windows-development-sandbox 1.5.0 → 1.7.0

package/dist/runtime/main.js

@@ -1363,11 +1363,11 @@ var require_lodash = __commonJS({
             return isFunction(object2[key]);
           });
         }
-        function baseGet(object2, path67) {
-          path67 = castPath(path67, object2);
-          var index = 0, length = path67.length;
+        function baseGet(object2, path74) {
+          path74 = castPath(path74, object2);
+          var index = 0, length = path74.length;
           while (object2 != null && index < length) {
-            object2 = object2[toKey(path67[index++])];
+            object2 = object2[toKey(path74[index++])];
           }
           return index && index == length ? object2 : undefined2;
         }
@@ -1431,10 +1431,10 @@ var require_lodash = __commonJS({
           });
           return accumulator;
         }
-        function baseInvoke(object2, path67, args) {
-          path67 = castPath(path67, object2);
-          object2 = parent(object2, path67);
-          var func = object2 == null ? object2 : object2[toKey(last(path67))];
+        function baseInvoke(object2, path74, args) {
+          path74 = castPath(path74, object2);
+          object2 = parent(object2, path74);
+          var func = object2 == null ? object2 : object2[toKey(last(path74))];
           return func == null ? undefined2 : apply(func, object2, args);
         }
         function baseIsArguments(value) {
@@ -1590,13 +1590,13 @@ var require_lodash = __commonJS({
             return object2 === source || baseIsMatch(object2, source, matchData);
           };
         }
-        function baseMatchesProperty(path67, srcValue) {
-          if (isKey(path67) && isStrictComparable(srcValue)) {
-            return matchesStrictComparable(toKey(path67), srcValue);
+        function baseMatchesProperty(path74, srcValue) {
+          if (isKey(path74) && isStrictComparable(srcValue)) {
+            return matchesStrictComparable(toKey(path74), srcValue);
           }
           return function(object2) {
-            var objValue = get(object2, path67);
-            return objValue === undefined2 && objValue === srcValue ? hasIn(object2, path67) : baseIsEqual(srcValue, objValue, COMPARE_PARTIAL_FLAG | COMPARE_UNORDERED_FLAG);
+            var objValue = get(object2, path74);
+            return objValue === undefined2 && objValue === srcValue ? hasIn(object2, path74) : baseIsEqual(srcValue, objValue, COMPARE_PARTIAL_FLAG | COMPARE_UNORDERED_FLAG);
           };
         }
         function baseMerge(object2, source, srcIndex, customizer, stack) {
@@ -1693,23 +1693,23 @@ var require_lodash = __commonJS({
           });
         }
         function basePick(object2, paths) {
-          return basePickBy(object2, paths, function(value, path67) {
-            return hasIn(object2, path67);
+          return basePickBy(object2, paths, function(value, path74) {
+            return hasIn(object2, path74);
           });
         }
         function basePickBy(object2, paths, predicate) {
           var index = -1, length = paths.length, result2 = {};
           while (++index < length) {
-            var path67 = paths[index], value = baseGet(object2, path67);
-            if (predicate(value, path67)) {
-              baseSet(result2, castPath(path67, object2), value);
+            var path74 = paths[index], value = baseGet(object2, path74);
+            if (predicate(value, path74)) {
+              baseSet(result2, castPath(path74, object2), value);
             }
           }
           return result2;
         }
-        function basePropertyDeep(path67) {
+        function basePropertyDeep(path74) {
           return function(object2) {
-            return baseGet(object2, path67);
+            return baseGet(object2, path74);
           };
         }
         function basePullAll(array2, values2, iteratee2, comparator) {
@@ -1783,14 +1783,14 @@ var require_lodash = __commonJS({
           var array2 = values(collection);
           return shuffleSelf(array2, baseClamp(n, 0, array2.length));
         }
-        function baseSet(object2, path67, value, customizer) {
+        function baseSet(object2, path74, value, customizer) {
           if (!isObject2(object2)) {
             return object2;
           }
-          path67 = castPath(path67, object2);
-          var index = -1, length = path67.length, lastIndex = length - 1, nested = object2;
+          path74 = castPath(path74, object2);
+          var index = -1, length = path74.length, lastIndex = length - 1, nested = object2;
           while (nested != null && ++index < length) {
-            var key = toKey(path67[index]), newValue = value;
+            var key = toKey(path74[index]), newValue = value;
             if (key === "__proto__" || key === "constructor" || key === "prototype") {
               return object2;
             }
@@ -1798,7 +1798,7 @@ var require_lodash = __commonJS({
               var objValue = nested[key];
               newValue = customizer ? customizer(objValue, key, nested) : undefined2;
               if (newValue === undefined2) {
-                newValue = isObject2(objValue) ? objValue : isIndex(path67[index + 1]) ? [] : {};
+                newValue = isObject2(objValue) ? objValue : isIndex(path74[index + 1]) ? [] : {};
               }
             }
             assignValue(nested, key, newValue);
@@ -1964,14 +1964,14 @@ var require_lodash = __commonJS({
             }
           return result2;
         }
-        function baseUnset(object2, path67) {
-          path67 = castPath(path67, object2);
-          var index = -1, length = path67.length;
+        function baseUnset(object2, path74) {
+          path74 = castPath(path74, object2);
+          var index = -1, length = path74.length;
           if (!length) {
             return true;
           }
           while (++index < length) {
-            var key = toKey(path67[index]);
+            var key = toKey(path74[index]);
             if (key === "__proto__" && !hasOwnProperty.call(object2, "__proto__")) {
               return false;
             }
@@ -1979,11 +1979,11 @@ var require_lodash = __commonJS({
               return false;
             }
           }
-          var obj = parent(object2, path67);
-          return obj == null || delete obj[toKey(last(path67))];
+          var obj = parent(object2, path74);
+          return obj == null || delete obj[toKey(last(path74))];
         }
-        function baseUpdate(object2, path67, updater, customizer) {
-          return baseSet(object2, path67, updater(baseGet(object2, path67)), customizer);
+        function baseUpdate(object2, path74, updater, customizer) {
+          return baseSet(object2, path74, updater(baseGet(object2, path74)), customizer);
         }
         function baseWhile(array2, predicate, isDrop, fromRight) {
           var length = array2.length, index = fromRight ? length : -1;
@@ -2866,11 +2866,11 @@ var require_lodash = __commonJS({
           var match = source.match(reWrapDetails);
           return match ? match[1].split(reSplitDetails) : [];
         }
-        function hasPath(object2, path67, hasFunc) {
-          path67 = castPath(path67, object2);
-          var index = -1, length = path67.length, result2 = false;
+        function hasPath(object2, path74, hasFunc) {
+          path74 = castPath(path74, object2);
+          var index = -1, length = path74.length, result2 = false;
           while (++index < length) {
-            var key = toKey(path67[index]);
+            var key = toKey(path74[index]);
             if (!(result2 = object2 != null && hasFunc(object2, key))) {
               break;
             }
@@ -3072,8 +3072,8 @@ var require_lodash = __commonJS({
             return apply(func, this, otherArgs);
           };
         }
-        function parent(object2, path67) {
-          return path67.length < 2 ? object2 : baseGet(object2, baseSlice(path67, 0, -1));
+        function parent(object2, path74) {
+          return path74.length < 2 ? object2 : baseGet(object2, baseSlice(path74, 0, -1));
         }
         function reorder(array2, indexes) {
           var arrLength = array2.length, length = nativeMin(indexes.length, arrLength), oldArray = copyArray(array2);
@@ -3230,7 +3230,7 @@ var require_lodash = __commonJS({
           }
           return isArrayLikeObject(array2) ? baseDifference(array2, baseFlatten(values2, 1, isArrayLikeObject, true), undefined2, comparator) : [];
         });
-        function drop(array2, n, guard) {
+        function drop2(array2, n, guard) {
           var length = array2 == null ? 0 : array2.length;
           if (!length) {
             return [];
@@ -3461,7 +3461,7 @@ var require_lodash = __commonJS({
         function sortedUniqBy(array2, iteratee2) {
           return array2 && array2.length ? baseSortedUniq(array2, getIteratee(iteratee2, 2)) : [];
         }
-        function tail(array2) {
+        function tail2(array2) {
           var length = array2 == null ? 0 : array2.length;
           return length ? baseSlice(array2, 1, length) : [];
         }
@@ -3708,10 +3708,10 @@ var require_lodash = __commonJS({
           }
           return isString(collection) ? fromIndex <= length && collection.indexOf(value, fromIndex) > -1 : !!length && baseIndexOf(collection, value, fromIndex) > -1;
         }
-        var invokeMap = baseRest(function(collection, path67, args) {
-          var index = -1, isFunc = typeof path67 == "function", result2 = isArrayLike(collection) ? Array2(collection.length) : [];
+        var invokeMap = baseRest(function(collection, path74, args) {
+          var index = -1, isFunc = typeof path74 == "function", result2 = isArrayLike(collection) ? Array2(collection.length) : [];
           baseEach(collection, function(value) {
-            result2[++index] = isFunc ? apply(path67, value, args) : baseInvoke(value, path67, args);
+            result2[++index] = isFunc ? apply(path74, value, args) : baseInvoke(value, path74, args);
           });
           return result2;
         });
@@ -4363,15 +4363,15 @@ var require_lodash = __commonJS({
         function functionsIn(object2) {
           return object2 == null ? [] : baseFunctions(object2, keysIn(object2));
         }
-        function get(object2, path67, defaultValue) {
-          var result2 = object2 == null ? undefined2 : baseGet(object2, path67);
+        function get(object2, path74, defaultValue) {
+          var result2 = object2 == null ? undefined2 : baseGet(object2, path74);
           return result2 === undefined2 ? defaultValue : result2;
         }
-        function has(object2, path67) {
-          return object2 != null && hasPath(object2, path67, baseHas);
+        function has(object2, path74) {
+          return object2 != null && hasPath(object2, path74, baseHas);
         }
-        function hasIn(object2, path67) {
-          return object2 != null && hasPath(object2, path67, baseHasIn);
+        function hasIn(object2, path74) {
+          return object2 != null && hasPath(object2, path74, baseHasIn);
         }
         var invert = createInverter(function(result2, value, key) {
           if (value != null && typeof value.toString != "function") {
@@ -4424,10 +4424,10 @@ var require_lodash = __commonJS({
             return result2;
           }
           var isDeep = false;
-          paths = arrayMap(paths, function(path67) {
-            path67 = castPath(path67, object2);
-            isDeep || (isDeep = path67.length > 1);
-            return path67;
+          paths = arrayMap(paths, function(path74) {
+            path74 = castPath(path74, object2);
+            isDeep || (isDeep = path74.length > 1);
+            return path74;
           });
           copyObject(object2, getAllKeysIn(object2), result2);
           if (isDeep) {
@@ -4453,19 +4453,19 @@ var require_lodash = __commonJS({
             return [prop];
           });
           predicate = getIteratee(predicate);
-          return basePickBy(object2, props, function(value, path67) {
-            return predicate(value, path67[0]);
+          return basePickBy(object2, props, function(value, path74) {
+            return predicate(value, path74[0]);
           });
         }
-        function result(object2, path67, defaultValue) {
-          path67 = castPath(path67, object2);
-          var index = -1, length = path67.length;
+        function result(object2, path74, defaultValue) {
+          path74 = castPath(path74, object2);
+          var index = -1, length = path74.length;
           if (!length) {
             length = 1;
             object2 = undefined2;
           }
           while (++index < length) {
-            var value = object2 == null ? undefined2 : object2[toKey(path67[index])];
+            var value = object2 == null ? undefined2 : object2[toKey(path74[index])];
             if (value === undefined2) {
               index = length;
               value = defaultValue;
@@ -4474,12 +4474,12 @@ var require_lodash = __commonJS({
           }
           return object2;
         }
-        function set2(object2, path67, value) {
-          return object2 == null ? object2 : baseSet(object2, path67, value);
+        function set2(object2, path74, value) {
+          return object2 == null ? object2 : baseSet(object2, path74, value);
         }
-        function setWith(object2, path67, value, customizer) {
+        function setWith(object2, path74, value, customizer) {
           customizer = typeof customizer == "function" ? customizer : undefined2;
-          return object2 == null ? object2 : baseSet(object2, path67, value, customizer);
+          return object2 == null ? object2 : baseSet(object2, path74, value, customizer);
         }
         var toPairs = createToPairs(keys);
         var toPairsIn = createToPairs(keysIn);
@@ -4501,15 +4501,15 @@ var require_lodash = __commonJS({
           });
           return accumulator;
         }
-        function unset(object2, path67) {
-          return object2 == null ? true : baseUnset(object2, path67);
+        function unset(object2, path74) {
+          return object2 == null ? true : baseUnset(object2, path74);
         }
-        function update(object2, path67, updater) {
-          return object2 == null ? object2 : baseUpdate(object2, path67, castFunction(updater));
+        function update(object2, path74, updater) {
+          return object2 == null ? object2 : baseUpdate(object2, path74, castFunction(updater));
         }
-        function updateWith(object2, path67, updater, customizer) {
+        function updateWith(object2, path74, updater, customizer) {
           customizer = typeof customizer == "function" ? customizer : undefined2;
-          return object2 == null ? object2 : baseUpdate(object2, path67, castFunction(updater), customizer);
+          return object2 == null ? object2 : baseUpdate(object2, path74, castFunction(updater), customizer);
         }
         function values(object2) {
           return object2 == null ? [] : baseValues(object2, keys(object2));
@@ -4895,17 +4895,17 @@ var require_lodash = __commonJS({
         function matches(source) {
           return baseMatches(baseClone(source, CLONE_DEEP_FLAG));
         }
-        function matchesProperty(path67, srcValue) {
-          return baseMatchesProperty(path67, baseClone(srcValue, CLONE_DEEP_FLAG));
+        function matchesProperty(path74, srcValue) {
+          return baseMatchesProperty(path74, baseClone(srcValue, CLONE_DEEP_FLAG));
         }
-        var method = baseRest(function(path67, args) {
+        var method = baseRest(function(path74, args) {
           return function(object2) {
-            return baseInvoke(object2, path67, args);
+            return baseInvoke(object2, path74, args);
           };
         });
         var methodOf = baseRest(function(object2, args) {
-          return function(path67) {
-            return baseInvoke(object2, path67, args);
+          return function(path74) {
+            return baseInvoke(object2, path74, args);
           };
         });
         function mixin(object2, source, options) {
@@ -4952,12 +4952,12 @@ var require_lodash = __commonJS({
         var over = createOver(arrayMap);
         var overEvery = createOver(arrayEvery);
         var overSome = createOver(arraySome);
-        function property(path67) {
-          return isKey(path67) ? baseProperty(toKey(path67)) : basePropertyDeep(path67);
+        function property(path74) {
+          return isKey(path74) ? baseProperty(toKey(path74)) : basePropertyDeep(path74);
         }
         function propertyOf(object2) {
-          return function(path67) {
-            return object2 == null ? undefined2 : baseGet(object2, path67);
+          return function(path74) {
+            return object2 == null ? undefined2 : baseGet(object2, path74);
           };
         }
         var range = createRange();
@@ -5071,7 +5071,7 @@ var require_lodash = __commonJS({
         lodash.difference = difference;
         lodash.differenceBy = differenceBy;
         lodash.differenceWith = differenceWith;
-        lodash.drop = drop;
+        lodash.drop = drop2;
         lodash.dropRight = dropRight;
         lodash.dropRightWhile = dropRightWhile;
         lodash.dropWhile = dropWhile;
@@ -5151,7 +5151,7 @@ var require_lodash = __commonJS({
         lodash.sortedUniqBy = sortedUniqBy;
         lodash.split = split;
         lodash.spread = spread;
-        lodash.tail = tail;
+        lodash.tail = tail2;
         lodash.take = take;
         lodash.takeRight = takeRight;
         lodash.takeRightWhile = takeRightWhile;
@@ -5410,12 +5410,12 @@ var require_lodash = __commonJS({
         LazyWrapper.prototype.findLast = function(predicate) {
           return this.reverse().find(predicate);
         };
-        LazyWrapper.prototype.invokeMap = baseRest(function(path67, args) {
-          if (typeof path67 == "function") {
+        LazyWrapper.prototype.invokeMap = baseRest(function(path74, args) {
+          if (typeof path74 == "function") {
             return new LazyWrapper(this);
           }
           return this.map(function(value) {
-            return baseInvoke(value, path67, args);
+            return baseInvoke(value, path74, args);
           });
         });
         LazyWrapper.prototype.reject = function(predicate) {
@@ -5532,8 +5532,8 @@ var require_lodash = __commonJS({
 });
 
