windows-development-sandbox 1.12.0 → 1.13.0

package/dist/cli/menu/views.js

@@ -18,6 +18,7 @@ import { updatesView } from '../../app/features/updates/index.js';
 import { webView } from '../../app/features/web/index.js';
 import { vpnView } from '../../app/features/vpn/index.js';
 import { githubView } from '../../app/features/github/index.js';
+import { accessView } from '../../app/features/access/index.js';
 export const MENU_VIEWS = [
     { view: agentsView, section: 'Agents' },
     { view: sessionsView, section: 'Sessions' },
@@ -34,6 +35,7 @@ export const MENU_VIEWS = [
     { view: updatesView, section: 'Maintenance' },
     { view: engineView, section: 'Maintenance' },
     { view: webView, section: 'Maintenance' },
+    { view: accessView, section: 'Maintenance' },
     // The Settings page draws the VPN row itself (its login is staged with the settings); the view lists its operations.
     { view: vpnView, section: 'Settings' },
     // The same for the GitHub token row.

package/dist/cli/operations/handler.js

@@ -1,6 +1,7 @@
 // Runs a definition as a command: its input from the command line, its questions on the terminal, and its output as
 // --json, as the definition's one-line text, or as the page of the view that shows it. A declined question prints
-// "Nothing changed." and exits 1, as the commands always have.
+// "Nothing changed." and exits 1, as the commands always have. An operation that opens a session's terminal (a new
+// shell) attaches this terminal to it afterwards.
 import { VIEWS } from '../../app/features/defs.js';
 import { runDefinition } from '../../app/registry.js';
 import { Cancelled } from '../../app/kernel/index.js';
@@ -33,6 +34,16 @@ function printOutput(def, output, input) {
     else
         console.log(JSON.stringify(output, null, 2));
 }
+/** Attaches this terminal to the session an operation opened (in a script: says how to). */
+async function attachOpened(ctx, session) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        nextStep('sandbox attach ' + session);
+        return 0;
+    }
+    // Loaded when needed: attach reaches the launch commands, which reach this handler (no import cycle).
+    const { attach } = await import('../commands/sessions/attach.js');
+    return attach({ ...ctx, options: { ...ctx.options, positionals: [session] } });
+}
 /** The command for a definition. */
 export function definitionHandler(def) {
     return async (ctx) => {
@@ -47,6 +58,9 @@ export function definitionHandler(def) {
                 return code;
             }
             printOutput(def, output, def.input.parse(input));
+            const opened = def.kind === 'operation' ? def.opens?.(output) : undefined;
+            if (opened?.kind === 'terminal')
+                return attachOpened(ctx, opened.session);
             return code;
         }
         catch (e) {

package/dist/cli/services/remote-client.d.ts

@@ -0,0 +1,16 @@
+import { type OperationIO } from '../../app/kernel/index.js';
+export declare class RemoteClient {
+    private readonly socket;
+    private readonly pending;
+    private next;
+    private constructor();
+    /** Trades the one-time token for a sign-in cookie, then opens the RPC socket. */
+    static connect(port: number, token: string): Promise<RemoteClient>;
+    private receive;
+    private send;
+    /** Runs a definition on the owner's side (a query or an operation) and returns its output. */
+    run(id: string, input: unknown, io: OperationIO): Promise<unknown>;
+    close(): void;
+}
+/** Connects, or fails with the reason and what to do. */
+export declare function remoteClient(port: number, token: string): Promise<RemoteClient>;

