windows-development-sandbox 1.12.0 → 1.13.0

package/dist/runtime/main.js

@@ -26765,12 +26765,39 @@ var ResumeSchema = external_exports.strictObject({
 });
 
 // src/core/schema/web.ts
+var REMOTE_ROLES = ["view", "control"];
+var WindowsUserNameSchema = external_exports.string().trim().min(1).max(120).regex(
+  /^(?:[A-Za-z0-9][A-Za-z0-9._ -]{0,62}\\)?[^\\/"[\]:;|=,+*?<>@]{1,64}$/,
+  "a Windows user name (name or DOMAIN\\name)"
+);
+var RemoteUserSchema = external_exports.strictObject({
+  name: WindowsUserNameSchema.describe("The Windows user (name, or DOMAIN\\name)"),
+  role: external_exports.enum(REMOTE_ROLES).describe("view: sees everything, terminals read-only. control: everything but remote access, logins and tokens.")
+});
+var WebLanSchema = external_exports.strictObject({
+  enabled: external_exports.boolean().describe(
+    "(Beta) Devices on your network (a phone): an HTTPS address on this PC for devices you pair with a one-time code (sandbox web pair). Needs a firewall rule (sandbox web lan on asks Windows once). Off: every paired device is signed out."
+  ),
+  port: external_exports.number().int().min(1024).max(65535).describe("HTTPS port for paired devices on your network."),
+  address: external_exports.string().trim().max(15).regex(/^$|^\d{1,3}(\.\d{1,3}){3}$/, "an IPv4 address or empty").describe("This PC's private address to listen on. Empty: the one of its network adapter (never a public one).")
+});
+var WebRemoteSchema = external_exports.strictObject({
+  windowsSignIn: external_exports.boolean().describe(
+    "(Beta) Other Windows users of this PC named in web.remote.users sign in to your web UI (and sandbox remote) with their own Windows account: no password, no link."
+  ),
+  users: external_exports.array(RemoteUserSchema).max(32).describe("Who else may sign in with Windows, and their role (view or control)."),
+  rememberDays: external_exports.number().int().min(1).max(90).describe(
+    "How many days a paired device or a Windows sign-in stays signed in (from when it signed in, not renewed)."
+  ),
+  lan: WebLanSchema
+});
 var WebSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
     "(Beta) The web UI: your sandbox sessions in a browser on this PC (http://127.0.0.1:<port>, this PC only). On: every sandbox start also starts it in the background (it keeps running until sandbox web stop or a restart of the PC). Off: only sandbox web start runs it. Open it signed in with sandbox web open."
   ),
   port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken."),
-  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts.")
+  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts."),
+  remote: WebRemoteSchema.describe("(Beta) Access for other Windows users of this PC and for paired devices.")
 });
 
 // src/core/schema/vpn.ts
@@ -26800,6 +26827,36 @@ var GithubSchema = external_exports.strictObject({
 });
 
