windows-development-sandbox 1.18.4 → 1.20.0

package/dist/runtime/daemon.js

@@ -1363,11 +1363,11 @@ var require_lodash = __commonJS({
             return isFunction(object2[key2]);
           });
         }
-        function baseGet(object2, path84) {
-          path84 = castPath(path84, object2);
-          var index = 0, length = path84.length;
+        function baseGet(object2, path87) {
+          path87 = castPath(path87, object2);
+          var index = 0, length = path87.length;
           while (object2 != null && index < length) {
-            object2 = object2[toKey(path84[index++])];
+            object2 = object2[toKey(path87[index++])];
           }
           return index && index == length ? object2 : undefined2;
         }
@@ -1431,10 +1431,10 @@ var require_lodash = __commonJS({
           });
           return accumulator;
         }
-        function baseInvoke(object2, path84, args) {
-          path84 = castPath(path84, object2);
-          object2 = parent(object2, path84);
-          var func = object2 == null ? object2 : object2[toKey(last(path84))];
+        function baseInvoke(object2, path87, args) {
+          path87 = castPath(path87, object2);
+          object2 = parent(object2, path87);
+          var func = object2 == null ? object2 : object2[toKey(last(path87))];
           return func == null ? undefined2 : apply(func, object2, args);
         }
         function baseIsArguments(value) {
@@ -1590,13 +1590,13 @@ var require_lodash = __commonJS({
             return object2 === source || baseIsMatch(object2, source, matchData);
           };
         }
-        function baseMatchesProperty(path84, srcValue) {
-          if (isKey(path84) && isStrictComparable(srcValue)) {
-            return matchesStrictComparable(toKey(path84), srcValue);
+        function baseMatchesProperty(path87, srcValue) {
+          if (isKey(path87) && isStrictComparable(srcValue)) {
+            return matchesStrictComparable(toKey(path87), srcValue);
           }
           return function(object2) {
-            var objValue = get(object2, path84);
-            return objValue === undefined2 && objValue === srcValue ? hasIn(object2, path84) : baseIsEqual(srcValue, objValue, COMPARE_PARTIAL_FLAG | COMPARE_UNORDERED_FLAG);
+            var objValue = get(object2, path87);
+            return objValue === undefined2 && objValue === srcValue ? hasIn(object2, path87) : baseIsEqual(srcValue, objValue, COMPARE_PARTIAL_FLAG | COMPARE_UNORDERED_FLAG);
           };
         }
         function baseMerge(object2, source, srcIndex, customizer, stack) {
@@ -1693,23 +1693,23 @@ var require_lodash = __commonJS({
           });
         }
         function basePick(object2, paths) {
-          return basePickBy(object2, paths, function(value, path84) {
-            return hasIn(object2, path84);
+          return basePickBy(object2, paths, function(value, path87) {
+            return hasIn(object2, path87);
           });
         }
         function basePickBy(object2, paths, predicate) {
           var index = -1, length = paths.length, result2 = {};
           while (++index < length) {
-            var path84 = paths[index], value = baseGet(object2, path84);
-            if (predicate(value, path84)) {
-              baseSet(result2, castPath(path84, object2), value);
+            var path87 = paths[index], value = baseGet(object2, path87);
+            if (predicate(value, path87)) {
+              baseSet(result2, castPath(path87, object2), value);
             }
           }
           return result2;
         }
-        function basePropertyDeep(path84) {
+        function basePropertyDeep(path87) {
           return function(object2) {
-            return baseGet(object2, path84);
+            return baseGet(object2, path87);
           };
         }
         function basePullAll(array2, values2, iteratee2, comparator) {
@@ -1783,14 +1783,14 @@ var require_lodash = __commonJS({
           var array2 = values(collection);
           return shuffleSelf(array2, baseClamp(n, 0, array2.length));
         }
-        function baseSet(object2, path84, value, customizer) {
+        function baseSet(object2, path87, value, customizer) {
           if (!isObject2(object2)) {
             return object2;
           }
-          path84 = castPath(path84, object2);
-          var index = -1, length = path84.length, lastIndex = length - 1, nested = object2;
+          path87 = castPath(path87, object2);
+          var index = -1, length = path87.length, lastIndex = length - 1, nested = object2;
           while (nested != null && ++index < length) {
-            var key2 = toKey(path84[index]), newValue = value;
+            var key2 = toKey(path87[index]), newValue = value;
             if (key2 === "__proto__" || key2 === "constructor" || key2 === "prototype") {
               return object2;
             }
@@ -1798,7 +1798,7 @@ var require_lodash = __commonJS({
               var objValue = nested[key2];
               newValue = customizer ? customizer(objValue, key2, nested) : undefined2;
               if (newValue === undefined2) {
-                newValue = isObject2(objValue) ? objValue : isIndex(path84[index + 1]) ? [] : {};
+                newValue = isObject2(objValue) ? objValue : isIndex(path87[index + 1]) ? [] : {};
               }
             }
             assignValue(nested, key2, newValue);
@@ -1964,14 +1964,14 @@ var require_lodash = __commonJS({
             }
           return result2;
         }
-        function baseUnset(object2, path84) {
-          path84 = castPath(path84, object2);
-          var index = -1, length = path84.length;
+        function baseUnset(object2, path87) {
+          path87 = castPath(path87, object2);
+          var index = -1, length = path87.length;
           if (!length) {
             return true;
           }
           while (++index < length) {
-            var key2 = toKey(path84[index]);
+            var key2 = toKey(path87[index]);
             if (key2 === "__proto__" && !hasOwnProperty.call(object2, "__proto__")) {
               return false;
             }
@@ -1979,11 +1979,11 @@ var require_lodash = __commonJS({
               return false;
             }
           }
-          var obj = parent(object2, path84);
-          return obj == null || delete obj[toKey(last(path84))];
+          var obj = parent(object2, path87);
+          return obj == null || delete obj[toKey(last(path87))];
         }
-        function baseUpdate(object2, path84, updater, customizer) {
-          return baseSet(object2, path84, updater(baseGet(object2, path84)), customizer);
+        function baseUpdate(object2, path87, updater, customizer) {
+          return baseSet(object2, path87, updater(baseGet(object2, path87)), customizer);
         }
         function baseWhile(array2, predicate, isDrop, fromRight) {
           var length = array2.length, index = fromRight ? length : -1;
@@ -2866,11 +2866,11 @@ var require_lodash = __commonJS({
           var match = source.match(reWrapDetails);
           return match ? match[1].split(reSplitDetails) : [];
         }
-        function hasPath(object2, path84, hasFunc) {
-          path84 = castPath(path84, object2);
-          var index = -1, length = path84.length, result2 = false;
+        function hasPath(object2, path87, hasFunc) {
+          path87 = castPath(path87, object2);
+          var index = -1, length = path87.length, result2 = false;
           while (++index < length) {
-            var key2 = toKey(path84[index]);
+            var key2 = toKey(path87[index]);
             if (!(result2 = object2 != null && hasFunc(object2, key2))) {
               break;
             }
@@ -3072,8 +3072,8 @@ var require_lodash = __commonJS({
             return apply(func, this, otherArgs);
           };
         }
-        function parent(object2, path84) {
-          return path84.length < 2 ? object2 : baseGet(object2, baseSlice(path84, 0, -1));
+        function parent(object2, path87) {
+          return path87.length < 2 ? object2 : baseGet(object2, baseSlice(path87, 0, -1));
         }
         function reorder(array2, indexes) {
           var arrLength = array2.length, length = nativeMin(indexes.length, arrLength), oldArray = copyArray(array2);
@@ -3708,10 +3708,10 @@ var require_lodash = __commonJS({
           }
           return isString(collection) ? fromIndex <= length && collection.indexOf(value, fromIndex) > -1 : !!length && baseIndexOf(collection, value, fromIndex) > -1;
         }
-        var invokeMap = baseRest(function(collection, path84, args) {
-          var index = -1, isFunc = typeof path84 == "function", result2 = isArrayLike(collection) ? Array2(collection.length) : [];
+        var invokeMap = baseRest(function(collection, path87, args) {
+          var index = -1, isFunc = typeof path87 == "function", result2 = isArrayLike(collection) ? Array2(collection.length) : [];
           baseEach(collection, function(value) {
-            result2[++index] = isFunc ? apply(path84, value, args) : baseInvoke(value, path84, args);
+            result2[++index] = isFunc ? apply(path87, value, args) : baseInvoke(value, path87, args);
           });
           return result2;
         });
@@ -4363,15 +4363,15 @@ var require_lodash = __commonJS({
         function functionsIn(object2) {
           return object2 == null ? [] : baseFunctions(object2, keysIn(object2));
         }
-        function get(object2, path84, defaultValue) {
-          var result2 = object2 == null ? undefined2 : baseGet(object2, path84);
+        function get(object2, path87, defaultValue) {
+          var result2 = object2 == null ? undefined2 : baseGet(object2, path87);
           return result2 === undefined2 ? defaultValue : result2;
         }
-        function has(object2, path84) {
-          return object2 != null && hasPath(object2, path84, baseHas);
+        function has(object2, path87) {
+          return object2 != null && hasPath(object2, path87, baseHas);
         }
-        function hasIn(object2, path84) {
-          return object2 != null && hasPath(object2, path84, baseHasIn);
+        function hasIn(object2, path87) {
+          return object2 != null && hasPath(object2, path87, baseHasIn);
         }
         var invert = createInverter(function(result2, value, key2) {
           if (value != null && typeof value.toString != "function") {
@@ -4424,10 +4424,10 @@ var require_lodash = __commonJS({
             return result2;
           }
           var isDeep = false;
-          paths = arrayMap(paths, function(path84) {
-            path84 = castPath(path84, object2);
-            isDeep || (isDeep = path84.length > 1);
-            return path84;
+          paths = arrayMap(paths, function(path87) {
+            path87 = castPath(path87, object2);
+            isDeep || (isDeep = path87.length > 1);
+            return path87;
           });
           copyObject(object2, getAllKeysIn(object2), result2);
           if (isDeep) {
@@ -4453,19 +4453,19 @@ var require_lodash = __commonJS({
             return [prop];
           });
           predicate = getIteratee(predicate);
-          return basePickBy(object2, props, function(value, path84) {
-            return predicate(value, path84[0]);
+          return basePickBy(object2, props, function(value, path87) {
+            return predicate(value, path87[0]);
           });
         }
-        function result(object2, path84, defaultValue) {
-          path84 = castPath(path84, object2);
-          var index = -1, length = path84.length;
+        function result(object2, path87, defaultValue) {
+          path87 = castPath(path87, object2);
+          var index = -1, length = path87.length;
           if (!length) {
             length = 1;
             object2 = undefined2;
           }
           while (++index < length) {
-            var value = object2 == null ? undefined2 : object2[toKey(path84[index])];
+            var value = object2 == null ? undefined2 : object2[toKey(path87[index])];
             if (value === undefined2) {
               index = length;
               value = defaultValue;
@@ -4474,12 +4474,12 @@ var require_lodash = __commonJS({
           }
           return object2;
         }
-        function set2(object2, path84, value) {
-          return object2 == null ? object2 : baseSet(object2, path84, value);
+        function set2(object2, path87, value) {
+          return object2 == null ? object2 : baseSet(object2, path87, value);
         }
-        function setWith(object2, path84, value, customizer) {
+        function setWith(object2, path87, value, customizer) {
           customizer = typeof customizer == "function" ? customizer : undefined2;
-          return object2 == null ? object2 : baseSet(object2, path84, value, customizer);
+          return object2 == null ? object2 : baseSet(object2, path87, value, customizer);
         }
         var toPairs = createToPairs(keys);
         var toPairsIn = createToPairs(keysIn);
@@ -4501,15 +4501,15 @@ var require_lodash = __commonJS({
           });
           return accumulator;
         }
-        function unset(object2, path84) {
-          return object2 == null ? true : baseUnset(object2, path84);
+        function unset(object2, path87) {
+          return object2 == null ? true : baseUnset(object2, path87);
         }
-        function update(object2, path84, updater) {
-          return object2 == null ? object2 : baseUpdate(object2, path84, castFunction(updater));
+        function update(object2, path87, updater) {
+          return object2 == null ? object2 : baseUpdate(object2, path87, castFunction(updater));
         }
-        function updateWith(object2, path84, updater, customizer) {
+        function updateWith(object2, path87, updater, customizer) {
           customizer = typeof customizer == "function" ? customizer : undefined2;
-          return object2 == null ? object2 : baseUpdate(object2, path84, castFunction(updater), customizer);
+          return object2 == null ? object2 : baseUpdate(object2, path87, castFunction(updater), customizer);
         }
         function values(object2) {
           return object2 == null ? [] : baseValues(object2, keys(object2));
@@ -4895,17 +4895,17 @@ var require_lodash = __commonJS({
         function matches(source) {
           return baseMatches(baseClone(source, CLONE_DEEP_FLAG));
         }
-        function matchesProperty(path84, srcValue) {
-          return baseMatchesProperty(path84, baseClone(srcValue, CLONE_DEEP_FLAG));
+        function matchesProperty(path87, srcValue) {
+          return baseMatchesProperty(path87, baseClone(srcValue, CLONE_DEEP_FLAG));
         }
-        var method = baseRest(function(path84, args) {
+        var method = baseRest(function(path87, args) {
           return function(object2) {
-            return baseInvoke(object2, path84, args);
+            return baseInvoke(object2, path87, args);
           };
         });
         var methodOf = baseRest(function(object2, args) {
-          return function(path84) {
-            return baseInvoke(object2, path84, args);
+          return function(path87) {
+            return baseInvoke(object2, path87, args);
           };
         });
         function mixin(object2, source, options) {
@@ -4952,12 +4952,12 @@ var require_lodash = __commonJS({
         var over = createOver(arrayMap);
         var overEvery = createOver(arrayEvery);
         var overSome = createOver(arraySome);
-        function property(path84) {
-          return isKey(path84) ? baseProperty(toKey(path84)) : basePropertyDeep(path84);
+        function property(path87) {
+          return isKey(path87) ? baseProperty(toKey(path87)) : basePropertyDeep(path87);
         }
         function propertyOf(object2) {
-          return function(path84) {
-            return object2 == null ? undefined2 : baseGet(object2, path84);
+          return function(path87) {
+            return object2 == null ? undefined2 : baseGet(object2, path87);
           };
         }
         var range = createRange();
@@ -5410,12 +5410,12 @@ var require_lodash = __commonJS({
         LazyWrapper.prototype.findLast = function(predicate) {
           return this.reverse().find(predicate);
         };
-        LazyWrapper.prototype.invokeMap = baseRest(function(path84, args) {
-          if (typeof path84 == "function") {
+        LazyWrapper.prototype.invokeMap = baseRest(function(path87, args) {
+          if (typeof path87 == "function") {
             return new LazyWrapper(this);
           }
           return this.map(function(value) {
-            return baseInvoke(value, path84, args);
+            return baseInvoke(value, path87, args);
           });
         });
         LazyWrapper.prototype.reject = function(predicate) {
@@ -5540,15 +5540,15 @@ function relayPort(index) {
 }
 
 // src/guest/runtime/log.ts
-import fs7 from "node:fs";
-import path9 from "node:path";
+import fs8 from "node:fs";
+import path10 from "node:path";
 
 // src/guest/runtime/paths.ts
-import path8 from "node:path";
+import path9 from "node:path";
 
 // src/shared/channel/run-dir.ts
-import fs6 from "node:fs";
-import path7 from "node:path";
+import fs7 from "node:fs";
+import path8 from "node:path";
 
 // node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -6366,10 +6366,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path84) {
-  if (!path84)
+function getElementAtPath(obj, path87) {
+  if (!path87)
     return obj;
-  return path84.reduce((acc, key2) => acc?.[key2], obj);
+  return path87.reduce((acc, key2) => acc?.[key2], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -6709,11 +6709,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path84, issues) {
+function prefixIssues(path87, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path84);
+    iss.path.unshift(path87);
     return iss;
   });
 }
@@ -7163,16 +7163,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path84 = []) => {
+  const processError = (error63, path87 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path84, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path87, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path84, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path87, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path84, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path87, ...issue2.path]);
       } else {
-        const fullpath = [...path84, ...issue2.path];
+        const fullpath = [...path87, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -7211,17 +7211,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path84 = []) => {
+  const processError = (error63, path87 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path84, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path87, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path84, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path87, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path84, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path87, ...issue2.path]);
       } else {
-        const fullpath = [...path84, ...issue2.path];
+        const fullpath = [...path87, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -7260,8 +7260,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path84 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path84) {
+  const path87 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path87) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -24363,13 +24363,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path84 = ref.slice(1).split("/").filter(Boolean);
-  if (path84.length === 0) {
+  const path87 = ref.slice(1).split("/").filter(Boolean);
+  if (path87.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path84[0] === defsKey) {
-    const key2 = path84[1] === void 0 ? void 0 : decodeJSONPointerSegment(path84[1]);
+  if (path87[0] === defsKey) {
+    const key2 = path87[1] === void 0 ? void 0 : decodeJSONPointerSegment(path87[1]);
     if (!key2 || !ctx.defs[key2]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -25369,6 +25369,22 @@ var DatabasesSchema = external_exports.strictObject({
   })
 });
 
+// src/core/schema/codex.ts
+var CodexSchema = external_exports.strictObject({
+  sandboxMode: external_exports.enum(["danger-full-access", "workspace-write", "read-only"]).describe(
+    "Codex's own sandbox. Inside Windows Sandbox Codex's own sandbox only slows it down (it re-grants file permissions over your profile at every boot), so the default is danger-full-access: Windows Sandbox is the sandbox."
+  ),
+  approvalPolicy: external_exports.enum(["never", "on-request", "on-failure", "untrusted"]).describe('When Codex asks before it runs a command. "never" with danger-full-access starts it with no questions.'),
+  model: external_exports.string().max(100).regex(/^[A-Za-z0-9._:/-]*$/, "letters, digits and . _ : / - only").describe("The model Codex uses. Empty = Codex's own default."),
+  reasoningEffort: external_exports.enum(["default", "minimal", "low", "medium", "high", "xhigh"]).describe(`How hard Codex thinks. "default" = Codex's own default.`),
+  windowsSandbox: external_exports.enum(["off", "unelevated", "elevated"]).describe(
+    `Codex's Windows sandbox mode in its config.toml. "off" removes the setting so Codex does not set up its sandbox users and firewall rules at every boot.`
+  ),
+  mcpLoginsInFile: external_exports.boolean().describe(
+    `Keep the sign-ins of Codex's MCP servers in a file in the saved Codex folder (mcp_oauth_credentials_store = "file"), so they survive between sandboxes. A value you set in config.toml is kept.`
+  )
+});
+
 // src/core/schema/harness.ts
 var SubfolderSchema = external_exports.string().regex(/^(?!.*(^|[\\/])\.\.([\\/]|$))[A-Za-z0-9._ -]+([\\/][A-Za-z0-9._ -]+)*$/, "a plain relative folder");
 var HarnessHomeSchema = external_exports.strictObject({
@@ -25681,6 +25697,9 @@ var ToolchainsSchema = external_exports.strictObject({
     keepInstallFiles: external_exports.boolean().describe(
       "Keep an offline copy of the Visual Studio install files in tools\\visualstudio (~10 GB, made once), so later boots install without downloading them again. Skipped while that disk has too little room."
     ),
+    visualStudio: external_exports.enum(["full", "autosdk"]).describe(
+      `"full": install Visual Studio Community (the engine finds it through the Setup API; ~10 GB, redone every boot). "autosdk" (experimental): skip Visual Studio and build an Unreal AutoSDK tree from the portable MSVC in tools\\unreal\\autosdk (kept between sandboxes); UnrealBuildTool finds MSVC through AutoSDK, but the editor's Visual Studio integration is not available. Needs toolchains.msvc (turned on for you).`
+    ),
     persistEngines: external_exports.boolean().describe(
       "Engines the Epic Games Launcher installs go to tools\\unreal\\engines (kept between sandboxes, 40-60 GB each) and are registered with the launcher again every boot. Off: they go on the sandbox disk and are lost when it closes. Engines installed on this PC can be mapped instead (pcInstalls.unrealEngines)."
     ),
@@ -27203,6 +27222,7 @@ var ConfigSchema = external_exports.strictObject({
   apps: AppsSchema,
   claudeProfile: ClaudeProfileSchema,
   harnesses: external_exports.record(NameSchema, HarnessSchema).describe("Agents that can run in the sandbox."),
+  codex: CodexSchema,
   hooks: external_exports.strictObject({ failFast: external_exports.boolean().describe("Stop when a hook script fails.") }),
   projects: ProjectsSchema.describe(
     "Several projects in one sandbox: folders of projects mapped at every start, and adding folders while it runs."
@@ -27446,6 +27466,8 @@ var ProjectStatusSchema = external_exports.object({
 var VpnStatusSchema = external_exports.object({
   state: external_exports.enum(["off", "starting", "up", "failed"]),
   message: Text(2e3),
+  /** Why it failed, when it did: `auth` (login refused), `unreachable`, `driver`, `timeout` or `other`. */
+  code: external_exports.enum(["auth", "unreachable", "driver", "timeout", "other"]).optional(),
   killSwitch: external_exports.boolean(),
   /** A direct connection was tried after the kill switch was applied: false = it still got out. */
   killSwitchHeld: external_exports.boolean().optional(),
@@ -27692,6 +27714,20 @@ function encodeText(text, encoding) {
   return Buffer.from(text, "utf8");
 }
 
+// src/shared/io/disk.ts
+import fs6 from "node:fs";
+import path7 from "node:path";
+function freeBytesAt(dir, statfs = fs6.statfsSync) {
+  let at = path7.resolve(dir);
+  while (!fs6.existsSync(at) && path7.dirname(at) !== at) at = path7.dirname(at);
+  try {
+    const s = statfs(at);
+    return s.bavail * s.bsize;
+  } catch {
+    return null;
+  }
+}
+
 // src/shared/channel/run-dir.ts
 function safeId(id) {
   return IdSchema.parse(id);
@@ -27700,14 +27736,14 @@ function now() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 var scan = (schema, dir) => {
-  if (!fs6.existsSync(dir)) return { valid: [], invalid: [] };
+  if (!fs7.existsSync(dir)) return { valid: [], invalid: [] };
   const valid = [];
   const invalid = [];
-  for (const name of fs6.readdirSync(dir)) {
+  for (const name of fs7.readdirSync(dir)) {
     if (name.endsWith(".tmp")) continue;
-    const message = /^[A-Za-z0-9_-]{1,64}\.json$/.test(name) ? readValid(schema, path7.join(dir, name)) : null;
+    const message = /^[A-Za-z0-9_-]{1,64}\.json$/.test(name) ? readValid(schema, path8.join(dir, name)) : null;
     if (message) valid.push(message);
-    else invalid.push(path7.join(dir, name));
+    else invalid.push(path8.join(dir, name));
   }
   return { valid, invalid };
 };
@@ -27738,45 +27774,45 @@ var RunDir = class {
   liveDir;
   liveRepliesDir;
   constructor(dataDir2) {
-    this.root = path7.join(dataDir2, "run");
-    this.sandboxFile = path7.join(this.root, "sandbox.json");
-    this.vpnFile = path7.join(this.root, "vpn.json");
-    this.pressureFile = path7.join(this.root, "pressure.json");
-    this.heartbeatFile = path7.join(this.root, "heartbeat.json");
-    this.budgetFile = path7.join(this.root, "budget.json");
-    this.requestsDir = path7.join(this.root, "requests");
-    this.responsesDir = path7.join(this.root, "responses");
-    this.sessionsDir = path7.join(this.root, "sessions");
-    this.projectsDir = path7.join(this.root, "projects");
-    this.auditDir = path7.join(this.root, "audit");
-    this.treesDir = path7.join(this.root, "trees");
-    this.secretsDir = path7.join(dataDir2, "secrets");
-    this.liveDir = path7.join(this.root, "live");
-    this.liveRepliesDir = path7.join(this.root, "live-replies");
+    this.root = path8.join(dataDir2, "run");
+    this.sandboxFile = path8.join(this.root, "sandbox.json");
+    this.vpnFile = path8.join(this.root, "vpn.json");
+    this.pressureFile = path8.join(this.root, "pressure.json");
+    this.heartbeatFile = path8.join(this.root, "heartbeat.json");
+    this.budgetFile = path8.join(this.root, "budget.json");
+    this.requestsDir = path8.join(this.root, "requests");
+    this.responsesDir = path8.join(this.root, "responses");
+    this.sessionsDir = path8.join(this.root, "sessions");
+    this.projectsDir = path8.join(this.root, "projects");
+    this.auditDir = path8.join(this.root, "audit");
+    this.treesDir = path8.join(this.root, "trees");
+    this.secretsDir = path8.join(dataDir2, "secrets");
+    this.liveDir = path8.join(this.root, "live");
+    this.liveRepliesDir = path8.join(this.root, "live-replies");
   }
   liveFile(id) {
-    return path7.join(this.liveDir, safeId(id) + ".json");
+    return path8.join(this.liveDir, safeId(id) + ".json");
   }
   liveReplyFile(id) {
-    return path7.join(this.liveRepliesDir, safeId(id) + ".json");
+    return path8.join(this.liveRepliesDir, safeId(id) + ".json");
   }
   requestFile(id) {
-    return path7.join(this.requestsDir, safeId(id) + ".json");
+    return path8.join(this.requestsDir, safeId(id) + ".json");
   }
   responseFile(id) {
-    return path7.join(this.responsesDir, safeId(id) + ".json");
+    return path8.join(this.responsesDir, safeId(id) + ".json");
   }
   sessionFile(id) {
-    return path7.join(this.sessionsDir, safeId(id) + ".json");
+    return path8.join(this.sessionsDir, safeId(id) + ".json");
   }
   treeFile(id) {
-    return path7.join(this.treesDir, safeId(id) + ".json");
+    return path8.join(this.treesDir, safeId(id) + ".json");
   }
   projectFile(name) {
-    return path7.join(this.projectsDir, safeId(name) + ".json");
+    return path8.join(this.projectsDir, safeId(name) + ".json");
   }
   secretFile(id) {
-    return path7.join(this.secretsDir, safeId(id) + ".json");
+    return path8.join(this.secretsDir, safeId(id) + ".json");
   }
   readSandboxStatus() {
     return readValid(SandboxStatusSchema, this.sandboxFile);
@@ -27818,19 +27854,19 @@ var launchDir = process.env.AGENT_LAUNCH_DIR ?? "C:\\AgentLaunch";
 var dataDir = process.env.AGENT_DATA_DIR ?? "C:\\AgentData";
 var hostToolsDir = process.env.AGENT_HOST_TOOLS_DIR ?? "C:\\HostTools";
 var localDir = process.env.AGENT_LOCAL_DIR ?? "C:\\nvm";
-var toolsDir = path8.join(dataDir, "tools");
-var logsDir = path8.join(dataDir, "logs");
+var toolsDir = path9.join(dataDir, "tools");
+var logsDir = path9.join(dataDir, "logs");
 var run = new RunDir(dataDir);
 
 // src/guest/runtime/log.ts
-fs7.mkdirSync(logsDir, { recursive: true });
-var logFile = path9.join(
+fs8.mkdirSync(logsDir, { recursive: true });
+var logFile = path10.join(
   logsDir,
   (process.env.AGENT_LOG_PREFIX ?? "guest") + "-" + (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-") + ".log"
 );
 var append = (line) => {
   try {
-    fs7.appendFileSync(logFile, line + "\n");
+    fs8.appendFileSync(logFile, line + "\n");
   } catch {
   }
 };
@@ -27844,8 +27880,8 @@ function warn(message) {
 }
 
 // src/guest/runtime/session.ts
-import fs11 from "node:fs";
-import path14 from "node:path";
+import fs12 from "node:fs";
+import path15 from "node:path";
 
 // src/shared/download/http.ts
 var USER_AGENT = "windows-development-sandbox";
@@ -27876,15 +27912,15 @@ async function fetchText(url2) {
 }
 
 // src/shared/download/archive.ts
-import fs9 from "node:fs";
-import path12 from "node:path";
+import fs10 from "node:fs";
+import path13 from "node:path";
 import crypto from "node:crypto";
 
 // src/shared/system.ts
-import path10 from "node:path";
+import path11 from "node:path";
 var systemRoot = () => process.env.SystemRoot ?? process.env.WINDIR ?? "C:\\Windows";
 function system32(exe) {
-  return path10.join(systemRoot(), "System32", exe);
+  return path11.join(systemRoot(), "System32", exe);
 }
 var SYSTEM = {
   cmd: () => system32("cmd.exe"),
@@ -27905,17 +27941,17 @@ var SYSTEM = {
   msiexec: () => system32("msiexec.exe"),
   sc: () => system32("sc.exe"),
   /** The .NET Framework C# compiler that ships with Windows (C# 5). */
-  csc: () => path10.join(systemRoot(), "Microsoft.NET", "Framework64", "v4.0.30319", "csc.exe")
+  csc: () => path11.join(systemRoot(), "Microsoft.NET", "Framework64", "v4.0.30319", "csc.exe")
 };
 
