windows-development-sandbox 1.7.0 → 1.9.0

package/native/scripts/mount-contained.ps1

@@ -0,0 +1,139 @@
+#Requires -Version 5.1
+# Mounts the contained-storage disk image of one data set at its mount folder (no drive letter), creating and
+# formatting the image the very first time. Run elevated (host/storage/contained starts it through run-elevated.ps1,
+# one Windows permission prompt). The request is a JSON file: { set, storageRoot, image, mount, userSid, maxGb, create }.
+# Safety, all checked again here: the image is <storage>\images\<set>.vhdx and the mount folder <storage>\mounts\<set>;
+# no folder on the way is a link; both are yours; the image has no parent file and is not bigger than the limit; an
+# existing image is only attached (never formatted, never deleted), and a new one is only made where no file is.
+# Every diskpart command names this one image. -DryRun checks everything and prints the diskpart lines it would run
+# (and does nothing else); the result of a real run goes to result.json next to the request file.
+param(
+    [Parameter(Mandatory = $true)][string]$Json,
+    [string]$Sha256 = '',
+    [switch]$DryRun
+)
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'contained-common.ps1')
+
+$result = @{ ok = $false; message = ''; action = 'mount'; created = $false; alreadyMounted = $false }
+
+function Invoke-Mount($Req, [bool]$Dry, [string]$TempDir) {
+    foreach ($name in @('maxGb', 'create')) {
+        if (-not ($Req.PSObject.Properties.Name -contains $name)) { throw "The request has no $name." }
+    }
+    if ($Req.maxGb -lt 8 -or $Req.maxGb -gt 4096) { throw 'The size limit must be between 8 and 4096 GB.' }
+    $create = [bool]$Req.create
+    Assert-NoLinksOnTheWay $Req $true
+    $root = $Req.storageRoot.TrimEnd('\')
+    $mountIsLink = Test-ReparsePoint $Req.mount
+    Assert-OwnedByUser $Req @($root, (Join-Path $root 'images'), (Join-Path $root 'mounts'))
+    # A mounted folder shows the image's own root, whose owner is not ours to judge; a plain folder is.
+    if (-not $mountIsLink) { Assert-OwnedByUser $Req @($Req.mount) }
+    $exists = Test-Path -LiteralPath $Req.image -PathType Leaf
+    if ($create -and $exists) { throw "An image exists already; refusing to create over it: $($Req.image)" }
+    if ((-not $create) -and (-not $exists)) { throw "The image is missing: $($Req.image)" }
+    $image = $Req.image
+    $mount = $Req.mount.TrimEnd('\')
+
+    if ($exists) {
+        Assert-OwnedByUser $Req @($image)
+        $state = Get-ImageState $image $Dry
+        if ($state.Attached) {
+            if ((Test-MountedAt $state $mount) -and $mountIsLink) {
+                $script:result.ok = $true
+                $script:result.alreadyMounted = $true
+                $script:result.message = 'The image is mounted already.'
+                Add-Note 'already mounted at the mount folder'
+                return
+            }
+            throw 'The image is attached somewhere else (Disk Management or another tool). Detach it there first.'
+        }
+        # Not attached, so its header can be read.
+        [void](Assert-PlainImage $Req $Dry)
+    }
+    if ($mountIsLink) { throw "The mount folder is a mount point already: $mount" }
+    if (@(Get-ChildItem -LiteralPath $mount -Force).Count -ne 0) { throw "The mount folder is not empty: $mount" }
+    $format = (New-Object IO.DriveInfo ([IO.Path]::GetPathRoot($mount))).DriveFormat
+    if ($format -ne 'NTFS') { throw "The mount folder must be on an NTFS drive (this one is $format): $mount" }
+
+    if ($exists) {
+        # Attach and mount the first partition of this image; nothing is created and nothing is formatted.
