windows-development-sandbox 1.20.0 → 1.23.1

package/dist/guest/toolchains/setup.js

@@ -1,25 +1,44 @@
-import { log } from '../runtime/log.js';
+import fs from 'node:fs';
+import { log, runQuiet } from '../runtime/log.js';
+import { toolsDir } from '../runtime/paths.js';
+import { installedToolPaths } from '../setup/path-plan.js';
 import { mkdirp } from '../runtime/fs.js';
-import { emptyEnv, tool } from './tool-env.js';
+import { tool } from './tool-env.js';
 import { plan } from './plan.js';
 import { scheduler } from './scheduler.js';
-/** Provisions every enabled toolchain and database, and returns the combined environment for the agent. */
-export async function setupToolchains(config, versions, options, run = {}) {
+import { mergeParts, runSplit } from './split.js';
+/** The parts of these steps merged in the order of `names` (and the config's own variables on top). */
+export function mergeToolchains(config, names, parts, planNames = names) {
+    const map = parts instanceof Map ? parts : new Map(Object.entries(parts));
+    return {
+        ...mergeParts(names, map, { environment: config.environment, bin: mkdirp(tool('bin')) }),
+        names: [...planNames],
+    };
+}
+/**
+ * Provisions every enabled toolchain and database, and returns the combined environment for the agent. `later` is
+ * set when steps were left for the background: it resolves with the result of those steps alone.
+ */
+export async function setupToolchains(config, versions, options, run = {}, extras = {}) {
     const steps = plan(config, versions, options).filter((s) => s.enabled);
-    const envs = await scheduler.run(steps, run);
-    // Merged in plan order, so PATH order never depends on which download finished first.
-    const env = { ...emptyEnv(), steps: Object.fromEntries(envs) };
-    env.prepend.push(mkdirp(tool('bin')));
-    for (const part of envs.values()) {
-        Object.assign(env.vars, part.vars);
-        env.prepend.push(...part.prepend);
-        env.append.push(...part.append);
-        env.summary.push(...part.summary);
-    }
-    Object.assign(env.vars, config.environment);
-    // The git guard's variables (AGENT_GIT_ACCESS, GIT_DIR, GIT_CONFIG_*, BASH_ENV) always win over
-    // toolchains.environment.
-    Object.assign(env.vars, envs.get('Git')?.vars);
-    log('Set up ' + steps.length + ' toolchains and databases.');
-    return env;
+    const split = await runSplit(scheduler, steps, run, { ...extras, quiet: runQuiet });
+    const result = mergeToolchains(config, split.nowNames, split.now, steps.map((s) => s.name));
+    // Python and rust already installed in the persistent tools are on PATH for every project (at the end, nothing is
+    // installed): the project this session is for may not have asked for them, but its scripts and neighbours use them.
+    const have = new Set(steps.map((s) => s.name));
+    const installed = installedToolPaths(toolsDir, { exists: fs.existsSync, list: (dir) => (fs.existsSync(dir) ? fs.readdirSync(dir) : []) }, new Set([...(have.has('Python') ? ['python'] : []), ...(have.has('Rust') ? ['rust'] : [])]));
+    result.append.push(...installed.append);
+    result.summary.push(...installed.summary);
+    for (const [name, value] of Object.entries(installed.vars))
+        result.vars[name] ??= value;
+    log('Set up ' +
+        split.nowNames.length +
+        ' toolchains and databases' +
+        (split.laterNames.length ? ' (' + split.laterNames.length + ' more later)' : '') +
+        '.');
+    const later = split.later
+        ? split.later.then((parts) => mergeToolchains(config, split.laterNames, parts, steps.map((s) => s.name)))
+        : null;
+    later?.catch(() => undefined);
+    return Object.assign(result, { later });
 }

