windows-development-sandbox 1.23.2 → 1.25.1

package/dist/guest/boot/runner.d.ts

@@ -27,9 +27,22 @@ export interface RunnerStatus {
     readonly running: readonly string[];
     readonly message: string;
 }
+/** What the console's progress view hears (foreground tasks only: the background ones are file-only). */
+export interface RunnerObserver {
+    started(task: BootTaskDef): void;
+    /** Also for a task that was skipped (it never started). */
+    finished(task: BootTaskDef, outcome: TaskOutcome): void;
+}
+/** Who logs while a task runs. */
+export interface TaskContext {
+    readonly stage: number;
+    readonly title: string;
+    readonly quiet: boolean;
+}
 export interface RunnerOptions {
+    /** A line for the log file only: when each task started and finished (the console shows the progress view). */
+    trace(line: string): void;
     /** `quiet`: file only (background tasks). */
-    say(line: string, quiet?: boolean): void;
     warn(line: string, quiet?: boolean): void;
     /** Milliseconds. */
     now(): number;
@@ -39,13 +52,12 @@ export interface RunnerOptions {
     stages: number;
     stageTitle(stage: number): string;
     status?(status: RunnerStatus): void;
-    /** Runs a task's work so that its log lines carry the task (`prefix()` is empty while it runs alone). */
-    inContext?<T>(ctx: {
-        prefix: () => string;
-        quiet: boolean;
-    }, work: () => T): T;
+    observer?: RunnerObserver;
+    /** Runs a task's work so that its log lines carry the task (its stage and title, and whether they stay quiet). */
+    inContext?<T>(ctx: TaskContext, work: () => T): T;
 }
-export declare const seconds: (ms: number) => string;
+/** "4.6s" under a minute, "7m02s" from there. */
+export declare function duration(ms: number): string;
 /** Dependencies must exist, ids be unique, the graph acyclic and no foreground task wait for a background one. */
 export declare function checkGraph(defs: readonly BootTaskDef[]): void;
 export declare class BootRunner<Id extends string> {
@@ -55,7 +67,6 @@ export declare class BootRunner<Id extends string> {
     private readonly byId;
     private readonly state;
     private readonly outcomes;
-    private readonly announced;
     private readonly running;
     constructor(defs: readonly BootTaskDef<Id>[], impl: Readonly<Record<Id, TaskRun>>, o: RunnerOptions);
     /** Every outcome so far, in declaration order. */
@@ -68,10 +79,9 @@ export declare class BootRunner<Id extends string> {
     private isFinished;
     /** The task cannot have run properly: skipped, or failed with a critical failure. */
     private isBlocked;
+    private tag;
     private skip;
     private begin;
     private finish;
     private report;
 }
-/** "Boot ready in 31.8s. Slowest: Headroom 28.1s, Developer tools 7.0s. In the background: Visual Studio (...)". */
-export declare function bootSummary(totalMs: number, outcomes: readonly TaskOutcome[], background: readonly string[], logPath: string): string;

