windows-development-sandbox 1.4.0 → 1.4.3

package/dist/selftest/live-terminal.test.js

@@ -0,0 +1,195 @@
+// Live: the terminal path as you use it. An outer ptyhost stands in for Windows Terminal (it hosts the console, like
+// Windows Terminal's own pseudo console) and runs the real viewer/attach client (runTerminalClient), which is attached
+// to an inner ptyhost running a stand-in agent. The agent turns SGR mouse tracking on and echoes every byte it reads.
+// Checks: clicks and the wheel reach the agent, Backspace stays Backspace, a split escape sequence arrives whole,
+// 500 printed lines scroll through as lines (no alternate screen, no scrollback clear), and a viewer that joins after
+// a screen clear still gets mouse tracking.
+import fs from 'node:fs';
+import net from 'node:net';
+import path from 'node:path';
+import { spawn, spawnSync } from 'node:child_process';
+import { pathToFileURL } from 'node:url';
+import { encodeFrame, FrameType } from '../shared/pty/index.js';
+import { CSC, openViewer, tail, WAIT } from './support/live.js';
+/** The stand-in agent: VT input and SGR mouse tracking on, echoes what it reads ("got <1b>[<0;10;5M"). L prints 500 lines, K clears the screen, q quits. */
+const AGENT_CS = String.raw `
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+static class MouseAgent
+{
+    [DllImport("kernel32.dll")] static extern IntPtr GetStdHandle(int n);
+    [DllImport("kernel32.dll")] static extern bool GetConsoleMode(IntPtr h, out uint m);
+    [DllImport("kernel32.dll")] static extern bool SetConsoleMode(IntPtr h, uint m);
+    [DllImport("kernel32.dll")] static extern bool ReadFile(IntPtr h, byte[] b, int n, out int read, IntPtr o);
+    static void Say(string s) { Console.Out.Write(s); Console.Out.Flush(); }
+    static int Main()
+    {
+        IntPtr input = GetStdHandle(-10), output = GetStdHandle(-11);
+        uint mode;
+        GetConsoleMode(output, out mode); SetConsoleMode(output, mode | 4);
+        SetConsoleMode(input, 0x200);
+        Say("\x1b[?1000h\x1b[?1006hAGENT-READY\r\n");
+        var buffer = new byte[512];
+        int n;
+        while (ReadFile(input, buffer, buffer.Length, out n, IntPtr.Zero) && n > 0)
+        {
+            var text = new StringBuilder();
+            for (int i = 0; i < n; i++) text.Append(buffer[i] < 32 || buffer[i] > 126 ? "<" + buffer[i].ToString("x2") + ">" : ((char)buffer[i]).ToString());
+            string got = text.ToString();
+            Say("got " + got + "\r\n");
+            if (got == "L") { var lines = new StringBuilder(); for (int i = 1; i <= 500; i++) lines.Append("line " + i + "\r\n"); Say(lines.ToString() + "LINES-DONE\r\n"); }
+            if (got == "K") Say("\x1b[2J\x1b[HCLEARED\r\n");
+            if (got == "q") break;
+        }
+        // Exits with mouse tracking still on (like a crash): the client must turn it off.
+        return 0;
+    }
+}
+`;
+const freePort = () => new Promise((resolve, reject) => {
+    const server = net.createServer();
+    server.on('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+        const port = server.address().port;
+        server.close(() => resolve(port));
+    });
+});
+const compile = (source, exe) => {
+    const result = spawnSync(CSC, ['/nologo', '/optimize', '/target:exe', '/out:' + exe, source], {
+        encoding: 'utf8',
+        windowsHide: true,
+    });
+    return result.status === 0
+        ? ''
+        : ((result.stdout ?? '') + (result.stderr ?? '')).trim().slice(0, 1500) || 'csc failed';
+};
+/** conpty.dll as a sandbox has it (C:\AgentData\tools\conpty), when this machine has one; else only Windows' own is tested. */
+const conptyDll = () => {
+    const dll = path.join(process.env.AGENT_DATA_DIR ?? 'C:\\AgentData', 'tools', 'conpty', 'conpty.dll');
+    return fs.existsSync(dll) && fs.existsSync(path.join(path.dirname(dll), 'OpenConsole.exe')) ? dll : null;
+};
+export const liveTerminalSuite = {
+    name: 'live-terminal',
+    title: 'live: the viewer/attach client in a terminal (mouse clicks and wheel, keys, scrolling lines, late viewers)',
+    live: true,
+    timeoutMs: 300000,
+    run: async (t) => {
+        const ptyhost = t.at('ptyhost.exe');
+        const agent = t.at('mouse-agent.exe');
+        fs.writeFileSync(t.at('mouse-agent.cs'), AGENT_CS);
+        const errors = compile(path.join(t.packageRoot, 'sandbox', 'ptyhost.cs'), ptyhost) || compile(t.at('mouse-agent.cs'), agent);
+        t.check(!errors, 'ptyhost and the stand-in agent compile', errors);
+        if (errors)
+            return;
+        const client = t.at('client.mjs');
+        fs.writeFileSync(client, [
+            'import { connect, runTerminalClient } from ' +
+                JSON.stringify(pathToFileURL(path.join(t.packageRoot, 'dist', 'shared', 'pty', 'index.js')).href) +
+                ';',
+            'const socket = await connect({ addresses: ["127.0.0.1"], port: Number(process.argv[2]), token: "tok" });',
+            'const result = await runTerminalClient(socket, "tok");',
+            'console.log("CLIENT-DONE " + result.reason);',
+        ].join('\n'));
+        const dll = conptyDll();
+        const kinds = dll ? [dll, null] : [null];
+        if (!dll)
+            t.skip("conpty.dll not found on this machine: only Windows' own pseudo console is tested");
+        for (const kind of kinds) {
+            const label = kind ? 'conpty.dll' : "Windows' pseudo console";
+            t.section('live terminal (' + label + ')');
+            const children = [];
+            const viewers = [];
+            const start = (port, command, log) => {
+                const env = { ...process.env, PTYHOST_BIND: 'loopback' };
+                delete env.PTYHOST_CONPTY;
+                if (kind)
+                    env.PTYHOST_CONPTY = kind;
+                children.push(spawn(ptyhost, [String(port), 'tok', '100', '30', t.at(log), command], {
+                    env,
