windows-development-sandbox 1.10.0 → 1.11.4

package/dist/selftest/channel.test.js

@@ -3,7 +3,7 @@
 import { safeId } from '../shared/channel/index.js';
 import { GuestRequestSchema, SandboxStatusSchema, SessionStatusSchema } from '../shared/channel/index.js';
 import { bootLine, firstStartNotice, pendingDownloads, readyIn, stillWorking } from '../cli/commands/launch/index.js';
-import { encodeFrame, FrameReader, FrameType, fixWindowsKeys, helloFrame, InputJoiner, MAX_FRAME_BYTES, MOUSE_OFF, OutputFilter, } from '../shared/pty/index.js';
+import { CTRL_C_CONFIRM_MS, CTRL_C_HINT, CtrlCGuard, encodeFrame, FrameReader, FrameType, fixWindowsKeys, helloFrame, InputJoiner, MAX_FRAME_BYTES, MOUSE_OFF, OutputFilter, } from '../shared/pty/index.js';
 import { bootSilent, FIRST_STATUS_MS } from '../host/channel/index.js';
 export const channelSuite = {
     name: 'channel',
@@ -132,6 +132,23 @@ export const channelSuite = {
             hello.payload[4] === 2 &&
             hello.payload.subarray(5).toString() === 'tok', 'a frame of exactly the maximum size is accepted; a hello frame carries size, flags and token');
         t.equal(fixWindowsKeys(Buffer.from([0x61, 0x08, 0x7f, 0x1b])), Buffer.from([0x61, 0x7f, 0x08, 0x1b]), 'Windows console Backspace (^H) reaches the agent as DEL, so it deletes one character, not a word');
+        t.section('Ctrl+C meant as "copy" does not reach the agent');
+        const ctrlC = Buffer.from([3]);
+        const g = new CtrlCGuard();
+        const first = g.push(ctrlC, 1000);
+        const second = g.push(ctrlC, 1000 + CTRL_C_CONFIRM_MS - 1);
+        const third = g.push(ctrlC, 5000);
+        const late = g.push(ctrlC, 5000 + CTRL_C_CONFIRM_MS + 1);
+        t.check(first.held &&
+            first.send.length === 0 &&
+            !second.held &&
+            second.send.equals(ctrlC) &&
+            third.held &&
+            late.held &&
+            !g.push(Buffer.from('a\x03'), 6000).held &&
+            !g.push(Buffer.from('x'), 6000).held, 'a lone Ctrl+C is held back, a second one soon after is sent, a late second one is held again, other input passes');
+        g.watchOutput('\x1b]0;claude: working\x07more \x1b]2;\u0001evil\x07');
+        t.check(g.hintTitle().includes(CTRL_C_HINT) && g.restoreTitle() === '\x1b]0;evil\x07', "the hint shows in the title, and the program's last title comes back without control characters");
         t.section('typed input keeps escape sequences whole');
         const joined = (...chunks) => {
             const j = new InputJoiner();

package/dist/selftest/cli.test.js

@@ -8,7 +8,7 @@ import { COMMANDS } from '../cli/manifest.js';
 import { commandLine, readHistory, recordHistory } from '../cli/history.js';
 import { splitArgs } from '../cli/args.js';
 import { optionProblem } from '../cli/menu/index.js';
-import { cleanTargetOf } from '../cli/commands/data/collect.js';
+import { cleanTargetOf } from '../cli/services/index.js';
 import { ago, colorEnabled, shorten } from '../cli/output/index.js';
 import { versionText } from '../cli/version.js';
 import { hoistConfig, withoutConfig } from '../cli/argv.js';

package/dist/selftest/config.test.js

@@ -3,7 +3,7 @@ import path from 'node:path';
 import _ from 'lodash';
 import fs from 'node:fs';
 import { DEFAULTS, loadConfig } from '../core/config/index.js';
-import { diffText, exportSettings, planImport } from '../cli/menu/settings/index.js';
+import { diffText, exportSettings, planImport } from '../app/features/settings/settings-share.js';
 import { readJsonc } from '../core/util/index.js';
 export const configSuite = {
     name: 'config',

package/dist/selftest/contained.test.js

@@ -9,7 +9,7 @@ import { spawnSync } from 'node:child_process';
 import { assertNoGuestOverlap } from '../core/config/index.js';
 import { isWin } from '../core/util/index.js';
 import { CONTAINED_CHECKS } from '../cli/commands/repair/checks/contained.js';
-import { storageBusy } from '../cli/commands/storage/storage.js';
+import { storageBusy } from '../cli/services/index.js';
 import { generateSandbox, GUEST } from '../host/launch/index.js';
 import { currentUserSid } from '../host/sharing/index.js';
 import { addHolder, CONTAINED_FOLDERS, containedAvailability, ContainedStorage, containedMappings, containedPaths, diagnose, hostDataFolder, markMounted, mountedSets, planTransfer, providerFor, pruneHolders, removeHolder, runTransfer, ScriptDiskPort, setNameOf, setStateOf, staleMountNote, StateFile, } from '../host/storage/index.js';

