windows-development-sandbox 1.18.4 → 1.20.0

package/dist/guest/agents/local-state.js

@@ -10,7 +10,7 @@ import { execOutput } from '../runtime/process.js';
 import { log, warn } from '../runtime/log.js';
 import { session, stateDir } from '../runtime/session.js';
 import { errMsg } from '../../core/util/errors.js';
-import { bootResetPaths, codexConfigWithoutSandbox, isCopyableDatabaseFile, isDatabaseFile, localStateEntries, } from './agent-files.js';
+import { bootResetPaths, codexConfigOwned, MAX_CODEX_CONFIG_BYTES, isCopyableDatabaseFile, isDatabaseFile, localStateEntries, } from './agent-files.js';
 const SQLITE_HEADER = 'SQLite format 3\0';
 /** The sandbox-disk folder that holds the working copies. */
 const localRoot = () => path.join(localDir, 'agent-state');
@@ -102,17 +102,31 @@ export function resetMachineBound() {
         }
     }
 }
-/** Boot: Codex runs its commands without its own sandbox (codexConfigWithoutSandbox), unless the user picked one. */
-export function codexWithoutInnerSandbox() {
-    if (dryRun || !session.agents?.codex)
+/**
+ * Boot: Codex's config.toml follows the codex settings (codexConfigOwned): no Windows sandbox setup of its own, its MCP
+ * logins in a file. The sandbox mode itself travels as launch flags (codexArguments), which beat this file.
+ */
+export function codexBootConfig() {
+    if (dryRun || !session.agents?.codex || !session.codex)
         return;
     const file = path.join(stateDir, 'codex', 'config.toml');
-    const updated = codexConfigWithoutSandbox(exists(file) ? fs.readFileSync(file, 'utf8') : '');
-    if (updated === null)
-        return;
-    mkdirp(path.dirname(file));
-    fs.writeFileSync(file, updated, 'utf8');
-    log('codex: its own command sandbox is off (sandbox_mode = "danger-full-access" in config.toml).');
+    try {
+        const size = exists(file) ? fs.statSync(file).size : 0;
+        if (size > MAX_CODEX_CONFIG_BYTES) {
+            warn('codex: config.toml is over 1 MB; left as it is.');
+            return;
+        }
+        const before = size ? fs.readFileSync(file, 'utf8') : '';
+        const after = codexConfigOwned(before, session.codex);
+        if (after === before)
+            return;
+        mkdirp(path.dirname(file));
+        fs.writeFileSync(file, after, 'utf8');
+        log('codex: config.toml updated (Windows sandbox "' + session.codex.windowsSandbox + '").');
+    }
+    catch (e) {
+        warn('codex: could not update config.toml (' + errMsg(e) + ').');
+    }
 }
 /** Boot: the saved databases of every configured agent are copied to the sandbox's disk, where the agent runs them. */
 export function restoreLocalState() {

package/dist/guest/boot/boot.js

@@ -5,8 +5,8 @@ import { spawn } from 'node:child_process';
 import { writeGuides } from './guide.js';
 import { setupToolchains } from '../toolchains/index.js';
 import { agents } from '../agents/agent-installer.js';
-import { agentShims, sbxAgentText, shimText } from '../agents/agent-files.js';
-import { codexWithoutInnerSandbox, resetMachineBound, restoreLocalState } from '../agents/local-state.js';
+import { agentArguments, agentShims, codexArguments, sbxAgentText, shimText } from '../agents/agent-files.js';
+import { codexBootConfig, resetMachineBound, restoreLocalState } from '../agents/local-state.js';
 import { installShellPath } from '../setup/shell-path.js';
 import { linkProfileDirs } from '../agents/profile-links.js';
 import { restoreClaudeMem } from '../setup/claude-mem.js';
@@ -120,7 +120,7 @@ function writeDevToolCommands(dir) {
  */
 function writeAgentCommands(dir) {
     const install = { node: process.execPath, script: path.join(path.dirname(process.argv[1]), 'agent.js') };
-    for (const shim of agentShims(toolsDir, session.agents ?? {}))
+    for (const shim of agentShims(toolsDir, session.agents ?? {}, session.codex ? { codex: codexArguments(session.codex) } : {}))
         fs.writeFileSync(path.join(dir, shim.command + '.cmd'), shimText(shim, install));
     fs.writeFileSync(path.join(dir, 'sbx-agent.cmd'), sbxAgentText(install));
 }
@@ -280,7 +280,7 @@ export class Boot {
             await soft('Claude settings', () => syncClaudeProfile(this.secrets.claudeCredentials));
         await soft('claude-mem restore', restoreClaudeMem);
         await soft('Agent files of the last sandbox', resetMachineBound);
-        await soft('Codex without its own sandbox', codexWithoutInnerSandbox);
+        await soft('Codex settings', codexBootConfig);
         await soft('Agent databases restore', restoreLocalState);
         // Agent add-ons: MCP servers in the sandbox's Claude Code, and the Headroom proxy before the managed settings point
         // Claude Code at it (the guide reads them back, so it comes last).
@@ -316,7 +316,12 @@ export class Boot {
         if (dryRun) {
             const launch = agents.resolveLaunch(session.harnessName, session.harness);
             log('(dry run) would run: ' +
-                [launch.file, ...launch.args, ...session.harness.arguments, ...session.harnessArguments].join(' ') +
+                [
+                    launch.file,
+                    ...launch.args,
+                    ...agentArguments(session.harnessName, session.harness, session.codex),
+                    ...session.harnessArguments,
+                ].join(' ') +
                 ' | cwd=' +
                 workspace);
             runHooks('post-agent', env);

