windows-development-sandbox 1.25.1 → 1.27.1

package/dist/selftest/store-app.test.js

@@ -0,0 +1,162 @@
+// The Perplexity desktop app, a Microsoft Store package: the catalogue entry, the sign-in kind (sandbox only, like
+// Comet), the package manifest, the PC's fetch and staging with a fake Store tool (no download, nothing run), the
+// sandbox's check of the kept files and the shortcut's command line. Temp folders only.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { DEFAULTS } from '../core/config/index.js';
+import { OFF_IS_SAFER } from '../core/local-config/index.js';
+import { HOST_SOURCES } from '../host/accounts/index.js';
+import { prepareStorePackages, stagedPackageDir, StorePackages } from '../host/apps/index.js';
+import { checkedPackage } from '../guest/apps/store-check.js';
+import { peekPendingPerplexityApp, perplexityAppPendingFile } from '../guest/accounts/kinds/perplexityapp.js';
+import { perplexityAppShortcutArgs, restoreAppSignIn } from '../guest/browser/perplexity-app.js';
+import { appsToInstall, appById, isStorePackageFile, PERPLEXITY_DESKTOP_FAMILY, PERPLEXITY_DESKTOP_PACKAGE, PERPLEXITY_DESKTOP_PRODUCT_ID, storeApps, StorePackageManifestSchema, storePackageRole, } from '../shared/apps/index.js';
+import { appUsersOn, PAYLOADS, SERVICE_SPECS, serviceWanted, usedByText, } from '../shared/accounts/index.js';
+const MAIN = 'PerplexityAI.PerplexityApp_1.2.3.0_x64__3jh4kjrg4dzr2.msix';
+const FRAMEWORK = 'Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe.appx';
+const sha = (text) => crypto.createHash('sha256').update(text).digest('hex');
+/** A fake Store tool: writes the given files into -OutDir and answers like get-store-package.ps1. */
+function fakeStore(files, ok = true) {
+    let calls = 0;
+    const run = (_exe, args) => {
+        calls++;
+        if (!ok)
+            return Promise.resolve({
+                status: 0,
+                stdout: JSON.stringify({ ok: false, message: 'no Store access', files: [] }),
+                stderr: '',
+            });
+        const out = args[args.indexOf('-OutDir') + 1];
+        fs.mkdirSync(out, { recursive: true });
+        for (const [name, text] of Object.entries(files))
+            if (path.basename(name) === name)
+                fs.writeFileSync(path.join(out, name), text);
+        return Promise.resolve({
+            status: 0,
+            stdout: 'progress\n' + JSON.stringify({ ok: true, message: 'ok', files: Object.keys(files) }),
+            stderr: '',
+        });
+    };
+    return { run, calls: () => calls };
+}
+export const storeAppSuite = {
+    name: 'store-app',
+    title: 'Perplexity desktop app: Store package fetched on the PC, installed in the sandbox, sign-in kept like Comet',
+    run: async (t) => {
+        t.section('the catalogue entry');
+        const entry = appById('perplexity-desktop');
+        t.check(entry !== undefined &&
+            'store' in entry.source &&
+            entry.source.store.productId === PERPLEXITY_DESKTOP_PRODUCT_ID &&
+            entry.source.store.family === PERPLEXITY_DESKTOP_FAMILY &&
+            PERPLEXITY_DESKTOP_FAMILY.startsWith(PERPLEXITY_DESKTOP_PACKAGE + '_') &&
+            entry.userOnly === true, 'a Store source with the product and the package family, yours only');
+        t.equal(storeApps(['rtk', 'perplexity-desktop']).map((a) => a.productId), ['9P9XG917PWCJ'], 'only Store apps are fetched');
+        t.check(appsToInstall({ ...DEFAULTS.apps, install: ['perplexity-desktop'] }, 'none').entries.length === 1, 'it needs no 7-Zip and no other app');
+        t.section('the sign-in kind');
+        const spec = SERVICE_SPECS.perplexityapp;
+        t.check(spec.sources.join() === 'sandbox' &&
+            spec.returns &&
+            !spec.singleHolder &&
