windows-development-sandbox 1.17.0 → 1.18.0

package/dist/guest/accounts/adapters.js

@@ -0,0 +1,18 @@
+import { appstoreAdapter } from './kinds/appstore.js';
+import { cfxAdapter } from './kinds/cfx.js';
+import { epicAdapter } from './kinds/epic.js';
+import { expoAdapter } from './kinds/expo.js';
+import { keystoreAdapter } from './kinds/keystore.js';
+import { playAdapter } from './kinds/play.js';
+import { steamAdapter } from './kinds/steam.js';
+import { unityAdapter } from './kinds/unity.js';
+export const ADAPTERS = {
+    epic: epicAdapter,
+    steam: steamAdapter,
+    unity: unityAdapter,
+    cfx: cfxAdapter,
+    keystore: keystoreAdapter,
+    play: playAdapter,
+    expo: expoAdapter,
+    appstore: appstoreAdapter,
+};

package/dist/guest/accounts/apply.d.ts

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+import { type ServiceKind } from '../../shared/accounts/kinds.js';
+import type { ServiceAccounts } from '../../shared/accounts/payloads.js';
+import { type GuestAdapter } from './adapter.js';
+export declare const DeliveredSchema: z.ZodObject<{
+    fingerprints: z.ZodRecord<z.ZodEnum<{
+        unity: "unity";
+        steam: "steam";
+        epic: "epic";
+        cfx: "cfx";
+        keystore: "keystore";
+        play: "play";
+        expo: "expo";
+        appstore: "appstore";
+    }> & z.core.$partial, z.ZodString>;
+    leased: z.ZodArray<z.ZodEnum<{
+        unity: "unity";
+        steam: "steam";
+        epic: "epic";
+        cfx: "cfx";
+        keystore: "keystore";
+        play: "play";
+        expo: "expo";
+        appstore: "appstore";
+    }>>;
+}, z.core.$strip>;
+export type Delivered = z.output<typeof DeliveredSchema>;
+export declare function deliveredFile(root?: string): string;
+export declare function readDelivered(root?: string): Delivered;
+export interface ApplyOptions {
+    /** The kinds whose lease this launch holds (session.json accountLeases). */
+    readonly leased?: readonly ServiceKind[];
+    /** The boot log. */
+    readonly say?: (line: string) => void;
+    readonly root?: string;
+    readonly adapters?: {
+        readonly [K in ServiceKind]?: GuestAdapter<K>;
+    };
+}
+/** Applies every sign-in given; returns the variables for the agent's sessions. A failing kind is a log line. */
+export declare function applyServiceAccounts(given: ServiceAccounts | undefined, o?: ApplyOptions): Promise<Record<string, string>>;

package/dist/guest/accounts/apply.js

@@ -0,0 +1,47 @@
+// At boot: each handed-over sign-in goes to its tool (the adapters), then is dropped from memory. What was delivered
+// is remembered only as fingerprints, with the kinds whose lease this launch holds, in delivered.json on the
+// sandbox's own disk: the daemon's watch starts from them, so its first look never hands back what it was given.
+import fs from 'node:fs';
+import path from 'node:path';
+import { z } from 'zod';
+import { fingerprint } from '../../shared/accounts/fingerprint.js';
+import { SERVICE_KINDS } from '../../shared/accounts/kinds.js';
+import { readValid, writeJsonAtomic } from '../../shared/io/json.js';
+import { errMsg } from '../../core/util/errors.js';
+import { accountsRoot } from './adapter.js';
+import { ADAPTERS } from './adapters.js';
+export const DeliveredSchema = z.object({
+    fingerprints: z.partialRecord(z.enum(SERVICE_KINDS), z.string().max(128)),
+    leased: z.array(z.enum(SERVICE_KINDS)),
+});
+export function deliveredFile(root = accountsRoot()) {
+    return path.join(root, 'delivered.json');
+}
+export function readDelivered(root = accountsRoot()) {
+    return readValid(DeliveredSchema, deliveredFile(root)) ?? { fingerprints: {}, leased: [] };
+}
+/** Applies every sign-in given; returns the variables for the agent's sessions. A failing kind is a log line. */
+export async function applyServiceAccounts(given, o = {}) {
+    const say = o.say ?? (() => undefined);
+    const env = {};
+    const fingerprints = {};
+    for (const kind of SERVICE_KINDS) {
+        const payload = given?.[kind];
+        if (payload === undefined)
+            continue;
+        const adapter = (o.adapters?.[kind] ?? ADAPTERS[kind]);
+        try {
+            const applied = await adapter.apply(payload);
+            Object.assign(env, applied.env ?? {});
+            fingerprints[kind] = fingerprint(payload);
+            say(applied.summary);
+        }
+        catch (e) {
+            say(kind + ' sign-in: could not be used (' + errMsg(e) + ')');
+        }
+    }
+    const root = o.root ?? accountsRoot();
+    fs.mkdirSync(root, { recursive: true });
+    writeJsonAtomic(deliveredFile(root), { fingerprints, leased: [...(o.leased ?? [])] });
+    return env;
+}

