windows-development-sandbox 1.4.1 → 1.5.0

package/dist/host/profile/claude-profile.js

@@ -0,0 +1,117 @@
+// Your Claude settings from this PC, staged into the launch folder for the sandbox with secrets stripped.
+import fs from 'node:fs';
+import path from 'node:path';
+import { dirExists, ensureDir, fileExists, homeDir, isLink, readJson, writeJson } from '../../core/util/index.js';
+import { stripMcpServers, stripSettings } from './secrets.js';
+const MAX_BYTES = 250 * 1024 * 1024;
+/** Real files only: a link inside ~/.claude (even a loop or a dead one) is neither followed nor counted nor copied. */
+function directorySize(dir) {
+    let total = 0;
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory())
+            total += directorySize(full);
+        else if (entry.isFile())
+            total += fs.statSync(full).size;
+    }
+    return total;
+}
+function validJson(file) {
+    try {
+        JSON.parse(fs.readFileSync(file, 'utf8').replace(/^\uFEFF/, ''));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function hostClaudeDir(settings) {
+    return settings.hostDir === 'auto'
+        ? (process.env.CLAUDE_CONFIG_DIR ?? path.join(homeDir(), '.claude'))
+        : settings.hostDir;
+}
+export function hostGlobalStateFile(settings) {
+    if (settings.globalStateFile !== 'auto')
+        return settings.globalStateFile;
+    return process.env.CLAUDE_CONFIG_DIR
+        ? path.join(process.env.CLAUDE_CONFIG_DIR, '.claude.json')
+        : path.join(homeDir(), '.claude.json');
+}
+/**
+ * What of your .claude.json the sandbox gets: everything except secrets and other projects. API keys and the account
+ * block stay on this PC (logins travel only through `sandbox account`), and of the per-project entries only
+ * this workspace's (with its MCP servers) is kept; other projects' entries can hold their MCP servers' tokens.
+ */
+export function sandboxGlobalState(state, workspaceHost) {
+    const { primaryApiKey: _key, customApiKeyResponses: _responses, oauthAccount: _account, projects, ...rest } = state;
+    const same = (key) => key.replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase() ===
+        workspaceHost.replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase();
+    const own = Object.entries((projects ?? {})).filter(([key]) => same(key));
+    return { ...rest, projects: Object.fromEntries(own) };
+}
+/**
+ * Copies SELECTED Claude settings from this PC into the launch folder. Conversation history is handled
+ * separately by history.ts (it needs path translation), and the login only travels when copyCredentials is on.
+ */
+export function stageClaudeProfile(settings, launchPath, workspaceHost, secrets) {
+    const result = { hostDir: null, staged: [], skipped: [], credentials: false, secretsRemoved: [] };
+    if (!settings.enabled)
+        return result;
+    const hostDir = hostClaudeDir(settings);
+    result.hostDir = hostDir;
+    const target = path.join(launchPath, 'claude-profile');
+    ensureDir(target);
+    // The login goes only through copyCredentials (a project file asking for it is flagged); include never copies it.
+    const items = settings.include.filter((name) => name.toLowerCase() !== '.credentials.json');
+    if (settings.copyCredentials)
+        items.push('.credentials.json');
+    for (const name of items) {
+        if (!/^[A-Za-z0-9._-]+$/.test(name) || name === '.' || name === '..') {
+            result.skipped.push(name + ' (invalid name)');
+            continue;
+        }
+        const source = path.join(hostDir, name);
+        const destination = path.join(target, name);
+        if (fileExists(source)) {
+            if (name.toLowerCase().endsWith('.json') && !validJson(source)) {
+                result.skipped.push(name + ' (invalid JSON on host; fix or remove it)');
+                continue;
+            }
+            // Claude's settings can carry credentials in "env" and commands that fetch them; those stay here.
+            if (/^settings(.local)?.json$/i.test(name))
+                writeJson(destination, stripSettings(readJson(source), secrets, result.secretsRemoved));
+            else
+                fs.copyFileSync(source, destination);
+        }
+        else if (dirExists(source)) {
+            if (directorySize(source) > MAX_BYTES) {
+                result.skipped.push(name + ' (over 250 MB)');
+                continue;
+            }
+            fs.cpSync(source, destination, {
+                recursive: true,
+                force: true,
+                filter: (from) => from === source || !isLink(from),
+            });
+        }
+        else {
+            result.skipped.push(name + ' (not found)');
+            continue;
+        }
+        result.staged.push(name);
+        if (name === '.credentials.json')
+            result.credentials = true;
+    }
+    if (settings.globalStateFile !== '') {
+        const globalFile = hostGlobalStateFile(settings);
+        if (!fileExists(globalFile))
+            result.skipped.push('.claude.json (not found)');
+        else if (!validJson(globalFile))
+            result.skipped.push('.claude.json (invalid JSON on host)');
+        else {
+            writeJson(path.join(target, '.claude.json'), stripMcpServers(sandboxGlobalState(readJson(globalFile), workspaceHost), secrets, result.secretsRemoved));
+            result.staged.push('.claude.json');
+        }
+    }
+    return result;
+}

