windows-development-sandbox 1.27.1 → 1.28.0

package/dist/runtime/main.js

@@ -25494,7 +25494,7 @@ var SandboxSchema = external_exports.strictObject({
     'The last resort that keeps the sandbox up, in MB below its commit limit (RAM plus paging file): builds are slowed down long before (sandbox.pressureResponse); only if everything the agents start together would take the sandbox to the very edge of its memory, where Windows inside it would start failing, is a build refused memory instead of Windows. "auto" = the larger of 1536 MB and 3 % of the commit limit; "none" = no backstop. Yours only: a project file cannot change it.'
   ),
   pressureResponse: external_exports.boolean().describe(
-    "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. Yours only: a project file cannot change it."
+    "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. A memory gate also holds new compilers and linkers for a moment when the memory of the build programs grows faster than 4 GB in 3 seconds (3 GB with vGPU), and lets them go one at a time. Yours only: a project file cannot change it."
   ),
   vGpu: external_exports.boolean().describe(
     "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it). Browsers in the sandbox never use it (they draw in software)."
@@ -26086,6 +26086,7 @@ var GAMEDEV_APPS = [
     size: "100 MB",
     source: { github: "f3d-app/f3d", asset: "^F3D-[\\d.]+-Windows-x86_64\\.zip$" },
     exe: "f3d.exe",
+    onPath: true,
     needs: ["mesa"]
   },
   {
@@ -27426,7 +27427,7 @@ var SERVICE_SPECS = {
   },
   steam: {
     kind: "steam",
-    label: "Steam (SteamCMD)",
+    label: "Steam",
     usedBy: ["steam"],
     sources: ["file", "sandbox"],
     singleHolder: true,
@@ -27462,7 +27463,7 @@ var SERVICE_SPECS = {
   },
   cfx: {
     kind: "cfx",
-    label: "Cfx.re (FiveM / RedM server key)",
+    label: "FiveM key",
     usedBy: ["fivem"],
     sources: ["typed", "file"],
     singleHolder: false,
@@ -27491,7 +27492,7 @@ var SERVICE_SPECS = {
   },
   keystore: {
     kind: "keystore",
-    label: "Android upload keystore",
+    label: "Android keystore",
     usedBy: ["android"],
     sources: ["file"],
     singleHolder: false,
@@ -27506,7 +27507,7 @@ var SERVICE_SPECS = {
   },
   play: {
     kind: "play",
-    label: "Google Play (service account)",
+    label: "Google Play",
     usedBy: ["android"],
     sources: ["file"],
     singleHolder: false,
@@ -27517,7 +27518,7 @@ var SERVICE_SPECS = {
   },
   expo: {
     kind: "expo",
-    label: "Expo (EAS)",
+    label: "Expo",
     usedBy: ["reactNative"],
     sources: ["typed"],
     singleHolder: false,
@@ -27528,7 +27529,7 @@ var SERVICE_SPECS = {
   },
   appstore: {
     kind: "appstore",
-    label: "App Store Connect API key",
+    label: "App Store Connect",
     usedBy: ["reactNative", "flutter"],
     sources: ["file", "typed"],
     singleHolder: false,
@@ -27542,7 +27543,7 @@ var SERVICE_SPECS = {
   },
   perplexity: {
     kind: "perplexity",
-    label: "Perplexity API key",
+    label: "Perplexity API",
     usedBy: ["perplexity"],
     sources: ["pc", "file", "typed"],
     singleHolder: false,
@@ -27566,7 +27567,7 @@ var SERVICE_SPECS = {
   },
   comet: {
     kind: "comet",
-    label: "Comet (Perplexity browser)",
+    label: "Comet",
     usedBy: ["comet"],
     sources: ["sandbox"],
     singleHolder: false,
@@ -27582,7 +27583,7 @@ var SERVICE_SPECS = {
   },
   perplexityapp: {
     kind: "perplexityapp",
-    label: "Perplexity desktop app",
+    label: "Perplexity app",
     usedBy: ["perplexityapp"],
     sources: ["sandbox"],
     singleHolder: false,
@@ -27933,6 +27934,8 @@ var PressureStatusSchema = external_exports.object({
   lowered: external_exports.number().int().min(0).max(1024),
   /** Compilers waiting their turn right now (name, process id, seconds until they may go on). */
   paused: external_exports.array(external_exports.object({ name: Text(64), pid: external_exports.number().int(), seconds: external_exports.number().int().min(0).max(60) })).max(8),
+  /** Build programs the memory gate holds right now (let go one at a time). */
+  held: external_exports.number().int().min(0).max(1024).optional(),
   /** The CPU share the compilers get together (percent; 100 = no cap). */
   cpuPercent: external_exports.number().int().min(0).max(100).optional(),
   /** The PC itself asked for slowing down (its memory or CPU is low). */
@@ -27953,6 +27956,8 @@ var HeartbeatSchema = external_exports.object({
   topProcesses: external_exports.array(external_exports.object({ name: Text(64), privateMb: external_exports.number().int().min(0).max(1e7) })).max(5),
   /** The disk queue this PC last reported while asking the sandbox to slow down. */
   diskQueueReported: external_exports.number().min(0).max(1e5).optional(),
+  /** Build programs the memory gate holds right now (let go one at a time). */
+  held: external_exports.number().int().min(0).max(1024).optional(),
   /** "ending": the sandbox is shutting down in order (idle shutdown, sandbox stop, Windows shutting down). */
   phase: external_exports.enum(["ready", "working", "ending"])
 });
@@ -28363,7 +28368,7 @@ var logsDir = path9.join(dataDir, "logs");
 var run = new RunDir(dataDir);
 
