windows-development-sandbox 1.12.0 → 1.13.2

package/dist/app/features/defs.d.ts

@@ -11,6 +11,7 @@ export type { SessionRow, SessionsList } from './sessions/sessions.def.js';
 export type { SettingRow, SettingsList } from './settings/settings.def.js';
 export type { VpnStatus } from './vpn/vpn.def.js';
 export type { GithubStatus } from './github/github.def.js';
+export type { AccessStatus } from './access/access.def.js';
 export declare const OPERATIONS: readonly [OperationDef<import("zod").ZodObject<{}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
     available: import("zod").ZodBoolean;
     stopped: import("zod").ZodNumber;
@@ -29,6 +30,22 @@ export declare const OPERATIONS: readonly [OperationDef<import("zod").ZodObject<
 }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
     message: import("zod").ZodString;
 }, import("zod/v4/core").$strip>, "sessions.restart">, OperationDef<import("zod").ZodObject<{
+    project: import("zod").ZodOptional<import("zod").ZodString>;
+    shell: import("zod").ZodDefault<import("zod").ZodEnum<{
+        pwsh: "pwsh";
+        auto: "auto";
+        powershell: "powershell";
+        cmd: "cmd";
+    }>>;
+}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    session: import("zod").ZodString;
+    shell: import("zod").ZodString;
+    message: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, "sessions.shell">, OperationDef<import("zod").ZodObject<{
+    session: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    message: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, "sessions.close">, OperationDef<import("zod").ZodObject<{
     agent: import("zod").ZodString;
     project: import("zod").ZodOptional<import("zod").ZodString>;
 }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
@@ -94,6 +111,7 @@ export declare const OPERATIONS: readonly [OperationDef<import("zod").ZodObject<
 }, import("zod/v4/core").$strip>, "accounts.use">, OperationDef<import("zod").ZodObject<{
     agent: import("zod").ZodDefault<import("zod").ZodString>;
     name: import("zod").ZodOptional<import("zod").ZodString>;
+    noRestart: import("zod").ZodDefault<import("zod").ZodBoolean>;
 }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
     message: import("zod").ZodString;
 }, import("zod/v4/core").$strip>, "accounts.default">, OperationDef<import("zod").ZodObject<{
@@ -257,7 +275,32 @@ export declare const OPERATIONS: readonly [OperationDef<import("zod").ZodObject<
 }, import("zod/v4/core").$strip>, "github.login">, OperationDef<import("zod").ZodObject<{}, import("zod/v4/core").$strict>, import("zod").ZodObject<{
     deleted: import("zod").ZodBoolean;
     message: import("zod").ZodString;
-}, import("zod/v4/core").$strip>, "github.logout">];
+}, import("zod/v4/core").$strip>, "github.logout">, OperationDef<import("zod").ZodObject<{
+    role: import("zod").ZodDefault<import("zod").ZodEnum<{
+        view: "view";
+        control: "control";
+    }>>;
+}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    code: import("zod").ZodString;
+    expiresAt: import("zod").ZodString;
+    role: import("zod").ZodEnum<{
+        view: "view";
+        control: "control";
+    }>;
+    address: import("zod").ZodNullable<import("zod").ZodString>;
+    fingerprint: import("zod").ZodNullable<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>, "access.allowDevice">, OperationDef<import("zod").ZodObject<{
+    id: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    message: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, "access.revoke">, OperationDef<import("zod").ZodObject<{}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    message: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, "access.revokeAll">, OperationDef<import("zod").ZodObject<{}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    message: import("zod").ZodString;
+    address: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, "access.lanOn">, OperationDef<import("zod").ZodObject<{}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    message: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, "access.lanOff">];
 export declare const QUERIES: readonly [QueryDef<import("zod").ZodObject<{}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
     shared: import("zod").ZodOptional<import("zod").ZodObject<{
         line: import("zod").ZodString;
@@ -326,6 +369,10 @@ export declare const QUERIES: readonly [QueryDef<import("zod").ZodObject<{}, imp
         id: import("zod").ZodString;
         launchId: import("zod").ZodString;
         harness: import("zod").ZodString;
+        kind: import("zod").ZodOptional<import("zod").ZodEnum<{
+            shell: "shell";
