windows-development-sandbox 1.25.0 → 1.27.0

package/dist/guest/accounts/kinds/unity.js

@@ -1,7 +1,164 @@
-import { notAvailableYet } from '../adapter.js';
-export const unityAdapter = {
-    kind: 'unity',
-    apply(_p) {
-        return notAvailableYet('unity');
-    },
-};
+// Unity: the licence file (Unity_lic.ulf) goes to %ProgramData%\Unity and the named-user licence to
+// %LOCALAPPDATA%\Unity\licenses, where the editor reads them. The Unity ID (and a Plus or Pro serial) are kept in
+// secretDir('unity')\activation.json, on the sandbox's own disk, for the editor to sign in with. A serial seat is
+// returned when the sandbox stops. Nothing here puts a password, serial or licence text in a log or a summary.
+import { execFile } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { z } from 'zod';
+import { MAX_ULF_BYTES, parseLicenceStatus, unityEntitlementFile, unityUlfFile, } from '../../../shared/accounts/index.js';
+import { decodeText, readBoundedFile } from '../../../shared/io/index.js';
+import { licenceStatusArgs, UNITY_CLI_ENV } from '../../../shared/unity/cli.js';
+import { localAppData, secretDir } from '../adapter.js';
+const MAX_JSON_BYTES = 16 * 1024;
+const RETURN_MS = 120_000;
+const ACTIVATE_MS = 180_000;
+const STATUS_MS = 60_000;
+const ActivationSchema = z.object({
+    email: z.string().max(256).optional(),
+    password: z.string().max(1024).optional(),
+    serial: z.string().max(64).optional(),
+});
+const ActivatedSchema = z.object({ editorExe: z.string().min(1).max(520), serial: z.literal(true) });
+export const runUnityProgram = (file, args, o) => new Promise((resolve) => {
+    execFile(file, [...args], { windowsHide: true, timeout: o.timeoutMs, maxBuffer: 1024 * 1024, env: { ...process.env, ...o.env } }, (error, stdout) => {
+        const code = error ? (typeof error.code === 'number' ? error.code : -1) : 0;
+        resolve({ code, stdout: String(stdout ?? '') });
+    });
+});
+function readText(file) {
+    const bytes = readBoundedFile(file, MAX_ULF_BYTES);
+    return bytes ? decodeText(bytes).text : null;
+}
+function readSecretJson(schema, file) {
+    const bytes = readBoundedFile(file, MAX_JSON_BYTES);
+    if (!bytes)
+        return null;
+    try {
+        const parsed = schema.safeParse(JSON.parse(decodeText(bytes).text));
+        return parsed.success ? parsed.data : null;
+    }
+    catch {
+        return null; // not JSON: treated as absent
+    }
+}
+function writeText(file, text) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, text, 'utf8');
+}
+/** The adapter for these folders and this runner (the self-test passes its own). */
+export function unityAdapterFor(dirs, run = runUnityProgram) {
+    const activation = path.join(dirs.secrets, 'activation.json');
+    const activated = path.join(dirs.secrets, 'activated.json');
+    return {
+        kind: 'unity',
+        apply(p) {
+            if (p.ulf)
+                writeText(unityUlfFile(dirs.programData), p.ulf);
+            if (p.entitlement)
+                writeText(unityEntitlementFile(dirs.localAppData), p.entitlement);
+            const sign = {};
+            if (p.email)
+                sign.email = p.email;
+            if (p.password)
+                sign.password = p.password;
+            if (p.serial)
+                sign.serial = p.serial;
+            if (Object.keys(sign).length)
+                writeText(activation, JSON.stringify(sign));
+            return {
+                summary: p.ulf || p.entitlement
+                    ? 'Unity: your licence file is in place'
+                    : 'Unity: your Unity ID is ready to activate the serial',
+            };
+        },