package/dist/cli/services/remote-client.js

@@ -0,0 +1,141 @@
+// `sandbox remote`'s line to the owner's web UI (docs/design/remote-access.md): signs in with the one-time token of
+// Windows sign-in, then runs the shared core's queries and operations over the RPC socket, as the browser does. What
+// the owner's server sends is checked against the kernel's schemas (anything else is dropped) and every text is shown
+// through safeText by the menu. The owner's server checks the role of every call.
+import http from 'node:http';
+import { WebSocket } from 'ws';
+import { fromWireError, ServerMessageSchema, } from '../../app/kernel/index.js';
+import { fail } from '../../core/util/index.js';
+import { CSRF_HEADER, CSRF_VALUE } from '../../shared/web/index.js';
+const CONNECT_TIMEOUT_MS = 10_000;
+/** Asks an OperationIO a question that came over the socket. */
+function askIO(io, q) {
+    switch (q.kind) {
+        case 'confirm':
+            return io.confirm(q);
+        case 'choose':
+            return io.choose(q);
+        case 'checklist':
+            return io.checklist(q);
+        case 'text':
+            return io.text(q);
+        case 'secret':
+            return io.secret(q);
+        case 'path':
+            return io.path(q);
+    }
+}
+export class RemoteClient {
+    socket;
+    pending = new Map();
+    next = 1;
+    constructor(socket) {
+        this.socket = socket;
+        socket.on('message', (data, binary) => {
+            if (binary)
+                return;
+            let value;
+            try {
+                value = JSON.parse(data.toString());
+            }
+            catch {
+                return;
+            }
+            const parsed = ServerMessageSchema.safeParse(value);
+            if (parsed.success)
+                this.receive(parsed.data);
+        });
+        socket.on('close', () => {
+            for (const p of this.pending.values())
+                p.reject(new Error('The connection to the web UI closed.'));
+            this.pending.clear();
+        });
+    }
+    /** Trades the one-time token for a sign-in cookie, then opens the RPC socket. */
+    static async connect(port, token) {
+        const origin = 'http://127.0.0.1:' + port;
+        const cookie = await new Promise((resolve, reject) => {
+            const body = JSON.stringify({ token });
+            const req = http.request({
+                host: '127.0.0.1',
+                port,
+                method: 'POST',
+                path: '/api/login/once',
+                timeout: CONNECT_TIMEOUT_MS,
+                headers: {
+                    Origin: origin,
+                    [CSRF_HEADER]: CSRF_VALUE,
+                    'Content-Type': 'application/json',
+                    'Content-Length': Buffer.byteLength(body),
+                },
+            }, (res) => {
+                res.resume();
+                const value = (res.headers['set-cookie'] ?? [])[0]?.split(';')[0];
+                if (res.statusCode === 200 && value)
+                    resolve(value);
+                else
+                    reject(new Error('The web UI did not sign you in (' + res.statusCode + ').'));
+            });
+            req.on('timeout', () => req.destroy(new Error('The web UI did not answer.')));
+            req.on('error', reject);
+            req.end(body);
+        });
+        const socket = new WebSocket('ws://127.0.0.1:' + port + '/api/rpc', {
+            headers: { Cookie: cookie, Origin: origin },
+            handshakeTimeout: CONNECT_TIMEOUT_MS,
+        });
+        await new Promise((resolve, reject) => {
+            socket.once('open', () => resolve());
+            socket.once('error', reject);
+            socket.once('unexpected-response', (_req, res) => reject(new Error('Refused (' + res.statusCode + ').')));
+        });
+        return new RemoteClient(socket);
+    }
+    receive(m) {
+        const p = this.pending.get(m.id);
+        if (!p)
+            return;
+        switch (m.t) {
+            case 'progress':
+                return p.io.progress(m.text);
+            case 'log':
+                return p.io.log(m.text, m.tone);
+            case 'ask':
+                void askIO(p.io, m.question).then((value) => this.send({ t: 'answer', id: m.id, value }), () => this.send({ t: 'answer', id: m.id, value: m.question.kind === 'confirm' ? false : undefined }));
+                return;
+            case 'result':
+            case 'data':
+                this.pending.delete(m.id);
+                return p.resolve(m.output);
+            case 'error':
+                this.pending.delete(m.id);
+                return p.reject(fromWireError(m.error));
+        }
+    }
+    send(message) {
+        if (this.socket.readyState === WebSocket.OPEN)
+            this.socket.send(JSON.stringify(message));
+    }
+    /** Runs a definition on the owner's side (a query or an operation) and returns its output. */
+    run(id, input, io) {
+        if (this.socket.readyState !== WebSocket.OPEN)
+            return Promise.reject(new Error('Not connected to the web UI.'));
+        const callId = 'c' + this.next++;
+        return new Promise((resolve, reject) => {
+            this.pending.set(callId, { io, resolve, reject });
+            this.send({ t: 'call', id: callId, op: id, input: input ?? {} });
+        });
+    }
+    close() {
+        this.socket.close(1000);
+    }
+}
+/** Connects, or fails with the reason and what to do. */
+export async function remoteClient(port, token) {
+    try {
+        return await RemoteClient.connect(port, token);
+    }
+    catch (e) {
+        return fail('Could not reach the web UI on port ' + port + ': ' + (e instanceof Error ? e.message : String(e)), 'Ask its owner to start it (sandbox web start), then try again.');
+    }
+}