+            agent: "agent";
+        }>>;
         cwd: import("zod").ZodString;
         project: import("zod").ZodOptional<import("zod").ZodString>;
         phase: import("zod").ZodEnum<{
@@ -623,6 +670,7 @@ export declare const QUERIES: readonly [QueryDef<import("zod").ZodObject<{}, imp
     days: import("zod").ZodDefault<import("zod").ZodNumber>;
     kind: import("zod").ZodDefault<import("zod").ZodEnum<{
         file: "file";
+        remote: "remote";
         all: "all";
         session: "session";
         commit: "commit";
@@ -644,6 +692,7 @@ export declare const QUERIES: readonly [QueryDef<import("zod").ZodObject<{}, imp
         days: import("zod").ZodNumber;
         kind: import("zod").ZodEnum<{
             file: "file";
+            remote: "remote";
             all: "all";
             session: "session";
             commit: "commit";
@@ -660,6 +709,7 @@ export declare const QUERIES: readonly [QueryDef<import("zod").ZodObject<{}, imp
         time: import("zod").ZodString;
         kind: import("zod").ZodEnum<{
             file: "file";
+            remote: "remote";
             session: "session";
             note: "note";
             commit: "commit";
@@ -799,6 +849,9 @@ export declare const QUERIES: readonly [QueryDef<import("zod").ZodObject<{}, imp
     running: import("zod").ZodBoolean;
     port: import("zod").ZodNullable<import("zod").ZodNumber>;
     address: import("zod").ZodNullable<import("zod").ZodString>;
+    lanAddress: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+    lanFingerprint: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+    lanProblem: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
 }, import("zod/v4/core").$strip>, "web.status">, QueryDef<import("zod").ZodObject<{
     tunnel: import("zod").ZodDefault<import("zod").ZodBoolean>;
 }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
@@ -845,7 +898,51 @@ export declare const QUERIES: readonly [QueryDef<import("zod").ZodObject<{}, imp
         classic: "classic";
     }>>;
     savedAt: import("zod").ZodNullable<import("zod").ZodString>;
-}, import("zod/v4/core").$strip>, "github.status">];
+}, import("zod/v4/core").$strip>, "github.status">, QueryDef<import("zod").ZodObject<{}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    lan: import("zod").ZodObject<{
+        enabled: import("zod").ZodBoolean;
+        running: import("zod").ZodBoolean;
+        address: import("zod").ZodNullable<import("zod").ZodString>;
+        fingerprint: import("zod").ZodNullable<import("zod").ZodString>;
+        problem: import("zod").ZodNullable<import("zod").ZodString>;
+        network: import("zod").ZodNullable<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    windowsSignIn: import("zod").ZodBoolean;
+    users: import("zod").ZodArray<import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        role: import("zod").ZodEnum<{
+            view: "view";
+            control: "control";
+        }>;
+    }, import("zod/v4/core").$strip>>;
+    rememberDays: import("zod").ZodNumber;
+    devices: import("zod").ZodArray<import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        name: import("zod").ZodString;
+        role: import("zod").ZodEnum<{
+            view: "view";
+            control: "control";
+        }>;
+        address: import("zod").ZodString;
+        createdAt: import("zod").ZodString;
+        expiresAt: import("zod").ZodString;
+        lastSeen: import("zod").ZodNullable<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>>;
+    windows: import("zod").ZodArray<import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        user: import("zod").ZodString;
+        createdAt: import("zod").ZodString;
+        expiresAt: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>>;
+    pending: import("zod").ZodNullable<import("zod").ZodObject<{
+        role: import("zod").ZodEnum<{
+            view: "view";
+            control: "control";
+        }>;
+        expiresAt: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>>;
+    codeVoided: import("zod").ZodBoolean;
+}, import("zod/v4/core").$strip>, "access.status">];
 export declare const VIEWS: readonly [import("../kernel/define.js").ViewDef<{
     status: QueryDef<import("zod").ZodObject<{}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
         shared: import("zod").ZodOptional<import("zod").ZodObject<{
@@ -917,6 +1014,10 @@ export declare const VIEWS: readonly [import("../kernel/define.js").ViewDef<{
             id: import("zod").ZodString;
             launchId: import("zod").ZodString;
             harness: import("zod").ZodString;
+            kind: import("zod").ZodOptional<import("zod").ZodEnum<{
