@openclaw/mxc-sandbox 2026.9.4 → 2026.9.5

package/node_modules/@microsoft/mxc-sdk/dist/types.d.ts

@@ -129,10 +129,24 @@ export interface ProcessContainerConfig {
     name?: string;
     /** Use least privilege mode with PROCESS_CREATION_ALL_APPLICATION_PACKAGES_OPT_OUT (default: false) */
     leastPrivilege?: boolean;
-    /** Additional AppContainer capabilities (e.g., "registryRead", "internetClient") */
+    /**
+     * Enable deny-and-record learning mode. Failed access checks are logged while
+     * accesses remain denied and containment remains enforced.
+     */
+    learningMode?: boolean;
+    /**
+     * Additional AppContainer capabilities (e.g., "registryRead", "internetClient").
+     * Each entry must contain one capability name and must not contain a comma.
+     * The reserved learning-mode capability names must not be supplied directly.
+     */
     capabilities?: string[];
     /** BaseProcess-specific UI settings (Windows only) */
     ui?: BaseProcessUiConfig;
+    /** ProcessContainer-specific networking settings. */
+    network?: {
+        /** Package family name or AppContainer profile authorized as the loopback proxy peer. */
+        allowedProxyPeer?: string;
+    };
 }
 /**
  * Filesystem access configuration
@@ -171,7 +185,25 @@ export interface NetworkConfig {
     allowedHosts?: string[];
     /** Hostnames or IP addresses to block (firewall mode only) */
     blockedHosts?: string[];
-    /** Proxy configuration (supported on Windows ProcessContainer and Linux Bubblewrap) */
+    /** Proxy configuration (supported on Windows ProcessContainer, Linux Bubblewrap,
+     *  macOS Seatbelt, and WSLC). On Bubblewrap/Seatbelt/WSLC it is a cooperative
+     *  env-var proxy (HTTP_PROXY/HTTPS_PROXY): well-behaved HTTP clients honor it,
+     *  raw-socket clients can bypass it. `builtinTestServer` activates a bundled,
+     *  testing-only proxy; the SDK rejects it unless `allowTestingFeatures: true` is
+     *  set in SandboxSpawnOptions (which maps to the native `--allow-testing-features`
+     *  flag).
+     *
+     *  WSLC imposes additional parse-time constraints (a violating config is
+     *  rejected before it runs):
+     *   - Only the `{ url }` form is accepted — its containers run in their own
+     *     network namespace, so the `localhost` / `builtinTestServer` loopback
+     *     forms are unreachable and rejected.
+     *   - The `url` scheme must be `http` or `https`.
+     *   - `defaultPolicy` must be `"allow"` and both `allowedHosts` and
+     *     `blockedHosts` must be empty/unset — WSLC has no in-kernel iptables, so
+     *     it cannot enforce host lists, and the container needs outbound
+     *     networking to reach the proxy at all.
+     *  Enforcement is cooperative (no in-kernel iptables). */
     proxy?: {
         builtinTestServer: true;
     } | {
@@ -181,6 +213,58 @@ export interface NetworkConfig {
     };
     /** Automatically remove firewall rules after execution (default: true). Deprecated: use lifecycle.preservePolicy. */
     removeRulesOnExit?: boolean;
+    /** Outbound network policy. */
+    egress?: NetworkEgressConfig;
+    /** Inbound and host-loopback network policy. */
+    ingress?: NetworkIngressConfig;
+}
+/** Allow or deny network action. */
+export type NetworkAction = 'allow' | 'deny';
+/** Transport protocol selector. */
+export type NetworkProtocol = 'tcp' | 'udp' | 'icmp' | 'any';
+/** CIDR network peer. */
+export interface NetworkPeerConfig {
+    /** IPv4 or IPv6 CIDR. */
+    cidr: string;
+    /** CIDRs excluded from this peer. */
+    except?: string[];
+}
+/** Protocol and destination-port selector. */
+export interface NetworkPortConfig {
+    /** Transport protocol. Defaults to "any". */
+    protocol?: NetworkProtocol;
+    /** Destination port. Omission matches every port. */
+    port?: number;
+    /** Inclusive end of a destination-port range. Requires `port`. */
+    endPort?: number;
+}
+/** Outbound network rule. */
+export interface NetworkRuleConfig {
+    /** Destination CIDRs. Omission matches both IP families; an explicit array must be non-empty. */
+    to?: NetworkPeerConfig[];
+    /** Destination protocols and ports. Omission matches all; an explicit array must be non-empty. */
+    ports?: NetworkPortConfig[];
+}
+/** Outbound network policy. */
+export interface NetworkEgressConfig {
+    /** Action used when no explicit rule matches. Defaults to "deny". */
+    default?: NetworkAction;
+    /** Explicit allow rules. */
+    allow?: NetworkRuleConfig[];
+    /** Explicit deny rules. Deny rules take precedence. */
+    deny?: NetworkRuleConfig[];
+}
+/** Inbound and host-loopback network policy. */
+export interface NetworkIngressConfig {
+    /** Default action for LAN/private-network inbound traffic. */
+    default?: NetworkAction;
+    /** Bidirectional host-loopback connectivity action. */
+    hostLoopback?: NetworkAction;
+}
+/** Runtime values supplied separately from sandbox policy. */
+export interface RuntimeConfig {
+    /** HTTP/S loopback proxy URL. */
+    networkProxy?: string;
 }
 /**
  * WSLC SDK configuration for Linux containers from Windows
@@ -200,19 +284,42 @@ export interface WslcConfig {
     gpu?: boolean;
     /** Path to a local tar file to import as the container image */
     imageTarPath?: string;
-    /** Host↔container port mappings (TCP only) */
+    /**
+     * Host↔container port mappings.
