windows-development-sandbox 1.4.3 → 1.7.0

package/dist/selftest/vpn.test.js

@@ -0,0 +1,279 @@
+// The VPN: profiles are untrusted (programs refused), the kill switch rules, NordVPN server choice, the saved login,
+// the settings rules for projects, and that the login never lands in session.json or the launch folder.
+import fs from 'node:fs';
+import path from 'node:path';
+import { DEFAULTS } from '../core/config/index.js';
+import { applyOverrides, loosenedRequests, NEVER_LOOSER, normalizeOverrides } from '../core/local-config/index.js';
+import { ConfigSchema, LocalOverridesSchema } from '../core/schema/index.js';
+import { SecretStore } from '../host/secrets/index.js';
+import { clearSecrets } from '../host/secrets/index.js';
+import { generateSandbox } from '../host/launch/index.js';
+import { findCountry, nordProfile, prepareVpn, recommendedServer, VpnLogin, vpnLine, vpnNotes, } from '../host/vpn/index.js';
+import { RunDir } from '../shared/channel/index.js';
+import { OPENVPN_MSI } from '../shared/vpn/download.js';
+import { cleanServers, killSwitchCommands, removeKillSwitchCommands, tunnelAddressFromLog, tunnelCommands, } from '../shared/vpn/kill-switch.js';
+import { assertSafeOvpn, inspectOvpn, PROGRAM_DIRECTIVES } from '../shared/vpn/ovpn.js';
+const PROFILE = [
+    'client',
+    'dev tun',
+    'proto udp',
+    'remote 185.1.2.3 1194',
+    'remote-random',
+    'resolv-retry infinite',
+    'nobind',
+    'tun-mtu 1500',
+    'tun-mtu-extra 32',
+    'mssfix 1450',
+    'persist-key',
+    'persist-tun',
+    'ping 15',
+    'ping-restart 0',
+    'ping-timer-rem',
+    'reneg-sec 0',
+    'comp-lzo no',
+    'remote-cert-tls server',
+    'auth-user-pass',
+    'verb 3',
+    'pull',
+    'fast-io',
+    'cipher AES-256-CBC',
+    'auth SHA512',
+    '<ca>',
+    '-----BEGIN CERTIFICATE-----',
+    'MIIDxx',
+    '-----END CERTIFICATE-----',
+    '</ca>',
+    'key-direction 1',
+    '<tls-auth>',
+    '-----BEGIN OpenVPN Static key V1-----',
+    'abcd',
+    '-----END OpenVPN Static key V1-----',
+    '</tls-auth>',
+    '',
+].join('\r\n');
+const PASSWORD = 'vpn-pass-planted-91c2d7';
+const USERNAME = 'vpn-user-planted-5e8a40';
+export const vpnSuite = {
+    name: 'vpn',
+    title: 'VPN: profile checks, kill switch rules, NordVPN, login storage, settings rules',
+    run: async (t, f) => {
+        t.section('a profile is untrusted data');
+        const good = inspectOvpn(PROFILE);
+        t.check(good.ok && good.remotes.length === 1 && good.remotes[0].host === '185.1.2.3' && good.remotes[0].proto === 'udp', 'a NordVPN-style profile is accepted and says where it connects (and with which protocol)', JSON.stringify(good));
+        const byName = inspectOvpn('remote vpn.example.com 443\r\nproto tcp-client\r\nclient');
+        t.check(byName.ok && byName.remotes[0].proto === 'tcp' && byName.remotes[0].host === 'vpn.example.com', 'the proto line counts even after the remote line, and a host name is allowed');
+        for (const name of ['script-security', 'up', 'down', 'plugin', 'route-up', 'ipchange', 'tls-verify']) {
+            const bad = inspectOvpn(PROFILE + name + ' 2 C:\\evil.cmd\r\n');
+            t.check(!bad.ok && bad.problems.some((p) => p.includes(name + ' runs a program')), name + ' is refused as something that runs a program', JSON.stringify(bad));
+        }
+        t.check(PROGRAM_DIRECTIVES.every((name) => !inspectOvpn(PROFILE + name + ' x\r\n').ok), 'every listed program-running directive is refused');
+        const odd = [
+            ['--up x', 'a leading -- does not hide it'],
+            ['UP x', 'upper case does not hide it'],
+            ['\tscript-security 2', 'leading white space does not hide it'],
+            ['"up" x', 'quotes around the name do not hide it'],
+            ['made-up-directive 1', 'an unknown directive is refused, not passed on'],
+            ['ca /etc/ca.crt', 'a certificate file on this machine is refused'],
+            ['auth-user-pass C:\\secret.txt', 'a login file named in the profile is refused'],
+            ['setenv FOO bar', 'setenv for anything but CLIENT_CERT is refused'],
+            ['<connection>', 'a <connection> section (it could hide more) is refused'],
+        ];
+        for (const [line, why] of odd)
+            t.check(!inspectOvpn(PROFILE + line + '\r\n').ok, why, line);
+        t.check(!inspectOvpn(PROFILE.replace('</ca>', '')).ok &&
