windows-development-sandbox 1.4.1 → 1.5.0

package/dist/host/accounts.d.ts

@@ -1,32 +0,0 @@
-export interface Account {
-    name: string;
-    savedAt: string;
-    email: string | null;
-    credentials: unknown;
-    oauthAccount: unknown;
-}
-export interface AccountRow {
-    name: string;
-    email: string | null;
-    isDefault: boolean;
-    isActive: boolean;
-    savedAt: string;
-}
-export declare const accountsDir: (storageRoot: string) => string;
-export declare const sandboxClaudeDir: (dataPath: string) => string;
-export declare const readAccount: (storageRoot: string, name: string) => Account | null;
-export declare const defaultAccount: (storageRoot: string) => string | null;
-export declare const activeAccount: (dataPath: string) => string | null;
-export declare const listAccounts: (storageRoot: string, dataPath: string) => AccountRow[];
-/** Saves the sandbox's current login (or this PC's, with fromHost) under `name`. */
-export declare const saveAccount: (storageRoot: string, dataPath: string, name: string, fromHost: {
-    claudeDir: string;
-    globalStateFile: string;
-} | null) => Account;
-/**
- * Makes `name` the sandbox's login. Claude refreshes (rotates) tokens while it runs, so the outgoing account's
- * current tokens are saved back first; otherwise its stored refresh token could already be invalid.
- */
-export declare const activateAccount: (storageRoot: string, dataPath: string, name: string) => Account;
-export declare const setDefaultAccount: (storageRoot: string, name: string | null) => void;
-export declare const removeAccount: (storageRoot: string, name: string) => void;

