windows-development-sandbox 1.12.0 → 1.13.2

package/dist/core/util/fs.js

@@ -28,6 +28,29 @@ export async function fileExistsAsync(p) {
         return false;
     }
 }
+/**
+ * A file the sandbox or a repo may have written, read through one handle and only if that handle is a regular file of
+ * at most `maxBytes` (null otherwise): a multi-gigabyte .nvmrc must not stop a launch.
+ */
+export function readSmallFile(file, maxBytes = 256 * 1024) {
+    let fd = null;
+    try {
+        fd = fs.openSync(file, 'r');
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile() || stat.size > maxBytes)
+            return null;
+        const buffer = Buffer.alloc(stat.size);
+        fs.readSync(fd, buffer, 0, stat.size, 0);
+        return buffer.toString('utf8');
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== null)
+            fs.closeSync(fd);
+    }
+}
 export function readJson(p) {
     return JSON.parse(fs.readFileSync(p, 'utf8').replace(/^\uFEFF/, ''));
 }

package/dist/core/util/index.d.ts

@@ -1,7 +1,7 @@
 export { isWin, sleep, captureOutput } from './process.js';
 export { UserError, fail, errMsg } from './errors.js';
 export { parseJsonc, readJsonc } from './jsonc.js';
-export { ensureDir, dirExists, fileExists, fileExistsAsync, readJson, tryReadJson, writeJson, realPath } from './fs.js';
+export { ensureDir, dirExists, fileExists, fileExistsAsync, readJson, readSmallFile, tryReadJson, writeJson, realPath, } from './fs.js';
 export { xmlEscape, safeText, plainText } from './text.js';
 export { homeDir, expandPath, expandVariables, isRootPath, isUserProfile, isInsideOrEqual, findOnPath, } from './paths.js';
 export { isLink, removeLink, assertNoLinks } from './links.js';

package/dist/core/util/index.js

@@ -1,7 +1,7 @@
 export { isWin, sleep, captureOutput } from './process.js';
 export { UserError, fail, errMsg } from './errors.js';
 export { parseJsonc, readJsonc } from './jsonc.js';
-export { ensureDir, dirExists, fileExists, fileExistsAsync, readJson, tryReadJson, writeJson, realPath } from './fs.js';
+export { ensureDir, dirExists, fileExists, fileExistsAsync, readJson, readSmallFile, tryReadJson, writeJson, realPath, } from './fs.js';
 export { xmlEscape, safeText, plainText } from './text.js';
 export { homeDir, expandPath, expandVariables, isRootPath, isUserProfile, isInsideOrEqual, findOnPath, } from './paths.js';
 export { isLink, removeLink, assertNoLinks } from './links.js';

package/dist/guest/daemon/daemon.js

@@ -54,6 +54,8 @@ export class Daemon {
                 return execCommand(req);
             case 'restart':
                 return sessions.restart(req);
+            case 'close':
+                return sessions.close(req);
             case 'pressure':
                 // No response: the host repeats it every few seconds while its memory stays low.
                 return governor.hostPressure(req.seconds, req.reason, req.level ?? 'slow');

package/dist/guest/daemon/idle-shutdown.js

@@ -1,4 +1,5 @@
-// A headless sandbox with nothing running (or starting) only wastes RAM, so it shuts itself down.
+// A headless sandbox with nothing running (or starting) only wastes RAM, so it shuts itself down. Every open session
+// counts, a plain shell as much as an agent: whether it is busy cannot be told from outside, and closing it says so.
 import { spawnSync } from 'node:child_process';
 import { SYSTEM } from '../../shared/system.js';
 import { saveClaudeMem } from '../setup/claude-mem.js';

