windows-development-sandbox 1.25.1 → 1.27.0

package/dist/runtime/view.js

@@ -26294,21 +26294,35 @@ var ToolchainsSchema = external_exports.strictObject({
   }),
   unity: external_exports.strictObject({
     enabled: enabled(
-      "Unity: the editor version a project asks for, from Unity's release API (checked against its published hash), installed into tools\\unity\\<version> (6-7 GB each), with the modules you list.",
+      "Unity: the editor version a project asks for, from Unity's release API (checked against its published hash), installed on the data disk (tools\\unity\\editors\\<version>, 8-13 GB each, kept between sandboxes), with the modules you list. This PC's editors (pcInstalls.unityEditors) are used first.",
       "ProjectSettings/ProjectVersion.txt"
     ),
     acceptLicense: external_exports.boolean().describe(
       "Required to install: you accept the Unity terms of service (https://unity.com/legal/terms-of-service), and the editor needs a Unity licence (Personal is free). A project file cannot accept it for you."
     ),
     version: external_exports.string().min(1).describe(
-      '"project" = the version in ProjectSettings/ProjectVersion.txt, or an editor version such as "6000.0.32f1".'
+      `"project" = the version in ProjectSettings/ProjectVersion.txt, or an editor version such as "6000.0.32f1" for folders without one (a project's own version always wins).`
     ),
     modules: external_exports.array(external_exports.string().regex(/^[a-z0-9-]+$/)).describe(
       `Editor modules to add: "android" (4-5 GB, also the Android SDK), "webgl" (1.5 GB), "windows-il2cpp" (adds Visual Studio's C++ parts), "ios" (Xcode project export only: iOS builds need a Mac).`
     ),
-    hub: external_exports.boolean().describe("Also Unity Hub, with the installed editors listed in it."),
+    hub: external_exports.boolean().describe(
+      "Also Unity Hub (kept on the data disk), for signing in to Unity Personal and installing editors by hand."
+    ),
     keepVersions: external_exports.number().int().min(1).max(20).describe(
       "How many editor versions to keep in tools\\unity; older ones are removed (the least recently used first)."
+    ),
+    mcp: external_exports.boolean().describe(
+      "The Unity CLI's MCP server (unity mcp) in Claude Code and Codex as sbx-unity: Unity's read-only tools always, the open editor's tools when the project has the Unity Pipeline package (Unity 6 and later). Nothing in your project changes."
+    ),
+    agentSkills: external_exports.boolean().describe(
+      "Unity's skills for Claude Code and Codex, from Unity-Technologies/skills at the commit the Unity CLI pins."
+    ),
+    cliVersion: external_exports.string().regex(/^(latest|\d+\.\d+\.\d+(-[A-Za-z0-9.]+)?)$/).describe(
+      'The Unity CLI version, checked against the SHA-256 Unity publishes: a version such as "1.0.0-beta.16", or "latest". It never updates itself.'
+    ),
+    assetCache: external_exports.enum(["persisted", "pc", "local"]).describe(
+      `"persisted": Asset Store downloads made in the sandbox go to tools\\unity\\asset-store (kept). "pc": the sandbox uses this PC's Asset Store downloads (read-only; download new ones on your PC). "local": Unity's own place on the sandbox disk (lost when it closes).`
     )
   }),
   godot: external_exports.strictObject({
@@ -26460,7 +26474,7 @@ var ToolchainsSchema = external_exports.strictObject({
   }),
   cli: external_exports.strictObject({
     gh: EnabledSchema.describe(
-      'GitHub CLI (gh). Only with provisioning.git.access "full": gh can push and merge through the GitHub API, past a read-only git. Your PC\'s gh login is never copied; `gh auth login` inside persists (GH_CONFIG_DIR), unless a token you saved for sandboxes is handed over (github.shareToken). "auto" = when the project has a .github folder.'
+      'GitHub CLI (gh). Only with provisioning.git.access "full": gh can push and merge through the GitHub API, past a read-only git. Your PC\'s gh login is copied only with github.usePcLogin (or a token you saved for sandboxes with github.shareToken); otherwise `gh auth login` inside persists (GH_CONFIG_DIR). "auto" = when the project has a .github folder.'
     ),
     zstd: EnabledSchema.describe('Zstandard (zstd). "auto" = off; set true to get it.'),
     openssl: EnabledSchema.describe(
@@ -26515,6 +26529,9 @@ var COMET_SIGNER = {
   subject: ['(^|, )CN="?PERPLEXITY AI, INC\\.?"?(,|$)', '(^|, )O="?PERPLEXITY AI, INC\\.?"?(,|$)'],
   issuer: ["^CN=GlobalSign GCC R45 EV CodeSigning CA 2020(,|$)"]
 };
+var PERPLEXITY_DESKTOP_PRODUCT_ID = "9P9XG917PWCJ";
+var PERPLEXITY_DESKTOP_PACKAGE = "PerplexityAI.PerplexityApp";
+var PERPLEXITY_DESKTOP_FAMILY = "PerplexityAI.PerplexityApp_3jh4kjrg4dzr2";
 var EDGE_EXE = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe";
 var AGENTS_WEB_APPS = [
   {
@@ -26561,6 +26578,22 @@ var AGENTS_WEB_APPS = [
     signer: COMET_SIGNER,
     userOnly: true
   },
+  {
+    id: "perplexity-desktop",
+    name: "Perplexity (desktop app)",
+    category: "agents",
+    about: "Perplexity's desktop app, with Perplexity Computer, from the Microsoft Store. The package comes from this PC (winget with your own Microsoft Store access) and is kept on the data disk; the sandbox installs it on every boot. With accounts.perplexityapp.share on, your sign-in made in a sandbox is kept for the next ones (it cannot be copied from this PC). It acts on what it reads: use it only on what you would let it act on.",
+    size: "300 MB",
+    source: {
+      store: {
+        productId: PERPLEXITY_DESKTOP_PRODUCT_ID,
+        packageName: PERPLEXITY_DESKTOP_PACKAGE,
+        family: PERPLEXITY_DESKTOP_FAMILY
+      }
+    },
+    exe: "",
+    userOnly: true
+  },
   {
     id: "comet-mcp",
     name: "Comet MCP",
@@ -26614,6 +26647,8 @@ var AGENTS_WEB_APPS = [
 ];
 