+                    stdio: 'ignore',
+                    windowsHide: true,
+                }));
+            };
+            try {
+                const innerPort = await freePort();
+                start(innerPort, '"' + agent + '"', 'inner-' + kinds.indexOf(kind) + '.log');
+                const outerPort = await freePort();
+                start(outerPort, '"' + process.execPath + '" "' + client + '" ' + innerPort, 'outer-' + kinds.indexOf(kind) + '.log');
+                // The terminal: what it shows is what the client wrote; what it types goes to the client's console.
+                const terminal = await openViewer({ addresses: ['127.0.0.1'], port: outerPort, token: 'tok' });
+                viewers.push(terminal);
+                const screen = () => terminal.output();
+                const send = (text) => {
+                    terminal.socket.write(encodeFrame(FrameType.Input, Buffer.from(text, 'latin1')));
+                };
+                const ready = await t.waitFor(() => screen().includes('AGENT-READY'), WAIT.screen);
+                t.check(Boolean(ready), 'the client shows the agent', 'screen: ' + tail(screen()));
+                if (!ready)
+                    continue;
+                // The client switches its console to pass the terminal's input through as it is; until then clicks are lost.
+                const click = '\x1b[<0;10;5M\x1b[<0;10;5m';
+                const clicked = await t.waitFor(() => {
+                    if (!screen().includes('got <1b>[<0;10;5M'))
+                        send(click);
+                    return screen().includes('got <1b>[<0;10;5M');
+                }, WAIT.screen, 1000);
+                t.check(Boolean(clicked), 'a mouse click in the terminal reaches the agent (SGR mouse report)', 'screen: ' + tail(screen(), 800));
+                const mark = screen().length;
+                const after = () => screen().slice(mark);
+                send('\x1b[<64;10;5M');
+                t.check(Boolean(await t.waitFor(() => after().includes('got <1b>[<64;10;5M'), WAIT.screen)), 'the mouse wheel reaches the agent while it tracks the mouse', 'screen: ' + tail(after(), 800));
+                send('\x7f');
+                t.check(Boolean(await t.waitFor(() => after().includes('got <7f>'), WAIT.screen)), 'Backspace reaches the agent as DEL (one character, not a word)', 'screen: ' + tail(after(), 800));
+                send('\x08');
+                t.check(Boolean(await t.waitFor(() => after().includes('got <08>'), WAIT.screen)), 'Ctrl+Backspace reaches the agent as ^H', 'screen: ' + tail(after(), 800));
+                send('\x1b[');
+                await new Promise((r) => setTimeout(r, 5));
+                send('C');
+                t.check(Boolean(await t.waitFor(() => after().includes('got <1b>[C'), WAIT.screen)), 'a Right arrow that reaches the client in two pieces arrives whole (no stray "C")', 'screen: ' + tail(after(), 800));
+                const before = screen().length;
+                send('L');
+                const done = await t.waitFor(() => screen().includes('LINES-DONE'), WAIT.screen);
+                const printed = screen().slice(before);
+                const seen = new Set([...printed.matchAll(/line (\d+)\b/g)].map((m) => Number(m[1])));
+                const missing = Array.from({ length: 500 }, (_, i) => i + 1)
+                    .filter((n) => !seen.has(n))
+                    .map((n) => 'line ' + n);
+                t.check(Boolean(done) && missing.length === 0, 'all 500 printed lines reach the terminal as lines', 'missing: ' + missing.slice(0, 10).join(', ') + '\n' + tail(printed));
+                // (The client clears the tab once when it starts; from then on nothing may take the scrollback away.)
+                const session = screen().slice(screen().indexOf('AGENT-READY'));
+                for (const [sequence, what] of [
+                    ['\x1b[?1049h', 'alternate screen'],
+                    ['\x1b[?47h', 'alternate screen (47)'],
+                    ['\x1b[?1047h', 'alternate screen (1047)'],
+                    ['\x1b[3J', 'clear scrollback'],
+                ]) {
+                    t.excludes(session, sequence, 'the terminal is never sent ' + what + ' (' + JSON.stringify(sequence) + ')');
+                }
+                if (kind) {
+                    // A viewer that joins after the agent cleared its screen: the replay starts at the clear, the modes come first.
+                    send('K');
+                    await t.waitFor(() => screen().includes('CLEARED'), WAIT.screen);
+                    const late = await openViewer({ addresses: ['127.0.0.1'], port: innerPort, token: 'tok' });
+                    viewers.push(late);
+                    await t.waitFor(() => late.output().includes('CLEARED'), WAIT.screen);
+                    const head = late.output().slice(0, late.output().indexOf('CLEARED'));
+                    t.check(head.includes('\x1b[?1000h') && head.includes('\x1b[?1006h'), "a viewer joining after a screen clear gets the agent's mouse tracking before the replay", 'late viewer: ' + JSON.stringify(late.output().slice(0, 300)));
+                    late.close();
+                }
+                send('q');
+                const ended = await t.waitFor(() => screen().includes('CLIENT-DONE'), WAIT.exit);
+                t.check(Boolean(ended), 'the client ends with the agent', 'screen: ' + tail(screen()));
+                if (kind)
+                    t.includes(screen().slice(screen().lastIndexOf('got q')), '\x1b[?1000l', 'leaving the session turns mouse tracking off in the terminal again');
+            }
+            finally {
+                for (const v of viewers)
+                    v.close();
+                for (const c of children)
+                    if (c.exitCode === null)
+                        c.kill();
+            }
+        }
+    },
+};

