windows-development-sandbox 1.0.5 → 1.4.0

package/dist/guest/toolchains/native.js

@@ -1,220 +0,0 @@
-// Compiled languages: C/C++ (MinGW-w64 GCC, flex/bison), Rust (rustup + cargo), C# (.NET SDK and .NET Framework
-// targeting), and Mesa for running OpenGL programs without a GPU.
-import fs from 'node:fs';
-import path from 'node:path';
-import { z } from 'zod';
-import { download, fetchJson, githubAsset, installArchive } from '../../shared/download.js';
-import { readJsonFile, writeJsonAtomic } from '../../shared/rundir.js';
-import { SYSTEM } from '../../shared/system.js';
-import { dryRun, errMsg, execAsync, execOutput, exists, log, mkdirp, warn, workspace } from '../env.js';
-import { arch, installOnce, tool, versionOf } from './common.js';
-import { CMAKE_FLOOR, cmakeTooOld } from './versions.js';
-import { crateInstaller } from './binstall.js';
-import { installedMsvcEnv } from './msvc.js';
-/** MinGW-w64 GCC from WinLibs: gcc/g++/mingw32-make for the agent, and the linker for Rust's GNU host. */
-export const setupCpp = async (env, config) => {
-    const bin = tool('mingw', 'mingw64', 'bin');
-    const gcc = path.join(bin, 'gcc.exe');
-    if (dryRun) {
-        log('(dry run) would provision MinGW-w64 GCC');
-        return;
-    }
-    if (!exists(gcc)) {
-        const asset = await githubAsset('brechtsanders/winlibs_mingw', arch === 'arm64' ? /^winlibs-aarch64-.*\.zip$/ : /^winlibs-x86_64-posix-seh-gcc-.*\.zip$/, true);
-        log('Downloading ' + asset.name + ' (C/C++ compiler, ~270 MB once) ...');
-        await installArchive(asset.url, tool('mingw'), { sha256: asset.sha256, fileName: asset.name });
-    }
-    if (!exists(gcc))
-        throw new Error('gcc.exe missing after installing MinGW');
-    // Appended (not prepended) so MinGW's tools never shadow Windows or toolchain commands of the same name.
-    env.append.unshift(bin);
-    env.vars.CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER = gcc;
-    const cmake = versionOf(path.join(bin, 'cmake.exe'));
-    if (cmakeTooOld(cmake))
-        warn('The bundled CMake ' + cmake + ' is older than ' + CMAKE_FLOOR + ', which many projects need; set toolchains.cpp.enabled to refresh it, or install a newer CMake into C:\\AgentData\\tools\\bin.');
-    env.summary.push('gcc: ' + versionOf(gcc) + ' (MinGW-w64, with cmake ' + cmake + ', ninja, premake5)');
-    if (config.flexBison)
-        await setupFlexBison(env);
-};
-/** win_flex / win_bison (CMake's FindFLEX/FindBISON look for these names). Kept with the C/C++ tools on PATH. */
-const setupFlexBison = async (env) => {
-    const dir = tool('winflexbison');
-    if (!exists(path.join(dir, 'win_bison.exe'))) {
-        const asset = await githubAsset('lexxmark/winflexbison', /^win_flex_bison-[\d.]+\.zip$/);
-        log('Downloading ' + asset.name + ' ...');
-        await installArchive(asset.url, dir, { sha256: asset.sha256, locate: 'win_bison.exe', fileName: asset.name });
-    }
-    env.append.push(dir);
-    env.summary.push('win_flex/win_bison: ' + versionOf(path.join(dir, 'win_bison.exe')));
-};
-/**
- * Mesa 3D for Windows (llvmpipe): OpenGL 4.5 on the CPU when the sandbox has no GPU. Windows only offers OpenGL 1.1 in
- * software, and opengl32.dll cannot be replaced system-wide, so programs pick Mesa up from their own folder.
- */
-export const setupMesa = async (env, config) => {
-    if (dryRun) {
-        log('(dry run) would provision Mesa 3D');
-        return;
-    }
-    const root = tool('mesa');
-    const dir = path.join(root, arch === 'arm64' ? 'arm64' : 'x64');
-    if (!exists(path.join(dir, 'opengl32.dll'))) {
-        const asset = await githubAsset('pal1000/mesa-dist-win', /^mesa3d-[\d.]+-release-msvc\.7z$/);
-        log('Downloading ' + asset.name + ' (software OpenGL) ...');
-        await installArchive(asset.url, root, { sha256: asset.sha256, locate: 'opengl32.dll', up: 1, fileName: asset.name });
-    }
-    Object.assign(env.vars, { MESA_DIR: dir, GALLIUM_DRIVER: 'llvmpipe' });
-    env.summary.push('mesa (software OpenGL 4.5): copy opengl32.dll + libgallium_wgl.dll from %MESA_DIR% next to a game\'s .exe');
-    if (config.vulkan)
-        await setupLavapipe(env, dir);
-};
-const VULKAN_RUNTIME = 'https://sdk.lunarg.com/sdk/download/latest/windows/vulkan-runtime-components.zip';
-/**
- * Software Vulkan: Mesa's lavapipe plus the Khronos loader (vulkan-1.dll, from LunarG's runtime components; Windows
- * Sandbox has no Vulkan loader). The loader ignores VK_DRIVER_FILES in elevated processes, and everything in the
- * sandbox runs elevated, so lavapipe is registered where the loader looks (HKLM; the registry is new every boot).
- */
-const setupLavapipe = async (env, mesaDir) => {
-    const icd = path.join(mesaDir, arch === 'arm64' ? 'lvp_icd.aarch64.json' : 'lvp_icd.x86_64.json');
-    if (!exists(icd))
-        throw new Error('this Mesa build has no lavapipe (' + path.basename(icd) + ')');
-    const dir = tool('vulkan');
-    if (!exists(path.join(dir, 'vulkan-1.dll'))) {
-        log('Downloading the Vulkan loader (LunarG runtime components) ...');
-        // LunarG publishes no checksum for this zip; it comes over HTTPS from LunarG, the Khronos SDK's maintainer.
-        // The zip has x86 and x64 folders: only the 64-bit loader (and vulkaninfo) is extracted.
-        await installArchive(VULKAN_RUNTIME, dir, { locate: 'vulkan-1.dll', fileName: 'vulkan-runtime.zip', members: ['*/x64/*'] });
-    }
-    await execAsync(SYSTEM.reg(), ['add', 'HKLM\\SOFTWARE\\Khronos\\Vulkan\\Drivers', '/v', icd, '/t', 'REG_DWORD', '/d', '0', '/f'], { stdio: 'ignore' });
-    env.prepend.push(dir);
-    env.summary.push('vulkan: lavapipe (software Vulkan 1.4 on the CPU), vulkaninfo on PATH; WGPU_BACKEND=vulkan for wgpu');
-};
-export const setupRust = async (env, config, refresh) => {
-    const RUSTUP_HOME = tool('rust', 'rustup');
-    const CARGO_HOME = tool('rust', 'cargo');
-    const rustEnv = { env: { ...process.env, RUSTUP_HOME, CARGO_HOME } };
-    const rustup = path.join(CARGO_HOME, 'bin', 'rustup.exe');
-    if (dryRun) {
-        log('(dry run) would provision Rust ' + config.toolchain + ' (' + config.host + ')');
-        return;
-    }
-    if (!exists(rustup)) {
-        const init = tool('rust', 'rustup-init.exe');
-        log('Downloading rustup ...');
-        await download('https://static.rust-lang.org/rustup/dist/' + (arch === 'arm64' ? 'aarch64' : 'x86_64') + '-pc-windows-msvc/rustup-init.exe', init);
-        await execAsync(init, ['-y', '--no-modify-path', '--profile', 'default', '--default-host', config.host, '--default-toolchain', config.toolchain], rustEnv);
-    }
-    else {
-        // The host can change (GNU <-> msvc with toolchains.msvc): install the toolchain for it; a no-op when it is there.
-        await execAsync(rustup, ['set', 'default-host', config.host], { ...rustEnv, stdio: 'ignore' });
-        await execAsync(rustup, ['toolchain', 'install', config.toolchain, '--profile', 'default', '--no-self-update'], { ...rustEnv, stdio: 'ignore' });
-        await execAsync(rustup, ['default', config.toolchain], { ...rustEnv, stdio: 'ignore' });
-        if (refresh)
