windows-development-sandbox 1.25.0 → 1.27.0

package/dist/shared/accounts/payloads.js

@@ -33,16 +33,24 @@ export const SteamPayloadSchema = z.strictObject({
     client: base64(256 * KB).optional(),
 });
 /** A Unity licence file (Unity_lic.ulf), and the Unity ID to sign in with when it has to be made again. */
-export const UnityPayloadSchema = z.strictObject({
+export const UnityPayloadSchema = z
+    .strictObject({
     ulf: z
         .string()
         .min(1)
         .max(128 * KB)
         .optional(),
+    /** The named-user licence (UnityEntitlementLicense.xml) a Unity sign-in makes. */
+    entitlement: z
+        .string()
+        .min(1)
+        .max(128 * KB)
+        .optional(),
     email: z.string().email().max(256).optional(),
     password: secretText(1024).optional(),
     serial: secretText(64).optional(),
-});
+})
+    .refine((p) => Object.keys(p).length > 0, 'empty Unity sign-in');
 /** A FiveM / RedM server licence key from the Cfx.re keymaster, and an optional Steam Web API key. */
 export const CfxPayloadSchema = z.strictObject({
     licenseKey: z
@@ -125,6 +133,8 @@ export const CometCookieSchema = z.strictObject({
 export const CometPayloadSchema = z.strictObject({
     cookies: z.array(CometCookieSchema).min(1).max(MAX_COMET_COOKIES),
 });
+/** The Perplexity desktop app's sign-in: the same perplexity.ai cookies as Comet's. */
+export const PerplexityAppPayloadSchema = CometPayloadSchema;
 export const PAYLOADS = {
     epic: EpicPayloadSchema,
     steam: SteamPayloadSchema,
@@ -136,6 +146,7 @@ export const PAYLOADS = {
     appstore: AppstorePayloadSchema,
     perplexity: PerplexityPayloadSchema,
     comet: CometPayloadSchema,
+    perplexityapp: PerplexityAppPayloadSchema,
 };
 /** The secrets-file field: the sign-ins this launch hands over, each optional. */
 export const ServiceAccountsSchema = z.strictObject({
@@ -149,6 +160,7 @@ export const ServiceAccountsSchema = z.strictObject({
     appstore: AppstorePayloadSchema.optional(),
     perplexity: PerplexityPayloadSchema.optional(),
     comet: CometPayloadSchema.optional(),
+    perplexityapp: PerplexityAppPayloadSchema.optional(),
 });
 /** A launch's id (generate.ts: "<ms>-<6 hex>"). */
 export const LaunchIdSchema = z.string().regex(/^[A-Za-z0-9-]{1,64}$/);

package/dist/shared/apps/associations.d.ts

@@ -0,0 +1,7 @@
+import type { RegistryValue } from '../unreal/engines.js';
+export declare const ASSOCIATIONS: {
+    readonly f3d: readonly [".fbx", ".glb", ".gltf", ".obj", ".stl", ".ply", ".3ds", ".usd", ".usdz"];
+    readonly nomacs: readonly [".tga", ".psd", ".dds", ".exr"];
+};
+/** The registry values that make `appId` open its file types; no values for an app that opens none. */
+export declare function associationPlan(appId: string, exe: string): RegistryValue[];

package/dist/shared/apps/associations.js

@@ -0,0 +1,26 @@
+// Which apps open which game-asset files when you double-click them (per user, written to the registry each boot
+// because the sandbox's registry is new every time). Pure: the guest writes the plan with set-registry-values.ps1.
+import path from 'node:path';
+export const ASSOCIATIONS = {
+    f3d: ['.fbx', '.glb', '.gltf', '.obj', '.stl', '.ply', '.3ds', '.usd', '.usdz'],
+    nomacs: ['.tga', '.psd', '.dds', '.exr'],
+};
+const NAMES = { f3d: 'F3D', nomacs: 'nomacs' };
+/** The registry values that make `appId` open its file types; no values for an app that opens none. */
+export function associationPlan(appId, exe) {
+    if (!Object.hasOwn(ASSOCIATIONS, appId))
+        return [];
+    const id = appId;
+    if (!path.win32.isAbsolute(exe) || /["\r\n]/.test(exe))
+        throw new Error('not a program path: ' + exe);
+    const classes = 'Software\\Classes';
+    const type = classes + '\\Sandbox.' + id;
+    const quoted = '"' + exe + '"';
+    const v = (key, value) => ({ hive: 'HKCU', key, name: '', value });
+    return [
+        ...ASSOCIATIONS[id].map((ext) => v(classes + '\\' + ext, 'Sandbox.' + id)),
+        v(type, NAMES[id] + ' file'),
+        v(type + '\\DefaultIcon', quoted + ',0'),
+        v(type + '\\shell\\open\\command', quoted + ' "%1"'),
+    ];
+}

