windows-development-sandbox 1.5.0 → 1.9.0

package/native/scripts/dismount-contained.ps1

@@ -0,0 +1,66 @@
+#Requires -Version 5.1
+# Detaches the contained-storage disk image of one data set (the image file stays, with everything in it). Run elevated
+# (one Windows permission prompt). The request is a JSON file: { set, storageRoot, image, mount, userSid }. The same
+# checks as mount-contained.ps1 apply (exact paths, no links, yours). It refuses while Windows Sandbox is running (the
+# sandbox may be using the folders in the image). Only `detach vdisk` for this one image is run; nothing is deleted.
+# -DryRun prints the diskpart lines and does nothing else; the result goes to result.json next to the request file.
+param(
+    [Parameter(Mandatory = $true)][string]$Json,
+    [string]$Sha256 = '',
+    [switch]$DryRun
+)
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'contained-common.ps1')
+
+$result = @{ ok = $false; message = ''; action = 'dismount'; created = $false; alreadyMounted = $false }
+
+function Invoke-Dismount($Req, [bool]$Dry, [string]$TempDir) {
+    Assert-NoLinksOnTheWay $Req $true
+    $root = $Req.storageRoot.TrimEnd('\')
+    Assert-OwnedByUser $Req @($root, (Join-Path $root 'images'), (Join-Path $root 'mounts'))
+    if (-not (Test-Path -LiteralPath $Req.image -PathType Leaf)) { throw "The image is missing: $($Req.image)" }
+    Assert-OwnedByUser $Req @($Req.image)
+    $image = $Req.image
+    $mount = $Req.mount.TrimEnd('\')
+    if (-not $Dry) {
+        if (Get-Process -Name 'WindowsSandbox*' -ErrorAction SilentlyContinue) {
+            throw 'A Windows Sandbox is running and may be using the image. Close it first.'
+        }
+    }
+    $state = Get-ImageState $image $Dry
+    if ((-not $Dry) -and (-not $state.Attached)) {
+        if (Test-ReparsePoint $mount) { throw "The mount folder is a mount point of something else; not touching it: $mount" }
+        $script:result.ok = $true
+        $script:result.message = 'The image is not mounted.'
+        Add-Note 'not attached: nothing to do'
+        return
+    }
+    [void](Invoke-DiskPart @("select vdisk file=""$image""", 'detach vdisk') $TempDir $Dry)
+    if (-not $Dry) {
+        $after = Get-ImageState $image $false
+        if ($after.Attached) { throw 'The image is still attached (something is using it). Close programs that use files in it and try again.' }
+        if (Test-ReparsePoint $mount) { throw "The mount folder is still a mount point: $mount" }
+    }
+    $script:result.ok = $true
+    $script:result.message = 'The image was detached.'
+}
+
+$mutex = $null
+try {
+    $request = Read-ContainedRequest -JsonPath $Json -Sha256 $Sha256 -Dry $DryRun.IsPresent
+    Assert-ContainedRequest $request
+    if (-not $DryRun) {
+        if (-not (Test-IsAdministrator)) { throw 'Detaching a disk image needs administrator rights.' }
+        $mutex = Enter-ContainedLock
+    }
+    Invoke-Dismount $request $DryRun.IsPresent (Split-Path -Parent $Json)
+} catch {
+    $result.ok = $false
+    $result.message = $_.Exception.Message
+} finally {
+    if ($mutex) { $mutex.ReleaseMutex(); $mutex.Dispose() }
+}
+Write-ContainedResult $result $Json $DryRun.IsPresent
+if ($result.ok) { exit 0 }
+if ($DryRun) { [Console]::Error.WriteLine($result.message) }
+exit 1

