windows-development-sandbox 1.4.1 → 1.5.0

package/dist/host/repo-guard.js

@@ -1,347 +0,0 @@
-// Zero-click protection for the folder the sandbox shares with this PC.
-//
-// The agent can write the workspace. Two kinds of change there would run code on THIS PC without you doing anything
-// unusual, so they are snapshotted before launch, re-checked every minute while the sandbox runs and when it closes,
-// and neutralised:
-//  - git: new or changed hooks, and config that makes git run programs (core.fsmonitor, core.sshCommand, filters,
-//    include.path, ...), plus files that redirect where git reads config and hooks (commondir, config.worktree);
-//  - commands: executables dropped in the project root under the name of something you type there (node.exe,
-//    git.cmd, npm.cmd, ...), because Windows runs a program from the current folder before searching PATH;
-//  - agent and editor files: hooks, helper commands and MCP servers in .claude/ and .mcp.json, VS Code folder-open
-//    tasks and program paths, .envrc. Submodules and nested repositories get the git checks too.
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import path from 'node:path';
-import _ from 'lodash';
-import { z } from 'zod';
-import { parse as parseJsonc } from 'jsonc-parser';
-import { readValid, writeFileAtomic, writeJsonAtomic } from '../shared/rundir.js';
-import { assertTestWritable } from './test-guard.js';
-import { dirExists, fileExists, isLink } from '../core/util.js';
-/** Config keys that make git run a program, or load more config. */
-const DANGEROUS_KEY = /^(fsmonitor|hookspath|sshcommand|pager|editor|askpass|program|gpgprogram|textconv|command|cmd|clean|smudge|process|driver|helper|uploadpack|receivepack|path|attributesfile|excludesfile|worktree|worktreeconfig|gitproxy|proxycommand|sendemailvalidate|tool|external|difffilter|defaultkeycommand|alternaterefscommand)\s*=/i;
-/** Sections where any key runs a program ([pager] log = x), or where a "!" value does ([alias] st = !x). */
-const dangerousInSection = (section, keyPart) => (section === 'pager' && keyPart.includes('=')) || (section === 'alias' && /^[^=]+=\s*"?\s*!/.test(keyPart));
-const SECTION = /^\s*\[([^\]]*)\]\s*/;
-const MARK = '# [agent-sandbox] disabled, added inside the sandbox: ';
-/** Files in .git that make git read config/hooks from somewhere else. */
-const REDIRECTS = ['commondir', 'config.worktree'];
-/** Names you are likely to run in a project folder; with any of these extensions Windows would pick the local copy. */
-const COMMANDS = new RegExp('^(' + [
-    // this tool's own commands (package.json "bin")
-    'sandbox', 'windows-development-sandbox', 'agent-sandbox', 'claude-sbx', 'claude-sandbox', 'codex-sbx', 'codex-sandbox', 'gemini-sbx', 'gemini-sandbox', 'claude-host', 'sbx-show', 'sbx-hide',
-    // agents
-    'claude', 'codex', 'gemini', 'opencode', 'qwen', 'crush', 'copilot', 'kilo', 'kilocode', 'amp', 'cline', 'cn', 'kimi', 'reasonix', 'codewhale', 'aider', 'cursor-agent', 'agent', 'goose',
-    // toolchains and everyday tools
-    'node', 'npm', 'npx', 'pnpm', 'pnpx', 'yarn', 'corepack', 'volta', 'nvm', 'deno', 'bun', 'bunx', 'tsc', 'git', 'gh', 'code', 'python', 'python3', 'py', 'pip', 'pip3', 'uv', 'uvx', 'pyenv', 'poetry',
-    'cargo', 'rustc', 'rustup', 'dotnet', 'nuget', 'msbuild', 'go', 'java', 'javac', 'mvn', 'mvnw', 'gradle', 'gradlew', 'ruby', 'gem', 'bundle', 'rake', 'rails', 'php', 'composer',
-    'make', 'cmake', 'ninja', 'gcc', 'g\\+\\+', 'clang', 'psql', 'mysql', 'mariadb', 'mongosh', 'redis-cli', 'docker', 'kubectl', 'terraform', 'az', 'aws',
-    'powershell', 'pwsh', 'cmd', 'where', 'tasklist', 'tar', 'curl', 'ssh', 'scp',
-].join('|') + ')\\.(exe|com|bat|cmd|vbs|vbe|js|jse|wsf|wsh|msc|ps1)$', 'i');
-/**
- * Project files that tools on this PC act on by themselves: Claude Code runs a project's hooks, helpers and MCP servers,
- * VS Code runs folder-open tasks and the programs workspace settings point at, direnv runs .envrc. For each, only the
- * part that can run something is compared (`risky`), so the agent may still edit the rest (permissions, formatting).
