windows-development-sandbox 1.4.1 → 1.4.3

package/dist/guest/runtime/status.js

@@ -0,0 +1,57 @@
+// C:\AgentData\run\sandbox.json: the boot's phase and progress, which the host shows while it waits.
+import os from 'node:os';
+import { now } from '../../shared/channel/run-dir.js';
+import { writeJsonAtomic } from '../../shared/io/json.js';
+import { errMsg } from '../../core/util/errors.js';
+import { warn } from './log.js';
+import { run } from './paths.js';
+import { session, workspace } from './session.js';
+/** The boot's structured progress (the host shows it as one line); kept between status writes. */
+let progress;
+/**
+ * Best-effort: progress reporting must never be what breaks the boot. `update` changes the structured progress
+ * (a new step, what is being set up); it stays as it was otherwise.
+ */
+export function setSandboxStatus(phase, message, update) {
+    try {
+        if (update)
+            progress = fitProgress({ step: 1, steps: 1, title: '', active: [], done: 0, total: 0, ...progress, ...update });
+        writeStatus(phase, message);
+    }
+    catch (e) {
+        warn('Could not update sandbox status: ' + errMsg(e));
+    }
+}
+/** Within the limits the host accepts (it drops a progress that is not). */
+function fitProgress(p) {
+    return {
+        ...p,
+        title: p.title.slice(0, 120),
+        done: Math.min(p.done, 1000),
+        total: Math.min(p.total, 1000),
+        active: p.active.slice(0, 8).map((a) => ({
+            name: a.name.slice(0, 64),
+            ...(a.percent === undefined ? {} : { percent: Math.max(0, Math.min(100, Math.round(a.percent))) }),
+        })),
+    };
+}
+function ownAddresses() {
+    return Object.values(os.networkInterfaces())
+        .flat()
+        .filter((i) => Boolean(i) && i.family === 'IPv4' && !i.internal)
+        .map((i) => i.address)
+        .slice(0, 8);
+}
+function writeStatus(phase, message) {
+    writeJsonAtomic(run.sandboxFile, {
+        launchId: session.launchId,
+        phase,
+        message,
+        updatedAt: now(),
+        workspaceHost: session.workspaceHost,
+        guestWorkspace: workspace,
+        headless: session.headless,
+        addresses: ownAddresses(),
+        ...(progress ? { progress } : {}),
+    });
+}

package/dist/guest/{cmdline.js → sessions/cmdline.js}

@@ -11,13 +11,19 @@ export const quoteArg = (arg) => (arg !== '' && !/[\s"]/.test(arg) ? arg : quote
  * of these are quoted as usual.
  */
 export const cmdArgs = (args) => {
-    const pieces = args.map((arg) => (/[&|<>^%]/.test(arg) ? arg.split('%').map(quoted).join('%') : quoteArg(arg))).join(' ');
+    const pieces = args
+        .map((arg) => (/[&|<>^%]/.test(arg) ? arg.split('%').map(quoted).join('%') : quoteArg(arg)))
+        .join(' ');
     let inQuotes = false;
-    return [...pieces].map((c) => {
+    return [...pieces]
+        .map((c) => {
         if (c === '"')
             inQuotes = !inQuotes;
         return !inQuotes && /[&|<>^]/.test(c) ? '^^^' + c : c;
-    }).join('');
+    })
+        .join('');
 };
 /** The command line ptyhost starts; when the program is cmd.exe its arguments are quoted for cmd (cmdArgs). */
-export const commandLine = (file, args) => path.win32.basename(file).toLowerCase() === 'cmd.exe' ? [quoteArg(file), cmdArgs(args)].filter(Boolean).join(' ') : [file, ...args].map(quoteArg).join(' ');
+export const commandLine = (file, args) => path.win32.basename(file).toLowerCase() === 'cmd.exe'
+    ? [quoteArg(file), cmdArgs(args)].filter(Boolean).join(' ')
+    : [file, ...args].map(quoteArg).join(' ');

