windows-development-sandbox 1.4.3 → 1.7.0

package/dist/cli/commands/setup/facts.js

@@ -4,6 +4,7 @@ import _ from 'lodash';
 import { z } from 'zod';
 import { freeBytesAt } from '../../../core/disk.js';
 import { captureOutput, fileExists } from '../../../core/util/index.js';
+import { nativeScript } from '../../../host/native.js';
 import { SYSTEM, system32 } from '../../../shared/system.js';
 const FEATURE = 'Containers-DisposableClientVM';
 export const ENABLE_COMMAND = 'Enable-WindowsOptionalFeature -Online -FeatureName ' + FEATURE + ' -All -NoRestart';
@@ -26,17 +27,6 @@ export function parseDismState(text) {
 export function featureFromInstallState(state) {
     return state === 1 ? 'enabled' : state === 2 || state === 3 ? 'disabled' : 'unknown';
 }
-// Fixed script (no outside data): CPU/hypervisor facts and the feature state, readable without admin rights.
-const PROBE = [
-    '$ErrorActionPreference = "SilentlyContinue"',
-    '$cpu = @(Get-CimInstance Win32_Processor)',
-    '$cs = Get-CimInstance Win32_ComputerSystem',
-    '$f = Get-CimInstance Win32_OptionalFeature -Filter "Name=\'' + FEATURE + '\'"',
-    '$v = $null; if ($cpu.Count) { $v = [bool]($cpu | Where-Object { $_.VirtualizationFirmwareEnabled }) }',
-    '$h = $null; if ($cs) { $h = [bool]$cs.HypervisorPresent }',
-    '$s = $null; if ($f) { $s = [int]$f.InstallState }',
-    '@{ virtualizationFirmware = $v; hypervisorPresent = $h; installState = $s } | ConvertTo-Json -Compress',
-].join('; ');
 const ProbeSchema = z
     .object({
     virtualizationFirmware: z.boolean().nullable(),
@@ -54,7 +44,7 @@ export function parseProbe(text) {
 }
 export function gatherFacts(storageRoot) {
     const reg = parseRegQuery(captureOutput(SYSTEM.reg(), ['query', 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion']));
-    const probe = parseProbe(captureOutput(SYSTEM.powershell(), ['-NoProfile', '-NonInteractive', '-Command', PROBE]));
+    const probe = parseProbe(captureOutput(SYSTEM.powershell(), nativeScript('scripts/sandbox-probe.ps1', ['-Feature', FEATURE])));
     // DISM knows about a pending restart but needs admin rights; the CIM state works for everyone.
     const dism = parseDismState(captureOutput(SYSTEM.dism(), ['/English', '/Online', '/Get-FeatureInfo', '/FeatureName:' + FEATURE]));
     return {

package/dist/cli/commands/setup/index.d.ts

@@ -1,2 +1,7 @@
 import { type Context } from '../context.js';
+/**
+ * First start on a PC without Windows Sandbox: offers to turn it on (the setup steps) instead of a bare error.
+ * Returns the setup's exit code, or undefined when there is nothing to offer (it is on, no terminal, or declined).
+ */
+export declare function offerSetupWhenOff(ctx: Context): Promise<number | undefined>;
 export declare function setup(ctx: Context): Promise<number>;

