windows-development-sandbox 1.17.3 → 1.18.0

package/dist/core/schema/config.d.ts

@@ -96,6 +96,38 @@ export declare const ConfigSchema: z.ZodObject<{
     github: z.ZodObject<{
         shareToken: z.ZodBoolean;
     }, z.core.$strict>;
+    accounts: z.ZodObject<{
+        epic: z.ZodObject<{
+            share: z.ZodBoolean;
+        }, z.core.$strict>;
+        steam: z.ZodObject<{
+            share: z.ZodBoolean;
+        }, z.core.$strict>;
+        unity: z.ZodObject<{
+            share: z.ZodBoolean;
+        }, z.core.$strict>;
+        cfx: z.ZodObject<{
+            share: z.ZodBoolean;
+        }, z.core.$strict>;
+        keystore: z.ZodObject<{
+            share: z.ZodBoolean;
+        }, z.core.$strict>;
+        play: z.ZodObject<{
+            share: z.ZodBoolean;
+        }, z.core.$strict>;
+        expo: z.ZodObject<{
+            share: z.ZodBoolean;
+        }, z.core.$strict>;
+        appstore: z.ZodObject<{
+            share: z.ZodBoolean;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    pcInstalls: z.ZodObject<{
+        steamGames: z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodNumber>]>;
+        epicGames: z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>;
+        unrealEngines: z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>;
+        unityEditors: z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>;
+    }, z.core.$strict>;
     provisioning: z.ZodObject<{
         copyFromHost: z.ZodBoolean;
         fallbackToInstall: z.ZodBoolean;
@@ -158,6 +190,65 @@ export declare const ConfigSchema: z.ZodObject<{
             acceptLicense: z.ZodBoolean;
             components: z.ZodArray<z.ZodString>;
             keepInstallFiles: z.ZodBoolean;
+            persistEngines: z.ZodBoolean;
+            derivedDataCache: z.ZodEnum<{
+                persisted: "persisted";
+                local: "local";
+            }>;
+        }, z.core.$strict>;
+        unity: z.ZodObject<{
+            enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+            acceptLicense: z.ZodBoolean;
+            version: z.ZodString;
+            modules: z.ZodArray<z.ZodString>;
+            hub: z.ZodBoolean;
+            keepVersions: z.ZodNumber;
+        }, z.core.$strict>;
+        godot: z.ZodObject<{
+            enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+            version: z.ZodString;
+            dotnet: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+            exportTemplates: z.ZodBoolean;
+            keepVersions: z.ZodNumber;
+        }, z.core.$strict>;
+        steam: z.ZodObject<{
+            enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+            client: z.ZodBoolean;
+            sdkFolder: z.ZodString;
+        }, z.core.$strict>;
+        fivem: z.ZodObject<{
+            enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+            acceptLicense: z.ZodBoolean;
+            game: z.ZodEnum<{
+                gta5: "gta5";
+                rdr3: "rdr3";
+            }>;
+            artifact: z.ZodString;
+            txAdmin: z.ZodBoolean;
+            keepVersions: z.ZodNumber;
+        }, z.core.$strict>;
+        android: z.ZodObject<{
+            enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+            acceptLicense: z.ZodBoolean;
+            platforms: z.ZodArray<z.ZodString>;
+            buildTools: z.ZodString;
+            ndk: z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodString]>;
+            cmake: z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodString]>;
+            packages: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>;
+        flutter: z.ZodObject<{
+            enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+            version: z.ZodString;
+            windowsDesktop: z.ZodBoolean;
+            precache: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>;
+        dart: z.ZodObject<{
+            enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+            version: z.ZodString;
+        }, z.core.$strict>;
+        reactNative: z.ZodObject<{
+            enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+            easCli: z.ZodBoolean;
         }, z.core.$strict>;
         cpp: z.ZodObject<{
             enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
@@ -170,6 +261,7 @@ export declare const ConfigSchema: z.ZodObject<{
             workloads: z.ZodArray<z.ZodString>;
             frameworkTargets: z.ZodArray<z.ZodString>;
             netfx35: z.ZodBoolean;
+            templates: z.ZodArray<z.ZodString>;
         }, z.core.$strict>;
         go: z.ZodObject<{
             enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
@@ -181,6 +273,7 @@ export declare const ConfigSchema: z.ZodObject<{
             version: z.ZodString;
             maven: z.ZodBoolean;
             gradle: z.ZodBoolean;
+            kotlin: z.ZodBoolean;
         }, z.core.$strict>;
         ruby: z.ZodObject<{
             enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
@@ -416,6 +509,32 @@ export declare const LocalOverridesSchema: z.ZodObject<{
     vpn: z.ZodOptional<z.ZodObject<{
         killSwitch: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
+    accounts: z.ZodOptional<z.ZodObject<{
+        epic: z.ZodOptional<z.ZodObject<{
+            share: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+        steam: z.ZodOptional<z.ZodObject<{
+            share: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+        unity: z.ZodOptional<z.ZodObject<{
+            share: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+        cfx: z.ZodOptional<z.ZodObject<{
+            share: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+        keystore: z.ZodOptional<z.ZodObject<{
+            share: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+        play: z.ZodOptional<z.ZodObject<{
+            share: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+        expo: z.ZodOptional<z.ZodObject<{
+            share: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+        appstore: z.ZodOptional<z.ZodObject<{
+            share: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
     provisioning: z.ZodOptional<z.ZodObject<{
         copyFromHost: z.ZodOptional<z.ZodBoolean>;
         fallbackToInstall: z.ZodOptional<z.ZodBoolean>;
@@ -527,6 +646,126 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
+        unity: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict> | z.ZodObject<{
+            version: z.ZodOptional<z.ZodString>;
+            extraVersions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            corepack: z.ZodOptional<z.ZodBoolean>;
+            volta: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            globalPackages: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict> | z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+        }, z.core.$strict> | z.ZodObject<{
+            gh: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+        }, z.core.$strict>>;
+        godot: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict> | z.ZodObject<{
+            version: z.ZodOptional<z.ZodString>;
+            extraVersions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            corepack: z.ZodOptional<z.ZodBoolean>;
+            volta: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            globalPackages: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict> | z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+        }, z.core.$strict> | z.ZodObject<{
+            gh: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+        }, z.core.$strict>>;
+        steam: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict> | z.ZodObject<{
+            version: z.ZodOptional<z.ZodString>;
+            extraVersions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            corepack: z.ZodOptional<z.ZodBoolean>;
+            volta: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            globalPackages: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict> | z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+        }, z.core.$strict> | z.ZodObject<{
+            gh: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+        }, z.core.$strict>>;
+        fivem: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict> | z.ZodObject<{
+            version: z.ZodOptional<z.ZodString>;
+            extraVersions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            corepack: z.ZodOptional<z.ZodBoolean>;
+            volta: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            globalPackages: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict> | z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+        }, z.core.$strict> | z.ZodObject<{
+            gh: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+        }, z.core.$strict>>;
+        android: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict> | z.ZodObject<{
+            version: z.ZodOptional<z.ZodString>;
+            extraVersions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            corepack: z.ZodOptional<z.ZodBoolean>;
+            volta: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            globalPackages: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict> | z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+        }, z.core.$strict> | z.ZodObject<{
+            gh: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+        }, z.core.$strict>>;
+        flutter: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict> | z.ZodObject<{
+            version: z.ZodOptional<z.ZodString>;
+            extraVersions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            corepack: z.ZodOptional<z.ZodBoolean>;
+            volta: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            globalPackages: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict> | z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+        }, z.core.$strict> | z.ZodObject<{
+            gh: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+        }, z.core.$strict>>;
+        dart: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict> | z.ZodObject<{
+            version: z.ZodOptional<z.ZodString>;
+            extraVersions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            corepack: z.ZodOptional<z.ZodBoolean>;
+            volta: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            globalPackages: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict> | z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+        }, z.core.$strict> | z.ZodObject<{
+            gh: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+        }, z.core.$strict>>;
+        reactNative: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict> | z.ZodObject<{
+            version: z.ZodOptional<z.ZodString>;
+            extraVersions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            corepack: z.ZodOptional<z.ZodBoolean>;
+            volta: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            globalPackages: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict> | z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+        }, z.core.$strict> | z.ZodObject<{
+            gh: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+            openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
+        }, z.core.$strict>>;
         cpp: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{

