windows-development-sandbox 1.16.0 → 1.17.0

package/dist/guest/toolchains/native/unreal.js

@@ -0,0 +1,186 @@
+// Unreal Engine development (toolchains.unreal): Visual Studio Community 2022 with the C++ game workload and the parts
+// Unreal's build tool looks for (it finds Visual Studio through the Setup API, so the portable MSVC does not do), and
+// the DirectX End-User Runtime. Real installers: they run every boot. The installers are kept in tools\ and run only
+// when Microsoft's signature on them checks out; with keepInstallFiles an offline copy of the install files
+// (tools\visualstudio\layout) spares later boots the download. The engine itself comes from the Epic Games Launcher.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { z } from 'zod';
+import { spawnAsync } from '../../../shared/download/index.js';
+import { writeJsonAtomic } from '../../../shared/io/json.js';
+import { safeRemove } from '../../../shared/io/safe-remove.js';
+import { dryRun } from '../../runtime/paths.js';
+import { execOutput } from '../../runtime/process.js';
+import { exists, mkdirp } from '../../runtime/fs.js';
+import { log, warn } from '../../runtime/log.js';
+import { errMsg } from '../../../core/util/errors.js';
+import { downloadFile } from '../install.js';
+import { tool } from '../tool-env.js';
+import { MICROSOFT_SIGNER, signerOf } from './vcruntime.js';
+const BOOTSTRAPPER_URL = 'https://aka.ms/vs/17/release/vs_community.exe';
+const DIRECTX_URL = 'https://download.microsoft.com/download/8/4/A/84A35BF1-DAFE-4AE8-82AF-AD2AE20B6B14/directx_Jun2010_redist.exe';
+/**
+ * What Epic lists for Unreal Engine 5 with Visual Studio 2022: the game workload, MSVC v143, a Windows SDK of
+ * 10.0.18362 or newer, the C++ profiling tools, the .NET Framework targeting packs some engine tools build against,
+ * Visual Studio's Unreal support and the Unreal Engine installer (the Epic Games Launcher).
+ */
+export const UNREAL_COMPONENTS = [
+    'Microsoft.VisualStudio.Workload.NativeGame',
+    'Microsoft.VisualStudio.Component.VC.Tools.x86.x64',
+    'Microsoft.VisualStudio.Component.Windows11SDK.22621',
+    'Microsoft.VisualStudio.Component.VC.DiagnosticTools',
+    'Microsoft.Net.Component.4.6.2.TargetingPack',
+    'Microsoft.Net.Component.4.8.SDK',
+    'Component.Unreal.Ide',
+    'Component.Unreal',
+];
+/** Visual Studio installer exit codes that mean installed: 0, and 3010 (a restart would finish it, not needed here). */
+const OK_EXIT_CODES = [0, 3010];
+/** Free room the offline copy needs before it is made (it grows to about 10 GB). */
+const LAYOUT_ROOM_BYTES = 15 * 1024 ** 3;
+const ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;
+const VS_DIR = tool('visualstudio');
+const BOOTSTRAPPER = path.join(VS_DIR, 'vs_community.exe');
+const LAYOUT = path.join(VS_DIR, 'layout');
+const LAYOUT_MARKER = path.join(LAYOUT, '.complete.json');
+const LayoutSchema = z.object({ components: z.array(z.string()) });
+const VSWHERE = path.join(process.env['ProgramFiles(x86)'] ?? 'C:\\Program Files (x86)', 'Microsoft Visual Studio', 'Installer', 'vswhere.exe');
+/** The newest Visual Studio with the C++ compiler: its folder and version, or null. */
+function installedVs() {
+    if (!exists(VSWHERE))
+        return null;
+    const ask = (property) => execOutput(VSWHERE, [
+        '-latest',
+        '-products',
+        '*',
+        '-requires',
+        'Microsoft.VisualStudio.Component.VC.Tools.x86.x64',
+        '-property',
+        property,
+    ]);
+    const at = ask('installationPath');
+    return at ? { path: at, version: ask('installationVersion') || 'installed' } : null;
+}
+/** A Microsoft-signed installer kept in tools\ (downloaded once); a file with a bad signature is deleted. */
+async function signedInstaller(url, file, what) {
+    if (!exists(file)) {
+        log('Downloading ' + what + ' ...');
+        mkdirp(path.dirname(file));
+        await downloadFile(url, file);
+    }
+    if (signerOf(file) !== MICROSOFT_SIGNER) {
+        fs.rmSync(file, { force: true });
+        throw new Error(path.basename(file) + ' is not signed by Microsoft; deleted it (it is downloaded again next boot)');
+    }
+    return file;
+}
+function freeBytes(dir) {
+    try {
+        const s = fs.statfsSync(dir);
+        return s.bavail * s.bsize;
+    }
+    catch {
+        return 0;
+    }
+}
+/** The offline copy's installer when it holds every component; made or completed when there is room. */
+async function layoutInstaller(bootstrapper, ids) {
+    const installer = path.join(LAYOUT, 'vs_community.exe');
