windows-development-sandbox 1.13.0 → 1.14.0

package/dist/host/storage/contained/state.js

@@ -155,12 +155,15 @@ export function mountedSets(storageRoot) {
 }
 /**
  * A line for the start of a command when the record says an image is mounted that no running process holds and no
- * sandbox uses (nothing is looked up on the disk: this is only the record), or null.
+ * sandbox uses (nothing is looked up on the disk: this is only the record), or null. `sandboxRunning` can be a
+ * function: it is only asked (it runs tasklist) when the record says an image is mounted.
  */
 export function staleMountNote(storageRoot, set, sandboxRunning, alive = processAlive) {
     const record = setStateOf(new JsonFile(ContainedStateSchema, path.join(path.resolve(storageRoot), 'mounts', 'state.json')).read() ??
         EMPTY_STATE, set);
-    if (!record.mounted || sandboxRunning || record.holders.some((h) => alive(h.pid)))
+    if (!record.mounted || record.holders.some((h) => alive(h.pid)))
+        return null;
+    if (typeof sandboxRunning === 'function' ? sandboxRunning() : sandboxRunning)
         return null;
     return 'Contained storage is still mounted from an earlier sandbox. Run sandbox repair to dismount it (Windows asks for permission).';
 }

package/dist/host/web/bridge.d.ts

@@ -23,6 +23,11 @@ export declare class TerminalBridge {
     start(): Promise<void>;
     private fromBrowser;
     private fromSession;
+    /**
+     * The program's mouse tracking ends with it: the browser's terminal stops sending clicks and moves, and a drag
+     * selects text again (an ended terminal stays on screen).
+     */
+    private mouseOff;
     /** Stops reading from the session until the browser has taken what it was sent. */
     private hold;
     private tell;

package/dist/host/web/bridge.js

@@ -1,5 +1,5 @@
 import { safeText } from '../../core/util/index.js';
-import { connect, encodeFrame, FrameReader, FrameType, helloFrame, OutputFilter, PING_INTERVAL_MS, resizeFrame, } from '../../shared/pty/index.js';
+import { connect, encodeFrame, FrameReader, FrameType, helloFrame, MOUSE_OFF, OutputFilter, PING_INTERVAL_MS, resizeFrame, } from '../../shared/pty/index.js';
 import { parseClientMessage } from '../../shared/web/index.js';
 /** The browser is slower than the sandbox: past this much waiting to be sent, output is held back in the socket. */
 const MAX_BUFFERED_BYTES = 4 * 1024 * 1024;
@@ -94,9 +94,11 @@ export class TerminalBridge {
                     break;
                 }
                 case FrameType.Restarting:
+                    this.mouseOff();
                     this.tell({ t: 'restarting' });
                     break;
                 case FrameType.Exit:
+                    this.mouseOff();
                     this.tell({ t: 'exit', code: frame.payload.length >= 4 ? frame.payload.readInt32LE(0) : 1 });
                     this.finish(1000, 'exit');
                     return;
@@ -111,6 +113,14 @@ export class TerminalBridge {
         if (this.ws.bufferedAmount > MAX_BUFFERED_BYTES)
             this.hold();
     }
+    /**
+     * The program's mouse tracking ends with it: the browser's terminal stops sending clicks and moves, and a drag
+     * selects text again (an ended terminal stays on screen).
+     */
+    mouseOff() {
+        if (this.ws.readyState === this.ws.OPEN)
+            this.ws.send(Buffer.from(MOUSE_OFF, 'latin1'), { binary: true });
+    }
     /** Stops reading from the session until the browser has taken what it was sent. */
     hold() {
         if (this.drain || !this.socket)

package/dist/host/web/server.d.ts

@@ -55,6 +55,7 @@ export declare class WebServer {
     private readonly live;
     private actualPort;
     private lastUsed;
+    private lastCheck;
     private heartbeat;
     private idleCheck;
     constructor(options: WebServerOptions);
@@ -69,6 +70,7 @@ export declare class WebServer {
     private beat;
     /** No browser has used the server for a while: it ends (sooner when no sandbox runs). */
     private checkIdle;
+    private checkEveryMs;
     /** How long unused before it ends when no sandbox runs. */
     private quietMs;
     /** Counts a new socket; at the limit, the oldest of its kind makes room (a new tab always works). */

