windows-development-sandbox 1.18.4 → 1.20.0

package/dist/guest/toolchains/signature.js

@@ -0,0 +1,22 @@
+// A file's Authenticode signature (sandbox\scripts\get-signature.ps1) checked against the signer a download names.
+import { z } from 'zod';
+import { signerMatches } from '../../shared/signer.js';
+import { scriptOutput } from '../runtime/process.js';
+const SignatureSchema = z.object({ subject: z.string().max(4096), issuer: z.string().max(4096) });
+/** The names on a file's valid signature, or null when it is unsigned, tampered with, or cannot be read. */
+export function signatureOf(file) {
+    const text = scriptOutput('get-signature.ps1', ['-Path', file]).trim();
+    if (!text)
+        return null;
+    try {
+        const parsed = SignatureSchema.safeParse(JSON.parse(text));
+        return parsed.success ? parsed.data : null;
+    }
+    catch {
+        return null; // Not the script's JSON: treated as unsigned.
+    }
+}
+/** Whether a file's valid signature is the expected signer's. */
+export function signedBy(file, signer) {
+    return signerMatches(signatureOf(file), signer);
+}

package/dist/guest/vpn/tunnel.d.ts

@@ -1,6 +1,9 @@
+import { type VpnFailureCode } from '../../shared/vpn/failure.js';
 export interface TunnelOutcome {
     readonly ok: boolean;
     readonly message: string;
+    /** Why it failed (when it did), for the host to act on. */
+    readonly code?: VpnFailureCode;
     /** The tunnel's own address (what the kill switch lets through). */
     readonly tunnelIp?: string;
 }

package/dist/guest/vpn/tunnel.js

@@ -6,21 +6,14 @@ import { spawn } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { classifyFailure } from '../../shared/vpn/failure.js';
 import { tunnelAddressFromLog } from '../../shared/vpn/kill-switch.js';
 import { logsDir } from '../runtime/paths.js';
 import { log } from '../runtime/log.js';
 const DONE = 'Initialization Sequence Completed';
 /** Why the log says OpenVPN stopped, in a short plain sentence (or null when it does not say). */
 export function failureReason(text) {
-    if (/AUTH_FAILED/i.test(text))
-        return 'the VPN refused the login (for NordVPN use the service credentials, not your account password)';
-    if (/TLS Error: TLS key negotiation failed|TLS handshake failed/i.test(text))
-        return 'it could not reach the VPN server (the network blocks it, or the server is down)';
-    if (/All wintun adapters on this system are in use|Cannot open TUN\/TAP|Could not create Wintun|ovpn-dco.*(error|failed)/i.test(text))
-        return 'the network driver for the tunnel could not be used';
-    if (/Exiting due to fatal error/i.test(text))
-        return 'OpenVPN stopped with an error';
-    return null;
+    return classifyFailure(text)?.reason ?? null;
 }
 const tail = (text, lines = 12) => text.trim().split(/\r?\n/).slice(-lines).join('\n');
 /** Connects. Never leaves the login on disk; kills OpenVPN when the tunnel does not come up in time. */
@@ -57,17 +50,22 @@ export async function startTunnel(o) {
                 const tunnelIp = tunnelAddressFromLog(text) ?? undefined;
                 return { ok: true, message: 'the tunnel is up', ...(tunnelIp ? { tunnelIp } : {}) };
             }
-            const reason = failureReason(text);
+            const failure = classifyFailure(text);
+            const reason = failure?.reason ?? null;
             if (exited !== null || reason) {
                 if (exited === null)
                     child.kill();
                 keepLog();
-                return { ok: false, message: (reason ?? 'OpenVPN stopped') + '. ' + tail(text, 4) };
+                return {
+                    ok: false,
+                    code: failure?.code ?? 'other',
+                    message: (reason ?? 'OpenVPN stopped') + '. ' + tail(text, 4),
+                };
             }
             if (Date.now() > deadline) {
                 child.kill();
                 keepLog();
-                return { ok: false, message: 'the tunnel did not come up in time. ' + tail(text, 4) };
+                return { ok: false, code: 'timeout', message: 'the tunnel did not come up in time. ' + tail(text, 4) };
             }
             await new Promise((r) => setTimeout(r, 500));
         }

