windows-development-sandbox 1.18.4 → 1.20.0

package/dist/bin/claude-host.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-N4GXYTLV.js";
-import "./chunk-FRPLQLSY.js";
+} from "./chunk-DK4NTBUF.js";
+import "./chunk-Z2P5OGKL.js";
 
 // src/bin/claude-host.ts
 var args = process.argv.slice(2);

package/dist/bin/claude-sbx.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-N4GXYTLV.js";
-import "./chunk-FRPLQLSY.js";
+} from "./chunk-DK4NTBUF.js";
+import "./chunk-Z2P5OGKL.js";
 
 // src/bin/claude-sbx.ts
 run(process.argv.slice(2), { harness: "claude" });

package/dist/bin/codex-sbx.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-N4GXYTLV.js";
-import "./chunk-FRPLQLSY.js";
+} from "./chunk-DK4NTBUF.js";
+import "./chunk-Z2P5OGKL.js";
 
 // src/bin/codex-sbx.ts
 run(process.argv.slice(2), { harness: "codex" });

package/dist/bin/gemini-sbx.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-N4GXYTLV.js";
-import "./chunk-FRPLQLSY.js";
+} from "./chunk-DK4NTBUF.js";
+import "./chunk-Z2P5OGKL.js";
 
 // src/bin/gemini-sbx.ts
 run(process.argv.slice(2), { harness: "gemini" });

package/dist/bin/sandbox.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-N4GXYTLV.js";
-import "./chunk-FRPLQLSY.js";
+} from "./chunk-DK4NTBUF.js";
+import "./chunk-Z2P5OGKL.js";
 
 // src/bin/sandbox.ts
 run(process.argv.slice(2));

package/dist/bin/sbx-hide.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-N4GXYTLV.js";
-import "./chunk-FRPLQLSY.js";
+} from "./chunk-DK4NTBUF.js";
+import "./chunk-Z2P5OGKL.js";
 
 // src/bin/sbx-hide.ts
 run(process.argv.slice(2), { command: "hide" });

package/dist/bin/sbx-show.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-N4GXYTLV.js";
-import "./chunk-FRPLQLSY.js";
+} from "./chunk-DK4NTBUF.js";
+import "./chunk-Z2P5OGKL.js";
 
 // src/bin/sbx-show.ts
 run(process.argv.slice(2), { command: "show" });

package/dist/cli/commands/agent-commands.d.ts

@@ -3,4 +3,3 @@ import type { Reconciled } from '../../host/agent-commands/index.js';
 import { type Context } from './context.js';
 /** Brings this PC in line with agentCommands and says what changed (used after on/off, settings and launch). */
 export declare function syncAgentCommands(ctx: Context, config: Config, quiet?: boolean): Reconciled | null;
-export declare function agentCommandsCommand(ctx: Context): number;