+            !inspectOvpn('client\r\n').ok &&
+            !inspectOvpn('x'.repeat(300 * 1024)).ok &&
+            !inspectOvpn(PROFILE.replace('<tls-auth>', '<tls-auth>\r\nup evil\r\n<ca>')).ok, 'an unclosed section, no remote, an oversized file and a section inside a section are refused');
+        t.check(inspectOvpn(PROFILE.replace('</ca>', '</ca>\r\n# up /bin/evil\r\n; plugin evil.dll\r\n')).ok, 'comments are comments (a commented-out up line is not a directive)');
+        await t.throws(() => assertSafeOvpn(PROFILE + 'script-security 2\r\nup evil.cmd\r\n', 'uk1.nordvpn.com'), 'uk1.nordvpn.com was refused', 'a refused profile names its source and the reason');
+        t.section('the kill switch as netsh commands');
+        const servers = [
+            { ip: '185.1.2.3', port: 1194, proto: 'udp' },
+            { ip: '185.1.2.3', port: 1194, proto: 'udp' },
+            { ip: 'not-an-ip', port: 1194, proto: 'udp' },
+            { ip: '185.9.9.9', port: 443, proto: 'tcp' },
+        ];
+        t.equal(cleanServers(servers).map((s) => s.ip + ':' + s.port), ['185.1.2.3:1194', '185.9.9.9:443'], 'servers are valid and each once');
+        const phase1 = killSwitchCommands(servers, 'C:\\AgentLaunch\\ptyhost.exe').map((c) => c.join(' '));
+        const policyAt = phase1.findIndex((c) => c.includes('firewallpolicy blockinbound,blockoutbound'));
+        const firstAllow = phase1.findIndex((c) => c.includes('action=allow'));
+        t.check(policyAt > 0 && policyAt < firstAllow, 'outbound is blocked by default before any allow rule is added', phase1.join('\n'));
+        t.check(phase1.some((c) => c.includes('name=AgentSandbox-VPN-Loopback') && c.includes('remoteip=127.0.0.0/8')) &&
+            phase1.some((c) => c.includes('name=AgentSandbox-VPN-Server-1') &&
+                c.includes('protocol=udp') &&
+                c.includes('remoteip=185.1.2.3') &&
+                c.includes('remoteport=1194')) &&
+            phase1.some((c) => c.includes('name=AgentSandbox-VPN-Server-2') && c.includes('protocol=tcp') && c.includes('remoteport=443')) &&
+            phase1.some((c) => c.includes('name=AgentSandbox-VPN-Host') &&
+                c.includes('remoteip=LocalSubnet') &&
+                c.includes('program=C:\\AgentLaunch\\ptyhost.exe')) &&
+            phase1.some((c) => c.includes('name=AgentSandbox-VPN-DHCP')), 'it allows loopback, each VPN server endpoint, the attach channel on the Hyper-V network and DHCP');
+        t.check(!phase1.some((c) => c.includes('localip=') || (c.includes('action=allow') && c.includes('remoteip=any'))), 'nothing else is allowed before the tunnel exists (no blanket rule)');
+        t.check(killSwitchCommands([], null).every((c) => !c.join(' ').includes('Server-1') || c[2] === 'delete') &&
+            !killSwitchCommands([], null).some((c) => c.join(' ').includes('name=AgentSandbox-VPN-Host') && c[2] === 'add'), 'with no servers and no session host only the block and the loopback rules remain (the failure case: offline)');
+        t.equal(tunnelCommands('10.8.0.6')
+            .map((c) => c.join(' '))
+            .filter((c) => c.includes(' add ')), [
+            'advfirewall firewall add rule name=AgentSandbox-VPN-Tunnel dir=out action=allow enable=yes profile=any protocol=any localip=10.8.0.6',
+        ], 'once the tunnel is up, traffic from its own address (the tunnel) is allowed');
+        await t.throws(() => tunnelCommands('10.8.0.6; calc'), 'Not an IPv4', 'a tunnel address that is not an address makes no rule');
+        t.check(removeKillSwitchCommands().some((c) => c.join(' ').includes('blockinbound,allowoutbound')) &&
+            removeKillSwitchCommands().some((c) => c.join(' ').includes('name=AgentSandbox-VPN-Tunnel')), 'taking it away restores the default and deletes the rules');
+        t.equal([
+            tunnelAddressFromLog('... net_addr_v4_add: 10.100.0.2/16 dev Wintun ...'),
+            tunnelAddressFromLog('ifconfig 10.8.0.6 255.255.255.0'),
+            tunnelAddressFromLog('nothing'),
+        ], ['10.100.0.2', '10.8.0.6', null], "the tunnel's address is read from OpenVPN's log");
+        t.check(OPENVPN_MSI.x64.sha256.length === 64 &&
+            OPENVPN_MSI.arm64.sha256.length === 64 &&
+            OPENVPN_MSI.base.startsWith('https://'), 'the OpenVPN download has a checksum for each architecture (downloads.requireChecksum passes)');
