windows-development-sandbox 1.4.3 → 1.7.0

package/dist/selftest/repo-guard.test.js

@@ -20,33 +20,33 @@ export const repoGuardSuite = {
         t.write(path.join(repo, '.git', 'hooks', 'pre-push'), 'changed hook');
         fs.appendFileSync(path.join(repo, '.git', 'config'), '[core]\n\tfsmonitor = calc.exe\n\tsshCommand = evil\n[include]\n\tpath = C:/evil.cfg\n[branch "feature"]\n\tremote = origin\n');
         const findings = repoGuard.guard(repo, before);
-        t.check(!fs.existsSync(path.join(repo, '.git', 'hooks', 'post-checkout')), 'a new git hook is quarantined');
-        t.check(!fs.existsSync(path.join(repo, '.git', 'hooks', 'pre-push')), 'a changed git hook is quarantined');
-        t.check(fs.existsSync(path.join(repo, '.git', 'hooks', 'pre-commit.sample')), 'hook samples are left alone');
-        t.equal(findings.filter((x) => x.kind === 'hook').length, 2, 'both hooks are reported');
+        t.check(!fs.existsSync(path.join(repo, '.git', 'hooks', 'post-checkout')) &&
+            !fs.existsSync(path.join(repo, '.git', 'hooks', 'pre-push')) &&
+            fs.existsSync(path.join(repo, '.git', 'hooks', 'pre-commit.sample')) &&
+            findings.filter((x) => x.kind === 'hook').length === 2, 'new and changed git hooks are quarantined and reported; samples are left alone');
         const config = readConfig(repo);
-        t.matches(config, disabled('fsmonitor'), 'git config: fsmonitor (runs a program) is disabled');
-        t.matches(config, disabled('sshCommand'), 'git config: sshCommand is disabled');
-        t.matches(config, disabled('path = C:/evil'), 'git config: [include] of an outside file is disabled');
-        t.matches(config, /^\tremote = origin$/m, 'git config: a harmless change stays');
-        t.matches(config, /^\turl = https/m, 'git config: existing lines stay');
+        t.check(disabled('fsmonitor').test(config) &&
+            disabled('sshCommand').test(config) &&
+            disabled('path = C:/evil').test(config) &&
+            /^\tremote = origin$/m.test(config) &&
+            /^\turl = https/m.test(config), 'git config: fsmonitor, sshCommand and an [include] of an outside file are disabled; harmless lines stay', config);
         t.equal(repoGuard.guard(repo, before).length, 0, 'the guard is idempotent');
         t.section('planted commands and tricks');
         const repo2 = t.at('repo2');
         t.write(path.join(repo2, '.git', 'config'), '[core]\n\tbare = false\n');
         t.write(path.join(repo2, 'build.cmd'), 'echo legit');
         const before2 = repoGuard.snapshot(repo2);
-        for (const name of ['node.exe', 'git.cmd', 'sandbox.cmd', 'opencode.ps1'])
+        const planted = ['node.exe', 'git.cmd', 'sandbox.cmd', 'opencode.ps1'];
+        for (const name of planted)
             t.write(path.join(repo2, name), name === 'node.exe' ? 'MZ' : 'calc');
         t.write(path.join(repo2, '.git', 'commondir'), 'C:/evil');
         fs.appendFileSync(path.join(repo2, '.git', 'config'), '[core] fsmonitor = calc.exe\n');
         const found2 = repoGuard.guard(repo2, before2);
-        const gone = ['node.exe', 'git.cmd', 'sandbox.cmd', 'opencode.ps1'].filter((name) => !fs.existsSync(path.join(repo2, name)));
-        t.equal(gone, ['node.exe', 'git.cmd', 'sandbox.cmd', 'opencode.ps1'], 'executables planted under command names are quarantined');
-        t.check(fs.existsSync(path.join(repo2, 'build.cmd')), 'other scripts stay');
-        t.equal(found2.filter((x) => x.kind === 'command').length, 4, 'every planted command is reported');
-        t.check(!fs.existsSync(path.join(repo2, '.git', 'commondir')), 'a planted commondir is removed');
-        t.matches(readConfig(repo2), disabled('fsmonitor'), 'a key on the same line as its [section] is neutralised');
+        t.check(planted.every((name) => !fs.existsSync(path.join(repo2, name))) &&
+            fs.existsSync(path.join(repo2, 'build.cmd')) &&
+            found2.filter((x) => x.kind === 'command').length === 4 &&
+            !fs.existsSync(path.join(repo2, '.git', 'commondir')) &&
+            disabled('fsmonitor').test(readConfig(repo2)), 'executables planted under command names are quarantined (other scripts stay), a planted commondir is removed, a key on a [section] line is neutralised');
         t.section('a replaced or oversized .git');
         const victim = t.dir('repo-victim');
         const repo3 = t.at('repo3');
@@ -54,12 +54,12 @@ export const repoGuardSuite = {
         const before3 = repoGuard.snapshot(repo3);
         fs.rmSync(path.join(repo3, '.git'), { recursive: true });
         fs.symlinkSync(victim, path.join(repo3, '.git'), 'junction');
-        t.check(repoGuard.guard(repo3, before3).some((x) => x.kind === 'git' && x.detail.includes('replaced')), '.git replaced by a link is reported loudly');
         const repo4 = t.at('repo4');
         t.write(path.join(repo4, '.git', 'config'), '[core]\n');