package/dist/selftest/local-config.test.d.ts

@@ -1,2 +1,2 @@
-import type { Suite } from './suite.js';
+import type { Suite } from './support/suite.js';
 export declare const localConfigSuite: Suite;

package/dist/selftest/local-config.test.js

@@ -3,8 +3,8 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { download, setChecksumRequired } from '../shared/download.js';
-import { allowedAnswer, allowStorePath, saveAllowed } from '../core/local-config.js';
+import { Downloader } from '../shared/download/index.js';
+import { allowedAnswer, allowStorePath, saveAllowed } from '../core/local-config/index.js';
 export const localConfigSuite = {
     name: 'local-config',
     title: '.sandbox-config.json: approval, tighten-only rules, validation',
@@ -14,7 +14,10 @@ export const localConfigSuite = {
             harness: 'codex',
             sandbox: { memoryMb: 4096, networking: false, headless: true },
             toolchains: { node: { version: '18' }, rust: { enabled: false } },
-            mappings: [{ host: './assets', guest: 'C:\\Assets', readOnly: true }, { host: './data', guest: 'C:\\Data', readOnly: false }],
+            mappings: [
+                { host: './assets', guest: 'C:\\Assets', readOnly: true },
+                { host: './data', guest: 'C:\\Data', readOnly: false },
+            ],
             scripts: ['./setup.mjs'],
         };
         f.writeLocal(f.workB, localB);
@@ -30,7 +33,14 @@ export const localConfigSuite = {
             rustEnabled: approved.config.toolchains.rust.enabled,
             pythonStillOn: Boolean(approved.config.toolchains.python.enabled),
             nodeSource: approved.versions.node.source,
-        }, { harness: 'codex', memoryMb: 4096, headless: true, rustEnabled: false, pythonStillOn: true, nodeSource: '.sandbox-config.json' }, 'approved local settings apply over the defaults (including toolchains and headless)');
+        }, {
+            harness: 'codex',
+            memoryMb: 4096,
+            headless: true,
+            rustEnabled: false,
+            pythonStillOn: true,
+            nodeSource: '.sandbox-config.json',
+        }, 'approved local settings apply over the defaults (including toolchains and headless)');
         t.check(approved.config.mappings.some((m) => m.host === path.join(f.workB, 'data') && !m.readOnly), 'relative mapping paths resolve against the folder of .sandbox-config.json', 'mappings: ' + JSON.stringify(approved.config.mappings));
         t.check(approved.scripts.includes(path.join(f.workB, 'setup.mjs')), 'relative script paths resolve against the folder of .sandbox-config.json', 'scripts: ' + JSON.stringify(approved.scripts));
         t.equal((await f.run({ cwd: f.workB })).harnessName, 'codex', 'an approval is remembered');
@@ -50,14 +60,53 @@ export const localConfigSuite = {
         await rejectedBecause({ claudeProfile: { hostDir: 'C:\\x' } }, 'claudeProfile.hostDir is not allowed', 'a project file cannot point at the Claude profile folder');
         await rejectedBecause({ toolchains: { node: { hostDir: 'x' } } }, 'toolchains.node.hostDir is not allowed', 'a project file cannot point at host tool folders');
         await rejectedBecause({ sandbox: { memoryMb: 12 } }, 'sandbox.memoryMb:', 'values are type-checked (memory too small)');
-        await rejectedBecause({ mappings: [{ host: 'x', guest: 'C:\\Windows\\x', readOnly: true }] }, 'reserved or invalid guest path', 'reserved guest paths are rejected');
-        await rejectedBecause({ mappings: [{ host: '../shared', guest: 'C:\\Shared', readOnly: true }] }, 'only map folders inside the project', 'a project file cannot map folders outside the project');
-        await rejectedBecause({ mappings: [{ host: '%APPDATA%', guest: 'C:\\Startup', readOnly: false }] }, 'only map folders inside the project', '... not even through environment variables');
         await rejectedBecause({ provisioning: { git: { access: 'admin' } } }, 'provisioning.git.access:', 'unknown git access modes are rejected');
         await rejectedBecause('{\n  // a comment\n  "readOnly": tru\n}', 'line 3', 'broken JSON is reported with its line');
         await rejectedBecause({ _comment: 'old style' }, '_comment is not allowed', 'unknown keys are rejected');
         f.writeLocal(dirC, '// comments and trailing commas are fine\n{\n  "readOnly": true, /* inline */\n}\n');
         t.equal((await f.run({ cwd: dirC, trustConfig: true })).config.readOnly, true, '.sandbox-config.json may contain comments and trailing commas');
+        t.section('folders outside the project (projects.allowOutsideMappings)');
+        const dirD = t.dir('work-d');
+        const withOutside = (setting) => ({
+            ...f.baseConfig,
+            projects: { ...f.baseConfig.projects, allowOutsideMappings: setting },
+        });
+        const outsideFile = { mappings: [{ host: '../shared', readOnly: true }] };
+        f.writeLocal(dirD, outsideFile);
+        const notAllowed = await t.thrownMessage(() => f.run({ cwd: dirD, trustConfig: true }, withOutside(false)));
+        t.check(notAllowed.includes('outside the project') &&
+            notAllowed.includes(f.shared) &&
+            notAllowed.includes('projects.allowOutsideMappings'), 'false: refused, naming the folder and the setting that allows it', notAllowed);
+        const allowedOutside = await f.run({ cwd: dirD, trustConfig: true }, withOutside(true));
+        t.check(allowedOutside.config.mappings.some((m) => m.host === f.shared) &&
+            (allowedOutside.outsideMappings ?? []).includes(f.shared), 'true: allowed, and marked as outside the project');
+        f.writeLocal(dirD, { ...outsideFile, readOnly: true });
+        t.includes(await t.thrownMessage(() => f.run({ cwd: dirD }, withOutside(true))), '(outside the project)', 'true: still listed, flagged, when you approve the file');
+        const asking = await t.thrownMessage(() => f.run({ cwd: dirD, trustConfig: true, ask: async () => true, interactive: false }));
+        t.check(asking.includes('projects.allowOutsideMappings') && asking.includes('interactive'), '"ask" without a terminal (even with --trust-config): refused, naming the setting and that an interactive launch asks', asking);
+        t.includes(await t.thrownMessage(() => f.run({ cwd: dirD, trustConfig: true, ask: async () => false, interactive: true })), 'You did not allow', '"ask": answering no stops the launch');
+        const questions = [];
+        f.writeLocal(dirD, { ...outsideFile, sandbox: { vGpu: true } });
+        const asked = await f.run({
+            cwd: dirD,
+            trustConfig: true,
+            interactive: true,
+            ask: async (q) => {
+                questions.push(q);
+                return true;
+            },
+        });
+        t.check(questions.length === 1 && asked.config.sandbox.vGpu && asked.config.mappings.some((m) => m.host === f.shared), '"ask": the folder and a looser setting (vGPU) are asked together, once', JSON.stringify(questions));
