windows-development-sandbox 1.7.0 → 1.9.0

package/dist/cli/commands/repair/checks/pc.js

@@ -1,7 +1,8 @@
 // This PC: Windows itself, what Windows Sandbox needs of it, and whether Windows wants a restart. The hardware and
 // edition answers come from the same look `sandbox setup` takes (once per run).
 import { isWin } from '../../../../core/util/index.js';
-import { updateRestartPending } from '../../../../host/life/index.js';
+import { pageFileRisk, readHostMemory, updateRestartPending } from '../../../../host/life/index.js';
+import { decideMemory } from '../../../../host/launch/index.js';
 import { buildChecks } from '../../setup/checks.js';
 import { ok } from './common.js';
 const STATUS = { ok: 'ok', warn: 'warn', action: 'needs-you' };
@@ -38,6 +39,36 @@ export const PC_CHECKS = [
     fromFacts('pc-virtualization', 'This PC', 'CPU virtualization', 'CPU virtualization'),
     fromFacts('pc-memory', 'This PC', 'Memory', 'Memory'),
     fromFacts('pc-node', 'This PC', 'Node.js', 'Node.js'),
+    {
+        id: 'pc-commit',
+        group: 'This PC',
+        name: 'Memory for the sandbox',
+        timeoutMs: 40_000,
+        run: (env) => {
+            const memory = readHostMemory(env.storageRoot);
+            if (!memory)
+                return { status: 'skipped', detail: 'the memory of this PC could not be read' };
+            const sandbox = env.ctx.loaded.config.sandbox;
+            const planned = sandbox.memoryMb === 'auto'
+                ? decideMemory(sandbox, memory.availableMb, memory.totalMb, memory.commitAvailableMb).mb
+                : sandbox.memoryMb;
+            const detail = Math.floor(memory.commitAvailableMb / 1024) +
+                ' GB of RAM plus paging file free, page file ' +
+                memory.pageFile +
+                ', the next sandbox gets ' +
+                Math.floor(planned / 1024) +
+                ' GB';
+            const risk = pageFileRisk(memory, planned);
+            return risk
+                ? {
+                    status: 'warn',
+                    detail,
+                    means: risk.text,
+                    fix: 'Nothing is changed for you: set the page file as above (Windows keeps working either way).',
+                }
+                : ok(detail);
+        },
+    },
     {
         id: 'pc-restart-pending',
         group: 'This PC',

package/dist/cli/commands/repair/checks/sandbox.js

@@ -6,6 +6,7 @@ import path from 'node:path';
 import { dirExists, fileExists, isLink } from '../../../../core/util/index.js';
 import { SandboxChannel } from '../../../../host/channel/index.js';
 import { orphanWatchers, runStateProblems, staleLaunchFolders, watcherRecords } from '../../../../host/health/index.js';
+import { vgpuSource, vgpuWarning } from '../../../../host/launch/index.js';
 import { hostToolsExe } from '../../../../host/native.js';
 import { sandboxFeatureInstalled } from '../../../../host/sandbox/index.js';
 import { assertTestWritable, refuseInSelfTest } from '../../../../host/test-guard.js';
@@ -19,6 +20,19 @@ import { ok, plural, rel } from './common.js';
 const LAUNCH_DAYS = 7;
 const hiddenWindowsFile = (env) => path.join(env.storageRoot, 'run', 'hidden-windows.json');
 export const SANDBOX_CHECKS = [
+    {
+        id: 'sandbox-vgpu',
+        group: 'Sandbox',
+        name: 'vGPU',
+        run: (env) => env.ctx.loaded.config.sandbox.vGpu
+            ? {
+                status: 'warn',
+                detail: 'vGPU is on in your settings',
+                means: vgpuWarning(vgpuSource(true)),
+                fix: 'Run: sandbox config set sandbox.vGpu false',
+            }
+            : ok('off'),
+    },
     {
         id: 'sandbox-exe',
         group: 'Sandbox',
@@ -198,7 +212,8 @@ export const SANDBOX_CHECKS = [
         timeoutMs: 150_000,
         run: (env) => {
             const bin = path.join(env.storageRoot, 'bin');
-            const built = dirExists(bin) && fs.readdirSync(bin).some((n) => /^HostTools-[0-9a-f]+\.exe$/i.test(n));
+            const built = dirExists(bin) &&
+                fs.readdirSync(bin).some((n) => /^[0-9a-f]{12}$/i.test(n) && fs.existsSync(path.join(bin, n, 'HostTools.exe')));
             if (built)
                 return ok('built in ' + bin);
             return {

