windows-development-sandbox 1.17.0 → 1.18.0

package/dist/runtime/daemon.js

@@ -1363,11 +1363,11 @@ var require_lodash = __commonJS({
             return isFunction(object2[key2]);
           });
         }
-        function baseGet(object2, path73) {
-          path73 = castPath(path73, object2);
-          var index = 0, length = path73.length;
+        function baseGet(object2, path84) {
+          path84 = castPath(path84, object2);
+          var index = 0, length = path84.length;
           while (object2 != null && index < length) {
-            object2 = object2[toKey(path73[index++])];
+            object2 = object2[toKey(path84[index++])];
           }
           return index && index == length ? object2 : undefined2;
         }
@@ -1431,10 +1431,10 @@ var require_lodash = __commonJS({
           });
           return accumulator;
         }
-        function baseInvoke(object2, path73, args) {
-          path73 = castPath(path73, object2);
-          object2 = parent(object2, path73);
-          var func = object2 == null ? object2 : object2[toKey(last(path73))];
+        function baseInvoke(object2, path84, args) {
+          path84 = castPath(path84, object2);
+          object2 = parent(object2, path84);
+          var func = object2 == null ? object2 : object2[toKey(last(path84))];
           return func == null ? undefined2 : apply(func, object2, args);
         }
         function baseIsArguments(value) {
@@ -1590,13 +1590,13 @@ var require_lodash = __commonJS({
             return object2 === source || baseIsMatch(object2, source, matchData);
           };
         }
-        function baseMatchesProperty(path73, srcValue) {
-          if (isKey(path73) && isStrictComparable(srcValue)) {
-            return matchesStrictComparable(toKey(path73), srcValue);
+        function baseMatchesProperty(path84, srcValue) {
+          if (isKey(path84) && isStrictComparable(srcValue)) {
+            return matchesStrictComparable(toKey(path84), srcValue);
           }
           return function(object2) {
-            var objValue = get(object2, path73);
-            return objValue === undefined2 && objValue === srcValue ? hasIn(object2, path73) : baseIsEqual(srcValue, objValue, COMPARE_PARTIAL_FLAG | COMPARE_UNORDERED_FLAG);
+            var objValue = get(object2, path84);
+            return objValue === undefined2 && objValue === srcValue ? hasIn(object2, path84) : baseIsEqual(srcValue, objValue, COMPARE_PARTIAL_FLAG | COMPARE_UNORDERED_FLAG);
           };
         }
         function baseMerge(object2, source, srcIndex, customizer, stack) {
@@ -1693,23 +1693,23 @@ var require_lodash = __commonJS({
           });
         }
         function basePick(object2, paths) {
-          return basePickBy(object2, paths, function(value, path73) {
-            return hasIn(object2, path73);
+          return basePickBy(object2, paths, function(value, path84) {
+            return hasIn(object2, path84);
           });
         }
         function basePickBy(object2, paths, predicate) {
           var index = -1, length = paths.length, result2 = {};
           while (++index < length) {
-            var path73 = paths[index], value = baseGet(object2, path73);
-            if (predicate(value, path73)) {
-              baseSet(result2, castPath(path73, object2), value);
+            var path84 = paths[index], value = baseGet(object2, path84);
+            if (predicate(value, path84)) {
+              baseSet(result2, castPath(path84, object2), value);
             }
           }
           return result2;
         }
-        function basePropertyDeep(path73) {
+        function basePropertyDeep(path84) {
           return function(object2) {
-            return baseGet(object2, path73);
+            return baseGet(object2, path84);
           };
         }
         function basePullAll(array2, values2, iteratee2, comparator) {
@@ -1783,14 +1783,14 @@ var require_lodash = __commonJS({
           var array2 = values(collection);
           return shuffleSelf(array2, baseClamp(n, 0, array2.length));
         }
-        function baseSet(object2, path73, value, customizer) {
+        function baseSet(object2, path84, value, customizer) {
           if (!isObject2(object2)) {
             return object2;
           }
-          path73 = castPath(path73, object2);
-          var index = -1, length = path73.length, lastIndex = length - 1, nested = object2;
+          path84 = castPath(path84, object2);
+          var index = -1, length = path84.length, lastIndex = length - 1, nested = object2;
           while (nested != null && ++index < length) {
-            var key2 = toKey(path73[index]), newValue = value;
+            var key2 = toKey(path84[index]), newValue = value;
             if (key2 === "__proto__" || key2 === "constructor" || key2 === "prototype") {
               return object2;
             }
@@ -1798,7 +1798,7 @@ var require_lodash = __commonJS({
               var objValue = nested[key2];
               newValue = customizer ? customizer(objValue, key2, nested) : undefined2;
               if (newValue === undefined2) {
-                newValue = isObject2(objValue) ? objValue : isIndex(path73[index + 1]) ? [] : {};
+                newValue = isObject2(objValue) ? objValue : isIndex(path84[index + 1]) ? [] : {};
               }
             }
             assignValue(nested, key2, newValue);
@@ -1964,14 +1964,14 @@ var require_lodash = __commonJS({
             }
           return result2;
         }
-        function baseUnset(object2, path73) {
-          path73 = castPath(path73, object2);
-          var index = -1, length = path73.length;
+        function baseUnset(object2, path84) {
+          path84 = castPath(path84, object2);
+          var index = -1, length = path84.length;
           if (!length) {
             return true;
           }
           while (++index < length) {
-            var key2 = toKey(path73[index]);
+            var key2 = toKey(path84[index]);
             if (key2 === "__proto__" && !hasOwnProperty.call(object2, "__proto__")) {
               return false;
             }
@@ -1979,11 +1979,11 @@ var require_lodash = __commonJS({
               return false;
             }
           }
-          var obj = parent(object2, path73);
-          return obj == null || delete obj[toKey(last(path73))];
+          var obj = parent(object2, path84);
+          return obj == null || delete obj[toKey(last(path84))];
         }
-        function baseUpdate(object2, path73, updater, customizer) {
-          return baseSet(object2, path73, updater(baseGet(object2, path73)), customizer);
+        function baseUpdate(object2, path84, updater, customizer) {
+          return baseSet(object2, path84, updater(baseGet(object2, path84)), customizer);
         }
         function baseWhile(array2, predicate, isDrop, fromRight) {
           var length = array2.length, index = fromRight ? length : -1;
@@ -2866,11 +2866,11 @@ var require_lodash = __commonJS({
           var match = source.match(reWrapDetails);
           return match ? match[1].split(reSplitDetails) : [];
         }
-        function hasPath(object2, path73, hasFunc) {
-          path73 = castPath(path73, object2);
-          var index = -1, length = path73.length, result2 = false;
+        function hasPath(object2, path84, hasFunc) {
+          path84 = castPath(path84, object2);
+          var index = -1, length = path84.length, result2 = false;
           while (++index < length) {
-            var key2 = toKey(path73[index]);
+            var key2 = toKey(path84[index]);
             if (!(result2 = object2 != null && hasFunc(object2, key2))) {
               break;
             }
@@ -3072,8 +3072,8 @@ var require_lodash = __commonJS({
             return apply(func, this, otherArgs);
           };
         }
-        function parent(object2, path73) {
-          return path73.length < 2 ? object2 : baseGet(object2, baseSlice(path73, 0, -1));
+        function parent(object2, path84) {
+          return path84.length < 2 ? object2 : baseGet(object2, baseSlice(path84, 0, -1));
         }
         function reorder(array2, indexes) {
           var arrLength = array2.length, length = nativeMin(indexes.length, arrLength), oldArray = copyArray(array2);
@@ -3708,10 +3708,10 @@ var require_lodash = __commonJS({
           }
           return isString(collection) ? fromIndex <= length && collection.indexOf(value, fromIndex) > -1 : !!length && baseIndexOf(collection, value, fromIndex) > -1;
         }
-        var invokeMap = baseRest(function(collection, path73, args) {
-          var index = -1, isFunc = typeof path73 == "function", result2 = isArrayLike(collection) ? Array2(collection.length) : [];
+        var invokeMap = baseRest(function(collection, path84, args) {
+          var index = -1, isFunc = typeof path84 == "function", result2 = isArrayLike(collection) ? Array2(collection.length) : [];
           baseEach(collection, function(value) {
-            result2[++index] = isFunc ? apply(path73, value, args) : baseInvoke(value, path73, args);
+            result2[++index] = isFunc ? apply(path84, value, args) : baseInvoke(value, path84, args);
           });
           return result2;
         });
@@ -4363,15 +4363,15 @@ var require_lodash = __commonJS({
         function functionsIn(object2) {
           return object2 == null ? [] : baseFunctions(object2, keysIn(object2));
         }
-        function get(object2, path73, defaultValue) {
-          var result2 = object2 == null ? undefined2 : baseGet(object2, path73);
+        function get(object2, path84, defaultValue) {
+          var result2 = object2 == null ? undefined2 : baseGet(object2, path84);
           return result2 === undefined2 ? defaultValue : result2;
         }
-        function has(object2, path73) {
-          return object2 != null && hasPath(object2, path73, baseHas);
+        function has(object2, path84) {
+          return object2 != null && hasPath(object2, path84, baseHas);
         }
-        function hasIn(object2, path73) {
-          return object2 != null && hasPath(object2, path73, baseHasIn);
+        function hasIn(object2, path84) {
+          return object2 != null && hasPath(object2, path84, baseHasIn);
         }
         var invert = createInverter(function(result2, value, key2) {
           if (value != null && typeof value.toString != "function") {
@@ -4424,10 +4424,10 @@ var require_lodash = __commonJS({
             return result2;
           }
           var isDeep = false;
-          paths = arrayMap(paths, function(path73) {
-            path73 = castPath(path73, object2);
-            isDeep || (isDeep = path73.length > 1);
-            return path73;
+          paths = arrayMap(paths, function(path84) {
+            path84 = castPath(path84, object2);
+            isDeep || (isDeep = path84.length > 1);
+            return path84;
           });
           copyObject(object2, getAllKeysIn(object2), result2);
           if (isDeep) {
@@ -4442,7 +4442,7 @@ var require_lodash = __commonJS({
         function omitBy(object2, predicate) {
           return pickBy(object2, negate(getIteratee(predicate)));
         }
-        var pick2 = flatRest(function(object2, paths) {
+        var pick3 = flatRest(function(object2, paths) {
           return object2 == null ? {} : basePick(object2, paths);
         });
         function pickBy(object2, predicate) {
@@ -4453,19 +4453,19 @@ var require_lodash = __commonJS({
             return [prop];
           });
           predicate = getIteratee(predicate);
-          return basePickBy(object2, props, function(value, path73) {
-            return predicate(value, path73[0]);
+          return basePickBy(object2, props, function(value, path84) {
+            return predicate(value, path84[0]);
           });
         }
-        function result(object2, path73, defaultValue) {
-          path73 = castPath(path73, object2);
-          var index = -1, length = path73.length;
+        function result(object2, path84, defaultValue) {
+          path84 = castPath(path84, object2);
+          var index = -1, length = path84.length;
           if (!length) {
             length = 1;
             object2 = undefined2;
           }
           while (++index < length) {
-            var value = object2 == null ? undefined2 : object2[toKey(path73[index])];
+            var value = object2 == null ? undefined2 : object2[toKey(path84[index])];
             if (value === undefined2) {
               index = length;
               value = defaultValue;
@@ -4474,12 +4474,12 @@ var require_lodash = __commonJS({
           }
           return object2;
         }
-        function set2(object2, path73, value) {
-          return object2 == null ? object2 : baseSet(object2, path73, value);
+        function set2(object2, path84, value) {
+          return object2 == null ? object2 : baseSet(object2, path84, value);
         }
-        function setWith(object2, path73, value, customizer) {
+        function setWith(object2, path84, value, customizer) {
           customizer = typeof customizer == "function" ? customizer : undefined2;
-          return object2 == null ? object2 : baseSet(object2, path73, value, customizer);
+          return object2 == null ? object2 : baseSet(object2, path84, value, customizer);
         }
         var toPairs = createToPairs(keys);
         var toPairsIn = createToPairs(keysIn);
@@ -4501,15 +4501,15 @@ var require_lodash = __commonJS({
           });
           return accumulator;
         }
-        function unset(object2, path73) {
-          return object2 == null ? true : baseUnset(object2, path73);
+        function unset(object2, path84) {
+          return object2 == null ? true : baseUnset(object2, path84);
         }
-        function update(object2, path73, updater) {
-          return object2 == null ? object2 : baseUpdate(object2, path73, castFunction(updater));
+        function update(object2, path84, updater) {
+          return object2 == null ? object2 : baseUpdate(object2, path84, castFunction(updater));
         }
-        function updateWith(object2, path73, updater, customizer) {
+        function updateWith(object2, path84, updater, customizer) {
           customizer = typeof customizer == "function" ? customizer : undefined2;
-          return object2 == null ? object2 : baseUpdate(object2, path73, castFunction(updater), customizer);
+          return object2 == null ? object2 : baseUpdate(object2, path84, castFunction(updater), customizer);
         }
         function values(object2) {
           return object2 == null ? [] : baseValues(object2, keys(object2));
@@ -4895,17 +4895,17 @@ var require_lodash = __commonJS({
         function matches(source) {
           return baseMatches(baseClone(source, CLONE_DEEP_FLAG));
         }
-        function matchesProperty(path73, srcValue) {
-          return baseMatchesProperty(path73, baseClone(srcValue, CLONE_DEEP_FLAG));
+        function matchesProperty(path84, srcValue) {
+          return baseMatchesProperty(path84, baseClone(srcValue, CLONE_DEEP_FLAG));
         }
-        var method = baseRest(function(path73, args) {
+        var method = baseRest(function(path84, args) {
           return function(object2) {
-            return baseInvoke(object2, path73, args);
+            return baseInvoke(object2, path84, args);
           };
         });
         var methodOf = baseRest(function(object2, args) {
-          return function(path73) {
-            return baseInvoke(object2, path73, args);
+          return function(path84) {
+            return baseInvoke(object2, path84, args);
           };
         });
         function mixin(object2, source, options) {
@@ -4952,12 +4952,12 @@ var require_lodash = __commonJS({
         var over = createOver(arrayMap);
         var overEvery = createOver(arrayEvery);
         var overSome = createOver(arraySome);
-        function property(path73) {
-          return isKey(path73) ? baseProperty(toKey(path73)) : basePropertyDeep(path73);
+        function property(path84) {
+          return isKey(path84) ? baseProperty(toKey(path84)) : basePropertyDeep(path84);
         }
         function propertyOf(object2) {
-          return function(path73) {
-            return object2 == null ? undefined2 : baseGet(object2, path73);
+          return function(path84) {
+            return object2 == null ? undefined2 : baseGet(object2, path84);
           };
         }
         var range = createRange();
@@ -5125,7 +5125,7 @@ var require_lodash = __commonJS({
         lodash.partial = partial2;
         lodash.partialRight = partialRight;
         lodash.partition = partition;
-        lodash.pick = pick2;
+        lodash.pick = pick3;
         lodash.pickBy = pickBy;
         lodash.property = property;
         lodash.propertyOf = propertyOf;
@@ -5410,12 +5410,12 @@ var require_lodash = __commonJS({
         LazyWrapper.prototype.findLast = function(predicate) {
           return this.reverse().find(predicate);
         };
-        LazyWrapper.prototype.invokeMap = baseRest(function(path73, args) {
-          if (typeof path73 == "function") {
+        LazyWrapper.prototype.invokeMap = baseRest(function(path84, args) {
+          if (typeof path84 == "function") {
             return new LazyWrapper(this);
           }
           return this.map(function(value) {
-            return baseInvoke(value, path73, args);
+            return baseInvoke(value, path84, args);
           });
         });
         LazyWrapper.prototype.reject = function(predicate) {
@@ -5540,14 +5540,14 @@ function relayPort(index) {
 }
 
 // src/guest/runtime/log.ts
-import fs6 from "node:fs";
+import fs7 from "node:fs";
 import path9 from "node:path";
 
 // src/guest/runtime/paths.ts
 import path8 from "node:path";
 
 // src/shared/channel/run-dir.ts
-import fs5 from "node:fs";
+import fs6 from "node:fs";
 import path7 from "node:path";
 
 // node_modules/zod/v4/classic/external.js
@@ -6366,10 +6366,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path73) {
-  if (!path73)
+function getElementAtPath(obj, path84) {
+  if (!path84)
     return obj;
-  return path73.reduce((acc, key2) => acc?.[key2], obj);
+  return path84.reduce((acc, key2) => acc?.[key2], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -6709,11 +6709,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path73, issues) {
+function prefixIssues(path84, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path73);
+    iss.path.unshift(path84);
     return iss;
   });
 }
@@ -6818,8 +6818,8 @@ function cleanEnum(obj) {
     return Number.isNaN(Number.parseInt(k, 10));
   }).map((el) => el[1]);
 }
-function base64ToUint8Array(base643) {
-  const binaryString = atob(base643);
+function base64ToUint8Array(base644) {
+  const binaryString = atob(base644);
   const bytes = new Uint8Array(binaryString.length);
   for (let i = 0; i < binaryString.length; i++) {
     bytes[i] = binaryString.charCodeAt(i);
@@ -6834,9 +6834,9 @@ function uint8ArrayToBase64(bytes) {
   return btoa(binaryString);
 }
 function base64urlToUint8Array(base64url3) {
-  const base643 = base64url3.replace(/-/g, "+").replace(/_/g, "/");
-  const padding = "=".repeat((4 - base643.length % 4) % 4);
-  return base64ToUint8Array(base643 + padding);
+  const base644 = base64url3.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = "=".repeat((4 - base644.length % 4) % 4);
+  return base64ToUint8Array(base644 + padding);
 }
 function uint8ArrayToBase64url(bytes) {
   return uint8ArrayToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
@@ -7163,16 +7163,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path73 = []) => {
+  const processError = (error63, path84 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path73, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path84, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path73, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path84, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path73, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path84, ...issue2.path]);
       } else {
-        const fullpath = [...path73, ...issue2.path];
+        const fullpath = [...path84, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -7211,17 +7211,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path73 = []) => {
+  const processError = (error63, path84 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path73, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path84, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path73, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path84, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path73, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path84, ...issue2.path]);
       } else {
-        const fullpath = [...path73, ...issue2.path];
+        const fullpath = [...path84, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -7260,8 +7260,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path73 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path73) {
+  const path84 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path84) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -8579,8 +8579,8 @@ var base64urlCharset = /^[A-Za-z0-9_-]*$/;
 function isValidBase64URL(data) {
   if (!base64urlCharset.test(data))
     return false;
-  const base643 = data.replace(/[-_]/g, (c) => c === "-" ? "+" : "/");
-  const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
+  const base644 = data.replace(/[-_]/g, (c) => c === "-" ? "+" : "/");
+  const padded = base644.padEnd(Math.ceil(base644.length / 4) * 4, "=");
   return isValidBase64(padded);
 }
 var $ZodBase64URL = /* @__PURE__ */ $constructor("$ZodBase64URL", (inst, def) => {
@@ -24363,13 +24363,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path73 = ref.slice(1).split("/").filter(Boolean);
-  if (path73.length === 0) {
+  const path84 = ref.slice(1).split("/").filter(Boolean);
+  if (path84.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path73[0] === defsKey) {
-    const key2 = path73[1] === void 0 ? void 0 : decodeJSONPointerSegment(path73[1]);
+  if (path84[0] === defsKey) {
+    const key2 = path84[1] === void 0 ? void 0 : decodeJSONPointerSegment(path84[1]);
     if (!key2 || !ctx.defs[key2]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -25219,7 +25219,7 @@ function date4(params) {
 }
 
 // src/shared/paths/guest-paths.ts
-var RESERVED_GUEST = /^C:\\(?:Windows|Program Files|Program Files \(x86\)|ProgramData|Users|AgentLaunch|AgentData|HostTools|nvm|Mirror)(?:\\|$)/i;
+var RESERVED_GUEST = /^C:\\(?:Windows|Program Files|Program Files \(x86\)|ProgramData|Users|AgentLaunch|AgentData|HostTools|nvm|Mirror|PcInstalls)(?:\\|$)/i;
 var MIRROR_ROOT = "C:\\Mirror";
 var MIRROR_LETTER = /^[D-Z]$/;
 var DRIVE_PATH = /^([A-Za-z]):\\(.*)$/;
@@ -25680,8 +25680,119 @@ var ToolchainsSchema = external_exports.strictObject({
     ),
     keepInstallFiles: external_exports.boolean().describe(
       "Keep an offline copy of the Visual Studio install files in tools\\visualstudio (~10 GB, made once), so later boots install without downloading them again. Skipped while that disk has too little room."
+    ),
+    persistEngines: external_exports.boolean().describe(
+      "Engines the Epic Games Launcher installs go to tools\\unreal\\engines (kept between sandboxes, 40-60 GB each) and are registered with the launcher again every boot. Off: they go on the sandbox disk and are lost when it closes. Engines installed on this PC can be mapped instead (pcInstalls.unrealEngines)."
+    ),
+    derivedDataCache: external_exports.enum(["persisted", "local"]).describe(
+      `"persisted": the engine's local derived data cache (compiled shaders, 10-50 GB) in tools\\unreal\\ddc, kept between sandboxes. "local": Unreal's own place on the sandbox disk (rebuilt every boot).`
+    )
+  }),
+  unity: external_exports.strictObject({
+    enabled: enabled(
+      "Unity: the editor version a project asks for, from Unity's release API (checked against its published hash), installed into tools\\unity\\<version> (6-7 GB each), with the modules you list.",
+      "ProjectSettings/ProjectVersion.txt"
+    ),
+    acceptLicense: external_exports.boolean().describe(
+      "Required to install: you accept the Unity terms of service (https://unity.com/legal/terms-of-service), and the editor needs a Unity licence (Personal is free). A project file cannot accept it for you."
+    ),
+    version: external_exports.string().min(1).describe(
+      '"project" = the version in ProjectSettings/ProjectVersion.txt, or an editor version such as "6000.0.32f1".'
+    ),
+    modules: external_exports.array(external_exports.string().regex(/^[a-z0-9-]+$/)).describe(
+      `Editor modules to add: "android" (4-5 GB, also the Android SDK), "webgl" (1.5 GB), "windows-il2cpp" (adds Visual Studio's C++ parts), "ios" (Xcode project export only: iOS builds need a Mac).`
+    ),
+    hub: external_exports.boolean().describe("Also Unity Hub, with the installed editors listed in it."),
+    keepVersions: external_exports.number().int().min(1).max(20).describe(
+      "How many editor versions to keep in tools\\unity; older ones are removed (the least recently used first)."
+    )
+  }),
+  godot: external_exports.strictObject({
+    enabled: enabled(
+      "Godot from its official builds (checked against the published SHA-512 sums), self-contained in tools\\godot\\<version> with `godot` (the console build) on PATH.",
+      "project.godot"
+    ),
+    version: external_exports.string().min(1).describe(
+      '"project" = the version project.godot was saved with (else the newest stable), or a version such as "4.3".'
+    ),
+    dotnet: EnabledSchema.describe(
+      'The .NET (C#) build of Godot and the .NET SDK: true, false, or "auto" = when the project has a .csproj.'
+    ),
+    exportTemplates: external_exports.boolean().describe("Also the export templates for that version (~1.2 GB), for exporting games."),
+    keepVersions: external_exports.number().int().min(1).max(20).describe("How many Godot versions to keep; older ones are removed (the least recently used first).")
+  }),
+  steam: external_exports.strictObject({
+    enabled: enabled(
+      "SteamCMD (`steamcmd` on PATH, Valve-signed, ~0.3 GB) and `sbx-steam` for logging in, downloading apps and workshop items, and uploading builds (ContentBuilder) and workshop items.",
+      "steam_appid.txt, steam_api64.dll, steam_api.dll, or an app_build / workshop_item .vdf"
+    ),
+    client: external_exports.boolean().describe(
+      "Also the Steam client (1-1.5 GB, in tools\\steam), for testing the Steamworks API, the overlay or in-game uploads. You sign in to it in each sandbox."
+    ),
+    sdkFolder: external_exports.string().describe(
+      "Where the Steamworks SDK is in the sandbox (relative paths are inside the project); it sets STEAMWORKS_SDK. Empty = not set. The SDK is never downloaded (it needs a Steamworks partner login)."
+    )
+  }),
+  fivem: external_exports.strictObject({
+    enabled: enabled(
+      "A FiveM / RedM server (FXServer with txAdmin) for resource development, from the Cfx.re artifacts (the game client is not supported). `sbx-fivem serve` starts it.",
+      "fxmanifest.lua or __resource.lua (up to 3 folders down)"
+    ),
+    acceptLicense: external_exports.boolean().describe(
+      "Required to install: you accept the Cfx.re platform terms (https://fivem.net/terms) and the FXServer licence. A project file cannot accept it for you."
+    ),
+    game: external_exports.enum(["gta5", "rdr3"]).describe('"gta5" = FiveM, "rdr3" = RedM.'),
+    artifact: external_exports.string().regex(/^(recommended|optional|latest|\d+)$/).describe('The server build: "recommended", "optional", "latest", or a build number.'),
+    txAdmin: external_exports.boolean().describe("Start the server with txAdmin (its web panel on port 40120)."),
+    keepVersions: external_exports.number().int().min(1).max(20).describe("How many server builds to keep in tools\\fivem\\artifacts.")
+  }),
+  android: external_exports.strictObject({
+    enabled: enabled(
+      "The Android SDK (command-line tools, platform-tools, build-tools, platforms, NDK and CMake as needed) in tools\\android-sdk, with a JDK. No emulator (Windows Sandbox cannot run one): use a device over the network, or build only.",
+      "a Gradle build using com.android, an AndroidManifest.xml (up to 3 folders down), a .NET MAUI project, or a Flutter / React Native / Godot Android project"
+    ),
+    acceptLicense: external_exports.boolean().describe(
+      "Required to install: you accept the Android SDK licence (https://developer.android.com/studio/terms) and the licences sdkmanager shows. A project file cannot accept them for you."
+    ),
+    platforms: StringsSchema.describe(
+      `Platforms to install, e.g. ["android-35"]; "project" = the compileSdk the project's Gradle files ask for.`
+    ),
+    buildTools: external_exports.string().min(1).describe('"latest" or a build-tools version such as "35.0.0".'),
+    ndk: external_exports.union([external_exports.literal(false), external_exports.string().min(1)]).describe(
+      '"auto" = when the project uses native code (ndkVersion, CMake or ndk-build), false = never, or a version.'
+    ),
+    cmake: external_exports.union([external_exports.literal(false), external_exports.string().min(1)]).describe('"auto" = when the project builds native code with CMake, false = never, or a version.'),
+    packages: Packages("More sdkmanager packages (not the emulator or system images)", '["extras;google;usb_driver"]')
+  }),
+  flutter: external_exports.strictObject({
+    enabled: enabled(
+      "Flutter (with its Dart) from the official releases (checked against their SHA-256), with the Android SDK for Android builds.",
+      "a pubspec.yaml with a flutter: section"
+    ),
+    version: external_exports.string().min(1).describe(
+      '"project" = the version in .fvmrc (else the newest stable), "stable", "beta", or a version such as "3.24.5".'
+    ),
+    windowsDesktop: external_exports.boolean().describe(
+      "Windows desktop builds: needs Visual Studio Build Tools' C++ parts (a real installer: it runs every boot, ~5 GB on the sandbox disk)."
+    ),
+    precache: StringsSchema.describe(
+      'Platforms whose engine files are downloaded ahead (flutter precache), e.g. ["android", "web"].'
     )
   }),
+  dart: external_exports.strictObject({
+    enabled: enabled(
+      "The Dart SDK (without Flutter), checked against its published SHA-256.",
+      "a pubspec.yaml without a flutter: section"
+    ),
+    version: external_exports.string().min(1).describe('"stable", "beta" or a version such as "3.5.4".')
+  }),
+  reactNative: external_exports.strictObject({
+    enabled: enabled(
+      "React Native / Expo: the Android SDK and JDK for Android builds (Node is always there). iOS builds run in EAS Build (the cloud).",
+      "a package.json depending on react-native or expo"
+    ),
+    easCli: external_exports.boolean().describe("Also eas-cli (Expo Application Services) as a global npm package.")
+  }),
   cpp: external_exports.strictObject({
     enabled: enabled(
       "MinGW-w64 GCC with CMake, Ninja, premake5 and mingw32-make (also Rust's linker).",
@@ -25701,7 +25812,8 @@ var ToolchainsSchema = external_exports.strictObject({
     ),
     netfx35: external_exports.boolean().describe(
       ".NET Framework 3.5 runtime (a Windows feature, enabled from Windows Update on every boot; a few minutes)."
-    )
+    ),
+    templates: Packages("Project templates (`dotnet new install`)", '["MonoGame.Templates.CSharp"]')
   }),
   go: external_exports.strictObject({
     enabled: enabled("Go.", "go.mod or go.work"),
@@ -25717,7 +25829,8 @@ var ToolchainsSchema = external_exports.strictObject({
     ),
     version: external_exports.string().min(1).describe(`"lts" (newest LTS) or a major version such as "21". A project's .java-version or .sdkmanrc wins.`),
     maven: external_exports.boolean().describe("Apache Maven (mvn). A project's mvnw works either way."),
-    gradle: external_exports.boolean().describe("Gradle (gradle). A project's gradlew works either way.")
+    gradle: external_exports.boolean().describe("Gradle (gradle). A project's gradlew works either way."),
+    kotlin: external_exports.boolean().describe("Also the Kotlin compiler (kotlinc) from JetBrains' releases. Gradle builds fetch their own.")
   }),
   ruby: external_exports.strictObject({
     enabled: enabled(
@@ -25788,6 +25901,15 @@ var ToolchainsSchema = external_exports.strictObject({
   )
 });
 
