windows-development-sandbox 1.18.4 → 1.23.0

package/dist/core/util/index.js

@@ -1,5 +1,5 @@
 export { isWin, sleep, captureOutput } from './process.js';
-export { UserError, fail, errMsg } from './errors.js';
+export { UserError, fail, failWith, errMsg } from './errors.js';
 export { parseJsonc, readJsonc } from './jsonc.js';
 export { ensureDir, dirExists, fileExists, fileExistsAsync, readJson, readSmallFile, tryReadJson, writeJson, realPath, } from './fs.js';
 export { xmlEscape, safeText, plainText } from './text.js';

package/dist/guest/accounts/adapter.d.ts

@@ -10,6 +10,8 @@ export interface GuestAdapter<K extends ServiceKind> {
     apply(p: Payload<K>): Promise<Applied> | Applied;
     /** Bounded, BOM-aware read of what the tool holds now; null when it holds none. */
     current?(): Payload<K> | null;
+    /** Asks the tool before each look, for tools that only answer asynchronously (Comet over its DevTools port). */
+    refresh?(): Promise<void>;
     /** How often current() is asked (default 60000 ms). */
     readonly checkMs?: number;
     /** When the sandbox stops: let go of what must not stay taken (a Unity seat). */

package/dist/guest/accounts/adapters.js

@@ -1,8 +1,10 @@
 import { appstoreAdapter } from './kinds/appstore.js';
 import { cfxAdapter } from './kinds/cfx.js';
+import { cometAdapter } from './kinds/comet.js';
 import { epicAdapter } from './kinds/epic.js';
 import { expoAdapter } from './kinds/expo.js';
 import { keystoreAdapter } from './kinds/keystore.js';
+import { perplexityAdapter } from './kinds/perplexity.js';
 import { playAdapter } from './kinds/play.js';
 import { steamAdapter } from './kinds/steam.js';
 import { unityAdapter } from './kinds/unity.js';
@@ -15,4 +17,6 @@ export const ADAPTERS = {
     play: playAdapter,
     expo: expoAdapter,
     appstore: appstoreAdapter,
+    perplexity: perplexityAdapter,
+    comet: cometAdapter,
 };

package/dist/guest/accounts/apply.d.ts

@@ -5,23 +5,27 @@ import { type GuestAdapter } from './adapter.js';
 export declare const DeliveredSchema: z.ZodObject<{
     fingerprints: z.ZodRecord<z.ZodEnum<{
         unity: "unity";
-        steam: "steam";
-        epic: "epic";
-        cfx: "cfx";
         keystore: "keystore";
         play: "play";
         expo: "expo";
         appstore: "appstore";
-    }> & z.core.$partial, z.ZodString>;
-    leased: z.ZodArray<z.ZodEnum<{
-        unity: "unity";
         steam: "steam";
         epic: "epic";
         cfx: "cfx";
+        perplexity: "perplexity";
+        comet: "comet";
+    }> & z.core.$partial, z.ZodString>;
+    leased: z.ZodArray<z.ZodEnum<{
+        unity: "unity";
         keystore: "keystore";
         play: "play";
         expo: "expo";
         appstore: "appstore";
+        steam: "steam";
+        epic: "epic";
+        cfx: "cfx";
+        perplexity: "perplexity";
+        comet: "comet";
     }>>;
 }, z.core.$strip>;
 export type Delivered = z.output<typeof DeliveredSchema>;

package/dist/guest/accounts/kinds/cfx.d.ts

@@ -1,2 +1,9 @@
+import type { Payload } from '../../../shared/accounts/index.js';
 import { type GuestAdapter } from '../adapter.js';
+/** The cfg FXServer reads with +exec (forward slashes: FXServer's exec takes them). */
+export declare function cfxSecretsFile(dir?: string): string;
+/** The cfg's text. The payload's patterns allow no quotes or line breaks, so the values cannot escape their line. */
+export declare function cfxSecretsText(p: Payload<'cfx'>): string;
+/** Writes the cfg into `dir` (only there); returns its path. */
+export declare function writeCfxSecrets(p: Payload<'cfx'>, dir?: string): string;
 export declare const cfxAdapter: GuestAdapter<'cfx'>;

