windows-development-sandbox 1.27.1 → 1.28.0

package/dist/bin/{chunk-4TLSWPG7.js → chunk-UZ5S3EMB.js}

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   attach
-} from "./chunk-RSIX7C6D.js";
+} from "./chunk-CB44HTTN.js";
 export {
   attach
 };

package/dist/bin/{chunk-QUHNXHVG.js → chunk-ZMZI3625.js}

@@ -182,6 +182,7 @@ import {
   redactSecrets,
   refreshStorage,
   refuseInSelfTest,
+  reloadSettings,
   reopenSessions,
   reopenedText,
   requestApp,
@@ -257,7 +258,7 @@ import {
   withOperationCommands,
   working,
   writeJson
-} from "./chunk-RSIX7C6D.js";
+} from "./chunk-CB44HTTN.js";
 
 // node_modules/commander/lib/error.js
 var require_error = __commonJS({
@@ -4410,7 +4411,7 @@ function helpOrdered() {
   return [...COMMANDS].sort((x, y) => rank(x.name) - rank(y.name));
 }
 function toOptions(o, wrapper) {
-  const shown2 = o.shownAs && !wrapper ? o.shownAs : o.flag;
+  const shown3 = o.shownAs && !wrapper ? o.shownAs : o.flag;
   const placeholder = o.type === "boolean" ? "" : " <" + (o.value ?? "value") + ">";
   const make = (flag) => {
     const option = new Option((o.short ? o.short + ", " : "") + flag + placeholder, o.description);
@@ -4420,8 +4421,8 @@ function toOptions(o, wrapper) {
     if (o.group) option.helpGroup(o.group + ":");
     return option;
   };
-  const visible = make(shown2);
-  return shown2 === o.flag ? [visible] : [visible, make(o.flag).hideHelp()];
+  const visible = make(shown3);
+  return shown3 === o.flag ? [visible] : [visible, make(o.flag).hideHelp()];
 }
 function toArgument(arg) {
   const name = (arg.required ? "<" : "[") + arg.name + (arg.variadic ? "..." : "") + (arg.required ? ">" : "]");
@@ -4901,10 +4902,10 @@ var TextScreen = class {
     const chars = [...this.value].map((ch) => this.o.masked ? "*" : ch);
     const inner = width - 4;
     const start = Math.max(0, this.cursor - inner + 1);
-    const shown2 = chars.slice(start, start + inner);
-    const before = shown2.slice(0, this.cursor - start).join("");
-    const at = shown2[this.cursor - start] ?? " ";
-    const after = shown2.slice(this.cursor - start + 1).join("");
+    const shown3 = chars.slice(start, start + inner);
+    const before = shown3.slice(0, this.cursor - start).join("");
+    const at = shown3[this.cursor - start] ?? " ";
+    const after = shown3.slice(this.cursor - start + 1).join("");
     const text2 = this.value === "" && this.o.placeholder ? Theme.muted(this.o.placeholder) : before + (Theme.colour ? "\x1B[7m" + at + "\x1B[27m" : "_") + after;
     const body = [
       "",
@@ -5114,10 +5115,10 @@ var PathPickerScreen = class {
     const typing = this.mode === "input";
     const frame = (t) => typing ? Theme.accent(t) : Theme.muted(t);
     const start = Math.max(0, this.cursor - inner + 1);
-    const shown2 = this.input.slice(start, start + inner);
-    const before = shown2.slice(0, this.cursor - start);
-    const at = shown2[this.cursor - start] ?? " ";
-    const after = shown2.slice(this.cursor - start + 1);
+    const shown3 = this.input.slice(start, start + inner);
+    const before = shown3.slice(0, this.cursor - start);
+    const at = shown3[this.cursor - start] ?? " ";
+    const after = shown3.slice(this.cursor - start + 1);
     const cursor = typing ? Theme.colour ? "\x1B[7m" + at + "\x1B[27m" : "_" : at;
     const field = this.input === "" && !typing ? Theme.muted("type a path or pick below") : before + cursor + after;
     const verdict = this.verdict();
@@ -5540,17 +5541,17 @@ var OverlayScreen = class {
 var KeyBar = class {
   static render(keys, width) {
     const line = (list) => " " + list.map(([k, what]) => Theme.key(k) + " " + Theme.muted(what)).join("  ");
-    const shown2 = [...keys];
+    const shown3 = [...keys];
     const importance = (k) => k[2] ?? 5;
-    while (Text.width(line(shown2)) > width - 1) {
+    while (Text.width(line(shown3)) > width - 1) {
       let drop = -1;
-      shown2.forEach((k, i) => {
-        if (importance(k) > 0 && (drop < 0 || importance(k) >= importance(shown2[drop]))) drop = i;
+      shown3.forEach((k, i) => {
+        if (importance(k) > 0 && (drop < 0 || importance(k) >= importance(shown3[drop]))) drop = i;
       });
       if (drop < 0) break;
-      shown2.splice(drop, 1);
+      shown3.splice(drop, 1);
     }
-    return Text.truncate(line(shown2), width - 1);
+    return Text.truncate(line(shown3), width - 1);
   }
 };
 
