windows-development-sandbox 1.5.0 → 1.7.0

package/dist/cli/commands/repair/checks/install.js

@@ -0,0 +1,318 @@
+// Install: how this program was installed, and whether the pieces a managed install runs from are in one piece (the
+// version and Node pointers, the shims, the PATH entry, the update task, the record). Fixes move a pointer, rewrite
+// shims or add the user PATH entry; they never delete a version.
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileExists } from '../../../../core/util/index.js';
+import { editUserPath } from '../../../../host/agent-commands/index.js';
+import { HIGH_INTEGRITY_SID, binsOfPackage, currentPathext, fileOnDisk, findCommandCopies, inspectPointers, ownBinDir, pathHas, repairPointers, sameFolder, shimProblems, } from '../../../../host/health/index.js';
+import { UpdateTask, writeShims } from '../../../../host/install/index.js';
+import { assertTestWritable, refuseInSelfTest } from '../../../../host/test-guard.js';
+import { globalPackages } from '../finders.js';
+import { ok, plural } from './common.js';
+const UNINSTALL = '& ([scriptblock]::Create((irm https://github.com/JoshDiDuca/windows-development-sandbox/releases/latest/download/install.ps1))) -Uninstall -Scope ';
+/** The exact way to get rid of one copy (nothing here runs it: doctor only prints it). */
+export function removalCommand(copy) {
+    switch (copy.kind) {
+        case 'managed-machine':
+            return 'in an admin PowerShell: ' + UNINSTALL + 'AllUsers';
+        case 'managed-user':
+            return 'in PowerShell: ' + UNINSTALL + 'CurrentUser';
+        case 'npm': {
+            const current = fileOnDisk(path.join(copy.dir, 'node_modules', 'windows-development-sandbox', 'package.json'));
+            return 'npm uninstall -g ' + (current ? 'windows-development-sandbox' : 'agent-sandbox');
+        }
+        case 'old-scripts': {
+            const root = path.basename(copy.dir).toLowerCase() === 'bin' ? path.dirname(copy.dir) : copy.dir;
+            return 'Remove-Item -Recurse -Force "' + root + '" (and take ' + copy.dir + ' off your PATH)';
+        }
+        default:
+            return 'delete ' + copy.files.join(', ') + ' in ' + copy.dir + ', or take that folder off the PATH';
+    }
+}
+const KIND_NAMES = {
+    'managed-machine': 'the install for everyone',
+    'managed-user': 'the install for just you',
+    npm: 'an npm copy',
+    'old-scripts': 'an old Scripts\\agent-sandbox copy',
+    other: 'a copy of unknown origin',
+};
+const managed = (env) => env.layout !== null;
+const machine = (env) => env.layout?.scope === 'machine';
+/** The commands of the version the pointers name, else of the one running now. */
+function currentBins(env) {
+    const layout = env.layout;
+    if (!layout)
+        return null;
+    const active = layout.activeVersion();
+    return (active ? binsOfPackage(layout.packageDir(active)) : null) ?? binsOfPackage(env.ctx.packageRoot);
+}
+export const INSTALL_CHECKS = [
+    {
+        id: 'install-kind',
+        group: 'Install',
+        name: 'Install type',
+        run: (env) => {
+            const layout = env.layout;
+            if (!layout)
+                return ok('npm global install (update it with npm; there are no automatic updates)');
+            const who = layout.scope === 'machine' ? 'for everyone on this PC' : 'for you';
+            return ok('managed install ' + who + ' in ' + layout.root + ', version ' + (layout.activeVersion() ?? 'unknown'));
+        },
+    },
+    {
+        id: 'install-record',
+        group: 'Install',
+        name: 'Install record',
+        applies: managed,
+        run: (env) => {
+            if (env.record)
+                return ok('install.json: ' + env.record.scope + ' install, automatic updates ' + (env.record.autoUpdate ? 'on' : 'off'));
+            return {
+                status: 'warn',
+                detail: 'install.json is missing or cannot be read',
+                means: 'Updates and sharing cannot tell how this was installed, so they act as if automatic updates are off.',
+                fix: 'Run the installer again over this install (it writes the record and keeps your data).',
+            };
+        },
+    },
+    {
+        id: 'install-pointers',
+        group: 'Install',
+        name: 'Active version',
+        applies: managed,
+        run: (env) => {
+            const layout = env.layout;
+            if (!layout)
+                return ok('');
+            const state = inspectPointers(layout);
+            if (!state.problems.length)
+                return ok('version ' + state.activeVersion + ' with Node ' + state.activeNode);
+            const base = {
+                status: 'needs-you',
+                detail: state.problems.join('; '),
