windows-development-sandbox 1.25.1 → 1.27.0

package/dist/host/apps/store-package.js

@@ -0,0 +1,209 @@
+// Microsoft Store apps for the sandbox (the Perplexity desktop app): this PC fetches the package files with its own
+// Store tooling (native\scripts\get-store-package.ps1: winget download --source msstore, with your own Windows access;
+// no account token is ever held here), keeps them in <storage>\store-packages\<product id>, and copies them into the
+// data folder (tools\apps\<id>.package) where the sandbox installs them with Add-AppxPackage. The package keeps the
+// publisher's signature: nothing is repacked. The files are hashed here, never trusted from the script's word.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { z } from 'zod';
+import { assertNoLinks, errMsg } from '../../core/util/index.js';
+import { readValid } from '../../shared/io/index.js';
+import { isStorePackageFile, STORE_PACKAGE_MANIFEST, StorePackageManifestSchema, storePackageRole, } from '../../shared/apps/index.js';
+import { SYSTEM } from '../../shared/system.js';
+import { nativeScript } from '../native.js';
+import { hostDataFolder } from '../storage/contained/index.js';
+import { refuseInSelfTest } from '../test-guard.js';
+/** How long a fetched package is used before a launch looks for a newer one (a failed look keeps the old one). */
+export const STORE_PACKAGE_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000;
+/** The download is about 300 MB and Store servers can be slow. */
+const FETCH_TIMEOUT_MS = 20 * 60 * 1000;
+const READ_CHUNK = 1024 * 1024;
+const ScriptResultSchema = z.object({
+    ok: z.boolean(),
+    message: z.string().max(2000),
+    files: z.array(z.string().max(300)).max(64),
+});
+export const spawnStoreRunner = (exe, args, timeoutMs) => new Promise((resolve) => {
+    const child = spawn(exe, [...args], { windowsHide: true });
+    let stdout = '';
+    let stderr = '';
+    const timer = setTimeout(() => child.kill(), timeoutMs);
+    child.stdout.on('data', (d) => (stdout = (stdout + d.toString('utf8')).slice(-64 * 1024)));
+    child.stderr.on('data', (d) => (stderr = (stderr + d.toString('utf8')).slice(-64 * 1024)));
+    child.on('error', (e) => resolve({ status: null, stdout, stderr: stderr + e.message }));
+    child.on('close', (status) => {
+        clearTimeout(timer);
+        resolve({ status, stdout, stderr });
+    });
+});
+function sha256Of(file) {
+    const hash = crypto.createHash('sha256');
+    const fd = fs.openSync(file, 'r');
+    try {
+        const chunk = Buffer.alloc(READ_CHUNK);
+        for (let n = fs.readSync(fd, chunk, 0, chunk.length, null); n > 0; n = fs.readSync(fd, chunk, 0, chunk.length, null))
+            hash.update(chunk.subarray(0, n));
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    return hash.digest('hex');
+}
+/** Where the data folder keeps an app's package for the sandbox. */
+export function stagedPackageDir(dataPath, appId) {
+    return path.join(hostDataFolder(dataPath, 'tools'), 'apps', appId + '.package');
+}
+export class StorePackages {
+    o;
+    constructor(o) {
+        this.o = o;
+    }
+    cacheDir(productId) {
+        return path.join(this.o.storageRoot, 'store-packages', productId);
+    }
+    /** The cached package when its files are all there at the size hashed; null otherwise. */
+    cached(productId) {
+        const dir = this.cacheDir(productId);
+        const manifest = readValid(StorePackageManifestSchema, path.join(dir, STORE_PACKAGE_MANIFEST));
+        if (!manifest || manifest.productId !== productId)
+            return null;
+        const complete = manifest.files.every((f) => {
+            try {
+                return fs.statSync(path.join(dir, f.name)).size === f.bytes;
+            }
+            catch {
+                return false; // A file is gone: fetch again.
+            }
+        });
+        return complete ? manifest : null;
+    }
+    fresh(m) {
+        const at = Date.parse(m.fetchedAt);
+        return Number.isFinite(at) && (this.o.now?.() ?? Date.now()) - at < STORE_PACKAGE_MAX_AGE_MS;
+    }
+    /** Fetches the package into the cache with this PC's Store tooling and returns what was kept. */
+    async fetch(app) {
+        const run = this.o.run ?? spawnStoreRunner;
+        if (!this.o.run)
+            refuseInSelfTest('download from the Microsoft Store');
+        const work = this.cacheDir(app.productId) + '.new';
+        fs.rmSync(work, { recursive: true, force: true });
+        const out = await run(SYSTEM.powershell(), nativeScript('get-store-package.ps1', [
+            '-ProductId',
+            app.productId,
+            '-PackageName',
+            app.packageName,