+        current() {
+            const ulf = readText(unityUlfFile(dirs.programData));
+            const entitlement = readText(unityEntitlementFile(dirs.localAppData));
+            const sign = readSecretJson(ActivationSchema, activation) ?? {};
+            const out = {
+                ...(ulf ? { ulf } : {}),
+                ...(entitlement ? { entitlement } : {}),
+                ...sign,
+            };
+            return Object.keys(out).length ? out : null;
+        },
+        async release() {
+            const marker = readSecretJson(ActivatedSchema, activated);
+            if (!marker)
+                return;
+            const sign = readSecretJson(ActivationSchema, activation);
+            if (!sign?.email || !sign.password)
+                return;
+            await run(marker.editorExe, [
+                '-batchmode',
+                '-nographics',
+                '-quit',
+                '-returnlicense',
+                '-username',
+                sign.email,
+                '-password',
+                sign.password,
+                '-logFile',
+                path.join(dirs.secrets, 'return.log'),
+            ], { timeoutMs: RETURN_MS });
+        },
+    };
+}
+function defaultDirs() {
+    return {
+        programData: process.env.ProgramData ?? process.env.PROGRAMDATA ?? 'C:\\ProgramData',
+        localAppData: localAppData(),
+        secrets: secretDir('unity'),
+    };
+}
+export const unityAdapter = unityAdapterFor(defaultDirs());
+/**
+ * Activates the serial the sandbox holds once an editor exists, then asks `unity license status` where the licence
+ * stands. The detail never holds a secret.
+ */
+export async function activateUnityLicence(o, dirs = defaultDirs(), run = runUnityProgram) {
+    const sign = readSecretJson(ActivationSchema, path.join(dirs.secrets, 'activation.json'));
+    if (sign?.serial && sign.email && sign.password && o.editorExe) {
+        await run(o.editorExe, [
+            '-batchmode',
+            '-nographics',
+            '-quit',
+            '-serial',
+            sign.serial,
+            '-username',
+            sign.email,
+            '-password',
+            sign.password,
+            '-logFile',
+            path.join(dirs.secrets, 'activate.log'),
+        ], { timeoutMs: ACTIVATE_MS });
+        writeText(path.join(dirs.secrets, 'activated.json'), JSON.stringify({ editorExe: o.editorExe, serial: true }));
+    }
+    const user = sign?.email ?? null;
+    if (!o.unityExe)
+        return { state: 'unknown', kind: '', detail: 'not checked', user };
+    let parsed = null;
+    try {
+        const r = await run(o.unityExe, licenceStatusArgs(), { timeoutMs: STATUS_MS, env: UNITY_CLI_ENV });
+        parsed = r.code === 0 ? JSON.parse(r.stdout) : null;
+    }
+    catch {
+        parsed = null; // not JSON: reported as not recognised
+    }
+    const s = parseLicenceStatus(parsed);
+    if (s.state === 'active')
+        return { state: 'active', kind: s.kind, detail: 'active (' + (s.kind || 'licensed') + ')', user };
+    if (s.state === 'none') {
+        const hasFile = readText(unityUlfFile(dirs.programData)) !== null || readText(unityEntitlementFile(dirs.localAppData)) !== null;
+        return hasFile
+            ? {
+                state: 'invalid',
+                kind: '',
+                detail: 'the licence file from ' + (o.source ?? 'your saved sign-in') + ' is not accepted here: sign in again',
+                user,
+            }
+            : { state: 'none', kind: '', detail: 'none: sign in to Unity once in this sandbox', user };
+    }
+    return { state: 'unknown', kind: '', detail: s.detail, user };
+}

