windows-development-sandbox 1.12.0 → 1.13.0

package/dist/runtime/daemon.js

@@ -26743,12 +26743,39 @@ var ResumeSchema = external_exports.strictObject({
 });
 
 // src/core/schema/web.ts
+var REMOTE_ROLES = ["view", "control"];
+var WindowsUserNameSchema = external_exports.string().trim().min(1).max(120).regex(
+  /^(?:[A-Za-z0-9][A-Za-z0-9._ -]{0,62}\\)?[^\\/"[\]:;|=,+*?<>@]{1,64}$/,
+  "a Windows user name (name or DOMAIN\\name)"
+);
+var RemoteUserSchema = external_exports.strictObject({
+  name: WindowsUserNameSchema.describe("The Windows user (name, or DOMAIN\\name)"),
+  role: external_exports.enum(REMOTE_ROLES).describe("view: sees everything, terminals read-only. control: everything but remote access, logins and tokens.")
+});
+var WebLanSchema = external_exports.strictObject({
+  enabled: external_exports.boolean().describe(
+    "(Beta) Devices on your network (a phone): an HTTPS address on this PC for devices you pair with a one-time code (sandbox web pair). Needs a firewall rule (sandbox web lan on asks Windows once). Off: every paired device is signed out."
+  ),
+  port: external_exports.number().int().min(1024).max(65535).describe("HTTPS port for paired devices on your network."),
+  address: external_exports.string().trim().max(15).regex(/^$|^\d{1,3}(\.\d{1,3}){3}$/, "an IPv4 address or empty").describe("This PC's private address to listen on. Empty: the one of its network adapter (never a public one).")
+});
+var WebRemoteSchema = external_exports.strictObject({
+  windowsSignIn: external_exports.boolean().describe(
+    "(Beta) Other Windows users of this PC named in web.remote.users sign in to your web UI (and sandbox remote) with their own Windows account: no password, no link."
+  ),
+  users: external_exports.array(RemoteUserSchema).max(32).describe("Who else may sign in with Windows, and their role (view or control)."),
+  rememberDays: external_exports.number().int().min(1).max(90).describe(
+    "How many days a paired device or a Windows sign-in stays signed in (from when it signed in, not renewed)."
+  ),
+  lan: WebLanSchema
+});
 var WebSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
     "(Beta) The web UI: your sandbox sessions in a browser on this PC (http://127.0.0.1:<port>, this PC only). On: every sandbox start also starts it in the background (it keeps running until sandbox web stop or a restart of the PC). Off: only sandbox web start runs it. Open it signed in with sandbox web open."
   ),
   port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken."),
-  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts.")
+  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts."),
+  remote: WebRemoteSchema.describe("(Beta) Access for other Windows users of this PC and for paired devices.")
 });
 
 // src/core/schema/vpn.ts
@@ -26778,6 +26805,36 @@ var GithubSchema = external_exports.strictObject({
 });
 
