windows-development-sandbox 1.4.1 → 1.4.3

package/dist/cli/tui/dialogs.js

@@ -1,162 +0,0 @@
-import { Text } from './text.js';
-import { Theme } from './theme.js';
-/** Plain lines are wrapped to the width; coloured ones are kept as they are (the frame cuts them). */
-const paragraphs = (lines, width) => lines.flatMap((l) => (Text.strip(l) === l ? Text.wrap(l, width - 4) : [l]).map((x) => '  ' + x));
-/** One line of text. Resolves to the text, or undefined when you press Esc. */
-export class TextScreen {
-    o;
-    value;
-    cursor;
-    problem;
-    constructor(o) {
-        this.o = o;
-        this.value = o.initial ?? '';
-        this.cursor = [...this.value].length;
-    }
-    render(size) {
-        const width = Math.min(size.width - 4, 100);
-        const chars = [...this.value];
-        // Scroll the field so the cursor stays visible.
-        const inner = width - 4;
-        const start = Math.max(0, this.cursor - inner + 1);
-        const shown = chars.slice(start, start + inner);
-        const before = shown.slice(0, this.cursor - start).join('');
-        const at = shown[this.cursor - start] ?? ' ';
-        const after = shown.slice(this.cursor - start + 1).join('');
-        const text = this.value === '' && this.o.placeholder ? Theme.muted(this.o.placeholder) : before + (Theme.colour ? '\x1b[7m' + at + '\x1b[27m' : '_') + after;
-        const body = [
-            '',
-            '  ' + Theme.bold(this.o.label),
-            ...(this.o.about?.length ? paragraphs(this.o.about, size.width).map((l) => Theme.muted(l)) : []),
-            '',
-            '  ' + Theme.accent('╭' + '─'.repeat(width - 2) + '╮'),
-            '  ' + Theme.accent('│') + ' ' + Text.fit(text, inner) + ' ' + Theme.accent('│'),
-            '  ' + Theme.accent('╰' + '─'.repeat(width - 2) + '╯'),
-            this.problem ? '  ' + Theme.error(Theme.glyph.cross + ' ' + this.problem) : '',
-        ];
-        return { path: this.o.path, body, keys: [['↵', 'save'], ['esc', 'cancel'], ['ctrl+u', 'clear'], ['←→', 'move']] };
-    }
-    handle(key) {
-        const chars = [...this.value];
-        const set = (next, cursor) => { this.value = next.join(''); this.cursor = Math.max(0, Math.min(next.length, cursor)); this.check(); };
-        if (key.name === 'escape')
-            return { done: undefined };
-        if (key.name === 'return') {
-            if (this.value === '' && !this.o.allowEmpty)
-                return { done: undefined };
-            const verdict = this.o.validate?.(this.value) ?? true;
-            if (verdict !== true) {
-                this.problem = verdict;
-                return;
-            }
-            return { done: this.value };
-        }
-        if (key.name === 'left') {
-            this.cursor = Math.max(0, this.cursor - 1);
-            return;
-        }
-        if (key.name === 'right') {
-            this.cursor = Math.min(chars.length, this.cursor + 1);
-            return;
-        }
-        if (key.name === 'home') {
-            this.cursor = 0;
-            return;
-        }
-        if (key.name === 'end') {
-            this.cursor = chars.length;
-            return;
-        }
-        if (key.name === 'backspace') {
-            if (this.cursor > 0)
-                set([...chars.slice(0, this.cursor - 1), ...chars.slice(this.cursor)], this.cursor - 1);
-            return;
-        }
-        if (key.name === 'delete') {
-            set([...chars.slice(0, this.cursor), ...chars.slice(this.cursor + 1)], this.cursor);
