windows-development-sandbox 1.17.3 → 1.18.2

package/README.md

@@ -102,7 +102,7 @@ Details: [heavy load](docs/troubleshooting.md#the-sandbox-closes-under-heavy-loa
 | `sandbox db [start\|stop <name>]`        | list, start or stop databases (`sbx-db` inside)                                   |
 | `sandbox exec -- <cmd>`                  | run a command inside                                                              |
 | `sandbox config get\|set\|reset\|list`   | read and change settings (`export` / `import` to share them)                      |
-| `sandbox account`                        | save, switch and rename agent logins                                              |
+| `sandbox account`                        | save, switch and rename agent logins and Claude API keys                          |
 | `sandbox github` / `vpn`                 | the GitHub token for sandboxes; the VPN login and status                          |
 | `sandbox web`                            | (Beta) the web UI: start, stop, status, open                                      |
 | `sandbox stop` / `hide` / `show`         | shut down; hide or show the window                                                |

package/config.example.json

@@ -68,6 +68,38 @@
   "github": {
     "shareToken": false
   },
+  "accounts": {
+    "epic": {
+      "share": false
+    },
+    "steam": {
+      "share": false
+    },
+    "unity": {
+      "share": false
+    },
+    "cfx": {
+      "share": false
+    },
+    "keystore": {
+      "share": false
+    },
+    "play": {
+      "share": false
+    },
+    "expo": {
+      "share": false
+    },
+    "appstore": {
+      "share": false
+    }
+  },
+  "pcInstalls": {
+    "steamGames": false,
+    "epicGames": false,
+    "unrealEngines": false,
+    "unityEditors": false
+  },
   "provisioning": {
     "copyFromHost": true,
     "fallbackToInstall": true,
@@ -122,7 +154,65 @@
       "enabled": "auto",
       "acceptLicense": false,
       "components": [],
-      "keepInstallFiles": true
+      "keepInstallFiles": true,
+      "persistEngines": true,
+      "derivedDataCache": "persisted"
+    },
+    "unity": {
+      "enabled": "auto",
+      "acceptLicense": false,
+      "version": "project",
+      "modules": [],
+      "hub": false,
+      "keepVersions": 2
+    },
+    "godot": {
+      "enabled": "auto",
+      "version": "project",
+      "dotnet": "auto",
+      "exportTemplates": true,
+      "keepVersions": 2
+    },
+    "steam": {
+      "enabled": "auto",
+      "client": false,
+      "sdkFolder": ""
+    },
+    "fivem": {
+      "enabled": "auto",
+      "acceptLicense": false,
+      "game": "gta5",
+      "artifact": "recommended",
+      "txAdmin": true,
+      "keepVersions": 2
+    },
+    "android": {
+      "enabled": "auto",
+      "acceptLicense": false,
+      "platforms": [
+        "project"
+      ],
+      "buildTools": "latest",
+      "ndk": "auto",
+      "cmake": "auto",
+      "packages": []
+    },
+    "flutter": {
+      "enabled": "auto",
+      "version": "project",
+      "windowsDesktop": false,
+      "precache": [
+        "android",
+        "web"
+      ]
+    },
+    "dart": {
+      "enabled": "auto",
+      "version": "stable"
+    },
+    "reactNative": {
+      "enabled": "auto",
+      "easCli": true
     },
     "cpp": {
       "enabled": "auto",
@@ -139,7 +229,8 @@
         "net48",
         "net472"
       ],
-      "netfx35": false
+      "netfx35": false,
+      "templates": []
     },
     "go": {
       "enabled": "auto",
@@ -150,7 +241,8 @@
       "enabled": "auto",
       "version": "lts",
       "maven": true,
-      "gradle": true
+      "gradle": true,
+      "kotlin": false
     },
     "ruby": {
       "enabled": "auto",
@@ -330,7 +422,8 @@
       "bootReset": [
         ".sandbox-secrets",
         ".sandbox\\setup_marker.json",
-        ".sandbox\\deny_read_acl_state.json"
+        ".sandbox\\deny_read_acl_state.json",
+        "tmp\\arg0"
       ],
       "resumeArguments": [
         "resume",

