windows-development-sandbox 1.9.0 → 1.10.0

package/dist/runtime/db.js

@@ -26538,16 +26538,17 @@ var ResumeSchema = external_exports.strictObject({
 // src/core/schema/web.ts
 var WebSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "(Beta) Allow the web UI: your sandbox sessions in a browser on this PC. Off by default, and nothing starts it by itself yet: sandbox web start works either way and runs it until sandbox web stop (or a restart of the PC)."
+    "(Beta) The web UI: your sandbox sessions in a browser on this PC (http://127.0.0.1:<port>, this PC only). On: every sandbox start also starts it in the background (it keeps running until sandbox web stop or a restart of the PC). Off: only sandbox web start runs it. Open it signed in with sandbox web open."
   ),
-  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken.")
+  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken."),
+  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts.")
 });
 
 // src/core/schema/vpn.ts
 var VPN_PROVIDERS = ["nordvpn", "openvpn-file", "wireguard-file"];
 var VpnSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
+    "(Alpha: not yet tried on a real PC) Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
   ),
   provider: external_exports.enum(VPN_PROVIDERS).describe(
     "nordvpn: a recommended NordVPN server is picked at every launch. openvpn-file: your own .ovpn file (configFile). wireguard-file: your own WireGuard .conf (configFile), e.g. from your company."
@@ -27439,19 +27440,22 @@ import fs10 from "node:fs";
 import os3 from "node:os";
 import path12 from "node:path";
 import { spawnSync as spawnSync2 } from "node:child_process";
-function exec(file2, args, options = {}) {
-  const result = spawnSync2(file2, args, { stdio: "inherit", windowsHide: true, ...options });
-  if (result.error) throw result.error;
-  if (result.status !== 0)
-    throw new Error(path12.basename(file2) + " " + args.slice(0, 3).join(" ") + " failed with exit code " + result.status);
-}
 async function execAsync(file2, args, options = {}) {
   const code = await spawnAsync(file2, args, { stdio: "inherit", ...options });
   if (code !== 0)
     throw new Error(path12.basename(file2) + " " + args.slice(0, 3).join(" ") + " failed with exit code " + code);
 }
 function runScript(name, args = []) {
-  exec(SYSTEM.powershell(), scriptArgs(name, args));
+  const result = spawnSync2(SYSTEM.powershell(), scriptArgs(name, args), {
+    stdio: ["inherit", "inherit", "pipe"],
+    encoding: "utf8",
+    windowsHide: true
+  });
+  if (result.error) throw result.error;
+  const errors = String(result.stderr ?? "").trim();
+  if (errors) process.stderr.write(errors + "\n");
+  if (result.status !== 0)
+    throw new Error(name + " failed with exit code " + result.status + (errors ? ": " + errors.slice(0, 400) : ""));
 }
 function runScriptWithJson(name, param, data, args = []) {
   const dir = fs10.mkdtempSync(path12.join(os3.tmpdir(), "sbx-"));

package/dist/runtime/main.js

@@ -26595,16 +26595,17 @@ var ResumeSchema = external_exports.strictObject({
 // src/core/schema/web.ts
 var WebSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "(Beta) Allow the web UI: your sandbox sessions in a browser on this PC. Off by default, and nothing starts it by itself yet: sandbox web start works either way and runs it until sandbox web stop (or a restart of the PC)."
+    "(Beta) The web UI: your sandbox sessions in a browser on this PC (http://127.0.0.1:<port>, this PC only). On: every sandbox start also starts it in the background (it keeps running until sandbox web stop or a restart of the PC). Off: only sandbox web start runs it. Open it signed in with sandbox web open."
   ),
-  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken.")
+  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken."),
+  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts.")
 });
 
 // src/core/schema/vpn.ts
 var VPN_PROVIDERS = ["nordvpn", "openvpn-file", "wireguard-file"];
 var VpnSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
+    "(Alpha: not yet tried on a real PC) Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
   ),
   provider: external_exports.enum(VPN_PROVIDERS).describe(
     "nordvpn: a recommended NordVPN server is picked at every launch. openvpn-file: your own .ovpn file (configFile). wireguard-file: your own WireGuard .conf (configFile), e.g. from your company."
@@ -27014,6 +27015,21 @@ function safeRemove(target, root) {
   fs3.rmSync(target, { recursive: true, force: true, maxRetries: 2 });
 }
 