package/dist/cli/services/sessions-service.d.ts

@@ -1,4 +1,5 @@
 import type { SessionStatus } from '../../core/types.js';
+import type { ShellChoice } from '../../shared/channel/index.js';
 import type { RegistryEntry } from '../../host/projects/index.js';
 import type { Viewers } from '../../shared/pty/index.js';
 import type { Context } from '../commands/context.js';
@@ -38,5 +39,9 @@ export declare class SessionsService {
     restartScope(all: boolean): RestartScope;
     /** Restarts the agents (one kind, or all) of a project or of every session; returns the sandbox's message. */
     restart(harness: string | null, scope?: string): Promise<string>;
+    /** Starts a plain shell in a folder of the sandbox and waits until it runs. */
+    openShell(shell: ShellChoice, guestDir: string): Promise<SessionStatus>;
+    /** Ends a running session and everything it started; returns the sandbox's message (throws when it refused). */
+    close(sessionId: string): Promise<string>;
     private projects;
 }

package/dist/cli/services/sessions-service.js

@@ -1,10 +1,14 @@
-// Agent sessions of the running sandbox: list, pick one to attach to, restart. Returns data, never prints.
+// Sessions of the running sandbox (agents and plain shells): list, pick one to attach to, restart the agents, open a
+// shell, close one. Returns data, never prints.
 import _ from 'lodash';
+import { fail } from '../../core/util/index.js';
 import { SandboxChannel, sessionsFirstIn, sessionViewers } from '../../host/channel/index.js';
 import { isSandboxRunning } from '../../host/sandbox/index.js';
 import { RunDir } from '../../shared/channel/index.js';
 import { isWithin, projectForGuestDir } from '../../shared/paths/index.js';
 import { hereDir, locateHere, registryOf } from '../commands/projects/here.js';
+/** A shell needs no install: the longest it may take is its project's first setup. */
+const SHELL_START_MS = 15 * 60 * 1000;
 export function viewerText(v) {
     return v === undefined
         ? '-'
@@ -75,6 +79,18 @@ export class SessionsService {
     async restart(harness, scope) {
         return (await this.channel.restart(harness, scope)).message;
     }
+    /** Starts a plain shell in a folder of the sandbox and waits until it runs. */
+    openShell(shell, guestDir) {
+        const channel = this.channel;
+        return channel.waitForSession(channel.requestShell(shell, guestDir), SHELL_START_MS, () => undefined);
+    }
+    /** Ends a running session and everything it started; returns the sandbox's message (throws when it refused). */
+    async close(sessionId) {
+        const answer = await this.channel.closeSession(sessionId);
+        if (!answer.ok)
+            fail(answer.message);
+        return answer.message;
+    }
     projects() {
         return registryOf(this.ctx).read()?.projects ?? [];
     }

