windows-development-sandbox 1.27.1 → 1.28.0

package/dist/guest/toolchains/signature.js

@@ -1,11 +1,14 @@
 // A file's Authenticode signature (sandbox\scripts\get-signature.ps1) checked against the signer a download names.
 import { z } from 'zod';
 import { signerMatches } from '../../shared/signer.js';
-import { scriptOutput } from '../runtime/process.js';
+import { scriptOutput, scriptOutputAsync } from '../runtime/process.js';
 const SignatureSchema = z.object({ subject: z.string().max(4096), issuer: z.string().max(4096) });
 /** The names on a file's valid signature, or null when it is unsigned, tampered with, or cannot be read. */
 export function signatureOf(file) {
-    const text = scriptOutput('get-signature.ps1', ['-Path', file]).trim();
+    return parseSignature(scriptOutput('get-signature.ps1', ['-Path', file]));
+}
+function parseSignature(output) {
+    const text = output.trim();
     if (!text)
         return null;
     try {
@@ -20,3 +23,7 @@ export function signatureOf(file) {
 export function signedBy(file, signer) {
     return signerMatches(signatureOf(file), signer);
 }
+/** signedBy without blocking the event loop: a boot check of a big download must not stall the other tasks. */
+export async function signedByAsync(file, signer) {
+    return signerMatches(parseSignature(await scriptOutputAsync('get-signature.ps1', ['-Path', file])), signer);
+}

package/dist/guest/toolchains/step-scheduler.js

@@ -5,7 +5,7 @@ import { downloader } from '../../shared/download/index.js';
 import { errMsg } from '../../core/util/errors.js';
 import { emptyEnv } from './tool-env.js';
 /** How many installers run at once: enough to overlap downloads with installs, few enough not to thrash the disk. */
-const PARALLEL = 4;
+const PARALLEL = 3;
 /** Runs one installer; a failure is reported and skipped so it never blocks the other toolchains. */
 async function runReported(sink, name, env, work) {
     try {

package/dist/host/accounts/deliver.js

@@ -22,19 +22,27 @@ function howToSave(spec) {
         ? 'save one: sandbox account login ' + spec.kind
         : 'save one: sandbox account import ' + spec.kind + ' --from <file>';
 }
-/** The first time a shared kind has nothing saved: this PC's own sign-in, saved like `sandbox account import`. */
-function takeFromPc(kind, pc, store) {
+/**
+ * This PC's own sign-in, saved like `sandbox account import`: when nothing is saved, and when the saved one was taken
+ * from this PC and the PC's has changed since (Epic replaces its token whenever the launcher here renews it, so the
+ * old copy no longer signs in). One a sandbox handed back is newer than the PC's and is kept.
+ */
+function takeFromPc(kind, pc, store, saved) {
     const source = HOST_SOURCES[kind];
     if (!pc || !source.fromPc)
-        return null;
+        return saved;
+    if (saved && store.info(kind)?.source !== 'pc')
+        return saved;
     let payload = null;
     try {
         payload = source.fromPc(pc);
     }
     catch {
-        return null; // This PC's program has no usable sign-in: the note says how to save one.
+        return saved; // This PC's program has no usable sign-in: the saved one (or the note) stands.
     }
-    if (payload)
+    if (!payload)
+        return saved;
+    if (!saved || fingerprint(payload) !== fingerprint(saved))
         store.save(kind, payload, 'pc', source.summary(payload));
     return payload;
 }
@@ -70,8 +78,8 @@ export function prepareServiceAccounts(i) {
             catch {
                 unreadable = true;
             }
-            if (!payload && !unreadable)
-                payload = takeFromPc(kind, i.pc, store);
+            if (!unreadable)
+                payload = takeFromPc(kind, i.pc, store, payload);
             if (spec.singleHolder) {
                 const claim = leases.claim(kind, dataSet, i.launchId, payload ? fingerprint(payload) : null, i.isRunning);
                 if (!claim.ok) {

