windows-development-sandbox 1.27.0 → 1.27.3

package/dist/bin/claude-host.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-JXL6ZOO3.js";
-import "./chunk-6WWMBCT2.js";
+} from "./chunk-4M5SZZ5P.js";
+import "./chunk-RU7XRN62.js";
 
 // src/bin/claude-host.ts
 var args = process.argv.slice(2);

package/dist/bin/claude-sbx.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-JXL6ZOO3.js";
-import "./chunk-6WWMBCT2.js";
+} from "./chunk-4M5SZZ5P.js";
+import "./chunk-RU7XRN62.js";
 
 // src/bin/claude-sbx.ts
 run(process.argv.slice(2), { harness: "claude" });

package/dist/bin/codex-sbx.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-JXL6ZOO3.js";
-import "./chunk-6WWMBCT2.js";
+} from "./chunk-4M5SZZ5P.js";
+import "./chunk-RU7XRN62.js";
 
 // src/bin/codex-sbx.ts
 run(process.argv.slice(2), { harness: "codex" });

package/dist/bin/gemini-sbx.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-JXL6ZOO3.js";
-import "./chunk-6WWMBCT2.js";
+} from "./chunk-4M5SZZ5P.js";
+import "./chunk-RU7XRN62.js";
 
 // src/bin/gemini-sbx.ts
 run(process.argv.slice(2), { harness: "gemini" });

package/dist/bin/sandbox.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-JXL6ZOO3.js";
-import "./chunk-6WWMBCT2.js";
+} from "./chunk-4M5SZZ5P.js";
+import "./chunk-RU7XRN62.js";
 
 // src/bin/sandbox.ts
 run(process.argv.slice(2));

package/dist/bin/sbx-hide.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-JXL6ZOO3.js";
-import "./chunk-6WWMBCT2.js";
+} from "./chunk-4M5SZZ5P.js";
+import "./chunk-RU7XRN62.js";
 
 // src/bin/sbx-hide.ts
 run(process.argv.slice(2), { command: "hide" });

package/dist/bin/sbx-show.js

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   run
-} from "./chunk-JXL6ZOO3.js";
-import "./chunk-6WWMBCT2.js";
+} from "./chunk-4M5SZZ5P.js";
+import "./chunk-RU7XRN62.js";
 
 // src/bin/sbx-show.ts
 run(process.argv.slice(2), { command: "show" });

package/dist/cli/commands/launch/launch.js

@@ -10,7 +10,7 @@ import { findSecretFiles } from '../../../host/profile/index.js';
 import { RepoGuardStore } from '../../../host/guard/index.js';
 import { hostPublicIp, prepareVpn, readVpnLine, vpnNotes } from '../../../host/vpn/index.js';
 import { prepareGithubToken } from '../../../host/github/index.js';
-import { prepareServiceAccounts } from '../../../host/accounts/index.js';
+import { pcEnv, prepareServiceAccounts } from '../../../host/accounts/index.js';
 import { prepareStorePackages } from '../../../host/apps/index.js';
 import { storeApps } from '../../../shared/apps/index.js';
 import { discoverPcInstalls } from '../../../host/pc-installs/index.js';
@@ -194,6 +194,7 @@ class Launcher {
                 launchId,
                 // A new launch needs no sandbox running, so a lease held elsewhere is from one that stopped.
                 isRunning: () => isSandboxRunning(),
+                pc: pcEnv(),
             });
         // Store apps (apps.install): their packages are fetched with this PC's own Store tooling.
         const store = generateOnly

package/dist/cli/menu/menu.js

@@ -8,6 +8,7 @@ import { errMsg } from '../../core/util/index.js';
 import { SandboxChannel } from '../../host/channel/index.js';
 import { RunDir } from '../../shared/channel/index.js';
 import { isSandboxRunning } from '../../host/sandbox/index.js';
+import { reloadSettings } from '../../app/context.js';
 import { lookAtSandbox } from '../commands/shared-use.js';
 import { commandLine } from '../history.js';
 import { commandSpec } from '../manifest.js';
@@ -98,7 +99,11 @@ export class Menu {
             new SettingsPage(app, files, draft, ctx),
             new AccountsPage(app, ctx),
             new MaintenancePage(app, ctx),
-        ], draft, (saved) => this.applyAgentCommands(saved));
+        ], draft, (saved) => {
+            // Ctrl+S wrote the file: every page and operation reads the new settings from here on.
+            reloadSettings(this.ctx);
+            return this.applyAgentCommands(saved);
+        });
     }
     /** Runs the menu until you leave it, or until a command that takes over the terminal (attach) has run. */
     async start() {

