windows-development-sandbox 1.4.0 → 1.4.3

package/dist/selftest/repair.test.d.ts

@@ -1,2 +1,2 @@
-import type { Suite } from './suite.js';
+import type { Suite } from './support/suite.js';
 export declare const repairSuite: Suite;

package/dist/selftest/repair.test.js

@@ -1,6 +1,6 @@
 // `sandbox repair`: finding half-installed toolchains, interrupted downloads, stale pid files and broken state.
 import path from 'node:path';
-import { deadPidFiles, findHalfInstalled, findStagingLeftovers, globalPackages, resolvedVersionsValid } from '../cli/commands/repair/finders.js';
+import { deadPidFiles, findHalfInstalled, findStagingLeftovers, globalPackages, resolvedVersionsValid, } from '../cli/commands/repair/finders.js';
 export const repairSuite = {
     name: 'repair',
     title: 'repair detection (half-installed tools, leftovers, stale pids)',
@@ -20,10 +20,20 @@ export const repairSuite = {
         t.dir('repair', 'tools', 'go', '1.24.0.staging-ab12cd');
         t.dir('repair', 'tools', 'node-staging');
         t.dir('repair', 'tools', 'rust.staging-0f');
-        const half = findHalfInstalled(tools).map((h) => path.relative(tools, h.path)).sort();
-        const expectedHalf = [path.join('go', '1.22.8'), path.join('java', 'jdk-17'), 'dotnet', 'nvm', path.join('nvm', 'v20.18.0')].sort();
+        const half = findHalfInstalled(tools)
+            .map((h) => path.relative(tools, h.path))
+            .sort();
+        const expectedHalf = [
+            path.join('go', '1.22.8'),
+            path.join('java', 'jdk-17'),
+            'dotnet',
+            'nvm',
+            path.join('nvm', 'v20.18.0'),
+        ].sort();
         t.equal(half, expectedHalf, 'half-installed toolchains are folders without their program');
-        const leftovers = findStagingLeftovers(tools).map((p) => path.relative(tools, p)).sort();
+        const leftovers = findStagingLeftovers(tools)
+            .map((p) => path.relative(tools, p))
+            .sort();
         t.equal(leftovers, [path.join('go', '1.24.0.staging-ab12cd'), 'node-staging', 'rust.staging-0f'].sort(), 'interrupted downloads are found in tools and one level down');
         t.section('state files');
         t.check(resolvedVersionsValid('{"go":"1.23.2"}') && resolvedVersionsValid('{}'), 'resolved-versions.json: a JSON object is valid (a byte-order mark is fine)');
@@ -36,7 +46,9 @@ export const repairSuite = {
         t.write(path.join(run, 'watcher-other.pid'), String(process.pid));
         t.write(path.join(run, 'watcher-junk.pid'), 'not a pid');
         t.write(path.join(run, 'hidden-windows.json'), '[]');
-        const dead = deadPidFiles(run, (pid) => pid === process.pid).map((file) => path.basename(file)).sort();
+        const dead = deadPidFiles(run, (pid) => pid === process.pid)
+            .map((file) => path.basename(file))
+            .sort();
         t.equal(dead, ['watcher-default.pid', 'watcher-junk.pid'], 'stale watcher pid files (dead process or junk) are found; a live one is kept');
     },
 };

package/dist/selftest/repo-guard.test.d.ts

@@ -1,2 +1,2 @@
-import type { Suite } from './suite.js';
+import type { Suite } from './support/suite.js';
 export declare const repoGuardSuite: Suite;