+            DEFAULTS.accounts.perplexityapp.share === false &&
+            OFF_IS_SAFER.includes('accounts.perplexityapp.share') &&
+            spec.warnings.some((w) => w.includes("can't be copied from this PC")), 'only from a sandbox, handed back, not shared by default, a project file can only turn it off');
+        const source = HOST_SOURCES.perplexityapp;
+        t.check(!source.fromPc && !source.fromFile && !source.fromAnswers, 'nothing is read from this PC (the cookies are sealed to it)');
+        t.check(appUsersOn(['perplexity-desktop']).join() === 'perplexityapp' &&
+            serviceWanted('perplexityapp', new Set(['perplexityapp'])) &&
+            !serviceWanted('perplexityapp', new Set(['comet'])) &&
+            usedByText(['perplexityapp']) === 'the Perplexity desktop app', 'handed over only where the app is on');
+        const cookie = { name: 's', value: 'v', domain: '.perplexity.ai', path: '/', secure: true, httpOnly: true };
+        t.check(PAYLOADS.perplexityapp.safeParse({ cookies: [cookie] }).success &&
+            !PAYLOADS.perplexityapp.safeParse({ cookies: [{ ...cookie, domain: 'example.com' }] }).success, 'the payload is the perplexity.ai cookie allow-list');
+        const pendingRoot = t.dir('pending');
+        t.write(perplexityAppPendingFile(pendingRoot), JSON.stringify({ cookies: [cookie] }));
+        t.check(peekPendingPerplexityApp(pendingRoot)?.cookies.length === 1, 'a waiting sign-in is read and left in place');
+        t.write(perplexityAppPendingFile(pendingRoot), '{"cookies":[{"domain":"example.com"}]}');
+        t.check(peekPendingPerplexityApp(pendingRoot) === null, 'one that is not the allow-listed shape is not used');
+        t.check(!(await restoreAppSignIn({ cookies: [{ ...cookie, expires: 4_000_000_000 }] }, t.dir('no-app-profile'))), 'with the app not running, nothing is written');
+        t.section('the package manifest');
+        const file = (name, role) => ({ name, role, sha256: sha(name), bytes: 10 });
+        const manifest = (files) => ({
+            productId: '9P9XG917PWCJ',
+            fetchedAt: '2026-01-01T00:00:00Z',
+            files,
+        });
+        t.check(StorePackageManifestSchema.safeParse(manifest([file(MAIN, 'main'), file(FRAMEWORK, 'dependency')])).success &&
+            !StorePackageManifestSchema.safeParse(manifest([file(FRAMEWORK, 'dependency')])).success &&
+            !StorePackageManifestSchema.safeParse(manifest([file(MAIN, 'main'), file(MAIN.toUpperCase().replace('.MSIX', '.msix'), 'main')])).success &&
+            !StorePackageManifestSchema.safeParse(manifest([file('..\\evil.msix', 'main')])).success &&
+            !StorePackageManifestSchema.safeParse(manifest([file('x.exe', 'main')])).success, 'exactly one app file, and only .msix/.appx names (no paths, no programs)');
+        t.check(storePackageRole(MAIN, PERPLEXITY_DESKTOP_PACKAGE) === 'main' &&
+            storePackageRole(FRAMEWORK, PERPLEXITY_DESKTOP_PACKAGE) === 'dependency' &&
+            isStorePackageFile(MAIN) &&
+            !isStorePackageFile('a/b.msix'), 'the app is told from its frameworks by name');
+        t.section('this PC fetches and stages the package');
+        const storageRoot = t.dir('pc', 'storage');
+        const dataPath = t.dir('pc', 'storage', 'data', 'set');
+        const app = {
+            id: 'perplexity-desktop',
+            productId: PERPLEXITY_DESKTOP_PRODUCT_ID,
+            packageName: PERPLEXITY_DESKTOP_PACKAGE,
+        };
+        const store = fakeStore({
+            [MAIN]: 'app-bytes',
+            [FRAMEWORK]: 'framework-bytes',
+            '..evil.txt': 'x',
+            '../escape.msix': 'x',
+        });
+        let now = Date.parse('2026-06-01T00:00:00Z');
+        const packages = new StorePackages({ storageRoot, dataPath, run: store.run, now: () => now });
