windows-development-sandbox 1.4.1 → 1.4.3

package/dist/guest/databases/postgres.js

@@ -0,0 +1,85 @@
+// PostgreSQL from EnterpriseDB's Windows binaries (without pgAdmin).
+import fs from 'node:fs';
+import path from 'node:path';
+import { downloader, fetchJson } from '../../shared/download/index.js';
+import { execAsync } from '../runtime/process.js';
+import { exists } from '../runtime/fs.js';
+import { log } from '../runtime/log.js';
+import { logsDir } from '../runtime/paths.js';
+import { resolveCached } from '../toolchains/version-cache.js';
+import { tool } from '../toolchains/tool-env.js';
+import { portOpen } from '../runtime/ports.js';
+import { clearStaleLocks, createOnce, dataFor } from './server.js';
+import { DatabaseServer } from './database-server.js';
+/** The data folder of a PostgreSQL major version (one cluster per major). */
+function postgresData(version) {
+    return dataFor('postgres-' + version.split('.')[0]);
+}
+export class PostgresServer extends DatabaseServer {
+    id = 'postgres';
+    async start(env, plan) {
+        const exact = await resolveCached('postgres:' + plan.version, async () => {
+            const versions = (await fetchJson('https://www.postgresql.org/versions.json')).filter((v) => v.supported);
+            const hit = plan.version === 'latest'
+                ? (versions.find((v) => v.current) ?? versions[versions.length - 1])
+                : versions.find((v) => v.major === plan.version.split('.')[0]);
+            return hit
+                ? hit.major + '.' + hit.latestMinor
+                : Promise.reject(new Error('No supported PostgreSQL ' + plan.version));
+        });
+        const home = tool('postgres', exact);
+        const bin = path.join(home, 'bin');
+        if (!exists(path.join(bin, 'pg_ctl.exe'))) {
+            log('Downloading PostgreSQL ' + exact + ' (~330 MB once) ...');
+            // EDB publishes no checksums; the download is HTTPS from EnterpriseDB, PostgreSQL's official Windows packager.
+            await downloader.archive('https://get.enterprisedb.com/postgresql/postgresql-' + exact + '-1-windows-x64-binaries.zip', home, {
+                locate: 'pg_ctl.exe',
+                up: 1,
+                fileName: 'postgresql-' + exact + '.zip',
+                members: ['pgsql/bin', 'pgsql/lib', 'pgsql/share', 'pgsql/include'],
+            });
+        }
+        const data = postgresData(exact);
+        await createOnce(data, 'PG_VERSION', async () => {
+            log('Creating the PostgreSQL database (first start) ...');
+            await execAsync(path.join(bin, 'initdb.exe'), ['-D', data, '-U', 'postgres', '-A', 'trust', '-E', 'UTF8', '--locale=C'], { stdio: 'ignore' });
+        });
+        if (await portOpen(plan.port))
+            throw new Error('port ' + plan.port + ' is already in use (change databases.postgres.port)');
+        await clearStaleLocks(data, ['postmaster.pid'], plan.port);
+        // postgres.exe refuses to run as an administrator (the sandbox user is one); pg_ctl drops the rights first.
+        await execAsync(path.join(bin, 'pg_ctl.exe'), [
+            'start',
+            '-D',
+            data,
+            '-w',
+            '-t',
+            '60',
+            '-l',
+            path.join(logsDir, 'postgres.log'),
+            '-o',
+            '-p ' + plan.port + ' -c listen_addresses=localhost',
+        ], { stdio: 'ignore' });
+        Object.assign(env.vars, { PGHOST: 'localhost', PGPORT: String(plan.port), PGUSER: 'postgres' });
+        env.prepend.push(bin);
+        env.summary.push('postgres ' +
+            exact +
+            ': localhost:' +
+            plan.port +
+            ', user postgres, no password (postgres://postgres@localhost:' +
+            plan.port +
+            '/postgres)');
+    }
+    /** Every installed version's cluster shuts down cleanly through pg_ctl first. */
+    async stop(plan) {
+        if (exists(tool('postgres'))) {
+            for (const version of fs.readdirSync(tool('postgres'))) {
+                const data = postgresData(version);
+                const pgCtl = path.join(tool('postgres', version), 'bin', 'pg_ctl.exe');
+                if (exists(path.join(data, 'postmaster.pid')) && exists(pgCtl))
+                    await execAsync(pgCtl, ['stop', '-D', data, '-m', 'fast', '-w'], { stdio: 'ignore' });
+            }
+        }
+        await super.stop(plan);
+    }
+}

