windows-development-sandbox 1.0.5 → 1.4.0

package/dist/guest/toolchains/python.js

@@ -5,6 +5,7 @@ import { fetchJson, installArchive } from '../../shared/download.js';
 import { dryRun, execAsync, exists, log, mkdirp } from '../env.js';
 import { resolveCached, tool } from './common.js';
 import { pickPackageVersion } from './versions.js';
+import { duringSession } from '../project-context.js';
 const installPython = async (pkg, spec) => {
     const version = await resolveCached(pkg + ':' + spec, async () => {
         const { versions } = await fetchJson('https://api.nuget.org/v3-flatcontainer/' + pkg + '/index.json');
@@ -13,21 +14,47 @@ const installPython = async (pkg, spec) => {
     const dir = tool('python', pkg + '-' + version);
     const exe = path.join(dir, 'python.exe');
     if (!exists(exe)) {
-        log('Downloading ' + pkg + ' ' + version + ' ...');
+        log('Downloading Python ' + version + (pkg === 'python2' ? ' (Python 2, ' : ' (') + '~30 MB once) ...');
         await installArchive('https://api.nuget.org/v3-flatcontainer/' + pkg + '/' + version + '/' + pkg + '.' + version + '.nupkg', dir, { locate: 'python.exe', fileName: pkg + '.' + version + '.zip' });
     }
     if (!exists(path.join(dir, 'Scripts', 'pip.exe')) && !exists(path.join(dir, 'Scripts', 'pip2.exe')))
         await execAsync(exe, ['-m', 'ensurepip', '--default-pip'], { stdio: 'ignore' });
     return dir;
 };
-/** Writes `<name>.cmd` into tools\shims, e.g. python2.cmd. */
-const shim = (name, command) => {
-    fs.writeFileSync(path.join(mkdirp(tool('shims')), name + '.cmd'), '@echo off\r\n' + command + ' %*\r\n');
+/**
+ * The shims folder: tools\shims at boot. A project added later gets one per Python version (tools\shims\<version>)
+ * so the boot project's python3.cmd keeps pointing at its own version.
+ */
+const shimDir = (dir) => (duringSession() ? tool('shims', path.basename(dir)) : tool('shims'));
+/** Writes `<name>.cmd` into the shims folder, e.g. python2.cmd. */
+const shim = (folder, name, command) => {
+    fs.writeFileSync(path.join(mkdirp(folder), name + '.cmd'), '@echo off\r\n' + command + ' %*\r\n');
 };
-const shimPair = (version, dir) => {
+const shimPair = (folder, version, dir) => {
     const python = '"' + path.join(dir, 'python.exe') + '"';
-    shim('python' + version, python);
-    shim('pip' + version, python + ' -m pip');
+    shim(folder, 'python' + version, python);
+    shim(folder, 'pip' + version, python + ' -m pip');
+};
+/**
+ * `py` like the Python launcher Windows installs: `py -3 x.py`, `py -3.12 ...`, `py -2 ...`, `py x.py`. The launcher
+ * itself is not portable, so py.cmd runs a small script that picks the interpreter (cmd's %* ignores shift).
+ */
+const pyLauncher = (folder, py3, py2) => {
+    const script = path.join(mkdirp(folder), 'py-launcher.py');
+    fs.writeFileSync(script, [
+        'import subprocess, sys',
+        'PY3, PY2 = ' + JSON.stringify(path.join(py3, 'python.exe')) + ', ' + JSON.stringify(py2 ? path.join(py2, 'python.exe') : null),
+        'args = sys.argv[1:]',
+        'exe = PY3',
+        "if args and args[0].startswith('-2'):",
+        '    if not PY2: sys.exit("py: Python 2 is not installed (toolchains.python.python2)")',
+        '    exe, args = PY2, args[1:]',
+        "elif args and (args[0] == '-3' or args[0].startswith('-3.') or args[0].startswith('-3-')):",
+        '    args = args[1:]',
+        'sys.exit(subprocess.call([exe] + args))',
+        '',
+    ].join('\n'));
+    shim(folder, 'py', '"' + path.join(py3, 'python.exe') + '" "' + script + '"');
 };
 export const setupPython = async (env, config, versions) => {
     if (dryRun) {
@@ -35,13 +62,17 @@ export const setupPython = async (env, config, versions) => {
         return;
     }
     const py3 = await installPython('python', versions.python.spec);
-    shimPair('3', py3);
-    env.prepend.push(py3, path.join(py3, 'Scripts'), tool('shims'));
+    const shims = shimDir(py3);
+    shimPair(shims, '3', py3);
+    env.prepend.push(py3, path.join(py3, 'Scripts'), shims);
     env.vars.PYTHONIOENCODING = 'utf-8';
-    env.summary.push('python: ' + path.basename(py3).replace('python-', '') + ' (from ' + versions.python.source + ')');
-    if (!config.python2)
+    env.summary.push('python: ' + path.basename(py3).replace('python-', '') + ' (from ' + versions.python.source + '; py works too)');
+    if (!config.python2) {
+        pyLauncher(shims, py3, null);
         return;
+    }
     const py2 = await installPython('python2', '2.7');
-    shimPair('2', py2);
+    shimPair(shims, '2', py2);
+    pyLauncher(shims, py3, py2);
     env.summary.push('python2: ' + path.basename(py2).replace('python2-', ''));
 };