package/dist/core/schema/config.js

@@ -14,6 +14,8 @@ import { ResumeSchema } from './resume.js';
 import { WebSchema } from './web.js';
 import { VpnSchema } from './vpn.js';
 import { GithubSchema } from './github.js';
+import { AccountsSchema } from './accounts.js';
+import { PcInstallsSchema } from './pc-installs.js';
 const RESERVED_ENV_PREFIX = /^(AGENT_|GIT_|GH_|GITHUB_|NODE_|NPM_CONFIG_(USERCONFIG|GLOBALCONFIG|PREFIX|SCRIPT_SHELL)|SSL_|CLAUDE|ANTHROPIC_|OPENAI_|CODEX_|GEMINI_|GOOGLE_|COPILOT_|AWS_|AZURE_)/i;
 const RESERVED_ENV_SUFFIX = /(_PROXY|_BASE_URL|_ENDPOINT|_CA_BUNDLE|_CA_CERTS)$/i;
 const RESERVED_ENV_NAMES = new Set([
@@ -85,6 +87,8 @@ export const ConfigSchema = z
     network: NetworkSchema,
     vpn: VpnSchema,
     github: GithubSchema,
+    accounts: AccountsSchema,
+    pcInstalls: PcInstallsSchema,
     provisioning: ProvisioningSchema,
     downloads: DownloadsSchema,
     toolchains: ToolchainsSchema,
@@ -137,6 +141,8 @@ export const LocalOverridesSchema = z
     network: NetworkSchema.pick({ blockPrivateRanges: true, blockHosts: true }).partial(),
     // A project may turn the kill switch on, never off, and never choose a VPN, a server, a file or a login.
     vpn: VpnSchema.pick({ killSwitch: true }).partial(),
+    // A project may only turn a sign-in off (policy: OFF_IS_SAFER); pcInstalls is never here (folders of this PC).
+    accounts: z.strictObject(_.mapValues(AccountsSchema.shape, (shape) => shape.partial())).partial(),
     provisioning: ProvisioningSchema.pick({ copyFromHost: true, fallbackToInstall: true, refresh: true })
         .extend({ git: GitSchema.partial(), terminal: toggle('Windows Terminal as the sandbox window.').partial() })
         .partial(),

package/dist/core/schema/pc-installs.d.ts

@@ -0,0 +1,7 @@
+import { z } from 'zod';
+export declare const PcInstallsSchema: z.ZodObject<{
+    steamGames: z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodNumber>]>;
+    epicGames: z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>;
+    unrealEngines: z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>;
+    unityEditors: z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>;
+}, z.core.$strict>;

package/dist/core/schema/pc-installs.js

@@ -0,0 +1,17 @@
+// pcInstalls: games, engines and editors already installed on this PC, mapped read-only into the sandbox (nothing is
+// copied). Yours only: a project file can never map folders of this PC.
+import { z } from 'zod';
+const pick = (item, what, example) => z
+    .union([z.boolean(), z.array(item)])
+    .describe(what +
+    ' of this PC, read-only in the sandbox under C:\\PcInstalls: true = all of them, false = none, or a list (e.g. ' +
+    example +
+    '). The agent can read their files.');
+export const PcInstallsSchema = z
+    .strictObject({
+    steamGames: pick(z.number().int().positive(), 'Steam games (true maps each library; a list of app IDs maps only those games)', '[480, 730]'),
+    epicGames: pick(z.string().regex(/^[A-Za-z0-9._-]{1,100}$/), 'Epic Games Launcher games (by their app name)', '["Fortnite"]'),
+    unrealEngines: pick(z.string().regex(/^(UE_)?\d+\.\d+$/), 'Unreal Engine versions installed with the Epic Games Launcher', '["5.4"]'),
+    unityEditors: pick(z.string().regex(/^\d+\.\d+\.\d+[abfp]\d+$/), 'Unity editors installed with Unity Hub', '["6000.0.32f1"]'),
+})
+    .describe("Games, engines and editors installed on this PC, mapped read-only into sandboxes (no copy, no room on the sandbox's disk).");

