg(e) + ")");
-      fs26.writeFileSync(path31.join(dir, "git.cmd"), '@"' + process.execPath + '" "' + guard + '" %*\r\n');
+      fs26.writeFileSync(path32.join(dir, "git.cmd"), '@"' + process.execPath + '" "' + guard + '" %*\r\n');
     }
   fs26.writeFileSync(
-    path31.join(dir, "bashenv.sh"),
+    path32.join(dir, "bashenv.sh"),
     'git() { "' + posix(process.execPath) + '" "' + posix(guard) + '" "$@"; }\nexport -f git\n'
   );
   env.prepend.unshift(dir);
@@ -28973,13 +29362,13 @@ var installGuard = (env, access, realGit) => {
     AGENT_REAL_GIT: access === "readonly" ? realGit : "",
     AGENT_GUARD_NODE: process.execPath,
     AGENT_GUARD_SCRIPT: guard,
-    BASH_ENV: posix(path31.join(dir, "bashenv.sh"))
+    BASH_ENV: posix(path32.join(dir, "bashenv.sh"))
   });
   if (access === "readonly") {
-    const hooks = mkdirp(path31.join(dir, "hooks"));
+    const hooks = mkdirp(path32.join(dir, "hooks"));
     for (const hook of BLOCKED_HOOKS)
       fs26.writeFileSync(
-        path31.join(hooks, hook),
+        path32.join(hooks, hook),
         '#!/bin/sh\necho "git is read-only in this sandbox: ' + hook + ' refused." >&2\nexit 1\n'
       );
     Object.assign(env.vars, {
@@ -28988,12 +29377,12 @@ var installGuard = (env, access, realGit) => {
       GIT_CONFIG_VALUE_0: posix(hooks)
     });
   } else {
-    env.vars.GIT_DIR = path31.join(dataDir, "git-disabled");
+    env.vars.GIT_DIR = path32.join(dataDir, "git-disabled");
   }
 };
 var pointAtOwnCertificates = (root) => {
-  const config2 = path31.join(root, "etc", "gitconfig");
-  const bundle = path31.join(root, "mingw64", "etc", "ssl", "certs", "ca-bundle.crt");
+  const config2 = path32.join(root, "etc", "gitconfig");
+  const bundle = path32.join(root, "mingw64", "etc", "ssl", "certs", "ca-bundle.crt");
   if (!exists(config2) || !exists(bundle)) return;
   const text = fs26.readFileSync(config2, "utf8");
   const fixed = text.replace(/^(\s*sslCAInfo\s*=\s*).*$/gim, (_m, key) => key + posix(bundle));
@@ -29001,9 +29390,9 @@ var pointAtOwnCertificates = (root) => {
 };
 async function setupGit(env, hostCopy, refresh, access) {
   const root = tool("git");
-  const bash = path31.join(root, "bin", "bash.exe");
-  const gitExe = path31.join(root, "cmd", "git.exe");
-  const hostGit = path31.join(hostToolsDir, "git");
+  const bash = path32.join(root, "bin", "bash.exe");
+  const gitExe = path32.join(root, "cmd", "git.exe");
+  const hostGit = path32.join(hostToolsDir, "git");
   if (exists(root) && !exists(bash)) {
     log("Replacing the old MinGit (no bash) with full Git for Windows.");
     safeRemove(root, toolsDir);
@@ -29017,11 +29406,11 @@ async function setupGit(env, hostCopy, refresh, access) {
     }
     const work = stagingFolder(root);
     try {
-      if (hostCopy && exists(path31.join(hostGit, "bin", "bash.exe"))) {
+      if (hostCopy && exists(path32.join(hostGit, "bin", "bash.exe"))) {
         log("Copying Git for Windows from this PC ...");
         robocopy(hostGit, work);
       } else await installPortableGit(work);
-      if (!exists(path31.join(work, "bin", "bash.exe"))) throw new Error("bash.exe missing after installing Git");
+      if (!exists(path32.join(work, "bin", "bash.exe"))) throw new Error("bash.exe missing after installing Git");
       moveIntoPlace(work, root);
     } finally {
       safeRemove(work, toolsDir);
@@ -29030,10 +29419,10 @@ async function setupGit(env, hostCopy, refresh, access) {
   if (!exists(bash)) throw new Error("bash.exe missing after installing Git");
   pointAtOwnCertificates(root);
   env.vars.CLAUDE_CODE_GIT_BASH_PATH = bash;
-  env.append.push(path31.join(root, "usr", "bin"));
+  env.append.push(path32.join(root, "usr", "bin"));
   const version2 = execOutput(gitExe, ["--version"]).replace(/^git version /, "");
   if (access === "full") {
-    env.prepend.push(path31.join(root, "cmd"));
+    env.prepend.push(path32.join(root, "cmd"));
     env.summary.push("git: " + version2);
     return;
   }
@@ -29045,7 +29434,7 @@ async function setupGit(env, hostCopy, refresh, access) {
 
 // src/guest/toolchains/languages/go.ts
 import fs27 from "node:fs";
-import path32 from "node:path";
+import path33 from "node:path";
 