package/dist/selftest/data.test.js

@@ -2,9 +2,8 @@
 // launch folders, logs and downloads are pruned.
 import fs from 'node:fs';
 import path from 'node:path';
-import { resolveCleanTargets } from '../cli/commands/data/clean.js';
-import { removeTree } from '../cli/commands/data/remove.js';
 import { findLinks } from '../cli/commands/repair/finders.js';
+import { removeTree, resolveCleanTargets } from '../cli/services/index.js';
 import { humanBytes, sizeOf } from '../core/disk.js';
 import { pruneStorage } from '../host/storage/index.js';
 export const dataSuite = {

package/dist/selftest/engine.test.js

@@ -66,7 +66,9 @@ export const engineSuite = {
         t.equal(fs.readFileSync(gen.wsbPath, 'utf8'), legacyWsb(f.baseConfig, gen.memoryMb, gen.mappings), 'the launch writes the .wsb the old writer would have (same settings, memory and mappings)');
         t.equal(path.basename(gen.wsbPath), 'agent.wsb', 'the engine file is still agent.wsb in the launch folder');
         t.equal(gen.enginePlan.entry, gen.wsbPath, 'the engine plan starts from that file');
-        t.equal(filesUnder(gen.launchPath), [...LAUNCH_FILES_GOLDEN], 'the launch folder has exactly the files it had before');
+        // home/.gitconfig is written only when this machine's ~/.gitconfig has a name or email (a GitHub runner has none).
+        const sameOnEveryMachine = (f) => f !== 'home/.gitconfig';
+        t.equal(filesUnder(gen.launchPath).filter(sameOnEveryMachine), LAUNCH_FILES_GOLDEN.filter(sameOnEveryMachine), 'the launch folder has exactly the files it had before');
         t.equal(gen.mappings.find((m) => m.guest === 'C:\\AgentData')?.host, f.baseConfig.storage.root + '\\data\\testdata', 'the data folder is still mapped at C:\\AgentData (through the folder provider)');
         t.section('capabilities');
         const caps = (over, cli) => new WindowsSandboxEngine({ ...DEFAULTS.sandbox, ...over }, () => cli).capabilities();

package/dist/selftest/github.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const githubSuite: Suite;