package/native/scripts/memory-status.ps1

@@ -0,0 +1,34 @@
+#Requires -Version 5.1
+# Prints this PC's memory as JSON: { totalMb, availableMb, commitLimitMb, commitAvailableMb }. Read-only. The fallback
+# for HostTools.exe memory-status (host/life/host-memory.ts).
+param()
+$ErrorActionPreference = 'Stop'
+
+$os = Get-CimInstance -ClassName Win32_OperatingSystem
+# The paging file setup from the registry: auto (Windows manages it), fixed (with its maximum sizes) or none.
+$pageFile = 'auto'
+$pageFileMax = 0
+try {
+    $entries = @((Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management' -ErrorAction Stop).PagingFiles | Where-Object { $_ -and $_.Trim() })
+    $pageFile = 'none'
+    foreach ($entry in $entries) {
+        $parts = $entry.Trim() -split ' '
+        $initial = 0; $max = 0
+        if ($parts.Count -ge 3) { $initial = [int64]$parts[-2]; $max = [int64]$parts[-1] }
+        if ($entry.StartsWith('?:') -or ($initial -eq 0 -and $max -eq 0)) { $pageFile = 'auto'; $pageFileMax = 0; break }
+        $pageFile = 'fixed'
+        $pageFileMax += $max
+    }
+} catch {
+    # Not readable: treated as automatic (no warning).
+}
+
+# Win32_OperatingSystem counts in KB.
+ConvertTo-Json -Compress -InputObject ([ordered]@{
+    totalMb           = [int64][math]::Floor($os.TotalVisibleMemorySize / 1024)
+    availableMb       = [int64][math]::Floor($os.FreePhysicalMemory / 1024)
+    commitLimitMb     = [int64][math]::Floor($os.TotalVirtualMemorySize / 1024)
+    commitAvailableMb = [int64][math]::Floor($os.FreeVirtualMemory / 1024)
+    pageFile          = $pageFile
+    pageFileMaxMb     = [int64]$pageFileMax
+})