package/dist/host/profile/index.d.ts

@@ -0,0 +1,8 @@
+export { isSecretName, isSecretValue, mayPass, stripMcpServers, stripSettings, stripVariables, type SecretsConfig, } from './secrets.js';
+export { findSecretFiles } from './secret-files.js';
+export { hostClaudeDir, hostGlobalStateFile, sandboxGlobalState, stageClaudeProfile } from './claude-profile.js';
+export { capturePersonalization } from './personalize.js';
+export { toRegFile, type RegValue } from './reg-file.js';
+export { AccountStore, accountsDir, type Account, type AccountRow } from './accounts.js';
+export { AgentAccountStore } from './agent-accounts.js';
+export { sandboxClaudeDir } from './claude-login.js';

package/dist/host/profile/index.js

@@ -0,0 +1,8 @@
+export { isSecretName, isSecretValue, mayPass, stripMcpServers, stripSettings, stripVariables, } from './secrets.js';
+export { findSecretFiles } from './secret-files.js';
+export { hostClaudeDir, hostGlobalStateFile, sandboxGlobalState, stageClaudeProfile } from './claude-profile.js';
+export { capturePersonalization } from './personalize.js';
+export { toRegFile } from './reg-file.js';
+export { AccountStore, accountsDir } from './accounts.js';
+export { AgentAccountStore } from './agent-accounts.js';
+export { sandboxClaudeDir } from './claude-login.js';

package/dist/host/profile/personalize.d.ts

@@ -0,0 +1,2 @@
+/** Writes personalize.reg (+ the wallpaper image) into `<launch>\personalize`. Returns a short summary. */
+export declare function capturePersonalization(launchPath: string): string;

