windows-development-sandbox 1.9.0 → 1.11.3

package/dist/shared/io/index.js

@@ -1,3 +1,5 @@
 export * from './json.js';
 export * from './json-file.js';
 export * from './safe-remove.js';
+export * from './robocopy-result.js';
+export * from './copy-tree.js';

package/dist/shared/io/robocopy-result.d.ts

@@ -0,0 +1,6 @@
+/** Exit code 8 and up means something could not be copied; below that every file is in place. */
+export declare function robocopyFailed(code: number | null): boolean;
+/** The exit code in plain words (it is a bit field: 1 copied, 2 extras, 4 mismatches, 8 failures, 16 fatal). */
+export declare function robocopyMeaning(code: number | null): string;
+/** The first few ERROR lines of robocopy's output (what went wrong and on which file), one line each. */
+export declare function robocopyErrors(output: string, max?: number): string[];

package/dist/shared/io/robocopy-result.js

@@ -0,0 +1,23 @@
+// Reading robocopy's exit code and output (pure; the guest and the tests share it).
+/** Exit code 8 and up means something could not be copied; below that every file is in place. */
+export function robocopyFailed(code) {
+    return code === null || code >= 8;
+}
+/** The exit code in plain words (it is a bit field: 1 copied, 2 extras, 4 mismatches, 8 failures, 16 fatal). */
+export function robocopyMeaning(code) {
+    if (code === null)
+        return 'robocopy did not finish';
+    if (code >= 16)
+        return 'robocopy stopped with a fatal error (bad path or no access)';
+    if (code >= 8)
+        return code & 1 ? 'some files were copied and some could not be' : 'files could not be copied';
+    return code === 0 ? 'nothing to copy' : 'copied';
+}
+/** The first few ERROR lines of robocopy's output (what went wrong and on which file), one line each. */
+export function robocopyErrors(output, max = 3) {
+    const lines = output
+        .split(/\r?\n/)
+        .map((l) => l.trim())
+        .filter((l) => /\bERROR\b/.test(l) || /^The (process|system) cannot/i.test(l));
+    return lines.slice(0, max).map((l) => (l.length > 220 ? l.slice(0, 217) + '...' : l));
+}