package/dist/guest/accounts/kinds/cfx.js

@@ -1,7 +1,37 @@
-import { notAvailableYet } from '../adapter.js';
+// Cfx.re: the server licence key (and the optional Steam Web API key) go into one cfg on the sandbox's own disk
+// (secretDir: %LOCALAPPDATA%\AgentSandbox\accounts\cfx, wiped with the sandbox) that `sbx-fivem serve` hands FXServer
+// with +exec before the project's server.cfg. Never into the project, the data disk or the tools folder; not in the
+// agent's environment either. It never comes back (the key does not change in the sandbox).
+import fs from 'node:fs';
+import path from 'node:path';
+import { secretDir } from '../adapter.js';
+/** The cfg FXServer reads with +exec (forward slashes: FXServer's exec takes them). */
+export function cfxSecretsFile(dir = secretDir('cfx')) {
+    return path.join(dir, 'server-secrets.cfg');
+}
+/** The cfg's text. The payload's patterns allow no quotes or line breaks, so the values cannot escape their line. */
+export function cfxSecretsText(p) {
+    return [
+        '# Written by the sandbox at boot from your saved Cfx.re key (sandbox account login cfx). It lives on the',
+        "# sandbox's own disk and goes when it closes: never copy these lines into a project or a server.cfg.",
+        'sv_licenseKey "' + p.licenseKey + '"',
+        ...(p.steamWebApiKey ? ['set steam_webApiKey "' + p.steamWebApiKey + '"'] : []),
+        '',
+    ].join('\r\n');
+}
+/** Writes the cfg into `dir` (only there); returns its path. */
+export function writeCfxSecrets(p, dir = secretDir('cfx')) {
+    const file = cfxSecretsFile(dir);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(file, cfxSecretsText(p), { encoding: 'utf8', mode: 0o600 });
+    return file;
+}
 export const cfxAdapter = {
     kind: 'cfx',
-    apply(_p) {
-        return notAvailableYet('cfx');
+    apply(p) {
+        writeCfxSecrets(p);
+        return {
+            summary: 'Cfx.re: the server key is ready for sbx-fivem serve' + (p.steamWebApiKey ? ' (with a Steam Web API key)' : ''),
+        };
     },
 };

package/dist/guest/accounts/kinds/comet.d.ts

@@ -0,0 +1,7 @@
+import { type CometPayload } from '../../../shared/accounts/index.js';
+import { type GuestAdapter } from '../adapter.js';
+/** Where the sign-in waits for Comet. */
+export declare function cometPendingFile(root?: string): string;
+/** The sign-in waiting for Comet, or null (none, or not the expected shape). */
+export declare function takePendingComet(root?: string): CometPayload | null;
+export declare const cometAdapter: GuestAdapter<'comet'>;

package/dist/guest/accounts/kinds/comet.js

@@ -0,0 +1,50 @@
+// Comet: the saved perplexity.ai sign-in cookies wait in secretDir('comet') (the sandbox's own disk) until the apps
+// step has Comet ready, which writes them into its profile over DevTools and deletes the file. While the sandbox runs,
+// the watch asks the running Comet for its perplexity.ai cookies, so a sign-in made here (or renewed) is kept for the
+// next sandbox. When Comet is not running, the last sign-in seen stands.
+import fs from 'node:fs';
+import path from 'node:path';
+import { cometSummary, PAYLOADS } from '../../../shared/accounts/index.js';
+import { readBoundedFile } from '../../../shared/io/bounded.js';
+import { readCometSignIn } from '../../browser/comet.js';
+import { secretDir } from '../adapter.js';
+/** Where the sign-in waits for Comet. */
+export function cometPendingFile(root = secretDir('comet')) {
+    return path.join(root, 'restore.json');
+}
+/** The sign-in waiting for Comet, or null (none, or not the expected shape). */
+export function takePendingComet(root) {
+    const file = cometPendingFile(root);
+    const bytes = readBoundedFile(file, 512 * 1024);
+    fs.rmSync(file, { force: true });
+    if (!bytes)
+        return null;
+    try {
+        const parsed = PAYLOADS.comet.safeParse(JSON.parse(bytes.toString('utf8')));
+        return parsed.success ? parsed.data : null;
+    }
+    catch {
+        return null; // Not JSON: nothing to restore.
+    }
+}
+/** The last sign-in seen in this process (the daemon's watch). */
+let held = null;
+export const cometAdapter = {
+    kind: 'comet',
+    apply(p) {
+        const file = cometPendingFile();
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, JSON.stringify(p), { encoding: 'utf8', mode: 0o600 });
+        held = p;
+        return { summary: 'Comet: your saved sign-in (' + cometSummary(p) + ') goes into its profile once it is ready' };
+    },
+    async refresh() {
+        const now = await readCometSignIn();
+        if (now)
+            held = now;
+    },
+    current() {
+        return held;
+    },
+    checkMs: 120_000,
+};