package/dist/guest/{ptyhost.js → sessions/pty-host.js}

@@ -2,14 +2,17 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
-import { ensureCompiled } from './helpers.js';
-import { portOpen } from './ports.js';
-import { logsDir, session, toolsDir } from './env.js';
+import { ensureCompiled } from '../runtime/csc.js';
+import { portOpen } from '../runtime/ports.js';
+import { logsDir, toolsDir } from '../runtime/paths.js';
+import { session } from '../runtime/session.js';
 export const ensurePtyHost = () => ensureCompiled('ptyhost');
 /** Resolves when ptyhost listens; rejects early if it exits first (e.g. the agent could not be started). */
 export const waitForPtyHost = async (child, port, timeoutMs) => {
     let exitCode;
-    child.once('exit', (code) => { exitCode = code; });
+    child.once('exit', (code) => {
+        exitCode = code;
+    });
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
         if (exitCode !== undefined)
@@ -33,7 +36,11 @@ export const ptyHostLogTail = (id, lines = 12) => {
 /** conpty.dll (+ OpenConsole.exe) the host downloaded, when provisioning.conpty is on; ptyhost falls back to Windows' own. */
 const conptyDll = () => {
     const dll = path.join(toolsDir, 'conpty', 'conpty.dll');
-    return session.provisioning.conpty?.enabled !== false && fs.existsSync(dll) && fs.existsSync(path.join(toolsDir, 'conpty', 'OpenConsole.exe')) ? dll : null;
+    return session.provisioning.conpty?.enabled !== false &&
+        fs.existsSync(dll) &&
+        fs.existsSync(path.join(toolsDir, 'conpty', 'OpenConsole.exe'))
+        ? dll
+        : null;
 };
 /** Starts ptyhost detached, so closing a terminal tab never kills the agent; only the agent exiting ends it. */
 export const startPtyHost = (o) => {

package/dist/guest/{view.js → sessions/viewer.js}

@@ -1,13 +1,13 @@
-// A terminal tab inside the sandbox that shows one agent session (same pseudo console the host can attach to).
-// Usage: node view.js <sessionId>
-import { connect, runTerminalClient } from '../shared/pty-client.js';
-import { readSession } from '../shared/rundir.js';
-import { dataDir } from './env.js';
-/** A session that is still being set up (its project provisioning, its agent installing): show the progress until it runs. */
+import { connect, runTerminalClient } from '../../shared/pty/index.js';
+import { run } from '../runtime/paths.js';
+/**
+ * A session that is still being set up (its project provisioning, its agent installing): show the progress until it
+ * runs.
+ */
 const waitUntilStarted = async (id) => {
     let last = '';
     for (let i = 0; i < 3600; i++) {
-        const s = readSession(dataDir, id);
+        const s = run.readSession(id);
         if (s && s.phase !== 'starting')
             return s;
         if (s && s.message !== last) {
@@ -16,7 +16,7 @@ const waitUntilStarted = async (id) => {
         }
         await new Promise((r) => setTimeout(r, 500));
     }
-    return readSession(dataDir, id);
+    return run.readSession(id);
 };
 export const viewSession = async (id) => {
     const session = await waitUntilStarted(id);
@@ -37,6 +37,3 @@ export const viewSession = async (id) => {
         console.log('Session error: ' + result.message);
     return result.reason === 'exit' ? result.exitCode : 1;
 };
-if (process.argv[1]?.endsWith('view.js') && process.argv[2]) {
-    viewSession(process.argv[2]).then((code) => { process.exitCode = code; }, (e) => { console.error(e instanceof Error ? e.message : String(e)); process.exitCode = 1; });
-}

package/dist/guest/setup/claude-mem.d.ts

@@ -0,0 +1,10 @@
+/**
+ * claude-mem keeps SQLite + a vector store. They run from the sandbox's own disk (SQLite and mapped folders do not
+ * mix) and are mirrored to persistent storage, from where the host syncs them back to your PC.
+ */
+export declare const claudeMemPaths: {
+    store: string;
+    local: string;
+};
+export declare const restoreClaudeMem: () => void;
+export declare const saveClaudeMem: () => void;

