windows-development-sandbox 1.4.3 → 1.7.0

package/dist/guest/toolchains/native/rust-extras.d.ts

@@ -3,8 +3,8 @@ import { type ToolEnv } from '../tool-env.js';
 /** "separate": tools\shims\cargo\cargo.exe in front of the real cargo, which it runs with the checkout's target dir. */
 export declare function cargoShim(env: ToolEnv, rust: Toolchains['rust']): void;
 /**
- * GNU host: Rust links through tools\shims\linkgate.exe (sandbox/linkgate.cs), which lets only `linkSlots` links run
- * at once in the whole sandbox and, with linker "lld", has MinGW's gcc use Rust's own lld instead of GNU ld.
+ * GNU host: Rust links through tools\shims\linkgate.exe (sandbox/csharp/LinkGate.cs), which lets only `linkSlots` links
+ * run at once in the whole sandbox and, with linker "lld", has MinGW's gcc use Rust's own lld instead of GNU ld.
  */
 export declare function linkGate(env: ToolEnv, rust: Toolchains['rust'], host: string): void;
 /**

package/dist/guest/toolchains/native/rust-extras.js

@@ -9,8 +9,8 @@ import { arch, tool } from '../tool-env.js';
 import { wanted } from '../detect.js';
 /**
  * Where cargo builds: shared with the PC's target\, one on the sandbox's disk, or a path. "separate" sets no variable:
- * the cargo shim (sandbox/cargoshim.cs) gives every checkout its own target\sandbox, so git worktrees of several agents
- * never overwrite each other's builds.
+ * the cargo shim (sandbox/csharp/CargoShim.cs) gives every checkout its own target\sandbox, so git worktrees of several
+ * agents never overwrite each other's builds.
  */
 const cargoTarget = (targetDir) => {
     if (targetDir === 'shared' || targetDir === 'separate')
@@ -30,8 +30,8 @@ export function cargoShim(env, rust) {
     env.vars.AGENT_REAL_CARGO = real;
 }
 /**
- * GNU host: Rust links through tools\shims\linkgate.exe (sandbox/linkgate.cs), which lets only `linkSlots` links run
- * at once in the whole sandbox and, with linker "lld", has MinGW's gcc use Rust's own lld instead of GNU ld.
+ * GNU host: Rust links through tools\shims\linkgate.exe (sandbox/csharp/LinkGate.cs), which lets only `linkSlots` links
+ * run at once in the whole sandbox and, with linker "lld", has MinGW's gcc use Rust's own lld instead of GNU ld.
  */
 export function linkGate(env, rust, host) {
     const gcc = tool('mingw', 'mingw64', 'bin', 'gcc.exe');

package/dist/guest/toolchains/native/vcruntime.js

@@ -2,9 +2,8 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawnAsync } from '../../../shared/download/index.js';
-import { SYSTEM } from '../../../shared/system.js';
 import { dryRun } from '../../runtime/paths.js';
-import { execOutput } from '../../runtime/process.js';
+import { scriptOutput } from '../../runtime/process.js';
 import { exists } from '../../runtime/fs.js';
 import { log } from '../../runtime/log.js';
 import { downloadFile } from '../install.js';
@@ -14,14 +13,7 @@ const MICROSOFT_SIGNER = 'CN=Microsoft Corporation, O=Microsoft Corporation, L=R
 /** 1638: a newer version is already installed; 3010: installed, a restart would finish it (not needed for the DLLs). */
 const OK_EXIT_CODES = [0, 1638, 3010];
 /** The subject of a valid Authenticode signature, or '' when the file is unsigned or tampered with. */
-const signerOf = (file) => execOutput(SYSTEM.powershell(), [
-    '-NoLogo',
-    '-NoProfile',
-    '-Command',
-    "$s = Get-AuthenticodeSignature -LiteralPath '" +
-        file.replace(/'/g, "''") +
-        "'; if ($s.Status -eq 'Valid') { $s.SignerCertificate.Subject }",
-]).trim();
+const signerOf = (file) => scriptOutput('get-signer.ps1', ['-Path', file]).trim();
 /**
  * A real installer (it writes to System32), so it runs on every boot; the installer itself is kept in persistent
  * storage and only run when Microsoft's signature on it checks out. Resolves true when this call ran the installer.

