windows-development-sandbox 1.25.0 → 1.27.0

package/sandbox/csharp/AppActivation.cs

@@ -0,0 +1,38 @@
+// Starts an installed Store (packaged) app by its app user model id, with a command line. Loaded by
+// scripts\start-store-app.ps1 (Add-Type). C# 5.
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+
+public static class SbxAppActivation
+{
+    private const int OptionsNone = 0;
+
+    [ComImport]
+    [Guid("2e941141-7f97-4756-ba1d-9decde894a3d")]
+    [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+    private interface IApplicationActivationManager
+    {
+        [PreserveSig]
+        int ActivateApplication([MarshalAs(UnmanagedType.LPWStr)] string appUserModelId, [MarshalAs(UnmanagedType.LPWStr)] string arguments, int options, out uint processId);
+    }
+
+    [ComImport]
+    [Guid("45BA127D-10A8-46EA-8AB7-56EA9078943C")]
+    private class ApplicationActivationManager
+    {
+    }
+
+    /// <summary>Starts the app and returns its process id; throws a Win32Exception when Windows refuses.</summary>
+    public static uint Start(string appUserModelId, string arguments)
+    {
+        IApplicationActivationManager manager = (IApplicationActivationManager)new ApplicationActivationManager();
+        uint processId;
+        int result = manager.ActivateApplication(appUserModelId, arguments, OptionsNone, out processId);
+        if (result < 0)
+        {
+            throw new Win32Exception(result, "ActivateApplication failed for " + appUserModelId);
+        }
+        return processId;
+    }
+}

package/sandbox/csharp/VsSetup.cs

@@ -0,0 +1,210 @@
+// The Visual Studio Setup Configuration API as UnrealBuildTool calls it (MicrosoftPlatformSDK: SetupConfiguration,
+// ISetupConfiguration2.EnumAllInstances, ISetupInstance2): every instance with its state, version, product, path and
+// packages. Loaded by scripts\get-vs-setup.ps1 (Add-Type), which adds the file checks and writes the JSON. C# 5.
+using System;
+using System.Collections.Generic;
+using System.Runtime.InteropServices;
+using FILETIME = System.Runtime.InteropServices.ComTypes.FILETIME;
+
+namespace AgentSandbox
+{
+    [ComImport]
+    [Guid("42843719-DB4C-46C2-8E7C-64F1816EFD5B")]
+    [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+    public interface ISetupConfiguration
+    {
+        IEnumSetupInstances EnumInstances();
+        ISetupInstance GetInstanceForCurrentProcess();
+        ISetupInstance GetInstanceForPath([In, MarshalAs(UnmanagedType.LPWStr)] string path);
+    }
+
+    [ComImport]
+    [Guid("26AAB78C-4A60-49D6-AF3B-3C35BC93365D")]
+    [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+    public interface ISetupConfiguration2 : ISetupConfiguration
+    {
+        new IEnumSetupInstances EnumInstances();
+        new ISetupInstance GetInstanceForCurrentProcess();
+        new ISetupInstance GetInstanceForPath([In, MarshalAs(UnmanagedType.LPWStr)] string path);
+        IEnumSetupInstances EnumAllInstances();
+    }
+
+    [ComImport]
+    [Guid("6380BCFF-41D3-4B2E-8B2E-BF8A6810C848")]
+    [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+    public interface IEnumSetupInstances
+    {
+        void Next(
+            [In, MarshalAs(UnmanagedType.U4)] int celt,
+            [Out, MarshalAs(UnmanagedType.LPArray, ArraySubType = UnmanagedType.Interface, SizeParamIndex = 0)]
+            ISetupInstance[] rgelt,
+            [Out, MarshalAs(UnmanagedType.U4)] out int pceltFetched);
+        void Skip([In, MarshalAs(UnmanagedType.U4)] int celt);
+        void Reset();
+        IEnumSetupInstances Clone();
+    }
+
+    [ComImport]
+    [Guid("B41463C3-8866-43B5-BC33-2B0676F7F42E")]
+    [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+    public interface ISetupInstance