+            '-OutDir',
+            work,
+        ]), FETCH_TIMEOUT_MS);
+        try {
+            return this.keep(app, work, out);
+        }
+        finally {
+            fs.rmSync(work, { recursive: true, force: true });
+        }
+    }
+    /** Checks what the script fetched into `work`, hashes it and moves it into the cache. */
+    keep(app, work, out) {
+        const line = out.stdout.trim().split(/\r?\n/).pop() ?? '';
+        let parsed;
+        try {
+            parsed = ScriptResultSchema.parse(JSON.parse(line));
+        }
+        catch {
+            throw new Error('the Store tooling gave no answer' + (out.stderr ? ': ' + out.stderr.trim().slice(0, 200) : ''));
+        }
+        if (!parsed.ok)
+            throw new Error(parsed.message);
+        const files = parsed.files
+            .filter((n) => isStorePackageFile(n) && n === path.basename(n) && fs.existsSync(path.join(work, n)))
+            .map((name) => {
+            const full = path.join(work, name);
+            return {
+                name,
+                role: storePackageRole(name, app.packageName),
+                sha256: sha256Of(full),
+                bytes: fs.statSync(full).size,
+            };
+        });
+        const manifest = StorePackageManifestSchema.parse({
+            productId: app.productId,
+            fetchedAt: new Date(this.o.now?.() ?? Date.now()).toISOString(),
+            files,
+        });
+        fs.writeFileSync(path.join(work, STORE_PACKAGE_MANIFEST), JSON.stringify(manifest, null, 2), 'utf8');
+        const dest = this.cacheDir(app.productId);
+        fs.rmSync(dest, { recursive: true, force: true });
+        fs.renameSync(work, dest);
+        return manifest;
+    }
+    /** The package to use: the cache when fresh, else a new fetch (the old one stands when that fails). */
+    async ensure(app) {
+        const have = this.cached(app.productId);
+        if (have && this.fresh(have))
+            return { manifest: have, note: 'kept from ' + have.fetchedAt.slice(0, 10) };
+        try {
+            return { manifest: await this.fetch(app), note: 'downloaded' };
+        }
+        catch (e) {
+            if (have)
+                return { manifest: have, note: 'kept (a newer one could not be fetched: ' + errMsg(e) + ')' };
+            throw e;
+        }
+    }
+    /** Copies the cached package into the data folder for the sandbox (files already there at the same size stay). */
+    stage(app, manifest) {
+        const tools = hostDataFolder(this.o.dataPath, 'tools');
+        const dest = stagedPackageDir(this.o.dataPath, app.id);
+        fs.mkdirSync(path.join(tools, 'apps'), { recursive: true });
+        assertNoLinks(tools, dest);
+        fs.mkdirSync(dest, { recursive: true });
+        const wanted = new Set(manifest.files.map((f) => f.name.toLowerCase()));
+        for (const name of fs.readdirSync(dest)) {
+            if (name !== STORE_PACKAGE_MANIFEST && !wanted.has(name.toLowerCase()))
+                fs.rmSync(path.join(dest, name), { recursive: true, force: true });
+        }
+        const source = this.cacheDir(manifest.productId);
+        for (const f of manifest.files) {
+            const target = path.join(dest, f.name);
+            assertNoLinks(tools, target);
+            let same = false;
+            try {
+                same = fs.statSync(target).size === f.bytes;
+            }
+            catch {
+                same = false; // Not there yet.
+            }
+            if (!same)
+                fs.copyFileSync(path.join(source, f.name), target);
+        }
+        fs.writeFileSync(path.join(dest, STORE_PACKAGE_MANIFEST), JSON.stringify(manifest, null, 2), 'utf8');
+        return dest;
+    }
+}
+/**
+ * For a launch: every Store app chosen gets its package fetched (or kept) and staged. A failure never stops the launch:
+ * it is a note, and the sandbox skips that app.
+ */
+export async function prepareStorePackages(apps, o) {
+    const notes = [];
+    const packages = new StorePackages(o);
+    for (const app of apps) {
+        try {
+            const { manifest, note } = await packages.ensure(app);
+            packages.stage(app, manifest);
+            notes.push(app.id + ': package ' + note + ' (' + manifest.files.length + ' files)');
+        }
+        catch (e) {
+            notes.push(app.id +
+                ' is not prepared: ' +
+                errMsg(e) +
+                ' Fix: sign in to the Microsoft Store on this PC and check that winget works (winget download --id ' +
+                app.productId +
+                ' --source msstore), then launch again.');
+        }
+    }
+    return { notes };
+}

