windows-development-sandbox 1.17.3 → 1.18.2

package/dist/runtime/netproxy.js

@@ -4442,7 +4442,7 @@ var require_lodash = __commonJS({
         function omitBy(object2, predicate) {
           return pickBy(object2, negate(getIteratee(predicate)));
         }
-        var pick2 = flatRest(function(object2, paths) {
+        var pick3 = flatRest(function(object2, paths) {
           return object2 == null ? {} : basePick(object2, paths);
         });
         function pickBy(object2, predicate) {
@@ -5125,7 +5125,7 @@ var require_lodash = __commonJS({
         lodash.partial = partial2;
         lodash.partialRight = partialRight;
         lodash.partition = partition;
-        lodash.pick = pick2;
+        lodash.pick = pick3;
         lodash.pickBy = pickBy;
         lodash.property = property;
         lodash.propertyOf = propertyOf;
@@ -25291,7 +25291,7 @@ function date4(params) {
 }
 
 // src/shared/paths/guest-paths.ts
-var RESERVED_GUEST = /^C:\\(?:Windows|Program Files|Program Files \(x86\)|ProgramData|Users|AgentLaunch|AgentData|HostTools|nvm|Mirror)(?:\\|$)/i;
+var RESERVED_GUEST = /^C:\\(?:Windows|Program Files|Program Files \(x86\)|ProgramData|Users|AgentLaunch|AgentData|HostTools|nvm|Mirror|PcInstalls)(?:\\|$)/i;
 var MIRROR_LETTER = /^[D-Z]$/;
 var DRIVE_PATH = /^([A-Za-z]):\\(.*)$/;
 var BAD_CHARS = /[<>:"|?*/\x00-\x1f]/;
@@ -25690,8 +25690,119 @@ var ToolchainsSchema = external_exports.strictObject({
     ),
     keepInstallFiles: external_exports.boolean().describe(
       "Keep an offline copy of the Visual Studio install files in tools\\visualstudio (~10 GB, made once), so later boots install without downloading them again. Skipped while that disk has too little room."
+    ),
+    persistEngines: external_exports.boolean().describe(
+      "Engines the Epic Games Launcher installs go to tools\\unreal\\engines (kept between sandboxes, 40-60 GB each) and are registered with the launcher again every boot. Off: they go on the sandbox disk and are lost when it closes. Engines installed on this PC can be mapped instead (pcInstalls.unrealEngines)."
+    ),
+    derivedDataCache: external_exports.enum(["persisted", "local"]).describe(
+      `"persisted": the engine's local derived data cache (compiled shaders, 10-50 GB) in tools\\unreal\\ddc, kept between sandboxes. "local": Unreal's own place on the sandbox disk (rebuilt every boot).`
+    )
+  }),
+  unity: external_exports.strictObject({
+    enabled: enabled(
+      "Unity: the editor version a project asks for, from Unity's release API (checked against its published hash), installed into tools\\unity\\<version> (6-7 GB each), with the modules you list.",
+      "ProjectSettings/ProjectVersion.txt"
+    ),
+    acceptLicense: external_exports.boolean().describe(
+      "Required to install: you accept the Unity terms of service (https://unity.com/legal/terms-of-service), and the editor needs a Unity licence (Personal is free). A project file cannot accept it for you."
+    ),
+    version: external_exports.string().min(1).describe(
+      '"project" = the version in ProjectSettings/ProjectVersion.txt, or an editor version such as "6000.0.32f1".'
+    ),
+    modules: external_exports.array(external_exports.string().regex(/^[a-z0-9-]+$/)).describe(
+      `Editor modules to add: "android" (4-5 GB, also the Android SDK), "webgl" (1.5 GB), "windows-il2cpp" (adds Visual Studio's C++ parts), "ios" (Xcode project export only: iOS builds need a Mac).`
+    ),
+    hub: external_exports.boolean().describe("Also Unity Hub, with the installed editors listed in it."),
+    keepVersions: external_exports.number().int().min(1).max(20).describe(
+      "How many editor versions to keep in tools\\unity; older ones are removed (the least recently used first)."
