windows-development-sandbox 1.9.0 → 1.11.3

package/dist/runtime/main.js

@@ -5532,7 +5532,7 @@ var require_lodash = __commonJS({
 });
 
 // src/guest/entries/main.ts
-import fs60 from "node:fs";
+import fs61 from "node:fs";
 import path74 from "node:path";
 
 // src/guest/runtime/paths.ts
@@ -25411,6 +25411,9 @@ var AttachSchema = external_exports.strictObject({
   ),
   autoHide: external_exports.boolean().describe(
     "Hide the Windows Sandbox window whenever this terminal attaches; it keeps running (sandbox show brings it back)."
+  ),
+  confirmCtrlC: external_exports.boolean().describe(
+    'In an attached terminal and the sandbox window, a single Ctrl+C is held back (the title says so) and only a second one within 1.5 seconds reaches the agent: a Ctrl+C meant as "copy" no longer stops it. Esc still stops an agent.'
   )
 });
 var AgentCommandsSchema = external_exports.strictObject({
@@ -25455,7 +25458,9 @@ var SandboxSchema = external_exports.strictObject({
   engine: external_exports.enum(["windows-sandbox", "hcs"]).describe(
     '(alpha) What runs the sandbox. "windows-sandbox" = Windows Sandbox (the default: desktop, Windows Terminal, GPU, clipboard, audio, printers). "hcs" = a headless Hyper-V isolated Server Core container for agents (no desktop, GPU or clipboard); it needs Windows features and an image on this PC (sandbox engine check hcs lists what is missing), and starting it is not enabled yet in this alpha. sandbox engine shows what each engine can do. Yours only: a project file (.sandbox-config.json) cannot set it.'
   ),
-  memoryMb: external_exports.union([external_exports.literal("auto"), external_exports.number().int().min(2048)]).describe('Sandbox RAM in MB (>= 2048), or "auto": free RAM minus reserveHostMb, capped at maxMemoryMb.'),
+  memoryMb: external_exports.union([external_exports.literal("auto"), external_exports.number().int().min(2048)]).describe(
+    'Sandbox RAM in MB (>= 2048), or "auto": free RAM minus reserveHostMb, capped at maxMemoryMb. Never more than this PC can keep in RAM for it (its RAM minus the larger of reserveHostMb and 25 %, 2 GB more with vGPU): a bigger value is lowered.'
+  ),
   maxMemoryMb: external_exports.number().int().positive().describe('Upper limit for memoryMb "auto".'),
   maxMemoryPercent: external_exports.number().int().min(10).max(100).describe(`memoryMb "auto" never takes more than this share of this PC's total RAM (percent).`),
   cpuLimit: external_exports.union([external_exports.literal("none"), external_exports.number().int().min(5).max(100)]).describe(
@@ -25468,10 +25473,10 @@ var SandboxSchema = external_exports.strictObject({
     'Memory always left for this PC when memoryMb is "auto": the sandbox gets at most (free RAM, and RAM plus paging file still unused) minus this.'
   ),
   agentMemoryHeadroomMb: external_exports.union([external_exports.literal("auto"), external_exports.literal("none"), external_exports.number().int().min(0)]).describe(
-    'Memory kept out of the agents reach inside the sandbox, in MB: everything the agents start (their builds, tests, tools) together may use at most the sandbox memory minus this; a runaway parallel build then gets out-of-memory errors in its own session instead of freezing or crashing the whole sandbox. "auto" = the larger of 2048 MB and 10 % of the sandbox memory; "none" = no limit. Yours only: a project file cannot change it.'
+    'The last resort that keeps the sandbox up, in MB below its commit limit (RAM plus paging file): builds are slowed down long before (sandbox.pressureResponse); only if everything the agents start together would take the sandbox to the very edge of its memory, where Windows inside it would start failing, is a build refused memory instead of Windows. "auto" = the larger of 1536 MB and 3 % of the commit limit; "none" = no backstop. Yours only: a project file cannot change it.'
   ),
   pressureResponse: external_exports.boolean().describe(
-    "When the sandbox (or this PC) runs low on memory, slow the heaviest build programs down (lower priority) and, if that is not enough, pause the biggest compiler for a few seconds at a time, so heavy parallel builds slow down instead of closing the sandbox. Never touches the agents themselves. Yours only: a project file cannot change it."
+    "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. Yours only: a project file cannot change it."
   ),
   vGpu: external_exports.boolean().describe(
     "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it)."
@@ -25617,7 +25622,7 @@ var ToolchainsSchema = external_exports.strictObject({
       `GNU host: "lld" links with Rust's own lld through MinGW's gcc (much less memory than GNU ld), "gnu" with GNU ld.`
     ),
     linkSlots: external_exports.union([external_exports.literal("auto"), external_exports.number().int().min(1).max(32)]).describe(
-      'GNU host: how many programs may link at the same time in the whole sandbox (other links wait). "auto" = one per 8 GB of sandbox memory, 2 to 4. Several agents linking big programs at once can take Windows down.'
+      'GNU host: how many programs may link at the same time in the whole sandbox (other links wait). "auto" = one per 3 GB of sandbox memory after 6 GB, 2 to 8 (the memory governor slows links down too when memory runs short).'
     )
   }),
   msvc: external_exports.strictObject({
@@ -25692,7 +25697,7 @@ var ToolchainsSchema = external_exports.strictObject({
   }),
   cli: external_exports.strictObject({
     gh: EnabledSchema.describe(
-      'GitHub CLI (gh). Only with provisioning.git.access "full": gh can push and merge through the GitHub API, past a read-only git. Your PC\'s gh login is never copied; `gh auth login` inside persists (GH_CONFIG_DIR). "auto" = when the project has a .github folder.'
+      'GitHub CLI (gh). Only with provisioning.git.access "full": gh can push and merge through the GitHub API, past a read-only git. Your PC\'s gh login is never copied; `gh auth login` inside persists (GH_CONFIG_DIR), unless a token you saved for sandboxes is handed over (github.shareToken). "auto" = when the project has a .github folder.'
     ),
     zstd: EnabledSchema.describe('Zstandard (zstd). "auto" = off; set true to get it.'),
     openssl: EnabledSchema.describe(
@@ -26595,16 +26600,17 @@ var ResumeSchema = external_exports.strictObject({
 // src/core/schema/web.ts
 var WebSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "(Beta) Allow the web UI: your sandbox sessions in a browser on this PC. Off by default, and nothing starts it by itself yet: sandbox web start works either way and runs it until sandbox web stop (or a restart of the PC)."
+    "(Beta) The web UI: your sandbox sessions in a browser on this PC (http://127.0.0.1:<port>, this PC only). On: every sandbox start also starts it in the background (it keeps running until sandbox web stop or a restart of the PC). Off: only sandbox web start runs it. Open it signed in with sandbox web open."
   ),
-  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken.")
+  port: external_exports.number().int().min(1024).max(65535).describe("Port of the web UI on 127.0.0.1 (this PC only). Pick another when it is taken."),
+  openOnLaunch: external_exports.boolean().describe("(Beta) With the web UI on: open it in your browser, already signed in, every time a sandbox starts.")
 });
 
 // src/core/schema/vpn.ts
 var VPN_PROVIDERS = ["nordvpn", "openvpn-file", "wireguard-file"];
 var VpnSchema = external_exports.strictObject({
   enabled: external_exports.boolean().describe(
-    "Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
+    "(Alpha: not yet tried on a real PC) Send the sandbox's traffic through a VPN. Only the sandbox: your PC's own connection is untouched. Needs a saved login first (sandbox vpn login). The agent in the sandbox can read that login and can turn the tunnel off (it is the administrator there)."
   ),
   provider: external_exports.enum(VPN_PROVIDERS).describe(
     "nordvpn: a recommended NordVPN server is picked at every launch. openvpn-file: your own .ovpn file (configFile). wireguard-file: your own WireGuard .conf (configFile), e.g. from your company."
@@ -26619,6 +26625,13 @@ var VpnSchema = external_exports.strictObject({
   )
 });
 