package/dist/selftest/repo-guard.test.js

@@ -2,8 +2,8 @@
 // and commands planted in the repository are quarantined before anything on this PC can run them.
 import fs from 'node:fs';
 import path from 'node:path';
-import { guardRepo, snapshotRepo } from '../host/repo-guard.js';
-import { isMarked, markFromSandbox, watchAndMark } from '../host/motw.js';
+import { isMarked, markFromSandbox, RepoGuard, watchAndMark } from '../host/guard/index.js';
+const repoGuard = new RepoGuard();
 export const repoGuardSuite = {
     name: 'repo-guard',
     title: 'repository guard (hooks, git config, planted commands, replaced .git)',
@@ -15,11 +15,11 @@ export const repoGuardSuite = {
         t.write(path.join(repo, '.git', 'config'), '[core]\n\trepositoryformatversion = 0\n[remote "origin"]\n\turl = https://example.com/x.git\n');
         t.write(path.join(repo, '.git', 'hooks', 'pre-commit.sample'), 'sample');
         t.write(path.join(repo, '.git', 'hooks', 'pre-push'), 'existing hook');
-        const before = snapshotRepo(repo);
+        const before = repoGuard.snapshot(repo);
         t.write(path.join(repo, '.git', 'hooks', 'post-checkout'), 'calc.exe');
         t.write(path.join(repo, '.git', 'hooks', 'pre-push'), 'changed hook');
         fs.appendFileSync(path.join(repo, '.git', 'config'), '[core]\n\tfsmonitor = calc.exe\n\tsshCommand = evil\n[include]\n\tpath = C:/evil.cfg\n[branch "feature"]\n\tremote = origin\n');
-        const findings = guardRepo(repo, before);
+        const findings = repoGuard.guard(repo, before);
         t.check(!fs.existsSync(path.join(repo, '.git', 'hooks', 'post-checkout')), 'a new git hook is quarantined');
         t.check(!fs.existsSync(path.join(repo, '.git', 'hooks', 'pre-push')), 'a changed git hook is quarantined');
         t.check(fs.existsSync(path.join(repo, '.git', 'hooks', 'pre-commit.sample')), 'hook samples are left alone');
@@ -30,17 +30,17 @@ export const repoGuardSuite = {
         t.matches(config, disabled('path = C:/evil'), 'git config: [include] of an outside file is disabled');
         t.matches(config, /^\tremote = origin$/m, 'git config: a harmless change stays');
         t.matches(config, /^\turl = https/m, 'git config: existing lines stay');
-        t.equal(guardRepo(repo, before).length, 0, 'the guard is idempotent');
+        t.equal(repoGuard.guard(repo, before).length, 0, 'the guard is idempotent');
         t.section('planted commands and tricks');
         const repo2 = t.at('repo2');
         t.write(path.join(repo2, '.git', 'config'), '[core]\n\tbare = false\n');
         t.write(path.join(repo2, 'build.cmd'), 'echo legit');
-        const before2 = snapshotRepo(repo2);
+        const before2 = repoGuard.snapshot(repo2);
         for (const name of ['node.exe', 'git.cmd', 'sandbox.cmd', 'opencode.ps1'])
             t.write(path.join(repo2, name), name === 'node.exe' ? 'MZ' : 'calc');
         t.write(path.join(repo2, '.git', 'commondir'), 'C:/evil');
         fs.appendFileSync(path.join(repo2, '.git', 'config'), '[core] fsmonitor = calc.exe\n');
-        const found2 = guardRepo(repo2, before2);
+        const found2 = repoGuard.guard(repo2, before2);
         const gone = ['node.exe', 'git.cmd', 'sandbox.cmd', 'opencode.ps1'].filter((name) => !fs.existsSync(path.join(repo2, name)));
         t.equal(gone, ['node.exe', 'git.cmd', 'sandbox.cmd', 'opencode.ps1'], 'executables planted under command names are quarantined');
         t.check(fs.existsSync(path.join(repo2, 'build.cmd')), 'other scripts stay');
@@ -51,21 +51,21 @@ export const repoGuardSuite = {
         const victim = t.dir('repo-victim');
         const repo3 = t.at('repo3');
         t.write(path.join(repo3, '.git', 'config'), '[core]\n');
-        const before3 = snapshotRepo(repo3);
+        const before3 = repoGuard.snapshot(repo3);
         fs.rmSync(path.join(repo3, '.git'), { recursive: true });
         fs.symlinkSync(victim, path.join(repo3, '.git'), 'junction');
-        t.check(guardRepo(repo3, before3).some((x) => x.kind === 'git' && x.detail.includes('replaced')), '.git replaced by a link is reported loudly');
+        t.check(repoGuard.guard(repo3, before3).some((x) => x.kind === 'git' && x.detail.includes('replaced')), '.git replaced by a link is reported loudly');
         const repo4 = t.at('repo4');
         t.write(path.join(repo4, '.git', 'config'), '[core]\n');
-        const before4 = snapshotRepo(repo4);
+        const before4 = repoGuard.snapshot(repo4);
         fs.appendFileSync(path.join(repo4, '.git', 'config'), '#'.repeat(5 * 1024 * 1024));
-        t.check(guardRepo(repo4, before4).some((x) => x.kind === 'git' && x.detail.includes('over 4 MB')), 'a git config too big to check is reported instead of passing');
+        t.check(repoGuard.guard(repo4, before4).some((x) => x.kind === 'git' && x.detail.includes('over 4 MB')), 'a git config too big to check is reported instead of passing');