+        $lines = @(
+            "select vdisk file=""$image""",
+            'attach vdisk',
+            'select partition 1',
+            "assign mount=""$mount"""
+        )
+    } else {
+        if (-not $Dry) {
+            $drive = New-Object IO.DriveInfo ([IO.Path]::GetPathRoot($image))
+            if ($drive.AvailableFreeSpace -lt 1GB) { throw 'There is less than 1 GB free where the image would be made.' }
+        }
+        $megabytes = [int]$Req.maxGb * 1024
+        $lines = @(
+            "create vdisk file=""$image"" maximum=$megabytes type=expandable",
+            "select vdisk file=""$image""",
+            'attach vdisk',
+            'create partition primary',
+            'format fs=ntfs quick label=AgentData',
+            "assign mount=""$mount"""
+        )
+    }
+    try {
+        [void](Invoke-DiskPart $lines $TempDir $Dry)
+        if (-not $Dry) {
+            $after = Get-ImageState $image $false
+            if (-not $after.Attached -or -not (Test-MountedAt $after $mount)) { throw 'The image is attached but not mounted at the mount folder.' }
+            if (-not (Test-ReparsePoint $mount)) { throw 'The mount folder is not a mount point after mounting.' }
+            if (-not $exists) {
+                # The new volume's root is open to Users by default: only you and the system may use it.
+                $acl = New-Object Security.AccessControl.DirectorySecurity
+                $acl.SetAccessRuleProtection($true, $false)
+                $inherit = [Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+                foreach ($sid in @($Req.userSid, 'S-1-5-18')) {
+                    $who = New-Object Security.Principal.SecurityIdentifier($sid)
+                    $acl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($who, 'FullControl', $inherit, 'None', 'Allow')))
+                }
+                Set-Acl -LiteralPath $mount -AclObject $acl
+            }
+        }
+        $script:result.ok = $true
+        $script:result.created = (-not $exists)
+        $script:result.message = if ($exists) { 'The image was mounted.' } else { 'The image was created and mounted.' }
+    } catch {
+        $problem = $_.Exception.Message
+        if (-not $Dry) {
+            # Leave the PC as it was: detach this image (only this one); a half-made new image is renamed, never deleted.
+            $now = $null
+            try { $now = Get-ImageState $image $false } catch { $now = $null }
+            if ((Test-Path -LiteralPath $image) -and ((-not $now) -or $now.Attached)) {
+                try { [void](Invoke-DiskPart @("select vdisk file=""$image""", 'detach vdisk') $TempDir $false) } catch { $problem += ' (it could not be detached again: ' + $_.Exception.Message + ')' }
+            }
+            if ((-not $exists) -and (Test-Path -LiteralPath $image)) {
+                $kept = $image + '.failed-' + (Get-Date -Format 'yyyyMMddHHmmss')
+                try { Rename-Item -LiteralPath $image -NewName (Split-Path -Leaf $kept); $problem += " (the unfinished image was kept as $kept)" } catch { $problem += ' (the unfinished image is still at ' + $image + ')' }
+            }
+        }
+        throw $problem
+    }
+}
+
+$mutex = $null
+try {
+    $request = Read-ContainedRequest -JsonPath $Json -Sha256 $Sha256 -Dry $DryRun.IsPresent
+    Assert-ContainedRequest $request
+    if (-not $DryRun) {
+        if (-not (Test-IsAdministrator)) { throw 'Mounting a disk image needs administrator rights.' }
+        $mutex = Enter-ContainedLock
+    }
+    Invoke-Mount $request $DryRun.IsPresent (Split-Path -Parent $Json)
+} catch {
+    $result.ok = $false
+    $result.message = $_.Exception.Message
+} finally {
+    if ($mutex) { $mutex.ReleaseMutex(); $mutex.Dispose() }
+}
+Write-ContainedResult $result $Json $DryRun.IsPresent
+if ($result.ok) { exit 0 }
+if ($DryRun) { [Console]::Error.WriteLine($result.message) }
+exit 1

package/native/scripts/run-elevated.ps1

@@ -1,11 +1,24 @@
 #Requires -Version 5.1
-# Runs one fixed PowerShell command in an elevated PowerShell (Windows asks for permission) and waits for it. Used by
-# `sandbox setup` to turn on the Windows Sandbox feature. Exits with the command's exit code, or 1 when declined.
