windows-development-sandbox 1.0.5 → 1.4.0

package/dist/guest/toolchains/databases.js

@@ -1,226 +0,0 @@
-// Databases inside the sandbox: PostgreSQL, MariaDB (MySQL-compatible), MongoDB and Redis. Binaries live in
-// C:\AgentData\tools, data in C:\AgentData\databases (both persist), and every server listens on localhost only.
-// Which ones run was decided on the host (session.databases): only what the project needs.
-import fs from 'node:fs';
-import net from 'node:net';
-import path from 'node:path';
-import { spawn, spawnSync } from 'node:child_process';
-import { fetchJson, fetchText, githubAsset, installArchive } from '../../shared/download.js';
-import { SYSTEM } from '../../shared/system.js';
-import { ensureJdk } from './java.js';
-import { dataDir, dryRun, execAsync, exists, log, logsDir, mkdirp } from '../env.js';
-import { resolveCached, tool } from './common.js';
-const dataFor = (name) => path.join(dataDir, 'databases', name);
-export const portOpen = (port) => new Promise((resolve) => {
-    const socket = net.connect({ host: '127.0.0.1', port }, () => { socket.destroy(); resolve(true); });
-    socket.once('error', () => resolve(false));
-});
-const waitForPort = async (port, seconds) => {
-    for (const end = Date.now() + seconds * 1000; Date.now() < end;) {
-        if (await portOpen(port))
-            return true;
-        await new Promise((r) => setTimeout(r, 300));
-    }
-    return false;
-};
-/** Starts a server detached (it outlives the boot script) with its output in logs\<name>.log, and waits for its port. */
-const startServer = async (name, exe, args, port) => {
-    if (await portOpen(port))
-        throw new Error('port ' + port + ' is already in use (change databases.' + name + '.port)');
-    const logFile = path.join(logsDir, name + '.log');
-    const out = fs.openSync(logFile, 'a');
-    spawn(exe, args, { detached: true, stdio: ['ignore', out, out], windowsHide: true }).unref();
-    fs.closeSync(out);
-    if (!(await waitForPort(port, 60)))
-        throw new Error(name + ' did not start listening on port ' + port + '; see ' + logFile);
-};
-/** Lock files a sandbox that was closed without shutting the server down leaves behind (this VM never ran it). */
-const clearStaleLocks = (dir, files) => { for (const f of files)
-    fs.rmSync(path.join(dir, f), { force: true }); };
-const setupPostgres = async (env, plan) => {
-    const exact = await resolveCached('postgres:' + plan.version, async () => {
-        const versions = (await fetchJson('https://www.postgresql.org/versions.json')).filter((v) => v.supported);
-        const hit = plan.version === 'latest' ? versions.find((v) => v.current) ?? versions[versions.length - 1] : versions.find((v) => v.major === plan.version.split('.')[0]);
-        return hit ? hit.major + '.' + hit.latestMinor : Promise.reject(new Error('No supported PostgreSQL ' + plan.version));
-    });
-    const home = tool('postgres', exact);
-    const bin = path.join(home, 'bin');
-    if (!exists(path.join(bin, 'pg_ctl.exe'))) {
-        log('Downloading PostgreSQL ' + exact + ' (~330 MB once) ...');
-        // EDB publishes no checksums; the download is HTTPS from EnterpriseDB, PostgreSQL's official Windows packager.
-        await installArchive('https://get.enterprisedb.com/postgresql/postgresql-' + exact + '-1-windows-x64-binaries.zip', home, { locate: 'pg_ctl.exe', up: 1, fileName: 'postgresql-' + exact + '.zip', members: ['pgsql/bin', 'pgsql/lib', 'pgsql/share', 'pgsql/include'] });
-    }
-    const data = dataFor('postgres-' + exact.split('.')[0]);
-    if (!exists(path.join(data, 'PG_VERSION'))) {
-        log('Creating the PostgreSQL database cluster ...');
-        mkdirp(path.dirname(data));
-        await execAsync(path.join(bin, 'initdb.exe'), ['-D', data, '-U', 'postgres', '-A', 'trust', '-E', 'UTF8', '--locale=C'], { stdio: 'ignore' });
-    }
-    clearStaleLocks(data, ['postmaster.pid']);
-    // postgres.exe refuses to run as an administrator (the sandbox user is one); pg_ctl drops the rights first.