package/dist/cli/commands/agent-commands.js

@@ -1,5 +1,4 @@
-import { fail } from '../../core/util/index.js';
-import { c, table } from '../output/index.js';
+import { c } from '../output/index.js';
 import { AgentCommandsService } from '../services/index.js';
 /** Brings this PC in line with agentCommands and says what changed (used after on/off, settings and launch). */
 export function syncAgentCommands(ctx, config, quiet = false) {
@@ -7,39 +6,10 @@ export function syncAgentCommands(ctx, config, quiet = false) {
     if (!result || !result.changed || quiet)
         return result;
     if (result.on) {
-        console.log('Agent commands (Beta) are on for: ' +
-            (result.commands.map((a) => a.command).join(', ') || 'no installed agents found'));
+        console.log('Agent commands are on for: ' + (result.commands.map((a) => a.command).join(', ') || 'no installed agents found'));
         console.log(c.dim('Open a new terminal, then type e.g. claude in any project folder. Run the real one: set SANDBOX_AGENT_DIRECT=1'));
     }
     else
         console.log('Agent commands are off: claude, codex ... run on this PC again (open a new terminal).');
     return result;
 }
-export function agentCommandsCommand(ctx) {
-    const service = new AgentCommandsService(ctx);
-    service.assertOnPc();
-    const action = ctx.options.positionals[0] ?? 'status';
-    if (action === 'status') {
-        const { enabled, dir, found } = service.status();
-        console.log('Agent commands (Beta): ' + (enabled ? c.green('on') : 'off') + c.dim('  (' + dir + ')'));
-        if (found.length)
-            table(found.map((a) => [a.command, 'sandboxed ' + a.harness + (enabled ? '' : ' when on'), c.dim('real: ' + a.real)]));
-        else
-            console.log(c.dim('No agents found on this PC (claude, codex, gemini ... on your PATH).'));
-        if (!enabled)
-            console.log(c.dim('Turn on with: sandbox agent-commands on'));
-        return 0;
-    }
-    if (action !== 'on' && action !== 'off')
-        fail('Unknown action "' + action + '".', 'Use: sandbox agent-commands [status|on|off]');
-    const result = service.setEnabled(action === 'on');
-    if (result?.on) {
-        console.log('Agent commands (Beta) are on: ' +
-            (result.commands.map((a) => a.command).join(', ') || 'no installed agents found yet'));
-        console.log(c.dim('Open a new terminal, then type e.g. claude in a project folder: it starts in a hidden sandbox and attaches.'));
-        console.log(c.dim('Run the real one on this PC: set SANDBOX_AGENT_DIRECT=1 (PowerShell: $env:SANDBOX_AGENT_DIRECT=1). Turn off: sandbox agent-commands off'));
-    }
-    else
-        console.log('Agent commands are off: claude, codex ... run on this PC again. Open a new terminal.');
-    return 0;
-}

package/dist/cli/commands/index.d.ts

@@ -7,5 +7,5 @@ export { contextOrDefaults } from './context.js';
 export { attach, db, exec } from './sessions/index.js';
 export { resume } from './resume.js';
 export { claudeHost, config, doctor, hostCommand, logs, migrateBeforeCommand, sync, updatesBeforeCommand, watcher, } from './maintenance/index.js';
-export { agentCommandsCommand, syncAgentCommands } from './agent-commands.js';
+export { syncAgentCommands } from './agent-commands.js';
 export { HANDLERS, type Handler } from './registry.js';

package/dist/cli/commands/index.js

@@ -7,5 +7,5 @@ export { contextOrDefaults } from './context.js';
 export { attach, db, exec } from './sessions/index.js';
 export { resume } from './resume.js';
 export { claudeHost, config, doctor, hostCommand, logs, migrateBeforeCommand, sync, updatesBeforeCommand, watcher, } from './maintenance/index.js';
-export { agentCommandsCommand, syncAgentCommands } from './agent-commands.js';
+export { syncAgentCommands } from './agent-commands.js';
 export { HANDLERS } from './registry.js';

package/dist/cli/commands/launch/launch.js

@@ -74,13 +74,13 @@ class Launcher {
             return this.launchSessions();
         return this.launchHere();
     }
-    /** agentCommands (Beta) follows the config: a setting changed in the file takes effect here too. Never blocks. */
+    /** agentCommands follows the config: a setting changed in the file takes effect here too. Never blocks. */
     syncAgentCommands() {
         try {
             syncAgentCommands(this.ctx, this.ctx.loaded.config);
         }
         catch (e) {
-            console.warn('Agent commands (Beta): ' + errMsg(e));
+            console.warn('Agent commands: ' + errMsg(e));
         }
     }
     /**