 // src/core/schema/config.ts
+var RESERVED_ENV_PREFIX = /^(AGENT_|GIT_|GH_|GITHUB_|NODE_|NPM_CONFIG_(USERCONFIG|GLOBALCONFIG|PREFIX|SCRIPT_SHELL)|SSL_|CLAUDE|ANTHROPIC_|OPENAI_|CODEX_|GEMINI_|GOOGLE_|COPILOT_|AWS_|AZURE_)/i;
+var RESERVED_ENV_SUFFIX = /(_PROXY|_BASE_URL|_ENDPOINT|_CA_BUNDLE|_CA_CERTS)$/i;
+var RESERVED_ENV_NAMES = new Set(
+  [
+    "PATH",
+    "PATHEXT",
+    "BASH_ENV",
+    "ENV",
+    "COMSPEC",
+    "PSMODULEPATH",
+    "PYTHONPATH",
+    "PYTHONSTARTUP",
+    "PERL5OPT",
+    "RUBYOPT",
+    "JAVA_TOOL_OPTIONS",
+    "LD_PRELOAD",
+    "SYSTEMROOT",
+    "WINDIR",
+    "HOME",
+    "USERPROFILE",
+    "APPDATA",
+    "LOCALAPPDATA",
+    "PROGRAMDATA",
+    "TEMP",
+    "TMP"
+  ].map((n) => n.toUpperCase())
+);
+function reservedEnvName(name) {
+  return RESERVED_ENV_PREFIX.test(name) || RESERVED_ENV_SUFFIX.test(name) || RESERVED_ENV_NAMES.has(name.toUpperCase());
+}
 var ConfigSchema = external_exports.strictObject({
   $schema: SchemaRefSchema.optional(),
   defaultHarness: NameSchema.describe("Agent started by `sandbox launch` (sandbox claude always runs claude)."),
@@ -26866,10 +26923,14 @@ var LocalOverridesSchema = external_exports.strictObject({
   scripts: StringsSchema.describe(
     "Scripts (.ps1 / .mjs / .cmd, relative to this file) run inside the sandbox before the agent."
   ),
-  // This PC's resources are yours to share: CPU and paging file (this PC's disk) are not a project's to set.
+  // This PC's resources are yours to share: CPU, paging file (this PC's disk) and the RAM kept for this PC are not a
+  // project's to set.
   sandbox: SandboxSchema.omit({
     cpuLimit: true,
     pageFileMb: true,
+    reserveHostMb: true,
+    maxMemoryPercent: true,
+    maxMemoryMb: true,
     engine: true,
     agentMemoryHeadroomMb: true,
     pressureResponse: true
@@ -26883,7 +26944,10 @@ var LocalOverridesSchema = external_exports.strictObject({
   // Every toolchain setting, each one optional (a project usually only switches languages on or pins a version).
   toolchains: external_exports.strictObject({
     ...import_lodash.default.mapValues(import_lodash.default.omit(ToolchainsSchema.shape, "environment"), (shape) => shape.partial()),
-    environment: ToolchainsSchema.shape.environment
+    environment: ToolchainsSchema.shape.environment.refine(
+      (env) => !Object.keys(env).some(reservedEnvName),
+      "names the sandbox sets or that carry logins (AGENT_*, GIT_*, PATH, BASH_ENV, NODE_*, proxies, ANTHROPIC_*, CLAUDE_* ...) cannot be set by a project"
+    )
   }).partial(),
   databases: external_exports.strictObject(import_lodash.default.mapValues(DatabasesSchema.shape, (shape) => shape.partial())).partial(),
   attach: AttachSchema.partial(),
@@ -26953,6 +27017,7 @@ var ProjectSpecSchema = external_exports.strictObject({
   /** Its hooks were staged in C:\AgentLaunch\projects\<name>\hooks. */
   hooks: external_exports.boolean()
 });
+var ShellChoiceSchema = external_exports.enum(["auto", "pwsh", "powershell", "cmd"]);
 var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
   external_exports.strictObject({
     kind: external_exports.literal("session"),
@@ -26962,8 +27027,12 @@ var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
     cwd: Text(),
     project: ProjectSpecSchema.optional(),
     harnessSpec: HarnessSchema.optional(),
+    /** A plain shell instead of an agent (harness is then "shell" and args are ignored). */
+    shell: ShellChoiceSchema.optional(),
     createdAt: TimeSchema
   }),
+  /** End a running session (an agent or a shell) and everything it started. */
+  external_exports.strictObject({ kind: external_exports.literal("close"), id: IdSchema, session: IdSchema, createdAt: TimeSchema }),
   /** Provision a registered project without starting an agent (sandbox start / exec / db from its folder). */
   external_exports.strictObject({ kind: external_exports.literal("project"), id: IdSchema, project: ProjectSpecSchema, createdAt: TimeSchema }),
   external_exports.strictObject({
@@ -27029,6 +27098,8 @@ var SessionStatusSchema = external_exports.object({
   id: IdSchema,
   launchId: Text(64),
   harness: Text(64),
+  /** A plain shell (harness is then the shell: pwsh, powershell or cmd); absent: an agent. */
+  kind: external_exports.enum(["agent", "shell"]).optional(),
   cwd: Text(),
   /** The project it runs in: its hub name, or the launch folder's for the first project. */
   project: Text(64).optional(),
@@ -32651,6 +32722,7 @@ async function setupToolchains(config2, versions, options, run3 = {}) {
     env.summary.push(...part.summary);
   }
   Object.assign(env.vars, config2.environment);
+  Object.assign(env.vars, envs.get("Git")?.vars);
   log("Set up " + steps.length + " toolchains and databases.");
   return env;
 }
@@ -34964,6 +35036,8 @@ var FrameType = {
   Resize: 3,
   Restart: 4,
   Ping: 5,
+  /** Ends the program and everything it started, and with it the session. */
+  Close: 6,
   Output: 16,
   Exit: 17,
   Error: 18,

package/dist/runtime/netproxy.js

@@ -26689,12 +26689,39 @@ var ResumeSchema = external_exports.strictObject({
 });
 
