windows-development-sandbox 1.9.0 → 1.11.3

package/dist/runtime/daemon.js

@@ -1363,11 +1363,11 @@ var require_lodash = __commonJS({
             return isFunction(object2[key2]);
           });
         }
-        function baseGet(object2, path69) {
-          path69 = castPath(path69, object2);
-          var index = 0, length = path69.length;
+        function baseGet(object2, path70) {
+          path70 = castPath(path70, object2);
+          var index = 0, length = path70.length;
           while (object2 != null && index < length) {
-            object2 = object2[toKey(path69[index++])];
+            object2 = object2[toKey(path70[index++])];
           }
           return index && index == length ? object2 : undefined2;
         }
@@ -1431,10 +1431,10 @@ var require_lodash = __commonJS({
           });
           return accumulator;
         }
-        function baseInvoke(object2, path69, args) {
-          path69 = castPath(path69, object2);
-          object2 = parent(object2, path69);
-          var func = object2 == null ? object2 : object2[toKey(last(path69))];
+        function baseInvoke(object2, path70, args) {
+          path70 = castPath(path70, object2);
+          object2 = parent(object2, path70);
+          var func = object2 == null ? object2 : object2[toKey(last(path70))];
           return func == null ? undefined2 : apply(func, object2, args);
         }
         function baseIsArguments(value) {
@@ -1590,13 +1590,13 @@ var require_lodash = __commonJS({
             return object2 === source || baseIsMatch(object2, source, matchData);
           };
         }
-        function baseMatchesProperty(path69, srcValue) {
-          if (isKey(path69) && isStrictComparable(srcValue)) {
-            return matchesStrictComparable(toKey(path69), srcValue);
+        function baseMatchesProperty(path70, srcValue) {
+          if (isKey(path70) && isStrictComparable(srcValue)) {
+            return matchesStrictComparable(toKey(path70), srcValue);
           }
           return function(object2) {
-            var objValue = get(object2, path69);
-            return objValue === undefined2 && objValue === srcValue ? hasIn(object2, path69) : baseIsEqual(srcValue, objValue, COMPARE_PARTIAL_FLAG | COMPARE_UNORDERED_FLAG);
+            var objValue = get(object2, path70);
+            return objValue === undefined2 && objValue === srcValue ? hasIn(object2, path70) : baseIsEqual(srcValue, objValue, COMPARE_PARTIAL_FLAG | COMPARE_UNORDERED_FLAG);
           };
         }
         function baseMerge(object2, source, srcIndex, customizer, stack) {
@@ -1693,23 +1693,23 @@ var require_lodash = __commonJS({
           });
         }
         function basePick(object2, paths) {
-          return basePickBy(object2, paths, function(value, path69) {
-            return hasIn(object2, path69);
+          return basePickBy(object2, paths, function(value, path70) {
+            return hasIn(object2, path70);
           });
         }
         function basePickBy(object2, paths, predicate) {
           var index = -1, length = paths.length, result2 = {};
           while (++index < length) {
-            var path69 = paths[index], value = baseGet(object2, path69);
-            if (predicate(value, path69)) {
-              baseSet(result2, castPath(path69, object2), value);
+            var path70 = paths[index], value = baseGet(object2, path70);
+            if (predicate(value, path70)) {
+              baseSet(result2, castPath(path70, object2), value);
             }
           }
           return result2;
         }
-        function basePropertyDeep(path69) {
+        function basePropertyDeep(path70) {
           return function(object2) {
-            return baseGet(object2, path69);
+            return baseGet(object2, path70);
           };
         }
         function basePullAll(array2, values2, iteratee2, comparator) {
@@ -1783,14 +1783,14 @@ var require_lodash = __commonJS({
           var array2 = values(collection);
           return shuffleSelf(array2, baseClamp(n, 0, array2.length));
         }
-        function baseSet(object2, path69, value, customizer) {
+        function baseSet(object2, path70, value, customizer) {
           if (!isObject2(object2)) {
             return object2;
           }
-          path69 = castPath(path69, object2);
-          var index = -1, length = path69.length, lastIndex = length - 1, nested = object2;
+          path70 = castPath(path70, object2);
+          var index = -1, length = path70.length, lastIndex = length - 1, nested = object2;
           while (nested != null && ++index < length) {
-            var key2 = toKey(path69[index]), newValue = value;
+            var key2 = toKey(path70[index]), newValue = value;
             if (key2 === "__proto__" || key2 === "constructor" || key2 === "prototype") {
               return object2;
             }
@@ -1798,7 +1798,7 @@ var require_lodash = __commonJS({
               var objValue = nested[key2];
               newValue = customizer ? customizer(objValue, key2, nested) : undefined2;
               if (newValue === undefined2) {
-                newValue = isObject2(objValue) ? objValue : isIndex(path69[index + 1]) ? [] : {};
+                newValue = isObject2(objValue) ? objValue : isIndex(path70[index + 1]) ? [] : {};
               }
             }
             assignValue(nested, key2, newValue);
@@ -1964,14 +1964,14 @@ var require_lodash = __commonJS({
             }
           return result2;
         }
-        function baseUnset(object2, path69) {
-          path69 = castPath(path69, object2);
-          var index = -1, length = path69.length;
+        function baseUnset(object2, path70) {
+          path70 = castPath(path70, object2);
+          var index = -1, length = path70.length;
           if (!length) {
             return true;
           }
           while (++index < length) {
-            var key2 = toKey(path69[index]);
+            var key2 = toKey(path70[index]);
             if (key2 === "__proto__" && !hasOwnProperty.call(object2, "__proto__")) {
               return false;
             }
@@ -1979,11 +1979,11 @@ var require_lodash = __commonJS({
               return false;
             }
           }
-          var obj = parent(object2, path69);
-          return obj == null || delete obj[toKey(last(path69))];
+          var obj = parent(object2, path70);
+          return obj == null || delete obj[toKey(last(path70))];
         }
-        function baseUpdate(object2, path69, updater, customizer) {
-          return baseSet(object2, path69, updater(baseGet(object2, path69)), customizer);
+        function baseUpdate(object2, path70, updater, customizer) {
+          return baseSet(object2, path70, updater(baseGet(object2, path70)), customizer);
         }
         function baseWhile(array2, predicate, isDrop, fromRight) {
           var length = array2.length, index = fromRight ? length : -1;
@@ -2866,11 +2866,11 @@ var require_lodash = __commonJS({
           var match = source.match(reWrapDetails);
           return match ? match[1].split(reSplitDetails) : [];
         }
-        function hasPath(object2, path69, hasFunc) {
-          path69 = castPath(path69, object2);
-          var index = -1, length = path69.length, result2 = false;
+        function hasPath(object2, path70, hasFunc) {
+          path70 = castPath(path70, object2);
+          var index = -1, length = path70.length, result2 = false;
           while (++index < length) {
-            var key2 = toKey(path69[index]);
+            var key2 = toKey(path70[index]);
             if (!(result2 = object2 != null && hasFunc(object2, key2))) {
               break;
             }
@@ -3072,8 +3072,8 @@ var require_lodash = __commonJS({
             return apply(func, this, otherArgs);
           };
         }
-        function parent(object2, path69) {
-          return path69.length < 2 ? object2 : baseGet(object2, baseSlice(path69, 0, -1));
+        function parent(object2, path70) {
+          return path70.length < 2 ? object2 : baseGet(object2, baseSlice(path70, 0, -1));
         }
         function reorder(array2, indexes) {
           var arrLength = array2.length, length = nativeMin(indexes.length, arrLength), oldArray = copyArray(array2);
@@ -3708,10 +3708,10 @@ var require_lodash = __commonJS({
           }
           return isString(collection) ? fromIndex <= length && collection.indexOf(value, fromIndex) > -1 : !!length && baseIndexOf(collection, value, fromIndex) > -1;
         }
-        var invokeMap = baseRest(function(collection, path69, args) {
-          var index = -1, isFunc = typeof path69 == "function", result2 = isArrayLike(collection) ? Array2(collection.length) : [];
+        var invokeMap = baseRest(function(collection, path70, args) {
+          var index = -1, isFunc = typeof path70 == "function", result2 = isArrayLike(collection) ? Array2(collection.length) : [];
           baseEach(collection, function(value) {
-            result2[++index] = isFunc ? apply(path69, value, args) : baseInvoke(value, path69, args);
+            result2[++index] = isFunc ? apply(path70, value, args) : baseInvoke(value, path70, args);
           });
           return result2;
         });
@@ -4363,15 +4363,15 @@ var require_lodash = __commonJS({
         function functionsIn(object2) {
           return object2 == null ? [] : baseFunctions(object2, keysIn(object2));
         }
-        function get(object2, path69, defaultValue) {
-          var result2 = object2 == null ? undefined2 : baseGet(object2, path69);
+        function get(object2, path70, defaultValue) {
+          var result2 = object2 == null ? undefined2 : baseGet(object2, path70);
           return result2 === undefined2 ? defaultValue : result2;
         }
-        function has(object2, path69) {
-          return object2 != null && hasPath(object2, path69, baseHas);
+        function has(object2, path70) {
+          return object2 != null && hasPath(object2, path70, baseHas);
         }
-        function hasIn(object2, path69) {
-          return object2 != null && hasPath(object2, path69, baseHasIn);
+        function hasIn(object2, path70) {
+          return object2 != null && hasPath(object2, path70, baseHasIn);
         }
         var invert = createInverter(function(result2, value, key2) {
           if (value != null && typeof value.toString != "function") {
@@ -4424,10 +4424,10 @@ var require_lodash = __commonJS({
             return result2;
           }
           var isDeep = false;
-          paths = arrayMap(paths, function(path69) {
-            path69 = castPath(path69, object2);
-            isDeep || (isDeep = path69.length > 1);
-            return path69;
+          paths = arrayMap(paths, function(path70) {
+            path70 = castPath(path70, object2);
+            isDeep || (isDeep = path70.length > 1);
+            return path70;
           });
           copyObject(object2, getAllKeysIn(object2), result2);
           if (isDeep) {
@@ -4453,19 +4453,19 @@ var require_lodash = __commonJS({
             return [prop];
           });
           predicate = getIteratee(predicate);
-          return basePickBy(object2, props, function(value, path69) {
-            return predicate(value, path69[0]);
+          return basePickBy(object2, props, function(value, path70) {
+            return predicate(value, path70[0]);
           });
         }
-        function result(object2, path69, defaultValue) {
-          path69 = castPath(path69, object2);
-          var index = -1, length = path69.length;
+        function result(object2, path70, defaultValue) {
+          path70 = castPath(path70, object2);
+          var index = -1, length = path70.length;
           if (!length) {
             length = 1;
             object2 = undefined2;
           }
           while (++index < length) {
-            var value = object2 == null ? undefined2 : object2[toKey(path69[index])];
+            var value = object2 == null ? undefined2 : object2[toKey(path70[index])];
             if (value === undefined2) {
               index = length;
               value = defaultValue;
@@ -4474,12 +4474,12 @@ var require_lodash = __commonJS({
           }
           return object2;
         }
-        function set2(object2, path69, value) {
-          return object2 == null ? object2 : baseSet(object2, path69, value);
+        function set2(object2, path70, value) {
+          return object2 == null ? object2 : baseSet(object2, path70, value);
         }
-        function setWith(object2, path69, value, customizer) {
+        function setWith(object2, path70, value, customizer) {
           customizer = typeof customizer == "function" ? customizer : undefined2;
-          return object2 == null ? object2 : baseSet(object2, path69, value, customizer);
+          return object2 == null ? object2 : baseSet(object2, path70, value, customizer);
         }
         var toPairs = createToPairs(keys);
         var toPairsIn = createToPairs(keysIn);
@@ -4501,15 +4501,15 @@ var require_lodash = __commonJS({
           });
           return accumulator;
         }
-        function unset(object2, path69) {
-          return object2 == null ? true : baseUnset(object2, path69);
+        function unset(object2, path70) {
+          return object2 == null ? true : baseUnset(object2, path70);
         }
-        function update(object2, path69, updater) {
-          return object2 == null ? object2 : baseUpdate(object2, path69, castFunction(updater));
+        function update(object2, path70, updater) {
+          return object2 == null ? object2 : baseUpdate(object2, path70, castFunction(updater));
         }
-        function updateWith(object2, path69, updater, customizer) {
+        function updateWith(object2, path70, updater, customizer) {
           customizer = typeof customizer == "function" ? customizer : undefined2;
-          return object2 == null ? object2 : baseUpdate(object2, path69, castFunction(updater), customizer);
+          return object2 == null ? object2 : baseUpdate(object2, path70, castFunction(updater), customizer);
         }
         function values(object2) {
           return object2 == null ? [] : baseValues(object2, keys(object2));
@@ -4895,17 +4895,17 @@ var require_lodash = __commonJS({
         function matches(source) {
           return baseMatches(baseClone(source, CLONE_DEEP_FLAG));
         }
-        function matchesProperty(path69, srcValue) {
-          return baseMatchesProperty(path69, baseClone(srcValue, CLONE_DEEP_FLAG));
+        function matchesProperty(path70, srcValue) {
+          return baseMatchesProperty(path70, baseClone(srcValue, CLONE_DEEP_FLAG));
         }
-        var method = baseRest(function(path69, args) {
+        var method = baseRest(function(path70, args) {
           return function(object2) {
-            return baseInvoke(object2, path69, args);
+            return baseInvoke(object2, path70, args);
           };
         });
         var methodOf = baseRest(function(object2, args) {
-          return function(path69) {
-            return baseInvoke(object2, path69, args);
+          return function(path70) {
+            return baseInvoke(object2, path70, args);
           };
         });
         function mixin(object2, source, options) {
@@ -4952,12 +4952,12 @@ var require_lodash = __commonJS({
         var over = createOver(arrayMap);
         var overEvery = createOver(arrayEvery);
         var overSome = createOver(arraySome);
-        function property(path69) {
-          return isKey(path69) ? baseProperty(toKey(path69)) : basePropertyDeep(path69);
+        function property(path70) {
+          return isKey(path70) ? baseProperty(toKey(path70)) : basePropertyDeep(path70);
         }
         function propertyOf(object2) {
-          return function(path69) {
-            return object2 == null ? undefined2 : baseGet(object2, path69);
+          return function(path70) {
+            return object2 == null ? undefined2 : baseGet(object2, path70);
           };
         }
         var range = createRange();
@@ -5410,12 +5410,12 @@ var require_lodash = __commonJS({
         LazyWrapper.prototype.findLast = function(predicate) {
           return this.reverse().find(predicate);
         };
-        LazyWrapper.prototype.invokeMap = baseRest(function(path69, args) {
-          if (typeof path69 == "function") {
+        LazyWrapper.prototype.invokeMap = baseRest(function(path70, args) {
+          if (typeof path70 == "function") {
             return new LazyWrapper(this);
           }
           return this.map(function(value) {
-            return baseInvoke(value, path69, args);
+            return baseInvoke(value, path70, args);
           });
         });
         LazyWrapper.prototype.reject = function(predicate) {
@@ -5540,15 +5540,15 @@ function relayPort(index) {
 }
 
 // src/guest/runtime/log.ts
-import fs5 from "node:fs";
-import path8 from "node:path";
+import fs6 from "node:fs";
+import path9 from "node:path";
 
 // src/guest/runtime/paths.ts
-import path7 from "node:path";
+import path8 from "node:path";
 
 // src/shared/channel/run-dir.ts
-import fs4 from "node:fs";
-import path6 from "node:path";
+import fs5 from "node:fs";
+import path7 from "node:path";
 
 // node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -6366,10 +6366,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path69) {
-  if (!path69)
+function getElementAtPath(obj, path70) {
+  if (!path70)
     return obj;
-  return path69.reduce((acc, key2) => acc?.[key2], obj);
+  return path70.reduce((acc, key2) => acc?.[key2], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -6709,11 +6709,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path69, issues) {
+function prefixIssues(path70, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path69);
+    iss.path.unshift(path70);
     return iss;
   });
 }
@@ -7163,16 +7163,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path69 = []) => {
+  const processError = (error63, path70 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path69, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path70, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path69, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path70, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path69, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path70, ...issue2.path]);
       } else {
-        const fullpath = [...path69, ...issue2.path];
+        const fullpath = [...path70, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -7211,17 +7211,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path69 = []) => {
+  const processError = (error63, path70 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path69, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path70, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path69, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path70, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path69, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path70, ...issue2.path]);
       } else {
-        const fullpath = [...path69, ...issue2.path];
+        const fullpath = [...path70, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -7260,8 +7260,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path69 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path69) {
+  const path70 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path70) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -24363,13 +24363,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path69 = ref.slice(1).split("/").filter(Boolean);
-  if (path69.length === 0) {
+  const path70 = ref.slice(1).split("/").filter(Boolean);
+  if (path70.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path69[0] === defsKey) {
-    const key2 = path69[1] === void 0 ? void 0 : decodeJSONPointerSegment(path69[1]);
+  if (path70[0] === defsKey) {
+    const key2 = path70[1] === void 0 ? void 0 : decodeJSONPointerSegment(path70[1]);
     if (!key2 || !ctx.defs[key2]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -25437,6 +25437,9 @@ var AttachSchema = external_exports.strictObject({
   ),
   autoHide: external_exports.boolean().describe(
     "Hide the Windows Sandbox window whenever this terminal attaches; it keeps running (sandbox show brings it back)."
+  ),
+  confirmCtrlC: external_exports.boolean().describe(
+    'In an attached terminal and the sandbox window, a single Ctrl+C is held back (the title says so) and only a second one within 1.5 seconds reaches the agent: a Ctrl+C meant as "copy" no longer stops it. Esc still stops an agent.'
   )
 });
 var AgentCommandsSchema = external_exports.strictObject({
@@ -25481,7 +25484,9 @@ var SandboxSchema = external_exports.strictObject({
   engine: external_exports.enum(["windows-sandbox", "hcs"]).describe(
     '(alpha) What runs the sandbox. "windows-sandbox" = Windows Sandbox (the default: desktop, Windows Terminal, GPU, clipboard, audio, printers). "hcs" = a headless Hyper-V isolated Server Core container for agents (no desktop, GPU or clipboard); it needs Windows features and an image on this PC (sandbox engine check hcs lists what is missing), and starting it is not enabled yet in this alpha. sandbox engine shows what each engine can do. Yours only: a project file (.sandbox-config.json) cannot set it.'
   ),
-  memoryMb: external_exports.union([external_exports.literal("auto"), external_exports.number().int().min(2048)]).describe('Sandbox RAM in MB (>= 2048), or "auto": free RAM minus reserveHostMb, capped at maxMemoryMb.'),
+  memoryMb: external_exports.union([external_exports.literal("auto"), external_exports.number().int().min(2048)]).describe(
+    'Sandbox RAM in MB (>= 2048), or "auto": free RAM minus reserveHostMb, capped at maxMemoryMb. Never more than this PC can keep in RAM for it (its RAM minus the larger of reserveHostMb and 25 %, 2 GB more with vGPU): a bigger value is lowered.'
+  ),
   maxMemoryMb: external_exports.number().int().positive().describe('Upper limit for memoryMb "auto".'),
   maxMemoryPercent: external_exports.number().int().min(10).max(100).describe(`memoryMb "auto" never takes more than this share of this PC's total RAM (percent).`),
   cpuLimit: external_exports.union([external_exports.literal("none"), external_exports.number().int().min(5).max(100)]).describe(
@@ -25494,10 +25499,10 @@ var SandboxSchema = external_exports.strictObject({
     'Memory always left for this PC when memoryMb is "auto": the sandbox gets at most (free RAM, and RAM plus paging file still unused) minus this.'
   ),
   agentMemoryHeadroomMb: external_exports.union([external_exports.literal("auto"), external_exports.literal("none"), external_exports.number().int().min(0)]).describe(
-    'Memory kept out of the agents reach inside the sandbox, in MB: everything the agents start (their builds, tests, tools) together may use at most the sandbox memory minus this; a runaway parallel build then gets out-of-memory errors in its own session instead of freezing or crashing the whole sandbox. "auto" = the larger of 2048 MB and 10 % of the sandbox memory; "none" = no limit. Yours only: a project file cannot change it.'
+    'The last resort that keeps the sandbox up, in MB below its commit limit (RAM plus paging file): builds are slowed down long before (sandbox.pressureResponse); only if everything the agents start together would take the sandbox to the very edge of its memory, where Windows inside it would start failing, is a build refused memory instead of Windows. "auto" = the larger of 1536 MB and 3 % of the commit limit; "none" = no backstop. Yours only: a project file cannot change it.'
   ),
   pressureResponse: external_exports.boolean().describe(
-    "When the sandbox (or this PC) runs low on memory, slow the heaviest build programs down (lower priority) and, if that is not enough, pause the biggest compiler for a few seconds at a time, so heavy parallel builds slow down instead of closing the sandbox. Never touches the agents themselves. Yours only: a project file cannot change it."
+    "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. Yours only: a project file cannot change it."
   ),
   vGpu: external_exports.boolean().describe(
     "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it)."
@@ -25643,7 +25648,7 @@ var ToolchainsSchema = external_exports.strictObject({
       `GNU host: "lld" links with Rust's own lld through MinGW's gcc (much less memory than GNU ld), "gnu" with GNU ld.`
     ),
     linkSlots: external_exports.union([external_exports.literal("auto"), external_exports.number().int().min(1).max(32)]).describe(
-      'GNU host: how many programs may link at the same time in the whole sandbox (other links wait). "auto" = one per 8 GB of sandbox memory, 2 to 4. Several agents linking big programs at once can take Windows down.'
+      'GNU host: how many programs may link at the same time in the whole sandbox (other links wait). "auto" = one per 3 GB of sandbox memory after 6 GB, 2 to 8 (the memory governor slows links down too when memory runs short).'
     )
   }),
   msvc: external_exports.strictObject({
@@ -25718,7 +25723,7 @@ var ToolchainsSchema = external_exports.strictObject({
   }),
   cli: external_exports.strictObject({
     gh: EnabledSchema.describe(
-      'GitHub CLI (gh). Only with provisioning.git.access "full": gh can push and merge through the GitHub API, past a read-only git. Your PC\'s gh login is never copied; `gh auth login` inside persists (GH_CONFIG_DIR). "auto" = when the project has a .github folder.'
+      'GitHub CLI (gh). Only with provisioning.git.access "full": gh can push and merge through the GitHub API, past a read-only git. Your PC\'s gh login is never copied; `gh auth login` inside persists (GH_CONFIG_DIR), unless a token you saved for sandboxes is handed over (github.shareToken). "auto" = when the project has a .github folder.'
     ),
     zstd: EnabledSchema.describe('Zstandard (zstd). "auto" = off; set true to get it.'),
     openssl: EnabledSchema.describe(
@@ -26621,16 +26626,17 @@ var ResumeSchema = external_exports.strictObject({
 // src/core/schema/web.ts
 var WebSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "(Beta) Allow the web UI: your sandbox sessions in a browser on this PC. Off by default, and nothing starts it by itself yet: sandbox web start works either way and runs it until sandbox web stop (or a restart of the PC)."
+    "(Beta) The web UI: your sandbox sessions in a browser on this PC (http://127.0.0.1:<port>, this PC only). On: every sandbox start also starts it in the background (it keeps running until sandbox web stop or a restart of the PC). Off: only sandbox web start runs it. Open it signed in with sandbox web open."
   ),
-  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken.")
+  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken."),
+  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts.")
 });
 
 // src/core/schema/vpn.ts
 var VPN_PROVIDERS = ["nordvpn", "openvpn-file", "wireguard-file"];
 var VpnSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
+    "(Alpha: not yet tried on a real PC) Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
   ),
   provider: external_exports.enum(VPN_PROVIDERS).describe(
     "nordvpn: a recommended NordVPN server is picked at every launch. openvpn-file: your own .ovpn file (configFile). wireguard-file: your own WireGuard .conf (configFile), e.g. from your company."
@@ -26645,6 +26651,13 @@ var VpnSchema = external_exports.strictObject({
   )
 });
 
+// src/core/schema/github.ts
+var GithubSchema = external_exports.strictObject({
+  shareToken: external_exports.boolean().describe(
+    'Give each sandbox the GitHub token you saved with `sandbox github login` (best a fine-grained token limited to some repositories and permissions), so gh and https git work there without logging in. Only with provisioning.git.access "full". The agent in the sandbox can read the token and use it for whatever it allows. A project file (.sandbox-config.json) cannot turn this on.'
+  )
+});
+
 // src/core/schema/config.ts
 var ConfigSchema = external_exports.strictObject({
   $schema: SchemaRefSchema.optional(),
@@ -26675,6 +26688,7 @@ var ConfigSchema = external_exports.strictObject({
   }),
   network: NetworkSchema,
   vpn: VpnSchema,
+  github: GithubSchema,
   provisioning: ProvisioningSchema,
   downloads: DownloadsSchema,
   toolchains: ToolchainsSchema,
@@ -26837,19 +26851,25 @@ var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
     id: IdSchema,
     reason: Text(300),
     seconds: external_exports.number().int().min(10).max(300),
+    /** "severe": the PC is nearly out of memory; builds go to the governor's last step at once. */
+    level: external_exports.enum(["slow", "severe"]).optional(),
     createdAt: TimeSchema
   })
 ]);
 var PressureStatusSchema = external_exports.object({
   level: external_exports.enum(["ok", "throttled", "suspending"]),
+  /** The governor's dial, 0 (nothing wrong) to 4 (one compiler at a time). */
+  step: external_exports.number().int().min(0).max(4).optional(),
   profile: external_exports.enum(["normal", "gentle"]),
   /** Share of the sandbox's RAM still free and of its commit limit in use (percent). */
   ramFreePercent: external_exports.number().int().min(0).max(100),
   commitPercent: external_exports.number().int().min(0).max(100),
   /** Programs running at lower priority because of it. */
   lowered: external_exports.number().int().min(0).max(1024),
-  /** Programs paused right now (name, process id, seconds left). */
+  /** Compilers waiting their turn right now (name, process id, seconds until they may go on). */
   paused: external_exports.array(external_exports.object({ name: Text(64), pid: external_exports.number().int(), seconds: external_exports.number().int().min(0).max(60) })).max(8),
+  /** The CPU share the compilers get together (percent; 100 = no cap). */
+  cpuPercent: external_exports.number().int().min(0).max(100).optional(),
   /** The PC itself asked for slowing down (its memory or CPU is low). */
   pcLow: external_exports.boolean(),
   lastAction: Text(300),
@@ -26893,6 +26913,8 @@ var VpnStatusSchema = external_exports.object({
   state: external_exports.enum(["off", "starting", "up", "failed"]),
   message: Text(2e3),
   killSwitch: external_exports.boolean(),
+  /** A direct connection was tried after the kill switch was applied: false = it still got out. */
+  killSwitchHeld: external_exports.boolean().optional(),
   /** The server's name, e.g. uk2201.nordvpn.com. */
   server: Text(128).optional(),
   /** What the sandbox's traffic looks like from outside, once the tunnel is up. */
@@ -27040,6 +27062,59 @@ function safeRemove(target, root) {
   fs3.rmSync(target, { recursive: true, force: true, maxRetries: 2 });
 }
 