package/dist/guest/databases/redis.d.ts

@@ -0,0 +1,7 @@
+import type { DatabasePlan } from '../../core/types.js';
+import { type ToolEnv } from '../toolchains/tool-env.js';
+import { DatabaseServer } from './database-server.js';
+export declare class RedisServer extends DatabaseServer {
+    readonly id = "redis";
+    start(env: ToolEnv, plan: DatabasePlan): Promise<void>;
+}

package/dist/guest/databases/redis.js

@@ -0,0 +1,25 @@
+// Redis (the maintained community Windows build of upstream Redis).
+import path from 'node:path';
+import { exists, mkdirp } from '../runtime/fs.js';
+import { installFromGithub } from '../toolchains/install.js';
+import { tool } from '../toolchains/tool-env.js';
+import { dataFor, startServer } from './server.js';
+import { DatabaseServer } from './database-server.js';
+export class RedisServer extends DatabaseServer {
+    id = 'redis';
+    async start(env, plan) {
+        const home = tool('redis');
+        if (!exists(path.join(home, 'redis-server.exe'))) {
+            // Redis has no official Windows build; this one is built from upstream Redis with MSYS2.
+            await installFromGithub('redis-windows/redis-windows', /^Redis-[\d.]+-Windows-x64-msys2\.zip$/, {
+                dest: home,
+                what: (a) => 'Redis (' + a.name + ', ~10 MB once)',
+                locate: 'redis-server.exe',
+            });
+        }
+        const data = mkdirp(dataFor('redis'));
+        await startServer('redis', path.join(home, 'redis-server.exe'), ['--port', String(plan.port), '--bind', '127.0.0.1', '--dir', data.replace(/\\/g, '/'), '--appendonly', 'yes'], plan.port);
+        env.prepend.push(home);
+        env.summary.push('redis: redis://127.0.0.1:' + plan.port + ' (redis-cli on PATH)');
+    }
+}

package/dist/guest/databases/registry.d.ts

@@ -0,0 +1,5 @@
+import type { DatabasePlan } from '../../core/types.js';
+import type { ToolEnv } from '../toolchains/tool-env.js';
+/** Stops a database (and DynamoDB's admin UI); false when it was not running. */
+export declare function stopDatabase(plan: DatabasePlan): Promise<boolean>;
+export declare function setupDatabase(env: ToolEnv, plan: DatabasePlan): Promise<void>;

package/dist/guest/databases/registry.js

@@ -0,0 +1,51 @@
+import { dryRun } from '../runtime/paths.js';
+import { log } from '../runtime/log.js';
+import { portOpen } from '../runtime/ports.js';
+import { duringSession } from '../runtime/project-context.js';
+import { killListeners } from './database-server.js';
+import { DynamoServer } from './dynamodb.js';
+import { MongoServer } from './mongodb.js';
+import { MysqlServer } from './mysql.js';
+import { DATABASE_NAMES } from './names.js';
+import { PostgresServer } from './postgres.js';
+import { RedisServer } from './redis.js';
+const SERVERS = {
+    postgres: new PostgresServer(),
+    mysql: new MysqlServer(),
+    mongodb: new MongoServer(),
+    redis: new RedisServer(),
+    dynamodb: new DynamoServer(),
+};
+/** Stops a database (and DynamoDB's admin UI); false when it was not running. */
+export async function stopDatabase(plan) {
+    if (!(await portOpen(plan.port)))
+        return false;
+    // SQL Server never runs here: whatever listens on its port is just ended.
+    if (plan.database === 'sqlserver')
+        killListeners(plan);
+    else
+        await SERVERS[plan.database].stop(plan);
+    return true;
+}
+export async function setupDatabase(env, plan) {
+    if (plan.database === 'sqlserver') {
+        env.summary.push('sqlserver: NOT available (SQL Server cannot start inside Windows Sandbox). Switch the project to Postgres or SQLite for local work');
+        return;
+    }
+    if (dryRun) {
+        log('(dry run) would run ' +
+            DATABASE_NAMES[plan.database] +
+            ' on port ' +
+            plan.port +
+            ' (' +
+            plan.reasons.join('; ') +
+            ')');
+        return;
+    }
+    // A project that joined later, while another project's server already listens there: they share it.
+    if (duringSession() && (await portOpen(plan.port))) {
+        env.summary.push(plan.database + ': shared, already running on port ' + plan.port);
+        return;
+    }
+    await SERVERS[plan.database].start(env, plan);
+}

