windows-development-sandbox 1.16.0 → 1.17.3

package/dist/runtime/main.js

@@ -1363,11 +1363,11 @@ var require_lodash = __commonJS({
             return isFunction(object2[key]);
           });
         }
-        function baseGet(object2, path77) {
-          path77 = castPath(path77, object2);
-          var index = 0, length = path77.length;
+        function baseGet(object2, path78) {
+          path78 = castPath(path78, object2);
+          var index = 0, length = path78.length;
           while (object2 != null && index < length) {
-            object2 = object2[toKey(path77[index++])];
+            object2 = object2[toKey(path78[index++])];
           }
           return index && index == length ? object2 : undefined2;
         }
@@ -1431,10 +1431,10 @@ var require_lodash = __commonJS({
           });
           return accumulator;
         }
-        function baseInvoke(object2, path77, args) {
-          path77 = castPath(path77, object2);
-          object2 = parent(object2, path77);
-          var func = object2 == null ? object2 : object2[toKey(last(path77))];
+        function baseInvoke(object2, path78, args) {
+          path78 = castPath(path78, object2);
+          object2 = parent(object2, path78);
+          var func = object2 == null ? object2 : object2[toKey(last(path78))];
           return func == null ? undefined2 : apply(func, object2, args);
         }
         function baseIsArguments(value) {
@@ -1590,13 +1590,13 @@ var require_lodash = __commonJS({
             return object2 === source || baseIsMatch(object2, source, matchData);
           };
         }
-        function baseMatchesProperty(path77, srcValue) {
-          if (isKey(path77) && isStrictComparable(srcValue)) {
-            return matchesStrictComparable(toKey(path77), srcValue);
+        function baseMatchesProperty(path78, srcValue) {
+          if (isKey(path78) && isStrictComparable(srcValue)) {
+            return matchesStrictComparable(toKey(path78), srcValue);
           }
           return function(object2) {
-            var objValue = get(object2, path77);
-            return objValue === undefined2 && objValue === srcValue ? hasIn(object2, path77) : baseIsEqual(srcValue, objValue, COMPARE_PARTIAL_FLAG | COMPARE_UNORDERED_FLAG);
+            var objValue = get(object2, path78);
+            return objValue === undefined2 && objValue === srcValue ? hasIn(object2, path78) : baseIsEqual(srcValue, objValue, COMPARE_PARTIAL_FLAG | COMPARE_UNORDERED_FLAG);
           };
         }
         function baseMerge(object2, source, srcIndex, customizer, stack) {
@@ -1693,23 +1693,23 @@ var require_lodash = __commonJS({
           });
         }
         function basePick(object2, paths) {
-          return basePickBy(object2, paths, function(value, path77) {
-            return hasIn(object2, path77);
+          return basePickBy(object2, paths, function(value, path78) {
+            return hasIn(object2, path78);
           });
         }
         function basePickBy(object2, paths, predicate) {
           var index = -1, length = paths.length, result2 = {};
           while (++index < length) {
-            var path77 = paths[index], value = baseGet(object2, path77);
-            if (predicate(value, path77)) {
-              baseSet(result2, castPath(path77, object2), value);
+            var path78 = paths[index], value = baseGet(object2, path78);
+            if (predicate(value, path78)) {
+              baseSet(result2, castPath(path78, object2), value);
             }
           }
           return result2;
         }
-        function basePropertyDeep(path77) {
+        function basePropertyDeep(path78) {
           return function(object2) {
-            return baseGet(object2, path77);
+            return baseGet(object2, path78);
           };
         }
         function basePullAll(array2, values2, iteratee2, comparator) {
@@ -1783,14 +1783,14 @@ var require_lodash = __commonJS({
           var array2 = values(collection);
           return shuffleSelf(array2, baseClamp(n, 0, array2.length));
         }
-        function baseSet(object2, path77, value, customizer) {
+        function baseSet(object2, path78, value, customizer) {
           if (!isObject2(object2)) {
             return object2;
           }
-          path77 = castPath(path77, object2);
-          var index = -1, length = path77.length, lastIndex = length - 1, nested = object2;
+          path78 = castPath(path78, object2);
+          var index = -1, length = path78.length, lastIndex = length - 1, nested = object2;
           while (nested != null && ++index < length) {
-            var key = toKey(path77[index]), newValue = value;
+            var key = toKey(path78[index]), newValue = value;
             if (key === "__proto__" || key === "constructor" || key === "prototype") {
               return object2;
             }
@@ -1798,7 +1798,7 @@ var require_lodash = __commonJS({
               var objValue = nested[key];
               newValue = customizer ? customizer(objValue, key, nested) : undefined2;
               if (newValue === undefined2) {
-                newValue = isObject2(objValue) ? objValue : isIndex(path77[index + 1]) ? [] : {};
+                newValue = isObject2(objValue) ? objValue : isIndex(path78[index + 1]) ? [] : {};
               }
             }
             assignValue(nested, key, newValue);
@@ -1964,14 +1964,14 @@ var require_lodash = __commonJS({
             }
           return result2;
         }
-        function baseUnset(object2, path77) {
-          path77 = castPath(path77, object2);
-          var index = -1, length = path77.length;
+        function baseUnset(object2, path78) {
+          path78 = castPath(path78, object2);
+          var index = -1, length = path78.length;
           if (!length) {
             return true;
           }
           while (++index < length) {
-            var key = toKey(path77[index]);
+            var key = toKey(path78[index]);
             if (key === "__proto__" && !hasOwnProperty.call(object2, "__proto__")) {
               return false;
             }
@@ -1979,11 +1979,11 @@ var require_lodash = __commonJS({
               return false;
             }
           }
-          var obj = parent(object2, path77);
-          return obj == null || delete obj[toKey(last(path77))];
+          var obj = parent(object2, path78);
+          return obj == null || delete obj[toKey(last(path78))];
         }
-        function baseUpdate(object2, path77, updater, customizer) {
-          return baseSet(object2, path77, updater(baseGet(object2, path77)), customizer);
+        function baseUpdate(object2, path78, updater, customizer) {
+          return baseSet(object2, path78, updater(baseGet(object2, path78)), customizer);
         }
         function baseWhile(array2, predicate, isDrop, fromRight) {
           var length = array2.length, index = fromRight ? length : -1;
@@ -2866,11 +2866,11 @@ var require_lodash = __commonJS({
           var match = source.match(reWrapDetails);
           return match ? match[1].split(reSplitDetails) : [];
         }
-        function hasPath(object2, path77, hasFunc) {
-          path77 = castPath(path77, object2);
-          var index = -1, length = path77.length, result2 = false;
+        function hasPath(object2, path78, hasFunc) {
+          path78 = castPath(path78, object2);
+          var index = -1, length = path78.length, result2 = false;
           while (++index < length) {
-            var key = toKey(path77[index]);
+            var key = toKey(path78[index]);
             if (!(result2 = object2 != null && hasFunc(object2, key))) {
               break;
             }
@@ -3072,8 +3072,8 @@ var require_lodash = __commonJS({
             return apply(func, this, otherArgs);
           };
         }
-        function parent(object2, path77) {
-          return path77.length < 2 ? object2 : baseGet(object2, baseSlice(path77, 0, -1));
+        function parent(object2, path78) {
+          return path78.length < 2 ? object2 : baseGet(object2, baseSlice(path78, 0, -1));
         }
         function reorder(array2, indexes) {
           var arrLength = array2.length, length = nativeMin(indexes.length, arrLength), oldArray = copyArray(array2);
@@ -3708,10 +3708,10 @@ var require_lodash = __commonJS({
           }
           return isString(collection) ? fromIndex <= length && collection.indexOf(value, fromIndex) > -1 : !!length && baseIndexOf(collection, value, fromIndex) > -1;
         }
-        var invokeMap = baseRest(function(collection, path77, args) {
-          var index = -1, isFunc = typeof path77 == "function", result2 = isArrayLike(collection) ? Array2(collection.length) : [];
+        var invokeMap = baseRest(function(collection, path78, args) {
+          var index = -1, isFunc = typeof path78 == "function", result2 = isArrayLike(collection) ? Array2(collection.length) : [];
           baseEach(collection, function(value) {
-            result2[++index] = isFunc ? apply(path77, value, args) : baseInvoke(value, path77, args);
+            result2[++index] = isFunc ? apply(path78, value, args) : baseInvoke(value, path78, args);
           });
           return result2;
         });
@@ -4363,15 +4363,15 @@ var require_lodash = __commonJS({
         function functionsIn(object2) {
           return object2 == null ? [] : baseFunctions(object2, keysIn(object2));
         }
-        function get(object2, path77, defaultValue) {
-          var result2 = object2 == null ? undefined2 : baseGet(object2, path77);
+        function get(object2, path78, defaultValue) {
+          var result2 = object2 == null ? undefined2 : baseGet(object2, path78);
           return result2 === undefined2 ? defaultValue : result2;
         }
-        function has(object2, path77) {
-          return object2 != null && hasPath(object2, path77, baseHas);
+        function has(object2, path78) {
+          return object2 != null && hasPath(object2, path78, baseHas);
         }
-        function hasIn(object2, path77) {
-          return object2 != null && hasPath(object2, path77, baseHasIn);
+        function hasIn(object2, path78) {
+          return object2 != null && hasPath(object2, path78, baseHasIn);
         }
         var invert = createInverter(function(result2, value, key) {
           if (value != null && typeof value.toString != "function") {
@@ -4424,10 +4424,10 @@ var require_lodash = __commonJS({
             return result2;
           }
           var isDeep = false;
-          paths = arrayMap(paths, function(path77) {
-            path77 = castPath(path77, object2);
-            isDeep || (isDeep = path77.length > 1);
-            return path77;
+          paths = arrayMap(paths, function(path78) {
+            path78 = castPath(path78, object2);
+            isDeep || (isDeep = path78.length > 1);
+            return path78;
           });
           copyObject(object2, getAllKeysIn(object2), result2);
           if (isDeep) {
@@ -4453,19 +4453,19 @@ var require_lodash = __commonJS({
             return [prop];
           });
           predicate = getIteratee(predicate);
-          return basePickBy(object2, props, function(value, path77) {
-            return predicate(value, path77[0]);
+          return basePickBy(object2, props, function(value, path78) {
+            return predicate(value, path78[0]);
           });
         }
-        function result(object2, path77, defaultValue) {
-          path77 = castPath(path77, object2);
-          var index = -1, length = path77.length;
+        function result(object2, path78, defaultValue) {
+          path78 = castPath(path78, object2);
+          var index = -1, length = path78.length;
           if (!length) {
             length = 1;
             object2 = undefined2;
           }
           while (++index < length) {
-            var value = object2 == null ? undefined2 : object2[toKey(path77[index])];
+            var value = object2 == null ? undefined2 : object2[toKey(path78[index])];
             if (value === undefined2) {
               index = length;
               value = defaultValue;
@@ -4474,12 +4474,12 @@ var require_lodash = __commonJS({
           }
           return object2;
         }
-        function set2(object2, path77, value) {
-          return object2 == null ? object2 : baseSet(object2, path77, value);
+        function set2(object2, path78, value) {
+          return object2 == null ? object2 : baseSet(object2, path78, value);
         }
-        function setWith(object2, path77, value, customizer) {
+        function setWith(object2, path78, value, customizer) {
           customizer = typeof customizer == "function" ? customizer : undefined2;
-          return object2 == null ? object2 : baseSet(object2, path77, value, customizer);
+          return object2 == null ? object2 : baseSet(object2, path78, value, customizer);
         }
         var toPairs = createToPairs(keys);
         var toPairsIn = createToPairs(keysIn);
@@ -4501,15 +4501,15 @@ var require_lodash = __commonJS({
           });
           return accumulator;
         }
-        function unset(object2, path77) {
-          return object2 == null ? true : baseUnset(object2, path77);
+        function unset(object2, path78) {
+          return object2 == null ? true : baseUnset(object2, path78);
         }
-        function update(object2, path77, updater) {
-          return object2 == null ? object2 : baseUpdate(object2, path77, castFunction(updater));
+        function update(object2, path78, updater) {
+          return object2 == null ? object2 : baseUpdate(object2, path78, castFunction(updater));
         }
-        function updateWith(object2, path77, updater, customizer) {
+        function updateWith(object2, path78, updater, customizer) {
           customizer = typeof customizer == "function" ? customizer : undefined2;
-          return object2 == null ? object2 : baseUpdate(object2, path77, castFunction(updater), customizer);
+          return object2 == null ? object2 : baseUpdate(object2, path78, castFunction(updater), customizer);
         }
         function values(object2) {
           return object2 == null ? [] : baseValues(object2, keys(object2));
@@ -4895,17 +4895,17 @@ var require_lodash = __commonJS({
         function matches(source) {
           return baseMatches(baseClone(source, CLONE_DEEP_FLAG));
         }
-        function matchesProperty(path77, srcValue) {
-          return baseMatchesProperty(path77, baseClone(srcValue, CLONE_DEEP_FLAG));
+        function matchesProperty(path78, srcValue) {
+          return baseMatchesProperty(path78, baseClone(srcValue, CLONE_DEEP_FLAG));
         }
-        var method = baseRest(function(path77, args) {
+        var method = baseRest(function(path78, args) {
           return function(object2) {
-            return baseInvoke(object2, path77, args);
+            return baseInvoke(object2, path78, args);
           };
         });
         var methodOf = baseRest(function(object2, args) {
-          return function(path77) {
-            return baseInvoke(object2, path77, args);
+          return function(path78) {
+            return baseInvoke(object2, path78, args);
           };
         });
         function mixin(object2, source, options) {
@@ -4952,12 +4952,12 @@ var require_lodash = __commonJS({
         var over = createOver(arrayMap);
         var overEvery = createOver(arrayEvery);
         var overSome = createOver(arraySome);
-        function property(path77) {
-          return isKey(path77) ? baseProperty(toKey(path77)) : basePropertyDeep(path77);
+        function property(path78) {
+          return isKey(path78) ? baseProperty(toKey(path78)) : basePropertyDeep(path78);
         }
         function propertyOf(object2) {
-          return function(path77) {
-            return object2 == null ? undefined2 : baseGet(object2, path77);
+          return function(path78) {
+            return object2 == null ? undefined2 : baseGet(object2, path78);
           };
         }
         var range = createRange();
@@ -5410,12 +5410,12 @@ var require_lodash = __commonJS({
         LazyWrapper.prototype.findLast = function(predicate) {
           return this.reverse().find(predicate);
         };
-        LazyWrapper.prototype.invokeMap = baseRest(function(path77, args) {
-          if (typeof path77 == "function") {
+        LazyWrapper.prototype.invokeMap = baseRest(function(path78, args) {
+          if (typeof path78 == "function") {
             return new LazyWrapper(this);
           }
           return this.map(function(value) {
-            return baseInvoke(value, path77, args);
+            return baseInvoke(value, path78, args);
           });
         });
         LazyWrapper.prototype.reject = function(predicate) {
@@ -5532,8 +5532,8 @@ var require_lodash = __commonJS({
 });
 
 // src/guest/entries/main.ts
-import fs63 from "node:fs";
-import path76 from "node:path";
+import fs64 from "node:fs";
+import path77 from "node:path";
 