package/dist/guest/setup/{claude.js → claude-mem.js}

@@ -1,86 +1,19 @@
-// Claude settings from this PC, plugin path fix-up, and the claude-mem working copy.
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { translatePaths } from '../../shared/paths.js';
-import { writeJsonAtomic } from '../../shared/rundir.js';
-import { safeRemove } from '../../shared/safe-remove.js';
-import { claudeDir, dryRun, exists, launchDir, log, mkdirp, robocopy, session, stateDir, warn, workspace } from '../env.js';
-/** The sandbox keeps its own login and global state; everything else is refreshed from this PC each boot. */
-const KEEP_SANDBOX_COPY = ['.claude.json', '.credentials.json'];
-/** Plugin manifests store absolute paths to the plugin cache; point them at the sandbox's Claude folder. */
-const fixPluginPaths = (hostConfigDir) => {
-    const plugins = path.join(claudeDir, 'plugins');
-    if (!hostConfigDir || !exists(plugins))
-        return;
-    for (const name of fs.readdirSync(plugins).filter((f) => f.endsWith('.json'))) {
-        const file = path.join(plugins, name);
-        const text = fs.readFileSync(file, 'utf8');
-        const fixed = translatePaths(text, hostConfigDir, claudeDir);
-        if (fixed !== text)
-            fs.writeFileSync(file, fixed, 'utf8');
-    }
-};
-const readState = (file) => { try {
-    return JSON.parse(fs.readFileSync(file, 'utf8').replace(/^/, ''));
-}
-catch {
-    return null;
-} };
-const sameFolder = (a, b) => a.replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase() === b.replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase();
-/**
- * The sandbox keeps its own .claude.json (login, onboarding, per-project state), so MCP servers from this PC are
- * merged into it each boot: user-scope `mcpServers`, and this project's local-scope servers under the sandbox path.
- * Servers with the same name are replaced by this PC's definition; servers added inside the sandbox are kept.
- */
-export const mergeMcpServers = (hostFile, guestFile, hostWorkspace, guestWorkspace) => {
-    const host = readState(hostFile);
-    const guest = readState(guestFile);
-    if (!host || !guest)
-        return 0;
-    const hostProject = Object.entries(host.projects ?? {}).find(([key]) => sameFolder(key, hostWorkspace))?.[1]?.mcpServers ?? {};
-    const projects = { ...(guest.projects ?? {}) };
-    const guestKey = Object.keys(projects).find((key) => sameFolder(key, guestWorkspace)) ?? guestWorkspace.replace(/\\/g, '/');
-    projects[guestKey] = { ...(projects[guestKey] ?? {}), mcpServers: { ...(projects[guestKey]?.mcpServers ?? {}), ...hostProject } };
-    const merged = { ...guest, mcpServers: { ...(guest.mcpServers ?? {}), ...(host.mcpServers ?? {}) }, projects };
-    writeJsonAtomic(guestFile, merged);
-    return Object.keys(host.mcpServers ?? {}).length + Object.keys(hostProject).length;
-};
-export const syncClaudeProfile = () => {
-    const profile = session.claudeProfile;
-    if (profile.items.length === 0) {
-        log('No Claude settings were staged from this PC.');
-        return;
-    }
-    const source = path.join(launchDir, 'claude-profile');
-    mkdirp(claudeDir);
-    for (const name of profile.items) {