 // src/shared/apps/catalogue-gamedev.ts
+var UNITY_MCP_VERSION = "10.3.0";
+var OPENUPM_CLI_VERSION = "4.5.3";
 var GAMEDEV_APPS = [
   {
     id: "krita",
@@ -26683,6 +26718,34 @@ var GAMEDEV_APPS = [
     size: "60 MB",
     source: { github: "nomacs/nomacs", asset: "^nomacs-portable-win\\.zip$" },
     exe: "nomacs.exe"
+  },
+  {
+    id: "unity-mcp",
+    name: "MCP for Unity",
+    category: "agents",
+    about: "Lets Claude Code and Codex work in an open Unity editor (CoplayDev/unity-mcp 10.3.0, MIT; Unity 2021.3 to 6.x). Your project needs its package (Unity page: Add the editor bridge). Telemetry is off.",
+    size: "60 MB",
+    source: { locked: "uv", package: "mcpforunityserver", version: UNITY_MCP_VERSION },
+    exe: "mcp-for-unity.exe",
+    service: true,
+    mcp: {
+      name: "sbx-unity-mcp",
+      program: true,
+      args: ["--transport", "stdio"],
+      env: { DISABLE_TELEMETRY: "1", UNITY_MCP_DISABLE_TELEMETRY: "1", MCP_DISABLE_TELEMETRY: "1" },
+      codex: true
+    },
+    plugsInto: "Claude Code and Codex as the MCP server sbx-unity-mcp",
+    userOnly: true
+  },
+  {
+    id: "openupm-cli",
+    name: "openupm-cli",
+    category: "gamedev",
+    about: "Adds OpenUPM packages to Unity projects from the command line (openupm 4.5.3, BSD-3-Clause).",
+    size: "15 MB",
+    source: { locked: "npm", package: "openupm-cli", version: OPENUPM_CLI_VERSION },
+    exe: "openupm.cmd"
   }
 ];
 
@@ -27557,6 +27620,21 @@ var CORE_APPS = [
 ];
 var APPS = [...CORE_APPS, ...GAMEDEV_APPS, ...MODDING_APPS, ...MOBILE_APPS, ...AGENTS_WEB_APPS];
 
+// src/shared/apps/store-package.ts
+var GB = 1024 * 1024 * 1024;
+var FILE_NAME = /^[A-Za-z0-9._~+-]{1,200}\.(msix|appx|msixbundle|appxbundle)$/i;
+var StorePackageFileSchema = external_exports.strictObject({
+  name: external_exports.string().regex(FILE_NAME),
+  role: external_exports.enum(["main", "dependency"]),
+  sha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  bytes: external_exports.number().int().positive().max(2 * GB)
+});
+var StorePackageManifestSchema = external_exports.strictObject({
+  productId: external_exports.string().regex(/^[A-Z0-9]{12}$/),
+  fetchedAt: external_exports.string().max(40),
+  files: external_exports.array(StorePackageFileSchema).min(1).max(24)
+}).refine((m) => m.files.filter((f) => f.role === "main").length === 1, "exactly one file must be the app itself").refine((m) => new Set(m.files.map((f) => f.name.toLowerCase())).size === m.files.length, "file names repeat");
+
 // src/core/schema/apps.ts
 var CATALOGUE_IDS = APPS.filter((a) => !a.setting).map((a) => a.id);
 var AppIdSchema = external_exports.enum(CATALOGUE_IDS);
@@ -27691,6 +27769,9 @@ var VpnSchema = external_exports.strictObject({
 var GithubSchema = external_exports.strictObject({
   shareToken: external_exports.boolean().describe(
     'Give each sandbox the GitHub token you saved in Accounts (best a fine-grained token limited to some repositories and permissions), so gh and https git work there without logging in. Only with provisioning.git.access "full". The agent in the sandbox can read the token and use it for whatever it allows. A project file (.sandbox-config.json) cannot turn this on.'
+  ),
+  usePcLogin: external_exports.boolean().describe(
+    'Give each sandbox the GitHub CLI (gh) login from this PC, when there is one, so gh and https git work there without logging in. Used when no token saved for sandboxes is handed over. Only with provisioning.git.access "full". Without a gh login on the PC nothing happens. The login reaches everything your account can, and the agent in the sandbox can read it. A project file (.sandbox-config.json) cannot turn this on.'
   )
 });
 