+        t.check((await f.run({ cwd: dirD, trustConfig: true, interactive: false })).config.mappings.some((m) => m.host === f.shared), '"ask": the answer is remembered for this project file');
+        // What counts as outside is where the folder really is: environment variables are expanded and links followed.
+        f.writeLocal(dirD, { mappings: [{ host: '%APPDATA%', readOnly: false }] });
+        t.includes(await t.thrownMessage(() => f.run({ cwd: dirD, trustConfig: true }, withOutside(false))), 'outside the project', '%VAR% is expanded before deciding inside or outside');
+        fs.symlinkSync(f.shared, path.join(dirD, 'link'), 'junction');
+        f.writeLocal(dirD, { mappings: [{ host: './link', readOnly: true }] });
+        t.includes(await t.thrownMessage(() => f.run({ cwd: dirD, trustConfig: true }, withOutside(false))), 'outside the project', 'a link inside the project to a folder outside counts as outside');
+        fs.rmSync(path.join(dirD, 'link'));
+        f.writeLocal(dirD, { mappings: [{ host: './assets', readOnly: true }] });
+        t.check((await f.run({ cwd: dirD, trustConfig: true }, withOutside(false))).config.mappings.some((m) => m.host === path.join(dirD, 'assets')), 'a folder inside the project needs no permission');
         t.section('a project can only tighten protections');
         // Settings that would loosen a protection are listed before approval, then ignored.
         f.writeLocal(dirC, {
@@ -87,18 +136,42 @@ export const localConfigSuite = {
             networking: kept.sandbox.networking,
             protectedClient: kept.sandbox.protectedClient,
             copyCredentials: kept.claudeProfile.copyCredentials,
-        }, { readOnly: true, blockPrivateRanges: true, gitAccess: 'readonly', vGpu: false, clipboard: false, networking: false, protectedClient: true, copyCredentials: false }, 'a project file can never loosen network, git, read-only, GPU, clipboard or login settings');
+        }, {
+            readOnly: true,
+            blockPrivateRanges: true,
+            gitAccess: 'readonly',
+            vGpu: false,
+            clipboard: false,
+            networking: false,
+            protectedClient: true,
+            copyCredentials: false,
+        }, 'a project file can never loosen network, git, read-only, GPU, clipboard or login settings');
         // You allowed one request for this project (asked once at an interactive launch): only that one is let through.
         const store = allowStorePath(strictUser.storage.root);
         saveAllowed(store, path.join(dirC, '.sandbox-config.json'), 'sandbox.vGpu', true, true);
         saveAllowed(store, path.join(dirC, '.sandbox-config.json'), 'sandbox.clipboard', true, false);
         const allowedRun = await f.run({ cwd: dirC, trustConfig: true }, strictUser);
-        t.equal({ vGpu: allowedRun.config.sandbox.vGpu, clipboard: allowedRun.config.sandbox.clipboard, networking: allowedRun.config.sandbox.networking }, { vGpu: true, clipboard: false, networking: false }, 'a request you allowed for this project is used; one you declined and the others are not');
-        t.check(allowedRun.notes.some((n) => n.includes('Allowed for this project: sandbox.vGpu')) && allowedRun.notes.some((n) => n.includes('sandbox.clipboard') && n.includes('You said no')), 'launch says what was allowed and what you declined', allowedRun.notes.join('\n'));
+        t.equal({
+            vGpu: allowedRun.config.sandbox.vGpu,
+            clipboard: allowedRun.config.sandbox.clipboard,
+            networking: allowedRun.config.sandbox.networking,
+        }, { vGpu: true, clipboard: false, networking: false }, 'a request you allowed for this project is used; one you declined and the others are not');
+        t.check(allowedRun.notes.some((n) => n.includes('Allowed for this project: sandbox.vGpu')) &&
+            allowedRun.notes.some((n) => n.includes('sandbox.clipboard') && n.includes('You said no')), 'launch says what was allowed and what you declined', allowedRun.notes.join('\n'));
         t.equal(allowedAnswer(store, path.join(f.workB, '.sandbox-config.json'), 'sandbox.vGpu', true), null, 'an answer is kept per project file');
-        f.writeLocal(dirC, { readOnly: true, network: { blockPrivateRanges: true }, provisioning: { git: { access: 'none' } }, sandbox: { networking: false, clipboard: false } });
+        f.writeLocal(dirC, {
+            readOnly: true,
+            network: { blockPrivateRanges: true },
+            provisioning: { git: { access: 'none' } },
+            sandbox: { networking: false, clipboard: false },
+        });
         const tightened = (await f.run({ cwd: dirC, trustConfig: true })).config;
-        t.equal({ readOnly: tightened.readOnly, gitAccess: tightened.provisioning.git.access, networking: tightened.sandbox.networking, clipboard: tightened.sandbox.clipboard }, { readOnly: true, gitAccess: 'none', networking: false, clipboard: false }, 'a project file can still make things stricter');
+        t.equal({
+            readOnly: tightened.readOnly,
+            gitAccess: tightened.provisioning.git.access,
+            networking: tightened.sandbox.networking,
+            clipboard: tightened.sandbox.clipboard,
+        }, { readOnly: true, gitAccess: 'none', networking: false, clipboard: false }, 'a project file can still make things stricter');
         t.section('downloads.requireChecksum');
         f.writeLocal(dirC, { downloads: { requireChecksum: false } });
         const keptOn = (await f.run({ cwd: dirC, trustConfig: true }, { ...f.baseConfig, downloads: { requireChecksum: true } })).config;
@@ -108,10 +181,10 @@ export const localConfigSuite = {
         t.equal(turnedOn.downloads.requireChecksum, true, 'a project file can switch the checksum requirement on');
         t.equal(f.baseConfig.downloads.requireChecksum, false, '(the requirement is off in the defaults)');
         // With the requirement on, a download without a hash is refused before anything is fetched.
-        setChecksumRequired(true);
+        const strict = new Downloader();
+        strict.requireChecksum = true;
         const target = path.join(os.tmpdir(), 'agent-sandbox-no-such-download.bin');
-        const refused = await download('http://127.0.0.1:9/tool.zip', target).then(() => '', (e) => e.message);
-        setChecksumRequired(false);
+        const refused = await strict.file('http://127.0.0.1:9/tool.zip', target).then(() => '', (e) => e.message);
         t.includes(refused, 'requireChecksum', 'a download with no hash is refused when checksums are required');
         t.includes(refused, 'tool.zip', 'the refusal names the download');
         t.check(!fs.existsSync(target) && !fs.existsSync(target + '.part'), 'a refused download leaves nothing behind');

