windows-development-sandbox 1.15.0 → 1.17.0

package/dist/bin/{chunk-D7CM63BS.js → chunk-REE3EMHD.js}

@@ -25938,6 +25938,7 @@ var DEFAULTS = {
       linkSlots: "auto"
     },
     msvc: { enabled: "auto", acceptLicense: false, msvcVersion: "latest", sdkVersion: "latest" },
+    unreal: { enabled: "auto", acceptLicense: false, components: [], keepInstallFiles: true },
     cpp: { enabled: "auto", flexBison: true },
     dotnet: {
       enabled: "auto",
@@ -46053,7 +46054,7 @@ var SandboxSchema = external_exports.strictObject({
     "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. Yours only: a project file cannot change it."
   ),
   vGpu: external_exports.boolean().describe(
-    "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it)."
+    "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it). Browsers in the sandbox never use it (they draw in software)."
   ),
   networking: external_exports.boolean().describe("Internet access. false is the only hard network isolation Windows Sandbox offers."),
   clipboard: external_exports.boolean().describe(
@@ -46215,6 +46216,21 @@ var ToolchainsSchema = external_exports.strictObject({
     msvcVersion: external_exports.string().min(1).describe('"latest" or an MSVC tools version prefix, e.g. "14.44".'),
     sdkVersion: external_exports.string().min(1).describe('"latest" or a Windows SDK build, e.g. "26100" or "10.0.22621".')
   }),
+  unreal: external_exports.strictObject({
+    enabled: enabled(
+      "Unreal Engine development: Visual Studio Community 2022 with the C++ game workload (MSVC, a Windows 11 SDK, .NET Framework targeting packs, Unreal integration and the Epic Games Launcher) and the DirectX End-User Runtime. A real installer: it runs every boot (~10 GB on the sandbox disk). The engine itself comes from the Epic Games Launcher or its source.",
+      "a .uproject or .uplugin"
+    ),
+    acceptLicense: external_exports.boolean().describe(
+      "Required to install: you accept the Visual Studio Community licence terms (https://visualstudio.microsoft.com/license-terms/) and the DirectX End-User Runtime licence."
+    ),
+    components: StringsSchema.describe(
+      'More Visual Studio workload or component IDs to add, e.g. ["Microsoft.VisualStudio.Component.VC.Llvm.Clang"].'
+    ),
+    keepInstallFiles: external_exports.boolean().describe(
+      "Keep an offline copy of the Visual Studio install files in tools\\visualstudio (~10 GB, made once), so later boots install without downloading them again. Skipped while that disk has too little room."
+    )
+  }),
   cpp: external_exports.strictObject({
     enabled: enabled(
       "MinGW-w64 GCC with CMake, Ninja, premake5 and mingw32-make (also Rust's linker).",
@@ -54689,7 +54705,23 @@ import { spawn as spawn8 } from "node:child_process";
 // src/host/secrets/secret-store.ts
 import { spawnSync as spawnSync19 } from "node:child_process";
 var TIMEOUT_MS2 = 6e4;
+var toolsFor = /* @__PURE__ */ new Map();
+function dpapiTool(storageRoot) {
+  if (!toolsFor.has(storageRoot)) {
+    let exe = null;
+    try {
+      exe = hostToolsExe(storageRoot);
+    } catch {
+    }
+    toolsFor.set(storageRoot, exe);
+  }
+  return toolsFor.get(storageRoot) ?? null;
+}
 var DpapiBox = class {
+  constructor(storageRoot) {
+    this.storageRoot = storageRoot;
+  }
+  storageRoot;
   kind = "dpapi1";