-            await execAsync(rustup, ['update'], rustEnv);
-    }
-    Object.assign(env.vars, { RUSTUP_HOME, CARGO_HOME });
-    env.prepend.push(path.join(CARGO_HOME, 'bin'));
-    env.summary.push('rust: ' + versionOf(path.join(CARGO_HOME, 'bin', 'rustc.exe'), ['--version'], rustEnv) + ' [' + config.host + ']');
-    const toolchainKey = 'rustup@' + config.toolchain;
-    await installOnce(env, toolchainKey + ' components', config.components, (c) => execAsync(rustup, ['component', 'add', c], rustEnv));
-    await installOnce(env, toolchainKey + ' targets', config.targets, (t) => execAsync(rustup, ['target', 'add', t], rustEnv));
-    // cargo install links with MSVC's link.exe (msvc host) or MinGW's gcc (GNU host). Those steps ran first, but their
-    // PATH only reaches the agent at the end, so it is put together here.
-    const msvc = config.host.endsWith('-msvc') ? installedMsvcEnv() : null;
-    const mingw = tool('mingw', 'mingw64', 'bin');
-    const cargoEnv = msvc
-        ? { env: { ...rustEnv.env, ...msvc.vars, PATH: [path.join(CARGO_HOME, 'bin'), ...msvc.path, process.env.PATH ?? ''].join(path.delimiter) } }
-        : { env: { ...rustEnv.env, CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: path.join(mingw, 'gcc.exe'), PATH: [path.join(CARGO_HOME, 'bin'), mingw, process.env.PATH ?? ''].join(path.delimiter) } };
-    // Prebuilt through cargo-binstall where the crate publishes a Windows build, else compiled (same "cargo" keys as before).
-    await installOnce(env, 'cargo', config.crates, crateInstaller(CARGO_HOME, cargoEnv));
-};
-/** tools\dotnet\.agent-sandbox-installed.json: which install keys (channel:8.0, global.json:...) already ran. */
-const DotnetMarker = z.record(z.string(), z.boolean());
-/** .NET SDK channels from config plus whatever the workspace's global.json pins. Installs are remembered in a marker. */
-export const setupDotnet = async (env, config, refresh) => {
-    const root = tool('dotnet');
-    const marker = path.join(root, '.agent-sandbox-installed.json');
-    const script = tool('dotnet-install.ps1');
-    if (dryRun) {
-        log('(dry run) would provision .NET SDK channels ' + config.channels.join(', '));
-        return;
-    }
-    // A corrupt or hand-edited marker just means "nothing recorded yet" (the installs are idempotent).
-    const recorded = DotnetMarker.safeParse(exists(marker) && !refresh ? readJsonFile(marker) : {});
-    const done = recorded.success ? recorded.data : {};
-    const globalJson = path.join(workspace, 'global.json');
-    const installs = [
-        ...config.channels.map((c) => ['channel:' + c, ['-Channel', c]]),
-        ...(exists(globalJson) ? [['global.json:' + fs.readFileSync(globalJson, 'utf8').replace(/\s+/g, ''), ['-JSonFile', globalJson]]] : []),
-    ];
-    for (const [key, args] of installs.filter(([k]) => !done[k])) {
-        if (!exists(script) || refresh)
-            await download('https://dot.net/v1/dotnet-install.ps1', script);
-        log('Installing .NET SDK (' + key + ') ...');
-        await execAsync(SYSTEM.powershell(), ['-NoLogo', '-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', script, ...args, '-InstallDir', root, '-NoPath']);
-        done[key] = true;
-        writeJsonAtomic(marker, done);
-    }
-    const home = mkdirp(tool('dotnet-home'));
-    Object.assign(env.vars, { DOTNET_ROOT: root, DOTNET_CLI_HOME: home, DOTNET_CLI_TELEMETRY_OPTOUT: '1', DOTNET_NOLOGO: '1', DOTNET_SKIP_FIRST_TIME_EXPERIENCE: '1', NUGET_PACKAGES: tool('nuget', 'packages') });
-    env.prepend.push(root, path.join(home, '.dotnet', 'tools'));
-    env.summary.push('dotnet: ' + execOutput(path.join(root, 'dotnet.exe'), ['--list-sdks']).split(/\r?\n/).map((l) => l.split(' ')[0]).filter(Boolean).join(', '));
-    const dotnet = path.join(root, 'dotnet.exe');
-    const dotnetEnv = { env: { ...process.env, ...env.vars, PATH: root + path.delimiter + (process.env.PATH ?? '') } };
-    await installOnce(env, 'dotnet workload', config.workloads, (w) => execAsync(dotnet, ['workload', 'install', w, '--skip-manifest-update'], dotnetEnv));
-    await installOnce(env, 'dotnet tool', config.tools, (t) => execAsync(dotnet, ['tool', 'install', '--global', t], dotnetEnv));
-    await setupFrameworkReferences(env, config.frameworkTargets);
-    if (config.netfx35)
-        await setupNetFx35(env);
-};
-/**
- * .NET Framework reference assemblies (the "targeting packs" Visual Studio would install) from NuGet, so net4x projects,
- * old-style .csproj included, build with the SDK's MSBuild. MSBuild reads TargetFrameworkRootPath from the environment.
- * Running .NET Framework 4.8 apps needs nothing: Windows ships it.
- */
-const setupFrameworkReferences = async (env, targets) => {
-    if (!targets.length)
-        return;
-    const root = tool('netfx-references');
-    for (const target of targets) {
-        const id = 'microsoft.netframework.referenceassemblies.' + target.toLowerCase();
-        const marker = path.join(root, '.installed-' + target.toLowerCase());
-        if (exists(marker))
-            continue;
-        try {
-            const { versions } = await fetchJson('https://api.nuget.org/v3-flatcontainer/' + id + '/index.json');
-            const version = versions.filter((v) => /^\d+(\.\d+)*$/.test(v)).pop();
-            if (!version)
-                throw new Error('no stable version of ' + id);
-            log('Downloading .NET Framework reference assemblies (' + target + ') ...');
-            const staging = tool('netfx-references-' + target.toLowerCase());
-            await installArchive('https://api.nuget.org/v3-flatcontainer/' + id + '/' + version + '/' + id + '.' + version + '.nupkg', staging, { fileName: id + '.zip' });
-            fs.cpSync(path.join(staging, 'build', '.NETFramework'), path.join(root, '.NETFramework'), { recursive: true });
-            fs.rmSync(staging, { recursive: true, force: true });
-            fs.writeFileSync(marker, version);
-        }
-        catch (e) {
-            warn('.NET Framework reference assemblies ' + target + ' failed: ' + errMsg(e));
-        }
-    }
-    if (!exists(path.join(root, '.NETFramework')))
-        return;
-    env.vars.TargetFrameworkRootPath = root + path.sep;
-    env.summary.push('.NET Framework targeting: ' + fs.readdirSync(path.join(root, '.NETFramework')).join(', '));
-};
-/** .NET Framework 3.5 is a Windows feature the sandbox image lacks; DISM fetches it from Windows Update on every boot. */
-const setupNetFx35 = async (env) => {
-    if (execOutput(SYSTEM.reg(), ['query', 'HKLM\\SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v3.5', '/v', 'Install']).includes('0x1')) {
-        env.summary.push('.NET Framework 3.5: on');
-        return;
-    }
-    log('Enabling .NET Framework 3.5 (downloads from Windows Update, a few minutes) ...');
-    try {
-        await execAsync(SYSTEM.dism(), ['/Online', '/Enable-Feature', '/FeatureName:NetFx3', '/All', '/NoRestart', '/Quiet'], { stdio: 'ignore' });
-        env.summary.push('.NET Framework 3.5: on');
-    }
-    catch (e) {
-        warn('.NET Framework 3.5 could not be enabled: ' + errMsg(e));
-        env.summary.push('.NET Framework 3.5: FAILED');
-    }
-};