+// src/shared/io/robocopy-result.ts
+function robocopyFailed(code) {
+  return code === null || code >= 8;
+}
+function robocopyMeaning(code) {
+  if (code === null) return "robocopy did not finish";
+  if (code >= 16) return "robocopy stopped with a fatal error (bad path or no access)";
+  if (code >= 8) return code & 1 ? "some files were copied and some could not be" : "files could not be copied";
+  return code === 0 ? "nothing to copy" : "copied";
+}
+function robocopyErrors(output2, max = 3) {
+  const lines = output2.split(/\r?\n/).map((l) => l.trim()).filter((l) => /\bERROR\b/.test(l) || /^The (process|system) cannot/i.test(l));
+  return lines.slice(0, max).map((l) => l.length > 220 ? l.slice(0, 217) + "..." : l);
+}
+
+// src/shared/io/copy-tree.ts
+import fs4 from "node:fs";
+import path6 from "node:path";
+var isGone = (e) => e?.code === "ENOENT";
+function copyTreeTolerant(from, to, skip = () => false) {
+  let copied = 0;
+  let vanished = 0;
+  const walk = (src, dest) => {
+    fs4.mkdirSync(dest, { recursive: true });
+    let entries2;
+    try {
+      entries2 = fs4.readdirSync(src, { withFileTypes: true });
+    } catch (e) {
+      if (!isGone(e)) throw e;
+      vanished++;
+      return;
+    }
+    for (const entry of entries2) {
+      if (skip(entry.name)) continue;
+      const source = path6.join(src, entry.name);
+      const target = path6.join(dest, entry.name);
+      try {
+        if (entry.isDirectory()) walk(source, target);
+        else if (entry.isFile()) {
+          fs4.copyFileSync(source, target);
+          copied++;
+        }
+      } catch (e) {
+        if (!isGone(e)) throw e;
+        vanished++;
+        fs4.rmSync(target, { force: true });
+      }
+    }
+  };
+  walk(from, to);
+  return { copied, vanished };
+}
+
 // src/shared/channel/run-dir.ts
 function safeId(id) {
   return IdSchema.parse(id);
@@ -27048,14 +27123,14 @@ function now() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 var scan = (schema, dir) => {
-  if (!fs4.existsSync(dir)) return { valid: [], invalid: [] };
+  if (!fs5.existsSync(dir)) return { valid: [], invalid: [] };
   const valid = [];
   const invalid = [];
-  for (const name of fs4.readdirSync(dir)) {
+  for (const name of fs5.readdirSync(dir)) {
     if (name.endsWith(".tmp")) continue;
-    const message = /^[A-Za-z0-9_-]{1,64}\.json$/.test(name) ? readValid(schema, path6.join(dir, name)) : null;
+    const message = /^[A-Za-z0-9_-]{1,64}\.json$/.test(name) ? readValid(schema, path7.join(dir, name)) : null;
     if (message) valid.push(message);
-    else invalid.push(path6.join(dir, name));
+    else invalid.push(path7.join(dir, name));
   }
   return { valid, invalid };
 };
@@ -27065,6 +27140,8 @@ var RunDir = class {
   vpnFile;
   /** What the memory governor in the sandbox is doing (pressure.json). */
   pressureFile;
+  /** What the sandbox's programs may really use (budget.json): processors, memory, build jobs, link slots. */
+  budgetFile;
   requestsDir;
   responsesDir;
   sessionsDir;
@@ -27074,31 +27151,32 @@ var RunDir = class {
   /** One-shot secrets the host hands over (see secrets.ts). Next to run, not in it: shared-use users can change run. */
   secretsDir;
   constructor(dataDir2) {
-    this.root = path6.join(dataDir2, "run");
-    this.sandboxFile = path6.join(this.root, "sandbox.json");
-    this.vpnFile = path6.join(this.root, "vpn.json");
-    this.pressureFile = path6.join(this.root, "pressure.json");
-    this.requestsDir = path6.join(this.root, "requests");
-    this.responsesDir = path6.join(this.root, "responses");
-    this.sessionsDir = path6.join(this.root, "sessions");
-    this.projectsDir = path6.join(this.root, "projects");
-    this.auditDir = path6.join(this.root, "audit");
-    this.secretsDir = path6.join(dataDir2, "secrets");
+    this.root = path7.join(dataDir2, "run");
+    this.sandboxFile = path7.join(this.root, "sandbox.json");
+    this.vpnFile = path7.join(this.root, "vpn.json");
+    this.pressureFile = path7.join(this.root, "pressure.json");
+    this.budgetFile = path7.join(this.root, "budget.json");
+    this.requestsDir = path7.join(this.root, "requests");
+    this.responsesDir = path7.join(this.root, "responses");
+    this.sessionsDir = path7.join(this.root, "sessions");
+    this.projectsDir = path7.join(this.root, "projects");
+    this.auditDir = path7.join(this.root, "audit");
+    this.secretsDir = path7.join(dataDir2, "secrets");
   }
   requestFile(id) {
-    return path6.join(this.requestsDir, safeId(id) + ".json");
+    return path7.join(this.requestsDir, safeId(id) + ".json");
   }
   responseFile(id) {
-    return path6.join(this.responsesDir, safeId(id) + ".json");
+    return path7.join(this.responsesDir, safeId(id) + ".json");
   }
   sessionFile(id) {
-    return path6.join(this.sessionsDir, safeId(id) + ".json");
+    return path7.join(this.sessionsDir, safeId(id) + ".json");
   }
   projectFile(name) {
-    return path6.join(this.projectsDir, safeId(name) + ".json");
+    return path7.join(this.projectsDir, safeId(name) + ".json");
   }
   secretFile(id) {
-    return path6.join(this.secretsDir, safeId(id) + ".json");
+    return path7.join(this.secretsDir, safeId(id) + ".json");
   }
   readSandboxStatus() {
     return readValid(SandboxStatusSchema, this.sandboxFile);
@@ -27137,19 +27215,19 @@ var launchDir = process.env.AGENT_LAUNCH_DIR ?? "C:\\AgentLaunch";
 var dataDir = process.env.AGENT_DATA_DIR ?? "C:\\AgentData";
 var hostToolsDir = process.env.AGENT_HOST_TOOLS_DIR ?? "C:\\HostTools";
 var localDir = process.env.AGENT_LOCAL_DIR ?? "C:\\nvm";
-var toolsDir = path7.join(dataDir, "tools");
-var logsDir = path7.join(dataDir, "logs");
+var toolsDir = path8.join(dataDir, "tools");
+var logsDir = path8.join(dataDir, "logs");
 var run = new RunDir(dataDir);
 
 // src/guest/runtime/log.ts
-fs5.mkdirSync(logsDir, { recursive: true });
-var logFile = path8.join(
+fs6.mkdirSync(logsDir, { recursive: true });
+var logFile = path9.join(
   logsDir,
   (process.env.AGENT_LOG_PREFIX ?? "guest") + "-" + (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-") + ".log"
 );
 var append = (line) => {
   try {
-    fs5.appendFileSync(logFile, line + "\n");
+    fs6.appendFileSync(logFile, line + "\n");
   } catch {
   }
 };
@@ -27163,8 +27241,8 @@ function warn(message) {
 }
 
 // src/guest/runtime/session.ts
-import fs9 from "node:fs";
-import path13 from "node:path";
+import fs10 from "node:fs";
+import path14 from "node:path";
 
 // src/shared/download/http.ts
 var USER_AGENT = "windows-development-sandbox";
@@ -27195,15 +27273,15 @@ async function fetchText(url2) {
 }
 
 // src/shared/download/archive.ts
-import fs7 from "node:fs";
-import path11 from "node:path";
+import fs8 from "node:fs";
+import path12 from "node:path";
 import crypto from "node:crypto";
 
 // src/shared/system.ts
-import path9 from "node:path";
+import path10 from "node:path";
 var systemRoot = () => process.env.SystemRoot ?? process.env.WINDIR ?? "C:\\Windows";
 function system32(exe) {
-  return path9.join(systemRoot(), "System32", exe);
+  return path10.join(systemRoot(), "System32", exe);
 }
 var SYSTEM = {
   cmd: () => system32("cmd.exe"),
@@ -27223,17 +27301,17 @@ var SYSTEM = {
   msiexec: () => system32("msiexec.exe"),
   sc: () => system32("sc.exe"),
   /** The .NET Framework C# compiler that ships with Windows (C# 5). */
-  csc: () => path9.join(systemRoot(), "Microsoft.NET", "Framework64", "v4.0.30319", "csc.exe")
+  csc: () => path10.join(systemRoot(), "Microsoft.NET", "Framework64", "v4.0.30319", "csc.exe")
 };
 
 // src/shared/scripts.ts
-import fs6 from "node:fs";
-import path10 from "node:path";
+import fs7 from "node:fs";
+import path11 from "node:path";
 import { fileURLToPath } from "node:url";
-var HERE = path10.dirname(fileURLToPath(import.meta.url));
+var HERE = path11.dirname(fileURLToPath(import.meta.url));
 function sandboxScriptsDir() {
-  const candidates = [path10.resolve(HERE, "..", "sandbox"), path10.resolve(HERE, "..", "..", "sandbox")];
-  return candidates.find((dir) => fs6.existsSync(path10.join(dir, "boot", "bootstrap.ps1"))) ?? candidates[candidates.length - 1];
+  const candidates = [path11.resolve(HERE, "..", "sandbox"), path11.resolve(HERE, "..", "..", "sandbox")];
+  return candidates.find((dir) => fs7.existsSync(path11.join(dir, "boot", "bootstrap.ps1"))) ?? candidates[candidates.length - 1];
 }
 function scriptArgs(name, args = []) {
   return [
@@ -27243,7 +27321,7 @@ function scriptArgs(name, args = []) {
     "-ExecutionPolicy",
     "Bypass",
     "-File",
-    path10.join(sandboxScriptsDir(), "scripts", name),
+    path11.join(sandboxScriptsDir(), "scripts", name),
     ...args
   ];
 }
@@ -27263,16 +27341,16 @@ function stagingFolder(destination) {
   return destination + ".staging-" + crypto.randomBytes(3).toString("hex");
 }
 function moveIntoPlace(work, destination) {
-  safeRemove(destination, path11.dirname(destination));
-  fs7.mkdirSync(path11.dirname(destination), { recursive: true });
-  fs7.renameSync(work, destination);
+  safeRemove(destination, path12.dirname(destination));
+  fs8.mkdirSync(path12.dirname(destination), { recursive: true });
+  fs8.renameSync(work, destination);
 }
 async function extractArchive(archive, destination, members2 = []) {
-  fs7.mkdirSync(destination, { recursive: true });
+  fs8.mkdirSync(destination, { recursive: true });
   let status = await spawnAsync(SYSTEM.tar(), ["-xf", archive, "-C", destination, ...members2]);
   if (status !== 0 && /\.(zip|nupkg)$/i.test(archive)) {
     const zip = archive.endsWith(".zip") ? archive : archive + ".zip";
-    if (zip !== archive) fs7.copyFileSync(archive, zip);
+    if (zip !== archive) fs8.copyFileSync(archive, zip);
     status = await spawnAsync(
       SYSTEM.powershell(),
       scriptArgs("expand-archive.ps1", ["-Archive", zip, "-Destination", destination])
@@ -27281,21 +27359,21 @@ async function extractArchive(archive, destination, members2 = []) {
   if (status !== 0) throw new Error("Could not extract " + archive);
 }
 function findFile(root, name, maxDepth = 4) {
-  if (maxDepth < 0 || !fs7.existsSync(root)) return null;
-  const entries2 = fs7.readdirSync(root, { withFileTypes: true });
+  if (maxDepth < 0 || !fs8.existsSync(root)) return null;
+  const entries2 = fs8.readdirSync(root, { withFileTypes: true });
   for (const entry of entries2)
-    if (entry.isFile() && entry.name.toLowerCase() === name.toLowerCase()) return path11.join(root, entry.name);
+    if (entry.isFile() && entry.name.toLowerCase() === name.toLowerCase()) return path12.join(root, entry.name);
   for (const entry of entries2)
     if (entry.isDirectory()) {
-      const found = findFile(path11.join(root, entry.name), name, maxDepth - 1);
+      const found = findFile(path12.join(root, entry.name), name, maxDepth - 1);
       if (found) return found;
     }
   return null;
 }
 
 // src/shared/download/downloader.ts
-import fs8 from "node:fs";
-import path12 from "node:path";
+import fs9 from "node:fs";
+import path13 from "node:path";
 import crypto2 from "node:crypto";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
@@ -27316,12 +27394,12 @@ var Downloader = class {
     const sums = typeof expected === "string" || expected === null ? { sha256: expected } : expected;
     if (this.requireChecksum && !sums.sha256?.trim() && !sums.sha512?.trim()) {
       throw new Error(
-        "Refusing to download " + path12.basename(destination) + " (" + url2 + "): no checksum is published for it, and downloads.requireChecksum is on. Turn that setting off to allow downloads that cannot be verified."
+        "Refusing to download " + path13.basename(destination) + " (" + url2 + "): no checksum is published for it, and downloads.requireChecksum is on. Turn that setting off to allow downloads that cannot be verified."
       );
     }
     const response = await fetchRetry(url2, {}, 3, 20 * 60 * 1e3);
     if (!response.body) throw new Error("Empty response for " + url2);
-    fs8.mkdirSync(path12.dirname(destination), { recursive: true });
+    fs9.mkdirSync(path13.dirname(destination), { recursive: true });
     const checks = ["sha256", "sha512"].flatMap((kind) => {
       const want = sums[kind]?.trim().toLowerCase();
       return want ? [{ want, hash: crypto2.createHash(kind) }] : [];
@@ -27351,12 +27429,12 @@ var Downloader = class {
     });
     const partial2 = destination + ".part";
     try {
-      await pipeline(Readable.fromWeb(response.body), tap, fs8.createWriteStream(partial2));
+      await pipeline(Readable.fromWeb(response.body), tap, fs9.createWriteStream(partial2));
       if (checks.some((c) => c.hash.digest("hex") !== c.want)) throw new Error("Checksum mismatch for " + url2);
-      fs8.rmSync(destination, { force: true });
-      fs8.renameSync(partial2, destination);
+      fs9.rmSync(destination, { force: true });
+      fs9.renameSync(partial2, destination);
     } finally {
-      fs8.rmSync(partial2, { force: true });
+      fs9.rmSync(partial2, { force: true });
     }
   }
   /**
@@ -27366,21 +27444,21 @@ var Downloader = class {
   async archive(url2, destination, options = {}) {
     const work = stagingFolder(destination);
     try {
-      const archive = path12.join(work, options.fileName ?? path12.basename(new URL(url2).pathname));
+      const archive = path13.join(work, options.fileName ?? path13.basename(new URL(url2).pathname));
       await this.file(url2, archive, { sha256: options.sha256, sha512: options.sha512 });
-      const extracted = path12.join(work, "x");
+      const extracted = path13.join(work, "x");
       await extractArchive(archive, extracted, options.members);
       let root = extracted;
       if (options.locate) {
         const found = findFile(extracted, options.locate);
         if (!found) throw new Error(options.locate + " not found in " + url2);
-        root = path12.dirname(found);
-        for (let i = 0; i < (options.up ?? 0) && path12.dirname(root).startsWith(extracted); i++)
-          root = path12.dirname(root);
+        root = path13.dirname(found);
+        for (let i = 0; i < (options.up ?? 0) && path13.dirname(root).startsWith(extracted); i++)
+          root = path13.dirname(root);
       }
       moveIntoPlace(root, destination);
     } finally {
-      safeRemove(work, path12.dirname(work));
+      safeRemove(work, path13.dirname(work));
     }
   }
 };
@@ -27458,12 +27536,12 @@ var githubAssetFromPage = async (repo, pattern, searchOlder) => {
 
 // src/guest/runtime/session.ts
 var session = JSON.parse(
-  fs9.readFileSync(path13.join(launchDir, "session.json"), "utf8").replace(/^\uFEFF/, "")
+  fs10.readFileSync(path14.join(launchDir, "session.json"), "utf8").replace(/^\uFEFF/, "")
 );
 downloader.requireChecksum = session.downloads?.requireChecksum === true;
 var workspace = process.env.AGENT_WORKSPACE ?? session.workspace;
-var stateDir = path13.join(dataDir, session.persistAgentState ? "state" : "state-session");
-var claudeDir = path13.join(stateDir, "claude");
+var stateDir = path14.join(dataDir, session.persistAgentState ? "state" : "state-session");
+var claudeDir = path14.join(stateDir, "claude");
 
 // src/core/util/errors.ts
 function errMsg(e) {
@@ -27489,12 +27567,12 @@ function startRelays() {
 }
 
 // src/guest/audit/process-audit.ts
-import fs11 from "node:fs";
-import path15 from "node:path";
+import fs12 from "node:fs";
+import path16 from "node:path";
 import { spawnSync } from "node:child_process";
 
 // src/guest/audit/parse.ts
-import path14 from "node:path";
+import path15 from "node:path";
 var NOISE = /* @__PURE__ */ new Set([
   "conhost.exe",
   "svchost.exe",
@@ -27531,7 +27609,7 @@ function parseProcessEvents(xml) {
     if (!id) continue;
     last = Math.max(last, id);
     const program = field(event, "NewProcessName");
-    if (!program || NOISE.has(path14.win32.basename(program).toLowerCase())) continue;
+    if (!program || NOISE.has(path15.win32.basename(program).toLowerCase())) continue;
     const t = /SystemTime='([^']+)'/.exec(event)?.[1] ?? (/* @__PURE__ */ new Date()).toISOString();
     lines.push(
       JSON.stringify({
@@ -27547,19 +27625,19 @@ function parseProcessEvents(xml) {
 }
 
 // src/guest/runtime/fs.ts
-import fs10 from "node:fs";
+import fs11 from "node:fs";
 function exists(p) {
-  return fs10.existsSync(p);
+  return fs11.existsSync(p);
 }
 function mkdirp(p) {
-  fs10.mkdirSync(p, { recursive: true });
+  fs11.mkdirSync(p, { recursive: true });
   return p;
 }
 
 // src/guest/audit/process-audit.ts
 var MAX_PER_PASS = 2e3;
 var auditOn = () => Boolean(session.auditProcesses) && isWin && !dryRun;
-var wevtutil = () => path15.join(process.env.WINDIR ?? "C:\\Windows", "System32", "wevtutil.exe");
+var wevtutil = () => path16.join(process.env.WINDIR ?? "C:\\Windows", "System32", "wevtutil.exe");
 var newestRecord = () => {
   const r = spawnSync(wevtutil(), ["qe", "Security", "/q:*[System[(EventID=4688)]]", "/f:xml", "/c:1", "/rd:true"], {
     encoding: "utf8",
@@ -27586,8 +27664,8 @@ function startProcessCollector() {
       const { lines, last: newest } = parseProcessEvents(r.stdout ?? "");
       if (newest) last = newest;
       if (lines.length)
-        fs11.writeFileSync(
-          path15.join(mkdirp(run.auditDir), Date.now() + "-" + process.pid + ".jsonl"),
+        fs12.writeFileSync(
+          path16.join(mkdirp(run.auditDir), Date.now() + "-" + process.pid + ".jsonl"),
           lines.join("\n") + "\n"
         );
     } catch (e) {
@@ -27598,14 +27676,14 @@ function startProcessCollector() {
 }
 
 // src/guest/daemon/state.ts
-import path16 from "node:path";
+import path17 from "node:path";
 var MAX_MESSAGE = 3500;
 function insidePrimary(cwd) {
-  const rel = path16.relative(workspace.toLowerCase(), path16.resolve(cwd).toLowerCase());
-  return rel === "" || !rel.startsWith("..") && !path16.isAbsolute(rel);
+  const rel = path17.relative(workspace.toLowerCase(), path17.resolve(cwd).toLowerCase());
+  return rel === "" || !rel.startsWith("..") && !path17.isAbsolute(rel);
 }
 function insideWorkspace(cwd) {
-  return insidePrimary(cwd) || session.projectsDir !== void 0 && insideProjects(path16.resolve(cwd), session.roots ?? [], session.projectsDir);
+  return insidePrimary(cwd) || session.projectsDir !== void 0 && insideProjects(path17.resolve(cwd), session.roots ?? [], session.projectsDir);
 }
 function tryWrite(file3, value) {
   try {
@@ -27629,7 +27707,13 @@ function safely(what, work) {
 }
 
 // src/guest/runtime/secrets.ts
-import fs12 from "node:fs";
+import fs13 from "node:fs";
+
+// src/shared/github/token.ts
+var MIN_LENGTH = 20;
+var MAX_LENGTH = 255;
+var PRINTABLE = /^[\x21-\x7e]+$/;
+var GithubTokenSchema = external_exports.string().min(MIN_LENGTH).max(MAX_LENGTH).regex(PRINTABLE);
 
 // src/shared/channel/secrets.ts
 var Environment = external_exports.record(external_exports.string().max(256), external_exports.string().max(65536));
@@ -27645,7 +27729,9 @@ var SecretsFileSchema = external_exports.strictObject({
   /** VPN service credentials (vpn.provider's login), only for the launch's own sandbox. */
   vpn: external_exports.strictObject({ username: external_exports.string().min(1).max(256), password: external_exports.string().min(1).max(1024) }).optional(),
   /** The checked WireGuard config of vpn.provider wireguard-file (holds the private key). */
-  wireguardConfig: external_exports.string().min(1).max(32 * 1024).optional()
+  wireguardConfig: external_exports.string().min(1).max(32 * 1024).optional(),
+  /** The GitHub token you saved for sandboxes (github.shareToken), only with git access "full". */
+  githubToken: GithubTokenSchema.optional()
 });
 var withEnvironment = (harness, environment) => environment ? { ...harness, environment: { ...harness.environment, ...environment } } : harness;
 function mergeRequestSecrets(request, secrets) {
@@ -27674,12 +27760,12 @@ function takeSecrets(id) {
   const file3 = run.secretFile(id);
   let text;
   try {
-    if (fs12.statSync(file3).size > MAX_BYTES) throw new Error("too big");
-    text = fs12.readFileSync(file3, "utf8").replace(/^\uFEFF/, "");
+    if (fs13.statSync(file3).size > MAX_BYTES) throw new Error("too big");
+    text = fs13.readFileSync(file3, "utf8").replace(/^\uFEFF/, "");
   } catch {
     return {};
   } finally {
-    fs12.rmSync(file3, { force: true });
+    fs13.rmSync(file3, { force: true });
   }
   try {
     const parsed = SecretsFileSchema.safeParse(JSON.parse(text));
@@ -27709,95 +27795,127 @@ function withRequestSecrets(req) {
 }
 
 // src/guest/daemon/daemon.ts
-import fs53 from "node:fs";
+import fs54 from "node:fs";
 
 // src/guest/setup/claude-mem.ts
-import fs14 from "node:fs";
+import fs15 from "node:fs";
 import os4 from "node:os";
-import path18 from "node:path";
+import path19 from "node:path";
 
 // src/guest/runtime/process.ts
-import fs13 from "node:fs";
+import fs14 from "node:fs";
 import os3 from "node:os";
-import path17 from "node:path";
+import path18 from "node:path";
 import { spawnSync as spawnSync2 } from "node:child_process";
-function exec(file3, args, options = {}) {
-  const result = spawnSync2(file3, args, { stdio: "inherit", windowsHide: true, ...options });
-  if (result.error) throw result.error;
-  if (result.status !== 0)
-    throw new Error(path17.basename(file3) + " " + args.slice(0, 3).join(" ") + " failed with exit code " + result.status);
-}
 async function execAsync(file3, args, options = {}) {
   const code = await spawnAsync(file3, args, { stdio: "inherit", ...options });
   if (code !== 0)
-    throw new Error(path17.basename(file3) + " " + args.slice(0, 3).join(" ") + " failed with exit code " + code);
+    throw new Error(path18.basename(file3) + " " + args.slice(0, 3).join(" ") + " failed with exit code " + code);
 }
 function execOutput(file3, args, options = {}) {
   const result = spawnSync2(file3, args, { encoding: "utf8", windowsHide: true, ...options });
   return result.status === 0 ? String(result.stdout ?? "").trim() : "";
 }
 function runScript(name, args = []) {
-  exec(SYSTEM.powershell(), scriptArgs(name, args));
+  const result = spawnSync2(SYSTEM.powershell(), scriptArgs(name, args), {
+    stdio: ["inherit", "inherit", "pipe"],
+    encoding: "utf8",
+    windowsHide: true
+  });
+  if (result.error) throw result.error;
+  const errors = String(result.stderr ?? "").trim();
+  if (errors) process.stderr.write(errors + "\n");
+  if (result.status !== 0)
+    throw new Error(name + " failed with exit code " + result.status + (errors ? ": " + errors.slice(0, 400) : ""));
 }
 function scriptOutput(name, args = [], options = {}) {
   return execOutput(SYSTEM.powershell(), scriptArgs(name, args), options);
 }
 function runScriptWithJson(name, param, data, args = []) {
-  const dir = fs13.mkdtempSync(path17.join(os3.tmpdir(), "sbx-"));
-  const file3 = path17.join(dir, "input.json");
+  const dir = fs14.mkdtempSync(path18.join(os3.tmpdir(), "sbx-"));
+  const file3 = path18.join(dir, "input.json");
   try {
-    fs13.writeFileSync(file3, JSON.stringify(data), "utf8");
+    fs14.writeFileSync(file3, JSON.stringify(data), "utf8");
     runScript(name, ["-" + param, file3, ...args]);
   } finally {
-    fs13.rmSync(dir, { recursive: true, force: true });
+    fs14.rmSync(dir, { recursive: true, force: true });
   }
 }
 function robocopy(from, to, files = []) {
   if (!isWin) {
     if (!files.length) {
-      fs13.cpSync(from, to, { recursive: true });
+      fs14.cpSync(from, to, { recursive: true });
       return;
     }
-    fs13.mkdirSync(to, { recursive: true });
-    for (const f of files.filter((f2) => fs13.existsSync(path17.join(from, f2))))
-      fs13.copyFileSync(path17.join(from, f), path17.join(to, f));
+    fs14.mkdirSync(to, { recursive: true });
+    for (const f of files.filter((f2) => fs14.existsSync(path18.join(from, f2))))
+      fs14.copyFileSync(path18.join(from, f), path18.join(to, f));
     return;
   }
-  const what = files.length ? files : ["/E", "/MT:16"];
-  const result = spawnSync2(
-    SYSTEM.robocopy(),
-    [from, to, ...what, "/NFL", "/NDL", "/NJH", "/NJS", "/NP", "/R:1", "/W:1", "/XJ"],
-    { stdio: "ignore", windowsHide: true }
+  const what = files.length ? files : ["/E"];
+  const passes = [
+    ["/MT:16", "/R:1", "/W:1"],
+    ["/MT:1", "/R:4", "/W:3"]
+  ];
+  let code = null;
+  let output2 = "";
+  for (const pass of passes) {
+    const result = spawnSync2(
+      SYSTEM.robocopy(),
+      [
+        from,
+        to,
+        ...what,
+        ...files.length ? [] : [pass[0]],
+        pass[1],
+        pass[2],
+        "/NFL",
+        "/NDL",
+        "/NJH",
+        "/NJS",
+        "/NP",
+        "/XJ"
+      ],
+      { encoding: "utf8", windowsHide: true }
+    );
+    code = result.status;
+    output2 = String(result.stdout ?? "") + String(result.stderr ?? "");
+    if (!robocopyFailed(code)) return;
+  }
+  const why = robocopyErrors(output2);
+  throw new Error(
+    "robocopy " + from + " -> " + to + " failed (exit " + code + ": " + robocopyMeaning(code) + ")" + (why.length ? ": " + why.join(" | ") : "")
   );
-  if ((result.status ?? 16) >= 8)
-    throw new Error("robocopy " + from + " -> " + to + " failed (exit " + result.status + ")");
 }
 function copyNode(from, to) {
   const work = stagingFolder(to);
   try {
     robocopy(from, work, ["node.exe", "npm", "npm.cmd", "npx", "npx.cmd"]);
-    robocopy(path17.join(from, "node_modules", "npm"), path17.join(work, "node_modules", "npm"));
+    robocopy(path18.join(from, "node_modules", "npm"), path18.join(work, "node_modules", "npm"));
     moveIntoPlace(work, to);
   } finally {
-    safeRemove(work, path17.dirname(work));
+    safeRemove(work, path18.dirname(work));
   }
 }
 
