windows-development-sandbox 1.11.7 → 1.13.0

package/dist/cli/operations/handler.js

@@ -1,6 +1,7 @@
 // Runs a definition as a command: its input from the command line, its questions on the terminal, and its output as
 // --json, as the definition's one-line text, or as the page of the view that shows it. A declined question prints
-// "Nothing changed." and exits 1, as the commands always have.
+// "Nothing changed." and exits 1, as the commands always have. An operation that opens a session's terminal (a new
+// shell) attaches this terminal to it afterwards.
 import { VIEWS } from '../../app/features/defs.js';
 import { runDefinition } from '../../app/registry.js';
 import { Cancelled } from '../../app/kernel/index.js';
@@ -33,6 +34,16 @@ function printOutput(def, output, input) {
     else
         console.log(JSON.stringify(output, null, 2));
 }
+/** Attaches this terminal to the session an operation opened (in a script: says how to). */
+async function attachOpened(ctx, session) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        nextStep('sandbox attach ' + session);
+        return 0;
+    }
+    // Loaded when needed: attach reaches the launch commands, which reach this handler (no import cycle).
+    const { attach } = await import('../commands/sessions/attach.js');
+    return attach({ ...ctx, options: { ...ctx.options, positionals: [session] } });
+}
 /** The command for a definition. */
 export function definitionHandler(def) {
     return async (ctx) => {
@@ -47,6 +58,9 @@ export function definitionHandler(def) {
                 return code;
             }
             printOutput(def, output, def.input.parse(input));
+            const opened = def.kind === 'operation' ? def.opens?.(output) : undefined;
+            if (opened?.kind === 'terminal')
+                return attachOpened(ctx, opened.session);
             return code;
         }
         catch (e) {

package/dist/cli/services/remote-client.d.ts

@@ -0,0 +1,16 @@
+import { type OperationIO } from '../../app/kernel/index.js';
+export declare class RemoteClient {
+    private readonly socket;
+    private readonly pending;
+    private next;
+    private constructor();
+    /** Trades the one-time token for a sign-in cookie, then opens the RPC socket. */
+    static connect(port: number, token: string): Promise<RemoteClient>;
+    private receive;
+    private send;
+    /** Runs a definition on the owner's side (a query or an operation) and returns its output. */
+    run(id: string, input: unknown, io: OperationIO): Promise<unknown>;
+    close(): void;
+}
+/** Connects, or fails with the reason and what to do. */
+export declare function remoteClient(port: number, token: string): Promise<RemoteClient>;