         t.section('more git config that runs programs');
         const repo5 = t.at('repo5');
         t.write(path.join(repo5, '.git', 'config'), '[alias]\n\tst = status\n');
-        const before5 = snapshotRepo(repo5);
+        const before5 = repoGuard.snapshot(repo5);
         fs.appendFileSync(path.join(repo5, '.git', 'config'), '[alias]\n\tlg = !calc.exe\n\tco = checkout\n[pager]\n\tlog = calc.exe\n[diff]\n\texternal = calc.exe\n');
-        guardRepo(repo5, before5);
+        repoGuard.guard(repo5, before5);
         const config5 = readConfig(repo5);
         t.matches(config5, disabled('lg = !calc'), 'git config: an alias that runs a program (!) is disabled');
         t.matches(config5, /^\tco = checkout$/m, 'git config: a plain alias stays');
@@ -77,34 +77,35 @@ export const repoGuardSuite = {
         t.write(path.join(repo6, '.git', 'modules', 'lib', 'config'), '[core]\n');
         t.write(path.join(repo6, '.git', 'modules', 'lib', 'HEAD'), 'ref: refs/heads/main\n');
         t.write(path.join(repo6, 'tools', 'inner', '.git', 'config'), '[core]\n');
-        const before6 = snapshotRepo(repo6);
+        const before6 = repoGuard.snapshot(repo6);
         t.write(path.join(repo6, '.git', 'modules', 'lib', 'hooks', 'post-checkout'), 'calc.exe');
         fs.appendFileSync(path.join(repo6, 'tools', 'inner', '.git', 'config'), '\tfsmonitor = calc.exe\n');
         t.write(path.join(repo6, 'other', '.git', 'hooks', 'pre-commit'), 'calc.exe');
-        const findings6 = guardRepo(repo6, before6);
+        const findings6 = repoGuard.guard(repo6, before6);
         t.check(!fs.existsSync(path.join(repo6, '.git', 'modules', 'lib', 'hooks', 'post-checkout')), 'a hook planted in a submodule is quarantined');
         t.matches(fs.readFileSync(path.join(repo6, 'tools', 'inner', '.git', 'config'), 'utf8'), disabled('fsmonitor'), 'git config of a nested repository is checked too');
         t.check(!fs.existsSync(path.join(repo6, 'other', '.git', 'hooks', 'pre-commit')), 'a repository created inside the sandbox has no trusted hooks');
         t.check(findings6.some((f) => f.detail.startsWith('tools/inner/.git: ')), 'findings say which repository they are in');
         const legacy = { ...before6, repos: undefined, agent: undefined };
         t.write(path.join(repo6, 'third', '.git', 'hooks', 'pre-commit'), 'yours');
-        guardRepo(repo6, legacy);
+        repoGuard.guard(repo6, legacy);
         t.check(fs.existsSync(path.join(repo6, 'third', '.git', 'hooks', 'pre-commit')), 'a snapshot from an older version (no baseline) never moves your files');
         t.section('agent and editor files');
         const repo7 = t.at('repo7');
         t.write(path.join(repo7, '.claude', 'settings.local.json'), '{ "permissions": { "allow": ["Bash(npm test)"] } }');
         t.write(path.join(repo7, '.vscode', 'settings.json'), '{\n  // comment\n  "editor.tabSize": 2\n}');
-        const before7 = snapshotRepo(repo7);
+        const before7 = repoGuard.snapshot(repo7);
         t.write(path.join(repo7, '.claude', 'settings.local.json'), '{ "permissions": { "allow": ["Bash(npm test)", "Bash(npm run lint)"] } }');
         t.write(path.join(repo7, '.vscode', 'settings.json'), '{\n  "editor.tabSize": 4,\n}');
-        t.equal(guardRepo(repo7, before7), [], 'ordinary edits (permissions, editor settings) are left alone');
+        t.equal(repoGuard.guard(repo7, before7), [], 'ordinary edits (permissions, editor settings) are left alone');
         t.write(path.join(repo7, '.claude', 'settings.json'), '{ "hooks": { "SessionStart": [{ "hooks": [{ "type": "command", "command": "calc.exe" }] }] } }');
         t.write(path.join(repo7, '.mcp.json'), '{ "mcpServers": { "x": { "command": "calc.exe" } } }');
         t.write(path.join(repo7, '.vscode', 'tasks.json'), '{ "tasks": [{ "label": "x", "command": "calc.exe", "runOptions": { "runOn": "folderOpen" } }] }');
         t.write(path.join(repo7, '.vscode', 'settings.json'), '{ "python.defaultInterpreterPath": "C:\\\\evil.exe" }');
-        const findings7 = guardRepo(repo7, before7);
+        const findings7 = repoGuard.guard(repo7, before7);
         t.equal(findings7.filter((f) => f.kind === 'agent').length, 4, 'Claude hooks, MCP servers, folder-open tasks and program paths in VS Code settings are quarantined');
-        t.check(!fs.existsSync(path.join(repo7, '.mcp.json')) && fs.existsSync(path.join(repo7, '.claude', 'settings.local.json')), '... and nothing else is moved');
+        t.check(!fs.existsSync(path.join(repo7, '.mcp.json')) &&
+            fs.existsSync(path.join(repo7, '.claude', 'settings.local.json')), '... and nothing else is moved');
         t.section('programs from the sandbox are marked');
         const marked = t.at('marked');
         t.write(path.join(marked, 'setup.ps1'), 'calc');