package/dist/host/life/crash-report.d.ts

@@ -22,6 +22,10 @@ export declare function findingLines(events: readonly StopEvent[]): string[];
 export declare function findDumps(dirs: readonly string[], since: Date): DumpFile[];
 /** Whether the newest launch started at or before `lastSeen` had vGPU on (host-only .wsb in <storage>\launches). */
 export declare function launchHadVgpu(storageRoot: string, lastSeen: string): boolean;
+/**
+ * "This PC still had ..." from the last line of its memory log, when RAM and commit were both 4 GB or more free (pure).
+ */
+export declare function memoryWasFineLine(hostMemoryLog: string): string | null;
 /**
  * The report text (pure): what happened (the sandbox's or this PC's stop code, where the dump is) and the memory log's
  * last lines. `memoryLog` is the sandbox's own file, so it is shown through safeText.

package/dist/host/life/crash-report.js

@@ -54,7 +54,10 @@ export function findingLines(events) {
         lines.push('WHEA-Logger: Windows reported a hardware error (CPU, memory, a bus or a disk): heat or failing hardware.');
     if (has((e) => lower(e).startsWith('hyper-v')))
         lines.push("Hyper-V events: the sandbox's virtual machine (or the service that runs it) reported a problem.");
-    if (has((e) => /^(application error|windows error reporting)$/i.test(e.provider)))
+    const isAppCrash = (e) => /^(application error|windows error reporting)$/i.test(e.provider);
+    if (has((e) => isAppCrash(e) && /vmwp\.exe/i.test(e.process)))
+        lines.push("vmwp.exe, the Windows program that runs the sandbox's VM, crashed. That is a fault in Windows' Hyper-V code or a driver it uses (with vGPU on, usually the graphics driver), not a program inside the sandbox running out of memory.");
+    else if (has(isAppCrash))
         lines.push("A crash report names vmwp.exe or vmmem, the programs that hold the sandbox's VM.");
     return lines;
 }
@@ -122,6 +125,30 @@ function hostMemoryTail(storageRoot, dataPath) {
         return '';
     }
 }
+/**
+ * "This PC still had ..." from the last line of its memory log, when RAM and commit were both 4 GB or more free (pure).
+ */
+export function memoryWasFineLine(hostMemoryLog) {
+    const last = hostMemoryLog
+        .split(/\r?\n/)
+        .filter((l) => l.trim() !== '')
+        .pop();
+    if (!last)
+        return null;
+    const ram = /RAM free\/total MB (\d{1,9})\/(\d{1,9})/.exec(last);
+    const commit = /commit free\/limit MB (\d{1,9})\/(\d{1,9})/.exec(last);
+    if (!ram || !commit)
+        return null;
+    const freeRam = Number(ram[1]);
+    const freeCommit = Number(commit[1]);
+    if (freeRam < 4096 || freeCommit < 4096)
+        return null;
+    return ('This PC still had ' +
+        Math.floor(freeRam / 1024) +
+        ' GB of RAM and ' +
+        Math.floor(freeCommit / 1024) +
+        ' GB of memory (RAM plus paging file) free just before, so it did not run out of memory.');
+}
 /**
  * The report text (pure): what happened (the sandbox's or this PC's stop code, where the dump is) and the memory log's
  * last lines. `memoryLog` is the sandbox's own file, so it is shown through safeText.
@@ -152,6 +179,7 @@ export function crashReportText(cause, events, memoryLog, lastSeen, extra = {})
         .map((l) => '  ' + safeText(l));
     const freeze = freezeLine(cause, lastSeen);
     const meaning = findingLines(unique);
+    const fine = memoryWasFineLine(extra.hostMemoryLog ?? '');
     const dumps = extra.dumps ?? [];
     const vgpu = extra.vgpu ? ['vGPU was on for this sandbox. ' + vgpuWarning('its launch settings'), ''] : [];
     return [
@@ -165,6 +193,7 @@ export function crashReportText(cause, events, memoryLog, lastSeen, extra = {})
         ...vgpu,
         'What that usually means:',
         ...(meaning.length ? meaning.map((l) => '  ' + l) : ['  (no memory, blue screen or hardware event was logged)']),
+        ...(fine ? ['  ' + fine] : []),
         '',
         'Crash dumps Windows left (C:\\Windows\\Minidump, MEMORY.DMP):',
         ...(dumps.length ? dumps.map((d) => '  ' + d.name + '  ' + d.at) : ['  (none from that time)']),

