windows-development-sandbox 1.5.0 → 1.7.0

package/dist/guest/agents/local-state.js

@@ -0,0 +1,198 @@
+// Agents that keep SQLite databases (codex ...): SQLite cannot map its shared memory in a mapped folder (error 8714,
+// "disk I/O error"), so they run from a copy on the sandbox's own disk. The copy comes from persistent storage at boot
+// and goes back when no agent process holds the files, so the data lives on between sandboxes.
+import fs from 'node:fs';
+import path from 'node:path';
+import { SYSTEM } from '../../shared/system.js';
+import { dryRun, isWin, localDir } from '../runtime/paths.js';
+import { exists, mkdirp } from '../runtime/fs.js';
+import { execOutput } from '../runtime/process.js';
+import { log, warn } from '../runtime/log.js';
+import { session, stateDir } from '../runtime/session.js';
+import { errMsg } from '../../core/util/errors.js';
+import { isCopyableDatabaseFile, isDatabaseFile, localStateEntries } from './agent-files.js';
+const SQLITE_HEADER = 'SQLite format 3\0';
+/** The sandbox-disk folder that holds the working copies. */
+const localRoot = () => path.join(localDir, 'agent-state');
+/** Every SQLite folder of every configured agent (none in launch folders that predate the agents list). */
+export function agentLocalStates() {
+    return localStateEntries(session.agents ?? {}, stateDir, localRoot());
+}
+/** Variable -> working folder, for the agent environment (and the machine environment of new terminal tabs). */
+export function localStateVars() {
+    return Object.fromEntries(agentLocalStates().map((s) => [s.env, s.local]));
+}
+const databaseFiles = (dir, keep) => exists(dir)
+    ? fs.readdirSync(dir, { withFileTypes: true }).flatMap((e) => (e.isFile() && keep(e.name) ? [e.name] : []))
+    : [];
+/** A database file that starts like SQLite (an empty or cut-off file must never replace a saved copy). */
+const looksLikeSqlite = (file) => {
+    const fd = fs.openSync(file, 'r');
+    try {
+        const head = Buffer.alloc(16);
+        return fs.readSync(fd, head, 0, 16, 0) === 16 && head.toString('latin1') === SQLITE_HEADER;
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+};
+const copyFiles = (from, to, names) => {
+    fs.rmSync(to, { recursive: true, force: true });
+    mkdirp(to);
+    for (const name of names)
+        fs.copyFileSync(path.join(from, name), path.join(to, name));
+};
+/** Replaces the folder `store` with the staged `incoming` folder; the old one is only removed once the new is in. */
+const swapIn = (incoming, store) => {
+    const previous = store + '.previous';
+    fs.rmSync(previous, { recursive: true, force: true });
+    if (exists(store))
+        fs.renameSync(store, previous);
+    try {
+        fs.renameSync(incoming, store);
+    }
+    catch (e) {
+        if (exists(previous))
+            fs.renameSync(previous, store);
+        throw e;
+    }
+    fs.rmSync(previous, { recursive: true, force: true });
+};
+/**
+ * Databases an agent kept in its state folder before (codex: state_5.sqlite ...) move into the saved copy. The
+ * originals
+ * go only after the copy is in place and has the same sizes.
+ */
+function adoptLegacy(s) {
+    if (exists(s.store))
+        return;
+    const names = databaseFiles(s.legacy, isDatabaseFile);
+    if (!names.length)
+        return;
+    const copyable = names.filter(isCopyableDatabaseFile);
+    const incoming = s.store + '.incoming';
+    copyFiles(s.legacy, incoming, copyable);
+    swapIn(incoming, s.store);
+    const same = copyable.every((n) => fs.statSync(path.join(s.store, n)).size === fs.statSync(path.join(s.legacy, n)).size);
+    if (!same) {
+        warn(s.agent + ': the copied databases differ in size from the originals; the originals were kept.');
+        return;
+    }
+    for (const n of names)
+        fs.rmSync(path.join(s.legacy, n), { force: true });
+    log(s.agent + ': moved ' + copyable.length + ' database file(s) to ' + s.store + '.');
+}
+/** Boot: the saved databases of every configured agent are copied to the sandbox's disk, where the agent runs them. */
+export function restoreLocalState() {
+    if (dryRun)
+        return;
+    for (const s of agentLocalStates()) {
+        try {
+            adoptLegacy(s);
+            mkdirp(s.local);
+            const names = databaseFiles(s.store, isCopyableDatabaseFile);