 // src/shared/scripts.ts
-import fs8 from "node:fs";
-import path11 from "node:path";
+import fs9 from "node:fs";
+import path12 from "node:path";
 import { fileURLToPath } from "node:url";
-var HERE = path11.dirname(fileURLToPath(import.meta.url));
+var HERE = path12.dirname(fileURLToPath(import.meta.url));
 function sandboxScriptsDir() {
-  const candidates = [path11.resolve(HERE, "..", "sandbox"), path11.resolve(HERE, "..", "..", "sandbox")];
-  return candidates.find((dir) => fs8.existsSync(path11.join(dir, "boot", "bootstrap.ps1"))) ?? candidates[candidates.length - 1];
+  const candidates = [path12.resolve(HERE, "..", "sandbox"), path12.resolve(HERE, "..", "..", "sandbox")];
+  return candidates.find((dir) => fs9.existsSync(path12.join(dir, "boot", "bootstrap.ps1"))) ?? candidates[candidates.length - 1];
 }
 function scriptArgs(name, args = []) {
   return [
@@ -27925,7 +27961,7 @@ function scriptArgs(name, args = []) {
     "-ExecutionPolicy",
     "Bypass",
     "-File",
-    path11.join(sandboxScriptsDir(), "scripts", name),
+    path12.join(sandboxScriptsDir(), "scripts", name),
     ...args
   ];
 }
@@ -27945,16 +27981,16 @@ function stagingFolder(destination) {
   return destination + ".staging-" + crypto.randomBytes(3).toString("hex");
 }
 function moveIntoPlace(work, destination) {
-  safeRemove(destination, path12.dirname(destination));
-  fs9.mkdirSync(path12.dirname(destination), { recursive: true });
-  fs9.renameSync(work, destination);
+  safeRemove(destination, path13.dirname(destination));
+  fs10.mkdirSync(path13.dirname(destination), { recursive: true });
+  fs10.renameSync(work, destination);
 }
 async function extractArchive(archive, destination, members2 = []) {
-  fs9.mkdirSync(destination, { recursive: true });
+  fs10.mkdirSync(destination, { recursive: true });
   let status = await spawnAsync(SYSTEM.tar(), ["-xf", archive, "-C", destination, ...members2]);
   if (status !== 0 && /\.(zip|nupkg)$/i.test(archive)) {
     const zip = archive.endsWith(".zip") ? archive : archive + ".zip";
-    if (zip !== archive) fs9.copyFileSync(archive, zip);
+    if (zip !== archive) fs10.copyFileSync(archive, zip);
     status = await spawnAsync(
       SYSTEM.powershell(),
       scriptArgs("expand-archive.ps1", ["-Archive", zip, "-Destination", destination])
@@ -27963,21 +27999,21 @@ async function extractArchive(archive, destination, members2 = []) {
   if (status !== 0) throw new Error("Could not extract " + archive);
 }
 function findFile(root, name, maxDepth = 4) {
-  if (maxDepth < 0 || !fs9.existsSync(root)) return null;
-  const entries2 = fs9.readdirSync(root, { withFileTypes: true });
+  if (maxDepth < 0 || !fs10.existsSync(root)) return null;
+  const entries2 = fs10.readdirSync(root, { withFileTypes: true });
   for (const entry of entries2)
-    if (entry.isFile() && entry.name.toLowerCase() === name.toLowerCase()) return path12.join(root, entry.name);
+    if (entry.isFile() && entry.name.toLowerCase() === name.toLowerCase()) return path13.join(root, entry.name);
   for (const entry of entries2)
     if (entry.isDirectory()) {
-      const found = findFile(path12.join(root, entry.name), name, maxDepth - 1);
+      const found = findFile(path13.join(root, entry.name), name, maxDepth - 1);
       if (found) return found;
     }
   return null;
 }
 
 // src/shared/download/downloader.ts
-import fs10 from "node:fs";
-import path13 from "node:path";
+import fs11 from "node:fs";
+import path14 from "node:path";
 import crypto2 from "node:crypto";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
@@ -27998,12 +28034,12 @@ var Downloader = class {
     const sums = typeof expected === "string" || expected === null ? { sha256: expected } : expected;
     if (this.requireChecksum && !sums.sha256?.trim() && !sums.sha512?.trim() && !sums.sha1?.trim() && !sums.verify) {
       throw new Error(
-        "Refusing to download " + path13.basename(destination) + " (" + url2 + "): no checksum is published for it, and downloads.requireChecksum is on. Turn that setting off to allow downloads that cannot be verified."
+        "Refusing to download " + path14.basename(destination) + " (" + url2 + "): no checksum is published for it, and downloads.requireChecksum is on. Turn that setting off to allow downloads that cannot be verified."
       );
     }
     const response = await fetchRetry(url2, {}, 3, 20 * 60 * 1e3);
     if (!response.body) throw new Error("Empty response for " + url2);
-    fs10.mkdirSync(path13.dirname(destination), { recursive: true });
+    fs11.mkdirSync(path14.dirname(destination), { recursive: true });
     const checks = ["sha256", "sha512", "sha1"].flatMap((kind) => {
       const want = sums[kind]?.trim().toLowerCase();
       return want ? [{ want, hash: crypto2.createHash(kind) }] : [];
@@ -28033,13 +28069,13 @@ var Downloader = class {
     });
     const partial2 = destination + ".part";
     try {
-      await pipeline(Readable.fromWeb(response.body), tap, fs10.createWriteStream(partial2));
+      await pipeline(Readable.fromWeb(response.body), tap, fs11.createWriteStream(partial2));
       if (checks.some((c) => c.hash.digest("hex") !== c.want)) throw new Error("Checksum mismatch for " + url2);
       if (sums.verify) await sums.verify(partial2);
-      fs10.rmSync(destination, { force: true });
-      fs10.renameSync(partial2, destination);
+      fs11.rmSync(destination, { force: true });
+      fs11.renameSync(partial2, destination);
     } finally {
-      fs10.rmSync(partial2, { force: true });
+      fs11.rmSync(partial2, { force: true });
     }
   }
   /**
@@ -28049,26 +28085,26 @@ var Downloader = class {
   async archive(url2, destination, options = {}) {
     const work = stagingFolder(destination);
     try {
-      const archive = path13.join(work, options.fileName ?? path13.basename(new URL(url2).pathname));
+      const archive = path14.join(work, options.fileName ?? path14.basename(new URL(url2).pathname));
       await this.file(url2, archive, {
         sha256: options.sha256,
         sha512: options.sha512,
         sha1: options.sha1,
         ...options.verify ? { verify: options.verify } : {}
       });
-      const extracted = path13.join(work, "x");
+      const extracted = path14.join(work, "x");
       await extractArchive(archive, extracted, options.members);
       let root = extracted;
       if (options.locate) {
         const found = findFile(extracted, options.locate);
         if (!found) throw new Error(options.locate + " not found in " + url2);
-        root = path13.dirname(found);
-        for (let i = 0; i < (options.up ?? 0) && path13.dirname(root).startsWith(extracted); i++)
-          root = path13.dirname(root);
+        root = path14.dirname(found);
+        for (let i = 0; i < (options.up ?? 0) && path14.dirname(root).startsWith(extracted); i++)
+          root = path14.dirname(root);
       }
       moveIntoPlace(root, destination);
     } finally {
-      safeRemove(work, path13.dirname(work));
+      safeRemove(work, path14.dirname(work));
     }
   }
 };
@@ -28146,12 +28182,12 @@ var githubAssetFromPage = async (repo, pattern, searchOlder) => {
 
 // src/guest/runtime/session.ts
 var session = JSON.parse(
-  fs11.readFileSync(path14.join(launchDir, "session.json"), "utf8").replace(/^\uFEFF/, "")
+  fs12.readFileSync(path15.join(launchDir, "session.json"), "utf8").replace(/^\uFEFF/, "")
 );
 downloader.requireChecksum = session.downloads?.requireChecksum === true;
 var workspace = process.env.AGENT_WORKSPACE ?? session.workspace;
-var stateDir = path14.join(dataDir, session.persistAgentState ? "state" : "state-session");
-var claudeDir = path14.join(stateDir, "claude");
+var stateDir = path15.join(dataDir, session.persistAgentState ? "state" : "state-session");
+var claudeDir = path15.join(stateDir, "claude");
 
 // src/core/util/errors.ts
 function errMsg(e) {
@@ -28177,12 +28213,12 @@ function startRelays() {
 }
 
 // src/guest/audit/process-audit.ts
-import fs13 from "node:fs";
-import path16 from "node:path";
+import fs14 from "node:fs";
+import path17 from "node:path";
 import { spawnSync } from "node:child_process";
 
 // src/guest/audit/parse.ts
-import path15 from "node:path";
+import path16 from "node:path";
 var NOISE = /* @__PURE__ */ new Set([
   "conhost.exe",
   "svchost.exe",
@@ -28243,7 +28279,7 @@ function parseProcessEvents(xml, attribution) {
     const pid = pidOf(field(event, "NewProcessId"));
     const ppid = pidOf(field(event, "ProcessId"));
     const session2 = attribution && pid && ppid ? attribution.attributor.attribute({ pid, ppid, t: Date.parse(t) || Date.now() }, attribution.roots) : void 0;
-    if (!program || NOISE.has(path15.win32.basename(program).toLowerCase())) continue;
+    if (!program || NOISE.has(path16.win32.basename(program).toLowerCase())) continue;
     lines.push(
       JSON.stringify({
         t,
@@ -28259,19 +28295,19 @@ function parseProcessEvents(xml, attribution) {
 }
 
 // src/guest/runtime/fs.ts
-import fs12 from "node:fs";
+import fs13 from "node:fs";
 function exists(p) {
-  return fs12.existsSync(p);
+  return fs13.existsSync(p);
 }
 function mkdirp(p) {
-  fs12.mkdirSync(p, { recursive: true });
+  fs13.mkdirSync(p, { recursive: true });
   return p;
 }
 
 // src/guest/audit/process-audit.ts
 var MAX_PER_PASS = 2e3;
 var auditOn = () => Boolean(session.auditProcesses) && isWin && !dryRun;
-var wevtutil = () => path16.join(process.env.WINDIR ?? "C:\\Windows", "System32", "wevtutil.exe");
+var wevtutil = () => path17.join(process.env.WINDIR ?? "C:\\Windows", "System32", "wevtutil.exe");
 var newestRecord = () => {
   const r = spawnSync(wevtutil(), ["qe", "Security", "/q:*[System[(EventID=4688)]]", "/f:xml", "/c:1", "/rd:true"], {
     encoding: "utf8",
@@ -28299,8 +28335,8 @@ function startProcessCollector(roots = () => []) {
       const { lines, last: newest } = parseProcessEvents(r.stdout ?? "", { attributor, roots: roots() });
       if (newest) last = newest;
       if (lines.length)
-        fs13.writeFileSync(
-          path16.join(mkdirp(run.auditDir), Date.now() + "-" + process.pid + ".jsonl"),
+        fs14.writeFileSync(
+          path17.join(mkdirp(run.auditDir), Date.now() + "-" + process.pid + ".jsonl"),
           lines.join("\n") + "\n"
         );
     } catch (e) {
@@ -28311,14 +28347,14 @@ function startProcessCollector(roots = () => []) {
 }
 
 // src/guest/daemon/state.ts
-import path17 from "node:path";
+import path18 from "node:path";
 var MAX_MESSAGE = 3500;
 function insidePrimary(cwd) {
-  const rel = path17.relative(workspace.toLowerCase(), path17.resolve(cwd).toLowerCase());
-  return rel === "" || !rel.startsWith("..") && !path17.isAbsolute(rel);
+  const rel = path18.relative(workspace.toLowerCase(), path18.resolve(cwd).toLowerCase());
+  return rel === "" || !rel.startsWith("..") && !path18.isAbsolute(rel);
 }
 function insideWorkspace(cwd) {
-  return insidePrimary(cwd) || session.projectsDir !== void 0 && insideProjects(path17.resolve(cwd), session.roots ?? [], session.projectsDir);
+  return insidePrimary(cwd) || session.projectsDir !== void 0 && insideProjects(path18.resolve(cwd), session.roots ?? [], session.projectsDir);
 }
 function tryWrite(file3, value) {
   try {
@@ -28342,7 +28378,7 @@ function safely(what, work) {
 }
 
 // src/guest/runtime/secrets.ts
-import fs14 from "node:fs";
+import fs15 from "node:fs";
 
 // src/shared/accounts/payloads.ts
 var KB = 1024;
@@ -28460,12 +28496,12 @@ function takeSecrets(id) {
   const file3 = run.secretFile(id);
   let text;
   try {
-    if (fs14.statSync(file3).size > MAX_BYTES) throw new Error("too big");
-    text = fs14.readFileSync(file3, "utf8").replace(/^\uFEFF/, "");
+    if (fs15.statSync(file3).size > MAX_BYTES) throw new Error("too big");
+    text = fs15.readFileSync(file3, "utf8").replace(/^\uFEFF/, "");
   } catch {
     return {};
   } finally {
-    fs14.rmSync(file3, { force: true });
+    fs15.rmSync(file3, { force: true });
   }
   try {
     const parsed = SecretsFileSchema.safeParse(JSON.parse(text));
@@ -28501,22 +28537,22 @@ function withRequestSecrets(req) {
 }
 
 // src/guest/daemon/daemon.ts
-import fs67 from "node:fs";
+import fs68 from "node:fs";
 
 // src/guest/setup/claude-mem.ts
-import fs16 from "node:fs";
+import fs17 from "node:fs";
 import os4 from "node:os";
-import path19 from "node:path";
+import path20 from "node:path";
 
 // src/guest/runtime/process.ts
-import fs15 from "node:fs";
+import fs16 from "node:fs";
 import os3 from "node:os";
-import path18 from "node:path";
+import path19 from "node:path";
 import { spawnSync as spawnSync2 } from "node:child_process";
 async function execAsync(file3, args, options = {}) {
   const code = await spawnAsync(file3, args, { stdio: "inherit", ...options });
   if (code !== 0)
-    throw new Error(path18.basename(file3) + " " + args.slice(0, 3).join(" ") + " failed with exit code " + code);
+    throw new Error(path19.basename(file3) + " " + args.slice(0, 3).join(" ") + " failed with exit code " + code);
 }
 function execOutput(file3, args, options = {}) {
   const result = spawnSync2(file3, args, { encoding: "utf8", windowsHide: true, ...options });
@@ -28538,24 +28574,24 @@ function scriptOutput(name, args = [], options = {}) {
   return execOutput(SYSTEM.powershell(), scriptArgs(name, args), options);
 }
 function runScriptWithJson(name, param, data, args = []) {
-  const dir = fs15.mkdtempSync(path18.join(os3.tmpdir(), "sbx-"));
-  const file3 = path18.join(dir, "input.json");
+  const dir = fs16.mkdtempSync(path19.join(os3.tmpdir(), "sbx-"));
+  const file3 = path19.join(dir, "input.json");
   try {
-    fs15.writeFileSync(file3, JSON.stringify(data), "utf8");
+    fs16.writeFileSync(file3, JSON.stringify(data), "utf8");
     runScript(name, ["-" + param, file3, ...args]);
   } finally {
-    fs15.rmSync(dir, { recursive: true, force: true });
+    fs16.rmSync(dir, { recursive: true, force: true });
   }
 }
 function robocopy(from, to, files = []) {
   if (!isWin) {
     if (!files.length) {
-      fs15.cpSync(from, to, { recursive: true });
+      fs16.cpSync(from, to, { recursive: true });
       return;
     }
-    fs15.mkdirSync(to, { recursive: true });
-    for (const f of files.filter((f2) => fs15.existsSync(path18.join(from, f2))))
-      fs15.copyFileSync(path18.join(from, f), path18.join(to, f));
+    fs16.mkdirSync(to, { recursive: true });
+    for (const f of files.filter((f2) => fs16.existsSync(path19.join(from, f2))))
+      fs16.copyFileSync(path19.join(from, f), path19.join(to, f));
     return;
   }
   const what = files.length ? files : ["/E"];
@@ -28597,28 +28633,28 @@ function copyNode(from, to) {
   const work = stagingFolder(to);
   try {
     robocopy(from, work, ["node.exe", "npm", "npm.cmd", "npx", "npx.cmd"]);
-    robocopy(path18.join(from, "node_modules", "npm"), path18.join(work, "node_modules", "npm"));
+    robocopy(path19.join(from, "node_modules", "npm"), path19.join(work, "node_modules", "npm"));
     moveIntoPlace(work, to);
   } finally {
-    safeRemove(work, path18.dirname(work));
+    safeRemove(work, path19.dirname(work));
   }
 }
 
 // src/guest/setup/claude-mem.ts
 var claudeMemPaths = {
-  store: path19.join(stateDir, "claude-mem"),
-  local: path19.join(os4.homedir(), ".claude-mem")
+  store: path20.join(stateDir, "claude-mem"),
+  local: path20.join(os4.homedir(), ".claude-mem")
 };
 var claudeMemEnabled = () => session.claudeProfile.syncClaudeMem && !dryRun;
 var databaseFingerprint = (dir) => {
   const parts2 = [];
   const walk = (folder) => {
-    for (const entry of fs16.readdirSync(folder, { withFileTypes: true })) {
-      const full = path19.join(folder, entry.name);
+    for (const entry of fs17.readdirSync(folder, { withFileTypes: true })) {
+      const full = path20.join(folder, entry.name);
       if (entry.isDirectory()) walk(full);
       else if (entry.isFile() && /\.(db|sqlite3?)(-wal)?$/i.test(entry.name)) {
         try {
-          const s = fs16.statSync(full);
+          const s = fs17.statSync(full);
           parts2.push(full + ":" + s.size + ":" + s.mtimeMs);
         } catch {
         }
@@ -28632,34 +28668,34 @@ var lastSaved = null;
 var SQLITE_HEADER = "SQLite format 3\0";
 var looksLikeSqlite = (file3) => {
   if (!exists(file3)) return true;
-  const fd = fs16.openSync(file3, "r");
+  const fd = fs17.openSync(file3, "r");
   try {
     const head = Buffer.alloc(16);
-    return fs16.readSync(fd, head, 0, 16, 0) === 16 && head.toString("latin1") === SQLITE_HEADER;
+    return fs17.readSync(fd, head, 0, 16, 0) === 16 && head.toString("latin1") === SQLITE_HEADER;
   } finally {
-    fs16.closeSync(fd);
+    fs17.closeSync(fd);
   }
 };
 var MAX_BACKUPS = 3;
 var BACKUP_EVERY_MS = 6 * 3600 * 1e3;
 var keepBackup = (previous, dir) => {
   if (!exists(previous)) return;
-  const backups = exists(dir) ? fs16.readdirSync(dir).filter((n) => /^\d{13}$/.test(n)).sort() : [];
+  const backups = exists(dir) ? fs17.readdirSync(dir).filter((n) => /^\d{13}$/.test(n)).sort() : [];
   const newest = Number(backups[backups.length - 1] ?? 0);
   if (Date.now() - newest < BACKUP_EVERY_MS) {
-    fs16.rmSync(previous, { recursive: true, force: true });
+    fs17.rmSync(previous, { recursive: true, force: true });
     return;
   }
-  fs16.renameSync(previous, path19.join(mkdirp(dir), String(Date.now())));
+  fs17.renameSync(previous, path20.join(mkdirp(dir), String(Date.now())));
   for (const old of [...backups, String(Date.now())].slice(0, -MAX_BACKUPS))
-    fs16.rmSync(path19.join(dir, old), { recursive: true, force: true });
+    fs17.rmSync(path20.join(dir, old), { recursive: true, force: true });
 };
 function saveClaudeMem() {
   if (!claudeMemEnabled() || !exists(claudeMemPaths.local)) return;
   const { store: store2, local } = claudeMemPaths;
   const fingerprint3 = databaseFingerprint(local);
   if (fingerprint3 === lastSaved && exists(store2)) return;
-  if (!looksLikeSqlite(path19.join(local, "claude-mem.db"))) {
+  if (!looksLikeSqlite(path20.join(local, "claude-mem.db"))) {
     warn(
       "claude-mem: the local database does not look valid, so it was not saved over the stored copy (" + local + ")."
     );
@@ -28667,14 +28703,14 @@ function saveClaudeMem() {
   }
   const incoming = store2 + ".incoming";
   const previous = store2 + ".previous";
-  fs16.rmSync(incoming, { recursive: true, force: true });
+  fs17.rmSync(incoming, { recursive: true, force: true });
   copyTreeTolerant(local, incoming, (name) => /\.(pid|lock)$|-journal$|-shm$/i.test(name));
-  fs16.rmSync(previous, { recursive: true, force: true });
-  if (exists(store2)) fs16.renameSync(store2, previous);
+  fs17.rmSync(previous, { recursive: true, force: true });
+  if (exists(store2)) fs17.renameSync(store2, previous);
   try {
-    fs16.renameSync(incoming, store2);
+    fs17.renameSync(incoming, store2);
   } catch (e) {
-    if (exists(previous)) fs16.renameSync(previous, store2);
+    if (exists(previous)) fs17.renameSync(previous, store2);
     throw e;
   }
   keepBackup(previous, store2 + ".backups");
@@ -28682,18 +28718,18 @@ function saveClaudeMem() {
 }
 
 // src/guest/agents/local-state.ts
-import fs17 from "node:fs";
-import path21 from "node:path";
+import fs18 from "node:fs";
+import path22 from "node:path";
 
 // src/guest/agents/agent-files.ts
-import path20 from "node:path";
+import path21 from "node:path";
 function agentPaths(toolsDir2, name, harness) {
-  const dir = path20.join(toolsDir2, "agents", name);
+  const dir = path21.join(toolsDir2, "agents", name);
   const exe = harness.hostExecutable ?? (harness.uvBin ? harness.uvBin + ".exe" : null);
   return {
     dir,
-    exe: exe ? path20.join(dir, exe) : null,
-    cmd: harness.npmBin ? path20.join(dir, harness.npmBin + ".cmd") : null
+    exe: exe ? path21.join(dir, exe) : null,
+    cmd: harness.npmBin ? path21.join(dir, harness.npmBin + ".cmd") : null
   };
 }
 function agentCommand(name, harness) {
@@ -28704,51 +28740,66 @@ function localStateEntries(agents2, stateDir3, localRoot2) {
     ([agent, harness]) => Object.entries(harness.localState ?? {}).map(([env, folder]) => ({
       agent,
       env,
-      store: path20.join(stateDir3, agent, folder),
-      local: path20.join(localRoot2, agent, folder),
+      store: path21.join(stateDir3, agent, folder),
+      local: path21.join(localRoot2, agent, folder),
       processes: [agentCommand(agent, harness) + ".exe"],
-      legacy: path20.join(stateDir3, agent)
+      legacy: path21.join(stateDir3, agent)
     }))
   );
 }
+var CODEX_MARKER = "# Set by the sandbox";
+function codexArguments(c) {
+  const out = c.sandboxMode === "danger-full-access" && c.approvalPolicy === "never" ? ["--dangerously-bypass-approvals-and-sandbox"] : ["--sandbox", c.sandboxMode, "--ask-for-approval", c.approvalPolicy];
+  if (c.model) out.push("-c", 'model="' + c.model + '"');
+  if (c.reasoningEffort !== "default") out.push("-c", 'model_reasoning_effort="' + c.reasoningEffort + '"');
+  return out;
+}
+function agentArguments(name, harness, codex) {
+  return name === "codex" && codex ? [...harness.arguments, ...codexArguments(codex)] : [...harness.arguments];
+}
+var MAX_CODEX_CONFIG_BYTES = 1024 * 1024;
+var MARKED_LINES = new RegExp(
+  "^" + CODEX_MARKER + "[^\r\n]*\r?\n(?:(?:sandbox_mode|approval_policy)[ 	]*=[^\r\n]*\r?\n)*(?:[ 	]*\r?\n)?",
+  "m"
+);
 var isDatabaseFile = (name) => /\.(sqlite3?|db)(-wal|-shm)?$/i.test(name);
 var isCopyableDatabaseFile = (name) => isDatabaseFile(name) && !/-shm$/i.test(name);
 
 // src/guest/agents/local-state.ts
 var SQLITE_HEADER2 = "SQLite format 3\0";
-var localRoot = () => path21.join(localDir, "agent-state");
+var localRoot = () => path22.join(localDir, "agent-state");
 function agentLocalStates() {
   return localStateEntries(session.agents ?? {}, stateDir, localRoot());
 }
 function localStateVars() {
   return Object.fromEntries(agentLocalStates().map((s) => [s.env, s.local]));
 }
-var databaseFiles = (dir, keep) => exists(dir) ? fs17.readdirSync(dir, { withFileTypes: true }).flatMap((e) => e.isFile() && keep(e.name) ? [e.name] : []) : [];
+var databaseFiles = (dir, keep) => exists(dir) ? fs18.readdirSync(dir, { withFileTypes: true }).flatMap((e) => e.isFile() && keep(e.name) ? [e.name] : []) : [];
 var looksLikeSqlite2 = (file3) => {
-  const fd = fs17.openSync(file3, "r");
+  const fd = fs18.openSync(file3, "r");
   try {
     const head = Buffer.alloc(16);
-    return fs17.readSync(fd, head, 0, 16, 0) === 16 && head.toString("latin1") === SQLITE_HEADER2;
+    return fs18.readSync(fd, head, 0, 16, 0) === 16 && head.toString("latin1") === SQLITE_HEADER2;
   } finally {
-    fs17.closeSync(fd);
+    fs18.closeSync(fd);
   }
 };
 var copyFiles = (from, to, names) => {
-  fs17.rmSync(to, { recursive: true, force: true });
+  fs18.rmSync(to, { recursive: true, force: true });
   mkdirp(to);
-  for (const name of names) fs17.copyFileSync(path21.join(from, name), path21.join(to, name));
+  for (const name of names) fs18.copyFileSync(path22.join(from, name), path22.join(to, name));
 };
 var swapIn = (incoming, store2) => {
   const previous = store2 + ".previous";
-  fs17.rmSync(previous, { recursive: true, force: true });
-  if (exists(store2)) fs17.renameSync(store2, previous);
+  fs18.rmSync(previous, { recursive: true, force: true });
+  if (exists(store2)) fs18.renameSync(store2, previous);
   try {
-    fs17.renameSync(incoming, store2);
+    fs18.renameSync(incoming, store2);
   } catch (e) {
-    if (exists(previous)) fs17.renameSync(previous, store2);
+    if (exists(previous)) fs18.renameSync(previous, store2);
     throw e;
   }
-  fs17.rmSync(previous, { recursive: true, force: true });
+  fs18.rmSync(previous, { recursive: true, force: true });
 };
 function held(s) {
   if (!isWin) return false;
@@ -28757,7 +28808,7 @@ function held(s) {
   );
 }
 var fingerprint = (dir) => databaseFiles(dir, isCopyableDatabaseFile).sort().map((n) => {
-  const st = fs17.statSync(path21.join(dir, n));
+  const st = fs18.statSync(path22.join(dir, n));
   return n + ":" + st.size + ":" + st.mtimeMs;
 }).join("|");
 var saved = /* @__PURE__ */ new Map();
@@ -28776,12 +28827,12 @@ function snapshotWhileRunning(s, print) {
         return;
       }
       const incoming = s.store + ".incoming";
-      fs17.rmSync(incoming, { recursive: true, force: true });
+      fs18.rmSync(incoming, { recursive: true, force: true });
       mkdirp(incoming);
       for (const name of databaseFiles(s.local, (n) => isCopyableDatabaseFile(n) && !/-wal$/i.test(n))) {
-        const db = new sqlite.DatabaseSync(path21.join(s.local, name), { readOnly: true });
+        const db = new sqlite.DatabaseSync(path22.join(s.local, name), { readOnly: true });
         try {
-          await sqlite.backup(db, path21.join(incoming, name));
+          await sqlite.backup(db, path22.join(incoming, name));
         } finally {
           db.close();
         }
@@ -28807,7 +28858,7 @@ function saveLocalState() {
         continue;
       }
       const names = databaseFiles(s.local, isCopyableDatabaseFile);
-      const bad = names.filter((n) => !/-wal$/i.test(n) && !looksLikeSqlite2(path21.join(s.local, n)));
+      const bad = names.filter((n) => !/-wal$/i.test(n) && !looksLikeSqlite2(path22.join(s.local, n)));
       if (bad.length) {
         warn(s.agent + ": " + bad.join(", ") + " do not look like SQLite databases, so they were not saved.");
         continue;
@@ -28826,10 +28877,10 @@ function saveLocalState() {
 import { spawn as spawn6 } from "node:child_process";
 
 // src/guest/setup/environment.ts
-import path23 from "node:path";
+import path24 from "node:path";
 
 // src/guest/setup/path-plan.ts
-import path22 from "node:path";
+import path23 from "node:path";
 function pathKey(folder) {
   const slashes = folder.trim().replace(/^"|"$/g, "").replace(/\//g, "\\");
   return (slashes.length > 3 ? slashes.replace(/\\+$/, "") : slashes).toLowerCase();
@@ -28869,13 +28920,13 @@ function parseRegPath(output2) {
 function isPinnedNodeDir(folder, nvmHome2) {
   const key2 = pathKey(folder);
   const home = pathKey(nvmHome2);
-  return key2.startsWith(home + "\\") && /^v\d/.test(path22.win32.basename(key2));
+  return key2.startsWith(home + "\\") && /^v\d/.test(path23.win32.basename(key2));
 }
 
 // src/guest/setup/environment.ts
 var LEGACY_HOMES = { CODEX_HOME: "codex", GEMINI_CLI_HOME: "gemini" };
 var agentHomes = () => Object.fromEntries(
-  Object.entries(session.agentHomes ?? LEGACY_HOMES).filter(([name]) => name !== "CLAUDE_CONFIG_DIR").map(([name, sub]) => [name, path23.join(stateDir, sub)])
+  Object.entries(session.agentHomes ?? LEGACY_HOMES).filter(([name]) => name !== "CLAUDE_CONFIG_DIR").map(([name, sub]) => [name, path24.join(stateDir, sub)])
 );
 function agentEnv(tools, target = { workspace, project: session.project, base: process.env }) {
   const homes = agentHomes();
@@ -28885,7 +28936,7 @@ function agentEnv(tools, target = { workspace, project: session.project, base: p
     CLAUDE_CONFIG_DIR: claudeDir,
     ...homes,
     ...localStateVars(),
-    npm_config_cache: path23.join(toolsDir, "npm-cache"),
+    npm_config_cache: path24.join(toolsDir, "npm-cache"),
     npm_config_update_notifier: "false",
     AGENT_WORKSPACE: target.workspace,
     AGENT_DATA: dataDir,
@@ -28903,9 +28954,9 @@ function agentEnv(tools, target = { workspace, project: session.project, base: p
     ...local.map((n) => env[n])
   ])
     mkdirp(dir);
-  const runners = [path23.join(toolsDir, "node"), path23.dirname(process.execPath)].map((d) => d.toLowerCase());
-  const base = (target.base.PATH ?? "").split(path23.delimiter).filter((d) => d && !runners.includes(d.toLowerCase()));
-  env.PATH = [.../* @__PURE__ */ new Set([...tools.prepend, ...base, ...tools.append])].join(path23.delimiter);
+  const runners = [path24.join(toolsDir, "node"), path24.dirname(process.execPath)].map((d) => d.toLowerCase());
+  const base = (target.base.PATH ?? "").split(path24.delimiter).filter((d) => d && !runners.includes(d.toLowerCase()));
+  env.PATH = [.../* @__PURE__ */ new Set([...tools.prepend, ...base, ...tools.append])].join(path24.delimiter);
   return env;
 }
 function addMachineEnvironment(vars, dirs, additive = false) {
@@ -28917,7 +28968,7 @@ function addMachineEnvironment(vars, dirs, additive = false) {
     warn("Could not add to the environment: " + errMsg(e));
   }
 }
-var nvmHome = () => path23.join(toolsDir, "nvm");
+var nvmHome = () => path24.join(toolsDir, "nvm");
 var MACHINE_ENVIRONMENT_KEY = "HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment";
 var USER_ENVIRONMENT_KEY = "HKCU\\Environment";
 var registryPath = (key2) => parseRegPath(execOutput(SYSTEM.reg(), ["query", key2, "/v", "Path"]));
@@ -28925,7 +28976,7 @@ function withRegistryPath(env) {
   if (!isWin || dryRun || testMode) return env;
   try {
     const registry2 = expandVars(registryPath(MACHINE_ENVIRONMENT_KEY) + ";" + registryPath(USER_ENVIRONMENT_KEY), env);
-    const runner = pathKey(path23.join(toolsDir, "node"));
+    const runner = pathKey(path24.join(toolsDir, "node"));
     const pathName = Object.keys(env).find((k) => k.toLowerCase() === "path") ?? "PATH";
     return {
       ...env,
@@ -28942,12 +28993,12 @@ function withRegistryPath(env) {
 }
 