 // src/guest/runtime/status.ts
-import os3 from "node:os";
+import os4 from "node:os";
 
 // src/core/util/errors.ts
 function errMsg(e) {
@@ -28548,10 +28553,20 @@ function scriptArgs(name, args = []) {
 }
 
 // src/shared/download/spawn.ts
+import os3 from "node:os";
 import { spawn } from "node:child_process";
+function lowerPriority(pid) {
+  if (pid === void 0) return;
+  try {
+    os3.setPriority(pid, os3.constants.priority.PRIORITY_BELOW_NORMAL);
+  } catch {
+  }
+}
 function spawnAsync(file3, args, options = {}) {
+  const { lowPriority, ...spawnOptions } = options;
   return new Promise((resolve2, reject) => {
-    const child = spawn(file3, args, { stdio: "ignore", windowsHide: true, ...options });
+    const child = spawn(file3, args, { stdio: "ignore", windowsHide: true, ...spawnOptions });
+    if (lowPriority) lowerPriority(child.pid);
     child.once("error", reject);
     child.once("close", (code) => resolve2(code ?? -1));
   });
@@ -28575,13 +28590,16 @@ function extractArchive(archive, destination, members2 = []) {
 }
 async function extract(archive, destination, members2) {
   fs10.mkdirSync(destination, { recursive: true });
-  let status = await spawnAsync(SYSTEM.tar(), ["-xf", archive, "-C", destination, ...members2]);
+  let status = await spawnAsync(SYSTEM.tar(), ["-xf", archive, "-C", destination, ...members2], {
+    lowPriority: true
+  });
   if (status !== 0 && /\.(zip|nupkg)$/i.test(archive)) {
     const zip = archive.endsWith(".zip") ? archive : archive + ".zip";
     if (zip !== archive) fs10.copyFileSync(archive, zip);
     status = await spawnAsync(
       SYSTEM.powershell(),
-      scriptArgs("expand-archive.ps1", ["-Archive", zip, "-Destination", destination])
+      scriptArgs("expand-archive.ps1", ["-Archive", zip, "-Destination", destination]),
+      { lowPriority: true }
     );
   }
   if (status !== 0) throw new Error("Could not extract " + archive);
@@ -28825,7 +28843,7 @@ function setBackgroundWork(work) {
   }
 }
 function ownAddresses() {
-  return Object.values(os3.networkInterfaces()).flat().filter((i) => Boolean(i) && i.family === "IPv4" && !i.internal).map((i) => i.address).slice(0, 8);
+  return Object.values(os4.networkInterfaces()).flat().filter((i) => Boolean(i) && i.family === "IPv4" && !i.internal).map((i) => i.address).slice(0, 8);
 }
 function writeStatus(phase, message) {
   writeJsonAtomic(run.sandboxFile, {
@@ -28845,7 +28863,7 @@ function writeStatus(phase, message) {
 // src/guest/boot/boot.ts
 import fs95 from "node:fs";
 import path126 from "node:path";
-import { spawn as spawn16 } from "node:child_process";
+import { spawn as spawn17 } from "node:child_process";
 
 // src/guest/boot/guide.ts
 import fs23 from "node:fs";
@@ -28893,7 +28911,7 @@ import path18 from "node:path";
 
