windows-development-sandbox 1.4.0 → 1.4.3

package/dist/core/config.js

@@ -1,109 +0,0 @@
-// Built-in defaults and loading the user config (~/.agent-sandbox/config.json). Shapes live in schema.ts.
-import fs from 'node:fs';
-import path from 'node:path';
-import _ from 'lodash';
-import { Config as ConfigSchema, describeIssues } from './schema.js';
-import { fail, homeDir, readJsonc } from './util.js';
-export const DEFAULTS = {
-    defaultHarness: 'claude',
-    guestWorkspace: 'auto',
-    readOnly: false,
-    workspaceFilter: { enabled: false, exclude: [], include: [] },
-    audit: { enabled: false, days: 14, maxMb: 100, processes: true, files: true },
-    mappings: [],
-    sandbox: { memoryMb: 'auto', maxMemoryMb: 32768, maxMemoryPercent: 80, cpuLimit: 80, pageFileMb: 16384, reserveHostMb: 8192, vGpu: false, networking: true, clipboard: true, audioInput: false, videoInput: false, printerRedirection: false, protectedClient: true, headless: false, keepAwake: true },
-    storage: { root: '%LOCALAPPDATA%\\AgentSandbox', persistAgentState: true, dataName: 'default', markSandboxFiles: true, warnDataGb: 50 },
-    network: { blockPrivateRanges: true, allowOnly: [], blockHosts: [], forwardPorts: [], dns: [], proxy: '' },
-    provisioning: { copyFromHost: true, fallbackToInstall: true, refresh: false, git: { enabled: true, access: 'full' }, terminal: { enabled: true }, conpty: { enabled: true } },
-    downloads: { requireChecksum: false },
-    toolchains: {
-        node: { version: 'host', extraVersions: [], corepack: true, volta: 'auto', globalPackages: [] },
-        python: { enabled: 'auto', version: '3', python2: true, pyenv: 'auto', tools: [] },
-        rust: { enabled: 'auto', toolchain: 'stable', host: 'auto', components: [], targets: [], crates: [], targetDir: 'separate' },
-        msvc: { enabled: 'auto', acceptLicense: false, msvcVersion: 'latest', sdkVersion: 'latest' },
-        cpp: { enabled: 'auto', flexBison: true },
-        dotnet: { enabled: 'auto', channels: ['LTS'], tools: [], workloads: [], frameworkTargets: ['net48', 'net472'], netfx35: false },
-        // Bigger downloads only for projects that use them.
-        go: { enabled: 'auto', version: 'stable', tools: [] },
-        java: { enabled: 'auto', version: 'lts', maven: true, gradle: true },
-        ruby: { enabled: 'auto', version: '3', gems: [] },
-        php: { enabled: 'auto', version: '8', composer: true },
-        deno: { enabled: 'auto' },
-        pwsh: { enabled: 'auto' },
-        cli: { gh: 'auto', zstd: false, openssl: 'auto' },
-        bun: { enabled: true },
-        uv: { enabled: true },
-        vcRuntime: { enabled: false },
-        mesa: { enabled: false, vulkan: false },
-        vscode: { enabled: true, setup: true, recommended: true, extensions: [] },
-        environment: {},
-    },
-    databases: {
-        postgres: { enabled: 'auto', version: 'latest', port: 5432 },
-        mysql: { enabled: 'auto', version: 'lts', port: 3306 },
-        mongodb: { enabled: 'auto', version: 'latest', port: 27017 },
-        redis: { enabled: 'auto', port: 6379 },
-        dynamodb: { enabled: 'auto', port: 8000, adminPort: 8001, admin: true },
-        sqlserver: { enabled: 'auto' },
-    },
-    attach: { enabled: true, reuseSession: true, auto: false, autoHide: false },
-    agentCommands: { enabled: false, agents: 'auto' },
-    secrets: { strip: true, allow: [], patterns: [], warnFiles: true },
-    personalization: { enabled: true },
-    apps: { install: [], custom: {} },
-    claudeProfile: { enabled: true, hostDir: 'auto', include: ['settings.json', 'CLAUDE.md', 'commands', 'agents', 'skills', 'plugins'], globalStateFile: 'auto', copyCredentials: false, overwrite: true, syncHistory: true, historyScope: 'project', syncClaudeMem: true, syncClaudeMemBack: false },
-    harnesses: {
-        claude: { hostExecutable: 'claude.exe', hostDir: 'auto', npmPackage: '@anthropic-ai/claude-code@latest', npmBin: 'claude', arguments: [], environment: { DISABLE_AUTOUPDATER: '1' }, resumeArguments: ['--continue'] },
-        codex: { npmPackage: '@openai/codex@latest', npmBin: 'codex', arguments: [], environment: {}, resumeArguments: ['resume', '--last'] },
