windows-development-sandbox 1.13.2 → 1.14.0

package/dist/bin/{chunk-VENWSGX2.js → chunk-BQ23GBLC.js}

@@ -20056,7 +20056,7 @@ var require_websocket = __commonJS({
     var EventEmitter = __require("events");
     var https2 = __require("https");
     var http3 = __require("http");
-    var net7 = __require("net");
+    var net8 = __require("net");
     var tls = __require("tls");
     var { randomBytes, createHash } = __require("crypto");
     var { Duplex, Readable: Readable2 } = __require("stream");
@@ -20813,12 +20813,12 @@ var require_websocket = __commonJS({
     }
     function netConnect(options) {
       options.path = options.socketPath;
-      return net7.connect(options);
+      return net8.connect(options);
     }
     function tlsConnect(options) {
       options.path = void 0;
       if (!options.servername && options.servername !== "") {
-        options.servername = net7.isIP(options.host) ? "" : options.host;
+        options.servername = net8.isIP(options.host) ? "" : options.host;
       }
       return tls.connect(options);
     }
@@ -51219,6 +51219,14 @@ var ContainedStorage = class {
         userSid: this.deps.userSid()
       });
       this.requireOk(outcome, "mount");
+    } else {
+      const confirmed = await this.deps.port.confirmMounted?.({
+        paths,
+        maxGb: this.deps.maxGb,
+        create: false,
+        userSid: this.deps.userSid()
+      });
+      if (confirmed) this.requireOk(confirmed, "mount");
     }
     this.assertReallyMounted();
     for (const name2 of CONTAINED_FOLDERS) fs18.mkdirSync(path26.join(paths.mount, name2), { recursive: true });
@@ -51473,6 +51481,138 @@ function safeJson(text) {
   }
 }
 