package/dist/shared/apps/catalogue-agents-web.d.ts

@@ -9,6 +9,16 @@ export declare const BROWSER_USE_VERSION = "0.13.14";
 export declare const PERPLEXITY_COMPUTER_MCP_URL = "https://www.perplexity.ai/rest/computer/mcp";
 /** Comet's Windows installer: a redirect to the current release (no checksum is published; its signer is checked). */
 export declare const COMET_DOWNLOAD_URL = "https://www.perplexity.ai/rest/browser/download?platform=win_x64&channel=stable";
-/** Who signs Comet: Perplexity AI, Inc., with an EV code-signing certificate from GlobalSign. */
+/**
+ * Who signs Comet: Perplexity AI, Inc., with an EV code-signing certificate from GlobalSign. Windows reports the
+ * subject with E=<contact address> first (E=..., CN="PERPLEXITY AI, INC.", O=...), so CN is not at the start.
+ */
 export declare const COMET_SIGNER: AppSigner;
+/**
+ * The Perplexity desktop app is Store-only (its old installer is gone): product 9P9XG917PWCJ, an MSIX of about 300 MB.
+ * The package is fetched on this PC with your own Store tooling and installed in the sandbox with Add-AppxPackage.
+ */
+export declare const PERPLEXITY_DESKTOP_PRODUCT_ID = "9P9XG917PWCJ";
+export declare const PERPLEXITY_DESKTOP_PACKAGE = "PerplexityAI.PerplexityApp";
+export declare const PERPLEXITY_DESKTOP_FAMILY = "PerplexityAI.PerplexityApp_3jh4kjrg4dzr2";
 export declare const AGENTS_WEB_APPS: readonly AppEntry[];

package/dist/shared/apps/catalogue-agents-web.js

@@ -7,11 +7,21 @@ export const BROWSER_USE_VERSION = '0.13.14';
 export const PERPLEXITY_COMPUTER_MCP_URL = 'https://www.perplexity.ai/rest/computer/mcp';
 /** Comet's Windows installer: a redirect to the current release (no checksum is published; its signer is checked). */
 export const COMET_DOWNLOAD_URL = 'https://www.perplexity.ai/rest/browser/download?platform=win_x64&channel=stable';
-/** Who signs Comet: Perplexity AI, Inc., with an EV code-signing certificate from GlobalSign. */
+/**
+ * Who signs Comet: Perplexity AI, Inc., with an EV code-signing certificate from GlobalSign. Windows reports the
+ * subject with E=<contact address> first (E=..., CN="PERPLEXITY AI, INC.", O=...), so CN is not at the start.
+ */
 export const COMET_SIGNER = {
-    subject: ['^CN="?PERPLEXITY AI, INC\\.?"?(,|$)', '(^|, )O="?PERPLEXITY AI, INC\\.?"?(,|$)'],
+    subject: ['(^|, )CN="?PERPLEXITY AI, INC\\.?"?(,|$)', '(^|, )O="?PERPLEXITY AI, INC\\.?"?(,|$)'],
     issuer: ['^CN=GlobalSign GCC R45 EV CodeSigning CA 2020(,|$)'],
 };
+/**
+ * The Perplexity desktop app is Store-only (its old installer is gone): product 9P9XG917PWCJ, an MSIX of about 300 MB.
+ * The package is fetched on this PC with your own Store tooling and installed in the sandbox with Add-AppxPackage.
+ */
+export const PERPLEXITY_DESKTOP_PRODUCT_ID = '9P9XG917PWCJ';
+export const PERPLEXITY_DESKTOP_PACKAGE = 'PerplexityAI.PerplexityApp';
+export const PERPLEXITY_DESKTOP_FAMILY = 'PerplexityAI.PerplexityApp_3jh4kjrg4dzr2';
 /** Microsoft Edge, already in every sandbox: the browser Chrome DevTools MCP starts. */
 const EDGE_EXE = 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe';
 export const AGENTS_WEB_APPS = [
@@ -59,6 +69,22 @@ export const AGENTS_WEB_APPS = [
         signer: COMET_SIGNER,
         userOnly: true,
     },
+    {
+        id: 'perplexity-desktop',
+        name: 'Perplexity (desktop app)',
+        category: 'agents',
+        about: "Perplexity's desktop app, with Perplexity Computer, from the Microsoft Store. The package comes from this PC (winget with your own Microsoft Store access) and is kept on the data disk; the sandbox installs it on every boot. With accounts.perplexityapp.share on, your sign-in made in a sandbox is kept for the next ones (it cannot be copied from this PC). It acts on what it reads: use it only on what you would let it act on.",
+        size: '300 MB',
+        source: {
+            store: {
+                productId: PERPLEXITY_DESKTOP_PRODUCT_ID,
+                packageName: PERPLEXITY_DESKTOP_PACKAGE,
+                family: PERPLEXITY_DESKTOP_FAMILY,
+            },
+        },
+        exe: '',
+        userOnly: true,
+    },
     {
         id: 'comet-mcp',
         name: 'Comet MCP',

