windows-development-sandbox 1.17.0 → 1.18.0

package/README.md

@@ -12,9 +12,10 @@
 
 </div>
 
-Run it in a project folder and you get a clean [Windows Sandbox](https://learn.microsoft.com/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview)
-where that folder is the workspace, the tools and databases the project needs install themselves, and nothing else
-on your PC is reachable. Close it and it's gone. Your project, tools, databases and logins are kept for next time.
+Run it in a project folder to get a clean
+[Windows Sandbox](https://learn.microsoft.com/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview).
+The folder is the workspace, the tools and databases it needs install themselves, and the rest of your PC is out of
+reach. Close it and it is gone. Your project, tools, databases and logins are kept for next time.
 
 ## Install
 
@@ -22,130 +23,129 @@ on your PC is reachable. Close it and it's gone. Your project, tools, databases
 irm https://github.com/JoshDiDuca/windows-development-sandbox/releases/latest/download/install.ps1 | iex
 ```
 
-It checks your PC, offers to turn on Windows Sandbox, and asks **1) Just me** or **2) Everyone on this PC** (needs
-admin). It brings its own private copy of Node.js; nothing else is installed system-wide, and no Start menu shortcut
-unless you ask for one. `sandbox update` installs newer versions (and can do it by itself), even while a sandbox runs:
-the sandbox keeps its version until it restarts. A version that fails to start is rolled back automatically, and
-`sandbox update --rollback` goes back one by hand.
+The installer checks your PC, offers to turn on Windows Sandbox, and asks **1) Just me** or **2) Everyone on this PC**
+(needs admin). It brings its own copy of Node.js and installs nothing else system-wide. It adds no Start menu shortcut
+unless you ask.
 
-Needs Windows 10/11 **Pro, Enterprise or Education**. Have Node.js 20+? `npm install -g windows-development-sandbox`
-works too. [Scopes, options (`-Version`, `-StartMenuShortcut` ...), upgrading, uninstall](docs/install.md)
+- `sandbox update` installs a newer version, and can do it by itself. A running sandbox keeps its version until it
+  restarts.
+- A new version that fails to start is rolled back for you. `sandbox update --rollback` goes back one version by hand.
+
+Needs Windows 10/11 **Pro, Enterprise or Education**. With Node.js 20+, `npm install -g windows-development-sandbox`
+works too. More: [install options, upgrading, uninstall](docs/install.md).
 
 ## Use
 
 ```powershell
 cd C:\code\my-app
 
-sandbox            # the menu: agents, sessions, apps, every setting, diagnostics ...
+sandbox            # the menu: agents, sessions, apps, settings, health ...
 sandbox claude     # Claude Code in a sandbox for this folder (or: claude-sandbox)
-sandbox claude -t  # ... in this terminal (Ctrl+] detaches, the session keeps running)
-sandbox start      # just the sandbox, no agent
+sandbox claude -t  # ... in this terminal (Ctrl+] detaches; the session keeps running)
+sandbox start      # the sandbox, no agent
 sandbox opencode   # any supported agent by name
 sandbox web open   # (Beta) the web UI in your browser, signed in
 ```
 
-The first start downloads what the project needs (a few minutes, once). After that, starts take seconds.
+The first start downloads what the project needs (a few minutes, once). Later starts take seconds.
 
-> `claude-sbx`, `codex-sbx`, `gemini-sbx` and `agent-sandbox` are the old command names. They still work for now; use
-> `sandbox <agent>` / `claude-sandbox` and `sandbox` instead.
+> The old names `claude-sbx`, `codex-sbx`, `gemini-sbx` and `agent-sandbox` still work for now. Use `sandbox <agent>`
+> (or `claude-sandbox`) and `sandbox` instead.
