windows-development-sandbox 1.5.0 → 1.7.0

package/dist/runtime/netproxy.js

@@ -25328,6 +25328,9 @@ function enabled(what, markers) {
 function Packages(what, example) {
   return StringsSchema.describe(what + ", installed once and kept (e.g. " + example + ").");
 }
+function secret(schema) {
+  return schema.meta({ secret: true });
+}
 
 // src/core/schema/config.ts
 var import_lodash = __toESM(require_lodash(), 1);
@@ -25396,10 +25399,15 @@ var HarnessSchema = external_exports.strictObject({
   uvPackage: external_exports.string().optional().describe("Python package installed with `uv tool install` inside the sandbox (e.g. aider-chat)."),
   uvBin: external_exports.string().optional().describe("Command the uv package provides."),
   arguments: StringsSchema.describe("Arguments always passed to the agent."),
-  environment: external_exports.record(external_exports.string(), external_exports.string()).describe("Environment variables for the agent."),
+  environment: external_exports.record(external_exports.string(), secret(external_exports.string())).describe(
+    "Environment variables for the agent (API keys go here). Their values are shown as *** and are handed to the sandbox in a one-shot file, never kept in the launch folder. The agent can read its own environment."
+  ),
   home: HarnessHomeSchema.optional().describe(
     "Where its login lives inside the sandbox; leave out when the agent cannot be pointed at a folder (then its login is not kept between sandboxes)."
   ),
+  localState: external_exports.record(external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/), SubfolderSchema).optional().describe(
+    "Environment variable -> folder below the agent's own state folder (state\\<agent>) for SQLite databases. SQLite cannot run in a mapped folder, so the agent runs from a copy on the sandbox's disk (the variable points to it) that is copied from and back to that folder."
+  ),
   resumeArguments: StringsSchema.optional().describe(
     "Arguments used when the agent is restarted in place (e.g. after an account switch) so it resumes the conversation."
   ),
@@ -25451,6 +25459,9 @@ var ClaudeProfileSchema = external_exports.strictObject({
   globalStateFile: external_exports.string().describe('Your .claude.json, or "auto". Empty string = do not copy.'),
   copyCredentials: external_exports.boolean().describe("Copy your Claude LOGIN into the sandbox. Prefer sandbox account instead."),
   overwrite: external_exports.boolean().describe("Refresh these settings from this PC on every launch."),
+  sharePluginsAcrossAccounts: external_exports.boolean().describe(
+    "When you switch Claude accounts, copy your Claude plugins (and which ones are enabled) into a data set that has none yet. Off by default: plugins are code that runs in your sessions."
+  ),
   syncHistory: external_exports.boolean().describe("Bring conversation history in, and sync new history back (path-translated)."),
   historyScope: external_exports.enum(["project", "all"]).describe(
     `Which history comes in: "project" = only the projects in this sandbox (other projects' conversations, file backups and prompts stay on this PC), "all" = everything. Only this sandbox's projects ever sync back.`
@@ -25527,7 +25538,10 @@ var NetworkSchema = external_exports.strictObject({
     "Reach servers in the sandbox from this PC: http://localhost:<pc> here goes to <sandbox> inside, while it runs. Nothing else on your network can use them."
   ),
   dns: external_exports.array(external_exports.string().regex(/^\d{1,3}(\.\d{1,3}){3}$/, "an IPv4 address like 1.1.1.1")).describe("DNS servers for the sandbox instead of your network's, e.g. 1.1.1.1 and 9.9.9.9."),
-  proxy: external_exports.string().regex(/^(https?:\/\/[^\s]+)?$/, "http://host:port").describe(
+  proxy: external_exports.string().regex(/^(https?:\/\/[^\s]+)?$/, "http://host:port").refine(
+    (v) => !/^https?:\/\/[^/?#]*@/i.test(v),
+    "no user name or password in the address (it would be stored in plain text and visible to the agent): use a proxy that needs no login"
+  ).describe(
     "An HTTP proxy the sandbox uses to reach the internet (HTTP_PROXY / HTTPS_PROXY for everything in it), e.g. http://proxy.corp:8080. Empty = none."
   )
 });
@@ -25929,6 +25943,17 @@ var APPS = [
     exe: "lazygit.exe",
     cli: true
   },
+  {
+    id: "jj",
+    name: "Jujutsu (jj)",
+    category: "git",
+    about: "Git-compatible version control; conflicts do not block a rebase. Pilot, untested with worktrees.",
+    size: "10 MB",
+    source: gh("jj-vcs/jj", "^jj-v[\\d.]+-x86_64-pc-windows-msvc\\.zip$"),
+    exe: "jj.exe",
+    cli: true,
+    fullGitOnly: true
+  },
   // ---- utilities
   {
     id: "7zip",
@@ -26457,6 +26482,26 @@ var APPS = [
     source: gh("gitleaks/gitleaks", "^gitleaks_[\\d.]+_windows_x64\\.zip$"),
     exe: "gitleaks.exe",
     cli: true
+  },
+  {
+    id: "ast-grep",
+    name: "ast-grep",
+    category: "cli",
+    about: "Search and rewrite code by its syntax tree (ast-grep, sg); prints only the matches.",
+    size: "15 MB",
+    source: gh("ast-grep/ast-grep", "^app-x86_64-pc-windows-msvc\\.zip$"),
+    exe: "ast-grep.exe",
+    cli: true
+  },
+  {
+    id: "rust-analyzer",
+    name: "rust-analyzer",
+    category: "cli",
+    about: "Rust language server: type errors and go-to-definition without cargo (for editors and the Claude LSP plugin).",
+    size: "18 MB",
+    source: gh("rust-lang/rust-analyzer", "^rust-analyzer-x86_64-pc-windows-msvc\\.zip$"),
+    exe: "rust-analyzer.exe",
+    cli: true
   }
 ];
 