-param([Parameter(Mandatory = $true)][string]$Command)
+# Runs one fixed PowerShell command, or one script of this package, in an elevated PowerShell (Windows asks for
+# permission) and waits for it. -Command is used by `sandbox setup` to turn on the Windows Sandbox feature. -Script is
+# used for contained storage: the script (a file of this package) gets -Json <request file> -Sha256 <its checksum>.
+# Exits with the exit code of what it ran, or 1 when the permission was declined.
+[CmdletBinding(DefaultParameterSetName = 'Command')]
+param(
+    [Parameter(Mandatory = $true, ParameterSetName = 'Command')][string]$Command,
+    [Parameter(Mandatory = $true, ParameterSetName = 'Script')][string]$Script,
+    [Parameter(Mandatory = $true, ParameterSetName = 'Script')][string]$Json,
+    [Parameter(Mandatory = $true, ParameterSetName = 'Script')][string]$Sha256
+)
 $ErrorActionPreference = 'Stop'
 try {
     $exe = Join-Path $PSHOME 'powershell.exe'
-    $p = Start-Process -FilePath $exe -Verb RunAs -Wait -PassThru -WindowStyle Hidden -ArgumentList '-NoProfile', '-Command', $Command
+    if ($PSCmdlet.ParameterSetName -eq 'Script') {
+        $arguments = @('-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', ('"' + $Script + '"'), '-Json', ('"' + $Json + '"'), '-Sha256', $Sha256)
+    } else {
+        $arguments = @('-NoProfile', '-Command', $Command)
+    }
+    $p = Start-Process -FilePath $exe -Verb RunAs -Wait -PassThru -WindowStyle Hidden -ArgumentList $arguments
     exit $p.ExitCode
 } catch {
     exit 1

package/native/scripts/stop-events.ps1

@@ -7,28 +7,43 @@ $ErrorActionPreference = 'Stop'
 $filters = @(
     @{ LogName = 'System'; Id = 1074, 6008, 41, 42, 2004; StartTime = $Since },
     @{ LogName = 'System'; Id = 1001; ProviderName = 'Microsoft-Windows-WER-SystemErrorReporting'; StartTime = $Since },
-    @{ LogName = 'Microsoft-Windows-Hyper-V-Worker-Admin'; Id = 18590, 40001; StartTime = $Since }
+    @{ LogName = 'Microsoft-Windows-Hyper-V-Worker-Admin'; Id = 18590, 40001; StartTime = $Since },
+    # Hardware errors Windows reported (WHEA: CPU, memory, bus, disk).
+    @{ LogName = 'System'; ProviderName = 'Microsoft-Windows-WHEA-Logger'; Id = 17, 18, 19, 47; StartTime = $Since },
+    # Any error or critical event of the Hyper-V worker and compute services (the VM's memory, start and stop).
+    @{ LogName = 'Microsoft-Windows-Hyper-V-Worker-Admin'; Level = 1, 2; StartTime = $Since },
+    @{ LogName = 'Microsoft-Windows-Hyper-V-Compute-Admin'; Level = 1, 2; StartTime = $Since },
+    # A crash report of the programs that hold the VM (kept only when it names one of them).
+    @{ LogName = 'Application'; Id = 1000, 1001; StartTime = $Since; OnlyVmPrograms = $true }
 )
 $maxMessage = 390
+$maxResourceMessage = 1500
 
 # What each event says beyond its id: the program that asked for a restart (1074), else the start of the message.
 function Get-EventDetail($record) {
     if ($record.Id -eq 1074) { return [string]$record.Properties[0].Value }
-    if ($record.Id -in 18590, 40001, 1001) {
-        $message = [string]$record.Message
-        return $message.Substring(0, [math]::Min($maxMessage, $message.Length))
-    }
-    return ''
+    # The plain power events say nothing more; the resource-exhaustion event (2004) lists the biggest memory users.
