windows-development-sandbox 1.18.4 → 1.23.0

package/dist/selftest/agent-commands.test.js

@@ -1,14 +1,18 @@
-// Agent commands (Beta): which agents get a forwarding command, what the files contain, and that "off" changes nothing.
+// Agent commands: which agents get a forwarding command, what the files contain, and that "off" changes nothing.
 // Everything happens in the test's temp folder with a made-up PATH; your real PATH is never read or written.
 import fs from 'node:fs';
 import path from 'node:path';
 import { DEFAULTS } from '../core/config/index.js';
 import { agentCommands, commandsDir, realAgent } from '../host/agent-commands/index.js';
 import { forwardingCmd, forwardingSh } from '../host/agent-commands/index.js';
-import { reconcileAgentCommands } from '../host/agent-commands/index.js';
+import { forwardTarget, reconcileAgentCommands } from '../host/agent-commands/index.js';
+import { agentCommandsSection } from '../app/features/agent-commands/agent-commands.def.js';
+import { applyAgentCommandsChange } from '../app/features/settings/settings.run.js';
+import { fakeIO } from '../app/kernel/index.js';
+import { runDefinition } from '../app/registry.js';
 export const agentCommandsSuite = {
     name: 'agent-commands',
-    title: 'agent commands (Beta): claude, codex ... forwarded into a hidden sandbox',
+    title: 'agent commands: claude, codex ... forwarded into a hidden sandbox',
     run: async (t) => {
         const storage = t.at('agent-cmd-storage');
         const npmDir = t.at('agent-cmd-npm');
@@ -33,19 +37,53 @@ export const agentCommandsSuite = {
         t.check(!agentCommands(on, storage, unsafeDir).some((a) => a.command === 'aider'), 'an agent in a folder whose path has % or ^ (which cmd.exe would expand) is left alone');
         t.section('the forwarding files');
         const claude = { harness: 'claude', command: 'claude', real: path.join(localBin, 'claude.exe') };
-        const cmd = forwardingCmd(claude, 'C:\\node\\node.exe', 'C:\\tool\\dist\\bin\\sandbox.js');
+        const direct = { node: 'C:\\node\\node.exe', entry: 'C:\\tool\\dist\\bin\\sandbox.js' };
+        const cmd = forwardingCmd(claude, direct);
         t.check(cmd.includes('"C:\\node\\node.exe" "C:\\tool\\dist\\bin\\sandbox.js" launch --harness claude --headless --terminal -- %*') &&
             cmd.includes('if "%SANDBOX_AGENT_DIRECT%"=="1" goto direct') &&
             cmd.includes('call "' + claude.real + '" %*'), 'the .cmd starts the agent in a hidden sandbox attached to this terminal, unless SANDBOX_AGENT_DIRECT=1 (real agent)');
-        const sh = forwardingSh({ ...claude, real: "C:\\Users\\me\\it's\\claude.exe" }, 'C:\\node\\node.exe', 'C:\\tool\\sandbox.js');
+        t.check(cmd.includes('if not exist "C:\\node\\node.exe" goto direct') &&
+            cmd.includes('if not exist "C:\\tool\\dist\\bin\\sandbox.js" goto direct') &&
+            cmd.indexOf('if not exist') < cmd.indexOf('launch --harness'), 'the .cmd runs the real agent when the tool was uninstalled or moved, instead of failing');
+        const managed = forwardTarget('C:\\tool\\versions\\1.0\\package', 'C:\\tool', 'C:\\node\\node.exe');
+        const viaLauncher = forwardingCmd(claude, managed);
+        t.check(managed.launcher === 'C:\\tool\\bin\\sandbox.cmd' &&
+            forwardTarget('C:\\src\\repo', null, 'C:\\node\\node.exe').launcher === undefined &&
+            viaLauncher.includes('call "C:\\tool\\bin\\sandbox.cmd" launch --harness claude --headless --terminal -- %*') &&
+            !viaLauncher.includes('versions') &&
+            forwardingSh(claude, managed).includes("[ -f '/c/tool/bin/sandbox' ] || exec "), 'under a managed install the files call its launcher (it survives updates), else node and the entry file');
+        const sh = forwardingSh({ ...claude, real: "C:\\Users\\me\\it's\\claude.exe" }, {
+            node: 'C:\\node\\node.exe',
+            entry: 'C:\\tool\\sandbox.js',
+        });
         t.check(sh.startsWith('#!/bin/sh') &&
             sh.includes("exec '/c/node/node.exe' '/c/tool/sandbox.js' launch --harness claude --headless --terminal -- \"$@\"") &&
             sh.includes("'/c/Users/me/it'\\''s/claude.exe'"), 'Git Bash gets a shell script with POSIX paths, quoted safely');
         t.section('off changes nothing');
         // Off with nothing set up: nothing to do, no PATH edit (which would be refused during the self-test anyway).