-            return;
-        }
-        if (key.ctrl && key.name === 'u') {
-            set([], 0);
-            return;
-        }
-        if (key.text) {
-            const add = [...key.text.replace(/[\r\n]/g, '')];
-            set([...chars.slice(0, this.cursor), ...add, ...chars.slice(this.cursor)], this.cursor + add.length);
-        }
-        return;
-    }
-    check() {
-        const verdict = this.value === '' ? true : this.o.validate?.(this.value) ?? true;
-        this.problem = verdict === true ? undefined : verdict;
-    }
-}
-/** Yes or no. Esc answers no. */
-export class ConfirmScreen {
-    o;
-    yes;
-    constructor(o) {
-        this.o = o;
-        this.yes = o.initial ?? true;
-    }
-    render(size) {
-        const button = (label, on, danger = false) => (on ? (danger ? Theme.colour ? '\x1b[48;5;160m\x1b[97m ' + label + ' \x1b[0m' : '[' + label + ']' : Theme.selected(' ' + label + ' ')) : Theme.muted(' ' + label + ' '));
-        const body = [
-            '',
-            '  ' + Theme.bold(this.o.question),
-            ...(this.o.about?.length ? ['', ...paragraphs(this.o.about, size.width)] : []),
-            '',
-            '  ' + button(this.o.yes ?? 'Yes', this.yes, this.o.danger) + '   ' + button(this.o.no ?? 'No', !this.yes),
-        ];
-        return { path: this.o.path, body, keys: [['←→', 'choose'], ['↵', 'confirm'], ['y/n', 'answer'], ['esc', 'no']] };
-    }
-    handle(key) {
-        if (key.name === 'left' || key.name === 'right' || key.name === 'tab') {
-            this.yes = !this.yes;
-            return;
-        }
-        if (key.text?.toLowerCase() === 'y')
-            return { done: true };
-        if (key.text?.toLowerCase() === 'n' || key.name === 'escape')
-            return { done: false };
-        if (key.name === 'return')
-            return { done: this.yes };
-        return;
-    }
-}
-/** Text to read (scrolls); any key but the arrows closes it. */
-export class MessageScreen {
-    o;
-    offset = 0;
-    height = 10;
-    constructor(o) {
-        this.o = o;
-    }
-    render(size) {
-        const paint = this.o.tone === 'ok' ? Theme.ok : this.o.tone === 'warn' ? Theme.warn : this.o.tone === 'error' ? Theme.error : Theme.bold;
-        const head = this.o.title ? ['', '  ' + paint(this.o.title), ''] : [''];
-        const lines = this.o.lines.flatMap((l) => (Text.width(l) > size.width - 4 && Text.strip(l) === l ? Text.wrap(l, size.width - 4) : [l])).map((l) => '  ' + l);
-        this.height = size.height - head.length;
-        this.offset = Math.max(0, Math.min(this.offset, lines.length - this.height));
-        return { path: this.o.path, body: [...head, ...lines.slice(this.offset, this.offset + this.height)], keys: lines.length > this.height ? [['↑↓', 'scroll'], ['↵', 'close']] : [['any key', 'close']] };
-    }
-    handle(key) {
-        if (key.name === 'up') {
-            this.offset--;
-            return;
-        }
-        if (key.name === 'down') {
-            this.offset++;
-            return;
-        }
-        if (key.name === 'pageup') {
-            this.offset -= this.height;
-            return;
-        }
-        if (key.name === 'pagedown') {
-            this.offset += this.height;
-            return;
-        }
-        return { done: undefined };
-    }
-}

package/dist/core/config.js

@@ -1,109 +0,0 @@
-// Built-in defaults and loading the user config (~/.agent-sandbox/config.json). Shapes live in schema.ts.