 // src/guest/runtime/process.ts
 import fs14 from "node:fs";
-import os4 from "node:os";
+import os5 from "node:os";
 import path17 from "node:path";
 import { spawn as spawn2, spawnSync } from "node:child_process";
 var outputSink = null;
@@ -28931,13 +28949,15 @@ function exec(file3, args, options = {}) {
     throw new Error(path17.basename(file3) + " " + args.slice(0, 3).join(" ") + " failed with exit code " + result.status);
 }
 async function execAsync(file3, args, options = {}) {
+  const { lowPriority, ...spawnOptions } = options;
   const code = captureOutput() ? await new Promise((resolve2, reject) => {
-    const child = spawn2(file3, args, { stdio: ["inherit", "pipe", "pipe"], windowsHide: true, ...options });
+    const child = spawn2(file3, args, { stdio: ["inherit", "pipe", "pipe"], windowsHide: true, ...spawnOptions });
+    if (lowPriority) lowerPriority(child.pid);
     logLines(child.stdout);
     logLines(child.stderr);
     child.once("error", reject);
     child.once("close", (c) => resolve2(c ?? -1));
-  }) : await spawnAsync(file3, args, { stdio: "inherit", ...options });
+  }) : await spawnAsync(file3, args, { stdio: "inherit", ...spawnOptions, ...lowPriority ? { lowPriority } : {} });
   if (code !== 0)
     throw new Error(path17.basename(file3) + " " + args.slice(0, 3).join(" ") + " failed with exit code " + code);
 }
@@ -28991,8 +29011,23 @@ function runScriptAsync(name, args = []) {
 function scriptOutput(name, args = [], options = {}) {
   return execOutput(SYSTEM.powershell(), scriptArgs(name, args), options);
 }
+function scriptOutputAsync(name, args = []) {
+  return new Promise((resolve2) => {
+    const child = spawn2(SYSTEM.powershell(), scriptArgs(name, args), {
+      stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true
+    });
+    let out = "";
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+      if (out.length < CAPTURE_BYTES) out += chunk;
+    });
+    child.once("error", () => resolve2(""));
+    child.once("close", (code) => resolve2(code === 0 ? out.trim() : ""));
+  });
+}
 function runScriptWithJson(name, param, data, args = []) {
-  const dir = fs14.mkdtempSync(path17.join(os4.tmpdir(), "sbx-"));
+  const dir = fs14.mkdtempSync(path17.join(os5.tmpdir(), "sbx-"));
   const file3 = path17.join(dir, "input.json");
   try {
     fs14.writeFileSync(file3, JSON.stringify(data), "utf8");
@@ -29002,7 +29037,7 @@ function runScriptWithJson(name, param, data, args = []) {
   }
 }
 async function runScriptWithJsonAsync(name, param, data, args = []) {
-  const dir = fs14.mkdtempSync(path17.join(os4.tmpdir(), "sbx-"));
+  const dir = fs14.mkdtempSync(path17.join(os5.tmpdir(), "sbx-"));
   const file3 = path17.join(dir, "input.json");
   try {
     fs14.writeFileSync(file3, JSON.stringify(data), "utf8");
@@ -29451,13 +29486,14 @@ function itemSizes(saved) {
   }
   return sizes;
 }
+var ITEM_NAME = /^[A-Za-z0-9_-]{1,80}\.item$/;
 function isItemUnder(text2, root) {
   const at = itemInstallLocation(text2);
   return at !== null && isWithin(root, at) && win2.resolve(at) !== win2.resolve(root);
 }
 function itemFiles(dir) {
   try {
-    return fs16.readdirSync(dir).filter((f) => /^[A-Za-z0-9_-]{1,80}\.item$/.test(f));
+    return fs16.readdirSync(dir).filter((f) => ITEM_NAME.test(f));
   } catch {
     return [];
   }
@@ -30706,7 +30742,6 @@ import fs21 from "node:fs";
 import path34 from "node:path";
 
 // src/guest/runtime/pools.ts
-import os5 from "node:os";
 import { spawn as spawn4 } from "node:child_process";
 import path31 from "node:path";
 
@@ -30780,7 +30815,7 @@ function installerRetry(code, attempt) {
 }
 
 // src/shared/concurrency/pools.ts
-var net2 = new Limiter(4, "net");
+var net2 = new Limiter(3, "net");
 var heavy = new Limiter(2, "heavy");
 var installer = new Limiter(1, "installer");
 
@@ -30789,14 +30824,7 @@ function installPools() {
   downloader.limit = net2;
   limitExtraction(heavy);
 }
-var BELOW_NORMAL = os5.constants.priority.PRIORITY_BELOW_NORMAL;
-function belowNormal(pid) {
-  if (pid === void 0) return;
-  try {
-    os5.setPriority(pid, BELOW_NORMAL);
-  } catch {
-  }
-}
+var belowNormal = lowerPriority;
 async function runInstaller(file3, args, o = {}) {
   for (let attempt = 1; ; attempt++) {
     const code = await installer.run(
@@ -30822,7 +30850,7 @@ async function runInstallerChecked(file3, args, o = {}) {
     throw new Error(path31.basename(file3) + " " + args.slice(0, 3).join(" ") + " failed with exit code " + code);
 }
 function execHeavy(file3, args, options = {}) {
-  return heavy.run(() => execAsync(file3, args, options));
+  return heavy.run(() => execAsync(file3, args, { ...options, lowPriority: true }));
 }
 
 // src/guest/toolchains/installers.ts
@@ -30832,7 +30860,10 @@ import path32 from "node:path";
 // src/guest/toolchains/signature.ts
 var SignatureSchema = external_exports.object({ subject: external_exports.string().max(4096), issuer: external_exports.string().max(4096) });
 function signatureOf(file3) {
-  const text2 = scriptOutput("get-signature.ps1", ["-Path", file3]).trim();
+  return parseSignature(scriptOutput("get-signature.ps1", ["-Path", file3]));
+}
+function parseSignature(output3) {
+  const text2 = output3.trim();
   if (!text2) return null;
   try {
     const parsed = SignatureSchema.safeParse(JSON.parse(text2));
@@ -30844,11 +30875,14 @@ function signatureOf(file3) {
 function signedBy(file3, signer) {
   return signerMatches(signatureOf(file3), signer);
 }
+async function signedByAsync(file3, signer) {
+  return signerMatches(parseSignature(await scriptOutputAsync("get-signature.ps1", ["-Path", file3])), signer);
+}
 