+// src/core/schema/github.ts
+var GithubSchema = external_exports.strictObject({
+  shareToken: external_exports.boolean().describe(
+    'Give each sandbox the GitHub token you saved with `sandbox github login` (best a fine-grained token limited to some repositories and permissions), so gh and https git work there without logging in. Only with provisioning.git.access "full". The agent in the sandbox can read the token and use it for whatever it allows. A project file (.sandbox-config.json) cannot turn this on.'
+  )
+});
+
 // src/core/schema/config.ts
 var ConfigSchema = external_exports.strictObject({
   $schema: SchemaRefSchema.optional(),
@@ -26649,6 +26662,7 @@ var ConfigSchema = external_exports.strictObject({
   }),
   network: NetworkSchema,
   vpn: VpnSchema,
+  github: GithubSchema,
   provisioning: ProvisioningSchema,
   downloads: DownloadsSchema,
   toolchains: ToolchainsSchema,
@@ -26811,19 +26825,25 @@ var GuestRequestSchema = external_exports.discriminatedUnion("kind", [
     id: IdSchema,
     reason: Text(300),
     seconds: external_exports.number().int().min(10).max(300),
+    /** "severe": the PC is nearly out of memory; builds go to the governor's last step at once. */
+    level: external_exports.enum(["slow", "severe"]).optional(),
     createdAt: TimeSchema
   })
 ]);
 var PressureStatusSchema = external_exports.object({
   level: external_exports.enum(["ok", "throttled", "suspending"]),
+  /** The governor's dial, 0 (nothing wrong) to 4 (one compiler at a time). */
+  step: external_exports.number().int().min(0).max(4).optional(),
   profile: external_exports.enum(["normal", "gentle"]),
   /** Share of the sandbox's RAM still free and of its commit limit in use (percent). */
   ramFreePercent: external_exports.number().int().min(0).max(100),
   commitPercent: external_exports.number().int().min(0).max(100),
   /** Programs running at lower priority because of it. */
   lowered: external_exports.number().int().min(0).max(1024),
-  /** Programs paused right now (name, process id, seconds left). */
+  /** Compilers waiting their turn right now (name, process id, seconds until they may go on). */
   paused: external_exports.array(external_exports.object({ name: Text(64), pid: external_exports.number().int(), seconds: external_exports.number().int().min(0).max(60) })).max(8),
+  /** The CPU share the compilers get together (percent; 100 = no cap). */
+  cpuPercent: external_exports.number().int().min(0).max(100).optional(),
   /** The PC itself asked for slowing down (its memory or CPU is low). */
   pcLow: external_exports.boolean(),
   lastAction: Text(300),
@@ -26867,6 +26887,8 @@ var VpnStatusSchema = external_exports.object({
   state: external_exports.enum(["off", "starting", "up", "failed"]),
   message: Text(2e3),
   killSwitch: external_exports.boolean(),
+  /** A direct connection was tried after the kill switch was applied: false = it still got out. */
+  killSwitchHeld: external_exports.boolean().optional(),
   /** The server's name, e.g. uk2201.nordvpn.com. */
   server: Text(128).optional(),
   /** What the sandbox's traffic looks like from outside, once the tunnel is up. */
@@ -27014,6 +27036,21 @@ function safeRemove(target, root) {
   fs3.rmSync(target, { recursive: true, force: true, maxRetries: 2 });
 }
 
+// src/shared/io/robocopy-result.ts
+function robocopyFailed(code) {
+  return code === null || code >= 8;
+}
+function robocopyMeaning(code) {
+  if (code === null) return "robocopy did not finish";
+  if (code >= 16) return "robocopy stopped with a fatal error (bad path or no access)";
+  if (code >= 8) return code & 1 ? "some files were copied and some could not be" : "files could not be copied";
+  return code === 0 ? "nothing to copy" : "copied";
+}
+function robocopyErrors(output3, max = 3) {
+  const lines = output3.split(/\r?\n/).map((l) => l.trim()).filter((l) => /\bERROR\b/.test(l) || /^The (process|system) cannot/i.test(l));
+  return lines.slice(0, max).map((l) => l.length > 220 ? l.slice(0, 217) + "..." : l);
+}
+
 // src/shared/channel/run-dir.ts
 function safeId(id) {
   return IdSchema.parse(id);
@@ -27039,6 +27076,8 @@ var RunDir = class {
   vpnFile;
   /** What the memory governor in the sandbox is doing (pressure.json). */
   pressureFile;
+  /** What the sandbox's programs may really use (budget.json): processors, memory, build jobs, link slots. */
+  budgetFile;
   requestsDir;
   responsesDir;
   sessionsDir;
@@ -27052,6 +27091,7 @@ var RunDir = class {
     this.sandboxFile = path6.join(this.root, "sandbox.json");
     this.vpnFile = path6.join(this.root, "vpn.json");
     this.pressureFile = path6.join(this.root, "pressure.json");
+    this.budgetFile = path6.join(this.root, "budget.json");
     this.requestsDir = path6.join(this.root, "requests");
     this.responsesDir = path6.join(this.root, "responses");
     this.sessionsDir = path6.join(this.root, "sessions");
@@ -27491,7 +27531,7 @@ function writeStatus(phase, message) {
 }
 
 // src/guest/boot/boot.ts
-import fs59 from "node:fs";
+import fs60 from "node:fs";
 import path73 from "node:path";
 import { spawn as spawn9 } from "node:child_process";
 
