windows-development-sandbox 1.11.3 → 1.11.5

package/dist/app/features/accounts/accounts.def.js

@@ -209,7 +209,6 @@ export function agentSection(a) {
         id: a.name,
         title: a.name,
         summary: a.accounts.length ? plural(a.accounts.length, 'saved login') : 'no saved login yet',
-        description: 'Saved ' + a.name + ' logins.',
         cards: true,
         items: [...saveItems(a), ...a.accounts.map((r) => loginItem(a, r))],
     };

package/dist/app/features/data/data.def.d.ts

@@ -113,7 +113,7 @@ export declare const pruneStorage: import("../../kernel/define.js").OperationDef
     message: z.ZodString;
     removed: z.ZodBoolean;
 }, z.core.$strip>, "data.prune">;
-/** The data page: disks, then one section per area, the total, and clean-up. */
+/** The data page: the disks, then every kept folder in one table (its total as the summary, clean-up as its action). */
 export declare function dataPage(o: DataShow): Page;
 export declare const dataView: import("../../kernel/define.js").ViewDef<{
     data: import("../../kernel/define.js").QueryDef<z.ZodObject<{}, z.core.$strip>, z.ZodObject<{

package/dist/app/features/data/data.def.js

@@ -103,7 +103,7 @@ export const pruneStorage = defineOperation({
     },
 });
 const DAYS_FIELD = fieldOf(new SchemaNode(PruneInputSchema).child('days'), ['days']);
-/** The data page: disks, then one section per area, the total, and clean-up. */
+/** The data page: the disks, then every kept folder in one table (its total as the summary, clean-up as its action). */
 export function dataPage(o) {
     const disks = {
         id: 'disks',
@@ -132,44 +132,44 @@ export function dataPage(o) {
         })),
         notes: [{ text: 'Persistent data for the sandbox: ' + o.dataPath + ' (C:\\AgentData inside)' }],
     };
-    const areas = DATA_AREAS.flatMap((area) => {
-        const rows = o.entries.filter((e) => e.area === area);
-        if (!rows.length)
-            return [];
-        return [
-            {
-                id: 'area:' + area,
-                title: AREA_LABEL[area],
-                summary: o.areaTotals[area] ?? '',
-                columns: [
-                    { key: 'name', label: '' },
-                    { key: 'size', label: '' },
-                    { key: 'path', label: '' },
-                ],
-                columnsOn: 'cli',
-                items: rows.map((e) => ({
-                    id: 'entry:' + e.name,
-                    label: e.name,
-                    hint: e.size,
-                    ...(e.target
-                        ? { keys: 'x deletes it.' }
-                        : { description: 'Kept on this PC on purpose; it is not deleted here.' }),
-                    details: ['Folder  ' + e.path],
-                    cells: { name: '  ' + e.name, size: e.size, path: e.path },
-                    actions: e.target
-                        ? [action(cleanData, { targets: [e.target] }, { label: 'Delete', key: 'x', verb: 'delete' })]
-                        : [],
-                })),
-            },
-        ];
-    });
-    const total = {
-        id: 'total',
-        facts: [{ id: 'total', label: 'Total', value: o.total }],
+    // Every folder in one table, grouped by kind (the order of DATA_AREAS), biggest first within a kind.
+    const kindRank = (area) => DATA_AREAS.indexOf(area);
+    const rows = [...o.entries].sort((a, b) => kindRank(a.area) - kindRank(b.area) || b.bytes - a.bytes);
+    const kept = {
+        id: 'kept',
+        title: 'What the sandbox keeps',
+        summary: o.total + ' in all',
+        columns: [
+            { key: 'kind', label: 'KIND' },
+            { key: 'name', label: 'NAME' },
+            { key: 'size', label: 'SIZE' },
+            { key: 'folder', label: 'FOLDER' },
+        ],
+        items: rows.map((e) => {
+            const del = e.target
+                ? action(cleanData, { targets: [e.target] }, { label: 'Delete', key: 'x', verb: 'delete' })
+                : undefined;
+            return {
+                id: 'entry:' + e.name,
+                label: e.name,
+                hint: e.size,
+                cells: { kind: AREA_LABEL[e.area], name: e.name, size: e.size, folder: e.path },
+                ...(del ? { primary: del } : {}),
+            };
+        }),
+        actions: [
+            action(pruneStorage, {}, {
+                label: 'Clean up…',
+                verb: 'choose what',
+                description: 'Delete caches, old sandboxes and other leftovers (the clean command, with its options).',
+                fields: [DAYS_FIELD],
+            }),
+        ],
         notes: [
             ...(o.entries.length
                 ? []
                 : [{ text: 'Nothing stored yet. Toolchains, databases and agent logins appear here after the first start.' }]),
+            ...keptNote(o),
             {
                 text: 'Free space with: sandbox data clean <target...>  (e.g. tools/go, databases/postgres-18, logs, launches)',
                 tone: 'muted',
@@ -177,19 +177,12 @@ export function dataPage(o) {
             },
         ],
     };
-    const clean = {
-        id: 'clean',
-        title: 'Clean up',
-        actions: [
-            action(pruneStorage, {}, {
-                label: 'Clean up…',
-                verb: 'choose what',
-                description: 'Delete caches, old sandboxes and other leftovers (the clean command, with its options).',
-                fields: [DAYS_FIELD],
-            }),
-        ],
-    };
-    return { title: 'Data', sections: [disks, ...areas, total, clean] };
+    return { title: 'Data', sections: [disks, kept] };
+}
+/** The folders kept on purpose (not deleted here), named in one note. */
+function keptNote(o) {
+    const names = o.entries.filter((e) => !e.target).map((e) => e.name);
+    return names.length ? [{ text: 'Kept on this PC on purpose, not deleted here: ' + names.join(', ') + '.' }] : [];
 }
 export const dataView = defineView({
     id: 'data',

