windows-development-sandbox 1.9.0 → 1.11.3

package/dist/guest/runtime/process.js

@@ -4,6 +4,7 @@ import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { moveIntoPlace, spawnAsync, stagingFolder } from '../../shared/download/index.js';
 import { safeRemove } from '../../shared/io/safe-remove.js';
+import { robocopyErrors, robocopyFailed, robocopyMeaning } from '../../shared/io/robocopy-result.js';
 import { SYSTEM } from '../../shared/system.js';
 import { scriptArgs } from '../../shared/scripts.js';
 import { isWin } from './paths.js';
@@ -27,7 +28,18 @@ export function execOutput(file, args, options = {}) {
 }
 /** Runs sandbox\scripts\<name> (a .ps1 in the launch folder) with `args`; throws when it fails. */
 export function runScript(name, args = []) {
-    exec(SYSTEM.powershell(), scriptArgs(name, args));
+    const result = spawnSync(SYSTEM.powershell(), scriptArgs(name, args), {
+        stdio: ['inherit', 'inherit', 'pipe'],
+        encoding: 'utf8',
+        windowsHide: true,
+    });
+    if (result.error)
+        throw result.error;
+    const errors = String(result.stderr ?? '').trim();
+    if (errors)
+        process.stderr.write(errors + '\n');
+    if (result.status !== 0)
+        throw new Error(name + ' failed with exit code ' + result.status + (errors ? ': ' + errors.slice(0, 400) : ''));
 }
 /** runScript for what it prints ('' when it fails). */
 export function scriptOutput(name, args = [], options = {}) {
@@ -59,10 +71,46 @@ export function robocopy(from, to, files = []) {
             fs.copyFileSync(path.join(from, f), path.join(to, f));
         return;
     }
-    const what = files.length ? files : ['/E', '/MT:16'];
-    const result = spawnSync(SYSTEM.robocopy(), [from, to, ...what, '/NFL', '/NDL', '/NJH', '/NJS', '/NP', '/R:1', '/W:1', '/XJ'], { stdio: 'ignore', windowsHide: true });
-    if ((result.status ?? 16) >= 8)
-        throw new Error('robocopy ' + from + ' -> ' + to + ' failed (exit ' + result.status + ')');
+    const what = files.length ? files : ['/E'];
+    // A second pass for what the first could not copy (a file another program holds open for a moment, a busy mapped
+    // folder): one thread and more patience; robocopy skips what is already in place.
+    const passes = [
+        ['/MT:16', '/R:1', '/W:1'],
+        ['/MT:1', '/R:4', '/W:3'],
+    ];
+    let code = null;
+    let output = '';
+    for (const pass of passes) {
+        const result = spawnSync(SYSTEM.robocopy(), [
+            from,
+            to,
+            ...what,
+            ...(files.length ? [] : [pass[0]]),
+            pass[1],
+            pass[2],
+            '/NFL',
+            '/NDL',
+            '/NJH',
+            '/NJS',
+            '/NP',
+            '/XJ',
+        ], { encoding: 'utf8', windowsHide: true });
+        code = result.status;
+        output = String(result.stdout ?? '') + String(result.stderr ?? '');
+        if (!robocopyFailed(code))
+            return;
+    }
+    const why = robocopyErrors(output);
+    throw new Error('robocopy ' +
+        from +
+        ' -> ' +
+        to +
+        ' failed (exit ' +
+        code +
+        ': ' +
+        robocopyMeaning(code) +
+        ')' +
+        (why.length ? ': ' + why.join(' | ') : ''));
 }
 /**
  * A Node install without its global packages (nvm keeps those per version: often tens of thousands of small files,

package/dist/guest/sessions/viewer.js

@@ -1,5 +1,6 @@
 import { connect, runTerminalClient } from '../../shared/pty/index.js';
 import { run } from '../runtime/paths.js';
+import { session as sandboxSession } from '../runtime/session.js';
 /**
  * A session that is still being set up (its project provisioning, its agent installing): show the progress until it
  * runs.
@@ -32,7 +33,10 @@ export async function viewSession(id) {
     const socket = await connect({ ...session.attach, addresses: ['127.0.0.1'] });
     // The sandbox's own terminal: a copy in the agent reaches the sandbox's clipboard (and yours only through
     // sandbox.clipboard, which already shares it).
-    const result = await runTerminalClient(socket, session.attach.token, { clipboardWrites: true });
+    const result = await runTerminalClient(socket, session.attach.token, {
+        clipboardWrites: true,
+        confirmCtrlC: sandboxSession.attach.confirmCtrlC !== false,
+    });
     if (result.reason === 'exit')
         console.log(session.harness + ' exited with code ' + result.exitCode + '.');
     else if (result.reason === 'error')