package/dist/guest/boot/runner.js

@@ -1,9 +1,15 @@
 // Runs the boot's tasks: each starts when the tasks it comes after are finished, a few at a time, in declaration order.
-// Pure (no runtime imports): the boot injects printing, the clock, the log context and the status.
+// Pure (no runtime imports): the boot injects the log, the clock, the log context, the status and the progress view.
 const PARALLEL = 4;
-const CYAN = '\x1b[36m';
-const RESET = '\x1b[0m';
-export const seconds = (ms) => (ms / 1000).toFixed(1) + 's';
+const MINUTE = 60000;
+/** "4.6s" under a minute, "7m02s" from there. */
+export function duration(ms) {
+    // 59.96 s would round to "60.0s": from there it is "1m00s".
+    if (ms < MINUTE - 50)
+        return (Math.max(0, ms) / 1000).toFixed(1) + 's';
+    const s = Math.round(ms / 1000);
+    return Math.floor(s / 60) + 'm' + String(s % 60).padStart(2, '0') + 's';
+}
 /** Dependencies must exist, ids be unique, the graph acyclic and no foreground task wait for a background one. */
 export function checkGraph(defs) {
     const byId = new Map();
@@ -44,7 +50,6 @@ export class BootRunner {
     byId = new Map();
     state = new Map();
     outcomes = new Map();
-    announced = new Set();
     running = new Set();
     constructor(defs, impl, o) {
         this.defs = defs;
@@ -84,13 +89,12 @@ export class BootRunner {
                 this.state.set(d.id, 'running');
                 this.running.add(d.id);
                 const began = this.o.now();
-                if (!quiet)
-                    this.begin(d);
-                const prefix = () => (this.running.size > 1 && !d.exclusive ? d.title : '');
+                this.begin(d, quiet);
+                const ctx = { stage: d.stage, title: d.title, quiet };
                 const work = async () => {
                     await this.impl[d.id]();
                 };
-                const call = () => (this.o.inContext ? this.o.inContext({ prefix, quiet }, work) : work());
+                const call = () => (this.o.inContext ? this.o.inContext(ctx, work) : work());
                 // A synchronous throw from a task is a failure too: the call starts inside a promise.
                 void Promise.resolve()
                     .then(call)
@@ -115,7 +119,7 @@ export class BootRunner {
                     for (const d of pending()) {
                         const bad = d.after.find((a) => this.isBlocked(a));
                         if (bad) {
-                            this.skip(d, this.byId.get(bad).title + ' failed');
+                            this.skip(d, this.byId.get(bad).title + ' failed', quiet);
                             again = true;
                         }
                     }
@@ -147,43 +151,44 @@ export class BootRunner {
         const s = this.state.get(id);
         return s === 'skipped' || (s === 'failed' && this.byId.get(id).critical);
     }
-    skip(d, why) {
+    tag(d) {
+        return (d.background ? '[background] ' : '[' + d.stage + '/' + this.o.stages + '] ') + d.title;
+    }
+    skip(d, why, quiet) {
         this.state.set(d.id, 'skipped');
-        this.outcomes.set(d.id, { id: d.id, title: d.title, state: 'skipped', ms: 0, error: why });
-        this.o.say('[' + d.stage + '/' + this.o.stages + '] ' + d.title + ': skipped (' + why + ')');
+        const outcome = { id: d.id, title: d.title, state: 'skipped', ms: 0, error: why };
+        this.outcomes.set(d.id, outcome);
+        this.o.trace(this.tag(d) + ': skipped (' + why + ')');
+        if (!quiet)
+            this.o.observer?.finished(d, outcome);
     }
-    begin(d) {
-        if (!this.announced.has(d.stage)) {
-            this.announced.add(d.stage);
-            this.o.say('\n' + CYAN + '[' + d.stage + '/' + this.o.stages + '] ' + this.o.stageTitle(d.stage) + RESET);
-        }
-        this.o.say('[' + d.stage + '/' + this.o.stages + '] ' + d.title + ': started');
+    begin(d, quiet) {
+        this.o.trace(this.tag(d) + ': started');
+        if (quiet)
+            return;
+        this.o.observer?.started(d);
         this.report(d.stage);
     }
     finish(d, began, quiet, error) {
         const ms = this.o.now() - began;
         const message = error === undefined ? undefined : error instanceof Error ? error.message : String(error);
-        this.state.set(d.id, message === undefined ? 'done' : 'failed');
-        this.outcomes.set(d.id, {
+        const outcome = {
             id: d.id,
             title: d.title,
             state: message === undefined ? 'done' : 'failed',
             ms,
             ...(message === undefined ? {} : { error: message }),
-        });
-        const tag = '[' + d.stage + '/' + this.o.stages + '] ' + d.title;
-        if (message === undefined) {
-            if (!quiet)
-                this.o.say(tag + ': done in ' + seconds(ms));
-        }
-        else if (d.critical) {
-            this.o.warn(tag + ': FAILED in ' + seconds(ms) + ': ' + message, quiet);
-        }
-        else {
+        };
+        this.state.set(d.id, outcome.state);
+        this.outcomes.set(d.id, outcome);
+        this.o.trace(this.tag(d) + (message === undefined ? ': done in ' : ': FAILED in ') + duration(ms));
+        // A soft failure is a warning and the boot goes on; a critical one stops the boot, which shows that error.
+        if (message !== undefined && !d.critical)
             this.o.warn(d.title + ' failed (continuing): ' + message, quiet);
-            if (!quiet)
-                this.o.say(tag + ': FAILED in ' + seconds(ms) + ': ' + message);
-        }
+        if (message !== undefined && d.critical)
+            this.o.trace(this.tag(d) + ': ' + message);
+        if (!quiet)
+            this.o.observer?.finished(d, outcome);
     }
     report(stageHint) {
         if (!this.o.status)
@@ -200,16 +205,3 @@ export class BootRunner {
         });
     }
 }
-/** "Boot ready in 31.8s. Slowest: Headroom 28.1s, Developer tools 7.0s. In the background: Visual Studio (...)". */
-export function bootSummary(totalMs, outcomes, background, logPath) {
-    const slowest = [...outcomes]
-        .filter((o) => o.state !== 'skipped')
-        .sort((a, b) => b.ms - a.ms)
-        .slice(0, 3)
-        .map((o) => o.title + ' ' + seconds(o.ms));
-    return ('Boot ready in ' +
-        seconds(totalMs) +
-        '.' +
-        (slowest.length ? ' Slowest: ' + slowest.join(', ') + '.' : '') +
-        (background.length ? ' In the background: ' + background.join(', ') + ' (installing, see ' + logPath + ').' : ''));
-}

