windows-development-sandbox 1.4.1 → 1.4.3

package/dist/host/projects.js

@@ -1,196 +0,0 @@
-// The projects of the running sandbox, and how another folder joins it (shared/projects.ts explains the ways in).
-// Two host-only files under the storage folder, never in the data folder the sandbox can write:
-//  - run\projects.json: the running sandbox's projects, roots and machine-wide protections (written at launch, then
-//    as folders join);
-//  - known-projects.json: every folder this tool has started a project in (for projects.all and `sandbox projects`).
-// Everything about HOW a folder becomes visible is behind ProjectMapper, so the mechanisms can change independently.
-import fs from 'node:fs';
-import path from 'node:path';
-import { z } from 'zod';
-import { assertSafeWorkspace } from '../core/safe-paths.js';
-import { dirExists, fail } from '../core/util.js';
-import { Id } from '../shared/schema.js';
-import { readValid, writeJsonAtomic } from '../shared/rundir.js';
-import { guestDirFor, hubName, isWithin, ownGuestFolder, PROJECTS_GUEST, projectForHostDir } from '../shared/projects.js';
-import { detectWsb, runningSandboxId, shareFolder } from './wsb.js';
-export { PROJECTS_GUEST };
-const AbsolutePath = z.string().max(1024).refine((p) => path.isAbsolute(p), 'must be an absolute path');
-const Entry = z.strictObject({
-    name: Id, host: AbsolutePath, guest: z.string().max(1024), primary: z.boolean(),
-    mechanism: z.enum(['launch', 'root', 'boot', 'wsb']), registeredAt: z.string().max(64),
-});
-const Registry = z.strictObject({
-    launchId: z.string().max(64),
-    /** The running sandbox's protections (core/project-policy.ts), fixed at boot. */
-    protections: z.record(z.string(), z.union([z.boolean(), z.string()])),
-    roots: z.array(z.strictObject({ host: AbsolutePath, guest: z.string().max(1024) })).max(64),
-    projects: z.array(Entry).max(1024),
-    /** What the sandbox booted with that a joining project may also want (missing in registries of 1.4.0 and older). */
-    atBoot: z.strictObject({
-        memoryMb: z.number().int().positive().nullable(),
-        mappings: z.array(z.strictObject({ host: z.string().max(1024), guest: z.string().max(1024), readOnly: z.boolean() })).max(1024),
-        /** Boot settings turned on for a project mapped at boot (setting -> project): other projects share them. */
-        widened: z.record(z.string().max(100), z.string().max(100)),
-    }).optional(),
-});
-const registryFile = (storageRoot) => path.join(storageRoot, 'run', 'projects.json');
-export const readRegistry = (storageRoot) => readValid(Registry, registryFile(storageRoot));
-const saveRegistry = (storageRoot, registry) => writeJsonAtomic(registryFile(storageRoot), registry);
-/** At launch: the launch folder, the projects mapped with it, and the roots. */
-export const startRegistry = (storageRoot, o) => {
-    const at = new Date().toISOString();
-    const primary = { name: hubName(o.primary.host, []), host: o.primary.host, guest: o.primary.guest, primary: true, mechanism: 'launch', registeredAt: at };
-    const names = [primary.name];
-    const boot = o.boot.map((b) => { const name = hubName(b.host, names); names.push(name); return { name, host: b.host, guest: b.guest, primary: false, mechanism: 'boot', registeredAt: at }; });
-    saveRegistry(storageRoot, { launchId: o.launchId, protections: o.protections, roots: o.roots, projects: [primary, ...boot], ...(o.atBoot ? { atBoot: o.atBoot } : {}) });
-    return primary;
-};
-/** Reads the memory and mapped folders back from a .wsb this tool wrote (host-only launch folder; bounded). */
-export const parseWsbBoot = (xml) => {
-    const text = xml.slice(0, 1_000_000);
-    const unescape = (s) => s.replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&apos;/g, '\'').replace(/&amp;/g, '&');
-    const mappings = [...text.matchAll(/<MappedFolder><HostFolder>([^<]{1,1024})<\/HostFolder><SandboxFolder>([^<]{1,1024})<\/SandboxFolder><ReadOnly>(true|false)<\/ReadOnly><\/MappedFolder>/g)]
-        .slice(0, 1024).map((m) => ({ host: unescape(m[1]), guest: unescape(m[2]), readOnly: m[3] === 'true' }));
-    const memory = /<MemoryInMB>(\d{1,7})<\/MemoryInMB>/.exec(text);
-    return { memoryMb: memory ? Number(memory[1]) : null, mappings, widened: {} };
-};
-/**
- * What the running sandbox booted with. A sandbox started by 1.4.0 or older has no record: it is read from the .wsb in
- * its launch folder (host-only storage) and recorded. null when neither is there.