+        const first = await packages.ensure(app);
+        t.check(first.note === 'downloaded' &&
+            first.manifest.files.length === 2 &&
+            first.manifest.files.find((f) => f.role === 'main')?.sha256 === sha('app-bytes') &&
+            packages.cached(app.productId) !== null &&
+            !fs.existsSync(packages.cacheDir(app.productId) + '.new'), "the files are hashed here, not taken on the script's word; names that are not packages are ignored");
+        const second = await packages.ensure(app);
+        t.check(store.calls() === 1 && second.note.startsWith('kept'), 'a fresh cache is not fetched again');
+        const staged = packages.stage(app, first.manifest);
+        t.check(staged === stagedPackageDir(dataPath, app.id) &&
+            fs.readFileSync(path.join(staged, MAIN), 'utf8') === 'app-bytes' &&
+            fs.existsSync(path.join(staged, 'store-package.json')), 'the package is copied into the data folder with its manifest');
+        fs.writeFileSync(path.join(staged, 'stale.msix'), 'old');
+        packages.stage(app, first.manifest);
+        t.check(!fs.existsSync(path.join(staged, 'stale.msix')), 'a file the manifest does not list is removed');
+        t.section('an old cache and a failing Store');
+        now += 40 * 24 * 3600 * 1000;
+        const failing = new StorePackages({ storageRoot, dataPath, run: fakeStore({}, false).run, now: () => now });
+        const kept = await failing.ensure(app);
+        t.check(kept.note.includes('could not be fetched') && kept.note.includes('no Store access'), 'the old package stands, and says why');
+        const emptyRoot = t.dir('pc2', 'storage');
+        const emptyData = t.dir('pc2', 'storage', 'data', 'set');
+        const outcome = await prepareStorePackages([app], {
+            storageRoot: emptyRoot,
+            dataPath: emptyData,
+            run: fakeStore({}, false).run,
+        });
+        t.check(outcome.notes.length === 1 &&
+            outcome.notes[0].includes('is not prepared') &&
+            outcome.notes[0].includes('winget download --id 9P9XG917PWCJ'), 'with nothing kept the launch goes on, with a note that says what to fix');
+        const good = await prepareStorePackages([app], {
+            storageRoot: emptyRoot,
+            dataPath: emptyData,
+            run: fakeStore({ [MAIN]: 'a' }).run,
+        });
+        t.check(good.notes[0].includes('downloaded') && fs.existsSync(path.join(stagedPackageDir(emptyData, app.id), MAIN)), 'and a working Store stages it');
+        t.section('the sandbox checks the kept files');
+        const checked = await checkedPackage(staged);
+        t.check(path.basename(checked.main) === MAIN && checked.dependencies.map((d) => path.basename(d)).join() === FRAMEWORK, 'the app and its frameworks, in order');
+        fs.writeFileSync(path.join(staged, FRAMEWORK), 'tampered');
+        t.check((await t.thrownMessage(() => checkedPackage(staged))).includes('missing or changed'), 'a changed file stops the install');
+        t.check((await t.thrownMessage(() => checkedPackage(t.dir('nothing')))).includes('not handed over'), 'no package says so');
+        t.section('the shortcut');
+        const args = perplexityAppShortcutArgs('C:\\AgentLaunch\\sandbox\\scripts\\start-store-app.ps1', 'C:\\Users\\X\\profile');
+        t.check(args.includes('-File "C:\\AgentLaunch\\sandbox\\scripts\\start-store-app.ps1"') &&
+            args.includes('-PackageName PerplexityAI.PerplexityApp') &&
+            args.includes('-UserDataDir "C:\\Users\\X\\profile"') &&
+            args.includes('-Port 0') &&
+            args.includes('-WindowStyle Hidden'), 'a hidden PowerShell start with the package, its own profile and a free DevTools port');
+    },
+};

