windows-development-sandbox 1.27.1 → 1.28.0

package/dist/runtime/daemon.js

@@ -25521,7 +25521,7 @@ var SandboxSchema = external_exports.strictObject({
     'The last resort that keeps the sandbox up, in MB below its commit limit (RAM plus paging file): builds are slowed down long before (sandbox.pressureResponse); only if everything the agents start together would take the sandbox to the very edge of its memory, where Windows inside it would start failing, is a build refused memory instead of Windows. "auto" = the larger of 1536 MB and 3 % of the commit limit; "none" = no backstop. Yours only: a project file cannot change it.'
   ),
   pressureResponse: external_exports.boolean().describe(
-    "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. Yours only: a project file cannot change it."
+    "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. A memory gate also holds new compilers and linkers for a moment when the memory of the build programs grows faster than 4 GB in 3 seconds (3 GB with vGPU), and lets them go one at a time. Yours only: a project file cannot change it."
   ),
   vGpu: external_exports.boolean().describe(
     "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it). Browsers in the sandbox never use it (they draw in software)."
@@ -26113,6 +26113,7 @@ var GAMEDEV_APPS = [
     size: "100 MB",
     source: { github: "f3d-app/f3d", asset: "^F3D-[\\d.]+-Windows-x86_64\\.zip$" },
     exe: "f3d.exe",
+    onPath: true,
     needs: ["mesa"]
   },
   {
@@ -27413,7 +27414,7 @@ var SERVICE_SPECS = {
   },
   steam: {
     kind: "steam",
-    label: "Steam (SteamCMD)",
+    label: "Steam",
     usedBy: ["steam"],
     sources: ["file", "sandbox"],
     singleHolder: true,
@@ -27449,7 +27450,7 @@ var SERVICE_SPECS = {
   },
   cfx: {
     kind: "cfx",
-    label: "Cfx.re (FiveM / RedM server key)",
+    label: "FiveM key",
     usedBy: ["fivem"],
     sources: ["typed", "file"],
     singleHolder: false,
@@ -27478,7 +27479,7 @@ var SERVICE_SPECS = {
   },
   keystore: {
     kind: "keystore",
-    label: "Android upload keystore",
+    label: "Android keystore",
     usedBy: ["android"],
     sources: ["file"],
     singleHolder: false,
@@ -27493,7 +27494,7 @@ var SERVICE_SPECS = {
   },
   play: {
     kind: "play",
-    label: "Google Play (service account)",
+    label: "Google Play",
     usedBy: ["android"],
     sources: ["file"],
     singleHolder: false,
@@ -27504,7 +27505,7 @@ var SERVICE_SPECS = {
   },
   expo: {
     kind: "expo",
-    label: "Expo (EAS)",
+    label: "Expo",
     usedBy: ["reactNative"],
     sources: ["typed"],
     singleHolder: false,
@@ -27515,7 +27516,7 @@ var SERVICE_SPECS = {
   },
   appstore: {
     kind: "appstore",
-    label: "App Store Connect API key",
+    label: "App Store Connect",
     usedBy: ["reactNative", "flutter"],
     sources: ["file", "typed"],
     singleHolder: false,
@@ -27529,7 +27530,7 @@ var SERVICE_SPECS = {
   },
   perplexity: {
     kind: "perplexity",
-    label: "Perplexity API key",
+    label: "Perplexity API",
     usedBy: ["perplexity"],
     sources: ["pc", "file", "typed"],
     singleHolder: false,
@@ -27553,7 +27554,7 @@ var SERVICE_SPECS = {
   },
   comet: {
     kind: "comet",
-    label: "Comet (Perplexity browser)",
+    label: "Comet",
     usedBy: ["comet"],
     sources: ["sandbox"],
     singleHolder: false,
@@ -27569,7 +27570,7 @@ var SERVICE_SPECS = {
   },
   perplexityapp: {
     kind: "perplexityapp",
-    label: "Perplexity desktop app",
+    label: "Perplexity app",
     usedBy: ["perplexityapp"],
     sources: ["sandbox"],
     singleHolder: false,
@@ -27921,6 +27922,8 @@ var PressureStatusSchema = external_exports.object({
   lowered: external_exports.number().int().min(0).max(1024),
   /** Compilers waiting their turn right now (name, process id, seconds until they may go on). */
   paused: external_exports.array(external_exports.object({ name: Text(64), pid: external_exports.number().int(), seconds: external_exports.number().int().min(0).max(60) })).max(8),
+  /** Build programs the memory gate holds right now (let go one at a time). */
+  held: external_exports.number().int().min(0).max(1024).optional(),
   /** The CPU share the compilers get together (percent; 100 = no cap). */
   cpuPercent: external_exports.number().int().min(0).max(100).optional(),
   /** The PC itself asked for slowing down (its memory or CPU is low). */
@@ -27941,6 +27944,8 @@ var HeartbeatSchema = external_exports.object({
   topProcesses: external_exports.array(external_exports.object({ name: Text(64), privateMb: external_exports.number().int().min(0).max(1e7) })).max(5),
   /** The disk queue this PC last reported while asking the sandbox to slow down. */
   diskQueueReported: external_exports.number().min(0).max(1e5).optional(),
+  /** Build programs the memory gate holds right now (let go one at a time). */
+  held: external_exports.number().int().min(0).max(1024).optional(),
   /** "ending": the sandbox is shutting down in order (idle shutdown, sandbox stop, Windows shutting down). */
   phase: external_exports.enum(["ready", "working", "ending"])
 });
@@ -28531,10 +28536,20 @@ function scriptArgs(name, args = []) {
 }
 
