windows-development-sandbox 1.9.0 → 1.11.3

package/dist/selftest/channel.test.js

@@ -3,7 +3,7 @@
 import { safeId } from '../shared/channel/index.js';
 import { GuestRequestSchema, SandboxStatusSchema, SessionStatusSchema } from '../shared/channel/index.js';
 import { bootLine, firstStartNotice, pendingDownloads, readyIn, stillWorking } from '../cli/commands/launch/index.js';
-import { encodeFrame, FrameReader, FrameType, fixWindowsKeys, helloFrame, InputJoiner, MAX_FRAME_BYTES, MOUSE_OFF, OutputFilter, } from '../shared/pty/index.js';
+import { CTRL_C_CONFIRM_MS, CTRL_C_HINT, CtrlCGuard, encodeFrame, FrameReader, FrameType, fixWindowsKeys, helloFrame, InputJoiner, MAX_FRAME_BYTES, MOUSE_OFF, OutputFilter, } from '../shared/pty/index.js';
 import { bootSilent, FIRST_STATUS_MS } from '../host/channel/index.js';
 export const channelSuite = {
     name: 'channel',
@@ -132,6 +132,23 @@ export const channelSuite = {
             hello.payload[4] === 2 &&
             hello.payload.subarray(5).toString() === 'tok', 'a frame of exactly the maximum size is accepted; a hello frame carries size, flags and token');
         t.equal(fixWindowsKeys(Buffer.from([0x61, 0x08, 0x7f, 0x1b])), Buffer.from([0x61, 0x7f, 0x08, 0x1b]), 'Windows console Backspace (^H) reaches the agent as DEL, so it deletes one character, not a word');
+        t.section('Ctrl+C meant as "copy" does not reach the agent');
+        const ctrlC = Buffer.from([3]);
+        const g = new CtrlCGuard();
+        const first = g.push(ctrlC, 1000);
+        const second = g.push(ctrlC, 1000 + CTRL_C_CONFIRM_MS - 1);
+        const third = g.push(ctrlC, 5000);
+        const late = g.push(ctrlC, 5000 + CTRL_C_CONFIRM_MS + 1);
+        t.check(first.held &&
+            first.send.length === 0 &&
+            !second.held &&
+            second.send.equals(ctrlC) &&
+            third.held &&
+            late.held &&
+            !g.push(Buffer.from('a\x03'), 6000).held &&
+            !g.push(Buffer.from('x'), 6000).held, 'a lone Ctrl+C is held back, a second one soon after is sent, a late second one is held again, other input passes');
+        g.watchOutput('\x1b]0;claude: working\x07more \x1b]2;\u0001evil\x07');
+        t.check(g.hintTitle().includes(CTRL_C_HINT) && g.restoreTitle() === '\x1b]0;evil\x07', "the hint shows in the title, and the program's last title comes back without control characters");
         t.section('typed input keeps escape sequences whole');
         const joined = (...chunks) => {
             const j = new InputJoiner();

package/dist/selftest/cli.test.js

@@ -8,7 +8,7 @@ import { COMMANDS } from '../cli/manifest.js';
 import { commandLine, readHistory, recordHistory } from '../cli/history.js';
 import { splitArgs } from '../cli/args.js';
 import { optionProblem } from '../cli/menu/index.js';
-import { cleanTargetOf } from '../cli/commands/data/collect.js';
+import { cleanTargetOf } from '../cli/services/index.js';
 import { ago, colorEnabled, shorten } from '../cli/output/index.js';
 import { versionText } from '../cli/version.js';
 import { hoistConfig, withoutConfig } from '../cli/argv.js';

package/dist/selftest/config.test.js

@@ -3,7 +3,7 @@ import path from 'node:path';
 import _ from 'lodash';
 import fs from 'node:fs';
 import { DEFAULTS, loadConfig } from '../core/config/index.js';
-import { diffText, exportSettings, planImport } from '../cli/menu/settings/index.js';
+import { diffText, exportSettings, planImport } from '../app/features/settings/settings-share.js';
 import { readJsonc } from '../core/util/index.js';
 export const configSuite = {
     name: 'config',

package/dist/selftest/contained.test.js

@@ -9,7 +9,7 @@ import { spawnSync } from 'node:child_process';
 import { assertNoGuestOverlap } from '../core/config/index.js';
 import { isWin } from '../core/util/index.js';
 import { CONTAINED_CHECKS } from '../cli/commands/repair/checks/contained.js';
-import { storageBusy } from '../cli/commands/storage/storage.js';
+import { storageBusy } from '../cli/services/index.js';
 import { generateSandbox, GUEST } from '../host/launch/index.js';
 import { currentUserSid } from '../host/sharing/index.js';
 import { addHolder, CONTAINED_FOLDERS, containedAvailability, ContainedStorage, containedMappings, containedPaths, diagnose, hostDataFolder, markMounted, mountedSets, planTransfer, providerFor, pruneHolders, removeHolder, runTransfer, ScriptDiskPort, setNameOf, setStateOf, staleMountNote, StateFile, } from '../host/storage/index.js';