 // src/guest/toolchains/installers.ts
 function signatureCheck(signer, what) {
-  return (file3) => {
-    if (!signedBy(file3, signer)) throw new Error(what + " is not signed by its vendor");
+  return async (file3) => {
+    if (!await signedByAsync(file3, signer)) throw new Error(what + " is not signed by its vendor");
   };
 }
 async function signedInstaller(url2, file3, what, signer, sha256 = null) {
@@ -30857,7 +30891,7 @@ async function signedInstaller(url2, file3, what, signer, sha256 = null) {
     mkdirp(path32.dirname(file3));
     await downloader.file(url2, file3, { sha256, verify: signatureCheck(signer, path32.basename(file3)) });
   }
-  if (!signedBy(file3, signer)) {
+  if (!await signedByAsync(file3, signer)) {
     fs20.rmSync(file3, { force: true });
     throw new Error(
       path32.basename(file3) + " is not signed by its vendor; deleted it (it is downloaded again next boot)"
@@ -30965,6 +30999,18 @@ function savedEntries() {
 function restoreLauncherItems() {
   return restoreItems(SAVED_MANIFESTS, launcherManifestsDir(programData()), ENGINES_DIR, exists);
 }
+function writePcLauncherItems(items) {
+  const dir = launcherManifestsDir(programData());
+  let written = 0;
+  for (const i of items) {
+    if (i.kind !== "unreal" || !i.launcherItem || !ITEM_NAME.test(i.launcherItem.name)) continue;
+    const at = itemInstallLocation(i.launcherItem.text);
+    if (!at || path34.win32.resolve(at).toLowerCase() !== path34.win32.resolve(i.guest).toLowerCase()) continue;
+    fs21.writeFileSync(path34.join(mkdirp(dir), i.launcherItem.name), i.launcherItem.text, "utf8");
+    written++;
+  }
+  return written;
+}
 function writeLauncherEntries(entries3) {
   if (!entries3.length) return;
   const file3 = launcherInstalledFile(programData());
@@ -31029,6 +31075,7 @@ async function registerEngines(engines, selectorFrom, ctx, aliases = []) {
   ];
   if (values.length) await runScriptWithJsonAsync("set-registry-values.ps1", "PlanFile", { values });
   try {
+    writePcLauncherItems(ctx.pcInstalls.items);
     writeLauncherEntries(launcherEntries(engines, ctx));
   } catch (e) {
     warn("Unreal: the Epic Games Launcher's LauncherInstalled.dat was left as it is (" + errMsg(e) + ")");
@@ -31353,11 +31400,10 @@ async function setupBun(env) {
     tool("bun", "bin"),
     { size: "35 MB" }
   );
-  Object.assign(env.vars, {
-    BUN_INSTALL: tool("bun"),
-    BUN_INSTALL_CACHE_DIR: path38.join(localDir, "bun-cache"),
-    BUN_TMPDIR: path38.join(localDir, "bun-tmp")
-  });
+  const cache = path38.join(localDir, "bun-cache");
+  const temp = path38.join(localDir, "bun-tmp");
+  if (!dryRun) [cache, temp].forEach((dir) => mkdirp(dir));
+  Object.assign(env.vars, { BUN_INSTALL: tool("bun"), BUN_INSTALL_CACHE_DIR: cache, BUN_TMPDIR: temp });
 }
 async function setupDeno(env) {
   await setupSingleExe(
@@ -31912,7 +31958,7 @@ async function installFromKept(dest, signer, what) {
   if (!installer2) return null;
   const installed = installedCometExe();
   if (fs29.existsSync(installed)) return installed;
-  if (!signedBy(installer2, signer)) {
+  if (!await signedByAsync(installer2, signer)) {
     fs29.rmSync(path44.join(dest, ".agent-sandbox-app"), { force: true });
     fs29.rmSync(installer2, { force: true });
     throw new Error(what + "'s installer is not signed by its vendor; deleted it (it is downloaded again next boot)");
@@ -32214,7 +32260,7 @@ var MARKER = ".agent-sandbox-app";
 function prefetchedFile(entry, fileName) {
   return path48.join(tool("apps", ...entry.id.split("/")) + ".download", fileName.replace(/[\\/:*?"<>|]/g, "_"));
 }
-var PARALLEL = 3;
+var PARALLEL = 2;
 var AppInstaller = class {
   constructor(env, options, parallel = PARALLEL) {
     this.env = env;
@@ -32235,19 +32281,21 @@ var AppInstaller = class {
     const todo = entries3.filter(
       (e) => !("remote" in e.source) && !("locked" in e.source) && !("store" in e.source) && !("npm" in e.source) && e.id !== "7zip" && (this.options.refresh || !exists(path48.join(tool("apps", ...e.id.split("/")), MARKER)))
     );
-    await Promise.all(
-      todo.map(async (entry) => {
-        try {
-          const d = await resolve(entry);
-          const file3 = prefetchedFile(entry, d.fileName);
-          if (exists(file3)) return;
-          await downloader.file(d.url, file3, {
-            sha256: d.sha256 ?? null,
-            ...entry.signer ? { verify: signatureCheck(entry.signer, d.fileName) } : {}
-          });
-        } catch {
-        }
-      })
+    await asBackground(
+      () => Promise.all(
+        todo.map(async (entry) => {
+          try {
+            const d = await resolve(entry);
+            const file3 = prefetchedFile(entry, d.fileName);
+            if (exists(file3)) return;
+            await downloader.file(d.url, file3, {
+              sha256: d.sha256 ?? null,
+              ...entry.signer ? { verify: signatureCheck(entry.signer, d.fileName) } : {}
+            });
+          } catch {
+          }
+        })
+      )
     );
   }
   /** Installs the entries (7-Zip first: the NSIS apps need it to unpack), then their shortcuts. */
@@ -32304,7 +32352,7 @@ var AppInstaller = class {
       const exe = findExe(dest, entry.exe) ?? (entry.unpack === "chromium" && entry.signer ? await installFromKept(dest, entry.signer, entry.name) : null);
       if (!exe) throw new Error(entry.exe + " not found in the download");
       await afterInstall(entry, exe);
-      if (!entry.service && (entry.cli || entry.id === "sysinternals")) {
+      if (!entry.service && (entry.cli || entry.onPath || entry.id === "sysinternals")) {
         if (entry.id === "rust-analyzer") this.env.prepend.unshift(path48.dirname(exe));
         else this.env.prepend.push(path48.dirname(exe));
       }
@@ -34195,6 +34243,49 @@ import fs52 from "node:fs";
 import os9 from "node:os";
 import path73 from "node:path";
 