package/dist/selftest/support/engine-golden.js

@@ -44,10 +44,14 @@ export const LAUNCH_FILES_GOLDEN = [
     'sandbox/addons/context7/package.json',
     'sandbox/addons/headroom/requirements.in',
     'sandbox/addons/headroom/requirements.txt',
+    'sandbox/addons/openupm-cli/package-lock.json',
+    'sandbox/addons/openupm-cli/package.json',
     'sandbox/addons/perplexity-mcp/package-lock.json',
     'sandbox/addons/perplexity-mcp/package.json',
     'sandbox/addons/playwright-mcp/package-lock.json',
     'sandbox/addons/playwright-mcp/package.json',
+    'sandbox/addons/unity-mcp/requirements.in',
+    'sandbox/addons/unity-mcp/requirements.txt',
     'sandbox/boot/bootstrap.ps1',
     'sandbox/boot/bootstrap/drives.ps1',
     'sandbox/boot/bootstrap/files.ps1',
@@ -55,6 +59,7 @@ export const LAUNCH_FILES_GOLDEN = [
     'sandbox/boot/bootstrap/status.ps1',
     'sandbox/boot/logon.cmd',
     'sandbox/boot/trust.cmd',
+    'sandbox/csharp/AppActivation.cs',
     'sandbox/csharp/BindMount.cs',
     'sandbox/csharp/CargoShim.cs',
     'sandbox/csharp/Desktop.cs',
@@ -79,6 +84,7 @@ export const LAUNCH_FILES_GOLDEN = [
     'sandbox/scripts/get-signature.ps1',
     'sandbox/scripts/get-vs-setup.ps1',
     'sandbox/scripts/install-shell-path.ps1',
+    'sandbox/scripts/install-store-package.ps1',
     'sandbox/scripts/link-profile-dirs.ps1',
     'sandbox/scripts/new-shortcuts.ps1',
     'sandbox/scripts/repair-wmi-services.ps1',
@@ -88,6 +94,7 @@ export const LAUNCH_FILES_GOLDEN = [
     'sandbox/scripts/set-dns-servers.ps1',
     'sandbox/scripts/set-machine-environment.ps1',
     'sandbox/scripts/set-registry-values.ps1',
+    'sandbox/scripts/start-store-app.ps1',
     'sandbox/templates/fivem/README.txt',
     'sandbox/templates/fivem/cs/Client/Client.csproj',
     'sandbox/templates/fivem/cs/Client/ClientMain.cs',

package/dist/selftest/support/fixtures.d.ts

@@ -106,6 +106,7 @@ export declare function createFixtures(t: Harness): {
         };
         github: {
             shareToken: boolean;
+            usePcLogin: boolean;
         };
         accounts: {
             epic: {
@@ -138,6 +139,9 @@ export declare function createFixtures(t: Harness): {
             comet: {
                 share: boolean;
             };
+            perplexityapp: {
+                share: boolean;
+            };
         };
         pcInstalls: {
             steamGames: boolean | number[];
@@ -145,7 +149,8 @@ export declare function createFixtures(t: Harness): {
             unrealEngines: boolean | string[] | "auto";
             unrealEngineFolders: string[];
             unrealAssets: boolean | "auto";
-            unityEditors: boolean | string[];
+            unityEditors: boolean | string[] | "auto";
+            unityAssets: boolean | "auto";
         };
         provisioning: {
             copyFromHost: boolean;
@@ -212,6 +217,10 @@ export declare function createFixtures(t: Harness): {
                 modules: string[];
                 hub: boolean;
                 keepVersions: number;
+                mcp: boolean;
+                agentSkills: boolean;
+                cliVersion: string;
+                assetCache: "pc" | "persisted" | "local";
             };
             godot: {
                 enabled: boolean | "auto";

package/dist/selftest/support/unity-sample.d.ts

@@ -0,0 +1,2 @@
+import type { UnityOverview } from '../../app/features/unity/index.js';
+export declare const UNITY_SAMPLE: UnityOverview;

