windows-development-sandbox 1.4.1 → 1.5.0

package/dist/selftest/local-config.test.js

@@ -3,8 +3,8 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { download, setChecksumRequired } from '../shared/download.js';
-import { allowedAnswer, allowStorePath, saveAllowed } from '../core/local-config.js';
+import { Downloader } from '../shared/download/index.js';
+import { allowedAnswer, allowStorePath, saveAllowed } from '../core/local-config/index.js';
 export const localConfigSuite = {
     name: 'local-config',
     title: '.sandbox-config.json: approval, tighten-only rules, validation',
@@ -14,13 +14,15 @@ export const localConfigSuite = {
             harness: 'codex',
             sandbox: { memoryMb: 4096, networking: false, headless: true },
             toolchains: { node: { version: '18' }, rust: { enabled: false } },
-            mappings: [{ host: './assets', guest: 'C:\\Assets', readOnly: true }, { host: './data', guest: 'C:\\Data', readOnly: false }],
+            mappings: [
+                { host: './assets', guest: 'C:\\Assets', readOnly: true },
+                { host: './data', guest: 'C:\\Data', readOnly: false },
+            ],
             scripts: ['./setup.mjs'],
         };
         f.writeLocal(f.workB, localB);
         const untrusted = await t.thrownMessage(() => f.run({ cwd: f.workB }));
-        t.includes(untrusted, '--trust-config', 'an untrusted .sandbox-config.json is refused, with the way to approve it');
-        t.includes(untrusted, 'READ/WRITE', 'the refusal lists what the file would change (read/write folders)');
+        t.check(untrusted.includes('--trust-config') && untrusted.includes('READ/WRITE'), 'an untrusted .sandbox-config.json is refused, with the way to approve it and what it would change', untrusted);
         await t.throws(() => f.run({ cwd: f.workB, ask: async () => false }), 'has not been approved', 'answering "no" refuses it');
         const approved = await f.run({ cwd: f.workB, ask: async () => true });
         t.equal({
@@ -30,13 +32,22 @@ export const localConfigSuite = {
             rustEnabled: approved.config.toolchains.rust.enabled,
             pythonStillOn: Boolean(approved.config.toolchains.python.enabled),
             nodeSource: approved.versions.node.source,
-        }, { harness: 'codex', memoryMb: 4096, headless: true, rustEnabled: false, pythonStillOn: true, nodeSource: '.sandbox-config.json' }, 'approved local settings apply over the defaults (including toolchains and headless)');
-        t.check(approved.config.mappings.some((m) => m.host === path.join(f.workB, 'data') && !m.readOnly), 'relative mapping paths resolve against the folder of .sandbox-config.json', 'mappings: ' + JSON.stringify(approved.config.mappings));
-        t.check(approved.scripts.includes(path.join(f.workB, 'setup.mjs')), 'relative script paths resolve against the folder of .sandbox-config.json', 'scripts: ' + JSON.stringify(approved.scripts));
-        t.equal((await f.run({ cwd: f.workB })).harnessName, 'codex', 'an approval is remembered');
-        t.equal((await f.run({ cwd: f.workB, noLocalConfig: true })).harnessName, 'claude', '--no-local-config ignores the file');
-        t.equal((await f.run({ cwd: f.workB, harness: 'gemini' })).harnessName, 'gemini', '--harness beats the file');
-        t.equal((await f.run({ cwd: f.workB, headless: false })).config.sandbox.headless, false, '--window beats a local headless setting');
+        }, {
+            harness: 'codex',
+            memoryMb: 4096,
+            headless: true,
+            rustEnabled: false,
+            pythonStillOn: true,
+            nodeSource: '.sandbox-config.json',
+        }, 'approved local settings apply over the defaults (including toolchains and headless)');
+        t.check(approved.config.mappings.some((m) => m.host === path.join(f.workB, 'data') && !m.readOnly) &&
+            approved.scripts.includes(path.join(f.workB, 'setup.mjs')), 'relative mapping and script paths resolve against the folder of .sandbox-config.json', JSON.stringify(approved.config.mappings));
+        t.equal([
+            (await f.run({ cwd: f.workB })).harnessName,
+            (await f.run({ cwd: f.workB, noLocalConfig: true })).harnessName,
+            (await f.run({ cwd: f.workB, harness: 'gemini' })).harnessName,
+            (await f.run({ cwd: f.workB, headless: false })).config.sandbox.headless,
+        ], ['codex', 'claude', 'gemini', false], 'an approval is remembered; --no-local-config ignores the file; --harness and --window beat it');
         f.writeLocal(f.workB, { ...localB, sandbox: { memoryMb: 6144 } });
         await t.throws(() => f.run({ cwd: f.workB }), 'has not been approved', 'changing the file requires approval again');
         t.section('validation');
@@ -50,39 +61,54 @@ export const localConfigSuite = {
         await rejectedBecause({ claudeProfile: { hostDir: 'C:\\x' } }, 'claudeProfile.hostDir is not allowed', 'a project file cannot point at the Claude profile folder');