package/dist/guest/daemon/daemon.js

@@ -12,6 +12,7 @@ import { liveFolders } from './live.js';
 import { warn } from '../runtime/log.js';
 import { errMsg } from '../../core/util/errors.js';
 import { flushAccounts } from './accounts.js';
+import { captureLauncherEngines } from '../toolchains/engines/unreal-engines.js';
 const POLL_MS = 400;
 const MEM_SAVE_MS = 120000;
 export class Daemon {
@@ -47,6 +48,8 @@ export class Daemon {
             safely('claude-mem save', saveClaudeMem);
             safely('agent databases save', saveLocalState);
             void flushAccounts();
+            // Engines the Epic Games Launcher installed on the data disk since: kept for the next sandbox.
+            void captureLauncherEngines().catch((e) => warn('Unreal launcher save: ' + errMsg(e)));
         }
     }
     handle(req) {

package/dist/guest/runtime/log-line.d.ts

@@ -0,0 +1,7 @@
+/** Text without its terminal colour and cursor sequences. */
+export declare function plainText(text: string): string;
+/**
+ * The file lines for one message: each line of it with an ISO timestamp (UTC, zero-padded:
+ * `2026-11-04T12:07:27.930Z`) and the task that logged it, if any; blank lines are dropped.
+ */
+export declare function fileLines(message: string, at?: Date, task?: string): string[];

package/dist/guest/runtime/log-line.js

@@ -0,0 +1,18 @@
+// The lines of the guest's log files: plain text (no colours), one timestamped line per line of the message. Pure.
+/** Colour and cursor sequences (CSI ... letter), bounded so a hostile line costs linear time. */
+const ESCAPES = /\x1b\[[0-9;?]{0,32}[A-Za-z]/g;
+/** Text without its terminal colour and cursor sequences. */
+export function plainText(text) {
+    return text.replace(ESCAPES, '');
+}
+/**
+ * The file lines for one message: each line of it with an ISO timestamp (UTC, zero-padded:
+ * `2026-11-04T12:07:27.930Z`) and the task that logged it, if any; blank lines are dropped.
+ */
+export function fileLines(message, at = new Date(), task) {
+    const stamp = at.toISOString() + ' ' + (task ? '[' + task + '] ' : '');
+    return plainText(message)
+        .split(/\r?\n/)
+        .filter((line) => line.trim() !== '')
+        .map((line) => stamp + line.trimEnd());
+}

