windows-development-sandbox 1.11.3 → 1.11.5

package/dist/runtime/main.js

@@ -29266,6 +29266,17 @@ function ghExePath() {
   const dir = tool("cli", "gh");
   return path34.join(entry?.subdir ? path34.join(dir, entry.subdir) : dir, entry?.exe ?? "gh.exe");
 }
+var GH_NOTE = " (log in once with: gh auth login --web --insecure-storage; it is kept between sandboxes)";
+function warnKeyringLogin() {
+  try {
+    const hosts = fs28.readFileSync(path34.join(ghConfigDir(), "hosts.yml"), "utf8");
+    if (/^\s*user:/m.test(hosts) && !/oauth_token:/.test(hosts))
+      warn(
+        "gh: the GitHub login from an earlier sandbox was kept in Windows Credential Manager, which is wiped with each sandbox. Log in again with: gh auth login --web --insecure-storage (then it lasts)."
+      );
+  } catch {
+  }
+}
 var toolVars = {
   gh: () => ({
     GH_CONFIG_DIR: exists(deliveredGhConfigDir()) ? deliveredGhConfigDir() : mkdirp(ghConfigDir()),
@@ -29306,9 +29317,11 @@ async function setupCli(env, settings, gitAccess, refresh = false) {
       await setupSingleExe(env, name, entry.repo, entry.asset(arch), entry.exe, tool("cli", name), {
         refresh,
         subdir: entry.subdir,
-        size: entry.size
+        size: entry.size,
+        ...name === "gh" ? { note: GH_NOTE } : {}
       });
       Object.assign(env.vars, toolVars[name]?.() ?? {});
+      if (name === "gh") warnKeyringLogin();
     } catch (e) {
       warn(name + " could not be set up and is skipped; the other tools are not affected. Reason: " + errMsg(e));
       env.summary.push(entry.name + ": FAILED");
@@ -34673,6 +34686,7 @@ var connectOnce = (host, port, timeoutMs) => {
     socket.once("connect", () => {
       clearTimeout(timer);
       socket.setNoDelay(true);
+      socket.setKeepAlive(true, KEEPALIVE_IDLE_MS);
       resolve2(socket);
     });
     socket.once("error", (e) => {
@@ -34681,6 +34695,7 @@ var connectOnce = (host, port, timeoutMs) => {
     });
   });
 };
+var KEEPALIVE_IDLE_MS = 1e4;
 async function connect(endpoint, timeoutMs = 3e3) {
   const errors = [];
   for (const address of endpoint.addresses) {

package/dist/runtime/view.js

@@ -5594,6 +5594,7 @@ var connectOnce = (host, port, timeoutMs) => {
     socket.once("connect", () => {
       clearTimeout(timer);
       socket.setNoDelay(true);
+      socket.setKeepAlive(true, KEEPALIVE_IDLE_MS);
       resolve(socket);
     });
     socket.once("error", (e) => {
@@ -5602,6 +5603,7 @@ var connectOnce = (host, port, timeoutMs) => {
     });
   });
 };
+var KEEPALIVE_IDLE_MS = 1e4;
 async function connect(endpoint, timeoutMs = 3e3) {
   const errors = [];
   for (const address of endpoint.addresses) {