package/dist/host/web/server.js

@@ -55,6 +55,7 @@ export class WebServer {
     live;
     actualPort = 0;
     lastUsed = Date.now();
+    lastCheck = Date.now();
     heartbeat;
     idleCheck;
     constructor(options) {
@@ -82,7 +83,8 @@ export class WebServer {
                 this.heartbeat = setInterval(() => this.beat(), this.options.heartbeatMs ?? HEARTBEAT_MS);
                 this.heartbeat.unref();
                 if (this.options.idleExitMs) {
-                    this.idleCheck = setInterval(() => void this.checkIdle(), Math.min(60_000, this.quietMs()));
+                    this.lastCheck = Date.now();
+                    this.idleCheck = setInterval(() => void this.checkIdle(), this.checkEveryMs());
                     this.idleCheck.unref();
                 }
                 const gate = this.options.gate;
@@ -127,6 +129,11 @@ export class WebServer {
     /** No browser has used the server for a while: it ends (sooner when no sandbox runs). */
     async checkIdle() {
         const limit = this.options.idleExitMs ?? 0;
+        const now = Date.now();
+        // A check much later than planned: the PC slept. Its tabs get time to reconnect before anything counts as idle.
+        if (now - this.lastCheck > 3 * this.checkEveryMs())
+            this.lastUsed = now;
+        this.lastCheck = now;
         if (!limit || this.tracked.size > 0)
             return;
         const idle = Date.now() - this.lastUsed;
@@ -143,6 +150,9 @@ export class WebServer {
         }
         this.options.onStop?.();
     }
+    checkEveryMs() {
+        return Math.min(60_000, this.quietMs());
+    }
     /** How long unused before it ends when no sandbox runs. */
     quietMs() {
         return Math.min(this.options.idleExitMs ?? 0, this.options.idleNoSandboxMs ?? IDLE_NO_SANDBOX_MS);

package/dist/runtime/agent.js

@@ -27173,6 +27173,11 @@ var RunDir = class {
   projectsDir;
   /** audit.processes: programs the sandbox started, in small .jsonl files the host takes in and deletes. */
   auditDir;
+  /**
+   * Each running session's process tree, recorded by its ptyhost (guest only: the daemon ends what a ptyhost that was
+   * itself ended left running).
+   */
+  treesDir;
   /** One-shot secrets the host hands over (see secrets.ts). Next to run, not in it: shared-use users can change run. */
   secretsDir;
   constructor(dataDir2) {
@@ -27186,6 +27191,7 @@ var RunDir = class {
     this.sessionsDir = path5.join(this.root, "sessions");
     this.projectsDir = path5.join(this.root, "projects");
     this.auditDir = path5.join(this.root, "audit");
+    this.treesDir = path5.join(this.root, "trees");
     this.secretsDir = path5.join(dataDir2, "secrets");
   }
   requestFile(id) {
@@ -27197,6 +27203,9 @@ var RunDir = class {
   sessionFile(id) {
     return path5.join(this.sessionsDir, safeId(id) + ".json");
   }
+  treeFile(id) {
+    return path5.join(this.treesDir, safeId(id) + ".json");
+  }
   projectFile(name) {
     return path5.join(this.projectsDir, safeId(name) + ".json");
   }

