windows-development-sandbox 1.11.7 → 1.13.0

package/dist/selftest/git-access.test.js

@@ -48,6 +48,14 @@ export const gitAccessSuite = {
             '--git-dir=x status',
             'clean -fd',
             'apply p.diff',
+            // reading commands with options that run a program or write a file
+            'grep -Ocalc.exe x',
+            'grep --open-files-in-pager=calc.exe x',
+            'ls-remote --upload-pack=calc.exe origin',
+            'ls-remote -ucalc.exe origin',
+            'diff --output=C:/x.txt',
+            'log --output C:/x.txt',
+            'diff --ext-diff',
         ];
         t.equal(writing.filter((command) => allowed(command.split(' '))), [], 'readonly: anything that writes (or overrides config) is refused');
         t.section('none and full');

package/dist/selftest/hcs.test.js

@@ -570,6 +570,41 @@ export const hcsSuite = {
                 t.check(refused(['grant-vm-access', 'agent-sandbox-1', notDisk]) &&
                     refused(['grant-vm-access', 'agent-sandbox-1', missing]) &&
                     refused(['grant-vm-access', 'agent-sandbox-1', 'relative.vhdx']), 'grant-vm-access refuses anything but an existing .vhdx at a full path');
+                // share (prototype, docs/design/hcs-live-folders.md): refused before HCS is asked, so no Hyper-V is needed.
+                const folder = t.dir('hcs-share-folder');
+                const share = (over) => ({
+                    id: 'agent-sandbox-1',
+                    action: 'add',
+                    name: 'agentsbx-0123abcd',
+                    path: folder,
+                    ...over,
+                });
+                let link = '';
+                try {
+                    link = path.join(tempRoot, 'share-link');
+                    fs.symlinkSync(folder, link, 'junction');
+                }
+                catch {
+                    link = ''; // a folder that refuses links (a mapped folder): that case is skipped
+                }
+                t.check(refused(['share'], share({ id: '0b9a3c2e-1f00-4a4c-9d1e-6a7b8c9d0e1f' })) &&
+                    refused(['share'], share({ id: 'WindowsSandbox' })) &&
+                    refused(['share'], share({ name: '3ad483dec1a233132da4197c9790dcda06668793230cd6d9e94b1882e0f7f29c' })) &&
+                    refused(['share'], share({ name: 'agentsbx-XYZ' })) &&
+                    refused(['share'], share({ action: 'update' })) &&
+                    refused(['share'], share({ path: 'relative\\folder' })) &&
+                    refused(['share'], share({ path: 'C:\\' })) &&
+                    refused(['share'], share({ path: path.join(tempRoot, 'missing-folder') })) &&
+                    refused(['share'], share({ path: folder + '\\..\\' + path.basename(folder) })) &&
+                    refused(['share'], share({ path: folder + '/../' + path.basename(folder) })) &&
+                    refused(['share'], share({ path: folder + ':stream' })) &&
+                    refused(['share'], share({ path: folder + '.' })) &&
+                    refused(['share'], share({ path: folder + ' ' })) &&
+                    refused(['share'], share({ path: 'C:\\PROGRA~1' })) &&
+                    refused(['share'], share({ readOnly: 'yes' })) &&
+                    (!link || refused(['share'], share({ path: link }))), 'share refuses a Windows Sandbox or other foreign id, a foreign share name, an update, a drive, a relative, ' +
+                    "missing, dotted, '/', stream, trailing-dot or -space, short-name or linked folder" +
+                    (link ? '' : ' (link case skipped)'));
                 const existing = t.write(path.join(tempRoot, 'existing.vhdx'), 'keep me');
                 const over = raw.call(['create-vhdx', existing, '1']);
                 t.check(!over.ok && fs.readFileSync(existing, 'utf8') === 'keep me', 'create-vhdx never touches an existing file', over.message);

