windows-development-sandbox 1.5.0 → 1.9.0

package/dist/cli/commands/maintenance/migrate.js

@@ -1,15 +1,28 @@
 import { userDir } from '../../../core/config/index.js';
 import { autoMigrates, continuesAfterFailedMigration, MigrateService, } from '../../services/index.js';
+import { askRequired } from '../../../core/prompt.js';
 import { c } from '../../output/index.js';
 import { errMsg, UserError } from '../../../core/util/index.js';
 import { insideSandbox } from '../../../host/sandbox/index.js';
-/** Where this context keeps the saved settings. */
+import { holdsData, oldDefaultRoot } from '../../../host/storage/index.js';
+import { refreshStorage } from '../context.js';
+/**
+ * Where this context keeps the saved settings. Backups go where the data is: an upgrade that has not pinned the old
+ * folder yet would otherwise fill the new, empty default folder with them.
+ */
 function whereOf(ctx) {
-    return { storageRoot: ctx.storageRoot, userDir: userDir(), configPath: ctx.loaded.configPath };
+    const old = oldDefaultRoot();
+    const unpinned = old !== null && !holdsData(ctx.storageRoot) && holdsData(old) && !ctx.loaded.layers?.machine;
+    return { storageRoot: unpinned ? old : ctx.storageRoot, userDir: userDir(), configPath: ctx.loaded.configPath };
 }
 /** `sandbox migrate`: the work, with the service and the output given so a test can drive it. */
 export async function runMigrate(service, options, print) {
     if (options.restore) {
+        if (!options.yes &&
+            !(await askRequired('Put back the files saved in ' + options.restore + '? Your current settings files are replaced.', 'Add --yes to put them back without asking.'))) {
+            print('Nothing was changed.');
+            return 1;
+        }
         service.restore(options.restore);
         print('Put back the files saved in ' + options.restore + '.');
         return 0;
@@ -31,7 +44,7 @@ export async function runMigrate(service, options, print) {
     return 0;
 }
 export function migrate(ctx) {
-    return runMigrate(new MigrateService(whereOf(ctx)), { dryRun: ctx.options.dryRun, restore: ctx.options.restore }, (line) => console.log(line));
+    return runMigrate(new MigrateService(whereOf(ctx)), { dryRun: ctx.options.dryRun, restore: ctx.options.restore, yes: ctx.options.yes }, (line) => console.log(line));
 }
 /**
  * Before a command: brings the settings up to date when the version changed (one small file is read otherwise).
@@ -44,7 +57,9 @@ export async function migrateBeforeCommand(ctx, command) {
     try {
         if (!service.versionChanged())
             return;
-        await service.run((line) => console.error(c.dim(line)));
+        const result = await service.run((line) => console.error(c.dim(line)));
+        if (result.applied.length)
+            refreshStorage(ctx);
     }
     catch (e) {
         if (!continuesAfterFailedMigration(command))

package/dist/cli/commands/maintenance/sync.js

@@ -1,5 +1,6 @@
 import { isSandboxRunning } from '../../../host/sandbox/index.js';
 import { syncBack } from '../../../sync/index.js';
+import { nextStep } from '../../output/index.js';
 export function sync(ctx) {
     const running = isSandboxRunning();
     const result = syncBack(ctx.dataPath, !running);
@@ -8,5 +9,6 @@ export function sync(ctx) {
         ' item(s) synced back. claude-mem: ' +
         result.claudeMem +
         (running ? ' (claude-mem syncs when the sandbox closes)' : ''));
+    nextStep('sandbox claude   (carry on where you left off)');
     return 0;
 }

package/dist/cli/commands/maintenance/update.d.ts

@@ -6,6 +6,8 @@ export interface UpdateRequest {
     readonly rollback: boolean;
     readonly auto?: 'on' | 'off';
     readonly unattended: boolean;
+    /** Do not ask before going back. */
+    readonly yes?: boolean;
 }
 /** One sentence for what an update run did, and whether it counts as done. */
 export declare function describeResult(result: UpdateResult | null, unattended: boolean): {

