windows-development-sandbox 1.23.2 → 1.25.1

package/dist/selftest/heavy-load.test.js

@@ -8,7 +8,7 @@ import { DEFAULTS } from '../core/config/index.js';
 import { isWin } from '../core/util/index.js';
 import { SYSTEM } from '../shared/system.js';
 import { GuestRequestSchema, PressureStatusSchema } from '../shared/channel/index.js';
-import { compilersAllowed, DIAL_CALM_SAMPLES, DIAL_STEPS, HOST_THRESHOLDS, buildJobs, cargoJobs, linkSlotsFor, usableCpus, effectiveCpuLimit, gentleCpuLimit, maxCompilers, chooseTargetDir, } from '../shared/memory/index.js';
+import { compilersAllowed, DIAL_CALM_SAMPLES, DIAL_STEPS, HOST_THRESHOLDS, buildJobs, cargoJobs, linkSlotsFor, usableCpus, effectiveCpuLimit, gentleCpuLimit, maxCompilers, chooseTargetDir, cargoLinkerVar, } from '../shared/memory/index.js';
 import { HeartbeatSchema } from '../shared/channel/index.js';
 import { heartbeatLine, lastEndOf, vanishedCause, stopWarning } from '../host/life/index.js';
 import { cappedMemoryMb, decideMemory, memoryNote, residentCapMb, residentNote, resolveMemoryMb, } from '../host/launch/index.js';
@@ -240,6 +240,8 @@ export const heavyLoadSuite = {
             chooseTargetDir('auto', 10 * 1024 ** 3).targetDir === 'separate' &&
             Boolean(chooseTargetDir('auto', 10 * 1024 ** 3).warning) &&
             chooseTargetDir('shared', 1).targetDir === 'shared', 'targetDir "auto": local with 25 GB free on C:, else separate with a warning; other values stay');
+        t.check(cargoLinkerVar('x86_64-pc-windows-msvc') === 'CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_LINKER' &&
+            cargoLinkerVar('aarch64-pc-windows-msvc') === 'CARGO_TARGET_AARCH64_PC_WINDOWS_MSVC_LINKER', 'cargo linker variable names the host triple (the msvc host links with lld, not link.exe)');
         const beat = {
             at: '2026-11-02T21:31:00.000Z',
             uptimeS: 2800,

package/dist/selftest/hostile-input.test.js

@@ -8,7 +8,7 @@ import { assertSafeMapping } from '../core/safe-paths.js';
 import { safeText } from '../core/util/index.js';
 import { isSafeFileName } from '../shared/paths/index.js';
 import { removeRefusal, safeRemove } from '../shared/io/index.js';
-import { writeJsonAtomic } from '../shared/io/index.js';
+import { rotateLog, writeJsonAtomic } from '../shared/io/index.js';
 export const hostileInputSuite = {
     name: 'hostile-input',
     title: 'file names, deletes, printed text, mappings and state files from an untrusted sandbox',
@@ -63,5 +63,15 @@ export const hostileInputSuite = {
         fs.writeFileSync(path.join(repoDir, '.sandbox-config.json'), '{"readOnly": true}' + ' '.repeat(1100 * 1024));
         await t.throws(() => f.run({ cwd: repoDir, trustConfig: true }), 'over 1 MB', 'a .sandbox-config.json over 1 MB is refused before it is parsed');
         fs.rmSync(path.join(repoDir, '.sandbox-config.json'));
+        t.section('a log that grows for ever (Headroom appends to one on the data disk)');
+        const logFile = t.at('rotate', 'proxy.log');
+        fs.mkdirSync(path.dirname(logFile), { recursive: true });
+        t.check(!rotateLog(logFile, 10), 'no log yet: nothing to rotate');
+        fs.writeFileSync(logFile, 'x'.repeat(10));
+        t.check(!rotateLog(logFile, 10) && fs.existsSync(logFile), 'a log at the limit stays');
+        fs.writeFileSync(logFile + '.1', 'old');
+        fs.writeFileSync(logFile, 'y'.repeat(11));
+        t.check(rotateLog(logFile, 10), 'a log over the limit is rotated');
+        t.check(!fs.existsSync(logFile) && fs.readFileSync(logFile + '.1', 'utf8') === 'y'.repeat(11), 'it replaces the older copy');
     },
 };

package/dist/selftest/index.js

@@ -16,6 +16,7 @@ import { persistedInstallsSuite } from './persisted-installs.test.js';
 import { pcInstallsSuite } from './pc-installs.test.js';
 import { steamSuite } from './steam.test.js';
 import { enginesSuite } from './engines.test.js';
+import { mixamoSuite } from './mixamo.test.js';
 import { unitySuite } from './unity.test.js';
 import { fivemSuite } from './fivem.test.js';
 import { androidSuite } from './android.test.js';
@@ -80,6 +81,7 @@ import { uiTextSuite } from './ui-text.test.js';
 import { menuCoverageSuite } from './menu-coverage.test.js';
 import { auditSuite } from './audit.test.js';
 import { bootRunnerSuite } from './boot-runner.test.js';
+import { bootConsoleSuite } from './boot-console.test.js';
 import { layoutSuite } from './layout.test.js';
 import { menuSuite } from './menu.test.js';
 import { menuPerfSuite } from './menu-perf.test.js';
@@ -133,10 +135,12 @@ export const SUITES = [
     // pure helpers and the command line
     layoutSuite,
     bootRunnerSuite,
+    bootConsoleSuite,
     toolchainsSuite,
     persistedInstallsSuite,
     steamSuite,
     enginesSuite,
+    mixamoSuite,
     unitySuite,
     fivemSuite,
     androidSuite,