package/dist/app/features/defs.d.ts

@@ -1262,9 +1262,16 @@ export interface NavSection {
     readonly elsewhere?: string;
     /** Entries under this one (Sandbox: Status, Projects). */
     readonly children?: readonly NavSection[];
+    /** Views shown as more categories inside this entry's page (Settings: VPN, GitHub), not as entries of their own. */
+    readonly embeds?: readonly {
+        readonly label: string;
+        readonly view: ViewId;
+    }[];
 }
 /** Every entry of the navigation, children included, in order. */
 export declare function navSections(nav: readonly NavSection[]): NavSection[];
 /** Every view the web's navigation opens. */
 export declare function navViews(nav: readonly NavSection[]): ViewId[];
+/** The entry whose page shows this view as one of its categories (VPN: Settings), if any. */
+export declare function embeddingOf(nav: readonly NavSection[], view: string): NavSection | undefined;
 export declare const NAV: readonly NavSection[];

package/dist/app/features/defs.js

@@ -125,7 +125,11 @@ export function navSections(nav) {
 }
 /** Every view the web's navigation opens. */
 export function navViews(nav) {
-    return navSections(nav).flatMap((n) => (n.view ? [n.view] : []));
+    return navSections(nav).flatMap((n) => [...(n.view ? [n.view] : []), ...(n.embeds ?? []).map((e) => e.view)]);
+}
+/** The entry whose page shows this view as one of its categories (VPN: Settings), if any. */
+export function embeddingOf(nav, view) {
+    return navSections(nav).find((n) => n.embeds?.some((e) => e.view === view));
 }
 export const NAV = [
     { label: 'Agents', view: 'agents' },
@@ -140,8 +144,8 @@ export const NAV = [
     { label: 'Apps', view: 'apps' },
     {
         label: 'Settings',
-        children: [
-            { label: 'All settings', view: 'settings' },
+        view: 'settings',
+        embeds: [
             { label: 'VPN', view: 'vpn' },
             { label: 'GitHub', view: 'github' },
         ],