+    {
+        [return: MarshalAs(UnmanagedType.BStr)] string GetInstanceId();
+        [return: MarshalAs(UnmanagedType.Struct)] FILETIME GetInstallDate();
+        [return: MarshalAs(UnmanagedType.BStr)] string GetInstallationName();
+        [return: MarshalAs(UnmanagedType.BStr)] string GetInstallationPath();
+        [return: MarshalAs(UnmanagedType.BStr)] string GetInstallationVersion();
+        [return: MarshalAs(UnmanagedType.BStr)] string GetDisplayName([In, MarshalAs(UnmanagedType.U4)] int lcid);
+        [return: MarshalAs(UnmanagedType.BStr)] string GetDescription([In, MarshalAs(UnmanagedType.U4)] int lcid);
+        [return: MarshalAs(UnmanagedType.BStr)] string ResolvePath([In, MarshalAs(UnmanagedType.LPWStr)] string path);
+    }
+
+    [ComImport]
+    [Guid("89143C9A-05AF-49B0-B717-72E218A2185C")]
+    [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+    public interface ISetupInstance2 : ISetupInstance
+    {
+        [return: MarshalAs(UnmanagedType.BStr)] new string GetInstanceId();
+        [return: MarshalAs(UnmanagedType.Struct)] new FILETIME GetInstallDate();
+        [return: MarshalAs(UnmanagedType.BStr)] new string GetInstallationName();
+        [return: MarshalAs(UnmanagedType.BStr)] new string GetInstallationPath();
+        [return: MarshalAs(UnmanagedType.BStr)] new string GetInstallationVersion();
+        [return: MarshalAs(UnmanagedType.BStr)] new string GetDisplayName([In, MarshalAs(UnmanagedType.U4)] int lcid);
+        [return: MarshalAs(UnmanagedType.BStr)] new string GetDescription([In, MarshalAs(UnmanagedType.U4)] int lcid);
+        [return: MarshalAs(UnmanagedType.BStr)] new string ResolvePath([In, MarshalAs(UnmanagedType.LPWStr)] string path);
+        [return: MarshalAs(UnmanagedType.U4)] uint GetState();
+        [return: MarshalAs(UnmanagedType.SafeArray, SafeArraySubType = VarEnum.VT_UNKNOWN)]
+        ISetupPackageReference[] GetPackages();
+        ISetupPackageReference GetProduct();
+        [return: MarshalAs(UnmanagedType.BStr)] string GetProductPath();
+        [return: MarshalAs(UnmanagedType.IUnknown)] object GetErrors();
+        [return: MarshalAs(UnmanagedType.VariantBool)] bool IsLaunchable();
+        [return: MarshalAs(UnmanagedType.VariantBool)] bool IsComplete();
+    }
+
+    [ComImport]
+    [Guid("DA8D8A16-B2B6-4487-A2F1-594CCCCD6BF5")]
+    [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+    public interface ISetupPackageReference
+    {
+        [return: MarshalAs(UnmanagedType.BStr)] string GetId();
+        [return: MarshalAs(UnmanagedType.BStr)] string GetVersion();
+        [return: MarshalAs(UnmanagedType.BStr)] string GetChip();
+        [return: MarshalAs(UnmanagedType.BStr)] string GetLanguage();
+        [return: MarshalAs(UnmanagedType.BStr)] string GetBranch();
+        [return: MarshalAs(UnmanagedType.BStr)] string GetType();
+        [return: MarshalAs(UnmanagedType.BStr)] string GetUniqueId();
+        [return: MarshalAs(UnmanagedType.VariantBool)] bool GetIsExtension();
+    }
+
+    [ComImport]
+    [Guid("177F0C4A-1CD3-4DE7-A32C-71DBBB9FA36D")]
+    [ClassInterface(ClassInterfaceType.None)]
+    public class SetupConfiguration
+    {
+    }
+
+    /// <summary>One instance as the Setup API reports it.</summary>
+    public class SetupInstanceInfo
+    {
+        public string InstanceId;
+        public string InstallationPath;
+        public string InstallationVersion;
+        public string ProductId;
+        public uint State;
+        public bool IsComplete;
+        public bool IsLaunchable;
+        public string[] Packages;
+    }
+
+    public static class VsSetup
+    {
+        /// <summary>InstanceState.Local: the instance's files are on this machine (the only ones UnrealBuildTool uses).</summary>
