windows-development-sandbox 1.10.0 → 1.11.4

package/dist/runtime/main.js

@@ -5532,7 +5532,7 @@ var require_lodash = __commonJS({
 });
 
 // src/guest/entries/main.ts
-import fs60 from "node:fs";
+import fs61 from "node:fs";
 import path74 from "node:path";
 
 // src/guest/runtime/paths.ts
@@ -25411,6 +25411,9 @@ var AttachSchema = external_exports.strictObject({
   ),
   autoHide: external_exports.boolean().describe(
     "Hide the Windows Sandbox window whenever this terminal attaches; it keeps running (sandbox show brings it back)."
+  ),
+  confirmCtrlC: external_exports.boolean().describe(
+    'In an attached terminal and the sandbox window, a single Ctrl+C is held back (the title says so) and only a second one within 1.5 seconds reaches the agent: a Ctrl+C meant as "copy" no longer stops it. Esc still stops an agent.'
   )
 });
 var AgentCommandsSchema = external_exports.strictObject({
@@ -25455,7 +25458,9 @@ var SandboxSchema = external_exports.strictObject({
   engine: external_exports.enum(["windows-sandbox", "hcs"]).describe(
     '(alpha) What runs the sandbox. "windows-sandbox" = Windows Sandbox (the default: desktop, Windows Terminal, GPU, clipboard, audio, printers). "hcs" = a headless Hyper-V isolated Server Core container for agents (no desktop, GPU or clipboard); it needs Windows features and an image on this PC (sandbox engine check hcs lists what is missing), and starting it is not enabled yet in this alpha. sandbox engine shows what each engine can do. Yours only: a project file (.sandbox-config.json) cannot set it.'
   ),
-  memoryMb: external_exports.union([external_exports.literal("auto"), external_exports.number().int().min(2048)]).describe('Sandbox RAM in MB (>= 2048), or "auto": free RAM minus reserveHostMb, capped at maxMemoryMb.'),
+  memoryMb: external_exports.union([external_exports.literal("auto"), external_exports.number().int().min(2048)]).describe(
+    'Sandbox RAM in MB (>= 2048), or "auto": free RAM minus reserveHostMb, capped at maxMemoryMb. Never more than this PC can keep in RAM for it (its RAM minus the larger of reserveHostMb and 25 %, 2 GB more with vGPU): a bigger value is lowered.'
+  ),
   maxMemoryMb: external_exports.number().int().positive().describe('Upper limit for memoryMb "auto".'),
   maxMemoryPercent: external_exports.number().int().min(10).max(100).describe(`memoryMb "auto" never takes more than this share of this PC's total RAM (percent).`),
   cpuLimit: external_exports.union([external_exports.literal("none"), external_exports.number().int().min(5).max(100)]).describe(
@@ -25468,10 +25473,10 @@ var SandboxSchema = external_exports.strictObject({
     'Memory always left for this PC when memoryMb is "auto": the sandbox gets at most (free RAM, and RAM plus paging file still unused) minus this.'
   ),
   agentMemoryHeadroomMb: external_exports.union([external_exports.literal("auto"), external_exports.literal("none"), external_exports.number().int().min(0)]).describe(
-    'Memory kept out of the agents reach inside the sandbox, in MB: everything the agents start (their builds, tests, tools) together may use at most the sandbox memory minus this; a runaway parallel build then gets out-of-memory errors in its own session instead of freezing or crashing the whole sandbox. "auto" = the larger of 2048 MB and 10 % of the sandbox memory; "none" = no limit. Yours only: a project file cannot change it.'
+    'The last resort that keeps the sandbox up, in MB below its commit limit (RAM plus paging file): builds are slowed down long before (sandbox.pressureResponse); only if everything the agents start together would take the sandbox to the very edge of its memory, where Windows inside it would start failing, is a build refused memory instead of Windows. "auto" = the larger of 1536 MB and 3 % of the commit limit; "none" = no backstop. Yours only: a project file cannot change it.'
   ),
   pressureResponse: external_exports.boolean().describe(
-    "When the sandbox (or this PC) runs low on memory, slow the heaviest build programs down (lower priority) and, if that is not enough, pause the biggest compiler for a few seconds at a time, so heavy parallel builds slow down instead of closing the sandbox. Never touches the agents themselves. Yours only: a project file cannot change it."
+    "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. Yours only: a project file cannot change it."
   ),
   vGpu: external_exports.boolean().describe(
     "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it)."
@@ -25617,7 +25622,7 @@ var ToolchainsSchema = external_exports.strictObject({
       `GNU host: "lld" links with Rust's own lld through MinGW's gcc (much less memory than GNU ld), "gnu" with GNU ld.`
     ),
     linkSlots: external_exports.union([external_exports.literal("auto"), external_exports.number().int().min(1).max(32)]).describe(
-      'GNU host: how many programs may link at the same time in the whole sandbox (other links wait). "auto" = one per 8 GB of sandbox memory, 2 to 4. Several agents linking big programs at once can take Windows down.'
+      'GNU host: how many programs may link at the same time in the whole sandbox (other links wait). "auto" = one per 3 GB of sandbox memory after 6 GB, 2 to 8 (the memory governor slows links down too when memory runs short).'
     )
   }),
   msvc: external_exports.strictObject({
@@ -25692,7 +25697,7 @@ var ToolchainsSchema = external_exports.strictObject({
   }),
   cli: external_exports.strictObject({
     gh: EnabledSchema.describe(
-      'GitHub CLI (gh). Only with provisioning.git.access "full": gh can push and merge through the GitHub API, past a read-only git. Your PC\'s gh login is never copied; `gh auth login` inside persists (GH_CONFIG_DIR). "auto" = when the project has a .github folder.'
+      'GitHub CLI (gh). Only with provisioning.git.access "full": gh can push and merge through the GitHub API, past a read-only git. Your PC\'s gh login is never copied; `gh auth login` inside persists (GH_CONFIG_DIR), unless a token you saved for sandboxes is handed over (github.shareToken). "auto" = when the project has a .github folder.'
     ),
     zstd: EnabledSchema.describe('Zstandard (zstd). "auto" = off; set true to get it.'),
     openssl: EnabledSchema.describe(
@@ -26620,6 +26625,13 @@ var VpnSchema = external_exports.strictObject({
   )
 });
 