@@ -26525,6 +26570,33 @@ var ResumeSchema = external_exports.strictObject({
   )
 });
 
+// src/core/schema/web.ts
+var WebSchema = external_exports.strictObject({
+  enabled: external_exports.boolean().describe(
+    "(Beta) Allow the web UI: your sandbox sessions in a browser on this PC. Off by default, and nothing starts it by itself yet: sandbox web start works either way and runs it until sandbox web stop (or a restart of the PC)."
+  ),
+  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken.")
+});
+
+// src/core/schema/vpn.ts
+var VPN_PROVIDERS = ["nordvpn", "openvpn-file"];
+var VpnSchema = external_exports.strictObject({
+  enabled: external_exports.boolean().describe(
+    "Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
+  ),
+  provider: external_exports.enum(VPN_PROVIDERS).describe(
+    "nordvpn: a recommended NordVPN server is picked at every launch. openvpn-file: your own .ovpn file (configFile)."
+  ),
+  protocol: external_exports.enum(["udp", "tcp"]).describe("udp is faster; tcp gets through networks that block udp."),
+  country: external_exports.string().regex(/^([A-Za-z][A-Za-z .'-]{0,39})?$/, "a country name or code like uk or Germany").describe("nordvpn: the country of the server, e.g. uk, us or Germany. Empty = the best server anywhere."),
+  configFile: external_exports.string().describe(
+    "openvpn-file: the .ovpn file on this PC (its certificates inside it). Files that run programs (script-security, up, down, plugin ...) are refused. A project's file can never set this."
+  ),
+  killSwitch: external_exports.boolean().describe(
+    "Block all traffic that does not go through the tunnel: when the tunnel cannot start, the sandbox stays offline instead of using your normal connection. A project can only turn this on, never off."
+  )
+});
+
 // src/core/schema/config.ts
 var ConfigSchema = external_exports.strictObject({
   $schema: SchemaRefSchema.optional(),
@@ -26537,7 +26609,9 @@ var ConfigSchema = external_exports.strictObject({
   sandbox: SandboxSchema,
   sharing: SharingSchema,
   storage: external_exports.strictObject({
-    root: external_exports.string().min(1).describe("Where everything is kept on this PC (tools, databases, logins, launches)."),
+    root: external_exports.string().min(1).describe(
+      "Where everything is kept on this PC (tools, databases, logins, launches). The default is a private folder for you under %ProgramData%\\AgentSandbox\\users, which works for installs for one user and for everyone. sandbox storage move <folder> moves it."
+    ),
     persistAgentState: external_exports.boolean().describe("Keep agent logins and history between sandboxes."),
     dataName: NameSchema.describe("Name of the persistent data set (C:\\AgentData) shared by all workspaces."),
     markSandboxFiles: external_exports.boolean().describe(
@@ -26548,6 +26622,7 @@ var ConfigSchema = external_exports.strictObject({
     )
   }),
   network: NetworkSchema,
+  vpn: VpnSchema,
   provisioning: ProvisioningSchema,
   downloads: DownloadsSchema,
   toolchains: ToolchainsSchema,
@@ -26555,6 +26630,7 @@ var ConfigSchema = external_exports.strictObject({
     "Databases running inside the sandbox. Data persists in C:\\AgentData\\databases; each one starts at boot."
   ),
   attach: AttachSchema,
+  web: WebSchema,
   agentCommands: AgentCommandsSchema,
   secrets: SecretsSchema,
   personalization: toggle("Copy your desktop look (theme, accent, taskbar, wallpaper, ...) into the sandbox."),
@@ -26587,6 +26663,8 @@ var LocalOverridesSchema = external_exports.strictObject({
   sandbox: SandboxSchema.omit({ cpuLimit: true, pageFileMb: true }).partial(),
   // A project may block more (the LAN, hosts); it never opens hosts, ports, DNS or a proxy.
   network: NetworkSchema.pick({ blockPrivateRanges: true, blockHosts: true }).partial(),
+  // A project may turn the kill switch on, never off, and never choose a VPN, a server, a file or a login.
+  vpn: VpnSchema.pick({ killSwitch: true }).partial(),
   provisioning: ProvisioningSchema.pick({ copyFromHost: true, fallbackToInstall: true, refresh: true }).extend({ git: GitSchema.partial(), terminal: toggle("Windows Terminal as the sandbox window.").partial() }).partial(),
   downloads: DownloadsSchema.partial(),
   // Every toolchain setting, each one optional (a project usually only switches languages on or pins a version).
@@ -26727,6 +26805,16 @@ var ProjectStatusSchema = external_exports.object({
   databases: external_exports.array(external_exports.object({ database: Text(32), port: external_exports.number().int() })).max(16),
   summary: external_exports.array(Text(512)).max(64)
 });
+var VpnStatusSchema = external_exports.object({
+  state: external_exports.enum(["off", "starting", "up", "failed"]),
+  message: Text(2e3),
+  killSwitch: external_exports.boolean(),
+  /** The server's name, e.g. uk2201.nordvpn.com. */
+  server: Text(128).optional(),
+  /** What the sandbox's traffic looks like from outside, once the tunnel is up. */
+  publicIp: Text(64).optional(),
+  updatedAt: TimeSchema
+});
 