+    # Kernel-Power 41 carries the stop code of a blue screen (0 when there was none: a freeze or power loss).
+    if ($record.Id -eq 41) { return 'BugcheckCode ' + [string]$record.Properties[0].Value }
+    if ($record.Id -in 42, 6008) { return '' }
+    $message = [string]$record.Message
+    $max = if ($record.Id -eq 2004) { $maxResourceMessage } else { $maxMessage }
+    return $message.Substring(0, [math]::Min($max, $message.Length))
 }
 
 $events = foreach ($filter in $filters) {
     try {
-        Get-WinEvent -FilterHashtable $filter -MaxEvents 100 | ForEach-Object {
+        $onlyVm = $filter.ContainsKey('OnlyVmPrograms')
+        $query = @{} + $filter
+        $query.Remove('OnlyVmPrograms')
+        Get-WinEvent -FilterHashtable $query -MaxEvents 100 | ForEach-Object {
+            $detail = Get-EventDetail $_
+            if ($onlyVm -and $detail -notmatch 'vmwp\.exe|vmmem|vmcompute|windowssandbox') { return }
             [pscustomobject]@{
                 at       = $_.TimeCreated.ToUniversalTime().ToString('o')
                 id       = $_.Id
                 provider = $_.ProviderName
-                process  = Get-EventDetail $_
+                process  = $detail
             }
         }
     } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "windows-development-sandbox",
-  "version": "1.7.0",
+  "version": "1.9.0",
   "description": "A disposable Windows Sandbox for development, with or without an AI agent (Claude Code, Codex, Gemini, opencode, ...): the folder you run it from is the workspace, toolchains and databases for your project install themselves, and nothing else on your PC is reachable.",
   "type": "module",
   "license": "MIT",
@@ -93,6 +93,13 @@
   ],
   "devDependencies": {
     "@eslint/js": "^9.39.5",
+    "@mantine/core": "^7.17.8",
+    "@mantine/form": "^7.17.8",
+    "@mantine/hooks": "^7.17.8",
+    "@mantine/modals": "^7.17.8",
+    "@mantine/notifications": "^7.17.8",
+    "@tabler/icons-react": "^3.49.0",
+    "@tanstack/react-query": "^5.104.3",
     "@types/lodash": "^4.17.26",
     "@types/node": "^22.0.0",
     "@types/react": "^18.3.31",
@@ -100,9 +107,9 @@
     "@types/ws": "^8.18.2",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
-    "bootstrap": "^5.3.8",
     "esbuild": "^0.28.2",
     "eslint": "^9.39.5",
+    "mantine-form-zod-resolver": "^1.3.0",
     "prettier": "^3.9.10",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",

package/sandbox/csharp/MemGov.cs

@@ -0,0 +1,398 @@
+// memgov.exe: the Windows side of the sandbox's memory governor (src/guest/governor). One long-running process the
+// daemon talks to over stdin/stdout, so the decisions stay in TypeScript and only the Win32 calls live here. C# 5.
+//
+//   stdout, a JSON line every --interval seconds (default 2):
+//     {"ramTotalMb":..,"ramAvailMb":..,"commitLimitMb":..,"commitAvailMb":..,"procs":[{"pid":..,"name":"rustc","mb":..,"prio":"normal"}]}
+//     procs = the processes in the agents' job (the job ptyhost makes for everything the agents start), nothing else.
+//   stdin, one command per line:
+//     priority <pid> <idle|below|normal>   lowers (or restores) the priority of a process in that job
+//     suspend <pid> <ms>                   pauses a process in that job, resumes it after ms (at most 30000)
+//     exit
+//
+// It only ever touches processes that are in the agents' job, never itself, and resumes everything it paused when it
+// ends or when the daemon goes away (stdin closes).
