windows-development-sandbox 1.4.1 → 1.5.0

package/dist/core/util.d.ts

@@ -1,62 +0,0 @@
-export declare const isWin: boolean;
-/** An expected problem the user can act on: what went wrong, and (optionally) how to fix it. */
-export declare class UserError extends Error {
-    readonly fix?: string | undefined;
-    constructor(message: string, fix?: string | undefined);
-}
-/** Throws a UserError. Typed explicitly so TypeScript narrows after calls (arrow functions need it to act as never). */
-export declare const fail: (message: string, fix?: string) => never;
-/**
- * Parses JSON with comments and trailing commas (JSONC, like VS Code's settings.json). Errors name the file, line
- * and column, and say what to fix.
- */
-export declare const parseJsonc: <T>(text: string, source: string) => T;
-export declare const readJsonc: <T>(file: string) => T;
-export declare const errMsg: (e: unknown) => string;
-export declare const ensureDir: (p: string) => void;
-export declare const dirExists: (p: string) => boolean;
-export declare const fileExists: (p: string) => boolean;
-export declare const readJson: <T>(p: string) => T;
-export declare const tryReadJson: <T>(p: string) => T | null;
-/** Atomic (a crash or a second command never leaves half a file); refused outside temp during the self-test. */
-export declare const writeJson: (p: string, value: unknown) => void;
-export declare const realPath: (p: string) => string;
-export declare const xmlEscape: (v: string) => string;
-export declare const homeDir: () => string;
-export declare const sleep: (ms: number) => Promise<void>;
-/** Expands %VAR% and resolves relative paths against `base`. */
-export declare const expandPath: (input: string, base: string) => string;
-export declare const isRootPath: (p: string) => boolean;
-export declare const isUserProfile: (p: string) => boolean;
-export declare const isInsideOrEqual: (parent: string, child: string) => boolean;
-/**
- * Text that came from the sandbox, made safe to print: control characters and escape sequences are removed except
- * plain colours (SGR), so nothing written by the sandbox can drive your terminal (titles, clipboard, cursor tricks).
- */
-export declare const safeText: (text: string) => string;
-/** safeText without colours either: for text you are asked to approve, which must not be able to hide parts of itself. */
-export declare const plainText: (text: string) => string;
-export declare const findOnPath: (names: string[]) => string | null;
-/** True if `p` itself is a symlink or junction (lstat; never follows it). */
-export declare const isLink: (p: string) => boolean;
-/** Removes a symlink or junction itself (never its target). Junctions need rmdir on Windows. */
-export declare const removeLink: (p: string) => void;
-/**
- * The sandbox can write anywhere in its data folder, so it could swap a folder for a junction that points at this
- * PC's own disk. Before the host reads, writes or deletes anything under `root`, every existing path component from
- * `root` down to `target` must be a plain folder/file. Throws otherwise.
- */
-export declare const assertNoLinks: (root: string, target: string) => void;
-/** Runs a PowerShell script and returns its exit code (and stdout when `capture`). */
-export declare const runPowerShell: (script: string, capture?: boolean) => {
-    status: number;
-    stdout: string;
-};
-/** Runs a program (an absolute path: `SYSTEM.*`, never a bare name) and returns its stdout, or '' if it failed or timed out. */
-export declare const captureOutput: (file: string, args: string[], options?: {
-    timeout?: number;
-    cwd?: string;
-    maxBuffer?: number;
-}) => string;
-/** Async variant (does not block the event loop), resolving with stdout. */
-export declare const runPowerShellAsync: (script: string) => Promise<string>;