package/dist/cli/menu/pages/accounts-page.js

@@ -7,12 +7,16 @@ import { readQuery } from '../../../app/registry.js';
 import { MenuOperations } from '../io-menu.js';
 import { menuView } from '../render-view.js';
 import { ListPage } from './list-page.js';
+/** The services the menu lists: those whose sign-in is written (the others would offer actions that cannot work). */
+function shown(m) {
+    return m.services.filter((s) => s.ready);
+}
 /** The menu's rows, keys and Enter labels of one agent's category. */
 function viewOf(m, category) {
     const agent = m.agents.find((a) => a.name === category);
     if (agent)
         return menuView(agentPage(agent), { category: agent.name, refresh: false });
-    const service = m.services.find((s) => serviceCategory(s.kind) === category);
+    const service = shown(m).find((s) => serviceCategory(s.kind) === category);
     if (service)
         return menuView(servicePage(service), { category: serviceCategory(service.kind), refresh: false });
     return menuView({ title: 'Accounts', sections: [] }, { refresh: false });
@@ -21,7 +25,7 @@ function viewOf(m, category) {
 export function accountsOptions(m) {
     return {
         path: [],
-        intro: 'Logins saved on this PC, per agent (Use puts one into the sandbox; new launches start with the default), and the service sign-ins sandboxes may get.',
+        intro: 'Logins saved on this PC, per agent, and the service sign-ins sandboxes may get.',
         categories: [
             ...m.agents.map((a) => ({
                 id: a.name,
@@ -30,15 +34,15 @@ export function accountsOptions(m) {
                     ? 'Saved ' + a.name + ' logins.'
                     : "This agent's login is not kept between sandboxes: it cannot be pointed at a folder we control.",
             })),
-            ...m.services.map((s) => ({
+            ...shown(m).map((s) => ({
                 id: serviceCategory(s.kind),
                 label: s.label,
-                description: 'Your ' + s.label + ' sign-in for sandboxes that use ' + s.usedFor + '.',
+                description: 'For ' + s.usedFor + '.',
             })),
         ],
         items: [
             ...m.agents.flatMap((a) => menuView(agentPage(a), { category: a.name, refresh: false }).items),
-            ...m.services.flatMap((s) => menuView(servicePage(s), { category: serviceCategory(s.kind), refresh: false }).items),
+            ...shown(m).flatMap((s) => menuView(servicePage(s), { category: serviceCategory(s.kind), refresh: false }).items),
         ],
         empty: 'No agents.',
         actions: (category) => viewOf(m, category).actions,

package/dist/guest/apps/app-installer.js

@@ -3,6 +3,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { appsToInstall, previewGuideLine } from '../../shared/apps/index.js';
+import { asBackground } from '../../shared/concurrency/index.js';
 import { downloader, moveIntoPlace, stagingFolder } from '../../shared/download/index.js';
 import { safeRemove } from '../../shared/io/safe-remove.js';
 import { dryRun, launchDir } from '../runtime/paths.js';
@@ -28,8 +29,8 @@ const MARKER = '.agent-sandbox-app';
 function prefetchedFile(entry, fileName) {
     return path.join(tool('apps', ...entry.id.split('/')) + '.download', fileName.replace(/[\\/:*?"<>|]/g, '_'));
 }
-/** How many apps download and unpack at once (they are big: a few at a time keeps the disk and network busy). */
-const PARALLEL = 3;
+/** How many apps unpack at once (as many as the heavy pool holds: more would only queue up behind it). */
+const PARALLEL = 2;
 export class AppInstaller {
     env;
     options;
@@ -53,7 +54,8 @@ export class AppInstaller {
             !('npm' in e.source) &&
             e.id !== '7zip' &&
             (this.options.refresh || !exists(path.join(tool('apps', ...e.id.split('/')), MARKER))));
-        await Promise.all(todo.map(async (entry) => {
+        // Behind the downloads other steps need now (the runtimes, Visual Studio): these only save time for the install.
+        await asBackground(() => Promise.all(todo.map(async (entry) => {
             try {
                 const d = await resolve(entry);
                 const file = prefetchedFile(entry, d.fileName);
@@ -67,7 +69,7 @@ export class AppInstaller {
             catch {
                 /* the install resolves and downloads again, and reports the reason if it fails too */
             }
-        }));
+        })));
     }
     /** Installs the entries (7-Zip first: the NSIS apps need it to unpack), then their shortcuts. */
     async installAll(entries) {
@@ -124,7 +126,7 @@ export class AppInstaller {
                 throw new Error(entry.exe + ' not found in the download');
             await afterInstall(entry, exe);
             // A proxy or MCP server (agent add-ons) is started by the sandbox or the agent: no PATH entry, no shortcut.
-            if (!entry.service && (entry.cli || entry.id === 'sysinternals')) {
+            if (!entry.service && (entry.cli || entry.onPath || entry.id === 'sysinternals')) {
                 // rustup's rust-analyzer proxy (in cargo's bin folder) only errors until its component is added.
                 if (entry.id === 'rust-analyzer')
                     this.env.prepend.unshift(path.dirname(exe));