+// src/host/storage/contained/helper-port.ts
+import net from "node:net";
+var HELPER_PIPE = "\\\\.\\pipe\\AgentSandboxStorage";
+var HELPER_PROTOCOL = 1;
+var MOUNT_TIMEOUT_MS2 = 10 * 6e4;
+var MAX_ANSWER_BYTES = 64 * 1024;
+var HelperRequestSchema = external_exports.object({ verb: external_exports.enum(["mount", "dismount"]), set: external_exports.string().regex(SET_NAME_RULE) }).strict();
+var HelperAnswerSchema = external_exports.object({
+  protocol: external_exports.number().int(),
+  ok: external_exports.boolean(),
+  message: external_exports.string().max(4e3),
+  created: external_exports.boolean(),
+  alreadyMounted: external_exports.boolean(),
+  fallback: external_exports.boolean(),
+  image: external_exports.string().max(1e3),
+  mount: external_exports.string().max(1e3),
+  notes: external_exports.array(external_exports.string().max(1e3)).max(50)
+});
+var ABSENT_CODES = /* @__PURE__ */ new Set(["ENOENT", "EACCES", "EPERM", "ECONNREFUSED"]);
+var pipeConnector = (pipe2, line, timeoutMs) => new Promise((resolve) => {
+  let text = "";
+  let connected = false;
+  let settled = false;
+  const done = (result) => {
+    if (settled) return;
+    settled = true;
+    clearTimeout(timer);
+    socket.destroy();
+    resolve(result);
+  };
+  const socket = net.connect(pipe2);
+  const timer = setTimeout(
+    () => done({ kind: "failed", reason: "the storage helper did not answer in time" }),
+    timeoutMs
+  );
+  socket.setEncoding("utf8");
+  socket.on("connect", () => {
+    connected = true;
+    socket.write(line + "\n");
+  });
+  socket.on("data", (chunk) => {
+    text += chunk;
+    const end = text.indexOf("\n");
+    if (end >= 0) done({ kind: "answer", text: text.slice(0, end) });
+    else if (text.length > MAX_ANSWER_BYTES) done({ kind: "failed", reason: "the storage helper answered too much" });
+  });
+  socket.on("error", (e) => {
+    if (!connected && ABSENT_CODES.has(e.code ?? "")) done({ kind: "absent", reason: e.code ?? "no pipe" });
+    else done({ kind: "failed", reason: e.message });
+  });
+  socket.on("close", () => done({ kind: "failed", reason: "the storage helper closed the connection" }));
+});
+function helperApplies(env, configOverridden) {
+  if (configOverridden) return false;
+  return !env.AGENT_SANDBOX_CONFIG && !env.AGENT_SANDBOX_HOME;
+}
+function samePaths(answer, paths) {
+  const norm3 = (p) => p.replace(/\\+$/, "").toLowerCase();
+  return norm3(answer.image) === norm3(paths.image) && norm3(answer.mount) === norm3(paths.mount);
+}
+function readAnswer(result, paths) {
+  if (result.kind === "absent") return { use: "fallback", why: "no storage helper (" + result.reason + ")" };
+  if (result.kind === "failed")
+    return { use: "outcome", outcome: failed("The storage helper did not finish: " + result.reason + ".") };
+  let raw;
+  try {
+    raw = JSON.parse(result.text);
+  } catch {
+    return { use: "fallback", why: "the storage helper gave an answer that is not JSON" };
+  }
+  const parsed = HelperAnswerSchema.safeParse(raw);
+  if (!parsed.success || parsed.data.protocol !== HELPER_PROTOCOL)
+    return { use: "fallback", why: "the storage helper speaks another version" };
+  const answer = parsed.data;
+  if (answer.fallback) return { use: "fallback", why: answer.message };
+  if (answer.ok && !samePaths(answer, paths))
+    return {
+      use: "outcome",
+      outcome: failed(
+        "The storage helper used other folders (" + answer.mount + ") than this command (" + paths.mount + "): your settings differ from what it reads. Run sandbox doctor."
+      )
+    };
+  return {
+    use: "outcome",
+    outcome: {
+      ok: answer.ok,
+      message: answer.message,
+      created: answer.created,
+      alreadyMounted: answer.alreadyMounted,
+      notes: answer.notes
+    }
+  };
+}
+function failed(message) {
+  return { ok: false, message, created: false, alreadyMounted: false, notes: [] };
+}
+var HelperDiskPort = class {
+  constructor(fallback, applies, connect2 = pipeConnector, pipe2 = HELPER_PIPE) {
+    this.fallback = fallback;
+    this.applies = applies;
+    this.connect = connect2;
+    this.pipe = pipe2;
+  }
+  fallback;
+  applies;
+  connect;
+  pipe;
+  async mount(request2) {
+    const answer = await this.ask({ verb: "mount", set: request2.paths.set }, request2.paths);
+    return answer ?? this.fallback.mount(request2);
+  }
+  /** The helper checks a mount without a prompt (it is "mounted already" only for this image); null without it. */
+  confirmMounted(request2) {
+    return this.ask({ verb: "mount", set: request2.paths.set }, request2.paths);
+  }
+  async dismount(request2) {
+    const answer = await this.ask({ verb: "dismount", set: request2.paths.set }, request2.paths);
+    return answer ?? this.fallback.dismount(request2);
+  }
+  reality(paths) {
+    return this.fallback.reality(paths);
+  }
+  /** The helper's outcome, or null to use the permission prompt. */
+  async ask(request2, paths) {
+    if (!this.applies) return null;
+    if (this.pipe === HELPER_PIPE) refuseInSelfTest("mount or dismount a disk image");
+    const line = JSON.stringify(HelperRequestSchema.parse(request2));
+    const read = readAnswer(await this.connect(this.pipe, line, MOUNT_TIMEOUT_MS2), paths);
+    return read.use === "outcome" ? read.outcome : null;
+  }
+};
+
 // src/host/storage/contained/resolve.ts
 import fs21 from "node:fs";
 import path29 from "node:path";
@@ -52959,6 +53099,11 @@ var RunDir = class {
   projectsDir;
   /** audit.processes: programs the sandbox started, in small .jsonl files the host takes in and deletes. */
   auditDir;
+  /**
+   * Each running session's process tree, recorded by its ptyhost (guest only: the daemon ends what a ptyhost that was
+   * itself ended left running).
+   */
+  treesDir;
   /** One-shot secrets the host hands over (see secrets.ts). Next to run, not in it: shared-use users can change run. */
   secretsDir;
   constructor(dataDir) {
@@ -52972,6 +53117,7 @@ var RunDir = class {
     this.sessionsDir = path41.join(this.root, "sessions");
     this.projectsDir = path41.join(this.root, "projects");
     this.auditDir = path41.join(this.root, "audit");
+    this.treesDir = path41.join(this.root, "trees");
     this.secretsDir = path41.join(dataDir, "secrets");
   }
   requestFile(id) {
@@ -52983,6 +53129,9 @@ var RunDir = class {
   sessionFile(id) {
     return path41.join(this.sessionsDir, safeId(id) + ".json");
   }
+  treeFile(id) {
+    return path41.join(this.treesDir, safeId(id) + ".json");
+  }
   projectFile(name2) {
     return path41.join(this.projectsDir, safeId(name2) + ".json");
   }
@@ -53218,6 +53367,8 @@ var InstallRecordSchema = external_exports.object({
   scope: external_exports.enum(["user", "machine"]),
   groupSid: external_exports.string().nullable(),
   autoUpdate: external_exports.boolean(),
+  /** All-users installs: the storage helper service (AgentSandboxStorage) was installed. Older records have none. */
+  storageHelper: external_exports.boolean().optional(),
   installedAt: external_exports.string()
 });
 var InstallRecordFile = class {
@@ -53452,7 +53603,15 @@ function beginSharing(deps, start, now2 = /* @__PURE__ */ new Date()) {
   deps.records.write({ ...start, startedAt: start.startedAt ?? now2.toISOString() });
   if (!opens(deps, start.dataPath)) return;
   const run3 = new RunDir(start.dataPath);
-  for (const dir of [run3.root, run3.requestsDir, run3.responsesDir, run3.sessionsDir, run3.projectsDir, run3.auditDir])
+  for (const dir of [
+    run3.root,
+    run3.requestsDir,
+    run3.responsesDir,
+    run3.sessionsDir,
+    run3.projectsDir,
+    run3.auditDir,
+    run3.treesDir
+  ])
     fs32.mkdirSync(dir, { recursive: true });
   const plan = sharingAclPlan({
     storageUserDir: storageOf(start.dataPath),
@@ -53523,13 +53682,13 @@ function machineDoctorRows(packageRoot, dataPath) {
 }
 
