windows-development-sandbox 1.5.0 → 1.9.0

package/dist/runtime/main.js

@@ -1363,11 +1363,11 @@ var require_lodash = __commonJS({
             return isFunction(object2[key]);
           });
         }
-        function baseGet(object2, path67) {
-          path67 = castPath(path67, object2);
-          var index = 0, length = path67.length;
+        function baseGet(object2, path75) {
+          path75 = castPath(path75, object2);
+          var index = 0, length = path75.length;
           while (object2 != null && index < length) {
-            object2 = object2[toKey(path67[index++])];
+            object2 = object2[toKey(path75[index++])];
           }
           return index && index == length ? object2 : undefined2;
         }
@@ -1431,10 +1431,10 @@ var require_lodash = __commonJS({
           });
           return accumulator;
         }
-        function baseInvoke(object2, path67, args) {
-          path67 = castPath(path67, object2);
-          object2 = parent(object2, path67);
-          var func = object2 == null ? object2 : object2[toKey(last(path67))];
+        function baseInvoke(object2, path75, args) {
+          path75 = castPath(path75, object2);
+          object2 = parent(object2, path75);
+          var func = object2 == null ? object2 : object2[toKey(last(path75))];
           return func == null ? undefined2 : apply(func, object2, args);
         }
         function baseIsArguments(value) {
@@ -1590,13 +1590,13 @@ var require_lodash = __commonJS({
             return object2 === source || baseIsMatch(object2, source, matchData);
           };
         }
-        function baseMatchesProperty(path67, srcValue) {
-          if (isKey(path67) && isStrictComparable(srcValue)) {
-            return matchesStrictComparable(toKey(path67), srcValue);
+        function baseMatchesProperty(path75, srcValue) {
+          if (isKey(path75) && isStrictComparable(srcValue)) {
+            return matchesStrictComparable(toKey(path75), srcValue);
           }
           return function(object2) {
-            var objValue = get(object2, path67);
-            return objValue === undefined2 && objValue === srcValue ? hasIn(object2, path67) : baseIsEqual(srcValue, objValue, COMPARE_PARTIAL_FLAG | COMPARE_UNORDERED_FLAG);
+            var objValue = get(object2, path75);
+            return objValue === undefined2 && objValue === srcValue ? hasIn(object2, path75) : baseIsEqual(srcValue, objValue, COMPARE_PARTIAL_FLAG | COMPARE_UNORDERED_FLAG);
           };
         }
         function baseMerge(object2, source, srcIndex, customizer, stack) {
@@ -1693,23 +1693,23 @@ var require_lodash = __commonJS({
           });
         }
         function basePick(object2, paths) {
-          return basePickBy(object2, paths, function(value, path67) {
-            return hasIn(object2, path67);
+          return basePickBy(object2, paths, function(value, path75) {
+            return hasIn(object2, path75);
           });
         }
         function basePickBy(object2, paths, predicate) {
           var index = -1, length = paths.length, result2 = {};
           while (++index < length) {
-            var path67 = paths[index], value = baseGet(object2, path67);
-            if (predicate(value, path67)) {
-              baseSet(result2, castPath(path67, object2), value);
+            var path75 = paths[index], value = baseGet(object2, path75);
+            if (predicate(value, path75)) {
+              baseSet(result2, castPath(path75, object2), value);
             }
           }
           return result2;
         }
-        function basePropertyDeep(path67) {
+        function basePropertyDeep(path75) {
           return function(object2) {
-            return baseGet(object2, path67);
+            return baseGet(object2, path75);
           };
         }
         function basePullAll(array2, values2, iteratee2, comparator) {
@@ -1783,14 +1783,14 @@ var require_lodash = __commonJS({
           var array2 = values(collection);
           return shuffleSelf(array2, baseClamp(n, 0, array2.length));
         }
-        function baseSet(object2, path67, value, customizer) {
+        function baseSet(object2, path75, value, customizer) {
           if (!isObject2(object2)) {
             return object2;
           }
-          path67 = castPath(path67, object2);
-          var index = -1, length = path67.length, lastIndex = length - 1, nested = object2;
+          path75 = castPath(path75, object2);
+          var index = -1, length = path75.length, lastIndex = length - 1, nested = object2;
           while (nested != null && ++index < length) {
-            var key = toKey(path67[index]), newValue = value;
+            var key = toKey(path75[index]), newValue = value;
             if (key === "__proto__" || key === "constructor" || key === "prototype") {
               return object2;
             }
@@ -1798,7 +1798,7 @@ var require_lodash = __commonJS({
               var objValue = nested[key];
               newValue = customizer ? customizer(objValue, key, nested) : undefined2;
               if (newValue === undefined2) {
-                newValue = isObject2(objValue) ? objValue : isIndex(path67[index + 1]) ? [] : {};
+                newValue = isObject2(objValue) ? objValue : isIndex(path75[index + 1]) ? [] : {};
               }
             }
             assignValue(nested, key, newValue);
@@ -1964,14 +1964,14 @@ var require_lodash = __commonJS({
             }
           return result2;
         }
-        function baseUnset(object2, path67) {
-          path67 = castPath(path67, object2);
-          var index = -1, length = path67.length;
+        function baseUnset(object2, path75) {
+          path75 = castPath(path75, object2);
+          var index = -1, length = path75.length;
           if (!length) {
             return true;
           }
           while (++index < length) {
-            var key = toKey(path67[index]);
+            var key = toKey(path75[index]);
             if (key === "__proto__" && !hasOwnProperty.call(object2, "__proto__")) {
               return false;
             }
@@ -1979,11 +1979,11 @@ var require_lodash = __commonJS({
               return false;
             }
           }
-          var obj = parent(object2, path67);
-          return obj == null || delete obj[toKey(last(path67))];
+          var obj = parent(object2, path75);
+          return obj == null || delete obj[toKey(last(path75))];
         }
-        function baseUpdate(object2, path67, updater, customizer) {
-          return baseSet(object2, path67, updater(baseGet(object2, path67)), customizer);
+        function baseUpdate(object2, path75, updater, customizer) {
+          return baseSet(object2, path75, updater(baseGet(object2, path75)), customizer);
         }
         function baseWhile(array2, predicate, isDrop, fromRight) {
           var length = array2.length, index = fromRight ? length : -1;
@@ -2866,11 +2866,11 @@ var require_lodash = __commonJS({
           var match = source.match(reWrapDetails);
           return match ? match[1].split(reSplitDetails) : [];
         }
-        function hasPath(object2, path67, hasFunc) {
-          path67 = castPath(path67, object2);
-          var index = -1, length = path67.length, result2 = false;
+        function hasPath(object2, path75, hasFunc) {
+          path75 = castPath(path75, object2);
+          var index = -1, length = path75.length, result2 = false;
           while (++index < length) {
-            var key = toKey(path67[index]);
+            var key = toKey(path75[index]);
             if (!(result2 = object2 != null && hasFunc(object2, key))) {
               break;
             }
@@ -3072,8 +3072,8 @@ var require_lodash = __commonJS({
             return apply(func, this, otherArgs);
           };
         }
-        function parent(object2, path67) {
-          return path67.length < 2 ? object2 : baseGet(object2, baseSlice(path67, 0, -1));
+        function parent(object2, path75) {
+          return path75.length < 2 ? object2 : baseGet(object2, baseSlice(path75, 0, -1));
         }
         function reorder(array2, indexes) {
           var arrLength = array2.length, length = nativeMin(indexes.length, arrLength), oldArray = copyArray(array2);
@@ -3230,7 +3230,7 @@ var require_lodash = __commonJS({
           }
           return isArrayLikeObject(array2) ? baseDifference(array2, baseFlatten(values2, 1, isArrayLikeObject, true), undefined2, comparator) : [];
         });
-        function drop(array2, n, guard) {
+        function drop2(array2, n, guard) {
           var length = array2 == null ? 0 : array2.length;
           if (!length) {
             return [];
@@ -3461,7 +3461,7 @@ var require_lodash = __commonJS({
         function sortedUniqBy(array2, iteratee2) {
           return array2 && array2.length ? baseSortedUniq(array2, getIteratee(iteratee2, 2)) : [];
         }
-        function tail(array2) {
+        function tail2(array2) {
           var length = array2 == null ? 0 : array2.length;
           return length ? baseSlice(array2, 1, length) : [];
         }
@@ -3708,10 +3708,10 @@ var require_lodash = __commonJS({
           }
           return isString(collection) ? fromIndex <= length && collection.indexOf(value, fromIndex) > -1 : !!length && baseIndexOf(collection, value, fromIndex) > -1;
         }
-        var invokeMap = baseRest(function(collection, path67, args) {
-          var index = -1, isFunc = typeof path67 == "function", result2 = isArrayLike(collection) ? Array2(collection.length) : [];
+        var invokeMap = baseRest(function(collection, path75, args) {
+          var index = -1, isFunc = typeof path75 == "function", result2 = isArrayLike(collection) ? Array2(collection.length) : [];
           baseEach(collection, function(value) {
-            result2[++index] = isFunc ? apply(path67, value, args) : baseInvoke(value, path67, args);
+            result2[++index] = isFunc ? apply(path75, value, args) : baseInvoke(value, path75, args);
           });
           return result2;
         });
@@ -4363,15 +4363,15 @@ var require_lodash = __commonJS({
         function functionsIn(object2) {
           return object2 == null ? [] : baseFunctions(object2, keysIn(object2));
         }
-        function get(object2, path67, defaultValue) {
-          var result2 = object2 == null ? undefined2 : baseGet(object2, path67);
+        function get(object2, path75, defaultValue) {
+          var result2 = object2 == null ? undefined2 : baseGet(object2, path75);
           return result2 === undefined2 ? defaultValue : result2;
         }
-        function has(object2, path67) {
-          return object2 != null && hasPath(object2, path67, baseHas);
+        function has(object2, path75) {
+          return object2 != null && hasPath(object2, path75, baseHas);
         }
-        function hasIn(object2, path67) {
-          return object2 != null && hasPath(object2, path67, baseHasIn);
+        function hasIn(object2, path75) {
+          return object2 != null && hasPath(object2, path75, baseHasIn);
         }
         var invert = createInverter(function(result2, value, key) {
           if (value != null && typeof value.toString != "function") {
@@ -4424,10 +4424,10 @@ var require_lodash = __commonJS({
             return result2;
           }
           var isDeep = false;
-          paths = arrayMap(paths, function(path67) {
-            path67 = castPath(path67, object2);
-            isDeep || (isDeep = path67.length > 1);
-            return path67;
+          paths = arrayMap(paths, function(path75) {
+            path75 = castPath(path75, object2);
+            isDeep || (isDeep = path75.length > 1);
+            return path75;
           });
           copyObject(object2, getAllKeysIn(object2), result2);
           if (isDeep) {
@@ -4453,19 +4453,19 @@ var require_lodash = __commonJS({
             return [prop];
           });
           predicate = getIteratee(predicate);
-          return basePickBy(object2, props, function(value, path67) {
-            return predicate(value, path67[0]);
+          return basePickBy(object2, props, function(value, path75) {
+            return predicate(value, path75[0]);
           });
         }
-        function result(object2, path67, defaultValue) {
-          path67 = castPath(path67, object2);
-          var index = -1, length = path67.length;
+        function result(object2, path75, defaultValue) {
+          path75 = castPath(path75, object2);
+          var index = -1, length = path75.length;
           if (!length) {
             length = 1;
             object2 = undefined2;
           }
           while (++index < length) {
-            var value = object2 == null ? undefined2 : object2[toKey(path67[index])];
+            var value = object2 == null ? undefined2 : object2[toKey(path75[index])];
             if (value === undefined2) {
               index = length;
               value = defaultValue;
@@ -4474,12 +4474,12 @@ var require_lodash = __commonJS({
           }
           return object2;
         }
-        function set2(object2, path67, value) {
-          return object2 == null ? object2 : baseSet(object2, path67, value);
+        function set2(object2, path75, value) {
+          return object2 == null ? object2 : baseSet(object2, path75, value);
         }
-        function setWith(object2, path67, value, customizer) {
+        function setWith(object2, path75, value, customizer) {
           customizer = typeof customizer == "function" ? customizer : undefined2;
-          return object2 == null ? object2 : baseSet(object2, path67, value, customizer);
+          return object2 == null ? object2 : baseSet(object2, path75, value, customizer);
         }
         var toPairs = createToPairs(keys);
         var toPairsIn = createToPairs(keysIn);
@@ -4501,15 +4501,15 @@ var require_lodash = __commonJS({
           });
           return accumulator;
         }
-        function unset(object2, path67) {
-          return object2 == null ? true : baseUnset(object2, path67);
+        function unset(object2, path75) {
+          return object2 == null ? true : baseUnset(object2, path75);
         }
-        function update(object2, path67, updater) {
-          return object2 == null ? object2 : baseUpdate(object2, path67, castFunction(updater));
+        function update(object2, path75, updater) {
+          return object2 == null ? object2 : baseUpdate(object2, path75, castFunction(updater));
         }
-        function updateWith(object2, path67, updater, customizer) {
+        function updateWith(object2, path75, updater, customizer) {
           customizer = typeof customizer == "function" ? customizer : undefined2;
-          return object2 == null ? object2 : baseUpdate(object2, path67, castFunction(updater), customizer);
+          return object2 == null ? object2 : baseUpdate(object2, path75, castFunction(updater), customizer);
         }
         function values(object2) {
           return object2 == null ? [] : baseValues(object2, keys(object2));
@@ -4532,7 +4532,7 @@ var require_lodash = __commonJS({
           }
           return baseClamp(toNumber(number4), lower, upper);
         }
-        function inRange(number4, start, end) {
+        function inRange2(number4, start, end) {
           start = toFinite(start);
           if (end === undefined2) {
             end = start;
@@ -4895,17 +4895,17 @@ var require_lodash = __commonJS({
         function matches(source) {
           return baseMatches(baseClone(source, CLONE_DEEP_FLAG));
         }
-        function matchesProperty(path67, srcValue) {
-          return baseMatchesProperty(path67, baseClone(srcValue, CLONE_DEEP_FLAG));
+        function matchesProperty(path75, srcValue) {
+          return baseMatchesProperty(path75, baseClone(srcValue, CLONE_DEEP_FLAG));
         }
-        var method = baseRest(function(path67, args) {
+        var method = baseRest(function(path75, args) {
           return function(object2) {
-            return baseInvoke(object2, path67, args);
+            return baseInvoke(object2, path75, args);
           };
         });
         var methodOf = baseRest(function(object2, args) {
-          return function(path67) {
-            return baseInvoke(object2, path67, args);
+          return function(path75) {
+            return baseInvoke(object2, path75, args);
           };
         });
         function mixin(object2, source, options) {
@@ -4952,12 +4952,12 @@ var require_lodash = __commonJS({
         var over = createOver(arrayMap);
         var overEvery = createOver(arrayEvery);
         var overSome = createOver(arraySome);
-        function property(path67) {
-          return isKey(path67) ? baseProperty(toKey(path67)) : basePropertyDeep(path67);
+        function property(path75) {
+          return isKey(path75) ? baseProperty(toKey(path75)) : basePropertyDeep(path75);
         }
         function propertyOf(object2) {
-          return function(path67) {
-            return object2 == null ? undefined2 : baseGet(object2, path67);
+          return function(path75) {
+            return object2 == null ? undefined2 : baseGet(object2, path75);
           };
         }
         var range = createRange();
@@ -5071,7 +5071,7 @@ var require_lodash = __commonJS({
         lodash.difference = difference;
         lodash.differenceBy = differenceBy;
         lodash.differenceWith = differenceWith;
-        lodash.drop = drop;
+        lodash.drop = drop2;
         lodash.dropRight = dropRight;
         lodash.dropRightWhile = dropRightWhile;
         lodash.dropWhile = dropWhile;
@@ -5151,7 +5151,7 @@ var require_lodash = __commonJS({
         lodash.sortedUniqBy = sortedUniqBy;
         lodash.split = split;
         lodash.spread = spread;
-        lodash.tail = tail;
+        lodash.tail = tail2;
         lodash.take = take;
         lodash.takeRight = takeRight;
         lodash.takeRightWhile = takeRightWhile;
@@ -5235,7 +5235,7 @@ var require_lodash = __commonJS({
         lodash.identity = identity;
         lodash.includes = includes;
         lodash.indexOf = indexOf;
-        lodash.inRange = inRange;
+        lodash.inRange = inRange2;
         lodash.invoke = invoke;
         lodash.isArguments = isArguments;
         lodash.isArray = isArray;
@@ -5410,12 +5410,12 @@ var require_lodash = __commonJS({
         LazyWrapper.prototype.findLast = function(predicate) {
           return this.reverse().find(predicate);
         };
-        LazyWrapper.prototype.invokeMap = baseRest(function(path67, args) {
-          if (typeof path67 == "function") {
+        LazyWrapper.prototype.invokeMap = baseRest(function(path75, args) {
+          if (typeof path75 == "function") {
             return new LazyWrapper(this);
           }
           return this.map(function(value) {
-            return baseInvoke(value, path67, args);
+            return baseInvoke(value, path75, args);
           });
         });
         LazyWrapper.prototype.reject = function(predicate) {
@@ -5532,8 +5532,8 @@ var require_lodash = __commonJS({
 });
 