 // src/guest/daemon/project-provisioner.ts
-import fs57 from "node:fs";
-import path71 from "node:path";
+import fs58 from "node:fs";
+import path74 from "node:path";
 
 // src/guest/boot/boot-env.ts
-import fs18 from "node:fs";
-import path24 from "node:path";
+import fs19 from "node:fs";
+import path25 from "node:path";
 
 // src/guest/boot/project-env.ts
 var EnvSchema = external_exports.object({
@@ -28977,28 +29028,28 @@ function baseEnvFor(boot, current = process.env) {
 }
 
 // src/guest/boot/boot-env.ts
-var file2 = () => path24.join(localDir, "boot-env.json");
+var file2 = () => path25.join(localDir, "boot-env.json");
 function readBootEnv() {
   try {
-    return BootEnvSchema.safeParse(JSON.parse(fs18.readFileSync(file2(), "utf8"))).data ?? null;
+    return BootEnvSchema.safeParse(JSON.parse(fs19.readFileSync(file2(), "utf8"))).data ?? null;
   } catch {
     return null;
   }
 }
 
 // src/guest/boot/guide.ts
-import fs20 from "node:fs";
-import path27 from "node:path";
+import fs21 from "node:fs";
+import path28 from "node:path";
 
 // src/guest/apps/find-exe.ts
-import fs19 from "node:fs";
-import path25 from "node:path";
+import fs20 from "node:fs";
+import path26 from "node:path";
 var MAX_DEPTH = 7;
 var MAX_ENTRIES = 5e4;
 var X64_FOLDER = /(^|[\\/])(amd64|x64|x86_64|win64)([\\/]|$)/i;
 function findExe(root, exe) {
   const match = exeMatcher(exe);
-  const best = (hits) => hits.find((h) => X64_FOLDER.test(path25.relative(root, h))) ?? hits[0] ?? null;
+  const best = (hits) => hits.find((h) => X64_FOLDER.test(path26.relative(root, h))) ?? hits[0] ?? null;
   let queue = [root];
   let seen = 0;
   for (let depth = 0; depth < MAX_DEPTH && queue.length; depth++) {
@@ -29007,14 +29058,14 @@ function findExe(root, exe) {
     for (const dir of queue) {
       let entries2;
       try {
-        entries2 = fs19.readdirSync(dir, { withFileTypes: true });
+        entries2 = fs20.readdirSync(dir, { withFileTypes: true });
       } catch {
         continue;
       }
       const hit = entries2.find((e) => e.isFile() && match(e.name));
-      if (hit) hits.push(path25.join(dir, hit.name));
+      if (hit) hits.push(path26.join(dir, hit.name));
       else
-        next.push(...entries2.filter((e) => e.isDirectory() && !e.isSymbolicLink()).map((e) => path25.join(dir, e.name)));
+        next.push(...entries2.filter((e) => e.isDirectory() && !e.isSymbolicLink()).map((e) => path26.join(dir, e.name)));
       if ((seen += entries2.length) > MAX_ENTRIES) return best(hits);
     }
     if (hits.length) return best(hits);
@@ -29024,13 +29075,13 @@ function findExe(root, exe) {
 }
 
 // src/guest/toolchains/tool-env.ts
-import path26 from "node:path";
+import path27 from "node:path";
 function emptyEnv() {
   return { vars: {}, prepend: [], append: [], summary: [] };
 }
 var arch = process.arch === "arm64" ? "arm64" : "x64";
 function tool(...parts2) {
-  return path26.join(toolsDir, ...parts2);
+  return path27.join(toolsDir, ...parts2);
 }
 function versionOf(exe, args = ["--version"], options = {}) {
   return /\d+\.\d+\.\d+\S*/.exec(execOutput(exe, args, options))?.[0] ?? "installed";
@@ -29050,7 +29101,7 @@ function installedRtk() {
 var BEGIN = "<!-- agent-sandbox:begin (generated every boot, do not edit) -->";
 var END = "<!-- agent-sandbox:end -->";
 var mirrorLine = () => {
-  const drives = (session.substDrives ?? []).filter((d) => fs20.existsSync(d.letter + ":\\"));
+  const drives = (session.substDrives ?? []).filter((d) => fs21.existsSync(d.letter + ":\\"));
   if (!drives.length) return [];
   return [
     "- " + drives.map((d) => d.letter + ":").join(", ") + " = mapped folders at their PC paths (subst onto `" + drives.map((d) => d.target).join("`, `") + "`; real-path tools may print that form)."
@@ -29066,8 +29117,8 @@ function sandboxGuide(toolSummary, lan = "blocked", projects = [], addons = [])
     ...projects.map(
       (p) => "- RW, persists: `" + p.guest + "` = host folder " + p.host + " (another project in this sandbox; your own is `%AGENT_WORKSPACE%`)"
     ),
-    "- RW, persists: `" + toolsDir + "` (toolchains) \u2014 put portable exes in `" + path27.join(toolsDir, "bin") + "` (on PATH)",
-    "- RW, persists: `" + stateDir + "` (agent config/history; do not edit logins) \xB7 logs: `" + path27.join(dataDir, "logs") + "`",
+    "- RW, persists: `" + toolsDir + "` (toolchains) \u2014 put portable exes in `" + path28.join(toolsDir, "bin") + "` (on PATH)",
+    "- RW, persists: `" + stateDir + "` (agent config/history; do not edit logins) \xB7 logs: `" + path28.join(dataDir, "logs") + "`",
     "- RO: `" + launchDir + "` (this boot's scripts) \xB7 lost on close: everything else, incl. `C:\\nvm` (Node symlink)",
     ...mirrorLine(),
     "- Tools: " + toolSummary.join(" \xB7 "),
@@ -29080,23 +29131,23 @@ function sandboxGuide(toolSummary, lan = "blocked", projects = [], addons = [])
   ].join("\n");
 }
 function upsertGuide(file3, guide) {
-  fs20.mkdirSync(path27.dirname(file3), { recursive: true });
-  const current = fs20.existsSync(file3) ? fs20.readFileSync(file3, "utf8") : "";
+  fs21.mkdirSync(path28.dirname(file3), { recursive: true });
+  const current = fs21.existsSync(file3) ? fs21.readFileSync(file3, "utf8") : "";
   const start = current.indexOf(BEGIN);
   const end = current.indexOf(END);
   const without = start >= 0 && end > start ? current.slice(0, start) + current.slice(end + END.length) : current;
-  fs20.writeFileSync(file3, without.trimEnd() + (without.trim() ? "\n\n" : "") + guide + "\n", "utf8");
+  fs21.writeFileSync(file3, without.trimEnd() + (without.trim() ? "\n\n" : "") + guide + "\n", "utf8");
 }
 function managedClaudeMd() {
-  return path27.join(
-    process.env.AGENT_MANAGED_DIR ?? path27.join(process.env.ProgramFiles ?? "C:\\Program Files", "ClaudeCode"),
+  return path28.join(
+    process.env.AGENT_MANAGED_DIR ?? path28.join(process.env.ProgramFiles ?? "C:\\Program Files", "ClaudeCode"),
     "CLAUDE.md"
   );
 }
 var headroomRuns = () => {
   try {
-    const file3 = path27.join(path27.dirname(managedClaudeMd()), "managed-settings.json");
-    const settings = JSON.parse(fs20.readFileSync(file3, "utf8"));
+    const file3 = path28.join(path28.dirname(managedClaudeMd()), "managed-settings.json");
+    const settings = JSON.parse(fs21.readFileSync(file3, "utf8"));
     return typeof settings.env?.ANTHROPIC_BASE_URL === "string";
   } catch {
     return false;
@@ -29106,28 +29157,28 @@ function addonLines() {
   const mcp = APPS.flatMap((a) => a.mcp && installedAddon(a.id) ? [a.mcp.name] : []);
   return [
     ...installedRtk() ? [RTK_GUIDE_LINE] : [],
-    ...installedAddon("headroom") && headroomRuns() ? [headroomGuideLine(path27.join(logsDir, "headroom.log"))] : [],
+    ...installedAddon("headroom") && headroomRuns() ? [headroomGuideLine(path28.join(logsDir, "headroom.log"))] : [],
     ...addonGuideLine(mcp, Boolean(installedAddon("ccusage")))
   ];
 }
 function writeGuides(toolSummary, lan, projects = []) {
   const guide = sandboxGuide(toolSummary, lan, projects, addonLines());
   const managed = managedClaudeMd();
-  fs20.mkdirSync(path27.dirname(managed), { recursive: true });
-  fs20.writeFileSync(managed, guide + "\n", "utf8");
-  fs20.writeFileSync(path27.join(dataDir, "SANDBOX.md"), guide + "\n", "utf8");
-  upsertGuide(path27.join(stateDir, "codex", "AGENTS.md"), guide);
-  upsertGuide(path27.join(stateDir, "gemini", ".gemini", "GEMINI.md"), guide);
-  removeGuide(path27.join(claudeDir, "CLAUDE.md"));
+  fs21.mkdirSync(path28.dirname(managed), { recursive: true });
+  fs21.writeFileSync(managed, guide + "\n", "utf8");
+  fs21.writeFileSync(path28.join(dataDir, "SANDBOX.md"), guide + "\n", "utf8");
+  upsertGuide(path28.join(stateDir, "codex", "AGENTS.md"), guide);
+  upsertGuide(path28.join(stateDir, "gemini", ".gemini", "GEMINI.md"), guide);
+  removeGuide(path28.join(claudeDir, "CLAUDE.md"));
   return managed;
 }
 var removeGuide = (file3) => {
-  if (!fs20.existsSync(file3)) return;
-  const current = fs20.readFileSync(file3, "utf8");
+  if (!fs21.existsSync(file3)) return;
+  const current = fs21.readFileSync(file3, "utf8");
   const start = current.indexOf(BEGIN);
   const end = current.indexOf(END);
   if (start >= 0 && end > start)
-    fs20.writeFileSync(file3, (current.slice(0, start) + current.slice(end + END.length)).trim() + "\n", "utf8");
+    fs21.writeFileSync(file3, (current.slice(0, start) + current.slice(end + END.length)).trim() + "\n", "utf8");
 };
 
 // src/guest/runtime/project-context.ts
@@ -29164,11 +29215,11 @@ function saveProjectStatus(name, workspace2, phase, message, databases, summary)
 }
 
 // src/guest/setup/hooks.ts
-import fs21 from "node:fs";
-import path28 from "node:path";
+import fs22 from "node:fs";
+import path29 from "node:path";
 import { spawnSync as spawnSync3 } from "node:child_process";
 var commandFor = (file3) => {
-  const ext = path28.extname(file3).toLowerCase();
+  const ext = path29.extname(file3).toLowerCase();
   if (ext === ".mjs" || ext === ".js") return [process.execPath, [file3]];
   if (!isWin) return null;
   if (ext === ".ps1")
@@ -29176,18 +29227,18 @@ var commandFor = (file3) => {
   if (ext === ".cmd" || ext === ".bat") return [SYSTEM.cmd(), ["/d", "/c", file3]];
   return null;
 };
-var BOOT = { root: path28.join(launchDir, "hooks"), cwd: workspace };
+var BOOT = { root: path29.join(launchDir, "hooks"), cwd: workspace };
 function projectHooks(name, cwd) {
   return {
-    root: path28.join(launchDir, "projects", name, "hooks"),
+    root: path29.join(launchDir, "projects", name, "hooks"),
     cwd
   };
 }
 var hooksOf = (stage, target) => {
-  const dir = path28.join(target.root, stage);
+  const dir = path29.join(target.root, stage);
   if (!exists(dir)) return [];
-  return fs21.readdirSync(dir).sort().flatMap((name) => {
-    const command = commandFor(path28.join(dir, name));
+  return fs22.readdirSync(dir).sort().flatMap((name) => {
+    const command = commandFor(path29.join(dir, name));
     return command ? [{ name, command }] : [];
   });
 };
@@ -29217,22 +29268,22 @@ async function runHooksAsync(stage, env, target) {
 }
 
 // src/guest/apps/app-installer.ts
-import fs25 from "node:fs";
-import path33 from "node:path";
+import fs26 from "node:fs";
+import path34 from "node:path";
 
 // src/guest/toolchains/runtimes.ts
-import path29 from "node:path";
+import path30 from "node:path";
 
 // src/guest/toolchains/install.ts
-import fs22 from "node:fs";
+import fs23 from "node:fs";
 async function downloadFile(url2, file3, sha256 = null) {
   const part = file3 + ".part";
   try {
     await downloader.file(url2, part, sha256);
-    fs22.rmSync(file3, { force: true });
-    fs22.renameSync(part, file3);
+    fs23.rmSync(file3, { force: true });
+    fs23.renameSync(part, file3);
   } finally {
-    fs22.rmSync(part, { force: true });
+    fs23.rmSync(part, { force: true });
   }
 }
 async function installFromGithub(repo, pattern, o) {
@@ -29252,8 +29303,8 @@ async function setupSingleExe(env, name, repo, pattern, exeName, dir, options =
     log("(dry run) would provision " + name);
     return;
   }
-  const bin = options.subdir ? path29.join(dir, options.subdir) : dir;
-  const exe = path29.join(bin, exeName);
+  const bin = options.subdir ? path30.join(dir, options.subdir) : dir;
+  const exe = path30.join(bin, exeName);
   if (!exists(exe) || options.refresh) {
     const size = options.size ? ", ~" + options.size : "";
     await installFromGithub(repo, pattern, {
@@ -29278,8 +29329,8 @@ async function setupBun(env) {
   );
   Object.assign(env.vars, {
     BUN_INSTALL: tool("bun"),
-    BUN_INSTALL_CACHE_DIR: path29.join(localDir, "bun-cache"),
-    BUN_TMPDIR: path29.join(localDir, "bun-tmp")
+    BUN_INSTALL_CACHE_DIR: path30.join(localDir, "bun-cache"),
+    BUN_TMPDIR: path30.join(localDir, "bun-tmp")
   });
 }
 async function setupDeno(env) {
@@ -29317,8 +29368,8 @@ async function setupUv(env) {
 }
 
 // src/guest/apps/after-install.ts
-import fs23 from "node:fs";
-import path30 from "node:path";
+import fs24 from "node:fs";
+import path31 from "node:path";
 var SYSINTERNALS_TOOLS = [
   "Process Explorer",
   "Process Monitor",
@@ -29339,16 +29390,16 @@ var SYSINTERNALS_TOOLS = [
   "ZoomIt"
 ];
 async function afterInstall(entry, exe) {
-  const dir = path30.dirname(exe);
+  const dir = path31.dirname(exe);
   if (entry.needs?.includes("mesa")) {
     const mesa = tool("mesa", arch === "arm64" ? "arm64" : "x64");
     for (const dll of ["opengl32.dll", "libgallium_wgl.dll", "dxil.dll"]) {
-      if (exists(path30.join(mesa, dll)) && !exists(path30.join(dir, dll)))
-        fs23.copyFileSync(path30.join(mesa, dll), path30.join(dir, dll));
+      if (exists(path31.join(mesa, dll)) && !exists(path31.join(dir, dll)))
+        fs24.copyFileSync(path31.join(mesa, dll), path31.join(dir, dll));
     }
   }
-  if (entry.id === "godot" && !exists(path30.join(dir, "._sc_"))) fs23.writeFileSync(path30.join(dir, "._sc_"), "");
-  if (entry.id === "sublime") mkdirp(path30.join(dir, "Data"));
+  if (entry.id === "godot" && !exists(path31.join(dir, "._sc_"))) fs24.writeFileSync(path31.join(dir, "._sc_"), "");
+  if (entry.id === "sublime") mkdirp(path31.join(dir, "Data"));
   if (entry.id === "sysinternals") {
     for (const name of SYSINTERNALS_TOOLS) {
       await execAsync(
@@ -29362,12 +29413,12 @@ async function afterInstall(entry, exe) {
 
 // src/guest/apps/shortcuts.ts
 import os5 from "node:os";
-import path31 from "node:path";
+import path32 from "node:path";
 function shortcuts(apps) {
   if (!apps.length) return;
-  const desktop = path31.join(os5.homedir(), "Desktop");
-  const start = path31.join(
-    process.env.APPDATA ?? path31.join(os5.homedir(), "AppData", "Roaming"),
+  const desktop = path32.join(os5.homedir(), "Desktop");
+  const start = path32.join(
+    process.env.APPDATA ?? path32.join(os5.homedir(), "AppData", "Roaming"),
     "Microsoft",
     "Windows",
     "Start Menu",
@@ -29377,9 +29428,9 @@ function shortcuts(apps) {
   const links = apps.flatMap((app) => {
     const name = app.name.replace(/[\\/:*?"<>|]/g, "");
     return [desktop, start].map((folder) => ({
-      link: path31.join(folder, name + ".lnk"),
+      link: path32.join(folder, name + ".lnk"),
       target: app.exe,
-      workingDirectory: path31.dirname(app.exe)
+      workingDirectory: path32.dirname(app.exe)
     }));
   });
   runScriptWithJson("new-shortcuts.ps1", "ListFile", links);
@@ -29519,12 +29570,12 @@ async function resolve(entry) {
 }
 
 // src/guest/apps/unpack.ts
-import fs24 from "node:fs";
-import path32 from "node:path";
+import fs25 from "node:fs";
+import path33 from "node:path";
 var sevenZip = () => tool("apps", "7zip", "7z.exe");
 async function unpack(entry, file3, out, d) {
   if (entry.id === "7zip") {
-    const sevenZr = path32.join(path32.dirname(file3), "7zr.exe");
+    const sevenZr = path33.join(path33.dirname(file3), "7zr.exe");
     const zr = await githubAsset("ip7z/7zip", /^7zr\.exe$/);
     await downloader.file(zr.url, sevenZr, zr.sha256);
     await execAsync(sevenZr, ["x", "-y", "-o" + out, file3], { stdio: "ignore" });
@@ -29533,17 +29584,17 @@ async function unpack(entry, file3, out, d) {
   switch (entry.unpack ?? "archive") {
     case "file": {
       mkdirp(out);
-      fs24.renameSync(file3, path32.join(out, /^\//.test(entry.exe) ? path32.basename(file3) : entry.exe));
+      fs25.renameSync(file3, path33.join(out, /^\//.test(entry.exe) ? path33.basename(file3) : entry.exe));
       return;
     }
     case "nsis": {
       if (!exists(sevenZip()))
         throw new Error("7-Zip is needed to unpack " + entry.name + " and could not be installed");
-      const raw = path32.join(path32.dirname(out), "raw");
+      const raw = path33.join(path33.dirname(out), "raw");
       await execAsync(sevenZip(), ["x", "-y", "-o" + raw, file3], { stdio: "ignore" });
       const inner = findExe(raw, "/^app-64\\.7z$/");
       if (inner) await execAsync(sevenZip(), ["x", "-y", "-o" + out, inner], { stdio: "ignore" });
-      else fs24.renameSync(raw, out);
+      else fs25.renameSync(raw, out);
       return;
     }
     case "msi": {
@@ -29593,11 +29644,11 @@ var AppInstaller = class {
   async installOne(entry) {
     try {
       const dest = tool("apps", ...entry.id.split("/"));
-      if (!exists(path33.join(dest, MARKER)) || this.options.refresh) await this.download(entry, dest);
+      if (!exists(path34.join(dest, MARKER)) || this.options.refresh) await this.download(entry, dest);
       const exe = findExe(dest, entry.exe);
       if (!exe) throw new Error(entry.exe + " not found in the download");
       await afterInstall(entry, exe);
-      if (!entry.service && (entry.cli || entry.id === "sysinternals")) this.env.prepend.push(path33.dirname(exe));
+      if (!entry.service && (entry.cli || entry.id === "sysinternals")) this.env.prepend.push(path34.dirname(exe));
       if (!entry.cli && !entry.service) this.gui.push({ name: entry.name, exe });
       this.installed.push(entry.name);
     } catch (e) {
@@ -29610,13 +29661,13 @@ var AppInstaller = class {
   /** Downloads and unpacks one entry into its folder (replaced in one step: never half there). */
   async download(entry, dest) {
     const work = stagingFolder(dest);
-    const out = path33.join(work, "out");
+    const out = path34.join(work, "out");
     try {
       if ("locked" in entry.source) {
         log("Installing " + entry.name + " " + entry.source.version + " (pinned, every file checked) ...");
         await installLocked(entry.id, entry.source.locked, mkdirp(out));
       } else if ("npm" in entry.source) {
-        const npmCli = path33.join(path33.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+        const npmCli = path34.join(path34.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
         log("Installing " + entry.name + " (npm) ...");
         await execAsync(process.execPath, [
           npmCli,
@@ -29631,23 +29682,23 @@ var AppInstaller = class {
       } else {
         const d = await resolve(entry);
         log("Downloading " + entry.name + " (" + d.fileName + ", ~" + entry.size + " once) ...");
-        const file3 = path33.join(mkdirp(work), d.fileName.replace(/[\\/:*?"<>|]/g, "_"));
+        const file3 = path34.join(mkdirp(work), d.fileName.replace(/[\\/:*?"<>|]/g, "_"));
         await downloader.file(d.url, file3, { sha256: d.sha256 ?? null });
         await unpack(entry, file3, out, d);
       }
-      fs25.writeFileSync(path33.join(out, MARKER), JSON.stringify({ id: entry.id, at: (/* @__PURE__ */ new Date()).toISOString() }));
+      fs26.writeFileSync(path34.join(out, MARKER), JSON.stringify({ id: entry.id, at: (/* @__PURE__ */ new Date()).toISOString() }));
       moveIntoPlace(out, dest);
     } finally {
-      safeRemove(work, path33.dirname(work));
+      safeRemove(work, path34.dirname(work));
     }
   }
 };
 var LOCKED_PYTHON = "3.13";
 async function installLocked(id, kind, out) {
-  const lock = path33.join(launchDir, "sandbox", "addons", id);
+  const lock = path34.join(launchDir, "sandbox", "addons", id);
   if (kind === "npm") {
-    for (const f of ["package.json", "package-lock.json"]) fs25.copyFileSync(path33.join(lock, f), path33.join(out, f));
-    const npmCli = path33.join(path33.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+    for (const f of ["package.json", "package-lock.json"]) fs26.copyFileSync(path34.join(lock, f), path34.join(out, f));
+    const npmCli = path34.join(path34.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
     await execAsync(
       process.execPath,
       [npmCli, "ci", "--ignore-scripts", "--no-audit", "--no-fund", "--loglevel=error"],
@@ -29658,7 +29709,7 @@ async function installLocked(id, kind, out) {
   const uv = findExe(tool("uv"), "uv.exe");
   if (!uv) throw new Error("uv is not installed (the uv step failed)");
   const env = { ...process.env, ...uvVars() };
-  const venv = path33.join(out, "venv");
+  const venv = path34.join(out, "venv");
   await execAsync(
     uv,
     ["venv", "--relocatable", "--python", LOCKED_PYTHON, "--python-preference", "only-managed", venv],
@@ -29672,7 +29723,7 @@ async function installLocked(id, kind, out) {
       "pip",
       "install",
       "--python",
-      path33.join(venv, "Scripts", "python.exe"),
+      path34.join(venv, "Scripts", "python.exe"),
       "--require-hashes",
       "--no-deps",
       "--only-binary",
@@ -29680,7 +29731,7 @@ async function installLocked(id, kind, out) {
       "--link-mode",
       "copy",
       "-r",
-      path33.join(lock, "requirements.txt")
+      path34.join(lock, "requirements.txt")
     ],
     { env }
   );
@@ -29696,8 +29747,8 @@ async function setupApps(env, apps, o) {
 }
 
 // src/guest/toolchains/detect.ts
-import fs26 from "node:fs";
-import path34 from "node:path";
+import fs27 from "node:fs";
+import path35 from "node:path";
 
 // src/core/detect/versions.ts
 function pickNodeVersion(releases, spec) {
@@ -29841,14 +29892,14 @@ function workspaceEntries() {
   if (known) return known;
   const list = (dir) => {
     try {
-      return fs26.readdirSync(dir, { withFileTypes: true });
+      return fs27.readdirSync(dir, { withFileTypes: true });
     } catch {
       return [];
     }
   };
   const top = list(workspace2);
   const below = top.filter((d) => d.isDirectory() && !d.name.startsWith(".") && !SKIP_DIRS.has(d.name.toLowerCase())).flatMap(
-    (d) => list(path34.join(workspace2, d.name)).filter((f) => f.isFile()).map((f) => d.name + "/" + f.name)
+    (d) => list(path35.join(workspace2, d.name)).filter((f) => f.isFile()).map((f) => d.name + "/" + f.name)
   );
   const found = [...top.filter((d) => d.isFile()).map((d) => d.name), ...below];
   entries.set(workspace2.toLowerCase(), found);
@@ -29859,9 +29910,9 @@ function wanted(setting, toolchain) {
 }
 function versionFromFiles(files, parse5 = (t) => specFromVersionFile(t)) {
   for (const name of files) {
-    const file3 = path34.join(projectWorkspace(), name);
+    const file3 = path35.join(projectWorkspace(), name);
     if (!exists(file3)) continue;
-    const spec = parse5(fs26.readFileSync(file3, "utf8"), name);
+    const spec = parse5(fs27.readFileSync(file3, "utf8"), name);
     if (spec) return { spec, source: name };
   }
   return null;
@@ -29934,22 +29985,22 @@ var DatabaseServer = class {
 };
 
 // src/guest/databases/dynamodb.ts
-import fs31 from "node:fs";
-import path37 from "node:path";
+import fs32 from "node:fs";
+import path38 from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 
 // src/guest/toolchains/languages/java.ts
-import fs29 from "node:fs";
-import path35 from "node:path";
+import fs30 from "node:fs";
+import path36 from "node:path";
 
 // src/guest/toolchains/version-cache.ts
-import fs28 from "node:fs";
+import fs29 from "node:fs";
 
 // src/guest/toolchains/state-file.ts
-import fs27 from "node:fs";
+import fs28 from "node:fs";
 function readState(file3, schema, empty) {
   try {
-    return schema.safeParse(JSON.parse(fs27.readFileSync(file3, "utf8").replace(/^\uFEFF/, ""))).data ?? empty;
+    return schema.safeParse(JSON.parse(fs28.readFileSync(file3, "utf8").replace(/^\uFEFF/, ""))).data ?? empty;
   } catch {
     return empty;
   }
@@ -29984,7 +30035,7 @@ var VersionCache = class {
       return cached2.value;
     try {
       const value = await resolve2();
-      fs28.mkdirSync(toolsDir, { recursive: true });
+      fs29.mkdirSync(toolsDir, { recursive: true });
       writeJsonAtomic(this.file(), { ...this.remembered(), [key2]: { value, at: Date.now() } });
       return value;
     } catch (e) {
@@ -30037,7 +30088,7 @@ var setupJdk = async (env, config2) => {
   const { major, source } = await javaMajor(config2);
   const release = await resolveCached("java:" + major, async () => (await temurin(major)).release_name);
   const home = tool("java", release.replace(/[^A-Za-z0-9.-]/g, "_"));
-  if (!exists(path35.join(home, "bin", "java.exe"))) {
+  if (!exists(path36.join(home, "bin", "java.exe"))) {
     const asset = await temurin(major);
     log("Downloading Java " + release + " (JDK, ~200 MB once) ...");
     await downloader.archive(asset.binary.package.link, home, {
@@ -30047,13 +30098,13 @@ var setupJdk = async (env, config2) => {
     });
   }
   env.vars.JAVA_HOME = home;
-  env.prepend.push(path35.join(home, "bin"));
+  env.prepend.push(path36.join(home, "bin"));
   env.summary.push("java: " + release + " (Temurin, from " + source + ")");
 };
 async function ensureJdk() {
   const root = tool("java");
-  const installed = exists(root) ? fs29.readdirSync(root).filter((d) => exists(path35.join(root, d, "bin", "java.exe"))).sort((a, b) => b.localeCompare(a, void 0, { numeric: true })) : [];
-  if (installed.length) return path35.join(root, installed[0]);
+  const installed = exists(root) ? fs30.readdirSync(root).filter((d) => exists(path36.join(root, d, "bin", "java.exe"))).sort((a, b) => b.localeCompare(a, void 0, { numeric: true })) : [];
+  if (installed.length) return path36.join(root, installed[0]);
   const scratch = emptyEnv();
   await setupJdk(scratch, { enabled: true, version: "lts", maven: false, gradle: false, kotlin: false });
   return scratch.vars.JAVA_HOME;
@@ -30066,7 +30117,7 @@ var setupMaven = async (env) => {
     return pickPackageVersion(versions, "3") ?? Promise.reject(new Error("No Maven 3 release found"));
   });
   const home = tool("maven", version2);
-  if (!exists(path35.join(home, "bin", "mvn.cmd"))) {
+  if (!exists(path36.join(home, "bin", "mvn.cmd"))) {
     const url2 = MAVEN + version2 + "/apache-maven-" + version2 + "-bin.zip";
     log("Downloading Maven " + version2 + " (~10 MB once) ...");
     await downloader.archive(url2, home, {
@@ -30076,7 +30127,7 @@ var setupMaven = async (env) => {
   }
   const repo = tool("maven-repository");
   Object.assign(env.vars, { MAVEN_HOME: home, M2_HOME: home, MAVEN_OPTS: "-Dmaven.repo.local=" + repo });
-  env.prepend.push(path35.join(home, "bin"));
+  env.prepend.push(path36.join(home, "bin"));
   env.summary.push("maven: " + version2);
 };
 var setupGradle = async (env) => {
@@ -30088,7 +30139,7 @@ var setupGradle = async (env) => {
     async () => current?.version ?? Promise.reject(new Error("Gradle version lookup failed"))
   );
   const home = tool("gradle", version2);
-  if (!exists(path35.join(home, "bin", "gradle.bat"))) {
+  if (!exists(path36.join(home, "bin", "gradle.bat"))) {
     if (!current || current.version !== version2)
       throw new Error("Gradle " + version2 + " is not installed and cannot be downloaded right now");
     log("Downloading Gradle " + version2 + " (~130 MB once) ...");
@@ -30099,13 +30150,13 @@ var setupGradle = async (env) => {
     });
   }
   const userHome = tool("gradle-home");
-  fs29.mkdirSync(userHome, { recursive: true });
+  fs30.mkdirSync(userHome, { recursive: true });
   Object.assign(env.vars, {
     GRADLE_HOME: home,
     GRADLE_USER_HOME: userHome,
     GRADLE_OPTS: "-Dorg.gradle.vfs.watch=false"
   });
-  env.prepend.push(path35.join(home, "bin"));
+  env.prepend.push(path36.join(home, "bin"));
   env.summary.push("gradle: " + version2);
 };
 async function setupJava(env, config2) {
@@ -30129,29 +30180,29 @@ async function setupJava(env, config2) {
 }
 