   seal(plain2) {
     return this.run("protect", plain2.toString("base64"));
@@ -54698,7 +54730,9 @@ var DpapiBox = class {
     return Buffer.from(this.run("unprotect", sealed), "base64");
   }
   run(mode, input2) {
-    const result = spawnSync19(SYSTEM.powershell(), nativeScript("protect-data.ps1", ["-Mode", mode]), {
+    const tools = this.storageRoot ? dpapiTool(this.storageRoot) : null;
+    const [exe, args] = tools ? [tools, [mode]] : [SYSTEM.powershell(), nativeScript("protect-data.ps1", ["-Mode", mode])];
+    const result = spawnSync19(exe, args, {
       input: input2,
       encoding: "utf8",
       windowsHide: true,
@@ -54726,17 +54760,17 @@ var SecretStore = class _SecretStore {
     this.box = box;
   }
   box;
-  /** Windows DPAPI, current user. */
-  static dpapi() {
-    return new _SecretStore(new DpapiBox());
+  /** Windows DPAPI, current user; with a storage folder, through its HostTools.exe (much faster than PowerShell). */
+  static dpapi(storageRoot = null) {
+    return new _SecretStore(new DpapiBox(storageRoot));
   }
   /** The test stand-in (not secure). */
   static memory() {
     return new _SecretStore(new MemoryBox());
   }
   /** What the program uses: DPAPI, except during the self-test (it never spawns Windows for this). */
-  static standard() {
-    return selfTestRunning() ? _SecretStore.memory() : _SecretStore.dpapi();
+  static standard(storageRoot = null) {
+    return selfTestRunning() ? _SecretStore.memory() : _SecretStore.dpapi(storageRoot);
   }
   /** True when `value` looks like something seal() made (any box). */
   static isSealed(value) {
@@ -55134,7 +55168,7 @@ function realLiveFolders(storageRoot, dataPath) {
   return new LiveFolders({
     storageRoot,
     dataPath,
-    secrets: SecretStore.standard(),
+    secrets: SecretStore.standard(storageRoot),
     elevated: new ScriptLivePort(),
     userSid: currentUserSid,
     isAlive: isSandboxRunning
@@ -56008,6 +56042,8 @@ var MAX_PLUGIN_BYTES = 1024 * 1024 * 1024;
 var MAX_SETTINGS_BYTES = 4 * 1024 * 1024;
 var MAX_DEPTH = 24;
 var INSTALLED = "installed_plugins.json";
+var RECORDS = [INSTALLED, "known_marketplaces.json"];
+var MAX_RECORD_BYTES2 = 4 * 1024 * 1024;
 function isObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -56054,7 +56090,7 @@ var PluginShare = class _PluginShare {
   /** When a sandbox ends: its plugins refresh the shared set. Never throws; returns the problem, if any. */
   saveQuietly(dataPath, claudeDir) {
     try {
-      if (_PluginShare.hasPlugins(claudeDir)) this.save(dataPath, claudeDir);
+      if (_PluginShare.hasPlugins(claudeDir) && !this.matches(claudeDir)) this.save(dataPath, claudeDir);
       return null;
     } catch (e) {
       return errMsg(e);
@@ -56108,9 +56144,24 @@ var PluginShare = class _PluginShare {
       if (isObject2(shared[key3])) merged[key3] = { ...shared[key3], ...isObject2(merged[key3]) ? merged[key3] : {} };
     writeSandboxJson(file2, merged);
   }
+  /**
+   * Whether the shared set already holds this Claude folder's plugins: the same plugin records and plugin settings.
+   * Copying a big plugins folder takes seconds, so a switch between accounts with the same plugins skips it.
+   */
+  matches(claudeDir) {
+    if (!this.hasShared()) return false;
+    const same3 = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+    for (const name2 of RECORDS) {
