windows-development-sandbox 1.5.0 → 1.9.0

package/dist/cli/commands/repair/checks/data.js

@@ -0,0 +1,241 @@
+// The data folder: where it is, that it can be written, how much room is left, data left behind in another folder, and
+// what an interrupted install left inside it (links the sandbox made, half-downloaded or half-installed tools). Nothing
+// here follows a link or deletes anything but leftovers.
+import fs from 'node:fs';
+import path from 'node:path';
+import { GB, freeBytesAt, humanBytes } from '../../../../core/disk.js';
+import { dirExists, isLink, removeLink } from '../../../../core/util/index.js';
+import { writeProblem } from '../../../../host/health/index.js';
+import { assertTestWritable } from '../../../../host/test-guard.js';
+import { OLD_DEFAULT_ROOT, StorageHistory, holdsData, oldDefaultRoot, otherDataFolders, sharedDefaultRoot, } from '../../../../host/storage/index.js';
+import { removeTree } from '../../data/remove.js';
+import { findHalfInstalled, findLinks, findStagingLeftovers, resolvedVersionsValid } from '../finders.js';
+import { guard, ok, plural, rel } from './common.js';
+const same = (a, b) => path.resolve(a).toLowerCase() === path.resolve(b).toLowerCase();
+export const DATA_CHECKS = [
+    {
+        id: 'data-folder',
+        group: 'Data folder',
+        name: 'Data folder',
+        checking: 'where the data folder is',
+        run: (env) => {
+            for (const dir of [env.storageRoot, env.dataPath])
+                if (isLink(dir))
+                    return {
+                        status: 'needs-you',
+                        detail: dir + ' is a link or junction',
+                        means: 'The sandbox tool refuses to work through links: one could lead to other folders on this PC.',
+                        fix: 'Point storage.root at the real folder (sandbox config path), or move the data with: sandbox storage move <folder>',
+                    };
+            if (!dirExists(env.storageRoot))
+                return ok(env.storageRoot + ' (not created yet; the first start makes it)');
+            const bad = writeProblem(env.storageRoot) ?? (dirExists(env.dataPath) ? writeProblem(env.dataPath) : null);
+            if (bad)
+                return {
+                    status: 'needs-you',
+                    detail: 'cannot write in ' + env.storageRoot + ' (' + bad + ')',
+                    means: 'The sandbox cannot save its tools, logins or logs.',
+                    fix: 'Check the folder is not read-only and that you may write to it, or choose another with: sandbox storage move <folder>',
+                };
+            return ok(env.dataPath + ' (you can write there)');
+        },
+    },
+    {
+        id: 'data-disk',
+        group: 'Data folder',
+        name: 'Free disk space',
+        run: (env) => {
+            const free = freeBytesAt(env.storageRoot);
+            if (free === null)
+                return { status: 'skipped', detail: 'could not check the drive of ' + env.storageRoot };
+            if (free >= 20 * GB)
+                return ok(humanBytes(free) + ' free');
+            return {
+                status: 'warn',
+                detail: humanBytes(free) +
+                    ' free on the drive of ' +
+                    env.storageRoot +
+                    (free < 5 * GB ? ' (toolchains need several GB)' : ' (getting low)'),
+                means: 'Tool installs and caches can use several GB.',
+                fix: 'See what is stored with: sandbox data, and free space with: sandbox data clean <target>',
+            };
+        },
+    },
+    {
+        id: 'data-pinned-old',
+        group: 'Data folder',
+        name: 'Old data folder',
+        run: (env) => {
+            const old = oldDefaultRoot();
+            const shared = sharedDefaultRoot();
+            if (!old || !same(env.storageRoot, old) || same(old, shared))
+                return ok('your data is not in the old per-user folder');
+            if (!holdsData(env.storageRoot))
+                return ok('the old folder is empty');
+            return {
+                status: 'warn',
+                detail: 'your data is still in the old per-user folder ' +
+                    old +
+                    ' (kept by settings that say ' +
+                    OLD_DEFAULT_ROOT +
+                    ')',
+                means: 'It keeps working. New installs keep their data in ' +
+                    shared +
+                    ', which only you can read, and which an install for everyone can share.',
+                fix: 'Move it when you like (it shows the size and time first): sandbox storage move "' + shared + '"',
+            };
+        },
+    },
+    {
+        id: 'data-elsewhere',
+        group: 'Data folder',
+        name: 'Data in other folders',
+        run: (env) => {
+            const others = otherDataFolders(env.storageRoot, new StorageHistory(env.userDir));
+            if (!others.length)
+                return ok('no saved data in any other known folder');
+            const both = holdsData(env.storageRoot);
+            return {
+                status: 'warn',
+                detail: (both ? 'data is in this folder and also in ' : 'data is in ') + others.join(', '),
+                means: both
+                    ? 'A move may have stopped half way, or you used another version for a while. Nothing is deleted for you.'
+                    : 'Your current data folder is empty, so the sandbox starts from scratch. That data is not lost.',
+                fix: both
+                    ? 'Check that other folder, and delete it yourself when you are sure. Or switch to it with: sandbox storage use "' +