package/dist/guest/accounts/kinds/perplexity.d.ts

@@ -0,0 +1,2 @@
+import type { GuestAdapter } from '../adapter.js';
+export declare const perplexityAdapter: GuestAdapter<'perplexity'>;

package/dist/guest/accounts/kinds/perplexity.js

@@ -0,0 +1,12 @@
+// Perplexity: the API key becomes PERPLEXITY_API_KEY in the agent's environment, in memory only. Nothing is written
+// to a file: the MCP servers read the variable (Claude Code passes its environment on; Codex is told its name).
+import { PERPLEXITY_ENV, perplexitySummary } from '../../../shared/accounts/index.js';
+export const perplexityAdapter = {
+    kind: 'perplexity',
+    apply(p) {
+        return {
+            env: { [PERPLEXITY_ENV]: p.apiKey },
+            summary: 'Perplexity API key (' + perplexitySummary(p) + ') in ' + PERPLEXITY_ENV + ' for the agent',
+        };
+    },
+};

package/dist/guest/accounts/watch.d.ts

@@ -21,6 +21,8 @@ export declare class AccountWatch {
     /** The kinds being watched. */
     watched(): readonly ServiceKind[];
     start(): void;
+    /** Lets an adapter that answers asynchronously ask its tool first, then looks; never throws. */
+    private look;
     /** One look at one kind; true when a handoff was written. */
     check(kind: ServiceKind): boolean;
     /** Looks at every kind now; with `final` (the sandbox stops) each adapter also lets go of what it holds. */

package/dist/guest/accounts/watch.js

@@ -33,11 +33,21 @@ export class AccountWatch {
     }
     start() {
         for (const kind of this.kinds) {
-            const timer = setInterval(() => this.check(kind), this.adapter(kind).checkMs ?? DEFAULT_CHECK_MS);
+            const timer = setInterval(() => void this.look(kind), this.adapter(kind).checkMs ?? DEFAULT_CHECK_MS);
             timer.unref();
             this.timers.push(timer);
         }
     }
+    /** Lets an adapter that answers asynchronously ask its tool first, then looks; never throws. */
+    async look(kind) {
+        try {
+            await this.adapter(kind).refresh?.();
+        }
+        catch (e) {
+            this.o.warn?.(SERVICE_SPECS[kind].label + ' sign-in: could not read it: ' + errMsg(e));
+        }
+        return this.check(kind);
+    }
     /** One look at one kind; true when a handoff was written. */
     check(kind) {
         try {
@@ -61,7 +71,7 @@ export class AccountWatch {
     /** Looks at every kind now; with `final` (the sandbox stops) each adapter also lets go of what it holds. */
     async flush(final = false) {
         for (const kind of this.kinds)
-            this.check(kind);
+            await this.look(kind);
         if (!final)
             return;
         for (const timer of this.timers)

