windows-development-sandbox 1.0.5 → 1.1.0

package/dist/guest/toolchains/msvc.js

@@ -1,216 +0,0 @@
-// MSVC (cl, link) and the Windows SDK without an installer, the way mmozeiko's portable-msvc.py does it: packages
-// from Microsoft's Visual Studio channel manifest (each payload checked against the manifest's sha256), the compiler
-// unpacked from its .vsix, the SDK from its .msi files with `msiexec /a`. Laid out like a Build Tools install, with
-// vcvars64.bat and a vswhere that points at it, so CMake, cargo (msvc host), node-gyp and vcvars-based scripts work.
-// Use is governed by the Visual Studio licence terms: it only installs with toolchains.msvc.acceptLicense.
-import fs from 'node:fs';
-import path from 'node:path';
-import { download, extractArchive, fetchJson } from '../../shared/download.js';
-import { safeRemove } from '../../shared/safe-remove.js';
-import { system32 } from '../../shared/system.js';
-import { dryRun, execAsync, exists, log, mkdirp } from '../env.js';
-import { ensureCompiled } from '../ptyhost.js';
-import { tool } from './common.js';
-import { msiCabs, pickMsvcVersion, pickWindowsSdk } from './versions.js';
-const CHANNEL = 'https://aka.ms/vs/17/release/channel';
-const ROOT = tool('msvc');
-const MANIFEST_DAY_MS = 24 * 60 * 60 * 1000;
-/** Where build tools look for vswhere (local to the sandbox, so it is written each boot). */
-const VSWHERE_DIR = path.join(process.env['ProgramFiles(x86)'] ?? 'C:\\Program Files (x86)', 'Microsoft Visual Studio', 'Installer');
-/** The VS manifest (~18 MB), cached for a day. */
-const manifest = async () => {
-    const cached = path.join(ROOT, '.manifest.json');
-    if (exists(cached) && Date.now() - fs.statSync(cached).mtimeMs < MANIFEST_DAY_MS)
-        return JSON.parse(fs.readFileSync(cached, 'utf8'));
-    const channel = await fetchJson(CHANNEL);
-    const item = channel.channelItems.find((i) => i.id === 'Microsoft.VisualStudio.Manifests.VisualStudio')?.payloads?.[0];
-    if (!item)
-        throw new Error('the Visual Studio channel has no package manifest');
-    mkdirp(ROOT);
-    // The channel's sha256 for the manifest is not the file's hash (portable-msvc.py does not check it either); the
-    // manifest comes over HTTPS from Microsoft, and every package payload it lists IS checked against its own sha256.
-    await download(item.url, cached);
-    return JSON.parse(fs.readFileSync(cached, 'utf8'));
-};
-/** The compiler's packages (host x64, target x64): tools, resources, CRT headers/libs, ASAN/PGO headers, DIA SDK. */
-const MSVC_PARTS = ['tools.hostx64.targetx64.base', 'tools.hostx64.targetx64.res.base', 'crt.headers.base', 'crt.x64.desktop.base', 'crt.x64.store.base', 'crt.source.base', 'asan.headers.base', 'pgo.headers.base'];
-/** The SDK's .msi files (Desktop + UCRT + Store headers/libs/tools for x64), as in portable-msvc.py. */
-const SDK_MSIS = [
-    'Windows SDK for Windows Store Apps Tools-x86_en-us.msi', 'Windows SDK for Windows Store Apps Headers-x86_en-us.msi',
-    'Windows SDK for Windows Store Apps Headers OnecoreUap-x86_en-us.msi', 'Windows SDK for Windows Store Apps Libs-x86_en-us.msi',
-    'Universal CRT Headers Libraries and Sources-x86_en-us.msi', 'Windows SDK Desktop Headers x86-x86_en-us.msi',
-    'Windows SDK Desktop Headers x64-x86_en-us.msi', 'Windows SDK Desktop Libs x64-x86_en-us.msi', 'Windows SDK Desktop Tools x64-x86_en-us.msi',
-];
-/** .vsix contents are percent-encoded file names under Contents/; unpack them into the root, names decoded. */
-const unpackVsix = async (vsix, work) => {
-    const out = mkdirp(path.join(work, 'vsix-' + path.basename(vsix)));
-    await extractArchive(vsix, out, ['Contents']);
-    const decode = (dir) => {
-        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-            const from = path.join(dir, entry.name);
-            let name = entry.name;
-            try {
-                if (name.includes('%'))
-                    name = decodeURIComponent(name);
-            }
-            catch { /* not percent-encoded after all */ }
-            const to = path.join(dir, name);
-            if (to !== from)
-                fs.renameSync(from, to);
-            if (entry.isDirectory())
-                decode(to);
-        }
-    };
-    decode(out);
-    fs.cpSync(path.join(out, 'Contents'), ROOT, { recursive: true, force: true });
-    safeRemove(out, work);
-};
-const install = async (config) => {
-    const m = await manifest();
-    const byId = new Map();
-    for (const p of m.packages)
-        byId.set(p.id.toLowerCase(), [...(byId.get(p.id.toLowerCase()) ?? []), p]);
-    const pick = (id) => byId.get(id.toLowerCase())?.find((p) => !p.language || p.language === 'en-US');
-    const ids = [...byId.keys()];
-    const version = pickMsvcVersion(ids, config.msvcVersion);
-    if (!version)
-        throw new Error('no MSVC ' + config.msvcVersion + ' in the Visual Studio manifest');
-    const sdk = pickWindowsSdk(ids, config.sdkVersion);
-    if (!sdk)
-        throw new Error('no Windows SDK ' + config.sdkVersion + ' in the Visual Studio manifest');
-    const work = mkdirp(path.join(ROOT, '.download'));
-    const fetchPayload = async (p) => {
-        const file = path.join(work, path.basename(p.fileName.replace(/\\/g, '/')));
-        if (!exists(file))
-            await download(p.url, file, p.sha256);
-        return file;
-    };
-    log('Downloading MSVC ' + version + ' (compiler, CRT) ...');
-    for (const part of MSVC_PARTS) {
-        const p = pick('microsoft.vc.' + version + '.' + part);
-        if (!p) {
-            if (part.startsWith('tools') || part.startsWith('crt.headers') || part.startsWith('crt.x64.desktop'))
-                throw new Error('MSVC ' + version + ' has no ' + part);
-            continue;
-        }
-        for (const payload of p.payloads ?? [])
-            await unpackVsix(await fetchPayload(payload), work);
-    }
-    const dia = pick('microsoft.visualcpp.dia.sdk');
-    for (const payload of dia?.payloads ?? [])
-        await unpackVsix(await fetchPayload(payload), work);
-    // The SDK component depends on the package that holds the .msi/.cab payloads (e.g. Win11SDK_10.0.26100).