 // src/core/schema/web.ts
+var REMOTE_ROLES = ["view", "control"];
+var WindowsUserNameSchema = external_exports.string().trim().min(1).max(120).regex(
+  /^(?:[A-Za-z0-9][A-Za-z0-9._ -]{0,62}\\)?[^\\/"[\]:;|=,+*?<>@]{1,64}$/,
+  "a Windows user name (name or DOMAIN\\name)"
+);
+var RemoteUserSchema = external_exports.strictObject({
+  name: WindowsUserNameSchema.describe("The Windows user (name, or DOMAIN\\name)"),
+  role: external_exports.enum(REMOTE_ROLES).describe("view: sees everything, terminals read-only. control: everything but remote access, logins and tokens.")
+});
+var WebLanSchema = external_exports.strictObject({
+  enabled: external_exports.boolean().describe(
+    "(Beta) Devices on your network (a phone): an HTTPS address on this PC for devices you pair with a one-time code (sandbox web pair). Needs a firewall rule (sandbox web lan on asks Windows once). Off: every paired device is signed out."
+  ),
+  port: external_exports.number().int().min(1024).max(65535).describe("HTTPS port for paired devices on your network."),
+  address: external_exports.string().trim().max(15).regex(/^$|^\d{1,3}(\.\d{1,3}){3}$/, "an IPv4 address or empty").describe("This PC's private address to listen on. Empty: the one of its network adapter (never a public one).")
+});
+var WebRemoteSchema = external_exports.strictObject({
+  windowsSignIn: external_exports.boolean().describe(
+    "(Beta) Other Windows users of this PC named in web.remote.users sign in to your web UI (and sandbox remote) with their own Windows account: no password, no link."
+  ),
+  users: external_exports.array(RemoteUserSchema).max(32).describe("Who else may sign in with Windows, and their role (view or control)."),
+  rememberDays: external_exports.number().int().min(1).max(90).describe(
+    "How many days a paired device or a Windows sign-in stays signed in (from when it signed in, not renewed)."
+  ),
+  lan: WebLanSchema
+});
 var WebSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
     "(Beta) The web UI: your sandbox sessions in a browser on this PC (http://127.0.0.1:<port>, this PC only). On: every sandbox start also starts it in the background (it keeps running until sandbox web stop or a restart of the PC). Off: only sandbox web start runs it. Open it signed in with sandbox web open."
   ),
   port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken."),
-  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts.")
+  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts."),
+  remote: WebRemoteSchema.describe("(Beta) Access for other Windows users of this PC and for paired devices.")
 });
 
 // src/core/schema/vpn.ts
@@ -26724,6 +26751,36 @@ var GithubSchema = external_exports.strictObject({
 });
 
 // src/core/schema/config.ts
+var RESERVED_ENV_PREFIX = /^(AGENT_|GIT_|GH_|GITHUB_|NODE_|NPM_CONFIG_(USERCONFIG|GLOBALCONFIG|PREFIX|SCRIPT_SHELL)|SSL_|CLAUDE|ANTHROPIC_|OPENAI_|CODEX_|GEMINI_|GOOGLE_|COPILOT_|AWS_|AZURE_)/i;
+var RESERVED_ENV_SUFFIX = /(_PROXY|_BASE_URL|_ENDPOINT|_CA_BUNDLE|_CA_CERTS)$/i;
+var RESERVED_ENV_NAMES = new Set(
+  [
+    "PATH",
+    "PATHEXT",
+    "BASH_ENV",
+    "ENV",
+    "COMSPEC",
+    "PSMODULEPATH",
+    "PYTHONPATH",
+    "PYTHONSTARTUP",
+    "PERL5OPT",
+    "RUBYOPT",
+    "JAVA_TOOL_OPTIONS",
+    "LD_PRELOAD",
+    "SYSTEMROOT",
+    "WINDIR",
+    "HOME",
+    "USERPROFILE",
+    "APPDATA",
+    "LOCALAPPDATA",
+    "PROGRAMDATA",
+    "TEMP",
+    "TMP"
+  ].map((n) => n.toUpperCase())
+);
+function reservedEnvName(name) {
+  return RESERVED_ENV_PREFIX.test(name) || RESERVED_ENV_SUFFIX.test(name) || RESERVED_ENV_NAMES.has(name.toUpperCase());
+}
 var ConfigSchema = external_exports.strictObject({
   $schema: SchemaRefSchema.optional(),
   defaultHarness: NameSchema.describe("Agent started by `sandbox launch` (sandbox claude always runs claude)."),
@@ -26790,10 +26847,14 @@ var LocalOverridesSchema = external_exports.strictObject({
   scripts: StringsSchema.describe(
     "Scripts (.ps1 / .mjs / .cmd, relative to this file) run inside the sandbox before the agent."
   ),
-  // This PC's resources are yours to share: CPU and paging file (this PC's disk) are not a project's to set.
+  // This PC's resources are yours to share: CPU, paging file (this PC's disk) and the RAM kept for this PC are not a
+  // project's to set.
   sandbox: SandboxSchema.omit({
     cpuLimit: true,
     pageFileMb: true,
+    reserveHostMb: true,
+    maxMemoryPercent: true,
+    maxMemoryMb: true,
     engine: true,
     agentMemoryHeadroomMb: true,
     pressureResponse: true
@@ -26807,7 +26868,10 @@ var LocalOverridesSchema = external_exports.strictObject({
   // Every toolchain setting, each one optional (a project usually only switches languages on or pins a version).
   toolchains: external_exports.strictObject({
     ...import_lodash.default.mapValues(import_lodash.default.omit(ToolchainsSchema.shape, "environment"), (shape) => shape.partial()),
-    environment: ToolchainsSchema.shape.environment
+    environment: ToolchainsSchema.shape.environment.refine(
+      (env) => !Object.keys(env).some(reservedEnvName),
+      "names the sandbox sets or that carry logins (AGENT_*, GIT_*, PATH, BASH_ENV, NODE_*, proxies, ANTHROPIC_*, CLAUDE_* ...) cannot be set by a project"
+    )
   }).partial(),
   databases: external_exports.strictObject(import_lodash.default.mapValues(DatabasesSchema.shape, (shape) => shape.partial())).partial(),
   attach: AttachSchema.partial(),
@@ -26877,6 +26941,7 @@ var ProjectSpecSchema = external_exports.strictObject({
   /** Its hooks were staged in C:\AgentLaunch\projects\<name>\hooks. */
   hooks: external_exports.boolean()
 });
+var ShellChoiceSchema = external_exports.enum(["auto", "pwsh", "powershell", "cmd"]);
 var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
   external_exports.strictObject({
     kind: external_exports.literal("session"),
@@ -26886,8 +26951,12 @@ var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
     cwd: Text(),
     project: ProjectSpecSchema.optional(),
     harnessSpec: HarnessSchema.optional(),
+    /** A plain shell instead of an agent (harness is then "shell" and args are ignored). */
+    shell: ShellChoiceSchema.optional(),
     createdAt: TimeSchema
   }),
+  /** End a running session (an agent or a shell) and everything it started. */
+  external_exports.strictObject({ kind: external_exports.literal("close"), id: IdSchema, session: IdSchema, createdAt: TimeSchema }),
   /** Provision a registered project without starting an agent (sandbox start / exec / db from its folder). */
   external_exports.strictObject({ kind: external_exports.literal("project"), id: IdSchema, project: ProjectSpecSchema, createdAt: TimeSchema }),
   external_exports.strictObject({
@@ -26953,6 +27022,8 @@ var SessionStatusSchema = external_exports.object({
   id: IdSchema,
   launchId: Text(64),
   harness: Text(64),
+  /** A plain shell (harness is then the shell: pwsh, powershell or cmd); absent: an agent. */
+  kind: external_exports.enum(["agent", "shell"]).optional(),
   cwd: Text(),
   /** The project it runs in: its hub name, or the launch folder's for the first project. */
   project: Text(64).optional(),