package/dist/guest/toolchains/scripting.d.ts

@@ -1,10 +0,0 @@
-import type { Toolchains } from '../../core/types.js';
-import { type ToolEnv } from './common.js';
-/**
- * vcruntime140.dll & co. A real installer (it writes to System32), so it runs on every boot; the installer itself is
- * kept in persistent storage and only run when Microsoft's signature on it checks out. Resolves true when this call
- * ran the installer. Only the "Visual C++ runtime" step reports it (`summary`); PHP calls it again just to be sure.
- */
-export declare const setupVcRuntime: (env: ToolEnv, summary?: boolean) => Promise<boolean>;
-export declare const setupRuby: (env: ToolEnv, config: Toolchains["ruby"]) => Promise<void>;
-export declare const setupPhp: (env: ToolEnv, config: Toolchains["php"]) => Promise<void>;

package/dist/guest/toolchains/scripting.js

@@ -1,137 +0,0 @@
-// Ruby (RubyInstaller) and PHP (windows.php.net, with Composer), plus the Visual C++ runtime PHP and other native
-// tools need. Gems and Composer's global packages live in persistent storage.
-import fs from 'node:fs';
-import path from 'node:path';
-import { download, fetchJson, fetchText, installArchive, spawnAsync } from '../../shared/download.js';
-import { SYSTEM } from '../../shared/system.js';
-import { dryRun, execAsync, execOutput, exists, log, mkdirp } from '../env.js';
-import { installOnce, resolveCached, tool, versionFromFiles, versionOf } from './common.js';
-import { pickPackageVersion } from './versions.js';
-/** Writes `<name>.cmd` into tools\shims (on PATH). */
-const shim = (env, name, command) => {
-    fs.writeFileSync(path.join(mkdirp(tool('shims')), name + '.cmd'), '@echo off\r\n' + command + ' %*\r\n');
-    env.prepend.push(tool('shims'));
-};
-// ---- Visual C++ runtime ----------------------------------------------------------------------------------------------
-const VC_REDIST = 'https://aka.ms/vs/17/release/vc_redist.x64.exe';
-/**
- * vcruntime140.dll & co. A real installer (it writes to System32), so it runs on every boot; the installer itself is
- * kept in persistent storage and only run when Microsoft's signature on it checks out. Resolves true when this call
- * ran the installer. Only the "Visual C++ runtime" step reports it (`summary`); PHP calls it again just to be sure.
- */
-export const setupVcRuntime = async (env, summary = true) => {
-    if (dryRun) {
-        log('(dry run) would install the Visual C++ runtime');
-        return false;
-    }
-    const system32 = path.join(process.env.WINDIR ?? 'C:\\Windows', 'System32');
-    const missing = !exists(path.join(system32, 'vcruntime140.dll')) || !exists(path.join(system32, 'msvcp140.dll'));
-    if (missing) {
-        const installer = tool('vcredist', 'vc_redist.x64.exe');
-        if (!exists(installer)) {
-            log('Downloading the Visual C++ runtime ...');
-            await download(VC_REDIST, installer);
-        }
-        const signer = execOutput(SYSTEM.powershell(), ['-NoLogo', '-NoProfile', '-Command', "$s = Get-AuthenticodeSignature -LiteralPath '" + installer.replace(/'/g, "''") + "'; if ($s.Status -eq 'Valid') { $s.SignerCertificate.Subject }"]);
-        if (signer.trim() !== 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US') {
-            fs.rmSync(installer, { force: true });
-            throw new Error('vc_redist.x64.exe is not signed by Microsoft; deleted it (it is downloaded again next boot)');
-        }
-        log('Installing the Visual C++ runtime ...');
-        // 1638: a newer version is already installed; 3010: installed, a restart would finish it (not needed for the DLLs).
-        const code = await spawnAsync(installer, ['/install', '/quiet', '/norestart']);
-        if (![0, 1638, 3010].includes(code ?? -1) || !exists(path.join(system32, 'vcruntime140.dll')))
-            throw new Error('the Visual C++ runtime installer failed (exit ' + code + ')');
-    }
-    if (summary)
-        env.summary.push('vc++ runtime: installed');
-    return missing;
-};
-const RUBY_ASSET = /^rubyinstaller-(\d+\.\d+\.\d+)-(\d+)-x64\.7z$/;
-/** RubyInstaller builds per Ruby version (newest build of each), from its GitHub releases. */
-const rubyBuilds = async () => {
-    const releases = await fetchJson('https://api.github.com/repos/oneclick/rubyinstaller2/releases?per_page=100');
-    const builds = new Map();
-    for (const asset of releases.filter((r) => !r.draft && !r.prerelease).flatMap((r) => r.assets)) {
-        const match = RUBY_ASSET.exec(asset.name);
-        const known = match && builds.get(match[1]);
-        if (match && (!known || Number(RUBY_ASSET.exec(known.name)[2]) < Number(match[2])))
-            builds.set(match[1], asset);
-    }
-    return builds;
-};
-export const setupRuby = async (env, config) => {
-    const wantedSpec = versionFromFiles(['.ruby-version']) ?? { spec: config.version, source: 'config' };
-    if (dryRun) {