package/dist/runtime/daemon.js

@@ -27338,6 +27338,11 @@ var RunDir = class {
   projectsDir;
   /** audit.processes: programs the sandbox started, in small .jsonl files the host takes in and deletes. */
   auditDir;
+  /**
+   * Each running session's process tree, recorded by its ptyhost (guest only: the daemon ends what a ptyhost that was
+   * itself ended left running).
+   */
+  treesDir;
   /** One-shot secrets the host hands over (see secrets.ts). Next to run, not in it: shared-use users can change run. */
   secretsDir;
   constructor(dataDir2) {
@@ -27351,6 +27356,7 @@ var RunDir = class {
     this.sessionsDir = path7.join(this.root, "sessions");
     this.projectsDir = path7.join(this.root, "projects");
     this.auditDir = path7.join(this.root, "audit");
+    this.treesDir = path7.join(this.root, "trees");
     this.secretsDir = path7.join(dataDir2, "secrets");
   }
   requestFile(id) {
@@ -27362,6 +27368,9 @@ var RunDir = class {
   sessionFile(id) {
     return path7.join(this.sessionsDir, safeId(id) + ".json");
   }
+  treeFile(id) {
+    return path7.join(this.treesDir, safeId(id) + ".json");
+  }
   projectFile(name) {
     return path7.join(this.projectsDir, safeId(name) + ".json");
   }
@@ -32426,7 +32435,7 @@ function shellLaunch(asked, paths) {
 // src/guest/sessions/pty-host.ts
 import fs50 from "node:fs";
 import path65 from "node:path";
-import { spawn as spawn6 } from "node:child_process";
+import { execFile, spawn as spawn6 } from "node:child_process";
 function ensurePtyHost() {
   return ensureCompiled("ptyhost");
 }
@@ -32458,7 +32467,12 @@ var conptyDll = () => {
   return session.provisioning.conpty?.enabled !== false && fs50.existsSync(dll) && fs50.existsSync(path65.join(toolsDir, "conpty", "OpenConsole.exe")) ? dll : null;
 };
 function startPtyHost(o) {
-  const env = { ...o.env, PTYHOST_BIND: o.remote ? "any" : "loopback" };
+  fs50.mkdirSync(run.treesDir, { recursive: true });
+  const env = {
+    ...o.env,
+    PTYHOST_BIND: o.remote ? "any" : "loopback",
+    PTYHOST_TREE_FILE: run.treeFile(o.id)
+  };
   delete env.PTYHOST_CONPTY;
   const dll = conptyDll();
   if (dll) env.PTYHOST_CONPTY = dll;
@@ -32468,6 +32482,29 @@ function startPtyHost(o) {
     { cwd: o.cwd, env, detached: true, stdio: "ignore", windowsHide: true }
   );
 }
+var END_TREE_MS = 3e4;
+function endLeftoverTree(id, exe = ensurePtyHost()) {
+  const file3 = run.treeFile(id);
+  if (!fs50.existsSync(file3)) return Promise.resolve(null);
+  return new Promise((resolve2) => {
+    execFile(exe, ["--end-tree", file3], { timeout: END_TREE_MS, windowsHide: true }, (error62, stdout) => {
+      const code = error62 ? typeof error62.code === "number" ? error62.code : -1 : 0;
+      if (code !== 3)
+        try {
+          fs50.rmSync(file3, { force: true });
+        } catch {
+        }
+      resolve2(code === 0 ? stdout.trim().slice(0, 200) : code === 3 ? null : "could not end them (code " + code + ")");
+    });
+  });
+}
+function recordedTrees() {
+  try {
+    return fs50.readdirSync(run.treesDir).filter((n) => /^[A-Za-z0-9_-]{1,64}\.json$/.test(n)).map((n) => n.slice(0, -".json".length));
+  } catch {
+    return [];
+  }
+}
 
 // src/guest/agents/agent-installer.ts
 import fs51 from "node:fs";
@@ -32797,7 +32834,23 @@ var SessionManager = class {
   }
   rootStarted(id, child, from) {
     if (child.pid) this.ptyHosts.set(id, { session: id, pid: child.pid, from });
-    child.once("exit", () => this.rootEnded(id));
+    child.once("exit", () => {
+      this.rootEnded(id);
+      this.endLeftovers(id);
+    });
+  }
+  /** What a session's ptyhost left running when it was itself ended (Task Manager, a crash) is ended now. */
+  endLeftovers(id) {
+    void endLeftoverTree(id).then((done) => {
+      if (done) log("Session " + id + ": its session host was ended from outside; " + done + " it left running");
+    }).catch((e) => warn("Ending what session " + id + " left running failed: " + errMsg(e)));
+  }
+  /**
+   * At the daemon's start: trees recorded by session hosts that are gone (a daemon that ended with them) are ended
+   * too. One whose session host still runs is left alone (ptyhost --end-tree checks).
+   */
+  sweepLeftovers() {
+    for (const id of recordedTrees()) if (!this.live.has(id)) this.endLeftovers(id);
   }
   rootEnded(id) {
     const r = this.ptyHosts.get(id);
@@ -33505,6 +33558,7 @@ adoptBootSecrets();
 log("Session daemon started (pid " + process.pid + ").");
 safely("port forwards", startRelays);
 safely("audit", () => startProcessCollector(() => sessions.roots()));
+safely("leftover processes", () => sessions.sweepLeftovers());
 safely("memory governor", () => governor.start());
 log("Memory governor: " + governor.describe());
 new Daemon().start();