         const fresh = t.at('agent-cmd-fresh');
-        const off = reconcileAgentCommands(DEFAULTS, fresh, 'C:\\node\\node.exe', 'C:\\tool\\sandbox.js');
+        const target = { node: 'C:\\node\\node.exe', entry: 'C:\\tool\\sandbox.js' };
+        const off = reconcileAgentCommands(DEFAULTS, fresh, target);
         t.equal({ on: off.on, changed: off.changed, wrote: fs.existsSync(commandsDir(fresh)) }, { on: false, changed: false, wrote: false }, 'off (the default) writes nothing and leaves your PATH alone');
-        await t.throws(() => reconcileAgentCommands(on, t.at('agent-cmd-on'), 'C:\\node\\node.exe', 'C:\\tool\\sandbox.js'), /self-test|PATH/i, 'turning it on edits your PATH, which the self-test refuses (it never changes this PC)');
+        await t.throws(() => reconcileAgentCommands(on, t.at('agent-cmd-on'), target), /self-test|PATH/i, 'turning it on edits your PATH, which the self-test refuses (it never changes this PC)');
+        t.section('every surface');
+        await t.throws(() => runDefinition('agentCommands.on', {}, {}, fakeIO().io), /self-test|PATH|inside the sandbox/i, 'agentCommands.on refuses in the self-test (it would change this PC)');
+        const reconciled = [];
+        const fakeService = { reconcile: (c) => reconciled.push(c) };
+        const ctx = { loaded: { configPath: undefined } };
+        applyAgentCommandsChange(ctx, 'user', 'agentCommands.enabled', fakeService);
+        applyAgentCommandsChange(ctx, 'user', 'defaultHarness', fakeService);
+        applyAgentCommandsChange(ctx, 'project', 'agentCommands.enabled', fakeService);
+        t.equal(reconciled.length, 1, 'changing agentCommands.* in your settings (any surface) brings this PC in line');
+        const section = agentCommandsSection({
+            enabled: false,
+            dir: 'C:\\x',
+            found: [{ command: 'claude', harness: 'claude', real: 'C:\\r\\claude.exe' }],
+        });
+        const toggle = section.items?.[0].primary;
+        t.check(section.items?.map((i) => i.id).join() === 'agentCommands,agentCommand:claude' &&
+            toggle?.kind === 'operation' &&
+            toggle.op === 'agentCommands.on' &&
+            !JSON.stringify(section).includes('sandbox agent-commands'), 'the Agents page offers the switch as an action and lists each agent found, naming no command');
     },
 };

package/dist/selftest/agent-paths.test.js

@@ -5,8 +5,8 @@ import path from 'node:path';
 import { DEFAULTS, mergeConfig, validateConfig } from '../core/config/index.js';
 import { isWin } from '../core/util/index.js';
 import { SYSTEM } from '../shared/system.js';
-import { agentCommand, agentShims, bootResetPaths, codexConfigWithoutSandbox, isCopyableDatabaseFile, isDatabaseFile, localStateEntries, shimText, } from '../guest/agents/agent-files.js';
-import { appendMissing, expandVars, isPinnedNodeDir, parseRegPath, pathKey, planPath, rebuildPath, splitPath, } from '../guest/setup/path-plan.js';
+import { agentCommand, agentShims, bootResetPaths, isCopyableDatabaseFile, isDatabaseFile, localStateEntries, shimText, } from '../guest/agents/agent-files.js';
