windows-development-sandbox 1.5.0 → 1.9.0

package/dist/host/life/stop-events.js

@@ -12,12 +12,17 @@ const StopEventsSchema = z
     provider: z.string().max(200),
     process: z
         .string()
-        .max(400)
+        .max(1600)
         .nullable()
         .transform((p) => p ?? ''),
 }))
     .max(100);
 const UPDATERS = /^(trustedinstaller|mousocoreworker|musnotification(ux)?|usoclient|wuauclt|tiworker|updateorchestrator)\.exe$/i;
+/** The stop code in Kernel-Power 41's detail ("BugcheckCode 209" -> "0xD1"); null for 0 (no blue screen). */
+export function bugcheckCode(detail) {
+    const n = Number(/BugcheckCode\s+(\d+)/.exec(detail)?.[1] ?? 0);
+    return n > 0 ? '0x' + n.toString(16).toUpperCase() : null;
+}
 /**
  * The first event that ends a running sandbox (pure): Windows inside the sandbox crashing (Hyper-V 18590; `process`
  * holds its message with the stop code), a restart or shutdown, a crash or power loss, sleep, low memory. Switching
@@ -41,12 +46,24 @@ export function explainStop(events) {
                     },
                 ];
         }
-        if ((e.id === 41 && p.includes('kernel-power')) || (e.id === 6008 && p.includes('eventlog')))
+        if (e.id === 41 && p.includes('kernel-power')) {
+            const code = bugcheckCode(e.process);
+            return [
+                {
+                    kind: 'crash',
+                    at: e.at,
+                    text: code
+                        ? 'this PC blue-screened (stop code ' + code + ')'
+                        : 'Windows stopped unexpectedly (a freeze, a crash, a power cut, or the power button held down)',
+                },
+            ];
+        }
+        if (e.id === 6008 && p.includes('eventlog'))
             return [
                 {
                     kind: 'crash',
                     at: e.at,
-                    text: 'Windows stopped unexpectedly (a crash, a power cut, or the power button held down)',
+                    text: 'Windows stopped unexpectedly (a freeze, a crash, a power cut, or the power button held down)',
                 },
             ];
         if (e.id === 42 && p.includes('kernel-power'))

package/dist/host/life/stop-warning.js

@@ -1,7 +1,7 @@
 const ADVICE = {
     updates: 'Before leaving agents overnight, restart for pending updates first or pause them (Settings > Windows Update > Pause updates).',
     restart: 'If that was not you, check Settings > Windows Update and Event Viewer > Windows Logs > System.',
-    crash: 'Event Viewer > Windows Logs > System has the details; a laptop also needs to stay plugged in.',
+    crash: 'sandbox logs --crash prints what Windows logged and how much memory this PC had; Event Viewer > Windows Logs > System has the rest. A laptop also needs to stay plugged in.',
     sleep: 'sandbox.keepAwake keeps this PC awake while a sandbox runs (closing a laptop lid still sleeps it). Check it is on, and that sleep is not forced by a policy.',
     sandboxCrash: 'C:\\AgentData\\logs\\memory-*.log shows what used memory just before. Fewer builds at once inside the sandbox (e.g. cargo build.jobs) makes it less likely.',
     memory: 'Give the sandbox less RAM (sandbox.maxMemoryMb, sandbox.reserveHostMb) or run fewer builds at once inside it.',