package/dist/selftest/mirror.test.d.ts

@@ -1,2 +1,2 @@
-import type { Suite } from './suite.js';
+import type { Suite } from './support/suite.js';
 export declare const mirrorSuite: Suite;

package/dist/selftest/mirror.test.js

@@ -1,35 +1,70 @@
 // Guest paths on other drive letters (C:\Mirror\<letter> + subst) and guestWorkspace "mirror".
 import fs from 'node:fs';
 import path from 'node:path';
-import { Config, Mapping } from '../core/schema.js';
+import { ConfigSchema, MappingSchema } from '../core/schema/index.js';
 import { guestPathFor } from '../cli/commands/context.js';
-import { buildWsb } from '../host/launch/wsb.js';
-import { guestDrive, isValidGuestPath, planMirrorWorkspace, sandboxFolder, substDrives } from '../shared/guest-paths.js';
-import { guestWorkspaceAliases, projectFolderName } from '../shared/paths.js';
-import { syncHistoryIn, syncHistoryOut } from '../sync/history.js';
+import { buildWsb } from '../host/launch/index.js';
+import { deriveGuest, guestDrive, isValidGuestPath, planMirrorWorkspace, sandboxFolder, substDrives, } from '../shared/paths/index.js';
+import { guestWorkspaceAliases, projectFolderName } from '../shared/paths/index.js';
+import { syncHistoryIn, syncHistoryOut } from '../sync/index.js';
 export const mirrorSuite = {
     name: 'mirror',
     title: 'guest paths on other drive letters, guestWorkspace "mirror"',
     run: async (t, f) => {
         t.section('which guest paths are valid');
-        const valid = ['C:\\Assets', 'C:\\Workspace\\x', 'F:\\SteamLibrary\\steamapps\\common\\Game', 'f:\\x', 'Z:\\a b\\c (1)'];
+        const valid = [
+            'C:\\Assets',
+            'C:\\Workspace\\x',
+            'F:\\SteamLibrary\\steamapps\\common\\Game',
+            'f:\\x',
+            'Z:\\a b\\c (1)',
+        ];
         t.equal(valid.filter((p) => !isValidGuestPath(p)), [], 'guest paths under C:\\ or on D: to Z: are accepted');
-        const invalid = ['C:\\', 'F:\\', 'F:', 'C:\\Windows\\x', 'C:\\Users\\me', 'c:\\program files\\x', 'C:\\AgentData\\x', 'C:\\Mirror', 'C:\\Mirror\\F\\x', 'A:\\x', 'B:\\x', 'C:\\a\\..\\Windows', 'F:\\a\\..\\b', 'F:\\a:b', 'F:\\a/b', 'F:\\a\\\\b', 'F:\\a.\\b', 'F:\\a|b', 'F:\\a\nb', '\\\\server\\share\\x', 'relative\\x', 'F:x'];
+        const invalid = [
+            'C:\\',
+            'F:\\',
+            'F:',
+            'C:\\Windows\\x',
+            'C:\\Users\\me',
+            'c:\\program files\\x',
+            'C:\\AgentData\\x',
+            'C:\\Mirror',
+            'C:\\Mirror\\F\\x',
+            'A:\\x',
+            'B:\\x',
+            'C:\\a\\..\\Windows',
+            'F:\\a\\..\\b',
+            'F:\\a:b',
+            'F:\\a/b',
+            'F:\\a\\\\b',
+            'F:\\a.\\b',
+            'F:\\a|b',
+            'F:\\a\nb',
+            '\\\\server\\share\\x',
+            'relative\\x',
+            'F:x',
+        ];
         t.equal(invalid.filter(isValidGuestPath), [], 'drive roots, reserved folders, C:\\Mirror, A:/B:, .., streams, odd characters and UNC paths are refused');
-        const mappingAccepts = (guest) => Mapping.safeParse({ host: 'E:\\Games', guest, readOnly: true }).success;
-        t.check(mappingAccepts('F:\\SteamLibrary\\Game') && mappingAccepts('C:\\F'), 'schema: mappings[].guest may be on another drive letter');
-        t.check(!mappingAccepts('C:\\Mirror\\F\\x') && !mappingAccepts('F:\\'), 'schema: mappings[].guest may never be C:\\Mirror or a drive root');
-        const workspaceAccepts = (guestWorkspace) => Config.safeParse({ ...f.makeConfig(), guestWorkspace }).success;
+        const mappingAccepts = (guest) => MappingSchema.safeParse({ host: 'E:\\Games', guest, readOnly: true }).success;
+        t.check(mappingAccepts('F:\\SteamLibrary\\Game') && mappingAccepts('C:\\Windows\\x') && mappingAccepts(undefined), 'schema: any mappings[].guest is accepted, or none (the launch places it; it never fails the config)');
+        const workspaceAccepts = (guestWorkspace) => ConfigSchema.safeParse({ ...f.makeConfig(), guestWorkspace }).success;
         t.check(workspaceAccepts('mirror') && workspaceAccepts('F:\\AgentProjects\\x'), 'schema: guestWorkspace accepts "mirror" and D:-Z: paths');
         t.check(!workspaceAccepts('C:\\Users\\x'), 'schema: guestWorkspace refuses reserved paths');