 // src/guest/runtime/paths.ts
 import path7 from "node:path";
@@ -6358,10 +6358,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path77) {
-  if (!path77)
+function getElementAtPath(obj, path78) {
+  if (!path78)
     return obj;
-  return path77.reduce((acc, key) => acc?.[key], obj);
+  return path78.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -6701,11 +6701,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path77, issues) {
+function prefixIssues(path78, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path77);
+    iss.path.unshift(path78);
     return iss;
   });
 }
@@ -7155,16 +7155,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path77 = []) => {
+  const processError = (error63, path78 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path77, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path78, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path77, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path78, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path77, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path78, ...issue2.path]);
       } else {
-        const fullpath = [...path77, ...issue2.path];
+        const fullpath = [...path78, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -7203,17 +7203,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path77 = []) => {
+  const processError = (error63, path78 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path77, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path78, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path77, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path78, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path77, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path78, ...issue2.path]);
       } else {
-        const fullpath = [...path77, ...issue2.path];
+        const fullpath = [...path78, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -7252,8 +7252,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path77 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path77) {
+  const path78 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path78) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -24355,13 +24355,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path77 = ref.slice(1).split("/").filter(Boolean);
-  if (path77.length === 0) {
+  const path78 = ref.slice(1).split("/").filter(Boolean);
+  if (path78.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path77[0] === defsKey) {
-    const key = path77[1] === void 0 ? void 0 : decodeJSONPointerSegment(path77[1]);
+  if (path78[0] === defsKey) {
+    const key = path78[1] === void 0 ? void 0 : decodeJSONPointerSegment(path78[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -25479,7 +25479,7 @@ var SandboxSchema = external_exports.strictObject({
     "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. Yours only: a project file cannot change it."
   ),
   vGpu: external_exports.boolean().describe(
-    "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it)."
+    "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it). Browsers in the sandbox never use it (they draw in software)."
   ),
   networking: external_exports.boolean().describe("Internet access. false is the only hard network isolation Windows Sandbox offers."),
   clipboard: external_exports.boolean().describe(
@@ -25641,6 +25641,21 @@ var ToolchainsSchema = external_exports.strictObject({
     msvcVersion: external_exports.string().min(1).describe('"latest" or an MSVC tools version prefix, e.g. "14.44".'),
     sdkVersion: external_exports.string().min(1).describe('"latest" or a Windows SDK build, e.g. "26100" or "10.0.22621".')
   }),
+  unreal: external_exports.strictObject({
+    enabled: enabled(
+      "Unreal Engine development: Visual Studio Community 2022 with the C++ game workload (MSVC, a Windows 11 SDK, .NET Framework targeting packs, Unreal integration and the Epic Games Launcher) and the DirectX End-User Runtime. A real installer: it runs every boot (~10 GB on the sandbox disk). The engine itself comes from the Epic Games Launcher or its source.",
+      "a .uproject or .uplugin"
+    ),
+    acceptLicense: external_exports.boolean().describe(
+      "Required to install: you accept the Visual Studio Community licence terms (https://visualstudio.microsoft.com/license-terms/) and the DirectX End-User Runtime licence."
+    ),
+    components: StringsSchema.describe(
+      'More Visual Studio workload or component IDs to add, e.g. ["Microsoft.VisualStudio.Component.VC.Llvm.Clang"].'
+    ),
+    keepInstallFiles: external_exports.boolean().describe(
+      "Keep an offline copy of the Visual Studio install files in tools\\visualstudio (~10 GB, made once), so later boots install without downloading them again. Skipped while that disk has too little room."
+    )
+  }),
   cpp: external_exports.strictObject({
     enabled: enabled(
       "MinGW-w64 GCC with CMake, Ninja, premake5 and mingw32-make (also Rust's linker).",
@@ -27792,8 +27807,8 @@ function writeStatus(phase, message) {
 }
 
 // src/guest/boot/boot.ts
-import fs62 from "node:fs";
-import path75 from "node:path";
+import fs63 from "node:fs";
+import path76 from "node:path";
 import { spawn as spawn10 } from "node:child_process";
 
 // src/guest/boot/guide.ts
@@ -28623,6 +28638,7 @@ var MARKERS = {
   ],
   rust: ["Cargo.toml", "rust-toolchain", "rust-toolchain.toml"],
   msvc: ["*.vcxproj", "CMakePresets.json", "CMakeUserPresets.json"],
+  unreal: ["*.uproject", "*.uplugin"],
   cpp: [
     "CMakeLists.txt",
     "Makefile",
@@ -30258,25 +30274,230 @@ async function setupMsvc(env, config2) {
   env.summary.push("msvc: " + done.msvc + ", Windows SDK " + done.sdk + " (cl, link; vcvars64.bat and vswhere work)");
 }
 
-// src/guest/toolchains/native/rust.ts
+// src/guest/toolchains/native/unreal.ts
+import fs36 from "node:fs";
+import os7 from "node:os";
 import path44 from "node:path";
 
-// src/guest/toolchains/native/binstall.ts
+// src/guest/toolchains/native/vcruntime.ts
 import fs35 from "node:fs";
 import path43 from "node:path";
+var VC_REDIST = "https://aka.ms/vs/17/release/vc_redist.x64.exe";
+var MICROSOFT_SIGNER = "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US";
+var OK_EXIT_CODES = [0, 1638, 3010];
+var signerOf = (file3) => scriptOutput("get-signer.ps1", ["-Path", file3]).trim();
+async function setupVcRuntime(env, summary = true) {
+  if (dryRun) {
+    log("(dry run) would install the Visual C++ runtime");
+    return false;
+  }
+  const system322 = path43.join(process.env.WINDIR ?? "C:\\Windows", "System32");
+  const missing = !exists(path43.join(system322, "vcruntime140.dll")) || !exists(path43.join(system322, "msvcp140.dll"));
+  if (missing) {
+    const installer = tool("vcredist", "vc_redist.x64.exe");
+    if (!exists(installer)) {
+      log("Downloading the Visual C++ runtime (~25 MB once) ...");
+      await downloadFile(VC_REDIST, installer);
+    }
+    if (signerOf(installer) !== MICROSOFT_SIGNER) {
+      fs35.rmSync(installer, { force: true });
+      throw new Error("vc_redist.x64.exe is not signed by Microsoft; deleted it (it is downloaded again next boot)");
+    }
+    log("Installing the Visual C++ runtime ...");
+    const code = await spawnAsync(installer, ["/install", "/quiet", "/norestart"]);
+    if (!OK_EXIT_CODES.includes(code ?? -1) || !exists(path43.join(system322, "vcruntime140.dll")))
+      throw new Error("the Visual C++ runtime installer failed (exit " + code + ")");
+  }
+  if (summary) env.summary.push("vc++ runtime: installed");
+  return missing;
+}
+
+// src/guest/toolchains/native/unreal.ts
+var BOOTSTRAPPER_URL = "https://aka.ms/vs/17/release/vs_community.exe";
+var DIRECTX_URL = "https://download.microsoft.com/download/8/4/A/84A35BF1-DAFE-4AE8-82AF-AD2AE20B6B14/directx_Jun2010_redist.exe";
+var UNREAL_COMPONENTS = [
+  "Microsoft.VisualStudio.Workload.NativeGame",
+  "Microsoft.VisualStudio.Component.VC.Tools.x86.x64",
+  "Microsoft.VisualStudio.Component.Windows11SDK.22621",
+  "Microsoft.VisualStudio.Component.VC.DiagnosticTools",
+  "Microsoft.Net.Component.4.6.2.TargetingPack",
+  "Microsoft.Net.Component.4.8.SDK",
+  "Component.Unreal.Ide",
+  "Component.Unreal"
+];
+var OK_EXIT_CODES2 = [0, 3010];
+var LAYOUT_ROOM_BYTES = 15 * 1024 ** 3;
+var INSTALL_ROOM_BYTES = 20 * 1024 ** 3;
+var ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;
+var VS_DIR = tool("visualstudio");
+var BOOTSTRAPPER = path44.join(VS_DIR, "vs_community.exe");
+var LAYOUT = path44.join(VS_DIR, "layout");
+var LAYOUT_MARKER = path44.join(LAYOUT, ".complete.json");
+var LayoutSchema = external_exports.object({ components: external_exports.array(external_exports.string()) });
+var VSWHERE = path44.join(
+  process.env["ProgramFiles(x86)"] ?? "C:\\Program Files (x86)",
+  "Microsoft Visual Studio",
+  "Installer",
+  "vswhere.exe"
+);
+function installedVs() {
+  if (!exists(VSWHERE)) return null;
+  const ask = (property) => execOutput(VSWHERE, [
+    "-latest",
+    "-products",
+    "*",
+    "-requires",
+    "Microsoft.VisualStudio.Component.VC.Tools.x86.x64",
+    "-property",
+    property
+  ]);
+  const at = ask("installationPath");
+  return at ? { path: at, version: ask("installationVersion") || "installed" } : null;
+}
+async function signedInstaller(url2, file3, what) {
+  if (!exists(file3)) {
+    log("Downloading " + what + " ...");
+    mkdirp(path44.dirname(file3));
+    await downloadFile(url2, file3);
+  }
+  if (signerOf(file3) !== MICROSOFT_SIGNER) {
+    fs36.rmSync(file3, { force: true });
+    throw new Error(path44.basename(file3) + " is not signed by Microsoft; deleted it (it is downloaded again next boot)");
+  }
+  return file3;
+}
+function freeBytes(dir) {
+  try {
+    const s = fs36.statfsSync(dir);
+    return s.bavail * s.bsize;
+  } catch {
+    return 0;
+  }
+}
+async function layoutInstaller(bootstrapper, ids) {
+  const installer = path44.join(LAYOUT, "vs_community.exe");
+  const has = () => {
+    if (!exists(LAYOUT_MARKER) || !exists(installer)) return false;
+    try {
+      const done = LayoutSchema.parse(JSON.parse(fs36.readFileSync(LAYOUT_MARKER, "utf8")));
+      return ids.every((id) => done.components.includes(id));
+    } catch {
+      return false;
+    }
+  };
+  if (has()) return installer;
+  if (freeBytes(mkdirp(VS_DIR)) < LAYOUT_ROOM_BYTES) {
+    warn("unreal: not keeping the install files (less than 15 GB free in " + VS_DIR + "); downloading this boot");
+    return null;
+  }
+  log("Saving the Visual Studio install files for later boots (~10 GB, once) ...");
+  fs36.rmSync(LAYOUT_MARKER, { force: true });
+  const code = await spawnAsync(bootstrapper, [
+    "--layout",
+    LAYOUT,
+    "--lang",
+    "en-US",
+    "--quiet",
+    "--wait",
+    ...ids.flatMap((id) => ["--add", id])
+  ]);
+  if (!OK_EXIT_CODES2.includes(code) || !exists(installer)) {
+    warn("unreal: saving the install files failed (exit " + code + "); downloading this boot");
+    return null;
+  }
+  writeJsonAtomic(LAYOUT_MARKER, { components: [...ids] });
+  return installer;
+}
+async function installVisualStudio(config2, ids) {
+  const bootstrapper = await signedInstaller(BOOTSTRAPPER_URL, BOOTSTRAPPER, "the Visual Studio installer");
+  let installer = null;
+  if (config2.keepInstallFiles) {
+    try {
+      installer = await layoutInstaller(bootstrapper, ids);
+    } catch (e) {
+      warn("unreal: the offline copy failed (" + errMsg(e) + "); downloading this boot");
+    }
+  }
+  log(
+    "Installing Visual Studio Community 2022 with the C++ game workload" + (installer ? " from the saved install files" : " (downloads ~5-8 GB)") + " ..."
+  );
+  const code = await spawnAsync(installer ?? bootstrapper, [
+    "--quiet",
+    "--wait",
+    "--norestart",
+    "--nocache",
+    ...installer ? ["--noWeb"] : [],
+    ...ids.flatMap((id) => ["--add", id])
+  ]);
+  if (!OK_EXIT_CODES2.includes(code) || !installedVs())
+    throw new Error(
+      "the Visual Studio installer failed (exit " + code + "); its logs are the dd_*.log files in " + os7.tmpdir()
+    );
+}
+async function installDirectX() {
+  const system322 = path44.join(process.env.WINDIR ?? "C:\\Windows", "System32");
+  if (exists(path44.join(system322, "d3dx9_43.dll")) && exists(path44.join(system322, "XAudio2_7.dll"))) return;
+  const redist = await signedInstaller(
+    DIRECTX_URL,
+    path44.join(VS_DIR, "directx_Jun2010_redist.exe"),
+    "the DirectX End-User Runtime (~95 MB once)"
+  );
+  const unpacked = path44.join(os7.tmpdir(), "directx-redist");
+  safeRemove(unpacked, os7.tmpdir());
+  mkdirp(unpacked);
+  if (await spawnAsync(redist, ["/Q", "/T:" + unpacked]) !== 0 || !exists(path44.join(unpacked, "DXSETUP.exe")))
+    throw new Error("could not unpack the DirectX End-User Runtime");
+  const code = await spawnAsync(path44.join(unpacked, "DXSETUP.exe"), ["/silent"]);
+  safeRemove(unpacked, os7.tmpdir());
+  if (code !== 0) throw new Error("the DirectX End-User Runtime installer failed (exit " + code + ")");
+}
+async function setupUnreal(env, config2) {
+  if (!config2.acceptLicense)
+    throw new Error(
+      "Unreal tools are installed only with toolchains.unreal.acceptLicense = true: Visual Studio Community and the DirectX End-User Runtime come under Microsoft licence terms (https://visualstudio.microsoft.com/license-terms/)"
+    );
+  const bad = config2.components.find((id) => !ID.test(id));
+  if (bad) throw new Error('toolchains.unreal.components: "' + bad + '" is not a Visual Studio component ID');
+  const ids = [.../* @__PURE__ */ new Set([...UNREAL_COMPONENTS, ...config2.components])];
+  if (dryRun) {
+    log("(dry run) would install Visual Studio Community 2022 with " + ids.join(", ") + " and DirectX");
+    return;
+  }
+  if (!installedVs()) {
+    const programFiles = process.env.ProgramFiles ?? "C:\\Program Files";
+    const free = freeBytes(programFiles);
+    if (free < INSTALL_ROOM_BYTES)
+      throw new Error(
+        "not installing Visual Studio: the sandbox disk has " + (free / 1024 ** 3).toFixed(1) + " GB free and it needs 20 GB (7 GB for Visual Studio, the rest for builds and the paging file)"
+      );
+    await installVisualStudio(config2, ids);
+  }
+  await installDirectX();
+  const vs = installedVs();
+  env.summary.push(
+    "unreal: Visual Studio Community " + vs.version + " (C++ game workload, Windows 11 SDK, Unreal support) at " + vs.path + "; DirectX End-User Runtime; get the engine from the Epic Games Launcher (Start menu)"
+  );
+}
+
+// src/guest/toolchains/native/rust.ts
+import path46 from "node:path";
+
+// src/guest/toolchains/native/binstall.ts
+import fs37 from "node:fs";
+import path45 from "node:path";
 var ensureBinstall = async (cargoBin) => {
-  const target = path43.join(cargoBin, "cargo-binstall.exe");
+  const target = path45.join(cargoBin, "cargo-binstall.exe");
   if (exists(target)) return true;
   try {
     const dir = tool("cargo-binstall");
-    if (!exists(path43.join(dir, "cargo-binstall.exe"))) {
+    if (!exists(path45.join(dir, "cargo-binstall.exe"))) {
       await installFromGithub("cargo-bins/cargo-binstall", binstallAsset(arch), {
         dest: dir,
         what: "cargo-binstall for prebuilt Rust tools (~10 MB once)",
         locate: "cargo-binstall.exe"
       });
     }
-    fs35.copyFileSync(path43.join(dir, "cargo-binstall.exe"), target);
+    fs37.copyFileSync(path45.join(dir, "cargo-binstall.exe"), target);
     return true;
   } catch (e) {
     warn("cargo-binstall unavailable, compiling crates with cargo install instead: " + errMsg(e));
@@ -30284,14 +30505,14 @@ var ensureBinstall = async (cargoBin) => {
   }
 };
 function crateInstaller(cargoHome, cargoEnv) {
-  const cargo = path43.join(cargoHome, "bin", "cargo.exe");
+  const cargo = path45.join(cargoHome, "bin", "cargo.exe");
   let binstall = null;
   const binstallEnv = {
     ...cargoEnv,
     env: { ...cargoEnv.env ?? process.env, BINSTALL_DISABLE_TELEMETRY: "true" }
   };
   return async (crate) => {
-    binstall ??= ensureBinstall(path43.join(cargoHome, "bin"));
+    binstall ??= ensureBinstall(path45.join(cargoHome, "bin"));
     if (await binstall) {
       try {
         await execAsync(
@@ -30313,7 +30534,7 @@ async function setupRust(env, config2, refresh) {
   const RUSTUP_HOME = tool("rust", "rustup");
   const CARGO_HOME = tool("rust", "cargo");
   const rustEnv = { env: { ...process.env, RUSTUP_HOME, CARGO_HOME } };
-  const rustup = path44.join(CARGO_HOME, "bin", "rustup.exe");
+  const rustup = path46.join(CARGO_HOME, "bin", "rustup.exe");
   if (dryRun) {
     log("(dry run) would provision Rust " + config2.toolchain + " (" + config2.host + ")");
     return;
@@ -30349,9 +30570,9 @@ async function setupRust(env, config2, refresh) {
     if (refresh) await execAsync(rustup, ["update"], rustEnv);
   }
   Object.assign(env.vars, { RUSTUP_HOME, CARGO_HOME });
-  env.prepend.push(path44.join(CARGO_HOME, "bin"));
+  env.prepend.push(path46.join(CARGO_HOME, "bin"));
   env.summary.push(
-    "rust: " + versionOf(path44.join(CARGO_HOME, "bin", "rustc.exe"), ["--version"], rustEnv) + " [" + config2.host + "]"
+    "rust: " + versionOf(path46.join(CARGO_HOME, "bin", "rustc.exe"), ["--version"], rustEnv) + " [" + config2.host + "]"
   );
   const toolchainKey = "rustup@" + config2.toolchain;
   await installOnce(
@@ -30372,36 +30593,36 @@ async function setupRust(env, config2, refresh) {
     env: {
       ...rustEnv.env,
       ...msvc.vars,
-      PATH: [path44.join(CARGO_HOME, "bin"), ...msvc.path, process.env.PATH ?? ""].join(path44.delimiter)
+      PATH: [path46.join(CARGO_HOME, "bin"), ...msvc.path, process.env.PATH ?? ""].join(path46.delimiter)
     }
   } : {
     env: {
       ...rustEnv.env,
-      CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: path44.join(mingw, "gcc.exe"),
-      PATH: [path44.join(CARGO_HOME, "bin"), mingw, process.env.PATH ?? ""].join(path44.delimiter)
+      CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: path46.join(mingw, "gcc.exe"),
+      PATH: [path46.join(CARGO_HOME, "bin"), mingw, process.env.PATH ?? ""].join(path46.delimiter)
     }
   };
   await installOnce(env, "cargo", config2.crates, crateInstaller(CARGO_HOME, cargoEnv));
 }
 