-    if (await portOpen(plan.port))
-        throw new Error('port ' + plan.port + ' is already in use (change databases.postgres.port)');
-    await execAsync(path.join(bin, 'pg_ctl.exe'), ['start', '-D', data, '-w', '-t', '60', '-l', path.join(logsDir, 'postgres.log'), '-o', '-p ' + plan.port + ' -c listen_addresses=localhost'], { stdio: 'ignore' });
-    Object.assign(env.vars, { PGHOST: 'localhost', PGPORT: String(plan.port), PGUSER: 'postgres' });
-    env.prepend.push(bin);
-    env.summary.push('postgres ' + exact + ': localhost:' + plan.port + ', user postgres, no password (postgres://postgres@localhost:' + plan.port + '/postgres)');
-};
-const MARIA = 'https://downloads.mariadb.org/rest-api/mariadb/';
-const setupMysql = async (env, plan) => {
-    const series = await resolveCached('mariadb:' + plan.version, async () => {
-        if (plan.version !== 'lts')
-            return plan.version;
-        const { major_releases: all } = await fetchJson(MARIA);
-        return all.find((r) => r.release_status === 'Stable' && r.release_support_type === 'Long Term Support')?.release_id ?? Promise.reject(new Error('No MariaDB LTS release found'));
-    });
-    const latest = async () => {
-        const { releases } = await fetchJson(MARIA + series + '/latest/');
-        const [version, release] = Object.entries(releases)[0] ?? [];
-        const zip = release?.files.find((f) => /-winx64\.zip$/.test(f.file_name));
-        return zip ? { version, zip } : Promise.reject(new Error('No MariaDB ' + series + ' zip for Windows'));
-    };
-    const version = await resolveCached('mariadb-version:' + series, async () => (await latest()).version);
-    const home = tool('mariadb', version);
-    const bin = path.join(home, 'bin');
-    if (!exists(path.join(bin, 'mariadbd.exe'))) {
-        const { zip } = await latest();
-        log('Downloading MariaDB ' + version + ' ...');
-        await installArchive(zip.file_download_url.replace(/^http:/, 'https:'), home, { sha256: zip.checksum?.sha256sum ?? null, locate: 'mariadbd.exe', up: 1, fileName: zip.file_name });
-    }
-    const data = dataFor('mariadb');
-    if (!exists(path.join(data, 'mysql'))) {
-        log('Creating the MariaDB data folder ...');
-        mkdirp(path.dirname(data));
-        await execAsync(path.join(bin, 'mariadb-install-db.exe'), ['--datadir=' + data, '--port=' + plan.port], { stdio: 'ignore' });
-    }
-    await startServer('mysql', path.join(bin, 'mariadbd.exe'), ['--datadir=' + data, '--port=' + plan.port, '--bind-address=127.0.0.1', '--console'], plan.port);
-    Object.assign(env.vars, { MYSQL_HOST: '127.0.0.1', MYSQL_TCP_PORT: String(plan.port) });
-    env.prepend.push(bin);
-    env.summary.push('mysql (MariaDB ' + version + '): 127.0.0.1:' + plan.port + ', user root, no password (mysql://root@127.0.0.1:' + plan.port + ')');
-};
-const setupMongo = async (env, plan) => {
-    const find = async () => {
-        const { versions } = await fetchJson('https://downloads.mongodb.org/full.json');
-        const prod = versions.filter((v) => v.production_release);
-        const hit = plan.version === 'latest' ? prod[0] : prod.find((v) => v.version === plan.version || v.version.startsWith(plan.version + '.'));
-        const archive = hit?.downloads.find((d) => d.target === 'windows' && d.arch === 'x86_64' && d.edition === 'base')?.archive;
-        return hit && archive ? { version: hit.version, archive } : Promise.reject(new Error('No MongoDB ' + plan.version + ' for Windows'));
-    };
-    const version = await resolveCached('mongodb:' + plan.version, async () => (await find()).version);
-    const home = tool('mongodb', version);
-    if (!exists(path.join(home, 'bin', 'mongod.exe'))) {
-        const { archive } = await find();
-        log('Downloading MongoDB ' + version + ' ...');
-        await installArchive(archive.url, home, { sha256: archive.sha256, locate: 'mongod.exe', up: 1 });
-    }
-    const shell = tool('mongosh');
-    if (!exists(path.join(shell, 'mongosh.exe'))) {
-        const asset = await githubAsset('mongodb-js/mongosh', /^mongosh-[\d.]+-win32-x64\.zip$/);
-        log('Downloading mongosh ...');
-        await installArchive(asset.url, shell, { sha256: asset.sha256, locate: 'mongosh.exe', fileName: asset.name });
-    }
-    const data = mkdirp(dataFor('mongodb'));
-    clearStaleLocks(data, ['mongod.lock']);
-    await startServer('mongodb', path.join(home, 'bin', 'mongod.exe'), ['--dbpath', data, '--bind_ip', '127.0.0.1', '--port', String(plan.port)], plan.port);
-    env.prepend.push(path.join(home, 'bin'), shell);
-    env.summary.push('mongodb ' + version + ': mongodb://127.0.0.1:' + plan.port + ' (mongosh on PATH)');
-};
-// ---- Redis -------------------------------------------------------------------------------------------------------
-const setupRedis = async (env, plan) => {
-    const home = tool('redis');
-    if (!exists(path.join(home, 'redis-server.exe'))) {
-        // Redis has no official Windows build; this is the maintained community build of upstream Redis (MSYS2).