-        gemini: { npmPackage: '@google/gemini-cli@latest', npmBin: 'gemini', arguments: [], environment: {}, resumeArguments: ['--resume'] },
-        // Not tested by us; installed from each project's official npm / PyPI package.
-        opencode: { npmPackage: 'opencode-ai@latest', npmBin: 'opencode', arguments: [], environment: {}, resumeArguments: ['--continue'] },
-        qwen: { npmPackage: '@qwen-code/qwen-code@latest', npmBin: 'qwen', arguments: [], environment: {}, resumeArguments: ['--continue'] },
-        crush: { npmPackage: '@charmland/crush@latest', npmBin: 'crush', arguments: [], environment: {}, resumeArguments: ['--continue'] },
-        copilot: { npmPackage: '@github/copilot@latest', npmBin: 'copilot', arguments: [], environment: {}, resumeArguments: ['--continue'] },
-        kilo: { npmPackage: '@kilocode/cli@latest', npmBin: 'kilo', arguments: [], environment: {}, resumeArguments: ['--continue'] },
-        amp: { npmPackage: '@ampcode/cli@latest', npmBin: 'amp', arguments: [], environment: {} },
-        cline: { npmPackage: 'cline@latest', npmBin: 'cline', arguments: [], environment: {} },
-        continue: { npmPackage: '@continuedev/cli@latest', npmBin: 'cn', arguments: [], environment: {}, resumeArguments: ['--resume'] },
-        kimi: { npmPackage: '@moonshot-ai/kimi-code@latest', npmBin: 'kimi', arguments: [], environment: {}, resumeArguments: ['-c'] },
-        // DeepSeek has no official coding CLI; these two community agents are built for it.
-        reasonix: { npmPackage: 'reasonix@latest', npmBin: 'reasonix', arguments: [], environment: {} },
-        deepseek: { npmPackage: 'codewhale@latest', npmBin: 'codewhale', arguments: [], environment: {} },
-        aider: { uvPackage: 'aider-chat', uvBin: 'aider', arguments: [], environment: {}, resumeArguments: ['--restore-chat-history'] },
-    },
-    hooks: { failFast: false },
-    projects: { all: false, exclude: [], roots: [], askToAddRoot: true, declinedRoots: [], wsbShare: true },
-};
-/** Per-user folder for config and hooks. Survives reinstalling the npm package. */
-export const userDir = () => process.env.AGENT_SANDBOX_HOME ?? path.join(homeDir(), '.agent-sandbox');
-export const userConfigPath = () => path.join(userDir(), 'config.json');
-/** Deep merge where arrays (and anything that is not a plain object) replace instead of merging element by element. */
-export const mergeConfig = (base, extra) => _.mergeWith(_.cloneDeep(base), extra, (_target, source) => (Array.isArray(source) ? source : undefined));
-/** Validates a full config; throws one readable error listing every problem. */
-export const validateConfig = (config, source) => {
-    const parsed = ConfigSchema.safeParse(config);
-    if (!parsed.success)
-        fail(source + ' is not valid:\n  - ' + describeIssues(parsed.error).join('\n  - '));
-    return parsed.data;
-};
-/**
- * Lookup order: --config, %AGENT_SANDBOX_CONFIG%, ~/.agent-sandbox/config.json, built-in defaults.
- * Whatever file is found (JSON with comments) is merged over the defaults, so it only needs the keys you change.
- */
-export const loadConfig = (explicitPath) => {
-    const requested = explicitPath ?? process.env.AGENT_SANDBOX_CONFIG;
-    const full = path.resolve(requested ?? userConfigPath());
-    if (!fs.existsSync(full)) {
-        if (requested)
-            fail('Config file not found: ' + full, 'Check the --config path or AGENT_SANDBOX_CONFIG, or create one with: sandbox config init');
-        return { config: structuredClone(DEFAULTS), configPath: null, base: userDir() };
-    }
-    return { config: validateConfig(mergeConfig(DEFAULTS, readJsonc(full)), full), configPath: full, base: path.dirname(full) };
-};
-export const assertNoGuestOverlap = (mappings) => {
-    const normal = mappings.map((m) => m.guest.replace(/\\+$/, '').toLowerCase());
-    normal.forEach((a, i) => normal.slice(i + 1).forEach((b, j) => {
-        if (a === b || a.startsWith(b + '\\') || b.startsWith(a + '\\'))
-            fail('Two folders map to overlapping places in the sandbox: ' + mappings[i].guest + ' and ' + mappings[i + 1 + j].guest + '.', 'Give each mapping its own guest folder (one must not be inside the other).');
-    }));
-};

