windows-development-sandbox 1.25.0 → 1.27.0

package/dist/cli/menu/views.js

@@ -19,6 +19,8 @@ import { webView } from '../../app/features/web/index.js';
 import { vpnView } from '../../app/features/vpn/index.js';
 import { githubView } from '../../app/features/github/index.js';
 import { accessView } from '../../app/features/access/index.js';
+import { unrealView } from '../../app/features/unreal/index.js';
+import { unityView } from '../../app/features/unity/index.js';
 export const MENU_VIEWS = [
     { view: agentsView, section: 'Agents' },
     { view: agentEnvView, section: 'Agents' },
@@ -28,6 +30,8 @@ export const MENU_VIEWS = [
     { view: accountsView, section: 'Accounts' },
     { view: appsView, section: 'Apps' },
     { view: projectsView, section: 'Sandbox' },
+    { view: unrealView, section: 'Sandbox' },
+    { view: unityView, section: 'Sandbox' },
     { view: healthView, section: 'Maintenance' },
     { view: dataView, section: 'Maintenance' },
     { view: storageView, section: 'Maintenance' },

package/dist/core/config/defaults.js

@@ -37,7 +37,7 @@ export const DEFAULTS = {
     },
     network: { blockPrivateRanges: true, allowOnly: [], blockHosts: [], forwardPorts: [], dns: [], proxy: '' },
     vpn: { enabled: false, provider: 'nordvpn', protocol: 'udp', country: '', configFile: '', killSwitch: true },
-    github: { shareToken: false },
+    github: { shareToken: false, usePcLogin: false },
     codex: {
         sandboxMode: 'danger-full-access',
         approvalPolicy: 'never',
@@ -57,8 +57,17 @@ export const DEFAULTS = {
         appstore: { share: false },
         perplexity: { share: false },
         comet: { share: false },
+        perplexityapp: { share: false },
+    },
+    pcInstalls: {
+        steamGames: false,
+        epicGames: false,
+        unrealEngines: 'auto',
+        unrealEngineFolders: [],
+        unrealAssets: 'auto',
+        unityEditors: 'auto',
+        unityAssets: 'auto',
     },
-    pcInstalls: { steamGames: false, epicGames: false, unrealEngines: false, unityEditors: false },
     provisioning: {
         copyFromHost: true,
         fallbackToInstall: true,
@@ -91,7 +100,18 @@ export const DEFAULTS = {
             persistEngines: true,
             derivedDataCache: 'persisted',
         },
-        unity: { enabled: 'auto', acceptLicense: false, version: 'project', modules: [], hub: false, keepVersions: 2 },
+        unity: {
+            enabled: 'auto',
+            acceptLicense: false,
+            version: 'project',
+            modules: [],
+            hub: false,
+            keepVersions: 2,
+            mcp: true,
+            agentSkills: true,
+            cliVersion: '1.0.0-beta.16',
+            assetCache: 'persisted',
+        },
         godot: { enabled: 'auto', version: 'project', dotnet: 'auto', exportTemplates: true, keepVersions: 2 },
         steam: { enabled: 'auto', client: false, sdkFolder: '' },
         fivem: {
@@ -196,9 +216,16 @@ export const DEFAULTS = {
             home: { env: { CODEX_HOME: 'codex' }, loginFiles: ['auth.json', '.credentials.json'], hostDir: '~/.codex' },
             localState: { CODEX_SQLITE_HOME: 'sqlite' },
             // Its own command sandbox keeps local users' passwords sealed with DPAPI: unreadable in the next sandbox
-            // ("CryptUnprotectData" on every command), so it sets that sandbox up again at each boot. tmp\arg0: folders
-            // Codex cannot remove in a mapped folder (os error 145, a warning at every start); nothing holds them at boot.
-            bootReset: ['.sandbox-secrets', '.sandbox\\setup_marker.json', '.sandbox\\deny_read_acl_state.json', 'tmp\\arg0'],
+            // ("CryptUnprotectData" on every command), so it sets that sandbox up again at each boot. tmp\arg0 and
+            // tmp\arg0-windows (newer Codex): folders Codex cannot remove in a mapped folder (os error 145, a warning at
+            // every start); nothing holds them at boot.
+            bootReset: [
+                '.sandbox-secrets',
+                '.sandbox\\setup_marker.json',
+                '.sandbox\\deny_read_acl_state.json',
+                'tmp\\arg0',
+                'tmp\\arg0-windows',
+            ],
             resumeArguments: ['resume', '--last'],
         },
         gemini: {