+        public const uint StateLocal = 1;
+
+        /// <summary>Every instance EnumAllInstances lists (complete or not), as UnrealBuildTool enumerates them.</summary>
+        public static SetupInstanceInfo[] AllInstances()
+        {
+            List<SetupInstanceInfo> found = new List<SetupInstanceInfo>();
+            ISetupConfiguration2 setup = (ISetupConfiguration2)new SetupConfiguration();
+            IEnumSetupInstances instances = null;
+            try
+            {
+                instances = setup.EnumAllInstances();
+                ISetupInstance[] one = new ISetupInstance[1];
+                while (true)
+                {
+                    int fetched;
+                    instances.Next(1, one, out fetched);
+                    if (fetched == 0)
+                    {
+                        break;
+                    }
+                    ISetupInstance2 instance = (ISetupInstance2)one[0];
+                    try
+                    {
+                        found.Add(Describe(instance));
+                    }
+                    finally
+                    {
+                        Marshal.ReleaseComObject(instance);
+                    }
+                }
+            }
+            finally
+            {
+                if (instances != null)
+                {
+                    Marshal.ReleaseComObject(instances);
+                }
+                Marshal.ReleaseComObject(setup);
+            }
+            return found.ToArray();
+        }
+
+        private static SetupInstanceInfo Describe(ISetupInstance2 instance)
+        {
+            SetupInstanceInfo info = new SetupInstanceInfo();
+            info.InstanceId = instance.GetInstanceId();
+            info.InstallationPath = instance.GetInstallationPath();
+            info.InstallationVersion = instance.GetInstallationVersion();
+            info.State = instance.GetState();
+            ISetupPackageReference product = instance.GetProduct();
+            if (product == null)
+            {
+                info.ProductId = "";
+            }
+            else
+            {
+                try
+                {
+                    info.ProductId = product.GetId();
+                }
+                finally
+                {
+                    Marshal.ReleaseComObject(product);
+                }
+            }
+            info.IsComplete = instance.IsComplete();
+            info.IsLaunchable = instance.IsLaunchable();
+            ISetupPackageReference[] packages = instance.GetPackages();
+            List<string> ids = new List<string>();
+            if (packages != null)
+            {
+                foreach (ISetupPackageReference package in packages)
+                {
+                    try
+                    {
+                        ids.Add(package.GetId());
+                    }
+                    finally
+                    {
+                        Marshal.ReleaseComObject(package);
+                    }
+                }
+            }
+            info.Packages = ids.ToArray();
+            return info;
+        }
+    }
+}

package/sandbox/scripts/get-vs-setup.ps1

@@ -0,0 +1,93 @@
+#Requires -Version 5.1
+# Looks for Visual Studio the way UnrealBuildTool does (guest/toolchains/engines/unreal-engines.ts runs it; the
+# verdict is decided in vs-check.ts): every instance the Setup Configuration API lists (csharp\VsSetup.cs), the MSVC
+# toolchains under each one's VC\Tools\MSVC that have the x64 compiler, and the Windows SDKs under each KitsRoot10 the
+# registry names (HKLM in both views, HKCU) that have windows.h and the x64 kernel32.lib. Writes JSON to -ResultFile.