package/dist/core/util.js

@@ -1,156 +0,0 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawn, spawnSync } from 'node:child_process';
-import { SYSTEM } from '../shared/system.js';
-import { writeJsonAtomic } from '../shared/rundir.js';
-import { assertTestWritable } from '../shared/test-guard.js';
-import { parse as parseJsoncText, printParseErrorCode } from 'jsonc-parser';
-export const isWin = process.platform === 'win32';
-/** An expected problem the user can act on: what went wrong, and (optionally) how to fix it. */
-export class UserError extends Error {
-    fix;
-    constructor(message, fix) {
-        super(message);
-        this.fix = fix;
-        this.name = 'UserError';
-    }
-}
-/** Throws a UserError. Typed explicitly so TypeScript narrows after calls (arrow functions need it to act as never). */
-export const fail = (message, fix) => { throw new UserError(message, fix); };
-/**
- * Parses JSON with comments and trailing commas (JSONC, like VS Code's settings.json). Errors name the file, line
- * and column, and say what to fix.
- */
-export const parseJsonc = (text, source) => {
-    const errors = [];
-    const value = parseJsoncText(text.replace(/^/, ''), errors, { allowTrailingComma: true, disallowComments: false });
-    if (errors.length) {
-        const { offset, error } = errors[0];
-        const before = text.slice(0, offset).split(/\r?\n/);
-        fail(source + ' is not valid JSON (line ' + before.length + ', column ' + (before[before.length - 1].length + 1) + ': ' + printParseErrorCode(error) + ').', 'Fix that spot in the file. Comments (// and /* */) and trailing commas are fine.');
-    }
-    return value;
-};
-export const readJsonc = (file) => parseJsonc(fs.readFileSync(file, 'utf8'), file);
-export const errMsg = (e) => e instanceof Error ? e.message : String(e);
-export const ensureDir = (p) => { fs.mkdirSync(p, { recursive: true }); };
-export const dirExists = (p) => { try {
-    return fs.statSync(p).isDirectory();
-}
-catch {
-    return false;
-} };
-export const fileExists = (p) => { try {
-    return fs.statSync(p).isFile();
-}
-catch {
-    return false;
-} };
-export const readJson = (p) => JSON.parse(fs.readFileSync(p, 'utf8').replace(/^\uFEFF/, ''));
-export const tryReadJson = (p) => { try {
-    return readJson(p);
-}
-catch {
-    return null;
-} };
-/** Atomic (a crash or a second command never leaves half a file); refused outside temp during the self-test. */
-export const writeJson = (p, value) => writeJsonAtomic(p, value);
-export const realPath = (p) => { try {
-    return fs.realpathSync(p);
-}
-catch {
-    return p;
-} };
-export const xmlEscape = (v) => v.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&apos;');
-export const homeDir = () => process.env.USERPROFILE ?? os.homedir();
-export const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-/** Expands %VAR% and resolves relative paths against `base`. */
-export const expandPath = (input, base) => {
-    const expanded = input.replace(/%([^%]+)%/g, (_m, name) => process.env[name] ?? '%' + name + '%').replace(/^~(?=$|[\\/])/, homeDir());
-    return path.resolve(path.isAbsolute(expanded) ? expanded : path.join(base, expanded));
-};
-export const isRootPath = (p) => { const n = path.resolve(p); return n.toLowerCase() === path.parse(n).root.toLowerCase(); };
-export const isUserProfile = (p) => { const profile = process.env.USERPROFILE ?? process.env.HOME ?? ''; return profile !== '' && path.resolve(p).toLowerCase() === path.resolve(profile).toLowerCase(); };
-export const isInsideOrEqual = (parent, child) => {
-    const rel = path.relative(path.resolve(parent).toLowerCase(), path.resolve(child).toLowerCase());
-    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
-};
-/**
- * Text that came from the sandbox, made safe to print: control characters and escape sequences are removed except
- * plain colours (SGR), so nothing written by the sandbox can drive your terminal (titles, clipboard, cursor tricks).
- */
-export const safeText = (text) => text.replace(/\x1b\[[0-9;]*m|\x1b(\[[0-9;?]*[ -\/]*[@-~]|\][^\x07\x1b]*(\x07|\x1b\\)|[@-Z\\-_])|[\x00-\x08\x0b-\x1f\x7f-\x9f]/g, (m) => (/^\x1b\[[0-9;]*m$/.test(m) ? m : ''));
-/** safeText without colours either: for text you are asked to approve, which must not be able to hide parts of itself. */
-export const plainText = (text) => safeText(text).replace(/\x1b\[[0-9;]*m/g, '');
-export const findOnPath = (names) => {
-    const dirs = (process.env.PATH ?? process.env.Path ?? '').split(path.delimiter).filter((d) => d !== '');
-    for (const name of names)
-        for (const dir of dirs) {
-            const candidate = path.join(dir, name);
-            if (fileExists(candidate))
-                return candidate;
-        }
-    return null;
-};
-/** True if `p` itself is a symlink or junction (lstat; never follows it). */
-export const isLink = (p) => { try {
-    return fs.lstatSync(p).isSymbolicLink();
-}
-catch {
-    return false;
-} };
-/** Removes a symlink or junction itself (never its target). Junctions need rmdir on Windows. */
-export const removeLink = (p) => { assertTestWritable(p); try {
-    fs.unlinkSync(p);
-}
-catch {
-    fs.rmdirSync(p);
-} };
-/**
- * The sandbox can write anywhere in its data folder, so it could swap a folder for a junction that points at this
- * PC's own disk. Before the host reads, writes or deletes anything under `root`, every existing path component from
- * `root` down to `target` must be a plain folder/file. Throws otherwise.
- */
-export const assertNoLinks = (root, target) => {
-    const rel = path.relative(path.resolve(root), path.resolve(target));
-    if (rel.startsWith('..') || path.isAbsolute(rel))
-        fail('Refusing to touch ' + target + ': it is outside ' + root);
-    let current = path.resolve(root);
-    for (const part of ['', ...rel.split(path.sep).filter(Boolean)]) {
-        current = part ? path.join(current, part) : current;
-        if (isLink(current))
-            fail('Refusing to touch ' + target + ': ' + current + ' is a link (possible escape attempt from the sandbox).');
-    }
-};
-/**
- * PowerShell arguments for a script passed encoded (no quoting issues, no progress-bar noise on stderr). Output is
- * UTF-8: Windows PowerShell 5.1 otherwise writes redirected stdout in the OEM code page, mangling non-ASCII (regional
- * date formats, wallpaper paths). UTF8Encoding($false): no byte-order mark in front of the output.
- */
-const powerShellArgs = (script) => {
-    const prelude = "[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding $false\n$ProgressPreference = 'SilentlyContinue'\n";
-    const encoded = Buffer.from(prelude + script, 'utf16le').toString('base64');
-    // -OutputFormat Text: with redirected output PowerShell would otherwise print its progress stream as "#< CLIXML" XML.
-    return ['-NoLogo', '-NoProfile', '-NonInteractive', '-OutputFormat', 'Text', '-ExecutionPolicy', 'Bypass', '-EncodedCommand', encoded];
-};
-/** Runs a PowerShell script and returns its exit code (and stdout when `capture`). */
-export const runPowerShell = (script, capture = false) => {
-    const result = spawnSync(SYSTEM.powershell(), powerShellArgs(script), { stdio: capture ? ['ignore', 'pipe', 'inherit'] : 'inherit', encoding: 'utf8', windowsHide: true });
-    if (result.error)
-        throw result.error;
-    return { status: result.status ?? 1, stdout: result.stdout ?? '' };
-};
-/** Runs a program (an absolute path: `SYSTEM.*`, never a bare name) and returns its stdout, or '' if it failed or timed out. */
-export const captureOutput = (file, args, options = {}) => {
-    const result = spawnSync(file, args, { encoding: 'utf8', windowsHide: true, timeout: 60000, ...options });
-    return result.status === 0 ? result.stdout ?? '' : '';
-};
-/** Async variant (does not block the event loop), resolving with stdout. */
-export const runPowerShellAsync = (script) => new Promise((resolve, reject) => {
-    const child = spawn(SYSTEM.powershell(), powerShellArgs(script), { stdio: ['ignore', 'pipe', 'inherit'], windowsHide: true });
-    let out = '';
-    child.stdout.on('data', (d) => { out += d.toString('utf8'); });
-    child.on('error', reject);
-    child.on('close', () => resolve(out));
-});