- */
-const AGENT_FILES = {
-    '.claude/settings.json': (d) => claudeRisk(d),
-    '.claude/settings.local.json': (d) => claudeRisk(d),
-    '.mcp.json': (_d, text) => text,
-    '.vscode/tasks.json': (d) => JSON.stringify(d).match(/"runOn"\s*:\s*"folderOpen"/) ? d : null,
-    '.vscode/settings.json': (d) => _.pickBy(_.isPlainObject(d) ? d : {}, (_v, k) => /path|executable|command|interpreter|shell|profile|args|env|exec|program|server|launch|runtime|binary/i.test(k)),
-    '.envrc': (_d, text) => text,
-};
-const claudeRisk = (d) => {
-    const s = (_.isPlainObject(d) ? d : {});
-    const permissions = (_.isPlainObject(s.permissions) ? s.permissions : {});
-    return { ..._.pick(s, ['hooks', 'apiKeyHelper', 'awsAuthRefresh', 'awsCredentialExport', 'otelHeadersHelper', 'statusLine', 'env', 'enableAllProjectMcpServers', 'enabledMcpjsonServers', 'disableAllHooks']), permissions: _.pick(permissions, ['defaultMode', 'additionalDirectories']) };
-};
-const MAX_AGENT_FILE_BYTES = 1024 * 1024;
-/** What can run in one agent file, as a short fingerprint (null = the file is not there). */
-const agentRisk = (workspace, rel) => {
-    const file = path.join(workspace, ...rel.split('/'));
-    if (!fs.existsSync(file))
-        return null;
-    if (isLink(file) || isLink(path.dirname(file)) || !fileExists(file))
-        return 'link-or-not-a-file';
-    if (fs.statSync(file).size > MAX_AGENT_FILE_BYTES)
-        return 'too-large-' + hash(file);
-    const text = fs.readFileSync(file, 'utf8');
-    const errors = [];
-    const data = parseJsonc(text, errors, { allowTrailingComma: true });
-    const risk = AGENT_FILES[rel](rel === '.envrc' ? null : data, text);
-    return crypto.createHash('sha256').update(JSON.stringify(risk ?? null) + (errors.length && rel !== '.envrc' && rel !== '.mcp.json' ? hash(file) : '')).digest('hex');
-};
-const agentSnapshot = (workspace) => Object.fromEntries(Object.keys(AGENT_FILES).flatMap((rel) => { const r = agentRisk(workspace, rel); return r ? [[rel, r]] : []; }));
-/** SHA-256 in small chunks: a sandbox can plant a multi-gigabyte "node.exe" to exhaust this PC's memory. */
-const hash = (file) => {
-    if (isLink(file))
-        return 'link';
-    const sum = crypto.createHash('sha256');
-    const buffer = Buffer.alloc(1 << 20);
-    let fd;
-    // A file that cannot be read (locked by a program in the sandbox) never matches the snapshot, so it is dealt with.
-    try {
-        fd = fs.openSync(file, 'r');
-    }
-    catch {
-        return 'unreadable-' + crypto.randomBytes(4).toString('hex');
-    }
-    try {
-        for (let n = fs.readSync(fd, buffer, 0, buffer.length, null); n > 0; n = fs.readSync(fd, buffer, 0, buffer.length, null))
-            sum.update(buffer.subarray(0, n));
-    }
-    finally {
-        fs.closeSync(fd);
-    }
-    return sum.digest('hex');
-};
-const MAX_CONFIG_BYTES = 4 * 1024 * 1024;
-const plainGitDir = (workspace) => {
-    const dir = path.join(workspace, '.git');
-    return dirExists(dir) && !isLink(dir) ? dir : null;
-};
-const filesIn = (dir, accept) => dirExists(dir) && !isLink(dir)
-    ? Object.fromEntries(fs.readdirSync(dir, { withFileTypes: true }).filter((e) => (e.isFile() || e.isSymbolicLink()) && accept(e.name)).map((e) => [e.name, hash(path.join(dir, e.name))]))
-    : {};
-const configLines = (dir) => {
-    const file = path.join(dir, 'config');
-    return fileExists(file) && !isLink(file) && fs.statSync(file).size <= MAX_CONFIG_BYTES ? fs.readFileSync(file, 'utf8').split(/\r?\n/) : [];
-};
-const gitState = (dir) => ({
-    config: dir ? configLines(dir) : [],
-    hooks: dir ? filesIn(path.join(dir, 'hooks'), (n) => !n.endsWith('.sample')) : {},
-    redirects: dir ? REDIRECTS.filter((n) => fs.existsSync(path.join(dir, n))) : [],
-});
-const EMPTY_GIT = { config: [], hooks: {}, redirects: [] };
-const MAX_OTHER_REPOS = 64;
-const SKIP_DIRS = new Set(['node_modules', '.git', 'agent-sandbox-quarantine', 'target', 'dist', 'build', 'bin', 'obj', '.venv', 'venv']);
-const plainDirs = (dir, limit) => {
-    try {
-        return fs.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.isSymbolicLink()).slice(0, limit).map((e) => path.join(dir, e.name));
-    }
-    catch {
-        return [];
-    }
-};
-/**
- * Git folders other than the project's own: submodules (.git/modules/**) and repositories nested up to two levels deep.
- * git runs their hooks and config too (git status in a subfolder, VS Code's repository scan). Bounded: links are never
- * followed and at most MAX_OTHER_REPOS are looked at.
- */
-const otherGitDirs = (workspace) => {
-    const found = [];
-    const main = plainGitDir(workspace);
-    // Submodules: a folder with a config and a HEAD is a git folder, and may have modules of its own.
