windows-development-sandbox 1.4.1 → 1.4.3

package/dist/host/guard/mark-of-the-web.js

@@ -0,0 +1,74 @@
+// storage.markSandboxFiles: programs and scripts that appear or change in a project while a sandbox runs get Windows'
+// "downloaded from the internet" mark (Zone.Identifier, zone 3), so SmartScreen and PowerShell's RemoteSigned policy
+// stop a planted file from running on a double-click or a habit. Runs in the watcher; only the mark is written.
+import fs from 'node:fs';
+import path from 'node:path';
+/** What Windows runs when you open it (not source files such as .js or .py: those need a program you choose). */
+export const RISKY = /\.(exe|dll|com|scr|pif|msi|msix|msp|appx|appxbundle|bat|cmd|ps1|psm1|psd1|vbs|vbe|wsf|wsh|hta|lnk|url|jar|reg|cpl|application|gadget|chm)$/i;
+const MARK = '[ZoneTransfer]\r\nZoneId=3\r\nHostUrl=about:windows-development-sandbox\r\n';
+/** Folders not worth watching closely (git's own files; dependency and build folders are still marked). */
+const SKIP = /(^|[\\/])\.git([\\/]|$)/i;
+const MAX_NAMED = 10;
+/** Marks one file if it is a program or script (and a plain file, not a link). Returns true when it marked it. */
+export function markFromSandbox(file) {
+    if (!RISKY.test(file) || SKIP.test(file))
+        return false;
+    try {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile())
+            return false;
+        fs.writeFileSync(file + ':Zone.Identifier', MARK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Has this file the mark? */
+export function isMarked(file) {
+    try {
+        return fs.readFileSync(file + ':Zone.Identifier', 'utf8').includes('ZoneId=3');
+    }
+    catch {
+        return false;
+    }
+}
+/** Watches the projects while the sandbox runs and marks what appears or changes; returns a function that stops it. */
+export function watchAndMark(projects, note = () => undefined) {
+    const pending = new Set();
+    let timer;
+    const flush = () => {
+        timer = undefined;
+        const marked = [...pending].filter(markFromSandbox);
+        pending.clear();
+        if (marked.length)
+            note('marked as from the sandbox (SmartScreen asks before they run here): ' +
+                marked
+                    .slice(0, MAX_NAMED)
+                    .map((f) => path.basename(f))
+                    .join(', ') +
+                (marked.length > MAX_NAMED ? ' and ' + (marked.length - MAX_NAMED) + ' more' : ''));
+    };
+    const watchers = projects.flatMap((project) => {
+        try {
+            return [
+                fs.watch(project, { recursive: true }, (_event, file) => {
+                    const rel = file ? String(file) : '';
+                    if (!rel || !RISKY.test(rel) || SKIP.test(rel))
+                        return;
+                    pending.add(path.join(project, rel));
+                    timer ??= setTimeout(flush, 1000);
+                }),
+            ];
+        }
+        catch {
+            return [];
+        }
+    });
+    return () => {
+        watchers.forEach((w) => w.close());
+        clearTimeout(timer);
+        if (pending.size)
+            flush();
+    };
+}

package/dist/host/guard/nested-repos.d.ts

@@ -0,0 +1,14 @@
+import type { GitState, GuardRule, RepoFinding, RepoSnapshot } from './types.js';
+/**
+ * Git folders other than the project's own: submodules (.git/modules/**) and repositories nested up to two levels deep.
+ * git runs their hooks and config too (git status in a subfolder, VS Code's repository scan). Bounded: links are never
+ * followed and at most MAX_OTHER_REPOS are looked at.
+ */
+export declare function otherGitDirs(workspace: string): string[];
+/** The state of every other git folder, for the snapshot. */
+export declare function nestedRepoStates(workspace: string): Record<string, GitState>;
+/** Submodules and nested repositories get the same git checks; a new one is compared with an empty baseline. */
+export declare class NestedReposRule implements GuardRule {
+    readonly kind = "nested-repos";
+    check(workspace: string, before: RepoSnapshot): RepoFinding[];
+}