package/dist/guest/runtime/log.d.ts

@@ -1,15 +1,28 @@
-/** Who is logging: the task title (a prefix while several tasks run) and whether the console stays silent. */
+/** Who is logging: the boot task (its stage and title) and whether the console stays silent. */
 export interface LogContext {
-    readonly prefix?: () => string;
+    readonly stage?: number;
+    readonly task?: string;
     /** File only: nothing may print once the first session owns the console. */
     readonly quiet?: boolean;
 }
+/** Takes the console's lines while the boot draws its progress (boot/boot-console.ts). */
+export interface ConsoleSink {
+    /** An info line; `stage` is the stage of the task that logged it. */
+    line(message: string, stage: number | undefined): void;
+    warning(message: string): void;
+    /** A line the user should read once the boot is ready (shown with the summary). */
+    notice(message: string): void;
+}
 /** Runs `work` so that everything it logs (also after awaits) carries `ctx`. */
 export declare function withLogContext<T>(ctx: LogContext, work: () => T): T;
 /** Runs `work` logging to the file only. */
 export declare function runQuiet<T>(work: () => T): T;
-/** One line of the file: an ISO timestamp first (the console shows no times). */
-export declare function fileLine(message: string, at?: Date): string;
+/** Sends the console's lines to `next` (null: straight to the console again). */
+export declare function routeConsole(next: ConsoleSink | null): void;
 export declare function log(message: string): void;
 export declare function warn(message: string): void;
+/** A line for the user once the boot is ready (printed at once outside the boot). */
+export declare function notice(message: string): void;
+/** A line for the log file only. */
+export declare function record(message: string): void;
 export declare const logPath: string;

package/dist/guest/runtime/log.js

@@ -1,10 +1,14 @@
+// The guest's log: every line goes to the log file (timestamped, plain) and, unless it is quiet, to the console, or
+// to the boot's progress view while that owns the console.
 import fs from 'node:fs';
 import path from 'node:path';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { logsDir } from './paths.js';
+import { fileLines } from './log-line.js';
 fs.mkdirSync(logsDir, { recursive: true });
 const logFile = path.join(logsDir, (process.env.AGENT_LOG_PREFIX ?? 'guest') + '-' + new Date().toISOString().replace(/[:.]/g, '-') + '.log');
 const context = new AsyncLocalStorage();
+let sink = null;
 /** Runs `work` so that everything it logs (also after awaits) carries `ctx`. */
 export function withLogContext(ctx, work) {
     return context.run(ctx, work);
@@ -13,34 +17,53 @@ export function withLogContext(ctx, work) {
 export function runQuiet(work) {
     return context.run({ ...context.getStore(), quiet: true }, work);
 }
-/** One line of the file: an ISO timestamp first (the console shows no times). */
-export function fileLine(message, at = new Date()) {
-    return at.toISOString() + ' ' + message;
+/** Sends the console's lines to `next` (null: straight to the console again). */
+export function routeConsole(next) {
+    sink = next;
 }
-const append = (line) => {
+const append = (message, ctx) => {
     try {
-        fs.appendFileSync(logFile, fileLine(line) + '\n');
+        const lines = fileLines(message, new Date(), ctx?.task);
+        if (lines.length)
+            fs.appendFileSync(logFile, lines.join('\n') + '\n');
     }
     catch {
         /* logging must never break the run */
     }
 };
-const tagged = (message, ctx) => {
-    const prefix = ctx?.prefix?.();
-    return prefix ? prefix + ' | ' + message : message;
-};
 export function log(message) {
     const ctx = context.getStore();
-    const line = tagged(message, ctx);
-    if (!ctx?.quiet)
-        console.log(line);
-    append(line);
+    append(message, ctx);
+    if (ctx?.quiet)
+        return;
+    if (sink)
+        sink.line(message, ctx?.stage);
+    else
+        console.log(message);
 }
 export function warn(message) {
     const ctx = context.getStore();
-    const line = tagged(message, ctx);
-    if (!ctx?.quiet)
-        console.warn('\x1b[33mWARNING: ' + line + '\x1b[0m');
-    append('WARNING: ' + line);
+    append('WARNING: ' + message, ctx);
+    if (ctx?.quiet)
+        return;
+    if (sink)
+        sink.warning(message);
+    else
+        console.warn('\x1b[33mWARNING: ' + message + '\x1b[0m');
+}
+/** A line for the user once the boot is ready (printed at once outside the boot). */
+export function notice(message) {
+    const ctx = context.getStore();
+    append(message, ctx);
+    if (ctx?.quiet)
+        return;
+    if (sink)
+        sink.notice(message);
+    else
+        console.log(message);
+}
+/** A line for the log file only. */
+export function record(message) {
+    append(message, context.getStore());
 }
 export const logPath = logFile;