package/dist/guest/toolchains/split.d.ts

@@ -0,0 +1,28 @@
+import { type ToolEnv } from './tool-env.js';
+import type { ToolchainStep } from './step.js';
+import type { RunOptions, StepScheduler } from './step-scheduler.js';
+/** The steps that wait for the gate: the ones marked `background`, and every step that comes after one. */
+export declare function backgroundNames(steps: readonly ToolchainStep[]): Set<string>;
+export interface SplitRun {
+    /** What the foreground steps contributed, in plan order. */
+    readonly now: Map<string, ToolEnv>;
+    readonly nowNames: readonly string[];
+    readonly laterNames: readonly string[];
+    /** The background steps' parts, once the gate opened and they ran; null when nothing was left for later. */
+    readonly later: Promise<Map<string, ToolEnv>> | null;
+}
+/**
+ * Runs the foreground steps and returns; the background steps (their downloads start now, behind the foreground ones)
+ * run after `gate`, inside `quiet` (file-only logging).
+ */
+export declare function runSplit(scheduler: StepScheduler, steps: readonly ToolchainStep[], run: RunOptions, o?: {
+    gate?: Promise<void>;
+    quiet?: <T>(work: () => T) => T;
+}): Promise<SplitRun>;
+/** The parts of these steps merged in the order of `names`, so PATH order never depends on which finished first. */
+export declare function mergeParts(names: readonly string[], parts: ReadonlyMap<string, ToolEnv>, o: {
+    environment: Readonly<Record<string, string>>;
+    bin: string;
+}): ToolEnv & {
+    steps: Record<string, ToolEnv>;
+};

package/dist/guest/toolchains/split.js

@@ -0,0 +1,60 @@
+// Splits a plan into the steps that run now and the ones that wait for a gate (the background: Visual Studio and what
+// needs it), and merges the steps' parts in plan order. Pure apart from the scheduler it is given.
+import { asBackground } from '../../shared/concurrency/index.js';
+import { emptyEnv } from './tool-env.js';
+/** The steps that wait for the gate: the ones marked `background`, and every step that comes after one. */
+export function backgroundNames(steps) {
+    const later = new Set(steps.filter((s) => s.background).map((s) => s.name));
+    for (let grew = later.size > 0; grew;) {
+        grew = false;
+        for (const s of steps)
+            if (!later.has(s.name) && (s.after ?? []).some((n) => later.has(n))) {
+                later.add(s.name);
+                grew = true;
+            }
+    }
+    return later;
+}
+/**
+ * Runs the foreground steps and returns; the background steps (their downloads start now, behind the foreground ones)
+ * run after `gate`, inside `quiet` (file-only logging).
+ */
+export async function runSplit(scheduler, steps, run, o = {}) {
+    const waiting = backgroundNames(steps);
+    const now = steps.filter((s) => !waiting.has(s.name));
+    const rest = steps.filter((s) => waiting.has(s.name));
+    asBackground(() => scheduler.startFetches(rest));
+    const parts = await scheduler.run(now, run);
+    const quiet = o.quiet ?? ((work) => work());
+    const later = rest.length
+        ? (async () => {
+            await o.gate;
+            // A progress callback that does nothing: the scheduler must not rewrite the boot's status as "ready".
+            return quiet(() => asBackground(() => scheduler.run(rest, { progress: () => undefined })));
+        })()
+        : null;
+    // Nobody may see a failed background run as an unhandled rejection before the boot awaits it.
+    later?.catch(() => undefined);
+    return { now: parts, nowNames: now.map((s) => s.name), laterNames: rest.map((s) => s.name), later };
+}
+/** The parts of these steps merged in the order of `names`, so PATH order never depends on which finished first. */
+export function mergeParts(names, parts, o) {
+    const present = names.filter((n) => parts.has(n));
+    const env = {
+        ...emptyEnv(),
+        steps: Object.fromEntries(present.map((n) => [n, parts.get(n)])),
+    };
+    env.prepend.push(o.bin);
+    for (const name of present) {
+        const p = parts.get(name);
+        Object.assign(env.vars, p.vars);
+        env.prepend.push(...p.prepend);
+        env.append.push(...p.append);
+        env.summary.push(...p.summary);
+    }
+    Object.assign(env.vars, o.environment);
+    // The git guard's variables (AGENT_GIT_ACCESS, GIT_DIR, GIT_CONFIG_*, BASH_ENV) always win over
+    // toolchains.environment.
+    Object.assign(env.vars, parts.get('Git')?.vars);
+    return env;
+}