@@ -27739,7 +27820,9 @@ var SERVICE_SPECS = {
     warnings: [
       AGENT_CAN_USE,
       ONE_PLACE,
-      "A Pro seat is handed back when the sandbox stops cleanly; a sandbox closed abruptly may keep it until you return it."
+      "Unity Personal is activated by signing in: sign in to Unity once in a sandbox and the licence it makes is kept for the next ones (if Unity refuses it there, sign in again).",
+      "A Plus or Pro serial is activated in each sandbox and handed back when the sandbox stops cleanly; a sandbox closed abruptly may keep the seat until you remove it at id.unity.com (My Seats).",
+      "A licence file taken from this PC may not work in a sandbox: Unity ties it to the computer."
     ],
     fields: [
       { name: "email", label: "Unity ID email", secret: false, optional: true },
@@ -27866,11 +27949,28 @@ var SERVICE_SPECS = {
       "Several sandboxes can use it at once: the sign-in the last one hands back is kept."
     ],
     fields: []
+  },
+  perplexityapp: {
+    kind: "perplexityapp",
+    label: "Perplexity desktop app",
+    usedBy: ["perplexityapp"],
+    sources: ["sandbox"],
+    singleHolder: false,
+    returns: true,
+    maxBytes: 256 * 1024,
+    warnings: [
+      AGENT_CAN_USE + " It can act as you in the Perplexity app and spend your Perplexity Computer credits; the app acts on the pages it reads, which can try to steer it.",
+      "Your sign-in in the Perplexity app can't be copied from this PC: Windows locks it to your PC account. Sign in once inside a sandbox and it is kept for the next ones.",
+      "Only the perplexity.ai sign-in cookies are kept: never saved passwords, other sites, localStorage or history.",
+      "Several sandboxes can use it at once: the sign-in the last one hands back is kept."
+    ],
+    fields: []
   }
 };
 var APP_USER_TEXT = {
   perplexity: "the Perplexity MCP app",
-  comet: "the Comet app"
+  comet: "the Comet app",
+  perplexityapp: "the Perplexity desktop app"
 };
 function usedByText(usedBy) {
   return usedBy.map((u) => u in APP_USER_TEXT ? APP_USER_TEXT[u] : u).join(" or ");
@@ -27895,7 +27995,11 @@ var AccountsSchema = external_exports.strictObject({
   expo: share("expo", "type the token in Accounts"),
   appstore: share("appstore", "import the AuthKey.p8 file in Accounts"),
   perplexity: share("perplexity", "type the API key in Accounts, or import it from a .env file"),
-  comet: share("comet", "sign in to Comet once in a sandbox: it cannot be taken from this PC")
+  comet: share("comet", "sign in to Comet once in a sandbox: it cannot be taken from this PC"),
+  perplexityapp: share(
+    "perplexityapp",
+    "sign in to the Perplexity app once in a sandbox: it cannot be taken from this PC"
+  )
 }).describe("Service sign-ins for sandboxes (game stores, engines, app signing, Perplexity). Manage them in Accounts.");
 
 // src/core/schema/pc-installs.ts
@@ -27922,10 +28026,11 @@ var PcInstallsSchema = external_exports.strictObject({
   unrealAssets: external_exports.union([external_exports.literal("auto"), external_exports.boolean()]).describe(
     `The Epic Games Launcher's vault cache of this PC (the Fab and Marketplace packs you downloaded), read-only in the sandbox at C:\\PcInstalls\\unreal\\Vault: what you download on your PC is there for the agents at once. "auto" = whenever the sandbox is set up for Unreal, true = always, false = never.`
   ),
-  unityEditors: pick2(
-    external_exports.string().regex(/^\d+\.\d+\.\d+[abfp]\d+$/),
-    "Unity editors installed with Unity Hub",
-    '["6000.0.32f1"]'
+  unityEditors: external_exports.union([external_exports.literal("auto"), external_exports.boolean(), external_exports.array(external_exports.string().regex(/^\d+\.\d+\.\d+[abfp]\d+$/))]).describe(
+    `Unity editors installed on this PC (with Unity Hub), read-only in the sandbox under C:\\PcInstalls\\unity: a project opens with the PC's editor without a download. "auto" = all of them whenever the sandbox is set up for Unity, true = always, false = never, or a list (e.g. ["6000.0.32f1"]).`
+  ),
+  unityAssets: external_exports.union([external_exports.literal("auto"), external_exports.boolean()]).describe(
+    `This PC's Unity Asset Store downloads (.unitypackage files), read-only at C:\\PcInstalls\\unity\\AssetStore: what you download on your PC is there for the agents at once. "auto" = whenever the sandbox is set up for Unity, true = always, false = never.`
   )
 }).describe(
   "Games, engines and editors installed on this PC, mapped read-only into sandboxes (no copy, no room on the sandbox's disk)."

package/dist/selftest/agents-web.test.js

@@ -539,11 +539,12 @@ export const agentsWebSuite = {
             'perplexity-mcp',
             'perplexity-computer-mcp',
             'comet',
+            'perplexity-desktop',
             'comet-mcp',
             'chrome-devtools-mcp',
             'browser-use-mcp',
         ];
-        t.equal(AGENTS_WEB_APPS.map((a) => a.id), ids, 'the six entries');
+        t.equal(AGENTS_WEB_APPS.map((a) => a.id), ids, 'the seven entries');
         for (const entry of AGENTS_WEB_APPS) {
             t.check(APPS.filter((a) => a.id === entry.id).length === 1 &&
                 entry.userOnly === true &&

package/dist/selftest/engines.test.js

@@ -439,9 +439,9 @@ export const enginesSuite = {
         t.section('the game-development apps');
         const ids = APPS.map((a) => a.id);
         t.check(new Set(ids).size === ids.length, 'every app id is used once');
-        t.equal(GAMEDEV_APPS.map((a) => a.id), ['krita', 'inkscape', 'audacity', 'renderdoc', 'f3d', 'imagemagick', 'nomacs'], 'Krita, Inkscape, Audacity, RenderDoc, then F3D, ImageMagick, nomacs for previews (Blender was there)');
+        t.equal(GAMEDEV_APPS.map((a) => a.id), ['krita', 'inkscape', 'audacity', 'renderdoc', 'f3d', 'imagemagick', 'nomacs', 'unity-mcp', 'openupm-cli'], 'Krita, Inkscape, Audacity, RenderDoc, F3D, ImageMagick, nomacs, then the Unity add-ons (Blender was there)');
         t.check(ids.includes('blender'), 'Blender is in the catalogue');
-        t.check(GAMEDEV_APPS.every((a) => a.category === 'gamedev' && a.exe && a.about.length > 20), 'each is a game-development app with its program');
+        t.check(GAMEDEV_APPS.every((a) => (a.category === 'gamedev' || a.id === 'unity-mcp') && a.exe && a.about.length > 20), 'each is a game-development app with its program');
         const audacity = new RegExp(GAMEDEV_APPS.find((a) => a.id === 'audacity').source.asset);
         t.check(audacity.test('audacity-win-4.0.2-x86_64.7z') &&
             audacity.test('audacity-win-3.7.7-64bit.zip') &&