         const before4 = repoGuard.snapshot(repo4);
         fs.appendFileSync(path.join(repo4, '.git', 'config'), '#'.repeat(5 * 1024 * 1024));
-        t.check(repoGuard.guard(repo4, before4).some((x) => x.kind === 'git' && x.detail.includes('over 4 MB')), 'a git config too big to check is reported instead of passing');
+        t.check(repoGuard.guard(repo3, before3).some((x) => x.kind === 'git' && x.detail.includes('replaced')) &&
+            repoGuard.guard(repo4, before4).some((x) => x.kind === 'git' && x.detail.includes('over 4 MB')), '.git replaced by a link, or a git config too big to check, is reported instead of passing');
         t.section('more git config that runs programs');
         const repo5 = t.at('repo5');
         t.write(path.join(repo5, '.git', 'config'), '[alias]\n\tst = status\n');
@@ -67,10 +67,10 @@ export const repoGuardSuite = {
         fs.appendFileSync(path.join(repo5, '.git', 'config'), '[alias]\n\tlg = !calc.exe\n\tco = checkout\n[pager]\n\tlog = calc.exe\n[diff]\n\texternal = calc.exe\n');
         repoGuard.guard(repo5, before5);
         const config5 = readConfig(repo5);
-        t.matches(config5, disabled('lg = !calc'), 'git config: an alias that runs a program (!) is disabled');
-        t.matches(config5, /^\tco = checkout$/m, 'git config: a plain alias stays');
-        t.matches(config5, disabled('log = calc'), 'git config: [pager] entries are disabled');
-        t.matches(config5, disabled('external = calc'), 'git config: diff.external is disabled');
+        t.check(disabled('lg = !calc').test(config5) &&
+            /^\tco = checkout$/m.test(config5) &&
+            disabled('log = calc').test(config5) &&
+            disabled('external = calc').test(config5), 'git config: aliases that run a program (!), [pager] and diff.external are disabled; a plain alias stays', config5);
         t.section('submodules and nested repositories');
         const repo6 = t.at('repo6');
         t.write(path.join(repo6, '.git', 'config'), '[core]\n');
@@ -82,10 +82,10 @@ export const repoGuardSuite = {
         fs.appendFileSync(path.join(repo6, 'tools', 'inner', '.git', 'config'), '\tfsmonitor = calc.exe\n');
         t.write(path.join(repo6, 'other', '.git', 'hooks', 'pre-commit'), 'calc.exe');
         const findings6 = repoGuard.guard(repo6, before6);
-        t.check(!fs.existsSync(path.join(repo6, '.git', 'modules', 'lib', 'hooks', 'post-checkout')), 'a hook planted in a submodule is quarantined');
-        t.matches(fs.readFileSync(path.join(repo6, 'tools', 'inner', '.git', 'config'), 'utf8'), disabled('fsmonitor'), 'git config of a nested repository is checked too');
-        t.check(!fs.existsSync(path.join(repo6, 'other', '.git', 'hooks', 'pre-commit')), 'a repository created inside the sandbox has no trusted hooks');
-        t.check(findings6.some((f) => f.detail.startsWith('tools/inner/.git: ')), 'findings say which repository they are in');
+        t.check(!fs.existsSync(path.join(repo6, '.git', 'modules', 'lib', 'hooks', 'post-checkout')) &&
+            disabled('fsmonitor').test(fs.readFileSync(path.join(repo6, 'tools', 'inner', '.git', 'config'), 'utf8')) &&
+            !fs.existsSync(path.join(repo6, 'other', '.git', 'hooks', 'pre-commit')) &&
+            findings6.some((f) => f.detail.startsWith('tools/inner/.git: ')), 'hooks in submodules, config of nested repositories and hooks of repositories created in the sandbox are handled, findings name the repository');
         const legacy = { ...before6, repos: undefined, agent: undefined };
         t.write(path.join(repo6, 'third', '.git', 'hooks', 'pre-commit'), 'yours');
         repoGuard.guard(repo6, legacy);
@@ -103,16 +103,18 @@ export const repoGuardSuite = {
         t.write(path.join(repo7, '.vscode', 'tasks.json'), '{ "tasks": [{ "label": "x", "command": "calc.exe", "runOptions": { "runOn": "folderOpen" } }] }');
         t.write(path.join(repo7, '.vscode', 'settings.json'), '{ "python.defaultInterpreterPath": "C:\\\\evil.exe" }');
         const findings7 = repoGuard.guard(repo7, before7);
-        t.equal(findings7.filter((f) => f.kind === 'agent').length, 4, 'Claude hooks, MCP servers, folder-open tasks and program paths in VS Code settings are quarantined');
-        t.check(!fs.existsSync(path.join(repo7, '.mcp.json')) &&
-            fs.existsSync(path.join(repo7, '.claude', 'settings.local.json')), '... and nothing else is moved');
+        t.check(findings7.filter((f) => f.kind === 'agent').length === 4 &&
+            !fs.existsSync(path.join(repo7, '.mcp.json')) &&
+            fs.existsSync(path.join(repo7, '.claude', 'settings.local.json')), 'Claude hooks, MCP servers, folder-open tasks and program paths in VS Code settings are quarantined, nothing else');
         t.section('programs from the sandbox are marked');
         const marked = t.at('marked');
         t.write(path.join(marked, 'setup.ps1'), 'calc');