+import { appendMissing, expandVars, installedToolPaths, isGitUsrBin, isMsvcToolsDir, isPinnedNodeDir, msvcBeforeGitUsr, parseRegPath, pathKey, planPath, rebuildPath, splitPath, } from '../guest/setup/path-plan.js';
 import { withReloadEnvironment } from '../host/tools/index.js';
 import { HarnessSchema } from '../core/schema/index.js';
 export const agentPathsSuite = {
@@ -59,17 +59,6 @@ export const agentPathsSuite = {
         ], "codex's DPAPI-sealed sandbox users and setup marker are removed at boot (CryptUnprotectData otherwise)");
         t.check(HarnessSchema.safeParse({ ...DEFAULTS.harnesses.codex, bootReset: ['..\\login'] }).success === false &&
             HarnessSchema.safeParse({ ...DEFAULTS.harnesses.codex, bootReset: ['C:\\Windows'] }).success === false, 'bootReset takes only plain paths below the agent state folder');
-        t.section('codex without its own command sandbox');
-        const userToml = '[tui]\nscreen_reader_detection_done = true\n\n[windows]\nsandbox = "elevated"\n';
-        const off = codexConfigWithoutSandbox(userToml) ?? '';
-        t.check(off.split('\n').find((l) => !l.startsWith('#')) === 'sandbox_mode = "danger-full-access"' &&
-            off.endsWith(userToml), 'sandbox_mode goes above the first table, the rest of the file is kept');
-        t.check(codexConfigWithoutSandbox('') === off.slice(0, off.indexOf('\n\n') + 1), 'a missing config.toml gets just the setting');
-        t.equal([
-            codexConfigWithoutSandbox(off),
-            codexConfigWithoutSandbox('model = "o3"\nsandbox_mode = "workspace-write"\n[windows]\n'),
-        ], [null, null], 'a sandbox_mode already set (by the sandbox or by the user) is left alone');
-        t.check(codexConfigWithoutSandbox('[profiles.x]\nsandbox_mode = "read-only"\n') !== null, 'a sandbox_mode inside a table does not count as the top-level one');
         t.section('PATH planner');
         const present = new Set(['c:\\a', 'c:\\b', 'c:\\c\\d', 'c:\\nvm\\v24.1.0']);
         const exists = (f) => present.has(pathKey(f));
@@ -89,6 +78,44 @@ export const agentPathsSuite = {
         }), 'C:\\only;C:\\a\\;C:\\Windows;C:\\b;C:\\u', 'a new shell: process-only entries first, then the registry, no duplicates, no runner node');
         t.equal(parseRegPath('\r\nHKEY_LOCAL_MACHINE\\X\r\n    Path    REG_EXPAND_SZ    C:\\a;%SystemRoot%\r\n\r\n'), 'C:\\a;%SystemRoot%', 'reg query output is parsed');
         t.equal(parseRegPath('ERROR: nothing'), '', 'no Path value is an empty PATH');
+        t.section('MSVC link before Git coreutils link');
+        const gitUsr = 'C:\\AgentData\\tools\\git\\usr\\bin';
+        const msvcBin = 'C:\\AgentData\\tools\\msvc\\VC\\Tools\\MSVC\\14.44.35207\\bin\\Hostx64\\x64';
+        t.check(isGitUsrBin(gitUsr) && isGitUsrBin('C:\\Program Files\\Git\\usr\\bin\\') && !isGitUsrBin('C:\\x\\usr\\bin'), "only Git's usr\\bin is recognised");
+        t.check(isMsvcToolsDir(msvcBin) && !isMsvcToolsDir('C:\\a\\bin'), "MSVC's compiler folder is recognised");