package/dist/guest/toolchains/plan.js

@@ -84,8 +84,8 @@ export function plan(config, versions, o) {
             install: (env) => setupPhp(env, config.php),
         },
         { name: 'Deno', enabled: wanted(config.deno.enabled, 'deno'), install: (env) => setupDeno(env) },
-        { name: 'Bun', enabled: config.bun.enabled, install: (env) => setupBun(env) },
-        { name: 'uv', enabled: config.uv.enabled, install: (env) => setupUv(env) },
+        { name: 'Bun', enabled: wanted(config.bun.enabled, 'bun'), install: (env) => setupBun(env) },
+        { name: 'uv', enabled: wanted(config.uv.enabled, 'uv'), install: (env) => setupUv(env) },
         { name: 'PowerShell 7', enabled: wanted(config.pwsh.enabled, 'pwsh'), install: (env) => setupPwsh(env, o.refresh) },
         // The openssl tool comes from Git's install: after Git.
         {
@@ -100,7 +100,12 @@ export function plan(config, versions, o) {
             shared: true,
             install: (env) => setupMesa(env, config.mesa),
         },
-        { name: 'VS Code', enabled: config.vscode.enabled, shared: true, install: (env) => setupVscode(env, o.refresh) },
+        {
+            name: 'VS Code',
+            enabled: wanted(config.vscode.enabled, 'vscode'),
+            shared: true,
+            install: (env) => setupVscode(env, o.refresh),
+        },
         // Desktop apps and extra tools (apps.install / apps.custom); games and 3D apps copy Mesa's OpenGL next to them.
         {
             name: 'Apps',

package/dist/guest/toolchains/runtimes.js

@@ -1,7 +1,7 @@
 // Bun, uv and Deno: single-binary tools from GitHub releases (claude-mem needs Bun and uv).
 import path from 'node:path';
 import { dryRun, localDir } from '../runtime/paths.js';
-import { exists } from '../runtime/fs.js';
+import { exists, mkdirp } from '../runtime/fs.js';
 import { log } from '../runtime/log.js';
 import { arch, tool, versionOf } from './tool-env.js';
 import { installFromGithub } from './install.js';
@@ -52,5 +52,5 @@ export function uvVars() {
 export async function setupUv(env) {
     await setupSingleExe(env, 'uv', 'astral-sh/uv', arch === 'arm64' ? /^uv-aarch64-pc-windows-msvc\.zip$/ : /^uv-x86_64-pc-windows-msvc\.zip$/, 'uv.exe', tool('uv'), { size: '20 MB' });
     Object.assign(env.vars, uvVars());
-    env.prepend.push(tool('uv-bin'));
+    env.prepend.push(mkdirp(tool('uv-bin')));
 }

package/dist/guest/toolchains/tools/cli.js

@@ -24,9 +24,9 @@ const toolVars = {
     }),
 };
 /**
- * tools\shims\openssl.exe (sandbox/openssl.cs), a launcher for Git's mingw64\bin\openssl.exe. A real .exe so programs
- * that call CreateProcess directly (Rust's Command::new("openssl")) find it, and only the shim is on PATH: mingw64\bin
- * itself would bring Git's runtime DLLs along and could shadow MinGW's gcc from the C/C++ step.
+ * tools\shims\openssl.exe (sandbox/csharp/OpenSsl.cs), a launcher for Git's mingw64\bin\openssl.exe. A real .exe so
+ * programs that call CreateProcess directly (Rust's Command::new("openssl")) find it, and only the shim is on PATH:
+ * mingw64\bin itself would bring Git's runtime DLLs along and could shadow MinGW's gcc from the C/C++ step.
  */
 const shimOpenssl = (env) => {
     if (!exists(tool('git', 'mingw64', 'bin', 'openssl.exe'))) {

