windows-development-sandbox 1.7.0 → 1.9.0

package/native/csharp/HostTools/MemoryStatus.cs

@@ -0,0 +1,107 @@
+// This PC's memory right now (HostTools memory-status): physical RAM and the commit limit (RAM plus paging files) with
+// what is left of each. The commit limit is what a sandbox's memory is charged against, so it matters as much as RAM.
+// C# 5.
+using System;
+using System.ComponentModel;
+using System.Globalization;
+using System.Runtime.InteropServices;
+using Microsoft.Win32;
+
+namespace AgentSandbox
+{
+    public static class HostMemory
+    {
+        private const double BytesPerMb = 1024.0 * 1024.0;
+
+        // MEMORYSTATUSEX.
+        [StructLayout(LayoutKind.Sequential)]
+        private struct MemoryStatus
+        {
+            public uint Length;
+            public uint MemoryLoad;
+            public ulong TotalPhys;
+            public ulong AvailPhys;
+            public ulong TotalPageFile;
+            public ulong AvailPageFile;
+            public ulong TotalVirtual;
+            public ulong AvailVirtual;
+            public ulong AvailExtendedVirtual;
+        }
+
+        private static class NativeMethods
+        {
+            [DllImport("kernel32.dll", SetLastError = true)]
+            public static extern bool GlobalMemoryStatusEx(ref MemoryStatus status);
+        }
+
+        /// <summary>{"totalMb":..,"availableMb":..,"commitLimitMb":..,"commitAvailableMb":..}; throws Win32Exception on failure.</summary>
+        public static string Json()
+        {
+            MemoryStatus status = new MemoryStatus();
+            status.Length = (uint)Marshal.SizeOf(typeof(MemoryStatus));
+            if (!NativeMethods.GlobalMemoryStatusEx(ref status))
+            {
+                throw new Win32Exception(Marshal.GetLastWin32Error());
+            }
+            return "{\"totalMb\":" + Mb(status.TotalPhys) +
+                ",\"availableMb\":" + Mb(status.AvailPhys) +
+                ",\"commitLimitMb\":" + Mb(status.TotalPageFile) +
+                ",\"commitAvailableMb\":" + Mb(status.AvailPageFile) +
+                "," + PageFileJson() + "}";
+        }
+
+        /// <summary>
+        /// How this PC's paging file is set up, from the registry (read-only): "auto" (Windows manages it), "fixed"
+        /// (with the total of the maximum sizes) or "none". An unreadable setting is reported as "auto".
+        /// </summary>
+        private static string PageFileJson()
+        {
+            string kind = "auto";
+            long maxMb = 0;
+            try
+            {
+                using (RegistryKey key = Registry.LocalMachine.OpenSubKey(@"SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management"))
+                {
+                    string[] files = key == null ? null : key.GetValue("PagingFiles") as string[];
+                    if (files != null)
+                    {
+                        kind = "none";
+                        foreach (string entry in files)
+                        {
+                            string[] parts = entry.Trim().Split(' ');
+                            if (entry.Trim().Length == 0)
+                            {
+                                continue;
+                            }
+                            long initial = 0;
+                            long max = 0;
+                            if (parts.Length >= 3)
+                            {
+                                long.TryParse(parts[parts.Length - 2], NumberStyles.Integer, CultureInfo.InvariantCulture, out initial);
+                                long.TryParse(parts[parts.Length - 1], NumberStyles.Integer, CultureInfo.InvariantCulture, out max);
+                            }
+                            if (entry.StartsWith("?:") || (initial == 0 && max == 0))
+                            {
+                                kind = "auto";
+                                maxMb = 0;
+                                break;
+                            }
+                            kind = "fixed";
+                            maxMb += max;
+                        }
+                    }
+                }
+            }
+            catch (Exception)
+            {
+                // Not readable: the caller treats "auto" as "no warning".
+            }
+            return "\"pageFile\":\"" + kind + "\",\"pageFileMaxMb\":" + maxMb.ToString(CultureInfo.InvariantCulture);
+        }
+
+        private static string Mb(ulong bytes)
+        {
+            return Math.Floor(bytes / BytesPerMb).ToString("0", CultureInfo.InvariantCulture);
+        }
+    }
+}