 // src/shared/io/json.ts
 import fs2 from "node:fs";
@@ -26861,20 +26949,25 @@ var scan = (schema, dir) => {
 var RunDir = class {
   root;
   sandboxFile;
+  vpnFile;
   requestsDir;
   responsesDir;
   sessionsDir;
   projectsDir;
   /** audit.processes: programs the sandbox started, in small .jsonl files the host takes in and deletes. */
   auditDir;
+  /** One-shot secrets the host hands over (see secrets.ts). Next to run, not in it: shared-use users can change run. */
+  secretsDir;
   constructor(dataDir2) {
     this.root = path3.join(dataDir2, "run");
     this.sandboxFile = path3.join(this.root, "sandbox.json");
+    this.vpnFile = path3.join(this.root, "vpn.json");
     this.requestsDir = path3.join(this.root, "requests");
     this.responsesDir = path3.join(this.root, "responses");
     this.sessionsDir = path3.join(this.root, "sessions");
     this.projectsDir = path3.join(this.root, "projects");
     this.auditDir = path3.join(this.root, "audit");
+    this.secretsDir = path3.join(dataDir2, "secrets");
   }
   requestFile(id) {
     return path3.join(this.requestsDir, safeId(id) + ".json");
@@ -26888,9 +26981,15 @@ var RunDir = class {
   projectFile(name) {
     return path3.join(this.projectsDir, safeId(name) + ".json");
   }
+  secretFile(id) {
+    return path3.join(this.secretsDir, safeId(id) + ".json");
+  }
   readSandboxStatus() {
     return readValid(SandboxStatusSchema, this.sandboxFile);
   }
+  readVpnStatus() {
+    return readValid(VpnStatusSchema, this.vpnFile);
+  }
   readSession(id) {
     return readValid(SessionStatusSchema, this.sessionFile(id));
   }

package/dist/runtime/view.js

@@ -25665,6 +25665,9 @@ function enabled(what, markers) {
 function Packages(what, example) {
   return StringsSchema.describe(what + ", installed once and kept (e.g. " + example + ").");
 }
+function secret(schema) {
+  return schema.meta({ secret: true });
+}
 