 // src/guest/setup/claude-mem.ts
 var claudeMemPaths = {
-  store: path18.join(stateDir, "claude-mem"),
-  local: path18.join(os4.homedir(), ".claude-mem")
+  store: path19.join(stateDir, "claude-mem"),
+  local: path19.join(os4.homedir(), ".claude-mem")
 };
 var claudeMemEnabled = () => session.claudeProfile.syncClaudeMem && !dryRun;
 var databaseFingerprint = (dir) => {
   const parts2 = [];
   const walk = (folder) => {
-    for (const entry of fs14.readdirSync(folder, { withFileTypes: true })) {
-      const full = path18.join(folder, entry.name);
+    for (const entry of fs15.readdirSync(folder, { withFileTypes: true })) {
+      const full = path19.join(folder, entry.name);
       if (entry.isDirectory()) walk(full);
       else if (entry.isFile() && /\.(db|sqlite3?)(-wal)?$/i.test(entry.name)) {
-        const s = fs14.statSync(full);
-        parts2.push(full + ":" + s.size + ":" + s.mtimeMs);
+        try {
+          const s = fs15.statSync(full);
+          parts2.push(full + ":" + s.size + ":" + s.mtimeMs);
+        } catch {
+        }
       }
     }
   };
@@ -27808,34 +27926,34 @@ var lastSaved = null;
 var SQLITE_HEADER = "SQLite format 3\0";
 var looksLikeSqlite = (file3) => {
   if (!exists(file3)) return true;
-  const fd = fs14.openSync(file3, "r");
+  const fd = fs15.openSync(file3, "r");
   try {
     const head = Buffer.alloc(16);
-    return fs14.readSync(fd, head, 0, 16, 0) === 16 && head.toString("latin1") === SQLITE_HEADER;
+    return fs15.readSync(fd, head, 0, 16, 0) === 16 && head.toString("latin1") === SQLITE_HEADER;
   } finally {
-    fs14.closeSync(fd);
+    fs15.closeSync(fd);
   }
 };
 var MAX_BACKUPS = 3;
 var BACKUP_EVERY_MS = 6 * 3600 * 1e3;
 var keepBackup = (previous, dir) => {
   if (!exists(previous)) return;
-  const backups = exists(dir) ? fs14.readdirSync(dir).filter((n) => /^\d{13}$/.test(n)).sort() : [];
+  const backups = exists(dir) ? fs15.readdirSync(dir).filter((n) => /^\d{13}$/.test(n)).sort() : [];
   const newest = Number(backups[backups.length - 1] ?? 0);
   if (Date.now() - newest < BACKUP_EVERY_MS) {
-    fs14.rmSync(previous, { recursive: true, force: true });
+    fs15.rmSync(previous, { recursive: true, force: true });
     return;
   }
-  fs14.renameSync(previous, path18.join(mkdirp(dir), String(Date.now())));
+  fs15.renameSync(previous, path19.join(mkdirp(dir), String(Date.now())));
   for (const old of [...backups, String(Date.now())].slice(0, -MAX_BACKUPS))
-    fs14.rmSync(path18.join(dir, old), { recursive: true, force: true });
+    fs15.rmSync(path19.join(dir, old), { recursive: true, force: true });
 };
 function saveClaudeMem() {
   if (!claudeMemEnabled() || !exists(claudeMemPaths.local)) return;
   const { store: store2, local } = claudeMemPaths;
   const fingerprint2 = databaseFingerprint(local);
   if (fingerprint2 === lastSaved && exists(store2)) return;
-  if (!looksLikeSqlite(path18.join(local, "claude-mem.db"))) {
+  if (!looksLikeSqlite(path19.join(local, "claude-mem.db"))) {
     warn(
       "claude-mem: the local database does not look valid, so it was not saved over the stored copy (" + local + ")."
     );
@@ -27843,14 +27961,14 @@ function saveClaudeMem() {
   }
   const incoming = store2 + ".incoming";
   const previous = store2 + ".previous";
-  fs14.rmSync(incoming, { recursive: true, force: true });
-  fs14.cpSync(local, incoming, { recursive: true, filter: (src) => !/\.(pid|lock)$/i.test(src) });
-  fs14.rmSync(previous, { recursive: true, force: true });
-  if (exists(store2)) fs14.renameSync(store2, previous);
+  fs15.rmSync(incoming, { recursive: true, force: true });
+  copyTreeTolerant(local, incoming, (name) => /\.(pid|lock)$|-journal$|-shm$/i.test(name));
+  fs15.rmSync(previous, { recursive: true, force: true });
+  if (exists(store2)) fs15.renameSync(store2, previous);
   try {
-    fs14.renameSync(incoming, store2);
+    fs15.renameSync(incoming, store2);
   } catch (e) {
-    if (exists(previous)) fs14.renameSync(previous, store2);
+    if (exists(previous)) fs15.renameSync(previous, store2);
     throw e;
   }
   keepBackup(previous, store2 + ".backups");
@@ -27858,18 +27976,18 @@ function saveClaudeMem() {
 }
 
 // src/guest/agents/local-state.ts
-import fs15 from "node:fs";
-import path20 from "node:path";
+import fs16 from "node:fs";
+import path21 from "node:path";
 
 // src/guest/agents/agent-files.ts
-import path19 from "node:path";
+import path20 from "node:path";
 function agentPaths(toolsDir2, name, harness) {
-  const dir = path19.join(toolsDir2, "agents", name);
+  const dir = path20.join(toolsDir2, "agents", name);
   const exe = harness.hostExecutable ?? (harness.uvBin ? harness.uvBin + ".exe" : null);
   return {
     dir,
-    exe: exe ? path19.join(dir, exe) : null,
-    cmd: harness.npmBin ? path19.join(dir, harness.npmBin + ".cmd") : null
+    exe: exe ? path20.join(dir, exe) : null,
+    cmd: harness.npmBin ? path20.join(dir, harness.npmBin + ".cmd") : null
   };
 }
 function agentCommand(name, harness) {
@@ -27880,10 +27998,10 @@ function localStateEntries(agents2, stateDir2, localRoot2) {
     ([agent, harness]) => Object.entries(harness.localState ?? {}).map(([env, folder]) => ({
       agent,
       env,
-      store: path19.join(stateDir2, agent, folder),
-      local: path19.join(localRoot2, agent, folder),
+      store: path20.join(stateDir2, agent, folder),
+      local: path20.join(localRoot2, agent, folder),
       processes: [agentCommand(agent, harness) + ".exe"],
-      legacy: path19.join(stateDir2, agent)
+      legacy: path20.join(stateDir2, agent)
     }))
   );
 }
@@ -27892,39 +28010,39 @@ var isCopyableDatabaseFile = (name) => isDatabaseFile(name) && !/-shm$/i.test(na
 
 // src/guest/agents/local-state.ts
 var SQLITE_HEADER2 = "SQLite format 3\0";
-var localRoot = () => path20.join(localDir, "agent-state");
+var localRoot = () => path21.join(localDir, "agent-state");
 function agentLocalStates() {
   return localStateEntries(session.agents ?? {}, stateDir, localRoot());
 }
 function localStateVars() {
   return Object.fromEntries(agentLocalStates().map((s) => [s.env, s.local]));
 }
-var databaseFiles = (dir, keep) => exists(dir) ? fs15.readdirSync(dir, { withFileTypes: true }).flatMap((e) => e.isFile() && keep(e.name) ? [e.name] : []) : [];
+var databaseFiles = (dir, keep) => exists(dir) ? fs16.readdirSync(dir, { withFileTypes: true }).flatMap((e) => e.isFile() && keep(e.name) ? [e.name] : []) : [];
 var looksLikeSqlite2 = (file3) => {
-  const fd = fs15.openSync(file3, "r");
+  const fd = fs16.openSync(file3, "r");
   try {
     const head = Buffer.alloc(16);
-    return fs15.readSync(fd, head, 0, 16, 0) === 16 && head.toString("latin1") === SQLITE_HEADER2;
+    return fs16.readSync(fd, head, 0, 16, 0) === 16 && head.toString("latin1") === SQLITE_HEADER2;
   } finally {
-    fs15.closeSync(fd);
+    fs16.closeSync(fd);
   }
 };
 var copyFiles = (from, to, names) => {
-  fs15.rmSync(to, { recursive: true, force: true });
+  fs16.rmSync(to, { recursive: true, force: true });
   mkdirp(to);
-  for (const name of names) fs15.copyFileSync(path20.join(from, name), path20.join(to, name));
+  for (const name of names) fs16.copyFileSync(path21.join(from, name), path21.join(to, name));
 };
 var swapIn = (incoming, store2) => {
   const previous = store2 + ".previous";
-  fs15.rmSync(previous, { recursive: true, force: true });
-  if (exists(store2)) fs15.renameSync(store2, previous);
+  fs16.rmSync(previous, { recursive: true, force: true });
+  if (exists(store2)) fs16.renameSync(store2, previous);
   try {
-    fs15.renameSync(incoming, store2);
+    fs16.renameSync(incoming, store2);
   } catch (e) {
-    if (exists(previous)) fs15.renameSync(previous, store2);
+    if (exists(previous)) fs16.renameSync(previous, store2);
     throw e;
   }
-  fs15.rmSync(previous, { recursive: true, force: true });
+  fs16.rmSync(previous, { recursive: true, force: true });
 };
 function held(s) {
   if (!isWin) return false;
@@ -27933,7 +28051,7 @@ function held(s) {
   );
 }
 var fingerprint = (dir) => databaseFiles(dir, isCopyableDatabaseFile).sort().map((n) => {
-  const st = fs15.statSync(path20.join(dir, n));
+  const st = fs16.statSync(path21.join(dir, n));
   return n + ":" + st.size + ":" + st.mtimeMs;
 }).join("|");
 var saved = /* @__PURE__ */ new Map();
@@ -27952,12 +28070,12 @@ function snapshotWhileRunning(s, print) {
         return;
       }
       const incoming = s.store + ".incoming";
-      fs15.rmSync(incoming, { recursive: true, force: true });
+      fs16.rmSync(incoming, { recursive: true, force: true });
       mkdirp(incoming);
       for (const name of databaseFiles(s.local, (n) => isCopyableDatabaseFile(n) && !/-wal$/i.test(n))) {
-        const db = new sqlite.DatabaseSync(path20.join(s.local, name), { readOnly: true });
+        const db = new sqlite.DatabaseSync(path21.join(s.local, name), { readOnly: true });
         try {
-          await sqlite.backup(db, path20.join(incoming, name));
+          await sqlite.backup(db, path21.join(incoming, name));
         } finally {
           db.close();
         }
@@ -27983,7 +28101,7 @@ function saveLocalState() {
         continue;
       }
       const names = databaseFiles(s.local, isCopyableDatabaseFile);
-      const bad = names.filter((n) => !/-wal$/i.test(n) && !looksLikeSqlite2(path20.join(s.local, n)));
+      const bad = names.filter((n) => !/-wal$/i.test(n) && !looksLikeSqlite2(path21.join(s.local, n)));
       if (bad.length) {
         warn(s.agent + ": " + bad.join(", ") + " do not look like SQLite databases, so they were not saved.");
         continue;
@@ -28002,10 +28120,10 @@ function saveLocalState() {
 import { spawn as spawn5 } from "node:child_process";
 
 // src/guest/setup/environment.ts
-import path22 from "node:path";
+import path23 from "node:path";
 
 // src/guest/setup/path-plan.ts
-import path21 from "node:path";
+import path22 from "node:path";
 function pathKey(folder) {
   const slashes = folder.trim().replace(/^"|"$/g, "").replace(/\//g, "\\");
   return (slashes.length > 3 ? slashes.replace(/\\+$/, "") : slashes).toLowerCase();
@@ -28045,13 +28163,13 @@ function parseRegPath(output2) {
 function isPinnedNodeDir(folder, nvmHome2) {
   const key2 = pathKey(folder);
   const home = pathKey(nvmHome2);
-  return key2.startsWith(home + "\\") && /^v\d/.test(path21.win32.basename(key2));
+  return key2.startsWith(home + "\\") && /^v\d/.test(path22.win32.basename(key2));
 }
 
 // src/guest/setup/environment.ts
 var LEGACY_HOMES = { CODEX_HOME: "codex", GEMINI_CLI_HOME: "gemini" };
 var agentHomes = () => Object.fromEntries(
-  Object.entries(session.agentHomes ?? LEGACY_HOMES).filter(([name]) => name !== "CLAUDE_CONFIG_DIR").map(([name, sub]) => [name, path22.join(stateDir, sub)])
+  Object.entries(session.agentHomes ?? LEGACY_HOMES).filter(([name]) => name !== "CLAUDE_CONFIG_DIR").map(([name, sub]) => [name, path23.join(stateDir, sub)])
 );
 function agentEnv(tools, target = { workspace, project: session.project, base: process.env }) {
   const homes = agentHomes();
@@ -28061,7 +28179,7 @@ function agentEnv(tools, target = { workspace, project: session.project, base: p
     CLAUDE_CONFIG_DIR: claudeDir,
     ...homes,
     ...localStateVars(),
-    npm_config_cache: path22.join(toolsDir, "npm-cache"),
+    npm_config_cache: path23.join(toolsDir, "npm-cache"),
     npm_config_update_notifier: "false",
     AGENT_WORKSPACE: target.workspace,
     AGENT_DATA: dataDir,
@@ -28079,9 +28197,9 @@ function agentEnv(tools, target = { workspace, project: session.project, base: p
     ...local.map((n) => env[n])
   ])
     mkdirp(dir);
-  const runners = [path22.join(toolsDir, "node"), path22.dirname(process.execPath)].map((d) => d.toLowerCase());
-  const base = (target.base.PATH ?? "").split(path22.delimiter).filter((d) => d && !runners.includes(d.toLowerCase()));
-  env.PATH = [.../* @__PURE__ */ new Set([...tools.prepend, ...base, ...tools.append])].join(path22.delimiter);
+  const runners = [path23.join(toolsDir, "node"), path23.dirname(process.execPath)].map((d) => d.toLowerCase());
+  const base = (target.base.PATH ?? "").split(path23.delimiter).filter((d) => d && !runners.includes(d.toLowerCase()));
+  env.PATH = [.../* @__PURE__ */ new Set([...tools.prepend, ...base, ...tools.append])].join(path23.delimiter);
   return env;
 }
 function addMachineEnvironment(vars, dirs, additive = false) {
@@ -28093,7 +28211,7 @@ function addMachineEnvironment(vars, dirs, additive = false) {
     warn("Could not add to the environment: " + errMsg(e));
   }
 }
-var nvmHome = () => path22.join(toolsDir, "nvm");
+var nvmHome = () => path23.join(toolsDir, "nvm");
 var MACHINE_ENVIRONMENT_KEY = "HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment";
 var USER_ENVIRONMENT_KEY = "HKCU\\Environment";
 var registryPath = (key2) => parseRegPath(execOutput(SYSTEM.reg(), ["query", key2, "/v", "Path"]));
@@ -28101,7 +28219,7 @@ function withRegistryPath(env) {
   if (!isWin || dryRun || testMode) return env;
   try {
     const registry2 = expandVars(registryPath(MACHINE_ENVIRONMENT_KEY) + ";" + registryPath(USER_ENVIRONMENT_KEY), env);
-    const runner = pathKey(path22.join(toolsDir, "node"));
+    const runner = pathKey(path23.join(toolsDir, "node"));
     const pathName = Object.keys(env).find((k) => k.toLowerCase() === "path") ?? "PATH";
     return {
       ...env,
@@ -28118,12 +28236,12 @@ function withRegistryPath(env) {
 }
 
 // src/guest/daemon/project-provisioner.ts
-import fs48 from "node:fs";
-import path62 from "node:path";
+import fs49 from "node:fs";
+import path63 from "node:path";
 
 // src/guest/boot/boot-env.ts
-import fs16 from "node:fs";
-import path23 from "node:path";
+import fs17 from "node:fs";
+import path24 from "node:path";
 
 // src/guest/boot/project-env.ts
 var EnvSchema = external_exports.object({
@@ -28153,22 +28271,22 @@ function baseEnvFor(boot, current = process.env) {
 }
 
 // src/guest/boot/boot-env.ts
-var file2 = () => path23.join(localDir, "boot-env.json");
+var file2 = () => path24.join(localDir, "boot-env.json");
 function readBootEnv() {
   try {
-    return BootEnvSchema.safeParse(JSON.parse(fs16.readFileSync(file2(), "utf8"))).data ?? null;
+    return BootEnvSchema.safeParse(JSON.parse(fs17.readFileSync(file2(), "utf8"))).data ?? null;
   } catch {
     return null;
   }
 }
 
 // src/guest/boot/guide.ts
-import fs17 from "node:fs";
-import path24 from "node:path";
+import fs18 from "node:fs";
+import path25 from "node:path";
 var BEGIN = "<!-- agent-sandbox:begin (generated every boot, do not edit) -->";
 var END = "<!-- agent-sandbox:end -->";
 var mirrorLine = () => {
-  const drives = (session.substDrives ?? []).filter((d) => fs17.existsSync(d.letter + ":\\"));
+  const drives = (session.substDrives ?? []).filter((d) => fs18.existsSync(d.letter + ":\\"));
   if (!drives.length) return [];
   return [
     "- " + drives.map((d) => d.letter + ":").join(", ") + " = mapped folders at their PC paths (subst onto `" + drives.map((d) => d.target).join("`, `") + "`; real-path tools may print that form)."
@@ -28184,8 +28302,8 @@ function sandboxGuide(toolSummary, lan = "blocked", projects = []) {
     ...projects.map(
       (p) => "- RW, persists: `" + p.guest + "` = host folder " + p.host + " (another project in this sandbox; your own is `%AGENT_WORKSPACE%`)"
     ),
-    "- RW, persists: `" + toolsDir + "` (toolchains) \u2014 put portable exes in `" + path24.join(toolsDir, "bin") + "` (on PATH)",
-    "- RW, persists: `" + stateDir + "` (agent config/history; do not edit logins) \xB7 logs: `" + path24.join(dataDir, "logs") + "`",
+    "- RW, persists: `" + toolsDir + "` (toolchains) \u2014 put portable exes in `" + path25.join(toolsDir, "bin") + "` (on PATH)",
+    "- RW, persists: `" + stateDir + "` (agent config/history; do not edit logins) \xB7 logs: `" + path25.join(dataDir, "logs") + "`",
     "- RO: `" + launchDir + "` (this boot's scripts) \xB7 lost on close: everything else, incl. `C:\\nvm` (Node symlink)",
     ...mirrorLine(),
     "- Tools: " + toolSummary.join(" \xB7 "),
@@ -28196,37 +28314,37 @@ function sandboxGuide(toolSummary, lan = "blocked", projects = []) {
   ].join("\n");
 }
 function upsertGuide(file3, guide) {
-  fs17.mkdirSync(path24.dirname(file3), { recursive: true });
-  const current = fs17.existsSync(file3) ? fs17.readFileSync(file3, "utf8") : "";
+  fs18.mkdirSync(path25.dirname(file3), { recursive: true });
+  const current = fs18.existsSync(file3) ? fs18.readFileSync(file3, "utf8") : "";
   const start = current.indexOf(BEGIN);
   const end = current.indexOf(END);
   const without = start >= 0 && end > start ? current.slice(0, start) + current.slice(end + END.length) : current;
-  fs17.writeFileSync(file3, without.trimEnd() + (without.trim() ? "\n\n" : "") + guide + "\n", "utf8");
+  fs18.writeFileSync(file3, without.trimEnd() + (without.trim() ? "\n\n" : "") + guide + "\n", "utf8");
 }
 function managedClaudeMd() {
-  return path24.join(
-    process.env.AGENT_MANAGED_DIR ?? path24.join(process.env.ProgramFiles ?? "C:\\Program Files", "ClaudeCode"),
+  return path25.join(
+    process.env.AGENT_MANAGED_DIR ?? path25.join(process.env.ProgramFiles ?? "C:\\Program Files", "ClaudeCode"),
     "CLAUDE.md"
   );
 }
 function writeGuides(toolSummary, lan, projects = []) {
   const guide = sandboxGuide(toolSummary, lan, projects);
   const managed = managedClaudeMd();
-  fs17.mkdirSync(path24.dirname(managed), { recursive: true });
-  fs17.writeFileSync(managed, guide + "\n", "utf8");
-  fs17.writeFileSync(path24.join(dataDir, "SANDBOX.md"), guide + "\n", "utf8");
-  upsertGuide(path24.join(stateDir, "codex", "AGENTS.md"), guide);
-  upsertGuide(path24.join(stateDir, "gemini", ".gemini", "GEMINI.md"), guide);
-  removeGuide(path24.join(claudeDir, "CLAUDE.md"));
+  fs18.mkdirSync(path25.dirname(managed), { recursive: true });
+  fs18.writeFileSync(managed, guide + "\n", "utf8");
+  fs18.writeFileSync(path25.join(dataDir, "SANDBOX.md"), guide + "\n", "utf8");
+  upsertGuide(path25.join(stateDir, "codex", "AGENTS.md"), guide);
+  upsertGuide(path25.join(stateDir, "gemini", ".gemini", "GEMINI.md"), guide);
+  removeGuide(path25.join(claudeDir, "CLAUDE.md"));
   return managed;
 }
 var removeGuide = (file3) => {
-  if (!fs17.existsSync(file3)) return;
-  const current = fs17.readFileSync(file3, "utf8");
+  if (!fs18.existsSync(file3)) return;
+  const current = fs18.readFileSync(file3, "utf8");
   const start = current.indexOf(BEGIN);
   const end = current.indexOf(END);
   if (start >= 0 && end > start)
-    fs17.writeFileSync(file3, (current.slice(0, start) + current.slice(end + END.length)).trim() + "\n", "utf8");
+    fs18.writeFileSync(file3, (current.slice(0, start) + current.slice(end + END.length)).trim() + "\n", "utf8");
 };
 
 // src/guest/runtime/project-context.ts
@@ -28263,11 +28381,11 @@ function saveProjectStatus(name, workspace2, phase, message, databases, summary)
 }
 
 // src/guest/setup/hooks.ts
-import fs18 from "node:fs";
-import path25 from "node:path";
+import fs19 from "node:fs";
+import path26 from "node:path";
 import { spawnSync as spawnSync3 } from "node:child_process";
 var commandFor = (file3) => {
-  const ext = path25.extname(file3).toLowerCase();
+  const ext = path26.extname(file3).toLowerCase();
   if (ext === ".mjs" || ext === ".js") return [process.execPath, [file3]];
   if (!isWin) return null;
   if (ext === ".ps1")
@@ -28275,18 +28393,18 @@ var commandFor = (file3) => {
   if (ext === ".cmd" || ext === ".bat") return [SYSTEM.cmd(), ["/d", "/c", file3]];
   return null;
 };
-var BOOT = { root: path25.join(launchDir, "hooks"), cwd: workspace };
+var BOOT = { root: path26.join(launchDir, "hooks"), cwd: workspace };
 function projectHooks(name, cwd) {
   return {
-    root: path25.join(launchDir, "projects", name, "hooks"),
+    root: path26.join(launchDir, "projects", name, "hooks"),
     cwd
   };
 }
 var hooksOf = (stage, target) => {
-  const dir = path25.join(target.root, stage);
+  const dir = path26.join(target.root, stage);
   if (!exists(dir)) return [];
-  return fs18.readdirSync(dir).sort().flatMap((name) => {
-    const command = commandFor(path25.join(dir, name));
+  return fs19.readdirSync(dir).sort().flatMap((name) => {
+    const command = commandFor(path26.join(dir, name));
     return command ? [{ name, command }] : [];
   });
 };
@@ -28316,25 +28434,25 @@ async function runHooksAsync(stage, env, target) {
 }
 
 // src/guest/toolchains/tool-env.ts
-import path26 from "node:path";
+import path27 from "node:path";
 function emptyEnv() {
   return { vars: {}, prepend: [], append: [], summary: [] };
 }
 var arch = process.arch === "arm64" ? "arm64" : "x64";
 function tool(...parts2) {
-  return path26.join(toolsDir, ...parts2);
+  return path27.join(toolsDir, ...parts2);
 }
 function versionOf(exe, args = ["--version"], options = {}) {
   return /\d+\.\d+\.\d+\S*/.exec(execOutput(exe, args, options))?.[0] ?? "installed";
 }
 
 // src/guest/apps/app-installer.ts
-import fs22 from "node:fs";
-import path31 from "node:path";
+import fs23 from "node:fs";
+import path32 from "node:path";
 
 // src/guest/apps/after-install.ts
-import fs19 from "node:fs";
-import path27 from "node:path";
+import fs20 from "node:fs";
+import path28 from "node:path";
 var SYSINTERNALS_TOOLS = [
   "Process Explorer",
   "Process Monitor",
@@ -28355,16 +28473,16 @@ var SYSINTERNALS_TOOLS = [
   "ZoomIt"
 ];
 async function afterInstall(entry, exe) {
-  const dir = path27.dirname(exe);
+  const dir = path28.dirname(exe);
   if (entry.needs?.includes("mesa")) {
     const mesa = tool("mesa", arch === "arm64" ? "arm64" : "x64");
     for (const dll of ["opengl32.dll", "libgallium_wgl.dll", "dxil.dll"]) {
-      if (exists(path27.join(mesa, dll)) && !exists(path27.join(dir, dll)))
-        fs19.copyFileSync(path27.join(mesa, dll), path27.join(dir, dll));
+      if (exists(path28.join(mesa, dll)) && !exists(path28.join(dir, dll)))
+        fs20.copyFileSync(path28.join(mesa, dll), path28.join(dir, dll));
     }
   }
-  if (entry.id === "godot" && !exists(path27.join(dir, "._sc_"))) fs19.writeFileSync(path27.join(dir, "._sc_"), "");
-  if (entry.id === "sublime") mkdirp(path27.join(dir, "Data"));
+  if (entry.id === "godot" && !exists(path28.join(dir, "._sc_"))) fs20.writeFileSync(path28.join(dir, "._sc_"), "");
+  if (entry.id === "sublime") mkdirp(path28.join(dir, "Data"));
   if (entry.id === "sysinternals") {
     for (const name of SYSINTERNALS_TOOLS) {
       await execAsync(
@@ -28377,14 +28495,14 @@ async function afterInstall(entry, exe) {
 }
 
 // src/guest/apps/find-exe.ts
-import fs20 from "node:fs";
-import path28 from "node:path";
+import fs21 from "node:fs";
+import path29 from "node:path";
 var MAX_DEPTH = 7;
 var MAX_ENTRIES = 5e4;
 var X64_FOLDER = /(^|[\\/])(amd64|x64|x86_64|win64)([\\/]|$)/i;
 function findExe(root, exe) {
   const match = exeMatcher(exe);
-  const best = (hits) => hits.find((h) => X64_FOLDER.test(path28.relative(root, h))) ?? hits[0] ?? null;
+  const best = (hits) => hits.find((h) => X64_FOLDER.test(path29.relative(root, h))) ?? hits[0] ?? null;
   let queue = [root];
   let seen = 0;
   for (let depth = 0; depth < MAX_DEPTH && queue.length; depth++) {
@@ -28393,14 +28511,14 @@ function findExe(root, exe) {
     for (const dir of queue) {
       let entries2;
       try {
-        entries2 = fs20.readdirSync(dir, { withFileTypes: true });
+        entries2 = fs21.readdirSync(dir, { withFileTypes: true });
       } catch {
         continue;
       }
       const hit = entries2.find((e) => e.isFile() && match(e.name));
-      if (hit) hits.push(path28.join(dir, hit.name));
+      if (hit) hits.push(path29.join(dir, hit.name));
       else
-        next.push(...entries2.filter((e) => e.isDirectory() && !e.isSymbolicLink()).map((e) => path28.join(dir, e.name)));
+        next.push(...entries2.filter((e) => e.isDirectory() && !e.isSymbolicLink()).map((e) => path29.join(dir, e.name)));
       if ((seen += entries2.length) > MAX_ENTRIES) return best(hits);
     }
     if (hits.length) return best(hits);
@@ -28411,12 +28529,12 @@ function findExe(root, exe) {
 
 // src/guest/apps/shortcuts.ts
 import os5 from "node:os";
-import path29 from "node:path";
+import path30 from "node:path";
 function shortcuts(apps) {
   if (!apps.length) return;
-  const desktop = path29.join(os5.homedir(), "Desktop");
-  const start = path29.join(
-    process.env.APPDATA ?? path29.join(os5.homedir(), "AppData", "Roaming"),
+  const desktop = path30.join(os5.homedir(), "Desktop");
+  const start = path30.join(
+    process.env.APPDATA ?? path30.join(os5.homedir(), "AppData", "Roaming"),
     "Microsoft",
     "Windows",
     "Start Menu",
@@ -28426,9 +28544,9 @@ function shortcuts(apps) {
   const links = apps.flatMap((app) => {
     const name = app.name.replace(/[\\/:*?"<>|]/g, "");
     return [desktop, start].map((folder) => ({
-      link: path29.join(folder, name + ".lnk"),
+      link: path30.join(folder, name + ".lnk"),
       target: app.exe,
-      workingDirectory: path29.dirname(app.exe)
+      workingDirectory: path30.dirname(app.exe)
     }));
   });
   runScriptWithJson("new-shortcuts.ps1", "ListFile", links);
@@ -28560,12 +28678,12 @@ async function resolve(entry) {
 }
 
