windows-development-sandbox 1.11.6 → 1.12.0

package/dist/app/features/audit/audit.run.js

@@ -0,0 +1,133 @@
+// The audit feature's work: reads the log on this PC and sums it up (totals, per agent, per session). Much of what is
+// in the log came from the sandbox, so every text is made plain (no control codes) before it leaves here.
+import { plainText } from '../../../core/util/index.js';
+import { AuditLog } from '../../../host/audit/index.js';
+import { implement } from '../../context.js';
+import { listAudit, NO_SESSION } from './audit.def.js';
+/** Most sessions listed. */
+const MAX_SESSIONS = 60;
+const plain = (s) => (s === undefined ? undefined : plainText(s));
+/** A stored event as the feature shows it. */
+export function auditRow(e) {
+    const opt = (key, value) => value ? { [key]: plainText(value) } : {};
+    return {
+        time: e.t,
+        kind: e.k,
+        what: plain(e.k === 'session' ? (e.ag ?? e.p) : e.p) ?? '',
+        ...opt('command', e.c),
+        ...opt('parent', e.pp),
+        ...opt('action', e.a),
+        ...opt('folder', e.w),
+        ...opt('project', e.pj),
+        ...opt('session', e.s),
+        ...opt('agent', e.ag),
+        ...(e.s && e.sv ? { linked: e.sv === 't' ? 'only-session' : 'process' } : {}),
+        count: e.n ?? 1,
+        ...opt('sha', e.h),
+        ...opt('author', e.au),
+    };
+}
+/** Does an event pass the filters that are not about its kind? */
+function inScope(e, input) {
+    const same = (a, b) => a !== undefined && a.toLowerCase() === b.toLowerCase();
+    if (input.session !== undefined) {
+        if (input.session === NO_SESSION ? e.s !== undefined : !e.s?.startsWith(input.session))
+            return false;
+    }
+    if (input.agent !== undefined && !same(e.ag, input.agent))
+        return false;
+    if (input.project !== undefined && !same(e.pj, input.project))
+        return false;
+    return true;
+}
+const tally = () => ({ commands: 0, files: new Set(), commits: 0 });
+function count(t, e) {
+    if (e.k === 'proc')
+        t.commands += e.n ?? 1;
+    if (e.k === 'file')
+        t.files.add((e.w ?? '') + '\0' + (e.p ?? ''));
+    if (e.k === 'commit')
+        t.commits += 1;
+}
+const counts = (t) => ({
+    commands: t.commands,
+    files: t.files.size,
+    commits: t.commits,
+});
+/** The listing for these filters, from a log (the command line, the menu and the web all show this). */
+export function auditListing(log, settings, input, folder, now = Date.now()) {
+    // The last n × 24 hours (the day files are UTC days: one more is read, then cut to the hour).
+    const since = new Date(now - input.days * 86400000).toISOString();
+    const scoped = log.read({ days: input.days + 1, grep: input.grep }).filter((e) => e.t >= since && inScope(e, input));
+    const total = tally();
+    const unlinked = tally();
+    const perSession = new Map();
+    for (const e of scoped) {
+        count(total, e);
+        if (!e.s) {
+            count(unlinked, e);
+            continue;
+        }
+        let entry = perSession.get(e.s);
+        if (!entry) {
+            entry = {
+                info: {
+                    id: plainText(e.s),
+                    agent: plainText(e.ag ?? (e.k === 'session' ? (e.p ?? '?') : '?')),
+                    project: plainText(e.pj ?? '?'),
+                    started: e.t,
+                    commands: 0,
+                    files: 0,
+                    commits: 0,
+                },
+                t: tally(),
+            };
+            perSession.set(e.s, entry);
+        }
+        count(entry.t, e);
+        if (e.k === 'session' && e.a === 'end')
+            entry.info = { ...entry.info, ended: e.t };
+        if (e.k === 'proc' && (e.c || e.p))
+            entry.info = { ...entry.info, last: plainText(e.c || e.p || '') };
+    }
+    const sessions = [...perSession.values()]
+        .map(({ info, t }) => ({ ...info, ...counts(t) }))
+        .sort((a, b) => b.started.localeCompare(a.started));
+    const agents = new Map();
+    for (const s of sessions) {
+        const a = agents.get(s.agent) ?? { sessions: 0, commands: 0, files: 0, commits: 0 };
+        agents.set(s.agent, {
+            sessions: a.sessions + 1,
+            commands: a.commands + s.commands,
+            files: a.files + s.files,
+            commits: a.commits + s.commits,
+        });
+    }
+    const matching = input.kind === 'all' ? scoped : scoped.filter((e) => e.k === input.kind);
+    return {
+        enabled: settings.enabled,
+        keepDays: settings.days,
+        maxMb: settings.maxMb,
+        bytes: log.bytes(),
+        folder,
+        filter: {
+            days: input.days,
+            kind: input.kind,
+            ...(input.session !== undefined ? { session: input.session } : {}),
+            ...(input.agent !== undefined ? { agent: input.agent } : {}),
+            ...(input.project !== undefined ? { project: input.project } : {}),
+            ...(input.grep !== undefined ? { grep: input.grep } : {}),
+        },
+        matched: matching.length,
+        events: matching.slice(-input.limit).reverse().map(auditRow),
+        totals: { events: scoped.length, ...counts(total), sessions: sessions.length },
+        agents: [...agents.entries()].map(([agent, a]) => ({ agent, ...a })).sort((a, b) => b.commands - a.commands),
+        sessions: sessions.slice(0, MAX_SESSIONS),
+        unlinked: counts(unlinked),
+    };
+}
+export const listAuditRun = implement(listAudit, (ctx, input) => {
+    const settings = ctx.loaded.config.audit;
+    const folder = AuditLog.dirFor(ctx.storageRoot, ctx.dataPath);
+    return auditListing(new AuditLog(folder, settings), settings, input, folder);
+});