+    )
+  }),
+  godot: external_exports.strictObject({
+    enabled: enabled(
+      "Godot from its official builds (checked against the published SHA-512 sums), self-contained in tools\\godot\\<version> with `godot` (the console build) on PATH.",
+      "project.godot"
+    ),
+    version: external_exports.string().min(1).describe(
+      '"project" = the version project.godot was saved with (else the newest stable), or a version such as "4.3".'
+    ),
+    dotnet: EnabledSchema.describe(
+      'The .NET (C#) build of Godot and the .NET SDK: true, false, or "auto" = when the project has a .csproj.'
+    ),
+    exportTemplates: external_exports.boolean().describe("Also the export templates for that version (~1.2 GB), for exporting games."),
+    keepVersions: external_exports.number().int().min(1).max(20).describe("How many Godot versions to keep; older ones are removed (the least recently used first).")
+  }),
+  steam: external_exports.strictObject({
+    enabled: enabled(
+      "SteamCMD (`steamcmd` on PATH, Valve-signed, ~0.3 GB) and `sbx-steam` for logging in, downloading apps and workshop items, and uploading builds (ContentBuilder) and workshop items.",
+      "steam_appid.txt, steam_api64.dll, steam_api.dll, or an app_build / workshop_item .vdf"
+    ),
+    client: external_exports.boolean().describe(
+      "Also the Steam client (1-1.5 GB, in tools\\steam), for testing the Steamworks API, the overlay or in-game uploads. You sign in to it in each sandbox."
+    ),
+    sdkFolder: external_exports.string().describe(
+      "Where the Steamworks SDK is in the sandbox (relative paths are inside the project); it sets STEAMWORKS_SDK. Empty = not set. The SDK is never downloaded (it needs a Steamworks partner login)."
+    )
+  }),
+  fivem: external_exports.strictObject({
+    enabled: enabled(
+      "A FiveM / RedM server (FXServer with txAdmin) for resource development, from the Cfx.re artifacts (the game client is not supported). `sbx-fivem serve` starts it.",
+      "fxmanifest.lua or __resource.lua (up to 3 folders down)"
+    ),
+    acceptLicense: external_exports.boolean().describe(
+      "Required to install: you accept the Cfx.re platform terms (https://fivem.net/terms) and the FXServer licence. A project file cannot accept it for you."
+    ),
+    game: external_exports.enum(["gta5", "rdr3"]).describe('"gta5" = FiveM, "rdr3" = RedM.'),
+    artifact: external_exports.string().regex(/^(recommended|optional|latest|\d+)$/).describe('The server build: "recommended", "optional", "latest", or a build number.'),
+    txAdmin: external_exports.boolean().describe("Start the server with txAdmin (its web panel on port 40120)."),
+    keepVersions: external_exports.number().int().min(1).max(20).describe("How many server builds to keep in tools\\fivem\\artifacts.")
+  }),
+  android: external_exports.strictObject({
+    enabled: enabled(
+      "The Android SDK (command-line tools, platform-tools, build-tools, platforms, NDK and CMake as needed) in tools\\android-sdk, with a JDK. No emulator (Windows Sandbox cannot run one): use a device over the network, or build only.",
+      "a Gradle build using com.android, an AndroidManifest.xml (up to 3 folders down), a .NET MAUI project, or a Flutter / React Native / Godot Android project"
+    ),
+    acceptLicense: external_exports.boolean().describe(
+      "Required to install: you accept the Android SDK licence (https://developer.android.com/studio/terms) and the licences sdkmanager shows. A project file cannot accept them for you."
+    ),
+    platforms: StringsSchema.describe(
+      `Platforms to install, e.g. ["android-35"]; "project" = the compileSdk the project's Gradle files ask for.`
+    ),
+    buildTools: external_exports.string().min(1).describe('"latest" or a build-tools version such as "35.0.0".'),
+    ndk: external_exports.union([external_exports.literal(false), external_exports.string().min(1)]).describe(
+      '"auto" = when the project uses native code (ndkVersion, CMake or ndk-build), false = never, or a version.'