 // src/guest/toolchains/package-ledger.ts
 var LedgerSchema = external_exports.record(external_exports.string(), external_exports.string());
@@ -29099,7 +29488,7 @@ async function setupGo(env, config2) {
   }
   const version2 = await resolveCached("go:" + config2.version, async () => (await findRelease(config2.version)).version);
   const root = tool("go", version2);
-  if (!exists(path32.join(root, "bin", "go.exe"))) {
+  if (!exists(path33.join(root, "bin", "go.exe"))) {
     const goArch = arch === "arm64" ? "arm64" : "amd64";
     const file3 = (await findRelease(version2)).files.find(
       (f) => f.os === "windows" && f.arch === goArch && f.kind === "archive"
@@ -29116,16 +29505,16 @@ async function setupGo(env, config2) {
   const vars = {
     GOROOT: root,
     GOPATH,
-    GOBIN: path32.join(GOPATH, "bin"),
-    GOMODCACHE: path32.join(GOPATH, "pkg", "mod"),
+    GOBIN: path33.join(GOPATH, "bin"),
+    GOMODCACHE: path33.join(GOPATH, "pkg", "mod"),
     GOCACHE: tool("go-cache"),
     GOTOOLCHAIN: "auto",
     GOTELEMETRY: "off"
   };
   fs27.mkdirSync(vars.GOBIN, { recursive: true });
   Object.assign(env.vars, vars);
-  env.prepend.push(path32.join(root, "bin"), vars.GOBIN);
-  const go = path32.join(root, "bin", "go.exe");
+  env.prepend.push(path33.join(root, "bin"), vars.GOBIN);
+  const go = path33.join(root, "bin", "go.exe");
   env.summary.push("go: " + versionOf(go, ["version"]));
   await installOnce(
     env,
@@ -29183,77 +29572,6 @@ function decideCli(settings, ctx) {
   return Object.fromEntries(CLI_NAMES.map((name) => [name, decide(name)]));
 }
 
-// src/guest/toolchains/runtimes.ts
-import path33 from "node:path";
-async function setupSingleExe(env, name, repo, pattern, exeName, dir, options = {}) {
-  if (dryRun) {
-    log("(dry run) would provision " + name);
-    return;
-  }
-  const bin = options.subdir ? path33.join(dir, options.subdir) : dir;
-  const exe = path33.join(bin, exeName);
-  if (!exists(exe) || options.refresh) {
-    const size = options.size ? ", ~" + options.size : "";
-    await installFromGithub(repo, pattern, {
-      dest: dir,
-      what: (a) => name + " (" + a.name + size + " once)",
-      ...options.subdir ? {} : { locate: exeName }
-    });
-  }
-  if (!exists(exe)) throw new Error(exeName + " missing after installing " + name);
-  env.prepend.push(bin);
-  env.summary.push(name + ": " + versionOf(exe, options.versionArgs) + (options.note ?? ""));
-}
-async function setupBun(env) {
-  await setupSingleExe(
-    env,
-    "bun",
-    "oven-sh/bun",
-    arch === "arm64" ? /^bun-windows-aarch64\.zip$/ : /^bun-windows-x64\.zip$/,
-    "bun.exe",
-    tool("bun", "bin"),
-    { size: "35 MB" }
-  );
-  Object.assign(env.vars, {
-    BUN_INSTALL: tool("bun"),
-    BUN_INSTALL_CACHE_DIR: path33.join(localDir, "bun-cache"),
-    BUN_TMPDIR: path33.join(localDir, "bun-tmp")
-  });
-}
-async function setupDeno(env) {
-  await setupSingleExe(
-    env,
-    "deno",
-    "denoland/deno",
-    arch === "arm64" ? /^deno-aarch64-pc-windows-msvc[.]zip$/ : /^deno-x86_64-pc-windows-msvc[.]zip$/,
-    "deno.exe",
-    tool("deno", "bin"),
-    { size: "40 MB" }
-  );
-  Object.assign(env.vars, { DENO_DIR: tool("deno-cache"), DENO_INSTALL_ROOT: tool("deno"), DENO_NO_UPDATE_CHECK: "1" });
-}
-function uvVars() {
-  return {
-    UV_CACHE_DIR: tool("uv-cache"),
-    UV_PYTHON_INSTALL_DIR: tool("uv-python"),
-    UV_TOOL_DIR: tool("uv-tools"),
-    UV_TOOL_BIN_DIR: tool("uv-bin")
-  };
-}
-async function setupUv(env) {
-  await setupSingleExe(
-    env,
-    "uv",
-    "astral-sh/uv",
-    arch === "arm64" ? /^uv-aarch64-pc-windows-msvc\.zip$/ : /^uv-x86_64-pc-windows-msvc\.zip$/,
-    "uv.exe",
-    tool("uv"),
-    { size: "20 MB" }
-  );
-  Object.assign(env.vars, uvVars());
-  env.prepend.push(mkdirp(tool("uv-bin")));
-}
-
 // src/guest/toolchains/tools/cli.ts
 function ghConfigDir() {
   return path34.join(stateDir, "gh");
@@ -31286,12 +31604,12 @@ function parseTree(text, errors = [], options = ParseOptions.DEFAULT) {
   }
   return result;
 }
-function findNodeAtLocation(root, path75) {
+function findNodeAtLocation(root, path77) {
   if (!root) {
     return void 0;
   }
   let node2 = root;
-  for (let segment of path75) {
+  for (let segment of path77) {
     if (typeof segment === "string") {
       if (node2.type !== "object" || !Array.isArray(node2.children)) {
         return void 0;
@@ -31645,14 +31963,14 @@ function getNodeType(value) {
 