+        t.section('NordVPN: the server for the country and protocol');
+        const asked = [];
+        const fake = (url) => {
+            asked.push(url);
+            if (url.endsWith('/servers/countries'))
+                return Promise.resolve(JSON.stringify([
+                    { id: 227, name: 'United Kingdom', code: 'GB' },
+                    { id: 81, name: 'Germany', code: 'DE' },
+                ]));
+            if (url.includes('/servers/recommendations'))
+                return Promise.resolve(JSON.stringify([{ hostname: 'uk2201.nordvpn.com', station: '185.1.2.3' }]));
+            if (url.endsWith('.ovpn'))
+                return Promise.resolve(PROFILE);
+            return Promise.reject(new Error('unexpected ' + url));
+        };
+        t.check(findCountry([{ id: 227, name: 'United Kingdom', code: 'GB' }], 'uk') === 227 &&
+            findCountry([{ id: 81, name: 'Germany', code: 'DE' }], 'germany') === 81, 'uk and Germany are found by code, alias or name');
+        await t.throws(() => findCountry([{ id: 81, name: 'Germany', code: 'DE' }], 'atlantis'), 'no country', 'an unknown country says so');
+        const server = await recommendedServer('udp', 'uk', fake);
+        t.check(server.hostname === 'uk2201.nordvpn.com' &&
+            asked.some((u) => u.includes('filters[country_id]=227') && u.includes('openvpn_udp')), 'the recommendation asks for the country and the protocol', asked.join('\n'));
+        t.check((await nordProfile(server, 'udp', fake)) === PROFILE &&
+            asked.some((u) => u === 'https://downloads.nordcdn.com/configs/files/ovpn_udp/servers/uk2201.nordvpn.com.udp.ovpn'), "the server's own profile is fetched from NordVPN's download host");
+        await t.throws(() => recommendedServer('udp', '', () => Promise.resolve(JSON.stringify([{ hostname: 'evil.example.com; calc', station: '1.2.3.4' }]))), 'did not recommend', 'an answer that is not a NordVPN host name is refused (it becomes part of a URL and a file name)');
+        t.section('the saved login');
+        const storage = t.dir('vpn-storage');
+        const login = new VpnLogin(storage, SecretStore.memory());
+        t.check(login.state('nordvpn') === 'none', 'nothing is saved at first');
+        await t.throws(() => login.save('nordvpn', { username: 'a\nb', password: 'x' }), 'line breaks', 'a login with a line break is refused (it goes on two lines of a file)');
+        login.save('nordvpn', { username: USERNAME, password: PASSWORD });
+        const file = path.join(storage, 'vpn', 'nordvpn.json');
+        t.check(login.state('nordvpn') === 'saved' &&
+            !fs.readFileSync(file, 'utf8').includes(USERNAME) &&
+            !fs.readFileSync(file, 'utf8').includes(PASSWORD), 'it is saved sealed: neither value is in the file');
+        t.equal(login.read('nordvpn'), { username: USERNAME, password: PASSWORD }, 'and it opens for the launch');
+        fs.writeFileSync(file, fs.readFileSync(file, 'utf8').replace(/"sealed": "[^"]*"/, '"sealed": "dpapi1:AAAA"'));
+        t.check(login.state('nordvpn') === 'unreadable', 'a login this Windows user cannot open is reported as unreadable');
+        login.remove('nordvpn');
+        t.check(login.state('nordvpn') === 'none', 'logout deletes it');
+        t.section('settings: what a project may and may not do');
+        t.check(DEFAULTS.vpn.enabled === false && DEFAULTS.vpn.provider === 'nordvpn' && DEFAULTS.vpn.killSwitch === true, 'the VPN is off by default, NordVPN, with the kill switch on');
+        t.check(ConfigSchema.safeParse(DEFAULTS).success, 'the defaults are valid');
+        t.check(!ConfigSchema.safeParse({ ...DEFAULTS, vpn: { ...DEFAULTS.vpn, country: 'uk; calc' } }).success &&
+            !ConfigSchema.safeParse({ ...DEFAULTS, vpn: { ...DEFAULTS.vpn, protocol: 'icmp' } }).success &&
+            !ConfigSchema.safeParse({ ...DEFAULTS, vpn: { ...DEFAULTS.vpn, username: 'x' } }).success, 'a country with odd characters, an unknown protocol and a login setting are all invalid (no login setting exists)');
+        for (const bad of [
+            { vpn: { enabled: true } },
+            { vpn: { provider: 'openvpn-file' } },
+            { vpn: { configFile: 'C:\\evil.ovpn' } },
+            { vpn: { country: 'uk' } },
+            { vpn: { username: 'x', password: 'y' } },
+            { vpn: { credentials: 'x' } },
+            { vpn: { servers: ['1.2.3.4'] } },
+        ])
