windows-development-sandbox 1.17.3 → 1.18.0

package/dist/selftest/steam.test.js

@@ -0,0 +1,316 @@
+// Steam: the VDF parser and its limits, the SteamCMD sign-in from a fake steamcmd folder (host) and back (sandbox),
+// SteamCMD's command lines (apps, workshop, builds), the PC's libraries from a fixture libraryfolders.vdf, the SteamCMD
+// install (a bad signer, the time limit, nothing private kept on the data disk), room checks with an injected statfs,
+// and the build-script hint. Temp folders and fakes only: nothing is downloaded or run.
+import fs from 'node:fs';
+import path from 'node:path';
+import { DEFAULTS } from '../core/config/index.js';
+import { decideToolchains } from '../core/detect/index.js';
+import { HOST_SOURCES } from '../host/accounts/index.js';
+import { steamCmdFolderOf } from '../host/accounts/kinds/steam.js';
+import { steamHints } from '../host/launch/hints/steam.js';
+import { discoverPcInstalls } from '../host/pc-installs/index.js';
+import { findSteamInstalls, steamInstalls, steamLibraries } from '../host/pc-installs/steam.js';
+import { fingerprint, readSteamCmdLogin } from '../shared/accounts/index.js';
+import { encodeText } from '../shared/io/index.js';
+import { InstallRecordsSchema } from '../shared/installs.js';
+import { PC_INSTALLS_GUEST } from '../shared/paths/index.js';
+import { parseVdf, vdfGet, vdfText } from '../shared/vdf.js';
+import { steamAdapterFor } from '../guest/accounts/kinds/steam.js';
+import { assertAppRoom, installedApps, recordApp } from '../guest/toolchains/steam/apps.js';
+import { appBuildArgs, appUpdateArgs, scriptKind, withBuildSettings, workshopGetArgs, workshopPushArgs, } from '../guest/toolchains/steam/commands.js';
+import { fetchSteamCmd, prepareSteamCmd } from '../guest/toolchains/steam/steamcmd-install.js';
+const GB = 1024 ** 3;
+const PC = { localAppData: '', appData: '', programData: '' };
+const roomy = { statfs: () => ({ bavail: 100 * GB, bsize: 1 }) };
+const short = { statfs: () => ({ bavail: GB / 4, bsize: 1 }) };
+/** A VDF string as Steam writes paths: backslashes doubled. */
+const q = (p) => '"' + p.replace(/\\/g, '\\\\') + '"';
+const CONFIG_VDF = `"InstallConfigStore"
+{
+	"Software"
+	{
+		"Valve"
+		{
+			"Steam"
+			{
+				"Accounts"
+				{
+					"builder_bot"
+					{
+						"SteamID"		"76561190000000000"
+					}
+				}
+				"ConnectCache"
+				{
+					"7a2c1b3d1"		"0200000001000000aabbccdd"
+				}
+			}
+		}
+	}
+}
+`;
+const APP_BUILD = `"AppBuild"
+{
+	"AppID" "480" // Spacewar
+	"Desc" "nightly"
+	"ContentRoot" "..\\content\\"
+	"BuildOutput" "..\\output\\"
+	"Depots"
+	{
+		"481" "depot_build_481.vdf"
+	}
+}
+`;
+export const steamSuite = {
+    name: 'steam',
+    title: 'Steam: the VDF parser, the SteamCMD sign-in, sbx-steam command lines, PC libraries, SteamCMD install',
+    run: async (t, f) => {
+        t.section('the VDF parser');
+        const parsed = parseVdf('\uFEFF// a comment\n"libraryfolders"\n{\n\t"0"\n\t{\n\t\t"path"\t\t"C:\\\\Program Files (x86)\\\\Steam"\n' +
+            '\t\t"Label" "say \\"hi\\""\n\t}\n\tunquoted value\n\t"cond" "1" [$WIN32]\n}\n');
+        t.equal(vdfText(parsed, 'libraryfolders', '0', 'path'), 'C:\\Program Files (x86)\\Steam', 'escaped paths come out');
+        t.equal(vdfText(parsed, 'LIBRARYFOLDERS', '0', 'label'), 'say "hi"', 'keys match in any case, quotes unescape');
+        t.check(vdfText(parsed, 'libraryfolders', 'unquoted') === 'value' && vdfText(parsed, 'libraryfolders', 'cond') === '1', 'comments, a byte-order mark, unquoted words and [conditions] are handled');
+        t.equal(vdfText(parseVdf(APP_BUILD, { escapes: false }), 'AppBuild', 'ContentRoot'), '..\\content\\', 'without escapes a hand-written "..\\content\\" stays as written');
+        t.equal(vdfText(parseVdf('"a" { "k" "first" "K" "second" }'), 'a', 'k'), 'first', 'a repeated key keeps the first value');
+        const proto = parseVdf('"__proto__" { "polluted" "yes" } "constructor" "x"');
+        t.check(proto !== null &&
+            {}.polluted === undefined &&
+            vdfGet(proto, '__proto__') !== undefined, 'a "__proto__" key is a plain key (nothing is polluted)');
+        const refused = [
+            ['"a" { "b" "c"', 'an unclosed block'],
+            ['"a" "b" }', 'a stray }'],
+            ['"a" { "b" "c', 'an unclosed quote'],
