windows-development-sandbox 1.7.0 → 1.10.0

package/dist/selftest/support/hcs-probes.js

@@ -0,0 +1,41 @@
+export const FAKE_IMAGE = {
+    id: 'sha256:' + 'a'.repeat(64),
+    layers: ['C:\\img\\base', 'C:\\img\\l2'],
+    utilityVmFiles: 'C:\\img\\base\\UtilityVM\\Files',
+};
+export const GOOD_PC = {
+    windows: true,
+    build: 22621,
+    computecore: true,
+    services: { vmcompute: true, cexecsvc: true },
+    token: { elevatedAdministrator: true, hyperVAdministrators: false },
+    image: FAKE_IMAGE,
+};
+export function fakeProbes(pc = {}) {
+    const p = { ...GOOD_PC, ...pc };
+    const calls = [];
+    const store = {
+        name: 'fake store',
+        find: () => {
+            calls.push('imageStore.find');
+            return { image: p.image, reason: p.image ? '' : 'The fake store has no image.' };
+        },
+    };
+    return {
+        calls,
+        isWindows: () => p.windows,
+        windowsBuild: () => p.build,
+        serviceInstalled: (name) => {
+            calls.push('serviceInstalled:' + name);
+            return name in p.services ? p.services[name] : null;
+        },
+        fileExists: (file) => {
+            calls.push('fileExists:' + file);
+            return file.toLowerCase().endsWith('computecore.dll') ? p.computecore : false;
+        },
+        tokenGroups: () => p.token,
+        imageStores: () => [store],
+    };
+}
+/** A PC without the HCS pieces, for the tests that must not depend on the PC they run on. */
+export const NO_HCS_PC = fakeProbes({ computecore: false, services: { vmcompute: false, cexecsvc: false } });

