windows-development-sandbox 1.5.0 → 1.9.0

package/dist/cli/commands/launch/add-root.js

@@ -4,10 +4,12 @@ import { isWithin, planMirrorWorkspace } from '../../../shared/paths/index.js';
 import { assertSafeMapping, assertSafeWorkspace } from '../../../core/safe-paths.js';
 import { isRootPath } from '../../../core/util/index.js';
 import { autoGuestWorkspace, placeInRoot } from '../../../core/run/index.js';
+import { c } from '../../output/index.js';
 import { addToList, setSetting } from '../user-config.js';
 /**
- * Asked once per parent folder: map it at every start (a project root), so the projects next to this one open in the
- * running sandbox without a restart. The answer is saved to your config.
+ * Asked at a start from a folder whose parent is not shared yet ("Not now" asks again next time): map it at every
+ * start (a project root), so the projects next to this one open in the running sandbox without a restart. The answer is
+ * saved to your config.
  */
 export async function maybeAddRoot(ctx, run) {
     const { projects } = run.config;
@@ -27,23 +29,22 @@ export async function maybeAddRoot(ctx, run) {
         return;
     }
     const answer = await select({
-        message: 'Map ' +
+        message: 'Share all projects in ' +
             parent +
-            ' at every start, so other projects there (also new ones) open in the running sandbox without a restart? Agents in the sandbox can then see every project in it.',
+            ' with the sandbox?\n  ' +
+            c.dim('Projects there, also new ones, then open without a restart. Agents can see every one of them.'),
         choices: [
-            { name: 'Yes, from now on', value: 'yes' },
-            { name: 'No (and do not ask again for this folder)', value: 'no' },
-            { name: 'Never ask this again', value: 'never' },
+            { name: 'Yes, share ' + parent, value: 'yes' },
+            { name: 'Not now', value: 'no' },
+            { name: 'No, and stop asking', value: 'never' },
         ],
     });
     if (answer === 'yes') {
         addToList(ctx, ['projects', 'roots'], parent);
         run.config.projects.roots.push(parent);
-        console.log('Added ' + parent + ' to projects.roots (sandbox projects roots remove ' + parent + ' undoes it).');
+        console.log('Added ' + parent + '. Undo: sandbox projects roots remove ' + parent);
         moveUnderRoot(run);
     }
-    if (answer === 'no')
-        addToList(ctx, ['projects', 'declinedRoots'], parent);
     if (answer === 'never')
         setSetting(ctx, ['projects', 'askToAddRoot'], false);
 }