+                shell: "shell";
+                agent: "agent";
+            }>>;
             cwd: import("zod").ZodString;
             project: import("zod").ZodOptional<import("zod").ZodString>;
             phase: import("zod").ZodEnum<{
@@ -1216,6 +1317,7 @@ export declare const VIEWS: readonly [import("../kernel/define.js").ViewDef<{
         days: import("zod").ZodDefault<import("zod").ZodNumber>;
         kind: import("zod").ZodDefault<import("zod").ZodEnum<{
             file: "file";
+            remote: "remote";
             all: "all";
             session: "session";
             commit: "commit";
@@ -1237,6 +1339,7 @@ export declare const VIEWS: readonly [import("../kernel/define.js").ViewDef<{
             days: import("zod").ZodNumber;
             kind: import("zod").ZodEnum<{
                 file: "file";
+                remote: "remote";
                 all: "all";
                 session: "session";
                 commit: "commit";
@@ -1253,6 +1356,7 @@ export declare const VIEWS: readonly [import("../kernel/define.js").ViewDef<{
             time: import("zod").ZodString;
             kind: import("zod").ZodEnum<{
                 file: "file";
+                remote: "remote";
                 session: "session";
                 note: "note";
                 commit: "commit";
@@ -1374,6 +1478,9 @@ export declare const VIEWS: readonly [import("../kernel/define.js").ViewDef<{
         running: import("zod").ZodBoolean;
         port: import("zod").ZodNullable<import("zod").ZodNumber>;
         address: import("zod").ZodNullable<import("zod").ZodString>;
+        lanAddress: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+        lanFingerprint: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+        lanProblem: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
     }, import("zod/v4/core").$strip>, "web.status">;
 }, Record<string, never>, "web">, import("../kernel/define.js").ViewDef<{
     status: QueryDef<import("zod").ZodObject<{
@@ -1425,7 +1532,53 @@ export declare const VIEWS: readonly [import("../kernel/define.js").ViewDef<{
         }>>;
         savedAt: import("zod").ZodNullable<import("zod").ZodString>;
     }, import("zod/v4/core").$strip>, "github.status">;
-}, Record<string, never>, "github">];
+}, Record<string, never>, "github">, import("../kernel/define.js").ViewDef<{
+    status: QueryDef<import("zod").ZodObject<{}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        lan: import("zod").ZodObject<{
+            enabled: import("zod").ZodBoolean;
+            running: import("zod").ZodBoolean;
+            address: import("zod").ZodNullable<import("zod").ZodString>;
+            fingerprint: import("zod").ZodNullable<import("zod").ZodString>;
+            problem: import("zod").ZodNullable<import("zod").ZodString>;
+            network: import("zod").ZodNullable<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>;
+        windowsSignIn: import("zod").ZodBoolean;
+        users: import("zod").ZodArray<import("zod").ZodObject<{
+            name: import("zod").ZodString;
+            role: import("zod").ZodEnum<{
+                view: "view";
+                control: "control";
+            }>;
+        }, import("zod/v4/core").$strip>>;
+        rememberDays: import("zod").ZodNumber;
+        devices: import("zod").ZodArray<import("zod").ZodObject<{
+            id: import("zod").ZodString;
+            name: import("zod").ZodString;
+            role: import("zod").ZodEnum<{
+                view: "view";
+                control: "control";
+            }>;
+            address: import("zod").ZodString;
+            createdAt: import("zod").ZodString;
+            expiresAt: import("zod").ZodString;
+            lastSeen: import("zod").ZodNullable<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        windows: import("zod").ZodArray<import("zod").ZodObject<{
+            id: import("zod").ZodString;
+            user: import("zod").ZodString;
+            createdAt: import("zod").ZodString;
+            expiresAt: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>>;
+        pending: import("zod").ZodNullable<import("zod").ZodObject<{
+            role: import("zod").ZodEnum<{
+                view: "view";
+                control: "control";
+            }>;
+            expiresAt: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>>;
+        codeVoided: import("zod").ZodBoolean;
+    }, import("zod/v4/core").$strip>, "access.status">;
+}, Record<string, never>, "access">];
 export type Operation = (typeof OPERATIONS)[number];
 export type Query = (typeof QUERIES)[number];
 export type View = (typeof VIEWS)[number];