package/dist/guest/accounts/kinds/appstore.d.ts

@@ -0,0 +1,2 @@
+import { type GuestAdapter } from '../adapter.js';
+export declare const appstoreAdapter: GuestAdapter<'appstore'>;

package/dist/guest/accounts/kinds/appstore.js

@@ -0,0 +1,7 @@
+import { notAvailableYet } from '../adapter.js';
+export const appstoreAdapter = {
+    kind: 'appstore',
+    apply(_p) {
+        return notAvailableYet('appstore');
+    },
+};

package/dist/guest/accounts/kinds/cfx.d.ts

@@ -0,0 +1,2 @@
+import { type GuestAdapter } from '../adapter.js';
+export declare const cfxAdapter: GuestAdapter<'cfx'>;

package/dist/guest/accounts/kinds/cfx.js

@@ -0,0 +1,7 @@
+import { notAvailableYet } from '../adapter.js';
+export const cfxAdapter = {
+    kind: 'cfx',
+    apply(_p) {
+        return notAvailableYet('cfx');
+    },
+};

package/dist/guest/accounts/kinds/epic.d.ts

@@ -0,0 +1,2 @@
+import { type GuestAdapter } from '../adapter.js';
+export declare const epicAdapter: GuestAdapter<'epic'>;

package/dist/guest/accounts/kinds/epic.js

@@ -0,0 +1,26 @@
+// Epic Games: the handed-over sign-in goes into the launcher's GameUserSettings.ini before anyone opens it (its other
+// settings are kept, and the file keeps the encoding it had: the launcher often writes UTF-16). The watch reads it
+// back to notice when the launcher renews it, or when you sign in here the first time.
+import fs from 'node:fs';
+import path from 'node:path';
+import { epicSettingsFile, MAX_EPIC_INI_BYTES, readEpicLogin, withEpicLogin, } from '../../../shared/accounts/index.js';
+import { decodeText, encodeText, readBoundedFile } from '../../../shared/io/index.js';
+import { localAppData } from '../adapter.js';
+function settingsFile() {
+    return epicSettingsFile(localAppData());
+}
+export const epicAdapter = {
+    kind: 'epic',
+    apply(p) {
+        const file = settingsFile();
+        const bytes = readBoundedFile(file, MAX_EPIC_INI_BYTES);
+        const read = bytes ? decodeText(bytes) : { text: '', encoding: 'utf8' };
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, encodeText(withEpicLogin(read.text, p), read.encoding));
+        return { summary: 'Epic Games Launcher: signed in with your saved sign-in' };
+    },
+    current() {
+        const bytes = readBoundedFile(settingsFile(), MAX_EPIC_INI_BYTES);
+        return bytes ? readEpicLogin(decodeText(bytes).text) : null;
+    },
+};

package/dist/guest/accounts/kinds/expo.d.ts

@@ -0,0 +1,2 @@
+import { type GuestAdapter } from '../adapter.js';
+export declare const expoAdapter: GuestAdapter<'expo'>;