package/dist/guest/apps/comet-unpack.js

@@ -9,7 +9,7 @@ import { installedCometExe } from '../browser/comet.js';
 import { execAsync } from '../runtime/process.js';
 import { heavy } from '../../shared/concurrency/index.js';
 import { mkdirp } from '../runtime/fs.js';
-import { signedBy } from '../toolchains/signature.js';
+import { signedByAsync } from '../toolchains/signature.js';
 /** The archives inside, last stage first: the first one found is opened next. */
 const INNER = [
     /^chrome\.7z$/i,
@@ -118,7 +118,7 @@ export async function installFromKept(dest, signer, what) {
     const installed = installedCometExe();
     if (fs.existsSync(installed))
         return installed;
-    if (!signedBy(installer, signer)) {
+    if (!(await signedByAsync(installer, signer))) {
         fs.rmSync(path.join(dest, '.agent-sandbox-app'), { force: true });
         fs.rmSync(installer, { force: true });
         throw new Error(what + "'s installer is not signed by its vendor; deleted it (it is downloaded again next boot)");

package/dist/guest/runtime/pools.d.ts

@@ -1,10 +1,10 @@
-import { type SpawnOptions } from 'node:child_process';
 import { heavy, installer, net } from '../../shared/concurrency/index.js';
+import { lowerPriority, type SpawnAsyncOptions } from '../../shared/download/index.js';
 export { net, heavy, installer };
 /** Called at the start of the boot and of the daemon: the downloader and the extractor use the pools from then on. */
 export declare function installPools(): void;
 /** Lowers a process (and the children it starts from now on) to below-normal priority; best effort. */
-export declare function belowNormal(pid: number | undefined): void;
+export declare const belowNormal: typeof lowerPriority;
 export interface InstallerOptions {
     /** Below-normal priority for the installer and what it starts (the background Visual Studio). */
     readonly lowPriority?: boolean;
@@ -20,5 +20,5 @@ export interface InstallerOptions {
 export declare function runInstaller(file: string, args: string[], o?: InstallerOptions): Promise<number>;
 /** runInstaller that throws like execAsync when the installer fails. */
 export declare function runInstallerChecked(file: string, args: string[], o?: InstallerOptions): Promise<void>;
-/** execAsync for heavy local work (npm, uv, rustup ...): one of the two heavy slots. */
-export declare function execHeavy(file: string, args: string[], options?: SpawnOptions): Promise<void>;
+/** execAsync for heavy local work (npm, uv, rustup ...): one of the two heavy slots, at below-normal priority. */
+export declare function execHeavy(file: string, args: string[], options?: SpawnAsyncOptions): Promise<void>;

