windows-development-sandbox 1.17.3 → 1.18.0

package/dist/host/accounts/handoff.js

@@ -0,0 +1,110 @@
+// What a sandbox hands back: a sign-in it renewed (or one you made there), left in its data folder as
+// state\accounts\<kind>.json. Taken on every sync cycle: sealed into the store when the kind returns, the launch holds
+// its lease and the file is a plain file within the size limit of the right shape; deleted unsealed otherwise. The
+// last sync of a sandbox releases its leases. The state folder is found through hostDataFolder (contained storage
+// keeps it in the image).
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertNoLinks, isLink } from '../../core/util/index.js';
+import { HANDOFF_PARTS, handoffSchema, SERVICE_KINDS, SERVICE_SPECS, } from '../../shared/accounts/index.js';
+import { readBoundedFile } from '../../shared/io/index.js';
+import { hostDataFolder, hostDataRoot, setNameOf, storageOf } from '../storage/index.js';
+import { AccountLeases } from './leases.js';
+import { HOST_SOURCES } from './sources.js';
+import { ServiceAccountStore } from './store.js';
+/** Room for the handoff's own fields around the payload. */
+const ENVELOPE_BYTES = 1024;
+/** state\accounts in a data set, as this PC sees it. */
+export function handoffDir(dataPath) {
+    return path.join(hostDataFolder(dataPath, HANDOFF_PARTS[0]), HANDOFF_PARTS[1]);
+}
+function exists(file) {
+    try {
+        fs.lstatSync(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Removes a handoff file without following anything the sandbox planted: a link is removed itself, and nothing is
+ * touched when a folder on the way is a link. False when it could not be removed.
+ */
+function drop(root, file) {
+    try {
+        if (isLink(file)) {
+            fs.unlinkSync(file);
+            return true;
+        }
+        assertNoLinks(root, file);
+        fs.rmSync(file, { force: true });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function takeHandoffs(dataPath, final, store = new ServiceAccountStore(storageOf(dataPath)), leases = new AccountLeases(storageOf(dataPath))) {
+    const taken = [];
+    const dropped = [];
+    const root = hostDataRoot(dataPath);
+    const dir = handoffDir(dataPath);
+    const dataSet = setNameOf(dataPath);
+    for (const kind of SERVICE_KINDS) {
+        const file = path.join(dir, kind + '.json');
+        if (!exists(file))
+            continue;
+        let ok = false;
+        try {
+            assertNoLinks(root, file);
+            const spec = SERVICE_SPECS[kind];
+            const bytes = readBoundedFile(file, spec.maxBytes + ENVELOPE_BYTES);
+            const parsed = bytes ? handoffSchema(kind).safeParse(JSON.parse(bytes.toString('utf8'))) : null;
+            const lease = leases.holder(kind);
+            if (parsed?.success &&
+                spec.returns &&
+                lease &&
+                lease.dataSet === dataSet &&
+                lease.launchId === parsed.data.launchId) {
+                const payload = parsed.data.payload;
+                store.save(kind, payload, 'sandbox', HOST_SOURCES[kind].summary(payload));
+                ok = true;
+            }
+        }
+        catch {
+            // A link on the way, not JSON, or a store that cannot be written: dropped below, the saved one stays.
+        }
+        drop(root, file);
+        (ok ? taken : dropped).push(kind);
+    }
+    if (final)
+        leases.releaseAll(dataSet);
+    return { taken, dropped };
+}
+/**
+ * Forgets a sign-in everywhere: the saved one, its lease (what a running sandbox hands back afterwards is refused),
+ * and every copy a sandbox left in a data set and the PC has not taken yet.
+ */
+export function forgetEverywhere(kind, storageRoot, store = new ServiceAccountStore(storageRoot), leases = new AccountLeases(storageRoot)) {
+    const removed = store.remove(kind);
+    leases.revoke(kind);
+    let pendingDeleted = 0;
+    const sets = path.join(storageRoot, 'data');
+    let names = [];
+    try {
+        names = fs.readdirSync(sets);
+    }
+    catch {
+        // No data sets yet.
+    }
+    for (const name of names) {
+        const dataPath = path.join(sets, name);
+        if (isLink(dataPath))
+            continue;
+        const file = path.join(handoffDir(dataPath), kind + '.json');
+        if (exists(file) && drop(hostDataRoot(dataPath), file))
+            pendingDeleted++;
+    }
+    return { removed, pendingDeleted };
+}