+param([Parameter(Mandatory = $true)][string]$ResultFile)
+$ErrorActionPreference = 'Stop'
+
+Add-Type -Path (Join-Path $PSScriptRoot '..\csharp\VsSetup.cs')
+
+$instances = New-Object System.Collections.ArrayList
+$setupError = ''
+try {
+    foreach ($i in [AgentSandbox.VsSetup]::AllInstances()) {
+        $toolchains = New-Object System.Collections.ArrayList
+        $msvc = Join-Path $i.InstallationPath 'VC\Tools\MSVC'
+        if (Test-Path -LiteralPath $msvc -PathType Container) {
+            foreach ($dir in Get-ChildItem -LiteralPath $msvc -Directory) {
+                $cl = Join-Path $dir.FullName 'bin\Hostx64\x64\cl.exe'
+                $link = Join-Path $dir.FullName 'bin\Hostx64\x64\link.exe'
+                [void]$toolchains.Add([ordered]@{
+                        version = $dir.Name
+                        cl      = (Test-Path -LiteralPath $cl -PathType Leaf)
+                        link    = (Test-Path -LiteralPath $link -PathType Leaf)
+                    })
+            }
+        }
+        $wanted = @('Microsoft.VisualStudio.Component.VC.Tools.x86.x64', 'Microsoft.VisualStudio.Workload.NativeGame',
+            'Microsoft.VisualStudio.Workload.VCTools', 'Component.Unreal', 'Component.Unreal.Ide')
+        [void]$instances.Add([ordered]@{
+                instanceId          = $i.InstanceId
+                installationPath    = $i.InstallationPath
+                installationVersion = $i.InstallationVersion
+                productId           = $i.ProductId
+                state               = [int64]$i.State
+                isComplete          = $i.IsComplete
+                isLaunchable        = $i.IsLaunchable
+                packages            = @($i.Packages | Where-Object { $wanted -contains $_ })
+                packageCount        = @($i.Packages).Count
+                toolchains          = @($toolchains)
+            })
+    }
+} catch {
+    $setupError = $_.Exception.Message
+}
+
+$roots = New-Object System.Collections.ArrayList
+$places = @(
+    @{ hive = [Microsoft.Win32.RegistryHive]::LocalMachine; view = [Microsoft.Win32.RegistryView]::Registry64; name = 'HKLM (64-bit)' },
+    @{ hive = [Microsoft.Win32.RegistryHive]::LocalMachine; view = [Microsoft.Win32.RegistryView]::Registry32; name = 'HKLM (32-bit)' },
+    @{ hive = [Microsoft.Win32.RegistryHive]::CurrentUser; view = [Microsoft.Win32.RegistryView]::Registry64; name = 'HKCU' }
+)
+foreach ($place in $places) {
+    $base = [Microsoft.Win32.RegistryKey]::OpenBaseKey($place.hive, $place.view)
+    try {
+        $key = $base.OpenSubKey('SOFTWARE\Microsoft\Windows Kits\Installed Roots')
+        if ($key) {
+            $value = [string]$key.GetValue('KitsRoot10')
+            $key.Close()
+            if ($value) { [void]$roots.Add([ordered]@{ where = $place.name; path = $value }) }
+        }
+    } finally {
+        $base.Close()
+    }
+}
+
+$sdks = New-Object System.Collections.ArrayList
+$seen = @{}
+foreach ($root in $roots) {
+    $include = Join-Path $root.path 'Include'
+    if ($seen.ContainsKey($include.ToLowerInvariant())) { continue }
+    $seen[$include.ToLowerInvariant()] = $true
+    if (-not (Test-Path -LiteralPath $include -PathType Container)) { continue }
+    foreach ($dir in Get-ChildItem -LiteralPath $include -Directory) {
+        if ($dir.Name -notmatch '^10\.\d+\.\d+\.\d+$') { continue }
+        [void]$sdks.Add([ordered]@{
+                version  = $dir.Name
+                root     = $root.path
+                windowsH = (Test-Path -LiteralPath (Join-Path $dir.FullName 'um\windows.h') -PathType Leaf)
+                kernel32 = (Test-Path -LiteralPath (Join-Path $root.path ('Lib\' + $dir.Name + '\um\x64\kernel32.lib')) -PathType Leaf)
+                ucrt     = (Test-Path -LiteralPath (Join-Path $root.path ('Lib\' + $dir.Name + '\ucrt\x64\ucrt.lib')) -PathType Leaf)
+            })
+    }
+}
+
+$result = [ordered]@{
+    setupError = $setupError
+    instances  = @($instances)
+    kitsRoots  = @($roots)
+    sdks       = @($sdks)
+}
+$json = ConvertTo-Json -InputObject $result -Depth 6
+[System.IO.File]::WriteAllText($ResultFile, $json, (New-Object System.Text.UTF8Encoding($false)))

package/sandbox/scripts/install-store-package.ps1

@@ -0,0 +1,28 @@
+#Requires -Version 5.1
+# Installs a Microsoft Store app from its package files with Add-AppxPackage (guest/apps/store-app.ts). -ListFile is
+# JSON written by the runtime: { main: "<full path of the app's .msix>", dependencies: ["<full path>", ...] }. The
+# package keeps the publisher's signature (nothing is repacked), so Windows checks it as it would any Store package.