package/dist/host/life/last-end.js

@@ -39,6 +39,7 @@ export function heartbeatLine(hb) {
         hb.step +
         (hb.hostStep > 0 ? ' (this PC asked for step ' + hb.hostStep + ')' : '') +
         (hb.diskQueueReported !== undefined ? ', this PC disk queue ' + hb.diskQueueReported : '') +
+        (hb.held ? ', ' + hb.held + ' builds held by the memory gate' : '') +
         (top ? '; biggest: ' + top : ''));
 }
 /** The likeliest reason, from the last heartbeat (pure). */

package/dist/host/pc-installs/discover.js

@@ -1,6 +1,7 @@
 import { assertSafeMapping } from '../../core/safe-paths.js';
 import { dirExists, errMsg } from '../../core/util/index.js';
 import { pcInstallGuest } from '../../shared/paths/index.js';
+import { relocateItem } from '../../shared/unreal/index.js';
 import { pcEnv } from '../accounts/index.js';
 import { epicInstalls } from './epic.js';
 import { steamInstalls } from './steam.js';
@@ -74,8 +75,10 @@ export function discoverPcInstalls(s, o, pc = pcEnv()) {
                     readOnly: !writable,
                     label: writable ? 'this PC, writable' : 'this PC, read-only',
                 });
-                const { host: _host, ...shown } = install;
-                items.push({ ...shown, guest });
+                const { host: _host, launcherItem, ...shown } = install;
+                // The manifest names the sandbox's folder, or it is left out: no path of this PC goes to the sandbox.
+                const moved = launcherItem ? relocateItem(launcherItem.text, install.host, guest) : null;
+                items.push({ ...shown, guest, ...(moved ? { launcherItem: { name: launcherItem.name, text: moved } } : {}) });
             }
             catch (e) {
                 notes.push('pcInstalls: ' + install.name + ' is not mapped: ' + errMsg(e));

package/dist/host/pc-installs/unreal.d.ts

@@ -13,6 +13,8 @@ export interface UnrealPcFiles {
     readonly defaultRoot: string;
     /** More folders that may hold UE_x.y folders: the same places on every drive (D:\Program Files\Epic Games ...). */
     readonly otherRoots?: readonly string[];
+    /** The launcher's Data\Manifests folder (its .item files), or none. */
+    readonly manifests?: string;
     readonly list: (dir: string) => string[];
     readonly read: (file: string, max: number) => Buffer | null;
 }
@@ -33,7 +35,7 @@ export interface PcSourceBuild {
 export declare function pcSourceBuilds(files: Pick<UnrealPcFiles, 'read' | 'builds'>): PcSourceBuild[];
 /** The engine folders you registered (pcInstalls.unrealEngineFolders), mapped writable. A folder that is a source
  * build of this PC keeps the PC's build id. */
-export declare function findEngineFolders(files: Pick<UnrealPcFiles, 'read' | 'builds'>, folders: readonly (string | number)[]): PcInstall[];
+export declare function findEngineFolders(files: Pick<UnrealPcFiles, 'read' | 'builds'> & Partial<Pick<UnrealPcFiles, 'launcherInstalled' | 'manifests' | 'list'>>, folders: readonly (string | number)[]): PcInstall[];
 /** This PC's files (reg.exe through system32, bounded reads). */
 export declare function unrealPcFiles(pc: PcEnv): UnrealPcFiles;
 export declare const unrealInstalls: PcInstallSource;