package/dist/cli/commands/setup/index.js

@@ -2,11 +2,12 @@
 import { spawnSync } from 'node:child_process';
 import { askYesNo } from '../../../core/prompt.js';
 import { fail, isWin } from '../../../core/util/index.js';
+import { insideSandbox, sandboxFeatureInstalled } from '../../../host/sandbox/index.js';
 import { refuseInSelfTest } from '../../../host/test-guard.js';
 import { SYSTEM } from '../../../shared/system.js';
 import { c, table } from '../../output/index.js';
-import { buildChecks, canEnableFeature } from './checks.js';
-import { ENABLE_COMMAND, gatherFacts } from './facts.js';
+import { HealthService } from '../../services/index.js';
+import { ENABLE_COMMAND } from './facts.js';
 const LABEL = {
     ok: c.green('OK'),
     warn: c.yellow('WARNING'),
@@ -15,34 +16,42 @@ const LABEL = {
 function print(checks) {
     table(checks.map((check) => [LABEL[check.status], check.name, check.detail]));
 }
-/** Runs the enable command in an elevated PowerShell (Windows asks for permission); true if it worked. */
-function enableFeature() {
-    refuseInSelfTest('turn on Windows features');
-    const inner = "'-NoProfile','-Command','" + ENABLE_COMMAND + " | Out-Null'";
-    const outer = "try { $p = Start-Process -FilePath '" +
-        SYSTEM.powershell() +
-        "' -Verb RunAs -Wait -PassThru -WindowStyle Hidden -ArgumentList " +
-        inner +
-        '; exit $p.ExitCode } catch { exit 1 }';
-    return (spawnSync(SYSTEM.powershell(), ['-NoProfile', '-NonInteractive', '-Command', outer], { stdio: 'inherit' })
-        .status === 0);
+/** Seconds Windows waits before it restarts (shutdown /a cancels in that time). */
+const RESTART_DELAY_SECONDS = 30;
+/** After turning the feature on Windows must restart: offered, never done without a yes. */
+async function offerRestart() {
+    if (!(await askYesNo('Restart Windows now?')))
+        return;
+    refuseInSelfTest('restart Windows');
+    spawnSync(SYSTEM.shutdown(), ['/r', '/t', String(RESTART_DELAY_SECONDS)], { windowsHide: true });
+    console.log('Windows restarts in ' + RESTART_DELAY_SECONDS + ' seconds. To cancel: shutdown /a');
+}
+/**
+ * First start on a PC without Windows Sandbox: offers to turn it on (the setup steps) instead of a bare error.
+ * Returns the setup's exit code, or undefined when there is nothing to offer (it is on, no terminal, or declined).
+ */
+export async function offerSetupWhenOff(ctx) {
+    if (!isWin || insideSandbox() || sandboxFeatureInstalled() || !process.stdin.isTTY)
+        return undefined;
+    return (await askYesNo('Windows Sandbox is not turned on. Turn it on now?', true)) ? setup(ctx) : undefined;
 }
 export async function setup(ctx) {
-    if (!isWin)
-        fail('Windows Sandbox only runs on Windows.', 'Run sandbox setup on a Windows 10/11 Pro, Enterprise or Education PC.');
+    const health = new HealthService(ctx);
+    health.assertWindows();
     console.log('Checking this PC for Windows Sandbox...\n');
-    const facts = gatherFacts(ctx.storageRoot);
-    let checks = buildChecks(facts);
+    const first = health.setupReport();
+    let checks = first.checks;
     print(checks);
-    if (canEnableFeature(facts)) {
+    if (first.canEnable) {
         console.log('');
         if (await askYesNo('Turn on Windows Sandbox now? Windows will ask for admin permission.')) {
             console.log('Enabling Windows Sandbox (this can take a minute)...');
-            if (!enableFeature())
+            if (!health.enableFeature())
                 fail('Windows Sandbox could not be enabled (or the admin prompt was declined).', 'In an admin PowerShell run: ' + ENABLE_COMMAND + ', then restart Windows.');
             console.log('Done. Restart Windows to finish, then run sandbox setup again.\n');
-            checks = buildChecks(gatherFacts(ctx.storageRoot));
+            checks = health.setupReport().checks;
             print(checks);
+            await offerRestart();
         }
         else
             console.log('To do it yourself, in an admin PowerShell run:\n  ' + ENABLE_COMMAND + '\nthen restart Windows.');

