windows-development-sandbox 1.27.3 → 1.28.0

package/dist/runtime/main.js

@@ -25494,7 +25494,7 @@ var SandboxSchema = external_exports.strictObject({
     'The last resort that keeps the sandbox up, in MB below its commit limit (RAM plus paging file): builds are slowed down long before (sandbox.pressureResponse); only if everything the agents start together would take the sandbox to the very edge of its memory, where Windows inside it would start failing, is a build refused memory instead of Windows. "auto" = the larger of 1536 MB and 3 % of the commit limit; "none" = no backstop. Yours only: a project file cannot change it.'
   ),
   pressureResponse: external_exports.boolean().describe(
-    "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. Yours only: a project file cannot change it."
+    "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. A memory gate also holds new compilers and linkers for a moment when the memory of the build programs grows faster than 4 GB in 3 seconds (3 GB with vGPU), and lets them go one at a time. Yours only: a project file cannot change it."
   ),
   vGpu: external_exports.boolean().describe(
     "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it). Browsers in the sandbox never use it (they draw in software)."
@@ -27934,6 +27934,8 @@ var PressureStatusSchema = external_exports.object({
   lowered: external_exports.number().int().min(0).max(1024),
   /** Compilers waiting their turn right now (name, process id, seconds until they may go on). */
   paused: external_exports.array(external_exports.object({ name: Text(64), pid: external_exports.number().int(), seconds: external_exports.number().int().min(0).max(60) })).max(8),
+  /** Build programs the memory gate holds right now (let go one at a time). */
+  held: external_exports.number().int().min(0).max(1024).optional(),
   /** The CPU share the compilers get together (percent; 100 = no cap). */
   cpuPercent: external_exports.number().int().min(0).max(100).optional(),
   /** The PC itself asked for slowing down (its memory or CPU is low). */
@@ -27954,6 +27956,8 @@ var HeartbeatSchema = external_exports.object({
   topProcesses: external_exports.array(external_exports.object({ name: Text(64), privateMb: external_exports.number().int().min(0).max(1e7) })).max(5),
   /** The disk queue this PC last reported while asking the sandbox to slow down. */
   diskQueueReported: external_exports.number().min(0).max(1e5).optional(),
+  /** Build programs the memory gate holds right now (let go one at a time). */
+  held: external_exports.number().int().min(0).max(1024).optional(),
   /** "ending": the sandbox is shutting down in order (idle shutdown, sandbox stop, Windows shutting down). */
   phase: external_exports.enum(["ready", "working", "ending"])
 });
@@ -28859,7 +28863,7 @@ function writeStatus(phase, message) {
 // src/guest/boot/boot.ts
 import fs95 from "node:fs";
 import path126 from "node:path";
-import { spawn as spawn16 } from "node:child_process";
+import { spawn as spawn17 } from "node:child_process";
 
 // src/guest/boot/guide.ts
 import fs23 from "node:fs";
@@ -31396,11 +31400,10 @@ async function setupBun(env) {
     tool("bun", "bin"),
     { size: "35 MB" }
   );
-  Object.assign(env.vars, {
-    BUN_INSTALL: tool("bun"),
-    BUN_INSTALL_CACHE_DIR: path38.join(localDir, "bun-cache"),
-    BUN_TMPDIR: path38.join(localDir, "bun-tmp")
-  });
+  const cache = path38.join(localDir, "bun-cache");
+  const temp = path38.join(localDir, "bun-tmp");
+  if (!dryRun) [cache, temp].forEach((dir) => mkdirp(dir));
+  Object.assign(env.vars, { BUN_INSTALL: tool("bun"), BUN_INSTALL_CACHE_DIR: cache, BUN_TMPDIR: temp });
 }
 async function setupDeno(env) {
   await setupSingleExe(
@@ -34240,6 +34243,49 @@ import fs52 from "node:fs";
 import os9 from "node:os";
 import path73 from "node:path";
 
