windows-development-sandbox 1.4.3 → 1.7.0

package/dist/selftest/projects.test.js

@@ -1,28 +1,26 @@
-// Several projects in one sandbox: guest paths, the safety of what gets mapped, joining a running sandbox (roots,
-// wsb share, the restart fallback), the project spec sent to the guest, tighten-only protections, the per-project
-// environment, history sync and the repo guard for every project. Offline: temp folders only.
+// Several projects in one sandbox: guest paths, joining a running sandbox, the project spec sent to the guest,
+// tighten-only protections, boot wants, repo guard and --session. Offline: temp folders only.
 import fs from 'node:fs';
 import path from 'node:path';
 import { LocalOverridesSchema } from '../core/schema/index.js';
-import { allowStorePath, checkJoin, describeMissing, missingAtBoot, missingTip, nothingMissing, protectionsOf, saveAllowed, } from '../core/local-config/index.js';
-import { sessionsFirstIn } from '../host/channel/index.js';
+import { allowStorePath, checkJoin, describeMissing, missingAtBoot, nothingMissing, protectionsOf, saveAllowed, } from '../core/local-config/index.js';
+import { SandboxChannel, sessionsFirstIn } from '../host/channel/index.js';
 import { buildWsb } from '../host/launch/index.js';
 import { projectSpec, joinRunning } from '../host/projects/index.js';
 import { allProjectsToMap, KnownProjects } from '../host/projects/index.js';
 import { NeedsRestart, projectMapper } from '../host/projects/index.js';
-import { parseWsbBoot, ProjectRegistry } from '../host/projects/index.js';
+import { parseWsbBoot, ProjectRegistry, runningRegistry } from '../host/projects/index.js';
 import { RepoGuardStore } from '../host/guard/index.js';
 import { findWsb, parseCommands, parseIp, parseList, parseVersion } from '../host/sandbox/index.js';
 import { baseEnvFor } from '../guest/boot/project-env.js';
-import { guestDirFor, hostDirFor, hubName, insideProjects, isBelow, isWithin, planProjectMappings, projectForGuestDir, projectForHostDir, PROJECTS_GUEST, rootGuestDir, } from '../shared/paths/index.js';
-import { GuestRequestSchema, ProjectSpecSchema } from '../shared/channel/index.js';
+import { guestDirFor, hostDirFor, hubName, insideProjects, isWithin, planProjectMappings, projectForGuestDir, projectForHostDir, PROJECTS_GUEST, rootGuestDir, } from '../shared/paths/index.js';
+import { GuestRequestSchema, ProjectSpecSchema, RunDir } from '../shared/channel/index.js';
 import { projectFolderName } from '../shared/paths/index.js';
 import { syncHistoryOut } from '../sync/index.js';
 import { validateOptions, validateProjectsArgs } from '../cli/validate.js';
 import { parseCli, parseSessionWant } from '../cli/args.js';
-import { candidateFolders, severalAgentsArgv } from '../cli/menu/index.js';
+import { severalAgentsArgv } from '../cli/menu/index.js';
 import { generateSandbox } from '../host/launch/index.js';
-import { askedWhen } from '../cli/manifest.js';
 import { describeSessions } from '../cli/commands/projects/index.js';
 /** The error `fn` throws, or null. */
 const caught = (fn) => {
@@ -39,65 +37,70 @@ export const projectsSuite = {
     title: 'several projects in one sandbox (paths, joining, policy, specs, --session)',
     run: async (t, f) => {
         t.section('projects: guest paths');
-        t.check(isWithin('C:\\code\\a', 'c:\\CODE\\a\\src') && isWithin('C:\\code\\a\\', 'C:\\code\\a'), 'isWithin: case-insensitive, trailing slashes ignored');
-        t.check(!isWithin('C:\\code\\a', 'C:\\code\\ab') && !isWithin('C:\\code\\a', 'C:\\code'), 'isWithin: no prefix matches (a vs ab) and no parents');
-        t.equal(hubName('F:\\Code\\my app (v2)', []), 'my-app-v2', 'project ids are file-name safe');
-        t.equal(hubName('F:\\Code\\api', ['API', 'api-2']), 'api-3', 'project ids are unique (case-insensitive)');
-        t.equal(hubName('F:\\Code\\...', []), 'project', 'project ids are never empty');
-        t.equal(hubName('F:\\' + 'x'.repeat(80), []).length, 48, 'project ids are capped at 48 characters');
         const projects = [
             { host: 'F:\\Code', guest: 'C:\\Projects\\Code' },
             { host: 'F:\\Code\\api', guest: 'C:\\Projects\\api' },
         ];
-        t.equal(projectForHostDir(projects, 'f:\\code\\api\\src')?.guest, 'C:\\Projects\\api', 'the most specific mapped folder wins');
-        t.equal(projectForHostDir(projects, 'F:\\Code\\web')?.guest, 'C:\\Projects\\Code', 'a folder inside a mapped folder belongs to it');
-        t.equal(projectForHostDir(projects, 'F:\\Other'), null, 'unrelated folders belong to no project');
-        t.equal(projectForGuestDir(projects, 'C:\\Projects\\api\\x')?.host, 'F:\\Code\\api', 'the same works from inside the sandbox');
         const mapped = { host: 'F:\\Code', guest: 'C:\\Projects\\Code' };
         const webGuest = guestDirFor(mapped, 'F:\\Code\\web\\src');
-        t.equal(webGuest, 'C:\\Projects\\Code\\web\\src', 'host folder -> guest folder');
-        t.equal(hostDirFor(mapped, webGuest), 'F:\\Code\\web\\src', 'guest folder -> host folder (round trip)');
-        t.equal(guestDirFor(mapped, 'F:\\Code'), 'C:\\Projects\\Code', 'the mapped folder itself translates');
-        t.check(insideProjects('C:\\Projects\\api') && insideProjects('c:\\projects\\api\\src'), 'C:\\Projects\\<name> holds projects');
-        t.check(!insideProjects('C:\\Projects') && !insideProjects('C:\\ProjectsX\\a') && !insideProjects('C:\\Windows'), 'C:\\Projects itself and look-alikes do not');
-        t.check(insideProjects('F:\\Code\\web', ['F:\\Code']) && !insideProjects('F:\\Other', ['F:\\Code']), 'a mirrored root counts too');
-        t.check(isBelow('C:\\a', 'C:\\a\\b') && !isBelow('C:\\a', 'C:\\a'), 'isBelow is strict');
+        t.check(isWithin('C:\\code\\a', 'c:\\CODE\\a\\src') &&
+            !isWithin('C:\\code\\a', 'C:\\code\\ab') &&
+            hubName('F:\\Code\\my app (v2)', []) === 'my-app-v2' &&
+            hubName('F:\\Code\\api', ['API', 'api-2']) === 'api-3' &&
+            hubName('F:\\' + 'x'.repeat(80), []).length === 48 &&
+            projectForHostDir(projects, 'f:\\code\\api\\src')?.guest === 'C:\\Projects\\api' &&
+            projectForHostDir(projects, 'F:\\Code\\web')?.guest === 'C:\\Projects\\Code' &&
+            projectForHostDir(projects, 'F:\\Other') === null &&
+            projectForGuestDir(projects, 'C:\\Projects\\api\\x')?.host === 'F:\\Code\\api' &&
+            webGuest === 'C:\\Projects\\Code\\web\\src' &&
+            hostDirFor(mapped, webGuest) === 'F:\\Code\\web\\src' &&
+            insideProjects('c:\\projects\\api\\src') &&
+            !insideProjects('C:\\Projects') &&
+            !insideProjects('C:\\ProjectsX\\a') &&
+            insideProjects('F:\\Code\\web', ['F:\\Code']) &&
+            rootGuestDir(['F:\\Code'], false, 'F:\\Code\\web\\src') === 'C:\\Projects\\Code\\web\\src' &&
+            rootGuestDir(['F:\\Code'], false, 'F:\\Other') === null, 'path helpers: case-insensitive, no prefix matches (a vs ab); ids file-name safe, unique and capped; the most specific folder wins; host <-> guest round trip; C:\\Projects look-alikes are not projects; roots place their folders');
         const plan = planProjectMappings(['F:\\Code', 'E:\\Work\\Code', 'C:\\Users\\me\\src'], ['D:\\x\\api', 'D:\\y\\api'], false);
-        t.equal(plan.roots.map((r) => r.guest), ['C:\\Projects\\Code', 'C:\\Projects\\Code-2', 'C:\\Projects\\src'], 'roots get unique C:\\Projects\\<name> folders');
-        t.equal(plan.projects.map((p) => p.guest), ['C:\\Workspace\\api', 'C:\\Workspace\\api-2'], 'projects mapped on their own get unique C:\\Workspace\\<name> folders (where they are as the launch folder)');
-        t.equal(planProjectMappings([], ['D:\\x\\app'], false, ['C:\\Workspace\\app']).projects[0].guest, 'C:\\Workspace\\app-2', "a project mapped on its own never lands on the launch folder's place");
-        t.equal(planProjectMappings(['F:\\Code'], ['D:\\x\\api'], true).projects[0].guest, 'D:\\x\\api', 'with "mirror" a project mapped on its own appears at its PC path, as it would as the launch folder');