 // src/host/sandbox/contained-deps.ts
-function realContainedDeps(storageRoot, maxGb) {
+function realContainedDeps(storageRoot, maxGb, configOverridden = false) {
   return {
     storageRoot,
     maxGb,
     protect: (dir) => protectPrivateFolder(dir),
     userSid: currentUserSid,
-    port: new ScriptDiskPort(),
+    port: new HelperDiskPort(new ScriptDiskPort(), helperApplies(process.env, configOverridden)),
     sandboxRunning: isSandboxRunning
   };
 }
@@ -59196,7 +59355,7 @@ import fs73 from "node:fs";
 import path95 from "node:path";
 
 // src/shared/vpn/wireguard.ts
-import net from "node:net";
+import net2 from "node:net";
 var MAX_WIREGUARD_BYTES = 16 * 1024;
 var MAX_LINES3 = 300;
 var MAX_PEERS = 16;
@@ -59209,7 +59368,7 @@ var HOST2 = /^(?:\d{1,3}(?:\.\d{1,3}){3}|[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za
 function validCidr(text) {
   const [addr, prefix, ...rest] = text.split("/");
   if (rest.length > 0 || !addr) return false;
-  const version2 = net.isIP(addr);
+  const version2 = net2.isIP(addr);
   if (version2 === 0) return false;
   if (prefix === void 0) return true;
   if (!/^\d{1,3}$/.test(prefix)) return false;
@@ -59273,10 +59432,10 @@ function inspectWireguard(text) {
   else if (!KEY.test(privateKey)) refuse2("PrivateKey is not a WireGuard key (44 characters of base64)");
   const addresses = joined(face, "address");
   if (addresses.length === 0 || !addresses.every(validCidr)) refuse2("[Interface] needs valid Address values");
-  else if (!addresses.some((a) => net.isIPv4(a.split("/")[0])))
+  else if (!addresses.some((a) => net2.isIPv4(a.split("/")[0])))
     refuse2("Address needs an IPv4 address (the kill switch works on IPv4)");
   const dns = joined(face, "dns");
-  if (!dns.every((d) => net.isIP(d) !== 0)) refuse2("DNS may only list IP addresses");
+  if (!dns.every((d) => net2.isIP(d) !== 0)) refuse2("DNS may only list IP addresses");
   const mtuText = one(face, "mtu");
   const mtu = mtuText === void 0 ? void 0 : inRange(mtuText, 576, 1500);
   if (mtuText !== void 0 && mtu === null) refuse2("MTU must be a number from 576 to 1500");
@@ -59296,7 +59455,7 @@ function inspectWireguard(text) {
     const m = endpoint ? /^([^:[\]]+):(\d{1,5})$/.exec(endpoint) : null;
     if (!m || !HOST2.test(m[1]) || inRange(m[2], 1, 65535) === null)
       return refuse2(who + "Endpoint must be host:port with a name or an IPv4 address");
-    if (/^\d+\.\d+\.\d+\.\d+$/.test(m[1]) && !net.isIPv4(m[1])) return refuse2(who + "Endpoint is not a valid address");
+    if (/^\d+\.\d+\.\d+\.\d+$/.test(m[1]) && !net2.isIPv4(m[1])) return refuse2(who + "Endpoint is not a valid address");
     const keepText = one(p, "persistentkeepalive");
     let keepalive;
     if (keepText !== void 0 && keepText.toLowerCase() !== "off") {
@@ -59892,7 +60051,7 @@ import fs80 from "node:fs";
 import path105 from "node:path";
 
 // src/host/network/port-forward.ts
-import net4 from "node:net";
+import net5 from "node:net";
 
 // src/shared/network/policy.ts
 function relayPort(index) {
@@ -60131,14 +60290,14 @@ var SandboxChannel = class {
       removeLink(p.root);
       return;
     }
-    for (const target2 of [p.sandboxFile, p.requestsDir, p.responsesDir, p.sessionsDir, p.projectsDir]) {
+    for (const target2 of [p.sandboxFile, p.requestsDir, p.responsesDir, p.sessionsDir, p.projectsDir, p.treesDir]) {
       safeRemove(target2, this.dataPath);
     }
   }
 };
 
 // src/host/channel/attach.ts
-import net3 from "node:net";
+import net4 from "node:net";
 import os16 from "node:os";
 