package/dist/guest/agents/agent-files.d.ts

@@ -1,4 +1,4 @@
-import type { Harness } from '../../core/types.js';
+import type { Config, Harness } from '../../core/types.js';
 /** Where an agent lives in persistent storage: its folder, and the program (an .exe, or an npm .cmd) in it. */
 export interface AgentPaths {
     readonly dir: string;
@@ -13,12 +13,14 @@ export interface AgentShim {
     readonly name: string;
     readonly command: string;
     readonly target: string;
+    /** Flags the shim puts before the arguments of the caller (codex: the sandbox's own settings). */
+    readonly arguments?: readonly string[];
 }
 /** One shim per configured agent that can be installed here (a name that is not a plain command word is skipped). */
-export declare function agentShims(toolsDir: string, agents: Readonly<Record<string, Harness>>): AgentShim[];
+export declare function agentShims(toolsDir: string, agents: Readonly<Record<string, Harness>>, flags?: Readonly<Record<string, readonly string[]>>): AgentShim[];
 /**
  * The text of `<command>.cmd`: runs the installed agent, or installs it first (`install` = node + installer script).
- * The agent's own arguments pass through %* untouched.
+ * The agent's own arguments pass through %* untouched, after the shim's flags if it has any.
  */
 export declare function shimText(shim: AgentShim, install: {
     node: string;
@@ -48,13 +50,31 @@ export declare function bootResetPaths(agents: Readonly<Record<string, Harness>>
     agent: string;
     path: string;
 }[];
+type CodexSettings = Config['codex'];
 /**
- * Codex's config.toml with its own command sandbox off, or null when it already says which one to use. Inside Windows
- * Sandbox that inner sandbox only costs: its setup re-grants ACLs over the whole profile at every boot (minutes), and
- * every command hangs until it is done. A `sandbox_mode` the user set (before the first [table]) is kept.
+ * The flags every Codex start gets. Flags beat config.toml and a resumed thread's saved permissions, which is why the
+ * sandbox does not rely on the file. Full access with no questions is the one flag that skips Codex's Windows sandbox
+ * setup for certain. Pure.
+ */
+export declare function codexArguments(c: CodexSettings): string[];
+/** The arguments an agent always starts with: its own, and for codex the sandbox's settings. */
+export declare function agentArguments(name: string, harness: Harness, codex: CodexSettings | undefined): string[];
+/** The largest config.toml the sandbox edits. */
+export declare const MAX_CODEX_CONFIG_BYTES: number;
+/**
+ * Codex's config.toml as the sandbox wants it, every other line byte for byte: the lines an older version wrote above
+ * the first table (sandbox_mode, approval_policy, under the marker comment) are gone, `[windows] sandbox` follows
+ * windowsSandbox ("off" removes the line, so Codex does not set up its own sandbox users), and
+ * mcp_oauth_credentials_store = "file" is added when it is not set. Running it again changes nothing. Pure.
+ */
+export declare function codexConfigOwned(toml: string, c: CodexSettings): string;
+/**
+ * Codex's config.toml with its own command sandbox off, or null when that changes nothing. Kept for callers that
+ * predate the codex settings; use codexConfigOwned.
  */
 export declare function codexConfigWithoutSandbox(toml: string): string | null;
 /** A SQLite database file or one of its -wal / -shm siblings. */
 export declare const isDatabaseFile: (name: string) => boolean;
 /** Files that make a consistent copy: the databases and their -wal (the -shm is rebuilt by SQLite). */
 export declare const isCopyableDatabaseFile: (name: string) => boolean;
+export {};