+// src/shared/apps/catalogue-gamedev.ts
+var GAMEDEV_APPS = [];
+
+// src/shared/apps/catalogue-mobile.ts
+var MOBILE_APPS = [];
+
+// src/shared/apps/catalogue-modding.ts
+var MODDING_APPS = [];
+
 // src/shared/apps/catalogue.ts
 var gh = (github, asset) => ({ github, asset });
 var RTK_VERSION = "1.0.1";
@@ -25797,7 +25919,7 @@ var HEADROOM_VERSION = "0.41.0";
 var CCUSAGE_VERSION = "20.0.36";
 var PLAYWRIGHT_MCP_VERSION = "0.0.83";
 var CONTEXT7_MCP_VERSION = "4.4.2";
-var APPS = [
+var CORE_APPS = [
   // ---- agent add-ons
   {
     id: "rtk",
@@ -26620,6 +26742,7 @@ var APPS = [
     cli: true
   }
 ];
+var APPS = [...CORE_APPS, ...GAMEDEV_APPS, ...MODDING_APPS, ...MOBILE_APPS];
 function appById(id) {
   return APPS.find((a) => a.id === id);
 }
@@ -26822,6 +26945,187 @@ var GithubSchema = external_exports.strictObject({
   )
 });
 
+// src/shared/accounts/kinds.ts
+var SERVICE_KINDS = ["epic", "steam", "unity", "cfx", "keystore", "play", "expo", "appstore"];
+var AGENT_CAN_USE = "The agent in the sandbox can use this sign-in while it is there.";
+var ONE_PLACE = "It works in one sandbox at a time: a second sandbox starts without it while the first one runs.";
+var SERVICE_SPECS = {
+  epic: {
+    kind: "epic",
+    label: "Epic Games",
+    usedBy: ["unreal"],
+    sources: ["pc", "sandbox"],
+    singleHolder: true,
+    returns: true,
+    maxBytes: 64 * 1024,
+    warnings: [
+      AGENT_CAN_USE,
+      "A sign-in works in one place at a time: taking this PC's signs the launcher on this PC out the first time a sandbox uses it."
+    ],
+    fields: []
+  },
+  steam: {
+    kind: "steam",
+    label: "Steam (SteamCMD)",
+    usedBy: ["steam"],
+    sources: ["file", "sandbox"],
+    singleHolder: true,
+    returns: true,
+    maxBytes: 768 * 1024,
+    warnings: [
+      AGENT_CAN_USE + " It can upload builds and workshop items to your Steam apps.",
+      ONE_PLACE,
+      "No password is kept: sign in once with sbx-steam login in a sandbox (Steam Guard asks there)."
+    ],
+    fields: []
+  },
+  unity: {
+    kind: "unity",
+    label: "Unity",
+    usedBy: ["unity"],
+    sources: ["pc", "file", "typed", "sandbox"],
+    singleHolder: true,
+    returns: true,
+    maxBytes: 256 * 1024,
+    warnings: [
+      AGENT_CAN_USE,
+      ONE_PLACE,
+      "A Pro seat is handed back when the sandbox stops cleanly; a sandbox closed abruptly may keep it until you return it."
+    ],
+    fields: [
+      { name: "email", label: "Unity ID email", secret: false, optional: true },
+      { name: "password", label: "Unity ID password", secret: true, optional: true },
+      { name: "serial", label: "Serial (Plus or Pro; empty for Personal)", secret: true, optional: true }
+    ]
+  },
+  cfx: {
+    kind: "cfx",
+    label: "Cfx.re (FiveM / RedM server key)",
+    usedBy: ["fivem"],
+    sources: ["typed"],
+    singleHolder: false,
+    returns: false,
+    maxBytes: 4 * 1024,
+    warnings: [AGENT_CAN_USE + " Anyone with the key can run a server under your Cfx.re account."],
+    fields: [
+      { name: "licenseKey", label: "Server licence key (cfxk_...)", secret: true, pattern: /^cfxk_[A-Za-z0-9_]+$/ },
+      {
+        name: "steamWebApiKey",
+        label: "Steam Web API key (optional)",
+        secret: true,
+        optional: true,
+        pattern: /^[A-F0-9]{32}$/
+      }
+    ]
+  },
+  keystore: {
+    kind: "keystore",
+    label: "Android upload keystore",
+    usedBy: ["android"],
+    sources: ["file"],
+    singleHolder: false,
+    returns: false,
+    maxBytes: 512 * 1024,
+    warnings: [AGENT_CAN_USE + " It can sign app updates as you; keep a backup of the keystore elsewhere."],
+    fields: [
+      { name: "storePassword", label: "Keystore password", secret: true },
+      { name: "keyAlias", label: "Key alias", secret: false },
+      { name: "keyPassword", label: "Key password", secret: true }
+    ]
+  },
+  play: {
+    kind: "play",
+    label: "Google Play (service account)",
+    usedBy: ["android"],
+    sources: ["file"],
+    singleHolder: false,
+    returns: false,
+    maxBytes: 128 * 1024,
+    warnings: [AGENT_CAN_USE + " It can publish to Google Play with what the service account is allowed."],
+    fields: []
+  },
+  expo: {
+    kind: "expo",
+    label: "Expo (EAS)",
+    usedBy: ["reactNative"],
+    sources: ["typed"],
+    singleHolder: false,
+    returns: false,
+    maxBytes: 4 * 1024,
+    warnings: [AGENT_CAN_USE + " It can start EAS builds and submissions on your Expo account."],
+    fields: [{ name: "token", label: "Expo access token", secret: true }]
+  },
+  appstore: {
+    kind: "appstore",
+    label: "App Store Connect API key",
+    usedBy: ["reactNative", "flutter"],
+    sources: ["file", "typed"],
+    singleHolder: false,
+    returns: false,
+    maxBytes: 16 * 1024,
+    warnings: [AGENT_CAN_USE + " It can upload and submit apps with what the key is allowed."],
+    fields: [
+      { name: "issuerId", label: "Issuer ID", secret: false },
+      { name: "keyId", label: "Key ID", secret: false, pattern: /^[A-Z0-9]{10}$/ }
+    ]
+  }
+};
+var HANDOFF_PARTS = ["state", "accounts"];
+
+// src/core/schema/accounts.ts
+function share(kind, how) {
+  const spec = SERVICE_SPECS[kind];
+  return external_exports.strictObject({
+    share: external_exports.boolean().describe(
+      "Hand your saved " + spec.label + " sign-in to sandboxes that use " + spec.usedBy.join(" or ") + " (" + how + "). Kept encrypted on this PC; " + spec.warnings.join(" ") + " Yours only: a project file can only turn it off."
+    )
+  });
+}
+var AccountsSchema = external_exports.strictObject({
+  epic: share("epic", "sign in to the launcher once in a sandbox, or take this PC's: sandbox account import epic"),
+  steam: share(
+    "steam",
+    "sign in once with sbx-steam login, or: sandbox account import steam --from <steamcmd folder>"
+  ),
+  unity: share("unity", "sign in once in a sandbox, or take this PC's licence: sandbox account import unity"),
+  cfx: share("cfx", "sandbox account login cfx"),
+  keystore: share("keystore", "sandbox account import keystore --from <upload.jks>"),
+  play: share("play", "sandbox account import play --from <service-account.json>"),
+  expo: share("expo", "sandbox account login expo"),
+  appstore: share("appstore", "sandbox account import appstore --from <AuthKey.p8>")
+}).describe(
+  "Service sign-ins for sandboxes (game stores, engines, app signing). Manage them in Accounts: sandbox account status."
+);
+
+// src/core/schema/pc-installs.ts
+var pick2 = (item, what, example) => external_exports.union([external_exports.boolean(), external_exports.array(item)]).describe(
+  what + " of this PC, read-only in the sandbox under C:\\PcInstalls: true = all of them, false = none, or a list (e.g. " + example + "). The agent can read their files."
+);
+var PcInstallsSchema = external_exports.strictObject({
+  steamGames: pick2(
+    external_exports.number().int().positive(),
+    "Steam games (true maps each library; a list of app IDs maps only those games)",
+    "[480, 730]"
+  ),
+  epicGames: pick2(
+    external_exports.string().regex(/^[A-Za-z0-9._-]{1,100}$/),
+    "Epic Games Launcher games (by their app name)",
+    '["Fortnite"]'
+  ),
+  unrealEngines: pick2(
+    external_exports.string().regex(/^(UE_)?\d+\.\d+$/),
+    "Unreal Engine versions installed with the Epic Games Launcher",
+    '["5.4"]'
+  ),
+  unityEditors: pick2(
+    external_exports.string().regex(/^\d+\.\d+\.\d+[abfp]\d+$/),
+    "Unity editors installed with Unity Hub",
+    '["6000.0.32f1"]'
+  )
+}).describe(
+  "Games, engines and editors installed on this PC, mapped read-only into sandboxes (no copy, no room on the sandbox's disk)."
+);
+
 // src/core/schema/config.ts
 var RESERVED_ENV_PREFIX = /^(AGENT_|GIT_|GH_|GITHUB_|NODE_|NPM_CONFIG_(USERCONFIG|GLOBALCONFIG|PREFIX|SCRIPT_SHELL)|SSL_|CLAUDE|ANTHROPIC_|OPENAI_|CODEX_|GEMINI_|GOOGLE_|COPILOT_|AWS_|AZURE_)/i;
 var RESERVED_ENV_SUFFIX = /(_PROXY|_BASE_URL|_ENDPOINT|_CA_BUNDLE|_CA_CERTS)$/i;
@@ -26883,6 +27187,8 @@ var ConfigSchema = external_exports.strictObject({
   network: NetworkSchema,
   vpn: VpnSchema,
   github: GithubSchema,
+  accounts: AccountsSchema,
+  pcInstalls: PcInstallsSchema,
   provisioning: ProvisioningSchema,
   downloads: DownloadsSchema,
   toolchains: ToolchainsSchema,
@@ -26935,6 +27241,8 @@ var LocalOverridesSchema = external_exports.strictObject({
   network: NetworkSchema.pick({ blockPrivateRanges: true, blockHosts: true }).partial(),
   // A project may turn the kill switch on, never off, and never choose a VPN, a server, a file or a login.
   vpn: VpnSchema.pick({ killSwitch: true }).partial(),
+  // A project may only turn a sign-in off (policy: OFF_IS_SAFER); pcInstalls is never here (folders of this PC).
+  accounts: external_exports.strictObject(import_lodash.default.mapValues(AccountsSchema.shape, (shape) => shape.partial())).partial(),
   provisioning: ProvisioningSchema.pick({ copyFromHost: true, fallbackToInstall: true, refresh: true }).extend({ git: GitSchema.partial(), terminal: toggle("Windows Terminal as the sandbox window.").partial() }).partial(),
   downloads: DownloadsSchema.partial(),
   // Every toolchain setting, each one optional (a project usually only switches languages on or pins a version).
@@ -27323,6 +27631,49 @@ function copyTreeTolerant(from, to, skip = () => false) {
   return { copied, vanished };
 }
 
+// src/shared/io/bounded.ts
+import fs5 from "node:fs";
+function readBoundedFile(file3, max, hooks = {}) {
+  try {
+    if (!fs5.lstatSync(file3).isFile()) return null;
+  } catch {
+    return null;
+  }
+  let fd = null;
+  try {
+    fd = fs5.openSync(file3, "r");
+    const stat = fs5.fstatSync(fd);
+    if (!stat.isFile() || stat.size > max) return null;
+    hooks.afterStat?.();
+    const buffer = Buffer.alloc(max + 1);
+    let total = 0;
+    while (total < buffer.length) {
+      const read = fs5.readSync(fd, buffer, total, buffer.length - total, total);
+      if (read === 0) break;
+      total += read;
+    }
+    return total > max ? null : buffer.subarray(0, total);
+  } catch {
+    return null;
+  } finally {
+    if (fd !== null) fs5.closeSync(fd);
+  }
+}
+
+// src/shared/io/text.ts
+function decodeText(bytes) {
+  if (bytes.length >= 2 && bytes[0] === 255 && bytes[1] === 254)
+    return { text: bytes.subarray(2).toString("utf16le"), encoding: "utf16le" };
+  if (bytes.length >= 3 && bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191)
+    return { text: bytes.subarray(3).toString("utf8"), encoding: "utf8bom" };
+  return { text: bytes.toString("utf8"), encoding: "utf8" };
+}
+function encodeText(text, encoding) {
+  if (encoding === "utf16le") return Buffer.concat([Buffer.from([255, 254]), Buffer.from(text, "utf16le")]);
+  if (encoding === "utf8bom") return Buffer.concat([Buffer.from([239, 187, 191]), Buffer.from(text, "utf8")]);
+  return Buffer.from(text, "utf8");
+}
+
 // src/shared/channel/run-dir.ts
 function safeId(id) {
   return IdSchema.parse(id);
@@ -27331,10 +27682,10 @@ function now() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 var scan = (schema, dir) => {
-  if (!fs5.existsSync(dir)) return { valid: [], invalid: [] };
+  if (!fs6.existsSync(dir)) return { valid: [], invalid: [] };
   const valid = [];
   const invalid = [];
-  for (const name of fs5.readdirSync(dir)) {
+  for (const name of fs6.readdirSync(dir)) {
     if (name.endsWith(".tmp")) continue;
     const message = /^[A-Za-z0-9_-]{1,64}\.json$/.test(name) ? readValid(schema, path7.join(dir, name)) : null;
     if (message) valid.push(message);
@@ -27448,14 +27799,14 @@ var logsDir = path8.join(dataDir, "logs");
 var run = new RunDir(dataDir);
 
 // src/guest/runtime/log.ts
-fs6.mkdirSync(logsDir, { recursive: true });
+fs7.mkdirSync(logsDir, { recursive: true });
 var logFile = path9.join(
   logsDir,
   (process.env.AGENT_LOG_PREFIX ?? "guest") + "-" + (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-") + ".log"
 );
 var append = (line) => {
   try {
-    fs6.appendFileSync(logFile, line + "\n");
+    fs7.appendFileSync(logFile, line + "\n");
   } catch {
   }
 };
@@ -27469,7 +27820,7 @@ function warn(message) {
 }
 
 // src/guest/runtime/session.ts
-import fs10 from "node:fs";
+import fs11 from "node:fs";
 import path14 from "node:path";
 
 // src/shared/download/http.ts
@@ -27501,7 +27852,7 @@ async function fetchText(url2) {
 }
 
 // src/shared/download/archive.ts
-import fs8 from "node:fs";
+import fs9 from "node:fs";
 import path12 from "node:path";
 import crypto from "node:crypto";
 
@@ -27533,13 +27884,13 @@ var SYSTEM = {
 };
 
 // src/shared/scripts.ts
-import fs7 from "node:fs";
+import fs8 from "node:fs";
 import path11 from "node:path";
 import { fileURLToPath } from "node:url";
 var HERE = path11.dirname(fileURLToPath(import.meta.url));
 function sandboxScriptsDir() {
   const candidates = [path11.resolve(HERE, "..", "sandbox"), path11.resolve(HERE, "..", "..", "sandbox")];
-  return candidates.find((dir) => fs7.existsSync(path11.join(dir, "boot", "bootstrap.ps1"))) ?? candidates[candidates.length - 1];
+  return candidates.find((dir) => fs8.existsSync(path11.join(dir, "boot", "bootstrap.ps1"))) ?? candidates[candidates.length - 1];
 }
 function scriptArgs(name, args = []) {
   return [
@@ -27570,15 +27921,15 @@ function stagingFolder(destination) {
 }
 function moveIntoPlace(work, destination) {
   safeRemove(destination, path12.dirname(destination));
-  fs8.mkdirSync(path12.dirname(destination), { recursive: true });
-  fs8.renameSync(work, destination);
+  fs9.mkdirSync(path12.dirname(destination), { recursive: true });
+  fs9.renameSync(work, destination);
 }
 async function extractArchive(archive, destination, members2 = []) {
-  fs8.mkdirSync(destination, { recursive: true });
+  fs9.mkdirSync(destination, { recursive: true });
   let status = await spawnAsync(SYSTEM.tar(), ["-xf", archive, "-C", destination, ...members2]);
   if (status !== 0 && /\.(zip|nupkg)$/i.test(archive)) {
     const zip = archive.endsWith(".zip") ? archive : archive + ".zip";
-    if (zip !== archive) fs8.copyFileSync(archive, zip);
+    if (zip !== archive) fs9.copyFileSync(archive, zip);
     status = await spawnAsync(
       SYSTEM.powershell(),
       scriptArgs("expand-archive.ps1", ["-Archive", zip, "-Destination", destination])
@@ -27587,8 +27938,8 @@ async function extractArchive(archive, destination, members2 = []) {
   if (status !== 0) throw new Error("Could not extract " + archive);
 }
 function findFile(root, name, maxDepth = 4) {
-  if (maxDepth < 0 || !fs8.existsSync(root)) return null;
-  const entries2 = fs8.readdirSync(root, { withFileTypes: true });
+  if (maxDepth < 0 || !fs9.existsSync(root)) return null;
+  const entries2 = fs9.readdirSync(root, { withFileTypes: true });
   for (const entry of entries2)
     if (entry.isFile() && entry.name.toLowerCase() === name.toLowerCase()) return path12.join(root, entry.name);
   for (const entry of entries2)
@@ -27600,7 +27951,7 @@ function findFile(root, name, maxDepth = 4) {
 }
 
 // src/shared/download/downloader.ts
-import fs9 from "node:fs";
+import fs10 from "node:fs";
 import path13 from "node:path";
 import crypto2 from "node:crypto";
 import { Readable, Transform } from "node:stream";
@@ -27620,15 +27971,15 @@ var Downloader = class {
    */
   async file(url2, destination, expected = null) {
     const sums = typeof expected === "string" || expected === null ? { sha256: expected } : expected;
-    if (this.requireChecksum && !sums.sha256?.trim() && !sums.sha512?.trim()) {
+    if (this.requireChecksum && !sums.sha256?.trim() && !sums.sha512?.trim() && !sums.sha1?.trim() && !sums.verify) {
       throw new Error(
         "Refusing to download " + path13.basename(destination) + " (" + url2 + "): no checksum is published for it, and downloads.requireChecksum is on. Turn that setting off to allow downloads that cannot be verified."
       );
     }
     const response = await fetchRetry(url2, {}, 3, 20 * 60 * 1e3);
     if (!response.body) throw new Error("Empty response for " + url2);
-    fs9.mkdirSync(path13.dirname(destination), { recursive: true });
-    const checks = ["sha256", "sha512"].flatMap((kind) => {
+    fs10.mkdirSync(path13.dirname(destination), { recursive: true });
+    const checks = ["sha256", "sha512", "sha1"].flatMap((kind) => {
       const want = sums[kind]?.trim().toLowerCase();
       return want ? [{ want, hash: crypto2.createHash(kind) }] : [];
     });
@@ -27657,12 +28008,13 @@ var Downloader = class {
     });
     const partial2 = destination + ".part";
     try {
-      await pipeline(Readable.fromWeb(response.body), tap, fs9.createWriteStream(partial2));
+      await pipeline(Readable.fromWeb(response.body), tap, fs10.createWriteStream(partial2));
       if (checks.some((c) => c.hash.digest("hex") !== c.want)) throw new Error("Checksum mismatch for " + url2);
-      fs9.rmSync(destination, { force: true });
-      fs9.renameSync(partial2, destination);
+      if (sums.verify) await sums.verify(partial2);
+      fs10.rmSync(destination, { force: true });
+      fs10.renameSync(partial2, destination);
     } finally {
-      fs9.rmSync(partial2, { force: true });
+      fs10.rmSync(partial2, { force: true });
     }
   }
   /**
@@ -27673,7 +28025,12 @@ var Downloader = class {
     const work = stagingFolder(destination);
     try {
       const archive = path13.join(work, options.fileName ?? path13.basename(new URL(url2).pathname));
-      await this.file(url2, archive, { sha256: options.sha256, sha512: options.sha512 });
+      await this.file(url2, archive, {
+        sha256: options.sha256,
+        sha512: options.sha512,
+        sha1: options.sha1,
+        ...options.verify ? { verify: options.verify } : {}
+      });
       const extracted = path13.join(work, "x");
       await extractArchive(archive, extracted, options.members);
       let root = extracted;
@@ -27764,7 +28121,7 @@ var githubAssetFromPage = async (repo, pattern, searchOlder) => {
 
 // src/guest/runtime/session.ts
 var session = JSON.parse(
-  fs10.readFileSync(path14.join(launchDir, "session.json"), "utf8").replace(/^\uFEFF/, "")
+  fs11.readFileSync(path14.join(launchDir, "session.json"), "utf8").replace(/^\uFEFF/, "")
 );
 downloader.requireChecksum = session.downloads?.requireChecksum === true;
 var workspace = process.env.AGENT_WORKSPACE ?? session.workspace;
@@ -27795,7 +28152,7 @@ function startRelays() {
 }
 
 // src/guest/audit/process-audit.ts
-import fs12 from "node:fs";
+import fs13 from "node:fs";
 import path16 from "node:path";
 import { spawnSync } from "node:child_process";
 
@@ -27877,12 +28234,12 @@ function parseProcessEvents(xml, attribution) {
 }
 
 // src/guest/runtime/fs.ts
-import fs11 from "node:fs";
+import fs12 from "node:fs";
 function exists(p) {
-  return fs11.existsSync(p);
+  return fs12.existsSync(p);
 }
 function mkdirp(p) {
-  fs11.mkdirSync(p, { recursive: true });
+  fs12.mkdirSync(p, { recursive: true });
   return p;
 }
 
@@ -27917,7 +28274,7 @@ function startProcessCollector(roots = () => []) {
       const { lines, last: newest } = parseProcessEvents(r.stdout ?? "", { attributor, roots: roots() });
       if (newest) last = newest;
       if (lines.length)
-        fs12.writeFileSync(
+        fs13.writeFileSync(
           path16.join(mkdirp(run.auditDir), Date.now() + "-" + process.pid + ".jsonl"),
           lines.join("\n") + "\n"
         );
@@ -27960,7 +28317,68 @@ function safely(what, work) {
 }
 
 // src/guest/runtime/secrets.ts
-import fs13 from "node:fs";
+import fs14 from "node:fs";
+
+// src/shared/accounts/payloads.ts
+var KB = 1024;
+var base643 = (maxBytes) => external_exports.string().min(4).max(maxBytes).regex(/^[A-Za-z0-9+/]+={0,2}$/);
+var secretText = (max) => external_exports.string().min(1).max(max).regex(/^[^\r\n]+$/);
+var EpicPayloadSchema = external_exports.strictObject({
+  data: external_exports.string().min(16).max(16384).regex(/^[A-Za-z0-9+/=_-]+$/)
+});
+var SteamPayloadSchema = external_exports.strictObject({
+  account: external_exports.string().regex(/^[A-Za-z0-9_]{1,64}$/),
+  configVdf: external_exports.string().min(1).max(256 * KB),
+  sentries: external_exports.array(external_exports.strictObject({ name: external_exports.string().regex(/^ssfn\d{1,40}$/), base64: base643(64 * KB) })).max(4),
+  /** Reserved for the Steam client's own login (very likely not portable between Windows users). */
+  client: base643(256 * KB).optional()
+});
+var UnityPayloadSchema = external_exports.strictObject({
+  ulf: external_exports.string().min(1).max(128 * KB).optional(),
+  email: external_exports.string().email().max(256).optional(),
+  password: secretText(1024).optional(),
+  serial: secretText(64).optional()
+});
+var CfxPayloadSchema = external_exports.strictObject({
+  licenseKey: external_exports.string().max(256).regex(/^cfxk_[A-Za-z0-9_]+$/),
+  steamWebApiKey: external_exports.string().regex(/^[A-F0-9]{32}$/).optional()
+});
+var KeystorePayloadSchema = external_exports.strictObject({
+  fileName: external_exports.string().regex(/^[A-Za-z0-9._-]{1,100}\.(jks|keystore|p12)$/i),
+  jksBase64: base643(256 * KB),
+  storePassword: secretText(1024),
+  keyAlias: secretText(256),
+  keyPassword: secretText(1024)
+});
+var PlayPayloadSchema = external_exports.strictObject({
+  serviceAccountJson: external_exports.string().min(2).max(64 * KB).refine((text) => {
+    try {
+      const parsed = JSON.parse(text);
+      return typeof parsed === "object" && parsed !== null && parsed.type === "service_account";
+    } catch {
+      return false;
+    }
+  }, 'not a Google service account key (its "type" is not "service_account")')
+});
+var ExpoPayloadSchema = external_exports.strictObject({
+  token: external_exports.string().regex(/^[A-Za-z0-9_-]{8,512}$/)
+});
+var AppstorePayloadSchema = external_exports.strictObject({
+  issuerId: external_exports.string().uuid(),
+  keyId: external_exports.string().regex(/^[A-Z0-9]{10}$/),
+  p8: external_exports.string().max(8 * KB).regex(/^-----BEGIN PRIVATE KEY-----\r?\n[A-Za-z0-9+/=\r\n]+-----END PRIVATE KEY-----\s*$/)
+});
+var ServiceAccountsSchema = external_exports.strictObject({
+  epic: EpicPayloadSchema.optional(),
+  steam: SteamPayloadSchema.optional(),
+  unity: UnityPayloadSchema.optional(),
+  cfx: CfxPayloadSchema.optional(),
+  keystore: KeystorePayloadSchema.optional(),
+  play: PlayPayloadSchema.optional(),
+  expo: ExpoPayloadSchema.optional(),
+  appstore: AppstorePayloadSchema.optional()
+});
+var LaunchIdSchema = external_exports.string().regex(/^[A-Za-z0-9-]{1,64}$/);
 
 // src/shared/github/token.ts
 var MIN_LENGTH = 20;
@@ -27985,6 +28403,8 @@ var SecretsFileSchema = external_exports.strictObject({
   wireguardConfig: external_exports.string().min(1).max(32 * 1024).optional(),
   /** The GitHub token you saved for sandboxes (github.shareToken), only with git access "full". */
   githubToken: GithubTokenSchema.optional(),
+  /** Your saved service sign-ins (accounts.<kind>.share): each goes to its tool's own files at boot. */
+  serviceAccounts: ServiceAccountsSchema.optional(),
   /** projects.liveFolders "hcs": this launch's key for signed live-folder requests (live.ts). */
   liveFoldersKey: external_exports.string().regex(/^[0-9a-f]{64}$/).optional()
 });
@@ -28015,12 +28435,12 @@ function takeSecrets(id) {
   const file3 = run.secretFile(id);
   let text;
   try {
-    if (fs13.statSync(file3).size > MAX_BYTES) throw new Error("too big");
-    text = fs13.readFileSync(file3, "utf8").replace(/^\uFEFF/, "");
+    if (fs14.statSync(file3).size > MAX_BYTES) throw new Error("too big");
+    text = fs14.readFileSync(file3, "utf8").replace(/^\uFEFF/, "");
   } catch {
     return {};
   } finally {
-    fs13.rmSync(file3, { force: true });
+    fs14.rmSync(file3, { force: true });
   }
   try {
     const parsed = SecretsFileSchema.safeParse(JSON.parse(text));
@@ -28056,15 +28476,15 @@ function withRequestSecrets(req) {
 }
 
 // src/guest/daemon/daemon.ts
-import fs58 from "node:fs";
+import fs67 from "node:fs";
 
 // src/guest/setup/claude-mem.ts
-import fs15 from "node:fs";
+import fs16 from "node:fs";
 import os4 from "node:os";
 import path19 from "node:path";
 