package/dist/core/schema.d.ts

@@ -1,6 +0,0 @@
-export { GitAccess } from './schema/common.js';
-export { Config, LocalOverrides } from './schema/config.js';
-export { Harness } from './schema/harness.js';
-export { describeIssues, jsonSchemas } from './schema/json-schema.js';
-export { Mapping } from './schema/sandbox.js';
-export { Toolchains } from './schema/toolchains.js';

package/dist/core/schema.js

@@ -1,8 +0,0 @@
-// Every setting, defined once with zod, split by area in schema/. This file is the one place the rest of the code (and
-// scripts/schemas.mjs, which generates the JSON Schema files) imports them from.
-export { GitAccess } from './schema/common.js';
-export { Config, LocalOverrides } from './schema/config.js';
-export { Harness } from './schema/harness.js';
-export { describeIssues, jsonSchemas } from './schema/json-schema.js';
-export { Mapping } from './schema/sandbox.js';
-export { Toolchains } from './schema/toolchains.js';

package/dist/core/util.d.ts

@@ -1,62 +0,0 @@
-export declare const isWin: boolean;
-/** An expected problem the user can act on: what went wrong, and (optionally) how to fix it. */
-export declare class UserError extends Error {
-    readonly fix?: string | undefined;
-    constructor(message: string, fix?: string | undefined);
-}
-/** Throws a UserError. Typed explicitly so TypeScript narrows after calls (arrow functions need it to act as never). */
-export declare const fail: (message: string, fix?: string) => never;
-/**
- * Parses JSON with comments and trailing commas (JSONC, like VS Code's settings.json). Errors name the file, line
- * and column, and say what to fix.
- */
-export declare const parseJsonc: <T>(text: string, source: string) => T;
-export declare const readJsonc: <T>(file: string) => T;
-export declare const errMsg: (e: unknown) => string;
-export declare const ensureDir: (p: string) => void;
-export declare const dirExists: (p: string) => boolean;
-export declare const fileExists: (p: string) => boolean;
-export declare const readJson: <T>(p: string) => T;
-export declare const tryReadJson: <T>(p: string) => T | null;
-/** Atomic (a crash or a second command never leaves half a file); refused outside temp during the self-test. */
-export declare const writeJson: (p: string, value: unknown) => void;
-export declare const realPath: (p: string) => string;
-export declare const xmlEscape: (v: string) => string;
-export declare const homeDir: () => string;
-export declare const sleep: (ms: number) => Promise<void>;
-/** Expands %VAR% and resolves relative paths against `base`. */
-export declare const expandPath: (input: string, base: string) => string;
-export declare const isRootPath: (p: string) => boolean;
-export declare const isUserProfile: (p: string) => boolean;
-export declare const isInsideOrEqual: (parent: string, child: string) => boolean;
-/**
- * Text that came from the sandbox, made safe to print: control characters and escape sequences are removed except
- * plain colours (SGR), so nothing written by the sandbox can drive your terminal (titles, clipboard, cursor tricks).
- */
-export declare const safeText: (text: string) => string;
-/** safeText without colours either: for text you are asked to approve, which must not be able to hide parts of itself. */
-export declare const plainText: (text: string) => string;
-export declare const findOnPath: (names: string[]) => string | null;
-/** True if `p` itself is a symlink or junction (lstat; never follows it). */
-export declare const isLink: (p: string) => boolean;
-/** Removes a symlink or junction itself (never its target). Junctions need rmdir on Windows. */
-export declare const removeLink: (p: string) => void;
-/**
- * The sandbox can write anywhere in its data folder, so it could swap a folder for a junction that points at this
- * PC's own disk. Before the host reads, writes or deletes anything under `root`, every existing path component from
- * `root` down to `target` must be a plain folder/file. Throws otherwise.
- */
-export declare const assertNoLinks: (root: string, target: string) => void;
-/** Runs a PowerShell script and returns its exit code (and stdout when `capture`). */
-export declare const runPowerShell: (script: string, capture?: boolean) => {
-    status: number;
-    stdout: string;
-};
-/** Runs a program (an absolute path: `SYSTEM.*`, never a bare name) and returns its stdout, or '' if it failed or timed out. */
-export declare const captureOutput: (file: string, args: string[], options?: {
-    timeout?: number;
-    cwd?: string;
-    maxBuffer?: number;
-}) => string;
-/** Async variant (does not block the event loop), resolving with stdout. */
-export declare const runPowerShellAsync: (script: string) => Promise<string>;