+// src/core/schema/github.ts
+var GithubSchema = external_exports.strictObject({
+  shareToken: external_exports.boolean().describe(
+    'Give each sandbox the GitHub token you saved with `sandbox github login` (best a fine-grained token limited to some repositories and permissions), so gh and https git work there without logging in. Only with provisioning.git.access "full". The agent in the sandbox can read the token and use it for whatever it allows. A project file (.sandbox-config.json) cannot turn this on.'
+  )
+});
+
 // src/core/schema/config.ts
 var ConfigSchema = external_exports.strictObject({
   $schema: SchemaRefSchema.optional(),
@@ -26650,6 +26662,7 @@ var ConfigSchema = external_exports.strictObject({
   }),
   network: NetworkSchema,
   vpn: VpnSchema,
+  github: GithubSchema,
   provisioning: ProvisioningSchema,
   downloads: DownloadsSchema,
   toolchains: ToolchainsSchema,
@@ -26812,19 +26825,25 @@ var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
     id: IdSchema,
     reason: Text(300),
     seconds: external_exports.number().int().min(10).max(300),
+    /** "severe": the PC is nearly out of memory; builds go to the governor's last step at once. */
+    level: external_exports.enum(["slow", "severe"]).optional(),
     createdAt: TimeSchema
   })
 ]);
 var PressureStatusSchema = external_exports.object({
   level: external_exports.enum(["ok", "throttled", "suspending"]),
+  /** The governor's dial, 0 (nothing wrong) to 4 (one compiler at a time). */
+  step: external_exports.number().int().min(0).max(4).optional(),
   profile: external_exports.enum(["normal", "gentle"]),
   /** Share of the sandbox's RAM still free and of its commit limit in use (percent). */
   ramFreePercent: external_exports.number().int().min(0).max(100),
   commitPercent: external_exports.number().int().min(0).max(100),
   /** Programs running at lower priority because of it. */
   lowered: external_exports.number().int().min(0).max(1024),
-  /** Programs paused right now (name, process id, seconds left). */
+  /** Compilers waiting their turn right now (name, process id, seconds until they may go on). */
   paused: external_exports.array(external_exports.object({ name: Text(64), pid: external_exports.number().int(), seconds: external_exports.number().int().min(0).max(60) })).max(8),
+  /** The CPU share the compilers get together (percent; 100 = no cap). */
+  cpuPercent: external_exports.number().int().min(0).max(100).optional(),
   /** The PC itself asked for slowing down (its memory or CPU is low). */
   pcLow: external_exports.boolean(),
   lastAction: Text(300),
@@ -26868,6 +26887,8 @@ var VpnStatusSchema = external_exports.object({
   state: external_exports.enum(["off", "starting", "up", "failed"]),
   message: Text(2e3),
   killSwitch: external_exports.boolean(),
+  /** A direct connection was tried after the kill switch was applied: false = it still got out. */
+  killSwitchHeld: external_exports.boolean().optional(),
   /** The server's name, e.g. uk2201.nordvpn.com. */
   server: Text(128).optional(),
   /** What the sandbox's traffic looks like from outside, once the tunnel is up. */
@@ -27055,6 +27076,8 @@ var RunDir = class {
   vpnFile;
   /** What the memory governor in the sandbox is doing (pressure.json). */
   pressureFile;
+  /** What the sandbox's programs may really use (budget.json): processors, memory, build jobs, link slots. */
+  budgetFile;
   requestsDir;
   responsesDir;
   sessionsDir;
@@ -27068,6 +27091,7 @@ var RunDir = class {
     this.sandboxFile = path6.join(this.root, "sandbox.json");
     this.vpnFile = path6.join(this.root, "vpn.json");
     this.pressureFile = path6.join(this.root, "pressure.json");
+    this.budgetFile = path6.join(this.root, "budget.json");
     this.requestsDir = path6.join(this.root, "requests");
     this.responsesDir = path6.join(this.root, "responses");
     this.sessionsDir = path6.join(this.root, "sessions");
@@ -27507,7 +27531,7 @@ function writeStatus(phase, message) {
 }
 
 // src/guest/boot/boot.ts
-import fs59 from "node:fs";
+import fs60 from "node:fs";
 import path73 from "node:path";
 import { spawn as spawn9 } from "node:child_process";
 
@@ -29234,9 +29258,28 @@ async function setupUv(env) {
 function ghConfigDir() {
   return path34.join(stateDir, "gh");
 }
+function deliveredGhConfigDir() {
+  return path34.join(localDir, "gh-token");
+}
+function ghExePath() {
+  const entry = CLI_TOOLS.find((t) => t.name === "gh");
+  const dir = tool("cli", "gh");
+  return path34.join(entry?.subdir ? path34.join(dir, entry.subdir) : dir, entry?.exe ?? "gh.exe");
+}
+var GH_NOTE = " (log in once with: gh auth login --web --insecure-storage; it is kept between sandboxes)";
+function warnKeyringLogin() {
+  try {
+    const hosts = fs28.readFileSync(path34.join(ghConfigDir(), "hosts.yml"), "utf8");
+    if (/^\s*user:/m.test(hosts) && !/oauth_token:/.test(hosts))
+      warn(
+        "gh: the GitHub login from an earlier sandbox was kept in Windows Credential Manager, which is wiped with each sandbox. Log in again with: gh auth login --web --insecure-storage (then it lasts)."
+      );
+  } catch {
+  }
+}
 var toolVars = {
   gh: () => ({
-    GH_CONFIG_DIR: mkdirp(ghConfigDir()),
+    GH_CONFIG_DIR: exists(deliveredGhConfigDir()) ? deliveredGhConfigDir() : mkdirp(ghConfigDir()),
     GH_NO_UPDATE_NOTIFIER: "1",
     GH_NO_EXTENSION_UPDATE_NOTIFIER: "1"
   })
@@ -29274,9 +29317,11 @@ async function setupCli(env, settings, gitAccess, refresh = false) {
       await setupSingleExe(env, name, entry.repo, entry.asset(arch), entry.exe, tool("cli", name), {
         refresh,
         subdir: entry.subdir,
-        size: entry.size
+        size: entry.size,
+        ...name === "gh" ? { note: GH_NOTE } : {}
       });
       Object.assign(env.vars, toolVars[name]?.() ?? {});
+      if (name === "gh") warnKeyringLogin();
     } catch (e) {
       warn(name + " could not be set up and is skipped; the other tools are not affected. Reason: " + errMsg(e));
       env.summary.push(entry.name + ": FAILED");
@@ -30082,6 +30127,10 @@ var activate = async (version2) => {
   fs36.rmSync(NVM_SYMLINK, { recursive: true, force: true });
   fs36.symlinkSync(path45.join(NVM_HOME, "v" + version2), NVM_SYMLINK, "junction");
 };
+var PLAYWRIGHT_VARS = () => ({
+  PLAYWRIGHT_BROWSERS_PATH: tool("ms-playwright"),
+  PLAYWRIGHT_MCP_BROWSER: "msedge"
+});
 async function setupNode(env, versions, config2) {
   if (dryRun) {
     log("(dry run) would provision nvm and Node " + versions.node.spec + " (from " + versions.node.source + ")");
@@ -30115,13 +30164,14 @@ async function setupNode(env, versions, config2) {
       warn("Node " + version2 + " from this PC: " + errMsg(e));
     }
   }
-  Object.assign(env.vars, { NVM_HOME, NVM_SYMLINK });
+  Object.assign(env.vars, { NVM_HOME, NVM_SYMLINK, ...PLAYWRIGHT_VARS() });
   if (duringSession()) env.prepend.push(path45.join(NVM_HOME, "v" + main), NVM_HOME, NVM_SYMLINK);
   else {
     await activate(main);
     env.prepend.push(NVM_HOME, NVM_SYMLINK);
   }
   env.summary.push("node: " + main + " (from " + versions.node.source + ", switch with nvm use)");
+  env.summary.push("playwright: ready (Edge; browsers it downloads are kept; in tests use channel: 'msedge')");
   await packageManagers(env, config2, main);
 }
 var packageManagers = async (env, config2, version2) => {
@@ -32032,11 +32082,17 @@ import os8 from "node:os";
 import path51 from "node:path";
 