 // src/core/schema/config.ts
+var RESERVED_ENV_PREFIX = /^(AGENT_|GIT_|GH_|GITHUB_|NODE_|NPM_CONFIG_(USERCONFIG|GLOBALCONFIG|PREFIX|SCRIPT_SHELL)|SSL_|CLAUDE|ANTHROPIC_|OPENAI_|CODEX_|GEMINI_|GOOGLE_|COPILOT_|AWS_|AZURE_)/i;
+var RESERVED_ENV_SUFFIX = /(_PROXY|_BASE_URL|_ENDPOINT|_CA_BUNDLE|_CA_CERTS)$/i;
+var RESERVED_ENV_NAMES = new Set(
+  [
+    "PATH",
+    "PATHEXT",
+    "BASH_ENV",
+    "ENV",
+    "COMSPEC",
+    "PSMODULEPATH",
+    "PYTHONPATH",
+    "PYTHONSTARTUP",
+    "PERL5OPT",
+    "RUBYOPT",
+    "JAVA_TOOL_OPTIONS",
+    "LD_PRELOAD",
+    "SYSTEMROOT",
+    "WINDIR",
+    "HOME",
+    "USERPROFILE",
+    "APPDATA",
+    "LOCALAPPDATA",
+    "PROGRAMDATA",
+    "TEMP",
+    "TMP"
+  ].map((n) => n.toUpperCase())
+);
+function reservedEnvName(name) {
+  return RESERVED_ENV_PREFIX.test(name) || RESERVED_ENV_SUFFIX.test(name) || RESERVED_ENV_NAMES.has(name.toUpperCase());
+}
 var ConfigSchema = external_exports.strictObject({
   $schema: SchemaRefSchema.optional(),
   defaultHarness: NameSchema.describe("Agent started by `sandbox launch` (sandbox claude always runs claude)."),
@@ -26844,10 +26901,14 @@ var LocalOverridesSchema = external_exports.strictObject({
   scripts: StringsSchema.describe(
     "Scripts (.ps1 / .mjs / .cmd, relative to this file) run inside the sandbox before the agent."
   ),
-  // This PC's resources are yours to share: CPU and paging file (this PC's disk) are not a project's to set.
+  // This PC's resources are yours to share: CPU, paging file (this PC's disk) and the RAM kept for this PC are not a
+  // project's to set.
   sandbox: SandboxSchema.omit({
     cpuLimit: true,
     pageFileMb: true,
+    reserveHostMb: true,
+    maxMemoryPercent: true,
+    maxMemoryMb: true,
     engine: true,
     agentMemoryHeadroomMb: true,
     pressureResponse: true
@@ -26861,7 +26922,10 @@ var LocalOverridesSchema = external_exports.strictObject({
   // Every toolchain setting, each one optional (a project usually only switches languages on or pins a version).
   toolchains: external_exports.strictObject({
     ...import_lodash.default.mapValues(import_lodash.default.omit(ToolchainsSchema.shape, "environment"), (shape) => shape.partial()),
-    environment: ToolchainsSchema.shape.environment
+    environment: ToolchainsSchema.shape.environment.refine(
+      (env) => !Object.keys(env).some(reservedEnvName),
+      "names the sandbox sets or that carry logins (AGENT_*, GIT_*, PATH, BASH_ENV, NODE_*, proxies, ANTHROPIC_*, CLAUDE_* ...) cannot be set by a project"
+    )
   }).partial(),
   databases: external_exports.strictObject(import_lodash.default.mapValues(DatabasesSchema.shape, (shape) => shape.partial())).partial(),
   attach: AttachSchema.partial(),
@@ -26931,6 +26995,7 @@ var ProjectSpecSchema = external_exports.strictObject({
   /** Its hooks were staged in C:\AgentLaunch\projects\<name>\hooks. */
   hooks: external_exports.boolean()
 });
+var ShellChoiceSchema = external_exports.enum(["auto", "pwsh", "powershell", "cmd"]);
 var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
   external_exports.strictObject({
     kind: external_exports.literal("session"),
@@ -26940,8 +27005,12 @@ var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
     cwd: Text(),
     project: ProjectSpecSchema.optional(),
     harnessSpec: HarnessSchema.optional(),
+    /** A plain shell instead of an agent (harness is then "shell" and args are ignored). */
+    shell: ShellChoiceSchema.optional(),
     createdAt: TimeSchema
   }),
+  /** End a running session (an agent or a shell) and everything it started. */
+  external_exports.strictObject({ kind: external_exports.literal("close"), id: IdSchema, session: IdSchema, createdAt: TimeSchema }),
   /** Provision a registered project without starting an agent (sandbox start / exec / db from its folder). */
   external_exports.strictObject({ kind: external_exports.literal("project"), id: IdSchema, project: ProjectSpecSchema, createdAt: TimeSchema }),
   external_exports.strictObject({
@@ -27007,6 +27076,8 @@ var SessionStatusSchema = external_exports.object({
   id: IdSchema,
   launchId: Text(64),
   harness: Text(64),
+  /** A plain shell (harness is then the shell: pwsh, powershell or cmd); absent: an agent. */
+  kind: external_exports.enum(["agent", "shell"]).optional(),
   cwd: Text(),
   /** The project it runs in: its hub name, or the launch folder's for the first project. */
   project: Text(64).optional(),
@@ -27939,7 +28010,7 @@ function withRequestSecrets(req) {
 }
 