package/dist/app/features/health/health.def.js

@@ -165,22 +165,35 @@ export const enableSandbox = defineOperation({
         },
     },
 });
+/**
+ * A repair row: what it means is the description; what was found and the fix are label/value detail lines ("Found:",
+ * "Fix:"). An ok row has nothing to fix, so what it found is its description.
+ */
 function checkItems(last) {
     return last.checks.map((r, i) => {
-        const lines = resultLines(r)
+        const found = r.detail + (r.timedOut ? ' (took too long)' : '');
+        const rest = resultLines(r)
             .slice(1)
-            .map((l) => l.text.trim());
+            .map((l) => l.text.trim())
+            .filter((l) => !l.startsWith('What it means: '));
+        const details = r.status === 'ok' ? [] : ['Found: ' + found, ...rest];
         return {
             id: 'repair:' + i,
             label: r.name,
             hint: BADGE[r.status],
             ...(TONE[r.status] ? { tone: TONE[r.status] } : {}),
             badges: [{ text: BADGE[r.status], ...(TONE[r.status] ? { tone: TONE[r.status] } : {}) }],
-            description: r.detail,
-            ...(lines.length ? { details: lines } : {}),
+            description: r.means ?? (details.length ? undefined : found),
+            ...(details.length ? { details } : {}),
         };
     });
 }
+/** A "Set up this PC" row: the real value is the hint; OK or action needed is the tone and the badge. */
+const SETUP_BADGE = {
+    ok: 'OK',
+    warn: 'WARNING',
+    action: 'NEEDS YOU',
+};
 /** The health page: before any check, the two things to do; after one, what it found. Pure. */
 export function healthPage(o) {
     const last = o.last;
@@ -223,8 +236,8 @@ export function healthPage(o) {
     const sections = [
         {
             id: 'status',
-            summary: (last.mode === 'repair' ? 'Repaired ' : 'Checked ') + ago(last.at),
-            facts: last.log ? [{ id: 'log', label: 'Log', value: last.log }] : [],
+            summary: (last.mode === 'repair' ? 'Last repair ' : 'Last check ') + ago(last.at),
+            ...(last.log ? { notes: [{ text: 'Log: ' + last.log, tone: 'muted' }] } : {}),
         },
         {
             id: 'doctor',
@@ -232,8 +245,9 @@ export function healthPage(o) {
             items: last.details.map(([name, detail], i) => ({
                 id: 'doctor:' + i,
                 label: name,
+                // The hint is the whole value; only a long one is cut, and then the description keeps all of it.
                 hint: cut(detail, 50),
-                details: [detail],
+                ...(detail.length > 50 ? { description: detail } : {}),
             })),
         },
         {
@@ -252,9 +266,14 @@ export function healthPage(o) {
                 : setup.checks.map((c, i) => ({
                     id: 'setup:' + i,
                     label: c.name,
-                    hint: c.status === 'ok' ? 'OK' : c.status === 'warn' ? 'WARNING' : 'ACTION NEEDED',
+                    hint: c.detail,
                     tone: c.status === 'ok' ? 'ok' : c.status === 'warn' ? 'warn' : 'danger',
-                    description: c.detail,
+                    badges: [
+                        {
+                            text: SETUP_BADGE[c.status],
+                            tone: c.status === 'ok' ? 'ok' : c.status === 'warn' ? 'warn' : 'danger',
+                        },
+                    ],
                 })),
             notes: canEnable
                 ? [{ text: 'Turn Windows Sandbox on from the menu or with sandbox setup.', tone: 'muted', only: 'web' }]

package/dist/app/features/sandbox/sandbox.def.js

@@ -130,12 +130,12 @@ function projectItem(p) {
         hint: p.host + '  ->  ' + p.guest + '  (' + (MECHANISM_TEXT[p.mechanism] ?? 'wsb share') + ')',
         marked: p.here,
         details: [
-            'setup: ' + p.setup.phase + (p.setup.phase === 'ready' ? '' : ' - ' + p.setup.message),
+            'Setup: ' + p.setup.phase + (p.setup.phase === 'ready' ? '' : ' - ' + p.setup.message),
             ...(p.databases.length
-                ? ['databases: ' + p.databases.map((d) => d.database + ' :' + d.port + ' ' + d.state).join(', ')]
+                ? ['Databases: ' + p.databases.map((d) => d.database + ' :' + d.port + ' ' + d.state).join(', ')]
                 : []),
-            ...p.sessions.map((s) => 'session ' + s.id + '  ' + s.harness + '  ' + s.viewers + '  ' + ago(s.started)),
-            ...p.repoGuard.map((f) => 'guard: ' + f),
+            ...p.sessions.map((s) => 'Session: ' + s.harness + ' ' + s.id + ', ' + s.viewers + ', started ' + ago(s.started)),
+            ...p.repoGuard.map((f) => 'Guard: ' + f),
         ],
     };
 }