package/dist/cli/commands/registry.js

@@ -3,6 +3,7 @@ import { launch } from './launch/index.js';
 import { setup } from './setup/index.js';
 import { cleanData, showData } from '../../app/features/data/index.js';
 import { attach, db, exec } from './sessions/index.js';
+import { agentCommandsStatus } from '../../app/features/agent-commands/index.js';
 import { listAccounts } from '../../app/features/accounts/index.js';
 import { containedStatus, showStorage } from '../../app/features/storage/index.js';
 import { listProjects } from '../../app/features/projects/index.js';
@@ -11,7 +12,6 @@ import { fail } from '../../core/util/index.js';
 import { claudeHost, config, doctor, hostCommand, logs, sync, watcher } from './maintenance/index.js';
 import { engine } from './engine.js';
 import { resume } from './resume.js';
-import { agentCommandsCommand } from './agent-commands.js';
 import { vpn } from './vpn.js';
 import { github } from './github.js';
 import { web, webServer } from './web.js';
@@ -21,7 +21,6 @@ export const HANDLERS = {
     generate: (ctx) => launch(ctx, true),
     attach: attach,
     exec: exec,
-    'agent-commands': agentCommandsCommand,
     db: db,
     resume: resume,
     // The bare command lists; its actions (save, use ...) are the operations' hints.
@@ -52,6 +51,8 @@ export const HANDLERS = {
     'host-claude': claudeHost,
     host: hostCommand,
     _watch: watcher,
+    // The bare command shows the status; on and off are the operations' hints (src/app/features/agent-commands).
+    'agent-commands': definitionHandler(agentCommandsStatus),
     vpn: vpn,
     github: github,
     web: web,

package/dist/cli/manifest.d.ts

@@ -702,7 +702,7 @@ declare const COMMAND_LIST: readonly [{
     readonly examples: readonly ["sandbox config set sandbox.memoryMb 8192", "sandbox config get sandbox.memoryMb", "sandbox config reset sandbox.memoryMb", "sandbox config list", "sandbox config export team-settings.json", "sandbox config import team-settings.json"];
 }, {
     readonly name: "agent-commands";
-    readonly summary: "(Beta) make claude, codex ... on this PC start in a hidden sandbox and attach";
+    readonly summary: "make claude, codex ... on this PC start in a hidden sandbox and attach";
     readonly group: "Advanced";
     readonly args: readonly [{
         readonly name: "action";

package/dist/cli/manifest.js

@@ -491,7 +491,7 @@ const COMMAND_LIST = [
     },
     {
         name: 'agent-commands',
-        summary: '(Beta) make claude, codex ... on this PC start in a hidden sandbox and attach',
+        summary: 'make claude, codex ... on this PC start in a hidden sandbox and attach',
         group: 'Advanced',
         args: [{ name: 'action', description: 'on, off or status', required: false, choices: ['status', 'on', 'off'] }],
         options: [],

package/dist/cli/menu/menu.d.ts

@@ -23,6 +23,6 @@ export declare class Menu {
     private execute;
     /** Shows the end of a log on the normal screen. */
     private view;
-    /** After a save: agent commands (Beta) may have been switched, which changes this PC. */
+    /** After a save: agent commands may have been switched, which changes this PC. */
     private applyAgentCommands;
 }

package/dist/cli/menu/menu.js

@@ -168,7 +168,7 @@ export class Menu {
             await pressAnyKey(Theme.muted('Press any key for the menu…'));
         });
     }
-    /** After a save: agent commands (Beta) may have been switched, which changes this PC. */
+    /** After a save: agent commands may have been switched, which changes this PC. */
     applyAgentCommands(saved) {
         if (!saved.files.some((f) => !f.isProject))
             return undefined;
@@ -177,11 +177,11 @@ export class Menu {
             if (!result?.changed)
                 return undefined;
             return result.on
-                ? 'Agent commands (Beta) are on: open a new terminal.'
+                ? 'Agent commands are on: open a new terminal.'
                 : 'Agent commands are off: claude, codex ... run on this PC again (open a new terminal).';
         }
         catch (e) {
-            return 'Agent commands (Beta): ' + errMsg(e);
+            return 'Agent commands: ' + errMsg(e);
         }
     }
 }