package/dist/app/features/accounts/accounts.def.d.ts

@@ -1,13 +1,22 @@
 import { z } from 'zod';
 import { type Page, type Section } from '../../kernel/index.js';
+import { type ServicesList } from './services.def.js';
 export declare const AccountRowSchema: z.ZodObject<{
     name: z.ZodString;
     email: z.ZodNullable<z.ZodString>;
     isDefault: z.ZodBoolean;
     isActive: z.ZodBoolean;
     savedAt: z.ZodString;
+    kind: z.ZodOptional<z.ZodEnum<{
+        subscription: "subscription";
+        console: "console";
+        "api-key": "api-key";
+    }>>;
+    keyHint: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
 export type AccountRow = z.output<typeof AccountRowSchema>;
+/** "API key sk-ant-...abcd", "Console sk-ant-...abcd", "subscription"; null when the agent does not say. */
+export declare function kindText(r: Pick<AccountRow, 'kind' | 'keyHint'>): string | null;
 export declare const AgentAccountsSchema: z.ZodObject<{
     name: z.ZodString;
     kept: z.ZodBoolean;
@@ -18,6 +27,12 @@ export declare const AgentAccountsSchema: z.ZodObject<{
         isDefault: z.ZodBoolean;
         isActive: z.ZodBoolean;
         savedAt: z.ZodString;
+        kind: z.ZodOptional<z.ZodEnum<{
+            subscription: "subscription";
+            console: "console";
+            "api-key": "api-key";
+        }>>;
+        keyHint: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type AgentAccounts = z.output<typeof AgentAccountsSchema>;
@@ -33,8 +48,33 @@ export declare const AccountsListSchema: z.ZodObject<{
             isDefault: z.ZodBoolean;
             isActive: z.ZodBoolean;
             savedAt: z.ZodString;
+            kind: z.ZodOptional<z.ZodEnum<{
+                subscription: "subscription";
+                console: "console";
+                "api-key": "api-key";
+            }>>;
+            keyHint: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
+    services: z.ZodArray<z.ZodObject<{
+        kind: z.ZodString;
+        label: z.ZodString;
+        share: z.ZodBoolean;
+        state: z.ZodEnum<{
+            none: "none";
+            saved: "saved";
+            unreadable: "unreadable";
+        }>;
+        source: z.ZodNullable<z.ZodString>;
+        savedAt: z.ZodNullable<z.ZodString>;
+        summary: z.ZodNullable<z.ZodString>;
+        heldBy: z.ZodNullable<z.ZodString>;
+        usedBy: z.ZodArray<z.ZodString>;
+        warnings: z.ZodArray<z.ZodString>;
+        canImport: z.ZodBoolean;
+        canLogin: z.ZodBoolean;
+        needsFile: z.ZodBoolean;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type AccountsList = z.output<typeof AccountsListSchema>;
 /** The name rule of a saved login: what the store accepts. */
@@ -55,13 +95,39 @@ export declare const listAccounts: import("../../kernel/define.js").QueryDef<z.Z
             isDefault: z.ZodBoolean;
             isActive: z.ZodBoolean;
             savedAt: z.ZodString;
+            kind: z.ZodOptional<z.ZodEnum<{
+                subscription: "subscription";
+                console: "console";
+                "api-key": "api-key";
+            }>>;
+            keyHint: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
+    services: z.ZodArray<z.ZodObject<{
+        kind: z.ZodString;
+        label: z.ZodString;
+        share: z.ZodBoolean;
+        state: z.ZodEnum<{
+            none: "none";
+            saved: "saved";
+            unreadable: "unreadable";
+        }>;
+        source: z.ZodNullable<z.ZodString>;
+        savedAt: z.ZodNullable<z.ZodString>;
+        summary: z.ZodNullable<z.ZodString>;
+        heldBy: z.ZodNullable<z.ZodString>;
+        usedBy: z.ZodArray<z.ZodString>;