 // src/shared/memory/policy.ts
+function buildJobs(cpus, memoryGb) {
+  return Math.max(2, Math.min(cpus, Math.floor((memoryGb - 6) / 3)));
+}
+function linkSlotsFor(memoryGb) {
+  return Math.max(2, Math.min(8, Math.floor((memoryGb - 6) / 3)));
+}
 function cargoJobs(cpus, memoryGb, sessions) {
-  const byCpu = Math.max(2, Math.min(4, Math.floor(cpus / 4)));
+  const byCpu = Math.max(2, Math.min(8, Math.floor(cpus / 4)));
   const byMemory = Math.max(1, Math.floor(memoryGb / 4));
   const jobs = Math.min(byCpu, byMemory);
-  return Math.max(1, Math.min(jobs, Math.floor(8 / Math.max(1, sessions))));
+  return Math.max(1, Math.min(jobs, Math.floor(buildJobs(cpus, memoryGb) / Math.max(1, sessions))));
 }
 
 // src/guest/toolchains/native/rust-extras.ts
@@ -32059,7 +32115,7 @@ function linkGate(env, rust, host) {
   const gate = path51.join(mkdirp(tool("shims")), "linkgate.exe");
   fs41.copyFileSync(ensureCompiled("linkgate"), gate);
   const memoryGb = os8.totalmem() / 1024 ** 3;
-  const slots = rust.linkSlots === "auto" ? Math.max(2, Math.min(4, Math.floor(memoryGb / 8))) : rust.linkSlots;
+  const slots = rust.linkSlots === "auto" ? linkSlotsFor(memoryGb) : rust.linkSlots;
   env.vars.AGENT_LINK_SLOTS = String(slots);
   env.vars.AGENT_REAL_LINKER = gcc;
   env.vars.CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER = gate;
@@ -33170,14 +33226,14 @@ var problems = [];
 function networkProblems() {
   return problems;
 }
-var longPath = (file3) => {
+function longPath(file3) {
   if (!hasShortName(file3)) return file3;
   try {
     return fs48.realpathSync.native(file3);
   } catch {
     return file3;
   }
-};
+}
 async function applyAttachRule(ptyHostExe) {
   if (!session.attach.enabled) return;
   if (!ptyHostExe) {
@@ -33210,9 +33266,9 @@ async function applyNetworkPolicy(ptyHostExe) {
     log("Networking is disabled for this sandbox.");
     return "offline";
   }
-  const block = session.network.blockPrivateRanges;
-  const exempt = block ? discoverExemptIps() : [];
-  const lanRules = block ? buildFirewallCommands(exempt) : [];
+  const block2 = session.network.blockPrivateRanges;
+  const exempt = block2 ? discoverExemptIps() : [];
+  const lanRules = block2 ? buildFirewallCommands(exempt) : [];
   const forwardRules = forwardRule();
   const commands = [
     ...lanRules,
@@ -33231,18 +33287,18 @@ async function applyNetworkPolicy(ptyHostExe) {
       warn("network.dns could not be applied: " + errMsg(e));
     }
   }
-  if (!block) log("Private-range blocking disabled by config.");
-  if (block)
+  if (!block2) log("Private-range blocking disabled by config.");
+  if (block2)
     log(
       "Gateway/DNS addresses kept reachable for DNS only: " + (exempt.length ? [...new Set(exempt)].join(", ") : "(none found)")
     );
   if (!isWin || dryRun) {
     log("(dry run) firewall plan:");
     for (const c of commands) log("  netsh " + c.join(" "));
-    return block ? "blocked" : "open";
+    return block2 ? "blocked" : "open";
   }
   if (commands.length === 0) return "open";
-  const online = block ? await waitForInternet(30) : true;
+  const online = block2 ? await waitForInternet(30) : true;
   const failures = [];
   try {
     run2(lanRules);
@@ -33257,7 +33313,7 @@ async function applyNetworkPolicy(ptyHostExe) {
     warn("PROTECTION MISSING: " + problems[problems.length - 1]);
   }
   if (failures.length) throw new Error(failures[0]);
-  if (!block) return "open";
+  if (!block2) return "open";
   if (online && !await waitForInternet(15)) {
     run2(lanRules.filter((c) => c[2] === "delete"));
     warn(
@@ -33487,18 +33543,109 @@ function setupGitConfig(env) {
   spawnSync7(git, ["config", "--global", "core.autocrlf", "input"], { env: rest, windowsHide: true, stdio: "ignore" });
 }
 