         await rejectedBecause({ toolchains: { node: { hostDir: 'x' } } }, 'toolchains.node.hostDir is not allowed', 'a project file cannot point at host tool folders');
         await rejectedBecause({ sandbox: { memoryMb: 12 } }, 'sandbox.memoryMb:', 'values are type-checked (memory too small)');
-        await rejectedBecause({ provisioning: { git: { access: 'admin' } } }, 'provisioning.git.access:', 'unknown git access modes are rejected');
         await rejectedBecause('{\n  // a comment\n  "readOnly": tru\n}', 'line 3', 'broken JSON is reported with its line');
         await rejectedBecause({ _comment: 'old style' }, '_comment is not allowed', 'unknown keys are rejected');
         f.writeLocal(dirC, '// comments and trailing commas are fine\n{\n  "readOnly": true, /* inline */\n}\n');
         t.equal((await f.run({ cwd: dirC, trustConfig: true })).config.readOnly, true, '.sandbox-config.json may contain comments and trailing commas');
         t.section('folders outside the project (projects.allowOutsideMappings)');
         const dirD = t.dir('work-d');
-        const withOutside = (setting) => ({ ...f.baseConfig, projects: { ...f.baseConfig.projects, allowOutsideMappings: setting } });
+        const withOutside = (setting) => ({
+            ...f.baseConfig,
+            projects: { ...f.baseConfig.projects, allowOutsideMappings: setting },
+        });
         const outsideFile = { mappings: [{ host: '../shared', readOnly: true }] };
         f.writeLocal(dirD, outsideFile);
         const notAllowed = await t.thrownMessage(() => f.run({ cwd: dirD, trustConfig: true }, withOutside(false)));
-        t.check(notAllowed.includes('outside the project') && notAllowed.includes(f.shared) && notAllowed.includes('projects.allowOutsideMappings'), 'false: refused, naming the folder and the setting that allows it', notAllowed);
+        t.check(notAllowed.includes('outside the project') &&
+            notAllowed.includes(f.shared) &&
+            notAllowed.includes('projects.allowOutsideMappings'), 'false: refused, naming the folder and the setting that allows it', notAllowed);
         const allowedOutside = await f.run({ cwd: dirD, trustConfig: true }, withOutside(true));
-        t.check(allowedOutside.config.mappings.some((m) => m.host === f.shared) && (allowedOutside.outsideMappings ?? []).includes(f.shared), 'true: allowed, and marked as outside the project');
-        f.writeLocal(dirD, { ...outsideFile, readOnly: true });
-        t.includes(await t.thrownMessage(() => f.run({ cwd: dirD }, withOutside(true))), '(outside the project)', 'true: still listed, flagged, when you approve the file');
+        t.check(allowedOutside.config.mappings.some((m) => m.host === f.shared) &&
+            (allowedOutside.outsideMappings ?? []).includes(f.shared), 'true: allowed, and marked as outside the project');
         const asking = await t.thrownMessage(() => f.run({ cwd: dirD, trustConfig: true, ask: async () => true, interactive: false }));
-        t.check(asking.includes('projects.allowOutsideMappings') && asking.includes('interactive'), '"ask" without a terminal (even with --trust-config): refused, naming the setting and that an interactive launch asks', asking);
+        t.check(asking.includes('projects.allowOutsideMappings') && asking.includes('interactive'), '"ask" without a terminal (even with --trust-config) is refused', asking);
         t.includes(await t.thrownMessage(() => f.run({ cwd: dirD, trustConfig: true, ask: async () => false, interactive: true })), 'You did not allow', '"ask": answering no stops the launch');
         const questions = [];
         f.writeLocal(dirD, { ...outsideFile, sandbox: { vGpu: true } });
-        const asked = await f.run({ cwd: dirD, trustConfig: true, interactive: true, ask: async (q) => { questions.push(q); return true; } });
-        t.check(questions.length === 1 && asked.config.sandbox.vGpu && asked.config.mappings.some((m) => m.host === f.shared), '"ask": the folder and a looser setting (vGPU) are asked together, once', JSON.stringify(questions));
-        t.check((await f.run({ cwd: dirD, trustConfig: true, interactive: false })).config.mappings.some((m) => m.host === f.shared), '"ask": the answer is remembered for this project file');
+        const asked = await f.run({
+            cwd: dirD,
+            trustConfig: true,
+            interactive: true,
+            ask: async (q) => {
+                questions.push(q);
+                return true;
+            },
+        });
+        t.check(questions.length === 1 &&
+            asked.config.sandbox.vGpu &&
+            asked.config.mappings.some((m) => m.host === f.shared) &&
+            (await f.run({ cwd: dirD, trustConfig: true, interactive: false })).config.mappings.some((m) => m.host === f.shared), '"ask": the folder and a looser setting (vGPU) are asked together, once, and the answer is remembered', JSON.stringify(questions));
         // What counts as outside is where the folder really is: environment variables are expanded and links followed.