package/dist/selftest/app.test.js

@@ -629,12 +629,18 @@ export const appSuite = {
         const dataSample = dataPage(stored);
         const dataSectionIds = dataSample.sections.map((s) => s.id);
         const dataOps = pageActions(dataSample);
-        const accountsItem = dataSample.sections.find((s) => s.id === 'area:host')?.items?.[0];
-        t.check(dataSectionIds.includes('area:tools') &&
-            dataSectionIds.includes('area:state') &&
-            dataOps.some((a) => a.kind === 'operation' && a.op === 'data.clean' && JSON.stringify(a.input) === '{"targets":["tools/rust"]}') &&
-            (accountsItem?.actions ?? []).length === 0 &&
-            dataOps.some((a) => a.kind === 'operation' && a.op === 'data.prune'), 'data: disks, one section per area, x deletes only what may be deleted', dataSectionIds.join());
+        const keptSection = dataSample.sections.find((s) => s.id === 'kept');
+        const keptItems = keptSection?.items ?? [];
+        const accountsItem = keptItems.find((i) => i.label === 'accounts');
+        t.check(dataSectionIds.join() === 'disks,kept' &&
+            keptItems.map((i) => i.label).join() === 'rust,state/claude,accounts' &&
+            keptSection?.summary === '6.5 GB in all' &&
+            keptItems[0]?.primary?.kind === 'operation' &&
+            keptItems[0].primary.op === 'data.clean' &&
+            JSON.stringify(keptItems[0].primary.input) === '{"targets":["tools/rust"]}' &&
+            accountsItem?.primary === undefined &&
+            (keptSection?.actions ?? []).some((a) => a.kind === 'operation' && a.op === 'data.prune') &&
+            dataOps.some((a) => a.kind === 'operation' && a.op === 'data.clean'), 'data: disks, then one table of every kept folder (total in the summary); delete only where it may be deleted', dataSectionIds.join());
         const shaped = showData.cli.shapeJson(stored);
         const shapedEntries = shaped.entries;
         const shapedDisks = shaped.disks;
@@ -644,6 +650,10 @@ export const appSuite = {
         const dataLines = pageLines(dataSample);
         t.check(dataLines.some((l) => l.startsWith('Disks')) &&
             dataLines.some((l) => /^DRIVE\s+USED\s+FREE\s+SIZE/.test(l)) &&
+            dataLines.some((l) => l.startsWith('What the sandbox keeps  6.5 GB in all')) &&
+            dataLines.some((l) => /^KIND\s+NAME\s+SIZE\s+FOLDER/.test(l)) &&
+            dataLines.some((l) => /^Toolchains\s+rust\s+4\.6 GB\s+C:\\AgentData\\tools\\rust/.test(l)) &&
+            dataLines.some((l) => l.startsWith('Kept on this PC on purpose, not deleted here: accounts.')) &&
             dataLines.some((l) => l.startsWith('Persistent data for the sandbox: ')) &&
             dataLines.some((l) => l.startsWith('Free space with:')), 'data on the command line: the disks table, the data folder line and the free space line', dataLines.join('\n'));
         t.check(definitionFor('data', ['clean'])?.id === 'data.clean' &&
@@ -837,10 +847,12 @@ export const appSuite = {
             mountedNow: null,
         };
         const storagePageNow = storagePage(shownStorage, shownContained);
-        const folderPrimary = storagePageNow.sections[0]?.items?.[0]?.primary;
+        const folderSection = storagePageNow.sections[0];
+        const folderOps = (folderSection?.actions ?? []).map((a) => (a.kind === 'operation' ? a.op : a.kind));
         const containedActions = storagePageNow.sections[1]?.actions ?? [];
-        t.check(folderPrimary?.kind === 'operation' &&
-            folderPrimary.op === 'storage.change' &&
+        t.check(folderOps.join() === 'storage.move,storage.use' &&
+            (folderSection?.facts ?? []).map((f) => f.label).join() ===
+                'Folder,Size,Default folder,Other folder with data' &&
             containedActions.length === 1 &&
             containedActions[0].kind === 'operation' &&
             containedActions[0].op === 'storage.containedOn', 'the storage page: the data folder row changes it, and contained storage offers to turn it on while it is off');