package/dist/guest/toolchains/steam/client.js

@@ -4,6 +4,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { errMsg } from '../../../core/util/errors.js';
+import { heavy } from '../../../shared/concurrency/index.js';
 import { moveIntoPlace, spawnAsync, stagingFolder } from '../../../shared/download/index.js';
 import { safeRemove } from '../../../shared/io/safe-remove.js';
 import { exists } from '../../runtime/fs.js';
@@ -38,7 +39,7 @@ async function installSteamClient() {
     try {
         log('Unpacking the Steam client into tools\\steam ...');
         // NSIS: /S silent, /D= the folder (last, unquoted: the staging path has no spaces).
-        const code = await spawnAsync(setup, ['/S', '/D=' + work], { timeout: SETUP_TIMEOUT_MS });
+        const code = await heavy.run(() => spawnAsync(setup, ['/S', '/D=' + work], { timeout: SETUP_TIMEOUT_MS }));
         const unpacked = path.join(work, 'steam.exe');
         if (!exists(unpacked))
             throw new Error('SteamSetup.exe did not unpack steam.exe (exit code ' + code + ')');

package/dist/guest/toolchains/step-scheduler.d.ts

@@ -0,0 +1,51 @@
+import { type ToolEnv } from './tool-env.js';
+import type { ToolchainStep } from './step.js';
+/** Where the scheduler's warnings and the boot status go (injected, so tests need neither the log nor session.json). */
+export interface SchedulerSink {
+    warn(message: string): void;
+    status(message: string, progress: {
+        active: {
+            name: string;
+            percent?: number;
+        }[];
+        done: number;
+        total: number;
+    }): void;
+}
+export interface RunOptions {
+    /** Progress lines ("Installing Go, Rust (3 of 9 done)"); default: the sandbox's boot status. */
+    report?: (message: string) => void;
+    /** What machine-wide (shared) steps contributed at boot: reused instead of run again. */
+    reuse?: Record<string, ToolEnv>;
+    /** The boot: gets what runs now instead of the scheduler writing the sandbox status itself. */
+    progress?: (p: {
+        active: {
+            name: string;
+            percent?: number;
+        }[];
+        done: number;
+        total: number;
+    }) => void;
+    /** A step finished (installed, failed or reused). */
+    onDone?: (name: string) => void;
+}
+export declare class StepScheduler {
+    private readonly sink;
+    private readonly parallel;
+    /** One lock per kind of step ("Node 20" and "Node 22" share nvm's folders): held while that step runs, in any run. */
+    private readonly locks;
+    /** The step a download belongs to (several run at once), for its progress. */
+    private readonly currentStep;
+    /** Downloads started ahead of their steps (by name), until the step has used them. */
+    private readonly fetches;
+    constructor(sink: SchedulerSink, parallel?: number);
+    /**
+     * Starts the downloads of these steps now (once per step); `run` waits for a step's own download before it installs.
+     * Failures are not reported here: the install downloads again and reports the real reason.
+     */
+    startFetches(steps: readonly ToolchainStep[]): void;
+    /** Runs the steps (each with its own environment) and returns each step's environment, in plan order. */
+    run(steps: readonly ToolchainStep[], o: RunOptions): Promise<Map<string, ToolEnv>>;
+    /** Runs `work` once no other step of the same kind (first word of the name) is running. */
+    private exclusive;
+}