package/dist/core/util.js

@@ -1,156 +0,0 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawn, spawnSync } from 'node:child_process';
-import { SYSTEM } from '../shared/system.js';
-import { writeJsonAtomic } from '../shared/rundir.js';
-import { assertTestWritable } from '../shared/test-guard.js';
-import { parse as parseJsoncText, printParseErrorCode } from 'jsonc-parser';
-export const isWin = process.platform === 'win32';
-/** An expected problem the user can act on: what went wrong, and (optionally) how to fix it. */
-export class UserError extends Error {
-    fix;
-    constructor(message, fix) {
-        super(message);
-        this.fix = fix;
-        this.name = 'UserError';
-    }
-}
-/** Throws a UserError. Typed explicitly so TypeScript narrows after calls (arrow functions need it to act as never). */
-export const fail = (message, fix) => { throw new UserError(message, fix); };
-/**
- * Parses JSON with comments and trailing commas (JSONC, like VS Code's settings.json). Errors name the file, line
- * and column, and say what to fix.
- */
-export const parseJsonc = (text, source) => {
-    const errors = [];
-    const value = parseJsoncText(text.replace(/^/, ''), errors, { allowTrailingComma: true, disallowComments: false });
-    if (errors.length) {
-        const { offset, error } = errors[0];
-        const before = text.slice(0, offset).split(/\r?\n/);
-        fail(source + ' is not valid JSON (line ' + before.length + ', column ' + (before[before.length - 1].length + 1) + ': ' + printParseErrorCode(error) + ').', 'Fix that spot in the file. Comments (// and /* */) and trailing commas are fine.');
-    }
-    return value;
-};
-export const readJsonc = (file) => parseJsonc(fs.readFileSync(file, 'utf8'), file);
-export const errMsg = (e) => e instanceof Error ? e.message : String(e);
-export const ensureDir = (p) => { fs.mkdirSync(p, { recursive: true }); };
-export const dirExists = (p) => { try {
-    return fs.statSync(p).isDirectory();
-}
-catch {
-    return false;
-} };
-export const fileExists = (p) => { try {
-    return fs.statSync(p).isFile();
-}
-catch {
-    return false;
-} };
-export const readJson = (p) => JSON.parse(fs.readFileSync(p, 'utf8').replace(/^\uFEFF/, ''));
-export const tryReadJson = (p) => { try {
-    return readJson(p);
-}
-catch {
-    return null;
-} };
-/** Atomic (a crash or a second command never leaves half a file); refused outside temp during the self-test. */
-export const writeJson = (p, value) => writeJsonAtomic(p, value);
-export const realPath = (p) => { try {
-    return fs.realpathSync(p);
-}
-catch {
-    return p;
-} };
-export const xmlEscape = (v) => v.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&apos;');
-export const homeDir = () => process.env.USERPROFILE ?? os.homedir();
-export const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-/** Expands %VAR% and resolves relative paths against `base`. */
-export const expandPath = (input, base) => {
-    const expanded = input.replace(/%([^%]+)%/g, (_m, name) => process.env[name] ?? '%' + name + '%').replace(/^~(?=$|[\\/])/, homeDir());
-    return path.resolve(path.isAbsolute(expanded) ? expanded : path.join(base, expanded));
-};
-export const isRootPath = (p) => { const n = path.resolve(p); return n.toLowerCase() === path.parse(n).root.toLowerCase(); };
-export const isUserProfile = (p) => { const profile = process.env.USERPROFILE ?? process.env.HOME ?? ''; return profile !== '' && path.resolve(p).toLowerCase() === path.resolve(profile).toLowerCase(); };
-export const isInsideOrEqual = (parent, child) => {
-    const rel = path.relative(path.resolve(parent).toLowerCase(), path.resolve(child).toLowerCase());
-    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
-};
-/**
- * Text that came from the sandbox, made safe to print: control characters and escape sequences are removed except
- * plain colours (SGR), so nothing written by the sandbox can drive your terminal (titles, clipboard, cursor tricks).
- */
-export const safeText = (text) => text.replace(/\x1b\[[0-9;]*m|\x1b(\[[0-9;?]*[ -\/]*[@-~]|\][^\x07\x1b]*(\x07|\x1b\\)|[@-Z\\-_])|[\x00-\x08\x0b-\x1f\x7f-\x9f]/g, (m) => (/^\x1b\[[0-9;]*m$/.test(m) ? m : ''));
-/** safeText without colours either: for text you are asked to approve, which must not be able to hide parts of itself. */
-export const plainText = (text) => safeText(text).replace(/\x1b\[[0-9;]*m/g, '');
-export const findOnPath = (names) => {
-    const dirs = (process.env.PATH ?? process.env.Path ?? '').split(path.delimiter).filter((d) => d !== '');
-    for (const name of names)
-        for (const dir of dirs) {
-            const candidate = path.join(dir, name);
-            if (fileExists(candidate))
-                return candidate;
-        }
-    return null;
-};
-/** True if `p` itself is a symlink or junction (lstat; never follows it). */
-export const isLink = (p) => { try {
-    return fs.lstatSync(p).isSymbolicLink();
-}
-catch {
-    return false;
-} };
-/** Removes a symlink or junction itself (never its target). Junctions need rmdir on Windows. */
-export const removeLink = (p) => { assertTestWritable(p); try {
-    fs.unlinkSync(p);
-}
-catch {
-    fs.rmdirSync(p);
-} };
-/**
- * The sandbox can write anywhere in its data folder, so it could swap a folder for a junction that points at this
- * PC's own disk. Before the host reads, writes or deletes anything under `root`, every existing path component from
- * `root` down to `target` must be a plain folder/file. Throws otherwise.
- */
-export const assertNoLinks = (root, target) => {
-    const rel = path.relative(path.resolve(root), path.resolve(target));
-    if (rel.startsWith('..') || path.isAbsolute(rel))
-        fail('Refusing to touch ' + target + ': it is outside ' + root);
-    let current = path.resolve(root);
-    for (const part of ['', ...rel.split(path.sep).filter(Boolean)]) {
-        current = part ? path.join(current, part) : current;
-        if (isLink(current))
-            fail('Refusing to touch ' + target + ': ' + current + ' is a link (possible escape attempt from the sandbox).');
-    }
-};
-/**
- * PowerShell arguments for a script passed encoded (no quoting issues, no progress-bar noise on stderr). Output is
- * UTF-8: Windows PowerShell 5.1 otherwise writes redirected stdout in the OEM code page, mangling non-ASCII (regional
- * date formats, wallpaper paths). UTF8Encoding($false): no byte-order mark in front of the output.
- */
-const powerShellArgs = (script) => {
-    const prelude = "[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding $false\n$ProgressPreference = 'SilentlyContinue'\n";
-    const encoded = Buffer.from(prelude + script, 'utf16le').toString('base64');
-    // -OutputFormat Text: with redirected output PowerShell would otherwise print its progress stream as "#< CLIXML" XML.
-    return ['-NoLogo', '-NoProfile', '-NonInteractive', '-OutputFormat', 'Text', '-ExecutionPolicy', 'Bypass', '-EncodedCommand', encoded];
-};
-/** Runs a PowerShell script and returns its exit code (and stdout when `capture`). */
-export const runPowerShell = (script, capture = false) => {
-    const result = spawnSync(SYSTEM.powershell(), powerShellArgs(script), { stdio: capture ? ['ignore', 'pipe', 'inherit'] : 'inherit', encoding: 'utf8', windowsHide: true });
-    if (result.error)
-        throw result.error;
-    return { status: result.status ?? 1, stdout: result.stdout ?? '' };
-};
-/** Runs a program (an absolute path: `SYSTEM.*`, never a bare name) and returns its stdout, or '' if it failed or timed out. */
-export const captureOutput = (file, args, options = {}) => {
-    const result = spawnSync(file, args, { encoding: 'utf8', windowsHide: true, timeout: 60000, ...options });
-    return result.status === 0 ? result.stdout ?? '' : '';
-};
-/** Async variant (does not block the event loop), resolving with stdout. */
-export const runPowerShellAsync = (script) => new Promise((resolve, reject) => {
-    const child = spawn(SYSTEM.powershell(), powerShellArgs(script), { stdio: ['ignore', 'pipe', 'inherit'], windowsHide: true });
-    let out = '';
-    child.stdout.on('data', (d) => { out += d.toString('utf8'); });
-    child.on('error', reject);
-    child.on('close', () => resolve(out));
-});