package/dist/guest/runtime/pools.js

@@ -1,10 +1,9 @@
 // The guest's work pools: network bodies, heavy local work and installers. A task takes one slot at the leaf (the
 // call that downloads, unpacks or installs), never while it holds another: the limiter refuses nested pools.
-import os from 'node:os';
 import { spawn } from 'node:child_process';
 import path from 'node:path';
 import { heavy, installer, net, INSTALLER_WAIT_MS, installerRetry } from '../../shared/concurrency/index.js';
-import { downloader, limitExtraction } from '../../shared/download/index.js';
+import { downloader, limitExtraction, lowerPriority } from '../../shared/download/index.js';
 import { log } from './log.js';
 import { execAsync } from './process.js';
 export { net, heavy, installer };
@@ -13,18 +12,8 @@ export function installPools() {
     downloader.limit = net;
     limitExtraction(heavy);
 }
-const BELOW_NORMAL = os.constants.priority.PRIORITY_BELOW_NORMAL;
 /** Lowers a process (and the children it starts from now on) to below-normal priority; best effort. */
-export function belowNormal(pid) {
-    if (pid === undefined)
-        return;
-    try {
-        os.setPriority(pid, BELOW_NORMAL);
-    }
-    catch {
-        /* the process may have ended already; a normal priority only makes it a little slower to share the machine */
-    }
-}
+export const belowNormal = lowerPriority;
 /**
  * Runs an installer in the one installer slot and starts it again while another process holds the Windows Installer
  * lock (exit 1618). Resolves with the exit code of the last try.
@@ -54,7 +43,7 @@ export async function runInstallerChecked(file, args, o = {}) {
     if (code !== 0)
         throw new Error(path.basename(file) + ' ' + args.slice(0, 3).join(' ') + ' failed with exit code ' + code);
 }
-/** execAsync for heavy local work (npm, uv, rustup ...): one of the two heavy slots. */
+/** execAsync for heavy local work (npm, uv, rustup ...): one of the two heavy slots, at below-normal priority. */
 export function execHeavy(file, args, options = {}) {
-    return heavy.run(() => execAsync(file, args, options));
+    return heavy.run(() => execAsync(file, args, { ...options, lowPriority: true }));
 }

package/dist/guest/runtime/process.d.ts

@@ -1,4 +1,5 @@
-import { type SpawnOptions, type SpawnSyncOptions } from 'node:child_process';
+import { type SpawnSyncOptions } from 'node:child_process';
+import { type SpawnAsyncOptions } from '../../shared/download/index.js';
 /** Takes the output of the programs started while the boot draws its progress (boot/boot-console.ts). */
 export interface OutputSink {
     /** Whether programs started now hand their output over instead of writing to the console. */
@@ -11,7 +12,7 @@ export declare function routeOutput(sink: OutputSink | null): void;
 /** Runs a program, streaming output, and throws with a readable message when it fails. */
 export declare function exec(file: string, args: string[], options?: SpawnSyncOptions): void;
 /** exec without blocking: other toolchains keep downloading while this one runs an installer. */
-export declare function execAsync(file: string, args: string[], options?: SpawnOptions): Promise<void>;
+export declare function execAsync(file: string, args: string[], options?: SpawnAsyncOptions): Promise<void>;
 export declare function execOutput(file: string, args: string[], options?: SpawnSyncOptions): string;
 /** Runs sandbox\scripts\<name> (a .ps1 in the launch folder) with `args`; throws when it fails. */
 export declare function runScript(name: string, args?: readonly string[]): void;
@@ -19,6 +20,8 @@ export declare function runScript(name: string, args?: readonly string[]): void;
 export declare function runScriptAsync(name: string, args?: readonly string[]): Promise<void>;
 /** runScript for what it prints ('' when it fails). */
 export declare function scriptOutput(name: string, args?: readonly string[], options?: SpawnSyncOptions): string;
+/** scriptOutput without blocking the event loop ('' when the script fails). */
+export declare function scriptOutputAsync(name: string, args?: readonly string[]): Promise<string>;
 /** Runs sandbox\scripts\<name> with a JSON file (-<param> path) holding `data`, removed afterwards. */
 export declare function runScriptWithJson(name: string, param: string, data: unknown, args?: readonly string[]): void;
 /** runScriptWithJson without blocking the event loop. */

