windows-development-sandbox 1.7.0 → 1.9.0

package/dist/selftest/vpn.test.js

@@ -8,11 +8,12 @@ import { ConfigSchema, LocalOverridesSchema } from '../core/schema/index.js';
 import { SecretStore } from '../host/secrets/index.js';
 import { clearSecrets } from '../host/secrets/index.js';
 import { generateSandbox } from '../host/launch/index.js';
-import { findCountry, nordProfile, prepareVpn, recommendedServer, VpnLogin, vpnLine, vpnNotes, } from '../host/vpn/index.js';
+import { findCountry, nordProfile, prepareVpn, wireguardFileProblem, recommendedServer, VpnLogin, vpnLine, vpnNotes, } from '../host/vpn/index.js';
 import { RunDir } from '../shared/channel/index.js';
-import { OPENVPN_MSI } from '../shared/vpn/download.js';
+import { OPENVPN_MSI, WIREGUARD_MSI } from '../shared/vpn/download.js';
 import { cleanServers, killSwitchCommands, removeKillSwitchCommands, tunnelAddressFromLog, tunnelCommands, } from '../shared/vpn/kill-switch.js';
 import { assertSafeOvpn, inspectOvpn, PROGRAM_DIRECTIVES } from '../shared/vpn/ovpn.js';
+import { assertSafeWireguard, handshakeDone, inspectWireguard, renderWireguard, serviceRunning, WIREGUARD_PROGRAM_KEYS, wireguardEndpoints, wireguardTunnelAddress, } from '../shared/vpn/wireguard.js';
 const PROFILE = [
     'client',
     'dev tun',
@@ -51,6 +52,24 @@ const PROFILE = [
     '</tls-auth>',
     '',
 ].join('\r\n');
+const PRIVATE_KEY = 'PrivPlanted' + 'A'.repeat(32) + '=';
+const PUBLIC_KEY = 'PubPlanted' + 'B'.repeat(33) + '=';
+const PRESHARED_KEY = 'PskPlanted' + 'C'.repeat(33) + '=';
+const WG_CONFIG = [
+    '[Interface]',
+    'PrivateKey = ' + PRIVATE_KEY,
+    'Address = 10.64.0.2/32, fd00::2/128',
+    'DNS = 10.64.0.1',
+    'MTU = 1380',
+    '',
+    '[Peer] # the office',
+    'PublicKey = ' + PUBLIC_KEY,
+    'PresharedKey = ' + PRESHARED_KEY,
+    'AllowedIPs = 0.0.0.0/0, ::/0',
+    'Endpoint = vpn.example.com:51820',
+    'PersistentKeepalive = 25',
+    '',
+].join('\r\n');
 const PASSWORD = 'vpn-pass-planted-91c2d7';
 const USERNAME = 'vpn-user-planted-5e8a40';
 export const vpnSuite = {
@@ -206,7 +225,7 @@ export const vpnSuite = {
         });
         t.check(prepared !== null &&
             prepared.session.server === 'uk2201.nordvpn.com' &&
-            prepared.credentials.password === PASSWORD, 'a launch picks the server, checks its profile and holds the login in memory');
+            prepared.credentials?.password === PASSWORD, 'a launch picks the server, checks its profile and holds the login in memory');
         await t.throws(() => prepareVpn({
             config: run.config,
             storageRoot: config.storage.root,
@@ -275,5 +294,119 @@ export const vpnSuite = {
             killSwitch: true,
             updatedAt: 'n',
         }).text.includes('\u001b'), 'text the sandbox wrote loses its escape sequences before it is printed');
+        t.section('WireGuard: your own config is untrusted data');
+        const wg = inspectWireguard(WG_CONFIG);
+        t.check(wg.ok &&
+            wg.config.peers.length === 1 &&
+            wg.config.peers[0].endpointHost === 'vpn.example.com' &&
+            wg.config.peers[0].endpointPort === 51820 &&
+            wireguardTunnelAddress(wg.config) === '10.64.0.2' &&
+            wireguardEndpoints(wg.config)[0].port === 51820, 'a plain config is accepted and says where it connects and which address the tunnel has', JSON.stringify(wg));
+        for (const key of WIREGUARD_PROGRAM_KEYS) {
+            const bad = inspectWireguard(WG_CONFIG.replace('MTU = 1380', key + ' = calc.exe'));
+            t.check(!bad.ok && bad.problems.some((p) => p.toLowerCase().includes(key)), key + ' is refused by name', JSON.stringify(bad));
+        }
+        const wgOdd = [
+            ['FwMark = 7', 'an unknown [Interface] key is refused, not passed on'],
+            ['postup = calc', 'lower case does not hide PostUp'],
+            ['[Socks]', 'an unknown section is refused'],
+            ['DNS = evil.example.com', 'a DNS name (a search domain) is refused: only addresses'],
+            ['MTU = 99999', 'an MTU out of range is refused'],
+            ['PrivateKey = ' + PRIVATE_KEY, 'a second PrivateKey is refused'],
+        ];
+        for (const [line, why] of wgOdd) {
+            const text = line.startsWith('[') ? WG_CONFIG + line + '\r\n' : WG_CONFIG.replace('MTU = 1380', line);
+            t.check(!inspectWireguard(text).ok, why, line);
+        }
+        t.check(!inspectWireguard(WG_CONFIG.replace(PRIVATE_KEY, 'tooshort')).ok &&
+            !inspectWireguard(WG_CONFIG.replace('10.64.0.2/32, fd00::2/128', 'fd00::2/128')).ok &&
+            !inspectWireguard(WG_CONFIG.replace('vpn.example.com:51820', '[2001:db8::1]:51820')).ok &&
+            !inspectWireguard(WG_CONFIG.replace('Endpoint = vpn.example.com:51820', '')).ok &&
+            !inspectWireguard(WG_CONFIG.replace('vpn.example.com:51820', 'vpn.example.com:0')).ok &&
+            !inspectWireguard(WG_CONFIG.replace('[Peer] # the office', '')).ok &&
+            !inspectWireguard('x'.repeat(20 * 1024)).ok &&
+            !inspectWireguard(WG_CONFIG.replace('AllowedIPs = 0.0.0.0/0, ::/0', 'AllowedIPs = 300.0.0.0/0')).ok, 'a bad key, an IPv6-only address or endpoint, a missing endpoint or peer, a bad port, a huge file and a bad range are refused');
+        t.check(inspectWireguard(WG_CONFIG.replace('MTU = 1380', '# PostUp = calc\r\nMTU = 1380 # PreUp = calc')).ok, 'comments are comments (a commented-out PostUp is not a key)');
+        const refusals = [
+            WG_CONFIG.replace('MTU = 1380', 'PostUp = ' + PRIVATE_KEY),
+            WG_CONFIG.replace('MTU = 1380', 'Bogus = ' + PRESHARED_KEY),
+            WG_CONFIG.replace(PUBLIC_KEY, 'bad' + PRESHARED_KEY),
+            WG_CONFIG.replace(PRIVATE_KEY, PRIVATE_KEY + 'x'),