- */
-export const bootRecordOf = (storageRoot, launchPath) => {
-    const registry = readRegistry(storageRoot);
-    if (!registry)
-        return null;
-    if (registry.atBoot)
-        return registry.atBoot;
-    if (!launchPath)
-        return null;
-    let xml;
-    try {
-        xml = fs.readFileSync(path.join(launchPath, 'agent.wsb'), 'utf8');
-    }
-    catch {
-        return null;
-    }
-    const atBoot = parseWsbBoot(xml);
-    try {
-        saveRegistry(storageRoot, { ...registry, atBoot });
-    }
-    catch { /* the record is a convenience */ }
-    return atBoot;
-};
-/**
- * Why a folder cannot join the running sandbox without a restart (the caller offers one). With `missing`: it could
- * join, but you chose to restart for what it wants at boot (core/project-policy.ts).
- */
-export class NeedsRestart extends Error {
-    hostDir;
-    reason;
-    missing;
-    constructor(hostDir, reason, missing) {
-        super(reason);
-        this.hostDir = hostDir;
-        this.reason = reason;
-        this.missing = missing;
-    }
-}
-/** Roots first (instant), then `wsb share` where the Windows Sandbox CLI exists, else NeedsRestart. */
-export const projectMapper = (o) => {
-    const registry = () => readRegistry(o.storageRoot) ?? fail('The running sandbox was started by an older version, so it cannot take another folder.', 'Stop it (sandbox stop) and start it again.');
-    const add = (reg, host, guest, mechanism, name) => {
-        const entry = { name, host, guest, primary: false, mechanism, registeredAt: new Date().toISOString() };
-        // Re-read right before writing: another terminal may have registered something meanwhile.
-        const latest = readRegistry(o.storageRoot) ?? reg;
-        const same = latest.projects.find((p) => p.host.toLowerCase() === host.toLowerCase());
-        if (same)
-            return same;
-        saveRegistry(o.storageRoot, { ...latest, projects: [...latest.projects, entry] });
-        return entry;
-    };
-    return {
-        list: () => readRegistry(o.storageRoot)?.projects ?? [],
-        register: (hostDir) => {
-            const host = path.resolve(hostDir);
-            const reg = registry();
-            const known = reg.projects.find((p) => p.host.toLowerCase() === host.toLowerCase());
-            if (known)
-                return known;
-            assertSafeWorkspace(host, o.packageRoot, o.storageRoot);
-            if (!dirExists(host))
-                fail('The folder does not exist: ' + host);
-            const name = hubName(host, reg.projects.map((p) => p.name));
-            // Inside a root: visible already (also a project created after the sandbox started).
-            const root = projectForHostDir(reg.roots, host);
-            if (root)
-                return add(reg, host, guestDirFor(root, host), 'root', name);
-            if (!o.wsbShare)
-                throw new NeedsRestart(host, 'it is not inside a project root (projects.roots), and adding folders with wsb share is off (projects.wsbShare)');
-            const wsb = (o.detect ?? detectWsb)();
-            if (!wsb?.has('share'))
-                throw new NeedsRestart(host, 'it is not inside a project root (projects.roots), and this Windows has no Windows Sandbox command line (wsb share needs Windows 11 24H2+ with the updated Windows Sandbox)');
-            const sandbox = runningSandboxId(wsb);
-            if (!sandbox.id)
-                throw new NeedsRestart(host, 'wsb share could not find the running sandbox: ' + sandbox.error);
-            // Where it is as a launch folder too (C:\Workspace\<name>), unless another project already uses that place.