package/dist/guest/runtime/process.js

@@ -2,7 +2,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
-import { moveIntoPlace, spawnAsync, stagingFolder } from '../../shared/download/index.js';
+import { lowerPriority, moveIntoPlace, spawnAsync, stagingFolder, } from '../../shared/download/index.js';
 import { safeRemove } from '../../shared/io/safe-remove.js';
 import { robocopyErrors, robocopyFailed, robocopyMeaning } from '../../shared/io/robocopy-result.js';
 import { SYSTEM } from '../../shared/system.js';
@@ -57,15 +57,18 @@ export function exec(file, args, options = {}) {
 }
 /** exec without blocking: other toolchains keep downloading while this one runs an installer. */
 export async function execAsync(file, args, options = {}) {
+    const { lowPriority, ...spawnOptions } = options;
     const code = captureOutput()
         ? await new Promise((resolve, reject) => {
-            const child = spawn(file, args, { stdio: ['inherit', 'pipe', 'pipe'], windowsHide: true, ...options });
+            const child = spawn(file, args, { stdio: ['inherit', 'pipe', 'pipe'], windowsHide: true, ...spawnOptions });
+            if (lowPriority)
+                lowerPriority(child.pid);
             logLines(child.stdout);
             logLines(child.stderr);
             child.once('error', reject);
             child.once('close', (c) => resolve(c ?? -1));
         })
-        : await spawnAsync(file, args, { stdio: 'inherit', ...options });
+        : await spawnAsync(file, args, { stdio: 'inherit', ...spawnOptions, ...(lowPriority ? { lowPriority } : {}) });
     if (code !== 0)
         throw new Error(path.basename(file) + ' ' + args.slice(0, 3).join(' ') + ' failed with exit code ' + code);
 }
@@ -131,6 +134,23 @@ export function runScriptAsync(name, args = []) {
 export function scriptOutput(name, args = [], options = {}) {
     return execOutput(SYSTEM.powershell(), scriptArgs(name, args), options);
 }
+/** scriptOutput without blocking the event loop ('' when the script fails). */
+export function scriptOutputAsync(name, args = []) {
+    return new Promise((resolve) => {
+        const child = spawn(SYSTEM.powershell(), scriptArgs(name, args), {
+            stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
+        });
+        let out = '';
+        child.stdout?.setEncoding('utf8');
+        child.stdout?.on('data', (chunk) => {
+            if (out.length < CAPTURE_BYTES)
+                out += chunk;
+        });
+        child.once('error', () => resolve(''));
+        child.once('close', (code) => resolve(code === 0 ? out.trim() : ''));
+    });
+}
 /** Runs sandbox\scripts\<name> with a JSON file (-<param> path) holding `data`, removed afterwards. */
 export function runScriptWithJson(name, param, data, args = []) {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sbx-'));

package/dist/guest/setup/unity-agent.js

@@ -10,7 +10,10 @@ import { setEngineMcp, writeAddonMcpServers } from './addon-mcp.js';
 async function syncSkills(unityExe, agent) {
     const home = agent === 'claude' ? { CLAUDE_CONFIG_DIR: claudeDir } : { CODEX_HOME: path.join(stateDir, 'codex') };
     try {
-        await execAsync(unityExe, ['skill', 'sync', agent], { env: { ...process.env, ...UNITY_CLI_ENV, ...home } });
+        // The Unity CLI's client names: claude-code, codex.
+        await execAsync(unityExe, ['skill', 'sync', agent === 'claude' ? 'claude-code' : 'codex'], {
+            env: { ...process.env, ...UNITY_CLI_ENV, ...home },
+        });
         return true;
     }
     catch (e) {

package/dist/guest/toolchains/engines/epic-launcher.d.ts

@@ -1,5 +1,6 @@
+import type { PcInstall } from '../../../shared/paths/pc-installs.js';
 import { type LauncherEntry } from '../../../shared/unreal/index.js';
-/** The launcher's program (launcher 17+ is 64-bit; older ones were in Win32). */
+/** The launcher's program: newer MSIs install into Program Files, older ones into Program Files (x86). */
 export declare function launcherExe(): string | null;
 /** Downloads the launcher's MSI ahead of the install (once). */
 export declare function fetchLauncher(): Promise<void>;
@@ -17,6 +18,11 @@ export declare function placeEngines(persist: boolean): LauncherPlaceResult;
 export declare function savedEntries(): LauncherEntry[];
 /** Puts the saved manifests back where the launcher reads them; the engine folders they name. */
 export declare function restoreLauncherItems(): string[];
+/**
+ * The manifests of this PC's engines (session.json) where the launcher reads them: without one it drops the engine
+ * from LauncherInstalled.dat when it starts. Only a manifest of the engine's own folder; one of ours is replaced.
+ */
+export declare function writePcLauncherItems(items: readonly Pick<PcInstall, 'kind' | 'guest' | 'launcherItem'>[]): number;
 /** Merges these entries into the launcher's LauncherInstalled.dat (foreign entries kept). */
 export declare function writeLauncherEntries(entries: readonly LauncherEntry[]): void;
 /**

