windows-development-sandbox 1.5.0 → 1.9.0

package/dist/host/profile/accounts.js

@@ -1,5 +1,7 @@
 // Several Claude logins for the sandbox. Each account is a saved copy of Claude's .credentials.json plus the
-// `oauthAccount` block of .claude.json, kept in host-only storage (<storage>\accounts, never mapped into a sandbox).
+// `oauthAccount` block of .claude.json, kept in host-only storage (<storage>\accounts, never mapped into a sandbox)
+// and encrypted with Windows DPAPI (host/secrets): only the name, e-mail and date are readable in the file. Accounts
+// saved before that were plain; they are encrypted the first time they are read.
 // Switching writes them into the sandbox's persistent Claude state; when the sandbox is running the agent is then
 // restarted in place with --continue so the conversation carries on.
 import fs from 'node:fs';
@@ -8,8 +10,10 @@ import { z } from 'zod';
 import { isSafeFileName } from '../../shared/paths/index.js';
 import { JsonFile } from '../../shared/io/index.js';
 import { storageOf } from '../storage/index.js';
-import { fail, fileExists } from '../../core/util/index.js';
-import { clearAccountCaches, emailOf, MAX_STATE_BYTES, readLogin, readUntrusted, sandboxLogin, writeSandboxJson, } from './claude-login.js';
+import { errMsg, fail, fileExists } from '../../core/util/index.js';
+import { SecretStore } from '../secrets/index.js';
+import { PluginShare } from './plugin-share.js';
+import { clearAccountCaches, emailOf, MAX_STATE_BYTES, readLogin, sandboxClaudeDir, readUntrusted, sandboxLogin, writeSandboxJson, } from './claude-login.js';
 const NAME = /^[A-Za-z0-9_-]{1,40}$/;
 const AccountSchema = z.object({
     name: z.string().regex(NAME),
@@ -22,6 +26,15 @@ const IndexSchema = z.object({
     default: z.string().regex(NAME).optional(),
     active: z.record(z.string().max(200), z.string().regex(NAME)).optional(),
 });
+/** On disk: the readable details and the sealed login ({ credentials, oauthAccount }). */
+const SealedSchema = z.object({
+    name: z.string().regex(NAME),
+    savedAt: z.string().max(64),
+    email: z.string().max(200).nullable(),
+    sealed: z.string().max(200000),
+});
+const StoredSchema = z.union([SealedSchema, AccountSchema]);
+const isSealed = (s) => 'sealed' in s;
 export function accountsDir(storageRoot) {
     return path.join(storageRoot, 'accounts');
 }
@@ -51,19 +64,87 @@ function assertName(name) {
 /** The saved Claude logins under <storage>\accounts, and which one each sandbox data folder uses. */
 export class AccountStore {
     storageRoot;
-    constructor(storageRoot) {
+    sharePlugins;
+    secrets;
+    /** What the last activate() did with the shared plugins (a problem there never stops the switch). */
+    pluginNote = null;
+    /** @param sharePlugins claudeProfile.sharePluginsAcrossAccounts: carry Claude plugins to the account switched to */
+    constructor(storageRoot, sharePlugins = false, secrets = SecretStore.standard()) {
         this.storageRoot = storageRoot;
+        this.sharePlugins = sharePlugins;
+        this.secrets = secrets;
+    }
+    /** With the setting on: refreshes the shared plugin set from this data set, or fills this data set from it. */
+    syncPlugins(dataPath) {
+        this.shareStep(dataPath, sandboxClaudeDir(dataPath));
+    }
+    shareStep(dataPath, claudeDir) {
+        this.pluginNote = null;
+        if (!this.sharePlugins)
+            return;
+        try {
+            const result = PluginShare.in(this.storageRoot).sync(dataPath, claudeDir);
+            if (result === 'restored')
+                this.pluginNote = 'Claude plugins were copied in from your other accounts.';
+        }
+        catch (e) {
+            this.pluginNote = 'Claude plugins were not copied: ' + errMsg(e);
+        }
     }
     file(name) {
-        return new JsonFile(AccountSchema, path.join(accountsDir(this.storageRoot), name + '.json'));
+        return new JsonFile(StoredSchema, path.join(accountsDir(this.storageRoot), name + '.json'));
+    }
+    seal(account) {
+        const { name, savedAt, email, credentials, oauthAccount } = account;
+        return { name, savedAt, email, sealed: this.secrets.sealJson({ credentials, oauthAccount }) };
     }
     store(name, login) {
         const account = { name, savedAt: new Date().toISOString(), email: emailOf(login.oauthAccount), ...login };
-        this.file(name).write(account);
+        this.file(name).write(this.seal(account));
         return account;
     }
+    /** The saved account's name, date and e-mail (nothing is decrypted). */
+    meta(name) {
+        const stored = validName(name) ? this.file(name).read() : null;