package/dist/selftest/vpn.test.js

@@ -8,11 +8,12 @@ import { ConfigSchema, LocalOverridesSchema } from '../core/schema/index.js';
 import { SecretStore } from '../host/secrets/index.js';
 import { clearSecrets } from '../host/secrets/index.js';
 import { generateSandbox } from '../host/launch/index.js';
-import { findCountry, nordProfile, prepareVpn, recommendedServer, VpnLogin, vpnLine, vpnNotes, } from '../host/vpn/index.js';
+import { findCountry, nordProfile, prepareVpn, wireguardFileProblem, recommendedServer, VpnLogin, vpnLine, vpnNotes, } from '../host/vpn/index.js';
 import { RunDir } from '../shared/channel/index.js';
-import { OPENVPN_MSI } from '../shared/vpn/download.js';
+import { OPENVPN_MSI, WIREGUARD_MSI } from '../shared/vpn/download.js';
 import { cleanServers, killSwitchCommands, removeKillSwitchCommands, tunnelAddressFromLog, tunnelCommands, } from '../shared/vpn/kill-switch.js';
 import { assertSafeOvpn, inspectOvpn, PROGRAM_DIRECTIVES } from '../shared/vpn/ovpn.js';
+import { assertSafeWireguard, handshakeDone, inspectWireguard, renderWireguard, serviceRunning, WIREGUARD_PROGRAM_KEYS, wireguardEndpoints, wireguardTunnelAddress, } from '../shared/vpn/wireguard.js';
 const PROFILE = [
     'client',
     'dev tun',
@@ -51,6 +52,24 @@ const PROFILE = [
     '</tls-auth>',
     '',
 ].join('\r\n');
+const PRIVATE_KEY = 'PrivPlanted' + 'A'.repeat(32) + '=';
+const PUBLIC_KEY = 'PubPlanted' + 'B'.repeat(33) + '=';
+const PRESHARED_KEY = 'PskPlanted' + 'C'.repeat(33) + '=';
+const WG_CONFIG = [
+    '[Interface]',
+    'PrivateKey = ' + PRIVATE_KEY,
+    'Address = 10.64.0.2/32, fd00::2/128',
+    'DNS = 10.64.0.1',
+    'MTU = 1380',
+    '',
+    '[Peer] # the office',
+    'PublicKey = ' + PUBLIC_KEY,
+    'PresharedKey = ' + PRESHARED_KEY,
+    'AllowedIPs = 0.0.0.0/0, ::/0',
+    'Endpoint = vpn.example.com:51820',
+    'PersistentKeepalive = 25',
+    '',
+].join('\r\n');
 const PASSWORD = 'vpn-pass-planted-91c2d7';
 const USERNAME = 'vpn-user-planted-5e8a40';
 export const vpnSuite = {
@@ -206,7 +225,7 @@ export const vpnSuite = {
         });
         t.check(prepared !== null &&
             prepared.session.server === 'uk2201.nordvpn.com' &&
-            prepared.credentials.password === PASSWORD, 'a launch picks the server, checks its profile and holds the login in memory');
+            prepared.credentials?.password === PASSWORD, 'a launch picks the server, checks its profile and holds the login in memory');
         await t.throws(() => prepareVpn({
             config: run.config,
             storageRoot: config.storage.root,
@@ -275,5 +294,119 @@ export const vpnSuite = {
             killSwitch: true,
             updatedAt: 'n',
         }).text.includes('\u001b'), 'text the sandbox wrote loses its escape sequences before it is printed');
+        t.section('WireGuard: your own config is untrusted data');
+        const wg = inspectWireguard(WG_CONFIG);
+        t.check(wg.ok &&
+            wg.config.peers.length === 1 &&
+            wg.config.peers[0].endpointHost === 'vpn.example.com' &&
+            wg.config.peers[0].endpointPort === 51820 &&
+            wireguardTunnelAddress(wg.config) === '10.64.0.2' &&
+            wireguardEndpoints(wg.config)[0].port === 51820, 'a plain config is accepted and says where it connects and which address the tunnel has', JSON.stringify(wg));
+        for (const key of WIREGUARD_PROGRAM_KEYS) {
+            const bad = inspectWireguard(WG_CONFIG.replace('MTU = 1380', key + ' = calc.exe'));
+            t.check(!bad.ok && bad.problems.some((p) => p.toLowerCase().includes(key)), key + ' is refused by name', JSON.stringify(bad));
+        }
+        const wgOdd = [
+            ['FwMark = 7', 'an unknown [Interface] key is refused, not passed on'],
+            ['postup = calc', 'lower case does not hide PostUp'],
+            ['[Socks]', 'an unknown section is refused'],
+            ['DNS = evil.example.com', 'a DNS name (a search domain) is refused: only addresses'],
+            ['MTU = 99999', 'an MTU out of range is refused'],
+            ['PrivateKey = ' + PRIVATE_KEY, 'a second PrivateKey is refused'],
+        ];
+        for (const [line, why] of wgOdd) {
+            const text = line.startsWith('[') ? WG_CONFIG + line + '\r\n' : WG_CONFIG.replace('MTU = 1380', line);
+            t.check(!inspectWireguard(text).ok, why, line);
+        }
+        t.check(!inspectWireguard(WG_CONFIG.replace(PRIVATE_KEY, 'tooshort')).ok &&
+            !inspectWireguard(WG_CONFIG.replace('10.64.0.2/32, fd00::2/128', 'fd00::2/128')).ok &&
+            !inspectWireguard(WG_CONFIG.replace('vpn.example.com:51820', '[2001:db8::1]:51820')).ok &&
+            !inspectWireguard(WG_CONFIG.replace('Endpoint = vpn.example.com:51820', '')).ok &&
+            !inspectWireguard(WG_CONFIG.replace('vpn.example.com:51820', 'vpn.example.com:0')).ok &&
+            !inspectWireguard(WG_CONFIG.replace('[Peer] # the office', '')).ok &&
+            !inspectWireguard('x'.repeat(20 * 1024)).ok &&
+            !inspectWireguard(WG_CONFIG.replace('AllowedIPs = 0.0.0.0/0, ::/0', 'AllowedIPs = 300.0.0.0/0')).ok, 'a bad key, an IPv6-only address or endpoint, a missing endpoint or peer, a bad port, a huge file and a bad range are refused');
+        t.check(inspectWireguard(WG_CONFIG.replace('MTU = 1380', '# PostUp = calc\r\nMTU = 1380 # PreUp = calc')).ok, 'comments are comments (a commented-out PostUp is not a key)');
+        const refusals = [
+            WG_CONFIG.replace('MTU = 1380', 'PostUp = ' + PRIVATE_KEY),
+            WG_CONFIG.replace('MTU = 1380', 'Bogus = ' + PRESHARED_KEY),
+            WG_CONFIG.replace(PUBLIC_KEY, 'bad' + PRESHARED_KEY),
+            WG_CONFIG.replace(PRIVATE_KEY, PRIVATE_KEY + 'x'),
+        ].map(inspectWireguard);