+      const own2 = readUntrusted(path67.join(claudeDir, "plugins", name2), MAX_RECORD_BYTES2);
+      if (!same3(own2, readUntrusted(path67.join(this.pluginsDir, name2), MAX_RECORD_BYTES2))) return false;
+    }
+    const shared = readUntrusted(this.settingsFile, MAX_SETTINGS_BYTES);
+    return same3(pluginSettings(claudeDir), isObject2(shared) ? shared : {});
+  }
   /** One step when an account is switched to. */
   sync(dataPath, claudeDir) {
     if (_PluginShare.hasPlugins(claudeDir)) {
+      if (this.matches(claudeDir)) return "nothing";
       this.save(dataPath, claudeDir);
       return "saved";
     }
@@ -56170,7 +56221,7 @@ function assertName(name2) {
 }
 var AccountStore = class {
   /** @param sharePlugins claudeProfile.sharePluginsAcrossAccounts: carry Claude plugins to the account switched to */
-  constructor(storageRoot, sharePlugins = false, secrets = SecretStore.standard()) {
+  constructor(storageRoot, sharePlugins = false, secrets = SecretStore.standard(storageRoot)) {
     this.storageRoot = storageRoot;
     this.sharePlugins = sharePlugins;
     this.secrets = secrets;
@@ -56345,7 +56396,7 @@ var AgentAccountStore = class {
   /**
    * @param loginFiles files of the login, relative to the folder they are read from and written to
    */
-  constructor(storageRoot, agent, loginFiles, secrets = SecretStore.standard()) {
+  constructor(storageRoot, agent, loginFiles, secrets = SecretStore.standard(storageRoot)) {
     this.storageRoot = storageRoot;
     this.agent = agent;
     this.loginFiles = loginFiles;
@@ -56508,7 +56559,7 @@ function checkGithubToken(token) {
   return githubTokenKind(token) ?? fail("That is not a GitHub personal access token.", "Run: sandbox github login");
 }
 var GithubToken = class {
-  constructor(storageRoot, secrets = SecretStore.standard()) {
+  constructor(storageRoot, secrets = SecretStore.standard(storageRoot)) {
     this.storageRoot = storageRoot;
     this.secrets = secrets;
   }
@@ -57191,6 +57242,7 @@ var MARKERS = {
   ],
   rust: ["Cargo.toml", "rust-toolchain", "rust-toolchain.toml"],
   msvc: ["*.vcxproj", "CMakePresets.json", "CMakeUserPresets.json"],
+  unreal: ["*.uproject", "*.uplugin"],
   cpp: [
     "CMakeLists.txt",
     "Makefile",
@@ -57249,6 +57301,11 @@ function decideToolchains(settings, entries, pcHas, hints = {}) {
       on: false,
       reason: "would be used (" + result.msvc.reason + "); set toolchains.msvc.acceptLicense to install it"
     };
+  if (settings.unreal.enabled === "auto" && result.unreal.on && !settings.unreal.acceptLicense)
+    result.unreal = {
+      on: false,
+      reason: "would be used (" + result.unreal.reason + "); set toolchains.unreal.acceptLicense to install it"
+    };
   if (result.rust.on && !result.msvc.on && !result.cpp.on && settings.cpp.enabled !== false)
     result.cpp = { on: true, reason: "the linker for Rust" };
   if (result.python.on && settings.uv.enabled === "auto" && settings.python.tools.length > 0 && !result.uv.on)
@@ -59144,7 +59201,7 @@ function loginProblem(c2) {
   return null;
 }
 var VpnLogin = class {
-  constructor(storageRoot, secrets = SecretStore.standard()) {
+  constructor(storageRoot, secrets = SecretStore.standard(storageRoot)) {
     this.storageRoot = storageRoot;
     this.secrets = secrets;
   }
@@ -70288,7 +70345,7 @@ var TlsStore = class {
 