@@ -27596,7 +27636,16 @@ function execOutput(file3, args, options = {}) {
   return result.status === 0 ? String(result.stdout ?? "").trim() : "";
 }
 function runScript(name, args = []) {
-  exec(SYSTEM.powershell(), scriptArgs(name, args));
+  const result = spawnSync(SYSTEM.powershell(), scriptArgs(name, args), {
+    stdio: ["inherit", "inherit", "pipe"],
+    encoding: "utf8",
+    windowsHide: true
+  });
+  if (result.error) throw result.error;
+  const errors = String(result.stderr ?? "").trim();
+  if (errors) process.stderr.write(errors + "\n");
+  if (result.status !== 0)
+    throw new Error(name + " failed with exit code " + result.status + (errors ? ": " + errors.slice(0, 400) : ""));
 }
 function scriptOutput(name, args = [], options = {}) {
   return execOutput(SYSTEM.powershell(), scriptArgs(name, args), options);
@@ -27622,14 +27671,40 @@ function robocopy(from, to, files = []) {
       fs12.copyFileSync(path15.join(from, f), path15.join(to, f));
     return;
   }
-  const what = files.length ? files : ["/E", "/MT:16"];
-  const result = spawnSync(
-    SYSTEM.robocopy(),
-    [from, to, ...what, "/NFL", "/NDL", "/NJH", "/NJS", "/NP", "/R:1", "/W:1", "/XJ"],
-    { stdio: "ignore", windowsHide: true }
+  const what = files.length ? files : ["/E"];
+  const passes = [
+    ["/MT:16", "/R:1", "/W:1"],
+    ["/MT:1", "/R:4", "/W:3"]
+  ];
+  let code = null;
+  let output3 = "";
+  for (const pass of passes) {
+    const result = spawnSync(
+      SYSTEM.robocopy(),
+      [
+        from,
+        to,
+        ...what,
+        ...files.length ? [] : [pass[0]],
+        pass[1],
+        pass[2],
+        "/NFL",
+        "/NDL",
+        "/NJH",
+        "/NJS",
+        "/NP",
+        "/XJ"
+      ],
+      { encoding: "utf8", windowsHide: true }
+    );
+    code = result.status;
+    output3 = String(result.stdout ?? "") + String(result.stderr ?? "");
+    if (!robocopyFailed(code)) return;
+  }
+  const why = robocopyErrors(output3);
+  throw new Error(
+    "robocopy " + from + " -> " + to + " failed (exit " + code + ": " + robocopyMeaning(code) + ")" + (why.length ? ": " + why.join(" | ") : "")
   );
-  if ((result.status ?? 16) >= 8)
-    throw new Error("robocopy " + from + " -> " + to + " failed (exit " + result.status + ")");
 }
 function copyNode(from, to) {
   const work = stagingFolder(to);
@@ -29183,9 +29258,17 @@ async function setupUv(env) {
 function ghConfigDir() {
   return path34.join(stateDir, "gh");
 }
+function deliveredGhConfigDir() {
+  return path34.join(localDir, "gh-token");
+}
+function ghExePath() {
+  const entry = CLI_TOOLS.find((t) => t.name === "gh");
+  const dir = tool("cli", "gh");
+  return path34.join(entry?.subdir ? path34.join(dir, entry.subdir) : dir, entry?.exe ?? "gh.exe");
+}
 var toolVars = {
   gh: () => ({
-    GH_CONFIG_DIR: mkdirp(ghConfigDir()),
+    GH_CONFIG_DIR: exists(deliveredGhConfigDir()) ? deliveredGhConfigDir() : mkdirp(ghConfigDir()),
     GH_NO_UPDATE_NOTIFIER: "1",
     GH_NO_EXTENSION_UPDATE_NOTIFIER: "1"
   })
@@ -29990,6 +30073,10 @@ var ensureNvm = async () => {
   log("Downloading nvm-windows (" + asset.url.split("/").slice(-2, -1)[0] + ") ...");
   await downloader.archive(asset.url, NVM_HOME, { sha256: asset.sha256, locate: "nvm.exe", fileName: asset.name });
 };
+var hostNodeFolder = (version2) => {
+  const dir = path45.join(hostToolsDir, "node");
+  return session.hostTools.nodeVersion?.replace(/^v/, "") === version2 && exists(path45.join(dir, "node.exe")) ? dir : null;
+};
 var installNodeVersion = async (version2) => {
   const dir = path45.join(NVM_HOME, "v" + version2);
   const fromHost = path45.join(HOST_NVM, "v" + version2);
@@ -29999,6 +30086,12 @@ var installNodeVersion = async (version2) => {
     copyNode(fromHost, dir);
     return;
   }
+  const hostNode = hostNodeFolder(version2);
+  if (hostNode) {
+    log("Copying Node " + version2 + " from this PC (without global packages) ...");
+    copyNode(hostNode, dir);
+    return;
+  }
   log("Downloading Node " + version2 + " (~30 MB once) ...");
   mkdirp(NVM_TEMP);
   let out;
@@ -30007,8 +30100,13 @@ var installNodeVersion = async (version2) => {
   } finally {
     safeRemove(NVM_TEMP, NVM_HOME);
   }
-  if (!exists(path45.join(dir, "node.exe")))
-    throw new Error("nvm install " + version2 + " failed: " + out.trim().split("\n").slice(-2).join(" "));
+  if (!exists(path45.join(dir, "node.exe"))) {
+    const tail2 = out.trim().split(/\r?\n/).filter(Boolean).slice(-3).join(" ");
+    const why = /complete/i.test(out) ? "nvm said it finished, but its move into the data folder did not happen" : "nvm could not download or unpack it: check the internet connection and the free disk space";
+    throw new Error(
+      "nvm install " + version2 + " did not leave " + path45.join(dir, "node.exe") + " (" + why + ")" + (tail2 ? ". nvm printed: " + tail2 : "")
+    );
+  }
 };
 var activate = async (version2) => {
   await nvm(["use", version2]);
@@ -30016,6 +30114,10 @@ var activate = async (version2) => {
   fs36.rmSync(NVM_SYMLINK, { recursive: true, force: true });
   fs36.symlinkSync(path45.join(NVM_HOME, "v" + version2), NVM_SYMLINK, "junction");
 };
+var PLAYWRIGHT_VARS = () => ({
+  PLAYWRIGHT_BROWSERS_PATH: tool("ms-playwright"),
+  PLAYWRIGHT_MCP_BROWSER: "msedge"
+});
 async function setupNode(env, versions, config2) {
   if (dryRun) {
     log("(dry run) would provision nvm and Node " + versions.node.spec + " (from " + versions.node.source + ")");
@@ -30049,13 +30151,14 @@ async function setupNode(env, versions, config2) {
       warn("Node " + version2 + " from this PC: " + errMsg(e));
     }
   }
-  Object.assign(env.vars, { NVM_HOME, NVM_SYMLINK });
+  Object.assign(env.vars, { NVM_HOME, NVM_SYMLINK, ...PLAYWRIGHT_VARS() });
   if (duringSession()) env.prepend.push(path45.join(NVM_HOME, "v" + main), NVM_HOME, NVM_SYMLINK);
   else {
     await activate(main);
     env.prepend.push(NVM_HOME, NVM_SYMLINK);
   }
   env.summary.push("node: " + main + " (from " + versions.node.source + ", switch with nvm use)");
+  env.summary.push("playwright: ready (Edge; browsers it downloads are kept; in tests use channel: 'msedge')");
   await packageManagers(env, config2, main);
 }
 var packageManagers = async (env, config2, version2) => {
@@ -31966,11 +32069,17 @@ import os8 from "node:os";
 import path51 from "node:path";
 
 // src/shared/memory/policy.ts
+function buildJobs(cpus, memoryGb) {
+  return Math.max(2, Math.min(cpus, Math.floor((memoryGb - 6) / 3)));
+}
+function linkSlotsFor(memoryGb) {
+  return Math.max(2, Math.min(8, Math.floor((memoryGb - 6) / 3)));
+}
 function cargoJobs(cpus, memoryGb, sessions) {
-  const byCpu = Math.max(2, Math.min(4, Math.floor(cpus / 4)));
+  const byCpu = Math.max(2, Math.min(8, Math.floor(cpus / 4)));
   const byMemory = Math.max(1, Math.floor(memoryGb / 4));
   const jobs = Math.min(byCpu, byMemory);
-  return Math.max(1, Math.min(jobs, Math.floor(8 / Math.max(1, sessions))));
+  return Math.max(1, Math.min(jobs, Math.floor(buildJobs(cpus, memoryGb) / Math.max(1, sessions))));
 }
 
 // src/guest/toolchains/native/rust-extras.ts
@@ -31993,7 +32102,7 @@ function linkGate(env, rust, host) {
   const gate = path51.join(mkdirp(tool("shims")), "linkgate.exe");
   fs41.copyFileSync(ensureCompiled("linkgate"), gate);
   const memoryGb = os8.totalmem() / 1024 ** 3;
-  const slots = rust.linkSlots === "auto" ? Math.max(2, Math.min(4, Math.floor(memoryGb / 8))) : rust.linkSlots;
+  const slots = rust.linkSlots === "auto" ? linkSlotsFor(memoryGb) : rust.linkSlots;
   env.vars.AGENT_LINK_SLOTS = String(slots);
   env.vars.AGENT_REAL_LINKER = gcc;
   env.vars.CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER = gate;
@@ -33042,9 +33151,31 @@ function buildFirewallCommands(exemptIps) {
   }
   return commands;
 }
+var ATTACH_RULE = "AgentSandbox-Attach";
+function hasShortName(file3) {
+  return file3.split(/[/\\]/).some((part) => /~\d/.test(part));
+}
+function attachRuleCommands(ptyHostExe) {
+  return [
+    ["advfirewall", "firewall", "delete", "rule", "name=" + ATTACH_RULE],
+    [
+      "advfirewall",
+      "firewall",
+      "add",
+      "rule",
+      "name=" + ATTACH_RULE,
+      "dir=in",
+      "action=allow",
+      "enable=yes",
+      "profile=any",
+      "protocol=tcp",
+      "remoteip=LocalSubnet",
+      "program=" + ptyHostExe
+    ]
+  ];
+}
 