package/dist/shared/memory/policy.d.ts

@@ -1,16 +1,27 @@
 export type LoadProfile = 'normal' | 'gentle';
-/** The guest governor: when memory inside the sandbox counts as under pressure, and when it has recovered. */
-export interface GuestThresholds {
-    /** Pressure starts when available RAM is below this share of the sandbox's RAM (percent)... */
-    readonly enterAvailablePercent: number;
-    /** ...or commit is above this share of its limit. */
-    readonly enterCommitPercent: number;
-    /** Pressure ends only when available RAM is above this and commit is below the next, for `calmSamples` in a row. */
-    readonly exitAvailablePercent: number;
-    readonly exitCommitPercent: number;
-    readonly calmSamples: number;
+/**
+ * One step of the guest governor's dial. It turns up when available RAM falls below `availablePercent` of the
+ * sandbox's RAM, commit rises above `commitPercent` of its limit, or (from step 3) the commit would reach its limit
+ * within `secondsToLimit` at the rate it is growing. It turns down one step after `calmSamples` samples in a row that
+ * are clear of the step by the margins below.
+ */
+export interface DialStep {
+    readonly availablePercent: number;
+    readonly commitPercent: number;
+    readonly secondsToLimit?: number;
 }
-export declare const GUEST_THRESHOLDS: Readonly<Record<LoadProfile, GuestThresholds>>;
+/** Steps 1 to 4 of the dial, per profile (index 0 is step 1). The gentle profile (vGPU on) turns earlier. */
+export declare const DIAL_STEPS: Readonly<Record<LoadProfile, readonly DialStep[]>>;
+/** How clear of a step a sample must be to count as calm: this much more RAM free and this much less commit. */
+export declare const DIAL_EXIT_MARGIN: {
+    readonly availablePercent: 5;
+    readonly commitPercent: 4;
+};
+export declare const DIAL_CALM_SAMPLES = 3;
+/** The CPU share (percent of the sandbox) the compilers get together at each step; 100 = no cap. */
+export declare const DIAL_CPU_RATE: readonly number[];
+/** How many of the compilers running may go on at each step (the rest wait their turn), as a share of them. */
+export declare function compilersAllowed(step: number, running: number): number;
 /** The PC watchdog: when this PC itself is low. */
 export interface HostThresholds {
     /** Low when available RAM is below max(this, availableShare of total RAM)... */
@@ -23,11 +34,26 @@ export interface HostThresholds {
     /** Total CPU above this (percent) for cpuSeconds. */
     readonly cpuPercent: number;
     readonly cpuSeconds: number;
+    /** The disks' queue length (all together) at or above this for diskSeconds: builds writing through mapped folders. */
+    readonly diskQueue: number;
+    readonly diskSeconds: number;
 }
 export declare const HOST_THRESHOLDS: Readonly<Record<LoadProfile, HostThresholds>>;
 /** The CPU cap (percent of the PC) the gentle profile uses: 15 points lower, never below 50. "none" = 100. */
 export declare function gentleCpuLimit(cpuLimit: 'none' | number): number;
 /** The CPU cap the sandbox runs with (percent; null = none) for a profile. */
 export declare function effectiveCpuLimit(cpuLimit: 'none' | number, profile: LoadProfile): number | null;
-/** Cargo jobs that fit the memory (about 4 GB per rustc) and the CPUs, fewer when several agent sessions build. */
+/**
+ * The build budget of the whole sandbox: how many compile jobs fit together (about 3 GB each after 6 GB for Windows,
+ * the agents and their tools), never more than the processors the sandbox may use. The governor slows them down when
+ * memory runs short anyway; this keeps builds from starting far more than fits.
+ */
+export declare function buildJobs(cpus: number, memoryGb: number): number;
+/** Links that may run at once in the whole sandbox ("auto"): one per 3 GB after 6 GB, 2 to 8. */
+export declare function linkSlotsFor(memoryGb: number): number;
+/** The processors the sandbox's programs may use with a CPU cap of `percent` (affinity): at least 2. */
+export declare function usableCpus(cpus: number, percent: number | null): number;
+/** Cargo jobs for one more agent session: what fits the memory and CPUs, shared with the sessions already building. */
 export declare function cargoJobs(cpus: number, memoryGb: number, sessions: number): number;
+/** The most heavy compilers (rustc, clippy-driver, link ...) that run at once in the agents' job: only with vGPU on. */
+export declare function maxCompilers(cpus: number, profile: LoadProfile): number | null;