         t.write(path.join(marked, 'src', 'app.ts'), 'code');
-        t.check(markFromSandbox(path.join(marked, 'setup.ps1')) && isMarked(path.join(marked, 'setup.ps1')), 'a script gets the "from the internet" mark (SmartScreen / PowerShell ask before it runs)');
-        t.check(!markFromSandbox(path.join(marked, 'src', 'app.ts')) && !isMarked(path.join(marked, 'src', 'app.ts')), 'source files are left alone');
-        t.equal(fs.readFileSync(path.join(marked, 'setup.ps1'), 'utf8'), 'calc', 'only the mark is written, never the file');
+        t.check(markFromSandbox(path.join(marked, 'setup.ps1')) &&
+            isMarked(path.join(marked, 'setup.ps1')) &&
+            !markFromSandbox(path.join(marked, 'src', 'app.ts')) &&
+            !isMarked(path.join(marked, 'src', 'app.ts')) &&
+            fs.readFileSync(path.join(marked, 'setup.ps1'), 'utf8') === 'calc', 'a script gets the "from the internet" mark (the file itself is never written); source files are left alone');
         const stop = watchAndMark([marked]);
         t.write(path.join(marked, 'bin', 'tool.exe'), 'MZ');
         const live = await t.waitFor(() => isMarked(path.join(marked, 'bin', 'tool.exe')), 5000);

package/dist/selftest/resume.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const resumeSuite: Suite;

package/dist/selftest/resume.test.js

@@ -0,0 +1,175 @@
+// Reopening the sessions of the last sandbox: the ledger of what ran, the decision to reopen, the limit on automatic
+// restarts, which conversation file is a session's, and the arguments that open it again.
+import fs from 'node:fs';
+import { HarnessSchema } from '../core/schema/index.js';
+import { DEFAULTS } from '../core/config/index.js';
+import { autoRestartAllowed, describeLast, endedUnexpectedly, SessionLedger, shouldReopen, } from '../host/life/index.js';
+import { notRunningYet } from '../cli/commands/sessions/reopen.js';
+import { pickConversation, resumeArgumentsFor } from '../shared/paths/index.js';
+import { SessionStatusSchema } from '../shared/channel/index.js';
+const ID_A = '0a1b2c3d-0000-4000-8000-000000000001';
+const ID_B = '0a1b2c3d-0000-4000-8000-000000000002';
+const ID_C = '0a1b2c3d-0000-4000-8000-000000000003';
+const NOW = new Date('2026-10-14T12:00:00.000Z');
+const minutes = (n) => new Date(NOW.getTime() - n * 60000).toISOString();
+const registry = (primary, other) => ({
+    launchId: 'L1',
+    protections: {},
+    roots: [],
+    projects: [
+        { name: 'api', host: primary, guest: 'C:\\Workspace\\api', primary: true, mechanism: 'launch', registeredAt: 'x' },
+        { name: 'web', host: other, guest: 'C:\\Workspace\\web', primary: false, mechanism: 'boot', registeredAt: 'x' },
+    ],
+});
+const status = (over) => ({
+    id: 's1',
+    launchId: 'L1',
+    harness: 'claude',
+    cwd: 'C:\\Workspace\\api',
+    phase: 'running',
+    message: 'ok',
+    updatedAt: minutes(0),
+    startedAt: minutes(30),
+    ...over,
+});
+const life = (over = {}) => ({
+    started: minutes(60),
+    lastSeen: minutes(1),
+    keepAwake: false,
+    ...over,
+});
+export const resumeSuite = {
+    name: 'resume',
+    title: 'reopening the last sandbox: ledger, decision, restart limit, conversations',
+    run: async (t) => {
+        t.section('the ledger');
+        const storage = t.dir('storage');
+        const data = t.at('storage', 'data', 'main');
+        const ledger = new SessionLedger(storage, data);
+        const launch = { primary: 'F:\\code\\api', harness: 'claude', projects: [], headless: true, configPath: null };
+        const reg = registry('F:\\code\\api', 'F:\\code\\web');
+        ledger.recordSessions([status({})], reg, NOW);
+        const untracked = ledger.read();
+        ledger.startLaunch(launch, NOW);
+        t.check(untracked === null && ledger.read()?.sessions.length === 0, 'a sandbox this tool did not start records nothing; a launch starts with no sessions');
+        ledger.recordSessions([
+            status({ conversation: ID_A }),
+            status({ id: 's2', harness: 'codex', cwd: 'C:\\Workspace\\web\\src', startedAt: minutes(20) }),
+            status({ id: 's3', phase: 'exited' }),
+            status({ id: 's4', cwd: 'D:\\nowhere' }),
+        ], reg, NOW);
+        const saved = ledger.read();
+        t.equal([saved?.sessions.map((s) => [s.harness, s.project, s.conversation]), saved?.launch.projects], [
+            [
+                ['claude', 'F:\\code\\api', ID_A],
+                ['codex', 'F:\\code\\web\\src', undefined],
+            ],
+            ['F:\\code\\web'],
+        ], 'running sessions are noted with their folder on this PC (ended ones and unknown folders are not), and the projects');
+        ledger.recordSessions([
+            status({ startedAt: minutes(30) }),
+            status({ id: 's2', harness: 'codex', cwd: 'C:\\Workspace\\web\\src', startedAt: minutes(20) }),