+    ),
+    cmake: external_exports.union([external_exports.literal(false), external_exports.string().min(1)]).describe('"auto" = when the project builds native code with CMake, false = never, or a version.'),
+    packages: Packages("More sdkmanager packages (not the emulator or system images)", '["extras;google;usb_driver"]')
+  }),
+  flutter: external_exports.strictObject({
+    enabled: enabled(
+      "Flutter (with its Dart) from the official releases (checked against their SHA-256), with the Android SDK for Android builds.",
+      "a pubspec.yaml with a flutter: section"
+    ),
+    version: external_exports.string().min(1).describe(
+      '"project" = the version in .fvmrc (else the newest stable), "stable", "beta", or a version such as "3.24.5".'
+    ),
+    windowsDesktop: external_exports.boolean().describe(
+      "Windows desktop builds: needs Visual Studio Build Tools' C++ parts (a real installer: it runs every boot, ~5 GB on the sandbox disk)."
+    ),
+    precache: StringsSchema.describe(
+      'Platforms whose engine files are downloaded ahead (flutter precache), e.g. ["android", "web"].'
     )
   }),
+  dart: external_exports.strictObject({
+    enabled: enabled(
+      "The Dart SDK (without Flutter), checked against its published SHA-256.",
+      "a pubspec.yaml without a flutter: section"
+    ),
+    version: external_exports.string().min(1).describe('"stable", "beta" or a version such as "3.5.4".')
+  }),
+  reactNative: external_exports.strictObject({
+    enabled: enabled(
+      "React Native / Expo: the Android SDK and JDK for Android builds (Node is always there). iOS builds run in EAS Build (the cloud).",
+      "a package.json depending on react-native or expo"
+    ),
+    easCli: external_exports.boolean().describe("Also eas-cli (Expo Application Services) as a global npm package.")
+  }),
   cpp: external_exports.strictObject({
     enabled: enabled(
       "MinGW-w64 GCC with CMake, Ninja, premake5 and mingw32-make (also Rust's linker).",
@@ -25711,7 +25822,8 @@ var ToolchainsSchema = external_exports.strictObject({
     ),
     netfx35: external_exports.boolean().describe(
       ".NET Framework 3.5 runtime (a Windows feature, enabled from Windows Update on every boot; a few minutes)."
-    )
+    ),
+    templates: Packages("Project templates (`dotnet new install`)", '["MonoGame.Templates.CSharp"]')
   }),
   go: external_exports.strictObject({
     enabled: enabled("Go.", "go.mod or go.work"),
@@ -25727,7 +25839,8 @@ var ToolchainsSchema = external_exports.strictObject({
     ),
     version: external_exports.string().min(1).describe(`"lts" (newest LTS) or a major version such as "21". A project's .java-version or .sdkmanrc wins.`),
     maven: external_exports.boolean().describe("Apache Maven (mvn). A project's mvnw works either way."),
-    gradle: external_exports.boolean().describe("Gradle (gradle). A project's gradlew works either way.")
+    gradle: external_exports.boolean().describe("Gradle (gradle). A project's gradlew works either way."),
+    kotlin: external_exports.boolean().describe("Also the Kotlin compiler (kotlinc) from JetBrains' releases. Gradle builds fetch their own.")