package/dist/host/github/deliver.d.ts

@@ -1,7 +1,8 @@
 import type { BootWant } from '../../core/local-config/index.js';
 import type { Config } from '../../core/types.js';
 import { GithubToken } from './token.js';
-/** github.shareToken is on and git access is "full" for every project this sandbox boots with. */
+import { type PcLoginOptions } from './pc-login.js';
+/** github.shareToken or github.usePcLogin is on and git access is "full" for every project this sandbox boots with. */
 export declare function githubTokenAllowed(config: Config, others?: readonly BootWant[]): boolean;
 export interface GithubDelivery {
     /** The token for the one-shot secrets file, when it is handed over. */
@@ -9,5 +10,9 @@ export interface GithubDelivery {
     /** What to tell you about it (never the token). */
     readonly notes: readonly string[];
 }
-/** What this launch hands over. Never throws: a token that cannot be read is a note, and the launch goes on. */
-export declare function prepareGithubToken(config: Config, storageRoot: string, store?: GithubToken, others?: readonly BootWant[], now?: number): GithubDelivery;
+/**
+ * What this launch hands over. Never throws: a token that cannot be read is a note, and the launch goes on. A token
+ * saved for sandboxes (github.shareToken) comes first; then this PC's own gh login (github.usePcLogin), which says
+ * nothing when the PC has none.
+ */
+export declare function prepareGithubToken(config: Config, storageRoot: string, store?: GithubToken, others?: readonly BootWant[], now?: number, pc?: PcLoginOptions): GithubDelivery;