+// src/shared/io/robocopy-result.ts
+function robocopyFailed(code) {
+  return code === null || code >= 8;
+}
+function robocopyMeaning(code) {
+  if (code === null) return "robocopy did not finish";
+  if (code >= 16) return "robocopy stopped with a fatal error (bad path or no access)";
+  if (code >= 8) return code & 1 ? "some files were copied and some could not be" : "files could not be copied";
+  return code === 0 ? "nothing to copy" : "copied";
+}
+function robocopyErrors(output3, max = 3) {
+  const lines = output3.split(/\r?\n/).map((l) => l.trim()).filter((l) => /\bERROR\b/.test(l) || /^The (process|system) cannot/i.test(l));
+  return lines.slice(0, max).map((l) => l.length > 220 ? l.slice(0, 217) + "..." : l);
+}
+
 // src/shared/channel/run-dir.ts
 function safeId(id) {
   return IdSchema.parse(id);
@@ -27596,7 +27612,16 @@ function execOutput(file3, args, options = {}) {
   return result.status === 0 ? String(result.stdout ?? "").trim() : "";
 }
 function runScript(name, args = []) {
-  exec(SYSTEM.powershell(), scriptArgs(name, args));
+  const result = spawnSync(SYSTEM.powershell(), scriptArgs(name, args), {
+    stdio: ["inherit", "inherit", "pipe"],
+    encoding: "utf8",
+    windowsHide: true
+  });
+  if (result.error) throw result.error;
+  const errors = String(result.stderr ?? "").trim();
+  if (errors) process.stderr.write(errors + "\n");
+  if (result.status !== 0)
+    throw new Error(name + " failed with exit code " + result.status + (errors ? ": " + errors.slice(0, 400) : ""));
 }
 function scriptOutput(name, args = [], options = {}) {
   return execOutput(SYSTEM.powershell(), scriptArgs(name, args), options);
@@ -27622,14 +27647,40 @@ function robocopy(from, to, files = []) {
       fs12.copyFileSync(path15.join(from, f), path15.join(to, f));
     return;
   }
-  const what = files.length ? files : ["/E", "/MT:16"];
-  const result = spawnSync(
-    SYSTEM.robocopy(),
-    [from, to, ...what, "/NFL", "/NDL", "/NJH", "/NJS", "/NP", "/R:1", "/W:1", "/XJ"],
-    { stdio: "ignore", windowsHide: true }
+  const what = files.length ? files : ["/E"];
+  const passes = [
+    ["/MT:16", "/R:1", "/W:1"],
+    ["/MT:1", "/R:4", "/W:3"]
+  ];
+  let code = null;
+  let output3 = "";
+  for (const pass of passes) {
+    const result = spawnSync(
+      SYSTEM.robocopy(),
+      [
+        from,
+        to,
+        ...what,
+        ...files.length ? [] : [pass[0]],
+        pass[1],
+        pass[2],
+        "/NFL",
+        "/NDL",
+        "/NJH",
+        "/NJS",
+        "/NP",
+        "/XJ"
+      ],
+      { encoding: "utf8", windowsHide: true }
+    );
+    code = result.status;
+    output3 = String(result.stdout ?? "") + String(result.stderr ?? "");
+    if (!robocopyFailed(code)) return;
+  }
+  const why = robocopyErrors(output3);
+  throw new Error(
+    "robocopy " + from + " -> " + to + " failed (exit " + code + ": " + robocopyMeaning(code) + ")" + (why.length ? ": " + why.join(" | ") : "")
   );
-  if ((result.status ?? 16) >= 8)
-    throw new Error("robocopy " + from + " -> " + to + " failed (exit " + result.status + ")");
 }
 function copyNode(from, to) {
   const work = stagingFolder(to);
@@ -29990,6 +30041,10 @@ var ensureNvm = async () => {
   log("Downloading nvm-windows (" + asset.url.split("/").slice(-2, -1)[0] + ") ...");
   await downloader.archive(asset.url, NVM_HOME, { sha256: asset.sha256, locate: "nvm.exe", fileName: asset.name });
 };
+var hostNodeFolder = (version2) => {
+  const dir = path45.join(hostToolsDir, "node");
+  return session.hostTools.nodeVersion?.replace(/^v/, "") === version2 && exists(path45.join(dir, "node.exe")) ? dir : null;
+};
 var installNodeVersion = async (version2) => {
   const dir = path45.join(NVM_HOME, "v" + version2);
   const fromHost = path45.join(HOST_NVM, "v" + version2);
@@ -29999,6 +30054,12 @@ var installNodeVersion = async (version2) => {
     copyNode(fromHost, dir);
     return;
   }
+  const hostNode = hostNodeFolder(version2);
+  if (hostNode) {
+    log("Copying Node " + version2 + " from this PC (without global packages) ...");
+    copyNode(hostNode, dir);
+    return;
+  }
   log("Downloading Node " + version2 + " (~30 MB once) ...");
   mkdirp(NVM_TEMP);
   let out;
@@ -30007,8 +30068,13 @@ var installNodeVersion = async (version2) => {
   } finally {
     safeRemove(NVM_TEMP, NVM_HOME);
   }
-  if (!exists(path45.join(dir, "node.exe")))
-    throw new Error("nvm install " + version2 + " failed: " + out.trim().split("\n").slice(-2).join(" "));
+  if (!exists(path45.join(dir, "node.exe"))) {
+    const tail2 = out.trim().split(/\r?\n/).filter(Boolean).slice(-3).join(" ");
+    const why = /complete/i.test(out) ? "nvm said it finished, but its move into the data folder did not happen" : "nvm could not download or unpack it: check the internet connection and the free disk space";
+    throw new Error(
+      "nvm install " + version2 + " did not leave " + path45.join(dir, "node.exe") + " (" + why + ")" + (tail2 ? ". nvm printed: " + tail2 : "")
+    );
+  }
 };
 var activate = async (version2) => {
   await nvm(["use", version2]);
@@ -33042,9 +33108,31 @@ function buildFirewallCommands(exemptIps) {
   }
   return commands;
 }
+var ATTACH_RULE = "AgentSandbox-Attach";
+function hasShortName(file3) {
+  return file3.split(/[/\\]/).some((part) => /~\d/.test(part));
+}
+function attachRuleCommands(ptyHostExe) {
+  return [
+    ["advfirewall", "firewall", "delete", "rule", "name=" + ATTACH_RULE],
+    [
+      "advfirewall",
+      "firewall",
+      "add",
+      "rule",
+      "name=" + ATTACH_RULE,
+      "dir=in",
+      "action=allow",
+      "enable=yes",
+      "profile=any",
+      "protocol=tcp",
+      "remoteip=LocalSubnet",
+      "program=" + ptyHostExe
+    ]
+  ];
+}
 