package/dist/core/workspace.d.ts

@@ -1,35 +0,0 @@
-import type { Config, Mapping, Overrides, ResolvedRun, RunRequest, ToolVersions } from './types.js';
-/** 'auto' guest workspace: C:\Workspace\<folder name> (shared/projects.ts, where every project's place is decided). */
-export declare const autoGuestWorkspace: (hostDir: string) => string;
-/**
- * A launch folder inside a project root appears under the root's folder (C:\Projects\<root>\<name>, or its PC path
- * with "mirror"), where it also is when another project started the sandbox, so git worktrees and Claude's project
- * folders keep working whichever project starts it. Only for "auto" / "mirror"; a filtered or read-only workspace
- * keeps its own mapping (the root would show the folder unfiltered and writable at that place).
- */
-export declare const placeInRoot: (config: Config, workspaceHost: string, mirror: boolean, notes: string[]) => Config;
-/** The Node version a Volta project pins ("volta": { "node": "20.11.1" } in package.json), so nvm defaults to it too. */
-export declare const voltaNode: (workspace: string) => string | null;
-/**
- * Picks tool versions. Highest priority first: command line, the folder's .sandbox-config.json,
- * version files in the workspace (.nvmrc, .node-version, .python-version), the tool config, this PC's node version.
- */
-export declare const resolveVersions: (config: Config, workspace: string, local: Overrides, req: {
-    nodeVersion?: string;
-    pythonVersion?: string;
-}, hostNodeVersion: string) => ToolVersions;
-/** Precedence (lowest to highest): built-in defaults, user config, .sandbox-config.json in the workspace, command-line flags. */
-export declare const resolveRun: (req: RunRequest, hostNodeVersion?: string) => Promise<ResolvedRun>;
-/** Where the workspace appears: guestWorkspace "auto", "mirror" (with a note when it falls back) or a path. */
-export declare const guestWorkspaceOf: (config: Pick<Config, "guestWorkspace">, workspaceHost: string) => {
-    guest: string;
-    note: string | null;
-};
-/**
- * Where a mapping will most likely appear, before the launch knows every other folder (the prompt and config check
- * show it; the launch places it for real in host/launch/mappings.ts with the same rules).
- */
-export declare const previewGuest: (m: Pick<Mapping, "host" | "guest">, workspaceHost: string, workspaceGuest: string) => {
-    guest: string;
-    note: string | null;
-};