package/dist/guest/accounts/kinds/expo.js

@@ -0,0 +1,7 @@
+import { notAvailableYet } from '../adapter.js';
+export const expoAdapter = {
+    kind: 'expo',
+    apply(_p) {
+        return notAvailableYet('expo');
+    },
+};

package/dist/guest/accounts/kinds/keystore.d.ts

@@ -0,0 +1,2 @@
+import { type GuestAdapter } from '../adapter.js';
+export declare const keystoreAdapter: GuestAdapter<'keystore'>;

package/dist/guest/accounts/kinds/keystore.js

@@ -0,0 +1,7 @@
+import { notAvailableYet } from '../adapter.js';
+export const keystoreAdapter = {
+    kind: 'keystore',
+    apply(_p) {
+        return notAvailableYet('keystore');
+    },
+};

package/dist/guest/accounts/kinds/play.d.ts

@@ -0,0 +1,2 @@
+import { type GuestAdapter } from '../adapter.js';
+export declare const playAdapter: GuestAdapter<'play'>;

package/dist/guest/accounts/kinds/play.js

@@ -0,0 +1,7 @@
+import { notAvailableYet } from '../adapter.js';
+export const playAdapter = {
+    kind: 'play',
+    apply(_p) {
+        return notAvailableYet('play');
+    },
+};

package/dist/guest/accounts/kinds/steam.d.ts

@@ -0,0 +1,4 @@
+import type { GuestAdapter } from '../adapter.js';
+/** The adapter for a SteamCMD folder (the self-test passes its own). */
+export declare function steamAdapterFor(steamcmdDir: string): GuestAdapter<'steam'>;
+export declare const steamAdapter: GuestAdapter<'steam'>;

package/dist/guest/accounts/kinds/steam.js

@@ -0,0 +1,17 @@
+// Steam: SteamCMD's cached login goes into C:\SteamCMD\config (config.vdf, the account name) and the ssfn sentry files
+// beside steamcmd.exe, on the sandbox's own disk, before the Steam step copies SteamCMD's binaries in (that copy never
+// touches config\). The watch reads it back when SteamCMD renews it, or after a first `sbx-steam login` here.
+import { readSteamCmdLogin, writeSteamCmdLogin } from '../../../shared/accounts/kinds/steam.js';
+import { STEAMCMD_DIR } from '../../toolchains/steam/commands.js';
+/** The adapter for a SteamCMD folder (the self-test passes its own). */
+export function steamAdapterFor(steamcmdDir) {
+    return {
+        kind: 'steam',
+        apply(p) {
+            writeSteamCmdLogin(steamcmdDir, p);
+            return { summary: 'SteamCMD: signed in as ' + p.account + ' with your saved sign-in' };
+        },
+        current: () => readSteamCmdLogin(steamcmdDir),
+    };
+}
+export const steamAdapter = steamAdapterFor(STEAMCMD_DIR);

package/dist/guest/accounts/kinds/unity.d.ts

@@ -0,0 +1,2 @@
+import { type GuestAdapter } from '../adapter.js';
+export declare const unityAdapter: GuestAdapter<'unity'>;

package/dist/guest/accounts/kinds/unity.js

@@ -0,0 +1,7 @@
+import { notAvailableYet } from '../adapter.js';
+export const unityAdapter = {
+    kind: 'unity',
+    apply(_p) {
+        return notAvailableYet('unity');
+    },
+};