 // node_modules/jsonc-parser/lib/esm/impl/edit.js
 function setProperty(text, originalPath, value, options) {
-  const path75 = originalPath.slice();
+  const path77 = originalPath.slice();
   const errors = [];
   const root = parseTree(text, errors);
   let parent = void 0;
   let lastSegment = void 0;
-  while (path75.length > 0) {
-    lastSegment = path75.pop();
-    parent = findNodeAtLocation(root, path75);
+  while (path77.length > 0) {
+    lastSegment = path77.pop();
+    parent = findNodeAtLocation(root, path77);
     if (parent === void 0 && value !== void 0) {
       if (typeof lastSegment === "string") {
         value = { [lastSegment]: value };
@@ -31838,8 +32156,8 @@ var ParseErrorCode;
   ParseErrorCode2[ParseErrorCode2["InvalidEscapeCharacter"] = 15] = "InvalidEscapeCharacter";
   ParseErrorCode2[ParseErrorCode2["InvalidCharacter"] = 16] = "InvalidCharacter";
 })(ParseErrorCode || (ParseErrorCode = {}));
-function modify(text, path75, value, options) {
-  return setProperty(text, path75, value, options);
+function modify(text, path77, value, options) {
+  return setProperty(text, path77, value, options);
 }
 function applyEdits(text, edits) {
   let sortedEdits = edits.slice(0).sort((a, b) => {
@@ -32232,7 +32550,12 @@ function plan(config2, versions, o) {
     },
     { name: "Deno", enabled: wanted(config2.deno.enabled, "deno"), install: (env) => setupDeno(env) },
     { name: "Bun", enabled: wanted(config2.bun.enabled, "bun"), install: (env) => setupBun(env) },
-    { name: "uv", enabled: wanted(config2.uv.enabled, "uv"), install: (env) => setupUv(env) },
+    // Headroom (an agent add-on) installs with uv: the uv step runs for it too, before the apps.
+    {
+      name: "uv",
+      enabled: wanted(config2.uv.enabled, "uv") || appsNeedUv(o.apps),
+      install: (env) => setupUv(env)
+    },
     { name: "PowerShell 7", enabled: wanted(config2.pwsh.enabled, "pwsh"), install: (env) => setupPwsh(env, o.refresh) },
     // The openssl tool comes from Git's install: after Git.
     {
@@ -32258,7 +32581,7 @@ function plan(config2, versions, o) {
       name: "Apps",
       enabled: apps,
       shared: true,
-      after: ["Mesa 3D", "Visual C++ runtime"],
+      after: ["Mesa 3D", "Visual C++ runtime", "uv"],
       install: (env) => setupApps(env, o.apps, { gitAccess: o.gitAccess, refresh: o.refresh })
     },
     {
@@ -32399,6 +32722,7 @@ async function setupToolchains(config2, versions, options, run3 = {}) {
     env.summary.push(...part.summary);
   }
   Object.assign(env.vars, config2.environment);
+  Object.assign(env.vars, envs.get("Git")?.vars);
   log("Set up " + steps.length + " toolchains and databases.");
   return env;
 }
@@ -33496,42 +33820,124 @@ function gitDenyRules(access) {
 function managedSettingsFile() {
   return path63.join(path63.dirname(managedClaudeMd()), "managed-settings.json");
 }
-function writeManagedSettings2(access) {
+function writeManagedSettings2(access, headroom = null) {
   const file3 = managedSettingsFile();
-  const deny = gitDenyRules(access);
-  if (deny.length === 0) {
+  const rtk = installedRtk();
+  const settings = claudeManagedSettings(gitDenyRules(access), rtk, headroom);
+  if (!settings) {
     fs50.rmSync(file3, { force: true });
     return;
   }
   fs50.mkdirSync(path63.dirname(file3), { recursive: true });
-  fs50.writeFileSync(file3, JSON.stringify({ permissions: { deny } }, null, 2) + "\n", "utf8");
+  fs50.writeFileSync(file3, JSON.stringify(settings, null, 2) + "\n", "utf8");
+  if (rtk) log("rtk: Claude Code's Bash commands go through it (hook in " + file3 + ")");
 }
 