-        log('(dry run) would provision Ruby ' + wantedSpec.spec);
-        return;
-    }
-    const version = await resolveCached('ruby:' + wantedSpec.spec, async () => pickPackageVersion([...(await rubyBuilds()).keys()], wantedSpec.spec) ?? Promise.reject(new Error('No RubyInstaller build matches "' + wantedSpec.spec + '"')));
-    const home = tool('ruby', version);
-    if (!exists(path.join(home, 'bin', 'ruby.exe'))) {
-        const asset = (await rubyBuilds()).get(version);
-        if (!asset)
-            throw new Error('RubyInstaller ' + version + ' is no longer published');
-        log('Downloading ' + asset.name + ' ...');
-        await installArchive(asset.browser_download_url, home, { sha256: asset.digest?.startsWith('sha256:') ? asset.digest.slice(7) : null, locate: 'ruby.exe', up: 1, fileName: asset.name });
-    }
-    const gems = tool('ruby-gems', version.split('.').slice(0, 2).join('.'));
-    Object.assign(env.vars, { GEM_HOME: gems, BUNDLE_USER_HOME: tool('bundle-home') });
-    env.prepend.push(path.join(home, 'bin'), path.join(gems, 'bin'));
-    env.summary.push('ruby: ' + versionOf(path.join(home, 'bin', 'ruby.exe')) + ' (from ' + wantedSpec.source + '; gems with C extensions need MSYS2, not included)');
-    const gem = path.join(home, 'bin', 'gem.cmd');
-    await installOnce(env, 'gem@' + version, config.gems, (pkg) => execAsync(SYSTEM.cmd(), ['/d', '/c', gem, 'install', pkg, '--no-document'], { env: { ...process.env, GEM_HOME: gems } }));
-};
-const PHP_EXTENSIONS = ['curl', 'fileinfo', 'gd', 'intl', 'mbstring', 'openssl', 'pdo_mysql', 'pdo_pgsql', 'pdo_sqlite', 'sodium', 'sqlite3', 'zip'];
-/** The non-thread-safe x64 zip of the newest release matching `spec` ("8" -> newest 8.x, "8.3" -> newest 8.3.x). */
-const phpBuild = async (spec) => {
-    const releases = await fetchJson('https://windows.php.net/downloads/releases/releases.json');
-    const pick = pickPackageVersion(Object.values(releases).map((r) => r.version), spec);
-    const release = Object.values(releases).find((r) => r.version === pick);
-    const build = release && Object.entries(release).find(([key, value]) => /^nts-vs\d+-x64$/.test(key) && typeof value === 'object' && value.zip)?.[1];
-    if (!release || typeof build !== 'object' || !build.zip)
-        throw new Error('No PHP build for Windows matches "' + spec + '"');
-    return { version: release.version, ...build.zip };
-};
-/** php.ini from the development template with the common extensions switched on. */
-const writePhpIni = (home) => {
-    const ini = path.join(home, 'php.ini');
-    if (exists(ini) || !exists(path.join(home, 'php.ini-development')))
-        return;
-    let text = fs.readFileSync(path.join(home, 'php.ini-development'), 'utf8')
-        .replace(/^;\s*extension_dir\s*=\s*"ext"/m, 'extension_dir = "' + path.join(home, 'ext') + '"');
-    for (const ext of PHP_EXTENSIONS.filter((e) => exists(path.join(home, 'ext', 'php_' + e + '.dll'))))
-        text = text.replace(new RegExp('^;(extension=' + ext + ')\\s*$', 'm'), '$1');
-    fs.writeFileSync(ini, text);
-};
-export const setupPhp = async (env, config) => {
-    const wantedSpec = versionFromFiles(['.php-version']) ?? { spec: config.version, source: 'config' };
-    if (dryRun) {
-        log('(dry run) would provision PHP ' + wantedSpec.spec + (config.composer ? ' + Composer' : ''));
-        return;
-    }
-    // No summary line of its own: the Visual C++ runtime step (which runs first) already reports it.
-    await setupVcRuntime(env, false);
-    const version = await resolveCached('php:' + wantedSpec.spec, async () => (await phpBuild(wantedSpec.spec)).version);
-    const home = tool('php', version);
-    if (!exists(path.join(home, 'php.exe'))) {
-        const build = await phpBuild(version);
-        log('Downloading ' + build.path + ' ...');
-        await installArchive('https://windows.php.net/downloads/releases/' + build.path, home, { sha256: build.sha256, locate: 'php.exe', fileName: build.path });
-    }
-    writePhpIni(home);
-    env.prepend.push(home);
-    env.summary.push('php: ' + version + ' (from ' + wantedSpec.source + ')');
-    if (!config.composer)
-        return;
-    const phar = tool('composer', 'composer.phar');
-    if (!exists(phar)) {
-        log('Downloading Composer ...');
-        await download('https://getcomposer.org/download/latest-stable/composer.phar', phar, (await fetchText('https://getcomposer.org/download/latest-stable/composer.phar.sha256sum')).trim().split(/\s+/)[0]);
-    }
-    const composerHome = tool('composer-home');
-    env.vars.COMPOSER_HOME = composerHome;
-    env.prepend.push(path.join(composerHome, 'vendor', 'bin'));
-    shim(env, 'composer', '"' + path.join(home, 'php.exe') + '" "' + phar + '"');
-    env.summary.push('composer: ' + (/\d+\.\d+\.\d+/.exec(execOutput(path.join(home, 'php.exe'), [phar, '--version', '--no-ansi']))?.[0] ?? 'installed'));
-};