package/dist/guest/setup/claude-mem.js

@@ -6,6 +6,7 @@ import { dryRun } from '../runtime/paths.js';
 import { exists, mkdirp } from '../runtime/fs.js';
 import { log, warn } from '../runtime/log.js';
 import { robocopy } from '../runtime/process.js';
+import { copyTreeTolerant } from '../../shared/io/copy-tree.js';
 /**
  * claude-mem keeps SQLite + a vector store. They run from the sandbox's own disk (SQLite and mapped folders do not
  * mix) and are mirrored to persistent storage, from where the host syncs them back to your PC.
@@ -49,8 +50,13 @@ const databaseFingerprint = (dir) => {
             if (entry.isDirectory())
                 walk(full);
             else if (entry.isFile() && /\.(db|sqlite3?)(-wal)?$/i.test(entry.name)) {
-                const s = fs.statSync(full);
-                parts.push(full + ':' + s.size + ':' + s.mtimeMs);
+                try {
+                    const s = fs.statSync(full);
+                    parts.push(full + ':' + s.size + ':' + s.mtimeMs);
+                }
+                catch {
+                    // Gone since the listing (a database being replaced): left out, the next save looks again.
+                }
             }
         }
     };
@@ -116,8 +122,10 @@ export function saveClaudeMem() {
     const incoming = store + '.incoming';
     const previous = store + '.previous';
     fs.rmSync(incoming, { recursive: true, force: true });
-    // The database, its -wal and -shm files are copied together, so the copy is consistent with itself.
-    fs.cpSync(local, incoming, { recursive: true, filter: (src) => !/\.(pid|lock)$/i.test(src) });
+    // The database and its -wal are copied together, so the copy is consistent with itself. A -journal is never copied:
+    // beside a database taken at another moment it would be rolled back over it. The -shm is rebuilt by SQLite. Files the
+    // agent removes while this runs (hook spool files) are skipped.
+    copyTreeTolerant(local, incoming, (name) => /\.(pid|lock)$|-journal$|-shm$/i.test(name));
     // Swap without a window where no copy exists: old aside, new in, then keep the old one as a dated backup.
     fs.rmSync(previous, { recursive: true, force: true });
     if (exists(store))

package/dist/guest/setup/github-token.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Before the tools are set up: the folder gh uses for a handed-over token exists only when one arrived (gh's setup
+ * points GH_CONFIG_DIR at it while it exists). Without one, gh keeps the login you made in the sandbox.
+ */
+export declare function prepareGithubFolder(token: string | undefined): boolean;
+/** gh logs in with the token (stdin) in the sandbox-only folder, then https git to github.com asks gh. */
+export declare function loginGithub(token: string, env: NodeJS.ProcessEnv): void;