-        const asset = await githubAsset('redis-windows/redis-windows', /^Redis-[\d.]+-Windows-x64-msys2\.zip$/);
-        log('Downloading ' + asset.name + ' ...');
-        await installArchive(asset.url, home, { sha256: asset.sha256, locate: 'redis-server.exe', fileName: asset.name });
-    }
-    const data = mkdirp(dataFor('redis'));
-    await startServer('redis', path.join(home, 'redis-server.exe'), ['--port', String(plan.port), '--bind', '127.0.0.1', '--dir', data.replace(/\\/g, '/'), '--appendonly', 'yes'], plan.port);
-    env.prepend.push(home);
-    env.summary.push('redis: redis://127.0.0.1:' + plan.port + ' (redis-cli on PATH)');
-};
-// ---- DynamoDB Local + dynamodb-admin -------------------------------------------------------------------------------
-const DYNAMO_ZIP = 'https://d1ni2b6xgvw0s0.cloudfront.net/v2.x/dynamodb_local_latest.zip';
-/**
- * Amazon's DynamoDB Local (a Java program; the Java toolchain step runs first, else this installs the LTS JDK) and
- * dynamodb-admin, the web UI to browse and edit tables, installed with the runner's own npm. Every AWS SDK picks the
- * local endpoint up from AWS_ENDPOINT_URL_DYNAMODB, with dummy credentials (real ones never reach the sandbox).
- */
-const setupDynamo = async (env, plan) => {
-    const java = path.join(await ensureJdk(), 'bin', 'java.exe');
-    const home = tool('dynamodb-local');
-    if (!exists(path.join(home, 'DynamoDBLocal.jar'))) {
-        log('Downloading DynamoDB Local ...');
-        const sha256 = (await fetchText(DYNAMO_ZIP + '.sha256')).trim().split(/\s+/)[0];
-        await installArchive(DYNAMO_ZIP, home, { sha256, locate: 'DynamoDBLocal.jar', fileName: 'dynamodb_local.zip' });
-    }
-    const data = mkdirp(dataFor('dynamodb'));
-    // -sharedDb: one database whatever region/credentials a client uses, so the admin UI and the app see the same tables.
-    await startServer('dynamodb', java, ['-Djava.library.path=' + path.join(home, 'DynamoDBLocal_lib'), '-jar', path.join(home, 'DynamoDBLocal.jar'), '-sharedDb', '-dbPath', data, '-port', String(plan.port)], plan.port);
-    const endpoint = 'http://localhost:' + plan.port;
-    const aws = { AWS_ENDPOINT_URL_DYNAMODB: endpoint, DYNAMO_ENDPOINT: endpoint, AWS_ACCESS_KEY_ID: 'local', AWS_SECRET_ACCESS_KEY: 'local', AWS_REGION: 'us-east-1', AWS_DEFAULT_REGION: 'us-east-1' };
-    Object.assign(env.vars, aws);
-    env.summary.push('dynamodb (DynamoDB Local): ' + endpoint + ' (AWS SDKs use it automatically via AWS_ENDPOINT_URL_DYNAMODB; dummy credentials)');
-    if (!plan.adminPort)
-        return;
-    const prefix = tool('dynamodb-admin');
-    const script = path.join(prefix, 'node_modules', 'dynamodb-admin', 'dist', 'dynamodb-admin.js');
-    if (!exists(script)) {
-        log('Installing dynamodb-admin (web UI for DynamoDB) ...');
-        const npmCli = path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');
-        await execAsync(process.execPath, [npmCli, 'install', '--global', '--prefix', prefix, 'dynamodb-admin', '--no-fund', '--no-audit'], { stdio: 'ignore' });
-    }
-    const admin = { ...process.env, ...aws, DYNAMO_ENDPOINT: endpoint };
-    // The database matters more than its UI: a taken port is reported, not fatal.
