windows-development-sandbox 1.20.0 → 1.23.0

package/dist/guest/apps/after-install.js

@@ -1,6 +1,10 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { SYSTEM } from '../../shared/system.js';
+import { errMsg } from '../../core/util/errors.js';
+import { takePendingComet } from '../accounts/kinds/comet.js';
+import { restoreCometSignIn } from '../browser/comet.js';
+import { log, warn } from '../runtime/log.js';
 import { execAsync } from '../runtime/process.js';
 import { exists, mkdirp } from '../runtime/fs.js';
 import { arch, tool } from '../toolchains/tool-env.js';
@@ -24,6 +28,19 @@ const SYSINTERNALS_TOOLS = [
     'Du',
     'ZoomIt',
 ];
+/** Your saved Comet sign-in (handed over at boot) goes into Comet's profile now that Comet is there. */
+async function restoreComet(exe) {
+    const pending = takePendingComet();
+    if (!pending)
+        return;
+    try {
+        const written = await restoreCometSignIn(exe, pending);
+        log('Comet: your saved sign-in is in its profile (' + written + ' cookies).');
+    }
+    catch (e) {
+        warn('Comet: your saved sign-in could not be put into its profile (' + errMsg(e) + '); sign in again in Comet.');
+    }
+}
 /** Settings an app needs on every boot (the sandbox's registry is new each time), and files next to its program. */
 export async function afterInstall(entry, exe) {
     const dir = path.dirname(exe);
@@ -39,6 +56,8 @@ export async function afterInstall(entry, exe) {
         fs.writeFileSync(path.join(dir, '._sc_'), '');
     if (entry.id === 'sublime')
         mkdirp(path.join(dir, 'Data'));
+    if (entry.id === 'comet')
+        await restoreComet(exe);
     if (entry.id === 'sysinternals') {
         for (const name of SYSINTERNALS_TOOLS) {
             await execAsync(SYSTEM.reg(), ['add', 'HKCU\\Software\\Sysinternals\\' + name, '/v', 'EulaAccepted', '/t', 'REG_DWORD', '/d', '1', '/f'], { stdio: 'ignore' }).catch(() => undefined);

package/dist/guest/apps/app-installer.d.ts

@@ -4,6 +4,8 @@ import { type ToolEnv } from '../toolchains/tool-env.js';
 export interface AppsOptions {
     gitAccess: GitAccess;
     refresh: boolean;
+    /** Every app chosen (apps.install): one app's start-up can depend on another (Comet's port for comet-mcp). */
+    chosen?: readonly string[];
 }
 export declare class AppInstaller {
     private readonly env;
@@ -12,11 +14,20 @@ export declare class AppInstaller {
     private readonly gui;
     private readonly installed;
     constructor(env: ToolEnv, options: AppsOptions, parallel?: number);
+    /**
+     * Downloads the plain downloads (not pinned, not npm, not remote) of the apps that are not installed yet, into
+     * `<app folder>.download`, which `download()` uses instead of downloading again. A failure is left for the install.
+     */
+    prefetch(entries: readonly AppEntry[]): Promise<void>;
     /** Installs the entries (7-Zip first: the NSIS apps need it to unpack), then their shortcuts. */
     installAll(entries: readonly AppEntry[]): Promise<void>;
     private installOne;
+    /** The command line an app's shortcut starts it with (Comet: its own profile, DevTools on 127.0.0.1). */
+    private launchArgs;
     /** Downloads and unpacks one entry into its folder (replaced in one step: never half there). */
     private download;
 }
 /** Installs apps.install and apps.custom (skipped ones are listed in the summary). */
 export declare function setupApps(env: ToolEnv, apps: Config['apps'], o: AppsOptions): Promise<void>;
+/** Downloads the apps ahead of their install (the Apps step waits for Mesa, uv and the runtime first). */
+export declare function prefetchApps(apps: Config['apps'], o: AppsOptions): Promise<void>;