 
 ## What you get
 
-|  |  |
-|---|---|
-| **Safe by default** | The agent sees only your project folder. Credentials are stripped before anything is copied in, your LAN is blocked, and nothing the sandbox writes can run on your PC. |
-| **Languages** | Node, Python, Rust, C/C++ (GCC or MSVC), .NET (incl. .NET Framework targeting), Go, Java, Ruby, PHP, Deno, Bun, PowerShell 7, with pnpm, yarn, Volta, uv, pyenv, Maven, Gradle, Composer, gh ... |
-| **Apps and tools** | VS Code (set up for your languages, with their extensions) and Windows Terminal, plus 60 optional apps and tools by category: DBeaver, pgAdmin, Bruno, Godot, Blender, kubectl, jq, ripgrep ... and programs of your own. Agent add-ons too: rtk and Headroom (fewer tokens), ccusage, Playwright and Context7 MCP servers, claude-mem, REA. Playwright works out of the box with Edge |
-| **Databases** | PostgreSQL, MySQL, MongoDB, Redis and DynamoDB Local with a web UI, started when the project uses them, or any time with `--database` / `sandbox db` |
-| **Agents** | Claude Code, Codex, Gemini, opencode, Qwen, Crush, Copilot, Kilo, Amp, Cline, Continue, Kimi, Aider, DeepSeek agents |
-| **Smart** | Detects what the project needs from its files, respects version files, installs in parallel and reuses everything |
-| **Several projects** | `sandbox claude` from another project joins the running sandbox: its own folder, tools, versions, databases and environment, set up on demand. Start several agents at once (`--session claude@A --session codex@B`, or the menu) and attach to any of them from any terminal |
-| **Picks up where you left off** | After a crash or a restart, `sandbox resume` reopens the last sessions; `sandbox restart` restarts the agents in place and they continue their conversation |
-| **Leaves nothing behind** | When an agent's session ends, everything it started ends with it, background servers included. The web UI's server stops when no browser uses it, and nothing of this tool keeps running on your PC once the sandbox is closed |
-| **GitHub, safely** | Give sandboxes a fine-grained GitHub token you made for them (`sandbox github login`, `github.shareToken`): `gh` and `git push` work inside, and the token never lands in the sandbox's files |
-| **Feels like home** | Your desktop look, Claude settings, MCP servers and conversation history come along; history syncs back. Logins you save (`sandbox account`) are kept encrypted for your Windows user |
+|                           |                                                                                                                                                                                                                                                                                                                                                               |
+| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Safe by default**       | The agent sees only your project folder. Credentials are stripped before anything is copied in, your LAN is blocked, and nothing the sandbox writes can run on your PC.                                                                                                                                                                                       |
+| **Languages**             | Node, Python, Rust, C/C++ (GCC or MSVC), .NET (with .NET Framework targeting), Go, Java, Ruby, PHP, Deno, Bun, PowerShell 7, Unreal Engine tools. Also pnpm, yarn, Volta, uv, pyenv, Maven, Gradle, Composer, gh ...                                                                                                                                          |
+| **Apps and tools**        | VS Code (set up for your languages) and Windows Terminal, plus about 80 optional apps by category: DBeaver, pgAdmin, Bruno, Godot, Blender, Ghidra, kubectl, jq, ripgrep ... and your own programs. Agent add-ons: rtk and Headroom (fewer tokens), ccusage, Playwright and Context7 MCP servers, claude-mem, REA. Playwright works with Edge out of the box. |
+| **Databases**             | PostgreSQL, MySQL, MongoDB, Redis and DynamoDB Local (with a web UI). They start when the project uses them, or any time with `--database` or `sandbox db`.                                                                                                                                                                                                   |
+| **Agents**                | Claude Code, Codex, Gemini, opencode, Qwen, Crush, Copilot, Kilo, Amp, Cline, Continue, Kimi, Aider and two DeepSeek agents.                                                                                                                                                                                                                                  |
+| **Smart setup**           | Finds what the project needs from its files, follows its version files, installs in parallel and reuses everything.                                                                                                                                                                                                                                           |
+| **Several projects**      | `sandbox claude` from another project joins the running sandbox, with that project's own folder, tools, versions, databases and environment. Start several agents at once (`--session claude@A --session codex@B`, or the menu) and attach to any of them from any terminal.                                                                                  |
+| **Pick up again**         | After a crash or restart, `sandbox resume` reopens the last sessions. `sandbox restart` restarts the agents in place, and they continue their conversations.                                                                                                                                                                                                  |
+| **Leaves nothing behind** | When an agent's session ends, everything it started ends too, background servers included. Nothing of this tool keeps running on your PC once the sandbox is closed.                                                                                                                                                                                          |
+| **GitHub, safely**        | Give sandboxes a fine-grained GitHub token made just for them (`sandbox github login`, `github.shareToken`). `gh` and `git push` then work inside, and the token is never written to the sandbox's files.                                                                                                                                                     |
+| **Feels like home**       | Your desktop look, Claude settings, MCP servers and conversation history come along, and history syncs back. Saved logins (`sandbox account`) are encrypted for your Windows user.                                                                                                                                                                            |
 
 ## Built for heavy workloads
 
-The sandbox behaves like a well-run PC of its own size: under load it slows down, it does not fail, and it never takes
-your PC down with it. Nothing needs setting up.
