windows-development-sandbox 1.7.0 → 1.10.0

package/native/scripts/mount-contained.ps1

@@ -0,0 +1,139 @@
+#Requires -Version 5.1
+# Mounts the contained-storage disk image of one data set at its mount folder (no drive letter), creating and
+# formatting the image the very first time. Run elevated (host/storage/contained starts it through run-elevated.ps1,
+# one Windows permission prompt). The request is a JSON file: { set, storageRoot, image, mount, userSid, maxGb, create }.
+# Safety, all checked again here: the image is <storage>\images\<set>.vhdx and the mount folder <storage>\mounts\<set>;
+# no folder on the way is a link; both are yours; the image has no parent file and is not bigger than the limit; an
+# existing image is only attached (never formatted, never deleted), and a new one is only made where no file is.
+# Every diskpart command names this one image. -DryRun checks everything and prints the diskpart lines it would run
+# (and does nothing else); the result of a real run goes to result.json next to the request file.
+param(
+    [Parameter(Mandatory = $true)][string]$Json,
+    [string]$Sha256 = '',
+    [switch]$DryRun
+)
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'contained-common.ps1')
+
+$result = @{ ok = $false; message = ''; action = 'mount'; created = $false; alreadyMounted = $false }
+
+function Invoke-Mount($Req, [bool]$Dry, [string]$TempDir) {
+    foreach ($name in @('maxGb', 'create')) {
+        if (-not ($Req.PSObject.Properties.Name -contains $name)) { throw "The request has no $name." }
+    }
+    if ($Req.maxGb -lt 8 -or $Req.maxGb -gt 4096) { throw 'The size limit must be between 8 and 4096 GB.' }
+    $create = [bool]$Req.create
+    Assert-NoLinksOnTheWay $Req $true
+    $root = $Req.storageRoot.TrimEnd('\')
+    $mountIsLink = Test-ReparsePoint $Req.mount
+    Assert-OwnedByUser $Req @($root, (Join-Path $root 'images'), (Join-Path $root 'mounts'))
+    # A mounted folder shows the image's own root, whose owner is not ours to judge; a plain folder is.
+    if (-not $mountIsLink) { Assert-OwnedByUser $Req @($Req.mount) }
+    $exists = Test-Path -LiteralPath $Req.image -PathType Leaf
+    if ($create -and $exists) { throw "An image exists already; refusing to create over it: $($Req.image)" }
+    if ((-not $create) -and (-not $exists)) { throw "The image is missing: $($Req.image)" }
+    $image = $Req.image
+    $mount = $Req.mount.TrimEnd('\')
+
+    if ($exists) {
+        Assert-OwnedByUser $Req @($image)
+        $state = Get-ImageState $image $Dry
+        if ($state.Attached) {
+            if ((Test-MountedAt $state $mount) -and $mountIsLink) {
+                $script:result.ok = $true
+                $script:result.alreadyMounted = $true
+                $script:result.message = 'The image is mounted already.'
+                Add-Note 'already mounted at the mount folder'
+                return
+            }
+            throw 'The image is attached somewhere else (Disk Management or another tool). Detach it there first.'
+        }
+        # Not attached, so its header can be read.
+        [void](Assert-PlainImage $Req $Dry)
+    }
+    if ($mountIsLink) { throw "The mount folder is a mount point already: $mount" }
+    if (@(Get-ChildItem -LiteralPath $mount -Force).Count -ne 0) { throw "The mount folder is not empty: $mount" }
+    $format = (New-Object IO.DriveInfo ([IO.Path]::GetPathRoot($mount))).DriveFormat
+    if ($format -ne 'NTFS') { throw "The mount folder must be on an NTFS drive (this one is $format): $mount" }
+
+    if ($exists) {
+        # Attach and mount the first partition of this image; nothing is created and nothing is formatted.
+        $lines = @(
+            "select vdisk file=""$image""",
+            'attach vdisk',
+            'select partition 1',
+            "assign mount=""$mount"""
+        )
+    } else {
+        if (-not $Dry) {
+            $drive = New-Object IO.DriveInfo ([IO.Path]::GetPathRoot($image))
+            if ($drive.AvailableFreeSpace -lt 1GB) { throw 'There is less than 1 GB free where the image would be made.' }
+        }
+        $megabytes = [int]$Req.maxGb * 1024
+        $lines = @(
+            "create vdisk file=""$image"" maximum=$megabytes type=expandable",
+            "select vdisk file=""$image""",
+            'attach vdisk',
+            'create partition primary',
+            'format fs=ntfs quick label=AgentData',
+            "assign mount=""$mount"""
+        )
+    }
+    try {
+        [void](Invoke-DiskPart $lines $TempDir $Dry)
+        if (-not $Dry) {
+            $after = Get-ImageState $image $false
+            if (-not $after.Attached -or -not (Test-MountedAt $after $mount)) { throw 'The image is attached but not mounted at the mount folder.' }
+            if (-not (Test-ReparsePoint $mount)) { throw 'The mount folder is not a mount point after mounting.' }
+            if (-not $exists) {
+                # The new volume's root is open to Users by default: only you and the system may use it.
+                $acl = New-Object Security.AccessControl.DirectorySecurity
+                $acl.SetAccessRuleProtection($true, $false)
+                $inherit = [Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+                foreach ($sid in @($Req.userSid, 'S-1-5-18')) {
+                    $who = New-Object Security.Principal.SecurityIdentifier($sid)
+                    $acl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($who, 'FullControl', $inherit, 'None', 'Allow')))
+                }
+                Set-Acl -LiteralPath $mount -AclObject $acl
+            }
+        }
+        $script:result.ok = $true
+        $script:result.created = (-not $exists)
+        $script:result.message = if ($exists) { 'The image was mounted.' } else { 'The image was created and mounted.' }
+    } catch {
+        $problem = $_.Exception.Message
+        if (-not $Dry) {
+            # Leave the PC as it was: detach this image (only this one); a half-made new image is renamed, never deleted.
+            $now = $null
+            try { $now = Get-ImageState $image $false } catch { $now = $null }
+            if ((Test-Path -LiteralPath $image) -and ((-not $now) -or $now.Attached)) {
+                try { [void](Invoke-DiskPart @("select vdisk file=""$image""", 'detach vdisk') $TempDir $false) } catch { $problem += ' (it could not be detached again: ' + $_.Exception.Message + ')' }
+            }
+            if ((-not $exists) -and (Test-Path -LiteralPath $image)) {
+                $kept = $image + '.failed-' + (Get-Date -Format 'yyyyMMddHHmmss')
+                try { Rename-Item -LiteralPath $image -NewName (Split-Path -Leaf $kept); $problem += " (the unfinished image was kept as $kept)" } catch { $problem += ' (the unfinished image is still at ' + $image + ')' }
+            }
+        }
+        throw $problem
+    }
+}
+
+$mutex = $null
+try {
+    $request = Read-ContainedRequest -JsonPath $Json -Sha256 $Sha256 -Dry $DryRun.IsPresent
+    Assert-ContainedRequest $request
+    if (-not $DryRun) {
+        if (-not (Test-IsAdministrator)) { throw 'Mounting a disk image needs administrator rights.' }
+        $mutex = Enter-ContainedLock
+    }
+    Invoke-Mount $request $DryRun.IsPresent (Split-Path -Parent $Json)
+} catch {
+    $result.ok = $false
+    $result.message = $_.Exception.Message
+} finally {
+    if ($mutex) { $mutex.ReleaseMutex(); $mutex.Dispose() }
+}
+Write-ContainedResult $result $Json $DryRun.IsPresent
+if ($result.ok) { exit 0 }
+if ($DryRun) { [Console]::Error.WriteLine($result.message) }
+exit 1