package/dist/runtime/view.js

@@ -5538,6 +5538,8 @@ var FrameType = {
   Resize: 3,
   Restart: 4,
   Ping: 5,
+  /** Ends the program and everything it started, and with it the session. */
+  Close: 6,
   Output: 16,
   Exit: 17,
   Error: 18,
@@ -27088,12 +27090,39 @@ var ResumeSchema = external_exports.strictObject({
 });
 
 // src/core/schema/web.ts
+var REMOTE_ROLES = ["view", "control"];
+var WindowsUserNameSchema = external_exports.string().trim().min(1).max(120).regex(
+  /^(?:[A-Za-z0-9][A-Za-z0-9._ -]{0,62}\\)?[^\\/"[\]:;|=,+*?<>@]{1,64}$/,
+  "a Windows user name (name or DOMAIN\\name)"
+);
+var RemoteUserSchema = external_exports.strictObject({
+  name: WindowsUserNameSchema.describe("The Windows user (name, or DOMAIN\\name)"),
+  role: external_exports.enum(REMOTE_ROLES).describe("view: sees everything, terminals read-only. control: everything but remote access, logins and tokens.")
+});
+var WebLanSchema = external_exports.strictObject({
+  enabled: external_exports.boolean().describe(
+    "(Beta) Devices on your network (a phone): an HTTPS address on this PC for devices you pair with a one-time code (sandbox web pair). Needs a firewall rule (sandbox web lan on asks Windows once). Off: every paired device is signed out."
+  ),
+  port: external_exports.number().int().min(1024).max(65535).describe("HTTPS port for paired devices on your network."),
+  address: external_exports.string().trim().max(15).regex(/^$|^\d{1,3}(\.\d{1,3}){3}$/, "an IPv4 address or empty").describe("This PC's private address to listen on. Empty: the one of its network adapter (never a public one).")
+});
+var WebRemoteSchema = external_exports.strictObject({
+  windowsSignIn: external_exports.boolean().describe(
+    "(Beta) Other Windows users of this PC named in web.remote.users sign in to your web UI (and sandbox remote) with their own Windows account: no password, no link."
+  ),
+  users: external_exports.array(RemoteUserSchema).max(32).describe("Who else may sign in with Windows, and their role (view or control)."),
+  rememberDays: external_exports.number().int().min(1).max(90).describe(
+    "How many days a paired device or a Windows sign-in stays signed in (from when it signed in, not renewed)."
+  ),
+  lan: WebLanSchema
+});
 var WebSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
     "(Beta) The web UI: your sandbox sessions in a browser on this PC (http://127.0.0.1:<port>, this PC only). On: every sandbox start also starts it in the background (it keeps running until sandbox web stop or a restart of the PC). Off: only sandbox web start runs it. Open it signed in with sandbox web open."
   ),
   port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken."),
-  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts.")
+  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts."),
+  remote: WebRemoteSchema.describe("(Beta) Access for other Windows users of this PC and for paired devices.")
 });
 