+            for (const n of names)
+                fs.copyFileSync(path.join(s.store, n), path.join(s.local, n));
+            if (names.length)
+                log(s.agent + ': databases restored to ' + s.local + '.');
+        }
+        catch (e) {
+            warn(s.agent + ': could not restore its databases (' + errMsg(e) + '); it starts with empty ones.');
+        }
+    }
+}
+/** True while one of the programs that open the databases runs. */
+function held(s) {
+    if (!isWin)
+        return false;
+    return s.processes.some((image) => execOutput(SYSTEM.tasklist(), ['/FI', 'IMAGENAME eq ' + image, '/NH', '/FO', 'CSV'])
+        .toLowerCase()
+        .includes(image.toLowerCase()));
+}
+const fingerprint = (dir) => databaseFiles(dir, isCopyableDatabaseFile)
+    .sort()
+    .map((n) => {
+    const st = fs.statSync(path.join(dir, n));
+    return n + ':' + st.size + ':' + st.mtimeMs;
+})
+    .join('|');
+/** The working copies as of the last save by this process. */
+const saved = new Map();
+/** Snapshots in progress (one per working folder) and whether the missing online backup was said already. */
+const snapshotting = new Set();
+let saidNoBackup = false;
+/**
+ * While the agent runs its databases are never copied as files (the -wal and the database would not match): SQLite's
+ * online backup writes a consistent snapshot into the staging folder, which is then swapped in. Needs node:sqlite
+ * (newer Node); without it the save waits until the agent has exited.
+ */
+function snapshotWhileRunning(s, print) {
+    if (snapshotting.has(s.local))
+        return;
+    snapshotting.add(s.local);
+    void (async () => {
+        try {
+            const sqlite = await import('node:sqlite').catch(() => null);
+            if (!sqlite || typeof sqlite.backup !== 'function') {
+                if (!saidNoBackup)
+                    log(s.agent + ': this Node has no SQLite online backup; its databases are saved when it exits.');
+                saidNoBackup = true;
+                return;
+            }
+            const incoming = s.store + '.incoming';
+            fs.rmSync(incoming, { recursive: true, force: true });
+            mkdirp(incoming);
+            for (const name of databaseFiles(s.local, (n) => isCopyableDatabaseFile(n) && !/-wal$/i.test(n))) {
+                const db = new sqlite.DatabaseSync(path.join(s.local, name), { readOnly: true });
+                try {
+                    await sqlite.backup(db, path.join(incoming, name));
+                }
+                finally {
+                    db.close();
+                }
+            }
+            swapIn(incoming, s.store);
+            saved.set(s.local, print);
+        }
+        catch (e) {
+            warn(s.agent + ': could not snapshot its running databases: ' + errMsg(e));
+        }
+        finally {
+            snapshotting.delete(s.local);
+        }
+    })();
+}
+/**
+ * Copies the working databases back to persistent storage (staging folder + swap). While the agent runs they are
+ * snapshotted with SQLite's online backup instead (see snapshotWhileRunning); nothing is done when nothing changed.
+ */
+export function saveLocalState() {
+    if (dryRun)
+        return;
+    for (const s of agentLocalStates()) {
+        try {
+            if (!exists(s.local))
+                continue;
+            const print = fingerprint(s.local);
+            if (!print || (saved.get(s.local) === print && exists(s.store)))
+                continue;
+            if (held(s)) {
+                snapshotWhileRunning(s, print);
+                continue;
+            }
+            const names = databaseFiles(s.local, isCopyableDatabaseFile);
+            const bad = names.filter((n) => !/-wal$/i.test(n) && !looksLikeSqlite(path.join(s.local, n)));
+            if (bad.length) {
+                warn(s.agent + ': ' + bad.join(', ') + ' do not look like SQLite databases, so they were not saved.');
+                continue;
+            }
+            const incoming = s.store + '.incoming';
+            copyFiles(s.local, incoming, names);
+            swapIn(incoming, s.store);
+            saved.set(s.local, print);
+        }
+        catch (e) {
+            warn(s.agent + ': could not save its databases: ' + errMsg(e));
+        }
+    }
+}