package/dist/cli/services/remote-client.js

@@ -0,0 +1,141 @@
+// `sandbox remote`'s line to the owner's web UI (docs/design/remote-access.md): signs in with the one-time token of
+// Windows sign-in, then runs the shared core's queries and operations over the RPC socket, as the browser does. What
+// the owner's server sends is checked against the kernel's schemas (anything else is dropped) and every text is shown
+// through safeText by the menu. The owner's server checks the role of every call.
+import http from 'node:http';
+import { WebSocket } from 'ws';
+import { fromWireError, ServerMessageSchema, } from '../../app/kernel/index.js';
+import { fail } from '../../core/util/index.js';
+import { CSRF_HEADER, CSRF_VALUE } from '../../shared/web/index.js';
+const CONNECT_TIMEOUT_MS = 10_000;
+/** Asks an OperationIO a question that came over the socket. */
+function askIO(io, q) {
+    switch (q.kind) {
+        case 'confirm':
+            return io.confirm(q);
+        case 'choose':
+            return io.choose(q);
+        case 'checklist':
+            return io.checklist(q);
+        case 'text':
+            return io.text(q);
+        case 'secret':
+            return io.secret(q);
+        case 'path':
+            return io.path(q);
+    }
+}
+export class RemoteClient {
+    socket;
+    pending = new Map();
+    next = 1;
+    constructor(socket) {
+        this.socket = socket;
+        socket.on('message', (data, binary) => {
+            if (binary)
+                return;
+            let value;
+            try {
+                value = JSON.parse(data.toString());
+            }
+            catch {
+                return;
+            }
+            const parsed = ServerMessageSchema.safeParse(value);
+            if (parsed.success)
+                this.receive(parsed.data);
+        });
+        socket.on('close', () => {
+            for (const p of this.pending.values())
+                p.reject(new Error('The connection to the web UI closed.'));
+            this.pending.clear();
+        });
+    }
+    /** Trades the one-time token for a sign-in cookie, then opens the RPC socket. */
+    static async connect(port, token) {
+        const origin = 'http://127.0.0.1:' + port;
+        const cookie = await new Promise((resolve, reject) => {
+            const body = JSON.stringify({ token });
+            const req = http.request({
+                host: '127.0.0.1',
+                port,
+                method: 'POST',
+                path: '/api/login/once',
+                timeout: CONNECT_TIMEOUT_MS,
+                headers: {
+                    Origin: origin,
+                    [CSRF_HEADER]: CSRF_VALUE,
+                    'Content-Type': 'application/json',
+                    'Content-Length': Buffer.byteLength(body),
+                },
+            }, (res) => {
+                res.resume();
+                const value = (res.headers['set-cookie'] ?? [])[0]?.split(';')[0];
+                if (res.statusCode === 200 && value)
+                    resolve(value);
+                else
+                    reject(new Error('The web UI did not sign you in (' + res.statusCode + ').'));
+            });
+            req.on('timeout', () => req.destroy(new Error('The web UI did not answer.')));
+            req.on('error', reject);
+            req.end(body);
+        });
+        const socket = new WebSocket('ws://127.0.0.1:' + port + '/api/rpc', {
+            headers: { Cookie: cookie, Origin: origin },
+            handshakeTimeout: CONNECT_TIMEOUT_MS,
+        });
+        await new Promise((resolve, reject) => {
+            socket.once('open', () => resolve());
+            socket.once('error', reject);
+            socket.once('unexpected-response', (_req, res) => reject(new Error('Refused (' + res.statusCode + ').')));
+        });
+        return new RemoteClient(socket);
+    }
+    receive(m) {
+        const p = this.pending.get(m.id);
+        if (!p)
+            return;
+        switch (m.t) {
+            case 'progress':
+                return p.io.progress(m.text);
+            case 'log':
+                return p.io.log(m.text, m.tone);
+            case 'ask':
+                void askIO(p.io, m.question).then((value) => this.send({ t: 'answer', id: m.id, value }), () => this.send({ t: 'answer', id: m.id, value: m.question.kind === 'confirm' ? false : undefined }));
+                return;
+            case 'result':
+            case 'data':
+                this.pending.delete(m.id);
+                return p.resolve(m.output);
+            case 'error':
+                this.pending.delete(m.id);
+                return p.reject(fromWireError(m.error));
+        }
+    }
+    send(message) {
+        if (this.socket.readyState === WebSocket.OPEN)
+            this.socket.send(JSON.stringify(message));
+    }
+    /** Runs a definition on the owner's side (a query or an operation) and returns its output. */
+    run(id, input, io) {
+        if (this.socket.readyState !== WebSocket.OPEN)
+            return Promise.reject(new Error('Not connected to the web UI.'));
+        const callId = 'c' + this.next++;
+        return new Promise((resolve, reject) => {
+            this.pending.set(callId, { io, resolve, reject });
+            this.send({ t: 'call', id: callId, op: id, input: input ?? {} });
+        });
+    }
+    close() {
+        this.socket.close(1000);
+    }
+}
+/** Connects, or fails with the reason and what to do. */
+export async function remoteClient(port, token) {
+    try {
+        return await RemoteClient.connect(port, token);
+    }
+    catch (e) {
+        return fail('Could not reach the web UI on port ' + port + ': ' + (e instanceof Error ? e.message : String(e)), 'Ask its owner to start it (sandbox web start), then try again.');
+    }
+}

package/dist/cli/services/sessions-service.d.ts

@@ -1,4 +1,5 @@
 import type { SessionStatus } from '../../core/types.js';
+import type { ShellChoice } from '../../shared/channel/index.js';
 import type { RegistryEntry } from '../../host/projects/index.js';
 import type { Viewers } from '../../shared/pty/index.js';
 import type { Context } from '../commands/context.js';
@@ -38,5 +39,9 @@ export declare class SessionsService {
     restartScope(all: boolean): RestartScope;
     /** Restarts the agents (one kind, or all) of a project or of every session; returns the sandbox's message. */
     restart(harness: string | null, scope?: string): Promise<string>;
+    /** Starts a plain shell in a folder of the sandbox and waits until it runs. */
+    openShell(shell: ShellChoice, guestDir: string): Promise<SessionStatus>;
+    /** Ends a running session and everything it started; returns the sandbox's message (throws when it refused). */
+    close(sessionId: string): Promise<string>;
     private projects;
 }