package/dist/guest/runtime/process.d.ts

@@ -1,4 +1,13 @@
 import { type SpawnOptions, type SpawnSyncOptions } from 'node:child_process';
+/** Takes the output of the programs started while the boot draws its progress (boot/boot-console.ts). */
+export interface OutputSink {
+    /** Whether programs started now hand their output over instead of writing to the console. */
+    capturing(): boolean;
+    /** One line of a program's output (to the log). */
+    line(text: string): void;
+}
+/** Hands the output of programs started from now on to `sink` while it is capturing (null: the console again). */
+export declare function routeOutput(sink: OutputSink | null): void;
 /** Runs a program, streaming output, and throws with a readable message when it fails. */
 export declare function exec(file: string, args: string[], options?: SpawnSyncOptions): void;
 /** exec without blocking: other toolchains keep downloading while this one runs an installer. */

package/dist/guest/runtime/process.js

@@ -8,9 +8,48 @@ import { robocopyErrors, robocopyFailed, robocopyMeaning } from '../../shared/io
 import { SYSTEM } from '../../shared/system.js';
 import { scriptArgs } from '../../shared/scripts.js';
 import { isWin } from './paths.js';
+// Set by the boot only: this module stays free of the log (pure helpers such as tool-env import it).
+let outputSink = null;
+/** Hands the output of programs started from now on to `sink` while it is capturing (null: the console again). */
+export function routeOutput(sink) {
+    outputSink = sink;
+}
+const captureOutput = () => outputSink?.capturing() ?? false;
+/** A program's captured output, line by line (its blank lines dropped). */
+function logOutput(text) {
+    for (const line of text.split(/\r?\n/))
+        if (line.trim())
+            outputSink?.line(line.trimEnd());
+}
+/** What a program may print while the boot holds its output for the log (a larger output stops it). */
+const CAPTURE_BYTES = 64 * 1024 * 1024;
+/** A captured line longer than this is cut (an installer's progress bar without line ends). */
+const LINE_CHARS = 2000;
+/** Feeds a stream to the log line by line as it arrives. */
+function logLines(stream) {
+    if (!stream)
+        return;
+    let partial = '';
+    stream.setEncoding('utf8');
+    stream.on('data', (chunk) => {
+        const lines = (partial + chunk).split(/\r?\n/);
+        partial = lines.pop().slice(0, LINE_CHARS);
+        logOutput(lines.map((l) => l.slice(0, LINE_CHARS)).join('\n'));
+    });
+    stream.on('end', () => logOutput(partial));
+}
 /** Runs a program, streaming output, and throws with a readable message when it fails. */
 export function exec(file, args, options = {}) {
-    const result = spawnSync(file, args, { stdio: 'inherit', windowsHide: true, ...options });
+    // While the boot draws its progress, the program's output goes to the log (it would break the drawing).
+    const capture = captureOutput();
+    const result = spawnSync(file, args, {
+        stdio: capture ? ['inherit', 'pipe', 'pipe'] : 'inherit',
+        windowsHide: true,
+        ...(capture ? { maxBuffer: CAPTURE_BYTES } : {}),
+        ...options,
+    });
+    if (capture)
+        logOutput(String(result.stdout ?? '') + '\n' + String(result.stderr ?? ''));
     if (result.error)
         throw result.error;
     if (result.status !== 0)
@@ -18,36 +57,59 @@ export function exec(file, args, options = {}) {
 }
 /** exec without blocking: other toolchains keep downloading while this one runs an installer. */
 export async function execAsync(file, args, options = {}) {
-    const code = await spawnAsync(file, args, { stdio: 'inherit', ...options });
+    const code = captureOutput()
+        ? await new Promise((resolve, reject) => {
