windows-development-sandbox 1.7.0 → 1.10.0

package/dist/runtime/netproxy.js

@@ -25408,6 +25408,9 @@ var HarnessSchema = external_exports.strictObject({
   localState: external_exports.record(external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/), SubfolderSchema).optional().describe(
     "Environment variable -> folder below the agent's own state folder (state\\<agent>) for SQLite databases. SQLite cannot run in a mapped folder, so the agent runs from a copy on the sandbox's disk (the variable points to it) that is copied from and back to that folder."
   ),
+  bootReset: external_exports.array(SubfolderSchema).max(32).optional().describe(
+    "Files and folders below the agent's own state folder (state\\<agent>) that only work on the machine that wrote them (keys sealed with Windows DPAPI, local accounts it created). Every sandbox is a new machine, so they are deleted at each boot and the agent sets them up again."
+  ),
   resumeArguments: StringsSchema.optional().describe(
     "Arguments used when the agent is restarted in place (e.g. after an account switch) so it resumes the conversation."
   ),
@@ -25485,6 +25488,9 @@ var MappingSchema = external_exports.strictObject({
   optional: external_exports.boolean().optional().describe("true = skip it quietly when the host folder does not exist.")
 });
 var SandboxSchema = external_exports.strictObject({
+  engine: external_exports.enum(["windows-sandbox", "hcs"]).describe(
+    '(alpha) What runs the sandbox. "windows-sandbox" = Windows Sandbox (the default: desktop, Windows Terminal, GPU, clipboard, audio, printers). "hcs" = a headless Hyper-V isolated Server Core container for agents (no desktop, GPU or clipboard); it needs Windows features and an image on this PC (sandbox engine check hcs lists what is missing), and starting it is not enabled yet in this alpha. sandbox engine shows what each engine can do. Yours only: a project file (.sandbox-config.json) cannot set it.'
+  ),
   memoryMb: external_exports.union([external_exports.literal("auto"), external_exports.number().int().min(2048)]).describe('Sandbox RAM in MB (>= 2048), or "auto": free RAM minus reserveHostMb, capped at maxMemoryMb.'),
   maxMemoryMb: external_exports.number().int().positive().describe('Upper limit for memoryMb "auto".'),
   maxMemoryPercent: external_exports.number().int().min(10).max(100).describe(`memoryMb "auto" never takes more than this share of this PC's total RAM (percent).`),
@@ -25494,10 +25500,22 @@ var SandboxSchema = external_exports.strictObject({
   pageFileMb: external_exports.number().int().min(0).max(262144).describe(
     `Size of the sandbox's paging file in MB, created at full size when it starts so it never grows while builds run (8 GB of its disk always stays free). Windows Sandbox starts with about 1 GB: parallel builds then fail with "The paging file is too small", and Windows grows the file under load. 0 = leave Windows' own.`
   ),
-  reserveHostMb: external_exports.number().int().nonnegative().describe('RAM always left for this PC when memoryMb is "auto".'),
-  vGpu: external_exports.boolean().describe("Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface."),
+  reserveHostMb: external_exports.number().int().nonnegative().describe(
+    'Memory always left for this PC when memoryMb is "auto": the sandbox gets at most (free RAM, and RAM plus paging file still unused) minus this.'
+  ),
+  agentMemoryHeadroomMb: external_exports.union([external_exports.literal("auto"), external_exports.literal("none"), external_exports.number().int().min(0)]).describe(
+    'Memory kept out of the agents reach inside the sandbox, in MB: everything the agents start (their builds, tests, tools) together may use at most the sandbox memory minus this; a runaway parallel build then gets out-of-memory errors in its own session instead of freezing or crashing the whole sandbox. "auto" = the larger of 2048 MB and 10 % of the sandbox memory; "none" = no limit. Yours only: a project file cannot change it.'
+  ),
+  pressureResponse: external_exports.boolean().describe(
+    "When the sandbox (or this PC) runs low on memory, slow the heaviest build programs down (lower priority) and, if that is not enough, pause the biggest compiler for a few seconds at a time, so heavy parallel builds slow down instead of closing the sandbox. Never touches the agents themselves. Yours only: a project file cannot change it."
