windows-development-sandbox 1.12.0 → 1.13.2

package/dist/selftest/layout.test.js

@@ -1,6 +1,7 @@
 // The architecture rules, checked on the compiled output (dist/**/*.js): which areas may import which, the guest's
 // portable core, the pure guest files the host and tests may load without the guest runtime's side effects, and no
-// import cycles. The bundled dist/runtime is left out (it has no imports).
+// import cycles. The bundled dist/runtime is left out (it has no imports); the bundled commands (dist/bin) must import
+// only their own chunks.
 import fs from 'node:fs';
 import path from 'node:path';
 const STATIC = /^\s*(?:import|export)\b[^;]*?\bfrom\s*(['"])([^'"\n]+)\1;?\s*$|^\s*import\s*(['"])([^'"\n]+)\3;?\s*$/gm;
@@ -149,5 +150,13 @@ export const layoutSuite = {
             .filter((d) => area(d) === 'app' && !(area(f) === 'host' && d.startsWith('app/kernel/')))
             .map((d) => f + ' -> ' + d));
         t.check(!intoApp.length, 'below the CLI only host code uses the shared core, and only its kernel', list(intoApp));
+        t.section('the commands');
+        // Loading the CLI as hundreds of modules took most of a second before anything was shown (scripts/bundle.mjs).
+        const bins = files.filter((f) => area(f) === 'bin');
+        const unbundled = bins.flatMap((f) => modules
+            .get(f)
+            .statics.filter((d) => area(d) !== 'bin')
+            .map((d) => f + ' -> ' + d));
+        t.check(bins.includes('bin/sandbox.js') && bins.some((f) => f.startsWith('bin/chunk-')) && !unbundled.length, 'the commands (dist/bin) are bundled: they load no compiled module one by one', list(unbundled));
     },
 };

package/dist/selftest/live-daemon.test.js

@@ -19,6 +19,8 @@ export const liveDaemonSuite = {
         Object.assign(session.harness, {
             arguments: ['/d', '/k', 'echo LIVE-AGENT-READY'],
             resumeArguments: ['/d', '/k', 'echo LIVE-AGENT-RESUMED'],
+            // The agent's own environment (where its keys live): a shell session must not get it.
+            environment: { LIVE_AGENT_KEY: 'sk-live-agent' },
         });
         t.writeJson(gen.sessionPath, session);
         const daemon = startDaemon(t, f, { launchPath: gen.launchPath, data, workspace });
@@ -82,6 +84,29 @@ export const liveDaemonSuite = {
             t.check(Boolean(ping?.ok) &&
                 !fs.existsSync(path.join(daemon.run, 'responses', 'evil.json')) &&
                 !fs.existsSync(path.join(daemon.run, 'requests', 'evil.json')), 'ping is answered; an unknown request kind gets no answer and is deleted', JSON.stringify(ping));
+            t.section('live: a plain shell session');
+            daemon.request({ kind: 'session', id: 'shell1', harness: 'shell', args: [], cwd: workspace, shell: 'cmd' });
+            const shell = await daemon.started('shell1');
+            t.check(shell?.phase === 'running' && shell.harness === 'cmd' && shell.kind === 'shell' && Boolean(shell.attach), 'a shell session runs through ptyhost and is listed by its shell, marked as a shell', JSON.stringify(shell) + '\n' + daemon.diagnostics());
+            if (shell?.attach) {
+                const shellView = await openViewer(shell.attach);
+                viewers.push(shellView);
+                // Typing before cmd has drawn its prompt can lose the keystrokes: wait for the prompt first.
+                await sees(t, shellView, '>');
+                shellView.type('echo SHELL-[%LIVE_AGENT_KEY%]-%USERNAME:~0,0%OK');
+                const sawShell = await sees(t, shellView, 'SHELL-[%LIVE_AGENT_KEY%]-OK');
+                t.check(Boolean(sawShell), "keystrokes reach the shell, and it has none of the agent's own environment", 'screen so far: ' + tail(shellView.output()) + '\n' + daemon.diagnostics());
+                daemon.request({ kind: 'close', id: 'close1', session: 'shell1' });
+                const closed = await daemon.response('close1');
+                const shellEnded = await t.waitFor(() => {
+                    const s = daemon.status('shell1');
+                    return s?.phase === 'exited' ? s : null;
+                }, WAIT.exit);
+                t.check(Boolean(closed?.ok) && shellEnded !== null && shellView.exitCode() !== null, 'close ends the shell: the sandbox answers, the status says exited and the attached client gets the exit', JSON.stringify(closed) + ' ' + JSON.stringify(daemon.status('shell1')));
+                daemon.request({ kind: 'close', id: 'close2', session: 'shell1' });
+                const again = await daemon.response('close2');
+                t.check(again?.ok === false, 'closing a session that has ended says it is not running', JSON.stringify(again));
+            }
             t.section('live: restart and exit');
             daemon.request({ kind: 'restart', id: 'restart1', harness: 'claude' });
             const sawResumed = await sees(t, viewer, 'LIVE-AGENT-RESUMED');