+            const child = spawn(file, args, { stdio: ['inherit', 'pipe', 'pipe'], windowsHide: true, ...options });
+            logLines(child.stdout);
+            logLines(child.stderr);
+            child.once('error', reject);
+            child.once('close', (c) => resolve(c ?? -1));
+        })
+        : await spawnAsync(file, args, { stdio: 'inherit', ...options });
     if (code !== 0)
         throw new Error(path.basename(file) + ' ' + args.slice(0, 3).join(' ') + ' failed with exit code ' + code);
 }
+/** A script's error output: to the log while the boot holds the console, else to the console's error stream. */
+function scriptErrors(errors) {
+    if (!errors)
+        return;
+    if (captureOutput())
+        logOutput(errors);
+    else
+        process.stderr.write(errors + '\n');
+}
 export function execOutput(file, args, options = {}) {
     const result = spawnSync(file, args, { encoding: 'utf8', windowsHide: true, ...options });
     return result.status === 0 ? String(result.stdout ?? '').trim() : '';
 }
 /** Runs sandbox\scripts\<name> (a .ps1 in the launch folder) with `args`; throws when it fails. */
 export function runScript(name, args = []) {
+    const capture = captureOutput();
     const result = spawnSync(SYSTEM.powershell(), scriptArgs(name, args), {
-        stdio: ['inherit', 'inherit', 'pipe'],
+        stdio: ['inherit', capture ? 'pipe' : 'inherit', 'pipe'],
         encoding: 'utf8',
         windowsHide: true,
+        ...(capture ? { maxBuffer: CAPTURE_BYTES } : {}),
     });
+    if (capture)
+        logOutput(String(result.stdout ?? ''));
     if (result.error)
         throw result.error;
     const errors = String(result.stderr ?? '').trim();
-    if (errors)
-        process.stderr.write(errors + '\n');
+    scriptErrors(errors);
     if (result.status !== 0)
         throw new Error(name + ' failed with exit code ' + result.status + (errors ? ': ' + errors.slice(0, 400) : ''));
 }
 /** runScript without blocking the event loop (other boot tasks keep going while the script runs). */
 export function runScriptAsync(name, args = []) {
     return new Promise((resolve, reject) => {
+        const capture = captureOutput();
         const child = spawn(SYSTEM.powershell(), scriptArgs(name, args), {
-            stdio: ['inherit', 'inherit', 'pipe'],
+            stdio: ['inherit', capture ? 'pipe' : 'inherit', 'pipe'],
             windowsHide: true,
         });
+        if (capture)
+            logLines(child.stdout);
         let errors = '';
         child.stderr?.setEncoding('utf8');
         child.stderr?.on('data', (chunk) => {
@@ -57,8 +119,7 @@ export function runScriptAsync(name, args = []) {
         child.once('error', reject);
         child.once('close', (code) => {
             errors = errors.trim();
-            if (errors)
-                process.stderr.write(errors + '\n');
+            scriptErrors(errors);
             if (code !== 0)
                 reject(new Error(name + ' failed with exit code ' + code + (errors ? ': ' + errors.slice(0, 400) : '')));
             else

package/dist/guest/setup/addon-mcp.d.ts

@@ -1,2 +1,9 @@
+/** The Unreal editor's MCP server (Unreal 5.8's ModelContextProtocol plugin), set by the Unreal engines step. */
+export declare const UNREAL_MCP_NAME = "sbx-unreal-editor";
+/**
+ * Adds the Unreal editor's MCP server (its address) to the next writeAddonMcpServers, or takes it away (null). It only
+ * answers while the editor runs with the plugin on; until then Claude Code lists it as not connected.
+ */
+export declare function setUnrealMcp(url: string | null): void;
 /** Sets the add-ons' MCP servers in the sandbox's .claude.json (and Codex's config.toml); the names that are on. */
 export declare function writeAddonMcpServers(): string[];