package/dist/runtime/db.js

@@ -27211,6 +27211,11 @@ var RunDir = class {
   projectsDir;
   /** audit.processes: programs the sandbox started, in small .jsonl files the host takes in and deletes. */
   auditDir;
+  /**
+   * Each running session's process tree, recorded by its ptyhost (guest only: the daemon ends what a ptyhost that was
+   * itself ended left running).
+   */
+  treesDir;
   /** One-shot secrets the host hands over (see secrets.ts). Next to run, not in it: shared-use users can change run. */
   secretsDir;
   constructor(dataDir2) {
@@ -27224,6 +27229,7 @@ var RunDir = class {
     this.sessionsDir = path5.join(this.root, "sessions");
     this.projectsDir = path5.join(this.root, "projects");
     this.auditDir = path5.join(this.root, "audit");
+    this.treesDir = path5.join(this.root, "trees");
     this.secretsDir = path5.join(dataDir2, "secrets");
   }
   requestFile(id) {
@@ -27235,6 +27241,9 @@ var RunDir = class {
   sessionFile(id) {
     return path5.join(this.sessionsDir, safeId(id) + ".json");
   }
+  treeFile(id) {
+    return path5.join(this.treesDir, safeId(id) + ".json");
+  }
   projectFile(name) {
     return path5.join(this.projectsDir, safeId(name) + ".json");
   }

package/dist/runtime/main.js

@@ -27322,6 +27322,11 @@ var RunDir = class {
   projectsDir;
   /** audit.processes: programs the sandbox started, in small .jsonl files the host takes in and deletes. */
   auditDir;
+  /**
+   * Each running session's process tree, recorded by its ptyhost (guest only: the daemon ends what a ptyhost that was
+   * itself ended left running).
+   */
+  treesDir;
   /** One-shot secrets the host hands over (see secrets.ts). Next to run, not in it: shared-use users can change run. */
   secretsDir;
   constructor(dataDir2) {
@@ -27335,6 +27340,7 @@ var RunDir = class {
     this.sessionsDir = path6.join(this.root, "sessions");
     this.projectsDir = path6.join(this.root, "projects");
     this.auditDir = path6.join(this.root, "audit");
+    this.treesDir = path6.join(this.root, "trees");
     this.secretsDir = path6.join(dataDir2, "secrets");
   }
   requestFile(id) {
@@ -27346,6 +27352,9 @@ var RunDir = class {
   sessionFile(id) {
     return path6.join(this.sessionsDir, safeId(id) + ".json");
   }
+  treeFile(id) {
+    return path6.join(this.treesDir, safeId(id) + ".json");
+  }
   projectFile(name) {
     return path6.join(this.projectsDir, safeId(name) + ".json");
   }
@@ -35339,12 +35348,175 @@ var CtrlCGuard = class {
   }
 };
 