package/dist/app/features/defs.js

@@ -10,18 +10,21 @@ import { hideWindow, sandboxStatus, sandboxView, showWindow, stopSandbox } from
 import { addProject, allProjects, chooseProjects, excludeProject, includeProject, listProjects, projectRoots, projectsView, removeProject, } from './projects/projects.def.js';
 import { listLogs, logsView, tailLog } from './logs/logs.def.js';
 import { auditView, listAudit } from './audit/audit.def.js';
-import { listSessions, restartSessions, sessionsView } from './sessions/sessions.def.js';
+import { closeSession, listSessions, restartSessions, sessionsView, startShell } from './sessions/sessions.def.js';
 import { vpnLogin, vpnLogout, vpnStatus, vpnView } from './vpn/vpn.def.js';
 import { githubLogin, githubLogout, githubStatus, githubView } from './github/github.def.js';
 import { exportConfig, getSetting, importConfig, listSettings, resetSetting, setSetting, settingsView, } from './settings/settings.def.js';
 import { migrateSettings, runUpdate, updatesStatus, updatesView } from './updates/updates.def.js';
 import { openWeb, startWeb, stopWeb, webStatus, webView } from './web/web.def.js';
+import { accessStatus, accessView, allowDevice, lanOff, lanOn, revokeAccess, revokeAllAccess, } from './access/access.def.js';
 export const OPERATIONS = [
     cleanEngine,
     showWindow,
     hideWindow,
     stopSandbox,
     restartSessions,
+    startShell,
+    closeSession,
     startAgent,
     addAgent,
     makeDefaultAgent,
@@ -64,6 +67,11 @@ export const OPERATIONS = [
     vpnLogout,
     githubLogin,
     githubLogout,
+    allowDevice,
+    revokeAccess,
+    revokeAllAccess,
+    lanOn,
+    lanOff,
 ];
 export const QUERIES = [
     sandboxStatus,
@@ -89,6 +97,7 @@ export const QUERIES = [
     webStatus,
     vpnStatus,
     githubStatus,
+    accessStatus,
 ];
 export const VIEWS = [
     sandboxView,
@@ -108,6 +117,7 @@ export const VIEWS = [
     webView,
     vpnView,
     githubView,
+    accessView,
 ];
 export const DEFINITIONS = [...OPERATIONS, ...QUERIES];
 export function definitionById(id) {
@@ -155,6 +165,7 @@ export const NAV = [
         ],
     },
     { label: 'Accounts', view: 'accounts' },
+    { label: 'Remote access', view: 'access' },
     {
         label: 'Maintenance',
         children: [

package/dist/app/features/files/files.def.js

@@ -22,6 +22,7 @@ export const FolderListingSchema = z.object({
 });
 export const browseFolder = defineQuery({
     id: 'files.browse',
+    access: 'owner',
     title: 'Browse folders',
     summary: 'list what is in a folder of this PC, to pick a folder or a file',
     input: z.object({

package/dist/app/features/health/health.def.js

@@ -131,6 +131,7 @@ export const lastHealth = defineQuery({
 });
 export const checkHealth = defineOperation({
     id: 'health.check',
+    access: 'control',
     title: 'Check this PC',
     summary: 'check this PC, the install, your settings and the sandbox (changes nothing)',
     input: z.object({ harness: z.string().optional().describe('agent to check') }),

package/dist/app/features/sandbox/sandbox.def.js

@@ -91,6 +91,7 @@ export const sandboxStatus = defineQuery({
 });
 export const showWindow = defineOperation({
     id: 'sandbox.showWindow',
+    access: 'control',
     title: 'Show the window',
     summary: 'show the sandbox window',
     input: z.object({}),
@@ -100,6 +101,7 @@ export const showWindow = defineOperation({
 });
 export const hideWindow = defineOperation({
     id: 'sandbox.hideWindow',
+    access: 'control',
     title: 'Hide the window',
     summary: 'hide the sandbox window (it keeps running)',
     input: z.object({}),
@@ -109,6 +111,7 @@ export const hideWindow = defineOperation({
 });
 export const stopSandbox = defineOperation({
     id: 'sandbox.stop',
+    access: 'control',
     title: 'Stop the sandbox…',
     summary: "shut the sandbox down (every project's sessions end)",
     input: z.object({}),