+        t.check(refusals.every((r) => !r.ok && !JSON.stringify(r).includes('PrivPlanted') && !JSON.stringify(r).includes('PskPlanted')), 'what a refusal says never contains a key');
+        await t.throws(() => assertSafeWireguard(WG_CONFIG.replace('MTU = 1380', 'PostUp = calc'), 'office.conf'), 'office.conf was refused', 'a refused config names its file and the reason');
+        if (wg.ok) {
+            const text = renderWireguard(wg.config, { 0: '203.0.113.7' });
+            t.check(text.includes('Endpoint = 203.0.113.7:51820') &&
+                !text.includes('vpn.example.com') &&
+                !text.includes('the office') &&
+                inspectWireguard(text).ok, 'the config handed on is written again from the checked values, with the endpoint as an address, and is itself valid');
+        }
+        const wgRules = killSwitchCommands([{ ip: '203.0.113.7', port: 51820, proto: 'udp' }], null).map((c) => c.join(' '));
+        t.check(wgRules.some((c) => c.includes('name=AgentSandbox-VPN-Server-1') &&
+            c.includes('protocol=udp') &&
+            c.includes('remoteip=203.0.113.7') &&
+            c.includes('remoteport=51820')) && wgRules.findIndex((c) => c.includes('blockoutbound')) < wgRules.findIndex((c) => c.includes('action=allow')), 'the kill switch blocks first and lets only the endpoint host:port through, over udp');
+        t.check(tunnelCommands('10.64.0.2').some((c) => c.join(' ').includes('localip=10.64.0.2') && c[2] === 'add'), "the tunnel's own address (from Address) is let through once the service runs");
+        t.check(WIREGUARD_MSI.x64.sha256.length === 64 &&
+            WIREGUARD_MSI.arm64.sha256.length === 64 &&
+            WIREGUARD_MSI.base.startsWith('https://download.wireguard.com/') &&
+            serviceRunning('STATE              : 4  RUNNING') &&
+            !serviceRunning('STATE              : 1  STOPPED') &&
+            handshakeDone('abc=\t1700000000\r\n') &&
+            !handshakeDone('abc=\t0\r\n') &&
+            !handshakeDone(''), 'the WireGuard download is pinned by checksum; the service state and handshake are read from the tools output');
+        t.section('WireGuard: the keys never land in session.json or the launch folder');
+        const wgDir = t.dir('wg-config');
+        const wgFile = path.join(wgDir, 'office.conf');
+        fs.writeFileSync(wgFile, WG_CONFIG);
+        const wgSettings = f.makeConfig();
+        wgSettings.vpn = { ...wgSettings.vpn, enabled: true, provider: 'wireguard-file', configFile: wgFile };
+        const wgRun = await f.run({}, wgSettings);
+        const wgPrepared = await prepareVpn({
+            config: wgRun.config,
+            storageRoot: wgSettings.storage.root,
+            login: new VpnLogin(t.dir('wg-nologin'), SecretStore.memory()),
+        });
+        t.check(wgPrepared !== null &&
+            wgPrepared.session.server === 'office.conf' &&
+            wgPrepared.session.profile === undefined &&
+            wgPrepared.credentials === undefined &&
+            (wgPrepared.wireguardConfig ?? '').includes(PRIVATE_KEY), 'a launch needs no saved login; it holds the checked config (with the private key) in memory only');
+        fs.writeFileSync(wgFile, WG_CONFIG.replace('MTU = 1380', 'PostUp = calc.exe'));
+        await t.throws(() => prepareVpn({ config: wgRun.config, storageRoot: wgSettings.storage.root }), 'refused', 'a config with PostUp stops the launch before anything is written');
+        t.check(wireguardFileProblem(wgFile, wgDir)?.includes('refused') === true &&
+            wireguardFileProblem(path.join(wgDir, 'missing.conf'), wgDir) !== null &&
+            !(wireguardFileProblem(wgFile, wgDir) ?? '').includes('PrivPlanted'), 'doctor says a bad or missing config is a problem, without a key');
+        fs.writeFileSync(wgFile, WG_CONFIG);
+        t.check(wireguardFileProblem('office.conf', wgDir) === null, 'a good config, even by a relative path, is fine');
+        clearSecrets(wgSettings.storage.root, wgRun.dataPath);
+        const wgLaunch = generateSandbox({
+            packageRoot: t.packageRoot,
+            run: wgRun,
+            harnessArgs: [],
+            probe: f.probe,
+            pcLanguages: ['python', 'rust', 'cpp', 'dotnet'],
+            ...(wgPrepared ? { vpn: wgPrepared } : {}),
+        });
+        const wgSession = fs.readFileSync(wgLaunch.sessionPath, 'utf8');
+        const wgAll = [];
+        const wgWalk = (d) => {
+            for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+                const p = path.join(d, e.name);
+                if (e.isDirectory())
+                    wgWalk(p);
+                else
+                    wgAll.push(fs.readFileSync(p, 'latin1'));
+            }
+        };
+        wgWalk(wgLaunch.launchPath);
+        const hasKey = (text) => text.includes(PRIVATE_KEY) || text.includes(PRESHARED_KEY) || text.includes('PrivPlanted');
+        t.check(!hasKey(wgSession) && !wgAll.some(hasKey) && !fs.existsSync(path.join(wgLaunch.launchPath, 'vpn')), 'neither the private key nor the preshared key is in session.json or any file of the launch folder');
+        const wgHanded = f.readJson(new RunDir(wgRun.dataPath).secretFile(wgLaunch.launchId));
+        t.check((wgHanded.wireguardConfig ?? '').includes(PRIVATE_KEY) && wgHanded.vpn === undefined, 'the config is only in the one-shot file for the sandbox');
+        clearSecrets(wgSettings.storage.root, wgRun.dataPath);
+        t.check(!fs.existsSync(new RunDir(wgRun.dataPath).secretFile(wgLaunch.launchId)) &&
+            vpnNotes(wgSettings.vpn).some((n) => n.includes('WireGuard private key') && n.includes('turn the tunnel off')), 'the launch warns that the agent can read the key and turn the tunnel off');
     },
 };