package/dist/host/accounts.js

@@ -1,128 +0,0 @@
-// Several Claude logins for the sandbox. Each account is a saved copy of Claude's .credentials.json plus the
-// `oauthAccount` block of .claude.json, kept in host-only storage (<storage>\accounts, never mapped into a sandbox).
-// Switching writes them into the sandbox's persistent Claude state; when the sandbox is running the agent is then
-// restarted in place with --continue so the conversation carries on.
-import fs from 'node:fs';
-import path from 'node:path';
-import { z } from 'zod';
-import { isSafeFileName } from '../shared/paths.js';
-import { assertTestWritable } from './test-guard.js';
-import { readValid, writeJsonAtomic } from '../shared/rundir.js';
-import { assertNoLinks, fail, fileExists, isLink, removeLink, tryReadJson, writeJson } from '../core/util.js';
-const NAME = /^[A-Za-z0-9_-]{1,40}$/;
-const AccountSchema = z.object({ name: z.string().regex(NAME), savedAt: z.string().max(64), email: z.string().max(200).nullable(), credentials: z.looseObject({}), oauthAccount: z.unknown() });
-const IndexSchema = z.object({ default: z.string().regex(NAME).optional(), active: z.record(z.string().max(200), z.string().regex(NAME)).optional() });
-const ACCOUNT_CACHES = ['remote-settings.json', 'policy-limits.json', 'policy-limits.json.stamp.json'];
-const MAX_LOGIN_BYTES = 1024 * 1024;
-/** .claude.json holds per-project state and can be large; it is still capped so a hostile file cannot exhaust memory. */
-const MAX_STATE_BYTES = 256 * 1024 * 1024;
-export const accountsDir = (storageRoot) => path.join(storageRoot, 'accounts');
-export const sandboxClaudeDir = (dataPath) => path.join(dataPath, 'state', 'claude');
-const storageOf = (dataPath) => path.dirname(path.dirname(dataPath));
-const dataName = (dataPath) => path.basename(dataPath);
-const accountFile = (storageRoot, name) => path.join(accountsDir(storageRoot), name + '.json');
-const indexFile = (storageRoot) => path.join(accountsDir(storageRoot), 'index.json');
-const readIndex = (storageRoot) => readValid(IndexSchema, indexFile(storageRoot)) ?? {};
-const updateIndex = (storageRoot, change) => writeJsonAtomic(indexFile(storageRoot), change(readIndex(storageRoot)));
-/** A file name of its own: not "index" (the index file), not a Windows device name such as con or nul. */
-const validName = (name) => NAME.test(name) && name.toLowerCase() !== 'index' && isSafeFileName(name + '.json');
-const assertName = (name) => { if (!validName(name))
-    fail('Invalid account name "' + name + '".', 'Use letters, numbers, - and _ only (max 40), e.g. work or personal.'); };
-const emailOf = (oauthAccount) => {
-    const email = oauthAccount?.emailAddress;
-    return typeof email === 'string' ? email.slice(0, 200) : null;
-};
-export const readAccount = (storageRoot, name) => (validName(name) ? readValid(AccountSchema, accountFile(storageRoot, name)) : null);
-export const defaultAccount = (storageRoot) => readIndex(storageRoot).default ?? null;
-export const activeAccount = (dataPath) => readIndex(storageOf(dataPath)).active?.[dataName(dataPath)] ?? null;
-const setActive = (dataPath, name) => updateIndex(storageOf(dataPath), (i) => ({ ...i, active: { ...i.active, [dataName(dataPath)]: name } }));
-export const listAccounts = (storageRoot, dataPath) => {
-    const dir = accountsDir(storageRoot);
-    if (!fs.existsSync(dir))
-        return [];
-    const def = defaultAccount(storageRoot);
-    const active = activeAccount(dataPath);
-    return fs.readdirSync(dir)
-        .filter((f) => f.endsWith('.json') && f !== 'index.json')
-        .map((f) => readAccount(storageRoot, f.slice(0, -5)))
-        .filter((a) => a !== null)
-        .map((a) => ({ name: a.name, email: a.email, isDefault: a.name === def, isActive: a.name === active, savedAt: a.savedAt }));
-};
-/** Reads a JSON file that may be sandbox-written: no links, size-capped. */
-const readUntrusted = (file, max) => (fileExists(file) && !isLink(file) && fs.statSync(file).size <= max ? tryReadJson(file) : null);
-/** The login currently in a Claude config folder (+ its global state file). */
-const readLogin = (claudeDir, globalStateFile) => {
-    const credentials = readUntrusted(path.join(claudeDir, '.credentials.json'), MAX_LOGIN_BYTES);
-    if (!credentials || typeof credentials !== 'object')
-        fail('No Claude login found in ' + claudeDir + '.', 'Sign in to Claude first (inside the sandbox, or on this PC with --from-host), then save it again.');
-    return { credentials, oauthAccount: readUntrusted(globalStateFile, MAX_STATE_BYTES)?.oauthAccount ?? null };
-};
-const store = (storageRoot, name, login) => {
-    const account = { name, savedAt: new Date().toISOString(), email: emailOf(login.oauthAccount), ...login };
-    writeJsonAtomic(accountFile(storageRoot, name), account);
-    return account;
-};
-const sandboxLogin = (dataPath) => {
-    assertNoLinks(dataPath, sandboxClaudeDir(dataPath));
-    return { claudeDir: sandboxClaudeDir(dataPath), globalStateFile: path.join(sandboxClaudeDir(dataPath), '.claude.json') };
-};
-/** Saves the sandbox's current login (or this PC's, with fromHost) under `name`. */
-export const saveAccount = (storageRoot, dataPath, name, fromHost) => {
-    assertName(name);
-    const source = fromHost ?? sandboxLogin(dataPath);
-    const account = store(storageRoot, name, readLogin(source.claudeDir, source.globalStateFile));
-    if (!fromHost)
-        setActive(dataPath, name);
-    if (!defaultAccount(storageRoot))
-        setDefaultAccount(storageRoot, name);
-    return account;
-};
-/** Replaces a file that may be a sandbox-planted link instead of writing through it. */
-const writeSandboxJson = (file, value) => {
-    assertTestWritable(file);
-    if (isLink(file))
-        removeLink(file);
-    writeJson(file, value);
-};
-/**
- * Makes `name` the sandbox's login. Claude refreshes (rotates) tokens while it runs, so the outgoing account's
- * current tokens are saved back first; otherwise its stored refresh token could already be invalid.
- */
-export const activateAccount = (storageRoot, dataPath, name) => {
-    const account = readAccount(storageRoot, name) ?? fail('Unknown account "' + name + '".', 'Saved accounts: ' + (listAccounts(storageRoot, dataPath).map((a) => a.name).join(', ') || 'none yet; save one with sandbox account save <name>'));
-    const { claudeDir, globalStateFile } = sandboxLogin(dataPath);
-    const outgoing = activeAccount(dataPath);
-    if (outgoing && outgoing !== name && readAccount(storageRoot, outgoing) && fileExists(path.join(claudeDir, '.credentials.json'))) {
-        try {
-            store(storageRoot, outgoing, readLogin(claudeDir, globalStateFile));
-        }
-        catch { /* nothing usable to save back */ }
-    }
-    fs.mkdirSync(claudeDir, { recursive: true });
-    // Caches tied to the previous account (Claude deletes these on /logout); otherwise its org policy could linger.
-    for (const cache of ACCOUNT_CACHES) {
-        const file = path.join(claudeDir, cache);
-        if (isLink(file))
-            removeLink(file);
-        else
-            fs.rmSync(file, { force: true });
-    }
-    writeSandboxJson(path.join(claudeDir, '.credentials.json'), account.credentials);
-    const state = readUntrusted(globalStateFile, MAX_STATE_BYTES);
-    if (account.oauthAccount && (state || !fileExists(globalStateFile)))
-        writeSandboxJson(globalStateFile, { ...(state ?? {}), oauthAccount: account.oauthAccount });
-    setActive(dataPath, name);
-    return account;
-};
-export const setDefaultAccount = (storageRoot, name) => {
-    if (name !== null && !readAccount(storageRoot, name))
-        fail('Unknown account "' + name + '".', 'See your accounts with: sandbox account list');
-    updateIndex(storageRoot, (i) => ({ ...i, default: name ?? undefined }));
-};
-export const removeAccount = (storageRoot, name) => {
-    if (!readAccount(storageRoot, name))
-        fail('Unknown account "' + name + '".', 'See your accounts with: sandbox account list');
-    fs.rmSync(accountFile(storageRoot, name));
-    if (defaultAccount(storageRoot) === name)
-        setDefaultAccount(storageRoot, null);
-};