package/dist/guest/daemon/sessions.js

@@ -18,6 +18,7 @@ import { freePort } from '../runtime/ports.js';
 import { primaryProject } from '../boot/project-status.js';
 import { endLeftoverTree, ensurePtyHost, ptyHostLogTail, recordedTrees, startPtyHost, waitForPtyHost, } from '../sessions/pty-host.js';
 import { agents } from '../agents/agent-installer.js';
+import { agentArguments } from '../agents/agent-files.js';
 import { saveClaudeMem } from '../setup/claude-mem.js';
 import { saveLocalState } from '../agents/local-state.js';
 import { projectHooks, runHooks, runHooksAsync } from '../setup/hooks.js';
@@ -108,7 +109,7 @@ const agentProgram = async (req, env, say) => {
     say('Preparing ' + req.harness);
     await agents.provision(req.harness, harness, env, false);
     const launch = agents.resolveLaunch(req.harness, harness);
-    const base = [...launch.args, ...harness.arguments];
+    const base = [...launch.args, ...agentArguments(req.harness, harness, session.codex)];
     return {
         command: commandLine(launch.file, [...base, ...req.args]),
         restartCommand: commandLine(launch.file, [...base, ...(harness.resumeArguments ?? [])]),

package/dist/guest/toolchains/installers.d.ts

@@ -1,12 +1,8 @@
-/** Who signs the installers the toolchains run (the subject of the signature). */
-export declare const SIGNERS: {
-    readonly microsoft: "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US";
-    readonly valve: RegExp;
-    readonly unity: RegExp;
-};
-/** Whether a file's signature is the expected signer's. */
-export declare function signedBy(file: string, signer: string | RegExp): boolean;
+import { SIGNERS, type AppSigner } from '../../shared/signer.js';
+import { signedBy } from './signature.js';
+export { SIGNERS };
+export { signedBy };
 /** A downloader `verify` hook: refuses a file not signed by `signer` (it counts as integrity for requireChecksum). */
-export declare function signatureCheck(signer: string | RegExp, what: string): (file: string) => void;
+export declare function signatureCheck(signer: AppSigner, what: string): (file: string) => void;
 /** The installer at `file` (downloaded once from `url`), checked against its signer and, when given, its SHA-256. */
-export declare function signedInstaller(url: string, file: string, what: string, signer: string | RegExp, sha256?: string | null): Promise<string>;
+export declare function signedInstaller(url: string, file: string, what: string, signer: AppSigner, sha256?: string | null): Promise<string>;

package/dist/guest/toolchains/installers.js

@@ -5,18 +5,10 @@ import path from 'node:path';
 import { downloader } from '../../shared/download/index.js';
 import { exists, mkdirp } from '../runtime/fs.js';
 import { log } from '../runtime/log.js';
-import { MICROSOFT_SIGNER, signerOf } from './native/vcruntime.js';
-/** Who signs the installers the toolchains run (the subject of the signature). */
-export const SIGNERS = {
-    microsoft: MICROSOFT_SIGNER,
-    valve: /^CN="?Valve(,| Corp)/,
-    unity: /^CN="?Unity Technologies/,
-};
-/** Whether a file's signature is the expected signer's. */
-export function signedBy(file, signer) {
-    const subject = signerOf(file);
-    return typeof signer === 'string' ? subject === signer : signer.test(subject);
-}
+import { SIGNERS } from '../../shared/signer.js';
+import { signedBy } from './signature.js';
+export { SIGNERS };
+export { signedBy };
 /** A downloader `verify` hook: refuses a file not signed by `signer` (it counts as integrity for requireChecksum). */
 export function signatureCheck(signer, what) {
     return (file) => {