 // src/guest/entries/main.ts
-import fs53 from "node:fs";
-import path66 from "node:path";
+import fs60 from "node:fs";
+import path74 from "node:path";
 
 // src/guest/runtime/paths.ts
 import path7 from "node:path";
@@ -6358,10 +6358,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path67) {
-  if (!path67)
+function getElementAtPath(obj, path75) {
+  if (!path75)
     return obj;
-  return path67.reduce((acc, key) => acc?.[key], obj);
+  return path75.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -6701,11 +6701,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path67, issues) {
+function prefixIssues(path75, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path67);
+    iss.path.unshift(path75);
     return iss;
   });
 }
@@ -7155,16 +7155,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path67 = []) => {
+  const processError = (error63, path75 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path67, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path75, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path67, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path75, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path67, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path75, ...issue2.path]);
       } else {
-        const fullpath = [...path67, ...issue2.path];
+        const fullpath = [...path75, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -7203,17 +7203,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path67 = []) => {
+  const processError = (error63, path75 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path67, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path75, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path67, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path75, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path67, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path75, ...issue2.path]);
       } else {
-        const fullpath = [...path67, ...issue2.path];
+        const fullpath = [...path75, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -7252,8 +7252,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path67 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path67) {
+  const path75 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path75) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -10030,9 +10030,9 @@ var $ZodTransform = /* @__PURE__ */ $constructor("$ZodTransform", (inst, def) =>
     }
     const _out = def.transform(payload.value, payload);
     if (ctx.async) {
-      const output2 = _out instanceof Promise ? _out : Promise.resolve(_out);
-      return output2.then((output3) => {
-        payload.value = output3;
+      const output3 = _out instanceof Promise ? _out : Promise.resolve(_out);
+      return output3.then((output4) => {
+        payload.value = output4;
         return payload;
       });
     }
@@ -10482,12 +10482,12 @@ var $ZodFunction = /* @__PURE__ */ $constructor("$ZodFunction", (inst, def) => {
       output: inst._def.output
     });
   };
-  inst.output = (output2) => {
+  inst.output = (output3) => {
     const F = inst.constructor;
     return new F({
       type: "function",
       input: inst._def.input,
-      output: output2
+      output: output3
     });
   };
   return inst;
@@ -23896,14 +23896,14 @@ var ZodTransform = /* @__PURE__ */ $constructor("ZodTransform", (inst, def) => {
         payload.issues.push(util_exports.issue(_issue));
       }
     };
-    const output2 = def.transform(payload.value, payload);
-    if (output2 instanceof Promise) {
-      return output2.then((output3) => {
-        payload.value = output3;
+    const output3 = def.transform(payload.value, payload);
+    if (output3 instanceof Promise) {
+      return output3.then((output4) => {
+        payload.value = output4;
         return payload;
       });
     }
-    payload.value = output2;
+    payload.value = output3;
     return payload;
   };
 });
@@ -24355,13 +24355,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path67 = ref.slice(1).split("/").filter(Boolean);
-  if (path67.length === 0) {
+  const path75 = ref.slice(1).split("/").filter(Boolean);
+  if (path75.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path67[0] === defsKey) {
-    const key = path67[1] === void 0 ? void 0 : decodeJSONPointerSegment(path67[1]);
+  if (path75[0] === defsKey) {
+    const key = path75[1] === void 0 ? void 0 : decodeJSONPointerSegment(path75[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -25292,6 +25292,9 @@ function enabled(what, markers) {
 function Packages(what, example) {
   return StringsSchema.describe(what + ", installed once and kept (e.g. " + example + ").");
 }
+function secret(schema) {
+  return schema.meta({ secret: true });
+}
 
 // src/core/schema/config.ts
 var import_lodash = __toESM(require_lodash(), 1);
@@ -25360,10 +25363,18 @@ var HarnessSchema = external_exports.strictObject({
   uvPackage: external_exports.string().optional().describe("Python package installed with `uv tool install` inside the sandbox (e.g. aider-chat)."),
   uvBin: external_exports.string().optional().describe("Command the uv package provides."),
   arguments: StringsSchema.describe("Arguments always passed to the agent."),
-  environment: external_exports.record(external_exports.string(), external_exports.string()).describe("Environment variables for the agent."),
+  environment: external_exports.record(external_exports.string(), secret(external_exports.string())).describe(
+    "Environment variables for the agent (API keys go here). Their values are shown as *** and are handed to the sandbox in a one-shot file, never kept in the launch folder. The agent can read its own environment."
+  ),
   home: HarnessHomeSchema.optional().describe(
     "Where its login lives inside the sandbox; leave out when the agent cannot be pointed at a folder (then its login is not kept between sandboxes)."
   ),
+  localState: external_exports.record(external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/), SubfolderSchema).optional().describe(
+    "Environment variable -> folder below the agent's own state folder (state\\<agent>) for SQLite databases. SQLite cannot run in a mapped folder, so the agent runs from a copy on the sandbox's disk (the variable points to it) that is copied from and back to that folder."
+  ),
+  bootReset: external_exports.array(SubfolderSchema).max(32).optional().describe(
+    "Files and folders below the agent's own state folder (state\\<agent>) that only work on the machine that wrote them (keys sealed with Windows DPAPI, local accounts it created). Every sandbox is a new machine, so they are deleted at each boot and the agent sets them up again."
+  ),
   resumeArguments: StringsSchema.optional().describe(
     "Arguments used when the agent is restarted in place (e.g. after an account switch) so it resumes the conversation."
   ),
@@ -25415,6 +25426,9 @@ var ClaudeProfileSchema = external_exports.strictObject({
   globalStateFile: external_exports.string().describe('Your .claude.json, or "auto". Empty string = do not copy.'),
   copyCredentials: external_exports.boolean().describe("Copy your Claude LOGIN into the sandbox. Prefer sandbox account instead."),
   overwrite: external_exports.boolean().describe("Refresh these settings from this PC on every launch."),
+  sharePluginsAcrossAccounts: external_exports.boolean().describe(
+    "When you switch Claude accounts, copy your Claude plugins (and which ones are enabled) into a data set that has none yet. Off by default: plugins are code that runs in your sessions."
+  ),
   syncHistory: external_exports.boolean().describe("Bring conversation history in, and sync new history back (path-translated)."),
   historyScope: external_exports.enum(["project", "all"]).describe(
     `Which history comes in: "project" = only the projects in this sandbox (other projects' conversations, file backups and prompts stay on this PC), "all" = everything. Only this sandbox's projects ever sync back.`
@@ -25438,6 +25452,9 @@ var MappingSchema = external_exports.strictObject({
   optional: external_exports.boolean().optional().describe("true = skip it quietly when the host folder does not exist.")
 });
 var SandboxSchema = external_exports.strictObject({
+  engine: external_exports.enum(["windows-sandbox", "hcs"]).describe(
+    '(alpha) What runs the sandbox. "windows-sandbox" = Windows Sandbox (the default: desktop, Windows Terminal, GPU, clipboard, audio, printers). "hcs" = a headless Hyper-V isolated Server Core container for agents (no desktop, GPU or clipboard); it needs Windows features and an image on this PC (sandbox engine check hcs lists what is missing), and starting it is not enabled yet in this alpha. sandbox engine shows what each engine can do. Yours only: a project file (.sandbox-config.json) cannot set it.'
+  ),
   memoryMb: external_exports.union([external_exports.literal("auto"), external_exports.number().int().min(2048)]).describe('Sandbox RAM in MB (>= 2048), or "auto": free RAM minus reserveHostMb, capped at maxMemoryMb.'),
   maxMemoryMb: external_exports.number().int().positive().describe('Upper limit for memoryMb "auto".'),
   maxMemoryPercent: external_exports.number().int().min(10).max(100).describe(`memoryMb "auto" never takes more than this share of this PC's total RAM (percent).`),
@@ -25447,10 +25464,22 @@ var SandboxSchema = external_exports.strictObject({
   pageFileMb: external_exports.number().int().min(0).max(262144).describe(
     `Size of the sandbox's paging file in MB, created at full size when it starts so it never grows while builds run (8 GB of its disk always stays free). Windows Sandbox starts with about 1 GB: parallel builds then fail with "The paging file is too small", and Windows grows the file under load. 0 = leave Windows' own.`
   ),
-  reserveHostMb: external_exports.number().int().nonnegative().describe('RAM always left for this PC when memoryMb is "auto".'),
-  vGpu: external_exports.boolean().describe("Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface."),
+  reserveHostMb: external_exports.number().int().nonnegative().describe(
+    'Memory always left for this PC when memoryMb is "auto": the sandbox gets at most (free RAM, and RAM plus paging file still unused) minus this.'
+  ),
+  agentMemoryHeadroomMb: external_exports.union([external_exports.literal("auto"), external_exports.literal("none"), external_exports.number().int().min(0)]).describe(
+    'Memory kept out of the agents reach inside the sandbox, in MB: everything the agents start (their builds, tests, tools) together may use at most the sandbox memory minus this; a runaway parallel build then gets out-of-memory errors in its own session instead of freezing or crashing the whole sandbox. "auto" = the larger of 2048 MB and 10 % of the sandbox memory; "none" = no limit. Yours only: a project file cannot change it.'
+  ),
+  pressureResponse: external_exports.boolean().describe(
+    "When the sandbox (or this PC) runs low on memory, slow the heaviest build programs down (lower priority) and, if that is not enough, pause the biggest compiler for a few seconds at a time, so heavy parallel builds slow down instead of closing the sandbox. Never touches the agents themselves. Yours only: a project file cannot change it."
+  ),
+  vGpu: external_exports.boolean().describe(
+    "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it)."
+  ),
   networking: external_exports.boolean().describe("Internet access. false is the only hard network isolation Windows Sandbox offers."),
-  clipboard: external_exports.boolean().describe("Shared clipboard between this PC and the sandbox."),
+  clipboard: external_exports.boolean().describe(
+    "Shared clipboard between this PC and the sandbox. Also lets an agent's copy (in sandbox attach) reach this PC's clipboard."
+  ),
   audioInput: external_exports.boolean().describe("Microphone access."),
   videoInput: external_exports.boolean().describe("Camera access."),
   printerRedirection: external_exports.boolean().describe("Printers from this PC."),
@@ -25491,7 +25520,10 @@ var NetworkSchema = external_exports.strictObject({
     "Reach servers in the sandbox from this PC: http://localhost:<pc> here goes to <sandbox> inside, while it runs. Nothing else on your network can use them."
   ),
   dns: external_exports.array(external_exports.string().regex(/^\d{1,3}(\.\d{1,3}){3}$/, "an IPv4 address like 1.1.1.1")).describe("DNS servers for the sandbox instead of your network's, e.g. 1.1.1.1 and 9.9.9.9."),
-  proxy: external_exports.string().regex(/^(https?:\/\/[^\s]+)?$/, "http://host:port").describe(
+  proxy: external_exports.string().regex(/^(https?:\/\/[^\s]+)?$/, "http://host:port").refine(
+    (v) => !/^https?:\/\/[^/?#]*@/i.test(v),
+    "no user name or password in the address (it would be stored in plain text and visible to the agent): use a proxy that needs no login"
+  ).describe(
     "An HTTP proxy the sandbox uses to reach the internet (HTTP_PROXY / HTTPS_PROXY for everything in it), e.g. http://proxy.corp:8080. Empty = none."
   )
 });
@@ -25893,6 +25925,17 @@ var APPS = [
     exe: "lazygit.exe",
     cli: true
   },
+  {
+    id: "jj",
+    name: "Jujutsu (jj)",
+    category: "git",
+    about: "Git-compatible version control; conflicts do not block a rebase. Pilot, untested with worktrees.",
+    size: "10 MB",
+    source: gh("jj-vcs/jj", "^jj-v[\\d.]+-x86_64-pc-windows-msvc\\.zip$"),
+    exe: "jj.exe",
+    cli: true,
+    fullGitOnly: true
+  },
   // ---- utilities
   {
     id: "7zip",
@@ -26421,6 +26464,26 @@ var APPS = [
     source: gh("gitleaks/gitleaks", "^gitleaks_[\\d.]+_windows_x64\\.zip$"),
     exe: "gitleaks.exe",
     cli: true
+  },
+  {
+    id: "ast-grep",
+    name: "ast-grep",
+    category: "cli",
+    about: "Search and rewrite code by its syntax tree (ast-grep, sg); prints only the matches.",
+    size: "15 MB",
+    source: gh("ast-grep/ast-grep", "^app-x86_64-pc-windows-msvc\\.zip$"),
+    exe: "ast-grep.exe",
+    cli: true
+  },
+  {
+    id: "rust-analyzer",
+    name: "rust-analyzer",
+    category: "cli",
+    about: "Rust language server: type errors and go-to-definition without cargo (for editors and the Claude LSP plugin).",
+    size: "18 MB",
+    source: gh("rust-lang/rust-analyzer", "^rust-analyzer-x86_64-pc-windows-msvc\\.zip$"),
+    exe: "rust-analyzer.exe",
+    cli: true
   }
 ];
 function appById(id) {
@@ -26529,6 +26592,33 @@ var ResumeSchema = external_exports.strictObject({
   )
 });
 