package/dist/guest/vpn/vpn.js

@@ -123,6 +123,7 @@ export async function setupVpn(secrets, ptyHostExe) {
             warn('VPN: the kill switch did not hold: a direct connection still got out. If the tunnel drops, traffic leaves through your normal connection.');
     };
     setVpnStatus('starting', 'Starting the VPN');
+    let failureCode;
     try {
         if (!session.networking)
             throw new Error('networking is off for this sandbox');
@@ -178,6 +179,7 @@ export async function setupVpn(secrets, ptyHostExe) {
         if (!result.ok) {
             if (wireguardExe)
                 await removeWireguardTunnel(wireguardExe);
+            failureCode = result.code;
             throw new Error(result.message);
         }
         if (!result.tunnelIp || !hasAdapter(result.tunnelIp))
@@ -207,7 +209,10 @@ export async function setupVpn(secrets, ptyHostExe) {
                 ? ' The kill switch is on, so this sandbox has NO internet access.'
                 : ' The kill switch could NOT close the network, so this sandbox is ONLINE through your normal connection, without the VPN.';
         warn('VPN failed: ' + reason + after);
-        setVpnStatus('failed', reason, killSwitch ? { killSwitchHeld: held } : {});
+        setVpnStatus('failed', reason, {
+            code: failureCode ?? 'other',
+            ...(killSwitch ? { killSwitchHeld: held } : {}),
+        });
         return false;
     }
 }

package/dist/host/accounts/leases.d.ts

@@ -3,13 +3,13 @@ import { type ServiceKind } from '../../shared/accounts/index.js';
 declare const LeaseSchema: z.ZodObject<{
     kind: z.ZodEnum<{
         unity: "unity";
-        steam: "steam";
-        epic: "epic";
-        cfx: "cfx";
         keystore: "keystore";
         play: "play";
         expo: "expo";
         appstore: "appstore";
+        cfx: "cfx";
+        steam: "steam";
+        epic: "epic";
     }>;
     dataSet: z.ZodString;
     launchId: z.ZodString;

package/dist/host/accounts/source.js

@@ -11,5 +11,5 @@ export function pcEnv() {
 }
 /** What a kind whose host side is not written yet says. */
 export function notAvailableYet(kind) {
-    return fail('Saving a ' + SERVICE_SPECS[kind].label + ' sign-in is not available yet.', 'It comes in a later version of the sandbox.');
+    return fail('Saving a ' + SERVICE_SPECS[kind].label + ' sign-in comes in a later version of the sandbox.', 'Nothing was changed.');
 }

package/dist/host/agent-commands/commands.js

@@ -1,4 +1,4 @@
-// (Beta) Agent commands: with agentCommands.enabled, typing an agent's own command on this PC (claude, codex, ...)
+// Agent commands: with agentCommands.enabled, typing an agent's own command on this PC (claude, codex, ...)
 // starts it in a hidden sandbox for the folder you are in and attaches that terminal. Small forwarding files in
 // <storage>\agent-commands go first on YOUR PATH (so they win over npm's and the installers' copies); turning it off
 // removes the files and that one PATH entry. SANDBOX_AGENT_DIRECT=1 runs the real agent on this PC instead.

package/dist/host/agent-commands/forwarders.d.ts

@@ -1,7 +1,19 @@
 import type { AgentCommand } from './commands.js';
 /** Marks files this tool wrote, so only those are ever replaced or removed. */
 export declare const MARKER = "windows-development-sandbox agent command";
+/** What a forwarding file runs: the managed install's launcher when there is one, else node + the entry file. */
+export interface ForwardTarget {
+    readonly node: string;
+    readonly entry: string;
+    /** The managed install's `bin\sandbox.cmd`: it survives updates, which remove the version folder `entry` is in. */
+    readonly launcher?: string;
+}
+/**
+ * Where the forwarding files send the typed command. Under a managed install (installRoot, the folder with `bin`,
+ * `versions` and `node`) that is its launcher; otherwise the entry file of this copy.
+ */
+export declare function forwardTarget(packageRoot: string, installRoot: string | null, node: string): ForwardTarget;
 /** The .cmd file for one agent (cmd, PowerShell and Windows Terminal all run it). */
-export declare function forwardingCmd(a: AgentCommand, node: string, entry: string): string;
+export declare function forwardingCmd(a: AgentCommand, target: ForwardTarget): string;
 /** The same for Git Bash, which looks for a file without an extension. */
-export declare function forwardingSh(a: AgentCommand, node: string, entry: string): string;
+export declare function forwardingSh(a: AgentCommand, target: ForwardTarget): string;