+        ].map(inspectWireguard);
+        t.check(refusals.every((r) => !r.ok && !JSON.stringify(r).includes('PrivPlanted') && !JSON.stringify(r).includes('PskPlanted')), 'what a refusal says never contains a key');
+        await t.throws(() => assertSafeWireguard(WG_CONFIG.replace('MTU = 1380', 'PostUp = calc'), 'office.conf'), 'office.conf was refused', 'a refused config names its file and the reason');
+        if (wg.ok) {
+            const text = renderWireguard(wg.config, { 0: '203.0.113.7' });
+            t.check(text.includes('Endpoint = 203.0.113.7:51820') &&
+                !text.includes('vpn.example.com') &&
+                !text.includes('the office') &&
+                inspectWireguard(text).ok, 'the config handed on is written again from the checked values, with the endpoint as an address, and is itself valid');
+        }
+        const wgRules = killSwitchCommands([{ ip: '203.0.113.7', port: 51820, proto: 'udp' }], null).map((c) => c.join(' '));
+        t.check(wgRules.some((c) => c.includes('name=AgentSandbox-VPN-Server-1') &&
+            c.includes('protocol=udp') &&
+            c.includes('remoteip=203.0.113.7') &&
+            c.includes('remoteport=51820')) && wgRules.findIndex((c) => c.includes('blockoutbound')) < wgRules.findIndex((c) => c.includes('action=allow')), 'the kill switch blocks first and lets only the endpoint host:port through, over udp');
+        t.check(tunnelCommands('10.64.0.2').some((c) => c.join(' ').includes('localip=10.64.0.2') && c[2] === 'add'), "the tunnel's own address (from Address) is let through once the service runs");
+        t.check(WIREGUARD_MSI.x64.sha256.length === 64 &&
+            WIREGUARD_MSI.arm64.sha256.length === 64 &&
+            WIREGUARD_MSI.base.startsWith('https://download.wireguard.com/') &&
+            serviceRunning('STATE              : 4  RUNNING') &&
+            !serviceRunning('STATE              : 1  STOPPED') &&
+            handshakeDone('abc=\t1700000000\r\n') &&
+            !handshakeDone('abc=\t0\r\n') &&
+            !handshakeDone(''), 'the WireGuard download is pinned by checksum; the service state and handshake are read from the tools output');
+        t.section('WireGuard: the keys never land in session.json or the launch folder');
+        const wgDir = t.dir('wg-config');
+        const wgFile = path.join(wgDir, 'office.conf');
+        fs.writeFileSync(wgFile, WG_CONFIG);
+        const wgSettings = f.makeConfig();
+        wgSettings.vpn = { ...wgSettings.vpn, enabled: true, provider: 'wireguard-file', configFile: wgFile };
+        const wgRun = await f.run({}, wgSettings);
+        const wgPrepared = await prepareVpn({
+            config: wgRun.config,
+            storageRoot: wgSettings.storage.root,
+            login: new VpnLogin(t.dir('wg-nologin'), SecretStore.memory()),
+        });
+        t.check(wgPrepared !== null &&
+            wgPrepared.session.server === 'office.conf' &&
+            wgPrepared.session.profile === undefined &&
+            wgPrepared.credentials === undefined &&
+            (wgPrepared.wireguardConfig ?? '').includes(PRIVATE_KEY), 'a launch needs no saved login; it holds the checked config (with the private key) in memory only');
+        fs.writeFileSync(wgFile, WG_CONFIG.replace('MTU = 1380', 'PostUp = calc.exe'));
+        await t.throws(() => prepareVpn({ config: wgRun.config, storageRoot: wgSettings.storage.root }), 'refused', 'a config with PostUp stops the launch before anything is written');
+        t.check(wireguardFileProblem(wgFile, wgDir)?.includes('refused') === true &&
+            wireguardFileProblem(path.join(wgDir, 'missing.conf'), wgDir) !== null &&
+            !(wireguardFileProblem(wgFile, wgDir) ?? '').includes('PrivPlanted'), 'doctor says a bad or missing config is a problem, without a key');
+        fs.writeFileSync(wgFile, WG_CONFIG);
+        t.check(wireguardFileProblem('office.conf', wgDir) === null, 'a good config, even by a relative path, is fine');
+        clearSecrets(wgSettings.storage.root, wgRun.dataPath);
+        const wgLaunch = generateSandbox({
+            packageRoot: t.packageRoot,
+            run: wgRun,
+            harnessArgs: [],
+            probe: f.probe,
+            pcLanguages: ['python', 'rust', 'cpp', 'dotnet'],
+            ...(wgPrepared ? { vpn: wgPrepared } : {}),
+        });
+        const wgSession = fs.readFileSync(wgLaunch.sessionPath, 'utf8');
+        const wgAll = [];
+        const wgWalk = (d) => {
+            for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+                const p = path.join(d, e.name);
+                if (e.isDirectory())
+                    wgWalk(p);
+                else
+                    wgAll.push(fs.readFileSync(p, 'latin1'));
+            }
+        };
+        wgWalk(wgLaunch.launchPath);
+        const hasKey = (text) => text.includes(PRIVATE_KEY) || text.includes(PRESHARED_KEY) || text.includes('PrivPlanted');
+        t.check(!hasKey(wgSession) && !wgAll.some(hasKey) && !fs.existsSync(path.join(wgLaunch.launchPath, 'vpn')), 'neither the private key nor the preshared key is in session.json or any file of the launch folder');
+        const wgHanded = f.readJson(new RunDir(wgRun.dataPath).secretFile(wgLaunch.launchId));
+        t.check((wgHanded.wireguardConfig ?? '').includes(PRIVATE_KEY) && wgHanded.vpn === undefined, 'the config is only in the one-shot file for the sandbox');
+        clearSecrets(wgSettings.storage.root, wgRun.dataPath);
+        t.check(!fs.existsSync(new RunDir(wgRun.dataPath).secretFile(wgLaunch.launchId)) &&
+            vpnNotes(wgSettings.vpn).some((n) => n.includes('WireGuard private key') && n.includes('turn the tunnel off')), 'the launch warns that the agent can read the key and turn the tunnel off');
     },
 };