+        warnings: z.ZodArray<z.ZodString>;
+        canImport: z.ZodBoolean;
+        canLogin: z.ZodBoolean;
+        needsFile: z.ZodBoolean;
+    }, z.core.$strip>>;
 }, z.core.$strip>, "accounts.list">;
 export declare const saveAccount: import("../../kernel/define.js").OperationDef<z.ZodObject<{
     agent: z.ZodDefault<z.ZodString>;
     name: z.ZodOptional<z.ZodString>;
     fromHost: z.ZodDefault<z.ZodBoolean>;
+    apiKey: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>, z.ZodObject<{
     name: z.ZodString;
     message: z.ZodString;
@@ -95,8 +161,8 @@ export declare const removeAccount: import("../../kernel/define.js").OperationDe
 }, z.core.$strip>, "accounts.remove">;
 /** One agent's card: its save rows and logins (a card to pick from), or the note that its login is not kept. */
 export declare function agentSection(a: AgentAccounts): Section;
-/** The web's page: one card per agent (its logins and the save rows). */
-export declare function accountsPage(o: AccountsList): Page;
+/** The web's page: one card per agent (its logins and the save rows), then one section per service sign-in. */
+export declare function accountsPage(o: AccountsList, services?: ServicesList): Page;
 /**
  * One agent's page for the menu: its section, and the keys of its save rows (s, p) which the menu's key bar shows
  * while the agent's category is open. The keys of a login row (d, r, x) are on the row itself.
@@ -117,7 +183,55 @@ export declare const accountsView: import("../../kernel/define.js").ViewDef<{
                 isDefault: z.ZodBoolean;
                 isActive: z.ZodBoolean;
                 savedAt: z.ZodString;
+                kind: z.ZodOptional<z.ZodEnum<{
+                    subscription: "subscription";
+                    console: "console";
+                    "api-key": "api-key";
+                }>>;
+                keyHint: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             }, z.core.$strip>>;
         }, z.core.$strip>>;
+        services: z.ZodArray<z.ZodObject<{
+            kind: z.ZodString;
+            label: z.ZodString;
+            share: z.ZodBoolean;
+            state: z.ZodEnum<{
+                none: "none";
+                saved: "saved";
+                unreadable: "unreadable";
+            }>;
+            source: z.ZodNullable<z.ZodString>;
+            savedAt: z.ZodNullable<z.ZodString>;
+            summary: z.ZodNullable<z.ZodString>;
+            heldBy: z.ZodNullable<z.ZodString>;
+            usedBy: z.ZodArray<z.ZodString>;
+            warnings: z.ZodArray<z.ZodString>;
+            canImport: z.ZodBoolean;
+            canLogin: z.ZodBoolean;
+            needsFile: z.ZodBoolean;
+        }, z.core.$strip>>;
     }, z.core.$strip>, "accounts.list">;
+    services: import("../../kernel/define.js").QueryDef<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        services: z.ZodArray<z.ZodObject<{
+            kind: z.ZodString;
+            label: z.ZodString;
+            share: z.ZodBoolean;
+            state: z.ZodEnum<{
+                none: "none";
+                saved: "saved";
+                unreadable: "unreadable";
+            }>;
+            source: z.ZodNullable<z.ZodString>;
+            savedAt: z.ZodNullable<z.ZodString>;
+            summary: z.ZodNullable<z.ZodString>;
+            heldBy: z.ZodNullable<z.ZodString>;
+            usedBy: z.ZodArray<z.ZodString>;
+            warnings: z.ZodArray<z.ZodString>;
+            canImport: z.ZodBoolean;
+            canLogin: z.ZodBoolean;
+            needsFile: z.ZodBoolean;
+        }, z.core.$strip>>;
+    }, z.core.$strip>, "accounts.services">;
 }, Record<string, never>, "accounts">;