 // src/guest/daemon/daemon.ts
-import fs54 from "node:fs";
+import fs55 from "node:fs";
 
 // src/guest/setup/claude-mem.ts
 import fs15 from "node:fs";
@@ -32046,6 +32117,7 @@ async function setupToolchains(config2, versions, options, run2 = {}) {
     env.summary.push(...part.summary);
   }
   Object.assign(env.vars, config2.environment);
+  Object.assign(env.vars, envs.get("Git")?.vars);
   log("Set up " + steps.length + " toolchains and databases.");
   return env;
 }
@@ -32242,6 +32314,7 @@ function execCommand(req) {
 }
 
 // src/guest/daemon/sessions.ts
+import fs53 from "node:fs";
 import path68 from "node:path";
 import crypto4 from "node:crypto";
 import os11 from "node:os";
@@ -32254,6 +32327,8 @@ var FrameType = {
   Resize: 3,
   Restart: 4,
   Ping: 5,
+  /** Ends the program and everything it started, and with it the session. */
+  Close: 6,
   Output: 16,
   Exit: 17,
   Error: 18,
@@ -32337,6 +32412,16 @@ function cmdArgs(args) {
 function commandLine(file3, args) {
   return path64.win32.basename(file3).toLowerCase() === "cmd.exe" ? [quoteArg(file3), cmdArgs(args)].filter(Boolean).join(" ") : [file3, ...args].map(quoteArg).join(" ");
 }
+function shellLaunch(asked, paths) {
+  if (asked === "cmd") return { name: "cmd", file: paths.cmd, args: [] };
+  if (asked === "powershell" || asked === "auto" && !paths.pwsh)
+    return { name: "powershell", file: paths.powershell, args: ["-NoLogo"] };
+  if (!paths.pwsh)
+    throw new Error(
+      "PowerShell 7 is not installed in this sandbox (toolchains.pwsh). Open powershell or cmd instead, or turn pwsh on."
+    );
+  return { name: "pwsh", file: paths.pwsh, args: ["-NoLogo"] };
+}
 
 // src/guest/sessions/pty-host.ts
 import fs50 from "node:fs";
@@ -32556,6 +32641,7 @@ var IdleShutdown = class {
 };
 
