windows-development-sandbox 1.1.0 → 1.4.0

package/dist/shared/schema.d.ts

@@ -19,6 +19,7 @@ export declare const SandboxStatus: z.ZodObject<{
     workspaceHost: z.ZodString;
     guestWorkspace: z.ZodString;
     headless: z.ZodBoolean;
+    addresses: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 /**
  * A project the host registered after boot (sandbox claude from another folder): everything the guest needs to
@@ -118,6 +119,9 @@ export declare const ProjectSpec: z.ZodObject<{
         }, z.core.$strict>;
         vscode: z.ZodObject<{
             enabled: z.ZodBoolean;
+            setup: z.ZodBoolean;
+            recommended: z.ZodBoolean;
+            extensions: z.ZodArray<z.ZodString>;
         }, z.core.$strict>;
         environment: z.ZodRecord<z.ZodString, z.ZodString>;
     }, z.core.$strict>;
@@ -259,6 +263,9 @@ export declare const GuestRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
             }, z.core.$strict>;
             vscode: z.ZodObject<{
                 enabled: z.ZodBoolean;
+                setup: z.ZodBoolean;
+                recommended: z.ZodBoolean;
+                extensions: z.ZodArray<z.ZodString>;
             }, z.core.$strict>;
             environment: z.ZodRecord<z.ZodString, z.ZodString>;
         }, z.core.$strict>;
@@ -408,6 +415,9 @@ export declare const GuestRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
             }, z.core.$strict>;
             vscode: z.ZodObject<{
                 enabled: z.ZodBoolean;
+                setup: z.ZodBoolean;
+                recommended: z.ZodBoolean;
+                extensions: z.ZodArray<z.ZodString>;
             }, z.core.$strict>;
             environment: z.ZodRecord<z.ZodString, z.ZodString>;
         }, z.core.$strict>;

package/dist/shared/schema.js

@@ -19,6 +19,8 @@ export const SandboxStatus = z.object({
     workspaceHost: Text(),
     guestWorkspace: Text(),
     headless: z.boolean(),
+    /** The sandbox's IPv4 addresses (for network.forwardPorts; the host only uses ones on its Hyper-V network). */
+    addresses: z.array(z.string().max(45)).max(8).optional(),
 });
 const Version = z.strictObject({ spec: Text(128), source: Text(256) });
 const DatabasePlan = z.strictObject({

package/dist/shared/system.d.ts

@@ -12,4 +12,5 @@ export declare const SYSTEM: {
     readonly robocopy: () => string;
     readonly shutdown: () => string;
     readonly dism: () => string;
+    readonly msiexec: () => string;
 };

package/dist/shared/system.js

@@ -16,4 +16,5 @@ export const SYSTEM = {
     robocopy: () => system32('Robocopy.exe'),
     shutdown: () => system32('shutdown.exe'),
     dism: () => system32('Dism.exe'),
+    msiexec: () => system32('msiexec.exe'),
 };

package/dist/sync/claude-mem.js

@@ -1,7 +1,7 @@
 // claude-mem data (~/.claude-mem) between this PC and the sandbox's persistent store.
 //
 // IN (this PC -> sandbox): the whole folder is mirrored; nothing flows to your PC in that direction.
-// OUT (sandbox -> this PC): ONLY the SQLite database files come back. Never settings, never the Chroma vector store:
+// OUT (sandbox -> this PC), only with claudeProfile.syncClaudeMemBack: ONLY the SQLite database files come back. Never settings, never the Chroma vector store:
 // Chroma keeps Python pickle files, and a crafted pickle runs code when loaded, so copying it back would let a
 // compromised sandbox execute code on your PC. claude-mem rebuilds its vector index from the database by itself.
 import fs from 'node:fs';
@@ -10,7 +10,8 @@ import _ from 'lodash';
 import { dirExists, homeDir, isLink } from '../core/util.js';
 import { safeRemove } from '../shared/safe-remove.js';
 import { assertTestWritable } from '../host/test-guard.js';
-const SKIP_IN = /(^logs$|\.pid$|\.port$|\.lock$|^worker.*\.json$|\.incoming$|\.conflict-\d+$)/i;
+// Never in: its settings (provider API keys), .env files and backups; nor run-time files that mean nothing elsewhere.
+const SKIP_IN = /(^logs$|^backups?$|^settings\.json$|^\.env|\.pid$|\.port$|\.lock$|^worker.*\.json$|\.incoming$|\.conflict-\d+$)/i;
 /** The only files that may come back from the sandbox. */
 const DATABASE = /^claude-mem\.db(-wal|-shm)?$/i;
 const MAX_DB_BYTES = 2 * 1024 * 1024 * 1024;