+                        others[0] +
+                        '"'
+                    : 'Bring it here with: sandbox storage move "' +
+                        others[0] +
+                        '" (or switch with: sandbox storage use "' +
+                        others[0] +
+                        '")',
+            };
+        },
+    },
+    {
+        id: 'data-links',
+        group: 'Data folder',
+        name: 'Links in the data folder',
+        checking: 'the data folder for links',
+        needsIdle: 'look',
+        run: (env) => {
+            const links = findLinks(env.dataPath);
+            if (!links.length)
+                return ok('none (nothing in ' + env.dataPath + ' points elsewhere)');
+            return {
+                status: 'needs-you',
+                detail: plural(links.length, 'link') + ' made inside the sandbox',
+                means: "A link here could point at this PC's own files; the tool must not follow it.",
+                plan: 'remove ' + plural(links.length, 'link') + ' without following them',
+                lines: links.map((l) => rel(env.dataPath, l)),
+                data: links,
+            };
+        },
+        fix: (env, finding) => {
+            const links = Array.isArray(finding.data) ? finding.data : [];
+            // Only if every folder above is still real.
+            for (const link of links) {
+                guard(env, path.dirname(link));
+                removeLink(link);
+            }
+            return {
+                done: 'removed ' + plural(links.length, 'link') + ' without following ' + (links.length === 1 ? 'it' : 'them'),
+            };
+        },
+    },
+    {
+        id: 'data-downloads',
+        group: 'Data folder',
+        name: 'Interrupted downloads',
+        needsIdle: 'look',
+        run: (env) => {
+            guard(env, env.toolsDir);
+            const found = findStagingLeftovers(env.toolsDir);
+            if (!found.length)
+                return ok('none');
+            return {
+                status: 'needs-you',
+                detail: plural(found.length, 'half-finished download or copy folder'),
+                means: 'They only waste space; the next start downloads again.',
+                plan: 'remove ' + plural(found.length, 'half-finished folder'),
+                lines: found.map((p) => rel(env.toolsDir, p)),
+                data: found,
+            };
+        },
+        fix: (env, finding) => {
+            const found = Array.isArray(finding.data) ? finding.data : [];
+            guard(env, env.toolsDir);
+            for (const p of found)
+                removeTree(p, env.dataPath);
+            return { done: 'removed ' + plural(found.length, 'half-finished folder') };
+        },
+    },
+    {
+        id: 'data-toolchains',
+        group: 'Data folder',
+        name: 'Half-installed toolchains',
+        needsIdle: 'look',
+        run: (env) => {
+            guard(env, env.toolsDir);
+            const found = findHalfInstalled(env.toolsDir);
+            if (!found.length)
+                return ok('every toolchain folder has its program');
+            return {
+                status: 'needs-you',
+                detail: found.map((f) => rel(env.toolsDir, f.path) + ' (no ' + f.missing + ')').join(', '),
+                means: 'An install stopped half way; that tool will not run.',
+                plan: 'remove ' + plural(found.length, 'half-installed folder') + ' (the next sandbox installs them again)',
+                data: found.map((f) => f.path),
+            };
+        },
+        fix: (env, finding) => {
+            const found = Array.isArray(finding.data) ? finding.data : [];
+            guard(env, env.toolsDir);
+            for (const p of found)
+                removeTree(p, env.dataPath);
+            return {
+                done: 'removed ' + found.map((p) => rel(env.toolsDir, p)).join(', ') + '; the next sandbox installs them again',
+            };
+        },
+    },
+    {
+        id: 'data-versions-cache',
+        group: 'Data folder',
+        name: 'Resolved versions cache',
+        needsIdle: 'look',
+        run: (env) => {
+            const file = path.join(env.toolsDir, 'resolved-versions.json');
+            if (!fs.existsSync(file) && !isLink(file))
+                return ok('not created yet');
+            guard(env, env.toolsDir);
+            if (isLink(file))
+                return {
+                    status: 'needs-you',
+                    detail: 'tools\\resolved-versions.json is a link',
+                    plan: 'remove the link',
+                    data: file,
+                };
+            if (fs.statSync(file).size < 4 * 1024 * 1024 && resolvedVersionsValid(fs.readFileSync(file, 'utf8')))
+                return ok('valid');
+            return {
+                status: 'needs-you',
+                detail: 'tools\\resolved-versions.json is damaged',
+                means: 'The sandbox cannot read which tool versions it looked up.',
+                plan: 'remove it (versions are looked up again on the next start)',
+                data: file,
+            };
+        },
+        fix: (env, finding) => {
+            const file = String(finding.data);
+            guard(env, env.toolsDir);
+            if (isLink(file)) {
+                removeLink(file);
+                return { done: 'removed the link in place of tools\\resolved-versions.json' };
+            }
+            assertTestWritable(file);
+            fs.rmSync(file, { force: true });
+            return { done: 'removed tools\\resolved-versions.json (versions are looked up again on the next start)' };
+        },
+    },
+];