package/dist/core/schema/accounts.d.ts

@@ -30,4 +30,7 @@ export declare const AccountsSchema: z.ZodObject<{
     comet: z.ZodObject<{
         share: z.ZodBoolean;
     }, z.core.$strict>;
+    perplexityapp: z.ZodObject<{
+        share: z.ZodBoolean;
+    }, z.core.$strict>;
 }, z.core.$strict>;

package/dist/core/schema/accounts.js

@@ -30,5 +30,6 @@ export const AccountsSchema = z
     appstore: share('appstore', 'import the AuthKey.p8 file in Accounts'),
     perplexity: share('perplexity', 'type the API key in Accounts, or import it from a .env file'),
     comet: share('comet', 'sign in to Comet once in a sandbox: it cannot be taken from this PC'),
+    perplexityapp: share('perplexityapp', 'sign in to the Perplexity app once in a sandbox: it cannot be taken from this PC'),
 })
     .describe('Service sign-ins for sandboxes (game stores, engines, app signing, Perplexity). Manage them in Accounts.');

package/dist/core/schema/config.d.ts

@@ -95,6 +95,7 @@ export declare const ConfigSchema: z.ZodObject<{
     }, z.core.$strict>;
     github: z.ZodObject<{
         shareToken: z.ZodBoolean;
+        usePcLogin: z.ZodBoolean;
     }, z.core.$strict>;
     accounts: z.ZodObject<{
         epic: z.ZodObject<{
@@ -127,12 +128,18 @@ export declare const ConfigSchema: z.ZodObject<{
         comet: z.ZodObject<{
             share: z.ZodBoolean;
         }, z.core.$strict>;
+        perplexityapp: z.ZodObject<{
+            share: z.ZodBoolean;
+        }, z.core.$strict>;
     }, z.core.$strict>;
     pcInstalls: z.ZodObject<{
         steamGames: z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodNumber>]>;
         epicGames: z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>;
-        unrealEngines: z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>;
-        unityEditors: z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>;
+        unrealEngines: z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodBoolean, z.ZodArray<z.ZodString>]>;
+        unrealEngineFolders: z.ZodArray<z.ZodString>;
+        unrealAssets: z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodBoolean]>;
+        unityEditors: z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodBoolean, z.ZodArray<z.ZodString>]>;
+        unityAssets: z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodBoolean]>;
     }, z.core.$strict>;
     provisioning: z.ZodObject<{
         copyFromHost: z.ZodBoolean;
@@ -212,6 +219,14 @@ export declare const ConfigSchema: z.ZodObject<{
             modules: z.ZodArray<z.ZodString>;
             hub: z.ZodBoolean;
             keepVersions: z.ZodNumber;
+            mcp: z.ZodBoolean;
+            agentSkills: z.ZodBoolean;
+            cliVersion: z.ZodString;
+            assetCache: z.ZodEnum<{
+                pc: "pc";
+                persisted: "persisted";
+                local: "local";
+            }>;
         }, z.core.$strict>;
         godot: z.ZodObject<{
             enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;
@@ -577,6 +592,9 @@ export declare const LocalOverridesSchema: z.ZodObject<{
         comet: z.ZodOptional<z.ZodObject<{
             share: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict>>;
+        perplexityapp: z.ZodOptional<z.ZodObject<{
+            share: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
     provisioning: z.ZodOptional<z.ZodObject<{
         copyFromHost: z.ZodOptional<z.ZodBoolean>;
@@ -599,7 +617,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
     }, z.core.$strict>>;
     toolchains: z.ZodOptional<z.ZodObject<{
         environment: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        unity: z.ZodOptional<z.ZodObject<{
+        godot: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -614,7 +632,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        godot: z.ZodOptional<z.ZodObject<{
+        android: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -629,7 +647,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        android: z.ZodOptional<z.ZodObject<{
+        flutter: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -644,7 +662,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        flutter: z.ZodOptional<z.ZodObject<{
+        dart: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -659,7 +677,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        dart: z.ZodOptional<z.ZodObject<{
+        reactNative: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -674,7 +692,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        reactNative: z.ZodOptional<z.ZodObject<{
+        node: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -689,7 +707,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        unreal: z.ZodOptional<z.ZodObject<{
+        go: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -704,7 +722,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        node: z.ZodOptional<z.ZodObject<{
+        python: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -719,7 +737,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        go: z.ZodOptional<z.ZodObject<{
+        rust: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -734,7 +752,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        python: z.ZodOptional<z.ZodObject<{
+        msvc: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -749,7 +767,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        rust: z.ZodOptional<z.ZodObject<{
+        unreal: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -764,7 +782,7 @@ export declare const LocalOverridesSchema: z.ZodObject<{
             zstd: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
             openssl: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>>;
         }, z.core.$strict>>;
-        msvc: z.ZodOptional<z.ZodObject<{
+        unity: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict> | z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;

