windows-development-sandbox 1.5.0 → 1.7.0

package/dist/runtime/db.js

@@ -1363,11 +1363,11 @@ var require_lodash = __commonJS({
             return isFunction(object2[key]);
           });
         }
-        function baseGet(object2, path22) {
-          path22 = castPath(path22, object2);
-          var index = 0, length = path22.length;
+        function baseGet(object2, path24) {
+          path24 = castPath(path24, object2);
+          var index = 0, length = path24.length;
           while (object2 != null && index < length) {
-            object2 = object2[toKey(path22[index++])];
+            object2 = object2[toKey(path24[index++])];
           }
           return index && index == length ? object2 : undefined2;
         }
@@ -1431,10 +1431,10 @@ var require_lodash = __commonJS({
           });
           return accumulator;
         }
-        function baseInvoke(object2, path22, args) {
-          path22 = castPath(path22, object2);
-          object2 = parent(object2, path22);
-          var func = object2 == null ? object2 : object2[toKey(last(path22))];
+        function baseInvoke(object2, path24, args) {
+          path24 = castPath(path24, object2);
+          object2 = parent(object2, path24);
+          var func = object2 == null ? object2 : object2[toKey(last(path24))];
           return func == null ? undefined2 : apply(func, object2, args);
         }
         function baseIsArguments(value) {
@@ -1590,13 +1590,13 @@ var require_lodash = __commonJS({
             return object2 === source || baseIsMatch(object2, source, matchData);
           };
         }
-        function baseMatchesProperty(path22, srcValue) {
-          if (isKey(path22) && isStrictComparable(srcValue)) {
-            return matchesStrictComparable(toKey(path22), srcValue);
+        function baseMatchesProperty(path24, srcValue) {
+          if (isKey(path24) && isStrictComparable(srcValue)) {
+            return matchesStrictComparable(toKey(path24), srcValue);
           }
           return function(object2) {
-            var objValue = get(object2, path22);
-            return objValue === undefined2 && objValue === srcValue ? hasIn(object2, path22) : baseIsEqual(srcValue, objValue, COMPARE_PARTIAL_FLAG | COMPARE_UNORDERED_FLAG);
+            var objValue = get(object2, path24);
+            return objValue === undefined2 && objValue === srcValue ? hasIn(object2, path24) : baseIsEqual(srcValue, objValue, COMPARE_PARTIAL_FLAG | COMPARE_UNORDERED_FLAG);
           };
         }
         function baseMerge(object2, source, srcIndex, customizer, stack) {
@@ -1693,23 +1693,23 @@ var require_lodash = __commonJS({
           });
         }
         function basePick(object2, paths) {
-          return basePickBy(object2, paths, function(value, path22) {
-            return hasIn(object2, path22);
+          return basePickBy(object2, paths, function(value, path24) {
+            return hasIn(object2, path24);
           });
         }
         function basePickBy(object2, paths, predicate) {
           var index = -1, length = paths.length, result2 = {};
           while (++index < length) {
-            var path22 = paths[index], value = baseGet(object2, path22);
-            if (predicate(value, path22)) {
-              baseSet(result2, castPath(path22, object2), value);
+            var path24 = paths[index], value = baseGet(object2, path24);
+            if (predicate(value, path24)) {
+              baseSet(result2, castPath(path24, object2), value);
             }
           }
           return result2;
         }
-        function basePropertyDeep(path22) {
+        function basePropertyDeep(path24) {
           return function(object2) {
-            return baseGet(object2, path22);
+            return baseGet(object2, path24);
           };
         }
         function basePullAll(array2, values2, iteratee2, comparator) {
@@ -1783,14 +1783,14 @@ var require_lodash = __commonJS({
           var array2 = values(collection);
           return shuffleSelf(array2, baseClamp(n, 0, array2.length));
         }
-        function baseSet(object2, path22, value, customizer) {
+        function baseSet(object2, path24, value, customizer) {
           if (!isObject2(object2)) {
             return object2;
           }
-          path22 = castPath(path22, object2);
-          var index = -1, length = path22.length, lastIndex = length - 1, nested = object2;
+          path24 = castPath(path24, object2);
+          var index = -1, length = path24.length, lastIndex = length - 1, nested = object2;