package/native/scripts/run-elevated.ps1

@@ -1,11 +1,24 @@
 #Requires -Version 5.1
-# Runs one fixed PowerShell command in an elevated PowerShell (Windows asks for permission) and waits for it. Used by
-# `sandbox setup` to turn on the Windows Sandbox feature. Exits with the command's exit code, or 1 when declined.
-param([Parameter(Mandatory = $true)][string]$Command)
+# Runs one fixed PowerShell command, or one script of this package, in an elevated PowerShell (Windows asks for
+# permission) and waits for it. -Command is used by `sandbox setup` to turn on the Windows Sandbox feature. -Script is
+# used for contained storage: the script (a file of this package) gets -Json <request file> -Sha256 <its checksum>.
+# Exits with the exit code of what it ran, or 1 when the permission was declined.
+[CmdletBinding(DefaultParameterSetName = 'Command')]
+param(
+    [Parameter(Mandatory = $true, ParameterSetName = 'Command')][string]$Command,
+    [Parameter(Mandatory = $true, ParameterSetName = 'Script')][string]$Script,
+    [Parameter(Mandatory = $true, ParameterSetName = 'Script')][string]$Json,
+    [Parameter(Mandatory = $true, ParameterSetName = 'Script')][string]$Sha256
+)
 $ErrorActionPreference = 'Stop'
 try {
     $exe = Join-Path $PSHOME 'powershell.exe'
-    $p = Start-Process -FilePath $exe -Verb RunAs -Wait -PassThru -WindowStyle Hidden -ArgumentList '-NoProfile', '-Command', $Command
+    if ($PSCmdlet.ParameterSetName -eq 'Script') {
+        $arguments = @('-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', ('"' + $Script + '"'), '-Json', ('"' + $Json + '"'), '-Sha256', $Sha256)
+    } else {
+        $arguments = @('-NoProfile', '-Command', $Command)
+    }
+    $p = Start-Process -FilePath $exe -Verb RunAs -Wait -PassThru -WindowStyle Hidden -ArgumentList $arguments
     exit $p.ExitCode
 } catch {
     exit 1

