windows-development-sandbox 1.12.0 → 1.13.0

package/README.md

@@ -95,6 +95,7 @@ Details and settings: [troubleshooting](docs/troubleshooting.md#the-sandbox-clos
 | `sandbox <agent>`, `claude-sandbox` | start an agent; `-t` for this terminal, `--headless` for no window |
 | `sandbox start` | the sandbox without an agent |
 | `sandbox attach` / `sessions` / `status` | work with a running sandbox (this folder's project first) |
+| `sandbox shell` / `close <id>` | open PowerShell (or cmd) in a project as a session you can attach to; end a session |
 | `sandbox restart` / `resume` | restart the agents in place; reopen the last sessions |
 | `sandbox projects` | the projects a sandbox can open without a restart: roots, `all`, exclude |
 | `sandbox db [start\|stop <name>]` | list, start or stop databases (`sbx-db` inside) |

package/config.example.json

@@ -228,7 +228,17 @@
   "web": {
     "enabled": false,
     "port": 47800,
-    "openOnLaunch": false
+    "openOnLaunch": false,
+    "remote": {
+      "windowsSignIn": false,
+      "users": [],
+      "rememberDays": 30,
+      "lan": {
+        "enabled": false,
+        "port": 47801,
+        "address": ""
+      }
+    }
   },
   "agentCommands": {
     "enabled": false,

package/dist/app/features/access/access.def.d.ts

@@ -0,0 +1,190 @@
+import { z } from 'zod';
+import { type Page } from '../../kernel/index.js';
+export declare const DeviceRowSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    role: z.ZodEnum<{
+        view: "view";
+        control: "control";
+    }>;
+    address: z.ZodString;
+    createdAt: z.ZodString;
+    expiresAt: z.ZodString;
+    lastSeen: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const WindowsRowSchema: z.ZodObject<{
+    id: z.ZodString;
+    user: z.ZodString;
+    createdAt: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strip>;
+export declare const AccessStatusSchema: z.ZodObject<{
+    lan: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        running: z.ZodBoolean;
+        address: z.ZodNullable<z.ZodString>;
+        fingerprint: z.ZodNullable<z.ZodString>;
+        problem: z.ZodNullable<z.ZodString>;
+        network: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    windowsSignIn: z.ZodBoolean;
+    users: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        role: z.ZodEnum<{
+            view: "view";
+            control: "control";
+        }>;
+    }, z.core.$strip>>;
+    rememberDays: z.ZodNumber;
+    devices: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodEnum<{
+            view: "view";
+            control: "control";
+        }>;
+        address: z.ZodString;
+        createdAt: z.ZodString;
+        expiresAt: z.ZodString;
+        lastSeen: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    windows: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        user: z.ZodString;
+        createdAt: z.ZodString;
+        expiresAt: z.ZodString;
+    }, z.core.$strip>>;
+    pending: z.ZodNullable<z.ZodObject<{
+        role: z.ZodEnum<{
+            view: "view";
+            control: "control";
+        }>;
+        expiresAt: z.ZodString;
+    }, z.core.$strip>>;
+    codeVoided: z.ZodBoolean;
+}, z.core.$strip>;
+export type AccessStatus = z.output<typeof AccessStatusSchema>;
+export declare const accessStatus: import("../../kernel/define.js").QueryDef<z.ZodObject<{}, z.core.$strip>, z.ZodObject<{
+    lan: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        running: z.ZodBoolean;
+        address: z.ZodNullable<z.ZodString>;
+        fingerprint: z.ZodNullable<z.ZodString>;
+        problem: z.ZodNullable<z.ZodString>;
+        network: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    windowsSignIn: z.ZodBoolean;
+    users: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        role: z.ZodEnum<{
+            view: "view";
+            control: "control";
+        }>;
+    }, z.core.$strip>>;
+    rememberDays: z.ZodNumber;
+    devices: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodEnum<{
+            view: "view";
+            control: "control";
+        }>;
+        address: z.ZodString;