 // src/app/features/access/access.run.ts
 function accessStoreOf(ctx) {
-  return AccessStore.at(ctx.storageRoot, SecretStore.standard(), {
+  return AccessStore.at(ctx.storageRoot, SecretStore.standard(ctx.storageRoot), {
     // The self-test never changes folder permissions; its storage is a temp folder.
     protect: selfTestRunning() ? void 0 : (dir) => protectPrivateFolder(dir)
   });
@@ -71073,9 +71130,10 @@ function loginItem(a, r) {
       ...r.isActive ? [{ text: "in the sandbox", tone: "ok" }] : [],
       ...r.isDefault ? [{ text: "default", tone: "accent" }] : []
     ],
-    description: "Choose it to make the sandbox use this login.",
+    description: r.isActive ? "The sandbox uses this login now." : "Choose it to make the sandbox use this login.",
     details: ["Agent  " + a.name, "Email  " + (r.email ?? "-"), "Saved  " + r.savedAt.slice(0, 16).replace("T", " ")],
-    primary: action(useAccount, { agent: a.name, name: r.name }, { verb: "use" }),
+    // The login in use already offers nothing to switch to.
+    ...r.isActive ? {} : { primary: action(useAccount, { agent: a.name, name: r.name }, { verb: "use" }) },
     actions: [
       action(defaultAccount, { agent: a.name, name: r.name }, { key: "d", verb: "make default", importance: 1 }),
       action(renameAccount, { agent: a.name, name: r.name }, { key: "r", verb: "rename", importance: 2 }),
@@ -71123,7 +71181,7 @@ function agentPage(a) {
 var accountsView = defineView({
   id: "accounts",
   title: "Accounts",
-  summary: "Logins saved on this PC, per agent. Use puts one into the sandbox; new launches start with the default.",
+  summary: 'Logins saved on this PC for each agent. Every launch starts with the default; "Use this login" switches now.',
   queries: { accounts: listAccounts },
   operations: [saveAccount, useAccount, defaultAccount, renameAccount, removeAccount],
   build: ({ accounts }) => accountsPage(accounts)
@@ -75578,11 +75636,6 @@ var SandboxStatusSchema2 = external_exports.object({
   repoGuard: external_exports.object({ guarded: external_exports.number(), findings: external_exports.array(external_exports.string()) })
 });
 var MessageSchema4 = external_exports.object({ message: external_exports.string().describe("What happened") });
-function helperText(answer) {
-  const sessions = /^pong \((\d+) session/.exec(answer);
-  if (!sessions) return answer;
-  return "responding, " + plural2(Number(sessions[1]), "session") + " running";
-}
 function uptime(s) {
   return s.running && s.startedAt ? ago(s.startedAt).replace(" ago", "") : null;
 }
@@ -75694,7 +75747,8 @@ function facts(o) {
     ...s.running ? [
       fact("window", "Window", s.headless ? "hidden (sandbox show opens it)" : "shown"),
       fact("uptime", "Uptime", uptime(s) ?? "-"),
-      fact("helper", "Helper", s.daemon === "-" ? "-" : helperText(s.daemon)),
+      // The session count is its own fact: the helper only says whether it answers.
+      fact("helper", "Helper", s.daemon === "-" ? "-" : s.daemon.startsWith("pong") ? "Responding" : s.daemon),
       fact("sessions", "Sessions", String(sessions))
     ] : [],
     fact("account", "Account", s.account ?? "none selected (sandbox account use)"),
@@ -75723,7 +75777,7 @@ function guardSection(o) {
   return {
     id: "guard",
     title: "Repo guard",