-import fs from 'node:fs';
-import path from 'node:path';
-import _ from 'lodash';
-import { Config as ConfigSchema, describeIssues } from './schema.js';
-import { fail, homeDir, readJsonc } from './util.js';
-export const DEFAULTS = {
-    defaultHarness: 'claude',
-    guestWorkspace: 'auto',
-    readOnly: false,
-    workspaceFilter: { enabled: false, exclude: [], include: [] },
-    audit: { enabled: false, days: 14, maxMb: 100, processes: true, files: true },
-    mappings: [],
-    sandbox: { memoryMb: 'auto', maxMemoryMb: 32768, maxMemoryPercent: 80, cpuLimit: 80, pageFileMb: 16384, reserveHostMb: 8192, vGpu: false, networking: true, clipboard: true, audioInput: false, videoInput: false, printerRedirection: false, protectedClient: true, headless: false, keepAwake: true },
-    storage: { root: '%LOCALAPPDATA%\\AgentSandbox', persistAgentState: true, dataName: 'default', markSandboxFiles: true, warnDataGb: 50 },
-    network: { blockPrivateRanges: true, allowOnly: [], blockHosts: [], forwardPorts: [], dns: [], proxy: '' },
-    provisioning: { copyFromHost: true, fallbackToInstall: true, refresh: false, git: { enabled: true, access: 'full' }, terminal: { enabled: true }, conpty: { enabled: true } },
-    downloads: { requireChecksum: false },
-    toolchains: {
-        node: { version: 'host', extraVersions: [], corepack: true, volta: 'auto', globalPackages: [] },
-        python: { enabled: 'auto', version: '3', python2: true, pyenv: 'auto', tools: [] },
-        rust: { enabled: 'auto', toolchain: 'stable', host: 'auto', components: [], targets: [], crates: [], targetDir: 'separate' },
-        msvc: { enabled: 'auto', acceptLicense: false, msvcVersion: 'latest', sdkVersion: 'latest' },
-        cpp: { enabled: 'auto', flexBison: true },
-        dotnet: { enabled: 'auto', channels: ['LTS'], tools: [], workloads: [], frameworkTargets: ['net48', 'net472'], netfx35: false },
-        // Bigger downloads only for projects that use them.
-        go: { enabled: 'auto', version: 'stable', tools: [] },
-        java: { enabled: 'auto', version: 'lts', maven: true, gradle: true },
-        ruby: { enabled: 'auto', version: '3', gems: [] },
-        php: { enabled: 'auto', version: '8', composer: true },
-        deno: { enabled: 'auto' },
-        pwsh: { enabled: 'auto' },
-        cli: { gh: 'auto', zstd: false, openssl: 'auto' },
-        bun: { enabled: true },
-        uv: { enabled: true },
-        vcRuntime: { enabled: false },
-        mesa: { enabled: false, vulkan: false },
-        vscode: { enabled: true, setup: true, recommended: true, extensions: [] },
-        environment: {},
-    },
-    databases: {
-        postgres: { enabled: 'auto', version: 'latest', port: 5432 },
-        mysql: { enabled: 'auto', version: 'lts', port: 3306 },
-        mongodb: { enabled: 'auto', version: 'latest', port: 27017 },
-        redis: { enabled: 'auto', port: 6379 },
-        dynamodb: { enabled: 'auto', port: 8000, adminPort: 8001, admin: true },
-        sqlserver: { enabled: 'auto' },
-    },
-    attach: { enabled: true, reuseSession: true, auto: false, autoHide: false },
-    agentCommands: { enabled: false, agents: 'auto' },
-    secrets: { strip: true, allow: [], patterns: [], warnFiles: true },
-    personalization: { enabled: true },
-    apps: { install: [], custom: {} },
-    claudeProfile: { enabled: true, hostDir: 'auto', include: ['settings.json', 'CLAUDE.md', 'commands', 'agents', 'skills', 'plugins'], globalStateFile: 'auto', copyCredentials: false, overwrite: true, syncHistory: true, historyScope: 'project', syncClaudeMem: true, syncClaudeMemBack: false },
-    harnesses: {
-        claude: { hostExecutable: 'claude.exe', hostDir: 'auto', npmPackage: '@anthropic-ai/claude-code@latest', npmBin: 'claude', arguments: [], environment: { DISABLE_AUTOUPDATER: '1' }, resumeArguments: ['--continue'] },
-        codex: { npmPackage: '@openai/codex@latest', npmBin: 'codex', arguments: [], environment: {}, resumeArguments: ['resume', '--last'] },
-        gemini: { npmPackage: '@google/gemini-cli@latest', npmBin: 'gemini', arguments: [], environment: {}, resumeArguments: ['--resume'] },
-        // Not tested by us; installed from each project's official npm / PyPI package.