-
-- **Sized to what your PC can hold.** The sandbox gets only the memory your PC can keep in RAM for it, with room kept
-  for your PC itself (and more with vGPU on).
-- **Builds within a budget.** Agents see the processors and memory they may really use, and every session gets a
-  matching number of build jobs and links, written to `run\budget.json` for agents to plan with.
-- **Graduated throttling.** As memory fills, a governor in the sandbox turns one dial in steps: build programs get
-  lower CPU and memory priority, then a smaller share of the CPU, then compilers take turns while the waiting ones move
-  to the paging file. Builds get slower; nothing is stopped or killed, and agents, shells and Windows are never touched.
-- **Your PC has a say.** A watchdog on your PC watches its memory, CPU and disks and asks the sandbox to ease off, at
-  once and all the way when your PC is nearly out of memory.
-- **A last resort that only protects.** Only at the very edge of the sandbox's own memory limit, where Windows inside
-  it would otherwise start failing, is a build refused memory so that the sandbox stays up.
-- **Answers after the fact.** `sandbox doctor` checks your paging file, and `sandbox logs --crash` explains a past
-  freeze or crash: the gap, blue screens, hardware and memory events, and whether vGPU was on.
-
-Details and settings: [troubleshooting](docs/troubleshooting.md#the-sandbox-closes-under-heavy-load) and
-[configuration](docs/configuration.md#cpu-ram-and-gpu).
+Under load the sandbox slows down instead of failing, and it never takes your PC down with it. Nothing needs setting
+up.
+
+- **Sized to fit.** The sandbox gets only the memory your PC can keep in RAM for it, with room left for your PC.
+- **A build budget.** Agents see the CPUs and memory they may really use. Each session gets a matching number of build
+  jobs, written to `run\budget.json` for agents to plan with.
+- **Slows down in steps.** As memory fills, build programs get lower priority, then less CPU, then compilers take
+  turns. Builds get slower, but nothing is killed, and agents, shells and Windows are never touched.
+- **Your PC has a say.** A watchdog on your PC asks the sandbox to ease off when your PC runs short of memory, CPU or
+  disk.
+- **A last resort.** Only at the very edge of the sandbox's memory limit is a build refused memory, so the sandbox
+  stays up.
+- **Answers afterwards.** `sandbox doctor` checks your paging file. `sandbox logs --crash` explains a past freeze or
+  crash.
+
+Details: [heavy load](docs/troubleshooting.md#the-sandbox-closes-under-heavy-load) and
+[CPU, RAM and GPU settings](docs/configuration.md#cpu-ram-and-gpu).
