windows-development-sandbox 1.20.0 → 1.23.1

package/dist/app/features/github/github.def.d.ts

@@ -1,7 +1,21 @@
 import { z } from 'zod';
-import { type Page } from '../../kernel/index.js';
+import { type Item, type Page, type Section } from '../../kernel/index.js';
 /** Where GitHub makes a fine-grained token. */
 export declare const NEW_TOKEN_URL = "https://github.com/settings/personal-access-tokens/new";
+/** What a token for sandboxes needs (GitHub's names for the permissions), asked for in the pre-filled form. */
+export declare const TOKEN_PERMISSIONS: Readonly<Record<string, 'read' | 'write'>>;
+/**
+ * The link that opens GitHub's "new fine-grained token" form already filled in (name, description, days until it
+ * expires, permissions): docs.github.com, "Creating a fine-grained personal access token". Pure.
+ */
+export declare function newTokenUrl(o: {
+    readonly name: string;
+    readonly description?: string;
+    readonly days: number;
+    readonly permissions: Readonly<Record<string, 'read' | 'write'>>;
+}): string;
+/** The pre-filled link for this PC (the name says which PC the token is for). */
+export declare function tokenUrlFor(host: string): string;
 /** The steps to make a token for sandboxes (shown before asking for it). */
 export declare const GITHUB_STEPS: readonly string[];
 /** What everyone who shares a token must know: on every surface. */
@@ -23,6 +37,11 @@ export declare const GithubStatusSchema: z.ZodObject<{
         classic: "classic";
     }>>;
     savedAt: z.ZodNullable<z.ZodString>;
+    login: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    repoCount: z.ZodNullable<z.ZodNumber>;
+    checkedAt: z.ZodNullable<z.ZodString>;
+    tokenUrl: z.ZodString;
 }, z.core.$strip>;
 export type GithubStatus = z.output<typeof GithubStatusSchema>;
 export declare const githubStatus: import("../../kernel/define.js").QueryDef<z.ZodObject<{}, z.core.$strict>, z.ZodObject<{
@@ -42,6 +61,11 @@ export declare const githubStatus: import("../../kernel/define.js").QueryDef<z.Z
         classic: "classic";
     }>>;
     savedAt: z.ZodNullable<z.ZodString>;
+    login: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    repoCount: z.ZodNullable<z.ZodNumber>;
+    checkedAt: z.ZodNullable<z.ZodString>;
+    tokenUrl: z.ZodString;
 }, z.core.$strip>, "github.status">;
 export declare const githubLogin: import("../../kernel/define.js").OperationDef<z.ZodObject<{}, z.core.$strict>, z.ZodObject<{
     message: z.ZodString;
@@ -56,8 +80,20 @@ export declare function githubTokenRowOf(s: GithubStatus): {
     hint: string;
     description: string;
 };
-/** The status page: the facts, the next step (command line only), the warnings and the token actions. */
-export declare function githubPage(s: GithubStatus): Page;
+/** A token that expires within this many days is flagged. */
+export declare const EXPIRY_WARN_DAYS = 14;
+/** How the expiry reads: "Expires 3 Feb 2027 (in 12 days)", "Expired 3 Feb 2027", and its tone. */
+export declare function expiryOf(expiresAt: string | null, now?: number): {
+    readonly text: string;
+    readonly tone: 'ok' | 'warn' | 'danger';
+    readonly days: number;
+} | null;
+/** The GitHub card (the "thing you connect" pattern): used by the GitHub page and the Accounts page. */
+export declare function githubItem(s: GithubStatus, now?: number): Item;
+/** The GitHub section (the card, the git-access fact, the warnings and the link that opens GitHub's form). */
+export declare function githubSection(s: GithubStatus, now?: number): Section;
+/** The status page: the card, the git access it needs, the warnings and how to make a new token. */
+export declare function githubPage(s: GithubStatus, now?: number): Page;
 export declare const githubView: import("../../kernel/define.js").ViewDef<{
     status: import("../../kernel/define.js").QueryDef<z.ZodObject<{}, z.core.$strict>, z.ZodObject<{
         shareToken: z.ZodBoolean;
@@ -76,5 +112,10 @@ export declare const githubView: import("../../kernel/define.js").ViewDef<{
             classic: "classic";
         }>>;
         savedAt: z.ZodNullable<z.ZodString>;
+        login: z.ZodNullable<z.ZodString>;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        repoCount: z.ZodNullable<z.ZodNumber>;
+        checkedAt: z.ZodNullable<z.ZodString>;
+        tokenUrl: z.ZodString;
     }, z.core.$strip>, "github.status">;
 }, Record<string, never>, "github">;