package/dist/sync/history.d.ts

@@ -7,6 +7,11 @@ declare const SyncStateSchema: z.ZodObject<{
     guestWorkspace: z.ZodString;
     syncHistory: z.ZodOptional<z.ZodBoolean>;
     syncClaudeMem: z.ZodOptional<z.ZodBoolean>;
+    syncClaudeMemBack: z.ZodOptional<z.ZodBoolean>;
+    historyScope: z.ZodOptional<z.ZodEnum<{
+        project: "project";
+        all: "all";
+    }>>;
     memHostStamp: z.ZodOptional<z.ZodNumber>;
     memGuestStamp: z.ZodOptional<z.ZodNumber>;
     projects: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -28,6 +33,7 @@ export interface SyncPaths extends WorkspacePair {
 /** Brings this PC's history into the sandbox state (run before the sandbox starts). Returns files copied. */
 export declare const syncHistoryIn: (p: SyncPaths, options?: {
     promptHistory?: boolean;
+    scope?: "project" | "all";
 }) => number;
 /** Copies new sandbox history back to this PC (safe while the sandbox runs: transcripts are append-only). */
 export declare const syncHistoryOut: (p: SyncPaths) => number;

package/dist/sync/history.js

@@ -7,8 +7,11 @@
 //
 // Safety (the sandbox side is untrusted):
 //  - links are never followed or written through, on either side;
-//  - what comes BACK is limited to transcripts (.jsonl), prompt history and to-do lists (.json), each capped in
-//    size, and never Claude's memory folders. Nothing executable or instruction-like flows to this PC.
+//  - what comes BACK is limited to the sandbox's own projects: their transcripts (.jsonl) and prompt-history lines,
+//    plus to-do lists (.json), each capped in size, and never Claude's memory folders. A sandbox cannot plant a
+//    conversation for another project on this PC (claude --resume there would load it);
+//  - what goes IN is, by default (historyScope "project"), only the sandbox's own projects: other projects'
+//    conversations, file backups and prompts are not the agent's business.
 import fs from 'node:fs';
 import path from 'node:path';
 import _ from 'lodash';
@@ -25,7 +28,7 @@ const MAX_FILE_BYTES = 100 * 1024 * 1024;
 const AbsolutePath = z.string().max(1024).refine((p) => path.isAbsolute(p), 'must be an absolute path');
 const SyncStateSchema = z.object({
     hostClaudeDir: AbsolutePath, hostWorkspace: AbsolutePath, guestWorkspace: z.string().max(1024),
-    syncHistory: z.boolean().optional(), syncClaudeMem: z.boolean().optional(),
+    syncHistory: z.boolean().optional(), syncClaudeMem: z.boolean().optional(), syncClaudeMemBack: z.boolean().optional(), historyScope: z.enum(['project', 'all']).optional(),
     /** Newest claude-mem database time on each side right after the last sync (detects edits on both sides). */
     memHostStamp: z.number().optional(), memGuestStamp: z.number().optional(),
     /** Projects registered while the sandbox ran (their history goes back to their own folders). */
@@ -91,6 +94,16 @@ const isJsonObject = (line) => { try {
 catch {
     return false;
 } };
+/** A prompt-history line whose project is one of `workspaces` (on this PC's side). */
+const inProjects = (line, workspaces) => {
+    try {
+        const project = JSON.parse(line).project;
+        return typeof project === 'string' && workspaces.some((w) => path.resolve(w).toLowerCase() === path.resolve(project).toLowerCase());
+    }
+    catch {
+        return false;
+    }
+};
 const lineTime = (line) => { try {
     return Number(JSON.parse(line).timestamp) || 0;
 }
@@ -102,22 +115,24 @@ const pairsOf = (p) => _.sortBy([{ hostWorkspace: p.hostWorkspace, guestWorkspac
 const translateAll = (text, pairs) => pairs.reduce((out, [from, to]) => translatePaths(out, from, to), text);
 /** Brings this PC's history into the sandbox state (run before the sandbox starts). Returns files copied. */
 export const syncHistoryIn = (p, options = {}) => {
+    const all = options.scope === 'all';
     assertTestWritable(p.guestClaudeDir);
     const pairs = pairsOf(p);
     const byHost = new Map(pairs.map((x) => [projectFolderName(x.hostWorkspace), projectFolderName(x.guestWorkspace)]));