package/dist/host/agent-commands/forwarders.js

@@ -1,12 +1,30 @@
+import path from 'node:path';
 /** Marks files this tool wrote, so only those are ever replaced or removed. */
 export const MARKER = 'windows-development-sandbox agent command';
+/**
+ * Where the forwarding files send the typed command. Under a managed install (installRoot, the folder with `bin`,
+ * `versions` and `node`) that is its launcher; otherwise the entry file of this copy.
+ */
+export function forwardTarget(packageRoot, installRoot, node) {
+    const entry = path.join(packageRoot, 'dist', 'bin', 'sandbox.js');
+    return installRoot ? { node, entry, launcher: path.join(installRoot, 'bin', 'sandbox.cmd') } : { node, entry };
+}
+const posix = (p) => p.replace(/^([A-Za-z]):/, (_m, d) => '/' + d.toLowerCase()).replace(/\\/g, '/');
 /** The .cmd file for one agent (cmd, PowerShell and Windows Terminal all run it). */
-export function forwardingCmd(a, node, entry) {
+export function forwardingCmd(a, target) {
+    const launch = ' launch --harness ' + a.harness + ' --headless --terminal -- %*';
     return [
         '@echo off',
-        'rem ' + MARKER + ' (Beta). Turn off: sandbox agent-commands off. Run the real one: set SANDBOX_AGENT_DIRECT=1',
+        'rem ' + MARKER + '. Turn off: sandbox agent-commands off. Run the real one: set SANDBOX_AGENT_DIRECT=1',
         'if "%SANDBOX_AGENT_DIRECT%"=="1" goto direct',
-        '"' + node + '" "' + entry + '" launch --harness ' + a.harness + ' --headless --terminal -- %*',
+        // A missing program (the tool was uninstalled or moved) runs the real agent instead of failing.
+        ...(target.launcher
+            ? ['if not exist "' + target.launcher + '" goto direct', 'call "' + target.launcher + '"' + launch]
+            : [
+                'if not exist "' + target.node + '" goto direct',
+                'if not exist "' + target.entry + '" goto direct',
+                '"' + target.node + '" "' + target.entry + '"' + launch,
+            ]),
         'exit /b %errorlevel%',
         ':direct',
         'call "' + a.real + '" %*',
@@ -14,20 +32,20 @@ export function forwardingCmd(a, node, entry) {
     ].join('\r\n');
 }
 /** The same for Git Bash, which looks for a file without an extension. */
-export function forwardingSh(a, node, entry) {
-    const posix = (p) => p.replace(/^([A-Za-z]):/, (_m, d) => '/' + d.toLowerCase()).replace(/\\/g, '/');
+export function forwardingSh(a, target) {
     const q = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
+    const launch = ' launch --harness ' + a.harness + ' --headless --terminal -- "$@"';
+    const shLauncher = target.launcher ? posix(target.launcher).replace(/\.cmd$/i, '') : null;
     return [
         '#!/bin/sh',
-        '# ' + MARKER + ' (Beta). Turn off: sandbox agent-commands off. Run the real one: SANDBOX_AGENT_DIRECT=1',
+        '# ' + MARKER + '. Turn off: sandbox agent-commands off. Run the real one: SANDBOX_AGENT_DIRECT=1',
         'if [ "$SANDBOX_AGENT_DIRECT" = "1" ]; then exec ' + q(posix(a.real)) + ' "$@"; fi',
-        'exec ' +
-            q(posix(node)) +
-            ' ' +
-            q(posix(entry)) +
-            ' launch --harness ' +
-            a.harness +
-            ' --headless --terminal -- "$@"',
+        ...(shLauncher
+            ? ['[ -f ' + q(shLauncher) + ' ] || exec ' + q(posix(a.real)) + ' "$@"', 'exec ' + q(shLauncher) + launch]
+            : [
+                '[ -f ' + q(posix(target.entry)) + ' ] || exec ' + q(posix(a.real)) + ' "$@"',
+                'exec ' + q(posix(target.node)) + ' ' + q(posix(target.entry)) + launch,
+            ]),
         '',
     ].join('\n');
 }

package/dist/host/agent-commands/reconcile.d.ts

@@ -1,4 +1,5 @@
 import type { Config } from '../../core/types.js';
+import { type ForwardTarget } from './forwarders.js';
 import { type AgentCommand } from './commands.js';
 export interface Reconciled {
     on: boolean;
@@ -9,4 +10,4 @@ export interface Reconciled {
  * Makes this PC match agentCommands: on = a forwarding file per installed agent and the folder first on your PATH;
  * off = no files, no PATH entry. Only touches files it wrote and its own PATH entry; does nothing when already right.
  */
-export declare function reconcileAgentCommands(config: Config, storageRoot: string, node: string, entry: string): Reconciled;
+export declare function reconcileAgentCommands(config: Config, storageRoot: string, target: ForwardTarget): Reconciled;