package/dist/selftest/secrets.test.d.ts

@@ -1,2 +1,2 @@
-import type { Suite } from './suite.js';
+import type { Suite } from './support/suite.js';
 export declare const secretsSuite: Suite;

package/dist/selftest/secrets.test.js

@@ -1,8 +1,7 @@
 // What reaches the sandbox from this PC's Claude files, and what is stripped first: API keys, cloud credentials, tokens in
 // MCP server definitions. Also the secret-looking files in a workspace that the launch warns about.
 import path from 'node:path';
-import { sandboxGlobalState } from '../host/claude-profile.js';
-import { findSecretFiles, stripMcpServers, stripSettings } from '../host/secrets.js';
+import { findSecretFiles, sandboxGlobalState, stripMcpServers, stripSettings } from '../host/profile/index.js';
 const REMOVED = '[removed by agent-sandbox]';
 export const secretsSuite = {
     name: 'secrets',
@@ -14,12 +13,15 @@ export const secretsSuite = {
             oauthAccount: { emailAddress: 'me' },
             mcpServers: { a: {} },
             theme: 'dark',
-            projects: { 'D:/Code/app': { mcpServers: { db: { env: { TOKEN: 'mine' } } } }, 'D:/Other': { mcpServers: { x: { env: { TOKEN: 'other' } } } } },
+            projects: {
+                'D:/Code/app': { mcpServers: { db: { env: { TOKEN: 'mine' } } } },
+                'D:/Other': { mcpServers: { x: { env: { TOKEN: 'other' } } } },
+            },
         }, 'D:\\Code\\app');
         const stateText = JSON.stringify(state);
         t.check(!('primaryApiKey' in state), 'the sandbox never gets your API key');
         t.check(!('oauthAccount' in state), 'the sandbox never gets your signed-in account');
-        t.includes(stateText, 'mine', 'the sandbox gets this project\'s MCP servers');
+        t.includes(stateText, 'mine', "the sandbox gets this project's MCP servers");
         t.excludes(stateText, 'other', 'the sandbox never gets other projects');
         t.equal(state.theme, 'dark', 'ordinary settings are kept');
         t.section('settings.json');
@@ -29,9 +31,21 @@ export const secretsSuite = {
             apiKeyHelper: 'aws-vault exec prod -- get-key',
             model: 'opus',
             env: {
-                AWS_ACCESS_KEY_ID: 'x', AWS_SECRET_ACCESS_KEY: 'y', AWS_REGION: 'eu-west-2', AZURE_CLIENT_SECRET: 'z', ARM_CLIENT_ID: 'id', CLOUDFLARE_API_TOKEN: 't',
-                GOOGLE_APPLICATION_CREDENTIALS: 'C:\\key.json', PROD_DB_HOST: 'db.internal', STRIPE_KEY: 'k', ACME_THING: 'a', DATABASE_URL: 'postgres://u:p@h/db',
-                INNOCENT: 'AKIAABCDEFGHIJKLMNOP', SAFE_URL: 'https://example.com', DISABLE_TELEMETRY: '1', CLAUDE_CODE_USE_BEDROCK: '1',
+                AWS_ACCESS_KEY_ID: 'x',
+                AWS_SECRET_ACCESS_KEY: 'y',
+                AWS_REGION: 'eu-west-2',
+                AZURE_CLIENT_SECRET: 'z',
+                ARM_CLIENT_ID: 'id',
+                CLOUDFLARE_API_TOKEN: 't',
+                GOOGLE_APPLICATION_CREDENTIALS: 'C:\\key.json',
+                PROD_DB_HOST: 'db.internal',
+                STRIPE_KEY: 'k',
+                ACME_THING: 'a',
+                DATABASE_URL: 'postgres://u:p@h/db',
+                INNOCENT: 'AKIAABCDEFGHIJKLMNOP',
+                SAFE_URL: 'https://example.com',
+                DISABLE_TELEMETRY: '1',
+                CLAUDE_CODE_USE_BEDROCK: '1',
             },
         }, secrets, removed);
         const env = settings.env;
@@ -41,20 +55,43 @@ export const secretsSuite = {
         t.equal(JSON.stringify(stripSettings({ env: { AWS_SECRET_ACCESS_KEY: 'y' } }, { ...secrets, strip: false }, [])), '{"env":{"AWS_SECRET_ACCESS_KEY":"y"}}', 'secrets.strip = false copies settings unchanged');
         t.section('MCP servers');
         const mcp = stripMcpServers({
-            mcpServers: { gh: { command: 'npx', args: ['server', '--api-key', 'plain', '--verbose', 'ghp_abcdefghijklmnopqrstuvwxyz0123456789'], env: { GITHUB_TOKEN: 'g', LOG_LEVEL: 'debug' } } },
-            projects: { 'D:/app': { mcpServers: { api: { type: 'http', url: 'https://x', headers: { Authorization: 'Bearer abcdefghijklmnopqrstuvwxyz', Accept: 'json' } } } } },
+            mcpServers: {
+                gh: {
+                    command: 'npx',
+                    args: ['server', '--api-key', 'plain', '--verbose', 'ghp_abcdefghijklmnopqrstuvwxyz0123456789'],
+                    env: { GITHUB_TOKEN: 'g', LOG_LEVEL: 'debug' },
+                },
+            },
+            projects: {
+                'D:/app': {
+                    mcpServers: {
+                        api: {
+                            type: 'http',
+                            url: 'https://x',
+                            headers: { Authorization: 'Bearer abcdefghijklmnopqrstuvwxyz', Accept: 'json' },
+                        },
+                    },
+                },
+            },
         }, secrets, []);
         const gh = mcp.mcpServers.gh;
-        const api = mcp.projects['D:/app'].mcpServers.api;
+        const api = mcp.projects['D:/app']
+            .mcpServers.api;
         t.equal(gh.args, ['server', '--api-key', REMOVED, '--verbose', REMOVED], 'MCP servers: key arguments and token-looking arguments are removed');
         t.equal(gh.env, { LOG_LEVEL: 'debug' }, 'MCP servers: token env vars are removed, the rest stays');
         t.equal(api.headers, { Accept: 'json' }, 'MCP servers: Authorization headers are removed');
         const sneaky = stripMcpServers({
             mcpServers: {
                 r: {
-                    type: 'http', url: 'https://mcp.example.com/mcp?api_key=0123456789abcdef&region=eu',
+                    type: 'http',
+                    url: 'https://mcp.example.com/mcp?api_key=0123456789abcdef&region=eu',
                     headers: { 'X-API-Key': 'k', 'x-auth-token': 't', Accept: 'json' },
-                    args: ['--api-key=deadbeefdeadbeef', '--header', 'Authorization: Bearer abcdefghijklmnopqrstuvwxyz', '--port=8080'],
+                    args: [
+                        '--api-key=deadbeefdeadbeef',
+                        '--header',
+                        'Authorization: Bearer abcdefghijklmnopqrstuvwxyz',
+                        '--port=8080',
+                    ],
                 },
             },
         }, secrets, []);
@@ -64,7 +101,14 @@ export const secretsSuite = {
         t.equal([r.args[0], r.args[2], r.args[3]], [REMOVED, REMOVED, '--port=8080'], 'MCP servers: --flag=value keys and "Authorization: Bearer" arguments are removed, ordinary flags stay');
         t.section('secret-looking files in the workspace');
         const workspace = t.at('secret-ws');
-        for (const file of ['.env', '.env.example', 'server.pem', 'README.md', 'api/credentials.json', 'node_modules/x/.env'])
+        for (const file of [
+            '.env',
+            '.env.example',
+            'server.pem',
+            'README.md',
+            'api/credentials.json',
+            'node_modules/x/.env',
+        ])
             t.write(path.join(workspace, file), 'x');
         t.equal(findSecretFiles(workspace).sort(), ['.env', 'api\\credentials.json', 'server.pem'], 'secret-looking workspace files are found for the launch warning (templates and dependencies ignored)');
     },

