windows-development-sandbox 1.18.4 → 1.20.0

package/dist/core/config/defaults.js

@@ -38,6 +38,14 @@ export const DEFAULTS = {
     network: { blockPrivateRanges: true, allowOnly: [], blockHosts: [], forwardPorts: [], dns: [], proxy: '' },
     vpn: { enabled: false, provider: 'nordvpn', protocol: 'udp', country: '', configFile: '', killSwitch: true },
     github: { shareToken: false },
+    codex: {
+        sandboxMode: 'danger-full-access',
+        approvalPolicy: 'never',
+        model: '',
+        reasoningEffort: 'default',
+        windowsSandbox: 'off',
+        mcpLoginsInFile: true,
+    },
     accounts: {
         epic: { share: false },
         steam: { share: false },
@@ -78,6 +86,7 @@ export const DEFAULTS = {
             acceptLicense: false,
             components: [],
             keepInstallFiles: true,
+            visualStudio: 'full',
             persistEngines: true,
             derivedDataCache: 'persisted',
         },

package/dist/core/detect/toolchains.js

@@ -1,3 +1,4 @@
+import { isToolchainReady } from '../../shared/readiness.js';
 import { projectUses } from './versions.js';
 /** Files that show a project uses a language (looked for in the workspace and one folder down). */
 export const MARKERS = {
@@ -84,6 +85,8 @@ export function decideToolchains(settings, entries, pcHas, hints = {}) {
         const setting = settings[name].enabled;
         if (setting !== 'auto')
             return { on: setting, reason: setting ? 'enabled in config' : 'disabled in config' };
+        if (!isToolchainReady(name))
+            return { on: false, reason: 'coming in a later version' };
         const marker = MARKERS[name].map((m) => entries.find((e) => projectUses([e], [m]))).find(Boolean);
         if (marker)
             return { on: true, reason: marker };
@@ -124,9 +127,15 @@ function applyImplications(settings, result) {
         imply(settings, result, 'android', 'React Native builds for Android');
     if (result.godot.on && settings.godot.dotnet === true)
         imply(settings, result, 'dotnet', "Godot's .NET build");
+    if (result.unreal.on && settings.unreal.visualStudio === 'autosdk')
+        imply(settings, result, 'msvc', 'Unreal builds from the portable MSVC (AutoSDK)');
+    // Unreal's licence acceptance covers the MSVC it builds from (the same Visual Studio terms).
+    const autosdkLicence = settings.unreal.visualStudio === 'autosdk' && settings.unreal.acceptLicense;
     for (const name of LICENSED_TOOLCHAINS) {
         if (settings[name].enabled !== 'auto' || !result[name].on || settings[name].acceptLicense)
             continue;
+        if (name === 'msvc' && autosdkLicence)
+            continue;
         result[name] = {
             on: false,
             reason: 'would be used (' + result[name].reason + '); set toolchains.' + name + '.acceptLicense to install it',

package/dist/core/disk.d.ts

@@ -8,11 +8,7 @@ export declare function humanBytes(bytes: number): string;
 export declare function sizeOf(p: string): number;
 /** sizeOf with a time budget: null when measuring would take longer than `ms` (a big data folder can take minutes). */
 export declare function sizeWithin(p: string, ms: number): number | null;
-/**
- * Free bytes on the drive that holds `dir` (which may not exist yet: the nearest existing parent is asked); null if
- * unknown.
- */
-export declare function freeBytesAt(dir: string): number | null;
+export { freeBytesAt } from '../shared/io/disk.js';
 export interface DiskUsage {
     drive: string;
     totalBytes: number;

package/dist/core/disk.js

@@ -59,22 +59,7 @@ export function sizeWithin(p, ms) {
         throw e;
     }
 }
-/**
- * Free bytes on the drive that holds `dir` (which may not exist yet: the nearest existing parent is asked); null if
- * unknown.
- */
-export function freeBytesAt(dir) {
-    let at = path.resolve(dir);
-    while (!fs.existsSync(at) && path.dirname(at) !== at)
-        at = path.dirname(at);
-    try {
-        const s = fs.statfsSync(at);
-        return s.bavail * s.bsize;
-    }
-    catch {
-        return null;
-    }
-}
+export { freeBytesAt } from '../shared/io/disk.js';
 /** Every local drive's size and free space, and which one holds the sandbox storage. */
 export function diskUsage(storageRoot) {
     const storageDrive = path.parse(path.resolve(storageRoot)).root.toUpperCase();