package/dist/cli/services/sessions-service.js

@@ -1,10 +1,14 @@
-// Agent sessions of the running sandbox: list, pick one to attach to, restart. Returns data, never prints.
+// Sessions of the running sandbox (agents and plain shells): list, pick one to attach to, restart the agents, open a
+// shell, close one. Returns data, never prints.
 import _ from 'lodash';
+import { fail } from '../../core/util/index.js';
 import { SandboxChannel, sessionsFirstIn, sessionViewers } from '../../host/channel/index.js';
 import { isSandboxRunning } from '../../host/sandbox/index.js';
 import { RunDir } from '../../shared/channel/index.js';
 import { isWithin, projectForGuestDir } from '../../shared/paths/index.js';
 import { hereDir, locateHere, registryOf } from '../commands/projects/here.js';
+/** A shell needs no install: the longest it may take is its project's first setup. */
+const SHELL_START_MS = 15 * 60 * 1000;
 export function viewerText(v) {
     return v === undefined
         ? '-'
@@ -75,6 +79,18 @@ export class SessionsService {
     async restart(harness, scope) {
         return (await this.channel.restart(harness, scope)).message;
     }
+    /** Starts a plain shell in a folder of the sandbox and waits until it runs. */
+    openShell(shell, guestDir) {
+        const channel = this.channel;
+        return channel.waitForSession(channel.requestShell(shell, guestDir), SHELL_START_MS, () => undefined);
+    }
+    /** Ends a running session and everything it started; returns the sandbox's message (throws when it refused). */
+    async close(sessionId) {
+        const answer = await this.channel.closeSession(sessionId);
+        if (!answer.ok)
+            fail(answer.message);
+        return answer.message;
+    }
     projects() {
         return registryOf(this.ctx).read()?.projects ?? [];
     }

package/dist/core/config/defaults.js

@@ -3,7 +3,7 @@ export const DEFAULTS = {
     guestWorkspace: 'auto',
     readOnly: false,
     workspaceFilter: { enabled: false, exclude: [], include: [] },
-    audit: { enabled: false, days: 14, maxMb: 100, processes: true, files: true },
+    audit: { enabled: true, days: 7, maxMb: 100, processes: true, files: true, commits: true },
     mappings: [],
     sandbox: {
         engine: 'windows-sandbox',
@@ -95,7 +95,17 @@ export const DEFAULTS = {
         sqlserver: { enabled: 'auto' },
     },
     attach: { enabled: true, reuseSession: true, auto: false, autoHide: false, confirmCtrlC: true },
-    web: { enabled: false, port: 47800, openOnLaunch: false },
+    web: {
+        enabled: false,
+        port: 47800,
+        openOnLaunch: false,
+        remote: {
+            windowsSignIn: false,
+            users: [],
+            rememberDays: 30,
+            lan: { enabled: false, port: 47801, address: '' },
+        },
+    },
     agentCommands: { enabled: false, agents: 'auto' },
     secrets: { strip: true, allow: [], patterns: [], warnFiles: true },
     personalization: { enabled: true },

package/dist/core/local-config/file.js

@@ -1,13 +1,27 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
-import { fileExists, parseJsonc } from '../util/index.js';
+import { fail, fileExists, parseJsonc } from '../util/index.js';
 export const LOCAL_CONFIG_NAME = '.sandbox-config.json';
+const MAX_LOCAL_CONFIG_BYTES = 1024 * 1024;
 export function readLocalConfig(dir) {
     const file = path.join(dir, LOCAL_CONFIG_NAME);
     if (!fileExists(file))
         return null;
-    const raw = fs.readFileSync(file);
+    // One handle for the size check and the read (the hash covers exactly the bytes parsed); a repo's file over 1 MB is
+    // refused, not loaded.
+    const fd = fs.openSync(file, 'r');
+    let raw;
+    try {
+        const size = fs.fstatSync(fd).size;
+        if (size > MAX_LOCAL_CONFIG_BYTES)
+            fail(file + ' is over 1 MB, so it is not read.', 'Make it smaller, or start with --no-local-config.');
+        raw = Buffer.alloc(size);
+        fs.readSync(fd, raw, 0, size, 0);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
     return {
         path: file,
         hash: crypto.createHash('sha256').update(raw).digest('hex'),