-// src/shared/pty/terminal.ts
-var MOUSE_OFF = "\x1B[?1000l\x1B[?1002l\x1B[?1003l\x1B[?1005l\x1B[?1006l\x1B[?1015l";
+// src/shared/pty/key-gate.ts
 function fixWindowsKeys(chunk) {
   if (!chunk.includes(8) && !chunk.includes(127)) return chunk;
   return Buffer.from(chunk.map((b) => b === 8 ? 127 : b === 127 ? 8 : b));
 }
+var KeyGate = class {
+  pending = [];
+  decided;
+  swap = false;
+  /** windowsConsole: input comes from a Windows console in raw mode (its mode is decided later); else it goes as is. */
+  constructor(windowsConsole) {
+    this.decided = !windowsConsole;
+  }
+  /** The bytes to send now (empty while the mode is not known yet). */
+  push(data) {
+    if (!data.length) return data;
+    if (!this.decided) {
+      this.pending.push(data);
+      return Buffer.alloc(0);
+    }
+    return this.swap ? fixWindowsKeys(data) : data;
+  }
+  /** The console's mode is known: what was held, ready to send. Later calls only change how new input is read. */
+  decide(vtInput) {
+    this.swap = !vtInput;
+    this.decided = true;
+    const held = Buffer.concat(this.pending);
+    this.pending = [];
+    return this.swap ? fixWindowsKeys(held) : held;
+  }
+};
+
+// src/shared/pty/mouse-modes.ts
+var TRACKING = [9, 1e3, 1002, 1003];
+var MAX_PARAMS = 64;
+var MOTION = 32;
+var NO_BUTTON = 3;
+var MouseModes = class {
+  on = /* @__PURE__ */ new Set();
+  /** 0 text, 1 after ESC, 2 after ESC[, 3 in ESC[? parameters, 4 after ESC[! */
+  state = 0;
+  params = "";
+  /** Reads the program's output (after OutputFilter): the mode changes in it. */
+  watch(output3) {
+    for (const b of output3) {
+      if (b === 27) {
+        this.state = 1;
+        continue;
+      }
+      if (this.state === 1) {
+        if (b === 99) this.on.clear();
+        this.state = b === 91 ? 2 : 0;
+      } else if (this.state === 2) {
+        this.state = b === 63 ? 3 : b === 33 ? 4 : 0;
+        this.params = "";
+      } else if (this.state === 4) {
+        if (b === 112) this.on.clear();
+        this.state = 0;
+      } else if (this.state === 3) {
+        if (b >= 48 && b <= 57 || b === 59) {
+          this.params += String.fromCharCode(b);
+          if (this.params.length > MAX_PARAMS) this.state = 0;
+        } else {
+          if (b === 104 || b === 108) this.apply(this.params, b === 104);
+          this.state = 0;
+        }
+      }
+    }
+  }
+  /** The program is gone (exited or restarting): its modes went with it. */
+  reset() {
+    this.on.clear();
+    this.state = 0;
+    this.params = "";
+  }
+  /** True while the program tracks the mouse in any way. */
+  tracking() {
+    return TRACKING.some((m) => this.on.has(m));
+  }
+  /** True while the program has a mode on (2004: bracketed paste). */
+  has(mode) {
+    return this.on.has(mode);
+  }
+  /** The mode numbers on now (for the report and tests). */
+  modes() {
+    return [...this.on].sort((a, b) => a - b);
+  }
+  /** `input` without the mouse reports the program has not asked for. Sequences must be whole (InputJoiner). */
+  filter(input2) {
+    if (!input2.includes(27)) return input2;
+    const parts2 = [];
+    let from = 0;
+    let i = input2.indexOf(27);
+    while (i !== -1) {
+      const report = mouseReport(input2, i, this.on.has(1005), this.on.has(1015));
+      if (report && !this.allows(report.button)) {
+        parts2.push(input2.subarray(from, i));
+        from = i + report.length;
+        i = input2.indexOf(27, from);
+      } else i = input2.indexOf(27, i + 1);
+    }
+    if (from === 0) return input2;
+    parts2.push(input2.subarray(from));
+    return Buffer.concat(parts2);
+  }
+  allows(button) {
+    if (!this.tracking()) return false;
+    if ((button & MOTION) === 0) return true;
+    if (this.on.has(1003)) return true;
+    return this.on.has(1002) && (button & NO_BUTTON) !== NO_BUTTON;
+  }
+  apply(params, set2) {
+    for (const p of params.split(";")) {
+      const mode = Number(p);
+      if (!p || !Number.isSafeInteger(mode)) continue;
+      if (set2) this.on.add(mode);
+      else this.on.delete(mode);
+    }
+  }
+};
+function mouseReport(data, at, utf8, urxvt) {
+  if (data[at + 1] !== 91) return null;
+  const sgr = data[at + 2] === 60;
+  if (sgr || urxvt && data[at + 2] >= 48 && data[at + 2] <= 57) {
+    let i = at + (sgr ? 3 : 2);
+    let digits = "";
+    let fields = 1;
+    for (; i < data.length && i - at < 32; i++) {
+      const b = data[i];
+      if (b >= 48 && b <= 57) {
+        if (fields === 1) digits += String.fromCharCode(b);
+      } else if (b === 59) fields++;
+      else break;
+    }
+    if (i >= data.length || fields !== 3 || !digits) return null;
+    if (sgr ? data[i] !== 77 && data[i] !== 109 : data[i] !== 77) return null;
+    const button = Number(digits) - (sgr ? 0 : 32);
+    return button >= 0 ? { button, length: i - at + 1 } : null;
+  }
+  if (data[at + 2] === 77 && !utf8 && data.length - at >= 6) {