package/dist/guest/toolchains/native/autosdk.d.ts

@@ -0,0 +1,3 @@
+import { type ToolEnv } from '../tool-env.js';
+/** Makes the AutoSDK tree from the portable MSVC if it is missing for this MSVC and SDK, and points Unreal at it. */
+export declare function setupAutosdk(env: ToolEnv): Promise<void>;

package/dist/guest/toolchains/native/autosdk.js

@@ -0,0 +1,50 @@
+// Unreal without Visual Studio (toolchains.unreal.visualStudio = "autosdk", experimental): an AutoSDK tree made from
+// the portable MSVC (tools\msvc), at tools\unreal\autosdk, which UnrealBuildTool finds through UE_SDKS_ROOT. Made of
+// copies (mapped folders refuse links), once; kept between sandboxes. The editor's Visual Studio integration is not
+// available.
+import fs from 'node:fs';
+import path from 'node:path';
+import { z } from 'zod';
+import { writeJsonAtomic } from '../../../shared/io/json.js';
+import { robocopyFailed } from '../../../shared/io/robocopy-result.js';
+import { spawnAsync } from '../../../shared/download/index.js';
+import { SYSTEM } from '../../../shared/system.js';
+import { exists, mkdirp } from '../../runtime/fs.js';
+import { log } from '../../runtime/log.js';
+import { tool } from '../tool-env.js';
+import { hasCompiler, readInstalled, ROOT as MSVC_ROOT } from './msvc/tree.js';
+import { autosdkLayout } from './vs-request.js';
+const AUTOSDK_DIR = tool('unreal', 'autosdk');
+const MARKER = path.join(AUTOSDK_DIR, '.complete.json');
+const MarkerSchema = z.object({ msvc: z.string(), sdk: z.string() });
+function builtFor(msvc, sdk) {
+    try {
+        const done = MarkerSchema.parse(JSON.parse(fs.readFileSync(MARKER, 'utf8')));
+        return done.msvc === msvc && done.sdk === sdk;
+    }
+    catch {
+        return false; // No marker, or a half-written one: build again.
+    }
+}
+/** Makes the AutoSDK tree from the portable MSVC if it is missing for this MSVC and SDK, and points Unreal at it. */
+export async function setupAutosdk(env) {
+    const msvc = readInstalled();
+    if (!msvc || !hasCompiler(msvc.msvc))
+        throw new Error('toolchains.unreal.visualStudio = "autosdk" builds from the portable MSVC, which is not installed ' +
+            '(is toolchains.msvc off?)');
+    if (!builtFor(msvc.msvc, msvc.sdk)) {
+        log('Making the Unreal AutoSDK from MSVC ' + msvc.msvc + ' (~2 GB, once) ...');
+        fs.rmSync(MARKER, { force: true });
+        for (const pair of autosdkLayout(MSVC_ROOT, msvc.msvc, msvc.sdk, AUTOSDK_DIR)) {
+            mkdirp(pair.to);
+            const code = await spawnAsync(SYSTEM.robocopy(), [pair.from, pair.to, '/E', '/COPY:DAT', '/R:1', '/W:1', '/NP']);
+            if (robocopyFailed(code))
+                throw new Error('could not copy ' + pair.from + ' into the AutoSDK (robocopy ' + code + ')');
+        }
+        writeJsonAtomic(MARKER, { msvc: msvc.msvc, sdk: msvc.sdk });
+    }
+    if (!exists(MARKER))
+        throw new Error('the Unreal AutoSDK was not completed');
+    env.vars['UE_SDKS_ROOT'] = AUTOSDK_DIR;
+    env.summary.push('unreal autosdk: MSVC ' + msvc.msvc + ', Windows SDK ' + msvc.sdk + ' (UE_SDKS_ROOT=' + AUTOSDK_DIR + ')');
+}