         t.equal([guestDrive('f:\\x'), guestDrive('\\\\s\\x')], ['F', null], 'drive letter of a guest path');
         t.section('where a drive-letter path really lives');
         t.equal([sandboxFolder('F:\\SteamLibrary\\Game'), sandboxFolder('f:\\x'), sandboxFolder('C:\\Assets')], ['C:\\Mirror\\F\\SteamLibrary\\Game', 'C:\\Mirror\\F\\x', 'C:\\Assets'], 'F:\\x really lives at C:\\Mirror\\F\\x; C: paths stay as they are');
-        t.equal(substDrives(['C:\\a', 'G:\\z', 'F:\\x', 'f:\\y']), [{ letter: 'F', target: 'C:\\Mirror\\F' }, { letter: 'G', target: 'C:\\Mirror\\G' }], 'one subst drive per used letter (never C:), sorted');
+        t.equal(substDrives(['C:\\a', 'G:\\z', 'F:\\x', 'f:\\y']), [
+            { letter: 'F', target: 'C:\\Mirror\\F' },
+            { letter: 'G', target: 'C:\\Mirror\\G' },
+        ], 'one subst drive per used letter (never C:), sorted');
         t.equal(guestWorkspaceAliases('F:\\AgentProjects\\mw2'), ['C:\\Mirror\\F\\AgentProjects\\mw2', 'F:\\AgentProjects\\mw2'], 'a mirrored workspace is also known by its real C:\\Mirror path');
         t.equal(guestWorkspaceAliases('C:\\Workspace\\x').length, 1, 'a C: workspace has no alias');
         const wsb = buildWsb(f.baseConfig, 4096, [
-            { host: 'E:\\SteamLibrary\\steamapps\\common\\Game', guest: 'F:\\SteamLibrary\\steamapps\\common\\Game', readOnly: true },
+            {
+                host: 'E:\\SteamLibrary\\steamapps\\common\\Game',
+                guest: 'F:\\SteamLibrary\\steamapps\\common\\Game',
+                readOnly: true,
+            },
             { host: 'D:\\Assets', guest: 'C:\\Assets', readOnly: false },
         ]);
         t.includes(wsb, '<SandboxFolder>C:\\Mirror\\F\\SteamLibrary\\steamapps\\common\\Game</SandboxFolder>', 'the .wsb maps F:\\ guests under C:\\Mirror\\F');
@@ -55,19 +90,83 @@ export const mirrorSuite = {
         t.section('generating a sandbox with drive-letter folders');
         const game = t.dir('steam', 'Game');
         const base = await f.run();
-        const run = { ...base, config: { ...base.config, guestWorkspace: 'G:\\Projects\\work-a', mappings: [{ host: game, guest: 'F:\\SteamLibrary\\steamapps\\common\\Game', readOnly: true }] } };
+        const run = {
+            ...base,
+            config: {
+                ...base.config,
+                guestWorkspace: 'G:\\Projects\\work-a',
+                mappings: [{ host: game, guest: 'F:\\SteamLibrary\\steamapps\\common\\Game', readOnly: true }],
+            },
+        };
         const generated = f.generate(run);
         const session = f.readJson(generated.sessionPath);
         const text = fs.readFileSync(generated.wsbPath, 'utf8');
         t.equal(session.workspace, 'G:\\Projects\\work-a', 'session.json: the workspace is at its drive-letter path');
-        t.equal(session.substDrives, [{ letter: 'F', target: 'C:\\Mirror\\F' }, { letter: 'G', target: 'C:\\Mirror\\G' }], 'session.json: subst drives are listed for bootstrap.ps1');
+        t.equal(session.substDrives, [
+            { letter: 'F', target: 'C:\\Mirror\\F' },
+            { letter: 'G', target: 'C:\\Mirror\\G' },
+        ], 'session.json: subst drives are listed for bootstrap.ps1');
         t.includes(text, '<SandboxFolder>C:\\Mirror\\G\\Projects\\work-a</SandboxFolder>', '.wsb: the workspace is under C:\\Mirror');
         t.includes(text, '<SandboxFolder>C:\\Mirror\\F\\SteamLibrary\\steamapps\\common\\Game</SandboxFolder>', '.wsb: the mapping is under C:\\Mirror');
         t.equal(f.readJson(f.generate(base).sessionPath).substDrives, [], 'no other drive letters: no subst drives');
-        const withMapping = (guest) => ({ ...run, config: { ...run.config, mappings: [{ host: game, guest, readOnly: true }] } });
-        await t.throws(() => f.generate(withMapping('C:\\Mirror\\F\\x')), 'not a usable sandbox folder', 'a mapping straight into C:\\Mirror is refused');
-        await t.throws(() => f.generate(withMapping('C:\\Windows\\x')), 'not a usable sandbox folder', 'a reserved guest folder is refused by the host too (not only the schema)');
-        await t.throws(() => f.generate(withMapping('g:\\projects\\work-a\\game')), 'overlapping', 'mappings overlapping on the same mirrored drive are refused');
+        t.section('where an extra folder goes: guest left out, or one the sandbox cannot use');