package/dist/selftest/web.test.js

@@ -1,11 +1,13 @@
 // The web UI's server: login and cookie, the Host / Origin / CSRF checks, static files that cannot leave their folder,
-// sessions without tokens, and the terminal bridge against a fake ptyhost on loopback (the real address check is the
-// backend's, so the fake is only reachable here).
+// sessions without tokens, the terminal bridge against a fake ptyhost on loopback (the real address check is the
+// backend's, so the fake is only reachable here), and the RPC socket of the shared core against a fake RpcHost.
 import http from 'node:http';
 import net from 'node:net';
 import path from 'node:path';
 import WebSocket from 'ws';
+import { cancelled } from '../app/kernel/index.js';
 import { webSession } from '../cli/services/index.js';
+import { fail } from '../core/util/index.js';
 import { cookieValue, csrfOk, hostAllowed, originAllowed, sameSecret, StaticFiles, WebAuth, WebServer, WebStore, } from '../host/web/index.js';
 import { encodeFrame, FrameReader, FrameType } from '../shared/pty/index.js';
 import { CSRF_HEADER, CSRF_VALUE, parseClientMessage } from '../shared/web/index.js';
@@ -96,6 +98,35 @@ class Tab {
         this.socket.on('close', (code) => (this.closeCode = code));
     }
 }
+/** A stand-in for the shared core: one operation that reports, asks and may fail, and one live query. */
+function fakeRpc() {
+    const ran = [];
+    const live = { value: 1 };
+    const host = {
+        kind: (id) => (id === 'test.work' ? 'operation' : id === 'test.live' ? 'query' : undefined),
+        liveMs: (id) => (id === 'test.live' ? 50 : undefined),
+        run: async (id, input, io) => {
+            ran.push(id);
+            if (id === 'test.live')
+                return { value: live.value };
+            const how = (input ?? {});
+            io.progress('Working');
+            io.log('one line', 'muted');
+            if (!(await io.confirm({ title: 'Go on?' })))
+                cancelled();
+            if (how.fail)
+                fail('It broke.', 'Fix it like this.');
+            if (how.bug)
+                throw new Error('internal detail C:\\Users\\secret');
+            return { done: true };
+        },
+    };
+    return { host, ran, live };
+}
+/** The server's messages on an RPC socket, parsed. */
+function rpcMessages(tab) {
+    return tab.texts.map((text) => JSON.parse(text));
+}
 const session = (id, attach) => ({
     id,
     launchId: 'launch1',
@@ -202,7 +233,15 @@ export const webSuite = {
             },
         };
         let stopped = false;
-        const server = new WebServer({ port: 0, token: TOKEN, backend, staticRoot: root, onStop: () => (stopped = true) });
+        const rpc = fakeRpc();
+        const server = new WebServer({
+            port: 0,
+            token: TOKEN,
+            backend,
+            staticRoot: root,
+            rpc: rpc.host,
+            onStop: () => (stopped = true),
+        });
         await server.start();
         const { port } = server;
         const origin = 'http://127.0.0.1:' + port;
@@ -282,6 +321,65 @@ export const webSuite = {
             leaving.socket.close();
             await t.waitFor(() => fake.closed >= 3, 5000);
             t.check(fake.closed >= 3, 'closing the browser side closes the connection to the session');
+            t.section('the RPC socket');
+            const rpcUrl = 'ws://127.0.0.1:' + port + '/api/rpc';
+            const refusedRpc = [
+                new Tab(rpcUrl, { Cookie }),
+                new Tab(rpcUrl, { Origin: 'http://evil.example', Cookie }),
+                new Tab(rpcUrl, { Origin: origin }),
+            ];
+            await t.waitFor(() => refusedRpc.every((a) => a.failed), 5000);
+            t.check(refusedRpc.every((a) => !a.opened), 'the RPC socket needs the cookie and this page as its Origin, like the terminal');
+            const browser = new Tab(rpcUrl, { Origin: origin, Cookie });
+            await t.waitFor(() => browser.opened, 5000);
+            const reply = (id, kind) => rpcMessages(browser).find((m) => m.id === id && m.t === kind);
+            browser.socket.send(JSON.stringify({ t: 'call', id: 'c1', op: 'test.work', input: {} }));
+            await t.waitFor(() => reply('c1', 'ask'), 5000);
+            t.check(reply('c1', 'progress') !== undefined && reply('c1', 'log') !== undefined, 'a call streams its progress and log lines before it asks');