package/dist/selftest/github.test.js

@@ -9,7 +9,7 @@ import { pageLines } from '../cli/output/index.js';
 import { DEFAULTS } from '../core/config/index.js';
 import { applyOverrides, normalizeOverrides } from '../core/local-config/index.js';
 import { ConfigSchema, LocalOverridesSchema } from '../core/schema/index.js';
-import { checkGithubToken, GithubToken, githubTokenAllowed, prepareGithubToken, verifyGithubToken, } from '../host/github/index.js';
+import { checkGithubToken, GithubToken, githubTokenAllowed, parseHostsYml, prepareGithubToken, readPcGhLogin, verifyGithubToken, } from '../host/github/index.js';
 import { UserError } from '../core/util/index.js';
 import { report } from '../cli/report.js';
 import { toWireError, fromWireError } from '../app/kernel/index.js';
@@ -288,6 +288,69 @@ export const githubSuite = {
         shareOn.github.shareToken = true;
         t.check(prepareGithubToken(shareOn, shareOn.storage.root, expiring, [], Date.parse('2027-01-30T00:00:00.000Z')).notes.some((n) => n.includes('expires in 5 days')) &&
             !prepareGithubToken(shareOn, shareOn.storage.root, expiring, [], Date.parse('2026-12-01T00:00:00.000Z')).notes.some((n) => n.includes('expires')), 'a launch mentions a token that ends within 7 days, and only then');
+        t.section('the gh login on this PC (github.usePcLogin)');
+        const PC_TOKEN = 'gho_' + 'a'.repeat(36);
+        const KEYRING_TOKEN = 'gho_' + 'b'.repeat(36);
+        const hosts = (token) => [
+            'github.com:',
+            '    users:',
+            '        other:',
+            '            oauth_token: gho_' + 'z'.repeat(36),
+            '        josh:',
+            ...(token ? ['            oauth_token: ' + token] : []),
+            '    git_protocol: https',
+            '    user: josh',
+            '',
+        ].join('\r\n');
+        t.equal(parseHostsYml(hosts(PC_TOKEN)), { signedIn: true, token: PC_TOKEN }, 'hosts.yml: the active user token');
+        t.equal(parseHostsYml('github.com:\n    oauth_token: ' + PC_TOKEN + '\n    user: josh\n'), { signedIn: true, token: PC_TOKEN }, 'hosts.yml: an older file with the token under the host');
+        t.equal(parseHostsYml('ghe.corp:\n    oauth_token: ' + PC_TOKEN + '\n'), { signedIn: false, token: null }, 'hosts.yml: other hosts are not read');
+        t.equal(parseHostsYml(hosts(null)), { signedIn: true, token: null }, 'hosts.yml: a login kept in Credential Manager');
+        t.equal(parseHostsYml(''), { signedIn: false, token: null }, 'hosts.yml: empty');
+        const pcDir = t.dir('github-pc');
+        const pcEnv = { GH_CONFIG_DIR: pcDir, GH_TOKEN: 'x'.repeat(30) };
+        t.check(readPcGhLogin({ env: pcEnv, run: () => 'never' }) === null, 'no hosts.yml: no login, quietly');
+        fs.writeFileSync(path.join(pcDir, 'hosts.yml'), hosts(PC_TOKEN));
+        t.check(readPcGhLogin({ env: pcEnv, run: () => 'never' }) === PC_TOKEN, 'the token is read from hosts.yml');
+        fs.writeFileSync(path.join(pcDir, 'hosts.yml'), hosts(null));
+        t.check(readPcGhLogin({ env: pcEnv, run: () => KEYRING_TOKEN }) === null, 'a keyring login with no gh.exe found: none');
+        const exeDir = t.dir('github-pc-programs');
+        fs.mkdirSync(path.join(exeDir, 'GitHub CLI'), { recursive: true });
+        fs.writeFileSync(path.join(exeDir, 'GitHub CLI', 'gh.exe'), '');
+        const seen = [];
+        const keyring = readPcGhLogin({
+            env: { ...pcEnv, ProgramFiles: exeDir },
+            run: (exe) => (seen.push(exe), KEYRING_TOKEN + '\n'),
+        });
+        t.check(keyring === KEYRING_TOKEN && seen.length === 1 && path.isAbsolute(seen[0] ?? ''), 'a keyring login is read with the PC gh.exe, by absolute path', JSON.stringify([keyring, seen]));
+        t.check(readPcGhLogin({ env: { ...pcEnv, ProgramFiles: exeDir }, run: () => 'not a token' }) === null, 'whatever gh prints must look like a token');
+        const pcConfig = f.makeConfig();
+        pcConfig.github.usePcLogin = true;
+        const pcStore = new GithubToken(pcConfig.storage.root, SecretStore.memory());
+        const pcNoLogin = prepareGithubToken(pcConfig, pcConfig.storage.root, pcStore, [], 0, {
+            env: { GH_CONFIG_DIR: t.dir('github-pc-empty') },
+        });
+        t.equal(pcNoLogin, { notes: [] }, 'on, but the PC has no gh login: nothing is delivered, nothing is said');
+        fs.writeFileSync(path.join(pcDir, 'hosts.yml'), hosts(PC_TOKEN));
+        const pcEnvOnly = { env: { GH_CONFIG_DIR: pcDir } };
+        const pcOn = prepareGithubToken(pcConfig, pcConfig.storage.root, pcStore, [], 0, pcEnvOnly);
+        t.check(pcOn.token === PC_TOKEN && pcOn.notes.length === 1 && !JSON.stringify(pcOn.notes).includes(PC_TOKEN), 'on with a gh login: delivered, and the notes never hold it');
+        pcConfig.github.usePcLogin = false;
+        t.equal(prepareGithubToken(pcConfig, pcConfig.storage.root, pcStore, [], 0, pcEnvOnly), { notes: [] }, 'off: the PC login is not even read');
+        pcConfig.github.usePcLogin = true;
+        pcConfig.github.shareToken = true;
+        pcStore.save(FINE);
+        t.check(prepareGithubToken(pcConfig, pcConfig.storage.root, pcStore, [], 0, pcEnvOnly).token === FINE, 'a token saved for sandboxes wins over the PC login');
+        pcStore.remove();
+        t.check(prepareGithubToken(pcConfig, pcConfig.storage.root, pcStore, [], 0, pcEnvOnly).token === PC_TOKEN, 'with none saved, the PC login is used');
+        pcConfig.provisioning.git.access = 'readonly';
+        const pcStrict = prepareGithubToken(pcConfig, pcConfig.storage.root, pcStore, [], 0, pcEnvOnly);
+        t.check(pcStrict.token === undefined &&
+            !githubTokenAllowed(pcConfig) &&
+            pcStrict.notes.some((n) => n.includes('"readonly"')), 'git access readonly: the PC login is not handed over');
+        const pcSecrets = SecretsFileSchema.safeParse({ githubToken: PC_TOKEN });
+        t.check(pcSecrets.success, 'an OAuth token from the PC passes the secrets file limits');
+        t.check(DEFAULTS.github.usePcLogin === false, 'the PC login is off by default');
         t.section('errors with an action');
         const fixable = new UserError('Broke.', 'Do it.', { op: 'sandbox.stop', label: 'Stop it', cli: 'sandbox stop' });
         const wire = toWireError(fixable);