package/dist/cli/menu/pages/agents-page.d.ts

@@ -1,4 +1,5 @@
-import { type AgentsList } from '../../../app/features/agents/index.js';
+import type { AgentCommandsStatus as AgentCommandsFacts } from '../../../app/features/agent-commands/index.js';
+import { type AgentEnv, type AgentsList } from '../../../app/features/agents/index.js';
 import type { ConfigFile } from '../../../app/features/settings/index.js';
 import type { Context } from '../../commands/context.js';
 import { type App, type Category, type ListOptions, type ListResult } from '../../tui/index.js';
@@ -17,8 +18,12 @@ export interface AgentsModel {
     readonly window: WindowChoice;
     /** Agents that can be run on this PC without the sandbox (see hostAgentsToShow). */
     readonly hostAgents: readonly string[];
+    /** Whether agent commands are on and which agents were found (the "On this PC" category). */
+    readonly agentCommands?: AgentCommandsFacts;
     /** The agents you added yourself: only these can be removed (the built-in ones stay). */
     readonly removable?: readonly string[];
+    /** Claude's environment variables (the Claude environment tab); missing when Claude is not an agent here. */
+    readonly claudeEnv?: AgentEnv;
 }
 /** The agents page's data as the agents view takes it. Pure. */
 export declare function agentsList(m: AgentsModel): AgentsList;
@@ -34,7 +39,7 @@ export declare function startArgv(m: AgentsModel, agent: string, cwd: string): s
 /** Settings has unsaved changes to the agents (their list or the default): the agent operations wait for them. */
 export declare function agentsHaveStagedChanges(file: ConfigFile, draft: Draft): boolean;
 /** The categories of the agents section; "On this PC" only when there is something in it. Pure. */
-export declare function agentCategories(m: Pick<AgentsModel, 'folder' | 'hostAgents'>): Category[];
+export declare function agentCategories(m: Pick<AgentsModel, 'folder' | 'hostAgents' | 'claudeEnv'>): Category[];
 /** The list for the agents section. Pure. */
 export declare function agentsOptions(m: AgentsModel, cwd?: string): ListOptions<string>;
 export declare class AgentsPage extends ListPage<string> {