@@ -5584,9 +5585,9 @@ var SideNav = class _SideNav {
       lines.findIndex((l) => l.stop)
     );
     const start = lines.length > height ? Math.min(Math.max(0, at - Math.floor(height / 2)), lines.length - height) : 0;
-    const shown2 = lines.slice(start, start + height).map((l) => l.text);
-    while (shown2.length < height) shown2.push(" ".repeat(width));
-    return shown2;
+    const shown3 = lines.slice(start, start + height).map((l) => l.text);
+    while (shown3.length < height) shown3.push(" ".repeat(width));
+    return shown3;
   }
   static section(nav, section, index, width, slim, standing) {
     const open = index === nav.active;
@@ -6435,8 +6436,8 @@ var StringListEditor = class extends CollectionEditor {
 
 // src/cli/menu/settings/format.ts
 function formatValue(value, max = 60) {
-  const shown2 = valueText(value, void 0, max);
-  return shown2.tone === "ok" ? Theme.ok(shown2.text) : shown2.tone === "muted" ? Theme.muted(shown2.text) : shown2.text;
+  const shown3 = valueText(value, void 0, max);
+  return shown3.tone === "ok" ? Theme.ok(shown3.text) : shown3.tone === "muted" ? Theme.muted(shown3.text) : shown3.text;
 }
 
 // src/cli/menu/settings/collections/map-editor.ts
@@ -7266,34 +7267,35 @@ var ListPage = class {
 };
 