package/dist/selftest/index.js

@@ -18,10 +18,15 @@ import { steamSuite } from './steam.test.js';
 import { enginesSuite } from './engines.test.js';
 import { mixamoSuite } from './mixamo.test.js';
 import { unitySuite } from './unity.test.js';
+import { unitySetupSuite } from './unity-setup.test.js';
+import { unityAccountsSuite } from './unity-accounts.test.js';
+import { unityPageSuite } from './unity-page.test.js';
+import { unityAgentSuite } from './unity-agent.test.js';
 import { fivemSuite } from './fivem.test.js';
 import { androidSuite } from './android.test.js';
 import { mobileSuite } from './mobile.test.js';
 import { agentsWebSuite } from './agents-web.test.js';
+import { storeAppSuite } from './store-app.test.js';
 import { credentialsSuite } from './credentials.test.js';
 import { vpnSuite } from './vpn.test.js';
 import { githubSuite } from './github.test.js';
@@ -142,10 +147,15 @@ export const SUITES = [
     enginesSuite,
     mixamoSuite,
     unitySuite,
+    unitySetupSuite,
+    unityAccountsSuite,
+    unityPageSuite,
+    unityAgentSuite,
     fivemSuite,
     androidSuite,
     mobileSuite,
     agentsWebSuite,
+    storeAppSuite,
     detectSuite,
     networkSuite,
     personalizationSuite,

package/dist/selftest/menu-screens.js

@@ -11,6 +11,7 @@ import { maintenanceOptions } from '../cli/menu/pages/maintenance-page.js';
 import { sandboxOptions } from '../cli/menu/pages/sandbox-page.js';
 import { sessionsOptions } from '../cli/menu/pages/sessions-page.js';
 import { UNREAL_SAMPLE } from './support/unreal-sample.js';
+import { UNITY_SAMPLE } from './support/unity-sample.js';
 import { settingsOf, settingsOptions } from '../cli/menu/pages/settings-page.js';
 import { CATEGORIES } from '../app/features/settings/index.js';
 import { agentsOptions } from '../cli/menu/pages/agents-page.js';
@@ -201,6 +202,7 @@ export function renderScreens(dir) {
         ],
         defaultAgent: 'claude',
         unreal: UNREAL_SAMPLE,
+        unity: UNITY_SAMPLE,
     };
     const stopped = {
         ...sandbox,
@@ -401,7 +403,7 @@ export function renderScreens(dir) {
         out.push(block('1 Agents · Start', draw(0, { ...agentsOptions(agentsModel, API_FOLDER), startCategory: 'start' }, size, status), size), block('1 Agents · Options (navigation focused)', draw(0, { ...agentsOptions(agentsModel, API_FOLDER), startCategory: 'options' }, size, status, 0, true), size), block('1 Agents · On this PC', draw(0, { ...agentsOptions(agentsModel, API_FOLDER), startCategory: 'host' }, size, status), size), block('2 Sessions', draw(1, sessionsOptions({ sandboxRunning: true, sessions: SESSIONS, defaultAgent: 'claude' }), size, status), size), block('2 Sessions (no sandbox)', draw(1, sessionsOptions({ sandboxRunning: false, sessions: [], defaultAgent: 'claude' }), size), size));
         for (const category of ['status', 'databases'])
             out.push(block('3 Sandbox (stopped) · ' + category, draw(2, { ...sandboxOptions(stopped), startCategory: category }, size), size));
-        for (const category of ['status', 'projects', 'databases', 'unreal'])
+        for (const category of ['status', 'projects', 'databases', 'unreal', 'unity'])
             out.push(block('3 Sandbox · ' + category, draw(2, { ...sandboxOptions(sandbox), startCategory: category }, size, status), size));
         out.push(block('4 Apps (1 unsaved)', draw(3, appsOptions(user, appsData, appsDraft, 'user'), size, status, appsDraft.count()), size));
         for (const category of CATEGORIES)