         f.writeLocal(dirD, { mappings: [{ host: '%APPDATA%', readOnly: false }] });
-        t.includes(await t.thrownMessage(() => f.run({ cwd: dirD, trustConfig: true }, withOutside(false))), 'outside the project', '%VAR% is expanded before deciding inside or outside');
+        const viaVariable = await t.thrownMessage(() => f.run({ cwd: dirD, trustConfig: true }, withOutside(false)));
         fs.symlinkSync(f.shared, path.join(dirD, 'link'), 'junction');
         f.writeLocal(dirD, { mappings: [{ host: './link', readOnly: true }] });
-        t.includes(await t.thrownMessage(() => f.run({ cwd: dirD, trustConfig: true }, withOutside(false))), 'outside the project', 'a link inside the project to a folder outside counts as outside');
+        const viaLink = await t.thrownMessage(() => f.run({ cwd: dirD, trustConfig: true }, withOutside(false)));
         fs.rmSync(path.join(dirD, 'link'));
         f.writeLocal(dirD, { mappings: [{ host: './assets', readOnly: true }] });
-        t.check((await f.run({ cwd: dirD, trustConfig: true }, withOutside(false))).config.mappings.some((m) => m.host === path.join(dirD, 'assets')), 'a folder inside the project needs no permission');
+        t.check(viaVariable.includes('outside the project') &&
+            viaLink.includes('outside the project') &&
+            (await f.run({ cwd: dirD, trustConfig: true }, withOutside(false))).config.mappings.some((m) => m.host === path.join(dirD, 'assets')), 'outside means where the folder really is (%VAR% expanded, links followed); a folder inside needs no permission');
         t.section('a project can only tighten protections');
         // Settings that would loosen a protection are listed before approval, then ignored.
         f.writeLocal(dirC, {
@@ -102,7 +128,6 @@ export const localConfigSuite = {
         };
         const keptRun = await f.run({ cwd: dirC, trustConfig: true }, strictUser);
         const kept = keptRun.config;
-        t.check(keptRun.notes.some((n) => n.includes('sandbox.vGpu = true') && n.includes('your own settings')), 'what a project asked for and did not get is said at launch, with how to allow it', keptRun.notes.join('\n'));
         t.equal({
             readOnly: kept.readOnly,
             blockPrivateRanges: kept.network.blockPrivateRanges,
@@ -112,34 +137,56 @@ export const localConfigSuite = {
             networking: kept.sandbox.networking,
             protectedClient: kept.sandbox.protectedClient,
             copyCredentials: kept.claudeProfile.copyCredentials,
-        }, { readOnly: true, blockPrivateRanges: true, gitAccess: 'readonly', vGpu: false, clipboard: false, networking: false, protectedClient: true, copyCredentials: false }, 'a project file can never loosen network, git, read-only, GPU, clipboard or login settings');
+        }, {
+            readOnly: true,
+            blockPrivateRanges: true,
+            gitAccess: 'readonly',
+            vGpu: false,
+            clipboard: false,
+            networking: false,
+            protectedClient: true,
+            copyCredentials: false,
+        }, 'a project file can never loosen network, git, read-only, GPU, clipboard or login settings');
+        t.check(keptRun.notes.some((n) => n.includes('sandbox.vGpu = true') && n.includes('your own settings')), 'what a project asked for and did not get is said at launch, with how to allow it', keptRun.notes.join('\n'));
         // You allowed one request for this project (asked once at an interactive launch): only that one is let through.
         const store = allowStorePath(strictUser.storage.root);
         saveAllowed(store, path.join(dirC, '.sandbox-config.json'), 'sandbox.vGpu', true, true);
         saveAllowed(store, path.join(dirC, '.sandbox-config.json'), 'sandbox.clipboard', true, false);
         const allowedRun = await f.run({ cwd: dirC, trustConfig: true }, strictUser);
-        t.equal({ vGpu: allowedRun.config.sandbox.vGpu, clipboard: allowedRun.config.sandbox.clipboard, networking: allowedRun.config.sandbox.networking }, { vGpu: true, clipboard: false, networking: false }, 'a request you allowed for this project is used; one you declined and the others are not');
-        t.check(allowedRun.notes.some((n) => n.includes('Allowed for this project: sandbox.vGpu')) && allowedRun.notes.some((n) => n.includes('sandbox.clipboard') && n.includes('You said no')), 'launch says what was allowed and what you declined', allowedRun.notes.join('\n'));