+// src/guest/setup/github-token.ts
+import fs53 from "node:fs";
+import { spawnSync as spawnSync8 } from "node:child_process";
+
+// src/shared/github/token.ts
+var MIN_LENGTH = 20;
+var MAX_LENGTH = 255;
+var PRINTABLE = /^[\x21-\x7e]+$/;
+var GithubTokenSchema = external_exports.string().min(MIN_LENGTH).max(MAX_LENGTH).regex(PRINTABLE);
+var TOKEN_VARIABLES = /^(GH_TOKEN|GITHUB_TOKEN|GH_ENTERPRISE_TOKEN|GITHUB_ENTERPRISE_TOKEN)$/i;
+var ghEnv = (base, configDir) => ({
+  ...Object.fromEntries(
+    Object.entries(base).filter((e) => e[1] !== void 0 && !TOKEN_VARIABLES.test(e[0]))
+  ),
+  GH_CONFIG_DIR: configDir,
+  GH_PROMPT_DISABLED: "1",
+  GH_NO_UPDATE_NOTIFIER: "1"
+});
+function ghLoginCommand(ghExe, configDir, token, base) {
+  return {
+    file: ghExe,
+    args: [
+      "auth",
+      "login",
+      "--hostname",
+      "github.com",
+      "--git-protocol",
+      "https",
+      "--insecure-storage",
+      "--with-token"
+    ],
+    input: token + "\n",
+    env: ghEnv(base, configDir)
+  };
+}
+function ghSetupGitCommand(ghExe, configDir, base) {
+  return { file: ghExe, args: ["auth", "setup-git", "--hostname", "github.com"], env: ghEnv(base, configDir) };
+}
+function ghOutputText(text, token) {
+  const clean = token ? text.split(token).join("***") : text;
+  return clean.replace(/\s+/g, " ").trim().slice(0, 300);
+}
+
+// src/guest/setup/github-token.ts
+var GH_TIMEOUT_MS = 6e4;
+function prepareGithubFolder(token) {
+  const dir = deliveredGhConfigDir();
+  fs53.rmSync(dir, { recursive: true, force: true });
+  if (!token) return false;
+  mkdirp(dir);
+  return true;
+}
+function runGh(command, token, what) {
+  const result = spawnSync8(command.file, [...command.args], {
+    env: command.env,
+    encoding: "utf8",
+    windowsHide: true,
+    timeout: GH_TIMEOUT_MS,
+    stdio: ["pipe", "pipe", "pipe"],
+    ...command.input !== void 0 ? { input: command.input } : {}
+  });
+  if (result.error) throw new Error(what + " could not run: " + ghOutputText(result.error.message, token));
+  if (result.status !== 0)
+    throw new Error(
+      what + " failed: " + ghOutputText(String(result.stderr ?? "") || String(result.stdout ?? ""), token)
+    );
+}
+function loginGithub(token, env) {
+  if (dryRun) {
+    log("(dry run) would log gh in with the GitHub token from your PC");
+    return;
+  }
+  const gh2 = ghExePath();
+  const dir = deliveredGhConfigDir();
+  if (!exists(gh2) || env.GH_CONFIG_DIR !== dir) {
+    fs53.rmSync(dir, { recursive: true, force: true });
+    log("A GitHub token arrived, but gh is not set up in this sandbox (toolchains.cli.gh), so it is not used.");
+    return;
+  }
+  try {
+    runGh(ghLoginCommand(gh2, dir, token, env), token, "gh auth login");
+    runGh(ghSetupGitCommand(gh2, dir, env), token, "gh auth setup-git");
+  } catch (e) {
+    fs53.rmSync(dir, { recursive: true, force: true });
+    env.GH_CONFIG_DIR = mkdirp(ghConfigDir());
+    addMachineEnvironment({ GH_CONFIG_DIR: env.GH_CONFIG_DIR }, []);
+    throw e;
+  }
+  log("gh and https git to github.com use the GitHub token from your PC (github.shareToken); the agent can read it.");
+}
+
 // src/guest/sessions/pty-host.ts
 function ensurePtyHost() {
   return ensureCompiled("ptyhost");
 }
 
 // src/guest/toolchains/leftovers.ts
-import fs53 from "node:fs";
+import fs54 from "node:fs";
 import path66 from "node:path";
 var STAGING = /\.staging-[0-9a-f]+$/i;
 var entries2 = (dir) => {
   try {
-    return fs53.readdirSync(dir, { withFileTypes: true });
+    return fs54.readdirSync(dir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -33515,17 +33662,17 @@ function pruneToolLeftovers() {
 
 // src/guest/audit/process-audit.ts
 import path67 from "node:path";
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 var PROCESS_CREATION = "{0CCE922B-69AE-11D9-BED3-505054503030}";
 var auditOn = () => Boolean(session.auditProcesses) && isWin && !dryRun;
 function enableProcessAudit() {
   if (!auditOn()) return;
-  spawnSync8(
+  spawnSync9(
     path67.join(process.env.WINDIR ?? "C:\\Windows", "System32", "auditpol.exe"),
     ["/set", "/subcategory:" + PROCESS_CREATION, "/success:enable"],
     { windowsHide: true, stdio: "ignore" }
   );
-  spawnSync8(
+  spawnSync9(
     SYSTEM.reg(),
     [
       "add",
@@ -33545,7 +33692,8 @@ function enableProcessAudit() {
 
 // src/guest/vpn/vpn.ts
 import dns2 from "node:dns";
-import fs57 from "node:fs";
+import fs58 from "node:fs";
+import net3 from "node:net";
 import os14 from "node:os";
 import path71 from "node:path";
 
