windows-development-sandbox 1.25.0 → 1.27.0

package/dist/guest/daemon/daemon.js

@@ -12,6 +12,8 @@ import { liveFolders } from './live.js';
 import { warn } from '../runtime/log.js';
 import { errMsg } from '../../core/util/errors.js';
 import { flushAccounts } from './accounts.js';
+import { captureLauncherEngines } from '../toolchains/engines/unreal-engines.js';
+import { captureUnityEditors } from '../toolchains/engines/unity.js';
 const POLL_MS = 400;
 const MEM_SAVE_MS = 120000;
 export class Daemon {
@@ -47,6 +49,9 @@ export class Daemon {
             safely('claude-mem save', saveClaudeMem);
             safely('agent databases save', saveLocalState);
             void flushAccounts();
+            // Engines the Epic Games Launcher installed on the data disk since: kept for the next sandbox.
+            void captureLauncherEngines().catch((e) => warn('Unreal launcher save: ' + errMsg(e)));
+            void captureUnityEditors().catch((e) => warn('Unity editors: ' + errMsg(e)));
         }
     }
     handle(req) {

package/dist/guest/devtools/devtool.d.ts

@@ -1,4 +1,4 @@
-export type DevToolName = 'steam' | 'fivem' | 'unity' | 'android';
+export type DevToolName = 'steam' | 'fivem' | 'android';
 export interface DevTool {
     readonly name: DevToolName;
     /** One line for its usage and the agent's guide. */

package/dist/guest/devtools/registry.js

@@ -1,8 +1,7 @@
 import { androidTool } from './android.js';
 import { fivemTool } from './fivem.js';
 import { steamTool } from './steam.js';
-import { unityTool } from './unity.js';
-export const DEVTOOLS = [steamTool, fivemTool, unityTool, androidTool];
+export const DEVTOOLS = [steamTool, fivemTool, androidTool];
 /** The helpers for the toolchains that are on (resolved by the host; "auto" counts as off here). */
 export function devToolsFor(t) {
     return DEVTOOLS.filter((tool) => t[tool.name].enabled === true);

package/dist/guest/entries/tool.js

@@ -1,4 +1,4 @@
-// The sbx-<name> helpers (sbx-steam, sbx-fivem, sbx-unity, sbx-android): `tool.js <name> <args...>` runs that helper.
+// The sbx-<name> helpers (sbx-steam, sbx-fivem, sbx-android): `tool.js <name> <args...>` runs that helper.
 import { errMsg } from '../../core/util/errors.js';
 import { DEVTOOLS, devToolByName } from '../devtools/registry.js';
 const [name, ...args] = process.argv.slice(2);

package/dist/guest/setup/addon-mcp.d.ts

@@ -1,2 +1,14 @@
+import { type McpServerConfig } from '../../shared/apps/index.js';
+/** The Unreal editor's MCP server (Unreal 5.8's ModelContextProtocol plugin), set by the Unreal engines step. */
+export declare const UNREAL_MCP_NAME = "sbx-unreal-editor";
+/** The engines' own MCP servers: not an Apps add-on, set by the engine's step each boot, and sent to Codex too. */
+export declare const ENGINE_MCP_NAMES: readonly ["sbx-unreal-editor", "sbx-unity"];
+/**
+ * Adds an engine's MCP server to the next writeAddonMcpServers, or takes it away (null). A server for an editor only
+ * answers while the editor runs; until then Claude Code lists it as not connected.
+ */
+export declare function setEngineMcp(name: (typeof ENGINE_MCP_NAMES)[number], server: McpServerConfig | null): void;
+/** Adds the Unreal editor's MCP server (its address) to the next writeAddonMcpServers, or takes it away (null). */
+export declare function setUnrealMcp(url: string | null): void;
 /** Sets the add-ons' MCP servers in the sandbox's .claude.json (and Codex's config.toml); the names that are on. */
 export declare function writeAddonMcpServers(): string[];