package/dist/selftest/data.test.js

@@ -2,9 +2,8 @@
 // launch folders, logs and downloads are pruned.
 import fs from 'node:fs';
 import path from 'node:path';
-import { resolveCleanTargets } from '../cli/commands/data/clean.js';
-import { removeTree } from '../cli/commands/data/remove.js';
 import { findLinks } from '../cli/commands/repair/finders.js';
+import { removeTree, resolveCleanTargets } from '../cli/services/index.js';
 import { humanBytes, sizeOf } from '../core/disk.js';
 import { pruneStorage } from '../host/storage/index.js';
 export const dataSuite = {

package/dist/selftest/engine.test.js

@@ -66,7 +66,9 @@ export const engineSuite = {
         t.equal(fs.readFileSync(gen.wsbPath, 'utf8'), legacyWsb(f.baseConfig, gen.memoryMb, gen.mappings), 'the launch writes the .wsb the old writer would have (same settings, memory and mappings)');
         t.equal(path.basename(gen.wsbPath), 'agent.wsb', 'the engine file is still agent.wsb in the launch folder');
         t.equal(gen.enginePlan.entry, gen.wsbPath, 'the engine plan starts from that file');
-        t.equal(filesUnder(gen.launchPath), [...LAUNCH_FILES_GOLDEN], 'the launch folder has exactly the files it had before');
+        // home/.gitconfig is written only when this machine's ~/.gitconfig has a name or email (a GitHub runner has none).
+        const sameOnEveryMachine = (f) => f !== 'home/.gitconfig';
+        t.equal(filesUnder(gen.launchPath).filter(sameOnEveryMachine), LAUNCH_FILES_GOLDEN.filter(sameOnEveryMachine), 'the launch folder has exactly the files it had before');
         t.equal(gen.mappings.find((m) => m.guest === 'C:\\AgentData')?.host, f.baseConfig.storage.root + '\\data\\testdata', 'the data folder is still mapped at C:\\AgentData (through the folder provider)');
         t.section('capabilities');
         const caps = (over, cli) => new WindowsSandboxEngine({ ...DEFAULTS.sandbox, ...over }, () => cli).capabilities();

package/dist/selftest/github.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const githubSuite: Suite;