+        return stored ? { name: stored.name, savedAt: stored.savedAt, email: stored.email } : null;
+    }
+    /**
+     * The saved account with its login decrypted. A plain file from an older version is encrypted on the spot (it stays
+     * readable when that fails).
+     */
     read(name) {
-        return validName(name) ? this.file(name).read() : null;
+        const stored = validName(name) ? this.file(name).read() : null;
+        if (!stored)
+            return null;
+        if (isSealed(stored)) {
+            const login = this.secrets.openJson(stored.sealed);
+            return { name: stored.name, savedAt: stored.savedAt, email: stored.email, ...login };
+        }
+        try {
+            this.file(name).write(this.seal(stored));
+        }
+        catch {
+            // Could not encrypt now (DPAPI unavailable): the old plain file stays and is tried again next time.
+        }
+        return stored;
+    }
+    /** Encrypts every account still saved as plain text (older versions); returns how many it did. */
+    sealLegacy() {
+        const dir = accountsDir(this.storageRoot);
+        if (!fs.existsSync(dir))
+            return 0;
+        let done = 0;
+        for (const f of fs.readdirSync(dir).filter((x) => x.endsWith('.json') && x !== 'index.json')) {
+            const name = f.slice(0, -5);
+            const stored = validName(name) ? this.file(name).read() : null;
+            if (!stored || isSealed(stored))
+                continue;
+            this.read(name);
+            const after = this.file(name).read();
+            if (after && isSealed(after))
+                done++;
+        }
+        return done;
     }
     defaultName() {
         return readIndex(this.storageRoot).default ?? null;
@@ -76,12 +157,13 @@ export class AccountStore {
         const dir = accountsDir(this.storageRoot);
         if (!fs.existsSync(dir))
             return [];
+        this.sealLegacy();
         const def = this.defaultName();
         const active = this.activeFor(dataPath);
         return fs
             .readdirSync(dir)
             .filter((f) => f.endsWith('.json') && f !== 'index.json')
-            .map((f) => this.read(f.slice(0, -5)))
+            .map((f) => this.meta(f.slice(0, -5)))
             .filter((a) => a !== null)
             .map((a) => ({
             name: a.name,
@@ -114,7 +196,7 @@ export class AccountStore {
                     .join(', ') || 'none yet; save one with sandbox account save <name>'));
         const { claudeDir, globalStateFile } = sandboxLogin(dataPath);
         const outgoing = this.activeFor(dataPath);
-        if (outgoing && outgoing !== name && this.read(outgoing) && fileExists(path.join(claudeDir, '.credentials.json'))) {
+        if (outgoing && outgoing !== name && this.meta(outgoing) && fileExists(path.join(claudeDir, '.credentials.json'))) {
             try {
                 this.store(outgoing, readLogin(claudeDir, globalStateFile));
             }
@@ -128,20 +210,21 @@ export class AccountStore {
         const state = readUntrusted(globalStateFile, MAX_STATE_BYTES);
         if (account.oauthAccount && (state || !fileExists(globalStateFile)))
             writeSandboxJson(globalStateFile, { ...(state ?? {}), oauthAccount: account.oauthAccount });
+        this.shareStep(dataPath, claudeDir);
         setActive(dataPath, name);
         return account;
     }
     setDefault(name) {
-        if (name !== null && !this.read(name))
+        if (name !== null && !this.meta(name))
             fail('Unknown account "' + name + '".', 'See your accounts with: sandbox account list');
         updateIndex(this.storageRoot, (i) => ({ ...i, default: name ?? undefined }));
     }
     rename(name, to) {
         assertName(to);
         const account = this.read(name) ?? fail('Unknown account "' + name + '".', 'See your accounts with: sandbox account list');
-        if (this.read(to))
+        if (this.meta(to))
             fail('There is an account "' + to + '" already.', 'Pick another name.');
-        this.file(to).write({ ...account, name: to });
+        this.file(to).write(this.seal({ ...account, name: to }));
         fs.rmSync(this.file(name).file);
         updateIndex(this.storageRoot, (i) => ({
             ...i,
@@ -150,7 +233,7 @@ export class AccountStore {
         }));
     }
     remove(name) {
-        if (!this.read(name))
+        if (!this.meta(name))
             fail('Unknown account "' + name + '".', 'See your accounts with: sandbox account list');
         fs.rmSync(this.file(name).file);
         if (this.defaultName() === name)