     const guestNames = new Set(pairs.map((x) => projectFolderName(x.guestWorkspace)));
     const transform = (t) => translateAll(t, pairs.map((x) => [x.hostWorkspace, x.guestWorkspace]));
     const hostProjects = path.join(p.hostClaudeDir, 'projects');
-    const names = dirExists(hostProjects) ? fs.readdirSync(hostProjects).filter((name) => isSafeFileName(name) && (!guestNames.has(name) || byHost.has(name))) : [];
+    const names = dirExists(hostProjects) ? fs.readdirSync(hostProjects).filter((name) => isSafeFileName(name) && (all ? !guestNames.has(name) || byHost.has(name) : byHost.has(name))) : [];
     const projects = _.sumBy(names, (name) => byHost.has(name)
         ? copyNewer(path.join(hostProjects, name), path.join(p.guestClaudeDir, 'projects', byHost.get(name)), { transform })
         : copyNewer(path.join(hostProjects, name), path.join(p.guestClaudeDir, 'projects', name)));
-    const sessions = _.sumBy(SESSION_DIRS, (dir) => copyNewer(path.join(p.hostClaudeDir, dir), path.join(p.guestClaudeDir, dir)));
+    // To-do lists, plans and file backups are kept by session, not by project: only with historyScope "all".
+    const sessions = all ? _.sumBy(SESSION_DIRS, (dir) => copyNewer(path.join(p.hostClaudeDir, dir), path.join(p.guestClaudeDir, dir))) : 0;
     if (options.promptHistory === false)
         return projects + sessions;
     // Prompt history: rebuild the sandbox copy from this PC's file plus anything only the sandbox has.
     const target = path.join(p.guestClaudeDir, 'history.jsonl');
-    const hostLines = readLines(path.join(p.hostClaudeDir, 'history.jsonl')).map(transform);
+    const hostLines = readLines(path.join(p.hostClaudeDir, 'history.jsonl')).filter((l) => all || inProjects(l, pairs.map((x) => x.hostWorkspace))).map(transform);
     const known = new Set(hostLines);
     const merged = _.sortBy([...hostLines, ...readLines(target).filter((l) => !known.has(l))], lineTime);
     if (merged.length) {
@@ -136,15 +151,15 @@ export const syncHistoryOut = (p) => {
     const transform = (t) => translateAll(t, pairs);
     const guestProjectsDir = path.join(p.guestClaudeDir, 'projects');
     const names = dirExists(guestProjectsDir) && !isLink(guestProjectsDir) ? fs.readdirSync(guestProjectsDir).filter(isSafeFileName) : [];
-    const projects = _.sumBy(names, (name) => byGuest.has(name)
-        ? copyNewer(path.join(guestProjectsDir, name), path.join(p.hostClaudeDir, 'projects', byGuest.get(name)), { accept: transcript, skipDirs: NO_MEMORY, transform })
-        : copyNewer(path.join(guestProjectsDir, name), path.join(p.hostClaudeDir, 'projects', name), { accept: transcript, skipDirs: NO_MEMORY }));
+    // Only this sandbox's projects: a transcript under any other folder name would be planted into that project on this PC.
+    const projects = _.sumBy(names.filter((name) => byGuest.has(name)), (name) => copyNewer(path.join(guestProjectsDir, name), path.join(p.hostClaudeDir, 'projects', byGuest.get(name)), { accept: transcript, skipDirs: NO_MEMORY, transform }));
     // Only to-do lists come back besides transcripts; plans and file backups stay in the sandbox.
     const sessions = copyNewer(path.join(p.guestClaudeDir, 'todos'), path.join(p.hostClaudeDir, 'todos'), { accept: json });
     const hostFile = path.join(p.hostClaudeDir, 'history.jsonl');
     const known = new Set(readLines(hostFile));
-    // Only prompt-history entries (one JSON object per line) come back, whatever else the sandbox wrote in that file.
-    const missing = readLines(path.join(p.guestClaudeDir, 'history.jsonl')).filter(isJsonObject).map(transform).filter((l) => !known.has(l));
+    // Only prompt-history entries (one JSON object per line) of this sandbox's projects come back.
+    const hostWorkspaces = pairsOf(p).map((x) => x.hostWorkspace);
+    const missing = readLines(path.join(p.guestClaudeDir, 'history.jsonl')).filter(isJsonObject).map(transform).filter((l) => inProjects(l, hostWorkspaces) && !known.has(l));
     if (missing.length) {
         ensureDir(p.hostClaudeDir);
         fs.appendFileSync(hostFile, missing.join('\n') + '\n', 'utf8');