package/dist/cli/commands/launch/launch.js

@@ -3,12 +3,15 @@
 // restart that adds it is offered (restart.ts).
 import path from 'node:path';
 import _ from 'lodash';
-import { generateSandbox } from '../../../host/launch/index.js';
+import { openEngine } from '../../../host/engines/index.js';
+import { containedMappings, containedPaths, providerFor, setNameOf, } from '../../../host/storage/index.js';
+import { generateSandbox, GUEST, vgpuSource, vgpuWarning } from '../../../host/launch/index.js';
 import { findSecretFiles } from '../../../host/profile/index.js';
 import { RepoGuardStore } from '../../../host/guard/index.js';
-import { assertCanLaunch, isSandboxRunning, spawnDetached, startSandbox, probeHost, hideSandboxWindow, } from '../../../host/sandbox/index.js';
+import { hostPublicIp, prepareVpn, readVpnLine, vpnNotes } from '../../../host/vpn/index.js';
+import { assertCanLaunch, isSandboxRunning, spawnDetached, probeHost, hideSandboxWindow, realContainedDeps, } from '../../../host/sandbox/index.js';
 import { KnownProjects, ProjectRegistry } from '../../../host/projects/index.js';
-import { LifeRecord, SessionLedger } from '../../../host/life/index.js';
+import { LifeRecord, pageFileRisk, readHostMemory, SessionLedger, takePageFileHint } from '../../../host/life/index.js';
 import { isWithin } from '../../../shared/paths/index.js';
 import { watcherRunning } from '../../../sync/index.js';
 import { protectionsOf } from '../../../core/local-config/index.js';
@@ -19,6 +22,7 @@ import { c, table } from '../../output/index.js';
 import { syncAgentCommands } from '../agent-commands.js';
 import { requireOnPc } from '../context.js';
 import { joinHere } from '../projects/index.js';
+import { offerSetupWhenOff } from '../setup/index.js';
 import { useSharedSandbox } from '../shared-use.js';
 import { beginSharing, currentUserName, currentUserSid, listProcesses, runningOwner, sessionOf, sharingDeps, takeSharingNotice, } from '../../../host/sharing/index.js';
 import { packageVersion } from '../../../core/package-info.js';
@@ -50,6 +54,11 @@ class Launcher {
             requireOnPc('launch');
         if (!generateOnly)
             this.syncAgentCommands();
+        if (!generateOnly) {
+            const setUp = await offerSetupWhenOff(this.ctx);
+            if (setUp !== undefined)
+                return setUp;
+        }
         if (!generateOnly && isSandboxRunning()) {
             // Another user's sandbox: an agent session in a project it has, when it is shared; nothing else.
             const ctx = await useSharedSandbox(this.ctx, options.noAgent ? { kind: 'owner-only', what: 'start a sandbox' } : { kind: 'use' });
@@ -111,28 +120,79 @@ class Launcher {
     }
     /** One sandbox for this folder: resolve, prepare, write the launch files, then (unless generate) start it. */
     async launchHere() {
-        const { ctx, generateOnly, extras } = this;
+        const { ctx, generateOnly } = this;
         const run = await this.resolve();
         const { config } = run;
+        // An engine or storage kind that is not available yet stops here, before anything is prepared.
+        const engine = await openEngine(config);
+        const provider = providerFor(config, config.storage.contained === 'off'
+            ? {}
+            : { contained: realContainedDeps(ctx.storageRoot, config.storage.containedMaxGb) });
         if (!generateOnly)
             assertCanLaunch(isSandboxRunning() ? runningOwner() : undefined);
+        // Contained storage: the image is mounted now (before anything reads or writes the data set), and let go of again
+        // when the launch fails before the sandbox starts. The background watcher holds it from then on.
+        const dataMappings = await this.prepareStorage(provider, run);
+        try {
+            return await this.launchPrepared(run, engine, dataMappings);
+        }
+        catch (e) {
+            await provider.release();
+            throw e;
+        }
+    }
+    /** The data set's mappings from a contained-storage provider (mounting it), or undefined for plain folders. */
+    async prepareStorage(provider, run) {
+        if (provider.id === 'folder')
+            return undefined;
+        if (this.generateOnly)
+            return containedMappings(run.dataPath, containedPaths(run.storageRoot, setNameOf(run.dataPath)).mount, GUEST.data);
+        console.log('Mounting the contained storage (Windows asks for permission when it is not mounted yet)...');
+        return [...(await provider.prepare({ dataPath: run.dataPath, guest: GUEST.data })).mappings];
+    }
+    async launchPrepared(run, engine, dataMappings) {
+        const { ctx, generateOnly, extras } = this;
+        const { config } = run;
         if (!generateOnly && !extras.extraProjects)
             await maybeAddRoot(ctx, run);
         const prepared = generateOnly ? null : await prepare(ctx, run);
         const bootWants = await bootWantsFor(ctx, run, extras.extraProjects);
+        // The VPN (vpn.enabled): its server and profile are fetched and checked here, before anything is written.
+        const vpn = generateOnly
+            ? null
+            : await prepareVpn({
+                config,
+                storageRoot: ctx.storageRoot,
+                sandboxRunning: isSandboxRunning(),
+                base: run.workspaceHost,
+            });
+        // This PC's commit (RAM plus paging file) bounds the sandbox's memory as much as free RAM does.
+        const hostMemory = generateOnly ? null : readHostMemory(ctx.storageRoot);