-    const walk = (dir, depth) => {
-        for (const d of plainDirs(dir, 200)) {
-            if (found.length >= MAX_OTHER_REPOS)
-                return;
-            if (fileExists(path.join(d, 'config')) && fileExists(path.join(d, 'HEAD'))) {
-                found.push(d);
-                if (depth < 3)
-                    walk(path.join(d, 'modules'), depth + 1);
-            }
-            else if (depth < 3)
-                walk(d, depth + 1);
-        }
-    };
-    if (main)
-        walk(path.join(main, 'modules'), 0);
-    for (const sub of plainDirs(workspace, 500).filter((d) => !SKIP_DIRS.has(path.basename(d).toLowerCase()))) {
-        for (const candidate of [sub, ...plainDirs(sub, 200).filter((d) => !SKIP_DIRS.has(path.basename(d).toLowerCase()))]) {
-            if (found.length >= MAX_OTHER_REPOS)
-                return found;
-            const git = plainGitDir(candidate);
-            if (git)
-                found.push(git);
-        }
-    }
-    return found;
-};
-const relative = (workspace, dir) => path.relative(workspace, dir).split(path.sep).join('/');
-export const snapshotRepo = (workspace) => {
-    const dir = plainGitDir(workspace);
-    return {
-        gitDir: dir !== null,
-        ...gitState(dir),
-        commands: filesIn(workspace, (n) => COMMANDS.test(n)),
-        agent: agentSnapshot(workspace),
-        repos: Object.fromEntries(otherGitDirs(workspace).map((d) => [relative(workspace, d), gitState(d)])),
-    };
-};
-/** Moves files into <dir>\agent-sandbox-quarantine\<time>\ and reports them. */
-const quarantine = (from, names, into, kind) => {
-    if (names.length === 0)
-        return [];
-    const target = path.join(into, 'agent-sandbox-quarantine', String(Date.now()));
-    fs.mkdirSync(target, { recursive: true });
-    return names.map((name) => {
-        try {
-            fs.renameSync(path.join(from, name), path.join(target, name));
-        }
-        catch (e) {
-            return { kind, detail: name + ' (could not be moved: ' + e.code + '; delete it yourself before running anything here)' };
-        }
-        return { kind, detail: name + ' (moved to ' + target + ')' };
-    });
-};
-/** Comments out newly added config lines that make git run programs. Existing lines are never touched. */
-const disableConfig = (dir, before) => {
-    const lines = configLines(dir);
-    const known = _.countBy(before);
-    const seen = {};
-    const findings = [];
-    let inInclude = false;
-    let section = '';
-    const fixed = lines.map((line) => {
-        const header = SECTION.exec(line);
-        if (header) {
-            section = header[1].trim().toLowerCase().split(/\s/)[0];
-            inInclude = /^include(if\s+"[^"]*")?$/i.test(header[1].trim());
-        }
-        seen[line] = (seen[line] ?? 0) + 1;
-        if (line.startsWith(MARK) || seen[line] <= (known[line] ?? 0))
-            return line;
-        // git also accepts "[core] fsmonitor = x" on one line, so look past a leading section header.
-        const keyPart = line.replace(SECTION, '').trim();
-        if (!(DANGEROUS_KEY.test(keyPart) || (inInclude && keyPart.includes('=')) || dangerousInSection(section, keyPart)))
-            return line;
-        findings.push({ kind: 'config', detail: line.trim() });
-        return MARK + line.trim();
-    });
-    if (findings.length)
-        writeFileAtomic(path.join(dir, 'config'), fixed.join('\n'));
-    const file = path.join(dir, 'config');
-    // A link or a huge file is not read at all, so say so instead of letting it pass as "nothing found".
-    const unchecked = isLink(file) ? '.git/config is a link' : lines.length === 0 && fileExists(file) && fs.statSync(file).size > MAX_CONFIG_BYTES ? '.git/config is over 4 MB' : null;
-    if (unchecked)
-        findings.push({ kind: 'git', detail: unchecked + ', so it cannot be checked. Do not run git in this folder until you have looked at it.' });
-    return findings;
-};
-/**
- * Compares the workspace with its pre-launch snapshot and neutralises anything new that would execute on this PC.
- * Returns what was found (and fixed). Never touches what was already there before the sandbox ran.
- */
-export const guardRepo = (workspace, before) => {
-    assertTestWritable(workspace);
-    const findings = [];
-    const commandsNow = filesIn(workspace, (n) => COMMANDS.test(n));
-    findings.push(...quarantine(workspace, Object.keys(commandsNow).filter((n) => before.commands[n] !== commandsNow[n]), workspace, 'command'));
-    // Snapshots from before these checks existed have no baseline: checking against nothing would move your own files.