+            browser.socket.send(JSON.stringify({ t: 'answer', id: 'c1', value: true }));
+            await t.waitFor(() => reply('c1', 'result'), 5000);
+            t.equal(reply('c1', 'result'), { t: 'result', id: 'c1', output: { done: true } }, 'the answer lets it finish');
+            browser.socket.send(JSON.stringify({ t: 'call', id: 'c2', op: 'test.work', input: {} }));
+            await t.waitFor(() => reply('c2', 'ask'), 5000);
+            browser.socket.send(JSON.stringify({ t: 'answer', id: 'c2', value: 'yes please' }));
+            await t.waitFor(() => reply('c2', 'error'), 5000);
+            const declinedCall = reply('c2', 'error');
+            t.check(declinedCall?.t === 'error' && declinedCall.error.kind === 'cancelled', 'an answer of the wrong kind counts as no: nothing changes');
+            browser.socket.send(JSON.stringify({ t: 'call', id: 'c3', op: 'test.work', input: { fail: true } }));
+            browser.socket.send(JSON.stringify({ t: 'call', id: 'c4', op: 'test.work', input: { bug: true } }));
+            await t.waitFor(() => reply('c3', 'ask') && reply('c4', 'ask'), 5000);
+            browser.socket.send(JSON.stringify({ t: 'answer', id: 'c3', value: true }));
+            browser.socket.send(JSON.stringify({ t: 'answer', id: 'c4', value: true }));
+            await t.waitFor(() => reply('c3', 'error') && reply('c4', 'error'), 5000);
+            t.equal(reply('c3', 'error'), { t: 'error', id: 'c3', error: { kind: 'user', message: 'It broke.', fix: 'Fix it like this.' } }, 'a failure arrives as its message and fix');
+            t.equal(reply('c4', 'error'), { t: 'error', id: 'c4', error: { kind: 'bug', message: 'Something went wrong.' } }, "a bug's details stay on this PC");
+            const before = rpc.ran.length;
+            browser.socket.send(JSON.stringify({ t: 'call', id: 'c5', op: 'sandbox.notThere', input: {} }));
+            await t.waitFor(() => reply('c5', 'error'), 5000);
+            const unknown = reply('c5', 'error');
+            t.check(unknown?.t === 'error' && unknown.error.kind === 'invalid' && rpc.ran.length === before, 'an operation that is not allowed on the web is never run');
+            browser.socket.send(JSON.stringify({ t: 'subscribe', id: 's1', query: 'test.live', input: {} }));
+            await t.waitFor(() => reply('s1', 'data'), 5000);
+            rpc.live.value = 2;
+            await t.waitFor(() => rpcMessages(browser).filter((m) => m.id === 's1' && m.t === 'data').length === 2, 5000);
+            const updates = rpcMessages(browser).filter((m) => m.id === 's1' && m.t === 'data');
+            t.equal(updates.map((m) => (m.t === 'data' ? m.output : null)), [{ value: 1 }, { value: 2 }], 'a live query sends its result, then again only when it changed');
+            browser.socket.send(JSON.stringify({ t: 'unsubscribe', id: 's1' }));
+            await new Promise((resolve) => setTimeout(resolve, 200));
+            const reads = rpc.ran.filter((id) => id === 'test.live').length;
+            await new Promise((resolve) => setTimeout(resolve, 200));
+            t.equal(rpc.ran.filter((id) => id === 'test.live').length, reads, 'unsubscribing stops the reads');
+            browser.socket.send(JSON.stringify({ t: 'call', id: 'bad id!', op: 'test.work', input: {} }));
+            await t.waitFor(() => browser.closeCode !== null, 5000);
+            t.equal(browser.closeCode, 1008, 'a message that does not fit the schema closes the socket');
+            const leaver = new Tab(rpcUrl, { Origin: origin, Cookie });
+            await t.waitFor(() => leaver.opened, 5000);
+            const runs = rpc.ran.length;
+            leaver.socket.send(JSON.stringify({ t: 'call', id: 'c1', op: 'test.work', input: {} }));
+            await t.waitFor(() => leaver.texts.some((m) => m.includes('"ask"')), 5000);
+            leaver.socket.close();
+            await t.waitFor(() => leaver.closeCode !== null, 5000);
+            t.check(rpc.ran.length === runs + 1, 'a browser that leaves mid-question answers no (the call ends)');
             t.section('stopping');
             t.equal((await send(port, 'POST', '/api/stop', { ...json, Cookie }, '{}')).status, 403, 'stop needs CSRF and Origin too');
             t.equal((await send(port, 'POST', '/api/stop', { ...ajax, Cookie }, '{}')).status, 200, 'a signed-in browser can stop it');