package/native/scripts/mount-contained.ps1

@@ -0,0 +1,139 @@
+#Requires -Version 5.1
+# Mounts the contained-storage disk image of one data set at its mount folder (no drive letter), creating and
+# formatting the image the very first time. Run elevated (host/storage/contained starts it through run-elevated.ps1,
+# one Windows permission prompt). The request is a JSON file: { set, storageRoot, image, mount, userSid, maxGb, create }.
+# Safety, all checked again here: the image is <storage>\images\<set>.vhdx and the mount folder <storage>\mounts\<set>;
+# no folder on the way is a link; both are yours; the image has no parent file and is not bigger than the limit; an
+# existing image is only attached (never formatted, never deleted), and a new one is only made where no file is.
+# Every diskpart command names this one image. -DryRun checks everything and prints the diskpart lines it would run
+# (and does nothing else); the result of a real run goes to result.json next to the request file.
+param(
+    [Parameter(Mandatory = $true)][string]$Json,
+    [string]$Sha256 = '',
+    [switch]$DryRun
+)
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'contained-common.ps1')
+
+$result = @{ ok = $false; message = ''; action = 'mount'; created = $false; alreadyMounted = $false }
+
+function Invoke-Mount($Req, [bool]$Dry, [string]$TempDir) {
+    foreach ($name in @('maxGb', 'create')) {
+        if (-not ($Req.PSObject.Properties.Name -contains $name)) { throw "The request has no $name." }
+    }
+    if ($Req.maxGb -lt 8 -or $Req.maxGb -gt 4096) { throw 'The size limit must be between 8 and 4096 GB.' }
+    $create = [bool]$Req.create
+    Assert-NoLinksOnTheWay $Req $true
+    $root = $Req.storageRoot.TrimEnd('\')
+    $mountIsLink = Test-ReparsePoint $Req.mount
+    Assert-OwnedByUser $Req @($root, (Join-Path $root 'images'), (Join-Path $root 'mounts'))
+    # A mounted folder shows the image's own root, whose owner is not ours to judge; a plain folder is.
+    if (-not $mountIsLink) { Assert-OwnedByUser $Req @($Req.mount) }
+    $exists = Test-Path -LiteralPath $Req.image -PathType Leaf
+    if ($create -and $exists) { throw "An image exists already; refusing to create over it: $($Req.image)" }
+    if ((-not $create) -and (-not $exists)) { throw "The image is missing: $($Req.image)" }
+    $image = $Req.image
+    $mount = $Req.mount.TrimEnd('\')
+
+    if ($exists) {
+        Assert-OwnedByUser $Req @($image)
+        $state = Get-ImageState $image $Dry
+        if ($state.Attached) {
+            if ((Test-MountedAt $state $mount) -and $mountIsLink) {
+                $script:result.ok = $true
+                $script:result.alreadyMounted = $true
+                $script:result.message = 'The image is mounted already.'
+                Add-Note 'already mounted at the mount folder'
+                return
+            }
+            throw 'The image is attached somewhere else (Disk Management or another tool). Detach it there first.'
+        }
+        # Not attached, so its header can be read.
+        [void](Assert-PlainImage $Req $Dry)
+    }
+    if ($mountIsLink) { throw "The mount folder is a mount point already: $mount" }
+    if (@(Get-ChildItem -LiteralPath $mount -Force).Count -ne 0) { throw "The mount folder is not empty: $mount" }
+    $format = (New-Object IO.DriveInfo ([IO.Path]::GetPathRoot($mount))).DriveFormat
+    if ($format -ne 'NTFS') { throw "The mount folder must be on an NTFS drive (this one is $format): $mount" }
+
+    if ($exists) {
+        # Attach and mount the first partition of this image; nothing is created and nothing is formatted.
+        $lines = @(
+            "select vdisk file=""$image""",
+            'attach vdisk',
+            'select partition 1',
+            "assign mount=""$mount"""
+        )
+    } else {
+        if (-not $Dry) {
+            $drive = New-Object IO.DriveInfo ([IO.Path]::GetPathRoot($image))
+            if ($drive.AvailableFreeSpace -lt 1GB) { throw 'There is less than 1 GB free where the image would be made.' }
+        }
+        $megabytes = [int]$Req.maxGb * 1024
+        $lines = @(
+            "create vdisk file=""$image"" maximum=$megabytes type=expandable",
+            "select vdisk file=""$image""",
+            'attach vdisk',
+            'create partition primary',
+            'format fs=ntfs quick label=AgentData',
+            "assign mount=""$mount"""
+        )
+    }
+    try {
+        [void](Invoke-DiskPart $lines $TempDir $Dry)
+        if (-not $Dry) {
+            $after = Get-ImageState $image $false
+            if (-not $after.Attached -or -not (Test-MountedAt $after $mount)) { throw 'The image is attached but not mounted at the mount folder.' }
+            if (-not (Test-ReparsePoint $mount)) { throw 'The mount folder is not a mount point after mounting.' }
+            if (-not $exists) {
+                # The new volume's root is open to Users by default: only you and the system may use it.
+                $acl = New-Object Security.AccessControl.DirectorySecurity
+                $acl.SetAccessRuleProtection($true, $false)
+                $inherit = [Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+                foreach ($sid in @($Req.userSid, 'S-1-5-18')) {
+                    $who = New-Object Security.Principal.SecurityIdentifier($sid)
+                    $acl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($who, 'FullControl', $inherit, 'None', 'Allow')))
+                }
+                Set-Acl -LiteralPath $mount -AclObject $acl
+            }
+        }
+        $script:result.ok = $true
+        $script:result.created = (-not $exists)
+        $script:result.message = if ($exists) { 'The image was mounted.' } else { 'The image was created and mounted.' }
+    } catch {
+        $problem = $_.Exception.Message
+        if (-not $Dry) {
+            # Leave the PC as it was: detach this image (only this one); a half-made new image is renamed, never deleted.
+            $now = $null
+            try { $now = Get-ImageState $image $false } catch { $now = $null }
+            if ((Test-Path -LiteralPath $image) -and ((-not $now) -or $now.Attached)) {
+                try { [void](Invoke-DiskPart @("select vdisk file=""$image""", 'detach vdisk') $TempDir $false) } catch { $problem += ' (it could not be detached again: ' + $_.Exception.Message + ')' }
+            }
+            if ((-not $exists) -and (Test-Path -LiteralPath $image)) {
+                $kept = $image + '.failed-' + (Get-Date -Format 'yyyyMMddHHmmss')
+                try { Rename-Item -LiteralPath $image -NewName (Split-Path -Leaf $kept); $problem += " (the unfinished image was kept as $kept)" } catch { $problem += ' (the unfinished image is still at ' + $image + ')' }
+            }
+        }
+        throw $problem
+    }
+}
+
+$mutex = $null
+try {
+    $request = Read-ContainedRequest -JsonPath $Json -Sha256 $Sha256 -Dry $DryRun.IsPresent
+    Assert-ContainedRequest $request
+    if (-not $DryRun) {
+        if (-not (Test-IsAdministrator)) { throw 'Mounting a disk image needs administrator rights.' }
+        $mutex = Enter-ContainedLock
+    }
+    Invoke-Mount $request $DryRun.IsPresent (Split-Path -Parent $Json)
+} catch {
+    $result.ok = $false
+    $result.message = $_.Exception.Message
+} finally {
+    if ($mutex) { $mutex.ReleaseMutex(); $mutex.Dispose() }
+}
+Write-ContainedResult $result $Json $DryRun.IsPresent
+if ($result.ok) { exit 0 }
+if ($DryRun) { [Console]::Error.WriteLine($result.message) }
+exit 1