-    const sdkPackage = pick(Object.keys(pick(sdk.componentId)?.dependencies ?? {})[0] ?? '');
-    if (!sdkPackage?.payloads)
-        throw new Error('the Windows SDK ' + sdk.build + ' package has no payloads');
-    log('Downloading the Windows SDK ' + sdk.build + ' (headers, libraries) ...');
-    const payload = (name) => sdkPackage.payloads.find((p) => p.fileName.toLowerCase() === ('installers\\' + name).toLowerCase());
-    const msis = [];
-    for (const name of SDK_MSIS) {
-        const p = payload(name);
-        if (!p)
-            throw new Error('the Windows SDK package has no ' + name);
-        const file = await fetchPayload(p);
-        msis.push(file);
-        for (const cab of msiCabs(fs.readFileSync(file))) {
-            const c = payload(cab);
-            if (c)
-                await fetchPayload(c);
-        }
-    }
-    for (const msi of msis) {
-        // An administrative install only unpacks files; its verbose log explains a failure (e.g. a path over 260 characters).
-        const logFile = msi + '.log';
-        try {
-            await execAsync(system32('msiexec.exe'), ['/a', msi, '/quiet', '/qn', 'TARGETDIR=' + ROOT, '/l*v', logFile], { stdio: 'ignore' });
-        }
-        catch (e) {
-            const lines = exists(logFile) ? fs.readFileSync(logFile, 'utf16le').split(/\r?\n/).filter((l) => /error|return value 3|failed/i.test(l)).slice(-4).join(' | ') : '';
-            throw new Error(path.basename(msi) + ' did not unpack: ' + (e instanceof Error ? e.message : String(e)) + (lines ? ' (' + lines.slice(0, 600) + ')' : ''));
-        }
-    }
-    // msiexec /a also copies every .msi into the target; they are not needed.
-    for (const name of fs.readdirSync(ROOT).filter((n) => n.toLowerCase().endsWith('.msi')))
-        fs.rmSync(path.join(ROOT, name), { force: true });
-    safeRemove(work, ROOT);
-    const sdkVersion = fs.readdirSync(path.join(ROOT, 'Windows Kits', '10', 'Include')).filter((d) => d.startsWith('10.0.' + sdk.build)).sort().pop();
-    if (!sdkVersion)
-        throw new Error('the Windows SDK did not unpack (no Include\\10.0.' + sdk.build + '.*)');
-    // The tools folder is named after the toolset (14.44.35207), not the package version (14.44.17.14).
-    const toolsRoot = path.join(ROOT, 'VC', 'Tools', 'MSVC');
-    const tools = fs.readdirSync(toolsRoot).filter((d) => exists(path.join(toolsRoot, d, 'bin', 'Hostx64', 'x64', 'cl.exe'))).sort((a, b) => a.localeCompare(b, undefined, { numeric: true })).pop();
-    if (!tools)
-        throw new Error('MSVC ' + version + ' did not unpack (no cl.exe under VC\\Tools\\MSVC)');
-    return { msvc: tools, sdk: sdkVersion };
-};
-/** Variables vcvars64.bat would set for this tree (host x64, target x64). */
-export const vcvars = (root, msvc, sdk) => {
-    const vc = path.join(root, 'VC', 'Tools', 'MSVC', msvc);
-    const kits = path.join(root, 'Windows Kits', '10');
-    const inc = (...p) => path.join(kits, 'Include', sdk, ...p);
-    const lib = (...p) => path.join(kits, 'Lib', sdk, ...p);
-    return {
-        vars: {
-            VSINSTALLDIR: root + '\\', VCINSTALLDIR: path.join(root, 'VC') + '\\', VCToolsInstallDir: vc + '\\', VCToolsVersion: msvc, VisualStudioVersion: '17.0',
-            WindowsSdkDir: kits + '\\', WindowsSDKVersion: sdk + '\\', WindowsSDKLibVersion: sdk + '\\', UniversalCRTSdkDir: kits + '\\', UCRTVersion: sdk,
-            VSCMD_ARG_HOST_ARCH: 'x64', VSCMD_ARG_TGT_ARCH: 'x64', Platform: 'x64',
-            INCLUDE: [path.join(vc, 'include'), inc('ucrt'), inc('shared'), inc('um'), inc('winrt'), inc('cppwinrt')].join(';'),
-            LIB: [path.join(vc, 'lib', 'x64'), lib('ucrt', 'x64'), lib('um', 'x64')].join(';'),
-            LIBPATH: [path.join(vc, 'lib', 'x64'), path.join(vc, 'lib', 'x86', 'store', 'references')].join(';'),
-        },
-        path: [path.join(vc, 'bin', 'Hostx64', 'x64'), path.join(kits, 'bin', sdk, 'x64')],
-    };
-};