package/dist/guest/apps/after-install.d.ts

@@ -1,3 +1,3 @@
-import type { AppEntry } from '../../shared/apps/index.js';
+import { type AppEntry } from '../../shared/apps/index.js';
 /** Settings an app needs on every boot (the sandbox's registry is new each time), and files next to its program. */
 export declare function afterInstall(entry: AppEntry, exe: string): Promise<void>;

package/dist/guest/apps/after-install.js

@@ -1,11 +1,12 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { associationPlan } from '../../shared/apps/index.js';
 import { SYSTEM } from '../../shared/system.js';
 import { errMsg } from '../../core/util/errors.js';
 import { takePendingComet } from '../accounts/kinds/comet.js';
 import { restoreCometSignIn } from '../browser/comet.js';
 import { log, warn } from '../runtime/log.js';
-import { execAsync } from '../runtime/process.js';
+import { execAsync, runScriptWithJsonAsync } from '../runtime/process.js';
 import { exists, mkdirp } from '../runtime/fs.js';
 import { arch, tool } from '../toolchains/tool-env.js';
 /** The Sysinternals tools whose EULA is accepted up front (each asks once otherwise). */
@@ -58,6 +59,10 @@ export async function afterInstall(entry, exe) {
         mkdirp(path.join(dir, 'Data'));
     if (entry.id === 'comet')
         await restoreComet(exe);
+    const plan = associationPlan(entry.id, exe);
+    if (plan.length) {
+        await runScriptWithJsonAsync('set-registry-values.ps1', 'PlanFile', { values: plan }).catch((e) => warn(entry.name + ': double-click file types were not set (' + errMsg(e) + ')'));
+    }
     if (entry.id === 'sysinternals') {
         for (const name of SYSINTERNALS_TOOLS) {
             await execAsync(SYSTEM.reg(), ['add', 'HKCU\\Software\\Sysinternals\\' + name, '/v', 'EulaAccepted', '/t', 'REG_DWORD', '/d', '1', '/f'], { stdio: 'ignore' }).catch(() => undefined);

package/dist/guest/apps/app-installer.d.ts

@@ -13,6 +13,7 @@ export declare class AppInstaller {
     private readonly parallel;
     private readonly gui;
     private readonly installed;
+    private readonly installedIds;
     constructor(env: ToolEnv, options: AppsOptions, parallel?: number);
     /**
      * Downloads the plain downloads (not pinned, not npm, not remote) of the apps that are not installed yet, into

package/dist/guest/apps/app-installer.js

@@ -2,7 +2,7 @@
 // failing is reported and never stops the others.
 import fs from 'node:fs';
 import path from 'node:path';
-import { appsToInstall } from '../../shared/apps/index.js';
+import { appsToInstall, previewGuideLine } from '../../shared/apps/index.js';
 import { downloader, moveIntoPlace, stagingFolder } from '../../shared/download/index.js';
 import { safeRemove } from '../../shared/io/safe-remove.js';
 import { dryRun, launchDir } from '../runtime/paths.js';
@@ -13,10 +13,13 @@ import { errMsg } from '../../core/util/errors.js';
 import { emptyEnv, tool } from '../toolchains/tool-env.js';
 import { uvVars } from '../toolchains/runtimes.js';
 import { COMET_MCP_PORT, cometShortcutArgs } from '../browser/comet.js';
+import { perplexityAppShortcutArgs } from '../browser/perplexity-app.js';
 import { afterInstall } from './after-install.js';
 import { installFromKept } from './comet-unpack.js';
 import { findExe } from './find-exe.js';
+import { installStoreApp } from './store-app.js';
 import { shortcuts } from './shortcuts.js';
+import { SYSTEM } from '../../shared/system.js';
 import { signatureCheck } from '../toolchains/installers.js';
 import { resolve } from './sources.js';