package/dist/selftest/setup.test.d.ts

@@ -1,2 +1,2 @@
-import type { Suite } from './suite.js';
+import type { Suite } from './support/suite.js';
 export declare const setupSuite: Suite;

package/dist/selftest/setup.test.js

@@ -1,6 +1,6 @@
 // `agent-sandbox setup`: the pure pieces of the machine checklist (parsing what Windows reports, judging each item).
 import { buildChecks, canEnableFeature, editionSupport, nodeMajor } from '../cli/commands/setup/checks.js';
-import { featureFromInstallState, parseDismState, parseProbe, parseRegQuery } from '../cli/commands/setup/facts.js';
+import { featureFromInstallState, parseDismState, parseProbe, parseRegQuery, } from '../cli/commands/setup/facts.js';
 const GB = 1024 ** 3;
 export const setupSuite = {
     name: 'setup',
@@ -10,15 +10,35 @@ export const setupSuite = {
         const reg = parseRegQuery('\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\r\n    CurrentBuild    REG_SZ    22631\r\n    EditionID    REG_SZ    Professional\r\n    ProductName    REG_SZ    Windows 10 Pro\r\n    InstallDate    REG_DWORD    0x65a1b2c3\r\n');
         t.equal({ EditionID: reg.EditionID, CurrentBuild: reg.CurrentBuild, ProductName: reg.ProductName }, { EditionID: 'Professional', CurrentBuild: '22631', ProductName: 'Windows 10 Pro' }, 'reg query output parses into name/value pairs');
         t.equal(['Professional', 'EnterpriseS', 'EducationN', 'Core', 'CoreSingleLanguage', 'ServerStandard', 'Weird', null].map(editionSupport), ['supported', 'supported', 'supported', 'home', 'home', 'unsupported', 'unknown', 'unknown'], 'editions: Pro/Enterprise/Education yes, Home and Server no');
-        const dism = (state) => 'Deployment Image Servicing and Management tool\r\n\r\nFeature Name : Containers-DisposableClientVM\r\nDisplay Name : Windows Sandbox\r\nRestart Required : Possible\r\nState : ' + state + '\r\n';
-        t.equal([parseDismState(dism('Enabled')), parseDismState(dism('Enable Pending')), parseDismState(dism('Disabled')), parseDismState(dism('Disabled with Payload Removed')), parseDismState('Error: 740\r\nElevated permissions are required')], ['enabled', 'pending', 'disabled', 'disabled', 'unknown'], 'DISM feature state: enabled, pending restart, disabled; errors are unknown');
+        const dism = (state) => 'Deployment Image Servicing and Management tool\r\n\r\nFeature Name : Containers-DisposableClientVM\r\nDisplay Name : Windows Sandbox\r\nRestart Required : Possible\r\nState : ' +
+            state +
+            '\r\n';
+        t.equal([
+            parseDismState(dism('Enabled')),
+            parseDismState(dism('Enable Pending')),
+            parseDismState(dism('Disabled')),
+            parseDismState(dism('Disabled with Payload Removed')),
+            parseDismState('Error: 740\r\nElevated permissions are required'),
+        ], ['enabled', 'pending', 'disabled', 'disabled', 'unknown'], 'DISM feature state: enabled, pending restart, disabled; errors are unknown');
         t.equal([featureFromInstallState(1), featureFromInstallState(2), featureFromInstallState(null)], ['enabled', 'disabled', 'unknown'], 'Win32_OptionalFeature install state maps to the feature state');
-        t.equal(parseProbe('WARNING: x\r\n{"virtualizationFirmware":false,"hypervisorPresent":true,"installState":1}\r\n').hypervisorPresent, true, 'PowerShell probe: the last line is read as JSON');
+        t.equal(parseProbe('WARNING: x\r\n{"virtualizationFirmware":false,"hypervisorPresent":true,"installState":1}\r\n')
+            .hypervisorPresent, true, 'PowerShell probe: the last line is read as JSON');
         t.equal(Object.keys(parseProbe('not json')).length, 0, 'PowerShell probe: text that is not JSON is ignored');
         t.equal(Object.keys(parseProbe('{"installState":"1"}')).length, 0, 'PowerShell probe: JSON of the wrong shape is ignored');
         t.equal([nodeMajor('v22.11.0'), nodeMajor('18.0.0'), nodeMajor('')], [22, 18, 0], 'Node major version');
         t.section('judging each item');
-        const good = { edition: 'Professional', build: 22631, feature: 'enabled', sandboxExe: true, virtualizationFirmware: false, hypervisorPresent: true, totalRamBytes: 16 * GB, freeDiskBytes: 100 * GB, storageRoot: 'C:\\store', nodeVersion: 'v22.11.0' };
+        const good = {
+            edition: 'Professional',
+            build: 22631,
+            feature: 'enabled',
+            sandboxExe: true,
+            virtualizationFirmware: false,
+            hypervisorPresent: true,
+            totalRamBytes: 16 * GB,
+            freeDiskBytes: 100 * GB,
+            storageRoot: 'C:\\store',
+            nodeVersion: 'v22.11.0',
+        };
         const status = (facts) => Object.fromEntries(buildChecks({ ...good, ...facts }).map((c) => [c.name, c.status]));
         t.check(buildChecks(good).every((c) => c.status === 'ok'), 'a ready PC is all OK (a running hypervisor counts as virtualization on)');
         t.equal(status({ edition: 'Core' })['Windows edition'], 'action', 'Windows Home needs action');