 // src/core/schema/config.ts
 var import_lodash = __toESM(require_lodash(), 1);
@@ -25733,10 +25736,15 @@ var HarnessSchema = external_exports.strictObject({
   uvPackage: external_exports.string().optional().describe("Python package installed with `uv tool install` inside the sandbox (e.g. aider-chat)."),
   uvBin: external_exports.string().optional().describe("Command the uv package provides."),
   arguments: StringsSchema.describe("Arguments always passed to the agent."),
-  environment: external_exports.record(external_exports.string(), external_exports.string()).describe("Environment variables for the agent."),
+  environment: external_exports.record(external_exports.string(), secret(external_exports.string())).describe(
+    "Environment variables for the agent (API keys go here). Their values are shown as *** and are handed to the sandbox in a one-shot file, never kept in the launch folder. The agent can read its own environment."
+  ),
   home: HarnessHomeSchema.optional().describe(
     "Where its login lives inside the sandbox; leave out when the agent cannot be pointed at a folder (then its login is not kept between sandboxes)."
   ),
+  localState: external_exports.record(external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/), SubfolderSchema).optional().describe(
+    "Environment variable -> folder below the agent's own state folder (state\\<agent>) for SQLite databases. SQLite cannot run in a mapped folder, so the agent runs from a copy on the sandbox's disk (the variable points to it) that is copied from and back to that folder."
+  ),
   resumeArguments: StringsSchema.optional().describe(
     "Arguments used when the agent is restarted in place (e.g. after an account switch) so it resumes the conversation."
   ),
@@ -25788,6 +25796,9 @@ var ClaudeProfileSchema = external_exports.strictObject({
   globalStateFile: external_exports.string().describe('Your .claude.json, or "auto". Empty string = do not copy.'),
   copyCredentials: external_exports.boolean().describe("Copy your Claude LOGIN into the sandbox. Prefer sandbox account instead."),
   overwrite: external_exports.boolean().describe("Refresh these settings from this PC on every launch."),
+  sharePluginsAcrossAccounts: external_exports.boolean().describe(
+    "When you switch Claude accounts, copy your Claude plugins (and which ones are enabled) into a data set that has none yet. Off by default: plugins are code that runs in your sessions."
+  ),
   syncHistory: external_exports.boolean().describe("Bring conversation history in, and sync new history back (path-translated)."),
   historyScope: external_exports.enum(["project", "all"]).describe(
     `Which history comes in: "project" = only the projects in this sandbox (other projects' conversations, file backups and prompts stay on this PC), "all" = everything. Only this sandbox's projects ever sync back.`
@@ -25864,7 +25875,10 @@ var NetworkSchema = external_exports.strictObject({
     "Reach servers in the sandbox from this PC: http://localhost:<pc> here goes to <sandbox> inside, while it runs. Nothing else on your network can use them."
   ),
   dns: external_exports.array(external_exports.string().regex(/^\d{1,3}(\.\d{1,3}){3}$/, "an IPv4 address like 1.1.1.1")).describe("DNS servers for the sandbox instead of your network's, e.g. 1.1.1.1 and 9.9.9.9."),
-  proxy: external_exports.string().regex(/^(https?:\/\/[^\s]+)?$/, "http://host:port").describe(
+  proxy: external_exports.string().regex(/^(https?:\/\/[^\s]+)?$/, "http://host:port").refine(
+    (v) => !/^https?:\/\/[^/?#]*@/i.test(v),
+    "no user name or password in the address (it would be stored in plain text and visible to the agent): use a proxy that needs no login"
+  ).describe(
     "An HTTP proxy the sandbox uses to reach the internet (HTTP_PROXY / HTTPS_PROXY for everything in it), e.g. http://proxy.corp:8080. Empty = none."
   )
 });
@@ -26266,6 +26280,17 @@ var APPS = [
     exe: "lazygit.exe",
     cli: true
   },
+  {
+    id: "jj",
+    name: "Jujutsu (jj)",
+    category: "git",
+    about: "Git-compatible version control; conflicts do not block a rebase. Pilot, untested with worktrees.",
+    size: "10 MB",
+    source: gh("jj-vcs/jj", "^jj-v[\\d.]+-x86_64-pc-windows-msvc\\.zip$"),
+    exe: "jj.exe",
+    cli: true,
+    fullGitOnly: true
+  },
   // ---- utilities
   {
     id: "7zip",
@@ -26794,6 +26819,26 @@ var APPS = [
     source: gh("gitleaks/gitleaks", "^gitleaks_[\\d.]+_windows_x64\\.zip$"),
     exe: "gitleaks.exe",
     cli: true
+  },
+  {
+    id: "ast-grep",
+    name: "ast-grep",
+    category: "cli",
+    about: "Search and rewrite code by its syntax tree (ast-grep, sg); prints only the matches.",
+    size: "15 MB",
+    source: gh("ast-grep/ast-grep", "^app-x86_64-pc-windows-msvc\\.zip$"),
+    exe: "ast-grep.exe",
+    cli: true
+  },
+  {
+    id: "rust-analyzer",
+    name: "rust-analyzer",
+    category: "cli",
+    about: "Rust language server: type errors and go-to-definition without cargo (for editors and the Claude LSP plugin).",
+    size: "18 MB",
+    source: gh("rust-lang/rust-analyzer", "^rust-analyzer-x86_64-pc-windows-msvc\\.zip$"),
+    exe: "rust-analyzer.exe",
+    cli: true
   }
 ];
 
@@ -26862,6 +26907,33 @@ var ResumeSchema = external_exports.strictObject({
   )
 });
 