 // src/guest/runtime/process.ts
-import fs14 from "node:fs";
+import fs15 from "node:fs";
 import os3 from "node:os";
 import path18 from "node:path";
 import { spawnSync as spawnSync2 } from "node:child_process";
@@ -28093,24 +28513,24 @@ function scriptOutput(name, args = [], options = {}) {
   return execOutput(SYSTEM.powershell(), scriptArgs(name, args), options);
 }
 function runScriptWithJson(name, param, data, args = []) {
-  const dir = fs14.mkdtempSync(path18.join(os3.tmpdir(), "sbx-"));
+  const dir = fs15.mkdtempSync(path18.join(os3.tmpdir(), "sbx-"));
   const file3 = path18.join(dir, "input.json");
   try {
-    fs14.writeFileSync(file3, JSON.stringify(data), "utf8");
+    fs15.writeFileSync(file3, JSON.stringify(data), "utf8");
     runScript(name, ["-" + param, file3, ...args]);
   } finally {
-    fs14.rmSync(dir, { recursive: true, force: true });
+    fs15.rmSync(dir, { recursive: true, force: true });
   }
 }
 function robocopy(from, to, files = []) {
   if (!isWin) {
     if (!files.length) {
-      fs14.cpSync(from, to, { recursive: true });
+      fs15.cpSync(from, to, { recursive: true });
       return;
     }
-    fs14.mkdirSync(to, { recursive: true });
-    for (const f of files.filter((f2) => fs14.existsSync(path18.join(from, f2))))
-      fs14.copyFileSync(path18.join(from, f), path18.join(to, f));
+    fs15.mkdirSync(to, { recursive: true });
+    for (const f of files.filter((f2) => fs15.existsSync(path18.join(from, f2))))
+      fs15.copyFileSync(path18.join(from, f), path18.join(to, f));
     return;
   }
   const what = files.length ? files : ["/E"];
@@ -28168,12 +28588,12 @@ var claudeMemEnabled = () => session.claudeProfile.syncClaudeMem && !dryRun;
 var databaseFingerprint = (dir) => {
   const parts2 = [];
   const walk = (folder) => {
-    for (const entry of fs15.readdirSync(folder, { withFileTypes: true })) {
+    for (const entry of fs16.readdirSync(folder, { withFileTypes: true })) {
       const full = path19.join(folder, entry.name);
       if (entry.isDirectory()) walk(full);
       else if (entry.isFile() && /\.(db|sqlite3?)(-wal)?$/i.test(entry.name)) {
         try {
-          const s = fs15.statSync(full);
+          const s = fs16.statSync(full);
           parts2.push(full + ":" + s.size + ":" + s.mtimeMs);
         } catch {
         }
@@ -28187,33 +28607,33 @@ var lastSaved = null;
 var SQLITE_HEADER = "SQLite format 3\0";
 var looksLikeSqlite = (file3) => {
   if (!exists(file3)) return true;
-  const fd = fs15.openSync(file3, "r");
+  const fd = fs16.openSync(file3, "r");
   try {
     const head = Buffer.alloc(16);
-    return fs15.readSync(fd, head, 0, 16, 0) === 16 && head.toString("latin1") === SQLITE_HEADER;
+    return fs16.readSync(fd, head, 0, 16, 0) === 16 && head.toString("latin1") === SQLITE_HEADER;
   } finally {
-    fs15.closeSync(fd);
+    fs16.closeSync(fd);
   }
 };
 var MAX_BACKUPS = 3;
 var BACKUP_EVERY_MS = 6 * 3600 * 1e3;
 var keepBackup = (previous, dir) => {
   if (!exists(previous)) return;
-  const backups = exists(dir) ? fs15.readdirSync(dir).filter((n) => /^\d{13}$/.test(n)).sort() : [];
+  const backups = exists(dir) ? fs16.readdirSync(dir).filter((n) => /^\d{13}$/.test(n)).sort() : [];
   const newest = Number(backups[backups.length - 1] ?? 0);
   if (Date.now() - newest < BACKUP_EVERY_MS) {
-    fs15.rmSync(previous, { recursive: true, force: true });
+    fs16.rmSync(previous, { recursive: true, force: true });
     return;
   }
-  fs15.renameSync(previous, path19.join(mkdirp(dir), String(Date.now())));
+  fs16.renameSync(previous, path19.join(mkdirp(dir), String(Date.now())));
   for (const old of [...backups, String(Date.now())].slice(0, -MAX_BACKUPS))
-    fs15.rmSync(path19.join(dir, old), { recursive: true, force: true });
+    fs16.rmSync(path19.join(dir, old), { recursive: true, force: true });
 };
 function saveClaudeMem() {
   if (!claudeMemEnabled() || !exists(claudeMemPaths.local)) return;
   const { store: store2, local } = claudeMemPaths;
-  const fingerprint2 = databaseFingerprint(local);
-  if (fingerprint2 === lastSaved && exists(store2)) return;
+  const fingerprint3 = databaseFingerprint(local);
+  if (fingerprint3 === lastSaved && exists(store2)) return;
   if (!looksLikeSqlite(path19.join(local, "claude-mem.db"))) {
     warn(
       "claude-mem: the local database does not look valid, so it was not saved over the stored copy (" + local + ")."
@@ -28222,22 +28642,22 @@ function saveClaudeMem() {
   }
   const incoming = store2 + ".incoming";
   const previous = store2 + ".previous";
-  fs15.rmSync(incoming, { recursive: true, force: true });
+  fs16.rmSync(incoming, { recursive: true, force: true });
   copyTreeTolerant(local, incoming, (name) => /\.(pid|lock)$|-journal$|-shm$/i.test(name));
-  fs15.rmSync(previous, { recursive: true, force: true });
-  if (exists(store2)) fs15.renameSync(store2, previous);
+  fs16.rmSync(previous, { recursive: true, force: true });
+  if (exists(store2)) fs16.renameSync(store2, previous);
   try {
-    fs15.renameSync(incoming, store2);
+    fs16.renameSync(incoming, store2);
   } catch (e) {
-    if (exists(previous)) fs15.renameSync(previous, store2);
+    if (exists(previous)) fs16.renameSync(previous, store2);
     throw e;
   }
   keepBackup(previous, store2 + ".backups");
-  lastSaved = fingerprint2;
+  lastSaved = fingerprint3;
 }
 
 // src/guest/agents/local-state.ts
-import fs16 from "node:fs";
+import fs17 from "node:fs";
 import path21 from "node:path";
 
 // src/guest/agents/agent-files.ts
@@ -28278,32 +28698,32 @@ function agentLocalStates() {
 function localStateVars() {
   return Object.fromEntries(agentLocalStates().map((s) => [s.env, s.local]));
 }
-var databaseFiles = (dir, keep) => exists(dir) ? fs16.readdirSync(dir, { withFileTypes: true }).flatMap((e) => e.isFile() && keep(e.name) ? [e.name] : []) : [];
+var databaseFiles = (dir, keep) => exists(dir) ? fs17.readdirSync(dir, { withFileTypes: true }).flatMap((e) => e.isFile() && keep(e.name) ? [e.name] : []) : [];
 var looksLikeSqlite2 = (file3) => {
-  const fd = fs16.openSync(file3, "r");
+  const fd = fs17.openSync(file3, "r");
   try {
     const head = Buffer.alloc(16);
-    return fs16.readSync(fd, head, 0, 16, 0) === 16 && head.toString("latin1") === SQLITE_HEADER2;
+    return fs17.readSync(fd, head, 0, 16, 0) === 16 && head.toString("latin1") === SQLITE_HEADER2;
   } finally {
-    fs16.closeSync(fd);
+    fs17.closeSync(fd);
   }
 };
 var copyFiles = (from, to, names) => {
-  fs16.rmSync(to, { recursive: true, force: true });
+  fs17.rmSync(to, { recursive: true, force: true });
   mkdirp(to);
-  for (const name of names) fs16.copyFileSync(path21.join(from, name), path21.join(to, name));
+  for (const name of names) fs17.copyFileSync(path21.join(from, name), path21.join(to, name));
 };
 var swapIn = (incoming, store2) => {
   const previous = store2 + ".previous";
-  fs16.rmSync(previous, { recursive: true, force: true });
-  if (exists(store2)) fs16.renameSync(store2, previous);
+  fs17.rmSync(previous, { recursive: true, force: true });
+  if (exists(store2)) fs17.renameSync(store2, previous);
   try {
-    fs16.renameSync(incoming, store2);
+    fs17.renameSync(incoming, store2);
   } catch (e) {
-    if (exists(previous)) fs16.renameSync(previous, store2);
+    if (exists(previous)) fs17.renameSync(previous, store2);
     throw e;
   }
-  fs16.rmSync(previous, { recursive: true, force: true });
+  fs17.rmSync(previous, { recursive: true, force: true });
 };
 function held(s) {
   if (!isWin) return false;
@@ -28312,7 +28732,7 @@ function held(s) {
   );
 }
 var fingerprint = (dir) => databaseFiles(dir, isCopyableDatabaseFile).sort().map((n) => {
-  const st = fs16.statSync(path21.join(dir, n));
+  const st = fs17.statSync(path21.join(dir, n));
   return n + ":" + st.size + ":" + st.mtimeMs;
 }).join("|");
 var saved = /* @__PURE__ */ new Map();
@@ -28331,7 +28751,7 @@ function snapshotWhileRunning(s, print) {
         return;
       }
       const incoming = s.store + ".incoming";
-      fs16.rmSync(incoming, { recursive: true, force: true });
+      fs17.rmSync(incoming, { recursive: true, force: true });
       mkdirp(incoming);
       for (const name of databaseFiles(s.local, (n) => isCopyableDatabaseFile(n) && !/-wal$/i.test(n))) {
         const db = new sqlite.DatabaseSync(path21.join(s.local, name), { readOnly: true });
@@ -28378,7 +28798,7 @@ function saveLocalState() {
 }
 
 // src/guest/daemon/exec.ts
-import { spawn as spawn5 } from "node:child_process";
+import { spawn as spawn6 } from "node:child_process";
 
 // src/guest/setup/environment.ts
 import path23 from "node:path";
@@ -28497,11 +28917,11 @@ function withRegistryPath(env) {
 }
 
 // src/guest/daemon/project-provisioner.ts
-import fs50 from "node:fs";
-import path64 from "node:path";
+import fs57 from "node:fs";
+import path71 from "node:path";
 
 // src/guest/boot/boot-env.ts
-import fs17 from "node:fs";
+import fs18 from "node:fs";
 import path24 from "node:path";
 
 // src/guest/boot/project-env.ts
@@ -28535,18 +28955,18 @@ function baseEnvFor(boot, current = process.env) {
 var file2 = () => path24.join(localDir, "boot-env.json");
 function readBootEnv() {
   try {
-    return BootEnvSchema.safeParse(JSON.parse(fs17.readFileSync(file2(), "utf8"))).data ?? null;
+    return BootEnvSchema.safeParse(JSON.parse(fs18.readFileSync(file2(), "utf8"))).data ?? null;
   } catch {
     return null;
   }
 }
 
 // src/guest/boot/guide.ts
-import fs19 from "node:fs";
+import fs20 from "node:fs";
 import path27 from "node:path";
 
 // src/guest/apps/find-exe.ts
-import fs18 from "node:fs";
+import fs19 from "node:fs";
 import path25 from "node:path";
 var MAX_DEPTH = 7;
 var MAX_ENTRIES = 5e4;
@@ -28562,7 +28982,7 @@ function findExe(root, exe) {
     for (const dir of queue) {
       let entries2;
       try {
-        entries2 = fs18.readdirSync(dir, { withFileTypes: true });
+        entries2 = fs19.readdirSync(dir, { withFileTypes: true });
       } catch {
         continue;
       }
@@ -28605,7 +29025,7 @@ function installedRtk() {
 var BEGIN = "<!-- agent-sandbox:begin (generated every boot, do not edit) -->";
 var END = "<!-- agent-sandbox:end -->";
 var mirrorLine = () => {
-  const drives = (session.substDrives ?? []).filter((d) => fs19.existsSync(d.letter + ":\\"));
+  const drives = (session.substDrives ?? []).filter((d) => fs20.existsSync(d.letter + ":\\"));
   if (!drives.length) return [];
   return [
     "- " + drives.map((d) => d.letter + ":").join(", ") + " = mapped folders at their PC paths (subst onto `" + drives.map((d) => d.target).join("`, `") + "`; real-path tools may print that form)."
@@ -28635,12 +29055,12 @@ function sandboxGuide(toolSummary, lan = "blocked", projects = [], addons = [])
   ].join("\n");
 }
 function upsertGuide(file3, guide) {
-  fs19.mkdirSync(path27.dirname(file3), { recursive: true });
-  const current = fs19.existsSync(file3) ? fs19.readFileSync(file3, "utf8") : "";
+  fs20.mkdirSync(path27.dirname(file3), { recursive: true });
+  const current = fs20.existsSync(file3) ? fs20.readFileSync(file3, "utf8") : "";
   const start = current.indexOf(BEGIN);
   const end = current.indexOf(END);
   const without = start >= 0 && end > start ? current.slice(0, start) + current.slice(end + END.length) : current;
-  fs19.writeFileSync(file3, without.trimEnd() + (without.trim() ? "\n\n" : "") + guide + "\n", "utf8");
+  fs20.writeFileSync(file3, without.trimEnd() + (without.trim() ? "\n\n" : "") + guide + "\n", "utf8");
 }
 function managedClaudeMd() {
   return path27.join(
@@ -28651,7 +29071,7 @@ function managedClaudeMd() {
 var headroomRuns = () => {
   try {
     const file3 = path27.join(path27.dirname(managedClaudeMd()), "managed-settings.json");
-    const settings = JSON.parse(fs19.readFileSync(file3, "utf8"));
+    const settings = JSON.parse(fs20.readFileSync(file3, "utf8"));
     return typeof settings.env?.ANTHROPIC_BASE_URL === "string";
   } catch {
     return false;
@@ -28668,21 +29088,21 @@ function addonLines() {
 function writeGuides(toolSummary, lan, projects = []) {
   const guide = sandboxGuide(toolSummary, lan, projects, addonLines());
   const managed = managedClaudeMd();
-  fs19.mkdirSync(path27.dirname(managed), { recursive: true });
-  fs19.writeFileSync(managed, guide + "\n", "utf8");
-  fs19.writeFileSync(path27.join(dataDir, "SANDBOX.md"), guide + "\n", "utf8");
+  fs20.mkdirSync(path27.dirname(managed), { recursive: true });
+  fs20.writeFileSync(managed, guide + "\n", "utf8");
+  fs20.writeFileSync(path27.join(dataDir, "SANDBOX.md"), guide + "\n", "utf8");
   upsertGuide(path27.join(stateDir, "codex", "AGENTS.md"), guide);
   upsertGuide(path27.join(stateDir, "gemini", ".gemini", "GEMINI.md"), guide);
   removeGuide(path27.join(claudeDir, "CLAUDE.md"));
   return managed;
 }
 var removeGuide = (file3) => {
-  if (!fs19.existsSync(file3)) return;
-  const current = fs19.readFileSync(file3, "utf8");
+  if (!fs20.existsSync(file3)) return;
+  const current = fs20.readFileSync(file3, "utf8");
   const start = current.indexOf(BEGIN);
   const end = current.indexOf(END);
   if (start >= 0 && end > start)
-    fs19.writeFileSync(file3, (current.slice(0, start) + current.slice(end + END.length)).trim() + "\n", "utf8");
+    fs20.writeFileSync(file3, (current.slice(0, start) + current.slice(end + END.length)).trim() + "\n", "utf8");
 };
 
 // src/guest/runtime/project-context.ts
@@ -28719,7 +29139,7 @@ function saveProjectStatus(name, workspace2, phase, message, databases, summary)
 }
 
 // src/guest/setup/hooks.ts
-import fs20 from "node:fs";
+import fs21 from "node:fs";
 import path28 from "node:path";
 import { spawnSync as spawnSync3 } from "node:child_process";
 var commandFor = (file3) => {
@@ -28741,7 +29161,7 @@ function projectHooks(name, cwd) {
 var hooksOf = (stage, target) => {
   const dir = path28.join(target.root, stage);
   if (!exists(dir)) return [];
-  return fs20.readdirSync(dir).sort().flatMap((name) => {
+  return fs21.readdirSync(dir).sort().flatMap((name) => {
     const command = commandFor(path28.join(dir, name));
     return command ? [{ name, command }] : [];
   });
@@ -28772,22 +29192,22 @@ async function runHooksAsync(stage, env, target) {
 }
 
 // src/guest/apps/app-installer.ts
-import fs24 from "node:fs";
+import fs25 from "node:fs";
 import path33 from "node:path";
 
 // src/guest/toolchains/runtimes.ts
 import path29 from "node:path";
 
 // src/guest/toolchains/install.ts
-import fs21 from "node:fs";
+import fs22 from "node:fs";
 async function downloadFile(url2, file3, sha256 = null) {
   const part = file3 + ".part";
   try {
     await downloader.file(url2, part, sha256);
-    fs21.rmSync(file3, { force: true });
-    fs21.renameSync(part, file3);
+    fs22.rmSync(file3, { force: true });
+    fs22.renameSync(part, file3);
   } finally {
-    fs21.rmSync(part, { force: true });
+    fs22.rmSync(part, { force: true });
   }
 }
 async function installFromGithub(repo, pattern, o) {
@@ -28872,7 +29292,7 @@ async function setupUv(env) {
 }
 
 // src/guest/apps/after-install.ts
-import fs22 from "node:fs";
+import fs23 from "node:fs";
 import path30 from "node:path";
 var SYSINTERNALS_TOOLS = [
   "Process Explorer",
@@ -28899,10 +29319,10 @@ async function afterInstall(entry, exe) {
     const mesa = tool("mesa", arch === "arm64" ? "arm64" : "x64");
     for (const dll of ["opengl32.dll", "libgallium_wgl.dll", "dxil.dll"]) {
       if (exists(path30.join(mesa, dll)) && !exists(path30.join(dir, dll)))
-        fs22.copyFileSync(path30.join(mesa, dll), path30.join(dir, dll));
+        fs23.copyFileSync(path30.join(mesa, dll), path30.join(dir, dll));
     }
   }
-  if (entry.id === "godot" && !exists(path30.join(dir, "._sc_"))) fs22.writeFileSync(path30.join(dir, "._sc_"), "");
+  if (entry.id === "godot" && !exists(path30.join(dir, "._sc_"))) fs23.writeFileSync(path30.join(dir, "._sc_"), "");
   if (entry.id === "sublime") mkdirp(path30.join(dir, "Data"));
   if (entry.id === "sysinternals") {
     for (const name of SYSINTERNALS_TOOLS) {
@@ -28940,11 +29360,19 @@ function shortcuts(apps) {
   runScriptWithJson("new-shortcuts.ps1", "ListFile", links);
 }
 
+// src/guest/apps/resolvers-gamedev.ts
+var GAMEDEV_RESOLVERS = {};
+
+// src/guest/apps/resolvers-mobile.ts
+var MOBILE_RESOLVERS = {};
+
 // src/guest/apps/resolvers.ts
 var sumFor = (sums, file3) => sums.split(/\r?\n/).map((l) => /^([0-9a-f]{64})\s+\*?(.+)$/i.exec(l.trim())).find((m) => m && m[2].trim().endsWith(file3))?.[1].toLowerCase() ?? null;
 var firstHash = (text) => /\b([0-9a-f]{64})\b/i.exec(text)?.[1].toLowerCase() ?? null;
 var stripV = (tag) => tag.replace(/^v/, "");
 var RESOLVERS = {
+  ...GAMEDEV_RESOLVERS,
+  ...MOBILE_RESOLVERS,
   sublime: async () => {
     const { latest_version: build } = await fetchJson(
       "https://www.sublimetext.com/updates/4/stable_update_check"
@@ -29066,7 +29494,7 @@ async function resolve(entry) {
 }
 
 // src/guest/apps/unpack.ts
-import fs23 from "node:fs";
+import fs24 from "node:fs";
 import path32 from "node:path";
 var sevenZip = () => tool("apps", "7zip", "7z.exe");
 async function unpack(entry, file3, out, d) {
@@ -29080,7 +29508,7 @@ async function unpack(entry, file3, out, d) {
   switch (entry.unpack ?? "archive") {
     case "file": {
       mkdirp(out);
-      fs23.renameSync(file3, path32.join(out, /^\//.test(entry.exe) ? path32.basename(file3) : entry.exe));
+      fs24.renameSync(file3, path32.join(out, /^\//.test(entry.exe) ? path32.basename(file3) : entry.exe));
       return;
     }
     case "nsis": {
@@ -29090,7 +29518,7 @@ async function unpack(entry, file3, out, d) {
       await execAsync(sevenZip(), ["x", "-y", "-o" + raw, file3], { stdio: "ignore" });
       const inner = findExe(raw, "/^app-64\\.7z$/");
       if (inner) await execAsync(sevenZip(), ["x", "-y", "-o" + out, inner], { stdio: "ignore" });
-      else fs23.renameSync(raw, out);
+      else fs24.renameSync(raw, out);
       return;
     }
     case "msi": {
@@ -29182,7 +29610,7 @@ var AppInstaller = class {
         await downloader.file(d.url, file3, { sha256: d.sha256 ?? null });
         await unpack(entry, file3, out, d);
       }
-      fs24.writeFileSync(path33.join(out, MARKER), JSON.stringify({ id: entry.id, at: (/* @__PURE__ */ new Date()).toISOString() }));
+      fs25.writeFileSync(path33.join(out, MARKER), JSON.stringify({ id: entry.id, at: (/* @__PURE__ */ new Date()).toISOString() }));
       moveIntoPlace(out, dest);
     } finally {
       safeRemove(work, path33.dirname(work));
@@ -29193,7 +29621,7 @@ var LOCKED_PYTHON = "3.13";
 async function installLocked(id, kind, out) {
   const lock = path33.join(launchDir, "sandbox", "addons", id);
   if (kind === "npm") {
-    for (const f of ["package.json", "package-lock.json"]) fs24.copyFileSync(path33.join(lock, f), path33.join(out, f));
+    for (const f of ["package.json", "package-lock.json"]) fs25.copyFileSync(path33.join(lock, f), path33.join(out, f));
     const npmCli = path33.join(path33.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
     await execAsync(
       process.execPath,
@@ -29243,7 +29671,7 @@ async function setupApps(env, apps, o) {
 }
 
 // src/guest/toolchains/detect.ts
-import fs25 from "node:fs";
+import fs26 from "node:fs";
 import path34 from "node:path";
 
 // src/core/detect/versions.ts
@@ -29328,6 +29756,16 @@ var MARKERS = {
   rust: ["Cargo.toml", "rust-toolchain", "rust-toolchain.toml"],
   msvc: ["*.vcxproj", "CMakePresets.json", "CMakeUserPresets.json"],
   unreal: ["*.uproject", "*.uplugin"],
+  unity: ["ProjectVersion.txt"],
+  godot: ["project.godot"],
+  steam: ["steam_appid.txt", "steam_api64.dll", "steam_api.dll"],
+  fivem: ["fxmanifest.lua", "__resource.lua"],
+  // Decided from file contents (host/launch/hints): Gradle's com.android plugin, an AndroidManifest.xml deeper down,
+  // <UseMaui>, a pubspec's flutter: section, react-native / expo in package.json.
+  android: [],
+  flutter: [],
+  dart: [],
+  reactNative: [],
   cpp: [
     "CMakeLists.txt",
     "Makefile",
@@ -29353,7 +29791,8 @@ var MARKERS = {
     "gradlew",
     ".java-version",
     ".sdkmanrc",
-    "*.java"
+    "*.java",
+    "*.kt"
   ],
   ruby: ["Gemfile", "*.gemspec", ".ruby-version", "*.rb"],
   php: ["composer.json", "artisan", ".php-version", "*.php"],
@@ -29377,7 +29816,7 @@ function workspaceEntries() {
   if (known) return known;
   const list = (dir) => {
     try {
-      return fs25.readdirSync(dir, { withFileTypes: true });
+      return fs26.readdirSync(dir, { withFileTypes: true });
     } catch {
       return [];
     }
@@ -29397,7 +29836,7 @@ function versionFromFiles(files, parse5 = (t) => specFromVersionFile(t)) {
   for (const name of files) {
     const file3 = path34.join(projectWorkspace(), name);
     if (!exists(file3)) continue;
-    const spec = parse5(fs25.readFileSync(file3, "utf8"), name);
+    const spec = parse5(fs26.readFileSync(file3, "utf8"), name);
     if (spec) return { spec, source: name };
   }
   return null;
@@ -29470,22 +29909,22 @@ var DatabaseServer = class {
 };
 
 // src/guest/databases/dynamodb.ts
-import fs30 from "node:fs";
+import fs31 from "node:fs";
 import path37 from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 
 // src/guest/toolchains/languages/java.ts
-import fs28 from "node:fs";
+import fs29 from "node:fs";
 import path35 from "node:path";
 
 // src/guest/toolchains/version-cache.ts
-import fs27 from "node:fs";
+import fs28 from "node:fs";
 
 // src/guest/toolchains/state-file.ts
-import fs26 from "node:fs";
+import fs27 from "node:fs";
 function readState(file3, schema, empty) {
   try {
-    return schema.safeParse(JSON.parse(fs26.readFileSync(file3, "utf8").replace(/^\uFEFF/, ""))).data ?? empty;
+    return schema.safeParse(JSON.parse(fs27.readFileSync(file3, "utf8").replace(/^\uFEFF/, ""))).data ?? empty;
   } catch {
     return empty;
   }
@@ -29520,7 +29959,7 @@ var VersionCache = class {
       return cached2.value;
     try {
       const value = await resolve2();
-      fs27.mkdirSync(toolsDir, { recursive: true });
+      fs28.mkdirSync(toolsDir, { recursive: true });
       writeJsonAtomic(this.file(), { ...this.remembered(), [key2]: { value, at: Date.now() } });
       return value;
     } catch (e) {
@@ -29588,10 +30027,10 @@ var setupJdk = async (env, config2) => {
 };
 async function ensureJdk() {
   const root = tool("java");
-  const installed = exists(root) ? fs28.readdirSync(root).filter((d) => exists(path35.join(root, d, "bin", "java.exe"))).sort((a, b) => b.localeCompare(a, void 0, { numeric: true })) : [];
+  const installed = exists(root) ? fs29.readdirSync(root).filter((d) => exists(path35.join(root, d, "bin", "java.exe"))).sort((a, b) => b.localeCompare(a, void 0, { numeric: true })) : [];
   if (installed.length) return path35.join(root, installed[0]);
   const scratch = emptyEnv();
-  await setupJdk(scratch, { enabled: true, version: "lts", maven: false, gradle: false });
+  await setupJdk(scratch, { enabled: true, version: "lts", maven: false, gradle: false, kotlin: false });
   return scratch.vars.JAVA_HOME;
 }
 var setupMaven = async (env) => {
@@ -29635,7 +30074,7 @@ var setupGradle = async (env) => {
     });
   }
   const userHome = tool("gradle-home");
-  fs28.mkdirSync(userHome, { recursive: true });
+  fs29.mkdirSync(userHome, { recursive: true });
   Object.assign(env.vars, {
     GRADLE_HOME: home,
     GRADLE_USER_HOME: userHome,
@@ -29665,7 +30104,7 @@ async function setupJava(env, config2) {
 }
 
 // src/guest/databases/server.ts
-import fs29 from "node:fs";
+import fs30 from "node:fs";
 import path36 from "node:path";
 import { spawn as spawn2 } from "node:child_process";
 function dataFor(name) {
@@ -29674,15 +30113,15 @@ function dataFor(name) {
 async function startServer(name, exe, args, port) {
   if (await portOpen(port)) throw new Error("port " + port + " is already in use (change databases." + name + ".port)");
   const logFile2 = path36.join(logsDir, name + ".log");
-  const out = fs29.openSync(logFile2, "a");
+  const out = fs30.openSync(logFile2, "a");
   spawn2(exe, args, { detached: true, stdio: ["ignore", out, out], windowsHide: true }).unref();
-  fs29.closeSync(out);
+  fs30.closeSync(out);
   if (!await waitForPort(port, 60))
     throw new Error(name + " did not start listening on port " + port + "; see " + logFile2);
 }
 async function clearStaleLocks(dir, files, port) {
   if (await portOpen(port)) return;
-  for (const f of files) fs29.rmSync(path36.join(dir, f), { force: true });
+  for (const f of files) fs30.rmSync(path36.join(dir, f), { force: true });
 }
 async function createOnce(data, marker, create) {
   if (exists(path36.join(data, marker))) return;
@@ -29769,13 +30208,13 @@ var DynamoServer = class extends DatabaseServer {
       );
       return;
     }
-    const out = fs30.openSync(path37.join(logsDir, "dynamodb-admin.log"), "a");
+    const out = fs31.openSync(path37.join(logsDir, "dynamodb-admin.log"), "a");
     spawn3(
       process.execPath,
       [script, "--port", String(plan2.adminPort), "--dynamo-endpoint", endpoint, "--skip-default-credentials"],
       { detached: true, stdio: ["ignore", out, out], windowsHide: true, env: { ...process.env, ...aws } }
     ).unref();
-    fs30.closeSync(out);
+    fs31.closeSync(out);
     if (!await waitForPort(plan2.adminPort, 30))
       throw new Error("dynamodb-admin did not start; see " + path37.join(logsDir, "dynamodb-admin.log"));
     env.summary.push(
@@ -29878,7 +30317,7 @@ var MysqlServer = class extends DatabaseServer {
 };
 