 // src/cli/menu/pages/accounts-page.ts
+function shown(m) {
+  return m.services.filter((s) => s.ready);
+}
 function viewOf(m, category) {
   const agent = m.agents.find((a) => a.name === category);
   if (agent) return menuView(agentPage(agent), { category: agent.name, refresh: false });
-  const service = m.services.find((s) => serviceCategory(s.kind) === category);
+  const service = shown(m).find((s) => serviceCategory(s.kind) === category);
   if (service) return menuView(servicePage(service), { category: serviceCategory(service.kind), refresh: false });
   return menuView({ title: "Accounts", sections: [] }, { refresh: false });
 }
 function accountsOptions(m) {
   return {
     path: [],
-    intro: "Logins saved on this PC, per agent (Use puts one into the sandbox; new launches start with the default), and the service sign-ins sandboxes may get.",
+    intro: "Logins saved on this PC, per agent, and the service sign-ins sandboxes may get.",
     categories: [
       ...m.agents.map((a) => ({
         id: a.name,
         label: a.name,
         description: a.kept ? "Saved " + a.name + " logins." : "This agent's login is not kept between sandboxes: it cannot be pointed at a folder we control."
       })),
-      ...m.services.map((s) => ({
+      ...shown(m).map((s) => ({
         id: serviceCategory(s.kind),
         label: s.label,
-        description: "Your " + s.label + " sign-in for sandboxes that use " + s.usedFor + "."
+        description: "For " + s.usedFor + "."
       }))
     ],
     items: [
       ...m.agents.flatMap((a) => menuView(agentPage(a), { category: a.name, refresh: false }).items),
-      ...m.services.flatMap(
-        (s) => menuView(servicePage(s), { category: serviceCategory(s.kind), refresh: false }).items
-      )
+      ...shown(m).flatMap((s) => menuView(servicePage(s), { category: serviceCategory(s.kind), refresh: false }).items)
     ],
     empty: "No agents.",
     actions: (category) => viewOf(m, category).actions,
@@ -7481,7 +7483,7 @@ var CommandForm = class {
   }
   item(f) {
     const v = this.values.get(this.id(f));
-    const shown2 = v === true ? Theme.ok("On") : v === false || v === void 0 ? Theme.muted(
+    const shown3 = v === true ? Theme.ok("On") : v === false || v === void 0 ? Theme.muted(
       f.kind === "option" && f.spec.type === "boolean" || f.kind === "json" ? "Off" : f.kind === "option" && f.spec.default !== void 0 ? "default " + f.spec.default : f.kind === "arg" && f.spec.required ? "required" : "not set"
     ) : Array.isArray(v) && v.length ? v.join(" ") : Theme.muted("not set");
     const actions = this.actions();
@@ -7489,7 +7491,7 @@ var CommandForm = class {
       return {
         value: this.id(f),
         label: argLabel(f.spec),
-        hint: shown2,
+        hint: shown3,
         description: plainDescription(f.spec.description, actions),
         section: "What",
         keywords: f.spec.name
@@ -7498,7 +7500,7 @@ var CommandForm = class {
       return {
         value: "json",
         label: "Machine-readable output",
-        hint: shown2,
+        hint: shown3,
         description: "Print JSON instead of a table.",
         section: "Output",
         flip: true
@@ -7507,14 +7509,14 @@ var CommandForm = class {
       return {
         value: "extra",
         label: this.spec.passthrough === "agent" ? "Extra arguments for the agent" : "Arguments for the command",
-        hint: shown2,
+        hint: shown3,
         description: this.spec.passthrough === "agent" ? "Passed on to the agent, e.g. --continue." : "The rest of the command line.",
         section: "Output"
       };
     return {
       value: this.id(f),
       label: optionLabel(f.spec),
-      hint: shown2,
+      hint: shown3,
       description: plainDescription(f.spec.description, actions),
       section: f.spec.advanced ? "Advanced" : "Options",
       keywords: f.spec.flag,
@@ -8941,19 +8943,19 @@ function draftSource2(draft) {
     effective: (file, key, config2) => file.isProject ? written(file, key) : draft.has(file, key) ? draft.value(file, key) ?? file.defaultOf(key) : import_lodash5.default.get(config2, key)
   };
 }
-function shown(row, value, max = 60) {
+function shown2(row, value, max = 60) {
   const v = valueText(value, row.field, max);
   return v.tone === "ok" ? Theme.ok(v.text) : v.tone === "muted" ? Theme.muted(v.text) : v.text;
 }
 function item(row, file, draft) {
   const unsaved = draft.has(file, row.key);
   const paint2 = file.isProject ? Theme.project : Theme.changed;
-  const value = file.isProject && !row.set ? Theme.muted("all projects: ") + shown(row, row.yours, 40) : shown(row, row.value);
+  const value = file.isProject && !row.set ? Theme.muted("all projects: ") + shown2(row, row.yours, 40) : shown2(row, row.value);
   const details = [
     Theme.muted("Setting       ") + row.id,
-    Theme.muted("All projects  ") + shown(row, row.yours, 40) + Theme.muted(row.yoursSet ? "  (your file)" : "  (built-in default)"),
-    Theme.muted("This project  ") + (row.inProject === void 0 ? Theme.muted("not set") : Theme.project(Text.strip(shown(row, row.inProject, 40)))),
-    ...!file.isProject ? [Theme.muted("Default       ") + shown(row, row.default, 40)] : [],
+    Theme.muted("All projects  ") + shown2(row, row.yours, 40) + Theme.muted(row.yoursSet ? "  (your file)" : "  (built-in default)"),
+    Theme.muted("This project  ") + (row.inProject === void 0 ? Theme.muted("not set") : Theme.project(Text.strip(shown2(row, row.inProject, 40)))),
+    ...!file.isProject ? [Theme.muted("Default       ") + shown2(row, row.default, 40)] : [],
     ...unsaved ? [Theme.warn("Unsaved: Ctrl+S saves, z undoes this change.")] : [],
     ...file.isProject && row.locked ? [Theme.warn(Theme.glyph.lock + " A project can only make this stricter than your own setting.")] : []
   ];
@@ -9620,7 +9622,10 @@ var Menu = class {
         new MaintenancePage(app, ctx)
       ],
       draft,
-      (saved) => this.applyAgentCommands(saved)
+      (saved) => {
+        reloadSettings(this.ctx);
+        return this.applyAgentCommands(saved);
+      }
     );
   }
   /** Runs the menu until you leave it, or until a command that takes over the terminal (attach) has run. */

package/dist/bin/claude-host.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-QUHNXHVG.js";
-import "./chunk-RSIX7C6D.js";
+} from "./chunk-ZMZI3625.js";
+import "./chunk-CB44HTTN.js";
 