package/dist/selftest/persisted-installs.test.js

@@ -309,7 +309,7 @@ export const persistedInstallsSuite = {
         const found = decideToolchains(everything, ['ProjectVersion.txt', 'project.godot', 'fxmanifest.lua'], ['unity']);
         t.check(NOT_READY.toolchains.every((n) => !found[n].on), '"auto" never turns on a toolchain that is not written yet, whatever the project holds');
         const shown = settingsOf(ConfigFile.user(t.at('settings', 'config.json'))).map((r) => r.key.join('.'));
-        t.check(!shown.some((k) => /^toolchains\.(unity|godot|android|flutter|dart|reactNative)\./.test(k)) &&
+        t.check(!shown.some((k) => /^toolchains\.(godot|android|flutter|dart|reactNative)\./.test(k)) &&
             shown.includes('toolchains.unreal.visualStudio') &&
             shown.some((k) => k.startsWith('toolchains.fivem.')), 'settings do not list the toolchains that are not written yet');
     },

package/dist/selftest/service-accounts.test.js

@@ -274,7 +274,7 @@ export const serviceAccountsSuite = {
                 process.env.LOCALAPPDATA = oldLocal;
         }
         t.section('the account command');
-        t.check(!COMMANDS.some((c) => ['epic', 'steam', 'unity'].includes(c.name)), 'no command of its own for a service');
+        t.check(!COMMANDS.some((c) => ['epic', 'steam'].includes(c.name)), 'no command of its own for a service');
         const account = buildProgram(() => undefined).commands.find((c) => c.name() === 'account');
         const help = account.helpInformation();
         t.check(['status', 'import', 'login', 'logout', '--from', '--yes'].every((w) => help.includes(w)), 'sandbox account --help lists status, import, login, logout, --from and --yes', help);

package/dist/selftest/store-app.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const storeAppSuite: Suite;