package/dist/selftest/github.test.js

@@ -0,0 +1,243 @@
+// The GitHub token for sandboxes: which tokens are accepted, the sealed store, when a launch hands it over (only in the
+// one-shot secrets file), the shared-core operations, the project-file rules, and the gh commands the sandbox runs.
+import fs from 'node:fs';
+import path from 'node:path';
+import { deleteGithubTokenFlow, githubPage, githubTokenRowOf, saveGithubTokenFlow, } from '../app/features/github/index.js';
+import { fakeIO } from '../app/kernel/index.js';
+import { runDefinition } from '../app/registry.js';
+import { pageLines } from '../cli/output/index.js';
+import { DEFAULTS } from '../core/config/index.js';
+import { applyOverrides, normalizeOverrides } from '../core/local-config/index.js';
+import { ConfigSchema, LocalOverridesSchema } from '../core/schema/index.js';
+import { checkGithubToken, GithubToken, githubTokenAllowed, prepareGithubToken } from '../host/github/index.js';
+import { generateSandbox } from '../host/launch/index.js';
+import { insideSandbox } from '../host/sandbox/platform.js';
+import { clearSecrets, SecretStore } from '../host/secrets/index.js';
+import { RunDir } from '../shared/channel/index.js';
+import { SecretsFileSchema } from '../shared/channel/secrets.js';
+import { ghLoginCommand, ghOutputText, ghSetupGitCommand, githubTokenProblem } from '../shared/github/index.js';
+const FINE = 'github_pat_' + 'PlantedFine0123456789'.repeat(3);
+const CLASSIC = 'ghp_' + 'PlantedClassic0123456789ab';
+const OAUTH = 'gho_' + 'PlantedOauth0123456789abcd';
+/** Every file under a folder, as text. */
+function allText(dir) {
+    const out = [];
+    const walk = (d) => {
+        for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+            const p = path.join(d, e.name);
+            if (e.isDirectory())
+                walk(p);
+            else
+                out.push(fs.readFileSync(p, 'latin1'));
+        }
+    };
+    walk(dir);
+    return out;
+}
+const message = async (work) => {
+    try {
+        await work();
+        return '';
+    }
+    catch (e) {
+        const err = e;
+        return err.message + ' ' + (err.fix ?? '');
+    }
+};
+export const githubSuite = {
+    name: 'github',
+    title: 'GitHub token: accepted tokens, sealed store, delivery only in the one-shot file, operations, gh on stdin',
+    run: async (t, f) => {
+        t.section('which tokens are accepted');
+        t.check(checkGithubToken(FINE) === 'fine-grained', 'a fine-grained token (github_pat_) is accepted');
+        t.check(checkGithubToken(CLASSIC) === 'classic', 'a classic token (ghp_) is accepted');
+        for (const [bad, why, expect] of [
+            [OAUTH, 'an OAuth token from gh auth token', 'OAuth'],
+            ['not-a-token-' + 'x'.repeat(20), 'text that is not a token', 'github_pat_'],
+            ['github_pat_ ' + 'x'.repeat(30), 'a token with a space', 'spaces'],
+            ['github_pat_\n' + 'x'.repeat(30), 'a token with a line break', 'line breaks'],
+            ['ghp_short', 'a token too short', 'length'],
+            ['github_pat_' + 'x'.repeat(300), 'a token too long', 'length'],
+        ]) {
+            const text = await message(() => checkGithubToken(bad));
+            t.check(text.includes(expect) && !text.includes(bad) && !text.includes(bad.slice(4, 24)), why + ' is refused, and the refusal does not repeat it', text);
+        }
+        t.check((githubTokenProblem(OAUTH)?.fix ?? '').includes('personal-access-tokens/new'), 'a refused OAuth token says to create a fine-grained token instead');
+        t.check(SecretsFileSchema.safeParse({ githubToken: FINE }).success &&
+            !SecretsFileSchema.safeParse({ githubToken: 'a b' }).success &&
+            !SecretsFileSchema.safeParse({ githubToken: 'x'.repeat(256) }).success, 'the secrets file holds the token with the same limits');
+        t.section('the saved token');
+        const storage = t.dir('github-storage');
+        const store = new GithubToken(storage, SecretStore.memory());
+        t.check(store.state() === 'none' && store.kind() === null, 'nothing is saved at first');
+        await t.throws(() => store.save(OAUTH), 'OAuth', 'an OAuth token is not saved');
+        t.check(store.state() === 'none', 'and nothing was written');
+        t.check(store.save(FINE) === 'fine-grained', 'a fine-grained token is saved');
+        const file = path.join(storage, 'github', 'token.json');
+        t.check(store.state() === 'saved' && store.kind() === 'fine-grained' && !fs.readFileSync(file, 'utf8').includes(FINE), 'it is saved sealed: the token is not in the file');
+        t.check(store.read() === FINE, 'and it opens for the launch');
+        fs.writeFileSync(file, fs.readFileSync(file, 'utf8').replace(/"sealed": "[^"]*"/, '"sealed": "dpapi1:AAAA"'));
+        t.check(store.state() === 'unreadable', 'a token this Windows user cannot open is reported as unreadable');
+        t.check(store.remove() && store.state() === 'none' && !store.remove(), 'logout deletes it (once)');
+        t.section('when a launch hands it over');
+        const config = f.makeConfig();
+        const tokens = new GithubToken(config.storage.root, SecretStore.memory());
+        t.check(DEFAULTS.github.shareToken === false, 'sharing is off by default');
+        t.equal(prepareGithubToken(config, config.storage.root, tokens), { notes: [] }, 'off: nothing, and nothing said');
+        config.github.shareToken = true;