+                means: 'The sandbox command cannot start until both pointers name an installed version and Node.',
+            };
+            if (!state.want)
+                return {
+                    ...base,
+                    fix: 'Nothing complete is installed in ' + layout.root + '. Run the installer again.',
+                };
+            return {
+                ...base,
+                plan: 'point active-version at ' + state.want.version + ' and active-node at ' + state.want.node + ' (installed)',
+            };
+        },
+        fix: (env) => {
+            if (!env.layout)
+                throw new Error('not a managed install');
+            assertTestWritable(env.layout.root);
+            return { done: 'pointed at ' + repairPointers(env.layout) };
+        },
+    },
+    {
+        id: 'install-shims',
+        group: 'Install',
+        name: 'Commands (shims)',
+        applies: managed,
+        run: (env) => {
+            const layout = env.layout;
+            const bins = currentBins(env);
+            if (!layout || !bins)
+                return { status: 'skipped', detail: 'the package.json of the active version cannot be read' };
+            const problems = shimProblems(layout, bins);
+            const count = Object.keys(bins).length;
+            if (!problems.missing.length && !problems.different.length)
+                return ok(plural(count, 'command') + ' in ' + layout.binDir + ' read the active version');
+            const bad = [
+                ...problems.missing.map((f) => f + ' (missing)'),
+                ...problems.different.map((f) => f + ' (out of date)'),
+            ];
+            return {
+                status: 'needs-you',
+                detail: bad.slice(0, 4).join(', ') + (bad.length > 4 ? ' and ' + (bad.length - 4) + ' more' : ''),
+                means: 'Typing sandbox in a terminal may fail or run the wrong version.',
+                plan: 'rewrite ' + plural(bad.length, 'command file') + ' in ' + layout.binDir,
+                lines: bad,
+            };
+        },
+        fix: (env) => {
+            const bins = currentBins(env);
+            if (!env.layout || !bins)
+                throw new Error('the package.json of the active version cannot be read');
+            assertTestWritable(env.layout.binDir);
+            writeShims(env.layout, bins);
+            return { done: 'rewrote the command files for ' + Object.keys(bins).join(', ') };
+        },
+    },
+    {
+        id: 'install-path',
+        group: 'Install',
+        name: 'PATH',
+        applies: managed,
+        timeoutMs: 40_000,
+        run: (env) => {
+            const layout = env.layout;
+            if (!layout)
+                return ok('');
+            const scope = layout.scope === 'machine' ? 'machine' : 'user';
+            const where = scope === 'machine' ? 'the PATH of this PC' : 'your PATH';
+            const own = env.system.registryPath(scope);
+            if (own === null)
+                return { status: 'skipped', detail: 'could not read ' + where };
+            if (pathHas(own, layout.binDir))
+                return ok(layout.binDir + ' is on ' + where);
+            const other = env.system.registryPath(scope === 'machine' ? 'user' : 'machine');
+            const base = {
+                status: 'needs-you',
+                detail: layout.binDir + ' is not on ' + where + (pathHas(other, layout.binDir) ? ' (only on the other one)' : ''),
+                means: 'New terminals will not find the sandbox command.',
+            };
+            if (scope === 'user')
+                return { ...base, plan: 'add ' + layout.binDir + ' to your PATH' };
+            return {
+                ...base,
+                fix: 'Run the installer again in an admin PowerShell (it adds the folder to the PATH of this PC).',
+            };
+        },
+        fix: (env) => {
+            if (!env.layout)
+                throw new Error('not a managed install');
+            editUserPath(env.layout.binDir, true, env.storageRoot);
+            return { done: 'added ' + env.layout.binDir + ' to your PATH (open a new terminal to use it)' };
+        },
+    },
+    {
+        id: 'install-copies',
+        group: 'Install',
+        name: 'Copies on the PATH',
+        timeoutMs: 40_000,
+        run: (env) => {
+            const machinePath = env.system.registryPath('machine');
+            const userPath = env.system.registryPath('user');
+            const copies = findCommandCopies({
+                machinePath: machinePath ?? (userPath === null ? (process.env.Path ?? null) : null),
+                userPath,
+                pathext: currentPathext(),
+                programFiles: process.env.ProgramFiles ?? null,
+                localAppData: process.env.LOCALAPPDATA ?? null,
+                exists: fileOnDisk,