package/dist/shared/apps/catalogue-gamedev.d.ts

@@ -1,2 +1,5 @@
 import type { AppEntry } from './catalogue.js';
+/** Pinned packages, installed from the lock files in sandbox\addons\<id> (renewing them: docs/toolchains.md). */
+export declare const UNITY_MCP_VERSION = "10.3.0";
+export declare const OPENUPM_CLI_VERSION = "4.5.3";
 export declare const GAMEDEV_APPS: readonly AppEntry[];

package/dist/shared/apps/catalogue-gamedev.js

@@ -1 +1,102 @@
-export const GAMEDEV_APPS = [];
+/** Pinned packages, installed from the lock files in sandbox\addons\<id> (renewing them: docs/toolchains.md). */
+export const UNITY_MCP_VERSION = '10.3.0';
+export const OPENUPM_CLI_VERSION = '4.5.3';
+export const GAMEDEV_APPS = [
+    {
+        id: 'krita',
+        name: 'Krita',
+        category: 'gamedev',
+        about: 'Painting and texture editor (PSD, layers, brushes), checked against the SHA-256 download.kde.org publishes.',
+        size: '450 MB',
+        source: { resolve: 'krita' },
+        exe: 'krita.exe',
+        needs: ['mesa'],
+    },
+    {
+        id: 'inkscape',
+        name: 'Inkscape',
+        category: 'gamedev',
+        about: 'Vector graphics for UI, icons and 2D art (SVG), checked against the SHA-256 inkscape.org publishes.',
+        size: '400 MB',
+        source: { resolve: 'inkscape' },
+        exe: 'inkscape.exe',
+        needs: ['7zip'],
+    },
+    {
+        id: 'audacity',
+        name: 'Audacity',
+        category: 'gamedev',
+        about: 'Records and edits sound effects and music (WAV, OGG, FLAC).',
+        size: '80 MB',
+        source: { github: 'audacity/audacity', asset: '^audacity-win-[\\d.]+-(?:64bit\\.zip|x86_64\\.7z)$' },
+        exe: 'Audacity.exe',
+        needs: ['7zip'],
+    },
+    {
+        id: 'renderdoc',
+        name: 'RenderDoc',
+        category: 'gamedev',
+        about: "Captures a frame of a game (Unreal's -d3d12/-vulkan builds) to inspect every draw call, texture and shader. Needs the sandbox's GPU (vGPU) for live captures.",
+        size: '70 MB',
+        source: { resolve: 'renderdoc' },
+        exe: 'qrenderdoc.exe',
+    },
+    {
+        id: 'f3d',
+        name: 'F3D',
+        category: 'gamedev',
+        about: 'Fast 3D viewer (FBX, glTF/GLB, OBJ, STL, PLY, 3DS, USD); renders still previews from the command line.',
+        size: '100 MB',
+        source: { github: 'f3d-app/f3d', asset: '^F3D-[\\d.]+-Windows-x86_64\\.zip$' },
+        exe: 'f3d.exe',
+        needs: ['mesa'],
+    },
+    {
+        id: 'imagemagick',
+        name: 'ImageMagick',
+        category: 'gamedev',
+        about: 'Converts and thumbnails textures (TGA, PSD, DDS, EXR, HDR) and builds contact sheets (magick montage).',
+        size: '150 MB',
+        source: { github: 'ImageMagick/ImageMagick', asset: '^ImageMagick-[\\d.]+-\\d+-portable-Q16-HDRI-x64\\.7z$' },
+        exe: 'magick.exe',
+        cli: true,
+        needs: ['7zip'],
+    },
+    {
+        id: 'nomacs',
+        name: 'nomacs',
+        category: 'gamedev',
+        about: 'Image viewer for textures (TGA, PSD, DDS, EXR).',
+        size: '60 MB',
+        source: { github: 'nomacs/nomacs', asset: '^nomacs-portable-win\\.zip$' },
+        exe: 'nomacs.exe',
+    },
+    {
+        id: 'unity-mcp',
+        name: 'MCP for Unity',
+        category: 'agents',
+        about: 'Lets Claude Code and Codex work in an open Unity editor (CoplayDev/unity-mcp 10.3.0, MIT; Unity 2021.3 to 6.x). Your project needs its package (Unity page: Add the editor bridge). Telemetry is off.',
+        size: '60 MB',
+        source: { locked: 'uv', package: 'mcpforunityserver', version: UNITY_MCP_VERSION },
+        exe: 'mcp-for-unity.exe',
+        service: true,
+        mcp: {
+            name: 'sbx-unity-mcp',
+            program: true,
+            args: ['--transport', 'stdio'],
+            env: { DISABLE_TELEMETRY: '1', UNITY_MCP_DISABLE_TELEMETRY: '1', MCP_DISABLE_TELEMETRY: '1' },
+            codex: true,
+        },
+        plugsInto: 'Claude Code and Codex as the MCP server sbx-unity-mcp',
+        userOnly: true,
+    },
+    {
+        id: 'openupm-cli',
+        name: 'openupm-cli',
+        category: 'gamedev',
+        about: 'Adds OpenUPM packages to Unity projects from the command line (openupm 4.5.3, BSD-3-Clause).',
+        size: '15 MB',
+        source: { locked: 'npm', package: 'openupm-cli', version: OPENUPM_CLI_VERSION },
+        exe: 'openupm.cmd',
+    },
+];