package/dist/guest/daemon/sessions.d.ts

@@ -23,7 +23,10 @@ export declare class SessionManager {
     roots(): SessionRoot[];
     private rootStarted;
     private rootEnded;
-    /** `session` requests: an agent in its own ptyhost, in the launch folder's project or a registered one. */
+    /**
+     * `session` requests: an agent (or a plain shell) in its own ptyhost, in the launch folder's project or a registered
+     * one.
+     */
     start(req: SessionRequest): Promise<void>;
     /**
      * `project` requests: provision a registered project without an agent (sandbox start / exec / db from its folder).
@@ -31,10 +34,21 @@ export declare class SessionManager {
     prepare(req: Extract<GuestRequest, {
         kind: 'project';
     }>): Promise<void>;
-    /** `restart` requests: the matching sessions restart their agent (continuing the conversation where it can). */
+    /**
+     * `restart` requests: the matching sessions restart their agent (continuing the conversation where it can). Shells
+     * are left alone: restarting one would only throw away what it was doing.
+     */
     restart(req: Extract<GuestRequest, {
         kind: 'restart';
     }>): Promise<void>;
+    /**
+     * `close` requests: the session's ptyhost ends its program and everything it started (ProcessTree), then exits as
+     * if the program had. One that does not end in time has its ptyhost ended instead (closing the pseudo console ends
+     * what is attached to it).
+     */
+    close(req: Extract<GuestRequest, {
+        kind: 'close';
+    }>): Promise<void>;
     /**
      * Finds out which of Claude's conversation files this session writes (it appears with the first message) and puts
      * it in the status, so the host can reopen this very conversation. A reopened session starts with the one it was