package/dist/guest/toolchains/native/unreal.js

@@ -12,6 +12,7 @@ import { log } from '../../runtime/log.js';
 import { setupUnrealEngines } from '../engines/unreal-engines.js';
 import { SIGNERS, signedInstaller } from '../installers.js';
 import { tool } from '../tool-env.js';
+import { setupAutosdk } from './autosdk.js';
 import { installedVs } from './visual-studio.js';
 export { UNREAL_COMPONENTS } from './vs-request.js';
 const DIRECTX_URL = 'https://download.microsoft.com/download/8/4/A/84A35BF1-DAFE-4AE8-82AF-AD2AE20B6B14/directx_Jun2010_redist.exe';
@@ -39,6 +40,8 @@ export async function setupUnreal(env, config, ctx) {
         return;
     }
     await installDirectX();
+    if (config.visualStudio === 'autosdk')
+        await setupAutosdk(env);
     await setupUnrealEngines(env, config, ctx);
     const vs = installedVs();
     env.summary.push('unreal: ' +

package/dist/guest/toolchains/native/vcruntime.d.ts

@@ -1,7 +1,4 @@
 import { type ToolEnv } from '../tool-env.js';
-export declare const MICROSOFT_SIGNER = "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US";
-/** The subject of a valid Authenticode signature, or '' when the file is unsigned or tampered with. */
-export declare const signerOf: (file: string) => string;
 /**
  * A real installer (it writes to System32), so it runs on every boot; the installer itself is kept in persistent
  * storage and only run when Microsoft's signature on it checks out. Resolves true when this call ran the installer.

package/dist/guest/toolchains/native/vcruntime.js

@@ -3,17 +3,14 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { spawnAsync } from '../../../shared/download/index.js';
 import { dryRun } from '../../runtime/paths.js';
-import { scriptOutput } from '../../runtime/process.js';
 import { exists } from '../../runtime/fs.js';
 import { log } from '../../runtime/log.js';
 import { downloadFile } from '../install.js';
+import { SIGNERS, signedBy } from '../installers.js';
 import { tool } from '../tool-env.js';
 const VC_REDIST = 'https://aka.ms/vs/17/release/vc_redist.x64.exe';
-export const MICROSOFT_SIGNER = 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US';
 /** 1638: a newer version is already installed; 3010: installed, a restart would finish it (not needed for the DLLs). */
 const OK_EXIT_CODES = [0, 1638, 3010];
-/** The subject of a valid Authenticode signature, or '' when the file is unsigned or tampered with. */
-export const signerOf = (file) => scriptOutput('get-signer.ps1', ['-Path', file]).trim();
 /**
  * A real installer (it writes to System32), so it runs on every boot; the installer itself is kept in persistent
  * storage and only run when Microsoft's signature on it checks out. Resolves true when this call ran the installer.
@@ -32,7 +29,7 @@ export async function setupVcRuntime(env, summary = true) {
             log('Downloading the Visual C++ runtime (~25 MB once) ...');
             await downloadFile(VC_REDIST, installer);
         }
-        if (signerOf(installer) !== MICROSOFT_SIGNER) {
+        if (!signedBy(installer, SIGNERS.microsoft)) {
             fs.rmSync(installer, { force: true });
             throw new Error('vc_redist.x64.exe is not signed by Microsoft; deleted it (it is downloaded again next boot)');
         }

package/dist/guest/toolchains/native/visual-studio.d.ts

@@ -1,6 +1,6 @@
 import { type ToolEnv } from '../tool-env.js';
-import type { VsRequest } from './vs-request.js';
-export { BUILD_TOOLS_COMPONENTS, UNREAL_COMPONENTS, visualStudioWanted, type VsRequest } from './vs-request.js';
+import { type VsRequest } from './vs-request.js';
+export { BUILD_TOOLS_COMPONENTS, UNREAL_COMPONENTS, unrealUsesAutosdk, visualStudioWanted, type VsRequest, } from './vs-request.js';
 /** The newest Visual Studio (or Build Tools) with the C++ compiler: its folder and version, or null. */
 export declare function installedVs(): {
     path: string;