-        t.equal(allowedAnswer(store, path.join(f.workB, '.sandbox-config.json'), 'sandbox.vGpu', true), null, 'an answer is kept per project file');
-        f.writeLocal(dirC, { readOnly: true, network: { blockPrivateRanges: true }, provisioning: { git: { access: 'none' } }, sandbox: { networking: false, clipboard: false } });
+        t.check(allowedRun.config.sandbox.vGpu === true &&
+            allowedRun.config.sandbox.clipboard === false &&
+            allowedRun.config.sandbox.networking === false &&
+            allowedAnswer(store, path.join(f.workB, '.sandbox-config.json'), 'sandbox.vGpu', true) === null &&
+            allowedRun.notes.some((n) => n.includes('Allowed for this project: sandbox.vGpu')) &&
+            allowedRun.notes.some((n) => n.includes('sandbox.clipboard') && n.includes('You said no')), 'a request you allowed for this project is used and said so; one you declined and the others are not; answers are per project file', allowedRun.notes.join('\n'));
+        f.writeLocal(dirC, {
+            readOnly: true,
+            network: { blockPrivateRanges: true },
+            provisioning: { git: { access: 'none' } },
+            sandbox: { networking: false, clipboard: false },
+        });
         const tightened = (await f.run({ cwd: dirC, trustConfig: true })).config;
-        t.equal({ readOnly: tightened.readOnly, gitAccess: tightened.provisioning.git.access, networking: tightened.sandbox.networking, clipboard: tightened.sandbox.clipboard }, { readOnly: true, gitAccess: 'none', networking: false, clipboard: false }, 'a project file can still make things stricter');
+        t.equal([
+            tightened.readOnly,
+            tightened.provisioning.git.access,
+            tightened.sandbox.networking,
+            tightened.sandbox.clipboard,
+        ], [true, 'none', false, false], 'a project file can still make things stricter');
         t.section('downloads.requireChecksum');
         f.writeLocal(dirC, { downloads: { requireChecksum: false } });
         const keptOn = (await f.run({ cwd: dirC, trustConfig: true }, { ...f.baseConfig, downloads: { requireChecksum: true } })).config;
         f.writeLocal(dirC, { downloads: { requireChecksum: true } });
         const turnedOn = (await f.run({ cwd: dirC, trustConfig: true })).config;
-        t.equal(keptOn.downloads.requireChecksum, true, 'a project file cannot switch the checksum requirement off');
-        t.equal(turnedOn.downloads.requireChecksum, true, 'a project file can switch the checksum requirement on');
-        t.equal(f.baseConfig.downloads.requireChecksum, false, '(the requirement is off in the defaults)');
+        t.check(keptOn.downloads.requireChecksum === true && turnedOn.downloads.requireChecksum === true, 'a project file cannot switch the checksum requirement off, but can switch it on');
         // With the requirement on, a download without a hash is refused before anything is fetched.
-        setChecksumRequired(true);
+        const strict = new Downloader();
+        strict.requireChecksum = true;
         const target = path.join(os.tmpdir(), 'agent-sandbox-no-such-download.bin');
-        const refused = await download('http://127.0.0.1:9/tool.zip', target).then(() => '', (e) => e.message);
-        setChecksumRequired(false);
-        t.includes(refused, 'requireChecksum', 'a download with no hash is refused when checksums are required');
-        t.includes(refused, 'tool.zip', 'the refusal names the download');
-        t.check(!fs.existsSync(target) && !fs.existsSync(target + '.part'), 'a refused download leaves nothing behind');
+        const refused = await strict.file('http://127.0.0.1:9/tool.zip', target).then(() => '', (e) => e.message);
+        t.check(refused.includes('requireChecksum') &&
+            refused.includes('tool.zip') &&
+            !fs.existsSync(target) &&
+            !fs.existsSync(target + '.part'), 'a download with no hash is refused when checksums are required, naming it, leaving nothing behind');
         fs.rmSync(path.join(dirC, '.sandbox-config.json'));
     },
 };

package/dist/selftest/menu-screens.d.ts

@@ -0,0 +1,2 @@
+/** All screens, at both sizes, as one text. `dir` is a scratch folder for the made-up config files. */
+export declare function renderScreens(dir: string): string;

package/dist/selftest/menu-screens.js

@@ -0,0 +1,224 @@
+// Draws every menu screen with made-up data through the same pure functions the menu uses, at two terminal sizes, as
+// plain text for reading (the menu-screens review file). No terminal, no sandbox, no services.