-/** vcvars64.bat / vcvarsall.bat in the usual place, for scripts that `call` them. */
-const writeVcvars = (env) => {
-    const dir = mkdirp(path.join(ROOT, 'VC', 'Auxiliary', 'Build'));
-    const lines = ['@echo off', 'rem Written by Windows Development Sandbox for its portable MSVC (host x64, target x64).',
-        ...Object.entries(env.vars).map(([k, v]) => 'set "' + k + '=' + v + '"'), 'set "PATH=' + env.path.join(';') + ';%PATH%"', 'exit /b 0'];
-    fs.writeFileSync(path.join(dir, 'vcvars64.bat'), lines.join('\r\n') + '\r\n');
-    fs.writeFileSync(path.join(dir, 'vcvarsall.bat'), ['@echo off', 'rem Only x64 (amd64) is installed.', 'call "%~dp0vcvars64.bat"', 'exit /b %errorlevel%'].join('\r\n') + '\r\n');
-};
-/** vswhere.exe where Visual Studio's installer would put it, answering with this tree. */
-const installVswhere = (msvc) => {
-    mkdirp(VSWHERE_DIR);
-    fs.copyFileSync(ensureCompiled('vswhere'), path.join(VSWHERE_DIR, 'vswhere.exe'));
-    const [major, minor] = msvc.split('.').slice(2);
-    fs.writeFileSync(path.join(VSWHERE_DIR, 'vswhere.json'), JSON.stringify({ installationPath: ROOT, installationVersion: '17.' + (minor ?? '0') + '.0.' + (major ?? '0') }));
-};
-/** The vcvars environment of an installed tree (for steps that run before the agent's environment exists). */
-export const installedMsvcEnv = () => {
-    try {
-        const done = JSON.parse(fs.readFileSync(path.join(ROOT, '.installed.json'), 'utf8'));
-        return exists(path.join(ROOT, 'VC', 'Tools', 'MSVC', done.msvc, 'bin', 'Hostx64', 'x64', 'cl.exe')) ? vcvars(ROOT, done.msvc, done.sdk) : null;
-    }
-    catch {
-        return null;
-    }
-};
-export const setupMsvc = async (env, config) => {
-    if (!config.acceptLicense) {
-        throw new Error('MSVC is installed only with toolchains.msvc.acceptLicense = true: its use is governed by the Visual Studio licence terms (https://visualstudio.microsoft.com/license-terms/), which need a Visual Studio licence');
-    }
-    if (dryRun) {
-        log('(dry run) would provision MSVC ' + config.msvcVersion + ' and Windows SDK ' + config.sdkVersion);
-        return;
-    }
-    const marker = path.join(ROOT, '.installed.json');
-    const want = config.msvcVersion + '/' + config.sdkVersion;
-    let done = exists(marker) ? JSON.parse(fs.readFileSync(marker, 'utf8')) : null;
-    if (!done || done.want !== want || !exists(path.join(ROOT, 'VC', 'Tools', 'MSVC', done.msvc, 'bin', 'Hostx64', 'x64', 'cl.exe'))) {
-        log('Installing MSVC and the Windows SDK (~1-2 GB, once; licence accepted in toolchains.msvc.acceptLicense) ...');
-        // A previous attempt's verified downloads (.download) are kept; everything it unpacked is redone.
-        if (exists(ROOT))
-            for (const name of fs.readdirSync(ROOT).filter((n) => n !== '.manifest.json' && n !== '.download'))
-                safeRemove(path.join(ROOT, name), ROOT);
-        const installed = await install(config);
-        done = { ...installed, want };
-        fs.writeFileSync(marker, JSON.stringify(done, null, 2));
-    }
-    const vc = vcvars(ROOT, done.msvc, done.sdk);
-    writeVcvars(vc);
-    installVswhere(done.msvc);
-    Object.assign(env.vars, vc.vars);
-    env.prepend.push(...vc.path);
-    env.summary.push('msvc: ' + done.msvc + ', Windows SDK ' + done.sdk + ' (cl, link; vcvars64.bat and vswhere work)');
-};

package/dist/guest/toolchains/native.d.ts

@@ -1,12 +0,0 @@
-import type { Toolchains } from '../../core/types.js';
-import { type ToolEnv } from './common.js';
-/** MinGW-w64 GCC from WinLibs: gcc/g++/mingw32-make for the agent, and the linker for Rust's GNU host. */
-export declare const setupCpp: (env: ToolEnv, config: Toolchains["cpp"]) => Promise<void>;
-/**
- * Mesa 3D for Windows (llvmpipe): OpenGL 4.5 on the CPU when the sandbox has no GPU. Windows only offers OpenGL 1.1 in
- * software, and opengl32.dll cannot be replaced system-wide, so programs pick Mesa up from their own folder.