package/dist/core/schema/toolchains.d.ts

@@ -39,6 +39,65 @@ export declare const ToolchainsSchema: z.ZodObject<{
         acceptLicense: z.ZodBoolean;
         components: z.ZodArray<z.ZodString>;
         keepInstallFiles: z.ZodBoolean;
+        persistEngines: z.ZodBoolean;
+        derivedDataCache: z.ZodEnum<{
+            persisted: "persisted";
+            local: "local";
+        }>;
+    }, z.core.$strict>;
+    unity: z.ZodObject<{
+        enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+        acceptLicense: z.ZodBoolean;
+        version: z.ZodString;
+        modules: z.ZodArray<z.ZodString>;
+        hub: z.ZodBoolean;
+        keepVersions: z.ZodNumber;
+    }, z.core.$strict>;
+    godot: z.ZodObject<{
+        enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+        version: z.ZodString;
+        dotnet: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+        exportTemplates: z.ZodBoolean;
+        keepVersions: z.ZodNumber;
+    }, z.core.$strict>;
+    steam: z.ZodObject<{
+        enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+        client: z.ZodBoolean;
+        sdkFolder: z.ZodString;
+    }, z.core.$strict>;
+    fivem: z.ZodObject<{
+        enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+        acceptLicense: z.ZodBoolean;
+        game: z.ZodEnum<{
+            gta5: "gta5";
+            rdr3: "rdr3";
+        }>;
+        artifact: z.ZodString;
+        txAdmin: z.ZodBoolean;
+        keepVersions: z.ZodNumber;
+    }, z.core.$strict>;
+    android: z.ZodObject<{
+        enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+        acceptLicense: z.ZodBoolean;
+        platforms: z.ZodArray<z.ZodString>;
+        buildTools: z.ZodString;
+        ndk: z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodString]>;
+        cmake: z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodString]>;
+        packages: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    flutter: z.ZodObject<{
+        enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+        version: z.ZodString;
+        windowsDesktop: z.ZodBoolean;
+        precache: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    dart: z.ZodObject<{
+        enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+        version: z.ZodString;
+    }, z.core.$strict>;
+    reactNative: z.ZodObject<{
+        enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
+        easCli: z.ZodBoolean;
     }, z.core.$strict>;
     cpp: z.ZodObject<{
         enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
@@ -51,6 +110,7 @@ export declare const ToolchainsSchema: z.ZodObject<{
         workloads: z.ZodArray<z.ZodString>;
         frameworkTargets: z.ZodArray<z.ZodString>;
         netfx35: z.ZodBoolean;
+        templates: z.ZodArray<z.ZodString>;
     }, z.core.$strict>;
     go: z.ZodObject<{
         enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
@@ -62,6 +122,7 @@ export declare const ToolchainsSchema: z.ZodObject<{
         version: z.ZodString;
         maven: z.ZodBoolean;
         gradle: z.ZodBoolean;
+        kotlin: z.ZodBoolean;
     }, z.core.$strict>;
     ruby: z.ZodObject<{
         enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;