package/dist/core/schema/codex.d.ts

@@ -0,0 +1,29 @@
+import { z } from 'zod';
+export declare const CodexSchema: z.ZodObject<{
+    sandboxMode: z.ZodEnum<{
+        "danger-full-access": "danger-full-access";
+        "workspace-write": "workspace-write";
+        "read-only": "read-only";
+    }>;
+    approvalPolicy: z.ZodEnum<{
+        never: "never";
+        "on-request": "on-request";
+        "on-failure": "on-failure";
+        untrusted: "untrusted";
+    }>;
+    model: z.ZodString;
+    reasoningEffort: z.ZodEnum<{
+        default: "default";
+        minimal: "minimal";
+        low: "low";
+        medium: "medium";
+        high: "high";
+        xhigh: "xhigh";
+    }>;
+    windowsSandbox: z.ZodEnum<{
+        off: "off";
+        unelevated: "unelevated";
+        elevated: "elevated";
+    }>;
+    mcpLoginsInFile: z.ZodBoolean;
+}, z.core.$strict>;

package/dist/core/schema/codex.js

@@ -0,0 +1,24 @@
+// How Codex runs inside the sandbox. Yours only: a project file (.sandbox-config.json) cannot change it.
+import { z } from 'zod';
+export const CodexSchema = z.strictObject({
+    sandboxMode: z
+        .enum(['danger-full-access', 'workspace-write', 'read-only'])
+        .describe("Codex's own sandbox. Inside Windows Sandbox Codex's own sandbox only slows it down (it re-grants file permissions over your profile at every boot), so the default is danger-full-access: Windows Sandbox is the sandbox."),
+    approvalPolicy: z
+        .enum(['never', 'on-request', 'on-failure', 'untrusted'])
+        .describe('When Codex asks before it runs a command. "never" with danger-full-access starts it with no questions.'),
+    model: z
+        .string()
+        .max(100)
+        .regex(/^[A-Za-z0-9._:/-]*$/, 'letters, digits and . _ : / - only')
+        .describe("The model Codex uses. Empty = Codex's own default."),
+    reasoningEffort: z
+        .enum(['default', 'minimal', 'low', 'medium', 'high', 'xhigh'])
+        .describe('How hard Codex thinks. "default" = Codex\'s own default.'),
+    windowsSandbox: z
+        .enum(['off', 'unelevated', 'elevated'])
+        .describe('Codex\'s Windows sandbox mode in its config.toml. "off" removes the setting so Codex does not set up its sandbox users and firewall rules at every boot.'),
+    mcpLoginsInFile: z
+        .boolean()
+        .describe('Keep the sign-ins of Codex\'s MCP servers in a file in the saved Codex folder (mcp_oauth_credentials_store = "file"), so they survive between sandboxes. A value you set in config.toml is kept.'),
+});