-        opencode: { npmPackage: 'opencode-ai@latest', npmBin: 'opencode', arguments: [], environment: {}, resumeArguments: ['--continue'] },
-        qwen: { npmPackage: '@qwen-code/qwen-code@latest', npmBin: 'qwen', arguments: [], environment: {}, resumeArguments: ['--continue'] },
-        crush: { npmPackage: '@charmland/crush@latest', npmBin: 'crush', arguments: [], environment: {}, resumeArguments: ['--continue'] },
-        copilot: { npmPackage: '@github/copilot@latest', npmBin: 'copilot', arguments: [], environment: {}, resumeArguments: ['--continue'] },
-        kilo: { npmPackage: '@kilocode/cli@latest', npmBin: 'kilo', arguments: [], environment: {}, resumeArguments: ['--continue'] },
-        amp: { npmPackage: '@ampcode/cli@latest', npmBin: 'amp', arguments: [], environment: {} },
-        cline: { npmPackage: 'cline@latest', npmBin: 'cline', arguments: [], environment: {} },
-        continue: { npmPackage: '@continuedev/cli@latest', npmBin: 'cn', arguments: [], environment: {}, resumeArguments: ['--resume'] },
-        kimi: { npmPackage: '@moonshot-ai/kimi-code@latest', npmBin: 'kimi', arguments: [], environment: {}, resumeArguments: ['-c'] },
-        // DeepSeek has no official coding CLI; these two community agents are built for it.
-        reasonix: { npmPackage: 'reasonix@latest', npmBin: 'reasonix', arguments: [], environment: {} },
-        deepseek: { npmPackage: 'codewhale@latest', npmBin: 'codewhale', arguments: [], environment: {} },
-        aider: { uvPackage: 'aider-chat', uvBin: 'aider', arguments: [], environment: {}, resumeArguments: ['--restore-chat-history'] },
-    },
-    hooks: { failFast: false },
-    projects: { all: false, exclude: [], roots: [], askToAddRoot: true, declinedRoots: [], allowOutsideMappings: 'ask', wsbShare: true },
-};
-/** Per-user folder for config and hooks. Survives reinstalling the npm package. */
-export const userDir = () => process.env.AGENT_SANDBOX_HOME ?? path.join(homeDir(), '.agent-sandbox');
-export const userConfigPath = () => path.join(userDir(), 'config.json');
-/** Deep merge where arrays (and anything that is not a plain object) replace instead of merging element by element. */
-export const mergeConfig = (base, extra) => _.mergeWith(_.cloneDeep(base), extra, (_target, source) => (Array.isArray(source) ? source : undefined));
-/** Validates a full config; throws one readable error listing every problem. */
-export const validateConfig = (config, source) => {
-    const parsed = ConfigSchema.safeParse(config);
-    if (!parsed.success)
-        fail(source + ' is not valid:\n  - ' + describeIssues(parsed.error).join('\n  - '));
-    return parsed.data;
-};
-/**
- * Lookup order: --config, %AGENT_SANDBOX_CONFIG%, ~/.agent-sandbox/config.json, built-in defaults.
- * Whatever file is found (JSON with comments) is merged over the defaults, so it only needs the keys you change.