package/dist/core/workspace.js

@@ -1,206 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { z } from 'zod';
-import { deriveGuest, placeGuest, planMirrorWorkspace } from '../shared/guest-paths.js';
-import { autoGuestFolder, PROJECTS_GUEST, rootGuestDir, usableRoots } from '../shared/projects.js';
-import { DATABASES } from './detect-databases.js';
-import { allowedAnswer, allowRequests, allowStorePath, applyOverrides, describeOverrides, isTrusted, LOCAL_CONFIG_NAME, loosenedRequests, normalizeOverrides, OUTSIDE_FOLDER, outsideKey, outsideMappings, readLocalConfig, saveAllowed, saveTrust, trustStorePath } from './local-config.js';
-import { assertSafeWorkspace } from './safe-paths.js';
-import { dirExists, expandPath, fail, fileExists, isInsideOrEqual, plainText } from './util.js';
-/** 'auto' guest workspace: C:\Workspace\<folder name> (shared/projects.ts, where every project's place is decided). */
-export const autoGuestWorkspace = autoGuestFolder;
-/**
- * A launch folder inside a project root appears under the root's folder (C:\Projects\<root>\<name>, or its PC path
- * with "mirror"), where it also is when another project started the sandbox, so git worktrees and Claude's project
- * folders keep working whichever project starts it. Only for "auto" / "mirror"; a filtered or read-only workspace
- * keeps its own mapping (the root would show the folder unfiltered and writable at that place).
- */
-export const placeInRoot = (config, workspaceHost, mirror, notes) => {
-    const guest = rootGuestDir(usableRoots(config.projects.roots, dirExists), mirror, workspaceHost);
-    if (!guest)
-        return config;
-    if (config.workspaceFilter.enabled || config.readOnly) {
-        notes.push(workspaceHost + ' is inside a project root, but ' + (config.readOnly ? 'readOnly' : 'workspaceFilter') + ' is on, so it is mapped on its own at ' + config.guestWorkspace + ' (when another project starts the sandbox it is at ' + guest + ').');
-        return config;
-    }
-    return { ...config, guestWorkspace: guest };
-};
-const firstLine = (file) => {
-    if (!fileExists(file))
-        return null;
-    const line = fs.readFileSync(file, 'utf8').replace(/^/, '').split(/\r?\n/).map((l) => l.replace(/#.*$/, '').trim()).find((l) => l !== '');
-    return line ?? null;
-};
-const VOLTA_PIN = 'package.json volta.node';
-const PackageJson = z.object({ volta: z.object({ node: z.string().regex(/^\d+(\.\d+){0,2}$/).optional() }).optional() });
-/** The Node version a Volta project pins ("volta": { "node": "20.11.1" } in package.json), so nvm defaults to it too. */
-export const voltaNode = (workspace) => {
-    const file = path.join(workspace, 'package.json');
-    if (!fileExists(file))
-        return null;
-    try {
-        return PackageJson.safeParse(JSON.parse(fs.readFileSync(file, 'utf8').replace(/^/, ''))).data?.volta?.node ?? null;
-    }
-    catch {
-        return null;
-    }
-};
-/**
- * Picks tool versions. Highest priority first: command line, the folder's .sandbox-config.json,
- * version files in the workspace (.nvmrc, .node-version, .python-version), the tool config, this PC's node version.
- */
-export const resolveVersions = (config, workspace, local, req, hostNodeVersion) => {
-    const localTools = (local.toolchains ?? {});
-    const pick = (cli, localValue, files, configured) => {
-        if (cli)
-            return { spec: cli, source: 'command line' };
-        if (localValue)
-            return { spec: localValue, source: '.sandbox-config.json' };
-        for (const name of files) {
-            const value = name === VOLTA_PIN ? voltaNode(workspace) : firstLine(path.join(workspace, name));
-            if (value)
-                return { spec: value, source: name };
-        }
-        return { spec: configured, source: 'config' };
-    };
-    let node = pick(req.nodeVersion, localTools.node?.version, ['.nvmrc', '.node-version', VOLTA_PIN], config.toolchains.node.version);
-    if (node.spec === 'host')
-        node = { spec: hostNodeVersion.replace(/^v/, ''), source: 'this PC' };
-    const python = pick(req.pythonVersion, localTools.python?.version, ['.python-version'], config.toolchains.python.version);
-    return { node, nodeExtra: config.toolchains.node.extraVersions, python };
-};
-/** Precedence (lowest to highest): built-in defaults, user config, .sandbox-config.json in the workspace, command-line flags. */
-export const resolveRun = async (req, hostNodeVersion = process.version) => {
-    const notes = [];
-    // Mappings from the user config are relative to that config file; expand them before anything else uses them.
-    const expand = (list) => list.map((p) => expandPath(p, req.loaded.base));
-    const projects = req.loaded.config.projects;
-    let config = {
-        ...req.loaded.config,
-        mappings: req.loaded.config.mappings.map((m) => ({ ...m, host: expandPath(m.host, req.loaded.base) })),
-        projects: { ...projects, roots: expand(projects.roots), exclude: expand(projects.exclude), declinedRoots: expand(projects.declinedRoots) },