 // src/core/schema/vpn.ts
@@ -27123,6 +27152,36 @@ var GithubSchema = external_exports.strictObject({
 });
 
 // src/core/schema/config.ts
+var RESERVED_ENV_PREFIX = /^(AGENT_|GIT_|GH_|GITHUB_|NODE_|NPM_CONFIG_(USERCONFIG|GLOBALCONFIG|PREFIX|SCRIPT_SHELL)|SSL_|CLAUDE|ANTHROPIC_|OPENAI_|CODEX_|GEMINI_|GOOGLE_|COPILOT_|AWS_|AZURE_)/i;
+var RESERVED_ENV_SUFFIX = /(_PROXY|_BASE_URL|_ENDPOINT|_CA_BUNDLE|_CA_CERTS)$/i;
+var RESERVED_ENV_NAMES = new Set(
+  [
+    "PATH",
+    "PATHEXT",
+    "BASH_ENV",
+    "ENV",
+    "COMSPEC",
+    "PSMODULEPATH",
+    "PYTHONPATH",
+    "PYTHONSTARTUP",
+    "PERL5OPT",
+    "RUBYOPT",
+    "JAVA_TOOL_OPTIONS",
+    "LD_PRELOAD",
+    "SYSTEMROOT",
+    "WINDIR",
+    "HOME",
+    "USERPROFILE",
+    "APPDATA",
+    "LOCALAPPDATA",
+    "PROGRAMDATA",
+    "TEMP",
+    "TMP"
+  ].map((n) => n.toUpperCase())
+);
+function reservedEnvName(name) {
+  return RESERVED_ENV_PREFIX.test(name) || RESERVED_ENV_SUFFIX.test(name) || RESERVED_ENV_NAMES.has(name.toUpperCase());
+}
 var ConfigSchema = external_exports.strictObject({
   $schema: SchemaRefSchema.optional(),
   defaultHarness: NameSchema.describe("Agent started by `sandbox launch` (sandbox claude always runs claude)."),
@@ -27189,10 +27248,14 @@ var LocalOverridesSchema = external_exports.strictObject({
   scripts: StringsSchema.describe(
     "Scripts (.ps1 / .mjs / .cmd, relative to this file) run inside the sandbox before the agent."
   ),
-  // This PC's resources are yours to share: CPU and paging file (this PC's disk) are not a project's to set.
+  // This PC's resources are yours to share: CPU, paging file (this PC's disk) and the RAM kept for this PC are not a
+  // project's to set.
   sandbox: SandboxSchema.omit({
     cpuLimit: true,
     pageFileMb: true,
+    reserveHostMb: true,
+    maxMemoryPercent: true,
+    maxMemoryMb: true,
     engine: true,
     agentMemoryHeadroomMb: true,
     pressureResponse: true
@@ -27206,7 +27269,10 @@ var LocalOverridesSchema = external_exports.strictObject({
   // Every toolchain setting, each one optional (a project usually only switches languages on or pins a version).
   toolchains: external_exports.strictObject({
     ...import_lodash.default.mapValues(import_lodash.default.omit(ToolchainsSchema.shape, "environment"), (shape) => shape.partial()),
-    environment: ToolchainsSchema.shape.environment
+    environment: ToolchainsSchema.shape.environment.refine(
+      (env) => !Object.keys(env).some(reservedEnvName),
+      "names the sandbox sets or that carry logins (AGENT_*, GIT_*, PATH, BASH_ENV, NODE_*, proxies, ANTHROPIC_*, CLAUDE_* ...) cannot be set by a project"
+    )
   }).partial(),
   databases: external_exports.strictObject(import_lodash.default.mapValues(DatabasesSchema.shape, (shape) => shape.partial())).partial(),
   attach: AttachSchema.partial(),
@@ -27276,6 +27342,7 @@ var ProjectSpecSchema = external_exports.strictObject({
   /** Its hooks were staged in C:\AgentLaunch\projects\<name>\hooks. */
   hooks: external_exports.boolean()
 });
+var ShellChoiceSchema = external_exports.enum(["auto", "pwsh", "powershell", "cmd"]);
 var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
   external_exports.strictObject({
     kind: external_exports.literal("session"),
@@ -27285,8 +27352,12 @@ var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
     cwd: Text(),
     project: ProjectSpecSchema.optional(),
     harnessSpec: HarnessSchema.optional(),
+    /** A plain shell instead of an agent (harness is then "shell" and args are ignored). */
+    shell: ShellChoiceSchema.optional(),
     createdAt: TimeSchema
   }),
+  /** End a running session (an agent or a shell) and everything it started. */
+  external_exports.strictObject({ kind: external_exports.literal("close"), id: IdSchema, session: IdSchema, createdAt: TimeSchema }),
   /** Provision a registered project without starting an agent (sandbox start / exec / db from its folder). */
   external_exports.strictObject({ kind: external_exports.literal("project"), id: IdSchema, project: ProjectSpecSchema, createdAt: TimeSchema }),
   external_exports.strictObject({
@@ -27352,6 +27423,8 @@ var SessionStatusSchema = external_exports.object({
   id: IdSchema,
   launchId: Text(64),
   harness: Text(64),
+  /** A plain shell (harness is then the shell: pwsh, powershell or cmd); absent: an agent. */
+  kind: external_exports.enum(["agent", "shell"]).optional(),
   cwd: Text(),
   /** The project it runs in: its hub name, or the launch folder's for the first project. */
   project: Text(64).optional(),