package/dist/cli/commands/repair/checks/vpn.js

@@ -1,17 +1,20 @@
 // The VPN, when it is on: is the login saved and readable, can the OpenVPN download be reached. Not shown when the
 // VPN is off. (That the storage folder is private is checked with the data folder.)
-import { VpnLogin } from '../../../../host/vpn/index.js';
-import { OPENVPN_MSI } from '../../../../shared/vpn/download.js';
+import { VpnLogin, wireguardFileProblem } from '../../../../host/vpn/index.js';
+import { OPENVPN_MSI, WIREGUARD_MSI } from '../../../../shared/vpn/download.js';
 import { ok } from './common.js';
 const REACH_MS = 6000;
 const vpnOn = (env) => env.ctx.loaded.config.vpn.enabled;
+const wireguard = (env) => env.ctx.loaded.config.vpn.provider === 'wireguard-file';
+const loginNeeded = (env) => vpnOn(env) && !wireguard(env);
+const wireguardOn = (env) => vpnOn(env) && wireguard(env);
 export const VPN_CHECKS = [
     {
         id: 'vpn-login',
         group: 'Network',
         name: 'VPN login',
         checking: 'the saved VPN login',
-        applies: vpnOn,
+        applies: loginNeeded,
         run: (env) => {
             const { provider } = env.ctx.loaded.config.vpn;
             const state = new VpnLogin(env.storageRoot).state(provider);
@@ -32,20 +35,42 @@ export const VPN_CHECKS = [
                 };
         },
     },
+    {
+        id: 'vpn-config',
+        group: 'Network',
+        name: 'WireGuard config',
+        checking: 'the WireGuard config file',
+        applies: wireguardOn,
+        run: (env) => {
+            const problem = wireguardFileProblem(env.ctx.loaded.config.vpn.configFile, process.cwd());
+            return problem
+                ? {
+                    status: 'needs-you',
+                    detail: problem,
+                    means: 'The sandbox cannot start its VPN, so a launch stops.',
+                    fix: 'Set vpn.configFile to a plain WireGuard .conf (no PostUp, PreUp or other script lines).',
+                }
+                : ok('readable and plain (keys are not shown)');
+        },
+    },
     {
         id: 'vpn-download',
         group: 'Network',
-        name: 'OpenVPN download',
-        checking: 'whether the OpenVPN download can be reached',
+        name: 'VPN download',
+        checking: 'whether the VPN software download can be reached',
         applies: vpnOn,
         timeoutMs: REACH_MS + 4000,
         run: async (env) => {
-            if (await env.system.reachable(OPENVPN_MSI.base, REACH_MS))
-                return ok('swupdate.openvpn.org answers');
+            const [name, base] = wireguard(env)
+                ? ['WireGuard', WIREGUARD_MSI.base]
+                : ['OpenVPN', OPENVPN_MSI.base];
+            const host = new URL(base).host;
+            if (await env.system.reachable(base, REACH_MS))
+                return ok(host + ' answers');
             return {
                 status: 'warn',
-                detail: 'swupdate.openvpn.org did not answer within ' + REACH_MS / 1000 + ' seconds',
-                means: 'The sandbox downloads OpenVPN there at its first VPN start (it is kept afterwards).',
+                detail: host + ' did not answer within ' + REACH_MS / 1000 + ' seconds',
+                means: 'The sandbox downloads ' + name + ' there at its first VPN start (it is kept afterwards).',
                 fix: 'Check your internet connection or proxy, then run this again.',
             };
         },