package/dist/core/local-config/overrides.js

@@ -14,6 +14,11 @@ export function normalizeOverrides(data, dir, source) {
     const missing = scripts?.filter((s) => !fileExists(s)) ?? [];
     if (missing.length)
         fail(source + ' is not valid:\n  - scripts: file not found: ' + missing.join(', '));
+    // A repo ships this file: a script path outside the project (%USERPROFILE%\.ssh\id_ed25519, ..\..) would copy that
+    // file of this PC into the launch folder, which the sandbox reads.
+    const outside = scripts?.filter((s) => !insideProject(dir, s)) ?? [];
+    if (outside.length)
+        fail(source + ' is not valid:\n  - scripts: only files inside the project can be used: ' + outside.join(', '));
     const mappings = overrides.mappings?.map((m) => ({ ...m, host: expandPath(m.host, dir) }));
     return { ...overrides, scripts, mappings };
 }
@@ -62,6 +67,8 @@ export const OFF_IS_SAFER = [
     'claudeProfile.enabled',
     'claudeProfile.syncHistory',
     'claudeProfile.syncClaudeMem',
+    // Maps this PC's Node, Git, nvm and agent folders into the sandbox.
+    'provisioning.copyFromHost',
 ];
 export const GIT_STRICTNESS = { full: 0, readonly: 1, none: 2 };
 export const NEVER_LOOSER = [...ON_IS_SAFER, ...OFF_IS_SAFER, 'provisioning.git.access'];

package/dist/core/run/versions.js

@@ -1,17 +1,18 @@
-import fs from 'node:fs';
 import path from 'node:path';
 import { z } from 'zod';
-import { fileExists } from '../util/index.js';
+import { fileExists, readSmallFile } from '../util/index.js';
+/** A version spec as version files hold it (20, lts/iron, 3.12.1, v18.*): anything else is ignored, never printed. */
+const VERSION_SPEC = /^[\w./*~^-]{1,64}$/;
 const firstLine = (file) => {
-    if (!fileExists(file))
+    const text = fileExists(file) ? readSmallFile(file, 64 * 1024) : null;
+    if (text === null)
         return null;
-    const line = fs
-        .readFileSync(file, 'utf8')
+    const line = text
         .replace(/^\uFEFF/, '')
         .split(/\r?\n/)
         .map((l) => l.replace(/#.*$/, '').trim())
         .find((l) => l !== '');
-    return line ?? null;
+    return line !== undefined && VERSION_SPEC.test(line) ? line : null;
 };
 const VOLTA_PIN = 'package.json volta.node';
 const PackageJsonSchema = z.object({
@@ -32,8 +33,8 @@ export function voltaNode(workspace) {
     if (!fileExists(file))
         return null;
     try {
-        return (PackageJsonSchema.safeParse(JSON.parse(fs.readFileSync(file, 'utf8').replace(/^\uFEFF/, ''))).data?.volta?.node ??
-            null);
+        return (PackageJsonSchema.safeParse(JSON.parse((readSmallFile(file, 4 * 1024 * 1024) ?? '').replace(/^\uFEFF/, ''))).data
+            ?.volta?.node ?? null);
     }
     catch {
         return null;

package/dist/core/schema/apps.d.ts

@@ -2,6 +2,9 @@ import { z } from 'zod';
 export declare const AppIdSchema: z.ZodEnum<{
     [x: string]: string;
 }>;
+export declare const ProjectAppIdSchema: z.ZodEnum<{
+    [x: string]: string;
+}>;
 export declare const CustomAppIdSchema: z.ZodString;
 export declare const CustomAppSchema: z.ZodObject<{
     name: z.ZodString;
@@ -18,6 +21,12 @@ export declare const CustomAppSchema: z.ZodObject<{
     exe: z.ZodString;
     cli: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
+/** What a project file may say about apps: catalogue apps it adds to yours (no add-ons that are yours only). */
+export declare const ProjectAppsSchema: z.ZodObject<{
+    install: z.ZodArray<z.ZodEnum<{
+        [x: string]: string;
+    }>>;
+}, z.core.$strict>;
 export declare const AppsSchema: z.ZodObject<{
     install: z.ZodArray<z.ZodEnum<{
         [x: string]: string;