 
 ## Commands
 
-| Command | |
-|---|---|
-| `sandbox` | the menu, a full-screen app with a left navigation: start agents, attach to sessions, pick apps, edit every setting (yours and the project's), all commands, with search |
-| `sandbox <agent>`, `claude-sandbox` | start an agent; `-t` for this terminal, `--headless` for no window |
-| `sandbox start` | the sandbox without an agent |
-| `sandbox attach` / `sessions` / `status` | work with a running sandbox (this folder's project first) |
-| `sandbox shell` / `close <id>` | open PowerShell (or cmd) in a project as a session you can attach to; end a session |
-| `sandbox restart` / `resume` | restart the agents in place; reopen the last sessions |
-| `sandbox projects` | the projects a sandbox can open without a restart: roots, `all`, exclude |
-| `sandbox db [start\|stop <name>]` | list, start or stop databases (`sbx-db` inside) |
-| `sandbox exec -- <cmd>` | run a command inside |
-| `sandbox config get\|set\|reset\|list` | read and change any setting from the command line (`export` / `import` to share them) |
-| `sandbox account` | save, switch and rename agent logins |
-| `sandbox github` / `vpn` | the GitHub token for sandboxes; the VPN login and status |
-| `sandbox web` | (Beta) the web UI: start, stop, status, open |
-| `sandbox stop` / `hide` / `show` | shut down, hide or show the window |
-| `sandbox data` / `storage` | what's stored and how big, freeing space, moving the data folder |
-| `sandbox setup` / `doctor` / `repair` | check this PC, see what will be installed, fix common problems |
-| `sandbox engine` | the engines and what each can do on this PC; `engine clean` stops HCS systems left running |
-| `sandbox logs [-f] [--crash]` | the sandbox log, or the report of the last crash |
-| `sandbox update [--rollback]` / `--version` | update (or go back one version); the installed version |
-
-All commands and options: [docs/commands.md](docs/commands.md)
+| Command                                  |                                                                                   |
+| ---------------------------------------- | --------------------------------------------------------------------------------- |
+| `sandbox`                                | the menu: start agents, attach to sessions, pick apps, change any setting, search |
+| `sandbox <agent>`, `claude-sandbox`      | start an agent; `-t` for this terminal, `--headless` for no window                |
+| `sandbox start`                          | the sandbox without an agent                                                      |
+| `sandbox attach` / `sessions` / `status` | work with a running sandbox (this folder's project first)                         |
+| `sandbox shell` / `close <id>`           | open PowerShell or cmd in a project as a session; end a session                   |
+| `sandbox restart` / `resume`             | restart the agents in place; reopen the last sessions                             |
+| `sandbox projects`                       | which projects a sandbox can open without a restart                               |
+| `sandbox db [start\|stop <name>]`        | list, start or stop databases (`sbx-db` inside)                                   |
+| `sandbox exec -- <cmd>`                  | run a command inside                                                              |
+| `sandbox config get\|set\|reset\|list`   | read and change settings (`export` / `import` to share them)                      |
+| `sandbox account`                        | save, switch and rename agent logins and Claude API keys                          |
+| `sandbox github` / `vpn`                 | the GitHub token for sandboxes; the VPN login and status                          |
+| `sandbox web`                            | (Beta) the web UI: start, stop, status, open                                      |
+| `sandbox stop` / `hide` / `show`         | shut down; hide or show the window                                                |
+| `sandbox data` / `storage`               | what is stored and how big; free space; move the data folder                      |
+| `sandbox setup` / `doctor` / `repair`    | check this PC, see what will be installed, fix common problems                    |
+| `sandbox engine`                         | (Alpha) the engines and what each can do on this PC                               |
+| `sandbox logs [-f] [--crash]`            | the sandbox log, or the report of the last crash                                  |
+| `sandbox update [--rollback]`            | update, or go back one version (`--version` shows the installed one)              |
+
+Every command and option: [docs/commands.md](docs/commands.md).
 
 ## Beta and alpha features
 
-These are off until you turn them on, and one setting turns each off again. Windows Sandbox stays the default and
-keeps every feature it has.
+These are off until you turn them on, and one setting turns each off again. Windows Sandbox stays the default engine
+and keeps all its features.