 // src/guest/apps/unpack.ts
-import fs21 from "node:fs";
-import path30 from "node:path";
+import fs22 from "node:fs";
+import path31 from "node:path";
 var sevenZip = () => tool("apps", "7zip", "7z.exe");
 async function unpack(entry, file3, out, d) {
   if (entry.id === "7zip") {
-    const sevenZr = path30.join(path30.dirname(file3), "7zr.exe");
+    const sevenZr = path31.join(path31.dirname(file3), "7zr.exe");
     const zr = await githubAsset("ip7z/7zip", /^7zr\.exe$/);
     await downloader.file(zr.url, sevenZr, zr.sha256);
     await execAsync(sevenZr, ["x", "-y", "-o" + out, file3], { stdio: "ignore" });
@@ -28574,17 +28692,17 @@ async function unpack(entry, file3, out, d) {
   switch (entry.unpack ?? "archive") {
     case "file": {
       mkdirp(out);
-      fs21.renameSync(file3, path30.join(out, /^\//.test(entry.exe) ? path30.basename(file3) : entry.exe));
+      fs22.renameSync(file3, path31.join(out, /^\//.test(entry.exe) ? path31.basename(file3) : entry.exe));
       return;
     }
     case "nsis": {
       if (!exists(sevenZip()))
         throw new Error("7-Zip is needed to unpack " + entry.name + " and could not be installed");
-      const raw = path30.join(path30.dirname(out), "raw");
+      const raw = path31.join(path31.dirname(out), "raw");
       await execAsync(sevenZip(), ["x", "-y", "-o" + raw, file3], { stdio: "ignore" });
       const inner = findExe(raw, "/^app-64\\.7z$/");
       if (inner) await execAsync(sevenZip(), ["x", "-y", "-o" + out, inner], { stdio: "ignore" });
-      else fs21.renameSync(raw, out);
+      else fs22.renameSync(raw, out);
       return;
     }
     case "msi": {
@@ -28634,11 +28752,11 @@ var AppInstaller = class {
   async installOne(entry) {
     try {
       const dest = tool("apps", ...entry.id.split("/"));
-      if (!exists(path31.join(dest, MARKER)) || this.options.refresh) await this.download(entry, dest);
+      if (!exists(path32.join(dest, MARKER)) || this.options.refresh) await this.download(entry, dest);
       const exe = findExe(dest, entry.exe);
       if (!exe) throw new Error(entry.exe + " not found in the download");
       await afterInstall(entry, exe);
-      if (entry.cli || entry.id === "sysinternals") this.env.prepend.push(path31.dirname(exe));
+      if (entry.cli || entry.id === "sysinternals") this.env.prepend.push(path32.dirname(exe));
       if (!entry.cli) this.gui.push({ name: entry.name, exe });
       this.installed.push(entry.name);
     } catch (e) {
@@ -28651,10 +28769,10 @@ var AppInstaller = class {
   /** Downloads and unpacks one entry into its folder (replaced in one step: never half there). */
   async download(entry, dest) {
     const work = stagingFolder(dest);
-    const out = path31.join(work, "out");
+    const out = path32.join(work, "out");
     try {
       if ("npm" in entry.source) {
-        const npmCli = path31.join(path31.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+        const npmCli = path32.join(path32.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
         log("Installing " + entry.name + " (npm) ...");
         await execAsync(process.execPath, [
           npmCli,
@@ -28669,14 +28787,14 @@ var AppInstaller = class {
       } else {
         const d = await resolve(entry);
         log("Downloading " + entry.name + " (" + d.fileName + ", ~" + entry.size + " once) ...");
-        const file3 = path31.join(mkdirp(work), d.fileName.replace(/[\\/:*?"<>|]/g, "_"));
+        const file3 = path32.join(mkdirp(work), d.fileName.replace(/[\\/:*?"<>|]/g, "_"));
         await downloader.file(d.url, file3, { sha256: d.sha256 ?? null });
         await unpack(entry, file3, out, d);
       }
-      fs22.writeFileSync(path31.join(out, MARKER), JSON.stringify({ id: entry.id, at: (/* @__PURE__ */ new Date()).toISOString() }));
+      fs23.writeFileSync(path32.join(out, MARKER), JSON.stringify({ id: entry.id, at: (/* @__PURE__ */ new Date()).toISOString() }));
       moveIntoPlace(out, dest);
     } finally {
-      safeRemove(work, path31.dirname(work));
+      safeRemove(work, path32.dirname(work));
     }
   }
 };
@@ -28691,8 +28809,8 @@ async function setupApps(env, apps, o) {
 }
 
 // src/guest/toolchains/detect.ts
-import fs23 from "node:fs";
-import path32 from "node:path";
+import fs24 from "node:fs";
+import path33 from "node:path";
 
 // src/core/detect/versions.ts
 function pickNodeVersion(releases, spec) {
@@ -28824,14 +28942,14 @@ function workspaceEntries() {
   if (known) return known;
   const list = (dir) => {
     try {
-      return fs23.readdirSync(dir, { withFileTypes: true });
+      return fs24.readdirSync(dir, { withFileTypes: true });
     } catch {
       return [];
     }
   };
   const top = list(workspace2);
   const below = top.filter((d) => d.isDirectory() && !d.name.startsWith(".") && !SKIP_DIRS.has(d.name.toLowerCase())).flatMap(
-    (d) => list(path32.join(workspace2, d.name)).filter((f) => f.isFile()).map((f) => d.name + "/" + f.name)
+    (d) => list(path33.join(workspace2, d.name)).filter((f) => f.isFile()).map((f) => d.name + "/" + f.name)
   );
   const found = [...top.filter((d) => d.isFile()).map((d) => d.name), ...below];
   entries.set(workspace2.toLowerCase(), found);
@@ -28842,9 +28960,9 @@ function wanted(setting, toolchain) {
 }
 function versionFromFiles(files, parse5 = (t) => specFromVersionFile(t)) {
   for (const name of files) {
-    const file3 = path32.join(projectWorkspace(), name);
+    const file3 = path33.join(projectWorkspace(), name);
     if (!exists(file3)) continue;
-    const spec = parse5(fs23.readFileSync(file3, "utf8"), name);
+    const spec = parse5(fs24.readFileSync(file3, "utf8"), name);
     if (spec) return { spec, source: name };
   }
   return null;
@@ -28917,22 +29035,22 @@ var DatabaseServer = class {
 };
 
 // src/guest/databases/dynamodb.ts
-import fs28 from "node:fs";
-import path35 from "node:path";
+import fs29 from "node:fs";
+import path36 from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 
 // src/guest/toolchains/languages/java.ts
-import fs26 from "node:fs";
-import path33 from "node:path";
+import fs27 from "node:fs";
+import path34 from "node:path";
 
 // src/guest/toolchains/version-cache.ts
-import fs25 from "node:fs";
+import fs26 from "node:fs";
 
 // src/guest/toolchains/state-file.ts
-import fs24 from "node:fs";
+import fs25 from "node:fs";
 function readState(file3, schema, empty) {
   try {
-    return schema.safeParse(JSON.parse(fs24.readFileSync(file3, "utf8").replace(/^\uFEFF/, ""))).data ?? empty;
+    return schema.safeParse(JSON.parse(fs25.readFileSync(file3, "utf8").replace(/^\uFEFF/, ""))).data ?? empty;
   } catch {
     return empty;
   }
@@ -28967,7 +29085,7 @@ var VersionCache = class {
       return cached2.value;
     try {
       const value = await resolve2();
-      fs25.mkdirSync(toolsDir, { recursive: true });
+      fs26.mkdirSync(toolsDir, { recursive: true });
       writeJsonAtomic(this.file(), { ...this.remembered(), [key2]: { value, at: Date.now() } });
       return value;
     } catch (e) {
@@ -29020,7 +29138,7 @@ var setupJdk = async (env, config2) => {
   const { major, source } = await javaMajor(config2);
   const release = await resolveCached("java:" + major, async () => (await temurin(major)).release_name);
   const home = tool("java", release.replace(/[^A-Za-z0-9.-]/g, "_"));
-  if (!exists(path33.join(home, "bin", "java.exe"))) {
+  if (!exists(path34.join(home, "bin", "java.exe"))) {
     const asset = await temurin(major);
     log("Downloading Java " + release + " (JDK, ~200 MB once) ...");
     await downloader.archive(asset.binary.package.link, home, {
@@ -29030,13 +29148,13 @@ var setupJdk = async (env, config2) => {
     });
   }
   env.vars.JAVA_HOME = home;
-  env.prepend.push(path33.join(home, "bin"));
+  env.prepend.push(path34.join(home, "bin"));
   env.summary.push("java: " + release + " (Temurin, from " + source + ")");
 };
 async function ensureJdk() {
   const root = tool("java");
-  const installed = exists(root) ? fs26.readdirSync(root).filter((d) => exists(path33.join(root, d, "bin", "java.exe"))).sort((a, b) => b.localeCompare(a, void 0, { numeric: true })) : [];
-  if (installed.length) return path33.join(root, installed[0]);
+  const installed = exists(root) ? fs27.readdirSync(root).filter((d) => exists(path34.join(root, d, "bin", "java.exe"))).sort((a, b) => b.localeCompare(a, void 0, { numeric: true })) : [];
+  if (installed.length) return path34.join(root, installed[0]);
   const scratch = emptyEnv();
   await setupJdk(scratch, { enabled: true, version: "lts", maven: false, gradle: false });
   return scratch.vars.JAVA_HOME;
@@ -29049,7 +29167,7 @@ var setupMaven = async (env) => {
     return pickPackageVersion(versions, "3") ?? Promise.reject(new Error("No Maven 3 release found"));
   });
   const home = tool("maven", version2);
-  if (!exists(path33.join(home, "bin", "mvn.cmd"))) {
+  if (!exists(path34.join(home, "bin", "mvn.cmd"))) {
     const url2 = MAVEN + version2 + "/apache-maven-" + version2 + "-bin.zip";
     log("Downloading Maven " + version2 + " (~10 MB once) ...");
     await downloader.archive(url2, home, {
@@ -29059,7 +29177,7 @@ var setupMaven = async (env) => {
   }
   const repo = tool("maven-repository");
   Object.assign(env.vars, { MAVEN_HOME: home, M2_HOME: home, MAVEN_OPTS: "-Dmaven.repo.local=" + repo });
-  env.prepend.push(path33.join(home, "bin"));
+  env.prepend.push(path34.join(home, "bin"));
   env.summary.push("maven: " + version2);
 };
 var setupGradle = async (env) => {
@@ -29071,7 +29189,7 @@ var setupGradle = async (env) => {
     async () => current?.version ?? Promise.reject(new Error("Gradle version lookup failed"))
   );
   const home = tool("gradle", version2);
-  if (!exists(path33.join(home, "bin", "gradle.bat"))) {
+  if (!exists(path34.join(home, "bin", "gradle.bat"))) {
     if (!current || current.version !== version2)
       throw new Error("Gradle " + version2 + " is not installed and cannot be downloaded right now");
     log("Downloading Gradle " + version2 + " (~130 MB once) ...");
@@ -29082,13 +29200,13 @@ var setupGradle = async (env) => {
     });
   }
   const userHome = tool("gradle-home");
-  fs26.mkdirSync(userHome, { recursive: true });
+  fs27.mkdirSync(userHome, { recursive: true });
   Object.assign(env.vars, {
     GRADLE_HOME: home,
     GRADLE_USER_HOME: userHome,
     GRADLE_OPTS: "-Dorg.gradle.vfs.watch=false"
   });
-  env.prepend.push(path33.join(home, "bin"));
+  env.prepend.push(path34.join(home, "bin"));
   env.summary.push("gradle: " + version2);
 };
 async function setupJava(env, config2) {
@@ -29112,29 +29230,29 @@ async function setupJava(env, config2) {
 }
 
 // src/guest/databases/server.ts
-import fs27 from "node:fs";
-import path34 from "node:path";
+import fs28 from "node:fs";
+import path35 from "node:path";
 import { spawn as spawn2 } from "node:child_process";
 function dataFor(name) {
-  return path34.join(dataDir, "databases", name);
+  return path35.join(dataDir, "databases", name);
 }
 async function startServer(name, exe, args, port) {
   if (await portOpen(port)) throw new Error("port " + port + " is already in use (change databases." + name + ".port)");
-  const logFile2 = path34.join(logsDir, name + ".log");
-  const out = fs27.openSync(logFile2, "a");
+  const logFile2 = path35.join(logsDir, name + ".log");
+  const out = fs28.openSync(logFile2, "a");
   spawn2(exe, args, { detached: true, stdio: ["ignore", out, out], windowsHide: true }).unref();
-  fs27.closeSync(out);
+  fs28.closeSync(out);
   if (!await waitForPort(port, 60))
     throw new Error(name + " did not start listening on port " + port + "; see " + logFile2);
 }
 async function clearStaleLocks(dir, files, port) {
   if (await portOpen(port)) return;
-  for (const f of files) fs27.rmSync(path34.join(dir, f), { force: true });
+  for (const f of files) fs28.rmSync(path35.join(dir, f), { force: true });
 }
 async function createOnce(data, marker, create) {
-  if (exists(path34.join(data, marker))) return;
+  if (exists(path35.join(data, marker))) return;
   const existed = exists(data);
-  mkdirp(path34.dirname(data));
+  mkdirp(path35.dirname(data));
   try {
     await create();
   } catch (e) {
@@ -29158,9 +29276,9 @@ var DynamoServer = class extends DatabaseServer {
    * local endpoint up from AWS_ENDPOINT_URL_DYNAMODB, with dummy credentials (real ones never reach the sandbox).
    */
   async start(env, plan2) {
-    const java = path35.join(await ensureJdk(), "bin", "java.exe");
+    const java = path36.join(await ensureJdk(), "bin", "java.exe");
     const home = tool("dynamodb-local");
-    if (!exists(path35.join(home, "DynamoDBLocal.jar"))) {
+    if (!exists(path36.join(home, "DynamoDBLocal.jar"))) {
       log("Downloading DynamoDB Local (~60 MB once) ...");
       const sha256 = (await fetchText(DYNAMO_ZIP + ".sha256")).trim().split(/\s+/)[0];
       await downloader.archive(DYNAMO_ZIP, home, {
@@ -29174,9 +29292,9 @@ var DynamoServer = class extends DatabaseServer {
       "dynamodb",
       java,
       [
-        "-Djava.library.path=" + path35.join(home, "DynamoDBLocal_lib"),
+        "-Djava.library.path=" + path36.join(home, "DynamoDBLocal_lib"),
         "-jar",
-        path35.join(home, "DynamoDBLocal.jar"),
+        path36.join(home, "DynamoDBLocal.jar"),
         "-sharedDb",
         "-dbPath",
         data,
@@ -29200,10 +29318,10 @@ var DynamoServer = class extends DatabaseServer {
     );
     if (!plan2.adminPort) return;
     const prefix = tool("dynamodb-admin");
-    const script = path35.join(prefix, "node_modules", "dynamodb-admin", "dist", "dynamodb-admin.js");
+    const script = path36.join(prefix, "node_modules", "dynamodb-admin", "dist", "dynamodb-admin.js");
     if (!exists(script)) {
       log("Installing dynamodb-admin, the DynamoDB web UI (~20 MB once) ...");
-      const npmCli = path35.join(path35.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+      const npmCli = path36.join(path36.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
       await execAsync(
         process.execPath,
         [npmCli, "install", "--global", "--prefix", prefix, "dynamodb-admin", "--no-fund", "--no-audit"],
@@ -29216,15 +29334,15 @@ var DynamoServer = class extends DatabaseServer {
       );
       return;
     }
-    const out = fs28.openSync(path35.join(logsDir, "dynamodb-admin.log"), "a");
+    const out = fs29.openSync(path36.join(logsDir, "dynamodb-admin.log"), "a");
     spawn3(
       process.execPath,
       [script, "--port", String(plan2.adminPort), "--dynamo-endpoint", endpoint, "--skip-default-credentials"],
       { detached: true, stdio: ["ignore", out, out], windowsHide: true, env: { ...process.env, ...aws } }
     ).unref();
-    fs28.closeSync(out);
+    fs29.closeSync(out);
     if (!await waitForPort(plan2.adminPort, 30))
-      throw new Error("dynamodb-admin did not start; see " + path35.join(logsDir, "dynamodb-admin.log"));
+      throw new Error("dynamodb-admin did not start; see " + path36.join(logsDir, "dynamodb-admin.log"));
     env.summary.push(
       "dynamodb-admin: http://localhost:" + plan2.adminPort + " (browse and edit tables in the sandbox's browser)"
     );
@@ -29232,18 +29350,18 @@ var DynamoServer = class extends DatabaseServer {
 };
 
 // src/guest/databases/mongodb.ts
-import path36 from "node:path";
+import path37 from "node:path";
 
 // src/guest/toolchains/install.ts
-import fs29 from "node:fs";
+import fs30 from "node:fs";
 async function downloadFile(url2, file3, sha256 = null) {
   const part = file3 + ".part";
   try {
     await downloader.file(url2, part, sha256);
-    fs29.rmSync(file3, { force: true });
-    fs29.renameSync(part, file3);
+    fs30.rmSync(file3, { force: true });
+    fs30.renameSync(part, file3);
   } finally {
-    fs29.rmSync(part, { force: true });
+    fs30.rmSync(part, { force: true });
   }
 }
 async function installFromGithub(repo, pattern, o) {
@@ -29272,13 +29390,13 @@ var MongoServer = class extends DatabaseServer {
     };
     const version2 = await resolveCached("mongodb:" + plan2.version, async () => (await find()).version);
     const home = tool("mongodb", version2);
-    if (!exists(path36.join(home, "bin", "mongod.exe"))) {
+    if (!exists(path37.join(home, "bin", "mongod.exe"))) {
       const { archive } = await find();
       log("Downloading MongoDB " + version2 + " (~400 MB once) ...");
       await downloader.archive(archive.url, home, { sha256: archive.sha256, locate: "mongod.exe", up: 1 });
     }
     const shell = tool("mongosh");
-    if (!exists(path36.join(shell, "mongosh.exe"))) {
+    if (!exists(path37.join(shell, "mongosh.exe"))) {
       await installFromGithub("mongodb-js/mongosh", /^mongosh-[\d.]+-win32-x64\.zip$/, {
         dest: shell,
         what: "mongosh, the MongoDB shell (~50 MB once)",
@@ -29289,17 +29407,17 @@ var MongoServer = class extends DatabaseServer {
     await clearStaleLocks(data, ["mongod.lock"], plan2.port);
     await startServer(
       "mongodb",
-      path36.join(home, "bin", "mongod.exe"),
+      path37.join(home, "bin", "mongod.exe"),
       ["--dbpath", data, "--bind_ip", "127.0.0.1", "--port", String(plan2.port)],
       plan2.port
     );
-    env.prepend.push(path36.join(home, "bin"), shell);
+    env.prepend.push(path37.join(home, "bin"), shell);
     env.summary.push("mongodb " + version2 + ": mongodb://127.0.0.1:" + plan2.port + " (mongosh on PATH)");
   }
 };
 
 // src/guest/databases/mysql.ts
-import path37 from "node:path";
+import path38 from "node:path";
 var MARIA = "https://downloads.mariadb.org/rest-api/mariadb/";
 var MysqlServer = class extends DatabaseServer {
   id = "mysql";
@@ -29317,8 +29435,8 @@ var MysqlServer = class extends DatabaseServer {
     };
     const version2 = await resolveCached("mariadb-version:" + series, async () => (await latest()).version);
     const home = tool("mariadb", version2);
-    const bin = path37.join(home, "bin");
-    if (!exists(path37.join(bin, "mariadbd.exe"))) {
+    const bin = path38.join(home, "bin");
+    if (!exists(path38.join(bin, "mariadbd.exe"))) {
       const { zip } = await latest();
       log("Downloading MariaDB " + version2 + " (~90 MB once) ...");
       await downloader.archive(zip.file_download_url.replace(/^http:/, "https:"), home, {
@@ -29331,13 +29449,13 @@ var MysqlServer = class extends DatabaseServer {
     const data = dataFor("mariadb");
     await createOnce(data, "mysql", async () => {
       log("Creating the MariaDB database (first start) ...");
-      await execAsync(path37.join(bin, "mariadb-install-db.exe"), ["--datadir=" + data, "--port=" + plan2.port], {
+      await execAsync(path38.join(bin, "mariadb-install-db.exe"), ["--datadir=" + data, "--port=" + plan2.port], {
         stdio: "ignore"
       });
     });
     await startServer(
       "mysql",
-      path37.join(bin, "mariadbd.exe"),
+      path38.join(bin, "mariadbd.exe"),
       ["--datadir=" + data, "--port=" + plan2.port, "--bind-address=127.0.0.1", "--console"],
       plan2.port
     );
@@ -29350,8 +29468,8 @@ var MysqlServer = class extends DatabaseServer {
 };
 
 // src/guest/databases/postgres.ts
-import fs30 from "node:fs";
-import path38 from "node:path";
+import fs31 from "node:fs";
+import path39 from "node:path";
 function postgresData(version2) {
   return dataFor("postgres-" + version2.split(".")[0]);
 }
@@ -29366,8 +29484,8 @@ var PostgresServer = class extends DatabaseServer {
       return hit ? hit.major + "." + hit.latestMinor : Promise.reject(new Error("No supported PostgreSQL " + plan2.version));
     });
     const home = tool("postgres", exact);
-    const bin = path38.join(home, "bin");
-    if (!exists(path38.join(bin, "pg_ctl.exe"))) {
+    const bin = path39.join(home, "bin");
+    if (!exists(path39.join(bin, "pg_ctl.exe"))) {
       log("Downloading PostgreSQL " + exact + " (~330 MB once) ...");
       await downloader.archive(
         "https://get.enterprisedb.com/postgresql/postgresql-" + exact + "-1-windows-x64-binaries.zip",
@@ -29384,7 +29502,7 @@ var PostgresServer = class extends DatabaseServer {
     await createOnce(data, "PG_VERSION", async () => {
       log("Creating the PostgreSQL database (first start) ...");
       await execAsync(
-        path38.join(bin, "initdb.exe"),
+        path39.join(bin, "initdb.exe"),
         ["-D", data, "-U", "postgres", "-A", "trust", "-E", "UTF8", "--locale=C"],
         { stdio: "ignore" }
       );
@@ -29393,7 +29511,7 @@ var PostgresServer = class extends DatabaseServer {
       throw new Error("port " + plan2.port + " is already in use (change databases.postgres.port)");
     await clearStaleLocks(data, ["postmaster.pid"], plan2.port);
     await execAsync(
-      path38.join(bin, "pg_ctl.exe"),
+      path39.join(bin, "pg_ctl.exe"),
       [
         "start",
         "-D",
@@ -29402,7 +29520,7 @@ var PostgresServer = class extends DatabaseServer {
         "-t",
         "60",
         "-l",
-        path38.join(logsDir, "postgres.log"),
+        path39.join(logsDir, "postgres.log"),
         "-o",
         "-p " + plan2.port + " -c listen_addresses=localhost"
       ],
@@ -29417,10 +29535,10 @@ var PostgresServer = class extends DatabaseServer {
   /** Every installed version's cluster shuts down cleanly through pg_ctl first. */
   async stop(plan2) {
     if (exists(tool("postgres"))) {
-      for (const version2 of fs30.readdirSync(tool("postgres"))) {
+      for (const version2 of fs31.readdirSync(tool("postgres"))) {
         const data = postgresData(version2);
-        const pgCtl = path38.join(tool("postgres", version2), "bin", "pg_ctl.exe");
-        if (exists(path38.join(data, "postmaster.pid")) && exists(pgCtl))
+        const pgCtl = path39.join(tool("postgres", version2), "bin", "pg_ctl.exe");
+        if (exists(path39.join(data, "postmaster.pid")) && exists(pgCtl))
           await execAsync(pgCtl, ["stop", "-D", data, "-m", "fast", "-w"], { stdio: "ignore" });
       }
     }
@@ -29429,12 +29547,12 @@ var PostgresServer = class extends DatabaseServer {
 };
 
 // src/guest/databases/redis.ts
-import path39 from "node:path";
+import path40 from "node:path";
 var RedisServer = class extends DatabaseServer {
   id = "redis";
   async start(env, plan2) {
     const home = tool("redis");
-    if (!exists(path39.join(home, "redis-server.exe"))) {
+    if (!exists(path40.join(home, "redis-server.exe"))) {
       await installFromGithub("redis-windows/redis-windows", /^Redis-[\d.]+-Windows-x64-msys2\.zip$/, {
         dest: home,
         what: (a) => "Redis (" + a.name + ", ~10 MB once)",
@@ -29444,7 +29562,7 @@ var RedisServer = class extends DatabaseServer {
     const data = mkdirp(dataFor("redis"));
     await startServer(
       "redis",
-      path39.join(home, "redis-server.exe"),
+      path40.join(home, "redis-server.exe"),
       ["--port", String(plan2.port), "--bind", "127.0.0.1", "--dir", data.replace(/\\/g, "/"), "--appendonly", "yes"],
       plan2.port
     );
@@ -29482,16 +29600,16 @@ async function setupDatabase(env, plan2) {
 }
 
 // src/guest/toolchains/tools/git.ts
-import fs32 from "node:fs";
-import path41 from "node:path";
+import fs33 from "node:fs";
+import path42 from "node:path";
 