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Globalization;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Threading;
+
+static class MemGov
+{
+    private const string AgentJobName = "Local\\AgentSandboxAgentsJob";
+    private const double BytesPerMb = 1024.0 * 1024.0;
+    private const int MaxProcesses = 1024;
+    private const int MaxSuspendMs = 30000;
+    private const uint JobObjectQuery = 0x0004;
+    private const int JobObjectBasicProcessIdList = 3;
+    private const uint ProcessQueryLimited = 0x1000;
+    private const uint ProcessSetInformation = 0x0200;
+    private const uint ProcessSuspendResume = 0x0800;
+    private const uint IdleClass = 0x00000040;
+    private const uint BelowNormalClass = 0x00004000;
+    private const uint NormalClass = 0x00000020;
+
+    // MEMORYSTATUSEX.
+    [StructLayout(LayoutKind.Sequential)]
+    private struct MemoryStatus
+    {
+        public uint Length;
+        public uint MemoryLoad;
+        public ulong TotalPhys;
+        public ulong AvailPhys;
+        public ulong TotalPageFile;
+        public ulong AvailPageFile;
+        public ulong TotalVirtual;
+        public ulong AvailVirtual;
+        public ulong AvailExtendedVirtual;
+    }
+
+    private static class NativeMethods
+    {
+        [DllImport("kernel32.dll", SetLastError = true)]
+        public static extern bool GlobalMemoryStatusEx(ref MemoryStatus status);
+
+        [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+        public static extern IntPtr OpenJobObjectW(uint access, bool inherit, string name);
+
+        [DllImport("kernel32.dll", SetLastError = true)]
+        public static extern bool QueryInformationJobObject(IntPtr job, int infoClass, IntPtr info, int length, IntPtr returnLength);
+
+        [DllImport("kernel32.dll", SetLastError = true)]
+        public static extern bool IsProcessInJob(IntPtr process, IntPtr job, out bool result);
+
+        [DllImport("kernel32.dll", SetLastError = true)]
+        public static extern IntPtr OpenProcess(uint access, bool inherit, int pid);
+
+        [DllImport("kernel32.dll", SetLastError = true)]
+        public static extern bool SetPriorityClass(IntPtr process, uint priorityClass);
+
+        [DllImport("kernel32.dll", SetLastError = true)]
+        public static extern uint GetPriorityClass(IntPtr process);
+
+        [DllImport("kernel32.dll", SetLastError = true)]
+        public static extern bool CloseHandle(IntPtr handle);
+
+        [DllImport("ntdll.dll")]
+        public static extern int NtSuspendProcess(IntPtr process);
+
+        [DllImport("ntdll.dll")]
+        public static extern int NtResumeProcess(IntPtr process);
+    }
+
+    private static readonly object Gate = new object();
+    private static readonly Dictionary<int, DateTime> Paused = new Dictionary<int, DateTime>();
+    private static IntPtr job = IntPtr.Zero;
+    private static volatile bool stop;
+
+    static int Main(string[] args)
+    {
+        if (args.Length == 0 || args[0] != "serve")
+        {
+            Console.Error.WriteLine("usage: memgov serve [--interval seconds]");
+            return 2;
+        }
+        int interval = 2;
+        for (int i = 1; i + 1 < args.Length; i++)
+        {
+            if (args[i] == "--interval")
+            {
+                int.TryParse(args[i + 1], NumberStyles.Integer, CultureInfo.InvariantCulture, out interval);
+            }
+        }
+        if (interval < 1)
+        {
+            interval = 2;
+        }
+        Thread commands = new Thread(ReadCommands);
+        commands.IsBackground = true;
+        commands.Start();
+        Thread resumer = new Thread(ResumeWhenDue);
+        resumer.IsBackground = true;
+        resumer.Start();
+        while (!stop)
+        {
+            try
+            {
+                Console.Out.WriteLine(Sample());
+                Console.Out.Flush();
+            }
+            catch (Exception)
+            {
+                // A sample that fails (a process ended while it was read) is skipped; the next one tries again.
