rightsize 0.1.0

package/dist/backend-msb/ls-json.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Parses `msb ls --format json` — the msb backend's only way to learn which
+ * sandboxes currently show `"status":"Running"`. The current msb release's shape is a flat
+ * JSON array of objects with keys `created_at, image, name, status` (status
+ * capitalized). `JSON.parse` handles that shape fine, but a hand-rolled
+ * string/escape-aware brace scanner is kept as the primary path anyway: it
+ * degrades gracefully (skip the malformed object, keep the rest) on the kind
+ * of schema drift a future msb release might introduce, where `JSON.parse`
+ * would simply throw and cost the caller every entry instead of the one bad
+ * one.
+ */
+/**
+ * Names of sandboxes whose `status` is exactly `"Running"` (capitalized —
+ * msb never lowercases it). An entry missing `name` or `status` is skipped
+ * outright, never counted as a name-less running sandbox. Tries `JSON.parse`
+ * first for the common case and falls back to the tolerant brace scanner
+ * only if that throws, so well-formed output pays no scanning cost while
+ * malformed output still degrades gracefully instead of losing everything.
+ */
+export declare function runningNames(json: string): Set<string>;
+/** Test-only: forces the tolerant scanner path regardless of whether JSON.parse would succeed. */
+export declare function _scanRunningNamesForTests(json: string): Set<string>;
+//# sourceMappingURL=ls-json.d.ts.map

package/dist/backend-msb/ls-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ls-json.d.ts","sourceRoot":"","sources":["../../src/backend-msb/ls-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA2EH;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAetD;AAED,kGAAkG;AAClG,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAQnE"}

package/dist/backend-msb/ls-json.js

@@ -0,0 +1,113 @@
+/**
+ * Parses `msb ls --format json` — the msb backend's only way to learn which
+ * sandboxes currently show `"status":"Running"`. The current msb release's shape is a flat
+ * JSON array of objects with keys `created_at, image, name, status` (status
+ * capitalized). `JSON.parse` handles that shape fine, but a hand-rolled
+ * string/escape-aware brace scanner is kept as the primary path anyway: it
+ * degrades gracefully (skip the malformed object, keep the rest) on the kind
+ * of schema drift a future msb release might introduce, where `JSON.parse`
+ * would simply throw and cost the caller every entry instead of the one bad
+ * one.
+ */
+/**
+ * Splits a top-level JSON array's text into the substrings of its immediate
+ * object elements, string- and escape-aware so a `}` or `,` inside a quoted
+ * value never miscounts as structural. Never throws: anything that isn't
+ * bracket-balanced simply yields whatever complete objects were found before
+ * the text ran out.
+ */
+function splitTopLevelObjects(text) {
+    const objects = [];
+    let depth = 0;
+    let start = -1;
+    let inString = false;
+    let escaped = false;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        if (inString) {
+            if (escaped) {
+                escaped = false;
+            }
+            else if (ch === "\\") {
+                escaped = true;
+            }
+            else if (ch === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+            continue;
+        }
+        if (ch === "{") {
+            if (depth === 0) {
+                start = i;
+            }
+            depth++;
+            continue;
+        }
+        if (ch === "}") {
+            if (depth > 0) {
+                depth--;
+                if (depth === 0 && start >= 0) {
+                    objects.push(text.slice(start, i + 1));
+                    start = -1;
+                }
+            }
+            continue;
+        }
+    }
+    return objects;
+}
+/** Extracts a single string field's value from one object's raw text, tolerant of key order. */
+function extractStringField(objectText, field) {
+    const re = new RegExp(`"${field}"\\s*:\\s*"((?:[^"\\\\]|\\\\.)*)"`);
+    const match = re.exec(objectText);
+    if (match === undefined || match === null || match[1] === undefined) {
+        return undefined;
+    }
+    return match[1].replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+}
+function scanEntries(json) {
+    return splitTopLevelObjects(json).map((objectText) => ({
+        name: extractStringField(objectText, "name"),
+        status: extractStringField(objectText, "status"),
+    }));
+}
+/**
+ * Names of sandboxes whose `status` is exactly `"Running"` (capitalized —
+ * msb never lowercases it). An entry missing `name` or `status` is skipped
+ * outright, never counted as a name-less running sandbox. Tries `JSON.parse`
+ * first for the common case and falls back to the tolerant brace scanner
+ * only if that throws, so well-formed output pays no scanning cost while
+ * malformed output still degrades gracefully instead of losing everything.
+ */
+export function runningNames(json) {
+    let entries;
+    try {
+        const parsed = JSON.parse(json);
+        entries = Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        entries = scanEntries(json);
+    }
+    const names = new Set();
+    for (const entry of entries) {
+        if (entry.status === "Running" && typeof entry.name === "string") {
+            names.add(entry.name);
+        }
+    }
+    return names;
+}
+/** Test-only: forces the tolerant scanner path regardless of whether JSON.parse would succeed. */
+export function _scanRunningNamesForTests(json) {
+    const names = new Set();
+    for (const entry of scanEntries(json)) {
+        if (entry.status === "Running" && typeof entry.name === "string") {
+            names.add(entry.name);
+        }
+    }
+    return names;
+}
+//# sourceMappingURL=ls-json.js.map