package/dist/host/agent-commands.d.ts

@@ -1,25 +0,0 @@
-import type { Config } from '../core/types.js';
-export declare const commandsDir: (storageRoot: string) => string;
-export interface AgentCommand {
-    harness: string;
-    command: string;
-    real: string;
-}
-/** The agent's own executable on this PC, skipping this tool's forwarding files. */
-export declare const realAgent: (command: string, skipDir: string, pathValue?: string) => string | null;
-/** The agents that get a forwarding command: installed on this PC, and listed (or "auto" = all of them). */
-export declare const agentCommands: (config: Config, storageRoot: string, pathValue?: string) => AgentCommand[];
-/** The .cmd file for one agent (cmd, PowerShell and Windows Terminal all run it). */
-export declare const forwardingCmd: (a: AgentCommand, node: string, entry: string) => string;
-/** The same for Git Bash, which looks for a file without an extension. */
-export declare const forwardingSh: (a: AgentCommand, node: string, entry: string) => string;
-export interface Reconciled {
-    on: boolean;
-    commands: AgentCommand[];
-    changed: boolean;
-}
-/**
- * Makes this PC match agentCommands: on = a forwarding file per installed agent and the folder first on your PATH;
- * off = no files, no PATH entry. Only touches files it wrote and its own PATH entry; does nothing when already right.
- */
-export declare const reconcileAgentCommands: (config: Config, storageRoot: string, node: string, entry: string) => Reconciled;

