windows-development-sandbox 1.11.4 → 1.11.5

package/dist/app/features/accounts/accounts.def.js

@@ -209,7 +209,6 @@ export function agentSection(a) {
         id: a.name,
         title: a.name,
         summary: a.accounts.length ? plural(a.accounts.length, 'saved login') : 'no saved login yet',
-        description: 'Saved ' + a.name + ' logins.',
         cards: true,
         items: [...saveItems(a), ...a.accounts.map((r) => loginItem(a, r))],
     };

package/dist/app/features/health/health.def.js

@@ -165,7 +165,10 @@ export const enableSandbox = defineOperation({
         },
     },
 });
-/** A repair row: what it means is the description; what was found and the fix are the detail lines. */
+/**
+ * A repair row: what it means is the description; what was found and the fix are label/value detail lines ("Found:",
+ * "Fix:"). An ok row has nothing to fix, so what it found is its description.
+ */
 function checkItems(last) {
     return last.checks.map((r, i) => {
         const found = r.detail + (r.timedOut ? ' (took too long)' : '');
@@ -173,14 +176,14 @@ function checkItems(last) {
             .slice(1)
             .map((l) => l.text.trim())
             .filter((l) => !l.startsWith('What it means: '));
-        const details = r.means ? [found, ...rest] : rest;
+        const details = r.status === 'ok' ? [] : ['Found: ' + found, ...rest];
         return {
             id: 'repair:' + i,
             label: r.name,
             hint: BADGE[r.status],
             ...(TONE[r.status] ? { tone: TONE[r.status] } : {}),
             badges: [{ text: BADGE[r.status], ...(TONE[r.status] ? { tone: TONE[r.status] } : {}) }],
-            description: r.means ?? found,
+            description: r.means ?? (details.length ? undefined : found),
             ...(details.length ? { details } : {}),
         };
     });

package/dist/app/features/sandbox/sandbox.def.js

@@ -130,12 +130,12 @@ function projectItem(p) {
         hint: p.host + '  ->  ' + p.guest + '  (' + (MECHANISM_TEXT[p.mechanism] ?? 'wsb share') + ')',
         marked: p.here,
         details: [
-            'setup: ' + p.setup.phase + (p.setup.phase === 'ready' ? '' : ' - ' + p.setup.message),
+            'Setup: ' + p.setup.phase + (p.setup.phase === 'ready' ? '' : ' - ' + p.setup.message),
             ...(p.databases.length
-                ? ['databases: ' + p.databases.map((d) => d.database + ' :' + d.port + ' ' + d.state).join(', ')]
+                ? ['Databases: ' + p.databases.map((d) => d.database + ' :' + d.port + ' ' + d.state).join(', ')]
                 : []),
-            ...p.sessions.map((s) => 'session ' + s.id + '  ' + s.harness + '  ' + s.viewers + '  ' + ago(s.started)),
-            ...p.repoGuard.map((f) => 'guard: ' + f),
+            ...p.sessions.map((s) => 'Session: ' + s.harness + ' ' + s.id + ', ' + s.viewers + ', started ' + ago(s.started)),
+            ...p.repoGuard.map((f) => 'Guard: ' + f),
         ],
     };
 }

package/dist/host/web/runner.d.ts

@@ -8,7 +8,7 @@ export interface WebRunOptions {
     readonly staticRoot: string;
     /** This program's version, kept in the state file. */
     readonly version: string;
-    /** End after this long unused while no sandbox runs (WebServerOptions.idleExitMs). */
+    /** End after this long with no browser (sooner with no sandbox): WebServerOptions.idleExitMs. */
     readonly idleExitMs?: number;
 }
 export declare class WebRunner {