-    if (before.agent)
-        findings.push(...guardAgentFiles(workspace, before.agent));
-    if (before.repos) {
-        for (const other of otherGitDirs(workspace)) {
-            const rel = relative(workspace, other);
-            findings.push(...guardGitDir(other, before.repos[rel] ?? EMPTY_GIT).map((f) => ({ ...f, detail: rel + ': ' + f.detail })));
-        }
-    }
-    const dir = plainGitDir(workspace);
-    if (!dir) {
-        const replaced = before.gitDir && fs.existsSync(path.join(workspace, '.git'));
-        if (replaced)
-            findings.push({ kind: 'git', detail: '.git was replaced by a link or a "gitdir:" file inside the sandbox. Do not run git in ' + workspace + ' until you have checked it.' });
-        return findings;
-    }
-    findings.push(...guardGitDir(dir, before));
-    return findings;
-};
-const guardGitDir = (dir, before) => {
-    const hooksDir = path.join(dir, 'hooks');
-    const hooksNow = filesIn(hooksDir, (n) => !n.endsWith('.sample'));
-    return [
-        ...quarantine(hooksDir, Object.keys(hooksNow).filter((n) => before.hooks[n] !== hooksNow[n]), dir, 'hook'),
-        ...quarantine(dir, REDIRECTS.filter((n) => fs.existsSync(path.join(dir, n)) && !before.redirects.includes(n)), dir, 'git'),
-        ...disableConfig(dir, before.config),
-    ];
-};
-/** Agent files whose runnable part changed are moved to the quarantine folder (the rest of your edits are in there too). */
-const guardAgentFiles = (workspace, before) => {
-    const changed = Object.keys(AGENT_FILES).filter((rel) => { const now = agentRisk(workspace, rel); return now !== null && now !== before[rel]; });
-    if (!changed.length)
-        return [];
-    const target = path.join(workspace, 'agent-sandbox-quarantine', String(Date.now()));
-    fs.mkdirSync(target, { recursive: true });
-    return changed.map((rel) => {
-        const what = rel + ' (the sandbox added something it would run on this PC: hooks, MCP servers, helper commands or tasks';
-        try {
-            fs.renameSync(path.join(workspace, ...rel.split('/')), path.join(target, rel.replace(/\//g, '_')));
-        }
-        catch (e) {
-            return { kind: 'agent', detail: what + '; could not be moved: ' + e.code + '. Check it before you open this folder in Claude Code or VS Code)' };
-        }
-        return { kind: 'agent', detail: what + '; moved to ' + target + ')' };
-    });
-};
-// ---- snapshot storage (host-only, next to the sync state) ---------------------------------------------------------
-const syncDir = (dataPath) => path.join(path.dirname(path.dirname(dataPath)), 'sync');
-const snapshotFile = (dataPath) => path.join(syncDir(dataPath), path.basename(dataPath) + '-repo.json');
-const findingsFile = (dataPath) => path.join(syncDir(dataPath), path.basename(dataPath) + '-repo-findings.json');
-const Finding = z.object({ kind: z.enum(['hook', 'config', 'git', 'command', 'agent']), detail: z.string().max(4096), at: z.string().max(64).optional() });
-const GitStateSchema = z.object({ config: z.array(z.string()), hooks: z.record(z.string(), z.string()), redirects: z.array(z.string()) });
-const Saved = z.object({
-    workspace: z.string().max(1024).refine((p) => path.isAbsolute(p)),
-    snapshot: GitStateSchema.extend({ gitDir: z.boolean(), commands: z.record(z.string(), z.string()), agent: z.record(z.string(), z.string()).optional(), repos: z.record(z.string(), GitStateSchema).optional() }),
-});
-const Store = z.strictObject({ projects: z.array(Saved).max(4096), roots: z.array(z.string().max(1024).refine((p) => path.isAbsolute(p))).max(64) });
-const StoreAny = z.union([Store, Saved.transform((s) => ({ projects: [s], roots: [] }))]);
-const readStore = (dataPath) => readValid(StoreAny, snapshotFile(dataPath)) ?? { projects: [], roots: [] };
-const EMPTY = { gitDir: false, config: [], hooks: {}, redirects: [], commands: {}, agent: {}, repos: {} };
-const MAX_ROOT_PROJECTS = 2000;
-/** The folders directly inside a project root (plain folders only; links are never followed). */
-const rootProjects = (root) => {
-    if (!dirExists(root) || isLink(root))
-        return [];
-    return fs.readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.isSymbolicLink()).slice(0, MAX_ROOT_PROJECTS).map((e) => path.join(root, e.name));
-};
-const has = (projects, workspace) => projects.some((s) => s.workspace.toLowerCase() === workspace.toLowerCase());
-/**
- * At launch: every folder the sandbox will be able to write. The launch folder, projects mapped with it and every
- * project already inside a project root are snapshotted as they are now, before the sandbox can touch them.
- */
-export const saveRepoSnapshot = (dataPath, workspace, more = [], roots = []) => {
-    const folders = _.uniqBy([workspace, ...more, ...roots.flatMap((r) => [r, ...rootProjects(r)])], (w) => w.toLowerCase());
-    writeJsonAtomic(snapshotFile(dataPath), { projects: folders.map((w) => ({ workspace: w, snapshot: snapshotRepo(w) })), roots });
-};
-/**
- * A project that joins the running sandbox: snapshotted before its first session, then guarded like the launch
- * folder. A project already guarded keeps its first snapshot (what was there before the sandbox could touch it).