 import { unpack } from './unpack.js';
@@ -33,6 +36,7 @@ export class AppInstaller {
     parallel;
     gui = [];
     installed = [];
+    installedIds = [];
     constructor(env, options, parallel = PARALLEL) {
         this.env = env;
         this.options = options;
@@ -45,6 +49,7 @@ export class AppInstaller {
     async prefetch(entries) {
         const todo = entries.filter((e) => !('remote' in e.source) &&
             !('locked' in e.source) &&
+            !('store' in e.source) &&
             !('npm' in e.source) &&
             e.id !== '7zip' &&
             (this.options.refresh || !exists(path.join(tool('apps', ...e.id.split('/')), MARKER))));
@@ -82,6 +87,9 @@ export class AppInstaller {
         }
         if (this.installed.length)
             this.env.summary.push('apps: ' + this.installed.join(', ') + ' (shortcuts on the desktop and in Start > Sandbox apps)');
+        const preview = previewGuideLine(this.installedIds);
+        if (preview)
+            this.env.summary.push(preview);
     }
     async installOne(entry) {
         try {
@@ -93,6 +101,20 @@ export class AppInstaller {
                 this.installed.push(entry.name);
                 return;
             }
+            if ('store' in entry.source) {
+                // A Store app: Windows in the sandbox is new on every boot, so it is installed again from the PC's package.
+                log('Installing ' + entry.name + ' (Microsoft Store package) ...');
+                await installStoreApp(entry.id, entry.source.store.packageName);
+                fs.writeFileSync(path.join(mkdirp(dest), MARKER), JSON.stringify({ id: entry.id, at: new Date().toISOString() }));
+                this.gui.push({
+                    name: entry.name,
+                    exe: SYSTEM.powershell(),
+                    args: perplexityAppShortcutArgs(path.join(launchDir, 'sandbox', 'scripts', 'start-store-app.ps1')),
+                });
+                this.installed.push(entry.name);
+                this.installedIds.push(entry.id);
+                return;
+            }
             if (!exists(path.join(dest, MARKER)) || this.options.refresh)
                 await this.download(entry, dest);
             // A Chromium installer that could not be unpacked is kept and installed into the sandbox each boot instead.
@@ -102,11 +124,17 @@ export class AppInstaller {
                 throw new Error(entry.exe + ' not found in the download');
             await afterInstall(entry, exe);
             // A proxy or MCP server (agent add-ons) is started by the sandbox or the agent: no PATH entry, no shortcut.
-            if (!entry.service && (entry.cli || entry.id === 'sysinternals'))
-                this.env.prepend.push(path.dirname(exe));
+            if (!entry.service && (entry.cli || entry.id === 'sysinternals')) {
+                // rustup's rust-analyzer proxy (in cargo's bin folder) only errors until its component is added.
+                if (entry.id === 'rust-analyzer')
+                    this.env.prepend.unshift(path.dirname(exe));
+                else
+                    this.env.prepend.push(path.dirname(exe));
+            }
             if (!entry.cli && !entry.service)
                 this.gui.push({ name: entry.name, exe, ...this.launchArgs(entry) });
             this.installed.push(entry.name);
+            this.installedIds.push(entry.id);
         }
         catch (e) {
             warn(entry.name + ' could not be installed and is skipped; the other apps are not affected. Reason: ' + errMsg(e));