+        createdAt: z.ZodString;
+        expiresAt: z.ZodString;
+        lastSeen: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    windows: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        user: z.ZodString;
+        createdAt: z.ZodString;
+        expiresAt: z.ZodString;
+    }, z.core.$strip>>;
+    pending: z.ZodNullable<z.ZodObject<{
+        role: z.ZodEnum<{
+            view: "view";
+            control: "control";
+        }>;
+        expiresAt: z.ZodString;
+    }, z.core.$strip>>;
+    codeVoided: z.ZodBoolean;
+}, z.core.$strip>, "access.status">;
+export declare const allowDevice: import("../../kernel/define.js").OperationDef<z.ZodObject<{
+    role: z.ZodDefault<z.ZodEnum<{
+        view: "view";
+        control: "control";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    code: z.ZodString;
+    expiresAt: z.ZodString;
+    role: z.ZodEnum<{
+        view: "view";
+        control: "control";
+    }>;
+    address: z.ZodNullable<z.ZodString>;
+    fingerprint: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>, "access.allowDevice">;
+export declare const revokeAccess: import("../../kernel/define.js").OperationDef<z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+}, z.core.$strip>, "access.revoke">;
+export declare const revokeAllAccess: import("../../kernel/define.js").OperationDef<z.ZodObject<{}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+}, z.core.$strip>, "access.revokeAll">;
+export declare const lanOn: import("../../kernel/define.js").OperationDef<z.ZodObject<{}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+    address: z.ZodString;
+}, z.core.$strip>, "access.lanOn">;
+export declare const lanOff: import("../../kernel/define.js").OperationDef<z.ZodObject<{}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+}, z.core.$strip>, "access.lanOff">;
+/** The Remote access page: your network, the devices, the Windows users. */
+export declare function accessPage(o: AccessStatus, now?: number): Page;
+export declare const accessView: import("../../kernel/define.js").ViewDef<{
+    status: import("../../kernel/define.js").QueryDef<z.ZodObject<{}, z.core.$strip>, z.ZodObject<{
+        lan: z.ZodObject<{
+            enabled: z.ZodBoolean;
+            running: z.ZodBoolean;
+            address: z.ZodNullable<z.ZodString>;
+            fingerprint: z.ZodNullable<z.ZodString>;
+            problem: z.ZodNullable<z.ZodString>;
+            network: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
+        windowsSignIn: z.ZodBoolean;
+        users: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            role: z.ZodEnum<{
+                view: "view";
+                control: "control";
+            }>;
+        }, z.core.$strip>>;
+        rememberDays: z.ZodNumber;
+        devices: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            role: z.ZodEnum<{
+                view: "view";
+                control: "control";
+            }>;
+            address: z.ZodString;
+            createdAt: z.ZodString;
+            expiresAt: z.ZodString;
+            lastSeen: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+        windows: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            user: z.ZodString;
+            createdAt: z.ZodString;
+            expiresAt: z.ZodString;
+        }, z.core.$strip>>;
+        pending: z.ZodNullable<z.ZodObject<{
+            role: z.ZodEnum<{
+                view: "view";
+                control: "control";
+            }>;
+            expiresAt: z.ZodString;
+        }, z.core.$strip>>;
+        codeVoided: z.ZodBoolean;
+    }, z.core.$strip>, "access.status">;
+}, Record<string, never>, "access">;

package/dist/app/features/access/access.def.js

@@ -0,0 +1,273 @@
+// Remote access (docs/design/remote-access.md): devices on your network (LAN mode, a one-time code per device) and
+// other Windows users of this PC (Windows sign-in), who is in, and taking access away. Pure: schemas, texts and the
+// page; access.run.ts does the work. Everything here is the owner's: a device or another Windows user never manages
+// access, whatever their role.