package/dist/app/features/github/github.def.js

@@ -2,12 +2,44 @@
 // and saving or deleting it. Pure: schemas, labels and the view; github.run.ts does the work. The token itself is never
 // an input or an output.
 import { z } from 'zod';
-import { action, defineOperation, defineQuery, defineView, } from '../../kernel/index.js';
+import { action, defineOperation, defineQuery, defineView, link, plural, } from '../../kernel/index.js';
+import { setSetting } from '../settings/settings.def.js';
 /** Where GitHub makes a fine-grained token. */
 export const NEW_TOKEN_URL = 'https://github.com/settings/personal-access-tokens/new';
+/** What a token for sandboxes needs (GitHub's names for the permissions), asked for in the pre-filled form. */
+export const TOKEN_PERMISSIONS = {
+    contents: 'write',
+    pull_requests: 'write',
+    metadata: 'read',
+    workflows: 'write',
+};
+/**
+ * The link that opens GitHub's "new fine-grained token" form already filled in (name, description, days until it
+ * expires, permissions): docs.github.com, "Creating a fine-grained personal access token". Pure.
+ */
+export function newTokenUrl(o) {
+    const query = new URLSearchParams();
+    query.set('name', o.name.slice(0, 40));
+    if (o.description)
+        query.set('description', o.description.slice(0, 1024));
+    query.set('expires_in', String(Math.max(1, Math.min(366, Math.round(o.days)))));
+    for (const [permission, level] of Object.entries(o.permissions))
+        query.set(permission, level);
+    // GitHub reads %20 as well as +; spaces are written %20 so the link reads the same everywhere.
+    return NEW_TOKEN_URL + '?' + query.toString().replace(/\+/g, '%20');
+}
+/** The pre-filled link for this PC (the name says which PC the token is for). */
+export function tokenUrlFor(host) {
+    return newTokenUrl({
+        name: 'Windows Sandbox ' + host,
+        description: 'For the agents in my Windows Sandbox. Limit it to the repositories they need.',
+        days: 90,
+        permissions: TOKEN_PERMISSIONS,
+    });
+}
 /** The steps to make a token for sandboxes (shown before asking for it). */
 export const GITHUB_STEPS = [
-    'Open ' + NEW_TOKEN_URL + ' (a fine-grained personal access token).',
+    'Make a fine-grained personal access token (the "Make a new token" button opens GitHub with the form filled in).',
     'Under "Repository access" choose "Only select repositories" and pick only the ones the agent should reach.',
     'Give only the permissions it needs, for example Contents (read and write), Pull requests (read and write) and Actions (read).',
     'Set an expiry date, then generate the token and copy it.',
@@ -26,6 +58,11 @@ export const GithubStatusSchema = z.object({
     token: TokenStateSchema,
     kind: z.enum(['fine-grained', 'classic']).nullable().describe('What kind of token is saved (never the token)'),
     savedAt: z.string().nullable().describe('When the token was saved (the date and time, never the token)'),
+    login: z.string().nullable().describe('The GitHub user the token belongs to, as GitHub said when it was saved'),
+    expiresAt: z.string().nullable().describe('When the token expires (ISO time), when GitHub said'),
+    repoCount: z.number().nullable().describe('How many repositories it reaches (at most 100 are counted)'),
+    checkedAt: z.string().nullable().describe('When GitHub was asked about it'),
+    tokenUrl: z.string().describe("GitHub's new-token form for this PC, filled in"),
 });
 export const githubStatus = defineQuery({
     id: 'github.status',
@@ -57,20 +94,6 @@ export const githubLogout = defineOperation({
     text: (o) => o.message,
     cli: { name: 'github', action: 'logout' },
 });
-const TOKEN_TEXT = {
-    none: 'not saved',
-    saved: 'saved (encrypted)',
-    unreadable: 'cannot be read',
-};
-const TOKEN_TONE = {