 // src/guest/daemon/sessions.ts
+var CLOSE_WAIT_MS = 8e3;
 var ROOTS_KEPT_MS = 10 * 60 * 1e3;
 function terminalTab(id, title, cwd) {
   const view = [process.execPath, path68.join(path68.dirname(process.argv[1]), "view.js"), id];
@@ -32601,14 +32687,38 @@ function writeBudget(cpus, memoryGb, jobs, env) {
     warn("budget.json could not be written: " + errMsg(e));
   }
 }
-var launchPtyHost = async (req, remote, env, say, sessions2, onSpawn) => {
+var agentProgram = async (req, env, say) => {
   const harness = harnessFor(req);
   say("Preparing " + req.harness);
   await agents.provision(req.harness, harness, env, false);
   const launch = agents.resolveLaunch(req.harness, harness);
   const base = [...launch.args, ...harness.arguments];
+  return {
+    command: commandLine(launch.file, [...base, ...req.args]),
+    restartCommand: commandLine(launch.file, [...base, ...harness.resumeArguments ?? []]),
+    environment: harness.environment
+  };
+};
+function shellPaths() {
+  const candidates = [
+    path68.join(pwshDir(), "pwsh.exe"),
+    path68.join(process.env.ProgramFiles ?? "C:\\Program Files", "PowerShell", "7", "pwsh.exe")
+  ];
+  return { pwsh: candidates.find((f) => fs53.existsSync(f)) ?? null, powershell: SYSTEM.powershell(), cmd: SYSTEM.cmd() };
+}
+var shellProgram = (shell) => {
+  const line = commandLine(shell.file, shell.args);
+  return { command: line, restartCommand: line, environment: {} };
+};
+var launchPtyHost = async (req, program, remote, env, sessions2, onSpawn) => {
   const port = await freePort();
   const token = crypto4.randomBytes(24).toString("base64url");
+  const sessionEnv = {
+    ...withRegistryPath(env),
+    ...program.environment,
+    ...memoryEnv(env, sessions2)
+  };
+  if (req.shell) delete sessionEnv.PSModulePath;
   const child = startPtyHost({
     exe: ensurePtyHost(),
     port,
@@ -32617,10 +32727,10 @@ var launchPtyHost = async (req, remote, env, say, sessions2, onSpawn) => {
     rows: 32,
     id: req.id,
     cwd: req.cwd,
-    env: { ...withRegistryPath(env), ...harness.environment, ...memoryEnv(env, sessions2) },
+    env: sessionEnv,
     remote,
-    command: commandLine(launch.file, [...base, ...req.args]),
-    restartCommand: commandLine(launch.file, [...base, ...harness.resumeArguments ?? []])
+    command: program.command,
+    restartCommand: program.restartCommand
   });
   onSpawn(child);
   try {
@@ -32635,6 +32745,17 @@ var launchPtyHost = async (req, remote, env, say, sessions2, onSpawn) => {
 };
 var placeFor = async (req, say) => {
   if (!req.project) {
+    const known = insidePrimary(req.cwd) ? null : provisioner.provisionedFor(req.cwd);
+    if (known && exists(req.cwd))
+      return {
+        env: known.env,
+        hooks: known.spec.hooks ? projectHooks(known.spec.name, known.spec.workspace) : null,
+        project: known.spec.name
+      };
+    if (!insidePrimary(req.cwd) && insideWorkspace(req.cwd))
+      throw new Error(
+        "The project in " + req.cwd + " is not set up in the sandbox yet: run sandbox start in its folder first."
+      );
     if (!insidePrimary(req.cwd) || !exists(req.cwd))
       throw new Error("Folder is not inside the sandbox workspace " + workspace + ": " + req.cwd);
     return { env: process.env, hooks: null, project: primaryProject() };
@@ -32682,16 +32803,29 @@ var SessionManager = class {
     const r = this.ptyHosts.get(id);
     if (r && r.to === void 0) this.ptyHosts.set(id, { ...r, to: Date.now() });
   }
-  /** `session` requests: an agent in its own ptyhost, in the launch folder's project or a registered one. */
+  /**
+   * `session` requests: an agent (or a plain shell) in its own ptyhost, in the launch folder's project or a registered
+   * one.
+   */
   async start(req) {
+    let shell = null;
+    let problem = null;
+    if (req.shell)
+      try {
+        shell = shellLaunch(req.shell, shellPaths());
+      } catch (e) {
+        problem = errMsg(e);
+      }
+    const name = shell?.name ?? (req.shell ? "shell" : req.harness);
     let status = {
       id: req.id,
       launchId: session.launchId,
-      harness: req.harness,
+      harness: name,
+      ...req.shell ? { kind: "shell" } : {},
       cwd: req.cwd,
       ...req.project ? { project: req.project.name } : {},
       phase: "starting",
-      message: "Starting " + req.harness,
+      message: "Starting " + name,
       updatedAt: now(),
       startedAt: now()
     };
@@ -32702,34 +32836,37 @@ var SessionManager = class {
     };
     this.starting++;
     if (req.id !== session.launchId && process.env.AGENT_NO_TABS !== "1")
-      safely("terminal tab", () => terminalTab(req.id, req.harness + " " + path68.basename(req.cwd), req.cwd));
+      safely("terminal tab", () => terminalTab(req.id, name + " " + path68.basename(req.cwd), req.cwd));
     try {
+      if (problem) throw new Error(problem);