+  ),
+  vGpu: external_exports.boolean().describe(
+    "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it)."
+  ),
   networking: external_exports.boolean().describe("Internet access. false is the only hard network isolation Windows Sandbox offers."),
-  clipboard: external_exports.boolean().describe("Shared clipboard between this PC and the sandbox."),
+  clipboard: external_exports.boolean().describe(
+    "Shared clipboard between this PC and the sandbox. Also lets an agent's copy (in sandbox attach) reach this PC's clipboard."
+  ),
   audioInput: external_exports.boolean().describe("Microphone access."),
   videoInput: external_exports.boolean().describe("Camera access."),
   printerRedirection: external_exports.boolean().describe("Printers from this PC."),
@@ -26573,24 +26591,25 @@ var ResumeSchema = external_exports.strictObject({
 // src/core/schema/web.ts
 var WebSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "(Beta) Allow the web UI: your sandbox sessions in a browser on this PC. Off by default, and nothing starts it by itself yet: sandbox web start works either way and runs it until sandbox web stop (or a restart of the PC)."
+    "(Beta) The web UI: your sandbox sessions in a browser on this PC (http://127.0.0.1:<port>, this PC only). On: every sandbox start also starts it in the background (it keeps running until sandbox web stop or a restart of the PC). Off: only sandbox web start runs it. Open it signed in with sandbox web open."
   ),
-  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken.")
+  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken."),
+  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts.")
 });
 
 // src/core/schema/vpn.ts
-var VPN_PROVIDERS = ["nordvpn", "openvpn-file"];
+var VPN_PROVIDERS = ["nordvpn", "openvpn-file", "wireguard-file"];
 var VpnSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
+    "(Alpha: not yet tried on a real PC) Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
   ),
   provider: external_exports.enum(VPN_PROVIDERS).describe(
-    "nordvpn: a recommended NordVPN server is picked at every launch. openvpn-file: your own .ovpn file (configFile)."
+    "nordvpn: a recommended NordVPN server is picked at every launch. openvpn-file: your own .ovpn file (configFile). wireguard-file: your own WireGuard .conf (configFile), e.g. from your company."
   ),
   protocol: external_exports.enum(["udp", "tcp"]).describe("udp is faster; tcp gets through networks that block udp."),
   country: external_exports.string().regex(/^([A-Za-z][A-Za-z .'-]{0,39})?$/, "a country name or code like uk or Germany").describe("nordvpn: the country of the server, e.g. uk, us or Germany. Empty = the best server anywhere."),
   configFile: external_exports.string().describe(
-    "openvpn-file: the .ovpn file on this PC (its certificates inside it). Files that run programs (script-security, up, down, plugin ...) are refused. A project's file can never set this."
+    "openvpn-file / wireguard-file: the .ovpn or .conf file on this PC (an .ovpn has its certificates inside it). Files that run programs (script-security, up, down, plugin, PostUp ...) are refused. A WireGuard file holds your private key: it is read when a sandbox starts and handed over in a one-shot file. A project's file can never set this."
   ),
   killSwitch: external_exports.boolean().describe(
     "Block all traffic that does not go through the tunnel: when the tunnel cannot start, the sandbox stays offline instead of using your normal connection. A project can only turn this on, never off."
@@ -26617,6 +26636,10 @@ var ConfigSchema = external_exports.strictObject({
     markSandboxFiles: external_exports.boolean().describe(
       `Programs and scripts (.exe, .ps1, .bat, .cmd, .msi, .lnk ...) that appear or change in your project while a sandbox runs get Windows' "downloaded from the internet" mark, so SmartScreen and PowerShell ask before they run on this PC.`
     ),
+    contained: external_exports.enum(["off", "vhdx"]).describe(
+      '(beta) Keep the sandbox tools, state and logs inside one disk image file (vhdx) instead of loose folders, so scanning programs on this PC see one file. Not yet tried on a real PC. Turn it on with sandbox storage contained on (it moves your files and asks first); Windows asks for permission to mount the image when a sandbox starts. "off" = loose folders, as always. Yours only: a project file (.sandbox-config.json) cannot set it.'