 // src/shared/download/spawn.ts
+import os3 from "node:os";
 import { spawn } from "node:child_process";
+function lowerPriority(pid) {
+  if (pid === void 0) return;
+  try {
+    os3.setPriority(pid, os3.constants.priority.PRIORITY_BELOW_NORMAL);
+  } catch {
+  }
+}
 function spawnAsync(file3, args, options = {}) {
+  const { lowPriority, ...spawnOptions } = options;
   return new Promise((resolve2, reject) => {
-    const child = spawn(file3, args, { stdio: "ignore", windowsHide: true, ...options });
+    const child = spawn(file3, args, { stdio: "ignore", windowsHide: true, ...spawnOptions });
+    if (lowPriority) lowerPriority(child.pid);
     child.once("error", reject);
     child.once("close", (code) => resolve2(code ?? -1));
   });
@@ -28558,13 +28573,16 @@ function extractArchive(archive, destination, members2 = []) {
 }
 async function extract(archive, destination, members2) {
   fs10.mkdirSync(destination, { recursive: true });
-  let status = await spawnAsync(SYSTEM.tar(), ["-xf", archive, "-C", destination, ...members2]);
+  let status = await spawnAsync(SYSTEM.tar(), ["-xf", archive, "-C", destination, ...members2], {
+    lowPriority: true
+  });
   if (status !== 0 && /\.(zip|nupkg)$/i.test(archive)) {
     const zip = archive.endsWith(".zip") ? archive : archive + ".zip";
     if (zip !== archive) fs10.copyFileSync(archive, zip);
     status = await spawnAsync(
       SYSTEM.powershell(),
-      scriptArgs("expand-archive.ps1", ["-Archive", zip, "-Destination", destination])
+      scriptArgs("expand-archive.ps1", ["-Archive", zip, "-Destination", destination]),
+      { lowPriority: true }
     );
   }
   if (status !== 0) throw new Error("Could not extract " + archive);
@@ -29160,7 +29178,6 @@ function withRequestSecrets(req) {
 }
 
 // src/guest/runtime/pools.ts
-import os4 from "node:os";
 import { spawn as spawn3 } from "node:child_process";
 import path21 from "node:path";
 
@@ -29234,13 +29251,13 @@ function installerRetry(code, attempt) {
 }
 
 // src/shared/concurrency/pools.ts
-var net2 = new Limiter(4, "net");
+var net2 = new Limiter(3, "net");
 var heavy = new Limiter(2, "heavy");
 var installer = new Limiter(1, "installer");
 