package/dist/host/github/deliver.js

@@ -1,4 +1,5 @@
 import { GithubToken } from './token.js';
+import { readPcGhLogin } from './pc-login.js';
 /** The first project (the launch's own, then the others at boot) whose git access is not "full", or null. */
 function stricterProject(config, others) {
     if (config.provisioning.git.access !== 'full')
@@ -6,9 +7,9 @@ function stricterProject(config, others) {
     const other = others.find((o) => o.config.provisioning.git.access !== 'full');
     return other ? { name: other.name, access: other.config.provisioning.git.access } : null;
 }
-/** github.shareToken is on and git access is "full" for every project this sandbox boots with. */
+/** github.shareToken or github.usePcLogin is on and git access is "full" for every project this sandbox boots with. */
 export function githubTokenAllowed(config, others = []) {
-    return config.github.shareToken && stricterProject(config, others) === null;
+    return (config.github.shareToken || config.github.usePcLogin) && stricterProject(config, others) === null;
 }
 /** A token that ends within this many days is mentioned at launch. */
 const EXPIRY_NOTE_DAYS = 7;
@@ -28,43 +29,55 @@ function expiryNotes(tokens, now = Date.now()) {
             '. Make a new one in Accounts.',
     ];
 }
-/** What this launch hands over. Never throws: a token that cannot be read is a note, and the launch goes on. */
-export function prepareGithubToken(config, storageRoot, store, others = [], now = Date.now()) {
-    if (!config.github.shareToken)
+const PC_LOGIN_NOTE = 'Your gh login on this PC is handed to this sandbox (github.usePcLogin): the agent can read it and use it for everything your account can.';
+/**
+ * What this launch hands over. Never throws: a token that cannot be read is a note, and the launch goes on. A token
+ * saved for sandboxes (github.shareToken) comes first; then this PC's own gh login (github.usePcLogin), which says
+ * nothing when the PC has none.
+ */
+export function prepareGithubToken(config, storageRoot, store, others = [], now = Date.now(), pc = {}) {
+    const { shareToken, usePcLogin } = config.github;
+    if (!shareToken && !usePcLogin)
         return { notes: [] };
     const stricter = stricterProject(config, others);
     if (stricter)
         return {
             notes: [
-                'github.shareToken is on, but git access is "' +
+                'github.' +
+                    (shareToken ? 'shareToken' : 'usePcLogin') +
+                    ' is on, but git access is "' +
                     stricter.access +
                     '"' +
                     (stricter.name ? ' for ' + stricter.name + ' (also in this sandbox)' : ' in this sandbox') +
-                    ', so your GitHub token was not handed over (it needs provisioning.git.access "full").',
+                    ', so your GitHub login was not handed over (it needs provisioning.git.access "full").',
             ],
         };
-    const tokens = store ?? new GithubToken(storageRoot);
-    let token;
-    try {
-        token = tokens.read();
+    const notes = [];
+    if (shareToken) {
+        const tokens = store ?? new GithubToken(storageRoot);
+        let token = null;
+        try {
+            token = tokens.read();
+        }
+        catch {
+            // The reason may come from DPAPI or a damaged file; a fixed text is enough (and can never hold the token).
+            notes.push('Your saved GitHub token could not be read (only the Windows user that saved it can), so it was not handed over. Save it again: sandbox github login');
+        }
+        if (token)
+            return {
+                token,
+                notes: [
+                    'Your GitHub token is handed to this sandbox (github.shareToken): the agent can read it and use it for whatever it allows.',
+                    ...expiryNotes(tokens, now),
+                ],
+            };
+        if (!usePcLogin && !notes.length)
+            notes.push('github.shareToken is on, but no GitHub token is saved. Save one: sandbox github login');
     }
-    catch {
-        // The reason may come from DPAPI or a damaged file; a fixed text is enough (and can never hold the token).
-        return {
-            notes: [
-                'Your saved GitHub token could not be read (only the Windows user that saved it can), so it was not handed over. Save it again: sandbox github login',
-            ],
-        };
+    if (usePcLogin) {
+        const login = readPcGhLogin(pc);
+        if (login)
+            return { token: login, notes: [...notes, PC_LOGIN_NOTE] };
     }
-    if (!token)
-        return {
-            notes: ['github.shareToken is on, but no GitHub token is saved. Save one: sandbox github login'],
-        };
-    return {
-        token,
-        notes: [
-            'Your GitHub token is handed to this sandbox (github.shareToken): the agent can read it and use it for whatever it allows.',
-            ...expiryNotes(tokens, now),
-        ],
-    };
+    return { notes };
 }

package/dist/host/github/index.d.ts

@@ -1,3 +1,4 @@
 export { GithubToken, checkGithubToken, type SavedCheck, type TokenState } from './token.js';
 export { githubTokenAllowed, prepareGithubToken, type GithubDelivery } from './deliver.js';
 export { expiryFromHeader, verifyGithubToken, type GithubCheck, type GithubVerdict } from './verify.js';
+export { parseHostsYml, readPcGhLogin, type PcLoginOptions, type RunGh } from './pc-login.js';

package/dist/host/github/index.js

@@ -2,3 +2,4 @@
 export { GithubToken, checkGithubToken } from './token.js';
 export { githubTokenAllowed, prepareGithubToken } from './deliver.js';
 export { expiryFromHeader, verifyGithubToken } from './verify.js';
+export { parseHostsYml, readPcGhLogin } from './pc-login.js';

package/dist/host/github/pc-login.d.ts

@@ -0,0 +1,27 @@
+/** What hosts.yml says about github.com: the token it holds (null when gh keeps it elsewhere) and the active user. */
+export interface HostsLogin {
+    readonly signedIn: boolean;
+    readonly token: string | null;
+}
+/**
+ * The github.com login in gh's hosts.yml. A small line reader for the two shapes gh writes (the token under
+ * `users.<name>.oauth_token`, or `oauth_token` directly under the host): bounded, with no YAML library and no
+ * regex that can run away. The active user's token is preferred.
+ */
+export declare function parseHostsYml(text: string): HostsLogin;
+/** Where gh keeps its settings on this PC (GH_CONFIG_DIR, XDG_CONFIG_HOME, or %APPDATA%\GitHub CLI). */
+export declare function ghConfigFolder(env: Readonly<Record<string, string | undefined>>): string | null;
+/** Where the GitHub CLI installer puts gh.exe (absolute paths only: the program is never found by name). */
+export declare function ghExeCandidates(env: Readonly<Record<string, string | undefined>>): string[];
+/** Runs gh.exe `auth token` and returns what it printed (null on any failure). Replaceable in tests. */
+export type RunGh = (exe: string, configDir: string | null, env: Readonly<Record<string, string | undefined>>) => string | null;
+export declare const runGhAuthToken: RunGh;
+export interface PcLoginOptions {
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly run?: RunGh;
+}
+/**
+ * The token of this PC's gh login for github.com, or null when there is none (or it cannot be read): no login is
+ * normal and silent. The result passes the same limits as a token in the secrets file.
+ */
+export declare function readPcGhLogin(options?: PcLoginOptions): string | null;