package/dist/selftest/app.test.js

@@ -5,7 +5,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { z } from 'zod';
-import { agentsPage, agentsView } from '../app/features/agents/index.js';
+import { agentNameProblem, agentsPage, agentsView } from '../app/features/agents/index.js';
 import { DEFINITIONS, NAV, navSections, navViews, QUERIES, VIEWS, viewById } from '../app/features/defs.js';
 import { accountsPage, agentPage, listAccounts } from '../app/features/accounts/index.js';
 import { addProject, projectRoots, projectsPage } from '../app/features/projects/index.js';
@@ -15,13 +15,13 @@ import { insideSandbox, isSandboxRunning } from '../host/sandbox/index.js';
 import { CRASH, listLogs, logsPage, tailLog } from '../app/features/logs/index.js';
 import { DEFAULTS } from '../core/config/index.js';
 import { sandboxPage } from '../app/features/sandbox/index.js';
-import { sessionsPage } from '../app/features/sessions/index.js';
+import { closeSession, sessionsPage, startShell, } from '../app/features/sessions/index.js';
 import { APP_GROUPS, appsPage, listApps } from '../app/features/apps/index.js';
 import { keepShownSecrets, settingsPage } from '../app/features/settings/index.js';
 import { checkEngine, checkText, enginePage } from '../app/features/engine/index.js';
 import { runUpdate, updatesPage } from '../app/features/updates/index.js';
 import { MenuOperations } from '../cli/menu/io-menu.js';
-import { ago, bytesText, Cancelled, ClientMessageSchema, defineOperation, exemption, fakeIO, fieldOf, fieldProblem, FieldSchema, fieldsOf, fromWireError, humanize, implementer, invoke, pageActions, pageHasContent, ServerMessageSchema, SURFACE_NAMES, toWireError, valueText, } from '../app/kernel/index.js';
+import { accessNeeded, ago, allows, bytesText, Cancelled, ClientMessageSchema, defineOperation, exemption, fakeIO, fieldOf, fieldProblem, FieldSchema, fieldsOf, fromWireError, humanize, implementer, invoke, pageActions, pageHasContent, ServerMessageSchema, SURFACE_NAMES, toWireError, valueText, OWNER, } from '../app/kernel/index.js';
 import { createRpcHost, IMPLEMENTATIONS, readQuery, runDefinition } from '../app/registry.js';
 import { webPage } from '../app/features/web/index.js';
 import { parseCli } from '../cli/args.js';
@@ -326,11 +326,43 @@ export const appSuite = {
         const menu = menuView(sessions);
         const chosen = menu.resolve({ kind: 'pick', value: 'new' });
         t.check(menu.items.length === 2 &&
-            menu.actions.map((a) => a.key).join() === 'n,r,o,l' &&
+            menu.actions.map((a) => a.key).join() === 'n,s,r,o,x,l' &&
             menu.enterLabel(undefined, 'new') === 'attach' &&
             chosen?.kind === 'action' &&
             chosen.action.kind === 'link' &&
-            menu.resolve({ kind: 'action', key: 'l', value: undefined })?.kind === 'refresh', 'sessions in the menu: rows, the n/r/o/l keys, Enter attaches');
+            menu.resolve({ kind: 'action', key: 'l', value: undefined })?.kind === 'refresh', 'sessions in the menu: rows, the n/s/r/o/x/l keys, Enter attaches');
+        t.section('plain shell sessions');
+        const shellRow = { ...running('sh1', true), harness: 'pwsh', kind: 'shell' };
+        const shellPage = sessionsPage({ ...list, sessions: [shellRow] });
+        const shellItem = shellPage.sections[0].items?.[0];
+        const closeAction = shellItem?.actions?.[0];
+        t.check(shellItem?.label === 'pwsh (shell)  api' &&
+            closeAction?.kind === 'operation' &&
+            closeAction.op === 'sessions.close' &&
+            closeAction.key === 'x' &&
+            closeAction.danger === true &&
+            JSON.stringify(closeAction.input) === '{"session":"sh1"}', 'a shell is listed by its name, marked as a shell, and can be closed (x)', JSON.stringify(shellItem));
+        const newShell = shellPage.actions?.find((a) => a.kind === 'operation' && a.op === 'sessions.shell');
+        t.check(newShell?.kind === 'operation' && newShell.key === 's' && JSON.stringify(newShell.input) === '{"shell":"auto"}', 'the sessions page offers New shell (s) next to New session');
+        t.check(!sessionsPage({ ...list, sandboxRunning: false, sessions: [] }).actions?.some((a) => a.kind === 'operation' && a.op === 'sessions.shell'), 'no New shell without a running sandbox');
+        t.equal(startShell.opens?.({ session: 'sh1', shell: 'pwsh', message: '' }), { kind: 'terminal', session: 'sh1' }, 'a new shell opens its terminal on every surface');
+        const controlCaller = { kind: 'windows', user: 'bob', role: 'control' };
+        const viewCaller = { kind: 'device', id: 'd', name: 'phone', role: 'view' };
+        t.check(accessNeeded(startShell, {}) === 'owner' &&
+            !allows(controlCaller, accessNeeded(startShell, {})) &&
+            allows(OWNER, accessNeeded(startShell, {})) &&
+            accessNeeded(closeSession, { session: 'x' }) === 'control' &&
+            allows(controlCaller, accessNeeded(closeSession, { session: 'x' })) &&
+            !allows(viewCaller, accessNeeded(closeSession, { session: 'x' })), 'only the owner opens a shell; control may close a session, view may not');
+        t.equal([
+            cliInput(definitionFor('shell', []), parseCli(['shell', 'api', '--shell', 'cmd'])),
+            cliInput(definitionFor('close', []), parseCli(['close', 'sh1'])),
+        ], [{ project: 'api', shell: 'cmd' }, { session: 'sh1' }], 'sandbox shell [project] --shell and sandbox close <id> become the input');
+        t.check(agentNameProblem('pwsh', []) !== true && agentNameProblem('Shell', []) !== true, 'an agent cannot be named after a shell or the shell command');
+        if (insideSandbox())
+            await t.throws(() => runDefinition('sessions.shell', {}, {}, fakeIO([]).io), 'has nothing to control', 'sandbox shell refuses inside the sandbox');
+        else
+            t.skip('sandbox shell refuses inside the sandbox (this PC is not a sandbox)');
         const menuStatus = menuView(statusPage, { category: 'status', prefix: 'status:' });
         t.check(menuStatus.items.every((i) => i.category === 'status' && i.value.startsWith('status:')) &&
             menuStatus.actions.some((a) => a.key === 'x' && a.label === 'stop'), 'a view inside one category of a page: rows in it, prefixed, with the keys of its actions');
@@ -963,6 +995,9 @@ export const appSuite = {
         t.check(definitionFor('web', ['open'])?.id === 'web.open' &&
             definitionFor('web', ['status'])?.id === 'web.status' &&
             definitionFor('web', []) === undefined &&
-            commandSpec('web')?.args[0]?.choices?.join() === 'start,stop,status,open', 'the web actions are actions of the web command; sandbox web with no action is not one of them');
+            commandSpec('web')?.args[0]?.choices?.join() ===
+                'start,stop,status,open,allow-device,revoke,revoke-all,lan-on,lan-off,devices' &&
+            definitionFor('web', ['allow-device'])?.id === 'access.allowDevice' &&
+            definitionFor('web', ['revoke', '0123456789abcdef'])?.id === 'access.revoke', 'the web actions (and the remote access ones) are actions of the web command; sandbox web alone is not one');
     },
 };