package/dist/core/schema/github.d.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
 export declare const GithubSchema: z.ZodObject<{
     shareToken: z.ZodBoolean;
+    usePcLogin: z.ZodBoolean;
 }, z.core.$strict>;

package/dist/core/schema/github.js

@@ -4,4 +4,7 @@ export const GithubSchema = z.strictObject({
     shareToken: z
         .boolean()
         .describe('Give each sandbox the GitHub token you saved in Accounts (best a fine-grained token limited to some repositories and permissions), so gh and https git work there without logging in. Only with provisioning.git.access "full". The agent in the sandbox can read the token and use it for whatever it allows. A project file (.sandbox-config.json) cannot turn this on.'),
+    usePcLogin: z
+        .boolean()
+        .describe('Give each sandbox the GitHub CLI (gh) login from this PC, when there is one, so gh and https git work there without logging in. Used when no token saved for sandboxes is handed over. Only with provisioning.git.access "full". Without a gh login on the PC nothing happens. The login reaches everything your account can, and the agent in the sandbox can read it. A project file (.sandbox-config.json) cannot turn this on.'),
 });

package/dist/core/schema/pc-installs.d.ts

@@ -2,6 +2,9 @@ import { z } from 'zod';
 export declare const PcInstallsSchema: z.ZodObject<{
     steamGames: z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodNumber>]>;
     epicGames: z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>;
-    unrealEngines: z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>;
-    unityEditors: z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>;
+    unrealEngines: z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodBoolean, z.ZodArray<z.ZodString>]>;
+    unrealEngineFolders: z.ZodArray<z.ZodString>;
+    unrealAssets: z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodBoolean]>;
+    unityEditors: z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodBoolean, z.ZodArray<z.ZodString>]>;
+    unityAssets: z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodBoolean]>;
 }, z.core.$strict>;

package/dist/core/schema/pc-installs.js

@@ -11,7 +11,21 @@ export const PcInstallsSchema = z
     .strictObject({
     steamGames: pick(z.number().int().positive(), 'Steam games (true maps each library; a list of app IDs maps only those games)', '[480, 730]'),
     epicGames: pick(z.string().regex(/^[A-Za-z0-9._-]{1,100}$/), 'Epic Games Launcher games (by their app name)', '["Fortnite"]'),
-    unrealEngines: pick(z.string().regex(/^(UE_)?\d+\.\d+$/), 'Unreal Engine versions installed with the Epic Games Launcher', '["5.4"]'),
-    unityEditors: pick(z.string().regex(/^\d+\.\d+\.\d+[abfp]\d+$/), 'Unity editors installed with Unity Hub', '["6000.0.32f1"]'),
+    unrealEngines: z
+        .union([z.literal('auto'), z.boolean(), z.array(z.string().regex(/^(UE_)?\d+\.\d+$/))])
+        .describe('Unreal Engine versions installed on this PC (with the Epic Games Launcher, or source builds it lists), read-only in the sandbox under C:\\PcInstalls\\unreal and registered there, so projects build with them without a download. "auto" = all of them whenever the sandbox is set up for Unreal, true = always, false = never, or a list (e.g. ["5.4"]).'),
+    unrealEngineFolders: z
+        .array(z.string().min(3).max(260))
+        .max(8)
+        .describe('Unreal Engine folders of this PC to use in the sandbox, writable (a source build, or a copy you build plugins into): each must hold Engine\\Build\\Build.version. Mapped under C:\\PcInstalls\\unreal and registered there.'),
+    unrealAssets: z
+        .union([z.literal('auto'), z.boolean()])
+        .describe('The Epic Games Launcher\'s vault cache of this PC (the Fab and Marketplace packs you downloaded), read-only in the sandbox at C:\\PcInstalls\\unreal\\Vault: what you download on your PC is there for the agents at once. "auto" = whenever the sandbox is set up for Unreal, true = always, false = never.'),
+    unityEditors: z
+        .union([z.literal('auto'), z.boolean(), z.array(z.string().regex(/^\d+\.\d+\.\d+[abfp]\d+$/))])
+        .describe('Unity editors installed on this PC (with Unity Hub), read-only in the sandbox under C:\\PcInstalls\\unity: a project opens with the PC\'s editor without a download. "auto" = all of them whenever the sandbox is set up for Unity, true = always, false = never, or a list (e.g. ["6000.0.32f1"]).'),
+    unityAssets: z
+        .union([z.literal('auto'), z.boolean()])
+        .describe('This PC\'s Unity Asset Store downloads (.unitypackage files), read-only at C:\\PcInstalls\\unity\\AssetStore: what you download on your PC is there for the agents at once. "auto" = whenever the sandbox is set up for Unity, true = always, false = never.'),
 })
     .describe("Games, engines and editors installed on this PC, mapped read-only into sandboxes (no copy, no room on the sandbox's disk).");