package/dist/guest/apps/comet-unpack.js

@@ -15,10 +15,11 @@ const INNER = [
     /^chrome\.7z$/i,
     /^chrome\.packed\.7z$/i,
     /^mini_installer\.exe$/i,
-    /^updater\.packed\.7z$/i,
+    /^updater\.(packed\.)?7z$/i,
 ];
 const MAX_LEVELS = 6;
-const MAX_DEPTH = 4;
+/** Comet's installer nests mini_installer.exe five folders down (bin\Offline\{id}\{id}). */
+const MAX_DEPTH = 7;
 const MAX_ENTRIES = 20000;
 /** Where the installer is kept when it could not be unpacked (below the app's folder). */
 export const KEPT_INSTALLER_DIR = 'installer';

package/dist/guest/apps/resolvers-gamedev.js

@@ -1 +1,55 @@
-export const GAMEDEV_RESOLVERS = {};
+// Where the latest version of the game-development apps (catalogue-gamedev.ts) is, when it is not a plain GitHub
+// release: Krita (download.kde.org, with the SHA-256 its mirror publishes beside each file), Inkscape (inkscape.org's
+// portable 7z and its .sha256) and RenderDoc (renderdoc.org's portable zip; it publishes no checksum, the download is
+// HTTPS from renderdoc.org).
+import { fetchText } from '../../shared/download/index.js';
+const firstHash = (text) => /\b([0-9a-f]{64})\b/i.exec(text)?.[1].toLowerCase() ?? null;
+const byVersion = (a, b) => {
+    const x = a.split('.').map(Number);
+    const y = b.split('.').map(Number);
+    for (let i = 0; i < Math.max(x.length, y.length); i++)
+        if ((x[i] ?? 0) !== (y[i] ?? 0))
+            return (x[i] ?? 0) - (y[i] ?? 0);
+    return 0;
+};
+/** The newest Krita release folder that has the portable Windows zip (a hotfix folder may have only some files). */
+async function krita() {
+    const base = 'https://download.kde.org/stable/krita/';
+    const versions = [...(await fetchText(base)).matchAll(/href="(\d+\.\d+\.\d+(?:\.\d+)?)\/"/g)]
+        .map((m) => m[1])
+        .sort(byVersion)
+        .reverse()
+        .slice(0, 4);
+    for (const v of versions) {
+        const file = 'krita-x64-' + v + '.zip';
+        if (!(await fetchText(base + v + '/')).includes('href="' + file + '"'))
+            continue;
+        const url = base + v + '/' + file;
+        return { url, fileName: file, sha256: firstHash(await fetchText(url + '.sha256').catch(() => '')) };
+    }
+    throw new Error('no portable Krita zip on download.kde.org');
+}
+async function inkscape() {
+    const release = await fetchText('https://inkscape.org/release/');
+    const v = /\/release\/inkscape-(\d+\.\d+(?:\.\d+)?)\//.exec(release)?.[1];
+    if (!v)
+        throw new Error('could not find the latest Inkscape release');
+    const page = await fetchText('https://inkscape.org/release/inkscape-' + v + '/windows/64-bit/compressed-7z/dl/');
+    const item = /\/gallery\/item\/\d+\/inkscape-[\w.-]+-x64[\w-]*\.7z/.exec(page);
+    const sums = /https:\/\/media\.inkscape\.org\/media\/resources\/sigs\/[\w.-]+\.sha256/.exec(page)?.[0];
+    if (!item)
+        throw new Error('no portable Inkscape 7z for ' + v);
+    return {
+        url: 'https://inkscape.org' + item[0],
+        fileName: 'inkscape-' + v + '-x64.7z',
+        sha256: sums ? firstHash(await fetchText(sums).catch(() => '')) : null,
+    };
+}
+async function renderdoc() {
+    const page = await fetchText('https://renderdoc.org/builds');
+    const hit = /https:\/\/renderdoc\.org\/stable\/([\d.]+)\/RenderDoc_[\d.]+_64\.zip/.exec(page);
+    if (!hit)
+        throw new Error('could not find the RenderDoc download on renderdoc.org');
+    return { url: hit[0], fileName: 'RenderDoc_' + hit[1] + '_64.zip' };
+}
+export const GAMEDEV_RESOLVERS = { krita, inkscape, renderdoc };

package/dist/guest/apps/store-app.d.ts

@@ -0,0 +1,4 @@
+/** Where the PC left an app's package. */
+export declare function storePackageDir(appId: string): string;
+/** Installs the app from its kept package; resolves when Windows has it. */
+export declare function installStoreApp(appId: string, packageName: string): Promise<void>;

package/dist/guest/apps/store-app.js

@@ -0,0 +1,19 @@
+// A Microsoft Store app in the sandbox: the PC put its package files in the data folder (toolsapps<id>.package,
+// with store-package.json). Windows in the sandbox is new on every boot, so the app is installed again each boot with
+// Add-AppxPackage (sandbox\scripts\install-store-package.ps1), from the package kept on the data disk. The files are
+// checked against the manifest's SHA-256 first (store-check.ts). Windows checks the publisher's signature itself.
+import { runScriptWithJsonAsync } from '../runtime/process.js';
+import { tool } from '../toolchains/tool-env.js';
+import { checkedPackage } from './store-check.js';
+/** Where the PC left an app's package. */
+export function storePackageDir(appId) {
+    return tool('apps', appId + '.package');
+}
+/** Installs the app from its kept package; resolves when Windows has it. */
+export async function installStoreApp(appId, packageName) {
+    const { main, dependencies } = await checkedPackage(storePackageDir(appId));
+    await runScriptWithJsonAsync('install-store-package.ps1', 'ListFile', { main, dependencies }, [
+        '-PackageName',
+        packageName,
+    ]);
+}

package/dist/guest/apps/store-check.d.ts

@@ -0,0 +1,8 @@
+/** The SHA-256 of a file, read in pieces (the package is hundreds of MB). */
+export declare function fileSha256(file: string): Promise<string>;
+export interface CheckedPackage {
+    readonly main: string;
+    readonly dependencies: string[];
+}
+/** The package in `dir` when its manifest is valid and every file is there as hashed; throws otherwise. */
+export declare function checkedPackage(dir: string): Promise<CheckedPackage>;