package/dist/host/accounts/index.d.ts

@@ -0,0 +1,6 @@
+export { accountsDir, ServiceAccountStore, type AccountInfo, type AccountState } from './store.js';
+export { AccountLeases, type ClaimResult, type Lease } from './leases.js';
+export { prepareServiceAccounts, type AccountDelivery, type DeliveryInput } from './deliver.js';
+export { forgetEverywhere, handoffDir, takeHandoffs } from './handoff.js';
+export { notAvailableYet, pcEnv, type HostSource, type PcEnv } from './source.js';
+export { HOST_SOURCES } from './sources.js';

package/dist/host/accounts/index.js

@@ -0,0 +1,8 @@
+// Service sign-ins kept for sandboxes (accounts.<kind>.share): the sealed store, the one-holder leases, what a launch
+// hands over, what a sandbox hands back, and where each kind's sign-in comes from on this PC.
+export { accountsDir, ServiceAccountStore } from './store.js';
+export { AccountLeases } from './leases.js';
+export { prepareServiceAccounts } from './deliver.js';
+export { forgetEverywhere, handoffDir, takeHandoffs } from './handoff.js';
+export { notAvailableYet, pcEnv } from './source.js';
+export { HOST_SOURCES } from './sources.js';

package/dist/host/accounts/kinds/appstore.d.ts

@@ -0,0 +1,2 @@
+import { type HostSource } from '../source.js';
+export declare const appstoreSource: HostSource<'appstore'>;

package/dist/host/accounts/kinds/appstore.js

@@ -0,0 +1,10 @@
+import { notAvailableYet } from '../source.js';
+export const appstoreSource = {
+    fromFile(_bytes, _answers) {
+        return notAvailableYet('appstore');
+    },
+    fromAnswers(_answers) {
+        return notAvailableYet('appstore');
+    },
+    summary: () => null,
+};

package/dist/host/accounts/kinds/cfx.d.ts

@@ -0,0 +1,2 @@
+import { type HostSource } from '../source.js';
+export declare const cfxSource: HostSource<'cfx'>;

package/dist/host/accounts/kinds/cfx.js

@@ -0,0 +1,7 @@
+import { notAvailableYet } from '../source.js';
+export const cfxSource = {
+    fromAnswers(_answers) {
+        return notAvailableYet('cfx');
+    },
+    summary: () => null,
+};

package/dist/host/accounts/kinds/epic.d.ts

@@ -0,0 +1,2 @@
+import type { HostSource } from '../source.js';
+export declare const epicSource: HostSource<'epic'>;

package/dist/host/accounts/kinds/epic.js

@@ -0,0 +1,15 @@
+// Epic Games: this PC's launcher sign-in ("Remember me" in its GameUserSettings.ini, often UTF-16). Taking it signs
+// the launcher on this PC out the first time a sandbox uses it (a sign-in works in one place at a time).
+import path from 'node:path';
+import { epicSettingsFile, MAX_EPIC_INI_BYTES, readEpicLogin, } from '../../../shared/accounts/index.js';
+import { decodeText, readBoundedFile } from '../../../shared/io/index.js';
+export const epicSource = {
+    fromPc(pc, from) {
+        const localAppData = from ? path.resolve(from) : pc.localAppData;
+        if (!localAppData)
+            return null;
+        const bytes = readBoundedFile(epicSettingsFile(localAppData), MAX_EPIC_INI_BYTES);
+        return bytes ? readEpicLogin(decodeText(bytes).text) : null;
+    },
+    summary: () => null,
+};

package/dist/host/accounts/kinds/expo.d.ts

@@ -0,0 +1,2 @@
+import { type HostSource } from '../source.js';
+export declare const expoSource: HostSource<'expo'>;

package/dist/host/accounts/kinds/expo.js

@@ -0,0 +1,7 @@
+import { notAvailableYet } from '../source.js';
+export const expoSource = {
+    fromAnswers(_answers) {
+        return notAvailableYet('expo');
+    },
+    summary: () => null,
+};

package/dist/host/accounts/kinds/keystore.d.ts

@@ -0,0 +1,2 @@
+import { type HostSource } from '../source.js';
+export declare const keystoreSource: HostSource<'keystore'>;