 // src/guest/runtime/process.ts
 import fs16 from "node:fs";
-import os3 from "node:os";
+import os4 from "node:os";
 import path20 from "node:path";
 import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
 var outputSink = null;
@@ -29262,13 +29279,15 @@ function logLines(stream) {
   stream.on("end", () => logOutput(partial2));
 }
 async function execAsync(file3, args, options = {}) {
+  const { lowPriority, ...spawnOptions } = options;
   const code = captureOutput() ? await new Promise((resolve2, reject) => {
-    const child = spawn2(file3, args, { stdio: ["inherit", "pipe", "pipe"], windowsHide: true, ...options });
+    const child = spawn2(file3, args, { stdio: ["inherit", "pipe", "pipe"], windowsHide: true, ...spawnOptions });
+    if (lowPriority) lowerPriority(child.pid);
     logLines(child.stdout);
     logLines(child.stderr);
     child.once("error", reject);
     child.once("close", (c) => resolve2(c ?? -1));
-  }) : await spawnAsync(file3, args, { stdio: "inherit", ...options });
+  }) : await spawnAsync(file3, args, { stdio: "inherit", ...spawnOptions, ...lowPriority ? { lowPriority } : {} });
   if (code !== 0)
     throw new Error(path20.basename(file3) + " " + args.slice(0, 3).join(" ") + " failed with exit code " + code);
 }
@@ -29322,8 +29341,23 @@ function runScriptAsync(name, args = []) {
 function scriptOutput(name, args = [], options = {}) {
   return execOutput(SYSTEM.powershell(), scriptArgs(name, args), options);
 }
+function scriptOutputAsync(name, args = []) {
+  return new Promise((resolve2) => {
+    const child = spawn2(SYSTEM.powershell(), scriptArgs(name, args), {
+      stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true
+    });
+    let out = "";
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+      if (out.length < CAPTURE_BYTES) out += chunk;
+    });
+    child.once("error", () => resolve2(""));
+    child.once("close", (code) => resolve2(code === 0 ? out.trim() : ""));
+  });
+}
 function runScriptWithJson(name, param, data, args = []) {
-  const dir = fs16.mkdtempSync(path20.join(os3.tmpdir(), "sbx-"));
+  const dir = fs16.mkdtempSync(path20.join(os4.tmpdir(), "sbx-"));
   const file3 = path20.join(dir, "input.json");
   try {
     fs16.writeFileSync(file3, JSON.stringify(data), "utf8");
@@ -29333,7 +29367,7 @@ function runScriptWithJson(name, param, data, args = []) {
   }
 }
 async function runScriptWithJsonAsync(name, param, data, args = []) {
-  const dir = fs16.mkdtempSync(path20.join(os3.tmpdir(), "sbx-"));
+  const dir = fs16.mkdtempSync(path20.join(os4.tmpdir(), "sbx-"));
   const file3 = path20.join(dir, "input.json");
   try {
     fs16.writeFileSync(file3, JSON.stringify(data), "utf8");
@@ -29404,14 +29438,7 @@ function installPools() {
   downloader.limit = net2;
   limitExtraction(heavy);
 }
-var BELOW_NORMAL = os4.constants.priority.PRIORITY_BELOW_NORMAL;
-function belowNormal(pid) {
-  if (pid === void 0) return;
-  try {
-    os4.setPriority(pid, BELOW_NORMAL);
-  } catch {
-  }
-}
+var belowNormal = lowerPriority;
 async function runInstaller(file3, args, o = {}) {
   for (let attempt = 1; ; attempt++) {
     const code = await installer.run(
@@ -29437,7 +29464,7 @@ async function runInstallerChecked(file3, args, o = {}) {
     throw new Error(path21.basename(file3) + " " + args.slice(0, 3).join(" ") + " failed with exit code " + code);
 }
 function execHeavy(file3, args, options = {}) {
-  return heavy.run(() => execAsync(file3, args, options));
+  return heavy.run(() => execAsync(file3, args, { ...options, lowPriority: true }));
 }
 
 // src/guest/daemon/daemon.ts
@@ -30361,13 +30388,14 @@ function itemSizes(saved2) {
   }
   return sizes;
 }
+var ITEM_NAME = /^[A-Za-z0-9_-]{1,80}\.item$/;
 function isItemUnder(text2, root) {
   const at = itemInstallLocation(text2);
   return at !== null && isWithin2(root, at) && win2.resolve(at) !== win2.resolve(root);
 }
 function itemFiles(dir) {
   try {
-    return fs22.readdirSync(dir).filter((f) => /^[A-Za-z0-9_-]{1,80}\.item$/.test(f));
+    return fs22.readdirSync(dir).filter((f) => ITEM_NAME.test(f));
   } catch {
     return [];
   }
@@ -31525,7 +31553,10 @@ import path42 from "node:path";
 // src/guest/toolchains/signature.ts
 var SignatureSchema = external_exports.object({ subject: external_exports.string().max(4096), issuer: external_exports.string().max(4096) });
 function signatureOf(file3) {
-  const text2 = scriptOutput("get-signature.ps1", ["-Path", file3]).trim();
+  return parseSignature(scriptOutput("get-signature.ps1", ["-Path", file3]));
+}
+function parseSignature(output2) {
+  const text2 = output2.trim();
   if (!text2) return null;
   try {
     const parsed = SignatureSchema.safeParse(JSON.parse(text2));
@@ -31537,11 +31568,14 @@ function signatureOf(file3) {
 function signedBy(file3, signer) {
   return signerMatches(signatureOf(file3), signer);
 }
+async function signedByAsync(file3, signer) {
+  return signerMatches(parseSignature(await scriptOutputAsync("get-signature.ps1", ["-Path", file3])), signer);
+}
 