package/dist/cli/commands/shared-use.d.ts

@@ -0,0 +1,29 @@
+import { type OwnerAction } from '../../host/sharing/index.js';
+import type { SandboxOwner } from '../../host/sharing/owner.js';
+import type { Context } from './context.js';
+/** The sandbox is another user's and shared with this one. */
+type SharedOwner = Extract<SandboxOwner, {
+    kind: 'other';
+}>;
+/**
+ * The context for working in another user's shared sandbox: its data folder, its projects (from its record), and none
+ * of this user's agent environment. A login chosen with --account would end up in their sandbox, so it is refused.
+ */
+export declare function borrowedContext(ctx: Context, owner: SharedOwner): Context;
+export interface SandboxView {
+    /** Where to read from: the owner's data folder when the sandbox is another user's and shared. */
+    readonly ctx: Context;
+    /** "Running, started by alice (shared with you)", or null for your own sandbox. */
+    readonly line: string | null;
+    /** The sandbox is another user's and not shared: there is nothing to show but that. */
+    readonly limited: boolean;
+    readonly owner: SandboxOwner | null;
+}
+/** For status and sessions: they work for anyone, and say whose sandbox this is. */
+export declare function lookAtSandbox(ctx: Context): SandboxView;
+/**
+ * For a command that acts on the running sandbox: refuses with the reason when this user may not, asks for the typed
+ * confirmation when the rule wants one (--yes in a script), and returns the context to use.
+ */
+export declare function useSharedSandbox(ctx: Context, action: OwnerAction | ((shared: Context) => OwnerAction)): Promise<Context>;
+export {};

package/dist/cli/commands/shared-use.js

@@ -0,0 +1,69 @@
+// Whose is the running sandbox? Windows allows one per PC, so with an all-users install another user's sandbox may be
+// the one running. These helpers apply the rules in host/sharing/rules.ts: a command that only looks goes on whatever
+// the owner (and says whose it is), a command that uses the sandbox goes on when it is shared (working on the owner's
+// data folder, with none of this user's logins or agent environment), and the rest is the owner's alone.
+import _ from 'lodash';
+import { askTyped } from '../../core/prompt.js';
+import { fail } from '../../core/util/index.js';
+import { insideSandbox, isSandboxRunning } from '../../host/sandbox/index.js';
+import { ownerLine, ownerName, ownerRule, runningOwner, sharedDataPath, } from '../../host/sharing/index.js';
+/** What the user's own settings must not carry into another user's sandbox: their agent environment values. */
+function withoutHarnessEnvironment(loaded) {