           while (nested != null && ++index < length) {
-            var key = toKey(path22[index]), newValue = value;
+            var key = toKey(path24[index]), newValue = value;
             if (key === "__proto__" || key === "constructor" || key === "prototype") {
               return object2;
             }
@@ -1798,7 +1798,7 @@ var require_lodash = __commonJS({
               var objValue = nested[key];
               newValue = customizer ? customizer(objValue, key, nested) : undefined2;
               if (newValue === undefined2) {
-                newValue = isObject2(objValue) ? objValue : isIndex(path22[index + 1]) ? [] : {};
+                newValue = isObject2(objValue) ? objValue : isIndex(path24[index + 1]) ? [] : {};
               }
             }
             assignValue(nested, key, newValue);
@@ -1964,14 +1964,14 @@ var require_lodash = __commonJS({
             }
           return result2;
         }
-        function baseUnset(object2, path22) {
-          path22 = castPath(path22, object2);
-          var index = -1, length = path22.length;
+        function baseUnset(object2, path24) {
+          path24 = castPath(path24, object2);
+          var index = -1, length = path24.length;
           if (!length) {
             return true;
           }
           while (++index < length) {
-            var key = toKey(path22[index]);
+            var key = toKey(path24[index]);
             if (key === "__proto__" && !hasOwnProperty.call(object2, "__proto__")) {
               return false;
             }
@@ -1979,11 +1979,11 @@ var require_lodash = __commonJS({
               return false;
             }
           }
-          var obj = parent(object2, path22);
-          return obj == null || delete obj[toKey(last(path22))];
+          var obj = parent(object2, path24);
+          return obj == null || delete obj[toKey(last(path24))];
         }
-        function baseUpdate(object2, path22, updater, customizer) {
-          return baseSet(object2, path22, updater(baseGet(object2, path22)), customizer);
+        function baseUpdate(object2, path24, updater, customizer) {
+          return baseSet(object2, path24, updater(baseGet(object2, path24)), customizer);
         }
         function baseWhile(array2, predicate, isDrop, fromRight) {
           var length = array2.length, index = fromRight ? length : -1;
@@ -2866,11 +2866,11 @@ var require_lodash = __commonJS({
           var match = source.match(reWrapDetails);
           return match ? match[1].split(reSplitDetails) : [];
         }
-        function hasPath(object2, path22, hasFunc) {
-          path22 = castPath(path22, object2);
-          var index = -1, length = path22.length, result2 = false;
+        function hasPath(object2, path24, hasFunc) {
+          path24 = castPath(path24, object2);
+          var index = -1, length = path24.length, result2 = false;
           while (++index < length) {
-            var key = toKey(path22[index]);
+            var key = toKey(path24[index]);
             if (!(result2 = object2 != null && hasFunc(object2, key))) {
               break;
             }
@@ -3072,8 +3072,8 @@ var require_lodash = __commonJS({
             return apply(func, this, otherArgs);
           };
         }
-        function parent(object2, path22) {
-          return path22.length < 2 ? object2 : baseGet(object2, baseSlice(path22, 0, -1));
+        function parent(object2, path24) {
+          return path24.length < 2 ? object2 : baseGet(object2, baseSlice(path24, 0, -1));
         }
         function reorder(array2, indexes) {
           var arrLength = array2.length, length = nativeMin(indexes.length, arrLength), oldArray = copyArray(array2);
@@ -3708,10 +3708,10 @@ var require_lodash = __commonJS({
           }
           return isString(collection) ? fromIndex <= length && collection.indexOf(value, fromIndex) > -1 : !!length && baseIndexOf(collection, value, fromIndex) > -1;
         }
-        var invokeMap = baseRest(function(collection, path22, args) {
-          var index = -1, isFunc = typeof path22 == "function", result2 = isArrayLike(collection) ? Array2(collection.length) : [];
+        var invokeMap = baseRest(function(collection, path24, args) {
+          var index = -1, isFunc = typeof path24 == "function", result2 = isArrayLike(collection) ? Array2(collection.length) : [];
           baseEach(collection, function(value) {
-            result2[++index] = isFunc ? apply(path22, value, args) : baseInvoke(value, path22, args);
+            result2[++index] = isFunc ? apply(path24, value, args) : baseInvoke(value, path24, args);