+            });
+            if (!copies.length)
+                return ok('no sandbox command is on the PATH of a new terminal');
+            const runs = copies.find((c) => c.files.some((f) => f.startsWith('sandbox.'))) ?? copies[0];
+            const own = ownBinDir(env.ctx.packageRoot, env.layout?.binDir ?? null);
+            const keep = copies.find((c) => c.kind === 'managed-machine' || c.kind === 'managed-user') ?? runs;
+            if (copies.length === 1 && (!own || sameFolder(own, runs.dir)))
+                return ok('one copy: ' + runs.dir + ' (' + KIND_NAMES[runs.kind] + ')');
+            const hidden = copies.filter((c) => c !== keep);
+            const wrong = keep !== runs;
+            return {
+                status: wrong || (own !== null && !sameFolder(own, runs.dir)) ? 'needs-you' : 'warn',
+                detail: wrong
+                    ? 'typing sandbox runs ' + runs.dir + ' (' + KIND_NAMES[runs.kind] + '), not ' + keep.dir
+                    : copies.length + ' copies are on the PATH; ' + runs.dir + ' runs (' + KIND_NAMES[runs.kind] + ')',
+                means: wrong
+                    ? 'The install you update is hidden, so its fixes never reach you, and sharing with other users may not work from this copy.'
+                    : 'The others are never used, and they may be the ones an old shortcut or script starts.',
+                fix: 'Remove the copies you do not want (repair never deletes them; run "Get-Command sandbox -All" to list them):',
+                lines: hidden.map((c) => c.dir + ': ' + removalCommand(c)),
+            };
+        },
+    },
+    {
+        id: 'install-task',
+        group: 'Install',
+        name: 'Automatic updates',
+        applies: machine,
+        timeoutMs: 40_000,
+        run: (env) => {
+            const wanted = env.record?.autoUpdate ?? false;
+            const has = env.system.updateTaskExists();
+            if (has === null)
+                return { status: 'skipped', detail: 'could not ask Windows about the update task' };
+            if (has === wanted)
+                return ok(wanted ? 'on, and the scheduled task is there' : 'off, and no scheduled task is left');
+            const admin = env.system.tokenHasGroup(HIGH_INTEGRITY_SID) === true;
+            const command = 'sandbox update --auto ' + (wanted ? 'on' : 'off');
+            const base = {
+                status: 'needs-you',
+                detail: wanted
+                    ? 'automatic updates are on but the scheduled task \\WindowsDevelopmentSandbox\\Update is missing'
+                    : 'automatic updates are off but the scheduled task is still there',
+                means: wanted ? 'No update is installed by itself.' : 'The task keeps trying to update.',
+            };
+            return admin
+                ? { ...base, plan: wanted ? 'create the update task' : 'remove the update task' }
+                : { ...base, fix: 'Changing it needs admin rights. In an admin terminal run: ' + command };
+        },
+        fix: (env) => {
+            if (!env.layout)
+                throw new Error('not a managed install');
+            refuseInSelfTest('change scheduled tasks');
+            const task = new UpdateTask(env.layout);
+            if (env.record?.autoUpdate) {
+                task.register();
+                return { done: 'created the update task' };
+            }
+            task.remove();
+            return { done: 'removed the update task' };
+        },
+    },
+    {
+        id: 'install-user-leftover',
+        group: 'Install',
+        name: 'Install for just you',
+        applies: (env) => machine(env) && env.userInstallRoot !== null,
+        run: (env) => {
+            const root = env.userInstallRoot;
+            if (!root || !fileExists(path.join(root, 'active-version')))
+                return ok('no second install for just you next to this one');
+            return {
+                status: 'warn',
+                detail: 'an install for just you is still in ' + root,
+                means: 'Both are on your PATH; whichever comes first runs, and its updates differ from the one for everyone.',
+                fix: 'Remove it in PowerShell (your data stays): ' + UNINSTALL + 'CurrentUser',
+            };
+        },
+    },
+    {
+        id: 'install-old-npm',
+        group: 'Install',
+        name: 'npm packages',
+        timeoutMs: 90_000,
+        run: (env) => {
+            const npmCli = path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');
+            if (!fileExists(npmCli))
+                return { status: 'skipped', detail: 'npm not found next to this Node (' + npmCli + ')' };
+            // cwd = Node's own folder: npm reads .npmrc from the current folder, which could be a sandbox-writable workspace.