package/dist/host/agent-commands/reconcile.js

@@ -5,7 +5,7 @@ import { writeFileAtomic } from '../../shared/io/index.js';
 import { safeRemove } from '../../shared/io/index.js';
 import { MARKER, forwardingCmd, forwardingSh } from './forwarders.js';
 import { commandsDir, cmdSafe, agentCommands } from './commands.js';
-import { editUserPath } from './user-path.js';
+import { editUserPath, userPathHas } from './user-path.js';
 const ownFiles = (dir) => fs.existsSync(dir)
     ? fs
         .readdirSync(dir)
@@ -23,7 +23,7 @@ const ownFiles = (dir) => fs.existsSync(dir)
  * Makes this PC match agentCommands: on = a forwarding file per installed agent and the folder first on your PATH;
  * off = no files, no PATH entry. Only touches files it wrote and its own PATH entry; does nothing when already right.
  */
-export function reconcileAgentCommands(config, storageRoot, node, entry) {
+export function reconcileAgentCommands(config, storageRoot, target) {
     const dir = commandsDir(storageRoot);
     if (!config.agentCommands.enabled) {
         if (!fs.existsSync(dir))
@@ -35,14 +35,14 @@ export function reconcileAgentCommands(config, storageRoot, node, entry) {
             safeRemove(dir, storageRoot);
         return { on: false, commands: [], changed: true };
     }
-    if (!cmdSafe(node) || !cmdSafe(entry))
+    if (![target.node, target.entry, target.launcher ?? ''].every(cmdSafe))
         throw new Error('This tool is installed in a folder whose path has % " or ^, which cannot go into a command file safely.');
     const commands = agentCommands(config, storageRoot);
     ensureDir(dir);
     const wanted = new Map();
     for (const a of commands) {
-        wanted.set(path.join(dir, a.command + '.cmd'), forwardingCmd(a, node, entry));
-        wanted.set(path.join(dir, a.command), forwardingSh(a, node, entry));
+        wanted.set(path.join(dir, a.command + '.cmd'), forwardingCmd(a, target));
+        wanted.set(path.join(dir, a.command), forwardingSh(a, target));
     }
     let changed = false;
     for (const f of ownFiles(dir))
@@ -60,9 +60,8 @@ export function reconcileAgentCommands(config, storageRoot, node, entry) {
             changed = true;
         }
     }
-    const onPath = (process.env.PATH ?? '')
-        .split(path.delimiter)
-        .some((d) => path.resolve(d).toLowerCase() === path.resolve(dir).toLowerCase());
+    // Your PATH as stored (not this process's copy of it, which an older terminal keeps): the registry says if it is on.
+    const onPath = !changed && userPathHas(dir, storageRoot);
     if (changed || !onPath)
         editUserPath(dir, true, storageRoot);
     return { on: true, commands, changed: changed || !onPath };

package/dist/host/agent-commands/user-path.d.ts

@@ -3,3 +3,8 @@
  * <storageRoot>\bin), else native\scripts\edit-user-path.ps1.
  */
 export declare function editUserPath(dir: string, add: boolean, storageRoot: string): void;
+/**
+ * Whether dir is on YOUR PATH as stored in the registry (not this process's copy, which an older terminal keeps stale).
+ * False when it cannot be told: the caller then edits the PATH again, which is harmless.
+ */
+export declare function userPathHas(dir: string, storageRoot: string): boolean;

package/dist/host/agent-commands/user-path.js

@@ -23,3 +23,16 @@ export function editUserPath(dir, add, storageRoot) {
             ' your PATH: ' +
             (result.stderr || result.error?.message || 'exit ' + result.status).trim());
 }
+/**
+ * Whether dir is on YOUR PATH as stored in the registry (not this process's copy, which an older terminal keeps stale).
+ * False when it cannot be told: the caller then edits the PATH again, which is harmless.
+ */
+export function userPathHas(dir, storageRoot) {
+    refuseInSelfTest('read your PATH');
+    const tools = hostToolsExe(storageRoot);
+    const options = { encoding: 'utf8', windowsHide: true };
+    const result = tools
+        ? spawnSync(tools, ['user-path', '--has', dir], options)
+        : spawnSync(SYSTEM.powershell(), nativeScript('edit-user-path.ps1', ['-Dir', dir, '-Query']), options);
+    return result.status === 0;
+}