package/native/scripts/protect-data.ps1

@@ -0,0 +1,29 @@
+#Requires -Version 5.1
+# Encrypts or decrypts data with Windows DPAPI for the current user (host/secrets/secret-store.ts runs it). Standard
+# input: base64 of the bytes; standard output: base64 of the result. Nothing goes on the command line, so nothing shows
+# in a process list, and nothing is written to disk. Only this Windows user, on this PC, can decrypt what it made.
+# Exit 0 on success; exit 1 with the reason on stderr.
+param(
+    [Parameter(Mandatory = $true)][ValidateSet('protect', 'unprotect')][string]$Mode
+)
+$ErrorActionPreference = 'Stop'
+try {
+    Add-Type -AssemblyName System.Security
+    $buffer = New-Object System.IO.MemoryStream
+    [Console]::OpenStandardInput().CopyTo($buffer)
+    $text = [System.Text.Encoding]::ASCII.GetString($buffer.ToArray()).Trim()
+    $data = [Convert]::FromBase64String($text)
+    # A fixed extra secret: another program of yours that calls DPAPI without it cannot open these.
+    $entropy = [System.Text.Encoding]::UTF8.GetBytes('agent-sandbox/secret-store/v1')
+    $scope = [System.Security.Cryptography.DataProtectionScope]::CurrentUser
+    if ($Mode -eq 'protect') {
+        $result = [System.Security.Cryptography.ProtectedData]::Protect($data, $entropy, $scope)
+    } else {
+        $result = [System.Security.Cryptography.ProtectedData]::Unprotect($data, $entropy, $scope)
+    }
+    [Console]::Out.Write([Convert]::ToBase64String($result))
+    exit 0
+} catch {
+    [Console]::Error.WriteLine($_.Exception.Message)
+    exit 1
+}

package/native/scripts/read-folder-sddl.ps1

@@ -0,0 +1,10 @@
+#Requires -Version 5.1
+# Prints the permissions of a folder (and of a second path when given) as SDDL, one line each, read only. Used by the
+# self-test to compare a folder and a child before and after a change ("D:AI" = auto-inherited).
+param(
+    [Parameter(Mandatory = $true)][string]$Path,
+    [string]$Also
+)
+$ErrorActionPreference = 'Stop'
+(Get-Acl -LiteralPath $Path).Sddl
+if ($Also) { (Get-Acl -LiteralPath $Also).Sddl }