+import fs from 'node:fs';
+import path from 'node:path';
+import { Draft } from '../cli/menu/settings/draft.js';
+import { ConfigFile } from '../cli/menu/settings/config-file.js';
+import { AppsModel } from '../cli/menu/apps.js';
+import { accountsOptions } from '../cli/menu/pages/accounts-page.js';
+import { appsOptions } from '../cli/menu/pages/apps-page.js';
+import { maintenanceOptions } from '../cli/menu/pages/maintenance-page.js';
+import { sandboxOptions } from '../cli/menu/pages/sandbox-page.js';
+import { sessionsOptions } from '../cli/menu/pages/sessions-page.js';
+import { settingsOf, settingsOptions } from '../cli/menu/pages/settings-page.js';
+import { startOptions } from '../cli/menu/pages/start-page.js';
+import { TAB_LABELS } from '../cli/menu/shell.js';
+import { Frame, ListScreen, OverlayScreen, Text } from '../cli/tui/index.js';
+const SIZES = [
+    { width: 100, height: 30 },
+    { width: 80, height: 24 },
+];
+const NOW = Date.now();
+const ACCOUNTS = {
+    agents: [
+        { name: 'claude', kept: true, canSavePc: true },
+        { name: 'codex', kept: true, canSavePc: true },
+        { name: 'opencode', kept: false, canSavePc: false },
+    ],
+    rows: {
+        claude: [
+            { name: 'work', email: 'me@work.example', isDefault: true, isActive: true, savedAt: '2026-10-13T09:30:00Z' },
+            { name: 'home', email: null, isDefault: false, isActive: false, savedAt: '2026-10-01T18:00:00Z' },
+        ],
+        codex: [{ name: 'main', email: null, isDefault: true, isActive: false, savedAt: '2026-10-12T08:00:00Z' }],
+    },
+};
+const SESSIONS = [
+    {
+        id: '1791927991435-aa11bb',
+        harness: 'claude',
+        cwd: 'C:\\Projects\\api',
+        phase: 'running',
+        startedAt: new Date(NOW - 12 * 60000).toISOString(),
+        projectName: 'api',
+        here: true,
+        viewers: { remote: 1, viewers: 1 },
+    },
+    {
+        id: '1791927991436-cc22dd',
+        harness: 'codex',
+        cwd: 'C:\\Projects\\web',
+        phase: 'running',
+        startedAt: new Date(NOW - 95 * 60000).toISOString(),
+        projectName: 'web',
+        here: false,
+        viewers: { remote: 0, viewers: 0 },
+    },
+];
+/** Frame for one screen: the tabs, a status line, the list, the keys. */
+function draw(active, options, size, status = '', unsaved = 0) {
+    const body = { width: size.width, height: Frame.bodyHeight(size.height, true) };
+    const parts = new ListScreen(options).render(body);
+    return Frame.render({
+        ...parts,
+        keys: unsaved ? [['ctrl+s', 'save (' + unsaved + ')', 0], ...parts.keys] : parts.keys,
+        status: (unsaved ? 'unsaved: ' + unsaved + '   ' : '') + (parts.status ?? status),
+        tabs: { tabs: TAB_LABELS.map((label) => ({ label })), active },
+    }, size.width, size.height).map((l) => Text.strip(l).replace(/\s+$/, ''));
+}
+function block(title, lines, size) {
+    return ['=== ' + title + ' (' + size.width + 'x' + size.height + ') ===', ...lines, ''].join('\n');
+}
+/** All screens, at both sizes, as one text. `dir` is a scratch folder for the made-up config files. */
+export function renderScreens(dir) {
+    const user = ConfigFile.user(path.join(dir, 'config.json'));
+    fs.mkdirSync(path.join(dir, 'project'), { recursive: true });
+    const project = ConfigFile.project(path.join(dir, 'project'));
+    const files = { user, project };
+    const draft = new Draft();
+    const status = 'Sandbox running · 2 sessions   C:\\Projects\\api';
+    const sandbox = {
+        report: {
+            sandbox: {
+                running: true,
+                phase: 'ready',
+                message: undefined,
+                headless: true,
+                startedAt: NOW - 3 * 3600000,
+                daemon: 'pong',
+                account: 'work',
+                syncWatcher: true,
+            },
+            here: { folder: 'C:\\Projects\\api', project: 'api', guest: 'C:\\Projects\\api' },
+            roots: [],
+            projects: [],
+            otherSessions: [],
+            repoGuard: { guarded: 2, findings: [] },
+        },
+        projects: {
+            all: true,
+            roots: ['C:\\Projects'],
+            exclude: [],
+            projects: [
+                {
+                    folder: 'C:\\Projects\\api',
+                    here: true,
+                    known: true,
+                    root: 'C:\\Projects',
+                    excluded: false,
+                    mappedAtStart: true,
+                    running: 'api (root)',
+                },
+                {
+                    folder: 'F:\\Code\\scratch',
+                    here: false,
+                    known: true,
+                    root: null,
+                    excluded: false,
+                    mappedAtStart: true,
+                    running: null,
+                },
+            ],
+        },
+        databases: [
+            { name: 'postgres', running: true, port: 5432, title: 'PostgreSQL 18' },
+            { name: 'redis', running: false, port: 6379, title: 'Redis' },
+        ],
+    };
+    const maintenance = {
+        data: {
+            entries: [
+                { area: 'tools', name: 'rust', path: 'C:\\AgentData\\tools\\rust', bytes: 4.6e9 },
+                { area: 'tools', name: 'vscode', path: 'C:\\AgentData\\tools\\vscode', bytes: 2.5e9 },
+                { area: 'state', name: 'state/claude', path: 'C:\\AgentData\\state\\claude', bytes: 1.8e9 },
+                { area: 'host', name: 'accounts', path: 'C:\\Users\\me\\AppData\\Local\\AgentSandbox\\accounts', bytes: 4096 },