package/dist/host/life/watchdog.d.ts

@@ -0,0 +1,54 @@
+import type os from 'node:os';
+import { type HostThresholds, type LoadProfile } from '../../shared/memory/index.js';
+import { type HostMemory } from './host-memory.js';
+export interface WatchdogState {
+    readonly low: boolean;
+    readonly calm: number;
+    /** Seconds the CPU has been above the limit. */
+    readonly cpuHighSeconds: number;
+    /** Time (ms) the last request went out. */
+    readonly lastSentAt: number;
+}
+export declare const WATCHDOG_START: WatchdogState;
+/** The request is repeated this often while the PC stays low, and each one lasts a bit longer than that. */
+export declare const RESEND_MS = 30000;
+export declare const REQUEST_SECONDS = 90;
+export interface WatchdogInput {
+    /** Null when memory could not be read this time (only the CPU counts then). */
+    readonly memory: HostMemory | null;
+    /** Total CPU use since the last sample (percent), null when unknown. */
+    readonly cpuPercent: number | null;
+    readonly intervalSeconds: number;
+    readonly nowMs: number;
+    readonly reserveHostMb: number;
+    readonly profile: LoadProfile;
+}
+export interface WatchdogStep {
+    readonly state: WatchdogState;
+    /** Send a request to the sandbox now. */
+    readonly send: boolean;
+    /** Why the PC is low (plain words), empty when it is not. */
+    readonly reason: string;
+    /** The state changed (the log says so). */
+    readonly changed: boolean;
+}
+/**
+ * Why this PC counts as low, for these numbers ("" when it does not). Low = available RAM under max(4 GB, 12 % of RAM)
+ * or available commit under 15 % of the commit limit or half the reserve (the gentle profile: 6 GB, 15 %, 20 %).
+ * `scale` widens the limits (1.25 = the level it must climb back above).
+ */
+export declare function lowReason(memory: HostMemory, reserveHostMb: number, t: HostThresholds, scale: number): string;
+/** One watchdog step. Hysteresis: low starts at the limits and ends above 1.25 times them for calmSamples samples. */
+export declare function watchdogStep(prev: WatchdogState, input: WatchdogInput): WatchdogStep;
+/** Total CPU use between two os.cpus() readings (percent). */
+export declare function cpuPercentBetween(a: readonly os.CpuInfo[], b: readonly os.CpuInfo[]): number | null;
+/** One line in <storage>\logs\host-memory-<data>.log, which the crash report reads; the file is kept small. */
+export declare function appendHostMemory(file: string, memory: HostMemory, cpuPercent: number | null): void;
+/** What the launch decided for the watchdog (host-only, in <storage>\run): the load profile and the PC's reserve. */
+export interface LoadSettings {
+    readonly profile: LoadProfile;
+    readonly reserveHostMb: number;
+}
+export declare function writeLoadSettings(storageRoot: string, dataPath: string, settings: LoadSettings): void;
+/** The settings of the running launch; the defaults (normal profile, 8 GB reserve) when none were written. */
+export declare function readLoadSettings(storageRoot: string, dataPath: string): LoadSettings;