package/dist/core/schema/config.d.ts

@@ -190,6 +190,10 @@ export declare const ConfigSchema: z.ZodObject<{
             acceptLicense: z.ZodBoolean;
             components: z.ZodArray<z.ZodString>;
             keepInstallFiles: z.ZodBoolean;
+            visualStudio: z.ZodEnum<{
+                full: "full";
+                autosdk: "autosdk";
+            }>;
             persistEngines: z.ZodBoolean;
             derivedDataCache: z.ZodEnum<{
                 persisted: "persisted";
@@ -444,6 +448,34 @@ export declare const ConfigSchema: z.ZodObject<{
         resumeArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
         resumeOneArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
+    codex: z.ZodObject<{
+        sandboxMode: z.ZodEnum<{
+            "danger-full-access": "danger-full-access";
+            "workspace-write": "workspace-write";
+            "read-only": "read-only";
+        }>;
+        approvalPolicy: z.ZodEnum<{
+            never: "never";
+            "on-request": "on-request";
+            "on-failure": "on-failure";
+            untrusted: "untrusted";
+        }>;
+        model: z.ZodString;
+        reasoningEffort: z.ZodEnum<{
+            default: "default";
+            minimal: "minimal";
+            low: "low";
+            medium: "medium";
+            high: "high";
+            xhigh: "xhigh";
+        }>;
+        windowsSandbox: z.ZodEnum<{
+            off: "off";
+            unelevated: "unelevated";
+            elevated: "elevated";
+        }>;
+        mcpLoginsInFile: z.ZodBoolean;
+    }, z.core.$strict>;
     hooks: z.ZodObject<{
         failFast: z.ZodBoolean;
     }, z.core.$strict>;
@@ -556,7 +588,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
     }, z.core.$strict>>;
     toolchains: z.ZodOptional<z.ZodObject<{
         environment: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        node: z.ZodOptional<z.ZodObject<{
+        unity: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -571,7 +603,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        go: z.ZodOptional<z.ZodObject<{
+        godot: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -586,7 +618,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        python: z.ZodOptional<z.ZodObject<{
+        android: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -601,7 +633,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        rust: z.ZodOptional<z.ZodObject<{
+        flutter: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -616,7 +648,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        msvc: z.ZodOptional<z.ZodObject<{
+        dart: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -631,7 +663,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        unreal: z.ZodOptional<z.ZodObject<{
+        reactNative: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -646,7 +678,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        unity: z.ZodOptional<z.ZodObject<{
+        fivem: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -661,7 +693,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        godot: z.ZodOptional<z.ZodObject<{
+        unreal: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -676,7 +708,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        steam: z.ZodOptional<z.ZodObject<{
+        node: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -691,7 +723,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        fivem: z.ZodOptional<z.ZodObject<{
+        go: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -706,7 +738,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        android: z.ZodOptional<z.ZodObject<{
+        python: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -721,7 +753,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        flutter: z.ZodOptional<z.ZodObject<{
+        rust: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -736,7 +768,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        dart: z.ZodOptional<z.ZodObject<{
+        msvc: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -751,7 +783,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        reactNative: z.ZodOptional<z.ZodObject<{
+        steam: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;

package/dist/core/schema/config.js

@@ -4,6 +4,7 @@ import _ from 'lodash';
 import { z } from 'zod';
 import { NameSchema, SchemaRefSchema, StringsSchema, toggle } from './common.js';
 import { DatabasesSchema } from './databases.js';
+import { CodexSchema } from './codex.js';
 import { HarnessSchema } from './harness.js';
 import { AgentCommandsSchema, AttachSchema, ClaudeProfileSchema, SecretsSchema } from './profile.js';
 import { AuditSchema, DownloadsSchema, SharingSchema, GitSchema, GuestWorkspaceSchema, MappingSchema, NetworkSchema, ProvisioningSchema, SandboxSchema, WorkspaceFilterSchema, } from './sandbox.js';
@@ -101,6 +102,7 @@ export const ConfigSchema = z
     apps: AppsSchema,
     claudeProfile: ClaudeProfileSchema,
     harnesses: z.record(NameSchema, HarnessSchema).describe('Agents that can run in the sandbox.'),
+    codex: CodexSchema,
     hooks: z.strictObject({ failFast: z.boolean().describe('Stop when a hook script fails.') }),
     projects: ProjectsSchema.describe('Several projects in one sandbox: folders of projects mapped at every start, and adding folders while it runs.'),
     resume: ResumeSchema.describe('Reopening the sessions of the last sandbox when a new one starts.'),

package/dist/core/schema/index.d.ts

@@ -2,6 +2,7 @@ export { GitAccessSchema, NameSchema, secret } from './common.js';
 export { REDACTED, redactSecrets, scrubSecrets, secretPaths, secretValues } from './redact.js';
 export { ConfigSchema, LocalOverridesSchema } from './config.js';
 export { HarnessSchema } from './harness.js';
+export { CodexSchema } from './codex.js';
 export { describeIssues, jsonSchemas } from './json-schema.js';
 export { MappingSchema } from './sandbox.js';
 export { ToolchainsSchema } from './toolchains.js';