package/dist/guest/toolchains/engines/epic-launcher.js

@@ -9,7 +9,7 @@ import { z } from 'zod';
 import { readBoundedFile } from '../../../shared/io/bounded.js';
 import { readValid, writeJsonAtomic } from '../../../shared/io/json.js';
 import { SYSTEM } from '../../../shared/system.js';
-import { enginePlaceProblem, ENGINE_NEED_BYTES, entriesUnder, launcherInstalledFile, launcherManifestsDir, launcherSettingsFiles, MAX_LAUNCHER_FILE_BYTES, mergeLauncherInstalled, restoreItems, saveItems, setLauncherInstallLocation, } from '../../../shared/unreal/index.js';
+import { enginePlaceProblem, ENGINE_NEED_BYTES, entriesUnder, itemInstallLocation, ITEM_NAME, launcherInstalledFile, launcherManifestsDir, launcherSettingsFiles, MAX_LAUNCHER_FILE_BYTES, mergeLauncherInstalled, restoreItems, saveItems, setLauncherInstallLocation, } from '../../../shared/unreal/index.js';
 import { errMsg } from '../../../core/util/errors.js';
 import { runInstaller } from '../../runtime/pools.js';
 import { exists, mkdirp } from '../../runtime/fs.js';
@@ -22,14 +22,18 @@ const SAVED_MANIFESTS = path.join(SAVED_DIR, 'Manifests');
 const SAVED_ENTRIES = path.join(SAVED_DIR, 'LauncherInstalled.json');
 const programData = () => process.env.ProgramData ?? 'C:\\ProgramData';
 const localAppData = () => process.env.LOCALAPPDATA ?? '';
-/** The launcher's program (launcher 17+ is 64-bit; older ones were in Win32). */
+/** The launcher's program: newer MSIs install into Program Files, older ones into Program Files (x86). */
 export function launcherExe() {
-    const root = path.join(process.env['ProgramFiles(x86)'] ?? 'C:\\Program Files (x86)', 'Epic Games', 'Launcher');
-    for (const arch of ['Win64', 'Win32']) {
-        const exe = path.join(root, 'Portal', 'Binaries', arch, 'EpicGamesLauncher.exe');
-        if (exists(exe))
-            return exe;
-    }
+    const roots = [
+        process.env.ProgramFiles ?? 'C:\\Program Files',
+        process.env['ProgramFiles(x86)'] ?? 'C:\\Program Files (x86)',
+    ];
+    for (const root of roots)
+        for (const arch of ['Win64', 'Win32']) {
+            const exe = path.join(root, 'Epic Games', 'Launcher', 'Portal', 'Binaries', arch, 'EpicGamesLauncher.exe');
+            if (exists(exe))
+                return exe;
+        }
     return null;
 }
 /** Downloads the launcher's MSI ahead of the install (once). */
@@ -89,6 +93,24 @@ export function savedEntries() {
 export function restoreLauncherItems() {
     return restoreItems(SAVED_MANIFESTS, launcherManifestsDir(programData()), ENGINES_DIR, exists);
 }
+/**
+ * The manifests of this PC's engines (session.json) where the launcher reads them: without one it drops the engine
+ * from LauncherInstalled.dat when it starts. Only a manifest of the engine's own folder; one of ours is replaced.
+ */
+export function writePcLauncherItems(items) {
+    const dir = launcherManifestsDir(programData());
+    let written = 0;
+    for (const i of items) {
+        if (i.kind !== 'unreal' || !i.launcherItem || !ITEM_NAME.test(i.launcherItem.name))
+            continue;
+        const at = itemInstallLocation(i.launcherItem.text);
+        if (!at || path.win32.resolve(at).toLowerCase() !== path.win32.resolve(i.guest).toLowerCase())
+            continue;
+        fs.writeFileSync(path.join(mkdirp(dir), i.launcherItem.name), i.launcherItem.text, 'utf8');
+        written++;
+    }
+    return written;
+}
 /** Merges these entries into the launcher's LauncherInstalled.dat (foreign entries kept). */
 export function writeLauncherEntries(entries) {
     if (!entries.length)