 // src/shared/pty/protocol.ts
@@ -60197,10 +60356,10 @@ var FrameReader = class {
 };
 
 // src/shared/pty/client.ts
-import net2 from "node:net";
+import net3 from "node:net";
 var connectOnce = (host, port, timeoutMs) => {
   return new Promise((resolve, reject) => {
-    const socket = net2.connect({ host, port });
+    const socket = net3.connect({ host, port });
     const timer = setTimeout(() => {
       socket.destroy();
       reject(new Error("timed out connecting to " + host + ":" + port));
@@ -60485,12 +60644,175 @@ var CtrlCGuard = class {
   }
 };
 
-// src/shared/pty/terminal.ts
-var MOUSE_OFF = "\x1B[?1000l\x1B[?1002l\x1B[?1003l\x1B[?1005l\x1B[?1006l\x1B[?1015l";
+// src/shared/pty/key-gate.ts
 function fixWindowsKeys(chunk) {
   if (!chunk.includes(8) && !chunk.includes(127)) return chunk;
   return Buffer.from(chunk.map((b) => b === 8 ? 127 : b === 127 ? 8 : b));
 }
+var KeyGate = class {
+  pending = [];
+  decided;
+  swap = false;
+  /** windowsConsole: input comes from a Windows console in raw mode (its mode is decided later); else it goes as is. */
+  constructor(windowsConsole) {
+    this.decided = !windowsConsole;
+  }
+  /** The bytes to send now (empty while the mode is not known yet). */
+  push(data) {
+    if (!data.length) return data;
+    if (!this.decided) {
+      this.pending.push(data);
+      return Buffer.alloc(0);
+    }
+    return this.swap ? fixWindowsKeys(data) : data;
+  }
+  /** The console's mode is known: what was held, ready to send. Later calls only change how new input is read. */
+  decide(vtInput) {
+    this.swap = !vtInput;
+    this.decided = true;
+    const held = Buffer.concat(this.pending);
+    this.pending = [];
+    return this.swap ? fixWindowsKeys(held) : held;
+  }
+};
+
+// src/shared/pty/mouse-modes.ts
+var TRACKING = [9, 1e3, 1002, 1003];
+var MAX_PARAMS = 64;
+var MOTION = 32;
+var NO_BUTTON = 3;
+var MouseModes = class {
+  on = /* @__PURE__ */ new Set();
+  /** 0 text, 1 after ESC, 2 after ESC[, 3 in ESC[? parameters, 4 after ESC[! */
+  state = 0;
+  params = "";
+  /** Reads the program's output (after OutputFilter): the mode changes in it. */
+  watch(output2) {
+    for (const b of output2) {
+      if (b === 27) {
+        this.state = 1;
+        continue;
+      }
+      if (this.state === 1) {
+        if (b === 99) this.on.clear();
+        this.state = b === 91 ? 2 : 0;
+      } else if (this.state === 2) {
+        this.state = b === 63 ? 3 : b === 33 ? 4 : 0;
+        this.params = "";
+      } else if (this.state === 4) {
+        if (b === 112) this.on.clear();
+        this.state = 0;
+      } else if (this.state === 3) {
+        if (b >= 48 && b <= 57 || b === 59) {
+          this.params += String.fromCharCode(b);
+          if (this.params.length > MAX_PARAMS) this.state = 0;
+        } else {
+          if (b === 104 || b === 108) this.apply(this.params, b === 104);
+          this.state = 0;
+        }
+      }
+    }
+  }
+  /** The program is gone (exited or restarting): its modes went with it. */
+  reset() {
+    this.on.clear();
+    this.state = 0;
+    this.params = "";
+  }
+  /** True while the program tracks the mouse in any way. */
+  tracking() {
+    return TRACKING.some((m) => this.on.has(m));
+  }
+  /** True while the program has a mode on (2004: bracketed paste). */
+  has(mode) {
+    return this.on.has(mode);
+  }
+  /** The mode numbers on now (for the report and tests). */
+  modes() {
+    return [...this.on].sort((a, b) => a - b);
+  }
+  /** `input` without the mouse reports the program has not asked for. Sequences must be whole (InputJoiner). */
+  filter(input2) {
+    if (!input2.includes(27)) return input2;
+    const parts = [];
+    let from = 0;
+    let i = input2.indexOf(27);
+    while (i !== -1) {
+      const report = mouseReport(input2, i, this.on.has(1005), this.on.has(1015));
+      if (report && !this.allows(report.button)) {
+        parts.push(input2.subarray(from, i));
+        from = i + report.length;
+        i = input2.indexOf(27, from);
+      } else i = input2.indexOf(27, i + 1);
+    }
+    if (from === 0) return input2;
+    parts.push(input2.subarray(from));
+    return Buffer.concat(parts);
+  }
+  allows(button) {
+    if (!this.tracking()) return false;
+    if ((button & MOTION) === 0) return true;
+    if (this.on.has(1003)) return true;
+    return this.on.has(1002) && (button & NO_BUTTON) !== NO_BUTTON;
+  }
+  apply(params, set3) {
+    for (const p of params.split(";")) {