package/dist/guest/agents/sbx-agent.d.ts

@@ -0,0 +1,2 @@
+/** Runs one sbx-agent command; returns the exit code. Prints, as the command line tool it is. */
+export declare function runSbxAgent(argv: readonly string[]): Promise<number>;

package/dist/guest/agents/sbx-agent.js

@@ -0,0 +1,35 @@
+// `sbx-agent`: install a configured agent from a terminal inside the sandbox (the agent commands call it the first
+// time). Usage: sbx-agent list | sbx-agent install <agent>
+import { agents } from './agent-installer.js';
+import { agentCommand, agentPaths } from './agent-files.js';
+import { toolsDir } from '../runtime/paths.js';
+import { exists } from '../runtime/fs.js';
+import { session } from '../runtime/session.js';
+/** Runs one sbx-agent command; returns the exit code. Prints, as the command line tool it is. */
+export async function runSbxAgent(argv) {
+    const known = session.agents ?? {};
+    const [verb, name] = argv;
+    if (verb === 'list' || verb === undefined) {
+        for (const [agent, harness] of Object.entries(known)) {
+            const p = agentPaths(toolsDir, agent, harness);
+            const installed = (p.exe !== null && exists(p.exe)) || (p.cmd !== null && exists(p.cmd));
+            console.log(agentCommand(agent, harness).padEnd(14) + (installed ? 'installed' : 'not installed yet'));
+        }
+        return 0;
+    }
+    const harness = verb === 'install' && name ? known[name] : undefined;
+    if (!harness) {
+        console.error(verb === 'install' && name
+            ? 'Unknown agent "' + name + '". Configured agents: ' + Object.keys(known).join(', ')
+            : 'Usage: sbx-agent list | sbx-agent install <agent>');
+        return 1;
+    }
+    try {
+        await agents.provision(name, harness, process.env, false);
+    }
+    catch (e) {
+        console.error('Could not install ' + name + ': ' + (e instanceof Error ? e.message : String(e)));
+        return 1;
+    }
+    return 0;
+}

package/dist/guest/boot/boot.d.ts

@@ -3,11 +3,15 @@ export declare class Boot {
     private ptyHost;
     private lan;
     private readonly gitAccess;
+    /** What the host handed over in its one-shot file (read and deleted at the start of run()). */
+    private secrets;
     run(): Promise<void>;
     private networkAndSessionHost;
     private hooksAndDesktop;
     /** Toolchains, databases, apps, the network proxy and VS Code; then the agent environment, saved machine-wide. */
     private developerTools;
+    /** vpn.enabled: the tunnel and its kill switch, before anything else uses the network (git, the agent). */
+    private vpn;
     private gitIdentity;
     private claude;
     private agent;