package/dist/selftest/local-config.test.js

@@ -61,6 +61,28 @@ export const localConfigSuite = {
         await rejectedBecause({ claudeProfile: { hostDir: 'C:\\x' } }, 'claudeProfile.hostDir is not allowed', 'a project file cannot point at the Claude profile folder');
         await rejectedBecause({ toolchains: { node: { hostDir: 'x' } } }, 'toolchains.node.hostDir is not allowed', 'a project file cannot point at host tool folders');
         await rejectedBecause({ sandbox: { memoryMb: 12 } }, 'sandbox.memoryMb:', 'values are type-checked (memory too small)');
+        // Security review 2026-10: what a repo could reach through fields that looked harmless.
+        const secretFile = path.join(f.shared, 'id_ed25519');
+        fs.writeFileSync(secretFile, 'PRIVATE KEY');
+        await rejectedBecause({ scripts: [secretFile] }, 'only files inside the project', 'a project file cannot name a script outside the project (it would copy that PC file into the launch folder)');
+        await rejectedBecause({ scripts: [path.relative(dirC, secretFile)] }, 'only files inside the project', 'a relative ..\\ script path outside the project is refused too');
+        fs.symlinkSync(f.shared, path.join(dirC, 'linked'), 'junction');
+        await rejectedBecause({ scripts: ['./linked/id_ed25519'] }, 'only files inside the project', 'a script reached through a link to a folder outside the project is refused');
+        fs.rmSync(path.join(dirC, 'linked'));
+        for (const name of [
+            'AGENT_GIT_ACCESS',
+            'GIT_CONFIG_COUNT',
+            'ANTHROPIC_BASE_URL',
+            'NODE_OPTIONS',
+            'Path',
+            'https_proxy',
+        ])
+            await rejectedBecause({ toolchains: { environment: { [name]: 'x' } } }, 'cannot be set by a project', 'a project file cannot set ' + name + ' in toolchains.environment');
+        await rejectedBecause({ sandbox: { reserveHostMb: 0 } }, 'sandbox.reserveHostMb is not allowed', 'a project file cannot lower the RAM kept for this PC');
+        f.writeLocal(dirC, { toolchains: { environment: { NPM_CONFIG_REGISTRY: 'https://registry.example' } } });
+        t.equal((await f.run({ cwd: dirC, trustConfig: true })).config.toolchains.environment.NPM_CONFIG_REGISTRY, 'https://registry.example', 'a registry mirror in toolchains.environment is still fine');
+        f.writeLocal(dirC, { provisioning: { copyFromHost: true } });
+        t.equal((await f.run({ cwd: dirC, trustConfig: true }, { ...f.baseConfig, provisioning: { ...f.baseConfig.provisioning, copyFromHost: false } })).config.provisioning.copyFromHost, false, 'a project file cannot turn on copying Node, Git and the agent from this PC when you turned it off');
         await rejectedBecause('{\n  // a comment\n  "readOnly": tru\n}', 'line 3', 'broken JSON is reported with its line');
         await rejectedBecause({ _comment: 'old style' }, '_comment is not allowed', 'unknown keys are rejected');
         f.writeLocal(dirC, '// comments and trailing commas are fine\n{\n  "readOnly": true, /* inline */\n}\n');
@@ -109,6 +131,14 @@ export const localConfigSuite = {
         t.check(viaVariable.includes('outside the project') &&
             viaLink.includes('outside the project') &&
             (await f.run({ cwd: dirD, trustConfig: true }, withOutside(false))).config.mappings.some((m) => m.host === path.join(dirD, 'assets')), 'outside means where the folder really is (%VAR% expanded, links followed); a folder inside needs no permission');
+        // A second mapping of part of the project must not undo readOnly or the workspace filter.
+        fs.mkdirSync(path.join(dirD, 'assets'), { recursive: true });
+        f.writeLocal(dirD, { mappings: [{ host: '.', guest: 'C:\\Data', readOnly: false }] });
+        const readOnlyUser = { ...f.baseConfig, readOnly: true };
+        const remapped = (await f.launch({ cwd: dirD, trustConfig: true }, { config: readOnlyUser })).mappings.find((m) => m.guest.toLowerCase() === 'c:\\data');
+        const filtered = await t.thrownMessage(() => f.launch({ cwd: dirD, trustConfig: true }, { config: { ...f.baseConfig, workspaceFilter: { ...f.baseConfig.workspaceFilter, enabled: true } } }));
+        t.check(remapped?.readOnly === true && filtered.includes('workspaceFilter.enabled'), 'a project folder mapped again is read-only when the project is, and refused while the workspace filter is on', JSON.stringify(remapped) + ' / ' + filtered);
+        fs.rmSync(path.join(dirD, '.sandbox-config.json'));
         t.section('a project can only tighten protections');
         // Settings that would loosen a protection are listed before approval, then ignored.
         f.writeLocal(dirC, {