+    const has = () => {
+        if (!exists(LAYOUT_MARKER) || !exists(installer))
+            return false;
+        try {
+            const done = LayoutSchema.parse(JSON.parse(fs.readFileSync(LAYOUT_MARKER, 'utf8')));
+            return ids.every((id) => done.components.includes(id));
+        }
+        catch {
+            return false;
+        }
+    };
+    if (has())
+        return installer;
+    if (freeBytes(mkdirp(VS_DIR)) < LAYOUT_ROOM_BYTES) {
+        warn('unreal: not keeping the install files (less than 15 GB free in ' + VS_DIR + '); downloading this boot');
+        return null;
+    }
+    log('Saving the Visual Studio install files for later boots (~10 GB, once) ...');
+    fs.rmSync(LAYOUT_MARKER, { force: true });
+    const code = await spawnAsync(bootstrapper, [
+        '--layout',
+        LAYOUT,
+        '--lang',
+        'en-US',
+        '--quiet',
+        '--wait',
+        ...ids.flatMap((id) => ['--add', id]),
+    ]);
+    if (!OK_EXIT_CODES.includes(code) || !exists(installer)) {
+        warn('unreal: saving the install files failed (exit ' + code + '); downloading this boot');
+        return null;
+    }
+    writeJsonAtomic(LAYOUT_MARKER, { components: [...ids] });
+    return installer;
+}
+async function installVisualStudio(config, ids) {
+    const bootstrapper = await signedInstaller(BOOTSTRAPPER_URL, BOOTSTRAPPER, 'the Visual Studio installer');
+    let installer = null;
+    if (config.keepInstallFiles) {
+        try {
+            installer = await layoutInstaller(bootstrapper, ids);
+        }
+        catch (e) {
+            warn('unreal: the offline copy failed (' + errMsg(e) + '); downloading this boot');
+        }
+    }
+    log('Installing Visual Studio Community 2022 with the C++ game workload' +
+        (installer ? ' from the saved install files' : ' (downloads ~5-8 GB)') +
+        ' ...');
+    const code = await spawnAsync(installer ?? bootstrapper, [
+        '--quiet',
+        '--wait',
+        '--norestart',
+        '--nocache',
+        ...(installer ? ['--noWeb'] : []),
+        ...ids.flatMap((id) => ['--add', id]),
+    ]);
+    if (!OK_EXIT_CODES.includes(code) || !installedVs())
+        throw new Error('the Visual Studio installer failed (exit ' + code + '); its logs are the dd_*.log files in ' + os.tmpdir());
+}
+/** The June 2010 DirectX End-User Runtime (D3DX, XAudio 2.7, XInput 1.3), which Epic lists for the engine. */
+async function installDirectX() {
+    const system32 = path.join(process.env.WINDIR ?? 'C:\\Windows', 'System32');
+    if (exists(path.join(system32, 'd3dx9_43.dll')) && exists(path.join(system32, 'XAudio2_7.dll')))
+        return;
+    const redist = await signedInstaller(DIRECTX_URL, path.join(VS_DIR, 'directx_Jun2010_redist.exe'), 'the DirectX End-User Runtime (~95 MB once)');
+    const unpacked = path.join(os.tmpdir(), 'directx-redist');
+    safeRemove(unpacked, os.tmpdir());
+    mkdirp(unpacked);
+    if ((await spawnAsync(redist, ['/Q', '/T:' + unpacked])) !== 0 || !exists(path.join(unpacked, 'DXSETUP.exe')))
+        throw new Error('could not unpack the DirectX End-User Runtime');
+    const code = await spawnAsync(path.join(unpacked, 'DXSETUP.exe'), ['/silent']);
+    safeRemove(unpacked, os.tmpdir());
+    if (code !== 0)
+        throw new Error('the DirectX End-User Runtime installer failed (exit ' + code + ')');
+}
+export async function setupUnreal(env, config) {
+    if (!config.acceptLicense)
+        throw new Error('Unreal tools are installed only with toolchains.unreal.acceptLicense = true: Visual Studio Community and the DirectX End-User Runtime come under Microsoft licence terms (https://visualstudio.microsoft.com/license-terms/)');
+    const bad = config.components.find((id) => !ID.test(id));
+    if (bad)
+        throw new Error('toolchains.unreal.components: "' + bad + '" is not a Visual Studio component ID');
+    const ids = [...new Set([...UNREAL_COMPONENTS, ...config.components])];
+    if (dryRun) {
+        log('(dry run) would install Visual Studio Community 2022 with ' + ids.join(', ') + ' and DirectX');
+        return;
+    }
+    if (!installedVs())
+        await installVisualStudio(config, ids);
+    await installDirectX();
+    const vs = installedVs();
+    env.summary.push('unreal: Visual Studio Community ' +
+        vs.version +
+        ' (C++ game workload, Windows 11 SDK, Unreal support) at ' +
+        vs.path +
+        '; DirectX End-User Runtime; get the engine from the Epic Games Launcher (Start menu)');
+}