+# The sandbox's Windows is new on every boot: this runs on every boot, from the package kept on the data disk.
+param(
+    [Parameter(Mandatory = $true)][string]$ListFile,
+    [Parameter(Mandatory = $true)][string]$PackageName
+)
+$ErrorActionPreference = 'Stop'
+
+if ($PackageName -notmatch '^[A-Za-z0-9.]{1,100}$') { throw 'That is not a package name.' }
+$list = ConvertFrom-Json -InputObject (Get-Content -LiteralPath $ListFile -Raw -Encoding UTF8)
+$dependencies = @()
+if ($list.dependencies) { $dependencies = @($list.dependencies | ForEach-Object { $_ }) }
+
+$existing = Get-AppxPackage -Name $PackageName -ErrorAction SilentlyContinue | Select-Object -First 1
+if (-not $existing) {
+    if ($dependencies.Count -gt 0) {
+        Add-AppxPackage -Path $list.main -DependencyPath $dependencies
+    }
+    else {
+        Add-AppxPackage -Path $list.main
+    }
+    $existing = Get-AppxPackage -Name $PackageName -ErrorAction Stop | Select-Object -First 1
+}
+[pscustomobject]@{ name = [string]$existing.Name; version = [string]$existing.Version; family = [string]$existing.PackageFamilyName } |
+    ConvertTo-Json -Compress

package/sandbox/scripts/set-registry-values.ps1

@@ -0,0 +1,35 @@
+#Requires -Version 5.1
+# Writes string registry values from a plan (guest/toolchains/engines/unreal-engines.ts: the Unreal engines'
+# registration and the .uproject file association; what goes where is decided in shared/unreal/engines.ts). -PlanFile
+# is JSON written by the runtime:
+#   values: [{ hive: 'HKLM' | 'HKCU', key, name, value }]   64-bit view, '' = the default value
+# Safe to run again. Exit 0 when every value is set, 2 when one could not be.
+param([Parameter(Mandatory = $true)][string]$PlanFile)
+$ErrorActionPreference = 'Stop'
+
+$plan = Get-Content -LiteralPath $PlanFile -Raw -Encoding UTF8 | ConvertFrom-Json
+$failed = New-Object System.Collections.ArrayList
+$set = 0
+foreach ($v in @($plan.values)) {
+    $hive = if ($v.hive -eq 'HKLM') { [Microsoft.Win32.RegistryHive]::LocalMachine } else { [Microsoft.Win32.RegistryHive]::CurrentUser }
+    $base = [Microsoft.Win32.RegistryKey]::OpenBaseKey($hive, [Microsoft.Win32.RegistryView]::Registry64)
+    try {
+        $key = $base.CreateSubKey([string]$v.key)
+        try {
+            $key.SetValue([string]$v.name, [string]$v.value, [Microsoft.Win32.RegistryValueKind]::String)
+            $set++
+        } finally {
+            $key.Close()
+        }
+    } catch {
+        [void]$failed.Add($v.hive + '\' + $v.key + ' ' + $v.name + ' (' + $_.Exception.Message + ')')
+    } finally {
+        $base.Close()
+    }
+}
+if ($failed.Count) {
+    Write-Host ('Could not set: ' + ($failed -join '; '))
+    exit 2
+}
+Write-Host ('Set ' + $set + ' registry values')
+exit 0

package/sandbox/scripts/start-store-app.ps1

@@ -0,0 +1,29 @@
+#Requires -Version 5.1
+# Starts an installed Microsoft Store app with command-line arguments (a shortcut to shell:AppsFolder cannot pass any).
+# The Perplexity desktop app is started with its own profile folder and its DevTools port, so the sandbox can keep
+# its perplexity.ai sign-in (guest/browser/perplexity-app.ts). -Port 0 picks a free port, written to the profile.