package/dist/selftest/guest.test.d.ts

@@ -1,3 +0,0 @@
-import type { Fixtures } from './fixtures.js';
-import type { Harness } from './harness.js';
-export declare const guestTests: (t: Harness, f: Fixtures) => Promise<string>;

package/dist/selftest/guest.test.js

@@ -1,61 +0,0 @@
-// Generated sandbox (.wsb + launch folder) and the guest boot in dry-run mode.
-import fs from 'node:fs';
-import path from 'node:path';
-import { buildWsb, gitIdentity, resolveMemoryMb } from '../host/generate.js';
-import { readJsonFile } from '../shared/rundir.js';
-export const guestTests = async (t, f) => {
-    const { check, rejects, at } = { ...t, at: f.at };
-    t.section('generated sandbox');
-    const rA = await f.run();
-    const gen = f.generate(rA, ['--version'], { ...f.probe, gitDir: f.shared, nvmDir: f.workB });
-    const wsb = fs.readFileSync(gen.wsbPath, 'utf8');
-    check(wsb.includes('<MemoryInMB>8192</MemoryInMB>') && wsb.includes('<SandboxFolder>C:\\Workspace\\work-a</SandboxFolder>') && wsb.includes('C:\\HostTools\\git') && wsb.includes('C:\\HostTools\\nvm') && !wsb.includes('Missing') && wsb.includes('logon.cmd</Command>') && wsb.includes('<vGPU>Disable</vGPU>'), 'wsb: memory, workspace, host git/nvm, optional mapping skipped, logon command, vGPU off');
-    const files = ['package.json', 'runtime/main.js', 'runtime/daemon.js', 'runtime/view.js', 'runtime/gitguard.js', 'sandbox/bootstrap.ps1', 'sandbox/logon.cmd', 'sandbox/trust.cmd', 'sandbox/ptyhost.cs', 'sandbox/gitshim.cs'];
-    const missing = files.filter((file) => !fs.existsSync(path.join(gen.launchPath, file)));
-    check(missing.length === 0 && fs.readdirSync(path.join(gen.launchPath, 'runtime')).length === 5, 'launch folder has the bundled sandbox runtime (5 self-contained files), the C# sources and the boot scripts' + (missing.length ? ' (missing: ' + missing.join(', ') + ')' : ''));
-    const logon = fs.readFileSync(path.join(gen.launchPath, 'sandbox', 'logon.cmd'), 'utf8');
-    check(logon.indexOf('trust.cmd') < logon.indexOf('wt.exe') && logon.includes('tools\\terminal\\wt.exe') && logon.includes('-NoExit'), 'logon.cmd applies sandbox trust settings first, then opens Windows Terminal (PowerShell fallback)');
-    const session = f.readJson(gen.sessionPath);
-    check(session.launchId === gen.launchId && session.workspace === 'C:\\Workspace\\work-a' && session.workspaceHost === f.workA && session.harnessArguments[0] === '--version' && session.hostTools.git && session.hostTools.nvm && /^\d+\.\d+\.\d+$/.test(session.hostTools.nodeVersion ?? '') && session.versions.node.spec === '22.3.0' && session.provisioning.git.access === 'full', 'session.json carries ids, paths, versions, host tools and git access');
-    const staged = path.join(gen.launchPath, 'claude-profile');
-    check(['settings.json', 'CLAUDE.md', '.claude.json', 'plugins'].every((file) => fs.existsSync(path.join(staged, file))) && !fs.existsSync(path.join(staged, '.credentials.json')), 'Claude settings and plugins staged; the login is not');
-    check(gitIdentity('[user]\n\tname = Josh\n\temail = "j@x.io"\n[credential]\n\thelper = store\n[url "https://TOKEN@github.com/"]\n\tinsteadOf = https://github.com/\n') === '[user]\n\tname = Josh\n\temail = j@x.io\n' && gitIdentity('[core]\n\tname = x\n') === '', 'only name/email from ~/.gitconfig reach the sandbox (no credential helpers or token URLs)');
-    check(buildWsb(f.baseConfig, 4096, [{ host: 'C:\\a&b', guest: 'C:\\X', readOnly: true }]).includes('C:\\a&amp;b'), 'wsb values are XML-escaped');
-    check(resolveMemoryMb({ ...f.baseConfig.sandbox, memoryMb: 'auto' }, 40000 * 1048576) === 31744 && await rejects(() => resolveMemoryMb({ ...f.baseConfig.sandbox, memoryMb: 'auto' }, 9000 * 1048576), 'Not enough free RAM'), "memory 'auto' follows free RAM minus reserve");
-    t.section('guest boot (dry run)');
-    const data1 = at('data1');
-    const r1 = f.runGuest(gen.launchPath, data1, f.workA, { AGENT_TEST_EXEMPT: '172.28.0.1' });
-    check(r1.status === 0 && r1.out.includes('would run:') && r1.out.includes('--version') && r1.out.includes('cwd=' + f.workA), 'guest starts the agent with its arguments in the workspace' + (r1.status === 0 ? '' : '\n' + r1.out));
-    check(['would provision nvm and Node 22.3.0 (from this PC)', 'would provision Python 3', 'would provision MinGW-w64 GCC', 'would provision Rust', '.NET SDK', 'would provision bun', 'would provision uv', 'would provision Git for Windows from this PC'].every((s) => r1.out.includes(s)), 'guest provisions nvm/Node, Python, MinGW, Rust, .NET, Bun, uv, Git');
-    const claudeState = path.join(data1, 'state', 'claude');
-    check(fs.readFileSync(path.join(claudeState, 'settings.json'), 'utf8').includes('dark') && fs.existsSync(path.join(claudeState, 'commands', 'review.md')) && !fs.existsSync(path.join(claudeState, '.credentials.json')), 'guest applied host Claude settings (no login)');
-    check(fs.readFileSync(path.join(claudeState, 'plugins', 'installed_plugins.json'), 'utf8').includes(JSON.stringify(claudeState).slice(1, -1)), 'plugin manifests are re-pointed at the sandbox Claude folder');
-    const guestState = f.readJson(path.join(claudeState, '.claude.json'));
-    check(guestState.mcpServers?.github?.command === 'npx', 'MCP servers from this PC are in the sandbox');
-    const manifest = fs.readFileSync(at('managed', 'CLAUDE.md'), 'utf8');
-    check(manifest.includes('DISPOSABLE Windows Sandbox') && manifest.includes(f.workA) && manifest.split('\n').length < 16 && fs.readFileSync(path.join(claudeState, 'CLAUDE.md'), 'utf8') === 'my rules' && fs.existsSync(path.join(data1, 'SANDBOX.md')), 'agent manifest goes to the managed CLAUDE.md (tiny); the user CLAUDE.md is untouched');
-    check(!fs.existsSync(at('managed', 'managed-settings.json')), 'git access full: no managed deny rules');
-    check(r1.out.includes('AgentSandbox-Block-Private') && r1.out.includes('remoteport=1-52,54-65535'), 'guest firewall plan blocks the LAN but keeps DNS to the gateway');
-    check(readJsonFile(path.join(data1, 'run', 'sandbox.json'))?.phase === 'ready', 'guest reports "ready" in run/sandbox.json');
-    // Second boot: host changed its MCP servers; the sandbox keeps its own .claude.json but gets the new servers.
-    fs.writeFileSync(path.join(claudeState, '.claude.json'), JSON.stringify({ ...guestState, oauthAccount: { emailAddress: 'sandbox@x' }, mcpServers: { local: { command: 'x' } } }));
-    fs.writeFileSync(path.join(gen.launchPath, 'claude-profile', '.claude.json'), JSON.stringify({ mcpServers: { github: { command: 'npx2' } }, projects: { [f.workA.replace(/\\/g, '/')]: { mcpServers: { db: { command: 'pg' } } } } }));
-    f.runGuest(gen.launchPath, data1, f.workA);
-    const merged = f.readJson(path.join(claudeState, '.claude.json'));
-    check(merged.oauthAccount.emailAddress === 'sandbox@x' && merged.mcpServers.github.command === 'npx2' && merged.mcpServers.local.command === 'x' && Object.values(merged.projects).some((p) => p.mcpServers?.db), 'MCP servers re-sync every boot (user + project scope) without touching the sandbox login');
-    const readonlyConfig = f.makeConfig();
-    readonlyConfig.provisioning.git.access = 'readonly';
-    const genRo = f.generate(await f.run({}, readonlyConfig));
-    f.runGuest(genRo.launchPath, at('data-ro'), f.workA, { AGENT_MANAGED_DIR: at('managed-ro') });
-    const policy = f.readJson(at('managed-ro', 'managed-settings.json'));
-    check(policy.permissions.deny.includes('Bash(git commit:*)') && policy.permissions.deny.includes('PowerShell(git push:*)') && policy.permissions.deny.includes('Edit(**/.git/**)') && !policy.permissions.deny.includes('Bash(git status:*)'), 'git readonly: Claude managed settings deny writing git commands and .git edits');
-    const genHook = f.generate(await f.run({ cwd: f.workB, harness: 'claude', trustConfig: true }));
-    const rHook = f.runGuest(genHook.launchPath, at('data-hook'), f.workB);
-    check(rHook.status === 0 && fs.readFileSync(at('data-hook', 'hook-ran.txt'), 'utf8') === f.workB, 'local "scripts" run inside the sandbox with the workspace set');
-    const genInstall = f.generate(await f.run({}, f.makeConfig(false)), [], { ...f.probe, nodeDir: null, harnessExe: null });
-    const r3 = f.runGuest(genInstall.launchPath, at('data3'), f.workA, { AGENT_HOST_TOOLS_DIR: at('empty') });
-    check(r3.status === 0 && r3.out.includes('npm-cli.js') && r3.out.includes('@anthropic-ai/claude-code') && !fs.readFileSync(genInstall.wsbPath, 'utf8').includes('HostTools'), 'install mode: nothing mapped from this PC, agent installed with npm');
-    const r5 = f.runGuest(f.generate(await f.run({ noAgent: true })).launchPath, at('data5'), f.workA);
-    check(r5.status === 0 && r5.out.includes('no agent requested'), '--no-agent provisions without an agent');
-    return gen.launchPath;
-};