package/dist/host/accounts/kinds/keystore.js

@@ -0,0 +1,7 @@
+import { notAvailableYet } from '../source.js';
+export const keystoreSource = {
+    fromFile(_bytes, _answers) {
+        return notAvailableYet('keystore');
+    },
+    summary: () => null,
+};

package/dist/host/accounts/kinds/play.d.ts

@@ -0,0 +1,2 @@
+import { type HostSource } from '../source.js';
+export declare const playSource: HostSource<'play'>;

package/dist/host/accounts/kinds/play.js

@@ -0,0 +1,7 @@
+import { notAvailableYet } from '../source.js';
+export const playSource = {
+    fromFile(_bytes, _answers) {
+        return notAvailableYet('play');
+    },
+    summary: () => null,
+};

package/dist/host/accounts/kinds/steam.d.ts

@@ -0,0 +1,6 @@
+import type { HostSource } from '../source.js';
+/** Where SteamCMD usually is on a PC (its own folder: it has no installer). */
+export declare const PC_STEAMCMD_DIR = "C:\\steamcmd";
+/** The SteamCMD folder a --from path names: the folder, its steamcmd.exe, or its config\config.vdf. */
+export declare function steamCmdFolderOf(from: string): string;
+export declare const steamSource: HostSource<'steam'>;

package/dist/host/accounts/kinds/steam.js

@@ -0,0 +1,31 @@
+// Steam: SteamCMD's cached login (config\config.vdf and the ssfn sentry files) from a steamcmd folder on this PC
+// (`sandbox account import steam --from C:\steamcmd`); no password is ever kept. `--from` may also name steamcmd.exe
+// or the config.vdf itself. Without it, C:\steamcmd is looked in.
+import fs from 'node:fs';
+import path from 'node:path';
+import { readSteamCmdLogin } from '../../../shared/accounts/index.js';
+/** Where SteamCMD usually is on a PC (its own folder: it has no installer). */
+export const PC_STEAMCMD_DIR = 'C:\\steamcmd';
+/** The SteamCMD folder a --from path names: the folder, its steamcmd.exe, or its config\config.vdf. */
+export function steamCmdFolderOf(from) {
+    const full = path.resolve(from);
+    let isFile = false;
+    try {
+        isFile = fs.statSync(full).isFile();
+    }
+    catch {
+        return full;
+    }
+    if (!isFile)
+        return full;
+    const dir = path.dirname(full);
+    return path.basename(full).toLowerCase() === 'config.vdf' && path.basename(dir).toLowerCase() === 'config'
+        ? path.dirname(dir)
+        : dir;
+}
+export const steamSource = {
+    fromPc(_pc, from) {
+        return readSteamCmdLogin(from ? steamCmdFolderOf(from) : PC_STEAMCMD_DIR);
+    },
+    summary: (p) => p.account,
+};

package/dist/host/accounts/kinds/unity.d.ts

@@ -0,0 +1,2 @@
+import { type HostSource } from '../source.js';
+export declare const unitySource: HostSource<'unity'>;

package/dist/host/accounts/kinds/unity.js

@@ -0,0 +1,13 @@
+import { notAvailableYet } from '../source.js';
+export const unitySource = {
+    fromPc(_pc, _from) {
+        return notAvailableYet('unity');
+    },
+    fromFile(_bytes, _answers) {
+        return notAvailableYet('unity');
+    },
+    fromAnswers(_answers) {
+        return notAvailableYet('unity');
+    },
+    summary: () => null,
+};

package/dist/host/accounts/leases.d.ts

@@ -0,0 +1,40 @@
+import { z } from 'zod';
+import { type ServiceKind } from '../../shared/accounts/index.js';
+declare const LeaseSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        unity: "unity";
+        steam: "steam";
+        epic: "epic";
+        cfx: "cfx";
+        keystore: "keystore";
+        play: "play";
+        expo: "expo";
+        appstore: "appstore";
+    }>;
+    dataSet: z.ZodString;
+    launchId: z.ZodString;
+    issuedAt: z.ZodString;
+    delivered: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type Lease = Readonly<z.output<typeof LeaseSchema>>;
+export type ClaimResult = {
+    ok: true;
+} | {
+    ok: false;
+    heldBy: string;
+};
+export declare class AccountLeases {
+    private readonly file;
+    constructor(storageRoot: string);
+    private all;
+    private keep;
+    holder(kind: ServiceKind): Lease | null;
+    /** The lease for this data set and launch, unless another data set's sandbox still runs with it. */
+    claim(kind: ServiceKind, dataSet: string, launchId: string, delivered: string | null, isRunning: (dataSet: string) => boolean): ClaimResult;
+    release(kind: ServiceKind, dataSet: string): void;
+    /** Every lease of a data set (its sandbox stopped). */
+    releaseAll(dataSet: string): void;
+    /** Drops the kind's lease (you forgot the sign-in): what a sandbox hands back afterwards is refused. */
+    revoke(kind: ServiceKind): Lease[];
+}
+export {};