 // src/guest/network/firewall.ts
-var ATTACH_RULE = "AgentSandbox-Attach";
 var netsh = (args) => {
   const r = spawnSync5(SYSTEM.netsh(), args, { encoding: "utf8", windowsHide: true });
   return { status: r.status, out: (r.stdout ?? "") + (r.stderr ?? "") };
@@ -33078,23 +33166,38 @@ var waitForInternet = async (seconds) => {
   }
   return false;
 };
-var attachRule = (ptyHostExe) => [
-  ["advfirewall", "firewall", "delete", "rule", "name=" + ATTACH_RULE],
-  [
-    "advfirewall",
-    "firewall",
-    "add",
-    "rule",
-    "name=" + ATTACH_RULE,
-    "dir=in",
-    "action=allow",
-    "enable=yes",
-    "profile=any",
-    "protocol=tcp",
-    "remoteip=LocalSubnet",
-    "program=" + ptyHostExe
-  ]
-];
+var problems = [];
+function networkProblems() {
+  return problems;
+}
+var longPath = (file3) => {
+  if (!hasShortName(file3)) return file3;
+  try {
+    return fs48.realpathSync.native(file3);
+  } catch {
+    return file3;
+  }
+};
+async function applyAttachRule(ptyHostExe) {
+  if (!session.attach.enabled) return;
+  if (!ptyHostExe) {
+    problems.push("attach: the session host was not built, so the firewall rule for it was not created");
+    warn(problems[problems.length - 1]);
+    return;
+  }
+  let last = "";
+  for (let attempt = 1; attempt <= 3; attempt++) {
+    try {
+      run2(attachRuleCommands(longPath(ptyHostExe)));
+      return;
+    } catch (e) {
+      last = errMsg(e);
+      if (attempt < 3) await new Promise((r) => setTimeout(r, 1e3));
+    }
+  }
+  problems.push("attach: the firewall rule for the session host could not be created (" + last + ")");
+  warn("PROTECTION MISSING: " + problems[problems.length - 1]);
+}
 function run2(commands) {
   for (const c of commands) {
     const r = netsh(c);
@@ -33110,10 +33213,11 @@ async function applyNetworkPolicy(ptyHostExe) {
   const block = session.network.blockPrivateRanges;
   const exempt = block ? discoverExemptIps() : [];
   const lanRules = block ? buildFirewallCommands(exempt) : [];
+  const forwardRules = forwardRule();
   const commands = [
     ...lanRules,
-    ...ptyHostExe && session.attach.enabled ? attachRule(ptyHostExe) : [],
-    ...forwardRule()
+    ...ptyHostExe && session.attach.enabled ? attachRuleCommands(ptyHostExe) : [],
+    ...forwardRules
   ];
   if (isWin && !dryRun) {
     try {
@@ -33139,7 +33243,20 @@ async function applyNetworkPolicy(ptyHostExe) {
   }
   if (commands.length === 0) return "open";
   const online = block ? await waitForInternet(30) : true;
-  run2(commands);
+  const failures = [];
+  try {
+    run2(lanRules);
+  } catch (e) {
+    failures.push(errMsg(e));
+  }
+  await applyAttachRule(ptyHostExe);
+  try {
+    run2(forwardRules);
+  } catch (e) {
+    problems.push("forwardPorts: the firewall rule for the relays could not be created (" + errMsg(e) + ")");
+    warn("PROTECTION MISSING: " + problems[problems.length - 1]);
+  }
+  if (failures.length) throw new Error(failures[0]);
   if (!block) return "open";
   if (online && !await waitForInternet(15)) {