         const generated = generateSandbox({
             packageRoot: ctx.packageRoot,
+            ...(hostMemory ? { commitAvailableMb: hostMemory.commitAvailableMb } : {}),
             run,
             harnessArgs: this.options.passthrough,
             probe: probeHost(config, run.harnessName),
             extraProjects: extras.extraProjects,
             autoSession: extras.autoSession,
             bootWants: bootWants.wants,
-        });
+            ...(vpn ? { vpn } : {}),
+            ...(dataMappings ? { dataMappings } : {}),
+        }, engine);
         const notes = [...run.notes, ...bootWants.notes, ...generated.projects.notes, ...generated.mappingNotes];
         for (const note of notes)
             console.log(note);
+        if (generated.memoryNote)
+            console.log(c.yellow(generated.memoryNote));
+        if (generated.bootConfig.sandbox.vGpu)
+            console.log(c.yellow(vgpuWarning(vgpuSource(ctx.loaded.config.sandbox.vGpu))));
+        const risk = hostMemory ? pageFileRisk(hostMemory, generated.memoryMb) : null;
+        if (risk && takePageFileHint(ctx.storageRoot))
+            console.log(c.yellow(risk.text));
         this.warnSecretFiles(run);
+        for (const line of vpnNotes(config.vpn))
+            console.log(c.yellow(line));
         table(launchSummary(run, generated, prepared));
         if (generateOnly)
             return 0;
@@ -140,7 +200,7 @@ class Launcher {
         const reopen = extras.extraProjects ? [] : await sessionsToResume(ctx, run);
         this.record(run, generated);
         this.share(generated);
-        startSandbox(generated.wsbPath);
+        await engine.start(generated.enginePlan);
         this.startWatcher();
         if (reopen.length)
             await this.reopenAfterBoot(generated.launchId, reopen);
@@ -188,8 +248,12 @@ class Launcher {
      */
     share(generated) {
         const deps = sharingDeps(this.ctx.packageRoot);
-        if (!deps)
+        if (!deps) {
+            if (this.ctx.loaded.config.sharing.otherUsers)
+                console.log(c.yellow('This sandbox is not shared: sharing.otherUsers is on, but no all-users install was found on this PC. ' +
+                    'Install for everyone (install.ps1 -Scope AllUsers) to share sandboxes.'));
             return;
+        }
         // Only the shared tree may be opened to the group: never a storage folder of your own (your profile, say).
         const inSharedTree = isWithin(deps.usersDir, this.ctx.dataPath);
         if (this.ctx.loaded.config.sharing.otherUsers && !inSharedTree)
@@ -199,6 +263,9 @@ class Launcher {
                 deps.usersDir +
                 '. Remove storage.root from your config to use the shared folder.'));
         const shared = this.ctx.loaded.config.sharing.otherUsers && inSharedTree;
+        // Only an opened folder has permissions to write; a closed one is checked in a moment and usually needs nothing.
+        if (shared)
+            console.log('Setting folder permissions...');
         const rows = listProcesses();
         beginSharing(deps, {
             user: currentUserName(),
@@ -230,6 +297,26 @@ class Launcher {
         if (!watcherRunning(this.ctx.dataPath))
             spawnDetached(this.ctx.entry, ['_watch', ...(config ? ['--config', path.resolve(config)] : [])]);
     }
+    /** Waits for the boot; the VPN's outcome is said whether the boot worked or not (a failed tunnel can be why). */
+    async bootThenReportVpn(run, launchId, timed) {
+        try {
+            await waitForBoot(this.ctx.dataPath, launchId, timed);
+        }
+        catch (e) {
+            await this.reportVpn(run);
+            throw e;
+        }
+        await this.reportVpn(run);
+    }
+    /** Says whether the VPN came up (the sandbox reports it; its address is compared with this PC's). */
+    async reportVpn(run) {
+        if (!run.config.vpn.enabled)
+            return;
+        const line = readVpnLine(this.ctx.dataPath, await hostPublicIp());
+        if (!line)
+            return;
+        console.log(line.level === 'ok' ? c.green(line.text) : line.level === 'warn' ? c.yellow(line.text) : c.red(line.text));
+    }
     /** Waits for the boot and attaches when asked to; otherwise says where the agent opens. */
     async afterStart(run, generated) {
         const { ctx, options, extras } = this;
@@ -241,7 +328,7 @@ class Launcher {
         if (options.terminal || options.noAgent || extras.waitUntilReady) {
             if (headsUp)
                 console.log(headsUp);
-            await waitForBoot(dataPath, generated.launchId, Boolean(headsUp));
+            await this.bootThenReportVpn(run, generated.launchId, Boolean(headsUp));
             if (extras.waitUntilReady)
                 return 0;
             // Without an agent there is no session to attach to: the sandbox itself is the result.
@@ -253,7 +340,13 @@ class Launcher {
             }
             return attachHere(ctx, await waitForStart(ctx, generated.launchId, 'Starting ' + run.harnessName));
         }
-        if (headsUp)
+        // The VPN's outcome is worth waiting for: a failed tunnel with the kill switch on means no internet.
+        if (config.vpn.enabled) {
+            if (headsUp)
+                console.log(headsUp);
+            await this.bootThenReportVpn(run, generated.launchId, Boolean(headsUp));
+        }
+        else if (headsUp)
             console.log(headsUp + '\nFollow along: sandbox logs -f');
         if (hidden)
             console.log((await hidden)