package/dist/guest/apps/store-check.js

@@ -0,0 +1,33 @@
+// The package files of a Store app the PC left in the data folder, checked against the SHA-256 in store-package.json.
+// No runtime imports: the self-test loads this file.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { STORE_PACKAGE_MANIFEST, StorePackageManifestSchema } from '../../shared/apps/store-package.js';
+import { readValid } from '../../shared/io/json.js';
+const READ_CHUNK = 1024 * 1024;
+/** The SHA-256 of a file, read in pieces (the package is hundreds of MB). */
+export function fileSha256(file) {
+    return new Promise((resolve, reject) => {
+        const hash = crypto.createHash('sha256');
+        const stream = fs.createReadStream(file, { highWaterMark: READ_CHUNK });
+        stream.on('data', (chunk) => hash.update(chunk));
+        stream.on('error', reject);
+        stream.on('end', () => resolve(hash.digest('hex')));
+    });
+}
+/** The package in `dir` when its manifest is valid and every file is there as hashed; throws otherwise. */
+export async function checkedPackage(dir) {
+    const manifest = readValid(StorePackageManifestSchema, path.join(dir, STORE_PACKAGE_MANIFEST));
+    if (!manifest)
+        throw new Error('the package was not handed over (this PC could not fetch it: see the launch notes)');
+    for (const f of manifest.files) {
+        if ((await fileSha256(path.join(dir, f.name)).catch(() => '')) !== f.sha256)
+            throw new Error(f.name + ' is missing or changed');
+    }
+    const full = (name) => path.join(dir, name);
+    return {
+        main: full(manifest.files.find((f) => f.role === 'main').name),
+        dependencies: manifest.files.filter((f) => f.role === 'dependency').map((f) => full(f.name)),
+    };
+}

package/dist/guest/boot/boot.js

@@ -52,7 +52,20 @@ import { setBackgroundWork, setSandboxStatus } from '../runtime/status.js';
 import { errMsg } from '../../core/util/errors.js';
 const PRIMARY_POLLS = 600;
 const POLL_MS = 500;
-const VSCODE_LANGUAGES = ['python', 'java', 'go', 'rust', 'cpp', 'msvc', 'dotnet', 'ruby', 'php', 'deno', 'pwsh'];
+const VSCODE_LANGUAGES = [
+    'python',
+    'java',
+    'go',
+    'rust',
+    'cpp',
+    'msvc',
+    'unreal',
+    'dotnet',
+    'ruby',
+    'php',
+    'deno',
+    'pwsh',
+];
 function startDaemon(env, secrets) {
     spawn(process.execPath, [path.join(path.dirname(process.argv[1]), 'daemon.js')], {
         detached: true,
@@ -86,7 +99,7 @@ function writeDbCommand() {
     writeDevToolCommands(dir);
     return dir;
 }
-/** sbx-steam, sbx-fivem, sbx-unity, sbx-android for the toolchains that are on: runtime\tool.js with that helper. */
+/** sbx-steam, sbx-fivem, sbx-android for the toolchains that are on: runtime\tool.js with that helper. */
 function writeDevToolCommands(dir) {
     const script = path.join(path.dirname(process.argv[1]), 'tool.js');
     for (const tool of devToolsFor(session.toolchains))