package/dist/selftest/menu-perf.test.js

@@ -1,16 +1,21 @@
-// The menu stays quick: no key or draw waits for a child process (tasklist is faked and counted), a slow tab load shows
-// "Loading…" instead of holding up the keys, a held key is drawn once, and the terminal writes only the rows that
-// changed (the screen after the diffs is the same as a full draw, also after a resize).
+// The menu stays quick: no key or draw waits for a child process (tasklist is faked and counted), the first screen does
+// not wait for the process list, a slow tab load shows "Loading…" instead of holding up the keys, a section seen before
+// shows at once, a held key is drawn once, Esc is a key at once, an idle menu writes nothing, and the terminal writes
+// only the rows that changed (the screen after the diffs is the same as a full draw, also after a resize). The process
+// list is fetched only when it may have changed, and the settings file is read once for a whole list.
+import fs from 'node:fs';
 import { EventEmitter } from 'node:events';
 import { PassThrough } from 'node:stream';
+import { ConfigFile } from '../app/features/settings/index.js';
 import { DEFAULTS } from '../core/config/index.js';
 import { sleep } from '../core/util/index.js';
 import { Menu } from '../cli/menu/menu.js';
-import { LiveStatus } from '../cli/menu/live.js';
+import { LiveStatus, listGap } from '../cli/menu/live.js';
 import { ListPage } from '../cli/menu/pages/list-page.js';
 import { App, Text, Terminal } from '../cli/tui/index.js';
-import { supportsSyncUpdate } from '../cli/tui/terminal.js';
-import { isSandboxRunning, useTasklistCache, useTasklistRunners } from '../host/sandbox/index.js';
+import { ESCAPE_TIMEOUT_MS, supportsSyncUpdate } from '../cli/tui/terminal.js';
+import { isSandboxRunning, readTasklist, sandboxPids, useTasklistCache, useTasklistRunners, } from '../host/sandbox/index.js';
+import { staleMountNote } from '../host/storage/index.js';
 const TASKLIST = [
     '"System Idle Process","0","Services","0","8 K"',
     '"WindowsSandboxClient.exe","4242","Console","1","9,000 K"',
@@ -124,6 +129,26 @@ export const menuPerfSuite = {
             app.close();
             t.check(result === 'bye' && handled === 31 && renders < 10, 'keys that are already waiting are handled first and drawn once, not once each', 'handled ' + handled + ', drawn ' + renders);
         }
+        t.section('Esc is a key at once');
+        {
+            const tty = new FakeTty();
+            const term = tty.terminal();
+            term.start();
+            const times = [];
+            for (let i = 0; i < 3; i++) {
+                const at = Date.now();
+                tty.type('\x1b');
+                const key = await term.key();
+                times.push(Date.now() - at);
+                if (key.name !== 'escape')
+                    times.push(9999);
+            }
+            tty.type('\x1b[B');
+            const arrow = await term.key();
+            term.stop();
+            t.check(Math.max(...times) < 250 && ESCAPE_TIMEOUT_MS <= 50, 'Esc arrives in ' + times.join(', ') + ' ms (Node waits 500 ms for the rest of a sequence by default)', times.join(', '));
+            t.check(arrow.name === 'down', 'an arrow key is still one key, not Esc and letters');
+        }
         t.section('a slow load does not hold up the keys');
         {
             const tty = new FakeTty();
@@ -131,9 +156,10 @@ export const menuPerfSuite = {
             class Slow extends ListPage {
                 label = 'Slow';
                 rows = [];
+                next = ['alpha', 'beta'];
                 async load() {
                     await sleep(500);
-                    this.rows = ['alpha', 'beta'];
+                    this.rows = this.next;
                 }
                 options() {
                     return { path: [], items: this.rows.map((r) => ({ value: r, label: r })) };
@@ -150,6 +176,14 @@ export const menuPerfSuite = {
             t.check(waited < 400 && page.loading && text().includes('Loading'), 'the tab opens at once and says Loading… while the data comes', 'waited ' + waited + ' ms');