package/dist/core/workspace.d.ts

@@ -1,18 +0,0 @@
-import type { Config, Overrides, ResolvedRun, RunRequest, ToolVersions } from './types.js';
-/**
- * 'auto' guest workspace: C:\Workspace\<folder name>. Keeping the real folder name means Claude's per-project history
- * and claude-mem's project name match this PC instead of every project being "Workspace".
- */
-export declare const autoGuestWorkspace: (workspaceHost: string) => string;
-/** The Node version a Volta project pins ("volta": { "node": "20.11.1" } in package.json), so nvm defaults to it too. */
-export declare const voltaNode: (workspace: string) => string | null;
-/**
- * Picks tool versions. Highest priority first: command line, the folder's .sandbox-config.json,
- * version files in the workspace (.nvmrc, .node-version, .python-version), the tool config, this PC's node version.
- */
-export declare const resolveVersions: (config: Config, workspace: string, local: Overrides, req: {
-    nodeVersion?: string;
-    pythonVersion?: string;
-}, hostNodeVersion: string) => ToolVersions;
-/** Precedence (lowest to highest): built-in defaults, user config, .sandbox-config.json in the workspace, command-line flags. */
-export declare const resolveRun: (req: RunRequest, hostNodeVersion?: string) => Promise<ResolvedRun>;