package/dist/host/profile/personalize.js

@@ -0,0 +1,130 @@
+// Captures the look of this desktop (theme, accent colour, taskbar, Explorer options, wallpaper, mouse/keyboard,
+// regional formats) from HKCU as a .reg file the sandbox imports at logon. Only an allow-list of values is read.
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { spawnSync } from 'node:child_process';
+import { ensureDir, errMsg, fileExists, isWin } from '../../core/util/index.js';
+import { SYSTEM } from '../../shared/system.js';
+import { nativeScript } from '../native.js';
+import { toRegFile } from './reg-file.js';
+/** The HKCU values captured, by key. */
+const VALUES = {
+    'Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize': [
+        'AppsUseLightTheme',
+        'SystemUsesLightTheme',
+        'EnableTransparency',
+        'ColorPrevalence',
+    ],
+    'Software\\Microsoft\\Windows\\DWM': [
+        'AccentColor',
+        'AccentColorInactive',
+        'ColorizationColor',
+        'ColorizationAfterglow',
+        'ColorizationColorBalance',
+        'ColorPrevalence',
+        'EnableWindowColorization',
+    ],
+    'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Accent': [
+        'AccentPalette',
+        'AccentColorMenu',
+        'StartColorMenu',
+    ],
+    'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced': [
+        'TaskbarAl',
+        'TaskbarSi',
+        'TaskbarDa',
+        'TaskbarMn',
+        'TaskbarGlomLevel',
+        'ShowTaskViewButton',
+        'Hidden',
+        'HideFileExt',
+        'ShowSuperHidden',
+        'LaunchTo',
+        'NavPaneExpandToCurrentFolder',
+        'NavPaneShowAllFolders',
+        'ShowCopilotButton',
+        'Start_TrackDocs',
+        'Start_Layout',
+    ],
+    'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StuckRects3': ['Settings'],
+    'Software\\Microsoft\\Windows\\CurrentVersion\\Search': ['SearchboxTaskbarMode'],
+    'Control Panel\\Desktop': [
+        'WallpaperStyle',
+        'TileWallpaper',
+        'MenuShowDelay',
+        'CursorBlinkRate',
+        'DragFullWindows',
+        'FontSmoothing',
+        'FontSmoothingType',
+        'UserPreferencesMask',
+    ],
+    'Control Panel\\Colors': ['Background', 'Hilight', 'HotTrackingColor'],
+    'Control Panel\\Mouse': [
+        'MouseSpeed',
+        'MouseSensitivity',
+        'MouseThreshold1',
+        'MouseThreshold2',
+        'DoubleClickSpeed',
+        'SwapMouseButtons',
+    ],
+    'Control Panel\\Keyboard': ['KeyboardDelay', 'KeyboardSpeed'],
+    'Control Panel\\International': [
+        'sShortDate',
+        'sLongDate',
+        'sShortTime',
+        'sTimeFormat',
+        'iFirstDayOfWeek',
+        'sDecimal',
+        'sThousand',
+        'sList',
+        'iMeasure',
+        'iTime',
+        'iTLZero',
+    ],
+    'Control Panel\\Accessibility\\StickyKeys': ['Flags'],
+};
+/** native\scripts\capture-look.ps1 with the spec in a temp file: the values found and the wallpaper path, as JSON. */
+function readLook(spec) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sbx-look-'));
+    try {
+        const file = path.join(dir, 'spec.json');
+        fs.writeFileSync(file, JSON.stringify(spec), 'utf8');
+        const result = spawnSync(SYSTEM.powershell(), nativeScript('capture-look.ps1', ['-SpecFile', file]), {
+            stdio: ['ignore', 'pipe', 'inherit'],
+            encoding: 'utf8',
+            windowsHide: true,
+        });
+        if (result.error)
+            throw result.error;
+        return { status: result.status ?? 1, stdout: result.stdout ?? '' };
+    }
+    finally {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+}
+/** Writes personalize.reg (+ the wallpaper image) into `<launch>\personalize`. Returns a short summary. */
+export function capturePersonalization(launchPath) {
+    if (!isWin)
+        return 'skipped (not Windows)';
+    try {
+        const { status, stdout } = readLook(VALUES);
+        if (status !== 0)
+            return 'skipped (registry read failed)';
+        // The script writes UTF-8 (non-ASCII date formats and wallpaper paths survive); a BOM is allowed.
+        const parsed = JSON.parse(stdout.replace(/^\uFEFF/, '').trim());
+        const values = parsed.values === null ? [] : Array.isArray(parsed.values) ? parsed.values : [parsed.values];
+        const dir = path.join(launchPath, 'personalize');
+        ensureDir(dir);
+        fs.writeFileSync(path.join(dir, 'personalize.reg'), '\uFEFF' + toRegFile(values), 'utf16le');
+        const wallpaper = parsed.wallpaper ?? '';
+        const themesCopy = path.join(process.env.APPDATA ?? '', 'Microsoft', 'Windows', 'Themes', 'TranscodedWallpaper');
+        const source = fileExists(wallpaper) ? wallpaper : fileExists(themesCopy) ? themesCopy : null;
+        if (source)
+            fs.copyFileSync(source, path.join(dir, 'wallpaper' + (path.extname(source) || '.jpg')));
+        return values.length + ' settings' + (source ? ' + wallpaper' : '');
+    }
+    catch (e) {
+        return 'skipped (' + errMsg(e) + ')';
+    }
+}

package/dist/host/profile/reg-file.d.ts

@@ -0,0 +1,8 @@
+export interface RegValue {
+    readonly key: string;
+    readonly name: string;
+    readonly kind: string;
+    readonly value: string | number | string[];
+}
+/** Formats captured values as a .reg file (UTF-16 friendly text; written as UTF-16LE with BOM). */
+export declare function toRegFile(values: RegValue[]): string;