-        t.equal(rootGuestDir(['F:\\Code'], false, 'F:\\Code\\web\\src'), 'C:\\Projects\\Code\\web\\src', "a folder inside a root is placed under the root's guest folder");
-        t.equal(rootGuestDir(['F:\\Code'], false, 'F:\\Other'), null, 'a folder in no root has no root place');
-        const mirror = planProjectMappings(['F:\\Code', 'C:\\Users\\me\\src'], [], true);
-        t.equal(mirror.roots.map((r) => r.guest), ['F:\\Code', 'C:\\Projects\\src'], 'with "mirror" a root appears at its PC path when the sandbox can show it there (C:\\Users\\... cannot)');
+        t.equal([
+            plan.roots.map((r) => r.guest),
+            plan.projects.map((p) => p.guest),
+            planProjectMappings([], ['D:\\x\\app'], false, ['C:\\Workspace\\app']).projects[0].guest,
+            planProjectMappings(['F:\\Code'], ['D:\\x\\api'], true).projects[0].guest,
+            planProjectMappings(['F:\\Code', 'C:\\Users\\me\\src'], [], true).roots.map((r) => r.guest),
+        ], [
+            ['C:\\Projects\\Code', 'C:\\Projects\\Code-2', 'C:\\Projects\\src'],
+            ['C:\\Workspace\\api', 'C:\\Workspace\\api-2'],
+            'C:\\Workspace\\app-2',
+            'D:\\x\\api',
+            ['F:\\Code', 'C:\\Projects\\src'],
+        ], 'roots and projects mapped on their own get unique guest folders, never the launch folder\'s place; with "mirror" they appear at their PC path when the sandbox can show it there (C:\\Users\\... cannot)');
         t.section('projects: tighten-only protections when joining a running sandbox');
         const base = protectionsOf(f.baseConfig);
         const same = checkJoin(base, base);
-        t.equal({ stricter: same.stricter, looser: same.looser }, { stricter: [], looser: [] }, 'the same settings join without notes');
         const readonlyGit = protectionsOf({
             ...f.baseConfig,
             provisioning: { ...f.baseConfig.provisioning, git: { ...f.baseConfig.provisioning.git, access: 'readonly' } },
         });
-        t.check(checkJoin(base, readonlyGit).stricter.some((s) => s.startsWith('provisioning.git.access')), 'a project needing stricter git access than the running sandbox is refused (git access is machine-wide)');
         const loosening = checkJoin(readonlyGit, base);
-        t.equal(loosening.stricter.length, 0, 'a project asking for less git access is not refused...');
-        t.check(loosening.looser.some((s) => s.includes('provisioning.git.access stays "readonly"')), "... it gets the sandbox's stricter value, with a note: never loosened", JSON.stringify(loosening.looser));
         const offline = protectionsOf({ ...f.baseConfig, sandbox: { ...f.baseConfig.sandbox, networking: false } });
-        t.check(checkJoin(base, offline).stricter.some((s) => s.startsWith('sandbox.networking')), 'networking off is stricter than a sandbox with networking');
-        t.check(checkJoin(offline, base).looser.some((s) => s.startsWith('sandbox.networking')), 'networking on is looser than an offline sandbox');
         const readOnly = protectionsOf({ ...f.baseConfig, readOnly: true });
-        t.check(checkJoin(readOnly, readOnly).stricter.some((s) => s.startsWith('readOnly')), 'a read-only project cannot join (other projects are mapped read/write), even when the launch folder was read-only');
-        t.check(!LocalOverridesSchema.safeParse({ projects: { roots: ['C:\\'] } }).success, "a project's .sandbox-config.json can never set projects.roots (they map folders of this PC)");
-        t.check(!LocalOverridesSchema.safeParse({ projects: { all: true } }).success, "a project's .sandbox-config.json can never set projects.all");
-        // A project file that loosens git access is clamped by keepStrictest first, then joins without being refused.
+        t.check(same.stricter.length === 0 &&
+            same.looser.length === 0 &&
+            checkJoin(base, readonlyGit).stricter.some((s) => s.startsWith('provisioning.git.access')) &&
+            loosening.stricter.length === 0 &&
+            loosening.looser.some((s) => s.includes('provisioning.git.access stays "readonly"')) &&
+            checkJoin(base, offline).stricter.some((s) => s.startsWith('sandbox.networking')) &&
+            checkJoin(offline, base).looser.some((s) => s.startsWith('sandbox.networking')) &&
+            checkJoin(readOnly, readOnly).stricter.some((s) => s.startsWith('readOnly')), 'joining: the same settings need no notes; stricter than the running sandbox is refused (git access, networking off), asking for less keeps the sandbox value with a note; a read-only project cannot join', JSON.stringify(loosening.looser));
+        t.check(!LocalOverridesSchema.safeParse({ projects: { roots: ['C:\\'] } }).success &&
+            !LocalOverridesSchema.safeParse({ projects: { all: true } }).success, "a project's .sandbox-config.json can never set projects.roots or projects.all");
         const strictUser = structuredClone(f.baseConfig);
         strictUser.provisioning.git.access = 'readonly';
         const looseDir = t.dir('proj-loose');
         f.writeLocal(looseDir, { provisioning: { git: { access: 'full' } } });
         const loose = await f.run({ cwd: looseDir, trustConfig: true }, strictUser);
-        t.equal(loose.config.provisioning.git.access, 'readonly', 'tighten-only: a project file cannot loosen git access');
-        t.equal(checkJoin(protectionsOf(strictUser), protectionsOf(loose.config)).stricter, [], 'tighten-only: so it joins a readonly sandbox as readonly');
+        t.check(loose.config.provisioning.git.access === 'readonly' &&
+            checkJoin(protectionsOf(strictUser), protectionsOf(loose.config)).stricter.length === 0, 'a project file cannot loosen git access, so it joins a readonly sandbox as readonly');
         const tightDir = t.dir('proj-tight');
         f.writeLocal(tightDir, { provisioning: { git: { access: 'none' } } });
         const tight = await f.run({ cwd: tightDir, trustConfig: true });
@@ -116,44 +119,94 @@ export const projectsSuite = {
             boot: [{ host: f.workB, guest: 'C:\\Projects\\work-b' }],
         });
         const registry = new ProjectRegistry(storage).read();
-        t.check(primary.primary, 'at launch the launch folder is the primary project');
-        t.equal(registry?.projects.length, 2, 'at launch the registry holds the launch folder and the projects mapped with it');
-        t.equal({ mechanism: registry?.projects[1].mechanism, name: registry?.projects[1].name }, { mechanism: 'boot', name: 'work-b' }, 'a project mapped at boot is registered by its mechanism and name');
-        t.equal(new ProjectRegistry(storage).here(path.join(f.workA, 'src'))?.guestDir, 'C:\\Workspace\\work-a\\src', 'projectHere: a folder inside the launch folder');
-        t.equal(new ProjectRegistry(storage).here(f.workB)?.project.mechanism, 'boot', 'projectHere: a project mapped at boot');
-        t.equal(new ProjectRegistry(storage).here(outside), null, 'projectHere: a folder in no project');
+        t.check(primary.primary &&
+            registry?.projects.length === 2 &&
+            registry.projects[1].mechanism === 'boot' &&
+            registry.projects[1].name === 'work-b' &&
+            new ProjectRegistry(storage).here(path.join(f.workA, 'src'))?.guestDir === 'C:\\Workspace\\work-a\\src' &&
+            new ProjectRegistry(storage).here(outside) === null, 'at launch the registry holds the launch folder (primary) and the projects mapped with it; a folder inside a project finds it, one in no project does not');
         const noWsb = projectMapper({ storageRoot: storage, packageRoot: f.install, wsbShare: true, detect: () => null });
         const web = noWsb.register(inRoot);
-        t.equal({ mechanism: web.mechanism, guest: web.guest }, { mechanism: 'root', guest: 'C:\\Projects\\proj-root\\web' }, 'a folder inside a root joins at once (also one created after boot)');
-        t.equal(noWsb.register(inRoot).name, web.name, 'registering the same folder again gives the same project');