package/dist/shared/memory/policy.js

@@ -1,22 +1,36 @@
 // What "heavy load" means, decided once for the host watchdog and the guest governor (pure, no I/O). Every
 // protection is on by default; the gentle profile (vGPU on: a graphics driver hang can freeze the whole PC) triggers
 // earlier and runs the sandbox with less CPU.
-export const GUEST_THRESHOLDS = {
-    normal: {
-        enterAvailablePercent: 8,
-        enterCommitPercent: 92,
-        exitAvailablePercent: 12,
-        exitCommitPercent: 88,
-        calmSamples: 3,
-    },
-    gentle: {
-        enterAvailablePercent: 15,
-        enterCommitPercent: 85,
-        exitAvailablePercent: 20,
-        exitCommitPercent: 80,
-        calmSamples: 3,
-    },
+/** Steps 1 to 4 of the dial, per profile (index 0 is step 1). The gentle profile (vGPU on) turns earlier. */
+export const DIAL_STEPS = {
+    normal: [
+        { availablePercent: 15, commitPercent: 80 },
+        { availablePercent: 10, commitPercent: 88 },
+        { availablePercent: 6, commitPercent: 94, secondsToLimit: 20 },
+        { availablePercent: 4, commitPercent: 97, secondsToLimit: 8 },
+    ],
+    gentle: [
+        { availablePercent: 20, commitPercent: 75 },
+        { availablePercent: 15, commitPercent: 85 },
+        { availablePercent: 8, commitPercent: 92, secondsToLimit: 25 },
+        { availablePercent: 5, commitPercent: 96, secondsToLimit: 10 },
+    ],
 };
+/** How clear of a step a sample must be to count as calm: this much more RAM free and this much less commit. */
+export const DIAL_EXIT_MARGIN = { availablePercent: 5, commitPercent: 4 };
+export const DIAL_CALM_SAMPLES = 3;
+/** The CPU share (percent of the sandbox) the compilers get together at each step; 100 = no cap. */
+export const DIAL_CPU_RATE = [100, 100, 60, 35, 15];
+/** How many of the compilers running may go on at each step (the rest wait their turn), as a share of them. */
+export function compilersAllowed(step, running) {
+    if (step <= 1 || running <= 1)
+        return running;
+    if (step === 2)
+        return Math.max(1, Math.ceil(running * 0.6));
+    if (step === 3)
+        return Math.max(1, Math.ceil(running / 3));
+    return 1;
+}
 export const HOST_THRESHOLDS = {
     normal: {
         availableMinMb: 4096,
@@ -25,6 +39,8 @@ export const HOST_THRESHOLDS = {
         calmSamples: 3,
         cpuPercent: 95,
         cpuSeconds: 60,
+        diskQueue: 32,
+        diskSeconds: 40,
     },
     gentle: {
         availableMinMb: 6144,
@@ -33,6 +49,8 @@ export const HOST_THRESHOLDS = {
         calmSamples: 3,
         cpuPercent: 90,
         cpuSeconds: 45,
+        diskQueue: 16,
+        diskSeconds: 30,
     },
 };
 /** The CPU cap (percent of the PC) the gentle profile uses: 15 points lower, never below 50. "none" = 100. */
@@ -45,11 +63,32 @@ export function effectiveCpuLimit(cpuLimit, profile) {
         return Math.min(gentleCpuLimit(cpuLimit), cpuLimit === 'none' ? 100 : cpuLimit);
     return cpuLimit === 'none' ? null : cpuLimit;
 }
-/** Cargo jobs that fit the memory (about 4 GB per rustc) and the CPUs, fewer when several agent sessions build. */
+/**
+ * The build budget of the whole sandbox: how many compile jobs fit together (about 3 GB each after 6 GB for Windows,
+ * the agents and their tools), never more than the processors the sandbox may use. The governor slows them down when
+ * memory runs short anyway; this keeps builds from starting far more than fits.
+ */
+export function buildJobs(cpus, memoryGb) {
+    return Math.max(2, Math.min(cpus, Math.floor((memoryGb - 6) / 3)));
+}
+/** Links that may run at once in the whole sandbox ("auto"): one per 3 GB after 6 GB, 2 to 8. */
+export function linkSlotsFor(memoryGb) {
+    return Math.max(2, Math.min(8, Math.floor((memoryGb - 6) / 3)));
+}
+/** The processors the sandbox's programs may use with a CPU cap of `percent` (affinity): at least 2. */
+export function usableCpus(cpus, percent) {
+    if (percent === null || percent >= 100)
+        return cpus;
+    return Math.max(2, Math.min(cpus, Math.floor((cpus * percent) / 100)));
+}
+/** Cargo jobs for one more agent session: what fits the memory and CPUs, shared with the sessions already building. */
 export function cargoJobs(cpus, memoryGb, sessions) {
-    const byCpu = Math.max(2, Math.min(4, Math.floor(cpus / 4)));
+    const byCpu = Math.max(2, Math.min(8, Math.floor(cpus / 4)));
     const byMemory = Math.max(1, Math.floor(memoryGb / 4));
     const jobs = Math.min(byCpu, byMemory);
-    // All the agents' builds share the sandbox: about 8 jobs in total however many sessions there are.
-    return Math.max(1, Math.min(jobs, Math.floor(8 / Math.max(1, sessions))));
+    return Math.max(1, Math.min(jobs, Math.floor(buildJobs(cpus, memoryGb) / Math.max(1, sessions))));
+}
+/** The most heavy compilers (rustc, clippy-driver, link ...) that run at once in the agents' job: only with vGPU on. */
+export function maxCompilers(cpus, profile) {
+    return profile === 'gentle' ? Math.max(2, Math.floor(cpus / 4)) : null;
 }