package/dist/host/profile/agent-accounts.d.ts

@@ -1,12 +1,16 @@
+import { SecretStore } from '../secrets/index.js';
 import { type AccountRow } from './accounts.js';
 export declare class AgentAccountStore {
     private readonly storageRoot;
     private readonly agent;
     private readonly loginFiles;
+    private readonly secrets;
     /**
      * @param loginFiles files of the login, relative to the folder they are read from and written to
      */
-    constructor(storageRoot: string, agent: string, loginFiles: readonly string[]);
+    constructor(storageRoot: string, agent: string, loginFiles: readonly string[], secrets?: SecretStore);
+    /** Encrypts the plain login files of every account saved by an older version. */
+    sealLegacy(): void;
     private get dir();
     private folder;
     private index;

package/dist/host/profile/agent-accounts.js

@@ -1,11 +1,14 @@
 // Saved logins for agents other than Claude: <storage>\accounts\<agent>\<name>\ holds a copy of the agent's login files
-// (the harness `home.loginFiles`) and meta.json. Host-only storage, never mapped into a sandbox; switching copies the
-// files into the sandbox's persistent state. Claude keeps its own older layout (accounts.ts).
+// (the harness `home.loginFiles`, each one encrypted with Windows DPAPI as <file>.sealed) and meta.json. Host-only
+// storage, never mapped into a sandbox; switching decrypts the files into the sandbox's persistent state. Copies saved
+// by older versions were plain: they are encrypted the next time the accounts are listed or one is switched to.
+// Claude keeps its own older layout (accounts.ts).
 import fs from 'node:fs';
 import path from 'node:path';
 import { z } from 'zod';
 import { JsonFile } from '../../shared/io/index.js';
 import { isSafeFileName } from '../../shared/paths/index.js';
+import { SecretStore } from '../secrets/index.js';
 import { assertNoLinks, ensureDir, fail, isLink } from '../../core/util/index.js';
 import { accountsDir } from './accounts.js';
 const NAME = /^[A-Za-z0-9_-]{1,40}$/;
@@ -27,13 +30,36 @@ export class AgentAccountStore {
     storageRoot;
     agent;
     loginFiles;
+    secrets;
     /**
      * @param loginFiles files of the login, relative to the folder they are read from and written to
      */
-    constructor(storageRoot, agent, loginFiles) {
+    constructor(storageRoot, agent, loginFiles, secrets = SecretStore.standard()) {
         this.storageRoot = storageRoot;
         this.agent = agent;
         this.loginFiles = loginFiles;
+        this.secrets = secrets;
+    }
+    /** Encrypts the plain login files of every account saved by an older version. */
+    sealLegacy() {
+        if (!fs.existsSync(this.dir))
+            return;
+        for (const d of fs.readdirSync(this.dir, { withFileTypes: true })) {
+            if (!d.isDirectory() || d.isSymbolicLink() || !validName(d.name))
+                continue;
+            for (const f of this.loginFiles) {
+                const plain = path.join(this.folder(d.name), ...f.split(/[\\/]/));
+                if (!fs.existsSync(plain) || isLink(plain))
+                    continue;
+                try {
+                    fs.writeFileSync(plain + '.sealed', this.secrets.sealBytes(fs.readFileSync(plain)));
+                    fs.rmSync(plain);
+                }
+                catch {
+                    // Could not encrypt now: the plain copy stays readable and is tried again next time.
+                }
+            }
+        }
     }
     get dir() {
         return path.join(accountsDir(this.storageRoot), this.agent);
@@ -66,6 +92,7 @@ export class AgentAccountStore {
     list(dataPath) {
         if (!fs.existsSync(this.dir))
             return [];
+        this.sealLegacy();
         const def = this.defaultName();
         const active = this.activeFor(dataPath);
         return fs
@@ -95,7 +122,7 @@ export class AgentAccountStore {
         for (const f of found) {
             const dest = path.join(target, ...f.split(/[\\/]/));
             ensureDir(path.dirname(dest));
-            fs.copyFileSync(path.join(from, f), dest);
+            fs.writeFileSync(dest + '.sealed', this.secrets.sealBytes(fs.readFileSync(path.join(from, f))));
         }
         new JsonFile(MetaSchema, path.join(target, 'meta.json')).write({ name, savedAt: new Date().toISOString() });
     }
@@ -115,6 +142,7 @@ export class AgentAccountStore {
                 (this.list(dataPath)
                     .map((a) => a.name)
                     .join(', ') || 'none yet'));
+        this.sealLegacy();
         // Tokens rotate while the agent runs: the outgoing account's current files are saved back first.
         const outgoing = this.activeFor(dataPath);
         if (outgoing && outgoing !== name && this.meta(outgoing)) {
@@ -133,7 +161,9 @@ export class AgentAccountStore {
             if (isLink(dest))
                 fs.rmSync(dest);
             const saved = path.join(this.folder(name), ...f.split(/[\\/]/));
-            if (fs.existsSync(saved))
+            if (fs.existsSync(saved + '.sealed'))
+                fs.writeFileSync(dest, this.secrets.openBytes(fs.readFileSync(saved + '.sealed', 'utf8')));
+            else if (fs.existsSync(saved))
                 fs.copyFileSync(saved, dest);
             else
                 fs.rmSync(dest, { force: true });