package/dist/guest/toolchains/native/visual-studio.js

@@ -10,15 +10,20 @@ import path from 'node:path';
 import { z } from 'zod';
 import { spawnAsync } from '../../../shared/download/index.js';
 import { writeJsonAtomic } from '../../../shared/io/json.js';
+import { robocopyFailed } from '../../../shared/io/robocopy-result.js';
+import { safeRemove } from '../../../shared/io/safe-remove.js';
+import { SYSTEM } from '../../../shared/system.js';
 import { execOutput } from '../../runtime/process.js';
 import { exists, mkdirp } from '../../runtime/fs.js';
 import { log, warn } from '../../runtime/log.js';
+import { logsDir } from '../../runtime/paths.js';
 import { duringSession } from '../../runtime/project-context.js';
 import { errMsg } from '../../../core/util/errors.js';
 import { SIGNERS, signedInstaller } from '../installers.js';
-import { assertLocalRoom, freeBytes } from '../persisted.js';
+import { assertLocalRoom, freeBytes, LOCAL_RESERVE_BYTES } from '../persisted.js';
 import { tool } from '../tool-env.js';
-export { BUILD_TOOLS_COMPONENTS, UNREAL_COMPONENTS, visualStudioWanted } from './vs-request.js';
+import { layoutNextStep, vsExitText } from './vs-request.js';
+export { BUILD_TOOLS_COMPONENTS, UNREAL_COMPONENTS, unrealUsesAutosdk, visualStudioWanted, } from './vs-request.js';
 const BOOTSTRAPPERS = {
     community: {
         url: 'https://aka.ms/vs/17/release/vs_community.exe',
@@ -63,6 +68,61 @@ export function installedVs() {
 function layoutDir(product) {
     return path.join(VS_DIR, product === 'community' ? 'layout' : 'layout-buildtools');
 }
+/** The layout arguments of the bootstrapper (the same for the data disk and the staging folder). */
+const layoutArgs = (req, folder) => [
+    '--layout',
+    folder,
+    '--lang',
+    'en-US',
+    '--quiet',
+    '--wait',
+    ...req.components.flatMap((id) => ['--add', id]),
+];
+/** The bootstrapper's newest log (dd_bootstrapper_*.log) in these folders, or null. */
+function newestBootstrapperLog(folders) {
+    const logs = folders.flatMap((dir) => {
+        try {
+            return fs
+                .readdirSync(dir)
+                .filter((n) => /^dd_bootstrapper_.*\.log$/i.test(n))
+                .map((n) => path.join(dir, n));
+        }
+        catch {
+            return []; // The folder is not there: no log in it.
+        }
+    });
+    const stamp = (f) => {
+        try {
+            return fs.statSync(f).mtimeMs;
+        }
+        catch {
+            return 0; // Gone since the listing.
+        }
+    };
+    return logs.sort((x, y) => stamp(y) - stamp(x))[0] ?? null;
+}
+/** Says why the layout failed and keeps the installer's log where the sandbox's logs are. */
+function reportLayoutFailure(code, temps) {
+    warn('Visual Studio: saving the install files failed (exit ' + code + '): ' + vsExitText(code));
+    const found = newestBootstrapperLog(temps);
+    if (!found)
+        return;
+    const kept = path.join(logsDir, 'vs-layout-' + new Date().toISOString().slice(0, 10) + '.log');
+    try {
+        fs.mkdirSync(logsDir, { recursive: true });
+        fs.copyFileSync(found, kept);
+        warn('Visual Studio: the installer log is ' + found + ' (a copy is in ' + kept + ')');
+    }
+    catch (e) {
+        warn('Visual Studio: the installer log is ' + found + ' (could not copy it: ' + errMsg(e) + ')');
+    }
+}
+/** Copies a finished layout onto the data disk (never /MOV: mapped folders refuse rename-over). */
+async function copyLayout(from, to) {
+    mkdirp(to);
+    const code = await spawnAsync(SYSTEM.robocopy(), [from, to, '/E', '/COPY:DAT', '/R:1', '/W:1', '/MT:8', '/NP']);
+    return !robocopyFailed(code);
+}
 /** The offline copy's installer when it holds every component; made or completed when there is room. */
 async function layoutInstaller(req, bootstrapper) {
     const layout = layoutDir(req.product);
@@ -79,6 +139,10 @@ async function layoutInstaller(req, bootstrapper) {
             return false;
         }
     };
+    const finish = () => {
+        writeJsonAtomic(marker, { components: [...req.components] });
+        return installer;
+    };
     if (has())
         return installer;
     if (freeBytes(mkdirp(VS_DIR)) < LAYOUT_ROOM_BYTES) {
@@ -87,21 +151,36 @@ async function layoutInstaller(req, bootstrapper) {
     }
     log('Saving the Visual Studio install files for later boots (~10 GB, once) ...');
     fs.rmSync(marker, { force: true });
-    const code = await spawnAsync(bootstrapper, [
-        '--layout',
-        layout,
-        '--lang',
-        'en-US',
-        '--quiet',
-        '--wait',
-        ...req.components.flatMap((id) => ['--add', id]),
-    ]);
-    if (!OK_EXIT_CODES.includes(code) || !exists(installer)) {
-        warn('Visual Studio: saving the install files failed (exit ' + code + '); downloading this boot');
+    // (a) The installer writes its scratch files to TEMP and moves them into the layout: a TEMP on the same (mapped)
+    // volume, inside the layout's folder tree, keeps those moves on one volume.
+    const scratch = mkdirp(path.join(VS_DIR, 'tmp'));
+    const code = await spawnAsync(bootstrapper, layoutArgs(req, layout), {
+        env: { ...process.env, TEMP: scratch, TMP: scratch },
+    });
+    if (OK_EXIT_CODES.includes(code) && exists(installer))
+        return finish();
+    reportLayoutFailure(code, [scratch, os.tmpdir()]);
+    // (b) Build it on the sandbox's own disk instead, then copy it over.
+    const drive = (process.env.SystemDrive ?? 'C:') + '\\';
+    if (layoutNextStep(code, freeBytes(drive), LOCAL_RESERVE_BYTES) !== 'stage') {
+        warn('Visual Studio: not enough room on ' + drive + ' to build the install files there; downloading this boot');
         return null;
     }
-    writeJsonAtomic(marker, { components: [...req.components] });
-    return installer;
+    const staging = path.join(drive, 'vs-layout-staging');
+    log('Building the install files on ' + drive + ' and copying them to ' + layout + ' ...');
+    const stagedCode = await spawnAsync(bootstrapper, layoutArgs(req, staging));
+    const staged = path.join(staging, BOOTSTRAPPERS[req.product].file);
+    let kept = false;
+    if (OK_EXIT_CODES.includes(stagedCode) && exists(staged)) {
+        kept = await copyLayout(staging, layout);
+        if (!kept)
+            warn('Visual Studio: copying the install files to ' + layout + ' failed');
+    }
+    else {
+        reportLayoutFailure(stagedCode, [os.tmpdir()]);
+    }
+    safeRemove(staging, drive);
+    return kept && exists(installer) ? finish() : null;
 }
 async function install(req, keepInstallFiles) {
     const boot = BOOTSTRAPPERS[req.product];
@@ -125,7 +204,12 @@ async function install(req, keepInstallFiles) {
         ...req.components.flatMap((id) => ['--add', id]),
     ]);
     if (!OK_EXIT_CODES.includes(code) || !installedVs())
-        throw new Error('the Visual Studio installer failed (exit ' + code + '); its logs are the dd_*.log files in ' + os.tmpdir());
+        throw new Error('the Visual Studio installer failed (exit ' +
+            code +
+            ': ' +
+            vsExitText(code) +
+            '); its logs are the dd_*.log files in ' +
+            os.tmpdir());
 }
 /** Visual Studio as asked for: installed at boot when it is not there yet; its folder and version. */
 export async function ensureVisualStudio(env, req, o) {