+        t.equal([
+            deriveGuest('F:\\P\\mw2\\data\\maps', 'F:\\P\\mw2', 'C:\\Workspace\\mw2'),
+            deriveGuest('C:\\Steam\\MOHAA', 'F:\\P\\mw2', 'C:\\Workspace\\mw2'),
+            deriveGuest('f:\\SteamLibrary\\steamapps\\common\\MW2\\', 'F:\\P\\mw2', 'C:\\Workspace\\mw2'),
+        ], ['C:\\Workspace\\mw2\\data\\maps', 'C:\\Steam\\MOHAA', 'F:\\SteamLibrary\\steamapps\\common\\MW2'], 'no guest: inside the project = the same place in it; outside = the same path as on the PC (C: as is, F: through C:\\Mirror\\F + subst)');
+        const other = t.dir('steam', 'Other');
+        const placed = (mappings) => {
+            const g = f.generate({ ...run, config: { ...run.config, mappings } });
+            return {
+                guests: g.mappings.filter((m) => m.host === game || m.host === other).map((m) => m.guest),
+                notes: g.mappingNotes,
+                wsb: fs.readFileSync(g.wsbPath, 'utf8'),
+            };
+        };
+        const usable = placed([
+            { host: game, guest: 'D:\\Games', readOnly: true },
+            { host: game, guest: 'c:/assets/', readOnly: true },
+            { host: game, guest: 'C:\\assets', readOnly: true },
+        ]);
+        t.equal(usable.guests, ['D:\\Games', 'C:\\assets'], 'a usable guest path is used exactly as asked (c:/assets/ tidied); the same folder at the same place is mapped once');
+        const refused = await t.thrownMessage(() => placed([
+            { host: game, guest: 'C:\\Windows\\foo', readOnly: true },
+            { host: game, guest: 'steamapps\\Game', readOnly: true },
+            { host: game, guest: 'G:\\Projects\\work-a', readOnly: true },
+            { host: game, guest: 'C:\\Assets', readOnly: true },
+            { host: other, guest: 'C:\\Assets', readOnly: true },
+        ]));
+        t.check(refused.includes('4 mapped folders cannot be used'), 'unusable guest paths stop the launch, all named in one message (never moved elsewhere)', refused);
+        t.check(refused.includes('C:\\Windows\\foo is a folder the sandbox keeps for itself') &&
+            refused.includes('steamapps\\Game is not a full path') &&
+            refused.includes('already used by'), '... each with why: reserved, relative, overlapping', refused);
+        t.check(refused.includes('Fix: set "guest" to a full path'), '... and the fix', refused);
+        t.excludes(refused, 'C:\\Mapped', 'no folder is ever placed under C:\\Mapped');
+        const derived = await t.thrownMessage(() => placed([{ host: game, readOnly: true }]));
+        t.check(derived === '' || derived.includes('give it a "guest" path'), 'no guest, outside the project: the PC path, or (under C:\\Users, like the temp folder) a message asking for a guest path', derived);
+        const inside = t.dir('work-a', 'data');
+        const insideRun = await f.run();
+        const insideGen = f.generate({
+            ...insideRun,
+            config: { ...insideRun.config, mappings: [{ host: inside, readOnly: true }] },
+        });
+        t.check(!insideGen.mappings.some((m) => m.host === inside) &&
+            insideGen.mappingNotes.some((n) => n.includes('already in the sandbox at C:\\Workspace\\work-a\\data')), 'no guest, inside the project: already there, no second mapping', insideGen.mappingNotes.join('\n'));
+        const missingRequired = await t.thrownMessage(() => f.generate({
+            ...run,
+            config: {
+                ...run.config,
+                mappings: [
+                    { host: t.at('nope-1'), readOnly: true },
+                    { host: t.at('nope-2'), guest: 'C:\\Windows', readOnly: true },
+                ],
+            },
+        }));
+        t.check(missingRequired.includes('2 mapped folders cannot be used') &&
+            missingRequired.includes('nope-1') &&
+            missingRequired.includes('nope-2') &&
+            missingRequired.includes('"optional": true'), 'folders that are not there: one message listing each, with the fix', missingRequired);
         t.section('exec, attach and history for a mirrored workspace');
         const workspace = 'F:\\AgentProjects\\mw2-agent';
         t.equal(guestPathFor(workspace + '\\crates\\engine', workspace, workspace), workspace + '\\crates\\engine', 'a host folder maps to the same guest folder');