-    if (await portOpen(plan.adminPort)) {
-        env.summary.push('dynamodb-admin: NOT started, port ' + plan.adminPort + ' is in use (change databases.dynamodb.adminPort)');
-        return;
-    }
-    const out = fs.openSync(path.join(logsDir, 'dynamodb-admin.log'), 'a');
-    spawn(process.execPath, [script, '--port', String(plan.adminPort), '--dynamo-endpoint', endpoint, '--skip-default-credentials'], { detached: true, stdio: ['ignore', out, out], windowsHide: true, env: admin }).unref();
-    fs.closeSync(out);
-    if (!(await waitForPort(plan.adminPort, 30)))
-        throw new Error('dynamodb-admin did not start; see ' + path.join(logsDir, 'dynamodb-admin.log'));
-    env.summary.push('dynamodb-admin: http://localhost:' + plan.adminPort + ' (browse and edit tables in the sandbox\'s browser)');
-};
-const SETUP = { postgres: setupPostgres, mysql: setupMysql, mongodb: setupMongo, redis: setupRedis, dynamodb: setupDynamo };
-export const DATABASE_NAMES = { postgres: 'PostgreSQL', mysql: 'MySQL (MariaDB)', mongodb: 'MongoDB', redis: 'Redis', dynamodb: 'DynamoDB Local', sqlserver: 'SQL Server' };
-/** The process listening on a local TCP port (netstat: no PowerShell start-up cost), or null. */
-const listenerPid = (port) => {
-    const out = spawnSync(SYSTEM.netstat(), ['-ano', '-p', 'TCP'], { encoding: 'utf8', windowsHide: true }).stdout ?? '';
-    const hit = out.split(/\r?\n/).map((l) => /^\s*TCP\s+\S+:(\d+)\s+\S+\s+LISTENING\s+(\d+)/.exec(l)).find((m) => m && Number(m[1]) === port);
-    return hit ? Number(hit[2]) : null;
-};
-/** Stops a database (and DynamoDB's admin UI). PostgreSQL shuts down cleanly through pg_ctl; the others are ended. */
-export const stopDatabase = async (plan) => {
-    if (!(await portOpen(plan.port)))
-        return false;
-    if (plan.database === 'postgres' && exists(tool('postgres'))) {
-        for (const version of fs.readdirSync(tool('postgres'))) {
-            const data = dataFor('postgres-' + version.split('.')[0]);
-            const pgCtl = path.join(tool('postgres', version), 'bin', 'pg_ctl.exe');
-            if (exists(path.join(data, 'postmaster.pid')) && exists(pgCtl))
-                await execAsync(pgCtl, ['stop', '-D', data, '-m', 'fast', '-w'], { stdio: 'ignore' });
-        }
-    }
-    for (const port of [plan.port, plan.adminPort ?? 0]) {
-        const pid = port && listenerPid(port);
-        if (pid)
-            try {
-                process.kill(pid);
-            }
-            catch { /* already gone */ }
-    }
-    return true;
-};
-export const setupDatabase = async (env, plan) => {
-    if (plan.database === 'sqlserver') {
-        env.summary.push('sqlserver: NOT available (SQL Server cannot start inside Windows Sandbox). Use the one on the PC via hostAccess.forwards, or switch the project to Postgres/SQLite for local work');
-        return;
-    }
-    if (dryRun) {
-        log('(dry run) would run ' + DATABASE_NAMES[plan.database] + ' on port ' + plan.port + ' (' + plan.reasons.join('; ') + ')');
-        return;
-    }
-    await SETUP[plan.database](env, plan);
-};

package/dist/guest/toolchains/msvc.d.ts

@@ -1,10 +0,0 @@
-import type { Toolchains } from '../../core/types.js';
-import { type ToolEnv } from './common.js';
-/** Variables vcvars64.bat would set for this tree (host x64, target x64). */
-export declare const vcvars: (root: string, msvc: string, sdk: string) => {
-    vars: Record<string, string>;
-    path: string[];
-};
-/** The vcvars environment of an installed tree (for steps that run before the agent's environment exists). */
-export declare const installedMsvcEnv: () => ReturnType<typeof vcvars> | null;
-export declare const setupMsvc: (env: ToolEnv, config: Toolchains["msvc"]) => Promise<void>;

package/dist/guest/toolchains/msvc.js

@@ -1,216 +0,0 @@
-// MSVC (cl, link) and the Windows SDK without an installer, the way mmozeiko's portable-msvc.py does it: packages
-// from Microsoft's Visual Studio channel manifest (each payload checked against the manifest's sha256), the compiler
-// unpacked from its .vsix, the SDK from its .msi files with `msiexec /a`. Laid out like a Build Tools install, with
-// vcvars64.bat and a vswhere that points at it, so CMake, cargo (msvc host), node-gyp and vcvars-based scripts work.