package/dist/host/life/watchdog.js

@@ -0,0 +1,108 @@
+import { z } from 'zod';
+import fs from 'node:fs';
+import path from 'node:path';
+import { HOST_THRESHOLDS } from '../../shared/memory/index.js';
+import { hostMemoryLine } from './host-memory.js';
+export const WATCHDOG_START = { low: false, calm: 0, cpuHighSeconds: 0, lastSentAt: 0 };
+/** The request is repeated this often while the PC stays low, and each one lasts a bit longer than that. */
+export const RESEND_MS = 30000;
+export const REQUEST_SECONDS = 90;
+/**
+ * Why this PC counts as low, for these numbers ("" when it does not). Low = available RAM under max(4 GB, 12 % of RAM)
+ * or available commit under 15 % of the commit limit or half the reserve (the gentle profile: 6 GB, 15 %, 20 %).
+ * `scale` widens the limits (1.25 = the level it must climb back above).
+ */
+export function lowReason(memory, reserveHostMb, t, scale) {
+    const availableLimit = Math.max(t.availableMinMb, (memory.totalMb * t.availablePercent) / 100) * scale;
+    if (memory.availableMb < availableLimit)
+        return 'only ' + memory.availableMb + " MB of this PC's RAM is free";
+    const commitLimit = Math.max((memory.commitLimitMb * t.commitAvailablePercent) / 100, reserveHostMb / 2) * scale;
+    if (memory.commitAvailableMb < commitLimit)
+        return 'only ' + memory.commitAvailableMb + ' MB of memory (RAM plus paging file) is left on this PC';
+    return '';
+}
+/** One watchdog step. Hysteresis: low starts at the limits and ends above 1.25 times them for calmSamples samples. */
+export function watchdogStep(prev, input) {
+    const t = HOST_THRESHOLDS[input.profile];
+    let reason = '';
+    if (input.memory)
+        reason = lowReason(input.memory, input.reserveHostMb, t, 1);
+    const cpuHigh = input.cpuPercent !== null && input.cpuPercent >= t.cpuPercent ? prev.cpuHighSeconds + input.intervalSeconds : 0;
+    if (!reason && cpuHigh >= t.cpuSeconds)
+        reason = "this PC's CPU has been above " + t.cpuPercent + '% for ' + cpuHigh + ' seconds';
+    const calmNow = input.memory ? lowReason(input.memory, input.reserveHostMb, t, 1.25) === '' : true;
+    let low = prev.low;
+    let calm = prev.calm;
+    if (reason) {
+        low = true;
+        calm = 0;
+    }
+    else if (prev.low) {
+        calm = calmNow && cpuHigh === 0 ? prev.calm + 1 : 0;
+        if (calm >= t.calmSamples) {
+            low = false;
+            calm = 0;
+        }
+    }
+    const send = low && input.nowMs - prev.lastSentAt >= RESEND_MS;
+    return {
+        state: { low, calm, cpuHighSeconds: cpuHigh, lastSentAt: send ? input.nowMs : prev.lastSentAt },
+        send,
+        reason: reason || (low ? 'this PC is still low' : ''),
+        changed: low !== prev.low,
+    };
+}
+/** Total CPU use between two os.cpus() readings (percent). */
+export function cpuPercentBetween(a, b) {
+    let busy = 0;
+    let total = 0;
+    for (let i = 0; i < Math.min(a.length, b.length); i++) {
+        const x = a[i].times;
+        const y = b[i].times;
+        const idle = y.idle - x.idle;
+        const all = y.user - x.user + (y.nice - x.nice) + (y.sys - x.sys) + (y.irq - x.irq) + idle;
+        busy += all - idle;
+        total += all;
+    }
+    return total > 0 ? Math.round((busy / total) * 100) : null;
+}
+const MAX_LOG_BYTES = 512 * 1024;
+/** One line in <storage>\logs\host-memory-<data>.log, which the crash report reads; the file is kept small. */
+export function appendHostMemory(file, memory, cpuPercent) {
+    try {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        try {
+            if (fs.statSync(file).size > MAX_LOG_BYTES)
+                fs.renameSync(file, file + '.old');
+        }
+        catch {
+            // No log yet.
+        }
+        fs.appendFileSync(file, hostMemoryLine(memory) + (cpuPercent === null ? '' : ' | CPU ' + cpuPercent + '%') + '\n');
+    }
+    catch {
+        // The log is a courtesy: never a reason to fail.
+    }
+}
+const LoadSettingsSchema = z.object({
+    profile: z.enum(['normal', 'gentle']),
+    reserveHostMb: z.number().int().nonnegative(),
+});
+function loadFile(storageRoot, dataPath) {
+    return path.join(storageRoot, 'run', 'load-' + path.basename(dataPath) + '.json');
+}
+export function writeLoadSettings(storageRoot, dataPath, settings) {
+    const file = loadFile(storageRoot, dataPath);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(settings));
+}
+/** The settings of the running launch; the defaults (normal profile, 8 GB reserve) when none were written. */
+export function readLoadSettings(storageRoot, dataPath) {
+    try {
+        return LoadSettingsSchema.parse(JSON.parse(fs.readFileSync(loadFile(storageRoot, dataPath), 'utf8')));
+    }
+    catch {
+        // Not written (an older launch) or damaged: the defaults.
+        return { profile: 'normal', reserveHostMb: 8192 };
+    }
+}

package/dist/host/migrate/backup.js

@@ -6,6 +6,8 @@ import path from 'node:path';
 import { z } from 'zod';
 import { assertNoLinks, fail, isInsideOrEqual, isLink } from '../../core/util/index.js';
 import { JsonFile } from '../../shared/io/index.js';
+import { protectPrivateFolder } from '../sharing/index.js';
+import { ensureStorageRoot } from '../storage/index.js';
 const ManifestSchema = z.object({
     entries: z.array(z.object({ original: z.string(), copy: z.string(), existed: z.boolean() })),
 });
@@ -56,6 +58,7 @@ export class MigrationBackup {
     }
     /** Copies each existing file or folder (and records the ones that do not exist yet, to remove them on restore). */
     save(paths) {
+        ensureStorageRoot(this.storageRoot, protectPrivateFolder);
         const dataRoot = path.join(this.storageRoot, 'data');
         const entries = this.manifest.read()?.entries ?? [];
         for (const target of paths) {