package/dist/cli/commands/launch/prepare.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import fs from 'node:fs';
 import { AccountStore } from '../../../host/profile/index.js';
 import { SandboxChannel } from '../../../host/channel/index.js';
-import { describePrune, pruneStorage } from '../../../host/storage/index.js';
+import { describePrune, hostDataFolder, pruneStorage } from '../../../host/storage/index.js';
 import { RepoGuardStore, readDataSize, saveMarkedProjects } from '../../../host/guard/index.js';
 import { ensureConpty, ensureTerminal } from '../../../host/tools/index.js';
 import { planView, viewSkipped, saveActiveViews, WorkspaceView } from '../../../host/workspace-view/index.js';
@@ -16,7 +16,7 @@ import { firstStartNotice, pendingDownloads } from './first-start.js';
 import { LifeRecord, UPDATE_RESTART_WARNING, updateRestartPending } from '../../../host/life/index.js';
 /** Nothing has been installed into this data set yet: the first start downloads every toolchain once. */
 export function firstBoot(dataPath) {
-    return !fs.existsSync(path.join(dataPath, 'tools', 'resolved-versions.json'));
+    return !fs.existsSync(path.join(hostDataFolder(dataPath, 'tools'), 'resolved-versions.json'));
 }
 /** The first-start heads-up (also when this project needs tools not downloaded yet), or null. */
 export function firstBootNotice(dataPath, generated) {
@@ -27,7 +27,7 @@ export function firstBootNotice(dataPath, generated) {
             .map(([name]) => name),
         ...generated.databases.map((d) => d.database),
     ];
-    return firstStartNotice(firstBoot(dataPath), pendingDownloads(wanted, (dir) => fs.existsSync(path.join(dataPath, 'tools', dir))));
+    return firstStartNotice(firstBoot(dataPath), pendingDownloads(wanted, (dir) => fs.existsSync(path.join(hostDataFolder(dataPath, 'tools'), dir))));
 }
 function syncSummary(config, dataPath, workspaceHost) {
     try {
@@ -77,10 +77,12 @@ async function prepareWorkspaceView(ctx, run) {
 export async function prepare(ctx, run) {
     const { options, dataPath, storageRoot } = ctx;
     const { config } = run;
-    const accounts = new AccountStore(storageRoot);
+    const accounts = new AccountStore(storageRoot, config.claudeProfile.sharePluginsAcrossAccounts);
     const account = options.account ?? accounts.defaultName();
     if (account && run.harnessName === 'claude' && account !== accounts.activeFor(dataPath))
         accounts.activate(dataPath, account);
+    else if (run.harnessName === 'claude')
+        accounts.syncPlugins(dataPath);
     const terminal = config.provisioning.terminal.enabled
         ? await ensureTerminal(dataPath, config.provisioning.refresh, { pwsh: config.toolchains.pwsh.enabled !== false })
         : { exe: null, message: 'disabled' };