package/native/csharp/HostTools/Program.cs

@@ -1,6 +1,7 @@
 // HostTools.exe: what the host side asks of Windows without PowerShell. Built on first use by host/native.ts (csc).
 //   keep-awake --owner-pid N    this PC stays awake until process N ends (sandbox.keepAwake)
 //   stop-events --since <iso>   the Windows events since then that can end a sandbox, as JSON (host/life)
+//   memory-status               this PC's RAM and commit (what a sandbox's memory is charged against), as JSON
 //   hide-window --wait S        hides the sandbox window once it appears; prints the hidden handles as JSON
 //   show-window --handles a,b   shows those windows (else any sandbox window); prints how many
 //   user-path --add|--remove D  D first on, or off, your PATH; exit 3 when PATH would be too long
@@ -15,6 +16,7 @@ static class Program
 {
     private const int MaxEventsPerQuery = 100;
     private const int MaxDetail = 390;
+    private const int MaxResourceDetail = 1500;
 
     static int Main(string[] args)
     {
@@ -39,6 +41,17 @@ static class Program
                 }
                 Console.Out.Write(StopEventsJson(since));
                 return 0;
+            case "memory-status":
+                try
+                {
+                    Console.Out.Write(AgentSandbox.HostMemory.Json());
+                    return 0;
+                }
+                catch (Exception e)
+                {
+                    Console.Error.WriteLine(e.Message);
+                    return 1;
+                }
             case "hide-window":
                 int wait;
                 if (!options.TryGetValue("wait", out value) || !int.TryParse(value, out wait))
@@ -84,7 +97,7 @@ static class Program
 
     static int Usage()
     {
-        Console.Error.WriteLine("Usage: HostTools keep-awake --owner-pid N | stop-events --since <ISO time> | hide-window --wait S | show-window [--handles a,b] | user-path --add|--remove <folder>");
+        Console.Error.WriteLine("Usage: HostTools keep-awake --owner-pid N | stop-events --since <ISO time> | memory-status | hide-window --wait S | show-window [--handles a,b] | user-path --add|--remove <folder>");
         return 2;
     }
 
@@ -127,13 +140,20 @@ static class Program
             new[] { "System", "*[System[(EventID=1074 or EventID=6008 or EventID=41 or EventID=42 or EventID=2004) and " + time + "]]" },
             new[] { "System", "*[System[Provider[@Name='Microsoft-Windows-WER-SystemErrorReporting'] and EventID=1001 and " + time + "]]" },
             new[] { "Microsoft-Windows-Hyper-V-Worker-Admin", "*[System[(EventID=18590 or EventID=40001) and " + time + "]]" },
+            // Hardware errors Windows reported (WHEA: CPU, memory, bus, disk).
+            new[] { "System", "*[System[Provider[@Name='Microsoft-Windows-WHEA-Logger'] and (EventID=17 or EventID=18 or EventID=19 or EventID=47) and " + time + "]]" },
+            // Any error or critical event of the Hyper-V worker and compute services (the VM's memory, start and stop).
+            new[] { "Microsoft-Windows-Hyper-V-Worker-Admin", "*[System[(Level=1 or Level=2) and " + time + "]]" },
+            new[] { "Microsoft-Windows-Hyper-V-Compute-Admin", "*[System[(Level=1 or Level=2) and " + time + "]]" },
+            // A crash report of the programs that hold the VM (kept only when it names one of them, see Detail).
+            new[] { "Application", "*[System[(EventID=1000 or EventID=1001) and " + time + "]]" },
         };
         List<string> items = new List<string>();
         foreach (string[] query in queries)
         {
             try
             {
-                ReadEvents(query[0], query[1], items);
+                ReadEvents(query[0], query[1], items, query[0] == "Application");
             }
             catch (EventLogException)
             {
@@ -148,7 +168,7 @@ static class Program
     }
 