package/dist/cli/commands/maintenance/update.js

@@ -1,4 +1,5 @@
 import { userDir } from '../../../core/config/index.js';
+import { askRequired } from '../../../core/prompt.js';
 import { errMsg } from '../../../core/util/index.js';
 import { PACKAGE_ROOT } from '../../../core/package-info.js';
 import { insideSandbox, spawnDetached } from '../../../host/sandbox/index.js';
@@ -23,8 +24,14 @@ export function describeResult(result, unattended) {
                 result.version +
                 ' failed: ' +
                 result.reason.replace(/\.?\s*$/, '.') +
-                ' Still on the version you had.' +
-                (result.blocked ? ' It is not tried again; the next release is.' : ' It is tried again later.'),
+                (result.rolledBack
+                    ? ' The change was undone: you are on the version you had.'
+                    : ' Going back to your previous version did not fully work: run sandbox update --rollback or the installer.') +
+                (result.autoUpdateOff
+                    ? ' Automatic updates are off; turn them back on in Maintenance > Updates or with sandbox update --auto on.'
+                    : result.blocked
+                        ? ' It is not tried again; the next release is.'
+                        : ' It is tried again later.'),
             code: 1,
         };
     switch (result.reason) {
@@ -52,12 +59,22 @@ export async function runUpdate(service, request, print) {
         print('This copy was installed with npm. Update it with: ' + NPM_UPDATE_COMMAND);
         return 0;
     }
+    // The scheduled task (it may outlive a removal that needed admin) and background starts only run when updates are on.
+    if (request.unattended && !request.auto && !service.status().autoUpdate)
+        return 0;
     if (request.auto) {
         service.setAuto(request.auto === 'on');
         print('Automatic updates are ' + request.auto + '.');
         return 0;
     }
     if (request.rollback) {
+        const { version, state } = service.status();
+        const target = state.previous ? 'version ' + state.previous : 'the version before the last update';
+        if (!request.yes &&
+            !(await askRequired('Go back from version ' + version + ' to ' + target + '?', 'Add --yes to go back without asking.'))) {
+            print('Nothing was changed.');
+            return 1;
+        }
         print('Went back to version ' + service.rollback() + '.');
         return 0;
     }
@@ -77,10 +94,16 @@ export async function runUpdate(service, request, print) {
 }
 export function update(options) {
     const service = UpdateService.forPackage(PACKAGE_ROOT, options.feed, { userDir: userDir() });
-    return runUpdate(service, { check: options.check, rollback: options.rollback, auto: options.autoUpdate, unattended: options.unattended }, (line) => console.log(line));
+    return runUpdate(service, {
+        check: options.check,
+        rollback: options.rollback,
+        auto: options.autoUpdate,
+        unattended: options.unattended,
+        yes: options.yes,
+    }, (line) => console.log(line));
 }
 /** Commands that never look for updates first: they are how updates run, or they must stay quiet. */
-const NO_STARTUP_UPDATE = ['self-test', 'update', '_watch'];
+const NO_STARTUP_UPDATE = ['self-test', 'update', '_watch', '_web'];
 /**
  * At the start of a command: tells this user once about an update that ran without them, and (current-user installs
  * with automatic updates on) starts the daily check in the background. Never stops the command.