           });
           return result2;
         });
@@ -4363,15 +4363,15 @@ var require_lodash = __commonJS({
         function functionsIn(object2) {
           return object2 == null ? [] : baseFunctions(object2, keysIn(object2));
         }
-        function get(object2, path22, defaultValue) {
-          var result2 = object2 == null ? undefined2 : baseGet(object2, path22);
+        function get(object2, path24, defaultValue) {
+          var result2 = object2 == null ? undefined2 : baseGet(object2, path24);
           return result2 === undefined2 ? defaultValue : result2;
         }
-        function has(object2, path22) {
-          return object2 != null && hasPath(object2, path22, baseHas);
+        function has(object2, path24) {
+          return object2 != null && hasPath(object2, path24, baseHas);
         }
-        function hasIn(object2, path22) {
-          return object2 != null && hasPath(object2, path22, baseHasIn);
+        function hasIn(object2, path24) {
+          return object2 != null && hasPath(object2, path24, baseHasIn);
         }
         var invert = createInverter(function(result2, value, key) {
           if (value != null && typeof value.toString != "function") {
@@ -4424,10 +4424,10 @@ var require_lodash = __commonJS({
             return result2;
           }
           var isDeep = false;
-          paths = arrayMap(paths, function(path22) {
-            path22 = castPath(path22, object2);
-            isDeep || (isDeep = path22.length > 1);
-            return path22;
+          paths = arrayMap(paths, function(path24) {
+            path24 = castPath(path24, object2);
+            isDeep || (isDeep = path24.length > 1);
+            return path24;
           });
           copyObject(object2, getAllKeysIn(object2), result2);
           if (isDeep) {
@@ -4453,19 +4453,19 @@ var require_lodash = __commonJS({
             return [prop];
           });
           predicate = getIteratee(predicate);
-          return basePickBy(object2, props, function(value, path22) {
-            return predicate(value, path22[0]);
+          return basePickBy(object2, props, function(value, path24) {
+            return predicate(value, path24[0]);
           });
         }
-        function result(object2, path22, defaultValue) {
-          path22 = castPath(path22, object2);
-          var index = -1, length = path22.length;
+        function result(object2, path24, defaultValue) {
+          path24 = castPath(path24, object2);
+          var index = -1, length = path24.length;
           if (!length) {
             length = 1;
             object2 = undefined2;
           }
           while (++index < length) {
-            var value = object2 == null ? undefined2 : object2[toKey(path22[index])];
+            var value = object2 == null ? undefined2 : object2[toKey(path24[index])];
             if (value === undefined2) {
               index = length;
               value = defaultValue;
@@ -4474,12 +4474,12 @@ var require_lodash = __commonJS({
           }
           return object2;
         }
-        function set2(object2, path22, value) {
-          return object2 == null ? object2 : baseSet(object2, path22, value);
+        function set2(object2, path24, value) {
+          return object2 == null ? object2 : baseSet(object2, path24, value);
         }
-        function setWith(object2, path22, value, customizer) {
+        function setWith(object2, path24, value, customizer) {
           customizer = typeof customizer == "function" ? customizer : undefined2;
-          return object2 == null ? object2 : baseSet(object2, path22, value, customizer);
+          return object2 == null ? object2 : baseSet(object2, path24, value, customizer);
         }
         var toPairs = createToPairs(keys);
         var toPairsIn = createToPairs(keysIn);
@@ -4501,15 +4501,15 @@ var require_lodash = __commonJS({
           });
           return accumulator;
         }
-        function unset(object2, path22) {
-          return object2 == null ? true : baseUnset(object2, path22);
+        function unset(object2, path24) {
+          return object2 == null ? true : baseUnset(object2, path24);
         }
-        function update(object2, path22, updater) {
-          return object2 == null ? object2 : baseUpdate(object2, path22, castFunction(updater));
+        function update(object2, path24, updater) {
+          return object2 == null ? object2 : baseUpdate(object2, path24, castFunction(updater));
         }
-        function updateWith(object2, path22, updater, customizer) {