+     *
+     * Only TCP is currently supported by the WSLC SDK runtime. UDP is declared
+     * in the SDK header but the shipped runtime returns `E_NOTIMPL` when UDP is
+     * actually requested, so the parser hard-rejects `"udp"` with a clear
+     * message at spawn time. The `protocol` field defaults to `"tcp"` when
+     * omitted.
+     */
     portMappings?: PortMapping[];
 }
 /**
- * Port mapping for host↔container port forwarding
+ * Port mapping for host↔container port forwarding.
  */
 export interface PortMapping {
     /** Port on the Windows host */
     windowsPort: number;
     /** Port inside the Linux container */
     containerPort: number;
-    /** Protocol: "tcp" or "udp" (default: "tcp") */
-    protocol?: string;
+    /**
+     * Transport protocol. Only `"tcp"` is currently supported; `"udp"` is
+     * rejected by the parser because the WSLC SDK runtime returns `E_NOTIMPL`
+     * for UDP even though the header declares it. Defaults to `"tcp"` when
+     * omitted.
+     */
+    protocol?: 'tcp';
+}
+/**
+ * Telemetry configuration for experimental TraceLogging ETW support.
+ */
+export interface TelemetryConfig {
+    /**
+     * Explicit telemetry override. `true` = force on, `false` = force off,
+     * `undefined` = off (default).
+     */
+    enabled?: boolean;
 }
 /**
  * Main WXC configuration
@@ -246,10 +353,14 @@ export interface ContainerConfig {
     filesystem?: FilesystemConfig;
     /** Network access configuration */
     network?: NetworkConfig;
+    /** Runtime values supplied separately from sandbox policy. */
+    runtimeConfig?: RuntimeConfig;
     /** Experimental features (only applied when --experimental flag is set) */
     experimental?: {
         /** WSLC SDK configuration for Linux containers from Windows */
         wslc?: WslcConfig;
+        /** Telemetry configuration for experimental TraceLogging ETW support */
+        telemetry?: TelemetryConfig;
     };
     /** macOS Seatbelt sandbox configuration (macOS only) */
     seatbelt?: SeatbeltConfig;
@@ -279,17 +390,25 @@ export type SandboxPolicy = {
     };
     /** Network access restrictions. All flags default to false (no network access). */
     network?: {
-        /** Whether to allow outbound connections to the Internet. (default: false) */
+        /** Whether to allow outbound connections to the Internet. (default: false) Legacy network field. */
         allowOutbound?: boolean;
-        /** Whether to allow connections to local networks. (default: false) */
+        /** Whether to allow connections to local networks. (default: false) Legacy network field. */
         allowLocalNetwork?: boolean;
-        /** When set, ONLY these outbound hosts are reachable. Requires allowOutbound. */
+        /** When set, ONLY these outbound hosts are reachable. Requires allowOutbound. Legacy network field. */
         allowedHosts?: string[];
-        /** Hosts to block even when outbound is allowed. Requires allowOutbound. */
+        /** Hosts to block even when outbound is allowed. Requires allowOutbound. Legacy network field. */
         blockedHosts?: string[];
         /**
-         * Proxy configuration. Routes all traffic through this proxy.
-         * Cannot be combined with other network flags.
+         * Proxy configuration. Routes cooperating HTTP traffic through this proxy.
