windows-development-sandbox 1.4.1 → 1.5.0

package/dist/selftest/repair.test.d.ts

@@ -1,2 +1,2 @@
-import type { Suite } from './suite.js';
+import type { Suite } from './support/suite.js';
 export declare const repairSuite: Suite;

package/dist/selftest/repair.test.js

@@ -1,6 +1,6 @@
 // `sandbox repair`: finding half-installed toolchains, interrupted downloads, stale pid files and broken state.
 import path from 'node:path';
-import { deadPidFiles, findHalfInstalled, findStagingLeftovers, globalPackages, resolvedVersionsValid } from '../cli/commands/repair/finders.js';
+import { deadPidFiles, findHalfInstalled, findStagingLeftovers, globalPackages, resolvedVersionsValid, } from '../cli/commands/repair/finders.js';
 export const repairSuite = {
     name: 'repair',
     title: 'repair detection (half-installed tools, leftovers, stale pids)',
@@ -20,10 +20,20 @@ export const repairSuite = {
         t.dir('repair', 'tools', 'go', '1.24.0.staging-ab12cd');
         t.dir('repair', 'tools', 'node-staging');
         t.dir('repair', 'tools', 'rust.staging-0f');
-        const half = findHalfInstalled(tools).map((h) => path.relative(tools, h.path)).sort();
-        const expectedHalf = [path.join('go', '1.22.8'), path.join('java', 'jdk-17'), 'dotnet', 'nvm', path.join('nvm', 'v20.18.0')].sort();
+        const half = findHalfInstalled(tools)
+            .map((h) => path.relative(tools, h.path))
+            .sort();
+        const expectedHalf = [
+            path.join('go', '1.22.8'),
+            path.join('java', 'jdk-17'),
+            'dotnet',
+            'nvm',
+            path.join('nvm', 'v20.18.0'),
+        ].sort();
         t.equal(half, expectedHalf, 'half-installed toolchains are folders without their program');
-        const leftovers = findStagingLeftovers(tools).map((p) => path.relative(tools, p)).sort();
+        const leftovers = findStagingLeftovers(tools)
+            .map((p) => path.relative(tools, p))
+            .sort();
         t.equal(leftovers, [path.join('go', '1.24.0.staging-ab12cd'), 'node-staging', 'rust.staging-0f'].sort(), 'interrupted downloads are found in tools and one level down');
         t.section('state files');
         t.check(resolvedVersionsValid('{"go":"1.23.2"}') && resolvedVersionsValid('{}'), 'resolved-versions.json: a JSON object is valid (a byte-order mark is fine)');
@@ -36,7 +46,9 @@ export const repairSuite = {
         t.write(path.join(run, 'watcher-other.pid'), String(process.pid));
         t.write(path.join(run, 'watcher-junk.pid'), 'not a pid');
         t.write(path.join(run, 'hidden-windows.json'), '[]');
-        const dead = deadPidFiles(run, (pid) => pid === process.pid).map((file) => path.basename(file)).sort();
+        const dead = deadPidFiles(run, (pid) => pid === process.pid)
+            .map((file) => path.basename(file))
+            .sort();
         t.equal(dead, ['watcher-default.pid', 'watcher-junk.pid'], 'stale watcher pid files (dead process or junk) are found; a live one is kept');
     },
 };

package/dist/selftest/repo-guard.test.d.ts

@@ -1,2 +1,2 @@
-import type { Suite } from './suite.js';
+import type { Suite } from './support/suite.js';
 export declare const repoGuardSuite: Suite;