       const place = await placeFor(req, say);
+      const program = shell ? shellProgram(shell) : await agentProgram(req, place.env, say);
       const remote = session.networking && session.attach.enabled;
       const from = Date.now();
       const { child, port, token } = await launchPtyHost(
         req,
+        program,
         remote,
         place.env,
-        say,
         this.live.size + 1,
         (c) => this.rootStarted(req.id, c, from)
       );
-      const resumed = req.harness === "claude" ? resumedConversation(req.args) : void 0;
+      const agent = shell === null;
+      const resumed = agent && req.harness === "claude" ? resumedConversation(req.args) : void 0;
       const running = {
         ...status,
         ...resumed ? { conversation: resumed } : {},
         project: place.project,
         phase: "running",
-        message: req.harness + " is running",
+        message: name + " is running",
         attach: { addresses: remote ? guestAddresses() : [], port, token }
       };
       this.live.set(req.id, { status: running, child });
       child.once("exit", (code) => this.onExit(running, place, code));
       saveStatus(running);
-      if (req.harness === "claude") this.trackConversation(running.id, resumed);
+      if (agent && req.harness === "claude") this.trackConversation(running.id, resumed);
       log(
-        "Session " + req.id + " started (" + req.harness + " in " + req.cwd + ", project " + place.project + ", port " + port + ")"
+        "Session " + req.id + " started (" + name + " in " + req.cwd + ", project " + place.project + ", port " + port + ")"
       );
     } catch (e) {
       this.rootEnded(req.id);
@@ -32758,10 +32895,13 @@ var SessionManager = class {
       this.idle.check();
     }
   }
-  /** `restart` requests: the matching sessions restart their agent (continuing the conversation where it can). */
+  /**
+   * `restart` requests: the matching sessions restart their agent (continuing the conversation where it can). Shells
+   * are left alone: restarting one would only throw away what it was doing.
+   */
   async restart(req) {
     const targets = [...this.live.values()].filter(
-      (s) => s.status.attach && (req.harness === null || s.status.harness === req.harness) && (!req.cwd || isWithin(req.cwd, s.status.cwd))
+      (s) => s.status.attach && s.status.kind !== "shell" && (req.harness === null || s.status.harness === req.harness) && (!req.cwd || isWithin(req.cwd, s.status.cwd))
     );
     for (const s of targets)
       await sendControl(
@@ -32770,6 +32910,41 @@ var SessionManager = class {
       );
     respond(req.id, { ok: true, message: "restarted " + targets.length + " session(s)" });
   }
+  /**
+   * `close` requests: the session's ptyhost ends its program and everything it started (ProcessTree), then exits as
+   * if the program had. One that does not end in time has its ptyhost ended instead (closing the pseudo console ends
+   * what is attached to it).
+   */
+  async close(req) {
+    const entry = this.live.get(req.session);
+    if (!entry?.status.attach) {
+      respond(req.id, { ok: false, message: "Session " + req.session + " is not running." });
+      return;
+    }
+    const { child, status } = entry;
+    const ended = new Promise((resolve2) => {
+      if (child.exitCode !== null || child.signalCode !== null) return resolve2(true);
+      const timer = setTimeout(() => resolve2(false), CLOSE_WAIT_MS);
+      child.once("exit", () => {
+        clearTimeout(timer);
+        resolve2(true);
+      });
+    });
+    try {
+      await sendControl(
+        { addresses: ["127.0.0.1"], port: status.attach.port, token: status.attach.token },
+        FrameType.Close
+      );
+    } catch (e) {
+      warn("Session " + req.session + " did not take the close request: " + errMsg(e));
+    }
+    if (!await ended) {
+      warn("Session " + req.session + " did not end in time; ending its session host.");
+      safely("ending a session host", () => child.kill());
+    }
+    log("Session " + req.session + " closed on request");
+    respond(req.id, { ok: true, message: "Closed " + status.harness + " session " + req.session + "." });
+  }
   /**
    * Finds out which of Claude's conversation files this session writes (it appears with the first message) and puts
    * it in the status, so the host can reopen this very conversation. A reopened session starts with the one it was
@@ -32812,6 +32987,10 @@ var SessionManager = class {
       attach: void 0
     });
     log("Session " + running.id + " ended (exit " + code + ")");
+    if (running.kind === "shell") {
+      this.idle.check();
+      return;
+    }
     if (place.hooks)
       void runHooksAsync("post-agent", place.env, place.hooks).catch(
         (e) => warn("post-agent hooks failed: " + errMsg(e))
@@ -33151,7 +33330,7 @@ var GovernorCore = class {
 };
 