+    return {
+        ...loaded,
+        config: {
+            ...loaded.config,
+            harnesses: _.mapValues(loaded.config.harnesses, (harness) => ({ ...harness, environment: {} })),
+        },
+    };
+}
+/**
+ * The context for working in another user's shared sandbox: its data folder, its projects (from its record), and none
+ * of this user's agent environment. A login chosen with --account would end up in their sandbox, so it is refused.
+ */
+export function borrowedContext(ctx, owner) {
+    if (ctx.options.account)
+        fail('--account cannot be used in ' + ownerName(owner.user) + "'s sandbox.", 'The sandbox uses the logins of ' + ownerName(owner.user) + '; yours stay on your side.');
+    return {
+        ...ctx,
+        dataPath: sharedDataPath(owner.record),
+        loaded: withoutHarnessEnvironment(ctx.loaded),
+        borrowed: { user: owner.user, record: owner.record },
+    };
+}
+/** The running sandbox's owner, or null when there is nothing to ask (none running, or this is inside the sandbox). */
+function ownerNow() {
+    if (insideSandbox() || !isSandboxRunning())
+        return null;
+    return runningOwner();
+}
+/** For status and sessions: they work for anyone, and say whose sandbox this is. */
+export function lookAtSandbox(ctx) {
+    const owner = ownerNow();
+    if (!owner)
+        return { ctx, line: null, limited: false, owner };
+    const line = ownerLine(owner);
+    if (owner.kind === 'other' && owner.shared)
+        return { ctx: borrowedContext(ctx, owner), line, limited: false, owner };
+    return { ctx, line, limited: owner.kind !== 'mine' && owner.kind !== 'none', owner };
+}
+/**
+ * For a command that acts on the running sandbox: refuses with the reason when this user may not, asks for the typed
+ * confirmation when the rule wants one (--yes in a script), and returns the context to use.
+ */
+export async function useSharedSandbox(ctx, action) {
+    const owner = ownerNow();
+    if (!owner || owner.kind === 'mine' || owner.kind === 'none')
+        return ctx;
+    const target = owner.kind === 'other' && owner.shared ? borrowedContext(ctx, owner) : ctx;
+    const rule = ownerRule(owner, typeof action === 'function' ? action(target) : action);
+    if (rule.kind === 'refuse')
+        return fail(rule.reason, rule.fix);
+    if (rule.kind === 'confirm' && !ctx.options.yes) {
+        if (!(process.stdin.isTTY && process.stdout.isTTY))
+            fail(rule.prompt + ' It was not stopped.', 'In a script, add --yes to do it anyway.');
+        if (!(await askTyped(rule.prompt, rule.expected)))
+            fail('Nothing changed.');
+    }
+    return target;
+}