package/dist/selftest/layout.test.js

@@ -19,6 +19,8 @@ const PURE_GUEST = [
     'guest/boot/project-env.js',
     'guest/boot/runner.js',
     'guest/boot/graph.js',
+    'guest/boot/progress-view.js',
+    'guest/runtime/log-line.js',
     'guest/toolchains/split.js',
     'guest/toolchains/step-scheduler.js',
     'guest/audit/parse.js',
@@ -30,6 +32,8 @@ const PURE_GUEST = [
     'guest/governor/decide.js',
     'guest/governor/core.js',
     'guest/daemon/live-folders.js',
+    'guest/toolchains/native/vs-request.js',
+    'guest/toolchains/native/vs-persist.js',
 ];
 const SIDE_EFFECTS = ['guest/runtime/session.js', 'guest/runtime/log.js'];
 const readModules = (dist) => {

package/dist/selftest/menu-screens.js

@@ -10,6 +10,7 @@ import { appsOptions, stageTicks } from '../cli/menu/pages/apps-page.js';
 import { maintenanceOptions } from '../cli/menu/pages/maintenance-page.js';
 import { sandboxOptions } from '../cli/menu/pages/sandbox-page.js';
 import { sessionsOptions } from '../cli/menu/pages/sessions-page.js';
+import { UNREAL_SAMPLE } from './support/unreal-sample.js';
 import { settingsOf, settingsOptions } from '../cli/menu/pages/settings-page.js';
 import { CATEGORIES } from '../app/features/settings/index.js';
 import { agentsOptions } from '../cli/menu/pages/agents-page.js';
@@ -199,6 +200,7 @@ export function renderScreens(dir) {
             { name: 'redis', running: false, port: 6379, title: 'Redis' },
         ],
         defaultAgent: 'claude',
+        unreal: UNREAL_SAMPLE,
     };
     const stopped = {
         ...sandbox,
@@ -399,7 +401,7 @@ export function renderScreens(dir) {
         out.push(block('1 Agents · Start', draw(0, { ...agentsOptions(agentsModel, API_FOLDER), startCategory: 'start' }, size, status), size), block('1 Agents · Options (navigation focused)', draw(0, { ...agentsOptions(agentsModel, API_FOLDER), startCategory: 'options' }, size, status, 0, true), size), block('1 Agents · On this PC', draw(0, { ...agentsOptions(agentsModel, API_FOLDER), startCategory: 'host' }, size, status), size), block('2 Sessions', draw(1, sessionsOptions({ sandboxRunning: true, sessions: SESSIONS, defaultAgent: 'claude' }), size, status), size), block('2 Sessions (no sandbox)', draw(1, sessionsOptions({ sandboxRunning: false, sessions: [], defaultAgent: 'claude' }), size), size));
         for (const category of ['status', 'databases'])
             out.push(block('3 Sandbox (stopped) · ' + category, draw(2, { ...sandboxOptions(stopped), startCategory: category }, size), size));
-        for (const category of ['status', 'projects', 'databases'])
+        for (const category of ['status', 'projects', 'databases', 'unreal'])
             out.push(block('3 Sandbox · ' + category, draw(2, { ...sandboxOptions(sandbox), startCategory: category }, size, status), size));
         out.push(block('4 Apps (1 unsaved)', draw(3, appsOptions(user, appsData, appsDraft, 'user'), size, status, appsDraft.count()), size));
         for (const category of CATEGORIES)

package/dist/selftest/migrate.test.js

@@ -159,6 +159,27 @@ export const migrateSuite = {
         finally {
             fs.rmSync(machineFile);
         }
+        t.section('drop-vs-install-files');
+        const dropVs = MIGRATIONS.find((m) => m.id === '2026-11-drop-vs-install-files');
+        if (!dropVs)
+            return t.check(false, 'the drop-vs-install-files migration exists');
+        const oldVs = t.write(t.at('vs', 'old.json'), '// mine\n' +
+            JSON.stringify({
+                toolchains: { unreal: { enabled: true, keepInstallFiles: true, visualStudio: 'autosdk', components: ['X'] } },
+            }));
+        const fullVs = t.write(t.at('vs', 'full.json'), JSON.stringify({ toolchains: { unreal: { visualStudio: 'full' } } }));
+        const vsNotes = [];
+        const vsWanted = dropVs.applies(ctx(t.at('vs'), oldVs)) && !dropVs.applies(ctx(t.at('vs'), fullVs));
+        await dropVs.run(ctx(t.at('vs'), oldVs), (line) => vsNotes.push(line));
+        const vsAfter = parse(readText(oldVs));
+        t.check(vsWanted &&
+            vsAfter.toolchains.unreal.keepInstallFiles === undefined &&
+            vsAfter.toolchains.unreal.visualStudio === undefined &&
+            vsAfter.toolchains.unreal.enabled === true &&
+            readText(oldVs).includes('// mine') &&
+            vsNotes.join().includes('toolchains.unreal.keepInstallFiles') &&
+            loadConfig(oldVs).config.toolchains.unreal.visualStudio === 'full' &&
+            !dropVs.applies(ctx(t.at('vs'), oldVs)), 'the retired Visual Studio settings are removed (a chosen "full" stays), the file loads again, and it is idempotent');
         t.section('sandbox migrate');
         const cmdUser = t.dir('cmd-user');
         const cmdConfig = t.write(t.at('cmd-user', 'config.json'), JSON.stringify({ ...JSON.parse(JSON.stringify(old.defaults)), sandbox: { memoryMb: 4096 } }, null, 2));