+      const mode = Number(p);
+      if (!p || !Number.isSafeInteger(mode)) continue;
+      if (set3) this.on.add(mode);
+      else this.on.delete(mode);
+    }
+  }
+};
+function mouseReport(data, at, utf8, urxvt) {
+  if (data[at + 1] !== 91) return null;
+  const sgr = data[at + 2] === 60;
+  if (sgr || urxvt && data[at + 2] >= 48 && data[at + 2] <= 57) {
+    let i = at + (sgr ? 3 : 2);
+    let digits = "";
+    let fields = 1;
+    for (; i < data.length && i - at < 32; i++) {
+      const b = data[i];
+      if (b >= 48 && b <= 57) {
+        if (fields === 1) digits += String.fromCharCode(b);
+      } else if (b === 59) fields++;
+      else break;
+    }
+    if (i >= data.length || fields !== 3 || !digits) return null;
+    if (sgr ? data[i] !== 77 && data[i] !== 109 : data[i] !== 77) return null;
+    const button = Number(digits) - (sgr ? 0 : 32);
+    return button >= 0 ? { button, length: i - at + 1 } : null;
+  }
+  if (data[at + 2] === 77 && !utf8 && data.length - at >= 6) {
+    const button = data[at + 3] - 32;
+    return button >= 0 ? { button, length: 6 } : null;
+  }
+  return null;
+}
+
+// src/shared/pty/terminal.ts
+var MOUSE_OFF = "\x1B[?1000l\x1B[?1002l\x1B[?1003l\x1B[?1005l\x1B[?1006l\x1B[?1015l";
+var SETTLE_QUIET_MS = 50;
+var SETTLE_MAX_MS = 300;
+function drainInput(stream) {
+  return new Promise((done) => {
+    let quiet;
+    const end = () => {
+      clearTimeout(quiet);
+      clearTimeout(cap);
+      stream.off("data", onData);
+      done();
+    };
+    const onData = () => {
+      clearTimeout(quiet);
+      quiet = setTimeout(end, SETTLE_QUIET_MS);
+    };
+    const cap = setTimeout(end, SETTLE_MAX_MS);
+    stream.on("data", onData);
+    onData();
+  });
+}
+var VT_WAIT_MS = 1e4;
 function runTerminalClient(socket, token, options = {}) {
   const stdin = process.stdin;
   const stdout = process.stdout;
@@ -60498,14 +60820,16 @@ function runTerminalClient(socket, token, options = {}) {
     const [c2, r] = stdout.isTTY ? stdout.getWindowSize() : [0, 0];
     return [c2 || 120, r || 30];
   };
-  let swapKeys = process.platform === "win32" && stdin.isTTY;
+  const keys = new KeyGate(process.platform === "win32" && Boolean(stdin.isTTY));
   return new Promise((resolve) => {
     let done = false;
     const reader = new FrameReader();
     const filter = new OutputFilter({ clipboardWrites: options.clipboardWrites });
     let sent = size();
     let resizeTimer;
-    let vtInput;
+    let vtInput, vtTimer;
+    const mouse = new MouseModes();
+    let passthrough = false;
     const finish = (result) => {
       if (done) return;
       done = true;
@@ -60516,9 +60840,13 @@ function runTerminalClient(socket, token, options = {}) {
       clearInterval(sizeWatch);
       clearTimeout(joinTimer);
       clearTimeout(hintTimer);
+      clearTimeout(vtTimer);
       socket.destroy();
-      stdout.write("\x1B[0m\x1B[?25h" + MOUSE_OFF + "\r\n");
-      void (vtInput?.stop() ?? Promise.resolve()).then(() => {
+      const tracked = mouse.tracking();
+      const reset = "\x1B[0m\x1B[?25h" + MOUSE_OFF + (mouse.has(2004) ? "\x1B[?2004l" : "") + "\r\n";
+      const flushed = new Promise((written) => stdout.write(reset, () => written()));
+      const settled = tracked ? flushed.then(() => drainInput(stdin)) : Promise.resolve();
+      void Promise.all([settled, vtInput?.stop()]).then(() => {
         if (stdin.isTTY) stdin.setRawMode(false);
         stdin.pause();
         resolve(result);
@@ -60526,9 +60854,10 @@ function runTerminalClient(socket, token, options = {}) {
     };
     const joiner = new InputJoiner();
     let joinTimer;
-    const sendInput = (data) => {
-      if (data.length && !done) socket.write(encodeFrame(FrameType.Input, swapKeys ? fixWindowsKeys(data) : data));
+    const write = (data) => {
+      if (data.length && !done) socket.write(encodeFrame(FrameType.Input, data));
     };
+    const sendInput = (data) => write(keys.push(passthrough ? mouse.filter(data) : data));
     const guard2 = options.confirmCtrlC ? new CtrlCGuard() : null;
     let hintTimer;
     const onInput = (chunk) => {
@@ -60550,7 +60879,6 @@ function runTerminalClient(socket, token, options = {}) {
       sendInput(joiner.push(chunk));
       if (joiner.holding()) joinTimer = setTimeout(() => sendInput(joiner.flush()), JOIN_MS);
     };
-    let passthrough = false;
     const sendSize = () => {
       const [c3, r2] = size();
       if (c3 === sent[0] && r2 === sent[1]) return;