-        t.equal(new ProjectRegistry(storage).read()?.projects.filter((p) => p.host === inRoot).length, 1, 'a folder is registered once');
+        t.check(web.mechanism === 'root' &&
+            web.guest === 'C:\\Projects\\proj-root\\web' &&
+            noWsb.register(inRoot).name === web.name &&
+            new ProjectRegistry(storage).read()?.projects.filter((p) => p.host === inRoot).length === 1, 'a folder inside a root joins at once, and only once');
+        t.section('projects: a registry another copy wrote, lost or left from an earlier sandbox');
+        const lostStorage = t.at('proj-lost');
+        const lostData = t.dir('proj-lost', 'data', 'testdata');
+        const lostRoot = t.dir('proj-lost-root');
+        const lostWeb = t.dir('proj-lost-root', 'web');
+        const lostLaunch = '1700000000001-abc123';
+        t.write(path.join(lostStorage, 'launches', lostLaunch, 'session.json'), JSON.stringify({
+            launchId: lostLaunch,
+            workspace: 'C:\\Workspace\\work-a',
+            workspaceHost: f.workA,
+            roots: ['C:\\Projects\\proj-lost-root'],
+        }));
+        t.write(path.join(lostStorage, 'launches', lostLaunch, 'agent.wsb'), '<Configuration><MappedFolders><MappedFolder><HostFolder>' +
+            lostRoot +
+            '</HostFolder><SandboxFolder>C:\\Projects\\proj-lost-root</SandboxFolder><ReadOnly>false</ReadOnly>' +
+            '</MappedFolder></MappedFolders></Configuration>');
+        const lostStatus = (id) => t.write(path.join(lostData, 'run', 'sandbox.json'), JSON.stringify({
+            launchId: id,
+            phase: 'ready',
+            message: 'ready',
+            updatedAt: new Date().toISOString(),
+            workspaceHost: f.workA,
+            guestWorkspace: 'C:\\Workspace\\work-a',
+            headless: false,
+        }));
+        lostStatus(lostLaunch);
+        const lostRebuilt = runningRegistry(lostStorage, lostData, base);
+        t.check(lostRebuilt?.launchId === lostLaunch &&
+            lostRebuilt.projects[0]?.host === f.workA &&
+            new ProjectRegistry(lostStorage).rootHere(lostWeb)?.guest === 'C:\\Projects\\proj-lost-root', 'no registry file: it is rebuilt from the launch folder, and a folder in a root is found');
+        const lostFile = path.join(lostStorage, 'run', 'projects.json');
+        const lostWritten = JSON.parse(fs.readFileSync(lostFile, 'utf8'));
+        fs.writeFileSync(lostFile, JSON.stringify({ ...lostWritten, addedByANewerVersion: { x: 1 } }));
+        t.check(new ProjectRegistry(lostStorage).read()?.launchId === lostLaunch, 'a registry with fields from another version is still read');
+        fs.writeFileSync(lostFile, JSON.stringify({ ...lostWritten, launchId: '1699999999999-000000', roots: [] }));
+        t.check(runningRegistry(lostStorage, lostData, base)?.roots.length === 1, "a registry left from an earlier sandbox is replaced by the running one's");
+        lostStatus('1700000000002-def456');
+        t.check(runningRegistry(lostStorage, lostData, base) === null, 'no launch folder for the running sandbox: no registry (never an earlier sandbox one)');
         const needs = caught(() => noWsb.register(outside));
-        t.check(needs instanceof NeedsRestart && needs.reason.includes('wsb share needs Windows 11 24H2'), 'a folder outside every root without the Windows Sandbox CLI needs a restart (and says why)');
         const shareOff = caught(() => projectMapper({ storageRoot: storage, packageRoot: f.install, wsbShare: false }).register(outside));
-        t.check(shareOff instanceof NeedsRestart && shareOff.reason.includes('projects.wsbShare'), 'projects.wsbShare off goes straight to the restart offer');
-        const fakeWsb = {
-            exe: t.at('no-such-wsb.exe'),
-            version: '0.1.0',
-            commands: ['share', 'list'],
-            has: (c) => c === 'share' || c === 'list',
-        };
-        const listFails = caught(() => projectMapper({ storageRoot: storage, packageRoot: f.install, wsbShare: true, detect: () => fakeWsb }).register(outside));
-        t.check(listFails instanceof NeedsRestart && listFails.reason.includes('wsb share could not find the running sandbox'), 'when wsb cannot tell which sandbox is ours, it falls back to the restart offer with the reason');
-        await t.throws(() => noWsb.register(storage), 'cannot be the workspace', 'joining uses the launch-folder safety checks: not the storage folder');
-        await t.throws(() => noWsb.register('C:\\'), 'whole drive', 'joining uses the launch-folder safety checks: not a drive root');
-        await t.throws(() => noWsb.unregister(primary.name), 'stays until the sandbox stops', 'the launch folder cannot be removed from a running sandbox');
-        // joinRunning: resolves the folder, checks protections, registers it, guards it, and builds the spec for the guest.
+        const listFails = caught(() => projectMapper({
+            storageRoot: storage,
+            packageRoot: f.install,
+            wsbShare: true,
+            detect: () => ({
+                exe: t.at('no-such-wsb.exe'),
+                version: '0.1.0',
+                commands: ['share', 'list'],
+                has: (c) => c === 'share' || c === 'list',
+            }),
+        }).register(outside));
+        t.check(needs instanceof NeedsRestart &&
+            needs.reason.includes('wsb share needs Windows 11 24H2') &&
+            shareOff instanceof NeedsRestart &&
+            shareOff.reason.includes('projects.wsbShare') &&
+            listFails instanceof NeedsRestart &&
+            listFails.reason.includes('wsb share could not find the running sandbox'), 'a folder outside every root needs a restart when wsb share is missing, switched off, or cannot tell which sandbox is ours, and says why');
+        const refusedStorage = await t.thrownMessage(() => noWsb.register(storage));
+        const refusedDrive = await t.thrownMessage(() => noWsb.register('C:\\'));
+        const refusedRemoval = await t.thrownMessage(() => noWsb.unregister(primary.name));
+        t.check(refusedStorage.includes('cannot be the workspace') &&
+            refusedDrive.includes('whole drive') &&
+            refusedRemoval.includes('stays until the sandbox stops'), 'joining refuses the storage folder and a drive root; the launch folder cannot be removed from a running sandbox', [refusedStorage, refusedDrive, refusedRemoval].join(' / '));
         const resolveFor = (run) => async () => run;
         const join = (hostDir, resolve) => joinRunning({ storageRoot: storage, dataPath: data, packageRoot: f.install, hostDir, wsbShare: false, resolve });
         const webRun = await f.run({ cwd: inRoot, trustConfig: true });
         const joined = await join(inRoot, resolveFor(webRun));
-        t.equal(joined.spec?.workspace, 'C:\\Projects\\proj-root\\web', 'joining a project builds a spec with its guest folder...');
-        t.check(ProjectSpecSchema.safeParse(joined.spec).success && joined.spec?.harnesses.claude !== undefined, '... that is valid and carries the agent');
-        t.check(new KnownProjects(storage).list().some((k) => k.host === inRoot), 'joined projects are remembered (projects.all, sandbox projects)');
         const launchFolder = await join(path.join(f.workA, 'sub'), () => Promise.reject(new Error('must not resolve')));
-        t.equal(launchFolder.spec, null, 'the launch folder (and below) needs no spec: its sessions use the boot environment');
-        await t.throws(() => join(tightDir, resolveFor(tight)), 'stricter than the running sandbox', 'a project whose .sandbox-config.json tightens git access beyond the running sandbox is refused without your consent, with the reason');
-        t.check(new ProjectRegistry(storage).read()?.projects.every((p) => p.host !== tightDir) === true, 'a refused project is not registered');
+        t.check(joined.spec?.workspace === 'C:\\Projects\\proj-root\\web' &&
+            ProjectSpecSchema.safeParse(joined.spec).success &&