package/dist/guest/boot/boot.js

@@ -5,6 +5,9 @@ import { spawn } from 'node:child_process';
 import { writeGuides } from './guide.js';
 import { setupToolchains } from '../toolchains/index.js';
 import { agents } from '../agents/agent-installer.js';
+import { agentShims, sbxAgentText, shimText } from '../agents/agent-files.js';
+import { restoreLocalState } from '../agents/local-state.js';
+import { installShellPath } from '../setup/shell-path.js';
 import { linkProfileDirs } from '../agents/profile-links.js';
 import { restoreClaudeMem } from '../setup/claude-mem.js';
 import { syncClaudeProfile } from '../setup/claude-profile.js';
@@ -20,6 +23,7 @@ import { pruneToolLeftovers } from '../toolchains/leftovers.js';
 import { wanted } from '../toolchains/detect.js';
 import { configureVscode } from '../toolchains/tools/vscode.js';
 import { enableProcessAudit } from '../audit/process-audit.js';
+import { setupVpn } from '../vpn/index.js';
 import { now } from '../../shared/channel/run-dir.js';
 import { writeJsonAtomic } from '../../shared/io/json.js';
 import { viewSession } from '../sessions/viewer.js';
@@ -29,9 +33,10 @@ import { dryRun, isWin, localDir, logsDir, run, toolsDir } from '../runtime/path
 import { log, logPath, warn } from '../runtime/log.js';
 import { mkdirp } from '../runtime/fs.js';
 import { session, workspace } from '../runtime/session.js';
+import { applyBootEnvironment, BOOT_SECRETS_VARIABLE, takeSecrets } from '../runtime/secrets.js';
 import { setSandboxStatus } from '../runtime/status.js';
 import { errMsg } from '../../core/util/errors.js';
-const STEPS = 8;
+const STEPS = 9;
 const PRIMARY_POLLS = 600;
 const POLL_MS = 500;
 const VSCODE_LANGUAGES = ['python', 'java', 'go', 'rust', 'cpp', 'msvc', 'dotnet', 'ruby', 'php', 'deno', 'pwsh'];
@@ -56,12 +61,19 @@ async function soft(what, work) {
         warn(what + ' failed (continuing): ' + errMsg(e));
     }
 }
-function startDaemon(env) {
+function startDaemon(env, secrets) {
     spawn(process.execPath, [path.join(path.dirname(process.argv[1]), 'daemon.js')], {
         detached: true,
         stdio: 'ignore',
         windowsHide: true,
-        env: { ...env, AGENT_LOG_PREFIX: 'daemon' },
+        env: {
+            ...env,
+            AGENT_LOG_PREFIX: 'daemon',
+            // The agent's environment (it may hold API keys): the daemon moves it into memory and removes this at once.
+            ...(secrets.harnessEnvironment
+                ? { [BOOT_SECRETS_VARIABLE]: JSON.stringify({ harnessEnvironment: secrets.harnessEnvironment }) }
+                : {}),
+        },
     }).unref();
 }
 /**
@@ -72,8 +84,19 @@ function writeDbCommand() {
     const dir = mkdirp(path.join(localDir, 'bin'));
     const db = path.join(path.dirname(process.argv[1]), 'db.js');
     fs.writeFileSync(path.join(dir, 'sbx-db.cmd'), '@setlocal\r\n@set AGENT_LOG_PREFIX=db\r\n@"' + process.execPath + '" "' + db + '" %*\r\n');
+    writeAgentCommands(dir);
     return dir;
 }
+/**
+ * `claude`, `codex` ... by name in every terminal tab, installed yet or not (the command installs the agent on first
+ * use), and `sbx-agent`. Written to the sandbox's disk each boot, next to `sbx-db`.
+ */
+function writeAgentCommands(dir) {
+    const install = { node: process.execPath, script: path.join(path.dirname(process.argv[1]), 'agent.js') };
+    for (const shim of agentShims(toolsDir, session.agents ?? {}))
+        fs.writeFileSync(path.join(dir, shim.command + '.cmd'), shimText(shim, install));
+    fs.writeFileSync(path.join(dir, 'sbx-agent.cmd'), sbxAgentText(install));
+}
 async function waitForPrimary() {
     for (let i = 0; i < PRIMARY_POLLS; i++) {
         const s = run.readSession(session.launchId);
@@ -97,6 +120,8 @@ export class Boot {
     ptyHost = null;
     lan = session.networking ? 'open' : 'offline';
     gitAccess = session.provisioning.git.access ?? 'full';