+    ),
+    containedMaxGb: external_exports.number().int().min(8).max(4096).describe("(beta) Largest size, in GB, the disk image of storage.contained may grow to."),
     warnDataGb: external_exports.number().min(0).describe(
       "Say at launch when the persisted data (tools, databases, logins) is bigger than this many GB; 0 = never. sandbox data shows what takes the space."
     )
@@ -26660,7 +26683,13 @@ var LocalOverridesSchema = external_exports.strictObject({
     "Scripts (.ps1 / .mjs / .cmd, relative to this file) run inside the sandbox before the agent."
   ),
   // This PC's resources are yours to share: CPU and paging file (this PC's disk) are not a project's to set.
-  sandbox: SandboxSchema.omit({ cpuLimit: true, pageFileMb: true }).partial(),
+  sandbox: SandboxSchema.omit({
+    cpuLimit: true,
+    pageFileMb: true,
+    engine: true,
+    agentMemoryHeadroomMb: true,
+    pressureResponse: true
+  }).partial(),
   // A project may block more (the LAN, hosts); it never opens hosts, ports, DNS or a proxy.
   network: NetworkSchema.pick({ blockPrivateRanges: true, blockHosts: true }).partial(),
   // A project may turn the kill switch on, never off, and never choose a VPN, a server, a file or a login.
@@ -26769,8 +26798,34 @@ var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
     cwd: Text().optional(),
     createdAt: TimeSchema
   }),
-  external_exports.strictObject({ kind: external_exports.literal("ping"), id: IdSchema, createdAt: TimeSchema })
+  external_exports.strictObject({ kind: external_exports.literal("ping"), id: IdSchema, createdAt: TimeSchema }),
+  /**
+   * The PC's own memory or CPU is running low (the host watchdog): the sandbox slows its heaviest builds down for
+   * `seconds` (it never stops them) so Windows does not have to close it. Repeated while the PC stays low.
+   */
+  external_exports.strictObject({
+    kind: external_exports.literal("pressure"),
+    id: IdSchema,
+    reason: Text(300),
+    seconds: external_exports.number().int().min(10).max(300),
+    createdAt: TimeSchema
+  })
 ]);
+var PressureStatusSchema = external_exports.object({
+  level: external_exports.enum(["ok", "throttled", "suspending"]),
+  profile: external_exports.enum(["normal", "gentle"]),
+  /** Share of the sandbox's RAM still free and of its commit limit in use (percent). */
+  ramFreePercent: external_exports.number().int().min(0).max(100),
+  commitPercent: external_exports.number().int().min(0).max(100),
+  /** Programs running at lower priority because of it. */
+  lowered: external_exports.number().int().min(0).max(1024),
+  /** Programs paused right now (name, process id, seconds left). */
+  paused: external_exports.array(external_exports.object({ name: Text(64), pid: external_exports.number().int(), seconds: external_exports.number().int().min(0).max(60) })).max(8),
+  /** The PC itself asked for slowing down (its memory or CPU is low). */
+  pcLow: external_exports.boolean(),
+  lastAction: Text(300),
+  updatedAt: TimeSchema
+});
 var GuestResponseSchema = external_exports.object({
   id: IdSchema,
   ok: external_exports.boolean(),
@@ -26950,6 +27005,8 @@ var RunDir = class {
   root;
   sandboxFile;
   vpnFile;
+  /** What the memory governor in the sandbox is doing (pressure.json). */
+  pressureFile;
   requestsDir;
   responsesDir;
   sessionsDir;
@@ -26962,6 +27019,7 @@ var RunDir = class {
     this.root = path3.join(dataDir2, "run");
     this.sandboxFile = path3.join(this.root, "sandbox.json");
     this.vpnFile = path3.join(this.root, "vpn.json");
+    this.pressureFile = path3.join(this.root, "pressure.json");
     this.requestsDir = path3.join(this.root, "requests");
     this.responsesDir = path3.join(this.root, "responses");
     this.sessionsDir = path3.join(this.root, "sessions");
@@ -26990,6 +27048,9 @@ var RunDir = class {
   readVpnStatus() {
     return readValid(VpnStatusSchema, this.vpnFile);