 
-| Feature | Status | |
-|---|---|---|
-| **Web UI** (`sandbox web`, `web.enabled`) | Beta | Agents, sessions with live terminals, the sandbox's status, apps, accounts and every setting in your browser, with search (Ctrl+K) and a folder picker; on this PC only (loopback, signed in with a token). `web.openOnLaunch` opens it with every sandbox. [web-ui.md](docs/web-ui.md) |
-| **Agent commands** (`sandbox agent-commands on`) | Beta | Typing `claude`, `codex` ... in any folder starts it in a hidden sandbox and attaches your terminal |
-| **Contained storage** (`sandbox storage contained on`) | Beta | Tools, logins and logs in one disk image per data set, mounted only while a sandbox runs. One admin prompt per launch. [engines](docs/design/engines.md) |
-| **VPN** (`sandbox vpn`, `vpn.enabled`) | Alpha | The sandbox's traffic through NordVPN, your own OpenVPN profile or a WireGuard config, with a kill switch that is checked with a real connection. The first real try fixed the install and the kill switch; a tunnel carrying traffic is not confirmed yet: read [vpn.md](docs/vpn.md) first |
-| **HCS engine** (`sandbox.engine: hcs`, `sandbox engine`) | Alpha | Headless agents in a Hyper-V isolated Server Core container. `sandbox engine check hcs` shows what your PC lacks; starting it is not enabled yet. Its create, start and stop steps pass on GitHub's Windows Server 2022 and 2025 runners |
+| Feature                                                | Status | What it does                                                                                                                                                                                                    |
+| ------------------------------------------------------ | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Web UI** (`sandbox web`, `web.enabled`)              | Beta   | Agents, live terminals, status, apps, accounts and settings in your browser, with search (Ctrl+K). This PC only, signed in with a token; devices on your network if you allow them. [web-ui.md](docs/web-ui.md) |
+| **Agent commands** (`sandbox agent-commands on`)       | Beta   | Typing `claude`, `codex` ... in any folder starts that agent in a hidden sandbox and attaches your terminal.                                                                                                    |
+| **Contained storage** (`sandbox storage contained on`) | Beta   | Tools, logins and logs in one disk image, mounted only while a sandbox runs. One admin prompt per launch. [Details](docs/configuration.md#contained-storage-beta)                                               |
+| **VPN** (`sandbox vpn`, `vpn.enabled`)                 | Alpha  | The sandbox's traffic through NordVPN, your own OpenVPN profile or a WireGuard config, with a kill switch. A tunnel carrying traffic is not confirmed yet: read [vpn.md](docs/vpn.md) first.                    |
+| **HCS engine** (`sandbox.engine: hcs`)                 | Alpha  | Headless agents in a Hyper-V isolated Server Core container. `sandbox engine check hcs` shows what your PC lacks. Starting it is not enabled yet.                                                               |
 
 ## Known gaps
 
-- Adding a folder to a RUNNING sandbox needs Windows 11 24H2+ with the updated Windows Sandbox (`wsb share`,
-  untested). On older Windows, folders inside a project root open at once and anything else offers a restart.
-  [Details, and how to get `wsb`](docs/projects.md#adding-folders-to-a-running-sandbox-wsb-share). A way for older
-  Windows through HCS is designed and waiting for a test on a real PC ([design](docs/design/hcs-live-folders.md)).
-- Windows Sandbox runs one sandbox at a time per PC; every project and agent shares it.
+- Adding a folder to a **running** sandbox needs Windows 11 24H2+ with the updated Windows Sandbox (`wsb share`,
+  untested). On older Windows, folders inside a project root open at once, and anything else offers a restart.
+  [Details](docs/projects.md#adding-a-project-to-a-running-sandbox).
+- Windows Sandbox runs one sandbox per PC. Every project and agent shares it.
 - What is planned next: [roadmap](docs/roadmap.md).
