windows-development-sandbox 1.23.1 → 1.25.0

package/dist/bin/{chunk-QFSJX2KW.js → chunk-KH4MI2U5.js}

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   attach
-} from "./chunk-USTRSHIE.js";
+} from "./chunk-IZRGTSQ5.js";
 export {
   attach
 };

package/dist/bin/{chunk-7YPEDAJD.js → chunk-SUYYVIDW.js}

@@ -251,7 +251,7 @@ import {
   withOperationCommands,
   working,
   writeJson
-} from "./chunk-USTRSHIE.js";
+} from "./chunk-IZRGTSQ5.js";
 
 // node_modules/commander/lib/error.js
 var require_error = __commonJS({

package/dist/bin/claude-host.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-7YPEDAJD.js";
-import "./chunk-USTRSHIE.js";
+} from "./chunk-SUYYVIDW.js";
+import "./chunk-IZRGTSQ5.js";
 
 // src/bin/claude-host.ts
 var args = process.argv.slice(2);

package/dist/bin/claude-sbx.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-7YPEDAJD.js";
-import "./chunk-USTRSHIE.js";
+} from "./chunk-SUYYVIDW.js";
+import "./chunk-IZRGTSQ5.js";
 
 // src/bin/claude-sbx.ts
 run(process.argv.slice(2), { harness: "claude" });

package/dist/bin/codex-sbx.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-7YPEDAJD.js";
-import "./chunk-USTRSHIE.js";
+} from "./chunk-SUYYVIDW.js";
+import "./chunk-IZRGTSQ5.js";
 
 // src/bin/codex-sbx.ts
 run(process.argv.slice(2), { harness: "codex" });

package/dist/bin/gemini-sbx.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-7YPEDAJD.js";
-import "./chunk-USTRSHIE.js";
+} from "./chunk-SUYYVIDW.js";
+import "./chunk-IZRGTSQ5.js";
 
 // src/bin/gemini-sbx.ts
 run(process.argv.slice(2), { harness: "gemini" });

package/dist/bin/sandbox.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-7YPEDAJD.js";
-import "./chunk-USTRSHIE.js";
+} from "./chunk-SUYYVIDW.js";
+import "./chunk-IZRGTSQ5.js";
 
 // src/bin/sandbox.ts
 run(process.argv.slice(2));

package/dist/bin/sbx-hide.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-7YPEDAJD.js";
-import "./chunk-USTRSHIE.js";
+} from "./chunk-SUYYVIDW.js";
+import "./chunk-IZRGTSQ5.js";
 
 // src/bin/sbx-hide.ts
 run(process.argv.slice(2), { command: "hide" });

package/dist/bin/sbx-show.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-7YPEDAJD.js";
-import "./chunk-USTRSHIE.js";
+} from "./chunk-SUYYVIDW.js";
+import "./chunk-IZRGTSQ5.js";
 
 // src/bin/sbx-show.ts
 run(process.argv.slice(2), { command: "show" });

package/dist/core/config/defaults.js

@@ -87,7 +87,6 @@ export const DEFAULTS = {
             enabled: 'auto',
             acceptLicense: false,
             components: [],
-            keepInstallFiles: true,
             visualStudio: 'full',
             persistEngines: true,
             derivedDataCache: 'persisted',

package/dist/core/detect/toolchains.js

@@ -127,15 +127,9 @@ function applyImplications(settings, result) {
         imply(settings, result, 'android', 'React Native builds for Android');
     if (result.godot.on && settings.godot.dotnet === true)
         imply(settings, result, 'dotnet', "Godot's .NET build");
-    if (result.unreal.on && settings.unreal.visualStudio === 'autosdk')
-        imply(settings, result, 'msvc', 'Unreal builds from the portable MSVC (AutoSDK)');
-    // Unreal's licence acceptance covers the MSVC it builds from (the same Visual Studio terms).
-    const autosdkLicence = settings.unreal.visualStudio === 'autosdk' && settings.unreal.acceptLicense;
     for (const name of LICENSED_TOOLCHAINS) {
         if (settings[name].enabled !== 'auto' || !result[name].on || settings[name].acceptLicense)
             continue;
-        if (name === 'msvc' && autosdkLicence)
-            continue;
         result[name] = {
             on: false,
             reason: 'would be used (' + result[name].reason + '); set toolchains.' + name + '.acceptLicense to install it',