 // src/guest/entries/main.ts
-import fs53 from "node:fs";
-import path66 from "node:path";
+import fs59 from "node:fs";
+import path73 from "node:path";
 
 // src/guest/runtime/paths.ts
 import path7 from "node:path";
@@ -6358,10 +6358,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path67) {
-  if (!path67)
+function getElementAtPath(obj, path74) {
+  if (!path74)
     return obj;
-  return path67.reduce((acc, key) => acc?.[key], obj);
+  return path74.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -6701,11 +6701,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path67, issues) {
+function prefixIssues(path74, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path67);
+    iss.path.unshift(path74);
     return iss;
   });
 }
@@ -7155,16 +7155,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path67 = []) => {
+  const processError = (error63, path74 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path67, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path74, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path67, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path74, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path67, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path74, ...issue2.path]);
       } else {
-        const fullpath = [...path67, ...issue2.path];
+        const fullpath = [...path74, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -7203,17 +7203,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path67 = []) => {
+  const processError = (error63, path74 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path67, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path74, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path67, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path74, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path67, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path74, ...issue2.path]);
       } else {
-        const fullpath = [...path67, ...issue2.path];
+        const fullpath = [...path74, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -7252,8 +7252,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path67 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path67) {
+  const path74 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path74) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -24355,13 +24355,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path67 = ref.slice(1).split("/").filter(Boolean);
-  if (path67.length === 0) {
+  const path74 = ref.slice(1).split("/").filter(Boolean);
+  if (path74.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path67[0] === defsKey) {
-    const key = path67[1] === void 0 ? void 0 : decodeJSONPointerSegment(path67[1]);
+  if (path74[0] === defsKey) {
+    const key = path74[1] === void 0 ? void 0 : decodeJSONPointerSegment(path74[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -25292,6 +25292,9 @@ function enabled(what, markers) {
 function Packages(what, example) {
   return StringsSchema.describe(what + ", installed once and kept (e.g. " + example + ").");
 }
+function secret(schema) {
+  return schema.meta({ secret: true });
+}
 
 // src/core/schema/config.ts
 var import_lodash = __toESM(require_lodash(), 1);
@@ -25360,10 +25363,15 @@ var HarnessSchema = external_exports.strictObject({
   uvPackage: external_exports.string().optional().describe("Python package installed with `uv tool install` inside the sandbox (e.g. aider-chat)."),
   uvBin: external_exports.string().optional().describe("Command the uv package provides."),
   arguments: StringsSchema.describe("Arguments always passed to the agent."),
-  environment: external_exports.record(external_exports.string(), external_exports.string()).describe("Environment variables for the agent."),
+  environment: external_exports.record(external_exports.string(), secret(external_exports.string())).describe(
+    "Environment variables for the agent (API keys go here). Their values are shown as *** and are handed to the sandbox in a one-shot file, never kept in the launch folder. The agent can read its own environment."
+  ),
   home: HarnessHomeSchema.optional().describe(
     "Where its login lives inside the sandbox; leave out when the agent cannot be pointed at a folder (then its login is not kept between sandboxes)."
   ),
+  localState: external_exports.record(external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/), SubfolderSchema).optional().describe(
+    "Environment variable -> folder below the agent's own state folder (state\\<agent>) for SQLite databases. SQLite cannot run in a mapped folder, so the agent runs from a copy on the sandbox's disk (the variable points to it) that is copied from and back to that folder."
+  ),
   resumeArguments: StringsSchema.optional().describe(
     "Arguments used when the agent is restarted in place (e.g. after an account switch) so it resumes the conversation."
   ),
@@ -25415,6 +25423,9 @@ var ClaudeProfileSchema = external_exports.strictObject({
   globalStateFile: external_exports.string().describe('Your .claude.json, or "auto". Empty string = do not copy.'),
   copyCredentials: external_exports.boolean().describe("Copy your Claude LOGIN into the sandbox. Prefer sandbox account instead."),
   overwrite: external_exports.boolean().describe("Refresh these settings from this PC on every launch."),
+  sharePluginsAcrossAccounts: external_exports.boolean().describe(
+    "When you switch Claude accounts, copy your Claude plugins (and which ones are enabled) into a data set that has none yet. Off by default: plugins are code that runs in your sessions."
+  ),
   syncHistory: external_exports.boolean().describe("Bring conversation history in, and sync new history back (path-translated)."),
   historyScope: external_exports.enum(["project", "all"]).describe(
     `Which history comes in: "project" = only the projects in this sandbox (other projects' conversations, file backups and prompts stay on this PC), "all" = everything. Only this sandbox's projects ever sync back.`
@@ -25491,7 +25502,10 @@ var NetworkSchema = external_exports.strictObject({
     "Reach servers in the sandbox from this PC: http://localhost:<pc> here goes to <sandbox> inside, while it runs. Nothing else on your network can use them."
   ),
   dns: external_exports.array(external_exports.string().regex(/^\d{1,3}(\.\d{1,3}){3}$/, "an IPv4 address like 1.1.1.1")).describe("DNS servers for the sandbox instead of your network's, e.g. 1.1.1.1 and 9.9.9.9."),
-  proxy: external_exports.string().regex(/^(https?:\/\/[^\s]+)?$/, "http://host:port").describe(
+  proxy: external_exports.string().regex(/^(https?:\/\/[^\s]+)?$/, "http://host:port").refine(
+    (v) => !/^https?:\/\/[^/?#]*@/i.test(v),
+    "no user name or password in the address (it would be stored in plain text and visible to the agent): use a proxy that needs no login"
+  ).describe(
     "An HTTP proxy the sandbox uses to reach the internet (HTTP_PROXY / HTTPS_PROXY for everything in it), e.g. http://proxy.corp:8080. Empty = none."
   )
 });
@@ -25893,6 +25907,17 @@ var APPS = [
     exe: "lazygit.exe",
     cli: true
   },
+  {
+    id: "jj",
+    name: "Jujutsu (jj)",
+    category: "git",
+    about: "Git-compatible version control; conflicts do not block a rebase. Pilot, untested with worktrees.",
+    size: "10 MB",
+    source: gh("jj-vcs/jj", "^jj-v[\\d.]+-x86_64-pc-windows-msvc\\.zip$"),
+    exe: "jj.exe",
+    cli: true,
+    fullGitOnly: true
+  },
   // ---- utilities
   {
     id: "7zip",
@@ -26421,6 +26446,26 @@ var APPS = [
     source: gh("gitleaks/gitleaks", "^gitleaks_[\\d.]+_windows_x64\\.zip$"),
     exe: "gitleaks.exe",
     cli: true
+  },
+  {
+    id: "ast-grep",
+    name: "ast-grep",
+    category: "cli",
+    about: "Search and rewrite code by its syntax tree (ast-grep, sg); prints only the matches.",
+    size: "15 MB",
+    source: gh("ast-grep/ast-grep", "^app-x86_64-pc-windows-msvc\\.zip$"),
+    exe: "ast-grep.exe",
+    cli: true
+  },
+  {
+    id: "rust-analyzer",
+    name: "rust-analyzer",
+    category: "cli",
+    about: "Rust language server: type errors and go-to-definition without cargo (for editors and the Claude LSP plugin).",
+    size: "18 MB",
+    source: gh("rust-lang/rust-analyzer", "^rust-analyzer-x86_64-pc-windows-msvc\\.zip$"),
+    exe: "rust-analyzer.exe",
+    cli: true
   }
 ];
 function appById(id) {
@@ -26529,6 +26574,33 @@ var ResumeSchema = external_exports.strictObject({
   )
 });
 