+// src/core/schema/web.ts
+var WebSchema = external_exports.strictObject({
+  enabled: external_exports.boolean().describe(
+    "(Beta) Allow the web UI: your sandbox sessions in a browser on this PC. Off by default, and nothing starts it by itself yet: sandbox web start works either way and runs it until sandbox web stop (or a restart of the PC)."
+  ),
+  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken.")
+});
+
+// src/core/schema/vpn.ts
+var VPN_PROVIDERS = ["nordvpn", "openvpn-file"];
+var VpnSchema = external_exports.strictObject({
+  enabled: external_exports.boolean().describe(
+    "Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
+  ),
+  provider: external_exports.enum(VPN_PROVIDERS).describe(
+    "nordvpn: a recommended NordVPN server is picked at every launch. openvpn-file: your own .ovpn file (configFile)."
+  ),
+  protocol: external_exports.enum(["udp", "tcp"]).describe("udp is faster; tcp gets through networks that block udp."),
+  country: external_exports.string().regex(/^([A-Za-z][A-Za-z .'-]{0,39})?$/, "a country name or code like uk or Germany").describe("nordvpn: the country of the server, e.g. uk, us or Germany. Empty = the best server anywhere."),
+  configFile: external_exports.string().describe(
+    "openvpn-file: the .ovpn file on this PC (its certificates inside it). Files that run programs (script-security, up, down, plugin ...) are refused. A project's file can never set this."
+  ),
+  killSwitch: external_exports.boolean().describe(
+    "Block all traffic that does not go through the tunnel: when the tunnel cannot start, the sandbox stays offline instead of using your normal connection. A project can only turn this on, never off."
+  )
+});
+
 // src/core/schema/config.ts
 var ConfigSchema = external_exports.strictObject({
   $schema: SchemaRefSchema.optional(),
@@ -26874,7 +26946,9 @@ var ConfigSchema = external_exports.strictObject({
   sandbox: SandboxSchema,
   sharing: SharingSchema,
   storage: external_exports.strictObject({
-    root: external_exports.string().min(1).describe("Where everything is kept on this PC (tools, databases, logins, launches)."),
+    root: external_exports.string().min(1).describe(
+      "Where everything is kept on this PC (tools, databases, logins, launches). The default is a private folder for you under %ProgramData%\\AgentSandbox\\users, which works for installs for one user and for everyone. sandbox storage move <folder> moves it."
+    ),
     persistAgentState: external_exports.boolean().describe("Keep agent logins and history between sandboxes."),
     dataName: NameSchema.describe("Name of the persistent data set (C:\\AgentData) shared by all workspaces."),
     markSandboxFiles: external_exports.boolean().describe(
@@ -26885,6 +26959,7 @@ var ConfigSchema = external_exports.strictObject({
     )
   }),
   network: NetworkSchema,
+  vpn: VpnSchema,
   provisioning: ProvisioningSchema,
   downloads: DownloadsSchema,
   toolchains: ToolchainsSchema,
@@ -26892,6 +26967,7 @@ var ConfigSchema = external_exports.strictObject({
     "Databases running inside the sandbox. Data persists in C:\\AgentData\\databases; each one starts at boot."
   ),
   attach: AttachSchema,
+  web: WebSchema,
   agentCommands: AgentCommandsSchema,
   secrets: SecretsSchema,
   personalization: toggle("Copy your desktop look (theme, accent, taskbar, wallpaper, ...) into the sandbox."),
@@ -26924,6 +27000,8 @@ var LocalOverridesSchema = external_exports.strictObject({
   sandbox: SandboxSchema.omit({ cpuLimit: true, pageFileMb: true }).partial(),
   // A project may block more (the LAN, hosts); it never opens hosts, ports, DNS or a proxy.
   network: NetworkSchema.pick({ blockPrivateRanges: true, blockHosts: true }).partial(),
+  // A project may turn the kill switch on, never off, and never choose a VPN, a server, a file or a login.
+  vpn: VpnSchema.pick({ killSwitch: true }).partial(),
   provisioning: ProvisioningSchema.pick({ copyFromHost: true, fallbackToInstall: true, refresh: true }).extend({ git: GitSchema.partial(), terminal: toggle("Windows Terminal as the sandbox window.").partial() }).partial(),
   downloads: DownloadsSchema.partial(),
   // Every toolchain setting, each one optional (a project usually only switches languages on or pins a version).
@@ -27064,6 +27142,16 @@ var ProjectStatusSchema = external_exports.object({
   databases: external_exports.array(external_exports.object({ database: Text(32), port: external_exports.number().int() })).max(16),
   summary: external_exports.array(Text(512)).max(64)
 });
+var VpnStatusSchema = external_exports.object({
+  state: external_exports.enum(["off", "starting", "up", "failed"]),
+  message: Text(2e3),
+  killSwitch: external_exports.boolean(),
+  /** The server's name, e.g. uk2201.nordvpn.com. */
+  server: Text(128).optional(),
+  /** What the sandbox's traffic looks like from outside, once the tunnel is up. */
+  publicIp: Text(64).optional(),
+  updatedAt: TimeSchema
+});
 
 // src/shared/io/json.ts
 import fs2 from "node:fs";
@@ -27100,20 +27188,25 @@ var scan = (schema, dir) => {
 var RunDir = class {
   root;
   sandboxFile;
+  vpnFile;
   requestsDir;
   responsesDir;
   sessionsDir;
   projectsDir;
   /** audit.processes: programs the sandbox started, in small .jsonl files the host takes in and deletes. */
   auditDir;
+  /** One-shot secrets the host hands over (see secrets.ts). Next to run, not in it: shared-use users can change run. */
+  secretsDir;
   constructor(dataDir2) {
     this.root = path3.join(dataDir2, "run");
     this.sandboxFile = path3.join(this.root, "sandbox.json");
+    this.vpnFile = path3.join(this.root, "vpn.json");
     this.requestsDir = path3.join(this.root, "requests");
     this.responsesDir = path3.join(this.root, "responses");
     this.sessionsDir = path3.join(this.root, "sessions");
     this.projectsDir = path3.join(this.root, "projects");
     this.auditDir = path3.join(this.root, "audit");
+    this.secretsDir = path3.join(dataDir2, "secrets");
   }
   requestFile(id) {
     return path3.join(this.requestsDir, safeId(id) + ".json");
@@ -27127,9 +27220,15 @@ var RunDir = class {
   projectFile(name) {
     return path3.join(this.projectsDir, safeId(name) + ".json");
   }
+  secretFile(id) {
+    return path3.join(this.secretsDir, safeId(id) + ".json");
+  }
   readSandboxStatus() {
     return readValid(SandboxStatusSchema, this.sandboxFile);
   }
+  readVpnStatus() {
+    return readValid(VpnStatusSchema, this.vpnFile);
+  }
   readSession(id) {
     return readValid(SessionStatusSchema, this.sessionFile(id));
   }