package/dist/guest/boot/guide.js

@@ -7,6 +7,13 @@ import { dataDir, launchDir, logsDir, toolsDir } from '../runtime/paths.js';
 import { addonGuideLine, APPS, headroomGuideLine, RTK_GUIDE_LINE } from '../../shared/apps/index.js';
 import { installedAddon, installedRtk } from '../setup/agent-addons.js';
 import { projectFolderLines, toolLines } from './guide-lines.js';
+import { sandboxScriptsDir } from '../../shared/scripts.js';
+import { findUproject, unrealGuideLines } from '../../shared/unreal/index.js';
+import { DISK } from '../toolchains/engines/unreal-engines.js';
+import { readValid } from '../../shared/io/json.js';
+import { UNITY_STATUS_FILE, UnityStatusSchema, unityGuideLines } from '../../shared/unity/index.js';
+import { tool } from '../toolchains/tool-env.js';
+import { readUnrealStatus } from '../toolchains/engines/unreal-status.js';
 const BEGIN = '<!-- agent-sandbox:begin (generated every boot, do not edit) -->';
 const END = '<!-- agent-sandbox:end -->';
 /** Drives other than C: are subst drives onto C:\Mirror\<letter> (mapped folders shown at their PC paths). */
@@ -25,6 +32,39 @@ const mirrorLine = () => {
 };
 /** Folders mapped for other projects at boot; launch folders from before mappedProjects only list the guest side. */
 const mappedFolders = () => session.mappedProjects ?? (session.roots ?? []).map((guest) => ({ host: 'a folder on the PC', guest }));
+/** The Mixamo import template, when this version ships one. */
+function mixamoScript() {
+    const file = path.join(sandboxScriptsDir(), 'templates', 'unreal', 'import_mixamo.py');
+    return fs.existsSync(file) ? file : null;
+}
+/** The Unreal lines (engine per project, build/test/package/debug commands) when the sandbox is set up for Unreal. */
+function unrealLines(projects) {
+    const any = session.toolchains.unreal.enabled === true || projects.some((p) => p.tools?.some((t) => /^unreal/.test(t)));
+    if (!any)
+        return [];
+    const status = readUnrealStatus();
+    if (!status.updatedAt)
+        return [];
+    const folders = [workspace, ...projects.map((p) => p.guest)];
+    return unrealGuideLines(status, folders
+        .filter((f, i) => folders.findIndex((g) => g.toLowerCase() === f.toLowerCase()) === i)
+        .filter((f) => status.projects.some((p) => p.workspace.toLowerCase() === f.toLowerCase()))
+        .map((f) => ({ workspace: f, uproject: findUproject(f, DISK) })), { mixamo: { downloads: path.join(dataDir, 'downloads'), script: mixamoScript() } });
+}
+/** The Unity lines (editor per project, build/test/import commands) when the sandbox is set up for Unity. */
+function unityLines(projects) {
+    const any = session.toolchains.unity.enabled === true || projects.some((p) => p.tools?.some((t) => /^unity/.test(t)));
+    if (!any)
+        return [];
+    const status = readValid(UnityStatusSchema, path.join(tool('unity'), UNITY_STATUS_FILE));
+    if (!status?.updatedAt)
+        return [];
+    const folders = [workspace, ...projects.map((p) => p.guest)];
+    return unityGuideLines(status, folders
+        .filter((f, i) => folders.findIndex((g) => g.toLowerCase() === f.toLowerCase()) === i)
+        .filter((f) => status.projects.some((p) => p.workspace.toLowerCase() === f.toLowerCase()))
+        .map((f) => ({ workspace: f })));
+}
 /** Deliberately tiny: it is loaded into every conversation. */
 export function sandboxGuide(toolSummary, lan = 'blocked', projects = [], addons = []) {
     return [
@@ -45,6 +85,8 @@ export function sandboxGuide(toolSummary, lan = 'blocked', projects = [], addons
         '- RO: `' + launchDir + "` (this boot's scripts) · lost on close: everything else, incl. `C:\\nvm` (Node symlink)",
         ...mirrorLine(),
         ...toolLines(session.project, toolSummary, projects),
+        ...unrealLines(projects),
+        ...unityLines(projects),
         // Agent add-ons that change how the agent works (rtk, Headroom, MCP servers, ccusage).
         ...addons,
         '- Persistent installs: `npm i -g` (per nvm version), `pip`, `cargo install`, `dotnet tool -g`, `uv tool`, `bun add -g`. Real installers must re-run each boot via a hook (ask the user).',

package/dist/guest/browser/comet.d.ts

@@ -1,5 +1,5 @@
 import { type CometPayload } from '../../shared/accounts/kinds/comet.js';
-import { type DevToolsEndpoint } from './cdp.js';
+import { CdpConnection, type DevToolsEndpoint } from './cdp.js';
 /** The port comet-mcp looks for (it connects to a Comet already listening there). */
 export declare const COMET_MCP_PORT = 9222;
 /** The addresses whose cookies are read back (their cookies and the parent domain's). */
@@ -16,6 +16,8 @@ export declare function cometLaunchArgs(port: number, profile?: string): string[
 export declare function cometShortcutArgs(port: number, profile?: string): string;
 /** Where a Comet running with this profile listens, from its DevToolsActivePort file; null when there is none. */
 export declare function devToolsEndpoint(profile?: string): DevToolsEndpoint | null;
+/** A connection to the Comet running with this profile, or null when none answers. */
+export declare function connect(profile: string): Promise<CdpConnection | null>;
 /**
  * The sign-in the running Comet holds now (perplexity.ai's own cookies, asked of one of its pages), or null when
  * Comet is not running with this profile, has no page open, or holds no sign-in. Never asks for another site's cookies.