package/dist/selftest/github.test.js

@@ -0,0 +1,243 @@
+// The GitHub token for sandboxes: which tokens are accepted, the sealed store, when a launch hands it over (only in the
+// one-shot secrets file), the shared-core operations, the project-file rules, and the gh commands the sandbox runs.
+import fs from 'node:fs';
+import path from 'node:path';
+import { deleteGithubTokenFlow, githubPage, githubTokenRowOf, saveGithubTokenFlow, } from '../app/features/github/index.js';
+import { fakeIO } from '../app/kernel/index.js';
+import { runDefinition } from '../app/registry.js';
+import { pageLines } from '../cli/output/index.js';
+import { DEFAULTS } from '../core/config/index.js';
+import { applyOverrides, normalizeOverrides } from '../core/local-config/index.js';
+import { ConfigSchema, LocalOverridesSchema } from '../core/schema/index.js';
+import { checkGithubToken, GithubToken, githubTokenAllowed, prepareGithubToken } from '../host/github/index.js';
+import { generateSandbox } from '../host/launch/index.js';
+import { insideSandbox } from '../host/sandbox/platform.js';
+import { clearSecrets, SecretStore } from '../host/secrets/index.js';
+import { RunDir } from '../shared/channel/index.js';
+import { SecretsFileSchema } from '../shared/channel/secrets.js';
+import { ghLoginCommand, ghOutputText, ghSetupGitCommand, githubTokenProblem } from '../shared/github/index.js';
+const FINE = 'github_pat_' + 'PlantedFine0123456789'.repeat(3);
+const CLASSIC = 'ghp_' + 'PlantedClassic0123456789ab';
+const OAUTH = 'gho_' + 'PlantedOauth0123456789abcd';
+/** Every file under a folder, as text. */
+function allText(dir) {
+    const out = [];
+    const walk = (d) => {
+        for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+            const p = path.join(d, e.name);
+            if (e.isDirectory())
+                walk(p);
+            else
+                out.push(fs.readFileSync(p, 'latin1'));
+        }
+    };
+    walk(dir);
+    return out;
+}
+const message = async (work) => {
+    try {
+        await work();
+        return '';
+    }
+    catch (e) {
+        const err = e;
+        return err.message + ' ' + (err.fix ?? '');
+    }
+};
+export const githubSuite = {
+    name: 'github',
+    title: 'GitHub token: accepted tokens, sealed store, delivery only in the one-shot file, operations, gh on stdin',
+    run: async (t, f) => {
+        t.section('which tokens are accepted');
+        t.check(checkGithubToken(FINE) === 'fine-grained', 'a fine-grained token (github_pat_) is accepted');
+        t.check(checkGithubToken(CLASSIC) === 'classic', 'a classic token (ghp_) is accepted');
+        for (const [bad, why, expect] of [
+            [OAUTH, 'an OAuth token from gh auth token', 'OAuth'],
+            ['not-a-token-' + 'x'.repeat(20), 'text that is not a token', 'github_pat_'],
+            ['github_pat_ ' + 'x'.repeat(30), 'a token with a space', 'spaces'],
+            ['github_pat_\n' + 'x'.repeat(30), 'a token with a line break', 'line breaks'],
+            ['ghp_short', 'a token too short', 'length'],
+            ['github_pat_' + 'x'.repeat(300), 'a token too long', 'length'],
+        ]) {
+            const text = await message(() => checkGithubToken(bad));
+            t.check(text.includes(expect) && !text.includes(bad) && !text.includes(bad.slice(4, 24)), why + ' is refused, and the refusal does not repeat it', text);
+        }
+        t.check((githubTokenProblem(OAUTH)?.fix ?? '').includes('personal-access-tokens/new'), 'a refused OAuth token says to create a fine-grained token instead');
+        t.check(SecretsFileSchema.safeParse({ githubToken: FINE }).success &&
+            !SecretsFileSchema.safeParse({ githubToken: 'a b' }).success &&
+            !SecretsFileSchema.safeParse({ githubToken: 'x'.repeat(256) }).success, 'the secrets file holds the token with the same limits');
+        t.section('the saved token');
+        const storage = t.dir('github-storage');
+        const store = new GithubToken(storage, SecretStore.memory());
+        t.check(store.state() === 'none' && store.kind() === null, 'nothing is saved at first');
+        await t.throws(() => store.save(OAUTH), 'OAuth', 'an OAuth token is not saved');
+        t.check(store.state() === 'none', 'and nothing was written');
+        t.check(store.save(FINE) === 'fine-grained', 'a fine-grained token is saved');
+        const file = path.join(storage, 'github', 'token.json');
+        t.check(store.state() === 'saved' && store.kind() === 'fine-grained' && !fs.readFileSync(file, 'utf8').includes(FINE), 'it is saved sealed: the token is not in the file');
+        t.check(store.read() === FINE, 'and it opens for the launch');
+        fs.writeFileSync(file, fs.readFileSync(file, 'utf8').replace(/"sealed": "[^"]*"/, '"sealed": "dpapi1:AAAA"'));
+        t.check(store.state() === 'unreadable', 'a token this Windows user cannot open is reported as unreadable');
+        t.check(store.remove() && store.state() === 'none' && !store.remove(), 'logout deletes it (once)');
+        t.section('when a launch hands it over');
+        const config = f.makeConfig();
+        const tokens = new GithubToken(config.storage.root, SecretStore.memory());
+        t.check(DEFAULTS.github.shareToken === false, 'sharing is off by default');
+        t.equal(prepareGithubToken(config, config.storage.root, tokens), { notes: [] }, 'off: nothing, and nothing said');
+        config.github.shareToken = true;