package/dist/selftest/support/unity-sample.js

@@ -0,0 +1,80 @@
+export const UNITY_SAMPLE = {
+    setUp: true,
+    checkedAt: '2026-11-05T12:00:00.000Z',
+    cli: { version: '1.0.0-beta.16', path: 'C:\\AgentData\\tools\\unity\\cli\\1.0.0-beta.16\\unity.exe' },
+    editors: [
+        {
+            version: '6000.0.58f2',
+            dir: 'C:\\PcInstalls\\unity\\6000.0.58f2',
+            where: 'this PC, read-only',
+            writable: false,
+            modules: ['android'],
+            sizeBytes: null,
+            projects: ['Platformer'],
+        },
+        {
+            version: '2022.3.20f1',
+            dir: 'C:\\AgentData\\tools\\unity\\editors\\2022.3.20f1',
+            where: 'the data disk, kept between sandboxes',
+            writable: true,
+            modules: [],
+            sizeBytes: 9 * 1024 ** 3,
+            projects: ['OldGame'],
+        },
+    ],
+    projects: [
+        {
+            project: 'Platformer',
+            folder: 'F:\\Code\\Platformer',
+            version: '6000.0.58f2',
+            editor: 'Unity 6000.0.58f2',
+            reason: 'the project asks for 6000.0.58f2',
+            bridge: 'pipeline',
+            pipeline: true,
+        },
+        {
+            project: 'OldGame',
+            folder: 'F:\\Code\\OldGame',
+            version: '2022.3.20f1',
+            editor: 'Unity 2022.3.20f1',
+            reason: 'the project asks for 2022.3.20f1',
+            bridge: null,
+            pipeline: false,
+        },
+    ],
+    licence: { state: 'active', kind: 'Personal', detail: 'Unity Personal', user: 'dev@example.com' },
+    hub: { installed: false, setting: false },
+    assetCache: { mode: 'persisted', dir: 'C:\\AgentData\\tools\\unity\\asset-store' },
+    agentTools: { cliVersion: '1.0.0-beta.16', mcp: 'sbx-unity', mcpSetting: true, skills: true, skillsSetting: true },
+    pc: {
+        setting: 'auto',
+        editors: [{ version: '6000.0.58f2', folder: 'C:\\Program Files\\Unity\\Hub\\Editor\\6000.0.58f2' }],
+        problem: null,
+    },
+    assets: {
+        setting: 'auto',
+        folders: [
+            {
+                folder: 'C:\\Users\\dev\\AppData\\Roaming\\Unity\\Asset Store-5.x',
+                packages: [
+                    { publisher: 'Kenney', category: '2D', name: 'Platformer Pack', size: '120 MB' },
+                    { publisher: 'Synty Studios', category: '3D Models', name: 'POLYGON Fantasy', size: '1.4 GB' },
+                ],
+                more: 0,
+            },
+        ],
+    },
+    problem: null,
+    settings: {
+        enabled: 'auto',
+        acceptLicense: true,
+        version: 'project',
+        modules: 'none',
+        hub: false,
+        keepVersions: 2,
+        mcp: true,
+        agentSkills: true,
+        cliVersion: '1.0.0-beta.16',
+        assetCache: 'persisted',
+    },
+};

package/dist/selftest/unity-accounts.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const unityAccountsSuite: Suite;