package/dist/host/agent-commands.js

@@ -1,145 +0,0 @@
-// (Beta) Agent commands: with agentCommands.enabled, typing an agent's own command on this PC (claude, codex, ...) starts
-// it in a hidden sandbox for the folder you are in and attaches that terminal. Small forwarding files in
-// <storage>\agent-commands go first on YOUR PATH (so they win over npm's and the installers' copies); turning it off
-// removes the files and that one PATH entry. SANDBOX_AGENT_DIRECT=1 runs the real agent on this PC instead.
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { ensureDir, fileExists } from '../core/util.js';
-import { writeFileAtomic } from '../shared/rundir.js';
-import { safeRemove } from '../shared/safe-remove.js';
-import { SYSTEM } from '../shared/system.js';
-import { refuseInSelfTest } from './test-guard.js';
-export const commandsDir = (storageRoot) => path.join(storageRoot, 'agent-commands');
-/** Marks files this tool wrote, so only those are ever replaced or removed. */
-const MARKER = 'windows-development-sandbox agent command';
-const EXTENSIONS = ['.exe', '.cmd', '.bat'];
-/** cmd.exe expands % and ^ even inside quotes: such paths cannot go into a forwarding file safely. */
-const cmdSafe = (p) => !/[%"^\r\n]/.test(p);
-/** The agent's own executable on this PC, skipping this tool's forwarding files. */
-export const realAgent = (command, skipDir, pathValue = process.env.PATH ?? process.env.Path ?? '') => {
-    const skip = path.resolve(skipDir).toLowerCase();
-    const dirs = pathValue.split(path.delimiter).filter((d) => d && path.resolve(d).toLowerCase() !== skip);
-    for (const dir of dirs)
-        for (const ext of EXTENSIONS) {
-            const candidate = path.join(dir, command + ext);
-            if (fileExists(candidate))
-                return candidate;
-        }
-    return null;
-};
-/** The agents that get a forwarding command: installed on this PC, and listed (or "auto" = all of them). */
-export const agentCommands = (config, storageRoot, pathValue) => {
-    const wanted = config.agentCommands.agents;
-    return Object.entries(config.harnesses).flatMap(([harness, h]) => {
-        if (wanted !== 'auto' && !wanted.includes(harness))
-            return [];
-        const command = h.npmBin ?? (h.hostExecutable ? path.parse(h.hostExecutable).name : harness);
-        const real = /^[A-Za-z0-9._-]+$/.test(command) ? realAgent(command, commandsDir(storageRoot), pathValue) : null;
-        return real && cmdSafe(real) ? [{ harness, command, real }] : [];
-    });
-};
-/** The .cmd file for one agent (cmd, PowerShell and Windows Terminal all run it). */
-export const forwardingCmd = (a, node, entry) => [
-    '@echo off',
-    'rem ' + MARKER + ' (Beta). Turn off: sandbox agent-commands off. Run the real one: set SANDBOX_AGENT_DIRECT=1',
-    'if "%SANDBOX_AGENT_DIRECT%"=="1" goto direct',
-    '"' + node + '" "' + entry + '" launch --harness ' + a.harness + ' --headless --terminal -- %*',
-    'exit /b %errorlevel%',
-    ':direct',
-    'call "' + a.real + '" %*',
-    '',
-].join('\r\n');
-/** The same for Git Bash, which looks for a file without an extension. */
-export const forwardingSh = (a, node, entry) => {
-    const posix = (p) => p.replace(/^([A-Za-z]):/, (_m, d) => '/' + d.toLowerCase()).replace(/\\/g, '/');
-    const q = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
-    return [
-        '#!/bin/sh',
-        '# ' + MARKER + ' (Beta). Turn off: sandbox agent-commands off. Run the real one: SANDBOX_AGENT_DIRECT=1',
-        'if [ "$SANDBOX_AGENT_DIRECT" = "1" ]; then exec ' + q(posix(a.real)) + ' "$@"; fi',
-        'exec ' + q(posix(node)) + ' ' + q(posix(entry)) + ' launch --harness ' + a.harness + ' --headless --terminal -- "$@"',
-        '',
-    ].join('\n');
-};
-/** Runs a PowerShell script that edits YOUR PATH (HKCU\Environment) unexpanded, then tells Windows it changed. */
-const editUserPath = (dir, add) => {
-    refuseInSelfTest('change your PATH');
-    const quoted = "'" + dir.replace(/'/g, "''") + "'";
-    const script = [
-        '$dir = ' + quoted,
-        "$key = [Microsoft.Win32.Registry]::CurrentUser.CreateSubKey('Environment')",
-        'try {',
-        "  $raw = [string]$key.GetValue('Path', '', [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)",
-        "  $rest = @($raw -split ';' | Where-Object { $_ -and $_.TrimEnd('\\') -ine $dir.TrimEnd('\\') })",
-        // First, so these commands win over the agents' own folders (also on YOUR PATH).
-        add ? '  $new = (@($dir) + $rest) -join \';\'' : "  $new = $rest -join ';'",
-        '  if ($new -eq $raw.TrimEnd(\';\')) { exit 0 }',
-        "  if ($new.Length -gt 32000) { Write-Error 'PATH too long'; exit 3 }",
-        "  $kind = if ($key.GetValueNames() -contains 'Path') { $key.GetValueKind('Path') } else { [Microsoft.Win32.RegistryValueKind]::ExpandString }",
-        "  $key.SetValue('Path', $new, $kind)",
-        '} finally { $key.Close() }',
-        "Add-Type -Namespace WdsAgents -Name Native -MemberDefinition '[System.Runtime.InteropServices.DllImport(\"user32.dll\", CharSet = System.Runtime.InteropServices.CharSet.Auto)] public static extern System.IntPtr SendMessageTimeout(System.IntPtr hWnd, uint msg, System.UIntPtr wParam, string lParam, uint flags, uint timeout, out System.UIntPtr result);'",
-        '$ignored = [UIntPtr]::Zero',
-        "[void][WdsAgents.Native]::SendMessageTimeout([IntPtr]0xffff, 0x1A, [UIntPtr]::Zero, 'Environment', 2, 5000, [ref]$ignored)",
-    ].join('\n');
-    const result = spawnSync(SYSTEM.powershell(), ['-NoProfile', '-NonInteractive', '-OutputFormat', 'Text', '-Command', script], { encoding: 'utf8', windowsHide: true });
-    if (result.status === 3)
-        throw new Error('Your PATH is too long to add ' + dir + '.');
-    if (result.status !== 0)
-        throw new Error('Could not ' + (add ? 'add ' + dir + ' to' : 'remove ' + dir + ' from') + ' your PATH: ' + (result.stderr || result.error?.message || 'exit ' + result.status).trim());
-};
-const ownFiles = (dir) => fs.existsSync(dir)
-    ? fs.readdirSync(dir).map((f) => path.join(dir, f)).filter((f) => { try {
-        return fs.lstatSync(f).isFile() && fs.readFileSync(f, 'utf8').includes(MARKER);
-    }
-    catch {
-        return false;
-    } })
-    : [];
-/**
- * Makes this PC match agentCommands: on = a forwarding file per installed agent and the folder first on your PATH;
- * off = no files, no PATH entry. Only touches files it wrote and its own PATH entry; does nothing when already right.
- */
-export const reconcileAgentCommands = (config, storageRoot, node, entry) => {
-    const dir = commandsDir(storageRoot);
-    if (!config.agentCommands.enabled) {
-        if (!fs.existsSync(dir))
-            return { on: false, commands: [], changed: false };
-        for (const f of ownFiles(dir))
-            fs.rmSync(f, { force: true });
-        editUserPath(dir, false);
-        if (fs.readdirSync(dir).length === 0)
-            safeRemove(dir, storageRoot);
-        return { on: false, commands: [], changed: true };
-    }
-    if (!cmdSafe(node) || !cmdSafe(entry))
-        throw new Error('This tool is installed in a folder whose path has % " or ^, which cannot go into a command file safely.');
-    const commands = agentCommands(config, storageRoot);
-    ensureDir(dir);
-    const wanted = new Map();
-    for (const a of commands) {
-        wanted.set(path.join(dir, a.command + '.cmd'), forwardingCmd(a, node, entry));
-        wanted.set(path.join(dir, a.command), forwardingSh(a, node, entry));
-    }
-    let changed = false;
-    for (const f of ownFiles(dir))
-        if (!wanted.has(f)) {
-            fs.rmSync(f, { force: true });
-            changed = true;
-        }
-    for (const [file, text] of wanted) {
-        const current = fileExists(file) ? fs.readFileSync(file, 'utf8') : null;
-        // A file of the same name that this tool did not write is never replaced.
-        if (current !== null && !current.includes(MARKER))
-            continue;
-        if (current !== text) {
-            writeFileAtomic(file, text);
-            changed = true;
-        }
-    }
-    const onPath = (process.env.PATH ?? '').split(path.delimiter).some((d) => path.resolve(d).toLowerCase() === path.resolve(dir).toLowerCase());
-    if (changed || !onPath)
-        editUserPath(dir, true);
-    return { on: true, commands, changed: changed || !onPath };
-};