@@ -60580,11 +60908,14 @@ function runTerminalClient(socket, token, options = {}) {
       for (const frame of frames) {
         if (frame.type === FrameType.Output) {
           const out = filter.push(frame.payload);
+          mouse.watch(out);
           guard2?.watchOutput(out.toString("latin1"));
           stdout.write(out);
         } else if (frame.type === FrameType.Console) passthrough = frame.payload.toString("latin1") === "conpty.dll";
-        else if (frame.type === FrameType.Restarting) stdout.write(MOUSE_OFF + "\x1B[2J\x1B[3J\x1B[H");
-        else if (frame.type === FrameType.Exit)
+        else if (frame.type === FrameType.Restarting) {
+          mouse.reset();
+          stdout.write(MOUSE_OFF + "\x1B[2J\x1B[3J\x1B[H");
+        } else if (frame.type === FrameType.Exit)
           finish({ reason: "exit", exitCode: frame.payload.length >= 4 ? frame.payload.readInt32LE(0) : 1 });
         else if (frame.type === FrameType.Error)
           finish({
@@ -60600,8 +60931,10 @@ function runTerminalClient(socket, token, options = {}) {
     socket.write(helloFrame(token, c2, r));
     if (stdin.isTTY) stdin.setRawMode(true);
     vtInput = enableVtInput();
+    vtTimer = setTimeout(() => write(keys.decide(false)), VT_WAIT_MS);
     void vtInput.ready.then((on) => {
-      if (on) swapKeys = false;
+      clearTimeout(vtTimer);
+      write(keys.decide(on));
     });
     stdin.on("data", onInput);
     stdin.resume();
@@ -60612,7 +60945,7 @@ function runTerminalClient(socket, token, options = {}) {
 // src/host/channel/attach.ts
 var ipToInt = (ip) => ip.split(".").reduce((n, part) => n * 256 + Number(part), 0);
 function isSandboxAddress(ip, interfaces = os16.networkInterfaces()) {
-  if (!net3.isIPv4(ip)) return false;
+  if (!net4.isIPv4(ip)) return false;
   return Object.entries(interfaces).some(
     ([name2, list]) => /^vEthernet/i.test(name2) && !/WSL/i.test(name2) && (list ?? []).some((i) => {
       if (i.family !== "IPv4" || i.internal) return false;
@@ -60691,13 +61024,13 @@ function sandboxAddress(dataPath) {
 }
 function startPortForwards(forwards, address, note = () => void 0) {
   const servers = forwards.map((f, i) => {
-    const server = net4.createServer((client) => {
+    const server = net5.createServer((client) => {
       const ip = address();
       if (!ip) {
         client.destroy();
         return;
       }
-      const target2 = net4.connect(relayPort(i), ip);
+      const target2 = net5.connect(relayPort(i), ip);
       client.pipe(target2).pipe(client);
       target2.on("error", () => client.destroy());
       client.on("error", () => target2.destroy());
@@ -61547,7 +61880,10 @@ var Watcher = class {
   /** Contained storage of this data set (only when a mounted image is on record), else null. */
   contained() {
     try {
-      const storage = new ContainedStorage(realContainedDeps(this.storageRoot, 64), setNameOf(this.dataPath));
+      const storage = new ContainedStorage(
+        realContainedDeps(this.storageRoot, 64, Boolean(this.resume.config)),
+        setNameOf(this.dataPath)
+      );
       return storage.isRecorded() ? storage : null;
     } catch {
       return null;
@@ -64698,17 +65034,17 @@ var DataService = class {
   }
   /** Removes the planned folders. A failure on one does not stop the others. */
   clean(plan) {
-    const failed = [];
+    const failed2 = [];
     for (const t of plan.present) {
       try {
         removeTree(t.path, t.root);
       } catch (e) {
-        failed.push(t.target + " (" + errMsg(e) + ")");
+        failed2.push(t.target + " (" + errMsg(e) + ")");
       }
     }
     return {
       freedBytes: plan.totalBytes - import_lodash22.default.sumBy(plan.present, (t) => sizeOf(t.path)),
-      failed,
+      failed: failed2,
       touchedData: plan.present.some((t) => t.root === this.ctx.dataPath || t.target === "all")
     };
   }
@@ -65196,8 +65532,8 @@ function decideUpdate(input2) {
   if (!input2.latest) return skip("no-release");
   const latest = input2.latest;
   if (compareVersions(latest.version, input2.current) <= 0) return skip("up-to-date");
-  const failed = input2.state.failed;
-  if (failed && compareVersions(latest.version, failed.version) <= 0) return skip("failed-before");
+  const failed2 = input2.state.failed;
+  if (failed2 && compareVersions(latest.version, failed2.version) <= 0) return skip("failed-before");
   return { kind: "install", release: latest };
 }
 
