windows-development-sandbox 1.18.3 → 1.20.0

package/dist/runtime/db.js

@@ -5546,6 +5546,7 @@ var SYSTEM = {
   cmd: () => system32("cmd.exe"),
   powershell: () => system32("WindowsPowerShell\\v1.0\\powershell.exe"),
   tasklist: () => system32("tasklist.exe"),
+  taskkill: () => system32("taskkill.exe"),
   whoami: () => system32("whoami.exe"),
   icacls: () => system32("icacls.exe"),
   tar: () => system32("tar.exe"),
@@ -25326,6 +25327,22 @@ var DatabasesSchema = external_exports.strictObject({
   })
 });
 
+// src/core/schema/codex.ts
+var CodexSchema = external_exports.strictObject({
+  sandboxMode: external_exports.enum(["danger-full-access", "workspace-write", "read-only"]).describe(
+    "Codex's own sandbox. Inside Windows Sandbox Codex's own sandbox only slows it down (it re-grants file permissions over your profile at every boot), so the default is danger-full-access: Windows Sandbox is the sandbox."
+  ),
+  approvalPolicy: external_exports.enum(["never", "on-request", "on-failure", "untrusted"]).describe('When Codex asks before it runs a command. "never" with danger-full-access starts it with no questions.'),
+  model: external_exports.string().max(100).regex(/^[A-Za-z0-9._:/-]*$/, "letters, digits and . _ : / - only").describe("The model Codex uses. Empty = Codex's own default."),
+  reasoningEffort: external_exports.enum(["default", "minimal", "low", "medium", "high", "xhigh"]).describe(`How hard Codex thinks. "default" = Codex's own default.`),
+  windowsSandbox: external_exports.enum(["off", "unelevated", "elevated"]).describe(
+    `Codex's Windows sandbox mode in its config.toml. "off" removes the setting so Codex does not set up its sandbox users and firewall rules at every boot.`
+  ),
+  mcpLoginsInFile: external_exports.boolean().describe(
+    `Keep the sign-ins of Codex's MCP servers in a file in the saved Codex folder (mcp_oauth_credentials_store = "file"), so they survive between sandboxes. A value you set in config.toml is kept.`
+  )
+});
+
 // src/core/schema/harness.ts
 var SubfolderSchema = external_exports.string().regex(/^(?!.*(^|[\\/])\.\.([\\/]|$))[A-Za-z0-9._ -]+([\\/][A-Za-z0-9._ -]+)*$/, "a plain relative folder");
 var HarnessHomeSchema = external_exports.strictObject({
@@ -25638,6 +25655,9 @@ var ToolchainsSchema = external_exports.strictObject({
     keepInstallFiles: external_exports.boolean().describe(
       "Keep an offline copy of the Visual Studio install files in tools\\visualstudio (~10 GB, made once), so later boots install without downloading them again. Skipped while that disk has too little room."
     ),
+    visualStudio: external_exports.enum(["full", "autosdk"]).describe(
+      `"full": install Visual Studio Community (the engine finds it through the Setup API; ~10 GB, redone every boot). "autosdk" (experimental): skip Visual Studio and build an Unreal AutoSDK tree from the portable MSVC in tools\\unreal\\autosdk (kept between sandboxes); UnrealBuildTool finds MSVC through AutoSDK, but the editor's Visual Studio integration is not available. Needs toolchains.msvc (turned on for you).`
+    ),
     persistEngines: external_exports.boolean().describe(
       "Engines the Epic Games Launcher installs go to tools\\unreal\\engines (kept between sandboxes, 40-60 GB each) and are registered with the launcher again every boot. Off: they go on the sandbox disk and are lost when it closes. Engines installed on this PC can be mapped instead (pcInstalls.unrealEngines)."
     ),
@@ -27094,6 +27114,7 @@ var ConfigSchema = external_exports.strictObject({
   apps: AppsSchema,
   claudeProfile: ClaudeProfileSchema,
   harnesses: external_exports.record(NameSchema, HarnessSchema).describe("Agents that can run in the sandbox."),
+  codex: CodexSchema,
   hooks: external_exports.strictObject({ failFast: external_exports.boolean().describe("Stop when a hook script fails.") }),
   projects: ProjectsSchema.describe(
     "Several projects in one sandbox: folders of projects mapped at every start, and adding folders while it runs."
@@ -27295,7 +27316,8 @@ var HeartbeatSchema = external_exports.object({
   topProcesses: external_exports.array(external_exports.object({ name: Text(64), privateMb: external_exports.number().int().min(0).max(1e7) })).max(5),
   /** The disk queue this PC last reported while asking the sandbox to slow down. */
   diskQueueReported: external_exports.number().min(0).max(1e5).optional(),
-  phase: external_exports.enum(["ready", "working"])
+  /** "ending": the sandbox is shutting down in order (idle shutdown, sandbox stop, Windows shutting down). */
+  phase: external_exports.enum(["ready", "working", "ending"])
 });
 var GuestResponseSchema = external_exports.object({
   id: IdSchema,
@@ -27336,6 +27358,8 @@ var ProjectStatusSchema = external_exports.object({
 var VpnStatusSchema = external_exports.object({
   state: external_exports.enum(["off", "starting", "up", "failed"]),
   message: Text(2e3),
+  /** Why it failed, when it did: `auth` (login refused), `unreachable`, `driver`, `timeout` or `other`. */
+  code: external_exports.enum(["auth", "unreachable", "driver", "timeout", "other"]).optional(),
   killSwitch: external_exports.boolean(),
   /** A direct connection was tried after the kill switch was applied: false = it still got out. */
   killSwitchHeld: external_exports.boolean().optional(),
@@ -28636,6 +28660,14 @@ async function setupDatabase(env, plan) {
 // src/guest/setup/environment.ts
 import path23 from "node:path";
 
+// src/guest/agents/agent-files.ts
+var CODEX_MARKER = "# Set by the sandbox";
+var MAX_CODEX_CONFIG_BYTES = 1024 * 1024;
+var MARKED_LINES = new RegExp(
+  "^" + CODEX_MARKER + "[^\r\n]*\r?\n(?:(?:sandbox_mode|approval_policy)[ 	]*=[^\r\n]*\r?\n)*(?:[ 	]*\r?\n)?",
+  "m"
+);
+
 // src/guest/setup/path-plan.ts
 import path22 from "node:path";
 function pathKey(folder) {