package/dist/selftest/health.test.js

@@ -524,6 +524,41 @@ async function sharedCore(t) {
     t.equal(keys, ['f', 'l'], 'the health keys are f and l (e only when Windows Sandbox can be turned on)');
     const canEnable = healthPage({ last: { ...saved, setup: { ...saved.setup, canEnable: true } } });
     t.equal(menuView(canEnable, { category: 'health', refresh: false }).actions.map((a) => a.key), ['f', 'l', 'e'], 'e turns Windows Sandbox on when the setup says it can be');
+    const problems = healthPage({
+        last: {
+            ...saved,
+            mode: 'repair',
+            checks: [
+                {
+                    id: 'stale',
+                    group: 'Data folder',
+                    name: 'Stale run folders',
+                    status: 'needs-you',
+                    detail: 'two folders from a sandbox that did not close',
+                    means: 'they take space',
+                    fix: 'stop the sandbox',
+                    lines: ['run-20261012-0931'],
+                    fixable: false,
+                },
+                {
+                    id: 'net',
+                    group: 'Network',
+                    name: 'GitHub',
+                    status: 'warn',
+                    detail: 'no answer',
+                    fix: 'check your VPN',
+                    fixable: false,
+                },
+            ],
+        },
+    });
+    const repairItems = problems.sections.find((s) => s.id === 'repair')?.items ?? [];
+    const stale = repairItems[0];
+    t.equal(stale?.details, ['Found: two folders from a sandbox that did not close', 'Fix: stop the sandbox', 'run-20261012-0931'], 'a repair row lists what was found as a Found: line, then the fix and the paths (ids stay plain)');
+    t.equal(stale?.description, 'they take space', 'a repair row with a meaning shows it as the description');
+    const net = repairItems[1];
+    t.equal(net?.details, ['Found: no answer', 'Fix: check your VPN'], 'a repair row without a meaning still says Found:');
+    t.equal(net?.description, undefined, 'without a meaning, the found text is not repeated as the description');
 }
 export const healthSuite = {
     name: 'health',

package/dist/selftest/live-terminal.test.js

@@ -90,6 +90,36 @@ export const liveTerminalSuite = {
         t.check(!errors, 'ptyhost and the stand-in agent compile', errors);
         if (errors)
             return;
+        t.section('what a program leaves running ends with it (no leftover processes)');
+        {
+            // A copy of PING with a name of its own, started detached and hidden (its own console, so closing the pseudo
+            // console does not end it), by a program that then exits.
+            const probe = t.at('leftover-probe.exe');
+            fs.copyFileSync(path.join(process.env.SystemRoot ?? 'C:\\Windows', 'System32', 'PING.EXE'), probe);
+            const starter = '"' +
+                SYSTEM.powershell() +
+                '" -NoProfile -Command "Start-Process -WindowStyle Hidden -FilePath \'' +
+                probe +
+                "' -ArgumentList '-n','120','127.0.0.1'; Start-Sleep -Seconds 5\"";
+            const host = spawn(ptyhost, [String(await freePort()), 'tok', '80', '24', t.at('leftover.log'), starter], {
+                env: { ...process.env, PTYHOST_BIND: 'loopback' },
+                stdio: 'ignore',
+                windowsHide: true,
+            });
+            const probeRunning = () => spawnSync(SYSTEM.tasklist(), ['/FI', 'IMAGENAME eq leftover-probe.exe', '/NH'], { encoding: 'utf8' })
+                .stdout.toLowerCase()
+                .includes('leftover-probe.exe');
+            await t.waitFor(probeRunning, WAIT.screen);
+            t.check(probeRunning(), 'the program started a background process of its own');
+            await t.waitFor(() => host.exitCode !== null, 30000);
+            await t.waitFor(() => !probeRunning(), 5000);
+            const log = fs.existsSync(t.at('leftover.log')) ? fs.readFileSync(t.at('leftover.log'), 'utf8') : '';
+            t.check(!probeRunning() && /ended [1-9]\d* process\(es\) the program left running/.test(log), 'when the program exits, the background process it left running is ended too', log.slice(-400));
+            if (probeRunning())
+                spawnSync(path.join(process.env.SystemRoot ?? 'C:\\Windows', 'System32', 'taskkill.exe'), ['/F', '/IM', 'leftover-probe.exe'], {
+                    stdio: 'ignore',
+                });
+        }
         t.section("the agents' job: a last-resort backstop, set once");
         {
             // A job of the test's own (PTYHOST_JOB_NAME), never the agents' real one.