package/dist/core/schema/apps.js

@@ -3,6 +3,9 @@ import { z } from 'zod';
 import { APPS } from '../../shared/apps/index.js';
 const CATALOGUE_IDS = APPS.filter((a) => !a.setting).map((a) => a.id);
 export const AppIdSchema = z.enum(CATALOGUE_IDS);
+/** The apps a project's .sandbox-config.json may add: not the add-ons that are yours only (they change the agents). */
+const PROJECT_IDS = APPS.filter((a) => !a.setting && !a.userOnly).map((a) => a.id);
+export const ProjectAppIdSchema = z.enum(PROJECT_IDS);
 export const CustomAppIdSchema = z.string().regex(/^[a-z0-9][a-z0-9-]{0,40}$/, 'lower-case letters, digits and - only');
 const compiles = (pattern) => {
     try {
@@ -51,6 +54,12 @@ export const CustomAppSchema = z
     .refine((a) => (a.github && a.asset ? !a.url : Boolean(a.url) && !a.github && !a.asset), {
     message: 'give github + asset, or url (not both)',
 });
+/** What a project file may say about apps: catalogue apps it adds to yours (no add-ons that are yours only). */
+export const ProjectAppsSchema = z.strictObject({
+    install: z
+        .array(ProjectAppIdSchema)
+        .describe('Apps from the catalogue this project adds to yours (agent add-ons such as rtk, Headroom and the MCP servers are set in your own settings only).'),
+});
 export const AppsSchema = z.strictObject({
     install: z
         .array(AppIdSchema)

package/dist/core/schema/config.d.ts

@@ -1,4 +1,10 @@
 import { z } from 'zod';
+/**
+ * An environment variable a repo's .sandbox-config.json may not set: the git guard's and the sandbox's own (setting
+ * AGENT_GIT_ACCESS or GIT_CONFIG_COUNT would undo provisioning.git.access), interpreter hooks (NODE_OPTIONS reaches the
+ * git guard's node), proxies and API endpoints (ANTHROPIC_BASE_URL would send your API key to the repo's server).
+ */
+export declare function reservedEnvName(name: string): boolean;
 export declare const ConfigSchema: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
     defaultHarness: z.ZodString;
@@ -15,6 +21,7 @@ export declare const ConfigSchema: z.ZodObject<{
         maxMb: z.ZodNumber;
         processes: z.ZodBoolean;
         files: z.ZodBoolean;
+        commits: z.ZodBoolean;
     }, z.core.$strict>;
     mappings: z.ZodArray<z.ZodObject<{
         host: z.ZodString;
@@ -252,6 +259,22 @@ export declare const ConfigSchema: z.ZodObject<{
         enabled: z.ZodBoolean;
         port: z.ZodNumber;
         openOnLaunch: z.ZodBoolean;
+        remote: z.ZodObject<{
+            windowsSignIn: z.ZodBoolean;
+            users: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                role: z.ZodEnum<{
+                    view: "view";
+                    control: "control";
+                }>;
+            }, z.core.$strict>>;
+            rememberDays: z.ZodNumber;
+            lan: z.ZodObject<{
+                enabled: z.ZodBoolean;
+                port: z.ZodNumber;
+                address: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
     }, z.core.$strict>;
     agentCommands: z.ZodObject<{
         enabled: z.ZodBoolean;
@@ -366,9 +389,6 @@ export declare const LocalOverridesSchema: z.ZodObject<{
     scripts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     sandbox: z.ZodOptional<z.ZodObject<{
         memoryMb: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodNumber]>>;
-        maxMemoryMb: z.ZodOptional<z.ZodNumber>;
-        maxMemoryPercent: z.ZodOptional<z.ZodNumber>;
-        reserveHostMb: z.ZodOptional<z.ZodNumber>;
         vGpu: z.ZodOptional<z.ZodBoolean>;
         networking: z.ZodOptional<z.ZodBoolean>;
         clipboard: z.ZodOptional<z.ZodBoolean>;