package/dist/guest/agents/agent-files.js

@@ -15,19 +15,19 @@ export function agentCommand(name, harness) {
     return harness.npmBin ?? harness.uvBin ?? (harness.hostExecutable ?? name).replace(/\.exe$/i, '');
 }
 /** One shim per configured agent that can be installed here (a name that is not a plain command word is skipped). */
-export function agentShims(toolsDir, agents) {
+export function agentShims(toolsDir, agents, flags = {}) {
     return Object.entries(agents).flatMap(([name, harness]) => {
         const p = agentPaths(toolsDir, name, harness);
         const target = p.exe ?? p.cmd;
         const command = agentCommand(name, harness);
         return target && /^[A-Za-z0-9_-]+$/.test(command) && /^[A-Za-z0-9_-]+$/.test(name)
-            ? [{ name, command, target }]
+            ? [{ name, command, target, ...(flags[name]?.length ? { arguments: flags[name] } : {}) }]
             : [];
     });
 }
 /**
  * The text of `<command>.cmd`: runs the installed agent, or installs it first (`install` = node + installer script).
- * The agent's own arguments pass through %* untouched.
+ * The agent's own arguments pass through %* untouched, after the shim's flags if it has any.
  */
 export function shimText(shim, install) {
     return [
@@ -39,7 +39,7 @@ export function shimText(shim, install) {
         '"' + install.node + '" "' + install.script + '" install ' + shim.name,
         'if errorlevel 1 exit /b 1',
         ':run',
-        'endlocal & "%SBX_REAL%" %*',
+        'endlocal & "%SBX_REAL%" ' + (shim.arguments?.length ? shim.arguments.join(' ') + ' ' : '') + '%*',
         '',
     ].join('\r\n');
 }
@@ -61,19 +61,89 @@ export function localStateEntries(agents, stateDir, localRoot) {
 export function bootResetPaths(agents, stateDir) {
     return Object.entries(agents).flatMap(([agent, harness]) => (harness.bootReset ?? []).map((rel) => ({ agent, path: path.join(stateDir, agent, rel) })));
 }
+/** The marker the sandbox puts above the lines it writes into config.toml. */
+const CODEX_MARKER = '# Set by the sandbox';
 /**
- * Codex's config.toml with its own command sandbox off, or null when it already says which one to use. Inside Windows
- * Sandbox that inner sandbox only costs: its setup re-grants ACLs over the whole profile at every boot (minutes), and
- * every command hangs until it is done. A `sandbox_mode` the user set (before the first [table]) is kept.
+ * The flags every Codex start gets. Flags beat config.toml and a resumed thread's saved permissions, which is why the
+ * sandbox does not rely on the file. Full access with no questions is the one flag that skips Codex's Windows sandbox
+ * setup for certain. Pure.
+ */
+export function codexArguments(c) {
+    const out = c.sandboxMode === 'danger-full-access' && c.approvalPolicy === 'never'
+        ? ['--dangerously-bypass-approvals-and-sandbox']
+        : ['--sandbox', c.sandboxMode, '--ask-for-approval', c.approvalPolicy];
+    if (c.model)
+        out.push('-c', 'model="' + c.model + '"');
+    if (c.reasoningEffort !== 'default')
+        out.push('-c', 'model_reasoning_effort="' + c.reasoningEffort + '"');
+    return out;
+}
+/** The arguments an agent always starts with: its own, and for codex the sandbox's settings. */
+export function agentArguments(name, harness, codex) {
+    return name === 'codex' && codex ? [...harness.arguments, ...codexArguments(codex)] : [...harness.arguments];
+}
+/** The largest config.toml the sandbox edits. */
+export const MAX_CODEX_CONFIG_BYTES = 1024 * 1024;
+/**
+ * Codex's config.toml as the sandbox wants it, every other line byte for byte: the lines an older version wrote above
+ * the first table (sandbox_mode, approval_policy, under the marker comment) are gone, `[windows] sandbox` follows
+ * windowsSandbox ("off" removes the line, so Codex does not set up its own sandbox users), and
+ * mcp_oauth_credentials_store = "file" is added when it is not set. Running it again changes nothing. Pure.
+ */
+export function codexConfigOwned(toml, c) {
+    const eol = toml.includes('\r\n') ? '\r\n' : '\n';
+    const firstTable = toml.search(/^[ \t]*\[/m);
+    let top = firstTable < 0 ? toml : toml.slice(0, firstTable);
+    const tables = firstTable < 0 ? '' : toml.slice(firstTable);
+    top = top.replace(MARKED_LINES, '');
+    if (c.mcpLoginsInFile && !/^[ \t]*mcp_oauth_credentials_store[ \t]*=/m.test(top)) {
+        if (top && !top.endsWith('\n'))
+            top += eol;
+        top += 'mcp_oauth_credentials_store = "file"' + eol + (tables ? eol : '');
+    }
+    return top + codexWindowsSandbox(tables, c.windowsSandbox, eol);
+}
+/** The lines an older version wrote above the first table: its marker comment, then sandbox_mode / approval_policy. */
+const MARKED_LINES = new RegExp('^' + CODEX_MARKER + '[^\r\n]*\r?\n(?:(?:sandbox_mode|approval_policy)[ \t]*=[^\r\n]*\r?\n)*(?:[ \t]*\r?\n)?', 'm');
+/** The tables of config.toml (from the first one on) with `[windows] sandbox` set to the mode, or removed for "off". */
+function codexWindowsSandbox(tables, mode, eol) {
+    const setting = 'sandbox = "' + mode + '"';
+    const header = /^[ \t]*\[windows\][ \t]*(#[^\r\n]*)?(\r?\n|$)/m.exec(tables);
+    if (!header) {
+        if (mode === 'off')
+            return tables;
+        const gap = tables && !tables.endsWith('\n') ? eol : '';
+        return tables + gap + (tables ? eol : '') + '[windows]' + eol + setting + eol;
+    }
+    const bodyStart = header.index + header[0].length;
+    const next = tables.slice(bodyStart).search(/^[ \t]*\[/m);
+    const bodyEnd = next < 0 ? tables.length : bodyStart + next;
+    const body = tables.slice(bodyStart, bodyEnd);
+    const line = /^[ \t]*sandbox[ \t]*=[^\r\n]*(\r?\n|$)/m.exec(body);
+    let updated;
+    if (!line)
+        updated = mode === 'off' ? body : setting + eol + body;
+    else if (mode === 'off')
+        updated = body.slice(0, line.index) + body.slice(line.index + line[0].length);
+    else
+        updated = body.slice(0, line.index) + setting + line[1] + body.slice(line.index + line[0].length);
+    const head = tables.slice(0, bodyStart);
+    return (head.endsWith('\n') || !updated ? head : head + eol) + updated + tables.slice(bodyEnd);
+}
+/**
+ * Codex's config.toml with its own command sandbox off, or null when that changes nothing. Kept for callers that
+ * predate the codex settings; use codexConfigOwned.
  */
 export function codexConfigWithoutSandbox(toml) {
-    const firstTable = toml.search(/^\s*\[/m);
-    const topLevel = firstTable < 0 ? toml : toml.slice(0, firstTable);
-    if (/^\s*sandbox_mode\s*=/m.test(topLevel))
-        return null;
-    return ('# Set by the sandbox: Windows Sandbox already contains Codex, its own command sandbox would only slow it down.\n' +
-        'sandbox_mode = "danger-full-access"\n' +
-        (toml ? '\n' + toml : ''));
+    const out = codexConfigOwned(toml, {
+        sandboxMode: 'danger-full-access',
+        approvalPolicy: 'never',
+        model: '',
+        reasoningEffort: 'default',
+        windowsSandbox: 'off',
+        mcpLoginsInFile: true,
+    });
+    return out === toml ? null : out;
 }
 /** A SQLite database file or one of its -wal / -shm siblings. */
 export const isDatabaseFile = (name) => /\.(sqlite3?|db)(-wal|-shm)?$/i.test(name);