 // src/guest/governor/governor.ts
-import fs53 from "node:fs";
+import fs54 from "node:fs";
 import os12 from "node:os";
 import path69 from "node:path";
 import { spawn as spawn8 } from "node:child_process";
@@ -33224,11 +33403,11 @@ var MemGovProcess = class {
 function appendToMemoryLog(line) {
   try {
     const logs = path69.join(dataDir, "logs");
-    const newest = fs53.readdirSync(logs).filter((f) => /^memory-\d{8}-\d{6}\.log$/.test(f)).sort().pop();
+    const newest = fs54.readdirSync(logs).filter((f) => /^memory-\d{8}-\d{6}\.log$/.test(f)).sort().pop();
     if (!newest) return;
     const t = /* @__PURE__ */ new Date();
     const stamp = [t.getHours(), t.getMinutes(), t.getSeconds()].map((n) => String(n).padStart(2, "0")).join(":");
-    fs53.appendFileSync(path69.join(logs, newest), stamp + " | " + line + "\r\n");
+    fs54.appendFileSync(path69.join(logs, newest), stamp + " | " + line + "\r\n");
   } catch {
   }
 }
@@ -33285,9 +33464,9 @@ var Daemon = class {
   tick() {
     const { valid, invalid } = run.scanRequests();
     for (const file3 of invalid)
-      safely("removing an invalid request", () => fs54.rmSync(file3, { recursive: true, force: true }));
+      safely("removing an invalid request", () => fs55.rmSync(file3, { recursive: true, force: true }));
     for (const req of valid) {
-      safely("claiming a request", () => fs54.rmSync(run.requestFile(req.id), { force: true }));
+      safely("claiming a request", () => fs55.rmSync(run.requestFile(req.id), { force: true }));
       if (run.readSession(req.id)) continue;
       void Promise.resolve(this.handle(withRequestSecrets(req))).catch(
         (e) => respond(req.id, { ok: false, message: errMsg(e) })
@@ -33309,6 +33488,8 @@ var Daemon = class {
         return execCommand(req);
       case "restart":
         return sessions.restart(req);
+      case "close":
+        return sessions.close(req);
       case "pressure":
         return governor.hostPressure(req.seconds, req.reason, req.level ?? "slow");
       case "ping":