package/dist/core/schema/config.d.ts

@@ -195,10 +195,9 @@ export declare const ConfigSchema: z.ZodObject<{
             enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
             acceptLicense: z.ZodBoolean;
             components: z.ZodArray<z.ZodString>;
-            keepInstallFiles: z.ZodBoolean;
             visualStudio: z.ZodEnum<{
                 full: "full";
-                autosdk: "autosdk";
+                buildtools: "buildtools";
             }>;
             persistEngines: z.ZodBoolean;
             derivedDataCache: z.ZodEnum<{

package/dist/core/schema/toolchains.d.ts

@@ -38,10 +38,9 @@ export declare const ToolchainsSchema: z.ZodObject<{
         enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
         acceptLicense: z.ZodBoolean;
         components: z.ZodArray<z.ZodString>;
-        keepInstallFiles: z.ZodBoolean;
         visualStudio: z.ZodEnum<{
             full: "full";
-            autosdk: "autosdk";
+            buildtools: "buildtools";
         }>;
         persistEngines: z.ZodBoolean;
         derivedDataCache: z.ZodEnum<{

package/dist/core/schema/toolchains.js

@@ -54,17 +54,14 @@ export const ToolchainsSchema = z.strictObject({
         sdkVersion: z.string().min(1).describe('"latest" or a Windows SDK build, e.g. "26100" or "10.0.22621".'),
     }),
     unreal: z.strictObject({
-        enabled: enabled('Unreal Engine development: Visual Studio Community 2022 with the C++ game workload (MSVC, a Windows 11 SDK, .NET Framework targeting packs, Unreal integration and the Epic Games Launcher) and the DirectX End-User Runtime. A real installer: it runs every boot (~10 GB on the sandbox disk). The engine itself comes from the Epic Games Launcher or its source.', 'a .uproject or .uplugin'),
+        enabled: enabled('Unreal Engine development: Visual Studio Community 2022 with the C++ game workload (MSVC, a Windows 11 SDK, .NET Framework targeting packs, Unreal integration and the Epic Games Launcher) and the DirectX End-User Runtime. Visual Studio is installed once and kept on the data disk (~6.5 GB); later boots put it back in seconds. The engine itself comes from the Epic Games Launcher or its source.', 'a .uproject or .uplugin'),
         acceptLicense: z
             .boolean()
             .describe('Required to install: you accept the Visual Studio Community licence terms (https://visualstudio.microsoft.com/license-terms/) and the DirectX End-User Runtime licence.'),
         components: StringsSchema.describe('More Visual Studio workload or component IDs to add, e.g. ["Microsoft.VisualStudio.Component.VC.Llvm.Clang"].'),
-        keepInstallFiles: z
-            .boolean()
-            .describe('Keep an offline copy of the Visual Studio install files in tools\\visualstudio (~10 GB, made once), so later boots install without downloading them again. Skipped while that disk has too little room.'),
         visualStudio: z
-            .enum(['full', 'autosdk'])
-            .describe('"full": install Visual Studio Community (the engine finds it through the Setup API; ~10 GB, redone every boot). "autosdk" (experimental): skip Visual Studio and build an Unreal AutoSDK tree from the portable MSVC in tools\\unreal\\autosdk (kept between sandboxes); UnrealBuildTool finds MSVC through AutoSDK, but the editor\'s Visual Studio integration is not available. Needs toolchains.msvc (turned on for you).'),
+            .enum(['full', 'buildtools'])
+            .describe('"full": Visual Studio Community with the C++ game workload (the IDE, its debugger and Unreal integration). "buildtools": only the Visual Studio Build Tools (MSVC, the Windows SDK and the .NET Framework parts UnrealBuildTool needs; no IDE). Either is installed once and kept on the data disk (tools\\visualstudio\\persist, ~6.5 GB for Community); later boots put it back in seconds.'),
         persistEngines: z
             .boolean()
             .describe('Engines the Epic Games Launcher installs go to tools\\unreal\\engines (kept between sandboxes, 40-60 GB each) and are registered with the launcher again every boot. Off: they go on the sandbox disk and are lost when it closes. Engines installed on this PC can be mapped instead (pcInstalls.unrealEngines).'),