- */
-export const loadConfig = (explicitPath) => {
-    const requested = explicitPath ?? process.env.AGENT_SANDBOX_CONFIG;
-    const full = path.resolve(requested ?? userConfigPath());
-    if (!fs.existsSync(full)) {
-        if (requested)
-            fail('Config file not found: ' + full, 'Check the --config path or AGENT_SANDBOX_CONFIG, or create one with: sandbox config init');
-        return { config: structuredClone(DEFAULTS), configPath: null, base: userDir() };
-    }
-    return { config: validateConfig(mergeConfig(DEFAULTS, readJsonc(full)), full), configPath: full, base: path.dirname(full) };
-};
-export const assertNoGuestOverlap = (mappings) => {
-    const normal = mappings.map((m) => m.guest.replace(/\\+$/, '').toLowerCase());
-    normal.forEach((a, i) => normal.slice(i + 1).forEach((b, j) => {
-        if (a === b || a.startsWith(b + '\\') || b.startsWith(a + '\\'))
-            fail('Two folders map to overlapping places in the sandbox: ' + mappings[i].guest + ' and ' + mappings[i + 1 + j].guest + '.', 'Give each mapping its own guest folder (one must not be inside the other).');
-    }));
-};

package/dist/core/project-policy.d.ts

@@ -1,62 +0,0 @@
-import type { Config, ResolvedMapping } from './types.js';
-/** The protections of a running sandbox, by setting path (`sandbox.networking`, `provisioning.git.access`, ...). */
-export type Protections = Record<string, boolean | string>;
-export declare const protectionsOf: (config: Config) => Protections;
-export interface JoinCheck {
-    /** Settings this project needs stricter than the running sandbox: the launch is refused. */
-    stricter: string[];
-    /** Settings it would have looser: it gets the sandbox's (stricter) value; shown as a note. */
-    looser: string[];
-    /** Settings the sandbox turned on at its start for another project you allowed them for: shared, shown as a note. */
-    shared: string[];
-}
-/**
- * Compares a project's effective protections with the running sandbox's. Hub projects are always read/write
- * (Windows Sandbox maps the hub once, read/write), so a read-only project counts as stricter. `widened`: the boot
- * settings the sandbox turned on for another of its projects (with your consent); a project that has them off
- * shares them instead of being refused.
- */
-export declare const checkJoin: (running: Protections, wanted: Protections, widened?: string[]) => JoinCheck;
-/** .wsb devices a project may want on (only when your settings or your answer for that project allow it). */
-export declare const BOOT_SETTINGS: string[];
-/** What the running sandbox booted with (host-only registry). */
-export interface BootRecord {
-    memoryMb: number | null;
-    mappings: ResolvedMapping[];
-}
-/** What a project wants that the running sandbox started without. */
-export interface Missing {
-    settings: string[];
-    memoryMb: number | null;
-    mappings: ResolvedMapping[];
-}
-/**
- * The boot-only things `config` (a project's effective config: your settings, its approved file, your answers) asks
- * for that the running sandbox lacks. `exists`: optional mappings whose folder is missing are no wish.
- */
-export declare const missingAtBoot: (running: Protections, boot: BootRecord, config: Config, exists?: (folder: string) => boolean) => Missing;
-export declare const nothingMissing: (m: Missing) => boolean;
-/** "mw2-agent wants vGPU and 2 folders (C:\Steam\..., F:\SteamLibrary\...), but this sandbox started without them." */
-export declare const describeMissing: (project: string, m: Missing) => string;
-/** "Set sandbox.vGpu (or the mappings) in your own settings to have them in every sandbox." */
-export declare const missingTip: (m: Missing) => string;
-/** A project mapped at boot besides the launch folder, with its effective config. */
-export interface BootWant {
-    name: string;
-    config: Config;
-}
-export interface Widened {
-    config: Config;
-    /** Setting -> the project it was turned on for. */
-    widened: Record<string, string>;
-    notes: string[];
-}
-/**
- * The launch folder's config plus what the other projects mapped at boot want: their allowed .wsb devices, a fixed
- * memory size larger than the launch's, and their mappings (placed with every other mapping at launch).
- * `keepOff`: devices the launch folder's own .sandbox-config.json switched off; they stay off.
- */
-export declare const widenForProjects: (launch: Config, others: BootWant[], opts?: {
-    keepOff?: string[];
-    exists?: (folder: string) => boolean;
-}) => Widened;

package/dist/core/project-policy.js

@@ -1,121 +0,0 @@
-// Joining a running sandbox from another project. Its protections (network, LAN block, git access, clipboard, the
-// .wsb device settings, read-only) are machine-wide: they were fixed when the sandbox booted for the first project.
-// A second project may never loosen them, and a project that needs a STRICTER setting than the running sandbox has
-// cannot get it there without changing it for the sessions already running, so that launch is refused with a clear
-// message. A project asking for less than the sandbox has simply runs with the sandbox's (stricter) setting.