package/dist/guest/toolchains/runtimes.d.ts

@@ -7,6 +7,8 @@ export interface SingleExeOptions {
     versionArgs?: string[];
     /** Appended to the summary line, e.g. " (PowerShell 7)". */
     note?: string;
+    /** Rough download size for the progress line, e.g. "35 MB". */
+    size?: string;
 }
 /** A tool from one GitHub release archive, into `dir` (atomically), on PATH. */
 export declare const setupSingleExe: (env: ToolEnv, name: string, repo: string, pattern: RegExp, exeName: string, dir: string, options?: SingleExeOptions) => Promise<void>;

package/dist/guest/toolchains/runtimes.js

@@ -1,8 +1,7 @@
 // Bun, uv and Deno: single-binary tools from GitHub releases (claude-mem needs Bun and uv).
 import path from 'node:path';
-import { githubAsset, installArchive } from '../../shared/download.js';
 import { dryRun, exists, localDir, log } from '../env.js';
-import { arch, tool, versionOf } from './common.js';
+import { arch, installFromGithub, tool, versionOf } from './common.js';
 /** A tool from one GitHub release archive, into `dir` (atomically), on PATH. */
 export const setupSingleExe = async (env, name, repo, pattern, exeName, dir, options = {}) => {
     if (dryRun) {
@@ -12,9 +11,8 @@ export const setupSingleExe = async (env, name, repo, pattern, exeName, dir, opt
     const bin = options.subdir ? path.join(dir, options.subdir) : dir;
     const exe = path.join(bin, exeName);
     if (!exists(exe) || options.refresh) {
-        const asset = await githubAsset(repo, pattern);
-        log('Downloading ' + asset.name + ' ...');
-        await installArchive(asset.url, dir, { sha256: asset.sha256, fileName: asset.name, ...(options.subdir ? {} : { locate: exeName }) });
+        const size = options.size ? ', ~' + options.size : '';
+        await installFromGithub(repo, pattern, { dest: dir, what: (a) => name + ' (' + a.name + size + ' once)', ...(options.subdir ? {} : { locate: exeName }) });
     }
     if (!exists(exe))
         throw new Error(exeName + ' missing after installing ' + name);
@@ -22,19 +20,19 @@ export const setupSingleExe = async (env, name, repo, pattern, exeName, dir, opt
     env.summary.push(name + ': ' + versionOf(exe, options.versionArgs) + (options.note ?? ''));
 };
 export const setupBun = async (env) => {
-    await setupSingleExe(env, 'bun', 'oven-sh/bun', arch === 'arm64' ? /^bun-windows-aarch64\.zip$/ : /^bun-windows-x64\.zip$/, 'bun.exe', tool('bun', 'bin'));
+    await setupSingleExe(env, 'bun', 'oven-sh/bun', arch === 'arm64' ? /^bun-windows-aarch64\.zip$/ : /^bun-windows-x64\.zip$/, 'bun.exe', tool('bun', 'bin'), { size: '35 MB' });
     // Bun cannot keep its cache or temp files on a mapped folder (EINVAL); they go to the sandbox's own disk.
     Object.assign(env.vars, { BUN_INSTALL: tool('bun'), BUN_INSTALL_CACHE_DIR: path.join(localDir, 'bun-cache'), BUN_TMPDIR: path.join(localDir, 'bun-tmp') });
 };
 export const setupDeno = async (env) => {
-    await setupSingleExe(env, 'deno', 'denoland/deno', arch === 'arm64' ? /^deno-aarch64-pc-windows-msvc[.]zip$/ : /^deno-x86_64-pc-windows-msvc[.]zip$/, 'deno.exe', tool('deno', 'bin'));
+    await setupSingleExe(env, 'deno', 'denoland/deno', arch === 'arm64' ? /^deno-aarch64-pc-windows-msvc[.]zip$/ : /^deno-x86_64-pc-windows-msvc[.]zip$/, 'deno.exe', tool('deno', 'bin'), { size: '40 MB' });
     // `deno install` puts commands in DENO_INSTALL_ROOT/bin: the folder deno.exe is in, already on PATH.
     Object.assign(env.vars, { DENO_DIR: tool('deno-cache'), DENO_INSTALL_ROOT: tool('deno'), DENO_NO_UPDATE_CHECK: '1' });
 };
 /** Where uv keeps its cache, Pythons and tools (persistent). */
 export const uvVars = () => ({ UV_CACHE_DIR: tool('uv-cache'), UV_PYTHON_INSTALL_DIR: tool('uv-python'), UV_TOOL_DIR: tool('uv-tools'), UV_TOOL_BIN_DIR: tool('uv-bin') });
 export const setupUv = async (env) => {
-    await setupSingleExe(env, 'uv', 'astral-sh/uv', arch === 'arm64' ? /^uv-aarch64-pc-windows-msvc\.zip$/ : /^uv-x86_64-pc-windows-msvc\.zip$/, 'uv.exe', tool('uv'));
+    await setupSingleExe(env, 'uv', 'astral-sh/uv', arch === 'arm64' ? /^uv-aarch64-pc-windows-msvc\.zip$/ : /^uv-x86_64-pc-windows-msvc\.zip$/, 'uv.exe', tool('uv'), { size: '20 MB' });
     Object.assign(env.vars, uvVars());
     env.prepend.push(tool('uv-bin'));
 };