package/dist/host/pc-installs/unreal.js

@@ -10,7 +10,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { readBoundedFile } from '../../shared/io/index.js';
 import { SYSTEM } from '../../shared/system.js';
-import { BUILDS_KEY, launcherInstallations, launcherInstalledFile, MAX_LAUNCHER_FILE_BYTES, parseBuildVersion, versionText, } from '../../shared/unreal/index.js';
+import { BUILDS_KEY, itemInstallLocation, ITEM_NAME, launcherInstallations, launcherInstalledFile, launcherManifestsDir, MAX_LAUNCHER_FILE_BYTES, parseBuildVersion, versionText, } from '../../shared/unreal/index.js';
 const win = path.win32;
 /** At most this many engines of this PC are mapped. */
 export const MAX_PC_ENGINES = 8;
@@ -29,6 +29,27 @@ const versionOf = (dir, files) => {
     const bytes = files.read(win.join(dir, 'Engine', 'Build', 'Build.version'), 64 * 1024);
     return bytes ? parseBuildVersion(bytes.toString('utf8')) : null;
 };
+/** At most this much of a manifest goes into session.json (an engine's is a few KB). */
+const MAX_ITEM_BYTES = 64 * 1024;
+/** The launcher's manifest of the app in `dir` (with this PC's paths), or nothing. */
+function launcherItemOf(dir, files) {
+    if (!files.manifests)
+        return {};
+    const want = win.resolve(dir).toLowerCase();
+    for (const name of files.list(files.manifests).filter((n) => ITEM_NAME.test(n))) {
+        const bytes = files.read(win.join(files.manifests, name), MAX_ITEM_BYTES);
+        const at = bytes ? itemInstallLocation(bytes.toString('utf8')) : null;
+        if (bytes && at && win.resolve(at).toLowerCase() === want)
+            return { launcherItem: { name, text: bytes.toString('utf8') } };
+    }
+    return {};
+}
+/** The launcher's ids for the app in `dir` (from LauncherInstalled.dat), or nothing. */
+function launcherIdsOf(dir, files) {
+    const want = win.resolve(dir).toLowerCase();
+    const entry = (files.launcherInstalled ? launcherInstallations(files.launcherInstalled) : []).find((i) => APP_NAME.test(i.appName) && i.ids && win.resolve(i.installLocation).toLowerCase() === want);
+    return entry?.ids ? { launcher: entry.ids } : {};
+}
 const isWanted = (wanted, v) => wanted === true || wanted.map((w) => String(w).replace(/^UE_/i, '')).includes(v.major + '.' + v.minor);
 /** The engines of this PC that `wanted` maps, each folder once, at most MAX_PC_ENGINES. */
 export function findUnrealInstalls(files, wanted) {
@@ -53,6 +74,7 @@ export function findUnrealInstalls(files, wanted) {
             host: win.normalize(dir),
             guest: '',
             ...(ids ? { launcher: ids } : {}),
+            ...launcherItemOf(dir, files),
         });
     };
     const listed = files.launcherInstalled ? launcherInstallations(files.launcherInstalled) : [];
@@ -117,6 +139,9 @@ export function findEngineFolders(files, folders) {
             guest: '',
             writable: true,
             ...(source ? { buildId: source.buildId } : {}),
+            // An engine the launcher installed keeps its ids and manifest, so the sandbox's launcher lists it too.
+            ...launcherIdsOf(dir, { launcherInstalled: files.launcherInstalled ?? null }),
+            ...(files.list ? launcherItemOf(dir, { manifests: files.manifests, list: files.list, read: files.read }) : {}),
         });
     }
     return found;
@@ -146,6 +171,7 @@ export function unrealPcFiles(pc) {
             win.join(d, 'Program Files', 'Epic Games'),
             win.join(d, 'Epic Games'),
         ]),
+        manifests: launcherManifestsDir(pc.programData),
         list: listDir,
         read: readBoundedFile,
     };