 // src/guest/runtime/csc.ts
-import fs31 from "node:fs";
+import fs32 from "node:fs";
 import os6 from "node:os";
-import path40 from "node:path";
+import path41 from "node:path";
 import crypto3 from "node:crypto";
 import { spawnSync as spawnSync5 } from "node:child_process";
-var CSC = path40.join(process.env.WINDIR ?? "C:\\Windows", "Microsoft.NET", "Framework64", "v4.0.30319", "csc.exe");
+var CSC = path41.join(process.env.WINDIR ?? "C:\\Windows", "Microsoft.NET", "Framework64", "v4.0.30319", "csc.exe");
 var SOURCES = {
   ptyhost: "PtyHost.cs",
   gitshim: "GitShim.cs",
@@ -29503,17 +29621,17 @@ var SOURCES = {
   memgov: "MemGov.cs"
 };
 function sourceOf(name) {
-  return path40.join(launchDir, "sandbox", "csharp", SOURCES[name]);
+  return path41.join(launchDir, "sandbox", "csharp", SOURCES[name]);
 }
 function sourceHash(name) {
-  return crypto3.createHash("sha256").update(fs31.readFileSync(sourceOf(name))).digest("hex").slice(0, 12);
+  return crypto3.createHash("sha256").update(fs32.readFileSync(sourceOf(name))).digest("hex").slice(0, 12);
 }
 function ensureCompiled(name) {
-  const exe = path40.join(os6.tmpdir(), "agent-sandbox", name + "-" + sourceHash(name) + ".exe");
+  const exe = path41.join(os6.tmpdir(), "agent-sandbox", name + "-" + sourceHash(name) + ".exe");
   if (exists(exe)) return exe;
   if (!exists(CSC))
     throw new Error("The .NET Framework C# compiler was not found at " + CSC + " (it ships with Windows 10/11).");
-  mkdirp(path40.dirname(exe));
+  mkdirp(path41.dirname(exe));
   const result = spawnSync5(CSC, ["/nologo", "/optimize", "/target:exe", "/out:" + exe, sourceOf(name)], {
     encoding: "utf8",
     windowsHide: true
@@ -29547,23 +29665,23 @@ var installPortableGit = async (root) => {
     await downloader.file(asset.url, sfx, asset.sha256);
     await execAsync(sfx, ["-o" + root, "-y"], { stdio: "ignore" });
   } finally {
-    fs32.rmSync(sfx, { force: true });
+    fs33.rmSync(sfx, { force: true });
   }
 };
 var installGuard = (env, access, realGit) => {
   const dir = mkdirp(tool("gitguard"));
-  const guard = path41.join(launchDir, "runtime", "gitguard.js");
-  if (duringSession() && (exists(path41.join(dir, "git.exe")) || exists(path41.join(dir, "git.cmd")))) {
+  const guard = path42.join(launchDir, "runtime", "gitguard.js");
+  if (duringSession() && (exists(path42.join(dir, "git.exe")) || exists(path42.join(dir, "git.cmd")))) {
   } else
     try {
-      fs32.copyFileSync(ensureCompiled("gitshim"), path41.join(dir, "git.exe"));
-      fs32.rmSync(path41.join(dir, "git.cmd"), { force: true });
+      fs33.copyFileSync(ensureCompiled("gitshim"), path42.join(dir, "git.exe"));
+      fs33.rmSync(path42.join(dir, "git.cmd"), { force: true });
     } catch (e) {
       warn("git guard: falling back to git.cmd (" + errMsg(e) + ")");
-      fs32.writeFileSync(path41.join(dir, "git.cmd"), '@"' + process.execPath + '" "' + guard + '" %*\r\n');
+      fs33.writeFileSync(path42.join(dir, "git.cmd"), '@"' + process.execPath + '" "' + guard + '" %*\r\n');
     }
-  fs32.writeFileSync(
-    path41.join(dir, "bashenv.sh"),
+  fs33.writeFileSync(
+    path42.join(dir, "bashenv.sh"),
     'git() { "' + posix(process.execPath) + '" "' + posix(guard) + '" "$@"; }\nexport -f git\n'
   );
   env.prepend.unshift(dir);
@@ -29572,13 +29690,13 @@ var installGuard = (env, access, realGit) => {
     AGENT_REAL_GIT: access === "readonly" ? realGit : "",
     AGENT_GUARD_NODE: process.execPath,
     AGENT_GUARD_SCRIPT: guard,
-    BASH_ENV: posix(path41.join(dir, "bashenv.sh"))
+    BASH_ENV: posix(path42.join(dir, "bashenv.sh"))
   });
   if (access === "readonly") {
-    const hooks = mkdirp(path41.join(dir, "hooks"));
+    const hooks = mkdirp(path42.join(dir, "hooks"));
     for (const hook of BLOCKED_HOOKS)
-      fs32.writeFileSync(
-        path41.join(hooks, hook),
+      fs33.writeFileSync(
+        path42.join(hooks, hook),
         '#!/bin/sh\necho "git is read-only in this sandbox: ' + hook + ' refused." >&2\nexit 1\n'
       );
     Object.assign(env.vars, {
@@ -29587,22 +29705,22 @@ var installGuard = (env, access, realGit) => {
       GIT_CONFIG_VALUE_0: posix(hooks)
     });
   } else {
-    env.vars.GIT_DIR = path41.join(dataDir, "git-disabled");
+    env.vars.GIT_DIR = path42.join(dataDir, "git-disabled");
   }
 };
 var pointAtOwnCertificates = (root) => {
-  const config2 = path41.join(root, "etc", "gitconfig");
-  const bundle = path41.join(root, "mingw64", "etc", "ssl", "certs", "ca-bundle.crt");
+  const config2 = path42.join(root, "etc", "gitconfig");
+  const bundle = path42.join(root, "mingw64", "etc", "ssl", "certs", "ca-bundle.crt");
   if (!exists(config2) || !exists(bundle)) return;
-  const text = fs32.readFileSync(config2, "utf8");
+  const text = fs33.readFileSync(config2, "utf8");
   const fixed = text.replace(/^(\s*sslCAInfo\s*=\s*).*$/gim, (_m, key2) => key2 + posix(bundle));
-  if (fixed !== text) fs32.writeFileSync(config2, fixed);
+  if (fixed !== text) fs33.writeFileSync(config2, fixed);
 };
 async function setupGit(env, hostCopy, refresh, access) {
   const root = tool("git");
-  const bash = path41.join(root, "bin", "bash.exe");
-  const gitExe = path41.join(root, "cmd", "git.exe");
-  const hostGit = path41.join(hostToolsDir, "git");
+  const bash = path42.join(root, "bin", "bash.exe");
+  const gitExe = path42.join(root, "cmd", "git.exe");
+  const hostGit = path42.join(hostToolsDir, "git");
   if (exists(root) && !exists(bash)) {
     log("Replacing the old MinGit (no bash) with full Git for Windows.");
     safeRemove(root, toolsDir);
@@ -29616,11 +29734,11 @@ async function setupGit(env, hostCopy, refresh, access) {
     }
     const work = stagingFolder(root);
     try {
-      if (hostCopy && exists(path41.join(hostGit, "bin", "bash.exe"))) {
+      if (hostCopy && exists(path42.join(hostGit, "bin", "bash.exe"))) {
         log("Copying Git for Windows from this PC ...");
         robocopy(hostGit, work);
       } else await installPortableGit(work);
-      if (!exists(path41.join(work, "bin", "bash.exe"))) throw new Error("bash.exe missing after installing Git");
+      if (!exists(path42.join(work, "bin", "bash.exe"))) throw new Error("bash.exe missing after installing Git");
       moveIntoPlace(work, root);
     } finally {
       safeRemove(work, toolsDir);
@@ -29629,10 +29747,10 @@ async function setupGit(env, hostCopy, refresh, access) {
   if (!exists(bash)) throw new Error("bash.exe missing after installing Git");
   pointAtOwnCertificates(root);
   env.vars.CLAUDE_CODE_GIT_BASH_PATH = bash;
-  env.append.push(path41.join(root, "usr", "bin"));
+  env.append.push(path42.join(root, "usr", "bin"));
   const version2 = execOutput(gitExe, ["--version"]).replace(/^git version /, "");
   if (access === "full") {
-    env.prepend.push(path41.join(root, "cmd"));
+    env.prepend.push(path42.join(root, "cmd"));
     env.summary.push("git: " + version2);
     return;
   }
@@ -29643,8 +29761,8 @@ async function setupGit(env, hostCopy, refresh, access) {
 }
 
 // src/guest/toolchains/languages/go.ts
-import fs33 from "node:fs";
-import path42 from "node:path";
+import fs34 from "node:fs";
+import path43 from "node:path";
 
 // src/guest/toolchains/package-ledger.ts
 var LedgerSchema = external_exports.record(external_exports.string(), external_exports.string());
@@ -29698,7 +29816,7 @@ async function setupGo(env, config2) {
   }
   const version2 = await resolveCached("go:" + config2.version, async () => (await findRelease(config2.version)).version);
   const root = tool("go", version2);
-  if (!exists(path42.join(root, "bin", "go.exe"))) {
+  if (!exists(path43.join(root, "bin", "go.exe"))) {
     const goArch = arch === "arm64" ? "arm64" : "amd64";
     const file3 = (await findRelease(version2)).files.find(
       (f) => f.os === "windows" && f.arch === goArch && f.kind === "archive"
@@ -29715,16 +29833,16 @@ async function setupGo(env, config2) {
   const vars = {
     GOROOT: root,
     GOPATH,
-    GOBIN: path42.join(GOPATH, "bin"),
-    GOMODCACHE: path42.join(GOPATH, "pkg", "mod"),
+    GOBIN: path43.join(GOPATH, "bin"),
+    GOMODCACHE: path43.join(GOPATH, "pkg", "mod"),
     GOCACHE: tool("go-cache"),
     GOTOOLCHAIN: "auto",
     GOTELEMETRY: "off"
   };
-  fs33.mkdirSync(vars.GOBIN, { recursive: true });
+  fs34.mkdirSync(vars.GOBIN, { recursive: true });
   Object.assign(env.vars, vars);
-  env.prepend.push(path42.join(root, "bin"), vars.GOBIN);
-  const go = path42.join(root, "bin", "go.exe");
+  env.prepend.push(path43.join(root, "bin"), vars.GOBIN);
+  const go = path43.join(root, "bin", "go.exe");
   env.summary.push("go: " + versionOf(go, ["version"]));
   await installOnce(
     env,
@@ -29735,8 +29853,8 @@ async function setupGo(env, config2) {
 }
 
 // src/guest/toolchains/tools/cli.ts
-import fs34 from "node:fs";
-import path44 from "node:path";
+import fs35 from "node:fs";
+import path45 from "node:path";
 
 // src/guest/toolchains/catalogue.ts
 function pwshAsset(arch2) {
@@ -29783,14 +29901,14 @@ function decideCli(settings, ctx) {
 }
 
 // src/guest/toolchains/runtimes.ts
-import path43 from "node:path";
+import path44 from "node:path";
 async function setupSingleExe(env, name, repo, pattern, exeName, dir, options = {}) {
   if (dryRun) {
     log("(dry run) would provision " + name);
     return;
   }
-  const bin = options.subdir ? path43.join(dir, options.subdir) : dir;
-  const exe = path43.join(bin, exeName);
+  const bin = options.subdir ? path44.join(dir, options.subdir) : dir;
+  const exe = path44.join(bin, exeName);
   if (!exists(exe) || options.refresh) {
     const size = options.size ? ", ~" + options.size : "";
     await installFromGithub(repo, pattern, {
@@ -29815,8 +29933,8 @@ async function setupBun(env) {
   );
   Object.assign(env.vars, {
     BUN_INSTALL: tool("bun"),
-    BUN_INSTALL_CACHE_DIR: path43.join(localDir, "bun-cache"),
-    BUN_TMPDIR: path43.join(localDir, "bun-tmp")
+    BUN_INSTALL_CACHE_DIR: path44.join(localDir, "bun-cache"),
+    BUN_TMPDIR: path44.join(localDir, "bun-tmp")
   });
 }
 async function setupDeno(env) {
@@ -29855,11 +29973,14 @@ async function setupUv(env) {
 
 // src/guest/toolchains/tools/cli.ts
 function ghConfigDir() {
-  return path44.join(stateDir, "gh");
+  return path45.join(stateDir, "gh");
+}
+function deliveredGhConfigDir() {
+  return path45.join(localDir, "gh-token");
 }
 var toolVars = {
   gh: () => ({
-    GH_CONFIG_DIR: mkdirp(ghConfigDir()),
+    GH_CONFIG_DIR: exists(deliveredGhConfigDir()) ? deliveredGhConfigDir() : mkdirp(ghConfigDir()),
     GH_NO_UPDATE_NOTIFIER: "1",
     GH_NO_EXTENSION_UPDATE_NOTIFIER: "1"
   })
@@ -29870,16 +29991,16 @@ var shimOpenssl = (env) => {
     return;
   }
   const shims = mkdirp(tool("shims"));
-  fs34.copyFileSync(ensureCompiled("openssl"), path44.join(shims, "openssl.exe"));
-  fs34.rmSync(path44.join(shims, "openssl.cmd"), { force: true });
+  fs35.copyFileSync(ensureCompiled("openssl"), path45.join(shims, "openssl.exe"));
+  fs35.rmSync(path45.join(shims, "openssl.cmd"), { force: true });
   env.prepend.push(shims);
   env.summary.push("openssl: Git for Windows' copy");
 };
 async function setupCli(env, settings, gitAccess, refresh = false) {
-  const decisions = decideCli(settings, { gitAccess, hasGithubDir: exists(path44.join(projectWorkspace(), ".github")) });
+  const decisions = decideCli(settings, { gitAccess, hasGithubDir: exists(path45.join(projectWorkspace(), ".github")) });
   if (settings.gh && !decisions.gh.on) {
     env.summary.push("gh: off (" + decisions.gh.reason + ")");
-    if (exists(path44.join(ghConfigDir(), "hosts.yml")))
+    if (exists(path45.join(ghConfigDir(), "hosts.yml")))
       warn(
         'gh is off (git access is not "full"), but an earlier gh login is still stored in ' + ghConfigDir() + " and readable by the agent. Run `gh auth logout` in a full-access sandbox, or delete that folder."
       );
@@ -29916,12 +30037,12 @@ async function setupCli(env, settings, gitAccess, refresh = false) {
 }
 
 // src/guest/toolchains/managers.ts
-import fs35 from "node:fs";
-import path45 from "node:path";
+import fs36 from "node:fs";
+import path46 from "node:path";
 function voltaPins() {
   try {
     const pkg = JSON.parse(
-      fs35.readFileSync(path45.join(projectWorkspace(), "package.json"), "utf8").replace(/^\uFEFF/, "")
+      fs36.readFileSync(path46.join(projectWorkspace(), "package.json"), "utf8").replace(/^\uFEFF/, "")
     );
     return Object.fromEntries(
       Object.entries(pkg.volta ?? {}).filter(
@@ -29944,7 +30065,7 @@ async function setupVolta(env) {
     return;
   }
   const dir = tool("volta");
-  if (!exists(path45.join(dir, "volta.exe"))) {
+  if (!exists(path46.join(dir, "volta.exe"))) {
     const pattern = arch === "arm64" ? /^volta-[\d.]+-windows-arm64\.zip$/ : /^volta-[\d.]+-windows\.zip$/;
     await installFromGithub("volta-cli/volta", pattern, {
       dest: dir,
@@ -29953,17 +30074,17 @@ async function setupVolta(env) {
     });
   }
   for (const shim3 of ["node", "npm", "npx", "pnpm", "pnpx", "yarn", "yarnpkg"]) {
-    const target = path45.join(dir, shim3 + ".exe");
-    if (!exists(target)) fs35.copyFileSync(path45.join(dir, "volta-shim.exe"), target);
+    const target = path46.join(dir, shim3 + ".exe");
+    if (!exists(target)) fs36.copyFileSync(path46.join(dir, "volta-shim.exe"), target);
   }
   const home = mkdirp(tool("volta-home"));
-  const shims = mkdirp(path45.join(home, "bin"));
+  const shims = mkdirp(path46.join(home, "bin"));
   const vars = { VOLTA_HOME: home, VOLTA_FEATURE_PNPM: "1" };
   Object.assign(env.vars, vars);
   const pins = voltaPins();
   if (Object.keys(pins).length) env.prepend.push(dir, shims);
   else env.append.push(dir, shims);
-  const volta = path45.join(dir, "volta.exe");
+  const volta = path46.join(dir, "volta.exe");
   for (const [toolName, version2] of Object.entries(pins)) {
     try {
       await execAsync(volta, ["install", toolName + "@" + version2], {
@@ -29985,7 +30106,7 @@ async function setupPyenv(env) {
     return;
   }
   const root = tool("pyenv", "pyenv-win");
-  if (!exists(path45.join(root, "bin", "pyenv.bat"))) {
+  if (!exists(path46.join(root, "bin", "pyenv.bat"))) {
     const tag = await resolveCached("pyenv-win", () => latestGithubTag("pyenv-win/pyenv-win"));
     log("Downloading pyenv-win " + tag + " (~5 MB once) ...");
     await downloader.archive(
@@ -29994,17 +30115,17 @@ async function setupPyenv(env) {
       { locate: "pyenv.bat", up: 1, fileName: "pyenv-win.zip" }
     );
   }
-  const home = root + path45.sep;
+  const home = root + path46.sep;
   Object.assign(env.vars, { PYENV: home, PYENV_ROOT: home, PYENV_HOME: home });
-  env.append.push(path45.join(root, "bin"), path45.join(root, "shims"));
+  env.append.push(path46.join(root, "bin"), path46.join(root, "shims"));
   env.summary.push("pyenv-win: pyenv install <version> / pyenv local <version> (versions persist)");
 }
 
 // src/guest/toolchains/native/cpp.ts
-import path46 from "node:path";
+import path47 from "node:path";
 async function setupCpp(env, config2) {
   const bin = tool("mingw", "mingw64", "bin");
-  const gcc = path46.join(bin, "gcc.exe");
+  const gcc = path47.join(bin, "gcc.exe");
   if (dryRun) {
     log("(dry run) would provision MinGW-w64 GCC");
     return;
@@ -30020,7 +30141,7 @@ async function setupCpp(env, config2) {
   if (!exists(gcc)) throw new Error("gcc.exe missing after installing MinGW");
   env.append.unshift(bin);
   env.vars.CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER = gcc;
-  const cmake = versionOf(path46.join(bin, "cmake.exe"));
+  const cmake = versionOf(path47.join(bin, "cmake.exe"));
   if (cmakeTooOld(cmake))
     warn(
       "The bundled CMake " + cmake + " is older than " + CMAKE_FLOOR + ", which many projects need; set toolchains.cpp.enabled to refresh it, or install a newer CMake into C:\\AgentData\\tools\\bin."
@@ -30030,7 +30151,7 @@ async function setupCpp(env, config2) {
 }
 var setupFlexBison = async (env) => {
   const dir = tool("winflexbison");
-  if (!exists(path46.join(dir, "win_bison.exe"))) {
+  if (!exists(path47.join(dir, "win_bison.exe"))) {
     await installFromGithub("lexxmark/winflexbison", /^win_flex_bison-[\d.]+\.zip$/, {
       dest: dir,
       what: "win_flex / win_bison (~1 MB once)",
@@ -30038,16 +30159,16 @@ var setupFlexBison = async (env) => {
     });
   }
   env.append.push(dir);
-  env.summary.push("win_flex/win_bison: " + versionOf(path46.join(dir, "win_bison.exe")));
+  env.summary.push("win_flex/win_bison: " + versionOf(path47.join(dir, "win_bison.exe")));
 };
 
 // src/guest/toolchains/native/dotnet.ts
-import fs36 from "node:fs";
-import path47 from "node:path";
+import fs37 from "node:fs";
+import path48 from "node:path";
 var DotnetMarkerSchema = external_exports.record(external_exports.string(), external_exports.boolean());
 async function setupDotnet(env, config2, refresh) {
   const root = tool("dotnet");
-  const marker = path47.join(root, ".agent-sandbox-installed.json");
+  const marker = path48.join(root, ".agent-sandbox-installed.json");
   const script = tool("dotnet-install.ps1");
   if (dryRun) {
     log("(dry run) would provision .NET SDK channels " + config2.channels.join(", "));
@@ -30055,11 +30176,11 @@ async function setupDotnet(env, config2, refresh) {
   }
   const recorded = DotnetMarkerSchema.safeParse(exists(marker) && !refresh ? readJsonFile(marker) : {});
   const done = recorded.success ? recorded.data : {};
-  const globalJson = path47.join(projectWorkspace(), "global.json");
+  const globalJson = path48.join(projectWorkspace(), "global.json");
   const installs = [
     ...config2.channels.map((c) => ["channel:" + c, ["-Channel", c]]),
     ...exists(globalJson) ? [
-      ["global.json:" + fs36.readFileSync(globalJson, "utf8").replace(/\s+/g, ""), ["-JSonFile", globalJson]]
+      ["global.json:" + fs37.readFileSync(globalJson, "utf8").replace(/\s+/g, ""), ["-JSonFile", globalJson]]
     ] : []
   ];
   for (const [key2, args] of installs.filter(([k]) => !done[k])) {
@@ -30091,12 +30212,12 @@ async function setupDotnet(env, config2, refresh) {
     DOTNET_SKIP_FIRST_TIME_EXPERIENCE: "1",
     NUGET_PACKAGES: tool("nuget", "packages")
   });
-  env.prepend.push(root, path47.join(home, ".dotnet", "tools"));
+  env.prepend.push(root, path48.join(home, ".dotnet", "tools"));
   env.summary.push(
-    "dotnet: " + execOutput(path47.join(root, "dotnet.exe"), ["--list-sdks"]).split(/\r?\n/).map((l) => l.split(" ")[0]).filter(Boolean).join(", ")
+    "dotnet: " + execOutput(path48.join(root, "dotnet.exe"), ["--list-sdks"]).split(/\r?\n/).map((l) => l.split(" ")[0]).filter(Boolean).join(", ")
   );
-  const dotnet = path47.join(root, "dotnet.exe");
-  const dotnetEnv = { env: { ...process.env, ...env.vars, PATH: root + path47.delimiter + (process.env.PATH ?? "") } };
+  const dotnet = path48.join(root, "dotnet.exe");
+  const dotnetEnv = { env: { ...process.env, ...env.vars, PATH: root + path48.delimiter + (process.env.PATH ?? "") } };
   await installOnce(
     env,
     "dotnet workload",
@@ -30117,7 +30238,7 @@ var setupFrameworkReferences = async (env, targets) => {
   const root = tool("netfx-references");
   for (const target of targets) {
     const id = "microsoft.netframework.referenceassemblies." + target.toLowerCase();
-    const marker = path47.join(root, ".installed-" + target.toLowerCase());
+    const marker = path48.join(root, ".installed-" + target.toLowerCase());
     if (exists(marker)) continue;
     const staging = tool("netfx-references-" + target.toLowerCase());
     try {
@@ -30132,8 +30253,8 @@ var setupFrameworkReferences = async (env, targets) => {
         staging,
         { fileName: id + ".zip" }
       );
-      fs36.cpSync(path47.join(staging, "build", ".NETFramework"), path47.join(root, ".NETFramework"), { recursive: true });
-      fs36.writeFileSync(marker, version2);
+      fs37.cpSync(path48.join(staging, "build", ".NETFramework"), path48.join(root, ".NETFramework"), { recursive: true });
+      fs37.writeFileSync(marker, version2);
     } catch (e) {
       warn(
         ".NET Framework " + target + " reference assemblies could not be installed (projects targeting it will not build): " + errMsg(e)
@@ -30142,9 +30263,9 @@ var setupFrameworkReferences = async (env, targets) => {
       safeRemove(staging, dataDir);
     }
   }
-  if (!exists(path47.join(root, ".NETFramework"))) return;
-  env.vars.TargetFrameworkRootPath = root + path47.sep;
-  env.summary.push(".NET Framework targeting: " + fs36.readdirSync(path47.join(root, ".NETFramework")).join(", "));
+  if (!exists(path48.join(root, ".NETFramework"))) return;
+  env.vars.TargetFrameworkRootPath = root + path48.sep;
+  env.summary.push(".NET Framework targeting: " + fs37.readdirSync(path48.join(root, ".NETFramework")).join(", "));
 };
 var setupNetFx35 = async (env) => {
   if (execOutput(SYSTEM.reg(), [
@@ -30171,15 +30292,15 @@ var setupNetFx35 = async (env) => {
 };
 
 // src/guest/toolchains/native/mesa.ts
-import path48 from "node:path";
+import path49 from "node:path";
 async function setupMesa(env, config2) {
   if (dryRun) {
     log("(dry run) would provision Mesa 3D");
     return;
   }
   const root = tool("mesa");
-  const dir = path48.join(root, arch === "arm64" ? "arm64" : "x64");
-  if (!exists(path48.join(dir, "opengl32.dll"))) {
+  const dir = path49.join(root, arch === "arm64" ? "arm64" : "x64");
+  if (!exists(path49.join(dir, "opengl32.dll"))) {
     await installFromGithub("pal1000/mesa-dist-win", /^mesa3d-[\d.]+-release-msvc\.7z$/, {
       dest: root,
       what: "Mesa 3D for software OpenGL (~100 MB once)",
@@ -30195,10 +30316,10 @@ async function setupMesa(env, config2) {
 }
 var VULKAN_RUNTIME = "https://sdk.lunarg.com/sdk/download/latest/windows/vulkan-runtime-components.zip";
 var setupLavapipe = async (env, mesaDir) => {
-  const icd = path48.join(mesaDir, arch === "arm64" ? "lvp_icd.aarch64.json" : "lvp_icd.x86_64.json");
-  if (!exists(icd)) throw new Error("this Mesa build has no lavapipe (" + path48.basename(icd) + ")");
+  const icd = path49.join(mesaDir, arch === "arm64" ? "lvp_icd.aarch64.json" : "lvp_icd.x86_64.json");
+  if (!exists(icd)) throw new Error("this Mesa build has no lavapipe (" + path49.basename(icd) + ")");
   const dir = tool("vulkan");
-  if (!exists(path48.join(dir, "vulkan-1.dll"))) {
+  if (!exists(path49.join(dir, "vulkan-1.dll"))) {
     log("Downloading the Vulkan loader (~10 MB once) ...");
     await downloader.archive(VULKAN_RUNTIME, dir, {
       locate: "vulkan-1.dll",
@@ -30212,7 +30333,7 @@ var setupLavapipe = async (env, mesaDir) => {
     { stdio: "ignore" }
   );
   await register(icd);
-  const dozen = path48.join(mesaDir, arch === "arm64" ? "dzn_icd.aarch64.json" : "dzn_icd.x86_64.json");
+  const dozen = path49.join(mesaDir, arch === "arm64" ? "dzn_icd.aarch64.json" : "dzn_icd.x86_64.json");
   const gpu = hasGpu();
   if (gpu && exists(dozen)) await register(dozen);
   env.prepend.push(dir);
@@ -30223,20 +30344,20 @@ var setupLavapipe = async (env, mesaDir) => {
 var hasGpu = () => scriptOutput("get-gpu-names.ps1", [], { timeout: 3e4 }).split(/\r?\n/).map((n) => n.trim()).some((n) => n && !/^Microsoft (Remote Display|Basic (Render|Display))/i.test(n));
 
 // src/guest/toolchains/native/msvc/index.ts
-import fs40 from "node:fs";
-import path52 from "node:path";
+import fs41 from "node:fs";
+import path53 from "node:path";
 
 // src/guest/toolchains/native/msvc/environment.ts
-import fs38 from "node:fs";
-import path50 from "node:path";
+import fs39 from "node:fs";
+import path51 from "node:path";
 
 // src/guest/toolchains/native/msvc/tree.ts
-import fs37 from "node:fs";
-import path49 from "node:path";
+import fs38 from "node:fs";
+import path50 from "node:path";
 var ROOT = tool("msvc");
-var MARKER2 = path49.join(ROOT, ".installed.json");
+var MARKER2 = path50.join(ROOT, ".installed.json");
 function msvcTools(msvc, ...parts2) {
-  return path49.join(ROOT, "VC", "Tools", "MSVC", msvc, ...parts2);
+  return path50.join(ROOT, "VC", "Tools", "MSVC", msvc, ...parts2);
 }
 function hostBin(msvc, ...parts2) {
   return msvcTools(msvc, "bin", "Hostx64", "x64", ...parts2);
@@ -30247,27 +30368,27 @@ function hasCompiler(msvc) {
 var InstalledSchema = external_exports.object({ msvc: external_exports.string().min(1), sdk: external_exports.string().min(1), want: external_exports.string() });
 function readInstalled() {
   try {
-    return InstalledSchema.safeParse(JSON.parse(fs37.readFileSync(MARKER2, "utf8"))).data ?? null;
+    return InstalledSchema.safeParse(JSON.parse(fs38.readFileSync(MARKER2, "utf8"))).data ?? null;
   } catch {
     return null;
   }
 }
 
 // src/guest/toolchains/native/msvc/environment.ts
-var VSWHERE_DIR = path50.join(
+var VSWHERE_DIR = path51.join(
   process.env["ProgramFiles(x86)"] ?? "C:\\Program Files (x86)",
   "Microsoft Visual Studio",
   "Installer"
 );
 function vcvars(root, msvc, sdk) {
-  const vc = path50.join(root, "VC", "Tools", "MSVC", msvc);
-  const kits = path50.join(root, "Windows Kits", "10");
-  const inc = (...p) => path50.join(kits, "Include", sdk, ...p);
-  const lib = (...p) => path50.join(kits, "Lib", sdk, ...p);
+  const vc = path51.join(root, "VC", "Tools", "MSVC", msvc);
+  const kits = path51.join(root, "Windows Kits", "10");
+  const inc = (...p) => path51.join(kits, "Include", sdk, ...p);
+  const lib = (...p) => path51.join(kits, "Lib", sdk, ...p);
   return {
     vars: {
       VSINSTALLDIR: root + "\\",
-      VCINSTALLDIR: path50.join(root, "VC") + "\\",
+      VCINSTALLDIR: path51.join(root, "VC") + "\\",
       VCToolsInstallDir: vc + "\\",
       VCToolsVersion: msvc,
       VisualStudioVersion: "17.0",
@@ -30279,17 +30400,17 @@ function vcvars(root, msvc, sdk) {
       VSCMD_ARG_HOST_ARCH: "x64",
       VSCMD_ARG_TGT_ARCH: "x64",
       Platform: "x64",
-      INCLUDE: [path50.join(vc, "include"), inc("ucrt"), inc("shared"), inc("um"), inc("winrt"), inc("cppwinrt")].join(
+      INCLUDE: [path51.join(vc, "include"), inc("ucrt"), inc("shared"), inc("um"), inc("winrt"), inc("cppwinrt")].join(
         ";"
       ),
-      LIB: [path50.join(vc, "lib", "x64"), lib("ucrt", "x64"), lib("um", "x64")].join(";"),
-      LIBPATH: [path50.join(vc, "lib", "x64"), path50.join(vc, "lib", "x86", "store", "references")].join(";")
+      LIB: [path51.join(vc, "lib", "x64"), lib("ucrt", "x64"), lib("um", "x64")].join(";"),
+      LIBPATH: [path51.join(vc, "lib", "x64"), path51.join(vc, "lib", "x86", "store", "references")].join(";")
     },
-    path: [path50.join(vc, "bin", "Hostx64", "x64"), path50.join(kits, "bin", sdk, "x64")]
+    path: [path51.join(vc, "bin", "Hostx64", "x64"), path51.join(kits, "bin", sdk, "x64")]
   };
 }
 function writeVcvars(env) {
-  const dir = mkdirp(path50.join(ROOT, "VC", "Auxiliary", "Build"));
+  const dir = mkdirp(path51.join(ROOT, "VC", "Auxiliary", "Build"));
   const lines = [
     "@echo off",
     "rem Written by Windows Development Sandbox for its portable MSVC (host x64, target x64).",
@@ -30297,9 +30418,9 @@ function writeVcvars(env) {
     'set "PATH=' + env.path.join(";") + ';%PATH%"',
     "exit /b 0"
   ];
-  fs38.writeFileSync(path50.join(dir, "vcvars64.bat"), lines.join("\r\n") + "\r\n");
-  fs38.writeFileSync(
-    path50.join(dir, "vcvarsall.bat"),
+  fs39.writeFileSync(path51.join(dir, "vcvars64.bat"), lines.join("\r\n") + "\r\n");
+  fs39.writeFileSync(
+    path51.join(dir, "vcvarsall.bat"),
     ["@echo off", "rem Only x64 (amd64) is installed.", 'call "%~dp0vcvars64.bat"', "exit /b %errorlevel%"].join(
       "\r\n"
     ) + "\r\n"
@@ -30307,24 +30428,24 @@ function writeVcvars(env) {
 }
 function installVswhere(msvc) {
   mkdirp(VSWHERE_DIR);
-  fs38.copyFileSync(ensureCompiled("vswhere"), path50.join(VSWHERE_DIR, "vswhere.exe"));
+  fs39.copyFileSync(ensureCompiled("vswhere"), path51.join(VSWHERE_DIR, "vswhere.exe"));
   const [major, minor] = msvc.split(".").slice(2);
-  fs38.writeFileSync(
-    path50.join(VSWHERE_DIR, "vswhere.json"),
+  fs39.writeFileSync(
+    path51.join(VSWHERE_DIR, "vswhere.json"),
     JSON.stringify({ installationPath: ROOT, installationVersion: "17." + (minor ?? "0") + ".0." + (major ?? "0") })
   );
 }
 function removeTelemetry(msvc) {
   try {
-    fs38.rmSync(hostBin(msvc, "vctip.exe"), { force: true });
+    fs39.rmSync(hostBin(msvc, "vctip.exe"), { force: true });
   } catch (e) {
     warn("Could not remove MSVC's telemetry helper (vctip.exe); it may keep tools\\msvc locked: " + errMsg(e));
   }
 }
 