-// The other direction: what a project WANTS at boot (a .wsb device you allowed for it, more memory, its mappings) and
-// the running sandbox started without. Those can only come with a restart, so they are named (missingAtBoot), and a
-// sandbox started with several projects boots with all of their allowed wants (widenForProjects).
-// Pure: the host checks it before registering a project, the tests drive it directly.
-import _ from 'lodash';
-import { GIT_STRICTNESS, NEVER_LOOSER, OFF_IS_SAFER, ON_IS_SAFER } from './local-config.js';
-export const protectionsOf = (config) => Object.fromEntries(NEVER_LOOSER.map((p) => [p, _.get(config, p)]));
-/** 1 = `wanted` is stricter than `running`, -1 = looser, 0 = the same. */
-const compare = (setting, running, wanted) => {
-    if (setting === 'provisioning.git.access')
-        return Math.sign((GIT_STRICTNESS[String(wanted)] ?? 0) - (GIT_STRICTNESS[String(running)] ?? 0));
-    if (ON_IS_SAFER.includes(setting))
-        return Number(Boolean(wanted)) - Number(Boolean(running));
-    if (OFF_IS_SAFER.includes(setting))
-        return Number(Boolean(running)) - Number(Boolean(wanted));
-    return 0;
-};
-/**
- * Compares a project's effective protections with the running sandbox's. Hub projects are always read/write
- * (Windows Sandbox maps the hub once, read/write), so a read-only project counts as stricter. `widened`: the boot
- * settings the sandbox turned on for another of its projects (with your consent); a project that has them off
- * shares them instead of being refused.
- */
-export const checkJoin = (running, wanted, widened = []) => {
-    const stricter = [];
-    const looser = [];
-    const shared = [];
-    for (const setting of NEVER_LOOSER) {
-        const result = compare(setting, setting === 'readOnly' ? false : running[setting], wanted[setting]);
-        if (result > 0 && widened.includes(setting))
-            shared.push(setting);
-        else if (result > 0)
-            stricter.push(setting + ' = ' + JSON.stringify(wanted[setting]) + ' (the running sandbox has ' + JSON.stringify(setting === 'readOnly' ? false : running[setting]) + ')');
-        if (result < 0)
-            looser.push(setting + ' stays ' + JSON.stringify(running[setting]));
-    }
-    return { stricter, looser, shared };
-};
-// ---- what a project wants at boot ---------------------------------------------------------------------------------
-/** .wsb devices a project may want on (only when your settings or your answer for that project allow it). */
-export const BOOT_SETTINGS = ['sandbox.vGpu', 'sandbox.networking', 'sandbox.clipboard', 'sandbox.audioInput', 'sandbox.videoInput', 'sandbox.printerRedirection'];
-const LABELS = {
-    'sandbox.vGpu': 'vGPU', 'sandbox.networking': 'networking', 'sandbox.clipboard': 'the shared clipboard',
-    'sandbox.audioInput': 'the microphone', 'sandbox.videoInput': 'the camera', 'sandbox.printerRedirection': 'printers',
-};
-const sameHost = (a, b) => a.toLowerCase().replace(/\\+$/, '') === b.toLowerCase().replace(/\\+$/, '');
-/** `m`'s folder is mapped, wherever the launch placed it (read-only is enough for a read-only wish). */
-const isMapped = (mapped, m) => mapped.some((x) => sameHost(x.host, m.host) && (m.readOnly || !x.readOnly));
-/**
- * The boot-only things `config` (a project's effective config: your settings, its approved file, your answers) asks
- * for that the running sandbox lacks. `exists`: optional mappings whose folder is missing are no wish.