package/dist/guest/toolchains/scripting/php.d.ts

@@ -0,0 +1,3 @@
+import type { Toolchains } from '../../../core/types.js';
+import { type ToolEnv } from '../common.js';
+export declare const setupPhp: (env: ToolEnv, config: Toolchains["php"]) => Promise<void>;

package/dist/guest/toolchains/scripting/php.js

@@ -0,0 +1,71 @@
+// PHP from windows.php.net, with Composer. Composer's global packages live in persistent storage.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fetchJson, fetchText, installArchive } from '../../../shared/download.js';
+import { dryRun, execOutput, exists, log, mkdirp } from '../../env.js';
+import { downloadFile, resolveCached, tool, versionFromFiles } from '../common.js';
+import { pickPackageVersion } from '../versions.js';
+import { setupVcRuntime } from './vcruntime.js';
+const PHP_EXTENSIONS = ['curl', 'fileinfo', 'gd', 'intl', 'mbstring', 'openssl', 'pdo_mysql', 'pdo_pgsql', 'pdo_sqlite', 'sodium', 'sqlite3', 'zip'];
+const COMPOSER = 'https://getcomposer.org/download/latest-stable/composer.phar';
+/** The non-thread-safe x64 zip of the newest release matching `spec` ("8" -> newest 8.x, "8.3" -> newest 8.3.x). */
+const phpBuild = async (spec) => {
+    const releases = await fetchJson('https://windows.php.net/downloads/releases/releases.json');
+    const pick = pickPackageVersion(Object.values(releases).map((r) => r.version), spec);
+    const release = Object.values(releases).find((r) => r.version === pick);
+    const build = release && Object.entries(release).find(([key, value]) => /^nts-vs\d+-x64$/.test(key) && typeof value === 'object' && value.zip)?.[1];
+    if (!release || typeof build !== 'object' || !build.zip)
+        throw new Error('No PHP build for Windows matches "' + spec + '"');
+    return { version: release.version, ...build.zip };
+};
+/** php.ini from the development template with the common extensions switched on (written whole, then renamed). */
+const writePhpIni = (home) => {
+    const ini = path.join(home, 'php.ini');
+    if (exists(ini) || !exists(path.join(home, 'php.ini-development')))
+        return;
+    let text = fs.readFileSync(path.join(home, 'php.ini-development'), 'utf8')
+        .replace(/^;\s*extension_dir\s*=\s*"ext"/m, 'extension_dir = "' + path.join(home, 'ext') + '"');
+    for (const ext of PHP_EXTENSIONS.filter((e) => exists(path.join(home, 'ext', 'php_' + e + '.dll'))))
+        text = text.replace(new RegExp('^;(extension=' + ext + ')\\s*$', 'm'), '$1');
+    fs.writeFileSync(ini + '.tmp', text);
+    fs.renameSync(ini + '.tmp', ini);
+};
+/** Writes `<name>.cmd` into tools\shims (on PATH). */
+const shim = (env, name, command) => {
+    fs.writeFileSync(path.join(mkdirp(tool('shims')), name + '.cmd'), '@echo off\r\n' + command + ' %*\r\n');
+    env.prepend.push(tool('shims'));
+};
+const setupComposer = async (env, php) => {
+    const phar = tool('composer', 'composer.phar');
+    if (!exists(phar)) {
+        log('Downloading Composer (~3 MB once) ...');
+        const sha256 = (await fetchText(COMPOSER + '.sha256sum')).trim().split(/\s+/)[0];
+        await downloadFile(COMPOSER, phar, sha256);
+    }
+    const composerHome = tool('composer-home');
+    env.vars.COMPOSER_HOME = composerHome;
+    env.prepend.push(path.join(composerHome, 'vendor', 'bin'));
+    shim(env, 'composer', '"' + php + '" "' + phar + '"');
+    env.summary.push('composer: ' + (/\d+\.\d+\.\d+/.exec(execOutput(php, [phar, '--version', '--no-ansi']))?.[0] ?? 'installed'));
+};
+export const setupPhp = async (env, config) => {
+    const wantedSpec = versionFromFiles(['.php-version']) ?? { spec: config.version, source: 'config' };
+    if (dryRun) {
+        log('(dry run) would provision PHP ' + wantedSpec.spec + (config.composer ? ' + Composer' : ''));
+        return;
+    }
+    // No summary line of its own: the Visual C++ runtime step (which runs first) already reports it.
+    await setupVcRuntime(env, false);
+    const version = await resolveCached('php:' + wantedSpec.spec, async () => (await phpBuild(wantedSpec.spec)).version);
+    const home = tool('php', version);
+    if (!exists(path.join(home, 'php.exe'))) {
+        const build = await phpBuild(version);
+        log('Downloading PHP ' + version + ' (~30 MB once) ...');
+        await installArchive('https://windows.php.net/downloads/releases/' + build.path, home, { sha256: build.sha256, locate: 'php.exe', fileName: build.path });
+    }
+    writePhpIni(home);
+    env.prepend.push(home);
+    env.summary.push('php: ' + version + ' (from ' + wantedSpec.source + ')');
+    if (config.composer)
+        await setupComposer(env, path.join(home, 'php.exe'));
+};