package/dist/guest/toolchains/native/vcruntime.d.ts

@@ -1,4 +1,7 @@
 import { type ToolEnv } from '../tool-env.js';
+export declare const MICROSOFT_SIGNER = "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US";
+/** The subject of a valid Authenticode signature, or '' when the file is unsigned or tampered with. */
+export declare const signerOf: (file: string) => string;
 /**
  * A real installer (it writes to System32), so it runs on every boot; the installer itself is kept in persistent
  * storage and only run when Microsoft's signature on it checks out. Resolves true when this call ran the installer.

package/dist/guest/toolchains/native/vcruntime.js

@@ -9,11 +9,11 @@ import { log } from '../../runtime/log.js';
 import { downloadFile } from '../install.js';
 import { tool } from '../tool-env.js';
 const VC_REDIST = 'https://aka.ms/vs/17/release/vc_redist.x64.exe';
-const MICROSOFT_SIGNER = 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US';
+export const MICROSOFT_SIGNER = 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US';
 /** 1638: a newer version is already installed; 3010: installed, a restart would finish it (not needed for the DLLs). */
 const OK_EXIT_CODES = [0, 1638, 3010];
 /** The subject of a valid Authenticode signature, or '' when the file is unsigned or tampered with. */
-const signerOf = (file) => scriptOutput('get-signer.ps1', ['-Path', file]).trim();
+export const signerOf = (file) => scriptOutput('get-signer.ps1', ['-Path', file]).trim();
 /**
  * A real installer (it writes to System32), so it runs on every boot; the installer itself is kept in persistent
  * storage and only run when Microsoft's signature on it checks out. Resolves true when this call ran the installer.

package/dist/guest/toolchains/plan.js

@@ -11,6 +11,7 @@ import { setupCpp } from './native/cpp.js';
 import { setupDotnet } from './native/dotnet.js';
 import { setupMesa } from './native/mesa.js';
 import { setupMsvc } from './native/msvc/index.js';
+import { setupUnreal } from './native/unreal.js';
 import { setupRust } from './native/rust.js';
 import { setupNode } from './languages/node.js';
 import { setupPwsh } from './tools/pwsh.js';
@@ -26,6 +27,7 @@ export function plan(config, versions, o) {
     const apps = Boolean(o.apps && (o.apps.install.length || Object.keys(o.apps.custom).length));
     const java = wanted(config.java.enabled, 'java');
     const python = wanted(config.python.enabled, 'python');
+    const unreal = wanted(config.unreal.enabled, 'unreal');
     return [
         {
             name: 'Git',
@@ -43,12 +45,18 @@ export function plan(config, versions, o) {
             enabled: wanted(config.cpp.enabled, 'cpp') || wanted(config.rust.enabled, 'rust'),
             install: (env) => setupCpp(env, config.cpp),
         },
-        { name: 'MSVC', enabled: wanted(config.msvc.enabled, 'msvc'), install: (env) => setupMsvc(env, config.msvc) },
+        // Unreal's Visual Studio brings MSVC and the real vswhere: the portable MSVC (and its stand-in vswhere) stays out.
+        { name: 'Unreal', enabled: unreal, shared: true, install: (env) => setupUnreal(env, config.unreal) },
+        {
+            name: 'MSVC',
+            enabled: wanted(config.msvc.enabled, 'msvc') && !unreal,
+            install: (env) => setupMsvc(env, config.msvc),
+        },
         // Rust links with MSVC (msvc host) or MinGW's gcc (GNU host): whichever it uses goes first.
         {
             name: 'Rust',
             enabled: wanted(config.rust.enabled, 'rust'),
-            after: ['C/C++', 'MSVC'],
+            after: ['C/C++', 'MSVC', 'Unreal'],
             install: async (env) => {
                 await setupRust(env, { ...config.rust, host: rustHost(config) }, o.refresh);
                 Object.assign(env.vars, rustCaches(config.rust));