package/dist/host/accounts/leases.js

@@ -0,0 +1,62 @@
+// Which data set holds a one-holder sign-in (Epic, Steam, Unity work in one place at a time), in host-only storage
+// (<storage>\accounts\leases.json). A launch claims the lease even when nothing is saved yet, so a first sign-in made
+// in that sandbox can come back; a lease whose sandbox no longer runs is stale and is taken over.
+import path from 'node:path';
+import { z } from 'zod';
+import { JsonFile } from '../../shared/io/index.js';
+import { SERVICE_KINDS } from '../../shared/accounts/index.js';
+import { accountsDir } from './store.js';
+const LeaseSchema = z.object({
+    kind: z.enum(SERVICE_KINDS),
+    dataSet: z.string().min(1).max(200),
+    launchId: z.string().min(1).max(64),
+    issuedAt: z.string().max(64),
+    /** The fingerprint of what was handed over (null: nothing saved yet). */
+    delivered: z.string().max(128).nullable(),
+});
+const LeasesSchema = z.object({ leases: z.array(LeaseSchema).max(SERVICE_KINDS.length) });
+export class AccountLeases {
+    file;
+    constructor(storageRoot) {
+        this.file = new JsonFile(LeasesSchema, path.join(accountsDir(storageRoot), 'leases.json'));
+    }
+    all() {
+        return this.file.read()?.leases ?? [];
+    }
+    keep(leases) {
+        this.file.write({ leases: [...leases] });
+    }
+    holder(kind) {
+        return this.all().find((l) => l.kind === kind) ?? null;
+    }
+    /** The lease for this data set and launch, unless another data set's sandbox still runs with it. */
+    claim(kind, dataSet, launchId, delivered, isRunning) {
+        const held = this.holder(kind);
+        if (held && held.dataSet !== dataSet && isRunning(held.dataSet))
+            return { ok: false, heldBy: held.dataSet };
+        const lease = { kind, dataSet, launchId, issuedAt: new Date().toISOString(), delivered };
+        this.keep([...this.all().filter((l) => l.kind !== kind), lease]);
+        return { ok: true };
+    }
+    release(kind, dataSet) {
+        const all = this.all();
+        const kept = all.filter((l) => !(l.kind === kind && l.dataSet === dataSet));
+        if (kept.length !== all.length)
+            this.keep(kept);
+    }
+    /** Every lease of a data set (its sandbox stopped). */
+    releaseAll(dataSet) {
+        const all = this.all();
+        const kept = all.filter((l) => l.dataSet !== dataSet);
+        if (kept.length !== all.length)
+            this.keep(kept);
+    }
+    /** Drops the kind's lease (you forgot the sign-in): what a sandbox hands back afterwards is refused. */
+    revoke(kind) {
+        const all = this.all();
+        const gone = all.filter((l) => l.kind === kind);
+        if (gone.length)
+            this.keep(all.filter((l) => l.kind !== kind));
+        return gone;
+    }
+}

package/dist/host/accounts/source.d.ts

@@ -0,0 +1,21 @@
+import type { Payload, ServiceKind } from '../../shared/accounts/index.js';
+/** This PC's profile folders (passed in, so the self-test uses its own). */
+export interface PcEnv {
+    readonly localAppData: string;
+    readonly appData: string;
+    readonly programData: string;
+}
+export interface HostSource<K extends ServiceKind> {
+    /** This PC's program's sign-in (`from`: another folder to read it from), or null when it has none. */
+    fromPc?(pc: PcEnv, from?: string): Payload<K> | null;
+    /** A file you named (its bytes, bounded by the caller) and the answers to the kind's fields. */
+    fromFile?(bytes: Buffer, answers: Readonly<Record<string, string>>): Payload<K>;
+    /** The answers to the kind's fields. */
+    fromAnswers?(answers: Readonly<Record<string, string>>): Payload<K>;
+    /** A short summary for the status (e.g. the Steam account name); never the secret. */
+    summary(p: Payload<K>): string | null;
+}
+/** This PC's folders from the environment (never HOME or USERPROFILE). */
+export declare function pcEnv(): PcEnv;
+/** What a kind whose host side is not written yet says. */
+export declare function notAvailableYet(kind: ServiceKind): never;