package/dist/guest/apps/app-installer.js

@@ -6,18 +6,25 @@ import { appsToInstall } from '../../shared/apps/index.js';
 import { downloader, moveIntoPlace, stagingFolder } from '../../shared/download/index.js';
 import { safeRemove } from '../../shared/io/safe-remove.js';
 import { dryRun, launchDir } from '../runtime/paths.js';
-import { execAsync } from '../runtime/process.js';
+import { execHeavy as execAsync } from '../runtime/pools.js';
 import { exists, mkdirp } from '../runtime/fs.js';
 import { log, warn } from '../runtime/log.js';
 import { errMsg } from '../../core/util/errors.js';
-import { tool } from '../toolchains/tool-env.js';
+import { emptyEnv, tool } from '../toolchains/tool-env.js';
 import { uvVars } from '../toolchains/runtimes.js';
+import { COMET_MCP_PORT, cometShortcutArgs } from '../browser/comet.js';
 import { afterInstall } from './after-install.js';
+import { installFromKept } from './comet-unpack.js';
 import { findExe } from './find-exe.js';
 import { shortcuts } from './shortcuts.js';
+import { signatureCheck } from '../toolchains/installers.js';
 import { resolve } from './sources.js';
 import { unpack } from './unpack.js';
 const MARKER = '.agent-sandbox-app';
+/** Where `prefetch` keeps an app's download until `download()` takes it (next to the app's folder, never inside). */
+function prefetchedFile(entry, fileName) {
+    return path.join(tool('apps', ...entry.id.split('/')) + '.download', fileName.replace(/[\\/:*?"<>|]/g, '_'));
+}
 /** How many apps download and unpack at once (they are big: a few at a time keeps the disk and network busy). */
 const PARALLEL = 3;
 export class AppInstaller {
@@ -31,6 +38,32 @@ export class AppInstaller {
         this.options = options;
         this.parallel = parallel;
     }
+    /**
+     * Downloads the plain downloads (not pinned, not npm, not remote) of the apps that are not installed yet, into
+     * `<app folder>.download`, which `download()` uses instead of downloading again. A failure is left for the install.
+     */
+    async prefetch(entries) {
+        const todo = entries.filter((e) => !('remote' in e.source) &&
+            !('locked' in e.source) &&
+            !('npm' in e.source) &&
+            e.id !== '7zip' &&
+            (this.options.refresh || !exists(path.join(tool('apps', ...e.id.split('/')), MARKER))));
+        await Promise.all(todo.map(async (entry) => {
+            try {
+                const d = await resolve(entry);
+                const file = prefetchedFile(entry, d.fileName);
+                if (exists(file))
+                    return;
+                await downloader.file(d.url, file, {
+                    sha256: d.sha256 ?? null,
+                    ...(entry.signer ? { verify: signatureCheck(entry.signer, d.fileName) } : {}),
+                });
+            }
+            catch {
+                /* the install resolves and downloads again, and reports the reason if it fails too */
+            }
+        }));
+    }
     /** Installs the entries (7-Zip first: the NSIS apps need it to unpack), then their shortcuts. */
     async installAll(entries) {
         const [first, rest] = entries[0]?.id === '7zip' ? [[entries[0]], entries.slice(1)] : [[], entries];
@@ -53,9 +86,18 @@ export class AppInstaller {
     async installOne(entry) {
         try {
             const dest = tool('apps', ...entry.id.split('/'));
+            if ('remote' in entry.source) {
+                // A remote MCP server: nothing to download, the marker only says it is set up.
+                if (!exists(path.join(dest, MARKER)))
+                    fs.writeFileSync(path.join(mkdirp(dest), MARKER), JSON.stringify({ id: entry.id, at: new Date().toISOString() }));
+                this.installed.push(entry.name);
+                return;
+            }
             if (!exists(path.join(dest, MARKER)) || this.options.refresh)
                 await this.download(entry, dest);
-            const exe = findExe(dest, entry.exe);
+            // A Chromium installer that could not be unpacked is kept and installed into the sandbox each boot instead.
+            const exe = findExe(dest, entry.exe) ??
+                (entry.unpack === 'chromium' && entry.signer ? await installFromKept(dest, entry.signer, entry.name) : null);
             if (!exe)
                 throw new Error(entry.exe + ' not found in the download');
             await afterInstall(entry, exe);
@@ -63,7 +105,7 @@ export class AppInstaller {
             if (!entry.service && (entry.cli || entry.id === 'sysinternals'))
                 this.env.prepend.push(path.dirname(exe));
             if (!entry.cli && !entry.service)
-                this.gui.push({ name: entry.name, exe });
+                this.gui.push({ name: entry.name, exe, ...this.launchArgs(entry) });
             this.installed.push(entry.name);
         }
         catch (e) {
@@ -71,6 +113,12 @@ export class AppInstaller {
             this.env.summary.push(entry.name + ': FAILED');
         }
     }
+    /** The command line an app's shortcut starts it with (Comet: its own profile, DevTools on 127.0.0.1). */
+    launchArgs(entry) {
+        if (entry.id !== 'comet')
+            return {};
+        return { args: cometShortcutArgs((this.options.chosen ?? []).includes('comet-mcp') ? COMET_MCP_PORT : 0) };
+    }
     /** Downloads and unpacks one entry into its folder (replaced in one step: never half there). */
     async download(entry, dest) {
         const work = stagingFolder(dest);
@@ -98,7 +146,15 @@ export class AppInstaller {
                 const d = await resolve(entry);
                 log('Downloading ' + entry.name + ' (' + d.fileName + ', ~' + entry.size + ' once) ...');
                 const file = path.join(mkdirp(work), d.fileName.replace(/[\\/:*?"<>|]/g, '_'));
-                await downloader.file(d.url, file, { sha256: d.sha256 ?? null });
+                const ahead = prefetchedFile(entry, d.fileName);
+                if (exists(ahead))
+                    fs.copyFileSync(ahead, file);
+                else
+                    await downloader.file(d.url, file, {
+                        sha256: d.sha256 ?? null,
+                        ...(entry.signer ? { verify: signatureCheck(entry.signer, d.fileName) } : {}),
+                    });
+                fs.rmSync(ahead, { force: true });
                 await unpack(entry, file, out, d);
             }
             fs.writeFileSync(path.join(out, MARKER), JSON.stringify({ id: entry.id, at: new Date().toISOString() }));
@@ -158,5 +214,12 @@ export async function setupApps(env, apps, o) {
         log('(dry run) would install apps: ' + entries.map((e) => e.name).join(', '));
         return;
     }
-    await new AppInstaller(env, o).installAll(entries);
+    await new AppInstaller(env, { ...o, chosen: apps.install }).installAll(entries);
+}
+/** Downloads the apps ahead of their install (the Apps step waits for Mesa, uv and the runtime first). */
+export async function prefetchApps(apps, o) {
+    const { entries } = appsToInstall(apps, o.gitAccess);
+    if (dryRun)
+        return;
+    await new AppInstaller(emptyEnv(), { ...o, chosen: apps.install }).prefetch(entries);
 }