package/dist/backend-msb/ls-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ls-json.js","sourceRoot":"","sources":["../../src/backend-msb/ls-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACf,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;iBAAM,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBACvB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;iBAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACtB,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,KAAK,GAAG,CAAC,CAAC;YACZ,CAAC;YACD,KAAK,EAAE,CAAC;YACR,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,KAAK,EAAE,CAAC;gBACR,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;oBAC9B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACvC,KAAK,GAAG,CAAC,CAAC,CAAC;gBACb,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gGAAgG;AAChG,SAAS,kBAAkB,CAAC,UAAkB,EAAE,KAAa;IAC3D,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,mCAAmC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACpE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,EAAE,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5C,MAAM,EAAE,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC;KACjD,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/backend-msb/network-links.d.ts

@@ -0,0 +1,7 @@
+import type { NetworkLink } from "../core/backend.js";
+/** Two siblings publishing the same guest port on one network have nowhere distinct to tunnel to. */
+export declare function requireNoDuplicateGuestPorts(links: readonly NetworkLink[]): void;
+export declare function requireAliasesAreValid(links: readonly NetworkLink[]): void;
+/** The `sh -c` script that appends one `/etc/hosts` line per distinct alias. */
+export declare function hostsAliasScript(links: readonly NetworkLink[]): string;
+//# sourceMappingURL=network-links.d.ts.map

package/dist/backend-msb/network-links.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-links.d.ts","sourceRoot":"","sources":["../../src/backend-msb/network-links.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAUtD,qGAAqG;AACrG,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,IAAI,CAWhF;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,IAAI,CAW1E;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,CAGtE"}

package/dist/backend-msb/network-links.js

@@ -0,0 +1,31 @@
+import { UnsupportedByBackendError } from "../core/errors.js";
+const BACKEND_NAME = "microsandbox";
+// Permissive DNS-label charset: aliases are interpolated into a `sh -c`
+// `/etc/hosts` echo, so this exists to reject shell-metacharacter aliases
+// that could break out of the quoting, not to enforce a strict hostname
+// grammar.
+const ALIAS_CHARSET = /^[A-Za-z0-9._-]+$/;
+/** Two siblings publishing the same guest port on one network have nowhere distinct to tunnel to. */
+export function requireNoDuplicateGuestPorts(links) {
+    const seen = new Set();
+    for (const link of links) {
+        if (seen.has(link.guestPort)) {
+            throw new UnsupportedByBackendError(`two siblings exposing the same guest port ${link.guestPort} on one network`, BACKEND_NAME);
+        }
+        seen.add(link.guestPort);
+    }
+}
+export function requireAliasesAreValid(links) {
+    const aliases = new Set(links.map((l) => l.alias));
+    for (const alias of aliases) {
+        if (!ALIAS_CHARSET.test(alias)) {
+            throw new UnsupportedByBackendError(`network alias '${alias}'`, BACKEND_NAME, "use a valid DNS label instead (allowed: letters, digits, '.', '_', '-')");
+        }
+    }
+}
+/** The `sh -c` script that appends one `/etc/hosts` line per distinct alias. */
+export function hostsAliasScript(links) {
+    const aliases = [...new Set(links.map((l) => l.alias))];
+    return aliases.map((alias) => `echo '127.0.0.1 ${alias}' >> /etc/hosts`).join("; ");
+}
+//# sourceMappingURL=network-links.js.map