package/dist/host/guard/nested-repos.js

@@ -0,0 +1,88 @@
+// Git folders other than the project's own: submodules and nested repositories, which git also runs hooks from.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileExists } from '../../core/util/index.js';
+import { EMPTY_GIT, gitState, guardGitDir, plainGitDir } from './git-dirs.js';
+const MAX_OTHER_REPOS = 64;
+const SKIP_DIRS = new Set([
+    'node_modules',
+    '.git',
+    'agent-sandbox-quarantine',
+    'target',
+    'dist',
+    'build',
+    'bin',
+    'obj',
+    '.venv',
+    'venv',
+]);
+const notSkipped = (d) => !SKIP_DIRS.has(path.basename(d).toLowerCase());
+function plainDirs(dir, limit) {
+    try {
+        return fs
+            .readdirSync(dir, { withFileTypes: true })
+            .filter((e) => e.isDirectory() && !e.isSymbolicLink())
+            .slice(0, limit)
+            .map((e) => path.join(dir, e.name));
+    }
+    catch {
+        return [];
+    }
+}
+/** The key of a git folder in RepoSnapshot.repos: its path relative to the workspace, with forward slashes. */
+function repoKey(workspace, dir) {
+    return path.relative(workspace, dir).split(path.sep).join('/');
+}
+/**
+ * Git folders other than the project's own: submodules (.git/modules/**) and repositories nested up to two levels deep.
+ * git runs their hooks and config too (git status in a subfolder, VS Code's repository scan). Bounded: links are never
+ * followed and at most MAX_OTHER_REPOS are looked at.
+ */
+export function otherGitDirs(workspace) {
+    const found = [];
+    const main = plainGitDir(workspace);
+    // Submodules: a folder with a config and a HEAD is a git folder, and may have modules of its own.
+    const walk = (dir, depth) => {
+        for (const d of plainDirs(dir, 200)) {
+            if (found.length >= MAX_OTHER_REPOS)
+                return;
+            if (fileExists(path.join(d, 'config')) && fileExists(path.join(d, 'HEAD'))) {
+                found.push(d);
+                if (depth < 3)
+                    walk(path.join(d, 'modules'), depth + 1);
+            }
+            else if (depth < 3)
+                walk(d, depth + 1);
+        }
+    };
+    if (main)
+        walk(path.join(main, 'modules'), 0);
+    for (const sub of plainDirs(workspace, 500).filter(notSkipped)) {
+        for (const candidate of [sub, ...plainDirs(sub, 200).filter(notSkipped)]) {
+            if (found.length >= MAX_OTHER_REPOS)
+                return found;
+            const git = plainGitDir(candidate);
+            if (git)
+                found.push(git);
+        }
+    }
+    return found;
+}
+/** The state of every other git folder, for the snapshot. */
+export function nestedRepoStates(workspace) {
+    return Object.fromEntries(otherGitDirs(workspace).map((d) => [repoKey(workspace, d), gitState(d)]));
+}
+/** Submodules and nested repositories get the same git checks; a new one is compared with an empty baseline. */
+export class NestedReposRule {
+    kind = 'nested-repos';
+    check(workspace, before) {
+        // Snapshots from before this check existed have no baseline: checking against nothing would move your own files.
+        const repos = before.repos;
+        if (!repos)
+            return [];
+        return otherGitDirs(workspace).flatMap((other) => {
+            const rel = repoKey(workspace, other);
+            return guardGitDir(other, repos[rel] ?? EMPTY_GIT).map((f) => ({ ...f, detail: rel + ': ' + f.detail }));
+        });
+    }
+}

package/dist/host/guard/quarantine.d.ts

@@ -0,0 +1,3 @@
+import type { FindingKind, RepoFinding } from './types.js';
+/** Moves files into <dir>\agent-sandbox-quarantine\<time>\ and reports them. */
+export declare function quarantine(from: string, names: readonly string[], into: string, kind: FindingKind): RepoFinding[];

package/dist/host/guard/quarantine.js

@@ -0,0 +1,24 @@
+import fs from 'node:fs';
+import path from 'node:path';
+/** Moves files into <dir>\agent-sandbox-quarantine\<time>\ and reports them. */
+export function quarantine(from, names, into, kind) {
+    if (names.length === 0)
+        return [];
+    const target = path.join(into, 'agent-sandbox-quarantine', String(Date.now()));
+    fs.mkdirSync(target, { recursive: true });
+    return names.map((name) => {
+        try {
+            fs.renameSync(path.join(from, name), path.join(target, name));
+        }
+        catch (e) {
+            return {
+                kind,
+                detail: name +
+                    ' (could not be moved: ' +
+                    e.code +
+                    '; delete it yourself before running anything here)',
+            };
+        }
+        return { kind, detail: name + ' (moved to ' + target + ')' };
+    });
+}