+            joined.spec.harnesses.claude !== undefined &&
+            new KnownProjects(storage).list().some((k) => k.host === inRoot) &&
+            launchFolder.spec === null, 'joining builds a valid spec with its guest folder and the agent, and remembers the project; the launch folder (and below) needs no spec');
+        const refusedTight = await t.thrownMessage(() => join(tightDir, resolveFor(tight)));
+        t.check(refusedTight.includes('stricter than the running sandbox') &&
+            new ProjectRegistry(storage).read()?.projects.every((p) => p.host !== tightDir) === true, 'a project that tightens git access beyond the running sandbox is refused without consent, and not registered', refusedTight);
         let asked = [];
         const agreed = await t.thrownMessage(() => joinRunning({
             storageRoot: storage,
@@ -168,7 +221,7 @@ export const projectsSuite = {
             },
         }));
         t.check(asked.some((s) => s.startsWith('provisioning.git.access')) &&
-            !agreed.includes('stricter than the running sandbox'), 'with your consent it is not refused for its stricter settings (it goes on to joining: here a restart, as its folder is outside every root)', agreed);
+            !agreed.includes('stricter than the running sandbox'), 'with your consent it is not refused for its stricter settings', agreed);
         const outsideRun = await f.run({ cwd: outside });
         await t.throws(() => join(outside, resolveFor(outsideRun)), 'projects.wsbShare', 'a folder that cannot be shown lets NeedsRestart reach the caller');
         t.section('projects: the spec and request the guest gets');
@@ -182,66 +235,80 @@ export const projectsSuite = {
             createdAt: new Date().toISOString(),
             ...extra,
         });
-        t.check(sessionRequest({ project: spec }).success, 'a session request carries a project spec');
-        t.check(sessionRequest({ project: spec, harnessSpec: f.baseConfig.harnesses.codex }).success, 'a session request carries an agent definition');
-        t.check(!sessionRequest({ project: { ...spec, name: '..\\evil' } }).success, 'specs are validated: project ids are file-name safe');
-        t.check(!sessionRequest({ project: { ...spec, extra: 1 } }).success, 'specs are validated: no unknown keys');
+        const carries = sessionRequest({ project: spec, harnessSpec: f.baseConfig.harnesses.codex }).success;
+        const codexId = new SandboxChannel(data, () => true).requestSession('codex', [], spec.workspace, {
+            project: spec,
+            harnessSpec: f.baseConfig.harnesses.codex,
+        });
+        const codexRequest = GuestRequestSchema.parse(JSON.parse(fs.readFileSync(new RunDir(data).requestFile(codexId), 'utf8')));
+        t.check(carries &&
+            codexRequest.kind === 'session' &&
+            codexRequest.harness === 'codex' &&
+            codexRequest.cwd === spec.workspace &&
+            codexRequest.project?.name === spec.name &&
+            codexRequest.harnessSpec?.npmBin === 'codex', 'a session request carries a project spec and an agent definition: an agent asked for in a joined project is requested there');
         const manyDatabases = Array(9).fill(spec.databases[0] ?? { database: 'redis', reasons: [], version: 'x', port: 6379 });
-        t.check(!sessionRequest({ project: { ...spec, databases: manyDatabases } }).success, 'specs are validated: lists are capped');
         const manyAgents = Object.fromEntries(Array.from({ length: 9 }, (_, i) => ['a' + i, f.baseConfig.harnesses.codex]));
-        t.check(!sessionRequest({ project: { ...spec, harnesses: manyAgents } }).success, 'at most 8 agent definitions in one spec');
-        t.check(GuestRequestSchema.safeParse({ kind: 'project', id: 'p1', project: spec, createdAt: 'x' }).success, '"project" requests (set up without an agent) carry a spec');
-        t.check(!GuestRequestSchema.safeParse({ kind: 'project', id: 'p1', createdAt: 'x' }).success, '"project" requests need a spec');
-        t.check(GuestRequestSchema.safeParse({ kind: 'restart', id: 'x', harness: null, cwd: 'C:\\Projects\\a', createdAt: 'x' })
-            .success, "restart can be scoped to one project's folder");
-        t.check(GuestRequestSchema.safeParse({ kind: 'restart', id: 'x', harness: null, createdAt: 'x' }).success, 'restart still works without a folder');
+        t.check(!sessionRequest({ project: { ...spec, name: '..\\evil' } }).success &&
+            !sessionRequest({ project: { ...spec, extra: 1 } }).success &&
+            !sessionRequest({ project: { ...spec, databases: manyDatabases } }).success &&
+            !sessionRequest({ project: { ...spec, harnesses: manyAgents } }).success &&
+            GuestRequestSchema.safeParse({ kind: 'project', id: 'p1', project: spec, createdAt: 'x' }).success &&
+            !GuestRequestSchema.safeParse({ kind: 'project', id: 'p1', createdAt: 'x' }).success, 'specs are validated: file-name safe ids, no unknown keys, capped lists; "project" requests need a spec');
         t.section('projects: which projects are mapped at boot');
-        const toMap = allProjectsToMap(['C:\\a', 'C:\\a\\b', 'C:\\work-a\\x', 'C:\\r\\p', 'C:\\ex\\y', 'C:\\gone'], {
+        t.equal(allProjectsToMap(['C:\\a', 'C:\\a\\b', 'C:\\work-a\\x', 'C:\\r\\p', 'C:\\ex\\y', 'C:\\gone'], {
             primary: 'C:\\work-a',
             roots: ['C:\\r'],
             exclude: ['C:\\ex'],
             exists: (p) => p !== 'C:\\gone',
-        });
-        t.equal(toMap, ['C:\\a'], "projects.all: known projects except excluded, missing, nested, the launch folder's and the roots'");
+        }), ['C:\\a'], "projects.all: known projects except excluded, missing, nested, the launch folder's and the roots'");
         const rootConfig = structuredClone(f.baseConfig);
         rootConfig.projects = { ...rootConfig.projects, roots: [root, t.at('no-such-root')], all: true };
         new KnownProjects(f.baseConfig.storage.root).remember(outside);
         const gen = f.generate(await f.run({}, rootConfig));
         const session = f.readJson(gen.sessionPath);
         const wsb = fs.readFileSync(gen.wsbPath, 'utf8');
-        t.equal(gen.projects.roots.map((r) => r.guest), ['C:\\Projects\\proj-root'], 'roots are mapped as C:\\Projects\\<name>');
-        t.check(gen.projects.notes.some((n) => n.includes('no-such-root')), 'a missing root is skipped with a note', JSON.stringify(gen.projects.notes));
-        t.check(gen.projects.projects.some((p) => p.host === outside), 'projects.all maps the known projects too');
-        t.includes(wsb, '<HostFolder>' +
-            root +
-            '</HostFolder><SandboxFolder>C:\\Projects\\proj-root</SandboxFolder><ReadOnly>false</ReadOnly>', 'roots are mapped read/write in the .wsb');
-        t.equal({ projectsDir: session.projectsDir, roots: session.roots, projectId: session.projectId }, {
+        t.check(gen.projects.roots.map((r) => r.guest).join() === 'C:\\Projects\\proj-root' &&
+            gen.projects.notes.some((n) => n.includes('no-such-root')) &&
+            gen.projects.projects.some((p) => p.host === outside), 'roots are mapped as C:\\Projects\\<name>, a missing root is skipped with a note, projects.all maps known projects', JSON.stringify(gen.projects.notes));
+        t.equal({
+            rwInWsb: wsb.includes('<HostFolder>' +
+                root +
+                '</HostFolder><SandboxFolder>C:\\Projects\\proj-root</SandboxFolder><ReadOnly>false</ReadOnly>'),
+            projectsDir: session.projectsDir,
+            roots: session.roots,
+            projectId: session.projectId,
+        }, {
+            rwInWsb: true,
             projectsDir: PROJECTS_GUEST,
             roots: ['C:\\Projects\\proj-root', 'C:\\Workspace\\proj-outside'],
             projectId: 'work-a',
-        }, 'session.json tells the guest where other projects can be');
-        // The same project is at the same place whether it started the sandbox or joined one another project started.