package/native/scripts/stop-events.ps1

@@ -7,28 +7,43 @@ $ErrorActionPreference = 'Stop'
 $filters = @(
     @{ LogName = 'System'; Id = 1074, 6008, 41, 42, 2004; StartTime = $Since },
     @{ LogName = 'System'; Id = 1001; ProviderName = 'Microsoft-Windows-WER-SystemErrorReporting'; StartTime = $Since },
-    @{ LogName = 'Microsoft-Windows-Hyper-V-Worker-Admin'; Id = 18590, 40001; StartTime = $Since }
+    @{ LogName = 'Microsoft-Windows-Hyper-V-Worker-Admin'; Id = 18590, 40001; StartTime = $Since },
+    # Hardware errors Windows reported (WHEA: CPU, memory, bus, disk).
+    @{ LogName = 'System'; ProviderName = 'Microsoft-Windows-WHEA-Logger'; Id = 17, 18, 19, 47; StartTime = $Since },
+    # Any error or critical event of the Hyper-V worker and compute services (the VM's memory, start and stop).
+    @{ LogName = 'Microsoft-Windows-Hyper-V-Worker-Admin'; Level = 1, 2; StartTime = $Since },
+    @{ LogName = 'Microsoft-Windows-Hyper-V-Compute-Admin'; Level = 1, 2; StartTime = $Since },
+    # A crash report of the programs that hold the VM (kept only when it names one of them).
+    @{ LogName = 'Application'; Id = 1000, 1001; StartTime = $Since; OnlyVmPrograms = $true }
 )
 $maxMessage = 390
+$maxResourceMessage = 1500
 
 # What each event says beyond its id: the program that asked for a restart (1074), else the start of the message.
 function Get-EventDetail($record) {
     if ($record.Id -eq 1074) { return [string]$record.Properties[0].Value }
-    if ($record.Id -in 18590, 40001, 1001) {
-        $message = [string]$record.Message
-        return $message.Substring(0, [math]::Min($maxMessage, $message.Length))
-    }
-    return ''
+    # The plain power events say nothing more; the resource-exhaustion event (2004) lists the biggest memory users.
+    # Kernel-Power 41 carries the stop code of a blue screen (0 when there was none: a freeze or power loss).
+    if ($record.Id -eq 41) { return 'BugcheckCode ' + [string]$record.Properties[0].Value }
+    if ($record.Id -in 42, 6008) { return '' }
+    $message = [string]$record.Message
+    $max = if ($record.Id -eq 2004) { $maxResourceMessage } else { $maxMessage }
+    return $message.Substring(0, [math]::Min($max, $message.Length))
 }
 
 $events = foreach ($filter in $filters) {
     try {
-        Get-WinEvent -FilterHashtable $filter -MaxEvents 100 | ForEach-Object {
+        $onlyVm = $filter.ContainsKey('OnlyVmPrograms')
+        $query = @{} + $filter
+        $query.Remove('OnlyVmPrograms')
+        Get-WinEvent -FilterHashtable $query -MaxEvents 100 | ForEach-Object {
+            $detail = Get-EventDetail $_
+            if ($onlyVm -and $detail -notmatch 'vmwp\.exe|vmmem|vmcompute|windowssandbox') { return }
             [pscustomobject]@{
                 at       = $_.TimeCreated.ToUniversalTime().ToString('o')
                 id       = $_.Id
                 provider = $_.ProviderName
-                process  = Get-EventDetail $_
+                process  = $detail
             }
         }
     } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "windows-development-sandbox",
-  "version": "1.7.0",
+  "version": "1.10.0",
   "description": "A disposable Windows Sandbox for development, with or without an AI agent (Claude Code, Codex, Gemini, opencode, ...): the folder you run it from is the workspace, toolchains and databases for your project install themselves, and nothing else on your PC is reachable.",
   "type": "module",
   "license": "MIT",
@@ -93,6 +93,13 @@
   ],
   "devDependencies": {
     "@eslint/js": "^9.39.5",
+    "@mantine/core": "^7.17.8",
+    "@mantine/form": "^7.17.8",
+    "@mantine/hooks": "^7.17.8",
+    "@mantine/modals": "^7.17.8",
+    "@mantine/notifications": "^7.17.8",
+    "@tabler/icons-react": "^3.49.0",
+    "@tanstack/react-query": "^5.104.3",
     "@types/lodash": "^4.17.26",
     "@types/node": "^22.0.0",
     "@types/react": "^18.3.31",
@@ -100,9 +107,9 @@
     "@types/ws": "^8.18.2",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
-    "bootstrap": "^5.3.8",
     "esbuild": "^0.28.2",
     "eslint": "^9.39.5",
+    "mantine-form-zod-resolver": "^1.3.0",
     "prettier": "^3.9.10",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",