+        ], reg, NOW);
+        const kept = ledger.read()?.sessions[0].conversation;
+        ledger.recordSessions([status({ conversation: 'not-an-id; rm -rf' })], reg, NOW);
+        t.equal([kept, ledger.read()?.sessions.map((s) => s.conversation)], [ID_A, [ID_A]], 'a conversation noted before stays; one that is not an id is never kept (it ends up on a command line)');
+        ledger.recordSessions(Array.from({ length: 60 }, (_, i) => status({ id: 'x' + i, startedAt: minutes(100 - i) })), reg, NOW);
+        ledger.markClosedOnPurpose();
+        const before = JSON.stringify(ledger.read()?.sessions);
+        ledger.recordSessions([], reg, NOW);
+        const erased = JSON.stringify(ledger.read()?.sessions) !== before;
+        ledger.startLaunch(launch, NOW);
+        t.check(JSON.parse(before).length === 50 &&
+            !erased &&
+            ledger.read()?.closedOnPurpose === false &&
+            ledger.read()?.sessions.length === 50, 'at most 50 sessions; stopping on purpose is marked and sessions ending at shutdown do not erase it; a new launch clears the mark');
+        t.equal(describeLast([
+            { harness: 'claude', project: 'F:\\code\\mw2-agent', startedAt: 'x' },
+            { harness: 'codex', project: 'F:\\code\\web', startedAt: 'x' },
+        ]), 'claude in mw2-agent, codex in web (2 sessions)', 'what ran last time in plain words');
+        t.section('the ledger file is validated');
+        const file = t.at('storage', 'sync', 'main-sessions.json');
+        const good = JSON.parse(fs.readFileSync(file, 'utf8'));
+        const refused = [
+            { ...good, sessions: [{ harness: 'a', project: 'x'.repeat(2000), startedAt: 'x' }] },
+            { ...good, sessions: [{ harness: 'a', project: 'b', startedAt: 'x', conversation: 'y'.repeat(200) }] },
+            { ...good, sessions: 'many' },
+            { savedAt: 'x', sessions: [] },
+        ].map((bad) => {
+            fs.writeFileSync(file, JSON.stringify(bad));
+            return ledger.read();
+        });
+        t.equal(refused, [null, null, null, null], 'a bad file is refused (huge folder, long conversation, wrong shapes)');
+        t.section('reopen, ask or leave');
+        const withSessions = {
+            sessions: [{ harness: 'claude', project: 'F:\\a', startedAt: 'x' }],
+            closedOnPurpose: false,
+        };
+        const crashed = life({ ended: { at: minutes(1), cause: { kind: 'sandboxCrash', at: minutes(1), text: 'x' } } });
+        const closed = life({ ended: { at: minutes(1), cause: null } });
+        const expected = {
+            // [last sandbox crashed, closed normally, the PC went down (no end recorded)]
+            ask: ['ask', 'ask', 'ask'],
+            always: ['reopen', 'reopen', 'reopen'],
+            afterCrash: ['reopen', 'no', 'reopen'],
+            never: ['no', 'no', 'no'],
+        };
+        const decided = ['ask', 'always', 'afterCrash', 'never'].map((setting) => [
+            shouldReopen(setting, crashed, withSessions),
+            shouldReopen(setting, closed, withSessions),
+            shouldReopen(setting, life(), withSessions),
+        ]);
+        t.equal(decided, Object.values(expected), 'resume.sessions ask/always/afterCrash/never: after a crash, a normal close, a PC that went down');
+        t.check(shouldReopen('always', crashed, { sessions: [], closedOnPurpose: false }) === 'no' &&
+            shouldReopen('always', crashed, null) === 'no' &&
+            shouldReopen('afterCrash', crashed, { ...withSessions, closedOnPurpose: true }) === 'no', 'nothing recorded, no ledger, or stopped on purpose: nothing is reopened');
+        t.check(!endedUnexpectedly(life(), false, true) && !endedUnexpectedly(null, false, false), 'a watcher that still runs, or no record at all, is not a crash');
+        t.section('automatic restarts: 3 in 6 hours');
+        t.check(autoRestartAllowed([minutes(10), minutes(20)], NOW) &&
+            !autoRestartAllowed([minutes(10), minutes(20), minutes(30)], NOW) &&
+            autoRestartAllowed([minutes(10), minutes(20), minutes(7 * 60)], NOW) &&
+            !autoRestartAllowed([minutes(10), minutes(20), minutes(359)], NOW) &&
+            autoRestartAllowed(['garbage', '', minutes(1)], NOW), 'the fourth restart in six hours is refused; old ones and garbage in the file do not count');
+        const restarts = new SessionLedger(storage, t.at('storage', 'data', 'other'));
+        restarts.startLaunch(launch, NOW);
+        for (let i = 0; i < 4; i++)
+            restarts.recordAutoRestart(new Date(NOW.getTime() - (4 - i) * 3600000));
+        const counted = restarts.read()?.autoRestarts?.length;
+        restarts.giveUp(NOW);
+        t.check(counted === 4 && restarts.takeGaveUp() !== null && restarts.takeGaveUp() === null, 'automatic restarts are counted; the launch hears that it gave up, once');