package/dist/sync/watcher.js

@@ -9,6 +9,12 @@ import { assertNoLinks, errMsg, sleep } from '../core/util.js';
 import { hostClaudeDir } from '../host/claude-profile.js';
 import { checkRepo } from '../host/repo-guard.js';
 import { isSandboxRunning } from '../host/platform.js';
+import { readActiveViews, WorkspaceView } from '../host/workspace-view/index.js';
+import { readForwards, sandboxAddress, startPortForwards } from '../host/port-forward.js';
+import { AuditCollector, readAuditSettings } from '../host/audit/collect.js';
+import { readMarkedProjects, saveDataSize, watchAndMark } from '../host/motw.js';
+import { sizeOf } from '../core/disk.js';
+import { beatLife, causeSince, endLife, keepAwake, readLife } from '../host/stops.js';
 import { hostClaudeMemDir, syncClaudeMem } from './claude-mem.js';
 import { readSyncState, syncHistoryIn, syncHistoryOut, writeSyncState } from './history.js';
 const WATCH_INTERVAL_MS = 60 * 1000;
@@ -32,7 +38,7 @@ export const syncProjectIn = (dataPath, project) => {
     const next = { ...state, projects };
     writeSyncState(dataPath, next);
     // Prompt history is left alone: sessions are appending to the sandbox's copy right now.
-    return state.syncHistory ? syncHistoryIn(toPaths(next, dataPath), { promptHistory: false }) : 0;
+    return state.syncHistory ? syncHistoryIn(toPaths(next, dataPath), { promptHistory: false, scope: state.historyScope }) : 0;
 };
 const memSync = (dataPath, state, direction) => {
     assertNoLinks(dataPath, guestMem(dataPath));
@@ -47,11 +53,11 @@ export const syncBeforeLaunch = (config, dataPath, hostWorkspace) => {
     const previous = readSyncState(dataPath);
     if (previous?.syncHistory)
         syncHistoryOut(toPaths(previous, dataPath));
-    const state = { ...previous, hostClaudeDir: hostClaudeDir(profile), hostWorkspace, guestWorkspace: config.guestWorkspace, syncHistory: profile.syncHistory, syncClaudeMem: profile.syncClaudeMem, projects: [] };
+    const state = { ...previous, hostClaudeDir: hostClaudeDir(profile), hostWorkspace, guestWorkspace: config.guestWorkspace, syncHistory: profile.syncHistory, historyScope: profile.historyScope, syncClaudeMem: profile.syncClaudeMem, syncClaudeMemBack: profile.syncClaudeMemBack, projects: [] };
     if (profile.syncHistory)
-        summary.history = syncHistoryIn(toPaths(state, dataPath));
+        summary.history = syncHistoryIn(toPaths(state, dataPath), { scope: profile.historyScope });
     if (profile.syncClaudeMem) {
-        if (previous?.syncClaudeMem)
+        if (previous?.syncClaudeMem && previous.syncClaudeMemBack)
             memSync(dataPath, state, 'out');
         summary.claudeMem = memSync(dataPath, state, 'in');
     }
@@ -66,7 +72,7 @@ export const syncBack = (dataPath, final) => {
         return summary;
     if (state.syncHistory)
         summary.history = syncHistoryOut(toPaths(state, dataPath));
-    if (final && state.syncClaudeMem)
+    if (final && state.syncClaudeMem && state.syncClaudeMemBack)
         summary.claudeMem = memSync(dataPath, state, 'out');
     writeSyncState(dataPath, state);
     return summary;
@@ -105,8 +111,10 @@ export const watch = async (dataPath) => {
     catch { /* ignore */ } };
     const sync = (final) => {
         try {
-            for (const finding of checkRepo(dataPath))
+            for (const finding of checkRepo(dataPath)) {
                 note('SECURITY: neutralised a git ' + finding.kind + ' added inside the sandbox: ' + finding.detail);
+                audit?.guard(finding.kind + ': ' + finding.detail);
+            }
         }
         catch (e) {
             note('repo guard failed: ' + errMsg(e));
@@ -120,16 +128,80 @@ export const watch = async (dataPath) => {
             note('sync failed: ' + errMsg(e));
         }
     };
+    // workspaceFilter: each filtered project is kept in step with its view from now until the sandbox closes.
+    // audit.enabled: programs, files, sessions and guard findings into the host-only audit log.
+    const auditSettings = readAuditSettings(storageOf(dataPath), dataPath);
+    const audit = auditSettings?.enabled ? new AuditCollector(dataPath, storageOf(dataPath), auditSettings) : null;
+    audit?.start();
+    const auditTimer = audit ? setInterval(() => { try {
+        audit.flush();
+    }
+    catch (e) {
+        note('audit: ' + errMsg(e));
+    } }, 10000) : null;
+    // storage.markSandboxFiles: programs and scripts that appear in the projects get the "from the internet" mark.
+    const stopMarking = watchAndMark(readMarkedProjects(storageOf(dataPath), dataPath), (m) => note(m));
+    // network.forwardPorts: localhost on this PC reaches servers in the sandbox while it runs.
+    const stopForwards = startPortForwards(readForwards(storageOf(dataPath), dataPath), () => sandboxAddress(dataPath), (m) => note('port forward: ' + m));
+    const views = readActiveViews(storageOf(dataPath), dataPath);
+    const stops = views.flatMap((v) => {
+        try {
+            return [new WorkspaceView({ ...v, note: (m) => note('workspace ' + v.host + ': ' + m) }).watch()];
+        }
+        catch (e) {
+            note('workspace ' + v.host + ': could not watch: ' + errMsg(e));
+            return [];
+        }
+    });
+    // sandbox.keepAwake, and the life record that tells the next launch how this run ended (host/stops.ts).
+    const awake = readLife(storageOf(dataPath), dataPath)?.keepAwake ? keepAwake(process.pid) : null;
     try {
         await sleep(30000);
         while (isSandboxRunning()) {
+            beatLife(storageOf(dataPath), dataPath);
             sync(false);
             await sleep(WATCH_INTERVAL_MS);
         }
+        try {
+            const life = readLife(storageOf(dataPath), dataPath);
+            const cause = life ? causeSince(life.lastSeen) : null;
+            endLife(storageOf(dataPath), dataPath, cause);
+            if (cause)
+                note('sandbox ended: ' + cause.text);
+        }
+        catch (e) {
+            note('could not record how the sandbox ended: ' + errMsg(e));
+        }
         await sleep(3000);
         sync(true);
     }
     finally {
+        awake?.kill();
+        stops.forEach((stop) => stop());
+        stopForwards();
+        stopMarking();
+        if (auditTimer)
+            clearInterval(auditTimer);
+        try {
+            audit?.stop();
+        }
+        catch (e) {
+            note('audit: ' + errMsg(e));
+        }
+        for (const v of views) {
+            try {
+                const s = new WorkspaceView(v).syncAll();
+                note('workspace ' + v.host + ': final sync ' + s.toHost + ' out, ' + s.toView + ' in');
+            }
+            catch (e) {
+                note('workspace ' + v.host + ': final sync failed: ' + errMsg(e));
+            }
+        }
+        // For the next launch's storage.warnDataGb (measuring then would be slow).
+        try {
+            saveDataSize(storageOf(dataPath), dataPath, sizeOf(dataPath));
+        }
+        catch { /* best effort */ }
         fs.rmSync(watcherPidFile(dataPath), { force: true });
     }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "windows-development-sandbox",
-  "version": "1.1.0",
+  "version": "1.4.0",
   "description": "A disposable Windows Sandbox for development, with or without an AI agent (Claude Code, Codex, Gemini, opencode, ...): the folder you run it from is the workspace, toolchains and databases for your project install themselves, and nothing else on your PC is reachable.",
   "type": "module",
   "license": "MIT",
@@ -72,6 +72,7 @@
   "dependencies": {
     "@inquirer/prompts": "^7.10.1",
     "commander": "^14.0.3",
+    "ignore": "^7.0.12",
     "jsonc-parser": "^3.3.1",
     "lodash": "^4.18.1",
     "zod": "^4.6.5"