+        function updateWith(object2, path24, updater, customizer) {
           customizer = typeof customizer == "function" ? customizer : undefined2;
-          return object2 == null ? object2 : baseUpdate(object2, path22, castFunction(updater), customizer);
+          return object2 == null ? object2 : baseUpdate(object2, path24, castFunction(updater), customizer);
         }
         function values(object2) {
           return object2 == null ? [] : baseValues(object2, keys(object2));
@@ -4895,17 +4895,17 @@ var require_lodash = __commonJS({
         function matches(source) {
           return baseMatches(baseClone(source, CLONE_DEEP_FLAG));
         }
-        function matchesProperty(path22, srcValue) {
-          return baseMatchesProperty(path22, baseClone(srcValue, CLONE_DEEP_FLAG));
+        function matchesProperty(path24, srcValue) {
+          return baseMatchesProperty(path24, baseClone(srcValue, CLONE_DEEP_FLAG));
         }
-        var method = baseRest(function(path22, args) {
+        var method = baseRest(function(path24, args) {
           return function(object2) {
-            return baseInvoke(object2, path22, args);
+            return baseInvoke(object2, path24, args);
           };
         });
         var methodOf = baseRest(function(object2, args) {
-          return function(path22) {
-            return baseInvoke(object2, path22, args);
+          return function(path24) {
+            return baseInvoke(object2, path24, args);
           };
         });
         function mixin(object2, source, options) {
@@ -4952,12 +4952,12 @@ var require_lodash = __commonJS({
         var over = createOver(arrayMap);
         var overEvery = createOver(arrayEvery);
         var overSome = createOver(arraySome);
-        function property(path22) {
-          return isKey(path22) ? baseProperty(toKey(path22)) : basePropertyDeep(path22);
+        function property(path24) {
+          return isKey(path24) ? baseProperty(toKey(path24)) : basePropertyDeep(path24);
         }
         function propertyOf(object2) {
-          return function(path22) {
-            return object2 == null ? undefined2 : baseGet(object2, path22);
+          return function(path24) {
+            return object2 == null ? undefined2 : baseGet(object2, path24);
           };
         }
         var range = createRange();
@@ -5410,12 +5410,12 @@ var require_lodash = __commonJS({
         LazyWrapper.prototype.findLast = function(predicate) {
           return this.reverse().find(predicate);
         };
-        LazyWrapper.prototype.invokeMap = baseRest(function(path22, args) {
-          if (typeof path22 == "function") {
+        LazyWrapper.prototype.invokeMap = baseRest(function(path24, args) {
+          if (typeof path24 == "function") {
             return new LazyWrapper(this);
           }
           return this.map(function(value) {
-            return baseInvoke(value, path22, args);
+            return baseInvoke(value, path24, args);
           });
         });
         LazyWrapper.prototype.reject = function(predicate) {
@@ -6384,10 +6384,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path22) {
-  if (!path22)
+function getElementAtPath(obj, path24) {
+  if (!path24)
     return obj;
-  return path22.reduce((acc, key) => acc?.[key], obj);
+  return path24.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -6727,11 +6727,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path22, issues) {
+function prefixIssues(path24, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path22);
+    iss.path.unshift(path24);
     return iss;
   });
 }
@@ -7181,16 +7181,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path22 = []) => {
+  const processError = (error63, path24 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path22, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path24, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path22, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path24, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path22, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path24, ...issue2.path]);
       } else {
-        const fullpath = [...path22, ...issue2.path];
+        const fullpath = [...path24, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -7229,17 +7229,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path22 = []) => {