package/dist/host/github/pc-login.js

@@ -0,0 +1,129 @@
+// The GitHub CLI login on this PC (github.usePcLogin): the github.com token, read only for a launch's one-shot file.
+// It comes from gh's hosts.yml (a login made with --insecure-storage) or, when gh keeps it in Windows Credential
+// Manager, from this PC's own gh.exe (`gh auth token`, by absolute path). Nothing here prints or logs the token.
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { GithubTokenSchema } from '../../shared/github/index.js';
+const HOST = 'github.com';
+const MAX_HOSTS_BYTES = 256 * 1024;
+const MAX_HOSTS_LINES = 2000;
+const GH_TIMEOUT_MS = 10_000;
+const indentOf = (line) => line.length - line.trimStart().length;
+const valueOf = (line, key) => {
+    const t = line.trim();
+    if (!t.startsWith(key + ':'))
+        return null;
+    return (t
+        .slice(key.length + 1)
+        .replace(/\s+#.*$/, '')
+        .trim()
+        .replace(/^(['"])(.*)\1$/, '$2') || null);
+};
+/**
+ * The github.com login in gh's hosts.yml. A small line reader for the two shapes gh writes (the token under
+ * `users.<name>.oauth_token`, or `oauth_token` directly under the host): bounded, with no YAML library and no
+ * regex that can run away. The active user's token is preferred.
+ */
+export function parseHostsYml(text) {
+    const lines = text.split(/\r?\n/, MAX_HOSTS_LINES);
+    let inHost = false;
+    let user = null;
+    let direct = null;
+    let inUsers = false;
+    let current = null;
+    const byUser = new Map();
+    let signedIn = false;
+    for (const line of lines) {
+        if (!line.trim() || line.trim().startsWith('#'))
+            continue;
+        const indent = indentOf(line);
+        if (indent === 0) {
+            inHost = line.trim() === HOST + ':';
+            signedIn = signedIn || inHost;
+            inUsers = false;
+            current = null;
+            continue;
+        }
+        if (!inHost)
+            continue;
+        const t = line.trim();
+        if (indent <= 4) {
+            inUsers = t === 'users:';
+            current = null;
+            user = valueOf(line, 'user') ?? user;
+            direct = valueOf(line, 'oauth_token') ?? direct;
+        }
+        else if (inUsers && t.endsWith(':') && !t.includes(' ')) {
+            current = t.slice(0, -1);
+        }
+        else if (inUsers && current) {
+            const token = valueOf(line, 'oauth_token');
+            if (token)
+                byUser.set(current, token);
+        }
+    }
+    // With an active user, another user's token is never a stand-in (theirs may be in Credential Manager).
+    const token = user ? (byUser.get(user) ?? direct) : (direct ?? [...byUser.values()][0] ?? null);
+    return { signedIn, token };
+}
+/** Where gh keeps its settings on this PC (GH_CONFIG_DIR, XDG_CONFIG_HOME, or %APPDATA%\GitHub CLI). */
+export function ghConfigFolder(env) {
+    if (env.GH_CONFIG_DIR)
+        return env.GH_CONFIG_DIR;
+    if (env.XDG_CONFIG_HOME)
+        return path.join(env.XDG_CONFIG_HOME, 'gh');
+    return env.APPDATA ? path.join(env.APPDATA, 'GitHub CLI') : null;
+}
+/** Where the GitHub CLI installer puts gh.exe (absolute paths only: the program is never found by name). */
+export function ghExeCandidates(env) {
+    const roots = [
+        env.ProgramFiles && path.join(env.ProgramFiles, 'GitHub CLI'),
+        env['ProgramFiles(x86)'] && path.join(env['ProgramFiles(x86)'], 'GitHub CLI'),
+        env.LOCALAPPDATA && path.join(env.LOCALAPPDATA, 'Programs', 'GitHub CLI'),
+    ];
+    return roots.filter((r) => !!r).map((r) => path.join(r, 'gh.exe'));
+}
+const TOKEN_VARIABLES = /^(GH_TOKEN|GITHUB_TOKEN|GH_ENTERPRISE_TOKEN|GITHUB_ENTERPRISE_TOKEN)$/i;
+export const runGhAuthToken = (exe, configDir, base) => {
+    const env = Object.fromEntries(Object.entries(base).filter((e) => e[1] !== undefined && !TOKEN_VARIABLES.test(e[0])));
+    if (configDir)
+        env.GH_CONFIG_DIR = configDir;
+    env.GH_PROMPT_DISABLED = '1';
+    const result = spawnSync(exe, ['auth', 'token', '--hostname', HOST], {
+        env,
+        encoding: 'utf8',
+        windowsHide: true,
+        timeout: GH_TIMEOUT_MS,
+        maxBuffer: 16 * 1024,
+        stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    return result.status === 0 ? String(result.stdout ?? '').trim() : null;
+};
+/**
+ * The token of this PC's gh login for github.com, or null when there is none (or it cannot be read): no login is
+ * normal and silent. The result passes the same limits as a token in the secrets file.
+ */
+export function readPcGhLogin(options = {}) {
+    const env = options.env ?? process.env;
+    const dir = ghConfigFolder(env);
+    let login = { signedIn: false, token: null };
+    if (dir) {
+        try {
+            const file = path.join(dir, 'hosts.yml');
+            if (fs.statSync(file).size <= MAX_HOSTS_BYTES)
+                login = parseHostsYml(fs.readFileSync(file, 'utf8'));
+        }
+        catch {
+            // No hosts.yml: gh is not signed in on this PC.
+        }
+    }
+    let token = login.token;
+    if (!token && login.signedIn) {
+        const run = options.run ?? runGhAuthToken;
+        const exe = ghExeCandidates(env).find((c) => fs.existsSync(c));
+        token = exe ? (run(exe, dir, env)?.trim() ?? null) : null;
+    }
+    const checked = GithubTokenSchema.safeParse(token ?? '');
+    return checked.success ? checked.data : null;
+}