+        const none = prepareGithubToken(config, config.storage.root, tokens);
+        t.check(none.token === undefined && none.notes.some((n) => n.includes('sandbox github login')), 'on without a saved token: not sent, and it says how to save one');
+        tokens.save(FINE);
+        for (const access of ['readonly', 'none']) {
+            const strict = structuredClone(config);
+            strict.provisioning.git.access = access;
+            const d = prepareGithubToken(strict, config.storage.root, tokens);
+            t.check(d.token === undefined && !githubTokenAllowed(strict) && d.notes.some((n) => n.includes('"' + access + '"')), 'git access ' + access + ': not sent, with a note why');
+        }
+        const unreadable = new GithubToken(t.dir('github-unreadable'), SecretStore.memory());
+        unreadable.save(FINE);
+        const uFile = path.join(t.at('github-unreadable'), 'github', 'token.json');
+        fs.writeFileSync(uFile, fs.readFileSync(uFile, 'utf8').replace(/"sealed": "[^"]*"/, '"sealed": "dpapi1:AAAA"'));
+        const u = prepareGithubToken(config, config.storage.root, unreadable);
+        t.check(u.token === undefined && u.notes.some((n) => n.includes('could not be read')), 'a token that cannot be decrypted is a warning, not a crash');
+        const all = prepareGithubToken(config, config.storage.root, tokens);
+        t.check(all.token === FINE && all.notes.every((n) => !n.includes(FINE)) && all.notes.some((n) => n.includes('can read')), 'all on: the token is handed over, the notes never hold it and say the agent can read it');
+        const run = await f.run({}, config);
+        clearSecrets(config.storage.root, run.dataPath);
+        const launched = generateSandbox({
+            packageRoot: t.packageRoot,
+            run,
+            harnessArgs: [],
+            probe: f.probe,
+            pcLanguages: ['python', 'rust', 'cpp', 'dotnet'],
+            githubToken: FINE,
+        });
+        const session = fs.readFileSync(launched.sessionPath, 'utf8');
+        t.check(!session.includes(FINE) && !allText(launched.launchPath).some((text) => text.includes(FINE)), 'the token is in neither session.json nor any file of the launch folder');
+        const runDir = new RunDir(run.dataPath);
+        const handed = f.readJson(runDir.secretFile(launched.launchId));
+        t.check(handed.githubToken === FINE, 'it is only in the one-shot file for the sandbox');
+        const runFolder = path.join(run.dataPath, 'run');
+        t.check(!fs.existsSync(runFolder) || !allText(runFolder).some((text) => text.includes(FINE)), 'and not in run\\');
+        clearSecrets(config.storage.root, run.dataPath);
+        const readonlyConfig = structuredClone(config);
+        readonlyConfig.provisioning.git.access = 'readonly';
+        const readonlyRun = await f.run({}, readonlyConfig);
+        const strictLaunch = generateSandbox({
+            packageRoot: t.packageRoot,
+            run: readonlyRun,
+            harnessArgs: [],
+            probe: f.probe,
+            pcLanguages: [],
+            githubToken: FINE,
+        });
+        const handedTo = (id) => fs.existsSync(runDir.secretFile(id)) ? f.readJson(runDir.secretFile(id)) : {};
+        t.check(handedTo(strictLaunch.launchId).githubToken === undefined, 'generateSandbox checks again: a readonly sandbox never gets it, whatever it was given');
+        clearSecrets(config.storage.root, run.dataPath);
+        const plain = generateSandbox({
+            packageRoot: t.packageRoot,
+            run: await f.run({ noAgent: true }, config),
+            harnessArgs: [],
+            probe: f.probe,
+            pcLanguages: [],
+            githubToken: FINE,
+        });
+        t.check(handedTo(plain.launchId).githubToken === FINE, 'a sandbox without an agent (no other secret to hand over) still gets the one-shot file with the token');
+        clearSecrets(config.storage.root, run.dataPath);
+        const strictOther = structuredClone(config);
+        strictOther.provisioning.git.access = 'readonly';
+        const others = [{ name: 'other-project', config: strictOther }];
+        const held = prepareGithubToken(config, config.storage.root, tokens, others);
+        t.check(held.token === undefined &&
+            !githubTokenAllowed(config, others) &&
+            held.notes.some((n) => n.includes('other-project')), 'another project mapped at boot with readonly git access holds the token back, and the note names it');
+        const withOther = generateSandbox({
+            packageRoot: t.packageRoot,
+            run: await f.run({ noAgent: true }, config),
+            harnessArgs: [],
+            probe: f.probe,
+            pcLanguages: [],
+            githubToken: FINE,
+            bootWants: { projects: others, keepOff: [] },
+        });
+        t.check(handedTo(withOther.launchId).githubToken === undefined, 'and generateSandbox checks the projects at boot again');
+        clearSecrets(config.storage.root, run.dataPath);
+        t.section("settings: a project's file cannot turn it on");
+        t.check(ConfigSchema.safeParse(DEFAULTS).success, 'the defaults are valid');
+        t.check(!ConfigSchema.safeParse({ ...DEFAULTS, github: { shareToken: true, token: FINE } }).success, 'there is no setting that holds a token');
+        t.check(!LocalOverridesSchema.safeParse({ github: { shareToken: true } }).success &&
+            !LocalOverridesSchema.safeParse({ github: { shareToken: false } }).success, "a project's .sandbox-config.json cannot set github at all");