package/dist/app/features/sessions/sessions.def.d.ts

@@ -5,6 +5,10 @@ export declare const SessionRowSchema: z.ZodObject<{
     id: z.ZodString;
     launchId: z.ZodString;
     harness: z.ZodString;
+    kind: z.ZodOptional<z.ZodEnum<{
+        shell: "shell";
+        agent: "agent";
+    }>>;
     cwd: z.ZodString;
     project: z.ZodOptional<z.ZodString>;
     phase: z.ZodEnum<{
@@ -36,6 +40,10 @@ export declare const SessionsListSchema: z.ZodObject<{
         id: z.ZodString;
         launchId: z.ZodString;
         harness: z.ZodString;
+        kind: z.ZodOptional<z.ZodEnum<{
+            shell: "shell";
+            agent: "agent";
+        }>>;
         cwd: z.ZodString;
         project: z.ZodOptional<z.ZodString>;
         phase: z.ZodEnum<{
@@ -74,6 +82,10 @@ export declare const listSessions: import("../../kernel/define.js").QueryDef<z.Z
         id: z.ZodString;
         launchId: z.ZodString;
         harness: z.ZodString;
+        kind: z.ZodOptional<z.ZodEnum<{
+            shell: "shell";
+            agent: "agent";
+        }>>;
         cwd: z.ZodString;
         project: z.ZodOptional<z.ZodString>;
         phase: z.ZodEnum<{
@@ -102,6 +114,26 @@ export declare const restartSessions: import("../../kernel/define.js").Operation
 }, z.core.$strip>, z.ZodObject<{
     message: z.ZodString;
 }, z.core.$strip>, "sessions.restart">;
+/** The shells a shell session can run; auto: PowerShell 7 when the sandbox has it, else Windows PowerShell. */
+export declare const SHELL_CHOICES: readonly ["auto", "pwsh", "powershell", "cmd"];
+export declare const startShell: import("../../kernel/define.js").OperationDef<z.ZodObject<{
+    project: z.ZodOptional<z.ZodString>;
+    shell: z.ZodDefault<z.ZodEnum<{
+        pwsh: "pwsh";
+        auto: "auto";
+        powershell: "powershell";
+        cmd: "cmd";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    session: z.ZodString;
+    shell: z.ZodString;
+    message: z.ZodString;
+}, z.core.$strip>, "sessions.shell">;
+export declare const closeSession: import("../../kernel/define.js").OperationDef<z.ZodObject<{
+    session: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+}, z.core.$strip>, "sessions.close">;
 /** The sessions page: one list (a table on the command line), this folder's project first. */
 export declare function sessionsPage(o: SessionsList): Page;
 export declare const sessionsView: import("../../kernel/define.js").ViewDef<{
@@ -116,6 +148,10 @@ export declare const sessionsView: import("../../kernel/define.js").ViewDef<{
             id: z.ZodString;
             launchId: z.ZodString;
             harness: z.ZodString;
+            kind: z.ZodOptional<z.ZodEnum<{
+                shell: "shell";
+                agent: "agent";
+            }>>;
             cwd: z.ZodString;
             project: z.ZodOptional<z.ZodString>;
             phase: z.ZodEnum<{