@@ -65237,13 +65573,13 @@ function updateNotice(state, current, seenKey) {
   const off = state.autoOff;
   if (off && compareVersions(off.version, current) > 0)
     candidates.push({ at: off.at, notice: { key: "auto-off@" + off.at, text: autoOffText(off.version, current) } });
-  const failed = state.failed;
-  if (failed && compareVersions(failed.version, current) > 0 && off?.version !== failed.version)
+  const failed2 = state.failed;
+  if (failed2 && compareVersions(failed2.version, current) > 0 && off?.version !== failed2.version)
     candidates.push({
-      at: failed.at,
+      at: failed2.at,
       notice: {
-        key: "failed@" + failed.at,
-        text: "Update to " + failed.version + " failed; still on " + current + " (sandbox update --rollback, or sandbox update for details)."
+        key: "failed@" + failed2.at,
+        text: "Update to " + failed2.version + " failed; still on " + current + " (sandbox update --rollback, or sandbox update for details)."
       }
     });
   const newest = candidates.sort((a, b) => Date.parse(b.at) - Date.parse(a.at))[0];
@@ -67615,7 +67951,7 @@ async function knockOnDoor(storageRoot, owner) {
 
 // src/host/remote/cert.ts
 import crypto17 from "node:crypto";
-import net5 from "node:net";
+import net6 from "node:net";
 var CERT_DAYS = 397;
 var DAY_MS4 = 864e5;
 function length(n) {
@@ -67660,13 +67996,13 @@ function extension(id, critical, value) {
 }
 function altNames(addresses, dnsNames) {
   const entries = [
-    ...addresses.filter((a) => net5.isIPv4(a)).map((a) => tlv(135, Buffer.from(a.split(".").map(Number)))),
+    ...addresses.filter((a) => net6.isIPv4(a)).map((a) => tlv(135, Buffer.from(a.split(".").map(Number)))),
     ...dnsNames.filter((d) => /^[A-Za-z0-9-]{1,63}$/.test(d)).map((d) => tlv(130, Buffer.from(d, "ascii")))
   ];
   return seq(...entries);
 }
 function makeCertificate(r) {
-  if (!r.addresses.length || !r.addresses.every((a) => net5.isIPv4(a)))
+  if (!r.addresses.length || !r.addresses.every((a) => net6.isIPv4(a)))
     throw new Error("A certificate needs at least one IPv4 address.");
   const now2 = r.now ?? Date.now();
   const days = r.days ?? CERT_DAYS;
@@ -67716,20 +68052,20 @@ import path137 from "node:path";
 import { spawn as spawn11 } from "node:child_process";
 