+// src/core/schema/web.ts
+var WebSchema = external_exports.strictObject({
+  enabled: external_exports.boolean().describe(
+    "(Beta) Allow the web UI: your sandbox sessions in a browser on this PC. Off by default, and nothing starts it by itself yet: sandbox web start works either way and runs it until sandbox web stop (or a restart of the PC)."
+  ),
+  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken.")
+});
+
+// src/core/schema/vpn.ts
+var VPN_PROVIDERS = ["nordvpn", "openvpn-file"];
+var VpnSchema = external_exports.strictObject({
+  enabled: external_exports.boolean().describe(
+    "Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
+  ),
+  provider: external_exports.enum(VPN_PROVIDERS).describe(
+    "nordvpn: a recommended NordVPN server is picked at every launch. openvpn-file: your own .ovpn file (configFile)."
+  ),
+  protocol: external_exports.enum(["udp", "tcp"]).describe("udp is faster; tcp gets through networks that block udp."),
+  country: external_exports.string().regex(/^([A-Za-z][A-Za-z .'-]{0,39})?$/, "a country name or code like uk or Germany").describe("nordvpn: the country of the server, e.g. uk, us or Germany. Empty = the best server anywhere."),
+  configFile: external_exports.string().describe(
+    "openvpn-file: the .ovpn file on this PC (its certificates inside it). Files that run programs (script-security, up, down, plugin ...) are refused. A project's file can never set this."
+  ),
+  killSwitch: external_exports.boolean().describe(
+    "Block all traffic that does not go through the tunnel: when the tunnel cannot start, the sandbox stays offline instead of using your normal connection. A project can only turn this on, never off."
+  )
+});
+
 // src/core/schema/config.ts
 var ConfigSchema = external_exports.strictObject({
   $schema: SchemaRefSchema.optional(),
@@ -26541,7 +26613,9 @@ var ConfigSchema = external_exports.strictObject({
   sandbox: SandboxSchema,
   sharing: SharingSchema,
   storage: external_exports.strictObject({
-    root: external_exports.string().min(1).describe("Where everything is kept on this PC (tools, databases, logins, launches)."),
+    root: external_exports.string().min(1).describe(
+      "Where everything is kept on this PC (tools, databases, logins, launches). The default is a private folder for you under %ProgramData%\\AgentSandbox\\users, which works for installs for one user and for everyone. sandbox storage move <folder> moves it."
+    ),
     persistAgentState: external_exports.boolean().describe("Keep agent logins and history between sandboxes."),
     dataName: NameSchema.describe("Name of the persistent data set (C:\\AgentData) shared by all workspaces."),
     markSandboxFiles: external_exports.boolean().describe(
@@ -26552,6 +26626,7 @@ var ConfigSchema = external_exports.strictObject({
     )
   }),
   network: NetworkSchema,
+  vpn: VpnSchema,
   provisioning: ProvisioningSchema,
   downloads: DownloadsSchema,
   toolchains: ToolchainsSchema,
@@ -26559,6 +26634,7 @@ var ConfigSchema = external_exports.strictObject({
     "Databases running inside the sandbox. Data persists in C:\\AgentData\\databases; each one starts at boot."
   ),
   attach: AttachSchema,
+  web: WebSchema,
   agentCommands: AgentCommandsSchema,
   secrets: SecretsSchema,
   personalization: toggle("Copy your desktop look (theme, accent, taskbar, wallpaper, ...) into the sandbox."),
@@ -26591,6 +26667,8 @@ var LocalOverridesSchema = external_exports.strictObject({
   sandbox: SandboxSchema.omit({ cpuLimit: true, pageFileMb: true }).partial(),
   // A project may block more (the LAN, hosts); it never opens hosts, ports, DNS or a proxy.
   network: NetworkSchema.pick({ blockPrivateRanges: true, blockHosts: true }).partial(),
+  // A project may turn the kill switch on, never off, and never choose a VPN, a server, a file or a login.
+  vpn: VpnSchema.pick({ killSwitch: true }).partial(),
   provisioning: ProvisioningSchema.pick({ copyFromHost: true, fallbackToInstall: true, refresh: true }).extend({ git: GitSchema.partial(), terminal: toggle("Windows Terminal as the sandbox window.").partial() }).partial(),
   downloads: DownloadsSchema.partial(),
   // Every toolchain setting, each one optional (a project usually only switches languages on or pins a version).
@@ -26731,6 +26809,16 @@ var ProjectStatusSchema = external_exports.object({
   databases: external_exports.array(external_exports.object({ database: Text(32), port: external_exports.number().int() })).max(16),
   summary: external_exports.array(Text(512)).max(64)
 });
+var VpnStatusSchema = external_exports.object({
+  state: external_exports.enum(["off", "starting", "up", "failed"]),
+  message: Text(2e3),
+  killSwitch: external_exports.boolean(),
+  /** The server's name, e.g. uk2201.nordvpn.com. */
+  server: Text(128).optional(),
+  /** What the sandbox's traffic looks like from outside, once the tunnel is up. */
+  publicIp: Text(64).optional(),
+  updatedAt: TimeSchema
+});
 
 // src/shared/io/json.ts
 import fs2 from "node:fs";
@@ -26894,20 +26982,25 @@ var scan = (schema, dir) => {
 var RunDir = class {
   root;
   sandboxFile;
+  vpnFile;
   requestsDir;
   responsesDir;
   sessionsDir;
   projectsDir;
   /** audit.processes: programs the sandbox started, in small .jsonl files the host takes in and deletes. */
   auditDir;
+  /** One-shot secrets the host hands over (see secrets.ts). Next to run, not in it: shared-use users can change run. */
+  secretsDir;
   constructor(dataDir2) {
     this.root = path6.join(dataDir2, "run");
     this.sandboxFile = path6.join(this.root, "sandbox.json");
+    this.vpnFile = path6.join(this.root, "vpn.json");
     this.requestsDir = path6.join(this.root, "requests");
     this.responsesDir = path6.join(this.root, "responses");
     this.sessionsDir = path6.join(this.root, "sessions");
     this.projectsDir = path6.join(this.root, "projects");
     this.auditDir = path6.join(this.root, "audit");
+    this.secretsDir = path6.join(dataDir2, "secrets");
   }
   requestFile(id) {
     return path6.join(this.requestsDir, safeId(id) + ".json");
@@ -26921,9 +27014,15 @@ var RunDir = class {
   projectFile(name) {
     return path6.join(this.projectsDir, safeId(name) + ".json");
   }
+  secretFile(id) {
+    return path6.join(this.secretsDir, safeId(id) + ".json");
+  }
   readSandboxStatus() {
     return readValid(SandboxStatusSchema, this.sandboxFile);
   }
+  readVpnStatus() {
+    return readValid(VpnStatusSchema, this.vpnFile);
+  }
   readSession(id) {
     return readValid(SessionStatusSchema, this.sessionFile(id));
   }
@@ -27331,9 +27430,9 @@ function writeStatus(phase, message) {
 }
 
 // src/guest/boot/boot.ts
-import fs52 from "node:fs";
-import path65 from "node:path";
-import { spawn as spawn8 } from "node:child_process";
+import fs58 from "node:fs";
+import path72 from "node:path";
+import { spawn as spawn9 } from "node:child_process";
 
 // src/guest/boot/guide.ts
 import fs10 from "node:fs";
@@ -28664,7 +28763,8 @@ var SOURCES = {
   vswhere: "VsWhere.cs",
   openssl: "OpenSsl.cs",
   cargoshim: "CargoShim.cs",
-  linkgate: "LinkGate.cs"
+  linkgate: "LinkGate.cs",
+  pathsync: "PathSync.cs"
 };
 function sourceOf(name) {
   return path30.join(launchDir, "sandbox", "csharp", SOURCES[name]);
@@ -29014,7 +29114,7 @@ async function setupUv(env) {
     { size: "20 MB" }
   );
   Object.assign(env.vars, uvVars());
-  env.prepend.push(tool("uv-bin"));
+  env.prepend.push(mkdirp(tool("uv-bin")));
 }
 
 // src/guest/toolchains/tools/cli.ts
@@ -30015,7 +30115,7 @@ async function setupPython(env, config2, versions) {
   const py3 = await installPython("python", versions.python.spec);
   const shims = shimDir(py3);
   shimPair(shims, "3", py3);
-  env.prepend.push(py3, path46.join(py3, "Scripts"), shims);
+  env.prepend.push(py3, mkdirp(path46.join(py3, "Scripts")), shims);
   env.vars.PYTHONIOENCODING = "utf-8";
   env.summary.push(
     "python: " + path46.basename(py3).replace("python-", "") + " (from " + versions.python.source + "; py works too)"
@@ -31008,12 +31108,12 @@ function parseTree(text, errors = [], options = ParseOptions.DEFAULT) {
   }
   return result;
 }
-function findNodeAtLocation(root, path67) {
+function findNodeAtLocation(root, path74) {
   if (!root) {
     return void 0;
   }
   let node2 = root;
-  for (let segment of path67) {
+  for (let segment of path74) {
     if (typeof segment === "string") {
       if (node2.type !== "object" || !Array.isArray(node2.children)) {
         return void 0;
@@ -31367,14 +31467,14 @@ function getNodeType(value) {
 
 // node_modules/jsonc-parser/lib/esm/impl/edit.js
 function setProperty(text, originalPath, value, options) {
-  const path67 = originalPath.slice();
+  const path74 = originalPath.slice();
   const errors = [];
   const root = parseTree(text, errors);
   let parent = void 0;
   let lastSegment = void 0;
-  while (path67.length > 0) {
-    lastSegment = path67.pop();
-    parent = findNodeAtLocation(root, path67);
+  while (path74.length > 0) {
+    lastSegment = path74.pop();
+    parent = findNodeAtLocation(root, path74);
     if (parent === void 0 && value !== void 0) {
       if (typeof lastSegment === "string") {
         value = { [lastSegment]: value };
@@ -31560,8 +31660,8 @@ var ParseErrorCode;
   ParseErrorCode2[ParseErrorCode2["InvalidEscapeCharacter"] = 15] = "InvalidEscapeCharacter";
   ParseErrorCode2[ParseErrorCode2["InvalidCharacter"] = 16] = "InvalidCharacter";
 })(ParseErrorCode || (ParseErrorCode = {}));
-function modify(text, path67, value, options) {
-  return setProperty(text, path67, value, options);
+function modify(text, path74, value, options) {
+  return setProperty(text, path74, value, options);
 }
 function applyEdits(text, edits) {
   let sortedEdits = edits.slice(0).sort((a, b) => {
@@ -32110,14 +32210,159 @@ async function setupToolchains(config2, versions, options, run3 = {}) {
 }
 
 // src/guest/agents/agent-installer.ts
+import fs43 from "node:fs";
+import path56 from "node:path";
+
+// src/guest/setup/environment.ts
+import path55 from "node:path";
+
+// src/guest/agents/local-state.ts
 import fs42 from "node:fs";
 import path53 from "node:path";
 