package/dist/host/guard/repo-guard.d.ts

@@ -0,0 +1,10 @@
+import type { RepoFinding, RepoSnapshot } from './types.js';
+/** Snapshots a project before the sandbox can write it, and later neutralises what it added. */
+export declare class RepoGuard {
+    snapshot(workspace: string): RepoSnapshot;
+    /**
+     * Compares the workspace with its pre-launch snapshot and neutralises anything new that would execute on this PC.
+     * Returns what was found (and fixed). Never touches what was already there before the sandbox ran.
+     */
+    guard(workspace: string, before: RepoSnapshot): RepoFinding[];
+}

package/dist/host/guard/repo-guard.js

@@ -0,0 +1,36 @@
+// Zero-click protection for the folder the sandbox shares with this PC. What the agent writes there could run code on
+// THIS PC without you doing anything unusual (git hooks and config, commands planted in the project root, agent and
+// editor files), so it is snapshotted before launch, re-checked every minute and at close, and neutralised (RULES).
+import { assertTestWritable } from '../test-guard.js';
+import { AgentFilesRule, agentSnapshot } from './agent-files.js';
+import { PlantedCommandsRule, plantedCommands } from './commands.js';
+import { GitDirRule, gitState, plainGitDir } from './git-dirs.js';
+import { NestedReposRule, nestedRepoStates } from './nested-repos.js';
+/** The checks in the order their findings are reported. */
+const RULES = [
+    new PlantedCommandsRule(),
+    new AgentFilesRule(),
+    new NestedReposRule(),
+    new GitDirRule(),
+];
+/** Snapshots a project before the sandbox can write it, and later neutralises what it added. */
+export class RepoGuard {
+    snapshot(workspace) {
+        const dir = plainGitDir(workspace);
+        return {
+            gitDir: dir !== null,
+            ...gitState(dir),
+            commands: plantedCommands(workspace),
+            agent: agentSnapshot(workspace),
+            repos: nestedRepoStates(workspace),
+        };
+    }
+    /**
+     * Compares the workspace with its pre-launch snapshot and neutralises anything new that would execute on this PC.
+     * Returns what was found (and fixed). Never touches what was already there before the sandbox ran.
+     */
+    guard(workspace, before) {
+        assertTestWritable(workspace);
+        return RULES.flatMap((rule) => rule.check(workspace, before));
+    }
+}

package/dist/host/guard/store.d.ts

@@ -0,0 +1,40 @@
+import { RepoGuard } from './repo-guard.js';
+import { type RepoFinding } from './types.js';
+/** A recorded finding (`at`: when it was found). */
+export type RecordedFinding = RepoFinding & {
+    at?: string;
+};
+/** The guarded projects of one data folder and what the guard found (host-only files next to the sync state). */
+export declare class RepoGuardStore {
+    private readonly guard;
+    private readonly snapshots;
+    private readonly found;
+    constructor(dataPath: string, guard?: RepoGuard);
+    private read;
+    /**
+     * At launch: every folder the sandbox will be able to write. The launch folder, projects mapped with it and every
+     * project already inside a project root are snapshotted as they are now, before the sandbox can touch them.
+     */
+    save(workspace: string, more?: readonly string[], roots?: readonly string[]): void;
+    /**
+     * A project that joins the running sandbox: snapshotted before its first session, then guarded like the launch
+     * folder. A project already guarded keeps its first snapshot (what was there before the sandbox could touch it).
+     */
+    add(workspace: string, o?: {
+        empty?: boolean;
+    }): void;
+    /**
+     * Folders that appeared inside a project root after the launch: the sandbox could have written them from the start,
+     * so they get an EMPTY baseline: any git hook, git config that runs programs (core.hooksPath, core.fsmonitor, ...)
+     * or planted command in them counts as added inside the sandbox and is neutralised.
+     */
+    private discoverRootProjects;
+    /** The folders being guarded (for status). */
+    guarded(): string[];
+    /**
+     * Re-checks every project of the current/last launch; findings are kept in a host-only file for `status`. Returns the
+     * new ones.
+     */
+    check(): RepoFinding[];
+    findings(): RecordedFinding[];
+}