-    };
-    const mirror = config.guestWorkspace === 'mirror';
-    const storageRoot = expandPath(config.storage.root, req.loaded.base);
-    const workspaceHost = path.resolve(req.workspace ?? req.cwd);
-    if (!dirExists(workspaceHost))
-        fail('The workspace folder does not exist: ' + workspaceHost, 'Check the --workspace path, or cd into the project first.');
-    assertSafeWorkspace(workspaceHost, req.packageRoot, storageRoot);
-    const scripts = [];
-    let localConfigPath = null;
-    let overrides = {};
-    const local = req.noLocalConfig ? null : readLocalConfig(workspaceHost);
-    let outsideAllowed = [];
-    if (local) {
-        overrides = normalizeOverrides(local.data, workspaceHost, local.path);
-        const store = trustStorePath(storageRoot);
-        if (!isTrusted(store, local.path, local.hash)) {
-            const summary = describeOverrides(overrides, workspaceHost);
-            let trusted = req.trustConfig;
-            if (!trusted && req.ask) {
-                console.log('\nFound ' + local.path + ' which is not trusted yet. It would apply:');
-                for (const line of summary)
-                    console.log('  ' + plainText(line));
-                trusted = await req.ask('Trust and use this file?');
-            }
-            if (!trusted)
-                fail(local.path + ' has not been approved yet (a repo can ship this file, so it needs your OK). It would apply:\n  ' + (summary.map(plainText).join('\n  ') || '(no changes)'), 'Review it, then run again in an interactive terminal and answer y, or add --trust-config. To ignore the file: --no-local-config');
-            saveTrust(store, local.path, local.hash);
-            notes.push('Trusted ' + local.path + ' (you will only be asked again if the file changes).');
-        }
-        // A project may only tighten. What it asks for beyond that (a looser setting, a folder outside the project) is used
-        // only if you allowed it for this project: asked once, in one question, at an interactive launch, never by
-        // --trust-config. Folders outside the project follow projects.allowOutsideMappings (your settings only). A looser
-        // setting you did not allow is named in the notes instead of dropped silently.
-        const allowStore = allowStorePath(storageRoot);
-        const policy = config.projects.allowOutsideMappings;
-        // An optional folder that is not on this PC is skipped at launch, so it needs no answer (yet).
-        const outside = outsideMappings(workspaceHost, overrides.mappings).filter((m) => !m.optional || dirExists(m.host));
-        const name = path.basename(workspaceHost) + '\'s ' + LOCAL_CONFIG_NAME;
-        const preview = guestWorkspaceOf(applyOverrides(config, overrides), workspaceHost).guest;
-        const describe = (m) => (m.readOnly ? 'read-only  ' : 'READ/WRITE ') + m.host + '  ->  ' + previewGuest(m, workspaceHost, preview).guest;
-        if (outside.length && policy === false) {
-            fail(name + ' maps ' + outside.length + ' folder' + (outside.length === 1 ? '' : 's') + ' outside the project, and your settings do not allow that:\n  ' + outside.map(describe).join('\n  '), 'Allow it: set projects.allowOutsideMappings to "ask" or true in your settings (sandbox > Settings, or the file sandbox config path shows). Or remove those mappings from the file.');
-        }
-        const looser = loosenedRequests(config, overrides);
-        const interactive = Boolean(req.ask) && (req.interactive ?? Boolean(process.stdin.isTTY));
-        const openOutside = policy === 'ask' ? outside.filter((m) => allowedAnswer(allowStore, local.path, OUTSIDE_FOLDER, outsideKey(m)) !== true) : [];
-        const openLooser = looser.filter((a) => allowedAnswer(allowStore, local.path, a.key, a.wanted) === null);
-        let declinedOutside = false;
-        if (interactive && req.ask && (openOutside.length || openLooser.length)) {
-            console.log('\n' + name + ' asks for more than your settings allow:');
-            if (openOutside.length)
-                console.log('  Folders outside the project:\n' + openOutside.map((m) => '    ' + plainText(describe(m))).join('\n'));
-            for (const a of openLooser)
-                console.log('  ' + a.key + ' = ' + JSON.stringify(a.wanted) + '  (your settings: ' + JSON.stringify(a.yours) + ')');
-            const ok = await req.ask('Allow ' + (openOutside.length + openLooser.length === 1 ? 'it' : 'these') + ' for this project?');
-            for (const a of openLooser)
-                saveAllowed(allowStore, local.path, a.key, a.wanted, ok);
-            // A "no" to folders is not kept: the next interactive launch asks again.
-            if (ok)
-                for (const m of openOutside)
-                    saveAllowed(allowStore, local.path, OUTSIDE_FOLDER, outsideKey(m), true);
-            declinedOutside = !ok && openOutside.length > 0;
-        }