package/dist/selftest/channel.test.js

@@ -35,6 +35,22 @@ export const channelSuite = {
         t.check(validSession(goodSession) &&
             !validSession({ ...goodSession, attach: { ...goodSession.attach, port: 70000 } }) &&
             !validSession({ ...goodSession, phase: 'pwned' }), 'session status: a well-formed one passes; an impossible port or unknown phase is rejected');
+        const shellRequest = {
+            kind: 'session',
+            id: 'r1',
+            harness: 'shell',
+            args: [],
+            cwd: 'C:\\Workspace',
+            shell: 'pwsh',
+            createdAt: 'x',
+        };
+        t.check(validRequest(shellRequest) &&
+            validRequest({ ...shellRequest, shell: 'auto' }) &&
+            !validRequest({ ...shellRequest, shell: 'bash -c evil' }) &&
+            validRequest({ kind: 'close', id: 'c1', session: 's1', createdAt: 'x' }) &&
+            !validRequest({ kind: 'close', id: 'c1', session: '..\\s1', createdAt: 'x' }) &&
+            validSession({ ...goodSession, harness: 'pwsh', kind: 'shell' }) &&
+            !validSession({ ...goodSession, kind: 'daemon' }), 'shells: a session request names one of the known shells; close names a safe session id; a status says shell');
         t.section('boot progress');
         const goodStatus = {
             launchId: 'l1',