package/dist/selftest/{fixtures.d.ts → support/fixtures.d.ts}

@@ -1,5 +1,5 @@
-import type { Config, HostProbe, ResolvedRun, RunRequest } from '../core/types.js';
-import { generateSandbox } from '../host/generate.js';
+import type { Config, HostProbe, ResolvedRun, RunRequest } from '../../core/types.js';
+import { generateSandbox } from '../../host/launch/index.js';
 import type { Harness } from './harness.js';
 export declare const HOST_NODE_VERSION = "v22.3.0";
 /** Colour codes are removed from captured output, so tests can match plain text. */
@@ -45,8 +45,8 @@ export declare const createFixtures: (t: Harness) => {
         };
         mappings: {
             host: string;
-            guest: string;
             readOnly: boolean;
+            guest?: string | undefined;
             optional?: boolean | undefined;
         }[];
         sandbox: {
@@ -90,7 +90,7 @@ export declare const createFixtures: (t: Harness) => {
             refresh: boolean;
             git: {
                 enabled: boolean;
-                access: "readonly" | "full" | "none";
+                access: "readonly" | "none" | "full";
             };
             terminal: {
                 enabled: boolean;
@@ -125,6 +125,8 @@ export declare const createFixtures: (t: Harness) => {
                 targets: string[];
                 crates: string[];
                 targetDir: string;
+                linker: "lld" | "gnu";
+                linkSlots: number | "auto";
             };
             msvc: {
                 enabled: boolean | "auto";
@@ -291,6 +293,7 @@ export declare const createFixtures: (t: Harness) => {
             roots: string[];
             askToAddRoot: boolean;
             declinedRoots: string[];
+            allowOutsideMappings: boolean | "ask";
             wsbShare: boolean;
         };
         $schema?: string | undefined;