package/dist/selftest/web.test.js

@@ -1,11 +1,13 @@
 // The web UI's server: login and cookie, the Host / Origin / CSRF checks, static files that cannot leave their folder,
-// sessions without tokens, and the terminal bridge against a fake ptyhost on loopback (the real address check is the
-// backend's, so the fake is only reachable here).
+// sessions without tokens, the terminal bridge against a fake ptyhost on loopback (the real address check is the
+// backend's, so the fake is only reachable here), and the RPC socket of the shared core against a fake RpcHost.
 import http from 'node:http';
 import net from 'node:net';
 import path from 'node:path';
 import WebSocket from 'ws';
+import { cancelled } from '../app/kernel/index.js';
 import { webSession } from '../cli/services/index.js';
+import { fail } from '../core/util/index.js';
 import { cookieValue, csrfOk, hostAllowed, originAllowed, sameSecret, StaticFiles, WebAuth, WebServer, WebStore, } from '../host/web/index.js';
 import { encodeFrame, FrameReader, FrameType } from '../shared/pty/index.js';
 import { CSRF_HEADER, CSRF_VALUE, parseClientMessage } from '../shared/web/index.js';
@@ -96,6 +98,35 @@ class Tab {
         this.socket.on('close', (code) => (this.closeCode = code));
     }
 }
+/** A stand-in for the shared core: one operation that reports, asks and may fail, and one live query. */
+function fakeRpc() {
+    const ran = [];
+    const live = { value: 1 };
+    const host = {
+        kind: (id) => (id === 'test.work' ? 'operation' : id === 'test.live' ? 'query' : undefined),
+        liveMs: (id) => (id === 'test.live' ? 50 : undefined),
+        run: async (id, input, io) => {
+            ran.push(id);
+            if (id === 'test.live')
+                return { value: live.value };
+            const how = (input ?? {});
+            io.progress('Working');
+            io.log('one line', 'muted');
+            if (!(await io.confirm({ title: 'Go on?' })))
+                cancelled();
+            if (how.fail)
+                fail('It broke.', 'Fix it like this.');
+            if (how.bug)
+                throw new Error('internal detail C:\\Users\\secret');
+            return { done: true };
+        },
+    };
+    return { host, ran, live };
+}
+/** The server's messages on an RPC socket, parsed. */
+function rpcMessages(tab) {
+    return tab.texts.map((text) => JSON.parse(text));
+}
 const session = (id, attach) => ({
     id,
     launchId: 'launch1',
@@ -202,7 +233,15 @@ export const webSuite = {
             },
         };
         let stopped = false;
-        const server = new WebServer({ port: 0, token: TOKEN, backend, staticRoot: root, onStop: () => (stopped = true) });
+        const rpc = fakeRpc();
+        const server = new WebServer({
+            port: 0,
+            token: TOKEN,
+            backend,
+            staticRoot: root,
+            rpc: rpc.host,
+            onStop: () => (stopped = true),
+        });
         await server.start();
         const { port } = server;
         const origin = 'http://127.0.0.1:' + port;
@@ -282,6 +321,65 @@ export const webSuite = {
             leaving.socket.close();
             await t.waitFor(() => fake.closed >= 3, 5000);
             t.check(fake.closed >= 3, 'closing the browser side closes the connection to the session');
+            t.section('the RPC socket');
+            const rpcUrl = 'ws://127.0.0.1:' + port + '/api/rpc';
+            const refusedRpc = [
+                new Tab(rpcUrl, { Cookie }),
+                new Tab(rpcUrl, { Origin: 'http://evil.example', Cookie }),
+                new Tab(rpcUrl, { Origin: origin }),
+            ];
+            await t.waitFor(() => refusedRpc.every((a) => a.failed), 5000);
+            t.check(refusedRpc.every((a) => !a.opened), 'the RPC socket needs the cookie and this page as its Origin, like the terminal');
+            const browser = new Tab(rpcUrl, { Origin: origin, Cookie });
+            await t.waitFor(() => browser.opened, 5000);
+            const reply = (id, kind) => rpcMessages(browser).find((m) => m.id === id && m.t === kind);
+            browser.socket.send(JSON.stringify({ t: 'call', id: 'c1', op: 'test.work', input: {} }));
+            await t.waitFor(() => reply('c1', 'ask'), 5000);
+            t.check(reply('c1', 'progress') !== undefined && reply('c1', 'log') !== undefined, 'a call streams its progress and log lines before it asks');