package/dist/selftest/hostile-input.test.js

@@ -12,7 +12,7 @@ import { writeJsonAtomic } from '../shared/io/index.js';
 export const hostileInputSuite = {
     name: 'hostile-input',
     title: 'file names, deletes, printed text, mappings and state files from an untrusted sandbox',
-    run: async (t) => {
+    run: async (t, f) => {
         t.section('file names');
         const unsafe = ['CON.jsonl', 'nul', 'aux.json', 'COM1.txt', 'a:b', 'x.jsonl.', 'x ', '..', 'a\\b', 'LPT3'];
         t.equal(unsafe.filter(isSafeFileName), [], 'device names, streams and trailing dots are not valid names to copy into this PC');
@@ -52,5 +52,16 @@ export const hostileInputSuite = {
         t.equal(fs.readdirSync(path.dirname(atomicFile)).length, 1, '... with no temp files left behind');
         await t.throws(() => assertCmdSafePath('C:\\a\\%TEMP%\\agent.wsb'), 'cannot be started safely', 'a launch path with %VAR% (which cmd.exe would expand) is refused');
         await t.throws(() => assertCmdSafePath('C:\\a"&calc&"\\agent.wsb'), 'cannot be started safely', 'a launch path with quotes and & is refused');
+        t.section('repo files read on this PC (security review 2026-10)');
+        const repoDir = t.dir('hostile-versions');
+        fs.writeFileSync(path.join(repoDir, '.nvmrc'), '\u001b]52;c;ZXZpbA==\u0007\u001b[2J20\n');
+        fs.writeFileSync(path.join(repoDir, '.python-version'), '3.12.1\n');
+        const versionsRun = await f.run({ cwd: repoDir });
+        t.check(!versionsRun.versions.node.spec.includes('\u001b') &&
+            versionsRun.versions.node.source !== '.nvmrc' &&
+            versionsRun.versions.python.spec === '3.12.1', 'a version file holding escape codes is ignored (it would reach the launch table); a plain one is used', JSON.stringify(versionsRun.versions));
+        fs.writeFileSync(path.join(repoDir, '.sandbox-config.json'), '{"readOnly": true}' + ' '.repeat(1100 * 1024));
+        await t.throws(() => f.run({ cwd: repoDir, trustConfig: true }), 'over 1 MB', 'a .sandbox-config.json over 1 MB is refused before it is parsed');
+        fs.rmSync(path.join(repoDir, '.sandbox-config.json'));
     },
 };

package/dist/selftest/index.js

@@ -57,6 +57,7 @@ import { syncSuite } from './sync.test.js';
 import { testGuardSuite } from './test-guard.test.js';
 import { toolchainsSuite } from './toolchains.test.js';
 import { webSuite } from './web.test.js';
+import { remoteSuite } from './remote.test.js';
 import { workspaceSuite } from './workspace.test.js';
 import { workspaceViewSuite } from './workspace-view.test.js';
 import { liveNetworkSuite } from './live-network.test.js';
@@ -107,6 +108,7 @@ export const SUITES = [
     secretsSuite,
     hostileInputSuite,
     webSuite,
+    remoteSuite,
     testGuardSuite,
     // pure helpers and the command line
     layoutSuite,