-            const guest = ownGuestFolder(host, false, [...reg.projects.map((p) => p.guest), ...reg.roots.map((r) => r.guest)]);
-            const shared = shareFolder(wsb, sandbox.id, host, guest);
-            if (!shared.ok)
-                throw new NeedsRestart(host, 'wsb share failed (untested on this Windows): ' + shared.error);
-            return add(reg, host, guest, 'wsb', name);
-        },
-        unregister: (name) => {
-            const reg = registry();
-            const entry = reg.projects.find((p) => p.name.toLowerCase() === name.toLowerCase());
-            if (!entry)
-                fail('No project "' + name + '" in the running sandbox.', 'sandbox projects lists them.');
-            if (entry.primary)
-                fail(entry.host + ' is the folder the sandbox started from; it stays until the sandbox stops.');
-            saveRegistry(o.storageRoot, { ...reg, projects: reg.projects.filter((p) => p !== entry) });
-        },
-    };
-};
-export const projectHere = (storageRoot, hostDir) => {
-    const project = projectForHostDir(readRegistry(storageRoot)?.projects ?? [], hostDir);
-    return project ? { project, guestDir: guestDirFor(project, hostDir) } : null;
-};
-/** The running sandbox's root containing this folder, if any. */
-export const rootHere = (storageRoot, hostDir) => projectForHostDir(readRegistry(storageRoot)?.roots ?? [], hostDir);
-// ---- known projects (every folder a project was started in) ------------------------------------------------------
-const Known = z.strictObject({ projects: z.array(z.strictObject({ host: AbsolutePath, lastUsed: z.string().max(64) })).max(2000) });
-const knownFile = (storageRoot) => path.join(storageRoot, 'known-projects.json');
-export const readKnown = (storageRoot) => readValid(Known, knownFile(storageRoot))?.projects ?? [];
-export const rememberProject = (storageRoot, hostDir) => {
-    const host = path.resolve(hostDir);
-    const rest = readKnown(storageRoot).filter((p) => p.host.toLowerCase() !== host.toLowerCase());
-    try {
-        writeJsonAtomic(knownFile(storageRoot), { projects: [{ host, lastUsed: new Date().toISOString() }, ...rest].slice(0, 2000) });
-    }
-    catch { /* a convenience list */ }
-};
-export const forgetProject = (storageRoot, hostDir) => {
-    const host = path.resolve(hostDir);
-    const all = readKnown(storageRoot);
-    const rest = all.filter((p) => p.host.toLowerCase() !== host.toLowerCase());
-    if (rest.length !== all.length)
-        writeJsonAtomic(knownFile(storageRoot), { projects: rest });
-    return rest.length !== all.length;
-};
-/**
- * projects.all: the known projects mapped at boot on their own (existing folders, not excluded, not the launch folder,
- * not inside it or a root, which already show them). Pure apart from checking that the folders exist.
- */
-export const allProjectsToMap = (known, o) => {
-    const exists = o.exists ?? dirExists;
-    const out = [];
-    for (const host of known.map((k) => path.resolve(k))) {
-        if (o.exclude.some((e) => isWithin(path.resolve(e), host)))
-            continue;
-        if (isWithin(o.primary, host) || o.roots.some((r) => isWithin(r, host)))
-            continue;
-        if (out.some((x) => isWithin(x, host) || isWithin(host, x)) || !exists(host))
-            continue;
-        out.push(host);
-    }
-    return out;
-};

package/dist/host/repo-guard.d.ts

@@ -1,43 +0,0 @@
-/** A git folder's own state: config lines, hooks, redirect files. */
-export interface GitState {
-    config: string[];
-    hooks: Record<string, string>;
-    redirects: string[];
-}
-export interface RepoSnapshot extends GitState {
-    gitDir: boolean;
-    commands: Record<string, string>;
-    /** Fingerprints of AGENT_FILES (missing in snapshots of older versions: then they are not checked). */
-    agent?: Record<string, string>;
-    /** Other git folders: submodules (.git/modules/...) and repositories nested in the project, by relative path. */
-    repos?: Record<string, GitState>;
-}
-export interface RepoFinding {
-    kind: 'hook' | 'config' | 'git' | 'command' | 'agent';
-    detail: string;
-}
-export declare const snapshotRepo: (workspace: string) => RepoSnapshot;
-/**
- * Compares the workspace with its pre-launch snapshot and neutralises anything new that would execute on this PC.
- * Returns what was found (and fixed). Never touches what was already there before the sandbox ran.
- */
-export declare const guardRepo: (workspace: string, before: RepoSnapshot) => RepoFinding[];
-/**
- * At launch: every folder the sandbox will be able to write. The launch folder, projects mapped with it and every
- * project already inside a project root are snapshotted as they are now, before the sandbox can touch them.
- */
-export declare const saveRepoSnapshot: (dataPath: string, workspace: string, more?: string[], roots?: string[]) => void;
-/**
- * A project that joins the running sandbox: snapshotted before its first session, then guarded like the launch
- * folder. A project already guarded keeps its first snapshot (what was there before the sandbox could touch it).
- */
-export declare const addRepoSnapshot: (dataPath: string, workspace: string, o?: {
-    empty?: boolean;
-}) => void;
-/** The folders being guarded (for status). */
-export declare const guardedProjects: (dataPath: string) => string[];
-/** Re-checks every project of the current/last launch; findings are kept in a host-only file for `status`. Returns the new ones. */
-export declare const checkRepo: (dataPath: string) => RepoFinding[];
-export declare const repoFindings: (dataPath: string) => (RepoFinding & {
-    at?: string;
-})[];

package/dist/host/repo-guard.js

@@ -1,347 +0,0 @@
-// Zero-click protection for the folder the sandbox shares with this PC.