package/sandbox/cargoshim.cs

@@ -0,0 +1,56 @@
+// cargo.exe stand-in for toolchains.rust.targetDir = "separate": every checkout builds into ITS OWN target\sandbox.
+// One CARGO_TARGET_DIR for the whole sandbox made agents working in different git worktrees overwrite each other's
+// builds (and the Claude Code Bash tool does not keep a per-call variable). The checkout is the nearest folder with a
+// .git (a folder, or the file a worktree has); without one, the nearest folder with a Cargo.toml. A CARGO_TARGET_DIR
+// you set yourself always wins. Compiled inside the sandbox with the .NET Framework csc.exe (C# 5).
+using System;
+using System.Diagnostics;
+using System.IO;
+
+static class CargoShim
+{
+    static int Main()
+    {
+        string real = Environment.GetEnvironmentVariable("AGENT_REAL_CARGO");
+        if (string.IsNullOrEmpty(real) || !File.Exists(real))
+        {
+            Console.Error.WriteLine("error: the real cargo was not found (AGENT_REAL_CARGO).");
+            return 101;
+        }
+        var start = new ProcessStartInfo(real, ArgumentsOf(Environment.CommandLine)) { UseShellExecute = false };
+        if (string.IsNullOrEmpty(Environment.GetEnvironmentVariable("CARGO_TARGET_DIR")))
+        {
+            string root = CheckoutOf(Environment.CurrentDirectory);
+            if (root != null) start.EnvironmentVariables["CARGO_TARGET_DIR"] = Path.Combine(root, "target", "sandbox");
+        }
+        // Ctrl+C reaches cargo too (same console); the shim only waits for it to finish.
+        Console.CancelKeyPress += delegate(object sender, ConsoleCancelEventArgs e) { e.Cancel = true; };
+        using (Process p = Process.Start(start))
+        {
+            p.WaitForExit();
+            return p.ExitCode;
+        }
+    }
+
+    static string CheckoutOf(string dir)
+    {
+        string cargoRoot = null;
+        for (var d = new DirectoryInfo(dir); d != null; d = d.Parent)
+        {
+            string git = Path.Combine(d.FullName, ".git");
+            if (Directory.Exists(git) || File.Exists(git)) return d.FullName;
+            if (cargoRoot == null && File.Exists(Path.Combine(d.FullName, "Cargo.toml"))) cargoRoot = d.FullName;
+        }
+        return cargoRoot;
+    }
+
+    // Everything after the program name, untouched, so quoting survives exactly as the caller wrote it.
+    static string ArgumentsOf(string commandLine)
+    {
+        string s = commandLine.TrimStart();
+        int end;
+        if (s.StartsWith("\"")) { end = s.IndexOf('"', 1); end = end < 0 ? s.Length : end + 1; }
+        else { end = s.IndexOf(' '); if (end < 0) end = s.Length; }
+        return s.Substring(end).TrimStart();
+    }
+}