 // src/guest/toolchains/native/msvc/packages.ts
-import fs39 from "node:fs";
-import path51 from "node:path";
+import fs40 from "node:fs";
+import path52 from "node:path";
 var CHANNEL = "https://aka.ms/vs/17/release/channel";
 var MANIFEST_DAY_MS = 24 * 60 * 60 * 1e3;
 var MSVC_PARTS = [
@@ -30350,10 +30471,10 @@ var SDK_MSIS = [
   "Windows SDK Desktop Tools x64-x86_en-us.msi"
 ];
 var manifest = async () => {
-  const cached2 = path51.join(ROOT, ".manifest.json");
-  if (exists(cached2) && Date.now() - fs39.statSync(cached2).mtimeMs < MANIFEST_DAY_MS) {
+  const cached2 = path52.join(ROOT, ".manifest.json");
+  if (exists(cached2) && Date.now() - fs40.statSync(cached2).mtimeMs < MANIFEST_DAY_MS) {
     try {
-      return JSON.parse(fs39.readFileSync(cached2, "utf8"));
+      return JSON.parse(fs40.readFileSync(cached2, "utf8"));
     } catch {
     }
   }
@@ -30362,26 +30483,26 @@ var manifest = async () => {
   if (!item) throw new Error("the Visual Studio channel has no package manifest");
   mkdirp(ROOT);
   await downloader.file(item.url, cached2);
-  return JSON.parse(fs39.readFileSync(cached2, "utf8"));
+  return JSON.parse(fs40.readFileSync(cached2, "utf8"));
 };
 var unpackVsix = async (vsix, work) => {
-  const out = mkdirp(path51.join(work, "vsix-" + path51.basename(vsix)));
+  const out = mkdirp(path52.join(work, "vsix-" + path52.basename(vsix)));
   await extractArchive(vsix, out, ["Contents"]);
   const decode4 = (dir) => {
-    for (const entry of fs39.readdirSync(dir, { withFileTypes: true })) {
-      const from = path51.join(dir, entry.name);
+    for (const entry of fs40.readdirSync(dir, { withFileTypes: true })) {
+      const from = path52.join(dir, entry.name);
       let name = entry.name;
       try {
         if (name.includes("%")) name = decodeURIComponent(name);
       } catch {
       }
-      const to = path51.join(dir, name);
-      if (to !== from) fs39.renameSync(from, to);
+      const to = path52.join(dir, name);
+      if (to !== from) fs40.renameSync(from, to);
       if (entry.isDirectory()) decode4(to);
     }
   };
   decode4(out);
-  fs39.cpSync(path51.join(out, "Contents"), ROOT, { recursive: true, force: true });
+  fs40.cpSync(path52.join(out, "Contents"), ROOT, { recursive: true, force: true });
   safeRemove(out, work);
 };
 var unpackMsi = async (msi) => {
@@ -30391,9 +30512,9 @@ var unpackMsi = async (msi) => {
       stdio: "ignore"
     });
   } catch (e) {
-    const lines = exists(logFile2) ? fs39.readFileSync(logFile2, "utf16le").split(/\r?\n/).filter((l) => /error|return value 3|failed/i.test(l)).slice(-4).join(" | ") : "";
+    const lines = exists(logFile2) ? fs40.readFileSync(logFile2, "utf16le").split(/\r?\n/).filter((l) => /error|return value 3|failed/i.test(l)).slice(-4).join(" | ") : "";
     throw new Error(
-      path51.basename(msi) + " did not unpack: " + (e instanceof Error ? e.message : String(e)) + (lines ? " (" + lines.slice(0, 600) + ")" : "")
+      path52.basename(msi) + " did not unpack: " + (e instanceof Error ? e.message : String(e)) + (lines ? " (" + lines.slice(0, 600) + ")" : "")
     );
   }
 };
@@ -30406,13 +30527,13 @@ var catalogue = (m) => {
   };
 };
 var payloadFetcher = (work) => async (p) => {
-  const file3 = path51.join(work, path51.basename(p.fileName.replace(/\\/g, "/")));
+  const file3 = path52.join(work, path52.basename(p.fileName.replace(/\\/g, "/")));
   if (!exists(file3)) await downloader.file(p.url, file3, p.sha256);
   return file3;
 };
 var unpackedToolset = () => {
-  const toolsRoot = path51.join(ROOT, "VC", "Tools", "MSVC");
-  return fs39.readdirSync(toolsRoot).filter((d) => exists(hostBin(d, "cl.exe"))).sort((a, b) => a.localeCompare(b, void 0, { numeric: true })).pop();
+  const toolsRoot = path52.join(ROOT, "VC", "Tools", "MSVC");
+  return fs40.readdirSync(toolsRoot).filter((d) => exists(hostBin(d, "cl.exe"))).sort((a, b) => a.localeCompare(b, void 0, { numeric: true })).pop();
 };
 async function installPackages(config2) {
   const { ids, pick: pick2 } = catalogue(await manifest());
@@ -30420,7 +30541,7 @@ async function installPackages(config2) {
   if (!version2) throw new Error("no MSVC " + config2.msvcVersion + " in the Visual Studio manifest");
   const sdk = pickWindowsSdk(ids, config2.sdkVersion);
   if (!sdk) throw new Error("no Windows SDK " + config2.sdkVersion + " in the Visual Studio manifest");
-  const work = mkdirp(path51.join(ROOT, ".download"));
+  const work = mkdirp(path52.join(ROOT, ".download"));
   const fetchPayload = payloadFetcher(work);
   log("Downloading the MSVC " + version2 + " compiler and C/C++ libraries ...");
   for (const part of MSVC_PARTS) {
@@ -30440,17 +30561,17 @@ async function installPackages(config2) {
     if (!p) throw new Error("the Windows SDK package has no " + name);
     const file3 = await fetchPayload(p);
     msis.push(file3);
-    for (const cab of msiCabs(fs39.readFileSync(file3))) {
+    for (const cab of msiCabs(fs40.readFileSync(file3))) {
       const c = payload(cab);
       if (c) await fetchPayload(c);
     }
   }
   log("Unpacking the Windows SDK (a few minutes) ...");
   for (const msi of msis) await unpackMsi(msi);
-  for (const name of fs39.readdirSync(ROOT).filter((n) => n.toLowerCase().endsWith(".msi")))
-    fs39.rmSync(path51.join(ROOT, name), { force: true });
+  for (const name of fs40.readdirSync(ROOT).filter((n) => n.toLowerCase().endsWith(".msi")))
+    fs40.rmSync(path52.join(ROOT, name), { force: true });
   safeRemove(work, ROOT);
-  const sdkVersion = fs39.readdirSync(path51.join(ROOT, "Windows Kits", "10", "Include")).filter((d) => d.startsWith("10.0." + sdk.build)).sort().pop();
+  const sdkVersion = fs40.readdirSync(path52.join(ROOT, "Windows Kits", "10", "Include")).filter((d) => d.startsWith("10.0." + sdk.build)).sort().pop();
   if (!sdkVersion) throw new Error("the Windows SDK did not unpack (no Include\\10.0." + sdk.build + ".*)");
   const toolset = unpackedToolset();
   if (!toolset) throw new Error("MSVC " + version2 + " did not unpack (no cl.exe under VC\\Tools\\MSVC)");
@@ -30464,8 +30585,8 @@ function installedMsvcEnv() {
 }
 var clearTree = () => {
   if (!exists(ROOT)) return;
-  for (const name of fs40.readdirSync(ROOT).filter((n) => n !== ".manifest.json" && n !== ".download"))
-    safeRemove(path52.join(ROOT, name), ROOT);
+  for (const name of fs41.readdirSync(ROOT).filter((n) => n !== ".manifest.json" && n !== ".download"))
+    safeRemove(path53.join(ROOT, name), ROOT);
 };
 async function setupMsvc(env, config2) {
   if (!config2.acceptLicense) {
@@ -30495,24 +30616,24 @@ async function setupMsvc(env, config2) {
 }
 
 // src/guest/toolchains/native/rust.ts
-import path54 from "node:path";
+import path55 from "node:path";
 
 // src/guest/toolchains/native/binstall.ts
-import fs41 from "node:fs";
-import path53 from "node:path";
+import fs42 from "node:fs";
+import path54 from "node:path";
 var ensureBinstall = async (cargoBin) => {
-  const target = path53.join(cargoBin, "cargo-binstall.exe");
+  const target = path54.join(cargoBin, "cargo-binstall.exe");
   if (exists(target)) return true;
   try {
     const dir = tool("cargo-binstall");
-    if (!exists(path53.join(dir, "cargo-binstall.exe"))) {
+    if (!exists(path54.join(dir, "cargo-binstall.exe"))) {
       await installFromGithub("cargo-bins/cargo-binstall", binstallAsset(arch), {
         dest: dir,
         what: "cargo-binstall for prebuilt Rust tools (~10 MB once)",
         locate: "cargo-binstall.exe"
       });
     }
-    fs41.copyFileSync(path53.join(dir, "cargo-binstall.exe"), target);
+    fs42.copyFileSync(path54.join(dir, "cargo-binstall.exe"), target);
     return true;
   } catch (e) {
     warn("cargo-binstall unavailable, compiling crates with cargo install instead: " + errMsg(e));
@@ -30520,14 +30641,14 @@ var ensureBinstall = async (cargoBin) => {
   }
 };
 function crateInstaller(cargoHome, cargoEnv) {
-  const cargo = path53.join(cargoHome, "bin", "cargo.exe");
+  const cargo = path54.join(cargoHome, "bin", "cargo.exe");
   let binstall = null;
   const binstallEnv = {
     ...cargoEnv,
     env: { ...cargoEnv.env ?? process.env, BINSTALL_DISABLE_TELEMETRY: "true" }
   };
   return async (crate) => {
-    binstall ??= ensureBinstall(path53.join(cargoHome, "bin"));
+    binstall ??= ensureBinstall(path54.join(cargoHome, "bin"));
     if (await binstall) {
       try {
         await execAsync(
@@ -30549,7 +30670,7 @@ async function setupRust(env, config2, refresh) {
   const RUSTUP_HOME = tool("rust", "rustup");
   const CARGO_HOME = tool("rust", "cargo");
   const rustEnv = { env: { ...process.env, RUSTUP_HOME, CARGO_HOME } };
-  const rustup = path54.join(CARGO_HOME, "bin", "rustup.exe");
+  const rustup = path55.join(CARGO_HOME, "bin", "rustup.exe");
   if (dryRun) {
     log("(dry run) would provision Rust " + config2.toolchain + " (" + config2.host + ")");
     return;
@@ -30585,9 +30706,9 @@ async function setupRust(env, config2, refresh) {
     if (refresh) await execAsync(rustup, ["update"], rustEnv);
   }
   Object.assign(env.vars, { RUSTUP_HOME, CARGO_HOME });
-  env.prepend.push(path54.join(CARGO_HOME, "bin"));
+  env.prepend.push(path55.join(CARGO_HOME, "bin"));
   env.summary.push(
-    "rust: " + versionOf(path54.join(CARGO_HOME, "bin", "rustc.exe"), ["--version"], rustEnv) + " [" + config2.host + "]"
+    "rust: " + versionOf(path55.join(CARGO_HOME, "bin", "rustc.exe"), ["--version"], rustEnv) + " [" + config2.host + "]"
   );
   const toolchainKey = "rustup@" + config2.toolchain;
   await installOnce(
@@ -30608,36 +30729,36 @@ async function setupRust(env, config2, refresh) {
     env: {
       ...rustEnv.env,
       ...msvc.vars,
-      PATH: [path54.join(CARGO_HOME, "bin"), ...msvc.path, process.env.PATH ?? ""].join(path54.delimiter)
+      PATH: [path55.join(CARGO_HOME, "bin"), ...msvc.path, process.env.PATH ?? ""].join(path55.delimiter)
     }
   } : {
     env: {
       ...rustEnv.env,
-      CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: path54.join(mingw, "gcc.exe"),
-      PATH: [path54.join(CARGO_HOME, "bin"), mingw, process.env.PATH ?? ""].join(path54.delimiter)
+      CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: path55.join(mingw, "gcc.exe"),
+      PATH: [path55.join(CARGO_HOME, "bin"), mingw, process.env.PATH ?? ""].join(path55.delimiter)
     }
   };
   await installOnce(env, "cargo", config2.crates, crateInstaller(CARGO_HOME, cargoEnv));
 }
 
 // src/guest/toolchains/languages/node.ts
-import fs42 from "node:fs";
-import path55 from "node:path";
+import fs43 from "node:fs";
+import path56 from "node:path";
 import { spawn as spawn4 } from "node:child_process";
 var NVM_HOME = tool("nvm");
-var NVM_SYMLINK = path55.join(localDir, "nodejs");
-var HOST_NVM = path55.join(hostToolsDir, "nvm");
+var NVM_SYMLINK = path56.join(localDir, "nodejs");
+var HOST_NVM = path56.join(hostToolsDir, "nvm");
 var HOST_VERSIONS_MAX = 3;
-var hostNvmVersions = () => exists(HOST_NVM) ? fs42.readdirSync(HOST_NVM).filter((d) => /^v\d+\.\d+\.\d+$/.test(d) && exists(path55.join(HOST_NVM, d, "node.exe"))).map((d) => d.slice(1)) : [];
+var hostNvmVersions = () => exists(HOST_NVM) ? fs43.readdirSync(HOST_NVM).filter((d) => /^v\d+\.\d+\.\d+$/.test(d) && exists(path56.join(HOST_NVM, d, "node.exe"))).map((d) => d.slice(1)) : [];
 var resolveNode = (spec) => resolveCached("node:" + spec, async () => {
   const exact = spec.replace(/^v/, "");
   if (/^\d+\.\d+\.\d+$/.test(exact)) return exact;
   const releases = await fetchJson("https://nodejs.org/dist/index.json");
   return pickNodeVersion(releases, spec) ?? Promise.reject(new Error('No Node.js release matches "' + spec + '"'));
 });
-var NVM_TEMP = path55.join(NVM_HOME, ".tmp");
+var NVM_TEMP = path56.join(NVM_HOME, ".tmp");
 var nvm = (args) => new Promise((resolve2) => {
-  const child = spawn4(path55.join(NVM_HOME, "nvm.exe"), args, {
+  const child = spawn4(path56.join(NVM_HOME, "nvm.exe"), args, {
     windowsHide: true,
     env: { ...process.env, NVM_HOME, NVM_SYMLINK, TEMP: NVM_TEMP, TMP: NVM_TEMP }
   });
@@ -30652,27 +30773,37 @@ var nvm = (args) => new Promise((resolve2) => {
   child.once("close", () => resolve2(out));
 });
 var ensureNvm = async () => {
-  if (exists(path55.join(NVM_HOME, "nvm.exe"))) return;
-  if (exists(path55.join(HOST_NVM, "nvm.exe"))) {
+  if (exists(path56.join(NVM_HOME, "nvm.exe"))) return;
+  if (exists(path56.join(HOST_NVM, "nvm.exe"))) {
     log("Copying nvm from this PC ...");
     mkdirp(NVM_HOME);
-    const files = fs42.readdirSync(HOST_NVM).filter((f) => /\.(exe|cmd|vbs)$/i.test(f)).sort((a, b) => Number(a.toLowerCase() === "nvm.exe") - Number(b.toLowerCase() === "nvm.exe"));
-    for (const file3 of files) fs42.copyFileSync(path55.join(HOST_NVM, file3), path55.join(NVM_HOME, file3));
+    const files = fs43.readdirSync(HOST_NVM).filter((f) => /\.(exe|cmd|vbs)$/i.test(f)).sort((a, b) => Number(a.toLowerCase() === "nvm.exe") - Number(b.toLowerCase() === "nvm.exe"));
+    for (const file3 of files) fs43.copyFileSync(path56.join(HOST_NVM, file3), path56.join(NVM_HOME, file3));
     return;
   }
   const asset = await githubAsset("coreybutler/nvm-windows", /^nvm-noinstall\.zip$/, true);
   log("Downloading nvm-windows (" + asset.url.split("/").slice(-2, -1)[0] + ") ...");
   await downloader.archive(asset.url, NVM_HOME, { sha256: asset.sha256, locate: "nvm.exe", fileName: asset.name });
 };
+var hostNodeFolder = (version2) => {
+  const dir = path56.join(hostToolsDir, "node");
+  return session.hostTools.nodeVersion?.replace(/^v/, "") === version2 && exists(path56.join(dir, "node.exe")) ? dir : null;
+};
 var installNodeVersion = async (version2) => {
-  const dir = path55.join(NVM_HOME, "v" + version2);
-  const fromHost = path55.join(HOST_NVM, "v" + version2);
-  if (exists(path55.join(dir, "node.exe"))) return;
-  if (exists(path55.join(fromHost, "node.exe"))) {
+  const dir = path56.join(NVM_HOME, "v" + version2);
+  const fromHost = path56.join(HOST_NVM, "v" + version2);
+  if (exists(path56.join(dir, "node.exe"))) return;
+  if (exists(path56.join(fromHost, "node.exe"))) {
     log("Copying Node " + version2 + " from this PC's nvm (without global packages) ...");
     copyNode(fromHost, dir);
     return;
   }
+  const hostNode = hostNodeFolder(version2);
+  if (hostNode) {
+    log("Copying Node " + version2 + " from this PC (without global packages) ...");
+    copyNode(hostNode, dir);
+    return;
+  }
   log("Downloading Node " + version2 + " (~30 MB once) ...");
   mkdirp(NVM_TEMP);
   let out;
@@ -30681,23 +30812,32 @@ var installNodeVersion = async (version2) => {
   } finally {
     safeRemove(NVM_TEMP, NVM_HOME);
   }
-  if (!exists(path55.join(dir, "node.exe")))
-    throw new Error("nvm install " + version2 + " failed: " + out.trim().split("\n").slice(-2).join(" "));
+  if (!exists(path56.join(dir, "node.exe"))) {
+    const tail = out.trim().split(/\r?\n/).filter(Boolean).slice(-3).join(" ");
+    const why = /complete/i.test(out) ? "nvm said it finished, but its move into the data folder did not happen" : "nvm could not download or unpack it: check the internet connection and the free disk space";
+    throw new Error(
+      "nvm install " + version2 + " did not leave " + path56.join(dir, "node.exe") + " (" + why + ")" + (tail ? ". nvm printed: " + tail : "")
+    );
+  }
 };
 var activate = async (version2) => {
   await nvm(["use", version2]);
-  if (exists(path55.join(NVM_SYMLINK, "node.exe"))) return;
-  fs42.rmSync(NVM_SYMLINK, { recursive: true, force: true });
-  fs42.symlinkSync(path55.join(NVM_HOME, "v" + version2), NVM_SYMLINK, "junction");
+  if (exists(path56.join(NVM_SYMLINK, "node.exe"))) return;
+  fs43.rmSync(NVM_SYMLINK, { recursive: true, force: true });
+  fs43.symlinkSync(path56.join(NVM_HOME, "v" + version2), NVM_SYMLINK, "junction");
 };
+var PLAYWRIGHT_VARS = () => ({
+  PLAYWRIGHT_BROWSERS_PATH: tool("ms-playwright"),
+  PLAYWRIGHT_MCP_BROWSER: "msedge"
+});
 async function setupNode(env, versions, config2) {
   if (dryRun) {
     log("(dry run) would provision nvm and Node " + versions.node.spec + " (from " + versions.node.source + ")");
     return;
   }
   await ensureNvm();
-  fs42.writeFileSync(
-    path55.join(NVM_HOME, "settings.txt"),
+  fs43.writeFileSync(
+    path56.join(NVM_HOME, "settings.txt"),
     [
       "root: " + NVM_HOME,
       "path: " + NVM_SYMLINK,
@@ -30723,23 +30863,24 @@ async function setupNode(env, versions, config2) {
       warn("Node " + version2 + " from this PC: " + errMsg(e));
     }
   }
-  Object.assign(env.vars, { NVM_HOME, NVM_SYMLINK });
-  if (duringSession()) env.prepend.push(path55.join(NVM_HOME, "v" + main), NVM_HOME, NVM_SYMLINK);
+  Object.assign(env.vars, { NVM_HOME, NVM_SYMLINK, ...PLAYWRIGHT_VARS() });
+  if (duringSession()) env.prepend.push(path56.join(NVM_HOME, "v" + main), NVM_HOME, NVM_SYMLINK);
   else {
     await activate(main);
     env.prepend.push(NVM_HOME, NVM_SYMLINK);
   }
   env.summary.push("node: " + main + " (from " + versions.node.source + ", switch with nvm use)");
+  env.summary.push("playwright: ready (Edge; browsers it downloads are kept; in tests use channel: 'msedge')");
   await packageManagers(env, config2, main);
 }
 var packageManagers = async (env, config2, version2) => {
-  const dir = path55.join(NVM_HOME, "v" + version2);
-  const nodeEnv = { ...process.env, PATH: dir + path55.delimiter + (process.env.PATH ?? "") };
-  const npm = (args) => execAsync(path55.join(dir, "node.exe"), [path55.join(dir, "node_modules", "npm", "bin", "npm-cli.js"), ...args], {
+  const dir = path56.join(NVM_HOME, "v" + version2);
+  const nodeEnv = { ...process.env, PATH: dir + path56.delimiter + (process.env.PATH ?? "") };
+  const npm = (args) => execAsync(path56.join(dir, "node.exe"), [path56.join(dir, "node_modules", "npm", "bin", "npm-cli.js"), ...args], {
     env: nodeEnv,
     stdio: "ignore"
   });
-  const corepackJs = path55.join(dir, "node_modules", "corepack", "dist", "corepack.js");
+  const corepackJs = path56.join(dir, "node_modules", "corepack", "dist", "corepack.js");
   const extra = config2.corepack && !exists(corepackJs) ? ["corepack"] : [];
   await installOnce(
     env,
@@ -30760,7 +30901,7 @@ var packageManagers = async (env, config2, version2) => {
   }
   try {
     await execAsync(
-      path55.join(dir, "node.exe"),
+      path56.join(dir, "node.exe"),
       [corepackJs, "enable", "--install-directory", mkdirp(tool("bin")), "pnpm", "yarn"],
       { env: nodeEnv, stdio: "ignore" }
     );
@@ -30785,8 +30926,8 @@ async function setupPwsh(env, refresh = false) {
 }
 
 // src/guest/toolchains/languages/python.ts
-import fs43 from "node:fs";
-import path56 from "node:path";
+import fs44 from "node:fs";
+import path57 from "node:path";
 var installPython = async (pkg, spec) => {
   const version2 = await resolveCached(pkg + ":" + spec, async () => {
     const { versions } = await fetchJson(
@@ -30795,7 +30936,7 @@ var installPython = async (pkg, spec) => {
     return pickPackageVersion(versions, spec) ?? Promise.reject(new Error("No " + pkg + ' release matches "' + spec + '"'));
   });
   const dir = tool("python", pkg + "-" + version2);
-  const exe = path56.join(dir, "python.exe");
+  const exe = path57.join(dir, "python.exe");
   if (!exists(exe)) {
     log("Downloading Python " + version2 + (pkg === "python2" ? " (Python 2, " : " (") + "~30 MB once) ...");
     await downloader.archive(
@@ -30804,32 +30945,32 @@ var installPython = async (pkg, spec) => {
       { locate: "python.exe", fileName: pkg + "." + version2 + ".zip" }
     );
   }
-  if (!exists(path56.join(dir, "Scripts", "pip.exe")) && !exists(path56.join(dir, "Scripts", "pip2.exe")))
+  if (!exists(path57.join(dir, "Scripts", "pip.exe")) && !exists(path57.join(dir, "Scripts", "pip2.exe")))
     await execAsync(exe, ["-m", "ensurepip", "--default-pip"], { stdio: "ignore" });
   return dir;
 };
-var shimDir = (dir) => duringSession() ? tool("shims", path56.basename(dir)) : tool("shims");
+var shimDir = (dir) => duringSession() ? tool("shims", path57.basename(dir)) : tool("shims");
 var shim = (folder, name, program, args = []) => {
   const fixed = [program, ...args];
-  fs43.writeFileSync(
-    path56.join(mkdirp(folder), name + ".cmd"),
+  fs44.writeFileSync(
+    path57.join(mkdirp(folder), name + ".cmd"),
     "@echo off\r\n" + fixed.map((a) => '"' + a + '"').join(" ") + " %*\r\n"
   );
   const sh = fixed.map((a) => "'" + a.replace(/\\/g, "/").replace(/'/g, "'\\''") + "'").join(" ");
-  fs43.writeFileSync(path56.join(folder, name), "#!/bin/sh\nexec " + sh + ' "$@"\n');
+  fs44.writeFileSync(path57.join(folder, name), "#!/bin/sh\nexec " + sh + ' "$@"\n');
 };
 var shimPair = (folder, version2, dir) => {
-  const python = path56.join(dir, "python.exe");
+  const python = path57.join(dir, "python.exe");
   shim(folder, "python" + version2, python);
   shim(folder, "pip" + version2, python, ["-m", "pip"]);
 };
 var pyLauncher = (folder, py3, py2) => {
-  const script = path56.join(mkdirp(folder), "py-launcher.py");
-  fs43.writeFileSync(
+  const script = path57.join(mkdirp(folder), "py-launcher.py");
+  fs44.writeFileSync(
     script,
     [
       "import subprocess, sys",
-      "PY3, PY2 = " + JSON.stringify(path56.join(py3, "python.exe")) + ", " + JSON.stringify(py2 ? path56.join(py2, "python.exe") : null),
+      "PY3, PY2 = " + JSON.stringify(path57.join(py3, "python.exe")) + ", " + JSON.stringify(py2 ? path57.join(py2, "python.exe") : null),
       "args = sys.argv[1:]",
       "exe = PY3",
       "if args and args[0].startswith('-2'):",
@@ -30841,7 +30982,7 @@ var pyLauncher = (folder, py3, py2) => {
       ""
     ].join("\n")
   );
-  shim(folder, "py", path56.join(py3, "python.exe"), [script]);
+  shim(folder, "py", path57.join(py3, "python.exe"), [script]);
 };
 async function setupPython(env, config2, versions) {
   if (dryRun) {
@@ -30851,10 +30992,10 @@ async function setupPython(env, config2, versions) {
   const py3 = await installPython("python", versions.python.spec);
   const shims = shimDir(py3);
   shimPair(shims, "3", py3);
-  env.prepend.push(py3, mkdirp(path56.join(py3, "Scripts")), shims);
+  env.prepend.push(py3, mkdirp(path57.join(py3, "Scripts")), shims);
   env.vars.PYTHONIOENCODING = "utf-8";
   env.summary.push(
-    "python: " + path56.basename(py3).replace("python-", "") + " (from " + versions.python.source + "; py works too)"
+    "python: " + path57.basename(py3).replace("python-", "") + " (from " + versions.python.source + "; py works too)"
   );
   if (!config2.python2) {
     pyLauncher(shims, py3, null);
@@ -30863,16 +31004,16 @@ async function setupPython(env, config2, versions) {
   const py2 = await installPython("python2", "2.7");
   shimPair(shims, "2", py2);
   pyLauncher(shims, py3, py2);
-  env.summary.push("python2: " + path56.basename(py2).replace("python2-", ""));
+  env.summary.push("python2: " + path57.basename(py2).replace("python2-", ""));
 }
 