package/dist/host/accounts/source.js

@@ -0,0 +1,15 @@
+import { fail } from '../../core/util/index.js';
+import { SERVICE_SPECS } from '../../shared/accounts/index.js';
+/** This PC's folders from the environment (never HOME or USERPROFILE). */
+export function pcEnv() {
+    const env = process.env;
+    return {
+        localAppData: env.LOCALAPPDATA ?? '',
+        appData: env.APPDATA ?? '',
+        programData: env.ProgramData ?? env.PROGRAMDATA ?? 'C:\\ProgramData',
+    };
+}
+/** What a kind whose host side is not written yet says. */
+export function notAvailableYet(kind) {
+    return fail('Saving a ' + SERVICE_SPECS[kind].label + ' sign-in is not available yet.', 'It comes in a later version of the sandbox.');
+}

package/dist/host/accounts/sources.d.ts

@@ -0,0 +1,5 @@
+import type { ServiceKind } from '../../shared/accounts/index.js';
+import type { HostSource } from './source.js';
+export declare const HOST_SOURCES: {
+    readonly [K in ServiceKind]: HostSource<K>;
+};

package/dist/host/accounts/sources.js

@@ -0,0 +1,18 @@
+import { appstoreSource } from './kinds/appstore.js';
+import { cfxSource } from './kinds/cfx.js';
+import { epicSource } from './kinds/epic.js';
+import { expoSource } from './kinds/expo.js';
+import { keystoreSource } from './kinds/keystore.js';
+import { playSource } from './kinds/play.js';
+import { steamSource } from './kinds/steam.js';
+import { unitySource } from './kinds/unity.js';
+export const HOST_SOURCES = {
+    epic: epicSource,
+    steam: steamSource,
+    unity: unitySource,
+    cfx: cfxSource,
+    keystore: keystoreSource,
+    play: playSource,
+    expo: expoSource,
+    appstore: appstoreSource,
+};

package/dist/host/accounts/store.d.ts

@@ -0,0 +1,23 @@
+import { type AccountSource, type Payload, type ServiceKind } from '../../shared/accounts/index.js';
+import { SecretStore } from '../secrets/index.js';
+export type AccountState = 'none' | 'saved' | 'unreadable';
+export interface AccountInfo {
+    readonly savedAt: string;
+    readonly source: AccountSource;
+    readonly summary: string | null;
+}
+/** The folder of the store, the leases and nothing else (host-only storage, never mapped). */
+export declare function accountsDir(storageRoot: string): string;
+export declare class ServiceAccountStore {
+    private readonly storageRoot;
+    private readonly secrets;
+    constructor(storageRoot: string, secrets?: SecretStore);
+    private file;
+    /** Whether a sign-in is saved and can be opened by this Windows user (it is never returned here). */
+    state(kind: ServiceKind): AccountState;
+    info(kind: ServiceKind): AccountInfo | null;
+    /** The sign-in, decrypted. Only the launch calls this; throws when this Windows user cannot open it. */
+    read<K extends ServiceKind>(kind: K): Payload<K> | null;
+    save<K extends ServiceKind>(kind: K, payload: Payload<K>, source: AccountSource, summary?: string | null): void;
+    remove(kind: ServiceKind): boolean;
+}