+        t.section("which conversation is a session's");
+        const at = (ms) => NOW.getTime() + ms * 1000;
+        const files = [
+            { id: ID_A, createdMs: at(5) },
+            { id: ID_B, createdMs: at(20) },
+            { id: ID_C, createdMs: at(-100) },
+            { id: 'notes', createdMs: at(6) },
+        ];
+        t.equal([
+            pickConversation(files, NOW.getTime(), new Set()),
+            pickConversation(files, NOW.getTime(), new Set([ID_A])),
+            pickConversation(files, at(10), new Set()),
+            pickConversation(files, at(30), new Set()),
+        ], [ID_A, ID_B, ID_B, null], 'the first file created since the session started, not one another session has; none yet is null');
+        t.section('the arguments that open it again');
+        const claude = DEFAULTS.harnesses.claude;
+        t.equal([
+            resumeArgumentsFor(claude, ID_A),
+            resumeArgumentsFor(claude),
+            resumeArgumentsFor(claude, 'x; calc'),
+            resumeArgumentsFor(DEFAULTS.harnesses.codex, ID_A),
+            resumeArgumentsFor({}, ID_A),
+        ], [['--resume', ID_A], ['--continue'], ['--continue'], ['resume', '--last'], []], 'a known id opens that conversation; otherwise the last one; an id that is not one never reaches the command line');
+        const harness = (extra) => HarnessSchema.safeParse({ npmPackage: 'x', npmBin: 'x', arguments: [], environment: {}, ...extra }).success;
+        t.check(harness({ resumeOneArguments: ['--resume', '{id}'] }) &&
+            !harness({ resumeOneArguments: ['--resume'] }) &&
+            SessionStatusSchema.safeParse(status({ conversation: ID_A })).success &&
+            !SessionStatusSchema.safeParse(status({ conversation: 'y'.repeat(200) })).success, 'resumeOneArguments needs {id}; a session status may carry a capped conversation');
+        t.section('not opening twice');
+        t.equal(notRunningYet([
+            { harness: 'claude', hostDir: 'F:\\code\\api' },
+            { harness: 'claude', hostDir: 'F:\\code\\api' },
+            { harness: 'codex', hostDir: 'F:\\code\\api' },
+        ], [{ harness: 'claude', hostDir: 'F:\\code\\API' }]).map((r) => r.harness), ['claude', 'codex'], 'a session the sandbox already has is not opened again (one for one, any letter case)');
+    },
+};

package/dist/selftest/secrets.test.js

@@ -1,5 +1,5 @@
-// What reaches the sandbox from this PC's Claude files, and what is stripped first: API keys, cloud credentials, tokens in
-// MCP server definitions. Also the secret-looking files in a workspace that the launch warns about.
+// What reaches the sandbox from this PC's Claude files, and what is stripped first: API keys, cloud credentials, tokens
+// in MCP server definitions. Also the secret-looking files in a workspace that the launch warns about.
 import path from 'node:path';
 import { findSecretFiles, sandboxGlobalState, stripMcpServers, stripSettings } from '../host/profile/index.js';
 const REMOVED = '[removed by agent-sandbox]';

package/dist/selftest/setup.test.js

@@ -21,11 +21,14 @@ export const setupSuite = {
             parseDismState('Error: 740\r\nElevated permissions are required'),
         ], ['enabled', 'pending', 'disabled', 'disabled', 'unknown'], 'DISM feature state: enabled, pending restart, disabled; errors are unknown');
         t.equal([featureFromInstallState(1), featureFromInstallState(2), featureFromInstallState(null)], ['enabled', 'disabled', 'unknown'], 'Win32_OptionalFeature install state maps to the feature state');
-        t.equal(parseProbe('WARNING: x\r\n{"virtualizationFirmware":false,"hypervisorPresent":true,"installState":1}\r\n')
-            .hypervisorPresent, true, 'PowerShell probe: the last line is read as JSON');
-        t.equal(Object.keys(parseProbe('not json')).length, 0, 'PowerShell probe: text that is not JSON is ignored');
-        t.equal(Object.keys(parseProbe('{"installState":"1"}')).length, 0, 'PowerShell probe: JSON of the wrong shape is ignored');
-        t.equal([nodeMajor('v22.11.0'), nodeMajor('18.0.0'), nodeMajor('')], [22, 18, 0], 'Node major version');
+        t.equal([
+            parseProbe('WARNING: x\r\n{"virtualizationFirmware":false,"hypervisorPresent":true,"installState":1}\r\n')
+                .hypervisorPresent,
+            Object.keys(parseProbe('not json')).length,
+            Object.keys(parseProbe('{"installState":"1"}')).length,
+            nodeMajor('v22.11.0'),
+            nodeMajor(''),
+        ], [true, 0, 0, 22, 0], 'PowerShell probe: the last line is read as JSON, other text or the wrong shape is ignored; Node major version');
         t.section('judging each item');
         const good = {
             edition: 'Professional',
@@ -41,26 +44,31 @@ export const setupSuite = {
         };
         const status = (facts) => Object.fromEntries(buildChecks({ ...good, ...facts }).map((c) => [c.name, c.status]));