   }),
   ruby: external_exports.strictObject({
     enabled: enabled(
@@ -25798,6 +25911,15 @@ var ToolchainsSchema = external_exports.strictObject({
   )
 });
 
+// src/shared/apps/catalogue-gamedev.ts
+var GAMEDEV_APPS = [];
+
+// src/shared/apps/catalogue-mobile.ts
+var MOBILE_APPS = [];
+
+// src/shared/apps/catalogue-modding.ts
+var MODDING_APPS = [];
+
 // src/shared/apps/catalogue.ts
 var gh = (github, asset) => ({ github, asset });
 var RTK_VERSION = "1.0.1";
@@ -25807,7 +25929,7 @@ var HEADROOM_VERSION = "0.41.0";
 var CCUSAGE_VERSION = "20.0.36";
 var PLAYWRIGHT_MCP_VERSION = "0.0.83";
 var CONTEXT7_MCP_VERSION = "4.4.2";
-var APPS = [
+var CORE_APPS = [
   // ---- agent add-ons
   {
     id: "rtk",
@@ -26630,6 +26752,7 @@ var APPS = [
     cli: true
   }
 ];
+var APPS = [...CORE_APPS, ...GAMEDEV_APPS, ...MODDING_APPS, ...MOBILE_APPS];
 
 // src/core/schema/apps.ts
 var CATALOGUE_IDS = APPS.filter((a) => !a.setting).map((a) => a.id);
@@ -26768,6 +26891,185 @@ var GithubSchema = external_exports.strictObject({
   )
 });
 
+// src/shared/accounts/kinds.ts
+var AGENT_CAN_USE = "The agent in the sandbox can use this sign-in while it is there.";
+var ONE_PLACE = "It works in one sandbox at a time: a second sandbox starts without it while the first one runs.";
+var SERVICE_SPECS = {
+  epic: {
+    kind: "epic",
+    label: "Epic Games",
+    usedBy: ["unreal"],
+    sources: ["pc", "sandbox"],
+    singleHolder: true,
+    returns: true,
+    maxBytes: 64 * 1024,
+    warnings: [
+      AGENT_CAN_USE,
+      "A sign-in works in one place at a time: taking this PC's signs the launcher on this PC out the first time a sandbox uses it."
+    ],
+    fields: []
+  },
+  steam: {
+    kind: "steam",
+    label: "Steam (SteamCMD)",
+    usedBy: ["steam"],
+    sources: ["file", "sandbox"],
+    singleHolder: true,
+    returns: true,
+    maxBytes: 768 * 1024,
+    warnings: [
+      AGENT_CAN_USE + " It can upload builds and workshop items to your Steam apps.",
+      ONE_PLACE,
+      "No password is kept: sign in once with sbx-steam login in a sandbox (Steam Guard asks there)."
+    ],
+    fields: []
+  },
+  unity: {
+    kind: "unity",
+    label: "Unity",
+    usedBy: ["unity"],
+    sources: ["pc", "file", "typed", "sandbox"],
+    singleHolder: true,
+    returns: true,
+    maxBytes: 256 * 1024,
+    warnings: [
+      AGENT_CAN_USE,
+      ONE_PLACE,
+      "A Pro seat is handed back when the sandbox stops cleanly; a sandbox closed abruptly may keep it until you return it."
+    ],
+    fields: [
+      { name: "email", label: "Unity ID email", secret: false, optional: true },
+      { name: "password", label: "Unity ID password", secret: true, optional: true },
+      { name: "serial", label: "Serial (Plus or Pro; empty for Personal)", secret: true, optional: true }
+    ]
+  },
+  cfx: {
+    kind: "cfx",
+    label: "Cfx.re (FiveM / RedM server key)",
+    usedBy: ["fivem"],
+    sources: ["typed"],
+    singleHolder: false,
+    returns: false,
+    maxBytes: 4 * 1024,
+    warnings: [AGENT_CAN_USE + " Anyone with the key can run a server under your Cfx.re account."],
+    fields: [
+      { name: "licenseKey", label: "Server licence key (cfxk_...)", secret: true, pattern: /^cfxk_[A-Za-z0-9_]+$/ },
+      {
+        name: "steamWebApiKey",
+        label: "Steam Web API key (optional)",
+        secret: true,
+        optional: true,
+        pattern: /^[A-F0-9]{32}$/
+      }
+    ]
+  },
+  keystore: {
+    kind: "keystore",
+    label: "Android upload keystore",
+    usedBy: ["android"],
+    sources: ["file"],
+    singleHolder: false,
+    returns: false,
+    maxBytes: 512 * 1024,
+    warnings: [AGENT_CAN_USE + " It can sign app updates as you; keep a backup of the keystore elsewhere."],
+    fields: [
+      { name: "storePassword", label: "Keystore password", secret: true },