package/dist/runtime/db.js

@@ -26636,12 +26636,39 @@ var ResumeSchema = external_exports.strictObject({
 });
 
 // src/core/schema/web.ts
+var REMOTE_ROLES = ["view", "control"];
+var WindowsUserNameSchema = external_exports.string().trim().min(1).max(120).regex(
+  /^(?:[A-Za-z0-9][A-Za-z0-9._ -]{0,62}\\)?[^\\/"[\]:;|=,+*?<>@]{1,64}$/,
+  "a Windows user name (name or DOMAIN\\name)"
+);
+var RemoteUserSchema = external_exports.strictObject({
+  name: WindowsUserNameSchema.describe("The Windows user (name, or DOMAIN\\name)"),
+  role: external_exports.enum(REMOTE_ROLES).describe("view: sees everything, terminals read-only. control: everything but remote access, logins and tokens.")
+});
+var WebLanSchema = external_exports.strictObject({
+  enabled: external_exports.boolean().describe(
+    "(Beta) Devices on your network (a phone): an HTTPS address on this PC for devices you pair with a one-time code (sandbox web pair). Needs a firewall rule (sandbox web lan on asks Windows once). Off: every paired device is signed out."
+  ),
+  port: external_exports.number().int().min(1024).max(65535).describe("HTTPS port for paired devices on your network."),
+  address: external_exports.string().trim().max(15).regex(/^$|^\d{1,3}(\.\d{1,3}){3}$/, "an IPv4 address or empty").describe("This PC's private address to listen on. Empty: the one of its network adapter (never a public one).")
+});
+var WebRemoteSchema = external_exports.strictObject({
+  windowsSignIn: external_exports.boolean().describe(
+    "(Beta) Other Windows users of this PC named in web.remote.users sign in to your web UI (and sandbox remote) with their own Windows account: no password, no link."
+  ),
+  users: external_exports.array(RemoteUserSchema).max(32).describe("Who else may sign in with Windows, and their role (view or control)."),
+  rememberDays: external_exports.number().int().min(1).max(90).describe(
+    "How many days a paired device or a Windows sign-in stays signed in (from when it signed in, not renewed)."
+  ),
+  lan: WebLanSchema
+});
 var WebSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
     "(Beta) The web UI: your sandbox sessions in a browser on this PC (http://127.0.0.1:<port>, this PC only). On: every sandbox start also starts it in the background (it keeps running until sandbox web stop or a restart of the PC). Off: only sandbox web start runs it. Open it signed in with sandbox web open."
   ),
   port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken."),
-  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts.")
+  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts."),
+  remote: WebRemoteSchema.describe("(Beta) Access for other Windows users of this PC and for paired devices.")
 });
 