package/dist/selftest/repo-guard.test.js

@@ -2,8 +2,8 @@
 // and commands planted in the repository are quarantined before anything on this PC can run them.
 import fs from 'node:fs';
 import path from 'node:path';
-import { guardRepo, snapshotRepo } from '../host/repo-guard.js';
-import { isMarked, markFromSandbox, watchAndMark } from '../host/motw.js';
+import { isMarked, markFromSandbox, RepoGuard, watchAndMark } from '../host/guard/index.js';
+const repoGuard = new RepoGuard();
 export const repoGuardSuite = {
     name: 'repo-guard',
     title: 'repository guard (hooks, git config, planted commands, replaced .git)',
@@ -15,103 +15,106 @@ export const repoGuardSuite = {
         t.write(path.join(repo, '.git', 'config'), '[core]\n\trepositoryformatversion = 0\n[remote "origin"]\n\turl = https://example.com/x.git\n');
         t.write(path.join(repo, '.git', 'hooks', 'pre-commit.sample'), 'sample');
         t.write(path.join(repo, '.git', 'hooks', 'pre-push'), 'existing hook');
-        const before = snapshotRepo(repo);
+        const before = repoGuard.snapshot(repo);
         t.write(path.join(repo, '.git', 'hooks', 'post-checkout'), 'calc.exe');
         t.write(path.join(repo, '.git', 'hooks', 'pre-push'), 'changed hook');
         fs.appendFileSync(path.join(repo, '.git', 'config'), '[core]\n\tfsmonitor = calc.exe\n\tsshCommand = evil\n[include]\n\tpath = C:/evil.cfg\n[branch "feature"]\n\tremote = origin\n');
-        const findings = guardRepo(repo, before);
-        t.check(!fs.existsSync(path.join(repo, '.git', 'hooks', 'post-checkout')), 'a new git hook is quarantined');
-        t.check(!fs.existsSync(path.join(repo, '.git', 'hooks', 'pre-push')), 'a changed git hook is quarantined');
-        t.check(fs.existsSync(path.join(repo, '.git', 'hooks', 'pre-commit.sample')), 'hook samples are left alone');
-        t.equal(findings.filter((x) => x.kind === 'hook').length, 2, 'both hooks are reported');
+        const findings = repoGuard.guard(repo, before);
+        t.check(!fs.existsSync(path.join(repo, '.git', 'hooks', 'post-checkout')) &&
+            !fs.existsSync(path.join(repo, '.git', 'hooks', 'pre-push')) &&
+            fs.existsSync(path.join(repo, '.git', 'hooks', 'pre-commit.sample')) &&
+            findings.filter((x) => x.kind === 'hook').length === 2, 'new and changed git hooks are quarantined and reported; samples are left alone');
         const config = readConfig(repo);
-        t.matches(config, disabled('fsmonitor'), 'git config: fsmonitor (runs a program) is disabled');
-        t.matches(config, disabled('sshCommand'), 'git config: sshCommand is disabled');
-        t.matches(config, disabled('path = C:/evil'), 'git config: [include] of an outside file is disabled');
-        t.matches(config, /^\tremote = origin$/m, 'git config: a harmless change stays');
-        t.matches(config, /^\turl = https/m, 'git config: existing lines stay');
-        t.equal(guardRepo(repo, before).length, 0, 'the guard is idempotent');
+        t.check(disabled('fsmonitor').test(config) &&
+            disabled('sshCommand').test(config) &&
+            disabled('path = C:/evil').test(config) &&
+            /^\tremote = origin$/m.test(config) &&
+            /^\turl = https/m.test(config), 'git config: fsmonitor, sshCommand and an [include] of an outside file are disabled; harmless lines stay', config);
+        t.equal(repoGuard.guard(repo, before).length, 0, 'the guard is idempotent');
         t.section('planted commands and tricks');
         const repo2 = t.at('repo2');
         t.write(path.join(repo2, '.git', 'config'), '[core]\n\tbare = false\n');
         t.write(path.join(repo2, 'build.cmd'), 'echo legit');
-        const before2 = snapshotRepo(repo2);
-        for (const name of ['node.exe', 'git.cmd', 'sandbox.cmd', 'opencode.ps1'])
+        const before2 = repoGuard.snapshot(repo2);
+        const planted = ['node.exe', 'git.cmd', 'sandbox.cmd', 'opencode.ps1'];
+        for (const name of planted)
             t.write(path.join(repo2, name), name === 'node.exe' ? 'MZ' : 'calc');
         t.write(path.join(repo2, '.git', 'commondir'), 'C:/evil');
         fs.appendFileSync(path.join(repo2, '.git', 'config'), '[core] fsmonitor = calc.exe\n');
-        const found2 = guardRepo(repo2, before2);
-        const gone = ['node.exe', 'git.cmd', 'sandbox.cmd', 'opencode.ps1'].filter((name) => !fs.existsSync(path.join(repo2, name)));
-        t.equal(gone, ['node.exe', 'git.cmd', 'sandbox.cmd', 'opencode.ps1'], 'executables planted under command names are quarantined');
-        t.check(fs.existsSync(path.join(repo2, 'build.cmd')), 'other scripts stay');
-        t.equal(found2.filter((x) => x.kind === 'command').length, 4, 'every planted command is reported');