package/dist/cli/commands/storage/index.d.ts

@@ -0,0 +1,2 @@
+export { storage, storageBusy, performMove } from './storage.js';
+export { storageBeforeCommand } from './offer.js';

package/dist/cli/commands/storage/index.js

@@ -0,0 +1,2 @@
+export { storage, storageBusy, performMove } from './storage.js';
+export { storageBeforeCommand } from './offer.js';

package/dist/cli/commands/storage/offer.d.ts

@@ -0,0 +1,3 @@
+import { type Context } from '../context.js';
+/** Before a command (after the saved settings are up to date). A failed move never stops the command. */
+export declare function storageBeforeCommand(ctx: Context, command: string): Promise<void>;

package/dist/cli/commands/storage/offer.js

@@ -0,0 +1,85 @@
+// At the start of an interactive command: makes sure the storage folder exists (private when it should be) and, once,
+// offers to move saved data from another folder to where it belongs. Never asks without a terminal.
+import { select } from '@inquirer/prompts';
+import { userDir } from '../../../core/config/index.js';
+import { errMsg } from '../../../core/util/index.js';
+import { isSandboxRunning, insideSandbox } from '../../../host/sandbox/index.js';
+import { protectPrivateFolder } from '../../../host/sharing/index.js';
+import { describeDuration, describeSize, ensureStorageRoot, estimate, measureFolder, moveWarning, planOffer, StorageHistory, } from '../../../host/storage/index.js';
+import { c, working } from '../../output/index.js';
+import { refreshStorage } from '../context.js';
+import { performMove } from './storage.js';
+/** Commands that do not touch the storage folder, or must work whatever state it is in. */
+const NO_STORAGE = ['self-test', '_watch', '_web', 'update', 'storage', 'migrate', 'repair'];
+/** Commands that start something the user is sitting in front of: the offer is shown before them. */
+const OFFERS = ['menu', 'launch'];
+async function ask(text) {
+    console.error('\n' + text + '\n');
+    return select({
+        message: 'Move it now?',
+        choices: [
+            { name: 'Move now', value: 'now' },
+            { name: 'Not now', value: 'later' },
+            { name: "Don't ask again", value: 'never' },
+        ],
+        default: 'now',
+    });
+}
+function offerText(offer, size, time, warning) {
+    const where = offer.toIsDefault
+        ? 'The default folder is now ' + offer.to + ', which works for both kinds of install.'
+        : 'Your folder is ' + offer.to + '.';
+    return ('Your saved data (' +
+        size +
+        ') is in ' +
+        offer.from +
+        '. ' +
+        where +
+        ' Move it there now? ' +
+        time +
+        '.' +
+        (warning ? '\n' + warning : ''));
+}
+async function offerMove(ctx, history) {
+    const offer = planOffer(ctx.storageRoot, history);
+    if (!offer || isSandboxRunning())
+        return;
+    const measured = await working('Looking at your saved data', () => measureFolder(offer.from));
+    const est = estimate(offer.from, offer.to, measured);
+    const spoken = est.sameVolume ? 'a few seconds' : describeDuration(est.seconds);
+    const time = spoken.charAt(0).toUpperCase() + spoken.slice(1);
+    if (!est.fits) {
+        console.error(c.dim(moveWarning(measured, est) ?? ''));
+        return;
+    }
+    const answer = await ask(offerText(offer, describeSize(measured), time, moveWarning(measured, est)));
+    if (answer === 'never')
+        history.setDontAsk();
+    else if (answer === 'later')
+        history.setNotNow();
+    if (answer !== 'now')
+        return;
+    const result = await performMove({ ...ctx, storageRoot: offer.from }, offer.to, false);
+    console.error('Moved. Your data is now in ' + result.to + '.');
+    for (const note of result.notes)
+        console.error(c.dim(note));
+    refreshStorage(ctx);
+}
+/** Before a command (after the saved settings are up to date). A failed move never stops the command. */
+export async function storageBeforeCommand(ctx, command) {
+    if (insideSandbox() || NO_STORAGE.includes(command))
+        return;
+    if (OFFERS.includes(command) &&
+        process.stdin.isTTY &&
+        process.stdout.isTTY &&
+        !ctx.options.json &&
+        !ctx.options.unattended) {
+        try {
+            await offerMove(ctx, new StorageHistory(userDir()));
+        }
+        catch (e) {
+            console.error(c.red('Could not move your data: ') + errMsg(e));
+        }
+    }
+    ensureStorageRoot(ctx.storageRoot, protectPrivateFolder);
+}