package/dist/cli/commands/repair/env.js

@@ -6,6 +6,7 @@ import { WindowsProbe } from '../../../host/health/index.js';
 import { InstallLayout, InstallRecordFile } from '../../../host/install/index.js';
 import { MIGRATIONS } from '../../../host/migrate/index.js';
 import { isSandboxRunning } from '../../../host/sandbox/index.js';
+import { hostDataFolder } from '../../../host/storage/index.js';
 import { gatherFacts } from '../setup/facts.js';
 /** The settings file in use: --config, AGENT_SANDBOX_CONFIG, else the user's config.json. */
 export function configFileOf(ctx) {
@@ -33,7 +34,7 @@ export function buildEnv(ctx, configError = null, system = new WindowsProbe()) {
         running: isSandboxRunning(),
         dataPath: ctx.dataPath,
         storageRoot: ctx.storageRoot,
-        toolsDir: path.join(ctx.dataPath, 'tools'),
+        toolsDir: hostDataFolder(ctx.dataPath, 'tools'),
         configError: configProblem(ctx, configError),
         layout,
         record: layout ? new InstallRecordFile(layout.root).read() : null,

package/dist/cli/commands/sessions/index.d.ts

@@ -1,6 +1,2 @@
 export * from './attach.js';
-export * from './list.js';
-export * from './status.js';
 export * from './exec.js';
-export * from './control.js';
-export * from './window.js';

package/dist/cli/commands/sessions/index.js

@@ -1,9 +1,5 @@
-// Working with a running sandbox: attach, sessions, status, exec, restart, stop, show/hide. Each knows which project
-// you run it from (project.ts): attach and sessions put that project's sessions first, exec and db run in it, restart
-// restarts its sessions, stop warns about the other projects' sessions.
+// Working with a running sandbox: attach and exec. Each knows which project you run it from (projects/here.ts): attach
+// puts that project's sessions first, exec and db run in it. Status, sessions, restart, stop and show/hide are the
+// shared core's (src/app/features/sandbox and sessions).
 export * from './attach.js';
-export * from './list.js';
-export * from './status.js';
 export * from './exec.js';
-export * from './control.js';
-export * from './window.js';

package/dist/cli/commands/shared-use.d.ts

@@ -21,9 +21,12 @@ export interface SandboxView {
 }
 /** For status and sessions: they work for anyone, and say whose sandbox this is. */
 export declare function lookAtSandbox(ctx: Context): SandboxView;
+/** Asks for a typed confirmation ("Type alice to confirm"); true when it was typed. */
+export type TypedConfirm = (prompt: string, expected: string) => Promise<boolean>;
 /**
  * For a command that acts on the running sandbox: refuses with the reason when this user may not, asks for the typed
- * confirmation when the rule wants one (--yes in a script), and returns the context to use.
+ * confirmation when the rule wants one (--yes in a script; `confirm` asks it, by default on the terminal), and returns
+ * the context to use.
  */
-export declare function useSharedSandbox(ctx: Context, action: OwnerAction | ((shared: Context) => OwnerAction)): Promise<Context>;
+export declare function useSharedSandbox(ctx: Context, action: OwnerAction | ((shared: Context) => OwnerAction), confirm?: TypedConfirm): Promise<Context>;
 export {};