-// Use is governed by the Visual Studio licence terms: it only installs with toolchains.msvc.acceptLicense.
-import fs from 'node:fs';
-import path from 'node:path';
-import { download, extractArchive, fetchJson } from '../../shared/download.js';
-import { safeRemove } from '../../shared/safe-remove.js';
-import { system32 } from '../../shared/system.js';
-import { dryRun, execAsync, exists, log, mkdirp } from '../env.js';
-import { ensureCompiled } from '../ptyhost.js';
-import { tool } from './common.js';
-import { msiCabs, pickMsvcVersion, pickWindowsSdk } from './versions.js';
-const CHANNEL = 'https://aka.ms/vs/17/release/channel';
-const ROOT = tool('msvc');
-const MANIFEST_DAY_MS = 24 * 60 * 60 * 1000;
-/** Where build tools look for vswhere (local to the sandbox, so it is written each boot). */
-const VSWHERE_DIR = path.join(process.env['ProgramFiles(x86)'] ?? 'C:\\Program Files (x86)', 'Microsoft Visual Studio', 'Installer');
-/** The VS manifest (~18 MB), cached for a day. */
-const manifest = async () => {
-    const cached = path.join(ROOT, '.manifest.json');
-    if (exists(cached) && Date.now() - fs.statSync(cached).mtimeMs < MANIFEST_DAY_MS)
-        return JSON.parse(fs.readFileSync(cached, 'utf8'));
-    const channel = await fetchJson(CHANNEL);
-    const item = channel.channelItems.find((i) => i.id === 'Microsoft.VisualStudio.Manifests.VisualStudio')?.payloads?.[0];
-    if (!item)
-        throw new Error('the Visual Studio channel has no package manifest');
-    mkdirp(ROOT);
-    // The channel's sha256 for the manifest is not the file's hash (portable-msvc.py does not check it either); the
-    // manifest comes over HTTPS from Microsoft, and every package payload it lists IS checked against its own sha256.