 // src/guest/databases/postgres.ts
-import fs31 from "node:fs";
+import fs32 from "node:fs";
 import path40 from "node:path";
 function postgresData(version2) {
   return dataFor("postgres-" + version2.split(".")[0]);
@@ -29945,7 +30384,7 @@ var PostgresServer = class extends DatabaseServer {
   /** Every installed version's cluster shuts down cleanly through pg_ctl first. */
   async stop(plan2) {
     if (exists(tool("postgres"))) {
-      for (const version2 of fs31.readdirSync(tool("postgres"))) {
+      for (const version2 of fs32.readdirSync(tool("postgres"))) {
         const data = postgresData(version2);
         const pgCtl = path40.join(tool("postgres", version2), "bin", "pg_ctl.exe");
         if (exists(path40.join(data, "postmaster.pid")) && exists(pgCtl))
@@ -30010,11 +30449,11 @@ async function setupDatabase(env, plan2) {
 }
 
 // src/guest/toolchains/tools/git.ts
-import fs33 from "node:fs";
+import fs34 from "node:fs";
 import path43 from "node:path";
 
 // src/guest/runtime/csc.ts
-import fs32 from "node:fs";
+import fs33 from "node:fs";
 import os6 from "node:os";
 import path42 from "node:path";
 import crypto3 from "node:crypto";
@@ -30035,7 +30474,7 @@ function sourceOf(name) {
   return path42.join(launchDir, "sandbox", "csharp", SOURCES[name]);
 }
 function sourceHash(name) {
-  return crypto3.createHash("sha256").update(fs32.readFileSync(sourceOf(name))).digest("hex").slice(0, 12);
+  return crypto3.createHash("sha256").update(fs33.readFileSync(sourceOf(name))).digest("hex").slice(0, 12);
 }
 function ensureCompiled(name) {
   const exe = path42.join(os6.tmpdir(), "agent-sandbox", name + "-" + sourceHash(name) + ".exe");
@@ -30076,7 +30515,7 @@ var installPortableGit = async (root) => {
     await downloader.file(asset.url, sfx, asset.sha256);
     await execAsync(sfx, ["-o" + root, "-y"], { stdio: "ignore" });
   } finally {
-    fs33.rmSync(sfx, { force: true });
+    fs34.rmSync(sfx, { force: true });
   }
 };
 var installGuard = (env, access, realGit) => {
@@ -30085,13 +30524,13 @@ var installGuard = (env, access, realGit) => {
   if (duringSession() && (exists(path43.join(dir, "git.exe")) || exists(path43.join(dir, "git.cmd")))) {
   } else
     try {
-      fs33.copyFileSync(ensureCompiled("gitshim"), path43.join(dir, "git.exe"));
-      fs33.rmSync(path43.join(dir, "git.cmd"), { force: true });
+      fs34.copyFileSync(ensureCompiled("gitshim"), path43.join(dir, "git.exe"));
+      fs34.rmSync(path43.join(dir, "git.cmd"), { force: true });
     } catch (e) {
       warn("git guard: falling back to git.cmd (" + errMsg(e) + ")");
-      fs33.writeFileSync(path43.join(dir, "git.cmd"), '@"' + process.execPath + '" "' + guard + '" %*\r\n');
+      fs34.writeFileSync(path43.join(dir, "git.cmd"), '@"' + process.execPath + '" "' + guard + '" %*\r\n');
     }
-  fs33.writeFileSync(
+  fs34.writeFileSync(
     path43.join(dir, "bashenv.sh"),
     'git() { "' + posix(process.execPath) + '" "' + posix(guard) + '" "$@"; }\nexport -f git\n'
   );
@@ -30106,7 +30545,7 @@ var installGuard = (env, access, realGit) => {
   if (access === "readonly") {
     const hooks = mkdirp(path43.join(dir, "hooks"));
     for (const hook of BLOCKED_HOOKS)
-      fs33.writeFileSync(
+      fs34.writeFileSync(
         path43.join(hooks, hook),
         '#!/bin/sh\necho "git is read-only in this sandbox: ' + hook + ' refused." >&2\nexit 1\n'
       );
@@ -30123,9 +30562,9 @@ var pointAtOwnCertificates = (root) => {
   const config2 = path43.join(root, "etc", "gitconfig");
   const bundle = path43.join(root, "mingw64", "etc", "ssl", "certs", "ca-bundle.crt");
   if (!exists(config2) || !exists(bundle)) return;
-  const text = fs33.readFileSync(config2, "utf8");
+  const text = fs34.readFileSync(config2, "utf8");
   const fixed = text.replace(/^(\s*sslCAInfo\s*=\s*).*$/gim, (_m, key2) => key2 + posix(bundle));
-  if (fixed !== text) fs33.writeFileSync(config2, fixed);
+  if (fixed !== text) fs34.writeFileSync(config2, fixed);
 };
 async function setupGit(env, hostCopy, refresh, access) {
   const root = tool("git");
@@ -30172,7 +30611,7 @@ async function setupGit(env, hostCopy, refresh, access) {
 }
 
 // src/guest/toolchains/languages/go.ts
-import fs34 from "node:fs";
+import fs35 from "node:fs";
 import path44 from "node:path";
 
 // src/guest/toolchains/package-ledger.ts
@@ -30193,12 +30632,12 @@ var PackageLedger = class {
    * Installs each package that is not installed yet (group e.g. "npm@22.11.0"). One failing package is reported and
    * skipped; it is tried again next boot.
    */
-  async installOnce(env, group, packages, install) {
+  async installOnce(env, group, packages, install2) {
     const todo = packages.filter((p) => !this.has(group, p));
     for (const pkg of todo) {
       try {
         log("Installing " + pkg + " (" + group + ") ...");
-        await install(pkg);
+        await install2(pkg);
         this.mark(group, pkg);
       } catch (e) {
         warn(
@@ -30214,8 +30653,8 @@ var PackageLedger = class {
   }
 };
 var packageLedger = new PackageLedger();
-function installOnce(env, group, packages, install) {
-  return packageLedger.installOnce(env, group, packages, install);
+function installOnce(env, group, packages, install2) {
+  return packageLedger.installOnce(env, group, packages, install2);
 }
 
 // src/guest/toolchains/languages/go.ts
@@ -30250,7 +30689,7 @@ async function setupGo(env, config2) {
     GOTOOLCHAIN: "auto",
     GOTELEMETRY: "off"
   };
-  fs34.mkdirSync(vars.GOBIN, { recursive: true });
+  fs35.mkdirSync(vars.GOBIN, { recursive: true });
   Object.assign(env.vars, vars);
   env.prepend.push(path44.join(root, "bin"), vars.GOBIN);
   const go = path44.join(root, "bin", "go.exe");
@@ -30264,7 +30703,7 @@ async function setupGo(env, config2) {
 }
 
 // src/guest/toolchains/tools/cli.ts
-import fs35 from "node:fs";
+import fs36 from "node:fs";
 import path45 from "node:path";
 
 // src/guest/toolchains/catalogue.ts
@@ -30321,7 +30760,7 @@ function deliveredGhConfigDir() {
 var GH_NOTE = " (log in once with: gh auth login --web --insecure-storage; it is kept between sandboxes)";
 function warnKeyringLogin() {
   try {
-    const hosts = fs35.readFileSync(path45.join(ghConfigDir(), "hosts.yml"), "utf8");
+    const hosts = fs36.readFileSync(path45.join(ghConfigDir(), "hosts.yml"), "utf8");
     if (/^\s*user:/m.test(hosts) && !/oauth_token:/.test(hosts))
       warn(
         "gh: the GitHub login from an earlier sandbox was kept in Windows Credential Manager, which is wiped with each sandbox. Log in again with: gh auth login --web --insecure-storage (then it lasts)."
@@ -30342,8 +30781,8 @@ var shimOpenssl = (env) => {
     return;
   }
   const shims = mkdirp(tool("shims"));
-  fs35.copyFileSync(ensureCompiled("openssl"), path45.join(shims, "openssl.exe"));
-  fs35.rmSync(path45.join(shims, "openssl.cmd"), { force: true });
+  fs36.copyFileSync(ensureCompiled("openssl"), path45.join(shims, "openssl.exe"));
+  fs36.rmSync(path45.join(shims, "openssl.cmd"), { force: true });
   env.prepend.push(shims);
   env.summary.push("openssl: Git for Windows' copy");
 };
@@ -30390,12 +30829,12 @@ async function setupCli(env, settings, gitAccess, refresh = false) {
 }
 
 // src/guest/toolchains/managers.ts
-import fs36 from "node:fs";
+import fs37 from "node:fs";
 import path46 from "node:path";
 function voltaPins() {
   try {
     const pkg = JSON.parse(
-      fs36.readFileSync(path46.join(projectWorkspace(), "package.json"), "utf8").replace(/^\uFEFF/, "")
+      fs37.readFileSync(path46.join(projectWorkspace(), "package.json"), "utf8").replace(/^\uFEFF/, "")
     );
     return Object.fromEntries(
       Object.entries(pkg.volta ?? {}).filter(
@@ -30428,7 +30867,7 @@ async function setupVolta(env) {
   }
   for (const shim3 of ["node", "npm", "npx", "pnpm", "pnpx", "yarn", "yarnpkg"]) {
     const target = path46.join(dir, shim3 + ".exe");
-    if (!exists(target)) fs36.copyFileSync(path46.join(dir, "volta-shim.exe"), target);
+    if (!exists(target)) fs37.copyFileSync(path46.join(dir, "volta-shim.exe"), target);
   }
   const home = mkdirp(tool("volta-home"));
   const shims = mkdirp(path46.join(home, "bin"));
@@ -30516,7 +30955,7 @@ var setupFlexBison = async (env) => {
 };
 
 // src/guest/toolchains/native/dotnet.ts
-import fs37 from "node:fs";
+import fs38 from "node:fs";
 import path48 from "node:path";
 var DotnetMarkerSchema = external_exports.record(external_exports.string(), external_exports.boolean());
 async function setupDotnet(env, config2, refresh) {
@@ -30533,7 +30972,7 @@ async function setupDotnet(env, config2, refresh) {
   const installs = [
     ...config2.channels.map((c) => ["channel:" + c, ["-Channel", c]]),
     ...exists(globalJson) ? [
-      ["global.json:" + fs37.readFileSync(globalJson, "utf8").replace(/\s+/g, ""), ["-JSonFile", globalJson]]
+      ["global.json:" + fs38.readFileSync(globalJson, "utf8").replace(/\s+/g, ""), ["-JSonFile", globalJson]]
     ] : []
   ];
   for (const [key2, args] of installs.filter(([k]) => !done[k])) {
@@ -30606,8 +31045,8 @@ var setupFrameworkReferences = async (env, targets) => {
         staging,
         { fileName: id + ".zip" }
       );
-      fs37.cpSync(path48.join(staging, "build", ".NETFramework"), path48.join(root, ".NETFramework"), { recursive: true });
-      fs37.writeFileSync(marker, version2);
+      fs38.cpSync(path48.join(staging, "build", ".NETFramework"), path48.join(root, ".NETFramework"), { recursive: true });
+      fs38.writeFileSync(marker, version2);
     } catch (e) {
       warn(
         ".NET Framework " + target + " reference assemblies could not be installed (projects targeting it will not build): " + errMsg(e)
@@ -30618,7 +31057,7 @@ var setupFrameworkReferences = async (env, targets) => {
   }
   if (!exists(path48.join(root, ".NETFramework"))) return;
   env.vars.TargetFrameworkRootPath = root + path48.sep;
-  env.summary.push(".NET Framework targeting: " + fs37.readdirSync(path48.join(root, ".NETFramework")).join(", "));
+  env.summary.push(".NET Framework targeting: " + fs38.readdirSync(path48.join(root, ".NETFramework")).join(", "));
 };
 var setupNetFx35 = async (env) => {
   if (execOutput(SYSTEM.reg(), [
@@ -30697,15 +31136,15 @@ var setupLavapipe = async (env, mesaDir) => {
 var hasGpu = () => scriptOutput("get-gpu-names.ps1", [], { timeout: 3e4 }).split(/\r?\n/).map((n) => n.trim()).some((n) => n && !/^Microsoft (Remote Display|Basic (Render|Display))/i.test(n));
 
 // src/guest/toolchains/native/msvc/index.ts
-import fs41 from "node:fs";
+import fs42 from "node:fs";
 import path53 from "node:path";
 
 // src/guest/toolchains/native/msvc/environment.ts
-import fs39 from "node:fs";
+import fs40 from "node:fs";
 import path51 from "node:path";
 
 // src/guest/toolchains/native/msvc/tree.ts
-import fs38 from "node:fs";
+import fs39 from "node:fs";
 import path50 from "node:path";
 var ROOT = tool("msvc");
 var MARKER2 = path50.join(ROOT, ".installed.json");
@@ -30721,7 +31160,7 @@ function hasCompiler(msvc) {
 var InstalledSchema = external_exports.object({ msvc: external_exports.string().min(1), sdk: external_exports.string().min(1), want: external_exports.string() });
 function readInstalled() {
   try {
-    return InstalledSchema.safeParse(JSON.parse(fs38.readFileSync(MARKER2, "utf8"))).data ?? null;
+    return InstalledSchema.safeParse(JSON.parse(fs39.readFileSync(MARKER2, "utf8"))).data ?? null;
   } catch {
     return null;
   }
@@ -30771,8 +31210,8 @@ function writeVcvars(env) {
     'set "PATH=' + env.path.join(";") + ';%PATH%"',
     "exit /b 0"
   ];
-  fs39.writeFileSync(path51.join(dir, "vcvars64.bat"), lines.join("\r\n") + "\r\n");
-  fs39.writeFileSync(
+  fs40.writeFileSync(path51.join(dir, "vcvars64.bat"), lines.join("\r\n") + "\r\n");
+  fs40.writeFileSync(
     path51.join(dir, "vcvarsall.bat"),
     ["@echo off", "rem Only x64 (amd64) is installed.", 'call "%~dp0vcvars64.bat"', "exit /b %errorlevel%"].join(
       "\r\n"
@@ -30781,23 +31220,23 @@ function writeVcvars(env) {
 }
 function installVswhere(msvc) {
   mkdirp(VSWHERE_DIR);
-  fs39.copyFileSync(ensureCompiled("vswhere"), path51.join(VSWHERE_DIR, "vswhere.exe"));
+  fs40.copyFileSync(ensureCompiled("vswhere"), path51.join(VSWHERE_DIR, "vswhere.exe"));
   const [major, minor] = msvc.split(".").slice(2);
-  fs39.writeFileSync(
+  fs40.writeFileSync(
     path51.join(VSWHERE_DIR, "vswhere.json"),
     JSON.stringify({ installationPath: ROOT, installationVersion: "17." + (minor ?? "0") + ".0." + (major ?? "0") })
   );
 }
 function removeTelemetry(msvc) {
   try {
-    fs39.rmSync(hostBin(msvc, "vctip.exe"), { force: true });
+    fs40.rmSync(hostBin(msvc, "vctip.exe"), { force: true });
   } catch (e) {
     warn("Could not remove MSVC's telemetry helper (vctip.exe); it may keep tools\\msvc locked: " + errMsg(e));
   }
 }
 
 // src/guest/toolchains/native/msvc/packages.ts
-import fs40 from "node:fs";
+import fs41 from "node:fs";
 import path52 from "node:path";
 var CHANNEL = "https://aka.ms/vs/17/release/channel";
 var MANIFEST_DAY_MS = 24 * 60 * 60 * 1e3;
@@ -30825,9 +31264,9 @@ var SDK_MSIS = [
 ];
 var manifest = async () => {
   const cached2 = path52.join(ROOT, ".manifest.json");
-  if (exists(cached2) && Date.now() - fs40.statSync(cached2).mtimeMs < MANIFEST_DAY_MS) {
+  if (exists(cached2) && Date.now() - fs41.statSync(cached2).mtimeMs < MANIFEST_DAY_MS) {
     try {
-      return JSON.parse(fs40.readFileSync(cached2, "utf8"));
+      return JSON.parse(fs41.readFileSync(cached2, "utf8"));
     } catch {
     }
   }
@@ -30836,13 +31275,13 @@ var manifest = async () => {
   if (!item) throw new Error("the Visual Studio channel has no package manifest");
   mkdirp(ROOT);
   await downloader.file(item.url, cached2);
-  return JSON.parse(fs40.readFileSync(cached2, "utf8"));
+  return JSON.parse(fs41.readFileSync(cached2, "utf8"));
 };
 var unpackVsix = async (vsix, work) => {
   const out = mkdirp(path52.join(work, "vsix-" + path52.basename(vsix)));
   await extractArchive(vsix, out, ["Contents"]);
   const decode4 = (dir) => {
-    for (const entry of fs40.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs41.readdirSync(dir, { withFileTypes: true })) {
       const from = path52.join(dir, entry.name);
       let name = entry.name;
       try {
@@ -30850,12 +31289,12 @@ var unpackVsix = async (vsix, work) => {
       } catch {
       }
       const to = path52.join(dir, name);
-      if (to !== from) fs40.renameSync(from, to);
+      if (to !== from) fs41.renameSync(from, to);
       if (entry.isDirectory()) decode4(to);
     }
   };
   decode4(out);
-  fs40.cpSync(path52.join(out, "Contents"), ROOT, { recursive: true, force: true });
+  fs41.cpSync(path52.join(out, "Contents"), ROOT, { recursive: true, force: true });
   safeRemove(out, work);
 };
 var unpackMsi = async (msi) => {
@@ -30865,7 +31304,7 @@ var unpackMsi = async (msi) => {
       stdio: "ignore"
     });
   } catch (e) {
-    const lines = exists(logFile2) ? fs40.readFileSync(logFile2, "utf16le").split(/\r?\n/).filter((l) => /error|return value 3|failed/i.test(l)).slice(-4).join(" | ") : "";
+    const lines = exists(logFile2) ? fs41.readFileSync(logFile2, "utf16le").split(/\r?\n/).filter((l) => /error|return value 3|failed/i.test(l)).slice(-4).join(" | ") : "";
     throw new Error(
       path52.basename(msi) + " did not unpack: " + (e instanceof Error ? e.message : String(e)) + (lines ? " (" + lines.slice(0, 600) + ")" : "")
     );
@@ -30886,10 +31325,10 @@ var payloadFetcher = (work) => async (p) => {
 };
 var unpackedToolset = () => {
   const toolsRoot = path52.join(ROOT, "VC", "Tools", "MSVC");
-  return fs40.readdirSync(toolsRoot).filter((d) => exists(hostBin(d, "cl.exe"))).sort((a, b) => a.localeCompare(b, void 0, { numeric: true })).pop();
+  return fs41.readdirSync(toolsRoot).filter((d) => exists(hostBin(d, "cl.exe"))).sort((a, b) => a.localeCompare(b, void 0, { numeric: true })).pop();
 };
 async function installPackages(config2) {
-  const { ids, pick: pick2 } = catalogue(await manifest());
+  const { ids, pick: pick3 } = catalogue(await manifest());
   const version2 = pickMsvcVersion(ids, config2.msvcVersion);
   if (!version2) throw new Error("no MSVC " + config2.msvcVersion + " in the Visual Studio manifest");
   const sdk = pickWindowsSdk(ids, config2.sdkVersion);
@@ -30898,13 +31337,13 @@ async function installPackages(config2) {
   const fetchPayload = payloadFetcher(work);
   log("Downloading the MSVC " + version2 + " compiler and C/C++ libraries ...");
   for (const part of MSVC_PARTS) {
-    const p = pick2("microsoft.vc." + version2 + "." + part);
+    const p = pick3("microsoft.vc." + version2 + "." + part);
     if (!p && REQUIRED_PARTS.some((r) => part.startsWith(r))) throw new Error("MSVC " + version2 + " has no " + part);
     for (const payload2 of p?.payloads ?? []) await unpackVsix(await fetchPayload(payload2), work);
   }
-  for (const payload2 of pick2("microsoft.visualcpp.dia.sdk")?.payloads ?? [])
+  for (const payload2 of pick3("microsoft.visualcpp.dia.sdk")?.payloads ?? [])
     await unpackVsix(await fetchPayload(payload2), work);
-  const sdkPackage = pick2(Object.keys(pick2(sdk.componentId)?.dependencies ?? {})[0] ?? "");
+  const sdkPackage = pick3(Object.keys(pick3(sdk.componentId)?.dependencies ?? {})[0] ?? "");
   if (!sdkPackage?.payloads) throw new Error("the Windows SDK " + sdk.build + " package has no payloads");
   log("Downloading the Windows SDK " + sdk.build + " (headers, libraries; the biggest part) ...");
   const payload = (name) => sdkPackage.payloads.find((p) => p.fileName.toLowerCase() === ("installers\\" + name).toLowerCase());
@@ -30914,17 +31353,17 @@ async function installPackages(config2) {
     if (!p) throw new Error("the Windows SDK package has no " + name);
     const file3 = await fetchPayload(p);
     msis.push(file3);
-    for (const cab of msiCabs(fs40.readFileSync(file3))) {
+    for (const cab of msiCabs(fs41.readFileSync(file3))) {
       const c = payload(cab);
       if (c) await fetchPayload(c);
     }
   }
   log("Unpacking the Windows SDK (a few minutes) ...");
   for (const msi of msis) await unpackMsi(msi);
-  for (const name of fs40.readdirSync(ROOT).filter((n) => n.toLowerCase().endsWith(".msi")))
-    fs40.rmSync(path52.join(ROOT, name), { force: true });
+  for (const name of fs41.readdirSync(ROOT).filter((n) => n.toLowerCase().endsWith(".msi")))
+    fs41.rmSync(path52.join(ROOT, name), { force: true });
   safeRemove(work, ROOT);
-  const sdkVersion = fs40.readdirSync(path52.join(ROOT, "Windows Kits", "10", "Include")).filter((d) => d.startsWith("10.0." + sdk.build)).sort().pop();
+  const sdkVersion = fs41.readdirSync(path52.join(ROOT, "Windows Kits", "10", "Include")).filter((d) => d.startsWith("10.0." + sdk.build)).sort().pop();
   if (!sdkVersion) throw new Error("the Windows SDK did not unpack (no Include\\10.0." + sdk.build + ".*)");
   const toolset = unpackedToolset();
   if (!toolset) throw new Error("MSVC " + version2 + " did not unpack (no cl.exe under VC\\Tools\\MSVC)");
@@ -30938,7 +31377,7 @@ function installedMsvcEnv() {
 }
 var clearTree = () => {
   if (!exists(ROOT)) return;
-  for (const name of fs41.readdirSync(ROOT).filter((n) => n !== ".manifest.json" && n !== ".download"))
+  for (const name of fs42.readdirSync(ROOT).filter((n) => n !== ".manifest.json" && n !== ".download"))
     safeRemove(path53.join(ROOT, name), ROOT);
 };
 async function setupMsvc(env, config2) {
@@ -30969,12 +31408,26 @@ async function setupMsvc(env, config2) {
 }
 
 // src/guest/toolchains/native/unreal.ts
-import fs43 from "node:fs";
-import os7 from "node:os";
+import os8 from "node:os";
+import path57 from "node:path";
+
+// src/guest/toolchains/not-yet.ts
+function notAvailableYet(env, what) {
+  log(what + ": not available yet (nothing installed)");
+  env.summary.push(what + ": not available yet");
+}
+
+// src/guest/toolchains/engines/unreal-engines.ts
+async function setupUnrealEngines(env, _config, _ctx) {
+  notAvailableYet(env, "Unreal engines");
+}
+
+// src/guest/toolchains/installers.ts
+import fs44 from "node:fs";
 import path55 from "node:path";
 
 // src/guest/toolchains/native/vcruntime.ts
-import fs42 from "node:fs";
+import fs43 from "node:fs";
 import path54 from "node:path";
 var VC_REDIST = "https://aka.ms/vs/17/release/vc_redist.x64.exe";
 var MICROSOFT_SIGNER = "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US";
@@ -30994,7 +31447,7 @@ async function setupVcRuntime(env, summary = true) {
       await downloadFile(VC_REDIST, installer);
     }
     if (signerOf(installer) !== MICROSOFT_SIGNER) {
-      fs42.rmSync(installer, { force: true });
+      fs43.rmSync(installer, { force: true });
       throw new Error("vc_redist.x64.exe is not signed by Microsoft; deleted it (it is downloaded again next boot)");
     }
     log("Installing the Visual C++ runtime ...");
@@ -31006,9 +31459,85 @@ async function setupVcRuntime(env, summary = true) {
   return missing;
 }
 