-// src/guest/setup/environment.ts
+// src/guest/agents/agent-files.ts
 import path52 from "node:path";
+function agentPaths(toolsDir2, name, harness) {
+  const dir = path52.join(toolsDir2, "agents", name);
+  const exe = harness.hostExecutable ?? (harness.uvBin ? harness.uvBin + ".exe" : null);
+  return {
+    dir,
+    exe: exe ? path52.join(dir, exe) : null,
+    cmd: harness.npmBin ? path52.join(dir, harness.npmBin + ".cmd") : null
+  };
+}
+function agentCommand(name, harness) {
+  return harness.npmBin ?? harness.uvBin ?? (harness.hostExecutable ?? name).replace(/\.exe$/i, "");
+}
+function agentShims(toolsDir2, agents2) {
+  return Object.entries(agents2).flatMap(([name, harness]) => {
+    const p = agentPaths(toolsDir2, name, harness);
+    const target = p.exe ?? p.cmd;
+    const command = agentCommand(name, harness);
+    return target && /^[A-Za-z0-9_-]+$/.test(command) && /^[A-Za-z0-9_-]+$/.test(name) ? [{ name, command, target }] : [];
+  });
+}
+function shimText(shim3, install) {
+  return [
+    "@echo off",
+    "setlocal",
+    'set "SBX_REAL=' + shim3.target + '"',
+    'if exist "%SBX_REAL%" goto run',
+    "echo " + shim3.command + " is not installed in this sandbox yet. Installing it now (one time)...",
+    '"' + install.node + '" "' + install.script + '" install ' + shim3.name,
+    "if errorlevel 1 exit /b 1",
+    ":run",
+    'endlocal & "%SBX_REAL%" %*',
+    ""
+  ].join("\r\n");
+}
+function sbxAgentText(install) {
+  return '@"' + install.node + '" "' + install.script + '" %*\r\n';
+}
+function localStateEntries(agents2, stateDir2, localRoot2) {
+  return Object.entries(agents2).flatMap(
+    ([agent, harness]) => Object.entries(harness.localState ?? {}).map(([env, folder]) => ({
+      agent,
+      env,
+      store: path52.join(stateDir2, agent, folder),
+      local: path52.join(localRoot2, agent, folder),
+      processes: [agentCommand(agent, harness) + ".exe"],
+      legacy: path52.join(stateDir2, agent)
+    }))
+  );
+}
+var isDatabaseFile = (name) => /\.(sqlite3?|db)(-wal|-shm)?$/i.test(name);
+var isCopyableDatabaseFile = (name) => isDatabaseFile(name) && !/-shm$/i.test(name);
+
+// src/guest/agents/local-state.ts
+var localRoot = () => path53.join(localDir, "agent-state");
+function agentLocalStates() {
+  return localStateEntries(session.agents ?? {}, stateDir, localRoot());
+}
+function localStateVars() {
+  return Object.fromEntries(agentLocalStates().map((s) => [s.env, s.local]));
+}
+var databaseFiles = (dir, keep) => exists(dir) ? fs42.readdirSync(dir, { withFileTypes: true }).flatMap((e) => e.isFile() && keep(e.name) ? [e.name] : []) : [];
+var copyFiles = (from, to, names) => {
+  fs42.rmSync(to, { recursive: true, force: true });
+  mkdirp(to);
+  for (const name of names) fs42.copyFileSync(path53.join(from, name), path53.join(to, name));
+};
+var swapIn = (incoming, store2) => {
+  const previous = store2 + ".previous";
+  fs42.rmSync(previous, { recursive: true, force: true });
+  if (exists(store2)) fs42.renameSync(store2, previous);
+  try {
+    fs42.renameSync(incoming, store2);
+  } catch (e) {
+    if (exists(previous)) fs42.renameSync(previous, store2);
+    throw e;
+  }
+  fs42.rmSync(previous, { recursive: true, force: true });
+};
+function adoptLegacy(s) {
+  if (exists(s.store)) return;
+  const names = databaseFiles(s.legacy, isDatabaseFile);
+  if (!names.length) return;
+  const copyable = names.filter(isCopyableDatabaseFile);
+  const incoming = s.store + ".incoming";
+  copyFiles(s.legacy, incoming, copyable);
+  swapIn(incoming, s.store);
+  const same = copyable.every(
+    (n) => fs42.statSync(path53.join(s.store, n)).size === fs42.statSync(path53.join(s.legacy, n)).size
+  );
+  if (!same) {
+    warn(s.agent + ": the copied databases differ in size from the originals; the originals were kept.");
+    return;
+  }
+  for (const n of names) fs42.rmSync(path53.join(s.legacy, n), { force: true });
+  log(s.agent + ": moved " + copyable.length + " database file(s) to " + s.store + ".");
+}
+function restoreLocalState() {
+  if (dryRun) return;
+  for (const s of agentLocalStates()) {
+    try {
+      adoptLegacy(s);
+      mkdirp(s.local);
+      const names = databaseFiles(s.store, isCopyableDatabaseFile);
+      for (const n of names) fs42.copyFileSync(path53.join(s.store, n), path53.join(s.local, n));
+      if (names.length) log(s.agent + ": databases restored to " + s.local + ".");
+    } catch (e) {
+      warn(s.agent + ": could not restore its databases (" + errMsg(e) + "); it starts with empty ones.");
+    }
+  }
+}
+
+// src/guest/setup/path-plan.ts
+import path54 from "node:path";
+function pathKey(folder) {
+  const slashes = folder.trim().replace(/^"|"$/g, "").replace(/\//g, "\\");
+  return (slashes.length > 3 ? slashes.replace(/\\+$/, "") : slashes).toLowerCase();
+}
+function splitPath(value) {
+  return value.split(";").map((part) => part.trim().replace(/^"|"$/g, "")).filter(Boolean);
+}
+function planPath(input2) {
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const entry of input2.entries.flatMap(splitPath)) {
+    const key = pathKey(entry);
+    if (seen.has(key) || input2.drop?.(entry) || !input2.exists(entry)) continue;
+    seen.add(key);
+    result.push(entry);
+  }
+  return result;
+}
+function isPinnedNodeDir(folder, nvmHome2) {
+  const key = pathKey(folder);
+  const home = pathKey(nvmHome2);
+  return key.startsWith(home + "\\") && /^v\d/.test(path54.win32.basename(key));
+}
+
+// src/guest/setup/environment.ts
 var LEGACY_HOMES = { CODEX_HOME: "codex", GEMINI_CLI_HOME: "gemini" };
 var agentHomes = () => Object.fromEntries(
-  Object.entries(session.agentHomes ?? LEGACY_HOMES).filter(([name]) => name !== "CLAUDE_CONFIG_DIR").map(([name, sub]) => [name, path52.join(stateDir, sub)])
+  Object.entries(session.agentHomes ?? LEGACY_HOMES).filter(([name]) => name !== "CLAUDE_CONFIG_DIR").map(([name, sub]) => [name, path55.join(stateDir, sub)])
 );
 var AGENT_VARS = [
   "CLAUDE_CONFIG_DIR",
@@ -32137,7 +32382,8 @@ function agentEnv(tools, target = { workspace, project: session.project, base: p
     ...tools.vars,
     CLAUDE_CONFIG_DIR: claudeDir,
     ...homes,
-    npm_config_cache: path52.join(toolsDir, "npm-cache"),
+    ...localStateVars(),
+    npm_config_cache: path55.join(toolsDir, "npm-cache"),
     npm_config_update_notifier: "false",
     AGENT_WORKSPACE: target.workspace,
     AGENT_DATA: dataDir,
@@ -32147,22 +32393,32 @@ function agentEnv(tools, target = { workspace, project: session.project, base: p
     AGENT_SANDBOX: "1",
     AGENT_SANDBOX_WORKSPACE: target.workspace
   };
-  for (const dir of [env.CLAUDE_CONFIG_DIR, ...Object.keys(homes).map((n) => env[n]), env.npm_config_cache])
+  const local = Object.keys(localStateVars());
+  for (const dir of [
+    env.CLAUDE_CONFIG_DIR,
+    ...Object.keys(homes).map((n) => env[n]),
+    env.npm_config_cache,
+    ...local.map((n) => env[n])
+  ])
     mkdirp(dir);
-  const runners = [path52.join(toolsDir, "node"), path52.dirname(process.execPath)].map((d) => d.toLowerCase());
-  const base = (target.base.PATH ?? "").split(path52.delimiter).filter((d) => d && !runners.includes(d.toLowerCase()));
-  env.PATH = [.../* @__PURE__ */ new Set([...tools.prepend, ...base, ...tools.append])].join(path52.delimiter);
+  const runners = [path55.join(toolsDir, "node"), path55.dirname(process.execPath)].map((d) => d.toLowerCase());
+  const base = (target.base.PATH ?? "").split(path55.delimiter).filter((d) => d && !runners.includes(d.toLowerCase()));
+  env.PATH = [.../* @__PURE__ */ new Set([...tools.prepend, ...base, ...tools.append])].join(path55.delimiter);
   return env;
 }
 function persistEnvironment(env, toolVars2) {
   if (!isWin || dryRun || testMode) return;
   const vars = Object.fromEntries(
-    [...toolVars2, ...AGENT_VARS, ...Object.keys(agentHomes())].filter((n) => env[n] !== void 0).map((n) => [n, env[n]])
+    [...toolVars2, ...AGENT_VARS, ...Object.keys(agentHomes()), ...Object.keys(localStateVars())].filter((n) => env[n] !== void 0).map((n) => [n, env[n]])
   );
   try {
     runScriptWithJson("set-machine-environment.ps1", "SettingsFile", {
       vars,
-      path: env.PATH ?? "",
+      path: planPath({
+        entries: [env.PATH ?? "", ...installedAgentDirs()],
+        exists,
+        drop: (dir) => isPinnedNodeDir(dir, nvmHome())
+      }).join(path55.delimiter),
       add: [],
       additive: false
     });
@@ -32172,12 +32428,20 @@ function persistEnvironment(env, toolVars2) {
 }
 function addMachineEnvironment(vars, dirs, additive = false) {
   if (!isWin || dryRun || testMode) return;
+  const planned = planPath({ entries: dirs, exists, drop: (dir) => isPinnedNodeDir(dir, nvmHome()) });
   try {
-    runScriptWithJson("set-machine-environment.ps1", "SettingsFile", { vars, path: null, add: dirs, additive });
+    runScriptWithJson("set-machine-environment.ps1", "SettingsFile", { vars, path: null, add: planned, additive });
   } catch (e) {
     warn("Could not add to the environment: " + errMsg(e));
   }
 }
+var nvmHome = () => path55.join(toolsDir, "nvm");
+function installedAgentDirs() {
+  return Object.entries(session.agents ?? {}).flatMap(([name, harness]) => {
+    const p = agentPaths(toolsDir, name, harness);
+    return p.exe && exists(p.exe) || p.cmd && exists(p.cmd) ? [p.dir] : [];
+  });
+}
 
 // src/guest/agents/profile-links.ts
 var profileRoot = () => process.env.USERPROFILE ?? "";
@@ -32199,19 +32463,11 @@ function linkHarnessProfile(name, harness) {
 }
 
 // src/guest/agents/agent-installer.ts
-function agentPaths(name, harness) {
-  const dir = path53.join(toolsDir, "agents", name);
-  const exe = harness.hostExecutable ?? (harness.uvBin ? harness.uvBin + ".exe" : null);
-  return {
-    dir,
-    exe: exe ? path53.join(dir, exe) : null,
-    cmd: harness.npmBin ? path53.join(dir, harness.npmBin + ".cmd") : null
-  };
-}
+var agentPaths2 = (name, harness) => agentPaths(toolsDir, name, harness);
 async function installViaNpm(name, harness, dir, env) {
   if (!harness.npmPackage)
     throw new Error("No npmPackage configured for " + name + " and no host executable was available.");
-  const npmCli = path53.join(path53.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+  const npmCli = path56.join(path56.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
   const args = [npmCli, "install", "--global", "--prefix", dir, harness.npmPackage, "--no-fund", "--no-audit"];
   log("Installing " + harness.npmPackage + " (this can take a minute)...");
   if (dryRun) {
@@ -32222,7 +32478,7 @@ async function installViaNpm(name, harness, dir, env) {
   await execAsync(process.execPath, args, { env });
 }
 async function installViaUv(name, harness, dir, env) {
-  const uv = path53.join(toolsDir, "uv", "uv.exe");
+  const uv = path56.join(toolsDir, "uv", "uv.exe");
   log("Installing " + harness.uvPackage + " with uv (this can take a minute)...");
   if (dryRun) {
     log("(dry run) uv tool install " + harness.uvPackage);
@@ -32237,8 +32493,8 @@ async function installViaUv(name, harness, dir, env) {
   });
 }
 function putOnPath(dir, env) {
-  const parts2 = (env.PATH ?? "").split(path53.delimiter);
-  if (!parts2.some((p) => p.toLowerCase() === dir.toLowerCase())) env.PATH = [...parts2, dir].join(path53.delimiter);
+  const parts2 = (env.PATH ?? "").split(path56.delimiter);
+  if (!parts2.some((p) => p.toLowerCase() === dir.toLowerCase())) env.PATH = [...parts2, dir].join(path56.delimiter);
   addMachineEnvironment({}, [dir], true);
 }
 var AgentInstaller = class {
@@ -32252,13 +32508,13 @@ var AgentInstaller = class {
     const current = this.installing.get(name);
     if (current) return current;
     linkHarnessProfile(name, harness);
-    const work = this.install(name, harness, env, refresh).then(() => putOnPath(agentPaths(name, harness).dir, env)).finally(() => this.installing.delete(name));
+    const work = this.install(name, harness, env, refresh).then(() => putOnPath(agentPaths2(name, harness).dir, env)).finally(() => this.installing.delete(name));
     this.installing.set(name, work);
     return work;
   }
   /** Program + arguments that start the agent (an npm .cmd shim has to go through cmd.exe). */
   resolveLaunch(name, harness) {
-    const p = agentPaths(name, harness);
+    const p = agentPaths2(name, harness);
     if (p.exe && exists(p.exe)) return { file: p.exe, args: [] };
     if (p.cmd && exists(p.cmd))
       return isWin ? { file: SYSTEM.cmd(), args: ["/d", "/c", p.cmd] } : { file: p.cmd, args: [] };
@@ -32271,7 +32527,7 @@ var AgentInstaller = class {
     return harness.uvPackage && !harness.npmPackage ? "uv" : "npm";
   }
   async install(name, harness, env, refresh) {
-    const p = agentPaths(name, harness);
+    const p = agentPaths2(name, harness);
     const cached2 = p.exe !== null && exists(p.exe) || p.cmd !== null && exists(p.cmd);
     if (cached2 && !refresh) {
       log(name + " already cached in persistent storage.");
@@ -32279,9 +32535,9 @@ var AgentInstaller = class {
     }
     mkdirp(p.dir);
     if (this.sourceOf(name, harness) === "host") {
-      const source = path53.join(hostToolsDir, "agents", name, harness.hostExecutable);
+      const source = path56.join(hostToolsDir, "agents", name, harness.hostExecutable);
       if (exists(source) && p.exe) {
-        fs42.copyFileSync(source, p.exe);
+        fs43.copyFileSync(source, p.exe);
         log("Copied " + name + " from this PC: " + source);
         return;
       }
@@ -32295,28 +32551,45 @@ var AgentInstaller = class {
 };
 var agents = new AgentInstaller();
 
