windows-development-sandbox 1.12.0 → 1.13.2

package/dist/selftest/resume.test.js

@@ -57,6 +57,7 @@ export const resumeSuite = {
             status({ id: 's2', harness: 'codex', cwd: 'C:\\Workspace\\web\\src', startedAt: minutes(20) }),
             status({ id: 's3', phase: 'exited' }),
             status({ id: 's4', cwd: 'D:\\nowhere' }),
+            status({ id: 's5', harness: 'pwsh', kind: 'shell' }),
         ], reg, NOW);
         const saved = ledger.read();
         t.equal([saved?.sessions.map((s) => [s.harness, s.project, s.conversation]), saved?.launch.projects], [
@@ -65,7 +66,7 @@ export const resumeSuite = {
                 ['codex', 'F:\\code\\web\\src', undefined],
             ],
             ['F:\\code\\web'],
-        ], 'running sessions are noted with their folder on this PC (ended ones and unknown folders are not), and the projects');
+        ], 'running sessions are noted with their folder on this PC (ended ones, unknown folders and shells are not), and the projects');
         ledger.recordSessions([
             status({ startedAt: minutes(30) }),
             status({ id: 's2', harness: 'codex', cwd: 'C:\\Workspace\\web\\src', startedAt: minutes(20) }),

package/dist/selftest/sharing.test.js

@@ -142,7 +142,7 @@ async function permissionPlan(t) {
     await t.throws(() => sharingAclPlan({ storageUserDir, dataPath: t.at('elsewhere', 'default'), groupSid: GROUP_SID, on: true }), 'not under', 'a data set outside the user folder is refused');
 }
 /** The PowerShell script: it parses, changes a temp folder's permissions, and refuses links. Windows only. */
-function folderScript(t) {
+async function folderScript(t) {
     t.section('set-folder-access.ps1');
     if (process.platform !== 'win32') {
         t.skip('the folder-permission script runs only on Windows');
@@ -223,6 +223,13 @@ function folderScript(t) {
     fs.mkdirSync(path.join(own, 'child'));
     fs.writeFileSync(path.join(own, 'child', 'a.txt'), 'x');
     t.check(fs.readFileSync(path.join(own, 'child', 'a.txt'), 'utf8') === 'x', 'the owner can still use a private folder');
+    // Security review 2026-10: under an all-users install another member of the group can create users\<you> first.
+    const theirs = t.dir('acl-someone-elses');
+    const given = spawnSync(SYSTEM.icacls(), [theirs, '/setowner', '*S-1-5-18'], { encoding: 'utf8', windowsHide: true });
+    if (given.status !== 0)
+        t.skip('a folder owned by someone else (cannot give a folder to SYSTEM here)');
+    else
+        await t.throws(() => runPrivateFolder(theirs), 'not to you', 'a folder someone else owns is refused, never made "private" for you (its owner could open it again)');
 }
 export const sharingSuite = {
     name: 'sharing',
@@ -236,7 +243,7 @@ export const sharingSuite = {
             recordsSection(t);
             ownership(t);
             await permissionPlan(t);
-            folderScript(t);
+            await folderScript(t);
         }
         finally {
             // Later suites load the settings too: the machine file this suite wrote must not outlive it.

package/dist/selftest/support/fixtures.d.ts

@@ -263,6 +263,19 @@ export declare function createFixtures(t: Harness): {
             enabled: boolean;
             port: number;
             openOnLaunch: boolean;
+            remote: {
+                windowsSignIn: boolean;
+                users: {
+                    name: string;
+                    role: "view" | "control";
+                }[];
+                rememberDays: number;
+                lan: {
+                    enabled: boolean;
+                    port: number;
+                    address: string;
+                };
+            };
         };
         agentCommands: {
             enabled: boolean;