package/dist/host/profile/reg-file.js

@@ -0,0 +1,45 @@
+// The .reg file format (as regedit imports it) for values captured from HKCU.
+function toHex(bytes) {
+    return [...bytes].map((b) => b.toString(16).padStart(2, '0')).join(',');
+}
+function regString(s) {
+    return '"' + s.replace(/\\/g, '\\\\').replace(/"/g, '\\"') + '"';
+}
+/** Formats captured values as a .reg file (UTF-16 friendly text; written as UTF-16LE with BOM). */
+export function toRegFile(values) {
+    const byKey = new Map();
+    for (const v of values)
+        byKey.set(v.key, [...(byKey.get(v.key) ?? []), v]);
+    const lines = ['Windows Registry Editor Version 5.00', ''];
+    for (const [key, list] of byKey) {
+        lines.push('[HKEY_CURRENT_USER\\' + key + ']');
+        for (const v of list) {
+            const name = regString(v.name);
+            switch (v.kind) {
+                case 'DWord':
+                    lines.push(name + '=dword:' + (Number(v.value) >>> 0).toString(16).padStart(8, '0'));
+                    break;
+                case 'QWord':
+                    lines.push(name +
+                        '=hex(b):' +
+                        toHex(Buffer.from(BigInt.asUintN(64, BigInt(v.value))
+                            .toString(16)
+                            .padStart(16, '0'), 'hex').reverse()));
+                    break;
+                case 'Binary':
+                    lines.push(name + '=hex:' + toHex(Buffer.from(String(v.value), 'base64')));
+                    break;
+                case 'ExpandString':
+                    lines.push(name + '=hex(2):' + toHex(Buffer.from(String(v.value) + '\0', 'utf16le')));
+                    break;
+                case 'MultiString':
+                    lines.push(name + '=hex(7):' + toHex(Buffer.from(v.value.join('\0') + '\0\0', 'utf16le')));
+                    break;
+                default:
+                    lines.push(name + '=' + regString(String(v.value)));
+            }
+        }
+        lines.push('');
+    }
+    return lines.join('\r\n');
+}

package/dist/host/profile/secret-files.d.ts

@@ -0,0 +1,2 @@
+/** Secret-looking files in the workspace root and one folder down (skipping dependency folders). */
+export declare function findSecretFiles(workspace: string): string[];

package/dist/host/profile/secret-files.js

@@ -0,0 +1,25 @@
+// Secret-looking files in a workspace, for a warning at launch (the agent can read them: the folder is mapped).
+import fs from 'node:fs';
+import path from 'node:path';
+/** Files that usually hold secrets. The agent CAN read them (the whole folder is mapped); we only warn. */
+const SECRET_FILES = /^(\.env(\..+)?|\.envrc|.*\.(pem|key|p12|pfx|jks|keystore|kdbx|tfvars|ovpn)|credentials(\.json)?|secrets?\.(json|ya?ml|toml)|service[-_]?account.*\.json|id_(rsa|ed25519|ecdsa)|\.npmrc|\.pypirc|\.netrc|\.git-credentials)$/i;
+const TEMPLATE = /\.(example|sample|template|dist|defaults?)$/i;
+/** Secret-looking files in the workspace root and one folder down (skipping dependency folders). */
+export function findSecretFiles(workspace) {
+    const list = (dir) => {
+        try {
+            return fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return [];
+        }
+    };
+    const hit = (name) => SECRET_FILES.test(name) && !TEMPLATE.test(name);
+    const top = list(workspace);
+    const below = top
+        .filter((d) => d.isDirectory() && !/^(node_modules|\.git|vendor|target|dist|build|\.venv|venv)$/i.test(d.name))
+        .flatMap((d) => list(path.join(workspace, d.name))
+        .filter((f) => f.isFile() && hit(f.name))
+        .map((f) => d.name + '\\' + f.name));
+    return [...top.filter((d) => d.isFile() && hit(d.name)).map((d) => d.name), ...below];
+}

