windows-development-sandbox 1.23.2 → 1.25.1

package/dist/runtime/netproxy.js

@@ -25678,7 +25678,7 @@ var ToolchainsSchema = external_exports.strictObject({
       `"auto" (default): on the sandbox's own disk when C: has 25 GB free at boot, else "separate" (builds then write through the mapped workspace, which can overload this PC's disk). "shared": cargo's default target\\ (shared with builds on this PC, so builds on either side invalidate the other), "separate": <workspace>\\target\\sandbox (kept, no cross-talk), "local": on the sandbox's own disk (fastest, lost every boot), or a guest path.`
     ),
     linker: external_exports.enum(["lld", "gnu"]).describe(
-      `GNU host: "lld" links with Rust's own lld through MinGW's gcc (much less memory than GNU ld), "gnu" with GNU ld.`
+      `"lld" (default) links with Rust's own lld: through MinGW's gcc on the GNU host (much less memory than GNU ld), and instead of link.exe on the MSVC host (link.exe writes executables into mapped folders as all zeros: os error 1392). "gnu" keeps GNU ld / link.exe.`
     ),
     linkSlots: external_exports.union([external_exports.literal("auto"), external_exports.number().int().min(1).max(32)]).describe(
       'GNU host: how many programs may link at the same time in the whole sandbox (other links wait). "auto" = one per 6 GB of sandbox memory, 1 to 4 (the memory governor slows links down too when memory runs short).'
@@ -25697,7 +25697,7 @@ var ToolchainsSchema = external_exports.strictObject({
   }),
   unreal: external_exports.strictObject({
     enabled: enabled(
-      "Unreal Engine development: Visual Studio Community 2022 with the C++ game workload (MSVC, a Windows 11 SDK, .NET Framework targeting packs, Unreal integration and the Epic Games Launcher) and the DirectX End-User Runtime. A real installer: it runs every boot (~10 GB on the sandbox disk). The engine itself comes from the Epic Games Launcher or its source.",
+      "Unreal Engine development: Visual Studio Community 2022 with the C++ game workload (MSVC, a Windows 11 SDK, .NET Framework targeting packs, Unreal integration and the Epic Games Launcher) and the DirectX End-User Runtime. Visual Studio is installed once and kept on the data disk (~6.5 GB); later boots put it back in seconds. The engine itself comes from the Epic Games Launcher or its source.",
       "a .uproject or .uplugin"
     ),
     acceptLicense: external_exports.boolean().describe(
@@ -25706,11 +25706,8 @@ var ToolchainsSchema = external_exports.strictObject({
     components: StringsSchema.describe(
       'More Visual Studio workload or component IDs to add, e.g. ["Microsoft.VisualStudio.Component.VC.Llvm.Clang"].'
     ),
-    keepInstallFiles: external_exports.boolean().describe(
-      "Keep an offline copy of the Visual Studio install files in tools\\visualstudio (~10 GB, made once), so later boots install without downloading them again. Skipped while that disk has too little room."
-    ),
-    visualStudio: external_exports.enum(["full", "autosdk"]).describe(
-      `"full": install Visual Studio Community (the engine finds it through the Setup API; ~10 GB, redone every boot). "autosdk" (experimental): skip Visual Studio and build an Unreal AutoSDK tree from the portable MSVC in tools\\unreal\\autosdk (kept between sandboxes); UnrealBuildTool finds MSVC through AutoSDK, but the editor's Visual Studio integration is not available. Needs toolchains.msvc (turned on for you).`
+    visualStudio: external_exports.enum(["full", "buildtools"]).describe(
+      '"full": Visual Studio Community with the C++ game workload (the IDE, its debugger and Unreal integration). "buildtools": only the Visual Studio Build Tools (MSVC, the Windows SDK and the .NET Framework parts UnrealBuildTool needs; no IDE). Either is installed once and kept on the data disk (tools\\visualstudio\\persist, ~6.5 GB for Community); later boots put it back in seconds.'
     ),
     persistEngines: external_exports.boolean().describe(
       "Engines the Epic Games Launcher installs go to tools\\unreal\\engines (kept between sandboxes, 40-60 GB each) and are registered with the launcher again every boot. Off: they go on the sandbox disk and are lost when it closes. Engines installed on this PC can be mapped instead (pcInstalls.unrealEngines)."
@@ -25939,7 +25936,7 @@ var CHROME_DEVTOOLS_MCP_VERSION = "1.12.0";
 var BROWSER_USE_VERSION = "0.13.14";
 var PERPLEXITY_COMPUTER_MCP_URL = "https://www.perplexity.ai/rest/computer/mcp";
 var COMET_SIGNER = {
-  subject: ['^CN="?PERPLEXITY AI, INC\\.?"?(,|$)', '(^|, )O="?PERPLEXITY AI, INC\\.?"?(,|$)'],
+  subject: ['(^|, )CN="?PERPLEXITY AI, INC\\.?"?(,|$)', '(^|, )O="?PERPLEXITY AI, INC\\.?"?(,|$)'],
   issuer: ["^CN=GlobalSign GCC R45 EV CodeSigning CA 2020(,|$)"]
 };
 var EDGE_EXE = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe";
@@ -26041,7 +26038,77 @@ var AGENTS_WEB_APPS = [
 ];
 