package/dist/guest/toolchains/tools/vscode.js

@@ -10,7 +10,7 @@ import { SYSTEM } from '../../../shared/system.js';
 import { dryRun, isWin, logsDir } from '../../runtime/paths.js';
 import { exists, mkdirp } from '../../runtime/fs.js';
 import { log } from '../../runtime/log.js';
-import { powershell } from '../../runtime/process.js';
+import { runScriptWithJson } from '../../runtime/process.js';
 import { arch, tool } from '../tool-env.js';
 import { EXTENSION_ID, missingExtensions, vscodeExtensions, vscodeSettings } from './vscode-profile.js';
 /** Newer builds keep their files under a commit-hash folder, so the installed version is recorded here. */
@@ -19,14 +19,9 @@ const desktopShortcut = (exe) => {
     if (!isWin)
         return;
     const link = path.join(os.homedir(), 'Desktop', 'Visual Studio Code.lnk');
-    const q = (s) => "'" + s.replace(/'/g, "''") + "'";
-    powershell('$s = (New-Object -ComObject WScript.Shell).CreateShortcut(' +
-        q(link) +
-        '); $s.TargetPath = ' +
-        q(exe) +
-        '; $s.Arguments = ' +
-        q('"' + (process.env.AGENT_WORKSPACE ?? '') + '"') +
-        '; $s.Save()');
+    runScriptWithJson('new-shortcuts.ps1', 'ListFile', [
+        { link, target: exe, arguments: '"' + (process.env.AGENT_WORKSPACE ?? '') + '"' },
+    ]);
 };
 /** The first of `names` in one of `dirs`. */
 const findIn = (dirs, ...names) => {

package/dist/guest/vpn/index.d.ts

@@ -0,0 +1 @@
+export { setupVpn, setVpnStatus } from './vpn.js';

package/dist/guest/vpn/index.js

@@ -0,0 +1 @@
+export { setupVpn, setVpnStatus } from './vpn.js';

package/dist/guest/vpn/openvpn.d.ts

@@ -0,0 +1,9 @@
+/** Where the MSI puts the program. */
+export declare function openvpnExe(env?: NodeJS.ProcessEnv): string;
+export declare function openvpnDownload(arch?: string): {
+    file: string;
+    sha256: string;
+    url: string;
+};
+/** Installs OpenVPN unless it is there; returns the path of openvpn.exe. Throws with the reason when it cannot. */
+export declare function ensureOpenVpn(): Promise<string>;

package/dist/guest/vpn/openvpn.js

@@ -0,0 +1,47 @@
+// OpenVPN Community for the sandbox: one checksummed MSI from the publisher, installed silently (it brings the driver).
+// The sandbox is new at every boot, so the install runs each time; the MSI itself is cached in the persistent tools
+// folder. downloads.requireChecksum is honoured by the downloader (this entry has a checksum, so it always passes).
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { downloader, spawnAsync } from '../../shared/download/index.js';
+import { SYSTEM } from '../../shared/system.js';
+import { dryRun, isWin, toolsDir } from '../runtime/paths.js';
+import { exists, mkdirp } from '../runtime/fs.js';
+import { log } from '../runtime/log.js';
+import { OPENVPN_MSI } from '../../shared/vpn/download.js';
+/** Where the MSI puts the program. */
+export function openvpnExe(env = process.env) {
+    return path.join(env.ProgramFiles ?? 'C:\\Program Files', 'OpenVPN', 'bin', 'openvpn.exe');
+}
+export function openvpnDownload(arch = process.arch) {
+    const entry = arch === 'arm64' ? OPENVPN_MSI.arm64 : OPENVPN_MSI.x64;
+    return { ...entry, url: OPENVPN_MSI.base + entry.file };
+}
+const hasHash = (file, sha256) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex') === sha256;
+/** Installs OpenVPN unless it is there; returns the path of openvpn.exe. Throws with the reason when it cannot. */
+export async function ensureOpenVpn() {
+    const exe = openvpnExe();
+    if (!isWin || dryRun)
+        return exe;
+    if (exists(exe))
+        return exe;
+    const dl = openvpnDownload();
+    const msi = path.join(mkdirp(path.join(toolsDir, 'downloads')), dl.file);
+    // The tools folder lasts between sandboxes and the agent can write it: a cached file is trusted only by its hash.
+    if (!exists(msi) || !hasHash(msi, dl.sha256)) {
+        log('VPN: downloading OpenVPN ' + OPENVPN_MSI.version + ' (about 6 MB)');
+        await downloader.file(dl.url, msi, dl.sha256);
+    }
+    log('VPN: installing OpenVPN');
+    const logFile = path.join(toolsDir, 'downloads', 'openvpn-install.log');
+    const code = await spawnAsync(SYSTEM.msiexec(), ['/i', msi, '/qn', '/norestart', '/l*v', logFile], {
+        stdio: 'ignore',
+    });
+    // 3010: installed, a restart is wanted (nothing here needs one).
+    if (code !== 0 && code !== 3010)
+        throw new Error('The OpenVPN installer failed (exit ' + code + '). Its log: ' + logFile);
+    if (!exists(exe))
+        throw new Error('OpenVPN was installed but ' + exe + ' is missing. The installer log: ' + logFile);
+    return exe;
+}