package/dist/guest/toolchains/scripting/ruby.d.ts

@@ -0,0 +1,3 @@
+import type { Toolchains } from '../../../core/types.js';
+import { type ToolEnv } from '../common.js';
+export declare const setupRuby: (env: ToolEnv, config: Toolchains["ruby"]) => Promise<void>;

package/dist/guest/toolchains/scripting/ruby.js

@@ -0,0 +1,47 @@
+// Ruby from RubyInstaller. Gems live in persistent storage.
+import path from 'node:path';
+import { fetchJson, installArchive } from '../../../shared/download.js';
+import { SYSTEM } from '../../../shared/system.js';
+import { dryRun, execAsync, exists, log } from '../../env.js';
+import { installOnce, resolveCached, tool, versionFromFiles, versionOf } from '../common.js';
+import { pickPackageVersion } from '../versions.js';
+const RUBY_ASSET = /^rubyinstaller-(\d+\.\d+\.\d+)-(\d+)-x64\.7z$/;
+/** The build number after the version in a RubyInstaller file name (rubyinstaller-3.3.1-1-x64.7z -> 1). */
+const buildNumber = (asset) => Number(RUBY_ASSET.exec(asset.name)?.[2] ?? 0);
+/** RubyInstaller builds per Ruby version (newest build of each), from its GitHub releases. */
+const rubyBuilds = async () => {
+    const releases = await fetchJson('https://api.github.com/repos/oneclick/rubyinstaller2/releases?per_page=100');
+    const builds = new Map();
+    for (const asset of releases.filter((r) => !r.draft && !r.prerelease).flatMap((r) => r.assets)) {
+        const version = RUBY_ASSET.exec(asset.name)?.[1];
+        if (!version)
+            continue;
+        const known = builds.get(version);
+        if (!known || buildNumber(known) < buildNumber(asset))
+            builds.set(version, asset);
+    }
+    return builds;
+};
+const sha256Of = (asset) => (asset.digest?.startsWith('sha256:') ? asset.digest.slice(7) : null);
+export const setupRuby = async (env, config) => {
+    const wantedSpec = versionFromFiles(['.ruby-version']) ?? { spec: config.version, source: 'config' };
+    if (dryRun) {
+        log('(dry run) would provision Ruby ' + wantedSpec.spec);
+        return;
+    }
+    const version = await resolveCached('ruby:' + wantedSpec.spec, async () => pickPackageVersion([...(await rubyBuilds()).keys()], wantedSpec.spec) ?? Promise.reject(new Error('No RubyInstaller build matches "' + wantedSpec.spec + '"')));
+    const home = tool('ruby', version);
+    if (!exists(path.join(home, 'bin', 'ruby.exe'))) {
+        const asset = (await rubyBuilds()).get(version);
+        if (!asset)
+            throw new Error('RubyInstaller ' + version + ' is no longer published');
+        log('Downloading Ruby ' + version + ' (~100 MB once) ...');
+        await installArchive(asset.browser_download_url, home, { sha256: sha256Of(asset), locate: 'ruby.exe', up: 1, fileName: asset.name });
+    }
+    const gems = tool('ruby-gems', version.split('.').slice(0, 2).join('.'));
+    Object.assign(env.vars, { GEM_HOME: gems, BUNDLE_USER_HOME: tool('bundle-home') });
+    env.prepend.push(path.join(home, 'bin'), path.join(gems, 'bin'));
+    env.summary.push('ruby: ' + versionOf(path.join(home, 'bin', 'ruby.exe')) + ' (from ' + wantedSpec.source + '; gems with C extensions need MSYS2, not included)');
+    const gem = path.join(home, 'bin', 'gem.cmd');
+    await installOnce(env, 'gem@' + version, config.gems, (pkg) => execAsync(SYSTEM.cmd(), ['/d', '/c', gem, 'install', pkg, '--no-document'], { env: { ...process.env, GEM_HOME: gems } }));
+};