package/dist/guest/agents/agent-files.d.ts

@@ -52,9 +52,10 @@ export declare function bootResetPaths(agents: Readonly<Record<string, Harness>>
 }[];
 type CodexSettings = Config['codex'];
 /**
- * The flags every Codex start gets. Flags beat config.toml and a resumed thread's saved permissions, which is why the
- * sandbox does not rely on the file. Full access with no questions is the one flag that skips Codex's Windows sandbox
- * setup for certain. Pure.
+ * The flags every Codex start through the sandbox gets (the codex.cmd shim, the daemon's sessions). Flags beat
+ * config.toml and a resumed thread's saved permissions; config.toml carries the same settings for a start without
+ * them (codexConfigOwned). Full access with no questions is the one flag that skips Codex's Windows sandbox setup for
+ * certain. Pure.
  */
 export declare function codexArguments(c: CodexSettings): string[];
 /** The arguments an agent always starts with: its own, and for codex the sandbox's settings. */
@@ -62,10 +63,13 @@ export declare function agentArguments(name: string, harness: Harness, codex: Co
 /** The largest config.toml the sandbox edits. */
 export declare const MAX_CODEX_CONFIG_BYTES: number;
 /**
- * Codex's config.toml as the sandbox wants it, every other line byte for byte: the lines an older version wrote above
- * the first table (sandbox_mode, approval_policy, under the marker comment) are gone, `[windows] sandbox` follows
- * windowsSandbox ("off" removes the line, so Codex does not set up its own sandbox users), and
- * mcp_oauth_credentials_store = "file" is added when it is not set. Running it again changes nothing. Pure.
+ * Codex's config.toml as the sandbox wants it, every other line byte for byte. Above the first table, under the
+ * marker comment: sandbox_mode, approval_policy (and model, model_reasoning_effort when set), so ANY start of Codex
+ * obeys the codex settings, also one without the shim's flags (a copy installed with npm -g). The marked lines are
+ * replaced each time; a key the user set on a line of their own above the first table is left to them.
+ * `[windows] sandbox` follows windowsSandbox ("off" removes the line, which Codex adds back after its own setup, so it
+ * does not set up its own sandbox users), and mcp_oauth_credentials_store = "file" is added when it is not set.
+ * Keeps the file's line endings; running it again changes nothing. Pure.
  */
 export declare function codexConfigOwned(toml: string, c: CodexSettings): string;
 /**