+            const result = spawnSync(process.execPath, [npmCli, 'ls', '-g', '--json', '--depth=0'], {
+                cwd: path.dirname(process.execPath),
+                encoding: 'utf8',
+                windowsHide: true,
+                timeout: 60000,
+                maxBuffer: 16 * 1024 * 1024,
+            });
+            const names = globalPackages(result.stdout ?? '');
+            if (!names.length)
+                return { status: 'skipped', detail: 'could not read the global npm packages' };
+            if (names.includes('agent-sandbox') && names.includes('windows-development-sandbox'))
+                return {
+                    status: 'needs-you',
+                    detail: 'the old agent-sandbox package is installed next to windows-development-sandbox',
+                    means: 'Their commands clash, and the one first on PATH runs.',
+                    fix: 'Run: npm uninstall -g agent-sandbox',
+                };
+            if (managed(env) && names.includes('windows-development-sandbox'))
+                return {
+                    status: 'warn',
+                    detail: 'an npm global copy of windows-development-sandbox is installed next to the managed install',
+                    means: 'Both are on PATH; whichever comes first runs, and only the managed one updates itself.',
+                    fix: 'Run: npm uninstall -g windows-development-sandbox',
+                };
+            return ok(names.includes('agent-sandbox')
+                ? 'agent-sandbox installed (the old name; fine on its own)'
+                : 'no old agent-sandbox package');
+        },
+    },
+];

package/dist/cli/commands/repair/checks/machine.d.ts

@@ -0,0 +1,2 @@
+import type { Check } from '../types.js';
+export declare const MACHINE_CHECKS: Check[];

package/dist/cli/commands/repair/checks/machine.js

@@ -0,0 +1,232 @@
+// All-users install: can this user read the settings for the PC, is this user in the sharing group, is the data folder
+// private, are the group's permissions gone when nothing is shared, and are there records of sandboxes that are gone.
+// Only for an install in Program Files; every other install skips these.