package/dist/cli/commands/projects/here.js

@@ -3,13 +3,13 @@
 // folder a project of the running sandbox when it can without a restart (launch, start, exec, db).
 import path from 'node:path';
 import { select } from '@inquirer/prompts';
-import { describeMissing, missingTip } from '../../../core/local-config/index.js';
+import { describeMissing, missingTip, protectionsOf } from '../../../core/local-config/index.js';
 import { askYesNo } from '../../../core/prompt.js';
 import { fail, isInsideOrEqual } from '../../../core/util/index.js';
 import { ownerName } from '../../../host/sharing/index.js';
 import { resolveRun } from '../../../core/run/index.js';
 import { SandboxChannel } from '../../../host/channel/index.js';
-import { BorrowedRegistry, ProjectRegistry, joinRunning, } from '../../../host/projects/index.js';
+import { BorrowedRegistry, ProjectRegistry, joinRunning, runningRegistry, } from '../../../host/projects/index.js';
 import { c, working } from '../../output/index.js';
 import { describeSessions } from './describe-sessions.js';
 import { guestPathFor } from '../context.js';
@@ -21,17 +21,22 @@ export function registryOf(ctx) {
 export function hereDir(ctx) {
     return path.resolve(ctx.options.workspace ?? process.cwd());
 }
+/**
+ * Your running sandbox's registry, rebuilt from its launch folder when the file is missing, unreadable or an earlier
+ * sandbox's (another copy or version of this tool started it). null only for a sandbox without one at all.
+ */
+function ownRegistry(ctx) {
+    return runningRegistry(ctx.storageRoot, ctx.dataPath, protectionsOf(ctx.loaded.config));
+}
 /** Where this folder is in the running sandbox, if it is in it at all (nothing is registered). */
 export function locateHere(ctx, status) {
     const dir = hereDir(ctx);
+    const own = ctx.borrowed ? null : ownRegistry(ctx);
     const here = registryOf(ctx).here(dir);
     if (here)
         return here;
     // A sandbox started before projects existed: only its launch folder.
-    if (!ctx.borrowed &&
-        !new ProjectRegistry(ctx.storageRoot).read() &&
-        status &&
-        isInsideOrEqual(status.workspaceHost, dir))
+    if (!ctx.borrowed && !own && status && isInsideOrEqual(status.workspaceHost, dir))
         return { project: null, guestDir: guestPathFor(dir, status.workspaceHost, status.guestWorkspace) };
     return { project: null, guestDir: null };
 }
@@ -57,7 +62,7 @@ export async function joinHere(ctx, status, o = {}) {
         return { project: known.project, guestDir: known.guestDir, spec: null, harness: null, notes: [] };
     }
     // A sandbox started before projects existed: only its launch folder (guestPathFor explains why otherwise).
-    if (!new ProjectRegistry(storageRoot).read())
+    if (!ownRegistry(ctx))
         return {
             project: null,
             guestDir: guestPathFor(dir, status.workspaceHost, status.guestWorkspace),