package/dist/host/launch/session-file.js

@@ -65,6 +65,7 @@ export function guestSession(o, parts) {
         loadProfile: loadProfileOf(config),
         pageFileMb: config.sandbox.pageFileMb,
         agentBackstop: config.sandbox.agentMemoryHeadroomMb,
+        codex: config.codex,
         pressureResponse: config.sandbox.pressureResponse,
         apps: config.apps,
         auditProcesses: config.audit.enabled && config.audit.processes,

package/dist/host/profile/accounts.js

@@ -9,6 +9,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { z } from 'zod';
+import { ANTHROPIC_KEY_HINT } from '../../shared/accounts/index.js';
 import { isSafeFileName } from '../../shared/paths/index.js';
 import { JsonFile } from '../../shared/io/index.js';
 import { storageOf } from '../storage/index.js';
@@ -36,10 +37,7 @@ const SealedSchema = z.object({
     email: z.string().max(200).nullable(),
     /** Missing in accounts saved before keys could be: a subscription. */
     kind: z.enum(LOGIN_KINDS).optional(),
-    keyHint: z
-        .string()
-        .regex(/^sk-ant-\.\.\.[A-Za-z0-9_-]{4}$/)
-        .optional(),
+    keyHint: z.string().regex(ANTHROPIC_KEY_HINT).optional(),
     sealed: z.string().max(200000),
 });
 const StoredSchema = z.union([SealedSchema, AccountSchema]);

package/dist/host/profile/claude-login.d.ts

@@ -1,3 +1,4 @@
+import { anthropicKeyProblem } from '../../shared/accounts/index.js';
 /** subscription: claude.ai OAuth; console: the key a Console login made; api-key: a key you gave. */
 export type LoginKind = 'subscription' | 'console' | 'api-key';
 export declare const LOGIN_KINDS: readonly ["subscription", "console", "api-key"];
@@ -16,8 +17,8 @@ export interface CaptureOptions {
     /** ANTHROPIC_API_KEY of this PC: the last place looked at (--from-host only). */
     readonly envKey?: string | null;
 }
-/** What is wrong with a typed or found API key, or null when it has the right shape. Never quotes the key. */
-export declare function apiKeyProblem(key: string): string | null;
+/** What is wrong with a typed or found API key (sk-ant-api or sk-ant-usr), or null. Never quotes the key. */
+export declare const apiKeyProblem: typeof anthropicKeyProblem;
 /** The most of a key that is ever shown: sk-ant-...abcd. */
 export declare function maskApiKey(key: string): string;
 export interface LoginFiles {

package/dist/host/profile/claude-login.js

@@ -9,23 +9,13 @@
 // written through. A key read from the sandbox must have the shape of an API key.
 import fs from 'node:fs';
 import path from 'node:path';
+import { anthropicKeyProblem } from '../../shared/accounts/index.js';
 import { assertTestWritable } from '../test-guard.js';
 import { hostDataFolder, hostDataRoot } from '../storage/index.js';
 import { assertNoLinks, fail, fileExists, isLink, removeLink, tryReadJson, writeJson } from '../../core/util/index.js';
 export const LOGIN_KINDS = ['subscription', 'console', 'api-key'];
-/** sk-ant-api03-...: a normal Anthropic API key (letters, digits, - and _, which is what Claude Code accepts). */
-const API_KEY = /^sk-ant-api\d{2}-[A-Za-z0-9_-]{20,400}$/;
-const API_USER_KEY = /^sk-ant-usr\d{2}-[A-Za-z0-9_-]{20,400}$/;
-/** What is wrong with a typed or found API key, or null when it has the right shape. Never quotes the key. */
-export function apiKeyProblem(key) {
-    if (API_KEY.test(key) || API_USER_KEY.test(key))
-        return null;
-    if (key.startsWith('sk-ant-oat'))
-        return 'That is a Claude subscription token (from claude setup-token), not an API key. Save the subscription login instead.';
-    if (key.startsWith('sk-ant-admin'))
-        return 'That is an Admin key: it cannot run Claude. Make an API key instead.';
-    return 'An Anthropic API key starts with sk-ant-api or sk-ant-usr and has only letters, digits, - and _ (copy it from the Claude Console).';
-}
+/** What is wrong with a typed or found API key (sk-ant-api or sk-ant-usr), or null. Never quotes the key. */
+export const apiKeyProblem = anthropicKeyProblem;
 /** The most of a key that is ever shown: sk-ant-...abcd. */
 export function maskApiKey(key) {
     return 'sk-ant-...' + key.slice(-4);

