windows-development-sandbox 1.5.0 → 1.7.0

package/dist/cli/menu/several.js

@@ -8,6 +8,7 @@ import { KnownProjects } from '../../host/projects/index.js';
 import { isWithin } from '../../shared/paths/index.js';
 import { commandLine } from '../history.js';
 import { Text, Theme } from '../tui/index.js';
+import { askPath } from './settings/path-kind.js';
 /** Folders worth offering: this one, the projects started before, and the folders inside your roots. */
 export function candidateFolders(ctx, cwd = process.cwd()) {
     const roots = ctx.loaded.config.projects.roots.map((r) => expandPath(r, ctx.loaded.base));
@@ -66,10 +67,10 @@ export class SeveralAgents {
         const headless = await this.app.confirm({
             path: this.path,
             question: 'Hide the sandbox window (headless)?',
-            about: ['sandbox show brings it back.'],
+            about: ['Sandbox > Show the window brings it back.'],
             initial: this.ctx.loaded.config.sandbox.headless,
         });
-        const attach = await this.app.choose(this.path, 'Attach this terminal to one of them? Each session also has a tab inside the sandbox; sandbox attach shows any of them later.', [
+        const attach = await this.app.choose(this.path, 'Attach this terminal to one of them? Each session also has a tab inside the sandbox; Sessions shows any of them later.', [
             { value: -1, label: 'None' },
             ...sessions.map((s, i) => ({ value: i, label: s.harness + ' in ' + Text.middle(s.folder, 60) })),
         ], 0);
@@ -119,9 +120,10 @@ export class SeveralAgents {
             return null;
         const folders = picked.values.filter((f) => f !== ADD);
         if (picked.values.includes(ADD)) {
-            const extra = await this.app.text({
+            const extra = await askPath(this.app, {
                 path: this.path,
-                label: 'Folder to add',
+                title: 'Choose the folder to add',
+                kind: 'dir',
                 validate: (v) => {
                     const dir = path.resolve(v.trim());
                     if (!v.trim() || !fs.existsSync(dir) || !fs.statSync(dir).isDirectory())
@@ -136,7 +138,7 @@ export class SeveralAgents {
                 },
             });
             if (extra)
-                folders.push(path.resolve(extra.trim()));
+                folders.push(path.resolve(extra));
         }
         return folders;
     }