package/dist/backend-msb/network-links.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-links.js","sourceRoot":"","sources":["../../src/backend-msb/network-links.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAG9D,MAAM,YAAY,GAAG,cAAc,CAAC;AAEpC,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AACxE,WAAW;AACX,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAE1C,qGAAqG;AACrG,MAAM,UAAU,4BAA4B,CAAC,KAA6B;IACxE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,yBAAyB,CACjC,6CAA6C,IAAI,CAAC,SAAS,iBAAiB,EAC5E,YAAY,CACb,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAA6B;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,yBAAyB,CACjC,kBAAkB,KAAK,GAAG,EAC1B,YAAY,EACZ,yEAAyE,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,KAA6B;IAC5D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,KAAK,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtF,CAAC"}

package/dist/backend-msb/platform.d.ts

@@ -0,0 +1,29 @@
+/** The five platforms the pinned microsandbox release ships a build for. */
+export type Platform = "darwin-arm64" | "linux-x64" | "linux-arm64" | "win32-x64" | "win32-arm64";
+/** Platform detection and per-platform msb/krun asset naming, backing `MsbBackendProvider.isSupported`. */
+export declare const PlatformInfo: {
+    /** This process's msb platform, or `undefined` if msb ships no build for it. */
+    current(): Platform | undefined;
+    /** The `msb` release asset filename for this platform. */
+    msbAsset(p: Platform): string;
+    /** The libkrunfw release asset filename for this platform — what it is downloaded as. */
+    krunAsset(p: Platform): string;
+    /**
+     * The basename the msb binary must be installed under inside `bin/` —
+     * suffixless (`msb`) on macOS/Linux, `msb.exe` on Windows (there is no
+     * such thing as a suffixless executable on Windows; the OS resolves
+     * executables by extension, not an executable permission bit). Derived
+     * from the platform rather than a literal `"msb"` constant so the
+     * provisioner's install-target path is correct on every platform.
+     */
+    msbBinaryName(p: Platform): string;
+    /** The filename the library must be installed under for msb to resolve it. */
+    krunInstallName(p: Platform): string;
+    /** Whether this machine can actually run msb's microVMs right now (KVM access on Linux; always true once the platform itself resolves on macOS or Windows — see `virtualizationAvailable`'s doc comment for why Windows is attempt-and-report). */
+    virtualizationAvailable(): boolean;
+    /** Test seam: exercises the pure decision tables against injected platform/arch strings. */
+    _currentFor(processPlatform: string, processArch: string): Platform | undefined;
+    /** Test seam: exercises `virtualizationAvailable`'s pure per-OS branches against injected platform/arch strings, without a real `/dev/kvm` or host OS. */
+    _virtualizationAvailableFor(processPlatform: string, processArch: string): boolean;
+};
+//# sourceMappingURL=platform.d.ts.map

package/dist/backend-msb/platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/backend-msb/platform.ts"],"names":[],"mappings":"AAEA,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,cAAc,GAAG,WAAW,GAAG,aAAa,GAAG,WAAW,GAAG,aAAa,CAAC;AA0FlG,2GAA2G;AAC3G,eAAO,MAAM,YAAY;IACvB,gFAAgF;eACrE,QAAQ,GAAG,SAAS;IAG/B,0DAA0D;gBAC9C,QAAQ,GAAG,MAAM;IAG7B,yFAAyF;iBAC5E,QAAQ,GAAG,MAAM;IAG9B;;;;;;;OAOG;qBACc,QAAQ,GAAG,MAAM;IAGlC,8EAA8E;uBAC3D,QAAQ,GAAG,MAAM;IAGpC,mPAAmP;+BACxN,OAAO;IAGlC,4FAA4F;iCAC/D,MAAM,eAAe,MAAM,GAAG,QAAQ,GAAG,SAAS;IAG/E,0JAA0J;iDAC7G,MAAM,eAAe,MAAM,GAAG,OAAO;CAGnF,CAAC"}