package/dist/app/features/audit/index.d.ts

@@ -0,0 +1,2 @@
+export * from './audit.def.js';
+export * from './audit.run.js';

package/dist/app/features/audit/index.js

@@ -0,0 +1,3 @@
+// The audit feature: what the agents ran, changed and committed, from the audit log on this PC.
+export * from './audit.def.js';
+export * from './audit.run.js';

package/dist/app/features/defs.d.ts

@@ -4,6 +4,7 @@ export type { AccountRow, AccountsList, AgentAccounts } from './accounts/account
 export type { AppRow, AppsList, CustomAppRow } from './apps/apps.def.js';
 export type { FolderEntry, FolderListing } from './files/files.def.js';
 export type { LogFileRow, LogFiles, LogTail } from './logs/logs.def.js';
+export type { AuditList, AuditRow, AuditSession } from './audit/audit.def.js';
 export type { ProjectRow, ProjectsList } from './projects/projects.def.js';
 export type { SandboxStatus } from './sandbox/sandbox.def.js';
 export type { SessionRow, SessionsList } from './sessions/sessions.def.js';
@@ -450,6 +451,8 @@ export declare const QUERIES: readonly [QueryDef<import("zod").ZodObject<{}, imp
         cli: import("zod").ZodBoolean;
         mesa: import("zod").ZodBoolean;
         fullGitOnly: import("zod").ZodBoolean;
+        plugsInto: import("zod").ZodOptional<import("zod").ZodString>;
+        service: import("zod").ZodOptional<import("zod").ZodBoolean>;
         setting: import("zod").ZodOptional<import("zod").ZodString>;
         settingField: import("zod").ZodOptional<import("zod").ZodType<import("../kernel/fields.js").Field, unknown, import("zod/v4/core").$ZodTypeInternals<import("../kernel/fields.js").Field, unknown>>>;
         settingValue: import("zod").ZodOptional<import("zod").ZodUnknown>;
@@ -616,7 +619,100 @@ export declare const QUERIES: readonly [QueryDef<import("zod").ZodObject<{}, imp
     file: import("zod").ZodString;
     text: import("zod").ZodString;
     next: import("zod").ZodNumber;
-}, import("zod/v4/core").$strip>, "logs.tail">, QueryDef<import("zod").ZodObject<{}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+}, import("zod/v4/core").$strip>, "logs.tail">, QueryDef<import("zod").ZodObject<{
+    days: import("zod").ZodDefault<import("zod").ZodNumber>;
+    kind: import("zod").ZodDefault<import("zod").ZodEnum<{
+        file: "file";
+        all: "all";
+        session: "session";
+        commit: "commit";
+        proc: "proc";
+        guard: "guard";
+    }>>;
+    session: import("zod").ZodOptional<import("zod").ZodString>;
+    agent: import("zod").ZodOptional<import("zod").ZodString>;
+    project: import("zod").ZodOptional<import("zod").ZodString>;
+    grep: import("zod").ZodOptional<import("zod").ZodString>;
+    limit: import("zod").ZodDefault<import("zod").ZodNumber>;
+}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    enabled: import("zod").ZodBoolean;
+    keepDays: import("zod").ZodNumber;
+    maxMb: import("zod").ZodNumber;
+    bytes: import("zod").ZodNumber;
+    folder: import("zod").ZodString;
+    filter: import("zod").ZodObject<{
+        days: import("zod").ZodNumber;
+        kind: import("zod").ZodEnum<{
+            file: "file";
+            all: "all";
+            session: "session";
+            commit: "commit";
+            proc: "proc";
+            guard: "guard";
+        }>;
+        session: import("zod").ZodOptional<import("zod").ZodString>;
+        agent: import("zod").ZodOptional<import("zod").ZodString>;
+        project: import("zod").ZodOptional<import("zod").ZodString>;
+        grep: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    matched: import("zod").ZodNumber;
+    events: import("zod").ZodArray<import("zod").ZodObject<{
+        time: import("zod").ZodString;
+        kind: import("zod").ZodEnum<{
+            file: "file";
+            session: "session";
+            note: "note";
+            commit: "commit";
+            proc: "proc";
+            guard: "guard";
+        }>;
+        what: import("zod").ZodString;
+        command: import("zod").ZodOptional<import("zod").ZodString>;