package/dist/host/accounts/store.js

@@ -0,0 +1,74 @@
+// Your saved service sign-ins for sandboxes (accounts.<kind>.share), one file per kind in host-only storage
+// (<storage>\accounts\<kind>.json): when and where it was saved, a short summary (an account name, never a secret) and
+// the sign-in sealed with Windows DPAPI. Never printed, logged or returned to a surface: only the launch reads it.
+import fs from 'node:fs';
+import path from 'node:path';
+import { z } from 'zod';
+import { JsonFile } from '../../shared/io/index.js';
+import { ACCOUNT_SOURCES, PAYLOADS, SERVICE_SPECS, } from '../../shared/accounts/index.js';
+import { fail } from '../../core/util/index.js';
+import { SecretStore } from '../secrets/index.js';
+const SavedSchema = z.object({
+    savedAt: z.string().max(64),
+    source: z.enum(ACCOUNT_SOURCES),
+    summary: z.string().max(200).nullable(),
+    sealed: z.string().max(4 * 1024 * 1024),
+});
+/** The folder of the store, the leases and nothing else (host-only storage, never mapped). */
+export function accountsDir(storageRoot) {
+    return path.join(storageRoot, 'accounts');
+}
+export class ServiceAccountStore {
+    storageRoot;
+    secrets;
+    constructor(storageRoot, secrets = SecretStore.standard(storageRoot)) {
+        this.storageRoot = storageRoot;
+        this.secrets = secrets;
+    }
+    file(kind) {
+        return new JsonFile(SavedSchema, path.join(accountsDir(this.storageRoot), kind + '.json'));
+    }
+    /** Whether a sign-in is saved and can be opened by this Windows user (it is never returned here). */
+    state(kind) {
+        if (!this.file(kind).read())
+            return 'none';
+        try {
+            return this.read(kind) ? 'saved' : 'none';
+        }
+        catch {
+            return 'unreadable';
+        }
+    }
+    info(kind) {
+        const saved = this.file(kind).read();
+        return saved ? { savedAt: saved.savedAt, source: saved.source, summary: saved.summary } : null;
+    }
+    /** The sign-in, decrypted. Only the launch calls this; throws when this Windows user cannot open it. */
+    read(kind) {
+        const saved = this.file(kind).read();
+        if (!saved)
+            return null;
+        const payload = PAYLOADS[kind].safeParse(this.secrets.openJson(saved.sealed));
+        if (!payload.success)
+            fail('The saved ' + SERVICE_SPECS[kind].label + ' sign-in is damaged.', 'Save it again: sandbox account import ' + kind + ' (or login).');
+        return payload.data;
+    }
+    save(kind, payload, source, summary = null) {
+        const checked = PAYLOADS[kind].parse(payload);
+        if (JSON.stringify(checked).length > SERVICE_SPECS[kind].maxBytes)
+            fail('That ' + SERVICE_SPECS[kind].label + ' sign-in is too big to keep.');
+        this.file(kind).write({
+            savedAt: new Date().toISOString(),
+            source,
+            summary: summary === null ? null : summary.slice(0, 200),
+            sealed: this.secrets.sealJson(checked),
+        });
+    }
+    remove(kind) {
+        const file = this.file(kind).file;
+        if (!fs.existsSync(file))
+            return false;
+        fs.rmSync(file, { force: true });
+        return true;
+    }
+}

package/dist/host/audit/log.d.ts

@@ -28,8 +28,8 @@ export declare const AuditEventSchema: z.ZodObject<{
     ag: z.ZodOptional<z.ZodString>;
     pj: z.ZodOptional<z.ZodString>;
     sv: z.ZodOptional<z.ZodEnum<{
-        p: "p";
         t: "t";
+        p: "p";
     }>>;
     h: z.ZodOptional<z.ZodString>;
     au: z.ZodOptional<z.ZodString>;

package/dist/host/launch/generate.d.ts

@@ -1,5 +1,7 @@
 import type { GenerateOptions, Generated } from '../../core/types.js';
 import { type EnginePlan, type SandboxEngine } from '../engines/index.js';
+/** A new launch's id: the time and 6 random hex digits. */
+export declare function newLaunchId(): string;
 export declare function generateSandbox(given: GenerateOptions, 
 /** The engine launch.ts opened (hcs needs a look at this PC first); Windows Sandbox when left out. */
 opened?: SandboxEngine): Generated & {