package/dist/host/attach.d.ts

@@ -1,17 +0,0 @@
-import os from 'node:os';
-import type { SessionStatus } from '../core/types.js';
-import { type Viewers } from '../shared/pty-client.js';
-/**
- * True only for IPv4 addresses inside the subnet of one of this PC's Hyper-V adapters ("vEthernet ..."), which is
- * where Windows Sandbox lives. Stops a compromised sandbox from pointing the host (and your keystrokes) anywhere else.
- */
-export declare const isSandboxAddress: (ip: string, interfaces?: NodeJS.Dict<os.NetworkInterfaceInfo[]>) => boolean;
-/** Who is watching a session right now (closed terminals do not count); null when it cannot be asked. */
-export declare const sessionViewers: (session: SessionStatus) => Promise<Viewers | null>;
-/**
- * The newest running session of this agent in exactly this folder that no terminal on this PC is attached to, so
- * sandbox claude -t picks it back up instead of starting another. A session that cannot answer is never reused.
- */
-export declare const findUnwatchedSession: (dataPath: string, harness: string, cwd: string) => Promise<SessionStatus | null>;
-/** Bridges this terminal to a session. Returns the agent's exit code, or 0 when the user detaches. */
-export declare const attachTerminal: (session: SessionStatus) => Promise<number>;

package/dist/host/attach.js

@@ -1,70 +0,0 @@
-// Attaching this terminal to an agent session inside the sandbox. Only addresses on this PC's own Hyper-V network are
-// trusted, and everything the sandbox reports is printed through safeText.
-import net from 'node:net';
-import os from 'node:os';
-import { fail, safeText, sleep } from '../core/util.js';
-import { connect, DETACH_KEY, queryViewers, runTerminalClient } from '../shared/pty-client.js';
-import { currentSessions } from './channel.js';
-import { insideSandbox } from './platform.js';
-const ipToInt = (ip) => ip.split('.').reduce((n, part) => n * 256 + Number(part), 0);
-/**
- * True only for IPv4 addresses inside the subnet of one of this PC's Hyper-V adapters ("vEthernet ..."), which is
- * where Windows Sandbox lives. Stops a compromised sandbox from pointing the host (and your keystrokes) anywhere else.
- */
-export const isSandboxAddress = (ip, interfaces = os.networkInterfaces()) => {
-    if (!net.isIPv4(ip))
-        return false;
-    // WSL's adapter is a Hyper-V adapter too, but no sandbox lives there: keystrokes must never go to a WSL VM.
-    return Object.entries(interfaces).some(([name, list]) => /^vEthernet/i.test(name) && !/WSL/i.test(name) && (list ?? []).some((i) => {
-        if (i.family !== 'IPv4' || i.internal)
-            return false;
-        const mask = ipToInt(i.netmask);
-        return mask !== 0 && (ipToInt(i.address) & mask) === (ipToInt(ip) & mask) && i.address !== ip;
-    }));
-};
-/** Where this PC may connect for a session: only addresses on its own Hyper-V network (null if there are none). */
-const hostEndpoint = (session) => {
-    // Inside the sandbox every session is on loopback; on the PC only addresses on its Hyper-V network are trusted.
-    const addresses = insideSandbox() ? ['127.0.0.1'] : session.attach?.addresses.filter((a) => isSandboxAddress(a)) ?? [];
-    return session.attach && addresses.length ? { ...session.attach, addresses } : null;
-};
-/** Who is watching a session right now (closed terminals do not count); null when it cannot be asked. */
-export const sessionViewers = (session) => {
-    const endpoint = hostEndpoint(session);
-    return endpoint ? queryViewers(endpoint) : Promise.resolve(null);
-};
-/**
- * The newest running session of this agent in exactly this folder that no terminal on this PC is attached to, so
- * sandbox claude -t picks it back up instead of starting another. A session that cannot answer is never reused.
- */
-export const findUnwatchedSession = async (dataPath, harness, cwd) => {
-    const candidates = currentSessions(dataPath).filter((s) => s.harness === harness && s.cwd.toLowerCase() === cwd.toLowerCase()).reverse().slice(0, 8);
-    for (const session of candidates)
-        if ((await sessionViewers(session))?.remote === 0)
-            return session;
-    return null;
-};
-/** Bridges this terminal to a session. Returns the agent's exit code, or 0 when the user detaches. */
-export const attachTerminal = async (session) => {
-    if (!process.stdin.isTTY || !process.stdout.isTTY)
-        fail('--terminal / attach needs an interactive terminal.', 'Run it directly in Windows Terminal or PowerShell, not through a pipe or script.');
-    if (!session.attach)
-        fail('This session cannot be attached to: networking or attach is disabled for this sandbox.', 'Set sandbox.networking and attach.enabled to true, then start a new sandbox.');
-    const endpoint = hostEndpoint(session) ?? fail('Refusing to connect: the sandbox reported no address on this PC\'s Hyper-V (vEthernet) network (' + session.attach.addresses.join(', ') + ').', 'Use the sandbox window instead (sbx-show); if this keeps happening, run sandbox doctor.');
-    const socket = await connect(endpoint);
-    console.log('Attaching to ' + safeText(session.harness) + ' session ' + session.id + ' (' + safeText(session.cwd) + '). Detach any time with Ctrl+]');
-    await sleep(400);
-    const result = await runTerminalClient(socket, session.attach.token, { detachKey: DETACH_KEY });
-    switch (result.reason) {
-        case 'detach':
-            console.log('Detached. The session keeps running; reattach with: sandbox attach ' + session.id);
-            return 0;
-        case 'exit':
-            console.log(safeText(session.harness) + ' exited with code ' + result.exitCode + '.');
-            return result.exitCode;
-        case 'error': fail('The sandbox refused the connection: ' + result.message, 'Try sandbox attach again; the session may have restarted.');
-        default:
-            console.log('Connection to the sandbox closed.');
-            return 1;
-    }
-};