package/dist/guest/setup/github-token.js

@@ -0,0 +1,65 @@
+// The GitHub token the host handed over (github.shareToken, only with git access "full"): gh logs in with it in a
+// folder on the sandbox's own disk (gone with the sandbox, never in the persistent state), and https git asks gh. The
+// token goes to gh on stdin, never in an argument, a file of ours or a log line.
+import fs from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { ghLoginCommand, ghOutputText, ghSetupGitCommand } from '../../shared/github/index.js';
+import { deliveredGhConfigDir, ghConfigDir, ghExePath } from '../toolchains/tools/cli.js';
+import { addMachineEnvironment } from './environment.js';
+import { dryRun } from '../runtime/paths.js';
+import { exists, mkdirp } from '../runtime/fs.js';
+import { log } from '../runtime/log.js';
+const GH_TIMEOUT_MS = 60_000;
+/**
+ * Before the tools are set up: the folder gh uses for a handed-over token exists only when one arrived (gh's setup
+ * points GH_CONFIG_DIR at it while it exists). Without one, gh keeps the login you made in the sandbox.
+ */
+export function prepareGithubFolder(token) {
+    const dir = deliveredGhConfigDir();
+    fs.rmSync(dir, { recursive: true, force: true });
+    if (!token)
+        return false;
+    mkdirp(dir);
+    return true;
+}
+function runGh(command, token, what) {
+    const result = spawnSync(command.file, [...command.args], {
+        env: command.env,
+        encoding: 'utf8',
+        windowsHide: true,
+        timeout: GH_TIMEOUT_MS,
+        stdio: ['pipe', 'pipe', 'pipe'],
+        ...(command.input !== undefined ? { input: command.input } : {}),
+    });
+    if (result.error)
+        throw new Error(what + ' could not run: ' + ghOutputText(result.error.message, token));
+    if (result.status !== 0)
+        throw new Error(what + ' failed: ' + ghOutputText(String(result.stderr ?? '') || String(result.stdout ?? ''), token));
+}
+/** gh logs in with the token (stdin) in the sandbox-only folder, then https git to github.com asks gh. */
+export function loginGithub(token, env) {
+    if (dryRun) {
+        log('(dry run) would log gh in with the GitHub token from your PC');
+        return;
+    }
+    const gh = ghExePath();
+    const dir = deliveredGhConfigDir();
+    if (!exists(gh) || env.GH_CONFIG_DIR !== dir) {
+        // Gone again, so gh set up later (a project added afterwards) keeps the login you make in the sandbox.
+        fs.rmSync(dir, { recursive: true, force: true });
+        log('A GitHub token arrived, but gh is not set up in this sandbox (toolchains.cli.gh), so it is not used.');
+        return;
+    }
+    try {
+        runGh(ghLoginCommand(gh, dir, token, env), token, 'gh auth login');
+        runGh(ghSetupGitCommand(gh, dir, env), token, 'gh auth setup-git');
+    }
+    catch (e) {
+        // gh goes back to the persistent folder (and a `gh auth login` you make inside is kept), for every session.
+        fs.rmSync(dir, { recursive: true, force: true });
+        env.GH_CONFIG_DIR = mkdirp(ghConfigDir());
+        addMachineEnvironment({ GH_CONFIG_DIR: env.GH_CONFIG_DIR }, []);
+        throw e;
+    }
+    log('gh and https git to github.com use the GitHub token from your PC (github.shareToken); the agent can read it.');
+}