package/dist/shared/channel/run-dir.d.ts

@@ -1,4 +1,4 @@
-import type { GuestRequest, GuestResponse, ProjectStatus, SandboxStatus, SessionStatus, VpnStatus } from './schema.js';
+import type { GuestRequest, GuestResponse, PressureStatus, ProjectStatus, SandboxStatus, SessionStatus, VpnStatus } from './schema.js';
 /** Ids become file names, so only a strict alphabet is allowed (no separators, no dots). */
 export declare function safeId(id: string): string;
 export declare function now(): string;
@@ -7,6 +7,8 @@ export declare class RunDir {
     readonly root: string;
     readonly sandboxFile: string;
     readonly vpnFile: string;
+    /** What the memory governor in the sandbox is doing (pressure.json). */
+    readonly pressureFile: string;
     readonly requestsDir: string;
     readonly responsesDir: string;
     readonly sessionsDir: string;
@@ -23,6 +25,7 @@ export declare class RunDir {
     secretFile(id: string): string;
     readSandboxStatus(): SandboxStatus | null;
     readVpnStatus(): VpnStatus | null;
+    readPressure(): PressureStatus | null;
     readSession(id: string): SessionStatus | null;
     readResponse(id: string): GuestResponse | null;
     listSessions(): SessionStatus[];

package/dist/shared/channel/run-dir.js

@@ -3,7 +3,7 @@
 // written atomically and parsed with the channel schemas on read. Anything that does not parse is ignored.
 import fs from 'node:fs';
 import path from 'node:path';
-import { GuestRequestSchema, GuestResponseSchema, IdSchema, ProjectStatusSchema, SandboxStatusSchema, SessionStatusSchema, VpnStatusSchema, } from './schema.js';
+import { GuestRequestSchema, GuestResponseSchema, IdSchema, PressureStatusSchema, ProjectStatusSchema, SandboxStatusSchema, SessionStatusSchema, VpnStatusSchema, } from './schema.js';
 import { readValid } from '../io/index.js';
 /** Ids become file names, so only a strict alphabet is allowed (no separators, no dots). */
 export function safeId(id) {
@@ -34,6 +34,8 @@ export class RunDir {
     root;
     sandboxFile;
     vpnFile;
+    /** What the memory governor in the sandbox is doing (pressure.json). */
+    pressureFile;
     requestsDir;
     responsesDir;
     sessionsDir;
@@ -46,6 +48,7 @@ export class RunDir {
         this.root = path.join(dataDir, 'run');
         this.sandboxFile = path.join(this.root, 'sandbox.json');
         this.vpnFile = path.join(this.root, 'vpn.json');
+        this.pressureFile = path.join(this.root, 'pressure.json');
         this.requestsDir = path.join(this.root, 'requests');
         this.responsesDir = path.join(this.root, 'responses');
         this.sessionsDir = path.join(this.root, 'sessions');
@@ -74,6 +77,9 @@ export class RunDir {
     readVpnStatus() {
         return readValid(VpnStatusSchema, this.vpnFile);
     }
+    readPressure() {
+        return readValid(PressureStatusSchema, this.pressureFile);
+    }
     readSession(id) {
         return readValid(SessionStatusSchema, this.sessionFile(id));
     }