 // src/guest/databases/server.ts
-import fs30 from "node:fs";
-import path36 from "node:path";
+import fs31 from "node:fs";
+import path37 from "node:path";
 import { spawn as spawn2 } from "node:child_process";
 function dataFor(name) {
-  return path36.join(dataDir, "databases", name);
+  return path37.join(dataDir, "databases", name);
 }
 async function startServer(name, exe, args, port) {
   if (await portOpen(port)) throw new Error("port " + port + " is already in use (change databases." + name + ".port)");
-  const logFile2 = path36.join(logsDir, name + ".log");
-  const out = fs30.openSync(logFile2, "a");
+  const logFile2 = path37.join(logsDir, name + ".log");
+  const out = fs31.openSync(logFile2, "a");
   spawn2(exe, args, { detached: true, stdio: ["ignore", out, out], windowsHide: true }).unref();
-  fs30.closeSync(out);
+  fs31.closeSync(out);
   if (!await waitForPort(port, 60))
     throw new Error(name + " did not start listening on port " + port + "; see " + logFile2);
 }
 async function clearStaleLocks(dir, files, port) {
   if (await portOpen(port)) return;
-  for (const f of files) fs30.rmSync(path36.join(dir, f), { force: true });
+  for (const f of files) fs31.rmSync(path37.join(dir, f), { force: true });
 }
 async function createOnce(data, marker, create) {
-  if (exists(path36.join(data, marker))) return;
+  if (exists(path37.join(data, marker))) return;
   const existed = exists(data);
-  mkdirp(path36.dirname(data));
+  mkdirp(path37.dirname(data));
   try {
     await create();
   } catch (e) {
@@ -30175,9 +30226,9 @@ var DynamoServer = class extends DatabaseServer {
    * local endpoint up from AWS_ENDPOINT_URL_DYNAMODB, with dummy credentials (real ones never reach the sandbox).
    */
   async start(env, plan2) {
-    const java = path37.join(await ensureJdk(), "bin", "java.exe");
+    const java = path38.join(await ensureJdk(), "bin", "java.exe");
     const home = tool("dynamodb-local");
-    if (!exists(path37.join(home, "DynamoDBLocal.jar"))) {
+    if (!exists(path38.join(home, "DynamoDBLocal.jar"))) {
       log("Downloading DynamoDB Local (~60 MB once) ...");
       const sha256 = (await fetchText(DYNAMO_ZIP + ".sha256")).trim().split(/\s+/)[0];
       await downloader.archive(DYNAMO_ZIP, home, {
@@ -30191,9 +30242,9 @@ var DynamoServer = class extends DatabaseServer {
       "dynamodb",
       java,
       [
-        "-Djava.library.path=" + path37.join(home, "DynamoDBLocal_lib"),
+        "-Djava.library.path=" + path38.join(home, "DynamoDBLocal_lib"),
         "-jar",
-        path37.join(home, "DynamoDBLocal.jar"),
+        path38.join(home, "DynamoDBLocal.jar"),
         "-sharedDb",
         "-dbPath",
         data,
@@ -30217,10 +30268,10 @@ var DynamoServer = class extends DatabaseServer {
     );
     if (!plan2.adminPort) return;
     const prefix = tool("dynamodb-admin");
-    const script = path37.join(prefix, "node_modules", "dynamodb-admin", "dist", "dynamodb-admin.js");
+    const script = path38.join(prefix, "node_modules", "dynamodb-admin", "dist", "dynamodb-admin.js");
     if (!exists(script)) {
       log("Installing dynamodb-admin, the DynamoDB web UI (~20 MB once) ...");
-      const npmCli = path37.join(path37.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+      const npmCli = path38.join(path38.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
       await execAsync(
         process.execPath,
         [npmCli, "install", "--global", "--prefix", prefix, "dynamodb-admin", "--no-fund", "--no-audit"],
@@ -30233,15 +30284,15 @@ var DynamoServer = class extends DatabaseServer {
       );
       return;
     }
-    const out = fs31.openSync(path37.join(logsDir, "dynamodb-admin.log"), "a");
+    const out = fs32.openSync(path38.join(logsDir, "dynamodb-admin.log"), "a");
     spawn3(
       process.execPath,
       [script, "--port", String(plan2.adminPort), "--dynamo-endpoint", endpoint, "--skip-default-credentials"],
       { detached: true, stdio: ["ignore", out, out], windowsHide: true, env: { ...process.env, ...aws } }
     ).unref();
-    fs31.closeSync(out);
+    fs32.closeSync(out);
     if (!await waitForPort(plan2.adminPort, 30))
-      throw new Error("dynamodb-admin did not start; see " + path37.join(logsDir, "dynamodb-admin.log"));
+      throw new Error("dynamodb-admin did not start; see " + path38.join(logsDir, "dynamodb-admin.log"));
     env.summary.push(
       "dynamodb-admin: http://localhost:" + plan2.adminPort + " (browse and edit tables in the sandbox's browser)"
     );
@@ -30249,7 +30300,7 @@ var DynamoServer = class extends DatabaseServer {
 };
 
 // src/guest/databases/mongodb.ts
-import path38 from "node:path";
+import path39 from "node:path";
 var MongoServer = class extends DatabaseServer {
   id = "mongodb";
   async start(env, plan2) {
@@ -30264,13 +30315,13 @@ var MongoServer = class extends DatabaseServer {
     };
     const version2 = await resolveCached("mongodb:" + plan2.version, async () => (await find()).version);
     const home = tool("mongodb", version2);
-    if (!exists(path38.join(home, "bin", "mongod.exe"))) {
+    if (!exists(path39.join(home, "bin", "mongod.exe"))) {
       const { archive } = await find();
       log("Downloading MongoDB " + version2 + " (~400 MB once) ...");
       await downloader.archive(archive.url, home, { sha256: archive.sha256, locate: "mongod.exe", up: 1 });
     }
     const shell = tool("mongosh");
-    if (!exists(path38.join(shell, "mongosh.exe"))) {
+    if (!exists(path39.join(shell, "mongosh.exe"))) {
       await installFromGithub("mongodb-js/mongosh", /^mongosh-[\d.]+-win32-x64\.zip$/, {
         dest: shell,
         what: "mongosh, the MongoDB shell (~50 MB once)",
@@ -30281,17 +30332,17 @@ var MongoServer = class extends DatabaseServer {
     await clearStaleLocks(data, ["mongod.lock"], plan2.port);
     await startServer(
       "mongodb",
-      path38.join(home, "bin", "mongod.exe"),
+      path39.join(home, "bin", "mongod.exe"),
       ["--dbpath", data, "--bind_ip", "127.0.0.1", "--port", String(plan2.port)],
       plan2.port
     );
-    env.prepend.push(path38.join(home, "bin"), shell);
+    env.prepend.push(path39.join(home, "bin"), shell);
     env.summary.push("mongodb " + version2 + ": mongodb://127.0.0.1:" + plan2.port + " (mongosh on PATH)");
   }
 };
 
 // src/guest/databases/mysql.ts
-import path39 from "node:path";
+import path40 from "node:path";
 var MARIA = "https://downloads.mariadb.org/rest-api/mariadb/";
 var MysqlServer = class extends DatabaseServer {
   id = "mysql";
@@ -30309,8 +30360,8 @@ var MysqlServer = class extends DatabaseServer {
     };
     const version2 = await resolveCached("mariadb-version:" + series, async () => (await latest()).version);
     const home = tool("mariadb", version2);
-    const bin = path39.join(home, "bin");
-    if (!exists(path39.join(bin, "mariadbd.exe"))) {
+    const bin = path40.join(home, "bin");
+    if (!exists(path40.join(bin, "mariadbd.exe"))) {
       const { zip } = await latest();
       log("Downloading MariaDB " + version2 + " (~90 MB once) ...");
       await downloader.archive(zip.file_download_url.replace(/^http:/, "https:"), home, {
@@ -30323,13 +30374,13 @@ var MysqlServer = class extends DatabaseServer {
     const data = dataFor("mariadb");
     await createOnce(data, "mysql", async () => {
       log("Creating the MariaDB database (first start) ...");
-      await execAsync(path39.join(bin, "mariadb-install-db.exe"), ["--datadir=" + data, "--port=" + plan2.port], {
+      await execAsync(path40.join(bin, "mariadb-install-db.exe"), ["--datadir=" + data, "--port=" + plan2.port], {
         stdio: "ignore"
       });
     });
     await startServer(
       "mysql",
-      path39.join(bin, "mariadbd.exe"),
+      path40.join(bin, "mariadbd.exe"),
       ["--datadir=" + data, "--port=" + plan2.port, "--bind-address=127.0.0.1", "--console"],
       plan2.port
     );
@@ -30342,8 +30393,8 @@ var MysqlServer = class extends DatabaseServer {
 };
 
 // src/guest/databases/postgres.ts
-import fs32 from "node:fs";
-import path40 from "node:path";
+import fs33 from "node:fs";
+import path41 from "node:path";
 function postgresData(version2) {
   return dataFor("postgres-" + version2.split(".")[0]);
 }
@@ -30358,8 +30409,8 @@ var PostgresServer = class extends DatabaseServer {
       return hit ? hit.major + "." + hit.latestMinor : Promise.reject(new Error("No supported PostgreSQL " + plan2.version));
     });
     const home = tool("postgres", exact);
-    const bin = path40.join(home, "bin");
-    if (!exists(path40.join(bin, "pg_ctl.exe"))) {
+    const bin = path41.join(home, "bin");
+    if (!exists(path41.join(bin, "pg_ctl.exe"))) {
       log("Downloading PostgreSQL " + exact + " (~330 MB once) ...");
       await downloader.archive(
         "https://get.enterprisedb.com/postgresql/postgresql-" + exact + "-1-windows-x64-binaries.zip",
@@ -30376,7 +30427,7 @@ var PostgresServer = class extends DatabaseServer {
     await createOnce(data, "PG_VERSION", async () => {
       log("Creating the PostgreSQL database (first start) ...");
       await execAsync(
-        path40.join(bin, "initdb.exe"),
+        path41.join(bin, "initdb.exe"),
         ["-D", data, "-U", "postgres", "-A", "trust", "-E", "UTF8", "--locale=C"],
         { stdio: "ignore" }
       );
@@ -30385,7 +30436,7 @@ var PostgresServer = class extends DatabaseServer {
       throw new Error("port " + plan2.port + " is already in use (change databases.postgres.port)");
     await clearStaleLocks(data, ["postmaster.pid"], plan2.port);
     await execAsync(
-      path40.join(bin, "pg_ctl.exe"),
+      path41.join(bin, "pg_ctl.exe"),
       [
         "start",
         "-D",
@@ -30394,7 +30445,7 @@ var PostgresServer = class extends DatabaseServer {
         "-t",
         "60",
         "-l",
-        path40.join(logsDir, "postgres.log"),
+        path41.join(logsDir, "postgres.log"),
         "-o",
         "-p " + plan2.port + " -c listen_addresses=localhost"
       ],
@@ -30409,10 +30460,10 @@ var PostgresServer = class extends DatabaseServer {
   /** Every installed version's cluster shuts down cleanly through pg_ctl first. */
   async stop(plan2) {
     if (exists(tool("postgres"))) {
-      for (const version2 of fs32.readdirSync(tool("postgres"))) {
+      for (const version2 of fs33.readdirSync(tool("postgres"))) {
         const data = postgresData(version2);
-        const pgCtl = path40.join(tool("postgres", version2), "bin", "pg_ctl.exe");
-        if (exists(path40.join(data, "postmaster.pid")) && exists(pgCtl))
+        const pgCtl = path41.join(tool("postgres", version2), "bin", "pg_ctl.exe");
+        if (exists(path41.join(data, "postmaster.pid")) && exists(pgCtl))
           await execAsync(pgCtl, ["stop", "-D", data, "-m", "fast", "-w"], { stdio: "ignore" });
       }
     }
@@ -30421,12 +30472,12 @@ var PostgresServer = class extends DatabaseServer {
 };
 
 // src/guest/databases/redis.ts
-import path41 from "node:path";
+import path42 from "node:path";
 var RedisServer = class extends DatabaseServer {
   id = "redis";
   async start(env, plan2) {
     const home = tool("redis");
-    if (!exists(path41.join(home, "redis-server.exe"))) {
+    if (!exists(path42.join(home, "redis-server.exe"))) {
       await installFromGithub("redis-windows/redis-windows", /^Redis-[\d.]+-Windows-x64-msys2\.zip$/, {
         dest: home,
         what: (a) => "Redis (" + a.name + ", ~10 MB once)",
@@ -30436,7 +30487,7 @@ var RedisServer = class extends DatabaseServer {
     const data = mkdirp(dataFor("redis"));
     await startServer(
       "redis",
-      path41.join(home, "redis-server.exe"),
+      path42.join(home, "redis-server.exe"),
       ["--port", String(plan2.port), "--bind", "127.0.0.1", "--dir", data.replace(/\\/g, "/"), "--appendonly", "yes"],
       plan2.port
     );
@@ -30474,16 +30525,16 @@ async function setupDatabase(env, plan2) {
 }
 
 // src/guest/toolchains/tools/git.ts
-import fs34 from "node:fs";
-import path43 from "node:path";
+import fs35 from "node:fs";
+import path44 from "node:path";
 
 // src/guest/runtime/csc.ts
-import fs33 from "node:fs";
+import fs34 from "node:fs";
 import os6 from "node:os";
-import path42 from "node:path";
+import path43 from "node:path";
 import crypto3 from "node:crypto";
 import { spawnSync as spawnSync5 } from "node:child_process";
-var CSC = path42.join(process.env.WINDIR ?? "C:\\Windows", "Microsoft.NET", "Framework64", "v4.0.30319", "csc.exe");
+var CSC = path43.join(process.env.WINDIR ?? "C:\\Windows", "Microsoft.NET", "Framework64", "v4.0.30319", "csc.exe");
 var SOURCES = {
   ptyhost: "PtyHost.cs",
   gitshim: "GitShim.cs",
@@ -30496,17 +30547,17 @@ var SOURCES = {
   bindmount: "BindMount.cs"
 };
 function sourceOf(name) {
-  return path42.join(launchDir, "sandbox", "csharp", SOURCES[name]);
+  return path43.join(launchDir, "sandbox", "csharp", SOURCES[name]);
 }
 function sourceHash(name) {
-  return crypto3.createHash("sha256").update(fs33.readFileSync(sourceOf(name))).digest("hex").slice(0, 12);
+  return crypto3.createHash("sha256").update(fs34.readFileSync(sourceOf(name))).digest("hex").slice(0, 12);
 }
 function ensureCompiled(name) {
-  const exe = path42.join(os6.tmpdir(), "agent-sandbox", name + "-" + sourceHash(name) + ".exe");
+  const exe = path43.join(os6.tmpdir(), "agent-sandbox", name + "-" + sourceHash(name) + ".exe");
   if (exists(exe)) return exe;
   if (!exists(CSC))
     throw new Error("The .NET Framework C# compiler was not found at " + CSC + " (it ships with Windows 10/11).");
-  mkdirp(path42.dirname(exe));
+  mkdirp(path43.dirname(exe));
   const result = spawnSync5(CSC, ["/nologo", "/optimize", "/target:exe", "/out:" + exe, sourceOf(name)], {
     encoding: "utf8",
     windowsHide: true
@@ -30540,23 +30591,23 @@ var installPortableGit = async (root) => {
     await downloader.file(asset.url, sfx, asset.sha256);
     await execAsync(sfx, ["-o" + root, "-y"], { stdio: "ignore" });
   } finally {
-    fs34.rmSync(sfx, { force: true });
+    fs35.rmSync(sfx, { force: true });
   }
 };
 var installGuard = (env, access, realGit) => {
   const dir = mkdirp(tool("gitguard"));
-  const guard = path43.join(launchDir, "runtime", "gitguard.js");
-  if (duringSession() && (exists(path43.join(dir, "git.exe")) || exists(path43.join(dir, "git.cmd")))) {
+  const guard = path44.join(launchDir, "runtime", "gitguard.js");
+  if (duringSession() && (exists(path44.join(dir, "git.exe")) || exists(path44.join(dir, "git.cmd")))) {
   } else
     try {
-      fs34.copyFileSync(ensureCompiled("gitshim"), path43.join(dir, "git.exe"));
-      fs34.rmSync(path43.join(dir, "git.cmd"), { force: true });
+      fs35.copyFileSync(ensureCompiled("gitshim"), path44.join(dir, "git.exe"));
+      fs35.rmSync(path44.join(dir, "git.cmd"), { force: true });
     } catch (e) {
       warn("git guard: falling back to git.cmd (" + errMsg(e) + ")");
-      fs34.writeFileSync(path43.join(dir, "git.cmd"), '@"' + process.execPath + '" "' + guard + '" %*\r\n');
+      fs35.writeFileSync(path44.join(dir, "git.cmd"), '@"' + process.execPath + '" "' + guard + '" %*\r\n');
     }
-  fs34.writeFileSync(
-    path43.join(dir, "bashenv.sh"),
+  fs35.writeFileSync(
+    path44.join(dir, "bashenv.sh"),
     'git() { "' + posix(process.execPath) + '" "' + posix(guard) + '" "$@"; }\nexport -f git\n'
   );
   env.prepend.unshift(dir);
@@ -30565,13 +30616,13 @@ var installGuard = (env, access, realGit) => {
     AGENT_REAL_GIT: access === "readonly" ? realGit : "",
     AGENT_GUARD_NODE: process.execPath,
     AGENT_GUARD_SCRIPT: guard,
-    BASH_ENV: posix(path43.join(dir, "bashenv.sh"))
+    BASH_ENV: posix(path44.join(dir, "bashenv.sh"))
   });
   if (access === "readonly") {
-    const hooks = mkdirp(path43.join(dir, "hooks"));
+    const hooks = mkdirp(path44.join(dir, "hooks"));
     for (const hook of BLOCKED_HOOKS)
-      fs34.writeFileSync(
-        path43.join(hooks, hook),
+      fs35.writeFileSync(
+        path44.join(hooks, hook),
         '#!/bin/sh\necho "git is read-only in this sandbox: ' + hook + ' refused." >&2\nexit 1\n'
       );
     Object.assign(env.vars, {
@@ -30580,22 +30631,22 @@ var installGuard = (env, access, realGit) => {
       GIT_CONFIG_VALUE_0: posix(hooks)
     });
   } else {
-    env.vars.GIT_DIR = path43.join(dataDir, "git-disabled");
+    env.vars.GIT_DIR = path44.join(dataDir, "git-disabled");
   }
 };
 var pointAtOwnCertificates = (root) => {
-  const config2 = path43.join(root, "etc", "gitconfig");
-  const bundle = path43.join(root, "mingw64", "etc", "ssl", "certs", "ca-bundle.crt");
+  const config2 = path44.join(root, "etc", "gitconfig");
+  const bundle = path44.join(root, "mingw64", "etc", "ssl", "certs", "ca-bundle.crt");
   if (!exists(config2) || !exists(bundle)) return;
-  const text = fs34.readFileSync(config2, "utf8");
+  const text = fs35.readFileSync(config2, "utf8");
   const fixed = text.replace(/^(\s*sslCAInfo\s*=\s*).*$/gim, (_m, key2) => key2 + posix(bundle));
-  if (fixed !== text) fs34.writeFileSync(config2, fixed);
+  if (fixed !== text) fs35.writeFileSync(config2, fixed);
 };
 async function setupGit(env, hostCopy, refresh, access) {
   const root = tool("git");
-  const bash = path43.join(root, "bin", "bash.exe");
-  const gitExe = path43.join(root, "cmd", "git.exe");
-  const hostGit = path43.join(hostToolsDir, "git");
+  const bash = path44.join(root, "bin", "bash.exe");
+  const gitExe = path44.join(root, "cmd", "git.exe");
+  const hostGit = path44.join(hostToolsDir, "git");
   if (exists(root) && !exists(bash)) {
     log("Replacing the old MinGit (no bash) with full Git for Windows.");
     safeRemove(root, toolsDir);
@@ -30609,11 +30660,11 @@ async function setupGit(env, hostCopy, refresh, access) {
     }
     const work = stagingFolder(root);
     try {
-      if (hostCopy && exists(path43.join(hostGit, "bin", "bash.exe"))) {
+      if (hostCopy && exists(path44.join(hostGit, "bin", "bash.exe"))) {
         log("Copying Git for Windows from this PC ...");
         robocopy(hostGit, work);
       } else await installPortableGit(work);
-      if (!exists(path43.join(work, "bin", "bash.exe"))) throw new Error("bash.exe missing after installing Git");
+      if (!exists(path44.join(work, "bin", "bash.exe"))) throw new Error("bash.exe missing after installing Git");
       moveIntoPlace(work, root);
     } finally {
       safeRemove(work, toolsDir);
@@ -30622,10 +30673,10 @@ async function setupGit(env, hostCopy, refresh, access) {
   if (!exists(bash)) throw new Error("bash.exe missing after installing Git");
   pointAtOwnCertificates(root);
   env.vars.CLAUDE_CODE_GIT_BASH_PATH = bash;
-  env.append.push(path43.join(root, "usr", "bin"));
+  env.append.push(path44.join(root, "usr", "bin"));
   const version2 = execOutput(gitExe, ["--version"]).replace(/^git version /, "");
   if (access === "full") {
-    env.prepend.push(path43.join(root, "cmd"));
+    env.prepend.push(path44.join(root, "cmd"));
     env.summary.push("git: " + version2);
     return;
   }
@@ -30636,8 +30687,8 @@ async function setupGit(env, hostCopy, refresh, access) {
 }
 
 // src/guest/toolchains/languages/go.ts
-import fs35 from "node:fs";
-import path44 from "node:path";
+import fs36 from "node:fs";
+import path45 from "node:path";
 
 // src/guest/toolchains/package-ledger.ts
 var LedgerSchema = external_exports.record(external_exports.string(), external_exports.string());
@@ -30691,7 +30742,7 @@ async function setupGo(env, config2) {
   }
   const version2 = await resolveCached("go:" + config2.version, async () => (await findRelease(config2.version)).version);
   const root = tool("go", version2);
-  if (!exists(path44.join(root, "bin", "go.exe"))) {
+  if (!exists(path45.join(root, "bin", "go.exe"))) {
     const goArch = arch === "arm64" ? "arm64" : "amd64";
     const file3 = (await findRelease(version2)).files.find(
       (f) => f.os === "windows" && f.arch === goArch && f.kind === "archive"
@@ -30708,16 +30759,16 @@ async function setupGo(env, config2) {
   const vars = {
     GOROOT: root,
     GOPATH,
-    GOBIN: path44.join(GOPATH, "bin"),
-    GOMODCACHE: path44.join(GOPATH, "pkg", "mod"),
+    GOBIN: path45.join(GOPATH, "bin"),
+    GOMODCACHE: path45.join(GOPATH, "pkg", "mod"),
     GOCACHE: tool("go-cache"),
     GOTOOLCHAIN: "auto",
     GOTELEMETRY: "off"
   };
-  fs35.mkdirSync(vars.GOBIN, { recursive: true });
+  fs36.mkdirSync(vars.GOBIN, { recursive: true });
   Object.assign(env.vars, vars);
-  env.prepend.push(path44.join(root, "bin"), vars.GOBIN);
-  const go = path44.join(root, "bin", "go.exe");
+  env.prepend.push(path45.join(root, "bin"), vars.GOBIN);
+  const go = path45.join(root, "bin", "go.exe");
   env.summary.push("go: " + versionOf(go, ["version"]));
   await installOnce(
     env,
@@ -30728,8 +30779,8 @@ async function setupGo(env, config2) {
 }
 
 // src/guest/toolchains/tools/cli.ts
-import fs36 from "node:fs";
-import path45 from "node:path";
+import fs37 from "node:fs";
+import path46 from "node:path";
 
 // src/guest/toolchains/catalogue.ts
 function pwshAsset(arch2) {
@@ -30777,15 +30828,15 @@ function decideCli(settings, ctx) {
 
 // src/guest/toolchains/tools/cli.ts
 function ghConfigDir() {
-  return path45.join(stateDir, "gh");
+  return path46.join(stateDir, "gh");
 }
 function deliveredGhConfigDir() {
-  return path45.join(localDir, "gh-token");
+  return path46.join(localDir, "gh-token");
 }
 var GH_NOTE = " (log in once with: gh auth login --web --insecure-storage; it is kept between sandboxes)";
 function warnKeyringLogin() {
   try {
-    const hosts = fs36.readFileSync(path45.join(ghConfigDir(), "hosts.yml"), "utf8");
+    const hosts = fs37.readFileSync(path46.join(ghConfigDir(), "hosts.yml"), "utf8");
     if (/^\s*user:/m.test(hosts) && !/oauth_token:/.test(hosts))
       warn(
         "gh: the GitHub login from an earlier sandbox was kept in Windows Credential Manager, which is wiped with each sandbox. Log in again with: gh auth login --web --insecure-storage (then it lasts)."
@@ -30806,16 +30857,16 @@ var shimOpenssl = (env) => {
     return;
   }
   const shims = mkdirp(tool("shims"));
-  fs36.copyFileSync(ensureCompiled("openssl"), path45.join(shims, "openssl.exe"));
-  fs36.rmSync(path45.join(shims, "openssl.cmd"), { force: true });
+  fs37.copyFileSync(ensureCompiled("openssl"), path46.join(shims, "openssl.exe"));
+  fs37.rmSync(path46.join(shims, "openssl.cmd"), { force: true });
   env.prepend.push(shims);
   env.summary.push("openssl: Git for Windows' copy");
 };
 async function setupCli(env, settings, gitAccess, refresh = false) {
-  const decisions = decideCli(settings, { gitAccess, hasGithubDir: exists(path45.join(projectWorkspace(), ".github")) });
+  const decisions = decideCli(settings, { gitAccess, hasGithubDir: exists(path46.join(projectWorkspace(), ".github")) });
   if (settings.gh && !decisions.gh.on) {
     env.summary.push("gh: off (" + decisions.gh.reason + ")");
-    if (exists(path45.join(ghConfigDir(), "hosts.yml")))
+    if (exists(path46.join(ghConfigDir(), "hosts.yml")))
       warn(
         'gh is off (git access is not "full"), but an earlier gh login is still stored in ' + ghConfigDir() + " and readable by the agent. Run `gh auth logout` in a full-access sandbox, or delete that folder."
       );
@@ -30854,12 +30905,12 @@ async function setupCli(env, settings, gitAccess, refresh = false) {
 }
 
 // src/guest/toolchains/managers.ts
-import fs37 from "node:fs";
-import path46 from "node:path";
+import fs38 from "node:fs";
+import path47 from "node:path";
 function voltaPins() {
   try {
     const pkg = JSON.parse(
-      fs37.readFileSync(path46.join(projectWorkspace(), "package.json"), "utf8").replace(/^\uFEFF/, "")
+      fs38.readFileSync(path47.join(projectWorkspace(), "package.json"), "utf8").replace(/^\uFEFF/, "")
     );
     return Object.fromEntries(
       Object.entries(pkg.volta ?? {}).filter(
@@ -30882,7 +30933,7 @@ async function setupVolta(env) {
     return;
   }
   const dir = tool("volta");
-  if (!exists(path46.join(dir, "volta.exe"))) {
+  if (!exists(path47.join(dir, "volta.exe"))) {
     const pattern = arch === "arm64" ? /^volta-[\d.]+-windows-arm64\.zip$/ : /^volta-[\d.]+-windows\.zip$/;
     await installFromGithub("volta-cli/volta", pattern, {
       dest: dir,
@@ -30891,17 +30942,17 @@ async function setupVolta(env) {
     });
   }
   for (const shim3 of ["node", "npm", "npx", "pnpm", "pnpx", "yarn", "yarnpkg"]) {
-    const target = path46.join(dir, shim3 + ".exe");
-    if (!exists(target)) fs37.copyFileSync(path46.join(dir, "volta-shim.exe"), target);
+    const target = path47.join(dir, shim3 + ".exe");
+    if (!exists(target)) fs38.copyFileSync(path47.join(dir, "volta-shim.exe"), target);
   }
   const home = mkdirp(tool("volta-home"));
-  const shims = mkdirp(path46.join(home, "bin"));
+  const shims = mkdirp(path47.join(home, "bin"));
   const vars = { VOLTA_HOME: home, VOLTA_FEATURE_PNPM: "1" };
   Object.assign(env.vars, vars);
   const pins = voltaPins();
   if (Object.keys(pins).length) env.prepend.push(dir, shims);
   else env.append.push(dir, shims);
-  const volta = path46.join(dir, "volta.exe");
+  const volta = path47.join(dir, "volta.exe");
   for (const [toolName, version2] of Object.entries(pins)) {
     try {
       await execAsync(volta, ["install", toolName + "@" + version2], {
@@ -30923,7 +30974,7 @@ async function setupPyenv(env) {
     return;
   }
   const root = tool("pyenv", "pyenv-win");
-  if (!exists(path46.join(root, "bin", "pyenv.bat"))) {
+  if (!exists(path47.join(root, "bin", "pyenv.bat"))) {
     const tag = await resolveCached("pyenv-win", () => latestGithubTag("pyenv-win/pyenv-win"));
     log("Downloading pyenv-win " + tag + " (~5 MB once) ...");
     await downloader.archive(
@@ -30932,17 +30983,17 @@ async function setupPyenv(env) {
       { locate: "pyenv.bat", up: 1, fileName: "pyenv-win.zip" }
     );
   }
-  const home = root + path46.sep;
+  const home = root + path47.sep;
   Object.assign(env.vars, { PYENV: home, PYENV_ROOT: home, PYENV_HOME: home });
-  env.append.push(path46.join(root, "bin"), path46.join(root, "shims"));
+  env.append.push(path47.join(root, "bin"), path47.join(root, "shims"));
   env.summary.push("pyenv-win: pyenv install <version> / pyenv local <version> (versions persist)");
 }
 