         t.check(buildChecks(good).every((c) => c.status === 'ok'), 'a ready PC is all OK (a running hypervisor counts as virtualization on)');
-        t.equal(status({ edition: 'Core' })['Windows edition'], 'action', 'Windows Home needs action');
-        t.equal(status({ build: 17763 })['Windows edition'], 'action', 'an old Windows build needs action');
-        t.equal(status({ edition: 'Weird' })['Windows edition'], 'warn', 'an unknown edition warns');
-        t.equal(status({ hypervisorPresent: false })['CPU virtualization'], 'action', 'virtualization: off needs action');
-        t.equal(status({ hypervisorPresent: null, virtualizationFirmware: null })['CPU virtualization'], 'warn', 'virtualization: unknown warns');
-        t.equal(status({ hypervisorPresent: false, virtualizationFirmware: true })['CPU virtualization'], 'ok', 'virtualization: on in the firmware is fine');
-        t.equal(status({ feature: 'disabled', sandboxExe: false })['Windows Sandbox feature'], 'action', 'feature: off needs action');
-        const waiting = buildChecks({ ...good, feature: 'pending', sandboxExe: false })[2];
-        t.includes(waiting.detail, 'restart', 'feature: waiting for a restart says so');
-        t.includes(buildChecks({ ...good, feature: 'enabled', sandboxExe: false })[2].detail, 'restart', 'feature: enabled but not usable yet says to restart');
-        t.equal(status({ totalRamBytes: 6 * GB }).Memory, 'warn', 'RAM under 8 GB warns');
-        t.equal(status({ totalRamBytes: 3 * GB }).Memory, 'action', 'RAM under 4 GB needs action');
-        t.equal(status({ freeDiskBytes: 10 * GB })['Free disk'], 'warn', 'low free disk warns');
-        t.equal(status({ freeDiskBytes: 2 * GB })['Free disk'], 'action', 'very low free disk needs action');
-        t.equal(status({ freeDiskBytes: null })['Free disk'], 'warn', 'unknown free disk warns');
-        t.equal(status({ nodeVersion: 'v18.20.0' })['Node.js'], 'action', 'an old Node.js needs action');
+        t.equal([
+            status({ edition: 'Core' })['Windows edition'],
+            status({ build: 17763 })['Windows edition'],
+            status({ edition: 'Weird' })['Windows edition'],
+            status({ nodeVersion: 'v18.20.0' })['Node.js'],
+        ], ['action', 'action', 'warn', 'action'], 'Windows Home and an old build or Node.js need action; an unknown edition warns');
+        t.equal([
+            status({ hypervisorPresent: false })['CPU virtualization'],
+            status({ hypervisorPresent: null, virtualizationFirmware: null })['CPU virtualization'],
+            status({ hypervisorPresent: false, virtualizationFirmware: true })['CPU virtualization'],
+        ], ['action', 'warn', 'ok'], 'virtualization: off needs action, unknown warns, on in the firmware is fine');
+        t.check(status({ feature: 'disabled', sandboxExe: false })['Windows Sandbox feature'] === 'action' &&
+            buildChecks({ ...good, feature: 'pending', sandboxExe: false })[2].detail.includes('restart') &&
+            buildChecks({ ...good, feature: 'enabled', sandboxExe: false })[2].detail.includes('restart'), 'feature: off needs action; pending or not usable yet says to restart');
+        t.equal([
+            status({ totalRamBytes: 6 * GB }).Memory,
+            status({ totalRamBytes: 3 * GB }).Memory,
+            status({ freeDiskBytes: 10 * GB })['Free disk'],
+            status({ freeDiskBytes: 2 * GB })['Free disk'],
+            status({ freeDiskBytes: null })['Free disk'],
+        ], ['warn', 'action', 'warn', 'action', 'warn'], 'low RAM or disk warns, very low needs action, unknown disk warns');
         const off = { ...good, feature: 'disabled', sandboxExe: false };
-        t.check(canEnableFeature(off), 'offers to enable the feature when it is off on an edition that has it');
-        t.check(!canEnableFeature({ ...off, edition: 'Core' }), 'does not offer it on Windows Home');
-        t.check(!canEnableFeature({ ...off, feature: 'pending' }), 'does not offer it while a restart is pending');
-        t.check(!canEnableFeature(good), 'does not offer it when it is already on');
+        t.check(canEnableFeature(off) &&
+            !canEnableFeature({ ...off, edition: 'Core' }) &&
+            !canEnableFeature({ ...off, feature: 'pending' }) &&
+            !canEnableFeature(good), 'offers to enable the feature only when it is off on an edition that has it (not Home, pending or already on)');
     },
 };

package/dist/selftest/shared-use.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const sharedUseSuite: Suite;

package/dist/selftest/shared-use.test.js

@@ -0,0 +1,178 @@
+// Sharing wired into the commands: what each user may do with the running sandbox (pure rules), the launch writing and
+// clearing the record, the shared data folder taken from a record, and a borrowed project list. Temp folders only; the
+// folder permissions go to a fake.