+      { name: "keyAlias", label: "Key alias", secret: false },
+      { name: "keyPassword", label: "Key password", secret: true }
+    ]
+  },
+  play: {
+    kind: "play",
+    label: "Google Play (service account)",
+    usedBy: ["android"],
+    sources: ["file"],
+    singleHolder: false,
+    returns: false,
+    maxBytes: 128 * 1024,
+    warnings: [AGENT_CAN_USE + " It can publish to Google Play with what the service account is allowed."],
+    fields: []
+  },
+  expo: {
+    kind: "expo",
+    label: "Expo (EAS)",
+    usedBy: ["reactNative"],
+    sources: ["typed"],
+    singleHolder: false,
+    returns: false,
+    maxBytes: 4 * 1024,
+    warnings: [AGENT_CAN_USE + " It can start EAS builds and submissions on your Expo account."],
+    fields: [{ name: "token", label: "Expo access token", secret: true }]
+  },
+  appstore: {
+    kind: "appstore",
+    label: "App Store Connect API key",
+    usedBy: ["reactNative", "flutter"],
+    sources: ["file", "typed"],
+    singleHolder: false,
+    returns: false,
+    maxBytes: 16 * 1024,
+    warnings: [AGENT_CAN_USE + " It can upload and submit apps with what the key is allowed."],
+    fields: [
+      { name: "issuerId", label: "Issuer ID", secret: false },
+      { name: "keyId", label: "Key ID", secret: false, pattern: /^[A-Z0-9]{10}$/ }
+    ]
+  }
+};
+
+// src/core/schema/accounts.ts
+function share(kind, how) {
+  const spec = SERVICE_SPECS[kind];
+  return external_exports.strictObject({
+    share: external_exports.boolean().describe(
+      "Hand your saved " + spec.label + " sign-in to sandboxes that use " + spec.usedBy.join(" or ") + " (" + how + "). Kept encrypted on this PC; " + spec.warnings.join(" ") + " Yours only: a project file can only turn it off."
+    )
+  });
+}
+var AccountsSchema = external_exports.strictObject({
+  epic: share("epic", "sign in to the launcher once in a sandbox, or take this PC's: sandbox account import epic"),
+  steam: share(
+    "steam",
+    "sign in once with sbx-steam login, or: sandbox account import steam --from <steamcmd folder>"
+  ),
+  unity: share("unity", "sign in once in a sandbox, or take this PC's licence: sandbox account import unity"),
+  cfx: share("cfx", "sandbox account login cfx"),
+  keystore: share("keystore", "sandbox account import keystore --from <upload.jks>"),
+  play: share("play", "sandbox account import play --from <service-account.json>"),
+  expo: share("expo", "sandbox account login expo"),
+  appstore: share("appstore", "sandbox account import appstore --from <AuthKey.p8>")
+}).describe(
+  "Service sign-ins for sandboxes (game stores, engines, app signing). Manage them in Accounts: sandbox account status."
+);
+
+// src/core/schema/pc-installs.ts
+var pick2 = (item, what, example) => external_exports.union([external_exports.boolean(), external_exports.array(item)]).describe(
+  what + " of this PC, read-only in the sandbox under C:\\PcInstalls: true = all of them, false = none, or a list (e.g. " + example + "). The agent can read their files."
+);
+var PcInstallsSchema = external_exports.strictObject({
+  steamGames: pick2(
+    external_exports.number().int().positive(),
+    "Steam games (true maps each library; a list of app IDs maps only those games)",
+    "[480, 730]"
+  ),
+  epicGames: pick2(
+    external_exports.string().regex(/^[A-Za-z0-9._-]{1,100}$/),
+    "Epic Games Launcher games (by their app name)",
+    '["Fortnite"]'
+  ),
+  unrealEngines: pick2(
+    external_exports.string().regex(/^(UE_)?\d+\.\d+$/),
+    "Unreal Engine versions installed with the Epic Games Launcher",
+    '["5.4"]'
+  ),
+  unityEditors: pick2(
+    external_exports.string().regex(/^\d+\.\d+\.\d+[abfp]\d+$/),
+    "Unity editors installed with Unity Hub",
+    '["6000.0.32f1"]'
+  )
+}).describe(
+  "Games, engines and editors installed on this PC, mapped read-only into sandboxes (no copy, no room on the sandbox's disk)."