+        }, 'roots are mapped read/write in the .wsb, and session.json tells the guest where other projects can be');
+        // A project is at the same place whether it started the sandbox or joined one another project started.
         const fromRoot = f.generate(await f.run({ cwd: inRoot }, rootConfig));
-        const joinedAt = guestDirFor(gen.projects.roots[0], inRoot);
-        t.equal([f.readJson(fromRoot.sessionPath).workspace, joinedAt], ['C:\\Projects\\proj-root\\web', 'C:\\Projects\\proj-root\\web'], 'a project in a root: the same guest folder as the launch folder and when another project started the sandbox');
-        t.check(!fromRoot.mappings.some((m) => m.host.toLowerCase() === inRoot.toLowerCase()), 'a launch folder inside a root is shown by the root (no second mapping of it)');
-        t.includes(fs.readFileSync(path.join(fromRoot.launchPath, 'env.cmd'), 'utf8'), 'AGENT_WORKSPACE=C:\\Projects\\proj-root\\web', 'env.cmd: AGENT_WORKSPACE follows');
+        t.check(f.readJson(fromRoot.sessionPath).workspace === 'C:\\Projects\\proj-root\\web' &&
+            guestDirFor(gen.projects.roots[0], inRoot) === 'C:\\Projects\\proj-root\\web' &&
+            !fromRoot.mappings.some((m) => m.host.toLowerCase() === inRoot.toLowerCase()) &&
+            fs
+                .readFileSync(path.join(fromRoot.launchPath, 'env.cmd'), 'utf8')
+                .includes('AGENT_WORKSPACE=C:\\Projects\\proj-root\\web'), 'a project in a root: same guest folder as launch folder or joined (and in env.cmd), and no second mapping of it');
         const asLaunch = f.readJson(f.generate(await f.run({ cwd: outside })).sessionPath).workspace;
-        t.equal([asLaunch, gen.projects.projects.find((p) => p.host === outside)?.guest], ['C:\\Workspace\\proj-outside', 'C:\\Workspace\\proj-outside'], 'a project outside the roots: the same guest folder as the launch folder and when mapped at boot by another');
         const mirrorRoot = structuredClone(rootConfig);
         mirrorRoot.guestWorkspace = 'mirror';
-        t.equal(f.readJson(f.generate(await f.run({ cwd: inRoot }, mirrorRoot)).sessionPath).workspace, rootGuestDir([root], true, inRoot), 'with "mirror" a launch folder inside a root is where the root shows it (no overlapping mappings)');
+        const mirrored = f.readJson(f.generate(await f.run({ cwd: inRoot }, mirrorRoot)).sessionPath).workspace;
         const filtered = structuredClone(rootConfig);
         filtered.workspaceFilter = { ...filtered.workspaceFilter, enabled: true };
         const filteredRun = await f.run({ cwd: inRoot }, filtered);
-        t.equal(filteredRun.config.guestWorkspace, 'C:\\Workspace\\web', 'workspaceFilter: a launch folder inside a root keeps its own (filtered) mapping');
-        t.check(filteredRun.notes.some((n) => n.includes('C:\\Projects\\proj-root\\web')), 'and a note says where it is when another project starts the sandbox', JSON.stringify(filteredRun.notes));
+        t.check(asLaunch === 'C:\\Workspace\\proj-outside' &&
+            gen.projects.projects.find((p) => p.host === outside)?.guest === 'C:\\Workspace\\proj-outside' &&
+            mirrored === rootGuestDir([root], true, inRoot) &&
+            filteredRun.config.guestWorkspace === 'C:\\Workspace\\web' &&
+            filteredRun.notes.some((n) => n.includes('C:\\Projects\\proj-root\\web')), 'a project outside the roots has the same guest folder as launch folder and mapped at boot; "mirror" puts a folder in a root where the root shows it; workspaceFilter keeps its own mapping, with a note', JSON.stringify(filteredRun.notes));
         const badRoot = structuredClone(f.baseConfig);
         badRoot.projects = { ...badRoot.projects, roots: [f.baseConfig.storage.root] };
         await t.throws(async () => f.generate(await f.run({}, badRoot)), 'projects.roots', 'a root that would expose the storage folder is refused');
-        t.check(new KnownProjects(f.baseConfig.storage.root).forget(outside), '`sandbox projects remove` forgets a project...');
-        t.check(!new KnownProjects(f.baseConfig.storage.root).list().some((k) => k.host === outside), '... so it is no longer known (its folder is untouched)');
-        t.includes(buildWsb(f.baseConfig, 4096, []), '<MappedFolders></MappedFolders>', 'no projects: nothing extra mapped');
+        t.check(new KnownProjects(f.baseConfig.storage.root).forget(outside) &&
+            !new KnownProjects(f.baseConfig.storage.root).list().some((k) => k.host === outside), '`sandbox projects remove` forgets a project');
         t.section('projects: repo guard for every project the sandbox can write');
         const guardData = t.at('guard-data');
         const rootG = t.at('guard-root');
@@ -255,12 +322,12 @@ export const projectsSuite = {
         t.write(path.join(fresh, '.git', 'config'), '[core]\n\tfsmonitor = evil.exe\n\tbare = false\n');
         t.write(path.join(fresh, 'node.exe'), 'planted');
         const found = new RepoGuardStore(guardData).check();
-        t.check(fs.existsSync(path.join(old, '.git', 'hooks', 'pre-commit')), 'a hook that was there before the sandbox ran stays');
-        t.check(!fs.existsSync(path.join(old, '.git', 'hooks', 'post-checkout')), 'a hook added inside the sandbox to a project in a root is quarantined');
-        t.check(!fs.existsSync(path.join(fresh, '.git', 'hooks', 'pre-push')), 'a project that appeared in a root after the start has its planted hooks removed');
-        t.check(!fs.existsSync(path.join(fresh, 'node.exe')), 'a project that appeared in a root after the start has its planted commands removed');
-        t.includes(fs.readFileSync(path.join(fresh, '.git', 'config'), 'utf8'), '# [agent-sandbox] disabled', 'a project that appeared in a root after the start has its program-running git config disabled');
-        t.check(found.some((x) => x.detail.startsWith(fresh)), 'the findings name the project', JSON.stringify(found));
+        t.check(fs.existsSync(path.join(old, '.git', 'hooks', 'pre-commit')) &&
+            !fs.existsSync(path.join(old, '.git', 'hooks', 'post-checkout')), 'a hook from before the sandbox stays; one added inside it to a project in a root is quarantined');
+        t.check(!fs.existsSync(path.join(fresh, '.git', 'hooks', 'pre-push')) &&
+            !fs.existsSync(path.join(fresh, 'node.exe')) &&
+            fs.readFileSync(path.join(fresh, '.git', 'config'), 'utf8').includes('# [agent-sandbox] disabled') &&
+            found.some((x) => x.detail.startsWith(fresh)), 'a project that appeared in a root after the start has hooks, commands and program-running git config removed', JSON.stringify(found));
         t.section('projects: history and environment');
         const hostClaude = t.at('hist-host');
         const guestClaude = t.at('hist-guest');
@@ -274,8 +341,7 @@ export const projectsSuite = {
             extra: [{ hostWorkspace: bHost, guestWorkspace: 'C:\\Projects\\hist-b' }],
         });
         const back = path.join(hostClaude, 'projects', projectFolderName(bHost), 's.jsonl');
-        t.check(fs.existsSync(back), "a joined project's history goes back to ITS folder on this PC");
-        t.includes(fs.existsSync(back) ? fs.readFileSync(back, 'utf8') : '', JSON.stringify(bHost + '\\src').slice(1, -1), "a joined project's history paths are translated");
+        t.check(fs.existsSync(back) && fs.readFileSync(back, 'utf8').includes(JSON.stringify(bHost + '\\src').slice(1, -1)), "a joined project's history goes back to ITS folder on this PC, with paths translated");
         const env = baseEnvFor({ basePath: 'C:\\Windows', toolVars: ['NVM_HOME', 'CARGO_HOME'], steps: {}, summary: [], lan: 'blocked' }, {
             Path: 'C:\\tools\\a;C:\\Windows',
             NVM_HOME: 'x',
@@ -284,21 +350,7 @@ export const projectsSuite = {
             AGENT_WORKSPACE: 'C:\\Workspace\\a',
             TEMP: 'C:\\t',
         });
-        t.equal({
-            PATH: env.PATH,
-            Path: env.Path,
-            NVM_HOME: env.NVM_HOME,
-            CARGO_TARGET_DIR: env.CARGO_TARGET_DIR,
-            AGENT_WORKSPACE: env.AGENT_WORKSPACE,
-            TEMP: env.TEMP,
-        }, {
-            PATH: 'C:\\Windows',
-            Path: undefined,
-            NVM_HOME: undefined,
-            CARGO_TARGET_DIR: undefined,
-            AGENT_WORKSPACE: undefined,
-            TEMP: 'C:\\t',
-        }, "a joined project starts from the boot's base environment: none of the first project's tools, workspace or target folder");
+        t.equal([env.PATH, env.NVM_HOME, env.CARGO_TARGET_DIR, env.AGENT_WORKSPACE, env.TEMP], ['C:\\Windows', undefined, undefined, undefined, 'C:\\t'], "a joined project starts from the boot's base environment: none of the first project's tools or folders");
         t.section('projects: commands');
         const status = (id, cwd, startedAt) => ({
             id,
@@ -310,67 +362,51 @@ export const projectsSuite = {
             updatedAt: startedAt,
             startedAt,
         });
-        const sessions = [
-            status('a1', 'C:\\Workspace\\a', '1'),
-            status('b1', 'C:\\Projects\\b', '2'),
-            status('a2', 'C:\\Workspace\\a\\x', '3'),