-// src/guest/toolchains/native/unreal.ts
-var BOOTSTRAPPER_URL = "https://aka.ms/vs/17/release/vs_community.exe";
-var DIRECTX_URL = "https://download.microsoft.com/download/8/4/A/84A35BF1-DAFE-4AE8-82AF-AD2AE20B6B14/directx_Jun2010_redist.exe";
+// src/guest/toolchains/installers.ts
+var SIGNERS = {
+  microsoft: MICROSOFT_SIGNER,
+  valve: /^CN="?Valve(,| Corp)/,
+  unity: /^CN="?Unity Technologies/
+};
+function signedBy(file3, signer) {
+  const subject = signerOf(file3);
+  return typeof signer === "string" ? subject === signer : signer.test(subject);
+}
+function signatureCheck(signer, what) {
+  return (file3) => {
+    if (!signedBy(file3, signer)) throw new Error(what + " is not signed by its vendor");
+  };
+}
+async function signedInstaller(url2, file3, what, signer, sha256 = null) {
+  if (!exists(file3)) {
+    log("Downloading " + what + " ...");
+    mkdirp(path55.dirname(file3));
+    await downloader.file(url2, file3, { sha256, verify: signatureCheck(signer, path55.basename(file3)) });
+  }
+  if (!signedBy(file3, signer)) {
+    fs44.rmSync(file3, { force: true });
+    throw new Error(
+      path55.basename(file3) + " is not signed by its vendor; deleted it (it is downloaded again next boot)"
+    );
+  }
+  return file3;
+}
+
+// src/guest/toolchains/native/visual-studio.ts
+import fs46 from "node:fs";
+import os7 from "node:os";
+import path56 from "node:path";
+
+// src/guest/toolchains/persisted.ts
+import fs45 from "node:fs";
+
+// src/shared/installs.ts
+var InstallRecordSchema = external_exports.object({
+  name: external_exports.string().max(100),
+  version: external_exports.string().max(100),
+  sizeBytes: external_exports.number().nonnegative().nullable(),
+  installedAt: external_exports.string().max(64),
+  usedAt: external_exports.string().max(64)
+});
+var InstallRecordsSchema = external_exports.object({ installs: external_exports.array(InstallRecordSchema).max(1e3) });
+
+// src/guest/toolchains/persisted.ts
+var GB = 1024 ** 3;
+var LOCAL_RESERVE_BYTES = 13 * GB;
+function freeBytes(dir, deps = {}) {
+  try {
+    const s = (deps.statfs ?? fs45.statfsSync)(dir);
+    return s.bavail * s.bsize;
+  } catch {
+    return 0;
+  }
+}
+var gb = (bytes) => (bytes / GB).toFixed(1) + " GB";
+function assertRoom(dir, needBytes, what, fix, deps = {}) {
+  const free = freeBytes(dir, deps);
+  if (free < needBytes)
+    throw new Error(
+      "not installing " + what + ": " + gb(free) + " free where it goes, it needs " + gb(needBytes) + ". " + fix
+    );
+}
+function assertLocalRoom(needBytes, what, deps = {}) {
+  const drive = deps.localDir ?? (process.env.SystemDrive ?? "C:") + "\\";
+  assertRoom(
+    drive,
+    needBytes + LOCAL_RESERVE_BYTES,
+    what,
+    "The sandbox's own disk also holds the paging file and every build: give the sandbox less to install, or a smaller sandbox.pageFileMb.",
+    deps
+  );
+}
+
+// src/guest/toolchains/native/vs-request.ts
 var UNREAL_COMPONENTS = [
   "Microsoft.VisualStudio.Workload.NativeGame",
   "Microsoft.VisualStudio.Component.VC.Tools.x86.x64",
@@ -31019,16 +31548,59 @@ var UNREAL_COMPONENTS = [
   "Component.Unreal.Ide",
   "Component.Unreal"
 ];
-var OK_EXIT_CODES2 = [0, 3010];
-var LAYOUT_ROOM_BYTES = 15 * 1024 ** 3;
-var ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;
-var VS_DIR = tool("visualstudio");
-var BOOTSTRAPPER = path55.join(VS_DIR, "vs_community.exe");
-var LAYOUT = path55.join(VS_DIR, "layout");
-var LAYOUT_MARKER = path55.join(LAYOUT, ".complete.json");
-var LayoutSchema = external_exports.object({ components: external_exports.array(external_exports.string()) });
-var VSWHERE = path55.join(
-  process.env["ProgramFiles(x86)"] ?? "C:\\Program Files (x86)",
+var BUILD_TOOLS_COMPONENTS = [
+  "Microsoft.VisualStudio.Workload.VCTools",
+  "Microsoft.VisualStudio.Component.VC.Tools.x86.x64",
+  "Microsoft.VisualStudio.Component.Windows11SDK.22621"
+];
+var isOn = (setting) => setting === true;
+function visualStudioWanted(t, on = isOn) {
+  const unreal = on(t.unreal.enabled, "unreal");
+  const flutter = on(t.flutter.enabled, "flutter") && t.flutter.windowsDesktop;
+  const unity = on(t.unity.enabled, "unity") && t.unity.modules.includes("windows-il2cpp");
+  const users = [...unreal ? ["unreal"] : [], ...flutter ? ["flutter"] : [], ...unity ? ["unity"] : []];
+  if (!users.length) return null;
+  if (unreal)
+    return {
+      product: "community",
+      components: [.../* @__PURE__ */ new Set([...UNREAL_COMPONENTS, ...t.unreal.components])],
+      for: users,
+      licence: "toolchains.unreal.acceptLicense",
+      accepted: t.unreal.acceptLicense
+    };
+  return {
+    product: "buildtools",
+    components: [...BUILD_TOOLS_COMPONENTS],
+    for: users,
+    licence: "toolchains.msvc.acceptLicense",
+    accepted: t.msvc.acceptLicense
+  };
+}
+
+// src/guest/toolchains/native/visual-studio.ts
+var BOOTSTRAPPERS = {
+  community: {
+    url: "https://aka.ms/vs/17/release/vs_community.exe",
+    file: "vs_community.exe",
+    name: "Visual Studio Community 2022"
+  },
+  buildtools: {
+    url: "https://aka.ms/vs/17/release/vs_buildtools.exe",
+    file: "vs_buildtools.exe",
+    name: "Visual Studio Build Tools 2022"
+  }
+};
+var INSTALL_BYTES = {
+  community: 7 * 1024 ** 3,
+  buildtools: 5 * 1024 ** 3
+};
+var OK_EXIT_CODES2 = [0, 3010];
+var LAYOUT_ROOM_BYTES = 15 * 1024 ** 3;
+var ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;
+var VS_DIR = tool("visualstudio");
+var LayoutSchema = external_exports.object({ components: external_exports.array(external_exports.string()) });
+var VSWHERE = path56.join(
+  process.env["ProgramFiles(x86)"] ?? "C:\\Program Files (x86)",
   "Microsoft Visual Studio",
   "Installer",
   "vswhere.exe"
@@ -31047,142 +31619,153 @@ function installedVs() {
   const at = ask("installationPath");
   return at ? { path: at, version: ask("installationVersion") || "installed" } : null;
 }
-async function signedInstaller(url2, file3, what) {
-  if (!exists(file3)) {
-    log("Downloading " + what + " ...");
-    mkdirp(path55.dirname(file3));
-    await downloadFile(url2, file3);
-  }
-  if (signerOf(file3) !== MICROSOFT_SIGNER) {
-    fs43.rmSync(file3, { force: true });
-    throw new Error(path55.basename(file3) + " is not signed by Microsoft; deleted it (it is downloaded again next boot)");
-  }
-  return file3;
+function layoutDir(product) {
+  return path56.join(VS_DIR, product === "community" ? "layout" : "layout-buildtools");
 }
-function freeBytes(dir) {
-  try {
-    const s = fs43.statfsSync(dir);
-    return s.bavail * s.bsize;
-  } catch {
-    return 0;
-  }
-}
-async function layoutInstaller(bootstrapper, ids) {
-  const installer = path55.join(LAYOUT, "vs_community.exe");
+async function layoutInstaller(req, bootstrapper) {
+  const layout = layoutDir(req.product);
+  const marker = path56.join(layout, ".complete.json");
+  const installer = path56.join(layout, BOOTSTRAPPERS[req.product].file);
   const has = () => {
-    if (!exists(LAYOUT_MARKER) || !exists(installer)) return false;
+    if (!exists(marker) || !exists(installer)) return false;
     try {
-      const done = LayoutSchema.parse(JSON.parse(fs43.readFileSync(LAYOUT_MARKER, "utf8")));
-      return ids.every((id) => done.components.includes(id));
+      const done = LayoutSchema.parse(JSON.parse(fs46.readFileSync(marker, "utf8")));
+      return req.components.every((id) => done.components.includes(id));
     } catch {
       return false;
     }
   };
   if (has()) return installer;
   if (freeBytes(mkdirp(VS_DIR)) < LAYOUT_ROOM_BYTES) {
-    warn("unreal: not keeping the install files (less than 15 GB free in " + VS_DIR + "); downloading this boot");
+    warn(
+      "Visual Studio: not keeping the install files (less than 15 GB free in " + VS_DIR + "); downloading this boot"
+    );
     return null;
   }
   log("Saving the Visual Studio install files for later boots (~10 GB, once) ...");
-  fs43.rmSync(LAYOUT_MARKER, { force: true });
+  fs46.rmSync(marker, { force: true });
   const code = await spawnAsync(bootstrapper, [
     "--layout",
-    LAYOUT,
+    layout,
     "--lang",
     "en-US",
     "--quiet",
     "--wait",
-    ...ids.flatMap((id) => ["--add", id])
+    ...req.components.flatMap((id) => ["--add", id])
   ]);
   if (!OK_EXIT_CODES2.includes(code) || !exists(installer)) {
-    warn("unreal: saving the install files failed (exit " + code + "); downloading this boot");
+    warn("Visual Studio: saving the install files failed (exit " + code + "); downloading this boot");
     return null;
   }
-  writeJsonAtomic(LAYOUT_MARKER, { components: [...ids] });
+  writeJsonAtomic(marker, { components: [...req.components] });
   return installer;
 }
-async function installVisualStudio(config2, ids) {
-  const bootstrapper = await signedInstaller(BOOTSTRAPPER_URL, BOOTSTRAPPER, "the Visual Studio installer");
+async function install(req, keepInstallFiles) {
+  const boot = BOOTSTRAPPERS[req.product];
+  const bootstrapper = await signedInstaller(
+    boot.url,
+    path56.join(VS_DIR, boot.file),
+    "the " + boot.name + " installer",
+    SIGNERS.microsoft
+  );
   let installer = null;
-  if (config2.keepInstallFiles) {
+  if (keepInstallFiles) {
     try {
-      installer = await layoutInstaller(bootstrapper, ids);
+      installer = await layoutInstaller(req, bootstrapper);
     } catch (e) {
-      warn("unreal: the offline copy failed (" + errMsg(e) + "); downloading this boot");
+      warn("Visual Studio: the offline copy failed (" + errMsg(e) + "); downloading this boot");
     }
   }
-  log(
-    "Installing Visual Studio Community 2022 with the C++ game workload" + (installer ? " from the saved install files" : " (downloads ~5-8 GB)") + " ..."
-  );
+  log("Installing " + boot.name + (installer ? " from the saved install files" : " (downloads ~5-8 GB)") + " ...");
   const code = await spawnAsync(installer ?? bootstrapper, [
     "--quiet",
     "--wait",
     "--norestart",
     "--nocache",
     ...installer ? ["--noWeb"] : [],
-    ...ids.flatMap((id) => ["--add", id])
+    ...req.components.flatMap((id) => ["--add", id])
   ]);
   if (!OK_EXIT_CODES2.includes(code) || !installedVs())
     throw new Error(
       "the Visual Studio installer failed (exit " + code + "); its logs are the dd_*.log files in " + os7.tmpdir()
     );
 }
+async function ensureVisualStudio(env, req, o) {
+  if (!req.accepted)
+    throw new Error(
+      "Visual Studio (for " + req.for.join(", ") + ") is installed only with " + req.licence + " = true: it comes under Microsoft licence terms (https://visualstudio.microsoft.com/license-terms/)"
+    );
+  const bad = req.components.find((id) => !ID.test(id));
+  if (bad) throw new Error('"' + bad + '" is not a Visual Studio component ID');
+  const have = installedVs();
+  if (have) return have;
+  if (duringSession())
+    throw new Error("Visual Studio is installed when the sandbox starts: restart it (sandbox restart) to get it");
+  assertLocalRoom(INSTALL_BYTES[req.product], BOOTSTRAPPERS[req.product].name);
+  await install(req, o.keepInstallFiles);
+  const vs = installedVs();
+  env.summary.push(
+    "visual studio: " + BOOTSTRAPPERS[req.product].name + " " + vs.version + " at " + vs.path + " (for " + req.for.join(", ") + ")"
+  );
+  return vs;
+}
+
+// src/guest/toolchains/native/unreal.ts
+var DIRECTX_URL = "https://download.microsoft.com/download/8/4/A/84A35BF1-DAFE-4AE8-82AF-AD2AE20B6B14/directx_Jun2010_redist.exe";
 async function installDirectX() {
-  const system322 = path55.join(process.env.WINDIR ?? "C:\\Windows", "System32");
-  if (exists(path55.join(system322, "d3dx9_43.dll")) && exists(path55.join(system322, "XAudio2_7.dll"))) return;
+  const system322 = path57.join(process.env.WINDIR ?? "C:\\Windows", "System32");
+  if (exists(path57.join(system322, "d3dx9_43.dll")) && exists(path57.join(system322, "XAudio2_7.dll"))) return;
   const redist = await signedInstaller(
     DIRECTX_URL,
-    path55.join(VS_DIR, "directx_Jun2010_redist.exe"),
-    "the DirectX End-User Runtime (~95 MB once)"
+    path57.join(tool("visualstudio"), "directx_Jun2010_redist.exe"),
+    "the DirectX End-User Runtime (~95 MB once)",
+    SIGNERS.microsoft
   );
-  const unpacked = path55.join(os7.tmpdir(), "directx-redist");
-  safeRemove(unpacked, os7.tmpdir());
+  const unpacked = path57.join(os8.tmpdir(), "directx-redist");
+  safeRemove(unpacked, os8.tmpdir());
   mkdirp(unpacked);
-  if (await spawnAsync(redist, ["/Q", "/T:" + unpacked]) !== 0 || !exists(path55.join(unpacked, "DXSETUP.exe")))
+  if (await spawnAsync(redist, ["/Q", "/T:" + unpacked]) !== 0 || !exists(path57.join(unpacked, "DXSETUP.exe")))
     throw new Error("could not unpack the DirectX End-User Runtime");
-  const code = await spawnAsync(path55.join(unpacked, "DXSETUP.exe"), ["/silent"]);
-  safeRemove(unpacked, os7.tmpdir());
+  const code = await spawnAsync(path57.join(unpacked, "DXSETUP.exe"), ["/silent"]);
+  safeRemove(unpacked, os8.tmpdir());
   if (code !== 0) throw new Error("the DirectX End-User Runtime installer failed (exit " + code + ")");
 }
-async function setupUnreal(env, config2) {
+async function setupUnreal(env, config2, ctx) {
   if (!config2.acceptLicense)
     throw new Error(
       "Unreal tools are installed only with toolchains.unreal.acceptLicense = true: Visual Studio Community and the DirectX End-User Runtime come under Microsoft licence terms (https://visualstudio.microsoft.com/license-terms/)"
     );
-  const bad = config2.components.find((id) => !ID.test(id));
-  if (bad) throw new Error('toolchains.unreal.components: "' + bad + '" is not a Visual Studio component ID');
-  const ids = [.../* @__PURE__ */ new Set([...UNREAL_COMPONENTS, ...config2.components])];
   if (dryRun) {
-    log("(dry run) would install Visual Studio Community 2022 with " + ids.join(", ") + " and DirectX");
+    log("(dry run) would install the DirectX End-User Runtime and set up the Unreal engines");
     return;
   }
-  if (!installedVs()) await installVisualStudio(config2, ids);
   await installDirectX();
+  await setupUnrealEngines(env, config2, ctx);
   const vs = installedVs();
   env.summary.push(
-    "unreal: Visual Studio Community " + vs.version + " (C++ game workload, Windows 11 SDK, Unreal support) at " + vs.path + "; DirectX End-User Runtime; get the engine from the Epic Games Launcher (Start menu)"
+    "unreal: " + (vs ? "Visual Studio " + vs.version + " (C++ game workload, Windows 11 SDK, Unreal support); " : "") + "DirectX End-User Runtime; get the engine from the Epic Games Launcher (Start menu)"
   );
 }
 
 // src/guest/toolchains/native/rust.ts
-import path57 from "node:path";
+import path59 from "node:path";
 
 // src/guest/toolchains/native/binstall.ts
-import fs44 from "node:fs";
-import path56 from "node:path";
+import fs47 from "node:fs";
+import path58 from "node:path";
 var ensureBinstall = async (cargoBin) => {
-  const target = path56.join(cargoBin, "cargo-binstall.exe");
+  const target = path58.join(cargoBin, "cargo-binstall.exe");
   if (exists(target)) return true;
   try {
     const dir = tool("cargo-binstall");
-    if (!exists(path56.join(dir, "cargo-binstall.exe"))) {
+    if (!exists(path58.join(dir, "cargo-binstall.exe"))) {
       await installFromGithub("cargo-bins/cargo-binstall", binstallAsset(arch), {
         dest: dir,
         what: "cargo-binstall for prebuilt Rust tools (~10 MB once)",
         locate: "cargo-binstall.exe"
       });
     }
-    fs44.copyFileSync(path56.join(dir, "cargo-binstall.exe"), target);
+    fs47.copyFileSync(path58.join(dir, "cargo-binstall.exe"), target);
     return true;
   } catch (e) {
     warn("cargo-binstall unavailable, compiling crates with cargo install instead: " + errMsg(e));
@@ -31190,14 +31773,14 @@ var ensureBinstall = async (cargoBin) => {
   }
 };
 function crateInstaller(cargoHome, cargoEnv) {
-  const cargo = path56.join(cargoHome, "bin", "cargo.exe");
+  const cargo = path58.join(cargoHome, "bin", "cargo.exe");
   let binstall = null;
   const binstallEnv = {
     ...cargoEnv,
     env: { ...cargoEnv.env ?? process.env, BINSTALL_DISABLE_TELEMETRY: "true" }
   };
   return async (crate) => {
-    binstall ??= ensureBinstall(path56.join(cargoHome, "bin"));
+    binstall ??= ensureBinstall(path58.join(cargoHome, "bin"));
     if (await binstall) {
       try {
         await execAsync(
@@ -31219,7 +31802,7 @@ async function setupRust(env, config2, refresh) {
   const RUSTUP_HOME = tool("rust", "rustup");
   const CARGO_HOME = tool("rust", "cargo");
   const rustEnv = { env: { ...process.env, RUSTUP_HOME, CARGO_HOME } };
-  const rustup = path57.join(CARGO_HOME, "bin", "rustup.exe");
+  const rustup = path59.join(CARGO_HOME, "bin", "rustup.exe");
   if (dryRun) {
     log("(dry run) would provision Rust " + config2.toolchain + " (" + config2.host + ")");
     return;
@@ -31255,9 +31838,9 @@ async function setupRust(env, config2, refresh) {
     if (refresh) await execAsync(rustup, ["update"], rustEnv);
   }
   Object.assign(env.vars, { RUSTUP_HOME, CARGO_HOME });
-  env.prepend.push(path57.join(CARGO_HOME, "bin"));
+  env.prepend.push(path59.join(CARGO_HOME, "bin"));
   env.summary.push(
-    "rust: " + versionOf(path57.join(CARGO_HOME, "bin", "rustc.exe"), ["--version"], rustEnv) + " [" + config2.host + "]"
+    "rust: " + versionOf(path59.join(CARGO_HOME, "bin", "rustc.exe"), ["--version"], rustEnv) + " [" + config2.host + "]"
   );
   const toolchainKey = "rustup@" + config2.toolchain;
   await installOnce(
@@ -31278,36 +31861,36 @@ async function setupRust(env, config2, refresh) {
     env: {
       ...rustEnv.env,
       ...msvc.vars,
-      PATH: [path57.join(CARGO_HOME, "bin"), ...msvc.path, process.env.PATH ?? ""].join(path57.delimiter)
+      PATH: [path59.join(CARGO_HOME, "bin"), ...msvc.path, process.env.PATH ?? ""].join(path59.delimiter)
     }
   } : {
     env: {
       ...rustEnv.env,
-      CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: path57.join(mingw, "gcc.exe"),
-      PATH: [path57.join(CARGO_HOME, "bin"), mingw, process.env.PATH ?? ""].join(path57.delimiter)
+      CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: path59.join(mingw, "gcc.exe"),
+      PATH: [path59.join(CARGO_HOME, "bin"), mingw, process.env.PATH ?? ""].join(path59.delimiter)
     }
   };
   await installOnce(env, "cargo", config2.crates, crateInstaller(CARGO_HOME, cargoEnv));
 }
 
 // src/guest/toolchains/languages/node.ts
-import fs45 from "node:fs";
-import path58 from "node:path";
+import fs48 from "node:fs";
+import path60 from "node:path";
 import { spawn as spawn4 } from "node:child_process";
 var NVM_HOME = tool("nvm");
-var NVM_SYMLINK = path58.join(localDir, "nodejs");
-var HOST_NVM = path58.join(hostToolsDir, "nvm");
+var NVM_SYMLINK = path60.join(localDir, "nodejs");
+var HOST_NVM = path60.join(hostToolsDir, "nvm");
 var HOST_VERSIONS_MAX = 3;
-var hostNvmVersions = () => exists(HOST_NVM) ? fs45.readdirSync(HOST_NVM).filter((d) => /^v\d+\.\d+\.\d+$/.test(d) && exists(path58.join(HOST_NVM, d, "node.exe"))).map((d) => d.slice(1)) : [];
+var hostNvmVersions = () => exists(HOST_NVM) ? fs48.readdirSync(HOST_NVM).filter((d) => /^v\d+\.\d+\.\d+$/.test(d) && exists(path60.join(HOST_NVM, d, "node.exe"))).map((d) => d.slice(1)) : [];
 var resolveNode = (spec) => resolveCached("node:" + spec, async () => {
   const exact = spec.replace(/^v/, "");
   if (/^\d+\.\d+\.\d+$/.test(exact)) return exact;
   const releases = await fetchJson("https://nodejs.org/dist/index.json");
   return pickNodeVersion(releases, spec) ?? Promise.reject(new Error('No Node.js release matches "' + spec + '"'));
 });
-var NVM_TEMP = path58.join(NVM_HOME, ".tmp");
+var NVM_TEMP = path60.join(NVM_HOME, ".tmp");
 var nvm = (args) => new Promise((resolve2) => {
-  const child = spawn4(path58.join(NVM_HOME, "nvm.exe"), args, {
+  const child = spawn4(path60.join(NVM_HOME, "nvm.exe"), args, {
     windowsHide: true,
     env: { ...process.env, NVM_HOME, NVM_SYMLINK, TEMP: NVM_TEMP, TMP: NVM_TEMP }
   });
@@ -31322,12 +31905,12 @@ var nvm = (args) => new Promise((resolve2) => {
   child.once("close", () => resolve2(out));
 });
 var ensureNvm = async () => {
-  if (exists(path58.join(NVM_HOME, "nvm.exe"))) return;
-  if (exists(path58.join(HOST_NVM, "nvm.exe"))) {
+  if (exists(path60.join(NVM_HOME, "nvm.exe"))) return;
+  if (exists(path60.join(HOST_NVM, "nvm.exe"))) {
     log("Copying nvm from this PC ...");
     mkdirp(NVM_HOME);
-    const files = fs45.readdirSync(HOST_NVM).filter((f) => /\.(exe|cmd|vbs)$/i.test(f)).sort((a, b) => Number(a.toLowerCase() === "nvm.exe") - Number(b.toLowerCase() === "nvm.exe"));
-    for (const file3 of files) fs45.copyFileSync(path58.join(HOST_NVM, file3), path58.join(NVM_HOME, file3));
+    const files = fs48.readdirSync(HOST_NVM).filter((f) => /\.(exe|cmd|vbs)$/i.test(f)).sort((a, b) => Number(a.toLowerCase() === "nvm.exe") - Number(b.toLowerCase() === "nvm.exe"));
+    for (const file3 of files) fs48.copyFileSync(path60.join(HOST_NVM, file3), path60.join(NVM_HOME, file3));
     return;
   }
   const asset = await githubAsset("coreybutler/nvm-windows", /^nvm-noinstall\.zip$/, true);
@@ -31335,14 +31918,14 @@ var ensureNvm = async () => {
   await downloader.archive(asset.url, NVM_HOME, { sha256: asset.sha256, locate: "nvm.exe", fileName: asset.name });
 };
 var hostNodeFolder = (version2) => {
-  const dir = path58.join(hostToolsDir, "node");
-  return session.hostTools.nodeVersion?.replace(/^v/, "") === version2 && exists(path58.join(dir, "node.exe")) ? dir : null;
+  const dir = path60.join(hostToolsDir, "node");
+  return session.hostTools.nodeVersion?.replace(/^v/, "") === version2 && exists(path60.join(dir, "node.exe")) ? dir : null;
 };
 var installNodeVersion = async (version2) => {
-  const dir = path58.join(NVM_HOME, "v" + version2);
-  const fromHost = path58.join(HOST_NVM, "v" + version2);
-  if (exists(path58.join(dir, "node.exe"))) return;
-  if (exists(path58.join(fromHost, "node.exe"))) {
+  const dir = path60.join(NVM_HOME, "v" + version2);
+  const fromHost = path60.join(HOST_NVM, "v" + version2);
+  if (exists(path60.join(dir, "node.exe"))) return;
+  if (exists(path60.join(fromHost, "node.exe"))) {
     log("Copying Node " + version2 + " from this PC's nvm (without global packages) ...");
     copyNode(fromHost, dir);
     return;
@@ -31361,19 +31944,19 @@ var installNodeVersion = async (version2) => {
   } finally {
     safeRemove(NVM_TEMP, NVM_HOME);
   }
-  if (!exists(path58.join(dir, "node.exe"))) {
+  if (!exists(path60.join(dir, "node.exe"))) {
     const tail = out.trim().split(/\r?\n/).filter(Boolean).slice(-3).join(" ");
     const why = /complete/i.test(out) ? "nvm said it finished, but its move into the data folder did not happen" : "nvm could not download or unpack it: check the internet connection and the free disk space";
     throw new Error(
-      "nvm install " + version2 + " did not leave " + path58.join(dir, "node.exe") + " (" + why + ")" + (tail ? ". nvm printed: " + tail : "")
+      "nvm install " + version2 + " did not leave " + path60.join(dir, "node.exe") + " (" + why + ")" + (tail ? ". nvm printed: " + tail : "")
     );
   }
 };
 var activate = async (version2) => {
   await nvm(["use", version2]);
-  if (exists(path58.join(NVM_SYMLINK, "node.exe"))) return;
-  fs45.rmSync(NVM_SYMLINK, { recursive: true, force: true });
-  fs45.symlinkSync(path58.join(NVM_HOME, "v" + version2), NVM_SYMLINK, "junction");
+  if (exists(path60.join(NVM_SYMLINK, "node.exe"))) return;
+  fs48.rmSync(NVM_SYMLINK, { recursive: true, force: true });
+  fs48.symlinkSync(path60.join(NVM_HOME, "v" + version2), NVM_SYMLINK, "junction");
 };
 var PLAYWRIGHT_VARS = () => ({
   PLAYWRIGHT_BROWSERS_PATH: tool("ms-playwright"),
@@ -31385,8 +31968,8 @@ async function setupNode(env, versions, config2) {
     return;
   }
   await ensureNvm();
-  fs45.writeFileSync(
-    path58.join(NVM_HOME, "settings.txt"),
+  fs48.writeFileSync(
+    path60.join(NVM_HOME, "settings.txt"),
     [
       "root: " + NVM_HOME,
       "path: " + NVM_SYMLINK,
@@ -31413,7 +31996,7 @@ async function setupNode(env, versions, config2) {
     }
   }
   Object.assign(env.vars, { NVM_HOME, NVM_SYMLINK, ...PLAYWRIGHT_VARS() });
-  if (duringSession()) env.prepend.push(path58.join(NVM_HOME, "v" + main), NVM_HOME, NVM_SYMLINK);
+  if (duringSession()) env.prepend.push(path60.join(NVM_HOME, "v" + main), NVM_HOME, NVM_SYMLINK);
   else {
     await activate(main);
     env.prepend.push(NVM_HOME, NVM_SYMLINK);
@@ -31423,13 +32006,13 @@ async function setupNode(env, versions, config2) {
   await packageManagers(env, config2, main);
 }
 var packageManagers = async (env, config2, version2) => {
-  const dir = path58.join(NVM_HOME, "v" + version2);
-  const nodeEnv = { ...process.env, PATH: dir + path58.delimiter + (process.env.PATH ?? "") };
-  const npm = (args) => execAsync(path58.join(dir, "node.exe"), [path58.join(dir, "node_modules", "npm", "bin", "npm-cli.js"), ...args], {
+  const dir = path60.join(NVM_HOME, "v" + version2);
+  const nodeEnv = { ...process.env, PATH: dir + path60.delimiter + (process.env.PATH ?? "") };
+  const npm = (args) => execAsync(path60.join(dir, "node.exe"), [path60.join(dir, "node_modules", "npm", "bin", "npm-cli.js"), ...args], {
     env: nodeEnv,
     stdio: "ignore"
   });
-  const corepackJs = path58.join(dir, "node_modules", "corepack", "dist", "corepack.js");
+  const corepackJs = path60.join(dir, "node_modules", "corepack", "dist", "corepack.js");
   const extra = config2.corepack && !exists(corepackJs) ? ["corepack"] : [];
   await installOnce(
     env,
@@ -31450,7 +32033,7 @@ var packageManagers = async (env, config2, version2) => {
   }
   try {
     await execAsync(
-      path58.join(dir, "node.exe"),
+      path60.join(dir, "node.exe"),
       [corepackJs, "enable", "--install-directory", mkdirp(tool("bin")), "pnpm", "yarn"],
       { env: nodeEnv, stdio: "ignore" }
     );
@@ -31475,8 +32058,8 @@ async function setupPwsh(env, refresh = false) {
 }
 
 // src/guest/toolchains/languages/python.ts
-import fs46 from "node:fs";
-import path59 from "node:path";
+import fs49 from "node:fs";
+import path61 from "node:path";
 var installPython = async (pkg, spec) => {
   const version2 = await resolveCached(pkg + ":" + spec, async () => {
     const { versions } = await fetchJson(
@@ -31485,7 +32068,7 @@ var installPython = async (pkg, spec) => {
     return pickPackageVersion(versions, spec) ?? Promise.reject(new Error("No " + pkg + ' release matches "' + spec + '"'));
   });
   const dir = tool("python", pkg + "-" + version2);
-  const exe = path59.join(dir, "python.exe");
+  const exe = path61.join(dir, "python.exe");
   if (!exists(exe)) {
     log("Downloading Python " + version2 + (pkg === "python2" ? " (Python 2, " : " (") + "~30 MB once) ...");
     await downloader.archive(
@@ -31494,32 +32077,32 @@ var installPython = async (pkg, spec) => {
       { locate: "python.exe", fileName: pkg + "." + version2 + ".zip" }
     );
   }
-  if (!exists(path59.join(dir, "Scripts", "pip.exe")) && !exists(path59.join(dir, "Scripts", "pip2.exe")))
+  if (!exists(path61.join(dir, "Scripts", "pip.exe")) && !exists(path61.join(dir, "Scripts", "pip2.exe")))
     await execAsync(exe, ["-m", "ensurepip", "--default-pip"], { stdio: "ignore" });
   return dir;
 };
-var shimDir = (dir) => duringSession() ? tool("shims", path59.basename(dir)) : tool("shims");
+var shimDir = (dir) => duringSession() ? tool("shims", path61.basename(dir)) : tool("shims");
 var shim = (folder, name, program, args = []) => {
   const fixed = [program, ...args];
-  fs46.writeFileSync(
-    path59.join(mkdirp(folder), name + ".cmd"),
+  fs49.writeFileSync(
+    path61.join(mkdirp(folder), name + ".cmd"),
     "@echo off\r\n" + fixed.map((a) => '"' + a + '"').join(" ") + " %*\r\n"
   );
   const sh = fixed.map((a) => "'" + a.replace(/\\/g, "/").replace(/'/g, "'\\''") + "'").join(" ");
-  fs46.writeFileSync(path59.join(folder, name), "#!/bin/sh\nexec " + sh + ' "$@"\n');
+  fs49.writeFileSync(path61.join(folder, name), "#!/bin/sh\nexec " + sh + ' "$@"\n');
 };
 var shimPair = (folder, version2, dir) => {
-  const python = path59.join(dir, "python.exe");
+  const python = path61.join(dir, "python.exe");
   shim(folder, "python" + version2, python);
   shim(folder, "pip" + version2, python, ["-m", "pip"]);
 };
 var pyLauncher = (folder, py3, py2) => {
-  const script = path59.join(mkdirp(folder), "py-launcher.py");
-  fs46.writeFileSync(
+  const script = path61.join(mkdirp(folder), "py-launcher.py");
+  fs49.writeFileSync(
     script,
     [
       "import subprocess, sys",
-      "PY3, PY2 = " + JSON.stringify(path59.join(py3, "python.exe")) + ", " + JSON.stringify(py2 ? path59.join(py2, "python.exe") : null),
+      "PY3, PY2 = " + JSON.stringify(path61.join(py3, "python.exe")) + ", " + JSON.stringify(py2 ? path61.join(py2, "python.exe") : null),
       "args = sys.argv[1:]",
       "exe = PY3",
       "if args and args[0].startswith('-2'):",
@@ -31531,7 +32114,7 @@ var pyLauncher = (folder, py3, py2) => {
       ""
     ].join("\n")
   );
-  shim(folder, "py", path59.join(py3, "python.exe"), [script]);
+  shim(folder, "py", path61.join(py3, "python.exe"), [script]);
 };
 async function setupPython(env, config2, versions) {
   if (dryRun) {
@@ -31541,10 +32124,10 @@ async function setupPython(env, config2, versions) {
   const py3 = await installPython("python", versions.python.spec);
   const shims = shimDir(py3);
   shimPair(shims, "3", py3);
-  env.prepend.push(py3, mkdirp(path59.join(py3, "Scripts")), shims);
+  env.prepend.push(py3, mkdirp(path61.join(py3, "Scripts")), shims);
   env.vars.PYTHONIOENCODING = "utf-8";
   env.summary.push(
-    "python: " + path59.basename(py3).replace("python-", "") + " (from " + versions.python.source + "; py works too)"
+    "python: " + path61.basename(py3).replace("python-", "") + " (from " + versions.python.source + "; py works too)"
   );
   if (!config2.python2) {
     pyLauncher(shims, py3, null);
@@ -31553,12 +32136,12 @@ async function setupPython(env, config2, versions) {
   const py2 = await installPython("python2", "2.7");
   shimPair(shims, "2", py2);
   pyLauncher(shims, py3, py2);
-  env.summary.push("python2: " + path59.basename(py2).replace("python2-", ""));
+  env.summary.push("python2: " + path61.basename(py2).replace("python2-", ""));
 }
 