-    await download(item.url, cached);
-    return JSON.parse(fs.readFileSync(cached, 'utf8'));
-};
-/** The compiler's packages (host x64, target x64): tools, resources, CRT headers/libs, ASAN/PGO headers, DIA SDK. */
-const MSVC_PARTS = ['tools.hostx64.targetx64.base', 'tools.hostx64.targetx64.res.base', 'crt.headers.base', 'crt.x64.desktop.base', 'crt.x64.store.base', 'crt.source.base', 'asan.headers.base', 'pgo.headers.base'];
-/** The SDK's .msi files (Desktop + UCRT + Store headers/libs/tools for x64), as in portable-msvc.py. */
-const SDK_MSIS = [
-    'Windows SDK for Windows Store Apps Tools-x86_en-us.msi', 'Windows SDK for Windows Store Apps Headers-x86_en-us.msi',
-    'Windows SDK for Windows Store Apps Headers OnecoreUap-x86_en-us.msi', 'Windows SDK for Windows Store Apps Libs-x86_en-us.msi',
-    'Universal CRT Headers Libraries and Sources-x86_en-us.msi', 'Windows SDK Desktop Headers x86-x86_en-us.msi',
-    'Windows SDK Desktop Headers x64-x86_en-us.msi', 'Windows SDK Desktop Libs x64-x86_en-us.msi', 'Windows SDK Desktop Tools x64-x86_en-us.msi',
-];
-/** .vsix contents are percent-encoded file names under Contents/; unpack them into the root, names decoded. */
-const unpackVsix = async (vsix, work) => {
-    const out = mkdirp(path.join(work, 'vsix-' + path.basename(vsix)));
-    await extractArchive(vsix, out, ['Contents']);
-    const decode = (dir) => {
-        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-            const from = path.join(dir, entry.name);
-            let name = entry.name;
-            try {
-                if (name.includes('%'))
-                    name = decodeURIComponent(name);
-            }
-            catch { /* not percent-encoded after all */ }
-            const to = path.join(dir, name);
-            if (to !== from)
-                fs.renameSync(from, to);
-            if (entry.isDirectory())
-                decode(to);
-        }
-    };
-    decode(out);
-    fs.cpSync(path.join(out, 'Contents'), ROOT, { recursive: true, force: true });
-    safeRemove(out, work);
-};
-const install = async (config) => {
-    const m = await manifest();
-    const byId = new Map();
-    for (const p of m.packages)
-        byId.set(p.id.toLowerCase(), [...(byId.get(p.id.toLowerCase()) ?? []), p]);
-    const pick = (id) => byId.get(id.toLowerCase())?.find((p) => !p.language || p.language === 'en-US');
-    const ids = [...byId.keys()];
-    const version = pickMsvcVersion(ids, config.msvcVersion);
-    if (!version)
-        throw new Error('no MSVC ' + config.msvcVersion + ' in the Visual Studio manifest');
-    const sdk = pickWindowsSdk(ids, config.sdkVersion);
-    if (!sdk)
-        throw new Error('no Windows SDK ' + config.sdkVersion + ' in the Visual Studio manifest');
-    const work = mkdirp(path.join(ROOT, '.download'));
-    const fetchPayload = async (p) => {
-        const file = path.join(work, path.basename(p.fileName.replace(/\\/g, '/')));
-        if (!exists(file))
-            await download(p.url, file, p.sha256);
-        return file;
-    };
-    log('Downloading MSVC ' + version + ' (compiler, CRT) ...');
-    for (const part of MSVC_PARTS) {
-        const p = pick('microsoft.vc.' + version + '.' + part);
-        if (!p) {
-            if (part.startsWith('tools') || part.startsWith('crt.headers') || part.startsWith('crt.x64.desktop'))
-                throw new Error('MSVC ' + version + ' has no ' + part);
-            continue;
-        }
-        for (const payload of p.payloads ?? [])
-            await unpackVsix(await fetchPayload(payload), work);
-    }
-    const dia = pick('microsoft.visualcpp.dia.sdk');
-    for (const payload of dia?.payloads ?? [])
-        await unpackVsix(await fetchPayload(payload), work);
-    // The SDK component depends on the package that holds the .msi/.cab payloads (e.g. Win11SDK_10.0.26100).
-    const sdkPackage = pick(Object.keys(pick(sdk.componentId)?.dependencies ?? {})[0] ?? '');
-    if (!sdkPackage?.payloads)
-        throw new Error('the Windows SDK ' + sdk.build + ' package has no payloads');
-    log('Downloading the Windows SDK ' + sdk.build + ' (headers, libraries) ...');
-    const payload = (name) => sdkPackage.payloads.find((p) => p.fileName.toLowerCase() === ('installers\\' + name).toLowerCase());
-    const msis = [];
-    for (const name of SDK_MSIS) {
-        const p = payload(name);
-        if (!p)
-            throw new Error('the Windows SDK package has no ' + name);
-        const file = await fetchPayload(p);
-        msis.push(file);
-        for (const cab of msiCabs(fs.readFileSync(file))) {
-            const c = payload(cab);
-            if (c)
-                await fetchPayload(c);
-        }
-    }
-    for (const msi of msis) {
-        // An administrative install only unpacks files; its verbose log explains a failure (e.g. a path over 260 characters).