 // src/guest/toolchains/languages/node.ts
-import fs36 from "node:fs";
-import path45 from "node:path";
+import fs38 from "node:fs";
+import path47 from "node:path";
 import { spawn as spawn4 } from "node:child_process";
 var NVM_HOME = tool("nvm");
-var NVM_SYMLINK = path45.join(localDir, "nodejs");
-var HOST_NVM = path45.join(hostToolsDir, "nvm");
+var NVM_SYMLINK = path47.join(localDir, "nodejs");
+var HOST_NVM = path47.join(hostToolsDir, "nvm");
 var HOST_VERSIONS_MAX = 3;
-var hostNvmVersions = () => exists(HOST_NVM) ? fs36.readdirSync(HOST_NVM).filter((d) => /^v\d+\.\d+\.\d+$/.test(d) && exists(path45.join(HOST_NVM, d, "node.exe"))).map((d) => d.slice(1)) : [];
+var hostNvmVersions = () => exists(HOST_NVM) ? fs38.readdirSync(HOST_NVM).filter((d) => /^v\d+\.\d+\.\d+$/.test(d) && exists(path47.join(HOST_NVM, d, "node.exe"))).map((d) => d.slice(1)) : [];
 var resolveNode = (spec) => resolveCached("node:" + spec, async () => {
   const exact = spec.replace(/^v/, "");
   if (/^\d+\.\d+\.\d+$/.test(exact)) return exact;
   const releases = await fetchJson("https://nodejs.org/dist/index.json");
   return pickNodeVersion(releases, spec) ?? Promise.reject(new Error('No Node.js release matches "' + spec + '"'));
 });
-var NVM_TEMP = path45.join(NVM_HOME, ".tmp");
+var NVM_TEMP = path47.join(NVM_HOME, ".tmp");
 var nvm = (args) => new Promise((resolve2) => {
-  const child = spawn4(path45.join(NVM_HOME, "nvm.exe"), args, {
+  const child = spawn4(path47.join(NVM_HOME, "nvm.exe"), args, {
     windowsHide: true,
     env: { ...process.env, NVM_HOME, NVM_SYMLINK, TEMP: NVM_TEMP, TMP: NVM_TEMP }
   });
@@ -30416,12 +30637,12 @@ var nvm = (args) => new Promise((resolve2) => {
   child.once("close", () => resolve2(out));
 });
 var ensureNvm = async () => {
-  if (exists(path45.join(NVM_HOME, "nvm.exe"))) return;
-  if (exists(path45.join(HOST_NVM, "nvm.exe"))) {
+  if (exists(path47.join(NVM_HOME, "nvm.exe"))) return;
+  if (exists(path47.join(HOST_NVM, "nvm.exe"))) {
     log("Copying nvm from this PC ...");
     mkdirp(NVM_HOME);
-    const files = fs36.readdirSync(HOST_NVM).filter((f) => /\.(exe|cmd|vbs)$/i.test(f)).sort((a, b) => Number(a.toLowerCase() === "nvm.exe") - Number(b.toLowerCase() === "nvm.exe"));
-    for (const file3 of files) fs36.copyFileSync(path45.join(HOST_NVM, file3), path45.join(NVM_HOME, file3));
+    const files = fs38.readdirSync(HOST_NVM).filter((f) => /\.(exe|cmd|vbs)$/i.test(f)).sort((a, b) => Number(a.toLowerCase() === "nvm.exe") - Number(b.toLowerCase() === "nvm.exe"));
+    for (const file3 of files) fs38.copyFileSync(path47.join(HOST_NVM, file3), path47.join(NVM_HOME, file3));
     return;
   }
   const asset = await githubAsset("coreybutler/nvm-windows", /^nvm-noinstall\.zip$/, true);
@@ -30429,14 +30650,14 @@ var ensureNvm = async () => {
   await downloader.archive(asset.url, NVM_HOME, { sha256: asset.sha256, locate: "nvm.exe", fileName: asset.name });
 };
 var hostNodeFolder = (version2) => {
-  const dir = path45.join(hostToolsDir, "node");
-  return session.hostTools.nodeVersion?.replace(/^v/, "") === version2 && exists(path45.join(dir, "node.exe")) ? dir : null;
+  const dir = path47.join(hostToolsDir, "node");
+  return session.hostTools.nodeVersion?.replace(/^v/, "") === version2 && exists(path47.join(dir, "node.exe")) ? dir : null;
 };
 var installNodeVersion = async (version2) => {
-  const dir = path45.join(NVM_HOME, "v" + version2);
-  const fromHost = path45.join(HOST_NVM, "v" + version2);
-  if (exists(path45.join(dir, "node.exe"))) return;
-  if (exists(path45.join(fromHost, "node.exe"))) {
+  const dir = path47.join(NVM_HOME, "v" + version2);
+  const fromHost = path47.join(HOST_NVM, "v" + version2);
+  if (exists(path47.join(dir, "node.exe"))) return;
+  if (exists(path47.join(fromHost, "node.exe"))) {
     log("Copying Node " + version2 + " from this PC's nvm (without global packages) ...");
     copyNode(fromHost, dir);
     return;
@@ -30455,19 +30676,19 @@ var installNodeVersion = async (version2) => {
   } finally {
     safeRemove(NVM_TEMP, NVM_HOME);
   }
-  if (!exists(path45.join(dir, "node.exe"))) {
+  if (!exists(path47.join(dir, "node.exe"))) {
     const tail2 = out.trim().split(/\r?\n/).filter(Boolean).slice(-3).join(" ");
     const why = /complete/i.test(out) ? "nvm said it finished, but its move into the data folder did not happen" : "nvm could not download or unpack it: check the internet connection and the free disk space";
     throw new Error(
-      "nvm install " + version2 + " did not leave " + path45.join(dir, "node.exe") + " (" + why + ")" + (tail2 ? ". nvm printed: " + tail2 : "")
+      "nvm install " + version2 + " did not leave " + path47.join(dir, "node.exe") + " (" + why + ")" + (tail2 ? ". nvm printed: " + tail2 : "")
     );
   }
 };
 var activate = async (version2) => {
   await nvm(["use", version2]);
-  if (exists(path45.join(NVM_SYMLINK, "node.exe"))) return;
-  fs36.rmSync(NVM_SYMLINK, { recursive: true, force: true });
-  fs36.symlinkSync(path45.join(NVM_HOME, "v" + version2), NVM_SYMLINK, "junction");
+  if (exists(path47.join(NVM_SYMLINK, "node.exe"))) return;
+  fs38.rmSync(NVM_SYMLINK, { recursive: true, force: true });
+  fs38.symlinkSync(path47.join(NVM_HOME, "v" + version2), NVM_SYMLINK, "junction");
 };
 var PLAYWRIGHT_VARS = () => ({
   PLAYWRIGHT_BROWSERS_PATH: tool("ms-playwright"),
@@ -30479,8 +30700,8 @@ async function setupNode(env, versions, config2) {
     return;
   }
   await ensureNvm();
-  fs36.writeFileSync(
-    path45.join(NVM_HOME, "settings.txt"),
+  fs38.writeFileSync(
+    path47.join(NVM_HOME, "settings.txt"),
     [
       "root: " + NVM_HOME,
       "path: " + NVM_SYMLINK,
@@ -30507,7 +30728,7 @@ async function setupNode(env, versions, config2) {
     }
   }
   Object.assign(env.vars, { NVM_HOME, NVM_SYMLINK, ...PLAYWRIGHT_VARS() });
-  if (duringSession()) env.prepend.push(path45.join(NVM_HOME, "v" + main), NVM_HOME, NVM_SYMLINK);
+  if (duringSession()) env.prepend.push(path47.join(NVM_HOME, "v" + main), NVM_HOME, NVM_SYMLINK);
   else {
     await activate(main);
     env.prepend.push(NVM_HOME, NVM_SYMLINK);
@@ -30517,13 +30738,13 @@ async function setupNode(env, versions, config2) {
   await packageManagers(env, config2, main);
 }
 var packageManagers = async (env, config2, version2) => {
-  const dir = path45.join(NVM_HOME, "v" + version2);
-  const nodeEnv = { ...process.env, PATH: dir + path45.delimiter + (process.env.PATH ?? "") };
-  const npm = (args) => execAsync(path45.join(dir, "node.exe"), [path45.join(dir, "node_modules", "npm", "bin", "npm-cli.js"), ...args], {
+  const dir = path47.join(NVM_HOME, "v" + version2);
+  const nodeEnv = { ...process.env, PATH: dir + path47.delimiter + (process.env.PATH ?? "") };
+  const npm = (args) => execAsync(path47.join(dir, "node.exe"), [path47.join(dir, "node_modules", "npm", "bin", "npm-cli.js"), ...args], {
     env: nodeEnv,
     stdio: "ignore"
   });
-  const corepackJs = path45.join(dir, "node_modules", "corepack", "dist", "corepack.js");
+  const corepackJs = path47.join(dir, "node_modules", "corepack", "dist", "corepack.js");
   const extra = config2.corepack && !exists(corepackJs) ? ["corepack"] : [];
   await installOnce(
     env,
@@ -30544,7 +30765,7 @@ var packageManagers = async (env, config2, version2) => {
   }
   try {
     await execAsync(
-      path45.join(dir, "node.exe"),
+      path47.join(dir, "node.exe"),
       [corepackJs, "enable", "--install-directory", mkdirp(tool("bin")), "pnpm", "yarn"],
       { env: nodeEnv, stdio: "ignore" }
     );
@@ -30569,8 +30790,8 @@ async function setupPwsh(env, refresh = false) {
 }
 
 // src/guest/toolchains/languages/python.ts
-import fs37 from "node:fs";
-import path46 from "node:path";
+import fs39 from "node:fs";
+import path48 from "node:path";
 var installPython = async (pkg, spec) => {
   const version2 = await resolveCached(pkg + ":" + spec, async () => {
     const { versions } = await fetchJson(
@@ -30579,7 +30800,7 @@ var installPython = async (pkg, spec) => {
     return pickPackageVersion(versions, spec) ?? Promise.reject(new Error("No " + pkg + ' release matches "' + spec + '"'));
   });
   const dir = tool("python", pkg + "-" + version2);
-  const exe = path46.join(dir, "python.exe");
+  const exe = path48.join(dir, "python.exe");
   if (!exists(exe)) {
     log("Downloading Python " + version2 + (pkg === "python2" ? " (Python 2, " : " (") + "~30 MB once) ...");
     await downloader.archive(
@@ -30588,32 +30809,32 @@ var installPython = async (pkg, spec) => {
       { locate: "python.exe", fileName: pkg + "." + version2 + ".zip" }
     );
   }
-  if (!exists(path46.join(dir, "Scripts", "pip.exe")) && !exists(path46.join(dir, "Scripts", "pip2.exe")))
+  if (!exists(path48.join(dir, "Scripts", "pip.exe")) && !exists(path48.join(dir, "Scripts", "pip2.exe")))
     await execAsync(exe, ["-m", "ensurepip", "--default-pip"], { stdio: "ignore" });
   return dir;
 };
-var shimDir = (dir) => duringSession() ? tool("shims", path46.basename(dir)) : tool("shims");
+var shimDir = (dir) => duringSession() ? tool("shims", path48.basename(dir)) : tool("shims");
 var shim = (folder, name, program, args = []) => {
   const fixed = [program, ...args];
-  fs37.writeFileSync(
-    path46.join(mkdirp(folder), name + ".cmd"),
+  fs39.writeFileSync(
+    path48.join(mkdirp(folder), name + ".cmd"),
     "@echo off\r\n" + fixed.map((a) => '"' + a + '"').join(" ") + " %*\r\n"
   );
   const sh = fixed.map((a) => "'" + a.replace(/\\/g, "/").replace(/'/g, "'\\''") + "'").join(" ");
-  fs37.writeFileSync(path46.join(folder, name), "#!/bin/sh\nexec " + sh + ' "$@"\n');
+  fs39.writeFileSync(path48.join(folder, name), "#!/bin/sh\nexec " + sh + ' "$@"\n');
 };
 var shimPair = (folder, version2, dir) => {
-  const python = path46.join(dir, "python.exe");
+  const python = path48.join(dir, "python.exe");
   shim(folder, "python" + version2, python);
   shim(folder, "pip" + version2, python, ["-m", "pip"]);
 };
 var pyLauncher = (folder, py3, py2) => {
-  const script = path46.join(mkdirp(folder), "py-launcher.py");
-  fs37.writeFileSync(
+  const script = path48.join(mkdirp(folder), "py-launcher.py");
+  fs39.writeFileSync(
     script,
     [
       "import subprocess, sys",
-      "PY3, PY2 = " + JSON.stringify(path46.join(py3, "python.exe")) + ", " + JSON.stringify(py2 ? path46.join(py2, "python.exe") : null),
+      "PY3, PY2 = " + JSON.stringify(path48.join(py3, "python.exe")) + ", " + JSON.stringify(py2 ? path48.join(py2, "python.exe") : null),
       "args = sys.argv[1:]",
       "exe = PY3",
       "if args and args[0].startswith('-2'):",
@@ -30625,7 +30846,7 @@ var pyLauncher = (folder, py3, py2) => {
       ""
     ].join("\n")
   );
-  shim(folder, "py", path46.join(py3, "python.exe"), [script]);
+  shim(folder, "py", path48.join(py3, "python.exe"), [script]);
 };
 async function setupPython(env, config2, versions) {
   if (dryRun) {
@@ -30635,10 +30856,10 @@ async function setupPython(env, config2, versions) {
   const py3 = await installPython("python", versions.python.spec);
   const shims = shimDir(py3);
   shimPair(shims, "3", py3);
-  env.prepend.push(py3, mkdirp(path46.join(py3, "Scripts")), shims);
+  env.prepend.push(py3, mkdirp(path48.join(py3, "Scripts")), shims);
   env.vars.PYTHONIOENCODING = "utf-8";
   env.summary.push(
-    "python: " + path46.basename(py3).replace("python-", "") + " (from " + versions.python.source + "; py works too)"
+    "python: " + path48.basename(py3).replace("python-", "") + " (from " + versions.python.source + "; py works too)"
   );
   if (!config2.python2) {
     pyLauncher(shims, py3, null);
@@ -30647,47 +30868,12 @@ async function setupPython(env, config2, versions) {
   const py2 = await installPython("python2", "2.7");
   shimPair(shims, "2", py2);
   pyLauncher(shims, py3, py2);
-  env.summary.push("python2: " + path46.basename(py2).replace("python2-", ""));
-}
-
-// src/guest/toolchains/languages/php.ts
-import fs39 from "node:fs";
-import path48 from "node:path";
-
-// src/guest/toolchains/native/vcruntime.ts
-import fs38 from "node:fs";
-import path47 from "node:path";
-var VC_REDIST = "https://aka.ms/vs/17/release/vc_redist.x64.exe";
-var MICROSOFT_SIGNER = "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US";
-var OK_EXIT_CODES = [0, 1638, 3010];
-var signerOf = (file3) => scriptOutput("get-signer.ps1", ["-Path", file3]).trim();
-async function setupVcRuntime(env, summary = true) {
-  if (dryRun) {
-    log("(dry run) would install the Visual C++ runtime");
-    return false;
-  }
-  const system322 = path47.join(process.env.WINDIR ?? "C:\\Windows", "System32");
-  const missing = !exists(path47.join(system322, "vcruntime140.dll")) || !exists(path47.join(system322, "msvcp140.dll"));
-  if (missing) {
-    const installer = tool("vcredist", "vc_redist.x64.exe");
-    if (!exists(installer)) {
-      log("Downloading the Visual C++ runtime (~25 MB once) ...");
-      await downloadFile(VC_REDIST, installer);
-    }
-    if (signerOf(installer) !== MICROSOFT_SIGNER) {
-      fs38.rmSync(installer, { force: true });
-      throw new Error("vc_redist.x64.exe is not signed by Microsoft; deleted it (it is downloaded again next boot)");
-    }
-    log("Installing the Visual C++ runtime ...");
-    const code = await spawnAsync(installer, ["/install", "/quiet", "/norestart"]);
-    if (!OK_EXIT_CODES.includes(code ?? -1) || !exists(path47.join(system322, "vcruntime140.dll")))
-      throw new Error("the Visual C++ runtime installer failed (exit " + code + ")");
-  }
-  if (summary) env.summary.push("vc++ runtime: installed");
-  return missing;
+  env.summary.push("python2: " + path48.basename(py2).replace("python2-", ""));
 }
 