-//
-// The agent can write the workspace. Two kinds of change there would run code on THIS PC without you doing anything
-// unusual, so they are snapshotted before launch, re-checked every minute while the sandbox runs and when it closes,
-// and neutralised:
-//  - git: new or changed hooks, and config that makes git run programs (core.fsmonitor, core.sshCommand, filters,
-//    include.path, ...), plus files that redirect where git reads config and hooks (commondir, config.worktree);
-//  - commands: executables dropped in the project root under the name of something you type there (node.exe,
-//    git.cmd, npm.cmd, ...), because Windows runs a program from the current folder before searching PATH;
-//  - agent and editor files: hooks, helper commands and MCP servers in .claude/ and .mcp.json, VS Code folder-open
-//    tasks and program paths, .envrc. Submodules and nested repositories get the git checks too.
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import path from 'node:path';
-import _ from 'lodash';
-import { z } from 'zod';
-import { parse as parseJsonc } from 'jsonc-parser';
-import { readValid, writeFileAtomic, writeJsonAtomic } from '../shared/rundir.js';
-import { assertTestWritable } from './test-guard.js';
-import { dirExists, fileExists, isLink } from '../core/util.js';
-/** Config keys that make git run a program, or load more config. */
-const DANGEROUS_KEY = /^(fsmonitor|hookspath|sshcommand|pager|editor|askpass|program|gpgprogram|textconv|command|cmd|clean|smudge|process|driver|helper|uploadpack|receivepack|path|attributesfile|excludesfile|worktree|worktreeconfig|gitproxy|proxycommand|sendemailvalidate|tool|external|difffilter|defaultkeycommand|alternaterefscommand)\s*=/i;
-/** Sections where any key runs a program ([pager] log = x), or where a "!" value does ([alias] st = !x). */
-const dangerousInSection = (section, keyPart) => (section === 'pager' && keyPart.includes('=')) || (section === 'alias' && /^[^=]+=\s*"?\s*!/.test(keyPart));
-const SECTION = /^\s*\[([^\]]*)\]\s*/;
-const MARK = '# [agent-sandbox] disabled, added inside the sandbox: ';
-/** Files in .git that make git read config/hooks from somewhere else. */
-const REDIRECTS = ['commondir', 'config.worktree'];
-/** Names you are likely to run in a project folder; with any of these extensions Windows would pick the local copy. */
-const COMMANDS = new RegExp('^(' + [
-    // this tool's own commands (package.json "bin")
-    'sandbox', 'windows-development-sandbox', 'agent-sandbox', 'claude-sbx', 'claude-sandbox', 'codex-sbx', 'codex-sandbox', 'gemini-sbx', 'gemini-sandbox', 'claude-host', 'sbx-show', 'sbx-hide',
-    // agents
-    'claude', 'codex', 'gemini', 'opencode', 'qwen', 'crush', 'copilot', 'kilo', 'kilocode', 'amp', 'cline', 'cn', 'kimi', 'reasonix', 'codewhale', 'aider', 'cursor-agent', 'agent', 'goose',
-    // toolchains and everyday tools
-    'node', 'npm', 'npx', 'pnpm', 'pnpx', 'yarn', 'corepack', 'volta', 'nvm', 'deno', 'bun', 'bunx', 'tsc', 'git', 'gh', 'code', 'python', 'python3', 'py', 'pip', 'pip3', 'uv', 'uvx', 'pyenv', 'poetry',
-    'cargo', 'rustc', 'rustup', 'dotnet', 'nuget', 'msbuild', 'go', 'java', 'javac', 'mvn', 'mvnw', 'gradle', 'gradlew', 'ruby', 'gem', 'bundle', 'rake', 'rails', 'php', 'composer',
-    'make', 'cmake', 'ninja', 'gcc', 'g\\+\\+', 'clang', 'psql', 'mysql', 'mariadb', 'mongosh', 'redis-cli', 'docker', 'kubectl', 'terraform', 'az', 'aws',
-    'powershell', 'pwsh', 'cmd', 'where', 'tasklist', 'tar', 'curl', 'ssh', 'scp',
-].join('|') + ')\\.(exe|com|bat|cmd|vbs|vbe|js|jse|wsf|wsh|msc|ps1)$', 'i');
-/**
- * Project files that tools on this PC act on by themselves: Claude Code runs a project's hooks, helpers and MCP servers,
- * VS Code runs folder-open tasks and the programs workspace settings point at, direnv runs .envrc. For each, only the
- * part that can run something is compared (`risky`), so the agent may still edit the rest (permissions, formatting).