package/dist/app/features/accounts/accounts.def.js

@@ -3,6 +3,8 @@
 // accounts.run.ts does the work over AccountsService.
 import { z } from 'zod';
 import { action, defineOperation, defineQuery, defineView, plural, } from '../../kernel/index.js';
+import { setSetting } from '../settings/settings.def.js';
+import { listServices, SERVICE_OPERATIONS, serviceSections, ServiceRowSchema, } from './services.def.js';
 const AgentSchema = z.string().default('claude').describe('whose login: an agent that keeps one (default: claude)');
 const NameSchema = z.string().optional().describe('account name');
 export const AccountRowSchema = z.object({
@@ -11,7 +13,19 @@ export const AccountRowSchema = z.object({
     isDefault: z.boolean().describe('New launches start with it'),
     isActive: z.boolean().describe('The sandbox uses it now'),
     savedAt: z.string().describe('When it was saved (ISO time)'),
+    kind: z
+        .enum(['subscription', 'console', 'api-key'])
+        .optional()
+        .describe('Claude: a subscription login, a Claude Console login (its API key), or an API key you gave'),
+    keyHint: z.string().nullable().optional().describe('The most of an API key ever shown: sk-ant-...abcd'),
 });
+const KIND_LABELS = { subscription: 'subscription', console: 'Console', 'api-key': 'API key' };
+/** "API key sk-ant-...abcd", "Console sk-ant-...abcd", "subscription"; null when the agent does not say. */
+export function kindText(r) {
+    if (!r.kind)
+        return null;
+    return KIND_LABELS[r.kind] + (r.keyHint ? ' ' + r.keyHint : '');
+}
 export const AgentAccountsSchema = z.object({
     name: z.string().describe('The agent'),
     kept: z.boolean().describe('Its login can be saved and switched'),
@@ -21,25 +35,42 @@ export const AgentAccountsSchema = z.object({
 export const AccountsListSchema = z.object({
     agent: z.string().describe('The agent asked for (the command line table shows only it)'),
     agents: z.array(AgentAccountsSchema).describe('Every agent, Claude first'),
+    services: z.array(ServiceRowSchema).describe('Service sign-ins for sandboxes (Epic, Steam ...)'),
 });
 const MessageSchema = z.object({ message: z.string().describe('What happened') });
 /** The name rule of a saved login: what the store accepts. */
 export const NAME_RULE = 'Use letters, digits, - and _ (up to 40).';
+/** The "Services" block under `sandbox account list`: one line per service that is shared or saved. */
+function servicesBlock(o) {
+    const kept = o.services.filter((s) => s.share || s.state !== 'none');
+    const lines = kept.map((s) => '  ' +
+        s.kind.padEnd(10) +
+        (s.share ? 'shared' : 'not shared') +
+        ', ' +
+        (s.state === 'none' ? 'not saved' : s.state === 'saved' ? 'saved' : 'cannot be read'));
+    return ['', 'Services' + (kept.length ? '' : ': none shared or saved') + '   (sandbox account status)', ...lines];
+}
 /** `sandbox account list`: the table of one agent, as the command line has always padded it. */
 export function accountsText(o) {
+    return [agentText(o), ...servicesBlock(o)].join('\n');
+}
+function agentText(o) {
     const rows = o.agents.find((a) => a.name === o.agent)?.accounts ?? [];
     if (!rows.length)
         return o.agent === 'claude'
-            ? "No saved accounts. Sign in inside the sandbox, then: sandbox account save <name>   (or --from-host to save this PC's login)"
+            ? "No saved accounts. Sign in inside the sandbox, then: sandbox account save <name>   (or --from-host to save this PC's login, or --api-key to type an API key)"
             : 'No saved ' +
                 o.agent +
                 ' accounts. Sign in inside the sandbox, then: sandbox account save <name> --agent ' +
                 o.agent;
+    // The KIND column only for an agent whose logins have kinds (Claude).
+    const kinds = rows.some((a) => a.kind);
     const table = [
-        ['', 'NAME', 'EMAIL', 'SAVED'],
+        ['', 'NAME', ...(kinds ? ['KIND'] : []), 'EMAIL', 'SAVED'],
         ...rows.map((a) => [
             (a.isActive ? '*' : ' ') + (a.isDefault ? 'D' : ' '),
             a.name,
+            ...(kinds ? [kindText(a) ?? '-'] : []),
             a.email ?? '-',
             a.savedAt.slice(0, 16).replace('T', ' '),
         ]),
@@ -72,6 +103,10 @@ export const saveAccount = defineOperation({
         agent: AgentSchema,
         name: NameSchema,
         fromHost: z.boolean().default(false).describe("(save) save this PC's login instead of the sandbox's"),
+        apiKey: z
+            .boolean()
+            .default(false)
+            .describe("(save, Claude) an Anthropic API key: typed in (hidden), or with --from-host this PC's"),
     }),
     output: z.object({ name: z.string().describe('The saved login'), message: z.string().describe('What happened') }),
     text: (o) => o.message,
@@ -79,7 +114,7 @@ export const saveAccount = defineOperation({