package/dist/shared/network/firewall-rules.d.ts

@@ -22,3 +22,11 @@ export declare function parseDnsServers(ipconfigAll: string): string[];
  * keeps working.
  */
 export declare function buildFirewallCommands(exemptIps: string[]): string[][];
+export declare const ATTACH_RULE = "AgentSandbox-Attach";
+/**
+ * True when a Windows path has an 8.3 short name in it (`C:\Users\WDAGUT~1\...`). netsh refuses `program=` paths
+ * like that ("The application name could not be resolved"), so they are expanded first.
+ */
+export declare function hasShortName(file: string): boolean;
+/** Inbound rule for ptyhost only, and only from the sandbox's own subnet (where the host's Hyper-V adapter is). */
+export declare function attachRuleCommands(ptyHostExe: string): string[][];

package/dist/shared/network/firewall-rules.js

@@ -135,3 +135,31 @@ export function buildFirewallCommands(exemptIps) {
     }
     return commands;
 }
+export const ATTACH_RULE = 'AgentSandbox-Attach';
+/**
+ * True when a Windows path has an 8.3 short name in it (`C:\Users\WDAGUT~1\...`). netsh refuses `program=` paths
+ * like that ("The application name could not be resolved"), so they are expanded first.
+ */
+export function hasShortName(file) {
+    return file.split(/[/\\]/).some((part) => /~\d/.test(part));
+}
+/** Inbound rule for ptyhost only, and only from the sandbox's own subnet (where the host's Hyper-V adapter is). */
+export function attachRuleCommands(ptyHostExe) {
+    return [
+        ['advfirewall', 'firewall', 'delete', 'rule', 'name=' + ATTACH_RULE],
+        [
+            'advfirewall',
+            'firewall',
+            'add',
+            'rule',
+            'name=' + ATTACH_RULE,
+            'dir=in',
+            'action=allow',
+            'enable=yes',
+            'profile=any',
+            'protocol=tcp',
+            'remoteip=LocalSubnet',
+            'program=' + ptyHostExe,
+        ],
+    ];
+}

package/dist/shared/pty/ctrl-c.d.ts

@@ -0,0 +1,18 @@
+/** A second Ctrl+C within this long sends it. */
+export declare const CTRL_C_CONFIRM_MS = 1500;
+/** What the title shows while a Ctrl+C is held back. */
+export declare const CTRL_C_HINT = "Ctrl+C again to send it to the program (Esc stops an agent)";
+export declare class CtrlCGuard {
+    private armedAt;
+    private lastTitle;
+    /** What to send for one read from the keyboard: a lone Ctrl+C only when another came just before. */
+    push(chunk: Buffer, nowMs: number): {
+        send: Buffer;
+        held: boolean;
+    };
+    /** Remembers the title the program last set (from its output), to put it back after the hint. */
+    watchOutput(text: string): void;
+    /** The escape sequence that shows the hint, and the one that puts the program's title back. */
+    hintTitle(): string;
+    restoreTitle(): string;
+}

package/dist/shared/pty/ctrl-c.js

@@ -0,0 +1,36 @@
+// A lone Ctrl+C is easy to send by accident: it is "copy" everywhere else, and a terminal sends it to the program when
+// the selection it was meant for has just been cleared by a redraw (an agent's spinner redraws all the time). With
+// attach.confirmCtrlC the terminal client holds a lone Ctrl+C back until it is pressed again within a moment; Esc still
+// stops an agent at once. Pure, so it is tested without a terminal.
+/** A second Ctrl+C within this long sends it. */
+export const CTRL_C_CONFIRM_MS = 1500;
+/** What the title shows while a Ctrl+C is held back. */
+export const CTRL_C_HINT = 'Ctrl+C again to send it to the program (Esc stops an agent)';
+const OSC_TITLE = /\x1b\][02];([^\x07\x1b]{0,256})(?:\x07|\x1b\\)/g;
+export class CtrlCGuard {
+    armedAt = Number.NEGATIVE_INFINITY;
+    lastTitle = '';
+    /** What to send for one read from the keyboard: a lone Ctrl+C only when another came just before. */
+    push(chunk, nowMs) {
+        if (chunk.length !== 1 || chunk[0] !== 0x03)
+            return { send: chunk, held: false };
+        if (nowMs - this.armedAt <= CTRL_C_CONFIRM_MS) {
+            this.armedAt = Number.NEGATIVE_INFINITY;
+            return { send: chunk, held: false };
+        }
+        this.armedAt = nowMs;
+        return { send: Buffer.alloc(0), held: true };
+    }
+    /** Remembers the title the program last set (from its output), to put it back after the hint. */
+    watchOutput(text) {
+        for (const m of text.matchAll(OSC_TITLE))
+            this.lastTitle = m[1];
+    }
+    /** The escape sequence that shows the hint, and the one that puts the program's title back. */
+    hintTitle() {
+        return '\x1b]0;' + CTRL_C_HINT + '\x07';
+    }
+    restoreTitle() {
+        return '\x1b]0;' + this.lastTitle.replace(/[\x00-\x1f\x7f]/g, '') + '\x07';
+    }
+}