package/dist/host/channel.d.ts

@@ -1,38 +0,0 @@
-import type { GuestRequest, GuestResponse, Harness, SandboxStatus, SessionStatus } from '../core/types.js';
-import type { ProjectSpecT } from '../shared/schema.js';
-/** Where progress lines go: printed by default; a spinner passes its own. Text from the sandbox, made safe first. */
-export type Progress = (line: string) => void;
-/** Waits until the sandbox finished provisioning, reporting each boot step (onStatus: every status read, validated). */
-export declare const waitForReady: (dataPath: string, launchId: string | null, isAlive: () => boolean, progress?: Progress, onStatus?: (status: SandboxStatus) => void) => Promise<SandboxStatus>;
-export declare const sendRequest: (dataPath: string, request: GuestRequest) => void;
-export declare const waitForResponse: (dataPath: string, requestId: string, isAlive: () => boolean, timeoutMs: number) => Promise<GuestResponse>;
-/** project: a project registered after boot (provisioned first). harnessSpec: the agent's definition, for an agent the sandbox did not boot with. */
-export declare const requestSession: (dataPath: string, harness: string, args: string[], cwd: string, extra?: {
-    project?: ProjectSpecT;
-    harnessSpec?: Harness;
-}) => string;
-/**
- * Provisions a registered project without starting an agent and waits for it, printing its progress (the guest's
- * run\projects\<name>.json) as it goes. Throws when it failed.
- */
-export declare const prepareProject: (dataPath: string, project: ProjectSpecT, isAlive: () => boolean, progress?: Progress) => Promise<GuestResponse>;
-export declare const waitForSession: (dataPath: string, sessionId: string, isAlive: () => boolean, timeoutMs?: number, progress?: Progress) => Promise<SessionStatus>;
-/** Runs a command inside the sandbox (in the workspace or a folder below it) and returns its output. */
-export declare const execInSandbox: (dataPath: string, command: string[], cwd: string, timeoutSeconds: number, isAlive: () => boolean) => Promise<GuestResponse>;
-/** Restarts running sessions in place (they resume via the harness's resumeArguments, e.g. claude --continue). */
-export declare const restartSessions: (dataPath: string, harness: string | null, isAlive: () => boolean, cwd?: string) => Promise<GuestResponse>;
-export declare const pingSandbox: (dataPath: string, isAlive: () => boolean) => Promise<GuestResponse>;
-export declare const runningSessions: (dataPath: string) => SessionStatus[];
-/** Most sessions the host will ever contact for one listing: a sandbox can write as many session files as it likes. */
-export declare const MAX_QUERIED_SESSIONS = 32;
-/** Running sessions of the sandbox that is running now (its launch id), newest last, capped. */
-export declare const currentSessions: (dataPath: string) => SessionStatus[];
-/** Sessions in this guest folder or below (one project's) first, each group newest first. */
-export declare const sessionsFirstIn: (sessions: SessionStatus[], guestDir: string | null) => SessionStatus[];
-/**
- * The session with this id (or id prefix), else the most recently started running one: in `guestDir` (the project
- * you are in) when it has one, else any.
- */
-export declare const pickSession: (dataPath: string, sessionId?: string, guestDir?: string | null) => SessionStatus;
-/** Forgets status from a previous sandbox run so nothing stale is picked up. */
-export declare const resetRunDir: (dataPath: string) => void;