-    none: 'warn',
-    saved: 'ok',
-    unreadable: 'danger',
-};
-const KIND_TEXT = {
-    'fine-grained': 'fine-grained',
-    classic: 'classic (reaches every repository you can: a fine-grained token is safer)',
-};
 /** The Settings row of the menu (label, hint, description), from the status. Pure. */
 export function githubTokenRowOf(s) {
     return {
@@ -80,63 +103,122 @@ export function githubTokenRowOf(s) {
             GITHUB_WARNINGS.join(' '),
     };
 }
-/** The status page: the facts, the next step (command line only), the warnings and the token actions. */
-export function githubPage(s) {
-    const savedDate = s.savedAt ? '  ' + s.savedAt.slice(0, 10) : '';
-    const facts = [
-        s.shareToken
-            ? { id: 'share', label: 'Share with sandboxes', value: 'on', tone: 'ok' }
-            : {
-                id: 'share',
-                label: 'Share with sandboxes',
-                value: 'off  (turn on: sandbox config set github.shareToken true)',
-            },
-        s.gitAccess === 'full'
-            ? { id: 'gitAccess', label: 'Git access', value: 'full' }
-            : {
+const MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+const DAY_MS = 86_400_000;
+/** A token that expires within this many days is flagged. */
+export const EXPIRY_WARN_DAYS = 14;
+/** "3 Feb 2027". */
+function dateText(iso) {
+    const d = new Date(iso);
+    return d.getUTCDate() + ' ' + MONTHS[d.getUTCMonth()] + ' ' + d.getUTCFullYear();
+}
+/** How the expiry reads: "Expires 3 Feb 2027 (in 12 days)", "Expired 3 Feb 2027", and its tone. */
+export function expiryOf(expiresAt, now = Date.now()) {
+    if (!expiresAt || Number.isNaN(Date.parse(expiresAt)))
+        return null;
+    const left = Date.parse(expiresAt) - now;
+    const days = Math.ceil(left / DAY_MS);
+    if (left <= 0)
+        return { text: 'Expired ' + dateText(expiresAt), tone: 'danger', days };
+    return {
+        text: 'Expires ' + dateText(expiresAt) + ' (' + (days <= 1 ? 'today or tomorrow' : 'in ' + days + ' days') + ')',
+        tone: days < EXPIRY_WARN_DAYS ? 'warn' : 'ok',
+        days,
+    };
+}
+/** The state badge of a GitHub card (the B5 words), then "shared". */
+function badgesOf(s, now) {
+    const expiry = s.token === 'saved' ? expiryOf(s.expiresAt, now) : null;
+    const state = s.token === 'unreadable'
+        ? { text: "can't be read", tone: 'danger' }
+        : s.token === 'none'
+            ? { text: 'not saved', tone: 'muted' }
+            : expiry?.tone === 'danger'
+                ? { text: 'expired', tone: 'danger' }
+                : expiry?.tone === 'warn'
+                    ? { text: 'expires soon', tone: 'warn' }
+                    : { text: 'saved', tone: 'ok' };
+    return [state, ...(s.shareToken && s.token !== 'none' ? [{ text: 'shared', tone: 'accent' }] : [])];
+}
+/** The GitHub card (the "thing you connect" pattern): used by the GitHub page and the Accounts page. */
+export function githubItem(s, now = Date.now()) {
+    const expiry = s.token === 'saved' ? expiryOf(s.expiresAt, now) : null;
+    const badges = badgesOf(s, now);
+    const who = s.login && s.token === 'saved'
+        ? 'Signed in as ' +
+            s.login +
+            (s.repoCount !== null
+                ? ', reaches ' + (s.repoCount >= 100 ? '100 or more' : plural(s.repoCount, 'repository', 'repositories'))
+                : '')
+        : undefined;
+    const details = [
+        ...(who ? [who] : []),
+        ...(expiry ? [expiry.text] : []),
+        ...(s.token === 'unreadable' ? ['Only the Windows user that saved it can read it.'] : []),
+        ...(s.kind === 'classic' ? ['A classic token reaches every repository you can: a fine-grained one is safer.'] : []),
+    ].slice(0, 2);