package/dist/backend-msb/platform.js

@@ -0,0 +1,128 @@
+import * as fs from "node:fs";
+const MSB_ASSETS = {
+    "darwin-arm64": "msb-darwin-aarch64",
+    "linux-x64": "msb-linux-x86_64",
+    "linux-arm64": "msb-linux-aarch64",
+    "win32-x64": "msb-windows-x86_64.exe",
+    "win32-arm64": "msb-windows-aarch64.exe",
+};
+const KRUN_ASSETS = {
+    "darwin-arm64": "libkrunfw-darwin-aarch64.dylib",
+    "linux-x64": "libkrunfw-linux-x86_64.so",
+    "linux-arm64": "libkrunfw-linux-aarch64.so",
+    "win32-x64": "libkrunfw-windows-x86_64.dll",
+    "win32-arm64": "libkrunfw-windows-aarch64.dll",
+};
+// The exact filename msb resolves the library under: it probes `../lib/` next to its
+// own binary for `libkrunfw.so.<version>` on Linux, `libkrunfw.<abi>.dylib` on macOS,
+// and unversioned `libkrunfw.dll` on Windows (confirmed against install.ps1, the
+// upstream Windows installer's own copy step: it moves the extracted bundle's
+// `libkrunfw.dll` straight to `lib\libkrunfw.dll`, no version suffix) — never the
+// release-asset name — so the provisioner installs the downloaded asset under this
+// name. The embedded libkrunfw version/ABI is part of the pinned msb release;
+// re-verify all names when bumping the pin.
+const KRUN_INSTALL_NAMES = {
+    "darwin-arm64": "libkrunfw.5.dylib",
+    "linux-x64": "libkrunfw.so.5.5.0",
+    "linux-arm64": "libkrunfw.so.5.5.0",
+    "win32-x64": "libkrunfw.dll",
+    "win32-arm64": "libkrunfw.dll",
+};
+function currentPlatform(processPlatform, processArch) {
+    if (processPlatform === "darwin" && processArch === "arm64") {
+        return "darwin-arm64";
+    }
+    if (processPlatform === "linux" && processArch === "x64") {
+        return "linux-x64";
+    }
+    if (processPlatform === "linux" && processArch === "arm64") {
+        return "linux-arm64";
+    }
+    if (processPlatform === "win32" && processArch === "x64") {
+        return "win32-x64";
+    }
+    if (processPlatform === "win32" && processArch === "arm64") {
+        return "win32-arm64";
+    }
+    return undefined;
+}
+/**
+ * Linux needs `/dev/kvm` open for read+write; Apple Silicon's virtualization
+ * is available whenever the platform itself resolves (Virtualization.framework
+ * needs no device-file probe). Windows is attempt-and-report rather than
+ * probed: there is no cheap, reliable no-spawn signal for Windows Hypervisor
+ * Platform availability (querying the `HypervisorPlatform` optional feature
+ * needs a PowerShell subprocess, which this synchronous method cannot spawn
+ * without blocking), and the windows-spike findings (2026-07-05, msb 0.6.3 on
+ * windows-2022/windows-2025 hosted runners) showed WHP already enabled out of
+ * the box on both — so a detected Windows platform reports true here, exactly
+ * as macOS does, and a genuinely WHP-less host finds out from msb's own error
+ * at boot (`msb doctor`/`msb run` fail loudly), not a silent Docker downgrade.
+ * All branches use the synchronous `fs` calls — never `fs.access` — because
+ * `BackendProvider.isSupported()` (the caller, `MsbBackendProvider`) is a
+ * synchronous interface method: an async probe here would make
+ * `isSupported()` return a Promise, which the pure resolver in
+ * `Backends.resolve` would read as truthy ("supported") without ever
+ * awaiting it.
+ */
+function virtualizationAvailable(processPlatform, processArch) {
+    if (processPlatform === "darwin") {
+        return currentPlatform(processPlatform, processArch) !== undefined;
+    }
+    if (processPlatform === "linux") {
+        try {
+            fs.accessSync("/dev/kvm", fs.constants.R_OK | fs.constants.W_OK);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    if (processPlatform === "win32") {
+        return currentPlatform(processPlatform, processArch) !== undefined;
+    }
+    return false;
+}
+/** Platform detection and per-platform msb/krun asset naming, backing `MsbBackendProvider.isSupported`. */
+export const PlatformInfo = {
+    /** This process's msb platform, or `undefined` if msb ships no build for it. */
+    current() {
+        return currentPlatform(process.platform, process.arch);
+    },
+    /** The `msb` release asset filename for this platform. */
+    msbAsset(p) {
+        return MSB_ASSETS[p];
+    },
+    /** The libkrunfw release asset filename for this platform — what it is downloaded as. */
+    krunAsset(p) {
+        return KRUN_ASSETS[p];
+    },
+    /**
+     * The basename the msb binary must be installed under inside `bin/` —
+     * suffixless (`msb`) on macOS/Linux, `msb.exe` on Windows (there is no
+     * such thing as a suffixless executable on Windows; the OS resolves
+     * executables by extension, not an executable permission bit). Derived
+     * from the platform rather than a literal `"msb"` constant so the
+     * provisioner's install-target path is correct on every platform.
+     */
+    msbBinaryName(p) {
+        return p === "win32-x64" || p === "win32-arm64" ? "msb.exe" : "msb";
+    },
+    /** The filename the library must be installed under for msb to resolve it. */
+    krunInstallName(p) {
+        return KRUN_INSTALL_NAMES[p];
+    },
+    /** Whether this machine can actually run msb's microVMs right now (KVM access on Linux; always true once the platform itself resolves on macOS or Windows — see `virtualizationAvailable`'s doc comment for why Windows is attempt-and-report). */
+    virtualizationAvailable() {
+        return virtualizationAvailable(process.platform, process.arch);
+    },
+    /** Test seam: exercises the pure decision tables against injected platform/arch strings. */
+    _currentFor(processPlatform, processArch) {
+        return currentPlatform(processPlatform, processArch);
+    },
+    /** Test seam: exercises `virtualizationAvailable`'s pure per-OS branches against injected platform/arch strings, without a real `/dev/kvm` or host OS. */
+    _virtualizationAvailableFor(processPlatform, processArch) {
+        return virtualizationAvailable(processPlatform, processArch);
+    },
+};
+//# sourceMappingURL=platform.js.map