package/dist/cli/menu/pages/agents-page.js

@@ -4,7 +4,7 @@
 // are on.
 import fs from 'node:fs';
 import path from 'node:path';
-import { agentsPage, listAgents } from '../../../app/features/agents/index.js';
+import { agentEnv, agentEnvPage, agentsPage, listAgents, } from '../../../app/features/agents/index.js';
 import { readQuery } from '../../../app/registry.js';
 import { commandLine, readHistory } from '../../history.js';
 import { AgentCommandsService } from '../../services/index.js';
@@ -16,6 +16,10 @@ import { menuView } from '../render-view.js';
 import { askPath } from '../settings/ask-path.js';
 import { SeveralAgents } from '../several.js';
 import { ListPage } from './list-page.js';
+/** What the agent commands section shows (before the status is read: off, nothing found). Pure. */
+function commandsOf(m) {
+    return m.agentCommands ?? { enabled: m.hostAgents.length > 0, dir: '', found: [] };
+}
 /** The agents page's data as the agents view takes it. Pure. */
 export function agentsList(m) {
     const removable = m.removable ?? [];
@@ -32,7 +36,13 @@ export function agentsList(m) {
 }
 /** The Start category: the agents view's rows and keys, as the menu draws them. Pure. */
 function startView(m) {
-    return menuView(agentsPage(agentsList(m)), { category: 'start', refresh: false });
+    const page = agentsPage(agentsList(m), commandsOf(m));
+    return menuView({ ...page, sections: page.sections.slice(0, 1) }, { category: 'start', refresh: false });
+}
+/** The On this PC category: the agent commands switch and the agents it covers (the view's second section). Pure. */
+function commandsView(m) {
+    const page = agentsPage(agentsList(m), commandsOf(m));
+    return menuView({ ...page, sections: page.sections.slice(1) }, { category: 'host', refresh: false });
 }
 /**
  * The "not sandboxed" entries: only while agent commands are on (typing the agent then starts the sandbox, so a way to
@@ -65,16 +75,21 @@ export function agentCategories(m) {
             label: 'Start',
             description: 'Agents you can start in ' + m.folder + '. Add an agent at the end of the list.',
         },
-        { id: 'options', label: 'Options', description: 'How a start goes, and the other ways to start.' },
-        ...(m.hostAgents.length
+        ...(m.claudeEnv
             ? [
                 {
-                    id: 'host',
-                    label: 'On this PC',
-                    description: 'The real agents on this PC, with no sandbox around them.',
+                    id: 'env',
+                    label: 'Claude environment',
+                    description: 'Models, limits, how many subagents run at once, and other variables of Claude.',
                 },
             ]
             : []),
+        { id: 'options', label: 'Options', description: 'How a start goes, and the other ways to start.' },
+        {
+            id: 'host',
+            label: 'On this PC',
+            description: 'Agent commands: typing claude, codex ... here starts them in a sandbox. The real agents are listed too.',
+        },
     ];
 }
 /** A Start row of the view with the menu's own lines: the default's accent and the command a start runs. Pure. */
@@ -88,9 +103,15 @@ function startRow(item, m, cwd) {
         details: [Theme.muted('Command  ') + commandLine(startArgv(m, name, cwd))],
     };
 }
+/** The Claude environment tab: the environment view's rows and keys, as the menu draws them. Pure. */
+function envView(m) {
+    return m.claudeEnv ? menuView(agentEnvPage(m.claudeEnv), { category: 'env', refresh: false }) : undefined;
+}
 /** The list for the agents section. Pure. */
 export function agentsOptions(m, cwd = process.cwd()) {
     const view = startView(m);
+    const env = envView(m);
+    const commands = commandsView(m);
     return {
         path: [],
         categories: agentCategories(m),
@@ -108,6 +129,8 @@ export function agentsOptions(m, cwd = process.cwd()) {
                 ]
                 : []),
             ...view.items.map((item) => startRow(item, m, cwd)),
+            ...(env?.items ?? []),
+            ...commands.items,
             {
                 value: 'opt:attach',
                 label: 'Attach this terminal',
@@ -161,8 +184,21 @@ export function agentsOptions(m, cwd = process.cwd()) {
                 description: 'Runs the real ' + agent + ' on this PC, with no sandbox around it.',
             })),
         ],
-        enterLabel: (_category, id) => ENTER[id ?? ''] ?? (id?.startsWith('agent:') ? 'start' : id?.startsWith('host:') ? 'run' : 'open'),
-        actions: (category) => (category === 'start' ? view.actions : []),
+        enterLabel: (category, id) => ENTER[id ?? ''] ??
+            (id?.startsWith('agent:')
+                ? 'start'
+                : id?.startsWith('host:')
+                    ? 'run'
+                    : category === 'host'
+                        ? commands.enterLabel(category, id)
+                        : 'open'),
+        actions: (category) => category === 'start'
+            ? view.actions
+            : category === 'env'
+                ? (env?.actions ?? [])
+                : category === 'host'
+                    ? commands.actions
+                    : [],
     };
 }
 /** What Enter does on the rows that are not an agent. */
@@ -199,7 +235,7 @@ export class AgentsPage extends ListPage {
     current() {
         if (!this.facts)
             throw new Error('The agents tab was not loaded');
-        const { agents, commands, last } = this.facts;
+        const { agents, commands, last, env } = this.facts;
         return {
             folder: this.folder,
             defaultAgent: agents.defaultAgent,
@@ -208,7 +244,13 @@ export class AgentsPage extends ListPage {
             attach: this.attach,
             window: this.window,
             hostAgents: hostAgentsToShow(commands.enabled, commands.found),
+            agentCommands: {
+                enabled: commands.enabled,
+                dir: commands.dir,
+                found: commands.found.map((a) => ({ command: a.command, harness: a.harness, real: a.real })),
+            },
             removable: agents.agents.filter((a) => a.removable).map((a) => a.name),
+            ...(env ? { claudeEnv: env } : {}),
         };
     }
     /** The cursor starts on the default agent. */
@@ -220,6 +262,9 @@ export class AgentsPage extends ListPage {
             agents: await readQuery(listAgents, this.ctx),
             commands: await new AgentCommandsService(this.ctx).statusAsync(),
             last: readHistory()[0]?.argv,
+            env: 'claude' in this.ctx.loaded.config.harnesses
+                ? await readQuery(agentEnv, this.ctx, { agent: 'claude' })
+                : undefined,
         };
         this.model = this.current();
     }
@@ -229,9 +274,20 @@ export class AgentsPage extends ListPage {
     }
     async act(result) {
         const model = this.current();
-        const chosen = startView(model).resolve(result);
+        const env = this.category === 'env' ? envView(model) : undefined;
+        if (env) {
+            const picked = env.resolve(result);
+            if (picked?.kind === 'action')
+                return this.operate(picked.action);
+            return {};
+        }
+        const chosen = startView(model).resolve(result) ?? commandsView(model).resolve(result);
         if (chosen?.kind === 'action') {
             const { action } = chosen;
+            if (action.kind === 'link' && action.target.kind === 'view') {
+                await this.selectCategory('env');
+                return {};
+            }
             // A start keeps the options of this page (attach, window, folder), which the plain link does not know.
             if (action.kind === 'link' && action.target.kind === 'start-agent')
                 return { exit: { kind: 'run', argv: startArgv(model, action.target.agent, process.cwd()) } };