 // src/shared/apps/catalogue-gamedev.ts
-var GAMEDEV_APPS = [];
+var GAMEDEV_APPS = [
+  {
+    id: "krita",
+    name: "Krita",
+    category: "gamedev",
+    about: "Painting and texture editor (PSD, layers, brushes), checked against the SHA-256 download.kde.org publishes.",
+    size: "450 MB",
+    source: { resolve: "krita" },
+    exe: "krita.exe",
+    needs: ["mesa"]
+  },
+  {
+    id: "inkscape",
+    name: "Inkscape",
+    category: "gamedev",
+    about: "Vector graphics for UI, icons and 2D art (SVG), checked against the SHA-256 inkscape.org publishes.",
+    size: "400 MB",
+    source: { resolve: "inkscape" },
+    exe: "inkscape.exe",
+    needs: ["7zip"]
+  },
+  {
+    id: "audacity",
+    name: "Audacity",
+    category: "gamedev",
+    about: "Records and edits sound effects and music (WAV, OGG, FLAC).",
+    size: "80 MB",
+    source: { github: "audacity/audacity", asset: "^audacity-win-[\\d.]+-(?:64bit\\.zip|x86_64\\.7z)$" },
+    exe: "Audacity.exe",
+    needs: ["7zip"]
+  },
+  {
+    id: "renderdoc",
+    name: "RenderDoc",
+    category: "gamedev",
+    about: "Captures a frame of a game (Unreal's -d3d12/-vulkan builds) to inspect every draw call, texture and shader. Needs the sandbox's GPU (vGPU) for live captures.",
+    size: "70 MB",
+    source: { resolve: "renderdoc" },
+    exe: "qrenderdoc.exe"
+  },
+  {
+    id: "f3d",
+    name: "F3D",
+    category: "gamedev",
+    about: "Fast 3D viewer (FBX, glTF/GLB, OBJ, STL, PLY, 3DS, USD); renders still previews from the command line.",
+    size: "100 MB",
+    source: { github: "f3d-app/f3d", asset: "^F3D-[\\d.]+-Windows-x86_64\\.zip$" },
+    exe: "f3d.exe",
+    needs: ["mesa"]
+  },
+  {
+    id: "imagemagick",
+    name: "ImageMagick",
+    category: "gamedev",
+    about: "Converts and thumbnails textures (TGA, PSD, DDS, EXR, HDR) and builds contact sheets (magick montage).",
+    size: "150 MB",
+    source: { github: "ImageMagick/ImageMagick", asset: "^ImageMagick-[\\d.]+-\\d+-portable-Q16-HDRI-x64\\.7z$" },
+    exe: "magick.exe",
+    cli: true,
+    needs: ["7zip"]
+  },
+  {
+    id: "nomacs",
+    name: "nomacs",
+    category: "gamedev",
+    about: "Image viewer for textures (TGA, PSD, DDS, EXR).",
+    size: "60 MB",
+    source: { github: "nomacs/nomacs", asset: "^nomacs-portable-win\\.zip$" },
+    exe: "nomacs.exe"
+  }
+];
 
 // src/shared/apps/catalogue-mobile.ts
 var MOBILE_APPS = [];
@@ -27270,10 +27337,14 @@ var PcInstallsSchema = external_exports.strictObject({
     "Epic Games Launcher games (by their app name)",
     '["Fortnite"]'
   ),
-  unrealEngines: pick2(
-    external_exports.string().regex(/^(UE_)?\d+\.\d+$/),
-    "Unreal Engine versions installed with the Epic Games Launcher",
-    '["5.4"]'
+  unrealEngines: external_exports.union([external_exports.literal("auto"), external_exports.boolean(), external_exports.array(external_exports.string().regex(/^(UE_)?\d+\.\d+$/))]).describe(
+    'Unreal Engine versions installed on this PC (with the Epic Games Launcher, or source builds it lists), read-only in the sandbox under C:\\PcInstalls\\unreal and registered there, so projects build with them without a download. "auto" = all of them whenever the sandbox is set up for Unreal, true = always, false = never, or a list (e.g. ["5.4"]).'
+  ),
+  unrealEngineFolders: external_exports.array(external_exports.string().min(3).max(260)).max(8).describe(
+    "Unreal Engine folders of this PC to use in the sandbox, writable (a source build, or a copy you build plugins into): each must hold Engine\\Build\\Build.version. Mapped under C:\\PcInstalls\\unreal and registered there."
+  ),
+  unrealAssets: external_exports.union([external_exports.literal("auto"), external_exports.boolean()]).describe(
+    `The Epic Games Launcher's vault cache of this PC (the Fab and Marketplace packs you downloaded), read-only in the sandbox at C:\\PcInstalls\\unreal\\Vault: what you download on your PC is there for the agents at once. "auto" = whenever the sandbox is set up for Unreal, true = always, false = never.`
   ),
   unityEditors: pick2(
     external_exports.string().regex(/^\d+\.\d+\.\d+[abfp]\d+$/),