package/dist/guest/databases/sbx-db.d.ts

@@ -0,0 +1 @@
+export declare function runSbxDb(args: string[]): Promise<number>;

package/dist/guest/{db.js → databases/sbx-db.js}

@@ -1,20 +1,21 @@
-// `sbx-db`: list, start and stop the sandbox's databases from a terminal inside it (`sandbox db` on the PC runs it too).
-// Usage: sbx-db [list] | sbx-db start <name> | sbx-db stop <name>
 import fs from 'node:fs';
-import { ProjectSpec } from '../shared/schema.js';
-import { portOpen } from './ports.js';
-import { DATABASE_NAMES, setupDatabase, stopDatabase } from './toolchains/databases/index.js';
-import { emptyEnv } from './toolchains/common.js';
-import { addMachineEnvironment } from './setup/environment.js';
-import { errMsg, session } from './env.js';
+import { ProjectSpecSchema } from '../../shared/channel/schema.js';
+import { portOpen } from '../runtime/ports.js';
+import { DATABASE_NAMES } from './names.js';
+import { setupDatabase, stopDatabase } from './registry.js';
+import { emptyEnv } from '../toolchains/tool-env.js';
+import { addMachineEnvironment } from '../setup/environment.js';
+import { session } from '../runtime/session.js';
 const USAGE = 'Usage: sbx-db [list] | sbx-db start <name> | sbx-db stop <name>';
-/** In a project registered after boot (its terminals and exec have AGENT_PROJECT_FILE): that project's database plan. */
+/**
+ * In a project registered after boot (its terminals and exec have AGENT_PROJECT_FILE): that project's database plan.
+ */
 const projectPlans = () => {
     const file = process.env.AGENT_PROJECT_FILE;
     if (!file)
         return null;
     try {
-        return ProjectSpec.safeParse(JSON.parse(fs.readFileSync(file, 'utf8'))).data?.databases ?? null;
+        return ProjectSpecSchema.safeParse(JSON.parse(fs.readFileSync(file, 'utf8'))).data?.databases ?? null;
     }
     catch {
         return null;
@@ -61,7 +62,7 @@ const stop = async (name) => {
     console.log((await stopDatabase(plan)) ? 'Stopped ' + plan.database + '.' : plan.database + ' was not running.');
     return 0;
 };
-const main = (args) => {
+export function runSbxDb(args) {
     const [action = 'list', name] = args;
     if (action === 'list')
         return list();
@@ -71,5 +72,4 @@ const main = (args) => {
         return stop(name);
     console.error(USAGE);
     return Promise.resolve(2);
-};
-main(process.argv.slice(2)).then((code) => { process.exitCode = code; }, (e) => { console.error(errMsg(e)); process.exitCode = 1; });
+}

package/dist/guest/{toolchains/databases → databases}/server.d.ts

@@ -1,14 +1,14 @@
 /** C:\AgentData\databases\<name>: the data survives the sandbox. */
-export declare const dataFor: (name: string) => string;
-/** Starts a server detached (it outlives the boot script) with its output in logs\<name>.log, and waits for its port. */
-export declare const startServer: (name: string, exe: string, args: string[], port: number) => Promise<void>;
+export declare function dataFor(name: string): string;
+/** Starts a server detached (it outlives the boot script), output in logs\<name>.log, and waits for its port. */
+export declare function startServer(name: string, exe: string, args: string[], port: number): Promise<void>;
 /**
  * Lock files a sandbox that was closed without shutting the server down leaves behind. Only when nothing listens on
  * the port: a server already running in this VM keeps its lock.
  */
-export declare const clearStaleLocks: (dir: string, files: string[], port: number) => Promise<void>;
+export declare function clearStaleLocks(dir: string, files: string[], port: number): Promise<void>;
 /**
  * Creates a database folder with `create` (initdb, install-db) unless `marker` is there. A failed or interrupted run
  * removes the folder again when this call made it, so the half-made one is not taken for a finished database next boot.
  */
-export declare const createOnce: (data: string, marker: string, create: () => Promise<void>) => Promise<void>;
+export declare function createOnce(data: string, marker: string, create: () => Promise<void>): Promise<void>;

