windows-development-sandbox 1.13.0 → 1.13.2

package/dist/cli/validate.js

@@ -4,7 +4,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { DATABASES } from '../core/detect/index.js';
 import { fail } from '../core/util/index.js';
-import { AccountStore } from '../host/profile/index.js';
+import { AccountsService } from './services/accounts-service.js';
 /** Edit distance, for "did you mean". */
 export function distance(a, b) {
     let row = Array.from({ length: b.length + 1 }, (_, i) => i);
@@ -79,11 +79,15 @@ export function validateOptions(ctx) {
             unknownValue('database', db, DATABASES, 'Repeat --database for several.');
     }
     if (o.account !== undefined) {
-        const names = new AccountStore(ctx.storageRoot).list(ctx.dataPath).map((a) => a.name);
+        // The launched agent's saved logins (an agent that keeps none says so).
+        const agent = o.harness ?? ctx.loaded.config.defaultHarness;
+        const names = new AccountsService(ctx).list(agent).map((a) => a.name);
         if (!names.includes(o.account))
             unknownValue('account', o.account, names, names.length
-                ? 'See them with: sandbox account list'
-                : 'None saved yet: sign in inside the sandbox, then run sandbox account save <name>.');
+                ? 'See them with: sandbox account list' + (agent === 'claude' ? '' : ' --agent ' + agent)
+                : 'None saved yet: sign in inside the sandbox, then run sandbox account save <name>' +
+                    (agent === 'claude' ? '' : ' --agent ' + agent) +
+                    '.');
     }
     for (const s of o.sessions) {
         checkHarness(s.harness, harnesses);

package/dist/core/package-info.js

@@ -1,5 +1,5 @@
 // Where this package is installed and its version. This file is dist/core/package-info.js, two folders below
-// package.json.
+// package.json, or bundled into a chunk in dist/bin (scripts/bundle.mjs), also two folders below.
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { z } from 'zod';

package/dist/host/sandbox/platform.d.ts

@@ -7,6 +7,8 @@ export declare function insideSandbox(): boolean;
 export declare const GUEST_DATA_DIR = "C:\\AgentData";
 /** Whether a Windows Sandbox program is in this process list (tasklist /NH /FO CSV output). */
 export declare function sandboxInTasklist(tasklist: string): boolean;
+/** The process ids of the Windows Sandbox programs in this process list (tasklist /NH /FO CSV output). */
+export declare function sandboxPids(tasklist: string): number[];
 export declare function isSandboxRunning(): boolean;
 export declare function sandboxFeatureInstalled(): boolean;
 /** `owner`: whose sandbox runs, when the caller knows (host/sharing); it makes the message say who started it. */

package/dist/host/sandbox/platform.js

@@ -10,15 +10,19 @@ import { launchBlocked } from '../sharing/rules.js';
 const HELPER_TIMEOUT_MS = 15000;
 const START_WAIT_MS = 20000;
 const SANDBOX_PROCESSES = ['WindowsSandboxClient.exe', 'WindowsSandboxRemoteSession.exe', 'WindowsSandbox.exe'];
+/** Whether the launch and data folders are mapped in (looked for once; see insideSandbox). */
+let mappedIn;
 /**
  * Running INSIDE a Windows Sandbox this tool started (its launch folder and data folder are mapped in): then the CLI
  * talks to the sandbox it is in, through C:\\AgentData and loopback, instead of looking for one on a PC.
  */
 export function insideSandbox() {
-    return (isWin &&
-        !process.env.AGENT_SANDBOX_HOST_ONLY &&
-        fs.existsSync('C:\\AgentLaunch\\session.json') &&
-        fs.existsSync('C:\\AgentData\\run'));
+    if (!isWin || process.env.AGENT_SANDBOX_HOST_ONLY)
+        return false;
+    // The launch folder and the data folder are mapped in for the sandbox's whole life (and never exist on a PC), so
+    // they are looked for once: the menu asks this many times a second.
+    mappedIn ??= fs.existsSync('C:\\AgentLaunch\\session.json') && fs.existsSync('C:\\AgentData\\run');
+    return mappedIn;
 }
 export const GUEST_DATA_DIR = 'C:\\AgentData';
 /** Whether a Windows Sandbox program is in this process list (tasklist /NH /FO CSV output). */
@@ -26,6 +30,17 @@ export function sandboxInTasklist(tasklist) {
     const out = tasklist.toLowerCase();
     return SANDBOX_PROCESSES.some((image) => out.includes('"' + image.toLowerCase() + '"'));
 }
+/** The process ids of the Windows Sandbox programs in this process list (tasklist /NH /FO CSV output). */
+export function sandboxPids(tasklist) {
+    const images = new Set(SANDBOX_PROCESSES.map((image) => image.toLowerCase()));
+    const pids = [];
+    for (const line of tasklist.split('\n')) {
+        const row = /^"([^"]{1,260})","(\d{1,10})"/.exec(line);
+        if (row && images.has(row[1].toLowerCase()))
+            pids.push(Number(row[2]));
+    }
+    return pids;
+}
 export function isSandboxRunning() {
     if (!isWin)
         return false;