package/dist/selftest/mixamo.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const mixamoSuite: Suite;

package/dist/selftest/mixamo.test.js

@@ -0,0 +1,60 @@
+// Mixamo: the browser policy table (downloads folder, no GPU) and the guide's Mixamo lines and editor names.
+import { browserPolicies } from '../shared/browser-policy.js';
+import { unrealGuideLines } from '../shared/unreal/guide.js';
+const DOWNLOADS = 'C:\\AgentData\\downloads';
+const PROJECT = { workspace: 'C:\\P\\Game', uproject: 'C:\\P\\Game\\Game.uproject' };
+function statusWith(version) {
+    return {
+        updatedAt: 'now',
+        engines: [
+            {
+                id: 'UE_' + version,
+                dir: 'C:\\E',
+                version,
+                build: 'installed',
+                origin: 'pc',
+                writable: true,
+                sizeBytes: null,
+            },
+        ],
+        projects: [{ workspace: PROJECT.workspace, engine: 'C:\\E', reason: 'test' }],
+        launcher: { installed: false, installLocation: null, problem: null, freeBytes: null, needBytes: 1 },
+        visualStudio: { version: '17.14', path: 'C:/VS', how: 'kept', check: 'ok', ok: true },
+        debugger: null,
+        ddc: { mode: 'persisted', dir: null },
+        vaults: [],
+        mcpUrl: null,
+    };
+}
+export const mixamoSuite = {
+    name: 'mixamo',
+    title: 'Mixamo: browser downloads folder and the guide lines for bringing characters into Unreal',
+    run: async (t) => {
+        t.section('browser policies');
+        const four = browserPolicies({ downloads: DOWNLOADS });
+        t.equal(four.length, 4, 'two browsers, two policies each');
+        t.equal(four.filter((p) => p.name === 'DefaultDownloadDirectory').map((p) => p.data), [DOWNLOADS, DOWNLOADS], 'both browsers download to the data disk');
+        t.equal(browserPolicies({ downloads: null }).length, 2, 'no folder: only the GPU policy');
+        await t.throws(() => browserPolicies({ downloads: 'C:\\a"b' }), 'not a folder', 'a quote in the folder is refused');
+        await t.throws(() => browserPolicies({ downloads: 'downloads' }), 'not a folder', 'a relative folder is refused');
+        t.section('the guide');
+        const on = { mixamo: { downloads: DOWNLOADS, script: null } };
+        const guide = unrealGuideLines(statusWith('5.4.4'), [PROJECT], on).join('\n');
+        t.includes(guide, 'https://www.mixamo.com', 'the Mixamo line is there');
+        t.includes(guide, DOWNLOADS, 'it names the downloads folder');
+        t.includes(guide, 'Mixamo into Unreal', 'and the import line');
+        t.excludes(guide, 'Mixamo import script', 'no script line without a script');
+        const withScript = unrealGuideLines(statusWith('5.4.4'), [PROJECT], {
+            mixamo: { downloads: DOWNLOADS, script: 'C:\\x\\import_mixamo.py' },
+        }).join('\n');
+        t.includes(withScript, 'Mixamo import script', 'a script adds its line');
+        t.excludes(unrealGuideLines(statusWith('5.4.4'), [PROJECT]).join('\n'), 'Mixamo', 'off by default');
+        const noEngine = { ...statusWith('5.4.4'), engines: [] };
+        t.excludes(unrealGuideLines(noEngine, [PROJECT], on).join('\n'), 'Mixamo', 'no engine: no Mixamo lines');
+        t.section('UE4 names');
+        const ue4 = unrealGuideLines(statusWith('4.27.2'), [PROJECT]).join('\n');
+        t.includes(ue4, 'UE4Editor-Cmd.exe', 'a UE4 engine uses UE4Editor-Cmd.exe');
+        t.excludes(ue4, 'UnrealEditor', 'and not the UE5 names');
+        t.includes(unrealGuideLines(statusWith('5.4.4'), [PROJECT]).join('\n'), 'UnrealEditor-Cmd.exe', 'UE5 keeps its names');
+    },
+};