package/dist/selftest/accounts.test.js

@@ -32,6 +32,46 @@ export const accountsSuite = {
             stateAfter.other === 1 &&
             new AccountStore(storage).activeFor(dataA) === 'work', 'switching swaps in the other credentials and account, keeps the rest of the sandbox state, and marks it active');
         t.includes(JSON.stringify(new AccountStore(storage).read('personal')?.credentials), 'personal-2', "the outgoing account's refreshed tokens are saved back before switching");
+        t.section('sharing plugins between data sets');
+        const plugA = path.join(storage, 'data', 'p1', 'state', 'claude');
+        const plugB = path.join(storage, 'data', 'p2', 'state', 'claude');
+        const plugC = path.join(storage, 'data', 'p3', 'state', 'claude');
+        const login = '{"claudeAiOauth":{"refreshToken":"x"}}';
+        for (const dir of [plugA, plugB, plugC])
+            t.write(path.join(dir, '.credentials.json'), login);
+        t.write(path.join(plugA, 'plugins', 'installed_plugins.json'), '{"version":2,"plugins":{}}');
+        t.write(path.join(plugA, 'plugins', 'cache', 'm', 'p', 'a.js'), 'x');
+        t.write(path.join(plugA, 'settings.json'), '{"theme":"dark","enabledPlugins":{"p@m":true}}');
+        t.write(path.join(plugB, 'settings.json'), '{"theme":"light","enabledPlugins":{"q@m":false}}');
+        const dataP = (n) => path.join(storage, 'data', n);
+        const off = new AccountStore(storage);
+        off.save(dataP('p1'), 'one', null);
+        off.activate(dataP('p2'), 'one');
+        t.check(!fs.existsSync(path.join(plugB, 'plugins')), 'plugins are not copied when the setting is off (default)');
+        const on = new AccountStore(storage, true);
+        on.activate(dataP('p1'), 'one');
+        on.activate(dataP('p2'), 'one');
+        const settingsB = f.readJson(path.join(plugB, 'settings.json'));
+        t.check(fs.existsSync(path.join(plugB, 'plugins', 'cache', 'm', 'p', 'a.js')) &&
+            settingsB.theme === 'light' &&
+            settingsB.enabledPlugins['p@m'] === true &&
+            settingsB.enabledPlugins['q@m'] === false &&
+            !fs.existsSync(path.join(storage, 'accounts', 'shared-plugins', '.credentials.json')), 'on: plugins and enabledPlugins reach the other data set; its own settings win and no login travels');
+        t.write(path.join(plugC, 'plugins', 'installed_plugins.json'), '{}');
+        const outside = t.dir('plugin-victim');
+        t.write(path.join(outside, 'secret.txt'), 's');
+        fs.symlinkSync(outside, path.join(plugC, 'plugins', 'cache'), 'junction');
+        on.activate(dataP('p3'), 'one');
+        t.check((on.pluginNote ?? '').includes('link') &&
+            !fs.existsSync(path.join(storage, 'accounts', 'shared-plugins', 'plugins', 'cache', 'secret.txt')), 'a link in the plugins is refused (the switch still works) and nothing behind it is copied');
+        const dataQ = dataP('p4');
+        const plugQ = path.join(dataQ, 'state', 'claude');
+        t.write(path.join(plugQ, 'plugins', 'installed_plugins.json'), '{"version":2}');
+        t.write(path.join(plugQ, 'plugins', 'cache', 'new.js'), 'n');
+        on.syncPlugins(dataQ);
+        const plugR = path.join(storage, 'data', 'p5', 'state', 'claude');
+        on.syncPlugins(dataP('p5'));
+        t.check(fs.existsSync(path.join(plugR, 'plugins', 'cache', 'new.js')), 'launch-time refresh: plugins installed in one data set reach the shared set and the next empty data set');
         t.section('removing and refusing');
         new AccountStore(storage).setDefault('work');
         new AccountStore(storage).remove('work');

package/dist/selftest/agent-paths.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const agentPathsSuite: Suite;