+            t.check(!LocalOverridesSchema.safeParse(bad).success, "a project's .sandbox-config.json cannot set " + Object.keys(bad.vpn).join(', '));
+        t.check(LocalOverridesSchema.safeParse({ vpn: { killSwitch: true } }).success, 'it can ask for the kill switch');
+        t.check(NEVER_LOOSER.includes('vpn.killSwitch'), 'the kill switch is a protection a project may only tighten');
+        const mine = structuredClone(DEFAULTS);
+        mine.vpn.enabled = true;
+        const loosen = normalizeOverrides({ vpn: { killSwitch: false } }, f.workA, 'x');
+        t.check(applyOverrides(mine, loosen).vpn.killSwitch === true &&
+            loosenedRequests(mine, loosen).some((r) => r.key === 'vpn.killSwitch'), 'a project cannot turn the kill switch off (it is flagged and ignored)');
+        const off = structuredClone(mine);
+        off.vpn.killSwitch = false;
+        t.check(applyOverrides(off, normalizeOverrides({ vpn: { killSwitch: true } }, f.workA, 'x')).vpn.killSwitch === true, 'but it can turn it on');
+        t.section('the login never lands in session.json, the launch folder or --json');
+        const config = f.makeConfig();
+        config.vpn = { ...config.vpn, enabled: true, country: 'uk' };
+        const store = new VpnLogin(config.storage.root, SecretStore.memory());
+        store.save('nordvpn', { username: USERNAME, password: PASSWORD });
+        const run = await f.run({}, config);
+        const prepared = await prepareVpn({
+            config: run.config,
+            storageRoot: config.storage.root,
+            login: store,
+            fetchText: fake,
+        });
+        t.check(prepared !== null &&
+            prepared.session.server === 'uk2201.nordvpn.com' &&
+            prepared.credentials.password === PASSWORD, 'a launch picks the server, checks its profile and holds the login in memory');
+        await t.throws(() => prepareVpn({
+            config: run.config,
+            storageRoot: config.storage.root,
+            login: store,
+            fetchText: fake,
+            sandboxRunning: true,
+        }), 'already', 'the login is not handed over while a sandbox is running (one that is not being started now)');
+        await t.throws(() => prepareVpn({
+            config: run.config,
+            storageRoot: config.storage.root,
+            login: store,
+            fetchText: (url) => (url.endsWith('.ovpn') ? Promise.resolve(PROFILE + 'up evil.cmd\r\n') : fake(url)),
+        }), 'refused', 'a profile that would run a program stops the launch before anything is written');
+        await t.throws(() => prepareVpn({
+            config: run.config,
+            storageRoot: config.storage.root,
+            login: new VpnLogin(t.dir('vpn-empty'), SecretStore.memory()),
+            fetchText: fake,
+        }), 'sandbox vpn login', 'no saved login says how to save one');
+        clearSecrets(config.storage.root, run.dataPath);
+        const withVpn = generateSandbox({
+            packageRoot: t.packageRoot,
+            run,
+            harnessArgs: [],
+            probe: f.probe,
+            pcLanguages: ['python', 'rust', 'cpp', 'dotnet'],
+            ...(prepared ? { vpn: prepared } : {}),
+        });
+        const session = fs.readFileSync(withVpn.sessionPath, 'utf8');
+        const everything = [];
+        const walk = (d) => {
+            for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+                const p = path.join(d, e.name);
+                if (e.isDirectory())
+                    walk(p);
+                else
+                    everything.push(fs.readFileSync(p, 'latin1'));
+            }
+        };
+        walk(withVpn.launchPath);
+        t.check(!session.includes(PASSWORD) &&
+            !session.includes(USERNAME) &&
+            !everything.some((text) => text.includes(PASSWORD) || text.includes(USERNAME)), 'neither the service user name nor the password is in session.json or any file of the launch folder');
+        const vpnSession = f.readJson(withVpn.sessionPath).vpn;
+        t.check(vpnSession.server === 'uk2201.nordvpn.com' &&
+            vpnSession.killSwitch === true &&
+            fs.readFileSync(path.join(withVpn.launchPath, 'vpn', 'server.ovpn'), 'utf8') === PROFILE, 'session.json says which server and whether the kill switch is on; the checked profile is in the launch folder');