@@ -33710,13 +33858,13 @@ function inspectOvpn(text) {
   if (text.includes("\0")) return { ok: false, problems: ["the file is not text"] };
   const lines = text.split(/\r?\n/);
   if (lines.length > MAX_LINES) return { ok: false, problems: ["the file has too many lines"] };
-  let block = null;
+  let block2 = null;
   let defaultProto = "udp";
   lines.forEach((line, i) => {
     const at = "line " + (i + 1) + ": ";
     const trimmed = line.trim();
-    if (block) {
-      if (trimmed.toLowerCase() === "</" + block + ">") block = null;
+    if (block2) {
+      if (trimmed.toLowerCase() === "</" + block2 + ">") block2 = null;
       else if (/^<\/?[A-Za-z-]+>$/.test(trimmed)) refuse(at + "a section inside a section");
       return;
     }
@@ -33724,7 +33872,7 @@ function inspectOvpn(text) {
     if (open2) {
       const tag = open2[1].toLowerCase();
       if (!BLOCKS.has(tag)) refuse(at + "<" + tag + "> is not allowed");
-      block = tag;
+      block2 = tag;
       return;
     }
     const d = directiveOf(line);
@@ -33749,7 +33897,7 @@ function inspectOvpn(text) {
     }
   });
   const remotes = found.map((r) => ({ host: r.host, port: r.port, proto: r.proto ?? defaultProto }));
-  if (block) refuse("a <" + block + "> section is never closed");
+  if (block2) refuse("a <" + block2 + "> section is never closed");
   if (remotes.length === 0) refuse("it names no remote server");
   if (remotes.length > 64) refuse("it names too many servers");
   return problems2.length ? { ok: false, problems: problems2 } : { ok: true, remotes };
@@ -33958,8 +34106,22 @@ var drop = (name) => [
   "rule",
   "name=" + VPN_RULE_PREFIX + name
 ];
+var block = (name, extra) => [
+  "advfirewall",
+  "firewall",
+  "add",
+  "rule",
+  "name=" + VPN_RULE_PREFIX + name,
+  "dir=out",
+  "action=block",
+  "enable=yes",
+  "profile=any",
+  ...extra
+];
+var BLOCK_RULES = ["Block-Internet", "Block-IPv6", "Block-DNS-UDP", "Block-DNS-TCP"];
 function ruleNames(serverCount) {
   return [
+    ...BLOCK_RULES,
     "Loopback",
     "DHCP",
     "Host",
@@ -33967,6 +34129,39 @@ function ruleNames(serverCount) {
     ...Array.from({ length: Math.max(serverCount, 0) }, (_v, i) => "Server-" + (i + 1))
   ];
 }
+var NOT_INTERNET = [
+  ["0.0.0.0", "0.255.255.255"],
+  ["10.0.0.0", "10.255.255.255"],
+  ["100.64.0.0", "100.127.255.255"],
+  ["127.0.0.0", "127.255.255.255"],
+  ["169.254.0.0", "169.254.255.255"],
+  ["172.16.0.0", "172.31.255.255"],
+  ["192.168.0.0", "192.168.255.255"],
+  ["224.0.0.0", "255.255.255.255"]
+];
+var LAST_IPV4 = 4294967295;
+function ipNumber(ip) {
+  return ip.split(".").reduce((n, part) => n * 256 + Number(part), 0);
+}
+function ipText(n) {
+  return [24, 16, 8, 0].map((shift) => Math.floor(n / 2 ** shift) % 256).join(".");
+}
+function ipv4Except(excluded) {
+  const sorted = [...excluded].sort((a, b) => a[0] - b[0]);
+  const out = [];
+  let next = 0;
+  for (const [from, to] of sorted) {
+    if (from > next) out.push(ipText(next) + "-" + ipText(from - 1));
+    next = Math.max(next, to + 1);
+  }
+  if (next <= LAST_IPV4) out.push(ipText(next) + "-" + ipText(LAST_IPV4));
+  return out.join(",");
+}
+function internetExcept(servers) {
+  const ranges = NOT_INTERNET.map(([a, b]) => [ipNumber(a), ipNumber(b)]);
+  for (const s of cleanServers(servers)) ranges.push([ipNumber(s.ip), ipNumber(s.ip)]);
+  return ipv4Except(ranges);
+}
 function cleanServers(servers) {
   const seen = /* @__PURE__ */ new Set();
   return servers.filter((s) => {
@@ -33981,6 +34176,10 @@ function killSwitchCommands(servers, ptyHostExe) {
   return [
     ...ruleNames(Math.max(list.length, 8)).map(drop),
     ["advfirewall", "set", "allprofiles", "state", "on"],
+    block("Block-Internet", ["protocol=any", "remoteip=" + internetExcept(list)]),
+    block("Block-IPv6", ["protocol=any", "remoteip=2000::/3"]),
+    block("Block-DNS-UDP", ["protocol=udp", "remoteport=53"]),
+    block("Block-DNS-TCP", ["protocol=tcp", "remoteport=53"]),
     ["advfirewall", "set", "allprofiles", "firewallpolicy", "blockinbound,blockoutbound"],
     rule("Loopback", ["protocol=any", "remoteip=127.0.0.0/8"]),
     rule("DHCP", ["protocol=udp", "localport=68", "remoteport=67"]),
@@ -33992,7 +34191,21 @@ function killSwitchCommands(servers, ptyHostExe) {
 }
 function tunnelCommands(tunnelIp) {
   if (!isIPv4(tunnelIp)) throw new Error("Not an IPv4 address: " + tunnelIp);
-  return [drop("Tunnel"), rule("Tunnel", ["protocol=any", "localip=" + tunnelIp])];
+  const n = ipNumber(tunnelIp);
+  const notTunnel = ipv4Except([[n, n]]);
+  return [
+    ...["Block-Internet", "Block-DNS-UDP", "Block-DNS-TCP"].map((name) => [
+      "advfirewall",
+      "firewall",
+      "set",
+      "rule",
+      "name=" + VPN_RULE_PREFIX + name,
+      "new",
+      "localip=" + notTunnel
+    ]),
+    drop("Tunnel"),
+    rule("Tunnel", ["protocol=any", "localip=" + tunnelIp])
+  ];
 }
 function tunnelAddressFromLog(log2) {
   const add = /net_addr_v4_add:\s*(\d{1,3}(?:\.\d{1,3}){3})\/\d+/.exec(log2);
@@ -34005,7 +34218,7 @@ function tunnelAddressFromLog(log2) {
 
 // src/guest/vpn/openvpn.ts
 import crypto4 from "node:crypto";
-import fs54 from "node:fs";
+import fs55 from "node:fs";
 import path68 from "node:path";
 
 // src/shared/vpn/download.ts
@@ -34042,7 +34255,12 @@ function openvpnDownload(arch2 = process.arch) {
   const entry = arch2 === "arm64" ? OPENVPN_MSI.arm64 : OPENVPN_MSI.x64;
   return { ...entry, url: OPENVPN_MSI.base + entry.file };
 }
-var hasHash = (file3, sha256) => crypto4.createHash("sha256").update(fs54.readFileSync(file3)).digest("hex") === sha256;
+function repairServiceQueries() {
+  const did = scriptOutput("repair-wmi-services.ps1");
+  if (did === "removed") log("VPN: repaired the Windows service queries installers use (a Windows Sandbox gap).");
+  else if (did !== "absent" && did !== "kept") warn("VPN: could not check the Windows service queries installers use.");
+}
+var hasHash = (file3, sha256) => crypto4.createHash("sha256").update(fs55.readFileSync(file3)).digest("hex") === sha256;
 async function ensureOpenVpn() {
   const exe = openvpnExe();
   if (!isWin || dryRun) return exe;
@@ -34053,6 +34271,7 @@ async function ensureOpenVpn() {
     log("VPN: downloading OpenVPN " + OPENVPN_MSI.version + " (about 6 MB)");
     await downloader.file(dl.url, msi, dl.sha256);
   }
+  repairServiceQueries();
   log("VPN: installing OpenVPN");
   const logFile2 = path68.join(toolsDir, "downloads", "openvpn-install.log");
   const code = await spawnAsync(SYSTEM.msiexec(), ["/i", msi, "/qn", "/norestart", "/l*v", logFile2], {
@@ -34066,7 +34285,7 @@ async function ensureOpenVpn() {
 