 // src/guest/toolchains/languages/php.ts
-import fs47 from "node:fs";
-import path60 from "node:path";
+import fs50 from "node:fs";
+import path62 from "node:path";
 var PHP_EXTENSIONS = [
   "curl",
   "fileinfo",
@@ -31576,11 +32159,11 @@ var PHP_EXTENSIONS = [
 var COMPOSER = "https://getcomposer.org/download/latest-stable/composer.phar";
 var phpBuild = async (spec) => {
   const releases = await fetchJson("https://windows.php.net/downloads/releases/releases.json");
-  const pick2 = pickPackageVersion(
+  const pick3 = pickPackageVersion(
     Object.values(releases).map((r) => r.version),
     spec
   );
-  const release = Object.values(releases).find((r) => r.version === pick2);
+  const release = Object.values(releases).find((r) => r.version === pick3);
   const build = release && Object.entries(release).find(
     ([key2, value]) => /^nts-vs\d+-x64$/.test(key2) && typeof value === "object" && value.zip
   )?.[1];
@@ -31589,16 +32172,16 @@ var phpBuild = async (spec) => {
   return { version: release.version, ...build.zip };
 };
 var writePhpIni = (home) => {
-  const ini = path60.join(home, "php.ini");
-  if (exists(ini) || !exists(path60.join(home, "php.ini-development"))) return;
-  let text = fs47.readFileSync(path60.join(home, "php.ini-development"), "utf8").replace(/^;\s*extension_dir\s*=\s*"ext"/m, 'extension_dir = "' + path60.join(home, "ext") + '"');
-  for (const ext of PHP_EXTENSIONS.filter((e) => exists(path60.join(home, "ext", "php_" + e + ".dll"))))
+  const ini = path62.join(home, "php.ini");
+  if (exists(ini) || !exists(path62.join(home, "php.ini-development"))) return;
+  let text = fs50.readFileSync(path62.join(home, "php.ini-development"), "utf8").replace(/^;\s*extension_dir\s*=\s*"ext"/m, 'extension_dir = "' + path62.join(home, "ext") + '"');
+  for (const ext of PHP_EXTENSIONS.filter((e) => exists(path62.join(home, "ext", "php_" + e + ".dll"))))
     text = text.replace(new RegExp("^;(extension=" + ext + ")\\s*$", "m"), "$1");
-  fs47.writeFileSync(ini + ".tmp", text);
-  fs47.renameSync(ini + ".tmp", ini);
+  fs50.writeFileSync(ini + ".tmp", text);
+  fs50.renameSync(ini + ".tmp", ini);
 };
 var shim2 = (env, name, command) => {
-  fs47.writeFileSync(path60.join(mkdirp(tool("shims")), name + ".cmd"), "@echo off\r\n" + command + " %*\r\n");
+  fs50.writeFileSync(path62.join(mkdirp(tool("shims")), name + ".cmd"), "@echo off\r\n" + command + " %*\r\n");
   env.prepend.push(tool("shims"));
 };
 var setupComposer = async (env, php) => {
@@ -31610,7 +32193,7 @@ var setupComposer = async (env, php) => {
   }
   const composerHome = tool("composer-home");
   env.vars.COMPOSER_HOME = composerHome;
-  env.prepend.push(path60.join(composerHome, "vendor", "bin"));
+  env.prepend.push(path62.join(composerHome, "vendor", "bin"));
   shim2(env, "composer", '"' + php + '" "' + phar + '"');
   env.summary.push(
     "composer: " + (/\d+\.\d+\.\d+/.exec(execOutput(php, [phar, "--version", "--no-ansi"]))?.[0] ?? "installed")
@@ -31625,7 +32208,7 @@ async function setupPhp(env, config2) {
   await setupVcRuntime(env, false);
   const version2 = await resolveCached("php:" + wantedSpec.spec, async () => (await phpBuild(wantedSpec.spec)).version);
   const home = tool("php", version2);
-  if (!exists(path60.join(home, "php.exe"))) {
+  if (!exists(path62.join(home, "php.exe"))) {
     const build = await phpBuild(version2);
     log("Downloading PHP " + version2 + " (~30 MB once) ...");
     await downloader.archive("https://windows.php.net/downloads/releases/" + build.path, home, {
@@ -31637,11 +32220,11 @@ async function setupPhp(env, config2) {
   writePhpIni(home);
   env.prepend.push(home);
   env.summary.push("php: " + version2 + " (from " + wantedSpec.source + ")");
-  if (config2.composer) await setupComposer(env, path60.join(home, "php.exe"));
+  if (config2.composer) await setupComposer(env, path62.join(home, "php.exe"));
 }
 
 // src/guest/toolchains/languages/ruby.ts
-import path61 from "node:path";
+import path63 from "node:path";
 var RUBY_ASSET = /^rubyinstaller-(\d+\.\d+\.\d+)-(\d+)-x64\.7z$/;
 var buildNumber = (asset) => Number(RUBY_ASSET.exec(asset.name)?.[2] ?? 0);
 var rubyBuilds = async () => {
@@ -31669,7 +32252,7 @@ async function setupRuby(env, config2) {
     async () => pickPackageVersion([...(await rubyBuilds()).keys()], wantedSpec.spec) ?? Promise.reject(new Error('No RubyInstaller build matches "' + wantedSpec.spec + '"'))
   );
   const home = tool("ruby", version2);
-  if (!exists(path61.join(home, "bin", "ruby.exe"))) {
+  if (!exists(path63.join(home, "bin", "ruby.exe"))) {
     const asset = (await rubyBuilds()).get(version2);
     if (!asset) throw new Error("RubyInstaller " + version2 + " is no longer published");
     log("Downloading Ruby " + version2 + " (~100 MB once) ...");
@@ -31682,11 +32265,11 @@ async function setupRuby(env, config2) {
   }
   const gems = tool("ruby-gems", version2.split(".").slice(0, 2).join("."));
   Object.assign(env.vars, { GEM_HOME: gems, BUNDLE_USER_HOME: tool("bundle-home") });
-  env.prepend.push(path61.join(home, "bin"), path61.join(gems, "bin"));
+  env.prepend.push(path63.join(home, "bin"), path63.join(gems, "bin"));
   env.summary.push(
-    "ruby: " + versionOf(path61.join(home, "bin", "ruby.exe")) + " (from " + wantedSpec.source + "; gems with C extensions need MSYS2, not included)"
+    "ruby: " + versionOf(path63.join(home, "bin", "ruby.exe")) + " (from " + wantedSpec.source + "; gems with C extensions need MSYS2, not included)"
   );
-  const gem = path61.join(home, "bin", "gem.cmd");
+  const gem = path63.join(home, "bin", "gem.cmd");
   await installOnce(
     env,
     "gem@" + version2,
@@ -31698,9 +32281,9 @@ async function setupRuby(env, config2) {
 }
 
 // src/guest/toolchains/tools/vscode.ts
-import fs48 from "node:fs";
-import os8 from "node:os";
-import path62 from "node:path";
+import fs51 from "node:fs";
+import os9 from "node:os";
+import path64 from "node:path";
 
 // node_modules/jsonc-parser/lib/esm/impl/scanner.js
 var CharacterCodes;
@@ -31880,14 +32463,14 @@ var ParseErrorCode;
 var VERSION_MARKER = ".agent-sandbox-version";
 var desktopShortcut = (exe) => {
   if (!isWin) return;
-  const link = path62.join(os8.homedir(), "Desktop", "Visual Studio Code.lnk");
+  const link = path64.join(os9.homedir(), "Desktop", "Visual Studio Code.lnk");
   runScriptWithJson("new-shortcuts.ps1", "ListFile", [
     { link, target: exe, arguments: '"' + (process.env.AGENT_WORKSPACE ?? "") + '"' }
   ]);
 };
 async function setupVscode(env, refresh) {
   const root = tool("vscode");
-  const exe = path62.join(root, "Code.exe");
+  const exe = path64.join(root, "Code.exe");
   if (dryRun) {
     log("(dry run) would provision VS Code");
     return;
@@ -31897,11 +32480,11 @@ async function setupVscode(env, refresh) {
       "https://update.code.visualstudio.com/api/update/win32-" + (arch === "arm64" ? "arm64" : "x64") + "-archive/stable/latest"
     );
     log("Downloading VS Code " + release.productVersion + " (~150 MB once) ...");
-    const keep = path62.join(root, "data");
+    const keep = path64.join(root, "data");
     const parked = root + "-data";
     if (exists(keep)) {
-      fs48.rmSync(parked, { recursive: true, force: true });
-      fs48.renameSync(keep, parked);
+      fs51.rmSync(parked, { recursive: true, force: true });
+      fs51.renameSync(keep, parked);
     }
     try {
       await downloader.archive(release.url, root, {
@@ -31909,26 +32492,511 @@ async function setupVscode(env, refresh) {
         locate: "Code.exe",
         fileName: "vscode.zip"
       });
-      fs48.writeFileSync(path62.join(root, VERSION_MARKER), release.productVersion);
+      fs51.writeFileSync(path64.join(root, VERSION_MARKER), release.productVersion);
     } finally {
       if (exists(parked)) {
         mkdirp(root);
-        fs48.rmSync(keep, { recursive: true, force: true });
-        fs48.renameSync(parked, keep);
+        fs51.rmSync(keep, { recursive: true, force: true });
+        fs51.renameSync(parked, keep);
       }
     }
   }
-  mkdirp(path62.join(root, "data"));
-  env.prepend.push(path62.join(root, "bin"));
+  mkdirp(path64.join(root, "data"));
+  env.prepend.push(path64.join(root, "bin"));
   desktopShortcut(exe);
-  const version2 = exists(path62.join(root, VERSION_MARKER)) ? fs48.readFileSync(path62.join(root, VERSION_MARKER), "utf8").trim() : "installed";
+  const version2 = exists(path64.join(root, VERSION_MARKER)) ? fs51.readFileSync(path64.join(root, VERSION_MARKER), "utf8").trim() : "installed";
   env.summary.push("vscode: " + version2 + " (portable; run code . or use the desktop shortcut)");
 }
 
+// src/guest/toolchains/steam/steam.ts
+import fs55 from "node:fs";
+import path69 from "node:path";
+
+// src/shared/accounts/kinds/steam.ts
+import fs52 from "node:fs";
+import path65 from "node:path";
+
+// src/shared/vdf.ts
+var DEFAULT_MAX_BYTES = 1024 * 1024;
+var DEFAULT_MAX_DEPTH = 32;
+var DEFAULT_MAX_KEYS = 1e5;
+var isSpace = (c) => c === " " || c === "	" || c === "\r" || c === "\n" || c === "\f";
+var ESCAPED = { "\\": "\\", '"': '"', n: "\n", t: "	" };
+function tokenize(text, escapes) {
+  const tokens = [];
+  let i = 0;
+  const n = text.length;
+  while (i < n) {
+    const c = text[i];
+    if (isSpace(c)) {
+      i++;
+    } else if (c === "/" && text[i + 1] === "/") {
+      while (i < n && text[i] !== "\n") i++;
+    } else if (c === "{") {
+      tokens.push({ kind: "open" });
+      i++;
+    } else if (c === "}") {
+      tokens.push({ kind: "close" });
+      i++;
+    } else if (c === "[") {
+      const end = text.indexOf("]", i);
+      if (end < 0) return null;
+      i = end + 1;
+    } else if (c === '"') {
+      let out = "";
+      let start = ++i;
+      for (; ; ) {
+        if (i >= n) return null;
+        const d = text[i];
+        if (d === '"') break;
+        if (escapes && d === "\\" && i + 1 < n && ESCAPED[text[i + 1]] !== void 0) {
+          out += text.slice(start, i) + ESCAPED[text[i + 1]];
+          i += 2;
+          start = i;
+          continue;
+        }
+        i++;
+      }
+      tokens.push({ kind: "text", text: out + text.slice(start, i) });
+      i++;
+    } else {
+      const start = i;
+      while (i < n && !isSpace(text[i]) && text[i] !== "{" && text[i] !== "}" && text[i] !== '"') i++;
+      tokens.push({ kind: "text", text: text.slice(start, i) });
+    }
+  }
+  return tokens;
+}
+function open2() {
+  return { target: /* @__PURE__ */ Object.create(null), seen: /* @__PURE__ */ new Set() };
+}
+function setFirst(o, key2, value) {
+  const lower = key2.toLowerCase();
+  if (o.seen.has(lower)) return false;
+  o.seen.add(lower);
+  o.target[key2] = value;
+  return true;
+}
+function parseVdf(text, limits = {}) {
+  const maxBytes = limits.maxBytes ?? DEFAULT_MAX_BYTES;
+  const maxDepth = limits.maxDepth ?? DEFAULT_MAX_DEPTH;
+  const maxKeys = limits.maxKeys ?? DEFAULT_MAX_KEYS;
+  if (typeof text !== "string" || text.length > maxBytes) return null;
+  const tokens = tokenize(text.charCodeAt(0) === 65279 ? text.slice(1) : text, limits.escapes ?? true);
+  if (!tokens) return null;
+  const root = open2();
+  const stack = [root];
+  let keys = 0;
+  let i = 0;
+  while (i < tokens.length) {
+    const token = tokens[i];
+    const current = stack[stack.length - 1];
+    if (token.kind === "close") {
+      if (stack.length === 1) return null;
+      stack.pop();
+      i++;
+      continue;
+    }
+    if (token.kind === "open") return null;
+    if (++keys > maxKeys) return null;
+    const next = tokens[i + 1];
+    if (!next || next.kind === "close") return null;
+    if (next.kind === "open") {
+      if (stack.length > maxDepth) return null;
+      const child = open2();
+      setFirst(current, token.text, child.target);
+      stack.push(child);
+    } else {
+      setFirst(current, token.text, next.text);
+    }
+    i += 2;
+  }
+  return stack.length === 1 ? root.target : null;
+}
+function vdfGet(root, ...keys) {
+  let at = root ?? void 0;
+  for (const key2 of keys) {
+    if (at === void 0 || typeof at === "string") return void 0;
+    const lower = key2.toLowerCase();
+    let found;
+    for (const k in at)
+      if (k.toLowerCase() === lower) {
+        found = at[k];
+        break;
+      }
+    at = found;
+  }
+  return at;
+}
+function vdfObject(root, ...keys) {
+  const value = vdfGet(root, ...keys);
+  return value !== void 0 && typeof value !== "string" ? value : void 0;
+}
+
+// src/shared/accounts/kinds/steam.ts
+var MAX_STEAM_CONFIG_BYTES = 256 * 1024;
+var MAX_SENTRY_BYTES = 48 * 1024;
+var MAX_SENTRIES = 4;
+var MAX_ENTRIES2 = 5e3;
+var SENTRY = /^ssfn\d{1,40}$/;
+var STEAM_ACCOUNT = /^[A-Za-z0-9_]{1,64}$/;
+var STEAM_ACCOUNT_FILE = "sbx-account.txt";
+function steamConfigFile(steamcmdDir) {
+  return path65.join(steamcmdDir, "config", "config.vdf");
+}
+function steamKey(root) {
+  return vdfObject(root, "InstallConfigStore", "Software", "Valve", "Steam");
+}
+function hasCachedLogin(configVdf) {
+  const cache = vdfObject(steamKey(parseVdf(configVdf, { maxBytes: MAX_STEAM_CONFIG_BYTES })), "ConnectCache");
+  return cache !== void 0 && Object.keys(cache).length > 0;
+}
+function steamAccounts(configVdf) {
+  const accounts = vdfObject(steamKey(parseVdf(configVdf, { maxBytes: MAX_STEAM_CONFIG_BYTES })), "Accounts");
+  return accounts ? Object.keys(accounts).filter((a) => STEAM_ACCOUNT.test(a)) : [];
+}
+function readSteamAccountFile(steamcmdDir) {
+  const bytes = readBoundedFile(path65.join(steamcmdDir, "config", STEAM_ACCOUNT_FILE), 256);
+  const name = bytes ? decodeText(bytes).text.trim() : "";
+  return STEAM_ACCOUNT.test(name) ? name : null;
+}
+function readSentries(steamcmdDir) {
+  let names;
+  try {
+    names = fs52.readdirSync(steamcmdDir).slice(0, MAX_ENTRIES2).filter((n) => SENTRY.test(n));
+  } catch {
+    return [];
+  }
+  const mtime = (name) => {
+    try {
+      return fs52.lstatSync(path65.join(steamcmdDir, name)).mtimeMs;
+    } catch {
+      return 0;
+    }
+  };
+  const found = [];
+  for (const name of names.sort((a, b) => mtime(b) - mtime(a))) {
+    if (found.length >= MAX_SENTRIES) break;
+    const bytes = readBoundedFile(path65.join(steamcmdDir, name), MAX_SENTRY_BYTES);
+    if (bytes && bytes.length) found.push({ name, base64: bytes.toString("base64") });
+  }
+  return found.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+}
+function readSteamCmdLogin(steamcmdDir, account) {
+  const bytes = readBoundedFile(steamConfigFile(steamcmdDir), MAX_STEAM_CONFIG_BYTES);
+  if (!bytes) return null;
+  const configVdf = decodeText(bytes).text;
+  if (!hasCachedLogin(configVdf)) return null;
+  const name = readSteamAccountFile(steamcmdDir) ?? steamAccounts(configVdf)[0] ?? account;
+  if (!name) return null;
+  const parsed = SteamPayloadSchema.safeParse({ account: name, configVdf, sentries: readSentries(steamcmdDir) });
+  return parsed.success ? parsed.data : null;
+}
+function writeSteamCmdLogin(steamcmdDir, p) {
+  const login = SteamPayloadSchema.parse(p);
+  const config2 = path65.dirname(steamConfigFile(steamcmdDir));
+  fs52.mkdirSync(config2, { recursive: true });
+  fs52.writeFileSync(steamConfigFile(steamcmdDir), login.configVdf, "utf8");
+  fs52.writeFileSync(path65.join(config2, STEAM_ACCOUNT_FILE), login.account, "utf8");
+  for (const s of login.sentries) fs52.writeFileSync(path65.join(steamcmdDir, s.name), Buffer.from(s.base64, "base64"));
+}
+
+// src/guest/toolchains/steam/client.ts
+import fs53 from "node:fs";
+import path67 from "node:path";
+
+// src/guest/toolchains/steam/commands.ts
+import path66 from "node:path";
+var STEAMCMD_DIR = "C:\\SteamCMD";
+var STEAMCMD_URL = "https://steamcdn-a.akamaihd.net/client/installer/steamcmd.zip";
+var STEAM_CLIENT_URL = "https://steamcdn-a.akamaihd.net/client/installer/SteamSetup.exe";
+function steamCmdStore(tools = toolsDir) {
+  return path66.join(tools, "steamcmd");
+}
+function steamClientDir(tools = toolsDir) {
+  return path66.join(tools, "steam");
+}
+var MAX_SCRIPT_BYTES = 256 * 1024;
+
+// src/guest/toolchains/steam/client.ts
+var GB2 = 1024 ** 3;
+var CLIENT_NEED_BYTES = 2 * GB2;
+var SETUP_TIMEOUT_MS = 10 * 60 * 1e3;
+function installedSteamClient() {
+  const exe = path67.join(steamClientDir(), "steam.exe");
+  return exists(exe) && signedBy(exe, SIGNERS.valve) ? exe : null;
+}
+async function installSteamClient() {
+  const dir = steamClientDir();
+  const exe = path67.join(dir, "steam.exe");
+  if (exists(exe)) {
+    if (!signedBy(exe, SIGNERS.valve)) throw new Error("tools\\steam\\steam.exe is not signed by Valve");
+    return exe;
+  }
+  fs53.mkdirSync(toolsDir, { recursive: true });
+  assertRoom(toolsDir, CLIENT_NEED_BYTES, "the Steam client", "Free room on the data disk.");
+  const setup = await signedInstaller(
+    STEAM_CLIENT_URL,
+    path67.join(tool("steam-setup"), "SteamSetup.exe"),
+    "the Steam client installer (~2 MB once)",
+    SIGNERS.valve
+  );
+  const work = stagingFolder(dir);
+  fs53.mkdirSync(work, { recursive: true });
+  try {
+    log("Unpacking the Steam client into tools\\steam ...");
+    const code = await spawnAsync(setup, ["/S", "/D=" + work], { timeout: SETUP_TIMEOUT_MS });
+    const unpacked = path67.join(work, "steam.exe");
+    if (!exists(unpacked)) throw new Error("SteamSetup.exe did not unpack steam.exe (exit code " + code + ")");
+    if (!signedBy(unpacked, SIGNERS.valve)) throw new Error("the unpacked steam.exe is not signed by Valve");
+    moveIntoPlace(work, dir);
+  } finally {
+    if (fs53.existsSync(work)) safeRemove(work, path67.dirname(work));
+  }
+  return exe;
+}
+async function ensureSteamClient(env) {
+  try {
+    const exe = await installSteamClient();
+    env.summary.push("steam client: tools\\steam (start it with sbx-steam client; sign in there in each sandbox)");
+    return exe;
+  } catch (e) {
+    log("Steam client: not set up: " + errMsg(e));
+    env.summary.push("steam client: not set up (" + errMsg(e) + ")");
+    return null;
+  }
+}
+
+// src/guest/toolchains/steam/steamcmd-install.ts
+import { spawn as spawn5 } from "node:child_process";
+import fs54 from "node:fs";
+import path68 from "node:path";
+var MB = 1024 ** 2;
+var STEAMCMD_NEED_BYTES = 600 * MB;
+var STEAMCMD_UPDATE_TIMEOUT_MS = 15 * 60 * 1e3;
+var PRIVATE_DIRS = /* @__PURE__ */ new Set(["config", "logs", "dumps", "userdata", "steamapps", "appcache", "depotcache"]);
+var isPrivate = (name) => PRIVATE_DIRS.has(name.toLowerCase()) || /^ssfn/i.test(name);
+var BOOTSTRAPPED = ["steamclient.dll", "steamclient64.dll"];
+function runWithTimeout(exe, args, cwd, timeoutMs) {
+  return new Promise((resolve2, reject) => {
+    const child = spawn5(exe, args, { cwd, stdio: "ignore", windowsHide: true });
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill();
+    }, timeoutMs);
+    child.once("error", (e) => {
+      clearTimeout(timer);
+      reject(e);
+    });
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      resolve2({ code: code ?? -1, timedOut });
+    });
+  });
+}
+var notSigned = (file3) => new Error(path68.basename(file3) + " is not signed by Valve: not running it (it is downloaded again next boot)");
+async function fetchSteamCmd(store2, deps) {
+  fs54.mkdirSync(path68.dirname(store2), { recursive: true });
+  assertRoom(path68.dirname(store2), STEAMCMD_NEED_BYTES, "SteamCMD", "Free room on the data disk.", deps);
+  const work = stagingFolder(store2);
+  const unpacked = path68.join(work, "x");
+  const extract = deps.extract ?? extractArchive;
+  try {
+    fs54.mkdirSync(work, { recursive: true });
+    const verify = async (part) => {
+      await extract(part, unpacked);
+      const exe = path68.join(unpacked, "steamcmd.exe");
+      if (!fs54.existsSync(exe)) throw new Error("steamcmd.zip has no steamcmd.exe");
+      if (!deps.signed(exe)) throw notSigned(exe);
+    };
+    const zip = path68.join(work, "steamcmd.zip");
+    if (deps.download) await deps.download(STEAMCMD_URL, zip, verify);
+    else await downloader.file(STEAMCMD_URL, zip, { verify });
+    moveIntoPlace(unpacked, store2);
+  } finally {
+    if (fs54.existsSync(work)) safeRemove(work, path68.dirname(work));
+  }
+}
+async function copyBinaries(from, to) {
+  fs54.mkdirSync(to, { recursive: true });
+  for (const entry of fs54.readdirSync(from, { withFileTypes: true })) {
+    if (isPrivate(entry.name) || entry.isSymbolicLink()) continue;
+    if (!entry.isFile() && !entry.isDirectory()) continue;
+    await fs54.promises.cp(path68.join(from, entry.name), path68.join(to, entry.name), {
+      recursive: true,
+      force: true,
+      verbatimSymlinks: true,
+      filter: (source) => {
+        try {
+          return !fs54.lstatSync(source).isSymbolicLink();
+        } catch {
+          return false;
+        }
+      }
+    });
+  }
+}
+function snapshot(dir) {
+  try {
+    return fs54.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && !isPrivate(e.name) && /\.(exe|dll)$/i.test(e.name)).map((e) => {
+      const s = fs54.statSync(path68.join(dir, e.name));
+      return e.name.toLowerCase() + ":" + s.size + ":" + Math.floor(s.mtimeMs / 1e3);
+    }).sort().join("|");
+  } catch {
+    return "";
+  }
+}
+var bootstrapped = (dir) => BOOTSTRAPPED.some((f) => fs54.existsSync(path68.join(dir, f)));
+function scrubStore(store2) {
+  let names = [];
+  try {
+    names = fs54.readdirSync(store2);
+  } catch {
+    return;
+  }
+  for (const name of names.filter(isPrivate)) safeRemove(path68.join(store2, name), store2);
+}
+async function prepareSteamCmd(deps) {
+  const store2 = deps.storeDir ?? steamCmdStore(deps.toolsDir);
+  const work = deps.workDir ?? STEAMCMD_DIR;
+  const log2 = deps.log ?? (() => void 0);
+  const exe = path68.join(work, "steamcmd.exe");
+  if (fs54.existsSync(exe) && bootstrapped(work)) {
+    if (!deps.signed(exe)) throw notSigned(exe);
+    return exe;
+  }
+  if (!fs54.existsSync(path68.join(store2, "steamcmd.exe"))) {
+    log2("Downloading SteamCMD (~3 MB once; it fetches ~300 MB on its first run) ...");
+    await fetchSteamCmd(store2, deps);
+  }
+  scrubStore(store2);
+  await copyBinaries(store2, work);
+  if (!deps.signed(exe)) {
+    safeRemove(store2, path68.dirname(store2));
+    throw notSigned(exe);
+  }
+  const before = snapshot(work);
+  const run2 = deps.run ?? runWithTimeout;
+  const limit = deps.updateTimeoutMs ?? STEAMCMD_UPDATE_TIMEOUT_MS;
+  for (let attempt = 1; attempt <= 2; attempt++) {
+    log2(attempt === 1 ? "SteamCMD: checking for updates ..." : "SteamCMD: trying its update once more ...");
+    const result = await run2(exe, ["+quit"], work, limit);
+    if (result.timedOut)
+      throw new Error("SteamCMD did not finish updating itself in " + Math.round(limit / 6e4) + " minutes");
+    if (bootstrapped(work)) break;
+    if (attempt === 2) throw new Error("SteamCMD did not finish its first run (exit code " + result.code + ")");
+  }
+  if (!deps.signed(exe)) throw notSigned(exe);
+  if (snapshot(work) !== before || !bootstrapped(store2)) {
+    const staging = stagingFolder(store2);
+    try {
+      await copyBinaries(work, staging);
+      moveIntoPlace(staging, store2);
+    } finally {
+      if (fs54.existsSync(staging)) safeRemove(staging, path68.dirname(staging));
+    }
+  }
+  return exe;
+}
+
+// src/guest/toolchains/steam/steamcmd.ts
+function installSteamCmd() {
+  return prepareSteamCmd({ signed: (file3) => signedBy(file3, SIGNERS.valve), log });
+}
+
+// src/guest/toolchains/steam/steam.ts
+function signedInAs() {
+  const bytes = readBoundedFile(steamConfigFile(STEAMCMD_DIR), 256 * 1024);
+  if (!bytes || !hasCachedLogin(bytes.toString("utf8"))) return null;
+  return readSteamAccountFile(STEAMCMD_DIR) ?? "your account";
+}
+function sdkFolder(env, setting) {
+  if (!setting.trim()) return;
+  const dir = path69.resolve(projectWorkspace(), setting.trim());
+  let ok = false;
+  try {
+    ok = fs55.statSync(dir).isDirectory();
+  } catch {
+  }
+  if (!ok) {
+    log("Steamworks SDK: " + dir + " is not there (toolchains.steam.sdkFolder); STEAMWORKS_SDK is not set");
+    env.summary.push("steamworks sdk: " + dir + " not found");
+    return;
+  }
+  env.vars.STEAMWORKS_SDK = dir;
+  env.summary.push("steamworks sdk: STEAMWORKS_SDK=" + dir);
+}
+async function setupSteam(env, config2, ctx) {
+  if (dryRun) {
+    log("(dry run) would set up SteamCMD" + (config2.client ? " and the Steam client" : ""));
+    return;
+  }
+  const exe = await installSteamCmd();
+  env.append.push(STEAMCMD_DIR);
+  env.vars.STEAMCMD = exe;
+  const user = signedInAs();
+  env.summary.push(
+    "steamcmd: C:\\SteamCMD, " + (user ? "signed in as " + user : "not signed in (sbx-steam login <account>)")
+  );
+  sdkFolder(env, config2.sdkFolder);
+  const fromPc = ctx.pcInstalls.items.filter((i) => i.kind === "steam-game" || i.kind === "steam-library");
+  if (fromPc.length)
+    env.summary.push(
+      "steam: " + fromPc.length + " of this PC's games or libraries, read-only in C:\\PcInstalls\\steam"
+    );
+  if (!config2.client) return;
+  if (ctx.duringSession && !installedSteamClient()) {
+    env.summary.push("steam client: restart the sandbox to install it");
+    return;
+  }
+  await ensureSteamClient(env);
+}
+
+// src/guest/toolchains/engines/godot.ts
+async function setupGodot(env, _config, _ctx) {
+  notAvailableYet(env, "Godot");
+}
+
+// src/guest/toolchains/engines/unity.ts
+async function setupUnity(env, _config, _ctx) {
+  notAvailableYet(env, "Unity");
+}
+
+// src/guest/toolchains/fivem/fivem.ts
+async function setupFivem(env, _config, _ctx) {
+  notAvailableYet(env, "FiveM server");
+}
+
+// src/guest/toolchains/mobile/android.ts
+async function setupAndroid(env, _config, _ctx) {
+  notAvailableYet(env, "Android SDK");
+}
+
+// src/guest/toolchains/mobile/flutter.ts
+async function setupFlutter(env, _config, _ctx) {
+  notAvailableYet(env, "Flutter");
+}
+
+// src/guest/toolchains/mobile/dart.ts
+async function setupDart(env, _config, _ctx) {
+  notAvailableYet(env, "Dart");
+}
+
+// src/guest/toolchains/mobile/react-native.ts
+async function setupReactNative(env, _config, _ctx) {
+  notAvailableYet(env, "React Native");
+}
+
+// src/guest/toolchains/languages/kotlin.ts
+async function setupKotlin(env, _ctx) {
+  notAvailableYet(env, "Kotlin");
+}
+
 // src/guest/toolchains/native/rust-extras.ts
-import fs49 from "node:fs";
-import os9 from "node:os";
-import path63 from "node:path";
+import fs56 from "node:fs";
+import os10 from "node:os";
+import path70 from "node:path";
 