package/dist/guest/agents/agent-installer.js

@@ -6,7 +6,7 @@ import { SYSTEM } from '../../shared/system.js';
 import { setupUv, uvVars } from '../toolchains/runtimes.js';
 import { emptyEnv } from '../toolchains/tool-env.js';
 import { dryRun, hostToolsDir, isWin, toolsDir } from '../runtime/paths.js';
-import { execAsync } from '../runtime/process.js';
+import { execHeavy as execAsync } from '../runtime/pools.js';
 import { exists, mkdirp } from '../runtime/fs.js';
 import { log, warn } from '../runtime/log.js';
 import { session } from '../runtime/session.js';

package/dist/guest/agents/local-state.d.ts

@@ -5,8 +5,11 @@ export declare function agentLocalStates(): LocalState[];
 export declare function localStateVars(): Record<string, string>;
 /** Boot: what an agent sealed to the last sandbox (bootReset) is deleted, so it sets it up again. Links are left. */
 export declare function resetMachineBound(): void;
-/** Boot: Codex runs its commands without its own sandbox (codexConfigWithoutSandbox), unless the user picked one. */
-export declare function codexWithoutInnerSandbox(): void;
+/**
+ * Boot: Codex's config.toml follows the codex settings (codexConfigOwned): no Windows sandbox setup of its own, its MCP
+ * logins in a file. The sandbox mode itself travels as launch flags (codexArguments), which beat this file.
+ */
+export declare function codexBootConfig(): void;
 /** Boot: the saved databases of every configured agent are copied to the sandbox's disk, where the agent runs them. */
 export declare function restoreLocalState(): void;
 /**