+            }
+            for (int waited = 0; waited < interval * 10 && !stop; waited++)
+            {
+                Thread.Sleep(100);
+            }
+        }
+        ResumeAll();
+        return 0;
+    }
+
+    /// <summary>The job, opened once it exists (ptyhost makes it when the first agent starts).</summary>
+    private static IntPtr Job()
+    {
+        if (job == IntPtr.Zero)
+        {
+            job = NativeMethods.OpenJobObjectW(JobObjectQuery, false, AgentJobName);
+        }
+        return job;
+    }
+
+    private static string Sample()
+    {
+        MemoryStatus status = new MemoryStatus();
+        status.Length = (uint)Marshal.SizeOf(typeof(MemoryStatus));
+        if (!NativeMethods.GlobalMemoryStatusEx(ref status))
+        {
+            throw new Win32Exception(Marshal.GetLastWin32Error());
+        }
+        StringBuilder sb = new StringBuilder();
+        sb.Append("{\"ramTotalMb\":").Append(Mb(status.TotalPhys));
+        sb.Append(",\"ramAvailMb\":").Append(Mb(status.AvailPhys));
+        sb.Append(",\"commitLimitMb\":").Append(Mb(status.TotalPageFile));
+        sb.Append(",\"commitAvailMb\":").Append(Mb(status.AvailPageFile));
+        sb.Append(",\"procs\":[");
+        bool first = true;
+        int self = Process.GetCurrentProcess().Id;
+        foreach (int pid in JobProcessIds())
+        {
+            if (pid == self)
+            {
+                continue;
+            }
+            try
+            {
+                using (Process p = Process.GetProcessById(pid))
+                {
+                    if (!first)
+                    {
+                        sb.Append(',');
+                    }
+                    first = false;
+                    sb.Append("{\"pid\":").Append(pid.ToString(CultureInfo.InvariantCulture));
+                    sb.Append(",\"name\":").Append(Json(p.ProcessName));
+                    sb.Append(",\"mb\":").Append(Mb((ulong)p.PrivateMemorySize64));
+                    sb.Append(",\"prio\":\"").Append(PriorityName(pid)).Append("\"}");
+                }
+            }
+            catch (Exception)
+            {
+                // The process ended while it was read.
+            }
+        }
+        return sb.Append("]}").ToString();
+    }
+
+    private static List<int> JobProcessIds()
+    {
+        List<int> ids = new List<int>();
+        IntPtr handle = Job();
+        if (handle == IntPtr.Zero)
+        {
+            return ids;
+        }
+        // JOBOBJECT_BASIC_PROCESS_ID_LIST: two counts, then the ids (pointer-sized).
+        int length = 8 + IntPtr.Size * MaxProcesses;
+        IntPtr buffer = Marshal.AllocHGlobal(length);
+        try
+        {
+            if (!NativeMethods.QueryInformationJobObject(handle, JobObjectBasicProcessIdList, buffer, length, IntPtr.Zero))
+            {
+                return ids;
+            }
+            int count = Marshal.ReadInt32(buffer, 4);
+            for (int i = 0; i < count && i < MaxProcesses; i++)
+            {
+                ids.Add((int)Marshal.ReadIntPtr(buffer, 8 + i * IntPtr.Size).ToInt64());
+            }
+        }
+        finally
+        {
+            Marshal.FreeHGlobal(buffer);
+        }
+        return ids;
+    }
+
+    private static string PriorityName(int pid)
+    {
+        IntPtr process = NativeMethods.OpenProcess(ProcessQueryLimited, false, pid);
+        if (process == IntPtr.Zero)
+        {
+            return "normal";
+        }
+        try
+        {
+            uint c = NativeMethods.GetPriorityClass(process);
+            return c == IdleClass ? "idle" : c == BelowNormalClass ? "below" : "normal";
+        }
+        finally
+        {
+            NativeMethods.CloseHandle(process);
+        }
+    }
+
+    /// <summary>Whether pid is a process of the agents' job and not this one: the only ones this program touches.</summary>
+    private static bool Allowed(int pid)
+    {
+        return pid != Process.GetCurrentProcess().Id && JobProcessIds().Contains(pid);
+    }
+
+    private static void ReadCommands()
+    {
+        string line;
+        while ((line = Console.In.ReadLine()) != null)
+        {
+            try
+            {
+                Run(line.Trim().Split(' '));
+            }
+            catch (Exception)
+            {
+                // A bad command is ignored.