package/dist/core/schema/toolchains.js

@@ -62,6 +62,108 @@ export const ToolchainsSchema = z.strictObject({
         keepInstallFiles: z
             .boolean()
             .describe('Keep an offline copy of the Visual Studio install files in tools\\visualstudio (~10 GB, made once), so later boots install without downloading them again. Skipped while that disk has too little room.'),
+        persistEngines: z
+            .boolean()
+            .describe('Engines the Epic Games Launcher installs go to tools\\unreal\\engines (kept between sandboxes, 40-60 GB each) and are registered with the launcher again every boot. Off: they go on the sandbox disk and are lost when it closes. Engines installed on this PC can be mapped instead (pcInstalls.unrealEngines).'),
+        derivedDataCache: z
+            .enum(['persisted', 'local'])
+            .describe('"persisted": the engine\'s local derived data cache (compiled shaders, 10-50 GB) in tools\\unreal\\ddc, kept between sandboxes. "local": Unreal\'s own place on the sandbox disk (rebuilt every boot).'),
+    }),
+    unity: z.strictObject({
+        enabled: enabled("Unity: the editor version a project asks for, from Unity's release API (checked against its published hash), installed into tools\\unity\\<version> (6-7 GB each), with the modules you list.", 'ProjectSettings/ProjectVersion.txt'),
+        acceptLicense: z
+            .boolean()
+            .describe('Required to install: you accept the Unity terms of service (https://unity.com/legal/terms-of-service), and the editor needs a Unity licence (Personal is free). A project file cannot accept it for you.'),
+        version: z
+            .string()
+            .min(1)
+            .describe('"project" = the version in ProjectSettings/ProjectVersion.txt, or an editor version such as "6000.0.32f1".'),
+        modules: z
+            .array(z.string().regex(/^[a-z0-9-]+$/))
+            .describe('Editor modules to add: "android" (4-5 GB, also the Android SDK), "webgl" (1.5 GB), "windows-il2cpp" (adds Visual Studio\'s C++ parts), "ios" (Xcode project export only: iOS builds need a Mac).'),
+        hub: z.boolean().describe('Also Unity Hub, with the installed editors listed in it.'),
+        keepVersions: z
+            .number()
+            .int()
+            .min(1)
+            .max(20)
+            .describe('How many editor versions to keep in tools\\unity; older ones are removed (the least recently used first).'),
+    }),
+    godot: z.strictObject({
+        enabled: enabled('Godot from its official builds (checked against the published SHA-512 sums), self-contained in tools\\godot\\<version> with `godot` (the console build) on PATH.', 'project.godot'),
+        version: z
+            .string()
+            .min(1)
+            .describe('"project" = the version project.godot was saved with (else the newest stable), or a version such as "4.3".'),
+        dotnet: EnabledSchema.describe('The .NET (C#) build of Godot and the .NET SDK: true, false, or "auto" = when the project has a .csproj.'),
+        exportTemplates: z.boolean().describe('Also the export templates for that version (~1.2 GB), for exporting games.'),
+        keepVersions: z
+            .number()
+            .int()
+            .min(1)
+            .max(20)
+            .describe('How many Godot versions to keep; older ones are removed (the least recently used first).'),
+    }),
+    steam: z.strictObject({
+        enabled: enabled('SteamCMD (`steamcmd` on PATH, Valve-signed, ~0.3 GB) and `sbx-steam` for logging in, downloading apps and workshop items, and uploading builds (ContentBuilder) and workshop items.', 'steam_appid.txt, steam_api64.dll, steam_api.dll, or an app_build / workshop_item .vdf'),
+        client: z
+            .boolean()
+            .describe('Also the Steam client (1-1.5 GB, in tools\\steam), for testing the Steamworks API, the overlay or in-game uploads. You sign in to it in each sandbox.'),
+        sdkFolder: z
+            .string()
+            .describe('Where the Steamworks SDK is in the sandbox (relative paths are inside the project); it sets STEAMWORKS_SDK. Empty = not set. The SDK is never downloaded (it needs a Steamworks partner login).'),
+    }),
+    fivem: z.strictObject({
+        enabled: enabled('A FiveM / RedM server (FXServer with txAdmin) for resource development, from the Cfx.re artifacts (the game client is not supported). `sbx-fivem serve` starts it.', 'fxmanifest.lua or __resource.lua (up to 3 folders down)'),
+        acceptLicense: z
+            .boolean()
+            .describe('Required to install: you accept the Cfx.re platform terms (https://fivem.net/terms) and the FXServer licence. A project file cannot accept it for you.'),
+        game: z.enum(['gta5', 'rdr3']).describe('"gta5" = FiveM, "rdr3" = RedM.'),