package/dist/guest/toolchains/languages/node.js

@@ -14,6 +14,7 @@ import { arch, tool } from '../tool-env.js';
 import { installOnce } from '../package-ledger.js';
 import { resolveCached } from '../version-cache.js';
 import { duringSession } from '../../runtime/project-context.js';
+import { session } from '../../runtime/session.js';
 import { pickNodeVersion, pickSpreadVersions } from '../../../core/detect/versions.js';
 const NVM_HOME = tool('nvm');
 const NVM_SYMLINK = path.join(localDir, 'nodejs');
@@ -73,7 +74,14 @@ const ensureNvm = async () => {
     log('Downloading nvm-windows (' + asset.url.split('/').slice(-2, -1)[0] + ') ...');
     await downloader.archive(asset.url, NVM_HOME, { sha256: asset.sha256, locate: 'nvm.exe', fileName: asset.name });
 };
-/** A Node version: from the host's nvm when it has it (fast, offline), else `nvm install`. */
+/** This PC's own Node folder (mapped read-only), when it is exactly this version. */
+const hostNodeFolder = (version) => {
+    const dir = path.join(hostToolsDir, 'node');
+    return session.hostTools.nodeVersion?.replace(/^v/, '') === version && exists(path.join(dir, 'node.exe'))
+        ? dir
+        : null;
+};
+/** A Node version: from the host's nvm or Node when it has it (fast, offline), else `nvm install`. */
 const installNodeVersion = async (version) => {
     const dir = path.join(NVM_HOME, 'v' + version);
     const fromHost = path.join(HOST_NVM, 'v' + version);
@@ -84,6 +92,12 @@ const installNodeVersion = async (version) => {
         copyNode(fromHost, dir);
         return;
     }
+    const hostNode = hostNodeFolder(version);
+    if (hostNode) {
+        log('Copying Node ' + version + ' from this PC (without global packages) ...');
+        copyNode(hostNode, dir);
+        return;
+    }
     log('Downloading Node ' + version + ' (~30 MB once) ...');
     mkdirp(NVM_TEMP);
     let out;
@@ -93,8 +107,20 @@ const installNodeVersion = async (version) => {
     finally {
         safeRemove(NVM_TEMP, NVM_HOME);
     }
-    if (!exists(path.join(dir, 'node.exe')))
-        throw new Error('nvm install ' + version + ' failed: ' + out.trim().split('\n').slice(-2).join(' '));
+    if (!exists(path.join(dir, 'node.exe'))) {
+        const tail = out.trim().split(/\r?\n/).filter(Boolean).slice(-3).join(' ');
+        const why = /complete/i.test(out)
+            ? 'nvm said it finished, but its move into the data folder did not happen'
+            : 'nvm could not download or unpack it: check the internet connection and the free disk space';
+        throw new Error('nvm install ' +
+            version +
+            ' did not leave ' +
+            path.join(dir, 'node.exe') +
+            ' (' +
+            why +
+            ')' +
+            (tail ? '. nvm printed: ' + tail : ''));
+    }
 };
 const activate = async (version) => {
     await nvm(['use', version]);
@@ -103,6 +129,15 @@ const activate = async (version) => {
     fs.rmSync(NVM_SYMLINK, { recursive: true, force: true });
     fs.symlinkSync(path.join(NVM_HOME, 'v' + version), NVM_SYMLINK, 'junction');
 };
+/**
+ * Playwright works in every sandbox without setup: the browsers `npx playwright install` downloads go in the tools
+ * folder, so they last between sandboxes, and its MCP server (and `channel: 'msedge'` in tests) uses Edge, the one
+ * browser Windows Sandbox always has (Chrome is not there).
+ */
+const PLAYWRIGHT_VARS = () => ({
+    PLAYWRIGHT_BROWSERS_PATH: tool('ms-playwright'),
+    PLAYWRIGHT_MCP_BROWSER: 'msedge',
+});
 export async function setupNode(env, versions, config) {
     if (dryRun) {
         log('(dry run) would provision nvm and Node ' + versions.node.spec + ' (from ' + versions.node.source + ')');
@@ -136,7 +171,7 @@ export async function setupNode(env, versions, config) {
             warn('Node ' + version + ' from this PC: ' + errMsg(e));
         }
     }
-    Object.assign(env.vars, { NVM_HOME, NVM_SYMLINK });
+    Object.assign(env.vars, { NVM_HOME, NVM_SYMLINK, ...PLAYWRIGHT_VARS() });
     // At boot, nvm's symlink selects the version. A project added later must not switch it under the sessions already
     // running: its own version's folder goes first on its sessions' PATH instead.
     if (duringSession())
@@ -146,6 +181,7 @@ export async function setupNode(env, versions, config) {
         env.prepend.push(NVM_HOME, NVM_SYMLINK);
     }
     env.summary.push('node: ' + main + ' (from ' + versions.node.source + ', switch with nvm use)');
+    env.summary.push("playwright: ready (Edge; browsers it downloads are kept; in tests use channel: 'msedge')");
     await packageManagers(env, config, main);
 }
 /** Global npm packages (per Node version, like nvm keeps them) and pnpm/yarn through corepack. */

package/dist/guest/toolchains/native/rust-extras.js

@@ -7,7 +7,7 @@ import { execOutput } from '../../runtime/process.js';
 import { ensureCompiled } from '../../runtime/csc.js';
 import { arch, tool } from '../tool-env.js';
 import { wanted } from '../detect.js';
-import { cargoJobs } from '../../../shared/memory/index.js';
+import { cargoJobs, linkSlotsFor } from '../../../shared/memory/index.js';
 /**
  * Where cargo builds: shared with the PC's target\, one on the sandbox's disk, or a path. "separate" sets no variable:
  * the cargo shim (sandbox/csharp/CargoShim.cs) gives every checkout its own target\sandbox, so git worktrees of several
@@ -41,7 +41,7 @@ export function linkGate(env, rust, host) {
     const gate = path.join(mkdirp(tool('shims')), 'linkgate.exe');
     fs.copyFileSync(ensureCompiled('linkgate'), gate);
     const memoryGb = os.totalmem() / 1024 ** 3;
-    const slots = rust.linkSlots === 'auto' ? Math.max(2, Math.min(4, Math.floor(memoryGb / 8))) : rust.linkSlots;
+    const slots = rust.linkSlots === 'auto' ? linkSlotsFor(memoryGb) : rust.linkSlots;
     env.vars.AGENT_LINK_SLOTS = String(slots);
     env.vars.AGENT_REAL_LINKER = gcc;
     env.vars.CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER = gate;