 
 ## Documentation
 
-All docs, with one line each: [docs/README.md](docs/README.md). The main ones:
+All docs, one line each: [docs/README.md](docs/README.md). The main ones:
 
-- [Install](docs/install.md): requirements, other ways to install, upgrading, rolling back
-- [Commands](docs/commands.md): every command and option, the menu, sessions and attaching
-- [Tools and databases](docs/toolchains.md): languages, package managers, databases, agents, what is tested
+- [Install](docs/install.md): requirements, other ways to install, updating, uninstalling
+- [Commands](docs/commands.md): every command and option, the menu, sessions
+- [Tools and databases](docs/toolchains.md): languages, apps, databases, agents
 - [Configuration](docs/configuration.md): settings, project files, paths, accounts, hooks
-- [Several projects](docs/projects.md): project roots, adding a project to a running sandbox, what each agent can see
+- [Several projects](docs/projects.md): project roots, joining a running sandbox, what each agent can see
 - [Security](docs/security.md): how your PC is protected, secrets, git access
 - [Web UI](docs/web-ui.md) (Beta) and [VPN](docs/vpn.md) (Alpha)
-- [Troubleshooting](docs/troubleshooting.md): common problems, freezes and crash reports
-- [Changelog](CHANGELOG.md) and [roadmap](docs/roadmap.md): what shipped, what is next
+- [Troubleshooting](docs/troubleshooting.md): common problems, heavy load, crash reports
+- [Changelog](CHANGELOG.md) and [roadmap](docs/roadmap.md)
 - [Development](docs/development.md): building, testing, releasing (code layout in [CLAUDE.md](CLAUDE.md))

package/config.example.json

@@ -68,6 +68,38 @@
   "github": {
     "shareToken": false
   },
+  "accounts": {
+    "epic": {
+      "share": false
+    },
+    "steam": {
+      "share": false
+    },
+    "unity": {
+      "share": false
+    },
+    "cfx": {
+      "share": false
+    },
+    "keystore": {
+      "share": false
+    },
+    "play": {
+      "share": false
+    },
+    "expo": {
+      "share": false
+    },
+    "appstore": {
+      "share": false
+    }
+  },
+  "pcInstalls": {
+    "steamGames": false,
+    "epicGames": false,
+    "unrealEngines": false,
+    "unityEditors": false
+  },
   "provisioning": {
     "copyFromHost": true,
     "fallbackToInstall": true,
@@ -122,7 +154,65 @@
       "enabled": "auto",
       "acceptLicense": false,
       "components": [],
-      "keepInstallFiles": true
+      "keepInstallFiles": true,
+      "persistEngines": true,
+      "derivedDataCache": "persisted"
+    },
+    "unity": {
+      "enabled": "auto",
+      "acceptLicense": false,
+      "version": "project",
+      "modules": [],
+      "hub": false,
+      "keepVersions": 2
+    },
+    "godot": {
+      "enabled": "auto",
+      "version": "project",
+      "dotnet": "auto",
+      "exportTemplates": true,
+      "keepVersions": 2
+    },
+    "steam": {
+      "enabled": "auto",
+      "client": false,
+      "sdkFolder": ""
+    },
+    "fivem": {
+      "enabled": "auto",
+      "acceptLicense": false,
+      "game": "gta5",
+      "artifact": "recommended",
+      "txAdmin": true,
+      "keepVersions": 2
+    },
+    "android": {
+      "enabled": "auto",
+      "acceptLicense": false,
+      "platforms": [
+        "project"
+      ],
+      "buildTools": "latest",
+      "ndk": "auto",
+      "cmake": "auto",
+      "packages": []
+    },
+    "flutter": {
+      "enabled": "auto",
+      "version": "project",
+      "windowsDesktop": false,
+      "precache": [
+        "android",
+        "web"
+      ]
+    },
+    "dart": {
+      "enabled": "auto",
+      "version": "stable"
+    },
+    "reactNative": {
+      "enabled": "auto",
+      "easCli": true
     },
     "cpp": {
       "enabled": "auto",
@@ -139,7 +229,8 @@
         "net48",
         "net472"
       ],
-      "netfx35": false
+      "netfx35": false,
+      "templates": []
     },
     "go": {