package/dist/selftest/agent-paths.test.js

@@ -0,0 +1,115 @@
+// Agent commands in every terminal, SQLite folders of agents, and the PATH rules (planner, rebuild, shell start-up).
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { DEFAULTS, mergeConfig, validateConfig } from '../core/config/index.js';
+import { isWin } from '../core/util/index.js';
+import { SYSTEM } from '../shared/system.js';
+import { agentCommand, agentShims, isCopyableDatabaseFile, isDatabaseFile, localStateEntries, shimText, } from '../guest/agents/agent-files.js';
+import { appendMissing, expandVars, isPinnedNodeDir, parseRegPath, pathKey, planPath, rebuildPath, splitPath, } from '../guest/setup/path-plan.js';
+import { withReloadEnvironment } from '../host/tools/index.js';
+import { HarnessSchema } from '../core/schema/index.js';
+export const agentPathsSuite = {
+    name: 'agent-paths',
+    title: 'agent commands, agent SQLite folders and PATH rules',
+    run: (t) => {
+        t.section('agent commands');
+        const tools = 'C:\\AgentData\\tools';
+        const shims = agentShims(tools, DEFAULTS.harnesses);
+        const codex = shims.find((s) => s.name === 'codex');
+        t.equal(codex?.command, 'codex', 'codex is typed as codex');
+        t.equal(codex?.target, tools + '\\agents\\codex\\codex.cmd', 'an npm agent runs its .cmd');
+        t.equal(shims.find((s) => s.name === 'claude')?.target, tools + '\\agents\\claude\\claude.exe', 'claude runs its .exe');
+        t.check(shims.length === Object.keys(DEFAULTS.harnesses).length, 'every built-in agent gets a command');
+        t.equal(agentCommand('aider', DEFAULTS.harnesses.aider), 'aider', 'a uv agent is typed as its uv command');
+        const text = shimText(codex, { node: 'C:\\n\\node.exe', script: 'C:\\r\\agent.js' });
+        t.check(text.includes('\r\n') && text.includes('install codex') && text.endsWith('%*\r\n'), 'the command installs on first use');
+        t.check(text.includes('if exist "%SBX_REAL%" goto run'), 'an installed agent starts at once');
+        t.equal(agentShims(tools, { 'bad name': DEFAULTS.harnesses.codex }).length, 0, 'an agent name that is not a plain word gets no command file');
+        t.section('agent SQLite folders');
+        t.equal(DEFAULTS.harnesses.codex.localState, { CODEX_SQLITE_HOME: 'sqlite' }, 'codex runs its databases locally');
+        const entries = localStateEntries(DEFAULTS.harnesses, 'C:\\AgentData\\state', 'C:\\nvm\\agent-state');
+        t.equal(entries.map((e) => [e.agent, e.env, e.store, e.local, e.processes[0]]), [
+            [
+                'codex',
+                'CODEX_SQLITE_HOME',
+                'C:\\AgentData\\state\\codex\\sqlite',
+                'C:\\nvm\\agent-state\\codex\\sqlite',
+                'codex.exe',
+            ],
+        ], 'saved copy in the state folder, working copy on the sandbox disk');
+        // A user's own harnesses.codex is merged over the built-in one: fields it leaves out (localState) stay.
+        const { localState: _omitted, ...pinned } = DEFAULTS.harnesses.codex;
+        const merged = (harnesses) => validateConfig(mergeConfig(DEFAULTS, { harnesses }), 'test').harnesses;
+        t.equal([
+            merged({ codex: { npmPackage: '@openai/codex@0.9.0' } }).codex.localState,
+            merged({ codex: pinned }).codex.localState,
+        ], [{ CODEX_SQLITE_HOME: 'sqlite' }, { CODEX_SQLITE_HOME: 'sqlite' }], 'a customized or pinned built-in agent keeps localState from the defaults');
+        t.check(HarnessSchema.safeParse({ ...DEFAULTS.harnesses.codex, localState: { X: '..\\up' } }).success === false, 'a local state folder cannot leave the agent state folder');
+        t.equal(['state_5.sqlite', 'x.sqlite-wal', 'x.sqlite-shm', 'a.db', 'auth.json'].map(isDatabaseFile), [true, true, true, true, false], 'database files are told apart');
+        t.equal(['state_5.sqlite', 'x.sqlite-wal', 'x.sqlite-shm'].map(isCopyableDatabaseFile), [true, true, false], 'the -shm file is not copied (SQLite rebuilds it)');
+        t.section('PATH planner');
+        const present = new Set(['c:\\a', 'c:\\b', 'c:\\c\\d', 'c:\\nvm\\v24.1.0']);
+        const exists = (f) => present.has(pathKey(f));
+        t.equal(planPath({ entries: ['C:\\A\\;c:\\b', 'C:\\a', 'C:\\missing;"C:\\C\\D"', '', 'c:/B'], exists }), ['C:\\A\\', 'c:\\b', 'C:\\C\\D'], 'ordered, no duplicates (case, slash, quotes), no missing folders');
+        t.equal(planPath({ entries: ['C:\\a;C:\\nvm\\v24.1.0'], exists, drop: (f) => isPinnedNodeDir(f, 'C:\\NVM') }), ['C:\\a'], 'a pinned node version is never machine-wide');
+        t.check(isPinnedNodeDir('C:\\nvm\\v24.1.0\\', 'C:\\nvm') && !isPinnedNodeDir('C:\\nvm', 'C:\\nvm'), 'only versions are pinned');
+        t.equal(pathKey('C:\\'), 'c:\\', 'a drive root keeps its slash');
+        t.equal(splitPath(' "C:\\a" ;; C:\\b;'), ['C:\\a', 'C:\\b'], 'splitting drops empty parts and quotes');
+        t.equal(expandVars('%SystemRoot%\\x;%nope%', { SYSTEMROOT: 'C:\\W' }), 'C:\\W\\x;%nope%', 'variables expand in any case');
+        t.equal(appendMissing('C:\\a;C:\\b', 'c:\\B;C:\\n;C:\\skip', (f) => f === 'C:\\skip'), 'C:\\a;C:\\b;C:\\n', 'missing folders go last');
+        t.equal(rebuildPath({
+            machine: 'C:\\a\\;%SystemRoot%;C:\\b',
+            user: 'c:\\B;C:\\u',
+            process: 'C:\\only;C:\\A;C:\\AgentData\\tools\\node',
+            env: { SystemRoot: 'C:\\Windows' },
+            skip: (f) => pathKey(f) === 'c:\\agentdata\\tools\\node',
+        }), 'C:\\only;C:\\a\\;C:\\Windows;C:\\b;C:\\u', 'a new shell: process-only entries first, then the registry, no duplicates, no runner node');
+        t.equal(parseRegPath('\r\nHKEY_LOCAL_MACHINE\\X\r\n    Path    REG_EXPAND_SZ    C:\\a;%SystemRoot%\r\n\r\n'), 'C:\\a;%SystemRoot%', 'reg query output is parsed');
+        t.equal(parseRegPath('ERROR: nothing'), '', 'no Path value is an empty PATH');
+        t.section('Windows Terminal reloads the environment');
+        t.equal(withReloadEnvironment({ compatibility: { reloadEnvironmentVariables: true } }), null, 'already set: unchanged');
+        t.equal(withReloadEnvironment({ theme: 'dark', compatibility: { other: 1 } })?.compatibility, { other: 1, reloadEnvironmentVariables: true }, 'set without touching the rest of compatibility');
+        if (!isWin)
+            return;
+        t.section('shell start-up (pathsync.exe and the start-up files)');
+        const dir = t.at('pathsync');
+        const exe = path.join(dir, 'pathsync.exe');
+        fs.mkdirSync(dir, { recursive: true });
+        const csc = spawnSync(SYSTEM.csc(), ['/nologo', '/out:' + exe, path.join(t.packageRoot, 'sandbox', 'csharp', 'PathSync.cs')], { encoding: 'utf8', windowsHide: true });
+        t.check(csc.status === 0, 'PathSync.cs compiles', csc.stdout);
+        if (csc.status !== 0)
+            return;
+        const sync = spawnSync(exe, [
+            '--machine',
+            'C:\\a\\;%SystemRoot%;C:\\b',
+            '--user',
+            'c:\\B;C:\\u',
+            '--process',
+            'C:\\only;C:\\A;C:\\AgentData\\tools\\node',
+        ], { encoding: 'utf8', windowsHide: true, env: { ...process.env, AGENT_TOOLS: 'C:\\AgentData\\tools' } });
+        t.equal(sync.stdout, 'C:\\only;C:\\a\\;' + (process.env.SystemRoot ?? 'C:\\Windows') + ';C:\\b;C:\\u', 'pathsync.exe follows the same rules');
+        const root = t.at('shell-root');
+        const install = spawnSync(SYSTEM.powershell(), [
+            '-NoLogo',
+            '-NoProfile',
+            '-ExecutionPolicy',
+            'Bypass',
+            '-File',
+            path.join(t.packageRoot, 'sandbox', 'scripts', 'install-shell-path.ps1'),
+            '-Helper',
+            exe,
+            '-Root',
+            root,
+        ], { encoding: 'utf8', windowsHide: true });
+        t.check(install.status === 0, 'install-shell-path.ps1 runs (to a temp folder, no registry)', install.stderr);
+        const cmdFile = path.join(dir, 'shell-path.cmd');
+        // Quotes and & in the command line of cmd /c must not run the script again (that once looped for ever).
+        const nested = spawnSync(SYSTEM.cmd(), ['/d', '/c', 'echo "a & b" & call "' + cmdFile + '" && echo guard-ok'], {
+            encoding: 'utf8',
+            windowsHide: true,
+            windowsVerbatimArguments: true,
+        });
+        t.check(nested.stdout.includes('guard-ok') && !nested.stdout.includes('RECURSION'), 'the cmd start-up file leaves `cmd /c` alone');
+    },
+};