package/dist/guest/setup/addon-mcp.js

@@ -6,6 +6,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { addonMcpServer, APPS, codexWithAddonMcpServers, withAddonMcpServers, } from '../../shared/apps/index.js';
+import { UNITY_MCP_NAME } from '../../shared/unity/index.js';
 import { writeJsonAtomic } from '../../shared/io/json.js';
 import { cometExe } from '../browser/comet.js';
 import { exists, mkdirp } from '../runtime/fs.js';
@@ -13,8 +14,27 @@ import { dryRun } from '../runtime/paths.js';
 import { claudeDir, session, stateDir } from '../runtime/session.js';
 import { log, warn } from '../runtime/log.js';
 import { installedMcpAddons } from './agent-addons.js';
-/** The names of every MCP server an add-on can add (the ones the sandbox may remove). */
-const ADDON_MCP_NAMES = APPS.flatMap((a) => (a.mcp ? [a.mcp.name] : []));
+/** The Unreal editor's MCP server (Unreal 5.8's ModelContextProtocol plugin), set by the Unreal engines step. */
+export const UNREAL_MCP_NAME = 'sbx-unreal-editor';
+/** The engines' own MCP servers: not an Apps add-on, set by the engine's step each boot, and sent to Codex too. */
+export const ENGINE_MCP_NAMES = [UNREAL_MCP_NAME, UNITY_MCP_NAME];
+const engineMcp = new Map();
+/** The names of every MCP server the sandbox can add (the ones it may remove). */
+const ADDON_MCP_NAMES = [...APPS.flatMap((a) => (a.mcp ? [a.mcp.name] : [])), ...ENGINE_MCP_NAMES];
+/**
+ * Adds an engine's MCP server to the next writeAddonMcpServers, or takes it away (null). A server for an editor only
+ * answers while the editor runs; until then Claude Code lists it as not connected.
+ */
+export function setEngineMcp(name, server) {
+    if (server)
+        engineMcp.set(name, server);
+    else
+        engineMcp.delete(name);
+}
+/** Adds the Unreal editor's MCP server (its address) to the next writeAddonMcpServers, or takes it away (null). */
+export function setUnrealMcp(url) {
+    setEngineMcp(UNREAL_MCP_NAME, url ? { type: 'http', url } : null);
+}
 /** Variables only this sandbox can tell an add-on's server (where Comet is). */
 function placeEnv(id) {
     if (id !== 'comet-mcp')
@@ -34,7 +54,10 @@ function addonServers() {
 export function writeAddonMcpServers() {
     const on = addonServers();
     writeCodexAddonMcpServers(on);
-    const servers = Object.fromEntries(on.map(({ mcp, server }) => [mcp.name, server]));
+    const servers = {
+        ...Object.fromEntries(on.map(({ mcp, server }) => [mcp.name, server])),
+        ...Object.fromEntries(engineMcp),
+    };
     const file = path.join(claudeDir, '.claude.json');
     let state = {};
     if (fs.existsSync(file)) {
@@ -72,10 +95,12 @@ function writeCodexAddonMcpServers(on) {
     const servers = Object.fromEntries(on
         .filter(({ mcp }) => mcp.codex)
         .map(({ mcp, server }) => [mcp.name, { ...server, ...(mcp.envVars?.length ? { envVars: mcp.envVars } : {}) }]));
+    for (const [name, server] of engineMcp)
+        servers[name] = server;
     const before = exists(file) ? fs.readFileSync(file, 'utf8') : '';
     if (!before && !Object.keys(servers).length)
         return;
-    const known = APPS.flatMap((a) => (a.mcp?.codex ? [a.mcp.name] : []));
+    const known = [...APPS.flatMap((a) => (a.mcp?.codex ? [a.mcp.name] : [])), ...ENGINE_MCP_NAMES];
     const result = codexWithAddonMcpServers(before, servers, known);
     for (const name of result.skipped)
         warn('Codex MCP servers from Apps: ' + name + ' is already in config.toml in another form, left as it is');