package/dist/core/schema/index.js

@@ -4,6 +4,7 @@ export { GitAccessSchema, NameSchema, secret } from './common.js';
 export { REDACTED, redactSecrets, scrubSecrets, secretPaths, secretValues } from './redact.js';
 export { ConfigSchema, LocalOverridesSchema } from './config.js';
 export { HarnessSchema } from './harness.js';
+export { CodexSchema } from './codex.js';
 export { describeIssues, jsonSchemas } from './json-schema.js';
 export { MappingSchema } from './sandbox.js';
 export { ToolchainsSchema } from './toolchains.js';

package/dist/core/schema/toolchains.d.ts

@@ -39,6 +39,10 @@ export declare const ToolchainsSchema: z.ZodObject<{
         acceptLicense: z.ZodBoolean;
         components: z.ZodArray<z.ZodString>;
         keepInstallFiles: z.ZodBoolean;
+        visualStudio: z.ZodEnum<{
+            full: "full";
+            autosdk: "autosdk";
+        }>;
         persistEngines: z.ZodBoolean;
         derivedDataCache: z.ZodEnum<{
             persisted: "persisted";

package/dist/core/schema/toolchains.js

@@ -62,6 +62,9 @@ export const ToolchainsSchema = z.strictObject({
         keepInstallFiles: z
             .boolean()
             .describe('Keep an offline copy of the Visual Studio install files in tools\\visualstudio (~10 GB, made once), so later boots install without downloading them again. Skipped while that disk has too little room.'),
+        visualStudio: z
+            .enum(['full', 'autosdk'])
+            .describe('"full": install Visual Studio Community (the engine finds it through the Setup API; ~10 GB, redone every boot). "autosdk" (experimental): skip Visual Studio and build an Unreal AutoSDK tree from the portable MSVC in tools\\unreal\\autosdk (kept between sandboxes); UnrealBuildTool finds MSVC through AutoSDK, but the editor\'s Visual Studio integration is not available. Needs toolchains.msvc (turned on for you).'),
         persistEngines: z
             .boolean()
             .describe('Engines the Epic Games Launcher installs go to tools\\unreal\\engines (kept between sandboxes, 40-60 GB each) and are registered with the launcher again every boot. Off: they go on the sandbox disk and are lost when it closes. Engines installed on this PC can be mapped instead (pcInstalls.unrealEngines).'),

package/dist/core/types.d.ts

@@ -284,6 +284,8 @@ export interface GuestSession {
      * creates.
      */
     agentBackstop?: 'auto' | 'none' | number;
+    /** The codex settings: the flags every Codex start gets and what boot writes to its config.toml. */
+    codex?: Config['codex'];
     /** "gentle" when vGPU is on: the governor and the watchdog act earlier, compilers run below normal. */
     loadProfile?: 'normal' | 'gentle';
     /** sandbox.pressureResponse: the daemon slows builds down when memory runs low. */

package/dist/guest/accounts/apply.d.ts

@@ -5,23 +5,23 @@ import { type GuestAdapter } from './adapter.js';
 export declare const DeliveredSchema: z.ZodObject<{
     fingerprints: z.ZodRecord<z.ZodEnum<{
         unity: "unity";
-        steam: "steam";
-        epic: "epic";
-        cfx: "cfx";
         keystore: "keystore";
         play: "play";
         expo: "expo";
         appstore: "appstore";
+        cfx: "cfx";
+        steam: "steam";
+        epic: "epic";
     }> & z.core.$partial, z.ZodString>;
     leased: z.ZodArray<z.ZodEnum<{
         unity: "unity";
-        steam: "steam";
-        epic: "epic";
-        cfx: "cfx";
         keystore: "keystore";
         play: "play";
         expo: "expo";
         appstore: "appstore";
+        cfx: "cfx";
+        steam: "steam";
+        epic: "epic";
     }>>;
 }, z.core.$strip>;
 export type Delivered = z.output<typeof DeliveredSchema>;