package/dist/core/schema/toolchains.d.ts

@@ -55,6 +55,14 @@ export declare const ToolchainsSchema: z.ZodObject<{
         modules: z.ZodArray<z.ZodString>;
         hub: z.ZodBoolean;
         keepVersions: z.ZodNumber;
+        mcp: z.ZodBoolean;
+        agentSkills: z.ZodBoolean;
+        cliVersion: z.ZodString;
+        assetCache: z.ZodEnum<{
+            pc: "pc";
+            persisted: "persisted";
+            local: "local";
+        }>;
     }, z.core.$strict>;
     godot: z.ZodObject<{
         enabled: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"auto">]>;

package/dist/core/schema/toolchains.js

@@ -40,7 +40,7 @@ export const ToolchainsSchema = z.strictObject({
             .describe('"auto" (default): on the sandbox\'s own disk when C: has 25 GB free at boot, else "separate" (builds then write through the mapped workspace, which can overload this PC\'s disk). "shared": cargo\'s default target\\ (shared with builds on this PC, so builds on either side invalidate the other), "separate": <workspace>\\target\\sandbox (kept, no cross-talk), "local": on the sandbox\'s own disk (fastest, lost every boot), or a guest path.'),
         linker: z
             .enum(['lld', 'gnu'])
-            .describe('GNU host: "lld" links with Rust\'s own lld through MinGW\'s gcc (much less memory than GNU ld), "gnu" with GNU ld.'),
+            .describe('"lld" (default) links with Rust\'s own lld: through MinGW\'s gcc on the GNU host (much less memory than GNU ld), and instead of link.exe on the MSVC host (link.exe writes executables into mapped folders as all zeros: os error 1392). "gnu" keeps GNU ld / link.exe.'),
         linkSlots: z
             .union([z.literal('auto'), z.number().int().min(1).max(32)])
             .describe('GNU host: how many programs may link at the same time in the whole sandbox (other links wait). "auto" = one per 6 GB of sandbox memory, 1 to 4 (the memory governor slows links down too when memory runs short).'),
@@ -70,24 +70,39 @@ export const ToolchainsSchema = z.strictObject({
             .describe('"persisted": the engine\'s local derived data cache (compiled shaders, 10-50 GB) in tools\\unreal\\ddc, kept between sandboxes. "local": Unreal\'s own place on the sandbox disk (rebuilt every boot).'),
     }),
     unity: z.strictObject({
-        enabled: enabled("Unity: the editor version a project asks for, from Unity's release API (checked against its published hash), installed into tools\\unity\\<version> (6-7 GB each), with the modules you list.", 'ProjectSettings/ProjectVersion.txt'),
+        enabled: enabled("Unity: the editor version a project asks for, from Unity's release API (checked against its published hash), installed on the data disk (tools\\unity\\editors\\<version>, 8-13 GB each, kept between sandboxes), with the modules you list. This PC's editors (pcInstalls.unityEditors) are used first.", 'ProjectSettings/ProjectVersion.txt'),
         acceptLicense: z
             .boolean()
             .describe('Required to install: you accept the Unity terms of service (https://unity.com/legal/terms-of-service), and the editor needs a Unity licence (Personal is free). A project file cannot accept it for you.'),
         version: z
             .string()
             .min(1)
-            .describe('"project" = the version in ProjectSettings/ProjectVersion.txt, or an editor version such as "6000.0.32f1".'),
+            .describe('"project" = the version in ProjectSettings/ProjectVersion.txt, or an editor version such as "6000.0.32f1" for folders without one (a project\'s own version always wins).'),
         modules: z
             .array(z.string().regex(/^[a-z0-9-]+$/))
             .describe('Editor modules to add: "android" (4-5 GB, also the Android SDK), "webgl" (1.5 GB), "windows-il2cpp" (adds Visual Studio\'s C++ parts), "ios" (Xcode project export only: iOS builds need a Mac).'),