+// src/core/schema/web.ts
+var WebSchema = external_exports.strictObject({
+  enabled: external_exports.boolean().describe(
+    "(Beta) Allow the web UI: your sandbox sessions in a browser on this PC. Off by default, and nothing starts it by itself yet: sandbox web start works either way and runs it until sandbox web stop (or a restart of the PC)."
+  ),
+  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken.")
+});
+
+// src/core/schema/vpn.ts
+var VPN_PROVIDERS = ["nordvpn", "openvpn-file", "wireguard-file"];
+var VpnSchema = external_exports.strictObject({
+  enabled: external_exports.boolean().describe(
+    "Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
+  ),
+  provider: external_exports.enum(VPN_PROVIDERS).describe(
+    "nordvpn: a recommended NordVPN server is picked at every launch. openvpn-file: your own .ovpn file (configFile). wireguard-file: your own WireGuard .conf (configFile), e.g. from your company."
+  ),
+  protocol: external_exports.enum(["udp", "tcp"]).describe("udp is faster; tcp gets through networks that block udp."),
+  country: external_exports.string().regex(/^([A-Za-z][A-Za-z .'-]{0,39})?$/, "a country name or code like uk or Germany").describe("nordvpn: the country of the server, e.g. uk, us or Germany. Empty = the best server anywhere."),
+  configFile: external_exports.string().describe(
+    "openvpn-file / wireguard-file: the .ovpn or .conf file on this PC (an .ovpn has its certificates inside it). Files that run programs (script-security, up, down, plugin, PostUp ...) are refused. A WireGuard file holds your private key: it is read when a sandbox starts and handed over in a one-shot file. A project's file can never set this."
+  ),
+  killSwitch: external_exports.boolean().describe(
+    "Block all traffic that does not go through the tunnel: when the tunnel cannot start, the sandbox stays offline instead of using your normal connection. A project can only turn this on, never off."
+  )
+});
+
 // src/core/schema/config.ts
 var ConfigSchema = external_exports.strictObject({
   $schema: SchemaRefSchema.optional(),
@@ -26541,17 +26631,24 @@ var ConfigSchema = external_exports.strictObject({
   sandbox: SandboxSchema,
   sharing: SharingSchema,
   storage: external_exports.strictObject({
-    root: external_exports.string().min(1).describe("Where everything is kept on this PC (tools, databases, logins, launches)."),
+    root: external_exports.string().min(1).describe(
+      "Where everything is kept on this PC (tools, databases, logins, launches). The default is a private folder for you under %ProgramData%\\AgentSandbox\\users, which works for installs for one user and for everyone. sandbox storage move <folder> moves it."
+    ),
     persistAgentState: external_exports.boolean().describe("Keep agent logins and history between sandboxes."),
     dataName: NameSchema.describe("Name of the persistent data set (C:\\AgentData) shared by all workspaces."),
     markSandboxFiles: external_exports.boolean().describe(
       `Programs and scripts (.exe, .ps1, .bat, .cmd, .msi, .lnk ...) that appear or change in your project while a sandbox runs get Windows' "downloaded from the internet" mark, so SmartScreen and PowerShell ask before they run on this PC.`
     ),
+    contained: external_exports.enum(["off", "vhdx"]).describe(
+      '(beta) Keep the sandbox tools, state and logs inside one disk image file (vhdx) instead of loose folders, so scanning programs on this PC see one file. Not yet tried on a real PC. Turn it on with sandbox storage contained on (it moves your files and asks first); Windows asks for permission to mount the image when a sandbox starts. "off" = loose folders, as always. Yours only: a project file (.sandbox-config.json) cannot set it.'
+    ),
+    containedMaxGb: external_exports.number().int().min(8).max(4096).describe("(beta) Largest size, in GB, the disk image of storage.contained may grow to."),
     warnDataGb: external_exports.number().min(0).describe(
       "Say at launch when the persisted data (tools, databases, logins) is bigger than this many GB; 0 = never. sandbox data shows what takes the space."
     )
   }),
   network: NetworkSchema,
+  vpn: VpnSchema,
   provisioning: ProvisioningSchema,
   downloads: DownloadsSchema,
   toolchains: ToolchainsSchema,
@@ -26559,6 +26656,7 @@ var ConfigSchema = external_exports.strictObject({
     "Databases running inside the sandbox. Data persists in C:\\AgentData\\databases; each one starts at boot."
   ),
   attach: AttachSchema,
+  web: WebSchema,
   agentCommands: AgentCommandsSchema,
   secrets: SecretsSchema,
   personalization: toggle("Copy your desktop look (theme, accent, taskbar, wallpaper, ...) into the sandbox."),
@@ -26588,9 +26686,17 @@ var LocalOverridesSchema = external_exports.strictObject({
     "Scripts (.ps1 / .mjs / .cmd, relative to this file) run inside the sandbox before the agent."
   ),
   // This PC's resources are yours to share: CPU and paging file (this PC's disk) are not a project's to set.
-  sandbox: SandboxSchema.omit({ cpuLimit: true, pageFileMb: true }).partial(),
+  sandbox: SandboxSchema.omit({
+    cpuLimit: true,
+    pageFileMb: true,
+    engine: true,
+    agentMemoryHeadroomMb: true,
+    pressureResponse: true
+  }).partial(),
   // A project may block more (the LAN, hosts); it never opens hosts, ports, DNS or a proxy.
   network: NetworkSchema.pick({ blockPrivateRanges: true, blockHosts: true }).partial(),
+  // A project may turn the kill switch on, never off, and never choose a VPN, a server, a file or a login.
+  vpn: VpnSchema.pick({ killSwitch: true }).partial(),
   provisioning: ProvisioningSchema.pick({ copyFromHost: true, fallbackToInstall: true, refresh: true }).extend({ git: GitSchema.partial(), terminal: toggle("Windows Terminal as the sandbox window.").partial() }).partial(),
   downloads: DownloadsSchema.partial(),
   // Every toolchain setting, each one optional (a project usually only switches languages on or pins a version).
@@ -26695,8 +26801,34 @@ var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
     cwd: Text().optional(),
     createdAt: TimeSchema
   }),
-  external_exports.strictObject({ kind: external_exports.literal("ping"), id: IdSchema, createdAt: TimeSchema })
+  external_exports.strictObject({ kind: external_exports.literal("ping"), id: IdSchema, createdAt: TimeSchema }),
+  /**
+   * The PC's own memory or CPU is running low (the host watchdog): the sandbox slows its heaviest builds down for
+   * `seconds` (it never stops them) so Windows does not have to close it. Repeated while the PC stays low.
+   */
+  external_exports.strictObject({
+    kind: external_exports.literal("pressure"),
+    id: IdSchema,
+    reason: Text(300),
+    seconds: external_exports.number().int().min(10).max(300),
+    createdAt: TimeSchema
+  })
 ]);
+var PressureStatusSchema = external_exports.object({
+  level: external_exports.enum(["ok", "throttled", "suspending"]),
+  profile: external_exports.enum(["normal", "gentle"]),
+  /** Share of the sandbox's RAM still free and of its commit limit in use (percent). */
+  ramFreePercent: external_exports.number().int().min(0).max(100),
+  commitPercent: external_exports.number().int().min(0).max(100),
+  /** Programs running at lower priority because of it. */
+  lowered: external_exports.number().int().min(0).max(1024),
+  /** Programs paused right now (name, process id, seconds left). */
+  paused: external_exports.array(external_exports.object({ name: Text(64), pid: external_exports.number().int(), seconds: external_exports.number().int().min(0).max(60) })).max(8),
+  /** The PC itself asked for slowing down (its memory or CPU is low). */
+  pcLow: external_exports.boolean(),
+  lastAction: Text(300),
+  updatedAt: TimeSchema
+});
 var GuestResponseSchema = external_exports.object({
   id: IdSchema,
   ok: external_exports.boolean(),
@@ -26731,6 +26863,16 @@ var ProjectStatusSchema = external_exports.object({
   databases: external_exports.array(external_exports.object({ database: Text(32), port: external_exports.number().int() })).max(16),
   summary: external_exports.array(Text(512)).max(64)
 });
+var VpnStatusSchema = external_exports.object({
+  state: external_exports.enum(["off", "starting", "up", "failed"]),
+  message: Text(2e3),
+  killSwitch: external_exports.boolean(),
+  /** The server's name, e.g. uk2201.nordvpn.com. */
+  server: Text(128).optional(),
+  /** What the sandbox's traffic looks like from outside, once the tunnel is up. */
+  publicIp: Text(64).optional(),
+  updatedAt: TimeSchema
+});
 
 // src/shared/io/json.ts
 import fs2 from "node:fs";
@@ -26894,20 +27036,28 @@ var scan = (schema, dir) => {
 var RunDir = class {
   root;
   sandboxFile;
+  vpnFile;
+  /** What the memory governor in the sandbox is doing (pressure.json). */
+  pressureFile;
   requestsDir;
   responsesDir;
   sessionsDir;
   projectsDir;
   /** audit.processes: programs the sandbox started, in small .jsonl files the host takes in and deletes. */
   auditDir;
+  /** One-shot secrets the host hands over (see secrets.ts). Next to run, not in it: shared-use users can change run. */
+  secretsDir;
   constructor(dataDir2) {
     this.root = path6.join(dataDir2, "run");
     this.sandboxFile = path6.join(this.root, "sandbox.json");
+    this.vpnFile = path6.join(this.root, "vpn.json");
+    this.pressureFile = path6.join(this.root, "pressure.json");
     this.requestsDir = path6.join(this.root, "requests");
     this.responsesDir = path6.join(this.root, "responses");
     this.sessionsDir = path6.join(this.root, "sessions");
     this.projectsDir = path6.join(this.root, "projects");
     this.auditDir = path6.join(this.root, "audit");
+    this.secretsDir = path6.join(dataDir2, "secrets");
   }
   requestFile(id) {
     return path6.join(this.requestsDir, safeId(id) + ".json");
@@ -26921,9 +27071,18 @@ var RunDir = class {
   projectFile(name) {
     return path6.join(this.projectsDir, safeId(name) + ".json");
   }
+  secretFile(id) {
+    return path6.join(this.secretsDir, safeId(id) + ".json");
+  }
   readSandboxStatus() {
     return readValid(SandboxStatusSchema, this.sandboxFile);
   }
+  readVpnStatus() {
+    return readValid(VpnStatusSchema, this.vpnFile);
+  }
+  readPressure() {
+    return readValid(PressureStatusSchema, this.pressureFile);
+  }
   readSession(id) {
     return readValid(SessionStatusSchema, this.sessionFile(id));
   }
@@ -27047,6 +27206,7 @@ var SYSTEM = {
   shutdown: () => system32("shutdown.exe"),
   dism: () => system32("Dism.exe"),
   msiexec: () => system32("msiexec.exe"),
+  sc: () => system32("sc.exe"),
   /** The .NET Framework C# compiler that ships with Windows (C# 5). */
   csc: () => path9.join(systemRoot(), "Microsoft.NET", "Framework64", "v4.0.30319", "csc.exe")
 };
@@ -27331,9 +27491,9 @@ function writeStatus(phase, message) {
 }
 
 // src/guest/boot/boot.ts
-import fs52 from "node:fs";
-import path65 from "node:path";
-import { spawn as spawn8 } from "node:child_process";
+import fs59 from "node:fs";
+import path73 from "node:path";
+import { spawn as spawn9 } from "node:child_process";
 
 // src/guest/boot/guide.ts
 import fs10 from "node:fs";
@@ -28664,7 +28824,9 @@ var SOURCES = {
   vswhere: "VsWhere.cs",
   openssl: "OpenSsl.cs",
   cargoshim: "CargoShim.cs",
-  linkgate: "LinkGate.cs"
+  linkgate: "LinkGate.cs",
+  pathsync: "PathSync.cs",
+  memgov: "MemGov.cs"
 };
 function sourceOf(name) {
   return path30.join(launchDir, "sandbox", "csharp", SOURCES[name]);
@@ -29014,7 +29176,7 @@ async function setupUv(env) {
     { size: "20 MB" }
   );
   Object.assign(env.vars, uvVars());
-  env.prepend.push(tool("uv-bin"));
+  env.prepend.push(mkdirp(tool("uv-bin")));
 }
 
 // src/guest/toolchains/tools/cli.ts
@@ -30015,7 +30177,7 @@ async function setupPython(env, config2, versions) {
   const py3 = await installPython("python", versions.python.spec);
   const shims = shimDir(py3);
   shimPair(shims, "3", py3);
-  env.prepend.push(py3, path46.join(py3, "Scripts"), shims);
+  env.prepend.push(py3, mkdirp(path46.join(py3, "Scripts")), shims);
   env.vars.PYTHONIOENCODING = "utf-8";
   env.summary.push(
     "python: " + path46.basename(py3).replace("python-", "") + " (from " + versions.python.source + "; py works too)"
@@ -31008,12 +31170,12 @@ function parseTree(text, errors = [], options = ParseOptions.DEFAULT) {
   }
   return result;
 }
-function findNodeAtLocation(root, path67) {
+function findNodeAtLocation(root, path75) {
   if (!root) {
     return void 0;
   }
   let node2 = root;
-  for (let segment of path67) {
+  for (let segment of path75) {
     if (typeof segment === "string") {
       if (node2.type !== "object" || !Array.isArray(node2.children)) {
         return void 0;
@@ -31367,14 +31529,14 @@ function getNodeType(value) {
 
 // node_modules/jsonc-parser/lib/esm/impl/edit.js
 function setProperty(text, originalPath, value, options) {
-  const path67 = originalPath.slice();
+  const path75 = originalPath.slice();
   const errors = [];
   const root = parseTree(text, errors);
   let parent = void 0;
   let lastSegment = void 0;
-  while (path67.length > 0) {
-    lastSegment = path67.pop();
-    parent = findNodeAtLocation(root, path67);
+  while (path75.length > 0) {
+    lastSegment = path75.pop();
+    parent = findNodeAtLocation(root, path75);
     if (parent === void 0 && value !== void 0) {
       if (typeof lastSegment === "string") {
         value = { [lastSegment]: value };
@@ -31560,8 +31722,8 @@ var ParseErrorCode;
   ParseErrorCode2[ParseErrorCode2["InvalidEscapeCharacter"] = 15] = "InvalidEscapeCharacter";
   ParseErrorCode2[ParseErrorCode2["InvalidCharacter"] = 16] = "InvalidCharacter";
 })(ParseErrorCode || (ParseErrorCode = {}));
-function modify(text, path67, value, options) {
-  return setProperty(text, path67, value, options);
+function modify(text, path75, value, options) {
+  return setProperty(text, path75, value, options);
 }
 function applyEdits(text, edits) {
   let sortedEdits = edits.slice(0).sort((a, b) => {
@@ -31802,6 +31964,16 @@ async function setupVscode(env, refresh) {
 import fs41 from "node:fs";
 import os8 from "node:os";
 import path51 from "node:path";
+
+// src/shared/memory/policy.ts
+function cargoJobs(cpus, memoryGb, sessions) {
+  const byCpu = Math.max(2, Math.min(4, Math.floor(cpus / 4)));
+  const byMemory = Math.max(1, Math.floor(memoryGb / 4));
+  const jobs = Math.min(byCpu, byMemory);
+  return Math.max(1, Math.min(jobs, Math.floor(8 / Math.max(1, sessions))));
+}
+
+// src/guest/toolchains/native/rust-extras.ts
 var cargoTarget = (targetDir) => {
   if (targetDir === "shared" || targetDir === "separate") return null;
   if (targetDir === "local") return path51.join(localDir, "cargo-target");
@@ -31836,7 +32008,7 @@ function linkGate(env, rust, host) {
 function cargoDefaults(host) {
   const file3 = tool("rust", "cargo", "config.toml");
   if (exists(file3) || !exists(path51.dirname(file3))) return;
-  const jobs = Math.max(2, Math.min(4, Math.floor(os8.cpus().length / 4)));
+  const jobs = cargoJobs(os8.cpus().length, os8.totalmem() / 1024 ** 3, 1);
   const gnu = host.endsWith("-gnu");
   fs41.writeFileSync(
     file3,
@@ -32110,14 +32282,179 @@ async function setupToolchains(config2, versions, options, run3 = {}) {
 }
 
 // src/guest/agents/agent-installer.ts
+import fs43 from "node:fs";
+import path56 from "node:path";
+
+// src/guest/setup/environment.ts
+import path55 from "node:path";
+
+// src/guest/agents/local-state.ts
 import fs42 from "node:fs";
 import path53 from "node:path";
 