package/dist/guest/vpn/tunnel.d.ts

@@ -0,0 +1,17 @@
+export interface TunnelOutcome {
+    readonly ok: boolean;
+    readonly message: string;
+    /** The tunnel's own address (what the kill switch lets through). */
+    readonly tunnelIp?: string;
+}
+export interface TunnelOptions {
+    readonly exe: string;
+    readonly profile: string;
+    readonly username: string;
+    readonly password: string;
+    readonly timeoutMs?: number;
+}
+/** Why the log says OpenVPN stopped, in a short plain sentence (or null when it does not say). */
+export declare function failureReason(text: string): string | null;
+/** Connects. Never leaves the login on disk; kills OpenVPN when the tunnel does not come up in time. */
+export declare function startTunnel(o: TunnelOptions): Promise<TunnelOutcome>;

package/dist/guest/vpn/tunnel.js

@@ -0,0 +1,78 @@
+// Starts OpenVPN with the login in a file that exists only while it connects, waits for the tunnel, and reports. The
+// file is deleted as soon as the tunnel is up (or has failed). OpenVPN reads it again when it must log in again, so a
+// tunnel that drops does not come back on its own (the kill switch then keeps the sandbox offline): the sandbox's
+// login is not left on disk for that.
+import { spawn } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { tunnelAddressFromLog } from '../../shared/vpn/kill-switch.js';
+import { logsDir } from '../runtime/paths.js';
+import { log } from '../runtime/log.js';
+const DONE = 'Initialization Sequence Completed';
+/** Why the log says OpenVPN stopped, in a short plain sentence (or null when it does not say). */
+export function failureReason(text) {
+    if (/AUTH_FAILED/i.test(text))
+        return 'the VPN refused the login (for NordVPN use the service credentials, not your account password)';
+    if (/TLS Error: TLS key negotiation failed|TLS handshake failed/i.test(text))
+        return 'it could not reach the VPN server (the network blocks it, or the server is down)';
+    if (/All wintun adapters on this system are in use|Cannot open TUN\/TAP|Could not create Wintun|ovpn-dco.*(error|failed)/i.test(text))
+        return 'the network driver for the tunnel could not be used';
+    if (/Exiting due to fatal error/i.test(text))
+        return 'OpenVPN stopped with an error';
+    return null;
+}
+const tail = (text, lines = 12) => text.trim().split(/\r?\n/).slice(-lines).join('\n');
+/** Connects. Never leaves the login on disk; kills OpenVPN when the tunnel does not come up in time. */
+export async function startTunnel(o) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sbx-vpn-'));
+    const auth = path.join(dir, 'login.txt');
+    const logFile = path.join(dir, 'openvpn.log');
+    const keepLog = () => {
+        try {
+            fs.mkdirSync(logsDir, { recursive: true });
+            fs.copyFileSync(logFile, path.join(logsDir, 'openvpn.log'));
+        }
+        catch {
+            // The log is only for finding out what went wrong.
+        }
+    };
+    fs.writeFileSync(auth, o.username + '\r\n' + o.password + '\r\n', 'utf8');
+    try {
+        const child = spawn(o.exe, ['--config', o.profile, '--auth-user-pass', auth, '--auth-nocache', '--verb', '3', '--log', logFile], { detached: true, stdio: 'ignore', windowsHide: true });
+        let exited = null;
+        child.once('exit', (code) => {
+            exited = code ?? -1;
+        });
+        child.once('error', (e) => {
+            exited = -1;
+            log('VPN: could not start OpenVPN: ' + e.message);
+        });
+        child.unref();
+        const deadline = Date.now() + (o.timeoutMs ?? 90000);
+        for (;;) {
+            const text = fs.existsSync(logFile) ? fs.readFileSync(logFile, 'utf8') : '';
+            if (text.includes(DONE)) {
+                keepLog();
+                const tunnelIp = tunnelAddressFromLog(text) ?? undefined;
+                return { ok: true, message: 'the tunnel is up', ...(tunnelIp ? { tunnelIp } : {}) };
+            }
+            const reason = failureReason(text);
+            if (exited !== null || reason) {
+                if (exited === null)
+                    child.kill();
+                keepLog();
+                return { ok: false, message: (reason ?? 'OpenVPN stopped') + '. ' + tail(text, 4) };
+            }
+            if (Date.now() > deadline) {
+                child.kill();
+                keepLog();
+                return { ok: false, message: 'the tunnel did not come up in time. ' + tail(text, 4) };
+            }
+            await new Promise((r) => setTimeout(r, 500));
+        }
+    }
+    finally {
+        fs.rmSync(auth, { force: true });
+    }
+}