-        t.check(!fs.existsSync(path.join(repo2, '.git', 'commondir')), 'a planted commondir is removed');
-        t.matches(readConfig(repo2), disabled('fsmonitor'), 'a key on the same line as its [section] is neutralised');
+        const found2 = repoGuard.guard(repo2, before2);
+        t.check(planted.every((name) => !fs.existsSync(path.join(repo2, name))) &&
+            fs.existsSync(path.join(repo2, 'build.cmd')) &&
+            found2.filter((x) => x.kind === 'command').length === 4 &&
+            !fs.existsSync(path.join(repo2, '.git', 'commondir')) &&
+            disabled('fsmonitor').test(readConfig(repo2)), 'executables planted under command names are quarantined (other scripts stay), a planted commondir is removed, a key on a [section] line is neutralised');
         t.section('a replaced or oversized .git');
         const victim = t.dir('repo-victim');
         const repo3 = t.at('repo3');
         t.write(path.join(repo3, '.git', 'config'), '[core]\n');
-        const before3 = snapshotRepo(repo3);
+        const before3 = repoGuard.snapshot(repo3);
         fs.rmSync(path.join(repo3, '.git'), { recursive: true });
         fs.symlinkSync(victim, path.join(repo3, '.git'), 'junction');
-        t.check(guardRepo(repo3, before3).some((x) => x.kind === 'git' && x.detail.includes('replaced')), '.git replaced by a link is reported loudly');
         const repo4 = t.at('repo4');
         t.write(path.join(repo4, '.git', 'config'), '[core]\n');
-        const before4 = snapshotRepo(repo4);
+        const before4 = repoGuard.snapshot(repo4);
         fs.appendFileSync(path.join(repo4, '.git', 'config'), '#'.repeat(5 * 1024 * 1024));
-        t.check(guardRepo(repo4, before4).some((x) => x.kind === 'git' && x.detail.includes('over 4 MB')), 'a git config too big to check is reported instead of passing');
+        t.check(repoGuard.guard(repo3, before3).some((x) => x.kind === 'git' && x.detail.includes('replaced')) &&
+            repoGuard.guard(repo4, before4).some((x) => x.kind === 'git' && x.detail.includes('over 4 MB')), '.git replaced by a link, or a git config too big to check, is reported instead of passing');
         t.section('more git config that runs programs');
         const repo5 = t.at('repo5');
         t.write(path.join(repo5, '.git', 'config'), '[alias]\n\tst = status\n');
-        const before5 = snapshotRepo(repo5);
+        const before5 = repoGuard.snapshot(repo5);
         fs.appendFileSync(path.join(repo5, '.git', 'config'), '[alias]\n\tlg = !calc.exe\n\tco = checkout\n[pager]\n\tlog = calc.exe\n[diff]\n\texternal = calc.exe\n');
-        guardRepo(repo5, before5);
+        repoGuard.guard(repo5, before5);
         const config5 = readConfig(repo5);
-        t.matches(config5, disabled('lg = !calc'), 'git config: an alias that runs a program (!) is disabled');
-        t.matches(config5, /^\tco = checkout$/m, 'git config: a plain alias stays');
-        t.matches(config5, disabled('log = calc'), 'git config: [pager] entries are disabled');
-        t.matches(config5, disabled('external = calc'), 'git config: diff.external is disabled');
+        t.check(disabled('lg = !calc').test(config5) &&
+            /^\tco = checkout$/m.test(config5) &&
+            disabled('log = calc').test(config5) &&
+            disabled('external = calc').test(config5), 'git config: aliases that run a program (!), [pager] and diff.external are disabled; a plain alias stays', config5);
         t.section('submodules and nested repositories');
         const repo6 = t.at('repo6');
         t.write(path.join(repo6, '.git', 'config'), '[core]\n');
         t.write(path.join(repo6, '.git', 'modules', 'lib', 'config'), '[core]\n');
         t.write(path.join(repo6, '.git', 'modules', 'lib', 'HEAD'), 'ref: refs/heads/main\n');
         t.write(path.join(repo6, 'tools', 'inner', '.git', 'config'), '[core]\n');
-        const before6 = snapshotRepo(repo6);
+        const before6 = repoGuard.snapshot(repo6);
         t.write(path.join(repo6, '.git', 'modules', 'lib', 'hooks', 'post-checkout'), 'calc.exe');
         fs.appendFileSync(path.join(repo6, 'tools', 'inner', '.git', 'config'), '\tfsmonitor = calc.exe\n');
         t.write(path.join(repo6, 'other', '.git', 'hooks', 'pre-commit'), 'calc.exe');
-        const findings6 = guardRepo(repo6, before6);
-        t.check(!fs.existsSync(path.join(repo6, '.git', 'modules', 'lib', 'hooks', 'post-checkout')), 'a hook planted in a submodule is quarantined');
-        t.matches(fs.readFileSync(path.join(repo6, 'tools', 'inner', '.git', 'config'), 'utf8'), disabled('fsmonitor'), 'git config of a nested repository is checked too');
-        t.check(!fs.existsSync(path.join(repo6, 'other', '.git', 'hooks', 'pre-commit')), 'a repository created inside the sandbox has no trusted hooks');