package/dist/shared/pty/index.d.ts

@@ -2,5 +2,6 @@ export { FrameType, HelloFlag, PING_INTERVAL_MS, type Frame, DETACH_KEY, encodeF
 export { type Endpoint, connect, sendControl, type Viewers, queryViewers } from './client.js';
 export { type ClientResult, MOUSE_OFF, fixWindowsKeys, runTerminalClient } from './terminal.js';
 export { JOIN_MS, InputJoiner } from './input-joiner.js';
+export { CTRL_C_CONFIRM_MS, CTRL_C_HINT, CtrlCGuard } from './ctrl-c.js';
 export { type VtInput, enableVtInput } from './console-input.js';
 export { OutputFilter } from './output-filter.js';

package/dist/shared/pty/index.js

@@ -2,5 +2,6 @@ export { FrameType, HelloFlag, PING_INTERVAL_MS, DETACH_KEY, encodeFrame, helloF
 export { connect, sendControl, queryViewers } from './client.js';
 export { MOUSE_OFF, fixWindowsKeys, runTerminalClient } from './terminal.js';
 export { JOIN_MS, InputJoiner } from './input-joiner.js';
+export { CTRL_C_CONFIRM_MS, CTRL_C_HINT, CtrlCGuard } from './ctrl-c.js';
 export { enableVtInput } from './console-input.js';
 export { OutputFilter } from './output-filter.js';

package/dist/shared/pty/terminal.d.ts

@@ -24,7 +24,9 @@ export declare function fixWindowsKeys(chunk: Buffer): Buffer;
  */
 export declare function runTerminalClient(socket: net.Socket, token: string, 
 /** clipboardWrites: the agent's "copy" (OSC 52) reaches the clipboard; see OutputFilterOptions. */
+/** confirmCtrlC: a lone Ctrl+C is held back until it is pressed again (CtrlCGuard, attach.confirmCtrlC). */
 options?: {
     detachKey?: number;
     clipboardWrites?: boolean;
+    confirmCtrlC?: boolean;
 }): Promise<ClientResult>;