-        const from = path.join(source, name);
-        const to = path.join(claudeDir, name);
-        if (!exists(from))
-            continue;
-        if ((KEEP_SANDBOX_COPY.includes(name) || !profile.overwrite) && exists(to)) {
-            log('Claude settings: kept the sandbox\'s ' + name);
-            continue;
-        }
-        // Folders (skills, commands, plugins) are mirrored: what was removed on this PC goes here too.
-        if (fs.statSync(from).isDirectory())
-            safeRemove(to, claudeDir);
-        fs.cpSync(from, to, { recursive: true, force: true });
-        log('Claude settings: copied ' + name + ' from this PC');
-    }
-    fixPluginPaths(profile.hostConfigDir);
-    const mcp = mergeMcpServers(path.join(source, '.claude.json'), path.join(claudeDir, '.claude.json'), session.workspaceHost, workspace);
-    if (mcp)
-        log('Claude settings: ' + mcp + ' MCP server(s) from this PC merged in');
-    if (profile.credentials)
-        warn('Your host Claude LOGIN was copied into the sandbox (copyCredentials is true).');
-};
+import { session, stateDir } from '../runtime/session.js';
+import { dryRun } from '../runtime/paths.js';
+import { exists, mkdirp } from '../runtime/fs.js';
+import { log, warn } from '../runtime/log.js';
+import { robocopy } from '../runtime/process.js';
 /**
  * claude-mem keeps SQLite + a vector store. They run from the sandbox's own disk (SQLite and mapped folders do not
  * mix) and are mirrored to persistent storage, from where the host syncs them back to your PC.
  */
-export const claudeMemPaths = { store: path.join(stateDir, 'claude-mem'), local: path.join(os.homedir(), '.claude-mem') };
+export const claudeMemPaths = {
+    store: path.join(stateDir, 'claude-mem'),
+    local: path.join(os.homedir(), '.claude-mem'),
+};
 const claudeMemEnabled = () => session.claudeProfile.syncClaudeMem && !dryRun;
 export const restoreClaudeMem = () => {
     if (!claudeMemEnabled())
@@ -97,7 +30,9 @@ export const restoreClaudeMem = () => {
             if (exists(claudeMemPaths.store))
                 fs.renameSync(claudeMemPaths.store, claudeMemPaths.store + '.damaged-' + Date.now());
             fs.cpSync(path.join(backups, good), claudeMemPaths.store, { recursive: true });
-            warn('claude-mem: the stored database was missing or damaged; restored the backup from ' + new Date(Number(good)).toISOString() + '.');
+            warn('claude-mem: the stored database was missing or damaged; restored the backup from ' +
+                new Date(Number(good)).toISOString() +
+                '.');
         }
     }
     if (!exists(claudeMemPaths.store))
@@ -148,7 +83,12 @@ const BACKUP_EVERY_MS = 6 * 3600 * 1000;
 const keepBackup = (previous, dir) => {
     if (!exists(previous))
         return;
-    const backups = exists(dir) ? fs.readdirSync(dir).filter((n) => /^\d{13}$/.test(n)).sort() : [];
+    const backups = exists(dir)
+        ? fs
+            .readdirSync(dir)
+            .filter((n) => /^\d{13}$/.test(n))
+            .sort()
+        : [];
     const newest = Number(backups[backups.length - 1] ?? 0);
     if (Date.now() - newest < BACKUP_EVERY_MS) {
         fs.rmSync(previous, { recursive: true, force: true });