package/dist/cli/commands/projects/projects.js

@@ -1,11 +1,12 @@
 // `sandbox projects`: which projects a sandbox can open without a restart. Project roots (whole folders of projects),
-// the projects this tool has started before, and projects.all / projects.exclude. Changes to what is mapped take
+// the projects this tool has started before, and the all-projects and exclude settings. Changes to what is mapped take
 // effect at the next start; a project you start while a sandbox runs joins it when it can (projects.ts in host/).
 import path from 'node:path';
 import { checkbox } from '@inquirer/prompts';
+import { askChoice } from '../../../core/prompt.js';
 import { fail } from '../../../core/util/index.js';
 import { isSandboxRunning } from '../../../host/sandbox/index.js';
-import { c, pageSizeFor, shortenMiddle, termWidth, printJson, table } from '../../output/index.js';
+import { c, nextStep, pageSizeFor, shortenMiddle, termWidth, printJson, table } from '../../output/index.js';
 import { ProjectsService } from '../../services/index.js';
 const NEXT_START = 'This changes what is mapped from the next start.';
 function runningNote() {
@@ -18,7 +19,7 @@ function list(ctx, service) {
     const rows = listing.projects;
     if (printJson(ctx, { all: listing.all, roots: listing.roots, exclude: listing.exclude, projects: rows }))
         return 0;
-    console.log(c.bold('projects.all') +
+    console.log(c.bold('All projects') +
         ': ' +
         (listing.all ? 'on (every project below is mapped at every start, except excluded ones)' : 'off') +
         c.dim('   sandbox projects all on|off'));
@@ -42,7 +43,7 @@ function list(ctx, service) {
     console.log(c.dim('* = this folder.  Choose with: sandbox projects choose'));
     return 0;
 }
-/** Ticks the projects mapped at every start (turns projects.all on when any is ticked); the rest are excluded. */
+/** Ticks the projects mapped at every start (any ticked turns all-projects on); the rest are excluded. */
 async function choose(service) {
     const rows = service.rows().filter((r) => !r.root);
     if (!rows.length) {
@@ -65,14 +66,22 @@ async function choose(service) {
     console.log(mapped + ' project(s) mapped at every start, ' + excluded + ' excluded. ' + NEXT_START + runningNote());
     return 0;
 }
+/** The folder typed, or one picked from the known projects (or this folder) when it was left out. */
+async function folderOf(service, action, given) {
+    if (given)
+        return given;
+    const rows = service.rows();
+    return askChoice('Which folder?', [
+        { name: 'This folder (' + shortenMiddle(process.cwd(), termWidth() - 30) + ')', value: '.' },
+        ...rows.filter((r) => !r.here).map((r) => ({ name: shortenMiddle(r.folder, termWidth() - 12), value: r.folder })),
+    ], 'Usage: sandbox projects ' + action + ' <folder>   (. = this folder)');
+}
 function add(service, value) {
     const dir = service.add(value);
-    console.log('Added ' +
-        dir +
-        ' to your projects.' +
-        (service.settings().all
-            ? ' ' + NEXT_START
-            : ' It is mapped at every start once projects.all is on (sandbox projects all on).'));
+    const all = service.settings().all;
+    console.log('Added ' + dir + ' to your projects.' + (all ? ' ' + NEXT_START : ''));
+    if (!all)
+        nextStep('sandbox projects all on   (map every project at every start)');
     return 0;
 }
 function remove(service, value) {
@@ -88,18 +97,18 @@ function includeOrExclude(service, action, value) {
         ? (action === 'exclude' ? 'Excluded ' : 'Included ') + path.resolve(value) + '. ' + NEXT_START
         : 'Nothing changed.') +
         (action === 'include' && !service.settings().all
-            ? ' projects.all is off: sandbox projects all on maps your projects at every start.'
+            ? ' Mapping all projects is off: sandbox projects all on maps your projects at every start.'
             : '') +
         (changed ? runningNote() : ''));
     return 0;
 }
 function all(service, value) {
     if (value === undefined) {
-        console.log('projects.all is ' + (service.settings().all ? 'on' : 'off') + '.');
+        console.log('Mapping all projects at every start is ' + (service.settings().all ? 'on' : 'off') + '.');
         return 0;
     }
     service.setAll(value === 'on');
-    console.log('projects.all is ' +
+    console.log('Mapping all projects at every start is ' +
         value +
         '. ' +
         NEXT_START +
@@ -137,17 +146,17 @@ export async function projects(ctx) {
         case 'choose':
             return choose(service);
         case 'add':
-            return add(service, value);
+            return add(service, await folderOf(service, action, value));
         case 'remove':
-            return remove(service, value);
+            return remove(service, await folderOf(service, action, value));
         case 'include':
         case 'exclude':
-            return includeOrExclude(service, action, value);
+            return includeOrExclude(service, action, await folderOf(service, action, value));
         case 'all':
             return all(service, value);
         case 'roots':
             return roots(service, value, folder);
         default:
-            return fail('Unknown projects action "' + action + '".');
+            return fail('Unknown projects action "' + action + '".', 'Use: sandbox projects list | choose | add | remove | include | exclude | all | roots');
     }
 }