package/dist/guest/toolchains/scripting/vcruntime.d.ts

@@ -0,0 +1,7 @@
+import { type ToolEnv } from '../common.js';
+/**
+ * A real installer (it writes to System32), so it runs on every boot; the installer itself is kept in persistent
+ * storage and only run when Microsoft's signature on it checks out. Resolves true when this call ran the installer.
+ * Only the "Visual C++ runtime" step reports it (`summary`); PHP calls it again just to be sure.
+ */
+export declare const setupVcRuntime: (env: ToolEnv, summary?: boolean) => Promise<boolean>;

package/dist/guest/toolchains/scripting/vcruntime.js

@@ -0,0 +1,45 @@
+// The Visual C++ runtime (vcruntime140.dll & co.) that PHP and other native tools need.
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnAsync } from '../../../shared/download.js';
+import { SYSTEM } from '../../../shared/system.js';
+import { dryRun, execOutput, exists, log } from '../../env.js';
+import { downloadFile, tool } from '../common.js';
+const VC_REDIST = 'https://aka.ms/vs/17/release/vc_redist.x64.exe';
+const MICROSOFT_SIGNER = 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US';
+/** 1638: a newer version is already installed; 3010: installed, a restart would finish it (not needed for the DLLs). */
+const OK_EXIT_CODES = [0, 1638, 3010];
+/** The subject of a valid Authenticode signature, or '' when the file is unsigned or tampered with. */
+const signerOf = (file) => execOutput(SYSTEM.powershell(), ['-NoLogo', '-NoProfile', '-Command',
+    "$s = Get-AuthenticodeSignature -LiteralPath '" + file.replace(/'/g, "''") + "'; if ($s.Status -eq 'Valid') { $s.SignerCertificate.Subject }"]).trim();
+/**
+ * A real installer (it writes to System32), so it runs on every boot; the installer itself is kept in persistent
+ * storage and only run when Microsoft's signature on it checks out. Resolves true when this call ran the installer.
+ * Only the "Visual C++ runtime" step reports it (`summary`); PHP calls it again just to be sure.
+ */
+export const setupVcRuntime = async (env, summary = true) => {
+    if (dryRun) {
+        log('(dry run) would install the Visual C++ runtime');
+        return false;
+    }
+    const system32 = path.join(process.env.WINDIR ?? 'C:\\Windows', 'System32');
+    const missing = !exists(path.join(system32, 'vcruntime140.dll')) || !exists(path.join(system32, 'msvcp140.dll'));
+    if (missing) {
+        const installer = tool('vcredist', 'vc_redist.x64.exe');
+        if (!exists(installer)) {
+            log('Downloading the Visual C++ runtime (~25 MB once) ...');
+            await downloadFile(VC_REDIST, installer);
+        }
+        if (signerOf(installer) !== MICROSOFT_SIGNER) {
+            fs.rmSync(installer, { force: true });
+            throw new Error('vc_redist.x64.exe is not signed by Microsoft; deleted it (it is downloaded again next boot)');
+        }
+        log('Installing the Visual C++ runtime ...');
+        const code = await spawnAsync(installer, ['/install', '/quiet', '/norestart']);
+        if (!OK_EXIT_CODES.includes(code ?? -1) || !exists(path.join(system32, 'vcruntime140.dll')))
+            throw new Error('the Visual C++ runtime installer failed (exit ' + code + ')');
+    }
+    if (summary)
+        env.summary.push('vc++ runtime: installed');
+    return missing;
+};