package/dist/guest/agents/local-state.js

@@ -10,7 +10,7 @@ import { execOutput } from '../runtime/process.js';
 import { log, warn } from '../runtime/log.js';
 import { session, stateDir } from '../runtime/session.js';
 import { errMsg } from '../../core/util/errors.js';
-import { bootResetPaths, codexConfigWithoutSandbox, isCopyableDatabaseFile, isDatabaseFile, localStateEntries, } from './agent-files.js';
+import { bootResetPaths, codexConfigOwned, MAX_CODEX_CONFIG_BYTES, isCopyableDatabaseFile, isDatabaseFile, localStateEntries, } from './agent-files.js';
 const SQLITE_HEADER = 'SQLite format 3\0';
 /** The sandbox-disk folder that holds the working copies. */
 const localRoot = () => path.join(localDir, 'agent-state');
@@ -102,17 +102,31 @@ export function resetMachineBound() {
         }
     }
 }
-/** Boot: Codex runs its commands without its own sandbox (codexConfigWithoutSandbox), unless the user picked one. */
-export function codexWithoutInnerSandbox() {
-    if (dryRun || !session.agents?.codex)
+/**
+ * Boot: Codex's config.toml follows the codex settings (codexConfigOwned): no Windows sandbox setup of its own, its MCP
+ * logins in a file. The sandbox mode itself travels as launch flags (codexArguments), which beat this file.
+ */
+export function codexBootConfig() {
+    if (dryRun || !session.agents?.codex || !session.codex)
         return;
     const file = path.join(stateDir, 'codex', 'config.toml');
-    const updated = codexConfigWithoutSandbox(exists(file) ? fs.readFileSync(file, 'utf8') : '');
-    if (updated === null)
-        return;
-    mkdirp(path.dirname(file));
-    fs.writeFileSync(file, updated, 'utf8');
-    log('codex: its own command sandbox is off (sandbox_mode = "danger-full-access" in config.toml).');
+    try {
+        const size = exists(file) ? fs.statSync(file).size : 0;
+        if (size > MAX_CODEX_CONFIG_BYTES) {
+            warn('codex: config.toml is over 1 MB; left as it is.');
+            return;
+        }
+        const before = size ? fs.readFileSync(file, 'utf8') : '';
+        const after = codexConfigOwned(before, session.codex);
+        if (after === before)
+            return;
+        mkdirp(path.dirname(file));
+        fs.writeFileSync(file, after, 'utf8');
+        log('codex: config.toml updated (Windows sandbox "' + session.codex.windowsSandbox + '").');
+    }
+    catch (e) {
+        warn('codex: could not update config.toml (' + errMsg(e) + ').');
+    }
 }
 /** Boot: the saved databases of every configured agent are copied to the sandbox's disk, where the agent runs them. */
 export function restoreLocalState() {

package/dist/guest/agents/profile-links.d.ts

@@ -1,4 +1,6 @@
 import type { Harness } from '../../core/types.js';
+/** The boot's linkProfileDirs without blocking the event loop. */
+export declare function linkProfileDirsAsync(agents: Readonly<Record<string, readonly string[] | undefined>>): Promise<void>;
 /** Makes the profile folders of these agents junctions into state\<agent>\profile; one failure never stops the boot. */
 export declare function linkProfileDirs(agents: Readonly<Record<string, readonly string[] | undefined>>): void;
 /** The same for one agent, when it is installed (the daemon starts agents the boot did not know). */

package/dist/guest/agents/profile-links.js

@@ -1,16 +1,30 @@
 import { profileLinkPairs } from '../../shared/paths/index.js';
 import { dryRun, isWin, testMode } from '../runtime/paths.js';
-import { runScriptWithJson } from '../runtime/process.js';
+import { runScriptWithJson, runScriptWithJsonAsync } from '../runtime/process.js';
 import { stateDir } from '../runtime/session.js';
 import { log, warn } from '../runtime/log.js';
 import { errMsg } from '../../core/util/errors.js';
 /** The sandbox's own user profile folder (not a setting: the guest's account). */
 const profileRoot = () => process.env.USERPROFILE ?? '';
+const linkPairs = (agents) => !isWin || dryRun || testMode || !profileRoot()
+    ? []
+    : Object.entries(agents).flatMap(([agent, dirs]) => dirs?.length ? profileLinkPairs(agent, dirs, profileRoot(), stateDir) : []);
+/** The boot's linkProfileDirs without blocking the event loop. */
+export async function linkProfileDirsAsync(agents) {
+    const pairs = linkPairs(agents);
+    if (!pairs.length)
+        return;
+    try {
+        await runScriptWithJsonAsync('link-profile-dirs.ps1', 'PairsFile', pairs);
+        log('Agent logins kept: ' + pairs.length + ' profile folder(s) linked into persistent storage.');
+    }
+    catch (e) {
+        warn('Could not link the agent profile folders (their logins will not be kept): ' + errMsg(e));
+    }
+}
 /** Makes the profile folders of these agents junctions into state\<agent>\profile; one failure never stops the boot. */
 export function linkProfileDirs(agents) {
-    if (!isWin || dryRun || testMode || !profileRoot())
-        return;
-    const pairs = Object.entries(agents).flatMap(([agent, dirs]) => dirs?.length ? profileLinkPairs(agent, dirs, profileRoot(), stateDir) : []);
+    const pairs = linkPairs(agents);
     if (!pairs.length)
         return;
     try {