package/dist/cli/menu/shell.d.ts

@@ -1,4 +1,4 @@
-import type { App, FrameParts, Key, Screen, Size, Step, TabsState } from '../tui/index.js';
+import type { App, Category, FrameParts, Key, NavState, Screen, Size, Step } from '../tui/index.js';
 import type { Draft, DraftResult } from './settings/draft.js';
 /** Why the shell closed. */
 export type ShellExit = {
@@ -14,20 +14,34 @@ export type ShellExit = {
     kind: 'view';
     file: string;
 };
-/** One tab. */
+/** Which section and category the menu shows. */
+export interface MenuView {
+    readonly section: number;
+    readonly category: string | undefined;
+}
+/** One section of the menu. */
 export interface Page {
     readonly label: string;
-    /** This page stages changes in the Draft (its tab is marked while something is unsaved). */
+    /** This page stages changes in the Draft (its section is marked while something is unsaved). */
     readonly stages: boolean;
-    /** Typing goes into a search box: digits are text, not tab numbers. */
+    /** Typing goes into a search box: digits are text, not section numbers. */
     readonly capturing: boolean;
-    /** The tab was opened (or the shell came back from a command): load what it shows again. */
+    /** The categories listed under the section while it is open (none: the section is one list). */
+    categories(): readonly Category[];
+    /** The id of the open category. */
+    readonly category: string | undefined;
+    /** Opens a category (the navigation moved onto it). */
+    selectCategory(id: string): Promise<void>;
+    /** Whether the list has the keyboard (its highlight is softer while the navigation has it). */
+    setFocus(list: boolean): void;
+    /** The section was opened (or the shell came back from a command): load what it shows again. */
     open(): Promise<void>;
     render(size: Size): FrameParts;
+    /** A `quit` from the page means "Esc with nothing left to close": the shell moves to the navigation. */
     handle(key: Key): Promise<Step<ShellExit>> | Step<ShellExit>;
 }
-/** The tab names, in order. Number keys 1-7 open them. */
-export declare const TAB_LABELS: readonly ["Start", "Sessions", "Sandbox", "Apps", "Settings", "Accounts", "Maintenance"];
+/** The section names, in order. Number keys 1-7 open them. */
+export declare const SECTION_LABELS: readonly ["Agents", "Sessions", "Sandbox", "Apps", "Settings", "Accounts", "Maintenance"];
 export declare class Shell implements Screen<ShellExit> {
     private readonly app;
     readonly pages: readonly Page[];
@@ -35,20 +49,33 @@ export declare class Shell implements Screen<ShellExit> {
     /** Told after a save (the menu applies settings that act on this PC) and returns a note to add. */
     private readonly afterSave;
     private active;
+    private focus;
     private notice;
     constructor(app: App, pages: readonly Page[], draft: Draft, 
     /** Told after a save (the menu applies settings that act on this PC) and returns a note to add. */
     afterSave?: (result: DraftResult) => string | undefined);
     get page(): Page;
-    tabs(): TabsState;
-    /** Opens a tab by index (loads its data). */
+    /** Which pane has the keyboard. */
+    get focused(): 'nav' | 'list';
+    nav(): NavState;
+    /** The section and category that are open (the menu opens on them again later in the same run). */
+    view(): MenuView;
+    /** Opens the section and category a view names (a category that is gone is ignored). */
+    restore(view: MenuView): Promise<void>;
+    /** Opens a section by index (loads its data). */
     openTab(index: number): Promise<void>;
-    /** Loads the open tab again (after a command ran). */
+    /** Puts the keyboard in the navigation or in the list. */
+    setFocus(focus: 'nav' | 'list'): void;
+    /** Loads the open section again (after a command ran). */
     reload(): Promise<void>;
     render(size: Size): FrameParts;
     /** Writes the staged changes; the notice says what happened. */
     save(): string;
     handle(key: Key): Promise<Step<ShellExit>>;
+    /** A key while the navigation has the keyboard. */
+    private navKey;
+    /** One stop up or down the tree: the categories of the open section, then the next section. */
+    private move;
     /** Leaving with unsaved changes asks what to do with them. */
     private leave;
 }