+            browser.socket.send(JSON.stringify({ t: 'answer', id: 'c1', value: true }));
+            await t.waitFor(() => reply('c1', 'result'), 5000);
+            t.equal(reply('c1', 'result'), { t: 'result', id: 'c1', output: { done: true } }, 'the answer lets it finish');
+            browser.socket.send(JSON.stringify({ t: 'call', id: 'c2', op: 'test.work', input: {} }));
+            await t.waitFor(() => reply('c2', 'ask'), 5000);
+            browser.socket.send(JSON.stringify({ t: 'answer', id: 'c2', value: 'yes please' }));
+            await t.waitFor(() => reply('c2', 'error'), 5000);
+            const declinedCall = reply('c2', 'error');
+            t.check(declinedCall?.t === 'error' && declinedCall.error.kind === 'cancelled', 'an answer of the wrong kind counts as no: nothing changes');
+            browser.socket.send(JSON.stringify({ t: 'call', id: 'c3', op: 'test.work', input: { fail: true } }));
+            browser.socket.send(JSON.stringify({ t: 'call', id: 'c4', op: 'test.work', input: { bug: true } }));
+            await t.waitFor(() => reply('c3', 'ask') && reply('c4', 'ask'), 5000);
+            browser.socket.send(JSON.stringify({ t: 'answer', id: 'c3', value: true }));
+            browser.socket.send(JSON.stringify({ t: 'answer', id: 'c4', value: true }));
+            await t.waitFor(() => reply('c3', 'error') && reply('c4', 'error'), 5000);
+            t.equal(reply('c3', 'error'), { t: 'error', id: 'c3', error: { kind: 'user', message: 'It broke.', fix: 'Fix it like this.' } }, 'a failure arrives as its message and fix');
+            t.equal(reply('c4', 'error'), { t: 'error', id: 'c4', error: { kind: 'bug', message: 'Something went wrong.' } }, "a bug's details stay on this PC");
+            const before = rpc.ran.length;
+            browser.socket.send(JSON.stringify({ t: 'call', id: 'c5', op: 'sandbox.notThere', input: {} }));
+            await t.waitFor(() => reply('c5', 'error'), 5000);
+            const unknown = reply('c5', 'error');
+            t.check(unknown?.t === 'error' && unknown.error.kind === 'invalid' && rpc.ran.length === before, 'an operation that is not allowed on the web is never run');
+            browser.socket.send(JSON.stringify({ t: 'subscribe', id: 's1', query: 'test.live', input: {} }));
+            await t.waitFor(() => reply('s1', 'data'), 5000);
+            rpc.live.value = 2;
+            await t.waitFor(() => rpcMessages(browser).filter((m) => m.id === 's1' && m.t === 'data').length === 2, 5000);
+            const updates = rpcMessages(browser).filter((m) => m.id === 's1' && m.t === 'data');
+            t.equal(updates.map((m) => (m.t === 'data' ? m.output : null)), [{ value: 1 }, { value: 2 }], 'a live query sends its result, then again only when it changed');
+            browser.socket.send(JSON.stringify({ t: 'unsubscribe', id: 's1' }));
+            await new Promise((resolve) => setTimeout(resolve, 200));
+            const reads = rpc.ran.filter((id) => id === 'test.live').length;
+            await new Promise((resolve) => setTimeout(resolve, 200));
+            t.equal(rpc.ran.filter((id) => id === 'test.live').length, reads, 'unsubscribing stops the reads');
+            browser.socket.send(JSON.stringify({ t: 'call', id: 'bad id!', op: 'test.work', input: {} }));
+            await t.waitFor(() => browser.closeCode !== null, 5000);
+            t.equal(browser.closeCode, 1008, 'a message that does not fit the schema closes the socket');
+            const leaver = new Tab(rpcUrl, { Origin: origin, Cookie });
+            await t.waitFor(() => leaver.opened, 5000);
+            const runs = rpc.ran.length;
+            leaver.socket.send(JSON.stringify({ t: 'call', id: 'c1', op: 'test.work', input: {} }));
+            await t.waitFor(() => leaver.texts.some((m) => m.includes('"ask"')), 5000);
+            leaver.socket.close();
+            await t.waitFor(() => leaver.closeCode !== null, 5000);
+            t.check(rpc.ran.length === runs + 1, 'a browser that leaves mid-question answers no (the call ends)');
             t.section('stopping');
             t.equal((await send(port, 'POST', '/api/stop', { ...json, Cookie }, '{}')).status, 403, 'stop needs CSRF and Origin too');
             t.equal((await send(port, 'POST', '/api/stop', { ...ajax, Cookie }, '{}')).status, 200, 'a signed-in browser can stop it');