-        t.check(findings6.some((f) => f.detail.startsWith('tools/inner/.git: ')), 'findings say which repository they are in');
+        const findings6 = repoGuard.guard(repo6, before6);
+        t.check(!fs.existsSync(path.join(repo6, '.git', 'modules', 'lib', 'hooks', 'post-checkout')) &&
+            disabled('fsmonitor').test(fs.readFileSync(path.join(repo6, 'tools', 'inner', '.git', 'config'), 'utf8')) &&
+            !fs.existsSync(path.join(repo6, 'other', '.git', 'hooks', 'pre-commit')) &&
+            findings6.some((f) => f.detail.startsWith('tools/inner/.git: ')), 'hooks in submodules, config of nested repositories and hooks of repositories created in the sandbox are handled, findings name the repository');
         const legacy = { ...before6, repos: undefined, agent: undefined };
         t.write(path.join(repo6, 'third', '.git', 'hooks', 'pre-commit'), 'yours');
-        guardRepo(repo6, legacy);
+        repoGuard.guard(repo6, legacy);
         t.check(fs.existsSync(path.join(repo6, 'third', '.git', 'hooks', 'pre-commit')), 'a snapshot from an older version (no baseline) never moves your files');
         t.section('agent and editor files');
         const repo7 = t.at('repo7');
         t.write(path.join(repo7, '.claude', 'settings.local.json'), '{ "permissions": { "allow": ["Bash(npm test)"] } }');
         t.write(path.join(repo7, '.vscode', 'settings.json'), '{\n  // comment\n  "editor.tabSize": 2\n}');
-        const before7 = snapshotRepo(repo7);
+        const before7 = repoGuard.snapshot(repo7);
         t.write(path.join(repo7, '.claude', 'settings.local.json'), '{ "permissions": { "allow": ["Bash(npm test)", "Bash(npm run lint)"] } }');
         t.write(path.join(repo7, '.vscode', 'settings.json'), '{\n  "editor.tabSize": 4,\n}');
-        t.equal(guardRepo(repo7, before7), [], 'ordinary edits (permissions, editor settings) are left alone');
+        t.equal(repoGuard.guard(repo7, before7), [], 'ordinary edits (permissions, editor settings) are left alone');
         t.write(path.join(repo7, '.claude', 'settings.json'), '{ "hooks": { "SessionStart": [{ "hooks": [{ "type": "command", "command": "calc.exe" }] }] } }');
         t.write(path.join(repo7, '.mcp.json'), '{ "mcpServers": { "x": { "command": "calc.exe" } } }');
         t.write(path.join(repo7, '.vscode', 'tasks.json'), '{ "tasks": [{ "label": "x", "command": "calc.exe", "runOptions": { "runOn": "folderOpen" } }] }');
         t.write(path.join(repo7, '.vscode', 'settings.json'), '{ "python.defaultInterpreterPath": "C:\\\\evil.exe" }');
-        const findings7 = guardRepo(repo7, before7);
-        t.equal(findings7.filter((f) => f.kind === 'agent').length, 4, 'Claude hooks, MCP servers, folder-open tasks and program paths in VS Code settings are quarantined');
-        t.check(!fs.existsSync(path.join(repo7, '.mcp.json')) && fs.existsSync(path.join(repo7, '.claude', 'settings.local.json')), '... and nothing else is moved');
+        const findings7 = repoGuard.guard(repo7, before7);
+        t.check(findings7.filter((f) => f.kind === 'agent').length === 4 &&
+            !fs.existsSync(path.join(repo7, '.mcp.json')) &&
+            fs.existsSync(path.join(repo7, '.claude', 'settings.local.json')), 'Claude hooks, MCP servers, folder-open tasks and program paths in VS Code settings are quarantined, nothing else');
         t.section('programs from the sandbox are marked');
         const marked = t.at('marked');
         t.write(path.join(marked, 'setup.ps1'), 'calc');
         t.write(path.join(marked, 'src', 'app.ts'), 'code');
-        t.check(markFromSandbox(path.join(marked, 'setup.ps1')) && isMarked(path.join(marked, 'setup.ps1')), 'a script gets the "from the internet" mark (SmartScreen / PowerShell ask before it runs)');
-        t.check(!markFromSandbox(path.join(marked, 'src', 'app.ts')) && !isMarked(path.join(marked, 'src', 'app.ts')), 'source files are left alone');
-        t.equal(fs.readFileSync(path.join(marked, 'setup.ps1'), 'utf8'), 'calc', 'only the mark is written, never the file');
+        t.check(markFromSandbox(path.join(marked, 'setup.ps1')) &&
+            isMarked(path.join(marked, 'setup.ps1')) &&
+            !markFromSandbox(path.join(marked, 'src', 'app.ts')) &&
+            !isMarked(path.join(marked, 'src', 'app.ts')) &&
+            fs.readFileSync(path.join(marked, 'setup.ps1'), 'utf8') === 'calc', 'a script gets the "from the internet" mark (the file itself is never written); source files are left alone');
         const stop = watchAndMark([marked]);
         t.write(path.join(marked, 'bin', 'tool.exe'), 'MZ');
         const live = await t.waitFor(() => isMarked(path.join(marked, 'bin', 'tool.exe')), 5000);