package/dist/guest/agents/agent-files.js

@@ -63,10 +63,17 @@ export function bootResetPaths(agents, stateDir) {
 }
 /** The marker the sandbox puts above the lines it writes into config.toml. */
 const CODEX_MARKER = '# Set by the sandbox';
+/** The full marker line: what it is and where to change it. */
+const CODEX_MARKER_LINE = CODEX_MARKER + ' from its codex settings (`sandbox config`); a line of your own without it wins.';
+/** Markers whose lines count as the sandbox's: CODEX_MARKER, and a hand-made fix's (`# agent-sandbox:`). */
+const CODEX_MARKERS = [CODEX_MARKER, '# agent-sandbox:'];
+/** The top-level keys the sandbox writes under its marker. */
+const CODEX_OWNED_KEYS = ['sandbox_mode', 'approval_policy', 'model', 'model_reasoning_effort'];
 /**
- * The flags every Codex start gets. Flags beat config.toml and a resumed thread's saved permissions, which is why the
- * sandbox does not rely on the file. Full access with no questions is the one flag that skips Codex's Windows sandbox
- * setup for certain. Pure.
+ * The flags every Codex start through the sandbox gets (the codex.cmd shim, the daemon's sessions). Flags beat
+ * config.toml and a resumed thread's saved permissions; config.toml carries the same settings for a start without
+ * them (codexConfigOwned). Full access with no questions is the one flag that skips Codex's Windows sandbox setup for
+ * certain. Pure.
  */
 export function codexArguments(c) {
     const out = c.sandboxMode === 'danger-full-access' && c.approvalPolicy === 'never'
@@ -85,10 +92,13 @@ export function agentArguments(name, harness, codex) {
 /** The largest config.toml the sandbox edits. */
 export const MAX_CODEX_CONFIG_BYTES = 1024 * 1024;
 /**
- * Codex's config.toml as the sandbox wants it, every other line byte for byte: the lines an older version wrote above
- * the first table (sandbox_mode, approval_policy, under the marker comment) are gone, `[windows] sandbox` follows
- * windowsSandbox ("off" removes the line, so Codex does not set up its own sandbox users), and
- * mcp_oauth_credentials_store = "file" is added when it is not set. Running it again changes nothing. Pure.
+ * Codex's config.toml as the sandbox wants it, every other line byte for byte. Above the first table, under the
+ * marker comment: sandbox_mode, approval_policy (and model, model_reasoning_effort when set), so ANY start of Codex
+ * obeys the codex settings, also one without the shim's flags (a copy installed with npm -g). The marked lines are
+ * replaced each time; a key the user set on a line of their own above the first table is left to them.
+ * `[windows] sandbox` follows windowsSandbox ("off" removes the line, which Codex adds back after its own setup, so it
+ * does not set up its own sandbox users), and mcp_oauth_credentials_store = "file" is added when it is not set.
+ * Keeps the file's line endings; running it again changes nothing. Pure.
  */
 export function codexConfigOwned(toml, c) {
     const eol = toml.includes('\r\n') ? '\r\n' : '\n';
@@ -96,15 +106,31 @@ export function codexConfigOwned(toml, c) {
     let top = firstTable < 0 ? toml : toml.slice(0, firstTable);
     const tables = firstTable < 0 ? '' : toml.slice(firstTable);
     top = top.replace(MARKED_LINES, '');
-    if (c.mcpLoginsInFile && !/^[ \t]*mcp_oauth_credentials_store[ \t]*=/m.test(top)) {
+    if (c.mcpLoginsInFile && !hasKey(top, 'mcp_oauth_credentials_store')) {
         if (top && !top.endsWith('\n'))
             top += eol;
         top += 'mcp_oauth_credentials_store = "file"' + eol + (tables ? eol : '');
     }
-    return top + codexWindowsSandbox(tables, c.windowsSandbox, eol);
+    const values = {
+        sandbox_mode: c.sandboxMode,
+        approval_policy: c.approvalPolicy,
+        model: c.model,
+        model_reasoning_effort: c.reasoningEffort === 'default' ? '' : c.reasoningEffort,
+    };
+    const lines = CODEX_OWNED_KEYS.filter((k) => values[k] && !hasKey(top, k)).map((k) => k + ' = ' + JSON.stringify(values[k]));
+    const marked = lines.length ? [CODEX_MARKER_LINE, ...lines].join(eol) + eol + (top || tables ? eol : '') : '';
+    return marked + top + codexWindowsSandbox(tables, c.windowsSandbox, eol);
+}
+/** True when the top of config.toml sets the key on a line of its own. */
+function hasKey(top, key) {
+    return new RegExp('^[ \t]*' + key + '[ \t]*=', 'm').test(top);
 }
-/** The lines an older version wrote above the first table: its marker comment, then sandbox_mode / approval_policy. */
-const MARKED_LINES = new RegExp('^' + CODEX_MARKER + '[^\r\n]*\r?\n(?:(?:sandbox_mode|approval_policy)[ \t]*=[^\r\n]*\r?\n)*(?:[ \t]*\r?\n)?', 'm');
+/** The lines the sandbox wrote above the first table: a marker comment, the keys it owns, then one blank line. */
+const MARKED_LINES = new RegExp('^(?:' +
+    CODEX_MARKERS.join('|') +
+    ')[^\r\n]*\r?\n(?:(?:' +
+    CODEX_OWNED_KEYS.join('|') +
+    ')[ \t]*=[^\r\n]*(?:\r?\n|$))*(?:[ \t]*\r?\n)?', 'm');
 /** The tables of config.toml (from the first one on) with `[windows] sandbox` set to the mode, or removed for "off". */
 function codexWindowsSandbox(tables, mode, eol) {
     const setting = 'sandbox = "' + mode + '"';