+    /** What the host handed over in its one-shot file (read and deleted at the start of run()). */
+    secrets = {};
     async run() {
         log('Agent sandbox: ' +
             session.project +
@@ -110,9 +135,12 @@ export class Boot {
             throw new Error('Workspace folder is missing in the sandbox: ' + workspace);
         mkdirp(toolsDir);
         mkdirp(run.root);
+        this.secrets = takeSecrets(session.launchId);
+        applyBootEnvironment(this.secrets.harnessEnvironment);
         await this.networkAndSessionHost();
         await this.hooksAndDesktop();
         const { tools, env } = await this.developerTools();
+        await this.vpn();
         await this.gitIdentity(env);
         await this.claude(tools);
         await this.agent(env);
@@ -165,6 +193,7 @@ export class Boot {
             }));
         const env = agentEnv(tools);
         persistEnvironment(env, Object.keys(tools.vars));
+        await soft('Shell start-up PATH', installShellPath);
         saveBootEnv({
             basePath,
             toolVars: Object.keys(tools.vars),
@@ -178,36 +207,46 @@ export class Boot {
         await soft('Cleaning old tool builds', () => pruneToolLeftovers());
         return { tools, env };
     }
+    /** vpn.enabled: the tunnel and its kill switch, before anything else uses the network (git, the agent). */
+    async vpn() {
+        step(4, session.vpn ? 'VPN (' + session.vpn.server + ')' : 'VPN (off)');
+        if (!session.vpn)
+            return;
+        await soft('VPN', async () => {
+            await setupVpn(this.secrets, this.ptyHost);
+        });
+    }
     async gitIdentity(env) {
-        step(4, 'Git identity');
+        step(5, 'Git identity');
         await soft('Git config', () => setupGitConfig(env));
     }
     async claude(tools) {
-        step(5, 'Claude settings, history and claude-mem');
+        step(6, 'Claude settings, history and claude-mem');
         if (session.harnessName === 'claude')
-            await soft('Claude settings', syncClaudeProfile);
+            await soft('Claude settings', () => syncClaudeProfile(this.secrets.claudeCredentials));
         await soft('claude-mem restore', restoreClaudeMem);
+        await soft('Agent databases restore', restoreLocalState);
         await soft('Sandbox guide for the agent', () => writeGuides(tools.summary, this.lan));
         await soft('Claude managed settings', () => writeManagedSettings(this.gitAccess));
     }
     async agent(env) {
-        step(6, 'Agent: ' + session.harnessName);
+        step(7, 'Agent: ' + session.harnessName);
         linkProfileDirs(session.agentProfileDirs ?? {});
         if (session.harness)
             await agents.provision(session.harnessName, session.harness, env);
     }
     preAgentHooks(env) {
-        step(7, 'Pre-agent hooks');
+        step(8, 'Pre-agent hooks');
         runHooks('pre-agent', env);
     }
     /** Ready: starts the session daemon and, with an agent, its first session, shown in this window. */
     async start(env) {
-        step(8, 'Starting ' + session.harnessName);
+        step(9, 'Starting ' + session.harnessName);
         setSandboxStatus('ready', 'Ready');
         // No agent, or a restart that adds a project (the host opens its sessions itself once the sandbox is ready).
         if (!session.harness || session.autoSession === false) {
             if (!dryRun)
-                startDaemon(env);
+                startDaemon(env, this.secrets);
             log('Ready' + (session.harness ? '' : ' (no agent requested)') + '. Workspace: ' + workspace);
             return;
         }
@@ -220,7 +259,7 @@ export class Boot {
             runHooks('post-agent', env);
             return;
         }
-        startDaemon(env);
+        startDaemon(env, this.secrets);
         writeJsonAtomic(run.requestFile(session.launchId), {
             kind: 'session',
             id: session.launchId,