package/dist/host/guard/store.js

@@ -0,0 +1,145 @@
+// Where the repo guard keeps its snapshots and findings: host-only files next to the sync state, never in the data
+// folder the sandbox can write.
+import fs from 'node:fs';
+import path from 'node:path';
+import _ from 'lodash';
+import { z } from 'zod';
+import { JsonFile } from '../../shared/io/index.js';
+import { hostStateFile, storageOf } from '../storage/index.js';
+import { dirExists, isLink } from '../../core/util/index.js';
+import { RepoGuard } from './repo-guard.js';
+import { FINDING_KINDS } from './types.js';
+const FindingSchema = z.object({
+    kind: z.enum(FINDING_KINDS),
+    detail: z.string().max(4096),
+    at: z.string().max(64).optional(),
+});
+const GitStateSchema = z.object({
+    config: z.array(z.string()),
+    hooks: z.record(z.string(), z.string()),
+    redirects: z.array(z.string()),
+});
+const SavedSchema = z.object({
+    workspace: z
+        .string()
+        .max(1024)
+        .refine((p) => path.isAbsolute(p)),
+    snapshot: GitStateSchema.extend({
+        gitDir: z.boolean(),
+        commands: z.record(z.string(), z.string()),
+        agent: z.record(z.string(), z.string()).optional(),
+        repos: z.record(z.string(), GitStateSchema).optional(),
+    }),
+});
+/**
+ * Every project the sandbox can write, and the project roots (whole folders of projects) it has mapped. Older
+ * versions saved a single object.
+ */
+const StoreSchema = z.strictObject({
+    projects: z.array(SavedSchema).max(4096),
+    roots: z
+        .array(z
+        .string()
+        .max(1024)
+        .refine((p) => path.isAbsolute(p)))
+        .max(64),
+});
+const StoreAnySchema = z.union([StoreSchema, SavedSchema.transform((s) => ({ projects: [s], roots: [] }))]);
+const EMPTY = { gitDir: false, config: [], hooks: {}, redirects: [], commands: {}, agent: {}, repos: {} };
+const MAX_ROOT_PROJECTS = 2000;
+/** The folders directly inside a project root (plain folders only; links are never followed). */
+function rootProjects(root) {
+    if (!dirExists(root) || isLink(root))
+        return [];
+    return fs
+        .readdirSync(root, { withFileTypes: true })
+        .filter((e) => e.isDirectory() && !e.isSymbolicLink())
+        .slice(0, MAX_ROOT_PROJECTS)
+        .map((e) => path.join(root, e.name));
+}
+function has(projects, workspace) {
+    return projects.some((s) => s.workspace.toLowerCase() === workspace.toLowerCase());
+}
+/** The guarded projects of one data folder and what the guard found (host-only files next to the sync state). */
+export class RepoGuardStore {
+    guard;
+    snapshots;
+    found;
+    constructor(dataPath, guard = new RepoGuard()) {
+        this.guard = guard;
+        const storageRoot = storageOf(dataPath);
+        this.snapshots = new JsonFile(StoreAnySchema, hostStateFile(storageRoot, dataPath, '-repo.json'));
+        this.found = new JsonFile(z.array(FindingSchema).max(10000), hostStateFile(storageRoot, dataPath, '-repo-findings.json'));
+    }
+    read() {
+        return this.snapshots.read() ?? { projects: [], roots: [] };
+    }
+    /**
+     * At launch: every folder the sandbox will be able to write. The launch folder, projects mapped with it and every
+     * project already inside a project root are snapshotted as they are now, before the sandbox can touch them.
+     */
+    save(workspace, more = [], roots = []) {
+        const folders = _.uniqBy([workspace, ...more, ...roots.flatMap((r) => [r, ...rootProjects(r)])], (w) => w.toLowerCase());
+        this.snapshots.write({
+            projects: folders.map((w) => ({ workspace: w, snapshot: this.guard.snapshot(w) })),
+            roots: [...roots],
+        });
+    }
+    /**
+     * A project that joins the running sandbox: snapshotted before its first session, then guarded like the launch
+     * folder. A project already guarded keeps its first snapshot (what was there before the sandbox could touch it).
+     */
+    add(workspace, o = {}) {
+        const store = this.read();
+        // A folder inside one that is guarded already is covered by it only for its root files; it gets its own entry.
+        if (has(store.projects, workspace))
+            return;
+        this.snapshots.write({
+            ...store,
+            projects: [...store.projects, { workspace, snapshot: o.empty ? EMPTY : this.guard.snapshot(workspace) }],
+        });
+    }
+    /**
+     * Folders that appeared inside a project root after the launch: the sandbox could have written them from the start,
+     * so they get an EMPTY baseline: any git hook, git config that runs programs (core.hooksPath, core.fsmonitor, ...)
+     * or planted command in them counts as added inside the sandbox and is neutralised.
+     */
+    discoverRootProjects() {
+        const store = this.read();
+        const found = store.roots
+            .flatMap(rootProjects)
+            .filter((w) => !has(store.projects, w))
+            .map((workspace) => ({ workspace, snapshot: EMPTY }));
+        if (!found.length)
+            return store.projects;
+        const projects = [...store.projects, ...found].slice(0, 4096);
+        this.snapshots.write({ ...store, projects });
+        return projects;
+    }
+    /** The folders being guarded (for status). */
+    guarded() {
+        return this.read().projects.map((s) => s.workspace);
+    }
+    /**
+     * Re-checks every project of the current/last launch; findings are kept in a host-only file for `status`. Returns the
+     * new ones.
+     */
+    check() {
+        const saved = this.discoverRootProjects();
+        if (!saved.length)
+            return [];
+        const old = this.findings();
+        // A finding that cannot be fixed (a file locked in the sandbox) is reported once, not every minute.
+        const findings = saved
+            .flatMap((s) => this.guard
+            .guard(s.workspace, s.snapshot)
+            .map((f) => (saved.length > 1 ? { ...f, detail: s.workspace + ': ' + f.detail } : f)))
+            .filter((f) => !old.some((o) => o.kind === f.kind && o.detail === f.detail));
+        if (findings.length)
+            this.found.write([...old, ...findings.map((f) => ({ ...f, at: new Date().toISOString() }))]);
+        return findings;
+    }
+    findings() {
+        return this.found.read() ?? [];
+    }
+}