+// src/shared/memory/policy.ts
+function buildJobs(cpus, memoryGb) {
+  return Math.max(2, Math.min(cpus, Math.floor((memoryGb - 6) / 3)));
+}
+function usableCpus(cpus, percent) {
+  if (percent === null || percent >= 100) return cpus;
+  return Math.max(2, Math.min(cpus, Math.floor(cpus * percent / 100)));
+}
+function cargoJobs(cpus, memoryGb, sessions) {
+  const byCpu = Math.max(2, Math.min(8, Math.floor(cpus / 4)));
+  const byMemory = Math.max(1, Math.floor(memoryGb / 4));
+  const jobs = Math.min(byCpu, byMemory);
+  return Math.max(1, Math.min(jobs, Math.floor(buildJobs(cpus, memoryGb) / Math.max(1, sessions))));
+}
+var LOCAL_TARGET_MIN_BYTES = 25 * 1024 ** 3;
+function chooseTargetDir(targetDir, freeBytes2) {
+  if (targetDir !== "auto") return { targetDir };
+  if (freeBytes2 >= LOCAL_TARGET_MIN_BYTES) return { targetDir: "local" };
+  return {
+    targetDir: "separate",
+    warning: "Rust builds write through the mapped workspace; this can overload your PC's disk (C: has less than 25 GB free for a local build folder)"
+  };
+}
+function cargoLinkerVar(host) {
+  return "CARGO_TARGET_" + host.toUpperCase().replace(/[^A-Z0-9]/g, "_") + "_LINKER";
+}
+
+// src/shared/memory/unreal-build.ts
+var NAMESPACE = "https://www.unrealengine.com/BuildConfiguration";
+function ubtBuildConfiguration(jobs) {
+  const max = Math.max(1, Math.floor(jobs));
+  return [
+    '<?xml version="1.0" encoding="utf-8"?>',
+    "<!-- Written by the sandbox at boot: compiles at once from the build budget (run\\budget.json, buildJobs). -->",
+    '<Configuration xmlns="' + NAMESPACE + '">',
+    "  <BuildConfiguration>",
+    "    <MaxParallelActions>" + max + "</MaxParallelActions>",
+    "  </BuildConfiguration>",
+    "</Configuration>",
+    ""
+  ].join("\r\n");
+}
+
 // src/guest/toolchains/native/debuggers.ts
 import path69 from "node:path";
 var SDK_SETUP_URL = "https://go.microsoft.com/fwlink/?linkid=2311806";
@@ -34969,6 +35015,14 @@ async function checkVisualStudio() {
     fs52.rmSync(dir, { recursive: true, force: true });
   }
 }
+function capUnrealBuilds() {
+  const cpus = usableCpus(os9.cpus().length, session.cpuLimitPercent ?? null);
+  const jobs = buildJobs(cpus, os9.totalmem() / 1024 ** 3);
+  const appData = process.env.APPDATA ?? "C:\\Users\\WDAGUtilityAccount\\AppData\\Roaming";
+  const dir = mkdirp(path73.join(appData, "Unreal Engine", "UnrealBuildTool"));
+  fs52.writeFileSync(path73.join(dir, "BuildConfiguration.xml"), ubtBuildConfiguration(jobs), "utf8");
+  return jobs;
+}
 async function part(what, work, fallback) {
   try {
     return await work();
@@ -34987,6 +35041,8 @@ async function setupUnreal(env, config3, _ctx) {
     return;
   }
   resetUnrealStatus();
+  const jobs = await part("capping parallel compiles", async () => capUnrealBuilds(), 0);
+  if (jobs) log("Unreal: UnrealBuildTool runs at most " + jobs + " compiles at once (the build budget)");
   await part("the DirectX End-User Runtime", installDirectX, void 0);
   const launcher = await part("the Epic Games Launcher", ensureLauncher, null);
   const place = placeEngines(config3.persistEngines);
@@ -35022,7 +35078,7 @@ async function setupUnreal(env, config3, _ctx) {
     debugger: debuggers ? path73.join(debuggers, "cdb.exe") : null
   }));
   env.summary.push(
-    "unreal tools: " + (vs ? "Visual Studio " + vs.version + (check2.ok ? " (UnrealBuildTool finds it)" : " (UnrealBuildTool would NOT find it)") : "no Visual Studio") + ", DirectX End-User Runtime" + (launcher ? ", Epic Games Launcher" : "") + (debuggers ? ", cdb/windbg" : "")
+    "unreal tools: " + (vs ? "Visual Studio " + vs.version + (check2.ok ? " (UnrealBuildTool finds it)" : " (UnrealBuildTool would NOT find it)") : "no Visual Studio") + (jobs ? ", at most " + jobs + " compiles at once" : "") + ", DirectX End-User Runtime" + (launcher ? ", Epic Games Launcher" : "") + (debuggers ? ", cdb/windbg" : "")
   );
 }
 