package/dist/selftest/live-daemon.test.js

@@ -19,6 +19,8 @@ export const liveDaemonSuite = {
         Object.assign(session.harness, {
             arguments: ['/d', '/k', 'echo LIVE-AGENT-READY'],
             resumeArguments: ['/d', '/k', 'echo LIVE-AGENT-RESUMED'],
+            // The agent's own environment (where its keys live): a shell session must not get it.
+            environment: { LIVE_AGENT_KEY: 'sk-live-agent' },
         });
         t.writeJson(gen.sessionPath, session);
         const daemon = startDaemon(t, f, { launchPath: gen.launchPath, data, workspace });
@@ -82,6 +84,29 @@ export const liveDaemonSuite = {
             t.check(Boolean(ping?.ok) &&
                 !fs.existsSync(path.join(daemon.run, 'responses', 'evil.json')) &&
                 !fs.existsSync(path.join(daemon.run, 'requests', 'evil.json')), 'ping is answered; an unknown request kind gets no answer and is deleted', JSON.stringify(ping));
+            t.section('live: a plain shell session');
+            daemon.request({ kind: 'session', id: 'shell1', harness: 'shell', args: [], cwd: workspace, shell: 'cmd' });
+            const shell = await daemon.started('shell1');
+            t.check(shell?.phase === 'running' && shell.harness === 'cmd' && shell.kind === 'shell' && Boolean(shell.attach), 'a shell session runs through ptyhost and is listed by its shell, marked as a shell', JSON.stringify(shell) + '\n' + daemon.diagnostics());
+            if (shell?.attach) {
+                const shellView = await openViewer(shell.attach);
+                viewers.push(shellView);
+                // Typing before cmd has drawn its prompt can lose the keystrokes: wait for the prompt first.
+                await sees(t, shellView, '>');
+                shellView.type('echo SHELL-[%LIVE_AGENT_KEY%]-%USERNAME:~0,0%OK');
+                const sawShell = await sees(t, shellView, 'SHELL-[%LIVE_AGENT_KEY%]-OK');
+                t.check(Boolean(sawShell), "keystrokes reach the shell, and it has none of the agent's own environment", 'screen so far: ' + tail(shellView.output()) + '\n' + daemon.diagnostics());
+                daemon.request({ kind: 'close', id: 'close1', session: 'shell1' });
+                const closed = await daemon.response('close1');
+                const shellEnded = await t.waitFor(() => {
+                    const s = daemon.status('shell1');
+                    return s?.phase === 'exited' ? s : null;
+                }, WAIT.exit);
+                t.check(Boolean(closed?.ok) && shellEnded !== null && shellView.exitCode() !== null, 'close ends the shell: the sandbox answers, the status says exited and the attached client gets the exit', JSON.stringify(closed) + ' ' + JSON.stringify(daemon.status('shell1')));
+                daemon.request({ kind: 'close', id: 'close2', session: 'shell1' });
+                const again = await daemon.response('close2');
+                t.check(again?.ok === false, 'closing a session that has ended says it is not running', JSON.stringify(again));
+            }
             t.section('live: restart and exit');
             daemon.request({ kind: 'restart', id: 'restart1', harness: 'claude' });
             const sawResumed = await sees(t, viewer, 'LIVE-AGENT-RESUMED');

package/dist/selftest/local-config.test.js

@@ -61,6 +61,28 @@ export const localConfigSuite = {
         await rejectedBecause({ claudeProfile: { hostDir: 'C:\\x' } }, 'claudeProfile.hostDir is not allowed', 'a project file cannot point at the Claude profile folder');
         await rejectedBecause({ toolchains: { node: { hostDir: 'x' } } }, 'toolchains.node.hostDir is not allowed', 'a project file cannot point at host tool folders');
         await rejectedBecause({ sandbox: { memoryMb: 12 } }, 'sandbox.memoryMb:', 'values are type-checked (memory too small)');
+        // Security review 2026-10: what a repo could reach through fields that looked harmless.
+        const secretFile = path.join(f.shared, 'id_ed25519');
+        fs.writeFileSync(secretFile, 'PRIVATE KEY');
+        await rejectedBecause({ scripts: [secretFile] }, 'only files inside the project', 'a project file cannot name a script outside the project (it would copy that PC file into the launch folder)');
+        await rejectedBecause({ scripts: [path.relative(dirC, secretFile)] }, 'only files inside the project', 'a relative ..\\ script path outside the project is refused too');
+        fs.symlinkSync(f.shared, path.join(dirC, 'linked'), 'junction');
+        await rejectedBecause({ scripts: ['./linked/id_ed25519'] }, 'only files inside the project', 'a script reached through a link to a folder outside the project is refused');
+        fs.rmSync(path.join(dirC, 'linked'));
+        for (const name of [
+            'AGENT_GIT_ACCESS',
+            'GIT_CONFIG_COUNT',
+            'ANTHROPIC_BASE_URL',
+            'NODE_OPTIONS',
+            'Path',
+            'https_proxy',
+        ])
+            await rejectedBecause({ toolchains: { environment: { [name]: 'x' } } }, 'cannot be set by a project', 'a project file cannot set ' + name + ' in toolchains.environment');
+        await rejectedBecause({ sandbox: { reserveHostMb: 0 } }, 'sandbox.reserveHostMb is not allowed', 'a project file cannot lower the RAM kept for this PC');
+        f.writeLocal(dirC, { toolchains: { environment: { NPM_CONFIG_REGISTRY: 'https://registry.example' } } });
+        t.equal((await f.run({ cwd: dirC, trustConfig: true })).config.toolchains.environment.NPM_CONFIG_REGISTRY, 'https://registry.example', 'a registry mirror in toolchains.environment is still fine');
+        f.writeLocal(dirC, { provisioning: { copyFromHost: true } });
+        t.equal((await f.run({ cwd: dirC, trustConfig: true }, { ...f.baseConfig, provisioning: { ...f.baseConfig.provisioning, copyFromHost: false } })).config.provisioning.copyFromHost, false, 'a project file cannot turn on copying Node, Git and the agent from this PC when you turned it off');
         await rejectedBecause('{\n  // a comment\n  "readOnly": tru\n}', 'line 3', 'broken JSON is reported with its line');
         await rejectedBecause({ _comment: 'old style' }, '_comment is not allowed', 'unknown keys are rejected');
         f.writeLocal(dirC, '// comments and trailing commas are fine\n{\n  "readOnly": true, /* inline */\n}\n');
@@ -109,6 +131,14 @@ export const localConfigSuite = {
         t.check(viaVariable.includes('outside the project') &&
             viaLink.includes('outside the project') &&
             (await f.run({ cwd: dirD, trustConfig: true }, withOutside(false))).config.mappings.some((m) => m.host === path.join(dirD, 'assets')), 'outside means where the folder really is (%VAR% expanded, links followed); a folder inside needs no permission');
+        // A second mapping of part of the project must not undo readOnly or the workspace filter.
+        fs.mkdirSync(path.join(dirD, 'assets'), { recursive: true });
+        f.writeLocal(dirD, { mappings: [{ host: '.', guest: 'C:\\Data', readOnly: false }] });
+        const readOnlyUser = { ...f.baseConfig, readOnly: true };
+        const remapped = (await f.launch({ cwd: dirD, trustConfig: true }, { config: readOnlyUser })).mappings.find((m) => m.guest.toLowerCase() === 'c:\\data');
+        const filtered = await t.thrownMessage(() => f.launch({ cwd: dirD, trustConfig: true }, { config: { ...f.baseConfig, workspaceFilter: { ...f.baseConfig.workspaceFilter, enabled: true } } }));
+        t.check(remapped?.readOnly === true && filtered.includes('workspaceFilter.enabled'), 'a project folder mapped again is read-only when the project is, and refused while the workspace filter is on', JSON.stringify(remapped) + ' / ' + filtered);
+        fs.rmSync(path.join(dirD, '.sandbox-config.json'));
         t.section('a project can only tighten protections');
         // Settings that would loosen a protection are listed before approval, then ignored.
         f.writeLocal(dirC, {