     /// <summary>The newest events first, at most 100 per query, as JSON objects { at, id, provider, process }.</summary>
-    static void ReadEvents(string log, string xpath, List<string> items)
+    static void ReadEvents(string log, string xpath, List<string> items, bool onlyVmPrograms)
     {
         EventLogQuery query = new EventLogQuery(log, PathType.LogName, xpath);
         query.ReverseDirection = true;
@@ -163,37 +183,58 @@ static class Program
                         return;
                     }
                     DateTime at = record.TimeCreated.HasValue ? record.TimeCreated.Value.ToUniversalTime() : DateTime.UtcNow;
+                    string detail = Detail(record);
+                    if (onlyVmPrograms && !MentionsVmProgram(detail))
+                    {
+                        continue;
+                    }
                     items.Add(
                         "{\"at\":" + Json(at.ToString("o", CultureInfo.InvariantCulture)) +
                         ",\"id\":" + record.Id.ToString(CultureInfo.InvariantCulture) +
                         ",\"provider\":" + Json(record.ProviderName ?? "") +
-                        ",\"process\":" + Json(Detail(record)) + "}");
+                        ",\"process\":" + Json(detail) + "}");
                 }
             }
         }
     }
 
-    /// <summary>What an event says beyond its id: the program that asked for a restart (1074), else its message start.</summary>
+    /// <summary>
+    /// What an event says beyond its id: the program that asked for a restart (1074), else its message start (the
+    /// resource-exhaustion event 2004 lists the biggest memory users, so it gets more room). Not for the plain power events.
+    /// </summary>
     static string Detail(EventRecord record)
     {
         if (record.Id == 1074)
         {
             return record.Properties.Count > 0 ? Convert.ToString(record.Properties[0].Value, CultureInfo.InvariantCulture) ?? "" : "";
         }
-        if (record.Id == 18590 || record.Id == 40001 || record.Id == 1001)
+        if (record.Id == 41)
         {
-            string message;
-            try
-            {
-                message = record.FormatDescription() ?? "";
-            }
-            catch (EventLogException)
-            {
-                message = "";
-            }
-            return message.Substring(0, Math.Min(MaxDetail, message.Length));
+            // Kernel-Power 41 carries the stop code of a blue screen (0 when there was none: a freeze or power loss).
+            return record.Properties.Count > 0 ? "BugcheckCode " + Convert.ToString(record.Properties[0].Value, CultureInfo.InvariantCulture) : "";
         }
-        return "";
+        if (record.Id == 42 || record.Id == 6008)
+        {
+            return "";
+        }
+        string message;
+        try
+        {
+            message = record.FormatDescription() ?? "";
+        }
+        catch (EventLogException)
+        {
+            message = "";
+        }
+        int max = record.Id == 2004 ? MaxResourceDetail : MaxDetail;
+        return message.Substring(0, Math.Min(max, message.Length));
+    }
+
+    /// <summary>Whether an application crash report names a program that runs the sandbox's VM.</summary>
+    static bool MentionsVmProgram(string detail)
+    {
+        string lower = detail.ToLowerInvariant();
+        return lower.Contains("vmwp.exe") || lower.Contains("vmmem") || lower.Contains("vmcompute") || lower.Contains("windowssandbox");
     }
 
     /// <summary>A JSON string literal.</summary>

package/native/scripts/check-contained.ps1

@@ -0,0 +1,28 @@
+#Requires -Version 5.1
+# Looks at the contained-storage image of one data set without changing anything and prints one line of JSON:
+# { imageExists, imageBytes, mountExists, mountIsMountPoint, attached }. `attached` is null when Windows will not say
+# without administrator rights. Used by doctor, repair and the launch (host/storage/contained) to compare what the
+# state file says with what is really mounted. Paths are never followed through links: a link gives mountIsMountPoint.
+param(
+    [Parameter(Mandatory = $true)][string]$Image,
+    [Parameter(Mandatory = $true)][string]$Mount
+)
+$ErrorActionPreference = 'Stop'
+
+$answer = [ordered]@{ imageExists = $false; imageBytes = 0; mountExists = $false; mountIsMountPoint = $false; attached = $null }
+try {
+    if (Test-Path -LiteralPath $Image -PathType Leaf) {
+        $answer.imageExists = $true
+        $answer.imageBytes = (Get-Item -LiteralPath $Image -Force).Length
+        try { $answer.attached = [bool](Get-DiskImage -ImagePath $Image -ErrorAction Stop).Attached } catch { $answer.attached = $null }
+    }
+    if (Test-Path -LiteralPath $Mount -PathType Container) {
+        $answer.mountExists = $true
+        $answer.mountIsMountPoint = [bool]([IO.File]::GetAttributes($Mount) -band [IO.FileAttributes]::ReparsePoint)
+    }
+    Write-Output ($answer | ConvertTo-Json -Compress)
+    exit 0
+} catch {
+    [Console]::Error.WriteLine($_.Exception.Message)
+    exit 1
+}