package/dist/host/tools/windows-terminal.d.ts

@@ -19,10 +19,13 @@ declare const TerminalSettingsSchema: z.ZodObject<{
 export declare function withPwshProfile(settings: z.output<typeof TerminalSettingsSchema>, visible: boolean): z.output<typeof TerminalSettingsSchema> | null;
 /** settings.json that makes new tabs read the current environment; null when it already does. Pure. */
 export declare function withReloadEnvironment(settings: z.output<typeof TerminalSettingsSchema>): z.output<typeof TerminalSettingsSchema> | null;
+/** settings.json that copies on select; null when the user already chose (true or false). Pure. */
+export declare function withCopyOnSelect(settings: z.output<typeof TerminalSettingsSchema>): z.output<typeof TerminalSettingsSchema> | null;
 /**
  * Shows the PowerShell 7 profile once pwsh is installed in this data folder (and `allowed`, i.e. toolchains.pwsh is
  * not off), hides it otherwise. settings.json is written by the sandbox too: read with a size cap, through no links,
- * shape-checked, only rewritten when the profile changes; a file that does not parse is left alone.
+ * shape-checked, only rewritten when the profile changes or a default switch is missing (reload the environment,
+ * copy on select; a value the user set stays); a file that does not parse is left alone.
  */
 export declare function syncPwshProfile(dataPath: string, allowed: boolean): void;
 export declare function ensureTerminal(dataPath: string, refresh: boolean, options?: {

package/dist/host/tools/windows-terminal.js

@@ -24,6 +24,9 @@ const SETTINGS = {
     theme: 'dark',
     firstWindowPreference: 'defaultProfile',
     confirmCloseAllTabs: false,
+    // Copied the moment the mouse is released, so an agent's redraw cannot clear the selection first.
+    copyOnSelect: true,
+    copyFormatting: 'none',
     // New tabs pick up the PATH and variables the runner writes machine-wide after the window opened.
     compatibility: { reloadEnvironmentVariables: true },
     warning: { confirmCloseAllTabs: false, largePaste: false, multiLinePaste: false },
@@ -75,10 +78,17 @@ export function withReloadEnvironment(settings) {
         return null;
     return { ...settings, compatibility: { ...compatibility, reloadEnvironmentVariables: true } };
 }
+/** settings.json that copies on select; null when the user already chose (true or false). Pure. */
+export function withCopyOnSelect(settings) {
+    if ('copyOnSelect' in settings)
+        return null;
+    return { ...settings, copyOnSelect: true };
+}
 /**
  * Shows the PowerShell 7 profile once pwsh is installed in this data folder (and `allowed`, i.e. toolchains.pwsh is
  * not off), hides it otherwise. settings.json is written by the sandbox too: read with a size cap, through no links,
- * shape-checked, only rewritten when the profile changes; a file that does not parse is left alone.
+ * shape-checked, only rewritten when the profile changes or a default switch is missing (reload the environment,
+ * copy on select; a value the user set stays); a file that does not parse is left alone.
  */
 export function syncPwshProfile(dataPath, allowed) {
     const file = path.join(terminalDir(dataPath), 'settings', 'settings.json');
@@ -100,16 +110,22 @@ export function syncPwshProfile(dataPath, allowed) {
     }
     const withProfile = withPwshProfile(parsed, visible);
     if (withProfile) {
-        writeJson(file, withReloadEnvironment(withProfile) ?? withProfile);
+        const reloaded = withReloadEnvironment(withProfile) ?? withProfile;
+        writeJson(file, withCopyOnSelect(reloaded) ?? reloaded);
         return;
     }
-    // Only the reload switch is missing: set that one value in the text, so comments and the layout stay.
-    if (withReloadEnvironment(parsed)) {
-        const edits = modify(text, ['compatibility', 'reloadEnvironmentVariables'], true, {
-            formattingOptions: { insertSpaces: true, tabSize: 4 },
-        });
-        writeFileAtomic(file, applyEdits(text, edits));
-    }
+    // Only default switches are missing: set those values in the text, so comments and the layout stay.
+    const missing = [];
+    if (withReloadEnvironment(parsed))
+        missing.push([['compatibility', 'reloadEnvironmentVariables'], true]);
+    if (withCopyOnSelect(parsed))
+        missing.push([['copyOnSelect'], true]);
+    if (missing.length === 0)
+        return;
+    let edited = text;
+    for (const [at, value] of missing)
+        edited = applyEdits(edited, modify(edited, at, value, { formattingOptions: { insertSpaces: true, tabSize: 4 } }));
+    writeFileAtomic(file, edited);
 }
 export async function ensureTerminal(dataPath, refresh, options = {}) {
     const result = await installTerminal(dataPath, refresh);