-        const logFile = msi + '.log';
-        try {
-            await execAsync(system32('msiexec.exe'), ['/a', msi, '/quiet', '/qn', 'TARGETDIR=' + ROOT, '/l*v', logFile], { stdio: 'ignore' });
-        }
-        catch (e) {
-            const lines = exists(logFile) ? fs.readFileSync(logFile, 'utf16le').split(/\r?\n/).filter((l) => /error|return value 3|failed/i.test(l)).slice(-4).join(' | ') : '';
-            throw new Error(path.basename(msi) + ' did not unpack: ' + (e instanceof Error ? e.message : String(e)) + (lines ? ' (' + lines.slice(0, 600) + ')' : ''));
-        }
-    }
-    // msiexec /a also copies every .msi into the target; they are not needed.
-    for (const name of fs.readdirSync(ROOT).filter((n) => n.toLowerCase().endsWith('.msi')))
-        fs.rmSync(path.join(ROOT, name), { force: true });
-    safeRemove(work, ROOT);
-    const sdkVersion = fs.readdirSync(path.join(ROOT, 'Windows Kits', '10', 'Include')).filter((d) => d.startsWith('10.0.' + sdk.build)).sort().pop();
-    if (!sdkVersion)
-        throw new Error('the Windows SDK did not unpack (no Include\\10.0.' + sdk.build + '.*)');
-    // The tools folder is named after the toolset (14.44.35207), not the package version (14.44.17.14).
-    const toolsRoot = path.join(ROOT, 'VC', 'Tools', 'MSVC');
-    const tools = fs.readdirSync(toolsRoot).filter((d) => exists(path.join(toolsRoot, d, 'bin', 'Hostx64', 'x64', 'cl.exe'))).sort((a, b) => a.localeCompare(b, undefined, { numeric: true })).pop();
-    if (!tools)
-        throw new Error('MSVC ' + version + ' did not unpack (no cl.exe under VC\\Tools\\MSVC)');
-    return { msvc: tools, sdk: sdkVersion };
-};
-/** Variables vcvars64.bat would set for this tree (host x64, target x64). */
-export const vcvars = (root, msvc, sdk) => {
-    const vc = path.join(root, 'VC', 'Tools', 'MSVC', msvc);
-    const kits = path.join(root, 'Windows Kits', '10');
-    const inc = (...p) => path.join(kits, 'Include', sdk, ...p);
-    const lib = (...p) => path.join(kits, 'Lib', sdk, ...p);
-    return {
-        vars: {
-            VSINSTALLDIR: root + '\\', VCINSTALLDIR: path.join(root, 'VC') + '\\', VCToolsInstallDir: vc + '\\', VCToolsVersion: msvc, VisualStudioVersion: '17.0',
-            WindowsSdkDir: kits + '\\', WindowsSDKVersion: sdk + '\\', WindowsSDKLibVersion: sdk + '\\', UniversalCRTSdkDir: kits + '\\', UCRTVersion: sdk,
-            VSCMD_ARG_HOST_ARCH: 'x64', VSCMD_ARG_TGT_ARCH: 'x64', Platform: 'x64',
-            INCLUDE: [path.join(vc, 'include'), inc('ucrt'), inc('shared'), inc('um'), inc('winrt'), inc('cppwinrt')].join(';'),
-            LIB: [path.join(vc, 'lib', 'x64'), lib('ucrt', 'x64'), lib('um', 'x64')].join(';'),
-            LIBPATH: [path.join(vc, 'lib', 'x64'), path.join(vc, 'lib', 'x86', 'store', 'references')].join(';'),
-        },
-        path: [path.join(vc, 'bin', 'Hostx64', 'x64'), path.join(kits, 'bin', sdk, 'x64')],
-    };
-};
-/** vcvars64.bat / vcvarsall.bat in the usual place, for scripts that `call` them. */
-const writeVcvars = (env) => {
-    const dir = mkdirp(path.join(ROOT, 'VC', 'Auxiliary', 'Build'));
-    const lines = ['@echo off', 'rem Written by Windows Development Sandbox for its portable MSVC (host x64, target x64).',
-        ...Object.entries(env.vars).map(([k, v]) => 'set "' + k + '=' + v + '"'), 'set "PATH=' + env.path.join(';') + ';%PATH%"', 'exit /b 0'];
-    fs.writeFileSync(path.join(dir, 'vcvars64.bat'), lines.join('\r\n') + '\r\n');
-    fs.writeFileSync(path.join(dir, 'vcvarsall.bat'), ['@echo off', 'rem Only x64 (amd64) is installed.', 'call "%~dp0vcvars64.bat"', 'exit /b %errorlevel%'].join('\r\n') + '\r\n');
-};