+            }
+            if (stop)
+            {
+                return;
+            }
+        }
+        // The daemon is gone: put everything back and end.
+        stop = true;
+    }
+
+    private static void Run(string[] parts)
+    {
+        if (parts.Length == 1 && parts[0] == "exit")
+        {
+            stop = true;
+            return;
+        }
+        int pid;
+        if (parts.Length < 3 || !int.TryParse(parts[1], NumberStyles.Integer, CultureInfo.InvariantCulture, out pid) || !Allowed(pid))
+        {
+            return;
+        }
+        if (parts[0] == "priority")
+        {
+            uint cls = parts[2] == "idle" ? IdleClass : parts[2] == "below" ? BelowNormalClass : NormalClass;
+            IntPtr process = NativeMethods.OpenProcess(ProcessSetInformation, false, pid);
+            if (process != IntPtr.Zero)
+            {
+                NativeMethods.SetPriorityClass(process, cls);
+                NativeMethods.CloseHandle(process);
+            }
+        }
+        else if (parts[0] == "suspend")
+        {
+            int ms;
+            if (!int.TryParse(parts[2], NumberStyles.Integer, CultureInfo.InvariantCulture, out ms) || ms < 1)
+            {
+                return;
+            }
+            Suspend(pid, Math.Min(ms, MaxSuspendMs));
+        }
+    }
+
+    private static void Suspend(int pid, int ms)
+    {
+        lock (Gate)
+        {
+            if (Paused.ContainsKey(pid))
+            {
+                return;
+            }
+            IntPtr process = NativeMethods.OpenProcess(ProcessSuspendResume, false, pid);
+            if (process == IntPtr.Zero)
+            {
+                return;
+            }
+            try
+            {
+                NativeMethods.NtSuspendProcess(process);
+                Paused[pid] = DateTime.UtcNow.AddMilliseconds(ms);
+            }
+            finally
+            {
+                NativeMethods.CloseHandle(process);
+            }
+        }
+    }
+
+    private static void Resume(int pid)
+    {
+        IntPtr process = NativeMethods.OpenProcess(ProcessSuspendResume, false, pid);
+        if (process != IntPtr.Zero)
+        {
+            NativeMethods.NtResumeProcess(process);
+            NativeMethods.CloseHandle(process);
+        }
+    }
+
+    /// <summary>A paused process always comes back: when its time is up (checked every 100 ms).</summary>
+    private static void ResumeWhenDue()
+    {
+        while (true)
+        {
+            Thread.Sleep(100);
+            lock (Gate)
+            {
+                List<int> due = new List<int>();
+                foreach (KeyValuePair<int, DateTime> p in Paused)
+                {
+                    if (p.Value <= DateTime.UtcNow)
+                    {
+                        due.Add(p.Key);
+                    }
+                }
+                foreach (int pid in due)
+                {
+                    Resume(pid);
+                    Paused.Remove(pid);
+                }
+            }
+        }
+    }
+
+    private static void ResumeAll()
+    {
+        lock (Gate)
+        {
+            foreach (int pid in new List<int>(Paused.Keys))
+            {
+                Resume(pid);
+            }
+            Paused.Clear();
+        }
+    }
+
+    private static string Mb(ulong bytes)
+    {
+        return Math.Floor(bytes / BytesPerMb).ToString("0", CultureInfo.InvariantCulture);
+    }
+
+    private static string Json(string value)
+    {
+        StringBuilder sb = new StringBuilder("\"");
+        foreach (char c in value)
+        {
+            if (c == '"' || c == '\\')
+            {
+                sb.Append('\\').Append(c);
+            }
+            else if (c < 0x20)
+            {
+                sb.Append("\\u").Append(((int)c).ToString("x4", CultureInfo.InvariantCulture));
+            }
+            else
+            {
+                sb.Append(c);
+            }
+        }
+        return sb.Append('"').ToString();
+    }
+}