package/dist/selftest/support/web-preview.js

@@ -594,9 +594,55 @@ function sampleAuditLog(dir) {
             sv: undefined,
         },
         proc(5, node, 'node dist/bin/agent-sandbox.js self-test app', claude),
+        { t: at(4), k: 'remote', p: 'sessions.restart', a: 'ok', au: "device Josh's iPhone" },
+        { t: at(3), k: 'remote', p: 'settings.set', a: 'refused', au: 'Windows user DESKTOP-JOSH\\sam' },
     ]);
     return log;
 }
+const ACCESS_FINGERPRINT = '3A:7F:01:C2:9B:44:E8:15:6D:A0:2B:93:CC:71:58:0E:F4:12:9A:BD:63:07:E5:2C:48:D9:B1:76:0A:3F:C8:E2';
+/** Remote access: LAN mode on, two devices, one Windows sign-in, a code waiting. */
+function sampleAccess() {
+    const at = (hours) => new Date(Date.now() + hours * 3_600_000).toISOString();
+    return {
+        lan: {
+            enabled: true,
+            running: true,
+            address: 'https://192.168.1.20:47801',
+            fingerprint: ACCESS_FINGERPRINT,
+            problem: null,
+            network: 'Home Wi-Fi',
+        },
+        windowsSignIn: true,
+        users: [
+            { name: 'sam', role: 'view' },
+            { name: 'OFFICE\\kim', role: 'control' },
+        ],
+        rememberDays: 30,
+        devices: [
+            {
+                id: '4f2c9a7e1b3d5f60',
+                name: "Josh's iPhone",
+                role: 'control',
+                address: '192.168.1.42',
+                createdAt: at(-24 * 6),
+                expiresAt: at(24 * 24),
+                lastSeen: at(-0.2),
+            },
+            {
+                id: '9d1e0b2a7c4f6e83',
+                name: 'Kitchen tablet',
+                role: 'view',
+                address: '192.168.1.57',
+                createdAt: at(-24 * 20),
+                expiresAt: at(24 * 10),
+                lastSeen: at(-30),
+            },
+        ],
+        windows: [{ id: '1a2b3c4d5e6f7a8b', user: 'DESKTOP-JOSH\\sam', createdAt: at(-3), expiresAt: at(24 * 30 - 3) }],
+        pending: { role: 'view', expiresAt: at(0.06) },
+        codeVoided: false,
+    };
+}
 /** The real features where they only touch the temp folder, sample data for the rest. */
 function previewRpc(ctx, state) {
     const auditDir = path.join(ctx.storageRoot, 'audit', 'preview');
@@ -608,6 +654,16 @@ function previewRpc(ctx, state) {
                 return auditListing(audit, { enabled: true, days: 7, maxMb: 100 }, listAudit.input.parse(input ?? {}), auditDir);
             case 'sandbox.status':
                 return sampleStatus(state.running);
+            case 'access.status':
+                return sampleAccess();
+            case 'access.allowDevice':
+                return {
+                    code: 'K7QD-M2XP',
+                    expiresAt: new Date(Date.now() + 5 * 60_000).toISOString(),
+                    role: input?.role ?? 'view',
+                    address: 'https://192.168.1.20:47801',
+                    fingerprint: ACCESS_FINGERPRINT,
+                };
             case 'vpn.status':
                 return vpnStatus.output.parse({
                     enabled: true,
@@ -886,9 +942,16 @@ function previewRpc(ctx, state) {
         'engine.status': 'query',
         'engine.leftovers': 'query',
         'audit.list': 'query',
+        'access.status': 'query',
+        'access.allowDevice': 'operation',
+        'access.revoke': 'operation',
+        'access.revokeAll': 'operation',
+        'access.lanOn': 'operation',
+        'access.lanOff': 'operation',
     };
     return {
         kind: (id) => kinds[id],
+        need: (id) => (kinds[id] ? 'view' : undefined),
         liveMs: (id) => (id === 'sandbox.status' || id === 'sessions.list' ? 2500 : id === 'logs.tail' ? 1000 : undefined),
         run: async (id, input, io) => id !== 'apps.request' && (id.startsWith('settings.') || id.startsWith('apps.') || id === 'files.browse')
             ? runDefinition(id, ctx, input, io)

package/dist/selftest/web.test.js

@@ -105,6 +105,7 @@ function fakeRpc() {
     const host = {
         kind: (id) => (id === 'test.work' ? 'operation' : id === 'test.live' ? 'query' : undefined),
         liveMs: (id) => (id === 'test.live' ? 50 : undefined),
+        need: (id) => (id === 'test.work' ? 'control' : id === 'test.live' ? 'view' : undefined),
         run: async (id, input, io) => {
             ran.push(id);
             if (id === 'test.live')
@@ -216,6 +217,7 @@ export const webSuite = {
             let reads = 0;
             const host = {
                 kind: () => 'query',
+                need: () => 'view',
                 liveMs: () => 40,
                 run: async () => {
                     reads++;