package/dist/cli/commands/repair/checks/hcs.d.ts

@@ -0,0 +1,7 @@
+import { type HcsProbes } from '../../../../host/engines/index.js';
+import type { Check } from '../types.js';
+/** Replaceable by tests: the probes the row looks through. */
+export declare const HCS_PROBES: {
+    current: HcsProbes | null;
+};
+export declare const HCS_CHECKS: Check[];

package/dist/cli/commands/repair/checks/hcs.js

@@ -0,0 +1,28 @@
+// The HCS engine (alpha), only when sandbox.engine is "hcs": can this PC run it. Looks only; the fixes are commands for
+// you to run (they change Windows), never run by repair.
+import { checkHcs, realHcsProbes } from '../../../../host/engines/index.js';
+import { ok } from './common.js';
+const hcsInUse = (env) => env.ctx.loaded.config.sandbox.engine === 'hcs';
+/** Replaceable by tests: the probes the row looks through. */
+export const HCS_PROBES = { current: null };
+export const HCS_CHECKS = [
+    {
+        id: 'hcs-engine',
+        group: 'Sandbox',
+        name: 'HCS engine (alpha)',
+        checking: 'the HCS engine',
+        applies: hcsInUse,
+        timeoutMs: 60000,
+        run: () => {
+            const check = checkHcs(HCS_PROBES.current ?? realHcsProbes());
+            if (check.available)
+                return ok('this PC can run it (starting it is not enabled yet in this alpha)');
+            return {
+                status: 'needs-you',
+                detail: check.reasons.length + ' thing(s) missing: ' + check.reasons[0],
+                means: check.reasons.join(' '),
+                fix: check.fixes.join('  |  '),
+            };
+        },
+    },
+];

package/dist/cli/commands/repair/checks/index.d.ts

@@ -0,0 +1,2 @@
+import type { Check } from '../types.js';
+export declare const ALL_CHECKS: readonly Check[];