package/dist/selftest/cmdline.test.js

@@ -4,6 +4,7 @@ import { spawnSync } from 'node:child_process';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { isWin } from '../core/util/index.js';
+import { commandLine, shellLaunch } from '../guest/sessions/cmdline.js';
 import { runNode } from './support/fixtures.js';
 // Odd quote counts flip cmd's quote state for every later argument: those come after them on purpose.
 const TRICKY_ARGUMENTS = [
@@ -71,5 +72,20 @@ export const cmdlineSuite = {
         }
         else
             t.skip('end-to-end cmd.exe quoting run (not Windows, or the temp path has spaces)');
+        t.section('plain shell sessions');
+        const paths = { pwsh: 'C:/T/pwsh/pwsh.exe', powershell: 'C:/W/powershell.exe', cmd: 'C:/W/cmd.exe' };
+        const noPwsh = { ...paths, pwsh: null };
+        t.equal([
+            shellLaunch('auto', paths),
+            shellLaunch('auto', noPwsh),
+            shellLaunch('powershell', paths),
+            shellLaunch('cmd', paths),
+        ].map((l) => l.name + ' ' + commandLine(l.file, l.args)), [
+            'pwsh C:/T/pwsh/pwsh.exe -NoLogo',
+            'powershell C:/W/powershell.exe -NoLogo',
+            'powershell C:/W/powershell.exe -NoLogo',
+            'cmd C:/W/cmd.exe',
+        ], 'a shell runs by its absolute path: auto is pwsh when present, else Windows PowerShell; cmd takes no arguments');
+        await t.throws(() => shellLaunch('pwsh', noPwsh), 'PowerShell 7 is not installed', 'asking for pwsh where it is missing says so');
     },
 };

package/dist/selftest/git-access.test.js

@@ -48,6 +48,14 @@ export const gitAccessSuite = {
             '--git-dir=x status',
             'clean -fd',
             'apply p.diff',
+            // reading commands with options that run a program or write a file
+            'grep -Ocalc.exe x',
+            'grep --open-files-in-pager=calc.exe x',
+            'ls-remote --upload-pack=calc.exe origin',
+            'ls-remote -ucalc.exe origin',
+            'diff --output=C:/x.txt',
+            'log --output C:/x.txt',
+            'diff --ext-diff',
         ];
         t.equal(writing.filter((command) => allowed(command.split(' '))), [], 'readonly: anything that writes (or overrides config) is refused');
         t.section('none and full');

package/dist/selftest/hostile-input.test.js

@@ -12,7 +12,7 @@ import { writeJsonAtomic } from '../shared/io/index.js';
 export const hostileInputSuite = {
     name: 'hostile-input',
     title: 'file names, deletes, printed text, mappings and state files from an untrusted sandbox',
-    run: async (t) => {
+    run: async (t, f) => {
         t.section('file names');
         const unsafe = ['CON.jsonl', 'nul', 'aux.json', 'COM1.txt', 'a:b', 'x.jsonl.', 'x ', '..', 'a\\b', 'LPT3'];
         t.equal(unsafe.filter(isSafeFileName), [], 'device names, streams and trailing dots are not valid names to copy into this PC');
@@ -52,5 +52,16 @@ export const hostileInputSuite = {
         t.equal(fs.readdirSync(path.dirname(atomicFile)).length, 1, '... with no temp files left behind');
         await t.throws(() => assertCmdSafePath('C:\\a\\%TEMP%\\agent.wsb'), 'cannot be started safely', 'a launch path with %VAR% (which cmd.exe would expand) is refused');
         await t.throws(() => assertCmdSafePath('C:\\a"&calc&"\\agent.wsb'), 'cannot be started safely', 'a launch path with quotes and & is refused');
+        t.section('repo files read on this PC (security review 2026-10)');
+        const repoDir = t.dir('hostile-versions');
+        fs.writeFileSync(path.join(repoDir, '.nvmrc'), '\u001b]52;c;ZXZpbA==\u0007\u001b[2J20\n');
+        fs.writeFileSync(path.join(repoDir, '.python-version'), '3.12.1\n');
+        const versionsRun = await f.run({ cwd: repoDir });
+        t.check(!versionsRun.versions.node.spec.includes('\u001b') &&
+            versionsRun.versions.node.source !== '.nvmrc' &&
+            versionsRun.versions.python.spec === '3.12.1', 'a version file holding escape codes is ignored (it would reach the launch table); a plain one is used', JSON.stringify(versionsRun.versions));
+        fs.writeFileSync(path.join(repoDir, '.sandbox-config.json'), '{"readOnly": true}' + ' '.repeat(1100 * 1024));
+        await t.throws(() => f.run({ cwd: repoDir, trustConfig: true }), 'over 1 MB', 'a .sandbox-config.json over 1 MB is refused before it is parsed');
+        fs.rmSync(path.join(repoDir, '.sandbox-config.json'));
     },
 };

package/dist/selftest/index.js

@@ -57,6 +57,7 @@ import { syncSuite } from './sync.test.js';
 import { testGuardSuite } from './test-guard.test.js';
 import { toolchainsSuite } from './toolchains.test.js';
 import { webSuite } from './web.test.js';
+import { remoteSuite } from './remote.test.js';
 import { workspaceSuite } from './workspace.test.js';
 import { workspaceViewSuite } from './workspace-view.test.js';
 import { liveNetworkSuite } from './live-network.test.js';
@@ -107,6 +108,7 @@ export const SUITES = [
     secretsSuite,
     hostileInputSuite,
     webSuite,
+    remoteSuite,
     testGuardSuite,
     // pure helpers and the command line
     layoutSuite,