package/dist/runtime/tool.js

@@ -26051,7 +26051,7 @@ var ToolchainsSchema = external_exports.strictObject({
       `"auto" (default): on the sandbox's own disk when C: has 25 GB free at boot, else "separate" (builds then write through the mapped workspace, which can overload this PC's disk). "shared": cargo's default target\\ (shared with builds on this PC, so builds on either side invalidate the other), "separate": <workspace>\\target\\sandbox (kept, no cross-talk), "local": on the sandbox's own disk (fastest, lost every boot), or a guest path.`
     ),
     linker: external_exports.enum(["lld", "gnu"]).describe(
-      `GNU host: "lld" links with Rust's own lld through MinGW's gcc (much less memory than GNU ld), "gnu" with GNU ld.`
+      `"lld" (default) links with Rust's own lld: through MinGW's gcc on the GNU host (much less memory than GNU ld), and instead of link.exe on the MSVC host (link.exe writes executables into mapped folders as all zeros: os error 1392). "gnu" keeps GNU ld / link.exe.`
     ),
     linkSlots: external_exports.union([external_exports.literal("auto"), external_exports.number().int().min(1).max(32)]).describe(
       'GNU host: how many programs may link at the same time in the whole sandbox (other links wait). "auto" = one per 6 GB of sandbox memory, 1 to 4 (the memory governor slows links down too when memory runs short).'
@@ -26070,7 +26070,7 @@ var ToolchainsSchema = external_exports.strictObject({
   }),
   unreal: external_exports.strictObject({
     enabled: enabled(
-      "Unreal Engine development: Visual Studio Community 2022 with the C++ game workload (MSVC, a Windows 11 SDK, .NET Framework targeting packs, Unreal integration and the Epic Games Launcher) and the DirectX End-User Runtime. A real installer: it runs every boot (~10 GB on the sandbox disk). The engine itself comes from the Epic Games Launcher or its source.",
+      "Unreal Engine development: Visual Studio Community 2022 with the C++ game workload (MSVC, a Windows 11 SDK, .NET Framework targeting packs, Unreal integration and the Epic Games Launcher) and the DirectX End-User Runtime. Visual Studio is installed once and kept on the data disk (~6.5 GB); later boots put it back in seconds. The engine itself comes from the Epic Games Launcher or its source.",
       "a .uproject or .uplugin"
     ),
     acceptLicense: external_exports.boolean().describe(
@@ -26079,11 +26079,8 @@ var ToolchainsSchema = external_exports.strictObject({
     components: StringsSchema.describe(
       'More Visual Studio workload or component IDs to add, e.g. ["Microsoft.VisualStudio.Component.VC.Llvm.Clang"].'
     ),
-    keepInstallFiles: external_exports.boolean().describe(
-      "Keep an offline copy of the Visual Studio install files in tools\\visualstudio (~10 GB, made once), so later boots install without downloading them again. Skipped while that disk has too little room."
-    ),
-    visualStudio: external_exports.enum(["full", "autosdk"]).describe(
-      `"full": install Visual Studio Community (the engine finds it through the Setup API; ~10 GB, redone every boot). "autosdk" (experimental): skip Visual Studio and build an Unreal AutoSDK tree from the portable MSVC in tools\\unreal\\autosdk (kept between sandboxes); UnrealBuildTool finds MSVC through AutoSDK, but the editor's Visual Studio integration is not available. Needs toolchains.msvc (turned on for you).`
+    visualStudio: external_exports.enum(["full", "buildtools"]).describe(
+      '"full": Visual Studio Community with the C++ game workload (the IDE, its debugger and Unreal integration). "buildtools": only the Visual Studio Build Tools (MSVC, the Windows SDK and the .NET Framework parts UnrealBuildTool needs; no IDE). Either is installed once and kept on the data disk (tools\\visualstudio\\persist, ~6.5 GB for Community); later boots put it back in seconds.'
     ),
     persistEngines: external_exports.boolean().describe(
       "Engines the Epic Games Launcher installs go to tools\\unreal\\engines (kept between sandboxes, 40-60 GB each) and are registered with the launcher again every boot. Off: they go on the sandbox disk and are lost when it closes. Engines installed on this PC can be mapped instead (pcInstalls.unrealEngines)."
@@ -26312,7 +26309,7 @@ var CHROME_DEVTOOLS_MCP_VERSION = "1.12.0";
 var BROWSER_USE_VERSION = "0.13.14";
 var PERPLEXITY_COMPUTER_MCP_URL = "https://www.perplexity.ai/rest/computer/mcp";
 var COMET_SIGNER = {
-  subject: ['^CN="?PERPLEXITY AI, INC\\.?"?(,|$)', '(^|, )O="?PERPLEXITY AI, INC\\.?"?(,|$)'],
+  subject: ['(^|, )CN="?PERPLEXITY AI, INC\\.?"?(,|$)', '(^|, )O="?PERPLEXITY AI, INC\\.?"?(,|$)'],
   issuer: ["^CN=GlobalSign GCC R45 EV CodeSigning CA 2020(,|$)"]
 };
 var EDGE_EXE = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe";
@@ -26414,7 +26411,77 @@ var AGENTS_WEB_APPS = [
 ];
 
 // src/shared/apps/catalogue-gamedev.ts
-var GAMEDEV_APPS = [];
+var GAMEDEV_APPS = [
+  {
+    id: "krita",
+    name: "Krita",
+    category: "gamedev",
+    about: "Painting and texture editor (PSD, layers, brushes), checked against the SHA-256 download.kde.org publishes.",
+    size: "450 MB",
+    source: { resolve: "krita" },
+    exe: "krita.exe",
+    needs: ["mesa"]
+  },
+  {
+    id: "inkscape",
+    name: "Inkscape",
+    category: "gamedev",
+    about: "Vector graphics for UI, icons and 2D art (SVG), checked against the SHA-256 inkscape.org publishes.",
+    size: "400 MB",
+    source: { resolve: "inkscape" },
+    exe: "inkscape.exe",
+    needs: ["7zip"]
+  },
+  {
+    id: "audacity",
+    name: "Audacity",
+    category: "gamedev",
+    about: "Records and edits sound effects and music (WAV, OGG, FLAC).",
+    size: "80 MB",
+    source: { github: "audacity/audacity", asset: "^audacity-win-[\\d.]+-(?:64bit\\.zip|x86_64\\.7z)$" },
+    exe: "Audacity.exe",
+    needs: ["7zip"]
+  },
+  {
+    id: "renderdoc",
+    name: "RenderDoc",
+    category: "gamedev",
+    about: "Captures a frame of a game (Unreal's -d3d12/-vulkan builds) to inspect every draw call, texture and shader. Needs the sandbox's GPU (vGPU) for live captures.",
+    size: "70 MB",
+    source: { resolve: "renderdoc" },
+    exe: "qrenderdoc.exe"
+  },
+  {
+    id: "f3d",
+    name: "F3D",
+    category: "gamedev",
+    about: "Fast 3D viewer (FBX, glTF/GLB, OBJ, STL, PLY, 3DS, USD); renders still previews from the command line.",
+    size: "100 MB",
+    source: { github: "f3d-app/f3d", asset: "^F3D-[\\d.]+-Windows-x86_64\\.zip$" },
+    exe: "f3d.exe",
+    needs: ["mesa"]
+  },
+  {
+    id: "imagemagick",
+    name: "ImageMagick",
+    category: "gamedev",
+    about: "Converts and thumbnails textures (TGA, PSD, DDS, EXR, HDR) and builds contact sheets (magick montage).",
+    size: "150 MB",
+    source: { github: "ImageMagick/ImageMagick", asset: "^ImageMagick-[\\d.]+-\\d+-portable-Q16-HDRI-x64\\.7z$" },
+    exe: "magick.exe",
+    cli: true,
+    needs: ["7zip"]
+  },
+  {
+    id: "nomacs",
+    name: "nomacs",
+    category: "gamedev",
+    about: "Image viewer for textures (TGA, PSD, DDS, EXR).",
+    size: "60 MB",
+    source: { github: "nomacs/nomacs", asset: "^nomacs-portable-win\\.zip$" },
+    exe: "nomacs.exe"
+  }
+];
 