package/dist/host/vpn/index.d.ts

@@ -1,4 +1,5 @@
-export { VpnLogin, loginProblem, type LoginState, type VpnCredentials } from './login.js';
+export { VpnLogin, loginProblem, loginWarning, type LoginState, type VpnCredentials } from './login.js';
 export { fetchBounded, findCountry, nordProfile, recommendedServer, type Fetcher, type NordServer } from './nordvpn.js';
 export { prepareVpn, vpnNotes, wireguardFileProblem, type PrepareOptions } from './prepare.js';
 export { hostPublicIp, readVpnLine, vpnLine, type VpnLine } from './status.js';
+export { readLastFailure, recordLastVpn, type LastVpn, type VpnFailureInfo } from './last.js';

package/dist/host/vpn/index.js

@@ -1,4 +1,5 @@
-export { VpnLogin, loginProblem } from './login.js';
+export { VpnLogin, loginProblem, loginWarning } from './login.js';
 export { fetchBounded, findCountry, nordProfile, recommendedServer } from './nordvpn.js';
 export { prepareVpn, vpnNotes, wireguardFileProblem } from './prepare.js';
 export { hostPublicIp, readVpnLine, vpnLine } from './status.js';
+export { readLastFailure, recordLastVpn } from './last.js';

package/dist/host/vpn/last.d.ts

@@ -0,0 +1,28 @@
+import { z } from 'zod';
+declare const LastSchema: z.ZodObject<{
+    state: z.ZodEnum<{
+        failed: "failed";
+        up: "up";
+    }>;
+    code: z.ZodOptional<z.ZodEnum<{
+        auth: "auth";
+        unreachable: "unreachable";
+        driver: "driver";
+        timeout: "timeout";
+        other: "other";
+    }>>;
+    message: z.ZodString;
+    at: z.ZodString;
+}, z.core.$strip>;
+export type LastVpn = z.output<typeof LastSchema>;
+/** What the page shows for a failure: the plain sentence, never the raw log. */
+export interface VpnFailureInfo {
+    readonly code: NonNullable<LastVpn['code']>;
+    readonly text: string;
+    readonly at: string;
+}
+/** Copies the sandbox's final VPN state to host storage (nothing when the VPN was off). Never throws. */
+export declare function recordLastVpn(storageRoot: string, dataPath: string): void;
+/** The last attempt, when it failed (null when it worked or none is known). */
+export declare function readLastFailure(storageRoot: string): VpnFailureInfo | null;
+export {};

package/dist/host/vpn/last.js

@@ -0,0 +1,43 @@
+// The last VPN result of a sandbox, kept in host storage (<storage>\vpn\last.json) when the sandbox closes, so "the
+// login was refused" can still be shown after the sandbox is gone. Read from the sandbox's run\vpn.json (validated),
+// never from anything else the guest wrote; the text is made safe before it is kept.
+import path from 'node:path';
+import { z } from 'zod';
+import { RunDir } from '../../shared/channel/index.js';
+import { JsonFile } from '../../shared/io/index.js';
+import { FAILURE_TEXT } from '../../shared/vpn/failure.js';
+import { safeText } from '../../core/util/index.js';
+const LastSchema = z.object({
+    state: z.enum(['up', 'failed']),
+    code: z.enum(['auth', 'unreachable', 'driver', 'timeout', 'other']).optional(),
+    message: z.string().max(400),
+    at: z.string().max(64),
+});
+function lastFile(storageRoot) {
+    return new JsonFile(LastSchema, path.join(storageRoot, 'vpn', 'last.json'));
+}
+/** Copies the sandbox's final VPN state to host storage (nothing when the VPN was off). Never throws. */
+export function recordLastVpn(storageRoot, dataPath) {
+    try {
+        const status = new RunDir(dataPath).readVpnStatus();
+        if (!status || (status.state !== 'up' && status.state !== 'failed'))
+            return;
+        lastFile(storageRoot).write({
+            state: status.state,
+            ...(status.code ? { code: status.code } : {}),
+            message: safeText(status.message).slice(0, 400),
+            at: status.updatedAt,
+        });
+    }
+    catch {
+        // Only a convenience for the page: a failure here must not hold the final sync up.
+    }
+}
+/** The last attempt, when it failed (null when it worked or none is known). */
+export function readLastFailure(storageRoot) {
+    const last = lastFile(storageRoot).read();
+    if (!last || last.state !== 'failed')
+        return null;
+    const code = last.code ?? 'other';
+    return { code, text: FAILURE_TEXT[code], at: last.at };
+}