package/dist/guest/setup/{claude.d.ts → claude-profile.d.ts}

@@ -5,13 +5,3 @@
  */
 export declare const mergeMcpServers: (hostFile: string, guestFile: string, hostWorkspace: string, guestWorkspace: string) => number;
 export declare const syncClaudeProfile: () => void;
-/**
- * claude-mem keeps SQLite + a vector store. They run from the sandbox's own disk (SQLite and mapped folders do not
- * mix) and are mirrored to persistent storage, from where the host syncs them back to your PC.
- */
-export declare const claudeMemPaths: {
-    store: string;
-    local: string;
-};
-export declare const restoreClaudeMem: () => void;
-export declare const saveClaudeMem: () => void;

package/dist/guest/setup/claude-profile.js

@@ -0,0 +1,89 @@
+// Claude settings from this PC, plugin path fix-up, and the claude-mem working copy.
+import fs from 'node:fs';
+import path from 'node:path';
+import { translatePaths } from '../../shared/paths/claude-paths.js';
+import { writeJsonAtomic } from '../../shared/io/json.js';
+import { safeRemove } from '../../shared/io/safe-remove.js';
+import { claudeDir, session, workspace } from '../runtime/session.js';
+import { launchDir } from '../runtime/paths.js';
+import { exists, mkdirp } from '../runtime/fs.js';
+import { log, warn } from '../runtime/log.js';
+/** The sandbox keeps its own login and global state; everything else is refreshed from this PC each boot. */
+const KEEP_SANDBOX_COPY = ['.claude.json', '.credentials.json'];
+/** Plugin manifests store absolute paths to the plugin cache; point them at the sandbox's Claude folder. */
+const fixPluginPaths = (hostConfigDir) => {
+    const plugins = path.join(claudeDir, 'plugins');
+    if (!hostConfigDir || !exists(plugins))
+        return;
+    for (const name of fs.readdirSync(plugins).filter((f) => f.endsWith('.json'))) {
+        const file = path.join(plugins, name);
+        const text = fs.readFileSync(file, 'utf8');
+        const fixed = translatePaths(text, hostConfigDir, claudeDir);
+        if (fixed !== text)
+            fs.writeFileSync(file, fixed, 'utf8');
+    }
+};
+const readState = (file) => {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf8').replace(/^/, ''));
+    }
+    catch {
+        return null;
+    }
+};
+const sameFolder = (a, b) => a.replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase() === b.replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase();
+/**
+ * The sandbox keeps its own .claude.json (login, onboarding, per-project state), so MCP servers from this PC are
+ * merged into it each boot: user-scope `mcpServers`, and this project's local-scope servers under the sandbox path.
+ * Servers with the same name are replaced by this PC's definition; servers added inside the sandbox are kept.
+ */
+export const mergeMcpServers = (hostFile, guestFile, hostWorkspace, guestWorkspace) => {
+    const host = readState(hostFile);
+    const guest = readState(guestFile);
+    if (!host || !guest)
+        return 0;
+    const hostProject = Object.entries(host.projects ?? {}).find(([key]) => sameFolder(key, hostWorkspace))?.[1]?.mcpServers ?? {};
+    const projects = { ...(guest.projects ?? {}) };
+    const guestKey = Object.keys(projects).find((key) => sameFolder(key, guestWorkspace)) ?? guestWorkspace.replace(/\\/g, '/');
+    projects[guestKey] = {
+        ...(projects[guestKey] ?? {}),
+        mcpServers: { ...(projects[guestKey]?.mcpServers ?? {}), ...hostProject },
+    };
+    const merged = {
+        ...guest,
+        mcpServers: { ...(guest.mcpServers ?? {}), ...(host.mcpServers ?? {}) },
+        projects,
+    };
+    writeJsonAtomic(guestFile, merged);
+    return Object.keys(host.mcpServers ?? {}).length + Object.keys(hostProject).length;
+};
+export const syncClaudeProfile = () => {
+    const profile = session.claudeProfile;
+    if (profile.items.length === 0) {
+        log('No Claude settings were staged from this PC.');
+        return;
+    }
+    const source = path.join(launchDir, 'claude-profile');
+    mkdirp(claudeDir);
+    for (const name of profile.items) {
+        const from = path.join(source, name);
+        const to = path.join(claudeDir, name);
+        if (!exists(from))
+            continue;
+        if ((KEEP_SANDBOX_COPY.includes(name) || !profile.overwrite) && exists(to)) {
+            log("Claude settings: kept the sandbox's " + name);
+            continue;
+        }
+        // Folders (skills, commands, plugins) are mirrored: what was removed on this PC goes here too.
+        if (fs.statSync(from).isDirectory())
+            safeRemove(to, claudeDir);
+        fs.cpSync(from, to, { recursive: true, force: true });
+        log('Claude settings: copied ' + name + ' from this PC');
+    }
+    fixPluginPaths(profile.hostConfigDir);
+    const mcp = mergeMcpServers(path.join(source, '.claude.json'), path.join(claudeDir, '.claude.json'), session.workspaceHost, workspace);
+    if (mcp)
+        log('Claude settings: ' + mcp + ' MCP server(s) from this PC merged in');
+    if (profile.credentials)
+        warn('Your host Claude LOGIN was copied into the sandbox (copyCredentials is true).');
+};

package/dist/guest/setup/desktop.d.ts

@@ -0,0 +1,2 @@
+/** Imports the host's look (registry values + wallpaper) and restarts Explorer so it applies. */
+export declare const applyPersonalization: () => void;