+        const none = prepareGithubToken(config, config.storage.root, tokens);
+        t.check(none.token === undefined && none.notes.some((n) => n.includes('sandbox github login')), 'on without a saved token: not sent, and it says how to save one');
+        tokens.save(FINE);
+        for (const access of ['readonly', 'none']) {
+            const strict = structuredClone(config);
+            strict.provisioning.git.access = access;
+            const d = prepareGithubToken(strict, config.storage.root, tokens);
+            t.check(d.token === undefined && !githubTokenAllowed(strict) && d.notes.some((n) => n.includes('"' + access + '"')), 'git access ' + access + ': not sent, with a note why');
+        }
+        const unreadable = new GithubToken(t.dir('github-unreadable'), SecretStore.memory());
+        unreadable.save(FINE);
+        const uFile = path.join(t.at('github-unreadable'), 'github', 'token.json');
+        fs.writeFileSync(uFile, fs.readFileSync(uFile, 'utf8').replace(/"sealed": "[^"]*"/, '"sealed": "dpapi1:AAAA"'));
+        const u = prepareGithubToken(config, config.storage.root, unreadable);
+        t.check(u.token === undefined && u.notes.some((n) => n.includes('could not be read')), 'a token that cannot be decrypted is a warning, not a crash');
+        const all = prepareGithubToken(config, config.storage.root, tokens);
+        t.check(all.token === FINE && all.notes.every((n) => !n.includes(FINE)) && all.notes.some((n) => n.includes('can read')), 'all on: the token is handed over, the notes never hold it and say the agent can read it');
+        const run = await f.run({}, config);
+        clearSecrets(config.storage.root, run.dataPath);
+        const launched = generateSandbox({
+            packageRoot: t.packageRoot,
+            run,
+            harnessArgs: [],
+            probe: f.probe,
+            pcLanguages: ['python', 'rust', 'cpp', 'dotnet'],
+            githubToken: FINE,
+        });
+        const session = fs.readFileSync(launched.sessionPath, 'utf8');
+        t.check(!session.includes(FINE) && !allText(launched.launchPath).some((text) => text.includes(FINE)), 'the token is in neither session.json nor any file of the launch folder');
+        const runDir = new RunDir(run.dataPath);
+        const handed = f.readJson(runDir.secretFile(launched.launchId));
+        t.check(handed.githubToken === FINE, 'it is only in the one-shot file for the sandbox');
+        const runFolder = path.join(run.dataPath, 'run');
+        t.check(!fs.existsSync(runFolder) || !allText(runFolder).some((text) => text.includes(FINE)), 'and not in run\\');
+        clearSecrets(config.storage.root, run.dataPath);
+        const readonlyConfig = structuredClone(config);
+        readonlyConfig.provisioning.git.access = 'readonly';
+        const readonlyRun = await f.run({}, readonlyConfig);
+        const strictLaunch = generateSandbox({
+            packageRoot: t.packageRoot,
+            run: readonlyRun,
+            harnessArgs: [],
+            probe: f.probe,
+            pcLanguages: [],
+            githubToken: FINE,
+        });
+        const handedTo = (id) => fs.existsSync(runDir.secretFile(id)) ? f.readJson(runDir.secretFile(id)) : {};
+        t.check(handedTo(strictLaunch.launchId).githubToken === undefined, 'generateSandbox checks again: a readonly sandbox never gets it, whatever it was given');
+        clearSecrets(config.storage.root, run.dataPath);
+        const plain = generateSandbox({
+            packageRoot: t.packageRoot,
+            run: await f.run({ noAgent: true }, config),
+            harnessArgs: [],
+            probe: f.probe,
+            pcLanguages: [],
+            githubToken: FINE,
+        });
+        t.check(handedTo(plain.launchId).githubToken === FINE, 'a sandbox without an agent (no other secret to hand over) still gets the one-shot file with the token');
+        clearSecrets(config.storage.root, run.dataPath);
+        const strictOther = structuredClone(config);
+        strictOther.provisioning.git.access = 'readonly';
+        const others = [{ name: 'other-project', config: strictOther }];
+        const held = prepareGithubToken(config, config.storage.root, tokens, others);
+        t.check(held.token === undefined &&
+            !githubTokenAllowed(config, others) &&
+            held.notes.some((n) => n.includes('other-project')), 'another project mapped at boot with readonly git access holds the token back, and the note names it');
+        const withOther = generateSandbox({
+            packageRoot: t.packageRoot,
+            run: await f.run({ noAgent: true }, config),
+            harnessArgs: [],
+            probe: f.probe,
+            pcLanguages: [],
+            githubToken: FINE,
+            bootWants: { projects: others, keepOff: [] },
+        });
+        t.check(handedTo(withOther.launchId).githubToken === undefined, 'and generateSandbox checks the projects at boot again');
+        clearSecrets(config.storage.root, run.dataPath);
+        t.section("settings: a project's file cannot turn it on");
+        t.check(ConfigSchema.safeParse(DEFAULTS).success, 'the defaults are valid');
+        t.check(!ConfigSchema.safeParse({ ...DEFAULTS, github: { shareToken: true, token: FINE } }).success, 'there is no setting that holds a token');
+        t.check(!LocalOverridesSchema.safeParse({ github: { shareToken: true } }).success &&
+            !LocalOverridesSchema.safeParse({ github: { shareToken: false } }).success, "a project's .sandbox-config.json cannot set github at all");