package/dist/host/web/server.d.ts

@@ -4,8 +4,13 @@ import type { Endpoint } from '../../shared/pty/index.js';
 import type { WebBackend } from './backend.js';
 /** No inline script: the page and its script are files from this server. Inline styles are what xterm.js needs. */
 export declare const CONTENT_SECURITY_POLICY: string;
-/** The server ends after this long with no request, no socket and no sandbox running (it starts again with one). */
+/**
+ * The server ends after this long with no browser connected and no request, even while a sandbox runs (sandbox web
+ * open and the next launch start it again), so it never sits in memory unused.
+ */
 export declare const IDLE_EXIT_MS: number;
+/** ...and sooner when no sandbox runs either: there is nothing to look at. */
+export declare const IDLE_NO_SANDBOX_MS: number;
 export declare const RPC_PATH = "/api/rpc";
 export interface WebServerOptions {
     /** 0 picks a free port (tests). */
@@ -20,8 +25,10 @@ export interface WebServerOptions {
     readonly dial?: (endpoint: Endpoint) => Promise<net.Socket>;
     /** The shared core's operations and queries the browser may run (none: /api/rpc is not served). */
     readonly rpc?: RpcHost;
-    /** End by itself (onStop) after this long unused while no sandbox runs; 0 or missing: never (tests). */
+    /** End by itself (onStop) after this long with no browser, even while a sandbox runs; 0 or missing: never (tests). */
     readonly idleExitMs?: number;
+    /** ...or after this long when no sandbox runs either (default IDLE_NO_SANDBOX_MS; tests make it short). */
+    readonly idleNoSandboxMs?: number;
     /** Heartbeat period (tests make it short). */
     readonly heartbeatMs?: number;
 }
@@ -54,8 +61,10 @@ export declare class WebServer {
      * so they never hold a slot or a session connection.
      */
     private beat;
-    /** Nothing has used the server for a while and no sandbox runs: it ends (the next launch starts it again). */
+    /** No browser has used the server for a while: it ends (sooner when no sandbox runs). */
     private checkIdle;
+    /** How long unused before it ends when no sandbox runs. */
+    private quietMs;
     /** Counts a new socket; at the limit, the oldest of its kind makes room (a new tab always works). */
     private track;
     stop(): Promise<void>;

package/dist/host/web/server.js

@@ -19,8 +19,13 @@ const MAX_TERMINALS = 16;
 const MAX_RPC_SOCKETS = 8;
 /** Every socket is pinged this often; one that has not answered the last ping by the next is dropped. */
 const HEARTBEAT_MS = 20_000;
-/** The server ends after this long with no request, no socket and no sandbox running (it starts again with one). */
-export const IDLE_EXIT_MS = 30 * 60_000;
+/**
+ * The server ends after this long with no browser connected and no request, even while a sandbox runs (sandbox web
+ * open and the next launch start it again), so it never sits in memory unused.
+ */
+export const IDLE_EXIT_MS = 20 * 60_000;
+/** ...and sooner when no sandbox runs either: there is nothing to look at. */
+export const IDLE_NO_SANDBOX_MS = 5 * 60_000;
 const SESSION_PATH = /^\/api\/sessions\/([A-Za-z0-9_-]{1,64})\/terminal$/;
 export const RPC_PATH = '/api/rpc';
 class HttpFailure extends Error {
@@ -72,7 +77,7 @@ export class WebServer {
                 this.heartbeat = setInterval(() => this.beat(), this.options.heartbeatMs ?? HEARTBEAT_MS);
                 this.heartbeat.unref();
                 if (this.options.idleExitMs) {
-                    this.idleCheck = setInterval(() => void this.checkIdle(), Math.min(60_000, this.options.idleExitMs));
+                    this.idleCheck = setInterval(() => void this.checkIdle(), Math.min(60_000, this.quietMs()));
                     this.idleCheck.unref();
                 }
                 resolve();
@@ -102,20 +107,29 @@ export class WebServer {
             }
         }
     }
-    /** Nothing has used the server for a while and no sandbox runs: it ends (the next launch starts it again). */
+    /** No browser has used the server for a while: it ends (sooner when no sandbox runs). */
     async checkIdle() {
         const limit = this.options.idleExitMs ?? 0;
-        if (!limit || this.tracked.size > 0 || Date.now() - this.lastUsed < limit)
+        if (!limit || this.tracked.size > 0)
+            return;
+        const idle = Date.now() - this.lastUsed;
+        if (idle >= limit)
+            return this.options.onStop?.();
+        if (idle < this.quietMs())
             return;
         try {
             if ((await this.options.backend.info()).sandbox === 'running')
                 return;
         }
         catch {
-            return; // cannot tell: keep running
+            return; // cannot tell: wait for the longer limit
         }
         this.options.onStop?.();
     }
+    /** How long unused before it ends when no sandbox runs. */
+    quietMs() {
+        return Math.min(this.options.idleExitMs ?? 0, this.options.idleNoSandboxMs ?? IDLE_NO_SANDBOX_MS);
+    }
     /** Counts a new socket; at the limit, the oldest of its kind makes room (a new tab always works). */
     track(ws, kind, limit) {
         const same = [...this.tracked.entries()]