+            ['"a"', 'a key without a value'],
+            ['{ "a" "b" }', 'a block without a key'],
+            ['"x" [$WIN32', 'an unclosed condition'],
+            ['"a" "' + 'x'.repeat(2000) + '"', 'a text over maxBytes', { maxBytes: 1000 }],
+            ['"a" { "b" { "c" "d" } }', 'nesting over maxDepth', { maxDepth: 1 }],
+            ['"a" "1" "b" "2" "c" "3"', 'more keys than maxKeys', { maxKeys: 2 }],
+        ];
+        for (const [text, what, limits] of refused)
+            t.equal(parseVdf(text, limits), null, 'refused: ' + what);
+        const deep = '"a" {'.repeat(50_000);
+        const flat = '"r" {' + Array.from({ length: 50_000 }, (_, i) => '"k' + i + '" "v"').join(' ') + '}';
+        const started = Date.now();
+        const deepResult = parseVdf(deep);
+        const flatResult = parseVdf(flat);
+        t.check(deepResult === null && flatResult !== null && Date.now() - started < 5000, 'deep nesting is refused and 50000 keys parse quickly (no quadratic work)', Date.now() - started + ' ms');
+        t.equal(parseVdf('"a" "b"', { maxBytes: 3 }), null, 'the size limit holds before anything is parsed');
+        t.section('the SteamCMD sign-in: from a steamcmd folder on this PC');
+        const pcCmd = t.dir('pc-steamcmd');
+        t.write(path.join(pcCmd, 'steamcmd.exe'), 'exe');
+        t.write(path.join(pcCmd, 'config', 'config.vdf'), CONFIG_VDF);
+        for (let i = 1; i <= 5; i++) {
+            t.write(path.join(pcCmd, 'ssfn' + i), 'sentry' + i);
+            fs.utimesSync(path.join(pcCmd, 'ssfn' + i), new Date(), new Date(Date.now() - (6 - i) * 60_000));
+        }
+        t.write(path.join(pcCmd, 'ssfn99'), 'x'.repeat(60 * 1024));
+        t.write(path.join(pcCmd, 'ssfnabc'), 'not a sentry');
+        const source = HOST_SOURCES.steam;
+        const login = source.fromPc(PC, pcCmd);
+        t.check(login !== null &&
+            login.account === 'builder_bot' &&
+            login.configVdf === CONFIG_VDF &&
+            login.sentries.length === 4 &&
+            login.sentries.map((s) => s.name).join() === 'ssfn2,ssfn3,ssfn4,ssfn5' &&
+            Buffer.from(login.sentries[3].base64, 'base64').toString() === 'sentry5', 'config.vdf and the newest four sentry files are taken (an oversized or misnamed one is not)', JSON.stringify(login?.sentries.map((s) => s.name)));
+        t.equal(login ? source.summary(login) : null, 'builder_bot', 'its summary is the account name, never the token');
+        t.check(steamCmdFolderOf(path.join(pcCmd, 'steamcmd.exe')) === pcCmd &&
+            steamCmdFolderOf(path.join(pcCmd, 'config', 'config.vdf')) === pcCmd &&
+            fingerprint(source.fromPc(PC, path.join(pcCmd, 'config', 'config.vdf'))) === fingerprint(login), '--from may name the folder, its steamcmd.exe or its config.vdf');
+        const utf16 = t.dir('pc-steamcmd-utf16');
+        fs.mkdirSync(path.join(utf16, 'config'));
+        fs.writeFileSync(path.join(utf16, 'config', 'config.vdf'), encodeText(CONFIG_VDF, 'utf16le'));
+        t.equal(readSteamCmdLogin(utf16)?.account, 'builder_bot', 'a UTF-16 config.vdf is read too');
+        const signedOut = t.dir('pc-steamcmd-out');
+        t.write(path.join(signedOut, 'config', 'config.vdf'), CONFIG_VDF.replace(/"ConnectCache"[\s\S]*?\}/, ''));
+        t.check(source.fromPc(PC, signedOut) === null && source.fromPc(PC, t.at('nowhere')) === null, 'no cached login (or no folder): nothing is taken');
+        const big = t.dir('pc-steamcmd-big');
+        t.write(path.join(big, 'config', 'config.vdf'), CONFIG_VDF + ' '.repeat(300 * 1024));
+        t.equal(readSteamCmdLogin(big), null, 'a config.vdf over 256 KB is refused');
+        t.section('the SteamCMD sign-in: in the sandbox');
+        const guestCmd = t.dir('guest-steamcmd');
+        const adapter = steamAdapterFor(guestCmd);
+        const applied = await adapter.apply(login);
+        const back = adapter.current();
+        t.check(fs.readFileSync(path.join(guestCmd, 'config', 'config.vdf'), 'utf8') === CONFIG_VDF &&
+            fs.readFileSync(path.join(guestCmd, 'ssfn5'), 'utf8') === 'sentry5' &&
+            !applied.summary.includes('aabbccdd') &&
+            back !== null &&
+            fingerprint(back) === fingerprint(login), "applied into SteamCMD's folder and read back the same (the watch hands back nothing new)");