 // src/guest/toolchains/languages/php.ts
+import fs40 from "node:fs";
+import path49 from "node:path";
 var PHP_EXTENSIONS = [
   "curl",
   "fileinfo",
@@ -30718,16 +30904,16 @@ var phpBuild = async (spec) => {
   return { version: release.version, ...build.zip };
 };
 var writePhpIni = (home) => {
-  const ini = path48.join(home, "php.ini");
-  if (exists(ini) || !exists(path48.join(home, "php.ini-development"))) return;
-  let text = fs39.readFileSync(path48.join(home, "php.ini-development"), "utf8").replace(/^;\s*extension_dir\s*=\s*"ext"/m, 'extension_dir = "' + path48.join(home, "ext") + '"');
-  for (const ext of PHP_EXTENSIONS.filter((e) => exists(path48.join(home, "ext", "php_" + e + ".dll"))))
+  const ini = path49.join(home, "php.ini");
+  if (exists(ini) || !exists(path49.join(home, "php.ini-development"))) return;
+  let text = fs40.readFileSync(path49.join(home, "php.ini-development"), "utf8").replace(/^;\s*extension_dir\s*=\s*"ext"/m, 'extension_dir = "' + path49.join(home, "ext") + '"');
+  for (const ext of PHP_EXTENSIONS.filter((e) => exists(path49.join(home, "ext", "php_" + e + ".dll"))))
     text = text.replace(new RegExp("^;(extension=" + ext + ")\\s*$", "m"), "$1");
-  fs39.writeFileSync(ini + ".tmp", text);
-  fs39.renameSync(ini + ".tmp", ini);
+  fs40.writeFileSync(ini + ".tmp", text);
+  fs40.renameSync(ini + ".tmp", ini);
 };
 var shim2 = (env, name, command) => {
-  fs39.writeFileSync(path48.join(mkdirp(tool("shims")), name + ".cmd"), "@echo off\r\n" + command + " %*\r\n");
+  fs40.writeFileSync(path49.join(mkdirp(tool("shims")), name + ".cmd"), "@echo off\r\n" + command + " %*\r\n");
   env.prepend.push(tool("shims"));
 };
 var setupComposer = async (env, php) => {
@@ -30739,7 +30925,7 @@ var setupComposer = async (env, php) => {
   }
   const composerHome = tool("composer-home");
   env.vars.COMPOSER_HOME = composerHome;
-  env.prepend.push(path48.join(composerHome, "vendor", "bin"));
+  env.prepend.push(path49.join(composerHome, "vendor", "bin"));
   shim2(env, "composer", '"' + php + '" "' + phar + '"');
   env.summary.push(
     "composer: " + (/\d+\.\d+\.\d+/.exec(execOutput(php, [phar, "--version", "--no-ansi"]))?.[0] ?? "installed")
@@ -30754,7 +30940,7 @@ async function setupPhp(env, config2) {
   await setupVcRuntime(env, false);
   const version2 = await resolveCached("php:" + wantedSpec.spec, async () => (await phpBuild(wantedSpec.spec)).version);
   const home = tool("php", version2);
-  if (!exists(path48.join(home, "php.exe"))) {
+  if (!exists(path49.join(home, "php.exe"))) {
     const build = await phpBuild(version2);
     log("Downloading PHP " + version2 + " (~30 MB once) ...");
     await downloader.archive("https://windows.php.net/downloads/releases/" + build.path, home, {
@@ -30766,11 +30952,11 @@ async function setupPhp(env, config2) {
   writePhpIni(home);
   env.prepend.push(home);
   env.summary.push("php: " + version2 + " (from " + wantedSpec.source + ")");
-  if (config2.composer) await setupComposer(env, path48.join(home, "php.exe"));
+  if (config2.composer) await setupComposer(env, path49.join(home, "php.exe"));
 }
 
 // src/guest/toolchains/languages/ruby.ts
-import path49 from "node:path";
+import path50 from "node:path";
 var RUBY_ASSET = /^rubyinstaller-(\d+\.\d+\.\d+)-(\d+)-x64\.7z$/;
 var buildNumber = (asset) => Number(RUBY_ASSET.exec(asset.name)?.[2] ?? 0);
 var rubyBuilds = async () => {
@@ -30798,7 +30984,7 @@ async function setupRuby(env, config2) {
     async () => pickPackageVersion([...(await rubyBuilds()).keys()], wantedSpec.spec) ?? Promise.reject(new Error('No RubyInstaller build matches "' + wantedSpec.spec + '"'))
   );
   const home = tool("ruby", version2);
-  if (!exists(path49.join(home, "bin", "ruby.exe"))) {
+  if (!exists(path50.join(home, "bin", "ruby.exe"))) {
     const asset = (await rubyBuilds()).get(version2);
     if (!asset) throw new Error("RubyInstaller " + version2 + " is no longer published");
     log("Downloading Ruby " + version2 + " (~100 MB once) ...");
@@ -30811,11 +30997,11 @@ async function setupRuby(env, config2) {
   }
   const gems = tool("ruby-gems", version2.split(".").slice(0, 2).join("."));
   Object.assign(env.vars, { GEM_HOME: gems, BUNDLE_USER_HOME: tool("bundle-home") });
-  env.prepend.push(path49.join(home, "bin"), path49.join(gems, "bin"));
+  env.prepend.push(path50.join(home, "bin"), path50.join(gems, "bin"));
   env.summary.push(
-    "ruby: " + versionOf(path49.join(home, "bin", "ruby.exe")) + " (from " + wantedSpec.source + "; gems with C extensions need MSYS2, not included)"
+    "ruby: " + versionOf(path50.join(home, "bin", "ruby.exe")) + " (from " + wantedSpec.source + "; gems with C extensions need MSYS2, not included)"
   );
-  const gem = path49.join(home, "bin", "gem.cmd");
+  const gem = path50.join(home, "bin", "gem.cmd");
   await installOnce(
     env,
     "gem@" + version2,
@@ -30827,9 +31013,9 @@ async function setupRuby(env, config2) {
 }
 
 // src/guest/toolchains/tools/vscode.ts
-import fs40 from "node:fs";
-import os7 from "node:os";
-import path50 from "node:path";
+import fs41 from "node:fs";
+import os8 from "node:os";
+import path51 from "node:path";
 import { spawn as spawn5 } from "node:child_process";
 
 // node_modules/jsonc-parser/lib/esm/impl/scanner.js
@@ -31628,12 +31814,12 @@ function parseTree(text, errors = [], options = ParseOptions.DEFAULT) {
   }
   return result;
 }
-function findNodeAtLocation(root, path77) {
+function findNodeAtLocation(root, path78) {
   if (!root) {
     return void 0;
   }
   let node2 = root;
-  for (let segment of path77) {
+  for (let segment of path78) {
     if (typeof segment === "string") {
       if (node2.type !== "object" || !Array.isArray(node2.children)) {
         return void 0;
@@ -31987,14 +32173,14 @@ function getNodeType(value) {
 
 // node_modules/jsonc-parser/lib/esm/impl/edit.js
 function setProperty(text, originalPath, value, options) {
-  const path77 = originalPath.slice();
+  const path78 = originalPath.slice();
   const errors = [];
   const root = parseTree(text, errors);
   let parent = void 0;
   let lastSegment = void 0;
-  while (path77.length > 0) {
-    lastSegment = path77.pop();
-    parent = findNodeAtLocation(root, path77);
+  while (path78.length > 0) {
+    lastSegment = path78.pop();
+    parent = findNodeAtLocation(root, path78);
     if (parent === void 0 && value !== void 0) {
       if (typeof lastSegment === "string") {
         value = { [lastSegment]: value };
@@ -32180,8 +32366,8 @@ var ParseErrorCode;
   ParseErrorCode2[ParseErrorCode2["InvalidEscapeCharacter"] = 15] = "InvalidEscapeCharacter";
   ParseErrorCode2[ParseErrorCode2["InvalidCharacter"] = 16] = "InvalidCharacter";
 })(ParseErrorCode || (ParseErrorCode = {}));
-function modify(text, path77, value, options) {
-  return setProperty(text, path77, value, options);
+function modify(text, path78, value, options) {
+  return setProperty(text, path78, value, options);
 }
 function applyEdits(text, edits) {
   let sortedEdits = edits.slice(0).sort((a, b) => {
@@ -32282,7 +32468,7 @@ function missingExtensions(wanted2, folders) {
 var VERSION_MARKER = ".agent-sandbox-version";
 var desktopShortcut = (exe) => {
   if (!isWin) return;
-  const link = path50.join(os7.homedir(), "Desktop", "Visual Studio Code.lnk");
+  const link = path51.join(os8.homedir(), "Desktop", "Visual Studio Code.lnk");
   runScriptWithJson("new-shortcuts.ps1", "ListFile", [
     { link, target: exe, arguments: '"' + (process.env.AGENT_WORKSPACE ?? "") + '"' }
   ]);
@@ -32290,16 +32476,16 @@ var desktopShortcut = (exe) => {
 var findIn = (dirs, ...names) => {
   for (const dir of dirs)
     for (const name of names) {
-      const file3 = path50.join(dir, name);
+      const file3 = path51.join(dir, name);
       if (exists(file3)) return file3;
     }
   return void 0;
 };
 var recommendedBy = (workspace2) => {
-  const file3 = path50.join(workspace2, ".vscode", "extensions.json");
+  const file3 = path51.join(workspace2, ".vscode", "extensions.json");
   try {
-    if (!exists(file3) || fs40.statSync(file3).size > 64 * 1024) return [];
-    const data = parse4(fs40.readFileSync(file3, "utf8"));
+    if (!exists(file3) || fs41.statSync(file3).size > 64 * 1024) return [];
+    const data = parse4(fs41.readFileSync(file3, "utf8"));
     return Array.isArray(data?.recommendations) ? data.recommendations.filter((r) => typeof r === "string" && EXTENSION_ID.test(r)).slice(0, 50) : [];
   } catch {
     return [];
@@ -32307,12 +32493,12 @@ var recommendedBy = (workspace2) => {
 };
 function configureVscode(tools, o) {
   const root = tool("vscode");
-  const code = path50.join(root, "bin", "code.cmd");
+  const code = path51.join(root, "bin", "code.cmd");
   if (dryRun) {
     log("(dry run) would set up VS Code for: " + o.toolchains.join(", "));
     return;
   }
-  if (!exists(path50.join(root, "Code.exe"))) return;
+  if (!exists(path51.join(root, "Code.exe"))) return;
   const dirs = [...tools.prepend, ...tools.append];
   const git = findIn([tool("git", "cmd"), ...dirs], "git.exe");
   const settings = vscodeSettings({
@@ -32327,14 +32513,14 @@ function configureVscode(tools, o) {
     node: findIn(dirs, "node.exe"),
     pwsh: findIn(dirs, "pwsh.exe"),
     git,
-    bash: git ? findIn([path50.join(path50.dirname(path50.dirname(git)), "bin")], "bash.exe") : void 0,
+    bash: git ? findIn([path51.join(path51.dirname(path51.dirname(git)), "bin")], "bash.exe") : void 0,
     php: findIn(dirs, "php.exe"),
     ruby: findIn(dirs, "ruby.exe"),
     deno: findIn(dirs, "deno.exe")
   });
   writeManagedSettings(
-    path50.join(root, "data", "user-data", "User", "settings.json"),
-    path50.join(root, "data", ".agent-sandbox-managed.json"),
+    path51.join(root, "data", "user-data", "User", "settings.json"),
+    path51.join(root, "data", ".agent-sandbox-managed.json"),
     settings
   );
   const wanted2 = vscodeExtensions({
@@ -32345,7 +32531,7 @@ function configureVscode(tools, o) {
   });
   let folders = [];
   try {
-    folders = fs40.readdirSync(path50.join(root, "data", "extensions"));
+    folders = fs41.readdirSync(path51.join(root, "data", "extensions"));
   } catch {
   }
   const missing = missingExtensions(wanted2, folders);
@@ -32353,19 +32539,19 @@ function configureVscode(tools, o) {
     "vscode: set up for " + (o.toolchains.join(", ") || "Node") + (missing.length ? "; installing " + missing.length + " extension(s) in the background" : "; extensions ready")
   );
   if (!missing.length) return;
-  const logFile2 = fs40.openSync(path50.join(logsDir, "vscode-extensions.log"), "a");
+  const logFile2 = fs41.openSync(path51.join(logsDir, "vscode-extensions.log"), "a");
   spawn5(SYSTEM.cmd(), ["/d", "/c", code, ...missing.flatMap((id) => ["--install-extension", id])], {
     detached: true,
     stdio: ["ignore", logFile2, logFile2],
     windowsHide: true
   }).unref();
-  fs40.closeSync(logFile2);
+  fs41.closeSync(logFile2);
 }
 var writeManagedSettings = (file3, managedFile, values) => {
-  let text = exists(file3) ? fs40.readFileSync(file3, "utf8") : "{}";
+  let text = exists(file3) ? fs41.readFileSync(file3, "utf8") : "{}";
   let before = [];
   try {
-    before = JSON.parse(fs40.readFileSync(managedFile, "utf8"));
+    before = JSON.parse(fs41.readFileSync(managedFile, "utf8"));
   } catch {
   }
   const format2 = { formattingOptions: { insertSpaces: true, tabSize: 2, eol: "\n" } };
@@ -32374,13 +32560,13 @@ var writeManagedSettings = (file3, managedFile, values) => {
       text = applyEdits(text, modify(text, [key], void 0, format2));
   }
   for (const [key, value] of Object.entries(values)) text = applyEdits(text, modify(text, [key], value, format2));
-  mkdirp(path50.dirname(file3));
-  fs40.writeFileSync(file3, text);
-  fs40.writeFileSync(managedFile, JSON.stringify(Object.keys(values)));
+  mkdirp(path51.dirname(file3));
+  fs41.writeFileSync(file3, text);
+  fs41.writeFileSync(managedFile, JSON.stringify(Object.keys(values)));
 };
 async function setupVscode(env, refresh) {
   const root = tool("vscode");
-  const exe = path50.join(root, "Code.exe");
+  const exe = path51.join(root, "Code.exe");
   if (dryRun) {
     log("(dry run) would provision VS Code");
     return;
@@ -32390,11 +32576,11 @@ async function setupVscode(env, refresh) {
       "https://update.code.visualstudio.com/api/update/win32-" + (arch === "arm64" ? "arm64" : "x64") + "-archive/stable/latest"
     );
     log("Downloading VS Code " + release.productVersion + " (~150 MB once) ...");
-    const keep = path50.join(root, "data");
+    const keep = path51.join(root, "data");
     const parked = root + "-data";
     if (exists(keep)) {
-      fs40.rmSync(parked, { recursive: true, force: true });
-      fs40.renameSync(keep, parked);
+      fs41.rmSync(parked, { recursive: true, force: true });
+      fs41.renameSync(keep, parked);
     }
     try {
       await downloader.archive(release.url, root, {
@@ -32402,26 +32588,26 @@ async function setupVscode(env, refresh) {
         locate: "Code.exe",
         fileName: "vscode.zip"
       });
-      fs40.writeFileSync(path50.join(root, VERSION_MARKER), release.productVersion);
+      fs41.writeFileSync(path51.join(root, VERSION_MARKER), release.productVersion);
     } finally {
       if (exists(parked)) {
         mkdirp(root);
-        fs40.rmSync(keep, { recursive: true, force: true });
-        fs40.renameSync(parked, keep);
+        fs41.rmSync(keep, { recursive: true, force: true });
+        fs41.renameSync(parked, keep);
       }
     }
   }
-  mkdirp(path50.join(root, "data"));
-  env.prepend.push(path50.join(root, "bin"));
+  mkdirp(path51.join(root, "data"));
+  env.prepend.push(path51.join(root, "bin"));
   desktopShortcut(exe);
-  const version2 = exists(path50.join(root, VERSION_MARKER)) ? fs40.readFileSync(path50.join(root, VERSION_MARKER), "utf8").trim() : "installed";
+  const version2 = exists(path51.join(root, VERSION_MARKER)) ? fs41.readFileSync(path51.join(root, VERSION_MARKER), "utf8").trim() : "installed";
   env.summary.push("vscode: " + version2 + " (portable; run code . or use the desktop shortcut)");
 }
 