-// src/guest/setup/environment.ts
+// src/guest/agents/agent-files.ts
 import path52 from "node:path";
+function agentPaths(toolsDir2, name, harness) {
+  const dir = path52.join(toolsDir2, "agents", name);
+  const exe = harness.hostExecutable ?? (harness.uvBin ? harness.uvBin + ".exe" : null);
+  return {
+    dir,
+    exe: exe ? path52.join(dir, exe) : null,
+    cmd: harness.npmBin ? path52.join(dir, harness.npmBin + ".cmd") : null
+  };
+}
+function agentCommand(name, harness) {
+  return harness.npmBin ?? harness.uvBin ?? (harness.hostExecutable ?? name).replace(/\.exe$/i, "");
+}
+function agentShims(toolsDir2, agents2) {
+  return Object.entries(agents2).flatMap(([name, harness]) => {
+    const p = agentPaths(toolsDir2, name, harness);
+    const target = p.exe ?? p.cmd;
+    const command = agentCommand(name, harness);
+    return target && /^[A-Za-z0-9_-]+$/.test(command) && /^[A-Za-z0-9_-]+$/.test(name) ? [{ name, command, target }] : [];
+  });
+}
+function shimText(shim3, install) {
+  return [
+    "@echo off",
+    "setlocal",
+    'set "SBX_REAL=' + shim3.target + '"',
+    'if exist "%SBX_REAL%" goto run',
+    "echo " + shim3.command + " is not installed in this sandbox yet. Installing it now (one time)...",
+    '"' + install.node + '" "' + install.script + '" install ' + shim3.name,
+    "if errorlevel 1 exit /b 1",
+    ":run",
+    'endlocal & "%SBX_REAL%" %*',
+    ""
+  ].join("\r\n");
+}
+function sbxAgentText(install) {
+  return '@"' + install.node + '" "' + install.script + '" %*\r\n';
+}
+function localStateEntries(agents2, stateDir2, localRoot2) {
+  return Object.entries(agents2).flatMap(
+    ([agent, harness]) => Object.entries(harness.localState ?? {}).map(([env, folder]) => ({
+      agent,
+      env,
+      store: path52.join(stateDir2, agent, folder),
+      local: path52.join(localRoot2, agent, folder),
+      processes: [agentCommand(agent, harness) + ".exe"],
+      legacy: path52.join(stateDir2, agent)
+    }))
+  );
+}
+function bootResetPaths(agents2, stateDir2) {
+  return Object.entries(agents2).flatMap(
+    ([agent, harness]) => (harness.bootReset ?? []).map((rel) => ({ agent, path: path52.join(stateDir2, agent, rel) }))
+  );
+}
+var isDatabaseFile = (name) => /\.(sqlite3?|db)(-wal|-shm)?$/i.test(name);
+var isCopyableDatabaseFile = (name) => isDatabaseFile(name) && !/-shm$/i.test(name);
+
+// src/guest/agents/local-state.ts
+var localRoot = () => path53.join(localDir, "agent-state");
+function agentLocalStates() {
+  return localStateEntries(session.agents ?? {}, stateDir, localRoot());
+}
+function localStateVars() {
+  return Object.fromEntries(agentLocalStates().map((s) => [s.env, s.local]));
+}
+var databaseFiles = (dir, keep) => exists(dir) ? fs42.readdirSync(dir, { withFileTypes: true }).flatMap((e) => e.isFile() && keep(e.name) ? [e.name] : []) : [];
+var copyFiles = (from, to, names) => {
+  fs42.rmSync(to, { recursive: true, force: true });
+  mkdirp(to);
+  for (const name of names) fs42.copyFileSync(path53.join(from, name), path53.join(to, name));
+};
+var swapIn = (incoming, store2) => {
+  const previous = store2 + ".previous";
+  fs42.rmSync(previous, { recursive: true, force: true });
+  if (exists(store2)) fs42.renameSync(store2, previous);
+  try {
+    fs42.renameSync(incoming, store2);
+  } catch (e) {
+    if (exists(previous)) fs42.renameSync(previous, store2);
+    throw e;
+  }
+  fs42.rmSync(previous, { recursive: true, force: true });
+};
+function adoptLegacy(s) {
+  if (exists(s.store)) return;
+  const names = databaseFiles(s.legacy, isDatabaseFile);
+  if (!names.length) return;
+  const copyable = names.filter(isCopyableDatabaseFile);
+  const incoming = s.store + ".incoming";
+  copyFiles(s.legacy, incoming, copyable);
+  swapIn(incoming, s.store);
+  const same = copyable.every(
+    (n) => fs42.statSync(path53.join(s.store, n)).size === fs42.statSync(path53.join(s.legacy, n)).size
+  );
+  if (!same) {
+    warn(s.agent + ": the copied databases differ in size from the originals; the originals were kept.");
+    return;
+  }
+  for (const n of names) fs42.rmSync(path53.join(s.legacy, n), { force: true });
+  log(s.agent + ": moved " + copyable.length + " database file(s) to " + s.store + ".");
+}
+function resetMachineBound() {
+  if (dryRun) return;
+  for (const { agent, path: target } of bootResetPaths(session.agents ?? {}, stateDir)) {
+    try {
+      const stat = fs42.lstatSync(target, { throwIfNoEntry: false });
+      if (!stat || stat.isSymbolicLink()) continue;
+      fs42.rmSync(target, { recursive: true, force: true });
+      log(
+        agent + ": removed " + path53.relative(path53.join(stateDir, agent), target) + " (it only worked in the last sandbox)."
+      );
+    } catch (e) {
+      warn(agent + ": could not remove " + target + " (" + errMsg(e) + ").");
+    }
+  }
+}
+function restoreLocalState() {
+  if (dryRun) return;
+  for (const s of agentLocalStates()) {
+    try {
+      adoptLegacy(s);
+      mkdirp(s.local);
+      const names = databaseFiles(s.store, isCopyableDatabaseFile);
+      for (const n of names) fs42.copyFileSync(path53.join(s.store, n), path53.join(s.local, n));
+      if (names.length) log(s.agent + ": databases restored to " + s.local + ".");
+    } catch (e) {
+      warn(s.agent + ": could not restore its databases (" + errMsg(e) + "); it starts with empty ones.");
+    }
+  }
+}
+
+// src/guest/setup/path-plan.ts
+import path54 from "node:path";
+function pathKey(folder) {
+  const slashes = folder.trim().replace(/^"|"$/g, "").replace(/\//g, "\\");
+  return (slashes.length > 3 ? slashes.replace(/\\+$/, "") : slashes).toLowerCase();
+}
+function splitPath(value) {
+  return value.split(";").map((part) => part.trim().replace(/^"|"$/g, "")).filter(Boolean);
+}
+function planPath(input2) {
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const entry of input2.entries.flatMap(splitPath)) {
+    const key = pathKey(entry);
+    if (seen.has(key) || input2.drop?.(entry) || !input2.exists(entry)) continue;
+    seen.add(key);
+    result.push(entry);
+  }
+  return result;
+}
+function isPinnedNodeDir(folder, nvmHome2) {
+  const key = pathKey(folder);
+  const home = pathKey(nvmHome2);
+  return key.startsWith(home + "\\") && /^v\d/.test(path54.win32.basename(key));
+}
+
+// src/guest/setup/environment.ts
 var LEGACY_HOMES = { CODEX_HOME: "codex", GEMINI_CLI_HOME: "gemini" };
 var agentHomes = () => Object.fromEntries(
-  Object.entries(session.agentHomes ?? LEGACY_HOMES).filter(([name]) => name !== "CLAUDE_CONFIG_DIR").map(([name, sub]) => [name, path52.join(stateDir, sub)])
+  Object.entries(session.agentHomes ?? LEGACY_HOMES).filter(([name]) => name !== "CLAUDE_CONFIG_DIR").map(([name, sub]) => [name, path55.join(stateDir, sub)])
 );
 var AGENT_VARS = [
   "CLAUDE_CONFIG_DIR",
@@ -32137,7 +32474,8 @@ function agentEnv(tools, target = { workspace, project: session.project, base: p
     ...tools.vars,
     CLAUDE_CONFIG_DIR: claudeDir,
     ...homes,
-    npm_config_cache: path52.join(toolsDir, "npm-cache"),
+    ...localStateVars(),
+    npm_config_cache: path55.join(toolsDir, "npm-cache"),
     npm_config_update_notifier: "false",
     AGENT_WORKSPACE: target.workspace,
     AGENT_DATA: dataDir,
@@ -32147,22 +32485,32 @@ function agentEnv(tools, target = { workspace, project: session.project, base: p
     AGENT_SANDBOX: "1",
     AGENT_SANDBOX_WORKSPACE: target.workspace
   };
-  for (const dir of [env.CLAUDE_CONFIG_DIR, ...Object.keys(homes).map((n) => env[n]), env.npm_config_cache])
+  const local = Object.keys(localStateVars());
+  for (const dir of [
+    env.CLAUDE_CONFIG_DIR,
+    ...Object.keys(homes).map((n) => env[n]),
+    env.npm_config_cache,
+    ...local.map((n) => env[n])
+  ])
     mkdirp(dir);
-  const runners = [path52.join(toolsDir, "node"), path52.dirname(process.execPath)].map((d) => d.toLowerCase());
-  const base = (target.base.PATH ?? "").split(path52.delimiter).filter((d) => d && !runners.includes(d.toLowerCase()));
-  env.PATH = [.../* @__PURE__ */ new Set([...tools.prepend, ...base, ...tools.append])].join(path52.delimiter);
+  const runners = [path55.join(toolsDir, "node"), path55.dirname(process.execPath)].map((d) => d.toLowerCase());
+  const base = (target.base.PATH ?? "").split(path55.delimiter).filter((d) => d && !runners.includes(d.toLowerCase()));
+  env.PATH = [.../* @__PURE__ */ new Set([...tools.prepend, ...base, ...tools.append])].join(path55.delimiter);
   return env;
 }
 function persistEnvironment(env, toolVars2) {
   if (!isWin || dryRun || testMode) return;
   const vars = Object.fromEntries(
-    [...toolVars2, ...AGENT_VARS, ...Object.keys(agentHomes())].filter((n) => env[n] !== void 0).map((n) => [n, env[n]])
+    [...toolVars2, ...AGENT_VARS, ...Object.keys(agentHomes()), ...Object.keys(localStateVars())].filter((n) => env[n] !== void 0).map((n) => [n, env[n]])
   );
   try {
     runScriptWithJson("set-machine-environment.ps1", "SettingsFile", {
       vars,
-      path: env.PATH ?? "",
+      path: planPath({
+        entries: [env.PATH ?? "", ...installedAgentDirs()],
+        exists,
+        drop: (dir) => isPinnedNodeDir(dir, nvmHome())
+      }).join(path55.delimiter),
       add: [],
       additive: false
     });
@@ -32172,12 +32520,20 @@ function persistEnvironment(env, toolVars2) {
 }
 function addMachineEnvironment(vars, dirs, additive = false) {
   if (!isWin || dryRun || testMode) return;
+  const planned = planPath({ entries: dirs, exists, drop: (dir) => isPinnedNodeDir(dir, nvmHome()) });
   try {
-    runScriptWithJson("set-machine-environment.ps1", "SettingsFile", { vars, path: null, add: dirs, additive });
+    runScriptWithJson("set-machine-environment.ps1", "SettingsFile", { vars, path: null, add: planned, additive });
   } catch (e) {
     warn("Could not add to the environment: " + errMsg(e));
   }
 }
+var nvmHome = () => path55.join(toolsDir, "nvm");
+function installedAgentDirs() {
+  return Object.entries(session.agents ?? {}).flatMap(([name, harness]) => {
+    const p = agentPaths(toolsDir, name, harness);
+    return p.exe && exists(p.exe) || p.cmd && exists(p.cmd) ? [p.dir] : [];
+  });
+}
 
 // src/guest/agents/profile-links.ts
 var profileRoot = () => process.env.USERPROFILE ?? "";
@@ -32199,19 +32555,11 @@ function linkHarnessProfile(name, harness) {
 }
 
 // src/guest/agents/agent-installer.ts
-function agentPaths(name, harness) {
-  const dir = path53.join(toolsDir, "agents", name);
-  const exe = harness.hostExecutable ?? (harness.uvBin ? harness.uvBin + ".exe" : null);
-  return {
-    dir,
-    exe: exe ? path53.join(dir, exe) : null,
-    cmd: harness.npmBin ? path53.join(dir, harness.npmBin + ".cmd") : null
-  };
-}
+var agentPaths2 = (name, harness) => agentPaths(toolsDir, name, harness);
 async function installViaNpm(name, harness, dir, env) {
   if (!harness.npmPackage)
     throw new Error("No npmPackage configured for " + name + " and no host executable was available.");
-  const npmCli = path53.join(path53.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+  const npmCli = path56.join(path56.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
   const args = [npmCli, "install", "--global", "--prefix", dir, harness.npmPackage, "--no-fund", "--no-audit"];
   log("Installing " + harness.npmPackage + " (this can take a minute)...");
   if (dryRun) {
@@ -32222,7 +32570,7 @@ async function installViaNpm(name, harness, dir, env) {
   await execAsync(process.execPath, args, { env });
 }
 async function installViaUv(name, harness, dir, env) {
-  const uv = path53.join(toolsDir, "uv", "uv.exe");
+  const uv = path56.join(toolsDir, "uv", "uv.exe");
   log("Installing " + harness.uvPackage + " with uv (this can take a minute)...");
   if (dryRun) {
     log("(dry run) uv tool install " + harness.uvPackage);
@@ -32237,8 +32585,8 @@ async function installViaUv(name, harness, dir, env) {
   });
 }
 function putOnPath(dir, env) {
-  const parts2 = (env.PATH ?? "").split(path53.delimiter);
-  if (!parts2.some((p) => p.toLowerCase() === dir.toLowerCase())) env.PATH = [...parts2, dir].join(path53.delimiter);
+  const parts2 = (env.PATH ?? "").split(path56.delimiter);
+  if (!parts2.some((p) => p.toLowerCase() === dir.toLowerCase())) env.PATH = [...parts2, dir].join(path56.delimiter);
   addMachineEnvironment({}, [dir], true);
 }
 var AgentInstaller = class {
@@ -32252,13 +32600,13 @@ var AgentInstaller = class {
     const current = this.installing.get(name);
     if (current) return current;
     linkHarnessProfile(name, harness);
-    const work = this.install(name, harness, env, refresh).then(() => putOnPath(agentPaths(name, harness).dir, env)).finally(() => this.installing.delete(name));
+    const work = this.install(name, harness, env, refresh).then(() => putOnPath(agentPaths2(name, harness).dir, env)).finally(() => this.installing.delete(name));
     this.installing.set(name, work);
     return work;
   }
   /** Program + arguments that start the agent (an npm .cmd shim has to go through cmd.exe). */
   resolveLaunch(name, harness) {
-    const p = agentPaths(name, harness);
+    const p = agentPaths2(name, harness);
     if (p.exe && exists(p.exe)) return { file: p.exe, args: [] };
     if (p.cmd && exists(p.cmd))
       return isWin ? { file: SYSTEM.cmd(), args: ["/d", "/c", p.cmd] } : { file: p.cmd, args: [] };
@@ -32271,7 +32619,7 @@ var AgentInstaller = class {
     return harness.uvPackage && !harness.npmPackage ? "uv" : "npm";
   }
   async install(name, harness, env, refresh) {
-    const p = agentPaths(name, harness);
+    const p = agentPaths2(name, harness);
     const cached2 = p.exe !== null && exists(p.exe) || p.cmd !== null && exists(p.cmd);
     if (cached2 && !refresh) {
       log(name + " already cached in persistent storage.");
@@ -32279,9 +32627,9 @@ var AgentInstaller = class {
     }
     mkdirp(p.dir);
     if (this.sourceOf(name, harness) === "host") {
-      const source = path53.join(hostToolsDir, "agents", name, harness.hostExecutable);
+      const source = path56.join(hostToolsDir, "agents", name, harness.hostExecutable);
       if (exists(source) && p.exe) {
-        fs42.copyFileSync(source, p.exe);
+        fs43.copyFileSync(source, p.exe);
         log("Copied " + name + " from this PC: " + source);
         return;
       }
@@ -32295,28 +32643,45 @@ var AgentInstaller = class {
 };
 var agents = new AgentInstaller();
 
+// src/guest/setup/shell-path.ts
+import fs44 from "node:fs";
+import path57 from "node:path";
+function installShellPath() {
+  if (!isWin || dryRun || testMode) return;
+  const helper = path57.join(mkdirp(path57.join(localDir, "bin")), "pathsync.exe");
+  fs44.copyFileSync(ensureCompiled("pathsync"), helper);
+  runScript("install-shell-path.ps1", [
+    "-Helper",
+    helper,
+    "-PwshDir",
+    path57.join(toolsDir, "pwsh"),
+    "-GitRoot",
+    path57.join(toolsDir, "git")
+  ]);
+}
+
 // src/guest/setup/claude-mem.ts
-import fs43 from "node:fs";
+import fs45 from "node:fs";
 import os9 from "node:os";
-import path54 from "node:path";
+import path58 from "node:path";
 var claudeMemPaths = {
-  store: path54.join(stateDir, "claude-mem"),
-  local: path54.join(os9.homedir(), ".claude-mem")
+  store: path58.join(stateDir, "claude-mem"),
+  local: path58.join(os9.homedir(), ".claude-mem")
 };
 var claudeMemEnabled = () => session.claudeProfile.syncClaudeMem && !dryRun;
 function restoreClaudeMem() {
   if (!claudeMemEnabled()) return;
   const previous = claudeMemPaths.store + ".previous";
-  if (!exists(claudeMemPaths.store) && exists(previous)) fs43.renameSync(previous, claudeMemPaths.store);
+  if (!exists(claudeMemPaths.store) && exists(previous)) fs45.renameSync(previous, claudeMemPaths.store);
   const backups = claudeMemPaths.store + ".backups";
-  if (!looksLikeSqlite(path54.join(claudeMemPaths.store, "claude-mem.db")) || !exists(claudeMemPaths.store)) {
-    const good = (exists(backups) ? fs43.readdirSync(backups).sort().reverse() : []).find(
-      (b) => exists(path54.join(backups, b, "claude-mem.db")) && looksLikeSqlite(path54.join(backups, b, "claude-mem.db"))
+  if (!looksLikeSqlite(path58.join(claudeMemPaths.store, "claude-mem.db")) || !exists(claudeMemPaths.store)) {
+    const good = (exists(backups) ? fs45.readdirSync(backups).sort().reverse() : []).find(
+      (b) => exists(path58.join(backups, b, "claude-mem.db")) && looksLikeSqlite(path58.join(backups, b, "claude-mem.db"))
     );
     if (good) {
       if (exists(claudeMemPaths.store))
-        fs43.renameSync(claudeMemPaths.store, claudeMemPaths.store + ".damaged-" + Date.now());
-      fs43.cpSync(path54.join(backups, good), claudeMemPaths.store, { recursive: true });
+        fs45.renameSync(claudeMemPaths.store, claudeMemPaths.store + ".damaged-" + Date.now());
+      fs45.cpSync(path58.join(backups, good), claudeMemPaths.store, { recursive: true });
       warn(
         "claude-mem: the stored database was missing or damaged; restored the backup from " + new Date(Number(good)).toISOString() + "."
       );
@@ -32329,33 +32694,33 @@ function restoreClaudeMem() {
 var SQLITE_HEADER = "SQLite format 3\0";
 var looksLikeSqlite = (file3) => {
   if (!exists(file3)) return true;
-  const fd = fs43.openSync(file3, "r");
+  const fd = fs45.openSync(file3, "r");
   try {
     const head = Buffer.alloc(16);
-    return fs43.readSync(fd, head, 0, 16, 0) === 16 && head.toString("latin1") === SQLITE_HEADER;
+    return fs45.readSync(fd, head, 0, 16, 0) === 16 && head.toString("latin1") === SQLITE_HEADER;
   } finally {
-    fs43.closeSync(fd);
+    fs45.closeSync(fd);
   }
 };
 var BACKUP_EVERY_MS = 6 * 3600 * 1e3;
 