package/dist/cli/commands/launch/running.js

@@ -17,7 +17,8 @@ const SESSION_START_MS = 60 * 60 * 1000;
 export function attachHere(ctx, session) {
     if (ctx.loaded.config.attach.autoHide && !insideSandbox())
         void hideSandboxWindow(ctx.storageRoot, 120).catch(() => false);
-    return attachTerminal(session);
+    // A copy in the agent reaches this PC's clipboard only when sandbox.clipboard already shares it with the sandbox.
+    return attachTerminal(session, { clipboardWrites: ctx.loaded.config.sandbox.clipboard });
 }
 /** The sandbox writes sandbox.json a few seconds into its boot; a second launch right after the first waits for it. */
 export async function runningSandboxStatus(dataPath) {

package/dist/cli/commands/launch/summary.d.ts

@@ -1,8 +1,10 @@
 import type { Generated, ResolvedRun } from '../../../core/types.js';
+import type { EnginePlan } from '../../../host/engines/index.js';
 import type { Prepared } from './prepare.js';
 /** What generateSandbox returned. */
 export type GeneratedSandbox = Generated & {
     readonly personalization: string;
+    readonly enginePlan: EnginePlan;
 };
 /** The launch summary rows, in the order they are printed. */
 export declare function launchSummary(run: ResolvedRun, generated: GeneratedSandbox, prepared: Prepared | null): string[][];

package/dist/cli/commands/maintenance/audit.js

@@ -28,7 +28,7 @@ export async function audit(ctx) {
     if (!events.length) {
         console.log(settings.enabled
             ? 'Nothing in the audit log for the last ' + ctx.options.days + ' day(s).'
-            : 'The audit log is off. Turn it on in the menu (Settings > Security & privacy > Audit log) or with audit.enabled in your config.');
+            : 'The audit log is off. Turn it on in the menu (Settings > Security & privacy > Audit log) or with: sandbox config set audit.enabled true');
         return 0;
     }
     for (const e of events) {

package/dist/cli/commands/maintenance/clean.d.ts

@@ -1,2 +1,2 @@
 import { type Context } from '../context.js';
-export declare function clean(ctx: Context): number;
+export declare function clean(ctx: Context): Promise<number>;

package/dist/cli/commands/maintenance/clean.js

@@ -1,10 +1,24 @@
+// `sandbox clean`: old launch folders, logs and leftovers. Shows what and how much, then asks (--yes skips).
 import _ from 'lodash';
+import { askRequired } from '../../../core/prompt.js';
 import { describePrune, pruneStorage } from '../../../host/storage/index.js';
 import { isSandboxRunning } from '../../../host/sandbox/index.js';
 import { RunDir } from '../../../shared/channel/index.js';
-export function clean(ctx) {
+import { nextStep } from '../../output/index.js';
+export async function clean(ctx) {
     const running = isSandboxRunning() ? new RunDir(ctx.dataPath).readSandboxStatus()?.launchId : undefined;
-    console.log('Cleanup: ' +
-        describePrune(pruneStorage(ctx.storageRoot, { launchDays: ctx.options.days, keep: _.compact([running]) })));
+    const options = { launchDays: ctx.options.days, keep: _.compact([running]) };
+    const found = pruneStorage(ctx.storageRoot, { ...options, dryRun: true });
+    if (found.launches + found.logs + found.leftovers === 0) {
+        console.log('Nothing to clean.');
+        return 0;
+    }
+    console.log('Can be removed: ' + describePrune(found).replace(' removed', '') + '.');
+    if (!ctx.options.yes && !(await askRequired('Delete them?', 'Add --yes to delete without asking.'))) {
+        console.log('Nothing removed.');
+        return 1;
+    }
+    console.log('Removed ' + describePrune(pruneStorage(ctx.storageRoot, options)).replace(' removed', '') + '.');
+    nextStep('sandbox data   (see what else is saved, and clean it)');
     return 0;
 }