+  const processError = (error63, path24 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path22, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path24, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path22, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path24, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path22, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path24, ...issue2.path]);
       } else {
-        const fullpath = [...path22, ...issue2.path];
+        const fullpath = [...path24, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -7278,8 +7278,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path22 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path22) {
+  const path24 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path24) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -24381,13 +24381,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path22 = ref.slice(1).split("/").filter(Boolean);
-  if (path22.length === 0) {
+  const path24 = ref.slice(1).split("/").filter(Boolean);
+  if (path24.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path22[0] === defsKey) {
-    const key = path22[1] === void 0 ? void 0 : decodeJSONPointerSegment(path22[1]);
+  if (path24[0] === defsKey) {
+    const key = path24[1] === void 0 ? void 0 : decodeJSONPointerSegment(path24[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -25274,6 +25274,9 @@ function enabled(what, markers) {
 function Packages(what, example) {
   return StringsSchema.describe(what + ", installed once and kept (e.g. " + example + ").");
 }
+function secret(schema) {
+  return schema.meta({ secret: true });
+}
 
 // src/core/schema/config.ts
 var import_lodash = __toESM(require_lodash(), 1);
@@ -25342,10 +25345,15 @@ var HarnessSchema = external_exports.strictObject({
   uvPackage: external_exports.string().optional().describe("Python package installed with `uv tool install` inside the sandbox (e.g. aider-chat)."),
   uvBin: external_exports.string().optional().describe("Command the uv package provides."),
   arguments: StringsSchema.describe("Arguments always passed to the agent."),
-  environment: external_exports.record(external_exports.string(), external_exports.string()).describe("Environment variables for the agent."),
+  environment: external_exports.record(external_exports.string(), secret(external_exports.string())).describe(
+    "Environment variables for the agent (API keys go here). Their values are shown as *** and are handed to the sandbox in a one-shot file, never kept in the launch folder. The agent can read its own environment."
+  ),
   home: HarnessHomeSchema.optional().describe(
     "Where its login lives inside the sandbox; leave out when the agent cannot be pointed at a folder (then its login is not kept between sandboxes)."
   ),
+  localState: external_exports.record(external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/), SubfolderSchema).optional().describe(
+    "Environment variable -> folder below the agent's own state folder (state\\<agent>) for SQLite databases. SQLite cannot run in a mapped folder, so the agent runs from a copy on the sandbox's disk (the variable points to it) that is copied from and back to that folder."
+  ),
   resumeArguments: StringsSchema.optional().describe(
     "Arguments used when the agent is restarted in place (e.g. after an account switch) so it resumes the conversation."
   ),
@@ -25397,6 +25405,9 @@ var ClaudeProfileSchema = external_exports.strictObject({
   globalStateFile: external_exports.string().describe('Your .claude.json, or "auto". Empty string = do not copy.'),
   copyCredentials: external_exports.boolean().describe("Copy your Claude LOGIN into the sandbox. Prefer sandbox account instead."),
   overwrite: external_exports.boolean().describe("Refresh these settings from this PC on every launch."),
+  sharePluginsAcrossAccounts: external_exports.boolean().describe(
+    "When you switch Claude accounts, copy your Claude plugins (and which ones are enabled) into a data set that has none yet. Off by default: plugins are code that runs in your sessions."
+  ),
   syncHistory: external_exports.boolean().describe("Bring conversation history in, and sync new history back (path-translated)."),
   historyScope: external_exports.enum(["project", "all"]).describe(
     `Which history comes in: "project" = only the projects in this sandbox (other projects' conversations, file backups and prompts stay on this PC), "all" = everything. Only this sandbox's projects ever sync back.`
@@ -25473,7 +25484,10 @@ var NetworkSchema = external_exports.strictObject({
     "Reach servers in the sandbox from this PC: http://localhost:<pc> here goes to <sandbox> inside, while it runs. Nothing else on your network can use them."