+import fs from 'node:fs';
+import path from 'node:path';
+import { errMsg, isInsideOrEqual, isLink } from '../../../../core/util/index.js';
+import { SHARING_GROUP, groupEntries, parseIcacls, privacyProblems, sharedFolders, staleActiveRecords, } from '../../../../host/health/index.js';
+import { ActiveRecords, applyAcl, protectPrivateFolder, sharingAclPlan, currentUserName, } from '../../../../host/sharing/index.js';
+import { holdsData, storageOf } from '../../../../host/storage/index.js';
+import { ok, plural, sameUser } from './common.js';
+const machine = (env) => env.layout?.scope === 'machine';
+const usersDir = (env) => path.join(env.machineHome, 'users');
+const records = (env) => new ActiveRecords(path.join(env.machineHome, 'active'));
+/** The per-user folder under users\ that holds the storage root, or null when the root is somewhere else. */
+function privateFolder(env) {
+    const users = path.resolve(usersDir(env));
+    const root = path.resolve(env.storageRoot);
+    if (!isInsideOrEqual(users, root) || root.toLowerCase() === users.toLowerCase())
+        return null;
+    return path.join(users, path.relative(users, root).split(path.sep)[0]);
+}
+/** Does this user have a shared sandbox running (their record says shared, and Windows says it runs)? */
+function sharedRecord(env) {
+    return (env.running &&
+        records(env)
+            .readAll()
+            .some((r) => r.shared && r.dataPath.toLowerCase() === env.dataPath.toLowerCase()));
+}
+function icaclsOf(env, dir) {
+    const text = env.system.icacls(dir);
+    return text === null ? null : parseIcacls(text, dir);
+}
+export const MACHINE_CHECKS = [
+    {
+        id: 'machine-config',
+        group: 'Install',
+        name: 'Settings for this PC',
+        applies: machine,
+        run: (env) => {
+            const file = path.join(env.machineHome, 'config.json');
+            try {
+                fs.accessSync(file, fs.constants.R_OK);
+                return ok(file + ' is readable');
+            }
+            catch (e) {
+                const code = e.code;
+                if (code === 'ENOENT' || code === 'ENOTDIR')
+                    return ok('no ' + file + ' (the built-in defaults apply)');
+                return {
+                    status: 'needs-you',
+                    detail: file + ' cannot be read (' + errMsg(e) + ')',
+                    means: 'Without it your settings for this PC (and the shared defaults) are ignored or refused.',
+                    fix: 'Sign out of Windows and in again if you were just added to the group "' +
+                        SHARING_GROUP +
+                        '"; otherwise ask an administrator to let that group read the file.',
+                };
+            }
+        },
+    },
+    {
+        id: 'machine-group',
+        group: 'Install',
+        name: 'Sharing group',
+        applies: machine,
+        timeoutMs: 30_000,
+        run: (env) => {
+            const members = env.system.groupMembers();
+            if (members === null)
+                return { status: 'skipped', detail: 'could not read the group "' + SHARING_GROUP + '"' };
+            const user = currentUserName();
+            if (!members.some((m) => sameUser(m, user)))
+                return {
+                    status: 'needs-you',
+                    detail: user + ' is not in the group "' + SHARING_GROUP + '"',
+                    means: 'You cannot read the settings for this PC or use a sandbox someone shares.',
+                    fix: 'Ask an administrator, or in an admin terminal run: net localgroup "' +
+                        SHARING_GROUP +
+                        '" ' +
+                        user +
+                        ' /add  (then sign out and in)',
+                };
+            const sid = env.record?.groupSid;
+            if (sid && env.system.tokenHasGroup(sid) === false)
+                return {
+                    status: 'needs-you',
+                    detail: user + ' is in the group, but this session was started before that',
+                    means: 'Windows only counts group membership after you sign in again.',
+                    fix: 'Sign out of Windows and in again.',
+                };
+            return ok(user + ' is in the group "' + SHARING_GROUP + '"');
+        },
+    },
+    {
+        id: 'machine-data-private',
+        group: 'Data folder',
+        name: 'Private data folder',
+        applies: machine,
+        timeoutMs: 30_000,
+        run: (env) => {
+            const dir = privateFolder(env);
+            if (!dir)
+                return ok(env.storageRoot + ' is not under ' + usersDir(env) + ' (your own choice; not shared)');
+            if (!fs.existsSync(dir))
+                return ok(dir + ' is not created yet');
+            if (isLink(dir))
+                return {
+                    status: 'needs-you',
+                    detail: dir + ' is a link',
+                    means: 'It is refused: a link could lead elsewhere.',
+                    fix: 'Remove the link, or point storage.root at a real folder (sandbox storage move).',
+                };
+            const entries = icaclsOf(env, dir);
+            if (!entries)
+                return { status: 'skipped', detail: 'could not read the permissions of ' + dir };
+            const bad = privacyProblems(entries, SHARING_GROUP);
+            if (!bad.length)
+                return ok(dir + ' is private to you');
+            return {
+                status: 'needs-you',
+                detail: dir + ' can also be read by: ' + bad.join(', '),
+                means: 'Your saved logins and history are in there; other users of this PC could read them.',
+                plan: 'make ' + dir + ' private (you, SYSTEM and Administrators only)',
+                data: dir,
+            };
+        },
+        fix: (_env, finding) => {
+            const dir = String(finding.data);
+            // A folder with files is walked file by file (a few hundred thousand take minutes), and this waits for it: the
+            // only other way is a hand-made icacls command, which is easier to get wrong than this script.