package/dist/guest/apps/after-install.js

@@ -1,6 +1,10 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { SYSTEM } from '../../shared/system.js';
+import { errMsg } from '../../core/util/errors.js';
+import { takePendingComet } from '../accounts/kinds/comet.js';
+import { restoreCometSignIn } from '../browser/comet.js';
+import { log, warn } from '../runtime/log.js';
 import { execAsync } from '../runtime/process.js';
 import { exists, mkdirp } from '../runtime/fs.js';
 import { arch, tool } from '../toolchains/tool-env.js';
@@ -24,6 +28,19 @@ const SYSINTERNALS_TOOLS = [
     'Du',
     'ZoomIt',
 ];
+/** Your saved Comet sign-in (handed over at boot) goes into Comet's profile now that Comet is there. */
+async function restoreComet(exe) {
+    const pending = takePendingComet();
+    if (!pending)
+        return;
+    try {
+        const written = await restoreCometSignIn(exe, pending);
+        log('Comet: your saved sign-in is in its profile (' + written + ' cookies).');
+    }
+    catch (e) {
+        warn('Comet: your saved sign-in could not be put into its profile (' + errMsg(e) + '); sign in again in Comet.');
+    }
+}
 /** Settings an app needs on every boot (the sandbox's registry is new each time), and files next to its program. */
 export async function afterInstall(entry, exe) {
     const dir = path.dirname(exe);
@@ -39,6 +56,8 @@ export async function afterInstall(entry, exe) {
         fs.writeFileSync(path.join(dir, '._sc_'), '');
     if (entry.id === 'sublime')
         mkdirp(path.join(dir, 'Data'));
+    if (entry.id === 'comet')
+        await restoreComet(exe);
     if (entry.id === 'sysinternals') {
         for (const name of SYSINTERNALS_TOOLS) {
             await execAsync(SYSTEM.reg(), ['add', 'HKCU\\Software\\Sysinternals\\' + name, '/v', 'EulaAccepted', '/t', 'REG_DWORD', '/d', '1', '/f'], { stdio: 'ignore' }).catch(() => undefined);

package/dist/guest/apps/app-installer.d.ts

@@ -4,6 +4,8 @@ import { type ToolEnv } from '../toolchains/tool-env.js';
 export interface AppsOptions {
     gitAccess: GitAccess;
     refresh: boolean;
+    /** Every app chosen (apps.install): one app's start-up can depend on another (Comet's port for comet-mcp). */
+    chosen?: readonly string[];
 }
 export declare class AppInstaller {
     private readonly env;
@@ -12,11 +14,20 @@ export declare class AppInstaller {
     private readonly gui;
     private readonly installed;
     constructor(env: ToolEnv, options: AppsOptions, parallel?: number);
+    /**
+     * Downloads the plain downloads (not pinned, not npm, not remote) of the apps that are not installed yet, into
+     * `<app folder>.download`, which `download()` uses instead of downloading again. A failure is left for the install.
+     */
+    prefetch(entries: readonly AppEntry[]): Promise<void>;
     /** Installs the entries (7-Zip first: the NSIS apps need it to unpack), then their shortcuts. */
     installAll(entries: readonly AppEntry[]): Promise<void>;
     private installOne;
+    /** The command line an app's shortcut starts it with (Comet: its own profile, DevTools on 127.0.0.1). */
+    private launchArgs;
     /** Downloads and unpacks one entry into its folder (replaced in one step: never half there). */
     private download;
 }
 /** Installs apps.install and apps.custom (skipped ones are listed in the summary). */
 export declare function setupApps(env: ToolEnv, apps: Config['apps'], o: AppsOptions): Promise<void>;
+/** Downloads the apps ahead of their install (the Apps step waits for Mesa, uv and the runtime first). */
+export declare function prefetchApps(apps: Config['apps'], o: AppsOptions): Promise<void>;