package/dist/cli/commands/shared-use.js

@@ -47,11 +47,18 @@ export function lookAtSandbox(ctx) {
         return { ctx: borrowedContext(ctx, owner), line, limited: false, owner };
     return { ctx, line, limited: owner.kind !== 'mine' && owner.kind !== 'none', owner };
 }
+/** On the terminal: no terminal fails and says how to do it in a script. */
+const terminalTypedConfirm = async (prompt, expected) => {
+    if (!(process.stdin.isTTY && process.stdout.isTTY))
+        fail(prompt + ' It was not stopped.', 'In a script, add --yes to do it anyway.');
+    return askTyped(prompt, expected);
+};
 /**
  * For a command that acts on the running sandbox: refuses with the reason when this user may not, asks for the typed
- * confirmation when the rule wants one (--yes in a script), and returns the context to use.
+ * confirmation when the rule wants one (--yes in a script; `confirm` asks it, by default on the terminal), and returns
+ * the context to use.
  */
-export async function useSharedSandbox(ctx, action) {
+export async function useSharedSandbox(ctx, action, confirm = terminalTypedConfirm) {
     const owner = ownerNow();
     if (!owner || owner.kind === 'mine' || owner.kind === 'none')
         return ctx;
@@ -59,11 +66,7 @@ export async function useSharedSandbox(ctx, action) {
     const rule = ownerRule(owner, typeof action === 'function' ? action(target) : action);
     if (rule.kind === 'refuse')
         return fail(rule.reason, rule.fix);
-    if (rule.kind === 'confirm' && !ctx.options.yes) {
-        if (!(process.stdin.isTTY && process.stdout.isTTY))
-            fail(rule.prompt + ' It was not stopped.', 'In a script, add --yes to do it anyway.');
-        if (!(await askTyped(rule.prompt, rule.expected)))
-            fail('Nothing changed.');
-    }
+    if (rule.kind === 'confirm' && !ctx.options.yes && !(await confirm(rule.prompt, rule.expected)))
+        fail('Nothing changed.');
     return target;
 }

package/dist/cli/commands/storage/contained.d.ts

@@ -0,0 +1,3 @@
+import type { Context } from '../context.js';
+/** `sandbox storage contained [status|on|off]`. */
+export declare function contained(ctx: Context): Promise<number>;