- */
-export const addRepoSnapshot = (dataPath, workspace, o = {}) => {
-    const store = readStore(dataPath);
-    // A folder inside one that is guarded already is covered by it only for its root files; it gets its own entry.
-    if (has(store.projects, workspace))
-        return;
-    writeJsonAtomic(snapshotFile(dataPath), { ...store, projects: [...store.projects, { workspace, snapshot: o.empty ? EMPTY : snapshotRepo(workspace) }] });
-};
-/**
- * Folders that appeared inside a project root after the launch: the sandbox could have written them from the start,
- * so they get an EMPTY baseline: any git hook, git config that runs programs (core.hooksPath, core.fsmonitor, ...)
- * or planted command in them counts as added inside the sandbox and is neutralised.
- */
-const discoverRootProjects = (dataPath) => {
-    const store = readStore(dataPath);
-    const found = store.roots.flatMap(rootProjects).filter((w) => !has(store.projects, w)).map((workspace) => ({ workspace, snapshot: EMPTY }));
-    if (!found.length)
-        return store.projects;
-    const projects = [...store.projects, ...found].slice(0, 4096);
-    writeJsonAtomic(snapshotFile(dataPath), { ...store, projects });
-    return projects;
-};
-/** The folders being guarded (for status). */
-export const guardedProjects = (dataPath) => readStore(dataPath).projects.map((s) => s.workspace);
-/** Re-checks every project of the current/last launch; findings are kept in a host-only file for `status`. Returns the new ones. */
-export const checkRepo = (dataPath) => {
-    const saved = discoverRootProjects(dataPath);
-    if (!saved.length)
-        return [];
-    const old = repoFindings(dataPath);
-    // A finding that cannot be fixed (a file locked in the sandbox) is reported once, not every minute.
-    const findings = saved.flatMap((s) => guardRepo(s.workspace, s.snapshot).map((f) => (saved.length > 1 ? { ...f, detail: s.workspace + ': ' + f.detail } : f)))
-        .filter((f) => !old.some((o) => o.kind === f.kind && o.detail === f.detail));
-    if (findings.length)
-        writeJsonAtomic(findingsFile(dataPath), [...old, ...findings.map((f) => ({ ...f, at: new Date().toISOString() }))]);
-    return findings;
-};
-export const repoFindings = (dataPath) => readValid(z.array(Finding).max(10000), findingsFile(dataPath)) ?? [];

package/dist/host/secrets.d.ts

@@ -1,14 +0,0 @@
-import type { Config } from '../core/types.js';
-export type SecretsConfig = Config['secrets'];
-export declare const isSecretName: (name: string, secrets: SecretsConfig) => boolean;
-export declare const isSecretValue: (value: string) => boolean;
-/** Whether a variable (name and value) may go into the sandbox. secrets.allow always wins. */
-export declare const mayPass: (name: string, value: unknown, secrets: SecretsConfig) => boolean;
-/** A copy of an env/headers map without the secrets; the names removed are added to `removed` (with `where`). */
-export declare const stripVariables: (vars: unknown, secrets: SecretsConfig, where: string, removed: string[]) => unknown;
-/** settings.json for the sandbox: secrets out of "env", credential helper commands removed. */
-export declare const stripSettings: (settings: Record<string, unknown>, secrets: SecretsConfig, removed: string[]) => Record<string, unknown>;
-/** Every MCP server in a .claude.json-shaped object (top level and per project). */
-export declare const stripMcpServers: (state: Record<string, unknown>, secrets: SecretsConfig, removed: string[]) => Record<string, unknown>;
-/** Secret-looking files in the workspace root and one folder down (skipping dependency folders). */
-export declare const findSecretFiles: (workspace: string) => string[];

package/dist/host/secrets.js

@@ -1,133 +0,0 @@
-// Keeps credentials on this PC. Everything copied into the sandbox from your Claude settings (settings.json "env",
-// MCP servers' env / headers / args in .claude.json) goes through here first: cloud and production credentials are
-// removed unless you let them through with secrets.allow. Pure functions, so they are easy to test.