package/dist/host/guard/types.d.ts

@@ -0,0 +1,27 @@
+/** What a finding is about (also the persisted findings' schema). */
+export declare const FINDING_KINDS: readonly ["hook", "config", "git", "command", "agent"];
+export type FindingKind = (typeof FINDING_KINDS)[number];
+/** A git folder's own state: config lines, hooks, redirect files. */
+export interface GitState {
+    readonly config: string[];
+    readonly hooks: Record<string, string>;
+    readonly redirects: string[];
+}
+export interface RepoSnapshot extends GitState {
+    readonly gitDir: boolean;
+    readonly commands: Record<string, string>;
+    /** Fingerprints of AGENT_FILES (missing in snapshots of older versions: then they are not checked). */
+    readonly agent?: Record<string, string>;
+    /** Other git folders: submodules (.git/modules/...) and repositories nested in the project, by relative path. */
+    readonly repos?: Record<string, GitState>;
+}
+export interface RepoFinding {
+    readonly kind: FindingKind;
+    readonly detail: string;
+}
+export type GuardRuleKind = 'commands' | 'agent-files' | 'nested-repos' | 'git-dir';
+/** One check: compares the workspace with its pre-launch snapshot and neutralises what is new. */
+export interface GuardRule {
+    readonly kind: GuardRuleKind;
+    check(workspace: string, before: RepoSnapshot): RepoFinding[];
+}

package/dist/host/guard/types.js

@@ -0,0 +1,3 @@
+// The shapes the repo guard saves before launch and reports afterwards, and the rule every check implements.
+/** What a finding is about (also the persisted findings' schema). */
+export const FINDING_KINDS = ['hook', 'config', 'git', 'command', 'agent'];