package/dist/guest/setup/browser-gpu.js

@@ -1,18 +1,21 @@
-// Browsers in the sandbox draw without the GPU (Edge and Chrome machine policy, written every boot). With sandbox.vGpu
-// the sandbox shares this PC's graphics card through one virtual GPU: a browser's GPU process starting next to a game
-// or other Direct3D program there has taken the whole sandbox down. Pages still render, WebGL included, in software;
-// programs that need the GPU keep it. Without vGPU nothing changes (there is no GPU to use).
+// Browsers in the sandbox (Edge and Chrome machine policy, written every boot) draw without the GPU, and download to
+// C:\AgentData\downloads, which is kept between sandboxes. With sandbox.vGpu the sandbox shares this PC's graphics card
+// through one virtual GPU: a browser's GPU process starting next to a game or other Direct3D program there has taken
+// the whole sandbox down. Pages still render, WebGL included, in software; programs that need the GPU keep it. Without
+// vGPU there is no GPU to use, so only the download folder matters.
+import path from 'node:path';
 import { SYSTEM } from '../../shared/system.js';
-import { dryRun, isWin } from '../runtime/paths.js';
+import { browserPolicies } from '../../shared/browser-policy.js';
+import { dataDir, dryRun, isWin } from '../runtime/paths.js';
 import { exec } from '../runtime/process.js';
 import { log } from '../runtime/log.js';
-const POLICY_KEYS = ['HKLM\\SOFTWARE\\Policies\\Microsoft\\Edge', 'HKLM\\SOFTWARE\\Policies\\Google\\Chrome'];
+import { mkdirp } from '../runtime/fs.js';
 export function keepBrowsersOffGpu() {
     if (dryRun || !isWin)
         return;
-    for (const key of POLICY_KEYS)
-        exec(SYSTEM.reg(), ['add', key, '/v', 'HardwareAccelerationModeEnabled', '/t', 'REG_DWORD', '/d', '0', '/f'], {
-            stdio: 'ignore',
-        });
-    log('Browsers draw without the GPU (Edge and Chrome policy).');
+    const downloads = path.join(dataDir, 'downloads');
+    mkdirp(downloads);
+    for (const p of browserPolicies({ downloads }))
+        exec(SYSTEM.reg(), ['add', p.key, '/v', p.name, '/t', p.type, '/d', p.data, '/f'], { stdio: 'ignore' });
+    log('Browsers draw without the GPU and download to ' + downloads + '.');
 }

package/dist/guest/setup/github-token.js

@@ -1,6 +1,6 @@
-// The GitHub token the host handed over (github.shareToken, only with git access "full"): gh logs in with it in a
-// folder on the sandbox's own disk (gone with the sandbox, never in the persistent state), and https git asks gh. The
-// token goes to gh on stdin, never in an argument, a file of ours or a log line.
+// The GitHub token the host handed over (github.shareToken or github.usePcLogin, only with git access "full"): gh logs
+// in with it in a folder on the sandbox's own disk (gone with the sandbox, never in the persistent state), and https
+// git asks gh. The token goes to gh on stdin, never in an argument, a file of ours or a log line.
 import fs from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { ghLoginCommand, ghOutputText, ghSetupGitCommand } from '../../shared/github/index.js';
@@ -61,5 +61,5 @@ export function loginGithub(token, env) {
         addMachineEnvironment({ GH_CONFIG_DIR: env.GH_CONFIG_DIR }, []);
         throw e;
     }
-    log('gh and https git to github.com use the GitHub token from your PC (github.shareToken); the agent can read it.');
+    log('gh and https git to github.com use the GitHub login from your PC (github.shareToken or github.usePcLogin); the agent can read it.');
 }

package/dist/guest/setup/headroom.js

@@ -5,6 +5,7 @@ import fs from 'node:fs';
 import http from 'node:http';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
+import { rotateLog } from '../../shared/io/index.js';
 import { HEADROOM_PORT, headroomArgs, headroomEnv, headroomUrl } from '../../shared/apps/index.js';
 import { logsDir } from '../runtime/paths.js';
 import { portOpen, waitForPort } from '../runtime/ports.js';
@@ -12,6 +13,8 @@ import { log } from '../runtime/log.js';
 import { installedAddon } from './agent-addons.js';
 /** The proxy's log (it redacts keys and tokens in what it logs). */
 export const HEADROOM_LOG = path.join(logsDir, 'headroom.log');
+/** The proxy logs every request and the file lives on the data disk: past this it is kept as headroom.log.1. */
+const HEADROOM_LOG_LIMIT = 20 * 1024 * 1024;
 /** Whether Headroom's own health check answers on the port (not some other program that took it). */
 function answersAsHeadroom(port) {
     return new Promise((resolve) => {
@@ -53,6 +56,7 @@ async function startProxy(env) {
         return false;
     if (await portOpen(HEADROOM_PORT))
         return true;
+    rotateLog(HEADROOM_LOG, HEADROOM_LOG_LIMIT);
     const out = fs.openSync(HEADROOM_LOG, 'a');
     try {
         spawn(exe, headroomArgs(HEADROOM_PORT), {

package/dist/guest/setup/unity-agent.d.ts

@@ -0,0 +1,11 @@
+export interface UnityAgentInput {
+    readonly unityExe: string;
+    readonly projectPath: string | null;
+    readonly mcp: boolean;
+    readonly skills: boolean;
+}
+/** Sets up what is asked; returns the MCP server's name when it was registered and whether the skills were synced. */
+export declare function setupUnityAgentTools(i: UnityAgentInput): Promise<{
+    mcp: string | null;
+    skills: boolean;
+}>;

