windows-development-sandbox 1.9.0 → 1.11.3

package/dist/selftest/menu-screens.js

@@ -4,9 +4,8 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { Draft } from '../cli/menu/settings/draft.js';
 import { ConfigFile } from '../app/features/settings/index.js';
-import { AppsModel } from '../cli/menu/apps.js';
 import { accountsOptions } from '../cli/menu/pages/accounts-page.js';
-import { appsOptions } from '../cli/menu/pages/apps-page.js';
+import { appsOptions, stageTicks } from '../cli/menu/pages/apps-page.js';
 import { maintenanceOptions } from '../cli/menu/pages/maintenance-page.js';
 import { sandboxOptions } from '../cli/menu/pages/sandbox-page.js';
 import { sessionsOptions } from '../cli/menu/pages/sessions-page.js';
@@ -23,7 +22,7 @@ export const SIZES = [
 ];
 const NOW = Date.now();
 const API_FOLDER = 'C:\\Projects\\api';
-/** The Data folder row of General (in the menu it comes from data-folder.ts). */
+/** The Data folder row of General (in the menu it comes from settings-page.ts). */
 const DATA_FOLDER_ROW = [
     {
         value: '@data-folder',
@@ -34,18 +33,25 @@ const DATA_FOLDER_ROW = [
     },
 ];
 const ACCOUNTS = {
+    agent: 'claude',
     agents: [
-        { name: 'claude', kept: true, canSavePc: true },
-        { name: 'codex', kept: true, canSavePc: true },
-        { name: 'opencode', kept: false, canSavePc: false },
+        {
+            name: 'claude',
+            kept: true,
+            canSavePc: true,
+            accounts: [
+                { name: 'work', email: 'me@work.example', isDefault: true, isActive: true, savedAt: '2026-10-13T09:30:00Z' },
+                { name: 'home', email: null, isDefault: false, isActive: false, savedAt: '2026-10-01T18:00:00Z' },
+            ],
+        },
+        {
+            name: 'codex',
+            kept: true,
+            canSavePc: true,
+            accounts: [{ name: 'main', email: null, isDefault: true, isActive: false, savedAt: '2026-10-12T08:00:00Z' }],
+        },
+        { name: 'opencode', kept: false, canSavePc: false, accounts: [] },
     ],
-    rows: {
-        claude: [
-            { name: 'work', email: 'me@work.example', isDefault: true, isActive: true, savedAt: '2026-10-13T09:30:00Z' },
-            { name: 'home', email: null, isDefault: false, isActive: false, savedAt: '2026-10-01T18:00:00Z' },
-        ],
-        codex: [{ name: 'main', email: null, isDefault: true, isActive: false, savedAt: '2026-10-12T08:00:00Z' }],
-    },
 };
 const SESSIONS = [
     {
@@ -164,54 +170,163 @@ export function renderScreens(dir) {
     };
     const maintenance = {
         data: {
+            dataPath: 'C:\\AgentData',
+            storageRoot: 'C:\\ProgramData\\AgentSandbox\\users\\me',
+            totalBytes: 8.9e9,
+            total: '8.9 GB',
+            storageShare: '<- sandbox storage (8.9 GB of it)',
+            areaTotals: { tools: '7.1 GB', state: '1.8 GB', host: '4.0 KB' },
             entries: [
-                { area: 'tools', name: 'rust', path: 'C:\\AgentData\\tools\\rust', bytes: 4.6e9 },
-                { area: 'tools', name: 'vscode', path: 'C:\\AgentData\\tools\\vscode', bytes: 2.5e9 },
-                { area: 'state', name: 'state/claude', path: 'C:\\AgentData\\state\\claude', bytes: 1.8e9 },
-                { area: 'host', name: 'accounts', path: 'C:\\Users\\me\\AppData\\Local\\AgentSandbox\\accounts', bytes: 4096 },
+                {
+                    area: 'tools',
+                    name: 'rust',
+                    path: 'C:\\AgentData\\tools\\rust',
+                    bytes: 4.6e9,
+                    size: '4.6 GB',
+                    target: 'tools/rust',
+                },
+                {
+                    area: 'tools',
+                    name: 'vscode',
+                    path: 'C:\\AgentData\\tools\\vscode',
+                    bytes: 2.5e9,
+                    size: '2.5 GB',
+                    target: 'tools/vscode',
+                },
+                {
+                    area: 'state',
+                    name: 'state/claude',
+                    path: 'C:\\AgentData\\state\\claude',
+                    bytes: 1.8e9,