package/dist/runtime/daemon.js

@@ -32063,6 +32063,7 @@ var connectOnce = (host, port, timeoutMs) => {
     socket.once("connect", () => {
       clearTimeout(timer);
       socket.setNoDelay(true);
+      socket.setKeepAlive(true, KEEPALIVE_IDLE_MS);
       resolve2(socket);
     });
     socket.once("error", (e) => {
@@ -32071,6 +32072,7 @@ var connectOnce = (host, port, timeoutMs) => {
     });
   });
 };
+var KEEPALIVE_IDLE_MS = 1e4;
 async function connect(endpoint, timeoutMs = 3e3) {
   const errors = [];
   for (const address of endpoint.addresses) {

package/dist/runtime/main.js

@@ -34686,6 +34686,7 @@ var connectOnce = (host, port, timeoutMs) => {
     socket.once("connect", () => {
       clearTimeout(timer);
       socket.setNoDelay(true);
+      socket.setKeepAlive(true, KEEPALIVE_IDLE_MS);
       resolve2(socket);
     });
     socket.once("error", (e) => {
@@ -34694,6 +34695,7 @@ var connectOnce = (host, port, timeoutMs) => {
     });
   });
 };
+var KEEPALIVE_IDLE_MS = 1e4;
 async function connect(endpoint, timeoutMs = 3e3) {
   const errors = [];
   for (const address of endpoint.addresses) {

package/dist/runtime/view.js

@@ -5594,6 +5594,7 @@ var connectOnce = (host, port, timeoutMs) => {
     socket.once("connect", () => {
       clearTimeout(timer);
       socket.setNoDelay(true);
+      socket.setKeepAlive(true, KEEPALIVE_IDLE_MS);
       resolve(socket);
     });
     socket.once("error", (e) => {
@@ -5602,6 +5603,7 @@ var connectOnce = (host, port, timeoutMs) => {
     });
   });
 };
+var KEEPALIVE_IDLE_MS = 1e4;
 async function connect(endpoint, timeoutMs = 3e3) {
   const errors = [];
   for (const address of endpoint.addresses) {