 // src/guest/setup/claude-profile.ts
-import fs44 from "node:fs";
-import path55 from "node:path";
+import fs46 from "node:fs";
+import path59 from "node:path";
 var KEEP_SANDBOX_COPY = [".claude.json", ".credentials.json"];
 var fixPluginPaths = (hostConfigDir) => {
-  const plugins = path55.join(claudeDir, "plugins");
+  const plugins = path59.join(claudeDir, "plugins");
   if (!hostConfigDir || !exists(plugins)) return;
-  for (const name of fs44.readdirSync(plugins).filter((f) => f.endsWith(".json"))) {
-    const file3 = path55.join(plugins, name);
-    const text = fs44.readFileSync(file3, "utf8");
+  for (const name of fs46.readdirSync(plugins).filter((f) => f.endsWith(".json"))) {
+    const file3 = path59.join(plugins, name);
+    const text = fs46.readFileSync(file3, "utf8");
     const fixed = translatePaths(text, hostConfigDir, claudeDir);
-    if (fixed !== text) fs44.writeFileSync(file3, fixed, "utf8");
+    if (fixed !== text) fs46.writeFileSync(file3, fixed, "utf8");
   }
 };
 var readState2 = (file3) => {
   try {
-    return JSON.parse(fs44.readFileSync(file3, "utf8").replace(/^\uFEFF/, ""));
+    return JSON.parse(fs46.readFileSync(file3, "utf8").replace(/^\uFEFF/, ""));
   } catch {
     return null;
   }
@@ -32380,30 +32745,37 @@ function mergeMcpServers(hostFile, guestFile, hostWorkspace, guestWorkspace) {
   writeJsonAtomic(guestFile, merged);
   return Object.keys(host.mcpServers ?? {}).length + Object.keys(hostProject).length;
 }
-function syncClaudeProfile() {
+function syncClaudeProfile(credentials) {
   const profile = session.claudeProfile;
   if (profile.items.length === 0) {
     log("No Claude settings were staged from this PC.");
     return;
   }
-  const source = path55.join(launchDir, "claude-profile");
+  const source = path59.join(launchDir, "claude-profile");
   mkdirp(claudeDir);
   for (const name of profile.items) {
-    const from = path55.join(source, name);
-    const to = path55.join(claudeDir, name);
+    const from = path59.join(source, name);
+    const to = path59.join(claudeDir, name);
+    if (name === ".credentials.json") {
+      if (credentials && !exists(to)) {
+        fs46.writeFileSync(to, credentials, "utf8");
+        log("Claude settings: copied " + name + " from this PC");
+      } else log("Claude settings: kept the sandbox's " + name);
+      continue;
+    }
     if (!exists(from)) continue;
     if ((KEEP_SANDBOX_COPY.includes(name) || !profile.overwrite) && exists(to)) {
       log("Claude settings: kept the sandbox's " + name);
       continue;
     }
-    if (fs44.statSync(from).isDirectory()) safeRemove(to, claudeDir);
-    fs44.cpSync(from, to, { recursive: true, force: true });
+    if (fs46.statSync(from).isDirectory()) safeRemove(to, claudeDir);
+    fs46.cpSync(from, to, { recursive: true, force: true });
     log("Claude settings: copied " + name + " from this PC");
   }
   fixPluginPaths(profile.hostConfigDir);
   const mcp = mergeMcpServers(
-    path55.join(source, ".claude.json"),
-    path55.join(claudeDir, ".claude.json"),
+    path59.join(source, ".claude.json"),
+    path59.join(claudeDir, ".claude.json"),
     session.workspaceHost,
     workspace
   );
@@ -32412,11 +32784,11 @@ function syncClaudeProfile() {
 }
 
 // src/guest/setup/hooks.ts
-import fs45 from "node:fs";
-import path56 from "node:path";
+import fs47 from "node:fs";
+import path60 from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 var commandFor = (file3) => {
-  const ext = path56.extname(file3).toLowerCase();
+  const ext = path60.extname(file3).toLowerCase();
   if (ext === ".mjs" || ext === ".js") return [process.execPath, [file3]];
   if (!isWin) return null;
   if (ext === ".ps1")
@@ -32424,12 +32796,12 @@ var commandFor = (file3) => {
   if (ext === ".cmd" || ext === ".bat") return [SYSTEM.cmd(), ["/d", "/c", file3]];
   return null;
 };
-var BOOT = { root: path56.join(launchDir, "hooks"), cwd: workspace };
+var BOOT = { root: path60.join(launchDir, "hooks"), cwd: workspace };
 var hooksOf = (stage, target) => {
-  const dir = path56.join(target.root, stage);
+  const dir = path60.join(target.root, stage);
   if (!exists(dir)) return [];
-  return fs45.readdirSync(dir).sort().flatMap((name) => {
-    const command = commandFor(path56.join(dir, name));
+  return fs47.readdirSync(dir).sort().flatMap((name) => {
+    const command = commandFor(path60.join(dir, name));
     return command ? [{ name, command }] : [];
   });
 };
@@ -32447,8 +32819,8 @@ function runHooks(stage, env, target = BOOT) {
 }
 
 // src/guest/network/allow-only.ts
-import fs47 from "node:fs";
-import path58 from "node:path";
+import fs49 from "node:fs";
+import path62 from "node:path";
 import { spawn as spawn6, spawnSync as spawnSync6 } from "node:child_process";
 
 // src/shared/network/policy.ts
@@ -32543,8 +32915,8 @@ var PROXY_PORT = 38080;
 
 // src/guest/network/firewall.ts
 import dns from "node:dns";
-import fs46 from "node:fs";
-import path57 from "node:path";
+import fs48 from "node:fs";
+import path61 from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 
 // src/shared/network/firewall-rules.ts
@@ -32783,12 +33155,12 @@ async function applyNetworkPolicy(ptyHostExe) {
   return "blocked";
 }
 var FORWARD_RULE = "AgentSandbox-Forward";
-var HOSTS_FILE = path57.join(process.env.WINDIR ?? "C:\\Windows", "System32", "drivers", "etc", "hosts");
+var HOSTS_FILE = path61.join(process.env.WINDIR ?? "C:\\Windows", "System32", "drivers", "etc", "hosts");
 var applyBlockedHosts = () => {
   const hosts = session.network.blockHosts ?? [];
   if (!hosts.length) return;
-  const text = fs46.existsSync(HOSTS_FILE) ? fs46.readFileSync(HOSTS_FILE, "utf8") : "";
-  fs46.writeFileSync(HOSTS_FILE, withBlockedHosts(text, hosts));
+  const text = fs48.existsSync(HOSTS_FILE) ? fs48.readFileSync(HOSTS_FILE, "utf8") : "";
+  fs48.writeFileSync(HOSTS_FILE, withBlockedHosts(text, hosts));
   log("Blocked hosts (network.blockHosts): " + hosts.join(", "));
 };
 var applyDns = () => {
@@ -32843,11 +33215,11 @@ async function applyAllowOnly() {
     log("(dry run) would allow only: " + hosts.join(", "));
     return false;
   }
-  const exe = path58.join(toolsDir, "netproxy", "sbx-netproxy.exe");
-  fs47.mkdirSync(path58.dirname(exe), { recursive: true });
-  if (!fs47.existsSync(exe) || fs47.statSync(exe).size !== fs47.statSync(process.execPath).size)
-    fs47.copyFileSync(process.execPath, exe);
-  spawn6(exe, [path58.join(launchDir, "runtime", "netproxy.js")], {
+  const exe = path62.join(toolsDir, "netproxy", "sbx-netproxy.exe");
+  fs49.mkdirSync(path62.dirname(exe), { recursive: true });
+  if (!fs49.existsSync(exe) || fs49.statSync(exe).size !== fs49.statSync(process.execPath).size)
+    fs49.copyFileSync(process.execPath, exe);
+  spawn6(exe, [path62.join(launchDir, "runtime", "netproxy.js")], {
     detached: true,
     stdio: "ignore",
     windowsHide: true
@@ -32891,8 +33263,8 @@ async function applyAllowOnly() {
 }
 
 // src/guest/setup/managed-policy.ts
-import fs48 from "node:fs";
-import path59 from "node:path";
+import fs50 from "node:fs";
+import path63 from "node:path";
 
 // src/guest/setup/git-rules.ts
 var SHELLS = ["Bash", "PowerShell"];
@@ -32949,44 +33321,44 @@ function gitDenyRules(access) {
 
 // src/guest/setup/managed-policy.ts
 function managedSettingsFile() {
-  return path59.join(path59.dirname(managedClaudeMd()), "managed-settings.json");
+  return path63.join(path63.dirname(managedClaudeMd()), "managed-settings.json");
 }
 function writeManagedSettings2(access) {
   const file3 = managedSettingsFile();
   const deny = gitDenyRules(access);
   if (deny.length === 0) {
-    fs48.rmSync(file3, { force: true });
+    fs50.rmSync(file3, { force: true });
     return;
   }
-  fs48.mkdirSync(path59.dirname(file3), { recursive: true });
-  fs48.writeFileSync(file3, JSON.stringify({ permissions: { deny } }, null, 2) + "\n", "utf8");
+  fs50.mkdirSync(path63.dirname(file3), { recursive: true });
+  fs50.writeFileSync(file3, JSON.stringify({ permissions: { deny } }, null, 2) + "\n", "utf8");
 }
 
 // src/guest/setup/desktop.ts
-import fs49 from "node:fs";
+import fs51 from "node:fs";
 import os10 from "node:os";
-import path60 from "node:path";
+import path64 from "node:path";
 function applyPersonalization() {
-  const dir = path60.join(launchDir, "personalize");
+  const dir = path64.join(launchDir, "personalize");
   if (!session.personalization || !exists(dir) || dryRun || !isWin) return;
-  exec(SYSTEM.reg(), ["import", path60.join(dir, "personalize.reg")], { stdio: "ignore" });
-  const wallpaper = fs49.readdirSync(dir).find((f) => f.startsWith("wallpaper"));
-  const local = wallpaper ? path60.join(mkdirp(path60.join(os10.homedir(), "Pictures")), wallpaper) : null;
-  if (wallpaper && local) fs49.copyFileSync(path60.join(dir, wallpaper), local);
+  exec(SYSTEM.reg(), ["import", path64.join(dir, "personalize.reg")], { stdio: "ignore" });
+  const wallpaper = fs51.readdirSync(dir).find((f) => f.startsWith("wallpaper"));
+  const local = wallpaper ? path64.join(mkdirp(path64.join(os10.homedir(), "Pictures")), wallpaper) : null;
+  if (wallpaper && local) fs51.copyFileSync(path64.join(dir, wallpaper), local);
   runScript("set-desktop.ps1", local ? ["-Wallpaper", local] : []);
   log("Desktop personalisation applied from this PC.");
 }
 
 // src/guest/setup/git-identity.ts
-import fs50 from "node:fs";
+import fs52 from "node:fs";
 import os11 from "node:os";
-import path61 from "node:path";
+import path65 from "node:path";
 import { spawnSync as spawnSync7 } from "node:child_process";
 function setupGitConfig(env) {
   if (dryRun) return;
-  const source = path61.join(launchDir, "home", ".gitconfig");
-  if (exists(source)) fs50.copyFileSync(source, path61.join(os11.homedir(), ".gitconfig"));
-  const git = path61.join(toolsDir, "git", "cmd", "git.exe");
+  const source = path65.join(launchDir, "home", ".gitconfig");
+  if (exists(source)) fs52.copyFileSync(source, path65.join(os11.homedir(), ".gitconfig"));
+  const git = path65.join(toolsDir, "git", "cmd", "git.exe");
   if (!exists(git)) return;
   const { GIT_DIR: _gitDir, ...rest } = env;
   spawnSync7(git, ["config", "--global", "--add", "safe.directory", "*"], {
@@ -33004,35 +33376,35 @@ function ensurePtyHost() {
 }
 
 // src/guest/toolchains/leftovers.ts
-import fs51 from "node:fs";
-import path62 from "node:path";
+import fs53 from "node:fs";
+import path66 from "node:path";
 var STAGING = /\.staging-[0-9a-f]+$/i;
 var entries2 = (dir) => {
   try {
-    return fs51.readdirSync(dir, { withFileTypes: true });
+    return fs53.readdirSync(dir, { withFileTypes: true });
   } catch {
     return [];
   }
 };
 function pruneToolLeftovers() {
-  for (const legacy of ["ptyhost", "gitshim"]) safeRemove(path62.join(toolsDir, legacy), toolsDir);
+  for (const legacy of ["ptyhost", "gitshim"]) safeRemove(path66.join(toolsDir, legacy), toolsDir);
   for (const top of entries2(toolsDir)) {
-    const dir = path62.join(toolsDir, top.name);
+    const dir = path66.join(toolsDir, top.name);
     if (STAGING.test(top.name)) safeRemove(dir, toolsDir);
     else if (top.isDirectory())
-      for (const sub of entries2(dir).filter((e) => STAGING.test(e.name))) safeRemove(path62.join(dir, sub.name), dir);
+      for (const sub of entries2(dir).filter((e) => STAGING.test(e.name))) safeRemove(path66.join(dir, sub.name), dir);
   }
 }
 
 // src/guest/audit/process-audit.ts
-import path63 from "node:path";
+import path67 from "node:path";
 import { spawnSync as spawnSync8 } from "node:child_process";
 var PROCESS_CREATION = "{0CCE922B-69AE-11D9-BED3-505054503030}";
 var auditOn = () => Boolean(session.auditProcesses) && isWin && !dryRun;
 function enableProcessAudit() {
   if (!auditOn()) return;
   spawnSync8(
-    path63.join(process.env.WINDIR ?? "C:\\Windows", "System32", "auditpol.exe"),
+    path67.join(process.env.WINDIR ?? "C:\\Windows", "System32", "auditpol.exe"),
     ["/set", "/subcategory:" + PROCESS_CREATION, "/success:enable"],
     { windowsHide: true, stdio: "ignore" }
   );
@@ -33054,6 +33426,831 @@ function enableProcessAudit() {
   log("Audit: programs started in the sandbox are recorded (audit.processes).");
 }
 