package/dist/selftest/resume.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const resumeSuite: Suite;

package/dist/selftest/resume.test.js

@@ -0,0 +1,175 @@
+// Reopening the sessions of the last sandbox: the ledger of what ran, the decision to reopen, the limit on automatic
+// restarts, which conversation file is a session's, and the arguments that open it again.
+import fs from 'node:fs';
+import { HarnessSchema } from '../core/schema/index.js';
+import { DEFAULTS } from '../core/config/index.js';
+import { autoRestartAllowed, describeLast, endedUnexpectedly, SessionLedger, shouldReopen, } from '../host/life/index.js';
+import { notRunningYet } from '../cli/commands/sessions/reopen.js';
+import { pickConversation, resumeArgumentsFor } from '../shared/paths/index.js';
+import { SessionStatusSchema } from '../shared/channel/index.js';
+const ID_A = '0a1b2c3d-0000-4000-8000-000000000001';
+const ID_B = '0a1b2c3d-0000-4000-8000-000000000002';
+const ID_C = '0a1b2c3d-0000-4000-8000-000000000003';
+const NOW = new Date('2026-10-14T12:00:00.000Z');
+const minutes = (n) => new Date(NOW.getTime() - n * 60000).toISOString();
+const registry = (primary, other) => ({
+    launchId: 'L1',
+    protections: {},
+    roots: [],
+    projects: [
+        { name: 'api', host: primary, guest: 'C:\\Workspace\\api', primary: true, mechanism: 'launch', registeredAt: 'x' },
+        { name: 'web', host: other, guest: 'C:\\Workspace\\web', primary: false, mechanism: 'boot', registeredAt: 'x' },
+    ],
+});
+const status = (over) => ({
+    id: 's1',
+    launchId: 'L1',
+    harness: 'claude',
+    cwd: 'C:\\Workspace\\api',
+    phase: 'running',
+    message: 'ok',
+    updatedAt: minutes(0),
+    startedAt: minutes(30),
+    ...over,
+});
+const life = (over = {}) => ({
+    started: minutes(60),
+    lastSeen: minutes(1),
+    keepAwake: false,
+    ...over,
+});
+export const resumeSuite = {
+    name: 'resume',
+    title: 'reopening the last sandbox: ledger, decision, restart limit, conversations',
+    run: async (t) => {
+        t.section('the ledger');
+        const storage = t.dir('storage');
+        const data = t.at('storage', 'data', 'main');
+        const ledger = new SessionLedger(storage, data);
+        const launch = { primary: 'F:\\code\\api', harness: 'claude', projects: [], headless: true, configPath: null };
+        const reg = registry('F:\\code\\api', 'F:\\code\\web');
+        ledger.recordSessions([status({})], reg, NOW);
+        const untracked = ledger.read();
+        ledger.startLaunch(launch, NOW);
+        t.check(untracked === null && ledger.read()?.sessions.length === 0, 'a sandbox this tool did not start records nothing; a launch starts with no sessions');
+        ledger.recordSessions([
+            status({ conversation: ID_A }),
+            status({ id: 's2', harness: 'codex', cwd: 'C:\\Workspace\\web\\src', startedAt: minutes(20) }),
+            status({ id: 's3', phase: 'exited' }),
+            status({ id: 's4', cwd: 'D:\\nowhere' }),
+        ], reg, NOW);
+        const saved = ledger.read();
+        t.equal([saved?.sessions.map((s) => [s.harness, s.project, s.conversation]), saved?.launch.projects], [
+            [
+                ['claude', 'F:\\code\\api', ID_A],
+                ['codex', 'F:\\code\\web\\src', undefined],
+            ],
+            ['F:\\code\\web'],
+        ], 'running sessions are noted with their folder on this PC (ended ones and unknown folders are not), and the projects');
+        ledger.recordSessions([
+            status({ startedAt: minutes(30) }),
+            status({ id: 's2', harness: 'codex', cwd: 'C:\\Workspace\\web\\src', startedAt: minutes(20) }),
+        ], reg, NOW);
+        const kept = ledger.read()?.sessions[0].conversation;
+        ledger.recordSessions([status({ conversation: 'not-an-id; rm -rf' })], reg, NOW);
+        t.equal([kept, ledger.read()?.sessions.map((s) => s.conversation)], [ID_A, [ID_A]], 'a conversation noted before stays; one that is not an id is never kept (it ends up on a command line)');
+        ledger.recordSessions(Array.from({ length: 60 }, (_, i) => status({ id: 'x' + i, startedAt: minutes(100 - i) })), reg, NOW);
+        ledger.markClosedOnPurpose();
+        const before = JSON.stringify(ledger.read()?.sessions);
+        ledger.recordSessions([], reg, NOW);
+        const erased = JSON.stringify(ledger.read()?.sessions) !== before;
+        ledger.startLaunch(launch, NOW);
+        t.check(JSON.parse(before).length === 50 &&
+            !erased &&
+            ledger.read()?.closedOnPurpose === false &&
+            ledger.read()?.sessions.length === 50, 'at most 50 sessions; stopping on purpose is marked and sessions ending at shutdown do not erase it; a new launch clears the mark');
+        t.equal(describeLast([
+            { harness: 'claude', project: 'F:\\code\\mw2-agent', startedAt: 'x' },
+            { harness: 'codex', project: 'F:\\code\\web', startedAt: 'x' },
+        ]), 'claude in mw2-agent, codex in web (2 sessions)', 'what ran last time in plain words');
+        t.section('the ledger file is validated');
+        const file = t.at('storage', 'sync', 'main-sessions.json');
+        const good = JSON.parse(fs.readFileSync(file, 'utf8'));
+        const refused = [
+            { ...good, sessions: [{ harness: 'a', project: 'x'.repeat(2000), startedAt: 'x' }] },
+            { ...good, sessions: [{ harness: 'a', project: 'b', startedAt: 'x', conversation: 'y'.repeat(200) }] },