+         * Supported on Windows ProcessContainer, Linux Bubblewrap, and macOS
+         * Seatbelt. On Bubblewrap/Seatbelt it is a cooperative env-var proxy
+         * (HTTP_PROXY/HTTPS_PROXY) — raw-socket clients can bypass it. Native
+         * validation enforces backend-specific combination rules.
+         * `builtinTestServer` selects a bundled, testing-only proxy; the SDK
+         * rejects it unless `allowTestingFeatures: true` is set in
+         * SandboxSpawnOptions (which maps to the native
+         * `--allow-testing-features` flag).
+         * Legacy network field.
          */
         proxy?: {
             builtinTestServer: true;
@@ -298,6 +417,20 @@ export type SandboxPolicy = {
         } | {
             url: string;
         };
+        /** Schema 0.8 outbound network policy. Cannot be combined with legacy network fields. */
+        egress?: NetworkEgressConfig;
+        /** Schema 0.8 inbound and host-loopback policy. Cannot be combined with legacy network fields. */
+        ingress?: NetworkIngressConfig;
+    };
+    /** Schema 0.8 runtime values supplied separately from sandbox policy. */
+    runtimeConfig?: RuntimeConfig;
+    /** Schema 0.8 ProcessContainer-specific policy. */
+    processContainer?: {
+        /** ProcessContainer-specific networking settings. */
+        network?: {
+            /** Package family name or AppContainer profile authorized as the loopback proxy peer. */
+            allowedProxyPeer?: string;
+        };
     };
     /** UI access restrictions. All flags default to denied. */
     ui?: {

package/node_modules/@microsoft/mxc-sdk/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA;;;GAGG;AAGH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,IAAI,GAAG,SAAS,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,eAAe,EAAiC,CAAC;AAEzF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAG1F,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAC1B,kBAAkB,GAClB,iBAAiB,GACjB,MAAM,GACN,KAAK,GACL,SAAS,GACT,YAAY,GACZ,UAAU,GACV,mBAAmB,GACnB,YAAY,CAAC;AAEjB;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,CAAC,eAAe,GAAG,kBAAkB,CAAC,EAA8E,CAAC;AAEjK;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAEhE;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,sFAAsF;IACtF,OAAO,EAAE,OAAO,CAAC;IACjB,6BAA6B;IAC7B,SAAS,EAAE,eAAe,CAAC;IAC3B,yCAAyC;IACzC,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,SAAS,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,WAAW,CAAC;IACzD,gDAAgD;IAChD,oBAAoB,EAAE,OAAO,CAAC;IAC9B,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,GAAG,EAAE,OAAO,CAAC;CACd;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACrC,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uGAAuG;IACvG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,sDAAsD;IACtD,EAAE,CAAC,EAAE,mBAAmB,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,qCAAqC;IACrC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,cAAc,GAAG,UAAU,GAAG,MAAM,CAAC;IACvD,oEAAoE;IACpE,aAAa,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAClC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,uFAAuF;IACvF,KAAK,CAAC,EAAE;QAAE,iBAAiB,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9E,qHAAqH;IACrH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,WAAW,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAAC;IACnD,mCAAmC;IACnC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,4CAA4C;IAC5C,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,qCAAqC;IACrC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC,+CAA+C;IAC/C,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,sCAAsC;IACtC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,mCAAmC;IACnC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,2EAA2E;IAC3E,YAAY,CAAC,EAAE;QACb,+DAA+D;QAC/D,IAAI,CAAC,EAAE,UAAU,CAAC;KACnB,CAAC;IACF,wDAAwD;IACxD,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,sCAAsC;IACtC,EAAE,CAAC,EAAE,QAAQ,CAAC;CACf;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,UAAU,CAAC,EAAE;QACT,mDAAmD;QACnD