package/dist/guest/setup/desktop.js

@@ -0,0 +1,32 @@
+// Making the sandbox feel like your PC: desktop look and Git identity.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { SYSTEM } from '../../shared/system.js';
+import { dryRun, isWin, launchDir } from '../runtime/paths.js';
+import { exec, powershell } from '../runtime/process.js';
+import { exists, mkdirp } from '../runtime/fs.js';
+import { log } from '../runtime/log.js';
+import { session } from '../runtime/session.js';
+const psQuote = (s) => "'" + s.replace(/'/g, "''") + "'";
+/** Imports the host's look (registry values + wallpaper) and restarts Explorer so it applies. */
+export const applyPersonalization = () => {
+    const dir = path.join(launchDir, 'personalize');
+    if (!session.personalization || !exists(dir) || dryRun || !isWin)
+        return;
+    exec(SYSTEM.reg(), ['import', path.join(dir, 'personalize.reg')], { stdio: 'ignore' });
+    const wallpaper = fs.readdirSync(dir).find((f) => f.startsWith('wallpaper'));
+    const local = wallpaper ? path.join(mkdirp(path.join(os.homedir(), 'Pictures')), wallpaper) : null;
+    if (wallpaper && local)
+        fs.copyFileSync(path.join(dir, wallpaper), local);
+    powershell([
+        local ? "Set-ItemProperty -Path 'HKCU:\\Control Panel\\Desktop' -Name WallPaper -Value " + psQuote(local) : '',
+        'Add-Type -Namespace AgentSandbox -Name Desk -MemberDefinition \'[System.Runtime.InteropServices.DllImport("user32.dll", CharSet = System.Runtime.InteropServices.CharSet.Unicode)] public static extern int SystemParametersInfo(int a, int b, string c, int d);\'',
+        local ? '[void][AgentSandbox.Desk]::SystemParametersInfo(20, 0, ' + psQuote(local) + ', 3)' : '',
+        // Explorer restarts by itself and picks up taskbar/theme changes.
+        'Stop-Process -Name explorer -Force -ErrorAction SilentlyContinue',
+    ]
+        .filter(Boolean)
+        .join('\n'));
+    log('Desktop personalisation applied from this PC.');
+};

package/dist/guest/setup/environment.js

@@ -1,8 +1,25 @@
 // The environment every agent session, hook and terminal tab in the sandbox gets.
 import path from 'node:path';
-import { claudeDir, dataDir, dryRun, errMsg, isWin, testMode, mkdirp, powershell, session, stateDir, toolsDir, warn, workspace } from '../env.js';
+import { claudeDir, session, stateDir, workspace } from '../runtime/session.js';
+import { dataDir, dryRun, isWin, testMode, toolsDir } from '../runtime/paths.js';
+import { mkdirp } from '../runtime/fs.js';
+import { powershell } from '../runtime/process.js';
+import { warn } from '../runtime/log.js';
+import { errMsg } from '../../core/util/errors.js';
 /** Variables agent-sandbox itself sets (besides the toolchains' own). */
-const AGENT_VARS = ['CLAUDE_CONFIG_DIR', 'CODEX_HOME', 'GEMINI_CLI_HOME', 'npm_config_cache', 'npm_config_update_notifier', 'AGENT_WORKSPACE', 'AGENT_DATA', 'AGENT_TOOLS', 'AGENT_PROJECT', 'AGENT_SANDBOX', 'AGENT_SANDBOX_WORKSPACE'];
+const AGENT_VARS = [
+    'CLAUDE_CONFIG_DIR',
+    'CODEX_HOME',
+    'GEMINI_CLI_HOME',
+    'npm_config_cache',
+    'npm_config_update_notifier',
+    'AGENT_WORKSPACE',
+    'AGENT_DATA',
+    'AGENT_TOOLS',
+    'AGENT_PROJECT',
+    'AGENT_SANDBOX',
+    'AGENT_SANDBOX_WORKSPACE',
+];
 export const agentEnv = (tools, target = { workspace, project: session.project, base: process.env }) => {
     const env = {
         ...target.base,
@@ -55,10 +72,16 @@ export const addMachineEnvironment = (vars, dirs, additive = false) => {
         return;
     const script = [
         "$vars = '" + JSON.stringify(vars).replace(/'/g, "''") + "' | ConvertFrom-Json",
-        "foreach ($p in $vars.PSObject.Properties) { " + (additive ? "if ([Environment]::GetEnvironmentVariable($p.Name, 'Machine')) { continue }; " : '') + "[Environment]::SetEnvironmentVariable($p.Name, [string]$p.Value, 'Machine') }",
+        'foreach ($p in $vars.PSObject.Properties) { ' +
+            (additive ? "if ([Environment]::GetEnvironmentVariable($p.Name, 'Machine')) { continue }; " : '') +
+            "[Environment]::SetEnvironmentVariable($p.Name, [string]$p.Value, 'Machine') }",
         "$path = [Environment]::GetEnvironmentVariable('Path', 'Machine') -split ';'",
-        "$add = '" + JSON.stringify(dirs).replace(/'/g, "''") + "' | ConvertFrom-Json | Where-Object { $path -notcontains $_ }",
-        "if ($add) { [Environment]::SetEnvironmentVariable('Path', (" + (additive ? '($path + @($add))' : '(@($add) + $path)') + " -join ';'), 'Machine') }",
+        "$add = '" +
+            JSON.stringify(dirs).replace(/'/g, "''") +
+            "' | ConvertFrom-Json | Where-Object { $path -notcontains $_ }",
+        "if ($add) { [Environment]::SetEnvironmentVariable('Path', (" +
+            (additive ? '($path + @($add))' : '(@($add) + $path)') +
+            " -join ';'), 'Machine') }",
     ].join('\n');
     try {
         powershell(script);