package/dist/guest/daemon/sessions.js

@@ -1,6 +1,8 @@
-// `session` and `restart` requests: agent sessions, each in its own ptyhost process. A session runs in the launch
-// folder's project (the boot environment) or in a project registered later, which is provisioned first
-// (daemon/project).
+// `session`, `restart` and `close` requests: agent sessions and plain shell sessions, each in its own ptyhost process.
+// A session runs in the launch folder's project (the boot environment) or in a project registered later, which is
+// provisioned first (daemon/project). A shell gets the same environment as an agent, without the agent's own
+// environment (its keys) and without the agent's install, hooks and conversation tracking.
+import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import os from 'node:os';
@@ -10,7 +12,8 @@ import { isWithin } from '../../shared/paths/projects.js';
 import { now } from '../../shared/channel/run-dir.js';
 import { SYSTEM } from '../../shared/system.js';
 import { buildJobs, cargoJobs, linkSlotsFor, usableCpus } from '../../shared/memory/index.js';
-import { commandLine } from '../sessions/cmdline.js';
+import { commandLine, shellLaunch } from '../sessions/cmdline.js';
+import { pwshDir } from '../toolchains/tools/pwsh.js';
 import { freePort } from '../runtime/ports.js';
 import { primaryProject } from '../boot/project-status.js';
 import { ensurePtyHost, ptyHostLogTail, startPtyHost, waitForPtyHost } from '../sessions/pty-host.js';
@@ -30,7 +33,9 @@ import { isConversationId } from '../../shared/paths/conversation.js';
 import { errMsg } from '../../core/util/errors.js';
 import { provisioner } from './project-provisioner.js';
 import { IdleShutdown } from './idle-shutdown.js';
-import { insidePrimary, respond, safely, saveStatus } from './state.js';
+import { insidePrimary, insideWorkspace, respond, safely, saveStatus } from './state.js';
+/** How long a close waits for the session to end before it ends its ptyhost instead. */
+const CLOSE_WAIT_MS = 8000;
 /** An ended session's ptyhost is remembered this long: its last programs reach the audit up to 15 s later. */
 const ROOTS_KEPT_MS = 10 * 60 * 1000;
 function terminalTab(id, title, cwd) {
@@ -95,16 +100,45 @@ function writeBudget(cpus, memoryGb, jobs, env) {
         warn('budget.json could not be written: ' + errMsg(e));
     }
 }
-/** Starts ptyhost for the agent and waits until it listens; a failure carries the tail of ptyhost's own log. */
-const launchPtyHost = async (req, remote, env, say, sessions, onSpawn) => {
+/** The agent, installed if it is not yet; its environment may hold its API keys. */
+const agentProgram = async (req, env, say) => {
     const harness = harnessFor(req);
     // Never refresh here: main already did, and replacing a running agent's executable would fail.
     say('Preparing ' + req.harness);
     await agents.provision(req.harness, harness, env, false);
     const launch = agents.resolveLaunch(req.harness, harness);
     const base = [...launch.args, ...harness.arguments];
+    return {
+        command: commandLine(launch.file, [...base, ...req.args]),
+        restartCommand: commandLine(launch.file, [...base, ...(harness.resumeArguments ?? [])]),
+        environment: harness.environment,
+    };
+};
+/** Where the shells are: PowerShell 7 from the toolchains (or an installed copy), Windows' own PowerShell and cmd. */
+function shellPaths() {
+    const candidates = [
+        path.join(pwshDir(), 'pwsh.exe'),
+        path.join(process.env.ProgramFiles ?? 'C:\\Program Files', 'PowerShell', '7', 'pwsh.exe'),
+    ];
+    return { pwsh: candidates.find((f) => fs.existsSync(f)) ?? null, powershell: SYSTEM.powershell(), cmd: SYSTEM.cmd() };
+}
+/** A plain shell: no install, no arguments of the request, nothing of the agent's environment. */
+const shellProgram = (shell) => {
+    const line = commandLine(shell.file, shell.args);
+    return { command: line, restartCommand: line, environment: {} };
+};
+/** Starts ptyhost for the program and waits until it listens; a failure carries the tail of ptyhost's own log. */
+const launchPtyHost = async (req, program, remote, env, sessions, onSpawn) => {
     const port = await freePort();
     const token = crypto.randomBytes(24).toString('base64url');
+    const sessionEnv = {
+        ...withRegistryPath(env),
+        ...program.environment,
+        ...memoryEnv(env, sessions),
+    };
+    // Each PowerShell builds its own module path; one inherited from another PowerShell breaks its modules.
+    if (req.shell)
+        delete sessionEnv.PSModulePath;
     const child = startPtyHost({
         exe: ensurePtyHost(),
         port,
@@ -113,10 +147,10 @@ const launchPtyHost = async (req, remote, env, say, sessions, onSpawn) => {
         rows: 32,
         id: req.id,
         cwd: req.cwd,
-        env: { ...withRegistryPath(env), ...harness.environment, ...memoryEnv(env, sessions) },
+        env: sessionEnv,
         remote,
-        command: commandLine(launch.file, [...base, ...req.args]),
-        restartCommand: commandLine(launch.file, [...base, ...(harness.resumeArguments ?? [])]),
+        command: program.command,
+        restartCommand: program.restartCommand,
     });
     onSpawn(child);
     try {
@@ -134,6 +168,16 @@ const launchPtyHost = async (req, remote, env, say, sessions, onSpawn) => {
 /** The launch folder's project, or the registered project this session is for (provisioned first if needed). */
 const placeFor = async (req, say) => {
     if (!req.project) {
+        // A project set up earlier (the web UI and sandbox shell name it by its folder only): its own environment.
+        const known = insidePrimary(req.cwd) ? null : provisioner.provisionedFor(req.cwd);
+        if (known && exists(req.cwd))
+            return {
+                env: known.env,
+                hooks: known.spec.hooks ? projectHooks(known.spec.name, known.spec.workspace) : null,
+                project: known.spec.name,
+            };
+        if (!insidePrimary(req.cwd) && insideWorkspace(req.cwd))
+            throw new Error('The project in ' + req.cwd + ' is not set up in the sandbox yet: run sandbox start in its folder first.');
         if (!insidePrimary(req.cwd) || !exists(req.cwd))
             throw new Error('Folder is not inside the sandbox workspace ' + workspace + ': ' + req.cwd);
         return { env: process.env, hooks: null, project: primaryProject() };
@@ -187,16 +231,31 @@ export class SessionManager {
         if (r && r.to === undefined)
             this.ptyHosts.set(id, { ...r, to: Date.now() });
     }
-    /** `session` requests: an agent in its own ptyhost, in the launch folder's project or a registered one. */
+    /**