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,8CAA8C;QAC9C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,kDAAkD;QAClD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,mFAAmF;QACnF,iBAAiB,CAAC,EAAE,OAAO,CAAC;KAC/B,CAAC;IACF,mFAAmF;IACnF,OAAO,CAAC,EAAE;QACN,8EAA8E;QAC9E,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,uEAAuE;QACvE,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,iFAAiF;QACjF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,4EAA4E;QAC5E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB;;;WAGG;QACH,KAAK,CAAC,EAAE;YAAE,iBAAiB,EAAE,IAAI,CAAA;SAAE,GAAG;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,GAAG;YAAE,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;KACjF,CAAC;IACF,2DAA2D;IAC3D,EAAE,CAAC,EAAE;QACD,uEAAuE;QACvE,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,gDAAgD;QAChD,SAAS,CAAC,EAAE,eAAe,CAAC;QAC5B,4EAA4E;QAC5E,mBAAmB,CAAC,EAAE,OAAO,CAAC;KACjC,CAAC;IACF,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAA;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,+CAA+C;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAEpE;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GACrB,gBAAgB,GAChB,kBAAkB,GAClB,mBAAmB,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,qBAAqB,EAAE,OAAO,CAAC;IAC/B,0DAA0D;IAC1D,sBAAsB,EAAE,OAAO,CAAC;IAChC,iEAAiE;IACjE,sBAAsB,EAAE,OAAO,CAAC;IAChC,6DAA6D;IAC7D,0BAA0B,EAAE,OAAO,CAAC;IACpC,uEAAuE;IACvE,yBAAyB,EAAE,OAAO,CAAC;IACnC,iEAAiE;IACjE,yBAAyB,EAAE,OAAO,CAAC;IACnC,oDAAoD;IACpD,wBAAwB,EAAE,OAAO,CAAC;IAClC,8DAA8D;IAC9D,wBAAwB,EAAE,OAAO,CAAC;IAClC,2DAA2D;IAC3D,8BAA8B,EAAE,OAAO,CAAC;IACxC,2DAA2D;IAC3D,8BAA8B,EAAE,OAAO,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,WAAW,EAAE,OAAO,CAAC;IACrB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;OAGG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA;;;GAGG;AAGH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,IAAI,GAAG,SAAS,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,eAAe,EAAiC,CAAC;AAEzF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAG1F,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAC1B,kBAAkB,GAClB,iBAAiB,GACjB,MAAM,GACN,KAAK,GACL,SAAS,GACT,YAAY,GACZ,UAAU,GACV,mBAAmB,GACnB,YAAY,CAAC;AAEjB;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,CAAC,eAAe,GAAG,kBAAkB,CAAC,EAA8E,CAAC;AAEjK;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAEhE;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,sFAAsF;IACtF,OAAO,EAAE,OAAO,CAAC;IACjB,6BAA6B;IAC7B,SAAS,EAAE,eAAe,CAAC;IAC3B,yCAAyC;IACzC,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,SAAS,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,WAAW,CAAC;IACzD,gDAAgD;IAChD,oBAAoB,EAAE,OAAO,CAAC;IAC9B,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,GAAG,EAAE,OAAO,CAAC;CACd;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACrC,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uGAAuG;IACvG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,sDAAsD;IACtD,EAAE,CAAC,EAAE,mBAAmB,CAAC;IACzB,qDAAqD;IACrD,OAAO,CAAC,EAAE;QACR,yFAAyF;QACzF,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,qCAAqC;IACrC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,cAAc,GAAG,UAAU,GAAG,MAAM,CAAC;IACvD,oEAAoE;IACpE,aAAa,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAClC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;;;;;;;;;;;;;;8DAkB0D;IAC1D,KAAK,CAAC,EAAE;QAAE,iBAAiB,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9E,qHAAqH;IACrH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,+BAA+B;IAC/B,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,gDAAgD;IAChD,OAAO,CAAC,EAAE,oBAAoB,CAAC;CAChC;AAED,oCAAoC;AACpC,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7C,mCAAmC;AACnC,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;AAE7D,yBAAyB;AACzB,MAAM,WAAW,iBAAiB;IAChC,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,6BAA6B;AAC7B,MAAM,WAAW,iBAAiB;IAChC,iGAAiG;IACjG,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACzB,kGAAkG;IAClG,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AAED,+BAA+B