+            ],
+            disks: [{ drive: 'C:\\', totalBytes: 40e9, freeBytes: 22e9, usedBytes: 18e9, holdsStorage: true }],
+            total: 8.9e9,
+        },
+        logs: [
+            { name: 'guest-2026-10-14.log', path: 'x', bytes: 120000, modified: NOW - 60000 },
+            { name: 'daemon-2026-10-14.log', path: 'y', bytes: 8000, modified: NOW - 600000 },
+        ],
+        doctor: [
+            ['Windows Sandbox', 'available'],
+            ['Config file', 'C:\\Users\\me\\.agent-sandbox\\config.json'],
+        ],
+        repair: [
+            { name: 'Config file', status: 'ok', detail: 'valid' },
+            { name: 'Stale run folders', status: 'fixed', detail: 'removed 2' },
+            { name: 'Toolchain cache', status: 'needs-you', detail: 'close the sandbox first' },
+        ],
+        settings: { pending: ['2026-10-unpin-config-defaults: stop pinning old defaults in your config.json'] },
+        updates: {
+            managed: true,
+            version: '1.4.3',
+            scope: 'user',
+            autoUpdate: true,
+            state: {
+                previous: '1.4.2',
+                failed: { version: '1.4.4', at: '2026-10-13T03:00:00Z', reason: 'it did not start' },
+            },
+        },
+        latest: '1.5.0',
+        setup: {
+            facts: {},
+            canEnable: true,
+            checks: [
+                { name: 'Windows edition', status: 'ok', detail: 'Pro' },
+                { name: 'Windows Sandbox feature', status: 'action', detail: 'turned off' },
+            ],
+        },
+        more: [
+            { name: 'sync', summary: 'sync history now' },
+            { name: 'audit', summary: 'show what the sandbox did' },
+        ],
+    };
+    // Two unsaved changes in Settings.
+    const settings = settingsOf(user);
+    const harness = settings.find((s) => s.key.join('.') === 'defaultHarness');
+    const flag = settings.find((s) => s.node.editor === 'boolean');
+    if (harness)
+        draft.stage(user, harness.key, 'codex');
+    if (flag)
+        draft.stage(user, flag.key, !user.userConfig()[flag.key[0]]);
+    const apps = new AppsModel(user, path.join(dir, 'data'));
+    const appsDraft = new Draft();
+    apps.stageTicks(appsDraft, ['git-gui']);
+    const out = [];
+    for (const size of SIZES) {
+        out.push(block('1 Start', draw(0, startOptions({
+            folder: 'C:\\Projects\\api',
+            defaultAgent: 'claude',
+            agents: [
+                { name: 'claude', ready: true },
+                { name: 'codex', ready: false },
+                { name: 'gemini', ready: false },
+            ],
+            last: ['launch', '--harness', 'claude', '--terminal'],
+            attach: true,
+            window: 'config',
+            hostAgents: ['codex'],
+        }, 'C:\\Projects\\api'), size, status), size), block('2 Sessions', draw(1, sessionsOptions({ sandboxRunning: true, sessions: SESSIONS }), size, status), size), block('2 Sessions (no sandbox)', draw(1, sessionsOptions({ sandboxRunning: false, sessions: [] }), size), size));
+        for (const category of ['status', 'projects', 'databases'])
+            out.push(block('3 Sandbox · ' + category, draw(2, { ...sandboxOptions(sandbox), startCategory: category }, size, status), size));
+        out.push(block('4 Apps (1 unsaved)', draw(3, appsOptions(apps, user, appsDraft, 'user'), size, status, appsDraft.count()), size), block('5 Settings (2 unsaved)', draw(4, settingsOptions(files, 'user', draft), size, status, draft.count()), size));
+        // The leave dialog over the settings screen.
+        const background = new ListScreen(settingsOptions(files, 'user', draft));
+        const bodySize = { width: size.width, height: Frame.bodyHeight(size.height, true) };
+        const dialog = new OverlayScreen(background, {
+            title: 'Unsaved changes',
+            lines: ['You have 2 unsaved changes in Settings and Apps.'],
+            choices: [
+                { value: 'save', label: 'Save', key: 's' },
+                { value: 'discard', label: 'Discard', key: 'd', danger: true },
+                { value: 'cancel', label: 'Cancel', key: 'c' },
+            ],
+            escape: 'cancel',
+        });
+        out.push(block('5 Settings: Save / Discard / Cancel', Frame.render({ ...dialog.render(bodySize), tabs: { tabs: TAB_LABELS.map((label) => ({ label })), active: 4 } }, size.width, size.height).map((l) => Text.strip(l).replace(/\s+$/, '')), size), block('6 Accounts', draw(5, accountsOptions(ACCOUNTS), size, status), size), block('6 Accounts · codex', draw(5, { ...accountsOptions(ACCOUNTS), startCategory: 'codex' }, size, status), size), block('6 Accounts · opencode (login not kept)', draw(5, { ...accountsOptions(ACCOUNTS), startCategory: 'opencode' }, size, status), size));
+        for (const category of ['data', 'logs', 'doctor', 'repair', 'settings', 'updates', 'setup', 'more'])
+            out.push(block('7 Maintenance · ' + category, draw(6, { ...maintenanceOptions(maintenance), startCategory: category }, size, status), size));
+    }
+    return out.join('\n');
+}

package/dist/selftest/menu.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const menuSuite: Suite;

package/dist/selftest/menu.test.js

@@ -0,0 +1,149 @@
+// The menu's pure parts: the tab bar and key bar at every width, the dialog box, the Draft of unsaved changes, and
+// the tab pages' lists. With MENU_SCREENS_OUT set it also writes every screen as text there, for review.