package/dist/cli/menu/shell.js

@@ -1,12 +1,20 @@
 import { Theme } from '../tui/index.js';
-/** The tab names, in order. Number keys 1-7 open them. */
-export const TAB_LABELS = ['Start', 'Sessions', 'Sandbox', 'Apps', 'Settings', 'Accounts', 'Maintenance'];
+/** The section names, in order. Number keys 1-7 open them. */
+export const SECTION_LABELS = ['Agents', 'Sessions', 'Sandbox', 'Apps', 'Settings', 'Accounts', 'Maintenance'];
+const NAV_KEYS = [
+    ['↑↓', 'move', 1],
+    ['→', 'open', 1],
+    ['1-7', 'jump', 4],
+    ['/', 'search', 6],
+    ['esc', 'quit', 0],
+];
 export class Shell {
     app;
     pages;
     draft;
     afterSave;
     active = 0;
+    focus = 'list';
     notice;
     constructor(app, pages, draft, 
     /** Told after a save (the menu applies settings that act on this PC) and returns a note to add. */
@@ -15,24 +23,50 @@ export class Shell {
         this.pages = pages;
         this.draft = draft;
         this.afterSave = afterSave;
-        app.tabs = () => this.tabs();
+        app.nav = () => this.nav();
     }
     get page() {
         return this.pages[this.active];
     }
-    tabs() {
+    /** Which pane has the keyboard. */
+    get focused() {
+        return this.focus;
+    }
+    nav() {
         const unsaved = this.draft.count() > 0;
+        const current = this.page.category;
         return {
-            tabs: this.pages.map((p) => ({ label: p.label, marked: p.stages && unsaved })),
+            sections: this.pages.map((p, i) => ({
+                label: p.label,
+                marked: p.stages && unsaved,
+                categories: i === this.active ? p.categories().map((c) => ({ label: c.label, current: c.id === current })) : [],
+            })),
             active: this.active,
+            focused: this.focus === 'nav',
         };
     }
-    /** Opens a tab by index (loads its data). */
+    /** The section and category that are open (the menu opens on them again later in the same run). */
+    view() {
+        return { section: this.active, category: this.page.category };
+    }
+    /** Opens the section and category a view names (a category that is gone is ignored). */
+    async restore(view) {
+        await this.openTab(view.section);
+        if (view.category && this.page.categories().some((c) => c.id === view.category))
+            await this.page.selectCategory(view.category);
+    }
+    /** Opens a section by index (loads its data). */
     async openTab(index) {
         this.active = Math.max(0, Math.min(this.pages.length - 1, index));
+        this.page.setFocus(this.focus === 'list');
         await this.page.open();
     }
-    /** Loads the open tab again (after a command ran). */
+    /** Puts the keyboard in the navigation or in the list. */
+    setFocus(focus) {
+        this.focus = focus;
+        this.page.setFocus(focus === 'list');
+    }
+    /** Loads the open section again (after a command ran). */
     reload() {
         return this.page.open();
     }
@@ -40,11 +74,14 @@ export class Shell {
         const parts = this.page.render(size);
         const unsaved = this.draft.count();
         const status = parts.status ?? this.app.status();
+        const category = this.page.categories().find((c) => c.id === this.page.category);
+        const keys = this.focus === 'nav' ? NAV_KEYS : parts.keys;
         return {
             ...parts,
+            path: parts.path.length ? parts.path : [this.page.label, ...(category ? [category.label] : [])],
             status: unsaved ? Theme.changed('unsaved: ' + unsaved) + '   ' + status : status,
             notice: this.notice ?? parts.notice,
-            keys: unsaved ? [['ctrl+s', 'save (' + unsaved + ')', 0], ...parts.keys] : parts.keys,
+            keys: unsaved ? [['ctrl+s', 'save (' + unsaved + ')', 0], ...keys] : keys,
         };
     }
     /** Writes the staged changes; the notice says what happened. */
@@ -75,11 +112,54 @@ export class Shell {
                 await this.openTab(index);
             return;
         }
+        if (this.focus === 'nav')
+            return this.navKey(key);
         const step = await this.page.handle(key);
-        if (step && step.done.kind === 'quit')
-            return this.leave();
+        if (step && step.done.kind === 'quit') {
+            // Esc (or Left) in the list: nothing left to close there, so go to the navigation.
+            this.setFocus('nav');
+            return;
+        }
         return step;
     }
+    /** A key while the navigation has the keyboard. */
+    async navKey(key) {
+        if (key.name === 'up' || key.name === 'down') {
+            await this.move(key.name === 'up' ? -1 : 1);
+            return;
+        }
+        if (key.name === 'right' || key.name === 'return') {
+            this.setFocus('list');
+            return;
+        }
+        if (key.name === 'escape')
+            return this.leave();
+        // The scopes of Settings and Apps switch from anywhere; "/" starts a search in the list.
+        if (key.name === 'tab')
+            return this.page.handle(key);
+        if (key.text === '/') {
+            this.setFocus('list');
+            return this.page.handle(key);
+        }
+        return;
+    }
+    /** One stop up or down the tree: the categories of the open section, then the next section. */
+    async move(by) {
+        const categories = this.page.categories();
+        const at = categories.findIndex((c) => c.id === this.page.category);
+        const next = at + by;
+        if (categories.length && next >= 0 && next < categories.length) {
+            await this.page.selectCategory(categories[next].id);
+            return;
+        }
+        const section = this.active + by;
+        if (section < 0 || section >= this.pages.length)
+            return;
+        await this.openTab(section);
+        const entered = this.page.categories();
+        if (entered.length)
+            await this.page.selectCategory(entered[by === 1 ? 0 : entered.length - 1].id);
+    }
     /** Leaving with unsaved changes asks what to do with them. */
     async leave() {
         const count = this.draft.count();

package/dist/cli/menu/vpn-login.d.ts

@@ -0,0 +1,16 @@
+import type { Context } from '../commands/context.js';
+import { type App } from '../tui/index.js';
+/** The row's id in the settings list. */
+export declare const VPN_LOGIN = "@vpn-login";
+export declare function vpnLoginRow(ctx: Context): {
+    label: string;
+    hint: string;
+    description: string;
+};
+export declare class VpnLoginFlow {
+    private readonly app;
+    private readonly ctx;
+    constructor(app: App, ctx: Context);
+    /** Returns the notice to show (undefined when cancelled). */
+    run(): Promise<string | undefined>;
+}