package/dist/host/engines/hcs/live-folders.js

@@ -331,7 +331,7 @@ export function realLiveFolders(storageRoot, dataPath) {
     return new LiveFolders({
         storageRoot,
         dataPath,
-        secrets: SecretStore.standard(),
+        secrets: SecretStore.standard(storageRoot),
         elevated: new ScriptLivePort(),
         userSid: currentUserSid,
         isAlive: isSandboxRunning,

package/dist/host/github/token.js

@@ -23,7 +23,7 @@ export function checkGithubToken(token) {
 export class GithubToken {
     storageRoot;
     secrets;
-    constructor(storageRoot, secrets = SecretStore.standard()) {
+    constructor(storageRoot, secrets = SecretStore.standard(storageRoot)) {
         this.storageRoot = storageRoot;
         this.secrets = secrets;
     }

package/dist/host/profile/accounts.js

@@ -69,7 +69,7 @@ export class AccountStore {
     /** What the last activate() did with the shared plugins (a problem there never stops the switch). */
     pluginNote = null;
     /** @param sharePlugins claudeProfile.sharePluginsAcrossAccounts: carry Claude plugins to the account switched to */
-    constructor(storageRoot, sharePlugins = false, secrets = SecretStore.standard()) {
+    constructor(storageRoot, sharePlugins = false, secrets = SecretStore.standard(storageRoot)) {
         this.storageRoot = storageRoot;
         this.sharePlugins = sharePlugins;
         this.secrets = secrets;

package/dist/host/profile/agent-accounts.js

@@ -34,7 +34,7 @@ export class AgentAccountStore {
     /**
      * @param loginFiles files of the login, relative to the folder they are read from and written to
      */
-    constructor(storageRoot, agent, loginFiles, secrets = SecretStore.standard()) {
+    constructor(storageRoot, agent, loginFiles, secrets = SecretStore.standard(storageRoot)) {
         this.storageRoot = storageRoot;
         this.agent = agent;
         this.loginFiles = loginFiles;

package/dist/host/profile/plugin-share.d.ts

@@ -21,6 +21,11 @@ export declare class PluginShare {
     save(dataPath: string, claudeDir: string): void;
     /** The shared set goes into a data set's Claude folder; its own settings win, its other settings are untouched. */
     restore(dataPath: string, claudeDir: string): void;
+    /**
+     * Whether the shared set already holds this Claude folder's plugins: the same plugin records and plugin settings.
+     * Copying a big plugins folder takes seconds, so a switch between accounts with the same plugins skips it.
+     */
+    matches(claudeDir: string): boolean;
     /** One step when an account is switched to. */
     sync(dataPath: string, claudeDir: string): PluginShareResult;
 }