package/dist/selftest/unity-accounts.test.js

@@ -0,0 +1,106 @@
+// Unity licence and sign-in: the host source (a fake ProgramData and LocalAppData in temp folders), the guest adapter
+// (apply and read back, release with an injected runner) and the Accounts page. Nothing real is read or run.
+import path from 'node:path';
+import { serviceRow, servicePage } from '../app/features/accounts/index.js';
+import { pageLines } from '../cli/output/index.js';
+import { AccountLeases, HOST_SOURCES, ServiceAccountStore } from '../host/accounts/index.js';
+import { unitySource } from '../host/accounts/kinds/unity.js';
+import { SecretStore } from '../host/secrets/index.js';
+import { serviceWanted, unityEntitlementFile, unityUlfFile, } from '../shared/accounts/index.js';
+import { activateUnityLicence, unityAdapterFor } from '../guest/accounts/kinds/unity.js';
+const ULF = '<?xml version="1.0"?><root><License id="Terms"><SerialMasked Value="U3-XXXX-XXXX"/></License></root>';
+const ENTITLEMENT = '<?xml version="1.0"?><Entitlement><Id>abc</Id></Entitlement>';
+const PASSWORD = 'hunter2-unity-pw';
+const SERIAL = 'E3-AAAA-BBBB-CCCC-DDDD-EEEE';
+function message(fn) {
+    try {
+        fn();
+    }
+    catch (e) {
+        return String(e.message);
+    }
+    return '';
+}
+export const unityAccountsSuite = {
+    name: 'unity-accounts',
+    title: 'Unity licence and sign-in',
+    run: async (t, f) => {
+        t.section('the host source');
+        const pcDir = t.dir('unity-pc');
+        const pc = {
+            programData: path.join(pcDir, 'ProgramData'),
+            localAppData: path.join(pcDir, 'Local'),
+            appData: path.join(pcDir, 'Roaming'),
+        };
+        t.check(unitySource.fromPc(pc) === null, 'a PC with no Unity licence gives nothing');
+        t.write(unityUlfFile(pc.programData), ULF);
+        t.write(unityEntitlementFile(pc.localAppData), ENTITLEMENT);
+        const fromPc = unitySource.fromPc(pc);
+        t.check(fromPc?.ulf === ULF && fromPc.entitlement === ENTITLEMENT, 'the PC licence and entitlement are read');
+        const other = t.dir('unity-other');
+        t.write(unityUlfFile(other), ULF);
+        t.check(unitySource.fromPc({ ...pc, localAppData: '' }, other)?.ulf === ULF, '--from names another ProgramData folder');
+        const virtual = t.dir('unity-virtual');
+        t.write(path.join(virtual, 'VirtualStore', 'ProgramData', 'Unity', 'Unity_lic.ulf'), ULF);
+        t.check(unitySource.fromPc({ programData: path.join(virtual, 'none'), localAppData: virtual, appData: '' })?.ulf === ULF, 'the VirtualStore copy is the fallback');
+        const refusal = message(() => unitySource.fromFile(Buffer.from('hello'), {}));
+        t.check(refusal.includes('That is not a Unity licence file (Unity_lic.ulf) or entitlement file.'), 'a file that is not a licence is refused with the plain text', refusal);
+        const ulfPayload = unitySource.fromFile(Buffer.from(ULF), { email: 'me@example.com' });
+        const entPayload = unitySource.fromFile(Buffer.from(ENTITLEMENT), {});
+        t.check(ulfPayload.ulf === ULF && ulfPayload.email === 'me@example.com' && entPayload.entitlement === ENTITLEMENT, 'a ULF becomes ulf, an Entitlement file becomes entitlement, answers are added');
+        t.check(message(() => unitySource.fromAnswers({ serial: SERIAL, email: 'me@example.com' })).includes('A serial needs your Unity ID email and password.'), 'a serial without email and password is refused');
+        const typed = unitySource.fromAnswers({ email: 'me@example.com', password: PASSWORD, serial: SERIAL });
+        t.check(typed.email === 'me@example.com' && typed.password === PASSWORD && typed.serial === SERIAL, 'typed answers');
+        const summary = unitySource.summary(typed) ?? '';
+        t.check(!summary.includes(PASSWORD) && !summary.includes(SERIAL), 'the summary never holds a secret');
+        t.section('the guest adapter');