package/dist/shared/channel/schema.d.ts

@@ -194,6 +194,7 @@ export declare const ProjectSpecSchema: z.ZodObject<{
             hostDir: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
         localState: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        bootReset: z.ZodOptional<z.ZodArray<z.ZodString>>;
         resumeArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
         resumeOneArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
@@ -351,6 +352,7 @@ export declare const GuestRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 hostDir: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
             localState: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            bootReset: z.ZodOptional<z.ZodArray<z.ZodString>>;
             resumeArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
             resumeOneArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
@@ -372,6 +374,7 @@ export declare const GuestRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             hostDir: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
         localState: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        bootReset: z.ZodOptional<z.ZodArray<z.ZodString>>;
         resumeArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
         resumeOneArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
@@ -524,6 +527,7 @@ export declare const GuestRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 hostDir: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
             localState: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            bootReset: z.ZodOptional<z.ZodArray<z.ZodString>>;
             resumeArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
             resumeOneArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
@@ -547,7 +551,37 @@ export declare const GuestRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"ping">;
     id: z.ZodString;
     createdAt: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"pressure">;
+    id: z.ZodString;
+    reason: z.ZodString;
+    seconds: z.ZodNumber;
+    createdAt: z.ZodString;
 }, z.core.$strict>], "kind">;
+/** C:\AgentData\run\pressure.json: what the memory governor in the sandbox is doing (guest-written, capped). */
+export declare const PressureStatusSchema: z.ZodObject<{
+    level: z.ZodEnum<{
+        ok: "ok";
+        throttled: "throttled";
+        suspending: "suspending";
+    }>;
+    profile: z.ZodEnum<{
+        normal: "normal";
+        gentle: "gentle";
+    }>;
+    ramFreePercent: z.ZodNumber;
+    commitPercent: z.ZodNumber;
+    lowered: z.ZodNumber;
+    paused: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        pid: z.ZodNumber;
+        seconds: z.ZodNumber;
+    }, z.core.$strip>>;
+    pcLow: z.ZodBoolean;
+    lastAction: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strip>;
+export type PressureStatus = z.output<typeof PressureStatusSchema>;
 /** C:\AgentData\run\responses\<id>.json: the guest's reply. */
 export declare const GuestResponseSchema: z.ZodObject<{
     id: z.ZodString;
@@ -604,9 +638,9 @@ export declare const ProjectStatusSchema: z.ZodObject<{
 /** The guest writes run/vpn.json: whether the VPN tunnel is up (validated and capped on the host). */
 export declare const VpnStatusSchema: z.ZodObject<{
     state: z.ZodEnum<{
+        off: "off";
         failed: "failed";
         starting: "starting";
-        off: "off";
         up: "up";
     }>;
     message: z.ZodString;

package/dist/shared/channel/schema.js

@@ -91,7 +91,34 @@ export const GuestRequestSchema = z.discriminatedUnion('kind', [
         createdAt: TimeSchema,
     }),
     z.strictObject({ kind: z.literal('ping'), id: IdSchema, createdAt: TimeSchema }),
+    /**
+     * The PC's own memory or CPU is running low (the host watchdog): the sandbox slows its heaviest builds down for
+     * `seconds` (it never stops them) so Windows does not have to close it. Repeated while the PC stays low.
+     */
+    z.strictObject({
+        kind: z.literal('pressure'),
+        id: IdSchema,
+        reason: Text(300),
+        seconds: z.number().int().min(10).max(300),
+        createdAt: TimeSchema,
+    }),
 ]);
+/** C:\AgentData\run\pressure.json: what the memory governor in the sandbox is doing (guest-written, capped). */
+export const PressureStatusSchema = z.object({
+    level: z.enum(['ok', 'throttled', 'suspending']),
+    profile: z.enum(['normal', 'gentle']),
+    /** Share of the sandbox's RAM still free and of its commit limit in use (percent). */
+    ramFreePercent: z.number().int().min(0).max(100),
+    commitPercent: z.number().int().min(0).max(100),
+    /** Programs running at lower priority because of it. */
+    lowered: z.number().int().min(0).max(1024),
+    /** Programs paused right now (name, process id, seconds left). */
+    paused: z.array(z.object({ name: Text(64), pid: z.number().int(), seconds: z.number().int().min(0).max(60) })).max(8),
+    /** The PC itself asked for slowing down (its memory or CPU is low). */
+    pcLow: z.boolean(),
+    lastAction: Text(300),
+    updatedAt: TimeSchema,
+});
 /** C:\AgentData\run\responses\<id>.json: the guest's reply. */
 export const GuestResponseSchema = z.object({
     id: IdSchema,

package/dist/shared/channel/secrets.d.ts

@@ -8,6 +8,7 @@ export declare const SecretsFileSchema: z.ZodObject<{
         username: z.ZodString;
         password: z.ZodString;
     }, z.core.$strict>>;
+    wireguardConfig: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type SecretsFile = z.output<typeof SecretsFileSchema>;
 interface WithHarnesses {

package/dist/shared/channel/secrets.js

@@ -19,6 +19,12 @@ export const SecretsFileSchema = z.strictObject({
         .optional(),
     /** VPN service credentials (vpn.provider's login), only for the launch's own sandbox. */
     vpn: z.strictObject({ username: z.string().min(1).max(256), password: z.string().min(1).max(1024) }).optional(),
+    /** The checked WireGuard config of vpn.provider wireguard-file (holds the private key). */
+    wireguardConfig: z
+        .string()
+        .min(1)
+        .max(32 * 1024)
+        .optional(),
 });
 /** The environment a harness gets: its own, then the values that travelled in the secrets file. */
 const withEnvironment = (harness, environment) => (environment ? { ...harness, environment: { ...harness.environment, ...environment } } : harness);