     run2(lanRules.filter((c) => c[2] === "delete"));
@@ -33584,10 +33701,10 @@ function directiveOf(line) {
   return { name: parts2[0].toLowerCase(), args: parts2.slice(1) };
 }
 function inspectOvpn(text) {
-  const problems = [];
+  const problems2 = [];
   const found = [];
   const refuse = (message) => {
-    if (problems.length < 20 && !problems.includes(message)) problems.push(message);
+    if (problems2.length < 20 && !problems2.includes(message)) problems2.push(message);
   };
   if (Buffer.byteLength(text, "utf8") > MAX_OVPN_BYTES) return { ok: false, problems: ["the file is too big"] };
   if (text.includes("\0")) return { ok: false, problems: ["the file is not text"] };
@@ -33635,7 +33752,7 @@ function inspectOvpn(text) {
   if (block) refuse("a <" + block + "> section is never closed");
   if (remotes.length === 0) refuse("it names no remote server");
   if (remotes.length > 64) refuse("it names too many servers");
-  return problems.length ? { ok: false, problems } : { ok: true, remotes };
+  return problems2.length ? { ok: false, problems: problems2 } : { ok: true, remotes };
 }
 function assertSafeOvpn(text, what) {
   const report = inspectOvpn(text);
@@ -33672,9 +33789,9 @@ var inRange = (text, low, high) => {
 };
 var splitList = (text) => text.split(",").map((s) => s.trim()).filter(Boolean);
 function inspectWireguard(text) {
-  const problems = [];
+  const problems2 = [];
   const refuse = (message) => {
-    if (problems.length < 20 && !problems.includes(message)) problems.push(message);
+    if (problems2.length < 20 && !problems2.includes(message)) problems2.push(message);
   };
   if (Buffer.byteLength(text, "utf8") > MAX_WIREGUARD_BYTES) return { ok: false, problems: ["the file is too big"] };
   if (text.includes("\0")) return { ok: false, problems: ["the file is not text"] };
@@ -33716,7 +33833,7 @@ function inspectWireguard(text) {
   if (interfaces.length !== 1) refuse("it needs exactly one [Interface] section");
   if (peers.length === 0) refuse("it has no [Peer] section");
   if (peers.length > MAX_PEERS) refuse("it has too many [Peer] sections");
-  if (problems.length) return { ok: false, problems };
+  if (problems2.length) return { ok: false, problems: problems2 };
   const face = interfaces[0];
   const privateKey = one(face, "privatekey");
   if (!privateKey) refuse("[Interface] has no PrivateKey");
@@ -33763,7 +33880,7 @@ function inspectWireguard(text) {
       ...keepalive !== void 0 ? { keepalive } : {}
     });
   });
-  if (problems.length || !privateKey) return { ok: false, problems };
+  if (problems2.length || !privateKey) return { ok: false, problems: problems2 };
   return {
     ok: true,
     config: {
@@ -34883,6 +35000,7 @@ var Boot = class {
       databases: session.databases ?? [],
       apps: session.apps
     });
+    for (const p of networkProblems()) tools.summary.push("PROTECTION MISSING: " + p);
     if (!dryRun) tools.prepend.push(writeDbCommand());
     Object.assign(tools.vars, proxyEnv());
     await soft("Network: allow only some hosts", async () => {