package/dist/shared/pty/terminal.js

@@ -2,6 +2,7 @@ import { FrameReader, encodeFrame, FrameType, resizeFrame, PING_INTERVAL_MS, hel
 import { OutputFilter } from './output-filter.js';
 import { enableVtInput } from './console-input.js';
 import { InputJoiner, JOIN_MS } from './input-joiner.js';
+import { CTRL_C_CONFIRM_MS, CtrlCGuard } from './ctrl-c.js';
 /**
  * Turns off every mouse tracking mode a program may have turned on in your terminal (normal, button, any, UTF-8, SGR,
  * urxvt).
@@ -22,6 +23,7 @@ export function fixWindowsKeys(chunk) {
  */
 export function runTerminalClient(socket, token, 
 /** clipboardWrites: the agent's "copy" (OSC 52) reaches the clipboard; see OutputFilterOptions. */
+/** confirmCtrlC: a lone Ctrl+C is held back until it is pressed again (CtrlCGuard, attach.confirmCtrlC). */
 options = {}) {
     const stdin = process.stdin;
     const stdout = process.stdout;
@@ -51,6 +53,7 @@ options = {}) {
             clearInterval(heartbeat);
             clearInterval(sizeWatch);
             clearTimeout(joinTimer);
+            clearTimeout(hintTimer);
             socket.destroy();
             // The agent's mouse tracking ends with it: your terminal's wheel scrolls again (and clicks select text).
             stdout.write('\x1b[0m\x1b[?25h' + MOUSE_OFF + '\r\n');
@@ -68,11 +71,24 @@ options = {}) {
             if (data.length && !done)
                 socket.write(encodeFrame(FrameType.Input, swapKeys ? fixWindowsKeys(data) : data));
         };
+        const guard = options.confirmCtrlC ? new CtrlCGuard() : null;
+        let hintTimer;
         const onInput = (chunk) => {
             if (options.detachKey !== undefined && chunk.includes(options.detachKey)) {
                 finish({ reason: 'detach' });
                 return;
             }
+            if (guard) {
+                const decided = guard.push(chunk, Date.now());
+                clearTimeout(hintTimer);
+                if (decided.held) {
+                    stdout.write(guard.hintTitle());
+                    hintTimer = setTimeout(() => stdout.write(guard.restoreTitle()), CTRL_C_CONFIRM_MS);
+                    return;
+                }
+                if (decided.send.length === 1 && decided.send[0] === 0x03)
+                    stdout.write(guard.restoreTitle());
+            }
             clearTimeout(joinTimer);
             sendInput(joiner.push(chunk));
             // A lone Esc key press is a "sequence" that never completes: send it after a moment.
@@ -116,8 +132,11 @@ options = {}) {
                 return;
             }
             for (const frame of frames) {
-                if (frame.type === FrameType.Output)
-                    stdout.write(filter.push(frame.payload));
+                if (frame.type === FrameType.Output) {
+                    const out = filter.push(frame.payload);
+                    guard?.watchOutput(out.toString('latin1'));
+                    stdout.write(out);
+                }
                 else if (frame.type === FrameType.Console)
                     passthrough = frame.payload.toString('latin1') === 'conpty.dll';
                 else if (frame.type === FrameType.Restarting)

package/dist/shared/vpn/kill-switch.d.ts

@@ -6,11 +6,22 @@ export interface KillSwitchServer {
 }
 /** The rule names phase 1 and 2 may create (the servers get a number each). */
 export declare function ruleNames(serverCount: number): string[];
+/** Every IPv4 address except the given ranges, as a netsh address list ("a-b,c-d"). */
+export declare function ipv4Except(excluded: readonly (readonly [number, number])[]): string;
+/** The internet's IPv4 addresses without the VPN servers: what the kill switch blocks. */
+export declare function internetExcept(servers: readonly KillSwitchServer[]): string;
 /** Servers worth a rule: valid IPv4 addresses and ports, each endpoint once. */
 export declare function cleanServers(servers: readonly KillSwitchServer[]): KillSwitchServer[];
-/** Phase 1: block everything that goes out, then allow only what the tunnel and the attach channel need. */
+/**
+ * Phase 1: the block rules first (they hold whatever else allows), then outbound blocked by default, then what the
+ * tunnel and the attach channel need. `ptyHostExe` must be the long form of the path (netsh refuses 8.3 names).
+ */
 export declare function killSwitchCommands(servers: readonly KillSwitchServer[], ptyHostExe: string | null): string[][];
-/** Phase 2: everything that leaves from the tunnel's own address goes (it is inside the tunnel). */
+/**
+ * Phase 2: everything that leaves from the tunnel's own address goes (it is inside the tunnel). The IPv4 block rules
+ * are changed in place to every other local address, so they never stop applying to the normal connection. Global
+ * IPv6 stays blocked (the tunnel is IPv4).
+ */
 export declare function tunnelCommands(tunnelIp: string): string[][];
 /** Takes the kill switch away again: its rules go and outbound traffic is allowed by default as before. */
 export declare function removeKillSwitchCommands(): string[][];