+        await t.throws(() => normalizeOverrides({ github: { shareToken: true } }, f.workA, '.sandbox-config.json'), 'not valid', 'such a file is refused as invalid');
+        const mine = structuredClone(DEFAULTS);
+        t.check(applyOverrides(mine, normalizeOverrides({ readOnly: true }, f.workA, 'x')).github.shareToken === false, 'and other project settings leave it as you set it');
+        t.section('the shared-core operations');
+        const featureStore = new GithubToken(t.dir('github-feature'), SecretStore.memory());
+        const { io: loginIO, seen: loginSeen } = fakeIO([FINE]);
+        const saved = await saveGithubTokenFlow(loginIO, featureStore);
+        t.check(loginSeen.questions.length === 1 &&
+            loginSeen.questions[0].kind === 'secret' &&
+            featureStore.state() === 'saved' &&
+            loginSeen.logs.some((l) => l.text.includes('personal-access-tokens/new')) &&
+            loginSeen.logs.some((l) => l.text.includes('agent in the sandbox can read')), 'login shows the steps, asks exactly one hidden question, saves, and warns the agent can read it', JSON.stringify(loginSeen.questions));
+        t.check(!JSON.stringify(saved).includes(FINE) && !JSON.stringify(loginSeen).includes(FINE.slice(12)), 'nothing it returns or logs holds the token');
+        const { io: retryIO, seen: retrySeen } = fakeIO([OAUTH, CLASSIC]);
+        await saveGithubTokenFlow(retryIO, featureStore);
+        t.check(retrySeen.questions.length === 2 &&
+            featureStore.kind() === 'classic' &&
+            !JSON.stringify(retrySeen).includes(OAUTH.slice(4)) &&
+            retrySeen.logs.some((l) => l.text.includes('classic')), 'a refused token is asked again (the refusal never repeats it), and a classic one is saved with a warning');
+        const status = (await runDefinition('github.status', {
+            storageRoot: t.dir('github-status'),
+            dataPath: t.at('github-status', 'data'),
+            loaded: { config: { ...DEFAULTS, github: { shareToken: true } } },
+        }, {}, fakeIO().io));
+        t.check(status.shareToken && status.token === 'none' && status.kind === null, 'status reads the setting');
+        const sample = {
+            shareToken: true,
+            gitAccess: 'readonly',
+            token: 'saved',
+            kind: 'classic',
+            savedAt: '2026-10-18T10:00:00.000Z',
+        };
+        const lines = pageLines(githubPage(sample)).join('\n');
+        t.check(lines.includes('saved (encrypted)') &&
+            lines.includes('only handed over with "full"') &&
+            lines.includes('classic'), 'the status page says saved, the git access it needs, and the kind', lines);
+        t.equal(githubTokenRowOf({ ...sample, token: 'none' }).hint, 'not saved', 'the Settings row says not saved');
+        const { io: logoutIO, seen: logoutSeen } = fakeIO([true]);
+        const out = await deleteGithubTokenFlow(logoutIO, featureStore);
+        t.check(out.deleted &&
+            logoutSeen.questions.length === 1 &&
+            logoutSeen.questions[0].kind === 'confirm' &&
+            featureStore.state() === 'none', 'logout asks to confirm, then deletes');
+        const { io: noneIO, seen: noneSeen } = fakeIO();
+        t.check(!(await deleteGithubTokenFlow(noneIO, featureStore)).deleted && noneSeen.questions.length === 0, 'logout with nothing saved asks nothing');
+        const { io: inputIO, seen: inputSeen } = fakeIO();
+        await t.throws(() => runDefinition('github.login', {}, { token: FINE }, inputIO), 'does not work', 'the token is never accepted as an input');
+        t.check(inputSeen.questions.length === 0, 'a token passed on the command line asks nothing');
+        if (insideSandbox()) {
+            const { io, seen } = fakeIO();
+            await t.throws(() => runDefinition('github.login', {}, {}, io), 'inside the sandbox already', 'github login refuses inside the sandbox');
+            t.check(seen.questions.length === 0, 'and asks no question first');
+        }
+        t.section('gh in the sandbox: the token on stdin only');
+        const base = {
+            PATH: 'C:\\x',
+            GH_TOKEN: 'other',
+            github_token: 'other2',
+            GH_CONFIG_DIR: 'C:\\AgentData\\state\\gh',
+        };
+        const login = ghLoginCommand('C:\\tools\\gh.exe', 'C:\\nvm\\gh-token', FINE, base);
+        t.check(login.input === FINE + '\n' &&
+            !login.args.some((a) => a.includes(FINE)) &&
+            login.args.includes('--with-token') &&
+            !Object.values(login.env).some((v) => v.includes(FINE)), 'gh auth login gets the token on stdin, never in its arguments or environment', JSON.stringify(login.args));
+        t.check(login.env.GH_CONFIG_DIR === 'C:\\nvm\\gh-token' &&
+            !('GH_TOKEN' in login.env) &&
+            !('github_token' in login.env) &&
+            login.env.PATH === 'C:\\x', 'it uses the sandbox-only folder, and other tokens in the environment are dropped (gh would prefer them)');
+        const setup = ghSetupGitCommand('C:\\tools\\gh.exe', 'C:\\nvm\\gh-token', base);
+        t.check(setup.input === undefined && setup.args.join(' ') === 'auth setup-git --hostname github.com', 'setup-git gets nothing on stdin');
+        t.check(!ghOutputText('error: bad credentials ' + FINE, FINE).includes(FINE), 'what gh prints is logged with the token blanked out');
+    },
+};