package/dist/cli/menu/vpn-login.js

@@ -0,0 +1,66 @@
+import { VPN_WARNINGS } from '../commands/vpn.js';
+import { NORD_STEPS, VpnService } from '../services/index.js';
+import { Theme } from '../tui/index.js';
+/** The row's id in the settings list. */
+export const VPN_LOGIN = '@vpn-login';
+export function vpnLoginRow(ctx) {
+    const service = new VpnService(ctx);
+    const nord = service.provider === 'nordvpn';
+    const state = service.loginState();
+    return {
+        label: nord ? 'Set NordVPN login…' : 'Set VPN login…',
+        hint: state === 'saved' ? 'saved' : state === 'unreadable' ? 'cannot be read' : 'not saved',
+        description: 'The login the VPN uses (for NordVPN the service credentials from Nord Account > NordVPN > Set up NordVPN manually, not your account password). Typed hidden, kept encrypted for your Windows user, never shown. ' +
+            VPN_WARNINGS.join(' '),
+    };
+}
+export class VpnLoginFlow {
+    app;
+    ctx;
+    constructor(app, ctx) {
+        this.app = app;
+        this.ctx = ctx;
+    }
+    /** Returns the notice to show (undefined when cancelled). */
+    async run() {
+        const service = new VpnService(this.ctx);
+        const nord = service.provider === 'nordvpn';
+        const path = ['Settings', 'Network', 'VPN login'];
+        await this.app.message({
+            path,
+            title: nord ? 'NordVPN service credentials' : 'VPN login',
+            lines: [
+                ...(nord
+                    ? ['To find them:', ...NORD_STEPS.map((s, i) => i + 1 + '. ' + s)]
+                    : ['The user name and password your VPN profile asks for.']),
+                '',
+                'What you type next is hidden, kept encrypted for your Windows user and never shown again.',
+                '',
+                ...VPN_WARNINGS,
+            ],
+        });
+        const username = await this.app.text({
+            path,
+            label: nord ? 'Service user name' : 'User name',
+            masked: true,
+            validate: (v) => (v.trim() ? true : 'Type the user name.'),
+        });
+        if (username === undefined)
+            return undefined;
+        const password = await this.app.text({
+            path,
+            label: nord ? 'Service password' : 'Password',
+            masked: true,
+            validate: (v) => (v ? true : 'Type the password.'),
+        });
+        if (password === undefined)
+            return undefined;
+        try {
+            service.save({ username, password });
+        }
+        catch (e) {
+            return Theme.error(Theme.glyph.cross + ' ' + (e instanceof Error ? e.message : String(e)));
+        }
+        return Theme.ok(Theme.glyph.ok + ' The VPN login is saved (encrypted). Turn the VPN on under Settings > Network.');
+    }
+}

package/dist/cli/output/print.d.ts

@@ -3,3 +3,5 @@ import type { Context } from '../commands/context.js';
 export declare function table(rows: string[][]): void;
 /** Prints `value` as JSON when --json was given; returns whether it did. */
 export declare function printJson(ctx: Context, value: unknown): boolean;
+/** A dim "Next: ..." line after a command: the usual thing to do now. */
+export declare function nextStep(text: string): void;

package/dist/cli/output/print.js

@@ -1,4 +1,6 @@
 import _ from 'lodash';
+import { scrubSecrets } from '../../core/schema/index.js';
+import { c } from './colors.js';
 /** Prints rows as aligned columns (the last column is not padded). */
 export function table(rows) {
     const widths = _.range(_.max(rows.map((r) => r.length)) ?? 0).map((i) => _.max(rows.map((r) => (r[i] ?? '').length)) ?? 0);
@@ -8,7 +10,12 @@ export function table(rows) {
 /** Prints `value` as JSON when --json was given; returns whether it did. */
 export function printJson(ctx, value) {
     // JSON.stringify leaves C1 controls (U+0080-U+009F) as they are; text from the sandbox must not reach a terminal raw.
+    // Secret values of your settings (agent API keys) never appear, whatever built the value.
     if (ctx.options.json)
-        console.log(JSON.stringify(value, null, 2).replace(/[\u0080-\u009f]/g, (ch) => '\\u' + ch.charCodeAt(0).toString(16).padStart(4, '0')));
+        console.log(scrubSecrets(JSON.stringify(value, null, 2), ctx.loaded.config).replace(/[\u0080-\u009f]/g, (ch) => '\\u' + ch.charCodeAt(0).toString(16).padStart(4, '0')));
     return ctx.options.json;
 }
+/** A dim "Next: ..." line after a command: the usual thing to do now. */
+export function nextStep(text) {
+    console.log(c.dim('Next: ' + text));
+}