package/native/scripts/contained-common.ps1

@@ -0,0 +1,241 @@
+#Requires -Version 5.1
+# Shared by mount-contained.ps1, dismount-contained.ps1 and check-contained.ps1 (dot-sourced; defines functions only).
+# Everything a request says is checked again here, because mounting a disk image needs administrator rights and the
+# request file was written by a program that is not elevated: the image and the mount folder must be exactly
+# <storage>\images\<name>.vhdx and <storage>\mounts\<name>, none of the folders on the way may be a link, and what is
+# there must be yours. Nothing in this file changes anything.
+Set-StrictMode -Version 2.0
+
+$script:NameRule = '^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$'
+$script:PathRule = '^[^"<>|*?\x00-\x1f]+$'
+$script:AdministratorsSid = 'S-1-5-32-544'
+$script:Lines = New-Object System.Collections.Generic.List[string]
+
+function Add-Note([string]$Text) {
+    $script:Lines.Add($Text)
+}
+
+function Test-PlainAbsolute([string]$Path) {
+    if ([string]::IsNullOrWhiteSpace($Path)) { return $false }
+    if ($Path -notmatch $script:PathRule) { return $false }
+    # A drive letter and plain folder names: no UNC or \\?\ form, no . or .. part, no stream (a colon), no slash.
+    # (GetFullPath is not used: it turns a short 8.3 name such as WDAGUT~1 into a long one, and those are fine.)
+    if ($Path -notmatch '^[A-Za-z]:\\') { return $false }
+    if ($Path.IndexOf(':', 2) -ge 0 -or $Path.Contains('/')) { return $false }
+    foreach ($part in $Path.Substring(3).TrimEnd('\').Split('\')) {
+        if ($part -eq '' -or $part -eq '.' -or $part -eq '..' -or $part.EndsWith(' ') -or $part.EndsWith('.')) { return $false }
+    }
+    return $true
+}
+
+function Test-ReparsePoint([string]$Path) {
+    return [bool]([IO.File]::GetAttributes($Path) -band [IO.FileAttributes]::ReparsePoint)
+}
+
+function Test-IsMe([string]$Sid) {
+    $me = [Security.Principal.WindowsIdentity]::GetCurrent()
+    return ($me.User.Value -ieq $Sid)
+}
+
+function Test-IsAdministrator {
+    $me = [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
+    return $me.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+}
+
+function Read-ContainedRequest([string]$JsonPath, [string]$Sha256, [bool]$Dry) {
+    if (-not (Test-Path -LiteralPath $JsonPath -PathType Leaf)) { throw "The request file is missing: $JsonPath" }
+    $bytes = [IO.File]::ReadAllBytes($JsonPath)
+    if ($bytes.Length -gt 65536) { throw 'The request file is too large.' }
+    if ($Sha256) {
+        $hash = [BitConverter]::ToString([Security.Cryptography.SHA256]::Create().ComputeHash($bytes)).Replace('-', '')
+        if ($hash -ine $Sha256) { throw 'The request file changed after it was written; nothing was done.' }
+    } elseif (-not $Dry) {
+        throw 'No checksum was given for the request file.'
+    }
+    $text = [Text.Encoding]::UTF8.GetString($bytes).TrimStart([char]0xFEFF)
+    return ($text | ConvertFrom-Json)
+}
+
+function Assert-ContainedRequest($Req) {
+    foreach ($name in @('storageRoot', 'image', 'mount', 'userSid', 'set')) {