+                    size: '1.8 GB',
+                    target: 'state/claude',
+                },
+                {
+                    area: 'host',
+                    name: 'accounts',
+                    path: 'C:\\Users\\me\\AppData\\Local\\AgentSandbox\\accounts',
+                    bytes: 4096,
+                    size: '4.0 KB',
+                    target: null,
+                },
+            ],
+            disks: [
+                {
+                    drive: 'C:\\',
+                    totalBytes: 40e9,
+                    freeBytes: 22e9,
+                    usedBytes: 18e9,
+                    holdsStorage: true,
+                    used: '18 GB',
+                    usedPercent: 45,
+                    free: '22 GB',
+                    total: '40 GB',
+                },
             ],
-            disks: [{ drive: 'C:\\', totalBytes: 40e9, freeBytes: 22e9, usedBytes: 18e9, holdsStorage: true }],
-            total: 8.9e9,
         },
-        logs: [
-            { name: 'guest-2026-10-14.log', path: 'x', bytes: 120000, modified: NOW - 60000 },
-            { name: 'daemon-2026-10-14.log', path: 'y', bytes: 8000, modified: NOW - 600000 },
-        ],
-        doctor: [
-            ['Windows Sandbox', 'available'],
-            ['Config file', 'C:\\Users\\me\\.agent-sandbox\\config.json'],
-        ],
-        repair: [
-            { name: 'Config file', status: 'ok', detail: 'valid' },
-            { name: 'Stale run folders', status: 'fixed', detail: 'removed 2' },
-            { name: 'Toolchain cache', status: 'needs-you', detail: 'close the sandbox first' },
-        ],
-        settings: { pending: ['2026-10-unpin-config-defaults: stop pinning old defaults in your config.json'] },
-        dataFolder: {
-            label: 'Data folder',
-            hint: 'C:\\ProgramData\\AgentSandbox\\users\\me',
-            description: 'Where the sandbox keeps its tools, databases and agent state. Enter changes it.',
+        logs: {
+            folder: 'C:\\AgentData\\logs',
+            files: [
+                {
+                    name: 'guest-2026-10-14.log',
+                    path: 'C:\\AgentData\\logs\\guest-2026-10-14.log',
+                    bytes: 120000,
+                    modified: NOW - 60000,
+                },
+                {
+                    name: 'daemon-2026-10-14.log',
+                    path: 'C:\\AgentData\\logs\\daemon-2026-10-14.log',
+                    bytes: 8000,
+                    modified: NOW - 600000,
+                },
+            ],
+            crash: true,
+        },
+        health: {
+            last: {
+                at: new Date(NOW - 180000).toISOString(),
+                mode: 'check',
+                checks: [
+                    { id: 'config', group: 'Settings', name: 'Config file', status: 'ok', detail: 'valid', fixable: false },
+                    {
+                        id: 'stale',
+                        group: 'Data folder',
+                        name: 'Stale run folders',
+                        status: 'fixed',
+                        detail: 'removed 2',
+                        fixable: false,
+                    },
+                    {
+                        id: 'cache',
+                        group: 'Sandbox',
+                        name: 'Toolchain cache',
+                        status: 'needs-you',
+                        detail: 'close the sandbox first',
+                        fixable: false,
+                    },
+                ],
+                summary: { total: 3, ok: 1, fixed: 1, warn: 0, needsYou: 1, skipped: 0, fixable: 0 },
+                details: [
+                    ['Windows Sandbox', 'available'],
+                    ['Config file', 'C:\\Users\\me\\.agent-sandbox\\config.json'],
+                ],
+                setup: {
+                    checks: [
+                        { name: 'Windows edition', status: 'ok', detail: 'Pro' },
+                        { name: 'Windows Sandbox feature', status: 'action', detail: 'turned off' },
+                    ],
+                    canEnable: true,