package/sandbox/cpucap.cs

@@ -0,0 +1,33 @@
+// Caps a process and everything it starts at a share of the PC's CPU. Loaded by cpucap.ps1 (Add-Type). C# 5.
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+
+public static class SandboxCpuCap {
+    // JOBOBJECT_CPU_RATE_CONTROL_INFORMATION.
+    [StructLayout(LayoutKind.Sequential)]
+    private struct CpuRate { public uint ControlFlags; public uint Rate; }
+
+    [DllImport("kernel32.dll", SetLastError = true)] private static extern IntPtr CreateJobObject(IntPtr attributes, string name);
+    [DllImport("kernel32.dll", SetLastError = true)] private static extern bool SetInformationJobObject(IntPtr job, int infoClass, ref CpuRate info, int length);
+    [DllImport("kernel32.dll", SetLastError = true)] private static extern IntPtr OpenProcess(uint access, bool inherit, int pid);
+    [DllImport("kernel32.dll", SetLastError = true)] private static extern bool AssignProcessToJobObject(IntPtr job, IntPtr process);
+    [DllImport("kernel32.dll")] private static extern bool CloseHandle(IntPtr handle);
+
+    private const int JobObjectCpuRateControlInformation = 15;
+    private const uint CpuRateEnable = 0x1, CpuRateHardCap = 0x4;
+    private const uint ProcessTerminate = 0x0001, ProcessSetQuota = 0x0100;  // what AssignProcessToJobObject needs
+
+    /// <summary>Puts process pid in a new job with a hard cap of percent % of all processors. Throws on failure.</summary>
+    public static void Apply(int pid, int percent) {
+        IntPtr job = CreateJobObject(IntPtr.Zero, null);
+        if (job == IntPtr.Zero) throw new Win32Exception();
+        // The rate is in 1/100 % of all processors.
+        CpuRate rate = new CpuRate { ControlFlags = CpuRateEnable | CpuRateHardCap, Rate = (uint)(percent * 100) };
+        if (!SetInformationJobObject(job, JobObjectCpuRateControlInformation, ref rate, Marshal.SizeOf(typeof(CpuRate)))) throw new Win32Exception();
+        IntPtr process = OpenProcess(ProcessSetQuota | ProcessTerminate, false, pid);
+        if (process == IntPtr.Zero) throw new Win32Exception();
+        try { if (!AssignProcessToJobObject(job, process)) throw new Win32Exception(); } finally { CloseHandle(process); }
+        // The job's handle is left to close with this process: the job lives on while any process in it runs.
+    }
+}

package/sandbox/cpucap.ps1

@@ -3,46 +3,15 @@
 # every processor, so heavy builds inside can take the whole PC. This puts logon.cmd (the parent of this script),
 # before it starts anything, into a Windows job object with a hard CPU-rate cap; everything it starts inherits it:
 # Windows Terminal and its tabs, the boot, the agents, installs and builds. Programs started from the sandbox's Start
-# menu are not covered. Never stops the boot: any problem is logged and the sandbox starts uncapped.
-param([int]$ProcessId = 0, [int]$Percent = 0)
+# menu are not covered. Never stops the boot: it logs one line either way and the sandbox starts uncapped on failure.
+param([int]$ProcessId = 0, [int]$Percent = 0)  # 0 = the parent process / cpuLimitPercent from session.json
 $ErrorActionPreference = 'Stop'
 $log = 'C:\AgentData\logs\logon-hit.txt'
 try {
-    if ($Percent -eq 0) {
-        $session = Get-Content -LiteralPath 'C:\AgentLaunch\session.json' -Raw -Encoding UTF8 | ConvertFrom-Json
-        if ($null -eq $session.cpuLimitPercent) { exit 0 }
-        $Percent = [int]$session.cpuLimitPercent
-    }
+    if ($Percent -eq 0) { $Percent = [int](Get-Content -LiteralPath 'C:\AgentLaunch\session.json' -Raw -Encoding UTF8 | ConvertFrom-Json).cpuLimitPercent }
     if ($Percent -lt 1 -or $Percent -ge 100) { exit 0 }
     if ($ProcessId -eq 0) { $ProcessId = [int](Get-CimInstance Win32_Process -Filter "ProcessId=$PID").ParentProcessId }
-    Add-Type -TypeDefinition @'
-using System;
-using System.ComponentModel;
-using System.Runtime.InteropServices;
-public static class SandboxCpuCap {
-    [StructLayout(LayoutKind.Sequential)]
-    private struct CpuRate { public uint ControlFlags; public uint Rate; }
-    [DllImport("kernel32.dll", SetLastError = true)] private static extern IntPtr CreateJobObject(IntPtr attributes, string name);
-    [DllImport("kernel32.dll", SetLastError = true)] private static extern bool SetInformationJobObject(IntPtr job, int infoClass, ref CpuRate info, int length);
-    [DllImport("kernel32.dll", SetLastError = true)] private static extern IntPtr OpenProcess(uint access, bool inherit, int pid);
-    [DllImport("kernel32.dll", SetLastError = true)] private static extern bool AssignProcessToJobObject(IntPtr job, IntPtr process);
-    [DllImport("kernel32.dll")] private static extern bool CloseHandle(IntPtr handle);
-    // JobObjectCpuRateControlInformation; ENABLE | HARD_CAP; the rate is in 1/100 % of all processors.
-    public static void Apply(int pid, int percent) {
-        IntPtr job = CreateJobObject(IntPtr.Zero, null);
-        if (job == IntPtr.Zero) throw new Win32Exception();
-        CpuRate rate = new CpuRate();
-        rate.ControlFlags = 0x1 | 0x4;
-        rate.Rate = (uint)(percent * 100);
-        if (!SetInformationJobObject(job, 15, ref rate, Marshal.SizeOf(typeof(CpuRate)))) throw new Win32Exception();
-        // PROCESS_SET_QUOTA | PROCESS_TERMINATE: what AssignProcessToJobObject needs.
-        IntPtr process = OpenProcess(0x0100 | 0x0001, false, pid);
-        if (process == IntPtr.Zero) throw new Win32Exception();
-        try { if (!AssignProcessToJobObject(job, process)) throw new Win32Exception(); } finally { CloseHandle(process); }
-        // The job's handle may close: it lives on while any process in it runs.
-    }
-}
-'@
+    Add-Type -Path (Join-Path $PSScriptRoot 'cpucap.cs')
     [SandboxCpuCap]::Apply($ProcessId, $Percent)
     "CPU capped at $Percent% of the PC (sandbox.cpuLimit)." | Add-Content -LiteralPath $log
 } catch {