package/dist/shared/channel/run-dir.d.ts

@@ -1,4 +1,4 @@
-import type { GuestRequest, GuestResponse, ProjectStatus, SandboxStatus, SessionStatus, VpnStatus } from './schema.js';
+import type { GuestRequest, GuestResponse, PressureStatus, ProjectStatus, SandboxStatus, SessionStatus, VpnStatus } from './schema.js';
 /** Ids become file names, so only a strict alphabet is allowed (no separators, no dots). */
 export declare function safeId(id: string): string;
 export declare function now(): string;
@@ -7,6 +7,8 @@ export declare class RunDir {
     readonly root: string;
     readonly sandboxFile: string;
     readonly vpnFile: string;
+    /** What the memory governor in the sandbox is doing (pressure.json). */
+    readonly pressureFile: string;
     readonly requestsDir: string;
     readonly responsesDir: string;
     readonly sessionsDir: string;
@@ -23,6 +25,7 @@ export declare class RunDir {
     secretFile(id: string): string;
     readSandboxStatus(): SandboxStatus | null;
     readVpnStatus(): VpnStatus | null;
+    readPressure(): PressureStatus | null;
     readSession(id: string): SessionStatus | null;
     readResponse(id: string): GuestResponse | null;
     listSessions(): SessionStatus[];