+        t.equal(msvcBeforeGitUsr(['C:\\a', gitUsr, 'C:\\b', msvcBin, 'C:\\c']), ['C:\\a', msvcBin, gitUsr, 'C:\\b', 'C:\\c'], 'MSVC found after Git usr\\bin moves just before it');
+        t.equal(msvcBeforeGitUsr([msvcBin, 'C:\\a', gitUsr]), [msvcBin, 'C:\\a', gitUsr], 'already in order: unchanged');
+        t.equal(msvcBeforeGitUsr(['C:\\a', gitUsr]), ['C:\\a', gitUsr], 'no MSVC: unchanged');
+        t.equal(planPath({ entries: [gitUsr, msvcBin], exists: () => true }), [msvcBin, gitUsr], 'the machine PATH plan puts MSVC first');
+        t.equal(appendMissing(gitUsr, msvcBin).split(';'), [msvcBin, gitUsr], 'a process that gains the MSVC folder later still finds its link first');
+        t.section('installed python and rust on every project');
+        const tree = new Set([
+            'python\\python-3.9.1\\python.exe',
+            'python\\python-3.15.2\\python.exe',
+            'python\\python-3.15.2',
+            'python\\python2-2.7.18\\python.exe',
+            'python\\python-3.20.0',
+            'shims\\py.cmd',
+            'rust\\cargo\\bin\\rustup.exe',
+        ].map((p) => 'c:\\t\\' + p.toLowerCase()));
+        const names = {
+            'c:\\t\\python': ['python-3.9.1', 'python-3.15.2', 'python2-2.7.18', 'python-3.20.0'],
+        };
+        const toolsFs = {
+            exists: (f) => tree.has(f.toLowerCase()),
+            list: (d) => names[d.toLowerCase()] ?? [],
+        };
+        const both = installedToolPaths('C:\\T', toolsFs);
+        t.equal(both.append, [
+            'C:\\T\\python\\python-3.15.2',
+            'C:\\T\\python\\python-3.15.2\\Scripts',
+            'C:\\T\\shims',
+            'C:\\T\\rust\\cargo\\bin',
+        ], 'the newest complete Python (not Python 2, not an unfinished folder) and rust go on PATH');
+        t.equal(both.vars, { RUSTUP_HOME: 'C:\\T\\rust\\rustup', CARGO_HOME: 'C:\\T\\rust\\cargo' }, "rust's own tools find their homes");
+        t.check(both.summary.length === 2, 'the guide can say what is there');
+        t.equal(installedToolPaths('C:\\T', toolsFs, new Set(['python', 'rust'])).append, [], 'a toolchain whose step runs brings its own entries');
+        t.equal(installedToolPaths('C:\\Empty', { exists: () => false, list: () => [] }).append, [], 'nothing installed: nothing added');
         t.section('Windows Terminal reloads the environment');
         t.equal(withReloadEnvironment({ compatibility: { reloadEnvironmentVariables: true } }), null, 'already set: unchanged');
         t.equal(withReloadEnvironment({ theme: 'dark', compatibility: { other: 1 } })?.compatibility, { other: 1, reloadEnvironmentVariables: true }, 'set without touching the rest of compatibility');

package/dist/selftest/agent-settings.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const agentSettingsSuite: Suite;

package/dist/selftest/agent-settings.test.js

@@ -0,0 +1,94 @@
+// Codex settings (launch flags, config.toml), the Claude environment editor and the one Anthropic key pattern.