package/dist/host/vpn/login.d.ts

@@ -7,7 +7,9 @@ export interface VpnCredentials {
 /** What `sandbox vpn status` may say about the login: never the values. */
 export type LoginState = 'none' | 'saved' | 'unreadable';
 /** The login must go on two lines of a file for OpenVPN, so no line breaks or other control characters. */
-export declare function loginProblem(c: VpnCredentials): string | null;
+export declare function loginProblem(c: VpnCredentials, provider?: VpnProvider): string | null;
+/** A hint (not a refusal) when a NordVPN login does not look like service credentials (letters and digits, ~24). */
+export declare function loginWarning(c: VpnCredentials, provider: VpnProvider): string | null;
 export declare class VpnLogin {
     private readonly storageRoot;
     private readonly secrets;

package/dist/host/vpn/login.js

@@ -14,16 +14,30 @@ const SavedSchema = z.object({
     sealed: z.string().max(10000),
 });
 /** The login must go on two lines of a file for OpenVPN, so no line breaks or other control characters. */
-export function loginProblem(c) {
+export function loginProblem(c, provider) {
     const clean = (v) => !/[\u0000-\u001f\u007f]/.test(v);
     if (!c.username.trim() || !c.password)
         return 'Both the user name and the password are needed.';
     if (!clean(c.username) || !clean(c.password))
         return 'The login may not contain line breaks or control characters.';
+    // The markers a terminal puts around pasted text ([200~ ... [201~) are not part of any login.
+    if (/\[20[01]~/.test(c.username + c.password))
+        return 'The login has hidden paste characters in it (the terminal added them when you pasted).';
     if (c.username.length > 256 || c.password.length > 1024)
         return 'The user name or password is too long.';
+    if (provider === 'nordvpn' && /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(c.username.trim()))
+        return 'That looks like your NordVPN account e-mail. Use the service credentials: Nord Account > NordVPN > Manual setup.';
     return null;
 }
+/** A hint (not a refusal) when a NordVPN login does not look like service credentials (letters and digits, ~24). */
+export function loginWarning(c, provider) {
+    if (provider !== 'nordvpn')
+        return null;
+    const ok = (v) => /^[A-Za-z0-9]{16,64}$/.test(v.trim());
+    return ok(c.username) && ok(c.password)
+        ? null
+        : 'NordVPN service credentials are letters and digits only (about 24 each). If the VPN says the login was refused, copy them again from Nord Account > NordVPN > Manual setup.';
+}
 export class VpnLogin {
     storageRoot;
     secrets;
@@ -36,13 +50,13 @@ export class VpnLogin {
     }
     /** Encrypts and saves the login (replacing an earlier one). */
     save(provider, login) {
-        const problem = loginProblem(login);
+        const problem = loginProblem({ username: login.username.trim(), password: login.password.trim() }, provider);
         if (problem)
             fail(problem, 'Type the service credentials again.');
         this.file(provider).write({
             provider,
             savedAt: new Date().toISOString(),
-            sealed: this.secrets.sealJson({ username: login.username.trim(), password: login.password }),
+            sealed: this.secrets.sealJson({ username: login.username.trim(), password: login.password.trim() }),
         });
     }
     /** The login, decrypted. Only the launch calls this. */

package/dist/runtime/agent.js

@@ -25351,6 +25351,22 @@ var DatabasesSchema = external_exports.strictObject({
   })
 });
 