package/dist/cli/commands/storage/storage.d.ts

@@ -0,0 +1,8 @@
+import { type MoveResult } from '../../../host/storage/index.js';
+import { type Context } from '../context.js';
+/** Why a move cannot start (a background sync is still on a data folder in the old storage), or null. */
+export declare function storageBusy(root: string): string | null;
+/** Moves the data with progress on the terminal; remembers both folders. Used by the command and the start offer. */
+export declare function performMove(ctx: Context, to: string, keepOld: boolean): Promise<MoveResult>;
+/** `sandbox storage [show|move <folder>|use <folder>]`. */
+export declare function storage(ctx: Context): number | Promise<number>;

package/dist/cli/commands/storage/storage.js

@@ -0,0 +1,171 @@
+// `sandbox storage`: where everything kept between sandboxes lives, moving it to another folder (with the size, an
+// estimate and a warning first) and switching to a folder without moving. The work is in host/storage.
+import fs from 'node:fs';
+import path from 'node:path';
+import { userConfigPath, userDir } from '../../../core/config/index.js';
+import { diskUsage, humanBytes } from '../../../core/disk.js';
+import { askChoice, askName, askRequired } from '../../../core/prompt.js';
+import { expandPath, fail } from '../../../core/util/index.js';
+import { describeDuration, describeSize, estimate, holdsData, measureFolder, moveWarning, otherDataFolders, sharedDefaultRoot, StorageHistory, StorageMove, } from '../../../host/storage/index.js';
+import { isSandboxRunning } from '../../../host/sandbox/index.js';
+import { protectPrivateFolder } from '../../../host/sharing/index.js';
+import { watcherRunning } from '../../../sync/index.js';
+import { printJson, working } from '../../output/index.js';
+import { requireOnPc } from '../context.js';
+/** Why a move cannot start (a background sync is still on a data folder in the old storage), or null. */
+export function storageBusy(root) {
+    const data = path.join(root, 'data');
+    try {
+        for (const name of fs.readdirSync(data))
+            if (watcherRunning(path.join(data, name)))
+                return 'The background sync of "' + name + '" is still finishing.';
+    }
+    catch {
+        // no data folder: nothing runs
+    }
+    return null;
+}
+function mover(ctx) {
+    return new StorageMove(ctx.loaded.configPath ?? userConfigPath(), () => storageBusy(ctx.storageRoot), isSandboxRunning, protectPrivateFolder);
+}
+/** The path as typed (variables and ~ expand, relative to the current folder). */
+function typedPath(value) {
+    return expandPath(value, process.cwd());
+}
+/** The folder typed, or picked from the default folder, folders that hold data and the drives (or typed in). */
+async function folderOf(ctx, value, what) {
+    if (value)
+        return typedPath(value);
+    const fix = 'Use: sandbox storage ' + what + ' <folder>';
+    const typed = 'type';
+    const known = [sharedDefaultRoot(), ...otherDataFolders(ctx.storageRoot, new StorageHistory(userDir()))];
+    const drives = diskUsage(ctx.storageRoot)
+        .filter((d) => !d.holdsStorage)
+        .map((d) => path.join(d.drive, 'AgentSandbox'));
+    const choices = [...new Set([...known, ...drives])]
+        .filter((f) => f.toLowerCase() !== ctx.storageRoot.toLowerCase())
+        .map((f) => ({ name: f, value: f }));
+    const picked = await askChoice('Which folder?', [...choices, { name: 'Type a path...', value: typed }], fix);
+    if (picked !== typed)
+        return picked;
+    const answer = await askName('Folder:', fix, (v) => v.length > 0 || 'Type a folder path.');
+    return typedPath(answer);
+}
+async function show(ctx) {
+    const history = new StorageHistory(userDir());
+    const measured = await working('Measuring your saved data (big folders take a moment)', () => measureFolder(ctx.storageRoot), !ctx.options.json);
+    const others = otherDataFolders(ctx.storageRoot, history);
+    const shared = sharedDefaultRoot();
+    if (printJson(ctx, {
+        root: ctx.storageRoot,
+        exists: fs.existsSync(ctx.storageRoot),
+        ...measured,
+        defaultRoot: shared,
+        otherFoldersWithData: others,
+    }))
+        return 0;
+    const inUse = shared.toLowerCase() === ctx.storageRoot.toLowerCase() ? ' (in use)' : '';
+    console.log('Your saved data is in: ' + ctx.storageRoot);
+    console.log('  ' + (holdsData(ctx.storageRoot) ? describeSize(measured) : 'nothing in it yet'));
+    console.log('The default folder is: ' + shared + inUse);