package/dist/guest/agents/local-state.d.ts

@@ -7,7 +7,8 @@ export declare function localStateVars(): Record<string, string>;
 export declare function resetMachineBound(): void;
 /**
  * Boot: Codex's config.toml follows the codex settings (codexConfigOwned): no Windows sandbox setup of its own, its MCP
- * logins in a file. The sandbox mode itself travels as launch flags (codexArguments), which beat this file.
+ * logins in a file, the sandbox mode and approval policy for a start without the launch flags (codexArguments, which
+ * beat this file and still go on every start through the sandbox).
  */
 export declare function codexBootConfig(): void;
 /** Boot: the saved databases of every configured agent are copied to the sandbox's disk, where the agent runs them. */

package/dist/guest/agents/local-state.js

@@ -104,7 +104,8 @@ export function resetMachineBound() {
 }
 /**
  * Boot: Codex's config.toml follows the codex settings (codexConfigOwned): no Windows sandbox setup of its own, its MCP
- * logins in a file. The sandbox mode itself travels as launch flags (codexArguments), which beat this file.
+ * logins in a file, the sandbox mode and approval policy for a start without the launch flags (codexArguments, which
+ * beat this file and still go on every start through the sandbox).
  */
 export function codexBootConfig() {
     if (dryRun || !session.agents?.codex || !session.codex)

package/dist/guest/boot/boot-console.d.ts

@@ -0,0 +1,28 @@
+import { type ReadyInfo, type ViewStage, type ViewTask } from './progress-view.js';
+import type { BootTaskDef, RunnerObserver, TaskOutcome } from './runner.js';
+export declare class BootConsole implements RunnerObserver {
+    private readonly view;
+    private readonly live;
+    private timer;
+    private open;
+    private constructor();
+    /** `plain`: ordered lines even on a terminal (a dry run). */
+    static create(stages: readonly ViewStage[], tasks: readonly ViewTask[], o: {
+        plain: boolean;
+    }): BootConsole;
+    /** Prints the header and takes the console. */
+    start(header: string): void;
+    started(task: BootTaskDef): void;
+    finished(task: BootTaskDef, outcome: TaskOutcome): void;
+    /** What a running task's place on its row says (null: its title). */
+    detail(taskId: string, text: string | null): void;
+    /** The tool summary: to the file now, to the console once the boot is ready. */
+    summary(lines: readonly string[]): void;
+    /** Runs `work` that writes to the terminal itself (the hooks). */
+    aside<T>(work: () => T): T;
+    /**
+     * The final summary (`ready`, or null when the boot failed); the console is the log's own again. Programs' output
+     * keeps going to the log (the background runs quiet: file only).
+     */
+    release(ready: ReadyInfo | null): void;
+}