 // src/guest/toolchains/installers.ts
 function signatureCheck(signer, what) {
-  return (file3) => {
-    if (!signedBy(file3, signer)) throw new Error(what + " is not signed by its vendor");
+  return async (file3) => {
+    if (!await signedByAsync(file3, signer)) throw new Error(what + " is not signed by its vendor");
   };
 }
 async function signedInstaller(url2, file3, what, signer, sha256 = null) {
@@ -31550,7 +31584,7 @@ async function signedInstaller(url2, file3, what, signer, sha256 = null) {
     mkdirp(path42.dirname(file3));
     await downloader.file(url2, file3, { sha256, verify: signatureCheck(signer, path42.basename(file3)) });
   }
-  if (!signedBy(file3, signer)) {
+  if (!await signedByAsync(file3, signer)) {
     fs25.rmSync(file3, { force: true });
     throw new Error(
       path42.basename(file3) + " is not signed by its vendor; deleted it (it is downloaded again next boot)"
@@ -31658,6 +31692,18 @@ function savedEntries() {
 function restoreLauncherItems() {
   return restoreItems(SAVED_MANIFESTS, launcherManifestsDir(programData()), ENGINES_DIR, exists);
 }
+function writePcLauncherItems(items) {
+  const dir = launcherManifestsDir(programData());
+  let written = 0;
+  for (const i of items) {
+    if (i.kind !== "unreal" || !i.launcherItem || !ITEM_NAME.test(i.launcherItem.name)) continue;
+    const at = itemInstallLocation(i.launcherItem.text);
+    if (!at || path44.win32.resolve(at).toLowerCase() !== path44.win32.resolve(i.guest).toLowerCase()) continue;
+    fs26.writeFileSync(path44.join(mkdirp(dir), i.launcherItem.name), i.launcherItem.text, "utf8");
+    written++;
+  }
+  return written;
+}
 function writeLauncherEntries(entries2) {
   if (!entries2.length) return;
   const file3 = launcherInstalledFile(programData());
@@ -31741,6 +31787,7 @@ async function registerEngines(engines, selectorFrom, ctx, aliases = []) {
   ];
   if (values.length) await runScriptWithJsonAsync("set-registry-values.ps1", "PlanFile", { values });
   try {
+    writePcLauncherItems(ctx.pcInstalls.items);
     writeLauncherEntries(launcherEntries(engines, ctx));
   } catch (e) {
     warn("Unreal: the Epic Games Launcher's LauncherInstalled.dat was left as it is (" + errMsg(e) + ")");
@@ -32066,11 +32113,10 @@ async function setupBun(env) {
     tool("bun", "bin"),
     { size: "35 MB" }
   );
-  Object.assign(env.vars, {
-    BUN_INSTALL: tool("bun"),
-    BUN_INSTALL_CACHE_DIR: path48.join(localDir, "bun-cache"),
-    BUN_TMPDIR: path48.join(localDir, "bun-tmp")
-  });
+  const cache = path48.join(localDir, "bun-cache");
+  const temp = path48.join(localDir, "bun-tmp");
+  if (!dryRun) [cache, temp].forEach((dir) => mkdirp(dir));
+  Object.assign(env.vars, { BUN_INSTALL: tool("bun"), BUN_INSTALL_CACHE_DIR: cache, BUN_TMPDIR: temp });
 }
 async function setupDeno(env) {
   await setupSingleExe(
@@ -32621,7 +32667,7 @@ async function installFromKept(dest, signer, what) {
   if (!installer2) return null;
   const installed = installedCometExe();
   if (fs35.existsSync(installed)) return installed;
-  if (!signedBy(installer2, signer)) {
+  if (!await signedByAsync(installer2, signer)) {
     fs35.rmSync(path54.join(dest, ".agent-sandbox-app"), { force: true });
     fs35.rmSync(installer2, { force: true });
     throw new Error(what + "'s installer is not signed by its vendor; deleted it (it is downloaded again next boot)");
@@ -32923,7 +32969,7 @@ var MARKER = ".agent-sandbox-app";
 function prefetchedFile(entry, fileName) {
   return path58.join(tool("apps", ...entry.id.split("/")) + ".download", fileName.replace(/[\\/:*?"<>|]/g, "_"));
 }
-var PARALLEL = 3;
+var PARALLEL = 2;
 var AppInstaller = class {
   constructor(env, options, parallel = PARALLEL) {
     this.env = env;
@@ -32944,19 +32990,21 @@ var AppInstaller = class {
     const todo = entries2.filter(
       (e) => !("remote" in e.source) && !("locked" in e.source) && !("store" in e.source) && !("npm" in e.source) && e.id !== "7zip" && (this.options.refresh || !exists(path58.join(tool("apps", ...e.id.split("/")), MARKER)))
     );
-    await Promise.all(
-      todo.map(async (entry) => {
-        try {
-          const d = await resolve(entry);
-          const file3 = prefetchedFile(entry, d.fileName);
-          if (exists(file3)) return;
-          await downloader.file(d.url, file3, {
-            sha256: d.sha256 ?? null,
-            ...entry.signer ? { verify: signatureCheck(entry.signer, d.fileName) } : {}
-          });
-        } catch {
-        }
-      })
+    await asBackground(
+      () => Promise.all(
+        todo.map(async (entry) => {
+          try {
+            const d = await resolve(entry);
+            const file3 = prefetchedFile(entry, d.fileName);
+            if (exists(file3)) return;
+            await downloader.file(d.url, file3, {
+              sha256: d.sha256 ?? null,
+              ...entry.signer ? { verify: signatureCheck(entry.signer, d.fileName) } : {}
+            });
+          } catch {
+          }
+        })
+      )
     );
   }
   /** Installs the entries (7-Zip first: the NSIS apps need it to unpack), then their shortcuts. */
@@ -33013,7 +33061,7 @@ var AppInstaller = class {
       const exe = findExe(dest, entry.exe) ?? (entry.unpack === "chromium" && entry.signer ? await installFromKept(dest, entry.signer, entry.name) : null);
       if (!exe) throw new Error(entry.exe + " not found in the download");
       await afterInstall(entry, exe);
-      if (!entry.service && (entry.cli || entry.id === "sysinternals")) {
+      if (!entry.service && (entry.cli || entry.onPath || entry.id === "sysinternals")) {
         if (entry.id === "rust-analyzer") this.env.prepend.unshift(path58.dirname(exe));
         else this.env.prepend.push(path58.dirname(exe));
       }
@@ -34909,6 +34957,82 @@ import fs58 from "node:fs";
 import os10 from "node:os";
 import path83 from "node:path";
 