package/dist/host/profile/plugin-share.js

@@ -17,6 +17,9 @@ export const MAX_PLUGIN_BYTES = 1024 * 1024 * 1024;
 const MAX_SETTINGS_BYTES = 4 * 1024 * 1024;
 const MAX_DEPTH = 24;
 const INSTALLED = 'installed_plugins.json';
+/** What Claude rewrites when a plugin or marketplace is added, removed or updated: equal files, same plugins. */
+const RECORDS = [INSTALLED, 'known_marketplaces.json'];
+const MAX_RECORD_BYTES = 4 * 1024 * 1024;
 function isObject(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -69,7 +72,7 @@ export class PluginShare {
     /** When a sandbox ends: its plugins refresh the shared set. Never throws; returns the problem, if any. */
     saveQuietly(dataPath, claudeDir) {
         try {
-            if (PluginShare.hasPlugins(claudeDir))
+            if (PluginShare.hasPlugins(claudeDir) && !this.matches(claudeDir))
                 this.save(dataPath, claudeDir);
             return null;
         }
@@ -131,9 +134,27 @@ export class PluginShare {
                 merged[key] = { ...shared[key], ...(isObject(merged[key]) ? merged[key] : {}) };
         writeSandboxJson(file, merged);
     }
+    /**
+     * Whether the shared set already holds this Claude folder's plugins: the same plugin records and plugin settings.
+     * Copying a big plugins folder takes seconds, so a switch between accounts with the same plugins skips it.
+     */
+    matches(claudeDir) {
+        if (!this.hasShared())
+            return false;
+        const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+        for (const name of RECORDS) {
+            const own = readUntrusted(path.join(claudeDir, 'plugins', name), MAX_RECORD_BYTES);
+            if (!same(own, readUntrusted(path.join(this.pluginsDir, name), MAX_RECORD_BYTES)))
+                return false;
+        }
+        const shared = readUntrusted(this.settingsFile, MAX_SETTINGS_BYTES);
+        return same(pluginSettings(claudeDir), isObject(shared) ? shared : {});
+    }
     /** One step when an account is switched to. */
     sync(dataPath, claudeDir) {
         if (PluginShare.hasPlugins(claudeDir)) {
+            if (this.matches(claudeDir))
+                return 'nothing';
             this.save(dataPath, claudeDir);
             return 'saved';
         }

package/dist/host/secrets/secret-store.d.ts

@@ -8,12 +8,12 @@ export interface SecretBox {
 export declare class SecretStore {
     private readonly box;
     constructor(box: SecretBox);
-    /** Windows DPAPI, current user. */
-    static dpapi(): SecretStore;
+    /** Windows DPAPI, current user; with a storage folder, through its HostTools.exe (much faster than PowerShell). */
+    static dpapi(storageRoot?: string | null): SecretStore;
     /** The test stand-in (not secure). */
     static memory(): SecretStore;
     /** What the program uses: DPAPI, except during the self-test (it never spawns Windows for this). */
-    static standard(): SecretStore;
+    static standard(storageRoot?: string | null): SecretStore;
     /** True when `value` looks like something seal() made (any box). */
     static isSealed(value: unknown): value is string;
     seal(text: string): string;

package/dist/host/secrets/secret-store.js

@@ -1,15 +1,38 @@
 // Encryption at rest for what must not sit in plain files (saved logins, the VPN login). The real box is Windows DPAPI
-// for the current user (native\scripts\protect-data.ps1: data on standard input, never on a command line); the memory
-// box is the self-test's stand-in and is not secure. A sealed value is a short string: "<kind>:<base64>".
+// for the current user (HostTools.exe protect, else native\scripts\protect-data.ps1: data on standard input, never on
+// a command line); the memory box is the self-test's stand-in and is not secure. A sealed value is a short string:
+// "<kind>:<base64>".
 import { spawnSync } from 'node:child_process';
 import { fail } from '../../core/util/index.js';
 import { SYSTEM } from '../../shared/system.js';
 import { selfTestRunning } from '../../shared/test-guard.js';
-import { nativeScript } from '../native.js';
+import { hostToolsExe, nativeScript } from '../native.js';
 const TIMEOUT_MS = 60000;
-/** DPAPI for the current Windows user, through powershell.exe 5.1. */
+/** HostTools.exe per storage folder (null: it cannot be built there), found once per process. */
+const toolsFor = new Map();
+function dpapiTool(storageRoot) {
+    if (!toolsFor.has(storageRoot)) {
+        let exe = null;
+        try {
+            exe = hostToolsExe(storageRoot);
+        }
+        catch {
+            // Its bin folder cannot be written (another user's storage): PowerShell does the work.
+        }
+        toolsFor.set(storageRoot, exe);
+    }
+    return toolsFor.get(storageRoot) ?? null;
+}
+/**
+ * DPAPI for the current Windows user: HostTools.exe (built in <storageRoot>\bin; about 0.15 s a call) when a storage
+ * folder is known, else powershell.exe 5.1 (about 2 s a call, which a menu feels). Both read and write the same format.
+ */
 class DpapiBox {
+    storageRoot;
     kind = 'dpapi1';
+    constructor(storageRoot) {
+        this.storageRoot = storageRoot;
+    }
     seal(plain) {
         return this.run('protect', plain.toString('base64'));
     }
@@ -17,7 +40,11 @@ class DpapiBox {
         return Buffer.from(this.run('unprotect', sealed), 'base64');
     }
     run(mode, input) {
-        const result = spawnSync(SYSTEM.powershell(), nativeScript('protect-data.ps1', ['-Mode', mode]), {
+        const tools = this.storageRoot ? dpapiTool(this.storageRoot) : null;
+        const [exe, args] = tools
+            ? [tools, [mode]]
+            : [SYSTEM.powershell(), nativeScript('protect-data.ps1', ['-Mode', mode])];
+        const result = spawnSync(exe, args, {
             input,
             encoding: 'utf8',
             windowsHide: true,
@@ -49,17 +76,17 @@ export class SecretStore {
     constructor(box) {
         this.box = box;
     }
-    /** Windows DPAPI, current user. */
-    static dpapi() {
-        return new SecretStore(new DpapiBox());
+    /** Windows DPAPI, current user; with a storage folder, through its HostTools.exe (much faster than PowerShell). */
+    static dpapi(storageRoot = null) {
+        return new SecretStore(new DpapiBox(storageRoot));
     }
     /** The test stand-in (not secure). */
     static memory() {
         return new SecretStore(new MemoryBox());
     }
     /** What the program uses: DPAPI, except during the self-test (it never spawns Windows for this). */
-    static standard() {
-        return selfTestRunning() ? SecretStore.memory() : SecretStore.dpapi();
+    static standard(storageRoot = null) {
+        return selfTestRunning() ? SecretStore.memory() : SecretStore.dpapi(storageRoot);
     }
     /** True when `value` looks like something seal() made (any box). */
     static isSealed(value) {