 // src/bin/claude-host.ts
 var args = process.argv.slice(2);

package/dist/bin/claude-sbx.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-QUHNXHVG.js";
-import "./chunk-RSIX7C6D.js";
+} from "./chunk-ZMZI3625.js";
+import "./chunk-CB44HTTN.js";
 
 // src/bin/claude-sbx.ts
 run(process.argv.slice(2), { harness: "claude" });

package/dist/bin/codex-sbx.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-QUHNXHVG.js";
-import "./chunk-RSIX7C6D.js";
+} from "./chunk-ZMZI3625.js";
+import "./chunk-CB44HTTN.js";
 
 // src/bin/codex-sbx.ts
 run(process.argv.slice(2), { harness: "codex" });

package/dist/bin/gemini-sbx.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-QUHNXHVG.js";
-import "./chunk-RSIX7C6D.js";
+} from "./chunk-ZMZI3625.js";
+import "./chunk-CB44HTTN.js";
 
 // src/bin/gemini-sbx.ts
 run(process.argv.slice(2), { harness: "gemini" });

package/dist/bin/sandbox.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-QUHNXHVG.js";
-import "./chunk-RSIX7C6D.js";
+} from "./chunk-ZMZI3625.js";
+import "./chunk-CB44HTTN.js";
 
 // src/bin/sandbox.ts
 run(process.argv.slice(2));

package/dist/bin/sbx-hide.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-QUHNXHVG.js";
-import "./chunk-RSIX7C6D.js";
+} from "./chunk-ZMZI3625.js";
+import "./chunk-CB44HTTN.js";
 
 // src/bin/sbx-hide.ts
 run(process.argv.slice(2), { command: "hide" });

package/dist/bin/sbx-show.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-QUHNXHVG.js";
-import "./chunk-RSIX7C6D.js";
+} from "./chunk-ZMZI3625.js";
+import "./chunk-CB44HTTN.js";
 
 // src/bin/sbx-show.ts
 run(process.argv.slice(2), { command: "show" });

package/dist/cli/menu/menu.js

@@ -8,6 +8,7 @@ import { errMsg } from '../../core/util/index.js';
 import { SandboxChannel } from '../../host/channel/index.js';
 import { RunDir } from '../../shared/channel/index.js';
 import { isSandboxRunning } from '../../host/sandbox/index.js';
+import { reloadSettings } from '../../app/context.js';
 import { lookAtSandbox } from '../commands/shared-use.js';
 import { commandLine } from '../history.js';
 import { commandSpec } from '../manifest.js';
@@ -98,7 +99,11 @@ export class Menu {
             new SettingsPage(app, files, draft, ctx),
             new AccountsPage(app, ctx),
             new MaintenancePage(app, ctx),
-        ], draft, (saved) => this.applyAgentCommands(saved));
+        ], draft, (saved) => {
+            // Ctrl+S wrote the file: every page and operation reads the new settings from here on.
+            reloadSettings(this.ctx);
+            return this.applyAgentCommands(saved);
+        });
     }
     /** Runs the menu until you leave it, or until a command that takes over the terminal (attach) has run. */
     async start() {

package/dist/cli/menu/pages/accounts-page.js

@@ -7,12 +7,16 @@ import { readQuery } from '../../../app/registry.js';
 import { MenuOperations } from '../io-menu.js';
 import { menuView } from '../render-view.js';
 import { ListPage } from './list-page.js';
+/** The services the menu lists: those whose sign-in is written (the others would offer actions that cannot work). */
+function shown(m) {
+    return m.services.filter((s) => s.ready);
+}
 /** The menu's rows, keys and Enter labels of one agent's category. */
 function viewOf(m, category) {
     const agent = m.agents.find((a) => a.name === category);
     if (agent)
         return menuView(agentPage(agent), { category: agent.name, refresh: false });
-    const service = m.services.find((s) => serviceCategory(s.kind) === category);
+    const service = shown(m).find((s) => serviceCategory(s.kind) === category);
     if (service)
         return menuView(servicePage(service), { category: serviceCategory(service.kind), refresh: false });
     return menuView({ title: 'Accounts', sections: [] }, { refresh: false });
@@ -21,7 +25,7 @@ function viewOf(m, category) {
 export function accountsOptions(m) {
     return {
         path: [],
-        intro: 'Logins saved on this PC, per agent (Use puts one into the sandbox; new launches start with the default), and the service sign-ins sandboxes may get.',
+        intro: 'Logins saved on this PC, per agent, and the service sign-ins sandboxes may get.',
         categories: [
             ...m.agents.map((a) => ({
                 id: a.name,
@@ -30,15 +34,15 @@ export function accountsOptions(m) {
                     ? 'Saved ' + a.name + ' logins.'
                     : "This agent's login is not kept between sandboxes: it cannot be pointed at a folder we control.",
             })),
-            ...m.services.map((s) => ({
+            ...shown(m).map((s) => ({
                 id: serviceCategory(s.kind),
                 label: s.label,
-                description: 'Your ' + s.label + ' sign-in for sandboxes that use ' + s.usedFor + '.',
+                description: 'For ' + s.usedFor + '.',
             })),
         ],
         items: [
             ...m.agents.flatMap((a) => menuView(agentPage(a), { category: a.name, refresh: false }).items),
-            ...m.services.flatMap((s) => menuView(servicePage(s), { category: serviceCategory(s.kind), refresh: false }).items),
+            ...shown(m).flatMap((s) => menuView(servicePage(s), { category: serviceCategory(s.kind), refresh: false }).items),
         ],
         empty: 'No agents.',
         actions: (category) => viewOf(m, category).actions,