package/dist/guest/{toolchains/databases → databases}/server.js

@@ -1,14 +1,17 @@
-// What every database module shares: where data lives, starting a server detached, and safe first-time creation.
+// What the database servers share: where data lives, starting a server detached, and safe first-time creation.
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
-import { safeRemove } from '../../../shared/safe-remove.js';
-import { dataDir, exists, logsDir, mkdirp } from '../../env.js';
-import { portOpen, waitForPort } from '../../ports.js';
+import { safeRemove } from '../../shared/io/safe-remove.js';
+import { dataDir, logsDir } from '../runtime/paths.js';
+import { exists, mkdirp } from '../runtime/fs.js';
+import { portOpen, waitForPort } from '../runtime/ports.js';
 /** C:\AgentData\databases\<name>: the data survives the sandbox. */
-export const dataFor = (name) => path.join(dataDir, 'databases', name);
-/** Starts a server detached (it outlives the boot script) with its output in logs\<name>.log, and waits for its port. */
-export const startServer = async (name, exe, args, port) => {
+export function dataFor(name) {
+    return path.join(dataDir, 'databases', name);
+}
+/** Starts a server detached (it outlives the boot script), output in logs\<name>.log, and waits for its port. */
+export async function startServer(name, exe, args, port) {
     if (await portOpen(port))
         throw new Error('port ' + port + ' is already in use (change databases.' + name + '.port)');
     const logFile = path.join(logsDir, name + '.log');
@@ -17,22 +20,22 @@ export const startServer = async (name, exe, args, port) => {
     fs.closeSync(out);
     if (!(await waitForPort(port, 60)))
         throw new Error(name + ' did not start listening on port ' + port + '; see ' + logFile);
-};
+}
 /**
  * Lock files a sandbox that was closed without shutting the server down leaves behind. Only when nothing listens on
  * the port: a server already running in this VM keeps its lock.
  */
-export const clearStaleLocks = async (dir, files, port) => {
+export async function clearStaleLocks(dir, files, port) {
     if (await portOpen(port))
         return;
     for (const f of files)
         fs.rmSync(path.join(dir, f), { force: true });
-};
+}
 /**
  * Creates a database folder with `create` (initdb, install-db) unless `marker` is there. A failed or interrupted run
  * removes the folder again when this call made it, so the half-made one is not taken for a finished database next boot.
  */
-export const createOnce = async (data, marker, create) => {
+export async function createOnce(data, marker, create) {
     if (exists(path.join(data, marker)))
         return;
     const existed = exists(data);
@@ -45,8 +48,10 @@ export const createOnce = async (data, marker, create) => {
             try {
                 safeRemove(data, dataDir);
             }
-            catch { /* the original error is the one to report */ }
+            catch {
+                /* the original error is the one to report */
+            }
         }
         throw e;
     }
-};
+}

package/dist/guest/entries/daemon.js

@@ -0,0 +1,16 @@
+// Session daemon (runs detached inside the sandbox for its whole life). It is the only thing that acts on host
+// requests, and it only knows four request kinds: start a session, run a command, restart sessions, ping.
+// It must never die quietly: every iteration is guarded, and anything unexpected is written to its log.
+// The handlers live in daemon/ (session, exec); this file is the polling loop.
+import { startRelays } from '../daemon/relays.js';
+import { startProcessCollector } from '../audit/process-audit.js';
+import { safely } from '../daemon/state.js';
+import { log, warn } from '../runtime/log.js';
+import { errMsg } from '../../core/util/errors.js';
+import { loop } from '../daemon/daemon.js';
+process.on('uncaughtException', (e) => warn('daemon: unexpected error (continuing): ' + (e.stack ?? errMsg(e))));
+process.on('unhandledRejection', (e) => warn('daemon: unexpected error (continuing): ' + errMsg(e)));
+log('Session daemon started (pid ' + process.pid + ').');
+safely('port forwards', startRelays);
+safely('audit', startProcessCollector);
+loop();