+// src/core/schema/codex.ts
+var CodexSchema = external_exports.strictObject({
+  sandboxMode: external_exports.enum(["danger-full-access", "workspace-write", "read-only"]).describe(
+    "Codex's own sandbox. Inside Windows Sandbox Codex's own sandbox only slows it down (it re-grants file permissions over your profile at every boot), so the default is danger-full-access: Windows Sandbox is the sandbox."
+  ),
+  approvalPolicy: external_exports.enum(["never", "on-request", "on-failure", "untrusted"]).describe('When Codex asks before it runs a command. "never" with danger-full-access starts it with no questions.'),
+  model: external_exports.string().max(100).regex(/^[A-Za-z0-9._:/-]*$/, "letters, digits and . _ : / - only").describe("The model Codex uses. Empty = Codex's own default."),
+  reasoningEffort: external_exports.enum(["default", "minimal", "low", "medium", "high", "xhigh"]).describe(`How hard Codex thinks. "default" = Codex's own default.`),
+  windowsSandbox: external_exports.enum(["off", "unelevated", "elevated"]).describe(
+    `Codex's Windows sandbox mode in its config.toml. "off" removes the setting so Codex does not set up its sandbox users and firewall rules at every boot.`
+  ),
+  mcpLoginsInFile: external_exports.boolean().describe(
+    `Keep the sign-ins of Codex's MCP servers in a file in the saved Codex folder (mcp_oauth_credentials_store = "file"), so they survive between sandboxes. A value you set in config.toml is kept.`
+  )
+});
+
 // src/core/schema/harness.ts
 var SubfolderSchema = external_exports.string().regex(/^(?!.*(^|[\\/])\.\.([\\/]|$))[A-Za-z0-9._ -]+([\\/][A-Za-z0-9._ -]+)*$/, "a plain relative folder");
 var HarnessHomeSchema = external_exports.strictObject({
@@ -25663,6 +25679,9 @@ var ToolchainsSchema = external_exports.strictObject({
     keepInstallFiles: external_exports.boolean().describe(
       "Keep an offline copy of the Visual Studio install files in tools\\visualstudio (~10 GB, made once), so later boots install without downloading them again. Skipped while that disk has too little room."
     ),
+    visualStudio: external_exports.enum(["full", "autosdk"]).describe(
+      `"full": install Visual Studio Community (the engine finds it through the Setup API; ~10 GB, redone every boot). "autosdk" (experimental): skip Visual Studio and build an Unreal AutoSDK tree from the portable MSVC in tools\\unreal\\autosdk (kept between sandboxes); UnrealBuildTool finds MSVC through AutoSDK, but the editor's Visual Studio integration is not available. Needs toolchains.msvc (turned on for you).`
+    ),
     persistEngines: external_exports.boolean().describe(
       "Engines the Epic Games Launcher installs go to tools\\unreal\\engines (kept between sandboxes, 40-60 GB each) and are registered with the launcher again every boot. Off: they go on the sandbox disk and are lost when it closes. Engines installed on this PC can be mapped instead (pcInstalls.unrealEngines)."
     ),
@@ -27119,6 +27138,7 @@ var ConfigSchema = external_exports.strictObject({
   apps: AppsSchema,
   claudeProfile: ClaudeProfileSchema,
   harnesses: external_exports.record(NameSchema, HarnessSchema).describe("Agents that can run in the sandbox."),
+  codex: CodexSchema,
   hooks: external_exports.strictObject({ failFast: external_exports.boolean().describe("Stop when a hook script fails.") }),
   projects: ProjectsSchema.describe(
     "Several projects in one sandbox: folders of projects mapped at every start, and adding folders while it runs."
@@ -27362,6 +27382,8 @@ var ProjectStatusSchema = external_exports.object({
 var VpnStatusSchema = external_exports.object({
   state: external_exports.enum(["off", "starting", "up", "failed"]),
   message: Text(2e3),
+  /** Why it failed, when it did: `auth` (login refused), `unreachable`, `driver`, `timeout` or `other`. */
+  code: external_exports.enum(["auth", "unreachable", "driver", "timeout", "other"]).optional(),
   killSwitch: external_exports.boolean(),
   /** A direct connection was tried after the kill switch was applied: false = it still got out. */
   killSwitchHeld: external_exports.boolean().optional(),
@@ -28056,6 +28078,12 @@ function agentPaths(toolsDir2, name, harness) {
 function agentCommand(name, harness) {
   return harness.npmBin ?? harness.uvBin ?? (harness.hostExecutable ?? name).replace(/\.exe$/i, "");
 }
+var CODEX_MARKER = "# Set by the sandbox";
+var MAX_CODEX_CONFIG_BYTES = 1024 * 1024;
+var MARKED_LINES = new RegExp(
+  "^" + CODEX_MARKER + "[^\r\n]*\r?\n(?:(?:sandbox_mode|approval_policy)[ 	]*=[^\r\n]*\r?\n)*(?:[ 	]*\r?\n)?",
+  "m"
+);
 
 // src/guest/setup/path-plan.ts
 import path16 from "node:path";