package/dist/core/schema/config.js

@@ -8,12 +8,45 @@ import { HarnessSchema } from './harness.js';
 import { AgentCommandsSchema, AttachSchema, ClaudeProfileSchema, SecretsSchema } from './profile.js';
 import { AuditSchema, DownloadsSchema, SharingSchema, GitSchema, GuestWorkspaceSchema, MappingSchema, NetworkSchema, ProvisioningSchema, SandboxSchema, WorkspaceFilterSchema, } from './sandbox.js';
 import { ToolchainsSchema } from './toolchains.js';
-import { AppsSchema } from './apps.js';
+import { AppsSchema, ProjectAppsSchema } from './apps.js';
 import { ProjectsSchema } from './projects.js';
 import { ResumeSchema } from './resume.js';
 import { WebSchema } from './web.js';
 import { VpnSchema } from './vpn.js';
 import { GithubSchema } from './github.js';
+const RESERVED_ENV_PREFIX = /^(AGENT_|GIT_|GH_|GITHUB_|NODE_|NPM_CONFIG_(USERCONFIG|GLOBALCONFIG|PREFIX|SCRIPT_SHELL)|SSL_|CLAUDE|ANTHROPIC_|OPENAI_|CODEX_|GEMINI_|GOOGLE_|COPILOT_|AWS_|AZURE_)/i;
+const RESERVED_ENV_SUFFIX = /(_PROXY|_BASE_URL|_ENDPOINT|_CA_BUNDLE|_CA_CERTS)$/i;
+const RESERVED_ENV_NAMES = new Set([
+    'PATH',
+    'PATHEXT',
+    'BASH_ENV',
+    'ENV',
+    'COMSPEC',
+    'PSMODULEPATH',
+    'PYTHONPATH',
+    'PYTHONSTARTUP',
+    'PERL5OPT',
+    'RUBYOPT',
+    'JAVA_TOOL_OPTIONS',
+    'LD_PRELOAD',
+    'SYSTEMROOT',
+    'WINDIR',
+    'HOME',
+    'USERPROFILE',
+    'APPDATA',
+    'LOCALAPPDATA',
+    'PROGRAMDATA',
+    'TEMP',
+    'TMP',
+].map((n) => n.toUpperCase()));
+/**
+ * An environment variable a repo's .sandbox-config.json may not set: the git guard's and the sandbox's own (setting
+ * AGENT_GIT_ACCESS or GIT_CONFIG_COUNT would undo provisioning.git.access), interpreter hooks (NODE_OPTIONS reaches the
+ * git guard's node), proxies and API endpoints (ANTHROPIC_BASE_URL would send your API key to the repo's server).
+ */
+export function reservedEnvName(name) {
+    return RESERVED_ENV_PREFIX.test(name) || RESERVED_ENV_SUFFIX.test(name) || RESERVED_ENV_NAMES.has(name.toUpperCase());
+}
 export const ConfigSchema = z
     .strictObject({
     $schema: SchemaRefSchema.optional(),
@@ -88,10 +121,14 @@ export const LocalOverridesSchema = z
         .array(MappingSchema)
         .describe('Extra folders (relative paths are relative to this file), e.g. a read-only data folder at another place in the sandbox. Folders outside the project are used only as your projects.allowOutsideMappings setting allows (by default you are asked once).'),
     scripts: StringsSchema.describe('Scripts (.ps1 / .mjs / .cmd, relative to this file) run inside the sandbox before the agent.'),
-    // This PC's resources are yours to share: CPU and paging file (this PC's disk) are not a project's to set.
+    // This PC's resources are yours to share: CPU, paging file (this PC's disk) and the RAM kept for this PC are not a
+    // project's to set.
     sandbox: SandboxSchema.omit({
         cpuLimit: true,
         pageFileMb: true,
+        reserveHostMb: true,
+        maxMemoryPercent: true,
+        maxMemoryMb: true,
         engine: true,
         agentMemoryHeadroomMb: true,
         pressureResponse: true,
@@ -108,15 +145,15 @@ export const LocalOverridesSchema = z
     toolchains: z
         .strictObject({
         ..._.mapValues(_.omit(ToolchainsSchema.shape, 'environment'), (shape) => shape.partial()),
-        environment: ToolchainsSchema.shape.environment,
+        environment: ToolchainsSchema.shape.environment.refine((env) => !Object.keys(env).some(reservedEnvName), 'names the sandbox sets or that carry logins (AGENT_*, GIT_*, PATH, BASH_ENV, NODE_*, proxies, ANTHROPIC_*, CLAUDE_* ...) cannot be set by a project'),
     })
         .partial(),
     databases: z.strictObject(_.mapValues(DatabasesSchema.shape, (shape) => shape.partial())).partial(),
     attach: AttachSchema.partial(),
     personalization: toggle('Copy your desktop look into the sandbox.').partial(),
     // Catalogue apps only (a vetted list): your own programs (apps.custom) download anything, so a repo cannot add
-    // them.
-    apps: AppsSchema.pick({ install: true }).partial(),
+    // them, nor agent add-ons that are yours only (rtk hooks every agent command, Headroom sits in its API path).
+    apps: ProjectAppsSchema.partial(),
     claudeProfile: ClaudeProfileSchema.pick({
         enabled: true,
         overwrite: true,