package/dist/cli/commands/storage/contained.js

@@ -0,0 +1,179 @@
+// `sandbox storage contained on|off|status` (beta): keep the data set's tools, state and logs in a
+// disk image that is mounted only while a sandbox runs. The work is in host/storage/contained; this file asks, shows
+// size and time, and prints.
+import fs from 'node:fs';
+import { userConfigPath } from '../../../core/config/index.js';
+import { humanBytes } from '../../../core/disk.js';
+import { askRequired } from '../../../core/prompt.js';
+import { fail } from '../../../core/util/index.js';
+import { isSandboxRunning, realContainedDeps } from '../../../host/sandbox/index.js';
+import { assertTargetsFree, containedAvailability, ContainedStorage, describeDuration, describeSize, planTransfer, runTransfer, setStateOf, StateFile, writeContainedSetting, } from '../../../host/storage/index.js';
+import { c, printJson, working } from '../../output/index.js';
+const BETA = 'Beta, and not yet tested on a real PC. ';
+function storageFor(ctx) {
+    const { config } = ctx.loaded;
+    return new ContainedStorage(realContainedDeps(ctx.storageRoot, config.storage.containedMaxGb), config.storage.dataName);
+}
+function requireAvailable() {
+    const check = containedAvailability();
+    if (!check.available)
+        fail('Contained storage cannot be used: ' + check.reasons.join(' '), check.fixes.join(' '));
+}
+function requireNoSandbox() {
+    if (isSandboxRunning())
+        fail('A sandbox is running.', 'Close it (sandbox stop) first: the folders in the image are in use.');
+}
+async function status(ctx) {
+    const storage = storageFor(ctx);
+    const check = containedAvailability();
+    const state = new StateFile(storage.paths).read();
+    const record = setStateOf(state, storage.set);
+    const reality = check.available && storage.imageExists() ? await storage.reality() : null;
+    const answer = {
+        setting: ctx.loaded.config.storage.contained,
+        maxGb: ctx.loaded.config.storage.containedMaxGb,
+        available: check.available,
+        reasons: check.reasons,
+        image: storage.paths.image,
+        imageExists: storage.imageExists(),
+        imageBytes: reality?.imageBytes ?? null,
+        mountFolder: storage.paths.mount,
+        recordedMounted: record.mounted,
+        holders: record.holders.length,
+        mountedNow: reality?.mountIsMountPoint ?? null,
+    };
+    if (printJson(ctx, answer))
+        return 0;
+    console.log(c.yellow('Contained storage (beta, untested on a real PC)'));
+    console.log('  setting:      storage.contained = ' + answer.setting + ' (limit ' + answer.maxGb + ' GB)');
+    console.log('  this PC:      ' +
+        (check.available ? 'can use it' : 'cannot use it: ' + check.reasons.join(' ') + ' ' + check.fixes.join(' ')));
+    console.log('  image:        ' +
+        answer.image +
+        (answer.imageExists ? ' (' + humanBytes(answer.imageBytes ?? 0) + ' on disk)' : ' (not made yet)'));
+    console.log('  mount folder: ' + answer.mountFolder);
+    if (reality)
+        console.log('  mounted now:  ' +
+            (reality.mountIsMountPoint ? 'yes' : 'no') +
+            (record.mounted !== reality.mountIsMountPoint
+                ? ' (the record says ' + (record.mounted ? 'yes' : 'no') + '; sandbox doctor looks into it)'
+                : ''));
+    console.log('\nTurn it on with: sandbox storage contained on   Turn it off with: sandbox storage contained off');
+    return 0;
+}
+function printPlan(plan, to) {
+    for (const f of plan.folders)
+        console.log('  ' + f.name + ': ' + describeSize(f.measured));
+    console.log('  total: ' + describeSize(plan.total) + ' to ' + to);
+    console.log('  time:  about ' + describeDuration(plan.estimate.seconds) + ' (copied, then the originals are removed)');
+    if (!plan.estimate.fits)
+        fail('Not enough free space for the copy.', 'Free some space on that drive and try again.');
+}
+async function turnOn(ctx) {
+    requireAvailable();
+    requireNoSandbox();
+    const storage = storageFor(ctx);
+    const { config } = ctx.loaded;
+    const configFile = ctx.loaded.configPath ?? userConfigPath();
+    console.log(c.yellow(BETA + 'Contained storage keeps the sandbox tools, state and logs in one disk image file.'));
+    console.log('  image:  ' + storage.paths.image + (storage.imageExists() ? ' (exists, it is used as it is)' : ''));
+    console.log('  limit:  ' + config.storage.containedMaxGb + ' GB (storage.containedMaxGb; the file grows only as it fills)');
+    console.log('  Windows asks for permission to mount it each time a sandbox starts (and once when it closes).');
+    if (!ctx.options.yes &&
+        !(await askRequired('Turn contained storage on?', 'Add --yes to turn it on without asking.', true)))
+        return fail('Nothing was changed.', 'Run sandbox storage contained on when you want it.');