package/dist/cli/commands/repair/checks/index.js

@@ -0,0 +1,24 @@
+import { AGENT_CHECKS } from './agents.js';
+import { CONTAINED_CHECKS } from './contained.js';
+import { DATA_CHECKS } from './data.js';
+import { HCS_CHECKS } from './hcs.js';
+import { INSTALL_CHECKS } from './install.js';
+import { MACHINE_CHECKS } from './machine.js';
+import { NETWORK_CHECKS } from './network.js';
+import { PC_CHECKS } from './pc.js';
+import { SANDBOX_CHECKS } from './sandbox.js';
+import { SETTINGS_CHECKS } from './settings.js';
+import { VPN_CHECKS } from './vpn.js';
+export const ALL_CHECKS = [
+    ...PC_CHECKS,
+    ...INSTALL_CHECKS,
+    ...MACHINE_CHECKS,
+    ...DATA_CHECKS,
+    ...CONTAINED_CHECKS,
+    ...SETTINGS_CHECKS,
+    ...SANDBOX_CHECKS,
+    ...HCS_CHECKS,
+    ...AGENT_CHECKS,
+    ...NETWORK_CHECKS,
+    ...VPN_CHECKS,
+];

package/dist/cli/commands/repair/checks/install.d.ts

@@ -0,0 +1,5 @@
+import { type CommandCopy } from '../../../../host/health/index.js';
+import type { Check } from '../types.js';
+/** The exact way to get rid of one copy (nothing here runs it: doctor only prints it). */
+export declare function removalCommand(copy: CommandCopy): string;
+export declare const INSTALL_CHECKS: Check[];