 // src/shared/apps/catalogue-mobile.ts
 var MOBILE_APPS = [];
@@ -27643,10 +27710,14 @@ var PcInstallsSchema = external_exports.strictObject({
     "Epic Games Launcher games (by their app name)",
     '["Fortnite"]'
   ),
-  unrealEngines: pick2(
-    external_exports.string().regex(/^(UE_)?\d+\.\d+$/),
-    "Unreal Engine versions installed with the Epic Games Launcher",
-    '["5.4"]'
+  unrealEngines: external_exports.union([external_exports.literal("auto"), external_exports.boolean(), external_exports.array(external_exports.string().regex(/^(UE_)?\d+\.\d+$/))]).describe(
+    'Unreal Engine versions installed on this PC (with the Epic Games Launcher, or source builds it lists), read-only in the sandbox under C:\\PcInstalls\\unreal and registered there, so projects build with them without a download. "auto" = all of them whenever the sandbox is set up for Unreal, true = always, false = never, or a list (e.g. ["5.4"]).'
+  ),
+  unrealEngineFolders: external_exports.array(external_exports.string().min(3).max(260)).max(8).describe(
+    "Unreal Engine folders of this PC to use in the sandbox, writable (a source build, or a copy you build plugins into): each must hold Engine\\Build\\Build.version. Mapped under C:\\PcInstalls\\unreal and registered there."
+  ),
+  unrealAssets: external_exports.union([external_exports.literal("auto"), external_exports.boolean()]).describe(
+    `The Epic Games Launcher's vault cache of this PC (the Fab and Marketplace packs you downloaded), read-only in the sandbox at C:\\PcInstalls\\unreal\\Vault: what you download on your PC is there for the agents at once. "auto" = whenever the sandbox is set up for Unreal, true = always, false = never.`
   ),
   unityEditors: pick2(
     external_exports.string().regex(/^\d+\.\d+\.\d+[abfp]\d+$/),
@@ -28127,19 +28198,33 @@ var run = new RunDir(dataDir);
 
 // src/guest/runtime/process.ts
 import { spawn as spawn2, spawnSync } from "node:child_process";
+var outputSink = null;
+var captureOutput = () => outputSink?.capturing() ?? false;
+function logOutput(text) {
+  for (const line of text.split(/\r?\n/)) if (line.trim()) outputSink?.line(line.trimEnd());
+}
+var CAPTURE_BYTES = 64 * 1024 * 1024;
+function scriptErrors(errors) {
+  if (!errors) return;
+  if (captureOutput()) logOutput(errors);
+  else process.stderr.write(errors + "\n");
+}
 function execOutput(file2, args2, options = {}) {
   const result = spawnSync(file2, args2, { encoding: "utf8", windowsHide: true, ...options });
   return result.status === 0 ? String(result.stdout ?? "").trim() : "";
 }
 function runScript(name2, args2 = []) {
+  const capture = captureOutput();
   const result = spawnSync(SYSTEM.powershell(), scriptArgs(name2, args2), {
-    stdio: ["inherit", "inherit", "pipe"],
+    stdio: ["inherit", capture ? "pipe" : "inherit", "pipe"],
     encoding: "utf8",
-    windowsHide: true
+    windowsHide: true,
+    ...capture ? { maxBuffer: CAPTURE_BYTES } : {}
   });
+  if (capture) logOutput(String(result.stdout ?? ""));
   if (result.error) throw result.error;
   const errors = String(result.stderr ?? "").trim();
-  if (errors) process.stderr.write(errors + "\n");
+  scriptErrors(errors);
   if (result.status !== 0)
     throw new Error(name2 + " failed with exit code " + result.status + (errors ? ": " + errors.slice(0, 400) : ""));
 }
@@ -28250,36 +28335,45 @@ import path17 from "node:path";
 import fs11 from "node:fs";
 import path12 from "node:path";
 import { AsyncLocalStorage } from "node:async_hooks";
+
+// src/guest/runtime/log-line.ts
+var ESCAPES = /\x1b\[[0-9;?]{0,32}[A-Za-z]/g;
+function plainText(text) {
+  return text.replace(ESCAPES, "");
+}
+function fileLines(message, at = /* @__PURE__ */ new Date(), task) {
+  const stamp = at.toISOString() + " " + (task ? "[" + task + "] " : "");
+  return plainText(message).split(/\r?\n/).filter((line) => line.trim() !== "").map((line) => stamp + line.trimEnd());
+}
+
+// src/guest/runtime/log.ts
 fs11.mkdirSync(logsDir, { recursive: true });
 var logFile = path12.join(
   logsDir,
   (process.env.AGENT_LOG_PREFIX ?? "guest") + "-" + (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-") + ".log"
 );
 var context = new AsyncLocalStorage();
-function fileLine(message, at = /* @__PURE__ */ new Date()) {
-  return at.toISOString() + " " + message;
-}
-var append = (line) => {
+var sink = null;
+var append = (message, ctx) => {
   try {
-    fs11.appendFileSync(logFile, fileLine(line) + "\n");
+    const lines = fileLines(message, /* @__PURE__ */ new Date(), ctx?.task);
+    if (lines.length) fs11.appendFileSync(logFile, lines.join("\n") + "\n");
   } catch {
   }
 };
-var tagged = (message, ctx) => {
-  const prefix = ctx?.prefix?.();
-  return prefix ? prefix + " | " + message : message;
-};
 function log(message) {
   const ctx = context.getStore();
-  const line = tagged(message, ctx);
-  if (!ctx?.quiet) console.log(line);
-  append(line);
+  append(message, ctx);
+  if (ctx?.quiet) return;
+  if (sink) sink.line(message, ctx?.stage);
+  else console.log(message);
 }
 function warn(message) {
   const ctx = context.getStore();
-  const line = tagged(message, ctx);
-  if (!ctx?.quiet) console.warn("\x1B[33mWARNING: " + line + "\x1B[0m");
-  append("WARNING: " + line);
+  append("WARNING: " + message, ctx);
+  if (ctx?.quiet) return;
+  if (sink) sink.warning(message);
+  else console.warn("\x1B[33mWARNING: " + message + "\x1B[0m");
 }
 