+// src/shared/memory/policy.ts
+function buildJobs(cpus, memoryGb) {
+  return Math.max(2, Math.min(cpus, Math.floor((memoryGb - 6) / 3)));
+}
+function usableCpus(cpus, percent) {
+  if (percent === null || percent >= 100) return cpus;
+  return Math.max(2, Math.min(cpus, Math.floor(cpus * percent / 100)));
+}
+function cargoJobs(cpus, memoryGb, sessions) {
+  const byCpu = Math.max(2, Math.min(8, Math.floor(cpus / 4)));
+  const byMemory = Math.max(1, Math.floor(memoryGb / 4));
+  const jobs = Math.min(byCpu, byMemory);
+  return Math.max(1, Math.min(jobs, Math.floor(buildJobs(cpus, memoryGb) / Math.max(1, sessions))));
+}
+var LOCAL_TARGET_MIN_BYTES = 25 * 1024 ** 3;
+function chooseTargetDir(targetDir, freeBytes2) {
+  if (targetDir !== "auto") return { targetDir };
+  if (freeBytes2 >= LOCAL_TARGET_MIN_BYTES) return { targetDir: "local" };
+  return {
+    targetDir: "separate",
+    warning: "Rust builds write through the mapped workspace; this can overload your PC's disk (C: has less than 25 GB free for a local build folder)"
+  };
+}
+function cargoLinkerVar(host) {
+  return "CARGO_TARGET_" + host.toUpperCase().replace(/[^A-Z0-9]/g, "_") + "_LINKER";
+}
+
+// src/shared/memory/unreal-build.ts
+var NAMESPACE = "https://www.unrealengine.com/BuildConfiguration";
+function ubtBuildConfiguration(jobs) {
+  const max = Math.max(1, Math.floor(jobs));
+  return [
+    '<?xml version="1.0" encoding="utf-8"?>',
+    "<!-- Written by the sandbox at boot: compiles at once from the build budget (run\\budget.json, buildJobs). -->",
+    '<Configuration xmlns="' + NAMESPACE + '">',
+    "  <BuildConfiguration>",
+    "    <MaxParallelActions>" + max + "</MaxParallelActions>",
+    "  </BuildConfiguration>",
+    "</Configuration>",
+    ""
+  ].join("\r\n");
+}
+
 // src/guest/toolchains/native/debuggers.ts
 import path69 from "node:path";
 var SDK_SETUP_URL = "https://go.microsoft.com/fwlink/?linkid=2311806";
@@ -34924,6 +35015,14 @@ async function checkVisualStudio() {
     fs52.rmSync(dir, { recursive: true, force: true });
   }
 }
+function capUnrealBuilds() {
+  const cpus = usableCpus(os9.cpus().length, session.cpuLimitPercent ?? null);
+  const jobs = buildJobs(cpus, os9.totalmem() / 1024 ** 3);
+  const appData = process.env.APPDATA ?? "C:\\Users\\WDAGUtilityAccount\\AppData\\Roaming";
+  const dir = mkdirp(path73.join(appData, "Unreal Engine", "UnrealBuildTool"));
+  fs52.writeFileSync(path73.join(dir, "BuildConfiguration.xml"), ubtBuildConfiguration(jobs), "utf8");
+  return jobs;
+}
 async function part(what, work, fallback) {
   try {
     return await work();
@@ -34942,6 +35041,8 @@ async function setupUnreal(env, config3, _ctx) {
     return;
   }
   resetUnrealStatus();
+  const jobs = await part("capping parallel compiles", async () => capUnrealBuilds(), 0);
+  if (jobs) log("Unreal: UnrealBuildTool runs at most " + jobs + " compiles at once (the build budget)");
   await part("the DirectX End-User Runtime", installDirectX, void 0);
   const launcher = await part("the Epic Games Launcher", ensureLauncher, null);
   const place = placeEngines(config3.persistEngines);
@@ -34977,7 +35078,7 @@ async function setupUnreal(env, config3, _ctx) {
     debugger: debuggers ? path73.join(debuggers, "cdb.exe") : null
   }));
   env.summary.push(
-    "unreal tools: " + (vs ? "Visual Studio " + vs.version + (check2.ok ? " (UnrealBuildTool finds it)" : " (UnrealBuildTool would NOT find it)") : "no Visual Studio") + ", DirectX End-User Runtime" + (launcher ? ", Epic Games Launcher" : "") + (debuggers ? ", cdb/windbg" : "")
+    "unreal tools: " + (vs ? "Visual Studio " + vs.version + (check2.ok ? " (UnrealBuildTool finds it)" : " (UnrealBuildTool would NOT find it)") : "no Visual Studio") + (jobs ? ", at most " + jobs + " compiles at once" : "") + ", DirectX End-User Runtime" + (launcher ? ", Epic Games Launcher" : "") + (debuggers ? ", cdb/windbg" : "")
   );
 }
 