+    const button = data[at + 3] - 32;
+    return button >= 0 ? { button, length: 6 } : null;
+  }
+  return null;
+}
+
+// src/shared/pty/terminal.ts
+var MOUSE_OFF = "\x1B[?1000l\x1B[?1002l\x1B[?1003l\x1B[?1005l\x1B[?1006l\x1B[?1015l";
+var SETTLE_QUIET_MS = 50;
+var SETTLE_MAX_MS = 300;
+function drainInput(stream) {
+  return new Promise((done) => {
+    let quiet;
+    const end = () => {
+      clearTimeout(quiet);
+      clearTimeout(cap);
+      stream.off("data", onData);
+      done();
+    };
+    const onData = () => {
+      clearTimeout(quiet);
+      quiet = setTimeout(end, SETTLE_QUIET_MS);
+    };
+    const cap = setTimeout(end, SETTLE_MAX_MS);
+    stream.on("data", onData);
+    onData();
+  });
+}
+var VT_WAIT_MS = 1e4;
 function runTerminalClient(socket, token, options = {}) {
   const stdin = process.stdin;
   const stdout = process.stdout;
@@ -35352,14 +35524,16 @@ function runTerminalClient(socket, token, options = {}) {
     const [c, r] = stdout.isTTY ? stdout.getWindowSize() : [0, 0];
     return [c || 120, r || 30];
   };
-  let swapKeys = process.platform === "win32" && stdin.isTTY;
+  const keys = new KeyGate(process.platform === "win32" && Boolean(stdin.isTTY));
   return new Promise((resolve2) => {
     let done = false;
     const reader = new FrameReader();
     const filter = new OutputFilter({ clipboardWrites: options.clipboardWrites });
     let sent = size();
     let resizeTimer;
-    let vtInput;
+    let vtInput, vtTimer;
+    const mouse = new MouseModes();
+    let passthrough = false;
     const finish = (result) => {
       if (done) return;
       done = true;
@@ -35370,9 +35544,13 @@ function runTerminalClient(socket, token, options = {}) {
       clearInterval(sizeWatch);
       clearTimeout(joinTimer);
       clearTimeout(hintTimer);
+      clearTimeout(vtTimer);
       socket.destroy();
-      stdout.write("\x1B[0m\x1B[?25h" + MOUSE_OFF + "\r\n");
-      void (vtInput?.stop() ?? Promise.resolve()).then(() => {
+      const tracked = mouse.tracking();
+      const reset = "\x1B[0m\x1B[?25h" + MOUSE_OFF + (mouse.has(2004) ? "\x1B[?2004l" : "") + "\r\n";
+      const flushed = new Promise((written) => stdout.write(reset, () => written()));
+      const settled = tracked ? flushed.then(() => drainInput(stdin)) : Promise.resolve();
+      void Promise.all([settled, vtInput?.stop()]).then(() => {
         if (stdin.isTTY) stdin.setRawMode(false);
         stdin.pause();
         resolve2(result);
@@ -35380,9 +35558,10 @@ function runTerminalClient(socket, token, options = {}) {
     };
     const joiner = new InputJoiner();
     let joinTimer;
-    const sendInput = (data) => {
-      if (data.length && !done) socket.write(encodeFrame(FrameType.Input, swapKeys ? fixWindowsKeys(data) : data));
+    const write = (data) => {
+      if (data.length && !done) socket.write(encodeFrame(FrameType.Input, data));
     };
+    const sendInput = (data) => write(keys.push(passthrough ? mouse.filter(data) : data));
     const guard = options.confirmCtrlC ? new CtrlCGuard() : null;
     let hintTimer;
     const onInput = (chunk) => {
@@ -35404,7 +35583,6 @@ function runTerminalClient(socket, token, options = {}) {
       sendInput(joiner.push(chunk));
       if (joiner.holding()) joinTimer = setTimeout(() => sendInput(joiner.flush()), JOIN_MS);
     };
-    let passthrough = false;
     const sendSize = () => {
       const [c2, r2] = size();
       if (c2 === sent[0] && r2 === sent[1]) return;
@@ -35434,11 +35612,14 @@ function runTerminalClient(socket, token, options = {}) {
       for (const frame of frames) {
         if (frame.type === FrameType.Output) {
           const out = filter.push(frame.payload);
+          mouse.watch(out);
           guard?.watchOutput(out.toString("latin1"));
           stdout.write(out);
         } else if (frame.type === FrameType.Console) passthrough = frame.payload.toString("latin1") === "conpty.dll";
-        else if (frame.type === FrameType.Restarting) stdout.write(MOUSE_OFF + "\x1B[2J\x1B[3J\x1B[H");
-        else if (frame.type === FrameType.Exit)
+        else if (frame.type === FrameType.Restarting) {
+          mouse.reset();
+          stdout.write(MOUSE_OFF + "\x1B[2J\x1B[3J\x1B[H");
+        } else if (frame.type === FrameType.Exit)
           finish({ reason: "exit", exitCode: frame.payload.length >= 4 ? frame.payload.readInt32LE(0) : 1 });
         else if (frame.type === FrameType.Error)
           finish({
@@ -35454,8 +35635,10 @@ function runTerminalClient(socket, token, options = {}) {
     socket.write(helloFrame(token, c, r));
     if (stdin.isTTY) stdin.setRawMode(true);
     vtInput = enableVtInput();
+    vtTimer = setTimeout(() => write(keys.decide(false)), VT_WAIT_MS);
     void vtInput.ready.then((on) => {
-      if (on) swapKeys = false;
+      clearTimeout(vtTimer);
+      write(keys.decide(on));
     });
     stdin.on("data", onInput);
     stdin.resume();