-            status('b2', 'C:\\Projects\\b\\y', '4'),
-        ];
-        t.equal(sessionsFirstIn(sessions, 'C:\\Projects\\b').map((x) => x.id), ['b2', 'b1', 'a2', 'a1'], "attach and sessions put this project's sessions first, newest first");
-        t.equal(describeSessions([
-            { harness: 'claude', cwd: 'C:\\Workspace\\api', project: 'api' },
-            { harness: 'codex', cwd: 'C:\\Projects\\web' },
-        ]), '2 sessions (claude in api, codex in web)', 'the restart offer lists the sessions that would end');
-        await t.throws(() => validateProjectsArgs(['bogus']), 'projects action', '`sandbox projects` rejects an unknown action');
-        await t.throws(() => validateProjectsArgs(['add']), 'Which folder', '`sandbox projects add` needs a folder');
-        await t.throws(() => validateProjectsArgs(['all', 'maybe']), 'on', '`sandbox projects all` needs on or off');
-        await t.throws(() => validateProjectsArgs(['roots', 'add']), 'Which folder', '`sandbox projects roots add` needs a folder');
+        t.equal([
+            sessionsFirstIn([
+                status('a1', 'C:\\Workspace\\a', '1'),
+                status('b1', 'C:\\Projects\\b', '2'),
+                status('a2', 'C:\\Workspace\\a\\x', '3'),
+                status('b2', 'C:\\Projects\\b\\y', '4'),
+            ], 'C:\\Projects\\b').map((x) => x.id),
+            describeSessions([
+                { harness: 'claude', cwd: 'C:\\Workspace\\api', project: 'api' },
+                { harness: 'codex', cwd: 'C:\\Projects\\web' },
+            ]),
+        ], [['b2', 'b1', 'a2', 'a1'], '2 sessions (claude in api, codex in web)'], "this project's sessions come first, newest first; the restart offer lists the sessions that would end");
+        const badAction = await t.thrownMessage(() => validateProjectsArgs(['bogus']));
+        const noFolder = await t.thrownMessage(() => validateProjectsArgs(['add']));
         validateProjectsArgs([]);
-        validateProjectsArgs(['roots']);
         validateProjectsArgs(['all', 'on']);
-        t.check(askedWhen(['add', 'remove'], 'add') &&
-            !askedWhen(['add'], 'list') &&
-            askedWhen(undefined, 'x') &&
-            askedWhen('save', 'save'), 'the menu asks an argument only for the actions it belongs to');
+        t.check(badAction.includes('projects action') && noFolder.includes('Which folder'), '`sandbox projects` rejects an unknown action, and `add` needs a folder', badAction + ' / ' + noFolder);
         t.section('projects: several sessions at once (--session agent@folder)');
         const want = parseSessionWant('claude@C:\\code\\a@b', 'C:\\here');
-        t.equal({ harness: want.harness, folder: want.folder }, { harness: 'claude', folder: 'C:\\code\\a@b' }, '--session: the first @ splits agent from folder');
-        t.equal(parseSessionWant('codex', 'C:\\here').folder, 'C:\\here', '--session: no folder means this one');
-        t.equal(parseSessionWant('gemini@sub', 'C:\\here').folder, 'C:\\here\\sub', '--session: relative folders become absolute');
-        await t.throws(() => parseSessionWant('@C:\\x'), 'names no agent', '--session without an agent is refused');
         const own = parseSessionWant('codex@C:\\code\\web|--model o3 "two words"', 'C:\\here');
-        t.equal({ harness: own.harness, folder: own.folder, args: own.args }, { harness: 'codex', folder: 'C:\\code\\web', args: ['--model', 'o3', 'two words'] }, "--session: after | come that agent's own arguments (quotes keep words together)");
-        t.equal(parseSessionWant('claude@C:\\x').args, undefined, '--session: no | means no own arguments');
-        const both = parseCli([
-            'launch',
-            '--session',
-            'claude@C:\\a|--continue',
-            '--session',
-            'codex@C:\\b',
-            '--',
-            '--verbose',
-        ]);
-        t.equal(both.passthrough, ['--verbose'], 'arguments after -- go to every session...');
-        t.equal(both.sessions.map((s) => s.args ?? []), [['--continue'], []], '... arguments after | only to that one');
+        t.check(want.harness === 'claude' &&
+            want.folder === 'C:\\code\\a@b' &&
+            parseSessionWant('codex', 'C:\\here').folder === 'C:\\here' &&
+            parseSessionWant('gemini@sub', 'C:\\here').folder === 'C:\\here\\sub' &&
+            own.folder === 'C:\\code\\web' &&
+            JSON.stringify(own.args) === JSON.stringify(['--model', 'o3', 'two words']), "--session: the first @ splits agent from folder; no folder means this one; relative folders become absolute; after | come that agent's own arguments (quotes keep words together)");
         const multi = parseCli([
             'launch',
             '--session',
-            'claude@' + f.workA,
+            'claude@' + f.workA + '|--continue',
             '--session',
             'codex@' + f.workB,
             '--session',
             'claude@' + f.workB,
             '-t',
             '--',
-            '--continue',
+            '--verbose',
         ]);
         t.equal({
-            command: multi.command,
             sessions: multi.sessions.length,
             terminal: multi.terminal,
             second: multi.sessions[1].harness,
+            own: multi.sessions.map((s) => s.args ?? []),
             passthrough: multi.passthrough,
-        }, { command: 'launch', sessions: 3, terminal: true, second: 'codex', passthrough: ['--continue'] }, 'several --session options parse in order, with -t and agent arguments');
+        }, { sessions: 3, terminal: true, second: 'codex', own: [['--continue'], [], []], passthrough: ['--verbose'] }, 'several --session options parse in order, with -t, own arguments and shared arguments after --');
         const validationContext = (options) => ({
             packageRoot: f.install,
             entry: '',
@@ -379,15 +415,15 @@ export const projectsSuite = {
             storageRoot: f.baseConfig.storage.root,
             dataPath: t.at('vdata'),
         });
-        await t.throws(() => validateOptions(validationContext(parseCli(['launch', '--session', 'claud@' + f.workA]))), 'Did you mean', 'an unknown agent in --session suggests the closest one');
-        await t.throws(() => validateOptions(validationContext(parseCli(['launch', '--session', 'claude@' + t.at('nope')]))), 'does not exist', 'a missing --session folder is refused before anything starts');
-        await t.throws(() => validateOptions(validationContext(parseCli(['launch', '--session', 'claude@' + f.workA, '--harness', 'codex']))), 'do not apply', '--session cannot be mixed with --harness/--workspace');
+        const noAgent = await t.thrownMessage(() => parseSessionWant('@C:\\x'));
+        const unknownAgent = await t.thrownMessage(() => validateOptions(validationContext(parseCli(['launch', '--session', 'claud@' + f.workA]))));
+        const mixed = await t.thrownMessage(() => validateOptions(validationContext(parseCli(['launch', '--session', 'claude@' + f.workA, '--harness', 'codex']))));
         validateOptions(validationContext(multi));
+        t.check(noAgent.includes('names no agent') && unknownAgent.includes('Did you mean') && mixed.includes('do not apply'), '--session without an agent is refused, an unknown agent suggests the closest one, and it cannot be mixed with --harness/--workspace', [noAgent, unknownAgent, mixed].join(' / '));
         t.equal(severalAgentsArgv([
             { harness: 'claude', folder: 'C:\\a' },
             { harness: 'codex', folder: 'C:\\b c' },
         ], { headless: true, attachFirst: true }).join(' '), 'launch --session claude@C:\\a --session codex@C:\\b c --headless -t', 'the menu builds the same command line (so repeat-last works)');
-        t.equal(candidateFolders(validationContext(parseCli(['launch'])), f.workA)[0], path.resolve(f.workA), 'the menu offers this folder first, then known projects and the folders in your roots');
         const multiGen = generateSandbox({
             packageRoot: t.packageRoot,
             run: await f.run(),
@@ -397,12 +433,13 @@ export const projectsSuite = {
             autoSession: false,
         });
         const multiSession = f.readJson(multiGen.sessionPath);
-        const multiWsb = fs.readFileSync(multiGen.wsbPath, 'utf8');
-        t.equal(multiGen.projects.projects.map((p) => p.guest), ['C:\\Workspace\\work-b'], 'a multi-project launch maps every other project once (folders inside the launch folder and duplicates need nothing)');
-        t.includes(multiWsb, '<HostFolder>' + f.workB + '</HostFolder><SandboxFolder>C:\\Workspace\\work-b</SandboxFolder>', 'a multi-project launch maps the other project in the .wsb');
-        t.equal({ autoSession: multiSession.autoSession, workspaceHost: multiSession.workspaceHost }, { autoSession: false, workspaceHost: f.workA }, 'the boot provisions the launch folder only; the host then opens every session (each project set up on demand, in parallel)');
-        t.section('projects: what a joining project wants at boot (vGPU, memory, its mappings)');
-        // A games project: its approved file asks for vGPU (you allowed it for this project) and maps a folder of its own.