package/dist/guest/apps/comet-unpack.d.ts

@@ -0,0 +1,20 @@
+import type { AppSigner } from '../../shared/signer.js';
+/** Where the installer is kept when it could not be unpacked (below the app's folder). */
+export declare const KEPT_INSTALLER_DIR = "installer";
+/** The browser's own folder (Chrome-bin, holding `exe`) among what one stage unpacked, or null. */
+export declare function chromiumBin(root: string, exe: string): string | null;
+/** The next archive to open among what one stage unpacked (the latest stage wins), or null. */
+export declare function nextInner(root: string): string | null;
+/**
+ * Unpacks a Chromium installer into `out` with 7-Zip ("portable"); when no stage holds the browser, keeps the
+ * installer in out\installer instead ("installer").
+ */
+export declare function unpackChromium(sevenZip: string, file: string, out: string, work: string, exe: string): Promise<'portable' | 'installer'>;
+/** The installer kept in an app's folder, or null when it was unpacked. */
+export declare function keptInstaller(dest: string): string | null;
+/**
+ * Comet from its kept installer: installed into this sandbox (--install --silent) once per boot, only while the
+ * installer is still signed by `signer` (else it is deleted, and downloaded again next boot). Null when there is no
+ * kept installer.
+ */
+export declare function installFromKept(dest: string, signer: AppSigner, what: string): Promise<string | null>;