- */
-export const missingAtBoot = (running, boot, config, exists = () => true) => ({
-    settings: BOOT_SETTINGS.filter((s) => _.get(config, s) === true && running[s] === false),
-    memoryMb: typeof config.sandbox.memoryMb === 'number' && boot.memoryMb !== null && config.sandbox.memoryMb > boot.memoryMb ? config.sandbox.memoryMb : null,
-    mappings: config.mappings.filter((m) => (!m.optional || exists(m.host)) && !isMapped(boot.mappings, m)).map((m) => ({ host: m.host, guest: m.guest ?? m.host, readOnly: m.readOnly })),
-});
-export const nothingMissing = (m) => m.settings.length === 0 && m.memoryMb === null && m.mappings.length === 0;
-const listing = (items) => items.length <= 1 ? items.join('') : items.slice(0, -1).join(', ') + ' and ' + items[items.length - 1];
-/** "mw2-agent wants vGPU and 2 folders (C:\Steam\..., F:\SteamLibrary\...), but this sandbox started without them." */
-export const describeMissing = (project, m) => {
-    const items = [
-        ...m.settings.map((s) => LABELS[s] ?? s),
-        ...(m.memoryMb !== null ? [m.memoryMb + ' MB of memory'] : []),
-        ...(m.mappings.length ? [m.mappings.length + ' folder' + (m.mappings.length === 1 ? '' : 's') + ' (' + m.mappings.map((x) => x.host).join(', ') + ')'] : []),
-    ];
-    return project + ' wants ' + listing(items) + ', but this sandbox started without ' + (items.length === 1 && !m.mappings.length ? 'it' : 'them') + '.';
-};
-/** "Set sandbox.vGpu (or the mappings) in your own settings to have them in every sandbox." */
-export const missingTip = (m) => {
-    const keys = [...m.settings, ...(m.memoryMb !== null ? ['sandbox.memoryMb'] : [])];
-    const what = keys.length ? listing(keys) + (m.mappings.length ? ' (or the mappings)' : '') : 'the mappings';
-    return 'Set ' + what + ' in your own settings to have them in every sandbox.';
-};
-/**
- * The launch folder's config plus what the other projects mapped at boot want: their allowed .wsb devices, a fixed
- * memory size larger than the launch's, and their mappings (placed with every other mapping at launch).
- * `keepOff`: devices the launch folder's own .sandbox-config.json switched off; they stay off.
- */
-export const widenForProjects = (launch, others, opts = {}) => {
-    const keepOff = opts.keepOff ?? [];
-    const exists = opts.exists ?? (() => true);
-    const config = _.cloneDeep(launch);
-    const widened = {};
-    const notes = [];
-    for (const setting of BOOT_SETTINGS) {
-        const by = others.find((o) => _.get(o.config, setting) === true);
-        if (!by || _.get(config, setting) === true)
-            continue;
-        if (keepOff.includes(setting)) {
-            notes.push(by.name + ' wants ' + (LABELS[setting] ?? setting) + ', but the launch folder\'s .sandbox-config.json switches it off, so it stays off.');
-            continue;
-        }
-        _.set(config, setting, true);
-        widened[setting] = by.name;
-        notes.push((LABELS[setting] ?? setting) + ' is on in this sandbox (for every project in it): ' + by.name + ' asks for it and you allowed it.');
-    }
-    for (const o of others) {
-        const mem = o.config.sandbox.memoryMb;
-        if (typeof mem === 'number' && typeof config.sandbox.memoryMb === 'number' && mem > config.sandbox.memoryMb)
-            config.sandbox.memoryMb = mem;
-        for (const m of o.config.mappings) {
-            if (config.mappings.some((x) => sameHost(x.host, m.host)))
-                continue;
-            if (m.optional && !exists(m.host))
-                continue;
-            if (!exists(m.host)) {
-                notes.push(o.name + ': mapped folder not found, skipped: ' + m.host);
-                continue;
-            }
-            // Where it appears (and moving it when that place is taken) is decided with every other mapping at launch.
-            config.mappings.push({ ...m, optional: true });
-        }
-    }
-    return { config, widened, notes };
-};

package/dist/core/schema.d.ts

@@ -1,6 +0,0 @@
-export { GitAccess } from './schema/common.js';
-export { Config, LocalOverrides } from './schema/config.js';
-export { Harness } from './schema/harness.js';
-export { describeIssues, jsonSchemas } from './schema/json-schema.js';
-export { Mapping } from './schema/sandbox.js';
-export { Toolchains } from './schema/toolchains.js';

package/dist/core/schema.js

@@ -1,8 +0,0 @@
-// Every setting, defined once with zod, split by area in schema/. This file is the one place the rest of the code (and
-// scripts/schemas.mjs, which generates the JSON Schema files) imports them from.