package/dist/host/guard/watch-state.d.ts

@@ -0,0 +1,9 @@
+/** The projects to watch and mark (empty: storage.markSandboxFiles is off). */
+export declare function saveMarkedProjects(storageRoot: string, dataPath: string, projects: string[]): void;
+export declare function readMarkedProjects(storageRoot: string, dataPath: string): string[];
+/** The data folder's size, measured by the watcher when a sandbox closes (measuring at launch would be slow). */
+export declare function saveDataSize(storageRoot: string, dataPath: string, bytes: number): void;
+export declare function readDataSize(storageRoot: string, dataPath: string): {
+    bytes: number;
+    at: string;
+} | null;

package/dist/host/guard/watch-state.js

@@ -0,0 +1,26 @@
+// What the background watcher marks, and the size of the persisted data: host-only files next to the sync state.
+import { z } from 'zod';
+import { JsonFile } from '../../shared/io/index.js';
+import { hostStateFile } from '../storage/index.js';
+const MarkedSchema = z.array(z.string().max(1024)).max(64);
+const DataSizeSchema = z.object({ bytes: z.number().min(0), at: z.string().max(40) });
+function marksFile(storageRoot, dataPath) {
+    return new JsonFile(MarkedSchema, hostStateFile(storageRoot, dataPath, '-mark.json'));
+}
+function sizeFile(storageRoot, dataPath) {
+    return new JsonFile(DataSizeSchema, hostStateFile(storageRoot, dataPath, '-size.json'));
+}
+/** The projects to watch and mark (empty: storage.markSandboxFiles is off). */
+export function saveMarkedProjects(storageRoot, dataPath, projects) {
+    marksFile(storageRoot, dataPath).write(projects);
+}
+export function readMarkedProjects(storageRoot, dataPath) {
+    return marksFile(storageRoot, dataPath).read() ?? [];
+}
+/** The data folder's size, measured by the watcher when a sandbox closes (measuring at launch would be slow). */
+export function saveDataSize(storageRoot, dataPath, bytes) {
+    sizeFile(storageRoot, dataPath).write({ bytes, at: new Date().toISOString() });
+}
+export function readDataSize(storageRoot, dataPath) {
+    return sizeFile(storageRoot, dataPath).read();
+}

package/dist/host/launch/boot-projects.d.ts

@@ -0,0 +1,17 @@
+import type { ResolvedRun } from '../../core/types.js';
+import { type RootMapping } from '../../shared/paths/index.js';
+/** More folders than this would make the .wsb (and every boot) unwieldy; the rest join with a restart later. */
+export declare const MAX_BOOT_PROJECTS = 48;
+export interface BootProjects {
+    readonly roots: RootMapping[];
+    readonly projects: RootMapping[];
+    readonly notes: string[];
+}
+export declare function planBootProjects(o: {
+    readonly run: ResolvedRun;
+    readonly packageRoot: string;
+    readonly extraProjects?: readonly string[];
+    readonly knownProjects?: readonly string[];
+}): BootProjects;
+/** The launch folder is inside a mapped root and placed under it (core/run): the root shows it, no own mapping. */
+export declare function shownByRoot(roots: readonly RootMapping[], workspaceHost: string, guestWorkspace: string): boolean;