package/dist/guest/setup/addon-mcp.js

@@ -13,8 +13,18 @@ import { dryRun } from '../runtime/paths.js';
 import { claudeDir, session, stateDir } from '../runtime/session.js';
 import { log, warn } from '../runtime/log.js';
 import { installedMcpAddons } from './agent-addons.js';
-/** The names of every MCP server an add-on can add (the ones the sandbox may remove). */
-const ADDON_MCP_NAMES = APPS.flatMap((a) => (a.mcp ? [a.mcp.name] : []));
+/** The Unreal editor's MCP server (Unreal 5.8's ModelContextProtocol plugin), set by the Unreal engines step. */
+export const UNREAL_MCP_NAME = 'sbx-unreal-editor';
+let unrealMcp = null;
+/** The names of every MCP server the sandbox can add (the ones it may remove). */
+const ADDON_MCP_NAMES = [...APPS.flatMap((a) => (a.mcp ? [a.mcp.name] : [])), UNREAL_MCP_NAME];
+/**
+ * Adds the Unreal editor's MCP server (its address) to the next writeAddonMcpServers, or takes it away (null). It only
+ * answers while the editor runs with the plugin on; until then Claude Code lists it as not connected.
+ */
+export function setUnrealMcp(url) {
+    unrealMcp = url ? { type: 'http', url } : null;
+}
 /** Variables only this sandbox can tell an add-on's server (where Comet is). */
 function placeEnv(id) {
     if (id !== 'comet-mcp')
@@ -34,7 +44,10 @@ function addonServers() {
 export function writeAddonMcpServers() {
     const on = addonServers();
     writeCodexAddonMcpServers(on);
-    const servers = Object.fromEntries(on.map(({ mcp, server }) => [mcp.name, server]));
+    const servers = {
+        ...Object.fromEntries(on.map(({ mcp, server }) => [mcp.name, server])),
+        ...(unrealMcp ? { [UNREAL_MCP_NAME]: unrealMcp } : {}),
+    };
     const file = path.join(claudeDir, '.claude.json');
     let state = {};
     if (fs.existsSync(file)) {
@@ -72,10 +85,12 @@ function writeCodexAddonMcpServers(on) {
     const servers = Object.fromEntries(on
         .filter(({ mcp }) => mcp.codex)
         .map(({ mcp, server }) => [mcp.name, { ...server, ...(mcp.envVars?.length ? { envVars: mcp.envVars } : {}) }]));
+    if (unrealMcp)
+        servers[UNREAL_MCP_NAME] = unrealMcp;
     const before = exists(file) ? fs.readFileSync(file, 'utf8') : '';
     if (!before && !Object.keys(servers).length)
         return;
-    const known = APPS.flatMap((a) => (a.mcp?.codex ? [a.mcp.name] : []));
+    const known = [...APPS.flatMap((a) => (a.mcp?.codex ? [a.mcp.name] : [])), UNREAL_MCP_NAME];
     const result = codexWithAddonMcpServers(before, servers, known);
     for (const name of result.skipped)
         warn('Codex MCP servers from Apps: ' + name + ' is already in config.toml in another form, left as it is');