+     * `session` requests: an agent (or a plain shell) in its own ptyhost, in the launch folder's project or a registered
+     * one.
+     */
     async start(req) {
+        let shell = null;
+        let problem = null;
+        if (req.shell)
+            try {
+                shell = shellLaunch(req.shell, shellPaths());
+            }
+            catch (e) {
+                problem = errMsg(e);
+            }
+        // A shell is listed by its own name (pwsh, powershell, cmd).
+        const name = shell?.name ?? (req.shell ? 'shell' : req.harness);
         let status = {
             id: req.id,
             launchId: session.launchId,
-            harness: req.harness,
+            harness: name,
+            ...(req.shell ? { kind: 'shell' } : {}),
             cwd: req.cwd,
             ...(req.project ? { project: req.project.name } : {}),
             phase: 'starting',
-            message: 'Starting ' + req.harness,
+            message: 'Starting ' + name,
             updatedAt: now(),
             startedAt: now(),
         };
@@ -209,30 +268,34 @@ export class SessionManager {
         this.starting++;
         // Sessions after the first get their own tab right away (it shows the setup progress until the agent starts).
         if (req.id !== session.launchId && process.env.AGENT_NO_TABS !== '1')
-            safely('terminal tab', () => terminalTab(req.id, req.harness + ' ' + path.basename(req.cwd), req.cwd));
+            safely('terminal tab', () => terminalTab(req.id, name + ' ' + path.basename(req.cwd), req.cwd));
         try {
+            if (problem)
+                throw new Error(problem);
             const place = await placeFor(req, say);
+            const program = shell ? shellProgram(shell) : await agentProgram(req, place.env, say);
             const remote = session.networking && session.attach.enabled;
             const from = Date.now();
-            const { child, port, token } = await launchPtyHost(req, remote, place.env, say, this.live.size + 1, (c) => this.rootStarted(req.id, c, from));
-            const resumed = req.harness === 'claude' ? resumedConversation(req.args) : undefined;
+            const { child, port, token } = await launchPtyHost(req, program, remote, place.env, this.live.size + 1, (c) => this.rootStarted(req.id, c, from));
+            const agent = shell === null;
+            const resumed = agent && req.harness === 'claude' ? resumedConversation(req.args) : undefined;
             const running = {
                 ...status,
                 ...(resumed ? { conversation: resumed } : {}),
                 project: place.project,
                 phase: 'running',
-                message: req.harness + ' is running',
+                message: name + ' is running',
                 attach: { addresses: remote ? guestAddresses() : [], port, token },
             };
             this.live.set(req.id, { status: running, child });
             child.once('exit', (code) => this.onExit(running, place, code));
             saveStatus(running);
-            if (req.harness === 'claude')
+            if (agent && req.harness === 'claude')
                 this.trackConversation(running.id, resumed);
             log('Session ' +
                 req.id +
                 ' started (' +
-                req.harness +
+                name +
                 ' in ' +
                 req.cwd +
                 ', project ' +
@@ -271,15 +334,53 @@ export class SessionManager {
             this.idle.check();
         }
     }
-    /** `restart` requests: the matching sessions restart their agent (continuing the conversation where it can). */
+    /**
+     * `restart` requests: the matching sessions restart their agent (continuing the conversation where it can). Shells
+     * are left alone: restarting one would only throw away what it was doing.
+     */
     async restart(req) {
         const targets = [...this.live.values()].filter((s) => s.status.attach &&
+            s.status.kind !== 'shell' &&
             (req.harness === null || s.status.harness === req.harness) &&
             (!req.cwd || isWithin(req.cwd, s.status.cwd)));
         for (const s of targets)
             await sendControl({ addresses: ['127.0.0.1'], port: s.status.attach.port, token: s.status.attach.token }, FrameType.Restart);
         respond(req.id, { ok: true, message: 'restarted ' + targets.length + ' session(s)' });
     }
+    /**
+     * `close` requests: the session's ptyhost ends its program and everything it started (ProcessTree), then exits as
+     * if the program had. One that does not end in time has its ptyhost ended instead (closing the pseudo console ends
+     * what is attached to it).
+     */
+    async close(req) {
+        const entry = this.live.get(req.session);
+        if (!entry?.status.attach) {
+            respond(req.id, { ok: false, message: 'Session ' + req.session + ' is not running.' });
+            return;
+        }
+        const { child, status } = entry;
+        const ended = new Promise((resolve) => {
+            if (child.exitCode !== null || child.signalCode !== null)
+                return resolve(true);
+            const timer = setTimeout(() => resolve(false), CLOSE_WAIT_MS);
+            child.once('exit', () => {
+                clearTimeout(timer);
+                resolve(true);
+            });
+        });
+        try {
+            await sendControl({ addresses: ['127.0.0.1'], port: status.attach.port, token: status.attach.token }, FrameType.Close);
+        }
+        catch (e) {
+            warn('Session ' + req.session + ' did not take the close request: ' + errMsg(e));
+        }
+        if (!(await ended)) {
+            warn('Session ' + req.session + ' did not end in time; ending its session host.');
+            safely('ending a session host', () => child.kill());
+        }
+        log('Session ' + req.session + ' closed on request');
+        respond(req.id, { ok: true, message: 'Closed ' + status.harness + ' session ' + req.session + '.' });
+    }
     /**
      * Finds out which of Claude's conversation files this session writes (it appears with the first message) and puts
      * it in the status, so the host can reopen this very conversation. A reopened session starts with the one it was
@@ -324,6 +425,11 @@ export class SessionManager {
             attach: undefined,
         });
         log('Session ' + running.id + ' ended (exit ' + code + ')');
+        // A shell ran no agent: no post-agent hooks, nothing of an agent's to save.
+        if (running.kind === 'shell') {
+            this.idle.check();
+            return;
+        }
         if (place.hooks)
             void runHooksAsync('post-agent', place.env, place.hooks).catch((e) => warn('post-agent hooks failed: ' + errMsg(e)));
         else