       "enabled": "auto",
@@ -150,7 +241,8 @@
       "enabled": "auto",
       "version": "lts",
       "maven": true,
-      "gradle": true
+      "gradle": true,
+      "kotlin": false
     },
     "ruby": {
       "enabled": "auto",
@@ -330,7 +422,8 @@
       "bootReset": [
         ".sandbox-secrets",
         ".sandbox\\setup_marker.json",
-        ".sandbox\\deny_read_acl_state.json"
+        ".sandbox\\deny_read_acl_state.json",
+        "tmp\\arg0"
       ],
       "resumeArguments": [
         "resume",

package/dist/app/features/accounts/accounts.def.d.ts

@@ -1,13 +1,22 @@
 import { z } from 'zod';
 import { type Page, type Section } from '../../kernel/index.js';
+import { type ServicesList } from './services.def.js';
 export declare const AccountRowSchema: z.ZodObject<{
     name: z.ZodString;
     email: z.ZodNullable<z.ZodString>;
     isDefault: z.ZodBoolean;
     isActive: z.ZodBoolean;
     savedAt: z.ZodString;
+    kind: z.ZodOptional<z.ZodEnum<{
+        subscription: "subscription";
+        console: "console";
+        "api-key": "api-key";
+    }>>;
+    keyHint: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
 export type AccountRow = z.output<typeof AccountRowSchema>;
+/** "API key sk-ant-...abcd", "Console sk-ant-...abcd", "subscription"; null when the agent does not say. */
+export declare function kindText(r: Pick<AccountRow, 'kind' | 'keyHint'>): string | null;
 export declare const AgentAccountsSchema: z.ZodObject<{
     name: z.ZodString;
     kept: z.ZodBoolean;
@@ -18,6 +27,12 @@ export declare const AgentAccountsSchema: z.ZodObject<{
         isDefault: z.ZodBoolean;
         isActive: z.ZodBoolean;
         savedAt: z.ZodString;
+        kind: z.ZodOptional<z.ZodEnum<{
+            subscription: "subscription";
+            console: "console";
+            "api-key": "api-key";
+        }>>;
+        keyHint: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type AgentAccounts = z.output<typeof AgentAccountsSchema>;
@@ -33,8 +48,33 @@ export declare const AccountsListSchema: z.ZodObject<{
             isDefault: z.ZodBoolean;
             isActive: z.ZodBoolean;
             savedAt: z.ZodString;
+            kind: z.ZodOptional<z.ZodEnum<{
+                subscription: "subscription";
+                console: "console";
+                "api-key": "api-key";
+            }>>;
+            keyHint: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
+    services: z.ZodArray<z.ZodObject<{
+        kind: z.ZodString;
+        label: z.ZodString;
+        share: z.ZodBoolean;
+        state: z.ZodEnum<{
+            none: "none";
+            saved: "saved";
+            unreadable: "unreadable";
+        }>;
+        source: z.ZodNullable<z.ZodString>;
+        savedAt: z.ZodNullable<z.ZodString>;
+        summary: z.ZodNullable<z.ZodString>;
+        heldBy: z.ZodNullable<z.ZodString>;
+        usedBy: z.ZodArray<z.ZodString>;
+        warnings: z.ZodArray<z.ZodString>;
+        canImport: z.ZodBoolean;
+        canLogin: z.ZodBoolean;
+        needsFile: z.ZodBoolean;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type AccountsList = z.output<typeof AccountsListSchema>;
 /** The name rule of a saved login: what the store accepts. */
@@ -55,13 +95,39 @@ export declare const listAccounts: import("../../kernel/define.js").QueryDef<z.Z
             isDefault: z.ZodBoolean;
             isActive: z.ZodBoolean;
             savedAt: z.ZodString;
+            kind: z.ZodOptional<z.ZodEnum<{
+                subscription: "subscription";
+                console: "console";
+                "api-key": "api-key";
+            }>>;
+            keyHint: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
+    services: z.ZodArray<z.ZodObject<{
+        kind: z.ZodString;
+        label: z.ZodString;
+        share: z.ZodBoolean;
+        state: z.ZodEnum<{
+            none: "none";
+            saved: "saved";
+            unreadable: "unreadable";