+// src/guest/vpn/vpn.ts
+import dns2 from "node:dns";
+import fs57 from "node:fs";
+import os14 from "node:os";
+import path71 from "node:path";
+
+// src/shared/vpn/ovpn.ts
+var PROGRAM_DIRECTIVES = [
+  "script-security",
+  "up",
+  "down",
+  "up-restart",
+  "down-pre",
+  "route-up",
+  "route-pre-down",
+  "ipchange",
+  "tls-verify",
+  "plugin",
+  "client-connect",
+  "client-disconnect",
+  "learn-address",
+  "auth-user-pass-verify",
+  "setenv-safe",
+  "management",
+  "management-client",
+  "management-client-auth",
+  "management-hold",
+  "management-query-passwords",
+  "config",
+  "daemon",
+  "service",
+  "cd",
+  "chroot",
+  "setcon",
+  "log",
+  "log-append",
+  "writepid",
+  "status",
+  "askpass",
+  "engine",
+  "bcast-dev",
+  "dev-node",
+  "cryptoapicert",
+  "pkcs11-providers",
+  "pkcs12",
+  "http-proxy-user-pass",
+  "tmp-dir"
+];
+var ALLOWED = /* @__PURE__ */ new Set([
+  "client",
+  "tls-client",
+  "dev",
+  "dev-type",
+  "proto",
+  "remote",
+  "remote-random",
+  "remote-random-hostname",
+  "resolv-retry",
+  "nobind",
+  "persist-key",
+  "persist-tun",
+  "remote-cert-tls",
+  "remote-cert-eku",
+  "ns-cert-type",
+  "verify-x509-name",
+  "cipher",
+  "data-ciphers",
+  "data-ciphers-fallback",
+  "ncp-ciphers",
+  "auth",
+  "verb",
+  "mute",
+  "mute-replay-warnings",
+  "reneg-sec",
+  "reneg-bytes",
+  "reneg-pkts",
+  "tun-mtu",
+  "tun-mtu-extra",
+  "ping-timer-rem",
+  "fast-io",
+  "tls-timeout",
+  "push-peer-info",
+  "comp-noadapt",
+  "link-mtu",
+  "fragment",
+  "mssfix",
+  "sndbuf",
+  "rcvbuf",
+  "comp-lzo",
+  "compress",
+  "allow-compression",
+  "key-direction",
+  "auth-user-pass",
+  "auth-nocache",
+  "explicit-exit-notify",
+  "pull",
+  "pull-filter",
+  "route-nopull",
+  "route",
+  "route-ipv6",
+  "route-delay",
+  "route-metric",
+  "redirect-gateway",
+  "redirect-private",
+  "dhcp-option",
+  "block-outside-dns",
+  "register-dns",
+  "topology",
+  "tls-version-min",
+  "tls-version-max",
+  "tls-cipher",
+  "tls-ciphersuites",
+  "tls-groups",
+  "tls-exit",
+  "ping",
+  "ping-restart",
+  "ping-exit",
+  "keepalive",
+  "connect-retry",
+  "connect-retry-max",
+  "connect-timeout",
+  "server-poll-timeout",
+  "float",
+  "ifconfig-nowarn",
+  "tun-ipv6",
+  "disable-dco",
+  "windows-driver",
+  "ignore-unknown-option",
+  "opt-verify",
+  "setenv",
+  "key-method",
+  "replay-window",
+  "hand-window",
+  "tran-window",
+  "inactive",
+  "socket-flags",
+  "auth-retry",
+  "ca",
+  "cert",
+  "key",
+  "tls-auth",
+  "tls-crypt",
+  "tls-crypt-v2",
+  "extra-certs",
+  "dh"
+]);
+var FILE_DIRECTIVES = /* @__PURE__ */ new Set(["ca", "cert", "key", "tls-auth", "tls-crypt", "tls-crypt-v2", "extra-certs", "dh"]);
+var BLOCKS = /* @__PURE__ */ new Set(["ca", "cert", "key", "tls-auth", "tls-crypt", "tls-crypt-v2", "extra-certs", "dh"]);
+var MAX_OVPN_BYTES = 256 * 1024;
+var MAX_LINES = 4e3;
+var HOST = /^(?:\d{1,3}(?:\.\d{1,3}){3}|[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?)$/;
+function directiveOf(line) {
+  const text = line.replace(/^\uFEFF/, "").trim();
+  if (text === "" || text.startsWith("#") || text.startsWith(";")) return null;
+  const parts2 = text.replace(/^-+/, "").split(/\s+/);
+  return { name: parts2[0].toLowerCase(), args: parts2.slice(1) };
+}
+function inspectOvpn(text) {
+  const problems = [];
+  const found = [];
+  const refuse = (message) => {
+    if (problems.length < 20 && !problems.includes(message)) problems.push(message);
+  };
+  if (Buffer.byteLength(text, "utf8") > MAX_OVPN_BYTES) return { ok: false, problems: ["the file is too big"] };
+  if (text.includes("\0")) return { ok: false, problems: ["the file is not text"] };
+  const lines = text.split(/\r?\n/);
+  if (lines.length > MAX_LINES) return { ok: false, problems: ["the file has too many lines"] };
+  let block = null;
+  let defaultProto = "udp";
+  lines.forEach((line, i) => {
+    const at = "line " + (i + 1) + ": ";
+    const trimmed = line.trim();
+    if (block) {
+      if (trimmed.toLowerCase() === "</" + block + ">") block = null;
+      else if (/^<\/?[A-Za-z-]+>$/.test(trimmed)) refuse(at + "a section inside a section");
+      return;
+    }
+    const open2 = /^<([A-Za-z0-9-]+)>$/.exec(trimmed);
+    if (open2) {
+      const tag = open2[1].toLowerCase();
+      if (!BLOCKS.has(tag)) refuse(at + "<" + tag + "> is not allowed");
+      block = tag;
+      return;
+    }
+    const d = directiveOf(line);
+    if (!d) return;
+    if (!/^[a-z0-9-]{1,40}$/.test(d.name)) return refuse(at + "a directive name with odd characters");
+    if (PROGRAM_DIRECTIVES.includes(d.name))
+      return refuse(at + d.name + " runs a program or reads or writes a file on this machine");
+    if (!ALLOWED.has(d.name)) return refuse(at + d.name + " is not on the list of settings that are safe to accept");
+    if (FILE_DIRECTIVES.has(d.name))
+      return refuse(at + d.name + " names a file: certificates must be inside the profile");
+    if (d.name === "auth-user-pass" && d.args.length > 0)
+      return refuse(at + "auth-user-pass names a file: the login is given separately");
+    if (d.name === "setenv" && !(d.args[0] === "CLIENT_CERT" && d.args.length === 2))
+      return refuse(at + "setenv may only be CLIENT_CERT");
+    if (d.name === "proto") defaultProto = d.args[0]?.startsWith("tcp") ? "tcp" : "udp";
+    if (d.name === "remote") {
+      const [host, port = "1194", proto] = d.args;
+      if (!host || !HOST.test(host)) return refuse(at + "remote needs a host name or an IPv4 address");
+      const n = Number(port);
+      if (!Number.isInteger(n) || n < 1 || n > 65535) return refuse(at + "remote has an invalid port");
+      found.push({ host, port: n, ...proto ? { proto: proto.startsWith("tcp") ? "tcp" : "udp" } : {} });
+    }
+  });
+  const remotes = found.map((r) => ({ host: r.host, port: r.port, proto: r.proto ?? defaultProto }));
+  if (block) refuse("a <" + block + "> section is never closed");
+  if (remotes.length === 0) refuse("it names no remote server");
+  if (remotes.length > 64) refuse("it names too many servers");
+  return problems.length ? { ok: false, problems } : { ok: true, remotes };
+}
+function assertSafeOvpn(text, what) {
+  const report = inspectOvpn(text);
+  if (report.ok) return report.remotes;
+  throw new Error(
+    what + " was refused because it could run programs or is not a plain profile:\n  - " + report.problems.slice(0, 5).join("\n  - ")
+  );
+}
+
+// src/shared/vpn/wireguard.ts
+import net2 from "node:net";
+var MAX_WIREGUARD_BYTES = 16 * 1024;
+var MAX_LINES2 = 300;
+var MAX_PEERS = 16;
+var WIREGUARD_PROGRAM_KEYS = ["preup", "postup", "predown", "postdown", "table", "saveconfig"];
+var INTERFACE_KEYS = /* @__PURE__ */ new Set(["privatekey", "address", "dns", "mtu", "listenport"]);
+var PEER_KEYS = /* @__PURE__ */ new Set(["publickey", "presharedkey", "allowedips", "endpoint", "persistentkeepalive"]);
+var LIST_KEYS = /* @__PURE__ */ new Set(["address", "dns", "allowedips"]);
+var KEY = /^[A-Za-z0-9+/]{43}=$/;
+var HOST2 = /^(?:\d{1,3}(?:\.\d{1,3}){3}|[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?)$/;
+function validCidr(text) {
+  const [addr, prefix, ...rest] = text.split("/");
+  if (rest.length > 0 || !addr) return false;
+  const version2 = net2.isIP(addr);
+  if (version2 === 0) return false;
+  if (prefix === void 0) return true;
+  if (!/^\d{1,3}$/.test(prefix)) return false;
+  return Number(prefix) <= (version2 === 4 ? 32 : 128);
+}
+var inRange = (text, low, high) => {
+  if (!/^\d{1,5}$/.test(text)) return null;
+  const n = Number(text);
+  return n >= low && n <= high ? n : null;
+};
+var splitList = (text) => text.split(",").map((s) => s.trim()).filter(Boolean);
+function inspectWireguard(text) {
+  const problems = [];
+  const refuse = (message) => {
+    if (problems.length < 20 && !problems.includes(message)) problems.push(message);
+  };
+  if (Buffer.byteLength(text, "utf8") > MAX_WIREGUARD_BYTES) return { ok: false, problems: ["the file is too big"] };
+  if (text.includes("\0")) return { ok: false, problems: ["the file is not text"] };
+  const lines = (text.charCodeAt(0) === 65279 ? text.slice(1) : text).split(/\r?\n/);
+  if (lines.length > MAX_LINES2) return { ok: false, problems: ["the file has too many lines"] };
+  const sections = [];
+  let current = null;
+  lines.forEach((raw, i) => {
+    const at = "line " + (i + 1) + ": ";
+    const line = raw.replace(/#.*$/, "").trim();
+    if (!line) return;
+    const header = /^\[([A-Za-z]{1,20})\]$/.exec(line);
+    if (header) {
+      const name = header[1].toLowerCase();
+      if (name !== "interface" && name !== "peer") {
+        current = null;
+        return refuse(at + "[" + name + "] is not allowed");
+      }
+      current = { kind: name, values: /* @__PURE__ */ new Map() };
+      sections.push(current);
+      return;
+    }
+    const pair = /^([A-Za-z]{1,40})\s*=\s*(.*)$/.exec(line);
+    if (!pair) return refuse(at + 'not a "Key = value" line');
+    const key = pair[1].toLowerCase();
+    if (WIREGUARD_PROGRAM_KEYS.includes(key))
+      return refuse(at + pair[1] + " runs a program or changes how the tunnel is routed or saved");
+    if (!current) return refuse(at + pair[1] + " is outside a section");
+    if (!(current.kind === "interface" ? INTERFACE_KEYS : PEER_KEYS).has(key))
+      return refuse(at + pair[1] + " is not on the list of settings that are safe to accept");
+    const seen = current.values.get(key);
+    if (seen && !LIST_KEYS.has(key)) return refuse(at + pair[1] + " is given twice");
+    current.values.set(key, [...seen ?? [], pair[2].trim()]);
+  });
+  const one = (s, key) => s.values.get(key)?.[0];
+  const joined = (s, key) => (s.values.get(key) ?? []).flatMap(splitList);
+  const interfaces = sections.filter((s) => s.kind === "interface");
+  const peers = sections.filter((s) => s.kind === "peer");
+  if (interfaces.length !== 1) refuse("it needs exactly one [Interface] section");
+  if (peers.length === 0) refuse("it has no [Peer] section");
+  if (peers.length > MAX_PEERS) refuse("it has too many [Peer] sections");
+  if (problems.length) return { ok: false, problems };
+  const face = interfaces[0];
+  const privateKey = one(face, "privatekey");
+  if (!privateKey) refuse("[Interface] has no PrivateKey");
+  else if (!KEY.test(privateKey)) refuse("PrivateKey is not a WireGuard key (44 characters of base64)");
+  const addresses = joined(face, "address");
+  if (addresses.length === 0 || !addresses.every(validCidr)) refuse("[Interface] needs valid Address values");
+  else if (!addresses.some((a) => net2.isIPv4(a.split("/")[0])))
+    refuse("Address needs an IPv4 address (the kill switch works on IPv4)");
+  const dns3 = joined(face, "dns");
+  if (!dns3.every((d) => net2.isIP(d) !== 0)) refuse("DNS may only list IP addresses");
+  const mtuText = one(face, "mtu");
+  const mtu = mtuText === void 0 ? void 0 : inRange(mtuText, 576, 1500);
+  if (mtuText !== void 0 && mtu === null) refuse("MTU must be a number from 576 to 1500");
+  const portText = one(face, "listenport");
+  const listenPort = portText === void 0 ? void 0 : inRange(portText, 1, 65535);
+  if (portText !== void 0 && listenPort === null) refuse("ListenPort must be a number from 1 to 65535");
+  const checked = [];
+  peers.forEach((p, n) => {
+    const who = "[Peer] " + (n + 1) + ": ";
+    const publicKey = one(p, "publickey");
+    if (!publicKey || !KEY.test(publicKey)) return refuse(who + "PublicKey is missing or not a WireGuard key");
+    const preshared = one(p, "presharedkey");
+    if (preshared !== void 0 && !KEY.test(preshared)) return refuse(who + "PresharedKey is not a WireGuard key");
+    const allowed = joined(p, "allowedips");
+    if (allowed.length === 0 || !allowed.every(validCidr)) return refuse(who + "AllowedIPs is missing or invalid");
+    const endpoint = one(p, "endpoint");
+    const m = endpoint ? /^([^:[\]]+):(\d{1,5})$/.exec(endpoint) : null;
+    if (!m || !HOST2.test(m[1]) || inRange(m[2], 1, 65535) === null)
+      return refuse(who + "Endpoint must be host:port with a name or an IPv4 address");
+    if (/^\d+\.\d+\.\d+\.\d+$/.test(m[1]) && !net2.isIPv4(m[1])) return refuse(who + "Endpoint is not a valid address");
+    const keepText = one(p, "persistentkeepalive");
+    let keepalive;
+    if (keepText !== void 0 && keepText.toLowerCase() !== "off") {
+      const k = inRange(keepText, 0, 65535);
+      if (k === null) return refuse(who + "PersistentKeepalive must be a number or off");
+      keepalive = k;
+    }
+    checked.push({
+      publicKey,
+      ...preshared ? { presharedKey: preshared } : {},
+      allowedIps: allowed,
+      endpointHost: m[1],
+      endpointPort: Number(m[2]),
+      ...keepalive !== void 0 ? { keepalive } : {}
+    });
+  });
+  if (problems.length || !privateKey) return { ok: false, problems };
+  return {
+    ok: true,
+    config: {
+      privateKey,
+      addresses,
+      dns: dns3,
+      ...typeof mtu === "number" ? { mtu } : {},
+      ...typeof listenPort === "number" ? { listenPort } : {},
+      peers: checked
+    }
+  };
+}
+function assertSafeWireguard(text, what) {
+  const report = inspectWireguard(text);
+  if (report.ok) return report.config;
+  throw new Error(
+    what + " was refused because it could run programs or is not a plain WireGuard config:\n  - " + report.problems.slice(0, 5).join("\n  - ")
+  );
+}
+function renderWireguard(config2, endpointIps = {}) {
+  const out = ["[Interface]", "PrivateKey = " + config2.privateKey, "Address = " + config2.addresses.join(", ")];
+  if (config2.dns.length) out.push("DNS = " + config2.dns.join(", "));
+  if (config2.mtu !== void 0) out.push("MTU = " + config2.mtu);
+  if (config2.listenPort !== void 0) out.push("ListenPort = " + config2.listenPort);
+  config2.peers.forEach((p, i) => {
+    out.push("", "[Peer]", "PublicKey = " + p.publicKey);
+    if (p.presharedKey) out.push("PresharedKey = " + p.presharedKey);
+    out.push(
+      "AllowedIPs = " + p.allowedIps.join(", "),
+      "Endpoint = " + (endpointIps[i] ?? p.endpointHost) + ":" + p.endpointPort
+    );
+    if (p.keepalive !== void 0) out.push("PersistentKeepalive = " + p.keepalive);
+  });
+  return out.join("\r\n") + "\r\n";
+}
+function wireguardEndpoints(config2) {
+  return config2.peers.map((p) => ({ host: p.endpointHost, port: p.endpointPort }));
+}
+function wireguardTunnelAddress(config2) {
+  const found = config2.addresses.map((a) => a.split("/")[0]).find((a) => net2.isIPv4(a));
+  if (!found) throw new Error("the config has no IPv4 address");
+  return found;
+}
+function routesEverything(config2) {
+  return config2.peers.some((p) => p.allowedIps.some((a) => a === "0.0.0.0/0"));
+}
+function serviceRunning(scOutput) {
+  return /STATE\s*:\s*\d+\s+RUNNING/i.test(scOutput);
+}
+function handshakeDone(wgOutput) {
+  return wgOutput.split(/\r?\n/).some((line) => {
+    const t = /\s(\d+)\s*$/.exec(line);
+    return t !== null && Number(t[1]) > 0;
+  });
+}
+
+// src/shared/vpn/kill-switch.ts
+var VPN_RULE_PREFIX = "AgentSandbox-VPN-";
+var rule = (name, extra) => [
+  "advfirewall",
+  "firewall",
+  "add",
+  "rule",
+  "name=" + VPN_RULE_PREFIX + name,
+  "dir=out",
+  "action=allow",
+  "enable=yes",
+  "profile=any",
+  ...extra
+];
+var drop = (name) => [
+  "advfirewall",
+  "firewall",
+  "delete",
+  "rule",
+  "name=" + VPN_RULE_PREFIX + name
+];
+function ruleNames(serverCount) {
+  return [
+    "Loopback",
+    "DHCP",
+    "Host",
+    "Tunnel",
+    ...Array.from({ length: Math.max(serverCount, 0) }, (_v, i) => "Server-" + (i + 1))
+  ];
+}
+function cleanServers(servers) {
+  const seen = /* @__PURE__ */ new Set();
+  return servers.filter((s) => {
+    const key = s.proto + ":" + s.ip + ":" + s.port;
+    if (!isIPv4(s.ip) || !Number.isInteger(s.port) || s.port < 1 || s.port > 65535 || seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function killSwitchCommands(servers, ptyHostExe) {
+  const list = cleanServers(servers);
+  return [
+    ...ruleNames(Math.max(list.length, 8)).map(drop),
+    ["advfirewall", "set", "allprofiles", "state", "on"],
+    ["advfirewall", "set", "allprofiles", "firewallpolicy", "blockinbound,blockoutbound"],
+    rule("Loopback", ["protocol=any", "remoteip=127.0.0.0/8"]),
+    rule("DHCP", ["protocol=udp", "localport=68", "remoteport=67"]),
+    ...ptyHostExe ? [rule("Host", ["protocol=any", "remoteip=LocalSubnet", "program=" + ptyHostExe])] : [],
+    ...list.map(
+      (s, i) => rule("Server-" + (i + 1), ["protocol=" + s.proto, "remoteip=" + s.ip, "remoteport=" + s.port])
+    )
+  ];
+}
+function tunnelCommands(tunnelIp) {
+  if (!isIPv4(tunnelIp)) throw new Error("Not an IPv4 address: " + tunnelIp);
+  return [drop("Tunnel"), rule("Tunnel", ["protocol=any", "localip=" + tunnelIp])];
+}
+function tunnelAddressFromLog(log2) {
+  const add = /net_addr_v4_add:\s*(\d{1,3}(?:\.\d{1,3}){3})\/\d+/.exec(log2);
+  if (add && isIPv4(add[1])) return add[1];
+  const ifconfig = /(?:ifconfig|ip addr add|Notified TAP-Windows driver to set a DHCP IP\/netmask of)\s+(\d{1,3}(?:\.\d{1,3}){3})/i.exec(
+    log2
+  );
+  return ifconfig && isIPv4(ifconfig[1]) ? ifconfig[1] : null;
+}
+
+// src/guest/vpn/openvpn.ts
+import crypto4 from "node:crypto";
+import fs54 from "node:fs";
+import path68 from "node:path";
+
+// src/shared/vpn/download.ts
+var OPENVPN_MSI = {
+  version: "2.7.8",
+  x64: {
+    file: "OpenVPN-2.7.8-I001-amd64.msi",
+    sha256: "1ea61a3056905b90607d4b0f084c04e5cf3043e07cf192d9cd44b0474f29cc49"
+  },
+  arm64: {
+    file: "OpenVPN-2.7.8-I001-arm64.msi",
+    sha256: "6fc0e8899cc5275ee297fb837bc84aa2bc49f8ef96d7ad93ee3fee1e7163a25c"
+  },
+  base: "https://swupdate.openvpn.org/community/releases/"
+};
+var WIREGUARD_MSI = {
+  version: "1.1.1",
+  x64: {
+    file: "wireguard-amd64-1.1.1.msi",
+    sha256: "7bfed60ad61b785c914b38b61555a975488e1d3ec472dbfb2fcdf498fca75242"
+  },
+  arm64: {
+    file: "wireguard-arm64-1.1.1.msi",
+    sha256: "8336335c738d4aff040fa9d11b752da65a80b6f41d3262d6ba5e82f97ebd1bd4"
+  },
+  base: "https://download.wireguard.com/windows-client/"
+};
+
+// src/guest/vpn/openvpn.ts
+function openvpnExe(env = process.env) {
+  return path68.join(env.ProgramFiles ?? "C:\\Program Files", "OpenVPN", "bin", "openvpn.exe");
+}
+function openvpnDownload(arch2 = process.arch) {
+  const entry = arch2 === "arm64" ? OPENVPN_MSI.arm64 : OPENVPN_MSI.x64;
+  return { ...entry, url: OPENVPN_MSI.base + entry.file };
+}
+var hasHash = (file3, sha256) => crypto4.createHash("sha256").update(fs54.readFileSync(file3)).digest("hex") === sha256;
+async function ensureOpenVpn() {
+  const exe = openvpnExe();
+  if (!isWin || dryRun) return exe;
+  if (exists(exe)) return exe;
+  const dl = openvpnDownload();
+  const msi = path68.join(mkdirp(path68.join(toolsDir, "downloads")), dl.file);
+  if (!exists(msi) || !hasHash(msi, dl.sha256)) {
+    log("VPN: downloading OpenVPN " + OPENVPN_MSI.version + " (about 6 MB)");
+    await downloader.file(dl.url, msi, dl.sha256);
+  }
+  log("VPN: installing OpenVPN");
+  const logFile2 = path68.join(toolsDir, "downloads", "openvpn-install.log");
+  const code = await spawnAsync(SYSTEM.msiexec(), ["/i", msi, "/qn", "/norestart", "/l*v", logFile2], {
+    stdio: "ignore"
+  });
+  if (code !== 0 && code !== 3010)
+    throw new Error("The OpenVPN installer failed (exit " + code + "). Its log: " + logFile2);
+  if (!exists(exe)) throw new Error("OpenVPN was installed but " + exe + " is missing. The installer log: " + logFile2);
+  return exe;
+}
+
+// src/guest/vpn/tunnel.ts
+import { spawn as spawn7 } from "node:child_process";
+import fs55 from "node:fs";
+import os12 from "node:os";
+import path69 from "node:path";
+var DONE = "Initialization Sequence Completed";
+function failureReason(text) {
+  if (/AUTH_FAILED/i.test(text))
+    return "the VPN refused the login (for NordVPN use the service credentials, not your account password)";
+  if (/TLS Error: TLS key negotiation failed|TLS handshake failed/i.test(text))
+    return "it could not reach the VPN server (the network blocks it, or the server is down)";
+  if (/All wintun adapters on this system are in use|Cannot open TUN\/TAP|Could not create Wintun|ovpn-dco.*(error|failed)/i.test(
+    text
+  ))
+    return "the network driver for the tunnel could not be used";
+  if (/Exiting due to fatal error/i.test(text)) return "OpenVPN stopped with an error";
+  return null;
+}
+var tail = (text, lines = 12) => text.trim().split(/\r?\n/).slice(-lines).join("\n");
+async function startTunnel(o) {
+  const dir = fs55.mkdtempSync(path69.join(os12.tmpdir(), "sbx-vpn-"));
+  const auth = path69.join(dir, "login.txt");
+  const logFile2 = path69.join(dir, "openvpn.log");
+  const keepLog = () => {
+    try {
+      fs55.mkdirSync(logsDir, { recursive: true });
+      fs55.copyFileSync(logFile2, path69.join(logsDir, "openvpn.log"));
+    } catch {
+    }
+  };
+  fs55.writeFileSync(auth, o.username + "\r\n" + o.password + "\r\n", "utf8");
+  try {
+    const child = spawn7(
+      o.exe,
+      ["--config", o.profile, "--auth-user-pass", auth, "--auth-nocache", "--verb", "3", "--log", logFile2],
+      { detached: true, stdio: "ignore", windowsHide: true }
+    );
+    let exited = null;
+    child.once("exit", (code) => {
+      exited = code ?? -1;
+    });
+    child.once("error", (e) => {
+      exited = -1;
+      log("VPN: could not start OpenVPN: " + e.message);
+    });
+    child.unref();
+    const deadline = Date.now() + (o.timeoutMs ?? 9e4);
+    for (; ; ) {
+      const text = fs55.existsSync(logFile2) ? fs55.readFileSync(logFile2, "utf8") : "";
+      if (text.includes(DONE)) {
+        keepLog();
+        const tunnelIp = tunnelAddressFromLog(text) ?? void 0;
+        return { ok: true, message: "the tunnel is up", ...tunnelIp ? { tunnelIp } : {} };
+      }
+      const reason = failureReason(text);
+      if (exited !== null || reason) {
+        if (exited === null) child.kill();
+        keepLog();
+        return { ok: false, message: (reason ?? "OpenVPN stopped") + ". " + tail(text, 4) };
+      }
+      if (Date.now() > deadline) {
+        child.kill();
+        keepLog();
+        return { ok: false, message: "the tunnel did not come up in time. " + tail(text, 4) };
+      }
+      await new Promise((r) => setTimeout(r, 500));
+    }
+  } finally {
+    fs55.rmSync(auth, { force: true });
+  }
+}
+
+// src/guest/vpn/wireguard.ts
+import { execFile } from "node:child_process";
+import crypto5 from "node:crypto";
+import fs56 from "node:fs";
+import os13 from "node:os";
+import path70 from "node:path";
+var WIREGUARD_TUNNEL = "sandbox";
+function wireguardDir(env = process.env) {
+  return path70.join(env.ProgramFiles ?? "C:\\Program Files", "WireGuard");
+}
+function wireguardExe(env = process.env) {
+  return path70.join(wireguardDir(env), "wireguard.exe");
+}
+function wireguardDownload(arch2 = process.arch) {
+  const entry = arch2 === "arm64" ? WIREGUARD_MSI.arm64 : WIREGUARD_MSI.x64;
+  return { ...entry, url: WIREGUARD_MSI.base + entry.file };
+}
+var hasHash2 = (file3, sha256) => crypto5.createHash("sha256").update(fs56.readFileSync(file3)).digest("hex") === sha256;
+async function ensureWireguard() {
+  const exe = wireguardExe();
+  if (!isWin || dryRun) return exe;
+  if (exists(exe)) return exe;
+  const dl = wireguardDownload();
+  const msi = path70.join(mkdirp(path70.join(toolsDir, "downloads")), dl.file);
+  if (!exists(msi) || !hasHash2(msi, dl.sha256)) {
+    log("VPN: downloading WireGuard " + WIREGUARD_MSI.version + " (about 3 MB)");
+    await downloader.file(dl.url, msi, dl.sha256);
+  }
+  log("VPN: installing WireGuard");
+  const logFile2 = path70.join(toolsDir, "downloads", "wireguard-install.log");
+  const code = await spawnAsync(
+    SYSTEM.msiexec(),
+    ["/i", msi, "/qn", "/norestart", "DO_NOT_LAUNCH=1", "/l*v", logFile2],
+    {
+      stdio: "ignore"
+    }
+  );
+  if (code !== 0 && code !== 3010)
+    throw new Error("The WireGuard installer failed (exit " + code + "). Its log: " + logFile2);
+  if (!exists(exe))
+    throw new Error("WireGuard was installed but " + exe + " is missing. The installer log: " + logFile2);
+  return exe;
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function output2(file3, args) {
+  return new Promise((resolve2) => {
+    execFile(file3, args, { windowsHide: true, timeout: 15e3, maxBuffer: 1024 * 1024 }, (error62, stdout, stderr) => {
+      const code = error62 ? typeof error62.code === "number" ? error62.code : -1 : 0;
+      resolve2({ code, text: String(stdout) + String(stderr) });
+    });
+  });
+}
+var serviceName = () => "WireGuardTunnel$" + WIREGUARD_TUNNEL;
+var hasAdapter = (ip) => Object.values(os13.networkInterfaces()).some((list) => (list ?? []).some((i) => i.address === ip));
+async function removeWireguardTunnel(exe) {
+  try {
+    await output2(exe, ["/uninstalltunnelservice", WIREGUARD_TUNNEL]);
+  } catch {
+  }
+}
+async function startWireguardTunnel(o) {
+  const root = path70.join(process.env.SystemRoot ?? "C:\\Windows", "Temp");
+  const dir = fs56.mkdtempSync(path70.join(fs56.existsSync(root) ? root : os13.tmpdir(), "sbx-wg-"));
+  const file3 = path70.join(dir, WIREGUARD_TUNNEL + ".conf");
+  fs56.writeFileSync(file3, o.config, "utf8");
+  const fail = async (message) => {
+    await removeWireguardTunnel(o.exe);
+    return { ok: false, message };
+  };
+  try {
+    const install = await output2(o.exe, ["/installtunnelservice", file3]);
+    if (install.code !== 0) return await fail("WireGuard could not install the tunnel (exit " + install.code + ")");
+    const deadline = Date.now() + (o.timeoutMs ?? 6e4);
+    for (; ; ) {
+      const state = await output2(SYSTEM.sc(), ["query", serviceName()]);
+      if (serviceRunning(state.text) && hasAdapter(o.tunnelIp)) {
+        return { ok: true, message: "the tunnel service is running", tunnelIp: o.tunnelIp };
+      }
+      if (/STOPPED/i.test(state.text) || /1060/.test(state.text))
+        return await fail("the WireGuard tunnel service stopped (check the config: keys, address, endpoint)");
+      if (Date.now() > deadline)
+        return await fail("the WireGuard tunnel did not start in time (the network driver may not work here)");
+      await sleep(500);
+    }
+  } finally {
+    fs56.rmSync(dir, { recursive: true, force: true });
+  }
+}
+async function waitForHandshake(exe, poke, timeoutMs = 3e4) {
+  const wg = path70.join(path70.dirname(exe), "wg.exe");
+  if (!exists(wg)) return { ok: true, message: "the tunnel service is running (no wg.exe to check the handshake)" };
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    await poke().catch(() => void 0);
+    const shown = await output2(wg, ["show", WIREGUARD_TUNNEL, "latest-handshakes"]);
+    if (shown.code === 0 && handshakeDone(shown.text)) return { ok: true, message: "the server answered" };
+    if (Date.now() > deadline)
+      return {
+        ok: false,
+        message: "the VPN server did not answer (check the endpoint, the keys and that its UDP port is reachable)"
+      };
+    await sleep(1e3);
+  }
+}
+
+// src/guest/vpn/vpn.ts
+function setVpnStatus(state, message, extra = {}) {
+  try {
+    writeJsonAtomic(run.vpnFile, {
+      state,
+      message: message.slice(0, 1900),
+      killSwitch: session.vpn?.killSwitch ?? false,
+      updatedAt: now(),
+      ...session.vpn ? { server: session.vpn.server.slice(0, 120) } : {},
+      ...extra
+    });
+  } catch (e) {
+    warn("Could not write the VPN status: " + errMsg(e));
+  }
+}
+async function serverAddresses(remotes) {
+  const out = [];
+  for (const r of remotes) {
+    const ips = isIPv4(r.host) ? [r.host] : await dns2.promises.lookup(r.host, { all: true, family: 4 }).then(
+      (all) => all.map((a) => a.address),
+      () => []
+    );
+    for (const ip of ips) out.push({ ip, port: r.port, proto: r.proto });
+  }
+  return out;
+}
+async function wireguardServers(config2) {
+  const endpointIps = {};
+  const servers = [];
+  const found = wireguardEndpoints(config2);
+  for (let i = 0; i < found.length; i++) {
+    const [ip] = await serverAddresses([{ host: found[i].host, port: found[i].port, proto: "udp" }]).then(
+      (all) => all.map((s) => s.ip)
+    );
+    if (!ip) throw new Error("the VPN server address could not be found");
+    endpointIps[i] = ip;
+    servers.push({ ip, port: found[i].port, proto: "udp" });
+  }
+  return { servers, text: renderWireguard(config2, endpointIps) };
+}
+async function publicAddress() {
+  try {
+    const text = (await (await fetch("https://api.ipify.org", { signal: AbortSignal.timeout(1e4) })).text()).trim();
+    return /^[0-9a-fA-F.:]{3,45}$/.test(text) ? text : null;
+  } catch {
+    return null;
+  }
+}
+var hasAdapter2 = (ip) => Object.values(os14.networkInterfaces()).some((list) => (list ?? []).some((i) => i.address === ip));
+async function setupVpn(secrets, ptyHostExe) {
+  const vpn = session.vpn;
+  if (!vpn) return true;
+  const killSwitch = vpn.killSwitch;
+  let blocked = false;
+  const block = (servers) => {
+    if (isWin && !dryRun) run2(killSwitchCommands(servers, ptyHostExe));
+    blocked = true;
+    log("VPN: kill switch on: nothing leaves the sandbox except through the tunnel.");
+  };
+  setVpnStatus("starting", "Starting the VPN");
+  try {
+    if (!session.networking) throw new Error("networking is off for this sandbox");
+    let result;
+    let wireguardExe2 = null;
+    if (vpn.provider === "wireguard-file") {
+      if (!secrets.wireguardConfig) throw new Error("the WireGuard config did not arrive (start the sandbox again)");
+      const config2 = assertSafeWireguard(secrets.wireguardConfig, vpn.server);
+      const exe = await ensureWireguard();
+      const { servers, text } = await wireguardServers(config2);
+      if (killSwitch && !routesEverything(config2))
+        warn(
+          "VPN: AllowedIPs does not include 0.0.0.0/0: with the kill switch on, only the tunnel traffic can leave the sandbox."
+        );
+      if (killSwitch) block(servers);
+      if (dryRun || !isWin) {
+        log("(dry run) would start the WireGuard tunnel " + vpn.server);
+        setVpnStatus("off", "dry run");
+        return true;
+      }
+      log("VPN: connecting with " + vpn.server);
+      wireguardExe2 = exe;
+      result = await startWireguardTunnel({ exe, config: text, tunnelIp: wireguardTunnelAddress(config2) });
+      if (result.ok && result.tunnelIp && killSwitch) run2(tunnelCommands(result.tunnelIp));
+      if (result.ok) result = await waitForHandshake(exe, publicAddress);
+    } else {
+      const credentials = secrets.vpn;
+      if (!credentials) throw new Error("the VPN login did not arrive (start the sandbox again)");
+      const profile = path71.join(launchDir, "vpn", "server.ovpn");
+      const remotes = assertSafeOvpn(fs57.readFileSync(profile, "utf8"), vpn.server);
+      const exe = await ensureOpenVpn();
+      const servers = await serverAddresses(remotes);
+      if (servers.length === 0) throw new Error("the VPN server addresses could not be found");
+      if (killSwitch) block(servers);
+      if (dryRun || !isWin) {
+        log("(dry run) would start the VPN tunnel to " + vpn.server);
+        setVpnStatus("off", "dry run");
+        return true;
+      }
+      log("VPN: connecting to " + vpn.server);
+      result = await startTunnel({ exe, profile, username: credentials.username, password: credentials.password });
+      if (result.ok && result.tunnelIp && hasAdapter2(result.tunnelIp) && killSwitch)
+        run2(tunnelCommands(result.tunnelIp));
+    }
+    if (!result.ok) {
+      if (wireguardExe2) await removeWireguardTunnel(wireguardExe2);
+      throw new Error(result.message);
+    }
+    if (!result.tunnelIp || !hasAdapter2(result.tunnelIp))
+      throw new Error("the tunnel reported it was up, but no network adapter with its address appeared");
+    const publicIp = await publicAddress();
+    log("VPN: up" + (publicIp ? " (the sandbox appears as " + publicIp + ")" : "") + ".");
+    setVpnStatus("up", "The tunnel is up", publicIp ? { publicIp } : {});
+    return true;
+  } catch (e) {
+    const reason = errMsg(e);
+    try {
+      if (killSwitch && !blocked) block([]);
+    } catch (blockError) {
+      warn("VPN: could not close the network after the failure: " + errMsg(blockError));
+    }
+    const text = "VPN failed: " + reason + (killSwitch ? " The kill switch is on, so this sandbox has NO internet access." : " The kill switch is off, so this sandbox is using your normal connection.");
+    warn(text);
+    setVpnStatus("failed", reason);
+    return false;
+  }
+}
+
 // src/shared/pty/protocol.ts
 var FrameType = {
   Hello: 1,
@@ -33106,10 +34303,10 @@ var FrameReader = class {
 };
 