-export { GitAccess } from './schema/common.js';
-export { Config, LocalOverrides } from './schema/config.js';
-export { Harness } from './schema/harness.js';
-export { describeIssues, jsonSchemas } from './schema/json-schema.js';
-export { Mapping } from './schema/sandbox.js';
-export { Toolchains } from './schema/toolchains.js';

package/dist/core/util.d.ts

@@ -1,62 +0,0 @@
-export declare const isWin: boolean;
-/** An expected problem the user can act on: what went wrong, and (optionally) how to fix it. */
-export declare class UserError extends Error {
-    readonly fix?: string | undefined;
-    constructor(message: string, fix?: string | undefined);
-}
-/** Throws a UserError. Typed explicitly so TypeScript narrows after calls (arrow functions need it to act as never). */
-export declare const fail: (message: string, fix?: string) => never;
-/**
- * Parses JSON with comments and trailing commas (JSONC, like VS Code's settings.json). Errors name the file, line
- * and column, and say what to fix.
- */
-export declare const parseJsonc: <T>(text: string, source: string) => T;
-export declare const readJsonc: <T>(file: string) => T;
-export declare const errMsg: (e: unknown) => string;
-export declare const ensureDir: (p: string) => void;
-export declare const dirExists: (p: string) => boolean;
-export declare const fileExists: (p: string) => boolean;
-export declare const readJson: <T>(p: string) => T;
-export declare const tryReadJson: <T>(p: string) => T | null;
-/** Atomic (a crash or a second command never leaves half a file); refused outside temp during the self-test. */
-export declare const writeJson: (p: string, value: unknown) => void;
-export declare const realPath: (p: string) => string;
-export declare const xmlEscape: (v: string) => string;
-export declare const homeDir: () => string;
-export declare const sleep: (ms: number) => Promise<void>;
-/** Expands %VAR% and resolves relative paths against `base`. */
-export declare const expandPath: (input: string, base: string) => string;
-export declare const isRootPath: (p: string) => boolean;
-export declare const isUserProfile: (p: string) => boolean;
-export declare const isInsideOrEqual: (parent: string, child: string) => boolean;
-/**
- * Text that came from the sandbox, made safe to print: control characters and escape sequences are removed except
- * plain colours (SGR), so nothing written by the sandbox can drive your terminal (titles, clipboard, cursor tricks).
- */
-export declare const safeText: (text: string) => string;
-/** safeText without colours either: for text you are asked to approve, which must not be able to hide parts of itself. */
-export declare const plainText: (text: string) => string;
-export declare const findOnPath: (names: string[]) => string | null;
-/** True if `p` itself is a symlink or junction (lstat; never follows it). */
-export declare const isLink: (p: string) => boolean;
-/** Removes a symlink or junction itself (never its target). Junctions need rmdir on Windows. */
-export declare const removeLink: (p: string) => void;
-/**
- * The sandbox can write anywhere in its data folder, so it could swap a folder for a junction that points at this
- * PC's own disk. Before the host reads, writes or deletes anything under `root`, every existing path component from
- * `root` down to `target` must be a plain folder/file. Throws otherwise.
- */
-export declare const assertNoLinks: (root: string, target: string) => void;
-/** Runs a PowerShell script and returns its exit code (and stdout when `capture`). */
-export declare const runPowerShell: (script: string, capture?: boolean) => {
-    status: number;
-    stdout: string;
-};
-/** Runs a program (an absolute path: `SYSTEM.*`, never a bare name) and returns its stdout, or '' if it failed or timed out. */
-export declare const captureOutput: (file: string, args: string[], options?: {
-    timeout?: number;
-    cwd?: string;
-    maxBuffer?: number;
-}) => string;
-/** Async variant (does not block the event loop), resolving with stdout. */
-export declare const runPowerShellAsync: (script: string) => Promise<string>;