package/dist/guest/vpn/vpn.d.ts

@@ -0,0 +1,6 @@
+import type { VpnStatus } from '../../shared/channel/schema.js';
+import type { SecretsFile } from '../../shared/channel/secrets.js';
+/** Writes run\vpn.json (what `sandbox vpn status` and the launch show). Never throws. */
+export declare function setVpnStatus(state: VpnStatus['state'], message: string, extra?: Partial<VpnStatus>): void;
+/** The whole step. Returns true when the tunnel is up. */
+export declare function setupVpn(secrets: SecretsFile, ptyHostExe: string | null): Promise<boolean>;

package/dist/guest/vpn/vpn.js

@@ -0,0 +1,126 @@
+// The VPN boot step (after the toolchains, before the agent): install OpenVPN, block everything that does not go
+// through the tunnel (the kill switch, applied BEFORE the tunnel starts), connect, check, delete the login, report. A
+// tunnel that fails never stops the boot: with the kill switch the sandbox stays offline and says so; without it, it
+// warns.
+import dns from 'node:dns';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { now } from '../../shared/channel/run-dir.js';
+import { writeJsonAtomic } from '../../shared/io/json.js';
+import { assertSafeOvpn } from '../../shared/vpn/ovpn.js';
+import { isIPv4 } from '../../shared/network/firewall-rules.js';
+import { killSwitchCommands, tunnelCommands } from '../../shared/vpn/kill-switch.js';
+import { errMsg } from '../../core/util/errors.js';
+import { run as netsh } from '../network/firewall.js';
+import { dryRun, isWin, launchDir, run } from '../runtime/paths.js';
+import { log, warn } from '../runtime/log.js';
+import { session } from '../runtime/session.js';
+import { ensureOpenVpn } from './openvpn.js';
+import { startTunnel } from './tunnel.js';
+/** Writes run\vpn.json (what `sandbox vpn status` and the launch show). Never throws. */
+export function setVpnStatus(state, message, extra = {}) {
+    try {
+        writeJsonAtomic(run.vpnFile, {
+            state,
+            message: message.slice(0, 1900),
+            killSwitch: session.vpn?.killSwitch ?? false,
+            updatedAt: now(),
+            ...(session.vpn ? { server: session.vpn.server.slice(0, 120) } : {}),
+            ...extra,
+        });
+    }
+    catch (e) {
+        warn('Could not write the VPN status: ' + errMsg(e));
+    }
+}
+/** IPv4 addresses of the servers the profile names: names are looked up now, before the kill switch closes DNS. */
+async function serverAddresses(remotes) {
+    const out = [];
+    for (const r of remotes) {
+        const ips = isIPv4(r.host)
+            ? [r.host]
+            : await dns.promises.lookup(r.host, { all: true, family: 4 }).then((all) => all.map((a) => a.address), () => []);
+        for (const ip of ips)
+            out.push({ ip, port: r.port, proto: r.proto });
+    }
+    return out;
+}
+/** What the sandbox looks like from outside, through the tunnel (null when it cannot be told quickly). */
+async function publicAddress() {
+    try {
+        const text = (await (await fetch('https://api.ipify.org', { signal: AbortSignal.timeout(10000) })).text()).trim();
+        return /^[0-9a-fA-F.:]{3,45}$/.test(text) ? text : null;
+    }
+    catch {
+        return null;
+    }
+}
+const hasAdapter = (ip) => Object.values(os.networkInterfaces()).some((list) => (list ?? []).some((i) => i.address === ip));
+/** The whole step. Returns true when the tunnel is up. */
+export async function setupVpn(secrets, ptyHostExe) {
+    const vpn = session.vpn;
+    if (!vpn)
+        return true;
+    const killSwitch = vpn.killSwitch;
+    let blocked = false;
+    const block = (servers) => {
+        if (isWin && !dryRun)
+            netsh(killSwitchCommands(servers, ptyHostExe));
+        blocked = true;
+        log('VPN: kill switch on: nothing leaves the sandbox except through the tunnel.');