package/dist/runtime/agent.js

@@ -25502,7 +25502,7 @@ var SandboxSchema = external_exports.strictObject({
     'The last resort that keeps the sandbox up, in MB below its commit limit (RAM plus paging file): builds are slowed down long before (sandbox.pressureResponse); only if everything the agents start together would take the sandbox to the very edge of its memory, where Windows inside it would start failing, is a build refused memory instead of Windows. "auto" = the larger of 1536 MB and 3 % of the commit limit; "none" = no backstop. Yours only: a project file cannot change it.'
   ),
   pressureResponse: external_exports.boolean().describe(
-    "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. Yours only: a project file cannot change it."
+    "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. A memory gate also holds new compilers and linkers for a moment when the memory of the build programs grows faster than 4 GB in 3 seconds (3 GB with vGPU), and lets them go one at a time. Yours only: a project file cannot change it."
   ),
   vGpu: external_exports.boolean().describe(
     "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it). Browsers in the sandbox never use it (they draw in software)."
@@ -26093,6 +26093,7 @@ var GAMEDEV_APPS = [
     size: "100 MB",
     source: { github: "f3d-app/f3d", asset: "^F3D-[\\d.]+-Windows-x86_64\\.zip$" },
     exe: "f3d.exe",
+    onPath: true,
     needs: ["mesa"]
   },
   {
@@ -27192,7 +27193,7 @@ var SERVICE_SPECS = {
   },
   steam: {
     kind: "steam",
-    label: "Steam (SteamCMD)",
+    label: "Steam",
     usedBy: ["steam"],
     sources: ["file", "sandbox"],
     singleHolder: true,
@@ -27228,7 +27229,7 @@ var SERVICE_SPECS = {
   },
   cfx: {
     kind: "cfx",
-    label: "Cfx.re (FiveM / RedM server key)",
+    label: "FiveM key",
     usedBy: ["fivem"],
     sources: ["typed", "file"],
     singleHolder: false,
@@ -27257,7 +27258,7 @@ var SERVICE_SPECS = {
   },
   keystore: {
     kind: "keystore",
-    label: "Android upload keystore",
+    label: "Android keystore",
     usedBy: ["android"],
     sources: ["file"],
     singleHolder: false,
@@ -27272,7 +27273,7 @@ var SERVICE_SPECS = {
   },
   play: {
     kind: "play",
-    label: "Google Play (service account)",
+    label: "Google Play",
     usedBy: ["android"],
     sources: ["file"],
     singleHolder: false,
@@ -27283,7 +27284,7 @@ var SERVICE_SPECS = {
   },
   expo: {
     kind: "expo",
-    label: "Expo (EAS)",
+    label: "Expo",
     usedBy: ["reactNative"],
     sources: ["typed"],
     singleHolder: false,