@@ -38349,33 +38405,69 @@ import fs67 from "node:fs";
 import os11 from "node:os";
 import path94 from "node:path";
 
-// src/shared/memory/policy.ts
-function buildJobs(cpus, memoryGb) {
-  return Math.max(2, Math.min(cpus, Math.floor((memoryGb - 6) / 3)));
-}
-function cargoJobs(cpus, memoryGb, sessions) {
-  const byCpu = Math.max(2, Math.min(8, Math.floor(cpus / 4)));
-  const byMemory = Math.max(1, Math.floor(memoryGb / 4));
-  const jobs = Math.min(byCpu, byMemory);
-  return Math.max(1, Math.min(jobs, Math.floor(buildJobs(cpus, memoryGb) / Math.max(1, sessions))));
-}
-var LOCAL_TARGET_MIN_BYTES = 25 * 1024 ** 3;
-function chooseTargetDir(targetDir, freeBytes2) {
-  if (targetDir !== "auto") return { targetDir };
-  if (freeBytes2 >= LOCAL_TARGET_MIN_BYTES) return { targetDir: "local" };
-  return {
-    targetDir: "separate",
-    warning: "Rust builds write through the mapped workspace; this can overload your PC's disk (C: has less than 25 GB free for a local build folder)"
-  };
-}
-function cargoLinkerVar(host) {
-  return "CARGO_TARGET_" + host.toUpperCase().replace(/[^A-Z0-9]/g, "_") + "_LINKER";
-}
-
 // src/guest/governor/decide.ts
+var COMPILERS = /* @__PURE__ */ new Set([
+  "rustc",
+  "clippy-driver",
+  "rustdoc",
+  "cc1",
+  "cc1plus",
+  "cc1obj",
+  "collect2",
+  "gcc",
+  "g++",
+  "c++",
+  "cc",
+  "clang",
+  "clang++",
+  "clang-cl",
+  "cl",
+  "link",
+  "lld",
+  "lld-link",
+  "ld",
+  "ld.lld",
+  "as",
+  "tsc",
+  "javac"
+]);
+var NEVER2 = /* @__PURE__ */ new Set([
+  "claude",
+  "codex",
+  "gemini",
+  "opencode",
+  "aider",
+  "cursor-agent",
+  "cmd",
+  "powershell",
+  "pwsh",
+  "bash",
+  "sh",
+  "zsh",
+  "git",
+  "conhost",
+  "openconsole",
+  "windowsterminal",
+  "wt",
+  "ptyhost",
+  "memgov",
+  "sandboxtools",
+  "sbx-db",
+  "explorer",
+  "csrss",
+  "wininit",
+  "winlogon",
+  "services",
+  "svchost",
+  "lsass",
+  "system",
+  "smss",
+  "dwm"
+]);
 function linkerSlots(totalMb, cpus) {
   return Math.max(1, Math.min(4, Math.max(1, Math.floor(cpus)), Math.floor(totalMb / 6144)));
 }
+var GATE_NAMES = [...COMPILERS, "shadercompileworker"].filter((n) => !NEVER2.has(n)).sort();
 