package/dist/cli/commands/repair/checks/install.js

@@ -0,0 +1,318 @@
+// Install: how this program was installed, and whether the pieces a managed install runs from are in one piece (the
+// version and Node pointers, the shims, the PATH entry, the update task, the record). Fixes move a pointer, rewrite
+// shims or add the user PATH entry; they never delete a version.
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileExists } from '../../../../core/util/index.js';
+import { editUserPath } from '../../../../host/agent-commands/index.js';
+import { HIGH_INTEGRITY_SID, binsOfPackage, currentPathext, fileOnDisk, findCommandCopies, inspectPointers, ownBinDir, pathHas, repairPointers, sameFolder, shimProblems, } from '../../../../host/health/index.js';
+import { UpdateTask, writeShims } from '../../../../host/install/index.js';
+import { assertTestWritable, refuseInSelfTest } from '../../../../host/test-guard.js';
+import { globalPackages } from '../finders.js';
+import { ok, plural } from './common.js';
+const UNINSTALL = '& ([scriptblock]::Create((irm https://github.com/JoshDiDuca/windows-development-sandbox/releases/latest/download/install.ps1))) -Uninstall -Scope ';
+/** The exact way to get rid of one copy (nothing here runs it: doctor only prints it). */
+export function removalCommand(copy) {
+    switch (copy.kind) {
+        case 'managed-machine':
+            return 'in an admin PowerShell: ' + UNINSTALL + 'AllUsers';
+        case 'managed-user':
+            return 'in PowerShell: ' + UNINSTALL + 'CurrentUser';
+        case 'npm': {
+            const current = fileOnDisk(path.join(copy.dir, 'node_modules', 'windows-development-sandbox', 'package.json'));
+            return 'npm uninstall -g ' + (current ? 'windows-development-sandbox' : 'agent-sandbox');
+        }
+        case 'old-scripts': {
+            const root = path.basename(copy.dir).toLowerCase() === 'bin' ? path.dirname(copy.dir) : copy.dir;
+            return 'Remove-Item -Recurse -Force "' + root + '" (and take ' + copy.dir + ' off your PATH)';
+        }
+        default:
+            return 'delete ' + copy.files.join(', ') + ' in ' + copy.dir + ', or take that folder off the PATH';
+    }
+}
+const KIND_NAMES = {
+    'managed-machine': 'the install for everyone',
+    'managed-user': 'the install for just you',
+    npm: 'an npm copy',
+    'old-scripts': 'an old Scripts\\agent-sandbox copy',
+    other: 'a copy of unknown origin',
+};
+const managed = (env) => env.layout !== null;
+const machine = (env) => env.layout?.scope === 'machine';
+/** The commands of the version the pointers name, else of the one running now. */
+function currentBins(env) {
+    const layout = env.layout;
+    if (!layout)
+        return null;
+    const active = layout.activeVersion();
+    return (active ? binsOfPackage(layout.packageDir(active)) : null) ?? binsOfPackage(env.ctx.packageRoot);
+}
+export const INSTALL_CHECKS = [
+    {
+        id: 'install-kind',
+        group: 'Install',
+        name: 'Install type',
+        run: (env) => {
+            const layout = env.layout;
+            if (!layout)
+                return ok('npm global install (update it with npm; there are no automatic updates)');
+            const who = layout.scope === 'machine' ? 'for everyone on this PC' : 'for you';
+            return ok('managed install ' + who + ' in ' + layout.root + ', version ' + (layout.activeVersion() ?? 'unknown'));
+        },
+    },
+    {
+        id: 'install-record',
+        group: 'Install',
+        name: 'Install record',
+        applies: managed,
+        run: (env) => {
+            if (env.record)
+                return ok('install.json: ' + env.record.scope + ' install, automatic updates ' + (env.record.autoUpdate ? 'on' : 'off'));
+            return {
+                status: 'warn',
+                detail: 'install.json is missing or cannot be read',
+                means: 'Updates and sharing cannot tell how this was installed, so they act as if automatic updates are off.',
+                fix: 'Run the installer again over this install (it writes the record and keeps your data).',
+            };
+        },
+    },
+    {
+        id: 'install-pointers',
+        group: 'Install',
+        name: 'Active version',
+        applies: managed,
+        run: (env) => {
+            const layout = env.layout;
+            if (!layout)
+                return ok('');
+            const state = inspectPointers(layout);
+            if (!state.problems.length)
+                return ok('version ' + state.activeVersion + ' with Node ' + state.activeNode);
+            const base = {
+                status: 'needs-you',
+                detail: state.problems.join('; '),
+                means: 'The sandbox command cannot start until both pointers name an installed version and Node.',
+            };
+            if (!state.want)
+                return {
+                    ...base,
+                    fix: 'Nothing complete is installed in ' + layout.root + '. Run the installer again.',
+                };
+            return {
+                ...base,
+                plan: 'point active-version at ' + state.want.version + ' and active-node at ' + state.want.node + ' (installed)',
+            };
+        },
+        fix: (env) => {
+            if (!env.layout)
+                throw new Error('not a managed install');