+            { ...good, sessions: 'many' },
+            { savedAt: 'x', sessions: [] },
+        ].map((bad) => {
+            fs.writeFileSync(file, JSON.stringify(bad));
+            return ledger.read();
+        });
+        t.equal(refused, [null, null, null, null], 'a bad file is refused (huge folder, long conversation, wrong shapes)');
+        t.section('reopen, ask or leave');
+        const withSessions = {
+            sessions: [{ harness: 'claude', project: 'F:\\a', startedAt: 'x' }],
+            closedOnPurpose: false,
+        };
+        const crashed = life({ ended: { at: minutes(1), cause: { kind: 'sandboxCrash', at: minutes(1), text: 'x' } } });
+        const closed = life({ ended: { at: minutes(1), cause: null } });
+        const expected = {
+            // [last sandbox crashed, closed normally, the PC went down (no end recorded)]
+            ask: ['ask', 'ask', 'ask'],
+            always: ['reopen', 'reopen', 'reopen'],
+            afterCrash: ['reopen', 'no', 'reopen'],
+            never: ['no', 'no', 'no'],
+        };
+        const decided = ['ask', 'always', 'afterCrash', 'never'].map((setting) => [
+            shouldReopen(setting, crashed, withSessions),
+            shouldReopen(setting, closed, withSessions),
+            shouldReopen(setting, life(), withSessions),
+        ]);
+        t.equal(decided, Object.values(expected), 'resume.sessions ask/always/afterCrash/never: after a crash, a normal close, a PC that went down');
+        t.check(shouldReopen('always', crashed, { sessions: [], closedOnPurpose: false }) === 'no' &&
+            shouldReopen('always', crashed, null) === 'no' &&
+            shouldReopen('afterCrash', crashed, { ...withSessions, closedOnPurpose: true }) === 'no', 'nothing recorded, no ledger, or stopped on purpose: nothing is reopened');
+        t.check(!endedUnexpectedly(life(), false, true) && !endedUnexpectedly(null, false, false), 'a watcher that still runs, or no record at all, is not a crash');
+        t.section('automatic restarts: 3 in 6 hours');
+        t.check(autoRestartAllowed([minutes(10), minutes(20)], NOW) &&
+            !autoRestartAllowed([minutes(10), minutes(20), minutes(30)], NOW) &&
+            autoRestartAllowed([minutes(10), minutes(20), minutes(7 * 60)], NOW) &&
+            !autoRestartAllowed([minutes(10), minutes(20), minutes(359)], NOW) &&
+            autoRestartAllowed(['garbage', '', minutes(1)], NOW), 'the fourth restart in six hours is refused; old ones and garbage in the file do not count');
+        const restarts = new SessionLedger(storage, t.at('storage', 'data', 'other'));
+        restarts.startLaunch(launch, NOW);
+        for (let i = 0; i < 4; i++)
+            restarts.recordAutoRestart(new Date(NOW.getTime() - (4 - i) * 3600000));
+        const counted = restarts.read()?.autoRestarts?.length;
+        restarts.giveUp(NOW);
+        t.check(counted === 4 && restarts.takeGaveUp() !== null && restarts.takeGaveUp() === null, 'automatic restarts are counted; the launch hears that it gave up, once');
+        t.section("which conversation is a session's");
+        const at = (ms) => NOW.getTime() + ms * 1000;
+        const files = [
+            { id: ID_A, createdMs: at(5) },
+            { id: ID_B, createdMs: at(20) },
+            { id: ID_C, createdMs: at(-100) },
+            { id: 'notes', createdMs: at(6) },
+        ];
+        t.equal([
+            pickConversation(files, NOW.getTime(), new Set()),
+            pickConversation(files, NOW.getTime(), new Set([ID_A])),
+            pickConversation(files, at(10), new Set()),
+            pickConversation(files, at(30), new Set()),
+        ], [ID_A, ID_B, ID_B, null], 'the first file created since the session started, not one another session has; none yet is null');
+        t.section('the arguments that open it again');
+        const claude = DEFAULTS.harnesses.claude;
+        t.equal([
+            resumeArgumentsFor(claude, ID_A),
+            resumeArgumentsFor(claude),
+            resumeArgumentsFor(claude, 'x; calc'),
+            resumeArgumentsFor(DEFAULTS.harnesses.codex, ID_A),
+            resumeArgumentsFor({}, ID_A),
+        ], [['--resume', ID_A], ['--continue'], ['--continue'], ['resume', '--last'], []], 'a known id opens that conversation; otherwise the last one; an id that is not one never reaches the command line');
+        const harness = (extra) => HarnessSchema.safeParse({ npmPackage: 'x', npmBin: 'x', arguments: [], environment: {}, ...extra }).success;
+        t.check(harness({ resumeOneArguments: ['--resume', '{id}'] }) &&
+            !harness({ resumeOneArguments: ['--resume'] }) &&
+            SessionStatusSchema.safeParse(status({ conversation: ID_A })).success &&
+            !SessionStatusSchema.safeParse(status({ conversation: 'y'.repeat(200) })).success, 'resumeOneArguments needs {id}; a session status may carry a capped conversation');
+        t.section('not opening twice');
+        t.equal(notRunningYet([
+            { harness: 'claude', hostDir: 'F:\\code\\api' },
+            { harness: 'claude', hostDir: 'F:\\code\\api' },
+            { harness: 'codex', hostDir: 'F:\\code\\api' },
+        ], [{ harness: 'claude', hostDir: 'F:\\code\\API' }]).map((r) => r.harness), ['claude', 'codex'], 'a session the sandbox already has is not opened again (one for one, any letter case)');
+    },
+};