+        t.write(path.join(guestCmd, 'config', 'config.vdf'), CONFIG_VDF.replace('aabbccdd', 'eeff0011'));
+        t.check(fingerprint(adapter.current()) !== fingerprint(login), 'a renewed login token reads back different (it goes back to the PC)');
+        t.section('SteamCMD command lines');
+        const dir = 'C:\\AgentData\\tools\\steam-apps\\740';
+        t.equal(appUpdateArgs({ appId: '740', dir, login: 'anonymous', beta: 'public-beta', validate: true }), [
+            '+force_install_dir',
+            dir,
+            '+login',
+            'anonymous',
+            '+app_update',
+            '740',
+            '-beta',
+            'public-beta',
+            'validate',
+            '+quit',
+        ], 'app: the folder comes before the login, then the app, its branch and validate');
+        t.equal(workshopGetArgs({
+            appId: '4000',
+            items: ['123', '456'],
+            dir: 'C:\\AgentData\\cache\\steam-workshop',
+            login: 'me',
+        }), [
+            '+force_install_dir',
+            'C:\\AgentData\\cache\\steam-workshop',
+            '+login',
+            'me',
+            '+workshop_download_item',
+            '4000',
+            '123',
+            '+workshop_download_item',
+            '4000',
+            '456',
+            '+quit',
+        ], 'workshop get: one download command per item');
+        t.equal(workshopPushArgs('me', 'C:\\Workspace\\game\\item.vdf'), ['+login', 'me', '+workshop_build_item', 'C:\\Workspace\\game\\item.vdf', '+quit'], 'workshop push: workshop_build_item');
+        t.equal(appBuildArgs('me', 'C:\\Workspace\\game\\app_build_480.vdf'), ['+login', 'me', '+run_app_build', 'C:\\Workspace\\game\\app_build_480.vdf', '+quit'], 'build: run_app_build');
+        const bad = [
+            [() => appUpdateArgs({ appId: '480 +quit', dir, login: 'me' }), 'an app ID with a command in it'],
+            [() => appUpdateArgs({ appId: '0', dir, login: 'me' }), 'app ID 0'],
+            [() => appUpdateArgs({ appId: '480', dir, login: 'me +runscript x' }), 'an account with a command in it'],
+            [() => appUpdateArgs({ appId: '480', dir, login: 'me', beta: 'a b' }), 'a branch with a space'],
+            [() => appUpdateArgs({ appId: '480', dir: 'relative\\dir', login: 'me' }), 'a relative folder'],
+            [() => appUpdateArgs({ appId: '480', dir: 'C:\\a "b"', login: 'me' }), 'a folder with a quote'],
+            [() => appUpdateArgs({ appId: '480', dir: 'C:\\x +quit', login: 'me' }), 'a folder with " +"'],
+            [() => workshopGetArgs({ appId: '480', items: [], dir, login: 'me' }), 'no workshop items'],
+            [() => workshopGetArgs({ appId: '480', items: ['12a'], dir, login: 'me' }), 'a bad item ID'],
+            [() => workshopPushArgs('anonymous', 'C:\\item.vdf'), 'uploading anonymously'],
+            [() => appBuildArgs('me', 'app_build.vdf'), 'a relative script'],
+        ];
+        for (const [fn, what] of bad)
+            await t.throws(fn, /not a|cannot be given|no workshop|needs your Steam/, 'refused: ' + what);
+        t.check(scriptKind(APP_BUILD) === 'appbuild' &&
+            scriptKind('"workshopitem" { "appid" "480" "publishedfileid" "0" }') === 'workshopitem' &&
+            scriptKind('"libraryfolders" { }') === null, 'a script is told by its first block');
+        const preview = withBuildSettings(APP_BUILD, { preview: true, desc: 'from the sandbox' });
+        const previewRoot = preview ? parseVdf(preview, { escapes: false }) : null;
+        t.check(vdfText(previewRoot, 'AppBuild', 'Preview') === '1' &&
+            vdfText(previewRoot, 'AppBuild', 'Desc') === 'from the sandbox' &&
+            vdfText(previewRoot, 'AppBuild', 'ContentRoot') === '..\\content\\', '--preview and --desc set Preview and Desc in a copy of the script, the rest unchanged');
+        t.check(vdfText(parseVdf(withBuildSettings(preview, { preview: true }), { escapes: false }), 'AppBuild', 'Preview') ===
+            '1' && withBuildSettings('"workshopitem" { }', { preview: true }) === null, 'an existing Preview is replaced; a workshop script is not a build');
+        await t.throws(() => withBuildSettings(APP_BUILD, { desc: 'a "quoted" one' }), 'one line', 'a description cannot break the script');