package/dist/host/profile/secret-patterns.d.ts

@@ -0,0 +1,6 @@
+/** Variable names that are credentials by definition: cloud, hosting, CI, registries, payment, AI APIs, ... */
+export declare const SECRET_NAMES: readonly RegExp[];
+/** Any name that says what it holds: ..._TOKEN, ..._SECRET, PASSWORD, API_KEY, PRIVATE_KEY, connection strings. */
+export declare const SECRET_WORDS: RegExp;
+/** Values that are credentials whatever they are called. */
+export declare const SECRET_VALUES: readonly RegExp[];

package/dist/host/profile/secret-patterns.js

@@ -0,0 +1,128 @@
+// What counts as a credential: variable names, words in names, and values that are credentials whatever their name.
+/** Variable names that are credentials by definition: cloud, hosting, CI, registries, payment, AI APIs, ... */
+export const SECRET_NAMES = [
+    /^AWS_/,
+    /^AMAZON_/,
+    /^AZURE_/,
+    /^ARM_(CLIENT|TENANT|SUBSCRIPTION|ACCESS)_/,
+    /^MSAL_/,
+    /^CLOUDFLARE_/,
+    /^CF_(API|ACCOUNT|ZONE|ACCESS)/,
+    /^GOOGLE_(APPLICATION_CREDENTIALS|API_KEY|CLOUD_|CLIENT_SECRET)/,
+    /^GCP_/,
+    /^GCLOUD_/,
+    /^GOOGLE_GHA_/,
+    /^FIREBASE_/,
+    /^DIGITALOCEAN_/,
+    /^DO_(API|AUTH)_/,
+    /^LINODE_/,
+    /^HCLOUD_/,
+    /^OCI_/,
+    /^ALIBABA_CLOUD_/,
+    /^ALICLOUD_/,
+    /^IBMCLOUD_/,
+    /^HEROKU_/,
+    /^VERCEL_/,
+    /^NETLIFY_/,
+    /^RENDER_API/,
+    /^FLY_(API|ACCESS)_/,
+    /^RAILWAY_/,
+    /^SUPABASE_/,
+    /^NEON_/,
+    /^PLANETSCALE_/,
+    /^GITHUB_TOKEN$/,
+    /^GH_TOKEN$/,
+    /^GH_ENTERPRISE_TOKEN$/,
+    /^GITHUB_PAT/,
+    /^GITLAB_/,
+    /^BITBUCKET_/,
+    /^CIRCLE_TOKEN$/,
+    /^TRAVIS_/,
+    /^BUILDKITE_/,
+    /^NPM_TOKEN$/,
+    /^NODE_AUTH_TOKEN$/,
+    /^YARN_NPM_AUTH/,
+    /^NUGET_(API_KEY|AUTH)/,
+    /^PYPI_/,
+    /^TWINE_/,
+    /^CARGO_REGISTRY_TOKEN$/,
+    /^GEM_HOST_API_KEY$/,
+    /^DOCKER_(PASSWORD|TOKEN|AUTH)/,
+    /^REGISTRY_(PASSWORD|TOKEN)/,
+    /^KUBECONFIG$/,
+    /^KUBE_TOKEN$/,
+    /^HELM_/,
+    /^VAULT_/,
+    /^CONSUL_HTTP_TOKEN$/,
+    /^NOMAD_TOKEN$/,
+    /^TF_VAR_/,
+    /^TF_TOKEN_/,
+    /^TFE_TOKEN$/,
+    /^PULUMI_ACCESS_TOKEN$/,
+    /^SPACELIFT_/,
+    /^ANSIBLE_VAULT/,
+    /^STRIPE_/,
+    /^PAYPAL_/,
+    /^BRAINTREE_/,
+    /^SQUARE_/,
+    /^ADYEN_/,
+    /^TWILIO_/,
+    /^SENDGRID_/,
+    /^MAILGUN_/,
+    /^POSTMARK_/,