+    };
+    setVpnStatus('starting', 'Starting the VPN');
+    try {
+        if (!session.networking)
+            throw new Error('networking is off for this sandbox');
+        const credentials = secrets.vpn;
+        if (!credentials)
+            throw new Error('the VPN login did not arrive (start the sandbox again)');
+        // The profile came from the host, but it is data like any other: checked again here before OpenVPN reads it.
+        const profile = path.join(launchDir, 'vpn', 'server.ovpn');
+        const remotes = assertSafeOvpn(fs.readFileSync(profile, 'utf8'), vpn.server);
+        const exe = await ensureOpenVpn();
+        const servers = await serverAddresses(remotes);
+        if (servers.length === 0)
+            throw new Error('the VPN server addresses could not be found');
+        if (killSwitch)
+            block(servers);
+        if (dryRun || !isWin) {
+            log('(dry run) would start the VPN tunnel to ' + vpn.server);
+            setVpnStatus('off', 'dry run');
+            return true;
+        }
+        log('VPN: connecting to ' + vpn.server);
+        const result = await startTunnel({ exe, profile, username: credentials.username, password: credentials.password });
+        if (!result.ok)
+            throw new Error(result.message);
+        if (!result.tunnelIp || !hasAdapter(result.tunnelIp))
+            throw new Error('the tunnel reported it was up, but no network adapter with its address appeared');
+        if (killSwitch)
+            netsh(tunnelCommands(result.tunnelIp));
+        const publicIp = await publicAddress();
+        log('VPN: up' + (publicIp ? ' (the sandbox appears as ' + publicIp + ')' : '') + '.');
+        setVpnStatus('up', 'The tunnel is up', publicIp ? { publicIp } : {});
+        return true;
+    }
+    catch (e) {
+        const reason = errMsg(e);
+        // Without the kill switch the sandbox keeps its normal connection: the rest of the boot goes on, with a warning.
+        try {
+            if (killSwitch && !blocked)
+                block([]);
+        }
+        catch (blockError) {
+            warn('VPN: could not close the network after the failure: ' + errMsg(blockError));
+        }
+        const text = 'VPN failed: ' +
+            reason +
+            (killSwitch
+                ? ' The kill switch is on, so this sandbox has NO internet access.'
+                : ' The kill switch is off, so this sandbox is using your normal connection.');
+        warn(text);
+        setVpnStatus('failed', reason);
+        return false;
+    }
+}

package/dist/host/agent-commands/commands.d.ts

@@ -1,13 +1,13 @@
 import type { Config } from '../../core/types.js';
-export declare const commandsDir: (storageRoot: string) => string;
+export declare function commandsDir(storageRoot: string): string;
 export interface AgentCommand {
     harness: string;
     command: string;
     real: string;
 }
 /** cmd.exe expands % and ^ even inside quotes: such paths cannot go into a forwarding file safely. */
-export declare const cmdSafe: (p: string) => boolean;
+export declare function cmdSafe(p: string): boolean;
 /** The agent's own executable on this PC, skipping this tool's forwarding files. */
-export declare const realAgent: (command: string, skipDir: string, pathValue?: string) => string | null;
+export declare function realAgent(command: string, skipDir: string, pathValue?: string): string | null;
 /** The agents that get a forwarding command: installed on this PC, and listed (or "auto" = all of them). */
-export declare const agentCommands: (config: Config, storageRoot: string, pathValue?: string) => AgentCommand[];
+export declare function agentCommands(config: Config, storageRoot: string, pathValue?: string): AgentCommand[];

