[Marc-André Moreau (mamoreau-devolutions)]

Windows Sandbox's default attach path is a local named pipe carrying plain TPKT/X.224 with PROTOCOL_RDP and ENCRYPTION_LEVEL_NONE, not TCP:3389 or VMConnect. Allow the connector and client to complete that sequence only via an explicit opt-in (enable_standard_rdp_security; NamedPipe enables it), and teach ironrdp-agent to resolve pipe path and guest credentials from WindowsSandboxServer after wsb start.

Adds Transport::NamedPipe, ironrdp_named_pipe/ironrdp_sandbox_id properties, sandbox list/config/stop CLI helpers via an in-process h2/gRPC client on the per-user \\.\pipe\wsandbox\{guid} pipe (no .NET helper), and connect --sandbox-id / --sandbox-pipe. Sandbox-derived properties are the merge base; explicit .rdp/--prop/flags override them while NamedPipe TLS/CredSSP stay forced off. Local :2179+PCB remains unsupported.

[Marc-André Moreau (mamoreau-devolutions)]

Validation notes (not part of squash message)

Live e2e (Windows 11 host, Sandbox feature on)

1. wsb start (headless / --raw as available) → SandboxId printed
2. ironrdp-agent sandbox list / sandbox config <id> via in-process gRPC against \\.\pipe\wsandbox\<md5(SID) as .NET Guid>
3. ironrdp-agent connect --sandbox-id … opened \\.\pipe\{VMId}, completed PROTOCOL_RDP + MCS ENCRYPTION_LEVEL_NONE, session 1280×720 with desktop bitmap frames

Protocol findings

• Default product path is NamedPipe, not TCP:3389 and not VMConnect :2179
• X.224 with SSL/HYBRID only → failure 0x2; empty PROTOCOL_RDP accepted
• No Security Exchange / no RC4 on Sandbox NamedPipe
• Guest account is typically WDAGUtilityAccount + server-provisioned password from GetRdpClientConfig

Dependencies / limits

• No .NET helper: agent speaks sandboxserver.SandboxCore in-process (h2 over the per-user pipe)
• RdpTransport.Local (127.0.0.1:2179 + PCB) is intentionally rejected with a clear error for now; VMConnect work in feat(connector): Hyper-V vmconnect support #1503 is complementary but not wired as the Sandbox default path

[github-actions]

This pull request is size/XL, so automated review is disabled for it: a change this large is hard to review well in one piece, whether by a human or a model.

Please split it into focused pull requests that can each be reviewed on their own. When the parts build on each other, stacked pull requests let you open each one on top of the last without waiting for the one below to merge. Stacks require every branch to live in this repository, so from a fork, please open separate pull requests instead.

Automated review resumes once the change is below the size/XL threshold.

[Copilot]

Pull request overview

Adds Windows Sandbox connectivity over named pipes with standard unencrypted RDP security.

Changes:

• Adds named-pipe transport and PROTOCOL_RDP support.
• Resolves Sandbox connection details through a .NET gRPC helper.
• Adds Sandbox lifecycle and connection CLI commands.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
crates/ironrdp-connector/src/connection.rs	Enables standard RDP security negotiation.
crates/ironrdp-client/src/rdp.rs	Connects and finalizes named-pipe sessions.
crates/ironrdp-client/src/config.rs	Adds named-pipe transport configuration.
crates/ironrdp-cfg/src/lib.rs	Adds Sandbox property accessors.
crates/ironrdp-agent/tools/windows_sandbox_grpc.cs	Implements the Sandbox gRPC helper.
crates/ironrdp-agent/src/sandbox.rs	Resolves Sandbox properties and credentials.
crates/ironrdp-agent/src/lib.rs	Exposes the Windows Sandbox module.
crates/ironrdp-agent/src/cli.rs	Adds Sandbox CLI operations.
crates/ironrdp-agent/README.md	Documents Sandbox usage.
crates/ironrdp-agent/Cargo.toml	Adds Serde derive support.
Cargo.lock	Records the dependency update.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.