package/dist/cli/commands/registry.js

@@ -1,26 +1,24 @@
 import { launch } from './launch/index.js';
 import { setup } from './setup/index.js';
 import { data } from './data/index.js';
-import { attach, db, exec, hide, restart, sessions, show, status, stop } from './sessions/index.js';
+import { storage } from './storage/index.js';
+import { attach, db, exec } from './sessions/index.js';
 import { account } from './accounts.js';
 import { projects } from './projects/index.js';
 import { audit, claudeHost, clean, config, doctor, hostCommand, logs, migrate, sync, watcher, } from './maintenance/index.js';
+import { engine } from './engine.js';
 import { resume } from './resume.js';
 import { agentCommandsCommand } from './agent-commands.js';
+import { vpn } from './vpn.js';
+import { web, webServer } from './web.js';
 export const HANDLERS = {
     launch: (ctx) => launch(ctx),
     generate: (ctx) => launch(ctx, true),
     attach: attach,
-    sessions: sessions,
-    status: status,
     exec: exec,
     'agent-commands': agentCommandsCommand,
     db: db,
-    restart: restart,
     resume: resume,
-    stop: stop,
-    show: show,
-    hide: hide,
     account: account,
     projects: projects,
     sync: sync,
@@ -32,7 +30,12 @@ export const HANDLERS = {
     migrate: migrate,
     setup: setup,
     data: data,
+    storage: storage,
+    engine: engine,
     'host-claude': claudeHost,
     host: hostCommand,
     _watch: watcher,
+    vpn: vpn,
+    web: web,
+    _web: webServer,
 };

package/dist/cli/commands/repair/checks/agents.d.ts

@@ -0,0 +1,2 @@
+import type { Check } from '../types.js';
+export declare const AGENT_CHECKS: Check[];

package/dist/cli/commands/repair/checks/agents.js

@@ -0,0 +1,70 @@
+// Agents: is the default agent one of those configured, and for each agent that keeps a login, is a saved login in
+// use in this data folder. Looks only; logins are never changed here.
+import { errMsg } from '../../../../core/util/index.js';
+import { AccountStore, AgentAccountStore } from '../../../../host/profile/index.js';
+import { ok, plural } from './common.js';
+function rowsOf(env, name, loginFiles) {
+    if (name === 'claude')
+        return new AccountStore(env.storageRoot).list(env.dataPath);
+    return loginFiles ? new AgentAccountStore(env.storageRoot, name, loginFiles).list(env.dataPath) : [];
+}
+export const AGENT_CHECKS = [
+    {
+        id: 'agents-default',
+        group: 'Agents & tools',
+        name: 'Default agent',
+        run: (env) => {
+            const config = env.ctx.loaded.config;
+            const name = env.ctx.options.harness ?? config.defaultHarness;
+            const harness = config.harnesses[name];
+            if (!harness)
+                return {
+                    status: 'needs-you',
+                    detail: '"' + name + '" is not one of your configured agents (' + Object.keys(config.harnesses).join(', ') + ')',
+                    means: 'sandbox launch has no agent to start.',
+                    fix: 'Set defaultHarness in your settings to one of those names (sandbox config path shows the file).',
+                };
+            return ok(name + ' (' + plural(Object.keys(config.harnesses).length, 'agent') + ' configured)');
+        },
+    },
+    {
+        id: 'agents-logins',
+        group: 'Agents & tools',
+        name: 'Agent logins',
+        run: (env) => {
+            const harnesses = env.ctx.loaded.config.harnesses;
+            const lines = [];
+            const idle = [];
+            for (const [name, harness] of Object.entries(harnesses)) {
+                let rows;
+                try {
+                    rows = rowsOf(env, name, harness.home?.loginFiles);
+                }
+                catch (e) {
+                    lines.push(name + ': saved logins cannot be read (' + errMsg(e) + ')');
+                    idle.push(name);
+                    continue;
+                }
+                if (!rows.length)
+                    continue;
+                const active = rows.find((r) => r.isActive);
+                if (active)
+                    lines.push(name + ': ' + active.name + ' is in use (' + plural(rows.length, 'login') + ' saved)');
+                else {
+                    lines.push(name + ': ' + plural(rows.length, 'login') + ' saved, none in use here');
+                    idle.push(name);
+                }
+            }
+            if (!lines.length)
+                return ok('no saved logins (sign in inside the sandbox the first time)');
+            if (!idle.length)
+                return { ...ok(lines.join('; ')) };
+            return {
+                status: 'warn',
+                detail: lines.join('; '),
+                means: 'The sandbox starts signed out for ' + idle.join(', ') + ' until you pick a saved login.',
+                fix: 'Run: sandbox account use <name>' + (idle[0] === 'claude' ? '' : ' --agent ' + idle[0]),
+            };
+        },
+    },
+];