package/dist/guest/browser/comet.js

@@ -56,7 +56,7 @@ export function devToolsEndpoint(profile = cometProfileDir()) {
     return bytes ? parseDevToolsActivePort(bytes.toString('utf8')) : null;
 }
 /** A connection to the Comet running with this profile, or null when none answers. */
-async function connect(profile) {
+export async function connect(profile) {
     const endpoint = devToolsEndpoint(profile);
     if (!endpoint)
         return null;

package/dist/guest/browser/perplexity-app.d.ts

@@ -0,0 +1,12 @@
+import { type CometPayload } from '../../shared/accounts/kinds/comet.js';
+/** The app's profile: on the sandbox's own disk, wiped with it. */
+export declare function perplexityAppProfileDir(): string;
+/**
+ * The powershell.exe arguments of the app's shortcut: start-store-app.ps1 with the package, the profile and a free
+ * DevTools port (0). `script` is the full path of the script in the launch folder.
+ */
+export declare function perplexityAppShortcutArgs(script: string, profile?: string): string;
+/** The sign-in the running app holds now, or null (not running with this profile, no page, signed out). */
+export declare function readAppSignIn(profile?: string): Promise<CometPayload | null>;
+/** Writes the sign-in into the running app; false when the app is not running with this profile. */
+export declare function restoreAppSignIn(payload: CometPayload, profile?: string): Promise<boolean>;

package/dist/guest/browser/perplexity-app.js

@@ -0,0 +1,60 @@
+// The Perplexity desktop app (a Microsoft Store package, Electron inside) in this sandbox: the profile folder it runs
+// with, the command line of its shortcut, and its sign-in over the DevTools port, the way Comet's is kept
+// (browser/comet.ts): only the allow-listed perplexity.ai cookies are read (Network.getCookies) and written back
+// (Storage.setCookies). The profile is on the sandbox's own disk: its cookie key is sealed to this sandbox's Windows
+// user, which is why the sign-in is not copied from the PC. No runtime imports: the sign-in adapter and the self-test
+// load this file.
+import fs from 'node:fs';
+import path from 'node:path';
+import { cookiesToRestore } from '../../shared/accounts/kinds/comet.js';
+import { PERPLEXITY_DESKTOP_PACKAGE } from '../../shared/apps/catalogue-agents-web.js';
+import { localAppData } from '../accounts/adapter.js';
+import { connect, readCometSignIn } from './comet.js';
+/** The app's profile: on the sandbox's own disk, wiped with it. */
+export function perplexityAppProfileDir() {
+    return path.join(localAppData(), 'AgentSandbox', 'perplexity-app-profile');
+}
+/**
+ * The powershell.exe arguments of the app's shortcut: start-store-app.ps1 with the package, the profile and a free
+ * DevTools port (0). `script` is the full path of the script in the launch folder.
+ */
+export function perplexityAppShortcutArgs(script, profile = perplexityAppProfileDir()) {
+    return [
+        '-NoLogo',
+        '-NoProfile',
+        '-WindowStyle',
+        'Hidden',
+        '-ExecutionPolicy',
+        'Bypass',
+        '-File',
+        '"' + script + '"',
+        '-PackageName',
+        PERPLEXITY_DESKTOP_PACKAGE,
+        '-UserDataDir',
+        '"' + profile + '"',
+        '-Port',
+        '0',
+    ].join(' ');
+}
+/** The sign-in the running app holds now, or null (not running with this profile, no page, signed out). */
+export function readAppSignIn(profile = perplexityAppProfileDir()) {
+    return readCometSignIn(profile);
+}
+/** Writes the sign-in into the running app; false when the app is not running with this profile. */
+export async function restoreAppSignIn(payload, profile = perplexityAppProfileDir()) {
+    const cookies = cookiesToRestore(payload, Math.floor(Date.now() / 1000));
+    if (!cookies.length)
+        return true;
+    if (!fs.existsSync(path.join(profile, 'DevToolsActivePort')))
+        return false;
+    const cdp = await connect(profile);
+    if (!cdp)
+        return false;
+    try {
+        await cdp.call('Storage.setCookies', { cookies });
+        return true;
+    }
+    finally {
+        cdp.close();
+    }
+}