+        const runs = [];
+        const run = (file, args) => {
+            runs.push(file + ' ' + args.join(' '));
+            return Promise.resolve({ code: 0, stdout: '{"status":"active","type":"Personal"}' });
+        };
+        const dirs = {
+            programData: t.dir('unity-guest-pd'),
+            localAppData: t.dir('unity-guest-local'),
+            secrets: t.dir('unity-guest-secrets'),
+        };
+        const adapter = unityAdapterFor(dirs, run);
+        t.check(adapter.current() === null, 'nothing is held at first');
+        const payload = { ulf: ULF, entitlement: ENTITLEMENT, email: 'me@example.com', password: PASSWORD };
+        const applied = await adapter.apply(payload);
+        const back = adapter.current();
+        t.check(back?.ulf === ULF &&
+            back.entitlement === ENTITLEMENT &&
+            back.email === 'me@example.com' &&
+            back.password === PASSWORD, 'apply then current keeps the licence files and the password');
+        t.check(!applied.summary.includes(PASSWORD) && !applied.summary.includes('me@example.com'), 'the summary is safe');
+        await adapter.release();
+        t.check(runs.length === 0, 'release without activated.json runs nothing');
+        const serialDirs = { ...dirs, secrets: t.dir('unity-guest-secrets2') };
+        const serialRuns = [];
+        const record = (file, args, o) => {
+            serialRuns.push(file + ' ' + args.join(' '));
+            return run(file, args, o);
+        };
+        const serialAdapter = unityAdapterFor(serialDirs, record);
+        await serialAdapter.apply({ email: 'me@example.com', password: PASSWORD, serial: SERIAL });
+        const licence = await activateUnityLicence({ editorExe: 'C:\\Editor\\Unity.exe', unityExe: 'C:\\Cli\\unity.exe' }, serialDirs, record);
+        t.check(serialRuns[0].includes('-serial') && serialRuns[0].includes('activate.log') && licence.state === 'active', 'a serial is activated with the editor, then the licence status is read');
+        t.check(!JSON.stringify(licence).includes(PASSWORD) && !JSON.stringify(licence).includes(SERIAL), 'the licence status holds no secret');
+        await serialAdapter.release();
+        t.check(serialRuns.some((r) => r.includes('-returnlicense') && r.includes('return.log')), 'release returns the seat once activated.json exists');
+        const noLicence = () => Promise.resolve({ code: 0, stdout: '{"licenses":[]}' });
+        const none = await activateUnityLicence({ editorExe: null, unityExe: 'C:\\Cli\\unity.exe' }, { programData: t.dir('unity-empty-pd'), localAppData: t.dir('unity-empty-la'), secrets: t.dir('unity-empty-s') }, noLicence);
+        t.check(none.state === 'none' && none.detail === 'none: sign in to Unity once in this sandbox', 'no licence: sign in once');
+        const refused = await activateUnityLicence({ editorExe: null, unityExe: 'C:\\Cli\\unity.exe', source: 'this PC' }, dirs, noLicence);
+        t.check(refused.state === 'invalid' && refused.detail.includes('is not accepted here: sign in again'), 'a licence file that is not accepted says to sign in again');
+        t.section('who wants it, and the page');
+        t.check(serviceWanted('unity', new Set(['unity'])) && !serviceWanted('unity', new Set(['steam'])), 'only the Unity toolchain wants the Unity sign-in');
+        t.check(HOST_SOURCES.unity === unitySource, 'the Unity source is registered');
+        const config = f.makeConfig();
+        const store = new ServiceAccountStore(config.storage.root, SecretStore.memory());
+        const row = serviceRow('unity', config, store, new AccountLeases(config.storage.root));
+        const text = pageLines(servicePage(row)).join('\n');
+        t.check(row.canImport && row.canLogin && row.warnings.length > 0 && !text.includes('sandbox account'), 'the Accounts section offers import and sign in, and shows no "sandbox account" command text', text);
+    },
+};