package/dist/cli/services/accounts-service.d.ts

@@ -13,6 +13,8 @@ export interface AgentAccounts {
 export interface AccountRef {
     readonly name: string;
     readonly email: string | null;
+    /** Something worth telling after a switch (e.g. plugins were copied, or could not be). */
+    readonly note?: string;
 }
 export declare class AccountsService {
     private readonly ctx;

package/dist/cli/services/accounts-service.js

@@ -12,7 +12,7 @@ export class AccountsService {
     claude;
     constructor(ctx) {
         this.ctx = ctx;
-        this.claude = new AccountStore(ctx.storageRoot);
+        this.claude = new AccountStore(ctx.storageRoot, ctx.loaded.config.claudeProfile.sharePluginsAcrossAccounts);
     }
     /** Claude first, then the other agents that keep a login, then the ones that cannot. */
     agents() {
@@ -68,7 +68,7 @@ export class AccountsService {
     activate(name, agent = CLAUDE) {
         if (agent === CLAUDE) {
             const a = this.claude.activate(this.ctx.dataPath, name);
-            return { name: a.name, email: a.email };
+            return { name: a.name, email: a.email, note: this.claude.pluginNote ?? undefined };
         }
         const { store, stateDir } = this.other(agent);
         store.activate(this.ctx.dataPath, name, stateDir);

package/dist/cli/services/health-service.d.ts

@@ -1,10 +1,6 @@
-import { UserError } from '../../core/util/index.js';
 import type { Context } from '../commands/context.js';
-import type { RepairCheck, RepairEnv, RepairResult } from '../commands/repair/types.js';
 import { type Check } from '../commands/setup/checks.js';
 import { type MachineFacts } from '../commands/setup/facts.js';
-/** Runs every check in order; a check that throws is reported, never stops the rest. */
-export declare function runChecks(env: RepairEnv, checks?: RepairCheck[]): RepairResult[];
 /** What `sandbox setup` found out about this PC. */
 export interface SetupReport {
     readonly facts: MachineFacts;
@@ -17,8 +13,6 @@ export declare class HealthService {
     constructor(ctx: Context);
     /** The table `doctor` shows: [name, detail] rows. */
     doctor(): string[][];
-    /** Runs the repair checks (and the fixes they make). A config file that does not load is the first problem. */
-    repair(configError?: UserError | null): RepairResult[];
     /** Fails unless this is Windows: Windows Sandbox runs nowhere else. */
     assertWindows(): void;
     /** The setup checklist for this PC. */

package/dist/cli/services/health-service.js

@@ -1,28 +1,15 @@
-// Is this PC (and the sandbox) in good shape: doctor rows, repair checks, the setup checklist. Never prints.
-import path from 'node:path';
+// Is this PC (and the sandbox) in good shape: the doctor details, the setup checklist. The checks themselves are in
+// commands/repair (one engine for doctor and repair). Never prints.
 import { spawnSync } from 'node:child_process';
-import { loadConfig } from '../../core/config/index.js';
-import { errMsg, expandPath, fail, isWin, UserError } from '../../core/util/index.js';
+import { expandPath, fail, isWin } from '../../core/util/index.js';
 import { detectWsb, doctorRows, insideSandbox, isSandboxRunning } from '../../host/sandbox/index.js';
+import { machineDoctorRows } from '../../host/sharing/index.js';
 import { KnownProjects, ProjectRegistry } from '../../host/projects/index.js';
 import { nativeScript } from '../../host/native.js';
 import { refuseInSelfTest } from '../../host/test-guard.js';
 import { SYSTEM } from '../../shared/system.js';
-import { CHECKS } from '../commands/repair/checks.js';
 import { buildChecks, canEnableFeature } from '../commands/setup/checks.js';
 import { ENABLE_COMMAND, gatherFacts } from '../commands/setup/facts.js';
-/** Runs every check in order; a check that throws is reported, never stops the rest. */
-export function runChecks(env, checks = CHECKS) {
-    return checks.map((check) => {
-        try {
-            return { name: check.name, ...check.run(env) };
-        }
-        catch (e) {
-            const fix = e instanceof UserError && e.fix ? ' ' + e.fix : '';
-            return { name: check.name, status: 'needs-you', detail: 'check failed: ' + errMsg(e) + fix };
-        }
-    });
-}
 export class HealthService {
     ctx;
     constructor(ctx) {
@@ -45,6 +32,7 @@ export class HealthService {
         const wsb = p.wsbShare ? detectWsb() : null;
         return [
             ...rows,
+            ...machineDoctorRows(ctx.packageRoot, ctx.dataPath),
             [
                 'Project roots',
                 p.roots.length
@@ -75,31 +63,6 @@ export class HealthService {
             ],
         ];
     }
-    /** Runs the repair checks (and the fixes they make). A config file that does not load is the first problem. */
-    repair(configError = null) {
-        const { ctx } = this;
-        const env = {
-            ctx,
-            running: isSandboxRunning(),
-            dataPath: ctx.dataPath,
-            storageRoot: ctx.storageRoot,
-            toolsDir: path.join(ctx.dataPath, 'tools'),
-            configError,
-        };
-        // Re-check the config file even when the context loaded (it may have been edited since, or come from --config).
-        if (!env.configError) {
-            try {
-                loadConfig(ctx.options.config);
-            }
-            catch (e) {
-                if (e instanceof UserError)
-                    env.configError = e;
-                else
-                    throw e;
-            }
-        }
-        return runChecks(env);
-    }
     /** Fails unless this is Windows: Windows Sandbox runs nowhere else. */
     assertWindows() {
         if (!isWin)