- */
-const AGENT_FILES = {
-    '.claude/settings.json': (d) => claudeRisk(d),
-    '.claude/settings.local.json': (d) => claudeRisk(d),
-    '.mcp.json': (_d, text) => text,
-    '.vscode/tasks.json': (d) => JSON.stringify(d).match(/"runOn"\s*:\s*"folderOpen"/) ? d : null,
-    '.vscode/settings.json': (d) => _.pickBy(_.isPlainObject(d) ? d : {}, (_v, k) => /path|executable|command|interpreter|shell|profile|args|env|exec|program|server|launch|runtime|binary/i.test(k)),
-    '.envrc': (_d, text) => text,
-};
-const claudeRisk = (d) => {
-    const s = (_.isPlainObject(d) ? d : {});
-    const permissions = (_.isPlainObject(s.permissions) ? s.permissions : {});
-    return { ..._.pick(s, ['hooks', 'apiKeyHelper', 'awsAuthRefresh', 'awsCredentialExport', 'otelHeadersHelper', 'statusLine', 'env', 'enableAllProjectMcpServers', 'enabledMcpjsonServers', 'disableAllHooks']), permissions: _.pick(permissions, ['defaultMode', 'additionalDirectories']) };
-};
-const MAX_AGENT_FILE_BYTES = 1024 * 1024;
-/** What can run in one agent file, as a short fingerprint (null = the file is not there). */
-const agentRisk = (workspace, rel) => {
-    const file = path.join(workspace, ...rel.split('/'));
-    if (!fs.existsSync(file))
-        return null;
-    if (isLink(file) || isLink(path.dirname(file)) || !fileExists(file))
-        return 'link-or-not-a-file';
-    if (fs.statSync(file).size > MAX_AGENT_FILE_BYTES)
-        return 'too-large-' + hash(file);
-    const text = fs.readFileSync(file, 'utf8');
-    const errors = [];
-    const data = parseJsonc(text, errors, { allowTrailingComma: true });
-    const risk = AGENT_FILES[rel](rel === '.envrc' ? null : data, text);
-    return crypto.createHash('sha256').update(JSON.stringify(risk ?? null) + (errors.length && rel !== '.envrc' && rel !== '.mcp.json' ? hash(file) : '')).digest('hex');
-};
-const agentSnapshot = (workspace) => Object.fromEntries(Object.keys(AGENT_FILES).flatMap((rel) => { const r = agentRisk(workspace, rel); return r ? [[rel, r]] : []; }));
-/** SHA-256 in small chunks: a sandbox can plant a multi-gigabyte "node.exe" to exhaust this PC's memory. */
-const hash = (file) => {
-    if (isLink(file))
-        return 'link';
-    const sum = crypto.createHash('sha256');
-    const buffer = Buffer.alloc(1 << 20);
-    let fd;
-    // A file that cannot be read (locked by a program in the sandbox) never matches the snapshot, so it is dealt with.
-    try {
-        fd = fs.openSync(file, 'r');
-    }
-    catch {
-        return 'unreadable-' + crypto.randomBytes(4).toString('hex');
-    }
-    try {
-        for (let n = fs.readSync(fd, buffer, 0, buffer.length, null); n > 0; n = fs.readSync(fd, buffer, 0, buffer.length, null))
-            sum.update(buffer.subarray(0, n));
-    }
-    finally {
-        fs.closeSync(fd);
-    }
-    return sum.digest('hex');
-};
-const MAX_CONFIG_BYTES = 4 * 1024 * 1024;
-const plainGitDir = (workspace) => {
-    const dir = path.join(workspace, '.git');
-    return dirExists(dir) && !isLink(dir) ? dir : null;
-};
-const filesIn = (dir, accept) => dirExists(dir) && !isLink(dir)
-    ? Object.fromEntries(fs.readdirSync(dir, { withFileTypes: true }).filter((e) => (e.isFile() || e.isSymbolicLink()) && accept(e.name)).map((e) => [e.name, hash(path.join(dir, e.name))]))
-    : {};
-const configLines = (dir) => {
-    const file = path.join(dir, 'config');
-    return fileExists(file) && !isLink(file) && fs.statSync(file).size <= MAX_CONFIG_BYTES ? fs.readFileSync(file, 'utf8').split(/\r?\n/) : [];
-};
-const gitState = (dir) => ({
-    config: dir ? configLines(dir) : [],
-    hooks: dir ? filesIn(path.join(dir, 'hooks'), (n) => !n.endsWith('.sample')) : {},
-    redirects: dir ? REDIRECTS.filter((n) => fs.existsSync(path.join(dir, n))) : [],
-});
-const EMPTY_GIT = { config: [], hooks: {}, redirects: [] };
-const MAX_OTHER_REPOS = 64;
-const SKIP_DIRS = new Set(['node_modules', '.git', 'agent-sandbox-quarantine', 'target', 'dist', 'build', 'bin', 'obj', '.venv', 'venv']);
-const plainDirs = (dir, limit) => {
-    try {
-        return fs.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.isSymbolicLink()).slice(0, limit).map((e) => path.join(dir, e.name));
-    }
-    catch {
-        return [];
-    }
-};
-/**
- * Git folders other than the project's own: submodules (.git/modules/**) and repositories nested up to two levels deep.