package/dist/guest/toolchains/step-scheduler.js

@@ -0,0 +1,147 @@
+// Runs the planned steps in parallel, a few at a time, after the steps they depend on. One lock per kind of step is
+// held across runs: the boot and projects that join later never install two Nodes (or two Gos) at once.
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { downloader } from '../../shared/download/index.js';
+import { errMsg } from '../../core/util/errors.js';
+import { emptyEnv } from './tool-env.js';
+/** How many installers run at once: enough to overlap downloads with installs, few enough not to thrash the disk. */
+const PARALLEL = 4;
+/** Runs one installer; a failure is reported and skipped so it never blocks the other toolchains. */
+async function runReported(sink, name, env, work) {
+    try {
+        await work();
+    }
+    catch (e) {
+        sink.warn(name +
+            ' could not be set up and is skipped; everything else still works, and the next start tries again. Reason: ' +
+            errMsg(e));
+        env.summary.push(name + ': FAILED');
+    }
+}
+export class StepScheduler {
+    sink;
+    parallel;
+    /** One lock per kind of step ("Node 20" and "Node 22" share nvm's folders): held while that step runs, in any run. */
+    locks = new Map();
+    /** The step a download belongs to (several run at once), for its progress. */
+    currentStep = new AsyncLocalStorage();
+    /** Downloads started ahead of their steps (by name), until the step has used them. */
+    fetches = new Map();
+    constructor(sink, parallel = PARALLEL) {
+        this.sink = sink;
+        this.parallel = parallel;
+    }
+    /**
+     * Starts the downloads of these steps now (once per step); `run` waits for a step's own download before it installs.
+     * Failures are not reported here: the install downloads again and reports the real reason.
+     */
+    startFetches(steps) {
+        for (const s of steps) {
+            if (!s.fetch || this.fetches.has(s.name))
+                continue;
+            this.fetches.set(s.name, this.currentStep
+                .run(s.name, async () => s.fetch())
+                .catch(() => {
+                /* install downloads again and says why it failed */
+            }));
+        }
+    }
+    /** Runs the steps (each with its own environment) and returns each step's environment, in plan order. */
+    async run(steps, o) {
+        const envs = new Map(steps.map((s) => [s.name, emptyEnv()]));
+        const finished = new Map();
+        const running = new Set();
+        const waiting = [];
+        let done = 0;
+        // The boot (no `report`) also publishes structured progress: what runs now, how far its download is, how many are
+        // done.
+        const percent = new Map();
+        const active = () => [...running].map((name) => ({ name, ...(percent.has(name) ? { percent: percent.get(name) } : {}) }));
+        const say = o.report ??
+            ((message) => o.progress
+                ? o.progress({ active: active(), done, total: steps.length })
+                : this.sink.status(message, { active: active(), done, total: steps.length }));
+        const report = () => {
+            if (running.size)
+                say('Installing ' + [...running].join(', ') + ' (' + done + ' of ' + steps.length + ' done)');
+        };
+        this.startFetches(steps.filter((s) => !(s.shared && o.reuse?.[s.name])));
+        if (!o.report)
+            downloader.watch(() => {
+                const name = this.currentStep.getStore();
+                return name
+                    ? (fraction) => {
+                        percent.set(name, Math.round(fraction * 100));
+                        report();
+                    }
+                    : null;
+            });
+        for (const s of steps) {
+            // Dependencies first (they are earlier in the plan, so their promises exist), then a free slot.
+            finished.set(s.name, (async () => {
+                await Promise.all((s.after ?? []).map((name) => finished.get(name)));
+                const env = envs.get(s.name);
+                const reused = s.shared ? o.reuse?.[s.name] : undefined;
+                if (reused) {
+                    envs.set(s.name, structuredClone(reused));
+                    done++;
+                    o.onDone?.(s.name);
+                    return;
+                }
+                // Its download (started above, before the dependencies finished) is in by now, or still coming.
+                await this.fetches.get(s.name);
+                this.fetches.delete(s.name);
+                while (running.size >= this.parallel)
+                    await new Promise((r) => waiting.push(r));
+                running.add(s.name);
+                report();
+                try {
+                    await this.currentStep.run(s.name, () => this.exclusive(s.name, () => runReported(this.sink, s.name, env, async () => s.install(env))));
+                }
+                finally {
+                    running.delete(s.name);
+                    percent.delete(s.name);
+                    done++;
+                    report();
+                    waiting.shift()?.();
+                    o.onDone?.(s.name);
+                }
+            })());
+        }
+        try {
+            await Promise.all(finished.values());
+        }
+        finally {
+            if (!o.report)
+                downloader.watch(null);
+        }
+        o.progress?.({ active: [], done, total: steps.length });
+        if (!o.report && !o.progress)
+            this.sink.status('Set up ' + steps.length + ' toolchains and databases', {
+                active: [],
+                done,
+                total: steps.length,
+            });
+        return envs;
+    }
+    /** Runs `work` once no other step of the same kind (first word of the name) is running. */
+    async exclusive(name, work) {
+        const key = name.split(' ')[0].toLowerCase();
+        const previous = this.locks.get(key) ?? Promise.resolve();
+        let release = () => undefined;
+        const mine = new Promise((r) => {
+            release = r;
+        });
+        const chained = previous.then(() => mine);
+        this.locks.set(key, chained);
+        await previous;
+        try {
+            return await work();
+        }
+        finally {
+            release();
+            if (this.locks.get(key) === chained)
+                this.locks.delete(key);
+        }
+    }
+}