package/dist/guest/setup/unity-agent.js

@@ -0,0 +1,36 @@
+// Unity for the agents: the Unity CLI's MCP server (sbx-unity) and its skills in the sandbox's Claude Code and Codex.
+// The project is never changed. A failure is a warning: the editor itself still works without the agent tools.
+import path from 'node:path';
+import { UNITY_CLI_ENV, UNITY_MCP_NAME, unityCliMcpServer } from '../../shared/unity/index.js';
+import { execAsync } from '../runtime/process.js';
+import { log, warn } from '../runtime/log.js';
+import { claudeDir, session, stateDir } from '../runtime/session.js';
+import { setEngineMcp, writeAddonMcpServers } from './addon-mcp.js';
+/** Syncs Unity's skills for one agent, with that agent's home folder in its variable; false on failure. */
+async function syncSkills(unityExe, agent) {
+    const home = agent === 'claude' ? { CLAUDE_CONFIG_DIR: claudeDir } : { CODEX_HOME: path.join(stateDir, 'codex') };
+    try {
+        await execAsync(unityExe, ['skill', 'sync', agent], { env: { ...process.env, ...UNITY_CLI_ENV, ...home } });
+        return true;
+    }
+    catch (e) {
+        warn('Unity skills for ' + agent + ' were not synced: ' + (e instanceof Error ? e.message : String(e)));
+        return false;
+    }
+}
+/** Sets up what is asked; returns the MCP server's name when it was registered and whether the skills were synced. */
+export async function setupUnityAgentTools(i) {
+    setEngineMcp(UNITY_MCP_NAME, i.mcp ? unityCliMcpServer(i.unityExe, i.projectPath) : null);
+    const names = writeAddonMcpServers();
+    const mcp = names.includes(UNITY_MCP_NAME) ? UNITY_MCP_NAME : null;
+    let skills = false;
+    if (i.skills) {
+        const results = [await syncSkills(i.unityExe, 'claude')];
+        if (session.agents?.codex)
+            results.push(await syncSkills(i.unityExe, 'codex'));
+        skills = results.some(Boolean);
+        if (skills)
+            log('Unity skills synced for the agents');
+    }
+    return { mcp, skills };
+}

package/dist/guest/toolchains/engines/epic-launcher.d.ts

@@ -0,0 +1,26 @@
+import { type LauncherEntry } from '../../../shared/unreal/index.js';
+/** The launcher's program (launcher 17+ is 64-bit; older ones were in Win32). */
+export declare function launcherExe(): string | null;
+/** Downloads the launcher's MSI ahead of the install (once). */
+export declare function fetchLauncher(): Promise<void>;
+/** Installs the launcher when this sandbox does not have it yet (the MSI, quietly). Returns its program. */
+export declare function ensureLauncher(): Promise<string>;
+export interface LauncherPlaceResult {
+    readonly installLocation: string | null;
+    readonly problem: string | null;
+    readonly freeBytes: number | null;
+    readonly needBytes: number;
+}
+/** Points the launcher's default install folder at tools\unreal\engines (every settings file it may read). */
+export declare function placeEngines(persist: boolean): LauncherPlaceResult;
+/** The saved LauncherInstalled.dat entries of engines in tools\unreal\engines whose folder is still there. */
+export declare function savedEntries(): LauncherEntry[];
+/** Puts the saved manifests back where the launcher reads them; the engine folders they name. */
+export declare function restoreLauncherItems(): string[];
+/** Merges these entries into the launcher's LauncherInstalled.dat (foreign entries kept). */
+export declare function writeLauncherEntries(entries: readonly LauncherEntry[]): void;
+/**
+ * Saves what the launcher knows about engines it installed into tools\unreal\engines (new or changed manifests, its
+ * LauncherInstalled.dat entries). Cheap: a few small files. Returns whether something new was saved.
+ */
+export declare function saveLauncherState(): boolean;