 // src/guest/toolchains/native/rust-extras.ts
-import fs41 from "node:fs";
-import os8 from "node:os";
-import path51 from "node:path";
+import fs42 from "node:fs";
+import os9 from "node:os";
+import path52 from "node:path";
 
 // src/shared/memory/policy.ts
 function buildJobs(cpus, memoryGb) {
@@ -32440,41 +32626,41 @@ function cargoJobs(cpus, memoryGb, sessions) {
 // src/guest/toolchains/native/rust-extras.ts
 var cargoTarget = (targetDir) => {
   if (targetDir === "shared" || targetDir === "separate") return null;
-  if (targetDir === "local") return path51.join(localDir, "cargo-target");
+  if (targetDir === "local") return path52.join(localDir, "cargo-target");
   return targetDir;
 };
 function cargoShim(env, rust) {
-  const real = path51.join(tool("rust", "cargo", "bin"), "cargo.exe");
+  const real = path52.join(tool("rust", "cargo", "bin"), "cargo.exe");
   if (rust.targetDir !== "separate" || !exists(real)) return;
   const dir = mkdirp(tool("shims", "cargo"));
-  fs41.copyFileSync(ensureCompiled("cargoshim"), path51.join(dir, "cargo.exe"));
+  fs42.copyFileSync(ensureCompiled("cargoshim"), path52.join(dir, "cargo.exe"));
   env.prepend.unshift(dir);
   env.vars.AGENT_REAL_CARGO = real;
 }
 function linkGate(env, rust, host) {
   const gcc = tool("mingw", "mingw64", "bin", "gcc.exe");
   if (!host.endsWith("-pc-windows-gnu") || !exists(gcc)) return;
-  const gate = path51.join(mkdirp(tool("shims")), "linkgate.exe");
-  fs41.copyFileSync(ensureCompiled("linkgate"), gate);
-  const memoryGb = os8.totalmem() / 1024 ** 3;
+  const gate = path52.join(mkdirp(tool("shims")), "linkgate.exe");
+  fs42.copyFileSync(ensureCompiled("linkgate"), gate);
+  const memoryGb = os9.totalmem() / 1024 ** 3;
   const slots = rust.linkSlots === "auto" ? linkSlotsFor(memoryGb) : rust.linkSlots;
   env.vars.AGENT_LINK_SLOTS = String(slots);
   env.vars.AGENT_REAL_LINKER = gcc;
   env.vars.CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER = gate;
   const rustEnv = { ...process.env, RUSTUP_HOME: tool("rust", "rustup"), CARGO_HOME: tool("rust", "cargo") };
   const sysroot = rust.linker === "lld" ? execOutput(tool("rust", "cargo", "bin", "rustc.exe"), ["--print", "sysroot"], { env: rustEnv }) : "";
-  const lld = sysroot ? path51.join(sysroot, "lib", "rustlib", host, "bin", "gcc-ld") : "";
-  if (lld && exists(path51.join(lld, "ld.lld.exe"))) env.vars.AGENT_LLD_DIR = lld;
+  const lld = sysroot ? path52.join(sysroot, "lib", "rustlib", host, "bin", "gcc-ld") : "";
+  if (lld && exists(path52.join(lld, "ld.lld.exe"))) env.vars.AGENT_LLD_DIR = lld;
   env.summary.push(
     "rust linking: " + (env.vars.AGENT_LLD_DIR ? "lld" : "GNU ld") + ", at most " + env.vars.AGENT_LINK_SLOTS + " at once"
   );
 }
 function cargoDefaults(host) {
   const file3 = tool("rust", "cargo", "config.toml");
-  if (exists(file3) || !exists(path51.dirname(file3))) return;
-  const jobs = cargoJobs(os8.cpus().length, os8.totalmem() / 1024 ** 3, 1);
+  if (exists(file3) || !exists(path52.dirname(file3))) return;
+  const jobs = cargoJobs(os9.cpus().length, os9.totalmem() / 1024 ** 3, 1);
   const gnu = host.endsWith("-gnu");
-  fs41.writeFileSync(
+  fs42.writeFileSync(
     file3,
     [
       "# Written by windows-development-sandbox once; edit freely, it is never overwritten.",
@@ -32489,13 +32675,14 @@ function rustCaches(rust) {
   const target = cargoTarget(rust.targetDir);
   return {
     ...target ? { CARGO_TARGET_DIR: target } : {},
-    ...process.env.SCCACHE_DIR ? {} : { SCCACHE_DIR: path51.join(dataDir, "cache", "sccache") }
+    ...process.env.SCCACHE_DIR ? {} : { SCCACHE_DIR: path52.join(dataDir, "cache", "sccache") }
   };
 }
 function rustHost(config2) {
   if (config2.rust.host !== "auto") return config2.rust.host;
   const cpu = arch === "arm64" ? "aarch64" : "x86_64";
-  return cpu + (wanted(config2.msvc.enabled, "msvc") ? "-pc-windows-msvc" : "-pc-windows-gnu");
+  const msvc = wanted(config2.msvc.enabled, "msvc") || wanted(config2.unreal.enabled, "unreal");
+  return cpu + (msvc ? "-pc-windows-msvc" : "-pc-windows-gnu");
 }
 
 // src/guest/toolchains/languages/python-tools.ts
@@ -32515,6 +32702,7 @@ function plan(config2, versions, o) {
   const apps = Boolean(o.apps && (o.apps.install.length || Object.keys(o.apps.custom).length));
   const java = wanted(config2.java.enabled, "java");
   const python = wanted(config2.python.enabled, "python");
+  const unreal = wanted(config2.unreal.enabled, "unreal");
   return [
     {
       name: "Git",
@@ -32532,12 +32720,18 @@ function plan(config2, versions, o) {
       enabled: wanted(config2.cpp.enabled, "cpp") || wanted(config2.rust.enabled, "rust"),
       install: (env) => setupCpp(env, config2.cpp)
     },
-    { name: "MSVC", enabled: wanted(config2.msvc.enabled, "msvc"), install: (env) => setupMsvc(env, config2.msvc) },
+    // Unreal's Visual Studio brings MSVC and the real vswhere: the portable MSVC (and its stand-in vswhere) stays out.
+    { name: "Unreal", enabled: unreal, shared: true, install: (env) => setupUnreal(env, config2.unreal) },
+    {
+      name: "MSVC",
+      enabled: wanted(config2.msvc.enabled, "msvc") && !unreal,
+      install: (env) => setupMsvc(env, config2.msvc)
+    },
     // Rust links with MSVC (msvc host) or MinGW's gcc (GNU host): whichever it uses goes first.
     {
       name: "Rust",
       enabled: wanted(config2.rust.enabled, "rust"),
-      after: ["C/C++", "MSVC"],
+      after: ["C/C++", "MSVC", "Unreal"],
       install: async (env) => {
         await setupRust(env, { ...config2.rust, host: rustHost(config2) }, o.refresh);
         Object.assign(env.vars, rustCaches(config2.rust));
@@ -32752,25 +32946,25 @@ async function setupToolchains(config2, versions, options, run3 = {}) {
 }
 
 // src/guest/agents/agent-installer.ts
-import fs43 from "node:fs";
-import path56 from "node:path";
+import fs44 from "node:fs";
+import path57 from "node:path";
 
 // src/guest/setup/environment.ts
-import path55 from "node:path";
+import path56 from "node:path";
 
 // src/guest/agents/local-state.ts
-import fs42 from "node:fs";
-import path53 from "node:path";
+import fs43 from "node:fs";
+import path54 from "node:path";
 
 // src/guest/agents/agent-files.ts
-import path52 from "node:path";
+import path53 from "node:path";
 function agentPaths(toolsDir2, name, harness) {
-  const dir = path52.join(toolsDir2, "agents", name);
+  const dir = path53.join(toolsDir2, "agents", name);
   const exe = harness.hostExecutable ?? (harness.uvBin ? harness.uvBin + ".exe" : null);
   return {
     dir,
-    exe: exe ? path52.join(dir, exe) : null,
-    cmd: harness.npmBin ? path52.join(dir, harness.npmBin + ".cmd") : null
+    exe: exe ? path53.join(dir, exe) : null,
+    cmd: harness.npmBin ? path53.join(dir, harness.npmBin + ".cmd") : null
   };
 }
 function agentCommand(name, harness) {
@@ -32806,46 +33000,52 @@ function localStateEntries(agents2, stateDir2, localRoot2) {
     ([agent, harness]) => Object.entries(harness.localState ?? {}).map(([env, folder]) => ({
       agent,
       env,
-      store: path52.join(stateDir2, agent, folder),
-      local: path52.join(localRoot2, agent, folder),
+      store: path53.join(stateDir2, agent, folder),
+      local: path53.join(localRoot2, agent, folder),
       processes: [agentCommand(agent, harness) + ".exe"],
-      legacy: path52.join(stateDir2, agent)
+      legacy: path53.join(stateDir2, agent)
     }))
   );
 }
 function bootResetPaths(agents2, stateDir2) {
   return Object.entries(agents2).flatMap(
-    ([agent, harness]) => (harness.bootReset ?? []).map((rel) => ({ agent, path: path52.join(stateDir2, agent, rel) }))
+    ([agent, harness]) => (harness.bootReset ?? []).map((rel) => ({ agent, path: path53.join(stateDir2, agent, rel) }))
   );
 }
+function codexConfigWithoutSandbox(toml) {
+  const firstTable = toml.search(/^\s*\[/m);
+  const topLevel = firstTable < 0 ? toml : toml.slice(0, firstTable);
+  if (/^\s*sandbox_mode\s*=/m.test(topLevel)) return null;
+  return '# Set by the sandbox: Windows Sandbox already contains Codex, its own command sandbox would only slow it down.\nsandbox_mode = "danger-full-access"\n' + (toml ? "\n" + toml : "");
+}
 var isDatabaseFile = (name) => /\.(sqlite3?|db)(-wal|-shm)?$/i.test(name);
 var isCopyableDatabaseFile = (name) => isDatabaseFile(name) && !/-shm$/i.test(name);
 
 // src/guest/agents/local-state.ts
-var localRoot = () => path53.join(localDir, "agent-state");
+var localRoot = () => path54.join(localDir, "agent-state");
 function agentLocalStates() {
   return localStateEntries(session.agents ?? {}, stateDir, localRoot());
 }
 function localStateVars() {
   return Object.fromEntries(agentLocalStates().map((s) => [s.env, s.local]));
 }
-var databaseFiles = (dir, keep) => exists(dir) ? fs42.readdirSync(dir, { withFileTypes: true }).flatMap((e) => e.isFile() && keep(e.name) ? [e.name] : []) : [];
+var databaseFiles = (dir, keep) => exists(dir) ? fs43.readdirSync(dir, { withFileTypes: true }).flatMap((e) => e.isFile() && keep(e.name) ? [e.name] : []) : [];
 var copyFiles = (from, to, names) => {
-  fs42.rmSync(to, { recursive: true, force: true });
+  fs43.rmSync(to, { recursive: true, force: true });
   mkdirp(to);
-  for (const name of names) fs42.copyFileSync(path53.join(from, name), path53.join(to, name));
+  for (const name of names) fs43.copyFileSync(path54.join(from, name), path54.join(to, name));
 };
 var swapIn = (incoming, store2) => {
   const previous = store2 + ".previous";
-  fs42.rmSync(previous, { recursive: true, force: true });
-  if (exists(store2)) fs42.renameSync(store2, previous);
+  fs43.rmSync(previous, { recursive: true, force: true });
+  if (exists(store2)) fs43.renameSync(store2, previous);
   try {
-    fs42.renameSync(incoming, store2);
+    fs43.renameSync(incoming, store2);
   } catch (e) {
-    if (exists(previous)) fs42.renameSync(previous, store2);
+    if (exists(previous)) fs43.renameSync(previous, store2);
     throw e;
   }
-  fs42.rmSync(previous, { recursive: true, force: true });
+  fs43.rmSync(previous, { recursive: true, force: true });
 };
 function adoptLegacy(s) {
   if (exists(s.store)) return;
@@ -32856,30 +33056,39 @@ function adoptLegacy(s) {
   copyFiles(s.legacy, incoming, copyable);
   swapIn(incoming, s.store);
   const same = copyable.every(
-    (n) => fs42.statSync(path53.join(s.store, n)).size === fs42.statSync(path53.join(s.legacy, n)).size
+    (n) => fs43.statSync(path54.join(s.store, n)).size === fs43.statSync(path54.join(s.legacy, n)).size
   );
   if (!same) {
     warn(s.agent + ": the copied databases differ in size from the originals; the originals were kept.");
     return;
   }
-  for (const n of names) fs42.rmSync(path53.join(s.legacy, n), { force: true });
+  for (const n of names) fs43.rmSync(path54.join(s.legacy, n), { force: true });
   log(s.agent + ": moved " + copyable.length + " database file(s) to " + s.store + ".");
 }
 function resetMachineBound() {
   if (dryRun) return;
   for (const { agent, path: target } of bootResetPaths(session.agents ?? {}, stateDir)) {
     try {
-      const stat = fs42.lstatSync(target, { throwIfNoEntry: false });
+      const stat = fs43.lstatSync(target, { throwIfNoEntry: false });
       if (!stat || stat.isSymbolicLink()) continue;
-      fs42.rmSync(target, { recursive: true, force: true });
+      fs43.rmSync(target, { recursive: true, force: true });
       log(
-        agent + ": removed " + path53.relative(path53.join(stateDir, agent), target) + " (it only worked in the last sandbox)."
+        agent + ": removed " + path54.relative(path54.join(stateDir, agent), target) + " (it only worked in the last sandbox)."
       );
     } catch (e) {
       warn(agent + ": could not remove " + target + " (" + errMsg(e) + ").");
     }
   }
 }
+function codexWithoutInnerSandbox() {
+  if (dryRun || !session.agents?.codex) return;
+  const file3 = path54.join(stateDir, "codex", "config.toml");
+  const updated = codexConfigWithoutSandbox(exists(file3) ? fs43.readFileSync(file3, "utf8") : "");
+  if (updated === null) return;
+  mkdirp(path54.dirname(file3));
+  fs43.writeFileSync(file3, updated, "utf8");
+  log('codex: its own command sandbox is off (sandbox_mode = "danger-full-access" in config.toml).');
+}
 function restoreLocalState() {
   if (dryRun) return;
   for (const s of agentLocalStates()) {
@@ -32887,7 +33096,7 @@ function restoreLocalState() {
       adoptLegacy(s);
       mkdirp(s.local);
       const names = databaseFiles(s.store, isCopyableDatabaseFile);
-      for (const n of names) fs42.copyFileSync(path53.join(s.store, n), path53.join(s.local, n));
+      for (const n of names) fs43.copyFileSync(path54.join(s.store, n), path54.join(s.local, n));
       if (names.length) log(s.agent + ": databases restored to " + s.local + ".");
     } catch (e) {
       warn(s.agent + ": could not restore its databases (" + errMsg(e) + "); it starts with empty ones.");
@@ -32896,7 +33105,7 @@ function restoreLocalState() {
 }
 