+// src/guest/setup/shell-path.ts
+import fs44 from "node:fs";
+import path57 from "node:path";
+function installShellPath() {
+  if (!isWin || dryRun || testMode) return;
+  const helper = path57.join(mkdirp(path57.join(localDir, "bin")), "pathsync.exe");
+  fs44.copyFileSync(ensureCompiled("pathsync"), helper);
+  runScript("install-shell-path.ps1", [
+    "-Helper",
+    helper,
+    "-PwshDir",
+    path57.join(toolsDir, "pwsh"),
+    "-GitRoot",
+    path57.join(toolsDir, "git")
+  ]);
+}
+
 // src/guest/setup/claude-mem.ts
-import fs43 from "node:fs";
+import fs45 from "node:fs";
 import os9 from "node:os";
-import path54 from "node:path";
+import path58 from "node:path";
 var claudeMemPaths = {
-  store: path54.join(stateDir, "claude-mem"),
-  local: path54.join(os9.homedir(), ".claude-mem")
+  store: path58.join(stateDir, "claude-mem"),
+  local: path58.join(os9.homedir(), ".claude-mem")
 };
 var claudeMemEnabled = () => session.claudeProfile.syncClaudeMem && !dryRun;
 function restoreClaudeMem() {
   if (!claudeMemEnabled()) return;
   const previous = claudeMemPaths.store + ".previous";
-  if (!exists(claudeMemPaths.store) && exists(previous)) fs43.renameSync(previous, claudeMemPaths.store);
+  if (!exists(claudeMemPaths.store) && exists(previous)) fs45.renameSync(previous, claudeMemPaths.store);
   const backups = claudeMemPaths.store + ".backups";
-  if (!looksLikeSqlite(path54.join(claudeMemPaths.store, "claude-mem.db")) || !exists(claudeMemPaths.store)) {
-    const good = (exists(backups) ? fs43.readdirSync(backups).sort().reverse() : []).find(
-      (b) => exists(path54.join(backups, b, "claude-mem.db")) && looksLikeSqlite(path54.join(backups, b, "claude-mem.db"))
+  if (!looksLikeSqlite(path58.join(claudeMemPaths.store, "claude-mem.db")) || !exists(claudeMemPaths.store)) {
+    const good = (exists(backups) ? fs45.readdirSync(backups).sort().reverse() : []).find(
+      (b) => exists(path58.join(backups, b, "claude-mem.db")) && looksLikeSqlite(path58.join(backups, b, "claude-mem.db"))
     );
     if (good) {
       if (exists(claudeMemPaths.store))
-        fs43.renameSync(claudeMemPaths.store, claudeMemPaths.store + ".damaged-" + Date.now());
-      fs43.cpSync(path54.join(backups, good), claudeMemPaths.store, { recursive: true });
+        fs45.renameSync(claudeMemPaths.store, claudeMemPaths.store + ".damaged-" + Date.now());
+      fs45.cpSync(path58.join(backups, good), claudeMemPaths.store, { recursive: true });
       warn(
         "claude-mem: the stored database was missing or damaged; restored the backup from " + new Date(Number(good)).toISOString() + "."
       );
@@ -32329,33 +32602,33 @@ function restoreClaudeMem() {
 var SQLITE_HEADER = "SQLite format 3\0";
 var looksLikeSqlite = (file3) => {
   if (!exists(file3)) return true;
-  const fd = fs43.openSync(file3, "r");
+  const fd = fs45.openSync(file3, "r");
   try {
     const head = Buffer.alloc(16);
-    return fs43.readSync(fd, head, 0, 16, 0) === 16 && head.toString("latin1") === SQLITE_HEADER;
+    return fs45.readSync(fd, head, 0, 16, 0) === 16 && head.toString("latin1") === SQLITE_HEADER;
   } finally {
-    fs43.closeSync(fd);
+    fs45.closeSync(fd);
   }
 };
 var BACKUP_EVERY_MS = 6 * 3600 * 1e3;
 
 // src/guest/setup/claude-profile.ts
-import fs44 from "node:fs";
-import path55 from "node:path";
+import fs46 from "node:fs";
+import path59 from "node:path";
 var KEEP_SANDBOX_COPY = [".claude.json", ".credentials.json"];
 var fixPluginPaths = (hostConfigDir) => {
-  const plugins = path55.join(claudeDir, "plugins");
+  const plugins = path59.join(claudeDir, "plugins");
   if (!hostConfigDir || !exists(plugins)) return;
-  for (const name of fs44.readdirSync(plugins).filter((f) => f.endsWith(".json"))) {
-    const file3 = path55.join(plugins, name);
-    const text = fs44.readFileSync(file3, "utf8");
+  for (const name of fs46.readdirSync(plugins).filter((f) => f.endsWith(".json"))) {
+    const file3 = path59.join(plugins, name);
+    const text = fs46.readFileSync(file3, "utf8");
     const fixed = translatePaths(text, hostConfigDir, claudeDir);
-    if (fixed !== text) fs44.writeFileSync(file3, fixed, "utf8");
+    if (fixed !== text) fs46.writeFileSync(file3, fixed, "utf8");
   }
 };
 var readState2 = (file3) => {
   try {
-    return JSON.parse(fs44.readFileSync(file3, "utf8").replace(/^\uFEFF/, ""));
+    return JSON.parse(fs46.readFileSync(file3, "utf8").replace(/^\uFEFF/, ""));
   } catch {
     return null;
   }
@@ -32380,30 +32653,37 @@ function mergeMcpServers(hostFile, guestFile, hostWorkspace, guestWorkspace) {
   writeJsonAtomic(guestFile, merged);
   return Object.keys(host.mcpServers ?? {}).length + Object.keys(hostProject).length;
 }
-function syncClaudeProfile() {
+function syncClaudeProfile(credentials) {
   const profile = session.claudeProfile;
   if (profile.items.length === 0) {
     log("No Claude settings were staged from this PC.");
     return;
   }
-  const source = path55.join(launchDir, "claude-profile");
+  const source = path59.join(launchDir, "claude-profile");
   mkdirp(claudeDir);
   for (const name of profile.items) {
-    const from = path55.join(source, name);
-    const to = path55.join(claudeDir, name);
+    const from = path59.join(source, name);
+    const to = path59.join(claudeDir, name);
+    if (name === ".credentials.json") {
+      if (credentials && !exists(to)) {
+        fs46.writeFileSync(to, credentials, "utf8");
+        log("Claude settings: copied " + name + " from this PC");
+      } else log("Claude settings: kept the sandbox's " + name);
+      continue;
+    }
     if (!exists(from)) continue;
     if ((KEEP_SANDBOX_COPY.includes(name) || !profile.overwrite) && exists(to)) {
       log("Claude settings: kept the sandbox's " + name);
       continue;
     }
-    if (fs44.statSync(from).isDirectory()) safeRemove(to, claudeDir);
-    fs44.cpSync(from, to, { recursive: true, force: true });
+    if (fs46.statSync(from).isDirectory()) safeRemove(to, claudeDir);
+    fs46.cpSync(from, to, { recursive: true, force: true });
     log("Claude settings: copied " + name + " from this PC");
   }
   fixPluginPaths(profile.hostConfigDir);
   const mcp = mergeMcpServers(
-    path55.join(source, ".claude.json"),
-    path55.join(claudeDir, ".claude.json"),
+    path59.join(source, ".claude.json"),
+    path59.join(claudeDir, ".claude.json"),
     session.workspaceHost,
     workspace
   );
@@ -32412,11 +32692,11 @@ function syncClaudeProfile() {
 }
 
 // src/guest/setup/hooks.ts
-import fs45 from "node:fs";
-import path56 from "node:path";
+import fs47 from "node:fs";
+import path60 from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 var commandFor = (file3) => {
-  const ext = path56.extname(file3).toLowerCase();
+  const ext = path60.extname(file3).toLowerCase();
   if (ext === ".mjs" || ext === ".js") return [process.execPath, [file3]];
   if (!isWin) return null;
   if (ext === ".ps1")
@@ -32424,12 +32704,12 @@ var commandFor = (file3) => {
   if (ext === ".cmd" || ext === ".bat") return [SYSTEM.cmd(), ["/d", "/c", file3]];
   return null;
 };
-var BOOT = { root: path56.join(launchDir, "hooks"), cwd: workspace };
+var BOOT = { root: path60.join(launchDir, "hooks"), cwd: workspace };
 var hooksOf = (stage, target) => {
-  const dir = path56.join(target.root, stage);
+  const dir = path60.join(target.root, stage);
   if (!exists(dir)) return [];
-  return fs45.readdirSync(dir).sort().flatMap((name) => {
-    const command = commandFor(path56.join(dir, name));
+  return fs47.readdirSync(dir).sort().flatMap((name) => {
+    const command = commandFor(path60.join(dir, name));
     return command ? [{ name, command }] : [];
   });
 };
@@ -32447,8 +32727,8 @@ function runHooks(stage, env, target = BOOT) {
 }
 
 // src/guest/network/allow-only.ts
-import fs47 from "node:fs";
-import path58 from "node:path";
+import fs49 from "node:fs";
+import path62 from "node:path";
 import { spawn as spawn6, spawnSync as spawnSync6 } from "node:child_process";
 
 // src/shared/network/policy.ts
@@ -32543,8 +32823,8 @@ var PROXY_PORT = 38080;
 
 // src/guest/network/firewall.ts
 import dns from "node:dns";
-import fs46 from "node:fs";
-import path57 from "node:path";
+import fs48 from "node:fs";
+import path61 from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 
 // src/shared/network/firewall-rules.ts
@@ -32783,12 +33063,12 @@ async function applyNetworkPolicy(ptyHostExe) {
   return "blocked";
 }
 var FORWARD_RULE = "AgentSandbox-Forward";
-var HOSTS_FILE = path57.join(process.env.WINDIR ?? "C:\\Windows", "System32", "drivers", "etc", "hosts");
+var HOSTS_FILE = path61.join(process.env.WINDIR ?? "C:\\Windows", "System32", "drivers", "etc", "hosts");
 var applyBlockedHosts = () => {
   const hosts = session.network.blockHosts ?? [];
   if (!hosts.length) return;
-  const text = fs46.existsSync(HOSTS_FILE) ? fs46.readFileSync(HOSTS_FILE, "utf8") : "";
-  fs46.writeFileSync(HOSTS_FILE, withBlockedHosts(text, hosts));
+  const text = fs48.existsSync(HOSTS_FILE) ? fs48.readFileSync(HOSTS_FILE, "utf8") : "";
+  fs48.writeFileSync(HOSTS_FILE, withBlockedHosts(text, hosts));
   log("Blocked hosts (network.blockHosts): " + hosts.join(", "));
 };
 var applyDns = () => {
@@ -32843,11 +33123,11 @@ async function applyAllowOnly() {
     log("(dry run) would allow only: " + hosts.join(", "));
     return false;
   }
-  const exe = path58.join(toolsDir, "netproxy", "sbx-netproxy.exe");
-  fs47.mkdirSync(path58.dirname(exe), { recursive: true });
-  if (!fs47.existsSync(exe) || fs47.statSync(exe).size !== fs47.statSync(process.execPath).size)
-    fs47.copyFileSync(process.execPath, exe);
-  spawn6(exe, [path58.join(launchDir, "runtime", "netproxy.js")], {
+  const exe = path62.join(toolsDir, "netproxy", "sbx-netproxy.exe");
+  fs49.mkdirSync(path62.dirname(exe), { recursive: true });
+  if (!fs49.existsSync(exe) || fs49.statSync(exe).size !== fs49.statSync(process.execPath).size)
+    fs49.copyFileSync(process.execPath, exe);
+  spawn6(exe, [path62.join(launchDir, "runtime", "netproxy.js")], {
     detached: true,
     stdio: "ignore",
     windowsHide: true
@@ -32891,8 +33171,8 @@ async function applyAllowOnly() {
 }
 
 // src/guest/setup/managed-policy.ts
-import fs48 from "node:fs";
-import path59 from "node:path";
+import fs50 from "node:fs";
+import path63 from "node:path";
 