package/dist/app/features/storage/storage.def.js

@@ -160,22 +160,17 @@ export const containedOff = defineOperation({
 });
 /** The Storage page: the data folder (change, move, use another), then contained storage (beta). */
 export function storagePage(o, c) {
-    const folder = {
-        id: '@data-folder',
-        label: 'Data folder',
-        hint: o.root,
-        description: 'Where your tools, logins, history and logs are kept between sandboxes. Press Enter to move them to another folder or drive, or to use a different folder.',
-        details: [
-            o.size,
-            'Default folder: ' + o.defaultRoot + (o.defaultInUse ? ' (in use)' : ''),
-            ...o.otherFoldersWithData.map((f) => 'Another folder with data: ' + f),
-        ],
-        primary: action(changeDataFolder, {}, { label: 'Data folder', verb: 'change' }),
-    };
+    // Move and use another folder are the two ways to change it (the same choice as the Data folder setting).
     const data = {
         id: 'folder',
         title: 'Data folder',
-        items: [folder],
+        description: 'Where your tools, logins, history and logs are kept between sandboxes.',
+        facts: [
+            { id: 'folder', label: 'Folder', value: o.root },
+            { id: 'size', label: 'Size', value: o.size },
+            { id: 'default', label: 'Default folder', value: o.defaultRoot + (o.defaultInUse ? ' (in use)' : '') },
+            ...o.otherFoldersWithData.map((f, i) => ({ id: 'other:' + i, label: 'Other folder with data', value: f })),
+        ],
         actions: [action(moveStorage, {}), action(useStorage, {})],
     };
     const contained = {

package/dist/app/features/updates/updates.def.js

@@ -159,7 +159,6 @@ export function updatesPage(s, latest) {
                                 hint: 'off',
                                 tone: 'warn',
                                 description: s.autoOffText,
-                                details: [s.autoOffText],
                             }),
                         ]
                         : []),
@@ -178,8 +177,8 @@ export function updatesPage(s, latest) {
                             row('failed', 'Last failed update', {
                                 hint: s.failed.version,
                                 tone: 'danger',
-                                description: s.failed.reason,
-                                details: [s.failed.reason, 'It is not tried again until a newer version is released.'],
+                                description: 'It is not tried again until a newer version is released.',
+                                details: [s.failed.reason],
                             }),
                         ]
                         : []),

package/dist/guest/toolchains/tools/cli.js

@@ -30,6 +30,22 @@ export function ghExePath() {
     const dir = tool('cli', 'gh');
     return path.join(entry?.subdir ? path.join(dir, entry.subdir) : dir, entry?.exe ?? 'gh.exe');
 }
+/**
+ * gh keeps its token in Windows Credential Manager unless told otherwise, and that is wiped with the sandbox: only a
+ * login made with --insecure-storage (the token in GH_CONFIG_DIR, which persists) is still there next time.
+ */
+const GH_NOTE = ' (log in once with: gh auth login --web --insecure-storage; it is kept between sandboxes)';
+/** A saved gh account whose token was in Credential Manager (gone now): say how to log in so that it lasts. */
+function warnKeyringLogin() {
+    try {
+        const hosts = fs.readFileSync(path.join(ghConfigDir(), 'hosts.yml'), 'utf8');
+        if (/^\s*user:/m.test(hosts) && !/oauth_token:/.test(hosts))
+            warn('gh: the GitHub login from an earlier sandbox was kept in Windows Credential Manager, which is wiped with each sandbox. Log in again with: gh auth login --web --insecure-storage (then it lasts).');
+    }
+    catch {
+        // No saved login: nothing to say.
+    }
+}
 const toolVars = {
     gh: () => ({
         GH_CONFIG_DIR: exists(deliveredGhConfigDir()) ? deliveredGhConfigDir() : mkdirp(ghConfigDir()),
@@ -85,8 +101,11 @@ export async function setupCli(env, settings, gitAccess, refresh = false) {
                 refresh,
                 subdir: entry.subdir,
                 size: entry.size,
+                ...(name === 'gh' ? { note: GH_NOTE } : {}),
             });
             Object.assign(env.vars, toolVars[name]?.() ?? {});
+            if (name === 'gh')
+                warnKeyringLogin();
         }
         catch (e) {
             // One tool failing never takes the others down.