package/dist/host/storage/contained/state.d.ts

@@ -83,7 +83,8 @@ export declare class StateFile {
 export declare function mountedSets(storageRoot: string): string[];
 /**
  * A line for the start of a command when the record says an image is mounted that no running process holds and no
- * sandbox uses (nothing is looked up on the disk: this is only the record), or null.
+ * sandbox uses (nothing is looked up on the disk: this is only the record), or null. `sandboxRunning` can be a
+ * function: it is only asked (it runs tasklist) when the record says an image is mounted.
  */
-export declare function staleMountNote(storageRoot: string, set: string, sandboxRunning: boolean, alive?: (pid: number) => boolean): string | null;
+export declare function staleMountNote(storageRoot: string, set: string, sandboxRunning: boolean | (() => boolean), alive?: (pid: number) => boolean): string | null;
 export {};

package/dist/host/storage/contained/state.js

@@ -155,12 +155,15 @@ export function mountedSets(storageRoot) {
 }
 /**
  * A line for the start of a command when the record says an image is mounted that no running process holds and no
- * sandbox uses (nothing is looked up on the disk: this is only the record), or null.
+ * sandbox uses (nothing is looked up on the disk: this is only the record), or null. `sandboxRunning` can be a
+ * function: it is only asked (it runs tasklist) when the record says an image is mounted.
  */
 export function staleMountNote(storageRoot, set, sandboxRunning, alive = processAlive) {
     const record = setStateOf(new JsonFile(ContainedStateSchema, path.join(path.resolve(storageRoot), 'mounts', 'state.json')).read() ??
         EMPTY_STATE, set);
-    if (!record.mounted || sandboxRunning || record.holders.some((h) => alive(h.pid)))
+    if (!record.mounted || record.holders.some((h) => alive(h.pid)))
+        return null;
+    if (typeof sandboxRunning === 'function' ? sandboxRunning() : sandboxRunning)
         return null;
     return 'Contained storage is still mounted from an earlier sandbox. Run sandbox repair to dismount it (Windows asks for permission).';
 }