-    summary: o.repoGuard.guarded + " folder(s) guarded; " + (findings.length ? findings.length + " change(s) neutralised:" : "nothing from the sandbox needed neutralising"),
+    summary: "Watching " + plural2(o.repoGuard.guarded, "folder") + ". " + (findings.length ? plural2(findings.length, "change") + " from the sandbox were blocked:" : "Nothing from the sandbox needed blocking."),
     items: findings.slice(-10).map((f, i) => ({ id: "guard:" + i, label: f, tone: "warn" }))
   };
 }
@@ -75767,7 +75821,7 @@ function sandboxPage(o) {
 var sandboxView = defineView({
   id: "sandbox",
   title: "Sandbox",
-  summary: "What the sandbox is doing, its window, and stopping it.",
+  summary: "Status, projects and controls of the running sandbox.",
   queries: { status: sandboxStatus },
   operations: [showWindow, hideWindow, stopSandbox],
   build: ({ status }) => sandboxPage(status)
@@ -76703,7 +76757,7 @@ function sessionsPage(o) {
 var sessionsView = defineView({
   id: "sessions",
   title: "Sessions",
-  summary: "The sessions of the running sandbox: open one, restart the agents, open a shell, close one.",
+  summary: "Agent and shell sessions in the running sandbox.",
   queries: { sessions: listSessions },
   operations: [restartSessions, startShell, closeSession],
   build: ({ sessions }) => sessionsPage(sessions)
@@ -78020,27 +78074,37 @@ function navViews(nav) {
   return navSections(nav).flatMap((n) => [...n.view ? [n.view] : [], ...(n.embeds ?? []).map((e) => e.view)]);
 }
 var NAV = [
-  { label: "Agents", view: "agents" },
-  { label: "Sessions", view: "sessions" },
-  { label: "Activity", view: "audit" },
+  {
+    label: "Workspace",
+    children: [
+      { label: "Agents", view: "agents" },
+      { label: "Sessions", view: "sessions" },
+      { label: "Activity", view: "audit" }
+    ]
+  },
   {
     label: "Sandbox",
     children: [
-      { label: "Status", view: "sandbox" },
-      { label: "Projects", view: "projects" }
+      { label: "Overview", view: "sandbox" },
+      { label: "Projects", view: "projects" },
+      { label: "Apps", view: "apps" }
     ]
   },
-  { label: "Apps", view: "apps" },
   {
-    label: "Settings",
-    view: "settings",
-    embeds: [
-      { label: "VPN", view: "vpn" },
-      { label: "GitHub", view: "github" }
+    label: "Configuration",
+    children: [
+      {
+        label: "Settings",
+        view: "settings",
+        embeds: [
+          { label: "VPN", view: "vpn" },
+          { label: "GitHub", view: "github" }
+        ]
+      },
+      { label: "Accounts", view: "accounts" },
+      { label: "Remote access", view: "access" }
     ]
   },
-  { label: "Accounts", view: "accounts" },
-  { label: "Remote access", view: "access" },
   {
     label: "Maintenance",
     children: [
@@ -78290,7 +78354,7 @@ async function attachOpened(ctx, session) {
     nextStep("sandbox attach " + session);
     return 0;
   }
-  const { attach: attach2 } = await import("./chunk-RQ4BWBYX.js");
+  const { attach: attach2 } = await import("./chunk-XYUVIVJT.js");
   return attach2({ ...ctx, options: { ...ctx.options, positionals: [session] } });
 }
 function definitionHandler(def) {
@@ -78382,7 +78446,7 @@ function remoteAudit(ctx) {
   };
 }
 function remoteGate(ctx) {
-  const secrets = SecretStore.standard();
+  const secrets = SecretStore.standard(ctx.storageRoot);
   let ownerSid = "";
   try {
     ownerSid = currentUserSid();