+        const handed = f.readJson(new RunDir(run.dataPath).secretFile(withVpn.launchId));
+        t.equal(handed.vpn, { username: USERNAME, password: PASSWORD }, 'the login is only in the one-shot file for the sandbox');
+        clearSecrets(config.storage.root, run.dataPath);
+        t.check(vpnNotes(config.vpn).some((n) => n.includes('can read the VPN login') && n.includes('turn the tunnel off')) &&
+            vpnNotes(config.vpn).some((n) => n.includes('kill switch on')) &&
+            vpnNotes({ ...config.vpn, killSwitch: false }).some((n) => n.includes('kill switch OFF')) &&
+            vpnNotes({ ...config.vpn, enabled: false }).length === 0, 'the launch warns that the agent can read the login and turn the tunnel off, and says what the kill switch does');
+        t.section('what the host says about the tunnel');
+        const status = (state, extra = {}) => vpnLine({ state, message: 'm', killSwitch: true, updatedAt: 'now', ...extra }, '203.0.113.9');
+        t.check(status('up', { publicIp: '185.1.2.3', server: 'uk2201.nordvpn.com' }).level === 'ok' &&
+            status('up', { publicIp: '203.0.113.9' }).level === 'bad' &&
+            status('failed', { message: 'login refused' }).text.includes('NO internet') === false &&
+            status('failed', { message: 'login refused' }).text.includes('no internet') &&
+            vpnLine({ state: 'failed', message: 'x', killSwitch: false, updatedAt: 'now' }).text.includes('normal connection') &&
+            status('starting').level === 'warn', "up with another address is fine, up with this PC's own address is flagged, a failure says what the kill switch did");
+        t.check(!vpnLine({
+            state: 'failed',
+            message: 'bad \u001b]52;c;ZXZpbA==\u0007 text',
+            killSwitch: true,
+            updatedAt: 'n',
+        }).text.includes('\u001b'), 'text the sandbox wrote loses its escape sequences before it is printed');
+    },
+};

package/dist/selftest/web.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const webSuite: Suite;

package/dist/selftest/web.test.js

@@ -0,0 +1,304 @@
+// The web UI's server: login and cookie, the Host / Origin / CSRF checks, static files that cannot leave their folder,
+// sessions without tokens, and the terminal bridge against a fake ptyhost on loopback (the real address check is the
+// backend's, so the fake is only reachable here).
+import http from 'node:http';
+import net from 'node:net';
+import path from 'node:path';
+import WebSocket from 'ws';
+import { webSession } from '../cli/services/index.js';
+import { cookieValue, csrfOk, hostAllowed, originAllowed, sameSecret, StaticFiles, WebAuth, WebServer, WebStore, } from '../host/web/index.js';
+import { encodeFrame, FrameReader, FrameType } from '../shared/pty/index.js';
+import { CSRF_HEADER, CSRF_VALUE, parseClientMessage } from '../shared/web/index.js';
+const TOKEN = 'a'.repeat(64);
+const ATTACH_TOKEN = 'SECRET-ATTACH-TOKEN';
+/** One HTTP request with exactly the headers given (Host included). */
+function send(port, method, url, headers = {}, body) {
+    return new Promise((resolve, reject) => {
+        const req = http.request({ host: '127.0.0.1', port, method, path: url, headers: { Host: '127.0.0.1:' + port, ...headers } }, (res) => {
+            const chunks = [];
+            res.on('data', (c) => chunks.push(c));
+            res.on('end', () => resolve({ status: res.statusCode ?? 0, headers: res.headers, body: Buffer.concat(chunks).toString('utf8') }));
+        });
+        req.on('error', reject);
+        req.end(body);
+    });
+}
+/** A ptyhost stand-in: records what the bridge sends, plays output, ends with EXIT when it gets the letter x. */
+class FakePtyHost {
+    hellos = [];
+    inputs = [];
+    resizes = [];
+    pings = 0;
+    closed = 0;
+    server;
+    open = new Set();
+    port = 0;
+    constructor() {
+        this.server = net.createServer((socket) => {
+            this.open.add(socket);
+            const reader = new FrameReader();
+            socket.on('error', () => undefined);
+            socket.on('close', () => this.closed++);
+            socket.on('data', (chunk) => {
+                for (const frame of reader.push(chunk)) {
+                    if (frame.type === FrameType.Hello) {
+                        this.hellos.push(frame.payload);
+                        // Output with a clipboard write (OSC 52) inside: the bridge must drop that part.