package/dist/app/features/sessions/sessions.def.js

@@ -1,6 +1,6 @@
-// The agent sessions of the running sandbox: the list (live) and restarting the agents. Pure: schemas, labels and the
-// view; sessions.run.ts does the work. A running session links to its terminal (attach in the menu, the terminal page
-// in the web UI).
+// The sessions of the running sandbox, agents and plain shells: the list (live), restarting the agents, opening a shell
+// and closing a session. Pure: schemas, labels and the view; sessions.run.ts does the work. A running session links to
+// its terminal (attach in the menu and on the command line, the terminal page in the web UI).
 import { z } from 'zod';
 import { action, ago, defineOperation, defineQuery, defineView, link, } from '../../kernel/index.js';
 const ViewersSchema = z.object({ viewers: z.number(), remote: z.number() });
@@ -8,7 +8,9 @@ const ViewersSchema = z.object({ viewers: z.number(), remote: z.number() });
 export const SessionRowSchema = z.object({
     id: z.string().describe('The session'),
     launchId: z.string(),
-    harness: z.string().describe('The agent'),
+    harness: z.string().describe('The agent, or the shell (pwsh, powershell, cmd)'),
+    /** A plain shell rather than an agent (absent: an agent). */
+    kind: z.enum(['agent', 'shell']).optional(),
     cwd: z.string().describe('Its folder in the sandbox'),
     project: z.string().optional(),
     phase: z.enum(['starting', 'running', 'exited', 'failed']).describe('What it is doing'),
@@ -50,7 +52,7 @@ export function orderedSessions(list) {
 export const listSessions = defineQuery({
     id: 'sessions.list',
     title: 'Sessions',
-    summary: 'list agent sessions and who is attached',
+    summary: 'list sessions (agents and shells) and who is attached',
     input: z.object({ wide: z.boolean().default(false).describe("also show each session's folder") }),
     output: SessionsListSchema,
     live: { everyMs: 2500 },
@@ -65,6 +67,7 @@ export const listSessions = defineQuery({
 });
 export const restartSessions = defineOperation({
     id: 'sessions.restart',
+    access: 'control',
     title: 'Restart agents',
     summary: "restart this project's running agents in place; they resume their conversation",
     input: z.object({
@@ -82,19 +85,71 @@ export const restartSessions = defineOperation({
         },
     },
 });
+/** Agent and project names as the web UI has always accepted them. */
+const NameText = z.string().regex(/^[A-Za-z0-9_.-]{1,64}$/);
+const SessionId = z.string().regex(/^[A-Za-z0-9_-]{1,64}$/);
+/** The shells a shell session can run; auto: PowerShell 7 when the sandbox has it, else Windows PowerShell. */
+export const SHELL_CHOICES = ['auto', 'pwsh', 'powershell', 'cmd'];
+/** The session the operation opened, as a link to its terminal. */
+function openedSession(o) {
+    return { kind: 'terminal', session: o.session };
+}
+export const startShell = defineOperation({
+    id: 'sessions.shell',
+    title: 'New shell',
+    summary: 'open PowerShell or cmd in a project of the running sandbox, as a session you can attach to',
+    input: z.object({
+        project: NameText.optional().describe("The project of the running sandbox (default: this folder's, else asked)"),
+        shell: z
+            .enum(SHELL_CHOICES)
+            .default('auto')
+            .describe('The shell: pwsh, powershell or cmd (default: pwsh if present)'),
+    }),
+    output: z.object({
+        session: z.string().describe('The new session'),
+        shell: z.string().describe('The shell it runs'),
+        message: z.string().describe('What happened'),
+    }),
+    // A shell runs anything as you: someone you let in remotely may type into one you opened, never open one.
+    access: 'owner',
+    text: (o) => o.message,
+    opens: openedSession,
+    cli: {
+        name: 'shell',
+        group: 'Sessions',
+        positional: ['project'],
+        flags: { shell: { flag: '--shell', value: 'name', choices: ['pwsh', 'powershell', 'cmd'] } },
+        json: true,
+        examples: [
+            "sandbox shell                      PowerShell in this folder's project, in this terminal (Ctrl+] detaches)",
+            'sandbox shell api --shell cmd      cmd in the project api',
+        ],
+    },
+});
+export const closeSession = defineOperation({
+    id: 'sessions.close',
+    title: 'Close',
+    summary: 'end a running session (an agent or a shell) and every program it started',
+    input: z.object({ session: SessionId.describe('The session to close') }),
+    output: z.object({ message: z.string().describe("The sandbox's answer") }),
+    access: 'control',
+    danger: true,
+    text: (o) => o.message,
+    cli: { name: 'close', group: 'Sessions', positional: ['session'], examples: ['sandbox close 4f2c9a'] },
+});
 function sessionItem(s, wide) {
     const state = s.phase + (s.exitCode !== undefined ? ' (' + s.exitCode + ')' : '');
     const running = s.phase === 'running';
     return {
         id: s.id,
-        label: s.harness + '  ' + (s.projectName ?? '-'),
+        label: (s.kind === 'shell' ? s.harness + ' (shell)' : s.harness) + '  ' + (s.projectName ?? '-'),
         hint: state + '  ' + ago(s.startedAt),
         badges: [{ text: s.phase, tone: running ? 'ok' : s.phase === 'failed' ? 'danger' : 'muted' }],
         group: s.here ? "This folder's project" : 'Other sessions',
         marked: s.here,
         icon: s.harness,
         description: running
-            ? "Opens this session's terminal (in a terminal, Ctrl+] detaches; the session keeps running)."
+            ? "Opens this session's terminal (in a terminal, Ctrl+] detaches; the session keeps running). x closes it."
             : undefined,
         details: ['Session   ' + s.id, 'Folder    ' + s.cwd, 'Attached  ' + viewerText(s.viewers)],
         cells: {
@@ -108,6 +163,9 @@ function sessionItem(s, wide) {
             started: ago(s.startedAt),
         },
         ...(running && s.canOpen ? { primary: link({ kind: 'terminal', session: s.id }, 'Open', { verb: 'attach' }) } : {}),
+        ...(running
+            ? { actions: [action(closeSession, { session: s.id }, { key: 'x', verb: 'close', importance: 1 })] }
+            : {}),
         ...(running ? {} : { disabled: 'This session has ended.' }),
         ...(running && !s.canOpen ? { disabled: 'Not reachable from this PC.' } : {}),
     };
@@ -150,6 +208,16 @@ export function sessionsPage(o) {
         ],
         actions: [
             ...(o.sandboxRunning ? [{ ...start, label: 'New session', key: 'n', verb: 'new session', importance: 1 }] : []),
+            ...(o.sandboxRunning
+                ? [
+                    action(startShell, { shell: 'auto' }, {
+                        key: 's',
+                        verb: 'new shell',
+                        importance: 1,
+                        description: 'Opens PowerShell in a project of the sandbox, as a session like the agents.',
+                    }),
+                ]
+                : []),
             ...(sessions.length
                 ? [action(restartSessions, { all: false }, { key: 'r', verb: 'restart agents', importance: 1 })]
                 : []),
@@ -172,8 +240,8 @@ export function sessionsPage(o) {
 export const sessionsView = defineView({
     id: 'sessions',
     title: 'Sessions',
-    summary: 'The agent sessions of the running sandbox: open one, restart the agents.',
+    summary: 'The sessions of the running sandbox: open one, restart the agents, open a shell, close one.',
     queries: { sessions: listSessions },
-    operations: [restartSessions],
+    operations: [restartSessions, startShell, closeSession],
     build: ({ sessions }) => sessionsPage(sessions),
 });