package/dist/guest/accounts/watch.d.ts

@@ -0,0 +1,28 @@
+import { type ServiceKind } from '../../shared/accounts/kinds.js';
+import type { GuestAdapter } from './adapter.js';
+export interface WatchOptions {
+    /** The data folder (C:\AgentData); the handoffs go in its state\accounts. */
+    readonly dataDir: string;
+    readonly launchId: string;
+    /** Where delivered.json is (default: the sandbox's accounts folder). */
+    readonly root?: string;
+    readonly adapters?: {
+        readonly [K in ServiceKind]?: GuestAdapter<K>;
+    };
+    readonly warn?: (line: string) => void;
+}
+export declare class AccountWatch {
+    private readonly o;
+    private readonly last;
+    private readonly timers;
+    private readonly kinds;
+    constructor(kinds: readonly ServiceKind[], o: WatchOptions);
+    private adapter;
+    /** The kinds being watched. */
+    watched(): readonly ServiceKind[];
+    start(): void;
+    /** One look at one kind; true when a handoff was written. */
+    check(kind: ServiceKind): boolean;
+    /** Looks at every kind now; with `final` (the sandbox stops) each adapter also lets go of what it holds. */
+    flush(final?: boolean): Promise<void>;
+}

package/dist/guest/accounts/watch.js

@@ -0,0 +1,78 @@
+// While the sandbox runs: each sign-in that may come back (Epic, Steam, Unity) is looked at every minute or so, and
+// when the tool holds a different one (renewed, or a first sign-in made here) it is left for the PC in
+// <data>\state\accounts\<kind>.json, which the PC seals and deletes on its next sync. Only kinds whose lease this
+// launch holds; seeded with what was delivered, so the first look writes nothing. flush() looks once more now (the
+// daemon calls it where claude-mem is saved) and, at the end, lets go of what must not stay taken.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fingerprint } from '../../shared/accounts/fingerprint.js';
+import { HANDOFF_PARTS, SERVICE_SPECS } from '../../shared/accounts/kinds.js';
+import { writeJsonAtomic } from '../../shared/io/json.js';
+import { errMsg } from '../../core/util/errors.js';
+import { ADAPTERS } from './adapters.js';
+import { readDelivered } from './apply.js';
+const DEFAULT_CHECK_MS = 60_000;
+export class AccountWatch {
+    o;
+    last = new Map();
+    timers = [];
+    kinds;
+    constructor(kinds, o) {
+        this.o = o;
+        this.kinds = kinds.filter((k) => SERVICE_SPECS[k].returns && this.adapter(k).current);
+        const delivered = readDelivered(o.root);
+        for (const kind of this.kinds)
+            this.last.set(kind, delivered.fingerprints[kind] ?? null);
+    }
+    adapter(kind) {
+        return (this.o.adapters?.[kind] ?? ADAPTERS[kind]);
+    }
+    /** The kinds being watched. */
+    watched() {
+        return this.kinds;
+    }
+    start() {
+        for (const kind of this.kinds) {
+            const timer = setInterval(() => this.check(kind), this.adapter(kind).checkMs ?? DEFAULT_CHECK_MS);
+            timer.unref();
+            this.timers.push(timer);
+        }
+    }
+    /** One look at one kind; true when a handoff was written. */
+    check(kind) {
+        try {
+            const now = this.adapter(kind).current?.() ?? null;
+            if (!now)
+                return false;
+            const print = fingerprint(now);
+            if (print === this.last.get(kind))
+                return false;
+            const file = path.join(this.o.dataDir, ...HANDOFF_PARTS, kind + '.json');
+            fs.mkdirSync(path.dirname(file), { recursive: true });
+            writeJsonAtomic(file, { kind, launchId: this.o.launchId, payload: now });
+            this.last.set(kind, print);
+            return true;
+        }
+        catch (e) {
+            this.o.warn?.(SERVICE_SPECS[kind].label + ' sign-in: could not keep it for the next sandbox: ' + errMsg(e));
+            return false;
+        }
+    }
+    /** Looks at every kind now; with `final` (the sandbox stops) each adapter also lets go of what it holds. */
+    async flush(final = false) {
+        for (const kind of this.kinds)
+            this.check(kind);
+        if (!final)
+            return;
+        for (const timer of this.timers)
+            clearInterval(timer);
+        for (const kind of this.kinds) {
+            try {
+                await this.adapter(kind).release?.();
+            }
+            catch (e) {
+                this.o.warn?.(SERVICE_SPECS[kind].label + ': could not let go of the sign-in: ' + errMsg(e));
+            }
+        }
+    }
+}