+        t.check(multiGen.projects.projects.map((p) => p.guest).join() === 'C:\\Workspace\\work-b' &&
+            fs
+                .readFileSync(multiGen.wsbPath, 'utf8')
+                .includes('<HostFolder>' + f.workB + '</HostFolder><SandboxFolder>C:\\Workspace\\work-b</SandboxFolder>') &&
+            multiSession.autoSession === false &&
+            multiSession.workspaceHost === f.workA, 'a multi-project launch maps every other project once; the boot provisions only the launch folder');
+        t.section('projects: what a joining project wants at boot (vGPU, its mappings)');
         const games = t.dir('proj-games');
         t.dir('proj-games', 'assets');
         f.writeLocal(games, {
@@ -411,37 +448,46 @@ export const projectsSuite = {
         });
         saveAllowed(allowStorePath(f.baseConfig.storage.root), path.join(games, '.sandbox-config.json'), 'sandbox.vGpu', true, true);
         const gamesRun = await f.run({ cwd: games, trustConfig: true });
-        t.equal(gamesRun.config.sandbox.vGpu, true, 'the vGPU you allowed for the project is in its effective config');
         const launchedRun = await f.run();
         const runningBoot = {
             memoryMb: 8192,
             mappings: [{ host: f.workA, guest: 'C:\\Workspace\\work-a', readOnly: false }],
         };
         const wanted = missingAtBoot(protectionsOf(launchedRun.config), runningBoot, gamesRun.config, fs.existsSync);
-        t.equal({ settings: wanted.settings, memoryMb: wanted.memoryMb, mappings: wanted.mappings.map((m) => m.guest) }, { settings: ['sandbox.vGpu'], memoryMb: null, mappings: ['F:\\GameAssets'] }, "missingAtBoot: vGPU and the project's folder are missing from a sandbox started without them (the missing optional mapping is no wish)");
         const mappedMirror = missingAtBoot(protectionsOf(gamesRun.config), {
             memoryMb: 8192,
             mappings: [{ host: path.join(games, 'assets'), guest: 'C:\\Mirror\\F\\GameAssets', readOnly: true }],
         }, gamesRun.config, fs.existsSync);
-        t.check(nothingMissing(mappedMirror), 'missingAtBoot: nothing missing when the sandbox has vGPU and the folder (F:\\x is C:\\Mirror\\F\\x in the .wsb)', JSON.stringify(mappedMirror));
-        const bigger = structuredClone(launchedRun.config);
-        bigger.sandbox.memoryMb = 16384;
-        t.equal(missingAtBoot(protectionsOf(launchedRun.config), runningBoot, bigger).memoryMb, 16384, 'missingAtBoot: a larger fixed memory size is missing too');
-        const twoFolders = {
+        t.equal({
+            settings: wanted.settings,
+            memoryMb: wanted.memoryMb,
+            mappings: wanted.mappings.map((m) => m.guest),
+            nothingMissingWhenMapped: nothingMissing(mappedMirror),
+            message: describeMissing('mw2-agent', {
+                settings: ['sandbox.vGpu'],
+                memoryMb: null,
+                mappings: [
+                    { host: 'C:\\Steam\\common', guest: 'C:\\Steam', readOnly: true },
+                    { host: 'F:\\SteamLibrary', guest: 'F:\\SteamLibrary', readOnly: true },
+                ],
+            }),
+        }, {
             settings: ['sandbox.vGpu'],
             memoryMb: null,
-            mappings: [
-                { host: 'C:\\Steam\\common', guest: 'C:\\Steam', readOnly: true },
-                { host: 'F:\\SteamLibrary', guest: 'F:\\SteamLibrary', readOnly: true },
-            ],
-        };
-        t.equal(describeMissing('mw2-agent', twoFolders), 'mw2-agent wants vGPU and 2 folders (C:\\Steam\\common, F:\\SteamLibrary), but this sandbox started without them.', 'the message names each missing item');
-        t.equal(missingTip(twoFolders), 'Set sandbox.vGpu (or the mappings) in your own settings to have them in every sandbox.', 'the tip names the settings');
-        t.equal(describeMissing('api', { settings: ['sandbox.vGpu'], memoryMb: null, mappings: [] }), 'api wants vGPU, but this sandbox started without it.', 'one item reads naturally');
-        t.equal(parseWsbBoot(buildWsb(f.baseConfig, 6144, [{ host: 'C:\\a&b', guest: 'F:\\x', readOnly: true }])), { memoryMb: 6144, mappings: [{ host: 'C:\\a&b', guest: 'C:\\Mirror\\F\\x', readOnly: true }], widened: {} }, 'a sandbox started by an older version: memory and mapped folders are read back from its .wsb');
+            mappings: ['F:\\GameAssets'],
+            nothingMissingWhenMapped: true,
+            message: 'mw2-agent wants vGPU and 2 folders (C:\\Steam\\common, F:\\SteamLibrary), but this sandbox started without them.',
+        }, "missingAtBoot: vGPU and the project's folder are missing from a sandbox started without them, nothing when it has both (F:\\x is C:\\Mirror\\F\\x in the .wsb); the message names each missing item");
         const widenedJoin = checkJoin({ ...base, 'sandbox.vGpu': true }, base, ['sandbox.vGpu']);
-        t.equal({ stricter: widenedJoin.stricter, shared: widenedJoin.shared }, { stricter: [], shared: ['sandbox.vGpu'] }, 'vGPU turned on at boot for another project you allowed it for: a project without it shares it instead of being refused');
-        t.check(checkJoin({ ...base, 'sandbox.vGpu': true }, base).stricter.some((s) => s.startsWith('sandbox.vGpu')), '... without that record a project without vGPU is still refused (it needs it off)');
+        t.check(JSON.stringify(parseWsbBoot(buildWsb(f.baseConfig, 6144, [{ host: 'C:\\a&b', guest: 'F:\\x', readOnly: true }]))) ===
+            JSON.stringify({
+                memoryMb: 6144,
+                mappings: [{ host: 'C:\\a&b', guest: 'C:\\Mirror\\F\\x', readOnly: true }],
+                widened: {},
+            }) &&
+            widenedJoin.stricter.length === 0 &&
+            widenedJoin.shared.join() === 'sandbox.vGpu' &&
+            checkJoin({ ...base, 'sandbox.vGpu': true }, base).stricter.some((s) => s.startsWith('sandbox.vGpu')), 'a sandbox started by an older version: memory and folders are read back from its .wsb; vGPU turned on at boot for a project you allowed it for is shared, without that record it is refused');
         // joinRunning asks before anything is registered: restart (NeedsRestart with what is missing), or continue without.