package/dist/selftest/layout.test.js

@@ -1,6 +1,7 @@
 // The architecture rules, checked on the compiled output (dist/**/*.js): which areas may import which, the guest's
 // portable core, the pure guest files the host and tests may load without the guest runtime's side effects, and no
-// import cycles. The bundled dist/runtime is left out (it has no imports).
+// import cycles. The bundled dist/runtime is left out (it has no imports); the bundled commands (dist/bin) must import
+// only their own chunks.
 import fs from 'node:fs';
 import path from 'node:path';
 const STATIC = /^\s*(?:import|export)\b[^;]*?\bfrom\s*(['"])([^'"\n]+)\1;?\s*$|^\s*import\s*(['"])([^'"\n]+)\3;?\s*$/gm;
@@ -149,5 +150,13 @@ export const layoutSuite = {
             .filter((d) => area(d) === 'app' && !(area(f) === 'host' && d.startsWith('app/kernel/')))
             .map((d) => f + ' -> ' + d));
         t.check(!intoApp.length, 'below the CLI only host code uses the shared core, and only its kernel', list(intoApp));
+        t.section('the commands');
+        // Loading the CLI as hundreds of modules took most of a second before anything was shown (scripts/bundle.mjs).
+        const bins = files.filter((f) => area(f) === 'bin');
+        const unbundled = bins.flatMap((f) => modules
+            .get(f)
+            .statics.filter((d) => area(d) !== 'bin')
+            .map((d) => f + ' -> ' + d));
+        t.check(bins.includes('bin/sandbox.js') && bins.some((f) => f.startsWith('bin/chunk-')) && !unbundled.length, 'the commands (dist/bin) are bundled: they load no compiled module one by one', list(unbundled));
     },
 };