-        const notAllowed = policy === 'ask' ? outside.filter((m) => allowedAnswer(allowStore, local.path, OUTSIDE_FOLDER, outsideKey(m)) !== true) : [];
-        if (notAllowed.length) {
-            const what = name + ' maps ' + notAllowed.length + ' folder' + (notAllowed.length === 1 ? '' : 's') + ' outside the project:\n  ' + notAllowed.map(describe).join('\n  ');
-            fail(what + (declinedOutside ? '\nYou did not allow ' + (notAllowed.length === 1 ? 'it' : 'them') + ', so the sandbox was not started.' : '\nThat needs your OK once (a repo ships this file), and this launch cannot ask (no interactive terminal).'), 'Allow ' + (notAllowed.length === 1 ? 'it' : 'them') + ': start it from an interactive terminal and answer y, or set projects.allowOutsideMappings to true in your settings (sandbox > Settings, or the file sandbox config path shows).');
-        }
-        outsideAllowed = [...new Set(outside.map((m) => m.host))];
-        if (outside.length)
-            notes.push('Folders outside the project allowed for ' + name + ' (' + (policy === true ? 'projects.allowOutsideMappings is true' : 'your answer is kept in ' + allowStore) + '): ' + outsideAllowed.join(', '));
-        const allowed = [];
-        for (const ask of looser) {
-            const ok = allowedAnswer(allowStore, local.path, ask.key, ask.wanted);
-            if (ok) {
-                allowed.push(ask);
-                notes.push('Allowed for this project: ' + ask.key + ' = ' + JSON.stringify(ask.wanted) + ' (your answer is kept in ' + allowStore + ').');
-            }
-            else
-                notes.push('The project asks for ' + ask.key + ' = ' + JSON.stringify(ask.wanted) + ', but your settings say ' + JSON.stringify(ask.yours) + ', so it is not used. ' + (ok === false ? 'You said no (kept in ' + allowStore + ').' : 'Start it from an interactive terminal to allow it for this project.') + ' Or set ' + ask.key + ' in your own settings (sandbox, then Settings > All projects).');
-        }
-        config = applyOverrides(allowRequests(config, allowed), overrides);
-        scripts.push(...(overrides.scripts ?? []));
-        localConfigPath = local.path;
-        notes.push('Using ' + local.path);
-    }
-    if (req.headless !== undefined)
-        config = { ...config, sandbox: { ...config.sandbox, headless: req.headless } };
-    for (const name of req.databases ?? []) {
-        const db = name.toLowerCase();
-        if (!DATABASES.includes(db))
-            fail('Unknown database "' + name + '".', 'Choose from: ' + DATABASES.join(', '));
-        config = { ...config, databases: { ...config.databases, [db]: { ...config.databases[db], enabled: true } } };
-    }
-    // auto / mirror: a project inside a root is where the root shows it, whichever project starts the sandbox.
-    const guest = guestWorkspaceOf(config, workspaceHost);
-    const placed = config.guestWorkspace === 'auto' || mirror ? placeInRoot({ ...config, guestWorkspace: guest.guest }, workspaceHost, mirror, notes) : { ...config, guestWorkspace: guest.guest };
-    if (guest.note && placed.guestWorkspace === guest.guest)
-        notes.push(guest.note);
-    config = placed;
-    scripts.push(...req.scripts.map((s) => path.resolve(s)));
-    const harnessName = req.noAgent ? 'none' : (req.harness ?? config.defaultHarness);
-    if (harnessName !== 'none' && !config.harnesses[harnessName])
-        fail('Unknown agent "' + harnessName + '".', 'Configured agents: ' + Object.keys(config.harnesses).join(', ') + ' (add more under "harnesses" in your config).');
-    const versions = resolveVersions(config, workspaceHost, overrides, req, hostNodeVersion);
-    const dataPath = path.join(storageRoot, 'data', config.storage.dataName);
-    // A project file may ask for "mirror" too (it decides only its own path); project roots follow the user's choice.
-    return { config, storageRoot, dataPath, workspaceHost, harnessName, scripts, localConfigPath, notes, versions, mirror, outsideMappings: outsideAllowed };
-};
-/** Where the workspace appears: guestWorkspace "auto", "mirror" (with a note when it falls back) or a path. */
-export const guestWorkspaceOf = (config, workspaceHost) => {
-    if (config.guestWorkspace === 'auto')
-        return { guest: autoGuestWorkspace(workspaceHost), note: null };
-    if (config.guestWorkspace === 'mirror')
-        return planMirrorWorkspace(workspaceHost, autoGuestWorkspace(workspaceHost));
-    return { guest: config.guestWorkspace, note: null };
-};
-/**
- * Where a mapping will most likely appear, before the launch knows every other folder (the prompt and config check
- * show it; the launch places it for real in host/launch/mappings.ts with the same rules).
- */
-export const previewGuest = (m, workspaceHost, workspaceGuest) => placeGuest(m.host, m.guest ?? deriveGuest(m.host, workspaceHost, workspaceGuest), [
-    ...(m.guest || !isInsideOrEqual(workspaceHost, m.host) ? [{ guest: workspaceGuest, what: 'the project' }] : []),
-    { guest: PROJECTS_GUEST, what: 'other projects' },
-]);