-import fs from 'node:fs';
-import path from 'node:path';
-/** Variable names that are credentials by definition: cloud providers, hosting, CI, registries, payment, AI APIs, ... */
-const SECRET_NAMES = [
-    /^AWS_/, /^AMAZON_/, /^AZURE_/, /^ARM_(CLIENT|TENANT|SUBSCRIPTION|ACCESS)_/, /^MSAL_/, /^CLOUDFLARE_/, /^CF_(API|ACCOUNT|ZONE|ACCESS)/,
-    /^GOOGLE_(APPLICATION_CREDENTIALS|API_KEY|CLOUD_|CLIENT_SECRET)/, /^GCP_/, /^GCLOUD_/, /^GOOGLE_GHA_/, /^FIREBASE_/,
-    /^DIGITALOCEAN_/, /^DO_(API|AUTH)_/, /^LINODE_/, /^HCLOUD_/, /^OCI_/, /^ALIBABA_CLOUD_/, /^ALICLOUD_/, /^IBMCLOUD_/,
-    /^HEROKU_/, /^VERCEL_/, /^NETLIFY_/, /^RENDER_API/, /^FLY_(API|ACCESS)_/, /^RAILWAY_/, /^SUPABASE_/, /^NEON_/, /^PLANETSCALE_/,
-    /^GITHUB_TOKEN$/, /^GH_TOKEN$/, /^GH_ENTERPRISE_TOKEN$/, /^GITHUB_PAT/, /^GITLAB_/, /^BITBUCKET_/, /^CIRCLE_TOKEN$/, /^TRAVIS_/, /^BUILDKITE_/,
-    /^NPM_TOKEN$/, /^NODE_AUTH_TOKEN$/, /^YARN_NPM_AUTH/, /^NUGET_(API_KEY|AUTH)/, /^PYPI_/, /^TWINE_/, /^CARGO_REGISTRY_TOKEN$/, /^GEM_HOST_API_KEY$/,
-    /^DOCKER_(PASSWORD|TOKEN|AUTH)/, /^REGISTRY_(PASSWORD|TOKEN)/, /^KUBECONFIG$/, /^KUBE_TOKEN$/, /^HELM_/, /^VAULT_/, /^CONSUL_HTTP_TOKEN$/, /^NOMAD_TOKEN$/,
-    /^TF_VAR_/, /^TF_TOKEN_/, /^TFE_TOKEN$/, /^PULUMI_ACCESS_TOKEN$/, /^SPACELIFT_/, /^ANSIBLE_VAULT/,
-    /^STRIPE_/, /^PAYPAL_/, /^BRAINTREE_/, /^SQUARE_/, /^ADYEN_/, /^TWILIO_/, /^SENDGRID_/, /^MAILGUN_/, /^POSTMARK_/, /^MAILCHIMP_/, /^RESEND_/,
-    /^SLACK_/, /^DISCORD_(TOKEN|BOT|WEBHOOK)/, /^TELEGRAM_BOT/, /^SENTRY_(AUTH|DSN)/, /^DATADOG_/, /^DD_(API|APP)_KEY$/, /^NEW_RELIC_/, /^HONEYCOMB_/,
-    /^OPENAI_/, /^ANTHROPIC_(API_KEY|AUTH_TOKEN)$/, /^CLAUDE_CODE_OAUTH_TOKEN$/, /^GEMINI_API_KEY$/, /^MISTRAL_API_KEY$/, /^COHERE_API_KEY$/,
-    /^GROQ_API_KEY$/, /^HF_TOKEN$/, /^HUGGING_?FACE_/, /^REPLICATE_API/, /^PINECONE_/, /^ELEVENLABS_/,
-    /^DATABASE_URL$/, /^.*_DATABASE_URL$/, /^(PG|POSTGRES|MYSQL|MARIADB|MSSQL|MONGO(DB)?|REDIS|ELASTIC(SEARCH)?|RABBITMQ|SNOWFLAKE|DATABRICKS)_/,
-    /^SSH_AUTH_SOCK$/, /^GPG_/, /^OP_(SERVICE_ACCOUNT|CONNECT)_/, /^BWS_ACCESS_TOKEN$/, /^DOPPLER_/, /^INFISICAL_/,
-];
-/** Any name that says what it holds: ..._TOKEN, ..._SECRET, PASSWORD, API_KEY, ..._PRIVATE_KEY, connection strings, ... */
-const SECRET_WORDS = /(^|_)(PROD|PRODUCTION|LIVE|SECRETS?|TOKENS?|PASSWORDS?|PASSWD|PWD|PASS|API_?KEYS?|ACCESS_?KEYS?|PRIVATE_?KEYS?|SIGNING_?KEYS?|CREDENTIALS?|CREDS|AUTH|AUTHORIZATION|BEARER|COOKIES?|SESSION_?KEYS?|CONN(ECTION)?_?STR(ING)?|DSN|WEBHOOK(_URL)?|CLIENT_?SECRET|SAS|SALT|PAT)(_|$)/;
-/** Values that are credentials whatever they are called. */
-const SECRET_VALUES = [
-    /\b(AKIA|ASIA|AGPA|AIDA|AROA)[0-9A-Z]{16}\b/, // AWS access key ids
-    /\bgh[pousr]_[A-Za-z0-9]{30,}/, /\bgithub_pat_[A-Za-z0-9_]{40,}/, /\bglpat-[A-Za-z0-9_-]{20,}/,
-    /\bxox[abposr]-[A-Za-z0-9-]{10,}/, /\bsk-(ant-|proj-|live_|test_)?[A-Za-z0-9_-]{20,}/, /\b[rs]k_live_[A-Za-z0-9]{20,}/,
-    /\bAIza[0-9A-Za-z_-]{35}\b/, /\bya29\.[0-9A-Za-z_-]{20,}/, /\bnpm_[A-Za-z0-9]{36}\b/, /\bhf_[A-Za-z0-9]{30,}/,
-    /-----BEGIN [A-Z ]*PRIVATE KEY-----/, /AccountKey=[A-Za-z0-9+/=]{20,}/i, /SharedAccessSignature=|[?&]sig=[A-Za-z0-9%+/=]{20,}/i,
-    /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s@/]+@/i, // user:password@host in any URL (database URLs, registries)
-    /\bBearer\s+\S{16,}/i, /\bBasic\s+[A-Za-z0-9+/=]{12,}/i,
-    /[?&](api[_-]?key|apikey|access[_-]?token|token|key|secret|password|sig|signature|auth)=[^&\s]{8,}/i, // credentials in a URL
-    /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/, // JWTs
-];
-/** "AWS_REGION", "MY_*", "*_URL": * matches anything. Case-insensitive, like Windows variable names. */
-const globMatch = (pattern, name) => new RegExp('^' + pattern.split('*').map((p) => p.replace(/[.+?^${}()|[\]\\]/g, '\\$&')).join('.*') + '$', 'i').test(name);
-export const isSecretName = (name, secrets) => {
-    // X-API-Key, x-auth-token, api.key: compared as X_API_KEY, X_AUTH_TOKEN, API_KEY.