 // src/guest/network/firewall.ts
-var ATTACH_RULE = "AgentSandbox-Attach";
 var netsh = (args) => {
   const r = spawnSync5(SYSTEM.netsh(), args, { encoding: "utf8", windowsHide: true });
   return { status: r.status, out: (r.stdout ?? "") + (r.stderr ?? "") };
@@ -33078,23 +33209,38 @@ var waitForInternet = async (seconds) => {
   }
   return false;
 };
-var attachRule = (ptyHostExe) => [
-  ["advfirewall", "firewall", "delete", "rule", "name=" + ATTACH_RULE],
-  [
-    "advfirewall",
-    "firewall",
-    "add",
-    "rule",
-    "name=" + ATTACH_RULE,
-    "dir=in",
-    "action=allow",
-    "enable=yes",
-    "profile=any",
-    "protocol=tcp",
-    "remoteip=LocalSubnet",
-    "program=" + ptyHostExe
-  ]
-];
+var problems = [];
+function networkProblems() {
+  return problems;
+}
+function longPath(file3) {
+  if (!hasShortName(file3)) return file3;
+  try {
+    return fs48.realpathSync.native(file3);
+  } catch {
+    return file3;
+  }
+}
+async function applyAttachRule(ptyHostExe) {
+  if (!session.attach.enabled) return;
+  if (!ptyHostExe) {
+    problems.push("attach: the session host was not built, so the firewall rule for it was not created");
+    warn(problems[problems.length - 1]);
+    return;
+  }
+  let last = "";
+  for (let attempt = 1; attempt <= 3; attempt++) {
+    try {
+      run2(attachRuleCommands(longPath(ptyHostExe)));
+      return;
+    } catch (e) {
+      last = errMsg(e);
+      if (attempt < 3) await new Promise((r) => setTimeout(r, 1e3));
+    }
+  }
+  problems.push("attach: the firewall rule for the session host could not be created (" + last + ")");
+  warn("PROTECTION MISSING: " + problems[problems.length - 1]);
+}
 function run2(commands) {
   for (const c of commands) {
     const r = netsh(c);
@@ -33107,13 +33253,14 @@ async function applyNetworkPolicy(ptyHostExe) {
     log("Networking is disabled for this sandbox.");
     return "offline";
   }
-  const block = session.network.blockPrivateRanges;
-  const exempt = block ? discoverExemptIps() : [];
-  const lanRules = block ? buildFirewallCommands(exempt) : [];
+  const block2 = session.network.blockPrivateRanges;
+  const exempt = block2 ? discoverExemptIps() : [];
+  const lanRules = block2 ? buildFirewallCommands(exempt) : [];
+  const forwardRules = forwardRule();
   const commands = [
     ...lanRules,
-    ...ptyHostExe && session.attach.enabled ? attachRule(ptyHostExe) : [],
-    ...forwardRule()
+    ...ptyHostExe && session.attach.enabled ? attachRuleCommands(ptyHostExe) : [],
+    ...forwardRules
   ];
   if (isWin && !dryRun) {
     try {
@@ -33127,20 +33274,33 @@ async function applyNetworkPolicy(ptyHostExe) {
       warn("network.dns could not be applied: " + errMsg(e));
     }
   }
-  if (!block) log("Private-range blocking disabled by config.");
-  if (block)
+  if (!block2) log("Private-range blocking disabled by config.");
+  if (block2)
     log(
       "Gateway/DNS addresses kept reachable for DNS only: " + (exempt.length ? [...new Set(exempt)].join(", ") : "(none found)")
     );
   if (!isWin || dryRun) {
     log("(dry run) firewall plan:");
     for (const c of commands) log("  netsh " + c.join(" "));
-    return block ? "blocked" : "open";
+    return block2 ? "blocked" : "open";
   }
   if (commands.length === 0) return "open";
-  const online = block ? await waitForInternet(30) : true;
-  run2(commands);
-  if (!block) return "open";
+  const online = block2 ? await waitForInternet(30) : true;
+  const failures = [];
+  try {
+    run2(lanRules);
+  } catch (e) {
+    failures.push(errMsg(e));
+  }
+  await applyAttachRule(ptyHostExe);
+  try {
+    run2(forwardRules);
+  } catch (e) {
+    problems.push("forwardPorts: the firewall rule for the relays could not be created (" + errMsg(e) + ")");
+    warn("PROTECTION MISSING: " + problems[problems.length - 1]);
+  }
+  if (failures.length) throw new Error(failures[0]);
+  if (!block2) return "open";
   if (online && !await waitForInternet(15)) {
     run2(lanRules.filter((c) => c[2] === "delete"));
     warn(
@@ -33370,18 +33530,109 @@ function setupGitConfig(env) {
   spawnSync7(git, ["config", "--global", "core.autocrlf", "input"], { env: rest, windowsHide: true, stdio: "ignore" });
 }
 
+// src/guest/setup/github-token.ts
+import fs53 from "node:fs";
+import { spawnSync as spawnSync8 } from "node:child_process";
+
+// src/shared/github/token.ts
+var MIN_LENGTH = 20;
+var MAX_LENGTH = 255;
+var PRINTABLE = /^[\x21-\x7e]+$/;
+var GithubTokenSchema = external_exports.string().min(MIN_LENGTH).max(MAX_LENGTH).regex(PRINTABLE);
+var TOKEN_VARIABLES = /^(GH_TOKEN|GITHUB_TOKEN|GH_ENTERPRISE_TOKEN|GITHUB_ENTERPRISE_TOKEN)$/i;
+var ghEnv = (base, configDir) => ({
+  ...Object.fromEntries(
+    Object.entries(base).filter((e) => e[1] !== void 0 && !TOKEN_VARIABLES.test(e[0]))
+  ),
+  GH_CONFIG_DIR: configDir,
+  GH_PROMPT_DISABLED: "1",
+  GH_NO_UPDATE_NOTIFIER: "1"
+});
+function ghLoginCommand(ghExe, configDir, token, base) {
+  return {
+    file: ghExe,
+    args: [
+      "auth",
+      "login",
+      "--hostname",
+      "github.com",
+      "--git-protocol",
+      "https",
+      "--insecure-storage",
+      "--with-token"
+    ],
+    input: token + "\n",
+    env: ghEnv(base, configDir)
+  };
+}
+function ghSetupGitCommand(ghExe, configDir, base) {
+  return { file: ghExe, args: ["auth", "setup-git", "--hostname", "github.com"], env: ghEnv(base, configDir) };
+}
+function ghOutputText(text, token) {
+  const clean = token ? text.split(token).join("***") : text;
+  return clean.replace(/\s+/g, " ").trim().slice(0, 300);
+}
+
+// src/guest/setup/github-token.ts
+var GH_TIMEOUT_MS = 6e4;
+function prepareGithubFolder(token) {
+  const dir = deliveredGhConfigDir();
+  fs53.rmSync(dir, { recursive: true, force: true });
+  if (!token) return false;
+  mkdirp(dir);
+  return true;
+}
+function runGh(command, token, what) {
+  const result = spawnSync8(command.file, [...command.args], {
+    env: command.env,
+    encoding: "utf8",
+    windowsHide: true,
+    timeout: GH_TIMEOUT_MS,
+    stdio: ["pipe", "pipe", "pipe"],
+    ...command.input !== void 0 ? { input: command.input } : {}
+  });
+  if (result.error) throw new Error(what + " could not run: " + ghOutputText(result.error.message, token));
+  if (result.status !== 0)
+    throw new Error(
+      what + " failed: " + ghOutputText(String(result.stderr ?? "") || String(result.stdout ?? ""), token)
+    );
+}
+function loginGithub(token, env) {
+  if (dryRun) {
+    log("(dry run) would log gh in with the GitHub token from your PC");
+    return;
+  }
+  const gh2 = ghExePath();
+  const dir = deliveredGhConfigDir();
+  if (!exists(gh2) || env.GH_CONFIG_DIR !== dir) {
+    fs53.rmSync(dir, { recursive: true, force: true });
+    log("A GitHub token arrived, but gh is not set up in this sandbox (toolchains.cli.gh), so it is not used.");
+    return;
+  }
+  try {
+    runGh(ghLoginCommand(gh2, dir, token, env), token, "gh auth login");
+    runGh(ghSetupGitCommand(gh2, dir, env), token, "gh auth setup-git");
+  } catch (e) {
+    fs53.rmSync(dir, { recursive: true, force: true });
+    env.GH_CONFIG_DIR = mkdirp(ghConfigDir());
+    addMachineEnvironment({ GH_CONFIG_DIR: env.GH_CONFIG_DIR }, []);
+    throw e;
+  }
+  log("gh and https git to github.com use the GitHub token from your PC (github.shareToken); the agent can read it.");
+}
+
 // src/guest/sessions/pty-host.ts
 function ensurePtyHost() {
   return ensureCompiled("ptyhost");
 }
 
 // src/guest/toolchains/leftovers.ts
-import fs53 from "node:fs";
+import fs54 from "node:fs";
 import path66 from "node:path";
 var STAGING = /\.staging-[0-9a-f]+$/i;
 var entries2 = (dir) => {
   try {
-    return fs53.readdirSync(dir, { withFileTypes: true });
+    return fs54.readdirSync(dir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -33398,17 +33649,17 @@ function pruneToolLeftovers() {
 