 // src/shared/memory/policy.ts
 var DIAL_STEPS = {
@@ -31977,41 +33045,41 @@ function maxCompilers(cpus, profile) {
 // src/guest/toolchains/native/rust-extras.ts
 var cargoTarget = (targetDir) => {
   if (targetDir === "shared" || targetDir === "separate") return null;
-  if (targetDir === "local") return path63.join(localDir, "cargo-target");
+  if (targetDir === "local") return path70.join(localDir, "cargo-target");
   return targetDir;
 };
 function cargoShim(env, rust) {
-  const real = path63.join(tool("rust", "cargo", "bin"), "cargo.exe");
+  const real = path70.join(tool("rust", "cargo", "bin"), "cargo.exe");
   if (rust.targetDir !== "separate" || !exists(real)) return;
   const dir = mkdirp(tool("shims", "cargo"));
-  fs49.copyFileSync(ensureCompiled("cargoshim"), path63.join(dir, "cargo.exe"));
+  fs56.copyFileSync(ensureCompiled("cargoshim"), path70.join(dir, "cargo.exe"));
   env.prepend.unshift(dir);
   env.vars.AGENT_REAL_CARGO = real;
 }
 function linkGate(env, rust, host) {
   const gcc = tool("mingw", "mingw64", "bin", "gcc.exe");
   if (!host.endsWith("-pc-windows-gnu") || !exists(gcc)) return;
-  const gate = path63.join(mkdirp(tool("shims")), "linkgate.exe");
-  fs49.copyFileSync(ensureCompiled("linkgate"), gate);
-  const memoryGb = os9.totalmem() / 1024 ** 3;
+  const gate = path70.join(mkdirp(tool("shims")), "linkgate.exe");
+  fs56.copyFileSync(ensureCompiled("linkgate"), gate);
+  const memoryGb = os10.totalmem() / 1024 ** 3;
   const slots = rust.linkSlots === "auto" ? linkSlotsFor(memoryGb) : rust.linkSlots;
   env.vars.AGENT_LINK_SLOTS = String(slots);
   env.vars.AGENT_REAL_LINKER = gcc;
   env.vars.CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER = gate;
   const rustEnv = { ...process.env, RUSTUP_HOME: tool("rust", "rustup"), CARGO_HOME: tool("rust", "cargo") };
   const sysroot = rust.linker === "lld" ? execOutput(tool("rust", "cargo", "bin", "rustc.exe"), ["--print", "sysroot"], { env: rustEnv }) : "";
-  const lld = sysroot ? path63.join(sysroot, "lib", "rustlib", host, "bin", "gcc-ld") : "";
-  if (lld && exists(path63.join(lld, "ld.lld.exe"))) env.vars.AGENT_LLD_DIR = lld;
+  const lld = sysroot ? path70.join(sysroot, "lib", "rustlib", host, "bin", "gcc-ld") : "";
+  if (lld && exists(path70.join(lld, "ld.lld.exe"))) env.vars.AGENT_LLD_DIR = lld;
   env.summary.push(
     "rust linking: " + (env.vars.AGENT_LLD_DIR ? "lld" : "GNU ld") + ", at most " + env.vars.AGENT_LINK_SLOTS + " at once"
   );
 }
 function cargoDefaults(host) {
   const file3 = tool("rust", "cargo", "config.toml");
-  if (exists(file3) || !exists(path63.dirname(file3))) return;
-  const jobs = cargoJobs(os9.cpus().length, os9.totalmem() / 1024 ** 3, 1);
+  if (exists(file3) || !exists(path70.dirname(file3))) return;
+  const jobs = cargoJobs(os10.cpus().length, os10.totalmem() / 1024 ** 3, 1);
   const gnu = host.endsWith("-gnu");
-  fs49.writeFileSync(
+  fs56.writeFileSync(
     file3,
     [
       "# Written by windows-development-sandbox once; edit freely, it is never overwritten.",
@@ -32026,7 +33094,7 @@ function rustCaches(rust) {
   const target = cargoTarget(rust.targetDir);
   return {
     ...target ? { CARGO_TARGET_DIR: target } : {},
-    ...process.env.SCCACHE_DIR ? {} : { SCCACHE_DIR: path63.join(dataDir, "cache", "sccache") }
+    ...process.env.SCCACHE_DIR ? {} : { SCCACHE_DIR: path70.join(dataDir, "cache", "sccache") }
   };
 }
 function rustHost(config2) {
@@ -32054,6 +33122,13 @@ function plan(config2, versions, o) {
   const java = wanted(config2.java.enabled, "java");
   const python = wanted(config2.python.enabled, "python");
   const unreal = wanted(config2.unreal.enabled, "unreal");
+  const android = wanted(config2.android.enabled, "android");
+  const vs = visualStudioWanted(config2, (setting, name) => wanted(setting, name));
+  const ctx = {
+    refresh: o.refresh,
+    pcInstalls: o.pcInstalls ?? { items: [] },
+    duringSession: duringSession()
+  };
   return [
     {
       name: "Git",
@@ -32071,18 +33146,32 @@ function plan(config2, versions, o) {
       enabled: wanted(config2.cpp.enabled, "cpp") || wanted(config2.rust.enabled, "rust"),
       install: (env) => setupCpp(env, config2.cpp)
     },
-    // Unreal's Visual Studio brings MSVC and the real vswhere: the portable MSVC (and its stand-in vswhere) stays out.
-    { name: "Unreal", enabled: unreal, shared: true, install: (env) => setupUnreal(env, config2.unreal) },
+    // Visual Studio brings MSVC and the real vswhere: the portable MSVC (and its stand-in vswhere) stays out.
+    {
+      name: "Visual Studio",
+      enabled: vs !== null,
+      shared: true,
+      install: async (env) => {
+        await ensureVisualStudio(env, vs, { keepInstallFiles: config2.unreal.keepInstallFiles });
+      }
+    },
+    {
+      name: "Unreal",
+      enabled: unreal,
+      shared: true,
+      after: ["Visual Studio"],
+      install: (env) => setupUnreal(env, config2.unreal, ctx)
+    },
     {
       name: "MSVC",
-      enabled: wanted(config2.msvc.enabled, "msvc") && !unreal,
+      enabled: wanted(config2.msvc.enabled, "msvc") && vs === null,
       install: (env) => setupMsvc(env, config2.msvc)
     },
     // Rust links with MSVC (msvc host) or MinGW's gcc (GNU host): whichever it uses goes first.
     {
       name: "Rust",
       enabled: wanted(config2.rust.enabled, "rust"),
-      after: ["C/C++", "MSVC", "Unreal"],
+      after: ["C/C++", "MSVC", "Visual Studio", "Unreal"],
       install: async (env) => {
         await setupRust(env, { ...config2.rust, host: rustHost(config2) }, o.refresh);
         Object.assign(env.vars, rustCaches(config2.rust));
@@ -32100,6 +33189,49 @@ function plan(config2, versions, o) {
     },
     { name: "Go", enabled: wanted(config2.go.enabled, "go"), install: (env) => setupGo(env, config2.go) },
     { name: "Java", enabled: java, install: (env) => setupJava(env, config2.java) },
+    { name: "Kotlin", enabled: java && config2.java.kotlin, after: ["Java"], install: (env) => setupKotlin(env, ctx) },
+    // Game engines, stores and mobile: each module keeps its big installs in tools (persisted.ts).
+    {
+      name: "Android SDK",
+      enabled: android,
+      after: ["Java"],
+      install: (env) => setupAndroid(env, config2.android, ctx)
+    },
+    {
+      name: "Steam",
+      enabled: wanted(config2.steam.enabled, "steam"),
+      install: (env) => setupSteam(env, config2.steam, ctx)
+    },
+    {
+      name: "Unity",
+      enabled: wanted(config2.unity.enabled, "unity"),
+      after: ["Visual Studio", "Android SDK"],
+      install: (env) => setupUnity(env, config2.unity, ctx)
+    },
+    {
+      name: "Godot",
+      enabled: wanted(config2.godot.enabled, "godot"),
+      after: [".NET", "Android SDK"],
+      install: (env) => setupGodot(env, config2.godot, ctx)
+    },
+    {
+      name: "FiveM server",
+      enabled: wanted(config2.fivem.enabled, "fivem"),
+      install: (env) => setupFivem(env, config2.fivem, ctx)
+    },
+    {
+      name: "Flutter",
+      enabled: wanted(config2.flutter.enabled, "flutter"),
+      after: ["Visual Studio", "Android SDK"],
+      install: (env) => setupFlutter(env, config2.flutter, ctx)
+    },
+    { name: "Dart", enabled: wanted(config2.dart.enabled, "dart"), install: (env) => setupDart(env, config2.dart, ctx) },
+    {
+      name: "React Native",
+      enabled: wanted(config2.reactNative.enabled, "reactNative"),
+      after: ["Android SDK"],
+      install: (env) => setupReactNative(env, config2.reactNative, ctx)
+    },
     { name: "Ruby", enabled: wanted(config2.ruby.enabled, "ruby"), install: (env) => setupRuby(env, config2.ruby) },
     // PHP installs the Visual C++ runtime itself: one installer at a time.
     // Many apps (bat, delta, Neovim, most GUIs, your own programs) are built against it too.
@@ -32175,7 +33307,7 @@ function plan(config2, versions, o) {
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 
 // src/guest/runtime/status.ts
-import os10 from "node:os";
+import os11 from "node:os";
 var progress;
 function setSandboxStatus(phase, message, update) {
   try {
@@ -32199,7 +33331,7 @@ function fitProgress(p) {
   };
 }
 function ownAddresses() {
-  return Object.values(os10.networkInterfaces()).flat().filter((i) => Boolean(i) && i.family === "IPv4" && !i.internal).map((i) => i.address).slice(0, 8);
+  return Object.values(os11.networkInterfaces()).flat().filter((i) => Boolean(i) && i.family === "IPv4" && !i.internal).map((i) => i.address).slice(0, 8);
 }
 function writeStatus(phase, message) {
   writeJsonAtomic(run.sandboxFile, {
@@ -32344,21 +33476,21 @@ function cmdSet(env, names) {
   return names.filter((n) => env[n] !== void 0 && !/[\r\n]/.test(String(env[n]))).map((n) => '@set "' + n + "=" + String(env[n]).replace(/%/g, "%%") + '"');
 }
 function writeShell(spec, env, names) {
-  const dir = mkdirp(path64.join(localDir, "projects", spec.name));
-  fs50.writeFileSync(path64.join(dir, "env.cmd"), [...cmdSet(env, [...names, "PATH"]), ""].join("\r\n"));
-  fs50.writeFileSync(
-    path64.join(dir, "shell.cmd"),
-    ['@call "' + path64.join(dir, "env.cmd") + '"', '@cd /d "' + spec.workspace + '"', "@title " + spec.name, ""].join(
+  const dir = mkdirp(path71.join(localDir, "projects", spec.name));
+  fs57.writeFileSync(path71.join(dir, "env.cmd"), [...cmdSet(env, [...names, "PATH"]), ""].join("\r\n"));
+  fs57.writeFileSync(
+    path71.join(dir, "shell.cmd"),
+    ['@call "' + path71.join(dir, "env.cmd") + '"', '@cd /d "' + spec.workspace + '"', "@title " + spec.name, ""].join(
       "\r\n"
     )
   );
-  const bin = mkdirp(path64.join(localDir, "bin"));
-  fs50.writeFileSync(
-    path64.join(bin, "sbx-shell.cmd"),
+  const bin = mkdirp(path71.join(localDir, "bin"));
+  fs57.writeFileSync(
+    path71.join(bin, "sbx-shell.cmd"),
     [
-      '@if "%~1"=="" (echo Usage: sbx-shell ^<project^>   ^(a terminal in that project with its tools^) & dir /b "' + path64.join(localDir, "projects") + '" & exit /b 2)',
-      '@if not exist "' + path64.join(localDir, "projects") + '\\%~1\\shell.cmd" (echo No project %~1 in this sandbox. & exit /b 2)',
-      '@cmd /k ""' + path64.join(localDir, "projects") + '\\%~1\\shell.cmd""',
+      '@if "%~1"=="" (echo Usage: sbx-shell ^<project^>   ^(a terminal in that project with its tools^) & dir /b "' + path71.join(localDir, "projects") + '" & exit /b 2)',
+      '@if not exist "' + path71.join(localDir, "projects") + '\\%~1\\shell.cmd" (echo No project %~1 in this sandbox. & exit /b 2)',
+      '@cmd /k ""' + path71.join(localDir, "projects") + '\\%~1\\shell.cmd""',
       ""
     ].join("\r\n")
   );
@@ -32411,10 +33543,10 @@ async function setUp(spec, say) {
       }
     )
   );
-  tools.prepend.push(path64.join(localDir, "bin"));
+  tools.prepend.push(path71.join(localDir, "bin"));
   const env = agentEnv(tools, { workspace: spec.workspace, project: spec.name, base });
-  const specFile = path64.join(mkdirp(path64.join(localDir, "projects", spec.name)), "project.json");
-  fs50.writeFileSync(specFile, JSON.stringify(spec));
+  const specFile = path71.join(mkdirp(path71.join(localDir, "projects", spec.name)), "project.json");
+  fs57.writeFileSync(specFile, JSON.stringify(spec));
   env.AGENT_PROJECT_FILE = specFile;
   addMachineEnvironment(tools.vars, [...tools.prepend, ...tools.append], true);
   try {
@@ -32502,7 +33634,7 @@ function execCommand(req) {
     return;
   }
   const env = withRegistryPath(provisioner.provisionedFor(req.cwd)?.env ?? process.env);
-  const child = spawn5(
+  const child = spawn6(
     SYSTEM.cmd(),
     ["/d", "/s", "/c", '"chcp 65001>nul & ' + req.command.map(quoteForCmd).join(" ") + '"'],
     { cwd: req.cwd, env, windowsHide: true, windowsVerbatimArguments: true }
@@ -32531,11 +33663,11 @@ function execCommand(req) {
 }
 
 // src/guest/daemon/sessions.ts
-import fs54 from "node:fs";
-import path69 from "node:path";
-import crypto4 from "node:crypto";
-import os12 from "node:os";
-import { spawn as spawn7 } from "node:child_process";
+import fs63 from "node:fs";
+import path80 from "node:path";
+import crypto5 from "node:crypto";
+import os13 from "node:os";
+import { spawn as spawn8 } from "node:child_process";
 
 // src/shared/pty/protocol.ts
 var FrameType = {
@@ -32613,7 +33745,7 @@ async function sendControl(endpoint, type) {
 var MAX_CLIPBOARD_STRING = 1024 * 1024;
 
 // src/guest/sessions/cmdline.ts
-import path65 from "node:path";
+import path72 from "node:path";
 var quoted = (arg) => '"' + arg.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, "$1$1") + '"';
 function quoteArg(arg) {
   return arg !== "" && !/[\s"]/.test(arg) ? arg : quoted(arg);
@@ -32627,7 +33759,7 @@ function cmdArgs(args) {
   }).join("");
 }
 function commandLine(file3, args) {
-  return path65.win32.basename(file3).toLowerCase() === "cmd.exe" ? [quoteArg(file3), cmdArgs(args)].filter(Boolean).join(" ") : [file3, ...args].map(quoteArg).join(" ");
+  return path72.win32.basename(file3).toLowerCase() === "cmd.exe" ? [quoteArg(file3), cmdArgs(args)].filter(Boolean).join(" ") : [file3, ...args].map(quoteArg).join(" ");
 }
 function shellLaunch(asked, paths) {
   if (asked === "cmd") return { name: "cmd", file: paths.cmd, args: [] };
@@ -32641,9 +33773,9 @@ function shellLaunch(asked, paths) {
 }
 
 // src/guest/sessions/pty-host.ts
-import fs51 from "node:fs";
-import path66 from "node:path";
-import { execFile, spawn as spawn6 } from "node:child_process";
+import fs58 from "node:fs";
+import path73 from "node:path";
+import { execFile, spawn as spawn7 } from "node:child_process";
 function ensurePtyHost() {
   return ensureCompiled("ptyhost");
 }
@@ -32661,21 +33793,21 @@ async function waitForPtyHost(child, port, timeoutMs) {
   throw new Error("the session host did not start listening on port " + port);
 }
 function ptyHostLog(id) {
-  return path66.join(logsDir, "ptyhost-" + id + ".log");
+  return path73.join(logsDir, "ptyhost-" + id + ".log");
 }
 function ptyHostLogTail(id, lines = 12) {
   try {
-    return fs51.readFileSync(ptyHostLog(id), "utf8").trim().split(/\r?\n/).slice(-lines).join("\n");
+    return fs58.readFileSync(ptyHostLog(id), "utf8").trim().split(/\r?\n/).slice(-lines).join("\n");
   } catch {
     return "";
   }
 }
 var conptyDll = () => {
-  const dll = path66.join(toolsDir, "conpty", "conpty.dll");
-  return session.provisioning.conpty?.enabled !== false && fs51.existsSync(dll) && fs51.existsSync(path66.join(toolsDir, "conpty", "OpenConsole.exe")) ? dll : null;
+  const dll = path73.join(toolsDir, "conpty", "conpty.dll");
+  return session.provisioning.conpty?.enabled !== false && fs58.existsSync(dll) && fs58.existsSync(path73.join(toolsDir, "conpty", "OpenConsole.exe")) ? dll : null;
 };
 function startPtyHost(o) {
-  fs51.mkdirSync(run.treesDir, { recursive: true });
+  fs58.mkdirSync(run.treesDir, { recursive: true });
   const env = {
     ...o.env,
     PTYHOST_BIND: o.remote ? "any" : "loopback",
@@ -32684,7 +33816,7 @@ function startPtyHost(o) {
   delete env.PTYHOST_CONPTY;
   const dll = conptyDll();
   if (dll) env.PTYHOST_CONPTY = dll;
-  return spawn6(
+  return spawn7(
     o.exe,
     [String(o.port), o.token, String(o.cols), String(o.rows), ptyHostLog(o.id), o.command, o.restartCommand],
     { cwd: o.cwd, env, detached: true, stdio: "ignore", windowsHide: true }
@@ -32693,13 +33825,13 @@ function startPtyHost(o) {
 var END_TREE_MS = 3e4;
 function endLeftoverTree(id, exe = ensurePtyHost()) {
   const file3 = run.treeFile(id);
-  if (!fs51.existsSync(file3)) return Promise.resolve(null);
+  if (!fs58.existsSync(file3)) return Promise.resolve(null);
   return new Promise((resolve2) => {
     execFile(exe, ["--end-tree", file3], { timeout: END_TREE_MS, windowsHide: true }, (error62, stdout) => {
       const code = error62 ? typeof error62.code === "number" ? error62.code : -1 : 0;
       if (code !== 3)
         try {
-          fs51.rmSync(file3, { force: true });
+          fs58.rmSync(file3, { force: true });
         } catch {
         }
       resolve2(code === 0 ? stdout.trim().slice(0, 200) : code === 3 ? null : "could not end them (code " + code + ")");
@@ -32708,15 +33840,15 @@ function endLeftoverTree(id, exe = ensurePtyHost()) {
 }
 function recordedTrees() {
   try {
-    return fs51.readdirSync(run.treesDir).filter((n) => /^[A-Za-z0-9_-]{1,64}\.json$/.test(n)).map((n) => n.slice(0, -".json".length));
+    return fs58.readdirSync(run.treesDir).filter((n) => /^[A-Za-z0-9_-]{1,64}\.json$/.test(n)).map((n) => n.slice(0, -".json".length));
   } catch {
     return [];
   }
 }
 
 // src/guest/agents/agent-installer.ts
-import fs52 from "node:fs";
-import path67 from "node:path";
+import fs59 from "node:fs";
+import path74 from "node:path";
 
 // src/guest/agents/profile-links.ts
 var profileRoot = () => process.env.USERPROFILE ?? "";
@@ -32742,7 +33874,7 @@ var agentPaths2 = (name, harness) => agentPaths(toolsDir, name, harness);
 async function installViaNpm(name, harness, dir, env) {
   if (!harness.npmPackage)
     throw new Error("No npmPackage configured for " + name + " and no host executable was available.");
-  const npmCli = path67.join(path67.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+  const npmCli = path74.join(path74.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
   const args = [npmCli, "install", "--global", "--prefix", dir, harness.npmPackage, "--no-fund", "--no-audit"];
   log("Installing " + harness.npmPackage + " (this can take a minute)...");
   if (dryRun) {
@@ -32753,7 +33885,7 @@ async function installViaNpm(name, harness, dir, env) {
   await execAsync(process.execPath, args, { env });
 }
 async function installViaUv(name, harness, dir, env) {
-  const uv = path67.join(toolsDir, "uv", "uv.exe");
+  const uv = path74.join(toolsDir, "uv", "uv.exe");
   log("Installing " + harness.uvPackage + " with uv (this can take a minute)...");
   if (dryRun) {
     log("(dry run) uv tool install " + harness.uvPackage);
@@ -32768,8 +33900,8 @@ async function installViaUv(name, harness, dir, env) {
   });
 }
 function putOnPath(dir, env) {
-  const parts2 = (env.PATH ?? "").split(path67.delimiter);
-  if (!parts2.some((p) => p.toLowerCase() === dir.toLowerCase())) env.PATH = [...parts2, dir].join(path67.delimiter);
+  const parts2 = (env.PATH ?? "").split(path74.delimiter);
+  if (!parts2.some((p) => p.toLowerCase() === dir.toLowerCase())) env.PATH = [...parts2, dir].join(path74.delimiter);
   addMachineEnvironment({}, [dir], true);
 }
 var AgentInstaller = class {
@@ -32810,9 +33942,9 @@ var AgentInstaller = class {
     }
     mkdirp(p.dir);
     if (this.sourceOf(name, harness) === "host") {
-      const source = path67.join(hostToolsDir, "agents", name, harness.hostExecutable);
+      const source = path74.join(hostToolsDir, "agents", name, harness.hostExecutable);
       if (exists(source) && p.exe) {
-        fs52.copyFileSync(source, p.exe);
+        fs59.copyFileSync(source, p.exe);
         log("Copied " + name + " from this PC: " + source);
         return;
       }
@@ -32827,28 +33959,28 @@ var AgentInstaller = class {
 var agents = new AgentInstaller();
 
 // src/guest/network/addresses.ts
-import os11 from "node:os";
+import os12 from "node:os";
 function guestAddresses() {
-  return Object.values(os11.networkInterfaces()).flat().filter((i) => Boolean(i) && i.family === "IPv4" && !i.internal).map((i) => i.address);
+  return Object.values(os12.networkInterfaces()).flat().filter((i) => Boolean(i) && i.family === "IPv4" && !i.internal).map((i) => i.address);
 }
 
 // src/guest/sessions/conversation.ts
-import fs53 from "node:fs";
-import path68 from "node:path";
+import fs60 from "node:fs";
+import path75 from "node:path";
 var MAX_FILES = 2e3;
 function conversationFiles(claudeDir2, cwd) {
   const names = /* @__PURE__ */ new Set([projectFolderName(cwd), projectFolderName(sandboxFolder(cwd))]);
   return [...names].flatMap((name) => {
-    const dir = path68.join(claudeDir2, "projects", name);
+    const dir = path75.join(claudeDir2, "projects", name);
     let entries2;
     try {
-      entries2 = fs53.readdirSync(dir);
+      entries2 = fs60.readdirSync(dir);
     } catch {
       return [];
     }
     return entries2.filter((e) => e.endsWith(".jsonl") && isConversationId(e.slice(0, -".jsonl".length))).slice(0, MAX_FILES).flatMap((e) => {
       try {
-        return [{ id: e.slice(0, -".jsonl".length), createdMs: fs53.statSync(path68.join(dir, e)).birthtimeMs }];
+        return [{ id: e.slice(0, -".jsonl".length), createdMs: fs60.statSync(path75.join(dir, e)).birthtimeMs }];
       } catch {
         return [];
       }
@@ -32861,6 +33993,263 @@ function findConversation(claudeDir2, cwd, sessionStartMs, claimed) {
 