package/dist/guest/toolchains/step.d.ts

@@ -11,6 +11,12 @@ export interface ToolchainOptions {
     apps?: Config['apps'];
     /** pcInstalls: this PC's games, engines and editors mapped read-only (session.json). */
     pcInstalls?: PcInstallManifest;
+    /**
+     * Boot only: the heavy installs (Visual Studio, and what depends on it) run in the background after the agent has
+     * started. Off with a VPN or network.allowOnly (their firewall would cut the downloads), in a dry run and when a
+     * project joins a running sandbox.
+     */
+    deferHeavy?: boolean;
 }
 /** What a toolchain module's step gets besides its settings. */
 export interface ToolCtx {
@@ -30,5 +36,12 @@ export interface ToolchainStep {
      * git guard): a project added after boot reuses what the boot's run contributed instead of running it again.
      */
     readonly shared?: boolean;
+    /**
+     * Download only what `install` will need (no-op when it is there). The scheduler starts every step's fetch at once,
+     * outside the step slots and `after`; only the net pool limits them. A failure is ignored: install downloads again.
+     */
+    fetch?(): Promise<void>;
+    /** At boot, runs after the agent has started (the steps that depend on it follow it). */
+    readonly background?: boolean;
     install(env: ToolEnv): Promise<void> | void;
 }

package/dist/guest/toolchains/tools/git.js

@@ -94,6 +94,22 @@ const pointAtOwnCertificates = (root) => {
     if (fixed !== text)
         fs.writeFileSync(config, fixed);
 };
+/**
+ * Coreutils' link.exe (hard links) next to MSVC's linker: Git Bash puts its own /usr/bin first on PATH, whatever the
+ * Windows PATH says, so a msvc Rust build ran the wrong `link` (os error 1392). Renamed; nobody needs it here.
+ */
+const hideCoreutilsLink = (usrBin) => {
+    const link = path.join(usrBin, 'link.exe');
+    if (!exists(link))
+        return;
+    try {
+        fs.rmSync(path.join(usrBin, 'link-coreutils.exe'), { force: true });
+        fs.renameSync(link, path.join(usrBin, 'link-coreutils.exe'));
+    }
+    catch (e) {
+        warn("Could not rename Git's coreutils link.exe (MSVC link may be shadowed in Git Bash): " + errMsg(e));
+    }
+};
 export async function setupGit(env, hostCopy, refresh, access) {
     const root = tool('git');
     const bash = path.join(root, 'bin', 'bash.exe');
@@ -130,6 +146,8 @@ export async function setupGit(env, hostCopy, refresh, access) {
         throw new Error('bash.exe missing after installing Git');
     pointAtOwnCertificates(root);
     env.vars.CLAUDE_CODE_GIT_BASH_PATH = bash;
+    // usr\bin is on PATH for Git's tools in cmd and PowerShell, last (path-plan.ts keeps MSVC before it).
+    hideCoreutilsLink(path.join(root, 'usr', 'bin'));
     env.append.push(path.join(root, 'usr', 'bin'));
     const version = execOutput(gitExe, ['--version']).replace(/^git version /, '');
     if (access === 'full') {