   ),
   dns: external_exports.array(external_exports.string().regex(/^\d{1,3}(\.\d{1,3}){3}$/, "an IPv4 address like 1.1.1.1")).describe("DNS servers for the sandbox instead of your network's, e.g. 1.1.1.1 and 9.9.9.9."),
-  proxy: external_exports.string().regex(/^(https?:\/\/[^\s]+)?$/, "http://host:port").describe(
+  proxy: external_exports.string().regex(/^(https?:\/\/[^\s]+)?$/, "http://host:port").refine(
+    (v) => !/^https?:\/\/[^/?#]*@/i.test(v),
+    "no user name or password in the address (it would be stored in plain text and visible to the agent): use a proxy that needs no login"
+  ).describe(
     "An HTTP proxy the sandbox uses to reach the internet (HTTP_PROXY / HTTPS_PROXY for everything in it), e.g. http://proxy.corp:8080. Empty = none."
   )
 });
@@ -25875,6 +25889,17 @@ var APPS = [
     exe: "lazygit.exe",
     cli: true
   },
+  {
+    id: "jj",
+    name: "Jujutsu (jj)",
+    category: "git",
+    about: "Git-compatible version control; conflicts do not block a rebase. Pilot, untested with worktrees.",
+    size: "10 MB",
+    source: gh("jj-vcs/jj", "^jj-v[\\d.]+-x86_64-pc-windows-msvc\\.zip$"),
+    exe: "jj.exe",
+    cli: true,
+    fullGitOnly: true
+  },
   // ---- utilities
   {
     id: "7zip",
@@ -26403,6 +26428,26 @@ var APPS = [
     source: gh("gitleaks/gitleaks", "^gitleaks_[\\d.]+_windows_x64\\.zip$"),
     exe: "gitleaks.exe",
     cli: true
+  },
+  {
+    id: "ast-grep",
+    name: "ast-grep",
+    category: "cli",
+    about: "Search and rewrite code by its syntax tree (ast-grep, sg); prints only the matches.",
+    size: "15 MB",
+    source: gh("ast-grep/ast-grep", "^app-x86_64-pc-windows-msvc\\.zip$"),
+    exe: "ast-grep.exe",
+    cli: true
+  },
+  {
+    id: "rust-analyzer",
+    name: "rust-analyzer",
+    category: "cli",
+    about: "Rust language server: type errors and go-to-definition without cargo (for editors and the Claude LSP plugin).",
+    size: "18 MB",
+    source: gh("rust-lang/rust-analyzer", "^rust-analyzer-x86_64-pc-windows-msvc\\.zip$"),
+    exe: "rust-analyzer.exe",
+    cli: true
   }
 ];
 
@@ -26471,6 +26516,33 @@ var ResumeSchema = external_exports.strictObject({
   )
 });
 
+// src/core/schema/web.ts
+var WebSchema = external_exports.strictObject({
+  enabled: external_exports.boolean().describe(
+    "(Beta) Allow the web UI: your sandbox sessions in a browser on this PC. Off by default, and nothing starts it by itself yet: sandbox web start works either way and runs it until sandbox web stop (or a restart of the PC)."
+  ),
+  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken.")
+});
+
+// src/core/schema/vpn.ts
+var VPN_PROVIDERS = ["nordvpn", "openvpn-file"];
+var VpnSchema = external_exports.strictObject({
+  enabled: external_exports.boolean().describe(
+    "Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
+  ),
+  provider: external_exports.enum(VPN_PROVIDERS).describe(
+    "nordvpn: a recommended NordVPN server is picked at every launch. openvpn-file: your own .ovpn file (configFile)."
+  ),
+  protocol: external_exports.enum(["udp", "tcp"]).describe("udp is faster; tcp gets through networks that block udp."),
+  country: external_exports.string().regex(/^([A-Za-z][A-Za-z .'-]{0,39})?$/, "a country name or code like uk or Germany").describe("nordvpn: the country of the server, e.g. uk, us or Germany. Empty = the best server anywhere."),
+  configFile: external_exports.string().describe(
+    "openvpn-file: the .ovpn file on this PC (its certificates inside it). Files that run programs (script-security, up, down, plugin ...) are refused. A project's file can never set this."