 // src/guest/toolchains/signature.ts

package/dist/runtime/view.js

@@ -6176,7 +6176,7 @@ function runTerminalClient(socket, token, options = {}) {
     socket.on("close", () => finish({ reason: "closed" }));
     socket.on("error", () => finish({ reason: "closed" }));
     const [c, r] = size();
-    stdout.write("\x1B[2J\x1B[3J\x1B[H");
+    stdout.write("\x1B[2J\x1B[H");
     socket.write(helloFrame(token, c, r));
     if (stdin.isTTY) stdin.setRawMode(true);
     vtInput = enableVtInput();
@@ -26254,7 +26254,7 @@ var ToolchainsSchema = external_exports.strictObject({
       `"auto" (default): on the sandbox's own disk when C: has 25 GB free at boot, else "separate" (builds then write through the mapped workspace, which can overload this PC's disk). "shared": cargo's default target\\ (shared with builds on this PC, so builds on either side invalidate the other), "separate": <workspace>\\target\\sandbox (kept, no cross-talk), "local": on the sandbox's own disk (fastest, lost every boot), or a guest path.`
     ),
     linker: external_exports.enum(["lld", "gnu"]).describe(
-      `GNU host: "lld" links with Rust's own lld through MinGW's gcc (much less memory than GNU ld), "gnu" with GNU ld.`
+      `"lld" (default) links with Rust's own lld: through MinGW's gcc on the GNU host (much less memory than GNU ld), and instead of link.exe on the MSVC host (link.exe writes executables into mapped folders as all zeros: os error 1392). "gnu" keeps GNU ld / link.exe.`
     ),
     linkSlots: external_exports.union([external_exports.literal("auto"), external_exports.number().int().min(1).max(32)]).describe(
       'GNU host: how many programs may link at the same time in the whole sandbox (other links wait). "auto" = one per 6 GB of sandbox memory, 1 to 4 (the memory governor slows links down too when memory runs short).'
@@ -26273,7 +26273,7 @@ var ToolchainsSchema = external_exports.strictObject({
   }),
   unreal: external_exports.strictObject({
     enabled: enabled(
-      "Unreal Engine development: Visual Studio Community 2022 with the C++ game workload (MSVC, a Windows 11 SDK, .NET Framework targeting packs, Unreal integration and the Epic Games Launcher) and the DirectX End-User Runtime. A real installer: it runs every boot (~10 GB on the sandbox disk). The engine itself comes from the Epic Games Launcher or its source.",
+      "Unreal Engine development: Visual Studio Community 2022 with the C++ game workload (MSVC, a Windows 11 SDK, .NET Framework targeting packs, Unreal integration and the Epic Games Launcher) and the DirectX End-User Runtime. Visual Studio is installed once and kept on the data disk (~6.5 GB); later boots put it back in seconds. The engine itself comes from the Epic Games Launcher or its source.",
       "a .uproject or .uplugin"
     ),
     acceptLicense: external_exports.boolean().describe(
@@ -26282,11 +26282,8 @@ var ToolchainsSchema = external_exports.strictObject({
     components: StringsSchema.describe(
       'More Visual Studio workload or component IDs to add, e.g. ["Microsoft.VisualStudio.Component.VC.Llvm.Clang"].'
     ),
-    keepInstallFiles: external_exports.boolean().describe(
-      "Keep an offline copy of the Visual Studio install files in tools\\visualstudio (~10 GB, made once), so later boots install without downloading them again. Skipped while that disk has too little room."
-    ),
-    visualStudio: external_exports.enum(["full", "autosdk"]).describe(
-      `"full": install Visual Studio Community (the engine finds it through the Setup API; ~10 GB, redone every boot). "autosdk" (experimental): skip Visual Studio and build an Unreal AutoSDK tree from the portable MSVC in tools\\unreal\\autosdk (kept between sandboxes); UnrealBuildTool finds MSVC through AutoSDK, but the editor's Visual Studio integration is not available. Needs toolchains.msvc (turned on for you).`
+    visualStudio: external_exports.enum(["full", "buildtools"]).describe(
+      '"full": Visual Studio Community with the C++ game workload (the IDE, its debugger and Unreal integration). "buildtools": only the Visual Studio Build Tools (MSVC, the Windows SDK and the .NET Framework parts UnrealBuildTool needs; no IDE). Either is installed once and kept on the data disk (tools\\visualstudio\\persist, ~6.5 GB for Community); later boots put it back in seconds.'
     ),
     persistEngines: external_exports.boolean().describe(
       "Engines the Epic Games Launcher installs go to tools\\unreal\\engines (kept between sandboxes, 40-60 GB each) and are registered with the launcher again every boot. Off: they go on the sandbox disk and are lost when it closes. Engines installed on this PC can be mapped instead (pcInstalls.unrealEngines)."
@@ -26515,7 +26512,7 @@ var CHROME_DEVTOOLS_MCP_VERSION = "1.12.0";
 var BROWSER_USE_VERSION = "0.13.14";
 var PERPLEXITY_COMPUTER_MCP_URL = "https://www.perplexity.ai/rest/computer/mcp";
 var COMET_SIGNER = {
-  subject: ['^CN="?PERPLEXITY AI, INC\\.?"?(,|$)', '(^|, )O="?PERPLEXITY AI, INC\\.?"?(,|$)'],
+  subject: ['(^|, )CN="?PERPLEXITY AI, INC\\.?"?(,|$)', '(^|, )O="?PERPLEXITY AI, INC\\.?"?(,|$)'],
   issuer: ["^CN=GlobalSign GCC R45 EV CodeSigning CA 2020(,|$)"]
 };
 var EDGE_EXE = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe";
@@ -26617,7 +26614,77 @@ var AGENTS_WEB_APPS = [
 ];
 