         name: 'account',
         action: 'save',
         positional: ['name'],
-        flags: { agent: { flag: '--agent' }, fromHost: { flag: '--from-host' } },
+        flags: { agent: { flag: '--agent' }, fromHost: { flag: '--from-host' }, apiKey: { flag: '--api-key' } },
     },
 });
 export const useAccount = defineOperation({
@@ -173,11 +208,25 @@ function saveItems(a) {
                 },
             ]
             : []),
+        ...(a.name === 'claude'
+            ? [
+                {
+                    id: '@save-key',
+                    label: '+ Save an API key…',
+                    group: 'Save a login',
+                    description: 'Saves an Anthropic API key (from the Claude Console) under a name you choose. What you type is not shown.',
+                    primary: action(saveAccount, { agent: a.name, fromHost: false, apiKey: true }, { verb: 'save', label: 'Save an API key' }),
+                },
+            ]
+            : []),
     ];
 }
 /** One saved login: its state in the hint and badges, Enter or a click uses it, d/r/x change it. */
 function loginItem(a, r) {
-    const hint = [r.isActive ? 'in the sandbox' : '', r.isDefault ? 'default' : ''].filter(Boolean).join(' · ');
+    const kind = kindText(r);
+    const hint = [r.kind ? KIND_LABELS[r.kind] : '', r.isActive ? 'in the sandbox' : '', r.isDefault ? 'default' : '']
+        .filter(Boolean)
+        .join(' · ');
     return {
         id: a.name + ':' + r.name,
         label: r.name,
@@ -185,11 +234,17 @@ function loginItem(a, r) {
         icon: a.name,
         hint,
         badges: [
+            ...(r.kind ? [{ text: KIND_LABELS[r.kind], tone: r.kind === 'subscription' ? 'muted' : 'warn' }] : []),
             ...(r.isActive ? [{ text: 'in the sandbox', tone: 'ok' }] : []),
             ...(r.isDefault ? [{ text: 'default', tone: 'accent' }] : []),
         ],
         description: r.isActive ? 'The sandbox uses this login now.' : 'Choose it to make the sandbox use this login.',
-        details: ['Agent  ' + a.name, 'Email  ' + (r.email ?? '-'), 'Saved  ' + r.savedAt.slice(0, 16).replace('T', ' ')],
+        details: [
+            'Agent  ' + a.name,
+            ...(kind ? ['Kind   ' + kind] : []),
+            'Email  ' + (r.email ?? '-'),
+            'Saved  ' + r.savedAt.slice(0, 16).replace('T', ' '),
+        ],
         // The login in use already offers nothing to switch to.
         ...(r.isActive ? {} : { primary: action(useAccount, { agent: a.name, name: r.name }, { verb: 'use' }) }),
         actions: [
@@ -223,9 +278,9 @@ export function agentSection(a) {
         items: [...saveItems(a), ...a.accounts.map((r) => loginItem(a, r))],
     };
 }
-/** The web's page: one card per agent (its logins and the save rows). */
-export function accountsPage(o) {
-    return { title: 'Accounts', sections: o.agents.map(agentSection) };
+/** The web's page: one card per agent (its logins and the save rows), then one section per service sign-in. */
+export function accountsPage(o, services = { services: o.services }) {
+    return { title: 'Accounts', sections: [...o.agents.map(agentSection), ...serviceSections(services)] };
 }
 /**
  * One agent's page for the menu: its section, and the keys of its save rows (s, p) which the menu's key bar shows
@@ -238,6 +293,11 @@ export function agentPage(a) {
             ...(a.canSavePc
                 ? [action(saveAccount, { agent: a.name, fromHost: true }, { key: 'p', verb: 'save PC login', importance: 3 })]
                 : []),
+            ...(a.name === 'claude'
+                ? [
+                    action(saveAccount, { agent: a.name, fromHost: false, apiKey: true }, { key: 'k', verb: 'save API key', importance: 3 }),
+                ]
+                : []),
         ]
         : [];
     return { title: 'Accounts', sections: [agentSection(a)], actions: keys };
@@ -245,8 +305,16 @@ export function agentPage(a) {
 export const accountsView = defineView({
     id: 'accounts',
     title: 'Accounts',
-    summary: 'Logins saved on this PC for each agent. Every launch starts with the default; "Use this login" switches now.',
-    queries: { accounts: listAccounts },
-    operations: [saveAccount, useAccount, defaultAccount, renameAccount, removeAccount],
-    build: ({ accounts }) => accountsPage(accounts),
+    summary: 'Logins saved on this PC for each agent (every launch starts with the default; "Use this login" switches now), and the service sign-ins sandboxes may get (Epic, Steam, Unity, signing keys ...).',
+    queries: { accounts: listAccounts, services: listServices },
+    operations: [
+        saveAccount,
+        useAccount,
+        defaultAccount,
+        renameAccount,
+        removeAccount,
+        ...SERVICE_OPERATIONS,
+        setSetting,
+    ],
+    build: ({ accounts, services }) => accountsPage(accounts, services),
 });