+        await t.throws(() => normalizeOverrides({ github: { shareToken: true } }, f.workA, '.sandbox-config.json'), 'not valid', 'such a file is refused as invalid');
+        const mine = structuredClone(DEFAULTS);
+        t.check(applyOverrides(mine, normalizeOverrides({ readOnly: true }, f.workA, 'x')).github.shareToken === false, 'and other project settings leave it as you set it');
+        t.section('the shared-core operations');
+        const featureStore = new GithubToken(t.dir('github-feature'), SecretStore.memory());
+        const { io: loginIO, seen: loginSeen } = fakeIO([FINE]);
+        const saved = await saveGithubTokenFlow(loginIO, featureStore);
+        t.check(loginSeen.questions.length === 1 &&
+            loginSeen.questions[0].kind === 'secret' &&
+            featureStore.state() === 'saved' &&
+            loginSeen.logs.some((l) => l.text.includes('personal-access-tokens/new')) &&
+            loginSeen.logs.some((l) => l.text.includes('agent in the sandbox can read')), 'login shows the steps, asks exactly one hidden question, saves, and warns the agent can read it', JSON.stringify(loginSeen.questions));
+        t.check(!JSON.stringify(saved).includes(FINE) && !JSON.stringify(loginSeen).includes(FINE.slice(12)), 'nothing it returns or logs holds the token');
+        const { io: retryIO, seen: retrySeen } = fakeIO([OAUTH, CLASSIC]);
+        await saveGithubTokenFlow(retryIO, featureStore);
+        t.check(retrySeen.questions.length === 2 &&
+            featureStore.kind() === 'classic' &&
+            !JSON.stringify(retrySeen).includes(OAUTH.slice(4)) &&
+            retrySeen.logs.some((l) => l.text.includes('classic')), 'a refused token is asked again (the refusal never repeats it), and a classic one is saved with a warning');
+        const status = (await runDefinition('github.status', {
+            storageRoot: t.dir('github-status'),
+            dataPath: t.at('github-status', 'data'),
+            loaded: { config: { ...DEFAULTS, github: { shareToken: true } } },
+        }, {}, fakeIO().io));
+        t.check(status.shareToken && status.token === 'none' && status.kind === null, 'status reads the setting');
+        const sample = {
+            shareToken: true,
+            gitAccess: 'readonly',
+            token: 'saved',
+            kind: 'classic',
+            savedAt: '2026-10-18T10:00:00.000Z',
+        };
+        const lines = pageLines(githubPage(sample)).join('\n');
+        t.check(lines.includes('saved (encrypted)') &&
+            lines.includes('only handed over with "full"') &&
+            lines.includes('classic'), 'the status page says saved, the git access it needs, and the kind', lines);
+        t.equal(githubTokenRowOf({ ...sample, token: 'none' }).hint, 'not saved', 'the Settings row says not saved');
+        const { io: logoutIO, seen: logoutSeen } = fakeIO([true]);
+        const out = await deleteGithubTokenFlow(logoutIO, featureStore);
+        t.check(out.deleted &&
+            logoutSeen.questions.length === 1 &&
+            logoutSeen.questions[0].kind === 'confirm' &&
+            featureStore.state() === 'none', 'logout asks to confirm, then deletes');
+        const { io: noneIO, seen: noneSeen } = fakeIO();
+        t.check(!(await deleteGithubTokenFlow(noneIO, featureStore)).deleted && noneSeen.questions.length === 0, 'logout with nothing saved asks nothing');
+        const { io: inputIO, seen: inputSeen } = fakeIO();
+        await t.throws(() => runDefinition('github.login', {}, { token: FINE }, inputIO), 'does not work', 'the token is never accepted as an input');
+        t.check(inputSeen.questions.length === 0, 'a token passed on the command line asks nothing');
+        if (insideSandbox()) {
+            const { io, seen } = fakeIO();
+            await t.throws(() => runDefinition('github.login', {}, {}, io), 'inside the sandbox already', 'github login refuses inside the sandbox');
+            t.check(seen.questions.length === 0, 'and asks no question first');
+        }
+        t.section('gh in the sandbox: the token on stdin only');
+        const base = {
+            PATH: 'C:\\x',
+            GH_TOKEN: 'other',
+            github_token: 'other2',
+            GH_CONFIG_DIR: 'C:\\AgentData\\state\\gh',
+        };
+        const login = ghLoginCommand('C:\\tools\\gh.exe', 'C:\\nvm\\gh-token', FINE, base);
+        t.check(login.input === FINE + '\n' &&
+            !login.args.some((a) => a.includes(FINE)) &&
+            login.args.includes('--with-token') &&
+            !Object.values(login.env).some((v) => v.includes(FINE)), 'gh auth login gets the token on stdin, never in its arguments or environment', JSON.stringify(login.args));
+        t.check(login.env.GH_CONFIG_DIR === 'C:\\nvm\\gh-token' &&
+            !('GH_TOKEN' in login.env) &&
+            !('github_token' in login.env) &&
+            login.env.PATH === 'C:\\x', 'it uses the sandbox-only folder, and other tokens in the environment are dropped (gh would prefer them)');
+        const setup = ghSetupGitCommand('C:\\tools\\gh.exe', 'C:\\nvm\\gh-token', base);
+        t.check(setup.input === undefined && setup.args.join(' ') === 'auth setup-git --hostname github.com', 'setup-git gets nothing on stdin');
+        t.check(!ghOutputText('error: bad credentials ' + FINE, FINE).includes(FINE), 'what gh prints is logged with the token blanked out');
+    },
+};