package/dist/app/features/sessions/sessions.run.d.ts

@@ -1,3 +1,4 @@
+import { type Context } from '../../../cli/commands/context.js';
 export declare const listSessionsRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").QueryDef<import("zod").ZodObject<{
     wide: import("zod").ZodDefault<import("zod").ZodBoolean>;
 }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
@@ -9,6 +10,10 @@ export declare const listSessionsRun: import("../../kernel/define.js").Implement
         id: import("zod").ZodString;
         launchId: import("zod").ZodString;
         harness: import("zod").ZodString;
+        kind: import("zod").ZodOptional<import("zod").ZodEnum<{
+            shell: "shell";
+            agent: "agent";
+        }>>;
         cwd: import("zod").ZodString;
         project: import("zod").ZodOptional<import("zod").ZodString>;
         phase: import("zod").ZodEnum<{
@@ -30,10 +35,28 @@ export declare const listSessionsRun: import("../../kernel/define.js").Implement
         }, import("zod/v4/core").$strip>>>;
         canOpen: import("zod").ZodBoolean;
     }, import("zod/v4/core").$strip>>;
-}, import("zod/v4/core").$strip>, "sessions.list">, import("../../../cli/commands/context.js").Context>;
+}, import("zod/v4/core").$strip>, "sessions.list">, Context>;
 export declare const restartSessionsRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").OperationDef<import("zod").ZodObject<{
     harness: import("zod").ZodOptional<import("zod").ZodString>;
     all: import("zod").ZodDefault<import("zod").ZodBoolean>;
 }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
     message: import("zod").ZodString;
-}, import("zod/v4/core").$strip>, "sessions.restart">, import("../../../cli/commands/context.js").Context>;
+}, import("zod/v4/core").$strip>, "sessions.restart">, Context>;
+export declare const startShellRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").OperationDef<import("zod").ZodObject<{
+    project: import("zod").ZodOptional<import("zod").ZodString>;
+    shell: import("zod").ZodDefault<import("zod").ZodEnum<{
+        pwsh: "pwsh";
+        auto: "auto";
+        powershell: "powershell";
+        cmd: "cmd";
+    }>>;
+}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    session: import("zod").ZodString;
+    shell: import("zod").ZodString;
+    message: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, "sessions.shell">, Context>;
+export declare const closeSessionRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").OperationDef<import("zod").ZodObject<{
+    session: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    message: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, "sessions.close">, Context>;