package/dist/selftest/secrets.test.d.ts

@@ -1,2 +1,2 @@
-import type { Suite } from './suite.js';
+import type { Suite } from './support/suite.js';
 export declare const secretsSuite: Suite;

package/dist/selftest/secrets.test.js

@@ -1,8 +1,7 @@
-// What reaches the sandbox from this PC's Claude files, and what is stripped first: API keys, cloud credentials, tokens in
-// MCP server definitions. Also the secret-looking files in a workspace that the launch warns about.
+// What reaches the sandbox from this PC's Claude files, and what is stripped first: API keys, cloud credentials, tokens
+// in MCP server definitions. Also the secret-looking files in a workspace that the launch warns about.
 import path from 'node:path';
-import { sandboxGlobalState } from '../host/claude-profile.js';
-import { findSecretFiles, stripMcpServers, stripSettings } from '../host/secrets.js';
+import { findSecretFiles, sandboxGlobalState, stripMcpServers, stripSettings } from '../host/profile/index.js';
 const REMOVED = '[removed by agent-sandbox]';
 export const secretsSuite = {
     name: 'secrets',
@@ -14,12 +13,15 @@ export const secretsSuite = {
             oauthAccount: { emailAddress: 'me' },
             mcpServers: { a: {} },
             theme: 'dark',
-            projects: { 'D:/Code/app': { mcpServers: { db: { env: { TOKEN: 'mine' } } } }, 'D:/Other': { mcpServers: { x: { env: { TOKEN: 'other' } } } } },
+            projects: {
+                'D:/Code/app': { mcpServers: { db: { env: { TOKEN: 'mine' } } } },
+                'D:/Other': { mcpServers: { x: { env: { TOKEN: 'other' } } } },
+            },
         }, 'D:\\Code\\app');
         const stateText = JSON.stringify(state);
         t.check(!('primaryApiKey' in state), 'the sandbox never gets your API key');
         t.check(!('oauthAccount' in state), 'the sandbox never gets your signed-in account');
-        t.includes(stateText, 'mine', 'the sandbox gets this project\'s MCP servers');
+        t.includes(stateText, 'mine', "the sandbox gets this project's MCP servers");
         t.excludes(stateText, 'other', 'the sandbox never gets other projects');
         t.equal(state.theme, 'dark', 'ordinary settings are kept');
         t.section('settings.json');
@@ -29,9 +31,21 @@ export const secretsSuite = {
             apiKeyHelper: 'aws-vault exec prod -- get-key',
             model: 'opus',
             env: {
-                AWS_ACCESS_KEY_ID: 'x', AWS_SECRET_ACCESS_KEY: 'y', AWS_REGION: 'eu-west-2', AZURE_CLIENT_SECRET: 'z', ARM_CLIENT_ID: 'id', CLOUDFLARE_API_TOKEN: 't',
-                GOOGLE_APPLICATION_CREDENTIALS: 'C:\\key.json', PROD_DB_HOST: 'db.internal', STRIPE_KEY: 'k', ACME_THING: 'a', DATABASE_URL: 'postgres://u:p@h/db',
-                INNOCENT: 'AKIAABCDEFGHIJKLMNOP', SAFE_URL: 'https://example.com', DISABLE_TELEMETRY: '1', CLAUDE_CODE_USE_BEDROCK: '1',
+                AWS_ACCESS_KEY_ID: 'x',
+                AWS_SECRET_ACCESS_KEY: 'y',
+                AWS_REGION: 'eu-west-2',
+                AZURE_CLIENT_SECRET: 'z',
+                ARM_CLIENT_ID: 'id',
+                CLOUDFLARE_API_TOKEN: 't',
+                GOOGLE_APPLICATION_CREDENTIALS: 'C:\\key.json',
+                PROD_DB_HOST: 'db.internal',
+                STRIPE_KEY: 'k',
+                ACME_THING: 'a',
+                DATABASE_URL: 'postgres://u:p@h/db',
+                INNOCENT: 'AKIAABCDEFGHIJKLMNOP',
+                SAFE_URL: 'https://example.com',
+                DISABLE_TELEMETRY: '1',
+                CLAUDE_CODE_USE_BEDROCK: '1',
             },
         }, secrets, removed);
         const env = settings.env;
@@ -41,20 +55,43 @@ export const secretsSuite = {
         t.equal(JSON.stringify(stripSettings({ env: { AWS_SECRET_ACCESS_KEY: 'y' } }, { ...secrets, strip: false }, [])), '{"env":{"AWS_SECRET_ACCESS_KEY":"y"}}', 'secrets.strip = false copies settings unchanged');