package/dist/runtime/netproxy.js

@@ -26591,16 +26591,17 @@ var ResumeSchema = external_exports.strictObject({
 // src/core/schema/web.ts
 var WebSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "(Beta) Allow the web UI: your sandbox sessions in a browser on this PC. Off by default, and nothing starts it by itself yet: sandbox web start works either way and runs it until sandbox web stop (or a restart of the PC)."
+    "(Beta) The web UI: your sandbox sessions in a browser on this PC (http://127.0.0.1:<port>, this PC only). On: every sandbox start also starts it in the background (it keeps running until sandbox web stop or a restart of the PC). Off: only sandbox web start runs it. Open it signed in with sandbox web open."
   ),
-  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken.")
+  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken."),
+  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts.")
 });
 
 // src/core/schema/vpn.ts
 var VPN_PROVIDERS = ["nordvpn", "openvpn-file", "wireguard-file"];
 var VpnSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
+    "(Alpha: not yet tried on a real PC) Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
   ),
   provider: external_exports.enum(VPN_PROVIDERS).describe(
     "nordvpn: a recommended NordVPN server is picked at every launch. openvpn-file: your own .ovpn file (configFile). wireguard-file: your own WireGuard .conf (configFile), e.g. from your company."

package/dist/runtime/view.js

@@ -26942,16 +26942,17 @@ var ResumeSchema = external_exports.strictObject({
 // src/core/schema/web.ts
 var WebSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "(Beta) Allow the web UI: your sandbox sessions in a browser on this PC. Off by default, and nothing starts it by itself yet: sandbox web start works either way and runs it until sandbox web stop (or a restart of the PC)."
+    "(Beta) The web UI: your sandbox sessions in a browser on this PC (http://127.0.0.1:<port>, this PC only). On: every sandbox start also starts it in the background (it keeps running until sandbox web stop or a restart of the PC). Off: only sandbox web start runs it. Open it signed in with sandbox web open."
   ),
-  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken.")
+  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken."),
+  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts.")
 });
 
 // src/core/schema/vpn.ts
 var VPN_PROVIDERS = ["nordvpn", "openvpn-file", "wireguard-file"];
 var VpnSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
+    "(Alpha: not yet tried on a real PC) Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
   ),
   provider: external_exports.enum(VPN_PROVIDERS).describe(
     "nordvpn: a recommended NordVPN server is picked at every launch. openvpn-file: your own .ovpn file (configFile). wireguard-file: your own WireGuard .conf (configFile), e.g. from your company."