 // src/guest/setup/git-rules.ts
 var SHELLS = ["Bash", "PowerShell"];
@@ -32949,44 +33229,44 @@ function gitDenyRules(access) {
 
 // src/guest/setup/managed-policy.ts
 function managedSettingsFile() {
-  return path59.join(path59.dirname(managedClaudeMd()), "managed-settings.json");
+  return path63.join(path63.dirname(managedClaudeMd()), "managed-settings.json");
 }
 function writeManagedSettings2(access) {
   const file3 = managedSettingsFile();
   const deny = gitDenyRules(access);
   if (deny.length === 0) {
-    fs48.rmSync(file3, { force: true });
+    fs50.rmSync(file3, { force: true });
     return;
   }
-  fs48.mkdirSync(path59.dirname(file3), { recursive: true });
-  fs48.writeFileSync(file3, JSON.stringify({ permissions: { deny } }, null, 2) + "\n", "utf8");
+  fs50.mkdirSync(path63.dirname(file3), { recursive: true });
+  fs50.writeFileSync(file3, JSON.stringify({ permissions: { deny } }, null, 2) + "\n", "utf8");
 }
 
 // src/guest/setup/desktop.ts
-import fs49 from "node:fs";
+import fs51 from "node:fs";
 import os10 from "node:os";
-import path60 from "node:path";
+import path64 from "node:path";
 function applyPersonalization() {
-  const dir = path60.join(launchDir, "personalize");
+  const dir = path64.join(launchDir, "personalize");
   if (!session.personalization || !exists(dir) || dryRun || !isWin) return;
-  exec(SYSTEM.reg(), ["import", path60.join(dir, "personalize.reg")], { stdio: "ignore" });
-  const wallpaper = fs49.readdirSync(dir).find((f) => f.startsWith("wallpaper"));
-  const local = wallpaper ? path60.join(mkdirp(path60.join(os10.homedir(), "Pictures")), wallpaper) : null;
-  if (wallpaper && local) fs49.copyFileSync(path60.join(dir, wallpaper), local);
+  exec(SYSTEM.reg(), ["import", path64.join(dir, "personalize.reg")], { stdio: "ignore" });
+  const wallpaper = fs51.readdirSync(dir).find((f) => f.startsWith("wallpaper"));
+  const local = wallpaper ? path64.join(mkdirp(path64.join(os10.homedir(), "Pictures")), wallpaper) : null;
+  if (wallpaper && local) fs51.copyFileSync(path64.join(dir, wallpaper), local);
   runScript("set-desktop.ps1", local ? ["-Wallpaper", local] : []);
   log("Desktop personalisation applied from this PC.");
 }
 
 // src/guest/setup/git-identity.ts
-import fs50 from "node:fs";
+import fs52 from "node:fs";
 import os11 from "node:os";
-import path61 from "node:path";
+import path65 from "node:path";
 import { spawnSync as spawnSync7 } from "node:child_process";
 function setupGitConfig(env) {
   if (dryRun) return;
-  const source = path61.join(launchDir, "home", ".gitconfig");
-  if (exists(source)) fs50.copyFileSync(source, path61.join(os11.homedir(), ".gitconfig"));
-  const git = path61.join(toolsDir, "git", "cmd", "git.exe");
+  const source = path65.join(launchDir, "home", ".gitconfig");
+  if (exists(source)) fs52.copyFileSync(source, path65.join(os11.homedir(), ".gitconfig"));
+  const git = path65.join(toolsDir, "git", "cmd", "git.exe");
   if (!exists(git)) return;
   const { GIT_DIR: _gitDir, ...rest } = env;
   spawnSync7(git, ["config", "--global", "--add", "safe.directory", "*"], {
@@ -33004,35 +33284,35 @@ function ensurePtyHost() {
 }
 
 // src/guest/toolchains/leftovers.ts
-import fs51 from "node:fs";
-import path62 from "node:path";
+import fs53 from "node:fs";
+import path66 from "node:path";
 var STAGING = /\.staging-[0-9a-f]+$/i;
 var entries2 = (dir) => {
   try {
-    return fs51.readdirSync(dir, { withFileTypes: true });
+    return fs53.readdirSync(dir, { withFileTypes: true });
   } catch {
     return [];
   }
 };
 function pruneToolLeftovers() {
-  for (const legacy of ["ptyhost", "gitshim"]) safeRemove(path62.join(toolsDir, legacy), toolsDir);
+  for (const legacy of ["ptyhost", "gitshim"]) safeRemove(path66.join(toolsDir, legacy), toolsDir);
   for (const top of entries2(toolsDir)) {
-    const dir = path62.join(toolsDir, top.name);
+    const dir = path66.join(toolsDir, top.name);
     if (STAGING.test(top.name)) safeRemove(dir, toolsDir);
     else if (top.isDirectory())
-      for (const sub of entries2(dir).filter((e) => STAGING.test(e.name))) safeRemove(path62.join(dir, sub.name), dir);
+      for (const sub of entries2(dir).filter((e) => STAGING.test(e.name))) safeRemove(path66.join(dir, sub.name), dir);
   }
 }
 
 // src/guest/audit/process-audit.ts
-import path63 from "node:path";
+import path67 from "node:path";
 import { spawnSync as spawnSync8 } from "node:child_process";
 var PROCESS_CREATION = "{0CCE922B-69AE-11D9-BED3-505054503030}";
 var auditOn = () => Boolean(session.auditProcesses) && isWin && !dryRun;
 function enableProcessAudit() {
   if (!auditOn()) return;
   spawnSync8(
-    path63.join(process.env.WINDIR ?? "C:\\Windows", "System32", "auditpol.exe"),
+    path67.join(process.env.WINDIR ?? "C:\\Windows", "System32", "auditpol.exe"),
     ["/set", "/subcategory:" + PROCESS_CREATION, "/success:enable"],
     { windowsHide: true, stdio: "ignore" }
   );
@@ -33054,6 +33334,497 @@ function enableProcessAudit() {
   log("Audit: programs started in the sandbox are recorded (audit.processes).");
 }
 