+    const signIn = action(githubLogin, {}, { key: 'g', verb: 'sign in', label: s.token === 'none' ? 'Sign in…' : 'Sign in again…' });
+    const share = action(setSetting, { scope: 'user', key: 'github.shareToken', value: !s.shareToken }, {
+        key: 't',
+        verb: s.shareToken ? 'stop sharing' : 'share',
+        label: s.shareToken ? 'Stop sharing' : 'Share with sandboxes',
+        importance: 1,
+    });
+    return {
+        id: 'github',
+        label: 'GitHub',
+        hint: badges[0].text,
+        tone: badges[0].tone,
+        badges,
+        description: 'A token that lets agents in a sandbox use gh and git over https.',
+        ...(details.length ? { details } : {}),
+        primary: s.token === 'saved' ? share : signIn,
+        actions: s.token === 'none'
+            ? []
+            : [
+                ...(s.token === 'saved' ? [signIn] : []),
+                action(githubLogout, {}, { key: 'x', verb: 'remove', label: 'Remove…' }),
+            ],
+    };
+}
+/** The GitHub section (the card, the git-access fact, the warnings and the link that opens GitHub's form). */
+export function githubSection(s, now = Date.now()) {
+    const facts = s.gitAccess === 'full'
+        ? []
+        : [
+            {
                 id: 'gitAccess',
                 label: 'Git access',
                 value: s.gitAccess + '  (the token is only handed over with "full")',
                 tone: 'warn',
+                description: 'Change it in Settings (provisioning.git.access).',
             },
-        { id: 'token', label: 'Token', value: TOKEN_TEXT[s.token] + savedDate, tone: TOKEN_TONE[s.token] },
-        ...(s.kind
-            ? [
-                {
-                    id: 'kind',
-                    label: 'Kind',
-                    value: KIND_TEXT[s.kind],
-                    ...(s.kind === 'classic' ? { tone: 'warn' } : {}),
-                },
-            ]
-            : []),
-    ];
-    const notes = [
-        ...(s.token === 'none'
-            ? [{ text: 'Next: sandbox github login', tone: 'muted', only: 'cli' }]
-            : []),
-        ...(s.token === 'unreadable'
-            ? [
-                {
-                    text: 'Only the Windows user that saved it can read it. Save it again: sandbox github login',
-                    tone: 'muted',
-                },
-            ]
-            : []),
-        ...GITHUB_WARNINGS.map((text) => ({ text, tone: 'muted' })),
-    ];
-    const actions = [
-        action(githubLogin, {}, { key: 'g', verb: 'save token' }),
-        ...(s.token !== 'none' ? [action(githubLogout, {}, { key: 'x', verb: 'delete token' })] : []),
-    ];
-    const section = { id: 'github', facts, notes, actions };
-    return { title: 'GitHub', sections: [section] };
+        ];
+    const notes = GITHUB_WARNINGS.map((text) => ({ text, tone: 'muted' }));
+    const make = link({ kind: 'url', href: s.tokenUrl }, 'Make a new token…', {
+        key: 'n',
+        verb: 'new token',
+        importance: 2,
+        description: "Opens GitHub's form with a name, an expiry and the permissions already filled in.",
+    });
+    return {
+        id: 'github',
+        title: 'GitHub',
+        facts,
+        items: [githubItem(s, now)],
+        notes,
+        actions: [make],
+    };
+}
+/** The status page: the card, the git access it needs, the warnings and how to make a new token. */
+export function githubPage(s, now = Date.now()) {
+    return { title: 'GitHub', sections: [githubSection(s, now)] };
 }
 export const githubView = defineView({
     id: 'github',
     title: 'GitHub',
     summary: 'A GitHub token for sandboxes: whether they get it, and the saved token.',
     queries: { status: githubStatus },
-    operations: [githubLogin, githubLogout],
+    operations: [githubLogin, githubLogout, setSetting],
     build: ({ status }) => githubPage(status),
 });