package/dist/guest/apps/comet-unpack.js

@@ -0,0 +1,127 @@
+// A Chromium browser's Windows installer (Comet's) opened with 7-Zip instead of run: installer exe -> UPDATER.PACKED.7Z
+// -> mini_installer.exe -> CHROME.PACKED.7Z -> chrome.7z -> Chrome-bin, whose contents run portable from
+// tools\apps\<id> (nothing registered, no updater, no per-boot reinstall). When the layout is not that (a new
+// installer), the signed installer is kept instead and run with --install --silent at every boot, after its signer is
+// checked again (the data folder is shared with the sandbox, so the file is never trusted from last time).
+import fs from 'node:fs';
+import path from 'node:path';
+import { installedCometExe } from '../browser/comet.js';
+import { execAsync } from '../runtime/process.js';
+import { heavy } from '../../shared/concurrency/index.js';
+import { mkdirp } from '../runtime/fs.js';
+import { signedBy } from '../toolchains/signature.js';
+/** The archives inside, last stage first: the first one found is opened next. */
+const INNER = [
+    /^chrome\.7z$/i,
+    /^chrome\.packed\.7z$/i,
+    /^mini_installer\.exe$/i,
+    /^updater\.packed\.7z$/i,
+];
+const MAX_LEVELS = 6;
+const MAX_DEPTH = 4;
+const MAX_ENTRIES = 20000;
+/** Where the installer is kept when it could not be unpacked (below the app's folder). */
+export const KEPT_INSTALLER_DIR = 'installer';
+/** Every file and folder below `root`, breadth first and bounded (no links followed). */
+function walk(root) {
+    const dirs = [];
+    const files = [];
+    let queue = [root];
+    for (let depth = 0; depth < MAX_DEPTH && queue.length && dirs.length + files.length < MAX_ENTRIES; depth++) {
+        const next = [];
+        for (const dir of queue) {
+            let entries = [];
+            try {
+                entries = fs.readdirSync(dir, { withFileTypes: true });
+            }
+            catch {
+                continue; // Unreadable: skipped.
+            }
+            for (const e of entries) {
+                const full = path.join(dir, e.name);
+                if (e.isDirectory() && !e.isSymbolicLink()) {
+                    dirs.push(full);
+                    next.push(full);
+                }
+                else if (e.isFile())
+                    files.push(full);
+            }
+        }
+        queue = next;
+    }
+    return { dirs, files };
+}
+/** The browser's own folder (Chrome-bin, holding `exe`) among what one stage unpacked, or null. */
+export function chromiumBin(root, exe) {
+    return (walk(root).dirs.find((d) => path.basename(d).toLowerCase() === 'chrome-bin' && fs.existsSync(path.join(d, exe))) ??
+        null);
+}
+/** The next archive to open among what one stage unpacked (the latest stage wins), or null. */
+export function nextInner(root) {
+    const { files } = walk(root);
+    for (const pattern of INNER) {
+        const hit = files.find((f) => pattern.test(path.basename(f)));
+        if (hit)
+            return hit;
+    }
+    return null;
+}
+/**
+ * Unpacks a Chromium installer into `out` with 7-Zip ("portable"); when no stage holds the browser, keeps the
+ * installer in out\installer instead ("installer").
+ */
+export async function unpackChromium(sevenZip, file, out, work, exe) {
+    let current = file;
+    for (let level = 0; level < MAX_LEVELS; level++) {
+        const dir = path.join(work, 'stage' + level);
+        try {
+            await heavy.run(() => execAsync(sevenZip, ['x', '-y', '-o' + dir, current], { stdio: 'ignore' }));
+        }
+        catch {
+            break; // Not an archive 7-Zip opens: keep the installer.
+        }
+        const bin = chromiumBin(dir, exe);
+        if (bin) {
+            fs.renameSync(bin, out);
+            return 'portable';
+        }
+        const inner = nextInner(dir);
+        if (!inner)
+            break;
+        current = inner;
+    }
+    const kept = path.join(mkdirp(path.join(out, KEPT_INSTALLER_DIR)), path.basename(file));
+    fs.copyFileSync(file, kept);
+    return 'installer';
+}
+/** The installer kept in an app's folder, or null when it was unpacked. */
+export function keptInstaller(dest) {
+    const dir = path.join(dest, KEPT_INSTALLER_DIR);
+    try {
+        const exe = fs.readdirSync(dir).find((n) => /\.exe$/i.test(n));
+        return exe ? path.join(dir, exe) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Comet from its kept installer: installed into this sandbox (--install --silent) once per boot, only while the
+ * installer is still signed by `signer` (else it is deleted, and downloaded again next boot). Null when there is no
+ * kept installer.
+ */
+export async function installFromKept(dest, signer, what) {
+    const installer = keptInstaller(dest);
+    if (!installer)
+        return null;
+    const installed = installedCometExe();
+    if (fs.existsSync(installed))
+        return installed;
+    if (!signedBy(installer, signer)) {
+        fs.rmSync(path.join(dest, '.agent-sandbox-app'), { force: true });
+        fs.rmSync(installer, { force: true });
+        throw new Error(what + "'s installer is not signed by its vendor; deleted it (it is downloaded again next boot)");
+    }
+    await execAsync(installer, ['--install', '--silent', '--do-not-launch-chrome'], { stdio: 'ignore' });
+    return fs.existsSync(installed) ? installed : null;
+}