package/dist/cli/menu/pages/maintenance-page.js

@@ -51,7 +51,7 @@ const CATEGORIES = [
     },
     { id: 'more', label: 'More commands', description: 'Less common commands.' },
 ];
-const MORE_COMMANDS = ['sync', 'config', 'generate', 'exec', 'agent-commands'];
+const MORE_COMMANDS = ['sync', 'config', 'generate', 'exec'];
 const NO_LOGS = { folder: '', files: [], crash: false };
 /** Until the status is read: the server counts as not running. */
 const NO_WEB = { running: false, port: null, address: null };
@@ -61,7 +61,6 @@ const MORE_LABELS = {
     config: 'Your settings file',
     generate: 'Preview a start',
     exec: 'Run a command in the sandbox',
-    'agent-commands': 'Agent commands (Beta)',
 };
 /** The Data & storage category's rows and keys once measured: the data view (src/app/features/data) as menu rows. */
 function dataMenuView(data) {

package/dist/cli/menu/pages/settings-page.js

@@ -158,6 +158,7 @@ export class SettingsPage extends ListPage {
         login: 'none',
         loginSavedAt: null,
         running: null,
+        lastFailure: null,
     };
     /** Whether a GitHub token is saved (never the token): the token row needs only its state. */
     github = { shareToken: false, gitAccess: 'full', token: 'none', kind: null, savedAt: null };

package/dist/cli/menu/views.js

@@ -1,7 +1,7 @@
 // The shared core's views the menu shows, and in which section (the parity self-test reads this list: an operation or
 // query is reachable in the menu when a view here offers it). Settings is drawn by its own page over the same rows,
 // because the menu stages changes until Ctrl+S.
-import { agentsView } from '../../app/features/agents/index.js';
+import { agentEnvView, agentsView } from '../../app/features/agents/index.js';
 import { dataView } from '../../app/features/data/index.js';
 import { accountsView } from '../../app/features/accounts/index.js';
 import { appsView } from '../../app/features/apps/index.js';
@@ -21,6 +21,7 @@ import { githubView } from '../../app/features/github/index.js';
 import { accessView } from '../../app/features/access/index.js';
 export const MENU_VIEWS = [
     { view: agentsView, section: 'Agents' },
+    { view: agentEnvView, section: 'Agents' },
     { view: sessionsView, section: 'Sessions' },
     { view: sandboxView, section: 'Sandbox' },
     { view: settingsView, section: 'Settings' },