+        if (-not ($Req.PSObject.Properties.Name -contains $name) -or -not $Req.$name) { throw "The request has no $name." }
+    }
+    if ($Req.userSid -notmatch '^S-1-[0-9-]{3,120}$') { throw 'The request has no valid user.' }
+    if ($Req.set -notmatch $script:NameRule) { throw "The data set name is not allowed: $($Req.set)" }
+    foreach ($p in @($Req.storageRoot, $Req.image, $Req.mount)) {
+        if (-not (Test-PlainAbsolute $p)) { throw "Not a plain full path (no .., no network path): $p" }
+    }
+    $root = $Req.storageRoot.TrimEnd('\')
+    $wantImage = Join-Path (Join-Path $root 'images') ($Req.set + '.vhdx')
+    $wantMount = Join-Path (Join-Path $root 'mounts') $Req.set
+    if ($Req.image.TrimEnd('\') -ine $wantImage) { throw "The image must be $wantImage, not $($Req.image)." }
+    if ($Req.mount.TrimEnd('\') -ine $wantMount) { throw "The mount folder must be $wantMount, not $($Req.mount)." }
+    if ($root.Length -le 3) { throw 'The storage folder cannot be a drive root.' }
+}
+
+function Assert-NoLinksOnTheWay($Req, [bool]$MountMayBeLink) {
+    $root = $Req.storageRoot.TrimEnd('\')
+    foreach ($p in @($root, (Join-Path $root 'images'), (Join-Path $root 'mounts'))) {
+        if (-not (Test-Path -LiteralPath $p -PathType Container)) { throw "A folder is missing: $p" }
+        if (Test-ReparsePoint $p) { throw "Refusing a link: $p" }
+    }
+    # Everything above the storage folder must not be a link either (a link there would move the whole tree).
+    $parent = Split-Path -Parent $root
+    while ($parent) {
+        if ((Test-Path -LiteralPath $parent) -and (Test-ReparsePoint $parent)) { throw "Refusing a link above the storage folder: $parent" }
+        $next = Split-Path -Parent $parent
+        if ($next -eq $parent) { break }
+        $parent = $next
+    }
+    if (Test-Path -LiteralPath $Req.image) {
+        if (Test-ReparsePoint $Req.image) { throw "Refusing a link: $($Req.image)" }
+        if (-not (Test-Path -LiteralPath $Req.image -PathType Leaf)) { throw "The image is not a file: $($Req.image)" }
+    }
+    if (-not (Test-Path -LiteralPath $Req.mount -PathType Container)) { throw "The mount folder is missing: $($Req.mount)" }
+    if ((-not $MountMayBeLink) -and (Test-ReparsePoint $Req.mount)) { throw "Refusing a link: $($Req.mount)" }
+}
+
+function Get-OwnerSid([string]$Path) {
+    return (Get-Acl -LiteralPath $Path).GetOwner([Security.Principal.SecurityIdentifier]).Value
+}
+
+function Assert-OwnedByUser($Req, [string[]]$Paths) {
+    # An object made by an elevated process of your own account is owned by Administrators, not by you.
+    $allowed = @($Req.userSid)
+    if ((Test-IsMe $Req.userSid) -and (Test-IsAdministrator)) { $allowed += $script:AdministratorsSid }
+    foreach ($p in $Paths) {
+        $owner = Get-OwnerSid $p
+        if ($allowed -inotcontains $owner) { throw "Not yours (owner $owner): $p" }
+    }
+}
+
+function Read-ExactBytes([IO.FileStream]$Stream, [long]$Offset, [int]$Count) {
+    if ($Offset -lt 0 -or ($Offset + $Count) -gt $Stream.Length) { throw 'The image is not a valid VHDX file (a part is missing).' }