package/dist/app/features/github/github.run.d.ts

@@ -1,7 +1,9 @@
-import { GithubToken } from '../../../host/github/index.js';
+import { GithubToken, type GithubVerdict } from '../../../host/github/index.js';
 import { type OperationIO } from '../../kernel/index.js';
+/** Asks GitHub about a token just typed (the self-test passes its own). */
+export type VerifyToken = (token: string) => Promise<GithubVerdict>;
 /** Asks for the token (one hidden question) and saves it. The validator answers with fixed texts only. */
-export declare function saveGithubTokenFlow(io: OperationIO, store: GithubToken): Promise<{
+export declare function saveGithubTokenFlow(io: OperationIO, store: GithubToken, verify?: VerifyToken): Promise<{
     message: string;
 }>;
 /** Deletes the saved token after asking (the CLI's typed logout is the answer). */
@@ -26,6 +28,11 @@ export declare const githubStatusRun: import("../../kernel/define.js").Implement
         classic: "classic";
     }>>;
     savedAt: import("zod").ZodNullable<import("zod").ZodString>;
+    login: import("zod").ZodNullable<import("zod").ZodString>;
+    expiresAt: import("zod").ZodNullable<import("zod").ZodString>;
+    repoCount: import("zod").ZodNullable<import("zod").ZodNumber>;
+    checkedAt: import("zod").ZodNullable<import("zod").ZodString>;
+    tokenUrl: import("zod").ZodString;
 }, import("zod/v4/core").$strip>, "github.status">, import("../../../cli/commands/context.js").Context>;
 export declare const githubLoginRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").OperationDef<import("zod").ZodObject<{}, import("zod/v4/core").$strict>, import("zod").ZodObject<{
     message: import("zod").ZodString;