+// src/shared/memory/policy.ts
+var DIAL_STEPS = {
+  normal: [
+    { availablePercent: 15, commitPercent: 80 },
+    { availablePercent: 10, commitPercent: 88 },
+    { availablePercent: 6, commitPercent: 94, secondsToLimit: 20 },
+    { availablePercent: 4, commitPercent: 97, secondsToLimit: 8 }
+  ],
+  gentle: [
+    { availablePercent: 20, commitPercent: 75 },
+    { availablePercent: 15, commitPercent: 85 },
+    { availablePercent: 8, commitPercent: 92, secondsToLimit: 25 },
+    { availablePercent: 5, commitPercent: 96, secondsToLimit: 10 }
+  ]
+};
+var DIAL_EXIT_MARGIN = { availablePercent: 5, commitPercent: 4 };
+var DIAL_CALM_SAMPLES = 3;
+var DIAL_CPU_RATE = [100, 100, 60, 35, 15];
+function compilersAllowed(step, running) {
+  if (step <= 1 || running <= 1) return running;
+  if (step === 2) return Math.max(1, Math.ceil(running * 0.6));
+  if (step === 3) return Math.max(1, Math.ceil(running / 3));
+  return 1;
+}
+function buildJobs(cpus, memoryGb) {
+  return Math.max(2, Math.min(cpus, Math.floor((memoryGb - 6) / 3)));
+}
+function linkSlotsFor(memoryGb) {
+  return Math.max(2, Math.min(8, Math.floor((memoryGb - 6) / 3)));
+}
+function usableCpus(cpus, percent) {
+  if (percent === null || percent >= 100) return cpus;
+  return Math.max(2, Math.min(cpus, Math.floor(cpus * percent / 100)));
+}
+function cargoJobs(cpus, memoryGb, sessions2) {
+  const byCpu = Math.max(2, Math.min(8, Math.floor(cpus / 4)));
+  const byMemory = Math.max(1, Math.floor(memoryGb / 4));
+  const jobs = Math.min(byCpu, byMemory);
+  return Math.max(1, Math.min(jobs, Math.floor(buildJobs(cpus, memoryGb) / Math.max(1, sessions2))));
+}
+var LOCAL_TARGET_MIN_BYTES = 25 * 1024 ** 3;
+function chooseTargetDir(targetDir, freeBytes2) {
+  if (targetDir !== "auto") return { targetDir };
+  if (freeBytes2 >= LOCAL_TARGET_MIN_BYTES) return { targetDir: "local" };
+  return {
+    targetDir: "separate",
+    warning: "Rust builds write through the mapped workspace; this can overload your PC's disk (C: has less than 25 GB free for a local build folder)"
+  };
+}
+function maxCompilers(cpus, profile) {
+  return profile === "gentle" ? Math.min(4, Math.max(2, Math.floor(cpus / 4))) : null;
+}
+function cargoLinkerVar(host) {
+  return "CARGO_TARGET_" + host.toUpperCase().replace(/[^A-Z0-9]/g, "_") + "_LINKER";
+}
+var BURST_GATE = {
+  normal: { growthMb: 4096, windowMs: 3e3, releaseMs: 1500, maxHoldMs: 3e4 },
+  gentle: { growthMb: 3072, windowMs: 3e3, releaseMs: 2e3, maxHoldMs: 3e4 }
+};
+
+// src/shared/memory/unreal-build.ts
+var NAMESPACE = "https://www.unrealengine.com/BuildConfiguration";
+function ubtBuildConfiguration(jobs) {
+  const max = Math.max(1, Math.floor(jobs));
+  return [
+    '<?xml version="1.0" encoding="utf-8"?>',
+    "<!-- Written by the sandbox at boot: compiles at once from the build budget (run\\budget.json, buildJobs). -->",
+    '<Configuration xmlns="' + NAMESPACE + '">',
+    "  <BuildConfiguration>",
+    "    <MaxParallelActions>" + max + "</MaxParallelActions>",
+    "  </BuildConfiguration>",
+    "</Configuration>",
+    ""
+  ].join("\r\n");
+}
+
 // src/guest/toolchains/native/debuggers.ts
 import path79 from "node:path";
 var SDK_SETUP_URL = "https://go.microsoft.com/fwlink/?linkid=2311806";
@@ -35686,6 +35810,14 @@ async function checkVisualStudio() {
     fs58.rmSync(dir, { recursive: true, force: true });
   }
 }
+function capUnrealBuilds() {
+  const cpus = usableCpus(os10.cpus().length, session.cpuLimitPercent ?? null);
+  const jobs = buildJobs(cpus, os10.totalmem() / 1024 ** 3);
+  const appData = process.env.APPDATA ?? "C:\\Users\\WDAGUtilityAccount\\AppData\\Roaming";
+  const dir = mkdirp(path83.join(appData, "Unreal Engine", "UnrealBuildTool"));
+  fs58.writeFileSync(path83.join(dir, "BuildConfiguration.xml"), ubtBuildConfiguration(jobs), "utf8");
+  return jobs;
+}
 async function part(what, work, fallback) {
   try {
     return await work();
@@ -35704,6 +35836,8 @@ async function setupUnreal(env, config2, _ctx) {
     return;
   }
   resetUnrealStatus();
+  const jobs = await part("capping parallel compiles", async () => capUnrealBuilds(), 0);
+  if (jobs) log("Unreal: UnrealBuildTool runs at most " + jobs + " compiles at once (the build budget)");
   await part("the DirectX End-User Runtime", installDirectX, void 0);
   const launcher = await part("the Epic Games Launcher", ensureLauncher, null);
   const place = placeEngines(config2.persistEngines);
@@ -35739,7 +35873,7 @@ async function setupUnreal(env, config2, _ctx) {
     debugger: debuggers ? path83.join(debuggers, "cdb.exe") : null
   }));
   env.summary.push(
-    "unreal tools: " + (vs ? "Visual Studio " + vs.version + (check2.ok ? " (UnrealBuildTool finds it)" : " (UnrealBuildTool would NOT find it)") : "no Visual Studio") + ", DirectX End-User Runtime" + (launcher ? ", Epic Games Launcher" : "") + (debuggers ? ", cdb/windbg" : "")
+    "unreal tools: " + (vs ? "Visual Studio " + vs.version + (check2.ok ? " (UnrealBuildTool finds it)" : " (UnrealBuildTool would NOT find it)") : "no Visual Studio") + (jobs ? ", at most " + jobs + " compiles at once" : "") + ", DirectX End-User Runtime" + (launcher ? ", Epic Games Launcher" : "") + (debuggers ? ", cdb/windbg" : "")
   );
 }
 