package/native/scripts/run-elevated.ps1

@@ -1,11 +1,24 @@
 #Requires -Version 5.1
-# Runs one fixed PowerShell command in an elevated PowerShell (Windows asks for permission) and waits for it. Used by
-# `sandbox setup` to turn on the Windows Sandbox feature. Exits with the command's exit code, or 1 when declined.
-param([Parameter(Mandatory = $true)][string]$Command)
+# Runs one fixed PowerShell command, or one script of this package, in an elevated PowerShell (Windows asks for
+# permission) and waits for it. -Command is used by `sandbox setup` to turn on the Windows Sandbox feature. -Script is
+# used for contained storage: the script (a file of this package) gets -Json <request file> -Sha256 <its checksum>.
+# Exits with the exit code of what it ran, or 1 when the permission was declined.
+[CmdletBinding(DefaultParameterSetName = 'Command')]
+param(
+    [Parameter(Mandatory = $true, ParameterSetName = 'Command')][string]$Command,
+    [Parameter(Mandatory = $true, ParameterSetName = 'Script')][string]$Script,
+    [Parameter(Mandatory = $true, ParameterSetName = 'Script')][string]$Json,
+    [Parameter(Mandatory = $true, ParameterSetName = 'Script')][string]$Sha256
+)
 $ErrorActionPreference = 'Stop'
 try {
     $exe = Join-Path $PSHOME 'powershell.exe'
-    $p = Start-Process -FilePath $exe -Verb RunAs -Wait -PassThru -WindowStyle Hidden -ArgumentList '-NoProfile', '-Command', $Command
+    if ($PSCmdlet.ParameterSetName -eq 'Script') {
+        $arguments = @('-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', ('"' + $Script + '"'), '-Json', ('"' + $Json + '"'), '-Sha256', $Sha256)
+    } else {
+        $arguments = @('-NoProfile', '-Command', $Command)
+    }
+    $p = Start-Process -FilePath $exe -Verb RunAs -Wait -PassThru -WindowStyle Hidden -ArgumentList $arguments
     exit $p.ExitCode
 } catch {
     exit 1

package/native/scripts/set-folder-access.ps1

@@ -1,23 +1,62 @@
 #Requires -Version 5.1
 # Adds or removes folder access entries listed in a JSON file (host/sharing/acl.ts writes it): { "changes": [ { path,
-# sid, rights (Read | Traverse | Modify), scope (this-folder | inherit), add } ] }. Entries are applied in order.
-# A link (junction or symbolic link) is refused, so an entry can never land on another folder. Exit 0 when all are
-# applied; exit 1 with the reason on stderr otherwise.
+# sid, rights (Read | Traverse | Modify), scope (this-folder | inherit), add } or { op: "private", path } ] }. Entries
+# are applied in order. A link (junction or symbolic link) is refused, so an entry can never land on another folder.
+# Nothing is written when the permissions would not change. A this-folder entry (and "private" on an empty folder) is
+# written to that folder only, never over its children (FolderSecurity.cs); an inherit entry reaches the children.
+# Exit 0 when all are applied; exit 1 with the reason on stderr otherwise.
 param(
     [Parameter(Mandatory = $true)][string]$Json
 )
 $ErrorActionPreference = 'Stop'
 