   }
+  readPressure() {
+    return readValid(PressureStatusSchema, this.pressureFile);
+  }
   readSession(id) {
     return readValid(SessionStatusSchema, this.sessionFile(id));
   }
@@ -27075,6 +27136,7 @@ var SYSTEM = {
   shutdown: () => system32("shutdown.exe"),
   dism: () => system32("Dism.exe"),
   msiexec: () => system32("msiexec.exe"),
+  sc: () => system32("sc.exe"),
   /** The .NET Framework C# compiler that ships with Windows (C# 5). */
   csc: () => path5.join(systemRoot(), "Microsoft.NET", "Framework64", "v4.0.30319", "csc.exe")
 };

package/dist/runtime/view.js

@@ -5622,7 +5622,14 @@ var KEPT_OSC = (body) => {
   return n <= 2 || n === 8 || n === 133 || n === 9 && body.startsWith(number4[1] + ";4;");
 };
 var MAX_KEPT_STRING = 4096;
+var MAX_CLIPBOARD_STRING = 1024 * 1024;
+var CLIPBOARD_WRITE = /^0{0,2}52;[cpqs0-7]{0,8};[A-Za-z0-9+/=]*$/;
 var OutputFilter = class {
+  constructor(options = {}) {
+    this.options = options;
+    this.maxString = options.clipboardWrites ? MAX_CLIPBOARD_STRING : MAX_KEPT_STRING;
+  }
+  options;
   /**
    * text: normal output; esc: after ESC; c2: after a 0xC2 lead byte; string: inside an OSC/DCS/...; stringEsc /
    * stringC2: a possible terminator inside one.
@@ -5630,8 +5637,14 @@ var OutputFilter = class {
   state = "text";
   /** The string being read: an OSC worth keeping is collected until its terminator; null = being dropped. */
   body = null;
+  maxString;
+  /** An OSC that may pass: a short title, link, progress or mark, or (when allowed) a clipboard write. */
+  kept(body) {
+    if (this.options.clipboardWrites && CLIPBOARD_WRITE.test(body)) return true;
+    return body.length <= MAX_KEPT_STRING && KEPT_OSC(body);
+  }
   push(chunk) {
-    const out = Buffer.allocUnsafe(chunk.length + MAX_KEPT_STRING + 8);
+    const out = Buffer.allocUnsafe(chunk.length + (this.body?.length ?? 0) + 8);
     let n = 0;
     const put = (...bytes) => {
       for (const b of bytes) out[n++] = b;
@@ -5651,7 +5664,7 @@ var OutputFilter = class {
     };
     const endString = (terminator) => {
       const body = this.body && Buffer.from(this.body).toString("latin1");
-      if (body !== null && KEPT_OSC(body)) {
+      if (body !== null && this.kept(body)) {
         put(27, 93);
         out.write(body, n, "latin1");
         n += body.length;
@@ -5661,7 +5674,7 @@ var OutputFilter = class {
       this.state = "text";
     };
     const collect = (b) => {
-      if (this.body && this.body.push(b) > MAX_KEPT_STRING) this.body = null;
+      if (this.body && this.body.push(b) > this.maxString) this.body = null;
     };
     for (const b of chunk) {
       switch (this.state) {
@@ -5751,6 +5764,7 @@ var SYSTEM = {
   shutdown: () => system32("shutdown.exe"),
   dism: () => system32("Dism.exe"),
   msiexec: () => system32("msiexec.exe"),
+  sc: () => system32("sc.exe"),
   /** The .NET Framework C# compiler that ships with Windows (C# 5). */
   csc: () => path.join(systemRoot(), "Microsoft.NET", "Framework64", "v4.0.30319", "csc.exe")
 };
@@ -5861,7 +5875,7 @@ function runTerminalClient(socket, token, options = {}) {
   return new Promise((resolve) => {
     let done = false;
     const reader = new FrameReader();
-    const filter = new OutputFilter();
+    const filter = new OutputFilter({ clipboardWrites: options.clipboardWrites });
     let sent = size();
     let resizeTimer;
     let vtInput;
@@ -25745,6 +25759,9 @@ var HarnessSchema = external_exports.strictObject({
   localState: external_exports.record(external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/), SubfolderSchema).optional().describe(
     "Environment variable -> folder below the agent's own state folder (state\\<agent>) for SQLite databases. SQLite cannot run in a mapped folder, so the agent runs from a copy on the sandbox's disk (the variable points to it) that is copied from and back to that folder."