-    const upper = name.toUpperCase().replace(/[-\s.]/g, '_');
-    return SECRET_NAMES.some((r) => r.test(upper)) || SECRET_WORDS.test(upper) || secrets.patterns.some((p) => globMatch(p, name));
-};
-export const isSecretValue = (value) => SECRET_VALUES.some((r) => r.test(value));
-/** Whether a variable (name and value) may go into the sandbox. secrets.allow always wins. */
-export const mayPass = (name, value, secrets) => {
-    if (!secrets.strip || secrets.allow.some((p) => globMatch(p, name)))
-        return true;
-    return !isSecretName(name, secrets) && !(typeof value === 'string' && isSecretValue(value));
-};
-/** A copy of an env/headers map without the secrets; the names removed are added to `removed` (with `where`). */
-export const stripVariables = (vars, secrets, where, removed) => {
-    if (typeof vars !== 'object' || vars === null || Array.isArray(vars))
-        return vars;
-    return Object.fromEntries(Object.entries(vars).filter(([name, value]) => {
-        const ok = mayPass(name, value, secrets);
-        if (!ok)
-            removed.push(where + name);
-        return ok;
-    }));
-};
-/** Claude settings keys that run commands to fetch credentials on this PC (they cannot work in the sandbox anyway). */
-const CREDENTIAL_HELPERS = ['apiKeyHelper', 'awsAuthRefresh', 'awsCredentialExport', 'otelHeadersHelper'];
-/** settings.json for the sandbox: secrets out of "env", credential helper commands removed. */
-export const stripSettings = (settings, secrets, removed) => {
-    if (!secrets.strip)
-        return settings;
-    const out = { ...settings };
-    for (const key of CREDENTIAL_HELPERS.filter((k) => k in out)) {
-        delete out[key];
-        removed.push('settings.json ' + key);
-    }
-    if ('env' in out)
-        out.env = stripVariables(out.env, secrets, 'settings.json env.', removed);
-    return out;
-};
-/** One MCP server: secret env vars and headers removed, and secret-looking command-line arguments blanked. */
-const stripServer = (server, secrets, where, removed) => {
-    if (typeof server !== 'object' || server === null)
-        return server;
-    const out = { ...server };
-    if ('env' in out)
-        out.env = stripVariables(out.env, secrets, where + ' env.', removed);
-    if ('headers' in out)
-        out.headers = stripVariables(out.headers, secrets, where + ' header ', removed);
-    if (typeof out.url === 'string' && secrets.strip && isSecretValue(out.url)) {
-        removed.push(where + ' url (it carried a credential)');
-        out.url = out.url.replace(/([?&])[^=&#]+=[^&#]*/g, (m, sep) => (isSecretValue('?' + m.slice(1)) ? sep + m.slice(1).split('=')[0] + '=REMOVED' : m));
-    }
-    if (Array.isArray(out.args) && secrets.strip) {
-        out.args = out.args.map((arg, i) => {
-            const previous = i > 0 ? String(out.args[i - 1]) : '';
-            const [flag, inline] = typeof arg === 'string' && /^--?[\w-]+=/.test(arg) ? [arg.slice(0, arg.indexOf('=')), arg.slice(arg.indexOf('=') + 1)] : [null, null];
-            const secretFlag = (f) => /^--?[\w-]+$/.test(f) && isSecretName(f.replace(/^-+/, ''), secrets);
-            const flagged = typeof arg === 'string' && (isSecretValue(arg) || (flag !== null && (secretFlag(flag) || isSecretValue(inline))) || secretFlag(previous));
-            if (flagged)
-                removed.push(where + ' argument ' + (i + 1));
-            return flagged ? '[removed by agent-sandbox]' : arg;
-        });
-    }
-    return out;
-};
-/** Every MCP server in a .claude.json-shaped object (top level and per project). */
-export const stripMcpServers = (state, secrets, removed) => {
-    if (!secrets.strip)
-        return state;
-    const servers = (owner, where) => {
-        const list = owner.mcpServers;
-        if (typeof list !== 'object' || list === null)
-            return owner;
-        return { ...owner, mcpServers: Object.fromEntries(Object.entries(list).map(([name, s]) => [name, stripServer(s, secrets, where + 'MCP ' + name, removed)])) };
-    };
-    const top = servers(state, '');
-    const projects = top.projects;
-    return projects ? { ...top, projects: Object.fromEntries(Object.entries(projects).map(([key, p]) => [key, servers(p, '')])) } : top;
-};
-/** Files in the workspace that usually hold secrets. The agent CAN read them (the whole folder is mapped); we only warn. */
-const SECRET_FILES = /^(\.env(\..+)?|\.envrc|.*\.(pem|key|p12|pfx|jks|keystore|kdbx|tfvars|ovpn)|credentials(\.json)?|secrets?\.(json|ya?ml|toml)|service[-_]?account.*\.json|id_(rsa|ed25519|ecdsa)|\.npmrc|\.pypirc|\.netrc|\.git-credentials)$/i;