package/dist/shared/vpn/kill-switch.js

@@ -1,8 +1,9 @@
-// The kill switch as netsh argument lists (pure, so it is tested without a firewall). Phase 1 runs BEFORE the tunnel
-// starts: everything that goes out is blocked except loopback, the VPN servers themselves, DHCP and the host's attach
-// channel. Phase 2 runs once the tunnel is up: traffic from the tunnel's own address is allowed, which is everything
-// that goes through the tunnel (DNS included). Windows keeps the block rules for private ranges
-// (network.blockPrivateRanges) on top of this: a block rule always beats an allow rule.
+// The kill switch as netsh argument lists (pure, so it is tested without a firewall). Windows Sandbox has its own
+// "Container: allow outbound" rule (any program, any address), so blocking outbound by default alone stops nothing:
+// the kill switch is made of BLOCK rules, which beat every allow rule. Phase 1 runs BEFORE the tunnel starts: every
+// public IPv4 address except the VPN servers, global IPv6 and DNS are blocked (private ranges are the LAN block's).
+// Phase 2 runs once the tunnel is up: the same block rules are narrowed in place (`set rule`, never a moment without
+// them) to every local address except the tunnel's own, so what goes through the tunnel (DNS included) passes.
 import { isIPv4 } from '../network/firewall-rules.js';
 export const VPN_RULE_PREFIX = 'AgentSandbox-VPN-';
 const rule = (name, extra) => [
@@ -24,9 +25,24 @@ const drop = (name) => [
     'rule',
     'name=' + VPN_RULE_PREFIX + name,
 ];
+const block = (name, extra) => [
+    'advfirewall',
+    'firewall',
+    'add',
+    'rule',
+    'name=' + VPN_RULE_PREFIX + name,
+    'dir=out',
+    'action=block',
+    'enable=yes',
+    'profile=any',
+    ...extra,
+];
+/** The block rules: IPv4 to the internet, global IPv6, and DNS anywhere (over udp and tcp). */
+const BLOCK_RULES = ['Block-Internet', 'Block-IPv6', 'Block-DNS-UDP', 'Block-DNS-TCP'];
 /** The rule names phase 1 and 2 may create (the servers get a number each). */
 export function ruleNames(serverCount) {
     return [
+        ...BLOCK_RULES,
         'Loopback',
         'DHCP',
         'Host',
@@ -34,6 +50,45 @@ export function ruleNames(serverCount) {
         ...Array.from({ length: Math.max(serverCount, 0) }, (_v, i) => 'Server-' + (i + 1)),
     ];
 }
+/** IPv4 ranges that are not the internet (this host, private, shared, link-local, multicast, reserved, broadcast). */
+const NOT_INTERNET = [
+    ['0.0.0.0', '0.255.255.255'],
+    ['10.0.0.0', '10.255.255.255'],
+    ['100.64.0.0', '100.127.255.255'],
+    ['127.0.0.0', '127.255.255.255'],
+    ['169.254.0.0', '169.254.255.255'],
+    ['172.16.0.0', '172.31.255.255'],
+    ['192.168.0.0', '192.168.255.255'],
+    ['224.0.0.0', '255.255.255.255'],
+];
+const LAST_IPV4 = 0xffffffff;
+function ipNumber(ip) {
+    return ip.split('.').reduce((n, part) => n * 256 + Number(part), 0);
+}
+function ipText(n) {
+    return [24, 16, 8, 0].map((shift) => Math.floor(n / 2 ** shift) % 256).join('.');
+}
+/** Every IPv4 address except the given ranges, as a netsh address list ("a-b,c-d"). */
+export function ipv4Except(excluded) {
+    const sorted = [...excluded].sort((a, b) => a[0] - b[0]);
+    const out = [];
+    let next = 0;
+    for (const [from, to] of sorted) {
+        if (from > next)
+            out.push(ipText(next) + '-' + ipText(from - 1));
+        next = Math.max(next, to + 1);
+    }
+    if (next <= LAST_IPV4)
+        out.push(ipText(next) + '-' + ipText(LAST_IPV4));
+    return out.join(',');
+}
+/** The internet's IPv4 addresses without the VPN servers: what the kill switch blocks. */
+export function internetExcept(servers) {
+    const ranges = NOT_INTERNET.map(([a, b]) => [ipNumber(a), ipNumber(b)]);
+    for (const s of cleanServers(servers))
+        ranges.push([ipNumber(s.ip), ipNumber(s.ip)]);
+    return ipv4Except(ranges);
+}
 /** Servers worth a rule: valid IPv4 addresses and ports, each endpoint once. */
 export function cleanServers(servers) {
     const seen = new Set();
@@ -45,12 +100,19 @@ export function cleanServers(servers) {
         return true;
     });
 }
-/** Phase 1: block everything that goes out, then allow only what the tunnel and the attach channel need. */
+/**
+ * Phase 1: the block rules first (they hold whatever else allows), then outbound blocked by default, then what the
+ * tunnel and the attach channel need. `ptyHostExe` must be the long form of the path (netsh refuses 8.3 names).
+ */
 export function killSwitchCommands(servers, ptyHostExe) {
     const list = cleanServers(servers);
     return [
         ...ruleNames(Math.max(list.length, 8)).map(drop),
         ['advfirewall', 'set', 'allprofiles', 'state', 'on'],
+        block('Block-Internet', ['protocol=any', 'remoteip=' + internetExcept(list)]),
+        block('Block-IPv6', ['protocol=any', 'remoteip=2000::/3']),
+        block('Block-DNS-UDP', ['protocol=udp', 'remoteport=53']),
+        block('Block-DNS-TCP', ['protocol=tcp', 'remoteport=53']),
         ['advfirewall', 'set', 'allprofiles', 'firewallpolicy', 'blockinbound,blockoutbound'],
         rule('Loopback', ['protocol=any', 'remoteip=127.0.0.0/8']),
         rule('DHCP', ['protocol=udp', 'localport=68', 'remoteport=67']),
@@ -58,11 +120,29 @@ export function killSwitchCommands(servers, ptyHostExe) {
         ...list.map((s, i) => rule('Server-' + (i + 1), ['protocol=' + s.proto, 'remoteip=' + s.ip, 'remoteport=' + s.port])),
     ];
 }
-/** Phase 2: everything that leaves from the tunnel's own address goes (it is inside the tunnel). */
+/**
+ * Phase 2: everything that leaves from the tunnel's own address goes (it is inside the tunnel). The IPv4 block rules
+ * are changed in place to every other local address, so they never stop applying to the normal connection. Global
+ * IPv6 stays blocked (the tunnel is IPv4).
+ */
 export function tunnelCommands(tunnelIp) {
     if (!isIPv4(tunnelIp))
         throw new Error('Not an IPv4 address: ' + tunnelIp);
-    return [drop('Tunnel'), rule('Tunnel', ['protocol=any', 'localip=' + tunnelIp])];
+    const n = ipNumber(tunnelIp);
+    const notTunnel = ipv4Except([[n, n]]);
+    return [
+        ...['Block-Internet', 'Block-DNS-UDP', 'Block-DNS-TCP'].map((name) => [
+            'advfirewall',
+            'firewall',
+            'set',
+            'rule',
+            'name=' + VPN_RULE_PREFIX + name,
+            'new',
+            'localip=' + notTunnel,
+        ]),
+        drop('Tunnel'),
+        rule('Tunnel', ['protocol=any', 'localip=' + tunnelIp]),
+    ];
 }
 /** Takes the kill switch away again: its rules go and outbound traffic is allowed by default as before. */
 export function removeKillSwitchCommands() {