package/dist/guest/vpn/openvpn.js

@@ -4,7 +4,8 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
-import { downloader, spawnAsync } from '../../shared/download/index.js';
+import { runInstaller } from '../runtime/pools.js';
+import { downloader } from '../../shared/download/index.js';
 import { SYSTEM } from '../../shared/system.js';
 import { dryRun, isWin, toolsDir } from '../runtime/paths.js';
 import { exists, mkdirp } from '../runtime/fs.js';
@@ -48,9 +49,7 @@ export async function ensureOpenVpn() {
     repairServiceQueries();
     log('VPN: installing OpenVPN');
     const logFile = path.join(toolsDir, 'downloads', 'openvpn-install.log');
-    const code = await spawnAsync(SYSTEM.msiexec(), ['/i', msi, '/qn', '/norestart', '/l*v', logFile], {
-        stdio: 'ignore',
-    });
+    const code = await runInstaller(SYSTEM.msiexec(), ['/i', msi, '/qn', '/norestart', '/l*v', logFile]);
     // 3010: installed, a restart is wanted (nothing here needs one).
     if (code !== 0 && code !== 3010)
         throw new Error('The OpenVPN installer failed (exit ' + code + '). Its log: ' + logFile);

package/dist/guest/vpn/wireguard.js

@@ -7,7 +7,8 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { downloader, spawnAsync } from '../../shared/download/index.js';
+import { runInstaller } from '../runtime/pools.js';
+import { downloader } from '../../shared/download/index.js';
 import { SYSTEM } from '../../shared/system.js';
 import { WIREGUARD_MSI } from '../../shared/vpn/download.js';
 import { handshakeDone, serviceRunning } from '../../shared/vpn/wireguard.js';
@@ -46,9 +47,15 @@ export async function ensureWireguard() {
     log('VPN: installing WireGuard');
     const logFile = path.join(toolsDir, 'downloads', 'wireguard-install.log');
     // DO_NOT_LAUNCH: the installer would otherwise start the manager window.
-    const code = await spawnAsync(SYSTEM.msiexec(), ['/i', msi, '/qn', '/norestart', 'DO_NOT_LAUNCH=1', '/l*v', logFile], {
-        stdio: 'ignore',
-    });
+    const code = await runInstaller(SYSTEM.msiexec(), [
+        '/i',
+        msi,
+        '/qn',
+        '/norestart',
+        'DO_NOT_LAUNCH=1',
+        '/l*v',
+        logFile,
+    ]);
     if (code !== 0 && code !== 3010)
         throw new Error('The WireGuard installer failed (exit ' + code + '). Its log: ' + logFile);
     if (!exists(exe))

package/dist/host/accounts/deliver.js

@@ -9,6 +9,8 @@ function howToSave(spec) {
         return "sign in to the Epic Games Launcher in this sandbox once, or take this PC's: sandbox account import epic";
     if (spec.kind === 'steam')
         return 'sign in once in this sandbox with sbx-steam login';
+    if (spec.kind === 'comet')
+        return 'sign in to Comet once in this sandbox, and it is kept for the next ones';
     if (spec.returns)
         return 'sign in once in this sandbox, or: sandbox account import ' + spec.kind;
     return spec.sources.includes('typed')
@@ -56,6 +58,11 @@ export function prepareServiceAccounts(i) {
                 if (spec.returns)
                     leased.push(kind);
             }
+            else if (spec.returns) {
+                // Several sandboxes may use it at once: each gets its own lease, so each may hand a renewed one back.
+                leases.claimShared(kind, dataSet, i.launchId, payload ? fingerprint(payload) : null);
+                leased.push(kind);
+            }
             if (unreadable) {
                 notes.push('Your saved ' +
                     spec.label +