package/dist/shared/channel/run-dir.js

@@ -3,7 +3,7 @@
 // written atomically and parsed with the channel schemas on read. Anything that does not parse is ignored.
 import fs from 'node:fs';
 import path from 'node:path';
-import { GuestRequestSchema, GuestResponseSchema, IdSchema, ProjectStatusSchema, SandboxStatusSchema, SessionStatusSchema, VpnStatusSchema, } from './schema.js';
+import { GuestRequestSchema, GuestResponseSchema, IdSchema, PressureStatusSchema, ProjectStatusSchema, SandboxStatusSchema, SessionStatusSchema, VpnStatusSchema, } from './schema.js';
 import { readValid } from '../io/index.js';
 /** Ids become file names, so only a strict alphabet is allowed (no separators, no dots). */
 export function safeId(id) {
@@ -34,6 +34,8 @@ export class RunDir {
     root;
     sandboxFile;
     vpnFile;
+    /** What the memory governor in the sandbox is doing (pressure.json). */
+    pressureFile;
     requestsDir;
     responsesDir;
     sessionsDir;
@@ -46,6 +48,7 @@ export class RunDir {
         this.root = path.join(dataDir, 'run');
         this.sandboxFile = path.join(this.root, 'sandbox.json');
         this.vpnFile = path.join(this.root, 'vpn.json');
+        this.pressureFile = path.join(this.root, 'pressure.json');
         this.requestsDir = path.join(this.root, 'requests');
         this.responsesDir = path.join(this.root, 'responses');
         this.sessionsDir = path.join(this.root, 'sessions');
@@ -74,6 +77,9 @@ export class RunDir {
     readVpnStatus() {
         return readValid(VpnStatusSchema, this.vpnFile);
     }
+    readPressure() {
+        return readValid(PressureStatusSchema, this.pressureFile);
+    }
     readSession(id) {
         return readValid(SessionStatusSchema, this.sessionFile(id));
     }

package/dist/shared/channel/schema.d.ts

@@ -194,6 +194,7 @@ export declare const ProjectSpecSchema: z.ZodObject<{
             hostDir: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
         localState: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        bootReset: z.ZodOptional<z.ZodArray<z.ZodString>>;
         resumeArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
         resumeOneArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
@@ -351,6 +352,7 @@ export declare const GuestRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 hostDir: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
             localState: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            bootReset: z.ZodOptional<z.ZodArray<z.ZodString>>;
             resumeArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
             resumeOneArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
@@ -372,6 +374,7 @@ export declare const GuestRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             hostDir: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
         localState: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        bootReset: z.ZodOptional<z.ZodArray<z.ZodString>>;
         resumeArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
         resumeOneArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
@@ -524,6 +527,7 @@ export declare const GuestRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 hostDir: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
             localState: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            bootReset: z.ZodOptional<z.ZodArray<z.ZodString>>;
             resumeArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
             resumeOneArguments: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
@@ -547,7 +551,37 @@ export declare const GuestRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"ping">;
     id: z.ZodString;
     createdAt: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"pressure">;
+    id: z.ZodString;
+    reason: z.ZodString;
+    seconds: z.ZodNumber;
+    createdAt: z.ZodString;
 }, z.core.$strict>], "kind">;
+/** C:\AgentData\run\pressure.json: what the memory governor in the sandbox is doing (guest-written, capped). */
+export declare const PressureStatusSchema: z.ZodObject<{
+    level: z.ZodEnum<{
+        ok: "ok";
+        throttled: "throttled";
+        suspending: "suspending";
+    }>;
+    profile: z.ZodEnum<{
+        normal: "normal";
+        gentle: "gentle";
+    }>;
+    ramFreePercent: z.ZodNumber;
+    commitPercent: z.ZodNumber;
+    lowered: z.ZodNumber;
+    paused: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        pid: z.ZodNumber;
+        seconds: z.ZodNumber;
+    }, z.core.$strip>>;
+    pcLow: z.ZodBoolean;
+    lastAction: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strip>;
+export type PressureStatus = z.output<typeof PressureStatusSchema>;
 /** C:\AgentData\run\responses\<id>.json: the guest's reply. */
 export declare const GuestResponseSchema: z.ZodObject<{
     id: z.ZodString;
@@ -604,9 +638,9 @@ export declare const ProjectStatusSchema: z.ZodObject<{
 /** The guest writes run/vpn.json: whether the VPN tunnel is up (validated and capped on the host). */
 export declare const VpnStatusSchema: z.ZodObject<{
     state: z.ZodEnum<{
+        off: "off";
         failed: "failed";
         starting: "starting";
-        off: "off";
         up: "up";
     }>;
     message: z.ZodString;