package/dist/cli/commands/maintenance/config-share.d.ts

@@ -0,0 +1,12 @@
+import { type ImportPlan } from '../../menu/settings/index.js';
+import type { Context } from '../context.js';
+/** The file `config export` writes when none is named. */
+export declare const DEFAULT_EXPORT = "sandbox-settings.json";
+/** Writes the settings that differ from the defaults (no secrets, no storage, no paths unless asked) to `file`. */
+export declare function writeExport(ctx: Context, file: string, withPaths: boolean, overwrite: boolean): string[];
+/** Reads a shared file and plans the import. Fails with the reason when it cannot be read. */
+export declare function readImport(ctx: Context, file: string): ImportPlan;
+/** Writes the planned changes to your settings file (comments stay); returns how many settings changed. */
+export declare function applyImport(ctx: Context, plan: ImportPlan): number;
+export declare function exportCommand(ctx: Context, file: string | undefined): number;
+export declare function importCommand(ctx: Context, file: string | undefined): Promise<number>;

package/dist/cli/commands/maintenance/config-share.js

@@ -0,0 +1,80 @@
+// `sandbox config export` and `import`: your settings as a shareable .json, and a shared file read back in.
+import fs from 'node:fs';
+import path from 'node:path';
+import { askRequired } from '../../../core/prompt.js';
+import { fail, safeText, writeJson } from '../../../core/util/index.js';
+import { c } from '../../output/index.js';
+import { ConfigFile } from '../../../app/features/settings/index.js';
+import { diffText, exportSettings, planImport, skippedLine } from '../../menu/settings/index.js';
+/** The file `config export` writes when none is named. */
+export const DEFAULT_EXPORT = 'sandbox-settings.json';
+/** A shared file is a few KB; anything bigger is not one. */
+const MAX_BYTES = 1024 * 1024;
+/** Writes the settings that differ from the defaults (no secrets, no storage, no paths unless asked) to `file`. */
+export function writeExport(ctx, file, withPaths, overwrite) {
+    const target = path.resolve(file);
+    if (!overwrite && fs.existsSync(target))
+        fail(target + ' exists already.', 'Pick another name, or delete it first.');
+    const { data, skipped } = exportSettings(ctx.loaded.config, withPaths);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    writeJson(target, data);
+    return skipped.map(skippedLine);
+}
+/** Reads a shared file and plans the import. Fails with the reason when it cannot be read. */
+export function readImport(ctx, file) {
+    const source = path.resolve(file);
+    if (!fs.existsSync(source))
+        fail('There is no file ' + source + '.', 'Give the path of a file made by sandbox config export.');
+    if (fs.statSync(source).size > MAX_BYTES)
+        fail(source + ' is too big to be a settings file.');
+    const plan = planImport(fs.readFileSync(source, 'utf8'), ctx.loaded.config);
+    if (plan.problems.length)
+        fail(source + ' is not valid settings:\n  ' + plan.problems.map(safeText).join('\n  '), 'Nothing was changed. Fix the file, or export a new one with: sandbox config export');
+    return plan;
+}
+/** Writes the planned changes to your settings file (comments stay); returns how many settings changed. */
+export function applyImport(ctx, plan) {
+    const outcome = ConfigFile.user(ctx.loaded.configPath).setMany(plan.changes);
+    if (typeof outcome === 'object')
+        fail('Could not import: ' + outcome.problems.join('; '), 'Nothing was written. Your settings are unchanged.');
+    return plan.changes.length;
+}
+export function exportCommand(ctx, file) {
+    const target = file ?? DEFAULT_EXPORT;
+    const skipped = writeExport(ctx, target, ctx.options.withPaths, false);
+    console.log('Wrote ' + path.resolve(target) + ' (only what differs from the defaults).');
+    if (skipped.length) {
+        console.log('Left out:');
+        for (const line of skipped)
+            console.log('  ' + line);
+    }
+    if (!ctx.options.withPaths && skipped.some((s) => s.includes('folder or file')))
+        console.log("Keep this PC's folders and files in the file with --with-paths.");
+    return 0;
+}
+export async function importCommand(ctx, file) {
+    if (!file)
+        fail('Which file?', 'Usage: sandbox config import <file>');
+    const plan = readImport(ctx, file);
+    if (plan.skipped.length) {
+        console.log('Not imported (never taken from a file):');
+        for (const s of plan.skipped)
+            console.log('  ' + safeText(skippedLine(s)));
+    }
+    if (!plan.changes.length) {
+        console.log('Nothing to change: your settings already match the file.');
+        return 0;
+    }
+    console.log('This would change ' + plan.changes.length + ' setting' + (plan.changes.length === 1 ? '' : 's') + ':');
+    for (const line of diffText(plan.lines))
+        console.log('  ' + safeText(line));
+    const yes = ctx.options.yes ||
+        (await askRequired('Change your settings like this?', 'Add --yes to change them without asking.'));
+    if (!yes) {
+        console.log('Nothing was changed.');
+        return 0;
+    }
+    const n = applyImport(ctx, plan);
+    console.log(c.green('Imported ' + n + ' setting' + (n === 1 ? '' : 's') + '.') + ' New sandboxes use them.');
+    return 0;
+}