+                        socket.write(encodeFrame(FrameType.Output, Buffer.from('hello \x1b]52;c;ZXZpbA==\x07world')));
+                    }
+                    else if (frame.type === FrameType.Input) {
+                        this.inputs.push(frame.payload);
+                        if (frame.payload.toString() === 'x') {
+                            const code = Buffer.alloc(4);
+                            code.writeInt32LE(3, 0);
+                            socket.write(encodeFrame(FrameType.Exit, code));
+                        }
+                    }
+                    else if (frame.type === FrameType.Resize)
+                        this.resizes.push(frame.payload);
+                    else if (frame.type === FrameType.Ping)
+                        this.pings++;
+                }
+            });
+        });
+    }
+    start() {
+        return new Promise((resolve) => this.server.listen(0, '127.0.0.1', () => {
+            this.port = this.server.address().port;
+            resolve();
+        }));
+    }
+    stop() {
+        this.server.close();
+        for (const socket of this.open)
+            socket.destroy();
+    }
+}
+/** What a browser tab sees on the terminal socket. */
+class Tab {
+    texts = [];
+    binary = [];
+    closeCode = null;
+    opened = false;
+    failed = false;
+    socket;
+    constructor(url, headers) {
+        this.socket = new WebSocket(url, { headers });
+        this.socket.on('open', () => (this.opened = true));
+        this.socket.on('unexpected-response', () => (this.failed = true));
+        this.socket.on('error', () => (this.failed = true));
+        this.socket.on('message', (data, isBinary) => {
+            if (isBinary)
+                this.binary.push(data);
+            else
+                this.texts.push(data.toString('utf8'));
+        });
+        this.socket.on('close', (code) => (this.closeCode = code));
+    }
+}
+const session = (id, attach) => ({
+    id,
+    launchId: 'launch1',
+    harness: 'claude',
+    cwd: 'C:\\Projects\\app',
+    phase: 'running',
+    message: 'running\x1b[31m',
+    updatedAt: '2026-01-01T00:00:00.000Z',
+    startedAt: '2026-01-01T00:00:00.000Z',
+    ...(attach ? { attach } : {}),
+});
+export const webSuite = {
+    name: 'web',
+    title: 'web UI server: login, Host / Origin / CSRF checks, static files, sessions, terminal bridge',
+    run: async (t) => {
+        t.section('the token and the cookie');
+        t.check(sameSecret(TOKEN, TOKEN) && !sameSecret(TOKEN, 'b'.repeat(64)) && !sameSecret(TOKEN, ''), 'secrets compare');
+        let clock = 1000;
+        const auth = new WebAuth(TOKEN, () => clock);
+        const bad = auth.login('nope');
+        t.check(!bad.ok && bad.status === 401, 'a wrong token is refused');
+        t.check(!auth.login(42).ok && !auth.login({}).ok, 'a token that is not text is refused');
+        const good = auth.login(TOKEN);
+        t.check(good.ok, 'the right token logs in');
+        const cookie = good.ok ? good.cookie : '';
+        t.check(auth.signedIn('x=1; sbxweb=' + cookie), 'the cookie signs in');
+        t.check(!auth.signedIn('sbxweb=' + cookie.replace(/.$/, '0')) && !auth.signedIn(undefined), 'another cookie does not');
+        clock += 13 * 60 * 60 * 1000;
+        t.check(!auth.signedIn('sbxweb=' + cookie), 'a cookie unused for 12 hours expires');
+        const limited = new WebAuth(TOKEN, () => clock);
+        for (let i = 0; i < 8; i++)
+            limited.login('wrong');
+        const locked = limited.login(TOKEN);
+        t.check(!locked.ok && locked.status === 429, 'too many wrong tokens lock logging in, even for the right one');
+        clock += 61 * 1000;
+        t.check(limited.login(TOKEN).ok, 'the lock ends after a minute');
+        t.equal(cookieValue('a=1; sbxweb=abc; b=2'), 'abc', 'the cookie is found among others');
+        t.section('Host, Origin and CSRF checks');
+        t.check(hostAllowed('127.0.0.1:47800', 47800) && hostAllowed('localhost:47800', 47800), 'loopback names are allowed');
+        t.check(!hostAllowed('evil.example:47800', 47800) &&
+            !hostAllowed('127.0.0.1:1', 47800) &&
+            !hostAllowed(undefined, 47800) &&
+            !hostAllowed('127.0.0.1.evil.example:47800', 47800), 'any other Host is refused (DNS rebinding)');
+        t.check(originAllowed('http://127.0.0.1:47800', '127.0.0.1:47800', 47800) &&
+            !originAllowed('http://evil.example', '127.0.0.1:47800', 47800) &&
+            !originAllowed(undefined, '127.0.0.1:47800', 47800) &&
+            !originAllowed('http://localhost:47800', '127.0.0.1:47800', 47800), 'the Origin must be the page itself');
+        t.check(csrfOk({ [CSRF_HEADER]: CSRF_VALUE }) && !csrfOk({}) && !csrfOk({ [CSRF_HEADER]: '0' }), 'the CSRF header');
+        t.section('browser messages');
+        t.check(parseClientMessage('{"t":"resize","cols":80,"rows":24}')?.t === 'resize', 'a resize is read');
+        t.check([
+            'nope',
+            '{"t":"resize","cols":0,"rows":24}',
+            '{"t":"resize","cols":80.5,"rows":24}',
+            '{"t":"resize","cols":80,"rows":99999}',
+            '{"t":"input","data":"x"}',
+            'null',
+        ].every((m) => parseClientMessage(m) === null), 'garbage, odd numbers and unknown kinds are refused');