;AAC/B,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,4BAA4B;IAC5B,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC5B,uDAAuD;IACvD,IAAI,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED,gDAAgD;AAChD,MAAM,WAAW,oBAAoB;IACnC,8DAA8D;IAC9D,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,uDAAuD;IACvD,YAAY,CAAC,EAAE,aAAa,CAAC;CAC9B;AAED,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,iCAAiC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,WAAW,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAAC;IACnD,mCAAmC;IACnC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,4CAA4C;IAC5C,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,qCAAqC;IACrC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC,+CAA+C;IAC/C,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,sCAAsC;IACtC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,mCAAmC;IACnC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,8DAA8D;IAC9D,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,2EAA2E;IAC3E,YAAY,CAAC,EAAE;QACb,+DAA+D;QAC/D,IAAI,CAAC,EAAE,UAAU,CAAC;QAClB,wEAAwE;QACxE,SAAS,CAAC,EAAE,eAAe,CAAC;KAC7B,CAAC;IACF,wDAAwD;IACxD,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,sCAAsC;IACtC,EAAE,CAAC,EAAE,QAAQ,CAAC;CACf;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,UAAU,CAAC,EAAE;QACT,mDAAmD;QACnD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,8CAA8C;QAC9C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,kDAAkD;QAClD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,mFAAmF;QACnF,iBAAiB,CAAC,EAAE,OAAO,CAAC;KAC/B,CAAC;IACF,mFAAmF;IACnF,OAAO,CAAC,EAAE;QACN,oGAAoG;QACpG,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,6FAA6F;QAC7F,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,uGAAuG;QACvG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,kGAAkG;QAClG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB;;;;;;;;;;;WAWG;QACH,KAAK,CAAC,EAAE;YAAE,iBAAiB,EAAE,IAAI,CAAA;SAAE,GAAG;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,GAAG;YAAE,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QAC9E,yFAAyF;QACzF,MAAM,CAAC,EAAE,mBAAmB,CAAC;QAC7B,kGAAkG;QAClG,OAAO,CAAC,EAAE,oBAAoB,CAAC;KAClC,CAAC;IACF,yEAAyE;IACzE,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,mDAAmD;IACnD,gBAAgB,CAAC,EAAE;QACf,qDAAqD;QACrD,OAAO,CAAC,EAAE;YACN,yFAAyF;YACzF,gBAAgB,CAAC,EAAE,MAAM,CAAC;SAC7B,CAAC;KACL,CAAC;IACF,2DAA2D;IAC3D,EAAE,CAAC,EAAE;QACD,uEAAuE;QACvE,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,gDAAgD;QAChD,SAAS,CAAC,EAAE,eAAe,CAAC;QAC5B,4EAA4E;QAC5E,mBAAmB,CAAC,EAAE,OAAO,CAAC;KACjC,CAAC;IACF,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAA;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,+CAA+C;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAEpE;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GACrB,gBAAgB,GAChB,kBAAkB,GAClB,mBAAmB,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,qBAAqB,EAAE,OAAO,CAAC;IAC/B,0DAA0D;IAC1D,sBAAsB,EAAE,OAAO,CAAC;IAChC,iEAAiE;IACjE,sBAAsB,EAAE,OAAO,CAAC;IAChC,6DAA6D;IAC7D,0BAA0B,EAAE,OAAO,CAAC;IACpC,uEAAuE;IACvE,yBAAyB,EAAE,OAAO,CAAC;IACnC,iEAAiE;IACjE,yBAAyB,EAAE,OAAO,CAAC;IACnC,oDAAoD;IACpD,wBAAwB,EAAE,OAAO,CAAC;IAClC,8DAA8D;IAC9D,wBAAwB,EAAE,OAAO,CAAC;IAClC,2DAA2D;IAC3D,8BAA8B,EAAE,OAAO,CAAC;IACxC,2DAA2D;IAC3D,8BAA8B,EAAE,OAAO,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,WAAW,EAAE,OAAO,CAAC;IACrB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;OAGG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC"}

package/node_modules/@microsoft/mxc-sdk/node_modules/node-pty/lib/windowsConoutConnection.js

@@ -50,25 +50,15 @@ var eventEmitter2_1 = require("./eventEmitter2");
  * the timer has started.
  */
 var FLUSH_DATA_INTERVAL = 1000;
-/**
- * Connects to and manages the lifecycle of the conout socket. This socket must be drained on
- * another thread in order to avoid deadlocks where Conpty waits for the out socket to drain
- * when `ClosePseudoConsole` is called. This happens when data is being written to the terminal when
- * the pty is closed.