package/dist/selftest/health.test.js

@@ -524,6 +524,41 @@ async function sharedCore(t) {
     t.equal(keys, ['f', 'l'], 'the health keys are f and l (e only when Windows Sandbox can be turned on)');
     const canEnable = healthPage({ last: { ...saved, setup: { ...saved.setup, canEnable: true } } });
     t.equal(menuView(canEnable, { category: 'health', refresh: false }).actions.map((a) => a.key), ['f', 'l', 'e'], 'e turns Windows Sandbox on when the setup says it can be');
+    const problems = healthPage({
+        last: {
+            ...saved,
+            mode: 'repair',
+            checks: [
+                {
+                    id: 'stale',
+                    group: 'Data folder',
+                    name: 'Stale run folders',
+                    status: 'needs-you',
+                    detail: 'two folders from a sandbox that did not close',
+                    means: 'they take space',
+                    fix: 'stop the sandbox',
+                    lines: ['run-20261012-0931'],
+                    fixable: false,
+                },
+                {
+                    id: 'net',
+                    group: 'Network',
+                    name: 'GitHub',
+                    status: 'warn',
+                    detail: 'no answer',
+                    fix: 'check your VPN',
+                    fixable: false,
+                },
+            ],
+        },
+    });
+    const repairItems = problems.sections.find((s) => s.id === 'repair')?.items ?? [];
+    const stale = repairItems[0];
+    t.equal(stale?.details, ['Found: two folders from a sandbox that did not close', 'Fix: stop the sandbox', 'run-20261012-0931'], 'a repair row lists what was found as a Found: line, then the fix and the paths (ids stay plain)');
+    t.equal(stale?.description, 'they take space', 'a repair row with a meaning shows it as the description');
+    const net = repairItems[1];
+    t.equal(net?.details, ['Found: no answer', 'Fix: check your VPN'], 'a repair row without a meaning still says Found:');
+    t.equal(net?.description, undefined, 'without a meaning, the found text is not repeated as the description');
 }
 export const healthSuite = {
     name: 'health',

package/dist/selftest/live-terminal.test.js

@@ -90,6 +90,36 @@ export const liveTerminalSuite = {
         t.check(!errors, 'ptyhost and the stand-in agent compile', errors);
         if (errors)
             return;
+        t.section('what a program leaves running ends with it (no leftover processes)');
+        {
+            // A copy of PING with a name of its own, started detached and hidden (its own console, so closing the pseudo
+            // console does not end it), by a program that then exits.
+            const probe = t.at('leftover-probe.exe');
+            fs.copyFileSync(path.join(process.env.SystemRoot ?? 'C:\\Windows', 'System32', 'PING.EXE'), probe);
+            const starter = '"' +
+                SYSTEM.powershell() +
+                '" -NoProfile -Command "Start-Process -WindowStyle Hidden -FilePath \'' +
+                probe +
+                "' -ArgumentList '-n','120','127.0.0.1'; Start-Sleep -Seconds 5\"";
+            const host = spawn(ptyhost, [String(await freePort()), 'tok', '80', '24', t.at('leftover.log'), starter], {
+                env: { ...process.env, PTYHOST_BIND: 'loopback' },
+                stdio: 'ignore',
+                windowsHide: true,
+            });
+            const probeRunning = () => spawnSync(SYSTEM.tasklist(), ['/FI', 'IMAGENAME eq leftover-probe.exe', '/NH'], { encoding: 'utf8' })
+                .stdout.toLowerCase()
+                .includes('leftover-probe.exe');
+            await t.waitFor(probeRunning, WAIT.screen);
+            t.check(probeRunning(), 'the program started a background process of its own');
+            await t.waitFor(() => host.exitCode !== null, 30000);
+            await t.waitFor(() => !probeRunning(), 5000);
+            const log = fs.existsSync(t.at('leftover.log')) ? fs.readFileSync(t.at('leftover.log'), 'utf8') : '';
+            t.check(!probeRunning() && /ended [1-9]\d* process\(es\) the program left running/.test(log), 'when the program exits, the background process it left running is ended too', log.slice(-400));
+            if (probeRunning())
+                spawnSync(path.join(process.env.SystemRoot ?? 'C:\\Windows', 'System32', 'taskkill.exe'), ['/F', '/IM', 'leftover-probe.exe'], {
+                    stdio: 'ignore',
+                });
+        }
         t.section("the agents' job: a last-resort backstop, set once");
         {
             // A job of the test's own (PTYHOST_JOB_NAME), never the agents' real one.