package/dist/guest/toolchains/tools/cli.d.ts

@@ -3,6 +3,14 @@ import { type CliSettings } from '../catalogue.js';
 import { type ToolEnv } from '../tool-env.js';
 /** gh keeps `gh auth login` here, under the agent state (persists like Claude's login; never copied from the PC). */
 export declare function ghConfigDir(): string;
+/**
+ * gh's folder for the token the host handed over (github.shareToken): on the sandbox's own disk, so it is gone with the
+ * sandbox and never reaches the persistent state other sandboxes and projects share. The boot creates it only when a
+ * token arrived; while it exists, every gh setup (later projects too) points GH_CONFIG_DIR at it.
+ */
+export declare function deliveredGhConfigDir(): string;
+/** gh.exe where the catalogue installs it. */
+export declare function ghExePath(): string;
 /**
  * Installs the tools toolchains.cli asks for. Settings still "auto" here (normally the host decides) use the same
  * rules on the workspace as the host would. The gh rule is enforced here again, whatever the host sent.

package/dist/guest/toolchains/tools/cli.js

@@ -2,7 +2,7 @@
 // `openssl` shim onto the copy Git for Windows already ships.
 import fs from 'node:fs';
 import path from 'node:path';
-import { dryRun } from '../../runtime/paths.js';
+import { dryRun, localDir } from '../../runtime/paths.js';
 import { exists, mkdirp } from '../../runtime/fs.js';
 import { log, warn } from '../../runtime/log.js';
 import { stateDir } from '../../runtime/session.js';
@@ -16,9 +16,23 @@ import { ensureCompiled } from '../../runtime/csc.js';
 export function ghConfigDir() {
     return path.join(stateDir, 'gh');
 }
+/**
+ * gh's folder for the token the host handed over (github.shareToken): on the sandbox's own disk, so it is gone with the
+ * sandbox and never reaches the persistent state other sandboxes and projects share. The boot creates it only when a
+ * token arrived; while it exists, every gh setup (later projects too) points GH_CONFIG_DIR at it.
+ */
+export function deliveredGhConfigDir() {
+    return path.join(localDir, 'gh-token');
+}
+/** gh.exe where the catalogue installs it. */
+export function ghExePath() {
+    const entry = CLI_TOOLS.find((t) => t.name === 'gh');
+    const dir = tool('cli', 'gh');
+    return path.join(entry?.subdir ? path.join(dir, entry.subdir) : dir, entry?.exe ?? 'gh.exe');
+}
 const toolVars = {
     gh: () => ({
-        GH_CONFIG_DIR: mkdirp(ghConfigDir()),
+        GH_CONFIG_DIR: exists(deliveredGhConfigDir()) ? deliveredGhConfigDir() : mkdirp(ghConfigDir()),
         GH_NO_UPDATE_NOTIFIER: '1',
         GH_NO_EXTENSION_UPDATE_NOTIFIER: '1',
     }),

package/dist/guest/vpn/openvpn.d.ts

@@ -5,5 +5,10 @@ export declare function openvpnDownload(arch?: string): {
     sha256: string;
     url: string;
 };
+/**
+ * Windows Sandbox cannot answer WMI questions about services (a class whose provider is missing), and installers that
+ * ask (OpenVPN's MSI does) fail with 1603: the dead class is removed first (repair-wmi-services.ps1). Never throws.
+ */
+export declare function repairServiceQueries(): void;
 /** Installs OpenVPN unless it is there; returns the path of openvpn.exe. Throws with the reason when it cannot. */
 export declare function ensureOpenVpn(): Promise<string>;