package/dist/guest/entries/db.js

@@ -0,0 +1,10 @@
+// `sbx-db`: list, start and stop the sandbox's databases from a terminal inside it (`sandbox db` on the PC runs it too).
+// Usage: sbx-db [list] | sbx-db start <name> | sbx-db stop <name>
+import { errMsg } from '../../core/util/errors.js';
+import { runSbxDb } from '../databases/sbx-db.js';
+runSbxDb(process.argv.slice(2)).then((code) => {
+    process.exitCode = code;
+}, (e) => {
+    console.error(errMsg(e));
+    process.exitCode = 1;
+});

package/dist/guest/entries/gitguard.js

@@ -0,0 +1,20 @@
+// `git` wrapper used when provisioning.git.access is 'readonly' or 'none'. Installed first on PATH (git.cmd) and as a
+// bash function (BASH_ENV), it decides per call and then runs the real git. Standalone on purpose: it runs on every
+// git call, so it reads only two environment variables (AGENT_GIT_ACCESS, AGENT_REAL_GIT).
+import { spawnSync } from 'node:child_process';
+import { gitDecision } from '../git/decision.js';
+if (process.argv[1]?.toLowerCase().endsWith('gitguard.js')) {
+    const args = process.argv.slice(2);
+    const decision = gitDecision(args, process.env.AGENT_GIT_ACCESS ?? 'none');
+    if (!decision.allow) {
+        console.error('fatal: ' + decision.reason);
+        process.exit(128);
+    }
+    const real = process.env.AGENT_REAL_GIT;
+    if (!real) {
+        console.error('fatal: git is not available in this sandbox.');
+        process.exit(128);
+    }
+    const result = spawnSync(real, args, { stdio: 'inherit', windowsHide: true });
+    process.exit(result.status ?? 1);
+}

package/dist/guest/entries/main.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/guest/entries/main.js

@@ -0,0 +1,24 @@
+// Guest entry point, started by bootstrap.ps1 in the sandbox window. Provisions everything, starts the session
+// daemon, asks it for the first agent session and then shows that session in this window.
+import fs from 'node:fs';
+import path from 'node:path';
+import { logsDir } from '../runtime/paths.js';
+import { setSandboxStatus } from '../runtime/status.js';
+import { errMsg } from '../../core/util/errors.js';
+import { runBoot } from '../boot/boot.js';
+runBoot().catch((e) => {
+    const message = errMsg(e) + (e instanceof Error && e.stack ? '\n' + e.stack : '');
+    try {
+        setSandboxStatus('failed', errMsg(e));
+        fs.writeFileSync(path.join(logsDir, 'guest-error.txt'), message);
+    }
+    catch {
+        /* ignore */
+    }
+    // The window gets the plain message; the stack trace is in guest-error.txt.
+    console.error('\n\x1b[31mThe sandbox could not start: ' +
+        errMsg(e) +
+        '\x1b[0m\nDetails: ' +
+        path.join(logsDir, 'guest-error.txt'));
+    process.exitCode = 1;
+});

package/dist/guest/entries/netproxy.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/guest/entries/netproxy.js

@@ -0,0 +1,7 @@
+// The sandbox's own proxy for network.allowOnly (runs detached for the sandbox's life, as sbx-netproxy.exe so the
+// firewall can let only it out). HTTPS goes through CONNECT, plain HTTP as proxy requests; a host that is not allowed
+// gets 403 and a line in logs\netproxy.log. With network.proxy set it hands everything on to that proxy.
+// Usage: sbx-netproxy.exe netproxy.js
+import { PROXY_PORT } from '../../shared/network/policy.js';
+import { server } from '../network/proxy-server.js';
+server.listen(PROXY_PORT, '127.0.0.1');

package/dist/guest/entries/view.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/guest/entries/view.js