package/dist/selftest/guest-boot.test.js

@@ -2,7 +2,10 @@
 // what it copies in, and what it refuses to.
 import fs from 'node:fs';
 import path from 'node:path';
-import { readJsonFile } from '../shared/io/index.js';
+import { spawnSync } from 'node:child_process';
+import { copyTreeTolerant, readJsonFile, robocopyErrors, robocopyFailed, robocopyMeaning } from '../shared/io/index.js';
+import { scriptArgs } from '../shared/scripts.js';
+import { SYSTEM } from '../shared/system.js';
 export const guestBootSuite = {
     name: 'guest-boot',
     title: 'guest boot in dry-run mode (provisioning, Claude state, git policy)',
@@ -92,5 +95,48 @@ export const guestBootSuite = {
         const genNoAgent = await f.launch({ noAgent: true });
         const noAgent = await f.runGuest(genNoAgent.launchPath, t.at('data5'), f.workA);
         t.check(noAgent.status === 0 && noAgent.out.includes('no agent requested'), '--no-agent provisions without an agent', noAgent.out);
+        t.section('robocopy results, vanished files, shortcuts');
+        t.check([0, 1, 2, 3, 7].every((c) => !robocopyFailed(c)) &&
+            [8, 9, 16].every((c) => robocopyFailed(c)) &&
+            robocopyFailed(null), 'robocopy: exit codes below 8 are success, 8 and up (9 = some copied, some failed) are failures');
+        t.includes(robocopyMeaning(9), 'some files were copied and some could not be', 'robocopy: exit 9 is explained');
+        t.equal(robocopyErrors('x\r\n2026/10/11 ERROR 32 (0x00000020) Copying File C:\\a\\b.dll\r\nThe process cannot access the file because it is being used by another process.\r\n', 5), [
+            '2026/10/11 ERROR 32 (0x00000020) Copying File C:\\a\\b.dll',
+            'The process cannot access the file because it is being used by another process.',
+        ], 'robocopy: the failing file and the reason are picked out of its output');
+        const spool = t.dir('copy-tree', 'live');
+        t.write(path.join(spool, 'a.json'), '1');
+        t.write(path.join(spool, 'b.json'), '2');
+        t.write(path.join(spool, 'db', 'chroma.sqlite3'), 'db');
+        t.write(path.join(spool, 'db', 'chroma.sqlite3-journal'), 'j');
+        t.write(path.join(spool, 'x.lock'), 'l');
+        const copied = copyTreeTolerant(spool, t.at('copy-tree', 'out'), (name) => /\.lock$|-journal$/.test(name));
+        t.check(copied.copied === 3 && !fs.existsSync(t.at('copy-tree', 'out', 'db', 'chroma.sqlite3-journal')), 'copy tree: files are copied, a -journal and a lock file are left out');
+        // The first file of the listing deletes the second before it is reached: the second has vanished, not failed.
+        const racing = t.dir('copy-tree', 'racing');
+        t.write(path.join(racing, 'a.json'), '1');
+        t.write(path.join(racing, 'b.json'), '2');
+        const result = copyTreeTolerant(racing, t.at('copy-tree', 'racing-out'), (name) => {
+            if (name === 'a.json')
+                fs.rmSync(path.join(racing, 'b.json'), { force: true });
+            return false;
+        });
+        t.check(result.copied === 1 && result.vanished === 1, 'copy tree: a file that vanishes during the copy is skipped, not an error');
+        t.equal(copyTreeTolerant(t.at('copy-tree', 'nothing'), t.at('copy-tree', 'nothing-out')).vanished, 1, 'copy tree: a missing folder is tolerated');
+        if (process.platform === 'win32') {
+            // Windows PowerShell 5.1 hands a JSON array over as one object: two or more shortcuts used to fail.
+            const out = t.dir('shortcuts');
+            const list = t.writeJson(path.join(out, 'in.json'), [
+                { link: path.join(out, 'one', 'A.lnk'), target: path.join(process.env.WINDIR ?? 'C:\\Windows', 'notepad.exe') },
+                { link: path.join(out, 'two', 'B.lnk'), target: path.join(process.env.WINDIR ?? 'C:\\Windows', 'notepad.exe') },
+            ]);
+            const made = spawnSync(SYSTEM.powershell(), scriptArgs('new-shortcuts.ps1', ['-ListFile', list]), {
+                encoding: 'utf8',
+                windowsHide: true,
+            });
+            t.check(made.status === 0 &&
+                fs.existsSync(path.join(out, 'one', 'A.lnk')) &&
+                fs.existsSync(path.join(out, 'two', 'B.lnk')), 'new-shortcuts.ps1 makes every shortcut of a list of two', String(made.stderr));
+        }
     },
 };