-// src/guest/setup/desktop.ts
+// src/guest/setup/addon-mcp.ts
 import fs51 from "node:fs";
-import os10 from "node:os";
 import path64 from "node:path";
+var ADDON_MCP_NAMES = APPS.flatMap((a) => a.mcp ? [a.mcp.name] : []);
+function writeAddonMcpServers() {
+  const servers = {};
+  for (const { id, folder } of installedMcpAddons()) {
+    const mcp = APPS.find((a) => a.id === id)?.mcp;
+    if (mcp) servers[mcp.name] = addonMcpServer(folder, mcp);
+  }
+  const file3 = path64.join(claudeDir, ".claude.json");
+  let state = {};
+  if (fs51.existsSync(file3)) {
+    try {
+      const text = fs51.readFileSync(file3, "utf8");
+      state = JSON.parse(text.charCodeAt(0) === 65279 ? text.slice(1) : text);
+    } catch {
+      warn("Claude Code MCP servers from Apps: " + file3 + " is not valid JSON, left as it is");
+      return [];
+    }
+  } else if (!Object.keys(servers).length) return [];
+  if (typeof state !== "object" || state === null || Array.isArray(state)) return [];
+  const current = state.mcpServers;
+  const before = current && typeof current === "object" && !Array.isArray(current) ? current : {};
+  const after = withAddonMcpServers(before, servers, ADDON_MCP_NAMES);
+  if (JSON.stringify(before) !== JSON.stringify(after)) {
+    fs51.mkdirSync(claudeDir, { recursive: true });
+    writeJsonAtomic(file3, { ...state, mcpServers: after });
+  }
+  const names = Object.keys(servers);
+  if (names.length) log("Claude Code MCP servers from Apps: " + names.join(", "));
+  return names;
+}
+
+// src/guest/setup/headroom.ts
+import fs52 from "node:fs";
+import http from "node:http";
+import path65 from "node:path";
+import { spawn as spawn7 } from "node:child_process";
+var HEADROOM_LOG = path65.join(logsDir, "headroom.log");
+function answersAsHeadroom(port) {
+  return new Promise((resolve2) => {
+    const req = http.get({ host: "127.0.0.1", port, path: "/livez", timeout: 3e3 }, (res) => {
+      let body = "";
+      res.setEncoding("utf8");
+      res.on("data", (chunk) => {
+        if (body.length < 4096) body += chunk;
+      });
+      res.on("end", () => resolve2(res.statusCode === 200 && /"service"\s*:\s*"headroom-proxy"/.test(body)));
+    });
+    req.on("timeout", () => req.destroy());
+    req.on("error", () => resolve2(false));
+  });
+}
+async function startHeadroom(env) {
+  const exe = installedAddon("headroom");
+  if (!exe) return null;
+  if (env.ANTHROPIC_BASE_URL) {
+    log("Headroom: not used, ANTHROPIC_BASE_URL is set in the agent environment (" + env.ANTHROPIC_BASE_URL + ")");
+    return null;
+  }
+  const port = HEADROOM_PORT;
+  if (!await portOpen(port)) {
+    const out = fs52.openSync(HEADROOM_LOG, "a");
+    spawn7(exe, headroomArgs(port), {
+      detached: true,
+      stdio: ["ignore", out, out],
+      windowsHide: true,
+      env: headroomEnv(env)
+    }).unref();
+    fs52.closeSync(out);
+    if (!await waitForPort(port, 90))
+      throw new Error("the Headroom proxy did not start on port " + port + "; see " + HEADROOM_LOG);
+  }
+  if (!await answersAsHeadroom(port))
+    throw new Error("port " + port + " is taken by another program; Claude Code talks to the API directly");
+  log("Headroom: Claude Code reaches the API through " + headroomUrl(port) + " (log: " + HEADROOM_LOG + ")");
+  return headroomUrl(port);
+}
+
+// src/guest/setup/desktop.ts
+import fs53 from "node:fs";
+import os10 from "node:os";
+import path66 from "node:path";
 function applyPersonalization() {
-  const dir = path64.join(launchDir, "personalize");
+  const dir = path66.join(launchDir, "personalize");
   if (!session.personalization || !exists(dir) || dryRun || !isWin) return;
-  exec(SYSTEM.reg(), ["import", path64.join(dir, "personalize.reg")], { stdio: "ignore" });
-  const wallpaper = fs51.readdirSync(dir).find((f) => f.startsWith("wallpaper"));
-  const local = wallpaper ? path64.join(mkdirp(path64.join(os10.homedir(), "Pictures")), wallpaper) : null;
-  if (wallpaper && local) fs51.copyFileSync(path64.join(dir, wallpaper), local);
+  exec(SYSTEM.reg(), ["import", path66.join(dir, "personalize.reg")], { stdio: "ignore" });
+  const wallpaper = fs53.readdirSync(dir).find((f) => f.startsWith("wallpaper"));
+  const local = wallpaper ? path66.join(mkdirp(path66.join(os10.homedir(), "Pictures")), wallpaper) : null;
+  if (wallpaper && local) fs53.copyFileSync(path66.join(dir, wallpaper), local);
   runScript("set-desktop.ps1", local ? ["-Wallpaper", local] : []);
   log("Desktop personalisation applied from this PC.");
 }
 
 // src/guest/setup/git-identity.ts
-import fs52 from "node:fs";
+import fs54 from "node:fs";
 import os11 from "node:os";
-import path65 from "node:path";
+import path67 from "node:path";
 import { spawnSync as spawnSync7 } from "node:child_process";
 function setupGitConfig(env) {
   if (dryRun) return;
-  const source = path65.join(launchDir, "home", ".gitconfig");
-  if (exists(source)) fs52.copyFileSync(source, path65.join(os11.homedir(), ".gitconfig"));
-  const git = path65.join(toolsDir, "git", "cmd", "git.exe");
+  const source = path67.join(launchDir, "home", ".gitconfig");
+  if (exists(source)) fs54.copyFileSync(source, path67.join(os11.homedir(), ".gitconfig"));
+  const git = path67.join(toolsDir, "git", "cmd", "git.exe");
   if (!exists(git)) return;
   const { GIT_DIR: _gitDir, ...rest } = env;
   spawnSync7(git, ["config", "--global", "--add", "safe.directory", "*"], {
@@ -33544,7 +33950,7 @@ function setupGitConfig(env) {
 }
 
 // src/guest/setup/github-token.ts
-import fs53 from "node:fs";
+import fs55 from "node:fs";
 import { spawnSync as spawnSync8 } from "node:child_process";
 