 // src/guest/toolchains/native/cpp.ts
-import path47 from "node:path";
+import path48 from "node:path";
 async function setupCpp(env, config2) {
   const bin = tool("mingw", "mingw64", "bin");
-  const gcc = path47.join(bin, "gcc.exe");
+  const gcc = path48.join(bin, "gcc.exe");
   if (dryRun) {
     log("(dry run) would provision MinGW-w64 GCC");
     return;
@@ -30958,7 +31009,7 @@ async function setupCpp(env, config2) {
   if (!exists(gcc)) throw new Error("gcc.exe missing after installing MinGW");
   env.append.unshift(bin);
   env.vars.CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER = gcc;
-  const cmake = versionOf(path47.join(bin, "cmake.exe"));
+  const cmake = versionOf(path48.join(bin, "cmake.exe"));
   if (cmakeTooOld(cmake))
     warn(
       "The bundled CMake " + cmake + " is older than " + CMAKE_FLOOR + ", which many projects need; set toolchains.cpp.enabled to refresh it, or install a newer CMake into C:\\AgentData\\tools\\bin."
@@ -30968,7 +31019,7 @@ async function setupCpp(env, config2) {
 }
 var setupFlexBison = async (env) => {
   const dir = tool("winflexbison");
-  if (!exists(path47.join(dir, "win_bison.exe"))) {
+  if (!exists(path48.join(dir, "win_bison.exe"))) {
     await installFromGithub("lexxmark/winflexbison", /^win_flex_bison-[\d.]+\.zip$/, {
       dest: dir,
       what: "win_flex / win_bison (~1 MB once)",
@@ -30976,16 +31027,16 @@ var setupFlexBison = async (env) => {
     });
   }
   env.append.push(dir);
-  env.summary.push("win_flex/win_bison: " + versionOf(path47.join(dir, "win_bison.exe")));
+  env.summary.push("win_flex/win_bison: " + versionOf(path48.join(dir, "win_bison.exe")));
 };
 
 // src/guest/toolchains/native/dotnet.ts
-import fs38 from "node:fs";
-import path48 from "node:path";
+import fs39 from "node:fs";
+import path49 from "node:path";
 var DotnetMarkerSchema = external_exports.record(external_exports.string(), external_exports.boolean());
 async function setupDotnet(env, config2, refresh) {
   const root = tool("dotnet");
-  const marker = path48.join(root, ".agent-sandbox-installed.json");
+  const marker = path49.join(root, ".agent-sandbox-installed.json");
   const script = tool("dotnet-install.ps1");
   if (dryRun) {
     log("(dry run) would provision .NET SDK channels " + config2.channels.join(", "));
@@ -30993,11 +31044,11 @@ async function setupDotnet(env, config2, refresh) {
   }
   const recorded = DotnetMarkerSchema.safeParse(exists(marker) && !refresh ? readJsonFile(marker) : {});
   const done = recorded.success ? recorded.data : {};
-  const globalJson = path48.join(projectWorkspace(), "global.json");
+  const globalJson = path49.join(projectWorkspace(), "global.json");
   const installs = [
     ...config2.channels.map((c) => ["channel:" + c, ["-Channel", c]]),
     ...exists(globalJson) ? [
-      ["global.json:" + fs38.readFileSync(globalJson, "utf8").replace(/\s+/g, ""), ["-JSonFile", globalJson]]
+      ["global.json:" + fs39.readFileSync(globalJson, "utf8").replace(/\s+/g, ""), ["-JSonFile", globalJson]]
     ] : []
   ];
   for (const [key2, args] of installs.filter(([k]) => !done[k])) {
@@ -31029,12 +31080,12 @@ async function setupDotnet(env, config2, refresh) {
     DOTNET_SKIP_FIRST_TIME_EXPERIENCE: "1",
     NUGET_PACKAGES: tool("nuget", "packages")
   });
-  env.prepend.push(root, path48.join(home, ".dotnet", "tools"));
+  env.prepend.push(root, path49.join(home, ".dotnet", "tools"));
   env.summary.push(
-    "dotnet: " + execOutput(path48.join(root, "dotnet.exe"), ["--list-sdks"]).split(/\r?\n/).map((l) => l.split(" ")[0]).filter(Boolean).join(", ")
+    "dotnet: " + execOutput(path49.join(root, "dotnet.exe"), ["--list-sdks"]).split(/\r?\n/).map((l) => l.split(" ")[0]).filter(Boolean).join(", ")
   );
-  const dotnet = path48.join(root, "dotnet.exe");
-  const dotnetEnv = { env: { ...process.env, ...env.vars, PATH: root + path48.delimiter + (process.env.PATH ?? "") } };
+  const dotnet = path49.join(root, "dotnet.exe");
+  const dotnetEnv = { env: { ...process.env, ...env.vars, PATH: root + path49.delimiter + (process.env.PATH ?? "") } };
   await installOnce(
     env,
     "dotnet workload",
@@ -31055,7 +31106,7 @@ var setupFrameworkReferences = async (env, targets) => {
   const root = tool("netfx-references");
   for (const target of targets) {
     const id = "microsoft.netframework.referenceassemblies." + target.toLowerCase();
-    const marker = path48.join(root, ".installed-" + target.toLowerCase());
+    const marker = path49.join(root, ".installed-" + target.toLowerCase());
     if (exists(marker)) continue;
     const staging = tool("netfx-references-" + target.toLowerCase());
     try {
@@ -31070,8 +31121,8 @@ var setupFrameworkReferences = async (env, targets) => {
         staging,
         { fileName: id + ".zip" }
       );
-      fs38.cpSync(path48.join(staging, "build", ".NETFramework"), path48.join(root, ".NETFramework"), { recursive: true });
-      fs38.writeFileSync(marker, version2);
+      fs39.cpSync(path49.join(staging, "build", ".NETFramework"), path49.join(root, ".NETFramework"), { recursive: true });
+      fs39.writeFileSync(marker, version2);
     } catch (e) {
       warn(
         ".NET Framework " + target + " reference assemblies could not be installed (projects targeting it will not build): " + errMsg(e)
@@ -31080,9 +31131,9 @@ var setupFrameworkReferences = async (env, targets) => {
       safeRemove(staging, dataDir);
     }
   }
-  if (!exists(path48.join(root, ".NETFramework"))) return;
-  env.vars.TargetFrameworkRootPath = root + path48.sep;
-  env.summary.push(".NET Framework targeting: " + fs38.readdirSync(path48.join(root, ".NETFramework")).join(", "));
+  if (!exists(path49.join(root, ".NETFramework"))) return;
+  env.vars.TargetFrameworkRootPath = root + path49.sep;
+  env.summary.push(".NET Framework targeting: " + fs39.readdirSync(path49.join(root, ".NETFramework")).join(", "));
 };
 var setupNetFx35 = async (env) => {
   if (execOutput(SYSTEM.reg(), [
@@ -31109,15 +31160,15 @@ var setupNetFx35 = async (env) => {
 };
 
 // src/guest/toolchains/native/mesa.ts
-import path49 from "node:path";
+import path50 from "node:path";
 async function setupMesa(env, config2) {
   if (dryRun) {
     log("(dry run) would provision Mesa 3D");
     return;
   }
   const root = tool("mesa");
-  const dir = path49.join(root, arch === "arm64" ? "arm64" : "x64");
-  if (!exists(path49.join(dir, "opengl32.dll"))) {
+  const dir = path50.join(root, arch === "arm64" ? "arm64" : "x64");
+  if (!exists(path50.join(dir, "opengl32.dll"))) {
     await installFromGithub("pal1000/mesa-dist-win", /^mesa3d-[\d.]+-release-msvc\.7z$/, {
       dest: root,
       what: "Mesa 3D for software OpenGL (~100 MB once)",
@@ -31133,10 +31184,10 @@ async function setupMesa(env, config2) {
 }
 var VULKAN_RUNTIME = "https://sdk.lunarg.com/sdk/download/latest/windows/vulkan-runtime-components.zip";
 var setupLavapipe = async (env, mesaDir) => {
-  const icd = path49.join(mesaDir, arch === "arm64" ? "lvp_icd.aarch64.json" : "lvp_icd.x86_64.json");
-  if (!exists(icd)) throw new Error("this Mesa build has no lavapipe (" + path49.basename(icd) + ")");
+  const icd = path50.join(mesaDir, arch === "arm64" ? "lvp_icd.aarch64.json" : "lvp_icd.x86_64.json");
+  if (!exists(icd)) throw new Error("this Mesa build has no lavapipe (" + path50.basename(icd) + ")");
   const dir = tool("vulkan");
-  if (!exists(path49.join(dir, "vulkan-1.dll"))) {
+  if (!exists(path50.join(dir, "vulkan-1.dll"))) {
     log("Downloading the Vulkan loader (~10 MB once) ...");
     await downloader.archive(VULKAN_RUNTIME, dir, {
       locate: "vulkan-1.dll",
@@ -31150,7 +31201,7 @@ var setupLavapipe = async (env, mesaDir) => {
     { stdio: "ignore" }
   );
   await register(icd);
-  const dozen = path49.join(mesaDir, arch === "arm64" ? "dzn_icd.aarch64.json" : "dzn_icd.x86_64.json");
+  const dozen = path50.join(mesaDir, arch === "arm64" ? "dzn_icd.aarch64.json" : "dzn_icd.x86_64.json");
   const gpu = hasGpu();
   if (gpu && exists(dozen)) await register(dozen);
   env.prepend.push(dir);
@@ -31161,20 +31212,20 @@ var setupLavapipe = async (env, mesaDir) => {
 var hasGpu = () => scriptOutput("get-gpu-names.ps1", [], { timeout: 3e4 }).split(/\r?\n/).map((n) => n.trim()).some((n) => n && !/^Microsoft (Remote Display|Basic (Render|Display))/i.test(n));
 
 // src/guest/toolchains/native/msvc/index.ts
-import fs42 from "node:fs";
-import path53 from "node:path";
+import fs43 from "node:fs";
+import path54 from "node:path";
 
 // src/guest/toolchains/native/msvc/environment.ts
-import fs40 from "node:fs";
-import path51 from "node:path";
+import fs41 from "node:fs";
+import path52 from "node:path";
 
 // src/guest/toolchains/native/msvc/tree.ts
-import fs39 from "node:fs";
-import path50 from "node:path";
+import fs40 from "node:fs";
+import path51 from "node:path";
 var ROOT = tool("msvc");
-var MARKER2 = path50.join(ROOT, ".installed.json");
+var MARKER2 = path51.join(ROOT, ".installed.json");
 function msvcTools(msvc, ...parts2) {
-  return path50.join(ROOT, "VC", "Tools", "MSVC", msvc, ...parts2);
+  return path51.join(ROOT, "VC", "Tools", "MSVC", msvc, ...parts2);
 }
 function hostBin(msvc, ...parts2) {
   return msvcTools(msvc, "bin", "Hostx64", "x64", ...parts2);
@@ -31185,27 +31236,27 @@ function hasCompiler(msvc) {
 var InstalledSchema = external_exports.object({ msvc: external_exports.string().min(1), sdk: external_exports.string().min(1), want: external_exports.string() });
 function readInstalled() {
   try {
-    return InstalledSchema.safeParse(JSON.parse(fs39.readFileSync(MARKER2, "utf8"))).data ?? null;
+    return InstalledSchema.safeParse(JSON.parse(fs40.readFileSync(MARKER2, "utf8"))).data ?? null;
   } catch {
     return null;
   }
 }
 
 // src/guest/toolchains/native/msvc/environment.ts
-var VSWHERE_DIR = path51.join(
+var VSWHERE_DIR = path52.join(
   process.env["ProgramFiles(x86)"] ?? "C:\\Program Files (x86)",
   "Microsoft Visual Studio",
   "Installer"
 );
 function vcvars(root, msvc, sdk) {
-  const vc = path51.join(root, "VC", "Tools", "MSVC", msvc);
-  const kits = path51.join(root, "Windows Kits", "10");
-  const inc = (...p) => path51.join(kits, "Include", sdk, ...p);
-  const lib = (...p) => path51.join(kits, "Lib", sdk, ...p);
+  const vc = path52.join(root, "VC", "Tools", "MSVC", msvc);
+  const kits = path52.join(root, "Windows Kits", "10");
+  const inc = (...p) => path52.join(kits, "Include", sdk, ...p);
+  const lib = (...p) => path52.join(kits, "Lib", sdk, ...p);
   return {
     vars: {
       VSINSTALLDIR: root + "\\",
-      VCINSTALLDIR: path51.join(root, "VC") + "\\",
+      VCINSTALLDIR: path52.join(root, "VC") + "\\",
       VCToolsInstallDir: vc + "\\",
       VCToolsVersion: msvc,
       VisualStudioVersion: "17.0",
@@ -31217,17 +31268,17 @@ function vcvars(root, msvc, sdk) {
       VSCMD_ARG_HOST_ARCH: "x64",
       VSCMD_ARG_TGT_ARCH: "x64",
       Platform: "x64",
-      INCLUDE: [path51.join(vc, "include"), inc("ucrt"), inc("shared"), inc("um"), inc("winrt"), inc("cppwinrt")].join(
+      INCLUDE: [path52.join(vc, "include"), inc("ucrt"), inc("shared"), inc("um"), inc("winrt"), inc("cppwinrt")].join(
         ";"
       ),
-      LIB: [path51.join(vc, "lib", "x64"), lib("ucrt", "x64"), lib("um", "x64")].join(";"),
-      LIBPATH: [path51.join(vc, "lib", "x64"), path51.join(vc, "lib", "x86", "store", "references")].join(";")
+      LIB: [path52.join(vc, "lib", "x64"), lib("ucrt", "x64"), lib("um", "x64")].join(";"),
+      LIBPATH: [path52.join(vc, "lib", "x64"), path52.join(vc, "lib", "x86", "store", "references")].join(";")
     },
-    path: [path51.join(vc, "bin", "Hostx64", "x64"), path51.join(kits, "bin", sdk, "x64")]
+    path: [path52.join(vc, "bin", "Hostx64", "x64"), path52.join(kits, "bin", sdk, "x64")]
   };
 }
 function writeVcvars(env) {
-  const dir = mkdirp(path51.join(ROOT, "VC", "Auxiliary", "Build"));
+  const dir = mkdirp(path52.join(ROOT, "VC", "Auxiliary", "Build"));
   const lines = [
     "@echo off",
     "rem Written by Windows Development Sandbox for its portable MSVC (host x64, target x64).",
@@ -31235,9 +31286,9 @@ function writeVcvars(env) {
     'set "PATH=' + env.path.join(";") + ';%PATH%"',
     "exit /b 0"
   ];
-  fs40.writeFileSync(path51.join(dir, "vcvars64.bat"), lines.join("\r\n") + "\r\n");
-  fs40.writeFileSync(
-    path51.join(dir, "vcvarsall.bat"),
+  fs41.writeFileSync(path52.join(dir, "vcvars64.bat"), lines.join("\r\n") + "\r\n");
+  fs41.writeFileSync(
+    path52.join(dir, "vcvarsall.bat"),
     ["@echo off", "rem Only x64 (amd64) is installed.", 'call "%~dp0vcvars64.bat"', "exit /b %errorlevel%"].join(
       "\r\n"
     ) + "\r\n"
@@ -31245,24 +31296,24 @@ function writeVcvars(env) {
 }
 function installVswhere(msvc) {
   mkdirp(VSWHERE_DIR);
-  fs40.copyFileSync(ensureCompiled("vswhere"), path51.join(VSWHERE_DIR, "vswhere.exe"));
+  fs41.copyFileSync(ensureCompiled("vswhere"), path52.join(VSWHERE_DIR, "vswhere.exe"));
   const [major, minor] = msvc.split(".").slice(2);
-  fs40.writeFileSync(
-    path51.join(VSWHERE_DIR, "vswhere.json"),
+  fs41.writeFileSync(
+    path52.join(VSWHERE_DIR, "vswhere.json"),
     JSON.stringify({ installationPath: ROOT, installationVersion: "17." + (minor ?? "0") + ".0." + (major ?? "0") })
   );
 }
 function removeTelemetry(msvc) {
   try {
-    fs40.rmSync(hostBin(msvc, "vctip.exe"), { force: true });
+    fs41.rmSync(hostBin(msvc, "vctip.exe"), { force: true });
   } catch (e) {
     warn("Could not remove MSVC's telemetry helper (vctip.exe); it may keep tools\\msvc locked: " + errMsg(e));
   }
 }
 
 // src/guest/toolchains/native/msvc/packages.ts
-import fs41 from "node:fs";
-import path52 from "node:path";
+import fs42 from "node:fs";
+import path53 from "node:path";
 var CHANNEL = "https://aka.ms/vs/17/release/channel";
 var MANIFEST_DAY_MS = 24 * 60 * 60 * 1e3;
 var MSVC_PARTS = [
@@ -31288,10 +31339,10 @@ var SDK_MSIS = [
   "Windows SDK Desktop Tools x64-x86_en-us.msi"
 ];
 var manifest = async () => {
-  const cached2 = path52.join(ROOT, ".manifest.json");
-  if (exists(cached2) && Date.now() - fs41.statSync(cached2).mtimeMs < MANIFEST_DAY_MS) {
+  const cached2 = path53.join(ROOT, ".manifest.json");
+  if (exists(cached2) && Date.now() - fs42.statSync(cached2).mtimeMs < MANIFEST_DAY_MS) {
     try {
-      return JSON.parse(fs41.readFileSync(cached2, "utf8"));
+      return JSON.parse(fs42.readFileSync(cached2, "utf8"));
     } catch {
     }
   }
@@ -31300,26 +31351,26 @@ var manifest = async () => {
   if (!item) throw new Error("the Visual Studio channel has no package manifest");
   mkdirp(ROOT);
   await downloader.file(item.url, cached2);
-  return JSON.parse(fs41.readFileSync(cached2, "utf8"));
+  return JSON.parse(fs42.readFileSync(cached2, "utf8"));
 };
 var unpackVsix = async (vsix, work) => {
-  const out = mkdirp(path52.join(work, "vsix-" + path52.basename(vsix)));
+  const out = mkdirp(path53.join(work, "vsix-" + path53.basename(vsix)));
   await extractArchive(vsix, out, ["Contents"]);
   const decode4 = (dir) => {
-    for (const entry of fs41.readdirSync(dir, { withFileTypes: true })) {
-      const from = path52.join(dir, entry.name);
+    for (const entry of fs42.readdirSync(dir, { withFileTypes: true })) {
+      const from = path53.join(dir, entry.name);
       let name = entry.name;
       try {
         if (name.includes("%")) name = decodeURIComponent(name);
       } catch {
       }
-      const to = path52.join(dir, name);
-      if (to !== from) fs41.renameSync(from, to);
+      const to = path53.join(dir, name);
+      if (to !== from) fs42.renameSync(from, to);
       if (entry.isDirectory()) decode4(to);
     }
   };
   decode4(out);
-  fs41.cpSync(path52.join(out, "Contents"), ROOT, { recursive: true, force: true });
+  fs42.cpSync(path53.join(out, "Contents"), ROOT, { recursive: true, force: true });
   safeRemove(out, work);
 };
 var unpackMsi = async (msi) => {
@@ -31329,9 +31380,9 @@ var unpackMsi = async (msi) => {
       stdio: "ignore"
     });
   } catch (e) {
-    const lines = exists(logFile2) ? fs41.readFileSync(logFile2, "utf16le").split(/\r?\n/).filter((l) => /error|return value 3|failed/i.test(l)).slice(-4).join(" | ") : "";
+    const lines = exists(logFile2) ? fs42.readFileSync(logFile2, "utf16le").split(/\r?\n/).filter((l) => /error|return value 3|failed/i.test(l)).slice(-4).join(" | ") : "";
     throw new Error(
-      path52.basename(msi) + " did not unpack: " + (e instanceof Error ? e.message : String(e)) + (lines ? " (" + lines.slice(0, 600) + ")" : "")
+      path53.basename(msi) + " did not unpack: " + (e instanceof Error ? e.message : String(e)) + (lines ? " (" + lines.slice(0, 600) + ")" : "")
     );
   }
 };
@@ -31344,13 +31395,13 @@ var catalogue = (m) => {
   };
 };
 var payloadFetcher = (work) => async (p) => {
-  const file3 = path52.join(work, path52.basename(p.fileName.replace(/\\/g, "/")));
+  const file3 = path53.join(work, path53.basename(p.fileName.replace(/\\/g, "/")));
   if (!exists(file3)) await downloader.file(p.url, file3, p.sha256);
   return file3;
 };
 var unpackedToolset = () => {
-  const toolsRoot = path52.join(ROOT, "VC", "Tools", "MSVC");
-  return fs41.readdirSync(toolsRoot).filter((d) => exists(hostBin(d, "cl.exe"))).sort((a, b) => a.localeCompare(b, void 0, { numeric: true })).pop();
+  const toolsRoot = path53.join(ROOT, "VC", "Tools", "MSVC");
+  return fs42.readdirSync(toolsRoot).filter((d) => exists(hostBin(d, "cl.exe"))).sort((a, b) => a.localeCompare(b, void 0, { numeric: true })).pop();
 };
 async function installPackages(config2) {
   const { ids, pick: pick3 } = catalogue(await manifest());
@@ -31358,7 +31409,7 @@ async function installPackages(config2) {
   if (!version2) throw new Error("no MSVC " + config2.msvcVersion + " in the Visual Studio manifest");
   const sdk = pickWindowsSdk(ids, config2.sdkVersion);
   if (!sdk) throw new Error("no Windows SDK " + config2.sdkVersion + " in the Visual Studio manifest");
-  const work = mkdirp(path52.join(ROOT, ".download"));
+  const work = mkdirp(path53.join(ROOT, ".download"));
   const fetchPayload = payloadFetcher(work);
   log("Downloading the MSVC " + version2 + " compiler and C/C++ libraries ...");
   for (const part of MSVC_PARTS) {
@@ -31378,17 +31429,17 @@ async function installPackages(config2) {
     if (!p) throw new Error("the Windows SDK package has no " + name);
     const file3 = await fetchPayload(p);
     msis.push(file3);
-    for (const cab of msiCabs(fs41.readFileSync(file3))) {
+    for (const cab of msiCabs(fs42.readFileSync(file3))) {
       const c = payload(cab);
       if (c) await fetchPayload(c);
     }
   }
   log("Unpacking the Windows SDK (a few minutes) ...");
   for (const msi of msis) await unpackMsi(msi);
-  for (const name of fs41.readdirSync(ROOT).filter((n) => n.toLowerCase().endsWith(".msi")))
-    fs41.rmSync(path52.join(ROOT, name), { force: true });
+  for (const name of fs42.readdirSync(ROOT).filter((n) => n.toLowerCase().endsWith(".msi")))
+    fs42.rmSync(path53.join(ROOT, name), { force: true });
   safeRemove(work, ROOT);
-  const sdkVersion = fs41.readdirSync(path52.join(ROOT, "Windows Kits", "10", "Include")).filter((d) => d.startsWith("10.0." + sdk.build)).sort().pop();
+  const sdkVersion = fs42.readdirSync(path53.join(ROOT, "Windows Kits", "10", "Include")).filter((d) => d.startsWith("10.0." + sdk.build)).sort().pop();
   if (!sdkVersion) throw new Error("the Windows SDK did not unpack (no Include\\10.0." + sdk.build + ".*)");
   const toolset = unpackedToolset();
   if (!toolset) throw new Error("MSVC " + version2 + " did not unpack (no cl.exe under VC\\Tools\\MSVC)");
@@ -31402,8 +31453,8 @@ function installedMsvcEnv() {
 }
 var clearTree = () => {
   if (!exists(ROOT)) return;
-  for (const name of fs42.readdirSync(ROOT).filter((n) => n !== ".manifest.json" && n !== ".download"))
-    safeRemove(path53.join(ROOT, name), ROOT);
+  for (const name of fs43.readdirSync(ROOT).filter((n) => n !== ".manifest.json" && n !== ".download"))
+    safeRemove(path54.join(ROOT, name), ROOT);
 };
 async function setupMsvc(env, config2) {
   if (!config2.acceptLicense) {
@@ -31434,12 +31485,11 @@ async function setupMsvc(env, config2) {
 
 // src/guest/toolchains/native/unreal.ts
 import os8 from "node:os";
-import path57 from "node:path";
+import path59 from "node:path";
 
 // src/guest/toolchains/not-yet.ts
-function notAvailableYet(env, what) {
+function notAvailableYet(_env, what) {
   log(what + ": not available yet (nothing installed)");
-  env.summary.push(what + ": not available yet");
 }
 
 // src/guest/toolchains/engines/unreal-engines.ts
@@ -31451,49 +31501,35 @@ async function setupUnrealEngines(env, _config, _ctx) {
 import fs44 from "node:fs";
 import path55 from "node:path";
 
-// src/guest/toolchains/native/vcruntime.ts
-import fs43 from "node:fs";
-import path54 from "node:path";
-var VC_REDIST = "https://aka.ms/vs/17/release/vc_redist.x64.exe";
-var MICROSOFT_SIGNER = "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US";
-var OK_EXIT_CODES = [0, 1638, 3010];
-var signerOf = (file3) => scriptOutput("get-signer.ps1", ["-Path", file3]).trim();
-async function setupVcRuntime(env, summary = true) {
-  if (dryRun) {
-    log("(dry run) would install the Visual C++ runtime");
-    return false;
-  }
-  const system322 = path54.join(process.env.WINDIR ?? "C:\\Windows", "System32");
-  const missing = !exists(path54.join(system322, "vcruntime140.dll")) || !exists(path54.join(system322, "msvcp140.dll"));
-  if (missing) {
-    const installer = tool("vcredist", "vc_redist.x64.exe");
-    if (!exists(installer)) {
-      log("Downloading the Visual C++ runtime (~25 MB once) ...");
-      await downloadFile(VC_REDIST, installer);
-    }
-    if (signerOf(installer) !== MICROSOFT_SIGNER) {
-      fs43.rmSync(installer, { force: true });
-      throw new Error("vc_redist.x64.exe is not signed by Microsoft; deleted it (it is downloaded again next boot)");
-    }
-    log("Installing the Visual C++ runtime ...");
-    const code = await spawnAsync(installer, ["/install", "/quiet", "/norestart"]);
-    if (!OK_EXIT_CODES.includes(code ?? -1) || !exists(path54.join(system322, "vcruntime140.dll")))
-      throw new Error("the Visual C++ runtime installer failed (exit " + code + ")");
-  }
-  if (summary) env.summary.push("vc++ runtime: installed");
-  return missing;
+// src/shared/signer.ts
+function signerMatches(signature, signer) {
+  if (!signature || !signature.subject) return false;
+  const all = (text, patterns) => patterns.every((p) => new RegExp(p, "i").test(text));
+  return all(signature.subject, signer.subject) && all(signature.issuer, signer.issuer ?? []);
 }
-
-// src/guest/toolchains/installers.ts
 var SIGNERS = {
-  microsoft: MICROSOFT_SIGNER,
-  valve: /^CN="?Valve(,| Corp)/,
-  unity: /^CN="?Unity Technologies/
+  microsoft: { subject: ["^CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US$"] },
+  valve: { subject: ['^CN="?Valve(,| Corp)'] },
+  unity: { subject: ['^CN="?Unity Technologies'] }
 };
+
+// src/guest/toolchains/signature.ts
+var SignatureSchema = external_exports.object({ subject: external_exports.string().max(4096), issuer: external_exports.string().max(4096) });
+function signatureOf(file3) {
+  const text = scriptOutput("get-signature.ps1", ["-Path", file3]).trim();
+  if (!text) return null;
+  try {
+    const parsed = SignatureSchema.safeParse(JSON.parse(text));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
 function signedBy(file3, signer) {
-  const subject = signerOf(file3);
-  return typeof signer === "string" ? subject === signer : signer.test(subject);
+  return signerMatches(signatureOf(file3), signer);
 }
+
+// src/guest/toolchains/installers.ts
 function signatureCheck(signer, what) {
   return (file3) => {
     if (!signedBy(file3, signer)) throw new Error(what + " is not signed by its vendor");
@@ -31514,55 +31550,12 @@ async function signedInstaller(url2, file3, what, signer, sha256 = null) {
   return file3;
 }
 
-// src/guest/toolchains/native/visual-studio.ts
-import fs46 from "node:fs";
-import os7 from "node:os";
-import path56 from "node:path";
-
-// src/guest/toolchains/persisted.ts
+// src/guest/toolchains/native/autosdk.ts
 import fs45 from "node:fs";
-
-// src/shared/installs.ts
-var InstallRecordSchema = external_exports.object({
-  name: external_exports.string().max(100),
-  version: external_exports.string().max(100),
-  sizeBytes: external_exports.number().nonnegative().nullable(),
-  installedAt: external_exports.string().max(64),
-  usedAt: external_exports.string().max(64)
-});
-var InstallRecordsSchema = external_exports.object({ installs: external_exports.array(InstallRecordSchema).max(1e3) });
-
-// src/guest/toolchains/persisted.ts
-var GB = 1024 ** 3;
-var LOCAL_RESERVE_BYTES = 13 * GB;
-function freeBytes(dir, deps = {}) {
-  try {
-    const s = (deps.statfs ?? fs45.statfsSync)(dir);
-    return s.bavail * s.bsize;
-  } catch {
-    return 0;
-  }
-}
-var gb = (bytes) => (bytes / GB).toFixed(1) + " GB";
-function assertRoom(dir, needBytes, what, fix, deps = {}) {
-  const free = freeBytes(dir, deps);
-  if (free < needBytes)
-    throw new Error(
-      "not installing " + what + ": " + gb(free) + " free where it goes, it needs " + gb(needBytes) + ". " + fix
-    );
-}
-function assertLocalRoom(needBytes, what, deps = {}) {
-  const drive = deps.localDir ?? (process.env.SystemDrive ?? "C:") + "\\";
-  assertRoom(
-    drive,
-    needBytes + LOCAL_RESERVE_BYTES,
-    what,
-    "The sandbox's own disk also holds the paging file and every build: give the sandbox less to install, or a smaller sandbox.pageFileMb.",
-    deps
-  );
-}
+import path57 from "node:path";
 