   ),
+  bootReset: external_exports.array(SubfolderSchema).max(32).optional().describe(
+    "Files and folders below the agent's own state folder (state\\<agent>) that only work on the machine that wrote them (keys sealed with Windows DPAPI, local accounts it created). Every sandbox is a new machine, so they are deleted at each boot and the agent sets them up again."
+  ),
   resumeArguments: StringsSchema.optional().describe(
     "Arguments used when the agent is restarted in place (e.g. after an account switch) so it resumes the conversation."
   ),
@@ -25822,6 +25839,9 @@ var MappingSchema = external_exports.strictObject({
   optional: external_exports.boolean().optional().describe("true = skip it quietly when the host folder does not exist.")
 });
 var SandboxSchema = external_exports.strictObject({
+  engine: external_exports.enum(["windows-sandbox", "hcs"]).describe(
+    '(alpha) What runs the sandbox. "windows-sandbox" = Windows Sandbox (the default: desktop, Windows Terminal, GPU, clipboard, audio, printers). "hcs" = a headless Hyper-V isolated Server Core container for agents (no desktop, GPU or clipboard); it needs Windows features and an image on this PC (sandbox engine check hcs lists what is missing), and starting it is not enabled yet in this alpha. sandbox engine shows what each engine can do. Yours only: a project file (.sandbox-config.json) cannot set it.'
+  ),
   memoryMb: external_exports.union([external_exports.literal("auto"), external_exports.number().int().min(2048)]).describe('Sandbox RAM in MB (>= 2048), or "auto": free RAM minus reserveHostMb, capped at maxMemoryMb.'),
   maxMemoryMb: external_exports.number().int().positive().describe('Upper limit for memoryMb "auto".'),
   maxMemoryPercent: external_exports.number().int().min(10).max(100).describe(`memoryMb "auto" never takes more than this share of this PC's total RAM (percent).`),
@@ -25831,10 +25851,22 @@ var SandboxSchema = external_exports.strictObject({
   pageFileMb: external_exports.number().int().min(0).max(262144).describe(
     `Size of the sandbox's paging file in MB, created at full size when it starts so it never grows while builds run (8 GB of its disk always stays free). Windows Sandbox starts with about 1 GB: parallel builds then fail with "The paging file is too small", and Windows grows the file under load. 0 = leave Windows' own.`
   ),
-  reserveHostMb: external_exports.number().int().nonnegative().describe('RAM always left for this PC when memoryMb is "auto".'),
-  vGpu: external_exports.boolean().describe("Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface."),
+  reserveHostMb: external_exports.number().int().nonnegative().describe(
+    'Memory always left for this PC when memoryMb is "auto": the sandbox gets at most (free RAM, and RAM plus paging file still unused) minus this.'
+  ),
+  agentMemoryHeadroomMb: external_exports.union([external_exports.literal("auto"), external_exports.literal("none"), external_exports.number().int().min(0)]).describe(
+    'Memory kept out of the agents reach inside the sandbox, in MB: everything the agents start (their builds, tests, tools) together may use at most the sandbox memory minus this; a runaway parallel build then gets out-of-memory errors in its own session instead of freezing or crashing the whole sandbox. "auto" = the larger of 2048 MB and 10 % of the sandbox memory; "none" = no limit. Yours only: a project file cannot change it.'