package/dist/selftest/hcs.test.js

@@ -4,13 +4,15 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { cleanEngineRun, engineLeftoversRun } from '../app/features/engine/index.js';
+import { fakeIO } from '../app/kernel/index.js';
 import { DEFAULTS } from '../core/config/index.js';
 import { isWin } from '../core/util/index.js';
 import { HCS_CHECKS, HCS_PROBES } from '../cli/commands/repair/checks/hcs.js';
-import { checkHcs, engineFor, HCS_CAPABILITIES, HcsEngine, openEngine, } from '../host/engines/index.js';
+import { checkHcs, engineFor, HCS_CAPABILITIES, HcsEngine, LEFTOVER_DEPS, lookForLeftovers, openEngine, stopLeftovers, } from '../host/engines/index.js';
 import { parseWhoamiGroups } from '../host/engines/hcs/check.js';
 import { buildDocuments, cpuCount, layerGuid } from '../host/engines/hcs/documents.js';
-import { HcsHelper, HcsReplySchema, buildHcsHostTo } from '../host/engines/hcs/helper.js';
+import { HcsHelper, HcsReplySchema, buildHcsHostTo, userSystemPrefix, } from '../host/engines/hcs/helper.js';
 import { chainIds, DockerImageStore, FolderImageStore } from '../host/engines/hcs/images.js';
 import { SYSTEM } from '../shared/system.js';
 import { fakeProbes, FAKE_IMAGE } from './support/hcs-probes.js';
@@ -378,16 +380,18 @@ export const hcsSuite = {
         });
         for (const file of plan.files)
             t.write(file.path, file.text);
+        const mineId = userSystemPrefix() + '1';
         const running = await live.start(plan);
         t.equal(log, [
-            'grant-vm-access agent-sandbox-1 C:\\S\\images\\set.vhdx',
-            'grant-vm-access agent-sandbox-1 ' + path.join(launch.launchPath, 'hcs', 'scratch.vhdx'),
+            'grant-vm-access ' + mineId + ' C:\\S\\images\\set.vhdx',
+            'grant-vm-access ' + mineId + ' ' + path.join(launch.launchPath, 'hcs', 'scratch.vhdx'),
             'create <request>',
-            'start agent-sandbox-1',
+            'start ' + mineId,
             'create <request>',
-            'start agent-sandbox-1-c',
+            'start ' + mineId + '-c',
         ], 'disks get access, the utility VM is created and started, then the container');
-        t.check(running.id === 'agent-sandbox-1' && running.engine === 'hcs', 'start() reports the sandbox');
+        t.check(running.id === mineId && running.engine === 'hcs', 'start() reports the sandbox');
+        t.check(mineId !== userSystemPrefix('someone-else', 'PC') + '1', "the id carries this Windows user's tag (another user's sandbox of the same name gets another id)");
         t.section('the helper: private temp folder, checked answers');
         const tempRoot = t.dir('hcs-helper-checks');
         const answers = [];
@@ -416,6 +420,99 @@ export const hcsSuite = {
         HCS_PROBES.current = null;
         t.check(finding.status === 'needs-you' && /docker pull/.test(finding.fix ?? ''), 'the row says what is missing and the command, and repair has no automatic fix for it');
         t.check(row.fix === undefined, 'repair never fixes HCS prerequisites (they change Windows)');
+        t.section('HCS systems left running: only ours are listed and stopped (fake helper)');
+        const mine = userSystemPrefix() + '1';
+        const theirs = userSystemPrefix('someone-else', 'PC') + '1';
+        const systems = [
+            {
+                Id: mine,
+                SystemType: 'VirtualMachine',
+                Owner: 'agent-sandbox',
+                State: 'Running',
+                CreateTimestamp: '2026-01-01T10:00:00Z',
+            },
+            { Id: mine + '-c', SystemType: 'Container', Owner: 'agent-sandbox', State: 'Running' },
+            { Id: theirs, SystemType: 'VirtualMachine', Owner: 'agent-sandbox', State: 'Running' },
+            { Id: 'WindowsSandbox-9', SystemType: 'VirtualMachine', Owner: 'agent-sandbox', State: 'Running' },
+            { Id: 'agent-sandbox-evil', SystemType: 'VirtualMachine', Owner: 'docker', State: 'Running' },
+            { Id: 'docker-1', SystemType: 'Container', Owner: 'docker', State: 'Running' },
+        ];
+        const calls = [];
+        let present = [...systems];
+        const leftoverRun = (_exe, args) => {
+            const verb = args[0];
+            calls.push(args.slice(0, args.indexOf('--out')).join(' '));
+            if (verb === 'terminate')
+                present = present.filter((s) => s.Id !== args[1]);
+            const json = verb === 'enumerate' ? JSON.stringify(present) : '';
+            fs.writeFileSync(args[args.indexOf('--out') + 1], JSON.stringify({ ok: true, hresult: '0x0', message: 'ok', json, values: {} }), 'utf8');
+            return { status: 0 };
+        };
+        const leftoverTemp = t.dir('hcs-leftovers-temp');
+        const helperCalls = [];
+        const useLeftovers = (probes = fakeProbes()) => {
+            LEFTOVER_DEPS.current = {
+                probes,
+                helper: () => {
+                    helperCalls.push(true);
+                    return new HcsHelper(() => 'C:\\fake\\HcsHost.exe', leftoverRun, leftoverTemp);
+                },