- * git runs their hooks and config too (git status in a subfolder, VS Code's repository scan). Bounded: links are never
- * followed and at most MAX_OTHER_REPOS are looked at.
- */
-const otherGitDirs = (workspace) => {
-    const found = [];
-    const main = plainGitDir(workspace);
-    // Submodules: a folder with a config and a HEAD is a git folder, and may have modules of its own.
-    const walk = (dir, depth) => {
-        for (const d of plainDirs(dir, 200)) {
-            if (found.length >= MAX_OTHER_REPOS)
-                return;
-            if (fileExists(path.join(d, 'config')) && fileExists(path.join(d, 'HEAD'))) {
-                found.push(d);
-                if (depth < 3)
-                    walk(path.join(d, 'modules'), depth + 1);
-            }
-            else if (depth < 3)
-                walk(d, depth + 1);
-        }
-    };
-    if (main)
-        walk(path.join(main, 'modules'), 0);
-    for (const sub of plainDirs(workspace, 500).filter((d) => !SKIP_DIRS.has(path.basename(d).toLowerCase()))) {
-        for (const candidate of [sub, ...plainDirs(sub, 200).filter((d) => !SKIP_DIRS.has(path.basename(d).toLowerCase()))]) {
-            if (found.length >= MAX_OTHER_REPOS)
-                return found;
-            const git = plainGitDir(candidate);
-            if (git)
-                found.push(git);
-        }
-    }
-    return found;
-};
-const relative = (workspace, dir) => path.relative(workspace, dir).split(path.sep).join('/');
-export const snapshotRepo = (workspace) => {
-    const dir = plainGitDir(workspace);
-    return {
-        gitDir: dir !== null,
-        ...gitState(dir),
-        commands: filesIn(workspace, (n) => COMMANDS.test(n)),
-        agent: agentSnapshot(workspace),
-        repos: Object.fromEntries(otherGitDirs(workspace).map((d) => [relative(workspace, d), gitState(d)])),
-    };
-};
-/** Moves files into <dir>\agent-sandbox-quarantine\<time>\ and reports them. */
-const quarantine = (from, names, into, kind) => {
-    if (names.length === 0)
-        return [];
-    const target = path.join(into, 'agent-sandbox-quarantine', String(Date.now()));
-    fs.mkdirSync(target, { recursive: true });
-    return names.map((name) => {
-        try {
-            fs.renameSync(path.join(from, name), path.join(target, name));
-        }
-        catch (e) {
-            return { kind, detail: name + ' (could not be moved: ' + e.code + '; delete it yourself before running anything here)' };
-        }
-        return { kind, detail: name + ' (moved to ' + target + ')' };
-    });
-};
-/** Comments out newly added config lines that make git run programs. Existing lines are never touched. */
-const disableConfig = (dir, before) => {
-    const lines = configLines(dir);
-    const known = _.countBy(before);
-    const seen = {};
-    const findings = [];
-    let inInclude = false;
-    let section = '';
-    const fixed = lines.map((line) => {
-        const header = SECTION.exec(line);
-        if (header) {
-            section = header[1].trim().toLowerCase().split(/\s/)[0];
-            inInclude = /^include(if\s+"[^"]*")?$/i.test(header[1].trim());
-        }
-        seen[line] = (seen[line] ?? 0) + 1;
-        if (line.startsWith(MARK) || seen[line] <= (known[line] ?? 0))
-            return line;
-        // git also accepts "[core] fsmonitor = x" on one line, so look past a leading section header.
-        const keyPart = line.replace(SECTION, '').trim();
-        if (!(DANGEROUS_KEY.test(keyPart) || (inInclude && keyPart.includes('=')) || dangerousInSection(section, keyPart)))
-            return line;
-        findings.push({ kind: 'config', detail: line.trim() });
-        return MARK + line.trim();
-    });
-    if (findings.length)
-        writeFileAtomic(path.join(dir, 'config'), fixed.join('\n'));
-    const file = path.join(dir, 'config');
-    // A link or a huge file is not read at all, so say so instead of letting it pass as "nothing found".
-    const unchecked = isLink(file) ? '.git/config is a link' : lines.length === 0 && fileExists(file) && fs.statSync(file).size > MAX_CONFIG_BYTES ? '.git/config is over 4 MB' : null;
-    if (unchecked)
-        findings.push({ kind: 'git', detail: unchecked + ', so it cannot be checked. Do not run git in this folder until you have looked at it.' });
-    return findings;
-};
-/**
- * Compares the workspace with its pre-launch snapshot and neutralises anything new that would execute on this PC.
- * Returns what was found (and fixed). Never touches what was already there before the sandbox ran.