package/dist/selftest/hcs.test.js

@@ -4,13 +4,15 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { cleanEngineRun, engineLeftoversRun } from '../app/features/engine/index.js';
+import { fakeIO } from '../app/kernel/index.js';
 import { DEFAULTS } from '../core/config/index.js';
 import { isWin } from '../core/util/index.js';
 import { HCS_CHECKS, HCS_PROBES } from '../cli/commands/repair/checks/hcs.js';
-import { checkHcs, engineFor, HCS_CAPABILITIES, HcsEngine, openEngine, } from '../host/engines/index.js';
+import { checkHcs, engineFor, HCS_CAPABILITIES, HcsEngine, LEFTOVER_DEPS, lookForLeftovers, openEngine, stopLeftovers, } from '../host/engines/index.js';
 import { parseWhoamiGroups } from '../host/engines/hcs/check.js';
 import { buildDocuments, cpuCount, layerGuid } from '../host/engines/hcs/documents.js';
-import { HcsHelper, HcsReplySchema, buildHcsHostTo } from '../host/engines/hcs/helper.js';
+import { HcsHelper, HcsReplySchema, buildHcsHostTo, userSystemPrefix, } from '../host/engines/hcs/helper.js';
 import { chainIds, DockerImageStore, FolderImageStore } from '../host/engines/hcs/images.js';
 import { SYSTEM } from '../shared/system.js';
 import { fakeProbes, FAKE_IMAGE } from './support/hcs-probes.js';
@@ -378,16 +380,18 @@ export const hcsSuite = {
         });
         for (const file of plan.files)
             t.write(file.path, file.text);
+        const mineId = userSystemPrefix() + '1';
         const running = await live.start(plan);
         t.equal(log, [
-            'grant-vm-access agent-sandbox-1 C:\\S\\images\\set.vhdx',
-            'grant-vm-access agent-sandbox-1 ' + path.join(launch.launchPath, 'hcs', 'scratch.vhdx'),
+            'grant-vm-access ' + mineId + ' C:\\S\\images\\set.vhdx',
+            'grant-vm-access ' + mineId + ' ' + path.join(launch.launchPath, 'hcs', 'scratch.vhdx'),
             'create <request>',
-            'start agent-sandbox-1',
+            'start ' + mineId,
             'create <request>',
-            'start agent-sandbox-1-c',
+            'start ' + mineId + '-c',
         ], 'disks get access, the utility VM is created and started, then the container');
-        t.check(running.id === 'agent-sandbox-1' && running.engine === 'hcs', 'start() reports the sandbox');
+        t.check(running.id === mineId && running.engine === 'hcs', 'start() reports the sandbox');
+        t.check(mineId !== userSystemPrefix('someone-else', 'PC') + '1', "the id carries this Windows user's tag (another user's sandbox of the same name gets another id)");
         t.section('the helper: private temp folder, checked answers');
         const tempRoot = t.dir('hcs-helper-checks');
         const answers = [];
@@ -416,6 +420,99 @@ export const hcsSuite = {
         HCS_PROBES.current = null;
         t.check(finding.status === 'needs-you' && /docker pull/.test(finding.fix ?? ''), 'the row says what is missing and the command, and repair has no automatic fix for it');
         t.check(row.fix === undefined, 'repair never fixes HCS prerequisites (they change Windows)');
+        t.section('HCS systems left running: only ours are listed and stopped (fake helper)');
+        const mine = userSystemPrefix() + '1';
+        const theirs = userSystemPrefix('someone-else', 'PC') + '1';
+        const systems = [
+            {
+                Id: mine,
+                SystemType: 'VirtualMachine',
+                Owner: 'agent-sandbox',
+                State: 'Running',
+                CreateTimestamp: '2026-01-01T10:00:00Z',
+            },
+            { Id: mine + '-c', SystemType: 'Container', Owner: 'agent-sandbox', State: 'Running' },
+            { Id: theirs, SystemType: 'VirtualMachine', Owner: 'agent-sandbox', State: 'Running' },
+            { Id: 'WindowsSandbox-9', SystemType: 'VirtualMachine', Owner: 'agent-sandbox', State: 'Running' },
+            { Id: 'agent-sandbox-evil', SystemType: 'VirtualMachine', Owner: 'docker', State: 'Running' },
+            { Id: 'docker-1', SystemType: 'Container', Owner: 'docker', State: 'Running' },
+        ];
+        const calls = [];
+        let present = [...systems];
+        const leftoverRun = (_exe, args) => {
+            const verb = args[0];
+            calls.push(args.slice(0, args.indexOf('--out')).join(' '));
+            if (verb === 'terminate')
+                present = present.filter((s) => s.Id !== args[1]);
+            const json = verb === 'enumerate' ? JSON.stringify(present) : '';
+            fs.writeFileSync(args[args.indexOf('--out') + 1], JSON.stringify({ ok: true, hresult: '0x0', message: 'ok', json, values: {} }), 'utf8');
+            return { status: 0 };
+        };
+        const leftoverTemp = t.dir('hcs-leftovers-temp');
+        const helperCalls = [];
+        const useLeftovers = (probes = fakeProbes()) => {
+            LEFTOVER_DEPS.current = {
+                probes,
+                helper: () => {
+                    helperCalls.push(true);
+                    return new HcsHelper(() => 'C:\\fake\\HcsHost.exe', leftoverRun, leftoverTemp);
+                },