package/dist/selftest/persisted-installs.test.js

@@ -1,12 +1,13 @@
 // Large installs kept between sandboxes (guest/toolchains/persisted.ts): the staging folder and its TEMP, the marker,
 // the refusal when the disk is short (an injected statfs), keeping only keepVersions, the records `sandbox data`
-// reads, and which Visual Studio the toolchains ask for (vs-request.ts). Temp folders only.
+// reads, which Visual Studio the toolchains ask for (vs-request.ts), and how it is saved on the data disk and put
+// back (vs-persist.ts: folders, marker, instance state, registry). Temp folders only.
 import fs from 'node:fs';
 import path from 'node:path';
 import { DEFAULTS } from '../core/config/index.js';
 import { assertLocalRoom, ensurePersisted, installRecords, InstallRecordsSchema, LOCAL_RESERVE_BYTES, recordUse, } from '../guest/toolchains/persisted.js';
-import { BUILD_TOOLS_COMPONENTS, UNREAL_COMPONENTS, visualStudioWanted, } from '../guest/toolchains/native/vs-request.js';
-import { autosdkLayout, layoutNextStep, STAGING_RESERVE_BYTES, unrealUsesAutosdk, vsExitText, } from '../guest/toolchains/native/vs-request.js';
+import { BUILD_TOOLS_COMPONENTS, UNREAL_BUILD_TOOLS_COMPONENTS, UNREAL_COMPONENTS, visualStudioWanted, vsExitText, } from '../guest/toolchains/native/vs-request.js';
+import { markerFrom, newestInstance, persistCovers, rebase, registryPlan, restoreInput, rewriteInstanceState, SaveResultSchema, saveInput, SETUP_CLSID, VsPersistMarkerSchema, } from '../guest/toolchains/native/vs-persist.js';
 import { freeBytesAt } from '../shared/io/disk.js';
 import { SIGNERS, signerMatches } from '../shared/signer.js';
 import { decideToolchains } from '../core/detect/toolchains.js';
@@ -17,7 +18,7 @@ import { collectDataEntries } from '../cli/services/data-collect.js';
 const GB = 1024 ** 3;
 export const persistedInstallsSuite = {
     name: 'persisted-installs',
-    title: 'large persisted installs: staging, marker, room checks, pruning, records; the Visual Studio request',
+    title: 'large persisted installs: staging, marker, room checks, pruning, records; Visual Studio: request, save, restore',
     run: async (t) => {
         t.section('installing a version');
         const tools = t.dir('persisted-tools');
@@ -110,28 +111,172 @@ export const persistedInstallsSuite = {
             all.for.join() === 'unreal,flutter,unity' &&
             UNREAL_COMPONENTS.every((c) => all.components.includes(c)) &&
             all.components.includes('Microsoft.VisualStudio.Component.VC.Llvm.Clang'), 'with Unreal: one Community install serves all of them');
-        t.section('Unreal on the portable MSVC (autosdk)');
-        tc.unreal.visualStudio = 'autosdk';
-        const noUnreal = visualStudioWanted(tc);
-        t.check(noUnreal?.product === 'buildtools' && noUnreal.for.join() === 'flutter,unity', 'autosdk: Unreal asks for no Visual Studio (the others still get the Build Tools)');
-        tc.flutter.enabled = false;
-        tc.unity.enabled = false;
-        t.equal(visualStudioWanted(tc), null, 'autosdk alone: no Visual Studio at all');
-        t.check(unrealUsesAutosdk(tc, (s) => s === true) && !unrealUsesAutosdk(DEFAULTS.toolchains), 'autosdk is only when asked');
-        const pairs = autosdkLayout('T:\\msvc', '14.44.35207', '10.0.26100.0', 'T:\\autosdk');
-        t.check(pairs.length === 4 &&
-            pairs[0].to === 'T:\\autosdk\\HostWin64\\Win64\\VS2022\\14.44.35207' &&
-            pairs[0].from === 'T:\\msvc\\VC\\Tools\\MSVC\\14.44.35207' &&
-            pairs[1].from === 'T:\\msvc\\Windows Kits\\10\\Include\\10.0.26100.0' &&
-            pairs[1].to === 'T:\\autosdk\\HostWin64\\Win64\\Windows Kits\\10\\Include\\10.0.26100.0', 'the AutoSDK tree is MSVC under VS2022\\<version> and the SDK under Windows Kits\\10 (copies)');
+        t.section('Unreal on the Build Tools');
+        tc.unreal.visualStudio = 'buildtools';
+        const bt = visualStudioWanted(tc);
+        t.check(bt?.product === 'buildtools' &&
+            bt.for.join() === 'unreal,flutter,unity' &&
+            bt.licence === 'toolchains.unreal.acceptLicense' &&
+            UNREAL_BUILD_TOOLS_COMPONENTS.every((c) => bt.components.includes(c)) &&
+            BUILD_TOOLS_COMPONENTS.every((c) => bt.components.includes(c)) &&
+            bt.components.includes('Microsoft.VisualStudio.Component.VC.Llvm.Clang'), '"buildtools": the Build Tools with what UnrealBuildTool needs, shared with Flutter and Unity');