+                    error: null,
+                },
+                log: null,
+            },
+        },
+        storage: {
+            show: {
+                root: 'C:\\ProgramData\\AgentSandbox\\users\\me',
+                exists: true,
+                holdsData: true,
+                measured: null,
+                size: 'not measured yet',
+                defaultRoot: 'C:\\ProgramData\\AgentSandbox\\users\\me',
+                defaultInUse: true,
+                otherFoldersWithData: [],
+            },
+            contained: {
+                setting: 'off',
+                maxGb: 60,
+                available: true,
+                reasons: [],
+                fixes: [],
+                image: 'C:\\ProgramData\\AgentSandbox\\users\\me\\contained\\agent.vhdx',
+                imageExists: false,
+                imageBytes: null,
+                mountFolder: 'C:\\ProgramData\\AgentSandbox\\users\\me\\mount',
+                recordedMounted: false,
+                holders: 0,
+                mountedNow: null,
+            },
         },
         updates: {
-            managed: true,
-            version: '1.4.3',
-            scope: 'user',
-            autoUpdate: true,
-            autoOffText: null,
-            state: {
+            status: {
+                managed: true,
+                version: '1.4.3',
+                scope: 'user',
+                autoUpdate: true,
+                autoOffText: null,
                 previous: '1.4.2',
-                failed: { version: '1.4.4', at: '2026-10-13T03:00:00Z', reason: 'it did not start' },
+                failed: { version: '1.4.4', reason: 'it did not start' },
+                npmCommand: 'npm install -g windows-development-sandbox',
+                error: null,
+                settings: {
+                    pending: ['2026-10-unpin-config-defaults: stop pinning old defaults in your config.json'],
+                    error: null,
+                },
             },
+            latest: '1.5.0',
         },
-        latest: '1.5.0',
-        setup: {
-            facts: {},
-            canEnable: true,
-            checks: [
-                { name: 'Windows edition', status: 'ok', detail: 'Pro' },
-                { name: 'Windows Sandbox feature', status: 'action', detail: 'turned off' },
-            ],
-        },
+        engine: null,
+        web: { running: true, port: 47800, address: 'http://127.0.0.1:47800/' },
         more: [
             { name: 'sync', summary: 'sync history now' },
             { name: 'audit', summary: 'show what the sandbox did' },
@@ -225,9 +340,9 @@ export function renderScreens(dir) {
         draft.stage(user, harness.key, 'codex');
     if (flag)
         draft.stage(user, flag.key, !user.userConfig()[flag.key[0]]);
-    const apps = new AppsModel(user, path.join(dir, 'data'));
+    const appsData = path.join(dir, 'data');
     const appsDraft = new Draft();
-    apps.stageTicks(appsDraft, ['git-gui']);
+    stageTicks(user, appsDraft, ['git-gui']);
     const out = [];
     for (const size of SIZES) {
         const agentsModel = {
@@ -249,7 +364,7 @@ export function renderScreens(dir) {
             out.push(block('3 Sandbox (stopped) · ' + category, draw(2, { ...sandboxOptions(stopped), startCategory: category }, size), size));
         for (const category of ['status', 'projects', 'databases'])
             out.push(block('3 Sandbox · ' + category, draw(2, { ...sandboxOptions(sandbox), startCategory: category }, size, status), size));
-        out.push(block('4 Apps (1 unsaved)', draw(3, appsOptions(apps, user, appsDraft, 'user'), size, status, appsDraft.count()), size));
+        out.push(block('4 Apps (1 unsaved)', draw(3, appsOptions(user, appsData, appsDraft, 'user'), size, status, appsDraft.count()), size));
         for (const category of CATEGORIES)
             out.push(block('5 Settings · ' + category.label + ' (2 unsaved)', draw(4, { ...settingsOptions(files, 'user', draft, DATA_FOLDER_ROW), startCategory: category.id }, size, status, draft.count()), size));
         // The leave dialog over the settings screen.