package/dist/guest/git/decision.js

@@ -57,6 +57,8 @@ const LISTING = {
 /** Global options that take a value (`git -C dir status`). Config overrides (-c, --config-env) are refused outright. */
 const WITH_VALUE = new Set(['-C', '--namespace']);
 const FORBIDDEN_GLOBAL = /^(-c|--config-env|--exec-path|--git-dir|--work-tree|--super-prefix)(=|$)/;
+/** Options of reading commands that run a program or write a file (grep -O<cmd>, ls-remote --upload-pack, --output). */
+const RUNS_OR_WRITES = /^(--open-files-in-pager|--upload-pack|--output|--ext-diff)(=|$)/;
 export function gitDecision(args, access) {
     if (access === 'full')
         return { allow: true };
@@ -72,6 +74,11 @@ export function gitDecision(args, access) {
         i += WITH_VALUE.has(args[i]) ? 2 : 1;
     }
     const [command, ...rest] = args.slice(i);
+    const runsOrWrites = rest.find((a) => RUNS_OR_WRITES.test(a) ||
+        (command === 'ls-remote' && /^-u(.|$)/.test(a)) ||
+        (command === 'grep' && /^-O/.test(a)));
+    if (runsOrWrites)
+        return { allow: false, reason: 'git ' + runsOrWrites + ' is not allowed: git is read-only in this sandbox.' };
     if (command === undefined || command === '--version' || READ_ONLY.has(command) || (LISTING[command]?.(rest) ?? false))
         return { allow: true };
     return {

package/dist/guest/sessions/cmdline.d.ts

@@ -10,3 +10,17 @@ export declare function quoteArg(arg: string): string;
 export declare function cmdArgs(args: string[]): string;
 /** The command line ptyhost starts; when the program is cmd.exe its arguments are quoted for cmd (cmdArgs). */
 export declare function commandLine(file: string, args: string[]): string;
+/** A plain shell session's program: which shell, its absolute path and its arguments. */
+export interface ShellLaunch {
+    readonly name: 'pwsh' | 'powershell' | 'cmd';
+    readonly file: string;
+    readonly args: string[];
+}
+/** Where the shells are in this sandbox (pwsh: null when PowerShell 7 is not installed). */
+export interface ShellPaths {
+    readonly pwsh: string | null;
+    readonly powershell: string;
+    readonly cmd: string;
+}
+/** The shell a session asked for runs as (auto: PowerShell 7 when present, else Windows PowerShell). Pure. */
+export declare function shellLaunch(asked: 'auto' | ShellLaunch['name'], paths: ShellPaths): ShellLaunch;

package/dist/guest/sessions/cmdline.js

@@ -31,3 +31,13 @@ export function commandLine(file, args) {
         ? [quoteArg(file), cmdArgs(args)].filter(Boolean).join(' ')
         : [file, ...args].map(quoteArg).join(' ');
 }
+/** The shell a session asked for runs as (auto: PowerShell 7 when present, else Windows PowerShell). Pure. */
+export function shellLaunch(asked, paths) {
+    if (asked === 'cmd')
+        return { name: 'cmd', file: paths.cmd, args: [] };
+    if (asked === 'powershell' || (asked === 'auto' && !paths.pwsh))
+        return { name: 'powershell', file: paths.powershell, args: ['-NoLogo'] };
+    if (!paths.pwsh)
+        throw new Error('PowerShell 7 is not installed in this sandbox (toolchains.pwsh). Open powershell or cmd instead, or turn pwsh on.');
+    return { name: 'pwsh', file: paths.pwsh, args: ['-NoLogo'] };
+}