+        t.equal(DEFAULTS.toolchains.unreal.visualStudio, 'full', 'Community is the default (the IDE, its debugger and Unreal integration)');
         const on = DEFAULTS.toolchains;
-        const auto = {
-            ...structuredClone(on),
-            unreal: { ...on.unreal, visualStudio: 'autosdk', acceptLicense: true },
+        const decided = decideToolchains({ ...structuredClone(on), unreal: { ...on.unreal, acceptLicense: true } }, ['Game.uproject'], []);
+        t.check(decided.unreal.on && !decided.msvc.on, 'an Unreal project does not turn the portable MSVC on (Visual Studio brings MSVC)');
+        t.section('Visual Studio kept on the data disk');
+        const places = {
+            programFiles: 'C:\\Program Files',
+            programFilesX86: 'C:\\Program Files (x86)',
+            programData: 'C:\\ProgramData',
         };
-        const decided = decideToolchains(auto, ['Game.uproject'], []);
-        t.check(decided.unreal.on && decided.msvc.on, 'an Unreal project with autosdk turns the portable MSVC on, under its licence');
-        t.section('the Visual Studio layout');
+        const root = 'C:\\AgentData\\tools\\visualstudio\\persist';
+        const community = 'C:\\Program Files\\Microsoft Visual Studio\\2022\\Community';
+        const instances = 'C:\\ProgramData\\Microsoft\\VisualStudio\\Packages\\_Instances';
+        const vsAt = { product: 'community', installationPath: community, instanceId: 'a190d188' };
+        const save = saveInput(vsAt, root, places, 'T:\\result.json');
+        const saved = (name) => save.copies.find((c) => c.name === name);
+        t.check(saved('Community')?.from === community &&
+            saved('Community')?.to === root + '\\Community' &&
+            saved('WindowsKits10')?.from === 'C:\\Program Files (x86)\\Windows Kits\\10' &&
+            saved('instance')?.from === instances + '\\a190d188' &&
+            saved('instance')?.to === root + '\\instance' &&
+            saved('Setup')?.from === 'C:\\ProgramData\\Microsoft\\VisualStudio\\Setup' &&
+            saved('Installer')?.optional === false &&
+            saved('ReferenceAssemblies')?.optional === true &&
+            save.resultFile === 'T:\\result.json', 'the capture mirrors the install, the Windows SDK, the installer, the Setup API and the instance onto the data disk');
+        t.check(save.registry.length === 8 &&
+            save.registry.filter((r) => r.view === '32').length === 4 &&
+            save.registry.some((r) => r.key.endsWith('NETFXSDK') && r.recurse) &&
+            save.registry.some((r) => r.key.endsWith('Installed Roots') && r.names?.join() === 'KitsRoot10'), 'it reads the SDK registry values in both views (NETFXSDK with its subkeys, only KitsRoot10 of the kits roots)');
+        await t.throws(() => Promise.resolve(saveInput({ ...vsAt, instanceId: '..\\x' }, root, places, 'r')), 'not a Visual Studio instance ID', 'an instance ID is never a path');
+        const captured = [
+            {
+                view: '64',
+                key: 'SOFTWARE\\Microsoft\\Windows Kits\\Installed Roots',
+                name: 'KitsRoot10',
+                kind: 'string',
+                value: 'C:\\Program Files (x86)\\Windows Kits\\10\\',
+            },
+            {
+                view: '32',
+                key: 'SOFTWARE\\Microsoft\\Microsoft SDKs\\Windows\\v10.0',
+                name: 'ProductVersion',
+                kind: 'string',
+                value: '10.0.22621',
+            },
+            {
+                view: '32',
+                key: 'SOFTWARE\\Microsoft\\Microsoft SDKs\\NETFXSDK\\4.8',
+                name: 'KitsInstallationFolder',
+                kind: 'string',
+                value: 'C:\\Program Files (x86)\\Windows Kits\\NETFXSDK\\4.8\\',
+            },
+            {
+                view: '32',
+                key: 'SOFTWARE\\Microsoft\\Microsoft SDKs\\NETFXSDK\\4.8\\WinSDK-NetFx40Tools-x64',
+                name: 'InstallationFolder',
+                kind: 'string',
+                value: 'c:\\program files (x86)\\Microsoft SDKs\\Windows\\v10.0A\\bin\\NETFX 4.8 Tools\\x64\\',
+            },
+            {
+                view: '64',
+                key: 'SOFTWARE\\Microsoft\\VisualStudio\\Setup',
+                name: 'KeepDownloadedPayloads',