package/dist/selftest/menu.test.js

@@ -5,19 +5,21 @@ import fs from 'node:fs';
 import { CATEGORIES, ConfigFile, SETTINGS_ELSEWHERE } from '../app/features/settings/index.js';
 import { Draft } from '../cli/menu/settings/draft.js';
 import { z } from 'zod';
-import { AddAgent, agentNameProblem, commandFromPackage, makeDefaultAgent, newAgent, removeAgent, } from '../cli/menu/add-agent.js';
-import { APP_GROUPS, AppsModel, REQUEST_APP, requestAppUrl } from '../cli/menu/apps.js';
+import { addedAgents, agentNameProblem, commandFromPackage, newAgent } from '../app/features/agents/index.js';
+import { APP_GROUPS, appRows, REQUEST_APP, requestAppUrl } from '../app/features/apps/index.js';
+import { appsCategories, appsItems } from '../cli/menu/pages/apps-page.js';
 import { readMenuView, saveMenuView } from '../cli/menu/memory.js';
 import path from 'node:path';
 import { argPathKind, optionLabel, optionPathKind, plainDescription } from '../cli/menu/command-fields.js';
 import { CommandForm } from '../cli/menu/command-form.js';
 import { COMMANDS, commandSpec } from '../cli/manifest.js';
 import { accountsOptions } from '../cli/menu/pages/accounts-page.js';
-import { addedAgents, agentActions, agentCategories, agentsOptions, hostAgentsToShow, startArgv, } from '../cli/menu/pages/agents-page.js';
+import { agentCategories, agentsHaveStagedChanges, agentsOptions, hostAgentsToShow, startArgv, } from '../cli/menu/pages/agents-page.js';
 import { ListPage } from '../cli/menu/pages/list-page.js';
 import { sandboxOptions } from '../cli/menu/pages/sandbox-page.js';
 import { sessionsOptions } from '../cli/menu/pages/sessions-page.js';
-import { pathKindOf, SchemaNode } from '../app/kernel/index.js';
+import { fakeIO, pathKindOf, SchemaNode } from '../app/kernel/index.js';
+import { runDefinition } from '../app/registry.js';
 import { numberProblem, ValueEditor } from '../cli/menu/settings/value-editor.js';
 import { APP_CATEGORIES } from '../shared/apps/index.js';
 import { settingsOf, settingsOptions } from '../cli/menu/pages/settings-page.js';
@@ -266,15 +268,11 @@ export const menuSuite = {
         ], 'a new agent name is checked (letters, no duplicates); the command is guessed from the package');
         const agentFile = ConfigFile.user(t.at('agents', 'config.json'));
         t.write(agentFile.file, '{\n  // mine\n  "defaultHarness": "claude"\n}\n');
-        const typed = (...answers) => ({
-            choose: () => Promise.resolve(answers.shift() === 'host' ? 'host' : 'npm'),
-            text: () => Promise.resolve(answers.shift()),
-            pickPath: () => Promise.resolve(answers.shift()),
-        });
-        const added = await new AddAgent(typed('npm', 'my-agent', '@me/my-agent@latest', 'my-agent'), agentFile, new Draft(), ['claude', 'codex']).run();
+        const agentCtx = { loaded: { configPath: agentFile.file } };
+        const added = (await runDefinition('agents.add', agentCtx, {}, fakeIO(['npm', 'my-agent', '@me/my-agent@latest', 'my-agent']).io));
         const saved = agentFile.userConfig().harnesses['my-agent'];
-        t.check(added?.name === 'my-agent' &&
-            added.saved &&
+        t.check(added.name === 'my-agent' &&
+            added.message === 'Added my-agent.' &&
             saved?.npmPackage === '@me/my-agent@latest' &&
             saved.npmBin === 'my-agent' &&
             agentFile.text().includes('// mine') &&
@@ -284,9 +282,7 @@ export const menuSuite = {
             ...agentFile.valueInFile(['harnesses']),
             other: newAgent('uv', 'tool', 'tool'),
         });
-        const joined = await new AddAgent(typed('host', 'third', 'third.exe'), agentFile, stagedAgents, ['claude']).run();
-        t.check(joined?.saved === false &&
-            Object.keys(stagedAgents.value(agentFile, ['harnesses'])).join() === 'my-agent,other,third', 'with unsaved changes to the agents, the new agent joins them instead of being written');
+        t.check(agentsHaveStagedChanges(agentFile, stagedAgents) && !agentsHaveStagedChanges(agentFile, new Draft()), 'with unsaved changes to the agents, the menu asks to save them first (the agent operations wait)');
         t.section('list keys follow the highlighted entry');
         const keyList = new ListScreen({
             path: [],
@@ -344,6 +340,30 @@ export const menuSuite = {
             .body.map((l) => Text.strip(l))
             .find((l) => l.includes('›'));
         t.check(marked?.includes('Beta') === true, 'a section opens with the cursor on the entry it asks for');
+        class Broken extends ListPage {
+            label = 'Broken';
+            load() {
+                return Promise.resolve();
+            }
+            options() {
+                return { path: [], items: [{ value: 'a', label: 'Alpha' }] };
+            }
+            act() {
+                return Promise.reject(new Error('the action broke'));
+            }
+        }
+        const broken = new Broken(new App());
+        await broken.open();
+        let survived = true;
+        try {
+            await broken.handle(press('return'));
+        }
+        catch {
+            survived = false;
+        }
+        const brokenFrame = broken.render({ width: 100, height: 12 });
+        const brokenScreen = Text.strip([...brokenFrame.body, brokenFrame.notice ?? ''].join('\n'));
+        t.check(survived && brokenScreen.includes('the action broke'), 'an action that fails shows its problem in the menu instead of closing it', brokenScreen);