package/dist/guest/audit-parse.d.ts

@@ -1,7 +0,0 @@
-/** Background programs of Windows itself: never what an agent ran. */
-export declare const NOISE: Set<string>;
-/** The events in wevtutil's XML output as audit lines, with the newest record id seen. */
-export declare const parseProcessEvents: (xml: string) => {
-    lines: string[];
-    last: number;
-};

package/dist/guest/audit-parse.js

@@ -1,24 +0,0 @@
-// Reading Windows process-creation events (Security log, 4688, as wevtutil prints them) into audit lines. Pure, so
-// the self-test can check it on the PC side.
-import path from 'node:path';
-/** Background programs of Windows itself: never what an agent ran. */
-export const NOISE = new Set(['conhost.exe', 'svchost.exe', 'backgroundtaskhost.exe', 'runtimebroker.exe', 'wmiprvse.exe', 'dllhost.exe', 'searchprotocolhost.exe', 'searchfilterhost.exe', 'taskhostw.exe', 'sppsvc.exe', 'wermgr.exe', 'consent.exe', 'smartscreen.exe', 'mpcmdrun.exe', 'compattelrunner.exe', 'wevtutil.exe', 'audiodg.exe', 'ctfmon.exe', 'sihost.exe', 'werfault.exe', 'msmpeng.exe', 'nissrv.exe', 'usoclient.exe', 'musnotification.exe']);
-const decode = (s) => s.replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, '&');
-const field = (event, name) => decode(new RegExp("<Data Name='" + name + "'>([^<]*)</Data>").exec(event)?.[1] ?? '');
-/** The events in wevtutil's XML output as audit lines, with the newest record id seen. */
-export const parseProcessEvents = (xml) => {
-    const lines = [];
-    let last = 0;
-    for (const event of xml.split('</Event>')) {
-        const id = Number(/<EventRecordID>(\d+)<\/EventRecordID>/.exec(event)?.[1] ?? 0);
-        if (!id)
-            continue;
-        last = Math.max(last, id);
-        const program = field(event, 'NewProcessName');
-        if (!program || NOISE.has(path.win32.basename(program).toLowerCase()))
-            continue;
-        const t = /SystemTime='([^']+)'/.exec(event)?.[1] ?? new Date().toISOString();
-        lines.push(JSON.stringify({ t, k: 'proc', p: program.slice(0, 1024), c: field(event, 'CommandLine').slice(0, 2000), pp: field(event, 'ParentProcessName').slice(0, 1024) }));
-    }
-    return { lines, last };
-};

package/dist/guest/audit.d.ts

@@ -1,4 +0,0 @@
-/** Turns on process-creation auditing with command lines (the registry is new every boot). */
-export declare const enableProcessAudit: () => void;
-/** Reads new process events every 15 s for the daemon's life (from the moment it started: older ones are boot noise). */
-export declare const startProcessCollector: () => void;

package/dist/guest/audit.js

@@ -1,47 +0,0 @@
-// audit.processes, sandbox side: Windows records every program started (Security log, event 4688, with its command
-// line); the daemon reads the new events every 15 s and leaves them in run\audit\ as small .jsonl files, which the
-// host takes into its own log (and deletes). Windows' own background programs are left out. The host treats all of it
-// as untrusted (it is checked line by line there).
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { SYSTEM } from '../shared/system.js';
-import { parseProcessEvents } from './audit-parse.js';
-import { dryRun, errMsg, isWin, log, mkdirp, run, session, warn } from './env.js';
-/** The "Process Creation" audit subcategory (a GUID, so it works in every Windows language). */
-const PROCESS_CREATION = '{0CCE922B-69AE-11D9-BED3-505054503030}';
-const MAX_PER_PASS = 2000;
-const auditOn = () => Boolean(session.auditProcesses) && isWin && !dryRun;
-/** Turns on process-creation auditing with command lines (the registry is new every boot). */
-export const enableProcessAudit = () => {
-    if (!auditOn())
-        return;
-    spawnSync(path.join(process.env.WINDIR ?? 'C:\\Windows', 'System32', 'auditpol.exe'), ['/set', '/subcategory:' + PROCESS_CREATION, '/success:enable'], { windowsHide: true, stdio: 'ignore' });
-    spawnSync(SYSTEM.reg(), ['add', 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Audit', '/v', 'ProcessCreationIncludeCmdLine_Enabled', '/t', 'REG_DWORD', '/d', '1', '/f'], { windowsHide: true, stdio: 'ignore' });
-    log('Audit: programs started in the sandbox are recorded (audit.processes).');
-};
-const wevtutil = () => path.join(process.env.WINDIR ?? 'C:\\Windows', 'System32', 'wevtutil.exe');
-const newestRecord = () => {
-    const r = spawnSync(wevtutil(), ['qe', 'Security', '/q:*[System[(EventID=4688)]]', '/f:xml', '/c:1', '/rd:true'], { encoding: 'utf8', windowsHide: true });
-    return parseProcessEvents(r.stdout ?? '').last;
-};
-/** Reads new process events every 15 s for the daemon's life (from the moment it started: older ones are boot noise). */
-export const startProcessCollector = () => {
-    if (!auditOn())
-        return;
-    let last = newestRecord();
-    const pass = () => {
-        try {
-            const r = spawnSync(wevtutil(), ['qe', 'Security', '/q:*[System[(EventID=4688) and (EventRecordID>' + last + ')]]', '/f:xml', '/c:' + MAX_PER_PASS], { encoding: 'utf8', windowsHide: true, maxBuffer: 64 * 1024 * 1024 });
-            const { lines, last: newest } = parseProcessEvents(r.stdout ?? '');
-            if (newest)
-                last = newest;
-            if (lines.length)
-                fs.writeFileSync(path.join(mkdirp(run.audit), Date.now() + '-' + process.pid + '.jsonl'), lines.join('\n') + '\n');
-        }
-        catch (e) {
-            warn('audit: ' + errMsg(e));
-        }
-    };
-    setInterval(pass, 15000).unref?.();
-};