package/dist/guest/vpn/openvpn.js

@@ -8,7 +8,8 @@ import { downloader, spawnAsync } from '../../shared/download/index.js';
 import { SYSTEM } from '../../shared/system.js';
 import { dryRun, isWin, toolsDir } from '../runtime/paths.js';
 import { exists, mkdirp } from '../runtime/fs.js';
-import { log } from '../runtime/log.js';
+import { log, warn } from '../runtime/log.js';
+import { scriptOutput } from '../runtime/process.js';
 import { OPENVPN_MSI } from '../../shared/vpn/download.js';
 /** Where the MSI puts the program. */
 export function openvpnExe(env = process.env) {
@@ -18,6 +19,17 @@ export function openvpnDownload(arch = process.arch) {
     const entry = arch === 'arm64' ? OPENVPN_MSI.arm64 : OPENVPN_MSI.x64;
     return { ...entry, url: OPENVPN_MSI.base + entry.file };
 }
+/**
+ * Windows Sandbox cannot answer WMI questions about services (a class whose provider is missing), and installers that
+ * ask (OpenVPN's MSI does) fail with 1603: the dead class is removed first (repair-wmi-services.ps1). Never throws.
+ */
+export function repairServiceQueries() {
+    const did = scriptOutput('repair-wmi-services.ps1');
+    if (did === 'removed')
+        log('VPN: repaired the Windows service queries installers use (a Windows Sandbox gap).');
+    else if (did !== 'absent' && did !== 'kept')
+        warn('VPN: could not check the Windows service queries installers use.');
+}
 const hasHash = (file, sha256) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex') === sha256;
 /** Installs OpenVPN unless it is there; returns the path of openvpn.exe. Throws with the reason when it cannot. */
 export async function ensureOpenVpn() {
@@ -33,6 +45,7 @@ export async function ensureOpenVpn() {
         log('VPN: downloading OpenVPN ' + OPENVPN_MSI.version + ' (about 6 MB)');
         await downloader.file(dl.url, msi, dl.sha256);
     }
+    repairServiceQueries();
     log('VPN: installing OpenVPN');
     const logFile = path.join(toolsDir, 'downloads', 'openvpn-install.log');
     const code = await spawnAsync(SYSTEM.msiexec(), ['/i', msi, '/qn', '/norestart', '/l*v', logFile], {