package/dist/cli/commands/repair/checks/common.d.ts

@@ -0,0 +1,8 @@
+import type { Finding, RepairEnv } from '../types.js';
+export declare function ok(detail: string): Finding;
+export declare function rel(root: string, p: string): string;
+/** Throws unless every folder from the data folder's parent down to `p` is real (no link the sandbox made). */
+export declare function guard(env: RepairEnv, p: string): void;
+export declare function plural(n: number, one: string, many?: string): string;
+/** The current Windows user's name (what the group lists, without the domain). */
+export declare function sameUser(account: string, user: string): boolean;

package/dist/cli/commands/repair/checks/common.js

@@ -0,0 +1,22 @@
+// Small helpers the checks share.
+import path from 'node:path';
+import { assertNoLinks } from '../../../../core/util/index.js';
+export function ok(detail) {
+    return { status: 'ok', detail };
+}
+export function rel(root, p) {
+    return path.relative(root, p) || '.';
+}
+/** Throws unless every folder from the data folder's parent down to `p` is real (no link the sandbox made). */
+export function guard(env, p) {
+    assertNoLinks(path.dirname(env.dataPath), p);
+}
+export function plural(n, one, many = one + 's') {
+    return n + ' ' + (n === 1 ? one : many);
+}
+/** The current Windows user's name (what the group lists, without the domain). */
+export function sameUser(account, user) {
+    const a = account.toLowerCase();
+    const u = user.toLowerCase();
+    return a === u || a.endsWith('\\' + u);
+}

package/dist/cli/commands/repair/checks/contained.d.ts

@@ -0,0 +1,2 @@
+import type { Check } from '../types.js';
+export declare const CONTAINED_CHECKS: Check[];