package/dist/cli/commands/maintenance/config.d.ts

@@ -1,2 +1,2 @@
 import { type Context } from '../context.js';
-export declare function config(ctx: Context): number;
+export declare function config(ctx: Context): number | Promise<number>;

package/dist/cli/commands/maintenance/config.js

@@ -1,21 +1,44 @@
+import { spawn } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { DEFAULTS, userConfigPath, userDir } from '../../../core/config/index.js';
+import { redactSecrets } from '../../../core/schema/index.js';
 import { allowedAnswer, allowStorePath, applyOverrides, describeOverrides, isTrusted, LOCAL_CONFIG_NAME, loosenedRequests, normalizeOverrides, OUTSIDE_FOLDER, outsideKey, outsideMappings, readLocalConfig, trustStorePath, } from '../../../core/local-config/index.js';
 import { guestWorkspaceOf, previewGuest } from '../../../core/run/index.js';
+import { askChoice } from '../../../core/prompt.js';
 import { dirExists, fail, safeText, writeJson } from '../../../core/util/index.js';
-import { c, table } from '../../output/index.js';
-function initConfig() {
+import { system32 } from '../../../shared/system.js';
+import { refuseInSelfTest } from '../../../host/test-guard.js';
+import { c, nextStep, table } from '../../output/index.js';
+import { exportCommand, importCommand } from './config-share.js';
+/** The settings file exists already: open it, start over, or leave it (no terminal: say how). */
+async function existingFile(file) {
+    return askChoice(file + ' exists already.', [
+        { name: 'Open it', value: 'open' },
+        { name: 'Overwrite it with the defaults (your changes are lost)', value: 'overwrite' },
+        { name: 'Cancel', value: 'cancel' },
+    ], 'Open it with: sandbox config path. To start over, delete it first.');
+}
+async function initConfig() {
     const file = userConfigPath();
-    if (fs.existsSync(file))
-        fail(file + ' already exists.');
+    if (fs.existsSync(file)) {
+        const answer = await existingFile(file);
+        if (answer === 'cancel')
+            return 0;
+        if (answer === 'open') {
+            refuseInSelfTest('open files');
+            spawn(system32('notepad.exe'), [file], { detached: true, stdio: 'ignore' }).unref();
+            console.log('Opened ' + file + '.');
+            return 0;
+        }
+    }
     fs.mkdirSync(path.join(userDir(), 'hooks', 'pre-agent'), { recursive: true });
     // The schema sits next to the file (a local path), so editors trust it and show docs and autocomplete.
     writeJson(file, { $schema: './config.schema.json', ...DEFAULTS });
     console.log('Created ' + file + '. It lists every setting with its default; delete the ones you do not change.');
     console.log('Your own hook scripts go in ' + path.join(userDir(), 'hooks') + '\\{pre-provision,pre-agent,post-agent}.');
-    console.log("For editor help in every project's .sandbox-config.json, run: sandbox config schema");
+    nextStep("sandbox config schema   (editor help in every project's .sandbox-config.json)");
     return 0;
 }
 /**
@@ -72,9 +95,9 @@ function previewFolders(ctx, dir, filePath, overrides) {
         if (!outside.includes(m))
             return m.guest ? 'inside the project' : 'inside the project (already in the sandbox there)';
         if (policy === true)
-            return 'outside the project, allowed (projects.allowOutsideMappings is true)';
+            return 'outside the project, allowed (your settings allow it)';
         if (policy === false)
-            return c.red('outside the project: refused (projects.allowOutsideMappings is false)');
+            return c.red('outside the project: refused (your settings do not allow it)');
         return allowedAnswer(store, filePath, OUTSIDE_FOLDER, outsideKey(m)) === true
             ? 'outside the project, allowed (you said yes)'
             : c.yellow('outside the project: the next interactive launch asks you');
@@ -110,7 +133,8 @@ function previewFolders(ctx, dir, filePath, overrides) {
     }
 }
 export function config(ctx) {
-    const [action = 'summary'] = ctx.options.positionals;
+    // get, set, reset and list are the settings feature's operations (cli/operations runs them before this).
+    const [action = 'summary', key] = ctx.options.positionals;
     switch (action) {
         case 'summary':
             table([
@@ -133,13 +157,17 @@ export function config(ctx) {
         case 'init':
             return initConfig();
         case 'show':
-            console.log(JSON.stringify(ctx.loaded.config, null, 2));
+            console.log(JSON.stringify(redactSecrets(ctx.loaded.config), null, 2));
             return 0;
+        case 'export':
+            return exportCommand(ctx, key);
+        case 'import':
+            return importCommand(ctx, key);
         case 'schema':
             return printSchemaSettings();
         case 'check':
             return checkLocalConfig(ctx);
         default:
-            fail('Unknown config action "' + action + '".', 'Use one of: sandbox config show | path | init | schema | check');
+            fail('Unknown config action "' + action + '".', 'Use one of: sandbox config show | list | get | set | reset | path | init | schema | check | export | import');
     }
 }

