windows-development-sandbox 1.15.0 → 1.17.0

package/native/csharp/HcsHost/AssemblyInfo.cs

@@ -8,9 +8,9 @@ using System.Runtime.InteropServices;
 [assembly: AssemblyCompany("windows-development-sandbox (open source)")]
 [assembly: AssemblyProduct("Windows Development Sandbox")]
 [assembly: AssemblyCopyright("MIT License, windows-development-sandbox contributors")]
-[assembly: AssemblyVersion("1.15.0.0")]
-[assembly: AssemblyFileVersion("1.15.0.0")]
-[assembly: AssemblyInformationalVersion("1.15.0")]
+[assembly: AssemblyVersion("1.17.0.0")]
+[assembly: AssemblyFileVersion("1.17.0.0")]
+[assembly: AssemblyInformationalVersion("1.17.0")]
 [assembly: ComVisible(false)]
 // computecore.dll and computestorage.dll are not KnownDLLs: load them from System32 only, never from the exe's folder.
 [assembly: DefaultDllImportSearchPaths(DllImportSearchPath.System32)]

package/native/csharp/HostTools/AssemblyInfo.cs

@@ -8,7 +8,7 @@ using System.Runtime.InteropServices;
 [assembly: AssemblyCompany("windows-development-sandbox (open source)")]
 [assembly: AssemblyProduct("Windows Development Sandbox")]
 [assembly: AssemblyCopyright("MIT License, windows-development-sandbox contributors")]
-[assembly: AssemblyVersion("1.15.0.0")]
-[assembly: AssemblyFileVersion("1.15.0.0")]
-[assembly: AssemblyInformationalVersion("1.15.0")]
+[assembly: AssemblyVersion("1.17.0.0")]
+[assembly: AssemblyFileVersion("1.17.0.0")]
+[assembly: AssemblyInformationalVersion("1.17.0")]
 [assembly: ComVisible(false)]

package/native/csharp/HostTools/Program.cs

@@ -8,6 +8,7 @@
 //   user-path --add|--remove D  D first on, or off, your PATH; exit 3 when PATH would be too long
 //   web-helper --pipe P --server-pid N   Windows sign-in for the web UI (WebHelper.cs), until stdin closes
 //   door-client --owner USER   another user's side of that sign-in: prints the answer
+//   protect | unprotect        DPAPI for the current user (Protect.cs): base64 on stdin, base64 on stdout
 using System;
 using System.Collections.Generic;
 using System.Diagnostics;
@@ -112,6 +113,10 @@ static class Program
                     return Usage();
                 }
                 return AgentSandbox.WebHelper.Client(value);
+            case "protect":
+                return AgentSandbox.Protect.Run(true);
+            case "unprotect":
+                return AgentSandbox.Protect.Run(false);
             default:
                 return Usage();
         }
@@ -119,7 +124,7 @@ static class Program
 
     static int Usage()
     {
-        Console.Error.WriteLine("Usage: HostTools keep-awake --owner-pid N | stop-events --since <ISO time> | memory-status | hide-window --wait S | show-window [--handles a,b] | user-path --add|--remove <folder> | web-helper --pipe P --server-pid N | door-client --owner USER");
+        Console.Error.WriteLine("Usage: HostTools keep-awake --owner-pid N | stop-events --since <ISO time> | memory-status | hide-window --wait S | show-window [--handles a,b] | user-path --add|--remove <folder> | web-helper --pipe P --server-pid N | door-client --owner USER | protect | unprotect");
         return 2;
     }
 

package/native/csharp/HostTools/Protect.cs

@@ -0,0 +1,41 @@
+// HostTools protect / unprotect: Windows DPAPI for the current user, as native\scripts\protect-data.ps1 does it (same
+// entropy, same format), without starting PowerShell. Standard input: base64 of the bytes; standard output: base64 of
+// the result. Nothing goes on the command line or to disk.
+using System;
+using System.IO;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace AgentSandbox
+{
+    static class Protect
+    {
+        /// <summary>The fixed extra secret of protect-data.ps1: another program that calls DPAPI without it cannot open these.</summary>
+        private const string Entropy = "agent-sandbox/secret-store/v1";
+
+        public static int Run(bool protect)
+        {
+            try
+            {
+                string text;
+                using (Stream input = Console.OpenStandardInput())
+                using (StreamReader reader = new StreamReader(input, Encoding.ASCII))
+                {
+                    text = reader.ReadToEnd().Trim();
+                }
+                byte[] data = Convert.FromBase64String(text);
+                byte[] entropy = Encoding.UTF8.GetBytes(Entropy);
+                byte[] result = protect
+                    ? ProtectedData.Protect(data, entropy, DataProtectionScope.CurrentUser)
+                    : ProtectedData.Unprotect(data, entropy, DataProtectionScope.CurrentUser);
+                Console.Out.Write(Convert.ToBase64String(result));
+                return 0;
+            }
+            catch (Exception e)
+            {
+                Console.Error.WriteLine(e.Message);
+                return 1;
+            }
+        }
+    }
+}