package/dist/guest/vpn/vpn.js

@@ -4,6 +4,7 @@
 // warns.
 import dns from 'node:dns';
 import fs from 'node:fs';
+import net from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
 import { now } from '../../shared/channel/run-dir.js';
@@ -13,7 +14,7 @@ import { assertSafeWireguard, renderWireguard, routesEverything, wireguardEndpoi
 import { isIPv4 } from '../../shared/network/firewall-rules.js';
 import { killSwitchCommands, tunnelCommands } from '../../shared/vpn/kill-switch.js';
 import { errMsg } from '../../core/util/errors.js';
-import { run as netsh } from '../network/firewall.js';
+import { longPath, run as netsh } from '../network/firewall.js';
 import { dryRun, isWin, launchDir, run } from '../runtime/paths.js';
 import { log, warn } from '../runtime/log.js';
 import { session } from '../runtime/session.js';
@@ -74,6 +75,27 @@ async function publicAddress() {
     }
 }
 const hasAdapter = (ip) => Object.values(os.networkInterfaces()).some((list) => (list ?? []).some((i) => i.address === ip));
+/** Well-known public addresses a direct connection is tried to, to see that the kill switch holds. */
+const PROBE_TARGETS = ['1.1.1.1', '8.8.8.8', '9.9.9.9'];
+const PROBE_TIMEOUT_MS = 3000;
+function connects(ip, port) {
+    return new Promise((resolve) => {
+        const socket = net.connect({ host: ip, port });
+        const done = (ok) => {
+            socket.destroy();
+            resolve(ok);
+        };
+        socket.setTimeout(PROBE_TIMEOUT_MS, () => done(false));
+        socket.once('connect', () => done(true));
+        socket.once('error', () => done(false));
+    });
+}
+/** True when a direct connection out (before the tunnel exists) fails: the kill switch holds. */
+async function directConnectionBlocked(servers) {
+    const targets = PROBE_TARGETS.filter((ip) => !servers.some((s) => s.ip === ip));
+    const results = await Promise.all(targets.map((ip) => connects(ip, 443)));
+    return !results.some(Boolean);
+}
 /** The whole step. Returns true when the tunnel is up. */
 export async function setupVpn(secrets, ptyHostExe) {
     const vpn = session.vpn;
@@ -81,11 +103,24 @@ export async function setupVpn(secrets, ptyHostExe) {
         return true;
     const killSwitch = vpn.killSwitch;
     let blocked = false;
-    const block = (servers) => {
-        if (isWin && !dryRun)
-            netsh(killSwitchCommands(servers, ptyHostExe));
-        blocked = true;
-        log('VPN: kill switch on: nothing leaves the sandbox except through the tunnel.');
+    /** A direct connection was tried after the kill switch and failed: only then is the sandbox said to be offline. */
+    let held = false;
+    const block = async (servers) => {
+        if (!isWin || dryRun) {
+            blocked = held = true;
+            return;
+        }
+        try {
+            netsh(killSwitchCommands(servers, ptyHostExe ? longPath(ptyHostExe) : null));
+        }
+        finally {
+            blocked = true;
+            held = await directConnectionBlocked(servers);
+        }
+        if (held)
+            log('VPN: kill switch on: nothing leaves the sandbox except through the tunnel (checked).');
+        else
+            warn('VPN: the kill switch did not hold: a direct connection still got out. If the tunnel drops, traffic leaves through your normal connection.');
     };
     setVpnStatus('starting', 'Starting the VPN');
     try {
@@ -103,7 +138,7 @@ export async function setupVpn(secrets, ptyHostExe) {
             if (killSwitch && !routesEverything(config))
                 warn('VPN: AllowedIPs does not include 0.0.0.0/0: with the kill switch on, only the tunnel traffic can leave the sandbox.');
             if (killSwitch)
-                block(servers);
+                await block(servers);
             if (dryRun || !isWin) {
                 log('(dry run) would start the WireGuard tunnel ' + vpn.server);
                 setVpnStatus('off', 'dry run');
@@ -129,7 +164,7 @@ export async function setupVpn(secrets, ptyHostExe) {
             if (servers.length === 0)
                 throw new Error('the VPN server addresses could not be found');
             if (killSwitch)
-                block(servers);
+                await block(servers);
             if (dryRun || !isWin) {
                 log('(dry run) would start the VPN tunnel to ' + vpn.server);
                 setVpnStatus('off', 'dry run');
@@ -149,7 +184,10 @@ export async function setupVpn(secrets, ptyHostExe) {
             throw new Error('the tunnel reported it was up, but no network adapter with its address appeared');
         const publicIp = await publicAddress();
         log('VPN: up' + (publicIp ? ' (the sandbox appears as ' + publicIp + ')' : '') + '.');
-        setVpnStatus('up', 'The tunnel is up', publicIp ? { publicIp } : {});
+        setVpnStatus('up', 'The tunnel is up', {
+            ...(publicIp ? { publicIp } : {}),
+            ...(killSwitch ? { killSwitchHeld: held } : {}),
+        });
         return true;
     }
     catch (e) {
@@ -157,18 +195,19 @@ export async function setupVpn(secrets, ptyHostExe) {
         // Without the kill switch the sandbox keeps its normal connection: the rest of the boot goes on, with a warning.
         try {
             if (killSwitch && !blocked)
-                block([]);
+                await block([]);
         }
         catch (blockError) {
             warn('VPN: could not close the network after the failure: ' + errMsg(blockError));
         }
-        const text = 'VPN failed: ' +
-            reason +
-            (killSwitch
+        // "No internet" is said only when a direct connection was tried and failed.
+        const after = !killSwitch
+            ? ' The kill switch is off, so this sandbox is using your normal connection.'
+            : held
                 ? ' The kill switch is on, so this sandbox has NO internet access.'
-                : ' The kill switch is off, so this sandbox is using your normal connection.');
-        warn(text);
-        setVpnStatus('failed', reason);
+                : ' The kill switch could NOT close the network, so this sandbox is ONLINE through your normal connection, without the VPN.';
+        warn('VPN failed: ' + reason + after);
+        setVpnStatus('failed', reason, killSwitch ? { killSwitchHeld: held } : {});
         return false;
     }
 }

package/dist/guest/vpn/wireguard.js

@@ -14,6 +14,7 @@ import { handshakeDone, serviceRunning } from '../../shared/vpn/wireguard.js';
 import { dryRun, isWin, toolsDir } from '../runtime/paths.js';
 import { exists, mkdirp } from '../runtime/fs.js';
 import { log } from '../runtime/log.js';
+import { repairServiceQueries } from './openvpn.js';
 /** The tunnel's name: the config file is sandbox.conf and the Windows service WireGuardTunnel$sandbox. */
 export const WIREGUARD_TUNNEL = 'sandbox';
 export function wireguardDir(env = process.env) {
@@ -41,6 +42,7 @@ export async function ensureWireguard() {
         log('VPN: downloading WireGuard ' + WIREGUARD_MSI.version + ' (about 3 MB)');
         await downloader.file(dl.url, msi, dl.sha256);
     }
+    repairServiceQueries();
     log('VPN: installing WireGuard');
     const logFile = path.join(toolsDir, 'downloads', 'wireguard-install.log');
     // DO_NOT_LAUNCH: the installer would otherwise start the manager window.