package/dist/shared/channel/schema.js

@@ -91,7 +91,34 @@ export const GuestRequestSchema = z.discriminatedUnion('kind', [
         createdAt: TimeSchema,
     }),
     z.strictObject({ kind: z.literal('ping'), id: IdSchema, createdAt: TimeSchema }),
+    /**
+     * The PC's own memory or CPU is running low (the host watchdog): the sandbox slows its heaviest builds down for
+     * `seconds` (it never stops them) so Windows does not have to close it. Repeated while the PC stays low.
+     */
+    z.strictObject({
+        kind: z.literal('pressure'),
+        id: IdSchema,
+        reason: Text(300),
+        seconds: z.number().int().min(10).max(300),
+        createdAt: TimeSchema,
+    }),
 ]);
+/** C:\AgentData\run\pressure.json: what the memory governor in the sandbox is doing (guest-written, capped). */
+export const PressureStatusSchema = z.object({
+    level: z.enum(['ok', 'throttled', 'suspending']),
+    profile: z.enum(['normal', 'gentle']),
+    /** Share of the sandbox's RAM still free and of its commit limit in use (percent). */
+    ramFreePercent: z.number().int().min(0).max(100),
+    commitPercent: z.number().int().min(0).max(100),
+    /** Programs running at lower priority because of it. */
+    lowered: z.number().int().min(0).max(1024),
+    /** Programs paused right now (name, process id, seconds left). */
+    paused: z.array(z.object({ name: Text(64), pid: z.number().int(), seconds: z.number().int().min(0).max(60) })).max(8),
+    /** The PC itself asked for slowing down (its memory or CPU is low). */
+    pcLow: z.boolean(),
+    lastAction: Text(300),
+    updatedAt: TimeSchema,
+});
 /** C:\AgentData\run\responses\<id>.json: the guest's reply. */
 export const GuestResponseSchema = z.object({
     id: IdSchema,

package/dist/shared/channel/secrets.d.ts

@@ -8,6 +8,7 @@ export declare const SecretsFileSchema: z.ZodObject<{
         username: z.ZodString;
         password: z.ZodString;
     }, z.core.$strict>>;
+    wireguardConfig: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type SecretsFile = z.output<typeof SecretsFileSchema>;
 interface WithHarnesses {

package/dist/shared/channel/secrets.js

@@ -19,6 +19,12 @@ export const SecretsFileSchema = z.strictObject({
         .optional(),
     /** VPN service credentials (vpn.provider's login), only for the launch's own sandbox. */
     vpn: z.strictObject({ username: z.string().min(1).max(256), password: z.string().min(1).max(1024) }).optional(),
+    /** The checked WireGuard config of vpn.provider wireguard-file (holds the private key). */
+    wireguardConfig: z
+        .string()
+        .min(1)
+        .max(32 * 1024)
+        .optional(),
 });
 /** The environment a harness gets: its own, then the values that travelled in the secrets file. */
 const withEnvironment = (harness, environment) => (environment ? { ...harness, environment: { ...harness.environment, ...environment } } : harness);

package/dist/shared/memory/index.d.ts

@@ -0,0 +1 @@
+export * from './policy.js';

package/dist/shared/memory/index.js

@@ -0,0 +1 @@
+export * from './policy.js';

package/dist/shared/memory/policy.d.ts

@@ -0,0 +1,33 @@
+export type LoadProfile = 'normal' | 'gentle';
+/** The guest governor: when memory inside the sandbox counts as under pressure, and when it has recovered. */
+export interface GuestThresholds {
+    /** Pressure starts when available RAM is below this share of the sandbox's RAM (percent)... */
+    readonly enterAvailablePercent: number;
+    /** ...or commit is above this share of its limit. */
+    readonly enterCommitPercent: number;
+    /** Pressure ends only when available RAM is above this and commit is below the next, for `calmSamples` in a row. */
+    readonly exitAvailablePercent: number;
+    readonly exitCommitPercent: number;
+    readonly calmSamples: number;
+}
+export declare const GUEST_THRESHOLDS: Readonly<Record<LoadProfile, GuestThresholds>>;
+/** The PC watchdog: when this PC itself is low. */
+export interface HostThresholds {
+    /** Low when available RAM is below max(this, availableShare of total RAM)... */
+    readonly availableMinMb: number;
+    readonly availablePercent: number;
+    /** ...or available commit is below this share of the commit limit (percent)... */
+    readonly commitAvailablePercent: number;
+    /** ...or below half the reserveHostMb. Recovered above 1.25 times each limit for `calmSamples` samples. */
+    readonly calmSamples: number;
+    /** Total CPU above this (percent) for cpuSeconds. */
+    readonly cpuPercent: number;
+    readonly cpuSeconds: number;
+}
+export declare const HOST_THRESHOLDS: Readonly<Record<LoadProfile, HostThresholds>>;
+/** The CPU cap (percent of the PC) the gentle profile uses: 15 points lower, never below 50. "none" = 100. */
+export declare function gentleCpuLimit(cpuLimit: 'none' | number): number;
+/** The CPU cap the sandbox runs with (percent; null = none) for a profile. */
+export declare function effectiveCpuLimit(cpuLimit: 'none' | number, profile: LoadProfile): number | null;
+/** Cargo jobs that fit the memory (about 4 GB per rustc) and the CPUs, fewer when several agent sessions build. */
+export declare function cargoJobs(cpus: number, memoryGb: number, sessions: number): number;