package/dist/selftest/menu-perf.test.js

@@ -1,16 +1,21 @@
-// The menu stays quick: no key or draw waits for a child process (tasklist is faked and counted), a slow tab load shows
-// "Loading…" instead of holding up the keys, a held key is drawn once, and the terminal writes only the rows that
-// changed (the screen after the diffs is the same as a full draw, also after a resize).
+// The menu stays quick: no key or draw waits for a child process (tasklist is faked and counted), the first screen does
+// not wait for the process list, a slow tab load shows "Loading…" instead of holding up the keys, a section seen before
+// shows at once, a held key is drawn once, Esc is a key at once, an idle menu writes nothing, and the terminal writes
+// only the rows that changed (the screen after the diffs is the same as a full draw, also after a resize). The process
+// list is fetched only when it may have changed, and the settings file is read once for a whole list.
+import fs from 'node:fs';
 import { EventEmitter } from 'node:events';
 import { PassThrough } from 'node:stream';
+import { ConfigFile } from '../app/features/settings/index.js';
 import { DEFAULTS } from '../core/config/index.js';
 import { sleep } from '../core/util/index.js';
 import { Menu } from '../cli/menu/menu.js';
-import { LiveStatus } from '../cli/menu/live.js';
+import { LiveStatus, listGap } from '../cli/menu/live.js';
 import { ListPage } from '../cli/menu/pages/list-page.js';
 import { App, Text, Terminal } from '../cli/tui/index.js';
-import { supportsSyncUpdate } from '../cli/tui/terminal.js';
-import { isSandboxRunning, useTasklistCache, useTasklistRunners } from '../host/sandbox/index.js';
+import { ESCAPE_TIMEOUT_MS, supportsSyncUpdate } from '../cli/tui/terminal.js';
+import { isSandboxRunning, readTasklist, sandboxPids, useTasklistCache, useTasklistRunners, } from '../host/sandbox/index.js';
+import { staleMountNote } from '../host/storage/index.js';
 const TASKLIST = [
     '"System Idle Process","0","Services","0","8 K"',
     '"WindowsSandboxClient.exe","4242","Console","1","9,000 K"',
@@ -124,6 +129,26 @@ export const menuPerfSuite = {
             app.close();
             t.check(result === 'bye' && handled === 31 && renders < 10, 'keys that are already waiting are handled first and drawn once, not once each', 'handled ' + handled + ', drawn ' + renders);
         }
+        t.section('Esc is a key at once');
+        {
+            const tty = new FakeTty();
+            const term = tty.terminal();
+            term.start();
+            const times = [];
+            for (let i = 0; i < 3; i++) {
+                const at = Date.now();
+                tty.type('\x1b');
+                const key = await term.key();
+                times.push(Date.now() - at);
+                if (key.name !== 'escape')
+                    times.push(9999);
+            }
+            tty.type('\x1b[B');
+            const arrow = await term.key();
+            term.stop();
+            t.check(Math.max(...times) < 250 && ESCAPE_TIMEOUT_MS <= 50, 'Esc arrives in ' + times.join(', ') + ' ms (Node waits 500 ms for the rest of a sequence by default)', times.join(', '));
+            t.check(arrow.name === 'down', 'an arrow key is still one key, not Esc and letters');
+        }
         t.section('a slow load does not hold up the keys');
         {
             const tty = new FakeTty();
@@ -131,9 +156,10 @@ export const menuPerfSuite = {
             class Slow extends ListPage {
                 label = 'Slow';
                 rows = [];
+                next = ['alpha', 'beta'];
                 async load() {
                     await sleep(500);
-                    this.rows = ['alpha', 'beta'];
+                    this.rows = this.next;
                 }
                 options() {
                     return { path: [], items: this.rows.map((r) => ({ value: r, label: r })) };
@@ -150,6 +176,14 @@ export const menuPerfSuite = {
             t.check(waited < 400 && page.loading && text().includes('Loading'), 'the tab opens at once and says Loading… while the data comes', 'waited ' + waited + ' ms');
             const arrived = await t.waitFor(() => (text().includes('beta') ? true : null), 5000, 20);
             t.check(arrived === true && !page.loading, 'the list is built when the data arrives');
+            // Back on the section later: what it had shows at once, the fresh data replaces it when it is there.
+            page.next = ['alpha', 'gamma'];
+            const again = Date.now();
+            await page.show();
+            const shownIn = Date.now() - again;
+            t.check(shownIn < 100 && text().includes('beta'), 'a section seen before shows its last data at once (in ' + shownIn + ' ms), not Loading…', text());
+            const fresh = await t.waitFor(() => (text().includes('gamma') ? true : null), 5000, 20);
+            t.check(fresh === true && !text().includes('beta'), 'and its fresh data when it has loaded');
         }
         t.section('no child process on a key or a draw');
         const saved = { hostOnly: process.env.AGENT_SANDBOX_HOST_ONLY };
@@ -177,24 +211,34 @@ export const menuPerfSuite = {
                     return TASKLIST;
                 },
                 refreshMs: 100,
+                // The sandbox's process is gone at every look: the list is fetched again on every tick.
+                processAlive: () => false,
             });
+            const startedAt = Date.now();
             const done = menu.start();
-            const shown = await t.waitFor(() => tty.writes.length > 0, 20000, 20);
+            const shown = await t.waitFor(() => tty.writes.length > 0, 20000, 5);
+            const firstPaint = Date.now() - startedAt;
             t.check(shown === true, 'the menu draws its first screen');
+            t.check(firstPaint < 1000, 'the first screen does not wait for a 1.5 second process list (drawn after ' + firstPaint + ' ms)');
             const slowest = { ms: 0, key: '' };
+            const took = [];
             const press = async (name, bytes) => {
                 const before = tty.writes.length;
                 const at = Date.now();
                 tty.type(bytes);
                 // Not every key changes the screen: give the ones that do a chance, and measure those.
-                await t.waitFor(() => tty.writes.length > before, 400, 5);
-                const took = Date.now() - at;
-                if (tty.writes.length > before && took > slowest.ms) {
-                    slowest.ms = took;
+                await t.waitFor(() => tty.writes.length > before, 400, 2);
+                const ms = Date.now() - at;
+                if (tty.writes.length > before)
+                    took.push(ms);
+                if (tty.writes.length > before && ms > slowest.ms) {
+                    slowest.ms = ms;
                     slowest.key = name;
                 }
                 await sleep(15);
             };
+            // The pages have their data (the first process list came after 1.5 s).
+            await sleep(1700);
             const syncBefore = calls.sync;
             for (const section of ['2', '3', '4', '5', '6', '7', '1'])
                 await press('section ' + section, section);
@@ -209,6 +253,21 @@ export const menuPerfSuite = {
                 ' ' +
                 slowest.ms +
                 ' ms)');
+            const median = [...took].sort((a, b) => a - b)[Math.floor(took.length / 2)] ?? 9999;
+            t.check(median < 100, 'a key is usually drawn at once (median ' + median + ' ms over ' + took.length + ' keys)');