package/dist/core/workspace.js

@@ -1,145 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { z } from 'zod';
-import { planMirrorWorkspace } from '../shared/guest-paths.js';
-import { DATABASES } from './detect-databases.js';
-import { allowedAnswer, allowRequests, allowStorePath, applyOverrides, describeOverrides, isTrusted, loosenedRequests, saveAllowed, normalizeOverrides, readLocalConfig, saveTrust, trustStorePath } from './local-config.js';
-import { assertSafeWorkspace } from './safe-paths.js';
-import { dirExists, expandPath, fail, fileExists, plainText } from './util.js';
-/**
- * 'auto' guest workspace: C:\Workspace\<folder name>. Keeping the real folder name means Claude's per-project history
- * and claude-mem's project name match this PC instead of every project being "Workspace".
- */
-export const autoGuestWorkspace = (workspaceHost) => {
-    const name = path.basename(workspaceHost).replace(/[^A-Za-z0-9._ -]/g, '_').replace(/^[. ]+|[. ]+$/g, '');
-    return 'C:\\Workspace\\' + (name || 'project');
-};
-const firstLine = (file) => {
-    if (!fileExists(file))
-        return null;
-    const line = fs.readFileSync(file, 'utf8').replace(/^/, '').split(/\r?\n/).map((l) => l.replace(/#.*$/, '').trim()).find((l) => l !== '');
-    return line ?? null;
-};
-const VOLTA_PIN = 'package.json volta.node';
-const PackageJson = z.object({ volta: z.object({ node: z.string().regex(/^\d+(\.\d+){0,2}$/).optional() }).optional() });
-/** The Node version a Volta project pins ("volta": { "node": "20.11.1" } in package.json), so nvm defaults to it too. */
-export const voltaNode = (workspace) => {
-    const file = path.join(workspace, 'package.json');
-    if (!fileExists(file))
-        return null;
-    try {
-        return PackageJson.safeParse(JSON.parse(fs.readFileSync(file, 'utf8').replace(/^/, ''))).data?.volta?.node ?? null;
-    }
-    catch {
-        return null;
-    }
-};
-/**
- * Picks tool versions. Highest priority first: command line, the folder's .sandbox-config.json,
- * version files in the workspace (.nvmrc, .node-version, .python-version), the tool config, this PC's node version.
- */
-export const resolveVersions = (config, workspace, local, req, hostNodeVersion) => {
-    const localTools = (local.toolchains ?? {});
-    const pick = (cli, localValue, files, configured) => {
-        if (cli)
-            return { spec: cli, source: 'command line' };
-        if (localValue)
-            return { spec: localValue, source: '.sandbox-config.json' };
-        for (const name of files) {
-            const value = name === VOLTA_PIN ? voltaNode(workspace) : firstLine(path.join(workspace, name));
-            if (value)
-                return { spec: value, source: name };
-        }
-        return { spec: configured, source: 'config' };
-    };
-    let node = pick(req.nodeVersion, localTools.node?.version, ['.nvmrc', '.node-version', VOLTA_PIN], config.toolchains.node.version);
-    if (node.spec === 'host')
-        node = { spec: hostNodeVersion.replace(/^v/, ''), source: 'this PC' };
-    const python = pick(req.pythonVersion, localTools.python?.version, ['.python-version'], config.toolchains.python.version);
-    return { node, nodeExtra: config.toolchains.node.extraVersions, python };
-};
-/** Precedence (lowest to highest): built-in defaults, user config, .sandbox-config.json in the workspace, command-line flags. */
-export const resolveRun = async (req, hostNodeVersion = process.version) => {
-    const notes = [];
-    // Mappings from the user config are relative to that config file; expand them before anything else uses them.
-    const expand = (list) => list.map((p) => expandPath(p, req.loaded.base));
-    const projects = req.loaded.config.projects;
-    let config = {
-        ...req.loaded.config,
-        mappings: req.loaded.config.mappings.map((m) => ({ ...m, host: expandPath(m.host, req.loaded.base) })),
-        projects: { ...projects, roots: expand(projects.roots), exclude: expand(projects.exclude), declinedRoots: expand(projects.declinedRoots) },
-    };
-    const mirror = config.guestWorkspace === 'mirror';
-    const storageRoot = expandPath(config.storage.root, req.loaded.base);
-    const workspaceHost = path.resolve(req.workspace ?? req.cwd);
-    if (!dirExists(workspaceHost))
-        fail('The workspace folder does not exist: ' + workspaceHost, 'Check the --workspace path, or cd into the project first.');
-    assertSafeWorkspace(workspaceHost, req.packageRoot, storageRoot);
-    const scripts = [];
-    let localConfigPath = null;
-    let overrides = {};