+                kind: 'dword',
+                value: 0,
+            },
+            {
+                view: '64',
+                key: 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run',
+                name: 'planted',
+                kind: 'string',
+                value: 'C:\\planted.exe',
+            },
+        ];
+        const result = SaveResultSchema.parse({
+            copied: [
+                'Community',
+                'WindowsKits10',
+                'NETFXSDK',
+                'MicrosoftSDKs-v10.0A',
+                'ReferenceAssemblies',
+                'Installer',
+            ].concat(['Setup', 'instance']),
+            registry: captured,
+        });
+        const marker = VsPersistMarkerSchema.parse(markerFrom({ product: 'community', components: [...UNREAL_COMPONENTS] }, { installationPath: community, instanceId: 'a190d188', version: '17.14.37827.9' }, result, '2026-11-04T00:00:00.000Z'));
+        t.check(marker.sdkVersion === '10.0.22621' && marker.instanceId === 'a190d188' && marker.folders.length === 8, 'the marker keeps the instance ID, what was saved and the Windows SDK version from the registry');
+        t.check(!VsPersistMarkerSchema.safeParse({ ...marker, instanceId: '..\\..\\Windows' }).success &&
+            !VsPersistMarkerSchema.safeParse({ ...marker, folders: ['..'] }).success, 'a marker with a path for its instance ID, or a folder it does not know, is refused');
+        const plan = registryPlan(marker, root, places);
+        const value = (view, key, name) => plan.find((e) => e.view === view && e.key.toLowerCase() === key.toLowerCase() && e.name === name)?.value;
+        const kits = root + '\\WindowsKits10\\';
+        const sdk = 'SOFTWARE\\Microsoft\\Microsoft SDKs\\Windows\\v10.0';
+        const netfx = 'SOFTWARE\\Microsoft\\Microsoft SDKs\\NETFXSDK\\4.8';
+        t.check(['64', '32'].every((v) => value(v, 'SOFTWARE\\Microsoft\\Windows Kits\\Installed Roots', 'KitsRoot10') === kits &&
+            value(v, sdk, 'InstallationFolder') === kits &&
+            value(v, sdk, 'ProductVersion') === '10.0.22621' &&
+            value(v, netfx, 'KitsInstallationFolder') === root + '\\NETFXSDK\\4.8\\' &&
+            value(v, netfx + '\\WinSDK-NetFx40Tools-x64', 'InstallationFolder') ===
+                root + '\\MicrosoftSDKs-v10.0A\\bin\\NETFX 4.8 Tools\\x64\\' &&
+            value(v, 'SOFTWARE\\Microsoft\\VisualStudio\\Setup', 'KeepDownloadedPayloads') === 0), 'both registry views point the Windows SDK and the .NET Framework SDK at the data disk (any case); the rest stays');
+        const clsid = 'SOFTWARE\\Classes\\CLSID\\' + SETUP_CLSID + '\\InprocServer32';
+        const setupDll = 'Microsoft.VisualStudio.Setup.Configuration.Native.dll';
+        t.check(value('64', clsid, '') === 'C:\\ProgramData\\Microsoft\\VisualStudio\\Setup\\x64\\' + setupDll &&
+            value('32', clsid, '') === 'C:\\ProgramData\\Microsoft\\VisualStudio\\Setup\\x86\\' + setupDll &&
+            value('64', clsid, 'ThreadingModel') === 'Both' &&
+            value('32', clsid, 'ThreadingModel') === 'Both', 'the Setup Configuration COM class is registered (x64 and x86), so vswhere and UnrealBuildTool find the instance');
+        t.check(!plan.some((e) => /CurrentVersion\\Run/i.test(e.key)), 'a value the capture never reads is never written back (a tampered marker)');
+        const back = restoreInput(marker, root, places);
+        const copied = (name) => back.copies.find((c) => c.name === name);
+        t.check(!copied('Community') &&
+            !copied('WindowsKits10') &&
+            !copied('NETFXSDK') &&
+            !copied('Shared') &&
+            copied('Installer')?.to === 'C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer' &&
+            copied('Installer')?.mode === 'all' &&
+            copied('ReferenceAssemblies')?.mode === 'missing' &&
+            copied('instance')?.from === root + '\\instance' &&
+            copied('instance')?.to === instances + '\\a190d188' &&
+            back.registry.length === plan.length, 'a boot copies back only the small fixed-path folders that were saved (the instance under its ID); the big ones stay');
+        t.check(persistCovers(marker, { product: 'community', components: [...UNREAL_COMPONENTS] }) &&
+            persistCovers(marker, { product: 'community', components: ['component.unreal'] }) &&