+            // Left alone, the menu writes nothing: the process list keeps coming (every tick here), but nothing on the
+            // screen changes, so nothing is drawn.
+            await sleep(300);
+            const idleFrom = tty.writes.length;
+            const fetchesFrom = calls.async;
+            await sleep(3000);
+            const idleWrites = tty.writes.slice(idleFrom);
+            const idleBytes = idleWrites.join('').length;
+            t.check(idleWrites.length <= 1 && idleBytes < 4000 && calls.async > fetchesFrom, 'an idle menu writes nothing for 3 s (' +
+                idleWrites.length +
+                ' writes, ' +
+                idleBytes +
+                ' bytes) while the process list is looked at in the background', Text.strip(idleWrites.join('')).slice(0, 300));
             tty.type(KEYS.ctrlC);
             const code = await Promise.race([done, sleep(5000).then(() => -1)]);
             t.check(code === 130, 'Ctrl+C leaves the menu');
@@ -244,5 +303,132 @@ export const menuPerfSuite = {
             await sleep(80);
             t.check(live.line() === 'status b' && changes === 2, 'a stopped status looks at nothing');
         }
+        t.section('the process list is fetched only when it may have changed');
+        {
+            t.equal([0, 1, 2, 3, 4, 10, -1].map((n) => listGap(n, 2500, 30000)), [2500, 5000, 10000, 20000, 30000, 30000, 2500], 'while nothing changes, the gap between two lists doubles up to the longest');
+            t.equal(sandboxPids(TASKLIST + '\r\n"WindowsSandbox.exe","77","Console","1","5 K"'), [4242, 77], 'the ids of the sandbox programs are read from the list');
+            // A sandbox runs: its programs are checked by id, and the list is fetched again only when one has ended.
+            let fetches = 0;
+            let derived = 0;
+            let alive = true;
+            const running = new LiveStatus({
+                fetch: () => {
+                    fetches++;
+                    return Promise.resolve(TASKLIST);
+                },
+                derive: () => String(++derived),
+                onChange: () => undefined,
+                intervalMs: 20,
+                alive: () => alive,
+                needsList: () => true,
+            });
+            await running.start();
+            await sleep(400);
+            t.check(fetches === 1 && derived > 5, 'while the sandbox runs, its programs are checked by id: no new list (' +
+                fetches +
+                ' fetched), the line is still derived (' +
+                derived +
+                ' times)');
+            alive = false;
+            const refetched = await t.waitFor(() => fetches > 1, 3000, 10);
+            running.stop();
+            t.check(refetched === true, 'when one of them has ended, the list is fetched again');
+            // None runs: fewer and fewer lists, one at once after a key press or when the data folder changes.
+            fetches = 0;
+            let signal = 'a';
+            const idle = new LiveStatus({
+                fetch: () => {
+                    fetches++;
+                    return Promise.resolve('"System Idle Process","0","Services","0","8 K"');
+                },
+                derive: () => 'none',
+                onChange: () => undefined,
+                intervalMs: 20,
+                idleMaxMs: 100000,
+                needsList: () => true,
+                signal: () => signal,
+            });
+            await idle.start();
+            await sleep(1000);
+            const quiet = fetches;
+            t.check(quiet >= 2 && quiet <= 8, 'with nothing running, a second of 20 ms ticks fetched the list ' + quiet + ' times (not 50)');
+            signal = 'b';
+            const onSignal = await t.waitFor(() => fetches > quiet, 1000, 5);
+            t.check(onSignal === true, 'a change in the data folder fetches the list at once');
+            await sleep(100);
+            const beforeKey = fetches;
+            idle.touch();
+            const onKey = await t.waitFor(() => fetches > beforeKey, 1000, 5);
+            idle.stop();
+            t.check(onKey === true, 'so does a key press (someone is looking)');
+            // Inside a sandbox the list is never needed: nothing runs tasklist, not even a question asked meanwhile.
+            fetches = 0;
+            let syncRuns = 0;
+            useTasklistRunners({
+                sync: () => {
+                    syncRuns++;
+                    return '';
+                },
+                async: () => Promise.resolve(''),
+            });
+            try {
+                const inside = new LiveStatus({
+                    fetch: () => {
+                        fetches++;
+                        return Promise.resolve('');
+                    },
+                    derive: () => 'inside',
+                    onChange: () => undefined,
+                    intervalMs: 20,
+                    needsList: () => false,
+                });
+                await inside.start();
+                await sleep(200);
+                const list = readTasklist();
+                inside.stop();
+                t.check(fetches === 0 && syncRuns === 0 && list === '', 'when the list is not needed, it is never fetched and nothing asks tasklist meanwhile');
+            }
+            finally {
+                useTasklistRunners();
+            }
+        }
+        t.section('nothing before the menu waits for tasklist');
+        {
+            let asked = 0;
+            const note = staleMountNote(t.dir('no-mounts'), 'main', () => {
+                asked++;
+                return false;
+            });
+            t.check(note === null && asked === 0, 'with no image mounted, "is a sandbox running?" is not even asked');
+        }
+        t.section('the settings file is read once for a whole list');
+        {
+            const file = t.write(t.at('settings', 'config.json'), JSON.stringify({ defaultHarness: 'codex', workspaceFilter: { exclude: ['a', 'b'] } }));
+            const config = new ConfigFile('user', file);
+            const reads = { count: 0 };
+            const original = fs.readFileSync;
+            const counting = ((...args) => {
+                if (String(args[0]) === file)
+                    reads.count++;
+                return original(...args);
+            });
+            fs.readFileSync = counting;
+            let first;
+            try {
+                first = Array.from({ length: 200 }, () => config.valueInFile(['defaultHarness']));
+            }
+            finally {
+                fs.readFileSync = original;
+            }
+            t.check(reads.count === 1 && first.every((v) => v === 'codex'), '200 values in one run read the file once (' + reads.count + ' reads)');
+            const exclude = ['workspaceFilter', 'exclude'];
+            config.valueInFile(exclude).push('c');
+            t.equal(config.valueInFile(exclude), ['a', 'b'], 'a value handed out is a copy (changing it changes nothing)');
+            fs.writeFileSync(file, JSON.stringify({ defaultHarness: 'gemini' }));
+            await Promise.resolve();
+            t.equal(config.valueInFile(['defaultHarness']), 'gemini', 'the next run reads the file again (a change outside)');
+            const result = config.set(['defaultHarness'], 'opencode');
+            t.equal([result, config.valueInFile(['defaultHarness'])], ['saved', 'opencode'], 'a save is seen at once');
+        }
     },
 };