package/dist/host/launch/generate.js

@@ -4,6 +4,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import os from 'node:os';
+import { isServiceKind } from '../../shared/accounts/index.js';
 import { widenForProjects } from '../../core/local-config/index.js';
 import { dirExists, ensureDir, fail, writeJson } from '../../core/util/index.js';
 import { engineFor, realLiveFolders } from '../engines/index.js';
@@ -22,6 +23,14 @@ import { copyRuntime, stageGitIdentity, stageHooks } from './stage.js';
 import { decideProjectToolchains } from './toolchains.js';
 import { buildLaunchPlan } from './launch-plan.js';
 import { cappedMemoryMb, decideMemory, GUEST, memoryNote, residentNote, resolveMemoryMb } from './wsb-file.js';
+/** The handed-over sign-ins still shared in the configs the sandbox boots with, as the secrets-file field. */
+function withSharedAccounts(given, config, others) {
+    const kept = Object.fromEntries(Object.entries(given ?? {}).filter(([kind, payload]) => payload !== undefined &&
+        isServiceKind(kind) &&
+        config.accounts[kind].share &&
+        others.every((p) => p.config.accounts[kind].share)));
+    return Object.keys(kept).length ? { serviceAccounts: kept } : {};
+}
 const NO_PROFILE = { hostDir: null, staged: [], skipped: [], credentials: false, secretsRemoved: [] };
 /** Moves the staged copy of this PC's Claude login out of the launch folder; its text goes in the one-shot file. */
 function takeStagedCredentials(launchPath) {
@@ -32,6 +41,10 @@ function takeStagedCredentials(launchPath) {
     fs.rmSync(file, { force: true });
     return text;
 }
+/** A new launch's id: the time and 6 random hex digits. */
+export function newLaunchId() {
+    return Date.now() + '-' + crypto.randomBytes(3).toString('hex');
+}
 export function generateSandbox(given, 
 /** The engine launch.ts opened (hcs needs a look at this PC first); Windows Sandbox when left out. */
 opened) {
@@ -63,7 +76,7 @@ opened) {
     const askedMb = Math.max(resolveMemoryMb(config.sandbox, o.freeMemoryBytes, undefined, commitAvailableMb), ...others.map((p) => (typeof p.config.sandbox.memoryMb === 'number' ? p.config.sandbox.memoryMb : 0)));
     // Never more than this PC can keep in RAM for it, whatever was asked.
     const memoryMb = cappedMemoryMb(askedMb, config.sandbox, Math.floor(os.totalmem() / 1048576));
-    const launchId = Date.now() + '-' + crypto.randomBytes(3).toString('hex');
+    const launchId = o.launchId ?? newLaunchId();
     const launchPath = path.join(storageRoot, 'launches', launchId);
     // Whatever must stay secret goes in a one-shot file in the data folder, never into the launch folder (the sandbox
     // maps it read-only and it is kept for days). Leftovers of earlier launches go first.
@@ -116,6 +129,8 @@ opened) {
         ...(o.vpn?.wireguardConfig ? { wireguardConfig: o.vpn.wireguardConfig } : {}),
         // Checked again on the configs the sandbox boots with: never when a project in it has git access below "full".
         ...(o.githubToken && githubTokenAllowed(config, others) ? { githubToken: o.githubToken } : {}),
+        // Checked again here: only the kinds you share, and none a project in this sandbox turned off.
+        ...withSharedAccounts(o.serviceAccounts, config, others),
     });
     fs.writeFileSync(path.join(launchPath, 'env.cmd'), logonEnv(session.workspace), 'utf8');
     copyRuntime(o.packageRoot, launchPath);

package/dist/host/launch/hints/android.d.ts

@@ -0,0 +1,3 @@
+import type { Toolchains } from '../../../core/types.js';
+import type { ToolchainHints } from './hint.js';
+export declare function androidHints(_root: string, _settings: Toolchains): ToolchainHints;

package/dist/host/launch/hints/android.js

@@ -0,0 +1,3 @@
+export function androidHints(_root, _settings) {
+    return {};
+}

package/dist/host/launch/hints/engines.d.ts

@@ -0,0 +1,3 @@
+import type { Toolchains } from '../../../core/types.js';
+import type { ToolchainHints } from './hint.js';
+export declare function engineHints(_root: string, _settings: Toolchains): ToolchainHints;

package/dist/host/launch/hints/engines.js

@@ -0,0 +1,3 @@
+export function engineHints(_root, _settings) {
+    return {};
+}

package/dist/host/launch/hints/fivem.d.ts

@@ -0,0 +1,3 @@
+import type { Toolchains } from '../../../core/types.js';
+import type { ToolchainHints } from './hint.js';
+export declare function fivemHints(_root: string, _settings: Toolchains): ToolchainHints;

package/dist/host/launch/hints/fivem.js

@@ -0,0 +1,3 @@
+export function fivemHints(_root, _settings) {
+    return {};
+}