package/dist/guest/daemon/daemon.js

@@ -1,10 +1,12 @@
 // The session daemon's polling loop: claims each valid request in run\requests and hands it to its handler.
 import fs from 'node:fs';
 import { saveClaudeMem } from '../setup/claude-mem.js';
+import { saveLocalState } from '../agents/local-state.js';
 import { execCommand } from './exec.js';
 import { sessions } from './sessions.js';
 import { respond, safely } from './state.js';
 import { run } from '../runtime/paths.js';
+import { withRequestSecrets } from '../runtime/secrets.js';
 import { warn } from '../runtime/log.js';
 import { errMsg } from '../../core/util/errors.js';
 const POLL_MS = 400;
@@ -33,11 +35,12 @@ export class Daemon {
             if (run.readSession(req.id))
                 continue;
             // Not awaited: starting a session or running a command must not hold up other requests.
-            void Promise.resolve(this.handle(req)).catch((e) => respond(req.id, { ok: false, message: errMsg(e) }));
+            void Promise.resolve(this.handle(withRequestSecrets(req))).catch((e) => respond(req.id, { ok: false, message: errMsg(e) }));
         }
         if (Date.now() - this.lastMemSave > MEM_SAVE_MS) {
             this.lastMemSave = Date.now();
             safely('claude-mem save', saveClaudeMem);
+            safely('agent databases save', saveLocalState);
         }
     }
     handle(req) {

package/dist/guest/daemon/exec.js

@@ -2,6 +2,7 @@
 import { spawn } from 'node:child_process';
 import { SYSTEM } from '../../shared/system.js';
 import { exists } from '../runtime/fs.js';
+import { withRegistryPath } from '../setup/environment.js';
 import { errMsg } from '../../core/util/errors.js';
 import { provisioner } from './project-provisioner.js';
 import { insideWorkspace, respond } from './state.js';
@@ -20,7 +21,7 @@ export function execCommand(req) {
     }
     // chcp 65001 first: console programs then write UTF-8 (not the OEM code page) into the pipes.
     // In a project registered after boot, its own environment (its Node, Python, database variables).
-    const env = provisioner.provisionedFor(req.cwd)?.env ?? process.env;
+    const env = withRegistryPath(provisioner.provisionedFor(req.cwd)?.env ?? process.env);
     const child = spawn(SYSTEM.cmd(), ['/d', '/s', '/c', '"chcp 65001>nul & ' + req.command.map(quoteForCmd).join(' ') + '"'], { cwd: req.cwd, env, windowsHide: true, windowsVerbatimArguments: true });
     const output = { stdout: '', stderr: '' };
     // setEncoding decodes across chunks: a multi-byte character split between two reads is not mangled.

package/dist/guest/daemon/idle-shutdown.js

@@ -2,6 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { SYSTEM } from '../../shared/system.js';
 import { saveClaudeMem } from '../setup/claude-mem.js';
+import { saveLocalState } from '../agents/local-state.js';
 import { isWin, run } from '../runtime/paths.js';
 import { log } from '../runtime/log.js';
 import { session } from '../runtime/session.js';
@@ -25,6 +26,7 @@ export class IdleShutdown {
                 return;
             log('Headless sandbox has no sessions left; shutting down.');
             safely('claude-mem save', saveClaudeMem);
+            safely('agent databases save', saveLocalState);
             spawnSync(SYSTEM.shutdown(), ['/s', '/t', '5'], { windowsHide: true });
         }, GRACE_MS);
     }