package/dist/host/life/host-memory.d.ts

@@ -17,6 +17,24 @@ export type HostMemory = z.output<typeof HostMemorySchema>;
 export declare function parseHostMemory(text: string): HostMemory | null;
 /** This PC's memory now, or null when it cannot be read (and always during the self-test: it never asks Windows). */
 export declare function readHostMemory(storageRoot: string): HostMemory | null;
+/**
+ * One long-running `HostTools memory-status --serve` for the watcher: a reading every `seconds`, instead of starting a
+ * program (and building a disk counter) for each one. Without HostTools.exe it does nothing and `latest()` stays null.
+ */
+export declare class HostMemoryStream {
+    private readonly storageRoot;
+    private readonly seconds;
+    private child;
+    private last;
+    private startedAt;
+    private stopped;
+    constructor(storageRoot: string, seconds: number);
+    start(): void;
+    /** The newest reading while it is fresh; starts the stream again when it ended (at most once a minute). */
+    latest(): HostMemory | null;
+    /** Ends it (closing its input ends HostTools). */
+    stop(): void;
+}
 /** The same without blocking: for the watcher, which must never wait on it. */
 export declare function readHostMemoryAsync(storageRoot: string): Promise<HostMemory | null>;
 /** How low this PC's memory is: what the host watchdog acts on (pure). */

package/dist/host/life/host-memory.js

@@ -47,6 +47,72 @@ export function readHostMemory(storageRoot) {
     const result = spawnSync(file, args, { encoding: 'utf8', windowsHide: true, timeout: TIMEOUT_MS });
     return parseHostMemory(result.stdout || '');
 }
+/** A reading older than this is not used (the stream stopped answering): the watcher asks once instead. */
+const STREAM_FRESH_MS = 30000;
+/** A stream that ended is started again at most this often. */
+const STREAM_RESTART_MS = 60000;
+/**
+ * One long-running `HostTools memory-status --serve` for the watcher: a reading every `seconds`, instead of starting a
+ * program (and building a disk counter) for each one. Without HostTools.exe it does nothing and `latest()` stays null.
+ */
+export class HostMemoryStream {
+    storageRoot;
+    seconds;
+    child = null;
+    last = null;
+    startedAt = 0;
+    stopped = false;
+    constructor(storageRoot, seconds) {
+        this.storageRoot = storageRoot;
+        this.seconds = seconds;
+    }
+    start() {
+        if (!isWin || selfTestRunning() || this.stopped || this.child)
+            return;
+        const tools = hostToolsExe(this.storageRoot);
+        if (!tools)
+            return;
+        this.startedAt = Date.now();
+        try {
+            const child = spawn(tools, ['memory-status', '--serve', String(this.seconds)], {
+                windowsHide: true,
+                stdio: ['pipe', 'pipe', 'ignore'],
+            });
+            this.child = child;
+            let buffer = '';
+            child.stdout.setEncoding('utf8');
+            child.stdout.on('data', (chunk) => {
+                buffer = (buffer + chunk).slice(-16384);
+                let end;
+                while ((end = buffer.indexOf('\n')) >= 0) {
+                    const memory = parseHostMemory(buffer.slice(0, end).trim());
+                    buffer = buffer.slice(end + 1);
+                    if (memory)
+                        this.last = { at: Date.now(), memory };
+                }
+            });
+            child.stdin.on('error', () => undefined);
+            child.on('error', () => (this.child = null));
+            child.on('exit', () => (this.child = null));
+        }
+        catch {
+            // Could not start it: the watcher asks the old way.
+            this.child = null;
+        }
+    }
+    /** The newest reading while it is fresh; starts the stream again when it ended (at most once a minute). */
+    latest() {
+        if (!this.child && Date.now() - this.startedAt >= STREAM_RESTART_MS)
+            this.start();
+        return this.last && Date.now() - this.last.at < STREAM_FRESH_MS ? this.last.memory : null;
+    }
+    /** Ends it (closing its input ends HostTools). */
+    stop() {
+        this.stopped = true;
+        this.child?.stdin?.end();
+        this.child = null;
+    }
+}
 /** The same without blocking: for the watcher, which must never wait on it. */
 export function readHostMemoryAsync(storageRoot) {
     if (!isWin || selfTestRunning())