package/dist/core/schema/sandbox.js

@@ -48,7 +48,7 @@ export const SandboxSchema = z.strictObject({
         .describe('The last resort that keeps the sandbox up, in MB below its commit limit (RAM plus paging file): builds are slowed down long before (sandbox.pressureResponse); only if everything the agents start together would take the sandbox to the very edge of its memory, where Windows inside it would start failing, is a build refused memory instead of Windows. "auto" = the larger of 1536 MB and 3 % of the commit limit; "none" = no backstop. Yours only: a project file cannot change it.'),
     pressureResponse: z
         .boolean()
-        .describe('When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. Yours only: a project file cannot change it.'),
+        .describe('When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. A memory gate also holds new compilers and linkers for a moment when the memory of the build programs grows faster than 4 GB in 3 seconds (3 GB with vGPU), and lets them go one at a time. Yours only: a project file cannot change it.'),
     vGpu: z
         .boolean()
         .describe("Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it). Browsers in the sandbox never use it (they draw in software)."),

package/dist/guest/apps/app-installer.js

@@ -3,6 +3,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { appsToInstall, previewGuideLine } from '../../shared/apps/index.js';
+import { asBackground } from '../../shared/concurrency/index.js';
 import { downloader, moveIntoPlace, stagingFolder } from '../../shared/download/index.js';
 import { safeRemove } from '../../shared/io/safe-remove.js';
 import { dryRun, launchDir } from '../runtime/paths.js';
@@ -28,8 +29,8 @@ const MARKER = '.agent-sandbox-app';
 function prefetchedFile(entry, fileName) {
     return path.join(tool('apps', ...entry.id.split('/')) + '.download', fileName.replace(/[\\/:*?"<>|]/g, '_'));
 }
-/** How many apps download and unpack at once (they are big: a few at a time keeps the disk and network busy). */
-const PARALLEL = 3;
+/** How many apps unpack at once (as many as the heavy pool holds: more would only queue up behind it). */
+const PARALLEL = 2;
 export class AppInstaller {
     env;
     options;
@@ -53,7 +54,8 @@ export class AppInstaller {
             !('npm' in e.source) &&
             e.id !== '7zip' &&
             (this.options.refresh || !exists(path.join(tool('apps', ...e.id.split('/')), MARKER))));
-        await Promise.all(todo.map(async (entry) => {
+        // Behind the downloads other steps need now (the runtimes, Visual Studio): these only save time for the install.
+        await asBackground(() => Promise.all(todo.map(async (entry) => {
             try {
                 const d = await resolve(entry);
                 const file = prefetchedFile(entry, d.fileName);
@@ -67,7 +69,7 @@ export class AppInstaller {
             catch {
                 /* the install resolves and downloads again, and reports the reason if it fails too */
             }
-        }));
+        })));
     }
     /** Installs the entries (7-Zip first: the NSIS apps need it to unpack), then their shortcuts. */
     async installAll(entries) {
@@ -124,7 +126,7 @@ export class AppInstaller {
                 throw new Error(entry.exe + ' not found in the download');
             await afterInstall(entry, exe);
             // A proxy or MCP server (agent add-ons) is started by the sandbox or the agent: no PATH entry, no shortcut.
-            if (!entry.service && (entry.cli || entry.id === 'sysinternals')) {
+            if (!entry.service && (entry.cli || entry.onPath || entry.id === 'sysinternals')) {
                 // rustup's rust-analyzer proxy (in cargo's bin folder) only errors until its component is added.
                 if (entry.id === 'rust-analyzer')
                     this.env.prepend.unshift(path.dirname(exe));