@@ -36168,7 +36302,7 @@ async function setupVcRuntime(env, summary = true) {
       log("Downloading the Visual C++ runtime (~25 MB once) ...");
       await downloadFile(VC_REDIST, installer2);
     }
-    if (!signedBy(installer2, SIGNERS.microsoft)) {
+    if (!await signedByAsync(installer2, SIGNERS.microsoft)) {
       fs62.rmSync(installer2, { force: true });
       throw new Error("vc_redist.x64.exe is not signed by Microsoft; deleted it (it is downloaded again next boot)");
     }
@@ -37586,62 +37720,6 @@ import fs72 from "node:fs";
 import os12 from "node:os";
 import path104 from "node:path";
 
-// src/shared/memory/policy.ts
-var DIAL_STEPS = {
-  normal: [
-    { availablePercent: 15, commitPercent: 80 },
-    { availablePercent: 10, commitPercent: 88 },
-    { availablePercent: 6, commitPercent: 94, secondsToLimit: 20 },
-    { availablePercent: 4, commitPercent: 97, secondsToLimit: 8 }
-  ],
-  gentle: [
-    { availablePercent: 20, commitPercent: 75 },
-    { availablePercent: 15, commitPercent: 85 },
-    { availablePercent: 8, commitPercent: 92, secondsToLimit: 25 },
-    { availablePercent: 5, commitPercent: 96, secondsToLimit: 10 }
-  ]
-};
-var DIAL_EXIT_MARGIN = { availablePercent: 5, commitPercent: 4 };
-var DIAL_CALM_SAMPLES = 3;
-var DIAL_CPU_RATE = [100, 100, 60, 35, 15];
-function compilersAllowed(step, running) {
-  if (step <= 1 || running <= 1) return running;
-  if (step === 2) return Math.max(1, Math.ceil(running * 0.6));
-  if (step === 3) return Math.max(1, Math.ceil(running / 3));
-  return 1;
-}
-function buildJobs(cpus, memoryGb) {
-  return Math.max(2, Math.min(cpus, Math.floor((memoryGb - 6) / 3)));
-}
-function linkSlotsFor(memoryGb) {
-  return Math.max(2, Math.min(8, Math.floor((memoryGb - 6) / 3)));
-}
-function usableCpus(cpus, percent) {
-  if (percent === null || percent >= 100) return cpus;
-  return Math.max(2, Math.min(cpus, Math.floor(cpus * percent / 100)));
-}
-function cargoJobs(cpus, memoryGb, sessions2) {
-  const byCpu = Math.max(2, Math.min(8, Math.floor(cpus / 4)));
-  const byMemory = Math.max(1, Math.floor(memoryGb / 4));
-  const jobs = Math.min(byCpu, byMemory);
-  return Math.max(1, Math.min(jobs, Math.floor(buildJobs(cpus, memoryGb) / Math.max(1, sessions2))));
-}
-var LOCAL_TARGET_MIN_BYTES = 25 * 1024 ** 3;
-function chooseTargetDir(targetDir, freeBytes2) {
-  if (targetDir !== "auto") return { targetDir };
-  if (freeBytes2 >= LOCAL_TARGET_MIN_BYTES) return { targetDir: "local" };
-  return {
-    targetDir: "separate",
-    warning: "Rust builds write through the mapped workspace; this can overload your PC's disk (C: has less than 25 GB free for a local build folder)"
-  };
-}
-function maxCompilers(cpus, profile) {
-  return profile === "gentle" ? Math.min(4, Math.max(2, Math.floor(cpus / 4))) : null;
-}
-function cargoLinkerVar(host) {
-  return "CARGO_TARGET_" + host.toUpperCase().replace(/[^A-Z0-9]/g, "_") + "_LINKER";
-}
-
 // src/guest/governor/decide.ts
 var COMPILERS = /* @__PURE__ */ new Set([
   "rustc",
@@ -37741,6 +37819,7 @@ function linkerSlots(totalMb, cpus) {
 }
 var isHeavyCompiler = (name) => !isNeverTouched(name) && HEAVY.has(key(name));
 var canPause = (name) => !isNeverTouched(name) && COMPILERS.has(key(name));
+var GATE_NAMES = [...COMPILERS, "shadercompileworker"].filter((n) => !NEVER2.has(n)).sort();
 var INITIAL_STATE = {
   step: 0,
   calm: 0,
@@ -38204,7 +38283,7 @@ function plan(config2, versions, o) {
 