package/dist/bin/{chunk-RQ4BWBYX.js → chunk-XYUVIVJT.js}

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   attach
-} from "./chunk-D7CM63BS.js";
+} from "./chunk-REE3EMHD.js";
 export {
   attach
 };

package/dist/bin/claude-host.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-HTQT5SBY.js";
-import "./chunk-D7CM63BS.js";
+} from "./chunk-QLGGAG3D.js";
+import "./chunk-REE3EMHD.js";
 
 // src/bin/claude-host.ts
 var args = process.argv.slice(2);

package/dist/bin/claude-sbx.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-HTQT5SBY.js";
-import "./chunk-D7CM63BS.js";
+} from "./chunk-QLGGAG3D.js";
+import "./chunk-REE3EMHD.js";
 
 // src/bin/claude-sbx.ts
 run(process.argv.slice(2), { harness: "claude" });

package/dist/bin/codex-sbx.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-HTQT5SBY.js";
-import "./chunk-D7CM63BS.js";
+} from "./chunk-QLGGAG3D.js";
+import "./chunk-REE3EMHD.js";
 
 // src/bin/codex-sbx.ts
 run(process.argv.slice(2), { harness: "codex" });

package/dist/bin/gemini-sbx.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-HTQT5SBY.js";
-import "./chunk-D7CM63BS.js";
+} from "./chunk-QLGGAG3D.js";
+import "./chunk-REE3EMHD.js";
 
 // src/bin/gemini-sbx.ts
 run(process.argv.slice(2), { harness: "gemini" });

package/dist/bin/sandbox.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-HTQT5SBY.js";
-import "./chunk-D7CM63BS.js";
+} from "./chunk-QLGGAG3D.js";
+import "./chunk-REE3EMHD.js";
 
 // src/bin/sandbox.ts
 run(process.argv.slice(2));

package/dist/bin/sbx-hide.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-HTQT5SBY.js";
-import "./chunk-D7CM63BS.js";
+} from "./chunk-QLGGAG3D.js";
+import "./chunk-REE3EMHD.js";
 
 // src/bin/sbx-hide.ts
 run(process.argv.slice(2), { command: "hide" });

package/dist/bin/sbx-show.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-HTQT5SBY.js";
-import "./chunk-D7CM63BS.js";
+} from "./chunk-QLGGAG3D.js";
+import "./chunk-REE3EMHD.js";
 
 // src/bin/sbx-show.ts
 run(process.argv.slice(2), { command: "show" });

package/dist/cli/commands/web.js

@@ -95,7 +95,7 @@ function remoteAudit(ctx) {
  * served (it refuses everyone while web.remote.windowsSignIn is off).
  */
 function remoteGate(ctx) {
-    const secrets = SecretStore.standard();
+    const secrets = SecretStore.standard(ctx.storageRoot);
     let ownerSid = '';
     try {
         ownerSid = currentUserSid();

package/dist/cli/index.js

@@ -12,7 +12,7 @@ import { takeHiddenInstallNotice } from '../host/install/index.js';
 import { c } from './output/index.js';
 import { dropInheritedModulePath } from '../shared/system.js';
 import { withConfig, hoistConfig, withoutConfig } from './argv.js';
-import { report } from './report.js';
+import { recordUnexpected, report } from './report.js';
 import { versionText } from './version.js';
 import { HANDLERS } from './commands/index.js';
 import { definitionHandler, operationHandler } from './operations/index.js';
@@ -121,6 +121,9 @@ export async function main(rawArgv, preset = {}) {
 }
 export function run(argv, preset) {
     dropInheritedModulePath();
+    // Background work that throws must not end the menu or the web server: the error is kept with its stack instead.
+    process.on('unhandledRejection', (e) => recordUnexpected(e, 'unhandled rejection'));
+    process.on('uncaughtException', (e) => recordUnexpected(e, 'uncaught exception'));
     main(argv, preset).then((code) => {
         process.exitCode = code;
     }, (e) => {

package/dist/cli/report.d.ts

@@ -1,2 +1,9 @@
+/** Where errors nobody caught are written in full (this user's temp folder; kept under 1 MB). */
+export declare const UNEXPECTED_LOG: string;
+/**
+ * An error thrown by background work (a timer, a promise nobody awaited): written in full to UNEXPECTED_LOG and named
+ * in one line, instead of ending the menu, the web server or a command half-way.
+ */
+export declare function recordUnexpected(e: unknown, kind: string): void;
 /** Prints a problem the way a user can act on it: what happened, how to fix it; stack traces only for real bugs. */
 export declare function report(e: unknown): number;