 // src/guest/toolchains/native/rust-extras.ts
 function resolveTargetDir(rust, free = freeBytes((process.env.SystemDrive ?? "C:") + "\\"), note = warn) {
@@ -42395,8 +42487,37 @@ var OutputFilter = class {
   }
 };
 
-// src/shared/pty/console-input.ts
+// src/shared/pty/clipboard-watch.ts
 import { spawn as spawn15 } from "node:child_process";
+var MAX_PENDING = 1024;
+function watchClipboard(onChange) {
+  if (process.platform !== "win32") return { stop: () => void 0 };
+  let child = null;
+  try {
+    child = spawn15(SYSTEM.powershell(), scriptArgs("watch-clipboard.ps1", ["-ProcessId", String(process.pid)]), {
+      stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true
+    });
+  } catch {
+    return { stop: () => void 0 };
+  }
+  let pending = "";
+  child.stdout?.setEncoding("latin1");
+  child.stdout?.on("data", (text2) => {
+    const lines = (pending + text2).split("\n");
+    pending = (lines.pop() ?? "").slice(-MAX_PENDING);
+    for (const line of lines) if (line.trim() === "changed") onChange();
+  });
+  child.on("error", () => void 0);
+  return {
+    stop: () => {
+      if (child && child.exitCode === null && child.signalCode === null) child.kill();
+    }
+  };
+}
+
+// src/shared/pty/console-input.ts
+import { spawn as spawn16 } from "node:child_process";
 function enableVtInput() {
   if (process.platform !== "win32" || !process.stdin.isTTY)
     return { ready: Promise.resolve(false), stop: () => Promise.resolve() };
@@ -42404,7 +42525,7 @@ function enableVtInput() {
   let exited2 = Promise.resolve();
   const ready = new Promise((resolve2) => {
     try {
-      child = spawn15(SYSTEM.powershell(), scriptArgs("enable-vt-input.ps1", ["-ProcessId", String(process.pid)]), {
+      child = spawn16(SYSTEM.powershell(), scriptArgs("enable-vt-input.ps1", ["-ProcessId", String(process.pid)]), {
         stdio: "ignore",
         windowsHide: true
       });
@@ -42463,30 +42584,94 @@ function unfinishedSequence(data) {
   return data.length;
 }
 