+        parent: import("zod").ZodOptional<import("zod").ZodString>;
+        action: import("zod").ZodOptional<import("zod").ZodString>;
+        folder: import("zod").ZodOptional<import("zod").ZodString>;
+        project: import("zod").ZodOptional<import("zod").ZodString>;
+        session: import("zod").ZodOptional<import("zod").ZodString>;
+        agent: import("zod").ZodOptional<import("zod").ZodString>;
+        linked: import("zod").ZodOptional<import("zod").ZodEnum<{
+            process: "process";
+            "only-session": "only-session";
+        }>>;
+        count: import("zod").ZodNumber;
+        sha: import("zod").ZodOptional<import("zod").ZodString>;
+        author: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>>;
+    totals: import("zod").ZodObject<{
+        commands: import("zod").ZodNumber;
+        files: import("zod").ZodNumber;
+        commits: import("zod").ZodNumber;
+        events: import("zod").ZodNumber;
+        sessions: import("zod").ZodNumber;
+    }, import("zod/v4/core").$strip>;
+    agents: import("zod").ZodArray<import("zod").ZodObject<{
+        commands: import("zod").ZodNumber;
+        files: import("zod").ZodNumber;
+        commits: import("zod").ZodNumber;
+        agent: import("zod").ZodString;
+        sessions: import("zod").ZodNumber;
+    }, import("zod/v4/core").$strip>>;
+    sessions: import("zod").ZodArray<import("zod").ZodObject<{
+        commands: import("zod").ZodNumber;
+        files: import("zod").ZodNumber;
+        commits: import("zod").ZodNumber;
+        id: import("zod").ZodString;
+        agent: import("zod").ZodString;
+        project: import("zod").ZodString;
+        started: import("zod").ZodString;
+        ended: import("zod").ZodOptional<import("zod").ZodString>;
+        last: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>>;
+    unlinked: import("zod").ZodObject<{
+        commands: import("zod").ZodNumber;
+        files: import("zod").ZodNumber;
+        commits: import("zod").ZodNumber;
+    }, import("zod/v4/core").$strip>;
+}, import("zod/v4/core").$strip>, "audit.list">, QueryDef<import("zod").ZodObject<{}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
     managed: import("zod").ZodBoolean;
     version: import("zod").ZodString;
     scope: import("zod").ZodNullable<import("zod").ZodEnum<{
@@ -932,6 +1028,8 @@ export declare const VIEWS: readonly [import("../kernel/define.js").ViewDef<{
             cli: import("zod").ZodBoolean;
             mesa: import("zod").ZodBoolean;
             fullGitOnly: import("zod").ZodBoolean;
+            plugsInto: import("zod").ZodOptional<import("zod").ZodString>;
+            service: import("zod").ZodOptional<import("zod").ZodBoolean>;
             setting: import("zod").ZodOptional<import("zod").ZodString>;
             settingField: import("zod").ZodOptional<import("zod").ZodType<import("../kernel/fields.js").Field, unknown, import("zod/v4/core").$ZodTypeInternals<import("../kernel/fields.js").Field, unknown>>>;
             settingValue: import("zod").ZodOptional<import("zod").ZodUnknown>;
@@ -1114,6 +1212,101 @@ export declare const VIEWS: readonly [import("../kernel/define.js").ViewDef<{
         next: import("zod").ZodNumber;
     }, import("zod/v4/core").$strip>, "logs.tail">;
 }, import("./logs/logs.def.js").LogsParams, "logs">, import("../kernel/define.js").ViewDef<{
+    audit: QueryDef<import("zod").ZodObject<{
+        days: import("zod").ZodDefault<import("zod").ZodNumber>;
+        kind: import("zod").ZodDefault<import("zod").ZodEnum<{
+            file: "file";
+            all: "all";
+            session: "session";
+            commit: "commit";
+            proc: "proc";
+            guard: "guard";
+        }>>;
+        session: import("zod").ZodOptional<import("zod").ZodString>;
+        agent: import("zod").ZodOptional<import("zod").ZodString>;
+        project: import("zod").ZodOptional<import("zod").ZodString>;
+        grep: import("zod").ZodOptional<import("zod").ZodString>;