 // src/host/remote/lan.ts
-import net6 from "node:net";
+import net7 from "node:net";
 import os20 from "node:os";
 var toInt = (ip) => ip.split(".").reduce((n, part) => n * 256 + Number(part), 0) >>> 0;
 function isPrivateIPv4(ip) {
-  if (!net6.isIPv4(ip)) return false;
+  if (!net7.isIPv4(ip)) return false;
   const [a, b] = ip.split(".").map(Number);
   return a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
 }
 function isLoopbackIPv4(ip) {
-  return net6.isIPv4(ip) && ip.startsWith("127.");
+  return net7.isIPv4(ip) && ip.startsWith("127.");
 }
 function plainIPv4(ip) {
   const value = ip ?? "";
-  return value.startsWith("::ffff:") && net6.isIPv4(value.slice(7)) ? value.slice(7) : value;
+  return value.startsWith("::ffff:") && net7.isIPv4(value.slice(7)) ? value.slice(7) : value;
 }
 function virtualAdapter(name2) {
   return /^vEthernet/i.test(name2) || /Hyper-V|WSL/i.test(name2);
@@ -68090,9 +68426,11 @@ var TerminalBridge = class {
           break;
         }
         case FrameType.Restarting:
+          this.mouseOff();
           this.tell({ t: "restarting" });
           break;
         case FrameType.Exit:
+          this.mouseOff();
           this.tell({ t: "exit", code: frame.payload.length >= 4 ? frame.payload.readInt32LE(0) : 1 });
           this.finish(1e3, "exit");
           return;
@@ -68106,6 +68444,13 @@ var TerminalBridge = class {
     }
     if (this.ws.bufferedAmount > MAX_BUFFERED_BYTES) this.hold();
   }
+  /**
+   * The program's mouse tracking ends with it: the browser's terminal stops sending clicks and moves, and a drag
+   * selects text again (an ended terminal stays on screen).
+   */
+  mouseOff() {
+    if (this.ws.readyState === this.ws.OPEN) this.ws.send(Buffer.from(MOUSE_OFF, "latin1"), { binary: true });
+  }
   /** Stops reading from the session until the browser has taken what it was sent. */
   hold() {
     if (this.drain || !this.socket) return;
@@ -68577,6 +68922,7 @@ var WebServer = class {
   live;
   actualPort = 0;
   lastUsed = Date.now();
+  lastCheck = Date.now();
   heartbeat;
   idleCheck;
   get port() {
@@ -68591,7 +68937,8 @@ var WebServer = class {
         this.heartbeat = setInterval(() => this.beat(), this.options.heartbeatMs ?? HEARTBEAT_MS);
         this.heartbeat.unref();
         if (this.options.idleExitMs) {
-          this.idleCheck = setInterval(() => void this.checkIdle(), Math.min(6e4, this.quietMs()));
+          this.lastCheck = Date.now();
+          this.idleCheck = setInterval(() => void this.checkIdle(), this.checkEveryMs());
           this.idleCheck.unref();
         }
         const gate = this.options.gate;
@@ -68632,6 +68979,9 @@ var WebServer = class {
   /** No browser has used the server for a while: it ends (sooner when no sandbox runs). */
   async checkIdle() {
     const limit = this.options.idleExitMs ?? 0;
+    const now2 = Date.now();
+    if (now2 - this.lastCheck > 3 * this.checkEveryMs()) this.lastUsed = now2;
+    this.lastCheck = now2;
     if (!limit || this.tracked.size > 0) return;
     const idle = Date.now() - this.lastUsed;
     if (idle >= limit) return this.options.onStop?.();
@@ -68643,6 +68993,9 @@ var WebServer = class {
     }
     this.options.onStop?.();
   }
+  checkEveryMs() {
+    return Math.min(6e4, this.quietMs());
+  }
   /** How long unused before it ends when no sandbox runs. */
   quietMs() {
     return Math.min(this.options.idleExitMs ?? 0, this.options.idleNoSandboxMs ?? IDLE_NO_SANDBOX_MS);
@@ -71166,7 +71519,7 @@ function requireNoSandbox() {
 function storageFor(ctx) {
   const { config: config3 } = ctx.loaded;
   return new ContainedStorage(
-    realContainedDeps(ctx.storageRoot, config3.storage.containedMaxGb),
+    realContainedDeps(ctx.storageRoot, config3.storage.containedMaxGb, Boolean(ctx.options.config)),
     config3.storage.dataName
   );
 }
@@ -72551,7 +72904,7 @@ import fs111 from "node:fs";
 function storageOf2(env) {
   const { config: config3 } = env.ctx.loaded;
   return new ContainedStorage(
-    realContainedDeps(env.storageRoot, config3.storage.containedMaxGb),
+    realContainedDeps(env.storageRoot, config3.storage.containedMaxGb, Boolean(env.ctx.options.config)),
     config3.storage.dataName
   );
 }
@@ -76578,13 +76931,13 @@ var cleanEngineRun = implement(cleanEngine, async (ctx, _input, io) => {
       r.stopped ? "ok" : "danger"
     );
   const stopped = results.filter((r) => r.stopped).length;
-  const failed = results.length - stopped;
-  if (failed)
+  const failed2 = results.length - stopped;
+  if (failed2)
     fail(
-      plural2(failed, "HCS system") + " could not be stopped.",
+      plural2(failed2, "HCS system") + " could not be stopped.",
       "Run it again from an administrator terminal: sandbox engine clean"
     );
-  return { available: true, stopped, failed, message: "Stopped " + plural2(stopped, "HCS system") + "." };
+  return { available: true, stopped, failed: failed2, message: "Stopped " + plural2(stopped, "HCS system") + "." };
 });
 
 // src/app/features/vpn/vpn.def.ts
@@ -77449,7 +77802,7 @@ async function attachOpened(ctx, session) {
     nextStep("sandbox attach " + session);
     return 0;
   }
-  const { attach: attach2 } = await import("./chunk-IL7BXJF2.js");
+  const { attach: attach2 } = await import("./chunk-LQHEUN2A.js");
   return attach2({ ...ctx, options: { ...ctx.options, positionals: [session] } });
 }
 function definitionHandler(def) {
@@ -77948,7 +78301,7 @@ var Launcher = class {
     const engine = await openEngine(config3);
     const provider = providerFor(
       config3,
-      config3.storage.contained === "off" ? {} : { contained: realContainedDeps(ctx.storageRoot, config3.storage.containedMaxGb) }
+      config3.storage.contained === "off" ? {} : { contained: realContainedDeps(ctx.storageRoot, config3.storage.containedMaxGb, Boolean(ctx.options.config)) }
     );
     if (!generateOnly) assertCanLaunch(isSandboxRunning() ? runningOwner() : void 0);
     const dataMappings = await this.prepareStorage(provider, run3);