package/dist/shared/memory/policy.js

@@ -0,0 +1,55 @@
+// What "heavy load" means, decided once for the host watchdog and the guest governor (pure, no I/O). Every
+// protection is on by default; the gentle profile (vGPU on: a graphics driver hang can freeze the whole PC) triggers
+// earlier and runs the sandbox with less CPU.
+export const GUEST_THRESHOLDS = {
+    normal: {
+        enterAvailablePercent: 8,
+        enterCommitPercent: 92,
+        exitAvailablePercent: 12,
+        exitCommitPercent: 88,
+        calmSamples: 3,
+    },
+    gentle: {
+        enterAvailablePercent: 15,
+        enterCommitPercent: 85,
+        exitAvailablePercent: 20,
+        exitCommitPercent: 80,
+        calmSamples: 3,
+    },
+};
+export const HOST_THRESHOLDS = {
+    normal: {
+        availableMinMb: 4096,
+        availablePercent: 12,
+        commitAvailablePercent: 15,
+        calmSamples: 3,
+        cpuPercent: 95,
+        cpuSeconds: 60,
+    },
+    gentle: {
+        availableMinMb: 6144,
+        availablePercent: 15,
+        commitAvailablePercent: 20,
+        calmSamples: 3,
+        cpuPercent: 90,
+        cpuSeconds: 45,
+    },
+};
+/** The CPU cap (percent of the PC) the gentle profile uses: 15 points lower, never below 50. "none" = 100. */
+export function gentleCpuLimit(cpuLimit) {
+    return Math.max(50, (cpuLimit === 'none' ? 100 : cpuLimit) - 15);
+}
+/** The CPU cap the sandbox runs with (percent; null = none) for a profile. */
+export function effectiveCpuLimit(cpuLimit, profile) {
+    if (profile === 'gentle')
+        return Math.min(gentleCpuLimit(cpuLimit), cpuLimit === 'none' ? 100 : cpuLimit);
+    return cpuLimit === 'none' ? null : cpuLimit;
+}
+/** Cargo jobs that fit the memory (about 4 GB per rustc) and the CPUs, fewer when several agent sessions build. */
+export function cargoJobs(cpus, memoryGb, sessions) {
+    const byCpu = Math.max(2, Math.min(4, Math.floor(cpus / 4)));
+    const byMemory = Math.max(1, Math.floor(memoryGb / 4));
+    const jobs = Math.min(byCpu, byMemory);
+    // All the agents' builds share the sandbox: about 8 jobs in total however many sessions there are.
+    return Math.max(1, Math.min(jobs, Math.floor(8 / Math.max(1, sessions))));
+}

package/dist/shared/pty/output-filter.d.ts

@@ -1,10 +1,19 @@
+export interface OutputFilterOptions {
+    /**
+     * Let clipboard writes (OSC 52) through: the agent's "copy" reaches your clipboard. Only where the sandbox can reach
+     * that clipboard anyway (its own terminal, or sandbox.clipboard on). Clipboard reads are always dropped.
+     */
+    readonly clipboardWrites?: boolean;
+}
 /**
  * Removes the terminal "strings" an untrusted program could abuse from the sandbox's output before it reaches your
- * terminal: clipboard writes (OSC 52), terminal macros (ConEmu's OSC 9), DCS / APC / PM / SOS, and their C1 forms.
+ * terminal: clipboard writes (OSC 52, unless clipboardWrites) and reads, terminal macros (ConEmu's OSC 9), DCS / APC /
+ * PM / SOS, and their C1 forms.
  * Titles, links, progress and colours pass. A byte-level state machine, so no split across chunks, leading zero
  * (ESC]052) or huge payload slips through: a dropped string stays dropped until its terminator, however long it is.
  */
 export declare class OutputFilter {
+    private readonly options;
     /**
      * text: normal output; esc: after ESC; c2: after a 0xC2 lead byte; string: inside an OSC/DCS/...; stringEsc /
      * stringC2: a possible terminator inside one.
@@ -12,5 +21,9 @@ export declare class OutputFilter {
     private state;
     /** The string being read: an OSC worth keeping is collected until its terminator; null = being dropped. */
     private body;
+    private readonly maxString;
+    constructor(options?: OutputFilterOptions);
+    /** An OSC that may pass: a short title, link, progress or mark, or (when allowed) a clipboard write. */
+    private kept;
     push(chunk: Buffer): Buffer;
 }