package/dist/guest/agents/agent-files.d.ts

@@ -1,4 +1,4 @@
-import type { Harness } from '../../core/types.js';
+import type { Config, Harness } from '../../core/types.js';
 /** Where an agent lives in persistent storage: its folder, and the program (an .exe, or an npm .cmd) in it. */
 export interface AgentPaths {
     readonly dir: string;
@@ -13,12 +13,14 @@ export interface AgentShim {
     readonly name: string;
     readonly command: string;
     readonly target: string;
+    /** Flags the shim puts before the arguments of the caller (codex: the sandbox's own settings). */
+    readonly arguments?: readonly string[];
 }
 /** One shim per configured agent that can be installed here (a name that is not a plain command word is skipped). */
-export declare function agentShims(toolsDir: string, agents: Readonly<Record<string, Harness>>): AgentShim[];
+export declare function agentShims(toolsDir: string, agents: Readonly<Record<string, Harness>>, flags?: Readonly<Record<string, readonly string[]>>): AgentShim[];
 /**
  * The text of `<command>.cmd`: runs the installed agent, or installs it first (`install` = node + installer script).
- * The agent's own arguments pass through %* untouched.
+ * The agent's own arguments pass through %* untouched, after the shim's flags if it has any.
  */
 export declare function shimText(shim: AgentShim, install: {
     node: string;
@@ -48,13 +50,31 @@ export declare function bootResetPaths(agents: Readonly<Record<string, Harness>>
     agent: string;
     path: string;
 }[];
+type CodexSettings = Config['codex'];
 /**
- * Codex's config.toml with its own command sandbox off, or null when it already says which one to use. Inside Windows
- * Sandbox that inner sandbox only costs: its setup re-grants ACLs over the whole profile at every boot (minutes), and
- * every command hangs until it is done. A `sandbox_mode` the user set (before the first [table]) is kept.
+ * The flags every Codex start gets. Flags beat config.toml and a resumed thread's saved permissions, which is why the
+ * sandbox does not rely on the file. Full access with no questions is the one flag that skips Codex's Windows sandbox
+ * setup for certain. Pure.
+ */
+export declare function codexArguments(c: CodexSettings): string[];
+/** The arguments an agent always starts with: its own, and for codex the sandbox's settings. */
+export declare function agentArguments(name: string, harness: Harness, codex: CodexSettings | undefined): string[];
+/** The largest config.toml the sandbox edits. */
+export declare const MAX_CODEX_CONFIG_BYTES: number;
+/**
+ * Codex's config.toml as the sandbox wants it, every other line byte for byte: the lines an older version wrote above
+ * the first table (sandbox_mode, approval_policy, under the marker comment) are gone, `[windows] sandbox` follows
+ * windowsSandbox ("off" removes the line, so Codex does not set up its own sandbox users), and
+ * mcp_oauth_credentials_store = "file" is added when it is not set. Running it again changes nothing. Pure.
+ */
+export declare function codexConfigOwned(toml: string, c: CodexSettings): string;
+/**
+ * Codex's config.toml with its own command sandbox off, or null when that changes nothing. Kept for callers that
+ * predate the codex settings; use codexConfigOwned.
  */
 export declare function codexConfigWithoutSandbox(toml: string): string | null;
 /** A SQLite database file or one of its -wal / -shm siblings. */
 export declare const isDatabaseFile: (name: string) => boolean;
 /** Files that make a consistent copy: the databases and their -wal (the -shm is rebuilt by SQLite). */
 export declare const isCopyableDatabaseFile: (name: string) => boolean;
+export {};