+import { z } from 'zod';
+import { action, defineOperation, defineQuery, defineView, fieldOf } from '../../kernel/index.js';
+const RoleSchema = z.enum(['view', 'control']);
+export const DeviceRowSchema = z.object({
+    id: z.string().describe('Its id (for revoke)'),
+    name: z.string().describe('The name it gave itself'),
+    role: RoleSchema.describe('view or control'),
+    address: z.string().describe('The address it was allowed from'),
+    createdAt: z.string().describe('When it was allowed (ISO time)'),
+    expiresAt: z.string().describe('When it is signed out (ISO time)'),
+    lastSeen: z.string().nullable().describe('When it was last used (ISO time)'),
+});
+export const WindowsRowSchema = z.object({
+    id: z.string().describe('Its id (for revoke)'),
+    user: z.string().describe('The Windows user (DOMAIN\\name)'),
+    createdAt: z.string().describe('When they signed in'),
+    expiresAt: z.string().describe('When they are signed out'),
+});
+export const AccessStatusSchema = z.object({
+    lan: z.object({
+        enabled: z.boolean().describe('web.remote.lan.enabled'),
+        running: z.boolean().describe('The web UI listens on your network now'),
+        address: z.string().nullable().describe('What a phone types: https://<address>:<port>'),
+        fingerprint: z.string().nullable().describe("The certificate's SHA-256 fingerprint"),
+        problem: z.string().nullable().describe('Why it is on but not listening'),
+        network: z.string().nullable().describe('The network it was turned on for'),
+    }),
+    windowsSignIn: z.boolean().describe('web.remote.windowsSignIn'),
+    users: z.array(z.object({ name: z.string(), role: RoleSchema })).describe('web.remote.users'),
+    rememberDays: z.number().describe('web.remote.rememberDays'),
+    devices: z.array(DeviceRowSchema),
+    windows: z.array(WindowsRowSchema).describe('Windows users signed in to the web UI now'),
+    pending: z
+        .object({ role: RoleSchema, expiresAt: z.string() })
+        .nullable()
+        .describe('A device code waiting to be typed (the code itself is never kept)'),
+    codeVoided: z.boolean().describe('The last code was voided after too many wrong tries'),
+});
+export const accessStatus = defineQuery({
+    id: 'access.status',
+    title: 'Remote access',
+    summary: 'devices on your network and other Windows users who may use your web UI',
+    input: z.object({}),
+    output: AccessStatusSchema,
+    access: 'owner',
+    live: { everyMs: 5000 },
+    text: (o) => (o.lan.running && o.lan.address ? 'On your network: ' + o.lan.address : 'LAN mode is off') +
+        '. ' +
+        o.devices.length +
+        ' device' +
+        (o.devices.length === 1 ? '' : 's') +
+        ', ' +
+        o.windows.length +
+        ' Windows sign-in' +
+        (o.windows.length === 1 ? '' : 's') +
+        '.',
+    cli: { name: 'web', action: 'devices', json: true },
+});
+export const allowDevice = defineOperation({
+    id: 'access.allowDevice',
+    title: 'Allow a new device',
+    summary: 'show a one-time code that a phone or tablet on your network types to sign in (5 minutes)',
+    input: z.object({
+        role: RoleSchema.default('view').describe('What the device may do: view (look) or control (everything but access)'),
+    }),
+    output: z.object({
+        code: z.string().describe('The one-time code (ABCD-EFGH)'),
+        expiresAt: z.string().describe('When it runs out'),
+        role: RoleSchema,
+        address: z.string().nullable().describe('What the device opens'),
+        fingerprint: z.string().nullable().describe("The certificate's fingerprint, to compare on the device"),
+    }),
+    access: 'owner',
+    keepResult: true,
+    text: (o) => 'Code ' +
+        o.code +
+        ' (5 minutes, ' +
+        o.role +
+        '). On the device open ' +
+        (o.address ?? 'the address on your network') +
+        ' and type the code.' +
+        (o.fingerprint ? ' Its certificate should be ' + o.fingerprint.slice(0, 23) + '...' : ''),
+    cli: {
+        name: 'web',
+        action: 'allow-device',
+        flags: { role: { flag: '--role', value: 'view|control', choices: ['view', 'control'] } },
+    },
+});