package/dist/core/schema/sandbox.d.ts

@@ -49,6 +49,7 @@ export declare const AuditSchema: z.ZodObject<{
     maxMb: z.ZodNumber;
     processes: z.ZodBoolean;
     files: z.ZodBoolean;
+    commits: z.ZodBoolean;
 }, z.core.$strict>;
 export declare const WorkspaceFilterSchema: z.ZodObject<{
     enabled: z.ZodBoolean;

package/dist/core/schema/sandbox.js

@@ -108,8 +108,13 @@ export const NetworkSchema = z.strictObject({
 export const AuditSchema = z.strictObject({
     enabled: z
         .boolean()
-        .describe('Keep an audit log on this PC of what happened in your sandboxes: programs started (with their command lines), files changed in the project, sessions, and what the repo guard caught. The sandbox cannot change it. Read it with sandbox audit.'),
-    days: z.number().int().min(1).max(365).describe('Days the audit log is kept.'),
+        .describe('Keep an audit log on this PC of what your agents did: programs started (with their command lines, secrets hidden), files changed in the projects, git commits, sessions, and what the repo guard caught, each linked to the agent session that did it where that can be known. The sandbox cannot change it. Read it with sandbox audit or on the Activity page.'),
+    days: z
+        .number()
+        .int()
+        .min(1)
+        .max(365)
+        .describe('Days the audit log is kept (1 to 30; a larger number keeps 30); older days are deleted when a sandbox starts and once a day.'),
     maxMb: z
         .number()
         .int()
@@ -119,7 +124,10 @@ export const AuditSchema = z.strictObject({
     processes: z
         .boolean()
         .describe('Record every program started in the sandbox with its command line (Windows process auditing; repeated runs are counted, not listed).'),
-    files: z.boolean().describe('Record the files changed in the project while the sandbox runs.'),
+    files: z.boolean().describe('Record the files changed in the projects while the sandbox runs.'),
+    commits: z
+        .boolean()
+        .describe("Record the git commits made in the projects while the sandbox runs (read from each project's .git folder on this PC)."),
 });
 export const WorkspaceFilterSchema = z.strictObject({
     enabled: z

package/dist/core/schema/web.d.ts

@@ -1,7 +1,58 @@
 import { z } from 'zod';
 export declare const WEB_DEFAULT_PORT = 47800;
+export declare const WEB_LAN_DEFAULT_PORT = 47801;
+export declare const REMOTE_ROLES: readonly ["view", "control"];
+export type RemoteRole = (typeof REMOTE_ROLES)[number];
+/** A Windows account name: "bob", "PC\bob" or "DOMAIN\bob" (no paths, quotes or wildcards). */
+export declare const WindowsUserNameSchema: z.ZodString;
+export declare const RemoteUserSchema: z.ZodObject<{
+    name: z.ZodString;
+    role: z.ZodEnum<{
+        view: "view";
+        control: "control";
+    }>;
+}, z.core.$strict>;
+export type RemoteUser = z.output<typeof RemoteUserSchema>;
+export declare const WebLanSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    port: z.ZodNumber;
+    address: z.ZodString;
+}, z.core.$strict>;
+export declare const WebRemoteSchema: z.ZodObject<{
+    windowsSignIn: z.ZodBoolean;
+    users: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        role: z.ZodEnum<{
+            view: "view";
+            control: "control";
+        }>;
+    }, z.core.$strict>>;
+    rememberDays: z.ZodNumber;
+    lan: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        port: z.ZodNumber;
+        address: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type WebRemote = z.output<typeof WebRemoteSchema>;
 export declare const WebSchema: z.ZodObject<{
     enabled: z.ZodBoolean;
     port: z.ZodNumber;
     openOnLaunch: z.ZodBoolean;
+    remote: z.ZodObject<{
+        windowsSignIn: z.ZodBoolean;
+        users: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            role: z.ZodEnum<{
+                view: "view";
+                control: "control";
+            }>;
+        }, z.core.$strict>>;
+        rememberDays: z.ZodNumber;
+        lan: z.ZodObject<{
+            enabled: z.ZodBoolean;
+            port: z.ZodNumber;
+            address: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
 }, z.core.$strict>;