package/dist/host/profile/claude-login.js

@@ -3,6 +3,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { assertTestWritable } from '../test-guard.js';
+import { hostDataFolder, hostDataRoot } from '../storage/index.js';
 import { assertNoLinks, fail, fileExists, isLink, removeLink, tryReadJson, writeJson } from '../../core/util/index.js';
 const MAX_LOGIN_BYTES = 1024 * 1024;
 /** .claude.json holds per-project state and can be large; still capped so a hostile file cannot exhaust memory. */
@@ -10,7 +11,7 @@ export const MAX_STATE_BYTES = 256 * 1024 * 1024;
 /** Caches tied to an account (Claude deletes these on /logout). */
 const ACCOUNT_CACHES = ['remote-settings.json', 'policy-limits.json', 'policy-limits.json.stamp.json'];
 export function sandboxClaudeDir(dataPath) {
-    return path.join(dataPath, 'state', 'claude');
+    return path.join(hostDataFolder(dataPath, 'state'), 'claude');
 }
 export function emailOf(oauthAccount) {
     const email = oauthAccount?.emailAddress;
@@ -32,7 +33,7 @@ export function readLogin(claudeDir, globalStateFile) {
 }
 /** The sandbox's Claude login files (refuses when the data folder holds a link on the way). */
 export function sandboxLogin(dataPath) {
-    assertNoLinks(dataPath, sandboxClaudeDir(dataPath));
+    assertNoLinks(hostDataRoot(dataPath), sandboxClaudeDir(dataPath));
     return {
         claudeDir: sandboxClaudeDir(dataPath),
         globalStateFile: path.join(sandboxClaudeDir(dataPath), '.claude.json'),