package/dist/selftest/support/web-preview.js

@@ -575,6 +575,8 @@ function previewRpc(ctx, state) {
                 return { message: 'Done. Restart Windows to finish. (preview: nothing was changed)' };
             case 'engine.status':
                 return sampleEngines();
+            case 'engine.leftovers':
+                return { available: true, message: 'No HCS systems of yours are running.', systems: [] };
             case 'logs.list':
                 return sampleLogs();
             case 'logs.tail':
@@ -789,6 +791,7 @@ function previewRpc(ctx, state) {
         'logs.list': 'query',
         'logs.tail': 'query',
         'engine.status': 'query',
+        'engine.leftovers': 'query',
     };
     return {
         kind: (id) => kinds[id],

package/dist/selftest/web.test.js

@@ -245,6 +245,39 @@ export const webSuite = {
             await new Promise((r) => setTimeout(r, 300));
             t.check(hub.size === 0 && reads === stopped, 'with nobody watching, nothing is read');
         }
+        t.section('an unused server ends by itself (no process left behind)');
+        {
+            const idleServer = async (sandbox, limits) => {
+                let ended = false;
+                const idle = new WebServer({
+                    port: 0,
+                    token: TOKEN,
+                    backend: {
+                        info: () => Promise.resolve({
+                            sandbox,
+                            owner: null,
+                            canUse: true,
+                            harnesses: [],
+                            defaultHarness: 'claude',
+                            projects: [],
+                        }),
+                        sessions: () => Promise.resolve([]),
+                        endpoint: () => null,
+                    },
+                    staticRoot: t.dir('idle-static-' + sandbox + limits.exit),
+                    idleExitMs: limits.exit,
+                    idleNoSandboxMs: limits.quiet,
+                    onStop: () => (ended = true),
+                });
+                await idle.start();
+                await new Promise((r) => setTimeout(r, 1500));
+                await idle.stop();
+                return ended;
+            };
+            t.check(await idleServer('stopped', { exit: 60_000, quiet: 200 }), 'no browser and no sandbox: it ends after the short wait');
+            t.check(!(await idleServer('running', { exit: 60_000, quiet: 200 })), 'a sandbox runs: the short wait does not end it');
+            t.check(await idleServer('running', { exit: 300, quiet: 200 }), 'no browser for the long wait: it ends even while a sandbox runs');
+        }
         t.section('the server');
         const fake = new FakePtyHost();
         await fake.start();

package/dist/shared/pty/client.d.ts

@@ -4,7 +4,6 @@ export interface Endpoint {
     port: number;
     token: string;
 }
-/** Tries every address the sandbox published and returns the first one that answers. */
 export declare function connect(endpoint: Endpoint, timeoutMs?: number): Promise<net.Socket>;
 /** Sends one control frame (e.g. RESTART) without taking over the screen. */
 export declare function sendControl(endpoint: Endpoint, type: number): Promise<void>;

package/dist/shared/pty/client.js

@@ -10,6 +10,9 @@ const connectOnce = (host, port, timeoutMs) => {
         socket.once('connect', () => {
             clearTimeout(timer);
             socket.setNoDelay(true);
+            // A sandbox that vanished (closed hard, ended in Task Manager) never closes the connection: keepalive notices
+            // within seconds, so an attached terminal or the web's bridge ends instead of hanging on.
+            socket.setKeepAlive(true, KEEPALIVE_IDLE_MS);
             resolve(socket);
         });
         socket.once('error', (e) => {
@@ -19,6 +22,8 @@ const connectOnce = (host, port, timeoutMs) => {
     });
 };
 /** Tries every address the sandbox published and returns the first one that answers. */
+/** Idle time before TCP keepalive probes start (the same as ptyhost's own side). */
+const KEEPALIVE_IDLE_MS = 10_000;
 export async function connect(endpoint, timeoutMs = 3000) {
     const errors = [];
     for (const address of endpoint.addresses) {