package/dist/selftest/unity-agent.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const unityAgentSuite: Suite;

package/dist/selftest/unity-agent.test.js

@@ -0,0 +1,47 @@
+// Unity agent tools: sbx-unity in Claude Code's and Codex's MCP settings, the Apps add-ons (MCP for Unity, openupm-cli)
+// and their lock files. Pure: nothing is installed or run.
+import fs from 'node:fs';
+import path from 'node:path';
+import { addonMcpServer, APPS, codexWithAddonMcpServers, withAddonMcpServers, } from '../shared/apps/index.js';
+import { UNITY_MCP_NAME, unityCliMcpServer } from '../shared/unity/index.js';
+export const unityAgentSuite = {
+    name: 'unity-agent',
+    title: 'Unity agent tools: MCP, guide, Apps add-ons',
+    run: (t) => {
+        t.section('sbx-unity in the agents');
+        const server = unityCliMcpServer('C:\\AgentData\\tools\\unity\\cli\\1.0.0\\unity.exe', 'C:\\Workspace\\game');
+        const mine = { mine: { type: 'stdio', command: 'mine.exe', args: [], env: {} } };
+        // The guest's ENGINE_MCP_NAMES (guest/setup/addon-mcp.ts) cannot be imported here: it loads the guest runtime.
+        const engineNames = ['sbx-unreal-editor', UNITY_MCP_NAME];
+        const names = [...APPS.flatMap((a) => (a.mcp ? [a.mcp.name] : [])), ...engineNames];
+        const on = withAddonMcpServers(mine, { [UNITY_MCP_NAME]: server }, names);
+        t.check('mine' in on && UNITY_MCP_NAME in on, 'your own servers are kept and sbx-unity is added');
+        const off = withAddonMcpServers(on, {}, names);
+        t.check('mine' in off && !(UNITY_MCP_NAME in off), 'sbx-unity is removed when it is off; your servers stay');
+        const codex = codexWithAddonMcpServers('', { [UNITY_MCP_NAME]: server }, engineNames);
+        t.check(codex.toml.includes('[mcp_servers.sbx-unity]') && codex.toml.includes('args = ["mcp", "--cli-tools"]'), 'Codex gets [mcp_servers.sbx-unity] with args = ["mcp", "--cli-tools"]');
+        t.section('Apps add-ons');
+        const unity = APPS.find((a) => a.id === 'unity-mcp');
+        const built = addonMcpServer('C:\\x', unity.mcp, { exe: 'C:\\x\\venv\\Scripts\\mcp-for-unity.exe' });
+        t.check(built?.type === 'stdio' &&
+            built.command === 'C:\\x\\venv\\Scripts\\mcp-for-unity.exe' &&
+            built.args.join(' ') === '--transport stdio' &&
+            built.env.DISABLE_TELEMETRY === '1' &&
+            built.env.UNITY_MCP_DISABLE_TELEMETRY === '1' &&
+            built.env.MCP_DISABLE_TELEMETRY === '1' &&
+            unity.mcp?.name === 'sbx-unity-mcp' &&
+            unity.mcp.codex === true, 'MCP for Unity runs mcp-for-unity.exe --transport stdio with telemetry off, for Claude Code and Codex');
+        const openupm = APPS.find((a) => a.id === 'openupm-cli');
+        t.check(openupm?.exe === 'openupm.cmd' && openupm.category === 'gamedev' && !openupm.mcp, 'openupm-cli is a game-development app');
+        const addons = path.join(process.cwd(), 'sandbox', 'addons');
+        const reqs = fs.readFileSync(path.join(addons, 'unity-mcp', 'requirements.txt'), 'utf8');
+        t.check(fs
+            .readFileSync(path.join(addons, 'unity-mcp', 'requirements.in'), 'utf8')
+            .includes('mcpforunityserver==10.3.0') &&
+            /^mcpforunityserver==10\.3\.0 \\\r?\n\s+--hash=sha256:[0-9a-f]{64}/m.test(reqs), 'the MCP for Unity lock file pins mcpforunityserver 10.3.0 with hashes');
+        const lock = fs.readFileSync(path.join(addons, 'openupm-cli', 'package-lock.json'), 'utf8');
+        t.check(fs.existsSync(path.join(addons, 'openupm-cli', 'package.json')) &&
+            lock.includes('"node_modules/openupm-cli"') &&
+            lock.includes('"version": "4.5.3"'), 'the openupm-cli lock file pins 4.5.3');
+    },
+};

package/dist/selftest/unity-page.test.d.ts

@@ -0,0 +1,2 @@
+import type { Suite } from './support/suite.js';
+export declare const unityPageSuite: Suite;