package/dist/host/profile/index.d.ts

@@ -3,6 +3,7 @@ export { findSecretFiles } from './secret-files.js';
 export { hostClaudeDir, hostGlobalStateFile, sandboxGlobalState, stageClaudeProfile } from './claude-profile.js';
 export { capturePersonalization } from './personalize.js';
 export { toRegFile, type RegValue } from './reg-file.js';
-export { AccountStore, accountsDir, type Account, type AccountRow } from './accounts.js';
+export { AccountStore, accountsDir, type Account, type AccountMeta, type AccountRow } from './accounts.js';
+export { PluginShare, PLUGIN_SETTING_KEYS, MAX_PLUGIN_FILES, MAX_PLUGIN_BYTES } from './plugin-share.js';
 export { AgentAccountStore } from './agent-accounts.js';
 export { sandboxClaudeDir } from './claude-login.js';

package/dist/host/profile/index.js

@@ -4,5 +4,6 @@ export { hostClaudeDir, hostGlobalStateFile, sandboxGlobalState, stageClaudeProf
 export { capturePersonalization } from './personalize.js';
 export { toRegFile } from './reg-file.js';
 export { AccountStore, accountsDir } from './accounts.js';
+export { PluginShare, PLUGIN_SETTING_KEYS, MAX_PLUGIN_FILES, MAX_PLUGIN_BYTES } from './plugin-share.js';
 export { AgentAccountStore } from './agent-accounts.js';
 export { sandboxClaudeDir } from './claude-login.js';

package/dist/host/profile/plugin-share.d.ts

@@ -0,0 +1,26 @@
+/** The settings.json keys that belong to plugins; nothing else of settings.json is copied. */
+export declare const PLUGIN_SETTING_KEYS: readonly ["enabledPlugins", "extraKnownMarketplaces"];
+export declare const MAX_PLUGIN_FILES = 20000;
+export declare const MAX_PLUGIN_BYTES: number;
+export type PluginShareResult = 'saved' | 'restored' | 'nothing';
+/** Copies a plugins folder: every entry a plain file or folder with a safe name, within the file and size caps. */
+export declare function copyPluginTree(from: string, to: string): void;
+export declare class PluginShare {
+    private readonly dir;
+    constructor(dir: string);
+    /** The shared set kept next to the saved accounts of a storage folder. */
+    static in(storageRoot: string): PluginShare;
+    /** When a sandbox ends: its plugins refresh the shared set. Never throws; returns the problem, if any. */
+    saveQuietly(dataPath: string, claudeDir: string): string | null;
+    private get pluginsDir();
+    private get settingsFile();
+    hasShared(): boolean;
+    /** Whether a Claude folder (the sandbox's) has plugins installed. */
+    static hasPlugins(claudeDir: string): boolean;
+    /** The plugins of a data set's Claude folder become the shared set (replacing the old one). */
+    save(dataPath: string, claudeDir: string): void;
+    /** The shared set goes into a data set's Claude folder; its own settings win, its other settings are untouched. */
+    restore(dataPath: string, claudeDir: string): void;
+    /** One step when an account is switched to. */
+    sync(dataPath: string, claudeDir: string): PluginShareResult;
+}