+            };
+        };
+        const ctx = { loaded: { config: hcsConfig } };
+        try {
+            useLeftovers();
+            const look = lookForLeftovers('C:\\S');
+            t.check(look.available &&
+                look.systems.map((s) => s.id).join() === mine + ',' + mine + '-c' &&
+                look.systems[0].kind === 'VirtualMachine' &&
+                look.systems[0].since === '2026-01-01T10:00:00Z' &&
+                look.systems[1].since === null, "only systems with our Owner and this user's id prefix are listed (not another user's, Windows Sandbox, Docker, or a foreign owner)", JSON.stringify(look));
+            const query = await engineLeftoversRun.run(ctx, {}, fakeIO().io);
+            t.check(query.available && query.systems.length === 2 && /2 HCS systems/.test(query.message), 'engine.leftovers returns them with a plain message');
+            calls.length = 0;
+            const outcome = stopLeftovers('C:\\S', [mine, mine + '-c', theirs, 'WindowsSandbox-9', 'docker-1', '--evil']);
+            t.equal(calls.filter((c) => c.startsWith('terminate')), ['terminate ' + mine + '-c', 'terminate ' + mine], 'only ours reach terminate, the container before its utility VM');
+            t.check(outcome.filter((o) => o.stopped).length === 2 && outcome.filter((o) => !o.stopped).length === 4, 'ids that are not ours (or not running) are reported, never terminated');
+            present = [...systems];
+            calls.length = 0;
+            const declined = fakeIO([false]);
+            await t.throws(() => cleanEngineRun.run(ctx, {}, declined.io), 'Nothing changed', 'declining the question stops cleanly');
+            t.check(!calls.some((c) => c.startsWith('terminate')), 'declining terminates nothing');
+            calls.length = 0;
+            const yes = fakeIO([true]);
+            const cleaned = await cleanEngineRun.run(ctx, {}, yes.io);
+            t.check(cleaned.stopped === 2 &&
+                cleaned.failed === 0 &&
+                yes.seen.questions.length === 1 &&
+                yes.seen.questions[0].kind === 'confirm' &&
+                calls.filter((c) => c.startsWith('terminate')).length === 2, 'engine.clean asks once, then stops what is ours');
+            const again = await cleanEngineRun.run(ctx, {}, fakeIO().io);
+            t.check(again.stopped === 0 && /Nothing to clean/.test(again.message), 'with none left it asks nothing and says so');
+            calls.length = 0;
+            helperCalls.length = 0;
+            useLeftovers(fakeProbes({ computecore: false }));
+            const missing = await cleanEngineRun.run(ctx, {}, fakeIO().io);
+            t.check(!missing.available && /not on this PC/.test(missing.message) && calls.length === 0 && helperCalls.length === 0, 'HCS missing: a plain message, the helper is never started, nothing to clean');
+            t.section('doctor row: HCS systems left running');
+            present = [...systems];
+            useLeftovers();
+            const leftoverRow = HCS_CHECKS[1];
+            t.check(leftoverRow.name === 'HCS systems left running' &&
+                leftoverRow.applies?.(rowEnv(f.baseConfig)) === true &&
+                helperCalls.every(Boolean), 'shown on any engine when one of ours is found, and the doctor never builds HcsHost.exe to look');
+            const warn = await leftoverRow.run(rowEnv(f.baseConfig));
+            t.check(warn.status === 'warn' && warn.fix === 'sandbox engine clean' && warn.detail.includes(mine), 'a warning with the fix "sandbox engine clean"');
+            present = [];
+            t.check(leftoverRow.applies?.(rowEnv(f.baseConfig)) === false &&
+                leftoverRow.applies?.(rowEnv(hcsConfig)) === true &&
+                (await leftoverRow.run(rowEnv(hcsConfig))).status === 'ok', 'hidden when none is left (unless the engine is hcs, where it says none is running)');
+            useLeftovers(fakeProbes({ computecore: false }));
+            t.check(leftoverRow.applies?.(rowEnv(f.baseConfig)) === false, 'hidden on a PC without HCS');
+        }
+        finally {
+            LEFTOVER_DEPS.current = null;
+        }
         t.section('sandbox engine check hcs');
         const out = await f.runBin('agent-sandbox', ['engine', 'check', 'hcs', '--config', t.writeJson(t.at('hcs-config.json'), {})], {
             cwd: f.workA,
@@ -425,7 +522,7 @@ export const hcsSuite = {
             (out.status === 0 || out.out.includes('To fix:')), 'the command prints the check in plain words with the fixes', out.out);
         t.check(DEFAULTS.sandbox.engine === 'windows-sandbox', 'the default engine is unchanged');
         t.section("documents against Microsoft's published HCS schema (Windows 11 21H2 and Windows 10 1809)");
-        const schemaDir = path.join(t.packageRoot, 'test-fixtures', 'hcs-schema');
+        const schemaDir = path.join(t.packageRoot, 'src', 'selftest', 'fixtures', 'hcs-schema');
         if (!fs.existsSync(schemaDir)) {
             t.check(true, 'skipped: the schema fixtures are only in the repository');
         }