package/dist/shared/channel/schema.d.ts

@@ -200,6 +200,14 @@ export declare const ProjectSpecSchema: z.ZodObject<{
     }, z.core.$strict>>;
     hooks: z.ZodBoolean;
 }, z.core.$strict>;
+/** The plain shells a session can run instead of an agent; auto: PowerShell 7 when the sandbox has it, else 5.1. */
+export declare const ShellChoiceSchema: z.ZodEnum<{
+    pwsh: "pwsh";
+    auto: "auto";
+    powershell: "powershell";
+    cmd: "cmd";
+}>;
+export type ShellChoice = z.output<typeof ShellChoiceSchema>;
 /** C:\AgentData\run\requests\<id>.json: the ONLY things the host can ask the sandbox to do. */
 export declare const GuestRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"session">;
@@ -378,6 +386,17 @@ export declare const GuestRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         resumeArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
         resumeOneArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
+    shell: z.ZodOptional<z.ZodEnum<{
+        pwsh: "pwsh";
+        auto: "auto";
+        powershell: "powershell";
+        cmd: "cmd";
+    }>>;
+    createdAt: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"close">;
+    id: z.ZodString;
+    session: z.ZodString;
     createdAt: z.ZodString;
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"project">;
@@ -603,6 +622,10 @@ export declare const SessionStatusSchema: z.ZodObject<{
     id: z.ZodString;
     launchId: z.ZodString;
     harness: z.ZodString;
+    kind: z.ZodOptional<z.ZodEnum<{
+        shell: "shell";
+        agent: "agent";
+    }>>;
     cwd: z.ZodString;
     project: z.ZodOptional<z.ZodString>;
     phase: z.ZodEnum<{

package/dist/shared/channel/schema.js

@@ -60,6 +60,8 @@ export const ProjectSpecSchema = z.strictObject({
     /** Its hooks were staged in C:\AgentLaunch\projects\<name>\hooks. */
     hooks: z.boolean(),
 });
+/** The plain shells a session can run instead of an agent; auto: PowerShell 7 when the sandbox has it, else 5.1. */
+export const ShellChoiceSchema = z.enum(['auto', 'pwsh', 'powershell', 'cmd']);
 /** C:\AgentData\run\requests\<id>.json: the ONLY things the host can ask the sandbox to do. */
 export const GuestRequestSchema = z.discriminatedUnion('kind', [
     z.strictObject({
@@ -70,8 +72,12 @@ export const GuestRequestSchema = z.discriminatedUnion('kind', [
         cwd: Text(),
         project: ProjectSpecSchema.optional(),
         harnessSpec: HarnessSchema.optional(),
+        /** A plain shell instead of an agent (harness is then "shell" and args are ignored). */
+        shell: ShellChoiceSchema.optional(),
         createdAt: TimeSchema,
     }),
+    /** End a running session (an agent or a shell) and everything it started. */
+    z.strictObject({ kind: z.literal('close'), id: IdSchema, session: IdSchema, createdAt: TimeSchema }),
     /** Provision a registered project without starting an agent (sandbox start / exec / db from its folder). */
     z.strictObject({ kind: z.literal('project'), id: IdSchema, project: ProjectSpecSchema, createdAt: TimeSchema }),
     z.strictObject({
@@ -140,6 +146,8 @@ export const SessionStatusSchema = z.object({
     id: IdSchema,
     launchId: Text(64),
     harness: Text(64),
+    /** A plain shell (harness is then the shell: pwsh, powershell or cmd); absent: an agent. */
+    kind: z.enum(['agent', 'shell']).optional(),
     cwd: Text(),
     /** The project it runs in: its hub name, or the launch folder's for the first project. */
     project: Text(64).optional(),

package/dist/shared/pty/protocol.d.ts

@@ -4,6 +4,8 @@ export declare const FrameType: {
     readonly Resize: 3;
     readonly Restart: 4;
     readonly Ping: 5;
+    /** Ends the program and everything it started, and with it the session. */
+    readonly Close: 6;
     readonly Output: 16;
     readonly Exit: 17;
     readonly Error: 18;

package/dist/shared/pty/protocol.js

@@ -6,6 +6,8 @@ export const FrameType = {
     Resize: 3,
     Restart: 4,
     Ping: 5,
+    /** Ends the program and everything it started, and with it the session. */
+    Close: 6,
     Output: 16,
     Exit: 17,
     Error: 18,

package/dist/web/index.html

@@ -6,7 +6,7 @@
     <title>Sandbox</title>
     <link rel="icon" href="data:," />
     <link rel="stylesheet" href="/main-UAQPI5XD.css" />
-    <script type="module" src="/main-UD4QCXZR.js"></script>
+    <script type="module" src="/main-NBQ3LF4E.js"></script>
   </head>
   <body>
     <div id="root"></div>