- */
-export declare const setupMesa: (env: ToolEnv, config: Toolchains["mesa"]) => Promise<void>;
-export declare const setupRust: (env: ToolEnv, config: Toolchains["rust"], refresh: boolean) => Promise<void>;
-/** .NET SDK channels from config plus whatever the workspace's global.json pins. Installs are remembered in a marker. */
-export declare const setupDotnet: (env: ToolEnv, config: Toolchains["dotnet"], refresh: boolean) => Promise<void>;

package/dist/guest/toolchains/native.js

@@ -1,220 +0,0 @@
-// Compiled languages: C/C++ (MinGW-w64 GCC, flex/bison), Rust (rustup + cargo), C# (.NET SDK and .NET Framework
-// targeting), and Mesa for running OpenGL programs without a GPU.
-import fs from 'node:fs';
-import path from 'node:path';
-import { z } from 'zod';
-import { download, fetchJson, githubAsset, installArchive } from '../../shared/download.js';
-import { readJsonFile, writeJsonAtomic } from '../../shared/rundir.js';
-import { SYSTEM } from '../../shared/system.js';
-import { dryRun, errMsg, execAsync, execOutput, exists, log, mkdirp, warn, workspace } from '../env.js';
-import { arch, installOnce, tool, versionOf } from './common.js';
-import { CMAKE_FLOOR, cmakeTooOld } from './versions.js';
-import { crateInstaller } from './binstall.js';
-import { installedMsvcEnv } from './msvc.js';
-/** MinGW-w64 GCC from WinLibs: gcc/g++/mingw32-make for the agent, and the linker for Rust's GNU host. */
-export const setupCpp = async (env, config) => {
-    const bin = tool('mingw', 'mingw64', 'bin');
-    const gcc = path.join(bin, 'gcc.exe');
-    if (dryRun) {
-        log('(dry run) would provision MinGW-w64 GCC');
-        return;
-    }
-    if (!exists(gcc)) {
-        const asset = await githubAsset('brechtsanders/winlibs_mingw', arch === 'arm64' ? /^winlibs-aarch64-.*\.zip$/ : /^winlibs-x86_64-posix-seh-gcc-.*\.zip$/, true);
-        log('Downloading ' + asset.name + ' (C/C++ compiler, ~270 MB once) ...');
-        await installArchive(asset.url, tool('mingw'), { sha256: asset.sha256, fileName: asset.name });
-    }
-    if (!exists(gcc))
-        throw new Error('gcc.exe missing after installing MinGW');
-    // Appended (not prepended) so MinGW's tools never shadow Windows or toolchain commands of the same name.
-    env.append.unshift(bin);
-    env.vars.CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER = gcc;
-    const cmake = versionOf(path.join(bin, 'cmake.exe'));
-    if (cmakeTooOld(cmake))
-        warn('The bundled CMake ' + cmake + ' is older than ' + CMAKE_FLOOR + ', which many projects need; set toolchains.cpp.enabled to refresh it, or install a newer CMake into C:\\AgentData\\tools\\bin.');
-    env.summary.push('gcc: ' + versionOf(gcc) + ' (MinGW-w64, with cmake ' + cmake + ', ninja, premake5)');
-    if (config.flexBison)
-        await setupFlexBison(env);
-};
-/** win_flex / win_bison (CMake's FindFLEX/FindBISON look for these names). Kept with the C/C++ tools on PATH. */
-const setupFlexBison = async (env) => {
-    const dir = tool('winflexbison');
-    if (!exists(path.join(dir, 'win_bison.exe'))) {
-        const asset = await githubAsset('lexxmark/winflexbison', /^win_flex_bison-[\d.]+\.zip$/);
-        log('Downloading ' + asset.name + ' ...');
-        await installArchive(asset.url, dir, { sha256: asset.sha256, locate: 'win_bison.exe', fileName: asset.name });
-    }
-    env.append.push(dir);
-    env.summary.push('win_flex/win_bison: ' + versionOf(path.join(dir, 'win_bison.exe')));
-};
-/**
- * Mesa 3D for Windows (llvmpipe): OpenGL 4.5 on the CPU when the sandbox has no GPU. Windows only offers OpenGL 1.1 in
- * software, and opengl32.dll cannot be replaced system-wide, so programs pick Mesa up from their own folder.
- */
-export const setupMesa = async (env, config) => {
-    if (dryRun) {
-        log('(dry run) would provision Mesa 3D');
-        return;
-    }
-    const root = tool('mesa');
-    const dir = path.join(root, arch === 'arm64' ? 'arm64' : 'x64');
-    if (!exists(path.join(dir, 'opengl32.dll'))) {
-        const asset = await githubAsset('pal1000/mesa-dist-win', /^mesa3d-[\d.]+-release-msvc\.7z$/);
-        log('Downloading ' + asset.name + ' (software OpenGL) ...');
-        await installArchive(asset.url, root, { sha256: asset.sha256, locate: 'opengl32.dll', up: 1, fileName: asset.name });
-    }
-    Object.assign(env.vars, { MESA_DIR: dir, GALLIUM_DRIVER: 'llvmpipe' });
-    env.summary.push('mesa (software OpenGL 4.5): copy opengl32.dll + libgallium_wgl.dll from %MESA_DIR% next to a game\'s .exe');
-    if (config.vulkan)
-        await setupLavapipe(env, dir);
-};
-const VULKAN_RUNTIME = 'https://sdk.lunarg.com/sdk/download/latest/windows/vulkan-runtime-components.zip';
-/**
- * Software Vulkan: Mesa's lavapipe plus the Khronos loader (vulkan-1.dll, from LunarG's runtime components; Windows
- * Sandbox has no Vulkan loader). The loader ignores VK_DRIVER_FILES in elevated processes, and everything in the
- * sandbox runs elevated, so lavapipe is registered where the loader looks (HKLM; the registry is new every boot).