package/dist/guest/toolchains/engines/epic-launcher.js

@@ -0,0 +1,127 @@
+// The Epic Games Launcher in the sandbox: installed every boot from its MSI (downloaded once into tools\unreal, run
+// only when Epic's signature checks out; a sandbox loses Program Files), pointed at the data disk for engines
+// (GameUserSettings.ini [Launcher] DefaultAppInstallLocation, in the encoding the file has), and given back what it
+// knew about the engines it installed there: their .item manifests and LauncherInstalled.dat entries are saved on the
+// data disk while the sandbox runs (the daemon calls saveLauncherState) and put back at the next boot.
+import fs from 'node:fs';
+import path from 'node:path';
+import { z } from 'zod';
+import { readBoundedFile } from '../../../shared/io/bounded.js';
+import { readValid, writeJsonAtomic } from '../../../shared/io/json.js';
+import { SYSTEM } from '../../../shared/system.js';
+import { enginePlaceProblem, ENGINE_NEED_BYTES, entriesUnder, launcherInstalledFile, launcherManifestsDir, launcherSettingsFiles, MAX_LAUNCHER_FILE_BYTES, mergeLauncherInstalled, restoreItems, saveItems, setLauncherInstallLocation, } from '../../../shared/unreal/index.js';
+import { errMsg } from '../../../core/util/errors.js';
+import { runInstaller } from '../../runtime/pools.js';
+import { exists, mkdirp } from '../../runtime/fs.js';
+import { log } from '../../runtime/log.js';
+import { SIGNERS, signedInstaller } from '../installers.js';
+import { ENGINES_DIR, SAVED_DIR, UNREAL_DIR } from './unreal-status.js';
+const MSI_URL = 'https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi';
+const MSI_FILE = path.join(UNREAL_DIR, 'EpicGamesLauncherInstaller.msi');
+const SAVED_MANIFESTS = path.join(SAVED_DIR, 'Manifests');
+const SAVED_ENTRIES = path.join(SAVED_DIR, 'LauncherInstalled.json');
+const programData = () => process.env.ProgramData ?? 'C:\\ProgramData';
+const localAppData = () => process.env.LOCALAPPDATA ?? '';
+/** The launcher's program (launcher 17+ is 64-bit; older ones were in Win32). */
+export function launcherExe() {
+    const root = path.join(process.env['ProgramFiles(x86)'] ?? 'C:\\Program Files (x86)', 'Epic Games', 'Launcher');
+    for (const arch of ['Win64', 'Win32']) {
+        const exe = path.join(root, 'Portal', 'Binaries', arch, 'EpicGamesLauncher.exe');
+        if (exists(exe))
+            return exe;
+    }
+    return null;
+}
+/** Downloads the launcher's MSI ahead of the install (once). */
+export async function fetchLauncher() {
+    if (!launcherExe())
+        await launcherMsi();
+}
+const launcherMsi = () => signedInstaller(MSI_URL, MSI_FILE, 'the Epic Games Launcher (~250 MB once)', SIGNERS.epic);
+/** Installs the launcher when this sandbox does not have it yet (the MSI, quietly). Returns its program. */
+export async function ensureLauncher() {
+    const have = launcherExe();
+    if (have)
+        return have;
+    const msi = await launcherMsi();
+    log('Installing the Epic Games Launcher ...');
+    const code = await runInstaller(SYSTEM.msiexec(), ['/i', msi, '/qn', '/norestart']);
+    const exe = launcherExe();
+    if ((code !== 0 && code !== 3010) || !exe)
+        throw new Error('the Epic Games Launcher installer failed (msiexec exit ' + code + ')');
+    return exe;
+}
+/** Points the launcher's default install folder at tools\unreal\engines (every settings file it may read). */
+export function placeEngines(persist) {
+    let error;
+    if (persist)
+        try {
+            mkdirp(ENGINES_DIR);
+            for (const file of launcherSettingsFiles(localAppData()))
+                setLauncherInstallLocation(file, ENGINES_DIR);
+        }
+        catch (e) {
+            error = "could not write the launcher's settings (" + errMsg(e) + ')';
+        }
+    else
+        error = 'toolchains.unreal.persistEngines is off';
+    const set = persist && !error;
+    const { problem, freeBytes } = enginePlaceProblem(set ? { set } : { set, error: error }, ENGINES_DIR);
+    return { installLocation: set ? ENGINES_DIR : null, problem, freeBytes, needBytes: ENGINE_NEED_BYTES };
+}
+const SavedEntriesSchema = z.object({
+    entries: z
+        .array(z.object({
+        InstallLocation: z.string().max(1024),
+        NamespaceId: z.string().max(200),
+        ItemId: z.string().max(200),
+        ArtifactId: z.string().max(200),
+        AppVersion: z.string().max(200),
+        AppName: z.string().max(200),
+    }))
+        .max(64),
+});
+/** The saved LauncherInstalled.dat entries of engines in tools\unreal\engines whose folder is still there. */
+export function savedEntries() {
+    return (readValid(SavedEntriesSchema, SAVED_ENTRIES)?.entries ?? []).filter((e) => e.InstallLocation.toLowerCase().startsWith(ENGINES_DIR.toLowerCase() + '\\') && exists(e.InstallLocation));
+}
+/** Puts the saved manifests back where the launcher reads them; the engine folders they name. */
+export function restoreLauncherItems() {
+    return restoreItems(SAVED_MANIFESTS, launcherManifestsDir(programData()), ENGINES_DIR, exists);
+}
+/** Merges these entries into the launcher's LauncherInstalled.dat (foreign entries kept). */
+export function writeLauncherEntries(entries) {
+    if (!entries.length)
+        return;
+    const file = launcherInstalledFile(programData());
+    const bytes = readBoundedFile(file, MAX_LAUNCHER_FILE_BYTES);
+    if (!bytes && fs.existsSync(file))
+        throw new Error(file + ' is too big to read');
+    const next = mergeLauncherInstalled(bytes ? bytes.toString('utf8') : null, entries);
+    mkdirp(path.dirname(file));
+    fs.writeFileSync(file, next, 'utf8');
+}
+/**
+ * Saves what the launcher knows about engines it installed into tools\unreal\engines (new or changed manifests, its
+ * LauncherInstalled.dat entries). Cheap: a few small files. Returns whether something new was saved.
+ */
+export function saveLauncherState() {
+    if (!exists(ENGINES_DIR))
+        return false;
+    const items = saveItems(launcherManifestsDir(programData()), SAVED_MANIFESTS, ENGINES_DIR);
+    const bytes = readBoundedFile(launcherInstalledFile(programData()), MAX_LAUNCHER_FILE_BYTES);
+    const live = bytes ? entriesUnder(bytes.toString('utf8'), ENGINES_DIR) : [];
+    const old = readValid(SavedEntriesSchema, SAVED_ENTRIES)?.entries ?? [];
+    const merged = [
+        ...old.filter((o) => !live.some((l) => l.InstallLocation.toLowerCase() === o.InstallLocation.toLowerCase())),
+        ...live,
+    ].filter((e) => exists(e.InstallLocation));
+    const changed = JSON.stringify(merged) !== JSON.stringify(old);
+    if (changed) {
+        mkdirp(SAVED_DIR);
+        writeJsonAtomic(SAVED_ENTRIES, { entries: merged.slice(0, 64) });
+    }
+    if (items.length || changed)
+        log('Unreal: saved what the Epic Games Launcher knows about its engines on the data disk');
+    return items.length > 0 || changed;
+}