package/dist/host/agent-commands/commands.js

@@ -1,15 +1,19 @@
-// (Beta) Agent commands: with agentCommands.enabled, typing an agent's own command on this PC (claude, codex, ...) starts
-// it in a hidden sandbox for the folder you are in and attaches that terminal. Small forwarding files in
+// (Beta) Agent commands: with agentCommands.enabled, typing an agent's own command on this PC (claude, codex, ...)
+// starts it in a hidden sandbox for the folder you are in and attaches that terminal. Small forwarding files in
 // <storage>\agent-commands go first on YOUR PATH (so they win over npm's and the installers' copies); turning it off
 // removes the files and that one PATH entry. SANDBOX_AGENT_DIRECT=1 runs the real agent on this PC instead.
 import path from 'node:path';
 import { fileExists } from '../../core/util/index.js';
-export const commandsDir = (storageRoot) => path.join(storageRoot, 'agent-commands');
+export function commandsDir(storageRoot) {
+    return path.join(storageRoot, 'agent-commands');
+}
 const EXTENSIONS = ['.exe', '.cmd', '.bat'];
 /** cmd.exe expands % and ^ even inside quotes: such paths cannot go into a forwarding file safely. */
-export const cmdSafe = (p) => !/[%"^\r\n]/.test(p);
+export function cmdSafe(p) {
+    return !/[%"^\r\n]/.test(p);
+}
 /** The agent's own executable on this PC, skipping this tool's forwarding files. */
-export const realAgent = (command, skipDir, pathValue = process.env.PATH ?? process.env.Path ?? '') => {
+export function realAgent(command, skipDir, pathValue = process.env.PATH ?? process.env.Path ?? '') {
     const skip = path.resolve(skipDir).toLowerCase();
     const dirs = pathValue.split(path.delimiter).filter((d) => d && path.resolve(d).toLowerCase() !== skip);
     for (const dir of dirs)
@@ -19,9 +23,9 @@ export const realAgent = (command, skipDir, pathValue = process.env.PATH ?? proc
                 return candidate;
         }
     return null;
-};
+}
 /** The agents that get a forwarding command: installed on this PC, and listed (or "auto" = all of them). */
-export const agentCommands = (config, storageRoot, pathValue) => {
+export function agentCommands(config, storageRoot, pathValue) {
     const wanted = config.agentCommands.agents;
     return Object.entries(config.harnesses).flatMap(([harness, h]) => {
         if (wanted !== 'auto' && !wanted.includes(harness))
@@ -30,4 +34,4 @@ export const agentCommands = (config, storageRoot, pathValue) => {
         const real = /^[A-Za-z0-9._-]+$/.test(command) ? realAgent(command, commandsDir(storageRoot), pathValue) : null;
         return real && cmdSafe(real) ? [{ harness, command, real }] : [];
     });
-};
+}

package/dist/host/agent-commands/forwarders.d.ts

@@ -2,6 +2,6 @@ import type { AgentCommand } from './commands.js';
 /** Marks files this tool wrote, so only those are ever replaced or removed. */
 export declare const MARKER = "windows-development-sandbox agent command";
 /** The .cmd file for one agent (cmd, PowerShell and Windows Terminal all run it). */
-export declare const forwardingCmd: (a: AgentCommand, node: string, entry: string) => string;
+export declare function forwardingCmd(a: AgentCommand, node: string, entry: string): string;
 /** The same for Git Bash, which looks for a file without an extension. */
-export declare const forwardingSh: (a: AgentCommand, node: string, entry: string) => string;
+export declare function forwardingSh(a: AgentCommand, node: string, entry: string): string;