package/dist/shared/io/copy-tree.d.ts

@@ -0,0 +1,7 @@
+export interface CopyTreeResult {
+    readonly copied: number;
+    /** Files (or folders) that were gone by the time they were reached. */
+    readonly vanished: number;
+}
+/** Copies `from` into `to`; `skip(name)` leaves out files by name. Any error except "no such file" is thrown. */
+export declare function copyTreeTolerant(from: string, to: string, skip?: (name: string) => boolean): CopyTreeResult;

package/dist/shared/io/copy-tree.js

@@ -0,0 +1,45 @@
+// Copies a folder that something else is still writing to: a file that disappears between the listing and the copy
+// (a spool file the agent's hook just consumed, a SQLite journal that was committed) is skipped, not an error.
+import fs from 'node:fs';
+import path from 'node:path';
+const isGone = (e) => e?.code === 'ENOENT';
+/** Copies `from` into `to`; `skip(name)` leaves out files by name. Any error except "no such file" is thrown. */
+export function copyTreeTolerant(from, to, skip = () => false) {
+    let copied = 0;
+    let vanished = 0;
+    const walk = (src, dest) => {
+        fs.mkdirSync(dest, { recursive: true });
+        let entries;
+        try {
+            entries = fs.readdirSync(src, { withFileTypes: true });
+        }
+        catch (e) {
+            if (!isGone(e))
+                throw e;
+            vanished++;
+            return;
+        }
+        for (const entry of entries) {
+            if (skip(entry.name))
+                continue;
+            const source = path.join(src, entry.name);
+            const target = path.join(dest, entry.name);
+            try {
+                if (entry.isDirectory())
+                    walk(source, target);
+                else if (entry.isFile()) {
+                    fs.copyFileSync(source, target);
+                    copied++;
+                }
+            }
+            catch (e) {
+                if (!isGone(e))
+                    throw e;
+                vanished++;
+                fs.rmSync(target, { force: true });
+            }
+        }
+    };
+    walk(from, to);
+    return { copied, vanished };
+}

package/dist/shared/io/index.d.ts

@@ -1,3 +1,5 @@
 export * from './json.js';
 export * from './json-file.js';
 export * from './safe-remove.js';
+export * from './robocopy-result.js';
+export * from './copy-tree.js';

package/dist/shared/io/index.js

@@ -1,3 +1,5 @@
 export * from './json.js';
 export * from './json-file.js';
 export * from './safe-remove.js';
+export * from './robocopy-result.js';
+export * from './copy-tree.js';

package/dist/shared/io/robocopy-result.d.ts

@@ -0,0 +1,6 @@
+/** Exit code 8 and up means something could not be copied; below that every file is in place. */
+export declare function robocopyFailed(code: number | null): boolean;
+/** The exit code in plain words (it is a bit field: 1 copied, 2 extras, 4 mismatches, 8 failures, 16 fatal). */
+export declare function robocopyMeaning(code: number | null): string;
+/** The first few ERROR lines of robocopy's output (what went wrong and on which file), one line each. */
+export declare function robocopyErrors(output: string, max?: number): string[];

package/dist/shared/io/robocopy-result.js

@@ -0,0 +1,23 @@
+// Reading robocopy's exit code and output (pure; the guest and the tests share it).
+/** Exit code 8 and up means something could not be copied; below that every file is in place. */
+export function robocopyFailed(code) {
+    return code === null || code >= 8;
+}
+/** The exit code in plain words (it is a bit field: 1 copied, 2 extras, 4 mismatches, 8 failures, 16 fatal). */
+export function robocopyMeaning(code) {
+    if (code === null)
+        return 'robocopy did not finish';
+    if (code >= 16)
+        return 'robocopy stopped with a fatal error (bad path or no access)';
+    if (code >= 8)
+        return code & 1 ? 'some files were copied and some could not be' : 'files could not be copied';
+    return code === 0 ? 'nothing to copy' : 'copied';
+}
+/** The first few ERROR lines of robocopy's output (what went wrong and on which file), one line each. */
+export function robocopyErrors(output, max = 3) {
+    const lines = output
+        .split(/\r?\n/)
+        .map((l) => l.trim())
+        .filter((l) => /\bERROR\b/.test(l) || /^The (process|system) cannot/i.test(l));
+    return lines.slice(0, max).map((l) => (l.length > 220 ? l.slice(0, 217) + '...' : l));
+}

package/dist/shared/memory/index.d.ts

@@ -0,0 +1 @@
+export * from './policy.js';