package/dist/cli/services/index.d.ts

@@ -5,8 +5,10 @@ export { resolveCleanTargets, type CleanTarget } from './data-targets.js';
 export { DatabasesService, parseDatabaseList, type DatabaseAction, type DatabaseRow } from './databases-service.js';
 export { autoMigrates, continuesAfterFailedMigration, MigrateService, type MigrateContext, type MigrateResult, } from './migrate-service.js';
 export { NPM_UPDATE_COMMAND, UpdateService, runsAsSystem, type CheckResult, type UpdateServiceOptions, type UpdateStatus, type UpdateTaskPort, } from './update-service.js';
+export { NORD_STEPS, VpnService, type VpnReport } from './vpn-service.js';
 export { LogsService, type LogFile } from './logs-service.js';
-export { HealthService, runChecks, type SetupReport } from './health-service.js';
+export { WebService, webSession } from './web-service.js';
+export { HealthService, type SetupReport } from './health-service.js';
 export { ProjectsService, type ProjectRow, type ProjectSettings, type ProjectsListing } from './projects-service.js';
 export { SandboxService, type OtherSession, type ProjectInfo, type SandboxReport, type SandboxState, type StopPlan, } from './sandbox-service.js';
 export { SessionsService, projectOf, viewerText, type ListedSession, type RestartScope } from './sessions-service.js';

package/dist/cli/services/index.js

@@ -5,8 +5,10 @@ export { resolveCleanTargets } from './data-targets.js';
 export { DatabasesService, parseDatabaseList } from './databases-service.js';
 export { autoMigrates, continuesAfterFailedMigration, MigrateService, } from './migrate-service.js';
 export { NPM_UPDATE_COMMAND, UpdateService, runsAsSystem, } from './update-service.js';
+export { NORD_STEPS, VpnService } from './vpn-service.js';
 export { LogsService } from './logs-service.js';
-export { HealthService, runChecks } from './health-service.js';
+export { WebService, webSession } from './web-service.js';
+export { HealthService } from './health-service.js';
 export { ProjectsService } from './projects-service.js';
 export { SandboxService, } from './sandbox-service.js';
 export { SessionsService, projectOf, viewerText } from './sessions-service.js';

package/dist/cli/services/migrate-service.js

@@ -32,7 +32,7 @@ export class MigrateService {
     }
 }
 /** Commands that never update the settings first: they must work whatever state the settings are in. */
-const NO_AUTO_MIGRATION = ['self-test', 'migrate', 'update', '_watch'];
+const NO_AUTO_MIGRATION = ['self-test', 'migrate', 'update', '_watch', '_web'];
 /** Does this command update the saved settings before it runs (when the version changed)? Never inside a sandbox. */
 export function autoMigrates(command, inSandbox) {
     return !inSandbox && !NO_AUTO_MIGRATION.includes(command);