+    /^MAILCHIMP_/,
+    /^RESEND_/,
+    /^SLACK_/,
+    /^DISCORD_(TOKEN|BOT|WEBHOOK)/,
+    /^TELEGRAM_BOT/,
+    /^SENTRY_(AUTH|DSN)/,
+    /^DATADOG_/,
+    /^DD_(API|APP)_KEY$/,
+    /^NEW_RELIC_/,
+    /^HONEYCOMB_/,
+    /^OPENAI_/,
+    /^ANTHROPIC_(API_KEY|AUTH_TOKEN)$/,
+    /^CLAUDE_CODE_OAUTH_TOKEN$/,
+    /^GEMINI_API_KEY$/,
+    /^MISTRAL_API_KEY$/,
+    /^COHERE_API_KEY$/,
+    /^GROQ_API_KEY$/,
+    /^HF_TOKEN$/,
+    /^HUGGING_?FACE_/,
+    /^REPLICATE_API/,
+    /^PINECONE_/,
+    /^ELEVENLABS_/,
+    /^DATABASE_URL$/,
+    /^.*_DATABASE_URL$/,
+    /^(PG|POSTGRES|MYSQL|MARIADB|MSSQL|MONGO(DB)?|REDIS|ELASTIC(SEARCH)?|RABBITMQ|SNOWFLAKE|DATABRICKS)_/,
+    /^SSH_AUTH_SOCK$/,
+    /^GPG_/,
+    /^OP_(SERVICE_ACCOUNT|CONNECT)_/,
+    /^BWS_ACCESS_TOKEN$/,
+    /^DOPPLER_/,
+    /^INFISICAL_/,
+];
+/** Any name that says what it holds: ..._TOKEN, ..._SECRET, PASSWORD, API_KEY, PRIVATE_KEY, connection strings. */
+export const SECRET_WORDS = /(^|_)(PROD|PRODUCTION|LIVE|SECRETS?|TOKENS?|PASSWORDS?|PASSWD|PWD|PASS|API_?KEYS?|ACCESS_?KEYS?|PRIVATE_?KEYS?|SIGNING_?KEYS?|CREDENTIALS?|CREDS|AUTH|AUTHORIZATION|BEARER|COOKIES?|SESSION_?KEYS?|CONN(ECTION)?_?STR(ING)?|DSN|WEBHOOK(_URL)?|CLIENT_?SECRET|SAS|SALT|PAT)(_|$)/;
+/** Values that are credentials whatever they are called. */
+export const SECRET_VALUES = [
+    /\b(AKIA|ASIA|AGPA|AIDA|AROA)[0-9A-Z]{16}\b/, // AWS access key ids
+    /\bgh[pousr]_[A-Za-z0-9]{30,}/,
+    /\bgithub_pat_[A-Za-z0-9_]{40,}/,
+    /\bglpat-[A-Za-z0-9_-]{20,}/,
+    /\bxox[abposr]-[A-Za-z0-9-]{10,}/,
+    /\bsk-(ant-|proj-|live_|test_)?[A-Za-z0-9_-]{20,}/,
+    /\b[rs]k_live_[A-Za-z0-9]{20,}/,
+    /\bAIza[0-9A-Za-z_-]{35}\b/,
+    /\bya29\.[0-9A-Za-z_-]{20,}/,
+    /\bnpm_[A-Za-z0-9]{36}\b/,
+    /\bhf_[A-Za-z0-9]{30,}/,
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+    /AccountKey=[A-Za-z0-9+/=]{20,}/i,
+    /SharedAccessSignature=|[?&]sig=[A-Za-z0-9%+/=]{20,}/i,
+    /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s@/]+@/i, // user:password@host in any URL (database URLs, registries)
+    /\bBearer\s+\S{16,}/i,
+    /\bBasic\s+[A-Za-z0-9+/=]{12,}/i,
+    /[?&](api[_-]?key|apikey|access[_-]?token|token|key|secret|password|sig|signature|auth)=[^&\s]{8,}/i, // credentials in a URL
+    /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/, // JWTs
+];