-const TEMPLATE = /\.(example|sample|template|dist|defaults?)$/i;
-/** Secret-looking files in the workspace root and one folder down (skipping dependency folders). */
-export const findSecretFiles = (workspace) => {
-    const list = (dir) => { try {
-        return fs.readdirSync(dir, { withFileTypes: true });
-    }
-    catch {
-        return [];
-    } };
-    const hit = (name) => SECRET_FILES.test(name) && !TEMPLATE.test(name);
-    const top = list(workspace);
-    const below = top.filter((d) => d.isDirectory() && !/^(node_modules|\.git|vendor|target|dist|build|\.venv|venv)$/i.test(d.name))
-        .flatMap((d) => list(path.join(workspace, d.name)).filter((f) => f.isFile() && hit(f.name)).map((f) => d.name + '\\' + f.name));
-    return [...top.filter((d) => d.isFile() && hit(d.name)).map((d) => d.name), ...below];
-};

package/dist/host/stops.d.ts

@@ -1,67 +0,0 @@
-import { type ChildProcess } from 'node:child_process';
-import { z } from 'zod';
-declare const Life: z.ZodObject<{
-    started: z.ZodString;
-    lastSeen: z.ZodString;
-    keepAwake: z.ZodBoolean;
-    ended: z.ZodOptional<z.ZodObject<{
-        at: z.ZodString;
-        cause: z.ZodNullable<z.ZodObject<{
-            kind: z.ZodEnum<{
-                restart: "restart";
-                updates: "updates";
-                crash: "crash";
-                sleep: "sleep";
-                memory: "memory";
-                sandboxCrash: "sandboxCrash";
-            }>;
-            at: z.ZodString;
-            text: z.ZodString;
-        }, z.core.$strip>>;
-    }, z.core.$strip>>;
-    reported: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$strip>;
-type LifeT = z.infer<typeof Life>;
-export declare const readLife: (storageRoot: string, dataPath: string) => LifeT | null;
-/** At launch: a fresh record (the previous one has been reported by then). */
-export declare const startLife: (storageRoot: string, dataPath: string, keepAwake: boolean, now?: Date) => void;
-/** Every minute while the sandbox runs. */
-export declare const beatLife: (storageRoot: string, dataPath: string, now?: Date) => void;
-/** The watcher saw the sandbox close while this PC kept running: closed by you (no cause), or by sleep / low memory. */
-export declare const endLife: (storageRoot: string, dataPath: string, cause: StopCause | null, now?: Date) => void;
-export interface StopEvent {
-    at: string;
-    id: number;
-    provider: string;
-    process: string;
-}
-export type StopKind = 'updates' | 'restart' | 'crash' | 'sleep' | 'memory' | 'sandboxCrash';
-export interface StopCause {
-    kind: StopKind;
-    at: string;
-    text: string;
-}
-/**
- * The first event that ends a running sandbox (pure): Windows inside the sandbox crashing (Hyper-V 18590; `process`
- * holds its message with the stop code), a restart or shutdown, a crash or power loss, sleep, low memory. Switching
- * user does not end it (seen on 13 Oct 2026: the sandbox ran on after a switch).
- */
-export declare const explainStop: (events: StopEvent[]) => StopCause | null;
-/** System log and Hyper-V events since `since` that can end a sandbox (Windows only; empty when the logs cannot be read). */
-export declare const readStopEvents: (since: Date) => StopEvent[];
-/** Looking back from the last time the sandbox was seen running (a minute between checks, plus margin). */
-export declare const causeSince: (lastSeen: string) => StopCause | null;
-/**
- * At launch: one warning when the last sandbox ended without anyone closing it (the PC restarted, crashed, slept or ran
- * out of memory), then never again for that run. `watcherAlive` = its watcher is still running (then it did not end).
- */
-export declare const lastStopWarning: (storageRoot: string, dataPath: string, watcherAlive: boolean, find?: (lastSeen: string) => StopCause | null) => string | null;
-/** Windows has installed updates and waits to restart: it may do so on its own, outside your active hours. */
-export declare const updateRestartPending: () => boolean;
-export declare const UPDATE_RESTART_WARNING = "Windows is waiting to restart for updates and may do so on its own (often overnight), which closes the sandbox. Restart first, or pause updates: Settings > Windows Update > Pause updates.";
-/**
- * sandbox.keepAwake: asks Windows not to sleep while the sandbox runs (as a video player does; the screen may still turn
- * off). A small PowerShell holds the request until `ownerPid` exits, so it never outlives the watcher.
- */
-export declare const keepAwake: (ownerPid: number) => ChildProcess | null;
-export {};