+import fs from 'node:fs';
+import { DEFAULTS } from '../core/config/index.js';
+import { CodexSchema } from '../core/schema/index.js';
+import { agentEnv, agentsEnvSet } from '../app/features/agents/index.js';
+import { agentsOptions } from '../cli/menu/pages/agents-page.js';
+import { fakeIO } from '../app/kernel/index.js';
+import { runDefinition } from '../app/registry.js';
+import { agentArguments, agentShims, codexArguments, codexConfigOwned, shimText } from '../guest/agents/agent-files.js';
+import { ANTHROPIC_KEY_PATTERN, anthropicKeyProblem } from '../shared/accounts/index.js';
+import { CLAUDE_ENV, ENV_GROUPS } from '../app/features/agents/claude-env.def.js';
+const CODEX = DEFAULTS.codex;
+export const agentSettingsSuite = {
+    name: 'agent-settings',
+    title: 'Codex settings, Claude environment editor, Anthropic key pattern',
+    run: async (t) => {
+        t.section('codex launch flags');
+        t.equal(codexArguments(CODEX), ['--dangerously-bypass-approvals-and-sandbox'], 'full access + never = the bypass flag');
+        t.equal(codexArguments({ ...CODEX, sandboxMode: 'workspace-write', approvalPolicy: 'on-request' }), ['--sandbox', 'workspace-write', '--ask-for-approval', 'on-request'], 'another mode gets explicit flags');
+        t.equal(codexArguments({ ...CODEX, sandboxMode: 'danger-full-access', approvalPolicy: 'on-failure' }), ['--sandbox', 'danger-full-access', '--ask-for-approval', 'on-failure'], 'the bypass flag is only for full access with no questions');
+        t.equal(codexArguments({ ...CODEX, model: 'gpt-5', reasoningEffort: 'high' }).slice(1), ['-c', 'model="gpt-5"', '-c', 'model_reasoning_effort="high"'], 'model and reasoning effort follow as -c overrides');
+        t.check(CodexSchema.safeParse({ ...CODEX, model: 'x"; evil' }).success === false, 'a model name cannot carry quotes');
+        const codex = DEFAULTS.harnesses.codex;
+        t.equal(agentArguments('codex', codex, CODEX), [...codex.arguments, '--dangerously-bypass-approvals-and-sandbox'], "codex's launch arguments carry the flags");
+        t.equal(agentArguments('claude', DEFAULTS.harnesses.claude, CODEX), [...DEFAULTS.harnesses.claude.arguments], 'other agents do not');
+        const shim = agentShims('C:\\AgentData\\tools', DEFAULTS.harnesses, { codex: codexArguments(CODEX) }).find((s) => s.name === 'codex');
+        const text = shim ? shimText(shim, { node: 'node.exe', script: 'agent.js' }) : '';
+        t.includes(text, '"%SBX_REAL%" --dangerously-bypass-approvals-and-sandbox %*', 'the codex.cmd shim adds the flags');
+        t.excludes(shimText(agentShims('C:\\AgentData\\tools', DEFAULTS.harnesses).find((s) => s.name === 'codex'), { node: 'node.exe', script: 'agent.js' }), 'dangerously', 'a shim without flags passes only %*');
+        t.section('codex config.toml');
+        const old = '# Set by the sandbox: x\nsandbox_mode = "danger-full-access"\n\n[tui]\nscreen_reader_detection_done = true\n\n[windows]\nsandbox = "elevated"\n';
+        const owned = codexConfigOwned(old, CODEX);
+        t.check(!owned.includes('sandbox_mode') && !owned.includes('Set by the sandbox') && !owned.includes('sandbox = '), 'the old sandbox_mode lines and [windows] sandbox are removed', owned);
+        t.check(owned.includes('mcp_oauth_credentials_store = "file"') &&
+            owned.includes('[tui]\nscreen_reader_detection_done = true\n') &&
+            owned.includes('[windows]'), 'MCP logins go to a file; every other line stays', owned);
+        t.equal(codexConfigOwned(owned, CODEX), owned, 'running it again changes nothing');
+        t.includes(codexConfigOwned(old, { ...CODEX, windowsSandbox: 'unelevated' }), '[windows]\nsandbox = "unelevated"', 'a Windows sandbox mode is written when asked for');
+        t.includes(codexConfigOwned('mcp_oauth_credentials_store = "keyring"\n', CODEX), 'mcp_oauth_credentials_store = "keyring"', "a user's own mcp_oauth_credentials_store is kept");
+        t.equal(codexConfigOwned('', { ...CODEX, mcpLoginsInFile: false }), '', 'an empty file stays empty when nothing is owned');