+        t.section("this PC's Steam libraries");
+        const steamRoot = t.dir('pc-steam');
+        const lib2 = t.dir('pc-steam-lib2');
+        t.write(path.join(steamRoot, 'steamapps', 'libraryfolders.vdf'), `"libraryfolders"\n{\n\t"0"\n\t{\n\t\t"path"\t\t${q(steamRoot)}\n\t\t"apps"\n\t\t{\n\t\t\t"228980"\t\t"1"\n\t\t}\n\t}\n` +
+            `\t"1"\n\t{\n\t\t"path"\t\t${q(lib2)}\n\t\t"apps"\n\t\t{\n\t\t\t"480"\t\t"1"\n\t\t}\n\t}\n}\n`);
+        t.write(path.join(lib2, 'steamapps', 'appmanifest_480.acf'), '"AppState"\n{\n\t"appid"\t\t"480"\n\t"name"\t\t"Spacewar"\n\t"installdir"\t\t"Spacewar"\n\t"buildid"\t\t"123"\n}\n');
+        t.dir('pc-steam-lib2', 'steamapps', 'common', 'Spacewar');
+        t.write(path.join(lib2, 'steamapps', 'appmanifest_10.acf'), '"AppState" { "appid" "10" "name" "Climber" "installdir" "..\\\\..\\\\Windows" }');
+        t.equal(steamLibraries(fs.readFileSync(path.join(steamRoot, 'steamapps', 'libraryfolders.vdf'), 'utf8')).map((l) => [
+            l.path,
+            l.apps,
+        ]), [
+            [steamRoot, ['228980']],
+            [lib2, ['480']],
+        ], 'libraryfolders.vdf: each library and the apps it lists');
+        t.equal(steamLibraries('"LibraryFolders" { "TimeNextStatsReport" "1" "ContentStatsID" "2" "1" "D:\\\\Games" }').map((l) => l.path), ['D:\\Games'], 'the old libraryfolders.vdf format too');
+        const libraries = findSteamInstalls(steamRoot, true);
+        t.check(libraries.map((l) => [l.kind, l.id, l.host].join()).join('|') ===
+            [
+                'steam-library,library1,' + path.join(steamRoot, 'steamapps'),
+                'steam-library,library2,' + path.join(lib2, 'steamapps'),
+            ].join('|') && libraries.every((l) => !l.name.includes(steamRoot) && !l.name.includes(lib2)), "true: every library's steamapps, named without a path of this PC");
+        const games = findSteamInstalls(steamRoot, [480, '10', 'abc', 99]);
+        t.equal(games.map((g) => [g.id, g.name, g.version, g.host]), [['480', 'Spacewar', '123', path.join(lib2, 'steamapps', 'common', 'Spacewar')]], 'a list: only those games, from their manifests (an installdir that climbs out, or an unknown ID, is left out)');
+        const fixture = { ...steamInstalls, find: (wanted) => findSteamInstalls(steamRoot, wanted) };
+        const found = discoverPcInstalls({ ...DEFAULTS.pcInstalls, steamGames: [480] }, { packageRoot: t.packageRoot, storageRoot: f.baseConfig.storage.root, sources: [fixture] }, PC);
+        t.check(found.mappings.length === 1 &&
+            found.mappings[0].guest === PC_INSTALLS_GUEST + '\\steam\\480' &&
+            found.mappings[0].readOnly &&
+            !JSON.stringify(found.manifest).includes(lib2), 'mapped read-only at C:\\PcInstalls\\steam\\480; the manifest holds no path of this PC');
+        t.section('installing SteamCMD');
+        const tools = t.dir('steam-tools');
+        const store = path.join(tools, 'steamcmd');
+        const work = t.dir('steam-work');
+        let downloads = 0;
+        const fake = (signed, extra = {}) => ({
+            ...roomy,
+            toolsDir: tools,
+            storeDir: store,
+            workDir: work,
+            signed,
+            download: async (_url, file, verify) => {
+                downloads++;
+                fs.writeFileSync(file + '.part', 'zip');
+                try {
+                    await verify(file + '.part');
+                    fs.renameSync(file + '.part', file);
+                }
+                finally {
+                    fs.rmSync(file + '.part', { force: true });
+                }
+            },
+            extract: async (_archive, destination) => {
+                fs.mkdirSync(destination, { recursive: true });
+                fs.writeFileSync(path.join(destination, 'steamcmd.exe'), 'steamcmd');
+            },
+            run: async (_exe, args, cwd) => {
+                if (args.join() === '+quit')
+                    fs.writeFileSync(path.join(cwd, 'steamclient64.dll'), 'updated');
+                return { code: 7, timedOut: false };
+            },
+            ...extra,
+        });
+        await t.throws(() => fetchSteamCmd(store, fake(() => false)), 'not signed by Valve', 'a steamcmd.exe not signed by Valve is refused');