package/dist/guest/agents/agent-files.d.ts

@@ -48,6 +48,12 @@ export declare function bootResetPaths(agents: Readonly<Record<string, Harness>>
     agent: string;
     path: string;
 }[];
+/**
+ * Codex's config.toml with its own command sandbox off, or null when it already says which one to use. Inside Windows
+ * Sandbox that inner sandbox only costs: its setup re-grants ACLs over the whole profile at every boot (minutes), and
+ * every command hangs until it is done. A `sandbox_mode` the user set (before the first [table]) is kept.
+ */
+export declare function codexConfigWithoutSandbox(toml: string): string | null;
 /** A SQLite database file or one of its -wal / -shm siblings. */
 export declare const isDatabaseFile: (name: string) => boolean;
 /** Files that make a consistent copy: the databases and their -wal (the -shm is rebuilt by SQLite). */

package/dist/guest/agents/agent-files.js

@@ -61,6 +61,20 @@ export function localStateEntries(agents, stateDir, localRoot) {
 export function bootResetPaths(agents, stateDir) {
     return Object.entries(agents).flatMap(([agent, harness]) => (harness.bootReset ?? []).map((rel) => ({ agent, path: path.join(stateDir, agent, rel) })));
 }
+/**
+ * Codex's config.toml with its own command sandbox off, or null when it already says which one to use. Inside Windows
+ * Sandbox that inner sandbox only costs: its setup re-grants ACLs over the whole profile at every boot (minutes), and
+ * every command hangs until it is done. A `sandbox_mode` the user set (before the first [table]) is kept.
+ */
+export function codexConfigWithoutSandbox(toml) {
+    const firstTable = toml.search(/^\s*\[/m);
+    const topLevel = firstTable < 0 ? toml : toml.slice(0, firstTable);
+    if (/^\s*sandbox_mode\s*=/m.test(topLevel))
+        return null;
+    return ('# Set by the sandbox: Windows Sandbox already contains Codex, its own command sandbox would only slow it down.\n' +
+        'sandbox_mode = "danger-full-access"\n' +
+        (toml ? '\n' + toml : ''));
+}
 /** A SQLite database file or one of its -wal / -shm siblings. */
 export const isDatabaseFile = (name) => /\.(sqlite3?|db)(-wal|-shm)?$/i.test(name);
 /** Files that make a consistent copy: the databases and their -wal (the -shm is rebuilt by SQLite). */

package/dist/guest/agents/local-state.d.ts

@@ -5,6 +5,8 @@ export declare function agentLocalStates(): LocalState[];
 export declare function localStateVars(): Record<string, string>;
 /** Boot: what an agent sealed to the last sandbox (bootReset) is deleted, so it sets it up again. Links are left. */
 export declare function resetMachineBound(): void;
+/** Boot: Codex runs its commands without its own sandbox (codexConfigWithoutSandbox), unless the user picked one. */
+export declare function codexWithoutInnerSandbox(): void;
 /** Boot: the saved databases of every configured agent are copied to the sandbox's disk, where the agent runs them. */
 export declare function restoreLocalState(): void;
 /**