@@ -27294,7 +27295,7 @@ var SERVICE_SPECS = {
   },
   appstore: {
     kind: "appstore",
-    label: "App Store Connect API key",
+    label: "App Store Connect",
     usedBy: ["reactNative", "flutter"],
     sources: ["file", "typed"],
     singleHolder: false,
@@ -27308,7 +27309,7 @@ var SERVICE_SPECS = {
   },
   perplexity: {
     kind: "perplexity",
-    label: "Perplexity API key",
+    label: "Perplexity API",
     usedBy: ["perplexity"],
     sources: ["pc", "file", "typed"],
     singleHolder: false,
@@ -27332,7 +27333,7 @@ var SERVICE_SPECS = {
   },
   comet: {
     kind: "comet",
-    label: "Comet (Perplexity browser)",
+    label: "Comet",
     usedBy: ["comet"],
     sources: ["sandbox"],
     singleHolder: false,
@@ -27348,7 +27349,7 @@ var SERVICE_SPECS = {
   },
   perplexityapp: {
     kind: "perplexityapp",
-    label: "Perplexity desktop app",
+    label: "Perplexity app",
     usedBy: ["perplexityapp"],
     sources: ["sandbox"],
     singleHolder: false,
@@ -27699,6 +27700,8 @@ var PressureStatusSchema = external_exports.object({
   lowered: external_exports.number().int().min(0).max(1024),
   /** Compilers waiting their turn right now (name, process id, seconds until they may go on). */
   paused: external_exports.array(external_exports.object({ name: Text(64), pid: external_exports.number().int(), seconds: external_exports.number().int().min(0).max(60) })).max(8),
+  /** Build programs the memory gate holds right now (let go one at a time). */
+  held: external_exports.number().int().min(0).max(1024).optional(),
   /** The CPU share the compilers get together (percent; 100 = no cap). */
   cpuPercent: external_exports.number().int().min(0).max(100).optional(),
   /** The PC itself asked for slowing down (its memory or CPU is low). */
@@ -27719,6 +27722,8 @@ var HeartbeatSchema = external_exports.object({
   topProcesses: external_exports.array(external_exports.object({ name: Text(64), privateMb: external_exports.number().int().min(0).max(1e7) })).max(5),
   /** The disk queue this PC last reported while asking the sandbox to slow down. */
   diskQueueReported: external_exports.number().min(0).max(1e5).optional(),
+  /** Build programs the memory gate holds right now (let go one at a time). */
+  held: external_exports.number().int().min(0).max(1024).optional(),
   /** "ending": the sandbox is shutting down in order (idle shutdown, sandbox stop, Windows shutting down). */
   phase: external_exports.enum(["ready", "working", "ending"])
 });
@@ -28074,7 +28079,7 @@ import path12 from "node:path";
 