+        limit: import("zod").ZodDefault<import("zod").ZodNumber>;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        enabled: import("zod").ZodBoolean;
+        keepDays: import("zod").ZodNumber;
+        maxMb: import("zod").ZodNumber;
+        bytes: import("zod").ZodNumber;
+        folder: import("zod").ZodString;
+        filter: import("zod").ZodObject<{
+            days: import("zod").ZodNumber;
+            kind: import("zod").ZodEnum<{
+                file: "file";
+                all: "all";
+                session: "session";
+                commit: "commit";
+                proc: "proc";
+                guard: "guard";
+            }>;
+            session: import("zod").ZodOptional<import("zod").ZodString>;
+            agent: import("zod").ZodOptional<import("zod").ZodString>;
+            project: import("zod").ZodOptional<import("zod").ZodString>;
+            grep: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>;
+        matched: import("zod").ZodNumber;
+        events: import("zod").ZodArray<import("zod").ZodObject<{
+            time: import("zod").ZodString;
+            kind: import("zod").ZodEnum<{
+                file: "file";
+                session: "session";
+                note: "note";
+                commit: "commit";
+                proc: "proc";
+                guard: "guard";
+            }>;
+            what: import("zod").ZodString;
+            command: import("zod").ZodOptional<import("zod").ZodString>;
+            parent: import("zod").ZodOptional<import("zod").ZodString>;
+            action: import("zod").ZodOptional<import("zod").ZodString>;
+            folder: import("zod").ZodOptional<import("zod").ZodString>;
+            project: import("zod").ZodOptional<import("zod").ZodString>;
+            session: import("zod").ZodOptional<import("zod").ZodString>;
+            agent: import("zod").ZodOptional<import("zod").ZodString>;
+            linked: import("zod").ZodOptional<import("zod").ZodEnum<{
+                process: "process";
+                "only-session": "only-session";
+            }>>;
+            count: import("zod").ZodNumber;
+            sha: import("zod").ZodOptional<import("zod").ZodString>;
+            author: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        totals: import("zod").ZodObject<{
+            commands: import("zod").ZodNumber;
+            files: import("zod").ZodNumber;
+            commits: import("zod").ZodNumber;
+            events: import("zod").ZodNumber;
+            sessions: import("zod").ZodNumber;
+        }, import("zod/v4/core").$strip>;
+        agents: import("zod").ZodArray<import("zod").ZodObject<{
+            commands: import("zod").ZodNumber;
+            files: import("zod").ZodNumber;
+            commits: import("zod").ZodNumber;
+            agent: import("zod").ZodString;
+            sessions: import("zod").ZodNumber;
+        }, import("zod/v4/core").$strip>>;
+        sessions: import("zod").ZodArray<import("zod").ZodObject<{
+            commands: import("zod").ZodNumber;
+            files: import("zod").ZodNumber;
+            commits: import("zod").ZodNumber;
+            id: import("zod").ZodString;
+            agent: import("zod").ZodString;
+            project: import("zod").ZodString;
+            started: import("zod").ZodString;
+            ended: import("zod").ZodOptional<import("zod").ZodString>;
+            last: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        unlinked: import("zod").ZodObject<{
+            commands: import("zod").ZodNumber;
+            files: import("zod").ZodNumber;
+            commits: import("zod").ZodNumber;
+        }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>, "audit.list">;
+}, import("./audit/audit.def.js").AuditParams, "audit">, import("../kernel/define.js").ViewDef<{
     status: QueryDef<import("zod").ZodObject<{}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
         managed: import("zod").ZodBoolean;
         version: import("zod").ZodString;