package/dist/guest/toolchains/engines/unreal-engines.js

@@ -16,7 +16,7 @@ import { runScriptWithJsonAsync } from '../../runtime/process.js';
 import { projectWorkspace } from '../../runtime/project-context.js';
 import { session } from '../../runtime/session.js';
 import { setUnrealMcp, writeAddonMcpServers } from '../../setup/addon-mcp.js';
-import { saveLauncherState, savedEntries, writeLauncherEntries } from './epic-launcher.js';
+import { saveLauncherState, savedEntries, writeLauncherEntries, writePcLauncherItems } from './epic-launcher.js';
 import { DDC_DIR, ENGINES_DIR, SAVED_DIR, updateUnrealStatus } from './unreal-status.js';
 const SAVED_MANIFESTS = path.join(SAVED_DIR, 'Manifests');
 /** The real disk, read bounded. */
@@ -76,6 +76,7 @@ export async function registerEngines(engines, selectorFrom, ctx, aliases = [])
     if (values.length)
         await runScriptWithJsonAsync('set-registry-values.ps1', 'PlanFile', { values });
     try {
+        writePcLauncherItems(ctx.pcInstalls.items);
         writeLauncherEntries(launcherEntries(engines, ctx));
     }
     catch (e) {

package/dist/guest/toolchains/engines/unreal-status.js

@@ -18,7 +18,7 @@ const EMPTY = {
     updatedAt: '',
     engines: [],
     projects: [],
-    launcher: { installed: false, installLocation: null, problem: null, freeBytes: null, needBytes: 0 },
+    launcher: { installed: false, exe: null, installLocation: null, problem: null, freeBytes: null, needBytes: 0 },
     visualStudio: { version: '', path: '', how: '', check: '', ok: false },
     debugger: null,
     ddc: { mode: 'local', dir: null },

package/dist/guest/toolchains/installers.d.ts

@@ -1,8 +1,8 @@
 import { SIGNERS, type AppSigner } from '../../shared/signer.js';
-import { signedBy } from './signature.js';
+import { signedBy, signedByAsync } from './signature.js';
 export { SIGNERS };
-export { signedBy };
+export { signedBy, signedByAsync };
 /** A downloader `verify` hook: refuses a file not signed by `signer` (it counts as integrity for requireChecksum). */
-export declare function signatureCheck(signer: AppSigner, what: string): (file: string) => void;
+export declare function signatureCheck(signer: AppSigner, what: string): (file: string) => Promise<void>;
 /** The installer at `file` (downloaded once from `url`), checked against its signer and, when given, its SHA-256. */
 export declare function signedInstaller(url: string, file: string, what: string, signer: AppSigner, sha256?: string | null): Promise<string>;

package/dist/guest/toolchains/installers.js

@@ -6,13 +6,13 @@ import { downloader } from '../../shared/download/index.js';
 import { exists, mkdirp } from '../runtime/fs.js';
 import { log } from '../runtime/log.js';
 import { SIGNERS } from '../../shared/signer.js';
-import { signedBy } from './signature.js';
+import { signedBy, signedByAsync } from './signature.js';
 export { SIGNERS };
-export { signedBy };
+export { signedBy, signedByAsync };
 /** A downloader `verify` hook: refuses a file not signed by `signer` (it counts as integrity for requireChecksum). */
 export function signatureCheck(signer, what) {
-    return (file) => {
-        if (!signedBy(file, signer))
+    return async (file) => {
+        if (!(await signedByAsync(file, signer)))
             throw new Error(what + ' is not signed by its vendor');
     };
 }
@@ -23,7 +23,7 @@ export async function signedInstaller(url, file, what, signer, sha256 = null) {
         mkdirp(path.dirname(file));
         await downloader.file(url, file, { sha256, verify: signatureCheck(signer, path.basename(file)) });
     }
-    if (!signedBy(file, signer)) {
+    if (!(await signedByAsync(file, signer))) {
         fs.rmSync(file, { force: true });
         throw new Error(path.basename(file) + ' is not signed by its vendor; deleted it (it is downloaded again next boot)');
     }