 // src/guest/daemon/idle-shutdown.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
+
+// src/guest/accounts/watch.ts
+import fs62 from "node:fs";
+import path79 from "node:path";
+
+// src/shared/accounts/fingerprint.ts
+import crypto4 from "node:crypto";
+function canonical2(value) {
+  if (Array.isArray(value)) return "[" + value.map(canonical2).join(",") + "]";
+  if (value && typeof value === "object")
+    return "{" + Object.keys(value).filter((k) => value[k] !== void 0).sort().map((k) => JSON.stringify(k) + ":" + canonical2(value[k])).join(",") + "}";
+  return JSON.stringify(value) ?? "null";
+}
+function fingerprint2(payload) {
+  return crypto4.createHash("sha256").update(canonical2(payload)).digest("hex");
+}
+
+// src/guest/accounts/adapter.ts
+import path76 from "node:path";
+function localAppData() {
+  return process.env.LOCALAPPDATA ?? "C:\\Users\\WDAGUtilityAccount\\AppData\\Local";
+}
+function accountsRoot() {
+  return path76.join(localAppData(), "AgentSandbox", "accounts");
+}
+function notAvailableYet2(kind) {
+  return { summary: kind + ": using a saved sign-in is not available yet (it is not used)" };
+}
+
+// src/guest/accounts/kinds/appstore.ts
+var appstoreAdapter = {
+  kind: "appstore",
+  apply(_p) {
+    return notAvailableYet2("appstore");
+  }
+};
+
+// src/guest/accounts/kinds/cfx.ts
+var cfxAdapter = {
+  kind: "cfx",
+  apply(_p) {
+    return notAvailableYet2("cfx");
+  }
+};
+
+// src/guest/accounts/kinds/epic.ts
+import fs61 from "node:fs";
+import path77 from "node:path";
+
+// src/shared/accounts/kinds/epic.ts
+var MAX_EPIC_INI_BYTES = 1024 * 1024;
+var SECTION = "[rememberme]";
+function epicSettingsFile(localAppData2) {
+  return localAppData2 + "\\EpicGamesLauncher\\Saved\\Config\\Windows\\GameUserSettings.ini";
+}
+var isHeader = (line) => line.trimStart().startsWith("[");
+function readEpicLogin(ini) {
+  let inSection = false;
+  let enabled2 = true;
+  let data = null;
+  for (const raw of ini.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (isHeader(line)) {
+      inSection = line.toLowerCase() === SECTION;
+      continue;
+    }
+    if (!inSection) continue;
+    const at = line.indexOf("=");
+    if (at < 0) continue;
+    const key2 = line.slice(0, at).trim().toLowerCase();
+    const value = line.slice(at + 1).trim();
+    if (key2 === "enable") enabled2 = value.toLowerCase() === "true";
+    else if (key2 === "data") data = value;
+  }
+  if (!enabled2 || !data) return null;
+  const parsed = EpicPayloadSchema.safeParse({ data });
+  return parsed.success ? parsed.data : null;
+}
+function withEpicLogin(ini, login) {
+  const kept = [];
+  let inSection = false;
+  for (const line of ini.split(/\r?\n/)) {
+    if (isHeader(line)) inSection = line.trim().toLowerCase() === SECTION;
+    if (!inSection) kept.push(line);
+  }
+  while (kept.length && kept[kept.length - 1].trim() === "") kept.pop();
+  const section = ["[RememberMe]", "Enable=True", "Data=" + EpicPayloadSchema.parse(login).data];
+  return [...kept, ...kept.length ? [""] : [], ...section, ""].join("\r\n");
+}
+
+// src/guest/accounts/kinds/epic.ts
+function settingsFile() {
+  return epicSettingsFile(localAppData());
+}
+var epicAdapter = {
+  kind: "epic",
+  apply(p) {
+    const file3 = settingsFile();
+    const bytes = readBoundedFile(file3, MAX_EPIC_INI_BYTES);
+    const read = bytes ? decodeText(bytes) : { text: "", encoding: "utf8" };
+    fs61.mkdirSync(path77.dirname(file3), { recursive: true });
+    fs61.writeFileSync(file3, encodeText(withEpicLogin(read.text, p), read.encoding));
+    return { summary: "Epic Games Launcher: signed in with your saved sign-in" };
+  },
+  current() {
+    const bytes = readBoundedFile(settingsFile(), MAX_EPIC_INI_BYTES);
+    return bytes ? readEpicLogin(decodeText(bytes).text) : null;
+  }
+};
+
+// src/guest/accounts/kinds/expo.ts
+var expoAdapter = {
+  kind: "expo",
+  apply(_p) {
+    return notAvailableYet2("expo");
+  }
+};
+
+// src/guest/accounts/kinds/keystore.ts
+var keystoreAdapter = {
+  kind: "keystore",
+  apply(_p) {
+    return notAvailableYet2("keystore");
+  }
+};
+
+// src/guest/accounts/kinds/play.ts
+var playAdapter = {
+  kind: "play",
+  apply(_p) {
+    return notAvailableYet2("play");
+  }
+};
+
+// src/guest/accounts/kinds/steam.ts
+function steamAdapterFor(steamcmdDir) {
+  return {
+    kind: "steam",
+    apply(p) {
+      writeSteamCmdLogin(steamcmdDir, p);
+      return { summary: "SteamCMD: signed in as " + p.account + " with your saved sign-in" };
+    },
+    current: () => readSteamCmdLogin(steamcmdDir)
+  };
+}
+var steamAdapter = steamAdapterFor(STEAMCMD_DIR);
+
+// src/guest/accounts/kinds/unity.ts
+var unityAdapter = {
+  kind: "unity",
+  apply(_p) {
+    return notAvailableYet2("unity");
+  }
+};
+
+// src/guest/accounts/adapters.ts
+var ADAPTERS = {
+  epic: epicAdapter,
+  steam: steamAdapter,
+  unity: unityAdapter,
+  cfx: cfxAdapter,
+  keystore: keystoreAdapter,
+  play: playAdapter,
+  expo: expoAdapter,
+  appstore: appstoreAdapter
+};
+
+// src/guest/accounts/apply.ts
+import path78 from "node:path";
+var DeliveredSchema = external_exports.object({
+  fingerprints: external_exports.partialRecord(external_exports.enum(SERVICE_KINDS), external_exports.string().max(128)),
+  leased: external_exports.array(external_exports.enum(SERVICE_KINDS))
+});
+function deliveredFile(root = accountsRoot()) {
+  return path78.join(root, "delivered.json");
+}
+function readDelivered(root = accountsRoot()) {
+  return readValid(DeliveredSchema, deliveredFile(root)) ?? { fingerprints: {}, leased: [] };
+}
+
+// src/guest/accounts/watch.ts
+var DEFAULT_CHECK_MS = 6e4;
+var AccountWatch = class {
+  constructor(kinds, o) {
+    this.o = o;
+    this.kinds = kinds.filter((k) => SERVICE_SPECS[k].returns && this.adapter(k).current);
+    const delivered = readDelivered(o.root);
+    for (const kind of this.kinds) this.last.set(kind, delivered.fingerprints[kind] ?? null);
+  }
+  o;
+  last = /* @__PURE__ */ new Map();
+  timers = [];
+  kinds;
+  adapter(kind) {
+    return this.o.adapters?.[kind] ?? ADAPTERS[kind];
+  }
+  /** The kinds being watched. */
+  watched() {
+    return this.kinds;
+  }
+  start() {
+    for (const kind of this.kinds) {
+      const timer = setInterval(() => this.check(kind), this.adapter(kind).checkMs ?? DEFAULT_CHECK_MS);
+      timer.unref();
+      this.timers.push(timer);
+    }
+  }
+  /** One look at one kind; true when a handoff was written. */
+  check(kind) {
+    try {
+      const now2 = this.adapter(kind).current?.() ?? null;
+      if (!now2) return false;
+      const print = fingerprint2(now2);
+      if (print === this.last.get(kind)) return false;
+      const file3 = path79.join(this.o.dataDir, ...HANDOFF_PARTS, kind + ".json");
+      fs62.mkdirSync(path79.dirname(file3), { recursive: true });
+      writeJsonAtomic(file3, { kind, launchId: this.o.launchId, payload: now2 });
+      this.last.set(kind, print);
+      return true;
+    } catch (e) {
+      this.o.warn?.(SERVICE_SPECS[kind].label + " sign-in: could not keep it for the next sandbox: " + errMsg(e));
+      return false;
+    }
+  }
+  /** Looks at every kind now; with `final` (the sandbox stops) each adapter also lets go of what it holds. */
+  async flush(final = false) {
+    for (const kind of this.kinds) this.check(kind);
+    if (!final) return;
+    for (const timer of this.timers) clearInterval(timer);
+    for (const kind of this.kinds) {
+      try {
+        await this.adapter(kind).release?.();
+      } catch (e) {
+        this.o.warn?.(SERVICE_SPECS[kind].label + ": could not let go of the sign-in: " + errMsg(e));
+      }
+    }
+  }
+};
+
+// src/guest/daemon/accounts.ts
+var watch = null;
+function startAccountWatch() {
+  const kinds = session.accountLeases ?? [];
+  if (!kinds.length) return;
+  watch = new AccountWatch(kinds, { dataDir, launchId: session.launchId, warn });
+  watch.start();
+  if (watch.watched().length) log("Service sign-ins kept for the next sandbox: " + watch.watched().join(", "));
+}
+async function flushAccounts(final = false) {
+  try {
+    await watch?.flush(final);
+  } catch (e) {
+    warn("service sign-ins: " + String(e));
+  }
+}
+
+// src/guest/daemon/idle-shutdown.ts
 var GRACE_MS = 15e3;
 var IdleShutdown = class {
   /** `busy`: a session runs or is starting. */
@@ -32877,7 +34266,7 @@ var IdleShutdown = class {
       log("Headless sandbox has no sessions left; shutting down.");
       safely("claude-mem save", saveClaudeMem);
       safely("agent databases save", saveLocalState);
-      spawnSync6(SYSTEM.shutdown(), ["/s", "/t", "5"], { windowsHide: true });
+      void flushAccounts(true).finally(() => spawnSync6(SYSTEM.shutdown(), ["/s", "/t", "5"], { windowsHide: true }));
     }, GRACE_MS);
   }
   idle() {
@@ -32889,11 +34278,11 @@ var IdleShutdown = class {
 var CLOSE_WAIT_MS = 8e3;
 var ROOTS_KEPT_MS = 10 * 60 * 1e3;
 function terminalTab(id, title, cwd) {
-  const view = [process.execPath, path69.join(path69.dirname(process.argv[1]), "view.js"), id];
-  const wt = path69.join(toolsDir, "terminal", "wt.exe");
+  const view = [process.execPath, path80.join(path80.dirname(process.argv[1]), "view.js"), id];
+  const wt = path80.join(toolsDir, "terminal", "wt.exe");
   if (exists(wt))
-    spawn7(wt, ["-w", "0", "nt", "--title", title, "-d", cwd, ...view], { detached: true, stdio: "ignore" }).unref();
-  else spawn7(SYSTEM.cmd(), ["/d", "/c", "start", title, ...view], { detached: true, stdio: "ignore", cwd }).unref();
+    spawn8(wt, ["-w", "0", "nt", "--title", title, "-d", cwd, ...view], { detached: true, stdio: "ignore" }).unref();
+  else spawn8(SYSTEM.cmd(), ["/d", "/c", "start", title, ...view], { detached: true, stdio: "ignore", cwd }).unref();
 }
 var harnessFor = (req) => {
   if (req.harness === session.harnessName && session.harness) return session.harness;
@@ -32906,8 +34295,8 @@ var harnessFor = (req) => {
 function memoryEnv(env, sessions2) {
   const out = {};
   out.PTYHOST_BACKSTOP_MB = String(session.agentBackstop ?? "auto");
-  const cpus = usableCpus(os12.cpus().length, session.cpuLimitPercent ?? null);
-  const memoryGb = os12.totalmem() / 1024 ** 3;
+  const cpus = usableCpus(os13.cpus().length, session.cpuLimitPercent ?? null);
+  const memoryGb = os13.totalmem() / 1024 ** 3;
   const jobs = cargoJobs(cpus, memoryGb, sessions2);
   out.NUMBER_OF_PROCESSORS = String(cpus);
   if (!env.CARGO_BUILD_JOBS) out.CARGO_BUILD_JOBS = String(jobs);
@@ -32946,10 +34335,10 @@ var agentProgram = async (req, env, say) => {
 };
 function shellPaths() {
   const candidates = [
-    path69.join(pwshDir(), "pwsh.exe"),
-    path69.join(process.env.ProgramFiles ?? "C:\\Program Files", "PowerShell", "7", "pwsh.exe")
+    path80.join(pwshDir(), "pwsh.exe"),
+    path80.join(process.env.ProgramFiles ?? "C:\\Program Files", "PowerShell", "7", "pwsh.exe")
   ];
-  return { pwsh: candidates.find((f) => fs54.existsSync(f)) ?? null, powershell: SYSTEM.powershell(), cmd: SYSTEM.cmd() };
+  return { pwsh: candidates.find((f) => fs63.existsSync(f)) ?? null, powershell: SYSTEM.powershell(), cmd: SYSTEM.cmd() };
 }
 var shellProgram = (shell) => {
   const line = commandLine(shell.file, shell.args);
@@ -32957,7 +34346,7 @@ var shellProgram = (shell) => {
 };
 var launchPtyHost = async (req, program, remote, env, sessions2, onSpawn) => {
   const port = await freePort();
-  const token = crypto4.randomBytes(24).toString("base64url");
+  const token = crypto5.randomBytes(24).toString("base64url");
   const sessionEnv = {
     ...withRegistryPath(env),
     ...program.environment,
@@ -32983,7 +34372,7 @@ var launchPtyHost = async (req, program, remote, env, sessions2, onSpawn) => {
   } catch (e) {
     const tail = ptyHostLogTail(req.id);
     throw new Error(
-      errMsg(e) + (tail ? ". From its log:\n" + tail : "") + "\nLog: " + path69.join(dataDir, "logs", "ptyhost-" + req.id + ".log")
+      errMsg(e) + (tail ? ". From its log:\n" + tail : "") + "\nLog: " + path80.join(dataDir, "logs", "ptyhost-" + req.id + ".log")
     );
   }
   return { child, port, token };
@@ -33097,7 +34486,7 @@ var SessionManager = class {
     };
     this.starting++;
     if (req.id !== session.launchId && process.env.AGENT_NO_TABS !== "1")
-      safely("terminal tab", () => terminalTab(req.id, name + " " + path69.basename(req.cwd), req.cwd));
+      safely("terminal tab", () => terminalTab(req.id, name + " " + path80.basename(req.cwd), req.cwd));
     try {
       if (problem) throw new Error(problem);
       const place = await placeFor(req, say);
@@ -33259,6 +34648,7 @@ var SessionManager = class {
     else safely("post-agent hooks", () => runHooks("post-agent", process.env));
     safely("claude-mem save", saveClaudeMem);
     safely("agent databases save", saveLocalState);
+    void flushAccounts();
     this.idle.check();
   }
 };
@@ -33591,10 +34981,10 @@ var GovernorCore = class {
 };
 
 // src/guest/governor/governor.ts
-import fs55 from "node:fs";
-import os13 from "node:os";
-import path70 from "node:path";
-import { spawn as spawn8 } from "node:child_process";
+import fs64 from "node:fs";
+import os14 from "node:os";
+import path81 from "node:path";
+import { spawn as spawn9 } from "node:child_process";
 import { createInterface } from "node:readline";
 var SampleSchema = external_exports.object({
   ramTotalMb: external_exports.number(),
@@ -33618,7 +35008,7 @@ var MemGovProcess = class {
   child = null;
   start() {
     try {
-      const child = spawn8(ensureCompiled("memgov"), ["serve", "--interval", "2"], {
+      const child = spawn9(ensureCompiled("memgov"), ["serve", "--interval", "2"], {
         stdio: ["pipe", "pipe", "ignore"],
         windowsHide: true
       });
@@ -33663,12 +35053,12 @@ var MemGovProcess = class {
 };
 function appendToMemoryLog(line) {
   try {
-    const logs = path70.join(dataDir, "logs");
-    const newest = fs55.readdirSync(logs).filter((f) => /^memory-\d{8}-\d{6}\.log$/.test(f)).sort().pop();
+    const logs = path81.join(dataDir, "logs");
+    const newest = fs64.readdirSync(logs).filter((f) => /^memory-\d{8}-\d{6}\.log$/.test(f)).sort().pop();
     if (!newest) return;
     const t = /* @__PURE__ */ new Date();
     const stamp = [t.getHours(), t.getMinutes(), t.getSeconds()].map((n) => String(n).padStart(2, "0")).join(":");
-    fs55.appendFileSync(path70.join(logs, newest), stamp + " | " + line + "\r\n");
+    fs64.appendFileSync(path81.join(logs, newest), stamp + " | " + line + "\r\n");
   } catch {
   }
 }
@@ -33686,7 +35076,7 @@ var Governor = class {
     this.core = new GovernorCore({
       port: proc,
       profile,
-      maxCompilers: maxCompilers(os13.cpus().length, profile),
+      maxCompilers: maxCompilers(os14.cpus().length, profile),
       now: () => Date.now(),
       logLine: appendToMemoryLog,
       warn,
@@ -33708,16 +35098,16 @@ var Governor = class {
 var governor = new Governor();
 
 // src/guest/daemon/live.ts
-import fs57 from "node:fs";
-import path72 from "node:path";
+import fs66 from "node:fs";
+import path83 from "node:path";
 import { spawnSync as spawnSync7 } from "node:child_process";
 
 // src/guest/daemon/live-folders.ts
-import fs56 from "node:fs";
-import path71 from "node:path";
+import fs65 from "node:fs";
+import path82 from "node:path";
 
 // src/shared/channel/live.ts
-import crypto5 from "node:crypto";
+import crypto6 from "node:crypto";
 var LIVE_SHARE_NAME = /^agentsbx-[0-9a-f]{8,32}$/;
 var LIVE_FOLDER_NAME = /^[a-z0-9][a-z0-9_-]{0,63}$/;
 var LIVE_KEY = /^[0-9a-f]{64}$/;
@@ -33747,7 +35137,7 @@ var LiveReplySchema = external_exports.strictObject({
   finishedAt: external_exports.string().max(64)
 });
 function mac3(key2, payload) {
-  return crypto5.createHmac("sha256", Buffer.from(key2, "hex")).update(payload, "utf8").digest("hex");
+  return crypto6.createHmac("sha256", Buffer.from(key2, "hex")).update(payload, "utf8").digest("hex");
 }
 function openLive(key2, envelope, o) {
   if (!key2 || !LIVE_KEY.test(key2))
@@ -33756,7 +35146,7 @@ function openLive(key2, envelope, o) {
   if (!env.success) return { refused: "not a live-folder request" };
   const want = Buffer.from(mac3(key2, env.data.payload), "hex");
   const got = Buffer.from(env.data.mac, "hex");
-  if (want.length !== got.length || !crypto5.timingSafeEqual(want, got))
+  if (want.length !== got.length || !crypto6.timingSafeEqual(want, got))
     return { refused: "the signature does not match" };
   let json2;
   try {
@@ -33807,7 +35197,7 @@ var LiveFolderHandler = class {
   }
   read() {
     try {
-      const text = fs56.readFileSync(this.o.stateFile, "utf8");
+      const text = fs65.readFileSync(this.o.stateFile, "utf8");
       const parsed = StateSchema.safeParse(JSON.parse(text));
       if (parsed.success && parsed.data.launchId === this.o.launchId) return parsed.data;
     } catch {
@@ -33815,7 +35205,7 @@ var LiveFolderHandler = class {
     return { key: null, launchId: this.o.launchId, seen: [], mappings: [] };
   }
   save(state) {
-    fs56.mkdirSync(path71.dirname(this.o.stateFile), { recursive: true });
+    fs65.mkdirSync(path82.dirname(this.o.stateFile), { recursive: true });
     writeJsonAtomic(this.o.stateFile, state);
   }
   /** The key the boot handed over (from the one-shot secrets file). */
@@ -33826,30 +35216,30 @@ var LiveFolderHandler = class {
   /** C:\Workspace\<name> from a checked name only. */
   folderPath(name) {
     if (!LIVE_FOLDER_NAME.test(name)) throw new Error("not a plain folder name");
-    return path71.win32.join(this.o.workspaces ?? WORKSPACES_GUEST, name);
+    return path82.win32.join(this.o.workspaces ?? WORKSPACES_GUEST, name);
   }
   /** One pass over run\live: every file is claimed (deleted) at once; valid ones are handled one after another. */
   tick() {
     const dir = this.o.run.liveDir;
     let names;
     try {
-      names = fs56.readdirSync(dir);
+      names = fs65.readdirSync(dir);
     } catch {
       return;
     }
     for (const name of names.slice(0, 64)) {
       if (name.endsWith(".tmp")) continue;
-      const file3 = path71.join(dir, name);
+      const file3 = path82.join(dir, name);
       let envelope = null;
       try {
-        const stat = fs56.lstatSync(file3);
+        const stat = fs65.lstatSync(file3);
         if (stat.isFile() && stat.size <= MAX_REQUEST_BYTES && /^[A-Za-z0-9_-]{1,64}\.json$/.test(name))
-          envelope = JSON.parse(fs56.readFileSync(file3, "utf8"));
+          envelope = JSON.parse(fs65.readFileSync(file3, "utf8"));
       } catch {
         envelope = null;
       } finally {
         try {
-          fs56.rmSync(file3, { recursive: true, force: true });
+          fs65.rmSync(file3, { recursive: true, force: true });
         } catch {
         }
       }
@@ -33886,18 +35276,18 @@ var LiveFolderHandler = class {
   }
   reply(id, r) {
     try {
-      fs56.mkdirSync(this.o.run.liveRepliesDir, { recursive: true });
+      fs65.mkdirSync(this.o.run.liveRepliesDir, { recursive: true });
       writeJsonAtomic(this.o.run.liveReplyFile(id), { id, ...r, finishedAt: new Date(this.now()).toISOString() });
     } catch (e) {
       this.log("live folder reply not written: " + errMsg(e));
     }
   }
   /** map with retries while the share is not there yet. */
-  async mapWithRetry(folder, share, readOnly) {
+  async mapWithRetry(folder, share2, readOnly) {
     const tries = this.o.tries ?? 20;
     let code = EXIT_NO_SHARE;
     for (let i = 0; i < tries; i++) {
-      code = this.o.bind.map(folder, share, readOnly);
+      code = this.o.bind.map(folder, share2, readOnly);
       if (code !== EXIT_NO_SHARE) return code;
       await (this.o.sleep ?? wait)(500);
     }
@@ -33907,14 +35297,14 @@ var LiveFolderHandler = class {
   assertFree(folder) {
     let exists2 = true;
     try {
-      fs56.lstatSync(folder);
+      fs65.lstatSync(folder);
     } catch {
       exists2 = false;
     }
     if (exists2) throw new Error(folder + " exists already");
-    const parent = path71.dirname(folder);
-    fs56.mkdirSync(parent, { recursive: true });
-    if (!fs56.lstatSync(parent).isDirectory()) throw new Error(parent + " is not a plain folder");
+    const parent = path82.dirname(folder);
+    fs65.mkdirSync(parent, { recursive: true });
+    if (!fs65.lstatSync(parent).isDirectory()) throw new Error(parent + " is not a plain folder");
   }
   async act(p) {
     const folder = this.folderPath(p.folder);
@@ -33929,21 +35319,21 @@ var LiveFolderHandler = class {
       this.save({ ...after, mappings: after.mappings.filter((m) => m.folder !== p.folder) });
       return { ok: true, message: "hidden: " + folder };
     }
-    const share = p.share ?? "";
+    const share2 = p.share ?? "";
     this.assertFree(folder);
     if (p.kind === "canary") {
-      const code2 = await this.mapWithRetry(folder, share, true);
+      const code2 = await this.mapWithRetry(folder, share2, true);
       if (code2 !== EXIT_OK) return { ok: false, message: "the test share could not be shown (" + code2 + ")" };
       try {
-        const file3 = path71.join(folder, "token.txt");
-        const stat = fs56.statSync(file3);
-        const token = stat.size <= 64 ? fs56.readFileSync(file3, "utf8").trim() : "";
+        const file3 = path82.join(folder, "token.txt");
+        const stat = fs65.statSync(file3);
+        const token = stat.size <= 64 ? fs65.readFileSync(file3, "utf8").trim() : "";
         return LIVE_TOKEN.test(token) ? { ok: true, message: "read the test share", token } : { ok: false, message: "the test share holds no token" };
       } finally {
         this.o.bind.unmap(folder);
       }
     }
-    const code = await this.mapWithRetry(folder, share, p.readOnly);
+    const code = await this.mapWithRetry(folder, share2, p.readOnly);
     if (code !== EXIT_OK)
       return {
         ok: false,
@@ -33954,7 +35344,7 @@ var LiveFolderHandler = class {
       ...state,
       mappings: [
         ...state.mappings.filter((m) => m.folder !== p.folder),
-        { folder: p.folder, share, readOnly: p.readOnly }
+        { folder: p.folder, share: share2, readOnly: p.readOnly }
       ]
     });
     return { ok: true, message: "shown at " + folder };
@@ -33965,7 +35355,7 @@ var LiveFolderHandler = class {
     for (const m of this.read().mappings) {
       const folder = this.folderPath(m.folder);
       if (this.o.bind.mapped(folder) === EXIT_OK) continue;
-      fs56.mkdirSync(path71.dirname(folder), { recursive: true });
+      fs65.mkdirSync(path82.dirname(folder), { recursive: true });
       if (this.o.bind.map(folder, m.share, m.readOnly) === EXIT_OK) done++;
       else this.log("live folder " + folder + " could not be shown again");
     }
@@ -33976,7 +35366,7 @@ var LiveFolderHandler = class {
 // src/guest/daemon/live.ts
 var BIND_TIMEOUT_MS = 3e4;
 var testing = Boolean(process.env.AGENT_DAEMON_STATE_DIR || process.env.AGENT_LOCAL_DIR);
-var stateDir2 = process.env.AGENT_DAEMON_STATE_DIR ?? (process.env.AGENT_LOCAL_DIR ? path72.join(localDir, "daemon-state") : path72.join(process.env.ProgramData ?? "C:\\ProgramData", "AgentSandboxDaemon"));
+var stateDir2 = process.env.AGENT_DAEMON_STATE_DIR ?? (process.env.AGENT_LOCAL_DIR ? path83.join(localDir, "daemon-state") : path83.join(process.env.ProgramData ?? "C:\\ProgramData", "AgentSandboxDaemon"));
 function bindMount(args) {
   const r = spawnSync7(ensureCompiled("bindmount"), args, {
     windowsHide: true,
@@ -33986,12 +35376,12 @@ function bindMount(args) {
   return r.status ?? 1;
 }
 var realBind = {
-  map: (folder, share, readOnly) => bindMount(["map", folder, share, ...readOnly ? [] : ["rw"]]),
+  map: (folder, share2, readOnly) => bindMount(["map", folder, share2, ...readOnly ? [] : ["rw"]]),
   unmap: (folder) => bindMount(["unmap", folder]),
   mapped: (folder) => bindMount(["mapped", folder])
 };
 function protectStateDir() {
-  fs57.mkdirSync(stateDir2, { recursive: true });
+  fs66.mkdirSync(stateDir2, { recursive: true });
   if (!isWin || testMode || testing) return;
   spawnSync7(
     SYSTEM.icacls(),
@@ -34004,7 +35394,7 @@ function protectStateDir() {
 }
 var liveFolders = new LiveFolderHandler({
   run,
-  stateFile: path72.join(stateDir2, "live-folders.json"),
+  stateFile: path83.join(stateDir2, "live-folders.json"),
   launchId: session.launchId,
   bind: realBind,
   log: warn
@@ -34034,9 +35424,9 @@ var Daemon = class {
   tick() {
     const { valid, invalid } = run.scanRequests();
     for (const file3 of invalid)
-      safely("removing an invalid request", () => fs58.rmSync(file3, { recursive: true, force: true }));
+      safely("removing an invalid request", () => fs67.rmSync(file3, { recursive: true, force: true }));
     for (const req of valid) {
-      safely("claiming a request", () => fs58.rmSync(run.requestFile(req.id), { force: true }));
+      safely("claiming a request", () => fs67.rmSync(run.requestFile(req.id), { force: true }));
       if (run.readSession(req.id)) continue;
       void Promise.resolve(this.handle(withRequestSecrets(req))).catch(
         (e) => respond(req.id, { ok: false, message: errMsg(e) })
@@ -34047,6 +35437,7 @@ var Daemon = class {
       this.lastMemSave = Date.now();
       safely("claude-mem save", saveClaudeMem);
       safely("agent databases save", saveLocalState);
+      void flushAccounts();
     }
   }
   handle(req) {
@@ -34080,4 +35471,5 @@ safely("audit", () => startProcessCollector(() => sessions.roots()));
 safely("leftover processes", () => sessions.sweepLeftovers());
 safely("memory governor", () => governor.start());
 log("Memory governor: " + governor.describe());
+safely("service sign-ins", startAccountWatch);
 new Daemon().start();