+    [void]$Stream.Seek($Offset, [IO.SeekOrigin]::Begin)
+    $buffer = New-Object byte[] $Count
+    $done = 0
+    while ($done -lt $Count) {
+        $n = $Stream.Read($buffer, $done, $Count - $done)
+        if ($n -le 0) { throw 'The image could not be read.' }
+        $done += $n
+    }
+    return , $buffer
+}
+
+function New-GuidFrom([byte[]]$Bytes, [int]$Offset) {
+    $part = New-Object byte[] 16
+    [Array]::Copy($Bytes, $Offset, $part, 0, 16)
+    return (New-Object System.Guid -ArgumentList (, $part))
+}
+
+# Reads the VHDX header of a file that is not attached (the layout is in the VHDX specification): is it a VHDX, how
+# big may it grow, does it have a parent (a differencing disk would reach into another file)?
+function Read-VhdxInfo([string]$Path) {
+    $metadataRegion = New-Object System.Guid '8b7ca206-4790-4b9a-b8fe-575f050f886e'
+    $virtualSizeItem = New-Object System.Guid '2fa54224-cd1b-4876-b211-5dbed83bf4b8'
+    $parentItem = New-Object System.Guid 'a8d35f2d-b30b-454d-abf7-d3d84834ab0c'
+    $stream = [IO.File]::Open($Path, [IO.FileMode]::Open, [IO.FileAccess]::Read, [IO.FileShare]::ReadWrite)
+    try {
+        $id = [Text.Encoding]::ASCII.GetString((Read-ExactBytes $stream 0 8))
+        if ($id -ne 'vhdxfile') { throw 'The file is not a VHDX image.' }
+        $table = Read-ExactBytes $stream 196608 65536
+        if ([Text.Encoding]::ASCII.GetString($table, 0, 4) -ne 'regi') { throw 'The image has no region table.' }
+        $count = [BitConverter]::ToUInt32($table, 8)
+        if ($count -gt 64) { throw 'The image has too many regions.' }
+        $metadataOffset = -1L
+        for ($i = 0; $i -lt $count; $i++) {
+            $at = 16 + 32 * $i
+            if ((New-GuidFrom $table $at) -eq $metadataRegion) { $metadataOffset = [long][BitConverter]::ToUInt64($table, $at + 16) }
+        }
+        if ($metadataOffset -lt 0) { throw 'The image has no metadata region.' }
+        $meta = Read-ExactBytes $stream $metadataOffset 65536
+        if ([Text.Encoding]::ASCII.GetString($meta, 0, 8) -ne 'metadata') { throw 'The image has no metadata table.' }
+        $items = [BitConverter]::ToUInt16($meta, 10)
+        if ($items -gt 2047) { throw 'The image has too many metadata items.' }
+        $size = [uint64]0
+        $hasParent = $false
+        for ($i = 0; $i -lt $items; $i++) {
+            $at = 32 + 32 * $i
+            $guid = New-GuidFrom $meta $at
+            if ($guid -eq $parentItem) { $hasParent = $true }
+            if ($guid -eq $virtualSizeItem) {
+                $itemOffset = [long][BitConverter]::ToUInt32($meta, $at + 16)
+                $size = [BitConverter]::ToUInt64((Read-ExactBytes $stream ($metadataOffset + $itemOffset) 8), 0)
+            }
+        }
+        return @{ VirtualSize = $size; HasParent = $hasParent }
+    } finally {
+        $stream.Dispose()
+    }
+}
+
+function Assert-PlainImage($Req, [bool]$Dry) {
+    $info = Read-VhdxInfo $Req.image
+    if ($info.HasParent) { throw 'The image is a differencing disk (it has a parent file); refusing it.' }