-// src/shared/pty/ctrl-c.ts
+// src/shared/web/protocol.ts
+var MAX_CLIENT_MESSAGE_BYTES = 256 * 1024;
+
+// src/shared/web/ctrl-c.ts
 var CTRL_C_CONFIRM_MS = 1500;
 var CTRL_C_HINT = "Ctrl+C again to send it to the program (Esc stops an agent)";
-var OSC_TITLE = /\x1b\][02];([^\x07\x1b]{0,256})(?:\x07|\x1b\\)/g;
-var CtrlCGuard = class {
+var CTRL_C_COPY_HINT = "Copied: Ctrl+C after selecting text is not sent to the program (Esc stops an agent)";
+var CtrlCDecider = class {
+  constructor(confirm = true) {
+    this.confirm = confirm;
+  }
+  confirm;
   armedAt = Number.NEGATIVE_INFINITY;
-  lastTitle = "";
-  /** What to send for one read from the keyboard: a lone Ctrl+C only when another came just before. */
-  push(chunk, nowMs) {
-    if (chunk.length !== 1 || chunk[0] !== 3) return { send: chunk, held: false };
+  selected = false;
+  /** Text was selected in the program: Ctrl+C is "copy" from now on. */
+  selection() {
+    this.selected = true;
+    this.armedAt = Number.NEGATIVE_INFINITY;
+  }
+  /** Any other key or a click: Ctrl+C is an interrupt again. */
+  otherInput() {
+    this.selected = false;
+  }
+  /** What to do with a lone Ctrl+C pressed at `nowMs`. */
+  ctrlC(nowMs) {
+    if (this.selected) return "copy";
+    if (!this.confirm) return "send";
     if (nowMs - this.armedAt <= CTRL_C_CONFIRM_MS) {
       this.armedAt = Number.NEGATIVE_INFINITY;
-      return { send: chunk, held: false };
+      return "send";
     }
     this.armedAt = nowMs;
-    return { send: Buffer.alloc(0), held: true };
+    return "hold";
+  }
+};
+var MOUSE_REPORT = /\x1b\[<(\d{1,4});\d{1,5};\d{1,5}([Mm])|\x1b\[M([\s\S])[\s\S]{2}/g;
+function classifyInput(text2) {
+  let drag = false;
+  let click = false;
+  for (const m of text2.matchAll(MOUSE_REPORT)) {
+    const sgr = m[1] !== void 0;
+    const b = sgr ? Number(m[1]) : (m[3] ?? " ").charCodeAt(0) - 32;
+    if (b & 64) continue;
+    if (b & 32) {
+      if ((b & 3) !== 3) drag = true;
+    } else if (sgr ? m[2] === "M" : (b & 3) !== 3) click = true;
+  }
+  return { mouse: drag ? "drag" : click ? "click" : null, keys: text2.replace(MOUSE_REPORT, "").length > 0 };
+}
+function hasClipboardWrite(text2) {
+  return /\x1b\]0{0,2}52;/.test(text2) || /\u009d0{0,2}52;/.test(text2);
+}
+
+// src/shared/pty/ctrl-c.ts
+var OSC_TITLE = /\x1b\][02];([^\x07\x1b]{0,256})(?:\x07|\x1b\\)/g;
+var CtrlCGuard = class {
+  decider;
+  lastTitle = "";
+  constructor(options = {}) {
+    this.decider = new CtrlCDecider(options.confirm !== false);
+  }
+  /** What to send for one read from the keyboard: a lone Ctrl+C only when it is not held back or taken as "copy". */
+  push(chunk, nowMs) {
+    if (chunk.length === 1 && chunk[0] === 3) {
+      const action = this.decider.ctrlC(nowMs);
+      if (action === "send") return { send: chunk, held: false, copied: false };
+      return { send: Buffer.alloc(0), held: action === "hold", copied: action === "copy" };
+    }
+    const c = classifyInput(chunk.toString("latin1"));
+    if (c.keys || c.mouse === "click") this.decider.otherInput();
+    else if (c.mouse === "drag") this.decider.selection();
+    return { send: chunk, held: false, copied: false };
+  }
+  /** The clipboard changed since the last key: you just copied. */
+  clipboardChanged() {
+    this.decider.selection();
+  }
+  /** The program wrote to the clipboard: that is a selection too. */
+  watchClipboard(raw) {
+    if (hasClipboardWrite(raw)) this.decider.selection();
   }
   /** Remembers the title the program last set (from its output), to put it back after the hint. */