package/dist/guest/toolchains/setup.js

@@ -17,6 +17,9 @@ export async function setupToolchains(config, versions, options, run = {}) {
         env.summary.push(...part.summary);
     }
     Object.assign(env.vars, config.environment);
+    // The git guard's variables (AGENT_GIT_ACCESS, GIT_DIR, GIT_CONFIG_*, BASH_ENV) always win over
+    // toolchains.environment.
+    Object.assign(env.vars, envs.get('Git')?.vars);
     log('Set up ' + steps.length + ' toolchains and databases.');
     return env;
 }

package/dist/host/audit/log.d.ts

@@ -1,16 +1,17 @@
 import { z } from 'zod';
-export declare const AUDIT_KINDS: readonly ["proc", "file", "commit", "session", "guard", "note"];
+export declare const AUDIT_KINDS: readonly ["proc", "file", "commit", "session", "guard", "note", "remote"];
 export type AuditKind = (typeof AUDIT_KINDS)[number];
 /** A session id as the sandbox's run folder names them. */
 export declare const AuditSessionIdSchema: z.ZodString;
 /**
  * One event. k: proc (a program started), file (changed in a project), commit (a git commit in a project), session,
- * guard (repo guard), note.
+ * guard (repo guard), note, remote (what another Windows user or a paired device did in the web UI).
  */
 export declare const AuditEventSchema: z.ZodObject<{
     t: z.ZodString;
     k: z.ZodEnum<{
         file: "file";
+        remote: "remote";
         session: "session";
         note: "note";
         commit: "commit";

package/dist/host/audit/log.js

@@ -6,12 +6,12 @@ import fs from 'node:fs';
 import path from 'node:path';
 import zlib from 'node:zlib';
 import { z } from 'zod';
-export const AUDIT_KINDS = ['proc', 'file', 'commit', 'session', 'guard', 'note'];
+export const AUDIT_KINDS = ['proc', 'file', 'commit', 'session', 'guard', 'note', 'remote'];
 /** A session id as the sandbox's run folder names them. */
 export const AuditSessionIdSchema = z.string().regex(/^[A-Za-z0-9_-]{1,64}$/);
 /**
  * One event. k: proc (a program started), file (changed in a project), commit (a git commit in a project), session,
- * guard (repo guard), note.
+ * guard (repo guard), note, remote (what another Windows user or a paired device did in the web UI).
  */
 export const AuditEventSchema = z.object({
     /** ISO time. */
@@ -44,7 +44,7 @@ export const AuditEventSchema = z.object({
         .string()
         .regex(/^[0-9a-f]{7,64}$/)
         .optional(),
-    /** commit: who git says made it ("Name <email>"). */
+    /** commit: who git says made it ("Name <email>"); remote: who did it ("device Josh's phone"). */
     au: z.string().max(256).optional(),
 });
 /** Each text field's limit (the schema's): text is cut to it before writing, so a line is never refused on reading. */

package/dist/host/channel/channel.d.ts

@@ -1,5 +1,5 @@
 import type { GuestRequest, GuestResponse, Harness, SandboxStatus, SessionStatus } from '../../core/types.js';
-import type { ProjectSpec } from '../../shared/channel/index.js';
+import type { ProjectSpec, ShellChoice } from '../../shared/channel/index.js';
 /**
  * The boot script writes its first status once Windows has booted the sandbox and logged on (a minute or two, longer on
  * a slow PC or the very first start); none after this long means it never got going.
@@ -46,6 +46,10 @@ export declare class SandboxChannel {
     exec(command: string[], cwd: string, timeoutSeconds: number): Promise<GuestResponse>;
     /** Restarts running sessions in place (they resume via the harness's resumeArguments, e.g. claude --continue). */
     restart(harness: string | null, cwd?: string): Promise<GuestResponse>;
+    /** Asks for a plain shell session in a folder of the sandbox; returns the request id (waitForSession follows it). */
+    requestShell(shell: ShellChoice, cwd: string): string;
+    /** Ends a running session (agent or shell) and everything it started; waits for the sandbox's answer. */
+    closeSession(sessionId: string): Promise<GuestResponse>;
     /** The PC is low on memory or CPU: the sandbox slows its builds down for `seconds`. Never waits for an answer. */
     pressure(reason: string, seconds: number, level?: 'slow' | 'severe'): void;
     ping(): Promise<GuestResponse>;