@@ -0,0 +1,11 @@
+// A terminal tab inside the sandbox that shows one agent session (same pseudo console the host can attach to).
+// Usage: node view.js <sessionId>
+import { viewSession } from '../sessions/viewer.js';
+if (process.argv[1]?.endsWith('view.js') && process.argv[2]) {
+    viewSession(process.argv[2]).then((code) => {
+        process.exitCode = code;
+    }, (e) => {
+        console.error(e instanceof Error ? e.message : String(e));
+        process.exitCode = 1;
+    });
+}

package/dist/guest/{gitguard.js → git/decision.js}

@@ -1,24 +1,54 @@
-// `git` wrapper used when provisioning.git.access is 'readonly' or 'none'. Installed first on PATH (git.cmd) and as a
-// bash function (BASH_ENV), it decides per call and then runs the real git. Standalone on purpose: it runs on every
-// git call, so it reads only two environment variables (AGENT_GIT_ACCESS, AGENT_REAL_GIT).
-import { spawnSync } from 'node:child_process';
 /** Subcommands that only read. */
 const READ_ONLY = new Set([
-    'status', 'log', 'diff', 'show', 'blame', 'annotate', 'ls-files', 'ls-tree', 'ls-remote', 'rev-parse', 'rev-list', 'describe', 'shortlog',
-    'grep', 'cat-file', 'reflog', 'whatchanged', 'name-rev', 'for-each-ref', 'show-ref', 'merge-base', 'count-objects', 'check-ignore',
-    'check-attr', 'var', 'version', 'help', 'diff-tree', 'diff-files', 'diff-index', 'cherry', 'range-diff', 'show-branch', 'verify-commit', 'verify-tag',
+    'status',
+    'log',
+    'diff',
+    'show',
+    'blame',
+    'annotate',
+    'ls-files',
+    'ls-tree',
+    'ls-remote',
+    'rev-parse',
+    'rev-list',
+    'describe',
+    'shortlog',
+    'grep',
+    'cat-file',
+    'reflog',
+    'whatchanged',
+    'name-rev',
+    'for-each-ref',
+    'show-ref',
+    'merge-base',
+    'count-objects',
+    'check-ignore',
+    'check-attr',
+    'var',
+    'version',
+    'help',
+    'diff-tree',
+    'diff-files',
+    'diff-index',
+    'cherry',
+    'range-diff',
+    'show-branch',
+    'verify-commit',
+    'verify-tag',
 ]);
 /**
  * `git branch` / `git tag` list when every argument is a listing flag, or when a listing flag is present and the
  * rest are patterns/commits (`git branch --contains HEAD`). A bare name (`git branch new`) creates, so it is refused.
  */
-const listingOnly = (flags, listFlags) => (rest) => rest.every((a) => flags.test(a)) || (rest.some((a) => listFlags.test(a)) && rest.every((a) => flags.test(a) || !a.startsWith('-')));
+const listingOnly = (flags, listFlags) => (rest) => rest.every((a) => flags.test(a)) ||
+    (rest.some((a) => listFlags.test(a)) && rest.every((a) => flags.test(a) || !a.startsWith('-')));
 /** Subcommands that are read-only only in their listing forms. */
 const LISTING = {
     branch: listingOnly(/^(-a|-r|-v|-vv|--all|--remotes|--list|-l|--show-current|--verbose|--no-color|--color(=.*)?|--contains|--no-contains|--merged|--no-merged|--sort=.*|--format=.*)$/, /^(--list|-l|--contains|--no-contains|--merged|--no-merged)$/),
     tag: listingOnly(/^(-l|--list|-n\d*|--contains|--no-contains|--merged|--no-merged|--points-at|--sort=.*|--format=.*)$/, /^(-l|--list|--contains|--no-contains|--merged|--no-merged|--points-at)$/),
     remote: (rest) => rest.length === 0 || ['-v', '--verbose', 'show', 'get-url'].includes(rest[0]),
-    config: (rest) => rest.some((a) => /^(--get|--get-all|--get-regexp|--list|-l|--show-origin|--show-scope|--name-only)$/.test(a)) && !rest.some((a) => /^(--add|--unset|--unset-all|--replace-all|--rename-section|--remove-section|-e|--edit)$/.test(a)),
+    config: (rest) => rest.some((a) => /^(--get|--get-all|--get-regexp|--list|-l|--show-origin|--show-scope|--name-only)$/.test(a)) &&
+        !rest.some((a) => /^(--add|--unset|--unset-all|--replace-all|--rename-section|--remove-section|-e|--edit)$/.test(a)),
     stash: (rest) => ['list', 'show'].includes(rest[0] ?? ''),
     worktree: (rest) => rest[0] === 'list',
     submodule: (rest) => rest.length === 0 || rest[0] === 'status' || rest[0] === 'summary',
@@ -31,7 +61,10 @@ export const gitDecision = (args, access) => {
     if (access === 'full')
         return { allow: true };
     if (access !== 'readonly')
-        return { allow: false, reason: 'git is disabled in this sandbox (provisioning.git.access = ' + (access || 'none') + ').' };
+        return {
+            allow: false,
+            reason: 'git is disabled in this sandbox (provisioning.git.access = ' + (access || 'none') + ').',
+        };
     let i = 0;
     while (i < args.length && args[i].startsWith('-')) {
         if (FORBIDDEN_GLOBAL.test(args[i]))
@@ -41,20 +74,10 @@ export const gitDecision = (args, access) => {
     const [command, ...rest] = args.slice(i);
     if (command === undefined || command === '--version' || READ_ONLY.has(command) || (LISTING[command]?.(rest) ?? false))
         return { allow: true };
-    return { allow: false, reason: 'git ' + command + ' is blocked: git is read-only in this sandbox (provisioning.git.access = readonly). Reading (status, log, diff, show, blame) is allowed.' };
+    return {
+        allow: false,
+        reason: 'git ' +
+            command +
+            ' is blocked: git is read-only in this sandbox (provisioning.git.access = readonly). Reading (status, log, diff, show, blame) is allowed.',
+    };
 };
-if (process.argv[1]?.toLowerCase().endsWith('gitguard.js')) {
-    const args = process.argv.slice(2);
-    const decision = gitDecision(args, process.env.AGENT_GIT_ACCESS ?? 'none');
-    if (!decision.allow) {
-        console.error('fatal: ' + decision.reason);
-        process.exit(128);
-    }
-    const real = process.env.AGENT_REAL_GIT;
-    if (!real) {
-        console.error('fatal: git is not available in this sandbox.');
-        process.exit(128);
-    }
-    const result = spawnSync(real, args, { stdio: 'inherit', windowsHide: true });
-    process.exit(result.status ?? 1);
-}