package/dist/app/features/defs.js

@@ -9,6 +9,7 @@ import { changeDataFolder, containedOff, containedOn, containedStatus, moveStora
 import { hideWindow, sandboxStatus, sandboxView, showWindow, stopSandbox } from './sandbox/sandbox.def.js';
 import { addProject, allProjects, chooseProjects, excludeProject, includeProject, listProjects, projectRoots, projectsView, removeProject, } from './projects/projects.def.js';
 import { listLogs, logsView, tailLog } from './logs/logs.def.js';
+import { auditView, listAudit } from './audit/audit.def.js';
 import { listSessions, restartSessions, sessionsView } from './sessions/sessions.def.js';
 import { vpnLogin, vpnLogout, vpnStatus, vpnView } from './vpn/vpn.def.js';
 import { githubLogin, githubLogout, githubStatus, githubView } from './github/github.def.js';
@@ -80,6 +81,7 @@ export const QUERIES = [
     containedStatus,
     listLogs,
     tailLog,
+    listAudit,
     updatesStatus,
     engineStatus,
     checkEngine,
@@ -100,6 +102,7 @@ export const VIEWS = [
     dataView,
     storageView,
     logsView,
+    auditView,
     updatesView,
     engineView,
     webView,
@@ -134,6 +137,7 @@ export function embeddingOf(nav, view) {
 export const NAV = [
     { label: 'Agents', view: 'agents' },
     { label: 'Sessions', view: 'sessions' },
+    { label: 'Activity', view: 'audit' },
     {
         label: 'Sandbox',
         children: [

package/dist/app/features/projects/projects.def.js

@@ -115,7 +115,7 @@ function projectItem(p) {
         icon: 'project',
         hint: p.running ?? (p.root ? 'in a root' : p.excluded ? 'excluded' : p.mappedAtStart ? 'mapped' : '-'),
         description: p.here ? 'This is the folder you started the menu in.' : undefined,
-        details: ['At start   ' + atStart(p), 'In sandbox ' + (p.running ?? '-')],
+        details: ['At start: ' + atStart(p), 'In the sandbox: ' + (p.running ?? 'not open')],
         cells: { here: p.here ? '*' : '', folder: p.folder, atStart: atStart(p), running: p.running ?? '-' },
         actions: [
             action(removeProject, { projectFolder: p.folder }, { key: 'f', verb: 'forget project', importance: 1 }),