package/dist/shared/web/protocol.d.ts

@@ -29,10 +29,6 @@ export interface WebInfo {
     readonly defaultHarness: string;
     readonly projects: readonly WebProject[];
 }
-export interface NewSessionRequest {
-    readonly harness: string;
-    readonly project: string;
-}
 /** Browser -> server on the terminal socket: binary messages are keystrokes; text messages are these (JSON). */
 export type ClientMessage = {
     readonly t: 'resize';

package/dist/sync/watcher.js

@@ -243,7 +243,7 @@ export class Watcher {
                     ? 'this PC is low (' + step.reason + '): asking the sandbox to slow its builds down'
                     : 'this PC has recovered: no longer asking the sandbox to slow down');
             if (step.send)
-                new SandboxChannel(this.dataPath).pressure(step.reason, REQUEST_SECONDS);
+                new SandboxChannel(this.dataPath).pressure(step.reason, REQUEST_SECONDS, step.severe ? 'severe' : 'slow');
         }
         catch (e) {
             this.note('host watchdog: ' + errMsg(e));

package/dist/web/index.html

@@ -5,8 +5,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>Sandbox</title>
     <link rel="icon" href="data:," />
-    <link rel="stylesheet" href="/main-T5DMCHYV.css" />
-    <script type="module" src="/main-NRRS5O6Z.js"></script>
+    <link rel="stylesheet" href="/main-6JF3ASB5.css" />
+    <script type="module" src="/main-Z645W45E.js"></script>
   </head>
   <body>
     <div id="root"></div>