+            if (holdsData(dir))
+                console.log('Changing the permissions of everything in ' + dir + '. This can take minutes.');
+            protectPrivateFolder(dir, { walkAll: true });
+            return { done: 'made ' + dir + ' private' };
+        },
+    },
+    {
+        id: 'machine-stale-acl',
+        group: 'Data folder',
+        name: 'Sharing permissions',
+        applies: (env) => machine(env) && Boolean(env.record?.groupSid),
+        needsIdle: 'look',
+        timeoutMs: 40_000,
+        run: (env) => {
+            const priv = privateFolder(env);
+            if (!priv)
+                return ok('your data folder is not in the shared tree; nothing is opened to the group');
+            const folders = sharedFolders(storageOf(env.dataPath), env.dataPath).filter((d) => fs.existsSync(d));
+            const stale = [];
+            for (const dir of folders) {
+                const entries = icaclsOf(env, dir);
+                if (entries && groupEntries(entries, SHARING_GROUP).length)
+                    stale.push(dir);
+            }
+            if (!stale.length)
+                return ok('the group "' + SHARING_GROUP + '" has no access to your folders (nothing is shared)');
+            return {
+                status: 'needs-you',
+                detail: 'the group "' + SHARING_GROUP + '" still has access to ' + plural(stale.length, 'of your folder'),
+                means: 'Others could enter your data folder although you are not sharing a sandbox.',
+                plan: 'remove the group from ' + plural(stale.length, 'folder') + ' (only those entries; nothing inside changes)',
+                lines: stale,
+            };
+        },
+        fix: (env) => {
+            const sid = env.record?.groupSid;
+            if (!sid)
+                throw new Error('install.json has no group');
+            applyAcl(sharingAclPlan({ storageUserDir: storageOf(env.dataPath), dataPath: env.dataPath, groupSid: sid, on: false }));
+            return { done: 'removed the group from your folders' };
+        },
+    },
+    {
+        id: 'machine-run-shared',
+        group: 'Data folder',
+        name: 'Shared run folder',
+        applies: (env) => machine(env) && Boolean(env.record?.groupSid),
+        timeoutMs: 40_000,
+        run: (env) => {
+            if (!sharedRecord(env))
+                return ok('no sandbox of yours is shared right now');
+            const run = path.join(env.dataPath, 'run');
+            const entries = icaclsOf(env, run);
+            if (!entries)
+                return { status: 'skipped', detail: 'could not read the permissions of ' + run };
+            if (groupEntries(entries, SHARING_GROUP).length)
+                return ok('the group can use ' + run);
+            return {
+                status: 'warn',
+                detail: 'your sandbox is shared but the group cannot use ' + run,
+                means: 'Others cannot attach to it or run commands in it.',
+                plan: 'open ' + run + ' to the group again',
+            };
+        },
+        fix: (env) => {
+            const sid = env.record?.groupSid;
+            if (!sid)
+                throw new Error('install.json has no group');
+            applyAcl(sharingAclPlan({ storageUserDir: storageOf(env.dataPath), dataPath: env.dataPath, groupSid: sid, on: true }));
+            return { done: 'opened the run folder to the group' };
+        },
+    },
+    {
+        id: 'machine-active-records',
+        group: 'Sandbox',
+        name: 'Sharing records',
+        applies: machine,
+        run: (env) => {
+            const all = records(env).readAll();
+            const stale = staleActiveRecords(all, env.system.processes());
+            if (!stale.length)
+                return ok(all.length ? plural(all.length, 'record') + ', all of a running sandbox' : 'none');
+            return {
+                status: 'needs-you',
+                detail: plural(stale.length, 'record') +
+                    ' of sandboxes that are no longer running (' +
+                    stale.map((r) => r.user).join(', ') +
+                    ')',
+                means: 'They can make other users think a sandbox is running or whose it is.',
+                plan: 'remove ' + plural(stale.length, 'stale record'),
+                data: stale.map((r) => r.sid),
+            };
+        },
+        fix: (env, finding) => {
+            const sids = Array.isArray(finding.data) ? finding.data : [];
+            // Looked at again now: a sandbox that started since is not removed.