+// src/guest/vpn/vpn.ts
+import dns2 from "node:dns";
+import fs56 from "node:fs";
+import os13 from "node:os";
+import path70 from "node:path";
+
+// src/shared/vpn/ovpn.ts
+var PROGRAM_DIRECTIVES = [
+  "script-security",
+  "up",
+  "down",
+  "up-restart",
+  "down-pre",
+  "route-up",
+  "route-pre-down",
+  "ipchange",
+  "tls-verify",
+  "plugin",
+  "client-connect",
+  "client-disconnect",
+  "learn-address",
+  "auth-user-pass-verify",
+  "setenv-safe",
+  "management",
+  "management-client",
+  "management-client-auth",
+  "management-hold",
+  "management-query-passwords",
+  "config",
+  "daemon",
+  "service",
+  "cd",
+  "chroot",
+  "setcon",
+  "log",
+  "log-append",
+  "writepid",
+  "status",
+  "askpass",
+  "engine",
+  "bcast-dev",
+  "dev-node",
+  "cryptoapicert",
+  "pkcs11-providers",
+  "pkcs12",
+  "http-proxy-user-pass",
+  "tmp-dir"
+];
+var ALLOWED = /* @__PURE__ */ new Set([
+  "client",
+  "tls-client",
+  "dev",
+  "dev-type",
+  "proto",
+  "remote",
+  "remote-random",
+  "remote-random-hostname",
+  "resolv-retry",
+  "nobind",
+  "persist-key",
+  "persist-tun",
+  "remote-cert-tls",
+  "remote-cert-eku",
+  "ns-cert-type",
+  "verify-x509-name",
+  "cipher",
+  "data-ciphers",
+  "data-ciphers-fallback",
+  "ncp-ciphers",
+  "auth",
+  "verb",
+  "mute",
+  "mute-replay-warnings",
+  "reneg-sec",
+  "reneg-bytes",
+  "reneg-pkts",
+  "tun-mtu",
+  "tun-mtu-extra",
+  "ping-timer-rem",
+  "fast-io",
+  "tls-timeout",
+  "push-peer-info",
+  "comp-noadapt",
+  "link-mtu",
+  "fragment",
+  "mssfix",
+  "sndbuf",
+  "rcvbuf",
+  "comp-lzo",
+  "compress",
+  "allow-compression",
+  "key-direction",
+  "auth-user-pass",
+  "auth-nocache",
+  "explicit-exit-notify",
+  "pull",
+  "pull-filter",
+  "route-nopull",
+  "route",
+  "route-ipv6",
+  "route-delay",
+  "route-metric",
+  "redirect-gateway",
+  "redirect-private",
+  "dhcp-option",
+  "block-outside-dns",
+  "register-dns",
+  "topology",
+  "tls-version-min",
+  "tls-version-max",
+  "tls-cipher",
+  "tls-ciphersuites",
+  "tls-groups",
+  "tls-exit",
+  "ping",
+  "ping-restart",
+  "ping-exit",
+  "keepalive",
+  "connect-retry",
+  "connect-retry-max",
+  "connect-timeout",
+  "server-poll-timeout",
+  "float",
+  "ifconfig-nowarn",
+  "tun-ipv6",
+  "disable-dco",
+  "windows-driver",
+  "ignore-unknown-option",
+  "opt-verify",
+  "setenv",
+  "key-method",
+  "replay-window",
+  "hand-window",
+  "tran-window",
+  "inactive",
+  "socket-flags",
+  "auth-retry",
+  "ca",
+  "cert",
+  "key",
+  "tls-auth",
+  "tls-crypt",
+  "tls-crypt-v2",
+  "extra-certs",
+  "dh"
+]);
+var FILE_DIRECTIVES = /* @__PURE__ */ new Set(["ca", "cert", "key", "tls-auth", "tls-crypt", "tls-crypt-v2", "extra-certs", "dh"]);
+var BLOCKS = /* @__PURE__ */ new Set(["ca", "cert", "key", "tls-auth", "tls-crypt", "tls-crypt-v2", "extra-certs", "dh"]);
+var MAX_OVPN_BYTES = 256 * 1024;
+var MAX_LINES = 4e3;
+var HOST = /^(?:\d{1,3}(?:\.\d{1,3}){3}|[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?)$/;
+function directiveOf(line) {
+  const text = line.replace(/^\uFEFF/, "").trim();
+  if (text === "" || text.startsWith("#") || text.startsWith(";")) return null;
+  const parts2 = text.replace(/^-+/, "").split(/\s+/);
+  return { name: parts2[0].toLowerCase(), args: parts2.slice(1) };
+}
+function inspectOvpn(text) {
+  const problems = [];
+  const found = [];
+  const refuse = (message) => {
+    if (problems.length < 20 && !problems.includes(message)) problems.push(message);
+  };
+  if (Buffer.byteLength(text, "utf8") > MAX_OVPN_BYTES) return { ok: false, problems: ["the file is too big"] };
+  if (text.includes("\0")) return { ok: false, problems: ["the file is not text"] };
+  const lines = text.split(/\r?\n/);
+  if (lines.length > MAX_LINES) return { ok: false, problems: ["the file has too many lines"] };
+  let block = null;
+  let defaultProto = "udp";
+  lines.forEach((line, i) => {
+    const at = "line " + (i + 1) + ": ";
+    const trimmed = line.trim();
+    if (block) {
+      if (trimmed.toLowerCase() === "</" + block + ">") block = null;
+      else if (/^<\/?[A-Za-z-]+>$/.test(trimmed)) refuse(at + "a section inside a section");
+      return;
+    }
+    const open2 = /^<([A-Za-z0-9-]+)>$/.exec(trimmed);
+    if (open2) {
+      const tag = open2[1].toLowerCase();
+      if (!BLOCKS.has(tag)) refuse(at + "<" + tag + "> is not allowed");
+      block = tag;
+      return;
+    }
+    const d = directiveOf(line);
+    if (!d) return;
+    if (!/^[a-z0-9-]{1,40}$/.test(d.name)) return refuse(at + "a directive name with odd characters");
+    if (PROGRAM_DIRECTIVES.includes(d.name))
+      return refuse(at + d.name + " runs a program or reads or writes a file on this machine");
+    if (!ALLOWED.has(d.name)) return refuse(at + d.name + " is not on the list of settings that are safe to accept");
+    if (FILE_DIRECTIVES.has(d.name))
+      return refuse(at + d.name + " names a file: certificates must be inside the profile");
+    if (d.name === "auth-user-pass" && d.args.length > 0)
+      return refuse(at + "auth-user-pass names a file: the login is given separately");
+    if (d.name === "setenv" && !(d.args[0] === "CLIENT_CERT" && d.args.length === 2))
+      return refuse(at + "setenv may only be CLIENT_CERT");
+    if (d.name === "proto") defaultProto = d.args[0]?.startsWith("tcp") ? "tcp" : "udp";
+    if (d.name === "remote") {
+      const [host, port = "1194", proto] = d.args;
+      if (!host || !HOST.test(host)) return refuse(at + "remote needs a host name or an IPv4 address");
+      const n = Number(port);
+      if (!Number.isInteger(n) || n < 1 || n > 65535) return refuse(at + "remote has an invalid port");
+      found.push({ host, port: n, ...proto ? { proto: proto.startsWith("tcp") ? "tcp" : "udp" } : {} });
+    }
+  });
+  const remotes = found.map((r) => ({ host: r.host, port: r.port, proto: r.proto ?? defaultProto }));
+  if (block) refuse("a <" + block + "> section is never closed");
+  if (remotes.length === 0) refuse("it names no remote server");
+  if (remotes.length > 64) refuse("it names too many servers");
+  return problems.length ? { ok: false, problems } : { ok: true, remotes };
+}
+function assertSafeOvpn(text, what) {
+  const report = inspectOvpn(text);
+  if (report.ok) return report.remotes;
+  throw new Error(
+    what + " was refused because it could run programs or is not a plain profile:\n  - " + report.problems.slice(0, 5).join("\n  - ")
+  );
+}
+
+// src/shared/vpn/kill-switch.ts
+var VPN_RULE_PREFIX = "AgentSandbox-VPN-";
+var rule = (name, extra) => [
+  "advfirewall",
+  "firewall",
+  "add",
+  "rule",
+  "name=" + VPN_RULE_PREFIX + name,
+  "dir=out",
+  "action=allow",
+  "enable=yes",
+  "profile=any",
+  ...extra
+];
+var drop = (name) => [
+  "advfirewall",
+  "firewall",
+  "delete",
+  "rule",
+  "name=" + VPN_RULE_PREFIX + name
+];
+function ruleNames(serverCount) {
+  return [
+    "Loopback",
+    "DHCP",
+    "Host",
+    "Tunnel",
+    ...Array.from({ length: Math.max(serverCount, 0) }, (_v, i) => "Server-" + (i + 1))
+  ];
+}
+function cleanServers(servers) {
+  const seen = /* @__PURE__ */ new Set();
+  return servers.filter((s) => {
+    const key = s.proto + ":" + s.ip + ":" + s.port;
+    if (!isIPv4(s.ip) || !Number.isInteger(s.port) || s.port < 1 || s.port > 65535 || seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function killSwitchCommands(servers, ptyHostExe) {
+  const list = cleanServers(servers);
+  return [
+    ...ruleNames(Math.max(list.length, 8)).map(drop),
+    ["advfirewall", "set", "allprofiles", "state", "on"],
+    ["advfirewall", "set", "allprofiles", "firewallpolicy", "blockinbound,blockoutbound"],
+    rule("Loopback", ["protocol=any", "remoteip=127.0.0.0/8"]),
+    rule("DHCP", ["protocol=udp", "localport=68", "remoteport=67"]),
+    ...ptyHostExe ? [rule("Host", ["protocol=any", "remoteip=LocalSubnet", "program=" + ptyHostExe])] : [],
+    ...list.map(
+      (s, i) => rule("Server-" + (i + 1), ["protocol=" + s.proto, "remoteip=" + s.ip, "remoteport=" + s.port])
+    )
+  ];
+}
+function tunnelCommands(tunnelIp) {
+  if (!isIPv4(tunnelIp)) throw new Error("Not an IPv4 address: " + tunnelIp);
+  return [drop("Tunnel"), rule("Tunnel", ["protocol=any", "localip=" + tunnelIp])];
+}
+function tunnelAddressFromLog(log2) {
+  const add = /net_addr_v4_add:\s*(\d{1,3}(?:\.\d{1,3}){3})\/\d+/.exec(log2);
+  if (add && isIPv4(add[1])) return add[1];
+  const ifconfig = /(?:ifconfig|ip addr add|Notified TAP-Windows driver to set a DHCP IP\/netmask of)\s+(\d{1,3}(?:\.\d{1,3}){3})/i.exec(
+    log2
+  );
+  return ifconfig && isIPv4(ifconfig[1]) ? ifconfig[1] : null;
+}
+
+// src/guest/vpn/openvpn.ts
+import crypto4 from "node:crypto";
+import fs54 from "node:fs";
+import path68 from "node:path";
+
+// src/shared/vpn/download.ts
+var OPENVPN_MSI = {
+  version: "2.7.8",
+  x64: {
+    file: "OpenVPN-2.7.8-I001-amd64.msi",
+    sha256: "1ea61a3056905b90607d4b0f084c04e5cf3043e07cf192d9cd44b0474f29cc49"
+  },
+  arm64: {
+    file: "OpenVPN-2.7.8-I001-arm64.msi",
+    sha256: "6fc0e8899cc5275ee297fb837bc84aa2bc49f8ef96d7ad93ee3fee1e7163a25c"
+  },
+  base: "https://swupdate.openvpn.org/community/releases/"
+};
+
+// src/guest/vpn/openvpn.ts
+function openvpnExe(env = process.env) {
+  return path68.join(env.ProgramFiles ?? "C:\\Program Files", "OpenVPN", "bin", "openvpn.exe");
+}
+function openvpnDownload(arch2 = process.arch) {
+  const entry = arch2 === "arm64" ? OPENVPN_MSI.arm64 : OPENVPN_MSI.x64;
+  return { ...entry, url: OPENVPN_MSI.base + entry.file };
+}
+var hasHash = (file3, sha256) => crypto4.createHash("sha256").update(fs54.readFileSync(file3)).digest("hex") === sha256;
+async function ensureOpenVpn() {
+  const exe = openvpnExe();
+  if (!isWin || dryRun) return exe;
+  if (exists(exe)) return exe;
+  const dl = openvpnDownload();
+  const msi = path68.join(mkdirp(path68.join(toolsDir, "downloads")), dl.file);
+  if (!exists(msi) || !hasHash(msi, dl.sha256)) {
+    log("VPN: downloading OpenVPN " + OPENVPN_MSI.version + " (about 6 MB)");
+    await downloader.file(dl.url, msi, dl.sha256);
+  }
+  log("VPN: installing OpenVPN");
+  const logFile2 = path68.join(toolsDir, "downloads", "openvpn-install.log");
+  const code = await spawnAsync(SYSTEM.msiexec(), ["/i", msi, "/qn", "/norestart", "/l*v", logFile2], {
+    stdio: "ignore"
+  });
+  if (code !== 0 && code !== 3010)
+    throw new Error("The OpenVPN installer failed (exit " + code + "). Its log: " + logFile2);
+  if (!exists(exe)) throw new Error("OpenVPN was installed but " + exe + " is missing. The installer log: " + logFile2);
+  return exe;
+}
+
+// src/guest/vpn/tunnel.ts
+import { spawn as spawn7 } from "node:child_process";
+import fs55 from "node:fs";
+import os12 from "node:os";
+import path69 from "node:path";
+var DONE = "Initialization Sequence Completed";
+function failureReason(text) {
+  if (/AUTH_FAILED/i.test(text))
+    return "the VPN refused the login (for NordVPN use the service credentials, not your account password)";
+  if (/TLS Error: TLS key negotiation failed|TLS handshake failed/i.test(text))
+    return "it could not reach the VPN server (the network blocks it, or the server is down)";
+  if (/All wintun adapters on this system are in use|Cannot open TUN\/TAP|Could not create Wintun|ovpn-dco.*(error|failed)/i.test(
+    text
+  ))
+    return "the network driver for the tunnel could not be used";
+  if (/Exiting due to fatal error/i.test(text)) return "OpenVPN stopped with an error";
+  return null;
+}
+var tail = (text, lines = 12) => text.trim().split(/\r?\n/).slice(-lines).join("\n");
+async function startTunnel(o) {
+  const dir = fs55.mkdtempSync(path69.join(os12.tmpdir(), "sbx-vpn-"));
+  const auth = path69.join(dir, "login.txt");
+  const logFile2 = path69.join(dir, "openvpn.log");
+  const keepLog = () => {
+    try {
+      fs55.mkdirSync(logsDir, { recursive: true });
+      fs55.copyFileSync(logFile2, path69.join(logsDir, "openvpn.log"));
+    } catch {
+    }
+  };
+  fs55.writeFileSync(auth, o.username + "\r\n" + o.password + "\r\n", "utf8");
+  try {
+    const child = spawn7(
+      o.exe,
+      ["--config", o.profile, "--auth-user-pass", auth, "--auth-nocache", "--verb", "3", "--log", logFile2],
+      { detached: true, stdio: "ignore", windowsHide: true }
+    );
+    let exited = null;
+    child.once("exit", (code) => {
+      exited = code ?? -1;
+    });
+    child.once("error", (e) => {
+      exited = -1;
+      log("VPN: could not start OpenVPN: " + e.message);
+    });
+    child.unref();
+    const deadline = Date.now() + (o.timeoutMs ?? 9e4);
+    for (; ; ) {
+      const text = fs55.existsSync(logFile2) ? fs55.readFileSync(logFile2, "utf8") : "";
+      if (text.includes(DONE)) {
+        keepLog();
+        const tunnelIp = tunnelAddressFromLog(text) ?? void 0;
+        return { ok: true, message: "the tunnel is up", ...tunnelIp ? { tunnelIp } : {} };
+      }
+      const reason = failureReason(text);
+      if (exited !== null || reason) {
+        if (exited === null) child.kill();
+        keepLog();
+        return { ok: false, message: (reason ?? "OpenVPN stopped") + ". " + tail(text, 4) };
+      }
+      if (Date.now() > deadline) {
+        child.kill();
+        keepLog();
+        return { ok: false, message: "the tunnel did not come up in time. " + tail(text, 4) };
+      }
+      await new Promise((r) => setTimeout(r, 500));
+    }
+  } finally {
+    fs55.rmSync(auth, { force: true });
+  }
+}
+
+// src/guest/vpn/vpn.ts
+function setVpnStatus(state, message, extra = {}) {
+  try {
+    writeJsonAtomic(run.vpnFile, {
+      state,
+      message: message.slice(0, 1900),
+      killSwitch: session.vpn?.killSwitch ?? false,
+      updatedAt: now(),
+      ...session.vpn ? { server: session.vpn.server.slice(0, 120) } : {},
+      ...extra
+    });
+  } catch (e) {
+    warn("Could not write the VPN status: " + errMsg(e));
+  }
+}
+async function serverAddresses(remotes) {
+  const out = [];
+  for (const r of remotes) {
+    const ips = isIPv4(r.host) ? [r.host] : await dns2.promises.lookup(r.host, { all: true, family: 4 }).then(
+      (all) => all.map((a) => a.address),
+      () => []
+    );
+    for (const ip of ips) out.push({ ip, port: r.port, proto: r.proto });
+  }
+  return out;
+}
+async function publicAddress() {
+  try {
+    const text = (await (await fetch("https://api.ipify.org", { signal: AbortSignal.timeout(1e4) })).text()).trim();
+    return /^[0-9a-fA-F.:]{3,45}$/.test(text) ? text : null;
+  } catch {
+    return null;
+  }
+}
+var hasAdapter = (ip) => Object.values(os13.networkInterfaces()).some((list) => (list ?? []).some((i) => i.address === ip));
+async function setupVpn(secrets, ptyHostExe) {
+  const vpn = session.vpn;
+  if (!vpn) return true;
+  const killSwitch = vpn.killSwitch;
+  let blocked = false;
+  const block = (servers) => {
+    if (isWin && !dryRun) run2(killSwitchCommands(servers, ptyHostExe));
+    blocked = true;
+    log("VPN: kill switch on: nothing leaves the sandbox except through the tunnel.");
+  };
+  setVpnStatus("starting", "Starting the VPN");
+  try {
+    if (!session.networking) throw new Error("networking is off for this sandbox");
+    const credentials = secrets.vpn;
+    if (!credentials) throw new Error("the VPN login did not arrive (start the sandbox again)");
+    const profile = path70.join(launchDir, "vpn", "server.ovpn");
+    const remotes = assertSafeOvpn(fs56.readFileSync(profile, "utf8"), vpn.server);
+    const exe = await ensureOpenVpn();
+    const servers = await serverAddresses(remotes);
+    if (servers.length === 0) throw new Error("the VPN server addresses could not be found");
+    if (killSwitch) block(servers);
+    if (dryRun || !isWin) {
+      log("(dry run) would start the VPN tunnel to " + vpn.server);
+      setVpnStatus("off", "dry run");
+      return true;
+    }
+    log("VPN: connecting to " + vpn.server);
+    const result = await startTunnel({ exe, profile, username: credentials.username, password: credentials.password });
+    if (!result.ok) throw new Error(result.message);
+    if (!result.tunnelIp || !hasAdapter(result.tunnelIp))
+      throw new Error("the tunnel reported it was up, but no network adapter with its address appeared");
+    if (killSwitch) run2(tunnelCommands(result.tunnelIp));
+    const publicIp = await publicAddress();
+    log("VPN: up" + (publicIp ? " (the sandbox appears as " + publicIp + ")" : "") + ".");
+    setVpnStatus("up", "The tunnel is up", publicIp ? { publicIp } : {});
+    return true;
+  } catch (e) {
+    const reason = errMsg(e);
+    try {
+      if (killSwitch && !blocked) block([]);
+    } catch (blockError) {
+      warn("VPN: could not close the network after the failure: " + errMsg(blockError));
+    }
+    const text = "VPN failed: " + reason + (killSwitch ? " The kill switch is on, so this sandbox has NO internet access." : " The kill switch is off, so this sandbox is using your normal connection.");
+    warn(text);
+    setVpnStatus("failed", reason);
+    return false;
+  }
+}
+
 // src/shared/pty/protocol.ts
 var FrameType = {
   Hello: 1,
@@ -33250,7 +34021,7 @@ var OutputFilter = class {
 };
 