+    const mount = await working('Making and mounting the image (Windows asks for permission)', () => storage.acquire({ id: 'cli', pid: process.pid }, { create: true }));
+    try {
+        const plan = planTransfer(ctx.dataPath, mount, ctx.storageRoot);
+        if (plan.folders.length > 0) {
+            console.log('\nThese folders hold your tools, state and logs now:');
+            printPlan(plan, 'the image');
+            assertTargetsFree(plan);
+            const move = ctx.options.yes || (await askRequired('Move them into the image?', 'Add --yes to move without asking.', true));
+            if (move) {
+                let line = 'Copying';
+                const result = await working(() => line, () => runTransfer(plan, ctx.dataPath, (p) => {
+                    line = 'Copying: ' + p.files.toLocaleString('en-US') + ' files, ' + humanBytes(p.bytes);
+                }));
+                console.log('Moved ' + result.files.toLocaleString('en-US') + ' files into the image.');
+                for (const note of result.notes)
+                    console.log(c.yellow(note));
+            }
+            else
+                console.log('They stay where they are and are not used: tools are downloaded again into the image. Delete them later with sandbox data clean.');
+        }
+        writeContainedSetting(configFile, 'vhdx');
+    }
+    finally {
+        const done = await working('Dismounting the image (Windows asks for permission)', () => storage.release('cli'));
+        if (!done.dismounted)
+            console.log(c.yellow('The image stays mounted (' + (done.note ?? '') + '). sandbox repair dismounts it.'));
+    }
+    console.log('Contained storage is on. sandbox launch mounts the image first.');
+    return 0;
+}
+async function turnOff(ctx) {
+    requireAvailable();
+    requireNoSandbox();
+    const storage = storageFor(ctx);
+    const configFile = ctx.loaded.configPath ?? userConfigPath();
+    console.log(c.yellow(BETA + 'Turning contained storage off moves the files back into plain folders.'));
+    if (!storage.imageExists()) {
+        writeContainedSetting(configFile, 'off');
+        console.log('There is no image, so there was nothing to move. Contained storage is off.');
+        return 0;
+    }
+    const mount = await working('Mounting the image (Windows asks for permission)', () => storage.acquire({ id: 'cli', pid: process.pid }));
+    let moved = false;
+    try {
+        const plan = planTransfer(mount, ctx.dataPath, ctx.dataPath);
+        if (plan.folders.length > 0) {
+            console.log('\nIn the image:');
+            printPlan(plan, ctx.dataPath);
+            assertTargetsFree(plan);
+            if (!ctx.options.yes &&
+                !(await askRequired('Move them back out of the image?', 'Add --yes to move without asking.', true)))
+                return fail('Nothing was moved.', 'Contained storage is still on.');
+            let line = 'Copying';
+            const result = await working(() => line, () => runTransfer(plan, mount, (p) => {
+                line = 'Copying: ' + p.files.toLocaleString('en-US') + ' files, ' + humanBytes(p.bytes);
+            }));
+            console.log('Moved ' + result.files.toLocaleString('en-US') + ' files back.');
+            for (const note of result.notes)
+                console.log(c.yellow(note));
+        }
+        writeContainedSetting(configFile, 'off');
+        moved = true;
+    }
+    finally {
+        const done = await working('Dismounting the image (Windows asks for permission)', () => storage.release('cli'));
+        if (!done.dismounted)
+            console.log(c.yellow('The image stays mounted (' + (done.note ?? '') + '). sandbox repair dismounts it.'));
+        else if (!moved)
+            console.log('The image was dismounted; contained storage is still on.');
+    }
+    console.log('Contained storage is off: tools, state and logs are plain folders in ' + ctx.dataPath + '.');
+    const bytes = fs.statSync(storage.paths.image).size;
+    if (!ctx.options.yes &&
+        (await askRequired('Delete the image file now (' + humanBytes(bytes) + ')? Everything in it was moved out.', 'Answer no to keep it.', false))) {
+        await storage.deleteImage();
+        console.log('Deleted ' + storage.paths.image + '.');
+    }
+    else
+        console.log('The image file is kept: ' + storage.paths.image + ' (delete it yourself when you are sure).');
+    return 0;
+}
+/** `sandbox storage contained [status|on|off]`. */
+export function contained(ctx) {
+    const [, mode = 'status'] = ctx.options.positionals;
+    switch (mode) {
+        case 'status':
+            return status(ctx);
+        case 'on':
+            return turnOn(ctx);
+        case 'off':
+            return turnOff(ctx);
+        default:
+            return Promise.resolve(fail('Unknown action "' + mode + '" for contained storage.', 'Use: sandbox storage contained on, off or status'));
+    }
+}