+        t.section('Anthropic key pattern');
+        const body = 'a'.repeat(60);
+        t.check(ANTHROPIC_KEY_PATTERN.test('sk-ant-usr01-' + body) && ANTHROPIC_KEY_PATTERN.test('sk-ant-api03-' + body), 'sk-ant-api03- and sk-ant-usr01- keys are accepted');
+        t.check(!ANTHROPIC_KEY_PATTERN.test('sk-ant-usr1-x') && anthropicKeyProblem('sk-ant-usr1-x') !== null, 'a short or malformed key is refused');
+        t.check(anthropicKeyProblem('sk-ant-usr01-' + body) === null, 'no problem for a user-workspace key');
+        t.section('Claude environment catalogue');
+        const names = CLAUDE_ENV.map((s) => s.name);
+        t.check(new Set(names).size === names.length, 'names are unique');
+        t.check(names.every((n) => /^[A-Z][A-Z0-9_]+$/.test(n)) && CLAUDE_ENV.every((s) => ENV_GROUPS.includes(s.group)), 'names and groups are valid');
+        t.check(names.includes('CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS'), 'the subagent limit is there');
+        t.section('Claude environment operations');
+        const configPath = t.at('agent-env', 'config.json');
+        t.write(configPath, '{}\n');
+        const ctx = {
+            packageRoot: t.dir('agent-env', 'package'),
+            options: {},
+            loaded: { config: structuredClone(DEFAULTS), configPath, base: t.temp },
+            storageRoot: t.dir('agent-env', 'storage'),
+            dataPath: t.dir('agent-env', 'storage', 'data', 'o'),
+        };
+        const io = fakeIO([]).io;
+        const set = (name, value) => runDefinition(agentsEnvSet.id, ctx, { agent: 'claude', name, value }, io);
+        const read = async () => (await runDefinition(agentEnv.id, ctx, { agent: 'claude' }, io));
+        await set('CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS', '40');
+        let row = (await read()).rows.find((r) => r.name === 'CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS');
+        t.check(row?.set === true && row.value === '40', 'a number is saved and read back');
+        t.includes(fs.readFileSync(configPath, 'utf8'), '"CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS": "40"', 'it is in the settings file');
+        await t.throws(() => set('CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS', 'many'), 'whole number', 'a word is refused for a number');
+        await t.throws(() => set('CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS', '0'), 'Use a number', 'zero is refused');
+        await set('CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS', null);
+        row = (await read()).rows.find((r) => r.name === 'CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS');
+        t.check(row?.set === false, 'an empty value removes it');
+        await t.throws(() => set('ANTHROPIC_API_KEY', 'sk-ant-usr1-x'), 'API key', 'the environment editor refuses a bad key');
+        const key = 'sk-ant-usr01-' + 'k'.repeat(60);
+        await set('ANTHROPIC_API_KEY', key);
+        const shown = JSON.stringify(await read());
+        t.check(!shown.includes(key.slice(13)), 'a secret value is never returned');
+        t.check((await read()).rows.find((r) => r.name === 'ANTHROPIC_API_KEY')?.set === true, 'but it says it is set');
+        const env = await read();
+        const menu = agentsOptions({
+            folder: 'C:/code',
+            defaultAgent: 'claude',
+            agents: [{ name: 'claude', ready: true }],
+            last: undefined,
+            attach: false,
+            window: 'config',
+            hostAgents: [],
+            claudeEnv: env,
+        });
+        t.check(menu.categories?.some((c) => c.id === 'env') === true &&
+            menu.items.some((i) => i.label === 'Subagents at once' || i.label === 'API key'), 'the menu has a Claude environment tab with the variables');
+        await t.throws(() => set('bad name', '1'), '', 'a bad variable name is refused');
+    },
+};

package/dist/selftest/agents-web.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const agentsWebSuite: Suite;