package/native/csharp/StorageHelper/AssemblyInfo.cs

@@ -9,7 +9,7 @@ using System.Runtime.InteropServices;
 [assembly: AssemblyCompany("windows-development-sandbox (open source)")]
 [assembly: AssemblyProduct("Windows Development Sandbox")]
 [assembly: AssemblyCopyright("MIT License, windows-development-sandbox contributors")]
-[assembly: AssemblyVersion("1.15.0.0")]
-[assembly: AssemblyFileVersion("1.15.0.0")]
-[assembly: AssemblyInformationalVersion("1.15.0")]
+[assembly: AssemblyVersion("1.17.0.0")]
+[assembly: AssemblyFileVersion("1.17.0.0")]
+[assembly: AssemblyInformationalVersion("1.17.0")]
 [assembly: ComVisible(false)]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "windows-development-sandbox",
-  "version": "1.15.0",
+  "version": "1.17.0",
   "description": "A disposable Windows Sandbox for development, with or without an AI agent (Claude Code, Codex, Gemini, opencode, ...): the folder you run it from is the workspace, toolchains and databases for your project install themselves, and nothing else on your PC is reachable.",
   "type": "module",
   "license": "MIT",

package/schemas/config.schema.json

@@ -208,7 +208,7 @@
         },
         "vGpu": {
           "type": "boolean",
-          "description": "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it)."
+          "description": "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it). Browsers in the sandbox never use it (they draw in software)."
         },
         "networking": {
           "type": "boolean",
@@ -676,6 +676,39 @@
           },
           "additionalProperties": false
         },
+        "unreal": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "Unreal Engine development: Visual Studio Community 2022 with the C++ game workload (MSVC, a Windows 11 SDK, .NET Framework targeting packs, Unreal integration and the Epic Games Launcher) and the DirectX End-User Runtime. A real installer: it runs every boot (~10 GB on the sandbox disk). The engine itself comes from the Epic Games Launcher or its source. true, false, or \"auto\" = only when the project has a .uproject or .uplugin."
+            },
+            "acceptLicense": {
+              "type": "boolean",
+              "description": "Required to install: you accept the Visual Studio Community licence terms (https://visualstudio.microsoft.com/license-terms/) and the DirectX End-User Runtime licence."
+            },
+            "components": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "More Visual Studio workload or component IDs to add, e.g. [\"Microsoft.VisualStudio.Component.VC.Llvm.Clang\"]."
+            },
+            "keepInstallFiles": {
+              "type": "boolean",
+              "description": "Keep an offline copy of the Visual Studio install files in tools\\visualstudio (~10 GB, made once), so later boots install without downloading them again. Skipped while that disk has too little room."
+            }
+          },
+          "additionalProperties": false
+        },
         "cpp": {
           "type": "object",
           "properties": {

package/schemas/sandbox-config.schema.json

@@ -109,7 +109,7 @@
         },
         "vGpu": {
           "type": "boolean",
-          "description": "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it)."
+          "description": "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it). Browsers in the sandbox never use it (they draw in software)."
         },
         "networking": {
           "type": "boolean",
@@ -430,6 +430,39 @@
           },
           "additionalProperties": false
         },
+        "unreal": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "const": "auto"
+                }
+              ],
+              "description": "Unreal Engine development: Visual Studio Community 2022 with the C++ game workload (MSVC, a Windows 11 SDK, .NET Framework targeting packs, Unreal integration and the Epic Games Launcher) and the DirectX End-User Runtime. A real installer: it runs every boot (~10 GB on the sandbox disk). The engine itself comes from the Epic Games Launcher or its source. true, false, or \"auto\" = only when the project has a .uproject or .uplugin."
+            },
+            "acceptLicense": {
+              "type": "boolean",
+              "description": "Required to install: you accept the Visual Studio Community licence terms (https://visualstudio.microsoft.com/license-terms/) and the DirectX End-User Runtime licence."
+            },
+            "components": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "More Visual Studio workload or component IDs to add, e.g. [\"Microsoft.VisualStudio.Component.VC.Llvm.Clang\"]."
+            },
+            "keepInstallFiles": {
+              "type": "boolean",
+              "description": "Keep an offline copy of the Visual Studio install files in tools\\visualstudio (~10 GB, made once), so later boots install without downloading them again. Skipped while that disk has too little room."
+            }
+          },
+          "additionalProperties": false
+        },
         "cpp": {
           "type": "object",
           "properties": {