 // src/shared/github/token.ts
@@ -33590,7 +33996,7 @@ function ghOutputText(text, token) {
 var GH_TIMEOUT_MS = 6e4;
 function prepareGithubFolder(token) {
   const dir = deliveredGhConfigDir();
-  fs53.rmSync(dir, { recursive: true, force: true });
+  fs55.rmSync(dir, { recursive: true, force: true });
   if (!token) return false;
   mkdirp(dir);
   return true;
@@ -33618,7 +34024,7 @@ function loginGithub(token, env) {
   const gh2 = ghExePath();
   const dir = deliveredGhConfigDir();
   if (!exists(gh2) || env.GH_CONFIG_DIR !== dir) {
-    fs53.rmSync(dir, { recursive: true, force: true });
+    fs55.rmSync(dir, { recursive: true, force: true });
     log("A GitHub token arrived, but gh is not set up in this sandbox (toolchains.cli.gh), so it is not used.");
     return;
   }
@@ -33626,7 +34032,7 @@ function loginGithub(token, env) {
     runGh(ghLoginCommand(gh2, dir, token, env), token, "gh auth login");
     runGh(ghSetupGitCommand(gh2, dir, env), token, "gh auth setup-git");
   } catch (e) {
-    fs53.rmSync(dir, { recursive: true, force: true });
+    fs55.rmSync(dir, { recursive: true, force: true });
     env.GH_CONFIG_DIR = mkdirp(ghConfigDir());
     addMachineEnvironment({ GH_CONFIG_DIR: env.GH_CONFIG_DIR }, []);
     throw e;
@@ -33640,35 +34046,35 @@ function ensurePtyHost() {
 }
 
 // src/guest/toolchains/leftovers.ts
-import fs54 from "node:fs";
-import path66 from "node:path";
+import fs56 from "node:fs";
+import path68 from "node:path";
 var STAGING = /\.staging-[0-9a-f]+$/i;
 var entries2 = (dir) => {
   try {
-    return fs54.readdirSync(dir, { withFileTypes: true });
+    return fs56.readdirSync(dir, { withFileTypes: true });
   } catch {
     return [];
   }
 };
 function pruneToolLeftovers() {
-  for (const legacy of ["ptyhost", "gitshim"]) safeRemove(path66.join(toolsDir, legacy), toolsDir);
+  for (const legacy of ["ptyhost", "gitshim"]) safeRemove(path68.join(toolsDir, legacy), toolsDir);
   for (const top of entries2(toolsDir)) {
-    const dir = path66.join(toolsDir, top.name);
+    const dir = path68.join(toolsDir, top.name);
     if (STAGING.test(top.name)) safeRemove(dir, toolsDir);
     else if (top.isDirectory())
-      for (const sub of entries2(dir).filter((e) => STAGING.test(e.name))) safeRemove(path66.join(dir, sub.name), dir);
+      for (const sub of entries2(dir).filter((e) => STAGING.test(e.name))) safeRemove(path68.join(dir, sub.name), dir);
   }
 }
 
 // src/guest/audit/process-audit.ts
-import path67 from "node:path";
+import path69 from "node:path";
 import { spawnSync as spawnSync9 } from "node:child_process";
 var PROCESS_CREATION = "{0CCE922B-69AE-11D9-BED3-505054503030}";
 var auditOn = () => Boolean(session.auditProcesses) && isWin && !dryRun;
 function enableProcessAudit() {
   if (!auditOn()) return;
   spawnSync9(
-    path67.join(process.env.WINDIR ?? "C:\\Windows", "System32", "auditpol.exe"),
+    path69.join(process.env.WINDIR ?? "C:\\Windows", "System32", "auditpol.exe"),
     ["/set", "/subcategory:" + PROCESS_CREATION, "/success:enable"],
     { windowsHide: true, stdio: "ignore" }
   );
@@ -33692,10 +34098,10 @@ function enableProcessAudit() {
 
 // src/guest/vpn/vpn.ts
 import dns2 from "node:dns";
-import fs58 from "node:fs";
+import fs60 from "node:fs";
 import net3 from "node:net";
 import os14 from "node:os";
-import path71 from "node:path";
+import path73 from "node:path";
 
 // src/shared/vpn/ovpn.ts
 var PROGRAM_DIRECTIVES = [
@@ -34218,8 +34624,8 @@ function tunnelAddressFromLog(log2) {
 
 // src/guest/vpn/openvpn.ts
 import crypto4 from "node:crypto";
-import fs55 from "node:fs";
-import path68 from "node:path";
+import fs57 from "node:fs";
+import path70 from "node:path";
 
 // src/shared/vpn/download.ts
 var OPENVPN_MSI = {
@@ -34249,7 +34655,7 @@ var WIREGUARD_MSI = {
 
 // src/guest/vpn/openvpn.ts
 function openvpnExe(env = process.env) {
-  return path68.join(env.ProgramFiles ?? "C:\\Program Files", "OpenVPN", "bin", "openvpn.exe");
+  return path70.join(env.ProgramFiles ?? "C:\\Program Files", "OpenVPN", "bin", "openvpn.exe");
 }
 function openvpnDownload(arch2 = process.arch) {
   const entry = arch2 === "arm64" ? OPENVPN_MSI.arm64 : OPENVPN_MSI.x64;
@@ -34260,20 +34666,20 @@ function repairServiceQueries() {
   if (did === "removed") log("VPN: repaired the Windows service queries installers use (a Windows Sandbox gap).");
   else if (did !== "absent" && did !== "kept") warn("VPN: could not check the Windows service queries installers use.");
 }
-var hasHash = (file3, sha256) => crypto4.createHash("sha256").update(fs55.readFileSync(file3)).digest("hex") === sha256;
+var hasHash = (file3, sha256) => crypto4.createHash("sha256").update(fs57.readFileSync(file3)).digest("hex") === sha256;
 async function ensureOpenVpn() {
   const exe = openvpnExe();
   if (!isWin || dryRun) return exe;
   if (exists(exe)) return exe;
   const dl = openvpnDownload();
-  const msi = path68.join(mkdirp(path68.join(toolsDir, "downloads")), dl.file);
+  const msi = path70.join(mkdirp(path70.join(toolsDir, "downloads")), dl.file);
   if (!exists(msi) || !hasHash(msi, dl.sha256)) {
     log("VPN: downloading OpenVPN " + OPENVPN_MSI.version + " (about 6 MB)");
     await downloader.file(dl.url, msi, dl.sha256);
   }
   repairServiceQueries();
   log("VPN: installing OpenVPN");
-  const logFile2 = path68.join(toolsDir, "downloads", "openvpn-install.log");
+  const logFile2 = path70.join(toolsDir, "downloads", "openvpn-install.log");
   const code = await spawnAsync(SYSTEM.msiexec(), ["/i", msi, "/qn", "/norestart", "/l*v", logFile2], {
     stdio: "ignore"
   });
@@ -34284,10 +34690,10 @@ async function ensureOpenVpn() {
 }
 