package/dist/selftest/menu-screens.js

@@ -329,7 +329,7 @@ export function renderScreens(dir) {
         web: { running: true, port: 47800, address: 'http://127.0.0.1:47800/' },
         more: [
             { name: 'sync', summary: 'sync history now' },
-            { name: 'audit', summary: 'show what the sandbox did' },
+            { name: 'config', summary: 'your settings file' },
         ],
     };
     // Two unsaved changes in Settings.

package/dist/selftest/menu.test.js

@@ -624,12 +624,12 @@ export const menuSuite = {
         t.section('apps in a few groups');
         const groupIds = appsCategories(user2).map((c) => c.id);
         const appItems = appsItems(user2, t.dir('apps-groups'), new Draft()).filter((i) => i.value !== REQUEST_APP);
-        t.check(groupIds.length <= 6 &&
-            appsCategories(ConfigFile.project(t.dir('apps-groups', 'project'))).length <= 5 &&
+        t.check(groupIds.length <= 7 &&
+            appsCategories(ConfigFile.project(t.dir('apps-groups', 'project'))).length <= 6 &&
             APP_GROUPS.every((g) => appItems.some((i) => i.category === g.id)) &&
             appItems.every((i) => groupIds.includes(i.category ?? '')) &&
             appItems.length === appRows(user2, t.dir('apps-groups')).length &&
-            APP_CATEGORIES.every((c) => APP_GROUPS.some((g) => g.members.includes(c.id))), 'the apps are in at most 6 groups; every catalogue category belongs to one and every app is listed', groupIds.join());
+            APP_CATEGORIES.every((c) => APP_GROUPS.some((g) => g.members.includes(c.id))), 'the apps are in at most 7 groups (with your own programs); every catalogue category belongs to one and every app is listed', groupIds.join());
         t.section('dialog box');
         const box = dialogBox({ title: 'Unsaved changes', lines: ['You have 2 unsaved changes.'], buttons: 'Save' }, 61);
         const base = Array.from({ length: 12 }, () => 'x'.repeat(60));

package/dist/selftest/remote.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const remoteSuite: Suite;