 // src/shared/pty/client.ts
-import net2 from "node:net";
+import net3 from "node:net";
 var connectOnce = (host, port, timeoutMs) => {
   return new Promise((resolve2, reject) => {
-    const socket = net2.connect({ host, port });
+    const socket = net3.connect({ host, port });
     const timer = setTimeout(() => {
       socket.destroy();
       reject(new Error("timed out connecting to " + host + ":" + port));
@@ -33145,7 +34342,14 @@ var KEPT_OSC = (body) => {
   return n <= 2 || n === 8 || n === 133 || n === 9 && body.startsWith(number4[1] + ";4;");
 };
 var MAX_KEPT_STRING = 4096;
+var MAX_CLIPBOARD_STRING = 1024 * 1024;
+var CLIPBOARD_WRITE = /^0{0,2}52;[cpqs0-7]{0,8};[A-Za-z0-9+/=]*$/;
 var OutputFilter = class {
+  constructor(options = {}) {
+    this.options = options;
+    this.maxString = options.clipboardWrites ? MAX_CLIPBOARD_STRING : MAX_KEPT_STRING;
+  }
+  options;
   /**
    * text: normal output; esc: after ESC; c2: after a 0xC2 lead byte; string: inside an OSC/DCS/...; stringEsc /
    * stringC2: a possible terminator inside one.
@@ -33153,8 +34357,14 @@ var OutputFilter = class {
   state = "text";
   /** The string being read: an OSC worth keeping is collected until its terminator; null = being dropped. */
   body = null;
+  maxString;
+  /** An OSC that may pass: a short title, link, progress or mark, or (when allowed) a clipboard write. */
+  kept(body) {
+    if (this.options.clipboardWrites && CLIPBOARD_WRITE.test(body)) return true;
+    return body.length <= MAX_KEPT_STRING && KEPT_OSC(body);
+  }
   push(chunk) {
-    const out = Buffer.allocUnsafe(chunk.length + MAX_KEPT_STRING + 8);
+    const out = Buffer.allocUnsafe(chunk.length + (this.body?.length ?? 0) + 8);
     let n = 0;
     const put = (...bytes) => {
       for (const b of bytes) out[n++] = b;
@@ -33174,7 +34384,7 @@ var OutputFilter = class {
     };
     const endString = (terminator) => {
       const body = this.body && Buffer.from(this.body).toString("latin1");
-      if (body !== null && KEPT_OSC(body)) {
+      if (body !== null && this.kept(body)) {
         put(27, 93);
         out.write(body, n, "latin1");
         n += body.length;
@@ -33184,7 +34394,7 @@ var OutputFilter = class {
       this.state = "text";
     };
     const collect = (b) => {
-      if (this.body && this.body.push(b) > MAX_KEPT_STRING) this.body = null;
+      if (this.body && this.body.push(b) > this.maxString) this.body = null;
     };
     for (const b of chunk) {
       switch (this.state) {
@@ -33250,7 +34460,7 @@ var OutputFilter = class {
 };
 