 // src/guest/vpn/tunnel.ts
 import { spawn as spawn7 } from "node:child_process";
-import fs55 from "node:fs";
+import fs56 from "node:fs";
 import os12 from "node:os";
 import path69 from "node:path";
 var DONE = "Initialization Sequence Completed";
@@ -34084,17 +34303,17 @@ function failureReason(text) {
 }
 var tail = (text, lines = 12) => text.trim().split(/\r?\n/).slice(-lines).join("\n");
 async function startTunnel(o) {
-  const dir = fs55.mkdtempSync(path69.join(os12.tmpdir(), "sbx-vpn-"));
+  const dir = fs56.mkdtempSync(path69.join(os12.tmpdir(), "sbx-vpn-"));
   const auth = path69.join(dir, "login.txt");
   const logFile2 = path69.join(dir, "openvpn.log");
   const keepLog = () => {
     try {
-      fs55.mkdirSync(logsDir, { recursive: true });
-      fs55.copyFileSync(logFile2, path69.join(logsDir, "openvpn.log"));
+      fs56.mkdirSync(logsDir, { recursive: true });
+      fs56.copyFileSync(logFile2, path69.join(logsDir, "openvpn.log"));
     } catch {
     }
   };
-  fs55.writeFileSync(auth, o.username + "\r\n" + o.password + "\r\n", "utf8");
+  fs56.writeFileSync(auth, o.username + "\r\n" + o.password + "\r\n", "utf8");
   try {
     const child = spawn7(
       o.exe,
@@ -34112,7 +34331,7 @@ async function startTunnel(o) {
     child.unref();
     const deadline = Date.now() + (o.timeoutMs ?? 9e4);
     for (; ; ) {
-      const text = fs55.existsSync(logFile2) ? fs55.readFileSync(logFile2, "utf8") : "";
+      const text = fs56.existsSync(logFile2) ? fs56.readFileSync(logFile2, "utf8") : "";
       if (text.includes(DONE)) {
         keepLog();
         const tunnelIp = tunnelAddressFromLog(text) ?? void 0;
@@ -34132,14 +34351,14 @@ async function startTunnel(o) {
       await new Promise((r) => setTimeout(r, 500));
     }
   } finally {
-    fs55.rmSync(auth, { force: true });
+    fs56.rmSync(auth, { force: true });
   }
 }
 
 // src/guest/vpn/wireguard.ts
 import { execFile } from "node:child_process";
 import crypto5 from "node:crypto";
-import fs56 from "node:fs";
+import fs57 from "node:fs";
 import os13 from "node:os";
 import path70 from "node:path";
 var WIREGUARD_TUNNEL = "sandbox";
@@ -34153,7 +34372,7 @@ function wireguardDownload(arch2 = process.arch) {
   const entry = arch2 === "arm64" ? WIREGUARD_MSI.arm64 : WIREGUARD_MSI.x64;
   return { ...entry, url: WIREGUARD_MSI.base + entry.file };
 }
-var hasHash2 = (file3, sha256) => crypto5.createHash("sha256").update(fs56.readFileSync(file3)).digest("hex") === sha256;
+var hasHash2 = (file3, sha256) => crypto5.createHash("sha256").update(fs57.readFileSync(file3)).digest("hex") === sha256;
 async function ensureWireguard() {
   const exe = wireguardExe();
   if (!isWin || dryRun) return exe;
@@ -34164,6 +34383,7 @@ async function ensureWireguard() {
     log("VPN: downloading WireGuard " + WIREGUARD_MSI.version + " (about 3 MB)");
     await downloader.file(dl.url, msi, dl.sha256);
   }
+  repairServiceQueries();
   log("VPN: installing WireGuard");
   const logFile2 = path70.join(toolsDir, "downloads", "wireguard-install.log");
   const code = await spawnAsync(
@@ -34198,9 +34418,9 @@ async function removeWireguardTunnel(exe) {
 }
 async function startWireguardTunnel(o) {
   const root = path70.join(process.env.SystemRoot ?? "C:\\Windows", "Temp");
-  const dir = fs56.mkdtempSync(path70.join(fs56.existsSync(root) ? root : os13.tmpdir(), "sbx-wg-"));
+  const dir = fs57.mkdtempSync(path70.join(fs57.existsSync(root) ? root : os13.tmpdir(), "sbx-wg-"));
   const file3 = path70.join(dir, WIREGUARD_TUNNEL + ".conf");
-  fs56.writeFileSync(file3, o.config, "utf8");
+  fs57.writeFileSync(file3, o.config, "utf8");
   const fail = async (message) => {
     await removeWireguardTunnel(o.exe);
     return { ok: false, message };
@@ -34221,7 +34441,7 @@ async function startWireguardTunnel(o) {
       await sleep(500);
     }
   } finally {
-    fs56.rmSync(dir, { recursive: true, force: true });
+    fs57.rmSync(dir, { recursive: true, force: true });
   }
 }
 async function waitForHandshake(exe, poke, timeoutMs = 3e4) {
@@ -34290,15 +34510,47 @@ async function publicAddress() {
   }
 }
 var hasAdapter2 = (ip) => Object.values(os14.networkInterfaces()).some((list) => (list ?? []).some((i) => i.address === ip));
+var PROBE_TARGETS = ["1.1.1.1", "8.8.8.8", "9.9.9.9"];
+var PROBE_TIMEOUT_MS = 3e3;
+function connects(ip, port) {
+  return new Promise((resolve2) => {
+    const socket = net3.connect({ host: ip, port });
+    const done = (ok) => {
+      socket.destroy();
+      resolve2(ok);
+    };
+    socket.setTimeout(PROBE_TIMEOUT_MS, () => done(false));
+    socket.once("connect", () => done(true));
+    socket.once("error", () => done(false));
+  });
+}
+async function directConnectionBlocked(servers) {
+  const targets = PROBE_TARGETS.filter((ip) => !servers.some((s) => s.ip === ip));
+  const results = await Promise.all(targets.map((ip) => connects(ip, 443)));
+  return !results.some(Boolean);
+}
 async function setupVpn(secrets, ptyHostExe) {
   const vpn = session.vpn;
   if (!vpn) return true;
   const killSwitch = vpn.killSwitch;
   let blocked = false;
-  const block = (servers) => {
-    if (isWin && !dryRun) run2(killSwitchCommands(servers, ptyHostExe));
-    blocked = true;
-    log("VPN: kill switch on: nothing leaves the sandbox except through the tunnel.");
+  let held = false;
+  const block2 = async (servers) => {
+    if (!isWin || dryRun) {
+      blocked = held = true;
+      return;
+    }
+    try {
+      run2(killSwitchCommands(servers, ptyHostExe ? longPath(ptyHostExe) : null));
+    } finally {
+      blocked = true;
+      held = await directConnectionBlocked(servers);
+    }
+    if (held) log("VPN: kill switch on: nothing leaves the sandbox except through the tunnel (checked).");
+    else
+      warn(
+        "VPN: the kill switch did not hold: a direct connection still got out. If the tunnel drops, traffic leaves through your normal connection."
+      );
   };
   setVpnStatus("starting", "Starting the VPN");
   try {
@@ -34314,7 +34566,7 @@ async function setupVpn(secrets, ptyHostExe) {
         warn(
           "VPN: AllowedIPs does not include 0.0.0.0/0: with the kill switch on, only the tunnel traffic can leave the sandbox."
         );
-      if (killSwitch) block(servers);
+      if (killSwitch) await block2(servers);
       if (dryRun || !isWin) {
         log("(dry run) would start the WireGuard tunnel " + vpn.server);
         setVpnStatus("off", "dry run");
@@ -34329,11 +34581,11 @@ async function setupVpn(secrets, ptyHostExe) {
       const credentials = secrets.vpn;
       if (!credentials) throw new Error("the VPN login did not arrive (start the sandbox again)");
       const profile = path71.join(launchDir, "vpn", "server.ovpn");
-      const remotes = assertSafeOvpn(fs57.readFileSync(profile, "utf8"), vpn.server);
+      const remotes = assertSafeOvpn(fs58.readFileSync(profile, "utf8"), vpn.server);
       const exe = await ensureOpenVpn();
       const servers = await serverAddresses(remotes);
       if (servers.length === 0) throw new Error("the VPN server addresses could not be found");
-      if (killSwitch) block(servers);
+      if (killSwitch) await block2(servers);
       if (dryRun || !isWin) {
         log("(dry run) would start the VPN tunnel to " + vpn.server);
         setVpnStatus("off", "dry run");
@@ -34352,18 +34604,21 @@ async function setupVpn(secrets, ptyHostExe) {
       throw new Error("the tunnel reported it was up, but no network adapter with its address appeared");
     const publicIp = await publicAddress();
     log("VPN: up" + (publicIp ? " (the sandbox appears as " + publicIp + ")" : "") + ".");
-    setVpnStatus("up", "The tunnel is up", publicIp ? { publicIp } : {});
+    setVpnStatus("up", "The tunnel is up", {
+      ...publicIp ? { publicIp } : {},
+      ...killSwitch ? { killSwitchHeld: held } : {}
+    });
     return true;
   } catch (e) {
     const reason = errMsg(e);
     try {
-      if (killSwitch && !blocked) block([]);
+      if (killSwitch && !blocked) await block2([]);
     } catch (blockError) {
       warn("VPN: could not close the network after the failure: " + errMsg(blockError));
     }
-    const text = "VPN failed: " + reason + (killSwitch ? " The kill switch is on, so this sandbox has NO internet access." : " The kill switch is off, so this sandbox is using your normal connection.");
-    warn(text);
-    setVpnStatus("failed", reason);
+    const after = !killSwitch ? " The kill switch is off, so this sandbox is using your normal connection." : held ? " The kill switch is on, so this sandbox has NO internet access." : " The kill switch could NOT close the network, so this sandbox is ONLINE through your normal connection, without the VPN.";
+    warn("VPN failed: " + reason + after);
+    setVpnStatus("failed", reason, killSwitch ? { killSwitchHeld: held } : {});
     return false;
   }
 }
@@ -34420,10 +34675,10 @@ var FrameReader = class {
 };
 