package/dist/guest/toolchains/native/vs-request.d.ts

@@ -17,3 +17,24 @@ export interface VsRequest {
     readonly accepted: boolean;
 }
 export declare function visualStudioWanted(t: Toolchains, on?: (setting: boolean | 'auto', name: string) => boolean): VsRequest | null;
+/** Whether Unreal is on and builds from the portable MSVC through AutoSDK instead of Visual Studio. */
+export declare function unrealUsesAutosdk(t: Toolchains, on?: (setting: boolean | 'auto', name: string) => boolean): boolean;
+/** The Visual Studio installer's exit code in plain words (it is a uint32: -1 and 4294967295 are the same). */
+export declare function vsExitText(code: number): string;
+/** Room the staging copy of the layout needs on the sandbox's own disk, on top of the reserve. */
+export declare const LAYOUT_STAGING_BYTES: number;
+/**
+ * What to do after the layout attempt in the data disk: 'done' when it worked, 'stage' (build it on the sandbox's
+ * own disk and copy it over) when it failed and that disk has room, 'skip' (download this boot) otherwise.
+ */
+export declare function layoutNextStep(exit: number | null, localFreeBytes: number, reserveBytes: number): 'done' | 'stage' | 'skip';
+export interface CopyPair {
+    readonly from: string;
+    readonly to: string;
+}
+/**
+ * The copies that make an Unreal AutoSDK tree from the portable MSVC (copies, not links: mapped folders refuse
+ * junctions): MSVC's tools into HostWin64\Win64\VS2022\<msvc> and the Windows SDK's Include, Lib and bin folders into
+ * HostWin64\Win64\Windows Kits\10. Pure.
+ */
+export declare function autosdkLayout(msvcRoot: string, msvc: string, sdk: string, autosdkRoot: string): CopyPair[];