package/dist/selftest/store-app.test.js

@@ -0,0 +1,162 @@
+// The Perplexity desktop app, a Microsoft Store package: the catalogue entry, the sign-in kind (sandbox only, like
+// Comet), the package manifest, the PC's fetch and staging with a fake Store tool (no download, nothing run), the
+// sandbox's check of the kept files and the shortcut's command line. Temp folders only.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { DEFAULTS } from '../core/config/index.js';
+import { OFF_IS_SAFER } from '../core/local-config/index.js';
+import { HOST_SOURCES } from '../host/accounts/index.js';
+import { prepareStorePackages, stagedPackageDir, StorePackages } from '../host/apps/index.js';
+import { checkedPackage } from '../guest/apps/store-check.js';
+import { peekPendingPerplexityApp, perplexityAppPendingFile } from '../guest/accounts/kinds/perplexityapp.js';
+import { perplexityAppShortcutArgs, restoreAppSignIn } from '../guest/browser/perplexity-app.js';
+import { appsToInstall, appById, isStorePackageFile, PERPLEXITY_DESKTOP_FAMILY, PERPLEXITY_DESKTOP_PACKAGE, PERPLEXITY_DESKTOP_PRODUCT_ID, storeApps, StorePackageManifestSchema, storePackageRole, } from '../shared/apps/index.js';
+import { appUsersOn, PAYLOADS, SERVICE_SPECS, serviceWanted, usedByText, } from '../shared/accounts/index.js';
+const MAIN = 'PerplexityAI.PerplexityApp_1.2.3.0_x64__3jh4kjrg4dzr2.msix';
+const FRAMEWORK = 'Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe.appx';
+const sha = (text) => crypto.createHash('sha256').update(text).digest('hex');
+/** A fake Store tool: writes the given files into -OutDir and answers like get-store-package.ps1. */
+function fakeStore(files, ok = true) {
+    let calls = 0;
+    const run = (_exe, args) => {
+        calls++;
+        if (!ok)
+            return Promise.resolve({
+                status: 0,
+                stdout: JSON.stringify({ ok: false, message: 'no Store access', files: [] }),
+                stderr: '',
+            });
+        const out = args[args.indexOf('-OutDir') + 1];
+        fs.mkdirSync(out, { recursive: true });
+        for (const [name, text] of Object.entries(files))
+            if (path.basename(name) === name)
+                fs.writeFileSync(path.join(out, name), text);
+        return Promise.resolve({
+            status: 0,
+            stdout: 'progress\n' + JSON.stringify({ ok: true, message: 'ok', files: Object.keys(files) }),
+            stderr: '',
+        });
+    };
+    return { run, calls: () => calls };
+}
+export const storeAppSuite = {
+    name: 'store-app',
+    title: 'Perplexity desktop app: Store package fetched on the PC, installed in the sandbox, sign-in kept like Comet',
+    run: async (t) => {
+        t.section('the catalogue entry');
+        const entry = appById('perplexity-desktop');
+        t.check(entry !== undefined &&
+            'store' in entry.source &&
+            entry.source.store.productId === PERPLEXITY_DESKTOP_PRODUCT_ID &&
+            entry.source.store.family === PERPLEXITY_DESKTOP_FAMILY &&
+            PERPLEXITY_DESKTOP_FAMILY.startsWith(PERPLEXITY_DESKTOP_PACKAGE + '_') &&
+            entry.userOnly === true, 'a Store source with the product and the package family, yours only');
+        t.equal(storeApps(['rtk', 'perplexity-desktop']).map((a) => a.productId), ['9P9XG917PWCJ'], 'only Store apps are fetched');
+        t.check(appsToInstall({ ...DEFAULTS.apps, install: ['perplexity-desktop'] }, 'none').entries.length === 1, 'it needs no 7-Zip and no other app');
+        t.section('the sign-in kind');
+        const spec = SERVICE_SPECS.perplexityapp;
+        t.check(spec.sources.join() === 'sandbox' &&
+            spec.returns &&
+            !spec.singleHolder &&
+            DEFAULTS.accounts.perplexityapp.share === false &&
+            OFF_IS_SAFER.includes('accounts.perplexityapp.share') &&
+            spec.warnings.some((w) => w.includes("can't be copied from this PC")), 'only from a sandbox, handed back, not shared by default, a project file can only turn it off');
+        const source = HOST_SOURCES.perplexityapp;
+        t.check(!source.fromPc && !source.fromFile && !source.fromAnswers, 'nothing is read from this PC (the cookies are sealed to it)');
+        t.check(appUsersOn(['perplexity-desktop']).join() === 'perplexityapp' &&
+            serviceWanted('perplexityapp', new Set(['perplexityapp'])) &&
+            !serviceWanted('perplexityapp', new Set(['comet'])) &&
+            usedByText(['perplexityapp']) === 'the Perplexity desktop app', 'handed over only where the app is on');
+        const cookie = { name: 's', value: 'v', domain: '.perplexity.ai', path: '/', secure: true, httpOnly: true };
+        t.check(PAYLOADS.perplexityapp.safeParse({ cookies: [cookie] }).success &&
+            !PAYLOADS.perplexityapp.safeParse({ cookies: [{ ...cookie, domain: 'example.com' }] }).success, 'the payload is the perplexity.ai cookie allow-list');
+        const pendingRoot = t.dir('pending');
+        t.write(perplexityAppPendingFile(pendingRoot), JSON.stringify({ cookies: [cookie] }));
+        t.check(peekPendingPerplexityApp(pendingRoot)?.cookies.length === 1, 'a waiting sign-in is read and left in place');
+        t.write(perplexityAppPendingFile(pendingRoot), '{"cookies":[{"domain":"example.com"}]}');
+        t.check(peekPendingPerplexityApp(pendingRoot) === null, 'one that is not the allow-listed shape is not used');
+        t.check(!(await restoreAppSignIn({ cookies: [{ ...cookie, expires: 4_000_000_000 }] }, t.dir('no-app-profile'))), 'with the app not running, nothing is written');
+        t.section('the package manifest');
+        const file = (name, role) => ({ name, role, sha256: sha(name), bytes: 10 });
+        const manifest = (files) => ({
+            productId: '9P9XG917PWCJ',
+            fetchedAt: '2026-01-01T00:00:00Z',
+            files,
+        });
+        t.check(StorePackageManifestSchema.safeParse(manifest([file(MAIN, 'main'), file(FRAMEWORK, 'dependency')])).success &&
+            !StorePackageManifestSchema.safeParse(manifest([file(FRAMEWORK, 'dependency')])).success &&
+            !StorePackageManifestSchema.safeParse(manifest([file(MAIN, 'main'), file(MAIN.toUpperCase().replace('.MSIX', '.msix'), 'main')])).success &&
+            !StorePackageManifestSchema.safeParse(manifest([file('..\\evil.msix', 'main')])).success &&
+            !StorePackageManifestSchema.safeParse(manifest([file('x.exe', 'main')])).success, 'exactly one app file, and only .msix/.appx names (no paths, no programs)');
+        t.check(storePackageRole(MAIN, PERPLEXITY_DESKTOP_PACKAGE) === 'main' &&
+            storePackageRole(FRAMEWORK, PERPLEXITY_DESKTOP_PACKAGE) === 'dependency' &&
+            isStorePackageFile(MAIN) &&
+            !isStorePackageFile('a/b.msix'), 'the app is told from its frameworks by name');
+        t.section('this PC fetches and stages the package');
+        const storageRoot = t.dir('pc', 'storage');
+        const dataPath = t.dir('pc', 'storage', 'data', 'set');
+        const app = {
+            id: 'perplexity-desktop',
+            productId: PERPLEXITY_DESKTOP_PRODUCT_ID,
+            packageName: PERPLEXITY_DESKTOP_PACKAGE,
+        };
+        const store = fakeStore({
+            [MAIN]: 'app-bytes',
+            [FRAMEWORK]: 'framework-bytes',
+            '..evil.txt': 'x',
+            '../escape.msix': 'x',
+        });
+        let now = Date.parse('2026-06-01T00:00:00Z');
+        const packages = new StorePackages({ storageRoot, dataPath, run: store.run, now: () => now });
+        const first = await packages.ensure(app);
+        t.check(first.note === 'downloaded' &&
+            first.manifest.files.length === 2 &&
+            first.manifest.files.find((f) => f.role === 'main')?.sha256 === sha('app-bytes') &&
+            packages.cached(app.productId) !== null &&
+            !fs.existsSync(packages.cacheDir(app.productId) + '.new'), "the files are hashed here, not taken on the script's word; names that are not packages are ignored");
+        const second = await packages.ensure(app);
+        t.check(store.calls() === 1 && second.note.startsWith('kept'), 'a fresh cache is not fetched again');
+        const staged = packages.stage(app, first.manifest);
+        t.check(staged === stagedPackageDir(dataPath, app.id) &&
+            fs.readFileSync(path.join(staged, MAIN), 'utf8') === 'app-bytes' &&
+            fs.existsSync(path.join(staged, 'store-package.json')), 'the package is copied into the data folder with its manifest');
+        fs.writeFileSync(path.join(staged, 'stale.msix'), 'old');
+        packages.stage(app, first.manifest);
+        t.check(!fs.existsSync(path.join(staged, 'stale.msix')), 'a file the manifest does not list is removed');
+        t.section('an old cache and a failing Store');
+        now += 40 * 24 * 3600 * 1000;
+        const failing = new StorePackages({ storageRoot, dataPath, run: fakeStore({}, false).run, now: () => now });
+        const kept = await failing.ensure(app);
+        t.check(kept.note.includes('could not be fetched') && kept.note.includes('no Store access'), 'the old package stands, and says why');
+        const emptyRoot = t.dir('pc2', 'storage');
+        const emptyData = t.dir('pc2', 'storage', 'data', 'set');
+        const outcome = await prepareStorePackages([app], {
+            storageRoot: emptyRoot,
+            dataPath: emptyData,
+            run: fakeStore({}, false).run,
+        });
+        t.check(outcome.notes.length === 1 &&
+            outcome.notes[0].includes('is not prepared') &&
+            outcome.notes[0].includes('winget download --id 9P9XG917PWCJ'), 'with nothing kept the launch goes on, with a note that says what to fix');
+        const good = await prepareStorePackages([app], {
+            storageRoot: emptyRoot,
+            dataPath: emptyData,
+            run: fakeStore({ [MAIN]: 'a' }).run,
+        });
+        t.check(good.notes[0].includes('downloaded') && fs.existsSync(path.join(stagedPackageDir(emptyData, app.id), MAIN)), 'and a working Store stages it');
+        t.section('the sandbox checks the kept files');
+        const checked = await checkedPackage(staged);
+        t.check(path.basename(checked.main) === MAIN && checked.dependencies.map((d) => path.basename(d)).join() === FRAMEWORK, 'the app and its frameworks, in order');
+        fs.writeFileSync(path.join(staged, FRAMEWORK), 'tampered');
+        t.check((await t.thrownMessage(() => checkedPackage(staged))).includes('missing or changed'), 'a changed file stops the install');
+        t.check((await t.thrownMessage(() => checkedPackage(t.dir('nothing')))).includes('not handed over'), 'no package says so');
+        t.section('the shortcut');
+        const args = perplexityAppShortcutArgs('C:\\AgentLaunch\\sandbox\\scripts\\start-store-app.ps1', 'C:\\Users\\X\\profile');
+        t.check(args.includes('-File "C:\\AgentLaunch\\sandbox\\scripts\\start-store-app.ps1"') &&
+            args.includes('-PackageName PerplexityAI.PerplexityApp') &&
+            args.includes('-UserDataDir "C:\\Users\\X\\profile"') &&
+            args.includes('-Port 0') &&
+            args.includes('-WindowStyle Hidden'), 'a hidden PowerShell start with the package, its own profile and a free DevTools port');
+    },
+};