package/dist/selftest/guest-boot.test.js

@@ -2,7 +2,10 @@
 // what it copies in, and what it refuses to.
 import fs from 'node:fs';
 import path from 'node:path';
-import { readJsonFile } from '../shared/io/index.js';
+import { spawnSync } from 'node:child_process';
+import { copyTreeTolerant, readJsonFile, robocopyErrors, robocopyFailed, robocopyMeaning } from '../shared/io/index.js';
+import { scriptArgs } from '../shared/scripts.js';
+import { SYSTEM } from '../shared/system.js';
 export const guestBootSuite = {
     name: 'guest-boot',
     title: 'guest boot in dry-run mode (provisioning, Claude state, git policy)',
@@ -92,5 +95,48 @@ export const guestBootSuite = {
         const genNoAgent = await f.launch({ noAgent: true });
         const noAgent = await f.runGuest(genNoAgent.launchPath, t.at('data5'), f.workA);
         t.check(noAgent.status === 0 && noAgent.out.includes('no agent requested'), '--no-agent provisions without an agent', noAgent.out);
+        t.section('robocopy results, vanished files, shortcuts');
+        t.check([0, 1, 2, 3, 7].every((c) => !robocopyFailed(c)) &&
+            [8, 9, 16].every((c) => robocopyFailed(c)) &&
+            robocopyFailed(null), 'robocopy: exit codes below 8 are success, 8 and up (9 = some copied, some failed) are failures');
+        t.includes(robocopyMeaning(9), 'some files were copied and some could not be', 'robocopy: exit 9 is explained');
+        t.equal(robocopyErrors('x\r\n2026/10/11 ERROR 32 (0x00000020) Copying File C:\\a\\b.dll\r\nThe process cannot access the file because it is being used by another process.\r\n', 5), [
+            '2026/10/11 ERROR 32 (0x00000020) Copying File C:\\a\\b.dll',
+            'The process cannot access the file because it is being used by another process.',
+        ], 'robocopy: the failing file and the reason are picked out of its output');
+        const spool = t.dir('copy-tree', 'live');
+        t.write(path.join(spool, 'a.json'), '1');
+        t.write(path.join(spool, 'b.json'), '2');
+        t.write(path.join(spool, 'db', 'chroma.sqlite3'), 'db');
+        t.write(path.join(spool, 'db', 'chroma.sqlite3-journal'), 'j');
+        t.write(path.join(spool, 'x.lock'), 'l');
+        const copied = copyTreeTolerant(spool, t.at('copy-tree', 'out'), (name) => /\.lock$|-journal$/.test(name));
+        t.check(copied.copied === 3 && !fs.existsSync(t.at('copy-tree', 'out', 'db', 'chroma.sqlite3-journal')), 'copy tree: files are copied, a -journal and a lock file are left out');
+        // The first file of the listing deletes the second before it is reached: the second has vanished, not failed.
+        const racing = t.dir('copy-tree', 'racing');
+        t.write(path.join(racing, 'a.json'), '1');
+        t.write(path.join(racing, 'b.json'), '2');
+        const result = copyTreeTolerant(racing, t.at('copy-tree', 'racing-out'), (name) => {
+            if (name === 'a.json')
+                fs.rmSync(path.join(racing, 'b.json'), { force: true });
+            return false;
+        });
+        t.check(result.copied === 1 && result.vanished === 1, 'copy tree: a file that vanishes during the copy is skipped, not an error');
+        t.equal(copyTreeTolerant(t.at('copy-tree', 'nothing'), t.at('copy-tree', 'nothing-out')).vanished, 1, 'copy tree: a missing folder is tolerated');
+        if (process.platform === 'win32') {
+            // Windows PowerShell 5.1 hands a JSON array over as one object: two or more shortcuts used to fail.
+            const out = t.dir('shortcuts');
+            const list = t.writeJson(path.join(out, 'in.json'), [
+                { link: path.join(out, 'one', 'A.lnk'), target: path.join(process.env.WINDIR ?? 'C:\\Windows', 'notepad.exe') },
+                { link: path.join(out, 'two', 'B.lnk'), target: path.join(process.env.WINDIR ?? 'C:\\Windows', 'notepad.exe') },
+            ]);
+            const made = spawnSync(SYSTEM.powershell(), scriptArgs('new-shortcuts.ps1', ['-ListFile', list]), {
+                encoding: 'utf8',
+                windowsHide: true,
+            });
+            t.check(made.status === 0 &&
+                fs.existsSync(path.join(out, 'one', 'A.lnk')) &&
+                fs.existsSync(path.join(out, 'two', 'B.lnk')), 'new-shortcuts.ps1 makes every shortcut of a list of two', String(made.stderr));
+        }
     },
 };