+  ),
+  killSwitch: external_exports.boolean().describe(
+    "Block all traffic that does not go through the tunnel: when the tunnel cannot start, the sandbox stays offline instead of using your normal connection. A project can only turn this on, never off."
+  )
+});
+
 // src/core/schema/config.ts
 var ConfigSchema = external_exports.strictObject({
   $schema: SchemaRefSchema.optional(),
@@ -26483,7 +26555,9 @@ var ConfigSchema = external_exports.strictObject({
   sandbox: SandboxSchema,
   sharing: SharingSchema,
   storage: external_exports.strictObject({
-    root: external_exports.string().min(1).describe("Where everything is kept on this PC (tools, databases, logins, launches)."),
+    root: external_exports.string().min(1).describe(
+      "Where everything is kept on this PC (tools, databases, logins, launches). The default is a private folder for you under %ProgramData%\\AgentSandbox\\users, which works for installs for one user and for everyone. sandbox storage move <folder> moves it."
+    ),
     persistAgentState: external_exports.boolean().describe("Keep agent logins and history between sandboxes."),
     dataName: NameSchema.describe("Name of the persistent data set (C:\\AgentData) shared by all workspaces."),
     markSandboxFiles: external_exports.boolean().describe(
@@ -26494,6 +26568,7 @@ var ConfigSchema = external_exports.strictObject({
     )
   }),
   network: NetworkSchema,
+  vpn: VpnSchema,
   provisioning: ProvisioningSchema,
   downloads: DownloadsSchema,
   toolchains: ToolchainsSchema,
@@ -26501,6 +26576,7 @@ var ConfigSchema = external_exports.strictObject({
     "Databases running inside the sandbox. Data persists in C:\\AgentData\\databases; each one starts at boot."
   ),
   attach: AttachSchema,
+  web: WebSchema,
   agentCommands: AgentCommandsSchema,
   secrets: SecretsSchema,
   personalization: toggle("Copy your desktop look (theme, accent, taskbar, wallpaper, ...) into the sandbox."),
@@ -26533,6 +26609,8 @@ var LocalOverridesSchema = external_exports.strictObject({
   sandbox: SandboxSchema.omit({ cpuLimit: true, pageFileMb: true }).partial(),
   // A project may block more (the LAN, hosts); it never opens hosts, ports, DNS or a proxy.
   network: NetworkSchema.pick({ blockPrivateRanges: true, blockHosts: true }).partial(),
+  // A project may turn the kill switch on, never off, and never choose a VPN, a server, a file or a login.
+  vpn: VpnSchema.pick({ killSwitch: true }).partial(),
   provisioning: ProvisioningSchema.pick({ copyFromHost: true, fallbackToInstall: true, refresh: true }).extend({ git: GitSchema.partial(), terminal: toggle("Windows Terminal as the sandbox window.").partial() }).partial(),
   downloads: DownloadsSchema.partial(),
   // Every toolchain setting, each one optional (a project usually only switches languages on or pins a version).