package/dist/app/features/settings/settings.run.d.ts

@@ -45,6 +45,9 @@ export declare const getSettingRun: import("../../kernel/define.js").Implementat
     key: import("zod").ZodString;
     value: import("zod").ZodUnknown;
 }, import("zod/v4/core").$strip>, "settings.get">, import("../../../cli/commands/context.js").Context>;
+/** The file of a scope, and the setting a key names in it. */
+/** incoming with every *** that stands where saved has a text replaced by that saved text. Pure. */
+export declare function keepShownSecrets(saved: unknown, incoming: unknown): unknown;
 export declare const setSettingRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").OperationDef<import("zod").ZodObject<{
     scope: import("zod").ZodDefault<import("zod").ZodEnum<{
         project: "project";

package/dist/app/features/settings/settings.run.js

@@ -4,7 +4,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import _ from 'lodash';
 import { loadConfig } from '../../../core/config/index.js';
-import { redactSecrets } from '../../../core/schema/index.js';
+import { REDACTED, redactSecrets } from '../../../core/schema/index.js';
 import { fail, safeText, writeJson } from '../../../core/util/index.js';
 import { hereDir } from '../../../cli/commands/projects/here.js';
 import { implement } from '../../context.js';
@@ -50,6 +50,18 @@ export const getSettingRun = implement(getSetting, (ctx, input) => {
     return { key: input.key, value: _.get(redactSecrets(file.userConfig()), key) };
 });
 /** The file of a scope, and the setting a key names in it. */
+/** incoming with every *** that stands where saved has a text replaced by that saved text. Pure. */
+export function keepShownSecrets(saved, incoming) {
+    if (incoming === REDACTED)
+        return typeof saved === 'string' ? saved : incoming;
+    if (Array.isArray(incoming))
+        return incoming.map((v, i) => keepShownSecrets(Array.isArray(saved) ? saved[i] : undefined, v));
+    if (incoming && typeof incoming === 'object') {
+        const from = saved && typeof saved === 'object' && !Array.isArray(saved) ? saved : {};
+        return Object.fromEntries(Object.entries(incoming).map(([k, v]) => [k, keepShownSecrets(from[k], v)]));
+    }
+    return incoming;
+}
 function target(ctx, scope, name) {
     const file = settingsFiles(ctx)[scope];
     return { ...findSetting(file, name), file };
@@ -58,7 +70,9 @@ export const setSettingRun = implement(setSetting, (ctx, input) => {
     const { key, node, file } = target(ctx, input.scope, input.key);
     if (node.isSection)
         fail('"' + input.key + '" is a group of settings.', 'Set one of them, e.g. ' + node.leaves(key)[0]?.key.join('.'));
-    const value = valueFor(node, input.value);
+    // A value that comes back with *** where a secret was shown (the web edits a whole map of secrets) keeps what is
+    // saved there: *** is how secrets are shown, never a value to save.
+    const value = keepShownSecrets(file.valueInFile(key), valueFor(node, input.value));
     const problem = node.check(value);
     if (problem !== true) {
         const typed = typeof input.value === 'string' ? input.value : JSON.stringify(masked(key, input.value));

package/dist/app/features/updates/update-lines.d.ts

@@ -2,7 +2,7 @@ import type { Context } from '../../../cli/commands/context.js';
 import type { MigrateContext } from '../../../cli/services/index.js';
 import type { UpdateResult } from '../../../host/update/index.js';
 /** One sentence for what an update run did, and whether it counts as done (1: it failed, or is waiting by hand). */
-export declare function describeResult(result: UpdateResult | null, unattended: boolean): {
+export declare function describeResult(result: UpdateResult | null, _unattended: boolean): {
     line: string;
     code: number;
 };