package/dist/cli/services/agent-commands-service.d.ts

@@ -14,6 +14,8 @@ export declare class AgentCommandsService {
     constructor(ctx: Context);
     /** Agent commands change this PC's PATH, so they are set up from the PC, not inside the sandbox. */
     assertOnPc(): void;
+    /** Your settings as they are on disk now (a switch made a moment ago, here or in Settings, counts). */
+    private config;
     status(): AgentCommandsStatus;
     /** status() that does not block the program (the menu asks while it stays responsive). */
     statusAsync(): Promise<AgentCommandsStatus>;

package/dist/cli/services/agent-commands-service.js

@@ -1,12 +1,12 @@
-// "Agent commands" (Beta): typing claude, codex ... on this PC starts them in a hidden sandbox. Never prints.
+// "Agent commands": typing claude, codex ... on this PC starts them in a hidden sandbox. Never prints.
 import fs from 'node:fs';
-import path from 'node:path';
 import { loadConfig, userConfigPath } from '../../core/config/index.js';
 import { fail } from '../../core/util/index.js';
-import { agentCommands, agentCommandsAsync, commandsDir, reconcileAgentCommands, } from '../../host/agent-commands/index.js';
+import { agentCommands, agentCommandsAsync, commandsDir, forwardTarget, reconcileAgentCommands, } from '../../host/agent-commands/index.js';
+import { InstallLayout } from '../../host/install/layout.js';
 import { insideSandbox } from '../../host/sandbox/index.js';
 import { writeFileAtomic } from '../../shared/io/index.js';
-import { editConfigText } from '../../app/features/settings/index.js';
+import { editConfigText } from '../../app/features/settings/settings-file.js';
 export class AgentCommandsService {
     ctx;
     constructor(ctx) {
@@ -17,8 +17,12 @@ export class AgentCommandsService {
         if (insideSandbox())
             fail("Agent commands change your PC's PATH, so they are set up from your PC, not inside the sandbox.", 'Run sandbox agent-commands on in a terminal on your PC.');
     }
+    /** Your settings as they are on disk now (a switch made a moment ago, here or in Settings, counts). */
+    config() {
+        return loadConfig(this.ctx.loaded.configPath ?? undefined).config;
+    }
     status() {
-        const { config } = this.ctx.loaded;
+        const config = this.config();
         return {
             enabled: config.agentCommands.enabled,
             dir: commandsDir(this.ctx.storageRoot),
@@ -27,7 +31,7 @@ export class AgentCommandsService {
     }
     /** status() that does not block the program (the menu asks while it stays responsive). */
     async statusAsync() {
-        const { config } = this.ctx.loaded;
+        const config = this.config();
         return {
             enabled: config.agentCommands.enabled,
             dir: commandsDir(this.ctx.storageRoot),
@@ -48,6 +52,8 @@ export class AgentCommandsService {
     reconcile(config) {
         if (insideSandbox())
             return null;
-        return reconcileAgentCommands(config, this.ctx.storageRoot, process.execPath, path.join(this.ctx.packageRoot, 'dist', 'bin', 'sandbox.js'));
+        // Under a managed install the forwarding files call its launcher, which keeps working after an update.
+        const installRoot = InstallLayout.detect(this.ctx.packageRoot)?.root ?? null;
+        return reconcileAgentCommands(config, this.ctx.storageRoot, forwardTarget(this.ctx.packageRoot, installRoot, process.execPath));
     }
 }