package/dist/guest/apps/comet-unpack.js

@@ -9,7 +9,7 @@ import { installedCometExe } from '../browser/comet.js';
 import { execAsync } from '../runtime/process.js';
 import { heavy } from '../../shared/concurrency/index.js';
 import { mkdirp } from '../runtime/fs.js';
-import { signedBy } from '../toolchains/signature.js';
+import { signedByAsync } from '../toolchains/signature.js';
 /** The archives inside, last stage first: the first one found is opened next. */
 const INNER = [
     /^chrome\.7z$/i,
@@ -118,7 +118,7 @@ export async function installFromKept(dest, signer, what) {
     const installed = installedCometExe();
     if (fs.existsSync(installed))
         return installed;
-    if (!signedBy(installer, signer)) {
+    if (!(await signedByAsync(installer, signer))) {
         fs.rmSync(path.join(dest, '.agent-sandbox-app'), { force: true });
         fs.rmSync(installer, { force: true });
         throw new Error(what + "'s installer is not signed by its vendor; deleted it (it is downloaded again next boot)");

package/dist/guest/daemon/heartbeat.js

@@ -23,6 +23,7 @@ export function buildHeartbeat(snapshot, sessionCount, uptimeSeconds, freeBytes,
         ...(snapshot?.diskQueue !== null && snapshot?.diskQueue !== undefined
             ? { diskQueueReported: snapshot.diskQueue }
             : {}),
+        ...(snapshot && snapshot.held > 0 ? { held: Math.min(1024, snapshot.held) } : {}),
         phase: ending ? 'ending' : sessionCount > 0 ? 'working' : 'ready',
     };
 }

package/dist/guest/governor/core.d.ts

@@ -1,12 +1,62 @@
 import type { PressureStatus } from '../../shared/channel/schema.js';
-import type { LoadProfile } from '../../shared/memory/index.js';
+import { z } from 'zod';
+import { type LoadProfile } from '../../shared/memory/index.js';
 import { type GovernorState, type MemSample } from './decide.js';
+/** memgov.exe's arguments: samples every 2 s and the memory gate for this profile. */
+export declare function memgovArgs(profile: LoadProfile): string[];
+/** What the memory gate in memgov reports on its stdout (one JSON line each). */
+export declare const GateEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"ready">;
+    mode: z.ZodEnum<{
+        notify: "notify";
+        poll: "poll";
+    }>;
+    growthMb: z.ZodNumber;
+    windowMs: z.ZodNumber;
+    event: z.ZodLiteral<"gate">;
+    at: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"off">;
+    reason: z.ZodString;
+    event: z.ZodLiteral<"gate">;
+    at: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"trip">;
+    grewMb: z.ZodNumber;
+    ms: z.ZodNumber;
+    jobMb: z.ZodNumber;
+    held: z.ZodArray<z.ZodObject<{
+        pid: z.ZodNumber;
+        name: z.ZodString;
+    }, z.core.$strict>>;
+    event: z.ZodLiteral<"gate">;
+    at: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"hold">;
+    pid: z.ZodNumber;
+    name: z.ZodString;
+    event: z.ZodLiteral<"gate">;
+    at: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"release">;
+    pid: z.ZodNumber;
+    name: z.ZodString;
+    heldMs: z.ZodNumber;
+    forced: z.ZodBoolean;
+    event: z.ZodLiteral<"gate">;
+    at: z.ZodNumber;
+}, z.core.$strict>], "kind">;
+export type GateEvent = z.output<typeof GateEventSchema>;
+/** One memory-log line for a gate event (names cut to 64 characters). */
+export declare function gateLine(e: GateEvent): string;
 /** The newest numbers the governor saw (for the heartbeat file). */
 export interface GovernorSnapshot {
     readonly ramFreePercent: number;
     readonly commitPercent: number;
     readonly step: number;
     readonly hostStep: number;
+    /** Build programs the memory gate holds now. */
+    readonly held: number;
     readonly diskQueue: number | null;
     readonly top: readonly {
         readonly name: string;
@@ -57,6 +107,8 @@ export declare class GovernorCore {
     get snapshot(): GovernorSnapshot | null;
     get current(): GovernorState;
     onSample(sample: MemSample): void;
+    /** An event from the memory gate in memgov: goes to the memory log. */
+    onGate(event: GateEvent): void;
     private apply;
     private note;
 }