package/dist/app/features/accounts/accounts.run.d.ts

@@ -1,3 +1,4 @@
+import { type OperationIO } from '../../kernel/index.js';
 export declare const listAccountsRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").QueryDef<import("zod").ZodObject<{
     agent: import("zod").ZodDefault<import("zod").ZodString>;
 }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
@@ -12,13 +13,41 @@ export declare const listAccountsRun: import("../../kernel/define.js").Implement
             isDefault: import("zod").ZodBoolean;
             isActive: import("zod").ZodBoolean;
             savedAt: import("zod").ZodString;
+            kind: import("zod").ZodOptional<import("zod").ZodEnum<{
+                subscription: "subscription";
+                console: "console";
+                "api-key": "api-key";
+            }>>;
+            keyHint: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
         }, import("zod/v4/core").$strip>>;
     }, import("zod/v4/core").$strip>>;
+    services: import("zod").ZodArray<import("zod").ZodObject<{
+        kind: import("zod").ZodString;
+        label: import("zod").ZodString;
+        share: import("zod").ZodBoolean;
+        state: import("zod").ZodEnum<{
+            none: "none";
+            saved: "saved";
+            unreadable: "unreadable";
+        }>;
+        source: import("zod").ZodNullable<import("zod").ZodString>;
+        savedAt: import("zod").ZodNullable<import("zod").ZodString>;
+        summary: import("zod").ZodNullable<import("zod").ZodString>;
+        heldBy: import("zod").ZodNullable<import("zod").ZodString>;
+        usedBy: import("zod").ZodArray<import("zod").ZodString>;
+        warnings: import("zod").ZodArray<import("zod").ZodString>;
+        canImport: import("zod").ZodBoolean;
+        canLogin: import("zod").ZodBoolean;
+        needsFile: import("zod").ZodBoolean;
+    }, import("zod/v4/core").$strip>>;
 }, import("zod/v4/core").$strip>, "accounts.list">, import("../../../cli/commands/context.js").Context>;
+/** Asks for an API key (one hidden question). The validator answers with fixed texts only, never the key. */
+export declare function askApiKey(io: OperationIO): Promise<string>;
 export declare const saveAccountRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").OperationDef<import("zod").ZodObject<{
     agent: import("zod").ZodDefault<import("zod").ZodString>;
     name: import("zod").ZodOptional<import("zod").ZodString>;
     fromHost: import("zod").ZodDefault<import("zod").ZodBoolean>;
+    apiKey: import("zod").ZodDefault<import("zod").ZodBoolean>;
 }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
     name: import("zod").ZodString;
     message: import("zod").ZodString;