+param(
+    [Parameter(Mandatory = $true)][string]$PackageName,
+    [string]$UserDataDir = '',
+    [int]$Port = -1
+)
+$ErrorActionPreference = 'Stop'
+
+if ($PackageName -notmatch '^[A-Za-z0-9.]{1,100}$') { throw 'That is not a package name.' }
+$package = Get-AppxPackage -Name $PackageName -ErrorAction Stop | Select-Object -First 1
+if (-not $package) { throw ($PackageName + ' is not installed.') }
+$manifest = Get-AppxPackageManifest -Package $package
+$application = @($manifest.Package.Applications.Application)[0]
+$aumid = $package.PackageFamilyName + '!' + $application.Id
+
+$arguments = ''
+if ($UserDataDir) {
+    New-Item -ItemType Directory -Force -Path $UserDataDir | Out-Null
+    Remove-Item -LiteralPath (Join-Path $UserDataDir 'DevToolsActivePort') -Force -ErrorAction SilentlyContinue
+    $arguments = '--user-data-dir="' + $UserDataDir + '"'
+}
+if ($Port -ge 0) { $arguments = ($arguments + ' --remote-debugging-port=' + $Port).Trim() }
+
+Add-Type -Path (Join-Path $PSScriptRoot '..\csharp\AppActivation.cs')
+$processId = [SbxAppActivation]::Start($aumid, $arguments)
+Write-Output $processId

package/schemas/config.schema.json

@@ -407,6 +407,10 @@
         "shareToken": {
           "type": "boolean",
           "description": "Give each sandbox the GitHub token you saved in Accounts (best a fine-grained token limited to some repositories and permissions), so gh and https git work there without logging in. Only with provisioning.git.access \"full\". The agent in the sandbox can read the token and use it for whatever it allows. A project file (.sandbox-config.json) cannot turn this on."
+        },
+        "usePcLogin": {
+          "type": "boolean",
+          "description": "Give each sandbox the GitHub CLI (gh) login from this PC, when there is one, so gh and https git work there without logging in. Used when no token saved for sandboxes is handed over. Only with provisioning.git.access \"full\". Without a gh login on the PC nothing happens. The login reaches everything your account can, and the agent in the sandbox can read it. A project file (.sandbox-config.json) cannot turn this on."
         }
       },
       "additionalProperties": false
@@ -439,7 +443,7 @@
           "properties": {
             "share": {
               "type": "boolean",
-              "description": "Hand your saved Unity sign-in to sandboxes that use unity (sign in once in a sandbox, or take this PC's licence from Accounts). Kept encrypted on this PC; The agent in the sandbox can use this sign-in while it is there. It works in one sandbox at a time: a second sandbox starts without it while the first one runs. A Pro seat is handed back when the sandbox stops cleanly; a sandbox closed abruptly may keep it until you return it. Yours only: a project file can only turn it off."
+              "description": "Hand your saved Unity sign-in to sandboxes that use unity (sign in once in a sandbox, or take this PC's licence from Accounts). Kept encrypted on this PC; The agent in the sandbox can use this sign-in while it is there. It works in one sandbox at a time: a second sandbox starts without it while the first one runs. Unity Personal is activated by signing in: sign in to Unity once in a sandbox and the licence it makes is kept for the next ones (if Unity refuses it there, sign in again). A Plus or Pro serial is activated in each sandbox and handed back when the sandbox stops cleanly; a sandbox closed abruptly may keep the seat until you remove it at id.unity.com (My Seats). A licence file taken from this PC may not work in a sandbox: Unity ties it to the computer. Yours only: a project file can only turn it off."
             }
           },
           "additionalProperties": false
@@ -513,6 +517,16 @@
             }
           },
           "additionalProperties": false
+        },
+        "perplexityapp": {
+          "type": "object",
+          "properties": {
+            "share": {
+              "type": "boolean",
+              "description": "Hand your saved Perplexity desktop app sign-in to sandboxes that use the Perplexity desktop app (sign in to the Perplexity app once in a sandbox: it cannot be taken from this PC). Kept encrypted on this PC; The agent in the sandbox can use this sign-in while it is there. It can act as you in the Perplexity app and spend your Perplexity Computer credits; the app acts on the pages it reads, which can try to steer it. Your sign-in in the Perplexity app can't be copied from this PC: Windows locks it to your PC account. Sign in once inside a sandbox and it is kept for the next ones. Only the perplexity.ai sign-in cookies are kept: never saved passwords, other sites, localStorage or history. Several sandboxes can use it at once: the sign-in the last one hands back is kept. Yours only: a project file can only turn it off."