-        hub: z.boolean().describe('Also Unity Hub, with the installed editors listed in it.'),
+        hub: z
+            .boolean()
+            .describe('Also Unity Hub (kept on the data disk), for signing in to Unity Personal and installing editors by hand.'),
         keepVersions: z
             .number()
             .int()
             .min(1)
             .max(20)
             .describe('How many editor versions to keep in tools\\unity; older ones are removed (the least recently used first).'),
+        mcp: z
+            .boolean()
+            .describe("The Unity CLI's MCP server (unity mcp) in Claude Code and Codex as sbx-unity: Unity's read-only tools always, the open editor's tools when the project has the Unity Pipeline package (Unity 6 and later). Nothing in your project changes."),
+        agentSkills: z
+            .boolean()
+            .describe("Unity's skills for Claude Code and Codex, from Unity-Technologies/skills at the commit the Unity CLI pins."),
+        cliVersion: z
+            .string()
+            .regex(/^(latest|\d+\.\d+\.\d+(-[A-Za-z0-9.]+)?)$/)
+            .describe('The Unity CLI version, checked against the SHA-256 Unity publishes: a version such as "1.0.0-beta.16", or "latest". It never updates itself.'),
+        assetCache: z
+            .enum(['persisted', 'pc', 'local'])
+            .describe('"persisted": Asset Store downloads made in the sandbox go to tools\\unity\\asset-store (kept). "pc": the sandbox uses this PC\'s Asset Store downloads (read-only; download new ones on your PC). "local": Unity\'s own place on the sandbox disk (lost when it closes).'),
     }),
     godot: z.strictObject({
         enabled: enabled('Godot from its official builds (checked against the published SHA-512 sums), self-contained in tools\\godot\\<version> with `godot` (the console build) on PATH.', 'project.godot'),
@@ -218,7 +233,7 @@ export const ToolchainsSchema = z.strictObject({
     }),
     cli: z
         .strictObject({
-        gh: EnabledSchema.describe('GitHub CLI (gh). Only with provisioning.git.access "full": gh can push and merge through the GitHub API, past a read-only git. Your PC\'s gh login is never copied; `gh auth login` inside persists (GH_CONFIG_DIR), unless a token you saved for sandboxes is handed over (github.shareToken). "auto" = when the project has a .github folder.'),
+        gh: EnabledSchema.describe('GitHub CLI (gh). Only with provisioning.git.access "full": gh can push and merge through the GitHub API, past a read-only git. Your PC\'s gh login is copied only with github.usePcLogin (or a token you saved for sandboxes with github.shareToken); otherwise `gh auth login` inside persists (GH_CONFIG_DIR). "auto" = when the project has a .github folder.'),
         zstd: EnabledSchema.describe('Zstandard (zstd). "auto" = off; set true to get it.'),
         openssl: EnabledSchema.describe('`openssl` on PATH, from the copy Git for Windows ships (its mingw64\\bin is not put on PATH, so it cannot shadow MinGW\'s gcc). "auto" = on.'),
     })

package/dist/guest/accounts/adapters.js

@@ -5,6 +5,7 @@ import { epicAdapter } from './kinds/epic.js';
 import { expoAdapter } from './kinds/expo.js';
 import { keystoreAdapter } from './kinds/keystore.js';
 import { perplexityAdapter } from './kinds/perplexity.js';
+import { perplexityAppAdapter } from './kinds/perplexityapp.js';
 import { playAdapter } from './kinds/play.js';
 import { steamAdapter } from './kinds/steam.js';
 import { unityAdapter } from './kinds/unity.js';
@@ -19,4 +20,5 @@ export const ADAPTERS = {
     appstore: appstoreAdapter,
     perplexity: perplexityAdapter,
     comet: cometAdapter,
+    perplexityapp: perplexityAppAdapter,
 };