 // src/guest/vpn/tunnel.ts
-import { spawn as spawn7 } from "node:child_process";
-import fs56 from "node:fs";
+import { spawn as spawn8 } from "node:child_process";
+import fs58 from "node:fs";
 import os12 from "node:os";
-import path69 from "node:path";
+import path71 from "node:path";
 var DONE = "Initialization Sequence Completed";
 function failureReason(text) {
   if (/AUTH_FAILED/i.test(text))
@@ -34303,19 +34709,19 @@ function failureReason(text) {
 }
 var tail = (text, lines = 12) => text.trim().split(/\r?\n/).slice(-lines).join("\n");
 async function startTunnel(o) {
-  const dir = fs56.mkdtempSync(path69.join(os12.tmpdir(), "sbx-vpn-"));
-  const auth = path69.join(dir, "login.txt");
-  const logFile2 = path69.join(dir, "openvpn.log");
+  const dir = fs58.mkdtempSync(path71.join(os12.tmpdir(), "sbx-vpn-"));
+  const auth = path71.join(dir, "login.txt");
+  const logFile2 = path71.join(dir, "openvpn.log");
   const keepLog = () => {
     try {
-      fs56.mkdirSync(logsDir, { recursive: true });
-      fs56.copyFileSync(logFile2, path69.join(logsDir, "openvpn.log"));
+      fs58.mkdirSync(logsDir, { recursive: true });
+      fs58.copyFileSync(logFile2, path71.join(logsDir, "openvpn.log"));
     } catch {
     }
   };
-  fs56.writeFileSync(auth, o.username + "\r\n" + o.password + "\r\n", "utf8");
+  fs58.writeFileSync(auth, o.username + "\r\n" + o.password + "\r\n", "utf8");
   try {
-    const child = spawn7(
+    const child = spawn8(
       o.exe,
       ["--config", o.profile, "--auth-user-pass", auth, "--auth-nocache", "--verb", "3", "--log", logFile2],
       { detached: true, stdio: "ignore", windowsHide: true }
@@ -34331,7 +34737,7 @@ async function startTunnel(o) {
     child.unref();
     const deadline = Date.now() + (o.timeoutMs ?? 9e4);
     for (; ; ) {
-      const text = fs56.existsSync(logFile2) ? fs56.readFileSync(logFile2, "utf8") : "";
+      const text = fs58.existsSync(logFile2) ? fs58.readFileSync(logFile2, "utf8") : "";
       if (text.includes(DONE)) {
         keepLog();
         const tunnelIp = tunnelAddressFromLog(text) ?? void 0;
@@ -34351,41 +34757,41 @@ async function startTunnel(o) {
       await new Promise((r) => setTimeout(r, 500));
     }
   } finally {
-    fs56.rmSync(auth, { force: true });
+    fs58.rmSync(auth, { force: true });
   }
 }
 