package/dist/host/pc-installs/discover.d.ts

@@ -12,10 +12,14 @@ export interface DiscoverOptions {
     readonly sources?: readonly PcInstallSource[];
     /** This launch sets the sandbox up for Unreal ("auto" maps this PC's engines and vault cache then). */
     readonly unrealOn?: boolean;
+    /** This launch sets the sandbox up for Unity ("auto" maps this PC's editors and Asset Store downloads then). */
+    readonly unityOn?: boolean;
 }
 export interface DiscoveredInstalls {
     readonly mappings: ResolvedMapping[];
     readonly manifest: PcInstallManifest;
     readonly notes: string[];
 }
+/** The toolchain an "auto" setting follows. */
+export declare const AUTO_FOLLOWS: Readonly<Partial<Record<PcInstallSource['setting'], 'unreal' | 'unity'>>>;
 export declare function discoverPcInstalls(s: PcInstalls, o: DiscoverOptions, pc?: PcEnv): DiscoveredInstalls;

package/dist/host/pc-installs/discover.js

@@ -5,6 +5,7 @@ import { pcEnv } from '../accounts/index.js';
 import { epicInstalls } from './epic.js';
 import { steamInstalls } from './steam.js';
 import { unityInstalls } from './unity.js';
+import { unityAssets } from './unity-assets.js';
 import { unrealFolders, unrealInstalls } from './unreal.js';
 import { unrealVault } from './unreal-vault.js';
 /** At most this many installs are mapped (each one is a mapping in the .wsb). */
@@ -16,18 +17,29 @@ export const PC_INSTALL_SOURCES = [
     unrealInstalls,
     unrealVault,
     unityInstalls,
+    unityAssets,
 ];
-/** What a setting asks for: false (nothing), true (everything) or a list; "auto" follows the Unreal toolchain. */
-function wantedOf(s, setting, unrealOn) {
+/** The toolchain an "auto" setting follows. */
+export const AUTO_FOLLOWS = {
+    unrealEngines: 'unreal',
+    unrealAssets: 'unreal',
+    unityEditors: 'unity',
+    unityAssets: 'unity',
+};
+/** What a setting asks for: false (nothing), true (everything) or a list; "auto" follows its toolchain. */
+function wantedOf(s, setting, on) {
     const value = s[setting];
-    return value === 'auto' ? unrealOn : value;
+    if (value !== 'auto')
+        return value;
+    const follows = AUTO_FOLLOWS[setting];
+    return follows ? on[follows] : false;
 }
 export function discoverPcInstalls(s, o, pc = pcEnv()) {
     const mappings = [];
     const items = [];
     const notes = [];
     for (const source of o.sources ?? PC_INSTALL_SOURCES) {
-        const wanted = wantedOf(s, source.setting, o.unrealOn === true);
+        const wanted = wantedOf(s, source.setting, { unreal: o.unrealOn === true, unity: o.unityOn === true });
         if (wanted === false || (Array.isArray(wanted) && !wanted.length))
             continue;
         let found = [];