package/dist/guest/accounts/apply.d.ts

@@ -4,28 +4,30 @@ import type { ServiceAccounts } from '../../shared/accounts/payloads.js';
 import { type GuestAdapter } from './adapter.js';
 export declare const DeliveredSchema: z.ZodObject<{
     fingerprints: z.ZodRecord<z.ZodEnum<{
-        unity: "unity";
         keystore: "keystore";
         play: "play";
         expo: "expo";
         appstore: "appstore";
+        unity: "unity";
         steam: "steam";
         epic: "epic";
         cfx: "cfx";
         perplexity: "perplexity";
         comet: "comet";
+        perplexityapp: "perplexityapp";
     }> & z.core.$partial, z.ZodString>;
     leased: z.ZodArray<z.ZodEnum<{
-        unity: "unity";
         keystore: "keystore";
         play: "play";
         expo: "expo";
         appstore: "appstore";
+        unity: "unity";
         steam: "steam";
         epic: "epic";
         cfx: "cfx";
         perplexity: "perplexity";
         comet: "comet";
+        perplexityapp: "perplexityapp";
     }>>;
 }, z.core.$strip>;
 export type Delivered = z.output<typeof DeliveredSchema>;

package/dist/guest/accounts/kinds/epic.js

@@ -1,26 +1,31 @@
 // Epic Games: the handed-over sign-in goes into the launcher's GameUserSettings.ini before anyone opens it (its other
-// settings are kept, and the file keeps the encoding it had: the launcher often writes UTF-16). The watch reads it
-// back to notice when the launcher renews it, or when you sign in here the first time.
+// settings are kept, and the file keeps the encoding it had: the launcher often writes UTF-16). Launcher 17+ reads
+// Config\WindowsEditor, older ones Config\Windows: both get it. The watch reads it back to notice when the launcher
+// renews it, or when you sign in here the first time.
 import fs from 'node:fs';
 import path from 'node:path';
-import { epicSettingsFile, MAX_EPIC_INI_BYTES, readEpicLogin, withEpicLogin, } from '../../../shared/accounts/index.js';
+import { epicSettingsFiles, MAX_EPIC_INI_BYTES, readEpicLogin, withEpicLogin, } from '../../../shared/accounts/index.js';
 import { decodeText, encodeText, readBoundedFile } from '../../../shared/io/index.js';
 import { localAppData } from '../adapter.js';
-function settingsFile() {
-    return epicSettingsFile(localAppData());
-}
 export const epicAdapter = {
     kind: 'epic',
     apply(p) {
-        const file = settingsFile();
-        const bytes = readBoundedFile(file, MAX_EPIC_INI_BYTES);
-        const read = bytes ? decodeText(bytes) : { text: '', encoding: 'utf8' };
-        fs.mkdirSync(path.dirname(file), { recursive: true });
-        fs.writeFileSync(file, encodeText(withEpicLogin(read.text, p), read.encoding));
+        for (const file of epicSettingsFiles(localAppData())) {
+            const bytes = readBoundedFile(file, MAX_EPIC_INI_BYTES);
+            const read = bytes ? decodeText(bytes) : { text: '', encoding: 'utf8' };
+            fs.mkdirSync(path.dirname(file), { recursive: true });
+            fs.writeFileSync(file, encodeText(withEpicLogin(read.text, p), read.encoding));
+        }
         return { summary: 'Epic Games Launcher: signed in with your saved sign-in' };
     },
     current() {
-        const bytes = readBoundedFile(settingsFile(), MAX_EPIC_INI_BYTES);
-        return bytes ? readEpicLogin(decodeText(bytes).text) : null;
+        // The newest place first: the one the launcher in this sandbox writes when it renews the sign-in.
+        for (const file of epicSettingsFiles(localAppData())) {
+            const bytes = readBoundedFile(file, MAX_EPIC_INI_BYTES);
+            const login = bytes ? readEpicLogin(decodeText(bytes).text) : null;
+            if (login)
+                return login;
+        }
+        return null;
     },
 };