package/dist/core/config/defaults.js

@@ -95,7 +95,17 @@ export const DEFAULTS = {
         sqlserver: { enabled: 'auto' },
     },
     attach: { enabled: true, reuseSession: true, auto: false, autoHide: false, confirmCtrlC: true },
-    web: { enabled: false, port: 47800, openOnLaunch: false },
+    web: {
+        enabled: false,
+        port: 47800,
+        openOnLaunch: false,
+        remote: {
+            windowsSignIn: false,
+            users: [],
+            rememberDays: 30,
+            lan: { enabled: false, port: 47801, address: '' },
+        },
+    },
     agentCommands: { enabled: false, agents: 'auto' },
     secrets: { strip: true, allow: [], patterns: [], warnFiles: true },
     personalization: { enabled: true },

package/dist/core/local-config/file.js

@@ -1,13 +1,27 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
-import { fileExists, parseJsonc } from '../util/index.js';
+import { fail, fileExists, parseJsonc } from '../util/index.js';
 export const LOCAL_CONFIG_NAME = '.sandbox-config.json';
+const MAX_LOCAL_CONFIG_BYTES = 1024 * 1024;
 export function readLocalConfig(dir) {
     const file = path.join(dir, LOCAL_CONFIG_NAME);
     if (!fileExists(file))
         return null;
-    const raw = fs.readFileSync(file);
+    // One handle for the size check and the read (the hash covers exactly the bytes parsed); a repo's file over 1 MB is
+    // refused, not loaded.
+    const fd = fs.openSync(file, 'r');
+    let raw;
+    try {
+        const size = fs.fstatSync(fd).size;
+        if (size > MAX_LOCAL_CONFIG_BYTES)
+            fail(file + ' is over 1 MB, so it is not read.', 'Make it smaller, or start with --no-local-config.');
+        raw = Buffer.alloc(size);
+        fs.readSync(fd, raw, 0, size, 0);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
     return {
         path: file,
         hash: crypto.createHash('sha256').update(raw).digest('hex'),

package/dist/core/local-config/overrides.js

@@ -14,6 +14,11 @@ export function normalizeOverrides(data, dir, source) {
     const missing = scripts?.filter((s) => !fileExists(s)) ?? [];
     if (missing.length)
         fail(source + ' is not valid:\n  - scripts: file not found: ' + missing.join(', '));
+    // A repo ships this file: a script path outside the project (%USERPROFILE%\.ssh\id_ed25519, ..\..) would copy that
+    // file of this PC into the launch folder, which the sandbox reads.
+    const outside = scripts?.filter((s) => !insideProject(dir, s)) ?? [];
+    if (outside.length)
+        fail(source + ' is not valid:\n  - scripts: only files inside the project can be used: ' + outside.join(', '));
     const mappings = overrides.mappings?.map((m) => ({ ...m, host: expandPath(m.host, dir) }));
     return { ...overrides, scripts, mappings };
 }
@@ -62,6 +67,8 @@ export const OFF_IS_SAFER = [
     'claudeProfile.enabled',
     'claudeProfile.syncHistory',
     'claudeProfile.syncClaudeMem',
+    // Maps this PC's Node, Git, nvm and agent folders into the sandbox.
+    'provisioning.copyFromHost',
 ];
 export const GIT_STRICTNESS = { full: 0, readonly: 1, none: 2 };
 export const NEVER_LOOSER = [...ON_IS_SAFER, ...OFF_IS_SAFER, 'provisioning.git.access'];