+    for (const other of others)
+        console.log('Another folder with data: ' + other);
+    console.log('\nMove it with: sandbox storage move <folder>  (or switch without moving: sandbox storage use <folder>)');
+    console.log('What takes the space: sandbox data');
+    return 0;
+}
+function printPlan(from, to, measured, copyOnly) {
+    const est = estimate(from, to, measured, copyOnly);
+    const time = est.sameVolume
+        ? 'a few seconds (same drive, nothing is copied)'
+        : describeDuration(est.seconds) + ' (copied to another drive)';
+    console.log('Move from: ' + from);
+    console.log('       to: ' + to);
+    console.log('     size: ' + describeSize(measured));
+    console.log('     time: ' + time);
+    const warning = moveWarning(measured, est);
+    if (warning)
+        console.log('Warning: ' + warning);
+    if (!est.fits)
+        fail('Not enough free space on the target drive.', 'Free some space or pick another drive.');
+}
+/** Moves the data with progress on the terminal; remembers both folders. Used by the command and the start offer. */
+export async function performMove(ctx, to, keepOld) {
+    const from = ctx.storageRoot;
+    const history = new StorageHistory(userDir());
+    let line = 'Moving your data';
+    const result = await working(() => line, () => mover(ctx).move(from, to, {
+        keepOld,
+        onProgress: (p) => {
+            line = 'Copying: ' + p.files.toLocaleString('en-US') + ' files, ' + humanBytes(p.bytes);
+        },
+    }));
+    history.remember(from);
+    history.remember(to);
+    return result;
+}
+async function move(ctx) {
+    const to = await folderOf(ctx, ctx.options.positionals[1], 'move');
+    const from = ctx.storageRoot;
+    if (!fs.existsSync(from))
+        fail('There is nothing to move: ' + from + ' does not exist.', 'Use sandbox storage use ' + to + ' to switch.');
+    mover(ctx).validate(from, to);
+    const measured = await working('Measuring your saved data', () => measureFolder(from), !ctx.options.json);
+    const keepOld = ctx.options.keepOld;
+    printPlan(from, to, measured, keepOld);
+    if (!ctx.options.yes) {
+        if (!(await askRequired('Move your data to ' + to + '?', 'Add --yes to move without asking.', true))) {
+            console.log('Nothing was moved.');
+            return 1;
+        }
+    }
+    const result = await performMove(ctx, to, keepOld);
+    if (printJson(ctx, result))
+        return 0;
+    const left = result.removedOld ? '' : '; the old folder is still at ' + result.from;
+    console.log('Moved ' + result.files.toLocaleString('en-US') + ' files. Your data is now in ' + result.to + left + '.');
+    for (const note of result.notes)
+        console.log(note);
+    console.log('Your settings now point to ' + result.pinned + ', so older versions find the data too.');
+    return 0;
+}
+async function use(ctx) {
+    const to = await folderOf(ctx, ctx.options.positionals[1], 'use');
+    if (to.toLowerCase() === ctx.storageRoot.toLowerCase()) {
+        console.log('That folder is in use already.');
+        return 0;
+    }
+    const busy = storageBusy(ctx.storageRoot);
+    if (busy)
+        fail(busy, 'Wait a minute, then try again.');
+    const state = holdsData(to)
+        ? to + ' is used as it is.'
+        : to + ' starts empty: tools, logins and history are set up again.';
+    console.log('Warning: your data stays in ' + ctx.storageRoot + '. ' + state);
+    if (!ctx.options.yes) {
+        if (!(await askRequired('Use ' + to + ' from now on, without moving your data?', 'Add --yes to switch without asking.'))) {
+            console.log('Nothing was changed.');
+            return 1;
+        }
+    }
+    new StorageHistory(userDir()).remember(ctx.storageRoot);
+    mover(ctx).pin(to);
+    console.log('Your data is now looked for in ' + to + '. Move it later with: sandbox storage move <folder>');
+    return 0;
+}
+/** `sandbox storage [show|move <folder>|use <folder>]`. */
+export function storage(ctx) {
+    requireOnPc('storage');
+    const [action = 'show'] = ctx.options.positionals;
+    switch (action) {
+        case 'show':
+        case 'info':
+            return show(ctx);
+        case 'move':
+            return move(ctx);
+        case 'use':
+            return use(ctx);
+        default:
+            return fail('Unknown storage action "' + action + '".', 'Use: sandbox storage, sandbox storage move <folder> or sandbox storage use <folder>');
+    }
+}