package/dist/cli/commands/storage/offer.js

@@ -5,7 +5,7 @@ import { userDir } from '../../../core/config/index.js';
 import { errMsg } from '../../../core/util/index.js';
 import { isSandboxRunning, insideSandbox } from '../../../host/sandbox/index.js';
 import { protectPrivateFolder } from '../../../host/sharing/index.js';
-import { describeDuration, describeSize, ensureStorageRoot, estimate, measureFolder, moveWarning, planOffer, StorageHistory, } from '../../../host/storage/index.js';
+import { describeDuration, describeSize, ensureStorageRoot, estimate, measureFolder, moveWarning, planOffer, staleMountNote, StorageHistory, } from '../../../host/storage/index.js';
 import { c, working } from '../../output/index.js';
 import { refreshStorage } from '../context.js';
 import { performMove } from './storage.js';
@@ -82,4 +82,10 @@ export async function storageBeforeCommand(ctx, command) {
         }
     }
     ensureStorageRoot(ctx.storageRoot, protectPrivateFolder);
+    // Contained storage (beta): a mount an earlier sandbox left behind is only mentioned here; repair fixes it.
+    if (command !== 'launch' && !ctx.options.json) {
+        const stale = staleMountNote(ctx.storageRoot, ctx.loaded.config.storage.dataName, isSandboxRunning());
+        if (stale)
+            console.error(c.yellow(stale));
+    }
 }

package/dist/cli/commands/storage/storage.js

@@ -6,14 +6,20 @@ import { userConfigPath, userDir } from '../../../core/config/index.js';
 import { diskUsage, humanBytes } from '../../../core/disk.js';
 import { askChoice, askName, askRequired } from '../../../core/prompt.js';
 import { expandPath, fail } from '../../../core/util/index.js';
-import { describeDuration, describeSize, estimate, holdsData, measureFolder, moveWarning, otherDataFolders, sharedDefaultRoot, StorageHistory, StorageMove, } from '../../../host/storage/index.js';
+import { describeDuration, describeSize, estimate, holdsData, measureFolder, mountedSets, moveWarning, otherDataFolders, sharedDefaultRoot, StorageHistory, StorageMove, } from '../../../host/storage/index.js';
 import { isSandboxRunning } from '../../../host/sandbox/index.js';
 import { protectPrivateFolder } from '../../../host/sharing/index.js';
 import { watcherRunning } from '../../../sync/index.js';
 import { printJson, working } from '../../output/index.js';
 import { requireOnPc } from '../context.js';
+import { contained } from './contained.js';
 /** Why a move cannot start (a background sync is still on a data folder in the old storage), or null. */
 export function storageBusy(root) {
+    const mounted = mountedSets(root);
+    if (mounted.length > 0)
+        return ('The contained storage of "' +
+            mounted.join('", "') +
+            '" is mounted (a disk image; moving now would reach into it).');
     const data = path.join(root, 'data');
     try {
         for (const name of fs.readdirSync(data))
@@ -165,7 +171,9 @@ export function storage(ctx) {
             return move(ctx);
         case 'use':
             return use(ctx);
+        case 'contained':
+            return contained(ctx);
         default:
-            return fail('Unknown storage action "' + action + '".', 'Use: sandbox storage, sandbox storage move <folder> or sandbox storage use <folder>');
+            return fail('Unknown storage action "' + action + '".', 'Use: sandbox storage, sandbox storage move <folder>, sandbox storage use <folder> or sandbox storage contained on|off|status');
     }
 }

package/dist/cli/commands/user-config.js

@@ -6,7 +6,7 @@ import { parse } from 'jsonc-parser';
 import _ from 'lodash';
 import { userConfigPath } from '../../core/config/index.js';
 import { fail } from '../../core/util/index.js';
-import { editConfigText } from '../menu/settings/index.js';
+import { editConfigText } from '../../app/features/settings/index.js';
 export function configFile(ctx) {
     return ctx.loaded.configPath ?? userConfigPath();
 }