package/dist/selftest/menu.test.js

@@ -725,6 +725,10 @@ export const menuSuite = {
             ['main', false, false],
             ['second', true, true],
         ], 'rename keeps the default and active marks');
+        const ensured = [service.ensure('codex', 'main'), service.activeName('codex'), fs.readFileSync(codexAuth, 'utf8')];
+        t.equal(ensured, ['main', 'main', '{"token":"A"}'], 'a launch with --account switches the sandbox to that login');
+        t.equal([service.ensure('codex', null), service.activeName('codex'), fs.readFileSync(codexAuth, 'utf8')], ['second', 'second', '{"token":"B2"}'], 'a launch without --account switches the sandbox back to the default login');
+        t.equal([service.ensure('claude', null), service.ensure('nobody', 'x')], [null, null], 'an agent with no saved login, or one that keeps no login: nothing to switch');
         await t.throws(() => service.save('x', false, 'nobody'), 'Unknown agent', 'an unknown agent: refused');
         await t.throws(() => service.save('bad name', false, 'codex'), 'Invalid account name', 'bad names are refused');
         t.section('every screen');

package/dist/web/index.html

@@ -6,7 +6,7 @@
     <title>Sandbox</title>
     <link rel="icon" href="data:," />
     <link rel="stylesheet" href="/main-UAQPI5XD.css" />
-    <script type="module" src="/main-Z2WYAE2Z.js"></script>
+    <script type="module" src="/main-NBQ3LF4E.js"></script>
   </head>
   <body>
     <div id="root"></div>