package/dist/selftest/support/engine-golden.js

@@ -44,10 +44,14 @@ export const LAUNCH_FILES_GOLDEN = [
     'sandbox/addons/context7/package.json',
     'sandbox/addons/headroom/requirements.in',
     'sandbox/addons/headroom/requirements.txt',
+    'sandbox/addons/openupm-cli/package-lock.json',
+    'sandbox/addons/openupm-cli/package.json',
     'sandbox/addons/perplexity-mcp/package-lock.json',
     'sandbox/addons/perplexity-mcp/package.json',
     'sandbox/addons/playwright-mcp/package-lock.json',
     'sandbox/addons/playwright-mcp/package.json',
+    'sandbox/addons/unity-mcp/requirements.in',
+    'sandbox/addons/unity-mcp/requirements.txt',
     'sandbox/boot/bootstrap.ps1',
     'sandbox/boot/bootstrap/drives.ps1',
     'sandbox/boot/bootstrap/files.ps1',
@@ -55,6 +59,7 @@ export const LAUNCH_FILES_GOLDEN = [
     'sandbox/boot/bootstrap/status.ps1',
     'sandbox/boot/logon.cmd',
     'sandbox/boot/trust.cmd',
+    'sandbox/csharp/AppActivation.cs',
     'sandbox/csharp/BindMount.cs',
     'sandbox/csharp/CargoShim.cs',
     'sandbox/csharp/Desktop.cs',
@@ -79,6 +84,7 @@ export const LAUNCH_FILES_GOLDEN = [
     'sandbox/scripts/get-signature.ps1',
     'sandbox/scripts/get-vs-setup.ps1',
     'sandbox/scripts/install-shell-path.ps1',
+    'sandbox/scripts/install-store-package.ps1',
     'sandbox/scripts/link-profile-dirs.ps1',
     'sandbox/scripts/new-shortcuts.ps1',
     'sandbox/scripts/repair-wmi-services.ps1',
@@ -88,6 +94,7 @@ export const LAUNCH_FILES_GOLDEN = [
     'sandbox/scripts/set-dns-servers.ps1',
     'sandbox/scripts/set-machine-environment.ps1',
     'sandbox/scripts/set-registry-values.ps1',
+    'sandbox/scripts/start-store-app.ps1',
     'sandbox/templates/fivem/README.txt',
     'sandbox/templates/fivem/cs/Client/Client.csproj',
     'sandbox/templates/fivem/cs/Client/ClientMain.cs',