@@ -26673,6 +26751,16 @@ var ProjectStatusSchema = external_exports.object({
   databases: external_exports.array(external_exports.object({ database: Text(32), port: external_exports.number().int() })).max(16),
   summary: external_exports.array(Text(512)).max(64)
 });
+var VpnStatusSchema = external_exports.object({
+  state: external_exports.enum(["off", "starting", "up", "failed"]),
+  message: Text(2e3),
+  killSwitch: external_exports.boolean(),
+  /** The server's name, e.g. uk2201.nordvpn.com. */
+  server: Text(128).optional(),
+  /** What the sandbox's traffic looks like from outside, once the tunnel is up. */
+  publicIp: Text(64).optional(),
+  updatedAt: TimeSchema
+});
 
 // src/guest/runtime/ports.ts
 import net from "node:net";
@@ -26869,20 +26957,25 @@ var scan = (schema, dir) => {
 var RunDir = class {
   root;
   sandboxFile;
+  vpnFile;
   requestsDir;
   responsesDir;
   sessionsDir;
   projectsDir;
   /** audit.processes: programs the sandbox started, in small .jsonl files the host takes in and deletes. */
   auditDir;
+  /** One-shot secrets the host hands over (see secrets.ts). Next to run, not in it: shared-use users can change run. */
+  secretsDir;
   constructor(dataDir2) {
     this.root = path5.join(dataDir2, "run");
     this.sandboxFile = path5.join(this.root, "sandbox.json");
+    this.vpnFile = path5.join(this.root, "vpn.json");
     this.requestsDir = path5.join(this.root, "requests");
     this.responsesDir = path5.join(this.root, "responses");
     this.sessionsDir = path5.join(this.root, "sessions");
     this.projectsDir = path5.join(this.root, "projects");
     this.auditDir = path5.join(this.root, "audit");
+    this.secretsDir = path5.join(dataDir2, "secrets");
   }
   requestFile(id) {
     return path5.join(this.requestsDir, safeId(id) + ".json");
@@ -26896,9 +26989,15 @@ var RunDir = class {
   projectFile(name) {
     return path5.join(this.projectsDir, safeId(name) + ".json");
   }
+  secretFile(id) {
+    return path5.join(this.secretsDir, safeId(id) + ".json");
+  }
   readSandboxStatus() {
     return readValid(SandboxStatusSchema, this.sandboxFile);
   }
+  readVpnStatus() {
+    return readValid(VpnStatusSchema, this.vpnFile);
+  }
   readSession(id) {
     return readValid(SessionStatusSchema, this.sessionFile(id));
   }
@@ -27894,15 +27993,46 @@ async function setupDatabase(env, plan) {
   await SERVERS[plan.database].start(env, plan);
 }
 
+// src/guest/setup/environment.ts
+import path23 from "node:path";
+
+// src/guest/setup/path-plan.ts
+import path22 from "node:path";
+function pathKey(folder) {
+  const slashes = folder.trim().replace(/^"|"$/g, "").replace(/\//g, "\\");
+  return (slashes.length > 3 ? slashes.replace(/\\+$/, "") : slashes).toLowerCase();
+}
+function splitPath(value) {
+  return value.split(";").map((part) => part.trim().replace(/^"|"$/g, "")).filter(Boolean);
+}
+function planPath(input2) {
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const entry of input2.entries.flatMap(splitPath)) {
+    const key = pathKey(entry);
+    if (seen.has(key) || input2.drop?.(entry) || !input2.exists(entry)) continue;
+    seen.add(key);
+    result.push(entry);
+  }
+  return result;
+}
+function isPinnedNodeDir(folder, nvmHome2) {
+  const key = pathKey(folder);
+  const home = pathKey(nvmHome2);
+  return key.startsWith(home + "\\") && /^v\d/.test(path22.win32.basename(key));
+}
+
 // src/guest/setup/environment.ts
 function addMachineEnvironment(vars, dirs, additive = false) {
   if (!isWin || dryRun || testMode) return;
+  const planned = planPath({ entries: dirs, exists, drop: (dir) => isPinnedNodeDir(dir, nvmHome()) });
   try {
-    runScriptWithJson("set-machine-environment.ps1", "SettingsFile", { vars, path: null, add: dirs, additive });
+    runScriptWithJson("set-machine-environment.ps1", "SettingsFile", { vars, path: null, add: planned, additive });
   } catch (e) {
     warn("Could not add to the environment: " + errMsg(e));
   }
 }
+var nvmHome = () => path23.join(toolsDir, "nvm");
 
 // src/guest/databases/sbx-db.ts
 var USAGE = "Usage: sbx-db [list] | sbx-db start <name> | sbx-db stop <name>";