+  ),
+  pressureResponse: external_exports.boolean().describe(
+    "When the sandbox (or this PC) runs low on memory, slow the heaviest build programs down (lower priority) and, if that is not enough, pause the biggest compiler for a few seconds at a time, so heavy parallel builds slow down instead of closing the sandbox. Never touches the agents themselves. Yours only: a project file cannot change it."
+  ),
+  vGpu: external_exports.boolean().describe(
+    "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it)."
+  ),
   networking: external_exports.boolean().describe("Internet access. false is the only hard network isolation Windows Sandbox offers."),
-  clipboard: external_exports.boolean().describe("Shared clipboard between this PC and the sandbox."),
+  clipboard: external_exports.boolean().describe(
+    "Shared clipboard between this PC and the sandbox. Also lets an agent's copy (in sandbox attach) reach this PC's clipboard."
+  ),
   audioInput: external_exports.boolean().describe("Microphone access."),
   videoInput: external_exports.boolean().describe("Camera access."),
   printerRedirection: external_exports.boolean().describe("Printers from this PC."),
@@ -26910,24 +26942,25 @@ var ResumeSchema = external_exports.strictObject({
 // src/core/schema/web.ts
 var WebSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "(Beta) Allow the web UI: your sandbox sessions in a browser on this PC. Off by default, and nothing starts it by itself yet: sandbox web start works either way and runs it until sandbox web stop (or a restart of the PC)."
+    "(Beta) The web UI: your sandbox sessions in a browser on this PC (http://127.0.0.1:<port>, this PC only). On: every sandbox start also starts it in the background (it keeps running until sandbox web stop or a restart of the PC). Off: only sandbox web start runs it. Open it signed in with sandbox web open."
   ),
-  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken.")
+  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken."),
+  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts.")
 });
 
 // src/core/schema/vpn.ts
-var VPN_PROVIDERS = ["nordvpn", "openvpn-file"];
+var VPN_PROVIDERS = ["nordvpn", "openvpn-file", "wireguard-file"];
 var VpnSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
+    "(Alpha: not yet tried on a real PC) Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
   ),
   provider: external_exports.enum(VPN_PROVIDERS).describe(
-    "nordvpn: a recommended NordVPN server is picked at every launch. openvpn-file: your own .ovpn file (configFile)."
+    "nordvpn: a recommended NordVPN server is picked at every launch. openvpn-file: your own .ovpn file (configFile). wireguard-file: your own WireGuard .conf (configFile), e.g. from your company."
   ),
   protocol: external_exports.enum(["udp", "tcp"]).describe("udp is faster; tcp gets through networks that block udp."),
   country: external_exports.string().regex(/^([A-Za-z][A-Za-z .'-]{0,39})?$/, "a country name or code like uk or Germany").describe("nordvpn: the country of the server, e.g. uk, us or Germany. Empty = the best server anywhere."),
   configFile: external_exports.string().describe(
-    "openvpn-file: the .ovpn file on this PC (its certificates inside it). Files that run programs (script-security, up, down, plugin ...) are refused. A project's file can never set this."
+    "openvpn-file / wireguard-file: the .ovpn or .conf file on this PC (an .ovpn has its certificates inside it). Files that run programs (script-security, up, down, plugin, PostUp ...) are refused. A WireGuard file holds your private key: it is read when a sandbox starts and handed over in a one-shot file. A project's file can never set this."
   ),
   killSwitch: external_exports.boolean().describe(
     "Block all traffic that does not go through the tunnel: when the tunnel cannot start, the sandbox stays offline instead of using your normal connection. A project can only turn this on, never off."
@@ -26954,6 +26987,10 @@ var ConfigSchema = external_exports.strictObject({
     markSandboxFiles: external_exports.boolean().describe(
       `Programs and scripts (.exe, .ps1, .bat, .cmd, .msi, .lnk ...) that appear or change in your project while a sandbox runs get Windows' "downloaded from the internet" mark, so SmartScreen and PowerShell ask before they run on this PC.`
     ),
+    contained: external_exports.enum(["off", "vhdx"]).describe(
+      '(beta) Keep the sandbox tools, state and logs inside one disk image file (vhdx) instead of loose folders, so scanning programs on this PC see one file. Not yet tried on a real PC. Turn it on with sandbox storage contained on (it moves your files and asks first); Windows asks for permission to mount the image when a sandbox starts. "off" = loose folders, as always. Yours only: a project file (.sandbox-config.json) cannot set it.'