package/dist/guest/boot-env.d.ts

@@ -1,4 +0,0 @@
-import { type BootEnvT } from './project-env.js';
-export { baseEnvFor, type BootEnvT } from './project-env.js';
-export declare const saveBootEnv: (value: BootEnvT) => void;
-export declare const readBootEnv: () => BootEnvT | null;

package/dist/guest/boot-env.js

@@ -1,25 +0,0 @@
-// What the boot's provisioning left for projects that join later: the PATH before any toolchain was added, which
-// variables the toolchains set, and what each step contributed. Kept on the sandbox's own disk (lost on close, as it
-// should be). The session daemon builds every later project's environment from it instead of from the boot
-// project's, so project A's Node, Rust target folder or database variables never leak into project B's sessions.
-import fs from 'node:fs';
-import path from 'node:path';
-import { writeJsonAtomic } from '../shared/rundir.js';
-import { localDir } from './env.js';
-import { BootEnv } from './project-env.js';
-export { baseEnvFor } from './project-env.js';
-const file = () => path.join(localDir, 'boot-env.json');
-export const saveBootEnv = (value) => {
-    try {
-        writeJsonAtomic(file(), value);
-    }
-    catch { /* projects added later then fall back to the boot environment */ }
-};
-export const readBootEnv = () => {
-    try {
-        return BootEnv.safeParse(JSON.parse(fs.readFileSync(file(), 'utf8'))).data ?? null;
-    }
-    catch {
-        return null;
-    }
-};

package/dist/guest/cmdline.d.ts

@@ -1,12 +0,0 @@
-export declare const quoteArg: (arg: string) => string;
-/**
- * Arguments on a `cmd /d /c <agent>.cmd ...` line (npm agents). cmd parses them twice: the /c line, then the .cmd's %*.
- * & | < > ^ are literal inside quotes, so arguments with them are quoted (https://x?a=1&b=2 survives). % expands even
- * inside quotes, so each one sits between quoted pieces ("50"%" off"): every %name% cmd could see then starts with a
- * quote, and no variable is called that. cmd's quote state runs across the whole line (an embedded \" toggles it too),
- * so a metacharacter it would see outside quotes gets ^^^ (one caret left after each parse). Arguments without any
- * of these are quoted as usual.
- */
-export declare const cmdArgs: (args: string[]) => string;
-/** The command line ptyhost starts; when the program is cmd.exe its arguments are quoted for cmd (cmdArgs). */
-export declare const commandLine: (file: string, args: string[]) => string;

package/dist/guest/cmdline.js

@@ -1,23 +0,0 @@
-// Command lines for the agent: Windows argument quoting, and the extra layer cmd.exe needs for npm agents (.cmd files).
-import path from 'node:path';
-const quoted = (arg) => '"' + arg.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, '$1$1') + '"';
-export const quoteArg = (arg) => (arg !== '' && !/[\s"]/.test(arg) ? arg : quoted(arg));
-/**
- * Arguments on a `cmd /d /c <agent>.cmd ...` line (npm agents). cmd parses them twice: the /c line, then the .cmd's %*.
- * & | < > ^ are literal inside quotes, so arguments with them are quoted (https://x?a=1&b=2 survives). % expands even
- * inside quotes, so each one sits between quoted pieces ("50"%" off"): every %name% cmd could see then starts with a
- * quote, and no variable is called that. cmd's quote state runs across the whole line (an embedded \" toggles it too),
- * so a metacharacter it would see outside quotes gets ^^^ (one caret left after each parse). Arguments without any
- * of these are quoted as usual.
- */
-export const cmdArgs = (args) => {
-    const pieces = args.map((arg) => (/[&|<>^%]/.test(arg) ? arg.split('%').map(quoted).join('%') : quoteArg(arg))).join(' ');
-    let inQuotes = false;
-    return [...pieces].map((c) => {
-        if (c === '"')
-            inQuotes = !inQuotes;
-        return !inQuotes && /[&|<>^]/.test(c) ? '^^^' + c : c;
-    }).join('');
-};
-/** The command line ptyhost starts; when the program is cmd.exe its arguments are quoted for cmd (cmdArgs). */
-export const commandLine = (file, args) => path.win32.basename(file).toLowerCase() === 'cmd.exe' ? [quoteArg(file), cmdArgs(args)].filter(Boolean).join(' ') : [file, ...args].map(quoteArg).join(' ');

package/dist/guest/daemon/project.d.ts

@@ -1,14 +0,0 @@
-import type { ProjectSpecT } from '../../shared/schema.js';
-export interface Provisioned {
-    spec: ProjectSpecT;
-    env: NodeJS.ProcessEnv;
-    summary: string[];
-}
-/** The provisioned project containing this folder, if any (exec in its folders uses its environment). */
-export declare const provisionedFor: (cwd: string) => Provisioned | null;
-export declare const provisionedProjects: () => Provisioned[];
-/**
- * Provisions a project (or joins the run already doing it: two sessions requested at once wait for the same one).
- * `say` gets the progress lines.
- */
-export declare const provisionProject: (spec: ProjectSpecT, say: (message: string) => void) => Promise<Provisioned>;