package/dist/app/features/updates/update-lines.js

@@ -3,7 +3,8 @@
 import { userDir } from '../../../core/config/index.js';
 import { holdsData, oldDefaultRoot } from '../../../host/storage/index.js';
 /** One sentence for what an update run did, and whether it counts as done (1: it failed, or is waiting by hand). */
-export function describeResult(result, unattended) {
+// _unattended: kept for the callers; every result now reads the same whether a person or the schedule ran it.
+export function describeResult(result, _unattended) {
     if (!result)
         return { line: 'Another update is running right now.', code: 0 };
     if (result.kind === 'installed')
@@ -12,7 +13,7 @@ export function describeResult(result, unattended) {
                 (result.previous ? 'from ' + result.previous + ' ' : '') +
                 'to ' +
                 result.version +
-                '. Open a new terminal to use it.',
+                '. New commands use it (open a new terminal); a running sandbox keeps the version it started with until it restarts.',
             code: 0,
         };
     if (result.kind === 'failed')
@@ -34,11 +35,6 @@ export function describeResult(result, unattended) {
     switch (result.reason) {
         case 'up-to-date':
             return { line: 'You have the newest version (' + result.current + ').', code: 0 };
-        case 'sandbox-running':
-            return {
-                line: 'A Windows Sandbox is running, so nothing was installed. Close it (sandbox stop), then update again.',
-                code: unattended ? 0 : 1,
-            };
         case 'failed-before':
             return {
                 line: 'The newest version failed to install before. It is not tried again until a newer one is released.',

package/dist/app/features/updates/updates.def.js

@@ -137,7 +137,7 @@ export function updatesPage(s, latest) {
                         tone: s.autoUpdate ? 'ok' : 'muted',
                         description: machine
                             ? 'For everyone: needs an admin terminal.'
-                            : 'A new version installs when no sandbox runs.',
+                            : 'A new version installs once a day, even while a sandbox runs (it keeps its version until it restarts).',
                         keys: 'Enter switches them.',
                         primary: action(runUpdate, { auto: nextAuto }, {
                             label: 'Automatic updates ' + nextAuto,

package/dist/app/kernel/define.d.ts

@@ -103,6 +103,15 @@ export interface ViewTabs<P> {
         readonly label: string;
     }[];
 }
+/**
+ * A filter of a view: one parameter picked from fixed values (the audit's kind and period). The web shows a small
+ * choice per filter above the page (changing one keeps the view's other parameters); the command line has the query's
+ * flags for the same thing, and the menu shows the first value. The first value is the default.
+ */
+export interface ViewFilter<P> extends ViewTabs<P> {
+    /** What the choice is about ("Period"), for its label. */
+    readonly label: string;
+}
 export interface ViewDef<Q extends QueryMap = QueryMap, P = Record<string, never>, Id extends string = string> {
     readonly kind: 'view';
     readonly id: Id;
@@ -115,7 +124,9 @@ export interface ViewDef<Q extends QueryMap = QueryMap, P = Record<string, never
     readonly pickers?: readonly QueryDef[];
     /** A parameter switched with tabs above the page (Settings: all projects or this project), first choice default. */
     readonly tabs?: ViewTabs<P>;
-    /** Parameters taken from the address as they are (the log shown), besides the tabs' one. */
+    /** Parameters picked from fixed values above the page (the audit's kind and period), first value default. */
+    readonly filters?: readonly ViewFilter<P>[];
+    /** Parameters taken from the address as they are (the log shown), besides the tabs' and filters' ones. */
     readonly params?: readonly (keyof P & string)[];
     /** The input of each query for these view parameters (default: each query's defaults). */
     inputs?(params: P): ViewInputs<Q>;

package/dist/app/registry.js

@@ -9,6 +9,7 @@ import { addProjectRun, allProjectsRun, chooseProjectsRun, excludeProjectRun, in
 import { checkHealthRun, enableSandboxRun, lastHealthRun, repairHealthRun } from './features/health/index.js';
 import { hideWindowRun, sandboxStatusRun, showWindowRun, stopSandboxRun } from './features/sandbox/index.js';
 import { listLogsRun, tailLogRun } from './features/logs/index.js';
+import { listAuditRun } from './features/audit/index.js';
 import { listSessionsRun, restartSessionsRun } from './features/sessions/index.js';
 import { exportConfigRun, getSettingRun, importConfigRun, listSettingsRun, resetSettingRun, setSettingRun, } from './features/settings/index.js';
 import { migrateSettingsRun, runUpdateRun, updatesStatusRun } from './features/updates/index.js';
@@ -69,6 +70,7 @@ export const IMPLEMENTATIONS = [
     containedOffRun,
     listLogsRun,
     tailLogRun,
+    listAuditRun,
     runUpdateRun,
     migrateSettingsRun,
     updatesStatusRun,