package/dist/guest/network/addresses.d.ts

@@ -0,0 +1,2 @@
+/** Guest IPv4 addresses the host can use to reach session ports. */
+export declare const guestAddresses: () => string[];

package/dist/guest/network/addresses.js

@@ -0,0 +1,6 @@
+import os from 'node:os';
+/** Guest IPv4 addresses the host can use to reach session ports. */
+export const guestAddresses = () => Object.values(os.networkInterfaces())
+    .flat()
+    .filter((i) => Boolean(i) && i.family === 'IPv4' && !i.internal)
+    .map((i) => i.address);

package/dist/guest/{setup/network.d.ts → network/allow-only.d.ts}

@@ -1,11 +1,3 @@
-/** What the agent's manifest says about the LAN. */
-export type LanState = 'blocked' | 'open' | 'offline';
-/**
- * Applies the LAN block. Internet is checked first; if it works before the rules but not after, the rules (not the
- * internet) are the problem, so they are removed and the agent is told the LAN is open. If there is no internet at
- * all, the block stays in place: being offline is never a reason to open the LAN.
- */
-export declare const applyNetworkPolicy: (ptyHostExe: string | null) => Promise<LanState>;
 /** HTTP_PROXY & co. for everything in the sandbox: its own proxy (allowOnly) or yours (network.proxy). */
 export declare const proxyEnv: () => Record<string, string>;
 /**
@@ -15,5 +7,3 @@ export declare const proxyEnv: () => Record<string, string>;
  * could undo it, which is why sandbox.networking false is the only hard isolation.
  */
 export declare const applyAllowOnly: () => Promise<boolean>;
-/** Guest IPv4 addresses the host can use to reach session ports. */
-export declare const guestAddresses: () => string[];