 // src/guest/audit/process-audit.ts
 import path67 from "node:path";
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 var PROCESS_CREATION = "{0CCE922B-69AE-11D9-BED3-505054503030}";
 var auditOn = () => Boolean(session.auditProcesses) && isWin && !dryRun;
 function enableProcessAudit() {
   if (!auditOn()) return;
-  spawnSync8(
+  spawnSync9(
     path67.join(process.env.WINDIR ?? "C:\\Windows", "System32", "auditpol.exe"),
     ["/set", "/subcategory:" + PROCESS_CREATION, "/success:enable"],
     { windowsHide: true, stdio: "ignore" }
   );
-  spawnSync8(
+  spawnSync9(
     SYSTEM.reg(),
     [
       "add",
@@ -33428,7 +33679,8 @@ function enableProcessAudit() {
 
 // src/guest/vpn/vpn.ts
 import dns2 from "node:dns";
-import fs57 from "node:fs";
+import fs58 from "node:fs";
+import net3 from "node:net";
 import os14 from "node:os";
 import path71 from "node:path";
 
@@ -33584,22 +33836,22 @@ function directiveOf(line) {
   return { name: parts2[0].toLowerCase(), args: parts2.slice(1) };
 }
 function inspectOvpn(text) {
-  const problems = [];
+  const problems2 = [];
   const found = [];
   const refuse = (message) => {
-    if (problems.length < 20 && !problems.includes(message)) problems.push(message);
+    if (problems2.length < 20 && !problems2.includes(message)) problems2.push(message);
   };
   if (Buffer.byteLength(text, "utf8") > MAX_OVPN_BYTES) return { ok: false, problems: ["the file is too big"] };
   if (text.includes("\0")) return { ok: false, problems: ["the file is not text"] };
   const lines = text.split(/\r?\n/);
   if (lines.length > MAX_LINES) return { ok: false, problems: ["the file has too many lines"] };
-  let block = null;
+  let block2 = null;
   let defaultProto = "udp";
   lines.forEach((line, i) => {
     const at = "line " + (i + 1) + ": ";
     const trimmed = line.trim();
-    if (block) {
-      if (trimmed.toLowerCase() === "</" + block + ">") block = null;
+    if (block2) {
+      if (trimmed.toLowerCase() === "</" + block2 + ">") block2 = null;
       else if (/^<\/?[A-Za-z-]+>$/.test(trimmed)) refuse(at + "a section inside a section");
       return;
     }
@@ -33607,7 +33859,7 @@ function inspectOvpn(text) {
     if (open2) {
       const tag = open2[1].toLowerCase();
       if (!BLOCKS.has(tag)) refuse(at + "<" + tag + "> is not allowed");
-      block = tag;
+      block2 = tag;
       return;
     }
     const d = directiveOf(line);
@@ -33632,10 +33884,10 @@ function inspectOvpn(text) {
     }
   });
   const remotes = found.map((r) => ({ host: r.host, port: r.port, proto: r.proto ?? defaultProto }));
-  if (block) refuse("a <" + block + "> section is never closed");
+  if (block2) refuse("a <" + block2 + "> section is never closed");
   if (remotes.length === 0) refuse("it names no remote server");
   if (remotes.length > 64) refuse("it names too many servers");
-  return problems.length ? { ok: false, problems } : { ok: true, remotes };
+  return problems2.length ? { ok: false, problems: problems2 } : { ok: true, remotes };
 }
 function assertSafeOvpn(text, what) {
   const report = inspectOvpn(text);
@@ -33672,9 +33924,9 @@ var inRange = (text, low, high) => {
 };
 var splitList = (text) => text.split(",").map((s) => s.trim()).filter(Boolean);
 function inspectWireguard(text) {
-  const problems = [];
+  const problems2 = [];
   const refuse = (message) => {
-    if (problems.length < 20 && !problems.includes(message)) problems.push(message);
+    if (problems2.length < 20 && !problems2.includes(message)) problems2.push(message);
   };
   if (Buffer.byteLength(text, "utf8") > MAX_WIREGUARD_BYTES) return { ok: false, problems: ["the file is too big"] };
   if (text.includes("\0")) return { ok: false, problems: ["the file is not text"] };
@@ -33716,7 +33968,7 @@ function inspectWireguard(text) {
   if (interfaces.length !== 1) refuse("it needs exactly one [Interface] section");
   if (peers.length === 0) refuse("it has no [Peer] section");
   if (peers.length > MAX_PEERS) refuse("it has too many [Peer] sections");
-  if (problems.length) return { ok: false, problems };
+  if (problems2.length) return { ok: false, problems: problems2 };
   const face = interfaces[0];
   const privateKey = one(face, "privatekey");
   if (!privateKey) refuse("[Interface] has no PrivateKey");
@@ -33763,7 +34015,7 @@ function inspectWireguard(text) {
       ...keepalive !== void 0 ? { keepalive } : {}
     });
   });
-  if (problems.length || !privateKey) return { ok: false, problems };
+  if (problems2.length || !privateKey) return { ok: false, problems: problems2 };
   return {
     ok: true,
     config: {
@@ -33841,8 +34093,22 @@ var drop = (name) => [
   "rule",
   "name=" + VPN_RULE_PREFIX + name
 ];
+var block = (name, extra) => [
+  "advfirewall",
+  "firewall",
+  "add",
+  "rule",
+  "name=" + VPN_RULE_PREFIX + name,
+  "dir=out",
+  "action=block",
+  "enable=yes",
+  "profile=any",
+  ...extra
+];
+var BLOCK_RULES = ["Block-Internet", "Block-IPv6", "Block-DNS-UDP", "Block-DNS-TCP"];
 function ruleNames(serverCount) {
   return [
+    ...BLOCK_RULES,
     "Loopback",
     "DHCP",
     "Host",
@@ -33850,6 +34116,39 @@ function ruleNames(serverCount) {
     ...Array.from({ length: Math.max(serverCount, 0) }, (_v, i) => "Server-" + (i + 1))
   ];
 }
+var NOT_INTERNET = [
+  ["0.0.0.0", "0.255.255.255"],
+  ["10.0.0.0", "10.255.255.255"],
+  ["100.64.0.0", "100.127.255.255"],
+  ["127.0.0.0", "127.255.255.255"],
+  ["169.254.0.0", "169.254.255.255"],
+  ["172.16.0.0", "172.31.255.255"],
+  ["192.168.0.0", "192.168.255.255"],
+  ["224.0.0.0", "255.255.255.255"]
+];
+var LAST_IPV4 = 4294967295;
+function ipNumber(ip) {
+  return ip.split(".").reduce((n, part) => n * 256 + Number(part), 0);
+}
+function ipText(n) {
+  return [24, 16, 8, 0].map((shift) => Math.floor(n / 2 ** shift) % 256).join(".");
+}
+function ipv4Except(excluded) {
+  const sorted = [...excluded].sort((a, b) => a[0] - b[0]);
+  const out = [];
+  let next = 0;
+  for (const [from, to] of sorted) {
+    if (from > next) out.push(ipText(next) + "-" + ipText(from - 1));
+    next = Math.max(next, to + 1);
+  }
+  if (next <= LAST_IPV4) out.push(ipText(next) + "-" + ipText(LAST_IPV4));
+  return out.join(",");
+}
+function internetExcept(servers) {
+  const ranges = NOT_INTERNET.map(([a, b]) => [ipNumber(a), ipNumber(b)]);
+  for (const s of cleanServers(servers)) ranges.push([ipNumber(s.ip), ipNumber(s.ip)]);
+  return ipv4Except(ranges);
+}
 function cleanServers(servers) {
   const seen = /* @__PURE__ */ new Set();
   return servers.filter((s) => {
@@ -33864,6 +34163,10 @@ function killSwitchCommands(servers, ptyHostExe) {
   return [
     ...ruleNames(Math.max(list.length, 8)).map(drop),
     ["advfirewall", "set", "allprofiles", "state", "on"],
+    block("Block-Internet", ["protocol=any", "remoteip=" + internetExcept(list)]),
+    block("Block-IPv6", ["protocol=any", "remoteip=2000::/3"]),
+    block("Block-DNS-UDP", ["protocol=udp", "remoteport=53"]),
+    block("Block-DNS-TCP", ["protocol=tcp", "remoteport=53"]),
     ["advfirewall", "set", "allprofiles", "firewallpolicy", "blockinbound,blockoutbound"],
     rule("Loopback", ["protocol=any", "remoteip=127.0.0.0/8"]),
     rule("DHCP", ["protocol=udp", "localport=68", "remoteport=67"]),
@@ -33875,7 +34178,21 @@ function killSwitchCommands(servers, ptyHostExe) {
 }
 function tunnelCommands(tunnelIp) {
   if (!isIPv4(tunnelIp)) throw new Error("Not an IPv4 address: " + tunnelIp);
-  return [drop("Tunnel"), rule("Tunnel", ["protocol=any", "localip=" + tunnelIp])];
+  const n = ipNumber(tunnelIp);
+  const notTunnel = ipv4Except([[n, n]]);
+  return [
+    ...["Block-Internet", "Block-DNS-UDP", "Block-DNS-TCP"].map((name) => [
+      "advfirewall",
+      "firewall",
+      "set",
+      "rule",
+      "name=" + VPN_RULE_PREFIX + name,
+      "new",
+      "localip=" + notTunnel
+    ]),
+    drop("Tunnel"),
+    rule("Tunnel", ["protocol=any", "localip=" + tunnelIp])
+  ];
 }
 function tunnelAddressFromLog(log2) {
   const add = /net_addr_v4_add:\s*(\d{1,3}(?:\.\d{1,3}){3})\/\d+/.exec(log2);
@@ -33888,7 +34205,7 @@ function tunnelAddressFromLog(log2) {
 