package/dist/app/features/github/github.run.js

@@ -1,14 +1,16 @@
 // The GitHub feature's work: its status, saving the token through io.secret (kept only for the save, never returned,
 // logged or shown), and deleting it after a confirmation. The flows take the store, so the self-test runs them with a
 // store of its own.
+import os from 'node:os';
 import { requireOnPc } from '../../../cli/commands/context.js';
-import { GithubToken } from '../../../host/github/index.js';
+import { fail } from '../../../core/util/index.js';
+import { GithubToken, verifyGithubToken } from '../../../host/github/index.js';
 import { githubTokenProblem } from '../../../shared/github/index.js';
 import { implement } from '../../context.js';
 import { cancelled } from '../../kernel/index.js';
-import { GITHUB_STEPS, GITHUB_WARNINGS, githubLogin, githubLogout, githubStatus } from './github.def.js';
+import { GITHUB_STEPS, GITHUB_WARNINGS, expiryOf, githubLogin, githubLogout, githubStatus, tokenUrlFor, } from './github.def.js';
 /** Asks for the token (one hidden question) and saves it. The validator answers with fixed texts only. */
-export async function saveGithubTokenFlow(io, store) {
+export async function saveGithubTokenFlow(io, store, verify = verifyGithubToken) {
     io.log('Make a GitHub token only for sandboxes:');
     GITHUB_STEPS.forEach((s, i) => io.log('  ' + (i + 1) + '. ' + s));
     io.log('What you type is not shown. It is kept encrypted for your Windows user and never printed.', 'muted');
@@ -18,11 +20,42 @@ export async function saveGithubTokenFlow(io, store) {
     });
     if (token === undefined)
         cancelled();
-    const kind = store.save(token.trim());
+    // GitHub says whose token it is and when it ends; one it refuses is not saved. No answer (offline) is not a refusal.
+    io.progress('Asking GitHub about the token');
+    const verdict = await verify(token.trim());
+    if (verdict.kind === 'refused')
+        fail('GitHub refused this token.', 'Copy it again from GitHub, and check that it has not expired or been revoked.');
+    if (verdict.kind === 'unreachable')
+        io.log('The token could not be checked (' + verdict.reason + ') and is saved without a check.', 'warn');
+    const check = verdict.kind === 'ok'
+        ? {
+            login: verdict.check.login,
+            expiresAt: verdict.check.expiresAt,
+            repoCount: verdict.check.repos.count,
+            checkedAt: new Date().toISOString(),
+        }
+        : undefined;
+    const kind = store.save(token.trim(), check);
+    if (verdict.kind === 'ok') {
+        const { repos } = verdict.check;
+        io.log('GitHub says this is ' +
+            verdict.check.login +
+            '. It reaches ' +
+            repos.count +
+            (repos.count >= 100 ? ' or more' : '') +
+            ' repositories' +
+            (repos.sample.length
+                ? ' (' + repos.sample.join(', ') + (repos.count > repos.sample.length ? ', ...' : '') + ')'
+                : '') +
+            '.', 'ok');
+        const expiry = expiryOf(verdict.check.expiresAt);
+        if (expiry)
+            io.log(expiry.text + '.', expiry.tone === 'ok' ? 'muted' : 'warn');
+    }
     GITHUB_WARNINGS.forEach((w) => io.log(w, 'warn'));
     if (kind === 'classic')
         io.log('This is a classic token: it reaches every repository you can. A fine-grained one is safer.', 'warn');
-    return { message: 'Saved. Sandboxes get it once you turn it on: sandbox config set github.shareToken true' };
+    return { message: 'Saved. Sandboxes get it once you turn on Share the token with sandboxes.' };
 }
 /** Deletes the saved token after asking (the CLI's typed logout is the answer). */
 export async function deleteGithubTokenFlow(io, store) {
@@ -47,6 +80,11 @@ export const githubStatusRun = implement(githubStatus, async (ctx) => {
         token,
         kind: token === 'none' ? null : store.kind(),
         savedAt: token === 'none' ? null : store.savedAt(),
+        login: token === 'none' ? null : (store.check()?.login ?? null),
+        expiresAt: token === 'none' ? null : (store.check()?.expiresAt ?? null),
+        repoCount: token === 'none' ? null : (store.check()?.repoCount ?? null),
+        checkedAt: token === 'none' ? null : (store.check()?.checkedAt ?? null),
+        tokenUrl: tokenUrlFor(os.hostname()),
     };
 });
 export const githubLoginRun = implement(githubLogin, async (ctx, _input, io) => {

package/dist/app/features/health/health.def.js

@@ -96,7 +96,7 @@ export function resultLines(r) {
     if (r.means)
         out.push({ text: '      What it means: ' + r.means });
     if (r.fixable && r.plan)
-        out.push({ text: '      Fix: sandbox repair will ' + r.plan });
+        out.push({ text: '      Fix: repair will ' + r.plan });
     else if (r.fix)
         out.push({ text: '      Fix: ' + r.fix });
     const lines = r.lines ?? [];
@@ -277,7 +277,13 @@ export function healthPage(o) {
                     ],
                 })),
             notes: canEnable
-                ? [{ text: 'Turn Windows Sandbox on from the menu or with sandbox setup.', tone: 'muted', only: 'web' }]
+                ? [
+                    {
+                        text: 'Windows asks for administrator permission to turn this on, so do it at this PC from Maintenance > Health in the menu.',
+                        tone: 'muted',
+                        only: 'web',
+                    },
+                ]
                 : [],
         });
     }

package/dist/app/features/logs/logs.def.js

@@ -92,14 +92,6 @@ export function logsPage(files, tail) {
     return {
         title: 'Logs',
         sections: [{ id: 'files', items }, ...tailSection],
-        actions: [
-            // The web hides command links (it follows live instead); this one stays because `logs` is a hand-written command.
-            link({ kind: 'command', argv: ['logs', '--follow'] }, 'Follow the newest log', {
-                key: 'f',
-                verb: 'follow in the terminal',
-                importance: 2,
-            }),
-        ],
         empty: { title: 'No logs yet', text: 'Logs appear after the first start.', cliText: 'No sandbox logs yet.' },
     };
 }