package/dist/guest/agents/local-state.js

@@ -10,7 +10,7 @@ import { execOutput } from '../runtime/process.js';
 import { log, warn } from '../runtime/log.js';
 import { session, stateDir } from '../runtime/session.js';
 import { errMsg } from '../../core/util/errors.js';
-import { bootResetPaths, isCopyableDatabaseFile, isDatabaseFile, localStateEntries, } from './agent-files.js';
+import { bootResetPaths, codexConfigWithoutSandbox, isCopyableDatabaseFile, isDatabaseFile, localStateEntries, } from './agent-files.js';
 const SQLITE_HEADER = 'SQLite format 3\0';
 /** The sandbox-disk folder that holds the working copies. */
 const localRoot = () => path.join(localDir, 'agent-state');
@@ -102,6 +102,18 @@ export function resetMachineBound() {
         }
     }
 }
+/** Boot: Codex runs its commands without its own sandbox (codexConfigWithoutSandbox), unless the user picked one. */
+export function codexWithoutInnerSandbox() {
+    if (dryRun || !session.agents?.codex)
+        return;
+    const file = path.join(stateDir, 'codex', 'config.toml');
+    const updated = codexConfigWithoutSandbox(exists(file) ? fs.readFileSync(file, 'utf8') : '');
+    if (updated === null)
+        return;
+    mkdirp(path.dirname(file));
+    fs.writeFileSync(file, updated, 'utf8');
+    log('codex: its own command sandbox is off (sandbox_mode = "danger-full-access" in config.toml).');
+}
 /** Boot: the saved databases of every configured agent are copied to the sandbox's disk, where the agent runs them. */
 export function restoreLocalState() {
     if (dryRun)

package/dist/guest/apps/resolvers-gamedev.d.ts

@@ -0,0 +1,2 @@
+import type { Download } from './resolvers.js';
+export declare const GAMEDEV_RESOLVERS: Readonly<Record<string, () => Promise<Download>>>;

package/dist/guest/apps/resolvers-gamedev.js

@@ -0,0 +1 @@
+export const GAMEDEV_RESOLVERS = {};

package/dist/guest/apps/resolvers-mobile.d.ts

@@ -0,0 +1,2 @@
+import type { Download } from './resolvers.js';
+export declare const MOBILE_RESOLVERS: Readonly<Record<string, () => Promise<Download>>>;

package/dist/guest/apps/resolvers-mobile.js

@@ -0,0 +1 @@
+export const MOBILE_RESOLVERS = {};

package/dist/guest/apps/resolvers.js

@@ -1,6 +1,8 @@
 // Where the latest version of an app is, for apps that are not a plain GitHub release: each looks it up on the
 // vendor's own site (and its published checksum, where there is one). Named by AppSource.resolve in shared/apps.ts.
 import { fetchJson, fetchText, githubAsset, latestGithubTag } from '../../shared/download/index.js';
+import { GAMEDEV_RESOLVERS } from './resolvers-gamedev.js';
+import { MOBILE_RESOLVERS } from './resolvers-mobile.js';
 /** The SHA-256 on the line of a SHA256SUMS-style file that names `file`. */
 const sumFor = (sums, file) => sums
     .split(/\r?\n/)
@@ -10,6 +12,8 @@ const sumFor = (sums, file) => sums
 const firstHash = (text) => /\b([0-9a-f]{64})\b/i.exec(text)?.[1].toLowerCase() ?? null;
 const stripV = (tag) => tag.replace(/^v/, '');
 export const RESOLVERS = {
+    ...GAMEDEV_RESOLVERS,
+    ...MOBILE_RESOLVERS,
     sublime: async () => {
         // Sublime publishes no checksums; the download is HTTPS from sublimetext.com.
         const { latest_version: build } = await fetchJson('https://www.sublimetext.com/updates/4/stable_update_check');

package/dist/guest/boot/boot.d.ts

@@ -6,6 +6,11 @@ export declare class Boot {
     /** What the host handed over in its one-shot file (read and deleted at the start of run()). */
     private secrets;
     run(): Promise<void>;
+    /**
+     * Your saved service sign-ins (accounts.<kind>.share) go to their tools before anything opens them, and leave memory
+     * at once; what they give the agent (EXPO_TOKEN ...) joins its environment (in memory only).
+     */
+    private serviceAccounts;
     private networkAndSessionHost;
     private hooksAndDesktop;
     /** Toolchains, databases, apps, the network proxy and VS Code; then the agent environment, saved machine-wide. */