package/dist/cli/services/update-service.d.ts

@@ -9,6 +9,8 @@ export interface UpdateStatus {
     readonly scope: 'user' | 'machine' | null;
     readonly autoUpdate: boolean;
     readonly state: UpdateState;
+    /** Set when a failed update was undone and switched automatic updates off: the sentence to show (menu, CLI). */
+    readonly autoOffText?: string | null;
 }
 export interface CheckResult {
     readonly current: string;

package/dist/cli/services/update-service.js

@@ -9,7 +9,7 @@ import { errMsg, fail } from '../../core/util/index.js';
 import { packageVersion } from '../../core/package-info.js';
 import { InstallLayout, InstallRecordFile, UpdateTask, compareVersions } from '../../host/install/index.js';
 import { isSandboxRunning } from '../../host/sandbox/index.js';
-import { FolderFeed, GithubReleases, UpdateLock, Updater, UpdateStateFile, decideUpdate, isTooSoon, updateNotice, } from '../../host/update/index.js';
+import { FolderFeed, GithubReleases, UpdateLock, Updater, UpdateStateFile, autoOffText, decideUpdate, isTooSoon, updateNotice, } from '../../host/update/index.js';
 import { JsonFile } from '../../shared/io/index.js';
 /** The command for an install that is not managed (npm). */
 export const NPM_UPDATE_COMMAND = 'npm install -g windows-development-sandbox';
@@ -53,13 +53,17 @@ export class UpdateService {
     status() {
         const layout = this.layout;
         if (!layout)
-            return { managed: false, version: this.version, scope: null, autoUpdate: false, state: {} };
+            return { managed: false, version: this.version, scope: null, autoUpdate: false, state: {}, autoOffText: null };
+        const version = layout.activeVersion() ?? this.version;
+        const autoUpdate = new InstallRecordFile(layout.root).read()?.autoUpdate ?? false;
+        const state = new UpdateStateFile(layout.root).read();
         return {
             managed: true,
-            version: layout.activeVersion() ?? this.version,
+            version,
             scope: layout.scope,
-            autoUpdate: new InstallRecordFile(layout.root).read()?.autoUpdate ?? false,
-            state: new UpdateStateFile(layout.root).read(),
+            autoUpdate,
+            state,
+            autoOffText: !autoUpdate && state.autoOff ? autoOffText(state.autoOff.version, version) : null,
         };
     }
     /** Asks the source what is newest. Changes nothing (the time of the look is not recorded). */
@@ -92,7 +96,7 @@ export class UpdateService {
         if (!release)
             return null;
         try {
-            const updater = new Updater(layout, this.source, { now: this.now });
+            const updater = new Updater(layout, this.source, { now: this.now, task: this.task });
             return await updater.run({ sandboxRunning: this.sandboxRunning(), force: true });
         }
         finally {
@@ -129,6 +133,9 @@ export class UpdateService {
         const record = new InstallRecordFile(layout.root);
         if (!record.setAutoUpdate(on))
             fail('This install has no install.json.', 'Run the installer again: it writes the file.');
+        // Turned back on by the user: the "turned off by a failed update" remark is history.
+        if (on)
+            new UpdateStateFile(layout.root).update(({ autoOff: _gone, ...rest }) => rest);
     }
     /**
      * Should this CLI start update by itself? Only current-user installs (an all-users install has its scheduled task),

package/dist/cli/services/vpn-service.d.ts

@@ -0,0 +1,28 @@
+import type { Config } from '../../core/types.js';
+import type { VpnProvider } from '../../core/schema/index.js';
+import { type LoginState, type VpnCredentials, type VpnLine } from '../../host/vpn/index.js';
+import type { Context } from '../commands/context.js';
+export interface VpnReport {
+    readonly enabled: boolean;
+    readonly provider: VpnProvider;
+    readonly protocol: Config['vpn']['protocol'];
+    readonly country: string;
+    readonly killSwitch: boolean;
+    readonly login: LoginState;
+    readonly loginSavedAt: string | null;
+    /** The running sandbox's tunnel, when one runs with the VPN on. */
+    readonly running: VpnLine | null;
+}
+/** The steps to get the NordVPN service credentials, in the words of Nord Account (shown before asking). */
+export declare const NORD_STEPS: readonly string[];
+export declare class VpnService {
+    private readonly ctx;
+    private readonly login;
+    constructor(ctx: Context);
+    private get config();
+    get provider(): VpnProvider;
+    report(): Promise<VpnReport>;
+    loginState(): LoginState;
+    save(credentials: VpnCredentials): void;
+    remove(): boolean;
+}