 // src/guest/vpn/openvpn.ts
 import crypto4 from "node:crypto";
-import fs54 from "node:fs";
+import fs55 from "node:fs";
 import path68 from "node:path";
 
 // src/shared/vpn/download.ts
@@ -33925,7 +34242,12 @@ function openvpnDownload(arch2 = process.arch) {
   const entry = arch2 === "arm64" ? OPENVPN_MSI.arm64 : OPENVPN_MSI.x64;
   return { ...entry, url: OPENVPN_MSI.base + entry.file };
 }
-var hasHash = (file3, sha256) => crypto4.createHash("sha256").update(fs54.readFileSync(file3)).digest("hex") === sha256;
+function repairServiceQueries() {
+  const did = scriptOutput("repair-wmi-services.ps1");
+  if (did === "removed") log("VPN: repaired the Windows service queries installers use (a Windows Sandbox gap).");
+  else if (did !== "absent" && did !== "kept") warn("VPN: could not check the Windows service queries installers use.");
+}
+var hasHash = (file3, sha256) => crypto4.createHash("sha256").update(fs55.readFileSync(file3)).digest("hex") === sha256;
 async function ensureOpenVpn() {
   const exe = openvpnExe();
   if (!isWin || dryRun) return exe;
@@ -33936,6 +34258,7 @@ async function ensureOpenVpn() {
     log("VPN: downloading OpenVPN " + OPENVPN_MSI.version + " (about 6 MB)");
     await downloader.file(dl.url, msi, dl.sha256);
   }
+  repairServiceQueries();
   log("VPN: installing OpenVPN");
   const logFile2 = path68.join(toolsDir, "downloads", "openvpn-install.log");
   const code = await spawnAsync(SYSTEM.msiexec(), ["/i", msi, "/qn", "/norestart", "/l*v", logFile2], {
@@ -33949,7 +34272,7 @@ async function ensureOpenVpn() {
 
 // src/guest/vpn/tunnel.ts
 import { spawn as spawn7 } from "node:child_process";
-import fs55 from "node:fs";
+import fs56 from "node:fs";
 import os12 from "node:os";
 import path69 from "node:path";
 var DONE = "Initialization Sequence Completed";
@@ -33967,17 +34290,17 @@ function failureReason(text) {
 }
 var tail = (text, lines = 12) => text.trim().split(/\r?\n/).slice(-lines).join("\n");
 async function startTunnel(o) {
-  const dir = fs55.mkdtempSync(path69.join(os12.tmpdir(), "sbx-vpn-"));
+  const dir = fs56.mkdtempSync(path69.join(os12.tmpdir(), "sbx-vpn-"));
   const auth = path69.join(dir, "login.txt");
   const logFile2 = path69.join(dir, "openvpn.log");
   const keepLog = () => {
     try {
-      fs55.mkdirSync(logsDir, { recursive: true });
-      fs55.copyFileSync(logFile2, path69.join(logsDir, "openvpn.log"));
+      fs56.mkdirSync(logsDir, { recursive: true });
+      fs56.copyFileSync(logFile2, path69.join(logsDir, "openvpn.log"));
     } catch {
     }
   };
-  fs55.writeFileSync(auth, o.username + "\r\n" + o.password + "\r\n", "utf8");
+  fs56.writeFileSync(auth, o.username + "\r\n" + o.password + "\r\n", "utf8");
   try {
     const child = spawn7(
       o.exe,
@@ -33995,7 +34318,7 @@ async function startTunnel(o) {
     child.unref();
     const deadline = Date.now() + (o.timeoutMs ?? 9e4);
     for (; ; ) {
-      const text = fs55.existsSync(logFile2) ? fs55.readFileSync(logFile2, "utf8") : "";
+      const text = fs56.existsSync(logFile2) ? fs56.readFileSync(logFile2, "utf8") : "";
       if (text.includes(DONE)) {
         keepLog();
         const tunnelIp = tunnelAddressFromLog(text) ?? void 0;
@@ -34015,14 +34338,14 @@ async function startTunnel(o) {
       await new Promise((r) => setTimeout(r, 500));
     }
   } finally {
-    fs55.rmSync(auth, { force: true });
+    fs56.rmSync(auth, { force: true });
   }
 }
 