package/dist/guest/accounts/kinds/perplexityapp.d.ts

@@ -0,0 +1,7 @@
+import { type CometPayload } from '../../../shared/accounts/index.js';
+import { type GuestAdapter } from '../adapter.js';
+/** Where the sign-in waits for the app. */
+export declare function perplexityAppPendingFile(root?: string): string;
+/** The sign-in waiting for the app (left in place), or null (none, or not the expected shape). */
+export declare function peekPendingPerplexityApp(root?: string): CometPayload | null;
+export declare const perplexityAppAdapter: GuestAdapter<'perplexityapp'>;

package/dist/guest/accounts/kinds/perplexityapp.js

@@ -0,0 +1,53 @@
+// Perplexity desktop app: the saved perplexity.ai sign-in cookies wait in secretDir('perplexityapp') (the sandbox's own
+// disk) until the app runs; the watch then writes them into it over its DevTools port and deletes the file. While the
+// sandbox runs, the watch asks the running app for its perplexity.ai cookies, so a sign-in made here (or renewed) is
+// kept for the next sandbox. When the app is not running, the last sign-in seen stands.
+import fs from 'node:fs';
+import path from 'node:path';
+import { cometSummary, PAYLOADS } from '../../../shared/accounts/index.js';
+import { readBoundedFile } from '../../../shared/io/bounded.js';
+import { readAppSignIn, restoreAppSignIn } from '../../browser/perplexity-app.js';
+import { secretDir } from '../adapter.js';
+/** Where the sign-in waits for the app. */
+export function perplexityAppPendingFile(root = secretDir('perplexityapp')) {
+    return path.join(root, 'restore.json');
+}
+/** The sign-in waiting for the app (left in place), or null (none, or not the expected shape). */
+export function peekPendingPerplexityApp(root) {
+    const bytes = readBoundedFile(perplexityAppPendingFile(root), 512 * 1024);
+    if (!bytes)
+        return null;
+    try {
+        const parsed = PAYLOADS.perplexityapp.safeParse(JSON.parse(bytes.toString('utf8')));
+        return parsed.success ? parsed.data : null;
+    }
+    catch {
+        return null; // Not JSON: nothing to restore.
+    }
+}
+/** The last sign-in seen in this process (the daemon's watch). */
+let held = null;
+export const perplexityAppAdapter = {
+    kind: 'perplexityapp',
+    apply(p) {
+        const file = perplexityAppPendingFile();
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, JSON.stringify(p), { encoding: 'utf8', mode: 0o600 });
+        held = p;
+        return {
+            summary: 'Perplexity app: your saved sign-in (' + cometSummary(p) + ') goes into it once it runs (reload its window)',
+        };
+    },
+    async refresh() {
+        const pending = peekPendingPerplexityApp();
+        if (pending && (await restoreAppSignIn(pending).catch(() => false)))
+            fs.rmSync(perplexityAppPendingFile(), { force: true });
+        const now = await readAppSignIn();
+        if (now)
+            held = now;
+    },
+    current() {
+        return held;
+    },
+    checkMs: 30_000,
+};

package/dist/guest/accounts/kinds/unity.d.ts

@@ -1,2 +1,29 @@
+import type { UnityStatus } from '../../../shared/unity/status.js';
 import { type GuestAdapter } from '../adapter.js';
+/** Runs a program to its end (or its time limit); the exit code and what it printed. Injected by the self-test. */
+export type UnityRunner = (file: string, args: readonly string[], o: {
+    readonly timeoutMs: number;
+    readonly env?: Readonly<Record<string, string>>;
+}) => Promise<{
+    readonly code: number;
+    readonly stdout: string;
+}>;
+export declare const runUnityProgram: UnityRunner;
+export interface UnityDirs {
+    readonly programData: string;
+    readonly localAppData: string;
+    /** secretDir('unity'). */
+    readonly secrets: string;
+}
+/** The adapter for these folders and this runner (the self-test passes its own). */
+export declare function unityAdapterFor(dirs: UnityDirs, run?: UnityRunner): GuestAdapter<'unity'>;
 export declare const unityAdapter: GuestAdapter<'unity'>;
+/**
+ * Activates the serial the sandbox holds once an editor exists, then asks `unity license status` where the licence
+ * stands. The detail never holds a secret.
+ */
+export declare function activateUnityLicence(o: {
+    readonly editorExe: string | null;
+    readonly unityExe: string | null;
+    readonly source?: string;
+}, dirs?: UnityDirs, run?: UnityRunner): Promise<UnityStatus['licence']>;