 // src/shared/apps/catalogue-gamedev.ts
-var GAMEDEV_APPS = [];
+var GAMEDEV_APPS = [
+  {
+    id: "krita",
+    name: "Krita",
+    category: "gamedev",
+    about: "Painting and texture editor (PSD, layers, brushes), checked against the SHA-256 download.kde.org publishes.",
+    size: "450 MB",
+    source: { resolve: "krita" },
+    exe: "krita.exe",
+    needs: ["mesa"]
+  },
+  {
+    id: "inkscape",
+    name: "Inkscape",
+    category: "gamedev",
+    about: "Vector graphics for UI, icons and 2D art (SVG), checked against the SHA-256 inkscape.org publishes.",
+    size: "400 MB",
+    source: { resolve: "inkscape" },
+    exe: "inkscape.exe",
+    needs: ["7zip"]
+  },
+  {
+    id: "audacity",
+    name: "Audacity",
+    category: "gamedev",
+    about: "Records and edits sound effects and music (WAV, OGG, FLAC).",
+    size: "80 MB",
+    source: { github: "audacity/audacity", asset: "^audacity-win-[\\d.]+-(?:64bit\\.zip|x86_64\\.7z)$" },
+    exe: "Audacity.exe",
+    needs: ["7zip"]
+  },
+  {
+    id: "renderdoc",
+    name: "RenderDoc",
+    category: "gamedev",
+    about: "Captures a frame of a game (Unreal's -d3d12/-vulkan builds) to inspect every draw call, texture and shader. Needs the sandbox's GPU (vGPU) for live captures.",
+    size: "70 MB",
+    source: { resolve: "renderdoc" },
+    exe: "qrenderdoc.exe"
+  },
+  {
+    id: "f3d",
+    name: "F3D",
+    category: "gamedev",
+    about: "Fast 3D viewer (FBX, glTF/GLB, OBJ, STL, PLY, 3DS, USD); renders still previews from the command line.",
+    size: "100 MB",
+    source: { github: "f3d-app/f3d", asset: "^F3D-[\\d.]+-Windows-x86_64\\.zip$" },
+    exe: "f3d.exe",
+    needs: ["mesa"]
+  },
+  {
+    id: "imagemagick",
+    name: "ImageMagick",
+    category: "gamedev",
+    about: "Converts and thumbnails textures (TGA, PSD, DDS, EXR, HDR) and builds contact sheets (magick montage).",
+    size: "150 MB",
+    source: { github: "ImageMagick/ImageMagick", asset: "^ImageMagick-[\\d.]+-\\d+-portable-Q16-HDRI-x64\\.7z$" },
+    exe: "magick.exe",
+    cli: true,
+    needs: ["7zip"]
+  },
+  {
+    id: "nomacs",
+    name: "nomacs",
+    category: "gamedev",
+    about: "Image viewer for textures (TGA, PSD, DDS, EXR).",
+    size: "60 MB",
+    source: { github: "nomacs/nomacs", asset: "^nomacs-portable-win\\.zip$" },
+    exe: "nomacs.exe"
+  }
+];
 