+    ),
+    containedMaxGb: external_exports.number().int().min(8).max(4096).describe("(beta) Largest size, in GB, the disk image of storage.contained may grow to."),
     warnDataGb: external_exports.number().min(0).describe(
       "Say at launch when the persisted data (tools, databases, logins) is bigger than this many GB; 0 = never. sandbox data shows what takes the space."
     )
@@ -26997,7 +27034,13 @@ var LocalOverridesSchema = external_exports.strictObject({
     "Scripts (.ps1 / .mjs / .cmd, relative to this file) run inside the sandbox before the agent."
   ),
   // This PC's resources are yours to share: CPU and paging file (this PC's disk) are not a project's to set.
-  sandbox: SandboxSchema.omit({ cpuLimit: true, pageFileMb: true }).partial(),
+  sandbox: SandboxSchema.omit({
+    cpuLimit: true,
+    pageFileMb: true,
+    engine: true,
+    agentMemoryHeadroomMb: true,
+    pressureResponse: true
+  }).partial(),
   // A project may block more (the LAN, hosts); it never opens hosts, ports, DNS or a proxy.
   network: NetworkSchema.pick({ blockPrivateRanges: true, blockHosts: true }).partial(),
   // A project may turn the kill switch on, never off, and never choose a VPN, a server, a file or a login.
@@ -27106,8 +27149,34 @@ var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
     cwd: Text().optional(),
     createdAt: TimeSchema
   }),
-  external_exports.strictObject({ kind: external_exports.literal("ping"), id: IdSchema, createdAt: TimeSchema })
+  external_exports.strictObject({ kind: external_exports.literal("ping"), id: IdSchema, createdAt: TimeSchema }),
+  /**
+   * The PC's own memory or CPU is running low (the host watchdog): the sandbox slows its heaviest builds down for
+   * `seconds` (it never stops them) so Windows does not have to close it. Repeated while the PC stays low.
+   */
+  external_exports.strictObject({
+    kind: external_exports.literal("pressure"),
+    id: IdSchema,
+    reason: Text(300),
+    seconds: external_exports.number().int().min(10).max(300),
+    createdAt: TimeSchema
+  })
 ]);
+var PressureStatusSchema = external_exports.object({
+  level: external_exports.enum(["ok", "throttled", "suspending"]),
+  profile: external_exports.enum(["normal", "gentle"]),
+  /** Share of the sandbox's RAM still free and of its commit limit in use (percent). */
+  ramFreePercent: external_exports.number().int().min(0).max(100),
+  commitPercent: external_exports.number().int().min(0).max(100),
+  /** Programs running at lower priority because of it. */
+  lowered: external_exports.number().int().min(0).max(1024),
+  /** Programs paused right now (name, process id, seconds left). */
+  paused: external_exports.array(external_exports.object({ name: Text(64), pid: external_exports.number().int(), seconds: external_exports.number().int().min(0).max(60) })).max(8),
+  /** The PC itself asked for slowing down (its memory or CPU is low). */
+  pcLow: external_exports.boolean(),
+  lastAction: Text(300),
+  updatedAt: TimeSchema
+});
 var GuestResponseSchema = external_exports.object({
   id: IdSchema,
   ok: external_exports.boolean(),
@@ -27189,6 +27258,8 @@ var RunDir = class {
   root;
   sandboxFile;
   vpnFile;
+  /** What the memory governor in the sandbox is doing (pressure.json). */
+  pressureFile;
   requestsDir;
   responsesDir;
   sessionsDir;
@@ -27201,6 +27272,7 @@ var RunDir = class {
     this.root = path3.join(dataDir2, "run");
     this.sandboxFile = path3.join(this.root, "sandbox.json");
     this.vpnFile = path3.join(this.root, "vpn.json");
+    this.pressureFile = path3.join(this.root, "pressure.json");