package/dist/guest/boot/boot.js

@@ -6,7 +6,7 @@ import { writeGuides } from './guide.js';
 import { setupToolchains } from '../toolchains/index.js';
 import { agents } from '../agents/agent-installer.js';
 import { agentShims, sbxAgentText, shimText } from '../agents/agent-files.js';
-import { resetMachineBound, restoreLocalState } from '../agents/local-state.js';
+import { codexWithoutInnerSandbox, resetMachineBound, restoreLocalState } from '../agents/local-state.js';
 import { installShellPath } from '../setup/shell-path.js';
 import { linkProfileDirs } from '../agents/profile-links.js';
 import { restoreClaudeMem } from '../setup/claude-mem.js';
@@ -22,6 +22,8 @@ import { applyPersonalization } from '../setup/desktop.js';
 import { keepBrowsersOffGpu } from '../setup/browser-gpu.js';
 import { setupGitConfig } from '../setup/git-identity.js';
 import { loginGithub, prepareGithubFolder } from '../setup/github-token.js';
+import { applyServiceAccounts } from '../accounts/apply.js';
+import { devToolsFor } from '../devtools/registry.js';
 import { ensurePtyHost } from '../sessions/pty-host.js';
 import { pruneToolLeftovers } from '../toolchains/leftovers.js';
 import { wanted } from '../toolchains/detect.js';
@@ -95,8 +97,23 @@ function writeDbCommand() {
     const db = path.join(path.dirname(process.argv[1]), 'db.js');
     fs.writeFileSync(path.join(dir, 'sbx-db.cmd'), '@setlocal\r\n@set AGENT_LOG_PREFIX=db\r\n@"' + process.execPath + '" "' + db + '" %*\r\n');
     writeAgentCommands(dir);
+    writeDevToolCommands(dir);
     return dir;
 }
+/** sbx-steam, sbx-fivem, sbx-unity, sbx-android for the toolchains that are on: runtime\tool.js with that helper. */
+function writeDevToolCommands(dir) {
+    const script = path.join(path.dirname(process.argv[1]), 'tool.js');
+    for (const tool of devToolsFor(session.toolchains))
+        fs.writeFileSync(path.join(dir, 'sbx-' + tool.name + '.cmd'), '@setlocal\r\n@set AGENT_LOG_PREFIX=' +
+            tool.name +
+            '\r\n@"' +
+            process.execPath +
+            '" "' +
+            script +
+            '" ' +
+            tool.name +
+            ' %*\r\n');
+}
 /**
  * `claude`, `codex` ... by name in every terminal tab, installed yet or not (the command installs the agent on first
  * use), and `sbx-agent`. Written to the sandbox's disk each boot, next to `sbx-db`.
@@ -146,6 +163,7 @@ export class Boot {
         mkdirp(toolsDir);
         mkdirp(run.root);
         this.secrets = takeSecrets(session.launchId);
+        await this.serviceAccounts();
         applyBootEnvironment(this.secrets.harnessEnvironment);
         prepareGithubFolder(this.secrets.githubToken);
         await this.networkAndSessionHost();
@@ -158,6 +176,21 @@ export class Boot {
         this.preAgentHooks(env);
         await this.start(env);
     }
+    /**
+     * Your saved service sign-ins (accounts.<kind>.share) go to their tools before anything opens them, and leave memory
+     * at once; what they give the agent (EXPO_TOKEN ...) joins its environment (in memory only).
+     */
+    async serviceAccounts() {
+        const given = this.secrets.serviceAccounts;
+        this.secrets = { ...this.secrets, serviceAccounts: undefined };
+        if (dryRun || (!given && !session.accountLeases?.length))
+            return;
+        await soft('Service sign-ins', async () => {
+            const env = await applyServiceAccounts(given, { leased: session.accountLeases ?? [], say: (line) => log(line) });
+            if (Object.keys(env).length)
+                this.secrets = { ...this.secrets, harnessEnvironment: { ...env, ...this.secrets.harnessEnvironment } };
+        });
+    }
     async networkAndSessionHost() {
         step(1, 'Network and session host');
         if (isWin && !dryRun && session.attach.enabled)
@@ -186,6 +219,7 @@ export class Boot {
             refresh: session.provisioning.refresh,
             databases: session.databases ?? [],
             apps: session.apps,
+            ...(session.pcInstalls ? { pcInstalls: session.pcInstalls } : {}),
         });
         for (const p of networkProblems())
             tools.summary.push('PROTECTION MISSING: ' + p);
@@ -246,6 +280,7 @@ export class Boot {
             await soft('Claude settings', () => syncClaudeProfile(this.secrets.claudeCredentials));
         await soft('claude-mem restore', restoreClaudeMem);
         await soft('Agent files of the last sandbox', resetMachineBound);
+        await soft('Codex without its own sandbox', codexWithoutInnerSandbox);
         await soft('Agent databases restore', restoreLocalState);
         // Agent add-ons: MCP servers in the sandbox's Claude Code, and the Headroom proxy before the managed settings point
         // Claude Code at it (the guide reads them back, so it comes last).