package/dist/host/pc-installs/source.d.ts

@@ -3,7 +3,7 @@ import type { PcEnv } from '../accounts/index.js';
 export interface PcInstallSource {
     readonly kind: PcInstall['kind'];
     /** The settings key that turns it on (pcInstalls.<setting>). */
-    readonly setting: 'steamGames' | 'epicGames' | 'unrealEngines' | 'unrealEngineFolders' | 'unrealAssets' | 'unityEditors';
+    readonly setting: 'steamGames' | 'epicGames' | 'unrealEngines' | 'unrealEngineFolders' | 'unrealAssets' | 'unityEditors' | 'unityAssets';
     /** What is installed: everything (true) or the ones listed. Bounded reads only (registry, manifests). */
     find(wanted: true | readonly (string | number)[], pc: PcEnv): PcInstall[];
 }

package/dist/host/pc-installs/unity-assets.d.ts

@@ -0,0 +1,5 @@
+import type { PcInstall } from '../../shared/paths/index.js';
+import type { PcInstallSource } from './source.js';
+/** The Asset Store folders as installs to map. */
+export declare function unityAssetInstalls(dirs: readonly string[]): PcInstall[];
+export declare const unityAssets: PcInstallSource;

package/dist/host/pc-installs/unity-assets.js

@@ -0,0 +1,18 @@
+import { assetCacheEnv, unityAssetCacheDirs, unityPcFiles } from './unity.js';
+/** The Asset Store folders as installs to map. */
+export function unityAssetInstalls(dirs) {
+    return dirs.map((dir, i) => ({
+        kind: 'unity-assets',
+        id: i ? 'AssetStore' + (i + 1) : 'AssetStore',
+        name: 'Unity Asset Store downloads' + (i ? ' ' + (i + 1) : ''),
+        host: dir,
+        guest: '',
+    }));
+}
+export const unityAssets = {
+    kind: 'unity-assets',
+    setting: 'unityAssets',
+    find(_wanted, pc) {
+        return unityAssetInstalls(unityAssetCacheDirs(unityPcFiles(pc), assetCacheEnv(pc)));
+    },
+};

package/dist/host/pc-installs/unity.d.ts

@@ -1,2 +1,22 @@
+import type { PcInstall } from '../../shared/paths/index.js';
+import type { PcEnv } from '../accounts/index.js';
 import type { PcInstallSource } from './source.js';
+/** At most this many editors of this PC are mapped. */
+export declare const MAX_PC_EDITORS = 12;
+/** The files and folders of this PC the search reads (the self-test passes its own). */
+export interface UnityPcFiles {
+    read(file: string, max: number): Buffer | null;
+    isDir(dir: string): boolean;
+    list(dir: string): string[];
+    readonly appData: string;
+    readonly programFiles: string;
+}
+/** The editors of this PC: all of them (true) or the listed versions. Each version once, each folder once. */
+export declare function findUnityEditorsOnPc(files: UnityPcFiles, wanted: true | readonly string[]): PcInstall[];
+/** The Asset Store-5.x folders of this PC (the environment's cache root first, then %APPDATA%\Unity), to map. */
+export declare function unityAssetCacheDirs(files: UnityPcFiles, envValue: string | undefined): string[];
+/** This PC's disk for the search. */
+export declare function unityPcFiles(pc: PcEnv): UnityPcFiles;
+/** The cache root the environment names: this terminal's variable, else the saved user one. */
+export declare function assetCacheEnv(pc: PcEnv): string | undefined;
 export declare const unityInstalls: PcInstallSource;