 // src/guest/vpn/wireguard.ts
 import { execFile } from "node:child_process";
 import crypto5 from "node:crypto";
-import fs56 from "node:fs";
+import fs57 from "node:fs";
 import os13 from "node:os";
 import path70 from "node:path";
 var WIREGUARD_TUNNEL = "sandbox";
@@ -34036,7 +34359,7 @@ function wireguardDownload(arch2 = process.arch) {
   const entry = arch2 === "arm64" ? WIREGUARD_MSI.arm64 : WIREGUARD_MSI.x64;
   return { ...entry, url: WIREGUARD_MSI.base + entry.file };
 }
-var hasHash2 = (file3, sha256) => crypto5.createHash("sha256").update(fs56.readFileSync(file3)).digest("hex") === sha256;
+var hasHash2 = (file3, sha256) => crypto5.createHash("sha256").update(fs57.readFileSync(file3)).digest("hex") === sha256;
 async function ensureWireguard() {
   const exe = wireguardExe();
   if (!isWin || dryRun) return exe;
@@ -34047,6 +34370,7 @@ async function ensureWireguard() {
     log("VPN: downloading WireGuard " + WIREGUARD_MSI.version + " (about 3 MB)");
     await downloader.file(dl.url, msi, dl.sha256);
   }
+  repairServiceQueries();
   log("VPN: installing WireGuard");
   const logFile2 = path70.join(toolsDir, "downloads", "wireguard-install.log");
   const code = await spawnAsync(
@@ -34081,9 +34405,9 @@ async function removeWireguardTunnel(exe) {
 }
 async function startWireguardTunnel(o) {
   const root = path70.join(process.env.SystemRoot ?? "C:\\Windows", "Temp");
-  const dir = fs56.mkdtempSync(path70.join(fs56.existsSync(root) ? root : os13.tmpdir(), "sbx-wg-"));
+  const dir = fs57.mkdtempSync(path70.join(fs57.existsSync(root) ? root : os13.tmpdir(), "sbx-wg-"));
   const file3 = path70.join(dir, WIREGUARD_TUNNEL + ".conf");
-  fs56.writeFileSync(file3, o.config, "utf8");
+  fs57.writeFileSync(file3, o.config, "utf8");
   const fail = async (message) => {
     await removeWireguardTunnel(o.exe);
     return { ok: false, message };
@@ -34104,7 +34428,7 @@ async function startWireguardTunnel(o) {
       await sleep(500);
     }
   } finally {
-    fs56.rmSync(dir, { recursive: true, force: true });
+    fs57.rmSync(dir, { recursive: true, force: true });
   }
 }
 async function waitForHandshake(exe, poke, timeoutMs = 3e4) {
@@ -34173,15 +34497,47 @@ async function publicAddress() {
   }
 }
 var hasAdapter2 = (ip) => Object.values(os14.networkInterfaces()).some((list) => (list ?? []).some((i) => i.address === ip));
+var PROBE_TARGETS = ["1.1.1.1", "8.8.8.8", "9.9.9.9"];
+var PROBE_TIMEOUT_MS = 3e3;
+function connects(ip, port) {
+  return new Promise((resolve2) => {
+    const socket = net3.connect({ host: ip, port });
+    const done = (ok) => {
+      socket.destroy();
+      resolve2(ok);
+    };
+    socket.setTimeout(PROBE_TIMEOUT_MS, () => done(false));
+    socket.once("connect", () => done(true));
+    socket.once("error", () => done(false));
+  });
+}
+async function directConnectionBlocked(servers) {
+  const targets = PROBE_TARGETS.filter((ip) => !servers.some((s) => s.ip === ip));
+  const results = await Promise.all(targets.map((ip) => connects(ip, 443)));
+  return !results.some(Boolean);
+}
 async function setupVpn(secrets, ptyHostExe) {
   const vpn = session.vpn;
   if (!vpn) return true;
   const killSwitch = vpn.killSwitch;
   let blocked = false;
-  const block = (servers) => {
-    if (isWin && !dryRun) run2(killSwitchCommands(servers, ptyHostExe));
-    blocked = true;
-    log("VPN: kill switch on: nothing leaves the sandbox except through the tunnel.");
+  let held = false;
+  const block2 = async (servers) => {
+    if (!isWin || dryRun) {
+      blocked = held = true;
+      return;
+    }
+    try {
+      run2(killSwitchCommands(servers, ptyHostExe ? longPath(ptyHostExe) : null));
+    } finally {
+      blocked = true;
+      held = await directConnectionBlocked(servers);
+    }
+    if (held) log("VPN: kill switch on: nothing leaves the sandbox except through the tunnel (checked).");
+    else
+      warn(
+        "VPN: the kill switch did not hold: a direct connection still got out. If the tunnel drops, traffic leaves through your normal connection."
+      );
   };
   setVpnStatus("starting", "Starting the VPN");
   try {
@@ -34197,7 +34553,7 @@ async function setupVpn(secrets, ptyHostExe) {
         warn(
           "VPN: AllowedIPs does not include 0.0.0.0/0: with the kill switch on, only the tunnel traffic can leave the sandbox."
         );
-      if (killSwitch) block(servers);
+      if (killSwitch) await block2(servers);
       if (dryRun || !isWin) {
         log("(dry run) would start the WireGuard tunnel " + vpn.server);
         setVpnStatus("off", "dry run");
@@ -34212,11 +34568,11 @@ async function setupVpn(secrets, ptyHostExe) {
       const credentials = secrets.vpn;
       if (!credentials) throw new Error("the VPN login did not arrive (start the sandbox again)");
       const profile = path71.join(launchDir, "vpn", "server.ovpn");
-      const remotes = assertSafeOvpn(fs57.readFileSync(profile, "utf8"), vpn.server);
+      const remotes = assertSafeOvpn(fs58.readFileSync(profile, "utf8"), vpn.server);
       const exe = await ensureOpenVpn();
       const servers = await serverAddresses(remotes);
       if (servers.length === 0) throw new Error("the VPN server addresses could not be found");
-      if (killSwitch) block(servers);
+      if (killSwitch) await block2(servers);
       if (dryRun || !isWin) {
         log("(dry run) would start the VPN tunnel to " + vpn.server);
         setVpnStatus("off", "dry run");
@@ -34235,18 +34591,21 @@ async function setupVpn(secrets, ptyHostExe) {
       throw new Error("the tunnel reported it was up, but no network adapter with its address appeared");
     const publicIp = await publicAddress();
     log("VPN: up" + (publicIp ? " (the sandbox appears as " + publicIp + ")" : "") + ".");
-    setVpnStatus("up", "The tunnel is up", publicIp ? { publicIp } : {});
+    setVpnStatus("up", "The tunnel is up", {
+      ...publicIp ? { publicIp } : {},
+      ...killSwitch ? { killSwitchHeld: held } : {}
+    });
     return true;
   } catch (e) {
     const reason = errMsg(e);
     try {
-      if (killSwitch && !blocked) block([]);
+      if (killSwitch && !blocked) await block2([]);
     } catch (blockError) {
       warn("VPN: could not close the network after the failure: " + errMsg(blockError));
     }
-    const text = "VPN failed: " + reason + (killSwitch ? " The kill switch is on, so this sandbox has NO internet access." : " The kill switch is off, so this sandbox is using your normal connection.");
-    warn(text);
-    setVpnStatus("failed", reason);
+    const after = !killSwitch ? " The kill switch is off, so this sandbox is using your normal connection." : held ? " The kill switch is on, so this sandbox has NO internet access." : " The kill switch could NOT close the network, so this sandbox is ONLINE through your normal connection, without the VPN.";
+    warn("VPN failed: " + reason + after);
+    setVpnStatus("failed", reason, killSwitch ? { killSwitchHeld: held } : {});
     return false;
   }
 }
@@ -34303,10 +34662,10 @@ var FrameReader = class {
 };
 
 // src/shared/pty/client.ts
-import net3 from "node:net";
+import net4 from "node:net";
 var connectOnce = (host, port, timeoutMs) => {
   return new Promise((resolve2, reject) => {
-    const socket = net3.connect({ host, port });
+    const socket = net4.connect({ host, port });
     const timer = setTimeout(() => {
       socket.destroy();
       reject(new Error("timed out connecting to " + host + ":" + port));
@@ -34527,6 +34886,36 @@ function unfinishedSequence(data) {
   return data.length;
 }
 