 // src/guest/vpn/wireguard.ts
 import { execFile } from "node:child_process";
 import crypto5 from "node:crypto";
-import fs57 from "node:fs";
+import fs59 from "node:fs";
 import os13 from "node:os";
-import path70 from "node:path";
+import path72 from "node:path";
 var WIREGUARD_TUNNEL = "sandbox";
 function wireguardDir(env = process.env) {
-  return path70.join(env.ProgramFiles ?? "C:\\Program Files", "WireGuard");
+  return path72.join(env.ProgramFiles ?? "C:\\Program Files", "WireGuard");
 }
 function wireguardExe(env = process.env) {
-  return path70.join(wireguardDir(env), "wireguard.exe");
+  return path72.join(wireguardDir(env), "wireguard.exe");
 }
 function wireguardDownload(arch2 = process.arch) {
   const entry = arch2 === "arm64" ? WIREGUARD_MSI.arm64 : WIREGUARD_MSI.x64;
   return { ...entry, url: WIREGUARD_MSI.base + entry.file };
 }
-var hasHash2 = (file3, sha256) => crypto5.createHash("sha256").update(fs57.readFileSync(file3)).digest("hex") === sha256;
+var hasHash2 = (file3, sha256) => crypto5.createHash("sha256").update(fs59.readFileSync(file3)).digest("hex") === sha256;
 async function ensureWireguard() {
   const exe = wireguardExe();
   if (!isWin || dryRun) return exe;
   if (exists(exe)) return exe;
   const dl = wireguardDownload();
-  const msi = path70.join(mkdirp(path70.join(toolsDir, "downloads")), dl.file);
+  const msi = path72.join(mkdirp(path72.join(toolsDir, "downloads")), dl.file);
   if (!exists(msi) || !hasHash2(msi, dl.sha256)) {
     log("VPN: downloading WireGuard " + WIREGUARD_MSI.version + " (about 3 MB)");
     await downloader.file(dl.url, msi, dl.sha256);
   }
   repairServiceQueries();
   log("VPN: installing WireGuard");
-  const logFile2 = path70.join(toolsDir, "downloads", "wireguard-install.log");
+  const logFile2 = path72.join(toolsDir, "downloads", "wireguard-install.log");
   const code = await spawnAsync(
     SYSTEM.msiexec(),
     ["/i", msi, "/qn", "/norestart", "DO_NOT_LAUNCH=1", "/l*v", logFile2],
@@ -34417,10 +34823,10 @@ async function removeWireguardTunnel(exe) {
   }
 }
 async function startWireguardTunnel(o) {
-  const root = path70.join(process.env.SystemRoot ?? "C:\\Windows", "Temp");
-  const dir = fs57.mkdtempSync(path70.join(fs57.existsSync(root) ? root : os13.tmpdir(), "sbx-wg-"));
-  const file3 = path70.join(dir, WIREGUARD_TUNNEL + ".conf");
-  fs57.writeFileSync(file3, o.config, "utf8");
+  const root = path72.join(process.env.SystemRoot ?? "C:\\Windows", "Temp");
+  const dir = fs59.mkdtempSync(path72.join(fs59.existsSync(root) ? root : os13.tmpdir(), "sbx-wg-"));
+  const file3 = path72.join(dir, WIREGUARD_TUNNEL + ".conf");
+  fs59.writeFileSync(file3, o.config, "utf8");
   const fail = async (message) => {
     await removeWireguardTunnel(o.exe);
     return { ok: false, message };
@@ -34441,11 +34847,11 @@ async function startWireguardTunnel(o) {
       await sleep(500);
     }
   } finally {
-    fs57.rmSync(dir, { recursive: true, force: true });
+    fs59.rmSync(dir, { recursive: true, force: true });
   }
 }
 async function waitForHandshake(exe, poke, timeoutMs = 3e4) {
-  const wg = path70.join(path70.dirname(exe), "wg.exe");
+  const wg = path72.join(path72.dirname(exe), "wg.exe");
   if (!exists(wg)) return { ok: true, message: "the tunnel service is running (no wg.exe to check the handshake)" };
   const deadline = Date.now() + timeoutMs;
   for (; ; ) {
@@ -34580,8 +34986,8 @@ async function setupVpn(secrets, ptyHostExe) {
     } else {
       const credentials = secrets.vpn;
       if (!credentials) throw new Error("the VPN login did not arrive (start the sandbox again)");
-      const profile = path71.join(launchDir, "vpn", "server.ovpn");
-      const remotes = assertSafeOvpn(fs58.readFileSync(profile, "utf8"), vpn.server);
+      const profile = path73.join(launchDir, "vpn", "server.ovpn");
+      const remotes = assertSafeOvpn(fs60.readFileSync(profile, "utf8"), vpn.server);
       const exe = await ensureOpenVpn();
       const servers = await serverAddresses(remotes);
       if (servers.length === 0) throw new Error("the VPN server addresses could not be found");
@@ -34630,6 +35036,8 @@ var FrameType = {
   Resize: 3,
   Restart: 4,
   Ping: 5,
+  /** Ends the program and everything it started, and with it the session. */
+  Close: 6,
   Output: 16,
   Exit: 17,
   Error: 18,
@@ -34834,7 +35242,7 @@ var OutputFilter = class {
 };
 
 // src/shared/pty/console-input.ts
-import { spawn as spawn8 } from "node:child_process";
+import { spawn as spawn9 } from "node:child_process";
 function enableVtInput() {
   if (process.platform !== "win32" || !process.stdin.isTTY)
     return { ready: Promise.resolve(false), stop: () => Promise.resolve() };
@@ -34842,7 +35250,7 @@ function enableVtInput() {
   let exited = Promise.resolve();
   const ready = new Promise((resolve2) => {
     try {
-      child = spawn8(SYSTEM.powershell(), scriptArgs("enable-vt-input.ps1", ["-ProcessId", String(process.pid)]), {
+      child = spawn9(SYSTEM.powershell(), scriptArgs("enable-vt-input.ps1", ["-ProcessId", String(process.pid)]), {
         stdio: "ignore",
         windowsHide: true
       });
@@ -35091,7 +35499,7 @@ async function viewSession(id) {
 }
 
 // src/guest/boot/boot-env.ts
-import path72 from "node:path";
+import path74 from "node:path";
 
 // src/guest/boot/project-env.ts
 var EnvSchema = external_exports.object({
@@ -35110,7 +35518,7 @@ var BootEnvSchema = external_exports.object({
 });
 
 // src/guest/boot/boot-env.ts
-var file2 = () => path72.join(localDir, "boot-env.json");
+var file2 = () => path74.join(localDir, "boot-env.json");
 function saveBootEnv(value) {
   try {
     writeJsonAtomic(file2(), value);
@@ -35139,7 +35547,7 @@ function saveProjectStatus(name, workspace2, phase, message, databases, summary)
 }
 
 // src/guest/runtime/secrets.ts
-import fs59 from "node:fs";
+import fs61 from "node:fs";
 