package/dist/app/features/accounts/accounts.run.js

@@ -3,9 +3,13 @@
 // safeText. Logins are never read here: the store keeps them sealed, and outputs hold names, emails and dates only.
 import { fail, safeText } from '../../../core/util/index.js';
 import { AccountsService } from '../../../cli/services/index.js';
+import { AccountLeases, ServiceAccountStore } from '../../../host/accounts/index.js';
+import { SERVICE_KINDS } from '../../../shared/accounts/index.js';
+import { apiKeyProblem } from '../../../host/profile/index.js';
 import { implement } from '../../context.js';
+import { serviceRow } from './services.run.js';
 import { cancelled } from '../../kernel/index.js';
-import { defaultAccount, listAccounts, NAME_RULE, removeAccount, renameAccount, saveAccount, useAccount, } from './accounts.def.js';
+import { defaultAccount, kindText, listAccounts, NAME_RULE, removeAccount, renameAccount, saveAccount, useAccount, } from './accounts.def.js';
 const NAME = /^[A-Za-z0-9_-]{1,40}$/;
 const validName = (v) => NAME.test(v.trim()) || NAME_RULE;
 /** "work" (me@example.com) as the notices and the command line have always said it. */
@@ -21,6 +25,7 @@ function savedLogins(service, agent) {
             isDefault: r.isDefault,
             isActive: r.isActive,
             savedAt: r.savedAt,
+            ...(r.kind ? { kind: r.kind, keyHint: r.keyHint ?? null } : {}),
         }));
     }
     catch {
@@ -46,7 +51,10 @@ async function accountName(io, service, verb, agent, given) {
         fail('No saved accounts.', 'Sign in inside the sandbox, then run: sandbox account save <name>');
     const picked = await io.choose({
         title: 'Which account?',
-        choices: rows.map((a) => ({ value: a.name, label: label(a) })),
+        choices: rows.map((a) => {
+            const kind = kindText(a);
+            return { value: a.name, label: label(a), ...(kind ? { description: kind } : {}) };
+        }),
     });
     if (picked === undefined)
         cancelled();
@@ -63,13 +71,34 @@ export const listAccountsRun = implement(listAccounts, async (ctx, input) => {
     // An agent that keeps no login, or no such agent: the command line says why (the store's own message).
     if (!agents.some((a) => a.name === input.agent && a.kept))
         service.list(input.agent);
-    return { agent: input.agent, agents };
+    const store = new ServiceAccountStore(ctx.storageRoot);
+    const leases = new AccountLeases(ctx.storageRoot);
+    const services = SERVICE_KINDS.map((k) => serviceRow(k, ctx.loaded.config, store, leases));
+    return { agent: input.agent, agents, services };
 });
+/** Asks for an API key (one hidden question). The validator answers with fixed texts only, never the key. */
+export async function askApiKey(io) {
+    io.log('Make an API key in the Claude Console (platform.claude.com, API keys), then paste it here.');
+    io.log('What you type is not shown. It is kept encrypted for your Windows user and never printed.', 'muted');
+    const key = await io.secret({
+        title: 'Anthropic API key',
+        validate: (v) => apiKeyProblem(v.trim()) ?? true,
+    });
+    if (key === undefined)
+        cancelled();
+    return key.trim();
+}
 export const saveAccountRun = implement(saveAccount, async (ctx, input, io) => {
     const service = new AccountsService(ctx);
+    if (input.apiKey && input.agent !== 'claude')
+        fail('--api-key is for Claude accounts only.', 'Leave out --agent, or leave out --api-key.');
     const name = await accountName(io, service, 'save', input.agent, input.name);
-    const saved = service.save(name, input.fromHost, input.agent);
-    return { name: saved.name, message: 'Saved account ' + label(saved) + '.' };
+    // --api-key alone: a key typed in; with --from-host: this PC's Console key or ANTHROPIC_API_KEY.
+    const saved = input.apiKey && !input.fromHost
+        ? service.saveApiKey(name, await askApiKey(io))
+        : service.save(name, input.fromHost, input.agent, input.apiKey);
+    const kind = saved.kind && saved.kind !== 'subscription' ? kindText(saved) : null;
+    return { name: saved.name, message: 'Saved account ' + label(saved) + (kind ? ' (' + kind + ')' : '') + '.' };
 });
 /**
  * Makes the sandbox use a saved login, then offers to restart the agent's running sessions. The switch is done before
@@ -77,7 +106,8 @@ export const saveAccountRun = implement(saveAccount, async (ctx, input, io) => {
  */
 async function switchTo(io, service, name, agent, noRestart) {
     const used = service.activate(name, agent);
-    const lines = ['Sandbox now uses ' + label(used) + '.'];
+    const kind = used.kind && used.kind !== 'subscription' ? kindText(used) : null;
+    const lines = ['Sandbox now uses ' + label(used) + (kind ? ' (' + kind + ')' : '') + '.'];
     if (used.note)
         lines.push(safeText(used.note));
     if (service.hasRunningSessions(agent) && !noRestart) {

package/dist/app/features/accounts/index.d.ts

@@ -1,2 +1,4 @@
 export * from './accounts.def.js';
 export * from './accounts.run.js';
+export * from './services.def.js';
+export * from './services.run.js';

package/dist/app/features/accounts/index.js

@@ -1,3 +1,6 @@
-// The accounts feature: the saved logins of each agent, and saving, using, defaulting, renaming and removing them.
+// The accounts feature: the saved logins of each agent (save, use, default, rename, remove), and the service sign-ins
+// sandboxes may get (Epic, Steam, Unity, signing keys ...: status, import, sign in, forget).
 export * from './accounts.def.js';
 export * from './accounts.run.js';
+export * from './services.def.js';
+export * from './services.run.js';