 // src/shared/apps/catalogue-mobile.ts
 var MOBILE_APPS = [];
@@ -27846,10 +27913,14 @@ var PcInstallsSchema = external_exports.strictObject({
     "Epic Games Launcher games (by their app name)",
     '["Fortnite"]'
   ),
-  unrealEngines: pick2(
-    external_exports.string().regex(/^(UE_)?\d+\.\d+$/),
-    "Unreal Engine versions installed with the Epic Games Launcher",
-    '["5.4"]'
+  unrealEngines: external_exports.union([external_exports.literal("auto"), external_exports.boolean(), external_exports.array(external_exports.string().regex(/^(UE_)?\d+\.\d+$/))]).describe(
+    'Unreal Engine versions installed on this PC (with the Epic Games Launcher, or source builds it lists), read-only in the sandbox under C:\\PcInstalls\\unreal and registered there, so projects build with them without a download. "auto" = all of them whenever the sandbox is set up for Unreal, true = always, false = never, or a list (e.g. ["5.4"]).'
+  ),
+  unrealEngineFolders: external_exports.array(external_exports.string().min(3).max(260)).max(8).describe(
+    "Unreal Engine folders of this PC to use in the sandbox, writable (a source build, or a copy you build plugins into): each must hold Engine\\Build\\Build.version. Mapped under C:\\PcInstalls\\unreal and registered there."
+  ),
+  unrealAssets: external_exports.union([external_exports.literal("auto"), external_exports.boolean()]).describe(
+    `The Epic Games Launcher's vault cache of this PC (the Fab and Marketplace packs you downloaded), read-only in the sandbox at C:\\PcInstalls\\unreal\\Vault: what you download on your PC is there for the agents at once. "auto" = whenever the sandbox is set up for Unreal, true = always, false = never.`
   ),
   unityEditors: pick2(
     external_exports.string().regex(/^\d+\.\d+\.\d+[abfp]\d+$/),

package/dist/selftest/agent-paths.test.js

@@ -6,7 +6,7 @@ import { DEFAULTS, mergeConfig, validateConfig } from '../core/config/index.js';
 import { isWin } from '../core/util/index.js';
 import { SYSTEM } from '../shared/system.js';
 import { agentCommand, agentShims, bootResetPaths, isCopyableDatabaseFile, isDatabaseFile, localStateEntries, shimText, } from '../guest/agents/agent-files.js';
-import { appendMissing, expandVars, installedToolPaths, isGitUsrBin, isMsvcToolsDir, isPinnedNodeDir, msvcBeforeGitUsr, parseRegPath, pathKey, planPath, rebuildPath, splitPath, } from '../guest/setup/path-plan.js';
+import { appendMissing, expandVars, installedToolPaths, isGitUsrBin, isMsvcToolsDir, isPinnedNodeDir, msvcBeforeGitUsr, parseRegPath, pathKey, planPath, rebuildPath, sessionPath, splitPath, } from '../guest/setup/path-plan.js';
 import { withReloadEnvironment } from '../host/tools/index.js';
 import { HarnessSchema } from '../core/schema/index.js';
 export const agentPathsSuite = {
@@ -56,6 +56,7 @@ export const agentPathsSuite = {
             'C:\\AgentData\\state\\codex\\.sandbox\\setup_marker.json',
             'C:\\AgentData\\state\\codex\\.sandbox\\deny_read_acl_state.json',
             'C:\\AgentData\\state\\codex\\tmp\\arg0',
+            'C:\\AgentData\\state\\codex\\tmp\\arg0-windows',
         ], "codex's DPAPI-sealed sandbox users and setup marker are removed at boot (CryptUnprotectData otherwise)");
         t.check(HarnessSchema.safeParse({ ...DEFAULTS.harnesses.codex, bootReset: ['..\\login'] }).success === false &&
             HarnessSchema.safeParse({ ...DEFAULTS.harnesses.codex, bootReset: ['C:\\Windows'] }).success === false, 'bootReset takes only plain paths below the agent state folder');
@@ -64,6 +65,22 @@ export const agentPathsSuite = {
         const exists = (f) => present.has(pathKey(f));
         t.equal(planPath({ entries: ['C:\\A\\;c:\\b', 'C:\\a', 'C:\\missing;"C:\\C\\D"', '', 'c:/B'], exists }), ['C:\\A\\', 'c:\\b', 'C:\\C\\D'], 'ordered, no duplicates (case, slash, quotes), no missing folders');
         t.equal(planPath({ entries: ['C:\\a;C:\\nvm\\v24.1.0'], exists, drop: (f) => isPinnedNodeDir(f, 'C:\\NVM') }), ['C:\\a'], 'a pinned node version is never machine-wide');
+        const agentPath = sessionPath({
+            commands: 'C:\\nvm\\bin',
+            prepend: ['C:\\AgentData\\tools\\bin', 'C:\\AgentData\\tools\\nvm', 'C:\\nvm\\nodejs'],
+            base: ['C:\\Windows\\system32', 'c:\\NVM\\bin\\'],
+            append: ['C:\\AgentData\\tools\\agents\\codex'],
+        });
+        t.equal(agentPath, [
+            'C:\\nvm\\bin',
+            'C:\\AgentData\\tools\\bin',
+            'C:\\AgentData\\tools\\nvm',
+            'C:\\nvm\\nodejs',
+            'C:\\Windows\\system32',
+            'C:\\AgentData\\tools\\agents\\codex',
+        ], "the sandbox's agent shims come first, before nvm's node folder (an npm -g codex there) and the agent's own folder");
+        t.equal(planPath({ entries: [agentPath.join(';')], exists: () => true })[0], 'C:\\nvm\\bin', 'and stay first on the machine PATH that terminal tabs get');
+        t.equal(rebuildPath({ machine: agentPath.join(';'), user: 'C:\\nvm\\nodejs', process: '', env: {} }).split(';')[0], 'C:\\nvm\\bin', 'a new shell keeps them first');
         t.check(isPinnedNodeDir('C:\\nvm\\v24.1.0\\', 'C:\\nvm') && !isPinnedNodeDir('C:\\nvm', 'C:\\nvm'), 'only versions are pinned');
         t.equal(pathKey('C:\\'), 'c:\\', 'a drive root keeps its slash');
         t.equal(splitPath(' "C:\\a" ;; C:\\b;'), ['C:\\a', 'C:\\b'], 'splitting drops empty parts and quotes');