+import fs from 'node:fs';
+import { ConfigFile } from '../cli/menu/settings/config-file.js';
+import { Draft } from '../cli/menu/settings/draft.js';
+import { hostAgentsToShow, startArgv } from '../cli/menu/pages/start-page.js';
+import { TAB_LABELS } from '../cli/menu/shell.js';
+import { DEFAULTS } from '../core/config/index.js';
+import { HarnessSchema } from '../core/schema/index.js';
+import { profileLinkPairs } from '../shared/paths/index.js';
+import { AccountsService, parseDatabaseList } from '../cli/services/index.js';
+import { dialogBox, KeyBar, overlayBox, TabBar, Text } from '../cli/tui/index.js';
+import { renderScreens } from './menu-screens.js';
+const WIDTHS = [120, 80, 40];
+export const menuSuite = {
+    name: 'menu',
+    title: 'menu tabs, key bar, dialogs and unsaved changes',
+    run: async (t) => {
+        t.section('tab bar and key bar');
+        const tabs = TAB_LABELS.map((label) => ({ label }));
+        const tooWide = [];
+        for (const width of WIDTHS)
+            for (const active of [0, 3, 6]) {
+                const line = TabBar.render(tabs, active, width);
+                if (Text.width(line) > width || !Text.strip(line).includes(TAB_LABELS[active]))
+                    tooWide.push(width + '/' + active);
+            }
+        t.equal(tooWide, [], 'the tab bar fits at every width and names the open tab');
+        const keys = [
+            ['ctrl+s', 'save (2)', 0],
+            ['↵', 'edit', 1],
+            ['r', 'reset', 2],
+            ['tab', 'scope', 3],
+            ['↑↓', 'move', 5],
+            ['/', 'search', 6],
+            ['esc', 'quit', 0],
+        ];
+        const bar = (width) => Text.strip(KeyBar.render(keys, width));
+        t.check(WIDTHS.every((w) => Text.width(bar(w)) <= w && bar(w).includes('quit') && bar(w).includes('save (2)')) &&
+            !bar(60).includes('search') &&
+            bar(60).includes('edit') &&
+            bar(200).includes('search'), 'the key bar fits, keeps save and the way out, and drops the least important keys first');
+        t.section('dialog box');
+        const box = dialogBox({ title: 'Unsaved changes', lines: ['You have 2 unsaved changes.'], buttons: 'Save' }, 61);
+        const base = Array.from({ length: 12 }, () => 'x'.repeat(60));
+        const over = overlayBox(base, box, 61);
+        t.check(new Set(box.map((l) => Text.width(l))).size === 1 &&
+            over.length === base.length &&
+            over.some((l) => Text.strip(l).includes('Unsaved changes')) &&
+            over.every((l) => Text.width(l) <= 60), 'the dialog box has equal rows and overlays the screen without changing its size');
+        t.section('unsaved changes (Draft)');
+        const file = ConfigFile.user(t.at('draft', 'config.json'));
+        t.write(file.file, '{\n  // keep this comment\n  "defaultHarness": "claude"\n}\n');
+        const draft = new Draft();
+        draft.stage(file, ['defaultHarness'], 'codex');
+        draft.stage(file, ['agentCommands', 'enabled'], true);
+        const staged = [draft.count(), draft.value(file, ['defaultHarness'])];
+        draft.stage(file, ['defaultHarness'], 'claude');
+        const restaged = draft.count();
+        draft.unstage(file, ['agentCommands', 'enabled']);
+        t.equal([staged, restaged, draft.count()], [[2, 'codex'], 1, 0], 'staged changes are counted; staging what the file already says, or undoing, drops the change');
+        draft.stage(file, ['defaultHarness'], 'codex');
+        draft.stage(file, ['sandbox', 'headless'], false);
+        const result = draft.apply();
+        const text = fs.readFileSync(file.file, 'utf8');
+        t.check(result.problems.length === 0 &&
+            result.files.length === 1 &&
+            draft.count() === 0 &&
+            text.includes('// keep this comment') &&
+            text.includes('"codex"'), 'apply writes the file once, keeps its comments and leaves nothing unsaved', JSON.stringify(result.problems));
+        draft.stage(file, ['defaultHarness'], 42);
+        t.check(draft.apply().problems.length > 0 && draft.count() === 1, 'an invalid change is refused and stays staged');
+        draft.discard();
+        t.section('tab pages');
+        t.equal(startArgv({
+            folder: 'C:\\code\\api',
+            defaultAgent: 'claude',
+            agents: [],
+            last: undefined,
+            attach: true,
+            window: 'hide',
+            hostAgents: [],