package/dist/cli/report.js

@@ -1,6 +1,37 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
 import { CommanderError } from 'commander';
 import { c } from './output/index.js';
 import { UserError, errMsg, plainText } from '../core/util/index.js';
+/** Where errors nobody caught are written in full (this user's temp folder; kept under 1 MB). */
+export const UNEXPECTED_LOG = path.join(os.tmpdir(), 'windows-development-sandbox-errors.log');
+const UNEXPECTED_LOG_MAX = 1024 * 1024;
+/**
+ * An error thrown by background work (a timer, a promise nobody awaited): written in full to UNEXPECTED_LOG and named
+ * in one line, instead of ending the menu, the web server or a command half-way.
+ */
+export function recordUnexpected(e, kind) {
+    const text = new Date().toISOString() +
+        ' ' +
+        kind +
+        ' (pid ' +
+        process.pid +
+        ', ' +
+        process.argv.slice(2).join(' ') +
+        ')\n' +
+        (e instanceof Error && e.stack ? e.stack : errMsg(e)) +
+        '\n\n';
+    try {
+        if (fs.existsSync(UNEXPECTED_LOG) && fs.statSync(UNEXPECTED_LOG).size > UNEXPECTED_LOG_MAX)
+            fs.rmSync(UNEXPECTED_LOG, { force: true });
+        fs.appendFileSync(UNEXPECTED_LOG, text);
+    }
+    catch {
+        // Nowhere to write it: the line below still says what happened.
+    }
+    console.error(c.red('Unexpected error (kept running): ') + plainText(errMsg(e)) + c.dim('  Details: ' + UNEXPECTED_LOG));
+}
 /** Prints a problem the way a user can act on it: what happened, how to fix it; stack traces only for real bugs. */
 export function report(e) {
     if (e instanceof CommanderError)

package/dist/core/config/defaults.js

@@ -62,6 +62,7 @@ export const DEFAULTS = {
             linkSlots: 'auto',
         },
         msvc: { enabled: 'auto', acceptLicense: false, msvcVersion: 'latest', sdkVersion: 'latest' },
+        unreal: { enabled: 'auto', acceptLicense: false, components: [], keepInstallFiles: true },
         cpp: { enabled: 'auto', flexBison: true },
         dotnet: {
             enabled: 'auto',

package/dist/core/detect/toolchains.d.ts

@@ -4,6 +4,7 @@ export declare const MARKERS: {
     readonly python: readonly ["pyproject.toml", "requirements.txt", "setup.py", "setup.cfg", "Pipfile", "uv.lock", "poetry.lock", ".python-version", "*.py", "*.ipynb"];
     readonly rust: readonly ["Cargo.toml", "rust-toolchain", "rust-toolchain.toml"];
     readonly msvc: readonly ["*.vcxproj", "CMakePresets.json", "CMakeUserPresets.json"];
+    readonly unreal: readonly ["*.uproject", "*.uplugin"];
     readonly cpp: readonly ["CMakeLists.txt", "Makefile", "meson.build", "premake5.lua", "Cargo.toml", "*.vcxproj", "*.c", "*.cpp", "*.cc", "*.h", "*.hpp"];
     readonly dotnet: readonly ["*.sln", "*.slnx", "*.csproj", "*.fsproj", "*.vbproj", "global.json", "*.cs"];
     readonly go: readonly ["go.mod", "go.work", "*.go"];

package/dist/core/detect/toolchains.js

@@ -15,6 +15,7 @@ export const MARKERS = {
     ],
     rust: ['Cargo.toml', 'rust-toolchain', 'rust-toolchain.toml'],
     msvc: ['*.vcxproj', 'CMakePresets.json', 'CMakeUserPresets.json'],
+    unreal: ['*.uproject', '*.uplugin'],
     cpp: [
         'CMakeLists.txt',
         'Makefile',
@@ -86,6 +87,12 @@ export function decideToolchains(settings, entries, pcHas, hints = {}) {
             on: false,
             reason: 'would be used (' + result.msvc.reason + '); set toolchains.msvc.acceptLicense to install it',
         };
+    // Unreal is a ~10 GB licensed install every boot: "auto" only installs it once its licence is accepted.
+    if (settings.unreal.enabled === 'auto' && result.unreal.on && !settings.unreal.acceptLicense)
+        result.unreal = {
+            on: false,
+            reason: 'would be used (' + result.unreal.reason + '); set toolchains.unreal.acceptLicense to install it',
+        };
     if (result.rust.on && !result.msvc.on && !result.cpp.on && settings.cpp.enabled !== false)
         result.cpp = { on: true, reason: 'the linker for Rust' };
     // uv installs the Python tools (`uv tool install`), so Python tools turn an "auto" uv on.