+$loaded = $false
+function Set-OwnDacl([string]$Path, $Acl) {
+    if (-not $script:loaded) {
+        Add-Type -Path (Join-Path $PSScriptRoot '..\csharp\FolderSecurity.cs')
+        $script:loaded = $true
+    }
+    # Keep "auto-inherited" (D:AI) as Set-Acl does: without it Windows treats the inherited entries as the folder's own
+    # the next time the parent changes. SetFileSecurity keeps that flag only when the descriptor also requests it.
+    $raw = New-Object System.Security.AccessControl.RawSecurityDescriptor -ArgumentList $Acl.GetSecurityDescriptorBinaryForm(), 0
+    if (-not $Acl.AreAccessRulesProtected) {
+        $auto = [System.Security.AccessControl.ControlFlags]'DiscretionaryAclAutoInherited, DiscretionaryAclAutoInheritRequired'
+        $raw.SetFlags($raw.ControlFlags -bor $auto)
+    }
+    $bytes = New-Object byte[] $raw.BinaryLength
+    $raw.GetBinaryForm($bytes, 0)
+    [AgentSandbox.FolderSecurity]::SetDacl($Path, $bytes)
+}
+
+function Get-Folder([string]$Path) {
+    $item = Get-Item -LiteralPath $Path -Force
+    if (-not $item.PSIsContainer) { throw "Not a folder: $Path" }
+    if ($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) { throw "Refusing a link: $Path" }
+}
+
 try {
     # The entries sit in a property: piping a bare JSON array into ConvertFrom-Json gives one array object on 5.1.
     $doc = Get-Content -LiteralPath $Json -Raw -Encoding UTF8 | ConvertFrom-Json
     $entries = @($doc.changes)
     foreach ($e in $entries) {
+        Get-Folder $e.path
+        if ($e.op -eq 'private') {
+            # Only you, SYSTEM and Administrators; inheritance from the parent off; children inherit this.
+            $me = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+            $want = New-Object System.Security.AccessControl.DirectorySecurity
+            $want.SetAccessRuleProtection($true, $false)
+            foreach ($who in @($me, (New-Object System.Security.Principal.SecurityIdentifier('S-1-5-18')), (New-Object System.Security.Principal.SecurityIdentifier('S-1-5-32-544')))) {
+                $want.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule(
+                    $who, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow')))
+            }
+            $have = Get-Acl -LiteralPath $e.path
+            if ($have.GetSecurityDescriptorSddlForm('Access') -eq $want.GetSecurityDescriptorSddlForm('Access')) { continue }
+            $children = @(Get-ChildItem -LiteralPath $e.path -Force | Select-Object -First 1)
+            if ($children.Count -eq 0) { Set-OwnDacl $e.path $want } else { Set-Acl -LiteralPath $e.path -AclObject $want }
+            continue
+        }
         if ($e.rights -notin @('Read', 'Traverse', 'Modify')) { throw "Unknown rights: $($e.rights)" }
         if ($e.scope -notin @('this-folder', 'inherit')) { throw "Unknown scope: $($e.scope)" }
-        $item = Get-Item -LiteralPath $e.path -Force
-        if (-not $item.PSIsContainer) { throw "Not a folder: $($e.path)" }
-        if ($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) { throw "Refusing a link: $($e.path)" }
 
         $sid = New-Object System.Security.Principal.SecurityIdentifier($e.sid)
         $rights = [System.Security.AccessControl.FileSystemRights]$e.rights
@@ -30,12 +69,15 @@ try {
             $sid, $rights, $inherit, [System.Security.AccessControl.PropagationFlags]'None', [System.Security.AccessControl.AccessControlType]'Allow')
 