package/dist/cli/args.d.ts

@@ -42,9 +42,6 @@ export interface CliOptions {
     all: boolean;
     /** launch --session <agent>@<folder> (repeatable): several sessions at once, folders made absolute. */
     sessions: SessionWant[];
-    /** audit: only events of this kind, and containing this text. */
-    kind?: string;
-    grep?: string;
     /** migrate --dry-run, and --restore <backup folder>. */
     dryRun: boolean;
     /** doctor --fix: repair what it finds without asking. */

package/dist/cli/args.js

@@ -217,11 +217,10 @@ export function parseCli(argv, wrapper = false) {
         keepOld: Boolean(o.keepOld),
         withPaths: Boolean(o.withPaths),
         all: Boolean(o.all),
-        sessions: (o.session ?? []).map((s) => parseSessionWant(s)),
+        // launch --session is repeatable (a list); `audit --session <id>` is one id, which its definition reads.
+        sessions: (Array.isArray(o.session) ? o.session : []).map((s) => parseSessionWant(s)),
         timeout: o.timeout ?? 600,
-        days: o.days ?? (name === 'audit' ? 1 : 7),
-        kind: o.kind,
-        grep: o.grep,
+        days: o.days ?? 7,
         dryRun: Boolean(o.dryRun),
         fix: Boolean(o.fix),
         auto: o.auto === true,

package/dist/cli/commands/index.d.ts

@@ -6,6 +6,6 @@ export { repairCommand } from './repair/index.js';
 export { contextOrDefaults } from './context.js';
 export { attach, db, exec } from './sessions/index.js';
 export { resume } from './resume.js';
-export { audit, claudeHost, config, doctor, hostCommand, logs, migrateBeforeCommand, sync, updatesBeforeCommand, watcher, } from './maintenance/index.js';
+export { claudeHost, config, doctor, hostCommand, logs, migrateBeforeCommand, sync, updatesBeforeCommand, watcher, } from './maintenance/index.js';
 export { agentCommandsCommand, syncAgentCommands } from './agent-commands.js';
 export { HANDLERS, type Handler } from './registry.js';

package/dist/cli/commands/index.js

@@ -6,6 +6,6 @@ export { repairCommand } from './repair/index.js';
 export { contextOrDefaults } from './context.js';
 export { attach, db, exec } from './sessions/index.js';
 export { resume } from './resume.js';
-export { audit, claudeHost, config, doctor, hostCommand, logs, migrateBeforeCommand, sync, updatesBeforeCommand, watcher, } from './maintenance/index.js';
+export { claudeHost, config, doctor, hostCommand, logs, migrateBeforeCommand, sync, updatesBeforeCommand, watcher, } from './maintenance/index.js';
 export { agentCommandsCommand, syncAgentCommands } from './agent-commands.js';
 export { HANDLERS } from './registry.js';

package/dist/cli/commands/launch/prepare.js

@@ -7,7 +7,7 @@ import { RepoGuardStore, readDataSize, saveMarkedProjects } from '../../../host/
 import { ensureConpty, ensureTerminal } from '../../../host/tools/index.js';
 import { planView, viewSkipped, saveActiveViews, WorkspaceView } from '../../../host/workspace-view/index.js';
 import { saveForwards } from '../../../host/network/index.js';
-import { saveAuditSettings } from '../../../host/audit/collect.js';
+import { saveAuditSettings } from '../../../host/audit/index.js';
 import { humanBytes } from '../../../core/disk.js';
 import { syncBeforeLaunch, watcherRunning } from '../../../sync/index.js';
 import { errMsg } from '../../../core/util/index.js';

package/dist/cli/commands/maintenance/index.d.ts

@@ -4,6 +4,5 @@ export * from './config.js';
 export * from './doctor.js';
 export * from './host-claude.js';
 export * from './watch.js';
-export * from './audit.js';
 export * from './migrate.js';
 export * from './update.js';

package/dist/cli/commands/maintenance/index.js

@@ -5,6 +5,5 @@ export * from './config.js';
 export * from './doctor.js';
 export * from './host-claude.js';
 export * from './watch.js';
-export * from './audit.js';
 export * from './migrate.js';
 export * from './update.js';