package/dist/guest/setup/{user.d.ts → git-identity.d.ts}

@@ -1,5 +1,3 @@
-/** Imports the host's look (registry values + wallpaper) and restarts Explorer so it applies. */
-export declare const applyPersonalization: () => void;
 /**
  * Your Git identity from this PC (name/email only), plus safe.directory for the mapped workspace (its owner SID
  * differs in the sandbox). Uses the real git.exe directly: the read-only guard would rightly refuse `config --add`.

package/dist/guest/setup/git-identity.js

@@ -0,0 +1,34 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { dryRun, launchDir, toolsDir } from '../runtime/paths.js';
+import { exists } from '../runtime/fs.js';
+/**
+ * Your Git identity from this PC (name/email only), plus safe.directory for the mapped workspace (its owner SID
+ * differs in the sandbox). Uses the real git.exe directly: the read-only guard would rightly refuse `config --add`.
+ */
+export const setupGitConfig = (env) => {
+    // A dry run (the self-test) must not touch the real ~/.gitconfig: it once replaced the sandbox's own, safe.directory
+    // included, so git refused the workspace until the next boot.
+    if (dryRun)
+        return;
+    const source = path.join(launchDir, 'home', '.gitconfig');
+    if (exists(source))
+        fs.copyFileSync(source, path.join(os.homedir(), '.gitconfig'));
+    const git = path.join(toolsDir, 'git', 'cmd', 'git.exe');
+    if (!exists(git))
+        return;
+    const { GIT_DIR: _gitDir, ...rest } = env;
+    spawnSync(git, ['config', '--global', '--add', 'safe.directory', '*'], {
+        env: rest,
+        windowsHide: true,
+        stdio: 'ignore',
+    });
+    // Windows long paths are on in the sandbox, but git skips files over 260 characters unless told.
+    spawnSync(git, ['config', '--global', 'core.longpaths', 'true'], { env: rest, windowsHide: true, stdio: 'ignore' });
+    // Git for Windows' system config says autocrlf=true: checkouts made in the sandbox (worktrees, clones) got CRLF and
+    // tools that want LF (rustfmt, shellcheck, prettier) failed on every file. "input" keeps the line endings the repo
+    // has, and a checkout from your PC (CRLF in the folder) still shows as unchanged.
+    spawnSync(git, ['config', '--global', 'core.autocrlf', 'input'], { env: rest, windowsHide: true, stdio: 'ignore' });
+};

package/dist/guest/{gitrules.d.ts → setup/git-rules.d.ts}

@@ -1,2 +1,2 @@
-import type { GitAccess } from '../core/types.js';
+import type { GitAccess } from '../../core/types.js';
 export declare const gitDenyRules: (access: GitAccess) => string[];