 // src/guest/toolchains/native/vs-request.ts
+import path56 from "node:path";
 var UNREAL_COMPONENTS = [
   "Microsoft.VisualStudio.Workload.NativeGame",
   "Microsoft.VisualStudio.Component.VC.Tools.x86.x64",
@@ -31580,7 +31573,7 @@ var BUILD_TOOLS_COMPONENTS = [
 ];
 var isOn = (setting) => setting === true;
 function visualStudioWanted(t, on = isOn) {
-  const unreal = on(t.unreal.enabled, "unreal");
+  const unreal = on(t.unreal.enabled, "unreal") && t.unreal.visualStudio === "full";
   const flutter = on(t.flutter.enabled, "flutter") && t.flutter.windowsDesktop;
   const unity = on(t.unity.enabled, "unity") && t.unity.modules.includes("windows-il2cpp");
   const users = [...unreal ? ["unreal"] : [], ...flutter ? ["flutter"] : [], ...unity ? ["unity"] : []];
@@ -31601,6 +31594,122 @@ function visualStudioWanted(t, on = isOn) {
     accepted: t.msvc.acceptLicense
   };
 }
+function unrealUsesAutosdk(t, on = isOn) {
+  return on(t.unreal.enabled, "unreal") && t.unreal.visualStudio === "autosdk";
+}
+function vsExitText(code) {
+  const c = code >>> 0;
+  switch (c) {
+    case 0:
+      return "installed";
+    case 3010:
+      return "done; a restart would finish it (not needed here)";
+    case 1602:
+      return "cancelled";
+    case 5007:
+      return "the installer refused to run (blocked by Windows, for example a restart waiting)";
+    case 8006:
+      return "Visual Studio is running and must be closed first";
+    case 3762504530:
+      return "0xE0434352: the Visual Studio installer crashed";
+    default:
+      return "the installer failed with exit " + c + " (0x" + c.toString(16).toUpperCase() + ")";
+  }
+}
+var LAYOUT_STAGING_BYTES = 12 * 1024 ** 3;
+function layoutNextStep(exit, localFreeBytes, reserveBytes) {
+  if (exit !== null && (exit === 0 || exit === 3010)) return "done";
+  return localFreeBytes >= LAYOUT_STAGING_BYTES + reserveBytes ? "stage" : "skip";
+}
+function autosdkLayout(msvcRoot, msvc, sdk, autosdkRoot) {
+  const win64 = path56.win32.join(autosdkRoot, "HostWin64", "Win64");
+  return [
+    {
+      from: path56.win32.join(msvcRoot, "VC", "Tools", "MSVC", msvc),
+      to: path56.win32.join(win64, "VS2022", msvc)
+    },
+    ...["Include", "Lib", "bin"].map((part) => ({
+      from: path56.win32.join(msvcRoot, "Windows Kits", "10", part, sdk),
+      to: path56.win32.join(win64, "Windows Kits", "10", part, sdk)
+    }))
+  ];
+}
+
+// src/guest/toolchains/native/autosdk.ts
+var AUTOSDK_DIR = tool("unreal", "autosdk");
+var MARKER3 = path57.join(AUTOSDK_DIR, ".complete.json");
+var MarkerSchema = external_exports.object({ msvc: external_exports.string(), sdk: external_exports.string() });
+function builtFor(msvc, sdk) {
+  try {
+    const done = MarkerSchema.parse(JSON.parse(fs45.readFileSync(MARKER3, "utf8")));
+    return done.msvc === msvc && done.sdk === sdk;
+  } catch {
+    return false;
+  }
+}
+async function setupAutosdk(env) {
+  const msvc = readInstalled();
+  if (!msvc || !hasCompiler(msvc.msvc))
+    throw new Error(
+      'toolchains.unreal.visualStudio = "autosdk" builds from the portable MSVC, which is not installed (is toolchains.msvc off?)'
+    );
+  if (!builtFor(msvc.msvc, msvc.sdk)) {
+    log("Making the Unreal AutoSDK from MSVC " + msvc.msvc + " (~2 GB, once) ...");
+    fs45.rmSync(MARKER3, { force: true });
+    for (const pair of autosdkLayout(ROOT, msvc.msvc, msvc.sdk, AUTOSDK_DIR)) {
+      mkdirp(pair.to);
+      const code = await spawnAsync(SYSTEM.robocopy(), [pair.from, pair.to, "/E", "/COPY:DAT", "/R:1", "/W:1", "/NP"]);
+      if (robocopyFailed(code))
+        throw new Error("could not copy " + pair.from + " into the AutoSDK (robocopy " + code + ")");
+    }
+    writeJsonAtomic(MARKER3, { msvc: msvc.msvc, sdk: msvc.sdk });
+  }
+  if (!exists(MARKER3)) throw new Error("the Unreal AutoSDK was not completed");
+  env.vars["UE_SDKS_ROOT"] = AUTOSDK_DIR;
+  env.summary.push(
+    "unreal autosdk: MSVC " + msvc.msvc + ", Windows SDK " + msvc.sdk + " (UE_SDKS_ROOT=" + AUTOSDK_DIR + ")"
+  );
+}
+
+// src/guest/toolchains/native/visual-studio.ts
+import fs46 from "node:fs";
+import os7 from "node:os";
+import path58 from "node:path";
+
+// src/shared/installs.ts
+var InstallRecordSchema = external_exports.object({
+  name: external_exports.string().max(100),
+  version: external_exports.string().max(100),
+  sizeBytes: external_exports.number().nonnegative().nullable(),
+  installedAt: external_exports.string().max(64),
+  usedAt: external_exports.string().max(64)
+});
+var InstallRecordsSchema = external_exports.object({ installs: external_exports.array(InstallRecordSchema).max(1e3) });
+
+// src/guest/toolchains/persisted.ts
+var GB = 1024 ** 3;
+var LOCAL_RESERVE_BYTES = 13 * GB;
+function freeBytes(dir, deps = {}) {
+  return freeBytesAt(dir, deps.statfs) ?? 0;
+}
+var gb = (bytes) => (bytes / GB).toFixed(1) + " GB";
+function assertRoom(dir, needBytes, what, fix, deps = {}) {
+  const free = freeBytes(dir, deps);
+  if (free < needBytes)
+    throw new Error(
+      "not installing " + what + ": " + gb(free) + " free where it goes, it needs " + gb(needBytes) + ". " + fix
+    );
+}
+function assertLocalRoom(needBytes, what, deps = {}) {
+  const drive = deps.localDir ?? (process.env.SystemDrive ?? "C:") + "\\";
+  assertRoom(
+    drive,
+    needBytes + LOCAL_RESERVE_BYTES,
+    what,
+    "The sandbox's own disk also holds the paging file and every build: give the sandbox less to install, or a smaller sandbox.pageFileMb.",
+    deps
+  );
+}
 
 // src/guest/toolchains/native/visual-studio.ts
 var BOOTSTRAPPERS = {
@@ -31619,12 +31728,12 @@ var INSTALL_BYTES = {
   community: 7 * 1024 ** 3,
   buildtools: 5 * 1024 ** 3
 };
-var OK_EXIT_CODES2 = [0, 3010];
+var OK_EXIT_CODES = [0, 3010];
 var LAYOUT_ROOM_BYTES = 15 * 1024 ** 3;
 var ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;
 var VS_DIR = tool("visualstudio");
 var LayoutSchema = external_exports.object({ components: external_exports.array(external_exports.string()) });
-var VSWHERE = path56.join(
+var VSWHERE = path58.join(
   process.env["ProgramFiles(x86)"] ?? "C:\\Program Files (x86)",
   "Microsoft Visual Studio",
   "Installer",
@@ -31645,12 +31754,56 @@ function installedVs() {
   return at ? { path: at, version: ask("installationVersion") || "installed" } : null;
 }
 function layoutDir(product) {
-  return path56.join(VS_DIR, product === "community" ? "layout" : "layout-buildtools");
+  return path58.join(VS_DIR, product === "community" ? "layout" : "layout-buildtools");
+}
+var layoutArgs = (req, folder) => [
+  "--layout",
+  folder,
+  "--lang",
+  "en-US",
+  "--quiet",
+  "--wait",
+  ...req.components.flatMap((id) => ["--add", id])
+];
+function newestBootstrapperLog(folders) {
+  const logs = folders.flatMap((dir) => {
+    try {
+      return fs46.readdirSync(dir).filter((n) => /^dd_bootstrapper_.*\.log$/i.test(n)).map((n) => path58.join(dir, n));
+    } catch {
+      return [];
+    }
+  });
+  const stamp = (f) => {
+    try {
+      return fs46.statSync(f).mtimeMs;
+    } catch {
+      return 0;
+    }
+  };
+  return logs.sort((x, y) => stamp(y) - stamp(x))[0] ?? null;
+}
+function reportLayoutFailure(code, temps) {
+  warn("Visual Studio: saving the install files failed (exit " + code + "): " + vsExitText(code));
+  const found = newestBootstrapperLog(temps);
+  if (!found) return;
+  const kept = path58.join(logsDir, "vs-layout-" + (/* @__PURE__ */ new Date()).toISOString().slice(0, 10) + ".log");
+  try {
+    fs46.mkdirSync(logsDir, { recursive: true });
+    fs46.copyFileSync(found, kept);
+    warn("Visual Studio: the installer log is " + found + " (a copy is in " + kept + ")");
+  } catch (e) {
+    warn("Visual Studio: the installer log is " + found + " (could not copy it: " + errMsg(e) + ")");
+  }
+}
+async function copyLayout(from, to) {
+  mkdirp(to);
+  const code = await spawnAsync(SYSTEM.robocopy(), [from, to, "/E", "/COPY:DAT", "/R:1", "/W:1", "/MT:8", "/NP"]);
+  return !robocopyFailed(code);
 }
 async function layoutInstaller(req, bootstrapper) {
   const layout = layoutDir(req.product);
-  const marker = path56.join(layout, ".complete.json");
-  const installer = path56.join(layout, BOOTSTRAPPERS[req.product].file);
+  const marker = path58.join(layout, ".complete.json");
+  const installer = path58.join(layout, BOOTSTRAPPERS[req.product].file);
   const has = () => {
     if (!exists(marker) || !exists(installer)) return false;
     try {
@@ -31660,6 +31813,10 @@ async function layoutInstaller(req, bootstrapper) {
       return false;
     }
   };
+  const finish = () => {
+    writeJsonAtomic(marker, { components: [...req.components] });
+    return installer;
+  };
   if (has()) return installer;
   if (freeBytes(mkdirp(VS_DIR)) < LAYOUT_ROOM_BYTES) {
     warn(
@@ -31669,27 +31826,36 @@ async function layoutInstaller(req, bootstrapper) {
   }
   log("Saving the Visual Studio install files for later boots (~10 GB, once) ...");
   fs46.rmSync(marker, { force: true });
-  const code = await spawnAsync(bootstrapper, [
-    "--layout",
-    layout,
-    "--lang",
-    "en-US",
-    "--quiet",
-    "--wait",
-    ...req.components.flatMap((id) => ["--add", id])
-  ]);
-  if (!OK_EXIT_CODES2.includes(code) || !exists(installer)) {
-    warn("Visual Studio: saving the install files failed (exit " + code + "); downloading this boot");
+  const scratch = mkdirp(path58.join(VS_DIR, "tmp"));
+  const code = await spawnAsync(bootstrapper, layoutArgs(req, layout), {
+    env: { ...process.env, TEMP: scratch, TMP: scratch }
+  });
+  if (OK_EXIT_CODES.includes(code) && exists(installer)) return finish();
+  reportLayoutFailure(code, [scratch, os7.tmpdir()]);
+  const drive = (process.env.SystemDrive ?? "C:") + "\\";
+  if (layoutNextStep(code, freeBytes(drive), LOCAL_RESERVE_BYTES) !== "stage") {
+    warn("Visual Studio: not enough room on " + drive + " to build the install files there; downloading this boot");
     return null;
   }
-  writeJsonAtomic(marker, { components: [...req.components] });
-  return installer;
+  const staging = path58.join(drive, "vs-layout-staging");
+  log("Building the install files on " + drive + " and copying them to " + layout + " ...");
+  const stagedCode = await spawnAsync(bootstrapper, layoutArgs(req, staging));
+  const staged = path58.join(staging, BOOTSTRAPPERS[req.product].file);
+  let kept = false;
+  if (OK_EXIT_CODES.includes(stagedCode) && exists(staged)) {
+    kept = await copyLayout(staging, layout);
+    if (!kept) warn("Visual Studio: copying the install files to " + layout + " failed");
+  } else {
+    reportLayoutFailure(stagedCode, [os7.tmpdir()]);
+  }
+  safeRemove(staging, drive);
+  return kept && exists(installer) ? finish() : null;
 }
 async function install(req, keepInstallFiles) {
   const boot = BOOTSTRAPPERS[req.product];
   const bootstrapper = await signedInstaller(
     boot.url,
-    path56.join(VS_DIR, boot.file),
+    path58.join(VS_DIR, boot.file),
     "the " + boot.name + " installer",
     SIGNERS.microsoft
   );
@@ -31710,9 +31876,9 @@ async function install(req, keepInstallFiles) {
     ...installer ? ["--noWeb"] : [],
     ...req.components.flatMap((id) => ["--add", id])
   ]);
-  if (!OK_EXIT_CODES2.includes(code) || !installedVs())
+  if (!OK_EXIT_CODES.includes(code) || !installedVs())
     throw new Error(
-      "the Visual Studio installer failed (exit " + code + "); its logs are the dd_*.log files in " + os7.tmpdir()
+      "the Visual Studio installer failed (exit " + code + ": " + vsExitText(code) + "); its logs are the dd_*.log files in " + os7.tmpdir()
     );
 }
 async function ensureVisualStudio(env, req, o) {
@@ -31738,20 +31904,20 @@ async function ensureVisualStudio(env, req, o) {
 // src/guest/toolchains/native/unreal.ts
 var DIRECTX_URL = "https://download.microsoft.com/download/8/4/A/84A35BF1-DAFE-4AE8-82AF-AD2AE20B6B14/directx_Jun2010_redist.exe";
 async function installDirectX() {
-  const system322 = path57.join(process.env.WINDIR ?? "C:\\Windows", "System32");
-  if (exists(path57.join(system322, "d3dx9_43.dll")) && exists(path57.join(system322, "XAudio2_7.dll"))) return;
+  const system322 = path59.join(process.env.WINDIR ?? "C:\\Windows", "System32");
+  if (exists(path59.join(system322, "d3dx9_43.dll")) && exists(path59.join(system322, "XAudio2_7.dll"))) return;
   const redist = await signedInstaller(
     DIRECTX_URL,
-    path57.join(tool("visualstudio"), "directx_Jun2010_redist.exe"),
+    path59.join(tool("visualstudio"), "directx_Jun2010_redist.exe"),
     "the DirectX End-User Runtime (~95 MB once)",
     SIGNERS.microsoft
   );
-  const unpacked = path57.join(os8.tmpdir(), "directx-redist");
+  const unpacked = path59.join(os8.tmpdir(), "directx-redist");
   safeRemove(unpacked, os8.tmpdir());
   mkdirp(unpacked);
-  if (await spawnAsync(redist, ["/Q", "/T:" + unpacked]) !== 0 || !exists(path57.join(unpacked, "DXSETUP.exe")))
+  if (await spawnAsync(redist, ["/Q", "/T:" + unpacked]) !== 0 || !exists(path59.join(unpacked, "DXSETUP.exe")))
     throw new Error("could not unpack the DirectX End-User Runtime");
-  const code = await spawnAsync(path57.join(unpacked, "DXSETUP.exe"), ["/silent"]);
+  const code = await spawnAsync(path59.join(unpacked, "DXSETUP.exe"), ["/silent"]);
   safeRemove(unpacked, os8.tmpdir());
   if (code !== 0) throw new Error("the DirectX End-User Runtime installer failed (exit " + code + ")");
 }
@@ -31765,6 +31931,7 @@ async function setupUnreal(env, config2, ctx) {
     return;
   }
   await installDirectX();
+  if (config2.visualStudio === "autosdk") await setupAutosdk(env);
   await setupUnrealEngines(env, config2, ctx);
   const vs = installedVs();
   env.summary.push(
@@ -31773,24 +31940,24 @@ async function setupUnreal(env, config2, ctx) {
 }
 
 // src/guest/toolchains/native/rust.ts
-import path59 from "node:path";
+import path61 from "node:path";
 
 // src/guest/toolchains/native/binstall.ts
 import fs47 from "node:fs";
-import path58 from "node:path";
+import path60 from "node:path";
 var ensureBinstall = async (cargoBin) => {
-  const target = path58.join(cargoBin, "cargo-binstall.exe");
+  const target = path60.join(cargoBin, "cargo-binstall.exe");
   if (exists(target)) return true;
   try {
     const dir = tool("cargo-binstall");
-    if (!exists(path58.join(dir, "cargo-binstall.exe"))) {
+    if (!exists(path60.join(dir, "cargo-binstall.exe"))) {
       await installFromGithub("cargo-bins/cargo-binstall", binstallAsset(arch), {
         dest: dir,
         what: "cargo-binstall for prebuilt Rust tools (~10 MB once)",
         locate: "cargo-binstall.exe"
       });
     }
-    fs47.copyFileSync(path58.join(dir, "cargo-binstall.exe"), target);
+    fs47.copyFileSync(path60.join(dir, "cargo-binstall.exe"), target);
     return true;
   } catch (e) {
     warn("cargo-binstall unavailable, compiling crates with cargo install instead: " + errMsg(e));
@@ -31798,14 +31965,14 @@ var ensureBinstall = async (cargoBin) => {
   }
 };
 function crateInstaller(cargoHome, cargoEnv) {
-  const cargo = path58.join(cargoHome, "bin", "cargo.exe");
+  const cargo = path60.join(cargoHome, "bin", "cargo.exe");
   let binstall = null;
   const binstallEnv = {
     ...cargoEnv,
     env: { ...cargoEnv.env ?? process.env, BINSTALL_DISABLE_TELEMETRY: "true" }
   };
   return async (crate) => {
-    binstall ??= ensureBinstall(path58.join(cargoHome, "bin"));
+    binstall ??= ensureBinstall(path60.join(cargoHome, "bin"));
     if (await binstall) {
       try {
         await execAsync(
@@ -31827,7 +31994,7 @@ async function setupRust(env, config2, refresh) {
   const RUSTUP_HOME = tool("rust", "rustup");
   const CARGO_HOME = tool("rust", "cargo");
   const rustEnv = { env: { ...process.env, RUSTUP_HOME, CARGO_HOME } };
-  const rustup = path59.join(CARGO_HOME, "bin", "rustup.exe");
+  const rustup = path61.join(CARGO_HOME, "bin", "rustup.exe");
   if (dryRun) {
     log("(dry run) would provision Rust " + config2.toolchain + " (" + config2.host + ")");
     return;
@@ -31863,9 +32030,9 @@ async function setupRust(env, config2, refresh) {
     if (refresh) await execAsync(rustup, ["update"], rustEnv);
   }
   Object.assign(env.vars, { RUSTUP_HOME, CARGO_HOME });
-  env.prepend.push(path59.join(CARGO_HOME, "bin"));
+  env.prepend.push(path61.join(CARGO_HOME, "bin"));
   env.summary.push(
-    "rust: " + versionOf(path59.join(CARGO_HOME, "bin", "rustc.exe"), ["--version"], rustEnv) + " [" + config2.host + "]"
+    "rust: " + versionOf(path61.join(CARGO_HOME, "bin", "rustc.exe"), ["--version"], rustEnv) + " [" + config2.host + "]"
   );
   const toolchainKey = "rustup@" + config2.toolchain;
   await installOnce(
@@ -31886,13 +32053,13 @@ async function setupRust(env, config2, refresh) {
     env: {
       ...rustEnv.env,
       ...msvc.vars,
-      PATH: [path59.join(CARGO_HOME, "bin"), ...msvc.path, process.env.PATH ?? ""].join(path59.delimiter)
+      PATH: [path61.join(CARGO_HOME, "bin"), ...msvc.path, process.env.PATH ?? ""].join(path61.delimiter)
     }
   } : {
     env: {
       ...rustEnv.env,
-      CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: path59.join(mingw, "gcc.exe"),
-      PATH: [path59.join(CARGO_HOME, "bin"), mingw, process.env.PATH ?? ""].join(path59.delimiter)
+      CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: path61.join(mingw, "gcc.exe"),
+      PATH: [path61.join(CARGO_HOME, "bin"), mingw, process.env.PATH ?? ""].join(path61.delimiter)
     }
   };
   await installOnce(env, "cargo", config2.crates, crateInstaller(CARGO_HOME, cargoEnv));
@@ -31900,22 +32067,22 @@ async function setupRust(env, config2, refresh) {
 
 // src/guest/toolchains/languages/node.ts
 import fs48 from "node:fs";
-import path60 from "node:path";
+import path62 from "node:path";
 import { spawn as spawn4 } from "node:child_process";
 var NVM_HOME = tool("nvm");
-var NVM_SYMLINK = path60.join(localDir, "nodejs");
-var HOST_NVM = path60.join(hostToolsDir, "nvm");
+var NVM_SYMLINK = path62.join(localDir, "nodejs");
+var HOST_NVM = path62.join(hostToolsDir, "nvm");
 var HOST_VERSIONS_MAX = 3;
-var hostNvmVersions = () => exists(HOST_NVM) ? fs48.readdirSync(HOST_NVM).filter((d) => /^v\d+\.\d+\.\d+$/.test(d) && exists(path60.join(HOST_NVM, d, "node.exe"))).map((d) => d.slice(1)) : [];
+var hostNvmVersions = () => exists(HOST_NVM) ? fs48.readdirSync(HOST_NVM).filter((d) => /^v\d+\.\d+\.\d+$/.test(d) && exists(path62.join(HOST_NVM, d, "node.exe"))).map((d) => d.slice(1)) : [];
 var resolveNode = (spec) => resolveCached("node:" + spec, async () => {
   const exact = spec.replace(/^v/, "");
   if (/^\d+\.\d+\.\d+$/.test(exact)) return exact;
   const releases = await fetchJson("https://nodejs.org/dist/index.json");
   return pickNodeVersion(releases, spec) ?? Promise.reject(new Error('No Node.js release matches "' + spec + '"'));
 });
-var NVM_TEMP = path60.join(NVM_HOME, ".tmp");
+var NVM_TEMP = path62.join(NVM_HOME, ".tmp");
 var nvm = (args) => new Promise((resolve2) => {
-  const child = spawn4(path60.join(NVM_HOME, "nvm.exe"), args, {
+  const child = spawn4(path62.join(NVM_HOME, "nvm.exe"), args, {
     windowsHide: true,
     env: { ...process.env, NVM_HOME, NVM_SYMLINK, TEMP: NVM_TEMP, TMP: NVM_TEMP }
   });
@@ -31930,12 +32097,12 @@ var nvm = (args) => new Promise((resolve2) => {
   child.once("close", () => resolve2(out));
 });
 var ensureNvm = async () => {
-  if (exists(path60.join(NVM_HOME, "nvm.exe"))) return;
-  if (exists(path60.join(HOST_NVM, "nvm.exe"))) {
+  if (exists(path62.join(NVM_HOME, "nvm.exe"))) return;
+  if (exists(path62.join(HOST_NVM, "nvm.exe"))) {
     log("Copying nvm from this PC ...");
     mkdirp(NVM_HOME);
     const files = fs48.readdirSync(HOST_NVM).filter((f) => /\.(exe|cmd|vbs)$/i.test(f)).sort((a, b) => Number(a.toLowerCase() === "nvm.exe") - Number(b.toLowerCase() === "nvm.exe"));
-    for (const file3 of files) fs48.copyFileSync(path60.join(HOST_NVM, file3), path60.join(NVM_HOME, file3));
+    for (const file3 of files) fs48.copyFileSync(path62.join(HOST_NVM, file3), path62.join(NVM_HOME, file3));
     return;
   }
   const asset = await githubAsset("coreybutler/nvm-windows", /^nvm-noinstall\.zip$/, true);
@@ -31943,14 +32110,14 @@ var ensureNvm = async () => {
   await downloader.archive(asset.url, NVM_HOME, { sha256: asset.sha256, locate: "nvm.exe", fileName: asset.name });
 };
 var hostNodeFolder = (version2) => {
-  const dir = path60.join(hostToolsDir, "node");
-  return session.hostTools.nodeVersion?.replace(/^v/, "") === version2 && exists(path60.join(dir, "node.exe")) ? dir : null;
+  const dir = path62.join(hostToolsDir, "node");
+  return session.hostTools.nodeVersion?.replace(/^v/, "") === version2 && exists(path62.join(dir, "node.exe")) ? dir : null;
 };
 var installNodeVersion = async (version2) => {
-  const dir = path60.join(NVM_HOME, "v" + version2);
-  const fromHost = path60.join(HOST_NVM, "v" + version2);
-  if (exists(path60.join(dir, "node.exe"))) return;
-  if (exists(path60.join(fromHost, "node.exe"))) {
+  const dir = path62.join(NVM_HOME, "v" + version2);
+  const fromHost = path62.join(HOST_NVM, "v" + version2);
+  if (exists(path62.join(dir, "node.exe"))) return;
+  if (exists(path62.join(fromHost, "node.exe"))) {
     log("Copying Node " + version2 + " from this PC's nvm (without global packages) ...");
     copyNode(fromHost, dir);
     return;
@@ -31969,19 +32136,19 @@ var installNodeVersion = async (version2) => {
   } finally {
     safeRemove(NVM_TEMP, NVM_HOME);
   }
-  if (!exists(path60.join(dir, "node.exe"))) {
+  if (!exists(path62.join(dir, "node.exe"))) {
     const tail = out.trim().split(/\r?\n/).filter(Boolean).slice(-3).join(" ");
     const why = /complete/i.test(out) ? "nvm said it finished, but its move into the data folder did not happen" : "nvm could not download or unpack it: check the internet connection and the free disk space";
     throw new Error(
-      "nvm install " + version2 + " did not leave " + path60.join(dir, "node.exe") + " (" + why + ")" + (tail ? ". nvm printed: " + tail : "")
+      "nvm install " + version2 + " did not leave " + path62.join(dir, "node.exe") + " (" + why + ")" + (tail ? ". nvm printed: " + tail : "")
     );
   }
 };
 var activate = async (version2) => {
   await nvm(["use", version2]);
-  if (exists(path60.join(NVM_SYMLINK, "node.exe"))) return;
+  if (exists(path62.join(NVM_SYMLINK, "node.exe"))) return;
   fs48.rmSync(NVM_SYMLINK, { recursive: true, force: true });
-  fs48.symlinkSync(path60.join(NVM_HOME, "v" + version2), NVM_SYMLINK, "junction");
+  fs48.symlinkSync(path62.join(NVM_HOME, "v" + version2), NVM_SYMLINK, "junction");
 };
 var PLAYWRIGHT_VARS = () => ({
   PLAYWRIGHT_BROWSERS_PATH: tool("ms-playwright"),
@@ -31994,7 +32161,7 @@ async function setupNode(env, versions, config2) {
   }
   await ensureNvm();
   fs48.writeFileSync(
-    path60.join(NVM_HOME, "settings.txt"),
+    path62.join(NVM_HOME, "settings.txt"),
     [
       "root: " + NVM_HOME,
       "path: " + NVM_SYMLINK,
@@ -32021,7 +32188,7 @@ async function setupNode(env, versions, config2) {
     }
   }
   Object.assign(env.vars, { NVM_HOME, NVM_SYMLINK, ...PLAYWRIGHT_VARS() });
-  if (duringSession()) env.prepend.push(path60.join(NVM_HOME, "v" + main), NVM_HOME, NVM_SYMLINK);
+  if (duringSession()) env.prepend.push(path62.join(NVM_HOME, "v" + main), NVM_HOME, NVM_SYMLINK);
   else {
     await activate(main);
     env.prepend.push(NVM_HOME, NVM_SYMLINK);
@@ -32031,13 +32198,13 @@ async function setupNode(env, versions, config2) {
   await packageManagers(env, config2, main);
 }
 var packageManagers = async (env, config2, version2) => {
-  const dir = path60.join(NVM_HOME, "v" + version2);
-  const nodeEnv = { ...process.env, PATH: dir + path60.delimiter + (process.env.PATH ?? "") };
-  const npm = (args) => execAsync(path60.join(dir, "node.exe"), [path60.join(dir, "node_modules", "npm", "bin", "npm-cli.js"), ...args], {
+  const dir = path62.join(NVM_HOME, "v" + version2);
+  const nodeEnv = { ...process.env, PATH: dir + path62.delimiter + (process.env.PATH ?? "") };
+  const npm = (args) => execAsync(path62.join(dir, "node.exe"), [path62.join(dir, "node_modules", "npm", "bin", "npm-cli.js"), ...args], {
     env: nodeEnv,
     stdio: "ignore"
   });
-  const corepackJs = path60.join(dir, "node_modules", "corepack", "dist", "corepack.js");
+  const corepackJs = path62.join(dir, "node_modules", "corepack", "dist", "corepack.js");
   const extra = config2.corepack && !exists(corepackJs) ? ["corepack"] : [];
   await installOnce(
     env,
@@ -32058,7 +32225,7 @@ var packageManagers = async (env, config2, version2) => {
   }
   try {
     await execAsync(
-      path60.join(dir, "node.exe"),
+      path62.join(dir, "node.exe"),
       [corepackJs, "enable", "--install-directory", mkdirp(tool("bin")), "pnpm", "yarn"],
       { env: nodeEnv, stdio: "ignore" }
     );
@@ -32084,7 +32251,7 @@ async function setupPwsh(env, refresh = false) {
 
 // src/guest/toolchains/languages/python.ts
 import fs49 from "node:fs";
-import path61 from "node:path";
+import path63 from "node:path";
 var installPython = async (pkg, spec) => {
   const version2 = await resolveCached(pkg + ":" + spec, async () => {
     const { versions } = await fetchJson(
@@ -32093,7 +32260,7 @@ var installPython = async (pkg, spec) => {
     return pickPackageVersion(versions, spec) ?? Promise.reject(new Error("No " + pkg + ' release matches "' + spec + '"'));
   });
   const dir = tool("python", pkg + "-" + version2);
-  const exe = path61.join(dir, "python.exe");
+  const exe = path63.join(dir, "python.exe");
   if (!exists(exe)) {
     log("Downloading Python " + version2 + (pkg === "python2" ? " (Python 2, " : " (") + "~30 MB once) ...");
     await downloader.archive(
@@ -32102,32 +32269,32 @@ var installPython = async (pkg, spec) => {
       { locate: "python.exe", fileName: pkg + "." + version2 + ".zip" }
     );
   }
-  if (!exists(path61.join(dir, "Scripts", "pip.exe")) && !exists(path61.join(dir, "Scripts", "pip2.exe")))
+  if (!exists(path63.join(dir, "Scripts", "pip.exe")) && !exists(path63.join(dir, "Scripts", "pip2.exe")))
     await execAsync(exe, ["-m", "ensurepip", "--default-pip"], { stdio: "ignore" });
   return dir;
 };
-var shimDir = (dir) => duringSession() ? tool("shims", path61.basename(dir)) : tool("shims");
+var shimDir = (dir) => duringSession() ? tool("shims", path63.basename(dir)) : tool("shims");
 var shim = (folder, name, program, args = []) => {
   const fixed = [program, ...args];
   fs49.writeFileSync(
-    path61.join(mkdirp(folder), name + ".cmd"),
+    path63.join(mkdirp(folder), name + ".cmd"),
     "@echo off\r\n" + fixed.map((a) => '"' + a + '"').join(" ") + " %*\r\n"
   );
   const sh = fixed.map((a) => "'" + a.replace(/\\/g, "/").replace(/'/g, "'\\''") + "'").join(" ");
-  fs49.writeFileSync(path61.join(folder, name), "#!/bin/sh\nexec " + sh + ' "$@"\n');
+  fs49.writeFileSync(path63.join(folder, name), "#!/bin/sh\nexec " + sh + ' "$@"\n');
 };
 var shimPair = (folder, version2, dir) => {
-  const python = path61.join(dir, "python.exe");
+  const python = path63.join(dir, "python.exe");
   shim(folder, "python" + version2, python);
   shim(folder, "pip" + version2, python, ["-m", "pip"]);
 };
 var pyLauncher = (folder, py3, py2) => {
-  const script = path61.join(mkdirp(folder), "py-launcher.py");
+  const script = path63.join(mkdirp(folder), "py-launcher.py");
   fs49.writeFileSync(
     script,
     [
       "import subprocess, sys",
-      "PY3, PY2 = " + JSON.stringify(path61.join(py3, "python.exe")) + ", " + JSON.stringify(py2 ? path61.join(py2, "python.exe") : null),
+      "PY3, PY2 = " + JSON.stringify(path63.join(py3, "python.exe")) + ", " + JSON.stringify(py2 ? path63.join(py2, "python.exe") : null),
       "args = sys.argv[1:]",
       "exe = PY3",
       "if args and args[0].startswith('-2'):",
@@ -32139,7 +32306,7 @@ var pyLauncher = (folder, py3, py2) => {
       ""
     ].join("\n")
   );
-  shim(folder, "py", path61.join(py3, "python.exe"), [script]);
+  shim(folder, "py", path63.join(py3, "python.exe"), [script]);
 };
 async function setupPython(env, config2, versions) {
   if (dryRun) {
@@ -32149,10 +32316,10 @@ async function setupPython(env, config2, versions) {
   const py3 = await installPython("python", versions.python.spec);
   const shims = shimDir(py3);
   shimPair(shims, "3", py3);
-  env.prepend.push(py3, mkdirp(path61.join(py3, "Scripts")), shims);
+  env.prepend.push(py3, mkdirp(path63.join(py3, "Scripts")), shims);
   env.vars.PYTHONIOENCODING = "utf-8";
   env.summary.push(
-    "python: " + path61.basename(py3).replace("python-", "") + " (from " + versions.python.source + "; py works too)"
+    "python: " + path63.basename(py3).replace("python-", "") + " (from " + versions.python.source + "; py works too)"
   );
   if (!config2.python2) {
     pyLauncher(shims, py3, null);
@@ -32161,12 +32328,45 @@ async function setupPython(env, config2, versions) {
   const py2 = await installPython("python2", "2.7");
   shimPair(shims, "2", py2);
   pyLauncher(shims, py3, py2);
-  env.summary.push("python2: " + path61.basename(py2).replace("python2-", ""));
+  env.summary.push("python2: " + path63.basename(py2).replace("python2-", ""));
 }
 