package/dist/sync/watcher.d.ts

@@ -23,6 +23,8 @@ export declare class Watcher {
     private views;
     private stops;
     private watchdogTimer;
+    /** This PC's memory, read by one long-running HostTools instead of a program per sample. */
+    private memoryStream;
     private watchdog;
     private watchdogBusy;
     private lastCpu;

package/dist/sync/watcher.js

@@ -13,7 +13,7 @@ import { readForwards, sandboxAddress, startPortForwards } from '../host/network
 import { AuditCollector, readAuditSettings } from '../host/audit/collect.js';
 import { readMarkedProjects, saveDataSize, watchAndMark } from '../host/guard/index.js';
 import { sizeWithin } from '../core/disk.js';
-import { autoRestartAllowed, causeSince, appendHostMemory, cpuPercentBetween, KeepAwake, LifeRecord, readHostMemoryAsync, readLoadSettings, REQUEST_SECONDS, WATCHDOG_START, watchdogStep, saveCrashReport, SessionLedger, } from '../host/life/index.js';
+import { autoRestartAllowed, causeSince, appendHostMemory, cpuPercentBetween, KeepAwake, LifeRecord, HostMemoryStream, readHostMemoryAsync, readLoadSettings, REQUEST_SECONDS, WATCHDOG_START, watchdogStep, saveCrashReport, SessionLedger, } from '../host/life/index.js';
 import { SandboxChannel } from '../host/channel/index.js';
 import { ProjectRegistry } from '../host/projects/registry.js';
 import { ContainedStorage, setNameOf, storageOf } from '../host/storage/index.js';
@@ -85,6 +85,8 @@ export class Watcher {
     views = [];
     stops = [];
     watchdogTimer = null;
+    /** This PC's memory, read by one long-running HostTools instead of a program per sample. */
+    memoryStream = null;
     watchdog = WATCHDOG_START;
     watchdogBusy = false;
     lastCpu = os.cpus();
@@ -208,6 +210,8 @@ export class Watcher {
         });
         this.stops = [...viewStops, stopForwards, stopMarking];
         // Memory and CPU of this PC: when low, the sandbox is asked to slow its builds down (host/life/watchdog.ts).
+        this.memoryStream = new HostMemoryStream(storageRoot, WATCHDOG_MS / 1000);
+        this.memoryStream.start();
         this.watchdogTimer = setInterval(() => void this.watchHost(), WATCHDOG_MS);
         this.watchdogTimer.unref();
         // sandbox.keepAwake, and the life record that tells the next launch how this run ended (host/life).
@@ -220,7 +224,7 @@ export class Watcher {
         this.watchdogBusy = true;
         try {
             const settings = readLoadSettings(this.storageRoot, this.dataPath);
-            const memory = await readHostMemoryAsync(this.storageRoot);
+            const memory = this.memoryStream?.latest() ?? (await readHostMemoryAsync(this.storageRoot));
             const cpus = os.cpus();
             const cpuPercent = cpuPercentBetween(this.lastCpu, cpus);
             this.lastCpu = cpus;
@@ -324,6 +328,7 @@ export class Watcher {
         this.awake?.stop();
         if (this.watchdogTimer)
             clearInterval(this.watchdogTimer);
+        this.memoryStream?.stop();
         this.stops.forEach((stop) => stop());
         if (this.auditTimer)
             clearInterval(this.auditTimer);

package/dist/web/index.html

@@ -5,8 +5,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>Sandbox</title>
     <link rel="icon" href="data:," />
-    <link rel="stylesheet" href="/main-6JF3ASB5.css" />
-    <script type="module" src="/main-Z645W45E.js"></script>
+    <link rel="stylesheet" href="/main-RQFN4WBY.css" />
+    <script type="module" src="/main-QL7KHCEE.js"></script>
   </head>
   <body>
     <div id="root"></div>