package/dist/guest/toolchains/native/vs-request.js

@@ -1,3 +1,8 @@
+// Which Visual Studio this sandbox installs (a real installer: it runs every boot), from every toolchain that needs
+// one: Unreal (Community with the C++ game workload), Flutter's Windows desktop builds and Unity's Windows IL2CPP
+// builds (the Build Tools' C++ parts). Pure: no runtime, so the self-test loads it. Community holds everything the
+// Build Tools would add, so one install serves all of them.
+import path from 'node:path';
 /**
  * What Epic lists for Unreal Engine 5 with Visual Studio 2022: the game workload, MSVC v143, a Windows SDK of
  * 10.0.18362 or newer, the C++ profiling tools, the .NET Framework targeting packs some engine tools build against,
@@ -22,7 +27,8 @@ export const BUILD_TOOLS_COMPONENTS = [
 /** Whether a toolchain is on (the host resolved "auto"; a session file that still says "auto" counts as off). */
 const isOn = (setting) => setting === true;
 export function visualStudioWanted(t, on = isOn) {
-    const unreal = on(t.unreal.enabled, 'unreal');
+    // Unreal with visualStudio "autosdk" needs no Visual Studio: it builds from the portable MSVC (autosdk.ts).
+    const unreal = on(t.unreal.enabled, 'unreal') && t.unreal.visualStudio === 'full';
     const flutter = on(t.flutter.enabled, 'flutter') && t.flutter.windowsDesktop;
     const unity = on(t.unity.enabled, 'unity') && t.unity.modules.includes('windows-il2cpp');
     const users = [...(unreal ? ['unreal'] : []), ...(flutter ? ['flutter'] : []), ...(unity ? ['unity'] : [])];
@@ -44,3 +50,56 @@ export function visualStudioWanted(t, on = isOn) {
         accepted: t.msvc.acceptLicense,
     };
 }
+/** Whether Unreal is on and builds from the portable MSVC through AutoSDK instead of Visual Studio. */
+export function unrealUsesAutosdk(t, on = isOn) {
+    return on(t.unreal.enabled, 'unreal') && t.unreal.visualStudio === 'autosdk';
+}
+/** The Visual Studio installer's exit code in plain words (it is a uint32: -1 and 4294967295 are the same). */
+export function vsExitText(code) {
+    const c = code >>> 0;
+    switch (c) {
+        case 0:
+            return 'installed';
+        case 3010:
+            return 'done; a restart would finish it (not needed here)';
+        case 1602:
+            return 'cancelled';
+        case 5007:
+            return 'the installer refused to run (blocked by Windows, for example a restart waiting)';
+        case 8006:
+            return 'Visual Studio is running and must be closed first';
+        case 0xe0434352:
+            return '0xE0434352: the Visual Studio installer crashed';
+        default:
+            return 'the installer failed with exit ' + c + ' (0x' + c.toString(16).toUpperCase() + ')';
+    }
+}
+/** Room the staging copy of the layout needs on the sandbox's own disk, on top of the reserve. */
+export const LAYOUT_STAGING_BYTES = 12 * 1024 ** 3;
+/**
+ * What to do after the layout attempt in the data disk: 'done' when it worked, 'stage' (build it on the sandbox's
+ * own disk and copy it over) when it failed and that disk has room, 'skip' (download this boot) otherwise.
+ */
+export function layoutNextStep(exit, localFreeBytes, reserveBytes) {
+    if (exit !== null && (exit === 0 || exit === 3010))
+        return 'done';
+    return localFreeBytes >= LAYOUT_STAGING_BYTES + reserveBytes ? 'stage' : 'skip';
+}
+/**
+ * The copies that make an Unreal AutoSDK tree from the portable MSVC (copies, not links: mapped folders refuse
+ * junctions): MSVC's tools into HostWin64\Win64\VS2022\<msvc> and the Windows SDK's Include, Lib and bin folders into
+ * HostWin64\Win64\Windows Kits\10. Pure.
+ */
+export function autosdkLayout(msvcRoot, msvc, sdk, autosdkRoot) {
+    const win64 = path.win32.join(autosdkRoot, 'HostWin64', 'Win64');
+    return [
+        {
+            from: path.win32.join(msvcRoot, 'VC', 'Tools', 'MSVC', msvc),
+            to: path.win32.join(win64, 'VS2022', msvc),
+        },
+        ...['Include', 'Lib', 'bin'].map((part) => ({
+            from: path.win32.join(msvcRoot, 'Windows Kits', '10', part, sdk),
+            to: path.win32.join(win64, 'Windows Kits', '10', part, sdk),
+        })),
+    ];
+}

