Add Windows guest control and ConPTY

[sjmiller609]

summary

• cross-compile the guest agent as a Windows LocalSystem service
• listen through the virtio-win VioSock provider while retaining the existing gRPC protocol
• add SYSTEM and active-desktop execution sessions
• add ConPTY terminal allocation and resize handling
• support Windows file copy, stat, readiness, and graceful shutdown
• bind command trees to kill-on-close Job Objects and terminate them synchronously
• promote Windows instances to Running when guest-agent readiness is proven
• move guest-service protocol and lifecycle rationale into lib/system/README.md

targeted tests

• guest, guest-agent, and Windows readiness unit tests
• Windows guest-agent cross-compilation

Additional terminal signal-parity work is intentionally deferred. Long-running KVM and full CI suites were not run for this review pass.

---

Note

High Risk
Touches guest command execution, Windows tokens/desktop sessions, and vsock transport—security-sensitive guest control with new process-lifetime semantics.

Overview
Windows VMs now run the same guest-agent protocol as Linux. The agent is cross-compiled as hypeman-guest-agent.exe, installed as the HypemanGuestAgent LocalSystem service, and listens on virtio-win VioSock (port 2222). Windows instances no longer skip the guest agent; readiness can mark them Running.

Exec gains an explicit session (system vs desktop). SYSTEM uses the service account; DESKTOP impersonates the active interactive user on winsta0\default. Interactive TTY uses ConPTY (SYSTEM only). Commands start suspended, join a kill-on-close Job Object, then resume so timeouts and RPC close tear down the whole process tree.

Copy/stat/shutdown work on Windows (ownership and network reconfigure are no-ops/unimplemented). The exec API defaults Windows shells to cmd.exe. CI builds the Windows agent and adds a QEMU guest-control integration gate.

^{Reviewed by Cursor Bugbot for commit 1f60d0a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​aymanbagabas/​go-pty@​v0.2.2

View full report

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2dfae88. Configure here.}