package/dist/host/profile/secrets.d.ts

@@ -0,0 +1,12 @@
+import type { Config } from '../../core/types.js';
+export type SecretsConfig = Config['secrets'];
+export declare function isSecretName(name: string, secrets: SecretsConfig): boolean;
+export declare function isSecretValue(value: string): boolean;
+/** Whether a variable (name and value) may go into the sandbox. secrets.allow always wins. */
+export declare function mayPass(name: string, value: unknown, secrets: SecretsConfig): boolean;
+/** A copy of an env/headers map without the secrets; the names removed are added to `removed` (with `where`). */
+export declare function stripVariables(vars: unknown, secrets: SecretsConfig, where: string, removed: string[]): unknown;
+/** settings.json for the sandbox: secrets out of "env", credential helper commands removed. */
+export declare function stripSettings(settings: Record<string, unknown>, secrets: SecretsConfig, removed: string[]): Record<string, unknown>;
+/** Every MCP server in a .claude.json-shaped object (top level and per project). */
+export declare function stripMcpServers(state: Record<string, unknown>, secrets: SecretsConfig, removed: string[]): Record<string, unknown>;

package/dist/host/profile/secrets.js

@@ -0,0 +1,100 @@
+import { SECRET_NAMES, SECRET_VALUES, SECRET_WORDS } from './secret-patterns.js';
+/** "AWS_REGION", "MY_*", "*_URL": * matches anything. Case-insensitive, like Windows variable names. */
+function globMatch(pattern, name) {
+    return new RegExp('^' +
+        pattern
+            .split('*')
+            .map((p) => p.replace(/[.+?^${}()|[\]\\]/g, '\\$&'))
+            .join('.*') +
+        '$', 'i').test(name);
+}
+export function isSecretName(name, secrets) {
+    // X-API-Key, x-auth-token, api.key: compared as X_API_KEY, X_AUTH_TOKEN, API_KEY.
+    const upper = name.toUpperCase().replace(/[-\s.]/g, '_');
+    return (SECRET_NAMES.some((r) => r.test(upper)) ||
+        SECRET_WORDS.test(upper) ||
+        secrets.patterns.some((p) => globMatch(p, name)));
+}
+export function isSecretValue(value) {
+    return SECRET_VALUES.some((r) => r.test(value));
+}
+/** Whether a variable (name and value) may go into the sandbox. secrets.allow always wins. */
+export function mayPass(name, value, secrets) {
+    if (!secrets.strip || secrets.allow.some((p) => globMatch(p, name)))
+        return true;
+    return !isSecretName(name, secrets) && !(typeof value === 'string' && isSecretValue(value));
+}
+/** A copy of an env/headers map without the secrets; the names removed are added to `removed` (with `where`). */
+export function stripVariables(vars, secrets, where, removed) {
+    if (typeof vars !== 'object' || vars === null || Array.isArray(vars))
+        return vars;
+    return Object.fromEntries(Object.entries(vars).filter(([name, value]) => {
+        const ok = mayPass(name, value, secrets);
+        if (!ok)
+            removed.push(where + name);
+        return ok;
+    }));
+}
+/** Claude settings keys that run commands to fetch credentials on this PC (they cannot work in the sandbox anyway). */
+const CREDENTIAL_HELPERS = ['apiKeyHelper', 'awsAuthRefresh', 'awsCredentialExport', 'otelHeadersHelper'];
+/** settings.json for the sandbox: secrets out of "env", credential helper commands removed. */
+export function stripSettings(settings, secrets, removed) {
+    if (!secrets.strip)
+        return settings;
+    const out = { ...settings };
+    for (const key of CREDENTIAL_HELPERS.filter((k) => k in out)) {
+        delete out[key];
+        removed.push('settings.json ' + key);
+    }
+    if ('env' in out)
+        out.env = stripVariables(out.env, secrets, 'settings.json env.', removed);
+    return out;
+}
+/** One MCP server: secret env vars and headers removed, and secret-looking command-line arguments blanked. */
+function stripServer(server, secrets, where, removed) {
+    if (typeof server !== 'object' || server === null)
+        return server;
+    const out = { ...server };
+    if ('env' in out)
+        out.env = stripVariables(out.env, secrets, where + ' env.', removed);
+    if ('headers' in out)
+        out.headers = stripVariables(out.headers, secrets, where + ' header ', removed);
+    if (typeof out.url === 'string' && secrets.strip && isSecretValue(out.url)) {
+        removed.push(where + ' url (it carried a credential)');
+        out.url = out.url.replace(/([?&])[^=&#]+=[^&#]*/g, (m, sep) => isSecretValue('?' + m.slice(1)) ? sep + m.slice(1).split('=')[0] + '=REMOVED' : m);
+    }
+    if (Array.isArray(out.args) && secrets.strip) {
+        out.args = out.args.map((arg, i) => {
+            const previous = i > 0 ? String(out.args[i - 1]) : '';
+            const [flag, inline] = typeof arg === 'string' && /^--?[\w-]+=/.test(arg)
+                ? [arg.slice(0, arg.indexOf('=')), arg.slice(arg.indexOf('=') + 1)]
+                : [null, null];
+            const secretFlag = (f) => /^--?[\w-]+$/.test(f) && isSecretName(f.replace(/^-+/, ''), secrets);
+            const flagged = typeof arg === 'string' &&
+                (isSecretValue(arg) || (flag !== null && (secretFlag(flag) || isSecretValue(inline))) || secretFlag(previous));
+            if (flagged)
+                removed.push(where + ' argument ' + (i + 1));
+            return flagged ? '[removed by agent-sandbox]' : arg;
+        });
+    }
+    return out;
+}
+/** Every MCP server in a .claude.json-shaped object (top level and per project). */
+export function stripMcpServers(state, secrets, removed) {
+    if (!secrets.strip)
+        return state;
+    const servers = (owner, where) => {
+        const list = owner.mcpServers;
+        if (typeof list !== 'object' || list === null)
+            return owner;
+        return {
+            ...owner,
+            mcpServers: Object.fromEntries(Object.entries(list).map(([name, s]) => [name, stripServer(s, secrets, where + 'MCP ' + name, removed)])),
+        };
+    };
+    const top = servers(state, '');
+    const projects = top.projects;
+    return projects
+        ? { ...top, projects: Object.fromEntries(Object.entries(projects).map(([key, p]) => [key, servers(p, '')])) }
+        : top;
+}