package/dist/host/profile/plugin-share.js

@@ -0,0 +1,146 @@
+// Claude plugins carried between sandbox data sets when the account changes (claudeProfile.sharePluginsAcrossAccounts).
+// One plugin set is kept in host-only storage (<storage>\accounts\shared-plugins): the plugins folder plus the plugin
+// keys of settings.json. A data set that has plugins refreshes it; one that has none (a fresh data set) receives it.
+// The sandbox wrote everything it holds: no links, bounded file count and size, nothing is executed, and logins
+// (.credentials.json, .claude.json) never travel with it.
+import fs from 'node:fs';
+import path from 'node:path';
+import { isSafeFileName } from '../../shared/paths/index.js';
+import { safeRemove } from '../../shared/io/index.js';
+import { assertNoLinks, ensureDir, errMsg, fail, fileExists, isLink, removeLink } from '../../core/util/index.js';
+import { assertTestWritable } from '../test-guard.js';
+import { readUntrusted, writeSandboxJson } from './claude-login.js';
+/** The settings.json keys that belong to plugins; nothing else of settings.json is copied. */
+export const PLUGIN_SETTING_KEYS = ['enabledPlugins', 'extraKnownMarketplaces'];
+export const MAX_PLUGIN_FILES = 20000;
+export const MAX_PLUGIN_BYTES = 1024 * 1024 * 1024;
+const MAX_SETTINGS_BYTES = 4 * 1024 * 1024;
+const MAX_DEPTH = 24;
+const INSTALLED = 'installed_plugins.json';
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Copies a plugins folder: every entry a plain file or folder with a safe name, within the file and size caps. */
+export function copyPluginTree(from, to) {
+    let files = 0;
+    let bytes = 0;
+    const walk = (src, dest, depth) => {
+        if (depth > MAX_DEPTH)
+            fail('The plugins folder is nested too deeply (' + from + ').', 'Remove the odd folders.');
+        ensureDir(dest);
+        for (const entry of fs.readdirSync(src)) {
+            const file = path.join(src, entry);
+            if (!isSafeFileName(entry))
+                fail('Plugin file name refused: ' + entry, 'Remove it from ' + from + '.');
+            if (isLink(file))
+                fail('Refusing to copy plugins: ' + file + ' is a link.', 'Remove the link and try again.');
+            const stat = fs.statSync(file);
+            if (stat.isDirectory())
+                walk(file, path.join(dest, entry), depth + 1);
+            else if (stat.isFile()) {
+                files++;
+                bytes += stat.size;
+                if (files > MAX_PLUGIN_FILES || bytes > MAX_PLUGIN_BYTES)
+                    fail('The plugins are too big to copy between accounts.', 'Remove unused plugins and try again.');
+                fs.copyFileSync(file, path.join(dest, entry));
+            }
+        }
+    };
+    walk(from, to, 0);
+}
+function pluginSettings(claudeDir) {
+    const settings = readUntrusted(path.join(claudeDir, 'settings.json'), MAX_SETTINGS_BYTES);
+    const out = {};
+    if (isObject(settings))
+        for (const key of PLUGIN_SETTING_KEYS)
+            if (isObject(settings[key]))
+                out[key] = settings[key];
+    return out;
+}
+export class PluginShare {
+    dir;
+    constructor(dir) {
+        this.dir = dir;
+    }
+    /** The shared set kept next to the saved accounts of a storage folder. */
+    static in(storageRoot) {
+        return new PluginShare(path.join(storageRoot, 'accounts', 'shared-plugins'));
+    }
+    /** When a sandbox ends: its plugins refresh the shared set. Never throws; returns the problem, if any. */
+    saveQuietly(dataPath, claudeDir) {
+        try {
+            if (PluginShare.hasPlugins(claudeDir))
+                this.save(dataPath, claudeDir);
+            return null;
+        }
+        catch (e) {
+            return errMsg(e);
+        }
+    }
+    get pluginsDir() {
+        return path.join(this.dir, 'plugins');
+    }
+    get settingsFile() {
+        return path.join(this.dir, 'settings.json');
+    }
+    hasShared() {
+        return fileExists(path.join(this.pluginsDir, INSTALLED));
+    }
+    /** Whether a Claude folder (the sandbox's) has plugins installed. */
+    static hasPlugins(claudeDir) {
+        const file = path.join(claudeDir, 'plugins', INSTALLED);
+        return !isLink(path.join(claudeDir, 'plugins')) && !isLink(file) && fileExists(file);
+    }
+    /** The plugins of a data set's Claude folder become the shared set (replacing the old one). */
+    save(dataPath, claudeDir) {
+        assertNoLinks(dataPath, path.join(claudeDir, 'plugins'));
+        assertTestWritable(this.dir);
+        const tmp = this.pluginsDir + '.new';
+        fs.rmSync(tmp, { recursive: true, force: true });
+        try {
+            copyPluginTree(path.join(claudeDir, 'plugins'), tmp);
+        }
+        catch (e) {
+            fs.rmSync(tmp, { recursive: true, force: true });
+            throw e;
+        }
+        fs.rmSync(this.pluginsDir, { recursive: true, force: true });
+        fs.renameSync(tmp, this.pluginsDir);
+        writeSandboxJson(this.settingsFile, pluginSettings(claudeDir));
+    }
+    /** The shared set goes into a data set's Claude folder; its own settings win, its other settings are untouched. */
+    restore(dataPath, claudeDir) {
+        assertNoLinks(dataPath, claudeDir);
+        const target = path.join(claudeDir, 'plugins');
+        ensureDir(claudeDir);
+        if (isLink(target))
+            removeLink(target);
+        else
+            safeRemove(target, claudeDir);
+        copyPluginTree(this.pluginsDir, target);
+        const shared = readUntrusted(this.settingsFile, MAX_SETTINGS_BYTES);
+        if (!isObject(shared))
+            return;
+        const file = path.join(claudeDir, 'settings.json');
+        const own = readUntrusted(file, MAX_SETTINGS_BYTES);
+        if (own !== null && !isObject(own))
+            return;
+        const merged = { ...(own ?? {}) };
+        for (const key of PLUGIN_SETTING_KEYS)
+            if (isObject(shared[key]))
+                merged[key] = { ...shared[key], ...(isObject(merged[key]) ? merged[key] : {}) };
+        writeSandboxJson(file, merged);
+    }
+    /** One step when an account is switched to. */
+    sync(dataPath, claudeDir) {
+        if (PluginShare.hasPlugins(claudeDir)) {
+            this.save(dataPath, claudeDir);
+            return 'saved';
+        }
+        if (this.hasShared()) {
+            this.restore(dataPath, claudeDir);
+            return 'restored';
+        }
+        return 'nothing';
+    }
+}