+        artifact: z
+            .string()
+            .regex(/^(recommended|optional|latest|\d+)$/)
+            .describe('The server build: "recommended", "optional", "latest", or a build number.'),
+        txAdmin: z.boolean().describe('Start the server with txAdmin (its web panel on port 40120).'),
+        keepVersions: z
+            .number()
+            .int()
+            .min(1)
+            .max(20)
+            .describe('How many server builds to keep in tools\\fivem\\artifacts.'),
+    }),
+    android: z.strictObject({
+        enabled: enabled('The Android SDK (command-line tools, platform-tools, build-tools, platforms, NDK and CMake as needed) in tools\\android-sdk, with a JDK. No emulator (Windows Sandbox cannot run one): use a device over the network, or build only.', 'a Gradle build using com.android, an AndroidManifest.xml (up to 3 folders down), a .NET MAUI project, or a Flutter / React Native / Godot Android project'),
+        acceptLicense: z
+            .boolean()
+            .describe('Required to install: you accept the Android SDK licence (https://developer.android.com/studio/terms) and the licences sdkmanager shows. A project file cannot accept them for you.'),
+        platforms: StringsSchema.describe('Platforms to install, e.g. ["android-35"]; "project" = the compileSdk the project\'s Gradle files ask for.'),
+        buildTools: z.string().min(1).describe('"latest" or a build-tools version such as "35.0.0".'),
+        ndk: z
+            .union([z.literal(false), z.string().min(1)])
+            .describe('"auto" = when the project uses native code (ndkVersion, CMake or ndk-build), false = never, or a version.'),
+        cmake: z
+            .union([z.literal(false), z.string().min(1)])
+            .describe('"auto" = when the project builds native code with CMake, false = never, or a version.'),
+        packages: Packages('More sdkmanager packages (not the emulator or system images)', '["extras;google;usb_driver"]'),
+    }),
+    flutter: z.strictObject({
+        enabled: enabled('Flutter (with its Dart) from the official releases (checked against their SHA-256), with the Android SDK for Android builds.', 'a pubspec.yaml with a flutter: section'),
+        version: z
+            .string()
+            .min(1)
+            .describe('"project" = the version in .fvmrc (else the newest stable), "stable", "beta", or a version such as "3.24.5".'),
+        windowsDesktop: z
+            .boolean()
+            .describe("Windows desktop builds: needs Visual Studio Build Tools' C++ parts (a real installer: it runs every boot, ~5 GB on the sandbox disk)."),
+        precache: StringsSchema.describe('Platforms whose engine files are downloaded ahead (flutter precache), e.g. ["android", "web"].'),
+    }),
+    dart: z.strictObject({
+        enabled: enabled('The Dart SDK (without Flutter), checked against its published SHA-256.', 'a pubspec.yaml without a flutter: section'),
+        version: z.string().min(1).describe('"stable", "beta" or a version such as "3.5.4".'),
+    }),
+    reactNative: z.strictObject({
+        enabled: enabled('React Native / Expo: the Android SDK and JDK for Android builds (Node is always there). iOS builds run in EAS Build (the cloud).', 'a package.json depending on react-native or expo'),
+        easCli: z.boolean().describe('Also eas-cli (Expo Application Services) as a global npm package.'),
     }),
     cpp: z.strictObject({
         enabled: enabled("MinGW-w64 GCC with CMake, Ninja, premake5 and mingw32-make (also Rust's linker).", 'CMakeLists.txt, Makefile, meson.build, premake5.lua or Cargo.toml'),
@@ -78,6 +180,7 @@ export const ToolchainsSchema = z.strictObject({
         netfx35: z
             .boolean()
             .describe('.NET Framework 3.5 runtime (a Windows feature, enabled from Windows Update on every boot; a few minutes).'),
+        templates: Packages('Project templates (`dotnet new install`)', '["MonoGame.Templates.CSharp"]'),
     }),
     go: z.strictObject({
         enabled: enabled('Go.', 'go.mod or go.work'),
@@ -95,6 +198,9 @@ export const ToolchainsSchema = z.strictObject({
             .describe('"lts" (newest LTS) or a major version such as "21". A project\'s .java-version or .sdkmanrc wins.'),
         maven: z.boolean().describe("Apache Maven (mvn). A project's mvnw works either way."),
         gradle: z.boolean().describe("Gradle (gradle). A project's gradlew works either way."),
+        kotlin: z
+            .boolean()
+            .describe("Also the Kotlin compiler (kotlinc) from JetBrains' releases. Gradle builds fetch their own."),
     }),
     ruby: z.strictObject({
         enabled: enabled('Ruby (RubyInstaller, with gem and bundler). Gems with C extensions need MSYS2, which is not included.', 'Gemfile, a .gemspec or .ruby-version'),