package/dist/host/vpn/login.js

@@ -27,7 +27,7 @@ export function loginProblem(c) {
 export class VpnLogin {
     storageRoot;
     secrets;
-    constructor(storageRoot, secrets = SecretStore.standard()) {
+    constructor(storageRoot, secrets = SecretStore.standard(storageRoot)) {
         this.storageRoot = storageRoot;
         this.secrets = secrets;
     }

package/dist/runtime/agent.js

@@ -25486,7 +25486,7 @@ var SandboxSchema = external_exports.strictObject({
     "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. Yours only: a project file cannot change it."
   ),
   vGpu: external_exports.boolean().describe(
-    "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it)."
+    "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it). Browsers in the sandbox never use it (they draw in software)."
   ),
   networking: external_exports.boolean().describe("Internet access. false is the only hard network isolation Windows Sandbox offers."),
   clipboard: external_exports.boolean().describe(
@@ -25648,6 +25648,21 @@ var ToolchainsSchema = external_exports.strictObject({
     msvcVersion: external_exports.string().min(1).describe('"latest" or an MSVC tools version prefix, e.g. "14.44".'),
     sdkVersion: external_exports.string().min(1).describe('"latest" or a Windows SDK build, e.g. "26100" or "10.0.22621".')
   }),
+  unreal: external_exports.strictObject({
+    enabled: enabled(
+      "Unreal Engine development: Visual Studio Community 2022 with the C++ game workload (MSVC, a Windows 11 SDK, .NET Framework targeting packs, Unreal integration and the Epic Games Launcher) and the DirectX End-User Runtime. A real installer: it runs every boot (~10 GB on the sandbox disk). The engine itself comes from the Epic Games Launcher or its source.",
+      "a .uproject or .uplugin"
+    ),
+    acceptLicense: external_exports.boolean().describe(
+      "Required to install: you accept the Visual Studio Community licence terms (https://visualstudio.microsoft.com/license-terms/) and the DirectX End-User Runtime licence."
+    ),
+    components: StringsSchema.describe(
+      'More Visual Studio workload or component IDs to add, e.g. ["Microsoft.VisualStudio.Component.VC.Llvm.Clang"].'
+    ),
+    keepInstallFiles: external_exports.boolean().describe(
+      "Keep an offline copy of the Visual Studio install files in tools\\visualstudio (~10 GB, made once), so later boots install without downloading them again. Skipped while that disk has too little room."
+    )
+  }),
   cpp: external_exports.strictObject({
     enabled: enabled(
       "MinGW-w64 GCC with CMake, Ninja, premake5 and mingw32-make (also Rust's linker).",