package/dist/shared/apps/catalogue.d.ts

@@ -28,6 +28,14 @@ export type AppSource = {
 /** Nothing to download: a remote MCP server (AddonMcp.url). */
  | {
     remote: true;
+}
+/** A Microsoft Store app: this PC fetches the package with its own Store tooling; the sandbox installs it. */
+ | {
+    store: {
+        productId: string;
+        packageName: string;
+        family: string;
+    };
 };
 /**
  * An MCP server an add-on adds to the sandbox's Claude Code (and Codex, with `codex`): `node <its folder>\<script>

package/dist/shared/apps/index.d.ts

@@ -1,5 +1,8 @@
 export { type AddonMcp, type AppCategory, APP_CATEGORIES, type AppSource, type AppEntry, APPS, appById, CCUSAGE_VERSION, CONTEXT7_MCP_VERSION, HEADROOM_VERSION, PLAYWRIGHT_MCP_VERSION, RTK_VERSION, } from './catalogue.js';
-export { exeMatcher, appsToInstall, appsNeedMesa, appsNeedUv } from './selection.js';
+export { ASSOCIATIONS, associationPlan } from './associations.js';
+export { previewGuideLine } from './preview.js';
+export { exeMatcher, appsToInstall, appsNeedMesa, appsNeedUv, storeApps } from './selection.js';
 export { signerMatches, type AppSigner, type Signature } from '../signer.js';
-export { AGENTS_WEB_APPS, BROWSER_USE_VERSION, CHROME_DEVTOOLS_MCP_VERSION, COMET_DOWNLOAD_URL, COMET_MCP_VERSION, COMET_SIGNER, PERPLEXITY_COMPUTER_MCP_URL, PERPLEXITY_MCP_VERSION, } from './catalogue-agents-web.js';
+export { AGENTS_WEB_APPS, BROWSER_USE_VERSION, CHROME_DEVTOOLS_MCP_VERSION, COMET_DOWNLOAD_URL, PERPLEXITY_DESKTOP_FAMILY, PERPLEXITY_DESKTOP_PACKAGE, PERPLEXITY_DESKTOP_PRODUCT_ID, COMET_MCP_VERSION, COMET_SIGNER, PERPLEXITY_COMPUTER_MCP_URL, PERPLEXITY_MCP_VERSION, } from './catalogue-agents-web.js';
 export { ADDON_MCP_PREFIX, addonGuideLine, addonMcpServer, type AddonPlace, claudeManagedSettings, codexWithAddonMcpServers, type CodexMcpServer, HEADROOM_ENV, HEADROOM_PORT, HEADROOM_UPSTREAM, headroomArgs, headroomEnv, headroomGuideLine, headroomUrl, type ManagedSettings, type McpServerConfig, rtkHookCommand, RTK_GUIDE_LINE, withAddonMcpServers, } from './agent-addons.js';
+export { isStorePackageFile, STORE_PACKAGE_MANIFEST, StorePackageFileSchema, StorePackageManifestSchema, storePackageRole, type StorePackageFile, type StorePackageManifest, } from './store-package.js';