 // src/core/schema/vpn.ts
@@ -26671,6 +26698,36 @@ var GithubSchema = external_exports.strictObject({
 });
 
 // src/core/schema/config.ts
+var RESERVED_ENV_PREFIX = /^(AGENT_|GIT_|GH_|GITHUB_|NODE_|NPM_CONFIG_(USERCONFIG|GLOBALCONFIG|PREFIX|SCRIPT_SHELL)|SSL_|CLAUDE|ANTHROPIC_|OPENAI_|CODEX_|GEMINI_|GOOGLE_|COPILOT_|AWS_|AZURE_)/i;
+var RESERVED_ENV_SUFFIX = /(_PROXY|_BASE_URL|_ENDPOINT|_CA_BUNDLE|_CA_CERTS)$/i;
+var RESERVED_ENV_NAMES = new Set(
+  [
+    "PATH",
+    "PATHEXT",
+    "BASH_ENV",
+    "ENV",
+    "COMSPEC",
+    "PSMODULEPATH",
+    "PYTHONPATH",
+    "PYTHONSTARTUP",
+    "PERL5OPT",
+    "RUBYOPT",
+    "JAVA_TOOL_OPTIONS",
+    "LD_PRELOAD",
+    "SYSTEMROOT",
+    "WINDIR",
+    "HOME",
+    "USERPROFILE",
+    "APPDATA",
+    "LOCALAPPDATA",
+    "PROGRAMDATA",
+    "TEMP",
+    "TMP"
+  ].map((n) => n.toUpperCase())
+);
+function reservedEnvName(name) {
+  return RESERVED_ENV_PREFIX.test(name) || RESERVED_ENV_SUFFIX.test(name) || RESERVED_ENV_NAMES.has(name.toUpperCase());
+}
 var ConfigSchema = external_exports.strictObject({
   $schema: SchemaRefSchema.optional(),
   defaultHarness: NameSchema.describe("Agent started by `sandbox launch` (sandbox claude always runs claude)."),
@@ -26737,10 +26794,14 @@ var LocalOverridesSchema = external_exports.strictObject({
   scripts: StringsSchema.describe(
     "Scripts (.ps1 / .mjs / .cmd, relative to this file) run inside the sandbox before the agent."
   ),
-  // This PC's resources are yours to share: CPU and paging file (this PC's disk) are not a project's to set.
+  // This PC's resources are yours to share: CPU, paging file (this PC's disk) and the RAM kept for this PC are not a
+  // project's to set.
   sandbox: SandboxSchema.omit({
     cpuLimit: true,
     pageFileMb: true,
+    reserveHostMb: true,
+    maxMemoryPercent: true,
+    maxMemoryMb: true,
     engine: true,
     agentMemoryHeadroomMb: true,
     pressureResponse: true
@@ -26754,7 +26815,10 @@ var LocalOverridesSchema = external_exports.strictObject({
   // Every toolchain setting, each one optional (a project usually only switches languages on or pins a version).
   toolchains: external_exports.strictObject({
     ...import_lodash.default.mapValues(import_lodash.default.omit(ToolchainsSchema.shape, "environment"), (shape) => shape.partial()),
-    environment: ToolchainsSchema.shape.environment
+    environment: ToolchainsSchema.shape.environment.refine(
+      (env) => !Object.keys(env).some(reservedEnvName),
+      "names the sandbox sets or that carry logins (AGENT_*, GIT_*, PATH, BASH_ENV, NODE_*, proxies, ANTHROPIC_*, CLAUDE_* ...) cannot be set by a project"
+    )
   }).partial(),
   databases: external_exports.strictObject(import_lodash.default.mapValues(DatabasesSchema.shape, (shape) => shape.partial())).partial(),
   attach: AttachSchema.partial(),
@@ -26824,6 +26888,7 @@ var ProjectSpecSchema = external_exports.strictObject({
   /** Its hooks were staged in C:\AgentLaunch\projects\<name>\hooks. */
   hooks: external_exports.boolean()
 });
+var ShellChoiceSchema = external_exports.enum(["auto", "pwsh", "powershell", "cmd"]);
 var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
   external_exports.strictObject({
     kind: external_exports.literal("session"),
@@ -26833,8 +26898,12 @@ var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
     cwd: Text(),
     project: ProjectSpecSchema.optional(),
     harnessSpec: HarnessSchema.optional(),
+    /** A plain shell instead of an agent (harness is then "shell" and args are ignored). */
+    shell: ShellChoiceSchema.optional(),
     createdAt: TimeSchema
   }),
+  /** End a running session (an agent or a shell) and everything it started. */
+  external_exports.strictObject({ kind: external_exports.literal("close"), id: IdSchema, session: IdSchema, createdAt: TimeSchema }),
   /** Provision a registered project without starting an agent (sandbox start / exec / db from its folder). */
   external_exports.strictObject({ kind: external_exports.literal("project"), id: IdSchema, project: ProjectSpecSchema, createdAt: TimeSchema }),
   external_exports.strictObject({
@@ -26900,6 +26969,8 @@ var SessionStatusSchema = external_exports.object({
   id: IdSchema,
   launchId: Text(64),
   harness: Text(64),
+  /** A plain shell (harness is then the shell: pwsh, powershell or cmd); absent: an agent. */
+  kind: external_exports.enum(["agent", "shell"]).optional(),
   cwd: Text(),
   /** The project it runs in: its hub name, or the launch folder's for the first project. */
   project: Text(64).optional(),

package/dist/runtime/gitguard.js

@@ -62,6 +62,7 @@ var LISTING = {
 };
 var WITH_VALUE = /* @__PURE__ */ new Set(["-C", "--namespace"]);
 var FORBIDDEN_GLOBAL = /^(-c|--config-env|--exec-path|--git-dir|--work-tree|--super-prefix)(=|$)/;
+var RUNS_OR_WRITES = /^(--open-files-in-pager|--upload-pack|--output|--ext-diff)(=|$)/;
 function gitDecision(args, access) {
   if (access === "full") return { allow: true };
   if (access !== "readonly")
@@ -76,6 +77,11 @@ function gitDecision(args, access) {
     i += WITH_VALUE.has(args[i]) ? 2 : 1;
   }
   const [command, ...rest] = args.slice(i);
+  const runsOrWrites = rest.find(
+    (a) => RUNS_OR_WRITES.test(a) || command === "ls-remote" && /^-u(.|$)/.test(a) || command === "grep" && /^-O/.test(a)
+  );
+  if (runsOrWrites)
+    return { allow: false, reason: "git " + runsOrWrites + " is not allowed: git is read-only in this sandbox." };
   if (command === void 0 || command === "--version" || READ_ONLY.has(command) || (LISTING[command]?.(rest) ?? false))
     return { allow: true };
   return {