+            const still = staleActiveRecords(records(env).readAll(), env.system.processes()).filter((r) => sids.includes(r.sid));
+            for (const r of still)
+                records(env).clear(r.sid);
+            return { done: 'removed ' + plural(still.length, 'stale record') };
+        },
+    },
+];

package/dist/cli/commands/repair/checks/network.d.ts

@@ -0,0 +1,6 @@
+import type { Check } from '../types.js';
+/** The first proxy variable that is set: [name, value]. */
+export declare function proxyFromEnvironment(env?: NodeJS.ProcessEnv): [string, string] | null;
+/** null when the value is a proxy address the downloads can use, else why not. */
+export declare function proxyProblem(value: string): string | null;
+export declare const NETWORK_CHECKS: Check[];

package/dist/cli/commands/repair/checks/network.js

@@ -0,0 +1,60 @@
+import { ok } from './common.js';
+const PROXY_VARIABLES = ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'ALL_PROXY', 'all_proxy'];
+const REACH_MS = 6000;
+/** The first proxy variable that is set: [name, value]. */
+export function proxyFromEnvironment(env = process.env) {
+    for (const name of PROXY_VARIABLES) {
+        const value = env[name]?.trim();
+        if (value)
+            return [name, value];
+    }
+    return null;
+}
+/** null when the value is a proxy address the downloads can use, else why not. */
+export function proxyProblem(value) {
+    try {
+        const url = new URL(/^[a-z][a-z0-9+.-]*:\/\//i.test(value) ? value : 'http://' + value);
+        return url.hostname ? null : 'it has no host name';
+    }
+    catch {
+        return 'it is not an address';
+    }
+}
+export const NETWORK_CHECKS = [
+    {
+        id: 'net-proxy',
+        group: 'Network',
+        name: 'Proxy',
+        run: () => {
+            const proxy = proxyFromEnvironment();
+            if (!proxy)
+                return ok('no proxy variable set');
+            const problem = proxyProblem(proxy[1]);
+            if (!problem)
+                return ok(proxy[0] + ' = ' + proxy[1].replace(/\/\/[^@/]*@/, '//***@'));
+            return {
+                status: 'warn',
+                detail: proxy[0] + ' is set but ' + problem,
+                means: 'Downloads that follow the proxy settings will fail.',
+                fix: 'Set ' + proxy[0] + ' to an address like http://proxy.example.com:8080, or remove it.',
+            };
+        },
+    },
+    {
+        id: 'net-github',
+        group: 'Network',
+        name: 'GitHub',
+        checking: 'whether GitHub can be reached',
+        timeoutMs: REACH_MS + 4000,
+        run: async (env) => {
+            if (await env.system.reachable('https://github.com', REACH_MS))
+                return ok('github.com answers');
+            return {
+                status: 'warn',
+                detail: 'github.com did not answer within ' + REACH_MS / 1000 + ' seconds',
+                means: 'Updates and some tool downloads need it. Without it they fail or use what is already saved.',
+                fix: 'Check your internet connection, VPN or proxy, then run this again.',
+            };
+        },
+    },
+];

package/dist/cli/commands/repair/checks/pc.d.ts

@@ -0,0 +1,4 @@
+import type { Check } from '../types.js';
+/** One line of the setup checklist as a check. */
+export declare function fromFacts(id: string, group: Check['group'], setupName: string, name?: string): Check;
+export declare const PC_CHECKS: Check[];