package/dist/shared/apps/index.js

@@ -1,5 +1,8 @@
 export { APP_CATEGORIES, APPS, appById, CCUSAGE_VERSION, CONTEXT7_MCP_VERSION, HEADROOM_VERSION, PLAYWRIGHT_MCP_VERSION, RTK_VERSION, } from './catalogue.js';
-export { exeMatcher, appsToInstall, appsNeedMesa, appsNeedUv } from './selection.js';
+export { ASSOCIATIONS, associationPlan } from './associations.js';
+export { previewGuideLine } from './preview.js';
+export { exeMatcher, appsToInstall, appsNeedMesa, appsNeedUv, storeApps } from './selection.js';
 export { signerMatches } from '../signer.js';
-export { AGENTS_WEB_APPS, BROWSER_USE_VERSION, CHROME_DEVTOOLS_MCP_VERSION, COMET_DOWNLOAD_URL, COMET_MCP_VERSION, COMET_SIGNER, PERPLEXITY_COMPUTER_MCP_URL, PERPLEXITY_MCP_VERSION, } from './catalogue-agents-web.js';
+export { AGENTS_WEB_APPS, BROWSER_USE_VERSION, CHROME_DEVTOOLS_MCP_VERSION, COMET_DOWNLOAD_URL, PERPLEXITY_DESKTOP_FAMILY, PERPLEXITY_DESKTOP_PACKAGE, PERPLEXITY_DESKTOP_PRODUCT_ID, COMET_MCP_VERSION, COMET_SIGNER, PERPLEXITY_COMPUTER_MCP_URL, PERPLEXITY_MCP_VERSION, } from './catalogue-agents-web.js';
 export { ADDON_MCP_PREFIX, addonGuideLine, addonMcpServer, claudeManagedSettings, codexWithAddonMcpServers, HEADROOM_ENV, HEADROOM_PORT, HEADROOM_UPSTREAM, headroomArgs, headroomEnv, headroomGuideLine, headroomUrl, rtkHookCommand, RTK_GUIDE_LINE, withAddonMcpServers, } from './agent-addons.js';
+export { isStorePackageFile, STORE_PACKAGE_MANIFEST, StorePackageFileSchema, StorePackageManifestSchema, storePackageRole, } from './store-package.js';

package/dist/shared/apps/preview.d.ts

@@ -0,0 +1,2 @@
+/** Null unless F3D or ImageMagick is installed; `installed` holds app ids. */
+export declare function previewGuideLine(installed: readonly string[]): string | null;

package/dist/shared/apps/preview.js

@@ -0,0 +1,10 @@
+// The one line that tells an agent how to render previews of meshes and textures for the owner (pure).
+/** Null unless F3D or ImageMagick is installed; `installed` holds app ids. */
+export function previewGuideLine(installed) {
+    if (!installed.includes('f3d') && !installed.includes('imagemagick'))
+        return null;
+    return ('asset previews: `f3d "<mesh>" --output="<pkg>\\previews\\<name>.png" --resolution=1024,768 --up=+Y` per mesh ' +
+        '(--up=+Z for Unreal-space files), `magick montage "<pkg>\\source\\**\\*.png" -thumbnail 256x256 -geometry +4+4 ' +
+        '-label %f "<pkg>\\previews\\textures.png"` for textures (convert TGA/PSD/DDS/EXR to PNG first with magick); ' +
+        "leave them in the package's previews\\ folder for the owner to look at before import");
+}

package/dist/shared/apps/selection.d.ts

@@ -11,3 +11,9 @@ export declare function appsToInstall(apps: Config['apps'], gitAccess: GitAccess
 export declare function appsNeedUv(apps: Config['apps'] | undefined): boolean;
 /** Does any chosen app draw with OpenGL (so the Mesa step must run first)? */
 export declare function appsNeedMesa(apps: Config['apps'] | undefined): boolean;
+/** The chosen apps that come from the Microsoft Store: what this PC has to fetch for them. */
+export declare function storeApps(install: readonly string[]): {
+    id: string;
+    productId: string;
+    packageName: string;
+}[];

package/dist/shared/apps/selection.js

@@ -47,3 +47,12 @@ export function appsNeedUv(apps) {
 export function appsNeedMesa(apps) {
     return Boolean(apps?.install.some((id) => appById(id)?.needs?.includes('mesa')));
 }
+/** The chosen apps that come from the Microsoft Store: what this PC has to fetch for them. */
+export function storeApps(install) {
+    return install.flatMap((id) => {
+        const source = appById(id)?.source;
+        return source !== undefined && 'store' in source
+            ? [{ id, productId: source.store.productId, packageName: source.store.packageName }]
+            : [];
+    });
+}