package/dist/guest/boot/boot-console.js

@@ -0,0 +1,98 @@
+// The boot's console on the sandbox's terminal: the live progress block when it is a terminal, ordered plain lines
+// otherwise (and in a dry run). While it is open it takes the log's console lines and the output of the programs the
+// boot starts; it is released, with the final summary, right before the first session takes the window.
+import { log, record, routeConsole } from '../runtime/log.js';
+import { routeOutput } from '../runtime/process.js';
+import { CONSOLE_GLYPHS, ProgressView, readyLines, RICH_GLYPHS, } from './progress-view.js';
+/** The spinner's pace (the elapsed times change every tenth of a second too). */
+const FRAME_MS = 100;
+const COLUMNS = 80;
+const SHOW_CURSOR = '\x1b[?25h';
+export class BootConsole {
+    view;
+    live;
+    timer = null;
+    open = false;
+    constructor(view, live) {
+        this.view = view;
+        this.live = live;
+    }
+    /** `plain`: ordered lines even on a terminal (a dry run). */
+    static create(stages, tasks, o) {
+        const live = !o.plain && process.stdout.isTTY === true;
+        // Windows Terminal sets WT_SESSION; the classic console's font has no braille or check marks.
+        const rich = live && Boolean(process.env.WT_SESSION);
+        const view = new ProgressView(stages, tasks, {
+            live,
+            glyphs: rich ? RICH_GLYPHS : CONSOLE_GLYPHS,
+            now: () => Date.now(),
+            screen: {
+                write: (text) => void process.stdout.write(text),
+                columns: () => process.stdout.columns ?? COLUMNS,
+            },
+        });
+        return new BootConsole(view, live);
+    }
+    /** Prints the header and takes the console. */
+    start(header) {
+        record(header);
+        this.open = true;
+        this.view.start(header);
+        routeConsole({
+            line: (message, stage) => this.view.line(message, stage),
+            warning: (message) => this.view.warning(message),
+            notice: (message) => this.view.notice(message),
+        });
+        // Programs the boot starts would draw over the block (or between the plain stages): their output goes to the log;
+        // the hooks keep the terminal. After the release too: the background steps must not write into the session.
+        routeOutput({ capturing: () => !this.open || this.view.capturing, line: (text) => log(text) });
+        if (!this.live)
+            return;
+        this.timer = setInterval(() => this.view.tick(), FRAME_MS);
+        this.timer.unref();
+        // A crash must not leave the terminal without its cursor.
+        process.once('exit', () => {
+            if (this.open)
+                process.stdout.write(SHOW_CURSOR);
+        });
+    }
+    started(task) {
+        this.view.started(task);
+        this.view.tick();
+    }
+    finished(task, outcome) {
+        this.view.finished(task, outcome);
+        this.view.tick();
+    }
+    /** What a running task's place on its row says (null: its title). */
+    detail(taskId, text) {
+        this.view.detail(taskId, text);
+    }
+    /** The tool summary: to the file now, to the console once the boot is ready. */
+    summary(lines) {
+        for (const line of lines)
+            record('  ' + line);
+        this.view.summary(lines);
+    }
+    /** Runs `work` that writes to the terminal itself (the hooks). */
+    aside(work) {
+        return this.view.aside(work);
+    }
+    /**
+     * The final summary (`ready`, or null when the boot failed); the console is the log's own again. Programs' output
+     * keeps going to the log (the background runs quiet: file only).
+     */
+    release(ready) {
+        if (!this.open)
+            return;
+        this.open = false;
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = null;
+        routeConsole(null);
+        if (ready)
+            for (const line of readyLines(ready))
+                record(line);
+        this.view.release(ready);
+    }
+}

package/dist/guest/boot/boot.d.ts

@@ -15,6 +15,9 @@ export declare class Boot {
     private secrets;
     private basePath;
     private readonly startedAt;
+    private readonly who;
+    /** The console while the boot runs: the stage rows, warnings and summary (released before the first session). */
+    private readonly progress;
     private openGate;
     private readonly gate;
     /** The boot is ready: the runner no longer writes the status (the session owns it). */
@@ -24,9 +27,13 @@ export declare class Boot {
     private stepsDone;
     private stepsTotal;
     run(): Promise<void>;
+    /** The prelude, then every foreground task (the console shows them). */
+    private foreground;
     private stageTitle;
-    /** The names shown for work that goes on after the boot is ready. */
+    /** The toolchain steps that go on after the boot is ready (Visual Studio and what needs it), in plan order. */
     private backgroundNames;
+    /** Runs a stage's hooks; they write to the terminal themselves, so the progress block steps aside for them. */
+    private hooks;
     /**
      * The host's one-shot file, read once. Your saved service sign-ins (accounts.<kind>.share) go to their tools before
      * anything opens them, and leave memory at once; what they give the agent (EXPO_TOKEN ...) joins its environment