         const storage2 = t.dir('proj-storage2');
         const data2 = t.dir('proj-storage2', 'data', 'testdata');
@@ -463,13 +509,14 @@ export const projectsSuite = {
             decide: async () => choice,
         });
         const restartFor = await joinGames('restart').then(() => null, (e) => e);
+        const cancelled = await t.thrownMessage(() => joinGames('cancel'));
+        const notRegistered = !new ProjectRegistry(storage2).read()?.projects.some((p) => p.host === games);
         t.check(restartFor instanceof NeedsRestart &&
             restartFor.missing?.settings.includes('sandbox.vGpu') === true &&
-            restartFor.missing.mappings.length === 1, 'choosing "Restart with them" hands the restart offer what is missing');
-        await t.throws(() => joinGames('cancel'), 'Cancelled', '"Cancel" stops with a short line');
-        t.check(!new ProjectRegistry(storage2).read()?.projects.some((p) => p.host === games), 'neither registers the project');
-        const continued = await joinGames('continue');
-        t.equal(continued.missing?.settings, ['sandbox.vGpu'], '"Continue anyway" joins without them and says what is missing');
+            restartFor.missing.mappings.length === 1 &&
+            cancelled.includes('Cancelled') &&
+            notRegistered &&
+            (await joinGames('continue')).missing?.settings.join() === 'sandbox.vGpu', '"Restart with them" hands the restart offer what is missing, "Cancel" stops with a short line (neither registers the project), "Continue anyway" joins and says what is missing', cancelled);
         // The restart that adds it (and any launch with it mapped at boot) boots with the union.
         const unionGen = generateSandbox({
             packageRoot: t.packageRoot,
@@ -481,14 +528,14 @@ export const projectsSuite = {
             bootWants: { projects: [{ name: 'proj-games', config: gamesRun.config }], keepOff: [] },
         });
         const unionWsb = fs.readFileSync(unionGen.wsbPath, 'utf8');
-        t.includes(unionWsb, '<vGPU>Enable</vGPU>', 'the restart plan: vGPU on because the added project asks for it (and you allowed it)');
-        t.includes(unionWsb, '<HostFolder>' +
-            path.join(games, 'assets') +
-            '</HostFolder><SandboxFolder>C:\\Mirror\\F\\GameAssets</SandboxFolder><ReadOnly>true</ReadOnly>', "the restart plan: the added project's mapping is mapped");
-        t.includes(unionWsb, '<HostFolder>' + games + '</HostFolder><SandboxFolder>C:\\Workspace\\proj-games</SandboxFolder>', 'the restart plan: the added project itself is mapped (where it is as the launch folder)');
-        t.equal(unionGen.widened, { 'sandbox.vGpu': 'proj-games' }, 'the registry learns which boot setting was turned on for which project');
-        t.check(unionGen.projects.notes.some((n) => n.startsWith('vGPU is on in this sandbox')), 'the launch says vGPU is on for every project and why', JSON.stringify(unionGen.projects.notes));
-        t.check(nothingMissing(missingAtBoot(protectionsOf(unionGen.bootConfig), { memoryMb: unionGen.memoryMb, mappings: unionGen.mappings }, gamesRun.config, fs.existsSync)), 'after that restart the project joins with nothing missing');
+        t.check(unionWsb.includes('<vGPU>Enable</vGPU>') &&
+            unionWsb.includes('<HostFolder>' +
+                path.join(games, 'assets') +
+                '</HostFolder><SandboxFolder>C:\\Mirror\\F\\GameAssets</SandboxFolder><ReadOnly>true</ReadOnly>') &&
+            unionWsb.includes('<HostFolder>' + games + '</HostFolder><SandboxFolder>C:\\Workspace\\proj-games</SandboxFolder>'), 'the restart plan: vGPU on, and the added project and its mapping are mapped');
+        const unionLearns = unionGen.widened['sandbox.vGpu'] === 'proj-games' &&
+            unionGen.projects.notes.some((n) => n.startsWith('vGPU is on in this sandbox')) &&
+            nothingMissing(missingAtBoot(protectionsOf(unionGen.bootConfig), { memoryMb: unionGen.memoryMb, mappings: unionGen.mappings }, gamesRun.config, fs.existsSync));
         const keptOff = generateSandbox({
             packageRoot: t.packageRoot,
             run: launchedRun,
@@ -498,21 +545,25 @@ export const projectsSuite = {
             autoSession: false,
             bootWants: { projects: [{ name: 'proj-games', config: gamesRun.config }], keepOff: ['sandbox.vGpu'] },
         });
-        t.includes(fs.readFileSync(keptOff.wsbPath, 'utf8'), '<vGPU>Disable</vGPU>', "a device the launch folder's own file switched off stays off");
-        t.includes(fs.readFileSync(f.generate(launchedRun).wsbPath, 'utf8'), '<vGPU>Disable</vGPU>', 'without other projects nothing changes');
+        t.check(unionLearns && fs.readFileSync(keptOff.wsbPath, 'utf8').includes('<vGPU>Disable</vGPU>'), "the registry learns which setting was turned on for which project, after that restart nothing is missing; a device the launch folder's own file switched off stays off", JSON.stringify(unionGen.projects.notes));
         t.section('projects: wsb (Windows Sandbox command line) adapter');
-        t.equal([parseVersion('Windows Sandbox CLI version 0.4.1.0\n'), parseVersion('nothing')], ['0.4.1.0', null], 'wsb --version');
-        const help = 'Description:\n  Windows Sandbox command line\n\nUsage:\n  wsb [command] [options]\n\nOptions:\n  --version  Show version information\n\nCommands:\n  start    Starts a sandbox\n  list     Lists sandboxes\n  exec     Runs a command\n  share    Shares a folder\n  stop     Stops a sandbox\n  connect  Connects\n  ip       Shows the IP\n';
-        t.equal(parseCommands(help), ['start', 'list', 'exec', 'share', 'stop', 'connect', 'ip'], 'wsb --help: the subcommands it offers');
-        t.equal(parseCommands('no commands here').length, 0, 'wsb --help: no commands in other text');
         const id = '12345678-1234-1234-1234-1234567890ab';
-        t.equal(parseList(JSON.stringify([{ Id: id, Status: 'Running', Uptime: '00:10' }]))[0]?.id, id, 'wsb list --raw: an array');
-        t.equal(parseList(JSON.stringify({ WindowsSandboxEnvironments: [{ id, status: 'Stopped' }] }))[0]?.status, 'Stopped', 'wsb list --raw: an object holding one');
-        t.equal(parseList('Id                                    Status   Uptime\n' + id + '  Running  00:01:02\n')[0]?.status, 'Running', 'wsb list as a table');
-        t.equal(parseList('nothing').length, 0, 'wsb list: nothing to read gives no sandboxes');
-        t.equal([parseIp('172.20.1.5\r\n'), parseIp('none')], ['172.20.1.5', null], 'wsb ip');
         const apps = 'C:\\Users\\me\\AppData\\Local\\Microsoft\\WindowsApps\\wsb.exe';
-        t.equal(findWsb({ LOCALAPPDATA: 'C:\\Users\\me\\AppData\\Local', SystemRoot: 'C:\\Windows' }, (p) => p === apps), apps, 'wsb.exe is looked for at absolute paths only (WindowsApps alias, System32)');
-        t.equal(findWsb({ SystemRoot: 'C:\\Windows' }, () => false), null, 'wsb.exe is not found when nothing is there');
+        t.check(parseVersion('Windows Sandbox CLI version 0.4.1.0\n') === '0.4.1.0' &&
+            parseVersion('nothing') === null &&
+            parseIp('172.20.1.5\r\n') === '172.20.1.5' &&
+            parseIp('none') === null &&
+            parseCommands('Commands:\n  start    Starts a sandbox\n  list     Lists\n  share    Shares\n').join() ===
+                'start,list,share' &&
+            parseCommands('no commands here').length === 0 &&
+            parseList(JSON.stringify([{ Id: id, Status: 'Running', Uptime: '00:10' }]))[0]?.id === id &&
+            parseList(JSON.stringify({ WindowsSandboxEnvironments: [{ id, status: 'Stopped' }] }))[0]?.status ===
+                'Stopped' &&
+            parseList('Id                                    Status   Uptime\n' + id + '  Running  00:01:02\n')[0]
+                ?.status === 'Running' &&
+            parseList('nothing').length === 0 &&
+            findWsb({ LOCALAPPDATA: 'C:\\Users\\me\\AppData\\Local', SystemRoot: 'C:\\Windows' }, (p) => p === apps) ===
+                apps &&
+            findWsb({ SystemRoot: 'C:\\Windows' }, () => false) === null, 'wsb --version, ip and --help are read, wsb list as an array, an object or a table, other text gives nothing; wsb.exe is looked for at absolute paths only');
     },
 };