package/dist/shared/apps/store-package.d.ts

@@ -0,0 +1,31 @@
+import { z } from 'zod';
+export declare const StorePackageFileSchema: z.ZodObject<{
+    name: z.ZodString;
+    role: z.ZodEnum<{
+        main: "main";
+        dependency: "dependency";
+    }>;
+    sha256: z.ZodString;
+    bytes: z.ZodNumber;
+}, z.core.$strict>;
+export type StorePackageFile = z.output<typeof StorePackageFileSchema>;
+/** store-package.json: next to the package files, on this PC's cache and in the sandbox's data folder. */
+export declare const StorePackageManifestSchema: z.ZodObject<{
+    productId: z.ZodString;
+    fetchedAt: z.ZodString;
+    files: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        role: z.ZodEnum<{
+            main: "main";
+            dependency: "dependency";
+        }>;
+        sha256: z.ZodString;
+        bytes: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type StorePackageManifest = z.output<typeof StorePackageManifestSchema>;
+export declare const STORE_PACKAGE_MANIFEST = "store-package.json";
+/** Whether a file name is a package file this feature handles. */
+export declare function isStorePackageFile(name: string): boolean;
+/** The app itself (named <package name>_<version>_...), as opposed to a framework it depends on (VCLibs ...). */
+export declare function storePackageRole(fileName: string, packageName: string): 'main' | 'dependency';

package/dist/shared/apps/store-package.js

@@ -0,0 +1,34 @@
+// A Microsoft Store app handed to the sandbox as package files (.msix and its dependencies). The PC fetches them with
+// its own Store tooling (host/apps/store-package.ts) and the sandbox installs them with Add-AppxPackage.
+// Pure, web-safe: the shape of the manifest that travels with the files, and which file is the app itself.
+import { z } from 'zod';
+const GB = 1024 * 1024 * 1024;
+const FILE_NAME = /^[A-Za-z0-9._~+-]{1,200}\.(msix|appx|msixbundle|appxbundle)$/i;
+export const StorePackageFileSchema = z.strictObject({
+    name: z.string().regex(FILE_NAME),
+    role: z.enum(['main', 'dependency']),
+    sha256: z.string().regex(/^[0-9a-f]{64}$/),
+    bytes: z
+        .number()
+        .int()
+        .positive()
+        .max(2 * GB),
+});
+/** store-package.json: next to the package files, on this PC's cache and in the sandbox's data folder. */
+export const StorePackageManifestSchema = z
+    .strictObject({
+    productId: z.string().regex(/^[A-Z0-9]{12}$/),
+    fetchedAt: z.string().max(40),
+    files: z.array(StorePackageFileSchema).min(1).max(24),
+})
+    .refine((m) => m.files.filter((f) => f.role === 'main').length === 1, 'exactly one file must be the app itself')
+    .refine((m) => new Set(m.files.map((f) => f.name.toLowerCase())).size === m.files.length, 'file names repeat');
+export const STORE_PACKAGE_MANIFEST = 'store-package.json';
+/** Whether a file name is a package file this feature handles. */
+export function isStorePackageFile(name) {
+    return FILE_NAME.test(name);
+}
+/** The app itself (named <package name>_<version>_...), as opposed to a framework it depends on (VCLibs ...). */
+export function storePackageRole(fileName, packageName) {
+    return fileName.toLowerCase().startsWith(packageName.toLowerCase() + '_') ? 'main' : 'dependency';
+}

package/dist/shared/browser-policy.d.ts

@@ -0,0 +1,14 @@
+export interface BrowserPolicy {
+    readonly key: string;
+    readonly name: string;
+    readonly type: 'REG_DWORD' | 'REG_SZ';
+    readonly data: string;
+}
+export declare const BROWSER_POLICY_KEYS: readonly ["HKLM\\SOFTWARE\\Policies\\Microsoft\\Edge", "HKLM\\SOFTWARE\\Policies\\Google\\Chrome"];
+/**
+ * The policies for each browser: no hardware acceleration (today's behaviour) and, when a downloads folder is given,
+ * DefaultDownloadDirectory (the default only: Playwright's download path and the user's own choice still win).
+ */
+export declare function browserPolicies(o: {
+    readonly downloads: string | null;
+}): BrowserPolicy[];

package/dist/shared/browser-policy.js

@@ -0,0 +1,22 @@
+// The machine policy of the sandbox's browsers (Edge and Chrome), written under HKLM at every boot by the guest: no GPU
+// and the folder downloads go to. Pure (no reads or writes here): the guest runs reg.exe with these entries and the
+// self-test checks them.
+import path from 'node:path';
+export const BROWSER_POLICY_KEYS = [
+    'HKLM\\SOFTWARE\\Policies\\Microsoft\\Edge',
+    'HKLM\\SOFTWARE\\Policies\\Google\\Chrome',
+];
+/**
+ * The policies for each browser: no hardware acceleration (today's behaviour) and, when a downloads folder is given,
+ * DefaultDownloadDirectory (the default only: Playwright's download path and the user's own choice still win).
+ */
+export function browserPolicies(o) {
+    if (o.downloads !== null && (!path.win32.isAbsolute(o.downloads) || /["\r\n%]/.test(o.downloads)))
+        throw new Error('not a folder');
+    return BROWSER_POLICY_KEYS.flatMap((key) => [
+        { key, name: 'HardwareAccelerationModeEnabled', type: 'REG_DWORD', data: '0' },
+        ...(o.downloads === null
+            ? []
+            : [{ key, name: 'DefaultDownloadDirectory', type: 'REG_SZ', data: o.downloads }]),
+    ]);
+}