- *
- * See also:
- * - https://github.com/microsoft/node-pty/issues/375
- * - https://github.com/microsoft/vscode/issues/76548
- * - https://github.com/microsoft/terminal/issues/1810
- * - https://docs.microsoft.com/en-us/windows/console/closepseudoconsole
- */
 var ConoutConnection = /** @class */ (function () {
     function ConoutConnection(_conoutPipeName, _useConptyDll) {
         var _this = this;
         this._conoutPipeName = _conoutPipeName;
         this._useConptyDll = _useConptyDll;
         this._isDisposed = false;
+        this._isReady = false;
         this._onReady = new eventEmitter2_1.EventEmitter2();
+        this._onError = new eventEmitter2_1.EventEmitter2();
         var workerData = {
             conoutPipeName: _conoutPipeName
         };
@@ -77,18 +67,34 @@ var ConoutConnection = /** @class */ (function () {
         this._worker.on('message', function (message) {
             switch (message) {
                 case 1 /* ConoutWorkerMessage.READY */:
+                    _this._isReady = true;
                     _this._onReady.fire();
                     return;
                 default:
                     console.warn('Unexpected ConoutWorkerMessage', message);
             }
         });
+        this._worker.on('error', function (error) {
+            if (!_this._isDisposed && !_this._isReady) {
+                _this._onError.fire(error);
+            }
+        });
+        this._worker.on('exit', function (code) {
+            if (!_this._isDisposed && !_this._isReady) {
+                _this._onError.fire(new Error("Conout worker exited before connecting (code ".concat(code, ")")));
+            }
+        });
     }
     Object.defineProperty(ConoutConnection.prototype, "onReady", {
         get: function () { return this._onReady.event; },
         enumerable: false,
         configurable: true
     });
+    Object.defineProperty(ConoutConnection.prototype, "onError", {
+        get: function () { return this._onError.event; },
+        enumerable: false,
+        configurable: true
+    });
     ConoutConnection.prototype.dispose = function () {
         if (!this._useConptyDll && this._isDisposed) {
             return;

package/node_modules/@microsoft/mxc-sdk/node_modules/node-pty/lib/windowsPtyAgent.js

@@ -21,13 +21,19 @@ var conptyNative;
  * has started.
  */
 var FLUSH_DATA_INTERVAL = 1000;
+var CONNECTION_TIMEOUT = 5000;
+var defaultWindowsPtyAgentOptions = {
+    connectionTimeout: CONNECTION_TIMEOUT,
+    conoutConnectionFactory: function (conoutPipeName, useConptyDll) { return new windowsConoutConnection_1.ConoutConnection(conoutPipeName, useConptyDll); }
+};
 /**
  * This agent sits between the WindowsTerminal class and provides an interface for conpty.
  */
 var WindowsPtyAgent = /** @class */ (function () {
-    function WindowsPtyAgent(file, args, env, cwd, cols, rows, debug, _useConptyDll, conptyInheritCursor) {
+    function WindowsPtyAgent(file, args, env, cwd, cols, rows, debug, _useConptyDll, conptyInheritCursor, options) {
         if (_useConptyDll === void 0) { _useConptyDll = false; }
         if (conptyInheritCursor === void 0) { conptyInheritCursor = false; }
+        if (options === void 0) { options = defaultWindowsPtyAgentOptions; }
         var _this = this;
         this._useConptyDll = _useConptyDll;
         this._innerPid = 0;
@@ -54,24 +60,26 @@ var WindowsPtyAgent = /** @class */ (function () {
         // We must wait for the worker to connect before calling conptyNative.connect()
         // to avoid blocking the Node.js event loop in ConnectNamedPipe.
         // See https://github.com/microsoft/node-pty/issues/763
-        this._conoutSocketWorker = new windowsConoutConnection_1.ConoutConnection(term.conout, this._useConptyDll);
+        this._conoutSocketWorker = options.conoutConnectionFactory(term.conout, this._useConptyDll);
         // Store pending connection info - we'll complete the connection when worker is ready
         this._pendingPtyInfo = { pty: this._pty, commandLine: commandLine, cwd: cwd, env: env };
-        // Timeout to ensure connection completes even if worker fails to signal ready
-        var connectionTimeout = setTimeout(function () {
-            if (_this._pendingPtyInfo) {
-                // Worker never signaled ready - complete connection anyway to avoid zombie state
-                _this._completePtyConnection();
-            }
-        }, 5000);
+        // Never call connect() before the worker is ready, as ConnectNamedPipe
+        // would block the Node.js event loop while waiting for the output client.
+        this._connectionTimeout = setTimeout(function () {
+            _this._failPtyConnection(new Error('Timed out waiting for ConPTY output worker'));
+        }, options.connectionTimeout);
         this._conoutSocketWorker.onReady(function () {
-            clearTimeout(connectionTimeout);
+            if (!_this._pendingPtyInfo) {
+                return;
+            }
+            _this._clearConnectionTimeout();
             _this._conoutSocketWorker.connectSocket(_this._outSocket);
             // Now that the worker has connected to the output pipe, we can safely call
             // conptyNative.connect() which calls ConnectNamedPipe - it won't block because
             // the client (worker) is already connected
             _this._completePtyConnection();
         });
+        this._conoutSocketWorker.onError(function (error) { return _this._failPtyConnection(error); });
         this._outSocket.on('connect', function () {
             _this._outSocket.emit('ready_datapipe');
         });
@@ -119,6 +127,7 @@ var WindowsPtyAgent = /** @class */ (function () {
         if (!this._pendingPtyInfo) {
             return;
         }
+        this._clearConnectionTimeout();
         var _b = this._pendingPtyInfo, pty = _b.pty, commandLine = _b.commandLine, cwd = _b.cwd, env = _b.env;
         this._pendingPtyInfo = undefined;
         try {
@@ -126,8 +135,8 @@ var WindowsPtyAgent = /** @class */ (function () {
             this._innerPid = connect.pid;
         }
         catch (err) {
-            // connect() runs from the conout worker's onReady callback (or its
-            // timeout fallback), so a throw here would otherwise surface as an
+            // connect() runs from the conout worker's onReady callback, so a throw
+            // here would otherwise surface as an
             // uncaughtException with no way for the consumer to observe it.