package/dist/guest/daemon/sessions.js

@@ -14,8 +14,10 @@ import { primaryProject } from '../boot/project-status.js';
 import { ensurePtyHost, ptyHostLogTail, startPtyHost, waitForPtyHost } from '../sessions/pty-host.js';
 import { agents } from '../agents/agent-installer.js';
 import { saveClaudeMem } from '../setup/claude-mem.js';
+import { saveLocalState } from '../agents/local-state.js';
 import { projectHooks, runHooks, runHooksAsync } from '../setup/hooks.js';
 import { guestAddresses } from '../network/addresses.js';
+import { withRegistryPath } from '../setup/environment.js';
 import { dataDir, toolsDir } from '../runtime/paths.js';
 import { exists } from '../runtime/fs.js';
 import { log, warn } from '../runtime/log.js';
@@ -64,7 +66,7 @@ const launchPtyHost = async (req, remote, env, say) => {
         rows: 32,
         id: req.id,
         cwd: req.cwd,
-        env: { ...env, ...harness.environment },
+        env: { ...withRegistryPath(env), ...harness.environment },
         remote,
         command: commandLine(launch.file, [...base, ...req.args]),
         restartCommand: commandLine(launch.file, [...base, ...(harness.resumeArguments ?? [])]),
@@ -257,6 +259,7 @@ export class SessionManager {
         else
             safely('post-agent hooks', () => runHooks('post-agent', process.env));
         safely('claude-mem save', saveClaudeMem);
+        safely('agent databases save', saveLocalState);
         this.idle.check();
     }
 }

package/dist/guest/entries/agent.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/guest/entries/agent.js

@@ -0,0 +1,10 @@
+// `sbx-agent`: list agents and install a configured one inside the sandbox. Usage: sbx-agent list | install <agent>
+import { dropInheritedModulePath } from '../../shared/system.js';
+import { runSbxAgent } from '../agents/sbx-agent.js';
+dropInheritedModulePath();
+runSbxAgent(process.argv.slice(2)).then((code) => {
+    process.exitCode = code;
+}, (e) => {
+    console.error(e instanceof Error ? e.message : String(e));
+    process.exitCode = 1;
+});

package/dist/guest/entries/daemon.js

@@ -6,10 +6,12 @@ import { startRelays } from '../daemon/relays.js';
 import { startProcessCollector } from '../audit/process-audit.js';
 import { safely } from '../daemon/state.js';
 import { log, warn } from '../runtime/log.js';
+import { adoptBootSecrets } from '../runtime/secrets.js';
 import { errMsg } from '../../core/util/errors.js';
 import { Daemon } from '../daemon/daemon.js';
 process.on('uncaughtException', (e) => warn('daemon: unexpected error (continuing): ' + (e.stack ?? errMsg(e))));
 process.on('unhandledRejection', (e) => warn('daemon: unexpected error (continuing): ' + errMsg(e)));
+adoptBootSecrets();
 log('Session daemon started (pid ' + process.pid + ').');
 safely('port forwards', startRelays);
 safely('audit', startProcessCollector);

package/dist/guest/runtime/csc.d.ts

@@ -6,6 +6,7 @@ declare const SOURCES: {
     readonly openssl: "OpenSsl.cs";
     readonly cargoshim: "CargoShim.cs";
     readonly linkgate: "LinkGate.cs";
+    readonly pathsync: "PathSync.cs";
 };
 export type Helper = keyof typeof SOURCES;
 /** %TEMP%\agent-sandbox\<name>-<hash>.exe, compiled from this launch's source the first time it is needed. */

package/dist/guest/runtime/csc.js

@@ -19,6 +19,7 @@ const SOURCES = {
     openssl: 'OpenSsl.cs',
     cargoshim: 'CargoShim.cs',
     linkgate: 'LinkGate.cs',
+    pathsync: 'PathSync.cs',
 };
 function sourceOf(name) {
     return path.join(launchDir, 'sandbox', 'csharp', SOURCES[name]);