package/dist/selftest/heavy-load.test.js

@@ -8,7 +8,7 @@ import { DEFAULTS } from '../core/config/index.js';
 import { isWin } from '../core/util/index.js';
 import { SYSTEM } from '../shared/system.js';
 import { GuestRequestSchema, PressureStatusSchema } from '../shared/channel/index.js';
-import { GUEST_THRESHOLDS, HOST_THRESHOLDS, cargoJobs, effectiveCpuLimit, gentleCpuLimit, } from '../shared/memory/index.js';
+import { GUEST_THRESHOLDS, HOST_THRESHOLDS, cargoJobs, effectiveCpuLimit, gentleCpuLimit, maxCompilers, } from '../shared/memory/index.js';
 import { agentMemoryLimitMb, decideMemory, memoryNote, resolveMemoryMb } from '../host/launch/index.js';
 import { vgpuWarning, GENTLE_NOTE } from '../host/launch/risk-notes.js';
 import { bugcheckCode, cpuPercentBetween, explainStop, findDumps, findingLines, freezeLine, hostPressure, lowReason, pageFileRisk, parseHostMemory, crashReportText, watchdogStep, WATCHDOG_START, } from '../host/life/index.js';
@@ -149,6 +149,22 @@ export const heavyLoadSuite = {
             g.actions.length === 3 &&
             g.actions.every((a) => a.kind === 'priority' && a.to === 'below' && a.pid !== 3), 'compilers start below normal even with plenty of memory (the agent does not)');
         t.check(decide(INITIAL_STATE, sample(14, 50, procs), 0, gentleT, 'gentle').level === 'throttled', '14 % free is pressure');
+        t.section('the compiler cap (vGPU on)');
+        t.check(maxCompilers(16, 'gentle') === 4 && maxCompilers(4, 'gentle') === 2 && maxCompilers(16, 'normal') === null, 'at most max(2, cores / 4) with vGPU, none otherwise');
+        const many = [
+            proc(10, 'rustc.exe', 800),
+            proc(11, 'rustc.exe', 900),
+            proc(12, 'clippy-driver.exe', 700),
+            proc(13, 'link.exe', 100),
+            proc(3, 'claude.exe', 500),
+            proc(14, 'node.exe', 400),
+        ];
+        const capped = decide(INITIAL_STATE, sample(60, 40, many), 0, gentleT, 'gentle', 2);
+        const holds = capped.actions.filter((a) => a.kind === 'hold').map((a) => a.pid);
+        t.check(holds.length === 2 && holds.includes(12) && holds.includes(13), 'the newest compilers beyond the cap wait; the oldest keep running', holds.join(','));
+        t.check(!holds.includes(3) && !holds.includes(14), 'agents and build tools are never held');
+        t.check(decide(INITIAL_STATE, sample(60, 40, many), 0, gentleT, 'gentle', null).actions.every((a) => a.kind !== 'hold'), 'no cap, no holds');
+        t.check(decide(INITIAL_STATE, sample(60, 40, many.slice(0, 2)), 0, gentleT, 'gentle', 2).actions.every((a) => a.kind !== 'hold'), 'under the cap nothing waits');
         t.section('the governor over a port (fake Windows)');
         const calls = [];
         const port = {
@@ -209,6 +225,16 @@ export const heavyLoadSuite = {
         }
         t.check(sent && cpu.low, 'CPU above 95 % for 60 s: asks the sandbox to slow down');
         t.check(!watchdogStep(WATCHDOG_START, input(pc(), 0, 97)).state.low, 'a short CPU peak is nothing');
+        let disk = WATCHDOG_START;
+        let diskSent = false;
+        for (let i = 0; i < 5; i++) {
+            const st = watchdogStep(disk, input(pc({ diskQueue: 40 }), i * 10000));
+            disk = st.state;
+            diskSent = diskSent || st.send;
+        }
+        t.check(diskSent && disk.low, 'a disk queue of 32 or more for 40 s: asks the sandbox to slow down');
+        t.check(!watchdogStep(WATCHDOG_START, input(pc({ diskQueue: 40 }), 0)).state.low, 'a short disk peak is nothing');
+        t.check(!watchdogStep(WATCHDOG_START, input(pc(), 0)).state.low, 'no disk counter: memory and CPU only');
         t.check(cpuPercentBetween([{ times: { user: 0, nice: 0, sys: 0, idle: 0, irq: 0 } }], [{ times: { user: 90, nice: 0, sys: 0, idle: 10, irq: 0 } }]) === 90, 'CPU use from two readings');
         t.check(GuestRequestSchema.safeParse({ kind: 'pressure', id: 'p1', reason: 'low', seconds: 90, createdAt: 'now' })
             .success &&