package/dist/guest/toolchains/vscode-profile.d.ts

@@ -0,0 +1,30 @@
+/** Where the sandbox's tools are (absent = not installed). */
+export interface ToolPaths {
+    javaHome?: string;
+    python?: string;
+    goRoot?: string;
+    go?: string;
+    gcc?: string;
+    cl?: string;
+    cmake?: string;
+    dotnet?: string;
+    node?: string;
+    pwsh?: string;
+    git?: string;
+    bash?: string;
+    php?: string;
+    ruby?: string;
+    deno?: string;
+}
+/** User settings for the sandbox's VS Code. Only keys with a value are set; the caller removes the ones it set before. */
+export declare const vscodeSettings: (p: ToolPaths) => Record<string, unknown>;
+export declare const EXTENSION_ID: RegExp;
+/** The extensions to have: always EditorConfig, then per toolchain and database in use, the project's, and yours. */
+export declare const vscodeExtensions: (o: {
+    toolchains: string[];
+    databases: string[];
+    recommended: string[];
+    extra: string[];
+}) => string[];
+/** Extensions not installed yet, from the names of the folders in VS Code's extensions folder (publisher.name-1.2.3). */
+export declare const missingExtensions: (wanted: string[], folders: string[]) => string[];

package/dist/guest/toolchains/vscode-profile.js

@@ -0,0 +1,69 @@
+// What VS Code is told about the sandbox: the settings that point it at the sandbox's own tools, and the extensions
+// for the languages in use. Pure (tested); vscode.ts finds the paths and writes them.
+/** The JDK's major version from its folder name (jdk-21.0.5+11 -> 21). */
+const javaMajor = (home) => /(?:jdk|jre)?-?(\d{1,2})(?:[.+_-]|$)/i.exec(home.split(/[\\/]/).pop() ?? '')?.[1];
+/** User settings for the sandbox's VS Code. Only keys with a value are set; the caller removes the ones it set before. */
+export const vscodeSettings = (p) => {
+    const profiles = {};
+    if (p.pwsh)
+        profiles['PowerShell 7'] = { path: p.pwsh, args: ['-NoLogo'] };
+    if (p.bash)
+        profiles['Git Bash'] = { path: p.bash, args: ['--login', '-i'] };
+    const settings = {
+        'telemetry.telemetryLevel': 'off',
+        'update.mode': 'none',
+        'workbench.startupEditor': 'none',
+        'git.path': p.git,
+        'terminal.integrated.profiles.windows': Object.keys(profiles).length ? profiles : undefined,
+        'terminal.integrated.defaultProfile.windows': p.pwsh ? 'PowerShell 7' : undefined,
+        'python.defaultInterpreterPath': p.python,
+        'java.jdt.ls.java.home': p.javaHome,
+        'java.configuration.runtimes': p.javaHome ? [{ name: 'JavaSE-' + (javaMajor(p.javaHome) ?? '21'), path: p.javaHome, default: true }] : undefined,
+        'maven.terminal.useJavaHome': p.javaHome ? true : undefined,
+        'go.goroot': p.goRoot,
+        'go.alternateTools': p.go ? { go: p.go } : undefined,
+        'C_Cpp.default.compilerPath': p.cl ?? p.gcc,
+        'cmake.cmakePath': p.cmake,
+        'dotnet.dotnetPath': p.dotnet ? p.dotnet.replace(/[\\/]dotnet\.exe$/i, '') : undefined,
+        'dotnetAcquisitionExtension.existingDotnetPath': p.dotnet ? [{ extensionId: 'ms-dotnettools.csharp', path: p.dotnet }] : undefined,
+        'php.validate.executablePath': p.php,
+        'php.debug.executablePath': p.php,
+        'rubyLsp.rubyVersionManager': p.ruby ? { identifier: 'none' } : undefined,
+        'deno.path': p.deno,
+        'powershell.powerShellAdditionalExePaths': p.pwsh ? { 'PowerShell 7 (sandbox)': p.pwsh } : undefined,
+        'npm.packageManager': 'auto',
+    };
+    return Object.fromEntries(Object.entries(settings).filter(([, v]) => v !== undefined));
+};
+/** Extensions per toolchain (Marketplace ids). */
+const BY_TOOLCHAIN = {
+    node: ['dbaeumer.vscode-eslint', 'esbenp.prettier-vscode'],
+    python: ['ms-python.python', 'ms-python.debugpy'],
+    java: ['redhat.java', 'vscjava.vscode-java-debug', 'vscjava.vscode-java-test', 'vscjava.vscode-maven', 'vscjava.vscode-gradle'],
+    go: ['golang.go'],
+    rust: ['rust-lang.rust-analyzer', 'vadimcn.vscode-lldb'],
+    cpp: ['ms-vscode.cpptools', 'ms-vscode.cmake-tools'],
+    msvc: ['ms-vscode.cpptools', 'ms-vscode.cmake-tools'],
+    dotnet: ['ms-dotnettools.csharp'],
+    ruby: ['shopify.ruby-lsp'],
+    php: ['bmewburn.vscode-intelephense-client', 'xdebug.php-debug'],
+    deno: ['denoland.vscode-deno'],
+    pwsh: ['ms-vscode.powershell'],
+};
+const BY_DATABASE = {
+    postgres: ['mtxr.sqltools', 'mtxr.sqltools-driver-pg'],
+    mysql: ['mtxr.sqltools', 'mtxr.sqltools-driver-mysql'],
+    mongodb: ['mongodb.mongodb-vscode'],
+    redis: ['redis.redis-for-vscode'],
+};
+export const EXTENSION_ID = /^[\w-]+\.[\w-]+$/;
+/** The extensions to have: always EditorConfig, then per toolchain and database in use, the project's, and yours. */
+export const vscodeExtensions = (o) => {
+    const all = ['editorconfig.editorconfig', ...o.toolchains.flatMap((t) => BY_TOOLCHAIN[t] ?? []), ...o.databases.flatMap((d) => BY_DATABASE[d] ?? []), ...o.recommended, ...o.extra];
+    return [...new Set(all.map((e) => e.toLowerCase()))].filter((e) => EXTENSION_ID.test(e));
+};
+/** Extensions not installed yet, from the names of the folders in VS Code's extensions folder (publisher.name-1.2.3). */
+export const missingExtensions = (wanted, folders) => {
+    const have = folders.map((f) => f.toLowerCase());
+    return wanted.filter((id) => !have.some((f) => f.startsWith(id + '-')));
+};