package/dist/core/run/versions.js

@@ -1,17 +1,18 @@
-import fs from 'node:fs';
 import path from 'node:path';
 import { z } from 'zod';
-import { fileExists } from '../util/index.js';
+import { fileExists, readSmallFile } from '../util/index.js';
+/** A version spec as version files hold it (20, lts/iron, 3.12.1, v18.*): anything else is ignored, never printed. */
+const VERSION_SPEC = /^[\w./*~^-]{1,64}$/;
 const firstLine = (file) => {
-    if (!fileExists(file))
+    const text = fileExists(file) ? readSmallFile(file, 64 * 1024) : null;
+    if (text === null)
         return null;
-    const line = fs
-        .readFileSync(file, 'utf8')
+    const line = text
         .replace(/^\uFEFF/, '')
         .split(/\r?\n/)
         .map((l) => l.replace(/#.*$/, '').trim())
         .find((l) => l !== '');
-    return line ?? null;
+    return line !== undefined && VERSION_SPEC.test(line) ? line : null;
 };
 const VOLTA_PIN = 'package.json volta.node';
 const PackageJsonSchema = z.object({
@@ -32,8 +33,8 @@ export function voltaNode(workspace) {
     if (!fileExists(file))
         return null;
     try {
-        return (PackageJsonSchema.safeParse(JSON.parse(fs.readFileSync(file, 'utf8').replace(/^\uFEFF/, ''))).data?.volta?.node ??
-            null);
+        return (PackageJsonSchema.safeParse(JSON.parse((readSmallFile(file, 4 * 1024 * 1024) ?? '').replace(/^\uFEFF/, ''))).data
+            ?.volta?.node ?? null);
     }
     catch {
         return null;

package/dist/core/schema/config.d.ts

@@ -1,4 +1,10 @@
 import { z } from 'zod';
+/**
+ * An environment variable a repo's .sandbox-config.json may not set: the git guard's and the sandbox's own (setting
+ * AGENT_GIT_ACCESS or GIT_CONFIG_COUNT would undo provisioning.git.access), interpreter hooks (NODE_OPTIONS reaches the
+ * git guard's node), proxies and API endpoints (ANTHROPIC_BASE_URL would send your API key to the repo's server).
+ */
+export declare function reservedEnvName(name: string): boolean;
 export declare const ConfigSchema: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
     defaultHarness: z.ZodString;
@@ -253,6 +259,22 @@ export declare const ConfigSchema: z.ZodObject<{
         enabled: z.ZodBoolean;
         port: z.ZodNumber;
         openOnLaunch: z.ZodBoolean;
+        remote: z.ZodObject<{
+            windowsSignIn: z.ZodBoolean;
+            users: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                role: z.ZodEnum<{
+                    view: "view";
+                    control: "control";
+                }>;
+            }, z.core.$strict>>;
+            rememberDays: z.ZodNumber;
+            lan: z.ZodObject<{
+                enabled: z.ZodBoolean;
+                port: z.ZodNumber;
+                address: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
     }, z.core.$strict>;
     agentCommands: z.ZodObject<{
         enabled: z.ZodBoolean;
@@ -367,9 +389,6 @@ export declare const LocalOverridesSchema: z.ZodObject<{
     scripts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     sandbox: z.ZodOptional<z.ZodObject<{
         memoryMb: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodNumber]>>;
-        maxMemoryMb: z.ZodOptional<z.ZodNumber>;
-        maxMemoryPercent: z.ZodOptional<z.ZodNumber>;
-        reserveHostMb: z.ZodOptional<z.ZodNumber>;
         vGpu: z.ZodOptional<z.ZodBoolean>;
         networking: z.ZodOptional<z.ZodBoolean>;
         clipboard: z.ZodOptional<z.ZodBoolean>;