package/dist/host/web/runner.d.ts

@@ -8,7 +8,7 @@ export interface WebRunOptions {
     readonly staticRoot: string;
     /** This program's version, kept in the state file. */
     readonly version: string;
-    /** End after this long unused while no sandbox runs (WebServerOptions.idleExitMs). */
+    /** End after this long with no browser (sooner with no sandbox): WebServerOptions.idleExitMs. */
     readonly idleExitMs?: number;
 }
 export declare class WebRunner {

package/dist/host/web/server.d.ts

@@ -4,8 +4,13 @@ import type { Endpoint } from '../../shared/pty/index.js';
 import type { WebBackend } from './backend.js';
 /** No inline script: the page and its script are files from this server. Inline styles are what xterm.js needs. */
 export declare const CONTENT_SECURITY_POLICY: string;
-/** The server ends after this long with no request, no socket and no sandbox running (it starts again with one). */
+/**
+ * The server ends after this long with no browser connected and no request, even while a sandbox runs (sandbox web
+ * open and the next launch start it again), so it never sits in memory unused.
+ */
 export declare const IDLE_EXIT_MS: number;
+/** ...and sooner when no sandbox runs either: there is nothing to look at. */
+export declare const IDLE_NO_SANDBOX_MS: number;
 export declare const RPC_PATH = "/api/rpc";
 export interface WebServerOptions {
     /** 0 picks a free port (tests). */
@@ -20,8 +25,10 @@ export interface WebServerOptions {
     readonly dial?: (endpoint: Endpoint) => Promise<net.Socket>;
     /** The shared core's operations and queries the browser may run (none: /api/rpc is not served). */
     readonly rpc?: RpcHost;
-    /** End by itself (onStop) after this long unused while no sandbox runs; 0 or missing: never (tests). */
+    /** End by itself (onStop) after this long with no browser, even while a sandbox runs; 0 or missing: never (tests). */
     readonly idleExitMs?: number;
+    /** ...or after this long when no sandbox runs either (default IDLE_NO_SANDBOX_MS; tests make it short). */
+    readonly idleNoSandboxMs?: number;
     /** Heartbeat period (tests make it short). */
     readonly heartbeatMs?: number;
 }
@@ -54,8 +61,10 @@ export declare class WebServer {
      * so they never hold a slot or a session connection.
      */
     private beat;
-    /** Nothing has used the server for a while and no sandbox runs: it ends (the next launch starts it again). */
+    /** No browser has used the server for a while: it ends (sooner when no sandbox runs). */
     private checkIdle;
+    /** How long unused before it ends when no sandbox runs. */
+    private quietMs;
     /** Counts a new socket; at the limit, the oldest of its kind makes room (a new tab always works). */
     private track;
     stop(): Promise<void>;