 // src/guest/setup/path-plan.ts
-import path54 from "node:path";
+import path55 from "node:path";
 function pathKey(folder) {
   const slashes = folder.trim().replace(/^"|"$/g, "").replace(/\//g, "\\");
   return (slashes.length > 3 ? slashes.replace(/\\+$/, "") : slashes).toLowerCase();
@@ -32918,13 +33127,13 @@ function planPath(input2) {
 function isPinnedNodeDir(folder, nvmHome2) {
   const key = pathKey(folder);
   const home = pathKey(nvmHome2);
-  return key.startsWith(home + "\\") && /^v\d/.test(path54.win32.basename(key));
+  return key.startsWith(home + "\\") && /^v\d/.test(path55.win32.basename(key));
 }
 
 // src/guest/setup/environment.ts
 var LEGACY_HOMES = { CODEX_HOME: "codex", GEMINI_CLI_HOME: "gemini" };
 var agentHomes = () => Object.fromEntries(
-  Object.entries(session.agentHomes ?? LEGACY_HOMES).filter(([name]) => name !== "CLAUDE_CONFIG_DIR").map(([name, sub]) => [name, path55.join(stateDir, sub)])
+  Object.entries(session.agentHomes ?? LEGACY_HOMES).filter(([name]) => name !== "CLAUDE_CONFIG_DIR").map(([name, sub]) => [name, path56.join(stateDir, sub)])
 );
 var AGENT_VARS = [
   "CLAUDE_CONFIG_DIR",
@@ -32945,7 +33154,7 @@ function agentEnv(tools, target = { workspace, project: session.project, base: p
     CLAUDE_CONFIG_DIR: claudeDir,
     ...homes,
     ...localStateVars(),
-    npm_config_cache: path55.join(toolsDir, "npm-cache"),
+    npm_config_cache: path56.join(toolsDir, "npm-cache"),
     npm_config_update_notifier: "false",
     AGENT_WORKSPACE: target.workspace,
     AGENT_DATA: dataDir,
@@ -32963,9 +33172,9 @@ function agentEnv(tools, target = { workspace, project: session.project, base: p
     ...local.map((n) => env[n])
   ])
     mkdirp(dir);
-  const runners = [path55.join(toolsDir, "node"), path55.dirname(process.execPath)].map((d) => d.toLowerCase());
-  const base = (target.base.PATH ?? "").split(path55.delimiter).filter((d) => d && !runners.includes(d.toLowerCase()));
-  env.PATH = [.../* @__PURE__ */ new Set([...tools.prepend, ...base, ...tools.append])].join(path55.delimiter);
+  const runners = [path56.join(toolsDir, "node"), path56.dirname(process.execPath)].map((d) => d.toLowerCase());
+  const base = (target.base.PATH ?? "").split(path56.delimiter).filter((d) => d && !runners.includes(d.toLowerCase()));
+  env.PATH = [.../* @__PURE__ */ new Set([...tools.prepend, ...base, ...tools.append])].join(path56.delimiter);
   return env;
 }
 function persistEnvironment(env, toolVars2) {
@@ -32980,7 +33189,7 @@ function persistEnvironment(env, toolVars2) {
         entries: [env.PATH ?? "", ...installedAgentDirs()],
         exists,
         drop: (dir) => isPinnedNodeDir(dir, nvmHome())
-      }).join(path55.delimiter),
+      }).join(path56.delimiter),
       add: [],
       additive: false
     });
@@ -32997,7 +33206,7 @@ function addMachineEnvironment(vars, dirs, additive = false) {
     warn("Could not add to the environment: " + errMsg(e));
   }
 }
-var nvmHome = () => path55.join(toolsDir, "nvm");
+var nvmHome = () => path56.join(toolsDir, "nvm");
 function installedAgentDirs() {
   return Object.entries(session.agents ?? {}).flatMap(([name, harness]) => {
     const p = agentPaths(toolsDir, name, harness);
@@ -33029,7 +33238,7 @@ var agentPaths2 = (name, harness) => agentPaths(toolsDir, name, harness);
 async function installViaNpm(name, harness, dir, env) {
   if (!harness.npmPackage)
     throw new Error("No npmPackage configured for " + name + " and no host executable was available.");
-  const npmCli = path56.join(path56.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+  const npmCli = path57.join(path57.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
   const args = [npmCli, "install", "--global", "--prefix", dir, harness.npmPackage, "--no-fund", "--no-audit"];
   log("Installing " + harness.npmPackage + " (this can take a minute)...");
   if (dryRun) {
@@ -33040,7 +33249,7 @@ async function installViaNpm(name, harness, dir, env) {
   await execAsync(process.execPath, args, { env });
 }
 async function installViaUv(name, harness, dir, env) {
-  const uv = path56.join(toolsDir, "uv", "uv.exe");
+  const uv = path57.join(toolsDir, "uv", "uv.exe");
   log("Installing " + harness.uvPackage + " with uv (this can take a minute)...");
   if (dryRun) {
     log("(dry run) uv tool install " + harness.uvPackage);
@@ -33055,8 +33264,8 @@ async function installViaUv(name, harness, dir, env) {
   });
 }
 function putOnPath(dir, env) {
-  const parts2 = (env.PATH ?? "").split(path56.delimiter);
-  if (!parts2.some((p) => p.toLowerCase() === dir.toLowerCase())) env.PATH = [...parts2, dir].join(path56.delimiter);
+  const parts2 = (env.PATH ?? "").split(path57.delimiter);
+  if (!parts2.some((p) => p.toLowerCase() === dir.toLowerCase())) env.PATH = [...parts2, dir].join(path57.delimiter);
   addMachineEnvironment({}, [dir], true);
 }
 var AgentInstaller = class {
@@ -33097,9 +33306,9 @@ var AgentInstaller = class {
     }
     mkdirp(p.dir);
     if (this.sourceOf(name, harness) === "host") {
-      const source = path56.join(hostToolsDir, "agents", name, harness.hostExecutable);
+      const source = path57.join(hostToolsDir, "agents", name, harness.hostExecutable);
       if (exists(source) && p.exe) {
-        fs43.copyFileSync(source, p.exe);
+        fs44.copyFileSync(source, p.exe);
         log("Copied " + name + " from this PC: " + source);
         return;
       }
@@ -33114,44 +33323,44 @@ var AgentInstaller = class {
 var agents = new AgentInstaller();
 
 // src/guest/setup/shell-path.ts
-import fs44 from "node:fs";
-import path57 from "node:path";
+import fs45 from "node:fs";
+import path58 from "node:path";
 function installShellPath() {
   if (!isWin || dryRun || testMode) return;
-  const helper = path57.join(mkdirp(path57.join(localDir, "bin")), "pathsync.exe");
-  fs44.copyFileSync(ensureCompiled("pathsync"), helper);
+  const helper = path58.join(mkdirp(path58.join(localDir, "bin")), "pathsync.exe");
+  fs45.copyFileSync(ensureCompiled("pathsync"), helper);
   runScript("install-shell-path.ps1", [
     "-Helper",
     helper,
     "-PwshDir",
-    path57.join(toolsDir, "pwsh"),
+    path58.join(toolsDir, "pwsh"),
     "-GitRoot",
-    path57.join(toolsDir, "git")
+    path58.join(toolsDir, "git")
   ]);
 }
 
 // src/guest/setup/claude-mem.ts
-import fs45 from "node:fs";
-import os9 from "node:os";
-import path58 from "node:path";
+import fs46 from "node:fs";
+import os10 from "node:os";
+import path59 from "node:path";
 var claudeMemPaths = {
-  store: path58.join(stateDir, "claude-mem"),
-  local: path58.join(os9.homedir(), ".claude-mem")
+  store: path59.join(stateDir, "claude-mem"),
+  local: path59.join(os10.homedir(), ".claude-mem")
 };
 var claudeMemEnabled = () => session.claudeProfile.syncClaudeMem && !dryRun;
 function restoreClaudeMem() {
   if (!claudeMemEnabled()) return;
   const previous = claudeMemPaths.store + ".previous";
-  if (!exists(claudeMemPaths.store) && exists(previous)) fs45.renameSync(previous, claudeMemPaths.store);
+  if (!exists(claudeMemPaths.store) && exists(previous)) fs46.renameSync(previous, claudeMemPaths.store);
   const backups = claudeMemPaths.store + ".backups";
-  if (!looksLikeSqlite(path58.join(claudeMemPaths.store, "claude-mem.db")) || !exists(claudeMemPaths.store)) {
-    const good = (exists(backups) ? fs45.readdirSync(backups).sort().reverse() : []).find(
-      (b) => exists(path58.join(backups, b, "claude-mem.db")) && looksLikeSqlite(path58.join(backups, b, "claude-mem.db"))
+  if (!looksLikeSqlite(path59.join(claudeMemPaths.store, "claude-mem.db")) || !exists(claudeMemPaths.store)) {
+    const good = (exists(backups) ? fs46.readdirSync(backups).sort().reverse() : []).find(
+      (b) => exists(path59.join(backups, b, "claude-mem.db")) && looksLikeSqlite(path59.join(backups, b, "claude-mem.db"))
     );
     if (good) {
       if (exists(claudeMemPaths.store))
-        fs45.renameSync(claudeMemPaths.store, claudeMemPaths.store + ".damaged-" + Date.now());
-      fs45.cpSync(path58.join(backups, good), claudeMemPaths.store, { recursive: true });
+        fs46.renameSync(claudeMemPaths.store, claudeMemPaths.store + ".damaged-" + Date.now());
+      fs46.cpSync(path59.join(backups, good), claudeMemPaths.store, { recursive: true });
       warn(
         "claude-mem: the stored database was missing or damaged; restored the backup from " + new Date(Number(good)).toISOString() + "."
       );
@@ -33164,33 +33373,33 @@ function restoreClaudeMem() {
 var SQLITE_HEADER = "SQLite format 3\0";
 var looksLikeSqlite = (file3) => {
   if (!exists(file3)) return true;
-  const fd = fs45.openSync(file3, "r");
+  const fd = fs46.openSync(file3, "r");
   try {
     const head = Buffer.alloc(16);
-    return fs45.readSync(fd, head, 0, 16, 0) === 16 && head.toString("latin1") === SQLITE_HEADER;
+    return fs46.readSync(fd, head, 0, 16, 0) === 16 && head.toString("latin1") === SQLITE_HEADER;
   } finally {
-    fs45.closeSync(fd);
+    fs46.closeSync(fd);
   }
 };
 var BACKUP_EVERY_MS = 6 * 3600 * 1e3;
 
 // src/guest/setup/claude-profile.ts
-import fs46 from "node:fs";
-import path59 from "node:path";
+import fs47 from "node:fs";
+import path60 from "node:path";
 var KEEP_SANDBOX_COPY = [".claude.json", ".credentials.json"];
 var fixPluginPaths = (hostConfigDir) => {
-  const plugins = path59.join(claudeDir, "plugins");
+  const plugins = path60.join(claudeDir, "plugins");
   if (!hostConfigDir || !exists(plugins)) return;
-  for (const name of fs46.readdirSync(plugins).filter((f) => f.endsWith(".json"))) {
-    const file3 = path59.join(plugins, name);
-    const text = fs46.readFileSync(file3, "utf8");
+  for (const name of fs47.readdirSync(plugins).filter((f) => f.endsWith(".json"))) {
+    const file3 = path60.join(plugins, name);
+    const text = fs47.readFileSync(file3, "utf8");
     const fixed = translatePaths(text, hostConfigDir, claudeDir);
-    if (fixed !== text) fs46.writeFileSync(file3, fixed, "utf8");
+    if (fixed !== text) fs47.writeFileSync(file3, fixed, "utf8");
   }
 };
 var readState2 = (file3) => {
   try {
-    return JSON.parse(fs46.readFileSync(file3, "utf8").replace(/^\uFEFF/, ""));
+    return JSON.parse(fs47.readFileSync(file3, "utf8").replace(/^\uFEFF/, ""));
   } catch {
     return null;
   }
@@ -33221,14 +33430,14 @@ function syncClaudeProfile(credentials) {
     log("No Claude settings were staged from this PC.");
     return;
   }
-  const source = path59.join(launchDir, "claude-profile");
+  const source = path60.join(launchDir, "claude-profile");
   mkdirp(claudeDir);
   for (const name of profile.items) {
-    const from = path59.join(source, name);
-    const to = path59.join(claudeDir, name);
+    const from = path60.join(source, name);
+    const to = path60.join(claudeDir, name);
     if (name === ".credentials.json") {
       if (credentials && !exists(to)) {
-        fs46.writeFileSync(to, credentials, "utf8");
+        fs47.writeFileSync(to, credentials, "utf8");
         log("Claude settings: copied " + name + " from this PC");
       } else log("Claude settings: kept the sandbox's " + name);
       continue;
@@ -33238,14 +33447,14 @@ function syncClaudeProfile(credentials) {
       log("Claude settings: kept the sandbox's " + name);
       continue;
     }
-    if (fs46.statSync(from).isDirectory()) safeRemove(to, claudeDir);
-    fs46.cpSync(from, to, { recursive: true, force: true });
+    if (fs47.statSync(from).isDirectory()) safeRemove(to, claudeDir);
+    fs47.cpSync(from, to, { recursive: true, force: true });
     log("Claude settings: copied " + name + " from this PC");
   }
   fixPluginPaths(profile.hostConfigDir);
   const mcp = mergeMcpServers(
-    path59.join(source, ".claude.json"),
-    path59.join(claudeDir, ".claude.json"),
+    path60.join(source, ".claude.json"),
+    path60.join(claudeDir, ".claude.json"),
     session.workspaceHost,
     workspace
   );
@@ -33254,11 +33463,11 @@ function syncClaudeProfile(credentials) {
 }
 
 // src/guest/setup/hooks.ts
-import fs47 from "node:fs";
-import path60 from "node:path";
+import fs48 from "node:fs";
+import path61 from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 var commandFor = (file3) => {
-  const ext = path60.extname(file3).toLowerCase();
+  const ext = path61.extname(file3).toLowerCase();
   if (ext === ".mjs" || ext === ".js") return [process.execPath, [file3]];
   if (!isWin) return null;
   if (ext === ".ps1")
@@ -33266,12 +33475,12 @@ var commandFor = (file3) => {
   if (ext === ".cmd" || ext === ".bat") return [SYSTEM.cmd(), ["/d", "/c", file3]];
   return null;
 };
-var BOOT = { root: path60.join(launchDir, "hooks"), cwd: workspace };
+var BOOT = { root: path61.join(launchDir, "hooks"), cwd: workspace };
 var hooksOf = (stage, target) => {
-  const dir = path60.join(target.root, stage);
+  const dir = path61.join(target.root, stage);
   if (!exists(dir)) return [];
-  return fs47.readdirSync(dir).sort().flatMap((name) => {
-    const command = commandFor(path60.join(dir, name));
+  return fs48.readdirSync(dir).sort().flatMap((name) => {
+    const command = commandFor(path61.join(dir, name));
     return command ? [{ name, command }] : [];
   });
 };
@@ -33289,8 +33498,8 @@ function runHooks(stage, env, target = BOOT) {
 }
 
 // src/guest/network/allow-only.ts
-import fs49 from "node:fs";
-import path62 from "node:path";
+import fs50 from "node:fs";
+import path63 from "node:path";
 import { spawn as spawn6, spawnSync as spawnSync6 } from "node:child_process";
 