package/dist/cli/commands/repair/checks/contained.js

@@ -0,0 +1,139 @@
+// Contained storage (beta): the image is there, what the record says is mounted matches what is really mounted, and
+// the folders around the image are private. A mount left behind (a sandbox that ended without letting go, a crash) is
+// dismounted here, which needs the Windows permission prompt.
+import fs from 'node:fs';
+import { isWin } from '../../../../core/util/index.js';
+import { parseIcacls, privacyProblems, SHARING_GROUP } from '../../../../host/health/index.js';
+import { realContainedDeps } from '../../../../host/sandbox/index.js';
+import { protectPrivateFolder } from '../../../../host/sharing/index.js';
+import { containedAvailability, ContainedStorage, containedPaths } from '../../../../host/storage/index.js';
+import { ok } from './common.js';
+function storageOf(env) {
+    const { config } = env.ctx.loaded;
+    return new ContainedStorage(realContainedDeps(env.storageRoot, config.storage.containedMaxGb), config.storage.dataName);
+}
+/** Only when contained storage is on, or an image or a record of one exists. */
+const inUse = (env) => {
+    if (!isWin)
+        return false;
+    const { config } = env.ctx.loaded;
+    const paths = containedPaths(env.storageRoot, config.storage.dataName);
+    return config.storage.contained === 'vhdx' || fs.existsSync(paths.image) || fs.existsSync(paths.stateFile);
+};
+export const CONTAINED_CHECKS = [
+    {
+        id: 'data-contained',
+        group: 'Data folder',
+        name: 'Contained storage',
+        checking: 'the contained storage image (beta)',
+        applies: inUse,
+        timeoutMs: 60_000,
+        run: async (env) => {
+            const wanted = env.ctx.loaded.config.storage.contained === 'vhdx';
+            const available = containedAvailability();
+            if (!available.available)
+                return wanted
+                    ? {
+                        status: 'needs-you',
+                        detail: 'storage.contained is "vhdx", but ' + available.reasons.join(' '),
+                        means: 'A launch cannot mount the image on this PC.',
+                        fix: available.fixes.join(' '),
+                    }
+                    : {
+                        status: 'skipped',
+                        detail: 'an image exists, but this PC cannot look at it: ' + available.reasons.join(' '),
+                    };
+            const storage = storageOf(env);
+            const diagnosis = await storage.diagnose();
+            switch (diagnosis.kind) {
+                case 'image-missing':
+                    return wanted
+                        ? {
+                            status: 'needs-you',
+                            detail: 'the image is missing: ' + storage.paths.image,
+                            means: 'A launch stops until it is there (the tools, state and logs in it are gone with it).',
+                            fix: 'Restore the file, or run: sandbox storage contained off (and then on again for a new, empty image).',
+                        }
+                        : ok('no image (contained storage is off)');
+                case 'in-use':
+                    return ok('mounted, in use by a running sandbox');
+                case 'stale-mount':
+                    return {
+                        status: 'needs-you',
+                        detail: 'the image is still mounted at ' + storage.paths.mount + ', and nothing uses it',
+                        means: 'It stays attached to this PC until it is dismounted; a launch would reuse it.',
+                        plan: 'dismount the image (Windows asks for permission)',
+                        data: 'dismount',
+                    };
+                case 'stale-state':
+                    return {
+                        status: 'warn',
+                        detail: 'the record says the image is mounted, but it is not',
+                        means: 'Nothing is wrong with the image; the record is out of date.',
+                        plan: 'correct the record',
+                        data: 'record',
+                    };
+                default:
+                    return ok('not mounted' + (wanted ? '' : ' (contained storage is off; the image is kept)'));
+            }
+        },
+        fix: async (env, finding) => {
+            const storage = storageOf(env);
+            if (finding.data === 'record') {
+                storage.clearRecord();
+                return { done: 'corrected the record' };
+            }
+            const result = await storage.dismountIfIdle();
+            if (!result.dismounted)
+                throw new Error('Could not dismount the image: ' + (result.note ?? 'unknown reason'));
+            return { done: 'dismounted the image' };
+        },
+        needsIdle: 'fix',
+    },
+    {
+        id: 'data-contained-privacy',
+        group: 'Data folder',
+        name: 'Contained storage folders',
+        checking: 'who can open the contained storage folders',
+        applies: inUse,
+        run: (env) => {
+            const { config } = env.ctx.loaded;
+            const paths = containedPaths(env.storageRoot, config.storage.dataName);
+            // While mounted, the mount folder shows the image's own root, and nothing is changed under a mount point.
+            if (env.running)
+                return ok('a sandbox is running; not looked at now');
+            const loose = [];
+            for (const dir of [paths.imagesDir, paths.mountsDir, paths.mount]) {
+                if (!fs.existsSync(dir))
+                    continue;
+                const text = env.system.icacls(dir);
+                if (text === null)
+                    return { status: 'skipped', detail: 'could not read the permissions of ' + dir };
+                const problems = privacyProblems(parseIcacls(text, dir), SHARING_GROUP);
+                if (problems.length > 0)
+                    loose.push(dir + ' (' + problems.join(', ') + ')');
+            }
+            if (loose.length === 0)
+                return ok('private (you, SYSTEM and administrators)');
+            return {
+                status: 'warn',
+                detail: 'open to more than you: ' + loose.join('; '),
+                means: 'Other users of this PC could open the image or the folders it is mounted in.',
+                plan: 'make them private',
+                data: 'private',
+            };
+        },
+        fix: (env) => {
+            const { config } = env.ctx.loaded;
+            const paths = containedPaths(env.storageRoot, config.storage.dataName);
+            // Never with an image mounted below: a folder with files is walked, and a mount point must not be.
+            if (env.running)
+                throw new Error('a sandbox is running; run repair again once it is closed');
+            for (const dir of [paths.imagesDir, paths.mountsDir, paths.mount])
+                if (fs.existsSync(dir))
+                    protectPrivateFolder(dir);
+            return { done: 'made the folders private' };
+        },
+        needsIdle: 'fix',
+    },
+];

package/dist/cli/commands/repair/checks/data.d.ts

@@ -0,0 +1,2 @@
+import type { Check } from '../types.js';
+export declare const DATA_CHECKS: Check[];