package/dist/host/projects/join.d.ts

@@ -1,8 +1,14 @@
 import type { ResolvedRun } from '../../core/types.js';
 import { type Missing } from '../../core/local-config/index.js';
 import { type ProjectSpec } from '../../shared/channel/index.js';
-import { type RegistryEntry } from './registry.js';
+import { type Registry, type RegistryEntry } from './registry.js';
 import { type ProjectMapper } from './mapper.js';
+/**
+ * The running sandbox's registry. When run\projects.json is missing, cannot be read or belongs to an earlier sandbox
+ * (another copy or version of this tool started this one), it is rebuilt from the launch folder, so a folder in one of
+ * the sandbox's roots can still join. null: no running sandbox reported a launch, or nothing to rebuild it from.
+ */
+export declare function runningRegistry(storageRoot: string, dataPath: string, protections: Registry['protections']): Registry | null;
 /** The launch folder of the running sandbox (host-only storage; its id comes from the guest, so it is checked). */
 export declare function runningLaunchPath(storageRoot: string, dataPath: string): string | null;
 /** What a session or command from this folder needs: where it is inside, and (for another project) its spec. */

package/dist/host/projects/join.js

@@ -17,12 +17,29 @@ import { RepoGuardStore } from '../guard/index.js';
 import { ProjectRegistry } from './registry.js';
 import { NeedsRestart, projectMapper } from './mapper.js';
 import { KnownProjects } from './known.js';
+/** A launch id as the launch writes it (it comes back from the guest, so it is checked before it names a folder). */
+const LAUNCH_ID = /^\d+-[0-9a-f]{6}$/;
+/**
+ * The running sandbox's registry. When run\projects.json is missing, cannot be read or belongs to an earlier sandbox
+ * (another copy or version of this tool started this one), it is rebuilt from the launch folder, so a folder in one of
+ * the sandbox's roots can still join. null: no running sandbox reported a launch, or nothing to rebuild it from.
+ */
+export function runningRegistry(storageRoot, dataPath, protections) {
+    const file = new ProjectRegistry(storageRoot);
+    const current = file.read();
+    const launchId = new RunDir(dataPath).readSandboxStatus()?.launchId;
+    if (!launchId || !LAUNCH_ID.test(launchId))
+        return current;
+    if (current?.launchId === launchId)
+        return current;
+    const launchPath = path.join(storageRoot, 'launches', launchId);
+    assertNoLinks(storageRoot, launchPath);
+    return file.rebuild(launchPath, launchId, protections);
+}
 /** The launch folder of the running sandbox (host-only storage; its id comes from the guest, so it is checked). */
 export function runningLaunchPath(storageRoot, dataPath) {
     const launchId = new RunDir(dataPath).readSandboxStatus()?.launchId;
-    if (!launchId ||
-        !/^\d+-[0-9a-f]{6}$/.test(launchId) ||
-        new ProjectRegistry(storageRoot).read()?.launchId !== launchId)
+    if (!launchId || !LAUNCH_ID.test(launchId) || new ProjectRegistry(storageRoot).read()?.launchId !== launchId)
         return null;
     const launchPath = path.join(storageRoot, 'launches', launchId);
     assertNoLinks(storageRoot, launchPath);
@@ -54,7 +71,7 @@ export async function joinRunning(o) {
     if (here?.project.primary)
         return { ...here, spec: null, run: null, notes: [], missing: null };
     const registry = registryFile.read() ??
-        fail('The running sandbox was started by an older version, so it cannot take another folder.', 'Stop it (sandbox stop) and start it again.');
+        fail("The record of the running sandbox's projects is missing, and its launch folder could not replace it.", 'Run sandbox doctor (it shows which copy of sandbox runs), or stop the sandbox (sandbox stop) and start it again.');
     // A folder below a project already in the sandbox uses that project; anything else becomes a project of its own.
     const root = here?.project.host ?? path.resolve(o.hostDir);
     const run = await o.resolve(root);