package/dist/host/channel.js

@@ -1,163 +0,0 @@
-// Host side of the sandbox channel: follow the boot and send requests (sessions, exec, restart, ping). Attaching a
-// terminal to a session is in attach.ts. Everything read from the run folder is guest-written and treated as untrusted.
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import { assertNoLinks, fail, isLink, removeLink, safeText, sleep } from '../core/util.js';
-import { isWithin } from '../shared/projects.js';
-import { listSessions, now, readProjectStatus, readResponse, readSandboxStatus, readSession, runPaths, writeJsonAtomic } from '../shared/rundir.js';
-import { safeRemove } from '../shared/safe-remove.js';
-import { assertTestWritable, refuseInSelfTest } from './test-guard.js';
-const BOOT_TIMEOUT_MS = 30 * 60 * 1000;
-const id = () => Date.now().toString(36) + crypto.randomBytes(3).toString('hex');
-const until = async (timeoutMs, isAlive, poll, timeoutMessage) => {
-    const deadline = Date.now() + timeoutMs;
-    for (let round = 0; Date.now() < deadline; round++) {
-        const value = poll();
-        if (value !== null && value !== undefined)
-            return value;
-        if (round % 10 === 0 && !isAlive())
-            fail('Windows Sandbox closed (or is not running).', 'Start it again with sandbox claude; sandbox logs shows what happened.');
-        await sleep(500);
-    }
-    fail(timeoutMessage, 'Check what the sandbox is doing with sandbox logs -f (or sbx-show to see its window).');
-};
-const printLine = (line) => console.log(line);
-/** Waits until the sandbox finished provisioning, reporting each boot step (onStatus: every status read, validated). */
-export const waitForReady = (dataPath, launchId, isAlive, progress = (m) => printLine('  [sandbox] ' + m), onStatus) => {
-    let last = '';
-    return until(BOOT_TIMEOUT_MS, isAlive, () => {
-        const status = readSandboxStatus(dataPath);
-        if (!status || (launchId !== null && status.launchId !== launchId))
-            return null;
-        onStatus?.(status);
-        if (status.message !== last) {
-            progress(safeText(status.message).slice(0, 300));
-            last = status.message;
-        }
-        if (status.phase === 'failed')
-            fail('The sandbox failed to start: ' + status.message, 'See sandbox logs for details; the sandbox window shows the error too (sbx-show if headless).');
-        return status.phase === 'ready' ? status : null;
-    }, 'Timed out waiting for the sandbox to finish provisioning.');
-};
-export const sendRequest = (dataPath, request) => {
-    assertTestWritable(dataPath);
-    // Asking the sandbox to power off is the one request with an effect outside it, so the self-test never sends it.
-    if (request.kind === 'exec' && /shutdown/i.test(request.command[0] ?? ''))
-        refuseInSelfTest('shut down Windows Sandbox');
-    assertNoLinks(dataPath, runPaths(dataPath).requests);
-    writeJsonAtomic(runPaths(dataPath).request(request.id), request);
-};
-export const waitForResponse = (dataPath, requestId, isAlive, timeoutMs) => until(timeoutMs, isAlive, () => {
-    const response = readResponse(dataPath, requestId);
-    if (response)
-        try {
-            assertNoLinks(dataPath, runPaths(dataPath).responses);
-            fs.rmSync(runPaths(dataPath).response(requestId), { force: true });
-        }
-        catch { /* a planted link: the answer is read, nothing is deleted */ }
-    return response;
-}, 'The sandbox did not answer (its session daemon may have stopped).');
-/** project: a project registered after boot (provisioned first). harnessSpec: the agent's definition, for an agent the sandbox did not boot with. */
-export const requestSession = (dataPath, harness, args, cwd, extra = {}) => {
-    const requestId = id();
-    sendRequest(dataPath, { kind: 'session', id: requestId, harness, args, cwd, ...(extra.project ? { project: extra.project } : {}), ...(extra.harnessSpec ? { harnessSpec: extra.harnessSpec } : {}), createdAt: now() });
-    return requestId;
-};
-/**
- * Provisions a registered project without starting an agent and waits for it, printing its progress (the guest's
- * run\projects\<name>.json) as it goes. Throws when it failed.
- */
-export const prepareProject = async (dataPath, project, isAlive, progress = (m) => printLine('  [' + project.name + '] ' + m)) => {
-    const requestId = id();
-    sendRequest(dataPath, { kind: 'project', id: requestId, project, createdAt: now() });
-    let last = '';
-    const response = await until(60 * 60 * 1000, isAlive, () => {
-        const status = readProjectStatus(dataPath, project.name);
-        if (status && status.message !== last) {
-            progress(safeText(status.message).slice(0, 300));
-            last = status.message;
-        }
-        return readResponse(dataPath, requestId);
-    }, 'Timed out waiting for the project to be set up.');
-    try {
-        assertNoLinks(dataPath, runPaths(dataPath).responses);
-        fs.rmSync(runPaths(dataPath).response(requestId), { force: true });
-    }
-    catch { /* read, nothing deleted */ }
-    if (!response.ok)
-        fail(safeText(response.message), 'See sandbox logs for details.');
-    return response;
-};
-export const waitForSession = (dataPath, sessionId, isAlive, timeoutMs = 15 * 60 * 1000, progress = (m) => printLine('  [session] ' + m)) => {