package/dist/host/projects/index.d.ts

@@ -0,0 +1,4 @@
+export * from './registry.js';
+export * from './mapper.js';
+export * from './known.js';
+export * from './join.js';

package/dist/host/projects/index.js

@@ -0,0 +1,4 @@
+export * from './registry.js';
+export * from './mapper.js';
+export * from './known.js';
+export * from './join.js';

package/dist/host/projects/join.d.ts

@@ -0,0 +1,38 @@
+import type { ResolvedRun } from '../../core/types.js';
+import { type Missing } from '../../core/local-config/index.js';
+import { type ProjectSpec } from '../../shared/channel/index.js';
+import { type RegistryEntry } from './registry.js';
+import { type ProjectMapper } from './mapper.js';
+/** The launch folder of the running sandbox (host-only storage; its id comes from the guest, so it is checked). */
+export declare function runningLaunchPath(storageRoot: string, dataPath: string): string | null;
+/** What a session or command from this folder needs: where it is inside, and (for another project) its spec. */
+export interface Joined {
+    project: RegistryEntry;
+    guestDir: string;
+    spec: ProjectSpec | null;
+    run: ResolvedRun | null;
+    notes: string[];
+    /** What it wants at boot that the running sandbox started without (it joined without them). */
+    missing: Missing | null;
+}
+/** What to do when a joining project wants something the running sandbox started without. */
+export type MissingChoice = 'continue' | 'restart' | 'cancel';
+/** The project spec the guest provisions from (scans the project folder like a launch does). */
+export declare function projectSpec(run: ResolvedRun, entry: RegistryEntry, hooks: boolean): ProjectSpec;
+/**
+ * Makes `hostDir` usable in the running sandbox. The launch folder (or a folder below it) needs nothing; any other
+ * folder is resolved with `resolve` (the caller's resolveRun, with the approval prompt), checked, and registered.
+ */
+export declare function joinRunning(o: {
+    storageRoot: string;
+    dataPath: string;
+    packageRoot: string;
+    hostDir: string;
+    wsbShare: boolean;
+    resolve: (projectRoot: string) => Promise<ResolvedRun>;
+    mapper?: ProjectMapper;
+    /** Asked before anything is registered when something is missing (default: continue without it). */
+    decide?: (name: string, missing: Missing) => Promise<MissingChoice>;
+    /** Asked when the project's own settings are stricter than the running sandbox's (default: refuse). */
+    acceptStricter?: (name: string, stricter: string[]) => Promise<boolean>;
+}): Promise<Joined>;