@@ -35406,7 +35507,7 @@ async function setupVcRuntime(env, summary = true) {
       log("Downloading the Visual C++ runtime (~25 MB once) ...");
       await downloadFile(VC_REDIST, installer2);
     }
-    if (!signedBy(installer2, SIGNERS.microsoft)) {
+    if (!await signedByAsync(installer2, SIGNERS.microsoft)) {
       fs56.rmSync(installer2, { force: true });
       throw new Error("vc_redist.x64.exe is not signed by Microsoft; deleted it (it is downloaded again next boot)");
     }
@@ -38304,33 +38405,69 @@ import fs67 from "node:fs";
 import os11 from "node:os";
 import path94 from "node:path";
 
-// src/shared/memory/policy.ts
-function buildJobs(cpus, memoryGb) {
-  return Math.max(2, Math.min(cpus, Math.floor((memoryGb - 6) / 3)));
-}
-function cargoJobs(cpus, memoryGb, sessions) {
-  const byCpu = Math.max(2, Math.min(8, Math.floor(cpus / 4)));
-  const byMemory = Math.max(1, Math.floor(memoryGb / 4));
-  const jobs = Math.min(byCpu, byMemory);
-  return Math.max(1, Math.min(jobs, Math.floor(buildJobs(cpus, memoryGb) / Math.max(1, sessions))));
-}
-var LOCAL_TARGET_MIN_BYTES = 25 * 1024 ** 3;
-function chooseTargetDir(targetDir, freeBytes2) {
-  if (targetDir !== "auto") return { targetDir };
-  if (freeBytes2 >= LOCAL_TARGET_MIN_BYTES) return { targetDir: "local" };
-  return {
-    targetDir: "separate",
-    warning: "Rust builds write through the mapped workspace; this can overload your PC's disk (C: has less than 25 GB free for a local build folder)"
-  };
-}
-function cargoLinkerVar(host) {
-  return "CARGO_TARGET_" + host.toUpperCase().replace(/[^A-Z0-9]/g, "_") + "_LINKER";
-}
-
 // src/guest/governor/decide.ts
+var COMPILERS = /* @__PURE__ */ new Set([
+  "rustc",
+  "clippy-driver",
+  "rustdoc",
+  "cc1",
+  "cc1plus",
+  "cc1obj",
+  "collect2",
+  "gcc",
+  "g++",
+  "c++",
+  "cc",
+  "clang",
+  "clang++",
+  "clang-cl",
+  "cl",
+  "link",
+  "lld",
+  "lld-link",
+  "ld",
+  "ld.lld",
+  "as",
+  "tsc",
+  "javac"
+]);
+var NEVER2 = /* @__PURE__ */ new Set([
+  "claude",
+  "codex",
+  "gemini",
+  "opencode",
+  "aider",
+  "cursor-agent",
+  "cmd",
+  "powershell",
+  "pwsh",
+  "bash",
+  "sh",
+  "zsh",
+  "git",
+  "conhost",
+  "openconsole",
+  "windowsterminal",
+  "wt",
+  "ptyhost",
+  "memgov",
+  "sandboxtools",
+  "sbx-db",
+  "explorer",
+  "csrss",
+  "wininit",
+  "winlogon",
+  "services",
+  "svchost",
+  "lsass",
+  "system",
+  "smss",
+  "dwm"
+]);
 function linkerSlots(totalMb, cpus) {
   return Math.max(1, Math.min(4, Math.max(1, Math.floor(cpus)), Math.floor(totalMb / 6144)));
 }
+var GATE_NAMES = [...COMPILERS, "shadercompileworker"].filter((n) => !NEVER2.has(n)).sort();
 
 // src/guest/toolchains/native/rust-extras.ts
 function resolveTargetDir(rust, free = freeBytes((process.env.SystemDrive ?? "C:") + "\\"), note = warn) {
@@ -38645,7 +38782,7 @@ function plan(config3, versions, o) {
 
 // src/guest/toolchains/step-scheduler.ts
 import { AsyncLocalStorage as AsyncLocalStorage4 } from "node:async_hooks";
-var PARALLEL2 = 4;
+var PARALLEL2 = 3;
 async function runReported(sink2, name, env, work) {
   try {
     await work();
@@ -42350,8 +42487,37 @@ var OutputFilter = class {
   }
 };
 