package/dist/core/schema/config.js

@@ -14,6 +14,39 @@ import { ResumeSchema } from './resume.js';
 import { WebSchema } from './web.js';
 import { VpnSchema } from './vpn.js';
 import { GithubSchema } from './github.js';
+const RESERVED_ENV_PREFIX = /^(AGENT_|GIT_|GH_|GITHUB_|NODE_|NPM_CONFIG_(USERCONFIG|GLOBALCONFIG|PREFIX|SCRIPT_SHELL)|SSL_|CLAUDE|ANTHROPIC_|OPENAI_|CODEX_|GEMINI_|GOOGLE_|COPILOT_|AWS_|AZURE_)/i;
+const RESERVED_ENV_SUFFIX = /(_PROXY|_BASE_URL|_ENDPOINT|_CA_BUNDLE|_CA_CERTS)$/i;
+const RESERVED_ENV_NAMES = new Set([
+    'PATH',
+    'PATHEXT',
+    'BASH_ENV',
+    'ENV',
+    'COMSPEC',
+    'PSMODULEPATH',
+    'PYTHONPATH',
+    'PYTHONSTARTUP',
+    'PERL5OPT',
+    'RUBYOPT',
+    'JAVA_TOOL_OPTIONS',
+    'LD_PRELOAD',
+    'SYSTEMROOT',
+    'WINDIR',
+    'HOME',
+    'USERPROFILE',
+    'APPDATA',
+    'LOCALAPPDATA',
+    'PROGRAMDATA',
+    'TEMP',
+    'TMP',
+].map((n) => n.toUpperCase()));
+/**
+ * An environment variable a repo's .sandbox-config.json may not set: the git guard's and the sandbox's own (setting
+ * AGENT_GIT_ACCESS or GIT_CONFIG_COUNT would undo provisioning.git.access), interpreter hooks (NODE_OPTIONS reaches the
+ * git guard's node), proxies and API endpoints (ANTHROPIC_BASE_URL would send your API key to the repo's server).
+ */
+export function reservedEnvName(name) {
+    return RESERVED_ENV_PREFIX.test(name) || RESERVED_ENV_SUFFIX.test(name) || RESERVED_ENV_NAMES.has(name.toUpperCase());
+}
 export const ConfigSchema = z
     .strictObject({
     $schema: SchemaRefSchema.optional(),
@@ -88,10 +121,14 @@ export const LocalOverridesSchema = z
         .array(MappingSchema)
         .describe('Extra folders (relative paths are relative to this file), e.g. a read-only data folder at another place in the sandbox. Folders outside the project are used only as your projects.allowOutsideMappings setting allows (by default you are asked once).'),
     scripts: StringsSchema.describe('Scripts (.ps1 / .mjs / .cmd, relative to this file) run inside the sandbox before the agent.'),
-    // This PC's resources are yours to share: CPU and paging file (this PC's disk) are not a project's to set.
+    // This PC's resources are yours to share: CPU, paging file (this PC's disk) and the RAM kept for this PC are not a
+    // project's to set.
     sandbox: SandboxSchema.omit({
         cpuLimit: true,
         pageFileMb: true,
+        reserveHostMb: true,
+        maxMemoryPercent: true,
+        maxMemoryMb: true,
         engine: true,
         agentMemoryHeadroomMb: true,
         pressureResponse: true,
@@ -108,7 +145,7 @@ export const LocalOverridesSchema = z
     toolchains: z
         .strictObject({
         ..._.mapValues(_.omit(ToolchainsSchema.shape, 'environment'), (shape) => shape.partial()),
-        environment: ToolchainsSchema.shape.environment,
+        environment: ToolchainsSchema.shape.environment.refine((env) => !Object.keys(env).some(reservedEnvName), 'names the sandbox sets or that carry logins (AGENT_*, GIT_*, PATH, BASH_ENV, NODE_*, proxies, ANTHROPIC_*, CLAUDE_* ...) cannot be set by a project'),
     })
         .partial(),
     databases: z.strictObject(_.mapValues(DatabasesSchema.shape, (shape) => shape.partial())).partial(),