package/sandbox/logon.cmd

@@ -4,9 +4,15 @@ rem (downloaded once by the host into persistent storage), or a plain PowerShell
 if not exist C:\AgentData\logs mkdir C:\AgentData\logs
 echo logon.cmd ran at %date% %time% > C:\AgentData\logs\logon-hit.txt
 call C:\AgentLaunch\sandbox\trust.cmd
+rem New Terminal tabs start in %AGENT_WORKSPACE%: Terminal must have it before the runtime sets it machine-wide.
+if exist C:\AgentLaunch\env.cmd call C:\AgentLaunch\env.cmd
 set "PS=%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe"
 rem sandbox.cpuLimit: this window joins a CPU-capped job first, so everything started below inherits the cap.
 "%PS%" -NoLogo -NoProfile -ExecutionPolicy Bypass -File C:\AgentLaunch\sandbox\cpucap.ps1
+rem sandbox.pageFileMb: room for many parallel builds (the sandbox starts with about 1 GB of paging file).
+"%PS%" -NoLogo -NoProfile -ExecutionPolicy Bypass -File C:\AgentLaunch\sandbox\pagefile.ps1
+rem The memory state every 30 s into the persistent logs, so a crash leaves evidence.
+start "" /min "%PS%" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\AgentLaunch\sandbox\memlog.ps1
 set "BOOT=%PS% -NoLogo -NoProfile -ExecutionPolicy Bypass -NoExit -File C:\AgentLaunch\sandbox\bootstrap.ps1"
 if not exist C:\AgentData\tools\terminal\wt.exe goto plain
 start "" C:\AgentData\tools\terminal\wt.exe --maximized new-tab --title "Agent Sandbox" -d C:\AgentLaunch %BOOT%

package/sandbox/memlog.ps1

@@ -0,0 +1,34 @@
+#Requires -Version 5.1
+# Writes the sandbox's memory state to C:\AgentData\logs\memory-<time>.log every 30 seconds, while it runs. That folder
+# outlives the sandbox, so if Windows inside it ever crashes again, the last lines show what was using memory just
+# before. Bounded: a file is closed at 1 MB (about two days) and a new one started; only the newest 10 are kept, so
+# the logs never take more than about 10 MB. Started hidden by logon.cmd. Never stops the boot.
+$ErrorActionPreference = 'SilentlyContinue'
+$logFolder = 'C:\AgentData\logs'
+$maxFileBytes = 1MB
+$keepFiles = 10
+
+# A new log file, and the oldest ones beyond $keepFiles removed. Returns its path.
+function New-MemoryLog {
+    $path = Join-Path $logFolder ('memory-{0:yyyyMMdd-HHmmss}.log' -f (Get-Date))
+    'time     | RAM used/total MB | commit used/limit MB | biggest processes (private MB)' | Set-Content -LiteralPath $path
+    Get-ChildItem -LiteralPath $logFolder -Filter 'memory-*.log' | Sort-Object LastWriteTime -Descending |
+        Select-Object -Skip $keepFiles | Remove-Item -Force
+    return $path
+}
+
+$logPath = New-MemoryLog
+while ($true) {
+    $os = Get-CimInstance Win32_OperatingSystem
+    $ramTotalMb = [math]::Round($os.TotalVisibleMemorySize / 1KB)
+    $ramUsedMb = $ramTotalMb - [math]::Round($os.FreePhysicalMemory / 1KB)
+    $commitLimitMb = [math]::Round($os.TotalVirtualMemorySize / 1KB)
+    $commitUsedMb = $commitLimitMb - [math]::Round($os.FreeVirtualMemory / 1KB)
+    $processes = @(Get-Process)
+    $biggest = $processes | Sort-Object PrivateMemorySize64 -Descending | Select-Object -First 5 |
+        ForEach-Object { '{0} {1}' -f $_.ProcessName, [math]::Round($_.PrivateMemorySize64 / 1MB) }
+    '{0:HH:mm:ss} | {1}/{2} | {3}/{4} | {5} processes; {6}' -f (Get-Date), $ramUsedMb, $ramTotalMb, $commitUsedMb, $commitLimitMb, $processes.Count, ($biggest -join ', ') |
+        Add-Content -LiteralPath $logPath
+    if ((Get-Item -LiteralPath $logPath).Length -ge $maxFileBytes) { $logPath = New-MemoryLog }
+    Start-Sleep -Seconds 30
+}