- */
-export const guardRepo = (workspace, before) => {
-    assertTestWritable(workspace);
-    const findings = [];
-    const commandsNow = filesIn(workspace, (n) => COMMANDS.test(n));
-    findings.push(...quarantine(workspace, Object.keys(commandsNow).filter((n) => before.commands[n] !== commandsNow[n]), workspace, 'command'));
-    // Snapshots from before these checks existed have no baseline: checking against nothing would move your own files.
-    if (before.agent)
-        findings.push(...guardAgentFiles(workspace, before.agent));
-    if (before.repos) {
-        for (const other of otherGitDirs(workspace)) {
-            const rel = relative(workspace, other);
-            findings.push(...guardGitDir(other, before.repos[rel] ?? EMPTY_GIT).map((f) => ({ ...f, detail: rel + ': ' + f.detail })));
-        }
-    }
-    const dir = plainGitDir(workspace);
-    if (!dir) {
-        const replaced = before.gitDir && fs.existsSync(path.join(workspace, '.git'));
-        if (replaced)
-            findings.push({ kind: 'git', detail: '.git was replaced by a link or a "gitdir:" file inside the sandbox. Do not run git in ' + workspace + ' until you have checked it.' });
-        return findings;
-    }
-    findings.push(...guardGitDir(dir, before));
-    return findings;
-};
-const guardGitDir = (dir, before) => {
-    const hooksDir = path.join(dir, 'hooks');
-    const hooksNow = filesIn(hooksDir, (n) => !n.endsWith('.sample'));
-    return [
-        ...quarantine(hooksDir, Object.keys(hooksNow).filter((n) => before.hooks[n] !== hooksNow[n]), dir, 'hook'),
-        ...quarantine(dir, REDIRECTS.filter((n) => fs.existsSync(path.join(dir, n)) && !before.redirects.includes(n)), dir, 'git'),
-        ...disableConfig(dir, before.config),
-    ];
-};
-/** Agent files whose runnable part changed are moved to the quarantine folder (the rest of your edits are in there too). */
-const guardAgentFiles = (workspace, before) => {
-    const changed = Object.keys(AGENT_FILES).filter((rel) => { const now = agentRisk(workspace, rel); return now !== null && now !== before[rel]; });
-    if (!changed.length)
-        return [];
-    const target = path.join(workspace, 'agent-sandbox-quarantine', String(Date.now()));
-    fs.mkdirSync(target, { recursive: true });
-    return changed.map((rel) => {
-        const what = rel + ' (the sandbox added something it would run on this PC: hooks, MCP servers, helper commands or tasks';
-        try {
-            fs.renameSync(path.join(workspace, ...rel.split('/')), path.join(target, rel.replace(/\//g, '_')));
-        }
-        catch (e) {
-            return { kind: 'agent', detail: what + '; could not be moved: ' + e.code + '. Check it before you open this folder in Claude Code or VS Code)' };
-        }
-        return { kind: 'agent', detail: what + '; moved to ' + target + ')' };
-    });
-};
-// ---- snapshot storage (host-only, next to the sync state) ---------------------------------------------------------
-const syncDir = (dataPath) => path.join(path.dirname(path.dirname(dataPath)), 'sync');
-const snapshotFile = (dataPath) => path.join(syncDir(dataPath), path.basename(dataPath) + '-repo.json');
-const findingsFile = (dataPath) => path.join(syncDir(dataPath), path.basename(dataPath) + '-repo-findings.json');
-const Finding = z.object({ kind: z.enum(['hook', 'config', 'git', 'command', 'agent']), detail: z.string().max(4096), at: z.string().max(64).optional() });
-const GitStateSchema = z.object({ config: z.array(z.string()), hooks: z.record(z.string(), z.string()), redirects: z.array(z.string()) });
-const Saved = z.object({
-    workspace: z.string().max(1024).refine((p) => path.isAbsolute(p)),
-    snapshot: GitStateSchema.extend({ gitDir: z.boolean(), commands: z.record(z.string(), z.string()), agent: z.record(z.string(), z.string()).optional(), repos: z.record(z.string(), GitStateSchema).optional() }),
-});
-const Store = z.strictObject({ projects: z.array(Saved).max(4096), roots: z.array(z.string().max(1024).refine((p) => path.isAbsolute(p))).max(64) });
-const StoreAny = z.union([Store, Saved.transform((s) => ({ projects: [s], roots: [] }))]);
-const readStore = (dataPath) => readValid(StoreAny, snapshotFile(dataPath)) ?? { projects: [], roots: [] };
-const EMPTY = { gitDir: false, config: [], hooks: {}, redirects: [], commands: {}, agent: {}, repos: {} };
-const MAX_ROOT_PROJECTS = 2000;
-/** The folders directly inside a project root (plain folders only; links are never followed). */
-const rootProjects = (root) => {
-    if (!dirExists(root) || isLink(root))
-        return [];
-    return fs.readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.isSymbolicLink()).slice(0, MAX_ROOT_PROJECTS).map((e) => path.join(root, e.name));
-};
-const has = (projects, workspace) => projects.some((s) => s.workspace.toLowerCase() === workspace.toLowerCase());
-/**
- * At launch: every folder the sandbox will be able to write. The launch folder, projects mapped with it and every
- * project already inside a project root are snapshotted as they are now, before the sandbox can touch them.