 // src/shared/pty/console-input.ts
-import { spawn as spawn7 } from "node:child_process";
+import { spawn as spawn8 } from "node:child_process";
 function enableVtInput() {
   if (process.platform !== "win32" || !process.stdin.isTTY)
     return { ready: Promise.resolve(false), stop: () => Promise.resolve() };
@@ -33258,7 +34029,7 @@ function enableVtInput() {
   let exited = Promise.resolve();
   const ready = new Promise((resolve2) => {
     try {
-      child = spawn7(SYSTEM.powershell(), scriptArgs("enable-vt-input.ps1", ["-ProcessId", String(process.pid)]), {
+      child = spawn8(SYSTEM.powershell(), scriptArgs("enable-vt-input.ps1", ["-ProcessId", String(process.pid)]), {
         stdio: "ignore",
         windowsHide: true
       });
@@ -33458,7 +34229,7 @@ async function viewSession(id) {
 }
 
 // src/guest/boot/boot-env.ts
-import path64 from "node:path";
+import path71 from "node:path";
 
 // src/guest/boot/project-env.ts
 var EnvSchema = external_exports.object({
@@ -33477,7 +34248,7 @@ var BootEnvSchema = external_exports.object({
 });
 
 // src/guest/boot/boot-env.ts
-var file2 = () => path64.join(localDir, "boot-env.json");
+var file2 = () => path71.join(localDir, "boot-env.json");
 function saveBootEnv(value) {
   try {
     writeJsonAtomic(file2(), value);
@@ -33505,8 +34276,52 @@ function saveProjectStatus(name, workspace2, phase, message, databases, summary)
   }
 }
 
+// src/guest/runtime/secrets.ts
+import fs57 from "node:fs";
+
+// src/shared/channel/secrets.ts
+var Environment = external_exports.record(external_exports.string().max(256), external_exports.string().max(65536));
+var SecretsFileSchema = external_exports.strictObject({
+  /** The agent the sandbox booted with: its harness environment. */
+  harnessEnvironment: Environment.optional(),
+  /** harnessSpec of a session request (an agent the sandbox did not boot with). */
+  harnessSpecEnvironment: Environment.optional(),
+  /** project.harnesses of a request, by agent name. */
+  projectHarnessEnvironment: external_exports.record(external_exports.string().max(64), Environment).optional(),
+  /** The login of this PC's Claude (claudeProfile.copyCredentials): the text of .credentials.json. */
+  claudeCredentials: external_exports.string().max(1024 * 1024).optional(),
+  /** VPN service credentials (vpn.provider's login), only for the launch's own sandbox. */
+  vpn: external_exports.strictObject({ username: external_exports.string().min(1).max(256), password: external_exports.string().min(1).max(1024) }).optional()
+});
+
+// src/guest/runtime/secrets.ts
+var BOOT_SECRETS_VARIABLE = "SBX_BOOT_SECRETS";
+var MAX_BYTES = 4 * 1024 * 1024;
+function takeSecrets(id) {
+  const file3 = run.secretFile(id);
+  let text;
+  try {
+    if (fs57.statSync(file3).size > MAX_BYTES) throw new Error("too big");
+    text = fs57.readFileSync(file3, "utf8").replace(/^\uFEFF/, "");
+  } catch {
+    return {};
+  } finally {
+    fs57.rmSync(file3, { force: true });
+  }
+  try {
+    const parsed = SecretsFileSchema.safeParse(JSON.parse(text));
+    if (parsed.success) return parsed.data;
+  } catch {
+  }
+  warn("The secrets file for " + id + " was not valid and was ignored.");
+  return {};
+}
+function applyBootEnvironment(environment) {
+  if (session.harness && environment) session.harness.environment = { ...environment };
+}
+
 // src/guest/boot/boot.ts
-var STEPS = 8;
+var STEPS = 9;
 var PRIMARY_POLLS = 600;
 var POLL_MS = 500;
 var VSCODE_LANGUAGES = ["python", "java", "go", "rust", "cpp", "msvc", "dotnet", "ruby", "php", "deno", "pwsh"];
@@ -33528,23 +34343,35 @@ async function soft(what, work) {
     warn(what + " failed (continuing): " + errMsg(e));
   }
 }
-function startDaemon(env) {
-  spawn8(process.execPath, [path65.join(path65.dirname(process.argv[1]), "daemon.js")], {
+function startDaemon(env, secrets) {
+  spawn9(process.execPath, [path72.join(path72.dirname(process.argv[1]), "daemon.js")], {
     detached: true,
     stdio: "ignore",
     windowsHide: true,
-    env: { ...env, AGENT_LOG_PREFIX: "daemon" }
+    env: {
+      ...env,
+      AGENT_LOG_PREFIX: "daemon",
+      // The agent's environment (it may hold API keys): the daemon moves it into memory and removes this at once.
+      ...secrets.harnessEnvironment ? { [BOOT_SECRETS_VARIABLE]: JSON.stringify({ harnessEnvironment: secrets.harnessEnvironment }) } : {}
+    }
   }).unref();
 }
 function writeDbCommand() {
-  const dir = mkdirp(path65.join(localDir, "bin"));
-  const db = path65.join(path65.dirname(process.argv[1]), "db.js");
-  fs52.writeFileSync(
-    path65.join(dir, "sbx-db.cmd"),
+  const dir = mkdirp(path72.join(localDir, "bin"));
+  const db = path72.join(path72.dirname(process.argv[1]), "db.js");
+  fs58.writeFileSync(
+    path72.join(dir, "sbx-db.cmd"),
     '@setlocal\r\n@set AGENT_LOG_PREFIX=db\r\n@"' + process.execPath + '" "' + db + '" %*\r\n'
   );
+  writeAgentCommands(dir);
   return dir;
 }
+function writeAgentCommands(dir) {
+  const install = { node: process.execPath, script: path72.join(path72.dirname(process.argv[1]), "agent.js") };
+  for (const shim3 of agentShims(toolsDir, session.agents ?? {}))
+    fs58.writeFileSync(path72.join(dir, shim3.command + ".cmd"), shimText(shim3, install));
+  fs58.writeFileSync(path72.join(dir, "sbx-agent.cmd"), sbxAgentText(install));
+}
 async function waitForPrimary() {
   for (let i = 0; i < PRIMARY_POLLS; i++) {
     const s = run.readSession(session.launchId);
@@ -33565,17 +34392,22 @@ var Boot = class {
   ptyHost = null;
   lan = session.networking ? "open" : "offline";
   gitAccess = session.provisioning.git.access ?? "full";
+  /** What the host handed over in its one-shot file (read and deleted at the start of run()). */
+  secrets = {};
   async run() {
     log(
       "Agent sandbox: " + session.project + " | workspace " + workspace + " | agent " + session.harnessName + " | log " + logPath
     );
-    if (!fs52.statSync(workspace, { throwIfNoEntry: false })?.isDirectory())
+    if (!fs58.statSync(workspace, { throwIfNoEntry: false })?.isDirectory())
       throw new Error("Workspace folder is missing in the sandbox: " + workspace);
     mkdirp(toolsDir);
     mkdirp(run.root);
+    this.secrets = takeSecrets(session.launchId);
+    applyBootEnvironment(this.secrets.harnessEnvironment);
     await this.networkAndSessionHost();
     await this.hooksAndDesktop();
     const { tools, env } = await this.developerTools();
+    await this.vpn();
     await this.gitIdentity(env);
     await this.claude(tools);
     await this.agent(env);
@@ -33629,6 +34461,7 @@ var Boot = class {
       );
     const env = agentEnv(tools);
     persistEnvironment(env, Object.keys(tools.vars));
+    await soft("Shell start-up PATH", installShellPath);
     saveBootEnv({
       basePath,
       toolVars: Object.keys(tools.vars),
@@ -33641,32 +34474,42 @@ var Boot = class {
     await soft("Cleaning old tool builds", () => pruneToolLeftovers());
     return { tools, env };
   }
+  /** vpn.enabled: the tunnel and its kill switch, before anything else uses the network (git, the agent). */
+  async vpn() {
+    step(4, session.vpn ? "VPN (" + session.vpn.server + ")" : "VPN (off)");
+    if (!session.vpn) return;
+    await soft("VPN", async () => {
+      await setupVpn(this.secrets, this.ptyHost);
+    });
+  }
   async gitIdentity(env) {
-    step(4, "Git identity");
+    step(5, "Git identity");
     await soft("Git config", () => setupGitConfig(env));
   }
   async claude(tools) {
-    step(5, "Claude settings, history and claude-mem");
-    if (session.harnessName === "claude") await soft("Claude settings", syncClaudeProfile);
+    step(6, "Claude settings, history and claude-mem");
+    if (session.harnessName === "claude")
+      await soft("Claude settings", () => syncClaudeProfile(this.secrets.claudeCredentials));
     await soft("claude-mem restore", restoreClaudeMem);
+    await soft("Agent databases restore", restoreLocalState);
     await soft("Sandbox guide for the agent", () => writeGuides(tools.summary, this.lan));
     await soft("Claude managed settings", () => writeManagedSettings2(this.gitAccess));
   }
   async agent(env) {
-    step(6, "Agent: " + session.harnessName);
+    step(7, "Agent: " + session.harnessName);
     linkProfileDirs(session.agentProfileDirs ?? {});
     if (session.harness) await agents.provision(session.harnessName, session.harness, env);
   }
   preAgentHooks(env) {
-    step(7, "Pre-agent hooks");
+    step(8, "Pre-agent hooks");
     runHooks("pre-agent", env);
   }
   /** Ready: starts the session daemon and, with an agent, its first session, shown in this window. */
   async start(env) {
-    step(8, "Starting " + session.harnessName);
+    step(9, "Starting " + session.harnessName);
     setSandboxStatus("ready", "Ready");
     if (!session.harness || session.autoSession === false) {
-      if (!dryRun) startDaemon(env);
+      if (!dryRun) startDaemon(env, this.secrets);
       log("Ready" + (session.harness ? "" : " (no agent requested)") + ". Workspace: " + workspace);
       return;
     }
@@ -33678,7 +34521,7 @@ var Boot = class {
       runHooks("post-agent", env);
       return;
     }
-    startDaemon(env);
+    startDaemon(env, this.secrets);
     writeJsonAtomic(run.requestFile(session.launchId), {
       kind: "session",
       id: session.launchId,
@@ -33702,11 +34545,11 @@ runBoot().catch((e) => {
   const message = errMsg(e) + (e instanceof Error && e.stack ? "\n" + e.stack : "");
   try {
     setSandboxStatus("failed", errMsg(e));
-    fs53.writeFileSync(path66.join(logsDir, "guest-error.txt"), message);
+    fs59.writeFileSync(path73.join(logsDir, "guest-error.txt"), message);
   } catch {
   }
   console.error(
-    "\n\x1B[31mThe sandbox could not start: " + errMsg(e) + "\x1B[0m\nDetails: " + path66.join(logsDir, "guest-error.txt")
+    "\n\x1B[31mThe sandbox could not start: " + errMsg(e) + "\x1B[0m\nDetails: " + path73.join(logsDir, "guest-error.txt")
   );
   process.exitCode = 1;
 });