+        t.check(!fs.existsSync(store) && !fs.readdirSync(tools).some((n) => n.includes('staging')), 'and nothing of it is kept');
+        downloads = 0;
+        await t.throws(() => fetchSteamCmd(store, fake(() => true, short)), 'it needs', 'too little room on the data disk: refused before downloading');
+        t.equal(downloads, 0, 'nothing was downloaded');
+        // The boot applied the sign-in into the working folder before this step (accounts come first).
+        t.write(path.join(work, 'config', 'config.vdf'), CONFIG_VDF);
+        t.write(path.join(work, 'ssfn5'), 'sentry5');
+        const exe = await prepareSteamCmd(fake(() => true));
+        t.check(exe === path.join(work, 'steamcmd.exe') &&
+            fs.readFileSync(path.join(work, 'config', 'config.vdf'), 'utf8') === CONFIG_VDF &&
+            fs.existsSync(path.join(store, 'steamclient64.dll')), 'downloaded once, copied in without touching the sign-in, updated, and the updated binaries kept');
+        t.check(!fs.existsSync(path.join(store, 'config')) && !fs.existsSync(path.join(store, 'ssfn5')), 'the kept copy on the data disk never holds config\\ or a sentry file');
+        const fresh = t.dir('steam-work-2');
+        t.write(path.join(store, 'config', 'config.vdf'), 'planted');
+        downloads = 0;
+        await prepareSteamCmd(fake(() => true, { workDir: fresh }));
+        t.check(downloads === 0 && !fs.existsSync(path.join(store, 'config')) && !fs.existsSync(path.join(fresh, 'config')), 'the next sandbox copies the kept binaries (no download); a config\\ planted there is removed, not copied');
+        await t.throws(() => prepareSteamCmd(fake(() => true, { workDir: t.dir('steam-work-3'), run: async () => ({ code: -1, timedOut: true }) })), 'did not finish updating itself', 'its first-run update has a time limit');
+        await t.throws(() => prepareSteamCmd(fake((file) => !file.startsWith(t.at('steam-work-4')), { workDir: t.dir('steam-work-4') })), 'not signed by Valve', 'a steamcmd.exe that is not Valve-signed is never run');
+        t.check(!fs.existsSync(store), 'and the kept copy goes (downloaded again next boot)');
+        t.section('apps and room');
+        await t.throws(() => assertAppRoom(path.join(tools, 'steam-apps', '740'), 5 * GB, 'app 740', short), 'it needs 5.0 GB', 'sbx-steam app refuses when the disk is short');
+        t.write(path.join(tools, 'steam-apps', '740', 'steamapps', 'appmanifest_740.acf'), '"AppState" { "appid" "740" "name" "Counter-Strike Global Offensive - Dedicated Server" "installdir" "csgo_ds" }');
+        recordApp('740', 123_456, { toolsDir: tools });
+        const apps = installedApps({ toolsDir: tools });
+        t.check(apps.length === 1 &&
+            apps[0].name.startsWith('Counter-Strike') &&
+            apps[0].sizeBytes === 123_456 &&
+            InstallRecordsSchema.safeParse(t.readJson(path.join(tools, 'installs.json'))).success, 'its size is recorded in tools\\installs.json (sandbox data shows it) and sbx-steam games lists it');
+        t.section('the build-script hint');
+        const project = t.dir('steam-project');
+        t.write(path.join(project, 'tools', 'ContentBuilder', 'scripts', 'app_build_480.vdf'), APP_BUILD);
+        t.write(path.join(project, 'node_modules', 'x', 'app_build.vdf'), APP_BUILD);
+        const tc = structuredClone(DEFAULTS.toolchains);
+        const hints = steamHints(project, tc);
+        t.check((hints.steam ?? '').includes('tools/ContentBuilder/scripts/app_build_480.vdf') &&
+            decideToolchains(tc, [], [], hints).steam.on, 'an app_build .vdf a few folders down turns Steam on');
+        const other = t.dir('steam-project-2');
+        t.write(path.join(other, 'node_modules', 'x', 'app_build.vdf'), APP_BUILD);
+        t.write(path.join(other, 'big.vdf'), '"workshopitem" { "title" "' + 'x'.repeat(70 * 1024) + '" }');
+        t.write(path.join(other, 'libraryfolders.vdf'), '"libraryfolders" { }');
+        t.write(path.join(other, 'item.txt'), '"workshopitem" { }');
+        t.equal(steamHints(other, tc), {}, 'skipped folders, oversized files and other .vdf files give no hint');
+        const off = structuredClone(tc);
+        off.steam.enabled = false;
+        t.equal(steamHints(project, off), {}, 'nothing is read when Steam is not "auto"');
+    },
+};