             var code = (_a = /error code: (\d+)/.exec(err.message)) === null || _a === void 0 ? void 0 : _a[1];
             this._exitCode = code ? parseInt(code, 10) : -1;
@@ -141,6 +150,28 @@ var WindowsPtyAgent = /** @class */ (function () {
             this._onError.fire(err);
         }
     };
+    WindowsPtyAgent.prototype._failPtyConnection = function (error) {
+        if (!this._pendingPtyInfo) {
+            return;
+        }
+        this._clearConnectionTimeout();
+        this._pendingPtyInfo = undefined;
+        this._exitCode = -1;
+        try {
+            this._ptyNative.kill(this._pty, this._useConptyDll);
+        }
+        catch ( /* already gone */_a) { /* already gone */ }
+        this._conoutSocketWorker.dispose();
+        this._inSocket.destroy();
+        this._outSocket.destroy();
+        this._onError.fire(error);
+    };
+    WindowsPtyAgent.prototype._clearConnectionTimeout = function () {
+        if (this._connectionTimeout) {
+            clearTimeout(this._connectionTimeout);
+            this._connectionTimeout = undefined;
+        }
+    };
     WindowsPtyAgent.prototype.resize = function (cols, rows) {
         if (this._exitCode !== undefined) {
             throw new Error('Cannot resize a pty that has already exited');
@@ -153,6 +184,7 @@ var WindowsPtyAgent = /** @class */ (function () {
     WindowsPtyAgent.prototype.kill = function () {
         var _this = this;
         // Prevent deferred connection from completing after kill
+        this._clearConnectionTimeout();
         this._pendingPtyInfo = undefined;
         // Tell the agent to kill the pty, this releases handles to the process
         if (!this._useConptyDll) {

package/node_modules/@microsoft/mxc-sdk/node_modules/node-pty/package.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "Microsoft Corporation"
   },
-  "version": "1.2.0-beta.14",
+  "version": "1.2.0-beta.15",
   "license": "MIT",
   "main": "./lib/index.js",
   "types": "./typings/node-pty.d.ts",

package/node_modules/@microsoft/mxc-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microsoft/mxc-sdk",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "TypeScript SDK for MXC (Microsoft eXecution Containers)",
   "type": "module",
   "types": "dist/index.d.ts",
@@ -23,7 +23,7 @@
     "watch": "tsc --watch",
     "clean": "rimraf dist",
     "test": "npm run test:unit",
-    "test:unit": "npm run build:test-unit && node --test dist-tests/tests/unit/sandbox.test.js dist-tests/tests/unit/policy.test.js dist-tests/tests/unit/logger.test.js dist-tests/tests/unit/errors.test.js dist-tests/tests/unit/state-aware-types.test.js dist-tests/tests/unit/state-aware.test.js dist-tests/tests/unit/platform.test.js",
+    "test:unit": "npm run build:test-unit && node --test dist-tests/tests/unit/sandbox.test.js dist-tests/tests/unit/policy.test.js dist-tests/tests/unit/logger.test.js dist-tests/tests/unit/errors.test.js dist-tests/tests/unit/state-aware-types.test.js dist-tests/tests/unit/state-aware.test.js dist-tests/tests/unit/platform.test.js dist-tests/tests/unit/wire-conformance.test.js dist-tests/tests/unit/wire-conformance-state-aware.test.js",
     "test:integration": "cd tests/integration && npm install && npm run build && npm test",
     "prepublishOnly": "npm run build"
   },

package/node_modules/zod/README.md

@@ -113,6 +113,33 @@ await schema.parseAsync("hello");
 // => "hello"
 ```
 
+### AOT compilation
+
+For hot validation paths, `z.compile(schema)` returns a schema clone with an ahead-of-time compiled fast path. Valid inputs take the compiled path; invalid inputs fall back to the regular parser so error reporting stays identical.