package/dist/runtime/netproxy.js

@@ -27202,6 +27202,11 @@ var RunDir = class {
   projectsDir;
   /** audit.processes: programs the sandbox started, in small .jsonl files the host takes in and deletes. */
   auditDir;
+  /**
+   * Each running session's process tree, recorded by its ptyhost (guest only: the daemon ends what a ptyhost that was
+   * itself ended left running).
+   */
+  treesDir;
   /** One-shot secrets the host hands over (see secrets.ts). Next to run, not in it: shared-use users can change run. */
   secretsDir;
   constructor(dataDir2) {
@@ -27215,6 +27220,7 @@ var RunDir = class {
     this.sessionsDir = path3.join(this.root, "sessions");
     this.projectsDir = path3.join(this.root, "projects");
     this.auditDir = path3.join(this.root, "audit");
+    this.treesDir = path3.join(this.root, "trees");
     this.secretsDir = path3.join(dataDir2, "secrets");
   }
   requestFile(id) {
@@ -27226,6 +27232,9 @@ var RunDir = class {
   sessionFile(id) {
     return path3.join(this.sessionsDir, safeId(id) + ".json");
   }
+  treeFile(id) {
+    return path3.join(this.treesDir, safeId(id) + ".json");
+  }
   projectFile(name) {
     return path3.join(this.projectsDir, safeId(name) + ".json");
   }