package/dist/backend-msb/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/backend-msb/platform.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAK9B,MAAM,UAAU,GAA6B;IAC3C,cAAc,EAAE,oBAAoB;IACpC,WAAW,EAAE,kBAAkB;IAC/B,aAAa,EAAE,mBAAmB;IAClC,WAAW,EAAE,wBAAwB;IACrC,aAAa,EAAE,yBAAyB;CACzC,CAAC;AAEF,MAAM,WAAW,GAA6B;IAC5C,cAAc,EAAE,gCAAgC;IAChD,WAAW,EAAE,2BAA2B;IACxC,aAAa,EAAE,4BAA4B;IAC3C,WAAW,EAAE,8BAA8B;IAC3C,aAAa,EAAE,+BAA+B;CAC/C,CAAC;AAEF,qFAAqF;AACrF,sFAAsF;AACtF,iFAAiF;AACjF,8EAA8E;AAC9E,kFAAkF;AAClF,mFAAmF;AACnF,8EAA8E;AAC9E,4CAA4C;AAC5C,MAAM,kBAAkB,GAA6B;IACnD,cAAc,EAAE,mBAAmB;IACnC,WAAW,EAAE,oBAAoB;IACjC,aAAa,EAAE,oBAAoB;IACnC,WAAW,EAAE,eAAe;IAC5B,aAAa,EAAE,eAAe;CAC/B,CAAC;AAEF,SAAS,eAAe,CAAC,eAAuB,EAAE,WAAmB;IACnE,IAAI,eAAe,KAAK,QAAQ,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC5D,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,IAAI,eAAe,KAAK,OAAO,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QACzD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,eAAe,KAAK,OAAO,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC3D,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,eAAe,KAAK,OAAO,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QACzD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,eAAe,KAAK,OAAO,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC3D,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,uBAAuB,CAAC,eAAuB,EAAE,WAAmB;IAC3E,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,eAAe,CAAC,eAAe,EAAE,WAAW,CAAC,KAAK,SAAS,CAAC;IACrE,CAAC;IACD,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,eAAe,CAAC,eAAe,EAAE,WAAW,CAAC,KAAK,SAAS,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,gFAAgF;IAChF,OAAO;QACL,OAAO,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,0DAA0D;IAC1D,QAAQ,CAAC,CAAW;QAClB,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,yFAAyF;IACzF,SAAS,CAAC,CAAW;QACnB,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD;;;;;;;OAOG;IACH,aAAa,CAAC,CAAW;QACvB,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IACtE,CAAC;IACD,8EAA8E;IAC9E,eAAe,CAAC,CAAW;QACzB,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,mPAAmP;IACnP,uBAAuB;QACrB,OAAO,uBAAuB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,4FAA4F;IAC5F,WAAW,CAAC,eAAuB,EAAE,WAAmB;QACtD,OAAO,eAAe,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IACD,0JAA0J;IAC1J,2BAA2B,CAAC,eAAuB,EAAE,WAAmB;QACtE,OAAO,uBAAuB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IAC/D,CAAC;CACF,CAAC"}