package/dist/host/accounts/handoff.js

@@ -61,12 +61,8 @@ export function takeHandoffs(dataPath, final, store = new ServiceAccountStore(st
             const spec = SERVICE_SPECS[kind];
             const bytes = readBoundedFile(file, spec.maxBytes + ENVELOPE_BYTES);
             const parsed = bytes ? handoffSchema(kind).safeParse(JSON.parse(bytes.toString('utf8'))) : null;
-            const lease = leases.holder(kind);
-            if (parsed?.success &&
-                spec.returns &&
-                lease &&
-                lease.dataSet === dataSet &&
-                lease.launchId === parsed.data.launchId) {
+            const lease = leases.leaseOf(kind, dataSet);
+            if (parsed?.success && spec.returns && lease && lease.launchId === parsed.data.launchId) {
                 const payload = parsed.data.payload;
                 store.save(kind, payload, 'sandbox', HOST_SOURCES[kind].summary(payload));
                 ok = true;

package/dist/host/accounts/index.d.ts

@@ -2,5 +2,5 @@ export { accountsDir, ServiceAccountStore, type AccountInfo, type AccountState }
 export { AccountLeases, type ClaimResult, type Lease } from './leases.js';
 export { prepareServiceAccounts, type AccountDelivery, type DeliveryInput } from './deliver.js';
 export { forgetEverywhere, handoffDir, takeHandoffs } from './handoff.js';
-export { notAvailableYet, pcEnv, type HostSource, type PcEnv } from './source.js';
+export { notAvailableYet, parseRegValue, pcEnv, type HostSource, type PcEnv } from './source.js';
 export { HOST_SOURCES } from './sources.js';

package/dist/host/accounts/index.js

@@ -4,5 +4,5 @@ export { accountsDir, ServiceAccountStore } from './store.js';
 export { AccountLeases } from './leases.js';
 export { prepareServiceAccounts } from './deliver.js';
 export { forgetEverywhere, handoffDir, takeHandoffs } from './handoff.js';
-export { notAvailableYet, pcEnv } from './source.js';
+export { notAvailableYet, parseRegValue, pcEnv } from './source.js';
 export { HOST_SOURCES } from './sources.js';

package/dist/host/accounts/kinds/cfx.d.ts

@@ -1,2 +1,2 @@
-import { type HostSource } from '../source.js';
+import type { HostSource } from '../source.js';
 export declare const cfxSource: HostSource<'cfx'>;

package/dist/host/accounts/kinds/cfx.js

@@ -1,7 +1,50 @@
-import { notAvailableYet } from '../source.js';
+// Cfx.re: a FiveM / RedM server licence key from the keymaster (https://portal.cfx.re), and an optional Steam Web API
+// key. Typed with `sandbox account login cfx`, or read from a server.cfg with `sandbox account import cfx --from`.
+import { CfxPayloadSchema } from '../../../shared/accounts/index.js';
+import { fail } from '../../../core/util/index.js';
+import { decodeText } from '../../../shared/io/index.js';
+const MAX_LINES = 20_000;
+const LICENSE_LINE = /^\s*(?:set[rs]?\s+)?sv_licenseKey\s+"?([^"\s]+)"?/i;
+const STEAM_LINE = /^\s*set[rs]?\s+steam_webApiKey\s+"?([A-Fa-f0-9]{32})"?/i;
+/** The line without a `#` or `//` comment (quotes are respected). */
+function withoutComment(line) {
+    let quoted = false;
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (c === '"')
+            quoted = !quoted;
+        else if (!quoted && (c === '#' || (c === '/' && line[i + 1] === '/')))
+            return line.slice(0, i);
+    }
+    return line;
+}
 export const cfxSource = {
-    fromAnswers(_answers) {
-        return notAvailableYet('cfx');
+    fromFile(bytes) {
+        let licenseKey = '';
+        let steamWebApiKey = '';
+        for (const raw of decodeText(bytes).text.split(/\r?\n/, MAX_LINES)) {
+            const line = withoutComment(raw);
+            const key = LICENSE_LINE.exec(line);
+            if (key)
+                licenseKey = key[1];
+            const steam = STEAM_LINE.exec(line);
+            if (steam)
+                steamWebApiKey = steam[1].toUpperCase();
+        }
+        if (!licenseKey)
+            fail('That server.cfg has no sv_licenseKey.', 'Type the key instead: sandbox account login cfx');
+        const parsed = CfxPayloadSchema.safeParse({ licenseKey, ...(steamWebApiKey ? { steamWebApiKey } : {}) });
+        if (!parsed.success)
+            fail('The sv_licenseKey in that server.cfg is not a Cfx.re server key (cfxk_...).', 'Copy the key from https://portal.cfx.re (Server keys) and run: sandbox account login cfx');
+        return parsed.data;
     },
-    summary: () => null,
+    fromAnswers(answers) {
+        const licenseKey = (answers.licenseKey ?? '').trim();
+        const steamWebApiKey = (answers.steamWebApiKey ?? '').trim().toUpperCase();
+        const parsed = CfxPayloadSchema.safeParse({ licenseKey, ...(steamWebApiKey ? { steamWebApiKey } : {}) });
+        if (!parsed.success)
+            fail('That is not a Cfx.re server key (cfxk_...) or a Steam Web API key (32 hex characters).', 'Copy the key from https://portal.cfx.re (Server keys) and run: sandbox account login cfx');
+        return parsed.data;
+    },
+    summary: (p) => 'server key' + (p.steamWebApiKey ? ' and Steam Web API key' : ''),
 };