+    $cap = [uint64]$Req.maxGb * 1GB
+    if ($info.VirtualSize -eq 0) { throw 'The image size could not be read.' }
+    if ($info.VirtualSize -gt $cap) { throw "The image is bigger than the limit of $($Req.maxGb) GB." }
+    return $info
+}
+
+# Is this very image attached, and where? Null as the second answer when Windows will not say.
+function Get-ImageState([string]$Image, [bool]$Dry) {
+    try {
+        $di = Get-DiskImage -ImagePath $Image -ErrorAction Stop
+        if (-not $di.Attached) { return @{ Attached = $false; Paths = @() } }
+        $disk = $di | Get-Disk -ErrorAction Stop
+        $paths = @()
+        foreach ($part in @(Get-Partition -DiskNumber $disk.Number -ErrorAction SilentlyContinue)) {
+            foreach ($a in @($part.AccessPaths)) { if ($a) { $paths += $a } }
+        }
+        return @{ Attached = $true; Paths = $paths }
+    } catch {
+        if ($Dry) { return @{ Attached = $false; Paths = @() } }
+        throw "Windows could not tell whether the image is attached: $($_.Exception.Message)"
+    }
+}
+
+function Test-MountedAt($State, [string]$Mount) {
+    $want = $Mount.TrimEnd('\') + '\'
+    foreach ($p in $State.Paths) { if ($p -ieq $want) { return $true } }
+    return $false
+}
+
+function Invoke-DiskPart([string[]]$DiskPartLines, [string]$TempDir, [bool]$Dry) {
+    foreach ($line in $DiskPartLines) {
+        if ($line -match '[\r\n]') { throw 'A diskpart line has a line break.' }
+    }
+    if ($Dry) {
+        foreach ($line in $DiskPartLines) { Add-Note ('DISKPART: ' + $line) }
+        return ''
+    }
+    $diskpart = Join-Path $env:SystemRoot 'System32\diskpart.exe'
+    if (-not (Test-Path -LiteralPath $diskpart)) { throw 'diskpart.exe was not found.' }
+    $file = Join-Path $TempDir ('diskpart-' + [guid]::NewGuid().ToString('N') + '.txt')
+    [IO.File]::WriteAllLines($file, $DiskPartLines, [Text.Encoding]::ASCII)
+    try {
+        # /s stops at the first command that fails.
+        $output = & $diskpart /s $file 2>&1 | Out-String
+        if ($LASTEXITCODE -ne 0) { throw "diskpart failed (exit $LASTEXITCODE): $output" }
+        return $output
+    } finally {
+        Remove-Item -LiteralPath $file -Force -ErrorAction SilentlyContinue
+    }
+}
+
+function Write-ContainedResult([hashtable]$Result, [string]$JsonPath, [bool]$Dry) {
+    if ($Dry) {
+        foreach ($line in $script:Lines) { Write-Output $line }
+        if ($Result.ok) { Write-Output 'RESULT: ok' } else { Write-Output ('RESULT: refused: ' + $Result.message) }
+        return
+    }
+    $Result.notes = @($script:Lines)
+    $file = Join-Path (Split-Path -Parent $JsonPath) 'result.json'
+    [IO.File]::WriteAllText($file, ($Result | ConvertTo-Json -Compress), (New-Object Text.UTF8Encoding($false)))
+}
+
+function Enter-ContainedLock {
+    $mutex = New-Object System.Threading.Mutex($false, 'Global\AgentSandboxContainedStorage')
+    if (-not $mutex.WaitOne(30000)) { throw 'Another mount or dismount is running. Try again in a minute.' }
+    return $mutex
+}