package/dist/cli/commands/vpn.js

@@ -21,14 +21,26 @@ async function status(ctx) {
         return 0;
     table([
         ['VPN', report.enabled ? c.green('on') : 'off  (turn on: sandbox config set vpn.enabled true)'],
-        ['Provider', report.provider === 'nordvpn' ? 'NordVPN' : 'your own .ovpn file'],
+        [
+            'Provider',
+            report.provider === 'nordvpn'
+                ? 'NordVPN'
+                : report.provider === 'wireguard-file'
+                    ? 'your own WireGuard .conf'
+                    : 'your own .ovpn file',
+        ],
         ['Protocol', report.protocol],
         ['Country', report.country || 'best available'],
         ['Kill switch', report.killSwitch ? 'on (no internet if the tunnel fails)' : c.yellow('off')],
-        ['Login', LOGIN_TEXT[report.login] + (report.loginSavedAt ? c.dim('  ' + report.loginSavedAt.slice(0, 10)) : '')],
+        [
+            'Login',
+            report.provider === 'wireguard-file'
+                ? c.dim('not needed (the keys are in your config)')
+                : LOGIN_TEXT[report.login] + (report.loginSavedAt ? c.dim('  ' + report.loginSavedAt.slice(0, 10)) : ''),
+        ],
         ...(report.running ? [['Running now', report.running.text]] : []),
     ]);
-    if (report.login === 'none')
+    if (report.provider !== 'wireguard-file' && report.login === 'none')
         nextStep('sandbox vpn login');
     if (report.login === 'unreadable')
         console.log(c.dim('Only the Windows user that saved it can read it. Save it again: sandbox vpn login'));
@@ -39,6 +51,10 @@ async function status(ctx) {
 async function login(ctx) {
     requireOnPc('vpn login');
     const service = new VpnService(ctx);
+    if (service.provider === 'wireguard-file') {
+        console.log('A WireGuard config needs no login: the keys are in the file vpn.configFile points to.');
+        return 0;
+    }
     const nord = service.provider === 'nordvpn';
     console.log(nord
         ? 'NordVPN needs its service credentials, not your usual login. To get them:'

package/dist/cli/commands/web.js

@@ -6,6 +6,7 @@ import { fail, sleep } from '../../core/util/index.js';
 import { spawnDetached } from '../../host/sandbox/index.js';
 import { openBrowser, WebControl, WebRunner, WebStore } from '../../host/web/index.js';
 import { printJson } from '../output/index.js';
+import { createRpcHost } from '../../app/registry.js';
 import { WebService } from '../services/index.js';
 import { requireOnPc } from './context.js';
 const START_WAIT_MS = 15000;
@@ -89,6 +90,7 @@ export async function webServer(ctx) {
         storageRoot: ctx.storageRoot,
         port: ctx.loaded.config.web.port,
         backend: new WebService(ctx),
+        rpc: createRpcHost(ctx),
         staticRoot,
     }).run();
     process.exit(0);

package/dist/cli/index.js

@@ -15,6 +15,7 @@ import { withConfig, hoistConfig, withoutConfig } from './argv.js';
 import { report } from './report.js';
 import { versionText } from './version.js';
 import { HANDLERS } from './commands/index.js';
+import { operationHandler } from './operations/index.js';
 const entry = path.join(PACKAGE_ROOT, 'dist', 'bin', 'agent-sandbox.js');
 /** A first word that is no command and no agent, but close to one: "Did you mean: sandbox status?". */
 function failOnTypo(word, agents) {
@@ -103,7 +104,7 @@ export async function main(rawArgv, preset = {}) {
     // update works on the install, not on a sandbox: it needs no settings (and a broken file must not stop it).
     if (options.command === 'update')
         return commands.update(options);
-    const handler = HANDLERS[options.command];
+    const handler = operationHandler(options.command, options.positionals) ?? HANDLERS[options.command];
     if (!handler)
         return fail('Unknown command "' + options.command + '".', 'Run sandbox --help for the list of commands, or sandbox for the menu.');
     const ctx = commands.createContext(PACKAGE_ROOT, entry, options);