package/dist/host/accounts/kinds/comet.d.ts

@@ -0,0 +1,2 @@
+import type { HostSource } from '../source.js';
+export declare const cometSource: HostSource<'comet'>;

package/dist/host/accounts/kinds/comet.js

@@ -0,0 +1,6 @@
+// Comet: nothing to take from this PC. Its sign-in there is sealed to your Windows account (and reading another
+// browser's cookies is what password stealers do), so it only ever comes from a sandbox you signed in in.
+import { cometSummary } from '../../../shared/accounts/index.js';
+export const cometSource = {
+    summary: (p) => cometSummary(p),
+};

package/dist/host/accounts/kinds/perplexity.d.ts

@@ -0,0 +1,2 @@
+import type { HostSource } from '../source.js';
+export declare const perplexitySource: HostSource<'perplexity'>;

package/dist/host/accounts/kinds/perplexity.js

@@ -0,0 +1,30 @@
+// Perplexity: an API key, taken from this PC (`sandbox account import perplexity`: PERPLEXITY_API_KEY of this
+// terminal, else of your saved Windows user environment), from a file that holds it (`--from .env`: only its
+// PERPLEXITY_API_KEY line is read), or typed (`sandbox account login perplexity`). The key is never printed.
+import { fail } from '../../../core/util/index.js';
+import { PERPLEXITY_ENV, PerplexityPayloadSchema, perplexityKeyFromText, perplexitySummary, } from '../../../shared/accounts/index.js';
+import { decodeText } from '../../../shared/io/index.js';
+/** A key value as it may sit in a variable (quotes and spaces around it taken off). */
+const keyFrom = (value) => {
+    const parsed = PerplexityPayloadSchema.safeParse({ apiKey: (value ?? '').trim().replace(/^(["'])(.*)\1$/, '$2') });
+    return parsed.success ? parsed.data : null;
+};
+export const perplexitySource = {
+    /** PERPLEXITY_API_KEY of this PC: this terminal's environment first, then your saved user environment. */
+    fromPc(pc) {
+        return keyFrom(pc.env?.[PERPLEXITY_ENV]) ?? keyFrom(pc.userVariable?.(PERPLEXITY_ENV));
+    },
+    fromFile(bytes) {
+        const key = perplexityKeyFromText(decodeText(bytes).text);
+        if (!key)
+            fail('That file holds no Perplexity API key.', 'Name a .env file with a line PERPLEXITY_API_KEY=pplx-..., or type the key: sandbox account login perplexity');
+        return key;
+    },
+    fromAnswers(answers) {
+        const parsed = PerplexityPayloadSchema.safeParse({ apiKey: (answers.apiKey ?? '').trim() });
+        if (!parsed.success)
+            fail('That is not a Perplexity API key.', 'Copy it from perplexity.ai/account/api/keys: it starts with pplx-.');
+        return parsed.data;
+    },
+    summary: (p) => perplexitySummary(p),
+};