         $acl = Get-Acl -LiteralPath $e.path
+        $before = $acl.GetSecurityDescriptorSddlForm('Access')
         if ($e.add) {
             $acl.AddAccessRule($rule)
         } else {
             [void]$acl.RemoveAccessRuleSpecific($rule)
         }
-        Set-Acl -LiteralPath $e.path -AclObject $acl
+        # Nothing changed (removing an absent entry, adding a present one): do not write, a write walks the subtree.
+        if ($acl.GetSecurityDescriptorSddlForm('Access') -eq $before) { continue }
+        if ($e.scope -eq 'inherit') { Set-Acl -LiteralPath $e.path -AclObject $acl } else { Set-OwnDacl $e.path $acl }
     }
     exit 0
 } catch {

package/native/scripts/stop-events.ps1

@@ -7,28 +7,43 @@ $ErrorActionPreference = 'Stop'
 $filters = @(
     @{ LogName = 'System'; Id = 1074, 6008, 41, 42, 2004; StartTime = $Since },
     @{ LogName = 'System'; Id = 1001; ProviderName = 'Microsoft-Windows-WER-SystemErrorReporting'; StartTime = $Since },
-    @{ LogName = 'Microsoft-Windows-Hyper-V-Worker-Admin'; Id = 18590, 40001; StartTime = $Since }
+    @{ LogName = 'Microsoft-Windows-Hyper-V-Worker-Admin'; Id = 18590, 40001; StartTime = $Since },
+    # Hardware errors Windows reported (WHEA: CPU, memory, bus, disk).
+    @{ LogName = 'System'; ProviderName = 'Microsoft-Windows-WHEA-Logger'; Id = 17, 18, 19, 47; StartTime = $Since },
+    # Any error or critical event of the Hyper-V worker and compute services (the VM's memory, start and stop).
+    @{ LogName = 'Microsoft-Windows-Hyper-V-Worker-Admin'; Level = 1, 2; StartTime = $Since },
+    @{ LogName = 'Microsoft-Windows-Hyper-V-Compute-Admin'; Level = 1, 2; StartTime = $Since },
+    # A crash report of the programs that hold the VM (kept only when it names one of them).
+    @{ LogName = 'Application'; Id = 1000, 1001; StartTime = $Since; OnlyVmPrograms = $true }
 )
 $maxMessage = 390
+$maxResourceMessage = 1500
 
 # What each event says beyond its id: the program that asked for a restart (1074), else the start of the message.
 function Get-EventDetail($record) {
     if ($record.Id -eq 1074) { return [string]$record.Properties[0].Value }
-    if ($record.Id -in 18590, 40001, 1001) {
-        $message = [string]$record.Message
-        return $message.Substring(0, [math]::Min($maxMessage, $message.Length))
-    }
-    return ''
+    # The plain power events say nothing more; the resource-exhaustion event (2004) lists the biggest memory users.
+    # Kernel-Power 41 carries the stop code of a blue screen (0 when there was none: a freeze or power loss).
+    if ($record.Id -eq 41) { return 'BugcheckCode ' + [string]$record.Properties[0].Value }
+    if ($record.Id -in 42, 6008) { return '' }
+    $message = [string]$record.Message
+    $max = if ($record.Id -eq 2004) { $maxResourceMessage } else { $maxMessage }
+    return $message.Substring(0, [math]::Min($max, $message.Length))
 }
 
 $events = foreach ($filter in $filters) {
     try {
-        Get-WinEvent -FilterHashtable $filter -MaxEvents 100 | ForEach-Object {
+        $onlyVm = $filter.ContainsKey('OnlyVmPrograms')
+        $query = @{} + $filter
+        $query.Remove('OnlyVmPrograms')
+        Get-WinEvent -FilterHashtable $query -MaxEvents 100 | ForEach-Object {
+            $detail = Get-EventDetail $_
+            if ($onlyVm -and $detail -notmatch 'vmwp\.exe|vmmem|vmcompute|windowssandbox') { return }
             [pscustomobject]@{
                 at       = $_.TimeCreated.ToUniversalTime().ToString('o')
                 id       = $_.Id
                 provider = $_.ProviderName
-                process  = Get-EventDetail $_
+                process  = $detail
             }
         }
     } catch {

package/node_modules/ws/LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2011 Einar Otto Stangvik <einaros@gmail.com>
+Copyright (c) 2013 Arnout Kazemier and contributors
+Copyright (c) 2016 Luigi Pinca and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.