package/dist/guest/apps/index.d.ts

@@ -1,3 +1,3 @@
 export { appsNeedMesa, appsNeedUv } from '../../shared/apps/index.js';
-export { setupApps, type AppsOptions } from './app-installer.js';
+export { prefetchApps, setupApps, type AppsOptions } from './app-installer.js';
 export { findExe } from './find-exe.js';

package/dist/guest/apps/index.js

@@ -2,5 +2,5 @@
 // Installers are never run: archives are unpacked, NSIS installers opened with 7-Zip and MSIs extracted (msiexec /a),
 // so nothing is registered and nothing is lost when the sandbox closes.
 export { appsNeedMesa, appsNeedUv } from '../../shared/apps/index.js';
-export { setupApps } from './app-installer.js';
+export { prefetchApps, setupApps } from './app-installer.js';
 export { findExe } from './find-exe.js';

package/dist/guest/apps/resolvers-agents-web.d.ts

@@ -0,0 +1,2 @@
+import type { Download } from './resolvers.js';
+export declare const AGENTS_WEB_RESOLVERS: Readonly<Record<string, () => Promise<Download>>>;

package/dist/guest/apps/resolvers-agents-web.js

@@ -0,0 +1,7 @@
+// Where the latest version of the agents' web apps (catalogue-agents-web.ts) is, when it is not a pinned package or a
+// remote server: Comet's installer, from Perplexity's own download address (a redirect to the current release).
+// Perplexity publishes no checksum: the download is kept only when Perplexity AI, Inc. signed it (AppEntry.signer).
+import { COMET_DOWNLOAD_URL } from '../../shared/apps/index.js';
+export const AGENTS_WEB_RESOLVERS = {
+    comet: () => Promise.resolve({ url: COMET_DOWNLOAD_URL, fileName: 'comet_installer.exe' }),
+};