+
+Across a 55-schema benchmark the median speedup is **2.4x**, and it scales with how much work the schema does per parse: a large array of objects is ~9x, a 20-key object ~9x, a nested object ~4.5x, while a bare `z.string()` gains nothing — compilation removes per-node dispatch and allocation, and a single `typeof` has none to remove.
+
+```ts
+const CompiledPlayer = z.compile(Player);
+
+CompiledPlayer.parse({ username: "billie", xp: 100 });
+```
+
+To enable compilation globally for schemas constructed after import:
+
+```ts
+import "zod/compile"; // place before modules that define schemas
+```
+
+Things to know:
+
+- Compilation uses `new Function`. Global mode is automatically disabled when `z.config({ jitless: true })` is set (e.g. CSP environments); calling `z.compile()` directly is an explicit opt-in.
+- Schemas with async refinements or transforms can't be compiled, and neither can a few other constructs. That is not an error: `z.compile()` hands the schema back unchanged and it keeps using the regular parser, exactly as global mode leaves it. Pass `{ strict: true }` to throw `ZodCompileAsyncError` / `ZodCompileUnsupportedError` instead.
+- On invalid input, refinements and transforms may run twice (fast path, then fallback).
+- Deriving a new schema from a compiled one (`.refine()`, `.extend()`, etc.) returns an uncompiled schema — compile the final schema.
+
+See [`compile` docs](https://zod.dev/compile) for details.
+
 ### Handling errors
 
 When validation fails, the `.parse()` method will throw a `ZodError` instance with granular information about the validation issues.

package/node_modules/zod/compile.cjs

@@ -0,0 +1,77 @@
+"use strict";
+// Side-effect-only: installs the post-processor on `globalConfig`. Listed in `package.json`'s `sideEffects`, and nothing else references it, so apps that never import it drop the compiler.
+//
+// Usage:
+//
+//   import "zod/compile";
+//   import * as z from "zod";
+//   // every schema constructed below this is compiled on first parse
+//
+// Module evaluation order matters: schemas constructed in modules that evaluate before this import will not be compiled. Place this import in the app entry point, before any module that constructs schemas at top level.
+//
+// Failure handling: if the compiler refuses a schema (async refinement, unsupported feature, etc.) the shim permanently restores the runtime `_zod.run` for that schema. The schema continues to work via the regular runtime parser — no observable difference to the caller.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const compile_js_1 = require("./v4/core/compile.cjs");
+const core = __importStar(require("./v4/core/index.cjs"));
+let compiling = false;
+core.globalConfig.postProcessor = (inst) => {
+    if (compiling)
+        return;
+    const originalRun = inst._zod?.run;
+    if (typeof originalRun !== "function")
+        return;
+    const shim = (payload, ctx) => {
+        // Bypass the fast path for any non-forward / non-sync / check-skipping call. The runtime owns those contracts.
+        if (ctx?.async || ctx?.direction === "backward" || ctx?.skipChecks) {
+            return originalRun(payload, ctx);
+        }
+        compiling = true;
+        try {
+            // Respect the jitless config: it exists precisely so CSP/no-eval environments never reach `new Function`. Global mode must not bypass it (explicit z.compile calls remain an explicit opt-in).
+            if (core.globalConfig.jitless) {
+                inst._zod.run = originalRun;
+                return originalRun(payload, ctx);
+            }
+            // Strict: the shim owns its own fallback below, and a non-strict compile would hand back `inst` — whose run is this shim — and reinstall it on itself.
+            const compiled = (0, compile_js_1.compile)(inst, { strict: true });
+            // Only the run wrapper. Copying the compiled parse/safeParse closures would make their fallback re-enter this instance and run user callbacks a third time.
+            inst._zod.run = compiled._zod.run;
+            inst._zod.bag.fallbackRun = compiled._zod.bag.fallbackRun;
+            inst._zod.bag.validator = compiled._zod.bag.validator;
+        }
+        catch {
+            // Permanent fallback for unsupported schemas.
+            inst._zod.run = originalRun;
+        }
+        finally {
+            compiling = false;
+        }
+        return inst._zod.run(payload, ctx);
+    };
+    // Expose the pre-shim runtime so `compile()` invoked elsewhere can unwrap past the shim and capture the source-of-truth runtime. Without this, a user calling `z.compile(s)` after global mode is enabled would capture the shim itself, which would feed the wrapper into itself on fallback.
+    shim.__originalRun = originalRun;
+    inst._zod.run = shim;
+};

package/node_modules/zod/compile.d.cts

@@ -0,0 +1 @@
+export {};

package/node_modules/zod/compile.d.ts

@@ -0,0 +1 @@
+export {};