-    let last = '';
-    return until(timeoutMs, isAlive, () => {
-        const session = readSession(dataPath, sessionId);
-        if (!session)
-            return null;
-        if (session.message !== last) {
-            progress(safeText(session.message).slice(0, 300));
-            last = session.message;
-        }
-        if (session.phase === 'failed')
-            fail('The agent session failed to start: ' + session.message, 'See sandbox logs for details.');
-        if (session.phase === 'exited')
-            fail('The agent exited right away (code ' + session.exitCode + ').', 'Check sandbox logs; a wrong agent argument is the usual cause.');
-        return session.phase === 'running' ? session : null;
-    }, 'Timed out waiting for the session to start.');
-};
-/** Runs a command inside the sandbox (in the workspace or a folder below it) and returns its output. */
-export const execInSandbox = async (dataPath, command, cwd, timeoutSeconds, isAlive) => {
-    const requestId = id();
-    sendRequest(dataPath, { kind: 'exec', id: requestId, command, cwd, timeoutSeconds, createdAt: now() });
-    return waitForResponse(dataPath, requestId, isAlive, (timeoutSeconds + 30) * 1000);
-};
-/** Restarts running sessions in place (they resume via the harness's resumeArguments, e.g. claude --continue). */
-export const restartSessions = async (dataPath, harness, isAlive, cwd) => {
-    const requestId = id();
-    sendRequest(dataPath, { kind: 'restart', id: requestId, harness, ...(cwd ? { cwd } : {}), createdAt: now() });
-    return waitForResponse(dataPath, requestId, isAlive, 30000);
-};
-export const pingSandbox = async (dataPath, isAlive) => {
-    const requestId = id();
-    sendRequest(dataPath, { kind: 'ping', id: requestId, createdAt: now() });
-    return waitForResponse(dataPath, requestId, isAlive, 15000);
-};
-export const runningSessions = (dataPath) => listSessions(dataPath).filter((s) => s.phase === 'running');
-/** Most sessions the host will ever contact for one listing: a sandbox can write as many session files as it likes. */
-export const MAX_QUERIED_SESSIONS = 32;
-/** Running sessions of the sandbox that is running now (its launch id), newest last, capped. */
-export const currentSessions = (dataPath) => {
-    const launchId = readSandboxStatus(dataPath)?.launchId;
-    return runningSessions(dataPath).filter((s) => s.launchId === launchId).slice(-MAX_QUERIED_SESSIONS);
-};
-/** Sessions in this guest folder or below (one project's) first, each group newest first. */
-export const sessionsFirstIn = (sessions, guestDir) => {
-    const newest = [...sessions].reverse();
-    if (!guestDir)
-        return newest;
-    return [...newest.filter((s) => isWithin(guestDir, s.cwd)), ...newest.filter((s) => !isWithin(guestDir, s.cwd))];
-};
-/**
- * The session with this id (or id prefix), else the most recently started running one: in `guestDir` (the project
- * you are in) when it has one, else any.
- */
-export const pickSession = (dataPath, sessionId, guestDir = null) => {
-    const running = runningSessions(dataPath);
-    if (running.length === 0)
-        fail('No agent session is running in the sandbox.', 'Start one with sandbox claude (it opens a new session in the running sandbox).');
-    if (!sessionId)
-        return sessionsFirstIn(running, guestDir)[0];
-    return running.find((s) => s.id === sessionId || s.id.startsWith(sessionId)) ?? fail('No running session "' + sessionId + '".', 'Running sessions: ' + running.map((s) => s.id).join(', ') + ' (sandbox sessions lists them).');
-};
-/** Forgets status from a previous sandbox run so nothing stale is picked up. */
-export const resetRunDir = (dataPath) => {
-    const p = runPaths(dataPath);
-    // A link (planted by a sandbox) is removed itself and never followed, including `run` itself.
-    if (isLink(p.run)) {
-        removeLink(p.run);
-        return;
-    }
-    for (const target of [p.sandbox, p.requests, p.responses, p.sessions, p.projects]) {
-        safeRemove(target, dataPath);
-    }
-};

package/dist/host/claude-profile.d.ts

@@ -1,15 +0,0 @@
-import type { ClaudeProfileConfig, ProfileResult } from '../core/types.js';
-import { type SecretsConfig } from './secrets.js';
-export declare const hostClaudeDir: (settings: ClaudeProfileConfig) => string;
-export declare const hostGlobalStateFile: (settings: ClaudeProfileConfig) => string;
-/**
- * Copies SELECTED Claude settings from this PC into the launch folder. Conversation history is handled
- * separately by history.ts (it needs path translation), and the login only travels when copyCredentials is on.
- */
-/**
- * What of your .claude.json the sandbox gets: everything except secrets and other projects. API keys and the account
- * block stay on this PC (logins travel only through `sandbox account`), and of the per-project entries only
- * this workspace's (with its MCP servers) is kept; other projects' entries can hold their MCP servers' tokens.
- */
-export declare const sandboxGlobalState: (state: Record<string, unknown>, workspaceHost: string) => Record<string, unknown>;
-export declare const stageClaudeProfile: (settings: ClaudeProfileConfig, launchPath: string, workspaceHost: string, secrets: SecretsConfig) => ProfileResult;