package/dist/app/features/projects/projects.def.js

@@ -151,7 +151,7 @@ export function projectsPage(o) {
             {
                 id: 'roots',
                 label: 'Roots',
-                value: o.roots.length ? o.roots.join(', ') : 'none (sandbox projects roots add <folder>)',
+                value: o.roots.length ? o.roots.join(', ') : 'none',
             },
         ],
         actions: [
@@ -185,7 +185,7 @@ export function projectsPage(o) {
         columnsOn: 'cli',
         items: o.projects.map(projectItem),
         notes: o.projects.length === 0
-            ? [{ text: 'No projects yet: start one with sandbox claude in its folder.', tone: 'muted' }]
+            ? [{ text: 'No projects yet: start an agent in a project folder.', tone: 'muted' }]
             : [{ text: '* = this folder.  Choose with: sandbox projects choose', tone: 'muted', only: 'cli' }],
     };
     return {

package/dist/app/features/projects/projects.run.js

@@ -11,7 +11,7 @@ import { addProject, allProjects, chooseProjects, excludeProject, includeProject
 const NEXT_START = 'This changes what is mapped from the next start.';
 function runningNote() {
     return isSandboxRunning()
-        ? ' The running sandbox keeps what it has; start a project in it (sandbox claude there) and it joins without a restart when it can, or you are offered one.'
+        ? ' The running sandbox keeps what it has; start a project in it (from its folder) and it joins without a restart when it can, or you are offered one.'
         : '';
 }
 /** The folder given, or one picked from the known projects (or this folder) when it was left out. */
@@ -39,7 +39,7 @@ export const chooseProjectsRun = implement(chooseProjects, async (ctx, _input, i
     const rows = service.rows().filter((r) => !r.root);
     if (!rows.length)
         return {
-            message: 'No projects to choose from yet (projects in a root are always mapped with it). Start one with sandbox claude in its folder.',
+            message: 'No projects to choose from yet (projects in a root are always mapped with it). Start an agent in a project folder first.',
         };
     const all = service.settings().all;
     const picked = await io.checklist({
@@ -108,7 +108,7 @@ function includeOrExcludeText(service, action, dir, changed) {
         ? (action === 'exclude' ? 'Excluded ' : 'Included ') + path.resolve(dir) + '. ' + NEXT_START
         : 'Nothing changed.') +
         (action === 'include' && !service.settings().all
-            ? ' Mapping all projects is off: sandbox projects all on maps your projects at every start.'
+            ? ' Mapping all projects is off: turn it on in Projects to map them at every start.'
             : '') +
         (changed ? runningNote() : ''));
 }
@@ -131,11 +131,11 @@ export const projectRootsRun = implement(projectRoots, async (ctx, input, io) =>
     if (input.change === 'list') {
         const list = service.settings().roots;
         return {
-            message: list.length ? list.join('\n') : 'No project roots. Add one: sandbox projects roots add <folder>',
+            message: list.length ? list.join('\n') : 'No project roots. Add one on the Projects page.',
         };
     }
     if (!input.rootFolder)
-        fail('Which folder?', 'Usage: sandbox projects roots ' + input.change + ' <folder>');
+        fail('Which folder?', 'Give the folder to ' + input.change + '.');
     if (input.change === 'add') {
         const { dir, added } = service.addRoot(input.rootFolder);
         return {