package/dist/guest/toolchains/vscode.d.ts

@@ -1,2 +1,19 @@
+import type { Toolchains } from '../../core/types.js';
 import { type ToolEnv } from './common.js';
+/**
+ * After every toolchain is installed: points VS Code at the sandbox's own JDK, Python, Go, compilers, .NET, Git and
+ * terminals (user settings; only the keys this tool manages are changed, your own stay), and installs the extensions
+ * for the languages in use in the background (they persist, so only new ones are downloaded).
+ */
+export declare const configureVscode: (tools: {
+    vars: Record<string, string>;
+    prepend: string[];
+    append: string[];
+    summary: string[];
+}, o: {
+    toolchains: string[];
+    databases: string[];
+    config: Toolchains["vscode"];
+    workspace: string;
+}) => void;
 export declare const setupVscode: (env: ToolEnv, refresh: boolean) => Promise<void>;

package/dist/guest/toolchains/vscode.js

@@ -3,9 +3,13 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { applyEdits, modify, parse as parseJsonc } from 'jsonc-parser';
 import { fetchJson, installArchive } from '../../shared/download.js';
-import { dryRun, exists, isWin, log, mkdirp, powershell } from '../env.js';
+import { SYSTEM } from '../../shared/system.js';
+import { dryRun, exists, isWin, log, logsDir, mkdirp, powershell } from '../env.js';
 import { arch, tool } from './common.js';
+import { EXTENSION_ID, missingExtensions, vscodeExtensions, vscodeSettings } from './vscode-profile.js';
 /** Newer builds keep their files under a commit-hash folder, so the installed version is recorded here. */
 const VERSION_MARKER = '.agent-sandbox-version';
 const desktopShortcut = (exe) => {
@@ -15,6 +19,88 @@ const desktopShortcut = (exe) => {
     const q = (s) => "'" + s.replace(/'/g, "''") + "'";
     powershell('$s = (New-Object -ComObject WScript.Shell).CreateShortcut(' + q(link) + '); $s.TargetPath = ' + q(exe) + '; $s.Arguments = ' + q('"' + (process.env.AGENT_WORKSPACE ?? '') + '"') + '; $s.Save()');
 };
+/** The first of `names` in one of `dirs`. */
+const findIn = (dirs, ...names) => {
+    for (const dir of dirs)
+        for (const name of names) {
+            const file = path.join(dir, name);
+            if (exists(file))
+                return file;
+        }
+    return undefined;
+};
+/** The project's .vscode/extensions.json recommendations (bounded; anything odd is ignored). */
+const recommendedBy = (workspace) => {
+    const file = path.join(workspace, '.vscode', 'extensions.json');
+    try {
+        if (!exists(file) || fs.statSync(file).size > 64 * 1024)
+            return [];
+        const data = parseJsonc(fs.readFileSync(file, 'utf8'));
+        return Array.isArray(data?.recommendations) ? data.recommendations.filter((r) => typeof r === 'string' && EXTENSION_ID.test(r)).slice(0, 50) : [];
+    }
+    catch {
+        return [];
+    }
+};
+/**
+ * After every toolchain is installed: points VS Code at the sandbox's own JDK, Python, Go, compilers, .NET, Git and
+ * terminals (user settings; only the keys this tool manages are changed, your own stay), and installs the extensions
+ * for the languages in use in the background (they persist, so only new ones are downloaded).
+ */
+export const configureVscode = (tools, o) => {
+    const root = tool('vscode');
+    const code = path.join(root, 'bin', 'code.cmd');
+    if (dryRun) {
+        log('(dry run) would set up VS Code for: ' + o.toolchains.join(', '));
+        return;
+    }
+    if (!exists(path.join(root, 'Code.exe')))
+        return;
+    const dirs = [...tools.prepend, ...tools.append];
+    const git = findIn([tool('git', 'cmd'), ...dirs], 'git.exe');
+    const settings = vscodeSettings({
+        javaHome: tools.vars.JAVA_HOME, goRoot: tools.vars.GOROOT, go: findIn(dirs, 'go.exe'), python: findIn(dirs, 'python.exe'), gcc: findIn(dirs, 'gcc.exe'), cl: findIn(dirs, 'cl.exe'),