 // src/guest/runtime/process.ts
 import fs10 from "node:fs";
-import os3 from "node:os";
+import os4 from "node:os";
 import path11 from "node:path";
 import { spawn as spawn2, spawnSync } from "node:child_process";
 
@@ -28134,10 +28139,20 @@ function scriptArgs(name, args = []) {
 }
 
 // src/shared/download/spawn.ts
+import os3 from "node:os";
 import { spawn } from "node:child_process";
+function lowerPriority(pid) {
+  if (pid === void 0) return;
+  try {
+    os3.setPriority(pid, os3.constants.priority.PRIORITY_BELOW_NORMAL);
+  } catch {
+  }
+}
 function spawnAsync(file2, args, options = {}) {
+  const { lowPriority, ...spawnOptions } = options;
   return new Promise((resolve, reject) => {
-    const child = spawn(file2, args, { stdio: "ignore", windowsHide: true, ...options });
+    const child = spawn(file2, args, { stdio: "ignore", windowsHide: true, ...spawnOptions });
+    if (lowPriority) lowerPriority(child.pid);
     child.once("error", reject);
     child.once("close", (code) => resolve(code ?? -1));
   });
@@ -28158,13 +28173,16 @@ function extractArchive(archive, destination, members2 = []) {
 }
 async function extract(archive, destination, members2) {
   fs8.mkdirSync(destination, { recursive: true });
-  let status = await spawnAsync(SYSTEM.tar(), ["-xf", archive, "-C", destination, ...members2]);
+  let status = await spawnAsync(SYSTEM.tar(), ["-xf", archive, "-C", destination, ...members2], {
+    lowPriority: true
+  });
   if (status !== 0 && /\.(zip|nupkg)$/i.test(archive)) {
     const zip = archive.endsWith(".zip") ? archive : archive + ".zip";
     if (zip !== archive) fs8.copyFileSync(archive, zip);
     status = await spawnAsync(
       SYSTEM.powershell(),
-      scriptArgs("expand-archive.ps1", ["-Archive", zip, "-Destination", destination])
+      scriptArgs("expand-archive.ps1", ["-Archive", zip, "-Destination", destination]),
+      { lowPriority: true }
     );
   }
   if (status !== 0) throw new Error("Could not extract " + archive);
@@ -28381,13 +28399,15 @@ function logLines(stream) {
   stream.on("end", () => logOutput(partial2));
 }
 async function execAsync(file2, args, options = {}) {
+  const { lowPriority, ...spawnOptions } = options;
   const code = captureOutput() ? await new Promise((resolve, reject) => {
-    const child = spawn2(file2, args, { stdio: ["inherit", "pipe", "pipe"], windowsHide: true, ...options });
+    const child = spawn2(file2, args, { stdio: ["inherit", "pipe", "pipe"], windowsHide: true, ...spawnOptions });
+    if (lowPriority) lowerPriority(child.pid);
     logLines(child.stdout);
     logLines(child.stderr);
     child.once("error", reject);
     child.once("close", (c) => resolve(c ?? -1));
-  }) : await spawnAsync(file2, args, { stdio: "inherit", ...options });
+  }) : await spawnAsync(file2, args, { stdio: "inherit", ...spawnOptions, ...lowPriority ? { lowPriority } : {} });
   if (code !== 0)
     throw new Error(path11.basename(file2) + " " + args.slice(0, 3).join(" ") + " failed with exit code " + code);
 }
@@ -28416,7 +28436,7 @@ function runScript(name, args = []) {
     throw new Error(name + " failed with exit code " + result.status + (errors ? ": " + errors.slice(0, 400) : ""));
 }
 function runScriptWithJson(name, param, data, args = []) {
-  const dir = fs10.mkdtempSync(path11.join(os3.tmpdir(), "sbx-"));
+  const dir = fs10.mkdtempSync(path11.join(os4.tmpdir(), "sbx-"));
   const file2 = path11.join(dir, "input.json");
   try {
     fs10.writeFileSync(file2, JSON.stringify(data), "utf8");
@@ -28492,9 +28512,6 @@ async function setupUv(env) {
   env.prepend.push(mkdirp(tool("uv-bin")));
 }
 
-// src/guest/runtime/pools.ts
-import os4 from "node:os";
-
 // src/shared/concurrency/limiter.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 var held = new AsyncLocalStorage2();
@@ -28554,14 +28571,13 @@ var Limiter = class {
 };
 
 // src/shared/concurrency/pools.ts
-var net = new Limiter(4, "net");
+var net = new Limiter(3, "net");
 var heavy = new Limiter(2, "heavy");
 var installer = new Limiter(1, "installer");
 
 // src/guest/runtime/pools.ts
-var BELOW_NORMAL = os4.constants.priority.PRIORITY_BELOW_NORMAL;
 function execHeavy(file2, args, options = {}) {
-  return heavy.run(() => execAsync(file2, args, options));
+  return heavy.run(() => execAsync(file2, args, { ...options, lowPriority: true }));
 }
 
 // src/guest/runtime/session.ts