         t.section('proper inputs');
         const user2 = ConfigFile.user(t.at('inputs', 'config.json'));
         const leaf = (...key) => {
@@ -549,9 +569,10 @@ export const menuSuite = {
             hostAgents: [],
             removable: addedAgents(['claude', 'codex', 'mine']),
         };
-        const startActions = agentActions(actionModel);
-        const keyFor = (key, id) => startActions.find((a) => a.key === key)?.applies?.(id) ?? false;
         const actionList = agentsOptions(actionModel, 'C:\\code\\api');
+        const keyFor = (key, id) => (typeof actionList.actions === 'function' ? actionList.actions('start') : [])
+            .find((a) => a.key === key)
+            ?.applies?.(id) ?? false;
         t.check(JSON.stringify(actionModel.removable) === '["mine"]' &&
             keyFor('d', 'agent:codex') &&
             !keyFor('d', 'agent:claude') &&
@@ -563,20 +584,15 @@ export const menuSuite = {
             actionList.actions('options').length === 0, 'Make default shows on any other agent, Remove only on one you added; neither on built-in agents or other rows');
         const agentsFile = ConfigFile.user(t.at('agents-actions', 'config.json'));
         t.write(agentsFile.file, '{\n  // mine\n  "defaultHarness": "claude"\n}\n');
-        const agentDraft = new Draft();
-        await new AddAgent({
-            choose: () => Promise.resolve('npm'),
-            text: (() => {
-                const answers = ['mine', '@me/mine@latest', 'mine'];
-                return () => Promise.resolve(answers.shift());
-            })(),
-        }, agentsFile, agentDraft, ['claude']).run();
-        makeDefaultAgent(agentsFile, agentDraft, 'mine');
+        const agentsCtx = { loaded: { configPath: agentsFile.file } };
+        const quiet = (answers = []) => fakeIO(answers).io;
+        await runDefinition('agents.add', agentsCtx, {}, quiet(['npm', 'mine', '@me/mine@latest', 'mine']));
+        await runDefinition('agents.makeDefault', agentsCtx, { name: 'mine' }, quiet());
         const becameDefault = agentsFile.userConfig().defaultHarness;
-        await t.throws(() => removeAgent(agentsFile, agentDraft, 'mine'), 'default agent', 'the default agent is not removed');
-        makeDefaultAgent(agentsFile, agentDraft, 'codex');
-        removeAgent(agentsFile, agentDraft, 'mine');
-        await t.throws(() => removeAgent(agentsFile, agentDraft, 'claude'), 'built in', 'a built-in agent is not removed');
+        await t.throws(() => runDefinition('agents.remove', agentsCtx, { name: 'mine' }, quiet([true])), 'default agent', 'the default agent is not removed');
+        await runDefinition('agents.makeDefault', agentsCtx, { name: 'codex' }, quiet());
+        await runDefinition('agents.remove', agentsCtx, { name: 'mine' }, quiet([true]));
+        await t.throws(() => runDefinition('agents.remove', agentsCtx, { name: 'claude' }, quiet([true])), 'built in', 'a built-in agent is not removed');
         t.check(becameDefault === 'mine' &&
             agentsFile.userConfig().defaultHarness === 'codex' &&
             !agentsFile.text().includes('mine"') &&
@@ -600,18 +616,19 @@ export const menuSuite = {
             stoppedItems.some((i) => i.value === 'act:start' && i.category === 'databases') &&
             stoppedItems.some((i) => i.value === '@add-root') &&
             !stoppedItems.some((i) => i.value === 'act:stop'), 'with no sandbox running, Sandbox offers to start one (Status and Databases) instead of dead rows');
-        const noLogins = accountsOptions({ agents: [{ name: 'claude', kept: true, canSavePc: true }], rows: {} });
+        const noLogins = accountsOptions({
+            agent: 'claude',
+            agents: [{ name: 'claude', kept: true, canSavePc: true, accounts: [] }],
+        });
         t.equal(noLogins.items.map((i) => i.value), ['@save-sandbox', '@save-pc'], 'with no saved login, Accounts offers to save the sandbox login or this PC login (Enter)');
         t.section('apps in a few groups');
-        const appsUser = new AppsModel(user2, t.dir('apps-groups'));
-        const groupIds = appsUser.categories().map((c) => c.id);
-        const appItems = appsUser.items(new Draft()).filter((i) => i.value !== REQUEST_APP);
+        const groupIds = appsCategories(user2).map((c) => c.id);
+        const appItems = appsItems(user2, t.dir('apps-groups'), new Draft()).filter((i) => i.value !== REQUEST_APP);
         t.check(groupIds.length <= 6 &&
-            new AppsModel(ConfigFile.project(t.dir('apps-groups', 'project')), t.dir('apps-groups')).categories().length <=
-                5 &&
+            appsCategories(ConfigFile.project(t.dir('apps-groups', 'project'))).length <= 5 &&
             APP_GROUPS.every((g) => appItems.some((i) => i.category === g.id)) &&
             appItems.every((i) => groupIds.includes(i.category ?? '')) &&
-            appItems.length === appsUser.entries().length &&
+            appItems.length === appRows(user2, t.dir('apps-groups')).length &&
             APP_CATEGORIES.every((c) => APP_GROUPS.some((g) => g.members.includes(c.id))), 'the apps are in at most 6 groups; every catalogue category belongs to one and every app is listed', groupIds.join());
         t.section('dialog box');
         const box = dialogBox({ title: 'Unsaved changes', lines: ['You have 2 unsaved changes.'], buttons: 'Save' }, 61);