package/dist/selftest/helpers.test.d.ts

@@ -1,2 +0,0 @@
-import type { Harness } from './harness.js';
-export declare const helperTests: (t: Harness) => void;

package/dist/selftest/helpers.test.js

@@ -1,125 +0,0 @@
-// Small pure helpers: version picking, .reg generation, firewall maths, storage cleanup.
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { pathToFileURL } from 'node:url';
-import { pruneStorage } from '../host/cleanup.js';
-import { toRegFile } from '../host/personalize.js';
-import { javaMajorFrom, pickGoRelease, pickNodeVersion, pickPackageVersion, pickSpreadVersions, projectUses, specFromVersionFile } from '../guest/toolchains/versions.js';
-import { parseReleaseTags } from '../shared/download.js';
-import { buildFirewallCommands, cidrToRange, ipv4DnsServers, parseDefaultGateways, parseDnsServers, subtractIps } from '../shared/netrules.js';
-import { ensureDir, isWin } from '../core/util.js';
-import { decidePwsh, pcHasPwsh, PWSH_MAX_BYTES, readPwshScripts, usesPwsh } from '../core/detect-pwsh.js';
-import { binstallAsset, CLI_TOOLS, decideCli, pwshAsset } from '../guest/toolchains/catalogue.js';
-import { PWSH_PROFILE_GUID, syncPwshProfile, withPwshProfile } from '../host/terminal.js';
-export const helperTests = (t) => {
-    const { check, write } = t;
-    t.section('versions, registry, firewall');
-    const releases = [{ version: 'v23.1.0', lts: false }, { version: 'v22.11.0', lts: 'Jod' }, { version: 'v20.18.0', lts: 'Iron' }, { version: 'v20.9.0', lts: 'Iron' }];
-    check(pickNodeVersion(releases, 'lts/*') === '22.11.0' && pickNodeVersion(releases, 'lts/iron') === '20.18.0' && pickNodeVersion(releases, '20') === '20.18.0' && pickNodeVersion(releases, 'v20.9.0') === '20.9.0' && pickNodeVersion(releases, 'node') === '23.1.0' && pickNodeVersion(releases, '99') === null, '.nvmrc specs resolve (lts/*, lts/<name>, major, exact, node)');
-    const spread = pickSpreadVersions(['16.20.2', '18.19.0', '18.20.4', '20.18.0', '22.3.0', '22.11.0', '23.1.0', 'notes'], '22.11.0', 3);
-    check(JSON.stringify(spread) === '["22.11.0","16.20.2","23.1.0"]' && pickSpreadVersions(['20.18.0'], '22.3.0', 3).join() === '22.3.0,20.18.0' && pickSpreadVersions(['18.20.4', '20.18.0'], '22.3.0', 1).join() === '22.3.0', 'host nvm versions: capped, current first, rest spread across other majors');
-    const go = [{ version: 'go1.24rc1', stable: false, files: [] }, { version: 'go1.23.2', stable: true, files: [] }, { version: 'go1.23.1', stable: true, files: [] }, { version: 'go1.22.8', stable: true, files: [] }];
-    check(pickGoRelease(go, 'stable')?.version === 'go1.23.2' && pickGoRelease(go, '1.22')?.version === 'go1.22.8' && pickGoRelease(go, 'go1.23.1')?.version === 'go1.23.1' && pickGoRelease(go, '1.30') === null, 'Go versions resolve (stable, minor prefix, exact; release candidates skipped)');
-    check(javaMajorFrom('21\n') === '21' && javaMajorFrom('17.0.9') === '17' && javaMajorFrom('1.8') === '8' && javaMajorFrom('temurin-21.0.2') === '21' && javaMajorFrom('# sdkman\njava=21.0.2-tem\n', true) === '21' && specFromVersionFile('ruby-3.3.1\n') === '3.3.1', 'version files: .java-version, .sdkmanrc, .ruby-version');
-    check(projectUses(['README.md', 'server/go.mod'], ['go.mod']) && projectUses(['App.csproj'], ['*.csproj']) && !projectUses(['notes.txt', 'docs/readme.md'], ['go.mod', '*.csproj']), 'enabled "auto": a language is used when its marker file is in the workspace or one folder down');
-    check(pickPackageVersion(['3.9.13', '3.12.7', '3.12.10', '3.13.0-rc1', '3.13.1'], '3') === '3.13.1' && pickPackageVersion(['3.12.7', '3.12.10'], '3.12') === '3.12.10' && pickPackageVersion(['2.7.18'], '2.7') === '2.7.18', 'Python versions resolve to the newest stable match');
-    const reg = toRegFile([{ key: 'Control Panel\\Desktop', name: 'WallpaperStyle', kind: 'String', value: '10' }, { key: 'X', name: 'D', kind: 'DWord', value: 4294967295 }, { key: 'X', name: 'B', kind: 'Binary', value: Buffer.from([1, 255]).toString('base64') }]);
-    check(reg.includes('[HKEY_CURRENT_USER\\Control Panel\\Desktop]') && reg.includes('"WallpaperStyle"="10"') && reg.includes('"D"=dword:ffffffff') && reg.includes('"B"=hex:01,ff'), 'personalisation: registry values become a valid .reg file (HKCU only)');
-    const [s172, e172] = cidrToRange('172.16.0.0/12');
-    const gw = 172 * 16777216 + 28 * 65536 + 1;
-    check(subtractIps([[s172, e172]], ['172.28.0.1']).every(([s, e]) => gw < s || gw > e) && !buildFirewallCommands(['8.8.8.8']).join().includes('8.8.8.8'), 'firewall maths: private block minus the gateway; public addresses ignored');
-    check(parseDefaultGateways('  0.0.0.0          0.0.0.0     172.28.80.1   172.28.85.200     5\n').join() === '172.28.80.1' && parseDnsServers('   DNS Servers . . . : 172.28.80.1\n                       8.8.8.8\n   NetBIOS : x\n').join() === '172.28.80.1,8.8.8.8', 'parses gateway and DNS servers');
-    check(ipv4DnsServers(['172.28.80.1', '8.8.8.8:1053', '[::1]:53', 'fe80::1']).join() === '172.28.80.1,8.8.8.8', 'DNS servers from the resolver (any Windows language): IPv4 only, ports dropped');
-    check(parseReleaseTags('<a href="/coreybutler/nvm-windows/releases/tag/1.2.2">x</a><a href="/coreybutler/nvm-windows/releases/tag/1.2.2">y</a><a href="/other/repo/releases/tag/9">z</a><a href="/coreybutler/nvm-windows/releases/tag/1.1.12">w</a>', 'coreybutler/nvm-windows').join() === '1.2.2,1.1.12', 'GitHub release list page: this repo\'s tags in order, once each');
-    t.section('cmd quoting (npm agents)');
-    // ptyhost.ts loads env.ts, which reads session.json: import it in a child with a throwaway launch/data folder.
-    const quoteDir = path.join(t.temp, 'quote');
-    write(path.join(quoteDir, 'launch', 'session.json'), '{}');
-    const agentCmd = write(path.join(quoteDir, 'agent.cmd'), '@"' + process.execPath + '" -e "console.log(JSON.stringify(process.argv.slice(1)))" %*\r\n');
-    // Odd quote counts flip cmd's quote state for every later argument: those come after them on purpose.