 // src/shared/pty/client.ts
-import net3 from "node:net";
+import net4 from "node:net";
 var connectOnce = (host, port, timeoutMs) => {
   return new Promise((resolve2, reject) => {
-    const socket = net3.connect({ host, port });
+    const socket = net4.connect({ host, port });
     const timer = setTimeout(() => {
       socket.destroy();
       reject(new Error("timed out connecting to " + host + ":" + port));
@@ -34644,6 +34899,36 @@ function unfinishedSequence(data) {
   return data.length;
 }
 
+// src/shared/pty/ctrl-c.ts
+var CTRL_C_CONFIRM_MS = 1500;
+var CTRL_C_HINT = "Ctrl+C again to send it to the program (Esc stops an agent)";
+var OSC_TITLE = /\x1b\][02];([^\x07\x1b]{0,256})(?:\x07|\x1b\\)/g;
+var CtrlCGuard = class {
+  armedAt = Number.NEGATIVE_INFINITY;
+  lastTitle = "";
+  /** What to send for one read from the keyboard: a lone Ctrl+C only when another came just before. */
+  push(chunk, nowMs) {
+    if (chunk.length !== 1 || chunk[0] !== 3) return { send: chunk, held: false };
+    if (nowMs - this.armedAt <= CTRL_C_CONFIRM_MS) {
+      this.armedAt = Number.NEGATIVE_INFINITY;
+      return { send: chunk, held: false };
+    }
+    this.armedAt = nowMs;
+    return { send: Buffer.alloc(0), held: true };
+  }
+  /** Remembers the title the program last set (from its output), to put it back after the hint. */
+  watchOutput(text) {
+    for (const m of text.matchAll(OSC_TITLE)) this.lastTitle = m[1];
+  }
+  /** The escape sequence that shows the hint, and the one that puts the program's title back. */
+  hintTitle() {
+    return "\x1B]0;" + CTRL_C_HINT + "\x07";
+  }
+  restoreTitle() {
+    return "\x1B]0;" + this.lastTitle.replace(/[\x00-\x1f\x7f]/g, "") + "\x07";
+  }
+};
+
 // src/shared/pty/terminal.ts
 var MOUSE_OFF = "\x1B[?1000l\x1B[?1002l\x1B[?1003l\x1B[?1005l\x1B[?1006l\x1B[?1015l";
 function fixWindowsKeys(chunk) {
@@ -34674,6 +34959,7 @@ function runTerminalClient(socket, token, options = {}) {
       clearInterval(heartbeat);
       clearInterval(sizeWatch);
       clearTimeout(joinTimer);
+      clearTimeout(hintTimer);
       socket.destroy();
       stdout.write("\x1B[0m\x1B[?25h" + MOUSE_OFF + "\r\n");
       void (vtInput?.stop() ?? Promise.resolve()).then(() => {
@@ -34687,11 +34973,23 @@ function runTerminalClient(socket, token, options = {}) {
     const sendInput = (data) => {
       if (data.length && !done) socket.write(encodeFrame(FrameType.Input, swapKeys ? fixWindowsKeys(data) : data));
     };
+    const guard = options.confirmCtrlC ? new CtrlCGuard() : null;
+    let hintTimer;
     const onInput = (chunk) => {
       if (options.detachKey !== void 0 && chunk.includes(options.detachKey)) {
         finish({ reason: "detach" });
         return;
       }
+      if (guard) {
+        const decided = guard.push(chunk, Date.now());
+        clearTimeout(hintTimer);
+        if (decided.held) {
+          stdout.write(guard.hintTitle());
+          hintTimer = setTimeout(() => stdout.write(guard.restoreTitle()), CTRL_C_CONFIRM_MS);
+          return;
+        }
+        if (decided.send.length === 1 && decided.send[0] === 3) stdout.write(guard.restoreTitle());
+      }
       clearTimeout(joinTimer);
       sendInput(joiner.push(chunk));
       if (joiner.holding()) joinTimer = setTimeout(() => sendInput(joiner.flush()), JOIN_MS);
@@ -34724,8 +35022,11 @@ function runTerminalClient(socket, token, options = {}) {
         return;
       }
       for (const frame of frames) {
-        if (frame.type === FrameType.Output) stdout.write(filter.push(frame.payload));
-        else if (frame.type === FrameType.Console) passthrough = frame.payload.toString("latin1") === "conpty.dll";
+        if (frame.type === FrameType.Output) {
+          const out = filter.push(frame.payload);
+          guard?.watchOutput(out.toString("latin1"));
+          stdout.write(out);
+        } else if (frame.type === FrameType.Console) passthrough = frame.payload.toString("latin1") === "conpty.dll";
         else if (frame.type === FrameType.Restarting) stdout.write(MOUSE_OFF + "\x1B[2J\x1B[3J\x1B[H");
         else if (frame.type === FrameType.Exit)
           finish({ reason: "exit", exitCode: frame.payload.length >= 4 ? frame.payload.readInt32LE(0) : 1 });
@@ -34778,7 +35079,10 @@ async function viewSession(id) {
     return 1;
   }
   const socket = await connect({ ...session2.attach, addresses: ["127.0.0.1"] });
-  const result = await runTerminalClient(socket, session2.attach.token, { clipboardWrites: true });
+  const result = await runTerminalClient(socket, session2.attach.token, {
+    clipboardWrites: true,
+    confirmCtrlC: session.attach.confirmCtrlC !== false
+  });
   if (result.reason === "exit") console.log(session2.harness + " exited with code " + result.exitCode + ".");
   else if (result.reason === "error") console.log("Session error: " + result.message);
   return result.reason === "exit" ? result.exitCode : 1;
@@ -34833,7 +35137,7 @@ function saveProjectStatus(name, workspace2, phase, message, databases, summary)
 }
 