+        t.section('static files');
+        const root = t.dir('web-root');
+        t.write(path.join(root, 'index.html'), '<!doctype html><title>x</title>');
+        t.write(path.join(root, 'main-ABCD1234.js'), 'console.log(1)');
+        t.write(path.join(root, 'notes.exe'), 'MZ');
+        t.write(path.join(t.temp, 'secret.txt'), 'TOP SECRET');
+        const files = new StaticFiles(root);
+        t.check(files.find('/')?.type.startsWith('text/html') === true, '/ is the app');
+        t.check(files.find('/main-ABCD1234.js')?.immutable === true, 'a hashed file may be cached for good');
+        t.check(files.find('/some/page')?.file === path.join(root, 'index.html'), 'a page of the app is the app');
+        t.check([
+            '/../secret.txt',
+            '/%2e%2e/secret.txt',
+            '/a/../../secret.txt',
+            '/..%2fsecret.txt',
+            '/..\\secret.txt',
+            '/x%00.js',
+        ].every((p) => files.find(p) === null), 'paths that leave the folder find nothing');
+        t.check(files.find('/notes.exe') === null && files.find('/missing.js') === null, 'unknown types and missing files find nothing');
+        t.section('sessions never carry a token');
+        const attach = { addresses: ['127.0.0.1'], port: 1234, token: ATTACH_TOKEN };
+        const shown = JSON.stringify(webSession(session('s1', attach), 2));
+        t.excludes(shown, ATTACH_TOKEN, 'the attach token is not in what the browser gets');
+        t.excludes(shown, '1234', 'nor the port');
+        t.excludes(shown, '\x1b', 'text from the sandbox is made safe');
+        t.section('the server');
+        const fake = new FakePtyHost();
+        await fake.start();
+        const endpoint = { addresses: ['127.0.0.1'], port: fake.port, token: ATTACH_TOKEN };
+        const listed = webSession(session('abc123'), 0);
+        const created = [];
+        const backend = {
+            info: () => Promise.resolve({
+                sandbox: 'running',
+                owner: null,
+                canUse: true,
+                harnesses: ['claude'],
+                defaultHarness: 'claude',
+                projects: [],
+            }),
+            sessions: () => Promise.resolve([listed]),
+            endpoint: (id) => (id === 'abc123' ? endpoint : null),
+            create: (request) => {
+                created.push(request);
+                return Promise.resolve(listed);
+            },
+        };
+        let stopped = false;
+        const server = new WebServer({ port: 0, token: TOKEN, backend, staticRoot: root, onStop: () => (stopped = true) });
+        await server.start();
+        const { port } = server;
+        const origin = 'http://127.0.0.1:' + port;
+        const json = { 'Content-Type': 'application/json' };
+        const ajax = { ...json, Origin: origin, [CSRF_HEADER]: CSRF_VALUE };
+        try {
+            const page = await send(port, 'GET', '/');
+            t.check(page.status === 200 && page.headers['content-type']?.startsWith('text/html') === true, 'the app is served');
+            t.includes(String(page.headers['content-security-policy']), "script-src 'self'", 'the page has a CSP without inline scripts');
+            t.check(!String(page.headers['content-security-policy']).includes("script-src 'self' 'unsafe-inline'") &&
+                page.headers['x-content-type-options'] === 'nosniff' &&
+                page.headers['x-frame-options'] === 'DENY', 'and the other protective headers');
+            t.equal((await send(port, 'GET', '/', { Host: 'evil.example:' + port })).status, 421, 'a foreign Host name is refused');
+            t.equal((await send(port, 'GET', '/..%2f..%2fsecret.txt')).status, 404, 'a path out of the folder is a 404');
+            t.equal((await send(port, 'GET', '/%2e%2e/secret.txt')).status, 404, 'an encoded path out of the folder is a 404');
+            t.equal((await send(port, 'POST', '/', {}, 'x')).status, 405, 'the files take only GET');
+            t.equal((await send(port, 'GET', '/api/sessions')).status, 401, 'the API needs the login');
+            t.equal((await send(port, 'GET', '/api/health')).status, 200, 'health needs none');
+            const noCsrf = await send(port, 'POST', '/api/login', { ...json, Origin: origin }, JSON.stringify({ token: TOKEN }));
+            t.equal(noCsrf.status, 403, 'login without the CSRF header is refused');
+            const foreign = await send(port, 'POST', '/api/login', { ...ajax, Origin: 'http://evil.example' }, JSON.stringify({ token: TOKEN }));
+            t.equal(foreign.status, 403, 'login from another origin is refused');
+            const noOrigin = await send(port, 'POST', '/api/login', { ...json, [CSRF_HEADER]: CSRF_VALUE }, JSON.stringify({ token: TOKEN }));
+            t.equal(noOrigin.status, 403, 'login without an Origin is refused');
+            t.equal((await send(port, 'POST', '/api/login', ajax, JSON.stringify({ token: 'wrong' }))).status, 401, 'a wrong token');
+            t.equal((await send(port, 'POST', '/api/login', { ...ajax, 'Content-Type': 'text/plain' }, '{}')).status, 415, 'JSON only');
+            const login = await send(port, 'POST', '/api/login', ajax, JSON.stringify({ token: TOKEN }));