 // src/guest/toolchains/languages/php.ts
-import fs45 from "node:fs";
-import path58 from "node:path";
+import fs46 from "node:fs";
+import path59 from "node:path";
 
 // src/guest/toolchains/native/vcruntime.ts
-import fs44 from "node:fs";
-import path57 from "node:path";
+import fs45 from "node:fs";
+import path58 from "node:path";
 var VC_REDIST = "https://aka.ms/vs/17/release/vc_redist.x64.exe";
 var MICROSOFT_SIGNER = "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US";
 var OK_EXIT_CODES = [0, 1638, 3010];
@@ -30882,8 +31023,8 @@ async function setupVcRuntime(env, summary = true) {
     log("(dry run) would install the Visual C++ runtime");
     return false;
   }
-  const system322 = path57.join(process.env.WINDIR ?? "C:\\Windows", "System32");
-  const missing = !exists(path57.join(system322, "vcruntime140.dll")) || !exists(path57.join(system322, "msvcp140.dll"));
+  const system322 = path58.join(process.env.WINDIR ?? "C:\\Windows", "System32");
+  const missing = !exists(path58.join(system322, "vcruntime140.dll")) || !exists(path58.join(system322, "msvcp140.dll"));
   if (missing) {
     const installer = tool("vcredist", "vc_redist.x64.exe");
     if (!exists(installer)) {
@@ -30891,12 +31032,12 @@ async function setupVcRuntime(env, summary = true) {
       await downloadFile(VC_REDIST, installer);
     }
     if (signerOf(installer) !== MICROSOFT_SIGNER) {
-      fs44.rmSync(installer, { force: true });
+      fs45.rmSync(installer, { force: true });
       throw new Error("vc_redist.x64.exe is not signed by Microsoft; deleted it (it is downloaded again next boot)");
     }
     log("Installing the Visual C++ runtime ...");
     const code = await spawnAsync(installer, ["/install", "/quiet", "/norestart"]);
-    if (!OK_EXIT_CODES.includes(code ?? -1) || !exists(path57.join(system322, "vcruntime140.dll")))
+    if (!OK_EXIT_CODES.includes(code ?? -1) || !exists(path58.join(system322, "vcruntime140.dll")))
       throw new Error("the Visual C++ runtime installer failed (exit " + code + ")");
   }
   if (summary) env.summary.push("vc++ runtime: installed");
@@ -30934,16 +31075,16 @@ var phpBuild = async (spec) => {
   return { version: release.version, ...build.zip };
 };
 var writePhpIni = (home) => {
-  const ini = path58.join(home, "php.ini");
-  if (exists(ini) || !exists(path58.join(home, "php.ini-development"))) return;
-  let text = fs45.readFileSync(path58.join(home, "php.ini-development"), "utf8").replace(/^;\s*extension_dir\s*=\s*"ext"/m, 'extension_dir = "' + path58.join(home, "ext") + '"');
-  for (const ext of PHP_EXTENSIONS.filter((e) => exists(path58.join(home, "ext", "php_" + e + ".dll"))))
+  const ini = path59.join(home, "php.ini");
+  if (exists(ini) || !exists(path59.join(home, "php.ini-development"))) return;
+  let text = fs46.readFileSync(path59.join(home, "php.ini-development"), "utf8").replace(/^;\s*extension_dir\s*=\s*"ext"/m, 'extension_dir = "' + path59.join(home, "ext") + '"');
+  for (const ext of PHP_EXTENSIONS.filter((e) => exists(path59.join(home, "ext", "php_" + e + ".dll"))))
     text = text.replace(new RegExp("^;(extension=" + ext + ")\\s*$", "m"), "$1");
-  fs45.writeFileSync(ini + ".tmp", text);
-  fs45.renameSync(ini + ".tmp", ini);
+  fs46.writeFileSync(ini + ".tmp", text);
+  fs46.renameSync(ini + ".tmp", ini);
 };
 var shim2 = (env, name, command) => {
-  fs45.writeFileSync(path58.join(mkdirp(tool("shims")), name + ".cmd"), "@echo off\r\n" + command + " %*\r\n");
+  fs46.writeFileSync(path59.join(mkdirp(tool("shims")), name + ".cmd"), "@echo off\r\n" + command + " %*\r\n");
   env.prepend.push(tool("shims"));
 };
 var setupComposer = async (env, php) => {
@@ -30955,7 +31096,7 @@ var setupComposer = async (env, php) => {
   }
   const composerHome = tool("composer-home");
   env.vars.COMPOSER_HOME = composerHome;
-  env.prepend.push(path58.join(composerHome, "vendor", "bin"));
+  env.prepend.push(path59.join(composerHome, "vendor", "bin"));
   shim2(env, "composer", '"' + php + '" "' + phar + '"');
   env.summary.push(
     "composer: " + (/\d+\.\d+\.\d+/.exec(execOutput(php, [phar, "--version", "--no-ansi"]))?.[0] ?? "installed")
@@ -30970,7 +31111,7 @@ async function setupPhp(env, config2) {
   await setupVcRuntime(env, false);
   const version2 = await resolveCached("php:" + wantedSpec.spec, async () => (await phpBuild(wantedSpec.spec)).version);
   const home = tool("php", version2);
-  if (!exists(path58.join(home, "php.exe"))) {
+  if (!exists(path59.join(home, "php.exe"))) {
     const build = await phpBuild(version2);
     log("Downloading PHP " + version2 + " (~30 MB once) ...");
     await downloader.archive("https://windows.php.net/downloads/releases/" + build.path, home, {
@@ -30982,11 +31123,11 @@ async function setupPhp(env, config2) {
   writePhpIni(home);
   env.prepend.push(home);
   env.summary.push("php: " + version2 + " (from " + wantedSpec.source + ")");
-  if (config2.composer) await setupComposer(env, path58.join(home, "php.exe"));
+  if (config2.composer) await setupComposer(env, path59.join(home, "php.exe"));
 }
 
 // src/guest/toolchains/languages/ruby.ts
-import path59 from "node:path";
+import path60 from "node:path";
 var RUBY_ASSET = /^rubyinstaller-(\d+\.\d+\.\d+)-(\d+)-x64\.7z$/;
 var buildNumber = (asset) => Number(RUBY_ASSET.exec(asset.name)?.[2] ?? 0);
 var rubyBuilds = async () => {
@@ -31014,7 +31155,7 @@ async function setupRuby(env, config2) {
     async () => pickPackageVersion([...(await rubyBuilds()).keys()], wantedSpec.spec) ?? Promise.reject(new Error('No RubyInstaller build matches "' + wantedSpec.spec + '"'))
   );
   const home = tool("ruby", version2);
-  if (!exists(path59.join(home, "bin", "ruby.exe"))) {
+  if (!exists(path60.join(home, "bin", "ruby.exe"))) {
     const asset = (await rubyBuilds()).get(version2);
     if (!asset) throw new Error("RubyInstaller " + version2 + " is no longer published");
     log("Downloading Ruby " + version2 + " (~100 MB once) ...");
@@ -31027,11 +31168,11 @@ async function setupRuby(env, config2) {
   }
   const gems = tool("ruby-gems", version2.split(".").slice(0, 2).join("."));
   Object.assign(env.vars, { GEM_HOME: gems, BUNDLE_USER_HOME: tool("bundle-home") });
-  env.prepend.push(path59.join(home, "bin"), path59.join(gems, "bin"));
+  env.prepend.push(path60.join(home, "bin"), path60.join(gems, "bin"));
   env.summary.push(
-    "ruby: " + versionOf(path59.join(home, "bin", "ruby.exe")) + " (from " + wantedSpec.source + "; gems with C extensions need MSYS2, not included)"
+    "ruby: " + versionOf(path60.join(home, "bin", "ruby.exe")) + " (from " + wantedSpec.source + "; gems with C extensions need MSYS2, not included)"
   );
-  const gem = path59.join(home, "bin", "gem.cmd");
+  const gem = path60.join(home, "bin", "gem.cmd");
   await installOnce(
     env,
     "gem@" + version2,
@@ -31043,9 +31184,9 @@ async function setupRuby(env, config2) {
 }
 
 // src/guest/toolchains/tools/vscode.ts
-import fs46 from "node:fs";
+import fs47 from "node:fs";
 import os7 from "node:os";
-import path60 from "node:path";
+import path61 from "node:path";
 
 // node_modules/jsonc-parser/lib/esm/impl/scanner.js
 var CharacterCodes;
@@ -31225,14 +31366,14 @@ var ParseErrorCode;
 var VERSION_MARKER = ".agent-sandbox-version";
 var desktopShortcut = (exe) => {
   if (!isWin) return;
-  const link = path60.join(os7.homedir(), "Desktop", "Visual Studio Code.lnk");
+  const link = path61.join(os7.homedir(), "Desktop", "Visual Studio Code.lnk");
   runScriptWithJson("new-shortcuts.ps1", "ListFile", [
     { link, target: exe, arguments: '"' + (process.env.AGENT_WORKSPACE ?? "") + '"' }
   ]);
 };
 async function setupVscode(env, refresh) {
   const root = tool("vscode");
-  const exe = path60.join(root, "Code.exe");
+  const exe = path61.join(root, "Code.exe");
   if (dryRun) {
     log("(dry run) would provision VS Code");
     return;
@@ -31242,11 +31383,11 @@ async function setupVscode(env, refresh) {
       "https://update.code.visualstudio.com/api/update/win32-" + (arch === "arm64" ? "arm64" : "x64") + "-archive/stable/latest"
     );
     log("Downloading VS Code " + release.productVersion + " (~150 MB once) ...");
-    const keep = path60.join(root, "data");
+    const keep = path61.join(root, "data");
     const parked = root + "-data";
     if (exists(keep)) {
-      fs46.rmSync(parked, { recursive: true, force: true });
-      fs46.renameSync(keep, parked);
+      fs47.rmSync(parked, { recursive: true, force: true });
+      fs47.renameSync(keep, parked);
     }
     try {
       await downloader.archive(release.url, root, {
@@ -31254,89 +31395,109 @@ async function setupVscode(env, refresh) {
         locate: "Code.exe",
         fileName: "vscode.zip"
       });
-      fs46.writeFileSync(path60.join(root, VERSION_MARKER), release.productVersion);
+      fs47.writeFileSync(path61.join(root, VERSION_MARKER), release.productVersion);
     } finally {
       if (exists(parked)) {
         mkdirp(root);
-        fs46.rmSync(keep, { recursive: true, force: true });
-        fs46.renameSync(parked, keep);
+        fs47.rmSync(keep, { recursive: true, force: true });
+        fs47.renameSync(parked, keep);
       }
     }
   }
-  mkdirp(path60.join(root, "data"));
-  env.prepend.push(path60.join(root, "bin"));
+  mkdirp(path61.join(root, "data"));
+  env.prepend.push(path61.join(root, "bin"));
   desktopShortcut(exe);
-  const version2 = exists(path60.join(root, VERSION_MARKER)) ? fs46.readFileSync(path60.join(root, VERSION_MARKER), "utf8").trim() : "installed";
+  const version2 = exists(path61.join(root, VERSION_MARKER)) ? fs47.readFileSync(path61.join(root, VERSION_MARKER), "utf8").trim() : "installed";
   env.summary.push("vscode: " + version2 + " (portable; run code . or use the desktop shortcut)");
 }
 
 // src/guest/toolchains/native/rust-extras.ts
-import fs47 from "node:fs";
+import fs48 from "node:fs";
 import os8 from "node:os";
-import path61 from "node:path";
+import path62 from "node:path";
 
 // src/shared/memory/policy.ts
-var GUEST_THRESHOLDS = {
-  normal: {
-    enterAvailablePercent: 8,
-    enterCommitPercent: 92,
-    exitAvailablePercent: 12,
-    exitCommitPercent: 88,
-    calmSamples: 3
-  },
-  gentle: {
-    enterAvailablePercent: 15,
-    enterCommitPercent: 85,
-    exitAvailablePercent: 20,
-    exitCommitPercent: 80,
-    calmSamples: 3
-  }
+var DIAL_STEPS = {
+  normal: [
+    { availablePercent: 15, commitPercent: 80 },
+    { availablePercent: 10, commitPercent: 88 },
+    { availablePercent: 6, commitPercent: 94, secondsToLimit: 20 },
+    { availablePercent: 4, commitPercent: 97, secondsToLimit: 8 }
+  ],
+  gentle: [
+    { availablePercent: 20, commitPercent: 75 },
+    { availablePercent: 15, commitPercent: 85 },
+    { availablePercent: 8, commitPercent: 92, secondsToLimit: 25 },
+    { availablePercent: 5, commitPercent: 96, secondsToLimit: 10 }
+  ]
 };
+var DIAL_EXIT_MARGIN = { availablePercent: 5, commitPercent: 4 };
+var DIAL_CALM_SAMPLES = 3;
+var DIAL_CPU_RATE = [100, 100, 60, 35, 15];
+function compilersAllowed(step, running) {
+  if (step <= 1 || running <= 1) return running;
+  if (step === 2) return Math.max(1, Math.ceil(running * 0.6));
+  if (step === 3) return Math.max(1, Math.ceil(running / 3));
+  return 1;
+}
+function buildJobs(cpus, memoryGb) {
+  return Math.max(2, Math.min(cpus, Math.floor((memoryGb - 6) / 3)));
+}
+function linkSlotsFor(memoryGb) {
+  return Math.max(2, Math.min(8, Math.floor((memoryGb - 6) / 3)));
+}
+function usableCpus(cpus, percent) {
+  if (percent === null || percent >= 100) return cpus;
+  return Math.max(2, Math.min(cpus, Math.floor(cpus * percent / 100)));
+}
 function cargoJobs(cpus, memoryGb, sessions2) {
-  const byCpu = Math.max(2, Math.min(4, Math.floor(cpus / 4)));
+  const byCpu = Math.max(2, Math.min(8, Math.floor(cpus / 4)));
   const byMemory = Math.max(1, Math.floor(memoryGb / 4));
   const jobs = Math.min(byCpu, byMemory);
-  return Math.max(1, Math.min(jobs, Math.floor(8 / Math.max(1, sessions2))));
+  return Math.max(1, Math.min(jobs, Math.floor(buildJobs(cpus, memoryGb) / Math.max(1, sessions2))));
+}
+function maxCompilers(cpus, profile) {
+  return profile === "gentle" ? Math.max(2, Math.floor(cpus / 4)) : null;
 }
 
 // src/guest/toolchains/native/rust-extras.ts
 var cargoTarget = (targetDir) => {
   if (targetDir === "shared" || targetDir === "separate") return null;
-  if (targetDir === "local") return path61.join(localDir, "cargo-target");
+  if (targetDir === "local") return path62.join(localDir, "cargo-target");
   return targetDir;
 };
 function cargoShim(env, rust) {
-  const real = path61.join(tool("rust", "cargo", "bin"), "cargo.exe");
+  const real = path62.join(tool("rust", "cargo", "bin"), "cargo.exe");
   if (rust.targetDir !== "separate" || !exists(real)) return;
   const dir = mkdirp(tool("shims", "cargo"));
-  fs47.copyFileSync(ensureCompiled("cargoshim"), path61.join(dir, "cargo.exe"));
+  fs48.copyFileSync(ensureCompiled("cargoshim"), path62.join(dir, "cargo.exe"));
   env.prepend.unshift(dir);
   env.vars.AGENT_REAL_CARGO = real;
 }
 function linkGate(env, rust, host) {
   const gcc = tool("mingw", "mingw64", "bin", "gcc.exe");
   if (!host.endsWith("-pc-windows-gnu") || !exists(gcc)) return;
-  const gate = path61.join(mkdirp(tool("shims")), "linkgate.exe");
-  fs47.copyFileSync(ensureCompiled("linkgate"), gate);
+  const gate = path62.join(mkdirp(tool("shims")), "linkgate.exe");
+  fs48.copyFileSync(ensureCompiled("linkgate"), gate);
   const memoryGb = os8.totalmem() / 1024 ** 3;
-  const slots = rust.linkSlots === "auto" ? Math.max(2, Math.min(4, Math.floor(memoryGb / 8))) : rust.linkSlots;
+  const slots = rust.linkSlots === "auto" ? linkSlotsFor(memoryGb) : rust.linkSlots;
   env.vars.AGENT_LINK_SLOTS = String(slots);
   env.vars.AGENT_REAL_LINKER = gcc;
   env.vars.CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER = gate;
   const rustEnv = { ...process.env, RUSTUP_HOME: tool("rust", "rustup"), CARGO_HOME: tool("rust", "cargo") };
   const sysroot = rust.linker === "lld" ? execOutput(tool("rust", "cargo", "bin", "rustc.exe"), ["--print", "sysroot"], { env: rustEnv }) : "";
-  const lld = sysroot ? path61.join(sysroot, "lib", "rustlib", host, "bin", "gcc-ld") : "";
-  if (lld && exists(path61.join(lld, "ld.lld.exe"))) env.vars.AGENT_LLD_DIR = lld;
+  const lld = sysroot ? path62.join(sysroot, "lib", "rustlib", host, "bin", "gcc-ld") : "";
+  if (lld && exists(path62.join(lld, "ld.lld.exe"))) env.vars.AGENT_LLD_DIR = lld;
   env.summary.push(
     "rust linking: " + (env.vars.AGENT_LLD_DIR ? "lld" : "GNU ld") + ", at most " + env.vars.AGENT_LINK_SLOTS + " at once"
   );
 }
 function cargoDefaults(host) {
   const file3 = tool("rust", "cargo", "config.toml");
-  if (exists(file3) || !exists(path61.dirname(file3))) return;
+  if (exists(file3) || !exists(path62.dirname(file3))) return;
   const jobs = cargoJobs(os8.cpus().length, os8.totalmem() / 1024 ** 3, 1);
   const gnu = host.endsWith("-gnu");
-  fs47.writeFileSync(
+  fs48.writeFileSync(
     file3,
     [
       "# Written by windows-development-sandbox once; edit freely, it is never overwritten.",
@@ -31351,7 +31512,7 @@ function rustCaches(rust) {
   const target = cargoTarget(rust.targetDir);
   return {
     ...target ? { CARGO_TARGET_DIR: target } : {},
-    ...process.env.SCCACHE_DIR ? {} : { SCCACHE_DIR: path61.join(dataDir, "cache", "sccache") }
+    ...process.env.SCCACHE_DIR ? {} : { SCCACHE_DIR: path62.join(dataDir, "cache", "sccache") }
   };
 }
 function rustHost(config2) {
@@ -31655,21 +31816,21 @@ function cmdSet(env, names) {
   return names.filter((n) => env[n] !== void 0 && !/[\r\n]/.test(String(env[n]))).map((n) => '@set "' + n + "=" + String(env[n]).replace(/%/g, "%%") + '"');
 }
 function writeShell(spec, env, names) {
-  const dir = mkdirp(path62.join(localDir, "projects", spec.name));
-  fs48.writeFileSync(path62.join(dir, "env.cmd"), [...cmdSet(env, [...names, "PATH"]), ""].join("\r\n"));
-  fs48.writeFileSync(
-    path62.join(dir, "shell.cmd"),
-    ['@call "' + path62.join(dir, "env.cmd") + '"', '@cd /d "' + spec.workspace + '"', "@title " + spec.name, ""].join(
+  const dir = mkdirp(path63.join(localDir, "projects", spec.name));
+  fs49.writeFileSync(path63.join(dir, "env.cmd"), [...cmdSet(env, [...names, "PATH"]), ""].join("\r\n"));
+  fs49.writeFileSync(
+    path63.join(dir, "shell.cmd"),
+    ['@call "' + path63.join(dir, "env.cmd") + '"', '@cd /d "' + spec.workspace + '"', "@title " + spec.name, ""].join(
       "\r\n"
     )
   );
-  const bin = mkdirp(path62.join(localDir, "bin"));
-  fs48.writeFileSync(
-    path62.join(bin, "sbx-shell.cmd"),
+  const bin = mkdirp(path63.join(localDir, "bin"));
+  fs49.writeFileSync(
+    path63.join(bin, "sbx-shell.cmd"),
     [
-      '@if "%~1"=="" (echo Usage: sbx-shell ^<project^>   ^(a terminal in that project with its tools^) & dir /b "' + path62.join(localDir, "projects") + '" & exit /b 2)',
-      '@if not exist "' + path62.join(localDir, "projects") + '\\%~1\\shell.cmd" (echo No project %~1 in this sandbox. & exit /b 2)',
-      '@cmd /k ""' + path62.join(localDir, "projects") + '\\%~1\\shell.cmd""',
+      '@if "%~1"=="" (echo Usage: sbx-shell ^<project^>   ^(a terminal in that project with its tools^) & dir /b "' + path63.join(localDir, "projects") + '" & exit /b 2)',
+      '@if not exist "' + path63.join(localDir, "projects") + '\\%~1\\shell.cmd" (echo No project %~1 in this sandbox. & exit /b 2)',
+      '@cmd /k ""' + path63.join(localDir, "projects") + '\\%~1\\shell.cmd""',
       ""
     ].join("\r\n")
   );
@@ -31722,10 +31883,10 @@ async function setUp(spec, say) {
       }
     )
   );
-  tools.prepend.push(path62.join(localDir, "bin"));
+  tools.prepend.push(path63.join(localDir, "bin"));
   const env = agentEnv(tools, { workspace: spec.workspace, project: spec.name, base });
-  const specFile = path62.join(mkdirp(path62.join(localDir, "projects", spec.name)), "project.json");
-  fs48.writeFileSync(specFile, JSON.stringify(spec));
+  const specFile = path63.join(mkdirp(path63.join(localDir, "projects", spec.name)), "project.json");
+  fs49.writeFileSync(specFile, JSON.stringify(spec));
   env.AGENT_PROJECT_FILE = specFile;
   addMachineEnvironment(tools.vars, [...tools.prepend, ...tools.append], true);
   try {
@@ -31842,7 +32003,7 @@ function execCommand(req) {
 }
 
 // src/guest/daemon/sessions.ts
-import path67 from "node:path";
+import path68 from "node:path";
 import crypto4 from "node:crypto";
 import os11 from "node:os";
 import { spawn as spawn7 } from "node:child_process";
@@ -31919,7 +32080,7 @@ async function sendControl(endpoint, type) {
 var MAX_CLIPBOARD_STRING = 1024 * 1024;
 
 // src/guest/sessions/cmdline.ts
-import path63 from "node:path";
+import path64 from "node:path";
 var quoted = (arg) => '"' + arg.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, "$1$1") + '"';
 function quoteArg(arg) {
   return arg !== "" && !/[\s"]/.test(arg) ? arg : quoted(arg);
@@ -31933,12 +32094,12 @@ function cmdArgs(args) {
   }).join("");
 }
 function commandLine(file3, args) {
-  return path63.win32.basename(file3).toLowerCase() === "cmd.exe" ? [quoteArg(file3), cmdArgs(args)].filter(Boolean).join(" ") : [file3, ...args].map(quoteArg).join(" ");
+  return path64.win32.basename(file3).toLowerCase() === "cmd.exe" ? [quoteArg(file3), cmdArgs(args)].filter(Boolean).join(" ") : [file3, ...args].map(quoteArg).join(" ");
 }
 
 // src/guest/sessions/pty-host.ts
-import fs49 from "node:fs";
-import path64 from "node:path";
+import fs50 from "node:fs";
+import path65 from "node:path";
 import { spawn as spawn6 } from "node:child_process";
 function ensurePtyHost() {
   return ensureCompiled("ptyhost");
@@ -31957,18 +32118,18 @@ async function waitForPtyHost(child, port, timeoutMs) {
   throw new Error("the session host did not start listening on port " + port);
 }
 function ptyHostLog(id) {
-  return path64.join(logsDir, "ptyhost-" + id + ".log");
+  return path65.join(logsDir, "ptyhost-" + id + ".log");
 }
 function ptyHostLogTail(id, lines = 12) {
   try {
-    return fs49.readFileSync(ptyHostLog(id), "utf8").trim().split(/\r?\n/).slice(-lines).join("\n");
+    return fs50.readFileSync(ptyHostLog(id), "utf8").trim().split(/\r?\n/).slice(-lines).join("\n");
   } catch {
     return "";
   }
 }
 var conptyDll = () => {
-  const dll = path64.join(toolsDir, "conpty", "conpty.dll");
-  return session.provisioning.conpty?.enabled !== false && fs49.existsSync(dll) && fs49.existsSync(path64.join(toolsDir, "conpty", "OpenConsole.exe")) ? dll : null;
+  const dll = path65.join(toolsDir, "conpty", "conpty.dll");
+  return session.provisioning.conpty?.enabled !== false && fs50.existsSync(dll) && fs50.existsSync(path65.join(toolsDir, "conpty", "OpenConsole.exe")) ? dll : null;
 };
 function startPtyHost(o) {
   const env = { ...o.env, PTYHOST_BIND: o.remote ? "any" : "loopback" };
@@ -31983,8 +32144,8 @@ function startPtyHost(o) {
 }
 
 // src/guest/agents/agent-installer.ts
-import fs50 from "node:fs";
-import path65 from "node:path";
+import fs51 from "node:fs";
+import path66 from "node:path";
 
 // src/guest/agents/profile-links.ts
 var profileRoot = () => process.env.USERPROFILE ?? "";
@@ -32010,7 +32171,7 @@ var agentPaths2 = (name, harness) => agentPaths(toolsDir, name, harness);
 async function installViaNpm(name, harness, dir, env) {
   if (!harness.npmPackage)
     throw new Error("No npmPackage configured for " + name + " and no host executable was available.");
-  const npmCli = path65.join(path65.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+  const npmCli = path66.join(path66.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
   const args = [npmCli, "install", "--global", "--prefix", dir, harness.npmPackage, "--no-fund", "--no-audit"];
   log("Installing " + harness.npmPackage + " (this can take a minute)...");
   if (dryRun) {
@@ -32021,7 +32182,7 @@ async function installViaNpm(name, harness, dir, env) {
   await execAsync(process.execPath, args, { env });
 }
 async function installViaUv(name, harness, dir, env) {
-  const uv = path65.join(toolsDir, "uv", "uv.exe");
+  const uv = path66.join(toolsDir, "uv", "uv.exe");
   log("Installing " + harness.uvPackage + " with uv (this can take a minute)...");
   if (dryRun) {
     log("(dry run) uv tool install " + harness.uvPackage);
@@ -32036,8 +32197,8 @@ async function installViaUv(name, harness, dir, env) {
   });
 }
 function putOnPath(dir, env) {
-  const parts2 = (env.PATH ?? "").split(path65.delimiter);
-  if (!parts2.some((p) => p.toLowerCase() === dir.toLowerCase())) env.PATH = [...parts2, dir].join(path65.delimiter);
+  const parts2 = (env.PATH ?? "").split(path66.delimiter);
+  if (!parts2.some((p) => p.toLowerCase() === dir.toLowerCase())) env.PATH = [...parts2, dir].join(path66.delimiter);
   addMachineEnvironment({}, [dir], true);
 }
 var AgentInstaller = class {
@@ -32078,9 +32239,9 @@ var AgentInstaller = class {
     }
     mkdirp(p.dir);
     if (this.sourceOf(name, harness) === "host") {
-      const source = path65.join(hostToolsDir, "agents", name, harness.hostExecutable);
+      const source = path66.join(hostToolsDir, "agents", name, harness.hostExecutable);
       if (exists(source) && p.exe) {
-        fs50.copyFileSync(source, p.exe);
+        fs51.copyFileSync(source, p.exe);
         log("Copied " + name + " from this PC: " + source);
         return;
       }
@@ -32101,22 +32262,22 @@ function guestAddresses() {
 }
 