package/native/scripts/dismount-contained.ps1

@@ -0,0 +1,66 @@
+#Requires -Version 5.1
+# Detaches the contained-storage disk image of one data set (the image file stays, with everything in it). Run elevated
+# (one Windows permission prompt). The request is a JSON file: { set, storageRoot, image, mount, userSid }. The same
+# checks as mount-contained.ps1 apply (exact paths, no links, yours). It refuses while Windows Sandbox is running (the
+# sandbox may be using the folders in the image). Only `detach vdisk` for this one image is run; nothing is deleted.
+# -DryRun prints the diskpart lines and does nothing else; the result goes to result.json next to the request file.
+param(
+    [Parameter(Mandatory = $true)][string]$Json,
+    [string]$Sha256 = '',
+    [switch]$DryRun
+)
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'contained-common.ps1')
+
+$result = @{ ok = $false; message = ''; action = 'dismount'; created = $false; alreadyMounted = $false }
+
+function Invoke-Dismount($Req, [bool]$Dry, [string]$TempDir) {
+    Assert-NoLinksOnTheWay $Req $true
+    $root = $Req.storageRoot.TrimEnd('\')
+    Assert-OwnedByUser $Req @($root, (Join-Path $root 'images'), (Join-Path $root 'mounts'))
+    if (-not (Test-Path -LiteralPath $Req.image -PathType Leaf)) { throw "The image is missing: $($Req.image)" }
+    Assert-OwnedByUser $Req @($Req.image)
+    $image = $Req.image
+    $mount = $Req.mount.TrimEnd('\')
+    if (-not $Dry) {
+        if (Get-Process -Name 'WindowsSandbox*' -ErrorAction SilentlyContinue) {
+            throw 'A Windows Sandbox is running and may be using the image. Close it first.'
+        }
+    }
+    $state = Get-ImageState $image $Dry
+    if ((-not $Dry) -and (-not $state.Attached)) {
+        if (Test-ReparsePoint $mount) { throw "The mount folder is a mount point of something else; not touching it: $mount" }
+        $script:result.ok = $true
+        $script:result.message = 'The image is not mounted.'
+        Add-Note 'not attached: nothing to do'
+        return
+    }
+    [void](Invoke-DiskPart @("select vdisk file=""$image""", 'detach vdisk') $TempDir $Dry)
+    if (-not $Dry) {
+        $after = Get-ImageState $image $false
+        if ($after.Attached) { throw 'The image is still attached (something is using it). Close programs that use files in it and try again.' }
+        if (Test-ReparsePoint $mount) { throw "The mount folder is still a mount point: $mount" }
+    }
+    $script:result.ok = $true
+    $script:result.message = 'The image was detached.'
+}
+
+$mutex = $null
+try {
+    $request = Read-ContainedRequest -JsonPath $Json -Sha256 $Sha256 -Dry $DryRun.IsPresent
+    Assert-ContainedRequest $request
+    if (-not $DryRun) {
+        if (-not (Test-IsAdministrator)) { throw 'Detaching a disk image needs administrator rights.' }
+        $mutex = Enter-ContainedLock
+    }
+    Invoke-Dismount $request $DryRun.IsPresent (Split-Path -Parent $Json)
+} catch {
+    $result.ok = $false
+    $result.message = $_.Exception.Message
+} finally {
+    if ($mutex) { $mutex.ReleaseMutex(); $mutex.Dispose() }
+}
+Write-ContainedResult $result $Json $DryRun.IsPresent
+if ($result.ok) { exit 0 }
+if ($DryRun) { [Console]::Error.WriteLine($result.message) }
+exit 1

package/native/scripts/memory-status.ps1

@@ -0,0 +1,34 @@
+#Requires -Version 5.1
+# Prints this PC's memory as JSON: { totalMb, availableMb, commitLimitMb, commitAvailableMb }. Read-only. The fallback
+# for HostTools.exe memory-status (host/life/host-memory.ts).
+param()
+$ErrorActionPreference = 'Stop'
+
+$os = Get-CimInstance -ClassName Win32_OperatingSystem
+# The paging file setup from the registry: auto (Windows manages it), fixed (with its maximum sizes) or none.
+$pageFile = 'auto'
+$pageFileMax = 0
+try {
+    $entries = @((Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management' -ErrorAction Stop).PagingFiles | Where-Object { $_ -and $_.Trim() })
+    $pageFile = 'none'
+    foreach ($entry in $entries) {
+        $parts = $entry.Trim() -split ' '
+        $initial = 0; $max = 0
+        if ($parts.Count -ge 3) { $initial = [int64]$parts[-2]; $max = [int64]$parts[-1] }
+        if ($entry.StartsWith('?:') -or ($initial -eq 0 -and $max -eq 0)) { $pageFile = 'auto'; $pageFileMax = 0; break }
+        $pageFile = 'fixed'
+        $pageFileMax += $max
+    }
+} catch {
+    # Not readable: treated as automatic (no warning).
+}
+
+# Win32_OperatingSystem counts in KB.
+ConvertTo-Json -Compress -InputObject ([ordered]@{
+    totalMb           = [int64][math]::Floor($os.TotalVisibleMemorySize / 1024)
+    availableMb       = [int64][math]::Floor($os.FreePhysicalMemory / 1024)
+    commitLimitMb     = [int64][math]::Floor($os.TotalVirtualMemorySize / 1024)
+    commitAvailableMb = [int64][math]::Floor($os.FreeVirtualMemory / 1024)
+    pageFile          = $pageFile
+    pageFileMaxMb     = [int64]$pageFileMax
+})