package/dist/selftest/channel.test.js

@@ -4,10 +4,15 @@ import { safeId } from '../shared/channel/index.js';
 import { GuestRequestSchema, SandboxStatusSchema, SessionStatusSchema } from '../shared/channel/index.js';
 import { bootLine, firstStartNotice, pendingDownloads, readyIn, stillWorking } from '../cli/commands/launch/index.js';
 import { encodeFrame, FrameReader, FrameType, fixWindowsKeys, helloFrame, InputJoiner, MAX_FRAME_BYTES, MOUSE_OFF, OutputFilter, } from '../shared/pty/index.js';
+import { bootSilent, FIRST_STATUS_MS } from '../host/channel/index.js';
 export const channelSuite = {
     name: 'channel',
     title: 'request/status validation and the terminal protocol (frames, OSC 52, keys)',
     run: async (t) => {
+        t.section('a silent boot');
+        t.check(!bootSilent(FIRST_STATUS_MS - 1, false) &&
+            bootSilent(FIRST_STATUS_MS + 1, false) &&
+            !bootSilent(10 * FIRST_STATUS_MS, true), 'a boot is silent only when no status came within the first three minutes');
         t.section('requests and session status');
         const validRequest = (r) => GuestRequestSchema.safeParse(r).success;
         const validSession = (s) => SessionStatusSchema.safeParse(s).success;