+            }
+          },
+          "additionalProperties": false
         }
       },
       "additionalProperties": false,
@@ -554,6 +568,10 @@
         },
         "unrealEngines": {
           "anyOf": [
+            {
+              "type": "string",
+              "const": "auto"
+            },
             {
               "type": "boolean"
             },
@@ -565,10 +583,36 @@
               }
             }
           ],
-          "description": "Unreal Engine versions installed with the Epic Games Launcher of this PC, read-only in the sandbox under C:\\PcInstalls: true = all of them, false = none, or a list (e.g. [\"5.4\"]). The agent can read their files."
+          "description": "Unreal Engine versions installed on this PC (with the Epic Games Launcher, or source builds it lists), read-only in the sandbox under C:\\PcInstalls\\unreal and registered there, so projects build with them without a download. \"auto\" = all of them whenever the sandbox is set up for Unreal, true = always, false = never, or a list (e.g. [\"5.4\"])."
+        },
+        "unrealEngineFolders": {
+          "maxItems": 8,
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 3,
+            "maxLength": 260
+          },
+          "description": "Unreal Engine folders of this PC to use in the sandbox, writable (a source build, or a copy you build plugins into): each must hold Engine\\Build\\Build.version. Mapped under C:\\PcInstalls\\unreal and registered there."
+        },
+        "unrealAssets": {
+          "anyOf": [
+            {
+              "type": "string",
+              "const": "auto"
+            },
+            {
+              "type": "boolean"
+            }
+          ],
+          "description": "The Epic Games Launcher's vault cache of this PC (the Fab and Marketplace packs you downloaded), read-only in the sandbox at C:\\PcInstalls\\unreal\\Vault: what you download on your PC is there for the agents at once. \"auto\" = whenever the sandbox is set up for Unreal, true = always, false = never."
         },
         "unityEditors": {
           "anyOf": [
+            {
+              "type": "string",
+              "const": "auto"
+            },
             {
               "type": "boolean"
             },
@@ -580,7 +624,19 @@
               }
             }
           ],
-          "description": "Unity editors installed with Unity Hub of this PC, read-only in the sandbox under C:\\PcInstalls: true = all of them, false = none, or a list (e.g. [\"6000.0.32f1\"]). The agent can read their files."
+          "description": "Unity editors installed on this PC (with Unity Hub), read-only in the sandbox under C:\\PcInstalls\\unity: a project opens with the PC's editor without a download. \"auto\" = all of them whenever the sandbox is set up for Unity, true = always, false = never, or a list (e.g. [\"6000.0.32f1\"])."
+        },
+        "unityAssets": {
+          "anyOf": [
+            {
+              "type": "string",
+              "const": "auto"
+            },
+            {
+              "type": "boolean"
+            }
+          ],
+          "description": "This PC's Unity Asset Store downloads (.unitypackage files), read-only at C:\\PcInstalls\\unity\\AssetStore: what you download on your PC is there for the agents at once. \"auto\" = whenever the sandbox is set up for Unity, true = always, false = never."
         }
       },
       "additionalProperties": false,
@@ -800,7 +856,7 @@
                 "lld",
                 "gnu"
               ],
-              "description": "GNU host: \"lld\" links with Rust's own lld through MinGW's gcc (much less memory than GNU ld), \"gnu\" with GNU ld."
+              "description": "\"lld\" (default) links with Rust's own lld: through MinGW's gcc on the GNU host (much less memory than GNU ld), and instead of link.exe on the MSVC host (link.exe writes executables into mapped folders as all zeros: os error 1392). \"gnu\" keeps GNU ld / link.exe."
             },
             "linkSlots": {
               "anyOf": [
@@ -913,7 +969,7 @@
                   "const": "auto"
                 }
               ],
-              "description": "Unity: the editor version a project asks for, from Unity's release API (checked against its published hash), installed into tools\\unity\\<version> (6-7 GB each), with the modules you list. true, false, or \"auto\" = only when the project has ProjectSettings/ProjectVersion.txt."