 // src/shared/network/policy.ts
@@ -33385,8 +33594,8 @@ var PROXY_PORT = 38080;
 
 // src/guest/network/firewall.ts
 import dns from "node:dns";
-import fs48 from "node:fs";
-import path61 from "node:path";
+import fs49 from "node:fs";
+import path62 from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 
 // src/shared/network/firewall-rules.ts
@@ -33577,7 +33786,7 @@ function networkProblems() {
 function longPath(file3) {
   if (!hasShortName(file3)) return file3;
   try {
-    return fs48.realpathSync.native(file3);
+    return fs49.realpathSync.native(file3);
   } catch {
     return file3;
   }
@@ -33676,12 +33885,12 @@ async function applyNetworkPolicy(ptyHostExe) {
   return "blocked";
 }
 var FORWARD_RULE = "AgentSandbox-Forward";
-var HOSTS_FILE = path61.join(process.env.WINDIR ?? "C:\\Windows", "System32", "drivers", "etc", "hosts");
+var HOSTS_FILE = path62.join(process.env.WINDIR ?? "C:\\Windows", "System32", "drivers", "etc", "hosts");
 var applyBlockedHosts = () => {
   const hosts = session.network.blockHosts ?? [];
   if (!hosts.length) return;
-  const text = fs48.existsSync(HOSTS_FILE) ? fs48.readFileSync(HOSTS_FILE, "utf8") : "";
-  fs48.writeFileSync(HOSTS_FILE, withBlockedHosts(text, hosts));
+  const text = fs49.existsSync(HOSTS_FILE) ? fs49.readFileSync(HOSTS_FILE, "utf8") : "";
+  fs49.writeFileSync(HOSTS_FILE, withBlockedHosts(text, hosts));
   log("Blocked hosts (network.blockHosts): " + hosts.join(", "));
 };
 var applyDns = () => {
@@ -33736,11 +33945,11 @@ async function applyAllowOnly() {
     log("(dry run) would allow only: " + hosts.join(", "));
     return false;
   }
-  const exe = path62.join(toolsDir, "netproxy", "sbx-netproxy.exe");
-  fs49.mkdirSync(path62.dirname(exe), { recursive: true });
-  if (!fs49.existsSync(exe) || fs49.statSync(exe).size !== fs49.statSync(process.execPath).size)
-    fs49.copyFileSync(process.execPath, exe);
-  spawn6(exe, [path62.join(launchDir, "runtime", "netproxy.js")], {
+  const exe = path63.join(toolsDir, "netproxy", "sbx-netproxy.exe");
+  fs50.mkdirSync(path63.dirname(exe), { recursive: true });
+  if (!fs50.existsSync(exe) || fs50.statSync(exe).size !== fs50.statSync(process.execPath).size)
+    fs50.copyFileSync(process.execPath, exe);
+  spawn6(exe, [path63.join(launchDir, "runtime", "netproxy.js")], {
     detached: true,
     stdio: "ignore",
     windowsHide: true
@@ -33784,8 +33993,8 @@ async function applyAllowOnly() {
 }
 
 // src/guest/setup/managed-policy.ts
-import fs50 from "node:fs";
-import path63 from "node:path";
+import fs51 from "node:fs";
+import path64 from "node:path";
 
 // src/guest/setup/git-rules.ts
 var SHELLS = ["Bash", "PowerShell"];
@@ -33842,24 +34051,24 @@ function gitDenyRules(access) {
 
 // src/guest/setup/managed-policy.ts
 function managedSettingsFile() {
-  return path63.join(path63.dirname(managedClaudeMd()), "managed-settings.json");
+  return path64.join(path64.dirname(managedClaudeMd()), "managed-settings.json");
 }
 function writeManagedSettings2(access, headroom = null) {
   const file3 = managedSettingsFile();
   const rtk = installedRtk();
   const settings = claudeManagedSettings(gitDenyRules(access), rtk, headroom);
   if (!settings) {
-    fs50.rmSync(file3, { force: true });
+    fs51.rmSync(file3, { force: true });
     return;
   }
-  fs50.mkdirSync(path63.dirname(file3), { recursive: true });
-  fs50.writeFileSync(file3, JSON.stringify(settings, null, 2) + "\n", "utf8");
+  fs51.mkdirSync(path64.dirname(file3), { recursive: true });
+  fs51.writeFileSync(file3, JSON.stringify(settings, null, 2) + "\n", "utf8");
   if (rtk) log("rtk: Claude Code's Bash commands go through it (hook in " + file3 + ")");
 }
 
 // src/guest/setup/addon-mcp.ts
-import fs51 from "node:fs";
-import path64 from "node:path";
+import fs52 from "node:fs";
+import path65 from "node:path";
 var ADDON_MCP_NAMES = APPS.flatMap((a) => a.mcp ? [a.mcp.name] : []);
 function writeAddonMcpServers() {
   const servers = {};
@@ -33867,11 +34076,11 @@ function writeAddonMcpServers() {
     const mcp = APPS.find((a) => a.id === id)?.mcp;
     if (mcp) servers[mcp.name] = addonMcpServer(folder, mcp);
   }
-  const file3 = path64.join(claudeDir, ".claude.json");
+  const file3 = path65.join(claudeDir, ".claude.json");
   let state = {};
-  if (fs51.existsSync(file3)) {
+  if (fs52.existsSync(file3)) {
     try {
-      const text = fs51.readFileSync(file3, "utf8");
+      const text = fs52.readFileSync(file3, "utf8");
       state = JSON.parse(text.charCodeAt(0) === 65279 ? text.slice(1) : text);
     } catch {
       warn("Claude Code MCP servers from Apps: " + file3 + " is not valid JSON, left as it is");
@@ -33883,7 +34092,7 @@ function writeAddonMcpServers() {
   const before = current && typeof current === "object" && !Array.isArray(current) ? current : {};
   const after = withAddonMcpServers(before, servers, ADDON_MCP_NAMES);
   if (JSON.stringify(before) !== JSON.stringify(after)) {
-    fs51.mkdirSync(claudeDir, { recursive: true });
+    fs52.mkdirSync(claudeDir, { recursive: true });
     writeJsonAtomic(file3, { ...state, mcpServers: after });
   }
   const names = Object.keys(servers);
@@ -33892,11 +34101,11 @@ function writeAddonMcpServers() {
 }
 
 // src/guest/setup/headroom.ts
-import fs52 from "node:fs";
+import fs53 from "node:fs";
 import http from "node:http";
-import path65 from "node:path";
+import path66 from "node:path";
 import { spawn as spawn7 } from "node:child_process";
-var HEADROOM_LOG = path65.join(logsDir, "headroom.log");
+var HEADROOM_LOG = path66.join(logsDir, "headroom.log");
 function answersAsHeadroom(port) {
   return new Promise((resolve2) => {
     const req = http.get({ host: "127.0.0.1", port, path: "/livez", timeout: 3e3 }, (res) => {
@@ -33920,14 +34129,14 @@ async function startHeadroom(env) {
   }
   const port = HEADROOM_PORT;
   if (!await portOpen(port)) {
-    const out = fs52.openSync(HEADROOM_LOG, "a");
+    const out = fs53.openSync(HEADROOM_LOG, "a");
     spawn7(exe, headroomArgs(port), {
       detached: true,
       stdio: ["ignore", out, out],
       windowsHide: true,
       env: headroomEnv(env)
     }).unref();
-    fs52.closeSync(out);
+    fs53.closeSync(out);
     if (!await waitForPort(port, 90))
       throw new Error("the Headroom proxy did not start on port " + port + "; see " + HEADROOM_LOG);
   }
@@ -33938,30 +34147,41 @@ async function startHeadroom(env) {
 }
 
 // src/guest/setup/desktop.ts
-import fs53 from "node:fs";
-import os10 from "node:os";
-import path66 from "node:path";
+import fs54 from "node:fs";
+import os11 from "node:os";
+import path67 from "node:path";
 function applyPersonalization() {
-  const dir = path66.join(launchDir, "personalize");
+  const dir = path67.join(launchDir, "personalize");
   if (!session.personalization || !exists(dir) || dryRun || !isWin) return;
-  exec(SYSTEM.reg(), ["import", path66.join(dir, "personalize.reg")], { stdio: "ignore" });
-  const wallpaper = fs53.readdirSync(dir).find((f) => f.startsWith("wallpaper"));
-  const local = wallpaper ? path66.join(mkdirp(path66.join(os10.homedir(), "Pictures")), wallpaper) : null;
-  if (wallpaper && local) fs53.copyFileSync(path66.join(dir, wallpaper), local);
+  exec(SYSTEM.reg(), ["import", path67.join(dir, "personalize.reg")], { stdio: "ignore" });
+  const wallpaper = fs54.readdirSync(dir).find((f) => f.startsWith("wallpaper"));
+  const local = wallpaper ? path67.join(mkdirp(path67.join(os11.homedir(), "Pictures")), wallpaper) : null;
+  if (wallpaper && local) fs54.copyFileSync(path67.join(dir, wallpaper), local);
   runScript("set-desktop.ps1", local ? ["-Wallpaper", local] : []);
   log("Desktop personalisation applied from this PC.");
 }
 
+// src/guest/setup/browser-gpu.ts
+var POLICY_KEYS = ["HKLM\\SOFTWARE\\Policies\\Microsoft\\Edge", "HKLM\\SOFTWARE\\Policies\\Google\\Chrome"];
+function keepBrowsersOffGpu() {
+  if (dryRun || !isWin) return;
+  for (const key of POLICY_KEYS)
+    exec(SYSTEM.reg(), ["add", key, "/v", "HardwareAccelerationModeEnabled", "/t", "REG_DWORD", "/d", "0", "/f"], {
+      stdio: "ignore"
+    });
+  log("Browsers draw without the GPU (Edge and Chrome policy).");
+}
+
 // src/guest/setup/git-identity.ts
-import fs54 from "node:fs";
-import os11 from "node:os";
-import path67 from "node:path";
+import fs55 from "node:fs";
+import os12 from "node:os";
+import path68 from "node:path";
 import { spawnSync as spawnSync7 } from "node:child_process";
 function setupGitConfig(env) {
   if (dryRun) return;
-  const source = path67.join(launchDir, "home", ".gitconfig");
-  if (exists(source)) fs54.copyFileSync(source, path67.join(os11.homedir(), ".gitconfig"));
-  const git = path67.join(toolsDir, "git", "cmd", "git.exe");
+  const source = path68.join(launchDir, "home", ".gitconfig");
+  if (exists(source)) fs55.copyFileSync(source, path68.join(os12.homedir(), ".gitconfig"));
+  const git = path68.join(toolsDir, "git", "cmd", "git.exe");
   if (!exists(git)) return;
   const { GIT_DIR: _gitDir, ...rest } = env;
   spawnSync7(git, ["config", "--global", "--add", "safe.directory", "*"], {
@@ -33974,7 +34194,7 @@ function setupGitConfig(env) {
 }
 
 // src/guest/setup/github-token.ts
-import fs55 from "node:fs";
+import fs56 from "node:fs";
 import { spawnSync as spawnSync8 } from "node:child_process";
 
 // src/shared/github/token.ts
@@ -34020,7 +34240,7 @@ function ghOutputText(text, token) {
 var GH_TIMEOUT_MS = 6e4;
 function prepareGithubFolder(token) {
   const dir = deliveredGhConfigDir();
-  fs55.rmSync(dir, { recursive: true, force: true });
+  fs56.rmSync(dir, { recursive: true, force: true });
   if (!token) return false;
   mkdirp(dir);
   return true;
@@ -34048,7 +34268,7 @@ function loginGithub(token, env) {
   const gh2 = ghExePath();
   const dir = deliveredGhConfigDir();
   if (!exists(gh2) || env.GH_CONFIG_DIR !== dir) {
-    fs55.rmSync(dir, { recursive: true, force: true });
+    fs56.rmSync(dir, { recursive: true, force: true });
     log("A GitHub token arrived, but gh is not set up in this sandbox (toolchains.cli.gh), so it is not used.");
     return;
   }
@@ -34056,7 +34276,7 @@ function loginGithub(token, env) {
     runGh(ghLoginCommand(gh2, dir, token, env), token, "gh auth login");
     runGh(ghSetupGitCommand(gh2, dir, env), token, "gh auth setup-git");
   } catch (e) {
-    fs55.rmSync(dir, { recursive: true, force: true });
+    fs56.rmSync(dir, { recursive: true, force: true });
     env.GH_CONFIG_DIR = mkdirp(ghConfigDir());
     addMachineEnvironment({ GH_CONFIG_DIR: env.GH_CONFIG_DIR }, []);
     throw e;
@@ -34070,35 +34290,35 @@ function ensurePtyHost() {
 }
 
 // src/guest/toolchains/leftovers.ts
-import fs56 from "node:fs";
-import path68 from "node:path";
+import fs57 from "node:fs";
+import path69 from "node:path";
 var STAGING = /\.staging-[0-9a-f]+$/i;
 var entries2 = (dir) => {
   try {
-    return fs56.readdirSync(dir, { withFileTypes: true });
+    return fs57.readdirSync(dir, { withFileTypes: true });
   } catch {
     return [];
   }
 };
 function pruneToolLeftovers() {
-  for (const legacy of ["ptyhost", "gitshim"]) safeRemove(path68.join(toolsDir, legacy), toolsDir);
+  for (const legacy of ["ptyhost", "gitshim"]) safeRemove(path69.join(toolsDir, legacy), toolsDir);
   for (const top of entries2(toolsDir)) {
-    const dir = path68.join(toolsDir, top.name);
+    const dir = path69.join(toolsDir, top.name);
     if (STAGING.test(top.name)) safeRemove(dir, toolsDir);
     else if (top.isDirectory())
-      for (const sub of entries2(dir).filter((e) => STAGING.test(e.name))) safeRemove(path68.join(dir, sub.name), dir);
+      for (const sub of entries2(dir).filter((e) => STAGING.test(e.name))) safeRemove(path69.join(dir, sub.name), dir);
   }
 }
 
 // src/guest/audit/process-audit.ts
-import path69 from "node:path";
+import path70 from "node:path";
 import { spawnSync as spawnSync9 } from "node:child_process";
 var PROCESS_CREATION = "{0CCE922B-69AE-11D9-BED3-505054503030}";
 var auditOn = () => Boolean(session.auditProcesses) && isWin && !dryRun;
 function enableProcessAudit() {
   if (!auditOn()) return;
   spawnSync9(
-    path69.join(process.env.WINDIR ?? "C:\\Windows", "System32", "auditpol.exe"),
+    path70.join(process.env.WINDIR ?? "C:\\Windows", "System32", "auditpol.exe"),
     ["/set", "/subcategory:" + PROCESS_CREATION, "/success:enable"],
     { windowsHide: true, stdio: "ignore" }
   );
@@ -34122,10 +34342,10 @@ function enableProcessAudit() {
 
 // src/guest/vpn/vpn.ts
 import dns2 from "node:dns";
-import fs60 from "node:fs";
+import fs61 from "node:fs";
 import net3 from "node:net";
-import os14 from "node:os";
-import path73 from "node:path";
+import os15 from "node:os";
+import path74 from "node:path";
 
 // src/shared/vpn/ovpn.ts
 var PROGRAM_DIRECTIVES = [
@@ -34648,8 +34868,8 @@ function tunnelAddressFromLog(log2) {
 
 // src/guest/vpn/openvpn.ts
 import crypto4 from "node:crypto";
-import fs57 from "node:fs";
-import path70 from "node:path";
+import fs58 from "node:fs";
+import path71 from "node:path";
 
 // src/shared/vpn/download.ts
 var OPENVPN_MSI = {
@@ -34679,7 +34899,7 @@ var WIREGUARD_MSI = {
 