package/dist/guest/setup/browser-gpu.js

@@ -1,18 +1,21 @@
-// Browsers in the sandbox draw without the GPU (Edge and Chrome machine policy, written every boot). With sandbox.vGpu
-// the sandbox shares this PC's graphics card through one virtual GPU: a browser's GPU process starting next to a game
-// or other Direct3D program there has taken the whole sandbox down. Pages still render, WebGL included, in software;
-// programs that need the GPU keep it. Without vGPU nothing changes (there is no GPU to use).
+// Browsers in the sandbox (Edge and Chrome machine policy, written every boot) draw without the GPU, and download to
+// C:\AgentData\downloads, which is kept between sandboxes. With sandbox.vGpu the sandbox shares this PC's graphics card
+// through one virtual GPU: a browser's GPU process starting next to a game or other Direct3D program there has taken
+// the whole sandbox down. Pages still render, WebGL included, in software; programs that need the GPU keep it. Without
+// vGPU there is no GPU to use, so only the download folder matters.
+import path from 'node:path';
 import { SYSTEM } from '../../shared/system.js';
-import { dryRun, isWin } from '../runtime/paths.js';
+import { browserPolicies } from '../../shared/browser-policy.js';
+import { dataDir, dryRun, isWin } from '../runtime/paths.js';
 import { exec } from '../runtime/process.js';
 import { log } from '../runtime/log.js';
-const POLICY_KEYS = ['HKLM\\SOFTWARE\\Policies\\Microsoft\\Edge', 'HKLM\\SOFTWARE\\Policies\\Google\\Chrome'];
+import { mkdirp } from '../runtime/fs.js';
 export function keepBrowsersOffGpu() {
     if (dryRun || !isWin)
         return;
-    for (const key of POLICY_KEYS)
-        exec(SYSTEM.reg(), ['add', key, '/v', 'HardwareAccelerationModeEnabled', '/t', 'REG_DWORD', '/d', '0', '/f'], {
-            stdio: 'ignore',
-        });
-    log('Browsers draw without the GPU (Edge and Chrome policy).');
+    const downloads = path.join(dataDir, 'downloads');
+    mkdirp(downloads);
+    for (const p of browserPolicies({ downloads }))
+        exec(SYSTEM.reg(), ['add', p.key, '/v', p.name, '/t', p.type, '/d', p.data, '/f'], { stdio: 'ignore' });
+    log('Browsers draw without the GPU and download to ' + downloads + '.');
 }

package/dist/guest/setup/environment.js

@@ -1,7 +1,7 @@
 // The environment every agent session, hook and terminal tab in the sandbox gets.
 import path from 'node:path';
 import { claudeDir, session, stateDir, workspace } from '../runtime/session.js';
-import { dataDir, dryRun, isWin, testMode, toolsDir } from '../runtime/paths.js';
+import { dataDir, dryRun, isWin, localDir, testMode, toolsDir } from '../runtime/paths.js';
 import { exists, mkdirp } from '../runtime/fs.js';
 import { execOutput, runScriptWithJson, runScriptWithJsonAsync } from '../runtime/process.js';
 import { SYSTEM } from '../../shared/system.js';
@@ -9,7 +9,7 @@ import { warn } from '../runtime/log.js';
 import { errMsg } from '../../core/util/errors.js';
 import { localStateVars } from '../agents/local-state.js';
 import { agentPaths } from '../agents/agent-files.js';
-import { appendMissing, expandVars, isPinnedNodeDir, msvcBeforeGitUsr, parseRegPath, pathKey, planPath, } from './path-plan.js';
+import { appendMissing, expandVars, isPinnedNodeDir, parseRegPath, pathKey, planPath, sessionPath, } from './path-plan.js';
 /** Older launch folders have no agentHomes: these two were always set. */
 const LEGACY_HOMES = { CODEX_HOME: 'codex', GEMINI_CLI_HOME: 'gemini' };
 /** Every agent's home variable (CODEX_HOME ...) with the folder it points to in the persistent state. */
@@ -57,8 +57,13 @@ export function agentEnv(tools, target = { workspace, project: session.project,
     // The runner's own Node (bootstrap.ps1 puts it first on PATH) is not exposed: `node` is whatever nvm selected.
     const runners = [path.join(toolsDir, 'node'), path.dirname(process.execPath)].map((d) => d.toLowerCase());
     const base = (target.base.PATH ?? '').split(path.delimiter).filter((d) => d && !runners.includes(d.toLowerCase()));
-    // MSVC's link.exe before Git's coreutils link.exe, wherever each came from.
-    env.PATH = msvcBeforeGitUsr([...new Set([...tools.prepend, ...base, ...tools.append])]).join(path.delimiter);
+    // The sandbox's commands (agent shims, sbx-db) first; MSVC's link.exe before Git's coreutils link.exe.
+    env.PATH = sessionPath({
+        commands: path.join(localDir, 'bin'),
+        prepend: tools.prepend,
+        base,
+        append: tools.append,
+    }).join(path.delimiter);
     return env;
 }
 /** Makes the agent environment machine-wide, so new terminal tabs and anything the agent starts see the same tools. */