+            !persistCovers(marker, {
+                product: 'community',
+                components: [...UNREAL_COMPONENTS, 'Microsoft.VisualStudio.Component.VC.Llvm.Clang'],
+            }) &&
+            persistCovers(marker, { product: 'buildtools', components: [...BUILD_TOOLS_COMPONENTS] }) &&
+            !persistCovers({ ...marker, product: 'buildtools' }, { product: 'community', components: [] }) &&
+            !persistCovers({ ...marker, folders: marker.folders.filter((f) => f !== 'Setup') }, {
+                product: 'community',
+                components: [],
+            }), 'a saved copy serves requests with no more components (Community serves the Build Tools too); one without the Setup API none');
+        const state = JSON.stringify({
+            installationPath: community,
+            resolvedInstallationPath: community.toLowerCase(),
+            nested: community + '\\Common7\\IDE',
+            longer: community + '2',
+            launchParams: { fileName: 'Common7\\IDE\\devenv.exe' },
+            enginePath: 'C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\resources\\app',
+        });
+        const moved = JSON.parse(rewriteInstanceState(state, community, root + '\\Community'));
+        t.check(moved.installationPath === root + '\\Community' &&
+            moved.resolvedInstallationPath === root + '\\Community' &&
+            moved.nested === root + '\\Community\\Common7\\IDE' &&
+            moved.longer === community + '2' &&
+            moved.enginePath === 'C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\resources\\app', "the instance's state names the saved folder (JSON-escaped, any case); a longer name that only starts the same stays");
+        const buildTools = 'C:\\Program Files (x86)\\Microsoft Visual Studio\\2022\\BuildTools';
+        const movedBt = JSON.parse(rewriteInstanceState(JSON.stringify({ installationPath: buildTools }), buildTools + '\\', root + '\\BuildTools'));
+        t.check(movedBt.installationPath === root + '\\BuildTools' &&
+            rebase('D:\\Other\\x', [{ from: 'C:\\Program Files', to: 'D:\\y' }]) === 'D:\\Other\\x', 'the Build Tools too (a trailing backslash does not matter); a value outside the saved folders is kept');
+        t.equal(newestInstance([
+            { installationVersion: '17.9.1', id: 'a' },
+            { installationVersion: '17.14.37827.9', id: 'b' },
+            { installationVersion: '17.14.3', id: 'c' },
+        ])?.id, 'b', 'the newest instance is chosen by version (vswhere -latest fails on two instances installed at the same time)');
+        t.equal(newestInstance([]), null, 'no instance: none');
+        t.section('the Visual Studio installer');
         t.check(vsExitText(3762504530).includes('crashed') &&
             vsExitText(-1).includes('exit 4294967295') &&
             vsExitText(0) === 'installed' &&
@@ -139,15 +284,6 @@ export const persistedInstallsSuite = {
             vsExitText(8006).includes('running') &&
             vsExitText(3010).includes('restart') &&
             vsExitText(5007).includes('refused'), 'installer exit codes are told in words (0xE0434352 is a crash)');
-        const reserve = LOCAL_RESERVE_BYTES;
-        const room = (free) => freeBytesAt(t.dir('layout-room'), () => ({ bavail: free, bsize: 1 })) ?? 0;
-        t.check(layoutNextStep(0, 0, reserve) === 'done' &&
-            layoutNextStep(3762504530, room(40 * GB), reserve) === 'stage' &&
-            layoutNextStep(3762504530, room(20 * GB), reserve) === 'skip' &&
-            layoutNextStep(null, room(40 * GB), reserve) === 'stage', 'a failed layout is built on the sandbox disk only with room for it (8 GB plus the reserve)');
-        t.check(layoutNextStep(null, room(14 * GB), STAGING_RESERVE_BYTES) === 'stage' &&
-            layoutNextStep(null, room(9.5 * GB), STAGING_RESERVE_BYTES) === 'stage' &&
-            layoutNextStep(null, room(9 * GB), STAGING_RESERVE_BYTES) === 'skip', 'before Visual Studio is installed, the ~14 GB free at boot is enough to build the install files (9.5 GB needed)');
         t.equal(freeBytesAt(path.join(t.dir('layout-room'), 'not', 'there'), () => ({ bavail: 3, bsize: 2 })), 6, 'free room of a folder that does not exist asks its parent');
         t.equal(freeBytesAt(t.dir('layout-room'), () => {
             throw new Error('no');