package/dist/host/migrate/migrations/config-file.d.ts

@@ -6,3 +6,5 @@ export declare function readFileObject(file: string | null): Json | null;
 export declare function fullSnapshots(file: Json): DefaultsSnapshot[];
 /** Removes these values from the file, comments and the rest untouched, noting `why: <key>` for each. */
 export declare function removeValues(file: string, paths: readonly string[][], why: string, note: (line: string) => void): void;
+/** Sets one value in the file (created when missing), comments and the rest untouched. */
+export declare function setValue(file: string, path: string[], value: unknown): void;

package/dist/host/migrate/migrations/config-file.js

@@ -1,5 +1,6 @@
 // Reading and editing a config.json (JSON with comments) for the migrations: removing a value keeps every comment.
 import fs from 'node:fs';
+import nodePath from 'node:path';
 import { applyEdits, modify, parse } from 'jsonc-parser';
 import _ from 'lodash';
 import { writeFileAtomic } from '../../../shared/io/index.js';
@@ -26,3 +27,9 @@ export function removeValues(file, paths, why, note) {
     }
     writeFileAtomic(file, text);
 }
+/** Sets one value in the file (created when missing), comments and the rest untouched. */
+export function setValue(file, path, value) {
+    const text = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '{}\n';
+    fs.mkdirSync(nodePath.dirname(file), { recursive: true });
+    writeFileAtomic(file, applyEdits(text, modify(text, path, value, FORMAT)));
+}

package/dist/host/migrate/migrations/follow-machine-storage.js

@@ -1,8 +1,11 @@
 // An all-users install keeps everyone's data under %ProgramData%\AgentSandbox (its machine config says where), so a
 // sandbox can be shared. A config.json written by an old `config init` pins storage.root to the old per-user default,
 // which wins over the machine config. Removes that pin, and only that: a storage.root you chose yourself stays.
+import path from 'node:path';
 import _ from 'lodash';
 import { DEFAULTS, machineConfigPath } from '../../../core/config/index.js';
+import { expandPath } from '../../../core/util/index.js';
+import { holdsData } from '../../storage/root.js';
 import { fullSnapshots, readFileObject, removeValues } from './config-file.js';
 const ROOT = ['storage', 'root'];
 /** True when the machine config sets the storage folder and the user's file only pins a default of an old init. */
@@ -15,7 +18,12 @@ function pinnedOverMachine(configPath) {
         return false;
     const value = _.get(file, ROOT);
     const defaults = [_.get(DEFAULTS, ROOT), ...fullSnapshots(file).map((s) => _.get(s.defaults, ROOT))];
-    return defaults.some((d) => _.isEqual(d, value));
+    if (!defaults.some((d) => _.isEqual(d, value)))
+        return false;
+    // A pin that holds your saved data while the shared folder has none is kept: sandbox storage offers the move.
+    const pinned = typeof value === 'string' ? expandPath(value, path.dirname(configPath ?? '')) : '';
+    const shared = expandPath(String(_.get(machine, ROOT)), path.dirname(machineConfigPath()));
+    return !(holdsData(pinned) && !holdsData(shared));
 }
 export const followMachineStorage = {
     id: '2026-10-follow-machine-storage',

package/dist/host/migrate/migrations/pin-storage-root.d.ts

@@ -0,0 +1,4 @@
+import type { Migration } from '../migration.js';
+/** All the conditions of the migration, as a pure check on what is on disk. */
+export declare function needsPin(file: string, machineFile: string, oldRoot: string | null): boolean;
+export declare const pinStorageRoot: Migration;