 // src/shared/pty/console-input.ts
-import { spawn as spawn7 } from "node:child_process";
+import { spawn as spawn8 } from "node:child_process";
 function enableVtInput() {
   if (process.platform !== "win32" || !process.stdin.isTTY)
     return { ready: Promise.resolve(false), stop: () => Promise.resolve() };
@@ -33258,7 +34468,7 @@ function enableVtInput() {
   let exited = Promise.resolve();
   const ready = new Promise((resolve2) => {
     try {
-      child = spawn7(SYSTEM.powershell(), scriptArgs("enable-vt-input.ps1", ["-ProcessId", String(process.pid)]), {
+      child = spawn8(SYSTEM.powershell(), scriptArgs("enable-vt-input.ps1", ["-ProcessId", String(process.pid)]), {
         stdio: "ignore",
         windowsHide: true
       });
@@ -33334,7 +34544,7 @@ function runTerminalClient(socket, token, options = {}) {
   return new Promise((resolve2) => {
     let done = false;
     const reader = new FrameReader();
-    const filter = new OutputFilter();
+    const filter = new OutputFilter({ clipboardWrites: options.clipboardWrites });
     let sent = size();
     let resizeTimer;
     let vtInput;
@@ -33451,14 +34661,14 @@ async function viewSession(id) {
     return 1;
   }
   const socket = await connect({ ...session2.attach, addresses: ["127.0.0.1"] });
-  const result = await runTerminalClient(socket, session2.attach.token);
+  const result = await runTerminalClient(socket, session2.attach.token, { clipboardWrites: true });
   if (result.reason === "exit") console.log(session2.harness + " exited with code " + result.exitCode + ".");
   else if (result.reason === "error") console.log("Session error: " + result.message);
   return result.reason === "exit" ? result.exitCode : 1;
 }
 
 // src/guest/boot/boot-env.ts
-import path64 from "node:path";
+import path72 from "node:path";
 
 // src/guest/boot/project-env.ts
 var EnvSchema = external_exports.object({
@@ -33477,7 +34687,7 @@ var BootEnvSchema = external_exports.object({
 });
 
 // src/guest/boot/boot-env.ts
-var file2 = () => path64.join(localDir, "boot-env.json");
+var file2 = () => path72.join(localDir, "boot-env.json");
 function saveBootEnv(value) {
   try {
     writeJsonAtomic(file2(), value);
@@ -33505,8 +34715,54 @@ function saveProjectStatus(name, workspace2, phase, message, databases, summary)
   }
 }
 
+// src/guest/runtime/secrets.ts
+import fs58 from "node:fs";
+
+// src/shared/channel/secrets.ts
+var Environment = external_exports.record(external_exports.string().max(256), external_exports.string().max(65536));
+var SecretsFileSchema = external_exports.strictObject({
+  /** The agent the sandbox booted with: its harness environment. */
+  harnessEnvironment: Environment.optional(),
+  /** harnessSpec of a session request (an agent the sandbox did not boot with). */
+  harnessSpecEnvironment: Environment.optional(),
+  /** project.harnesses of a request, by agent name. */
+  projectHarnessEnvironment: external_exports.record(external_exports.string().max(64), Environment).optional(),
+  /** The login of this PC's Claude (claudeProfile.copyCredentials): the text of .credentials.json. */
+  claudeCredentials: external_exports.string().max(1024 * 1024).optional(),
+  /** VPN service credentials (vpn.provider's login), only for the launch's own sandbox. */
+  vpn: external_exports.strictObject({ username: external_exports.string().min(1).max(256), password: external_exports.string().min(1).max(1024) }).optional(),
+  /** The checked WireGuard config of vpn.provider wireguard-file (holds the private key). */
+  wireguardConfig: external_exports.string().min(1).max(32 * 1024).optional()
+});
+
+// src/guest/runtime/secrets.ts
+var BOOT_SECRETS_VARIABLE = "SBX_BOOT_SECRETS";
+var MAX_BYTES = 4 * 1024 * 1024;
+function takeSecrets(id) {
+  const file3 = run.secretFile(id);
+  let text;
+  try {
+    if (fs58.statSync(file3).size > MAX_BYTES) throw new Error("too big");
+    text = fs58.readFileSync(file3, "utf8").replace(/^\uFEFF/, "");
+  } catch {
+    return {};
+  } finally {
+    fs58.rmSync(file3, { force: true });
+  }
+  try {
+    const parsed = SecretsFileSchema.safeParse(JSON.parse(text));
+    if (parsed.success) return parsed.data;
+  } catch {
+  }
+  warn("The secrets file for " + id + " was not valid and was ignored.");
+  return {};
+}
+function applyBootEnvironment(environment) {
+  if (session.harness && environment) session.harness.environment = { ...environment };
+}
+
 // src/guest/boot/boot.ts
-var STEPS = 8;
+var STEPS = 9;
 var PRIMARY_POLLS = 600;
 var POLL_MS = 500;
 var VSCODE_LANGUAGES = ["python", "java", "go", "rust", "cpp", "msvc", "dotnet", "ruby", "php", "deno", "pwsh"];
@@ -33528,23 +34784,35 @@ async function soft(what, work) {
     warn(what + " failed (continuing): " + errMsg(e));
   }
 }
-function startDaemon(env) {
-  spawn8(process.execPath, [path65.join(path65.dirname(process.argv[1]), "daemon.js")], {
+function startDaemon(env, secrets) {
+  spawn9(process.execPath, [path73.join(path73.dirname(process.argv[1]), "daemon.js")], {
     detached: true,
     stdio: "ignore",
     windowsHide: true,
-    env: { ...env, AGENT_LOG_PREFIX: "daemon" }
+    env: {
+      ...env,
+      AGENT_LOG_PREFIX: "daemon",
+      // The agent's environment (it may hold API keys): the daemon moves it into memory and removes this at once.
+      ...secrets.harnessEnvironment ? { [BOOT_SECRETS_VARIABLE]: JSON.stringify({ harnessEnvironment: secrets.harnessEnvironment }) } : {}
+    }
   }).unref();
 }
 function writeDbCommand() {
-  const dir = mkdirp(path65.join(localDir, "bin"));
-  const db = path65.join(path65.dirname(process.argv[1]), "db.js");
-  fs52.writeFileSync(
-    path65.join(dir, "sbx-db.cmd"),
+  const dir = mkdirp(path73.join(localDir, "bin"));
+  const db = path73.join(path73.dirname(process.argv[1]), "db.js");
+  fs59.writeFileSync(
+    path73.join(dir, "sbx-db.cmd"),
     '@setlocal\r\n@set AGENT_LOG_PREFIX=db\r\n@"' + process.execPath + '" "' + db + '" %*\r\n'
   );
+  writeAgentCommands(dir);
   return dir;
 }
+function writeAgentCommands(dir) {
+  const install = { node: process.execPath, script: path73.join(path73.dirname(process.argv[1]), "agent.js") };
+  for (const shim3 of agentShims(toolsDir, session.agents ?? {}))
+    fs59.writeFileSync(path73.join(dir, shim3.command + ".cmd"), shimText(shim3, install));
+  fs59.writeFileSync(path73.join(dir, "sbx-agent.cmd"), sbxAgentText(install));
+}
 async function waitForPrimary() {
   for (let i = 0; i < PRIMARY_POLLS; i++) {
     const s = run.readSession(session.launchId);
@@ -33565,17 +34833,22 @@ var Boot = class {
   ptyHost = null;
   lan = session.networking ? "open" : "offline";
   gitAccess = session.provisioning.git.access ?? "full";
+  /** What the host handed over in its one-shot file (read and deleted at the start of run()). */
+  secrets = {};
   async run() {
     log(
       "Agent sandbox: " + session.project + " | workspace " + workspace + " | agent " + session.harnessName + " | log " + logPath
     );
-    if (!fs52.statSync(workspace, { throwIfNoEntry: false })?.isDirectory())
+    if (!fs59.statSync(workspace, { throwIfNoEntry: false })?.isDirectory())
       throw new Error("Workspace folder is missing in the sandbox: " + workspace);
     mkdirp(toolsDir);
     mkdirp(run.root);
+    this.secrets = takeSecrets(session.launchId);
+    applyBootEnvironment(this.secrets.harnessEnvironment);
     await this.networkAndSessionHost();
     await this.hooksAndDesktop();
     const { tools, env } = await this.developerTools();
+    await this.vpn();
     await this.gitIdentity(env);
     await this.claude(tools);
     await this.agent(env);
@@ -33629,6 +34902,7 @@ var Boot = class {
       );
     const env = agentEnv(tools);
     persistEnvironment(env, Object.keys(tools.vars));
+    await soft("Shell start-up PATH", installShellPath);
     saveBootEnv({
       basePath,
       toolVars: Object.keys(tools.vars),
@@ -33641,32 +34915,43 @@ var Boot = class {
     await soft("Cleaning old tool builds", () => pruneToolLeftovers());
     return { tools, env };
   }
+  /** vpn.enabled: the tunnel and its kill switch, before anything else uses the network (git, the agent). */
+  async vpn() {
+    step(4, session.vpn ? "VPN (" + session.vpn.server + ")" : "VPN (off)");
+    if (!session.vpn) return;
+    await soft("VPN", async () => {
+      await setupVpn(this.secrets, this.ptyHost);
+    });
+  }
   async gitIdentity(env) {
-    step(4, "Git identity");
+    step(5, "Git identity");
     await soft("Git config", () => setupGitConfig(env));
   }
   async claude(tools) {
-    step(5, "Claude settings, history and claude-mem");
-    if (session.harnessName === "claude") await soft("Claude settings", syncClaudeProfile);
+    step(6, "Claude settings, history and claude-mem");
+    if (session.harnessName === "claude")
+      await soft("Claude settings", () => syncClaudeProfile(this.secrets.claudeCredentials));
     await soft("claude-mem restore", restoreClaudeMem);
+    await soft("Agent files of the last sandbox", resetMachineBound);
+    await soft("Agent databases restore", restoreLocalState);
     await soft("Sandbox guide for the agent", () => writeGuides(tools.summary, this.lan));
     await soft("Claude managed settings", () => writeManagedSettings2(this.gitAccess));
   }
   async agent(env) {
-    step(6, "Agent: " + session.harnessName);
+    step(7, "Agent: " + session.harnessName);
     linkProfileDirs(session.agentProfileDirs ?? {});
     if (session.harness) await agents.provision(session.harnessName, session.harness, env);
   }
   preAgentHooks(env) {
-    step(7, "Pre-agent hooks");
+    step(8, "Pre-agent hooks");
     runHooks("pre-agent", env);
   }
   /** Ready: starts the session daemon and, with an agent, its first session, shown in this window. */
   async start(env) {
-    step(8, "Starting " + session.harnessName);
+    step(9, "Starting " + session.harnessName);
     setSandboxStatus("ready", "Ready");
     if (!session.harness || session.autoSession === false) {
-      if (!dryRun) startDaemon(env);
+      if (!dryRun) startDaemon(env, this.secrets);
       log("Ready" + (session.harness ? "" : " (no agent requested)") + ". Workspace: " + workspace);
       return;
     }
@@ -33678,7 +34963,7 @@ var Boot = class {
       runHooks("post-agent", env);
       return;
     }
-    startDaemon(env);
+    startDaemon(env, this.secrets);
     writeJsonAtomic(run.requestFile(session.launchId), {
       kind: "session",
       id: session.launchId,
@@ -33702,11 +34987,11 @@ runBoot().catch((e) => {
   const message = errMsg(e) + (e instanceof Error && e.stack ? "\n" + e.stack : "");
   try {
     setSandboxStatus("failed", errMsg(e));
-    fs53.writeFileSync(path66.join(logsDir, "guest-error.txt"), message);
+    fs60.writeFileSync(path74.join(logsDir, "guest-error.txt"), message);
   } catch {
   }
   console.error(
-    "\n\x1B[31mThe sandbox could not start: " + errMsg(e) + "\x1B[0m\nDetails: " + path66.join(logsDir, "guest-error.txt")
+    "\n\x1B[31mThe sandbox could not start: " + errMsg(e) + "\x1B[0m\nDetails: " + path74.join(logsDir, "guest-error.txt")
   );
   process.exitCode = 1;
 });