             const arrived = await t.waitFor(() => (text().includes('beta') ? true : null), 5000, 20);
             t.check(arrived === true && !page.loading, 'the list is built when the data arrives');
+            // Back on the section later: what it had shows at once, the fresh data replaces it when it is there.
+            page.next = ['alpha', 'gamma'];
+            const again = Date.now();
+            await page.show();
+            const shownIn = Date.now() - again;
+            t.check(shownIn < 100 && text().includes('beta'), 'a section seen before shows its last data at once (in ' + shownIn + ' ms), not Loading…', text());
+            const fresh = await t.waitFor(() => (text().includes('gamma') ? true : null), 5000, 20);
+            t.check(fresh === true && !text().includes('beta'), 'and its fresh data when it has loaded');
         }
         t.section('no child process on a key or a draw');
         const saved = { hostOnly: process.env.AGENT_SANDBOX_HOST_ONLY };
@@ -177,24 +211,34 @@ export const menuPerfSuite = {
                     return TASKLIST;
                 },
                 refreshMs: 100,
+                // The sandbox's process is gone at every look: the list is fetched again on every tick.
+                processAlive: () => false,
             });
+            const startedAt = Date.now();
             const done = menu.start();
-            const shown = await t.waitFor(() => tty.writes.length > 0, 20000, 20);
+            const shown = await t.waitFor(() => tty.writes.length > 0, 20000, 5);
+            const firstPaint = Date.now() - startedAt;
             t.check(shown === true, 'the menu draws its first screen');
+            t.check(firstPaint < 1000, 'the first screen does not wait for a 1.5 second process list (drawn after ' + firstPaint + ' ms)');
             const slowest = { ms: 0, key: '' };
+            const took = [];
             const press = async (name, bytes) => {
                 const before = tty.writes.length;
                 const at = Date.now();
                 tty.type(bytes);
                 // Not every key changes the screen: give the ones that do a chance, and measure those.
-                await t.waitFor(() => tty.writes.length > before, 400, 5);
-                const took = Date.now() - at;
-                if (tty.writes.length > before && took > slowest.ms) {
-                    slowest.ms = took;
+                await t.waitFor(() => tty.writes.length > before, 400, 2);
+                const ms = Date.now() - at;
+                if (tty.writes.length > before)
+                    took.push(ms);
+                if (tty.writes.length > before && ms > slowest.ms) {
+                    slowest.ms = ms;
                     slowest.key = name;
                 }
                 await sleep(15);
             };
+            // The pages have their data (the first process list came after 1.5 s).
+            await sleep(1700);
             const syncBefore = calls.sync;
             for (const section of ['2', '3', '4', '5', '6', '7', '1'])
                 await press('section ' + section, section);
@@ -209,6 +253,21 @@ export const menuPerfSuite = {
                 ' ' +
                 slowest.ms +
                 ' ms)');
+            const median = [...took].sort((a, b) => a - b)[Math.floor(took.length / 2)] ?? 9999;
+            t.check(median < 100, 'a key is usually drawn at once (median ' + median + ' ms over ' + took.length + ' keys)');
+            // Left alone, the menu writes nothing: the process list keeps coming (every tick here), but nothing on the
+            // screen changes, so nothing is drawn.
+            await sleep(300);
+            const idleFrom = tty.writes.length;
+            const fetchesFrom = calls.async;
+            await sleep(3000);
+            const idleWrites = tty.writes.slice(idleFrom);
+            const idleBytes = idleWrites.join('').length;
+            t.check(idleWrites.length <= 1 && idleBytes < 4000 && calls.async > fetchesFrom, 'an idle menu writes nothing for 3 s (' +