package/dist/host/projects/registry.d.ts

@@ -9,44 +9,44 @@ declare const RegistryEntrySchema: z.ZodObject<{
     host: z.ZodString;
     guest: z.ZodString;
     primary: z.ZodBoolean;
-    mechanism: z.ZodEnum<{
+    mechanism: z.ZodCatch<z.ZodEnum<{
         root: "root";
         launch: "launch";
         boot: "boot";
         wsb: "wsb";
-    }>;
+    }>>;
     registeredAt: z.ZodString;
-}, z.core.$strict>;
+}, z.core.$strip>;
 declare const RegistrySchema: z.ZodObject<{
     launchId: z.ZodString;
     protections: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>;
     roots: z.ZodArray<z.ZodObject<{
         host: z.ZodString;
         guest: z.ZodString;
-    }, z.core.$strict>>;
+    }, z.core.$strip>>;
     projects: z.ZodArray<z.ZodObject<{
         name: z.ZodString;
         host: z.ZodString;
         guest: z.ZodString;
         primary: z.ZodBoolean;
-        mechanism: z.ZodEnum<{
+        mechanism: z.ZodCatch<z.ZodEnum<{
             root: "root";
             launch: "launch";
             boot: "boot";
             wsb: "wsb";
-        }>;
+        }>>;
         registeredAt: z.ZodString;
-    }, z.core.$strict>>;
+    }, z.core.$strip>>;
     atBoot: z.ZodOptional<z.ZodObject<{
         memoryMb: z.ZodNullable<z.ZodNumber>;
         mappings: z.ZodArray<z.ZodObject<{
             host: z.ZodString;
             guest: z.ZodString;
             readOnly: z.ZodBoolean;
-        }, z.core.$strict>>;
+        }, z.core.$strip>>;
         widened: z.ZodRecord<z.ZodString, z.ZodString>;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export type AtBoot = NonNullable<z.output<typeof RegistrySchema>['atBoot']>;
 export type RegistryEntry = z.output<typeof RegistryEntrySchema>;
 export type Registry = z.output<typeof RegistrySchema>;
@@ -79,6 +79,12 @@ export declare class ProjectRegistry {
     here(hostDir: string): ProjectHere | null;
     /** The running sandbox's root containing this folder, if any. */
     rootHere(hostDir: string): RootMapping | null;
+    /**
+     * The record rebuilt from the running sandbox's launch folder (host-only storage), for when run\projects.json is
+     * missing, cannot be read or belongs to an earlier sandbox: the launch folder, and every folder mapped for other
+     * projects at boot as a root. Saved and returned; null when the launch folder does not have what it takes.
+     */
+    rebuild(launchPath: string, launchId: string, protections: Registry['protections']): Registry | null;
 }
 /**
  * The projects of a sandbox another user started and shares: what that user's record lists, in the shape of a registry.