package/dist/guest/agents/agent-files.js

@@ -15,19 +15,19 @@ export function agentCommand(name, harness) {
     return harness.npmBin ?? harness.uvBin ?? (harness.hostExecutable ?? name).replace(/\.exe$/i, '');
 }
 /** One shim per configured agent that can be installed here (a name that is not a plain command word is skipped). */
-export function agentShims(toolsDir, agents) {
+export function agentShims(toolsDir, agents, flags = {}) {
     return Object.entries(agents).flatMap(([name, harness]) => {
         const p = agentPaths(toolsDir, name, harness);
         const target = p.exe ?? p.cmd;
         const command = agentCommand(name, harness);
         return target && /^[A-Za-z0-9_-]+$/.test(command) && /^[A-Za-z0-9_-]+$/.test(name)
-            ? [{ name, command, target }]
+            ? [{ name, command, target, ...(flags[name]?.length ? { arguments: flags[name] } : {}) }]
             : [];
     });
 }
 /**
  * The text of `<command>.cmd`: runs the installed agent, or installs it first (`install` = node + installer script).
- * The agent's own arguments pass through %* untouched.
+ * The agent's own arguments pass through %* untouched, after the shim's flags if it has any.
  */
 export function shimText(shim, install) {
     return [
@@ -39,7 +39,7 @@ export function shimText(shim, install) {
         '"' + install.node + '" "' + install.script + '" install ' + shim.name,
         'if errorlevel 1 exit /b 1',
         ':run',
-        'endlocal & "%SBX_REAL%" %*',
+        'endlocal & "%SBX_REAL%" ' + (shim.arguments?.length ? shim.arguments.join(' ') + ' ' : '') + '%*',
         '',
     ].join('\r\n');
 }
@@ -61,19 +61,89 @@ export function localStateEntries(agents, stateDir, localRoot) {
 export function bootResetPaths(agents, stateDir) {
     return Object.entries(agents).flatMap(([agent, harness]) => (harness.bootReset ?? []).map((rel) => ({ agent, path: path.join(stateDir, agent, rel) })));
 }
+/** The marker the sandbox puts above the lines it writes into config.toml. */
+const CODEX_MARKER = '# Set by the sandbox';
 /**
- * Codex's config.toml with its own command sandbox off, or null when it already says which one to use. Inside Windows
- * Sandbox that inner sandbox only costs: its setup re-grants ACLs over the whole profile at every boot (minutes), and
- * every command hangs until it is done. A `sandbox_mode` the user set (before the first [table]) is kept.
+ * The flags every Codex start gets. Flags beat config.toml and a resumed thread's saved permissions, which is why the
+ * sandbox does not rely on the file. Full access with no questions is the one flag that skips Codex's Windows sandbox
+ * setup for certain. Pure.
+ */
+export function codexArguments(c) {
+    const out = c.sandboxMode === 'danger-full-access' && c.approvalPolicy === 'never'
+        ? ['--dangerously-bypass-approvals-and-sandbox']
+        : ['--sandbox', c.sandboxMode, '--ask-for-approval', c.approvalPolicy];
+    if (c.model)
+        out.push('-c', 'model="' + c.model + '"');
+    if (c.reasoningEffort !== 'default')
+        out.push('-c', 'model_reasoning_effort="' + c.reasoningEffort + '"');
+    return out;
+}
+/** The arguments an agent always starts with: its own, and for codex the sandbox's settings. */
+export function agentArguments(name, harness, codex) {
+    return name === 'codex' && codex ? [...harness.arguments, ...codexArguments(codex)] : [...harness.arguments];
+}
+/** The largest config.toml the sandbox edits. */
+export const MAX_CODEX_CONFIG_BYTES = 1024 * 1024;
+/**
+ * Codex's config.toml as the sandbox wants it, every other line byte for byte: the lines an older version wrote above
+ * the first table (sandbox_mode, approval_policy, under the marker comment) are gone, `[windows] sandbox` follows
+ * windowsSandbox ("off" removes the line, so Codex does not set up its own sandbox users), and
+ * mcp_oauth_credentials_store = "file" is added when it is not set. Running it again changes nothing. Pure.
+ */
+export function codexConfigOwned(toml, c) {
+    const eol = toml.includes('\r\n') ? '\r\n' : '\n';
+    const firstTable = toml.search(/^[ \t]*\[/m);