package/dist/guest/daemon/accounts.d.ts

@@ -0,0 +1,3 @@
+export declare function startAccountWatch(): void;
+/** Looks once more now; `final` (the sandbox stops) also lets go of what must not stay taken. Never throws. */
+export declare function flushAccounts(final?: boolean): Promise<void>;

package/dist/guest/daemon/accounts.js

@@ -0,0 +1,25 @@
+// The daemon's one watch over the service sign-ins this launch may hand back (session.json accountLeases), and its
+// flush where claude-mem is saved (every 2 minutes, when a session ends, before an idle shutdown).
+import { AccountWatch } from '../accounts/watch.js';
+import { dataDir } from '../runtime/paths.js';
+import { log, warn } from '../runtime/log.js';
+import { session } from '../runtime/session.js';
+let watch = null;
+export function startAccountWatch() {
+    const kinds = session.accountLeases ?? [];
+    if (!kinds.length)
+        return;
+    watch = new AccountWatch(kinds, { dataDir, launchId: session.launchId, warn });
+    watch.start();
+    if (watch.watched().length)
+        log('Service sign-ins kept for the next sandbox: ' + watch.watched().join(', '));
+}
+/** Looks once more now; `final` (the sandbox stops) also lets go of what must not stay taken. Never throws. */
+export async function flushAccounts(final = false) {
+    try {
+        await watch?.flush(final);
+    }
+    catch (e) {
+        warn('service sign-ins: ' + String(e));
+    }
+}

package/dist/guest/daemon/daemon.js

@@ -11,6 +11,7 @@ import { withRequestSecrets } from '../runtime/secrets.js';
 import { liveFolders } from './live.js';
 import { warn } from '../runtime/log.js';
 import { errMsg } from '../../core/util/errors.js';
+import { flushAccounts } from './accounts.js';
 const POLL_MS = 400;
 const MEM_SAVE_MS = 120000;
 export class Daemon {
@@ -45,6 +46,7 @@ export class Daemon {
             this.lastMemSave = Date.now();
             safely('claude-mem save', saveClaudeMem);
             safely('agent databases save', saveLocalState);
+            void flushAccounts();
         }
     }
     handle(req) {

package/dist/guest/daemon/idle-shutdown.js

@@ -8,6 +8,7 @@ import { isWin, run } from '../runtime/paths.js';
 import { log } from '../runtime/log.js';
 import { session } from '../runtime/session.js';
 import { safely } from './state.js';
+import { flushAccounts } from './accounts.js';
 /** How long the sandbox must stay idle before it shuts down. */
 const GRACE_MS = 15000;
 export class IdleShutdown {
@@ -28,7 +29,8 @@ export class IdleShutdown {
             log('Headless sandbox has no sessions left; shutting down.');
             safely('claude-mem save', saveClaudeMem);
             safely('agent databases save', saveLocalState);
-            spawnSync(SYSTEM.shutdown(), ['/s', '/t', '5'], { windowsHide: true });
+            // Renewed sign-ins go to the PC, and a held one (a Unity seat) is let go, before Windows stops.
+            void flushAccounts(true).finally(() => spawnSync(SYSTEM.shutdown(), ['/s', '/t', '5'], { windowsHide: true }));
         }, GRACE_MS);
     }
     idle() {