package/dist/core/types.d.ts

@@ -2,6 +2,9 @@ import type { z } from 'zod';
 import type { AutoToolchain, ToolchainDecision } from './detect/index.js';
 import type { BootWant } from './local-config/index.js';
 import type { ConfigSchema, GitAccessSchema, HarnessSchema, LocalOverridesSchema, MappingSchema } from './schema/index.js';
+import type { Payloads } from '../shared/accounts/payloads.js';
+import type { ServiceKind } from '../shared/accounts/kinds.js';
+import type { PcInstallManifest } from '../shared/paths/pc-installs.js';
 export type { AttachEndpoint, GuestRequest, GuestResponse, SandboxStatus, SessionStatus, } from '../shared/channel/index.js';
 export type Config = z.output<typeof ConfigSchema>;
 export type Overrides = z.output<typeof LocalOverridesSchema>;
@@ -143,6 +146,17 @@ export interface GenerateOptions {
     vpn?: PreparedVpn;
     /** The saved GitHub token (github.shareToken, host/github/deliver.ts): only ever written to the one-shot file. */
     githubToken?: string;
+    /** Saved service sign-ins this launch hands over (accounts.<kind>.share): only ever in the one-shot file. */
+    serviceAccounts?: Payloads;
+    /** The kinds whose lease this launch holds (a sign-in made or renewed there may come back). Names only. */
+    accountLeases?: ServiceKind[];
+    /** The launch's id, when the caller made it first (service-account leases name it). */
+    launchId?: string;
+    /** pcInstalls: this PC's games, engines and editors, read-only under C:\PcInstalls (host/pc-installs). */
+    pcInstalls?: {
+        mappings: ResolvedMapping[];
+        manifest: PcInstallManifest;
+    };
     /** The data set's mappings from a storage provider (contained storage); else the data folder is one mapping. */
     dataMappings?: ResolvedMapping[];
 }
@@ -284,4 +298,8 @@ export interface GuestSession {
     agentProfileDirs?: Record<string, string[]>;
     /** Every configured agent (without its environment): a terminal command each; older launch folders lack it. */
     agents?: Record<string, Harness>;
+    /** pcInstalls: what is mapped read-only under C:\PcInstalls (paths in the sandbox only); older launches lack it. */
+    pcInstalls?: PcInstallManifest;
+    /** Service sign-ins whose lease this launch holds: the sandbox hands renewed ones back (names only). */
+    accountLeases?: ServiceKind[];
 }