package/dist/selftest/network.test.js

@@ -1,5 +1,5 @@
 import { isSandboxAddress } from '../host/channel/index.js';
-import { buildFirewallCommands, cidrToRange, ipv4DnsServers, parseDefaultGateways, parseDnsServers, subtractIps, } from '../shared/network/index.js';
+import { attachRuleCommands, hasShortName, buildFirewallCommands, cidrToRange, ipv4DnsServers, parseDefaultGateways, parseDnsServers, subtractIps, } from '../shared/network/index.js';
 import { expandAllowList, hostAllowed, withBlockedHosts } from '../shared/network/index.js';
 export const networkSuite = {
     name: 'network',
@@ -11,6 +11,25 @@ export const networkSuite = {
         const remaining = subtractIps([[start172, end172]], ['172.28.0.1']);
         t.check(remaining.every(([start, end]) => gateway < start || gateway > end), 'the private block minus the gateway no longer contains the gateway');
         t.excludes(buildFirewallCommands(['8.8.8.8']).join(), '8.8.8.8', 'public addresses are not part of the private-range rules');
+        t.section('the attach rule');
+        const exe = 'C:\\Users\\Me\\AppData\\Local\\Temp\\agent-sandbox\\ptyhost-abc.exe';
+        const attach = attachRuleCommands(exe);
+        t.equal(attach[0], ['advfirewall', 'firewall', 'delete', 'rule', 'name=AgentSandbox-Attach'], 'attach: the old rule is deleted first');
+        t.equal(attach[1].slice(2), [
+            'add',
+            'rule',
+            'name=AgentSandbox-Attach',
+            'dir=in',
+            'action=allow',
+            'enable=yes',
+            'profile=any',
+            'protocol=tcp',
+            'remoteip=LocalSubnet',
+            'program=' + exe,
+        ], 'attach: inbound TCP to ptyhost only, from the local subnet only');
+        t.check(hasShortName('C:\\Users\\WDAGUT~1\\AppData\\Local\\Temp\\agent-sandbox\\ptyhost.exe'), 'an 8.3 short path is recognised (netsh cannot resolve it: "The application name could not be resolved")');
+        t.check(!hasShortName('C:\\Users\\WDAGUtilityAccount\\AppData\\Local\\Temp\\ptyhost.exe'), 'a long path is left alone');
+        t.check(!hasShortName('C:\\Users\\a~b\\x.exe'), 'a tilde not followed by a digit is not a short name');
         t.section('reading Windows output');
         t.equal(parseDefaultGateways('  0.0.0.0          0.0.0.0     172.28.80.1   172.28.85.200     5\n'), ['172.28.80.1'], 'the default gateway is read from the route table');
         t.equal(parseDnsServers('   DNS Servers . . . : 172.28.80.1\n                       8.8.8.8\n   NetBIOS : x\n'), ['172.28.80.1', '8.8.8.8'], 'DNS servers are read from ipconfig output');

package/dist/selftest/support/fixtures.d.ts

@@ -257,6 +257,7 @@ export declare function createFixtures(t: Harness): {
         web: {
             enabled: boolean;
             port: number;
+            openOnLaunch: boolean;
         };
         agentCommands: {
             enabled: boolean;

package/dist/shared/io/copy-tree.d.ts

@@ -0,0 +1,7 @@
+export interface CopyTreeResult {
+    readonly copied: number;
+    /** Files (or folders) that were gone by the time they were reached. */
+    readonly vanished: number;
+}
+/** Copies `from` into `to`; `skip(name)` leaves out files by name. Any error except "no such file" is thrown. */
+export declare function copyTreeTolerant(from: string, to: string, skip?: (name: string) => boolean): CopyTreeResult;

package/dist/shared/io/copy-tree.js

@@ -0,0 +1,45 @@
+// Copies a folder that something else is still writing to: a file that disappears between the listing and the copy
+// (a spool file the agent's hook just consumed, a SQLite journal that was committed) is skipped, not an error.
+import fs from 'node:fs';
+import path from 'node:path';
+const isGone = (e) => e?.code === 'ENOENT';
+/** Copies `from` into `to`; `skip(name)` leaves out files by name. Any error except "no such file" is thrown. */
+export function copyTreeTolerant(from, to, skip = () => false) {
+    let copied = 0;
+    let vanished = 0;
+    const walk = (src, dest) => {
+        fs.mkdirSync(dest, { recursive: true });
+        let entries;
+        try {
+            entries = fs.readdirSync(src, { withFileTypes: true });
+        }
+        catch (e) {
+            if (!isGone(e))
+                throw e;
+            vanished++;
+            return;
+        }
+        for (const entry of entries) {
+            if (skip(entry.name))
+                continue;
+            const source = path.join(src, entry.name);
+            const target = path.join(dest, entry.name);
+            try {
+                if (entry.isDirectory())
+                    walk(source, target);
+                else if (entry.isFile()) {
+                    fs.copyFileSync(source, target);
+                    copied++;
+                }
+            }
+            catch (e) {
+                if (!isGone(e))
+                    throw e;
+                vanished++;
+                fs.rmSync(target, { force: true });
+            }
+        }
+    };
+    walk(from, to);
+    return { copied, vanished };
+}