package/dist/backend-msb/port-conflict.d.ts

@@ -0,0 +1,10 @@
+/**
+ * msb has no structured error for a host-port bind conflict — only the
+ * `msb run` child's combined stdout/stderr text — so this is a best-effort
+ * message match, msb-specific wording kept local to this backend rather than
+ * folded into `GenericContainer`'s own cause-chain classifier (which handles
+ * the typed `PortBindConflictError` case once this function has produced
+ * one).
+ */
+export declare function isPortBindConflictOutput(output: string): boolean;
+//# sourceMappingURL=port-conflict.d.ts.map

package/dist/backend-msb/port-conflict.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"port-conflict.d.ts","sourceRoot":"","sources":["../../src/backend-msb/port-conflict.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAQhE"}

package/dist/backend-msb/port-conflict.js

@@ -0,0 +1,16 @@
+/**
+ * msb has no structured error for a host-port bind conflict — only the
+ * `msb run` child's combined stdout/stderr text — so this is a best-effort
+ * message match, msb-specific wording kept local to this backend rather than
+ * folded into `GenericContainer`'s own cause-chain classifier (which handles
+ * the typed `PortBindConflictError` case once this function has produced
+ * one).
+ */
+export function isPortBindConflictOutput(output) {
+    const m = output.toLowerCase();
+    return (m.includes("address already in use") ||
+        m.includes("port is already allocated") ||
+        m.includes("bind: address already in use") ||
+        (m.includes("already in use") && m.includes("port")));
+}
+//# sourceMappingURL=port-conflict.js.map

package/dist/backend-msb/port-conflict.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"port-conflict.js","sourceRoot":"","sources":["../../src/backend-msb/port-conflict.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,OAAO,CACL,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QACpC,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QACvC,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAC1C,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CACrD,CAAC;AACJ,CAAC"}

package/dist/backend-msb/provider.d.ts

@@ -0,0 +1,10 @@
+import type { BackendProvider, SandboxBackend } from "../core/backend.js";
+export declare class MsbBackendProvider implements BackendProvider {
+    /** `"microsandbox"` — matched case-insensitively against `RIGHTSIZE_BACKEND`. */
+    readonly name = "microsandbox";
+    readonly priority = 20;
+    isSupported(): boolean;
+    unsupportedReason(): string;
+    create(): SandboxBackend;
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/backend-msb/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/backend-msb/provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAK1E,qBAAa,kBAAmB,YAAW,eAAe;IACxD,iFAAiF;IACjF,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,QAAQ,MAAM;IAEvB,WAAW,IAAI,OAAO;IAQtB,iBAAiB,IAAI,MAAM;IAa3B,MAAM,IAAI,cAAc;CAczB"}