package/dist/guest/toolchains/engines/unity-cli.d.ts

@@ -0,0 +1,24 @@
+export interface UnityCli {
+    readonly exe: string;
+    readonly version: string;
+}
+export interface UnityRun {
+    readonly code: number;
+    readonly stdout: string;
+}
+export interface UnityRunOptions {
+    /** TEMP and TMP for the run (inside the staging folder of an install). */
+    readonly temp?: string;
+    readonly cwd?: string;
+    readonly timeoutMs?: number;
+    /** Extra variables (the asset cache). */
+    readonly env?: Readonly<Record<string, string>>;
+}
+/** The pinned Unity CLI on the data disk, downloaded when it is not there yet ("latest" asks the manifest first). */
+export declare function ensureUnityCli(version: string): Promise<UnityCli>;
+/** Downloads the CLI ahead of its step; a failure is ignored (the step downloads again). */
+export declare function prefetchUnityCli(version: string): Promise<void>;
+/** Runs the CLI without blocking; the exit code and the start of its output (at most 1 MB). Never throws on a code. */
+export declare function runUnityCli(exe: string, args: readonly string[], o?: UnityRunOptions): Promise<UnityRun>;
+/** runUnityCli that throws with the end of the output when the exit code is not 0. */
+export declare function runUnityCliChecked(exe: string, args: readonly string[], o?: UnityRunOptions): Promise<string>;