package/dist/core/schema/web.d.ts

@@ -1,7 +1,58 @@
 import { z } from 'zod';
 export declare const WEB_DEFAULT_PORT = 47800;
+export declare const WEB_LAN_DEFAULT_PORT = 47801;
+export declare const REMOTE_ROLES: readonly ["view", "control"];
+export type RemoteRole = (typeof REMOTE_ROLES)[number];
+/** A Windows account name: "bob", "PC\bob" or "DOMAIN\bob" (no paths, quotes or wildcards). */
+export declare const WindowsUserNameSchema: z.ZodString;
+export declare const RemoteUserSchema: z.ZodObject<{
+    name: z.ZodString;
+    role: z.ZodEnum<{
+        view: "view";
+        control: "control";
+    }>;
+}, z.core.$strict>;
+export type RemoteUser = z.output<typeof RemoteUserSchema>;
+export declare const WebLanSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    port: z.ZodNumber;
+    address: z.ZodString;
+}, z.core.$strict>;
+export declare const WebRemoteSchema: z.ZodObject<{
+    windowsSignIn: z.ZodBoolean;
+    users: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        role: z.ZodEnum<{
+            view: "view";
+            control: "control";
+        }>;
+    }, z.core.$strict>>;
+    rememberDays: z.ZodNumber;
+    lan: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        port: z.ZodNumber;
+        address: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type WebRemote = z.output<typeof WebRemoteSchema>;
 export declare const WebSchema: z.ZodObject<{
     enabled: z.ZodBoolean;
     port: z.ZodNumber;
     openOnLaunch: z.ZodBoolean;
+    remote: z.ZodObject<{
+        windowsSignIn: z.ZodBoolean;
+        users: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            role: z.ZodEnum<{
+                view: "view";
+                control: "control";
+            }>;
+        }, z.core.$strict>>;
+        rememberDays: z.ZodNumber;
+        lan: z.ZodObject<{
+            enabled: z.ZodBoolean;
+            port: z.ZodNumber;
+            address: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
 }, z.core.$strict>;

package/dist/core/schema/web.js

@@ -1,6 +1,50 @@
-// The web UI settings (sandbox web): not part of LocalOverrides, a repo never turns a way into your agents on.
+// The web UI settings (sandbox web): not part of LocalOverrides, a repo never turns a way into your agents on. The
+// remote group (other Windows users of this PC, devices on your network) is off by default: design/remote-access.md.
 import { z } from 'zod';
 export const WEB_DEFAULT_PORT = 47800;
+export const WEB_LAN_DEFAULT_PORT = 47801;
+export const REMOTE_ROLES = ['view', 'control'];
+/** A Windows account name: "bob", "PC\bob" or "DOMAIN\bob" (no paths, quotes or wildcards). */
+export const WindowsUserNameSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(120)
+    .regex(/^(?:[A-Za-z0-9][A-Za-z0-9._ -]{0,62}\\)?[^\\/"[\]:;|=,+*?<>@]{1,64}$/, 'a Windows user name (name or DOMAIN\\name)');
+export const RemoteUserSchema = z.strictObject({
+    name: WindowsUserNameSchema.describe('The Windows user (name, or DOMAIN\\name)'),
+    role: z
+        .enum(REMOTE_ROLES)
+        .describe('view: sees everything, terminals read-only. control: everything but remote access, logins and tokens.'),
+});
+export const WebLanSchema = z.strictObject({
+    enabled: z
+        .boolean()
+        .describe('(Beta) Devices on your network (a phone): an HTTPS address on this PC for devices you pair with a one-time code (sandbox web pair). Needs a firewall rule (sandbox web lan on asks Windows once). Off: every paired device is signed out.'),
+    port: z.number().int().min(1024).max(65535).describe('HTTPS port for paired devices on your network.'),
+    address: z
+        .string()
+        .trim()
+        .max(15)
+        .regex(/^$|^\d{1,3}(\.\d{1,3}){3}$/, 'an IPv4 address or empty')
+        .describe("This PC's private address to listen on. Empty: the one of its network adapter (never a public one)."),
+});
+export const WebRemoteSchema = z.strictObject({
+    windowsSignIn: z
+        .boolean()
+        .describe('(Beta) Other Windows users of this PC named in web.remote.users sign in to your web UI (and sandbox remote) with their own Windows account: no password, no link.'),
+    users: z
+        .array(RemoteUserSchema)
+        .max(32)
+        .describe('Who else may sign in with Windows, and their role (view or control).'),
+    rememberDays: z
+        .number()
+        .int()
+        .min(1)
+        .max(90)
+        .describe('How many days a paired device or a Windows sign-in stays signed in (from when it signed in, not renewed).'),
+    lan: WebLanSchema,
+});
 export const WebSchema = z.strictObject({
     enabled: z
         .boolean()
@@ -14,4 +58,5 @@ export const WebSchema = z.strictObject({
     openOnLaunch: z
         .boolean()
         .describe('(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts.'),
+    remote: WebRemoteSchema.describe('(Beta) Access for other Windows users of this PC and for paired devices.'),
 });