+        }>;
+        source: z.ZodNullable<z.ZodString>;
+        savedAt: z.ZodNullable<z.ZodString>;
+        summary: z.ZodNullable<z.ZodString>;
+        heldBy: z.ZodNullable<z.ZodString>;
+        usedBy: z.ZodArray<z.ZodString>;
+        warnings: z.ZodArray<z.ZodString>;
+        canImport: z.ZodBoolean;
+        canLogin: z.ZodBoolean;
+        needsFile: z.ZodBoolean;
+    }, z.core.$strip>>;
 }, z.core.$strip>, "accounts.list">;
 export declare const saveAccount: import("../../kernel/define.js").OperationDef<z.ZodObject<{
     agent: z.ZodDefault<z.ZodString>;
     name: z.ZodOptional<z.ZodString>;
     fromHost: z.ZodDefault<z.ZodBoolean>;
+    apiKey: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>, z.ZodObject<{
     name: z.ZodString;
     message: z.ZodString;
@@ -95,8 +161,8 @@ export declare const removeAccount: import("../../kernel/define.js").OperationDe
 }, z.core.$strip>, "accounts.remove">;
 /** One agent's card: its save rows and logins (a card to pick from), or the note that its login is not kept. */
 export declare function agentSection(a: AgentAccounts): Section;
-/** The web's page: one card per agent (its logins and the save rows). */
-export declare function accountsPage(o: AccountsList): Page;
+/** The web's page: one card per agent (its logins and the save rows), then one section per service sign-in. */
+export declare function accountsPage(o: AccountsList, services?: ServicesList): Page;
 /**
  * One agent's page for the menu: its section, and the keys of its save rows (s, p) which the menu's key bar shows
  * while the agent's category is open. The keys of a login row (d, r, x) are on the row itself.
@@ -117,7 +183,55 @@ export declare const accountsView: import("../../kernel/define.js").ViewDef<{
                 isDefault: z.ZodBoolean;
                 isActive: z.ZodBoolean;
                 savedAt: z.ZodString;
+                kind: z.ZodOptional<z.ZodEnum<{
+                    subscription: "subscription";
+                    console: "console";
+                    "api-key": "api-key";
+                }>>;
+                keyHint: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             }, z.core.$strip>>;
         }, z.core.$strip>>;
+        services: z.ZodArray<z.ZodObject<{
+            kind: z.ZodString;
+            label: z.ZodString;
+            share: z.ZodBoolean;
+            state: z.ZodEnum<{
+                none: "none";
+                saved: "saved";
+                unreadable: "unreadable";
+            }>;
+            source: z.ZodNullable<z.ZodString>;
+            savedAt: z.ZodNullable<z.ZodString>;
+            summary: z.ZodNullable<z.ZodString>;
+            heldBy: z.ZodNullable<z.ZodString>;
+            usedBy: z.ZodArray<z.ZodString>;
+            warnings: z.ZodArray<z.ZodString>;
+            canImport: z.ZodBoolean;
+            canLogin: z.ZodBoolean;
+            needsFile: z.ZodBoolean;
+        }, z.core.$strip>>;
     }, z.core.$strip>, "accounts.list">;
+    services: import("../../kernel/define.js").QueryDef<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        services: z.ZodArray<z.ZodObject<{
+            kind: z.ZodString;
+            label: z.ZodString;
+            share: z.ZodBoolean;
+            state: z.ZodEnum<{
+                none: "none";
+                saved: "saved";
+                unreadable: "unreadable";
+            }>;
+            source: z.ZodNullable<z.ZodString>;
+            savedAt: z.ZodNullable<z.ZodString>;
+            summary: z.ZodNullable<z.ZodString>;
+            heldBy: z.ZodNullable<z.ZodString>;
+            usedBy: z.ZodArray<z.ZodString>;
+            warnings: z.ZodArray<z.ZodString>;
+            canImport: z.ZodBoolean;
+            canLogin: z.ZodBoolean;
+            needsFile: z.ZodBoolean;
+        }, z.core.$strip>>;
+    }, z.core.$strip>, "accounts.services">;
 }, Record<string, never>, "accounts">;