package/dist/selftest/storage-helper.test.js

@@ -59,6 +59,16 @@ function buildHelper(t) {
 function own(dir, sid) {
     spawnSync(SYSTEM.icacls(), [dir, '/setowner', '*' + sid, '/T', '/C', '/Q'], { windowsHide: true });
 }
+/**
+ * A new folder whose permissions are its own (not inherited from %TEMP%, which other tools may have opened up): only
+ * `sid`, SYSTEM and Administrators may change it and what is made below it. Null when icacls could not set that.
+ */
+function privateFolder(dir, sid) {
+    fs.mkdirSync(dir, { recursive: true });
+    const full = '(OI)(CI)F';
+    const r = spawnSync(SYSTEM.icacls(), [dir, '/inheritance:r', '/grant:r', '*' + sid + ':' + full, '*S-1-5-18:' + full, '*S-1-5-32-544:' + full, '/Q'], { windowsHide: true });
+    return r.status === 0 ? dir : null;
+}
 function units(t) {
     t.section('the request the CLI sends, and what it makes of the answer');
     t.check(HelperRequestSchema.safeParse({ verb: 'mount', set: 'main' }).success, 'a request is a verb and a set');
@@ -164,7 +174,17 @@ function checkRun(exe, verb, root, set, sid, maxGb) {
 }
 function checks(t, exe, sid) {
     t.section('the checks (dry run): what the helper accepts and refuses');
-    const root = t.dir('storage-helper', 'store');
+    // Every folder here starts private, so what is refused below is what the test opened up, never %TEMP%'s own rights.
+    const base = privateFolder(t.at('storage-helper', 'checks'), sid);
+    t.check(base !== null, 'the test folder is made private (only you, SYSTEM and Administrators may change it)');
+    if (!base)
+        return;
+    const dir = (name) => {
+        const p = path.join(base, name);
+        fs.mkdirSync(p, { recursive: true });
+        return p;
+    };
+    const root = dir('store');
     const paths = containedPaths(root, 'main');
     for (const dir of [paths.imagesDir, paths.mountsDir, paths.mount])
         fs.mkdirSync(dir, { recursive: true });
@@ -221,8 +241,8 @@ function checks(t, exe, sid) {
     }
     else
         t.skip('a folder others may change (icacls failed)');
-    const linkTarget = t.dir('storage-helper', 'linktarget');
-    const junctionRoot = t.dir('storage-helper', 'junction');
+    const linkTarget = dir('linktarget');
+    const junctionRoot = dir('junction');
     const junction = containedPaths(junctionRoot, 'main');
     fs.mkdirSync(junction.mount, { recursive: true });
     const mk = spawnSync(SYSTEM.cmd(), ['/c', 'mklink', '/J', junction.imagesDir, linkTarget], { windowsHide: true });
@@ -234,8 +254,8 @@ function checks(t, exe, sid) {
     }
     else
         t.skip('images folder as a junction');
-    const above = t.dir('storage-helper', 'above');
-    const realParent = t.dir('storage-helper', 'above-real');
+    const above = dir('above');
+    const realParent = dir('above-real');
     const inner = containedPaths(path.join(realParent, 'store'), 'main');
     for (const dir of [inner.imagesDir, inner.mount])
         fs.mkdirSync(dir, { recursive: true });
@@ -248,7 +268,7 @@ function checks(t, exe, sid) {
     }
     else
         t.skip('a junction above the storage folder');
-    const mountRoot = t.dir('storage-helper', 'mountlink');
+    const mountRoot = dir('mountlink');
     const mountLinked = containedPaths(mountRoot, 'main');
     fs.mkdirSync(mountLinked.imagesDir, { recursive: true });
     fs.mkdirSync(mountLinked.mountsDir, { recursive: true });
@@ -261,7 +281,7 @@ function checks(t, exe, sid) {
     }
     else
         t.skip('mount folder as a junction');
-    const missing = t.dir('storage-helper', 'missing');
+    const missing = dir('missing');
     own(missing, sid);
     refused('a storage folder without images and mounts', run({ root: missing }), 'missing');
 }
@@ -347,7 +367,10 @@ async function startConsole(exe, args) {
 }
 async function server(t, exe, sid) {
     t.section('the server in its console mode (this user, a pipe of its own, dry run)');
-    const root = t.dir('storage-helper', 'served');
+    const root = privateFolder(t.at('storage-helper', 'served'), sid);
+    t.check(root !== null, 'the served storage folder is made private');
+    if (!root)
+        return;
     const paths = containedPaths(root, 'main');
     for (const dir of [paths.imagesDir, paths.mount])
         fs.mkdirSync(dir, { recursive: true });