package/dist/cli/commands/maintenance/doctor.d.ts

@@ -1,2 +1,2 @@
 import { type Context } from '../context.js';
-export declare function doctor(ctx: Context): number;
+export declare function doctor(ctx: Context): Promise<number>;

package/dist/cli/commands/maintenance/doctor.js

@@ -1,6 +1,4 @@
-import { table } from '../../output/index.js';
-import { HealthService } from '../../services/index.js';
+import { runDoctor } from '../repair/index.js';
 export function doctor(ctx) {
-    table(new HealthService(ctx).doctor());
-    return 0;
+    return runDoctor(ctx);
 }

package/dist/cli/commands/maintenance/logs.js

@@ -1,6 +1,20 @@
 import { sleep } from '../../../core/util/index.js';
+import { newestCrashReport } from '../../../host/life/index.js';
 import { LogsService } from '../../services/index.js';
+/** The newest crash report (written by the background sync when the sandbox or this PC went down). */
+function printCrashReport(ctx) {
+    const report = newestCrashReport(ctx.storageRoot);
+    if (!report) {
+        console.log('No crash report yet: no sandbox has ended in a crash since this was installed.');
+        return 0;
+    }
+    console.log('== ' + report.file + ' ==');
+    console.log(report.text);
+    return 0;
+}
 export async function logs(ctx) {
+    if (ctx.options.crash)
+        return printCrashReport(ctx);
     const service = new LogsService(ctx);
     const file = service.newest();
     console.log('== ' + file + ' ==');

package/dist/cli/commands/maintenance/migrate.d.ts

@@ -1,9 +1,10 @@
 import { MigrateService } from '../../services/index.js';
-import type { Context } from '../context.js';
+import { type Context } from '../context.js';
 /** `sandbox migrate`: the work, with the service and the output given so a test can drive it. */
 export declare function runMigrate(service: MigrateService, options: {
     readonly dryRun: boolean;
     readonly restore?: string;
+    readonly yes?: boolean;
 }, print: (line: string) => void): Promise<number>;
 export declare function migrate(ctx: Context): Promise<number>;
 /**