package/dist/shared/channel/schema.d.ts

@@ -126,6 +126,14 @@ export declare const ProjectSpecSchema: z.ZodObject<{
             modules: z.ZodArray<z.ZodString>;
             hub: z.ZodBoolean;
             keepVersions: z.ZodNumber;
+            mcp: z.ZodBoolean;
+            agentSkills: z.ZodBoolean;
+            cliVersion: z.ZodString;
+            assetCache: z.ZodEnum<{
+                pc: "pc";
+                persisted: "persisted";
+                local: "local";
+            }>;
         }, z.core.$strict>;
         godot: z.ZodObject<{
             enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
@@ -362,6 +370,14 @@ export declare const GuestRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 modules: z.ZodArray<z.ZodString>;
                 hub: z.ZodBoolean;
                 keepVersions: z.ZodNumber;
+                mcp: z.ZodBoolean;
+                agentSkills: z.ZodBoolean;
+                cliVersion: z.ZodString;
+                assetCache: z.ZodEnum<{
+                    pc: "pc";
+                    persisted: "persisted";
+                    local: "local";
+                }>;
             }, z.core.$strict>;
             godot: z.ZodObject<{
                 enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
@@ -618,6 +634,14 @@ export declare const GuestRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 modules: z.ZodArray<z.ZodString>;
                 hub: z.ZodBoolean;
                 keepVersions: z.ZodNumber;
+                mcp: z.ZodBoolean;
+                agentSkills: z.ZodBoolean;
+                cliVersion: z.ZodString;
+                assetCache: z.ZodEnum<{
+                    pc: "pc";
+                    persisted: "persisted";
+                    local: "local";
+                }>;
             }, z.core.$strict>;
             godot: z.ZodObject<{
                 enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;

package/dist/shared/channel/secrets.d.ts

@@ -25,6 +25,7 @@ export declare const SecretsFileSchema: z.ZodObject<{
         }, z.core.$strict>>;
         unity: z.ZodOptional<z.ZodObject<{
             ulf: z.ZodOptional<z.ZodString>;
+            entitlement: z.ZodOptional<z.ZodString>;
             email: z.ZodOptional<z.ZodString>;
             password: z.ZodOptional<z.ZodString>;
             serial: z.ZodOptional<z.ZodString>;
@@ -70,6 +71,22 @@ export declare const SecretsFileSchema: z.ZodObject<{
                 }>>;
             }, z.core.$strict>>;
         }, z.core.$strict>>;
+        perplexityapp: z.ZodOptional<z.ZodObject<{
+            cookies: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                value: z.ZodString;
+                domain: z.ZodString;
+                path: z.ZodString;
+                expires: z.ZodOptional<z.ZodNumber>;
+                secure: z.ZodBoolean;
+                httpOnly: z.ZodBoolean;
+                sameSite: z.ZodOptional<z.ZodEnum<{
+                    Strict: "Strict";
+                    Lax: "Lax";
+                    None: "None";
+                }>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
     liveFoldersKey: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;

package/dist/shared/io/index.d.ts

@@ -6,3 +6,4 @@ export * from './copy-tree.js';
 export * from './bounded.js';
 export * from './text.js';
 export * from './disk.js';
+export * from './rotate-log.js';

package/dist/shared/io/index.js

@@ -6,3 +6,4 @@ export * from './copy-tree.js';
 export * from './bounded.js';
 export * from './text.js';
 export * from './disk.js';
+export * from './rotate-log.js';

package/dist/shared/io/rotate-log.d.ts

@@ -0,0 +1,2 @@
+/** Moves `file` to `file + '.1'` (replacing the older copy) when it is over `maxBytes`; true when it moved. */
+export declare function rotateLog(file: string, maxBytes: number): boolean;