+        cmake: findIn(dirs, 'cmake.exe'), dotnet: findIn(dirs, 'dotnet.exe'), node: findIn(dirs, 'node.exe'), pwsh: findIn(dirs, 'pwsh.exe'), git,
+        bash: git ? findIn([path.join(path.dirname(path.dirname(git)), 'bin')], 'bash.exe') : undefined, php: findIn(dirs, 'php.exe'), ruby: findIn(dirs, 'ruby.exe'), deno: findIn(dirs, 'deno.exe'),
+    });
+    writeManagedSettings(path.join(root, 'data', 'user-data', 'User', 'settings.json'), path.join(root, 'data', '.agent-sandbox-managed.json'), settings);
+    const wanted = vscodeExtensions({ toolchains: o.toolchains, databases: o.databases, recommended: o.config.recommended ? recommendedBy(o.workspace) : [], extra: o.config.extensions });
+    let folders = [];
+    try {
+        folders = fs.readdirSync(path.join(root, 'data', 'extensions'));
+    }
+    catch { /* none yet */ }
+    const missing = missingExtensions(wanted, folders);
+    tools.summary.push('vscode: set up for ' + (o.toolchains.join(', ') || 'Node') + (missing.length ? '; installing ' + missing.length + ' extension(s) in the background' : '; extensions ready'));
+    if (!missing.length)
+        return;
+    // In the background: the Marketplace can take a minute, and nothing else waits for it.
+    const logFile = fs.openSync(path.join(logsDir, 'vscode-extensions.log'), 'a');
+    spawn(SYSTEM.cmd(), ['/d', '/c', code, ...missing.flatMap((id) => ['--install-extension', id])], { detached: true, stdio: ['ignore', logFile, logFile], windowsHide: true }).unref();
+    fs.closeSync(logFile);
+};
+/**
+ * Sets `values` in a settings file, keeping everything else (comments too), and removes keys this tool set last time
+ * but no longer has a value for (a toolchain turned off). The keys it manages are remembered in `managedFile`.
+ */
+const writeManagedSettings = (file, managedFile, values) => {
+    let text = exists(file) ? fs.readFileSync(file, 'utf8') : '{}';
+    let before = [];
+    try {
+        before = JSON.parse(fs.readFileSync(managedFile, 'utf8'));
+    }
+    catch { /* first time */ }
+    const format = { formattingOptions: { insertSpaces: true, tabSize: 2, eol: '\n' } };
+    for (const key of before.filter((k) => !(k in values))) {
+        if (parseJsonc(text)?.[key] !== undefined)
+            text = applyEdits(text, modify(text, [key], undefined, format));
+    }
+    for (const [key, value] of Object.entries(values))
+        text = applyEdits(text, modify(text, [key], value, format));
+    mkdirp(path.dirname(file));
+    fs.writeFileSync(file, text);
+    fs.writeFileSync(managedFile, JSON.stringify(Object.keys(values)));
+};
 export const setupVscode = async (env, refresh) => {
     const root = tool('vscode');
     const exe = path.join(root, 'Code.exe');

package/dist/guest/view.js

@@ -3,8 +3,28 @@
 import { connect, runTerminalClient } from '../shared/pty-client.js';
 import { readSession } from '../shared/rundir.js';
 import { dataDir } from './env.js';
+/** A session that is still being set up (its project provisioning, its agent installing): show the progress until it runs. */
+const waitUntilStarted = async (id) => {
+    let last = '';
+    for (let i = 0; i < 3600; i++) {
+        const s = readSession(dataDir, id);
+        if (s && s.phase !== 'starting')
+            return s;
+        if (s && s.message !== last) {
+            console.log('  ' + s.message);
+            last = s.message;
+        }
+        await new Promise((r) => setTimeout(r, 500));
+    }
+    return readSession(dataDir, id);
+};
 export const viewSession = async (id) => {
-    const session = readSession(dataDir, id);
+    const session = await waitUntilStarted(id);
+    if (session?.phase === 'failed') {
+        console.error('Session ' + id + ' could not start: ' + session.message);
+        await new Promise((r) => setTimeout(r, 30000));
+        return 1;
+    }
     if (!session?.attach) {
         console.error('Session ' + id + ' is not running.');
         return 1;