package/dist/guest/accounts/adapter.d.ts

@@ -0,0 +1,25 @@
+import type { Payload, ServiceKind } from '../../shared/accounts/index.js';
+export interface Applied {
+    /** Variables the agent's sessions get (EXPO_TOKEN ...), in memory only. */
+    readonly env?: Readonly<Record<string, string>>;
+    /** One line for the boot log; never the secret. */
+    readonly summary: string;
+}
+export interface GuestAdapter<K extends ServiceKind> {
+    readonly kind: K;
+    apply(p: Payload<K>): Promise<Applied> | Applied;
+    /** Bounded, BOM-aware read of what the tool holds now; null when it holds none. */
+    current?(): Payload<K> | null;
+    /** How often current() is asked (default 60000 ms). */
+    readonly checkMs?: number;
+    /** When the sandbox stops: let go of what must not stay taken (a Unity seat). */
+    release?(): Promise<void> | void;
+}
+/** %LOCALAPPDATA% of the sandbox's user (its own disk). */
+export declare function localAppData(): string;
+/** The sandbox's own folder for the accounts: %LOCALAPPDATA%\AgentSandbox\accounts (wiped with the sandbox). */
+export declare function accountsRoot(): string;
+/** Where one kind's files go (a keystore, a .p8, a cfg the server reads). */
+export declare function secretDir(kind: ServiceKind): string;
+/** What a kind whose sandbox side is not written yet says (the sign-in is not used). */
+export declare function notAvailableYet(kind: ServiceKind): Applied;

package/dist/guest/accounts/adapter.js

@@ -0,0 +1,21 @@
+// How a handed-over service sign-in becomes the tool's own (one adapter per kind under kinds/): apply writes it where
+// the tool reads it, current reads back what the tool holds now (a renewed sign-in), release lets go of it when the
+// sandbox stops (a Unity seat). Adapters write only to secretDir(kind) or the tool's own files on the sandbox's disk,
+// which is wiped when the sandbox closes. No runtime imports: the self-test loads these files.
+import path from 'node:path';
+/** %LOCALAPPDATA% of the sandbox's user (its own disk). */
+export function localAppData() {
+    return process.env.LOCALAPPDATA ?? 'C:\\Users\\WDAGUtilityAccount\\AppData\\Local';
+}
+/** The sandbox's own folder for the accounts: %LOCALAPPDATA%\AgentSandbox\accounts (wiped with the sandbox). */
+export function accountsRoot() {
+    return path.join(localAppData(), 'AgentSandbox', 'accounts');
+}
+/** Where one kind's files go (a keystore, a .p8, a cfg the server reads). */
+export function secretDir(kind) {
+    return path.join(accountsRoot(), kind);
+}
+/** What a kind whose sandbox side is not written yet says (the sign-in is not used). */
+export function notAvailableYet(kind) {
+    return { summary: kind + ': using a saved sign-in is not available yet (it is not used)' };
+}

package/dist/guest/accounts/adapters.d.ts

@@ -0,0 +1,5 @@
+import type { ServiceKind } from '../../shared/accounts/index.js';
+import type { GuestAdapter } from './adapter.js';
+export declare const ADAPTERS: {
+    readonly [K in ServiceKind]: GuestAdapter<K>;
+};