package/dist/selftest/agent-settings.test.js

@@ -30,14 +30,45 @@ export const agentSettingsSuite = {
         t.section('codex config.toml');
         const old = '# Set by the sandbox: x\nsandbox_mode = "danger-full-access"\n\n[tui]\nscreen_reader_detection_done = true\n\n[windows]\nsandbox = "elevated"\n';
         const owned = codexConfigOwned(old, CODEX);
-        t.check(!owned.includes('sandbox_mode') && !owned.includes('Set by the sandbox') && !owned.includes('sandbox = '), 'the old sandbox_mode lines and [windows] sandbox are removed', owned);
-        t.check(owned.includes('mcp_oauth_credentials_store = "file"') &&
-            owned.includes('[tui]\nscreen_reader_detection_done = true\n') &&
-            owned.includes('[windows]'), 'MCP logins go to a file; every other line stays', owned);
+        const marker = owned.split('\n')[0];
+        t.check(marker.startsWith('# Set by the sandbox'), 'the marked lines start the file', owned);
+        t.equal(owned, marker +
+            '\nsandbox_mode = "danger-full-access"\napproval_policy = "never"\n\nmcp_oauth_credentials_store = "file"\n\n' +
+            '[tui]\nscreen_reader_detection_done = true\n\n[windows]\n', 'sandbox_mode and approval_policy are written above the first table (the old marked lines replaced), MCP logins go to a file, [windows] sandbox is removed for "off", every other line stays');
         t.equal(codexConfigOwned(owned, CODEX), owned, 'running it again changes nothing');
+        t.equal(codexConfigOwned(owned, { ...CODEX, sandboxMode: 'workspace-write', approvalPolicy: 'on-request' }), owned
+            .replace('"danger-full-access"', '"workspace-write"')
+            .replace('approval_policy = "never"', 'approval_policy = "on-request"'), 'changed settings replace the marked lines in place');
+        const tuned = codexConfigOwned('', { ...CODEX, model: 'gpt-5', reasoningEffort: 'high', mcpLoginsInFile: false });
+        t.equal(tuned.split('\n').slice(1), [
+            'sandbox_mode = "danger-full-access"',
+            'approval_policy = "never"',
+            'model = "gpt-5"',
+            'model_reasoning_effort = "high"',
+            '',
+        ], 'model and reasoning effort are written when set (an empty file gets only the marked lines)');
+        t.equal(codexConfigOwned(tuned, { ...CODEX, mcpLoginsInFile: false }), tuned.replace('model = "gpt-5"\nmodel_reasoning_effort = "high"\n', ''), 'and removed again when cleared');
+        const mine = 'approval_policy = "on-request"\n\n[windows]\nsandbox = "elevated"\n';
+        const respected = codexConfigOwned(mine, { ...CODEX, mcpLoginsInFile: false });
+        t.check(respected.includes('sandbox_mode = "danger-full-access"') &&
+            respected.includes('approval_policy = "on-request"') &&
+            !respected.includes('approval_policy = "never"') &&
+            !respected.includes('sandbox = "elevated"'), "a user's own unmarked line is kept and not written again", respected);
+        t.equal(codexConfigOwned(respected, { ...CODEX, mcpLoginsInFile: false }), respected, 'stable with it too');
+        const crlf = old.replace(/\n/g, '\r\n');
+        const ownedCrlf = codexConfigOwned(crlf, CODEX);
+        t.equal(ownedCrlf, owned.replace(/\n/g, '\r\n'), 'a CRLF file is edited the same way and keeps CRLF');
+        t.equal(codexConfigOwned(ownedCrlf, CODEX), ownedCrlf, 'running it again on CRLF changes nothing');
+        const byHand = '# agent-sandbox: Windows Sandbox already contains Codex; its own command sandbox is off.\n' +
+            'sandbox_mode = "danger-full-access"\napproval_policy = "never"\nmcp_oauth_credentials_store = "file"\n\n' +
+            '[tui]\nscreen_reader_detection_done = true\n\n[projects.\'c:\\x\']\ntrust_level = "trusted"\n';
+        const adopted = codexConfigOwned(byHand, CODEX);
+        t.equal(adopted, marker +
+            '\nsandbox_mode = "danger-full-access"\napproval_policy = "never"\n\nmcp_oauth_credentials_store = "file"\n\n' +
+            '[tui]\nscreen_reader_detection_done = true\n\n[projects.\'c:\\x\']\ntrust_level = "trusted"\n', 'lines under the hand-made "# agent-sandbox:" marker count as the sandbox\'s and are replaced');
+        t.equal(codexConfigOwned(adopted, CODEX), adopted, 'and stay stable after that');
         t.includes(codexConfigOwned(old, { ...CODEX, windowsSandbox: 'unelevated' }), '[windows]\nsandbox = "unelevated"', 'a Windows sandbox mode is written when asked for');
         t.includes(codexConfigOwned('mcp_oauth_credentials_store = "keyring"\n', CODEX), 'mcp_oauth_credentials_store = "keyring"', "a user's own mcp_oauth_credentials_store is kept");
-        t.equal(codexConfigOwned('', { ...CODEX, mcpLoginsInFile: false }), '', 'an empty file stays empty when nothing is owned');
         t.section('Anthropic key pattern');
         const body = 'a'.repeat(60);
         t.check(ANTHROPIC_KEY_PATTERN.test('sk-ant-usr01-' + body) && ANTHROPIC_KEY_PATTERN.test('sk-ant-api03-' + body), 'sk-ant-api03- and sk-ant-usr01- keys are accepted');