package/dist/host/channel/channel.js

@@ -179,6 +179,18 @@ export class SandboxChannel {
         this.send({ kind: 'restart', id: requestId, harness, ...(cwd ? { cwd } : {}), createdAt: now() });
         return this.waitForResponse(requestId, 30000);
     }
+    /** Asks for a plain shell session in a folder of the sandbox; returns the request id (waitForSession follows it). */
+    requestShell(shell, cwd) {
+        const requestId = newId();
+        this.send({ kind: 'session', id: requestId, harness: 'shell', args: [], cwd, shell, createdAt: now() });
+        return requestId;
+    }
+    /** Ends a running session (agent or shell) and everything it started; waits for the sandbox's answer. */
+    async closeSession(sessionId) {
+        const requestId = newId();
+        this.send({ kind: 'close', id: requestId, session: sessionId, createdAt: now() });
+        return this.waitForResponse(requestId, 30000);
+    }
     /** The PC is low on memory or CPU: the sandbox slows its builds down for `seconds`. Never waits for an answer. */
     pressure(reason, seconds, level = 'slow') {
         this.send({ kind: 'pressure', id: newId(), reason, seconds, level, createdAt: now() });

package/dist/host/guard/agent-files.js

@@ -17,8 +17,11 @@ const CLAUDE_RISKY_KEYS = [
     'enableAllProjectMcpServers',
     'enabledMcpjsonServers',
     'disableAllHooks',
+    // Plugins bring their own hooks and MCP servers.
+    'enabledPlugins',
+    'extraKnownMarketplaces',
 ];
-const VSCODE_RISKY_KEY = /path|executable|command|interpreter|shell|profile|args|env|exec|program|server|launch|runtime|binary/i;
+const VSCODE_RISKY_KEY = /path|executable|command|interpreter|shell|profile|args|env|exec|program|server|launch|runtime|binary|alternatetools|home|goroot|tsdk|sdk/i;
 const MAX_AGENT_FILE_BYTES = 1024 * 1024;
 function claudeRisk(d) {
     const s = (_.isPlainObject(d) ? d : {});
@@ -26,6 +29,9 @@ function claudeRisk(d) {
     return {
         ..._.pick(s, CLAUDE_RISKY_KEYS),
         permissions: _.pick(permissions, ['defaultMode', 'additionalDirectories']),
+        // A whole-tool rule ("Bash", "Bash(*)") lets Claude Code on this PC run any command without asking; narrow rules
+        // (Bash(npm test), what "always allow" writes) are ordinary edits.
+        broadAllow: (Array.isArray(permissions.allow) ? permissions.allow : []).filter((r) => typeof r !== 'string' || !r.includes('(') || /\(\s*:?\*\s*\)\s*$/.test(r)),
     };
 }
 /**

package/dist/host/guard/commands.js

@@ -1,5 +1,15 @@
 import { filesIn } from './file-hash.js';
 import { quarantine } from './quarantine.js';
+/** What cmd runs from the current folder: a fixed list plus this PC's PATHEXT (the Python installer adds .PY, .PYW). */
+const EXTENSIONS = [
+    ...new Set([
+        ...['exe', 'com', 'bat', 'cmd', 'vbs', 'vbe', 'js', 'jse', 'wsf', 'wsh', 'msc', 'ps1', 'cpl'],
+        ...(process.env.PATHEXT ?? '')
+            .split(';')
+            .map((e) => e.replace(/^\./, '').toLowerCase())
+            .filter((e) => /^[a-z0-9]{1,8}$/.test(e)),
+    ]),
+];
 /** Names you are likely to run in a project folder; with any of these extensions Windows would pick the local copy. */
 export const COMMANDS = new RegExp('^(' +
     [
@@ -108,7 +118,9 @@ export const COMMANDS = new RegExp('^(' +
         'ssh',
         'scp',
     ].join('|') +
-    ')\\.(exe|com|bat|cmd|vbs|vbe|js|jse|wsf|wsh|msc|ps1)$', 'i');
+    ')\\.(' +
+    EXTENSIONS.join('|') +
+    ')$', 'i');
 /** Fingerprints of the files in the project root named like one of COMMANDS. */
 export function plantedCommands(workspace) {
     return filesIn(workspace, (n) => COMMANDS.test(n));