+                idleWrites.length +
+                ' writes, ' +
+                idleBytes +
+                ' bytes) while the process list is looked at in the background', Text.strip(idleWrites.join('')).slice(0, 300));
             tty.type(KEYS.ctrlC);
             const code = await Promise.race([done, sleep(5000).then(() => -1)]);
             t.check(code === 130, 'Ctrl+C leaves the menu');
@@ -244,5 +303,132 @@ export const menuPerfSuite = {
             await sleep(80);
             t.check(live.line() === 'status b' && changes === 2, 'a stopped status looks at nothing');
         }
+        t.section('the process list is fetched only when it may have changed');
+        {
+            t.equal([0, 1, 2, 3, 4, 10, -1].map((n) => listGap(n, 2500, 30000)), [2500, 5000, 10000, 20000, 30000, 30000, 2500], 'while nothing changes, the gap between two lists doubles up to the longest');
+            t.equal(sandboxPids(TASKLIST + '\r\n"WindowsSandbox.exe","77","Console","1","5 K"'), [4242, 77], 'the ids of the sandbox programs are read from the list');
+            // A sandbox runs: its programs are checked by id, and the list is fetched again only when one has ended.
+            let fetches = 0;
+            let derived = 0;
+            let alive = true;
+            const running = new LiveStatus({
+                fetch: () => {
+                    fetches++;
+                    return Promise.resolve(TASKLIST);
+                },
+                derive: () => String(++derived),
+                onChange: () => undefined,
+                intervalMs: 20,
+                alive: () => alive,
+                needsList: () => true,
+            });
+            await running.start();
+            await sleep(400);
+            t.check(fetches === 1 && derived > 5, 'while the sandbox runs, its programs are checked by id: no new list (' +
+                fetches +
+                ' fetched), the line is still derived (' +
+                derived +
+                ' times)');
+            alive = false;
+            const refetched = await t.waitFor(() => fetches > 1, 3000, 10);
+            running.stop();
+            t.check(refetched === true, 'when one of them has ended, the list is fetched again');
+            // None runs: fewer and fewer lists, one at once after a key press or when the data folder changes.
+            fetches = 0;
+            let signal = 'a';
+            const idle = new LiveStatus({
+                fetch: () => {
+                    fetches++;
+                    return Promise.resolve('"System Idle Process","0","Services","0","8 K"');
+                },
+                derive: () => 'none',
+                onChange: () => undefined,
+                intervalMs: 20,
+                idleMaxMs: 100000,
+                needsList: () => true,
+                signal: () => signal,
+            });
+            await idle.start();
+            await sleep(1000);
+            const quiet = fetches;
+            t.check(quiet >= 2 && quiet <= 8, 'with nothing running, a second of 20 ms ticks fetched the list ' + quiet + ' times (not 50)');
+            signal = 'b';
+            const onSignal = await t.waitFor(() => fetches > quiet, 1000, 5);
+            t.check(onSignal === true, 'a change in the data folder fetches the list at once');
+            await sleep(100);
+            const beforeKey = fetches;
+            idle.touch();
+            const onKey = await t.waitFor(() => fetches > beforeKey, 1000, 5);
+            idle.stop();
+            t.check(onKey === true, 'so does a key press (someone is looking)');
+            // Inside a sandbox the list is never needed: nothing runs tasklist, not even a question asked meanwhile.
+            fetches = 0;
+            let syncRuns = 0;
+            useTasklistRunners({
+                sync: () => {
+                    syncRuns++;
+                    return '';
+                },
+                async: () => Promise.resolve(''),
+            });
+            try {
+                const inside = new LiveStatus({