- */
-const setupLavapipe = async (env, mesaDir) => {
-    const icd = path.join(mesaDir, arch === 'arm64' ? 'lvp_icd.aarch64.json' : 'lvp_icd.x86_64.json');
-    if (!exists(icd))
-        throw new Error('this Mesa build has no lavapipe (' + path.basename(icd) + ')');
-    const dir = tool('vulkan');
-    if (!exists(path.join(dir, 'vulkan-1.dll'))) {
-        log('Downloading the Vulkan loader (LunarG runtime components) ...');
-        // LunarG publishes no checksum for this zip; it comes over HTTPS from LunarG, the Khronos SDK's maintainer.
-        // The zip has x86 and x64 folders: only the 64-bit loader (and vulkaninfo) is extracted.
-        await installArchive(VULKAN_RUNTIME, dir, { locate: 'vulkan-1.dll', fileName: 'vulkan-runtime.zip', members: ['*/x64/*'] });
-    }
-    await execAsync(SYSTEM.reg(), ['add', 'HKLM\\SOFTWARE\\Khronos\\Vulkan\\Drivers', '/v', icd, '/t', 'REG_DWORD', '/d', '0', '/f'], { stdio: 'ignore' });
-    env.prepend.push(dir);
-    env.summary.push('vulkan: lavapipe (software Vulkan 1.4 on the CPU), vulkaninfo on PATH; WGPU_BACKEND=vulkan for wgpu');
-};
-export const setupRust = async (env, config, refresh) => {
-    const RUSTUP_HOME = tool('rust', 'rustup');
-    const CARGO_HOME = tool('rust', 'cargo');
-    const rustEnv = { env: { ...process.env, RUSTUP_HOME, CARGO_HOME } };
-    const rustup = path.join(CARGO_HOME, 'bin', 'rustup.exe');
-    if (dryRun) {
-        log('(dry run) would provision Rust ' + config.toolchain + ' (' + config.host + ')');
-        return;
-    }
-    if (!exists(rustup)) {
-        const init = tool('rust', 'rustup-init.exe');
-        log('Downloading rustup ...');
-        await download('https://static.rust-lang.org/rustup/dist/' + (arch === 'arm64' ? 'aarch64' : 'x86_64') + '-pc-windows-msvc/rustup-init.exe', init);
-        await execAsync(init, ['-y', '--no-modify-path', '--profile', 'default', '--default-host', config.host, '--default-toolchain', config.toolchain], rustEnv);
-    }
-    else {
-        // The host can change (GNU <-> msvc with toolchains.msvc): install the toolchain for it; a no-op when it is there.
-        await execAsync(rustup, ['set', 'default-host', config.host], { ...rustEnv, stdio: 'ignore' });
-        await execAsync(rustup, ['toolchain', 'install', config.toolchain, '--profile', 'default', '--no-self-update'], { ...rustEnv, stdio: 'ignore' });
-        await execAsync(rustup, ['default', config.toolchain], { ...rustEnv, stdio: 'ignore' });
-        if (refresh)
-            await execAsync(rustup, ['update'], rustEnv);
-    }
-    Object.assign(env.vars, { RUSTUP_HOME, CARGO_HOME });
-    env.prepend.push(path.join(CARGO_HOME, 'bin'));
-    env.summary.push('rust: ' + versionOf(path.join(CARGO_HOME, 'bin', 'rustc.exe'), ['--version'], rustEnv) + ' [' + config.host + ']');
-    const toolchainKey = 'rustup@' + config.toolchain;
-    await installOnce(env, toolchainKey + ' components', config.components, (c) => execAsync(rustup, ['component', 'add', c], rustEnv));
-    await installOnce(env, toolchainKey + ' targets', config.targets, (t) => execAsync(rustup, ['target', 'add', t], rustEnv));
-    // cargo install links with MSVC's link.exe (msvc host) or MinGW's gcc (GNU host). Those steps ran first, but their
-    // PATH only reaches the agent at the end, so it is put together here.
-    const msvc = config.host.endsWith('-msvc') ? installedMsvcEnv() : null;
-    const mingw = tool('mingw', 'mingw64', 'bin');
-    const cargoEnv = msvc
-        ? { env: { ...rustEnv.env, ...msvc.vars, PATH: [path.join(CARGO_HOME, 'bin'), ...msvc.path, process.env.PATH ?? ''].join(path.delimiter) } }
-        : { env: { ...rustEnv.env, CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: path.join(mingw, 'gcc.exe'), PATH: [path.join(CARGO_HOME, 'bin'), mingw, process.env.PATH ?? ''].join(path.delimiter) } };
-    // Prebuilt through cargo-binstall where the crate publishes a Windows build, else compiled (same "cargo" keys as before).
-    await installOnce(env, 'cargo', config.crates, crateInstaller(CARGO_HOME, cargoEnv));
-};
-/** tools\dotnet\.agent-sandbox-installed.json: which install keys (channel:8.0, global.json:...) already ran. */
-const DotnetMarker = z.record(z.string(), z.boolean());
-/** .NET SDK channels from config plus whatever the workspace's global.json pins. Installs are remembered in a marker. */
-export const setupDotnet = async (env, config, refresh) => {
-    const root = tool('dotnet');
-    const marker = path.join(root, '.agent-sandbox-installed.json');
-    const script = tool('dotnet-install.ps1');
-    if (dryRun) {
-        log('(dry run) would provision .NET SDK channels ' + config.channels.join(', '));
-        return;
-    }
-    // A corrupt or hand-edited marker just means "nothing recorded yet" (the installs are idempotent).