package/dist/host/launch/{projects.js → boot-projects.js}

@@ -3,12 +3,13 @@
 // started before (except projects.exclude). Every one passes the same checks as a launch folder.
 import path from 'node:path';
 import { assertSafeMapping, assertSafeWorkspace } from '../../core/safe-paths.js';
-import { dirExists, errMsg, fail } from '../../core/util.js';
-import { guestDirFor, isWithin, planProjectMappings, projectForHostDir, usableRoots } from '../../shared/projects.js';
-import { allProjectsToMap, readKnown } from '../projects.js';
+import { dirExists, errMsg, fail } from '../../core/util/index.js';
+import { guestDirFor, isWithin, planProjectMappings, projectForHostDir, usableRoots, } from '../../shared/paths/index.js';
+// Direct, not the barrel: host/projects/join.ts imports host/launch.
+import { allProjectsToMap, KnownProjects } from '../projects/known.js';
 /** More folders than this would make the .wsb (and every boot) unwieldy; the rest join with a restart later. */
 export const MAX_BOOT_PROJECTS = 48;
-export const planBootProjects = (o) => {
+export function planBootProjects(o) {
     const { config, workspaceHost, storageRoot } = o.run;
     const notes = [];
     const safe = (folder) => {
@@ -30,13 +31,20 @@ export const planBootProjects = (o) => {
         if (refusal)
             fail('projects.roots: ' + refusal, 'Use a folder that holds your projects, e.g. F:\\Code (not a drive, your profile or a system folder).');
     }
-    // The same list resolveRun used to place a launch folder that is inside a root (core/workspace.ts).
+    // The same list resolveRun used to place a launch folder that is inside a root (core/run/guest-workspace.ts).
     const roots = usableRoots(config.projects.roots, dirExists);
-    const known = o.knownProjects ?? readKnown(storageRoot).map((k) => k.host);
-    const wanted = [...(o.extraProjects ?? []), ...(config.projects.all ? allProjectsToMap(known, { primary: workspaceHost, roots, exclude: config.projects.exclude }) : [])];
+    const known = o.knownProjects ?? new KnownProjects(storageRoot).list().map((k) => k.host);
+    const wanted = [
+        ...(o.extraProjects ?? []),
+        ...(config.projects.all
+            ? allProjectsToMap(known, { primary: workspaceHost, roots, exclude: config.projects.exclude })
+            : []),
+    ];
     const projects = [];
     for (const folder of wanted.map((p) => path.resolve(p))) {
-        if (isWithin(workspaceHost, folder) || roots.some((r) => isWithin(r, folder)) || projects.some((p) => isWithin(p, folder) || isWithin(folder, p)))
+        if (isWithin(workspaceHost, folder) ||
+            roots.some((r) => isWithin(r, folder)) ||
+            projects.some((p) => isWithin(p, folder) || isWithin(folder, p)))
             continue;
         if (!dirExists(folder))
             continue;
@@ -54,9 +62,10 @@ export const planBootProjects = (o) => {
     // Projects mapped on their own sit where they would as the launch folder (C:\Workspace\<name>), never on top of it.
     const taken = [config.guestWorkspace, ...config.mappings.flatMap((m) => (m.guest ? [m.guest] : []))];
     return { ...planProjectMappings(roots, projects, Boolean(o.run.mirror), taken), notes };
-};
-/** The launch folder is inside a mapped root and placed under it (core/workspace.ts): the root shows it, no own mapping. */
-export const shownByRoot = (roots, workspaceHost, guestWorkspace) => {
+}
+/** The launch folder is inside a mapped root and placed under it (core/run): the root shows it, no own mapping. */
+export function shownByRoot(roots, workspaceHost, guestWorkspace) {
     const root = projectForHostDir(roots, workspaceHost);
-    return root !== null && guestDirFor(root, workspaceHost).toLowerCase() === guestWorkspace.replace(/[\\/]+$/, '').toLowerCase();
-};
+    return (root !== null &&
+        guestDirFor(root, workspaceHost).toLowerCase() === guestWorkspace.replace(/[\\/]+$/, '').toLowerCase());
+}

package/dist/host/{database-plan.d.ts → launch/database-plan.d.ts}

@@ -1,12 +1,12 @@
-import type { Config, DatabasePlan } from '../core/types.js';
-import { type Database, type ProjectFile } from '../core/detect-databases.js';
+import type { Config, DatabasePlan } from '../../core/types.js';
+import { type Database, type ProjectFile } from '../../core/detect/index.js';
 /**
  * What to run in this sandbox: databases set to true, plus "auto" ones the project needs. SQL Server is reported (so
  * the user hears about it) but cannot run inside Windows Sandbox.
  */
-export declare const planDatabases: (config: Config["databases"], workspace: string, probe?: {
+export declare function planDatabases(config: Config['databases'], workspace: string, probe?: {
     files?: ProjectFile[];
     host?: Database[];
-}) => DatabasePlan[];
+}): DatabasePlan[];
 /** Every database the sandbox can run, so `sbx-db start <name>` works for ones that did not start at boot. */
-export declare const databaseCatalog: (config: Config["databases"]) => DatabasePlan[];
+export declare function databaseCatalog(config: Config['databases']): DatabasePlan[];