package/dist/host/channel/attach.d.ts

@@ -18,4 +18,5 @@ export declare function findUnwatchedSession(dataPath: string, harness: string,
 /** Bridges this terminal to a session. Returns the agent's exit code, or 0 when the user detaches. */
 export declare function attachTerminal(session: SessionStatus, o?: {
     clipboardWrites?: boolean;
+    confirmCtrlC?: boolean;
 }): Promise<number>;

package/dist/host/channel/attach.js

@@ -74,6 +74,7 @@ export async function attachTerminal(session, o = {}) {
     const result = await runTerminalClient(socket, session.attach.token, {
         detachKey: DETACH_KEY,
         clipboardWrites: o.clipboardWrites,
+        confirmCtrlC: o.confirmCtrlC,
     });
     switch (result.reason) {
         case 'detach':

package/dist/host/channel/channel.d.ts

@@ -47,7 +47,7 @@ export declare class SandboxChannel {
     /** Restarts running sessions in place (they resume via the harness's resumeArguments, e.g. claude --continue). */
     restart(harness: string | null, cwd?: string): Promise<GuestResponse>;
     /** The PC is low on memory or CPU: the sandbox slows its builds down for `seconds`. Never waits for an answer. */
-    pressure(reason: string, seconds: number): void;
+    pressure(reason: string, seconds: number, level?: 'slow' | 'severe'): void;
     ping(): Promise<GuestResponse>;
     runningSessions(): SessionStatus[];
     /** Running sessions of the sandbox that is running now (its launch id), newest last, capped. */

package/dist/host/channel/channel.js

@@ -180,8 +180,8 @@ export class SandboxChannel {
         return this.waitForResponse(requestId, 30000);
     }
     /** The PC is low on memory or CPU: the sandbox slows its builds down for `seconds`. Never waits for an answer. */
-    pressure(reason, seconds) {
-        this.send({ kind: 'pressure', id: newId(), reason, seconds, createdAt: now() });
+    pressure(reason, seconds, level = 'slow') {
+        this.send({ kind: 'pressure', id: newId(), reason, seconds, level, createdAt: now() });
     }
     async ping() {
         const requestId = newId();

package/dist/host/engines/hcs/check.d.ts

@@ -19,6 +19,7 @@ export interface HcsProbes {
     imageStores(): readonly ImageStore[];
 }
 export declare function checkHcs(p: HcsProbes): EngineCheck;
+export declare function system32Dir(): string;
 /** The groups of a token from `whoami /groups /fo csv /nh`: name, type, SID, attributes per line. */
 export declare function parseWhoamiGroups(csv: string): TokenGroups;
 /** The real probes: sc.exe query, whoami, file checks. They only read. */

package/dist/host/engines/hcs/check.js

@@ -45,7 +45,7 @@ export function checkHcs(p) {
         need('No Windows Server Core (ltsc2022) image is on this PC. ' + image.reason, 'Pull one with Docker Desktop (Windows containers mode): docker pull mcr.microsoft.com/windows/servercore:ltsc2022  - or put your own in a folder with an image.json and set AGENT_SANDBOX_HCS_IMAGE to it. This tool does not download images in this alpha.');
     return { available: reasons.length === 0, reasons, fixes };
 }
-function system32Dir() {
+export function system32Dir() {
     return path.dirname(system32('x'));
 }
 /** The groups of a token from `whoami /groups /fo csv /nh`: name, type, SID, attributes per line. */

package/dist/host/engines/hcs/engine.d.ts

@@ -32,7 +32,7 @@ export declare class HcsEngine implements SandboxEngine {
     private helper;
     start(plan: EnginePlan): Promise<RunningSandbox>;
     private tryTerminate;
-    /** Ours: the compute systems the helper lists with our owner name. */
+    /** Ours: the compute systems the helper lists with our owner name and this Windows user's id prefix. */
     private ours;
     running(): Promise<boolean>;
     stop(): Promise<void>;