-    const recorded = DotnetMarker.safeParse(exists(marker) && !refresh ? readJsonFile(marker) : {});
-    const done = recorded.success ? recorded.data : {};
-    const globalJson = path.join(workspace, 'global.json');
-    const installs = [
-        ...config.channels.map((c) => ['channel:' + c, ['-Channel', c]]),
-        ...(exists(globalJson) ? [['global.json:' + fs.readFileSync(globalJson, 'utf8').replace(/\s+/g, ''), ['-JSonFile', globalJson]]] : []),
-    ];
-    for (const [key, args] of installs.filter(([k]) => !done[k])) {
-        if (!exists(script) || refresh)
-            await download('https://dot.net/v1/dotnet-install.ps1', script);
-        log('Installing .NET SDK (' + key + ') ...');
-        await execAsync(SYSTEM.powershell(), ['-NoLogo', '-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', script, ...args, '-InstallDir', root, '-NoPath']);
-        done[key] = true;
-        writeJsonAtomic(marker, done);
-    }
-    const home = mkdirp(tool('dotnet-home'));
-    Object.assign(env.vars, { DOTNET_ROOT: root, DOTNET_CLI_HOME: home, DOTNET_CLI_TELEMETRY_OPTOUT: '1', DOTNET_NOLOGO: '1', DOTNET_SKIP_FIRST_TIME_EXPERIENCE: '1', NUGET_PACKAGES: tool('nuget', 'packages') });
-    env.prepend.push(root, path.join(home, '.dotnet', 'tools'));
-    env.summary.push('dotnet: ' + execOutput(path.join(root, 'dotnet.exe'), ['--list-sdks']).split(/\r?\n/).map((l) => l.split(' ')[0]).filter(Boolean).join(', '));
-    const dotnet = path.join(root, 'dotnet.exe');
-    const dotnetEnv = { env: { ...process.env, ...env.vars, PATH: root + path.delimiter + (process.env.PATH ?? '') } };
-    await installOnce(env, 'dotnet workload', config.workloads, (w) => execAsync(dotnet, ['workload', 'install', w, '--skip-manifest-update'], dotnetEnv));
-    await installOnce(env, 'dotnet tool', config.tools, (t) => execAsync(dotnet, ['tool', 'install', '--global', t], dotnetEnv));
-    await setupFrameworkReferences(env, config.frameworkTargets);
-    if (config.netfx35)
-        await setupNetFx35(env);
-};
-/**
- * .NET Framework reference assemblies (the "targeting packs" Visual Studio would install) from NuGet, so net4x projects,
- * old-style .csproj included, build with the SDK's MSBuild. MSBuild reads TargetFrameworkRootPath from the environment.
- * Running .NET Framework 4.8 apps needs nothing: Windows ships it.
- */
-const setupFrameworkReferences = async (env, targets) => {
-    if (!targets.length)
-        return;
-    const root = tool('netfx-references');
-    for (const target of targets) {
-        const id = 'microsoft.netframework.referenceassemblies.' + target.toLowerCase();
-        const marker = path.join(root, '.installed-' + target.toLowerCase());
-        if (exists(marker))
-            continue;
-        try {
-            const { versions } = await fetchJson('https://api.nuget.org/v3-flatcontainer/' + id + '/index.json');
-            const version = versions.filter((v) => /^\d+(\.\d+)*$/.test(v)).pop();
-            if (!version)
-                throw new Error('no stable version of ' + id);
-            log('Downloading .NET Framework reference assemblies (' + target + ') ...');
-            const staging = tool('netfx-references-' + target.toLowerCase());
-            await installArchive('https://api.nuget.org/v3-flatcontainer/' + id + '/' + version + '/' + id + '.' + version + '.nupkg', staging, { fileName: id + '.zip' });
-            fs.cpSync(path.join(staging, 'build', '.NETFramework'), path.join(root, '.NETFramework'), { recursive: true });
-            fs.rmSync(staging, { recursive: true, force: true });
-            fs.writeFileSync(marker, version);
-        }
-        catch (e) {
-            warn('.NET Framework reference assemblies ' + target + ' failed: ' + errMsg(e));
-        }
-    }
-    if (!exists(path.join(root, '.NETFramework')))
-        return;
-    env.vars.TargetFrameworkRootPath = root + path.sep;
-    env.summary.push('.NET Framework targeting: ' + fs.readdirSync(path.join(root, '.NETFramework')).join(', '));
-};
-/** .NET Framework 3.5 is a Windows feature the sandbox image lacks; DISM fetches it from Windows Update on every boot. */
-const setupNetFx35 = async (env) => {
-    if (execOutput(SYSTEM.reg(), ['query', 'HKLM\\SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v3.5', '/v', 'Install']).includes('0x1')) {
-        env.summary.push('.NET Framework 3.5: on');
-        return;
-    }
-    log('Enabling .NET Framework 3.5 (downloads from Windows Update, a few minutes) ...');
-    try {
-        await execAsync(SYSTEM.dism(), ['/Online', '/Enable-Feature', '/FeatureName:NetFx3', '/All', '/NoRestart', '/Quiet'], { stdio: 'ignore' });
-        env.summary.push('.NET Framework 3.5: on');
-    }
-    catch (e) {
-        warn('.NET Framework 3.5 could not be enabled: ' + errMsg(e));
-        env.summary.push('.NET Framework 3.5: FAILED');
-    }
-};

package/dist/guest/toolchains/scripting.d.ts

@@ -1,10 +0,0 @@
-import type { Toolchains } from '../../core/types.js';
-import { type ToolEnv } from './common.js';
-/**
- * vcruntime140.dll & co. A real installer (it writes to System32), so it runs on every boot; the installer itself is
- * kept in persistent storage and only run when Microsoft's signature on it checks out. Resolves true when this call
- * ran the installer. Only the "Visual C++ runtime" step reports it (`summary`); PHP calls it again just to be sure.