package/dist/guest/toolchains/engines/unity-cli.js

@@ -0,0 +1,74 @@
+// The Unity CLI (`unity`): its pinned build downloaded once into tools\unity\cli\<version> (checked against the SHA-256
+// Unity publishes, and its signature when it has one), and the way every other Unity step runs it.
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { fetchBounded, downloader } from '../../../shared/download/index.js';
+import { CliManifestSchema, cliManifestUrl, pickCliBinary, UNITY_CLI_ENV, } from '../../../shared/unity/index.js';
+import { log } from '../../runtime/log.js';
+import { net } from '../../runtime/pools.js';
+import { ensurePersisted } from '../persisted.js';
+import { arch } from '../tool-env.js';
+const MB = 1024 * 1024;
+const MAX_MANIFEST_BYTES = 256 * 1024;
+const MAX_OUTPUT_BYTES = 1024 * 1024;
+/** The binary the manifest of a CLI version names for this CPU. */
+async function resolveCli(version) {
+    const text = await net.run(() => fetchBounded(cliManifestUrl(version), MAX_MANIFEST_BYTES));
+    const parsed = CliManifestSchema.safeParse(JSON.parse(text));
+    const binary = parsed.success ? pickCliBinary(parsed.data, arch) : null;
+    if (!binary)
+        throw new Error('the Unity CLI manifest for ' + version + ' has no usable Windows build');
+    return binary;
+}
+/** The pinned Unity CLI on the data disk, downloaded when it is not there yet ("latest" asks the manifest first). */
+export async function ensureUnityCli(version) {
+    const binary = await resolveCli(version);
+    const installed = await ensurePersisted({
+        name: 'unity/cli',
+        version: binary.version,
+        needBytes: 200 * MB,
+        marker: 'unity.exe',
+        what: 'Unity CLI ' + binary.version,
+        keepVersions: 2,
+    }, async (staging) => {
+        log('Downloading the Unity CLI ' + binary.version + ' ...');
+        // The CLI is not known to be signed: the SHA-256 from Unity's manifest is the check.
+        await downloader.file(binary.url, path.join(staging, 'unity.exe'), { sha256: binary.sha256 });
+    });
+    return { exe: path.join(installed.dir, 'unity.exe'), version: binary.version };
+}
+/** Downloads the CLI ahead of its step; a failure is ignored (the step downloads again). */
+export async function prefetchUnityCli(version) {
+    await ensureUnityCli(version);
+}
+/** Runs the CLI without blocking; the exit code and the start of its output (at most 1 MB). Never throws on a code. */
+export function runUnityCli(exe, args, o = {}) {
+    return new Promise((resolve, reject) => {
+        const temp = o.temp ? { TEMP: o.temp, TMP: o.temp } : {};
+        const child = spawn(exe, [...args], {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            windowsHide: true,
+            ...(o.cwd ? { cwd: o.cwd } : {}),
+            env: { ...process.env, ...UNITY_CLI_ENV, ...temp, ...(o.env ?? {}) },
+            ...(o.timeoutMs ? { timeout: o.timeoutMs } : {}),
+        });
+        let stdout = '';
+        const take = (chunk) => {
+            if (stdout.length < MAX_OUTPUT_BYTES)
+                stdout += chunk.slice(0, MAX_OUTPUT_BYTES - stdout.length);
+        };
+        child.stdout.setEncoding('utf8');
+        child.stderr.setEncoding('utf8');
+        child.stdout.on('data', take);
+        child.stderr.on('data', take);
+        child.once('error', reject);
+        child.once('close', (code) => resolve({ code: code ?? -1, stdout }));
+    });
+}
+/** runUnityCli that throws with the end of the output when the exit code is not 0. */
+export async function runUnityCliChecked(exe, args, o = {}) {
+    const r = await runUnityCli(exe, args, o);
+    if (r.code !== 0)
+        throw new Error('unity ' + args.slice(0, 2).join(' ') + ' failed with exit code ' + r.code + ': ' + r.stdout.trim().slice(-400));
+    return r.stdout;
+}

package/dist/guest/toolchains/engines/unity-hub.d.ts

@@ -0,0 +1,2 @@
+/** The Hub's program on the data disk, installed there when it is not (only with `hub` on). */
+export declare function ensureUnityHub(): Promise<string>;