 // src/guest/toolchains/step-scheduler.ts
 import { AsyncLocalStorage as AsyncLocalStorage4 } from "node:async_hooks";
-var PARALLEL2 = 4;
+var PARALLEL2 = 3;
 async function runReported(sink2, name, env, work) {
   try {
     await work();
@@ -38703,6 +38782,9 @@ async function sendControl(endpoint, type) {
 // src/shared/pty/output-filter.ts
 var MAX_CLIPBOARD_STRING = 1024 * 1024;
 
+// src/shared/web/protocol.ts
+var MAX_CLIENT_MESSAGE_BYTES = 256 * 1024;
+
 // src/guest/sessions/cmdline.ts
 import path106 from "node:path";
 var quoted = (arg) => '"' + arg.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, "$1$1") + '"';
@@ -39195,6 +39277,63 @@ async function flushAccounts(final = false) {
 import os15 from "node:os";
 
 // src/guest/governor/core.ts
+function memgovArgs(profile) {
+  const g = BURST_GATE[profile];
+  return [
+    "serve",
+    "--interval",
+    "2",
+    "--gate",
+    [g.growthMb, g.windowMs, g.releaseMs, g.maxHoldMs].join(":"),
+    "--gate-names",
+    GATE_NAMES.join(",")
+  ];
+}
+var GateBase = { event: external_exports.literal("gate"), at: external_exports.number() };
+var GateName = external_exports.string().max(128);
+var GateCount = external_exports.number().int().min(0);
+var GateEventSchema = external_exports.discriminatedUnion("kind", [
+  external_exports.strictObject({
+    ...GateBase,
+    kind: external_exports.literal("ready"),
+    mode: external_exports.enum(["notify", "poll"]),
+    growthMb: GateCount,
+    windowMs: GateCount
+  }),
+  external_exports.strictObject({ ...GateBase, kind: external_exports.literal("off"), reason: external_exports.string().max(200) }),
+  external_exports.strictObject({
+    ...GateBase,
+    kind: external_exports.literal("trip"),
+    grewMb: GateCount,
+    ms: GateCount,
+    jobMb: GateCount,
+    held: external_exports.array(external_exports.strictObject({ pid: external_exports.number().int(), name: GateName })).max(64)
+  }),
+  external_exports.strictObject({ ...GateBase, kind: external_exports.literal("hold"), pid: external_exports.number().int(), name: GateName }),
+  external_exports.strictObject({
+    ...GateBase,
+    kind: external_exports.literal("release"),
+    pid: external_exports.number().int(),
+    name: GateName,
+    heldMs: GateCount,
+    forced: external_exports.boolean()
+  })
+]);
+function gateLine(e) {
+  const cut = (s) => s.slice(0, 64);
+  switch (e.kind) {
+    case "ready":
+      return "gate: on (" + e.mode + "): new compilers wait when the agents' programs grow by more than " + e.growthMb + " MB within " + e.windowMs / 1e3 + " s";
+    case "off":
+      return "gate: off (" + e.reason + "): builds are only slowed down by the dial";
+    case "trip":
+      return "gate: the agents' programs grew " + e.grewMb + " MB in " + (e.ms / 1e3).toFixed(1) + " s (now " + e.jobMb + " MB); holding " + e.held.length + ": " + e.held.slice(0, 8).map((p) => cut(p.name) + " (" + p.pid + ")").join(", ") + (e.held.length > 8 ? " \u2026" : "");
+    case "hold":
+      return "gate: " + cut(e.name) + " (" + e.pid + ") waits at start while a build burst goes through in turn";
+    case "release":
+      return "gate: " + cut(e.name) + " (" + e.pid + ") goes on after " + (e.heldMs / 1e3).toFixed(1) + " s" + (e.forced ? " (the longest it may wait)" : "");
+  }
+}
 var STEP_TEXT = [
   "builds back to normal",
   "build programs at lower priority",
@@ -39244,6 +39383,7 @@ var GovernorCore = class {
       commitPercent: d.commitPercent,
       step: d.state.step,
       hostStep: nowMs < d.state.hostUntil ? d.state.hostStep : 0,
+      held: sample.gateHeld ?? 0,
       diskQueue: null,
       top: [...sample.procs].sort((a, b) => b.mb - a.mb).slice(0, 5).map((p) => ({ name: p.name.slice(0, 64), mb: Math.round(p.mb) }))
     };
@@ -39265,6 +39405,7 @@ var GovernorCore = class {