+export const revokeAccess = defineOperation({
+    id: 'access.revoke',
+    title: 'Sign out',
+    summary: 'sign out one device or Windows user now (its open pages close)',
+    input: z.object({
+        id: z
+            .string()
+            .regex(/^[0-9a-f]{16}$/)
+            .describe('The id from sandbox web devices'),
+    }),
+    output: z.object({ message: z.string() }),
+    access: 'owner',
+    text: (o) => o.message,
+    cli: { name: 'web', action: 'revoke', positional: ['id'] },
+});
+export const revokeAllAccess = defineOperation({
+    id: 'access.revokeAll',
+    title: 'Sign out everyone',
+    summary: 'sign out every device and Windows user now, and void a code that was not used',
+    input: z.object({}),
+    output: z.object({ message: z.string() }),
+    access: 'owner',
+    danger: true,
+    text: (o) => o.message,
+    cli: { name: 'web', action: 'revoke-all', yes: 'sign everyone out without asking' },
+});
+export const lanOn = defineOperation({
+    id: 'access.lanOn',
+    title: 'Turn on LAN mode',
+    summary: 'let devices you allow use the web UI on your network (adds a firewall rule; Windows asks once)',
+    input: z.object({}),
+    output: z.object({ message: z.string(), address: z.string() }),
+    access: 'owner',
+    text: (o) => o.message,
+    cli: { name: 'web', action: 'lan-on' },
+});
+export const lanOff = defineOperation({
+    id: 'access.lanOff',
+    title: 'Turn off LAN mode',
+    summary: 'stop listening on your network, remove the firewall rule and sign out every device',
+    input: z.object({}),
+    output: z.object({ message: z.string() }),
+    access: 'owner',
+    danger: true,
+    text: (o) => o.message,
+    cli: { name: 'web', action: 'lan-off', yes: 'turn it off without asking' },
+});
+const DAY_MS = 86_400_000;
+/** "in 3 days", "in 5 hours", "today". */
+function untilText(iso, now) {
+    const ms = Date.parse(iso) - now;
+    if (!Number.isFinite(ms))
+        return '?';
+    if (ms >= DAY_MS)
+        return 'in ' + Math.round(ms / DAY_MS) + ' days';
+    if (ms >= 3_600_000)
+        return 'in ' + Math.round(ms / 3_600_000) + ' hours';
+    return 'in ' + Math.max(1, Math.round(ms / 60_000)) + ' minutes';
+}
+function dateText(iso) {
+    return iso ? iso.slice(0, 16).replace('T', ' ') : 'not yet';
+}
+/** The Remote access page: your network, the devices, the Windows users. */
+export function accessPage(o, now = Date.now()) {
+    const allow = action(allowDevice, {}, {
+        key: 'a',
+        verb: 'allow',
+        fields: [{ ...fieldOf(allowDevice.input.shape.role, ['role']), name: 'role', label: 'Role' }],
+        initial: { role: 'view' },
+    });
+    const deviceItems = o.devices.map((d) => ({
+        id: 'device:' + d.id,
+        label: d.name,
+        hint: d.role,
+        tone: d.role === 'control' ? 'accent' : undefined,
+        icon: 'device',
+        description: 'From ' + d.address + ', signed out ' + untilText(d.expiresAt, now) + '.',
+        details: [
+            'Allowed  ' + dateText(d.createdAt),
+            'Last seen  ' + dateText(d.lastSeen),
+            'Ends     ' + dateText(d.expiresAt),
+            'Id       ' + d.id,
+        ],
+        keys: 'x signs it out.',
+        actions: [action(revokeAccess, { id: d.id }, { key: 'x', verb: 'sign out', label: 'Sign out ' + d.name })],
+    }));
+    const windowsItems = o.windows.map((w) => ({
+        id: 'windows:' + w.id,
+        label: w.user,
+        hint: o.users.find((u) => w.user.toLowerCase().endsWith('\\' + u.name.toLowerCase()) || w.user.toLowerCase() === u.name.toLowerCase())?.role ?? 'not on the list',
+        description: 'Signed in with Windows, signed out ' + untilText(w.expiresAt, now) + '.',
+        details: ['Signed in  ' + dateText(w.createdAt), 'Ends      ' + dateText(w.expiresAt), 'Id        ' + w.id],
+        keys: 'x signs them out.',
+        actions: [action(revokeAccess, { id: w.id }, { key: 'x', verb: 'sign out', label: 'Sign out ' + w.user })],
+    }));
+    const lan = o.lan;
+    return {
+        title: 'Remote access',
+        notice: {
+            text: 'Anyone you let in acts as you: control can read what your agents can read, logins included. Local network only, never the internet.',