+            assertTestWritable(env.layout.root);
+            return { done: 'pointed at ' + repairPointers(env.layout) };
+        },
+    },
+    {
+        id: 'install-shims',
+        group: 'Install',
+        name: 'Commands (shims)',
+        applies: managed,
+        run: (env) => {
+            const layout = env.layout;
+            const bins = currentBins(env);
+            if (!layout || !bins)
+                return { status: 'skipped', detail: 'the package.json of the active version cannot be read' };
+            const problems = shimProblems(layout, bins);
+            const count = Object.keys(bins).length;
+            if (!problems.missing.length && !problems.different.length)
+                return ok(plural(count, 'command') + ' in ' + layout.binDir + ' read the active version');
+            const bad = [
+                ...problems.missing.map((f) => f + ' (missing)'),
+                ...problems.different.map((f) => f + ' (out of date)'),
+            ];
+            return {
+                status: 'needs-you',
+                detail: bad.slice(0, 4).join(', ') + (bad.length > 4 ? ' and ' + (bad.length - 4) + ' more' : ''),
+                means: 'Typing sandbox in a terminal may fail or run the wrong version.',
+                plan: 'rewrite ' + plural(bad.length, 'command file') + ' in ' + layout.binDir,
+                lines: bad,
+            };
+        },
+        fix: (env) => {
+            const bins = currentBins(env);
+            if (!env.layout || !bins)
+                throw new Error('the package.json of the active version cannot be read');
+            assertTestWritable(env.layout.binDir);
+            writeShims(env.layout, bins);
+            return { done: 'rewrote the command files for ' + Object.keys(bins).join(', ') };
+        },
+    },
+    {
+        id: 'install-path',
+        group: 'Install',
+        name: 'PATH',
+        applies: managed,
+        timeoutMs: 40_000,
+        run: (env) => {
+            const layout = env.layout;
+            if (!layout)
+                return ok('');
+            const scope = layout.scope === 'machine' ? 'machine' : 'user';
+            const where = scope === 'machine' ? 'the PATH of this PC' : 'your PATH';
+            const own = env.system.registryPath(scope);
+            if (own === null)
+                return { status: 'skipped', detail: 'could not read ' + where };
+            if (pathHas(own, layout.binDir))
+                return ok(layout.binDir + ' is on ' + where);
+            const other = env.system.registryPath(scope === 'machine' ? 'user' : 'machine');
+            const base = {
+                status: 'needs-you',
+                detail: layout.binDir + ' is not on ' + where + (pathHas(other, layout.binDir) ? ' (only on the other one)' : ''),
+                means: 'New terminals will not find the sandbox command.',
+            };
+            if (scope === 'user')
+                return { ...base, plan: 'add ' + layout.binDir + ' to your PATH' };
+            return {
+                ...base,
+                fix: 'Run the installer again in an admin PowerShell (it adds the folder to the PATH of this PC).',
+            };
+        },
+        fix: (env) => {
+            if (!env.layout)
+                throw new Error('not a managed install');
+            editUserPath(env.layout.binDir, true, env.storageRoot);
+            return { done: 'added ' + env.layout.binDir + ' to your PATH (open a new terminal to use it)' };
+        },
+    },
+    {
+        id: 'install-copies',
+        group: 'Install',
+        name: 'Copies on the PATH',
+        timeoutMs: 40_000,
+        run: (env) => {
+            const machinePath = env.system.registryPath('machine');
+            const userPath = env.system.registryPath('user');
+            const copies = findCommandCopies({
+                machinePath: machinePath ?? (userPath === null ? (process.env.Path ?? null) : null),
+                userPath,
+                pathext: currentPathext(),
+                programFiles: process.env.ProgramFiles ?? null,
+                localAppData: process.env.LOCALAPPDATA ?? null,
+                exists: fileOnDisk,
+            });
+            if (!copies.length)
+                return ok('no sandbox command is on the PATH of a new terminal');
+            const runs = copies.find((c) => c.files.some((f) => f.startsWith('sandbox.'))) ?? copies[0];
+            const own = ownBinDir(env.ctx.packageRoot, env.layout?.binDir ?? null);
+            const keep = copies.find((c) => c.kind === 'managed-machine' || c.kind === 'managed-user') ?? runs;
+            if (copies.length === 1 && (!own || sameFolder(own, runs.dir)))
+                return ok('one copy: ' + runs.dir + ' (' + KIND_NAMES[runs.kind] + ')');
+            const hidden = copies.filter((c) => c !== keep);
+            const wrong = keep !== runs;
+            return {
+                status: wrong || (own !== null && !sameFolder(own, runs.dir)) ? 'needs-you' : 'warn',
+                detail: wrong
+                    ? 'typing sandbox runs ' + runs.dir + ' (' + KIND_NAMES[runs.kind] + '), not ' + keep.dir
+                    : copies.length + ' copies are on the PATH; ' + runs.dir + ' runs (' + KIND_NAMES[runs.kind] + ')',
+                means: wrong
+                    ? 'The install you update is hidden, so its fixes never reach you, and sharing with other users may not work from this copy.'