package/dist/core/schema/config.d.ts

@@ -153,6 +153,12 @@ export declare const ConfigSchema: z.ZodObject<{
             msvcVersion: z.ZodString;
             sdkVersion: z.ZodString;
         }, z.core.$strict>;
+        unreal: z.ZodObject<{
+            enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+            acceptLicense: z.ZodBoolean;
+            components: z.ZodArray<z.ZodString>;
+            keepInstallFiles: z.ZodBoolean;
+        }, z.core.$strict>;
         cpp: z.ZodObject<{
             enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
             flexBison: z.ZodBoolean;
@@ -506,6 +512,21 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
+        unreal: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict> | z.ZodObject<{
+            version: z.ZodOptional<z.ZodString>;
+            extraVersions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            corepack: z.ZodOptional<z.ZodBoolean>;
+            volta: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            globalPackages: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict> | z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+        }, z.core.$strict> | z.ZodObject<{
+            gh: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+        }, z.core.$strict>>;
         cpp: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{

package/dist/core/schema/sandbox.js

@@ -51,7 +51,7 @@ export const SandboxSchema = z.strictObject({
         .describe('When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. Yours only: a project file cannot change it.'),
     vGpu: z
         .boolean()
-        .describe("Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it)."),
+        .describe("Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it). Browsers in the sandbox never use it (they draw in software)."),
     networking: z.boolean().describe('Internet access. false is the only hard network isolation Windows Sandbox offers.'),
     clipboard: z
         .boolean()

package/dist/core/schema/toolchains.d.ts

@@ -34,6 +34,12 @@ export declare const ToolchainsSchema: z.ZodObject<{
         msvcVersion: z.ZodString;
         sdkVersion: z.ZodString;
     }, z.core.$strict>;
+    unreal: z.ZodObject<{
+        enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+        acceptLicense: z.ZodBoolean;
+        components: z.ZodArray<z.ZodString>;
+        keepInstallFiles: z.ZodBoolean;
+    }, z.core.$strict>;
     cpp: z.ZodObject<{
         enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
         flexBison: z.ZodBoolean;

package/dist/core/schema/toolchains.js

@@ -53,6 +53,16 @@ export const ToolchainsSchema = z.strictObject({
         msvcVersion: z.string().min(1).describe('"latest" or an MSVC tools version prefix, e.g. "14.44".'),
         sdkVersion: z.string().min(1).describe('"latest" or a Windows SDK build, e.g. "26100" or "10.0.22621".'),
     }),
+    unreal: z.strictObject({
+        enabled: enabled('Unreal Engine development: Visual Studio Community 2022 with the C++ game workload (MSVC, a Windows 11 SDK, .NET Framework targeting packs, Unreal integration and the Epic Games Launcher) and the DirectX End-User Runtime. A real installer: it runs every boot (~10 GB on the sandbox disk). The engine itself comes from the Epic Games Launcher or its source.', 'a .uproject or .uplugin'),
+        acceptLicense: z
+            .boolean()
+            .describe('Required to install: you accept the Visual Studio Community licence terms (https://visualstudio.microsoft.com/license-terms/) and the DirectX End-User Runtime licence.'),
+        components: StringsSchema.describe('More Visual Studio workload or component IDs to add, e.g. ["Microsoft.VisualStudio.Component.VC.Llvm.Clang"].'),
+        keepInstallFiles: z
+            .boolean()
+            .describe('Keep an offline copy of the Visual Studio install files in tools\\visualstudio (~10 GB, made once), so later boots install without downloading them again. Skipped while that disk has too little room.'),
+    }),
     cpp: z.strictObject({
         enabled: enabled("MinGW-w64 GCC with CMake, Ninja, premake5 and mingw32-make (also Rust's linker).", 'CMakeLists.txt, Makefile, meson.build, premake5.lua or Cargo.toml'),
         flexBison: z