package/dist/host/guard/git-config.js

@@ -5,13 +5,28 @@ import _ from 'lodash';
 import { writeFileAtomic } from '../../shared/io/index.js';
 import { fileExists, isLink } from '../../core/util/index.js';
 /** Config keys that make git run a program, or load more config. */
-const DANGEROUS_KEY = /^(fsmonitor|hookspath|sshcommand|pager|editor|askpass|program|gpgprogram|textconv|command|cmd|clean|smudge|process|driver|helper|uploadpack|receivepack|path|attributesfile|excludesfile|worktree|worktreeconfig|gitproxy|proxycommand|sendemailvalidate|tool|external|difffilter|defaultkeycommand|alternaterefscommand)\s*=/i;
-const SECTION = /^\s*\[([^\]]*)\]\s*/;
+const DANGEROUS_KEY = /^(fsmonitor|hookspath|sshcommand|pager|editor|askpass|program|gpgprogram|textconv|command|cmd|tocmd|cccmd|smtpserver|httpd|vcs|packobjectshook|clean|smudge|process|driver|helper|uploadpack|receivepack|path|attributesfile|excludesfile|worktree|worktreeconfig|gitproxy|proxycommand|sendemailvalidate|tool|external|difffilter|defaultkeycommand|alternaterefscommand)\s*(=|$)/i;
+/**
+ * A section header as git reads it: a name (the old [section.sub] form included), then an optional quoted subsection
+ * in which `]` and escaped quotes are allowed ([filter "a]b"] must not hide the key after it).
+ */
+const SECTION = /^\s*\[\s*([A-Za-z0-9.-]+)(\s+"(?:[^"\\]|\\.)*")?\s*\]\s*/;
+/** Sections where any key is risky: [protocol] turns on transports that run commands (ext::), [url] rewrites URLs. */
+const RISKY_SECTIONS = new Set(['pager', 'protocol', 'url']);
 const MARK = '# [agent-sandbox] disabled, added inside the sandbox: ';
 const MAX_CONFIG_BYTES = 4 * 1024 * 1024;
-/** Sections where any key runs a program ([pager] log = x), or where a "!" value does ([alias] st = !x). */
+/**
+ * Sections where any key runs a program ([pager] log = x), where a "!" value does ([alias] st = !x, also quoted or on a
+ * continued line: every new alias line with a "!" counts), or a "!" submodule update command.
+ */
 function dangerousInSection(section, keyPart) {
-    return (section === 'pager' && keyPart.includes('=')) || (section === 'alias' && /^[^=]+=\s*"?\s*!/.test(keyPart));
+    if (keyPart === '' || /^[#;]/.test(keyPart))
+        return false;
+    if (RISKY_SECTIONS.has(section))
+        return true;
+    if (section === 'alias')
+        return keyPart.includes('!');
+    return section === 'submodule' && /^update\s*=/i.test(keyPart) && keyPart.includes('!');
 }
 /** The lines of <dir>\config (none for a link or a file over 4 MB). */
 export function configLines(dir) {
@@ -30,16 +45,21 @@ export function disableConfig(dir, before) {
     let section = '';
     const fixed = lines.map((line) => {
         const header = SECTION.exec(line);
+        // A line that starts like a header but is not one git would accept: treat it as unknown (risky) below.
+        const badHeader = !header && /^\s*\[/.test(line);
         if (header) {
-            section = header[1].trim().toLowerCase().split(/\s/)[0];
-            inInclude = /^include(if\s+"[^"]*")?$/i.test(header[1].trim());
+            section = header[1].toLowerCase().split('.')[0];
+            inInclude = section === 'include' || section === 'includeif';
         }
         seen[line] = (seen[line] ?? 0) + 1;
         if (line.startsWith(MARK) || seen[line] <= (known[line] ?? 0))
             return line;
         // git also accepts "[core] fsmonitor = x" on one line, so look past a leading section header.
         const keyPart = line.replace(SECTION, '').trim();
-        if (!(DANGEROUS_KEY.test(keyPart) || (inInclude && keyPart.includes('=')) || dangerousInSection(section, keyPart)))
+        if (!(badHeader ||
+            DANGEROUS_KEY.test(keyPart) ||
+            (inInclude && keyPart.includes('=')) ||
+            dangerousInSection(section, keyPart)))
             return line;
         findings.push({ kind: 'config', detail: line.trim() });
         return MARK + line.trim();