 // src/guest/toolchains/languages/php.ts
+import fs51 from "node:fs";
+import path65 from "node:path";
+
+// src/guest/toolchains/native/vcruntime.ts
 import fs50 from "node:fs";
-import path62 from "node:path";
+import path64 from "node:path";
+var VC_REDIST = "https://aka.ms/vs/17/release/vc_redist.x64.exe";
+var OK_EXIT_CODES2 = [0, 1638, 3010];
+async function setupVcRuntime(env, summary = true) {
+  if (dryRun) {
+    log("(dry run) would install the Visual C++ runtime");
+    return false;
+  }
+  const system322 = path64.join(process.env.WINDIR ?? "C:\\Windows", "System32");
+  const missing = !exists(path64.join(system322, "vcruntime140.dll")) || !exists(path64.join(system322, "msvcp140.dll"));
+  if (missing) {
+    const installer = tool("vcredist", "vc_redist.x64.exe");
+    if (!exists(installer)) {
+      log("Downloading the Visual C++ runtime (~25 MB once) ...");
+      await downloadFile(VC_REDIST, installer);
+    }
+    if (!signedBy(installer, SIGNERS.microsoft)) {
+      fs50.rmSync(installer, { force: true });
+      throw new Error("vc_redist.x64.exe is not signed by Microsoft; deleted it (it is downloaded again next boot)");
+    }
+    log("Installing the Visual C++ runtime ...");
+    const code = await spawnAsync(installer, ["/install", "/quiet", "/norestart"]);
+    if (!OK_EXIT_CODES2.includes(code ?? -1) || !exists(path64.join(system322, "vcruntime140.dll")))
+      throw new Error("the Visual C++ runtime installer failed (exit " + code + ")");
+  }
+  if (summary) env.summary.push("vc++ runtime: installed");
+  return missing;
+}
+
+// src/guest/toolchains/languages/php.ts
 var PHP_EXTENSIONS = [
   "curl",
   "fileinfo",
@@ -32197,16 +32397,16 @@ var phpBuild = async (spec) => {
   return { version: release.version, ...build.zip };
 };
 var writePhpIni = (home) => {
-  const ini = path62.join(home, "php.ini");
-  if (exists(ini) || !exists(path62.join(home, "php.ini-development"))) return;
-  let text = fs50.readFileSync(path62.join(home, "php.ini-development"), "utf8").replace(/^;\s*extension_dir\s*=\s*"ext"/m, 'extension_dir = "' + path62.join(home, "ext") + '"');
-  for (const ext of PHP_EXTENSIONS.filter((e) => exists(path62.join(home, "ext", "php_" + e + ".dll"))))
+  const ini = path65.join(home, "php.ini");
+  if (exists(ini) || !exists(path65.join(home, "php.ini-development"))) return;
+  let text = fs51.readFileSync(path65.join(home, "php.ini-development"), "utf8").replace(/^;\s*extension_dir\s*=\s*"ext"/m, 'extension_dir = "' + path65.join(home, "ext") + '"');
+  for (const ext of PHP_EXTENSIONS.filter((e) => exists(path65.join(home, "ext", "php_" + e + ".dll"))))
     text = text.replace(new RegExp("^;(extension=" + ext + ")\\s*$", "m"), "$1");
-  fs50.writeFileSync(ini + ".tmp", text);
-  fs50.renameSync(ini + ".tmp", ini);
+  fs51.writeFileSync(ini + ".tmp", text);
+  fs51.renameSync(ini + ".tmp", ini);
 };
 var shim2 = (env, name, command) => {
-  fs50.writeFileSync(path62.join(mkdirp(tool("shims")), name + ".cmd"), "@echo off\r\n" + command + " %*\r\n");
+  fs51.writeFileSync(path65.join(mkdirp(tool("shims")), name + ".cmd"), "@echo off\r\n" + command + " %*\r\n");
   env.prepend.push(tool("shims"));
 };
 var setupComposer = async (env, php) => {
@@ -32218,7 +32418,7 @@ var setupComposer = async (env, php) => {
   }
   const composerHome = tool("composer-home");
   env.vars.COMPOSER_HOME = composerHome;
-  env.prepend.push(path62.join(composerHome, "vendor", "bin"));
+  env.prepend.push(path65.join(composerHome, "vendor", "bin"));
   shim2(env, "composer", '"' + php + '" "' + phar + '"');
   env.summary.push(
     "composer: " + (/\d+\.\d+\.\d+/.exec(execOutput(php, [phar, "--version", "--no-ansi"]))?.[0] ?? "installed")
@@ -32233,7 +32433,7 @@ async function setupPhp(env, config2) {
   await setupVcRuntime(env, false);
   const version2 = await resolveCached("php:" + wantedSpec.spec, async () => (await phpBuild(wantedSpec.spec)).version);
   const home = tool("php", version2);
-  if (!exists(path62.join(home, "php.exe"))) {
+  if (!exists(path65.join(home, "php.exe"))) {
     const build = await phpBuild(version2);
     log("Downloading PHP " + version2 + " (~30 MB once) ...");
     await downloader.archive("https://windows.php.net/downloads/releases/" + build.path, home, {
@@ -32245,11 +32445,11 @@ async function setupPhp(env, config2) {
   writePhpIni(home);
   env.prepend.push(home);
   env.summary.push("php: " + version2 + " (from " + wantedSpec.source + ")");
-  if (config2.composer) await setupComposer(env, path62.join(home, "php.exe"));
+  if (config2.composer) await setupComposer(env, path65.join(home, "php.exe"));
 }
 
 // src/guest/toolchains/languages/ruby.ts
-import path63 from "node:path";
+import path66 from "node:path";
 var RUBY_ASSET = /^rubyinstaller-(\d+\.\d+\.\d+)-(\d+)-x64\.7z$/;
 var buildNumber = (asset) => Number(RUBY_ASSET.exec(asset.name)?.[2] ?? 0);
 var rubyBuilds = async () => {
@@ -32277,7 +32477,7 @@ async function setupRuby(env, config2) {
     async () => pickPackageVersion([...(await rubyBuilds()).keys()], wantedSpec.spec) ?? Promise.reject(new Error('No RubyInstaller build matches "' + wantedSpec.spec + '"'))
   );
   const home = tool("ruby", version2);
-  if (!exists(path63.join(home, "bin", "ruby.exe"))) {
+  if (!exists(path66.join(home, "bin", "ruby.exe"))) {
     const asset = (await rubyBuilds()).get(version2);
     if (!asset) throw new Error("RubyInstaller " + version2 + " is no longer published");
     log("Downloading Ruby " + version2 + " (~100 MB once) ...");
@@ -32290,11 +32490,11 @@ async function setupRuby(env, config2) {
   }
   const gems = tool("ruby-gems", version2.split(".").slice(0, 2).join("."));
   Object.assign(env.vars, { GEM_HOME: gems, BUNDLE_USER_HOME: tool("bundle-home") });
-  env.prepend.push(path63.join(home, "bin"), path63.join(gems, "bin"));
+  env.prepend.push(path66.join(home, "bin"), path66.join(gems, "bin"));
   env.summary.push(
-    "ruby: " + versionOf(path63.join(home, "bin", "ruby.exe")) + " (from " + wantedSpec.source + "; gems with C extensions need MSYS2, not included)"
+    "ruby: " + versionOf(path66.join(home, "bin", "ruby.exe")) + " (from " + wantedSpec.source + "; gems with C extensions need MSYS2, not included)"
   );
-  const gem = path63.join(home, "bin", "gem.cmd");
+  const gem = path66.join(home, "bin", "gem.cmd");
   await installOnce(
     env,
     "gem@" + version2,
@@ -32306,9 +32506,9 @@ async function setupRuby(env, config2) {
 }
 
 // src/guest/toolchains/tools/vscode.ts
-import fs51 from "node:fs";
+import fs52 from "node:fs";
 import os9 from "node:os";
-import path64 from "node:path";
+import path67 from "node:path";
 
 // node_modules/jsonc-parser/lib/esm/impl/scanner.js
 var CharacterCodes;
@@ -32488,14 +32688,14 @@ var ParseErrorCode;
 var VERSION_MARKER = ".agent-sandbox-version";
 var desktopShortcut = (exe) => {
   if (!isWin) return;
-  const link = path64.join(os9.homedir(), "Desktop", "Visual Studio Code.lnk");
+  const link = path67.join(os9.homedir(), "Desktop", "Visual Studio Code.lnk");
   runScriptWithJson("new-shortcuts.ps1", "ListFile", [
     { link, target: exe, arguments: '"' + (process.env.AGENT_WORKSPACE ?? "") + '"' }
   ]);
 };
 async function setupVscode(env, refresh) {
   const root = tool("vscode");
-  const exe = path64.join(root, "Code.exe");
+  const exe = path67.join(root, "Code.exe");
   if (dryRun) {
     log("(dry run) would provision VS Code");
     return;
@@ -32505,11 +32705,11 @@ async function setupVscode(env, refresh) {
       "https://update.code.visualstudio.com/api/update/win32-" + (arch === "arm64" ? "arm64" : "x64") + "-archive/stable/latest"
     );
     log("Downloading VS Code " + release.productVersion + " (~150 MB once) ...");
-    const keep = path64.join(root, "data");
+    const keep = path67.join(root, "data");
     const parked = root + "-data";
     if (exists(keep)) {
-      fs51.rmSync(parked, { recursive: true, force: true });
-      fs51.renameSync(keep, parked);
+      fs52.rmSync(parked, { recursive: true, force: true });
+      fs52.renameSync(keep, parked);
     }
     try {
       await downloader.archive(release.url, root, {
@@ -32517,29 +32717,29 @@ async function setupVscode(env, refresh) {
         locate: "Code.exe",
         fileName: "vscode.zip"
       });
-      fs51.writeFileSync(path64.join(root, VERSION_MARKER), release.productVersion);
+      fs52.writeFileSync(path67.join(root, VERSION_MARKER), release.productVersion);
     } finally {
       if (exists(parked)) {
         mkdirp(root);
-        fs51.rmSync(keep, { recursive: true, force: true });
-        fs51.renameSync(parked, keep);
+        fs52.rmSync(keep, { recursive: true, force: true });
+        fs52.renameSync(parked, keep);
       }
     }
   }
-  mkdirp(path64.join(root, "data"));
-  env.prepend.push(path64.join(root, "bin"));
+  mkdirp(path67.join(root, "data"));
+  env.prepend.push(path67.join(root, "bin"));
   desktopShortcut(exe);
-  const version2 = exists(path64.join(root, VERSION_MARKER)) ? fs51.readFileSync(path64.join(root, VERSION_MARKER), "utf8").trim() : "installed";
+  const version2 = exists(path67.join(root, VERSION_MARKER)) ? fs52.readFileSync(path67.join(root, VERSION_MARKER), "utf8").trim() : "installed";
   env.summary.push("vscode: " + version2 + " (portable; run code . or use the desktop shortcut)");
 }
 
 // src/guest/toolchains/steam/steam.ts
-import fs55 from "node:fs";
-import path69 from "node:path";
+import fs56 from "node:fs";
+import path72 from "node:path";
 
 // src/shared/accounts/kinds/steam.ts
-import fs52 from "node:fs";
-import path65 from "node:path";
+import fs53 from "node:fs";
+import path68 from "node:path";
 
 // src/shared/vdf.ts
 var DEFAULT_MAX_BYTES = 1024 * 1024;
@@ -32667,7 +32867,7 @@ var SENTRY = /^ssfn\d{1,40}$/;
 var STEAM_ACCOUNT = /^[A-Za-z0-9_]{1,64}$/;
 var STEAM_ACCOUNT_FILE = "sbx-account.txt";
 function steamConfigFile(steamcmdDir) {
-  return path65.join(steamcmdDir, "config", "config.vdf");
+  return path68.join(steamcmdDir, "config", "config.vdf");
 }
 function steamKey(root) {
   return vdfObject(root, "InstallConfigStore", "Software", "Valve", "Steam");
@@ -32681,20 +32881,20 @@ function steamAccounts(configVdf) {
   return accounts ? Object.keys(accounts).filter((a) => STEAM_ACCOUNT.test(a)) : [];
 }
 function readSteamAccountFile(steamcmdDir) {
-  const bytes = readBoundedFile(path65.join(steamcmdDir, "config", STEAM_ACCOUNT_FILE), 256);
+  const bytes = readBoundedFile(path68.join(steamcmdDir, "config", STEAM_ACCOUNT_FILE), 256);
   const name = bytes ? decodeText(bytes).text.trim() : "";
   return STEAM_ACCOUNT.test(name) ? name : null;
 }
 function readSentries(steamcmdDir) {
   let names;
   try {
-    names = fs52.readdirSync(steamcmdDir).slice(0, MAX_ENTRIES2).filter((n) => SENTRY.test(n));
+    names = fs53.readdirSync(steamcmdDir).slice(0, MAX_ENTRIES2).filter((n) => SENTRY.test(n));
   } catch {
     return [];
   }
   const mtime = (name) => {
     try {
-      return fs52.lstatSync(path65.join(steamcmdDir, name)).mtimeMs;
+      return fs53.lstatSync(path68.join(steamcmdDir, name)).mtimeMs;
     } catch {
       return 0;
     }
@@ -32702,7 +32902,7 @@ function readSentries(steamcmdDir) {
   const found = [];
   for (const name of names.sort((a, b) => mtime(b) - mtime(a))) {
     if (found.length >= MAX_SENTRIES) break;
-    const bytes = readBoundedFile(path65.join(steamcmdDir, name), MAX_SENTRY_BYTES);
+    const bytes = readBoundedFile(path68.join(steamcmdDir, name), MAX_SENTRY_BYTES);
     if (bytes && bytes.length) found.push({ name, base64: bytes.toString("base64") });
   }
   return found.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
@@ -32719,27 +32919,27 @@ function readSteamCmdLogin(steamcmdDir, account) {
 }
 function writeSteamCmdLogin(steamcmdDir, p) {
   const login = SteamPayloadSchema.parse(p);
-  const config2 = path65.dirname(steamConfigFile(steamcmdDir));
-  fs52.mkdirSync(config2, { recursive: true });
-  fs52.writeFileSync(steamConfigFile(steamcmdDir), login.configVdf, "utf8");
-  fs52.writeFileSync(path65.join(config2, STEAM_ACCOUNT_FILE), login.account, "utf8");
-  for (const s of login.sentries) fs52.writeFileSync(path65.join(steamcmdDir, s.name), Buffer.from(s.base64, "base64"));
+  const config2 = path68.dirname(steamConfigFile(steamcmdDir));
+  fs53.mkdirSync(config2, { recursive: true });
+  fs53.writeFileSync(steamConfigFile(steamcmdDir), login.configVdf, "utf8");
+  fs53.writeFileSync(path68.join(config2, STEAM_ACCOUNT_FILE), login.account, "utf8");
+  for (const s of login.sentries) fs53.writeFileSync(path68.join(steamcmdDir, s.name), Buffer.from(s.base64, "base64"));
 }
 
 // src/guest/toolchains/steam/client.ts
-import fs53 from "node:fs";
-import path67 from "node:path";
+import fs54 from "node:fs";
+import path70 from "node:path";
 
 // src/guest/toolchains/steam/commands.ts
-import path66 from "node:path";
+import path69 from "node:path";
 var STEAMCMD_DIR = "C:\\SteamCMD";
 var STEAMCMD_URL = "https://steamcdn-a.akamaihd.net/client/installer/steamcmd.zip";
 var STEAM_CLIENT_URL = "https://steamcdn-a.akamaihd.net/client/installer/SteamSetup.exe";
 function steamCmdStore(tools = toolsDir) {
-  return path66.join(tools, "steamcmd");
+  return path69.join(tools, "steamcmd");
 }
 function steamClientDir(tools = toolsDir) {
-  return path66.join(tools, "steam");
+  return path69.join(tools, "steam");
 }
 var MAX_SCRIPT_BYTES = 256 * 1024;
 
@@ -32748,35 +32948,35 @@ var GB2 = 1024 ** 3;
 var CLIENT_NEED_BYTES = 2 * GB2;
 var SETUP_TIMEOUT_MS = 10 * 60 * 1e3;
 function installedSteamClient() {
-  const exe = path67.join(steamClientDir(), "steam.exe");
+  const exe = path70.join(steamClientDir(), "steam.exe");
   return exists(exe) && signedBy(exe, SIGNERS.valve) ? exe : null;
 }
 async function installSteamClient() {
   const dir = steamClientDir();
-  const exe = path67.join(dir, "steam.exe");
+  const exe = path70.join(dir, "steam.exe");
   if (exists(exe)) {
     if (!signedBy(exe, SIGNERS.valve)) throw new Error("tools\\steam\\steam.exe is not signed by Valve");
     return exe;
   }
-  fs53.mkdirSync(toolsDir, { recursive: true });
+  fs54.mkdirSync(toolsDir, { recursive: true });
   assertRoom(toolsDir, CLIENT_NEED_BYTES, "the Steam client", "Free room on the data disk.");
   const setup = await signedInstaller(
     STEAM_CLIENT_URL,
-    path67.join(tool("steam-setup"), "SteamSetup.exe"),
+    path70.join(tool("steam-setup"), "SteamSetup.exe"),
     "the Steam client installer (~2 MB once)",
     SIGNERS.valve
   );
   const work = stagingFolder(dir);
-  fs53.mkdirSync(work, { recursive: true });
+  fs54.mkdirSync(work, { recursive: true });
   try {
     log("Unpacking the Steam client into tools\\steam ...");
     const code = await spawnAsync(setup, ["/S", "/D=" + work], { timeout: SETUP_TIMEOUT_MS });
-    const unpacked = path67.join(work, "steam.exe");
+    const unpacked = path70.join(work, "steam.exe");
     if (!exists(unpacked)) throw new Error("SteamSetup.exe did not unpack steam.exe (exit code " + code + ")");
     if (!signedBy(unpacked, SIGNERS.valve)) throw new Error("the unpacked steam.exe is not signed by Valve");
     moveIntoPlace(work, dir);
   } finally {
-    if (fs53.existsSync(work)) safeRemove(work, path67.dirname(work));
+    if (fs54.existsSync(work)) safeRemove(work, path70.dirname(work));
   }
   return exe;
 }
@@ -32794,8 +32994,8 @@ async function ensureSteamClient(env) {
 
 // src/guest/toolchains/steam/steamcmd-install.ts
 import { spawn as spawn5 } from "node:child_process";
-import fs54 from "node:fs";
-import path68 from "node:path";
+import fs55 from "node:fs";
+import path71 from "node:path";
 var MB = 1024 ** 2;
 var STEAMCMD_NEED_BYTES = 600 * MB;
 var STEAMCMD_UPDATE_TIMEOUT_MS = 15 * 60 * 1e3;
@@ -32820,41 +33020,41 @@ function runWithTimeout(exe, args, cwd, timeoutMs) {
     });
   });
 }
-var notSigned = (file3) => new Error(path68.basename(file3) + " is not signed by Valve: not running it (it is downloaded again next boot)");
+var notSigned = (file3) => new Error(path71.basename(file3) + " is not signed by Valve: not running it (it is downloaded again next boot)");
 async function fetchSteamCmd(store2, deps) {
-  fs54.mkdirSync(path68.dirname(store2), { recursive: true });
-  assertRoom(path68.dirname(store2), STEAMCMD_NEED_BYTES, "SteamCMD", "Free room on the data disk.", deps);
+  fs55.mkdirSync(path71.dirname(store2), { recursive: true });
+  assertRoom(path71.dirname(store2), STEAMCMD_NEED_BYTES, "SteamCMD", "Free room on the data disk.", deps);
   const work = stagingFolder(store2);
-  const unpacked = path68.join(work, "x");
+  const unpacked = path71.join(work, "x");
   const extract = deps.extract ?? extractArchive;
   try {
-    fs54.mkdirSync(work, { recursive: true });
+    fs55.mkdirSync(work, { recursive: true });
     const verify = async (part) => {
       await extract(part, unpacked);
-      const exe = path68.join(unpacked, "steamcmd.exe");
-      if (!fs54.existsSync(exe)) throw new Error("steamcmd.zip has no steamcmd.exe");
+      const exe = path71.join(unpacked, "steamcmd.exe");
+      if (!fs55.existsSync(exe)) throw new Error("steamcmd.zip has no steamcmd.exe");
       if (!deps.signed(exe)) throw notSigned(exe);
     };
-    const zip = path68.join(work, "steamcmd.zip");
+    const zip = path71.join(work, "steamcmd.zip");
     if (deps.download) await deps.download(STEAMCMD_URL, zip, verify);
     else await downloader.file(STEAMCMD_URL, zip, { verify });
     moveIntoPlace(unpacked, store2);
   } finally {
-    if (fs54.existsSync(work)) safeRemove(work, path68.dirname(work));
+    if (fs55.existsSync(work)) safeRemove(work, path71.dirname(work));
   }
 }
 async function copyBinaries(from, to) {
-  fs54.mkdirSync(to, { recursive: true });
-  for (const entry of fs54.readdirSync(from, { withFileTypes: true })) {
+  fs55.mkdirSync(to, { recursive: true });
+  for (const entry of fs55.readdirSync(from, { withFileTypes: true })) {
     if (isPrivate(entry.name) || entry.isSymbolicLink()) continue;
     if (!entry.isFile() && !entry.isDirectory()) continue;
-    await fs54.promises.cp(path68.join(from, entry.name), path68.join(to, entry.name), {
+    await fs55.promises.cp(path71.join(from, entry.name), path71.join(to, entry.name), {
       recursive: true,
       force: true,
       verbatimSymlinks: true,
       filter: (source) => {
         try {
-          return !fs54.lstatSync(source).isSymbolicLink();
+          return !fs55.lstatSync(source).isSymbolicLink();
         } catch {
           return false;
         }
@@ -32864,41 +33064,41 @@ async function copyBinaries(from, to) {
 }
 function snapshot(dir) {
   try {
-    return fs54.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && !isPrivate(e.name) && /\.(exe|dll)$/i.test(e.name)).map((e) => {
-      const s = fs54.statSync(path68.join(dir, e.name));
+    return fs55.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && !isPrivate(e.name) && /\.(exe|dll)$/i.test(e.name)).map((e) => {
+      const s = fs55.statSync(path71.join(dir, e.name));
       return e.name.toLowerCase() + ":" + s.size + ":" + Math.floor(s.mtimeMs / 1e3);
     }).sort().join("|");
   } catch {
     return "";
   }
 }
-var bootstrapped = (dir) => BOOTSTRAPPED.some((f) => fs54.existsSync(path68.join(dir, f)));
+var bootstrapped = (dir) => BOOTSTRAPPED.some((f) => fs55.existsSync(path71.join(dir, f)));
 function scrubStore(store2) {
   let names = [];
   try {
-    names = fs54.readdirSync(store2);
+    names = fs55.readdirSync(store2);
   } catch {
     return;
   }
-  for (const name of names.filter(isPrivate)) safeRemove(path68.join(store2, name), store2);
+  for (const name of names.filter(isPrivate)) safeRemove(path71.join(store2, name), store2);
 }
 async function prepareSteamCmd(deps) {
   const store2 = deps.storeDir ?? steamCmdStore(deps.toolsDir);
   const work = deps.workDir ?? STEAMCMD_DIR;
   const log2 = deps.log ?? (() => void 0);
-  const exe = path68.join(work, "steamcmd.exe");
-  if (fs54.existsSync(exe) && bootstrapped(work)) {
+  const exe = path71.join(work, "steamcmd.exe");
+  if (fs55.existsSync(exe) && bootstrapped(work)) {
     if (!deps.signed(exe)) throw notSigned(exe);
     return exe;
   }
-  if (!fs54.existsSync(path68.join(store2, "steamcmd.exe"))) {
+  if (!fs55.existsSync(path71.join(store2, "steamcmd.exe"))) {
     log2("Downloading SteamCMD (~3 MB once; it fetches ~300 MB on its first run) ...");
     await fetchSteamCmd(store2, deps);
   }
   scrubStore(store2);
   await copyBinaries(store2, work);
   if (!deps.signed(exe)) {
-    safeRemove(store2, path68.dirname(store2));
+    safeRemove(store2, path71.dirname(store2));
     throw notSigned(exe);
   }
   const before = snapshot(work);
@@ -32919,7 +33119,7 @@ async function prepareSteamCmd(deps) {
       await copyBinaries(work, staging);
       moveIntoPlace(staging, store2);
     } finally {
-      if (fs54.existsSync(staging)) safeRemove(staging, path68.dirname(staging));
+      if (fs55.existsSync(staging)) safeRemove(staging, path71.dirname(staging));
     }
   }
   return exe;
@@ -32938,10 +33138,10 @@ function signedInAs() {
 }
 function sdkFolder(env, setting) {
   if (!setting.trim()) return;
-  const dir = path69.resolve(projectWorkspace(), setting.trim());
+  const dir = path72.resolve(projectWorkspace(), setting.trim());
   let ok = false;
   try {
-    ok = fs55.statSync(dir).isDirectory();
+    ok = fs56.statSync(dir).isDirectory();
   } catch {
   }
   if (!ok) {
@@ -33019,9 +33219,9 @@ async function setupKotlin(env, _ctx) {
 }
 
 // src/guest/toolchains/native/rust-extras.ts
-import fs56 from "node:fs";
+import fs57 from "node:fs";
 import os10 from "node:os";
-import path70 from "node:path";
+import path73 from "node:path";
 