   watchOutput(text2) {
     for (const m of text2.matchAll(OSC_TITLE)) this.lastTitle = m[1];
   }
   /** The escape sequence that shows the hint, and the one that puts the program's title back. */
-  hintTitle() {
-    return "\x1B]0;" + CTRL_C_HINT + "\x07";
+  hintTitle(kind = "hold") {
+    return "\x1B]0;" + (kind === "copy" ? CTRL_C_COPY_HINT : CTRL_C_HINT) + "\x07";
   }
   restoreTitle() {
     return "\x1B]0;" + this.lastTitle.replace(/[\x00-\x1f\x7f]/g, "") + "\x07";
@@ -42690,6 +42875,7 @@ function runTerminalClient(socket, token, options = {}) {
       clearTimeout(joinTimer);
       clearTimeout(hintTimer);
       clearTimeout(vtTimer);
+      clipboard.stop();
       socket.destroy();
       const tracked = mouse.tracking();
       const reset = "\x1B[0m\x1B[?25h" + MOUSE_OFF + (mouse.has(2004) ? "\x1B[?2004l" : "") + "\r\n";
@@ -42707,23 +42893,22 @@ function runTerminalClient(socket, token, options = {}) {
       if (data.length && !done) socket.write(encodeFrame2(FrameType.Input, data));
     };
     const sendInput = (data) => write(keys.push(passthrough ? mouse.filter(data) : data));
-    const guard = options.confirmCtrlC ? new CtrlCGuard() : null;
+    const guard = new CtrlCGuard({ confirm: options.confirmCtrlC !== false });
     let hintTimer;
+    const clipboard = watchClipboard(() => guard.clipboardChanged());
     const onInput = (chunk) => {
       if (options.detachKey !== void 0 && chunk.includes(options.detachKey)) {
         finish({ reason: "detach" });
         return;
       }
-      if (guard) {
-        const decided = guard.push(chunk, Date.now());
-        clearTimeout(hintTimer);
-        if (decided.held) {
-          stdout.write(guard.hintTitle());
-          hintTimer = setTimeout(() => stdout.write(guard.restoreTitle()), CTRL_C_CONFIRM_MS);
-          return;
-        }
-        if (decided.send.length === 1 && decided.send[0] === 3) stdout.write(guard.restoreTitle());
+      const decided = guard.push(chunk, Date.now());
+      clearTimeout(hintTimer);
+      if (decided.held || decided.copied) {
+        stdout.write(guard.hintTitle(decided.copied ? "copy" : "hold"));
+        hintTimer = setTimeout(() => stdout.write(guard.restoreTitle()), CTRL_C_CONFIRM_MS);
+        return;
       }
+      if (decided.send.length === 1 && decided.send[0] === 3) stdout.write(guard.restoreTitle());
       clearTimeout(joinTimer);
       sendInput(joiner.push(chunk));
       if (joiner.holding()) joinTimer = setTimeout(() => sendInput(joiner.flush()), JOIN_MS);
@@ -42756,9 +42941,10 @@ function runTerminalClient(socket, token, options = {}) {
       }
       for (const frame of frames) {
         if (frame.type === FrameType.Output) {
+          guard.watchClipboard(frame.payload.toString("latin1"));
           const out = filter.push(frame.payload);
           mouse.watch(out);
-          guard?.watchOutput(out.toString("latin1"));
+          guard.watchOutput(out.toString("latin1"));
           stdout.write(out);
         } else if (frame.type === FrameType.Console) passthrough = frame.payload.toString("latin1") === "conpty.dll";
         else if (frame.type === FrameType.Restarting) {
@@ -43851,7 +44037,7 @@ var VSCODE_LANGUAGES = [
   "pwsh"
 ];
 function startDaemon(env, secrets) {
-  spawn16(process.execPath, [path126.join(path126.dirname(process.argv[1]), "daemon.js")], {
+  spawn17(process.execPath, [path126.join(path126.dirname(process.argv[1]), "daemon.js")], {
     detached: true,
     stdio: "ignore",
     windowsHide: true,