package/dist/selftest/migrate.test.js

@@ -6,7 +6,8 @@ import { parse } from 'jsonc-parser';
 import { DEFAULTS, loadConfig, machineConfigPath } from '../core/config/index.js';
 import { MIGRATIONS, MigrationBackup, MigrationMarker, MigrationRunner, } from '../host/migrate/index.js';
 import { DEFAULTS_SNAPSHOTS } from '../host/migrate/snapshots.js';
-import { runMigrate } from '../cli/commands/index.js';
+import { migrateWith } from '../app/features/updates/updates.run.js';
+import { fakeIO } from '../app/kernel/index.js';
 import { autoMigrates, continuesAfterFailedMigration, MigrateService } from '../cli/services/index.js';
 const readText = (file) => fs.readFileSync(file, 'utf8');
 export const migrateSuite = {
@@ -163,26 +164,27 @@ export const migrateSuite = {
         const cmdConfig = t.write(t.at('cmd-user', 'config.json'), JSON.stringify({ ...JSON.parse(JSON.stringify(old.defaults)), sandbox: { memoryMb: 4096 } }, null, 2));
         const service = new MigrateService({ storageRoot: t.dir('cmd-storage'), userDir: cmdUser, configPath: cmdConfig }, '9.9.9', MIGRATIONS, () => false);
         const noticed = service.versionChanged();
-        const lines = [];
-        const say = (line) => void lines.push(line);
-        await runMigrate(service, { dryRun: true }, say);
-        const dry = lines.join('\n');
+        // sandbox migrate's work through the feature: the logged lines, then the line it returns.
+        const runM = async (input) => {
+            const { io, seen } = fakeIO(input.answers ?? []);
+            const restore = input.restore ? { restore: input.restore } : {};
+            const out = await migrateWith(service, { dryRun: input.dryRun, ...restore }, io);
+            return [...seen.logs.map((l) => l.text), out.line].join('\n');
+        };
+        const dry = await runM({ dryRun: true });
         const untouched = readText(cmdConfig).includes('"toolchains"');
-        lines.length = 0;
-        await runMigrate(service, { dryRun: false }, say);
-        const ran = lines.join('\n');
-        lines.length = 0;
-        await runMigrate(service, { dryRun: true }, say);
+        const ran = await runM({ dryRun: false });
+        const again = await runM({ dryRun: true });
         t.check(noticed &&
             dry.includes('2026-10-unpin-config-defaults') &&
             untouched &&
             ran.includes('Updated: 2026-10-unpin-config-defaults.') &&
             !service.versionChanged() &&
-            lines.join() === 'Nothing to update.', 'a dry run lists the pending change and changes nothing; a run applies it and moves the record on');
+            again === 'Nothing to update.', 'a dry run lists the pending change and changes nothing; a run applies it and moves the record on');
         const backups = t.at('cmd-storage', 'backups');
         const made = fs.readdirSync(backups);
         fs.writeFileSync(cmdConfig, 'broken by hand');
-        await runMigrate(service, { dryRun: false, restore: path.join(backups, made[0]), yes: true }, say);
+        await runM({ dryRun: false, restore: path.join(backups, made[0]), answers: [true] });
         t.check(made.length === 1 && readText(cmdConfig).includes('"toolchains"'), 'the run kept one backup and --restore puts the saved files back');
         t.check(!autoMigrates('self-test', false) &&
             !autoMigrates('migrate', false) &&