+            tone: 'warn',
+        },
+        sections: [
+            {
+                id: 'lan',
+                title: 'Devices on your network',
+                facts: [
+                    {
+                        id: 'lan-mode',
+                        label: 'LAN mode',
+                        value: lan.running ? 'on' : lan.enabled ? 'on, not listening' : 'off',
+                        tone: lan.running ? 'ok' : lan.enabled ? 'warn' : 'muted',
+                        description: lan.problem ?? undefined,
+                    },
+                    ...(lan.address
+                        ? [
+                            {
+                                id: 'lan-address',
+                                label: 'On your network',
+                                value: lan.address,
+                                description: "Type this into the phone's browser. The first time it warns about the certificate: compare it with the one below. A warning after that means stop.",
+                            },
+                        ]
+                        : []),
+                    ...(lan.fingerprint ? [{ id: 'lan-cert', label: 'Certificate', value: lan.fingerprint }] : []),
+                    ...(o.pending
+                        ? [
+                            {
+                                id: 'pending',
+                                label: 'Code waiting',
+                                value: 'for a ' + o.pending.role + ' device, ' + untilText(o.pending.expiresAt, now),
+                                tone: 'accent',
+                            },
+                        ]
+                        : []),
+                    ...(o.codeVoided
+                        ? [
+                            {
+                                id: 'voided',
+                                label: 'Last code',
+                                value: 'voided after too many wrong tries',
+                                tone: 'warn',
+                                description: 'Someone on your network may have tried to guess it. Make a new one when you are ready.',
+                            },
+                        ]
+                        : []),
+                    { id: 'remember', label: 'Stays signed in', value: o.rememberDays + ' days (web.remote.rememberDays)' },
+                ],
+                items: deviceItems,
+                actions: lan.enabled
+                    ? [allow, action(lanOff, {}, { key: 'f', verb: 'LAN off' })]
+                    : [action(lanOn, {}, { key: 'n', verb: 'LAN on' })],
+                notes: deviceItems.length ? [] : [{ text: 'No devices yet.', tone: 'muted' }],
+            },
+            {
+                id: 'windows',
+                title: 'Other Windows users of this PC',
+                facts: [
+                    {
+                        id: 'windows-sign-in',
+                        label: 'Windows sign-in',
+                        value: o.windowsSignIn ? 'on' : 'off',
+                        tone: o.windowsSignIn ? 'ok' : 'muted',
+                        description: 'They run sandbox remote (or sandbox remote --browser) as themselves. Turn on web.remote.windowsSignIn and list them in web.remote.users (Settings).',
+                    },
+                    ...o.users.map((u, i) => ({ id: 'user-' + i, label: u.name, value: u.role })),
+                ],
+                items: windowsItems,
+            },
+        ],
+        actions: [action(revokeAllAccess, {}, { key: 'X', verb: 'sign out all' })],
+    };
+}
+export const accessView = defineView({
+    id: 'access',
+    title: 'Remote access',
+    summary: 'Devices on your network and other Windows users of this PC: allow, see, sign out.',
+    queries: { status: accessStatus },
+    operations: [allowDevice, revokeAccess, revokeAllAccess, lanOn, lanOff],
+    build: ({ status }) => accessPage(status),
+});

package/dist/app/features/access/access.run.d.ts

@@ -0,0 +1,79 @@
+import { AccessStore } from '../../../host/remote/index.js';
+import { type AppContext } from '../../context.js';
+/** The access list of this user (the folder is the web state's private one). */