package/dist/host/agent-commands/forwarders.js

@@ -1,18 +1,20 @@
 /** Marks files this tool wrote, so only those are ever replaced or removed. */
 export const MARKER = 'windows-development-sandbox agent command';
 /** The .cmd file for one agent (cmd, PowerShell and Windows Terminal all run it). */
-export const forwardingCmd = (a, node, entry) => [
-    '@echo off',
-    'rem ' + MARKER + ' (Beta). Turn off: sandbox agent-commands off. Run the real one: set SANDBOX_AGENT_DIRECT=1',
-    'if "%SANDBOX_AGENT_DIRECT%"=="1" goto direct',
-    '"' + node + '" "' + entry + '" launch --harness ' + a.harness + ' --headless --terminal -- %*',
-    'exit /b %errorlevel%',
-    ':direct',
-    'call "' + a.real + '" %*',
-    '',
-].join('\r\n');
+export function forwardingCmd(a, node, entry) {
+    return [
+        '@echo off',
+        'rem ' + MARKER + ' (Beta). Turn off: sandbox agent-commands off. Run the real one: set SANDBOX_AGENT_DIRECT=1',
+        'if "%SANDBOX_AGENT_DIRECT%"=="1" goto direct',
+        '"' + node + '" "' + entry + '" launch --harness ' + a.harness + ' --headless --terminal -- %*',
+        'exit /b %errorlevel%',
+        ':direct',
+        'call "' + a.real + '" %*',
+        '',
+    ].join('\r\n');
+}
 /** The same for Git Bash, which looks for a file without an extension. */
-export const forwardingSh = (a, node, entry) => {
+export function forwardingSh(a, node, entry) {
     const posix = (p) => p.replace(/^([A-Za-z]):/, (_m, d) => '/' + d.toLowerCase()).replace(/\\/g, '/');
     const q = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
     return [
@@ -28,4 +30,4 @@ export const forwardingSh = (a, node, entry) => {
             ' --headless --terminal -- "$@"',
         '',
     ].join('\n');
-};
+}

package/dist/host/agent-commands/reconcile.d.ts

@@ -9,4 +9,4 @@ export interface Reconciled {
  * Makes this PC match agentCommands: on = a forwarding file per installed agent and the folder first on your PATH;
  * off = no files, no PATH entry. Only touches files it wrote and its own PATH entry; does nothing when already right.
  */
-export declare const reconcileAgentCommands: (config: Config, storageRoot: string, node: string, entry: string) => Reconciled;
+export declare function reconcileAgentCommands(config: Config, storageRoot: string, node: string, entry: string): Reconciled;

package/dist/host/agent-commands/reconcile.js

@@ -23,14 +23,14 @@ const ownFiles = (dir) => fs.existsSync(dir)
  * Makes this PC match agentCommands: on = a forwarding file per installed agent and the folder first on your PATH;
  * off = no files, no PATH entry. Only touches files it wrote and its own PATH entry; does nothing when already right.
  */
-export const reconcileAgentCommands = (config, storageRoot, node, entry) => {
+export function reconcileAgentCommands(config, storageRoot, node, entry) {
     const dir = commandsDir(storageRoot);
     if (!config.agentCommands.enabled) {
         if (!fs.existsSync(dir))
             return { on: false, commands: [], changed: false };
         for (const f of ownFiles(dir))
             fs.rmSync(f, { force: true });
-        editUserPath(dir, false);
+        editUserPath(dir, false, storageRoot);
         if (fs.readdirSync(dir).length === 0)
             safeRemove(dir, storageRoot);
         return { on: false, commands: [], changed: true };
@@ -64,6 +64,6 @@ export const reconcileAgentCommands = (config, storageRoot, node, entry) => {
         .split(path.delimiter)
         .some((d) => path.resolve(d).toLowerCase() === path.resolve(dir).toLowerCase());
     if (changed || !onPath)
-        editUserPath(dir, true);
+        editUserPath(dir, true, storageRoot);
     return { on: true, commands, changed: changed || !onPath };
-};
+}

package/dist/host/agent-commands/user-path.d.ts

@@ -1,2 +1,5 @@
-/** Runs a PowerShell script that edits YOUR PATH (HKCU\Environment) unexpanded, then tells Windows it changed. */
-export declare const editUserPath: (dir: string, add: boolean) => void;
+/**
+ * Edits YOUR PATH (HKCU\Environment) unexpanded, then tells Windows it changed: HostTools.exe user-path (built in
+ * <storageRoot>\bin), else native\scripts\edit-user-path.ps1.
+ */
+export declare function editUserPath(dir: string, add: boolean, storageRoot: string): void;