-    const tricky = ['https://x?a=1&b=2', '50% off', 'a|b<c>d', 'x^y', 'say "hi" & go', 'plain', '%PATH%', 'a"b&c', 'q"x|y^z"w', 'e"5%', 'k&v', '100%'];
-    const probe = spawnSync(process.execPath, ['--input-type=module', '-e', [
-            'const m = await import(process.argv[1]); const [cmd, tricky] = JSON.parse(process.argv[2]);',
-            'console.log(JSON.stringify({ normal: m.commandLine("C:\\\\W\\\\cmd.exe", ["/d", "/c", "C:\\\\a\\\\agent.cmd", "--model", "big one", "plain", ""]), direct: m.commandLine("C:\\\\a\\\\agent.exe", ["a&b", "50%"]),',
-            '  url: m.cmdArgs(["https://x?a=1&b=2"]), pct: m.cmdArgs(["50%"]), live: m.commandLine("cmd.exe", ["/d", "/c", cmd, ...tricky]).slice(8) }));',
-        ].join('\n'), pathToFileURL(path.join(t.packageRoot, 'dist', 'guest', 'ptyhost.js')).href, JSON.stringify([agentCmd, tricky])], {
-        encoding: 'utf8', env: { ...process.env, AGENT_LAUNCH_DIR: path.join(quoteDir, 'launch'), AGENT_DATA_DIR: path.join(quoteDir, 'data') },
-    });
-    const quoting = (() => { try {
-        return JSON.parse(probe.stdout);
-    }
-    catch {
-        return {};
-    } })();
-    check(quoting.normal === 'C:\\W\\cmd.exe /d /c C:\\a\\agent.cmd --model "big one" plain ""' && quoting.direct === 'C:\\a\\agent.exe a&b 50%', 'command lines: ordinary arguments quoted as before; a program started directly gets & and % unchanged' + (quoting.normal ? '' : ' (' + (probe.stderr || probe.stdout).trim().slice(0, 300) + ')'));
-    check(quoting.url === '"https://x?a=1&b=2"' && quoting.pct === '"50"%""', 'cmd /c arguments: & | < > ^ quoted, % split out so no %name% expands');
-    // (Agents live under C:\AgentData\tools; a temp folder with spaces would also need cmd's quote rules, so skip there.)
-    if (isWin && quoting.live && !/\s/.test(agentCmd)) {
-        const echoed = spawnSync(process.env.ComSpec ?? 'cmd.exe', [quoting.live], { encoding: 'utf8', windowsVerbatimArguments: true, windowsHide: true });
-        check(echoed.stdout.trim() === JSON.stringify(tricky), 'cmd /d /c <agent>.cmd passes &, |, <, >, ^, % and quotes through to the agent unchanged (got ' + echoed.stdout.trim() + ')');
-    }
-    t.section('cleanup');
-    const store = path.join(t.temp, 'prune');
-    const aged = (p, days) => { const d = new Date(Date.now() - days * 86400000); fs.utimesSync(p, d, d); };
-    for (const [name, days] of [['old', 9], ['kept', 30], ['new', 1]]) {
-        aged(write(path.join(store, 'launches', name, 'agent.wsb'), 'x'), days);
-        aged(path.join(store, 'launches', name), days);
-    }
-    aged(write(path.join(store, 'data', 'd', 'logs', 'guest-old.log'), 'x'), 20);
-    write(path.join(store, 'data', 'd', 'logs', 'guest-new.log'), 'x');
-    ensureDir(path.join(store, 'data', 'd', 'tools', 'git.staging-ab12'));
-    aged(path.join(store, 'data', 'd', 'tools', 'git.staging-ab12'), 2);
-    ensureDir(path.join(store, 'data', 'd', 'tools', 'node'));
-    const pruned = pruneStorage(store, { keep: ['kept'] });
-    const left = (p) => fs.existsSync(path.join(store, p));
-    check(pruned.launches === 1 && !left('launches/old') && left('launches/kept') && left('launches/new') && !left('data/d/logs/guest-old.log') && left('data/d/logs/guest-new.log') && !left('data/d/tools/git.staging-ab12') && left('data/d/tools/node'), 'cleanup: launches > 7 days, logs > 14 days and interrupted downloads go; the running launch and real tools stay');
-    t.section('PowerShell 7, CLI catalogue, cargo-binstall');
-    const pwshNames = ['PowerShell-7.6.6-win-x64.zip', 'PowerShell-7.6.6-win-arm64.zip', 'PowerShell-7.6.6-win-x64.msi', 'PowerShell-7.6.6-win-fxdependent.zip', 'PowerShell-7.6.6-win-x86.zip', 'PowerShell-7.6.6-win-x64.zip.sha256'];
-    check(pwshNames.filter((n) => pwshAsset('x64').test(n)).join() === 'PowerShell-7.6.6-win-x64.zip' && pwshNames.filter((n) => pwshAsset('arm64').test(n)).join() === 'PowerShell-7.6.6-win-arm64.zip', 'PowerShell 7: the portable zip for the architecture (no MSI, fxdependent or x86 build)');
-    const binstallNames = ['cargo-binstall-x86_64-pc-windows-msvc.zip', 'cargo-binstall-x86_64-pc-windows-msvc.full.zip', 'cargo-binstall-x86_64-pc-windows-msvc.zip.sig', 'cargo-binstall-aarch64-pc-windows-msvc.zip', 'cargo-binstall-x86_64-unknown-linux-musl.tgz'];
-    check(binstallNames.filter((n) => binstallAsset('x64').test(n)).join() === 'cargo-binstall-x86_64-pc-windows-msvc.zip' && binstallNames.filter((n) => binstallAsset('arm64').test(n)).join() === 'cargo-binstall-aarch64-pc-windows-msvc.zip', 'cargo-binstall: the plain Windows zip for the architecture (not .full, not the signature)');
-    const cliAsset = (name, arch, names) => names.filter((n) => CLI_TOOLS.find((c) => c.name === name).asset(arch).test(n)).join();
-    const ghNames = ['gh_2.102.0_windows_amd64.zip', 'gh_2.102.0_windows_amd64.msi', 'gh_2.102.0_windows_386.zip', 'gh_2.102.0_windows_arm64.zip', 'gh_2.102.0_linux_amd64.tar.gz'];
-    const zstdNames = ['zstd-v1.5.7-win64.zip', 'zstd-v1.5.7-win32.zip', 'zstd-v1.5.7.tar.gz'];
-    check(cliAsset('gh', 'x64', ghNames) === 'gh_2.102.0_windows_amd64.zip' && cliAsset('gh', 'arm64', ghNames) === 'gh_2.102.0_windows_arm64.zip' && cliAsset('zstd', 'x64', zstdNames) === 'zstd-v1.5.7-win64.zip' && cliAsset('zstd', 'arm64', zstdNames) === 'zstd-v1.5.7-win64.zip' && CLI_TOOLS.every((c) => c.exe.endsWith('.exe')), 'CLI catalogue: gh and zstd release zips per architecture (zstd: win64 also on Arm)');
-    const cli = (settings, gitAccess, hasGithubDir = false) => Object.entries(decideCli(settings, { gitAccess, hasGithubDir })).filter(([, d]) => d.on).map(([n]) => n).join();
-    check(cli({ gh: true, zstd: true, openssl: true }, 'full') === 'gh,zstd,openssl' && cli({ gh: true, zstd: true }, 'readonly') === 'zstd' && cli({ gh: 'auto' }, 'none', true) === '' && decideCli({ gh: true }, { gitAccess: 'readonly', hasGithubDir: false }).gh.reason.includes('"full"'), 'CLI catalogue: gh only with git access "full" (it pushes through the API), whatever the config says');