package/dist/selftest/support/web-preview.js

@@ -575,6 +575,8 @@ function previewRpc(ctx, state) {
                 return { message: 'Done. Restart Windows to finish. (preview: nothing was changed)' };
             case 'engine.status':
                 return sampleEngines();
+            case 'engine.leftovers':
+                return { available: true, message: 'No HCS systems of yours are running.', systems: [] };
             case 'logs.list':
                 return sampleLogs();
             case 'logs.tail':
@@ -789,6 +791,7 @@ function previewRpc(ctx, state) {
         'logs.list': 'query',
         'logs.tail': 'query',
         'engine.status': 'query',
+        'engine.leftovers': 'query',
     };
     return {
         kind: (id) => kinds[id],

package/dist/selftest/web.test.js

@@ -245,6 +245,39 @@ export const webSuite = {
             await new Promise((r) => setTimeout(r, 300));
             t.check(hub.size === 0 && reads === stopped, 'with nobody watching, nothing is read');
         }
+        t.section('an unused server ends by itself (no process left behind)');
+        {
+            const idleServer = async (sandbox, limits) => {
+                let ended = false;
+                const idle = new WebServer({
+                    port: 0,
+                    token: TOKEN,
+                    backend: {
+                        info: () => Promise.resolve({
+                            sandbox,
+                            owner: null,
+                            canUse: true,
+                            harnesses: [],
+                            defaultHarness: 'claude',
+                            projects: [],
+                        }),
+                        sessions: () => Promise.resolve([]),
+                        endpoint: () => null,
+                    },
+                    staticRoot: t.dir('idle-static-' + sandbox + limits.exit),
+                    idleExitMs: limits.exit,
+                    idleNoSandboxMs: limits.quiet,
+                    onStop: () => (ended = true),
+                });
+                await idle.start();
+                await new Promise((r) => setTimeout(r, 1500));
+                await idle.stop();
+                return ended;
+            };
+            t.check(await idleServer('stopped', { exit: 60_000, quiet: 200 }), 'no browser and no sandbox: it ends after the short wait');
+            t.check(!(await idleServer('running', { exit: 60_000, quiet: 200 })), 'a sandbox runs: the short wait does not end it');
+            t.check(await idleServer('running', { exit: 300, quiet: 200 }), 'no browser for the long wait: it ends even while a sandbox runs');
+        }
         t.section('the server');
         const fake = new FakePtyHost();
         await fake.start();

package/dist/shared/pty/client.d.ts

@@ -4,7 +4,6 @@ export interface Endpoint {
     port: number;
     token: string;
 }
-/** Tries every address the sandbox published and returns the first one that answers. */
 export declare function connect(endpoint: Endpoint, timeoutMs?: number): Promise<net.Socket>;
 /** Sends one control frame (e.g. RESTART) without taking over the screen. */
 export declare function sendControl(endpoint: Endpoint, type: number): Promise<void>;

package/dist/shared/pty/client.js

@@ -10,6 +10,9 @@ const connectOnce = (host, port, timeoutMs) => {
         socket.once('connect', () => {
             clearTimeout(timer);
             socket.setNoDelay(true);
+            // A sandbox that vanished (closed hard, ended in Task Manager) never closes the connection: keepalive notices
+            // within seconds, so an attached terminal or the web's bridge ends instead of hanging on.
+            socket.setKeepAlive(true, KEEPALIVE_IDLE_MS);
             resolve(socket);
         });
         socket.once('error', (e) => {
@@ -19,6 +22,8 @@ const connectOnce = (host, port, timeoutMs) => {
     });
 };
 /** Tries every address the sandbox published and returns the first one that answers. */
+/** Idle time before TCP keepalive probes start (the same as ptyhost's own side). */
+const KEEPALIVE_IDLE_MS = 10_000;
 export async function connect(endpoint, timeoutMs = 3000) {
     const errors = [];
     for (const address of endpoint.addresses) {

package/dist/web/index.html

@@ -5,8 +5,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>Sandbox</title>
     <link rel="icon" href="data:," />
-    <link rel="stylesheet" href="/main-MU5XWZMS.css" />
-    <script type="module" src="/main-SLQNJRXD.js"></script>
+    <link rel="stylesheet" href="/main-RQFN4WBY.css" />
+    <script type="module" src="/main-QL7KHCEE.js"></script>
   </head>
   <body>
     <div id="root"></div>