+            const setCookie = String(login.headers['set-cookie']?.[0] ?? '');
+            t.check(login.status === 200 && /HttpOnly/.test(setCookie) && /SameSite=Strict/.test(setCookie), 'the right token gets a safe cookie');
+            const Cookie = setCookie.split(';')[0];
+            const list = await send(port, 'GET', '/api/sessions', { Cookie });
+            t.check(list.status === 200 && JSON.parse(list.body).length === 1, 'a signed-in browser lists sessions');
+            t.excludes(list.body, ATTACH_TOKEN, 'the list has no attach token');
+            t.equal((await send(port, 'GET', '/api/info', { Cookie })).status, 200, 'and reads the info');
+            t.equal((await send(port, 'POST', '/api/sessions', { ...json, Cookie }, '{}')).status, 403, 'a new session needs CSRF and Origin');
+            t.equal((await send(port, 'POST', '/api/sessions', { ...ajax, Cookie }, '{"harness":"../x","project":"p"}')).status, 400, 'odd names are refused');
+            const made = await send(port, 'POST', '/api/sessions', { ...ajax, Cookie }, '{"harness":"claude","project":"app"}');
+            t.check(made.status === 201 && created.length === 1, 'a new session is requested');
+            t.section('the terminal bridge');
+            const url = 'ws://127.0.0.1:' + port + '/api/sessions/abc123/terminal?cols=100&rows=40';
+            const attempts = [
+                new Tab(url, { Cookie }),
+                new Tab(url, { Origin: 'http://evil.example', Cookie }),
+                new Tab(url, { Origin: origin }),
+                new Tab('ws://127.0.0.1:' + port + '/api/sessions/nosuch/terminal', { Origin: origin, Cookie }),
+            ];
+            await t.waitFor(() => attempts.every((a) => a.failed), 5000);
+            t.check(attempts.every((a) => !a.opened && a.failed), 'no Origin, a foreign Origin, no cookie and an unknown session are all refused');
+            t.check(fake.hellos.length === 0, 'and the session was never contacted');
+            const tab = new Tab(url, { Origin: origin, Cookie });
+            await t.waitFor(() => tab.binary.length > 0, 5000);
+            t.check(tab.texts.includes('{"t":"ready"}'), 'the browser is told when it is connected');
+            const hello = fake.hellos[0];
+            t.check(hello !== undefined &&
+                hello.readInt16LE(0) === 100 &&
+                hello.readInt16LE(2) === 40 &&
+                hello.subarray(5).toString() === ATTACH_TOKEN, 'HELLO carries the attach token and the size');
+            const output = Buffer.concat(tab.binary).toString();
+            t.check(output.includes('hello ') && output.includes('world'), 'output is relayed as binary');
+            t.excludes(output, ']52', 'and a clipboard write (OSC 52) in it is dropped');
+            tab.socket.send(Buffer.from('abc'));
+            tab.socket.send(JSON.stringify({ t: 'resize', cols: 90, rows: 30 }));
+            await t.waitFor(() => fake.inputs.length > 0 && fake.resizes.length > 0, 5000);
+            t.check(fake.inputs[0]?.toString() === 'abc', 'keystrokes are forwarded as INPUT');
+            t.check(fake.resizes[0]?.readInt16LE(0) === 90 && fake.resizes[0]?.readInt16LE(2) === 30, 'a resize is forwarded');
+            tab.socket.send(Buffer.from('x'));
+            await t.waitFor(() => tab.closeCode !== null, 5000);
+            t.check(tab.texts.includes('{"t":"exit","code":3}'), 'EXIT reaches the browser with its code');
+            t.equal(tab.closeCode, 1000, 'and the socket closes cleanly');
+            const rude = new Tab(url, { Origin: origin, Cookie });
+            await t.waitFor(() => rude.binary.length > 0, 5000);
+            rude.socket.send('this is not json');
+            await t.waitFor(() => rude.closeCode !== null, 5000);
+            t.equal(rude.closeCode, 1008, 'a browser that sends garbage is closed');
+            const leaving = new Tab(url, { Origin: origin, Cookie });
+            await t.waitFor(() => leaving.binary.length > 0, 5000);
+            leaving.socket.close();
+            await t.waitFor(() => fake.closed >= 3, 5000);
+            t.check(fake.closed >= 3, 'closing the browser side closes the connection to the session');
+            t.section('stopping');
+            t.equal((await send(port, 'POST', '/api/stop', { ...json, Cookie }, '{}')).status, 403, 'stop needs CSRF and Origin too');
+            t.equal((await send(port, 'POST', '/api/stop', { ...ajax, Cookie }, '{}')).status, 200, 'a signed-in browser can stop it');
+            await t.waitFor(() => stopped, 3000);
+            t.check(stopped, 'the server is told to stop');
+        }
+        finally {
+            await server.stop();
+            fake.stop();
+        }
+        t.section('the state file');
+        const store = new WebStore(t.dir('web-state'), () => undefined);
+        store.write({ pid: 1234, port: 47800, token: TOKEN, startedAt: '2026-01-01T00:00:00.000Z' });
+        t.equal(store.read()?.port, 47800, 'pid, port and token are kept');
+        t.write(path.join(store.dir, 'server.json'), '{"pid":1,"port":1,"token":"short","startedAt":"x"}');
+        t.check(store.read() === null, 'a state file that does not fit the schema is ignored');
+        store.clear();
+        t.check(store.read() === null, 'and it can be removed');
+    },
+};