package/dist/cli/services/vpn-service.d.ts

@@ -1,7 +1,7 @@
 import type { Config } from '../../core/types.js';
 import type { VpnProvider } from '../../core/schema/index.js';
 import type { SecretStore } from '../../host/secrets/index.js';
-import { type LoginState, type VpnCredentials, type VpnLine } from '../../host/vpn/index.js';
+import { type VpnFailureInfo, type LoginState, type VpnCredentials, type VpnLine } from '../../host/vpn/index.js';
 import type { Context } from '../commands/context.js';
 export interface VpnReport {
     readonly enabled: boolean;
@@ -13,6 +13,8 @@ export interface VpnReport {
     readonly loginSavedAt: string | null;
     /** The running sandbox's tunnel, when one runs with the VPN on. */
     readonly running: VpnLine | null;
+    /** The last sandbox's VPN attempt, when it failed (kept after it closed). */
+    readonly lastFailure: VpnFailureInfo | null;
 }
 export declare class VpnService {
     private readonly ctx;
@@ -26,5 +28,7 @@ export declare class VpnService {
     }): Promise<VpnReport>;
     loginState(): LoginState;
     save(credentials: VpnCredentials): void;
+    /** A hint when the login does not look like it belongs to the provider (null when it looks right). */
+    warning(credentials: VpnCredentials): string | null;
     remove(): boolean;
 }

package/dist/cli/services/vpn-service.js

@@ -1,5 +1,5 @@
 import { isSandboxRunning } from '../../host/sandbox/index.js';
-import { hostPublicIp, readVpnLine, VpnLogin, } from '../../host/vpn/index.js';
+import { hostPublicIp, loginWarning, readLastFailure, readVpnLine, VpnLogin, } from '../../host/vpn/index.js';
 export class VpnService {
     ctx;
     login;
@@ -25,6 +25,7 @@ export class VpnService {
             killSwitch: c.killSwitch,
             login: this.login.state(c.provider),
             loginSavedAt: this.login.savedAt(c.provider),
+            lastFailure: readLastFailure(this.ctx.storageRoot),
             running: running ? readVpnLine(this.ctx.dataPath, await hostPublicIp()) : null,
         };
     }
@@ -34,6 +35,10 @@ export class VpnService {
     save(credentials) {
         this.login.save(this.provider, credentials);
     }
+    /** A hint when the login does not look like it belongs to the provider (null when it looks right). */
+    warning(credentials) {
+        return loginWarning(credentials, this.provider);
+    }
     remove() {
         return this.login.remove(this.provider);
     }

package/dist/cli/tui/dialogs/text-screen.js

@@ -100,7 +100,8 @@ export class TextScreen {
         }
         if (key.text) {
             const accept = this.o.accept;
-            const add = [...key.text.replace(/[\r\n]/g, '')].filter((c) => !accept || accept.test(c));
+            // Line breaks and the bracketed-paste markers a terminal wraps around pasted text are not part of the text.
+            const add = [...key.text.replace(/\x1b?\[20[01]~/g, '').replace(/[\r\n]/g, '')].filter((c) => !accept || accept.test(c));
             if (!add.length)
                 return;
             set([...chars.slice(0, this.cursor), ...add, ...chars.slice(this.cursor)], this.cursor + add.length);

package/dist/cli/tui/terminal.js

@@ -119,9 +119,11 @@ export class Terminal {
         });
     }
     push(str, key) {
+        // The markers around a paste (readline names them paste-start / paste-end) carry no text.
+        const marker = key?.name === 'paste-start' || key?.name === 'paste-end';
         const event = {
             name: key?.name ?? '',
-            text: str && !key?.ctrl && !key?.meta && str.length >= 1 && str >= ' ' && str !== '\x7f' ? str : '',
+            text: str && !marker && !key?.ctrl && !key?.meta && str.length >= 1 && str >= ' ' && str !== '\x7f' ? str : '',
             ctrl: Boolean(key?.ctrl),
             meta: Boolean(key?.meta),
             shift: Boolean(key?.shift),