     this.requestsDir = path3.join(this.root, "requests");
     this.responsesDir = path3.join(this.root, "responses");
     this.sessionsDir = path3.join(this.root, "sessions");
@@ -27229,6 +27301,9 @@ var RunDir = class {
   readVpnStatus() {
     return readValid(VpnStatusSchema, this.vpnFile);
   }
+  readPressure() {
+    return readValid(PressureStatusSchema, this.pressureFile);
+  }
   readSession(id) {
     return readValid(SessionStatusSchema, this.sessionFile(id));
   }
@@ -27287,7 +27362,7 @@ async function viewSession(id) {
     return 1;
   }
   const socket = await connect({ ...session.attach, addresses: ["127.0.0.1"] });
-  const result = await runTerminalClient(socket, session.attach.token);
+  const result = await runTerminalClient(socket, session.attach.token, { clipboardWrites: true });
   if (result.reason === "exit") console.log(session.harness + " exited with code " + result.exitCode + ".");
   else if (result.reason === "error") console.log("Session error: " + result.message);
   return result.reason === "exit" ? result.exitCode : 1;

package/dist/selftest/agent-paths.test.js

@@ -5,7 +5,7 @@ import path from 'node:path';
 import { DEFAULTS, mergeConfig, validateConfig } from '../core/config/index.js';
 import { isWin } from '../core/util/index.js';
 import { SYSTEM } from '../shared/system.js';
-import { agentCommand, agentShims, isCopyableDatabaseFile, isDatabaseFile, localStateEntries, shimText, } from '../guest/agents/agent-files.js';
+import { agentCommand, agentShims, bootResetPaths, isCopyableDatabaseFile, isDatabaseFile, localStateEntries, shimText, } from '../guest/agents/agent-files.js';
 import { appendMissing, expandVars, isPinnedNodeDir, parseRegPath, pathKey, planPath, rebuildPath, splitPath, } from '../guest/setup/path-plan.js';
 import { withReloadEnvironment } from '../host/tools/index.js';
 import { HarnessSchema } from '../core/schema/index.js';
@@ -48,6 +48,16 @@ export const agentPathsSuite = {
         t.check(HarnessSchema.safeParse({ ...DEFAULTS.harnesses.codex, localState: { X: '..\\up' } }).success === false, 'a local state folder cannot leave the agent state folder');
         t.equal(['state_5.sqlite', 'x.sqlite-wal', 'x.sqlite-shm', 'a.db', 'auth.json'].map(isDatabaseFile), [true, true, true, true, false], 'database files are told apart');
         t.equal(['state_5.sqlite', 'x.sqlite-wal', 'x.sqlite-shm'].map(isCopyableDatabaseFile), [true, true, false], 'the -shm file is not copied (SQLite rebuilds it)');
+        t.section('agent files sealed to the last sandbox');
+        t.equal(bootResetPaths(DEFAULTS.harnesses, 'C:\\AgentData\\state')
+            .filter((p) => p.agent === 'codex')
+            .map((p) => p.path), [
+            'C:\\AgentData\\state\\codex\\.sandbox-secrets',
+            'C:\\AgentData\\state\\codex\\.sandbox\\setup_marker.json',
+            'C:\\AgentData\\state\\codex\\.sandbox\\deny_read_acl_state.json',
+        ], "codex's DPAPI-sealed sandbox users and setup marker are removed at boot (CryptUnprotectData otherwise)");
+        t.check(HarnessSchema.safeParse({ ...DEFAULTS.harnesses.codex, bootReset: ['..\\login'] }).success === false &&
+            HarnessSchema.safeParse({ ...DEFAULTS.harnesses.codex, bootReset: ['C:\\Windows'] }).success === false, 'bootReset takes only plain paths below the agent state folder');
         t.section('PATH planner');
         const present = new Set(['c:\\a', 'c:\\b', 'c:\\c\\d', 'c:\\nvm\\v24.1.0']);
         const exists = (f) => present.has(pathKey(f));

package/dist/selftest/app.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const appSuite: Suite;