package/dist/selftest/health.test.js

@@ -5,6 +5,10 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { ALL_CHECKS } from '../cli/commands/repair/checks/index.js';
 import { proxyProblem } from '../cli/commands/repair/checks/network.js';
+import { healthPage, ioEvents, summaryText as featureSummaryText, } from '../app/features/health/index.js';
+import { fakeIO } from '../app/kernel/index.js';
+import { runDefinition } from '../app/registry.js';
+import { menuView } from '../cli/menu/render-view.js';
 import { HealthRun, summarize } from '../cli/commands/repair/engine.js';
 import { logText, writeRepairLog } from '../cli/commands/repair/log.js';
 import { HealthPrinter, summaryText } from '../cli/commands/repair/printer.js';
@@ -455,6 +459,72 @@ function backups(t) {
     t.equal(found[0].label, '1.4.0 to 1.5.0 at 2026-10-14 09:30:12', 'a backup is labelled with its versions and time');
     t.equal(lineDiff('{\n  "a": 1,\n  "x": 3\n}', '{\n  "a": 2,\n  "x": 3\n}'), ['- "a": 1,', '+ "a": 2,'], 'the difference shows the lines only in one file');
 }
+/** The shared core: the same run as the menu and the web use, the saved results, and the health page. */
+async function sharedCore(t) {
+    t.section('the shared core');
+    const bad = (plan, over = {}) => ({
+        status: 'needs-you',
+        detail: 'broken',
+        plan,
+        means: 'it hurts',
+        ...over,
+    });
+    const cracks = [];
+    const three = [
+        check('p1', 'This PC', { name: 'Windows' }),
+        check('p2', 'Data folder', {
+            name: 'Cracks',
+            run: () => (cracks.length ? { status: 'ok', detail: 'whole' } : bad('mend the cracks', { fix: undefined })),
+            fix: () => {
+                cracks.push('mended');
+                return { done: 'mended the cracks' };
+            },
+        }),
+        check('p3', 'Network', {
+            name: 'GitHub',
+            run: () => ({ status: 'warn', detail: 'no answer', fix: 'check your VPN' }),
+        }),
+    ];
+    const fake = fakeIO();
+    await runHealth(fakeEnv(t, 'events'), ioEvents(fake.io), { yes: true, ask: false, question: () => '' }, three, () => Promise.resolve(true));
+    const logged = fake.seen.logs.map((l) => l.text).join('\n');
+    t.includes(logged, '  [ok] Windows: p1 is fine', 'ioEvents writes a line per result, like the printer');
+    t.includes(logged, 'What it means: it hurts', 'ioEvents says what a problem means');
+    t.includes(logged, 'Fix: sandbox repair will mend the cracks', 'ioEvents says what repair would do');
+    t.includes(logged, 'Repair will change:', 'ioEvents lists the changes before they are made');
+    t.includes(logged, '[fixed] Cracks: mended the cracks', 'ioEvents reports a fix on its own line');
+    t.equal(featureSummaryText({ total: 9, ok: 6, fixed: 1, warn: 1, needsYou: 1, skipped: 0, fixable: 0 }), '6 ok, 1 fixed, 1 needs you, 1 warning', 'summaryText moved to the feature and reads the same');
+    t.equal(featureSummaryText({ total: 3, ok: 0, fixed: 0, warn: 0, needsYou: 2, skipped: 1, fixable: 0 }), '0 ok, 2 need you, 1 skipped', 'summaryText plurals (feature)');
+    const saved = {
+        at: '2026-10-15T09:30:12.000Z',
+        mode: 'check',
+        checks: [{ id: 'p1', group: 'This PC', name: 'Windows', status: 'ok', detail: 'fine', fixable: false }],
+        summary: { total: 1, ok: 1, fixed: 0, warn: 0, needsYou: 0, skipped: 0, fixable: 0 },
+        details: [['Config file', 'valid']],
+        setup: { checks: [{ name: 'Edition', status: 'ok', detail: 'Pro' }], canEnable: false, error: null },
+        log: null,
+    };
+    const storage = t.dir('health', 'saved', 'storage');
+    const ctx = { storageRoot: storage };
+    const none = await runDefinition('health.last', ctx, {}, fakeIO().io);
+    t.equal(none, { last: null }, 'nothing saved yet: no results');
+    t.writeJson(path.join(storage, 'health', 'last.json'), saved);
+    const read = await runDefinition('health.last', ctx, {}, fakeIO().io);
+    t.equal(read, { last: saved }, 'a check is saved and read back by health.last');
+    t.write(path.join(storage, 'health', 'last.json'), '{ this is not json');
+    t.equal(await runDefinition('health.last', ctx, {}, fakeIO().io), { last: null }, 'a damaged results file reads as nothing saved');
+    const empty = healthPage({ last: null });
+    const emptyIds = empty.sections.flatMap((s) => (s.items ?? []).map((i) => i.id));
+    t.equal(emptyIds, ['health:check', 'repair:run'], 'before any check the page offers the check and the repair');
+    t.equal(menuView(empty, { category: 'health', refresh: false }).enterLabel('health', 'repair:run'), 'check and fix', 'Enter on the repair row says check and fix');
+    const page = healthPage({ last: saved });
+    const ids = page.sections.flatMap((s) => (s.items ?? []).map((i) => i.id));
+    t.check(['doctor:0', 'repair:0', 'setup:0'].every((id) => ids.includes(id)), 'with results the page lists the doctor, repair and setup rows', ids.join(', '));
+    const keys = menuView(page, { category: 'health', refresh: false }).actions.map((a) => a.key);
+    t.equal(keys, ['f', 'l'], 'the health keys are f and l (e only when Windows Sandbox can be turned on)');
+    const canEnable = healthPage({ last: { ...saved, setup: { ...saved.setup, canEnable: true } } });
+    t.equal(menuView(canEnable, { category: 'health', refresh: false }).actions.map((a) => a.key), ['f', 'l', 'e'], 'e turns Windows Sandbox on when the setup says it can be');
+}
 export const healthSuite = {
     name: 'health',
     title: 'doctor and repair (engine, printer, log, the install, stale state, permissions, settings backups)',
@@ -466,5 +536,6 @@ export const healthSuite = {
         await staleState(t);
         parsing(t);
         backups(t);
+        await sharedCore(t);
     },
 };