- */
-export const saveRepoSnapshot = (dataPath, workspace, more = [], roots = []) => {
-    const folders = _.uniqBy([workspace, ...more, ...roots.flatMap((r) => [r, ...rootProjects(r)])], (w) => w.toLowerCase());
-    writeJsonAtomic(snapshotFile(dataPath), { projects: folders.map((w) => ({ workspace: w, snapshot: snapshotRepo(w) })), roots });
-};
-/**
- * A project that joins the running sandbox: snapshotted before its first session, then guarded like the launch
- * folder. A project already guarded keeps its first snapshot (what was there before the sandbox could touch it).
- */
-export const addRepoSnapshot = (dataPath, workspace, o = {}) => {
-    const store = readStore(dataPath);
-    // A folder inside one that is guarded already is covered by it only for its root files; it gets its own entry.
-    if (has(store.projects, workspace))
-        return;
-    writeJsonAtomic(snapshotFile(dataPath), { ...store, projects: [...store.projects, { workspace, snapshot: o.empty ? EMPTY : snapshotRepo(workspace) }] });
-};
-/**
- * Folders that appeared inside a project root after the launch: the sandbox could have written them from the start,
- * so they get an EMPTY baseline: any git hook, git config that runs programs (core.hooksPath, core.fsmonitor, ...)
- * or planted command in them counts as added inside the sandbox and is neutralised.
- */
-const discoverRootProjects = (dataPath) => {
-    const store = readStore(dataPath);
-    const found = store.roots.flatMap(rootProjects).filter((w) => !has(store.projects, w)).map((workspace) => ({ workspace, snapshot: EMPTY }));
-    if (!found.length)
-        return store.projects;
-    const projects = [...store.projects, ...found].slice(0, 4096);
-    writeJsonAtomic(snapshotFile(dataPath), { ...store, projects });
-    return projects;
-};
-/** The folders being guarded (for status). */
-export const guardedProjects = (dataPath) => readStore(dataPath).projects.map((s) => s.workspace);
-/** Re-checks every project of the current/last launch; findings are kept in a host-only file for `status`. Returns the new ones. */
-export const checkRepo = (dataPath) => {
-    const saved = discoverRootProjects(dataPath);
-    if (!saved.length)
-        return [];
-    const old = repoFindings(dataPath);
-    // A finding that cannot be fixed (a file locked in the sandbox) is reported once, not every minute.
-    const findings = saved.flatMap((s) => guardRepo(s.workspace, s.snapshot).map((f) => (saved.length > 1 ? { ...f, detail: s.workspace + ': ' + f.detail } : f)))
-        .filter((f) => !old.some((o) => o.kind === f.kind && o.detail === f.detail));
-    if (findings.length)
-        writeJsonAtomic(findingsFile(dataPath), [...old, ...findings.map((f) => ({ ...f, at: new Date().toISOString() }))]);
-    return findings;
-};
-export const repoFindings = (dataPath) => readValid(z.array(Finding).max(10000), findingsFile(dataPath)) ?? [];

package/dist/host/secrets.d.ts

@@ -1,14 +0,0 @@
-import type { Config } from '../core/types.js';
-export type SecretsConfig = Config['secrets'];
-export declare const isSecretName: (name: string, secrets: SecretsConfig) => boolean;
-export declare const isSecretValue: (value: string) => boolean;
-/** Whether a variable (name and value) may go into the sandbox. secrets.allow always wins. */
-export declare const mayPass: (name: string, value: unknown, secrets: SecretsConfig) => boolean;
-/** A copy of an env/headers map without the secrets; the names removed are added to `removed` (with `where`). */
-export declare const stripVariables: (vars: unknown, secrets: SecretsConfig, where: string, removed: string[]) => unknown;
-/** settings.json for the sandbox: secrets out of "env", credential helper commands removed. */
-export declare const stripSettings: (settings: Record<string, unknown>, secrets: SecretsConfig, removed: string[]) => Record<string, unknown>;
-/** Every MCP server in a .claude.json-shaped object (top level and per project). */
-export declare const stripMcpServers: (state: Record<string, unknown>, secrets: SecretsConfig, removed: string[]) => Record<string, unknown>;
-/** Secret-looking files in the workspace root and one folder down (skipping dependency folders). */
-export declare const findSecretFiles: (workspace: string) => string[];