package/dist/guest/setup/git-rules.js

@@ -0,0 +1,50 @@
+const SHELLS = ['Bash', 'PowerShell'];
+const WRITE_COMMANDS = [
+    'commit',
+    'push',
+    'add',
+    'rm',
+    'mv',
+    'merge',
+    'rebase',
+    'reset',
+    'checkout',
+    'switch',
+    'restore',
+    'stash',
+    'tag',
+    'cherry-pick',
+    'revert',
+    'am',
+    'apply',
+    'clean',
+    'pull',
+    'fetch',
+    'clone',
+    'init',
+    'gc',
+    'prune',
+    'update-ref',
+    'update-index',
+    'filter-branch',
+    'replace',
+    'worktree add',
+    'branch -d',
+    'branch -D',
+    'branch -m',
+    'branch -M',
+    'config --add',
+    'config --unset',
+    'remote add',
+    'remote remove',
+    'remote set-url',
+];
+const GIT_DIR_PATHS = ['**/.git', '**/.git/**'];
+export const gitDenyRules = (access) => {
+    if (access === 'full')
+        return [];
+    const commands = access === 'none' ? ['git'] : WRITE_COMMANDS.map((c) => 'git ' + c);
+    const shellRules = SHELLS.flatMap((shell) => commands.map((c) => shell + '(' + c + ':*)'));
+    const fileRules = GIT_DIR_PATHS.flatMap((p) => access === 'none' ? ['Read(' + p + ')', 'Edit(' + p + ')'] : ['Edit(' + p + ')']);
+    return [...shellRules, ...fileRules];
+};

package/dist/guest/setup/hooks.js

@@ -3,8 +3,11 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { SYSTEM } from '../../shared/system.js';
-import { spawnAsync } from '../../shared/download.js';
-import { exists, isWin, launchDir, log, session, warn, workspace } from '../env.js';
+import { spawnAsync } from '../../shared/download/index.js';
+import { exists } from '../runtime/fs.js';
+import { isWin, launchDir } from '../runtime/paths.js';
+import { log, warn } from '../runtime/log.js';
+import { session, workspace } from '../runtime/session.js';
 const commandFor = (file) => {
     const ext = path.extname(file).toLowerCase();
     if (ext === '.mjs' || ext === '.js')
@@ -18,12 +21,21 @@ const commandFor = (file) => {
     return null;
 };
 const BOOT = { root: path.join(launchDir, 'hooks'), cwd: workspace };
-export const projectHooks = (name, cwd) => ({ root: path.join(launchDir, 'projects', name, 'hooks'), cwd });
+export const projectHooks = (name, cwd) => ({
+    root: path.join(launchDir, 'projects', name, 'hooks'),
+    cwd,
+});
 const hooksOf = (stage, target) => {
     const dir = path.join(target.root, stage);
     if (!exists(dir))
         return [];
-    return fs.readdirSync(dir).sort().flatMap((name) => { const command = commandFor(path.join(dir, name)); return command ? [{ name, command }] : []; });
+    return fs
+        .readdirSync(dir)
+        .sort()
+        .flatMap((name) => {
+        const command = commandFor(path.join(dir, name));
+        return command ? [{ name, command }] : [];
+    });
 };
 const failed = (stage, name, status) => {
     const message = 'Hook failed (' + stage + '/' + name + ', exit ' + status + ')';
@@ -43,7 +55,12 @@ export const runHooks = (stage, env, target = BOOT) => {
 export const runHooksAsync = async (stage, env, target) => {
     for (const { name, command } of hooksOf(stage, target)) {
         log('Hook [' + stage + ']: ' + name);
-        const status = await spawnAsync(command[0], command[1], { stdio: 'ignore', cwd: target.cwd, env, windowsHide: true });
+        const status = await spawnAsync(command[0], command[1], {
+            stdio: 'ignore',
+            cwd: target.cwd,
+            env,
+            windowsHide: true,
+        });
         if (status !== 0)
             failed(stage, name, status);
     }

package/dist/guest/setup/{policy.js → managed-policy.js}

@@ -3,8 +3,8 @@
 // today, the git access mode. Rewritten every boot; removed when there is nothing to enforce.
 import fs from 'node:fs';
 import path from 'node:path';
-import { gitDenyRules } from '../gitrules.js';
-import { managedClaudeMd } from '../guide.js';
+import { gitDenyRules } from './git-rules.js';
+import { managedClaudeMd } from '../boot/guide.js';
 export const managedSettingsFile = () => path.join(path.dirname(managedClaudeMd()), 'managed-settings.json');
 export const writeManagedSettings = (access) => {
     const file = managedSettingsFile();