package/dist/guest/apps/resolvers.js

@@ -1,6 +1,7 @@
 // Where the latest version of an app is, for apps that are not a plain GitHub release: each looks it up on the
 // vendor's own site (and its published checksum, where there is one). Named by AppSource.resolve in shared/apps.ts.
 import { fetchJson, fetchText, githubAsset, latestGithubTag } from '../../shared/download/index.js';
+import { AGENTS_WEB_RESOLVERS } from './resolvers-agents-web.js';
 import { GAMEDEV_RESOLVERS } from './resolvers-gamedev.js';
 import { MOBILE_RESOLVERS } from './resolvers-mobile.js';
 /** The SHA-256 on the line of a SHA256SUMS-style file that names `file`. */
@@ -14,6 +15,7 @@ const stripV = (tag) => tag.replace(/^v/, '');
 export const RESOLVERS = {
     ...GAMEDEV_RESOLVERS,
     ...MOBILE_RESOLVERS,
+    ...AGENTS_WEB_RESOLVERS,
     sublime: async () => {
         // Sublime publishes no checksums; the download is HTTPS from sublimetext.com.
         const { latest_version: build } = await fetchJson('https://www.sublimetext.com/updates/4/stable_update_check');

package/dist/guest/apps/shortcuts.d.ts

@@ -1,6 +1,8 @@
 export interface Shortcut {
     readonly name: string;
     readonly exe: string;
+    /** The program's command line (Comet's profile and DevTools port). */
+    readonly args?: string;
 }
 /** Desktop and Start menu shortcuts, all in one PowerShell call (sandbox\scripts\new-shortcuts.ps1). */
 export declare function shortcuts(apps: readonly Shortcut[]): void;

package/dist/guest/apps/shortcuts.js

@@ -13,6 +13,7 @@ export function shortcuts(apps) {
             link: path.join(folder, name + '.lnk'),
             target: app.exe,
             workingDirectory: path.dirname(app.exe),
+            ...(app.args ? { arguments: app.args } : {}),
         }));
     });
     runScriptWithJson('new-shortcuts.ps1', 'ListFile', links);

package/dist/guest/apps/unpack.js

@@ -3,8 +3,11 @@ import path from 'node:path';
 import { downloader, extractArchive, githubAsset } from '../../shared/download/index.js';
 import { SYSTEM } from '../../shared/system.js';
 import { execAsync } from '../runtime/process.js';
+import { heavy } from '../../shared/concurrency/index.js';
+import { runInstallerChecked } from '../runtime/pools.js';
 import { exists, mkdirp } from '../runtime/fs.js';
 import { tool } from '../toolchains/tool-env.js';
+import { unpackChromium } from './comet-unpack.js';
 import { findExe } from './find-exe.js';
 const sevenZip = () => tool('apps', '7zip', '7z.exe');
 export async function unpack(entry, file, out, d) {
@@ -13,7 +16,7 @@ export async function unpack(entry, file, out, d) {
         const sevenZr = path.join(path.dirname(file), '7zr.exe');
         const zr = await githubAsset('ip7z/7zip', /^7zr\.exe$/);
         await downloader.file(zr.url, sevenZr, zr.sha256);
-        await execAsync(sevenZr, ['x', '-y', '-o' + out, file], { stdio: 'ignore' });
+        await heavy.run(() => execAsync(sevenZr, ['x', '-y', '-o' + out, file], { stdio: 'ignore' }));
         return;
     }
     switch (entry.unpack ?? 'archive') {
@@ -26,19 +29,26 @@ export async function unpack(entry, file, out, d) {
             if (!exists(sevenZip()))
                 throw new Error('7-Zip is needed to unpack ' + entry.name + ' and could not be installed');
             const raw = path.join(path.dirname(out), 'raw');
-            await execAsync(sevenZip(), ['x', '-y', '-o' + raw, file], { stdio: 'ignore' });
+            await heavy.run(() => execAsync(sevenZip(), ['x', '-y', '-o' + raw, file], { stdio: 'ignore' }));
             // electron-builder installers carry the app as one more archive inside.
             const inner = findExe(raw, '/^app-64\\.7z$/');
             if (inner)
-                await execAsync(sevenZip(), ['x', '-y', '-o' + out, inner], { stdio: 'ignore' });
+                await heavy.run(() => execAsync(sevenZip(), ['x', '-y', '-o' + out, inner], { stdio: 'ignore' }));
             else
                 fs.renameSync(raw, out);
             return;
         }
+        case 'chromium': {
+            // A Chromium browser's installer (Comet), opened stage by stage; kept as an installer when that fails.
+            if (!exists(sevenZip()))
+                throw new Error('7-Zip is needed to unpack ' + entry.name + ' and could not be installed');
+            await unpackChromium(sevenZip(), file, out, path.join(path.dirname(out), 'chromium'), entry.exe);
+            return;
+        }
         case 'msi': {
             // An administrative install only extracts the files: nothing is registered with Windows.
             mkdirp(out);
-            await execAsync(SYSTEM.msiexec(), ['/a', file, '/qn', 'TARGETDIR=' + out], { stdio: 'ignore' });
+            await runInstallerChecked(SYSTEM.msiexec(), ['/a', file, '/qn', 'TARGETDIR=' + out]);
             return;
         }
         default:

package/dist/guest/boot/boot.d.ts

@@ -1,27 +1,56 @@
-/** One boot of the sandbox, step by step: each step is a method, in the order they run. */
+/** One boot of the sandbox: a graph of tasks (graph.ts) run by the BootRunner, each task a method below. */
 export declare class Boot {
     private ptyHost;
     private lan;
+    private tools;
+    private dbBin;
+    private allowSummary;
+    private vscodeSummary;
+    private env;
+    private toolVars;
+    private summary;
+    private headroom;
     private readonly gitAccess;
-    /** What the host handed over in its one-shot file (read and deleted at the start of run()). */
+    /** What the host handed over in its one-shot file (read and deleted in the prelude; never changed afterwards). */
     private secrets;
+    private basePath;
+    private readonly startedAt;
+    private openGate;
+    private readonly gate;
+    /** The boot is ready: the runner no longer writes the status (the session owns it). */
+    private ready;
+    private lastStatus;
+    private activeSteps;
+    private stepsDone;
+    private stepsTotal;
     run(): Promise<void>;
+    private stageTitle;
+    /** The names shown for work that goes on after the boot is ready. */
+    private backgroundNames;
     /**
-     * Your saved service sign-ins (accounts.<kind>.share) go to their tools before anything opens them, and leave memory
-     * at once; what they give the agent (EXPO_TOKEN ...) joins its environment (in memory only).
+     * The host's one-shot file, read once. Your saved service sign-ins (accounts.<kind>.share) go to their tools before
+     * anything opens them, and leave memory at once; what they give the agent (EXPO_TOKEN ...) joins its environment
+     * (in memory only).
      */
-    private serviceAccounts;
-    private networkAndSessionHost;
-    private hooksAndDesktop;
-    /** Toolchains, databases, apps, the network proxy and VS Code; then the agent environment, saved machine-wide. */
-    private developerTools;
-    /** vpn.enabled: the tunnel and its kill switch, before anything else uses the network (git, the agent). */
-    private vpn;
-    private gitIdentity;
-    private claude;
-    private agent;
-    private preAgentHooks;
-    /** Ready: starts the session daemon and, with an agent, its first session, shown in this window. */
+    private takeSecretsAndAccounts;
+    /** The host's progress line: the runner's stage, the tasks that run now, and what the toolchain scheduler runs. */
+    private publish;
+    /** Every task of the graph. */
+    private tasks;
+    /** The agent environment before the toolchains are known (the proxy needs no PATH of theirs). */
+    private headroomAgentEnv;
+    /** Foreground toolchain steps and databases and apps; Visual Studio and what needs it wait for the background. */
+    private toolchains;
+    private vscode;
+    /** The agent environment, saved machine-wide, and the PATH of new shells. */
+    private environment;
+    /** What the tools left: lines for the guide and status, and what later projects start from. */
+    private bootEnv;
+    /** The toolchains' lines, then the missing protections, allowOnly and VS Code (in this order). */
+    private summaryLines;
+    /** Visual Studio and what depends on it (after the session has started): merged into the environment again. */
+    private toolchainsLater;
+    /** Ready: starts the session daemon and, with an agent, its first session (shown in this window by run()). */
     private start;
 }
 export declare function runBoot(): Promise<void>;