package/dist/selftest/network.test.js

@@ -1,5 +1,5 @@
 import { isSandboxAddress } from '../host/channel/index.js';
-import { buildFirewallCommands, cidrToRange, ipv4DnsServers, parseDefaultGateways, parseDnsServers, subtractIps, } from '../shared/network/index.js';
+import { attachRuleCommands, hasShortName, buildFirewallCommands, cidrToRange, ipv4DnsServers, parseDefaultGateways, parseDnsServers, subtractIps, } from '../shared/network/index.js';
 import { expandAllowList, hostAllowed, withBlockedHosts } from '../shared/network/index.js';
 export const networkSuite = {
     name: 'network',
@@ -11,6 +11,25 @@ export const networkSuite = {
         const remaining = subtractIps([[start172, end172]], ['172.28.0.1']);
         t.check(remaining.every(([start, end]) => gateway < start || gateway > end), 'the private block minus the gateway no longer contains the gateway');
         t.excludes(buildFirewallCommands(['8.8.8.8']).join(), '8.8.8.8', 'public addresses are not part of the private-range rules');
+        t.section('the attach rule');
+        const exe = 'C:\\Users\\Me\\AppData\\Local\\Temp\\agent-sandbox\\ptyhost-abc.exe';
+        const attach = attachRuleCommands(exe);
+        t.equal(attach[0], ['advfirewall', 'firewall', 'delete', 'rule', 'name=AgentSandbox-Attach'], 'attach: the old rule is deleted first');
+        t.equal(attach[1].slice(2), [
+            'add',
+            'rule',
+            'name=AgentSandbox-Attach',
+            'dir=in',
+            'action=allow',
+            'enable=yes',
+            'profile=any',
+            'protocol=tcp',
+            'remoteip=LocalSubnet',
+            'program=' + exe,
+        ], 'attach: inbound TCP to ptyhost only, from the local subnet only');
+        t.check(hasShortName('C:\\Users\\WDAGUT~1\\AppData\\Local\\Temp\\agent-sandbox\\ptyhost.exe'), 'an 8.3 short path is recognised (netsh cannot resolve it: "The application name could not be resolved")');
+        t.check(!hasShortName('C:\\Users\\WDAGUtilityAccount\\AppData\\Local\\Temp\\ptyhost.exe'), 'a long path is left alone');
+        t.check(!hasShortName('C:\\Users\\a~b\\x.exe'), 'a tilde not followed by a digit is not a short name');
         t.section('reading Windows output');
         t.equal(parseDefaultGateways('  0.0.0.0          0.0.0.0     172.28.80.1   172.28.85.200     5\n'), ['172.28.80.1'], 'the default gateway is read from the route table');
         t.equal(parseDnsServers('   DNS Servers . . . : 172.28.80.1\n                       8.8.8.8\n   NetBIOS : x\n'), ['172.28.80.1', '8.8.8.8'], 'DNS servers are read from ipconfig output');

package/dist/selftest/powershell-variables.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const powershellVariablesSuite: Suite;