package/dist/selftest/support/engine-golden.js

@@ -29,6 +29,7 @@ export const LAUNCH_FILES_GOLDEN = [
     'runtime/gitguard.js',
     'runtime/main.js',
     'runtime/netproxy.js',
+    'runtime/tool.js',
     'runtime/view.js',
     // The agent add-ons' lock files (pinned installs), copied with the rest of sandbox\.
     'sandbox/addons/ccusage/package-lock.json',
@@ -62,6 +63,7 @@ export const LAUNCH_FILES_GOLDEN = [
     'sandbox/csharp/SandboxTools/Program.cs',
     'sandbox/csharp/VsWhere.cs',
     'sandbox/csharp/VtInput.cs',
+    'sandbox/scripts/add-firewall-port.ps1',
     'sandbox/scripts/enable-vt-input.ps1',
     'sandbox/scripts/expand-archive.ps1',
     'sandbox/scripts/get-gpu-names.ps1',
@@ -73,5 +75,6 @@ export const LAUNCH_FILES_GOLDEN = [
     'sandbox/scripts/set-desktop.ps1',
     'sandbox/scripts/set-dns-servers.ps1',
     'sandbox/scripts/set-machine-environment.ps1',
+    'sandbox/templates/fivem/README.txt',
     'session.json',
 ];

package/dist/selftest/support/fixtures.d.ts

@@ -107,6 +107,38 @@ export declare function createFixtures(t: Harness): {
         github: {
             shareToken: boolean;
         };
+        accounts: {
+            epic: {
+                share: boolean;
+            };
+            steam: {
+                share: boolean;
+            };
+            unity: {
+                share: boolean;
+            };
+            cfx: {
+                share: boolean;
+            };
+            keystore: {
+                share: boolean;
+            };
+            play: {
+                share: boolean;
+            };
+            expo: {
+                share: boolean;
+            };
+            appstore: {
+                share: boolean;
+            };
+        };
+        pcInstalls: {
+            steamGames: boolean | number[];
+            epicGames: boolean | string[];
+            unrealEngines: boolean | string[];
+            unityEditors: boolean | string[];
+        };
         provisioning: {
             copyFromHost: boolean;
             fallbackToInstall: boolean;
@@ -162,6 +194,59 @@ export declare function createFixtures(t: Harness): {
                 acceptLicense: boolean;
                 components: string[];
                 keepInstallFiles: boolean;
+                persistEngines: boolean;
+                derivedDataCache: "persisted" | "local";
+            };
+            unity: {
+                enabled: boolean | "auto";
+                acceptLicense: boolean;
+                version: string;
+                modules: string[];
+                hub: boolean;
+                keepVersions: number;
+            };
+            godot: {
+                enabled: boolean | "auto";
+                version: string;
+                dotnet: boolean | "auto";
+                exportTemplates: boolean;
+                keepVersions: number;
+            };
+            steam: {
+                enabled: boolean | "auto";
+                client: boolean;
+                sdkFolder: string;
+            };
+            fivem: {
+                enabled: boolean | "auto";
+                acceptLicense: boolean;
+                game: "gta5" | "rdr3";
+                artifact: string;
+                txAdmin: boolean;
+                keepVersions: number;
+            };
+            android: {
+                enabled: boolean | "auto";
+                acceptLicense: boolean;
+                platforms: string[];
+                buildTools: string;
+                ndk: string | false;
+                cmake: string | false;
+                packages: string[];
+            };
+            flutter: {
+                enabled: boolean | "auto";
+                version: string;
+                windowsDesktop: boolean;
+                precache: string[];
+            };
+            dart: {
+                enabled: boolean | "auto";
+                version: string;
+            };
+            reactNative: {
+                enabled: boolean | "auto";
+                easCli: boolean;
             };
             cpp: {
                 enabled: boolean | "auto";
@@ -174,6 +259,7 @@ export declare function createFixtures(t: Harness): {
                 workloads: string[];
                 frameworkTargets: string[];
                 netfx35: boolean;
+                templates: string[];
             };
             go: {
                 enabled: boolean | "auto";
@@ -185,6 +271,7 @@ export declare function createFixtures(t: Harness): {
                 version: string;
                 maven: boolean;
                 gradle: boolean;
+                kotlin: boolean;
             };
             ruby: {
                 enabled: boolean | "auto";