package/dist/core/util/fs.d.ts

@@ -3,6 +3,11 @@ export declare function dirExists(p: string): boolean;
 export declare function fileExists(p: string): boolean;
 /** fileExists without blocking the program (the menu looks for programs while it stays responsive). */
 export declare function fileExistsAsync(p: string): Promise<boolean>;
+/**
+ * A file the sandbox or a repo may have written, read through one handle and only if that handle is a regular file of
+ * at most `maxBytes` (null otherwise): a multi-gigabyte .nvmrc must not stop a launch.
+ */
+export declare function readSmallFile(file: string, maxBytes?: number): string | null;
 export declare function readJson<T>(p: string): T;
 export declare function tryReadJson<T>(p: string): T | null;
 /** Atomic (a crash or a second command never leaves half a file); refused outside temp during the self-test. */

package/dist/core/util/fs.js

@@ -28,6 +28,29 @@ export async function fileExistsAsync(p) {
         return false;
     }
 }
+/**
+ * A file the sandbox or a repo may have written, read through one handle and only if that handle is a regular file of
+ * at most `maxBytes` (null otherwise): a multi-gigabyte .nvmrc must not stop a launch.
+ */
+export function readSmallFile(file, maxBytes = 256 * 1024) {
+    let fd = null;
+    try {
+        fd = fs.openSync(file, 'r');
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile() || stat.size > maxBytes)
+            return null;
+        const buffer = Buffer.alloc(stat.size);
+        fs.readSync(fd, buffer, 0, stat.size, 0);
+        return buffer.toString('utf8');
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== null)
+            fs.closeSync(fd);
+    }
+}
 export function readJson(p) {
     return JSON.parse(fs.readFileSync(p, 'utf8').replace(/^\uFEFF/, ''));
 }

package/dist/core/util/index.d.ts

@@ -1,7 +1,7 @@
 export { isWin, sleep, captureOutput } from './process.js';
 export { UserError, fail, errMsg } from './errors.js';
 export { parseJsonc, readJsonc } from './jsonc.js';
-export { ensureDir, dirExists, fileExists, fileExistsAsync, readJson, tryReadJson, writeJson, realPath } from './fs.js';
+export { ensureDir, dirExists, fileExists, fileExistsAsync, readJson, readSmallFile, tryReadJson, writeJson, realPath, } from './fs.js';
 export { xmlEscape, safeText, plainText } from './text.js';
 export { homeDir, expandPath, expandVariables, isRootPath, isUserProfile, isInsideOrEqual, findOnPath, } from './paths.js';
 export { isLink, removeLink, assertNoLinks } from './links.js';

package/dist/core/util/index.js

@@ -1,7 +1,7 @@
 export { isWin, sleep, captureOutput } from './process.js';
 export { UserError, fail, errMsg } from './errors.js';
 export { parseJsonc, readJsonc } from './jsonc.js';
-export { ensureDir, dirExists, fileExists, fileExistsAsync, readJson, tryReadJson, writeJson, realPath } from './fs.js';
+export { ensureDir, dirExists, fileExists, fileExistsAsync, readJson, readSmallFile, tryReadJson, writeJson, realPath, } from './fs.js';
 export { xmlEscape, safeText, plainText } from './text.js';
 export { homeDir, expandPath, expandVariables, isRootPath, isUserProfile, isInsideOrEqual, findOnPath, } from './paths.js';
 export { isLink, removeLink, assertNoLinks } from './links.js';