-// src/shared/pty/console-input.ts
+// src/shared/pty/clipboard-watch.ts
 import { spawn as spawn15 } from "node:child_process";
+var MAX_PENDING = 1024;
+function watchClipboard(onChange) {
+  if (process.platform !== "win32") return { stop: () => void 0 };
+  let child = null;
+  try {
+    child = spawn15(SYSTEM.powershell(), scriptArgs("watch-clipboard.ps1", ["-ProcessId", String(process.pid)]), {
+      stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true
+    });
+  } catch {
+    return { stop: () => void 0 };
+  }
+  let pending = "";
+  child.stdout?.setEncoding("latin1");
+  child.stdout?.on("data", (text2) => {
+    const lines = (pending + text2).split("\n");
+    pending = (lines.pop() ?? "").slice(-MAX_PENDING);
+    for (const line of lines) if (line.trim() === "changed") onChange();
+  });
+  child.on("error", () => void 0);
+  return {
+    stop: () => {
+      if (child && child.exitCode === null && child.signalCode === null) child.kill();
+    }
+  };
+}
+
+// src/shared/pty/console-input.ts
+import { spawn as spawn16 } from "node:child_process";
 function enableVtInput() {
   if (process.platform !== "win32" || !process.stdin.isTTY)
     return { ready: Promise.resolve(false), stop: () => Promise.resolve() };
@@ -42359,7 +42525,7 @@ function enableVtInput() {
   let exited2 = Promise.resolve();
   const ready = new Promise((resolve2) => {
     try {
-      child = spawn15(SYSTEM.powershell(), scriptArgs("enable-vt-input.ps1", ["-ProcessId", String(process.pid)]), {
+      child = spawn16(SYSTEM.powershell(), scriptArgs("enable-vt-input.ps1", ["-ProcessId", String(process.pid)]), {
         stdio: "ignore",
         windowsHide: true
       });
@@ -42418,30 +42584,94 @@ function unfinishedSequence(data) {
   return data.length;
 }
 