package/dist/shared/io/rotate-log.js

@@ -0,0 +1,16 @@
+// Keeps a log that a detached program appends to from growing for ever: past the limit it becomes <log>.1.
+import fs from 'node:fs';
+/** Moves `file` to `file + '.1'` (replacing the older copy) when it is over `maxBytes`; true when it moved. */
+export function rotateLog(file, maxBytes) {
+    try {
+        if (fs.statSync(file).size <= maxBytes)
+            return false;
+        fs.rmSync(file + '.1', { force: true });
+        fs.renameSync(file, file + '.1');
+        return true;
+    }
+    catch {
+        // No log yet, or it is held open: the next start tries again.
+        return false;
+    }
+}

package/dist/shared/memory/policy.d.ts

@@ -67,3 +67,8 @@ export declare function chooseTargetDir(targetDir: string, freeBytes: number): {
 };
 /** The most heavy compilers (rustc, clippy-driver, link ...) that run at once in the agents' job: only with vGPU on. */
 export declare function maxCompilers(cpus: number, profile: LoadProfile): number | null;
+/**
+ * The cargo variable that names the linker of a Rust host (`x86_64-pc-windows-msvc` ->
+ * `CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_LINKER`).
+ */
+export declare function cargoLinkerVar(host: string): string;

package/dist/shared/memory/policy.js

@@ -108,3 +108,10 @@ export function chooseTargetDir(targetDir, freeBytes) {
 export function maxCompilers(cpus, profile) {
     return profile === 'gentle' ? Math.min(4, Math.max(2, Math.floor(cpus / 4))) : null;
 }
+/**
+ * The cargo variable that names the linker of a Rust host (`x86_64-pc-windows-msvc` ->
+ * `CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_LINKER`).
+ */
+export function cargoLinkerVar(host) {
+    return 'CARGO_TARGET_' + host.toUpperCase().replace(/[^A-Z0-9]/g, '_') + '_LINKER';
+}

package/dist/shared/paths/pc-installs.d.ts

@@ -1,6 +1,6 @@
 /** Where this PC's installs appear in the sandbox (reserved: RESERVED_GUEST). */
 export declare const PC_INSTALLS_GUEST = "C:\\PcInstalls";
-export type PcInstallKind = 'steam-game' | 'steam-library' | 'epic-game' | 'unreal' | 'unity';
+export type PcInstallKind = 'steam-game' | 'steam-library' | 'epic-game' | 'unreal' | 'unreal-vault' | 'unity' | 'unity-assets';
 export interface PcInstall {
     readonly kind: PcInstallKind;
     /** The Steam app ID or library (library1), the Epic app name, the engine (UE_5.4) or editor version. */
@@ -9,8 +9,19 @@ export interface PcInstall {
     readonly version?: string;
     /** The folder on this PC (never sent to the sandbox). */
     readonly host: string;
-    /** Where it appears in the sandbox, read-only. */
+    /** Where it appears in the sandbox, read-only unless `writable`. */
     readonly guest: string;
+    /** Mapped writable: an engine folder you registered (pcInstalls.unrealEngineFolders). */
+    readonly writable?: boolean;
+    /** An Unreal source build's registered name on this PC (HKCU\Software\Epic Games\Unreal Engine\Builds). */
+    readonly buildId?: string;
+    /** The Epic Games Launcher's own ids of the app (from this PC's LauncherInstalled.dat). */
+    readonly launcher?: {
+        readonly namespaceId: string;
+        readonly itemId: string;
+        readonly artifactId: string;
+        readonly appVersion: string;
+    };
 }
 /** What session.json says about them: no host paths. */
 export interface PcInstallManifest {

package/dist/shared/paths/pc-installs.js

@@ -9,7 +9,9 @@ const AREA = {
     'steam-library': 'steam',
     'epic-game': 'epic',
     unreal: 'unreal',
+    'unreal-vault': 'unreal',
     unity: 'unity',
+    'unity-assets': 'unity',
 };
 /** The guest folder of one install: C:\PcInstalls\steam\<appid>, \epic\<AppName>, \unreal\UE_5.4, \unity\<ver>. */
 export function pcInstallGuest(kind, id) {

package/dist/shared/readiness.d.ts

@@ -1,9 +1,8 @@
 export declare const NOT_READY: {
     /** Toolchains whose step is a stub: their settings rows are hidden and "auto" never turns them on. */
-    readonly toolchains: readonly ["unity", "godot", "android", "flutter", "dart", "reactNative"];
+    readonly toolchains: readonly ["godot", "android", "flutter", "dart", "reactNative"];
     /** Service sign-ins whose host or guest side is a stub: the menu and the web do not list them. */
-    readonly kinds: readonly ["unity", "keystore", "play", "expo", "appstore"];
-    readonly unreal: readonly ["engines"];
+    readonly kinds: readonly ["keystore", "play", "expo", "appstore"];
 };
 export declare const isToolchainReady: (name: string) => boolean;
 export declare const isKindReady: (kind: string) => boolean;