+    let top = firstTable < 0 ? toml : toml.slice(0, firstTable);
+    const tables = firstTable < 0 ? '' : toml.slice(firstTable);
+    top = top.replace(MARKED_LINES, '');
+    if (c.mcpLoginsInFile && !/^[ \t]*mcp_oauth_credentials_store[ \t]*=/m.test(top)) {
+        if (top && !top.endsWith('\n'))
+            top += eol;
+        top += 'mcp_oauth_credentials_store = "file"' + eol + (tables ? eol : '');
+    }
+    return top + codexWindowsSandbox(tables, c.windowsSandbox, eol);
+}
+/** The lines an older version wrote above the first table: its marker comment, then sandbox_mode / approval_policy. */
+const MARKED_LINES = new RegExp('^' + CODEX_MARKER + '[^\r\n]*\r?\n(?:(?:sandbox_mode|approval_policy)[ \t]*=[^\r\n]*\r?\n)*(?:[ \t]*\r?\n)?', 'm');
+/** The tables of config.toml (from the first one on) with `[windows] sandbox` set to the mode, or removed for "off". */
+function codexWindowsSandbox(tables, mode, eol) {
+    const setting = 'sandbox = "' + mode + '"';
+    const header = /^[ \t]*\[windows\][ \t]*(#[^\r\n]*)?(\r?\n|$)/m.exec(tables);
+    if (!header) {
+        if (mode === 'off')
+            return tables;
+        const gap = tables && !tables.endsWith('\n') ? eol : '';
+        return tables + gap + (tables ? eol : '') + '[windows]' + eol + setting + eol;
+    }
+    const bodyStart = header.index + header[0].length;
+    const next = tables.slice(bodyStart).search(/^[ \t]*\[/m);
+    const bodyEnd = next < 0 ? tables.length : bodyStart + next;
+    const body = tables.slice(bodyStart, bodyEnd);
+    const line = /^[ \t]*sandbox[ \t]*=[^\r\n]*(\r?\n|$)/m.exec(body);
+    let updated;
+    if (!line)
+        updated = mode === 'off' ? body : setting + eol + body;
+    else if (mode === 'off')
+        updated = body.slice(0, line.index) + body.slice(line.index + line[0].length);
+    else
+        updated = body.slice(0, line.index) + setting + line[1] + body.slice(line.index + line[0].length);
+    const head = tables.slice(0, bodyStart);
+    return (head.endsWith('\n') || !updated ? head : head + eol) + updated + tables.slice(bodyEnd);
+}
+/**
+ * Codex's config.toml with its own command sandbox off, or null when that changes nothing. Kept for callers that
+ * predate the codex settings; use codexConfigOwned.
  */
 export function codexConfigWithoutSandbox(toml) {
-    const firstTable = toml.search(/^\s*\[/m);
-    const topLevel = firstTable < 0 ? toml : toml.slice(0, firstTable);
-    if (/^\s*sandbox_mode\s*=/m.test(topLevel))
-        return null;
-    return ('# Set by the sandbox: Windows Sandbox already contains Codex, its own command sandbox would only slow it down.\n' +
-        'sandbox_mode = "danger-full-access"\n' +
-        (toml ? '\n' + toml : ''));
+    const out = codexConfigOwned(toml, {
+        sandboxMode: 'danger-full-access',
+        approvalPolicy: 'never',
+        model: '',
+        reasoningEffort: 'default',
+        windowsSandbox: 'off',
+        mcpLoginsInFile: true,
+    });
+    return out === toml ? null : out;
 }
 /** A SQLite database file or one of its -wal / -shm siblings. */
 export const isDatabaseFile = (name) => /\.(sqlite3?|db)(-wal|-shm)?$/i.test(name);

package/dist/guest/agents/local-state.d.ts

@@ -5,8 +5,11 @@ export declare function agentLocalStates(): LocalState[];
 export declare function localStateVars(): Record<string, string>;
 /** Boot: what an agent sealed to the last sandbox (bootReset) is deleted, so it sets it up again. Links are left. */
 export declare function resetMachineBound(): void;
-/** Boot: Codex runs its commands without its own sandbox (codexConfigWithoutSandbox), unless the user picked one. */
-export declare function codexWithoutInnerSandbox(): void;
+/**
+ * Boot: Codex's config.toml follows the codex settings (codexConfigOwned): no Windows sandbox setup of its own, its MCP
+ * logins in a file. The sandbox mode itself travels as launch flags (codexArguments), which beat this file.
+ */
+export declare function codexBootConfig(): void;
 /** Boot: the saved databases of every configured agent are copied to the sandbox's disk, where the agent runs them. */
 export declare function restoreLocalState(): void;
 /**