-/** vswhere.exe where Visual Studio's installer would put it, answering with this tree. */
-const installVswhere = (msvc) => {
-    mkdirp(VSWHERE_DIR);
-    fs.copyFileSync(ensureCompiled('vswhere'), path.join(VSWHERE_DIR, 'vswhere.exe'));
-    const [major, minor] = msvc.split('.').slice(2);
-    fs.writeFileSync(path.join(VSWHERE_DIR, 'vswhere.json'), JSON.stringify({ installationPath: ROOT, installationVersion: '17.' + (minor ?? '0') + '.0.' + (major ?? '0') }));
-};
-/** The vcvars environment of an installed tree (for steps that run before the agent's environment exists). */
-export const installedMsvcEnv = () => {
-    try {
-        const done = JSON.parse(fs.readFileSync(path.join(ROOT, '.installed.json'), 'utf8'));
-        return exists(path.join(ROOT, 'VC', 'Tools', 'MSVC', done.msvc, 'bin', 'Hostx64', 'x64', 'cl.exe')) ? vcvars(ROOT, done.msvc, done.sdk) : null;
-    }
-    catch {
-        return null;
-    }
-};
-export const setupMsvc = async (env, config) => {
-    if (!config.acceptLicense) {
-        throw new Error('MSVC is installed only with toolchains.msvc.acceptLicense = true: its use is governed by the Visual Studio licence terms (https://visualstudio.microsoft.com/license-terms/), which need a Visual Studio licence');
-    }
-    if (dryRun) {
-        log('(dry run) would provision MSVC ' + config.msvcVersion + ' and Windows SDK ' + config.sdkVersion);
-        return;
-    }
-    const marker = path.join(ROOT, '.installed.json');
-    const want = config.msvcVersion + '/' + config.sdkVersion;
-    let done = exists(marker) ? JSON.parse(fs.readFileSync(marker, 'utf8')) : null;
-    if (!done || done.want !== want || !exists(path.join(ROOT, 'VC', 'Tools', 'MSVC', done.msvc, 'bin', 'Hostx64', 'x64', 'cl.exe'))) {
-        log('Installing MSVC and the Windows SDK (~1-2 GB, once; licence accepted in toolchains.msvc.acceptLicense) ...');
-        // A previous attempt's verified downloads (.download) are kept; everything it unpacked is redone.
-        if (exists(ROOT))
-            for (const name of fs.readdirSync(ROOT).filter((n) => n !== '.manifest.json' && n !== '.download'))
-                safeRemove(path.join(ROOT, name), ROOT);
-        const installed = await install(config);
-        done = { ...installed, want };
-        fs.writeFileSync(marker, JSON.stringify(done, null, 2));
-    }
-    const vc = vcvars(ROOT, done.msvc, done.sdk);
-    writeVcvars(vc);
-    installVswhere(done.msvc);
-    Object.assign(env.vars, vc.vars);
-    env.prepend.push(...vc.path);
-    env.summary.push('msvc: ' + done.msvc + ', Windows SDK ' + done.sdk + ' (cl, link; vcvars64.bat and vswhere work)');
-};

package/dist/guest/toolchains/native.d.ts

@@ -1,12 +0,0 @@
-import type { Toolchains } from '../../core/types.js';
-import { type ToolEnv } from './common.js';
-/** MinGW-w64 GCC from WinLibs: gcc/g++/mingw32-make for the agent, and the linker for Rust's GNU host. */
-export declare const setupCpp: (env: ToolEnv, config: Toolchains["cpp"]) => Promise<void>;
-/**
- * Mesa 3D for Windows (llvmpipe): OpenGL 4.5 on the CPU when the sandbox has no GPU. Windows only offers OpenGL 1.1 in
- * software, and opengl32.dll cannot be replaced system-wide, so programs pick Mesa up from their own folder.
- */
-export declare const setupMesa: (env: ToolEnv, config: Toolchains["mesa"]) => Promise<void>;
-export declare const setupRust: (env: ToolEnv, config: Toolchains["rust"], refresh: boolean) => Promise<void>;
-/** .NET SDK channels from config plus whatever the workspace's global.json pins. Installs are remembered in a marker. */
-export declare const setupDotnet: (env: ToolEnv, config: Toolchains["dotnet"], refresh: boolean) => Promise<void>;