package/dist/selftest/{fixtures.js → support/fixtures.js}

@@ -2,22 +2,38 @@
 // run, generate the sandbox for it, run the guest against it and start the CLI. Shared by all suites.
 import path from 'node:path';
 import { spawn } from 'node:child_process';
-import { DEFAULTS } from '../core/config.js';
-import { generateSandbox } from '../host/generate.js';
-import { resolveRun } from '../core/workspace.js';
+import { DEFAULTS } from '../../core/config/index.js';
+import { generateSandbox } from '../../host/launch/index.js';
+import { resolveRun } from '../../core/run/index.js';
 export const HOST_NODE_VERSION = 'v22.3.0';
 /** Colour codes are removed from captured output, so tests can match plain text. */
 export const stripAnsi = (text) => text.replace(/\x1b\[[0-9;]*m/g, '');
 /** Runs `node <args>` and collects stdout + stderr (colours removed). Never throws; a hung process is killed at the timeout. */
 export const runNode = (args, options = {}) => new Promise((resolve) => {
-    const child = spawn(process.execPath, args, { cwd: options.cwd, env: options.env ?? process.env, windowsHide: true });
+    const child = spawn(process.execPath, args, {
+        cwd: options.cwd,
+        env: options.env ?? process.env,
+        windowsHide: true,
+    });
     let out = '';
     let timedOut = false;
-    const timer = setTimeout(() => { timedOut = true; child.kill(); }, options.timeoutMs ?? 120000);
-    child.stdout.on('data', (c) => { out += c.toString(); });
-    child.stderr.on('data', (c) => { out += c.toString(); });
-    child.on('error', (e) => { out += String(e); });
-    child.on('close', (status) => { clearTimeout(timer); resolve({ status: timedOut ? null : status, out: stripAnsi(out), timedOut }); });
+    const timer = setTimeout(() => {
+        timedOut = true;
+        child.kill();
+    }, options.timeoutMs ?? 120000);
+    child.stdout.on('data', (c) => {
+        out += c.toString();
+    });
+    child.stderr.on('data', (c) => {
+        out += c.toString();
+    });
+    child.on('error', (e) => {
+        out += String(e);
+    });
+    child.on('close', (status) => {
+        clearTimeout(timer);
+        resolve({ status: timedOut ? null : status, out: stripAnsi(out), timedOut });
+    });
 });
 export const createFixtures = (t) => {
     const { at, write } = t;
@@ -33,7 +49,10 @@ export const createFixtures = (t) => {
     write(path.join(hostProfile, 'commands', 'review.md'), 'review cmd');
     write(path.join(hostProfile, 'plugins', 'installed_plugins.json'), JSON.stringify({ path: hostProfile + '\\plugins\\cache\\claude-mem' }));
     write(path.join(hostProfile, '.credentials.json'), '{ "token": "secret" }');
-    const hostGlobalState = t.writeJson(at('host-claude.json'), { hasCompletedOnboarding: true, mcpServers: { github: { command: 'npx' } } });
+    const hostGlobalState = t.writeJson(at('host-claude.json'), {
+        hasCompletedOnboarding: true,
+        mcpServers: { github: { command: 'npx' } },
+    });
     // The install folder, two workspaces (B has a setup script), a folder to share, the storage root, and tools "from this PC".
     const install = at('install');
     t.dir('install', 'sub');
@@ -59,24 +78,83 @@ export const createFixtures = (t) => {
         return c;
     };
     const baseConfig = makeConfig();
-    const probe = { nodeDir: hostNode, harnessExe: { dir: hostClaude, file: 'claude.exe' }, gitDir: null, nvmDir: null, hostNodeVersion: HOST_NODE_VERSION };
+    const probe = {
+        nodeDir: hostNode,
+        harnessExe: { dir: hostClaude, file: 'claude.exe' },
+        gitDir: null,
+        nvmDir: null,
+        hostNodeVersion: HOST_NODE_VERSION,
+    };
     /** Resolves a run for `workA` (or whatever `over` says). */
-    const run = (over = {}, config = baseConfig) => resolveRun({ packageRoot: install, loaded: { config, configPath: null, base: t.temp }, cwd: workA, noAgent: false, noLocalConfig: false, trustConfig: false, scripts: [], ...over }, HOST_NODE_VERSION);
+    const run = (over = {}, config = baseConfig) => resolveRun({
+        packageRoot: install,
+        loaded: { config, configPath: null, base: t.temp },
+        cwd: workA,
+        noAgent: false,
+        noLocalConfig: false,
+        trustConfig: false,
+        scripts: [],
+        ...over,
+    }, HOST_NODE_VERSION);
     const generate = (r, args = [], p = probe) => 
     // A fixed "this PC has" list, so "auto" toolchains decide the same on every machine the tests run on.
-    generateSandbox({ packageRoot: t.packageRoot, run: r, harnessArgs: args, probe: p, pcLanguages: ['python', 'rust', 'cpp', 'dotnet'] });
+    generateSandbox({
+        packageRoot: t.packageRoot,
+        run: r,
+        harnessArgs: args,
+        probe: p,
+        pcLanguages: ['python', 'rust', 'cpp', 'dotnet'],
+    });
     /** Resolves a run and generates its sandbox (.wsb + launch folder + session.json) in one step. */
     const launch = async (over = {}, options = {}) => generate(await run(over, options.config ?? baseConfig), options.args, options.probe);
     /** Writes a project's `.sandbox-config.json` (objects are serialised; strings are written as they are). */
-    const writeLocal = (dir, content) => { write(path.join(dir, '.sandbox-config.json'), typeof content === 'string' ? content : JSON.stringify(content)); };
+    const writeLocal = (dir, content) => {
+        write(path.join(dir, '.sandbox-config.json'), typeof content === 'string' ? content : JSON.stringify(content));
+    };
     /** The four folders history sync works with, for a workspace on the PC and its place in the sandbox. */
-    const historySides = (name, hostWorkspace, guestWorkspace) => ({ hostClaudeDir: at(name + '-host'), guestClaudeDir: at(name + '-guest'), hostWorkspace, guestWorkspace });
+    const historySides = (name, hostWorkspace, guestWorkspace) => ({
+        hostClaudeDir: at(name + '-host'),
+        guestClaudeDir: at(name + '-guest'),
+        hostWorkspace,
+        guestWorkspace,
+    });
     /** Runs the guest's bundled main.js in dry-run mode against fake sandbox folders. */
     const runGuest = async (launchPath, data, workspace, extra = {}) => runNode([path.join(launchPath, 'runtime', 'main.js')], {
-        env: { ...process.env, AGENT_LAUNCH_DIR: launchPath, AGENT_DATA_DIR: data, AGENT_HOST_TOOLS_DIR: at('host-tools'), AGENT_WORKSPACE: workspace, AGENT_LOCAL_DIR: at('local'), AGENT_MANAGED_DIR: at('managed'), AGENT_DRY_RUN: '1', ...extra },
+        env: {
+            ...process.env,
+            AGENT_LAUNCH_DIR: launchPath,
+            AGENT_DATA_DIR: data,
+            AGENT_HOST_TOOLS_DIR: at('host-tools'),
+            AGENT_WORKSPACE: workspace,
+            AGENT_LOCAL_DIR: at('local'),
+            AGENT_MANAGED_DIR: at('managed'),
+            AGENT_DRY_RUN: '1',
+            ...extra,
+        },
     });
     /** Runs a built command (dist/bin/<name>.js) as its own process. */
     const runBin = (name, args, options = {}) => runNode([path.join(t.packageRoot, 'dist', 'bin', name + '.js'), ...args], options);
     const readJson = t.readJson;
-    return { at, hostNode, hostClaude, hostProfile, hostGlobalState, install, workA, workB, shared, makeConfig, baseConfig, probe, run, generate, launch, writeLocal, historySides, runGuest, runBin, readJson };
+    return {
+        at,
+        hostNode,
+        hostClaude,
+        hostProfile,
+        hostGlobalState,
+        install,
+        workA,
+        workB,
+        shared,
+        makeConfig,
+        baseConfig,
+        probe,
+        run,
+        generate,
+        launch,
+        writeLocal,
+        historySides,
+        runGuest,
+        runBin,
+        readJson,
+    };
 };