+        }, 'codex', 'C:\\code\\other'), ['launch', '--harness', 'codex', '--terminal', '--headless', '--workspace', 'C:\\code\\api'], 'the start tab builds the same command line the form would');
+        t.equal([
+            hostAgentsToShow(false, [{ harness: 'claude' }]),
+            hostAgentsToShow(true, [{ harness: 'claude' }, { harness: 'codex' }]),
+        ], [[], ['claude', 'codex']], 'not-sandboxed entries show only while agent commands are on');
+        t.equal(parseDatabaseList('postgres  running  port 5432  PostgreSQL 18\nredis     stopped  port 6379  Redis\nnoise\n').map((d) => [d.name, d.running, d.port]), [
+            ['postgres', true, 5432],
+            ['redis', false, 6379],
+        ], 'the database list reads sbx-db output and ignores other lines');
+        t.section('accounts for every agent');
+        const service = new AccountsService({
+            storageRoot: t.dir('acc', 'storage'),
+            dataPath: t.dir('acc', 'data'),
+            loaded: { config: structuredClone(DEFAULTS), configPath: null, base: t.temp },
+        });
+        const agents = service.agents();
+        t.check(agents[0].name === 'claude' && agents.some((a) => a.name === 'qwen' && a.kept && !a.canSavePc), 'Claude is listed first; an agent with only a profile folder cannot be saved from this PC');
+        const qwenCreds = t.at('acc', 'data', 'state', 'qwen', 'profile', '.qwen', 'oauth_creds.json');
+        t.write(qwenCreds, '{"token":"Q"}');
+        service.save('q', false, 'qwen');
+        t.write(qwenCreds, '{"token":"Q2"}');
+        service.activate('q', 'qwen');
+        t.equal(fs.readFileSync(qwenCreds, 'utf8'), '{"token":"Q"}', 'login files below profile/ are saved and restored');
+        t.equal(profileLinkPairs('qwen', ['.qwen', '.config/x', '.QWEN'], 'C:\\Users\\u', 'C:\\AgentData\\state'), [
+            { link: 'C:\\Users\\u\\.qwen', target: 'C:\\AgentData\\state\\qwen\\profile\\.qwen' },
+            { link: 'C:\\Users\\u\\.config\\x', target: 'C:\\AgentData\\state\\qwen\\profile\\.config\\x' },
+        ], 'the profile links: one pair per folder, below state\\<agent>\\profile, without repeats');
+        const home = (profileDirs) => HarnessSchema.safeParse({
+            npmPackage: 'x',
+            npmBin: 'x',
+            arguments: [],
+            environment: {},
+            home: { env: {}, loginFiles: [], profileDirs },
+        }).success;
+        t.check(home(['.qwen', '.local/share/opencode']) &&
+            !home(['..\\x']) &&
+            !home(['C:\\x']) &&
+            !home(['a/../b']) &&
+            !home(Array.from({ length: 9 }, (_, i) => 'd' + i)), 'profile folders: relative paths only (no "..", no drive), at most 8');
+        const codexAuth = t.at('acc', 'data', 'state', 'codex', 'auth.json');
+        t.write(codexAuth, '{"token":"A"}');
+        service.save('main', false, 'codex');
+        t.write(codexAuth, '{"token":"B"}');
+        service.save('other', false, 'codex');
+        t.write(codexAuth, '{"token":"B2"}');
+        service.activate('main', 'codex');
+        const swapped = fs.readFileSync(codexAuth, 'utf8');
+        service.activate('other', 'codex');
+        t.equal([swapped, fs.readFileSync(codexAuth, 'utf8')], ['{"token":"A"}', '{"token":"B2"}'], 'using a login puts its files into the sandbox state; the outgoing login is saved back first (tokens rotate)');
+        service.rename('other', 'second', 'codex');
+        service.setDefault('second', 'codex');
+        t.equal(service.list('codex').map((a) => [a.name, a.isDefault, a.isActive]), [
+            ['main', false, false],
+            ['second', true, true],
+        ], 'rename keeps the default and active marks');
+        await t.throws(() => service.save('x', false, 'nobody'), 'Unknown agent', 'an unknown agent: refused');
+        await t.throws(() => service.save('bad name', false, 'codex'), 'Invalid account name', 'bad names are refused');
+        t.section('every screen');
+        const screens = renderScreens(t.dir('screens'));
+        t.check(screens.includes('=== 7 Maintenance · repair (80x24) ===') &&
+            screens.includes('unsaved: 2') &&
+            screens.includes('Save'), 'all screens render at both sizes; the settings screen shows its unsaved count and the leave dialog offers Save');
+        const out = process.env.MENU_SCREENS_OUT;
+        if (out)
+            fs.writeFileSync(out, screens, 'utf8');
+    },
+};

package/dist/selftest/migrate.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const migrateSuite: Suite;