       commitPercent: Math.max(0, Math.min(100, d.commitPercent)),
       lowered: Object.keys(d.state.lowered).length,
       paused: [...this.held].slice(0, 8).map(([pid, name]) => ({ name: name.slice(0, 64), pid, seconds: HOLD_MS / 1e3 })),
+      held: sample.gateHeld ?? 0,
       cpuPercent: d.state.cpuRate,
       pcLow: nowMs < d.state.hostUntil,
       lastAction: this.lastAction.slice(0, 300),
@@ -39277,6 +39418,10 @@ var GovernorCore = class {
       this.deps.saveStatus(status);
     }
   }
+  /** An event from the memory gate in memgov: goes to the memory log. */
+  onGate(event) {
+    this.note(gateLine(event));
+  }
   apply(action) {
     const port = this.deps.port;
     try {
@@ -39337,26 +39482,34 @@ var SampleSchema = external_exports.object({
       mb: external_exports.number(),
       prio: external_exports.enum(["idle", "below", "normal"]).catch("normal")
     })
-  ).max(1024)
+  ).max(1024),
+  gateHeld: external_exports.number().int().min(0).max(1024).optional().catch(void 0)
 });
 var MemGovProcess = class {
-  constructor(onSample) {
+  constructor(args, onSample, onGate) {
+    this.args = args;
     this.onSample = onSample;
+    this.onGate = onGate;
   }
+  args;
   onSample;
+  onGate;
   child = null;
   start() {
     try {
-      const child = spawn12(ensureCompiled("memgov"), ["serve", "--interval", "2"], {
+      const child = spawn12(ensureCompiled("memgov"), [...this.args], {
         stdio: ["pipe", "pipe", "ignore"],
         windowsHide: true
       });
       this.child = child;
       createInterface({ input: child.stdout }).on("line", (line) => {
         try {
-          this.onSample(SampleSchema.parse(JSON.parse(line)));
+          const raw = JSON.parse(line);
+          if (typeof raw === "object" && raw !== null && raw.event === "gate")
+            this.onGate(GateEventSchema.parse(raw));
+          else this.onSample(SampleSchema.parse(raw));
         } catch (e) {
-          warn("governor: bad sample: " + errMsg(e));
+          warn("governor: bad line from memgov: " + errMsg(e));
         }
       });
       child.stdin.on("error", () => void 0);
@@ -39409,12 +39562,16 @@ var Governor = class {
   describe() {
     const profile = session.loadProfile === "gentle" ? "gentle" : "normal";
     const first = DIAL_STEPS[profile][0];
-    return session.pressureResponse === false ? "off (sandbox.pressureResponse)" : profile + " profile: slows builds down from " + first.availablePercent + "% free RAM or " + first.commitPercent + "% commit, in steps";
+    return session.pressureResponse === false ? "off (sandbox.pressureResponse)" : profile + " profile: slows builds down from " + first.availablePercent + "% free RAM or " + first.commitPercent + "% commit, in steps; holds new compilers when memory grows faster than " + BURST_GATE[profile].growthMb + " MB in " + BURST_GATE[profile].windowMs / 1e3 + " s";
   }
   start() {
     if (session.pressureResponse === false) return;
     const profile = session.loadProfile === "gentle" ? "gentle" : "normal";
-    const proc = new MemGovProcess((s) => this.core?.onSample(s));
+    const proc = new MemGovProcess(
+      memgovArgs(profile),
+      (s) => this.core?.onSample(s),
+      (e) => this.core?.onGate(e)
+    );
     this.core = new GovernorCore({
       port: proc,
       profile,
@@ -39457,6 +39614,7 @@ function buildHeartbeat(snapshot2, sessionCount, uptimeSeconds, freeBytes2, tota
     hostStep: clamp(snapshot2?.hostStep ?? 0, 0, 4),
     topProcesses: (snapshot2?.top ?? []).slice(0, 5).map((p) => ({ name: p.name.slice(0, 64), privateMb: p.mb })),
     ...snapshot2?.diskQueue !== null && snapshot2?.diskQueue !== void 0 ? { diskQueueReported: snapshot2.diskQueue } : {},
+    ...snapshot2 && snapshot2.held > 0 ? { held: Math.min(1024, snapshot2.held) } : {},
     phase: ending ? "ending" : sessionCount > 0 ? "working" : "ready"
   };
 }