package/dist/host/migrate/migrations/pin-storage-root.js

@@ -0,0 +1,46 @@
+// 1.6 moves the default storage folder to %ProgramData%\AgentSandbox\users\<you>. Nobody's data may seem to vanish: a
+// user with no storage.root of their own, no all-users install, and saved data in the old per-user folder keeps that
+// folder, pinned in config.json. Moving it to the new default is offered later (sandbox storage).
+import fs from 'node:fs';
+import path from 'node:path';
+import _ from 'lodash';
+import { machineConfigPath } from '../../../core/config/index.js';
+import { holdsData, OLD_DEFAULT_ROOT, oldDefaultRoot } from '../../storage/root.js';
+import { readFileObject, setValue } from './config-file.js';
+const ROOT = ['storage', 'root'];
+/** The file the pin goes in: the user's config, or the one it would be (not created until the pin is written). */
+function targetFile(ctx) {
+    return ctx.configPath ?? path.join(ctx.userDir, 'config.json');
+}
+/** All the conditions of the migration, as a pure check on what is on disk. */
+export function needsPin(file, machineFile, oldRoot) {
+    if (!oldRoot || !holdsData(oldRoot))
+        return false;
+    const machine = readFileObject(machineFile);
+    if (machine && _.has(machine, ROOT))
+        return false;
+    if (!fs.existsSync(file))
+        return true;
+    const parsed = readFileObject(file);
+    // A file that cannot be read is left alone: editing it blindly could lose the user's settings.
+    return parsed !== null && !_.has(parsed, ROOT);
+}
+export const pinStorageRoot = {
+    id: '2026-10-pin-storage-root',
+    introducedIn: '1.6.0',
+    scope: 'user',
+    needsIdleSandbox: false,
+    summary: 'Keeps your saved data where it is (the old per-user folder), now that the default folder is a new one.',
+    applies(ctx) {
+        return needsPin(targetFile(ctx), machineConfigPath(), oldDefaultRoot());
+    },
+    touches() {
+        return [];
+    },
+    async run(ctx, note) {
+        if (!needsPin(targetFile(ctx), machineConfigPath(), oldDefaultRoot()))
+            return;
+        setValue(targetFile(ctx), ROOT, OLD_DEFAULT_ROOT);
+        note('Your saved data stays in ' + OLD_DEFAULT_ROOT + ' (storage.root)');
+    },
+};

package/dist/host/migrate/migrations/unpin-config-defaults.js

@@ -4,6 +4,8 @@
 import _ from 'lodash';
 import { DEFAULTS } from '../../../core/config/index.js';
 import { fullSnapshots, readFileObject, removeValues } from './config-file.js';
+/** storage.root is never unpinned: the old default now names the old folder, and following today's would hide it. */
+const KEEP_PINNED = ['storage', 'root'];
 /** Paths of the leaves of a JSON object (arrays and scalars are leaves). */
 function leafPaths(value, prefix = []) {
     if (!_.isPlainObject(value))
@@ -15,7 +17,8 @@ function pinnedLeaves(file) {
     const snapshots = fullSnapshots(file);
     return leafPaths(file).filter((path) => {
         const value = _.get(file, path);
-        return (_.has(DEFAULTS, path) &&
+        return (!_.isEqual(path, KEEP_PINNED) &&
+            _.has(DEFAULTS, path) &&
             !_.isEqual(value, _.get(DEFAULTS, path)) &&
             snapshots.some((snapshot) => _.has(snapshot.defaults, path) && _.isEqual(_.get(snapshot.defaults, path), value)));
     });

package/dist/host/migrate/registry.js

@@ -1,3 +1,4 @@
 import { followMachineStorage } from './migrations/follow-machine-storage.js';
+import { pinStorageRoot } from './migrations/pin-storage-root.js';
 import { unpinConfigDefaults } from './migrations/unpin-config-defaults.js';
-export const MIGRATIONS = [unpinConfigDefaults, followMachineStorage];
+export const MIGRATIONS = [unpinConfigDefaults, followMachineStorage, pinStorageRoot];

package/dist/host/native.d.ts

@@ -3,7 +3,8 @@ export declare function nativeFile(...parts: string[]): string;
 /** powershell.exe arguments that run native\scripts\<name> (a .ps1 shipped next to dist) with `args`. */
 export declare function nativeScript(name: string, args?: readonly string[]): string[];
 /**
- * <storage>\bin\HostTools-<hash of its sources>.exe, compiled with the .NET Framework csc the first time; null when it
- * cannot be built (no csc, a compile error): the caller then runs the PowerShell fallback.
+ * <storage>\bin\<hash of its sources>\HostTools.exe, compiled with the .NET Framework csc the first time; null when it
+ * cannot be built (no csc, a compile error): the caller then runs the PowerShell fallback. A plain name and full file
+ * properties (AssemblyInfo.cs), so antivirus software does not take a nameless, random-looking exe for malware.
  */
 export declare function hostToolsExe(storageRoot: string): string | null;