package/dist/guest/toolchains/not-yet.d.ts

@@ -1,2 +1,2 @@
 import type { ToolEnv } from './tool-env.js';
-export declare function notAvailableYet(env: ToolEnv, what: string): void;
+export declare function notAvailableYet(_env: ToolEnv, what: string): void;

package/dist/guest/toolchains/not-yet.js

@@ -1,6 +1,6 @@
-// What a toolchain step whose module is not written yet does: says so in the log and the summary, installs nothing.
+// What a toolchain step whose module is not written yet does: says so in the log, installs nothing and adds no
+// summary line.
 import { log } from '../runtime/log.js';
-export function notAvailableYet(env, what) {
+export function notAvailableYet(_env, what) {
     log(what + ': not available yet (nothing installed)');
-    env.summary.push(what + ': not available yet');
 }

package/dist/guest/toolchains/persisted.js

@@ -7,6 +7,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { freeBytesAt } from '../../shared/io/disk.js';
 import { readValid, writeJsonAtomic } from '../../shared/io/json.js';
 import { safeRemove } from '../../shared/io/safe-remove.js';
 import { dataDir } from '../runtime/paths.js';
@@ -27,13 +28,7 @@ function checkSpec(spec) {
 }
 /** Free bytes for this user on the disk holding `dir` (0 when it cannot be told). */
 export function freeBytes(dir, deps = {}) {
-    try {
-        const s = (deps.statfs ?? fs.statfsSync)(dir);
-        return s.bavail * s.bsize;
-    }
-    catch {
-        return 0;
-    }
+    return freeBytesAt(dir, deps.statfs) ?? 0;
 }
 const gb = (bytes) => (bytes / GB).toFixed(1) + ' GB';
 /** Throws (with the fix) when the disk holding `dir` has less than `needBytes` free. */

package/dist/guest/toolchains/plan.js

@@ -21,7 +21,7 @@ import { setupPhp } from './languages/php.js';
 import { setupRuby } from './languages/ruby.js';
 import { setupVcRuntime } from './native/vcruntime.js';
 import { setupVscode } from './tools/vscode.js';
-import { ensureVisualStudio, visualStudioWanted } from './native/visual-studio.js';
+import { ensureVisualStudio, unrealUsesAutosdk, visualStudioWanted } from './native/visual-studio.js';
 import { duringSession } from '../runtime/project-context.js';
 import { setupSteam } from './steam/steam.js';
 import { setupGodot } from './engines/godot.js';
@@ -42,6 +42,8 @@ export function plan(config, versions, o) {
     const android = wanted(config.android.enabled, 'android');
     // One Visual Studio for every toolchain that needs the real one (Unreal, Flutter desktop, Unity IL2CPP).
     const vs = visualStudioWanted(config, (setting, name) => wanted(setting, name));
+    // Unreal on the portable MSVC (AutoSDK) needs that MSVC even when nothing else asked for it.
+    const autosdk = unrealUsesAutosdk(config, (setting, name) => wanted(setting, name));
     const ctx = {
         refresh: o.refresh,
         pcInstalls: o.pcInstalls ?? { items: [] },
@@ -77,13 +79,16 @@ export function plan(config, versions, o) {
             name: 'Unreal',
             enabled: unreal,
             shared: true,
-            after: ['Visual Studio'],
+            after: ['Visual Studio', 'MSVC'],
             install: (env) => setupUnreal(env, config.unreal, ctx),
         },
         {
             name: 'MSVC',
-            enabled: wanted(config.msvc.enabled, 'msvc') && vs === null,
-            install: (env) => setupMsvc(env, config.msvc),
+            enabled: (wanted(config.msvc.enabled, 'msvc') || (autosdk && config.msvc.enabled !== false)) && vs === null,
+            // The same Visual Studio licence terms, which Unreal's acceptLicense already names.
+            install: (env) => setupMsvc(env, autosdk
+                ? { ...config.msvc, acceptLicense: config.msvc.acceptLicense || config.unreal.acceptLicense }
+                : config.msvc),
         },
         // Rust links with MSVC (msvc host) or MinGW's gcc (GNU host): whichever it uses goes first.
         {

package/dist/guest/toolchains/signature.d.ts

@@ -0,0 +1,5 @@
+import { type AppSigner, type Signature } from '../../shared/signer.js';
+/** The names on a file's valid signature, or null when it is unsigned, tampered with, or cannot be read. */
+export declare function signatureOf(file: string): Signature | null;
+/** Whether a file's valid signature is the expected signer's. */
+export declare function signedBy(file: string, signer: AppSigner): boolean;