- */
-export declare const setupVcRuntime: (env: ToolEnv, summary?: boolean) => Promise<boolean>;
-export declare const setupRuby: (env: ToolEnv, config: Toolchains["ruby"]) => Promise<void>;
-export declare const setupPhp: (env: ToolEnv, config: Toolchains["php"]) => Promise<void>;

package/dist/guest/toolchains/scripting.js

@@ -1,137 +0,0 @@
-// Ruby (RubyInstaller) and PHP (windows.php.net, with Composer), plus the Visual C++ runtime PHP and other native
-// tools need. Gems and Composer's global packages live in persistent storage.
-import fs from 'node:fs';
-import path from 'node:path';
-import { download, fetchJson, fetchText, installArchive, spawnAsync } from '../../shared/download.js';
-import { SYSTEM } from '../../shared/system.js';
-import { dryRun, execAsync, execOutput, exists, log, mkdirp } from '../env.js';
-import { installOnce, resolveCached, tool, versionFromFiles, versionOf } from './common.js';
-import { pickPackageVersion } from './versions.js';
-/** Writes `<name>.cmd` into tools\shims (on PATH). */
-const shim = (env, name, command) => {
-    fs.writeFileSync(path.join(mkdirp(tool('shims')), name + '.cmd'), '@echo off\r\n' + command + ' %*\r\n');
-    env.prepend.push(tool('shims'));
-};
-// ---- Visual C++ runtime ----------------------------------------------------------------------------------------------
-const VC_REDIST = 'https://aka.ms/vs/17/release/vc_redist.x64.exe';
-/**
- * vcruntime140.dll & co. A real installer (it writes to System32), so it runs on every boot; the installer itself is
- * kept in persistent storage and only run when Microsoft's signature on it checks out. Resolves true when this call
- * ran the installer. Only the "Visual C++ runtime" step reports it (`summary`); PHP calls it again just to be sure.
- */
-export const setupVcRuntime = async (env, summary = true) => {
-    if (dryRun) {
-        log('(dry run) would install the Visual C++ runtime');
-        return false;
-    }
-    const system32 = path.join(process.env.WINDIR ?? 'C:\\Windows', 'System32');
-    const missing = !exists(path.join(system32, 'vcruntime140.dll')) || !exists(path.join(system32, 'msvcp140.dll'));
-    if (missing) {
-        const installer = tool('vcredist', 'vc_redist.x64.exe');
-        if (!exists(installer)) {
-            log('Downloading the Visual C++ runtime ...');
-            await download(VC_REDIST, installer);
-        }
-        const signer = execOutput(SYSTEM.powershell(), ['-NoLogo', '-NoProfile', '-Command', "$s = Get-AuthenticodeSignature -LiteralPath '" + installer.replace(/'/g, "''") + "'; if ($s.Status -eq 'Valid') { $s.SignerCertificate.Subject }"]);
-        if (signer.trim() !== 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US') {
-            fs.rmSync(installer, { force: true });
-            throw new Error('vc_redist.x64.exe is not signed by Microsoft; deleted it (it is downloaded again next boot)');
-        }
-        log('Installing the Visual C++ runtime ...');
-        // 1638: a newer version is already installed; 3010: installed, a restart would finish it (not needed for the DLLs).
-        const code = await spawnAsync(installer, ['/install', '/quiet', '/norestart']);
-        if (![0, 1638, 3010].includes(code ?? -1) || !exists(path.join(system32, 'vcruntime140.dll')))
-            throw new Error('the Visual C++ runtime installer failed (exit ' + code + ')');
-    }
-    if (summary)
-        env.summary.push('vc++ runtime: installed');
-    return missing;
-};
-const RUBY_ASSET = /^rubyinstaller-(\d+\.\d+\.\d+)-(\d+)-x64\.7z$/;
-/** RubyInstaller builds per Ruby version (newest build of each), from its GitHub releases. */
-const rubyBuilds = async () => {
-    const releases = await fetchJson('https://api.github.com/repos/oneclick/rubyinstaller2/releases?per_page=100');
-    const builds = new Map();
-    for (const asset of releases.filter((r) => !r.draft && !r.prerelease).flatMap((r) => r.assets)) {
-        const match = RUBY_ASSET.exec(asset.name);
-        const known = match && builds.get(match[1]);
-        if (match && (!known || Number(RUBY_ASSET.exec(known.name)[2]) < Number(match[2])))
-            builds.set(match[1], asset);
-    }
-    return builds;
-};
-export const setupRuby = async (env, config) => {
-    const wantedSpec = versionFromFiles(['.ruby-version']) ?? { spec: config.version, source: 'config' };
-    if (dryRun) {
-        log('(dry run) would provision Ruby ' + wantedSpec.spec);
-        return;
-    }
-    const version = await resolveCached('ruby:' + wantedSpec.spec, async () => pickPackageVersion([...(await rubyBuilds()).keys()], wantedSpec.spec) ?? Promise.reject(new Error('No RubyInstaller build matches "' + wantedSpec.spec + '"')));
-    const home = tool('ruby', version);