package/dist/selftest/powershell-variables.test.js

@@ -0,0 +1,61 @@
+// PowerShell variable hygiene: scripts/check-variables.ps1 reads every .ps1 of the repository with the PowerShell 5.1
+// parser and reports automatic variables used as ordinary ones, names that differ from a parameter only in case,
+// preference variables leaking out of functions, names a dot-sourced file shares with its caller, and reads before an
+// assignment. It must find nothing in the repository, and it must still find each kind in a deliberately bad file.
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { isWin } from '../core/util/index.js';
+import { SYSTEM } from '../shared/system.js';
+const SKIP_FOLDERS = new Set(['node_modules', 'dist', '.git', '.claude']);
+function powershellFiles(folder, found = []) {
+    for (const entry of fs.readdirSync(folder, { withFileTypes: true })) {
+        const full = path.join(folder, entry.name);
+        if (entry.isDirectory()) {
+            if (!SKIP_FOLDERS.has(entry.name))
+                powershellFiles(full, found);
+        }
+        else if (entry.name.endsWith('.ps1'))
+            found.push(full);
+    }
+    return found;
+}
+function check(checker, files) {
+    const run = spawnSync(SYSTEM.powershell(), ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', checker, ...files], { encoding: 'utf8', windowsHide: true, timeout: 180000 });
+    return { status: run.status, report: run.stderr.trim() };
+}
+const BAD_SCRIPT = [
+    'param([switch]$AutoUpdate)',
+    '$autoUpdate = 1',
+    '$matches = 3',
+    'foreach ($input in 1, 2) { }',
+    'function F { $global:ErrorActionPreference = "Stop"; $env:SOME_VARIABLE = 1; $x = $notSetAnywhere }',
+    '',
+].join('\r\n');
+export const powershellVariablesSuite = {
+    name: 'ps-variables',
+    title: 'PowerShell scripts: no automatic-variable, case or scope collisions',
+    run: (t) => {
+        const checker = path.join(t.packageRoot, 'scripts', 'check-variables.ps1');
+        if (!isWin || !fs.existsSync(checker)) {
+            t.skip('needs Windows PowerShell and scripts/check-variables.ps1');
+            return;
+        }
+        t.section('the checker finds each kind of collision');
+        const bad = t.at('bad-variables.ps1');
+        fs.writeFileSync(bad, BAD_SCRIPT);
+        const caught = check(checker, [bad]);
+        t.equal(caught.status, 1, 'a bad script fails the check');
+        for (const kind of ['automatic', 'case', 'preference', 'env', 'unassigned', 'script-scope']) {
+            t.check(caught.report.includes(': ' + kind + ':'), 'it reports "' + kind + '"');
+        }
+        t.section('the repository scripts are clean');
+        const files = ['native', 'sandbox', 'scripts']
+            .map((folder) => path.join(t.packageRoot, folder))
+            .filter((folder) => fs.existsSync(folder))
+            .flatMap((folder) => powershellFiles(folder));
+        t.check(files.length > 0, 'it found the scripts (' + files.length + ')');
+        const clean = check(checker, files);
+        t.equal(clean.status, 0, 'no collisions' + (clean.report ? ':\n' + clean.report : ''));
+    },
+};

package/dist/selftest/support/engine-golden.js

@@ -59,6 +59,7 @@ export const LAUNCH_FILES_GOLDEN = [
     'sandbox/scripts/install-shell-path.ps1',
     'sandbox/scripts/link-profile-dirs.ps1',
     'sandbox/scripts/new-shortcuts.ps1',
+    'sandbox/scripts/repair-wmi-services.ps1',
     'sandbox/scripts/set-desktop.ps1',
     'sandbox/scripts/set-dns-servers.ps1',
     'sandbox/scripts/set-machine-environment.ps1',

package/dist/selftest/support/fixtures.d.ts

@@ -103,6 +103,9 @@ export declare function createFixtures(t: Harness): {
             configFile: string;
             killSwitch: boolean;
         };
+        github: {
+            shareToken: boolean;
+        };
         provisioning: {
             copyFromHost: boolean;
             fallbackToInstall: boolean;
@@ -253,10 +256,12 @@ export declare function createFixtures(t: Harness): {
             reuseSession: boolean;
             auto: boolean;
             autoHide: boolean;
+            confirmCtrlC: boolean;
         };
         web: {
             enabled: boolean;
             port: number;
+            openOnLaunch: boolean;
         };
         agentCommands: {
             enabled: boolean;

package/dist/selftest/support/web-preview.d.ts

@@ -0,0 +1 @@
+export {};