 // src/guest/vpn/openvpn.ts
 function openvpnExe(env = process.env) {
-  return path70.join(env.ProgramFiles ?? "C:\\Program Files", "OpenVPN", "bin", "openvpn.exe");
+  return path71.join(env.ProgramFiles ?? "C:\\Program Files", "OpenVPN", "bin", "openvpn.exe");
 }
 function openvpnDownload(arch2 = process.arch) {
   const entry = arch2 === "arm64" ? OPENVPN_MSI.arm64 : OPENVPN_MSI.x64;
@@ -34690,20 +34910,20 @@ function repairServiceQueries() {
   if (did === "removed") log("VPN: repaired the Windows service queries installers use (a Windows Sandbox gap).");
   else if (did !== "absent" && did !== "kept") warn("VPN: could not check the Windows service queries installers use.");
 }
-var hasHash = (file3, sha256) => crypto4.createHash("sha256").update(fs57.readFileSync(file3)).digest("hex") === sha256;
+var hasHash = (file3, sha256) => crypto4.createHash("sha256").update(fs58.readFileSync(file3)).digest("hex") === sha256;
 async function ensureOpenVpn() {
   const exe = openvpnExe();
   if (!isWin || dryRun) return exe;
   if (exists(exe)) return exe;
   const dl = openvpnDownload();
-  const msi = path70.join(mkdirp(path70.join(toolsDir, "downloads")), dl.file);
+  const msi = path71.join(mkdirp(path71.join(toolsDir, "downloads")), dl.file);
   if (!exists(msi) || !hasHash(msi, dl.sha256)) {
     log("VPN: downloading OpenVPN " + OPENVPN_MSI.version + " (about 6 MB)");
     await downloader.file(dl.url, msi, dl.sha256);
   }
   repairServiceQueries();
   log("VPN: installing OpenVPN");
-  const logFile2 = path70.join(toolsDir, "downloads", "openvpn-install.log");
+  const logFile2 = path71.join(toolsDir, "downloads", "openvpn-install.log");
   const code = await spawnAsync(SYSTEM.msiexec(), ["/i", msi, "/qn", "/norestart", "/l*v", logFile2], {
     stdio: "ignore"
   });
@@ -34715,9 +34935,9 @@ async function ensureOpenVpn() {
 
 // src/guest/vpn/tunnel.ts
 import { spawn as spawn8 } from "node:child_process";
-import fs58 from "node:fs";
-import os12 from "node:os";
-import path71 from "node:path";
+import fs59 from "node:fs";
+import os13 from "node:os";
+import path72 from "node:path";
 var DONE = "Initialization Sequence Completed";
 function failureReason(text) {
   if (/AUTH_FAILED/i.test(text))
@@ -34733,17 +34953,17 @@ function failureReason(text) {
 }
 var tail = (text, lines = 12) => text.trim().split(/\r?\n/).slice(-lines).join("\n");
 async function startTunnel(o) {
-  const dir = fs58.mkdtempSync(path71.join(os12.tmpdir(), "sbx-vpn-"));
-  const auth = path71.join(dir, "login.txt");
-  const logFile2 = path71.join(dir, "openvpn.log");
+  const dir = fs59.mkdtempSync(path72.join(os13.tmpdir(), "sbx-vpn-"));
+  const auth = path72.join(dir, "login.txt");
+  const logFile2 = path72.join(dir, "openvpn.log");
   const keepLog = () => {
     try {
-      fs58.mkdirSync(logsDir, { recursive: true });
-      fs58.copyFileSync(logFile2, path71.join(logsDir, "openvpn.log"));
+      fs59.mkdirSync(logsDir, { recursive: true });
+      fs59.copyFileSync(logFile2, path72.join(logsDir, "openvpn.log"));
     } catch {
     }
   };
-  fs58.writeFileSync(auth, o.username + "\r\n" + o.password + "\r\n", "utf8");
+  fs59.writeFileSync(auth, o.username + "\r\n" + o.password + "\r\n", "utf8");
   try {
     const child = spawn8(
       o.exe,
@@ -34761,7 +34981,7 @@ async function startTunnel(o) {
     child.unref();
     const deadline = Date.now() + (o.timeoutMs ?? 9e4);
     for (; ; ) {
-      const text = fs58.existsSync(logFile2) ? fs58.readFileSync(logFile2, "utf8") : "";
+      const text = fs59.existsSync(logFile2) ? fs59.readFileSync(logFile2, "utf8") : "";
       if (text.includes(DONE)) {
         keepLog();
         const tunnelIp = tunnelAddressFromLog(text) ?? void 0;
@@ -34781,41 +35001,41 @@ async function startTunnel(o) {
       await new Promise((r) => setTimeout(r, 500));
     }
   } finally {
-    fs58.rmSync(auth, { force: true });
+    fs59.rmSync(auth, { force: true });
   }
 }
 
 // src/guest/vpn/wireguard.ts
 import { execFile } from "node:child_process";
 import crypto5 from "node:crypto";
-import fs59 from "node:fs";
-import os13 from "node:os";
-import path72 from "node:path";
+import fs60 from "node:fs";
+import os14 from "node:os";
+import path73 from "node:path";
 var WIREGUARD_TUNNEL = "sandbox";
 function wireguardDir(env = process.env) {
-  return path72.join(env.ProgramFiles ?? "C:\\Program Files", "WireGuard");
+  return path73.join(env.ProgramFiles ?? "C:\\Program Files", "WireGuard");
 }
 function wireguardExe(env = process.env) {
-  return path72.join(wireguardDir(env), "wireguard.exe");
+  return path73.join(wireguardDir(env), "wireguard.exe");
 }
 function wireguardDownload(arch2 = process.arch) {
   const entry = arch2 === "arm64" ? WIREGUARD_MSI.arm64 : WIREGUARD_MSI.x64;
   return { ...entry, url: WIREGUARD_MSI.base + entry.file };
 }
-var hasHash2 = (file3, sha256) => crypto5.createHash("sha256").update(fs59.readFileSync(file3)).digest("hex") === sha256;
+var hasHash2 = (file3, sha256) => crypto5.createHash("sha256").update(fs60.readFileSync(file3)).digest("hex") === sha256;
 async function ensureWireguard() {
   const exe = wireguardExe();
   if (!isWin || dryRun) return exe;
   if (exists(exe)) return exe;
   const dl = wireguardDownload();
-  const msi = path72.join(mkdirp(path72.join(toolsDir, "downloads")), dl.file);
+  const msi = path73.join(mkdirp(path73.join(toolsDir, "downloads")), dl.file);
   if (!exists(msi) || !hasHash2(msi, dl.sha256)) {
     log("VPN: downloading WireGuard " + WIREGUARD_MSI.version + " (about 3 MB)");
     await downloader.file(dl.url, msi, dl.sha256);
   }
   repairServiceQueries();
   log("VPN: installing WireGuard");
-  const logFile2 = path72.join(toolsDir, "downloads", "wireguard-install.log");
+  const logFile2 = path73.join(toolsDir, "downloads", "wireguard-install.log");
   const code = await spawnAsync(
     SYSTEM.msiexec(),
     ["/i", msi, "/qn", "/norestart", "DO_NOT_LAUNCH=1", "/l*v", logFile2],
@@ -34839,7 +35059,7 @@ function output2(file3, args) {
   });
 }
 var serviceName = () => "WireGuardTunnel$" + WIREGUARD_TUNNEL;
-var hasAdapter = (ip) => Object.values(os13.networkInterfaces()).some((list) => (list ?? []).some((i) => i.address === ip));
+var hasAdapter = (ip) => Object.values(os14.networkInterfaces()).some((list) => (list ?? []).some((i) => i.address === ip));
 async function removeWireguardTunnel(exe) {
   try {
     await output2(exe, ["/uninstalltunnelservice", WIREGUARD_TUNNEL]);
@@ -34847,10 +35067,10 @@ async function removeWireguardTunnel(exe) {
   }
 }
 async function startWireguardTunnel(o) {
-  const root = path72.join(process.env.SystemRoot ?? "C:\\Windows", "Temp");
-  const dir = fs59.mkdtempSync(path72.join(fs59.existsSync(root) ? root : os13.tmpdir(), "sbx-wg-"));
-  const file3 = path72.join(dir, WIREGUARD_TUNNEL + ".conf");
-  fs59.writeFileSync(file3, o.config, "utf8");
+  const root = path73.join(process.env.SystemRoot ?? "C:\\Windows", "Temp");
+  const dir = fs60.mkdtempSync(path73.join(fs60.existsSync(root) ? root : os14.tmpdir(), "sbx-wg-"));
+  const file3 = path73.join(dir, WIREGUARD_TUNNEL + ".conf");
+  fs60.writeFileSync(file3, o.config, "utf8");
   const fail = async (message) => {
     await removeWireguardTunnel(o.exe);
     return { ok: false, message };
@@ -34871,11 +35091,11 @@ async function startWireguardTunnel(o) {
       await sleep(500);
     }
   } finally {
-    fs59.rmSync(dir, { recursive: true, force: true });
+    fs60.rmSync(dir, { recursive: true, force: true });
   }
 }
 async function waitForHandshake(exe, poke, timeoutMs = 3e4) {
-  const wg = path72.join(path72.dirname(exe), "wg.exe");
+  const wg = path73.join(path73.dirname(exe), "wg.exe");
   if (!exists(wg)) return { ok: true, message: "the tunnel service is running (no wg.exe to check the handshake)" };
   const deadline = Date.now() + timeoutMs;
   for (; ; ) {
@@ -34939,7 +35159,7 @@ async function publicAddress() {
     return null;
   }
 }
-var hasAdapter2 = (ip) => Object.values(os14.networkInterfaces()).some((list) => (list ?? []).some((i) => i.address === ip));
+var hasAdapter2 = (ip) => Object.values(os15.networkInterfaces()).some((list) => (list ?? []).some((i) => i.address === ip));
 var PROBE_TARGETS = ["1.1.1.1", "8.8.8.8", "9.9.9.9"];
 var PROBE_TIMEOUT_MS = 3e3;
 function connects(ip, port) {
@@ -35010,8 +35230,8 @@ async function setupVpn(secrets, ptyHostExe) {
     } else {
       const credentials = secrets.vpn;
       if (!credentials) throw new Error("the VPN login did not arrive (start the sandbox again)");
-      const profile = path73.join(launchDir, "vpn", "server.ovpn");
-      const remotes = assertSafeOvpn(fs60.readFileSync(profile, "utf8"), vpn.server);
+      const profile = path74.join(launchDir, "vpn", "server.ovpn");
+      const remotes = assertSafeOvpn(fs61.readFileSync(profile, "utf8"), vpn.server);
       const exe = await ensureOpenVpn();
       const servers = await serverAddresses(remotes);
       if (servers.length === 0) throw new Error("the VPN server addresses could not be found");
@@ -35697,7 +35917,7 @@ async function viewSession(id) {
 }
 
 // src/guest/boot/boot-env.ts
-import path74 from "node:path";
+import path75 from "node:path";
 
 // src/guest/boot/project-env.ts
 var EnvSchema = external_exports.object({
@@ -35716,7 +35936,7 @@ var BootEnvSchema = external_exports.object({
 });
 
 // src/guest/boot/boot-env.ts
-var file2 = () => path74.join(localDir, "boot-env.json");
+var file2 = () => path75.join(localDir, "boot-env.json");
 function saveBootEnv(value) {
   try {
     writeJsonAtomic(file2(), value);
@@ -35745,7 +35965,7 @@ function saveProjectStatus(name, workspace2, phase, message, databases, summary)
 }
 
 // src/guest/runtime/secrets.ts
-import fs61 from "node:fs";
+import fs62 from "node:fs";
 
 // src/shared/channel/secrets.ts
 var Environment = external_exports.record(external_exports.string().max(256), external_exports.string().max(65536));
@@ -35775,12 +35995,12 @@ function takeSecrets(id) {
   const file3 = run.secretFile(id);
   let text;
   try {
-    if (fs61.statSync(file3).size > MAX_BYTES) throw new Error("too big");
-    text = fs61.readFileSync(file3, "utf8").replace(/^\uFEFF/, "");
+    if (fs62.statSync(file3).size > MAX_BYTES) throw new Error("too big");
+    text = fs62.readFileSync(file3, "utf8").replace(/^\uFEFF/, "");
   } catch {
     return {};
   } finally {
-    fs61.rmSync(file3, { force: true });
+    fs62.rmSync(file3, { force: true });
   }
   try {
     const parsed = SecretsFileSchema.safeParse(JSON.parse(text));
@@ -35818,7 +36038,7 @@ async function soft(what, work) {
   }
 }
 function startDaemon(env, secrets) {
-  spawn10(process.execPath, [path75.join(path75.dirname(process.argv[1]), "daemon.js")], {
+  spawn10(process.execPath, [path76.join(path76.dirname(process.argv[1]), "daemon.js")], {
     detached: true,
     stdio: "ignore",
     windowsHide: true,
@@ -35837,20 +36057,20 @@ function startDaemon(env, secrets) {
   }).unref();
 }
 function writeDbCommand() {
-  const dir = mkdirp(path75.join(localDir, "bin"));
-  const db = path75.join(path75.dirname(process.argv[1]), "db.js");
-  fs62.writeFileSync(
-    path75.join(dir, "sbx-db.cmd"),
+  const dir = mkdirp(path76.join(localDir, "bin"));
+  const db = path76.join(path76.dirname(process.argv[1]), "db.js");
+  fs63.writeFileSync(
+    path76.join(dir, "sbx-db.cmd"),
     '@setlocal\r\n@set AGENT_LOG_PREFIX=db\r\n@"' + process.execPath + '" "' + db + '" %*\r\n'
   );
   writeAgentCommands(dir);
   return dir;
 }
 function writeAgentCommands(dir) {
-  const install = { node: process.execPath, script: path75.join(path75.dirname(process.argv[1]), "agent.js") };
+  const install = { node: process.execPath, script: path76.join(path76.dirname(process.argv[1]), "agent.js") };
   for (const shim3 of agentShims(toolsDir, session.agents ?? {}))
-    fs62.writeFileSync(path75.join(dir, shim3.command + ".cmd"), shimText(shim3, install));
-  fs62.writeFileSync(path75.join(dir, "sbx-agent.cmd"), sbxAgentText(install));
+    fs63.writeFileSync(path76.join(dir, shim3.command + ".cmd"), shimText(shim3, install));
+  fs63.writeFileSync(path76.join(dir, "sbx-agent.cmd"), sbxAgentText(install));
 }
 async function waitForPrimary() {
   for (let i = 0; i < PRIMARY_POLLS; i++) {
@@ -35878,7 +36098,7 @@ var Boot = class {
     log(
       "Agent sandbox: " + session.project + " | workspace " + workspace + " | agent " + session.harnessName + " | log " + logPath
     );
-    if (!fs62.statSync(workspace, { throwIfNoEntry: false })?.isDirectory())
+    if (!fs63.statSync(workspace, { throwIfNoEntry: false })?.isDirectory())
       throw new Error("Workspace folder is missing in the sandbox: " + workspace);
     mkdirp(toolsDir);
     mkdirp(run.root);
@@ -35910,6 +36130,7 @@ var Boot = class {
     step(2, "Pre-provision hooks and desktop");
     runHooks("pre-provision", process.env);
     await soft("Personalisation", applyPersonalization);
+    await soft("Browsers without the GPU", keepBrowsersOffGpu);
   }
   /** Toolchains, databases, apps, the network proxy and VS Code; then the agent environment, saved machine-wide. */
   async developerTools() {
@@ -35980,6 +36201,7 @@ var Boot = class {
     await soft("claude-mem restore", restoreClaudeMem);
     await soft("Agent files of the last sandbox", resetMachineBound);
     await soft("Agent databases restore", restoreLocalState);
+    await soft("Codex without its own sandbox", codexWithoutInnerSandbox);
     let headroom = null;
     await soft("MCP servers from Apps", writeAddonMcpServers);
     await soft("Headroom proxy", async () => {
@@ -36038,11 +36260,11 @@ runBoot().catch((e) => {
   const message = errMsg(e) + (e instanceof Error && e.stack ? "\n" + e.stack : "");
   try {
     setSandboxStatus("failed", errMsg(e));
-    fs63.writeFileSync(path76.join(logsDir, "guest-error.txt"), message);
+    fs64.writeFileSync(path77.join(logsDir, "guest-error.txt"), message);
   } catch {
   }
   console.error(
-    "\n\x1B[31mThe sandbox could not start: " + errMsg(e) + "\x1B[0m\nDetails: " + path76.join(logsDir, "guest-error.txt")
+    "\n\x1B[31mThe sandbox could not start: " + errMsg(e) + "\x1B[0m\nDetails: " + path77.join(logsDir, "guest-error.txt")
   );
   process.exitCode = 1;
 });