+            };
+        };
+        const ctx = { loaded: { config: hcsConfig } };
+        try {
+            useLeftovers();
+            const look = lookForLeftovers('C:\\S');
+            t.check(look.available &&
+                look.systems.map((s) => s.id).join() === mine + ',' + mine + '-c' &&
+                look.systems[0].kind === 'VirtualMachine' &&
+                look.systems[0].since === '2026-01-01T10:00:00Z' &&
+                look.systems[1].since === null, "only systems with our Owner and this user's id prefix are listed (not another user's, Windows Sandbox, Docker, or a foreign owner)", JSON.stringify(look));
+            const query = await engineLeftoversRun.run(ctx, {}, fakeIO().io);
+            t.check(query.available && query.systems.length === 2 && /2 HCS systems/.test(query.message), 'engine.leftovers returns them with a plain message');
+            calls.length = 0;
+            const outcome = stopLeftovers('C:\\S', [mine, mine + '-c', theirs, 'WindowsSandbox-9', 'docker-1', '--evil']);
+            t.equal(calls.filter((c) => c.startsWith('terminate')), ['terminate ' + mine + '-c', 'terminate ' + mine], 'only ours reach terminate, the container before its utility VM');
+            t.check(outcome.filter((o) => o.stopped).length === 2 && outcome.filter((o) => !o.stopped).length === 4, 'ids that are not ours (or not running) are reported, never terminated');
+            present = [...systems];
+            calls.length = 0;
+            const declined = fakeIO([false]);
+            await t.throws(() => cleanEngineRun.run(ctx, {}, declined.io), 'Nothing changed', 'declining the question stops cleanly');
+            t.check(!calls.some((c) => c.startsWith('terminate')), 'declining terminates nothing');
+            calls.length = 0;
+            const yes = fakeIO([true]);
+            const cleaned = await cleanEngineRun.run(ctx, {}, yes.io);
+            t.check(cleaned.stopped === 2 &&
+                cleaned.failed === 0 &&
+                yes.seen.questions.length === 1 &&
+                yes.seen.questions[0].kind === 'confirm' &&
+                calls.filter((c) => c.startsWith('terminate')).length === 2, 'engine.clean asks once, then stops what is ours');
+            const again = await cleanEngineRun.run(ctx, {}, fakeIO().io);
+            t.check(again.stopped === 0 && /Nothing to clean/.test(again.message), 'with none left it asks nothing and says so');
+            calls.length = 0;
+            helperCalls.length = 0;
+            useLeftovers(fakeProbes({ computecore: false }));
+            const missing = await cleanEngineRun.run(ctx, {}, fakeIO().io);
+            t.check(!missing.available && /not on this PC/.test(missing.message) && calls.length === 0 && helperCalls.length === 0, 'HCS missing: a plain message, the helper is never started, nothing to clean');
+            t.section('doctor row: HCS systems left running');
+            present = [...systems];
+            useLeftovers();
+            const leftoverRow = HCS_CHECKS[1];
+            t.check(leftoverRow.name === 'HCS systems left running' &&
+                leftoverRow.applies?.(rowEnv(f.baseConfig)) === true &&
+                helperCalls.every(Boolean), 'shown on any engine when one of ours is found, and the doctor never builds HcsHost.exe to look');
+            const warn = await leftoverRow.run(rowEnv(f.baseConfig));
+            t.check(warn.status === 'warn' && warn.fix === 'sandbox engine clean' && warn.detail.includes(mine), 'a warning with the fix "sandbox engine clean"');
+            present = [];
+            t.check(leftoverRow.applies?.(rowEnv(f.baseConfig)) === false &&
+                leftoverRow.applies?.(rowEnv(hcsConfig)) === true &&
+                (await leftoverRow.run(rowEnv(hcsConfig))).status === 'ok', 'hidden when none is left (unless the engine is hcs, where it says none is running)');
+            useLeftovers(fakeProbes({ computecore: false }));
+            t.check(leftoverRow.applies?.(rowEnv(f.baseConfig)) === false, 'hidden on a PC without HCS');
+        }
+        finally {
+            LEFTOVER_DEPS.current = null;
+        }
         t.section('sandbox engine check hcs');
         const out = await f.runBin('agent-sandbox', ['engine', 'check', 'hcs', '--config', t.writeJson(t.at('hcs-config.json'), {})], {
             cwd: f.workA,
@@ -425,7 +522,7 @@ export const hcsSuite = {
             (out.status === 0 || out.out.includes('To fix:')), 'the command prints the check in plain words with the fixes', out.out);
         t.check(DEFAULTS.sandbox.engine === 'windows-sandbox', 'the default engine is unchanged');
         t.section("documents against Microsoft's published HCS schema (Windows 11 21H2 and Windows 10 1809)");
-        const schemaDir = path.join(t.packageRoot, 'test-fixtures', 'hcs-schema');
+        const schemaDir = path.join(t.packageRoot, 'src', 'selftest', 'fixtures', 'hcs-schema');
         if (!fs.existsSync(schemaDir)) {
             t.check(true, 'skipped: the schema fixtures are only in the repository');
         }