+export declare function accessStoreOf(ctx: AppContext): AccessStore;
+export declare const accessStatusRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").QueryDef<import("zod").ZodObject<{}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    lan: import("zod").ZodObject<{
+        enabled: import("zod").ZodBoolean;
+        running: import("zod").ZodBoolean;
+        address: import("zod").ZodNullable<import("zod").ZodString>;
+        fingerprint: import("zod").ZodNullable<import("zod").ZodString>;
+        problem: import("zod").ZodNullable<import("zod").ZodString>;
+        network: import("zod").ZodNullable<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    windowsSignIn: import("zod").ZodBoolean;
+    users: import("zod").ZodArray<import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        role: import("zod").ZodEnum<{
+            view: "view";
+            control: "control";
+        }>;
+    }, import("zod/v4/core").$strip>>;
+    rememberDays: import("zod").ZodNumber;
+    devices: import("zod").ZodArray<import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        name: import("zod").ZodString;
+        role: import("zod").ZodEnum<{
+            view: "view";
+            control: "control";
+        }>;
+        address: import("zod").ZodString;
+        createdAt: import("zod").ZodString;
+        expiresAt: import("zod").ZodString;
+        lastSeen: import("zod").ZodNullable<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>>;
+    windows: import("zod").ZodArray<import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        user: import("zod").ZodString;
+        createdAt: import("zod").ZodString;
+        expiresAt: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>>;
+    pending: import("zod").ZodNullable<import("zod").ZodObject<{
+        role: import("zod").ZodEnum<{
+            view: "view";
+            control: "control";
+        }>;
+        expiresAt: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>>;
+    codeVoided: import("zod").ZodBoolean;
+}, import("zod/v4/core").$strip>, "access.status">, import("../../../cli/commands/context.js").Context>;
+export declare const allowDeviceRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").OperationDef<import("zod").ZodObject<{
+    role: import("zod").ZodDefault<import("zod").ZodEnum<{
+        view: "view";
+        control: "control";
+    }>>;
+}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    code: import("zod").ZodString;
+    expiresAt: import("zod").ZodString;
+    role: import("zod").ZodEnum<{
+        view: "view";
+        control: "control";
+    }>;
+    address: import("zod").ZodNullable<import("zod").ZodString>;
+    fingerprint: import("zod").ZodNullable<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>, "access.allowDevice">, import("../../../cli/commands/context.js").Context>;
+export declare const revokeAccessRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").OperationDef<import("zod").ZodObject<{
+    id: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    message: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, "access.revoke">, import("../../../cli/commands/context.js").Context>;
+export declare const revokeAllAccessRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").OperationDef<import("zod").ZodObject<{}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    message: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, "access.revokeAll">, import("../../../cli/commands/context.js").Context>;
+export declare const lanOnRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").OperationDef<import("zod").ZodObject<{}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    message: import("zod").ZodString;
+    address: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, "access.lanOn">, import("../../../cli/commands/context.js").Context>;
+export declare const lanOffRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").OperationDef<import("zod").ZodObject<{}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    message: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, "access.lanOff">, import("../../../cli/commands/context.js").Context>;