+import fs from 'node:fs';
+import path from 'node:path';
+import { BorrowedRegistry } from '../host/projects/index.js';
+import { ActiveRecords, beginSharing, endSharing, launchBlocked, ownerLine, ownerRule, sharedDataPath, sharingDeps, takeSharingNotice, } from '../host/sharing/index.js';
+import { takeHiddenInstallNotice } from '../host/install/index.js';
+const SID = 'S-1-5-21-1-2-3-1001';
+const GROUP = 'S-1-5-21-1-2-3-5000';
+const record = (dataPath, shared) => ({
+    user: 'alice',
+    sid: SID,
+    windowsSession: 2,
+    dataPath,
+    shared,
+    startedAt: '2026-10-14T09:00:00Z',
+    version: '1.5.0',
+    projects: [{ id: 'app', hostPath: 'C:\\Dev\\app', guestPath: 'C:\\Workspace\\app' }],
+});
+const other = (shared, user = 'alice') => ({
+    kind: 'other',
+    user,
+    shared,
+    record: record('C:\\x', shared),
+});
+function rules(t) {
+    t.section('what a user may do with another user\u2019s sandbox');
+    t.equal([
+        ownerRule({ kind: 'mine' }, { kind: 'stop', sessions: 1 }).kind,
+        ownerRule({ kind: 'none' }, { kind: 'use' }).kind,
+        ownerRule(other(false), { kind: 'look' }).kind,
+        ownerRule(other(true), { kind: 'use' }).kind,
+        ownerRule({ kind: 'unknown-other' }, { kind: 'look' }).kind,
+    ], ['allow', 'allow', 'allow', 'allow', 'allow'], 'allowed: your own sandbox, nothing running, looking at any, using a shared one');
+    const refused = ownerRule(other(false), { kind: 'use' });
+    const stop = ownerRule(other(true), { kind: 'stop', sessions: 2 });
+    t.check(refused.kind === 'refuse' &&
+        refused.reason.includes('not shared') &&
+        ownerRule(other(false), { kind: 'stop', sessions: 0 }).kind === 'refuse' &&
+        ownerRule({ kind: 'unknown-other' }, { kind: 'use' }).kind === 'refuse' &&
+        stop.kind === 'confirm' &&
+        stop.expected === 'alice' &&
+        stop.prompt.includes('2 sessions'), 'not shared or unrecorded: use and stop are refused; shared: stop asks for the owner’s name and the session count');
+    const restart = ownerRule(other(true), { kind: 'owner-only', what: 'restart the agents' });
+    const window = ownerRule(other(true), { kind: 'owner-only', what: 'x', window: true });
+    t.check(restart.kind === 'refuse' &&
+        restart.reason === 'Only alice can restart the agents: the sandbox is theirs.' &&
+        window.kind === 'refuse' &&
+        window.reason.includes("window is on alice's desktop"), 'restart, a new launch and the like are the owner’s alone, and the window message says whose desktop it is on');
+    t.check(!(ownerLine(other(true, 'al\u001b[2Jice')) ?? '').includes('\u001b') &&
+        ownerLine(other(false)) === 'Running, started by alice (not shared)' &&
+        ownerLine(other(true)) === 'Running, started by alice (shared with you)' &&
+        ownerLine({ kind: 'mine' }) === null &&
+        launchBlocked(other(true)) === 'A Windows Sandbox started by alice is already running' &&
+        launchBlocked({ kind: 'mine' }) === null, 'the owner is named in the status line and a blocked launch; terminal codes in a name are cleaned');
+}
+function lifecycle(t) {
+    t.section('launch writes the record and the permissions; the end clears them');
+    const machine = t.dir('shared', 'machine');
+    const records = new ActiveRecords(path.join(machine, 'active'));
+    const storage = t.dir('shared', 'machine', 'users', 'alice');
+    const dataPath = path.join(storage, 'data', 'default');
+    const calls = [];
+    const deps = {
+        records,
+        apply: (c) => void calls.push([...c]),
+        groupSid: GROUP,
+        usersDir: path.join(machine, 'users'),
+    };
+    const { startedAt: _ignored, ...start } = record(dataPath, true);
+    void _ignored;
+    beginSharing(deps, start, new Date('2026-10-14T09:00:00Z'));
+    t.check(records.readAll().length === 1 &&
+        records.readAll()[0].shared &&
+        calls[0].length === 4 &&
+        calls[0].every((c) => c.add), 'the record is written as shared and the group is granted its four entries');
+    t.check(['requests', 'responses', 'sessions'].every((d) => fs.existsSync(path.join(dataPath, 'run', d))), 'the owner creates the channel folders before others may write there');
+    endSharing(deps, dataPath);
+    t.check(records.readAll().length === 0 && calls[1].length === 4 && calls[1].every((c) => !c.add), 'the end removes the record and takes the entries away');
+    beginSharing(deps, { ...start, shared: false });
+    endSharing({ ...deps, groupSid: null }, dataPath);
+    t.check(calls[2].every((c) => !c.add) && records.readAll().length === 0, 'sharing off applies the removal, never a grant; without a group only the record goes');
+    // Sharing off and no group entry anywhere: nothing to remove, so the permission script is not run at all.