+                    fetch: () => {
+                        fetches++;
+                        return Promise.resolve('');
+                    },
+                    derive: () => 'inside',
+                    onChange: () => undefined,
+                    intervalMs: 20,
+                    needsList: () => false,
+                });
+                await inside.start();
+                await sleep(200);
+                const list = readTasklist();
+                inside.stop();
+                t.check(fetches === 0 && syncRuns === 0 && list === '', 'when the list is not needed, it is never fetched and nothing asks tasklist meanwhile');
+            }
+            finally {
+                useTasklistRunners();
+            }
+        }
+        t.section('nothing before the menu waits for tasklist');
+        {
+            let asked = 0;
+            const note = staleMountNote(t.dir('no-mounts'), 'main', () => {
+                asked++;
+                return false;
+            });
+            t.check(note === null && asked === 0, 'with no image mounted, "is a sandbox running?" is not even asked');
+        }
+        t.section('the settings file is read once for a whole list');
+        {
+            const file = t.write(t.at('settings', 'config.json'), JSON.stringify({ defaultHarness: 'codex', workspaceFilter: { exclude: ['a', 'b'] } }));
+            const config = new ConfigFile('user', file);
+            const reads = { count: 0 };
+            const original = fs.readFileSync;
+            const counting = ((...args) => {
+                if (String(args[0]) === file)
+                    reads.count++;
+                return original(...args);
+            });
+            fs.readFileSync = counting;
+            let first;
+            try {
+                first = Array.from({ length: 200 }, () => config.valueInFile(['defaultHarness']));
+            }
+            finally {
+                fs.readFileSync = original;
+            }
+            t.check(reads.count === 1 && first.every((v) => v === 'codex'), '200 values in one run read the file once (' + reads.count + ' reads)');
+            const exclude = ['workspaceFilter', 'exclude'];
+            config.valueInFile(exclude).push('c');
+            t.equal(config.valueInFile(exclude), ['a', 'b'], 'a value handed out is a copy (changing it changes nothing)');
+            fs.writeFileSync(file, JSON.stringify({ defaultHarness: 'gemini' }));
+            await Promise.resolve();
+            t.equal(config.valueInFile(['defaultHarness']), 'gemini', 'the next run reads the file again (a change outside)');
+            const result = config.set(['defaultHarness'], 'opencode');
+            t.equal([result, config.valueInFile(['defaultHarness'])], ['saved', 'opencode'], 'a save is seen at once');
+        }
     },
 };

package/dist/selftest/menu.test.js

@@ -725,6 +725,10 @@ export const menuSuite = {
             ['main', false, false],
             ['second', true, true],
         ], 'rename keeps the default and active marks');
+        const ensured = [service.ensure('codex', 'main'), service.activeName('codex'), fs.readFileSync(codexAuth, 'utf8')];
+        t.equal(ensured, ['main', 'main', '{"token":"A"}'], 'a launch with --account switches the sandbox to that login');
+        t.equal([service.ensure('codex', null), service.activeName('codex'), fs.readFileSync(codexAuth, 'utf8')], ['second', 'second', '{"token":"B2"}'], 'a launch without --account switches the sandbox back to the default login');
+        t.equal([service.ensure('claude', null), service.ensure('nobody', 'x')], [null, null], 'an agent with no saved login, or one that keeps no login: nothing to switch');
         await t.throws(() => service.save('x', false, 'nobody'), 'Unknown agent', 'an unknown agent: refused');
         await t.throws(() => service.save('bad name', false, 'codex'), 'Invalid account name', 'bad names are refused');
         t.section('every screen');

package/dist/selftest/remote.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const remoteSuite: Suite;