-    if (!exists(path.join(home, 'bin', 'ruby.exe'))) {
-        const asset = (await rubyBuilds()).get(version);
-        if (!asset)
-            throw new Error('RubyInstaller ' + version + ' is no longer published');
-        log('Downloading ' + asset.name + ' ...');
-        await installArchive(asset.browser_download_url, home, { sha256: asset.digest?.startsWith('sha256:') ? asset.digest.slice(7) : null, locate: 'ruby.exe', up: 1, fileName: asset.name });
-    }
-    const gems = tool('ruby-gems', version.split('.').slice(0, 2).join('.'));
-    Object.assign(env.vars, { GEM_HOME: gems, BUNDLE_USER_HOME: tool('bundle-home') });
-    env.prepend.push(path.join(home, 'bin'), path.join(gems, 'bin'));
-    env.summary.push('ruby: ' + versionOf(path.join(home, 'bin', 'ruby.exe')) + ' (from ' + wantedSpec.source + '; gems with C extensions need MSYS2, not included)');
-    const gem = path.join(home, 'bin', 'gem.cmd');
-    await installOnce(env, 'gem@' + version, config.gems, (pkg) => execAsync(SYSTEM.cmd(), ['/d', '/c', gem, 'install', pkg, '--no-document'], { env: { ...process.env, GEM_HOME: gems } }));
-};
-const PHP_EXTENSIONS = ['curl', 'fileinfo', 'gd', 'intl', 'mbstring', 'openssl', 'pdo_mysql', 'pdo_pgsql', 'pdo_sqlite', 'sodium', 'sqlite3', 'zip'];
-/** The non-thread-safe x64 zip of the newest release matching `spec` ("8" -> newest 8.x, "8.3" -> newest 8.3.x). */
-const phpBuild = async (spec) => {
-    const releases = await fetchJson('https://windows.php.net/downloads/releases/releases.json');
-    const pick = pickPackageVersion(Object.values(releases).map((r) => r.version), spec);
-    const release = Object.values(releases).find((r) => r.version === pick);
-    const build = release && Object.entries(release).find(([key, value]) => /^nts-vs\d+-x64$/.test(key) && typeof value === 'object' && value.zip)?.[1];
-    if (!release || typeof build !== 'object' || !build.zip)
-        throw new Error('No PHP build for Windows matches "' + spec + '"');
-    return { version: release.version, ...build.zip };
-};
-/** php.ini from the development template with the common extensions switched on. */
-const writePhpIni = (home) => {
-    const ini = path.join(home, 'php.ini');
-    if (exists(ini) || !exists(path.join(home, 'php.ini-development')))
-        return;
-    let text = fs.readFileSync(path.join(home, 'php.ini-development'), 'utf8')
-        .replace(/^;\s*extension_dir\s*=\s*"ext"/m, 'extension_dir = "' + path.join(home, 'ext') + '"');
-    for (const ext of PHP_EXTENSIONS.filter((e) => exists(path.join(home, 'ext', 'php_' + e + '.dll'))))
-        text = text.replace(new RegExp('^;(extension=' + ext + ')\\s*$', 'm'), '$1');
-    fs.writeFileSync(ini, text);
-};
-export const setupPhp = async (env, config) => {
-    const wantedSpec = versionFromFiles(['.php-version']) ?? { spec: config.version, source: 'config' };
-    if (dryRun) {
-        log('(dry run) would provision PHP ' + wantedSpec.spec + (config.composer ? ' + Composer' : ''));
-        return;
-    }
-    // No summary line of its own: the Visual C++ runtime step (which runs first) already reports it.
-    await setupVcRuntime(env, false);
-    const version = await resolveCached('php:' + wantedSpec.spec, async () => (await phpBuild(wantedSpec.spec)).version);
-    const home = tool('php', version);
-    if (!exists(path.join(home, 'php.exe'))) {
-        const build = await phpBuild(version);
-        log('Downloading ' + build.path + ' ...');
-        await installArchive('https://windows.php.net/downloads/releases/' + build.path, home, { sha256: build.sha256, locate: 'php.exe', fileName: build.path });
-    }
-    writePhpIni(home);
-    env.prepend.push(home);
-    env.summary.push('php: ' + version + ' (from ' + wantedSpec.source + ')');
-    if (!config.composer)
-        return;
-    const phar = tool('composer', 'composer.phar');
-    if (!exists(phar)) {
-        log('Downloading Composer ...');
-        await download('https://getcomposer.org/download/latest-stable/composer.phar', phar, (await fetchText('https://getcomposer.org/download/latest-stable/composer.phar.sha256sum')).trim().split(/\s+/)[0]);
-    }
-    const composerHome = tool('composer-home');
-    env.vars.COMPOSER_HOME = composerHome;
-    env.prepend.push(path.join(composerHome, 'vendor', 'bin'));
-    shim(env, 'composer', '"' + path.join(home, 'php.exe') + '" "' + phar + '"');
-    env.summary.push('composer: ' + (/\d+\.\d+\.\d+/.exec(execOutput(path.join(home, 'php.exe'), [phar, '--version', '--no-ansi']))?.[0] ?? 'installed'));
-};

package/dist/selftest/guest.test.d.ts

@@ -1,3 +0,0 @@
-import type { Fixtures } from './fixtures.js';
-import type { Harness } from './harness.js';
-export declare const guestTests: (t: Harness, f: Fixtures) => Promise<string>;