package/dist/selftest/{harness.js → support/harness.js}

@@ -4,10 +4,13 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { inspect, isDeepStrictEqual } from 'node:util';
-import { ensureDir, errMsg, sleep } from '../core/util.js';
+import { ensureDir, errMsg, sleep } from '../../core/util/index.js';
 const show = (value) => inspect(value, { depth: 6, breakLength: 110, maxStringLength: 600, maxArrayLength: 40 });
-const indent = (text) => text.split('\n').map((line) => '        ' + line).join('\n');
-const clip = (text, max = 800) => (text.length > max ? text.slice(0, max) + ' ... (' + text.length + ' characters)' : text);
+const indent = (text) => text
+    .split('\n')
+    .map((line) => '        ' + line)
+    .join('\n');
+const clip = (text, max = 800) => text.length > max ? text.slice(0, max) + ' ... (' + text.length + ' characters)' : text;
 export const createHarness = (packageRoot) => {
     let failed = 0;
     let total = 0;
@@ -35,7 +38,11 @@ export const createHarness = (packageRoot) => {
         const outcome = await attempt(fn);
         return outcome.threw ? outcome.message : '';
     };
-    const write = (file, content) => { ensureDir(path.dirname(file)); fs.writeFileSync(file, content); return file; };
+    const write = (file, content) => {
+        ensureDir(path.dirname(file));
+        fs.writeFileSync(file, content);
+        return file;
+    };
     return {
         packageRoot,
         temp,
@@ -50,17 +57,27 @@ export const createHarness = (packageRoot) => {
             const outcome = await attempt(fn);
             const message = outcome.threw ? outcome.message : '';
             const ok = outcome.threw && (typeof expected === 'string' ? message.includes(expected) : expected.test(message));
-            check(ok, name, 'expected an error containing: ' + String(expected) + '\n' + (outcome.threw ? 'actual error: ' + show(clip(message)) : 'but nothing was thrown'));
+            check(ok, name, 'expected an error containing: ' +
+                String(expected) +
+                '\n' +
+                (outcome.threw ? 'actual error: ' + show(clip(message)) : 'but nothing was thrown'));
         },
         thrownMessage,
         section: (title) => console.log('\n\x1b[36m-- ' + title + '\x1b[0m'),
         skip: (what) => console.log('SKIP  ' + what),
         at: (...parts) => path.join(temp, ...parts),
-        dir: (...parts) => { const p = path.join(temp, ...parts); ensureDir(p); return p; },
+        dir: (...parts) => {
+            const p = path.join(temp, ...parts);
+            ensureDir(p);
+            return p;
+        },
         write,
         writeJson: (file, value) => write(file, JSON.stringify(value)),
         readJson: (file) => JSON.parse(fs.readFileSync(file, 'utf8')),
-        touch: (file, secondsFromNow = 10) => { const when = new Date(Date.now() + secondsFromNow * 1000); fs.utimesSync(file, when, when); },
+        touch: (file, secondsFromNow = 10) => {
+            const when = new Date(Date.now() + secondsFromNow * 1000);
+            fs.utimesSync(file, when, when);
+        },
         waitFor: async (read, ms = 30000, everyMs = 100) => {
             const end = Date.now() + ms;
             for (;;) {

package/dist/selftest/{live.d.ts → support/live.d.ts}

@@ -1,7 +1,7 @@
 import { type ChildProcess } from 'node:child_process';
 import type net from 'node:net';
-import type { GuestResponse, SessionStatus } from '../core/types.js';
-import { type Endpoint, type Viewers } from '../shared/pty-client.js';
+import type { GuestResponse, SessionStatus } from '../../core/types.js';
+import { type Endpoint, type Viewers } from '../../shared/pty/index.js';
 import type { Fixtures } from './fixtures.js';
 import type { Harness } from './harness.js';
 export declare const CSC: string;