-    const local = req.noLocalConfig ? null : readLocalConfig(workspaceHost);
-    if (local) {
-        overrides = normalizeOverrides(local.data, workspaceHost, local.path);
-        const store = trustStorePath(storageRoot);
-        if (!isTrusted(store, local.path, local.hash)) {
-            const summary = describeOverrides(overrides);
-            let trusted = req.trustConfig;
-            if (!trusted && req.ask) {
-                console.log('\nFound ' + local.path + ' which is not trusted yet. It would apply:');
-                for (const line of summary)
-                    console.log('  ' + plainText(line));
-                trusted = await req.ask('Trust and use this file?');
-            }
-            if (!trusted)
-                fail(local.path + ' has not been approved yet (a repo can ship this file, so it needs your OK). It would apply:\n  ' + (summary.map(plainText).join('\n  ') || '(no changes)'), 'Review it, then run again in an interactive terminal and answer y, or add --trust-config. To ignore the file: --no-local-config');
-            saveTrust(store, local.path, local.hash);
-            notes.push('Trusted ' + local.path + ' (you will only be asked again if the file changes).');
-        }
-        // A project may only tighten. What it asks for beyond that is used only if you allowed it for this project (asked
-        // once, interactively, never by --trust-config); otherwise it is named here instead of dropped silently.
-        const allowStore = allowStorePath(storageRoot);
-        const allowed = [];
-        for (const ask of loosenedRequests(config, overrides)) {
-            let ok = allowedAnswer(allowStore, local.path, ask.key, ask.wanted);
-            if (ok === null && req.ask && process.stdin.isTTY) {
-                ok = await req.ask('This project asks for ' + ask.key + ' = ' + JSON.stringify(ask.wanted) + ', which is looser than your settings (' + JSON.stringify(ask.yours) + '). Allow it for this project only?');
-                saveAllowed(allowStore, local.path, ask.key, ask.wanted, ok);
-            }
-            if (ok) {
-                allowed.push(ask);
-                notes.push('Allowed for this project: ' + ask.key + ' = ' + JSON.stringify(ask.wanted) + ' (your answer is kept in ' + allowStore + ').');
-            }
-            else
-                notes.push('The project asks for ' + ask.key + ' = ' + JSON.stringify(ask.wanted) + ', but your settings say ' + JSON.stringify(ask.yours) + ', so it is not used. ' + (ok === false ? 'You said no (kept in ' + allowStore + ').' : 'Start it from an interactive terminal to allow it for this project.') + ' Or set ' + ask.key + ' in your own settings (sandbox, then Settings > All projects).');
-        }
-        config = applyOverrides(allowRequests(config, allowed), overrides);
-        scripts.push(...(overrides.scripts ?? []));
-        localConfigPath = local.path;
-        notes.push('Using ' + local.path);
-    }
-    if (req.headless !== undefined)
-        config = { ...config, sandbox: { ...config.sandbox, headless: req.headless } };
-    for (const name of req.databases ?? []) {
-        const db = name.toLowerCase();
-        if (!DATABASES.includes(db))
-            fail('Unknown database "' + name + '".', 'Choose from: ' + DATABASES.join(', '));
-        config = { ...config, databases: { ...config.databases, [db]: { ...config.databases[db], enabled: true } } };
-    }
-    if (config.guestWorkspace === 'auto')
-        config = { ...config, guestWorkspace: autoGuestWorkspace(workspaceHost) };
-    else if (config.guestWorkspace === 'mirror') {
-        const plan = planMirrorWorkspace(workspaceHost, autoGuestWorkspace(workspaceHost));
-        if (plan.note)
-            notes.push(plan.note);
-        config = { ...config, guestWorkspace: plan.guest };
-    }
-    scripts.push(...req.scripts.map((s) => path.resolve(s)));
-    const harnessName = req.noAgent ? 'none' : (req.harness ?? config.defaultHarness);
-    if (harnessName !== 'none' && !config.harnesses[harnessName])
-        fail('Unknown agent "' + harnessName + '".', 'Configured agents: ' + Object.keys(config.harnesses).join(', ') + ' (add more under "harnesses" in your config).');
-    const versions = resolveVersions(config, workspaceHost, overrides, req, hostNodeVersion);
-    const dataPath = path.join(storageRoot, 'data', config.storage.dataName);
-    // A project file may ask for "mirror" too (it decides only its own path); project roots follow the user's choice.
-    return { config, storageRoot, dataPath, workspaceHost, harnessName, scripts, localConfigPath, notes, versions, mirror };
-};