package/dist/cli/commands/user-config.js

@@ -21,7 +21,7 @@ export function setSetting(ctx, key, value) {
     const text = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
     const result = editConfigText(text, key, value);
     if ('problems' in result)
-        fail('Could not change ' + key.join('.') + ':\n  ' + result.problems.join('\n  '));
+        fail('Could not change ' + key.join('.') + ':\n  ' + result.problems.join('\n  '), 'Nothing was written. Fix the value, or the settings file: ' + file);
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.writeFileSync(file, result.text, 'utf8');
 }

package/dist/cli/commands/vpn.d.ts

@@ -0,0 +1,4 @@
+import { type Context } from './context.js';
+/** The warnings every VPN user must see. */
+export declare const VPN_WARNINGS: readonly string[];
+export declare function vpn(ctx: Context): Promise<number> | number;

package/dist/cli/commands/vpn.js

@@ -0,0 +1,75 @@
+// `sandbox vpn [status|login|logout]`: the VPN login (kept encrypted on this PC, never printed) and what the VPN is
+// doing.
+import { askSecret } from '../../core/prompt.js';
+import { fail } from '../../core/util/index.js';
+import { c, nextStep, printJson, table } from '../output/index.js';
+import { NORD_STEPS, VpnService } from '../services/vpn-service.js';
+import { requireOnPc } from './context.js';
+const LOGIN_TEXT = {
+    none: c.yellow('not saved'),
+    saved: c.green('saved (encrypted)'),
+    unreadable: c.red('cannot be read'),
+};
+/** The warnings every VPN user must see. */
+export const VPN_WARNINGS = [
+    'The agent in the sandbox can read the VPN login (a service login you can revoke) and can turn the tunnel off, because it is the administrator there.',
+    'Free VPNs see all your traffic: use one you trust.',
+];
+async function status(ctx) {
+    const report = await new VpnService(ctx).report();
+    if (printJson(ctx, report))
+        return 0;
+    table([
+        ['VPN', report.enabled ? c.green('on') : 'off  (turn on: sandbox config set vpn.enabled true)'],
+        ['Provider', report.provider === 'nordvpn' ? 'NordVPN' : 'your own .ovpn file'],
+        ['Protocol', report.protocol],
+        ['Country', report.country || 'best available'],
+        ['Kill switch', report.killSwitch ? 'on (no internet if the tunnel fails)' : c.yellow('off')],
+        ['Login', LOGIN_TEXT[report.login] + (report.loginSavedAt ? c.dim('  ' + report.loginSavedAt.slice(0, 10)) : '')],
+        ...(report.running ? [['Running now', report.running.text]] : []),
+    ]);
+    if (report.login === 'none')
+        nextStep('sandbox vpn login');
+    if (report.login === 'unreadable')
+        console.log(c.dim('Only the Windows user that saved it can read it. Save it again: sandbox vpn login'));
+    for (const w of VPN_WARNINGS)
+        console.log(c.dim(w));
+    return 0;
+}
+async function login(ctx) {
+    requireOnPc('vpn login');
+    const service = new VpnService(ctx);
+    const nord = service.provider === 'nordvpn';
+    console.log(nord
+        ? 'NordVPN needs its service credentials, not your usual login. To get them:'
+        : 'Type the user name and password your VPN profile asks for.');
+    if (nord)
+        NORD_STEPS.forEach((s, i) => console.log('  ' + (i + 1) + '. ' + s));
+    console.log(c.dim('What you type is not shown. It is kept encrypted for your Windows user and never printed.\n'));
+    const fix = 'Run sandbox vpn login in a terminal.';
+    const username = await askSecret(nord ? 'Service user name' : 'User name', fix);
+    const password = await askSecret(nord ? 'Service password' : 'Password', fix);
+    service.save({ username, password });
+    console.log(c.green('Saved.') + ' Turn the VPN on with: sandbox config set vpn.enabled true');
+    for (const w of VPN_WARNINGS)
+        console.log(c.dim(w));
+    return 0;
+}
+function logout(ctx) {
+    requireOnPc('vpn logout');
+    console.log(new VpnService(ctx).remove() ? 'The saved VPN login is deleted.' : 'No VPN login was saved.');
+    return 0;
+}
+export function vpn(ctx) {
+    const action = ctx.options.positionals[0] ?? 'status';
+    switch (action) {
+        case 'status':
+            return status(ctx);
+        case 'login':
+            return login(ctx);
+        case 'logout':
+            return logout(ctx);
+        default:
+            return fail('Unknown VPN action "' + action + '".', 'Use: sandbox vpn status | login | logout');
+    }
+}

package/dist/cli/commands/web.d.ts

@@ -0,0 +1,4 @@
+import { type Context } from './context.js';
+export declare function web(ctx: Context): Promise<number>;
+/** Body of the background process (`sandbox _web`): runs until stopped. */
+export declare function webServer(ctx: Context): Promise<void>;