package/dist/guest/runtime/secrets.d.ts

@@ -0,0 +1,12 @@
+import type { GuestRequest } from '../../core/types.js';
+import { type SecretsFile } from '../../shared/channel/secrets.js';
+/** Where the boot's secrets travel from main.js to the daemon. */
+export declare const BOOT_SECRETS_VARIABLE = "SBX_BOOT_SECRETS";
+/** Reads and deletes <data>\secrets\<id>.json; nothing (or an unreadable file) gives {}. */
+export declare function takeSecrets(id: string): SecretsFile;
+/** The agent the sandbox booted with gets its environment (in memory only). */
+export declare function applyBootEnvironment(environment: Record<string, string> | undefined): void;
+/** The daemon takes what main.js passed it, and removes it from its own environment before any session starts. */
+export declare function adoptBootSecrets(): void;
+/** A request with the agent environment values that travelled in its own secrets file put back (in memory only). */
+export declare function withRequestSecrets(req: GuestRequest): GuestRequest;

package/dist/guest/runtime/secrets.js

@@ -0,0 +1,63 @@
+// The one-shot secrets the host handed over (shared/channel/secrets.ts): read once, the file deleted at once. What the
+// boot read for the agent is passed to the daemon in its own environment (SBX_BOOT_SECRETS, removed there at start), so
+// nothing waits on disk.
+import fs from 'node:fs';
+import { mergeRequestSecrets, SecretsFileSchema } from '../../shared/channel/secrets.js';
+import { run } from './paths.js';
+import { warn } from './log.js';
+import { session } from './session.js';
+/** Where the boot's secrets travel from main.js to the daemon. */
+export const BOOT_SECRETS_VARIABLE = 'SBX_BOOT_SECRETS';
+const MAX_BYTES = 4 * 1024 * 1024;
+/** Reads and deletes <data>\secrets\<id>.json; nothing (or an unreadable file) gives {}. */
+export function takeSecrets(id) {
+    const file = run.secretFile(id);
+    let text;
+    try {
+        if (fs.statSync(file).size > MAX_BYTES)
+            throw new Error('too big');
+        text = fs.readFileSync(file, 'utf8').replace(/^\uFEFF/, '');
+    }
+    catch {
+        return {};
+    }
+    finally {
+        fs.rmSync(file, { force: true });
+    }
+    try {
+        const parsed = SecretsFileSchema.safeParse(JSON.parse(text));
+        if (parsed.success)
+            return parsed.data;
+    }
+    catch {
+        // Not JSON: treated like an invalid file below.
+    }
+    warn('The secrets file for ' + id + ' was not valid and was ignored.');
+    return {};
+}
+/** The agent the sandbox booted with gets its environment (in memory only). */
+export function applyBootEnvironment(environment) {
+    if (session.harness && environment)
+        session.harness.environment = { ...environment };
+}
+/** The daemon takes what main.js passed it, and removes it from its own environment before any session starts. */
+export function adoptBootSecrets() {
+    const text = process.env[BOOT_SECRETS_VARIABLE];
+    delete process.env[BOOT_SECRETS_VARIABLE];
+    if (!text)
+        return;
+    try {
+        const parsed = SecretsFileSchema.pick({ harnessEnvironment: true }).safeParse(JSON.parse(text));
+        if (parsed.success)
+            applyBootEnvironment(parsed.data.harnessEnvironment);
+    }
+    catch {
+        warn('The boot secrets given to the daemon were not valid.');
+    }
+}
+/** A request with the agent environment values that travelled in its own secrets file put back (in memory only). */
+export function withRequestSecrets(req) {
+    if (req.kind !== 'session' && req.kind !== 'project')
+        return req;
+    return mergeRequestSecrets(req, takeSecrets(req.id));
+}

package/dist/guest/setup/claude-profile.d.ts

@@ -4,4 +4,5 @@
  * Servers with the same name are replaced by this PC's definition; servers added inside the sandbox are kept.
  */
 export declare function mergeMcpServers(hostFile: string, guestFile: string, hostWorkspace: string, guestWorkspace: string): number;
-export declare function syncClaudeProfile(): void;
+/** `credentials`: the text of this PC's .credentials.json, handed over in the one-shot secrets file. */
+export declare function syncClaudeProfile(credentials?: string): void;