package/dist/host/web/server.js

@@ -19,8 +19,13 @@ const MAX_TERMINALS = 16;
 const MAX_RPC_SOCKETS = 8;
 /** Every socket is pinged this often; one that has not answered the last ping by the next is dropped. */
 const HEARTBEAT_MS = 20_000;
-/** The server ends after this long with no request, no socket and no sandbox running (it starts again with one). */
-export const IDLE_EXIT_MS = 30 * 60_000;
+/**
+ * The server ends after this long with no browser connected and no request, even while a sandbox runs (sandbox web
+ * open and the next launch start it again), so it never sits in memory unused.
+ */
+export const IDLE_EXIT_MS = 20 * 60_000;
+/** ...and sooner when no sandbox runs either: there is nothing to look at. */
+export const IDLE_NO_SANDBOX_MS = 5 * 60_000;
 const SESSION_PATH = /^\/api\/sessions\/([A-Za-z0-9_-]{1,64})\/terminal$/;
 export const RPC_PATH = '/api/rpc';
 class HttpFailure extends Error {
@@ -72,7 +77,7 @@ export class WebServer {
                 this.heartbeat = setInterval(() => this.beat(), this.options.heartbeatMs ?? HEARTBEAT_MS);
                 this.heartbeat.unref();
                 if (this.options.idleExitMs) {
-                    this.idleCheck = setInterval(() => void this.checkIdle(), Math.min(60_000, this.options.idleExitMs));
+                    this.idleCheck = setInterval(() => void this.checkIdle(), Math.min(60_000, this.quietMs()));
                     this.idleCheck.unref();
                 }
                 resolve();
@@ -102,20 +107,29 @@ export class WebServer {
             }
         }
     }
-    /** Nothing has used the server for a while and no sandbox runs: it ends (the next launch starts it again). */
+    /** No browser has used the server for a while: it ends (sooner when no sandbox runs). */
     async checkIdle() {
         const limit = this.options.idleExitMs ?? 0;
-        if (!limit || this.tracked.size > 0 || Date.now() - this.lastUsed < limit)
+        if (!limit || this.tracked.size > 0)
+            return;
+        const idle = Date.now() - this.lastUsed;
+        if (idle >= limit)
+            return this.options.onStop?.();
+        if (idle < this.quietMs())
             return;
         try {
             if ((await this.options.backend.info()).sandbox === 'running')
                 return;
         }
         catch {
-            return; // cannot tell: keep running
+            return; // cannot tell: wait for the longer limit
         }
         this.options.onStop?.();
     }
+    /** How long unused before it ends when no sandbox runs. */
+    quietMs() {
+        return Math.min(this.options.idleExitMs ?? 0, this.options.idleNoSandboxMs ?? IDLE_NO_SANDBOX_MS);
+    }
     /** Counts a new socket; at the limit, the oldest of its kind makes room (a new tab always works). */
     track(ws, kind, limit) {
         const same = [...this.tracked.entries()]

package/dist/runtime/daemon.js

@@ -29978,6 +29978,17 @@ function ghConfigDir() {
 function deliveredGhConfigDir() {
   return path45.join(localDir, "gh-token");
 }
+var GH_NOTE = " (log in once with: gh auth login --web --insecure-storage; it is kept between sandboxes)";
+function warnKeyringLogin() {
+  try {
+    const hosts = fs35.readFileSync(path45.join(ghConfigDir(), "hosts.yml"), "utf8");
+    if (/^\s*user:/m.test(hosts) && !/oauth_token:/.test(hosts))
+      warn(
+        "gh: the GitHub login from an earlier sandbox was kept in Windows Credential Manager, which is wiped with each sandbox. Log in again with: gh auth login --web --insecure-storage (then it lasts)."
+      );
+  } catch {
+  }
+}
 var toolVars = {
   gh: () => ({
     GH_CONFIG_DIR: exists(deliveredGhConfigDir()) ? deliveredGhConfigDir() : mkdirp(ghConfigDir()),
@@ -30018,9 +30029,11 @@ async function setupCli(env, settings, gitAccess, refresh = false) {
       await setupSingleExe(env, name, entry.repo, entry.asset(arch), entry.exe, tool("cli", name), {
         refresh,
         subdir: entry.subdir,
-        size: entry.size
+        size: entry.size,
+        ...name === "gh" ? { note: GH_NOTE } : {}
       });
       Object.assign(env.vars, toolVars[name]?.() ?? {});
+      if (name === "gh") warnKeyringLogin();
     } catch (e) {
       warn(name + " could not be set up and is skipped; the other tools are not affected. Reason: " + errMsg(e));
       env.summary.push(entry.name + ": FAILED");
@@ -32050,6 +32063,7 @@ var connectOnce = (host, port, timeoutMs) => {
     socket.once("connect", () => {
       clearTimeout(timer);
       socket.setNoDelay(true);
+      socket.setKeepAlive(true, KEEPALIVE_IDLE_MS);
       resolve2(socket);
     });
     socket.once("error", (e) => {
@@ -32058,6 +32072,7 @@ var connectOnce = (host, port, timeoutMs) => {
     });
   });
 };
+var KEEPALIVE_IDLE_MS = 1e4;
 async function connect(endpoint, timeoutMs = 3e3) {
   const errors = [];
   for (const address of endpoint.addresses) {