+);
+
 // src/core/schema/config.ts
 var RESERVED_ENV_PREFIX = /^(AGENT_|GIT_|GH_|GITHUB_|NODE_|NPM_CONFIG_(USERCONFIG|GLOBALCONFIG|PREFIX|SCRIPT_SHELL)|SSL_|CLAUDE|ANTHROPIC_|OPENAI_|CODEX_|GEMINI_|GOOGLE_|COPILOT_|AWS_|AZURE_)/i;
 var RESERVED_ENV_SUFFIX = /(_PROXY|_BASE_URL|_ENDPOINT|_CA_BUNDLE|_CA_CERTS)$/i;
@@ -26829,6 +27131,8 @@ var ConfigSchema = external_exports.strictObject({
   network: NetworkSchema,
   vpn: VpnSchema,
   github: GithubSchema,
+  accounts: AccountsSchema,
+  pcInstalls: PcInstallsSchema,
   provisioning: ProvisioningSchema,
   downloads: DownloadsSchema,
   toolchains: ToolchainsSchema,
@@ -26881,6 +27185,8 @@ var LocalOverridesSchema = external_exports.strictObject({
   network: NetworkSchema.pick({ blockPrivateRanges: true, blockHosts: true }).partial(),
   // A project may turn the kill switch on, never off, and never choose a VPN, a server, a file or a login.
   vpn: VpnSchema.pick({ killSwitch: true }).partial(),
+  // A project may only turn a sign-in off (policy: OFF_IS_SAFER); pcInstalls is never here (folders of this PC).
+  accounts: external_exports.strictObject(import_lodash.default.mapValues(AccountsSchema.shape, (shape) => shape.partial())).partial(),
   provisioning: ProvisioningSchema.pick({ copyFromHost: true, fallbackToInstall: true, refresh: true }).extend({ git: GitSchema.partial(), terminal: toggle("Windows Terminal as the sandbox window.").partial() }).partial(),
   downloads: DownloadsSchema.partial(),
   // Every toolchain setting, each one optional (a project usually only switches languages on or pins a version).
@@ -27457,7 +27763,7 @@ var Downloader = class {
    */
   async file(url2, destination, expected = null) {
     const sums = typeof expected === "string" || expected === null ? { sha256: expected } : expected;
-    if (this.requireChecksum && !sums.sha256?.trim() && !sums.sha512?.trim()) {
+    if (this.requireChecksum && !sums.sha256?.trim() && !sums.sha512?.trim() && !sums.sha1?.trim() && !sums.verify) {
       throw new Error(
         "Refusing to download " + path8.basename(destination) + " (" + url2 + "): no checksum is published for it, and downloads.requireChecksum is on. Turn that setting off to allow downloads that cannot be verified."
       );
@@ -27465,7 +27771,7 @@ var Downloader = class {
     const response = await fetchRetry(url2, {}, 3, 20 * 60 * 1e3);
     if (!response.body) throw new Error("Empty response for " + url2);
     fs7.mkdirSync(path8.dirname(destination), { recursive: true });
-    const checks = ["sha256", "sha512"].flatMap((kind) => {
+    const checks = ["sha256", "sha512", "sha1"].flatMap((kind) => {
       const want = sums[kind]?.trim().toLowerCase();
       return want ? [{ want, hash: crypto2.createHash(kind) }] : [];
     });
@@ -27496,6 +27802,7 @@ var Downloader = class {
     try {
       await pipeline(Readable.fromWeb(response.body), tap, fs7.createWriteStream(partial2));
       if (checks.some((c) => c.hash.digest("hex") !== c.want)) throw new Error("Checksum mismatch for " + url2);
+      if (sums.verify) await sums.verify(partial2);
       fs7.rmSync(destination, { force: true });
       fs7.renameSync(partial2, destination);
     } finally {
@@ -27510,7 +27817,12 @@ var Downloader = class {
     const work = stagingFolder(destination);
     try {
       const archive = path8.join(work, options.fileName ?? path8.basename(new URL(url2).pathname));
-      await this.file(url2, archive, { sha256: options.sha256, sha512: options.sha512 });
+      await this.file(url2, archive, {
+        sha256: options.sha256,
+        sha512: options.sha512,
+        sha1: options.sha1,
+        ...options.verify ? { verify: options.verify } : {}
+      });
       const extracted = path8.join(work, "x");
       await extractArchive(archive, extracted, options.members);
       let root = extracted;