package/dist/backend-msb/provider.js

@@ -0,0 +1,40 @@
+import { PlatformInfo } from "./platform.js";
+import { ensureInstalled } from "./provisioner.js";
+import { MsbCliBackend } from "./backend.js";
+export class MsbBackendProvider {
+    /** `"microsandbox"` — matched case-insensitively against `RIGHTSIZE_BACKEND`. */
+    name = "microsandbox";
+    priority = 20;
+    isSupported() {
+        // Both sides of this && are synchronous (platform.ts never uses async
+        // fs.access) — this method must never return a Promise, or the pure
+        // resolver in Backends.resolve would read a truthy Promise as "supported"
+        // without ever awaiting it.
+        return PlatformInfo.current() !== undefined && PlatformInfo.virtualizationAvailable();
+    }
+    unsupportedReason() {
+        if (PlatformInfo.current() === undefined) {
+            return `no msb build for ${process.platform}/${process.arch} (Intel Mac: use the docker backend)`;
+        }
+        if (process.platform === "win32") {
+            return ("Windows Hypervisor Platform is not enabled (run 'msb doctor --fix' in an elevated " +
+                "terminal, which may require a reboot), or use the docker backend");
+        }
+        return "/dev/kvm is not accessible (need KVM, or run on Apple Silicon macOS)";
+    }
+    create() {
+        // create() is a synchronous ServiceLoader-style factory, but
+        // locating/installing msb is inherently async. The
+        // backend holds the provisioning promise and awaits it lazily on first
+        // use; sweepOrphans() piggybacks on that same lazy resolution rather
+        // than blocking construction.
+        const backend = new MsbCliBackend(ensureInstalled());
+        void backend.sweepOrphans().catch(() => {
+            // Best-effort: a failed sweep must not prevent this backend from
+            // being usable — the next run's sweep gets another chance, and a
+            // container that's actually still running is left alone either way.
+        });
+        return backend;
+    }
+}
+//# sourceMappingURL=provider.js.map

package/dist/backend-msb/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/backend-msb/provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,OAAO,kBAAkB;IAC7B,iFAAiF;IACxE,IAAI,GAAG,cAAc,CAAC;IACtB,QAAQ,GAAG,EAAE,CAAC;IAEvB,WAAW;QACT,sEAAsE;QACtE,oEAAoE;QACpE,0EAA0E;QAC1E,4BAA4B;QAC5B,OAAO,YAAY,CAAC,OAAO,EAAE,KAAK,SAAS,IAAI,YAAY,CAAC,uBAAuB,EAAE,CAAC;IACxF,CAAC;IAED,iBAAiB;QACf,IAAI,YAAY,CAAC,OAAO,EAAE,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,oBAAoB,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,sCAAsC,CAAC;QACpG,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,OAAO,CACL,oFAAoF;gBACpF,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,OAAO,sEAAsE,CAAC;IAChF,CAAC;IAED,MAAM;QACJ,6DAA6D;QAC7D,mDAAmD;QACnD,uEAAuE;QACvE,qEAAqE;QACrE,8BAA8B;QAC9B,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,eAAe,EAAE,CAAC,CAAC;QACrD,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACrC,iEAAiE;YACjE,iEAAiE;YACjE,oEAAoE;QACtE,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/backend-msb/provisioner.d.ts

@@ -0,0 +1,19 @@
+import type { Platform } from "./platform.js";
+export declare const MSB_VERSION = "0.6.3";
+/** Test seam: the full resolution logic parameterized over the release base URL, cache dir, and environment. */
+export declare function ensureInstalledAt(baseUrl: string, cacheDir: string, env: Record<string, string | undefined>): Promise<string>;
+/** Resolves (downloading and verifying if needed) a runnable `msb` binary path, using the real GitHub release base, `RIGHTSIZE_CACHE_DIR`, and `process.env`. */
+export declare function ensureInstalled(): Promise<string>;
+/** Test-only access to the pure checksum-line parser, exercised against real-shape and malformed input. */
+export declare function _parseChecksumsForTests(text: string): Map<string, string>;
+/**
+ * Test-only seam: `downloadAndInstall` parameterized over an injected
+ * `Platform` value, rather than the real `PlatformInfo.current()`. This is
+ * how the `.exe`/`.dll` install shape (Windows asset names, `bin\msb.exe`,
+ * unversioned `lib\libkrunfw.dll`) is exercised against the real
+ * download-verify-rename pipeline from a non-Windows CI/dev machine — the
+ * public `ensureInstalledAt` always resolves the platform from the real
+ * process, so it can only ever prove the CURRENT host's shape without this.
+ */
+export declare function _downloadAndInstallForTests(baseUrl: string, platform: Platform, installDir: string, msbPath: string, krunPath: string): Promise<void>;
+//# sourceMappingURL=provisioner.d.ts.map

package/dist/backend-msb/provisioner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../../src/backend-msb/provisioner.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,eAAO,MAAM,WAAW,UAAU,CAAC;AAiSnC,gHAAgH;AAChH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC,CA8CjB;AAED,iKAAiK;AACjK,wBAAgB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAEjD;AAED,2GAA2G;AAC3G,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAEzE;AAED;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAEf"}