 // src/shared/memory/policy.ts
 var DIAL_STEPS = {
@@ -33339,40 +33539,40 @@ function targetSummary(rust) {
 }
 var cargoTarget = (targetDir) => {
   if (targetDir === "shared" || targetDir === "separate") return null;
-  if (targetDir === "local") return path70.join(localDir, "cargo-target");
+  if (targetDir === "local") return path73.join(localDir, "cargo-target");
   return targetDir;
 };
 function cargoShim(env, rust) {
-  const real = path70.join(tool("rust", "cargo", "bin"), "cargo.exe");
+  const real = path73.join(tool("rust", "cargo", "bin"), "cargo.exe");
   if (rust.targetDir !== "separate" || !exists(real)) return;
   const dir = mkdirp(tool("shims", "cargo"));
-  fs56.copyFileSync(ensureCompiled("cargoshim"), path70.join(dir, "cargo.exe"));
+  fs57.copyFileSync(ensureCompiled("cargoshim"), path73.join(dir, "cargo.exe"));
   env.prepend.unshift(dir);
   env.vars.AGENT_REAL_CARGO = real;
 }
 function linkGate(env, rust, host) {
   const gcc = tool("mingw", "mingw64", "bin", "gcc.exe");
   if (!host.endsWith("-pc-windows-gnu") || !exists(gcc)) return;
-  const gate = path70.join(mkdirp(tool("shims")), "linkgate.exe");
-  fs56.copyFileSync(ensureCompiled("linkgate"), gate);
+  const gate = path73.join(mkdirp(tool("shims")), "linkgate.exe");
+  fs57.copyFileSync(ensureCompiled("linkgate"), gate);
   const slots = rust.linkSlots === "auto" ? linkerSlots(os10.totalmem() / 1024 ** 2, os10.cpus().length) : rust.linkSlots;
   env.vars.AGENT_LINK_SLOTS = String(slots);
   env.vars.AGENT_REAL_LINKER = gcc;
   env.vars.CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER = gate;
   const rustEnv = { ...process.env, RUSTUP_HOME: tool("rust", "rustup"), CARGO_HOME: tool("rust", "cargo") };
   const sysroot = rust.linker === "lld" ? execOutput(tool("rust", "cargo", "bin", "rustc.exe"), ["--print", "sysroot"], { env: rustEnv }) : "";
-  const lld = sysroot ? path70.join(sysroot, "lib", "rustlib", host, "bin", "gcc-ld") : "";
-  if (lld && exists(path70.join(lld, "ld.lld.exe"))) env.vars.AGENT_LLD_DIR = lld;
+  const lld = sysroot ? path73.join(sysroot, "lib", "rustlib", host, "bin", "gcc-ld") : "";
+  if (lld && exists(path73.join(lld, "ld.lld.exe"))) env.vars.AGENT_LLD_DIR = lld;
   env.summary.push(
     "rust linking: " + (env.vars.AGENT_LLD_DIR ? "lld" : "GNU ld") + ", at most " + env.vars.AGENT_LINK_SLOTS + " at once"
   );
 }
 function cargoDefaults(host) {
   const file3 = tool("rust", "cargo", "config.toml");
-  if (exists(file3) || !exists(path70.dirname(file3))) return;
+  if (exists(file3) || !exists(path73.dirname(file3))) return;
   const jobs = cargoJobs(os10.cpus().length, os10.totalmem() / 1024 ** 3, 1);
   const gnu = host.endsWith("-gnu");
-  fs56.writeFileSync(
+  fs57.writeFileSync(
     file3,
     [
       "# Written by windows-development-sandbox once; edit freely, it is never overwritten.",
@@ -33387,7 +33587,7 @@ function rustCaches(rust) {
   const target = cargoTarget(rust.targetDir);
   return {
     ...target ? { CARGO_TARGET_DIR: target } : {},
-    ...process.env.SCCACHE_DIR ? {} : { SCCACHE_DIR: path70.join(dataDir, "cache", "sccache") }
+    ...process.env.SCCACHE_DIR ? {} : { SCCACHE_DIR: path73.join(dataDir, "cache", "sccache") }
   };
 }
 function rustHost(config2) {
@@ -33417,6 +33617,7 @@ function plan(config2, versions, o) {
   const unreal = wanted(config2.unreal.enabled, "unreal");
   const android = wanted(config2.android.enabled, "android");
   const vs = visualStudioWanted(config2, (setting, name) => wanted(setting, name));
+  const autosdk = unrealUsesAutosdk(config2, (setting, name) => wanted(setting, name));
   const ctx = {
     refresh: o.refresh,
     pcInstalls: o.pcInstalls ?? { items: [] },
@@ -33452,13 +33653,17 @@ function plan(config2, versions, o) {
       name: "Unreal",
       enabled: unreal,
       shared: true,
-      after: ["Visual Studio"],
+      after: ["Visual Studio", "MSVC"],
       install: (env) => setupUnreal(env, config2.unreal, ctx)
     },
     {
       name: "MSVC",
-      enabled: wanted(config2.msvc.enabled, "msvc") && vs === null,
-      install: (env) => setupMsvc(env, config2.msvc)
+      enabled: (wanted(config2.msvc.enabled, "msvc") || autosdk && config2.msvc.enabled !== false) && vs === null,
+      // The same Visual Studio licence terms, which Unreal's acceptLicense already names.
+      install: (env) => setupMsvc(
+        env,
+        autosdk ? { ...config2.msvc, acceptLicense: config2.msvc.acceptLicense || config2.unreal.acceptLicense } : config2.msvc
+      )
     },
     // Rust links with MSVC (msvc host) or MinGW's gcc (GNU host): whichever it uses goes first.
     {
@@ -33771,21 +33976,21 @@ function cmdSet(env, names) {
   return names.filter((n) => env[n] !== void 0 && !/[\r\n]/.test(String(env[n]))).map((n) => '@set "' + n + "=" + String(env[n]).replace(/%/g, "%%") + '"');
 }
 function writeShell(spec, env, names) {
-  const dir = mkdirp(path71.join(localDir, "projects", spec.name));
-  fs57.writeFileSync(path71.join(dir, "env.cmd"), [...cmdSet(env, [...names, "PATH"]), ""].join("\r\n"));
-  fs57.writeFileSync(
-    path71.join(dir, "shell.cmd"),
-    ['@call "' + path71.join(dir, "env.cmd") + '"', '@cd /d "' + spec.workspace + '"', "@title " + spec.name, ""].join(
+  const dir = mkdirp(path74.join(localDir, "projects", spec.name));
+  fs58.writeFileSync(path74.join(dir, "env.cmd"), [...cmdSet(env, [...names, "PATH"]), ""].join("\r\n"));
+  fs58.writeFileSync(
+    path74.join(dir, "shell.cmd"),
+    ['@call "' + path74.join(dir, "env.cmd") + '"', '@cd /d "' + spec.workspace + '"', "@title " + spec.name, ""].join(
       "\r\n"
     )
   );
-  const bin = mkdirp(path71.join(localDir, "bin"));
-  fs57.writeFileSync(
-    path71.join(bin, "sbx-shell.cmd"),
+  const bin = mkdirp(path74.join(localDir, "bin"));
+  fs58.writeFileSync(
+    path74.join(bin, "sbx-shell.cmd"),
     [
-      '@if "%~1"=="" (echo Usage: sbx-shell ^<project^>   ^(a terminal in that project with its tools^) & dir /b "' + path71.join(localDir, "projects") + '" & exit /b 2)',
-      '@if not exist "' + path71.join(localDir, "projects") + '\\%~1\\shell.cmd" (echo No project %~1 in this sandbox. & exit /b 2)',
-      '@cmd /k ""' + path71.join(localDir, "projects") + '\\%~1\\shell.cmd""',
+      '@if "%~1"=="" (echo Usage: sbx-shell ^<project^>   ^(a terminal in that project with its tools^) & dir /b "' + path74.join(localDir, "projects") + '" & exit /b 2)',
+      '@if not exist "' + path74.join(localDir, "projects") + '\\%~1\\shell.cmd" (echo No project %~1 in this sandbox. & exit /b 2)',
+      '@cmd /k ""' + path74.join(localDir, "projects") + '\\%~1\\shell.cmd""',
       ""
     ].join("\r\n")
   );
@@ -33838,10 +34043,10 @@ async function setUp(spec, say) {
       }
     )
   );
-  tools.prepend.push(path71.join(localDir, "bin"));
+  tools.prepend.push(path74.join(localDir, "bin"));
   const env = agentEnv(tools, { workspace: spec.workspace, project: spec.name, base });
-  const specFile = path71.join(mkdirp(path71.join(localDir, "projects", spec.name)), "project.json");
-  fs57.writeFileSync(specFile, JSON.stringify(spec));
+  const specFile = path74.join(mkdirp(path74.join(localDir, "projects", spec.name)), "project.json");
+  fs58.writeFileSync(specFile, JSON.stringify(spec));
   env.AGENT_PROJECT_FILE = specFile;
   addMachineEnvironment(tools.vars, [...tools.prepend, ...tools.append], true);
   try {
@@ -33958,8 +34163,8 @@ function execCommand(req) {
 }
 
 // src/guest/daemon/sessions.ts
-import fs64 from "node:fs";
-import path81 from "node:path";
+import fs65 from "node:fs";
+import path84 from "node:path";
 import crypto5 from "node:crypto";
 import os15 from "node:os";
 import { spawn as spawn9 } from "node:child_process";
@@ -34040,7 +34245,7 @@ async function sendControl(endpoint, type) {
 var MAX_CLIPBOARD_STRING = 1024 * 1024;
 
 // src/guest/sessions/cmdline.ts
-import path72 from "node:path";
+import path75 from "node:path";
 var quoted = (arg) => '"' + arg.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, "$1$1") + '"';
 function quoteArg(arg) {
   return arg !== "" && !/[\s"]/.test(arg) ? arg : quoted(arg);
@@ -34054,7 +34259,7 @@ function cmdArgs(args) {
   }).join("");
 }
 function commandLine(file3, args) {
-  return path72.win32.basename(file3).toLowerCase() === "cmd.exe" ? [quoteArg(file3), cmdArgs(args)].filter(Boolean).join(" ") : [file3, ...args].map(quoteArg).join(" ");
+  return path75.win32.basename(file3).toLowerCase() === "cmd.exe" ? [quoteArg(file3), cmdArgs(args)].filter(Boolean).join(" ") : [file3, ...args].map(quoteArg).join(" ");
 }
 function shellLaunch(asked, paths) {
   if (asked === "cmd") return { name: "cmd", file: paths.cmd, args: [] };
@@ -34068,8 +34273,8 @@ function shellLaunch(asked, paths) {
 }
 
 // src/guest/sessions/pty-host.ts
-import fs58 from "node:fs";
-import path73 from "node:path";
+import fs59 from "node:fs";
+import path76 from "node:path";
 import { execFile, spawn as spawn7 } from "node:child_process";
 function ensurePtyHost() {
   return ensureCompiled("ptyhost");
@@ -34088,21 +34293,21 @@ async function waitForPtyHost(child, port, timeoutMs) {
   throw new Error("the session host did not start listening on port " + port);
 }
 function ptyHostLog(id) {
-  return path73.join(logsDir, "ptyhost-" + id + ".log");
+  return path76.join(logsDir, "ptyhost-" + id + ".log");
 }
 function ptyHostLogTail(id, lines = 12) {
   try {
-    return fs58.readFileSync(ptyHostLog(id), "utf8").trim().split(/\r?\n/).slice(-lines).join("\n");
+    return fs59.readFileSync(ptyHostLog(id), "utf8").trim().split(/\r?\n/).slice(-lines).join("\n");
   } catch {
     return "";
   }
 }
 var conptyDll = () => {
-  const dll = path73.join(toolsDir, "conpty", "conpty.dll");
-  return session.provisioning.conpty?.enabled !== false && fs58.existsSync(dll) && fs58.existsSync(path73.join(toolsDir, "conpty", "OpenConsole.exe")) ? dll : null;
+  const dll = path76.join(toolsDir, "conpty", "conpty.dll");
+  return session.provisioning.conpty?.enabled !== false && fs59.existsSync(dll) && fs59.existsSync(path76.join(toolsDir, "conpty", "OpenConsole.exe")) ? dll : null;
 };
 function startPtyHost(o) {
-  fs58.mkdirSync(run.treesDir, { recursive: true });
+  fs59.mkdirSync(run.treesDir, { recursive: true });
   const env = {
     ...o.env,
     PTYHOST_BIND: o.remote ? "any" : "loopback",
@@ -34120,13 +34325,13 @@ function startPtyHost(o) {
 var END_TREE_MS = 3e4;
 function endLeftoverTree(id, exe = ensurePtyHost()) {
   const file3 = run.treeFile(id);
-  if (!fs58.existsSync(file3)) return Promise.resolve(null);
+  if (!fs59.existsSync(file3)) return Promise.resolve(null);
   return new Promise((resolve2) => {
     execFile(exe, ["--end-tree", file3], { timeout: END_TREE_MS, windowsHide: true }, (error62, stdout) => {
       const code = error62 ? typeof error62.code === "number" ? error62.code : -1 : 0;
       if (code !== 3)
         try {
-          fs58.rmSync(file3, { force: true });
+          fs59.rmSync(file3, { force: true });
         } catch {
         }
       resolve2(code === 0 ? stdout.trim().slice(0, 200) : code === 3 ? null : "could not end them (code " + code + ")");
@@ -34135,15 +34340,15 @@ function endLeftoverTree(id, exe = ensurePtyHost()) {
 }
 function recordedTrees() {
   try {
-    return fs58.readdirSync(run.treesDir).filter((n) => /^[A-Za-z0-9_-]{1,64}\.json$/.test(n)).map((n) => n.slice(0, -".json".length));
+    return fs59.readdirSync(run.treesDir).filter((n) => /^[A-Za-z0-9_-]{1,64}\.json$/.test(n)).map((n) => n.slice(0, -".json".length));
   } catch {
     return [];
   }
 }
 
 // src/guest/agents/agent-installer.ts
-import fs59 from "node:fs";
-import path74 from "node:path";
+import fs60 from "node:fs";
+import path77 from "node:path";
 
 // src/guest/agents/profile-links.ts
 var profileRoot = () => process.env.USERPROFILE ?? "";
@@ -34169,7 +34374,7 @@ var agentPaths2 = (name, harness) => agentPaths(toolsDir, name, harness);
 async function installViaNpm(name, harness, dir, env) {
   if (!harness.npmPackage)
     throw new Error("No npmPackage configured for " + name + " and no host executable was available.");
-  const npmCli = path74.join(path74.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+  const npmCli = path77.join(path77.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
   const args = [npmCli, "install", "--global", "--prefix", dir, harness.npmPackage, "--no-fund", "--no-audit"];
   log("Installing " + harness.npmPackage + " (this can take a minute)...");
   if (dryRun) {
@@ -34180,7 +34385,7 @@ async function installViaNpm(name, harness, dir, env) {
   await execAsync(process.execPath, args, { env });
 }
 async function installViaUv(name, harness, dir, env) {
-  const uv = path74.join(toolsDir, "uv", "uv.exe");
+  const uv = path77.join(toolsDir, "uv", "uv.exe");
   log("Installing " + harness.uvPackage + " with uv (this can take a minute)...");
   if (dryRun) {
     log("(dry run) uv tool install " + harness.uvPackage);
@@ -34195,8 +34400,8 @@ async function installViaUv(name, harness, dir, env) {
   });
 }
 function putOnPath(dir, env) {
-  const parts2 = (env.PATH ?? "").split(path74.delimiter);
-  if (!parts2.some((p) => p.toLowerCase() === dir.toLowerCase())) env.PATH = [...parts2, dir].join(path74.delimiter);
+  const parts2 = (env.PATH ?? "").split(path77.delimiter);
+  if (!parts2.some((p) => p.toLowerCase() === dir.toLowerCase())) env.PATH = [...parts2, dir].join(path77.delimiter);
   addMachineEnvironment({}, [dir], true);
 }
 var AgentInstaller = class {
@@ -34237,9 +34442,9 @@ var AgentInstaller = class {
     }
     mkdirp(p.dir);
     if (this.sourceOf(name, harness) === "host") {
-      const source = path74.join(hostToolsDir, "agents", name, harness.hostExecutable);
+      const source = path77.join(hostToolsDir, "agents", name, harness.hostExecutable);
       if (exists(source) && p.exe) {
-        fs59.copyFileSync(source, p.exe);
+        fs60.copyFileSync(source, p.exe);
         log("Copied " + name + " from this PC: " + source);
         return;
       }
@@ -34260,22 +34465,22 @@ function guestAddresses() {
 }
 
 // src/guest/sessions/conversation.ts
-import fs60 from "node:fs";
-import path75 from "node:path";
+import fs61 from "node:fs";
+import path78 from "node:path";
 var MAX_FILES = 2e3;
 function conversationFiles(claudeDir2, cwd) {
   const names = /* @__PURE__ */ new Set([projectFolderName(cwd), projectFolderName(sandboxFolder(cwd))]);
   return [...names].flatMap((name) => {
-    const dir = path75.join(claudeDir2, "projects", name);
+    const dir = path78.join(claudeDir2, "projects", name);
     let entries2;
     try {
-      entries2 = fs60.readdirSync(dir);
+      entries2 = fs61.readdirSync(dir);
     } catch {
       return [];
     }
     return entries2.filter((e) => e.endsWith(".jsonl") && isConversationId(e.slice(0, -".jsonl".length))).slice(0, MAX_FILES).flatMap((e) => {
       try {
-        return [{ id: e.slice(0, -".jsonl".length), createdMs: fs60.statSync(path75.join(dir, e)).birthtimeMs }];
+        return [{ id: e.slice(0, -".jsonl".length), createdMs: fs61.statSync(path78.join(dir, e)).birthtimeMs }];
       } catch {
         return [];
       }
@@ -34290,8 +34495,8 @@ function findConversation(claudeDir2, cwd, sessionStartMs, claimed) {
 import { spawnSync as spawnSync6 } from "node:child_process";
 
 // src/guest/accounts/watch.ts
-import fs62 from "node:fs";
-import path79 from "node:path";
+import fs63 from "node:fs";
+import path82 from "node:path";
 
 // src/shared/accounts/fingerprint.ts
 import crypto4 from "node:crypto";
@@ -34306,12 +34511,12 @@ function fingerprint2(payload) {
 }
 
 // src/guest/accounts/adapter.ts
-import path76 from "node:path";
+import path79 from "node:path";
 function localAppData() {
   return process.env.LOCALAPPDATA ?? "C:\\Users\\WDAGUtilityAccount\\AppData\\Local";
 }
 function accountsRoot() {
-  return path76.join(localAppData(), "AgentSandbox", "accounts");
+  return path79.join(localAppData(), "AgentSandbox", "accounts");
 }
 function notAvailableYet2(kind) {
   return { summary: kind + ": using a saved sign-in is not available yet (it is not used)" };
@@ -34334,8 +34539,8 @@ var cfxAdapter = {
 };
 
 // src/guest/accounts/kinds/epic.ts
-import fs61 from "node:fs";
-import path77 from "node:path";
+import fs62 from "node:fs";
+import path80 from "node:path";
 
 // src/shared/accounts/kinds/epic.ts
 var MAX_EPIC_INI_BYTES = 1024 * 1024;
@@ -34388,8 +34593,8 @@ var epicAdapter = {
     const file3 = settingsFile();
     const bytes = readBoundedFile(file3, MAX_EPIC_INI_BYTES);
     const read = bytes ? decodeText(bytes) : { text: "", encoding: "utf8" };
-    fs61.mkdirSync(path77.dirname(file3), { recursive: true });
-    fs61.writeFileSync(file3, encodeText(withEpicLogin(read.text, p), read.encoding));
+    fs62.mkdirSync(path80.dirname(file3), { recursive: true });
+    fs62.writeFileSync(file3, encodeText(withEpicLogin(read.text, p), read.encoding));
     return { summary: "Epic Games Launcher: signed in with your saved sign-in" };
   },
   current() {
@@ -34456,13 +34661,13 @@ var ADAPTERS = {
 };
 
 // src/guest/accounts/apply.ts
-import path78 from "node:path";
+import path81 from "node:path";
 var DeliveredSchema = external_exports.object({
   fingerprints: external_exports.partialRecord(external_exports.enum(SERVICE_KINDS), external_exports.string().max(128)),
   leased: external_exports.array(external_exports.enum(SERVICE_KINDS))
 });
 function deliveredFile(root = accountsRoot()) {
-  return path78.join(root, "delivered.json");
+  return path81.join(root, "delivered.json");
 }
 function readDelivered(root = accountsRoot()) {
   return readValid(DeliveredSchema, deliveredFile(root)) ?? { fingerprints: {}, leased: [] };
@@ -34502,8 +34707,8 @@ var AccountWatch = class {
       if (!now2) return false;
       const print = fingerprint2(now2);
       if (print === this.last.get(kind)) return false;
-      const file3 = path79.join(this.o.dataDir, ...HANDOFF_PARTS, kind + ".json");
-      fs62.mkdirSync(path79.dirname(file3), { recursive: true });
+      const file3 = path82.join(this.o.dataDir, ...HANDOFF_PARTS, kind + ".json");
+      fs63.mkdirSync(path82.dirname(file3), { recursive: true });
       writeJsonAtomic(file3, { kind, launchId: this.o.launchId, payload: now2 });
       this.last.set(kind, print);
       return true;
@@ -34673,9 +34878,9 @@ var GovernorCore = class {
 };
 
 // src/guest/governor/governor.ts
-import fs63 from "node:fs";
+import fs64 from "node:fs";
 import os13 from "node:os";
-import path80 from "node:path";
+import path83 from "node:path";
 import { spawn as spawn8 } from "node:child_process";
 import { createInterface } from "node:readline";
 var SampleSchema = external_exports.object({
@@ -34748,12 +34953,12 @@ var MemGovProcess = class {
 };
 function appendToMemoryLog(line) {
   try {
-    const logs = path80.join(dataDir, "logs");
-    const newest = fs63.readdirSync(logs).filter((f) => /^memory-\d{8}-\d{6}\.log$/.test(f)).sort().pop();
+    const logs = path83.join(dataDir, "logs");
+    const newest = fs64.readdirSync(logs).filter((f) => /^memory-\d{8}-\d{6}\.log$/.test(f)).sort().pop();
     if (!newest) return;
     const t = /* @__PURE__ */ new Date();
     const stamp = [t.getHours(), t.getMinutes(), t.getSeconds()].map((n) => String(n).padStart(2, "0")).join(":");
-    fs63.appendFileSync(path80.join(logs, newest), stamp + " | " + line + "\r\n");
+    fs64.appendFileSync(path83.join(logs, newest), stamp + " | " + line + "\r\n");
   } catch {
   }
 }
@@ -34870,8 +35075,8 @@ var IdleShutdown = class {
 var CLOSE_WAIT_MS = 8e3;
 var ROOTS_KEPT_MS = 10 * 60 * 1e3;
 function terminalTab(id, title, cwd) {
-  const view = [process.execPath, path81.join(path81.dirname(process.argv[1]), "view.js"), id];
-  const wt = path81.join(toolsDir, "terminal", "wt.exe");
+  const view = [process.execPath, path84.join(path84.dirname(process.argv[1]), "view.js"), id];
+  const wt = path84.join(toolsDir, "terminal", "wt.exe");
   if (exists(wt))
     spawn9(wt, ["-w", "0", "nt", "--title", title, "-d", cwd, ...view], { detached: true, stdio: "ignore" }).unref();
   else spawn9(SYSTEM.cmd(), ["/d", "/c", "start", title, ...view], { detached: true, stdio: "ignore", cwd }).unref();
@@ -34918,7 +35123,7 @@ var agentProgram = async (req, env, say) => {
   say("Preparing " + req.harness);
   await agents.provision(req.harness, harness, env, false);
   const launch = agents.resolveLaunch(req.harness, harness);
-  const base = [...launch.args, ...harness.arguments];
+  const base = [...launch.args, ...agentArguments(req.harness, harness, session.codex)];
   return {
     command: commandLine(launch.file, [...base, ...req.args]),
     restartCommand: commandLine(launch.file, [...base, ...harness.resumeArguments ?? []]),
@@ -34927,10 +35132,10 @@ var agentProgram = async (req, env, say) => {
 };
 function shellPaths() {
   const candidates = [
-    path81.join(pwshDir(), "pwsh.exe"),
-    path81.join(process.env.ProgramFiles ?? "C:\\Program Files", "PowerShell", "7", "pwsh.exe")
+    path84.join(pwshDir(), "pwsh.exe"),
+    path84.join(process.env.ProgramFiles ?? "C:\\Program Files", "PowerShell", "7", "pwsh.exe")
   ];
-  return { pwsh: candidates.find((f) => fs64.existsSync(f)) ?? null, powershell: SYSTEM.powershell(), cmd: SYSTEM.cmd() };
+  return { pwsh: candidates.find((f) => fs65.existsSync(f)) ?? null, powershell: SYSTEM.powershell(), cmd: SYSTEM.cmd() };
 }
 var shellProgram = (shell) => {
   const line = commandLine(shell.file, shell.args);
@@ -34964,7 +35169,7 @@ var launchPtyHost = async (req, program, remote, env, sessions2, onSpawn) => {
   } catch (e) {
     const tail = ptyHostLogTail(req.id);
     throw new Error(
-      errMsg(e) + (tail ? ". From its log:\n" + tail : "") + "\nLog: " + path81.join(dataDir, "logs", "ptyhost-" + req.id + ".log")
+      errMsg(e) + (tail ? ". From its log:\n" + tail : "") + "\nLog: " + path84.join(dataDir, "logs", "ptyhost-" + req.id + ".log")
     );
   }
   return { child, port, token };
@@ -35078,7 +35283,7 @@ var SessionManager = class {
     };
     this.starting++;
     if (req.id !== session.launchId && process.env.AGENT_NO_TABS !== "1")
-      safely("terminal tab", () => terminalTab(req.id, name + " " + path81.basename(req.cwd), req.cwd));
+      safely("terminal tab", () => terminalTab(req.id, name + " " + path84.basename(req.cwd), req.cwd));
     try {
       if (problem) throw new Error(problem);
       const place = await placeFor(req, say);
@@ -35247,13 +35452,13 @@ var SessionManager = class {
 var sessions = new SessionManager();
 
 // src/guest/daemon/live.ts
-import fs66 from "node:fs";
-import path83 from "node:path";
+import fs67 from "node:fs";
+import path86 from "node:path";
 import { spawnSync as spawnSync7 } from "node:child_process";
 
 // src/guest/daemon/live-folders.ts
-import fs65 from "node:fs";
-import path82 from "node:path";
+import fs66 from "node:fs";
+import path85 from "node:path";
 
 // src/shared/channel/live.ts
 import crypto6 from "node:crypto";
@@ -35346,7 +35551,7 @@ var LiveFolderHandler = class {
   }
   read() {
     try {
-      const text = fs65.readFileSync(this.o.stateFile, "utf8");
+      const text = fs66.readFileSync(this.o.stateFile, "utf8");
       const parsed = StateSchema.safeParse(JSON.parse(text));
       if (parsed.success && parsed.data.launchId === this.o.launchId) return parsed.data;
     } catch {
@@ -35354,7 +35559,7 @@ var LiveFolderHandler = class {
     return { key: null, launchId: this.o.launchId, seen: [], mappings: [] };
   }
   save(state) {
-    fs65.mkdirSync(path82.dirname(this.o.stateFile), { recursive: true });
+    fs66.mkdirSync(path85.dirname(this.o.stateFile), { recursive: true });
     writeJsonAtomic(this.o.stateFile, state);
   }
   /** The key the boot handed over (from the one-shot secrets file). */
@@ -35365,30 +35570,30 @@ var LiveFolderHandler = class {
   /** C:\Workspace\<name> from a checked name only. */
   folderPath(name) {
     if (!LIVE_FOLDER_NAME.test(name)) throw new Error("not a plain folder name");
-    return path82.win32.join(this.o.workspaces ?? WORKSPACES_GUEST, name);
+    return path85.win32.join(this.o.workspaces ?? WORKSPACES_GUEST, name);
   }
   /** One pass over run\live: every file is claimed (deleted) at once; valid ones are handled one after another. */
   tick() {
     const dir = this.o.run.liveDir;
     let names;
     try {
-      names = fs65.readdirSync(dir);
+      names = fs66.readdirSync(dir);
     } catch {
       return;
     }
     for (const name of names.slice(0, 64)) {
       if (name.endsWith(".tmp")) continue;
-      const file3 = path82.join(dir, name);
+      const file3 = path85.join(dir, name);
       let envelope = null;
       try {
-        const stat = fs65.lstatSync(file3);
+        const stat = fs66.lstatSync(file3);
         if (stat.isFile() && stat.size <= MAX_REQUEST_BYTES && /^[A-Za-z0-9_-]{1,64}\.json$/.test(name))
-          envelope = JSON.parse(fs65.readFileSync(file3, "utf8"));
+          envelope = JSON.parse(fs66.readFileSync(file3, "utf8"));
       } catch {
         envelope = null;
       } finally {
         try {
-          fs65.rmSync(file3, { recursive: true, force: true });
+          fs66.rmSync(file3, { recursive: true, force: true });
         } catch {
         }
       }
@@ -35425,7 +35630,7 @@ var LiveFolderHandler = class {
   }
   reply(id, r) {
     try {
-      fs65.mkdirSync(this.o.run.liveRepliesDir, { recursive: true });
+      fs66.mkdirSync(this.o.run.liveRepliesDir, { recursive: true });
       writeJsonAtomic(this.o.run.liveReplyFile(id), { id, ...r, finishedAt: new Date(this.now()).toISOString() });
     } catch (e) {
       this.log("live folder reply not written: " + errMsg(e));
@@ -35446,14 +35651,14 @@ var LiveFolderHandler = class {
   assertFree(folder) {
     let exists2 = true;
     try {
-      fs65.lstatSync(folder);
+      fs66.lstatSync(folder);
     } catch {
       exists2 = false;
     }
     if (exists2) throw new Error(folder + " exists already");
-    const parent = path82.dirname(folder);
-    fs65.mkdirSync(parent, { recursive: true });
-    if (!fs65.lstatSync(parent).isDirectory()) throw new Error(parent + " is not a plain folder");
+    const parent = path85.dirname(folder);
+    fs66.mkdirSync(parent, { recursive: true });
+    if (!fs66.lstatSync(parent).isDirectory()) throw new Error(parent + " is not a plain folder");
   }
   async act(p) {
     const folder = this.folderPath(p.folder);
@@ -35474,9 +35679,9 @@ var LiveFolderHandler = class {
       const code2 = await this.mapWithRetry(folder, share2, true);
       if (code2 !== EXIT_OK) return { ok: false, message: "the test share could not be shown (" + code2 + ")" };
       try {
-        const file3 = path82.join(folder, "token.txt");
-        const stat = fs65.statSync(file3);
-        const token = stat.size <= 64 ? fs65.readFileSync(file3, "utf8").trim() : "";
+        const file3 = path85.join(folder, "token.txt");
+        const stat = fs66.statSync(file3);
+        const token = stat.size <= 64 ? fs66.readFileSync(file3, "utf8").trim() : "";
         return LIVE_TOKEN.test(token) ? { ok: true, message: "read the test share", token } : { ok: false, message: "the test share holds no token" };
       } finally {
         this.o.bind.unmap(folder);
@@ -35504,7 +35709,7 @@ var LiveFolderHandler = class {
     for (const m of this.read().mappings) {
       const folder = this.folderPath(m.folder);
       if (this.o.bind.mapped(folder) === EXIT_OK) continue;
-      fs65.mkdirSync(path82.dirname(folder), { recursive: true });
+      fs66.mkdirSync(path85.dirname(folder), { recursive: true });
       if (this.o.bind.map(folder, m.share, m.readOnly) === EXIT_OK) done++;
       else this.log("live folder " + folder + " could not be shown again");
     }
@@ -35515,7 +35720,7 @@ var LiveFolderHandler = class {
 // src/guest/daemon/live.ts
 var BIND_TIMEOUT_MS = 3e4;
 var testing = Boolean(process.env.AGENT_DAEMON_STATE_DIR || process.env.AGENT_LOCAL_DIR);
-var stateDir2 = process.env.AGENT_DAEMON_STATE_DIR ?? (process.env.AGENT_LOCAL_DIR ? path83.join(localDir, "daemon-state") : path83.join(process.env.ProgramData ?? "C:\\ProgramData", "AgentSandboxDaemon"));
+var stateDir2 = process.env.AGENT_DAEMON_STATE_DIR ?? (process.env.AGENT_LOCAL_DIR ? path86.join(localDir, "daemon-state") : path86.join(process.env.ProgramData ?? "C:\\ProgramData", "AgentSandboxDaemon"));
 function bindMount(args) {
   const r = spawnSync7(ensureCompiled("bindmount"), args, {
     windowsHide: true,
@@ -35530,7 +35735,7 @@ var realBind = {
   mapped: (folder) => bindMount(["mapped", folder])
 };
 function protectStateDir() {
-  fs66.mkdirSync(stateDir2, { recursive: true });
+  fs67.mkdirSync(stateDir2, { recursive: true });
   if (!isWin || testMode || testing) return;
   spawnSync7(
     SYSTEM.icacls(),
@@ -35543,7 +35748,7 @@ function protectStateDir() {
 }
 var liveFolders = new LiveFolderHandler({
   run,
-  stateFile: path83.join(stateDir2, "live-folders.json"),
+  stateFile: path86.join(stateDir2, "live-folders.json"),
   launchId: session.launchId,
   bind: realBind,
   log: warn
@@ -35573,9 +35778,9 @@ var Daemon = class {
   tick() {
     const { valid, invalid } = run.scanRequests();
     for (const file3 of invalid)
-      safely("removing an invalid request", () => fs67.rmSync(file3, { recursive: true, force: true }));
+      safely("removing an invalid request", () => fs68.rmSync(file3, { recursive: true, force: true }));
     for (const req of valid) {
-      safely("claiming a request", () => fs67.rmSync(run.requestFile(req.id), { force: true }));
+      safely("claiming a request", () => fs68.rmSync(run.requestFile(req.id), { force: true }));
       if (run.readSession(req.id)) continue;
       void Promise.resolve(this.handle(withRequestSecrets(req))).catch(
         (e) => respond(req.id, { ok: false, message: errMsg(e) })