+// src/shared/pty/ctrl-c.ts
+var CTRL_C_CONFIRM_MS = 1500;
+var CTRL_C_HINT = "Ctrl+C again to send it to the program (Esc stops an agent)";
+var OSC_TITLE = /\x1b\][02];([^\x07\x1b]{0,256})(?:\x07|\x1b\\)/g;
+var CtrlCGuard = class {
+  armedAt = Number.NEGATIVE_INFINITY;
+  lastTitle = "";
+  /** What to send for one read from the keyboard: a lone Ctrl+C only when another came just before. */
+  push(chunk, nowMs) {
+    if (chunk.length !== 1 || chunk[0] !== 3) return { send: chunk, held: false };
+    if (nowMs - this.armedAt <= CTRL_C_CONFIRM_MS) {
+      this.armedAt = Number.NEGATIVE_INFINITY;
+      return { send: chunk, held: false };
+    }
+    this.armedAt = nowMs;
+    return { send: Buffer.alloc(0), held: true };
+  }
+  /** Remembers the title the program last set (from its output), to put it back after the hint. */
+  watchOutput(text) {
+    for (const m of text.matchAll(OSC_TITLE)) this.lastTitle = m[1];
+  }
+  /** The escape sequence that shows the hint, and the one that puts the program's title back. */
+  hintTitle() {
+    return "\x1B]0;" + CTRL_C_HINT + "\x07";
+  }
+  restoreTitle() {
+    return "\x1B]0;" + this.lastTitle.replace(/[\x00-\x1f\x7f]/g, "") + "\x07";
+  }
+};
+
 // src/shared/pty/terminal.ts
 var MOUSE_OFF = "\x1B[?1000l\x1B[?1002l\x1B[?1003l\x1B[?1005l\x1B[?1006l\x1B[?1015l";
 function fixWindowsKeys(chunk) {
@@ -34557,6 +34946,7 @@ function runTerminalClient(socket, token, options = {}) {
       clearInterval(heartbeat);
       clearInterval(sizeWatch);
       clearTimeout(joinTimer);
+      clearTimeout(hintTimer);
       socket.destroy();
       stdout.write("\x1B[0m\x1B[?25h" + MOUSE_OFF + "\r\n");
       void (vtInput?.stop() ?? Promise.resolve()).then(() => {
@@ -34570,11 +34960,23 @@ function runTerminalClient(socket, token, options = {}) {
     const sendInput = (data) => {
       if (data.length && !done) socket.write(encodeFrame(FrameType.Input, swapKeys ? fixWindowsKeys(data) : data));
     };
+    const guard = options.confirmCtrlC ? new CtrlCGuard() : null;
+    let hintTimer;
     const onInput = (chunk) => {
       if (options.detachKey !== void 0 && chunk.includes(options.detachKey)) {
         finish({ reason: "detach" });
         return;
       }
+      if (guard) {
+        const decided = guard.push(chunk, Date.now());
+        clearTimeout(hintTimer);
+        if (decided.held) {
+          stdout.write(guard.hintTitle());
+          hintTimer = setTimeout(() => stdout.write(guard.restoreTitle()), CTRL_C_CONFIRM_MS);
+          return;
+        }
+        if (decided.send.length === 1 && decided.send[0] === 3) stdout.write(guard.restoreTitle());
+      }
       clearTimeout(joinTimer);
       sendInput(joiner.push(chunk));
       if (joiner.holding()) joinTimer = setTimeout(() => sendInput(joiner.flush()), JOIN_MS);
@@ -34607,8 +35009,11 @@ function runTerminalClient(socket, token, options = {}) {
         return;
       }
       for (const frame of frames) {
-        if (frame.type === FrameType.Output) stdout.write(filter.push(frame.payload));
-        else if (frame.type === FrameType.Console) passthrough = frame.payload.toString("latin1") === "conpty.dll";
+        if (frame.type === FrameType.Output) {
+          const out = filter.push(frame.payload);
+          guard?.watchOutput(out.toString("latin1"));
+          stdout.write(out);
+        } else if (frame.type === FrameType.Console) passthrough = frame.payload.toString("latin1") === "conpty.dll";
         else if (frame.type === FrameType.Restarting) stdout.write(MOUSE_OFF + "\x1B[2J\x1B[3J\x1B[H");
         else if (frame.type === FrameType.Exit)
           finish({ reason: "exit", exitCode: frame.payload.length >= 4 ? frame.payload.readInt32LE(0) : 1 });
@@ -34661,7 +35066,10 @@ async function viewSession(id) {
     return 1;
   }
   const socket = await connect({ ...session2.attach, addresses: ["127.0.0.1"] });
-  const result = await runTerminalClient(socket, session2.attach.token, { clipboardWrites: true });
+  const result = await runTerminalClient(socket, session2.attach.token, {
+    clipboardWrites: true,
+    confirmCtrlC: session.attach.confirmCtrlC !== false
+  });
   if (result.reason === "exit") console.log(session2.harness + " exited with code " + result.exitCode + ".");
   else if (result.reason === "error") console.log("Session error: " + result.message);
   return result.reason === "exit" ? result.exitCode : 1;
@@ -34716,7 +35124,7 @@ function saveProjectStatus(name, workspace2, phase, message, databases, summary)
 }
 
 // src/guest/runtime/secrets.ts
-import fs58 from "node:fs";
+import fs59 from "node:fs";
 
 // src/shared/channel/secrets.ts
 var Environment = external_exports.record(external_exports.string().max(256), external_exports.string().max(65536));
@@ -34732,7 +35140,9 @@ var SecretsFileSchema = external_exports.strictObject({
   /** VPN service credentials (vpn.provider's login), only for the launch's own sandbox. */
   vpn: external_exports.strictObject({ username: external_exports.string().min(1).max(256), password: external_exports.string().min(1).max(1024) }).optional(),
   /** The checked WireGuard config of vpn.provider wireguard-file (holds the private key). */
-  wireguardConfig: external_exports.string().min(1).max(32 * 1024).optional()
+  wireguardConfig: external_exports.string().min(1).max(32 * 1024).optional(),
+  /** The GitHub token you saved for sandboxes (github.shareToken), only with git access "full". */
+  githubToken: GithubTokenSchema.optional()
 });
 
 // src/guest/runtime/secrets.ts
@@ -34742,12 +35152,12 @@ function takeSecrets(id) {
   const file3 = run.secretFile(id);
   let text;
   try {
-    if (fs58.statSync(file3).size > MAX_BYTES) throw new Error("too big");
-    text = fs58.readFileSync(file3, "utf8").replace(/^\uFEFF/, "");
+    if (fs59.statSync(file3).size > MAX_BYTES) throw new Error("too big");
+    text = fs59.readFileSync(file3, "utf8").replace(/^\uFEFF/, "");
   } catch {
     return {};
   } finally {
-    fs58.rmSync(file3, { force: true });
+    fs59.rmSync(file3, { force: true });
   }
   try {
     const parsed = SecretsFileSchema.safeParse(JSON.parse(text));
@@ -34800,7 +35210,7 @@ function startDaemon(env, secrets) {
 function writeDbCommand() {
   const dir = mkdirp(path73.join(localDir, "bin"));
   const db = path73.join(path73.dirname(process.argv[1]), "db.js");
-  fs59.writeFileSync(
+  fs60.writeFileSync(
     path73.join(dir, "sbx-db.cmd"),
     '@setlocal\r\n@set AGENT_LOG_PREFIX=db\r\n@"' + process.execPath + '" "' + db + '" %*\r\n'
   );
@@ -34810,8 +35220,8 @@ function writeDbCommand() {
 function writeAgentCommands(dir) {
   const install = { node: process.execPath, script: path73.join(path73.dirname(process.argv[1]), "agent.js") };
   for (const shim3 of agentShims(toolsDir, session.agents ?? {}))
-    fs59.writeFileSync(path73.join(dir, shim3.command + ".cmd"), shimText(shim3, install));
-  fs59.writeFileSync(path73.join(dir, "sbx-agent.cmd"), sbxAgentText(install));
+    fs60.writeFileSync(path73.join(dir, shim3.command + ".cmd"), shimText(shim3, install));
+  fs60.writeFileSync(path73.join(dir, "sbx-agent.cmd"), sbxAgentText(install));
 }
 async function waitForPrimary() {
   for (let i = 0; i < PRIMARY_POLLS; i++) {
@@ -34839,12 +35249,13 @@ var Boot = class {
     log(
       "Agent sandbox: " + session.project + " | workspace " + workspace + " | agent " + session.harnessName + " | log " + logPath
     );
-    if (!fs59.statSync(workspace, { throwIfNoEntry: false })?.isDirectory())
+    if (!fs60.statSync(workspace, { throwIfNoEntry: false })?.isDirectory())
       throw new Error("Workspace folder is missing in the sandbox: " + workspace);
     mkdirp(toolsDir);
     mkdirp(run.root);
     this.secrets = takeSecrets(session.launchId);
     applyBootEnvironment(this.secrets.harnessEnvironment);
+    prepareGithubFolder(this.secrets.githubToken);
     await this.networkAndSessionHost();
     await this.hooksAndDesktop();
     const { tools, env } = await this.developerTools();
@@ -34883,6 +35294,7 @@ var Boot = class {
       databases: session.databases ?? [],
       apps: session.apps
     });
+    for (const p of networkProblems()) tools.summary.push("PROTECTION MISSING: " + p);
     if (!dryRun) tools.prepend.push(writeDbCommand());
     Object.assign(tools.vars, proxyEnv());
     await soft("Network: allow only some hosts", async () => {
@@ -34926,6 +35338,11 @@ var Boot = class {
   async gitIdentity(env) {
     step(5, "Git identity");
     await soft("Git config", () => setupGitConfig(env));
+    const token = this.secrets.githubToken;
+    if (token) {
+      this.secrets = { ...this.secrets, githubToken: void 0 };
+      await soft("GitHub token", () => loginGithub(token, env));
+    }
   }
   async claude(tools) {
     step(6, "Claude settings, history and claude-mem");
@@ -34987,7 +35404,7 @@ runBoot().catch((e) => {
   const message = errMsg(e) + (e instanceof Error && e.stack ? "\n" + e.stack : "");
   try {
     setSandboxStatus("failed", errMsg(e));
-    fs60.writeFileSync(path74.join(logsDir, "guest-error.txt"), message);
+    fs61.writeFileSync(path74.join(logsDir, "guest-error.txt"), message);
   } catch {
   }
   console.error(