 // src/guest/runtime/secrets.ts
-import fs58 from "node:fs";
+import fs59 from "node:fs";
 
 // src/shared/channel/secrets.ts
 var Environment = external_exports.record(external_exports.string().max(256), external_exports.string().max(65536));
@@ -34849,7 +35153,9 @@ var SecretsFileSchema = external_exports.strictObject({
   /** VPN service credentials (vpn.provider's login), only for the launch's own sandbox. */
   vpn: external_exports.strictObject({ username: external_exports.string().min(1).max(256), password: external_exports.string().min(1).max(1024) }).optional(),
   /** The checked WireGuard config of vpn.provider wireguard-file (holds the private key). */
-  wireguardConfig: external_exports.string().min(1).max(32 * 1024).optional()
+  wireguardConfig: external_exports.string().min(1).max(32 * 1024).optional(),
+  /** The GitHub token you saved for sandboxes (github.shareToken), only with git access "full". */
+  githubToken: GithubTokenSchema.optional()
 });
 
 // src/guest/runtime/secrets.ts
@@ -34859,12 +35165,12 @@ function takeSecrets(id) {
   const file3 = run.secretFile(id);
   let text;
   try {
-    if (fs58.statSync(file3).size > MAX_BYTES) throw new Error("too big");
-    text = fs58.readFileSync(file3, "utf8").replace(/^\uFEFF/, "");
+    if (fs59.statSync(file3).size > MAX_BYTES) throw new Error("too big");
+    text = fs59.readFileSync(file3, "utf8").replace(/^\uFEFF/, "");
   } catch {
     return {};
   } finally {
-    fs58.rmSync(file3, { force: true });
+    fs59.rmSync(file3, { force: true });
   }
   try {
     const parsed = SecretsFileSchema.safeParse(JSON.parse(text));
@@ -34917,7 +35223,7 @@ function startDaemon(env, secrets) {
 function writeDbCommand() {
   const dir = mkdirp(path73.join(localDir, "bin"));
   const db = path73.join(path73.dirname(process.argv[1]), "db.js");
-  fs59.writeFileSync(
+  fs60.writeFileSync(
     path73.join(dir, "sbx-db.cmd"),
     '@setlocal\r\n@set AGENT_LOG_PREFIX=db\r\n@"' + process.execPath + '" "' + db + '" %*\r\n'
   );
@@ -34927,8 +35233,8 @@ function writeDbCommand() {
 function writeAgentCommands(dir) {
   const install = { node: process.execPath, script: path73.join(path73.dirname(process.argv[1]), "agent.js") };
   for (const shim3 of agentShims(toolsDir, session.agents ?? {}))
-    fs59.writeFileSync(path73.join(dir, shim3.command + ".cmd"), shimText(shim3, install));
-  fs59.writeFileSync(path73.join(dir, "sbx-agent.cmd"), sbxAgentText(install));
+    fs60.writeFileSync(path73.join(dir, shim3.command + ".cmd"), shimText(shim3, install));
+  fs60.writeFileSync(path73.join(dir, "sbx-agent.cmd"), sbxAgentText(install));
 }
 async function waitForPrimary() {
   for (let i = 0; i < PRIMARY_POLLS; i++) {
@@ -34956,12 +35262,13 @@ var Boot = class {
     log(
       "Agent sandbox: " + session.project + " | workspace " + workspace + " | agent " + session.harnessName + " | log " + logPath
     );
-    if (!fs59.statSync(workspace, { throwIfNoEntry: false })?.isDirectory())
+    if (!fs60.statSync(workspace, { throwIfNoEntry: false })?.isDirectory())
       throw new Error("Workspace folder is missing in the sandbox: " + workspace);
     mkdirp(toolsDir);
     mkdirp(run.root);
     this.secrets = takeSecrets(session.launchId);
     applyBootEnvironment(this.secrets.harnessEnvironment);
+    prepareGithubFolder(this.secrets.githubToken);
     await this.networkAndSessionHost();
     await this.hooksAndDesktop();
     const { tools, env } = await this.developerTools();
@@ -35044,6 +35351,11 @@ var Boot = class {
   async gitIdentity(env) {
     step(5, "Git identity");
     await soft("Git config", () => setupGitConfig(env));
+    const token = this.secrets.githubToken;
+    if (token) {
+      this.secrets = { ...this.secrets, githubToken: void 0 };
+      await soft("GitHub token", () => loginGithub(token, env));
+    }
   }
   async claude(tools) {
     step(6, "Claude settings, history and claude-mem");
@@ -35105,7 +35417,7 @@ runBoot().catch((e) => {
   const message = errMsg(e) + (e instanceof Error && e.stack ? "\n" + e.stack : "");
   try {
     setSandboxStatus("failed", errMsg(e));
-    fs60.writeFileSync(path74.join(logsDir, "guest-error.txt"), message);
+    fs61.writeFileSync(path74.join(logsDir, "guest-error.txt"), message);
   } catch {
   }
   console.error(