package/dist/guest/boot-env.d.ts

@@ -1,4 +0,0 @@
-import { type BootEnvT } from './project-env.js';
-export { baseEnvFor, type BootEnvT } from './project-env.js';
-export declare const saveBootEnv: (value: BootEnvT) => void;
-export declare const readBootEnv: () => BootEnvT | null;

package/dist/guest/daemon.js

@@ -1,57 +0,0 @@
-// Session daemon (runs detached inside the sandbox for its whole life). It is the only thing that acts on host
-// requests, and it only knows four request kinds: start a session, run a command, restart sessions, ping.
-// It must never die quietly: every iteration is guarded, and anything unexpected is written to its log.
-// The handlers live in daemon/ (session, exec); this file is the polling loop.
-import fs from 'node:fs';
-import { readSession, scanRequests } from '../shared/rundir.js';
-import { saveClaudeMem } from './setup/claude.js';
-import { execCommand } from './daemon/exec.js';
-import { startRelays } from './daemon/relays.js';
-import { startProcessCollector } from './audit.js';
-import { prepareProject, restartSessions, startSession } from './daemon/session.js';
-import { live, respond, safely } from './daemon/state.js';
-import { dataDir, errMsg, log, run, warn } from './env.js';
-let lastMemSave = Date.now();
-process.on('uncaughtException', (e) => warn('daemon: unexpected error (continuing): ' + (e.stack ?? errMsg(e))));
-process.on('unhandledRejection', (e) => warn('daemon: unexpected error (continuing): ' + errMsg(e)));
-const handle = (req) => {
-    switch (req.kind) {
-        case 'session': return startSession(req);
-        case 'project': return prepareProject(req);
-        case 'exec': return execCommand(req);
-        case 'restart': return restartSessions(req);
-        case 'ping': return respond(req.id, { ok: true, message: 'pong (' + live.size + ' session(s) running)' });
-    }
-};
-const tick = () => {
-    const { valid, invalid } = scanRequests(dataDir);
-    // Anything in requests/ that is not a valid request (wrong kind, bad id, junk) is deleted unread.
-    for (const file of invalid)
-        safely('removing an invalid request', () => fs.rmSync(file, { recursive: true, force: true }));
-    for (const req of valid) {
-        safely('claiming a request', () => fs.rmSync(run.request(req.id), { force: true }));
-        if (readSession(dataDir, req.id))
-            continue;
-        // Not awaited: starting a session or running a command must not hold up other requests.
-        void Promise.resolve(handle(req)).catch((e) => respond(req.id, { ok: false, message: errMsg(e) }));
-    }
-    if (Date.now() - lastMemSave > 120000) {
-        lastMemSave = Date.now();
-        safely('claude-mem save', saveClaudeMem);
-    }
-};
-const loop = () => {
-    try {
-        tick();
-    }
-    catch (e) {
-        warn('daemon loop: ' + errMsg(e));
-    }
-    finally {
-        setTimeout(loop, 400);
-    }
-};
-log('Session daemon started (pid ' + process.pid + ').');
-safely('port forwards', startRelays);
-safely('audit', startProcessCollector);
-loop();

package/dist/guest/env.d.ts

@@ -1,52 +0,0 @@
-import { type SpawnOptions, type SpawnSyncOptions } from 'node:child_process';
-import type { GuestSession, SandboxStatus } from '../core/types.js';
-export declare const isWin: boolean;
-export declare const dryRun: boolean;
-/** Real provisioning, but nothing machine-wide (environment variables): for end-to-end tests outside a sandbox. */
-export declare const testMode: boolean;
-export declare const launchDir: string;
-export declare const dataDir: string;
-export declare const hostToolsDir: string;
-/** Folders that must stay on the sandbox's own disk (symlinks, SQLite) rather than in a mapped folder. */
-export declare const localDir: string;
-export declare const toolsDir: string;
-export declare const logsDir: string;
-export declare const run: {
-    run: string;
-    sandbox: string;
-    requests: string;
-    responses: string;
-    sessions: string;
-    projects: string;
-    audit: string;
-    request: (id: string) => string;
-    response: (id: string) => string;
-    session: (id: string) => string;
-    project: (id: string) => string;
-};
-export declare const session: GuestSession;
-export declare const workspace: string;
-export declare const stateDir: string;
-export declare const claudeDir: string;
-export declare const log: (message: string) => void;
-export declare const warn: (message: string) => void;
-export declare const errMsg: (e: unknown) => string;
-export declare const exists: (p: string) => boolean;
-export declare const mkdirp: (p: string) => string;
-export declare const logPath: string;
-/** Best-effort: progress reporting must never be what breaks the boot. */
-export declare const setSandboxStatus: (phase: SandboxStatus["phase"], message: string) => void;
-/** Runs a program, streaming output, and throws with a readable message when it fails. */
-export declare const exec: (file: string, args: string[], options?: SpawnSyncOptions) => void;
-/** exec without blocking: other toolchains keep downloading while this one runs an installer. */
-export declare const execAsync: (file: string, args: string[], options?: SpawnOptions) => Promise<void>;
-export declare const execOutput: (file: string, args: string[], options?: SpawnSyncOptions) => string;
-export declare const powershell: (script: string) => void;
-/** Copies a folder with robocopy (fast, restartable), or just the named files in it; exit codes below 8 mean success. */
-export declare const robocopy: (from: string, to: string, files?: string[]) => void;
-/**
- * A Node install without its global packages (nvm keeps those per version: often tens of thousands of small files,
- * which is what made copying from this PC slow). Same file list as Copy-NodeFromHost in sandbox/bootstrap.ps1.
- * Copied into a staging folder and renamed into place: node.exe alone (an interrupted copy) must not look like a full install.
- */
-export declare const copyNode: (from: string, to: string) => void;