package/dist/selftest/secrets.test.js

@@ -1,7 +1,9 @@
 // What reaches the sandbox from this PC's Claude files, and what is stripped first: API keys, cloud credentials, tokens
 // in MCP server definitions. Also the secret-looking files in a workspace that the launch warns about.
 import path from 'node:path';
-import { findSecretFiles, sandboxGlobalState, stripMcpServers, stripSettings } from '../host/profile/index.js';
+import fs from 'node:fs';
+import { DEFAULTS } from '../core/config/index.js';
+import { findSecretFiles, pluginFilter, pluginTrimLevel, sandboxGlobalState, stageClaudeProfile, stripMcpServers, stripSettings, } from '../host/profile/index.js';
 const REMOVED = '[removed by agent-sandbox]';
 export const secretsSuite = {
     name: 'secrets',
@@ -111,5 +113,38 @@ export const secretsSuite = {
         ])
             t.write(path.join(workspace, file), 'x');
         t.equal(findSecretFiles(workspace).sort(), ['.env', 'api\\credentials.json', 'server.pem'], 'secret-looking workspace files are found for the launch warning (templates and dependencies ignored)');
+        t.section('plugins staged from this PC');
+        const hostClaude = t.at('plugins-host');
+        const plugins = path.join(hostClaude, 'plugins');
+        t.write(path.join(plugins, 'installed_plugins.json'), '{"version":2,"plugins":{}}');
+        t.write(path.join(plugins, 'known_marketplaces.json'), '{}');
+        t.write(path.join(plugins, 'cache', 'm', 'p', '1.0', 'plugin.json'), '{}');
+        t.write(path.join(plugins, 'cache', 'm', 'p', '1.0', 'node_modules', 'dep', 'index.js'), 'x');
+        t.write(path.join(plugins, 'cache', 'temp_git_1_abc', 'junk.txt'), 'x');
+        t.write(path.join(plugins, 'marketplaces', 'm', 'marketplace.json'), '{}');
+        t.write(path.join(plugins, 'marketplaces', 'm', '.git', 'HEAD'), 'ref');
+        t.write(path.join(plugins, 'marketplaces', 'm.backup', 'old.txt'), 'x');
+        t.write(path.join(plugins, 'marketplaces', 'temp_subdir_2.clone', 'junk.txt'), 'x');
+        t.write(path.join(hostClaude, 'settings.json'), '{"enabledPlugins":{"p@m":true}}');
+        const launch = t.at('plugins-launch');
+        const profile = { ...DEFAULTS.claudeProfile, hostDir: hostClaude, globalStateFile: '' };
+        const staged = stageClaudeProfile(profile, launch, 'D:/Code/app', DEFAULTS.secrets);
+        const out = path.join(launch, 'claude-profile', 'plugins');
+        t.check(staged.staged.includes('plugins'), 'plugins are staged');
+        t.check(fs.existsSync(path.join(out, 'cache', 'm', 'p', '1.0', 'plugin.json')) &&
+            fs.existsSync(path.join(out, 'marketplaces', 'm', 'marketplace.json')) &&
+            fs.existsSync(path.join(out, 'marketplaces', 'm', '.git', 'HEAD')) &&
+            fs.existsSync(path.join(out, 'cache', 'm', 'p', '1.0', 'node_modules', 'dep', 'index.js')), 'the plugin cache, marketplaces and (when they fit) their git folders and dependencies are copied');
+        t.check(!fs.existsSync(path.join(out, 'cache', 'temp_git_1_abc')) &&
+            !fs.existsSync(path.join(out, 'marketplaces', 'm.backup')) &&
+            !fs.existsSync(path.join(out, 'marketplaces', 'temp_subdir_2.clone')), 'interrupted clones, backups and staging folders of plugins are left out');
+        t.check(pluginTrimLevel(plugins) === 0, 'a plugins folder under the cap is not trimmed');
+        const git = path.join(plugins, 'marketplaces', 'm', '.git');
+        const deps = path.join(plugins, 'cache', 'm', 'p', '1.0', 'node_modules');
+        t.check(pluginFilter(plugins, 0)(git) &&
+            !pluginFilter(plugins, 1)(git) &&
+            pluginFilter(plugins, 1)(deps) &&
+            !pluginFilter(plugins, 2)(deps), 'a plugins folder over the cap loses git history first, then node_modules');
+        t.check(fs.readFileSync(path.join(launch, 'claude-profile', 'settings.json'), 'utf8').includes('p@m'), 'enabledPlugins reach the sandbox');
     },
 };

package/dist/selftest/support/engine-golden.js

@@ -69,6 +69,7 @@ export const LAUNCH_FILES_GOLDEN = [
     'sandbox/csharp/SandboxTools/MemoryLog.cs',
     'sandbox/csharp/SandboxTools/PageFile.cs',
     'sandbox/csharp/SandboxTools/Program.cs',
+    'sandbox/csharp/VsSetup.cs',
     'sandbox/csharp/VsWhere.cs',
     'sandbox/csharp/VtInput.cs',
     'sandbox/scripts/add-firewall-port.ps1',
@@ -76,13 +77,17 @@ export const LAUNCH_FILES_GOLDEN = [
     'sandbox/scripts/expand-archive.ps1',
     'sandbox/scripts/get-gpu-names.ps1',
     'sandbox/scripts/get-signature.ps1',
+    'sandbox/scripts/get-vs-setup.ps1',
     'sandbox/scripts/install-shell-path.ps1',
     'sandbox/scripts/link-profile-dirs.ps1',
     'sandbox/scripts/new-shortcuts.ps1',
     'sandbox/scripts/repair-wmi-services.ps1',
+    'sandbox/scripts/restore-visual-studio.ps1',
+    'sandbox/scripts/save-visual-studio.ps1',
     'sandbox/scripts/set-desktop.ps1',
     'sandbox/scripts/set-dns-servers.ps1',
     'sandbox/scripts/set-machine-environment.ps1',
+    'sandbox/scripts/set-registry-values.ps1',
     'sandbox/templates/fivem/README.txt',
     'sandbox/templates/fivem/cs/Client/Client.csproj',
     'sandbox/templates/fivem/cs/Client/ClientMain.cs',

package/dist/selftest/support/fixtures.d.ts

@@ -142,7 +142,9 @@ export declare function createFixtures(t: Harness): {
         pcInstalls: {
             steamGames: boolean | number[];
             epicGames: boolean | string[];
-            unrealEngines: boolean | string[];
+            unrealEngines: boolean | string[] | "auto";
+            unrealEngineFolders: string[];
+            unrealAssets: boolean | "auto";
             unityEditors: boolean | string[];
         };
         provisioning: {
@@ -199,8 +201,7 @@ export declare function createFixtures(t: Harness): {
                 enabled: boolean | "auto";
                 acceptLicense: boolean;
                 components: string[];
-                keepInstallFiles: boolean;
-                visualStudio: "full" | "autosdk";
+                visualStudio: "full" | "buildtools";
                 persistEngines: boolean;
                 derivedDataCache: "persisted" | "local";
             };

package/dist/selftest/support/unreal-sample.d.ts

@@ -0,0 +1,2 @@
+import type { UnrealOverview } from '../../app/features/unreal/index.js';
+export declare const UNREAL_SAMPLE: UnrealOverview;