+                    : 'The others are never used, and they may be the ones an old shortcut or script starts.',
+                fix: 'Remove the copies you do not want (repair never deletes them; run "Get-Command sandbox -All" to list them):',
+                lines: hidden.map((c) => c.dir + ': ' + removalCommand(c)),
+            };
+        },
+    },
+    {
+        id: 'install-task',
+        group: 'Install',
+        name: 'Automatic updates',
+        applies: machine,
+        timeoutMs: 40_000,
+        run: (env) => {
+            const wanted = env.record?.autoUpdate ?? false;
+            const has = env.system.updateTaskExists();
+            if (has === null)
+                return { status: 'skipped', detail: 'could not ask Windows about the update task' };
+            if (has === wanted)
+                return ok(wanted ? 'on, and the scheduled task is there' : 'off, and no scheduled task is left');
+            const admin = env.system.tokenHasGroup(HIGH_INTEGRITY_SID) === true;
+            const command = 'sandbox update --auto ' + (wanted ? 'on' : 'off');
+            const base = {
+                status: 'needs-you',
+                detail: wanted
+                    ? 'automatic updates are on but the scheduled task \\WindowsDevelopmentSandbox\\Update is missing'
+                    : 'automatic updates are off but the scheduled task is still there',
+                means: wanted ? 'No update is installed by itself.' : 'The task keeps trying to update.',
+            };
+            return admin
+                ? { ...base, plan: wanted ? 'create the update task' : 'remove the update task' }
+                : { ...base, fix: 'Changing it needs admin rights. In an admin terminal run: ' + command };
+        },
+        fix: (env) => {
+            if (!env.layout)
+                throw new Error('not a managed install');
+            refuseInSelfTest('change scheduled tasks');
+            const task = new UpdateTask(env.layout);
+            if (env.record?.autoUpdate) {
+                task.register();
+                return { done: 'created the update task' };
+            }
+            task.remove();
+            return { done: 'removed the update task' };
+        },
+    },
+    {
+        id: 'install-user-leftover',
+        group: 'Install',
+        name: 'Install for just you',
+        applies: (env) => machine(env) && env.userInstallRoot !== null,
+        run: (env) => {
+            const root = env.userInstallRoot;
+            if (!root || !fileExists(path.join(root, 'active-version')))
+                return ok('no second install for just you next to this one');
+            return {
+                status: 'warn',
+                detail: 'an install for just you is still in ' + root,
+                means: 'Both are on your PATH; whichever comes first runs, and its updates differ from the one for everyone.',
+                fix: 'Remove it in PowerShell (your data stays): ' + UNINSTALL + 'CurrentUser',
+            };
+        },
+    },
+    {
+        id: 'install-old-npm',
+        group: 'Install',
+        name: 'npm packages',
+        timeoutMs: 90_000,
+        run: (env) => {
+            const npmCli = path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');
+            if (!fileExists(npmCli))
+                return { status: 'skipped', detail: 'npm not found next to this Node (' + npmCli + ')' };
+            // cwd = Node's own folder: npm reads .npmrc from the current folder, which could be a sandbox-writable workspace.
+            const result = spawnSync(process.execPath, [npmCli, 'ls', '-g', '--json', '--depth=0'], {
+                cwd: path.dirname(process.execPath),
+                encoding: 'utf8',
+                windowsHide: true,
+                timeout: 60000,
+                maxBuffer: 16 * 1024 * 1024,
+            });
+            const names = globalPackages(result.stdout ?? '');
+            if (!names.length)
+                return { status: 'skipped', detail: 'could not read the global npm packages' };
+            if (names.includes('agent-sandbox') && names.includes('windows-development-sandbox'))
+                return {
+                    status: 'needs-you',
+                    detail: 'the old agent-sandbox package is installed next to windows-development-sandbox',
+                    means: 'Their commands clash, and the one first on PATH runs.',
+                    fix: 'Run: npm uninstall -g agent-sandbox',
+                };
+            if (managed(env) && names.includes('windows-development-sandbox'))
+                return {
+                    status: 'warn',
+                    detail: 'an npm global copy of windows-development-sandbox is installed next to the managed install',
+                    means: 'Both are on PATH; whichever comes first runs, and only the managed one updates itself.',
+                    fix: 'Run: npm uninstall -g windows-development-sandbox',
+                };
+            return ok(names.includes('agent-sandbox')
+                ? 'agent-sandbox installed (the old name; fine on its own)'
+                : 'no old agent-sandbox package');
+        },
+    },
+];

package/dist/cli/commands/repair/checks/machine.d.ts

@@ -0,0 +1,2 @@
+import type { Check } from '../types.js';
+export declare const MACHINE_CHECKS: Check[];