package/sandbox/pagefile.cs

@@ -0,0 +1,31 @@
+// Sets the size of the sandbox's paging file at once, with no restart. Loaded by pagefile.ps1 (Add-Type). C# 5.
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+
+public static class SandboxPageFile {
+    // UNICODE_STRING. The marshaller copies Buffer to native memory for the length of the call.
+    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+    private struct NtString { public ushort Length; public ushort MaximumLength; public string Buffer; }
+
+    [DllImport("ntdll.dll")] private static extern int RtlAdjustPrivilege(int privilege, bool enable, bool currentThread, out bool wasEnabled);
+    [DllImport("ntdll.dll")] private static extern int NtCreatePagingFile(ref NtString path, ref long minimumBytes, ref long maximumBytes, uint priority);
+    [DllImport("ntdll.dll")] private static extern int RtlNtStatusToDosError(int status);
+
+    private const int SeCreatePagefilePrivilege = 15;
+
+    /// <summary>Makes C:\pagefile.sys sizeMb, fixed (it never grows). Throws with Windows' reason on failure.</summary>
+    public static void Set(int sizeMb) {
+        bool wasEnabled;
+        Check(RtlAdjustPrivilege(SeCreatePagefilePrivilege, true, false, out wasEnabled));
+        // The same call Windows makes at startup; for the existing file it changes the size in place.
+        const string path = @"\??\C:\pagefile.sys";
+        NtString name = new NtString { Length = (ushort)(path.Length * 2), MaximumLength = (ushort)(path.Length * 2 + 2), Buffer = path };
+        long minimum = sizeMb * 1048576L, maximum = minimum;
+        Check(NtCreatePagingFile(ref name, ref minimum, ref maximum, 0));
+    }
+
+    private static void Check(int status) {
+        if (status != 0) throw new Win32Exception(RtlNtStatusToDosError(status));
+    }
+}

package/sandbox/pagefile.ps1

@@ -0,0 +1,21 @@
+#Requires -Version 5.1
+# Gives the sandbox a paging file of sandbox.pageFileMb, created at full size now, before anything runs. Windows Sandbox
+# starts with about 1 GB, so parallel builds run out of memory ("The paging file is too small", os error 1455), and
+# then Windows grows the file while they run: both crashes of Windows inside the sandbox (13 Oct 2026, stop code 0x1A
+# MEMORY_MANAGEMENT) happened under that load. A fixed size never grows. Never stops the boot: it logs one line.
+param([int]$SizeMb = 0)  # 0 = read sandbox.pageFileMb from session.json
+$ErrorActionPreference = 'Stop'
+$log = 'C:\AgentData\logs\logon-hit.txt'
+try {
+    if ($SizeMb -eq 0) { $SizeMb = [int](Get-Content -LiteralPath 'C:\AgentLaunch\session.json' -Raw -Encoding UTF8 | ConvertFrom-Json).pageFileMb }
+    if ($SizeMb -le 0) { exit 0 }
+    # Keep 8 GB of the sandbox's disk free for everything else.
+    $SizeMb = [math]::Min($SizeMb, [math]::Floor((Get-PSDrive -Name C).Free / 1MB) - 8192)
+    if ($SizeMb -lt 1024) { throw 'too little free disk.' }
+    Add-Type -Path (Join-Path $PSScriptRoot 'pagefile.cs')
+    [SandboxPageFile]::Set($SizeMb)
+    "Paging file set to $SizeMb MB, fixed (sandbox.pageFileMb)." | Add-Content -LiteralPath $log
+} catch {
+    "Paging file left as it is: $($_.Exception.Message)" | Add-Content -LiteralPath $log
+}
+exit 0