+    const before = calls.length;
+    const asked = [];
+    const quiet = {
+        ...deps,
+        groupHasAccess: (dirs) => {
+            asked.push([...dirs]);
+            return false;
+        },
+    };
+    beginSharing(quiet, { ...start, shared: false });
+    t.check(calls.length === before && asked.length === 1 && asked[0].length === 4, 'sharing off with no group entry on the four folders skips the permission change');
+    beginSharing({ ...quiet, groupHasAccess: () => true }, { ...start, shared: false });
+    beginSharing({ ...quiet, groupHasAccess: () => false }, start);
+    t.check(calls.length === before + 2 && !calls[before].some((c) => c.add) && calls[before + 1].every((c) => c.add), 'a group entry (or one that cannot be read) is removed as before, and sharing on always writes its entries');
+    const failing = {
+        ...deps,
+        groupHasAccess: () => true,
+        apply: () => {
+            throw new Error('denied');
+        },
+    };
+    let refused = false;
+    try {
+        beginSharing(failing, { ...start, shared: false });
+    }
+    catch {
+        refused = true;
+    }
+    t.check(refused, 'a removal that fails refuses the launch');
+    endSharing(deps, dataPath);
+    // The all-users install is found from any copy of the program (an npm copy, a checkout), never skipped silently.
+    const savedPf = process.env.ProgramFiles;
+    const pf = t.dir('shared', 'Program Files');
+    const copy = path.join(t.dir('shared', 'npm'), 'node_modules', 'windows-development-sandbox');
+    try {
+        process.env.ProgramFiles = pf;
+        t.check(sharingDeps(copy) === null, 'with no all-users install on the PC an npm copy shares nothing');
+        t.writeJson(path.join(pf, 'WindowsDevelopmentSandbox', 'install.json'), {
+            scope: 'machine',
+            groupSid: GROUP,
+            autoUpdate: false,
+            installedAt: '2026-10-01T00:00:00Z',
+        });
+        t.equal(sharingDeps(copy)?.groupSid, GROUP, 'with one, an npm copy uses its group and shares like the installed copy');
+    }
+    finally {
+        if (savedPf === undefined)
+            delete process.env.ProgramFiles;
+        else
+            process.env.ProgramFiles = savedPf;
+    }
+    const env = { ProgramFiles: pf };
+    const managedPackage = path.join(pf, 'WindowsDevelopmentSandbox', 'versions', '1.5.0', 'package');
+    const line = takeHiddenInstallNotice(storage, copy, '1.5.0', env);
+    t.check((line ?? '').includes(copy) && (line ?? '').includes(path.join(pf, 'WindowsDevelopmentSandbox')), 'a copy that is not the managed install says where it runs and which install it hides');
+    t.check(takeHiddenInstallNotice(storage, copy, '1.5.0', env) === null &&
+        takeHiddenInstallNotice(storage, copy, '1.5.1', env) !== null &&
+        takeHiddenInstallNotice(storage, managedPackage, '1.5.2', env) === null &&
+        takeHiddenInstallNotice(storage, copy, '1.5.3', {}) === null, 'the line comes once per version, never from the managed install itself, and never without an install to hide');
+    const callsBefore = calls.length;
+    const own = path.join(t.dir('shared', 'profile', 'AgentSandbox'), 'data', 'default');
+    beginSharing(deps, { ...start, dataPath: own });
+    endSharing(deps, own);
+    t.check(calls.length === callsBefore && !fs.existsSync(path.join(own, 'run')), 'a data folder outside machine\\users is never opened to the group, even with sharing on');
+    const notice = takeSharingNotice(storage);
+    t.check((notice ?? '').includes('Agent Sandbox Users can attach to and run commands') &&
+        takeSharingNotice(storage) === null, 'the first sharing launch explains it, once');
+}
+async function borrowed(t) {
+    t.section('using a shared sandbox: its folder and projects');
+    const machine = t.dir('borrow', 'machine');
+    const ok = path.join(machine, 'users', 'alice', 'data', 'default');
+    t.equal(sharedDataPath(record(ok, true), machine), ok, 'a data folder under machine\\users\\<name>\\data is taken');
+    for (const bad of [
+        path.join(machine, 'users', 'alice', 'accounts'),
+        path.join(machine, 'users', 'alice', 'data', 'default', 'run'),
+        path.join(machine, '..', 'elsewhere', 'data', 'default'),
+        'C:\\Windows',
+    ])
+        await t.throws(() => sharedDataPath(record(bad, true), machine), 'points outside', 'refused: ' + bad);
+    const registry = new BorrowedRegistry(record(ok, true)).read();
+    t.check(registry.projects.map((p) => p.host).join() === 'C:\\Dev\\app' &&
+        registry.projects[0].guest === 'C:\\Workspace\\app', 'the projects come from the record, with their paths in the sandbox');
+    await t.throws(() => new BorrowedRegistry(record(ok, true)).save(), 'theirs to change', 'and cannot be changed from here');
+}
+export const sharedUseSuite = {
+    name: 'shared-use',
+    title: 'sharing in the commands: rules, record at launch and end, borrowed folder and projects',
+    run: async (t) => {
+        rules(t);
+        lifecycle(t);
+        await borrowed(t);
+    },
+};

package/dist/selftest/sharing.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const sharingSuite: Suite;