package/dist/selftest/network.test.d.ts

@@ -1,2 +1,2 @@
-import type { Suite } from './suite.js';
+import type { Suite } from './support/suite.js';
 export declare const networkSuite: Suite;

package/dist/selftest/network.test.js

@@ -1,6 +1,6 @@
-import { isSandboxAddress } from '../host/attach.js';
-import { buildFirewallCommands, cidrToRange, ipv4DnsServers, parseDefaultGateways, parseDnsServers, subtractIps } from '../shared/netrules.js';
-import { expandAllowList, hostAllowed, withBlockedHosts } from '../shared/netpolicy.js';
+import { isSandboxAddress } from '../host/channel/index.js';
+import { buildFirewallCommands, cidrToRange, ipv4DnsServers, parseDefaultGateways, parseDnsServers, subtractIps, } from '../shared/network/index.js';
+import { expandAllowList, hostAllowed, withBlockedHosts } from '../shared/network/index.js';
 export const networkSuite = {
     name: 'network',
     title: 'firewall maths, gateway/DNS parsing, attach address checks',
@@ -17,19 +17,28 @@ export const networkSuite = {
         t.equal(ipv4DnsServers(['172.28.80.1', '8.8.8.8:1053', '[::1]:53', 'fe80::1']), ['172.28.80.1', '8.8.8.8'], 'DNS servers from the resolver (any Windows language): IPv4 only, ports dropped');
         t.section('attach only reaches into the sandbox');
         const interfaces = {
-            'vEthernet (Default Switch)': [{ address: '172.20.0.1', netmask: '255.255.240.0', family: 'IPv4', internal: false, mac: '', cidr: null }],
-            'vEthernet (WSL (Hyper-V firewall))': [{ address: '172.30.0.1', netmask: '255.255.240.0', family: 'IPv4', internal: false, mac: '', cidr: null }],
-            Ethernet: [{ address: '192.168.1.10', netmask: '255.255.255.0', family: 'IPv4', internal: false, mac: '', cidr: null }],
+            'vEthernet (Default Switch)': [
+                { address: '172.20.0.1', netmask: '255.255.240.0', family: 'IPv4', internal: false, mac: '', cidr: null },
+            ],
+            'vEthernet (WSL (Hyper-V firewall))': [
+                { address: '172.30.0.1', netmask: '255.255.240.0', family: 'IPv4', internal: false, mac: '', cidr: null },
+            ],
+            Ethernet: [
+                { address: '192.168.1.10', netmask: '255.255.255.0', family: 'IPv4', internal: false, mac: '', cidr: null },
+            ],
         };
         t.check(isSandboxAddress('172.20.5.9', interfaces), 'an address in the Hyper-V subnet is the sandbox');
         t.check(!isSandboxAddress('192.168.1.20', interfaces), 'a LAN address is not');
         t.check(!isSandboxAddress('172.30.4.4', interfaces), 'an address on the WSL Hyper-V network is not (keystrokes never go to a WSL VM)');
         t.check(!isSandboxAddress('127.0.0.1', interfaces), 'loopback is not');
         t.check(!isSandboxAddress('8.8.8.8', interfaces), 'an internet address is not');
-        t.check(!isSandboxAddress('172.20.0.1', interfaces), 'this PC\'s own address on that subnet is not');
+        t.check(!isSandboxAddress('172.20.0.1', interfaces), "this PC's own address on that subnet is not");
         t.section('network settings');
         const allow = expandAllowList(['@developer', 'Example.COM', '*.corp.example', 'not a host!']);
-        t.check(allow.includes('registry.npmjs.org') && allow.includes('api.anthropic.com') && allow.includes('example.com') && !allow.includes('not a host!'), 'allowOnly: @developer expands to registries, GitHub and AI providers; bad entries are dropped');
+        t.check(allow.includes('registry.npmjs.org') &&
+            allow.includes('api.anthropic.com') &&
+            allow.includes('example.com') &&
+            !allow.includes('not a host!'), 'allowOnly: @developer expands to registries, GitHub and AI providers; bad entries are dropped');
         t.equal(['a.corp.example', 'corp.example', 'example.com', 'www.example.com', 'evil-example.com'].map((h) => hostAllowed(h, allow)), [true, false, true, false, false], 'allowOnly: *.x covers subdomains only, a name covers only itself');
         const hosts = '127.0.0.1 localhost\r\n# mine\r\n';
         const once = withBlockedHosts(hosts, ['Telemetry.Example.com', '*.bad']);

package/dist/selftest/personalization.test.d.ts

@@ -1,2 +1,2 @@
-import type { Suite } from './suite.js';
+import type { Suite } from './support/suite.js';
 export declare const personalizationSuite: Suite;