package/dist/app/features/sandbox/sandbox.def.js

@@ -191,7 +191,7 @@ function facts(o) {
         }),
         ...(s.running
             ? [
-                fact('window', 'Window', s.headless ? 'hidden (sandbox show opens it)' : 'shown'),
+                fact('window', 'Window', s.headless ? 'hidden' : 'shown'),
                 fact('uptime', 'Uptime', uptime(s) ?? '-'),
                 // The session count is its own fact: the helper only says whether it answers.
                 fact('helper', 'Helper', s.daemon === '-' ? '-' : s.daemon.startsWith('pong') ? 'Responding' : s.daemon),
@@ -200,7 +200,7 @@ function facts(o) {
             : []),
         ...(o.leftover ? [fact('leftover', 'Windows Sandbox', o.leftover.text, { tone: 'warn' })] : []),
         ...(o.lastEnd ? [fact('lastEnd', 'Last sandbox', o.lastEnd.text, { tone: 'warn' })] : []),
-        fact('account', 'Account', s.account ?? 'none selected (sandbox account use)'),
+        fact('account', 'Account', s.account ?? 'none selected'),
         fact('sync', 'Background sync', s.syncWatcher ? 'on' : 'off'),
     ];
 }
@@ -216,10 +216,11 @@ function projectsSection(o) {
         id: 'projects',
         title: 'Projects',
         items: [...o.projects.map(projectItem), ...roots],
+        ...(here ? {} : { actions: [link({ kind: 'view', view: 'agents' }, 'Start an agent here…', { verb: 'start' })] }),
         notes: [
             here
                 ? { text: '* = the project of this folder', tone: 'muted' }
-                : { text: o.here.folder + ' is not in this sandbox (start it here: sandbox claude)', tone: 'muted' },
+                : { text: o.here.folder + ' is not in this sandbox.', tone: 'muted' },
         ],
     };
 }
@@ -254,6 +255,9 @@ export function sandboxPage(o) {
         facts: facts(o),
         // Only the window action that changes something: show a hidden window, hide a shown one.
         actions: [
+            ...(running && !o.sandbox.account
+                ? [link({ kind: 'view', view: 'accounts' }, 'Choose an account…', { verb: 'choose', importance: 4 })]
+                : []),
             ...(o.leftover ? [action(cleanUpSandbox, {}, { key: 'c', verb: 'clean up', importance: 1 })] : []),
             ...(running
                 ? [

package/dist/app/features/sessions/sessions.def.d.ts

@@ -12,9 +12,9 @@ export declare const SessionRowSchema: z.ZodObject<{
     cwd: z.ZodString;
     project: z.ZodOptional<z.ZodString>;
     phase: z.ZodEnum<{
+        running: "running";
         failed: "failed";
         starting: "starting";
-        running: "running";
         exited: "exited";
     }>;
     message: z.ZodString;
@@ -47,9 +47,9 @@ export declare const SessionsListSchema: z.ZodObject<{
         cwd: z.ZodString;
         project: z.ZodOptional<z.ZodString>;
         phase: z.ZodEnum<{
+            running: "running";
             failed: "failed";
             starting: "starting";
-            running: "running";
             exited: "exited";
         }>;
         message: z.ZodString;
@@ -89,9 +89,9 @@ export declare const listSessions: import("../../kernel/define.js").QueryDef<z.Z
         cwd: z.ZodString;
         project: z.ZodOptional<z.ZodString>;
         phase: z.ZodEnum<{
+            running: "running";
             failed: "failed";
             starting: "starting";
-            running: "running";
             exited: "exited";
         }>;
         message: z.ZodString;
@@ -155,9 +155,9 @@ export declare const sessionsView: import("../../kernel/define.js").ViewDef<{
             cwd: z.ZodString;
             project: z.ZodOptional<z.ZodString>;
             phase: z.ZodEnum<{
+                running: "running";
                 failed: "failed";
                 starting: "starting";
-                running: "running";
                 exited: "exited";
             }>;
             message: z.ZodString;

package/dist/app/features/sessions/sessions.def.js

@@ -221,11 +221,6 @@ export function sessionsPage(o) {
             ...(sessions.length
                 ? [action(restartSessions, { all: false }, { key: 'r', verb: 'restart agents', importance: 1 })]
                 : []),
-            link({ kind: 'command', argv: ['resume'] }, 'Reopen last sessions', {
-                key: 'o',
-                verb: 'reopen last sessions',
-                importance: 2,
-            }),
         ],
         empty: {
             title: o.sandboxRunning ? 'No sessions' : 'No sandbox is running',

package/dist/app/features/sessions/sessions.run.d.ts

@@ -17,9 +17,9 @@ export declare const listSessionsRun: import("../../kernel/define.js").Implement
         cwd: import("zod").ZodString;
         project: import("zod").ZodOptional<import("zod").ZodString>;
         phase: import("zod").ZodEnum<{
+            running: "running";
             failed: "failed";
             starting: "starting";
-            running: "running";
             exited: "exited";
         }>;
         message: import("zod").ZodString;