package/dist/selftest/support/fixtures.js

@@ -5,6 +5,7 @@ import { spawn } from 'node:child_process';
 import { DEFAULTS } from '../../core/config/index.js';
 import { generateSandbox } from '../../host/launch/index.js';
 import { resolveRun } from '../../core/run/index.js';
+import { onFixedPc } from './pc-memory.js';
 export const HOST_NODE_VERSION = 'v22.3.0';
 /** Colour codes are removed from captured output, so tests can match plain text. */
 export function stripAnsi(text) {
@@ -110,14 +111,14 @@ export function createFixtures(t) {
         ...over,
     }, HOST_NODE_VERSION);
     const generate = (r, args = [], p = probe) => 
-    // A fixed "this PC has" list, so "auto" toolchains decide the same on every machine the tests run on.
-    generateSandbox({
+    // A fixed "this PC has" list and RAM, so "auto" toolchains and the memory decide the same on every machine.
+    onFixedPc(() => generateSandbox({
         packageRoot: t.packageRoot,
         run: r,
         harnessArgs: args,
         probe: p,
         pcLanguages: ['python', 'rust', 'cpp', 'dotnet'],
-    });
+    }));
     /** Resolves a run and generates its sandbox (.wsb + launch folder + session.json) in one step. */
     const launch = async (over = {}, options = {}) => generate(await run(over, options.config ?? baseConfig), options.args, options.probe);
     /** Writes a project's `.sandbox-config.json` (objects are serialised; strings are written as they are). */

package/dist/selftest/support/pc-memory.d.ts

@@ -0,0 +1,2 @@
+/** Runs `fn` (synchronous) as on a PC with this much RAM in total and free; the real os functions come back after. */
+export declare function onFixedPc<T>(fn: () => T, totalMb?: number, freeMb?: number): T;

package/dist/selftest/support/pc-memory.js

@@ -0,0 +1,17 @@
+// A pretend PC's RAM for code that sizes the sandbox from os.totalmem() / os.freemem() (generateSandbox caps a fixed
+// memoryMb at what the PC can keep resident), so launch tests decide the same on every machine they run on.
+import os from 'node:os';
+const MB = 1048576;
+/** Runs `fn` (synchronous) as on a PC with this much RAM in total and free; the real os functions come back after. */
+export function onFixedPc(fn, totalMb = 64 * 1024, freeMb = 48 * 1024) {
+    const real = { totalmem: os.totalmem, freemem: os.freemem };
+    os.totalmem = () => totalMb * MB;
+    os.freemem = () => freeMb * MB;
+    try {
+        return fn();
+    }
+    finally {
+        os.totalmem = real.totalmem;
+        os.freemem = real.freemem;
+    }
+}

package/dist/selftest/support/web-preview.js

@@ -157,8 +157,27 @@ function sampleAccounts() {
                         isDefault: true,
                         isActive: true,
                         savedAt: iso(3 * 24 * 60 * MINUTE),
+                        kind: 'subscription',
+                        keyHint: null,
+                    },
+                    {
+                        name: 'personal',
+                        email: null,
+                        isDefault: false,
+                        isActive: false,
+                        savedAt: iso(9 * 24 * 60 * MINUTE),
+                        kind: 'subscription',
+                        keyHint: null,
+                    },
+                    {
+                        name: 'free-credits',
+                        email: null,
+                        isDefault: false,
+                        isActive: false,
+                        savedAt: iso(1 * 24 * 60 * MINUTE),
+                        kind: 'api-key',
+                        keyHint: 'sk-ant-...x7Qa',
                     },
-                    { name: 'personal', email: null, isDefault: false, isActive: false, savedAt: iso(9 * 24 * 60 * MINUTE) },
                 ],
             },
             {

package/dist/selftest/unity.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const unitySuite: Suite;

package/dist/selftest/unity.test.js

@@ -0,0 +1,7 @@
+export const unitySuite = {
+    name: 'unity',
+    title: 'Unity: editors, modules, the release API and the licence (not available yet)',
+    run: (t) => {
+        t.check(true, 'unity: not available yet');
+    },
+};

package/dist/shared/accounts/fingerprint.d.ts

@@ -0,0 +1 @@
+export declare function fingerprint(payload: unknown): string;