-// src/shared/pty/ctrl-c.ts
+// src/shared/web/protocol.ts
+var MAX_CLIENT_MESSAGE_BYTES = 256 * 1024;
+
+// src/shared/web/ctrl-c.ts
 var CTRL_C_CONFIRM_MS = 1500;
 var CTRL_C_HINT = "Ctrl+C again to send it to the program (Esc stops an agent)";
-var OSC_TITLE = /\x1b\][02];([^\x07\x1b]{0,256})(?:\x07|\x1b\\)/g;
-var CtrlCGuard = class {
+var CTRL_C_COPY_HINT = "Copied: Ctrl+C after selecting text is not sent to the program (Esc stops an agent)";
+var CtrlCDecider = class {
+  constructor(confirm = true) {
+    this.confirm = confirm;
+  }
+  confirm;
   armedAt = Number.NEGATIVE_INFINITY;
-  lastTitle = "";
-  /** What to send for one read from the keyboard: a lone Ctrl+C only when another came just before. */
-  push(chunk, nowMs) {
-    if (chunk.length !== 1 || chunk[0] !== 3) return { send: chunk, held: false };
+  selected = false;
+  /** Text was selected in the program: Ctrl+C is "copy" from now on. */
+  selection() {
+    this.selected = true;
+    this.armedAt = Number.NEGATIVE_INFINITY;
+  }
+  /** Any other key or a click: Ctrl+C is an interrupt again. */
+  otherInput() {
+    this.selected = false;
+  }
+  /** What to do with a lone Ctrl+C pressed at `nowMs`. */
+  ctrlC(nowMs) {
+    if (this.selected) return "copy";
+    if (!this.confirm) return "send";
     if (nowMs - this.armedAt <= CTRL_C_CONFIRM_MS) {
       this.armedAt = Number.NEGATIVE_INFINITY;
-      return { send: chunk, held: false };
+      return "send";
     }
     this.armedAt = nowMs;
-    return { send: Buffer.alloc(0), held: true };
+    return "hold";
+  }
+};
+var MOUSE_REPORT = /\x1b\[<(\d{1,4});\d{1,5};\d{1,5}([Mm])|\x1b\[M([\s\S])[\s\S]{2}/g;
+function classifyInput(text2) {
+  let drag = false;
+  let click = false;
+  for (const m of text2.matchAll(MOUSE_REPORT)) {
+    const sgr = m[1] !== void 0;
+    const b = sgr ? Number(m[1]) : (m[3] ?? " ").charCodeAt(0) - 32;
+    if (b & 64) continue;
+    if (b & 32) {
+      if ((b & 3) !== 3) drag = true;
+    } else if (sgr ? m[2] === "M" : (b & 3) !== 3) click = true;
+  }
+  return { mouse: drag ? "drag" : click ? "click" : null, keys: text2.replace(MOUSE_REPORT, "").length > 0 };
+}
+function hasClipboardWrite(text2) {
+  return /\x1b\]0{0,2}52;/.test(text2) || /\u009d0{0,2}52;/.test(text2);
+}
+
+// src/shared/pty/ctrl-c.ts
+var OSC_TITLE = /\x1b\][02];([^\x07\x1b]{0,256})(?:\x07|\x1b\\)/g;
+var CtrlCGuard = class {
+  decider;
+  lastTitle = "";
+  constructor(options = {}) {
+    this.decider = new CtrlCDecider(options.confirm !== false);
+  }
+  /** What to send for one read from the keyboard: a lone Ctrl+C only when it is not held back or taken as "copy". */
+  push(chunk, nowMs) {
+    if (chunk.length === 1 && chunk[0] === 3) {
+      const action = this.decider.ctrlC(nowMs);
+      if (action === "send") return { send: chunk, held: false, copied: false };
+      return { send: Buffer.alloc(0), held: action === "hold", copied: action === "copy" };
+    }
+    const c = classifyInput(chunk.toString("latin1"));
+    if (c.keys || c.mouse === "click") this.decider.otherInput();
+    else if (c.mouse === "drag") this.decider.selection();
+    return { send: chunk, held: false, copied: false };
+  }
+  /** The clipboard changed since the last key: you just copied. */
+  clipboardChanged() {
+    this.decider.selection();
+  }
+  /** The program wrote to the clipboard: that is a selection too. */
+  watchClipboard(raw) {
+    if (hasClipboardWrite(raw)) this.decider.selection();
   }
   /** Remembers the title the program last set (from its output), to put it back after the hint. */
   watchOutput(text2) {
     for (const m of text2.matchAll(OSC_TITLE)) this.lastTitle = m[1];
   }
   /** The escape sequence that shows the hint, and the one that puts the program's title back. */
-  hintTitle() {
-    return "\x1B]0;" + CTRL_C_HINT + "\x07";
+  hintTitle(kind = "hold") {
+    return "\x1B]0;" + (kind === "copy" ? CTRL_C_COPY_HINT : CTRL_C_HINT) + "\x07";
   }
   restoreTitle() {
     return "\x1B]0;" + this.lastTitle.replace(/[\x00-\x1f\x7f]/g, "") + "\x07";
@@ -42645,6 +42875,7 @@ function runTerminalClient(socket, token, options = {}) {
       clearTimeout(joinTimer);
       clearTimeout(hintTimer);
       clearTimeout(vtTimer);
+      clipboard.stop();
       socket.destroy();
       const tracked = mouse.tracking();
       const reset = "\x1B[0m\x1B[?25h" + MOUSE_OFF + (mouse.has(2004) ? "\x1B[?2004l" : "") + "\r\n";
@@ -42662,23 +42893,22 @@ function runTerminalClient(socket, token, options = {}) {
       if (data.length && !done) socket.write(encodeFrame2(FrameType.Input, data));
     };
     const sendInput = (data) => write(keys.push(passthrough ? mouse.filter(data) : data));
-    const guard = options.confirmCtrlC ? new CtrlCGuard() : null;
+    const guard = new CtrlCGuard({ confirm: options.confirmCtrlC !== false });
     let hintTimer;
+    const clipboard = watchClipboard(() => guard.clipboardChanged());
     const onInput = (chunk) => {
       if (options.detachKey !== void 0 && chunk.includes(options.detachKey)) {
         finish({ reason: "detach" });
         return;
       }
-      if (guard) {
-        const decided = guard.push(chunk, Date.now());
-        clearTimeout(hintTimer);
-        if (decided.held) {
-          stdout.write(guard.hintTitle());
-          hintTimer = setTimeout(() => stdout.write(guard.restoreTitle()), CTRL_C_CONFIRM_MS);
-          return;
-        }
-        if (decided.send.length === 1 && decided.send[0] === 3) stdout.write(guard.restoreTitle());
+      const decided = guard.push(chunk, Date.now());
+      clearTimeout(hintTimer);
+      if (decided.held || decided.copied) {
+        stdout.write(guard.hintTitle(decided.copied ? "copy" : "hold"));
+        hintTimer = setTimeout(() => stdout.write(guard.restoreTitle()), CTRL_C_CONFIRM_MS);
+        return;
       }
+      if (decided.send.length === 1 && decided.send[0] === 3) stdout.write(guard.restoreTitle());
       clearTimeout(joinTimer);
       sendInput(joiner.push(chunk));
       if (joiner.holding()) joinTimer = setTimeout(() => sendInput(joiner.flush()), JOIN_MS);
@@ -42711,9 +42941,10 @@ function runTerminalClient(socket, token, options = {}) {
       }
       for (const frame of frames) {
         if (frame.type === FrameType.Output) {
+          guard.watchClipboard(frame.payload.toString("latin1"));
           const out = filter.push(frame.payload);
           mouse.watch(out);
-          guard?.watchOutput(out.toString("latin1"));
+          guard.watchOutput(out.toString("latin1"));
           stdout.write(out);
         } else if (frame.type === FrameType.Console) passthrough = frame.payload.toString("latin1") === "conpty.dll";
         else if (frame.type === FrameType.Restarting) {
@@ -43806,7 +44037,7 @@ var VSCODE_LANGUAGES = [
   "pwsh"
 ];
 function startDaemon(env, secrets) {
-  spawn16(process.execPath, [path126.join(path126.dirname(process.argv[1]), "daemon.js")], {
+  spawn17(process.execPath, [path126.join(path126.dirname(process.argv[1]), "daemon.js")], {
     detached: true,
     stdio: "ignore",
     windowsHide: true,