         t.section('MCP servers');
         const mcp = stripMcpServers({
-            mcpServers: { gh: { command: 'npx', args: ['server', '--api-key', 'plain', '--verbose', 'ghp_abcdefghijklmnopqrstuvwxyz0123456789'], env: { GITHUB_TOKEN: 'g', LOG_LEVEL: 'debug' } } },
-            projects: { 'D:/app': { mcpServers: { api: { type: 'http', url: 'https://x', headers: { Authorization: 'Bearer abcdefghijklmnopqrstuvwxyz', Accept: 'json' } } } } },
+            mcpServers: {
+                gh: {
+                    command: 'npx',
+                    args: ['server', '--api-key', 'plain', '--verbose', 'ghp_abcdefghijklmnopqrstuvwxyz0123456789'],
+                    env: { GITHUB_TOKEN: 'g', LOG_LEVEL: 'debug' },
+                },
+            },
+            projects: {
+                'D:/app': {
+                    mcpServers: {
+                        api: {
+                            type: 'http',
+                            url: 'https://x',
+                            headers: { Authorization: 'Bearer abcdefghijklmnopqrstuvwxyz', Accept: 'json' },
+                        },
+                    },
+                },
+            },
         }, secrets, []);
         const gh = mcp.mcpServers.gh;
-        const api = mcp.projects['D:/app'].mcpServers.api;
+        const api = mcp.projects['D:/app']
+            .mcpServers.api;
         t.equal(gh.args, ['server', '--api-key', REMOVED, '--verbose', REMOVED], 'MCP servers: key arguments and token-looking arguments are removed');
         t.equal(gh.env, { LOG_LEVEL: 'debug' }, 'MCP servers: token env vars are removed, the rest stays');
         t.equal(api.headers, { Accept: 'json' }, 'MCP servers: Authorization headers are removed');
         const sneaky = stripMcpServers({
             mcpServers: {
                 r: {
-                    type: 'http', url: 'https://mcp.example.com/mcp?api_key=0123456789abcdef&region=eu',
+                    type: 'http',
+                    url: 'https://mcp.example.com/mcp?api_key=0123456789abcdef&region=eu',
                     headers: { 'X-API-Key': 'k', 'x-auth-token': 't', Accept: 'json' },
-                    args: ['--api-key=deadbeefdeadbeef', '--header', 'Authorization: Bearer abcdefghijklmnopqrstuvwxyz', '--port=8080'],
+                    args: [
+                        '--api-key=deadbeefdeadbeef',
+                        '--header',
+                        'Authorization: Bearer abcdefghijklmnopqrstuvwxyz',
+                        '--port=8080',
+                    ],
                 },
             },
         }, secrets, []);
@@ -64,7 +101,14 @@ export const secretsSuite = {
         t.equal([r.args[0], r.args[2], r.args[3]], [REMOVED, REMOVED, '--port=8080'], 'MCP servers: --flag=value keys and "Authorization: Bearer" arguments are removed, ordinary flags stay');
         t.section('secret-looking files in the workspace');
         const workspace = t.at('secret-ws');
-        for (const file of ['.env', '.env.example', 'server.pem', 'README.md', 'api/credentials.json', 'node_modules/x/.env'])
+        for (const file of [
+            '.env',
+            '.env.example',
+            'server.pem',
+            'README.md',
+            'api/credentials.json',
+            'node_modules/x/.env',
+        ])
             t.write(path.join(workspace, file), 'x');
         t.equal(findSecretFiles(workspace).sort(), ['.env', 'api\\credentials.json', 'server.pem'], 'secret-looking workspace files are found for the launch warning (templates and dependencies ignored)');
     },

package/dist/selftest/setup.test.d.ts

@@ -1,2 +1,2 @@
-import type { Suite } from './suite.js';
+import type { Suite } from './support/suite.js';
 export declare const setupSuite: Suite;