+              "description": "Unity: the editor version a project asks for, from Unity's release API (checked against its published hash), installed on the data disk (tools\\unity\\editors\\<version>, 8-13 GB each, kept between sandboxes), with the modules you list. This PC's editors (pcInstalls.unityEditors) are used first. true, false, or \"auto\" = only when the project has ProjectSettings/ProjectVersion.txt."
             },
             "acceptLicense": {
               "type": "boolean",
@@ -922,7 +978,7 @@
             "version": {
               "type": "string",
               "minLength": 1,
-              "description": "\"project\" = the version in ProjectSettings/ProjectVersion.txt, or an editor version such as \"6000.0.32f1\"."
+              "description": "\"project\" = the version in ProjectSettings/ProjectVersion.txt, or an editor version such as \"6000.0.32f1\" for folders without one (a project's own version always wins)."
             },
             "modules": {
               "type": "array",
@@ -934,13 +990,35 @@
             },
             "hub": {
               "type": "boolean",
-              "description": "Also Unity Hub, with the installed editors listed in it."
+              "description": "Also Unity Hub (kept on the data disk), for signing in to Unity Personal and installing editors by hand."
             },
             "keepVersions": {
               "type": "integer",
               "minimum": 1,
               "maximum": 20,
               "description": "How many editor versions to keep in tools\\unity; older ones are removed (the least recently used first)."
+            },
+            "mcp": {
+              "type": "boolean",
+              "description": "The Unity CLI's MCP server (unity mcp) in Claude Code and Codex as sbx-unity: Unity's read-only tools always, the open editor's tools when the project has the Unity Pipeline package (Unity 6 and later). Nothing in your project changes."
+            },
+            "agentSkills": {
+              "type": "boolean",
+              "description": "Unity's skills for Claude Code and Codex, from Unity-Technologies/skills at the commit the Unity CLI pins."
+            },
+            "cliVersion": {
+              "type": "string",
+              "pattern": "^(latest|\\d+\\.\\d+\\.\\d+(-[A-Za-z0-9.]+)?)$",
+              "description": "The Unity CLI version, checked against the SHA-256 Unity publishes: a version such as \"1.0.0-beta.16\", or \"latest\". It never updates itself."
+            },
+            "assetCache": {
+              "type": "string",
+              "enum": [
+                "persisted",
+                "pc",
+                "local"
+              ],
+              "description": "\"persisted\": Asset Store downloads made in the sandbox go to tools\\unity\\asset-store (kept). \"pc\": the sandbox uses this PC's Asset Store downloads (read-only; download new ones on your PC). \"local\": Unity's own place on the sandbox disk (lost when it closes)."
             }
           },
           "additionalProperties": false
@@ -1457,7 +1535,7 @@
                   "const": "auto"
                 }
               ],
-              "description": "GitHub CLI (gh). Only with provisioning.git.access \"full\": gh can push and merge through the GitHub API, past a read-only git. Your PC's gh login is never copied; `gh auth login` inside persists (GH_CONFIG_DIR), unless a token you saved for sandboxes is handed over (github.shareToken). \"auto\" = when the project has a .github folder."
+              "description": "GitHub CLI (gh). Only with provisioning.git.access \"full\": gh can push and merge through the GitHub API, past a read-only git. Your PC's gh login is copied only with github.usePcLogin (or a token you saved for sandboxes with github.shareToken); otherwise `gh auth login` inside persists (GH_CONFIG_DIR). \"auto\" = when the project has a .github folder."
             },
             "zstd": {
               "anyOf": [
@@ -2026,12 +2104,22 @@
               "gitleaks",
               "ast-grep",
               "rust-analyzer",
+              "krita",
+              "inkscape",
+              "audacity",
+              "renderdoc",
+              "f3d",
+              "imagemagick",
+              "nomacs",
+              "unity-mcp",
+              "openupm-cli",
               "lua-language-server",
               "stylua",
               "selene",
               "perplexity-mcp",
               "perplexity-computer-mcp",
               "comet",
+              "perplexity-desktop",
               "comet-mcp",
               "chrome-devtools-mcp",
               "browser-use-mcp"