-    check(cli({ gh: 'auto', zstd: 'auto', openssl: 'auto' }, 'full', true) === 'gh,openssl' && cli({ gh: 'auto', zstd: 'auto' }, 'full', false) === '' && cli({}, 'full', true) === '', 'CLI catalogue: "auto" = gh with a .github folder, openssl always (a shim), zstd only when listed; unlisted tools stay off');
-    const ps = (text, file = 'moh.ps1') => usesPwsh([{ path: file, text }]);
-    check(ps('#Requires -Version 7.2\nparam()') === 'moh.ps1: #Requires -Version 7' && ps('  #requires -PSEdition Core') !== null && ps('#Requires -Modules Pester -Version 7') !== null && ps('<#\n.SYNOPSIS\n  Usage: pwsh scripts/moh/build-openmohaa.ps1 -Release\n#>') !== null && ps('& pwsh.exe -NoProfile -File x.ps1') !== null && ps('C:\\Program Files\\PowerShell\\7\\pwsh.exe -c 1') !== null, 'pwsh markers: #Requires -Version 7+ / -PSEdition Core, and pwsh usage lines');
-    check(ps('#Requires -Version 5.1') === null && ps('#Requires -PSEdition Desktop') === null && ps('# Works in Windows PowerShell and pwsh too.') === null && ps('$pwsh -x; Write-Host mypwsh -y') === null && ps('#Requires -Version 7', 'notes.txt') === null && ps('Write-Host hi') === null, 'pwsh markers: Windows PowerShell scripts, prose, variables and non-scripts do not count');
-    const evilStart = Date.now();
-    const evilText = (' #requires' + ' -version'.repeat(5000) + '\n' + 'xpwsh pwsh\t\t'.repeat(20000) + '\n' + ' '.repeat(100000) + 'pwsh\n' + 'pwsh\n'.repeat(50000)).repeat(3);
-    const evil = usesPwsh(Array.from({ length: 100 }, (_, i) => ({ path: 'a' + i + '.ps1', text: evilText })));
-    check(evil === null && Date.now() - evilStart < 2000, 'pwsh markers: hostile scripts (huge lines, endless repeats) are capped and scanned in linear time (' + (Date.now() - evilStart) + ' ms)');
-    check(decidePwsh('auto', [], true, true).on && !decidePwsh('auto', [], false, true).on && !decidePwsh('auto', [], true, false).on && decidePwsh('auto', [{ path: 'x/run.ps1', text: '#Requires -PSEdition Core' }], false, false).reason === 'x/run.ps1: #Requires -PSEdition Core' && !decidePwsh(false, [{ path: 'a.ps1', text: '#Requires -Version 7' }], true, true).on && decidePwsh(true, [], false, false).on, 'pwsh "auto": a script that needs it, else this PC has it (new folder only); true/false win');
-    const pf = 'C:\\PF';
-    check(pcHasPwsh({ ProgramFiles: pf }, (p) => p === 'C:\\PF\\PowerShell\\7\\pwsh.exe') && pcHasPwsh({ PATH: 'C:\\x;C:\\tools\\pwsh' }, (p) => p === 'C:\\tools\\pwsh\\pwsh.exe') && !pcHasPwsh({ ProgramFiles: pf, PATH: 'C:\\Users\\u\\AppData\\Local\\Microsoft\\WindowsApps' }, (p) => /WindowsApps/.test(p)), 'pwsh on this PC: Program Files\\PowerShell\\7 or PATH, not a Store alias');
-    const psRoot = path.join(t.temp, 'pwsh-scan');
-    write(path.join(psRoot, 'moh.ps1'), '#Requires -Version 7\n');
-    write(path.join(psRoot, 'scripts', 'build.ps1'), 'x'.repeat(200000) + '\n#Requires -Version 7');
-    write(path.join(psRoot, 'node_modules', 'pkg.ps1'), '#Requires -Version 7');
-    write(path.join(psRoot, 'scripts', 'deep', 'far.ps1'), '#Requires -Version 7');
-    write(path.join(psRoot, 'readme.md'), 'pwsh -File x.ps1');
-    const scanned = readPwshScripts(psRoot);
-    check(scanned.map((f) => f.path).join() === 'moh.ps1,scripts/build.ps1' && scanned[1].text.length === PWSH_MAX_BYTES, 'pwsh scan: *.ps1 at the root and one folder down only (node_modules skipped), each read up to its cap');
-    const shown = withPwshProfile({ theme: 'dark', profiles: { defaults: { font: {} } } }, true);
-    const shownList = shown?.profiles;
-    const tweaked = { profiles: { list: [{ guid: 'other' }, { guid: PWSH_PROFILE_GUID.toUpperCase(), name: 'My pwsh', fontSize: 14 }] } };
-    const hidden = withPwshProfile(tweaked, false)?.profiles;
-    check(shownList?.list.length === 1 && shownList.list[0].guid === PWSH_PROFILE_GUID && String(shownList.list[0].commandline).includes('pwsh.exe') && Boolean(shownList.defaults) && shown?.theme === 'dark' && withPwshProfile(shown, true) === null && withPwshProfile({ profiles: { defaults: {} } }, false) === null, 'Windows Terminal: a PowerShell 7 profile is added once pwsh is installed, nothing rewritten when already there or never wanted');
-    check(hidden?.list[1].hidden === true && hidden.list[1].name === 'My pwsh' && hidden.list[1].fontSize === 14 && hidden.list.length === 2 && (withPwshProfile({ profiles: [{ guid: 'a' }] }, true)?.profiles).list.length === 2, 'Windows Terminal: turning pwsh off hides the profile, keeping the user\'s edits; the old array form of "profiles" works');
-    const wtData = path.join(t.temp, 'wt-data');
-    const wtSettings = write(path.join(wtData, 'tools', 'terminal', 'settings', 'settings.json'), '// edited in the sandbox\n{ "theme": "light", "profiles": { "list": [{ "guid": "{x}", }] } }');
-    syncPwshProfile(wtData, true);
-    const before = fs.readFileSync(wtSettings, 'utf8');
-    write(path.join(wtData, 'tools', 'pwsh', 'pwsh.exe'), 'MZ');
-    syncPwshProfile(wtData, true);
-    const after = JSON.parse(fs.readFileSync(wtSettings, 'utf8'));
-    syncPwshProfile(wtData, false);
-    const off = JSON.parse(fs.readFileSync(wtSettings, 'utf8'));
-    write(path.join(wtData, 'tools', 'terminal', 'settings', 'settings.json'), '{ not json');
-    syncPwshProfile(wtData, true);
-    check(before.startsWith('// edited') && after.theme === 'light' && after.profiles.list.map((p) => p.guid).join() === '{x},' + PWSH_PROFILE_GUID && off.profiles.list[1].hidden === true && fs.readFileSync(wtSettings, 'utf8') === '{ not json', 'Windows Terminal settings.json (JSONC): untouched until pwsh is installed, then the profile is added, hidden when off; an unreadable file is left alone');
-};

package/dist/selftest/host.test.d.ts

@@ -1,2 +0,0 @@
-import type { Harness } from './harness.js';
-export declare const hostTests: (t: Harness) => void;