 // src/shared/channel/secrets.ts
 var Environment = external_exports.record(external_exports.string().max(256), external_exports.string().max(65536));
@@ -35167,12 +35575,12 @@ function takeSecrets(id) {
   const file3 = run.secretFile(id);
   let text;
   try {
-    if (fs59.statSync(file3).size > MAX_BYTES) throw new Error("too big");
-    text = fs59.readFileSync(file3, "utf8").replace(/^\uFEFF/, "");
+    if (fs61.statSync(file3).size > MAX_BYTES) throw new Error("too big");
+    text = fs61.readFileSync(file3, "utf8").replace(/^\uFEFF/, "");
   } catch {
     return {};
   } finally {
-    fs59.rmSync(file3, { force: true });
+    fs61.rmSync(file3, { force: true });
   }
   try {
     const parsed = SecretsFileSchema.safeParse(JSON.parse(text));
@@ -35210,7 +35618,7 @@ async function soft(what, work) {
   }
 }
 function startDaemon(env, secrets) {
-  spawn9(process.execPath, [path73.join(path73.dirname(process.argv[1]), "daemon.js")], {
+  spawn10(process.execPath, [path75.join(path75.dirname(process.argv[1]), "daemon.js")], {
     detached: true,
     stdio: "ignore",
     windowsHide: true,
@@ -35223,20 +35631,20 @@ function startDaemon(env, secrets) {
   }).unref();
 }
 function writeDbCommand() {
-  const dir = mkdirp(path73.join(localDir, "bin"));
-  const db = path73.join(path73.dirname(process.argv[1]), "db.js");
-  fs60.writeFileSync(
-    path73.join(dir, "sbx-db.cmd"),
+  const dir = mkdirp(path75.join(localDir, "bin"));
+  const db = path75.join(path75.dirname(process.argv[1]), "db.js");
+  fs62.writeFileSync(
+    path75.join(dir, "sbx-db.cmd"),
     '@setlocal\r\n@set AGENT_LOG_PREFIX=db\r\n@"' + process.execPath + '" "' + db + '" %*\r\n'
   );
   writeAgentCommands(dir);
   return dir;
 }
 function writeAgentCommands(dir) {
-  const install = { node: process.execPath, script: path73.join(path73.dirname(process.argv[1]), "agent.js") };
+  const install = { node: process.execPath, script: path75.join(path75.dirname(process.argv[1]), "agent.js") };
   for (const shim3 of agentShims(toolsDir, session.agents ?? {}))
-    fs60.writeFileSync(path73.join(dir, shim3.command + ".cmd"), shimText(shim3, install));
-  fs60.writeFileSync(path73.join(dir, "sbx-agent.cmd"), sbxAgentText(install));
+    fs62.writeFileSync(path75.join(dir, shim3.command + ".cmd"), shimText(shim3, install));
+  fs62.writeFileSync(path75.join(dir, "sbx-agent.cmd"), sbxAgentText(install));
 }
 async function waitForPrimary() {
   for (let i = 0; i < PRIMARY_POLLS; i++) {
@@ -35264,7 +35672,7 @@ var Boot = class {
     log(
       "Agent sandbox: " + session.project + " | workspace " + workspace + " | agent " + session.harnessName + " | log " + logPath
     );
-    if (!fs60.statSync(workspace, { throwIfNoEntry: false })?.isDirectory())
+    if (!fs62.statSync(workspace, { throwIfNoEntry: false })?.isDirectory())
       throw new Error("Workspace folder is missing in the sandbox: " + workspace);
     mkdirp(toolsDir);
     mkdirp(run.root);
@@ -35276,7 +35684,7 @@ var Boot = class {
     const { tools, env } = await this.developerTools();
     await this.vpn();
     await this.gitIdentity(env);
-    await this.claude(tools);
+    await this.claude(tools, env);
     await this.agent(env);
     this.preAgentHooks(env);
     await this.start(env);
@@ -35359,15 +35767,20 @@ var Boot = class {
       await soft("GitHub token", () => loginGithub(token, env));
     }
   }
-  async claude(tools) {
+  async claude(tools, env) {
     step(6, "Claude settings, history and claude-mem");
     if (session.harnessName === "claude")
       await soft("Claude settings", () => syncClaudeProfile(this.secrets.claudeCredentials));
     await soft("claude-mem restore", restoreClaudeMem);
     await soft("Agent files of the last sandbox", resetMachineBound);
     await soft("Agent databases restore", restoreLocalState);
+    let headroom = null;
+    await soft("MCP servers from Apps", writeAddonMcpServers);
+    await soft("Headroom proxy", async () => {
+      headroom = await startHeadroom(env);
+    });
+    await soft("Claude managed settings", () => writeManagedSettings2(this.gitAccess, headroom));
     await soft("Sandbox guide for the agent", () => writeGuides(tools.summary, this.lan));
-    await soft("Claude managed settings", () => writeManagedSettings2(this.gitAccess));
   }
   async agent(env) {
     step(7, "Agent: " + session.harnessName);
@@ -35419,11 +35832,11 @@ runBoot().catch((e) => {
   const message = errMsg(e) + (e instanceof Error && e.stack ? "\n" + e.stack : "");
   try {
     setSandboxStatus("failed", errMsg(e));
-    fs61.writeFileSync(path74.join(logsDir, "guest-error.txt"), message);
+    fs63.writeFileSync(path76.join(logsDir, "guest-error.txt"), message);
   } catch {
   }
   console.error(
-    "\n\x1B[31mThe sandbox could not start: " + errMsg(e) + "\x1B[0m\nDetails: " + path74.join(logsDir, "guest-error.txt")
+    "\n\x1B[31mThe sandbox could not start: " + errMsg(e) + "\x1B[0m\nDetails: " + path76.join(logsDir, "guest-error.txt")
   );
   process.exitCode = 1;
 });