package/dist/runtime/netproxy.js

@@ -25530,7 +25530,7 @@ var SandboxSchema = external_exports.strictObject({
     'The last resort that keeps the sandbox up, in MB below its commit limit (RAM plus paging file): builds are slowed down long before (sandbox.pressureResponse); only if everything the agents start together would take the sandbox to the very edge of its memory, where Windows inside it would start failing, is a build refused memory instead of Windows. "auto" = the larger of 1536 MB and 3 % of the commit limit; "none" = no backstop. Yours only: a project file cannot change it.'
   ),
   pressureResponse: external_exports.boolean().describe(
-    "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. Yours only: a project file cannot change it."
+    "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. A memory gate also holds new compilers and linkers for a moment when the memory of the build programs grows faster than 4 GB in 3 seconds (3 GB with vGPU), and lets them go one at a time. Yours only: a project file cannot change it."
   ),
   vGpu: external_exports.boolean().describe(
     "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it). Browsers in the sandbox never use it (they draw in software)."
@@ -27728,6 +27728,8 @@ var PressureStatusSchema = external_exports.object({
   lowered: external_exports.number().int().min(0).max(1024),
   /** Compilers waiting their turn right now (name, process id, seconds until they may go on). */
   paused: external_exports.array(external_exports.object({ name: Text(64), pid: external_exports.number().int(), seconds: external_exports.number().int().min(0).max(60) })).max(8),
+  /** Build programs the memory gate holds right now (let go one at a time). */
+  held: external_exports.number().int().min(0).max(1024).optional(),
   /** The CPU share the compilers get together (percent; 100 = no cap). */
   cpuPercent: external_exports.number().int().min(0).max(100).optional(),
   /** The PC itself asked for slowing down (its memory or CPU is low). */
@@ -27748,6 +27750,8 @@ var HeartbeatSchema = external_exports.object({
   topProcesses: external_exports.array(external_exports.object({ name: Text(64), privateMb: external_exports.number().int().min(0).max(1e7) })).max(5),
   /** The disk queue this PC last reported while asking the sandbox to slow down. */
   diskQueueReported: external_exports.number().min(0).max(1e5).optional(),
+  /** Build programs the memory gate holds right now (let go one at a time). */
+  held: external_exports.number().int().min(0).max(1024).optional(),
   /** "ending": the sandbox is shutting down in order (idle shutdown, sandbox stop, Windows shutting down). */
   phase: external_exports.enum(["ready", "working", "ending"])
 });

package/dist/runtime/tool.js

@@ -25916,7 +25916,7 @@ var SandboxSchema = external_exports.strictObject({
     'The last resort that keeps the sandbox up, in MB below its commit limit (RAM plus paging file): builds are slowed down long before (sandbox.pressureResponse); only if everything the agents start together would take the sandbox to the very edge of its memory, where Windows inside it would start failing, is a build refused memory instead of Windows. "auto" = the larger of 1536 MB and 3 % of the commit limit; "none" = no backstop. Yours only: a project file cannot change it.'
   ),
   pressureResponse: external_exports.boolean().describe(
-    "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. Yours only: a project file cannot change it."
+    "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. A memory gate also holds new compilers and linkers for a moment when the memory of the build programs grows faster than 4 GB in 3 seconds (3 GB with vGPU), and lets them go one at a time. Yours only: a project file cannot change it."
   ),
   vGpu: external_exports.boolean().describe(
     "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it). Browsers in the sandbox never use it (they draw in software)."
@@ -28114,6 +28114,8 @@ var PressureStatusSchema = external_exports.object({
   lowered: external_exports.number().int().min(0).max(1024),
   /** Compilers waiting their turn right now (name, process id, seconds until they may go on). */
   paused: external_exports.array(external_exports.object({ name: Text(64), pid: external_exports.number().int(), seconds: external_exports.number().int().min(0).max(60) })).max(8),
+  /** Build programs the memory gate holds right now (let go one at a time). */
+  held: external_exports.number().int().min(0).max(1024).optional(),
   /** The CPU share the compilers get together (percent; 100 = no cap). */
   cpuPercent: external_exports.number().int().min(0).max(100).optional(),
   /** The PC itself asked for slowing down (its memory or CPU is low). */
@@ -28134,6 +28136,8 @@ var HeartbeatSchema = external_exports.object({
   topProcesses: external_exports.array(external_exports.object({ name: Text(64), privateMb: external_exports.number().int().min(0).max(1e7) })).max(5),
   /** The disk queue this PC last reported while asking the sandbox to slow down. */
   diskQueueReported: external_exports.number().min(0).max(1e5).optional(),
+  /** Build programs the memory gate holds right now (let go one at a time). */
+  held: external_exports.number().int().min(0).max(1024).optional(),
   /** "ending": the sandbox is shutting down in order (idle shutdown, sandbox stop, Windows shutting down). */
   phase: external_exports.enum(["ready", "working", "ending"])
 });