package/dist/guest/toolchains/engines/unity-hub.js

@@ -0,0 +1,27 @@
+// Unity Hub (toolchains.unity.hub): kept on the data disk (tools\unity\hub\3), installed by its signed installer
+// unpacked there. For signing in to Unity Personal and installing editors by hand.
+import path from 'node:path';
+import { runInstaller } from '../../runtime/pools.js';
+import { shortcuts } from '../../apps/shortcuts.js';
+import { exists } from '../../runtime/fs.js';
+import { log } from '../../runtime/log.js';
+import { SIGNERS, signedInstaller } from '../installers.js';
+import { ensurePersisted } from '../persisted.js';
+import { UNITY_DIR } from './unity-status.js';
+const HUB_URL = 'https://public-cdn.cloud.unity3d.com/hub/prod/UnityHubSetup.exe';
+const HUB_MARKER = 'Unity Hub.exe';
+const GB = 1024 ** 3;
+/** The Hub's program on the data disk, installed there when it is not (only with `hub` on). */
+export async function ensureUnityHub() {
+    const setup = await signedInstaller(HUB_URL, path.join(UNITY_DIR, 'UnityHubSetup.exe'), 'Unity Hub (~150 MB once)', SIGNERS.unity);
+    const installed = await ensurePersisted({ name: 'unity/hub', version: '3', needBytes: 2 * GB, marker: HUB_MARKER, what: 'Unity Hub', keepVersions: 1 }, async (staging) => {
+        log('Installing Unity Hub ...');
+        const code = await runInstaller(setup, ['/S', '/D=' + staging]);
+        if (code !== 0)
+            throw new Error('the Unity Hub installer failed (exit ' + code + ')');
+    });
+    const exe = path.join(installed.dir, HUB_MARKER);
+    if (exists(exe))
+        shortcuts([{ name: 'Unity Hub', exe }]);
+    return exe;
+}

package/dist/guest/toolchains/engines/unity-release.d.ts

@@ -1,15 +1,4 @@
-export interface UnityDownload {
-    /** "editor", or a module id (android, webgl, windows-il2cpp, ios). */
-    readonly id: string;
-    readonly url: string;
-    /** The SRI hash (sha384-... or sha256-...). */
-    readonly integrity: string | null;
-    readonly sizeBytes: number | null;
-}
-export interface UnityRelease {
-    readonly version: string;
-    readonly changeset: string | null;
-    readonly downloads: readonly UnityDownload[];
-}
-/** The release of one editor version (6000.0.32f1), or null when Unity does not list it. */
-export declare function findUnityRelease(_version: string): Promise<UnityRelease | null>;
+import { type UnityRelease } from '../../../shared/unity/index.js';
+export type { UnityRelease };
+/** The release of one editor version (6000.0.58f2), or null when Unity does not list it or answers oddly. */
+export declare function findUnityRelease(version: string): Promise<UnityRelease | null>;

package/dist/guest/toolchains/engines/unity-release.js

@@ -1,6 +1,18 @@
-// Unity's release API (services.api.unity.com/unity/editor/release/v1/releases): the editor installer and module
-// downloads of one version, each with its SRI integrity hash. Not available yet.
-/** The release of one editor version (6000.0.32f1), or null when Unity does not list it. */
-export async function findUnityRelease(_version) {
-    return null;
+// Unity's release API (services.api.unity.com): the editor installer, its changeset and its modules for one version.
+// The answer is read with a size limit and checked by shared/unity/release.ts.
+import { fetchBounded } from '../../../shared/download/index.js';
+import { pickRelease, releaseUrl } from '../../../shared/unity/index.js';
+const MAX_ANSWER_BYTES = 2 * 1024 * 1024;
+/** The release of one editor version (6000.0.58f2), or null when Unity does not list it or answers oddly. */
+export async function findUnityRelease(version) {
+    const text = await fetchBounded(releaseUrl(version), MAX_ANSWER_BYTES);
+    let json;
+    try {
+        json = JSON.parse(text);
+    }
+    catch {
+        return null; // Not JSON: no release.
+    }
+    const release = pickRelease(json);
+    return release && release.version === version ? release : null;
 }

package/dist/guest/toolchains/engines/unity-status.d.ts

@@ -0,0 +1,11 @@
+import { type UnityStatus } from '../../../shared/unity/index.js';
+export declare const UNITY_DIR: string;
+/** The Unity CLI, one folder per version (unity.exe). */
+export declare const CLI_DIR: string;
+/** The editors on the data disk: one folder per version (Editor\Unity.exe). */
+export declare const EDITORS_DIR: string;
+/** Asset Store downloads made in the sandbox (assetCache "persisted"). */
+export declare const ASSET_DIR: string;
+export declare function readUnityStatus(): UnityStatus;
+/** Changes the status with `change` and writes it (whole, atomically). */
+export declare function updateUnityStatus(change: (s: UnityStatus) => UnityStatus): UnityStatus;