 // src/guest/sessions/conversation.ts
-import fs51 from "node:fs";
-import path66 from "node:path";
+import fs52 from "node:fs";
+import path67 from "node:path";
 var MAX_FILES = 2e3;
 function conversationFiles(claudeDir2, cwd) {
   const names = /* @__PURE__ */ new Set([projectFolderName(cwd), projectFolderName(sandboxFolder(cwd))]);
   return [...names].flatMap((name) => {
-    const dir = path66.join(claudeDir2, "projects", name);
+    const dir = path67.join(claudeDir2, "projects", name);
     let entries2;
     try {
-      entries2 = fs51.readdirSync(dir);
+      entries2 = fs52.readdirSync(dir);
     } catch {
       return [];
     }
     return entries2.filter((e) => e.endsWith(".jsonl") && isConversationId(e.slice(0, -".jsonl".length))).slice(0, MAX_FILES).flatMap((e) => {
       try {
-        return [{ id: e.slice(0, -".jsonl".length), createdMs: fs51.statSync(path66.join(dir, e)).birthtimeMs }];
+        return [{ id: e.slice(0, -".jsonl".length), createdMs: fs52.statSync(path67.join(dir, e)).birthtimeMs }];
       } catch {
         return [];
       }
@@ -32155,8 +32316,8 @@ var IdleShutdown = class {
 
 // src/guest/daemon/sessions.ts
 function terminalTab(id, title, cwd) {
-  const view = [process.execPath, path67.join(path67.dirname(process.argv[1]), "view.js"), id];
-  const wt = path67.join(toolsDir, "terminal", "wt.exe");
+  const view = [process.execPath, path68.join(path68.dirname(process.argv[1]), "view.js"), id];
+  const wt = path68.join(toolsDir, "terminal", "wt.exe");
   if (exists(wt))
     spawn7(wt, ["-w", "0", "nt", "--title", title, "-d", cwd, ...view], { detached: true, stdio: "ignore" }).unref();
   else spawn7(SYSTEM.cmd(), ["/d", "/c", "start", title, ...view], { detached: true, stdio: "ignore", cwd }).unref();
@@ -32171,11 +32332,33 @@ var harnessFor = (req) => {
 };
 function memoryEnv(env, sessions2) {
   const out = {};
-  if (session.agentMemoryLimitMb) out.PTYHOST_JOB_MB = String(session.agentMemoryLimitMb);
-  if (!env.CARGO_BUILD_JOBS)
-    out.CARGO_BUILD_JOBS = String(cargoJobs(os11.cpus().length, os11.totalmem() / 1024 ** 3, sessions2));
+  out.PTYHOST_BACKSTOP_MB = String(session.agentBackstop ?? "auto");
+  const cpus = usableCpus(os11.cpus().length, session.cpuLimitPercent ?? null);
+  const memoryGb = os11.totalmem() / 1024 ** 3;
+  const jobs = cargoJobs(cpus, memoryGb, sessions2);
+  out.NUMBER_OF_PROCESSORS = String(cpus);
+  if (!env.CARGO_BUILD_JOBS) out.CARGO_BUILD_JOBS = String(jobs);
+  if (!env.CMAKE_BUILD_PARALLEL_LEVEL) out.CMAKE_BUILD_PARALLEL_LEVEL = String(jobs);
+  out.SANDBOX_BUDGET_FILE = run.budgetFile;
+  writeBudget(cpus, memoryGb, jobs, env);
   return out;
 }
+function writeBudget(cpus, memoryGb, jobs, env) {
+  try {
+    writeJsonAtomic(run.budgetFile, {
+      processors: cpus,
+      memoryMb: Math.round(memoryGb * 1024),
+      buildJobs: buildJobs(cpus, memoryGb),
+      cargoJobsPerSession: jobs,
+      linkSlots: Number(env.AGENT_LINK_SLOTS) || linkSlotsFor(memoryGb),
+      cpuLimitPercent: session.cpuLimitPercent ?? null,
+      governor: run.pressureFile,
+      note: "Plan builds with these numbers. When memory runs short the sandbox slows builds down in steps (governor); nothing fails."
+    });
+  } catch (e) {
+    warn("budget.json could not be written: " + errMsg(e));
+  }
+}
 var launchPtyHost = async (req, remote, env, say, sessions2) => {
   const harness = harnessFor(req);
   say("Preparing " + req.harness);
@@ -32202,7 +32385,7 @@ var launchPtyHost = async (req, remote, env, say, sessions2) => {
   } catch (e) {
     const tail = ptyHostLogTail(req.id);
     throw new Error(
-      errMsg(e) + (tail ? ". From its log:\n" + tail : "") + "\nLog: " + path67.join(dataDir, "logs", "ptyhost-" + req.id + ".log")
+      errMsg(e) + (tail ? ". From its log:\n" + tail : "") + "\nLog: " + path68.join(dataDir, "logs", "ptyhost-" + req.id + ".log")
     );
   }
   return { child, port, token };
@@ -32260,7 +32443,7 @@ var SessionManager = class {
     };
     this.starting++;
     if (req.id !== session.launchId && process.env.AGENT_NO_TABS !== "1")
-      safely("terminal tab", () => terminalTab(req.id, req.harness + " " + path67.basename(req.cwd), req.cwd));
+      safely("terminal tab", () => terminalTab(req.id, req.harness + " " + path68.basename(req.cwd), req.cwd));
     try {
       const place = await placeFor(req, say);
       const remote = session.networking && session.attach.enabled;
@@ -32400,7 +32583,6 @@ var COMPILERS = /* @__PURE__ */ new Set([
   "javac"
 ]);
 var BUILD_TOOLS = /* @__PURE__ */ new Set([
-  "node",
   "dotnet",
   "msbuild",
   "vbcscompiler",
@@ -32450,82 +32632,142 @@ var NEVER2 = /* @__PURE__ */ new Set([
 var key = (name) => name.toLowerCase().replace(/\.exe$/, "");
 var isNeverTouched = (name) => NEVER2.has(key(name));
 var canLower = (name) => !isNeverTouched(name) && (COMPILERS.has(key(name)) || BUILD_TOOLS.has(key(name)));
+var HEAVY = /* @__PURE__ */ new Set([
+  "rustc",
+  "clippy-driver",
+  "rustdoc",
+  "cc1",
+  "cc1plus",
+  "clang",
+  "clang++",
+  "clang-cl",
+  "cl",
+  "link",
+  "lld",
+  "lld-link",
+  "ld",
+  "ld.lld"
+]);
+var isHeavyCompiler = (name) => !isNeverTouched(name) && HEAVY.has(key(name));
 var canPause = (name) => !isNeverTouched(name) && COMPILERS.has(key(name));
 var INITIAL_STATE = {
-  pressure: false,
+  step: 0,
   calm: 0,
-  samples: 0,
   lowered: {},
-  pausedUntil: 0,
-  nextPauseAt: 0,
-  hostUntil: 0
+  memLow: [],
+  throttled: [],
+  trimmed: [],
+  cpuRate: 100,
+  lastCommitMb: 0,
+  lastAt: 0,
+  growth: 0,
+  hostUntil: 0,
+  hostStep: 0
 };
-var PAUSE_MS = 5e3;
-var PAUSE_COOLDOWN_MS = 1e4;
-var IDLE_AFTER = 3;
-var PAUSE_AFTER = 4;
-var PAUSE_MIN_MB = 300;
-function decide(prev, sample, nowMs, thresholds, profile) {
+var GROWTH_WEIGHT = 0.3;
+var HOLD_MS = 3e3;
+var ROTATE_MS = 2e4;
+var SOON_WITHIN_PERCENT = 12;
+function stepFor(ramFree, commit, secondsToLimit, profile) {
+  let step = 0;
+  DIAL_STEPS[profile].forEach((t, i) => {
+    const near = commit > t.commitPercent - SOON_WITHIN_PERCENT;
+    const soon = near && t.secondsToLimit !== void 0 && secondsToLimit < t.secondsToLimit;
+    if (ramFree < t.availablePercent || commit > t.commitPercent || soon) step = i + 1;
+  });
+  return step;
+}
+function clearOf(step, ramFree, commit, profile) {
+  if (step === 0) return true;
+  const t = DIAL_STEPS[profile][step - 1];
+  return ramFree > t.availablePercent + DIAL_EXIT_MARGIN.availablePercent && commit < t.commitPercent - DIAL_EXIT_MARGIN.commitPercent;
+}
+function decide(prev, sample, nowMs, profile, maxCompilers2 = null) {
   const ramFree = sample.ramAvailMb / Math.max(1, sample.ramTotalMb) * 100;
-  const commit = (sample.commitLimitMb - sample.commitAvailMb) / Math.max(1, sample.commitLimitMb) * 100;
+  const usedMb = sample.commitLimitMb - sample.commitAvailMb;
+  const commit = usedMb / Math.max(1, sample.commitLimitMb) * 100;
+  const seconds = (nowMs - prev.lastAt) / 1e3;
+  const instant = prev.lastAt > 0 && seconds > 0 ? (usedMb - prev.lastCommitMb) / seconds : 0;
+  const growth = prev.lastAt > 0 ? prev.growth * (1 - GROWTH_WEIGHT) + instant * GROWTH_WEIGHT : 0;
+  const secondsToLimit = growth > 0 ? sample.commitAvailMb / growth : Number.POSITIVE_INFINITY;
   const pcLow = nowMs < prev.hostUntil;
-  const low = ramFree < thresholds.enterAvailablePercent || commit > thresholds.enterCommitPercent || pcLow;
-  const recovered = ramFree > thresholds.exitAvailablePercent && commit < thresholds.exitCommitPercent && !pcLow;
-  let pressure = prev.pressure;
-  let calm = prev.calm;
-  let samples = prev.samples;
-  if (low) {
-    pressure = true;
-    calm = 0;
-    samples = prev.samples + 1;
-  } else if (prev.pressure) {
-    calm = recovered ? prev.calm + 1 : 0;
-    if (calm >= thresholds.calmSamples) {
-      pressure = false;
+  const wanted2 = Math.max(stepFor(ramFree, commit, secondsToLimit, profile), pcLow ? prev.hostStep : 0);
+  let step = prev.step;
+  let calm = 0;
+  if (wanted2 > prev.step) step = wanted2;
+  else if (prev.step > 0 && wanted2 < prev.step && clearOf(prev.step, ramFree, commit, profile)) {
+    calm = prev.calm + 1;
+    if (calm >= DIAL_CALM_SAMPLES) {
+      step = prev.step - 1;
       calm = 0;
-      samples = 0;
     }
   }
   const actions = [];
   const present2 = new Set(sample.procs.map((p) => p.pid));
+  const keep = (pids) => pids.filter((pid) => present2.has(pid));
   const lowered = {};
   for (const [pid, to] of Object.entries(prev.lowered)) if (present2.has(Number(pid))) lowered[Number(pid)] = to;
-  if (pressure) {
-    const target = samples > IDLE_AFTER ? "idle" : "below";
-    for (const p of sample.procs) {
-      if (!canLower(p.name) || lowered[p.pid] === target) continue;
-      if (p.prio !== target && !(target === "below" && p.prio === "idle"))
-        actions.push({ kind: "priority", pid: p.pid, name: p.name, to: target });
-      lowered[p.pid] = target;
-    }
-  } else {
-    for (const p of sample.procs) {
-      if (!canLower(p.name)) continue;
-      const base = profile === "gentle" && canPause(p.name) ? "below" : "normal";
-      const was = lowered[p.pid];
-      if (prev.pressure && was !== void 0 && was !== base) {
-        if (p.prio !== base) actions.push({ kind: "priority", pid: p.pid, name: p.name, to: base });
-        if (base === "normal") delete lowered[p.pid];
-        else lowered[p.pid] = base;
-      } else if (!prev.pressure && base === "below" && was === void 0) {
-        if (p.prio === "normal") actions.push({ kind: "priority", pid: p.pid, name: p.name, to: "below" });
-        lowered[p.pid] = "below";
-      }
-    }
-  }
-  let pausedUntil = prev.pausedUntil;
-  let nextPauseAt = prev.nextPauseAt;
-  if (pressure && samples >= PAUSE_AFTER && nowMs >= prev.nextPauseAt && nowMs >= prev.pausedUntil) {
-    const victim = [...sample.procs].filter((p) => canPause(p.name) && p.mb >= PAUSE_MIN_MB).sort((a, b) => b.mb - a.mb)[0];
-    if (victim) {
-      actions.push({ kind: "pause", pid: victim.pid, name: victim.name, ms: PAUSE_MS });
-      pausedUntil = nowMs + PAUSE_MS;
-      nextPauseAt = pausedUntil + PAUSE_COOLDOWN_MS;
-    }
-  }
-  const level = nowMs < pausedUntil ? "suspending" : pressure ? "throttled" : "ok";
+  const memLow = new Set(keep(prev.memLow));
+  const throttled = new Set(keep(prev.throttled));
+  const trimmed = new Set(keep(prev.trimmed));
+  for (const p of sample.procs) {
+    if (!canLower(p.name)) continue;
+    const rest = profile === "gentle" && canPause(p.name) ? "below" : "normal";
+    const target = step >= 2 ? "idle" : step === 1 ? "below" : rest;
+    const was = lowered[p.pid];
+    const touched = was !== void 0 || target !== "normal";
+    if (touched && was !== target && p.prio !== target)
+      actions.push({ kind: "priority", pid: p.pid, name: p.name, to: target });
+    if (target === "normal") delete lowered[p.pid];
+    else lowered[p.pid] = target;
+  }
+  const lowMemory = step >= 1;
+  for (const p of sample.procs) {
+    if (!canLower(p.name) || lowMemory === memLow.has(p.pid)) continue;
+    actions.push({ kind: "memory", pid: p.pid, name: p.name, low: lowMemory });
+    if (lowMemory) memLow.add(p.pid);
+    else memLow.delete(p.pid);
+  }
+  if (step >= 2) {
+    for (const p of sample.procs)
+      if (canPause(p.name) && !throttled.has(p.pid)) {
+        actions.push({ kind: "throttle", pid: p.pid, name: p.name });
+        throttled.add(p.pid);
+      }
+  }
+  const cpuRate = DIAL_CPU_RATE[step] ?? 100;
+  if (cpuRate !== prev.cpuRate) actions.push({ kind: "cpu", percent: cpuRate });
+  const heavy = sample.procs.filter((p) => isHeavyCompiler(p.name)).sort((a, b) => a.pid - b.pid);
+  let allowed = compilersAllowed(step, heavy.length);
+  if (maxCompilers2 !== null && step >= 2) allowed = Math.min(allowed, Math.max(1, maxCompilers2));
+  if (allowed < heavy.length) {
+    const turn = Math.floor(nowMs / ROTATE_MS) % heavy.length;
+    const order = [...heavy.slice(turn), ...heavy.slice(0, turn)];
+    for (const p of order.slice(allowed)) {
+      actions.push({ kind: "hold", pid: p.pid, name: p.name, ms: HOLD_MS });
+      if (step >= 3 && !trimmed.has(p.pid)) {
+        actions.push({ kind: "trim", pid: p.pid, name: p.name });
+        trimmed.add(p.pid);
+      }
+    }
+    for (const p of order.slice(0, allowed)) trimmed.delete(p.pid);
+  } else trimmed.clear();
+  const level = step >= 3 ? "suspending" : step >= 1 ? "throttled" : "ok";
   return {
-    state: { pressure, calm, samples, lowered, pausedUntil, nextPauseAt, hostUntil: prev.hostUntil },
+    state: {
+      step,
+      calm,
+      lowered,
+      memLow: [...memLow],
+      throttled: [...throttled],
+      trimmed: [...trimmed],
+      cpuRate,
+      lastCommitMb: usedMb,
+      lastAt: nowMs,
+      growth,
+      hostUntil: prev.hostUntil,
+      hostStep: prev.hostStep
+    },
     actions,
     level,
     ramFreePercent: Math.round(ramFree),
@@ -32533,25 +32775,14 @@ function decide(prev, sample, nowMs, thresholds, profile) {
   };
 }
 
-// src/guest/governor/governor.ts
-import fs52 from "node:fs";
-import path68 from "node:path";
-import { spawn as spawn8 } from "node:child_process";
-import { createInterface } from "node:readline";
-var SampleSchema = external_exports.object({
-  ramTotalMb: external_exports.number(),
-  ramAvailMb: external_exports.number(),
-  commitLimitMb: external_exports.number(),
-  commitAvailMb: external_exports.number(),
-  procs: external_exports.array(
-    external_exports.object({
-      pid: external_exports.number().int(),
-      name: external_exports.string().max(128),
-      mb: external_exports.number(),
-      prio: external_exports.enum(["idle", "below", "normal"]).catch("normal")
-    })
-  ).max(1024)
-});
+// src/guest/governor/core.ts
+var STEP_TEXT = [
+  "builds back to normal",
+  "build programs at lower priority",
+  "builds get less CPU and take turns",
+  "builds take turns, waiting ones go to the paging file",
+  "one compiler at a time"
+];
 var GovernorCore = class {
   constructor(deps) {
     this.deps = deps;
@@ -32561,42 +32792,51 @@ var GovernorCore = class {
   lastAction = "";
   lastWrite = "";
   lastWriteAt = 0;
-  pausedName = "";
-  pausedPid = 0;
-  hostPressure(seconds, reason) {
-    const until = this.deps.now() + seconds * 1e3;
-    if (until > this.state.hostUntil) {
-      if (this.state.hostUntil <= this.deps.now())
-        this.deps.logLine("governor: this PC is low (" + reason + "); slowing builds down");
-      this.state = { ...this.state, hostUntil: until };
-    }
+  /** Compilers waiting their turn now, by pid (name), to log a hold once. */
+  held = /* @__PURE__ */ new Map();
+  hostPressure(seconds, reason, level = "slow") {
+    const nowMs = this.deps.now();
+    const until = nowMs + seconds * 1e3;
+    const active = this.state.hostUntil > nowMs;
+    const step = Math.max(level === "severe" ? 4 : 2, active ? this.state.hostStep : 0);
+    if (!active || step > this.state.hostStep)
+      this.deps.logLine(
+        "governor: this PC is " + (level === "severe" ? "nearly out of memory" : "low") + " (" + reason + "); builds to step " + step
+      );
+    this.state = { ...this.state, hostUntil: Math.max(until, this.state.hostUntil), hostStep: step };
   }
   get current() {
     return this.state;
   }
   onSample(sample) {
     const nowMs = this.deps.now();
-    const before = this.state.pressure;
-    const d = decide(this.state, sample, nowMs, GUEST_THRESHOLDS[this.deps.profile], this.deps.profile);
+    const before = this.state.step;
+    const d = decide(this.state, sample, nowMs, this.deps.profile, this.deps.maxCompilers ?? null);
     this.state = d.state;
-    for (const action of d.actions) this.apply(action);
-    if (d.state.pressure !== before)
+    const holding = /* @__PURE__ */ new Set();
+    for (const action of d.actions) {
+      if (action.kind === "hold") holding.add(action.pid);
+      this.apply(action);
+    }
+    for (const pid of [...this.held.keys()]) if (!holding.has(pid)) this.held.delete(pid);
+    if (d.state.step !== before)
       this.deps.logLine(
-        d.state.pressure ? "governor: memory is low (" + d.ramFreePercent + "% RAM free, commit " + d.commitPercent + "% used): slowing builds down" : "governor: memory is fine again: builds back to normal"
+        "governor: step " + d.state.step + " (" + d.ramFreePercent + "% RAM free, commit " + d.commitPercent + "% used): " + STEP_TEXT[d.state.step]
       );
-    const paused = nowMs < d.state.pausedUntil && this.pausedPid ? [{ name: this.pausedName, pid: this.pausedPid, seconds: Math.ceil((d.state.pausedUntil - nowMs) / 1e3) }] : [];
     const status = {
       level: d.level,
+      step: d.state.step,
       profile: this.deps.profile,
       ramFreePercent: Math.max(0, Math.min(100, d.ramFreePercent)),
       commitPercent: Math.max(0, Math.min(100, d.commitPercent)),
       lowered: Object.keys(d.state.lowered).length,
-      paused,
+      paused: [...this.held].slice(0, 8).map(([pid, name]) => ({ name: name.slice(0, 64), pid, seconds: HOLD_MS / 1e3 })),
+      cpuPercent: d.state.cpuRate,
       pcLow: nowMs < d.state.hostUntil,
-      lastAction: this.lastAction,
+      lastAction: this.lastAction.slice(0, 300),
       updatedAt: now()
     };
-    const shape = JSON.stringify({ ...status, updatedAt: "", paused: paused.map((p) => p.pid) });
+    const shape = JSON.stringify({ ...status, updatedAt: "", paused: status.paused.map((p) => p.pid) });
     if (shape !== this.lastWrite || nowMs - this.lastWriteAt > 6e4) {
       this.lastWrite = shape;
       this.lastWriteAt = nowMs;
@@ -32604,24 +32844,64 @@ var GovernorCore = class {
     }
   }
   apply(action) {
+    const port = this.deps.port;
     try {
-      if (action.kind === "priority") {
-        this.deps.port.setPriority(action.pid, action.to);
-        this.lastAction = action.name + " (" + action.pid + ") priority " + action.to;
-      } else {
-        this.deps.port.pause(action.pid, action.ms);
-        this.pausedName = action.name;
-        this.pausedPid = action.pid;
-        this.lastAction = "paused " + action.name + " (" + action.pid + ") for " + action.ms / 1e3 + " s";
-        this.deps.logLine("governor: " + this.lastAction);
-        return;
+      switch (action.kind) {
+        case "hold":
+          port.hold(action.pid, action.ms);
+          if (!this.held.has(action.pid)) {
+            this.held.set(action.pid, action.name);
+            this.note(action.name + " (" + action.pid + ") waits its turn");
+          }
+          return;
+        case "priority":
+          port.setPriority(action.pid, action.to);
+          this.note(action.name + " (" + action.pid + ") priority " + action.to);
+          return;
+        case "memory":
+          port.setMemoryPriority(action.pid, action.low);
+          return;
+        case "throttle":
+          port.throttle(action.pid);
+          return;
+        case "cpu":
+          port.setCpuRate(action.percent);
+          this.note(action.percent >= 100 ? "compilers: no CPU cap" : "compilers: at most " + action.percent + "% CPU");
+          return;
+        case "trim":
+          port.trim(action.pid);
+          return;
       }
-      this.deps.logLine("governor: " + this.lastAction);
     } catch (e) {
-      warn("governor: " + errMsg(e));
+      this.deps.warn("governor: " + errMsg(e));
     }
   }
+  note(text) {
+    this.lastAction = text;
+    this.deps.logLine("governor: " + text);
+  }
 };
+
+// src/guest/governor/governor.ts
+import fs53 from "node:fs";
+import os12 from "node:os";
+import path69 from "node:path";
+import { spawn as spawn8 } from "node:child_process";
+import { createInterface } from "node:readline";
+var SampleSchema = external_exports.object({
+  ramTotalMb: external_exports.number(),
+  ramAvailMb: external_exports.number(),
+  commitLimitMb: external_exports.number(),
+  commitAvailMb: external_exports.number(),
+  procs: external_exports.array(
+    external_exports.object({
+      pid: external_exports.number().int(),
+      name: external_exports.string().max(128),
+      mb: external_exports.number(),
+      prio: external_exports.enum(["idle", "below", "normal"]).catch("normal")
+    })
+  ).max(1024)
+});
 var MemGovProcess = class {
   constructor(onSample) {
     this.onSample = onSample;
@@ -32652,20 +32932,35 @@ var MemGovProcess = class {
     }
   }
   setPriority(pid, to) {
-    this.child?.stdin?.write("priority " + pid + " " + to + "\n");
+    this.send("priority " + pid + " " + to);
+  }
+  hold(pid, ms) {
+    this.send("suspend " + pid + " " + ms);
+  }
+  setMemoryPriority(pid, low) {
+    this.send("memprio " + pid + " " + (low ? "low" : "normal"));
+  }
+  throttle(pid) {
+    this.send("throttle " + pid);
+  }
+  setCpuRate(percent) {
+    this.send("cpurate " + Math.round(percent));
+  }
+  trim(pid) {
+    this.send("trim " + pid);
   }
-  pause(pid, ms) {
-    this.child?.stdin?.write("suspend " + pid + " " + ms + "\n");
+  send(line) {
+    this.child?.stdin?.write(line + "\n");
   }
 };
 function appendToMemoryLog(line) {
   try {
-    const logs = path68.join(dataDir, "logs");
-    const newest = fs52.readdirSync(logs).filter((f) => /^memory-\d{8}-\d{6}\.log$/.test(f)).sort().pop();
+    const logs = path69.join(dataDir, "logs");
+    const newest = fs53.readdirSync(logs).filter((f) => /^memory-\d{8}-\d{6}\.log$/.test(f)).sort().pop();
     if (!newest) return;
     const t = /* @__PURE__ */ new Date();
     const stamp = [t.getHours(), t.getMinutes(), t.getSeconds()].map((n) => String(n).padStart(2, "0")).join(":");
-    fs52.appendFileSync(path68.join(logs, newest), stamp + " | " + line + "\r\n");
+    fs53.appendFileSync(path69.join(logs, newest), stamp + " | " + line + "\r\n");
   } catch {
   }
 }
@@ -32673,8 +32968,8 @@ var Governor = class {
   core = null;
   describe() {
     const profile = session.loadProfile === "gentle" ? "gentle" : "normal";
-    const t = GUEST_THRESHOLDS[profile];
-    return session.pressureResponse === false ? "off (sandbox.pressureResponse)" : profile + " profile: slows builds down below " + t.enterAvailablePercent + "% free RAM or above " + t.enterCommitPercent + "% commit";
+    const first = DIAL_STEPS[profile][0];
+    return session.pressureResponse === false ? "off (sandbox.pressureResponse)" : profile + " profile: slows builds down from " + first.availablePercent + "% free RAM or " + first.commitPercent + "% commit, in steps";
   }
   start() {
     if (session.pressureResponse === false) return;
@@ -32683,8 +32978,10 @@ var Governor = class {
     this.core = new GovernorCore({
       port: proc,
       profile,
+      maxCompilers: maxCompilers(os12.cpus().length, profile),
       now: () => Date.now(),
       logLine: appendToMemoryLog,
+      warn,
       saveStatus: (status) => {
         try {
           writeJsonAtomic(run.pressureFile, status);
@@ -32695,9 +32992,9 @@ var Governor = class {
     });
     proc.start();
   }
-  /** The host's watchdog: this PC is low for a while. */
-  hostPressure(seconds, reason) {
-    this.core?.hostPressure(seconds, reason);
+  /** The host's watchdog: this PC is low (or nearly out of memory) for a while. */
+  hostPressure(seconds, reason, level = "slow") {
+    this.core?.hostPressure(seconds, reason, level);
   }
 };
 var governor = new Governor();
@@ -32720,9 +33017,9 @@ var Daemon = class {
   tick() {
     const { valid, invalid } = run.scanRequests();
     for (const file3 of invalid)
-      safely("removing an invalid request", () => fs53.rmSync(file3, { recursive: true, force: true }));
+      safely("removing an invalid request", () => fs54.rmSync(file3, { recursive: true, force: true }));
     for (const req of valid) {
-      safely("claiming a request", () => fs53.rmSync(run.requestFile(req.id), { force: true }));
+      safely("claiming a request", () => fs54.rmSync(run.requestFile(req.id), { force: true }));
       if (run.readSession(req.id)) continue;
       void Promise.resolve(this.handle(withRequestSecrets(req))).catch(
         (e) => respond(req.id, { ok: false, message: errMsg(e) })
@@ -32745,7 +33042,7 @@ var Daemon = class {
       case "restart":
         return sessions.restart(req);
       case "pressure":
-        return governor.hostPressure(req.seconds, req.reason);
+        return governor.hostPressure(req.seconds, req.reason, req.level ?? "slow");
       case "ping":
         return respond(req.id, { ok: true, message: "pong (" + sessions.count + " session(s) running)" });
     }