package/dist/guest/toolchains/native/mesa.js

@@ -1,11 +1,11 @@
 // Mesa for running OpenGL and Vulkan programs without a GPU (llvmpipe, lavapipe).
 import path from 'node:path';
-import { downloader } from '../../../shared/download/index.js';
+import { downloader, fetchJson } from '../../../shared/download/index.js';
 import { SYSTEM } from '../../../shared/system.js';
 import { dryRun } from '../../runtime/paths.js';
 import { execAsync, scriptOutput } from '../../runtime/process.js';
 import { exists } from '../../runtime/fs.js';
-import { log, warn } from '../../runtime/log.js';
+import { log } from '../../runtime/log.js';
 import { errMsg } from '../../../core/util/errors.js';
 import { arch, tool } from '../tool-env.js';
 import { installFromGithub } from '../install.js';
@@ -33,9 +33,28 @@ export async function setupMesa(env, config) {
     if (config.vulkan)
         await setupLavapipe(env, dir);
 }
-const VULKAN_RUNTIME = 'https://sdk.lunarg.com/sdk/download/latest/windows/vulkan-runtime-components.zip';
-/** Used when "latest" is not published yet (LunarG announces a version before its runtime zip is up: a 404). */
-const VULKAN_RUNTIME_PINNED = 'https://sdk.lunarg.com/sdk/download/1.4.350.0/windows/vulkan-runtime-components.zip';
+/** LunarG's newest SDK version per platform ({"windows": "1.4.363.1", ...}). */
+const VULKAN_LATEST = 'https://vulkan.lunarg.com/sdk/latest.json';
+const runtimeUrl = (version) => 'https://sdk.lunarg.com/sdk/download/' + version + '/windows/vulkan-runtime-components.zip';
+/** Known to have the runtime zip: used when LunarG cannot be asked, or none of its versions has one. */
+const VULKAN_PINNED = '1.4.363.0';
+/**
+ * The versions to try for the runtime zip, newest first: LunarG's latest, its x.y.z.0 (a point release such as
+ * 1.4.363.1 reissues the SDK without the runtime zip), then the pinned one.
+ */
+async function runtimeVersions() {
+    let latest = null;
+    try {
+        const value = (await fetchJson(VULKAN_LATEST)).windows;
+        if (typeof value === 'string' && /^\d{1,2}\.\d{1,2}\.\d{1,4}\.\d{1,3}$/.test(value))
+            latest = value;
+    }
+    catch {
+        // LunarG not reachable: the pinned version.
+    }
+    const found = latest ? [latest, latest.replace(/\.\d+$/, '.0')] : [];
+    return [...new Set([...found, VULKAN_PINNED])];
+}
 /**
  * Software Vulkan: Mesa's lavapipe plus the Khronos loader (vulkan-1.dll, from LunarG's runtime components; Windows
  * Sandbox has no Vulkan loader). The loader ignores VK_DRIVER_FILES in elevated processes, and everything in the
@@ -52,12 +71,17 @@ const setupLavapipe = async (env, mesaDir) => {
         // LunarG publishes no checksum for this zip; it comes over HTTPS from LunarG, the Khronos SDK's maintainer.
         // The zip has x86 and x64 folders: only the 64-bit loader (and vulkaninfo) is extracted.
         const fetchRuntime = (url) => downloader.archive(url, dir, { locate: 'vulkan-1.dll', fileName: 'vulkan-runtime.zip', members: ['*/x64/*'] });
-        try {
-            await fetchRuntime(VULKAN_RUNTIME);
-        }
-        catch (e) {
-            warn('The latest Vulkan runtime could not be downloaded (' + errMsg(e) + '); using version 1.4.350.0.');
-            await fetchRuntime(VULKAN_RUNTIME_PINNED);
+        const versions = await runtimeVersions();
+        for (const [n, version] of versions.entries()) {
+            try {
+                await fetchRuntime(runtimeUrl(version));
+                log('Vulkan loader ' + version + ' installed');
+                break;
+            }
+            catch (e) {
+                if (n === versions.length - 1)
+                    throw new Error('the Vulkan loader could not be downloaded (' + errMsg(e) + ')');
+            }
         }
     }
     const register = (file) => execAsync(SYSTEM.reg(), ['add', 'HKLM\\SOFTWARE\\Khronos\\Vulkan\\Drivers', '/v', file, '/t', 'REG_DWORD', '/d', '0', '/f'], { stdio: 'ignore' });

package/dist/guest/toolchains/native/unreal.js

@@ -110,6 +110,7 @@ export async function setupUnreal(env, config, _ctx) {
         ...s,
         launcher: {
             installed: launcher !== null,
+            exe: launcher,
             installLocation: place.installLocation,
             problem: place.problem,
             freeBytes: place.freeBytes,