package/dist/host/native.js

@@ -27,8 +27,9 @@ export function nativeScript(name, args = []) {
     ];
 }
 /**
- * <storage>\bin\HostTools-<hash of its sources>.exe, compiled with the .NET Framework csc the first time; null when it
- * cannot be built (no csc, a compile error): the caller then runs the PowerShell fallback.
+ * <storage>\bin\<hash of its sources>\HostTools.exe, compiled with the .NET Framework csc the first time; null when it
+ * cannot be built (no csc, a compile error): the caller then runs the PowerShell fallback. A plain name and full file
+ * properties (AssemblyInfo.cs), so antivirus software does not take a nameless, random-looking exe for malware.
  */
 export function hostToolsExe(storageRoot) {
     refuseInSelfTest('build HostTools.exe');
@@ -47,15 +48,33 @@ export function hostToolsExe(storageRoot) {
     const hash = crypto.createHash('sha256');
     for (const file of sources)
         hash.update(fs.readFileSync(file));
-    const exe = path.join(storageRoot, 'bin', 'HostTools-' + hash.digest('hex').slice(0, 12) + '.exe');
+    const bin = path.join(storageRoot, 'bin');
+    const exe = path.join(bin, hash.digest('hex').slice(0, 12), 'HostTools.exe');
     if (fs.existsSync(exe))
         return exe;
     if (!fs.existsSync(SYSTEM.csc()))
         return null;
     fs.mkdirSync(path.dirname(exe), { recursive: true });
+    removeOldHostTools(bin, path.dirname(exe));
     const result = spawnSync(SYSTEM.csc(), ['/nologo', '/optimize', '/target:exe', '/out:' + exe, ...sources], {
         windowsHide: true,
         timeout: 120000,
     });
     return result.status === 0 && fs.existsSync(exe) ? exe : null;
 }
+/** Earlier builds: HostTools-<hash>.exe files and other <hash> folders in bin (best effort: one in use stays). */
+function removeOldHostTools(bin, keep) {
+    for (const entry of fs.readdirSync(bin, { withFileTypes: true })) {
+        const full = path.join(bin, entry.name);
+        const old = (entry.isFile() && /^HostTools-[0-9a-f]{12}\.exe$/i.test(entry.name)) ||
+            (entry.isDirectory() && /^[0-9a-f]{12}$/i.test(entry.name) && full !== keep);
+        if (!old)
+            continue;
+        try {
+            fs.rmSync(full, { recursive: true, force: true });
+        }
+        catch {
+            // Still running (keep-awake of another sandbox): removed by a later build.
+        }
+    }
+}

package/dist/host/profile/accounts.d.ts

@@ -1,3 +1,4 @@
+import { SecretStore } from '../secrets/index.js';
 import { type LoginFiles } from './claude-login.js';
 export interface Account {
     readonly name: string;
@@ -13,14 +14,37 @@ export interface AccountRow {
     readonly isActive: boolean;
     readonly savedAt: string;
 }
+/** What lists need: no decryption. */
+export interface AccountMeta {
+    readonly name: string;
+    readonly savedAt: string;
+    readonly email: string | null;
+}
 export declare function accountsDir(storageRoot: string): string;
 /** The saved Claude logins under <storage>\accounts, and which one each sandbox data folder uses. */
 export declare class AccountStore {
     private readonly storageRoot;
-    constructor(storageRoot: string);
+    private readonly sharePlugins;
+    private readonly secrets;
+    /** What the last activate() did with the shared plugins (a problem there never stops the switch). */
+    pluginNote: string | null;
+    /** @param sharePlugins claudeProfile.sharePluginsAcrossAccounts: carry Claude plugins to the account switched to */
+    constructor(storageRoot: string, sharePlugins?: boolean, secrets?: SecretStore);
+    /** With the setting on: refreshes the shared plugin set from this data set, or fills this data set from it. */
+    syncPlugins(dataPath: string): void;
+    private shareStep;
     private file;
+    private seal;
     private store;
+    /** The saved account's name, date and e-mail (nothing is decrypted). */
+    meta(name: string): AccountMeta | null;
+    /**
+     * The saved account with its login decrypted. A plain file from an older version is encrypted on the spot (it stays
+     * readable when that fails).
+     */
     read(name: string): Account | null;
+    /** Encrypts every account still saved as plain text (older versions); returns how many it did. */
+    sealLegacy(): number;
     defaultName(): string | null;
     /** The account a data folder uses (kept in the index of the storage folder that data folder is in). */
     activeFor(dataPath: string): string | null;