windows-development-sandbox 1.27.0 → 1.27.3

package/dist/guest/toolchains/native/vcruntime.js

@@ -6,7 +6,7 @@ import { dryRun } from '../../runtime/paths.js';
 import { exists } from '../../runtime/fs.js';
 import { log } from '../../runtime/log.js';
 import { downloadFile } from '../install.js';
-import { SIGNERS, signedBy } from '../installers.js';
+import { SIGNERS, signedByAsync } from '../installers.js';
 import { tool } from '../tool-env.js';
 const VC_REDIST = 'https://aka.ms/vs/17/release/vc_redist.x64.exe';
 /** 1638: a newer version is already installed; 3010: installed, a restart would finish it (not needed for the DLLs). */
@@ -37,7 +37,7 @@ export async function setupVcRuntime(env, summary = true) {
             log('Downloading the Visual C++ runtime (~25 MB once) ...');
             await downloadFile(VC_REDIST, installer);
         }
-        if (!signedBy(installer, SIGNERS.microsoft)) {
+        if (!(await signedByAsync(installer, SIGNERS.microsoft))) {
             fs.rmSync(installer, { force: true });
             throw new Error('vc_redist.x64.exe is not signed by Microsoft; deleted it (it is downloaded again next boot)');
         }

package/dist/guest/toolchains/native/vs-persist.d.ts

@@ -71,6 +71,7 @@ export declare const VsPersistMarkerSchema: z.ZodObject<{
     installationPath: z.ZodString;
     sdkVersion: z.ZodString;
     folders: z.ZodArray<z.ZodEnum<{
+        Shared: "Shared";
         Community: "Community";
         BuildTools: "BuildTools";
         WindowsKits10: "WindowsKits10";
@@ -78,7 +79,6 @@ export declare const VsPersistMarkerSchema: z.ZodObject<{
         "MicrosoftSDKs-v10.0A": "MicrosoftSDKs-v10.0A";
         ReferenceAssemblies: "ReferenceAssemblies";
         Installer: "Installer";
-        Shared: "Shared";
         Setup: "Setup";
         instance: "instance";
     }>>;
@@ -102,6 +102,7 @@ export type VsPersistMarker = z.infer<typeof VsPersistMarkerSchema>;
 /** What save-visual-studio.ps1 writes to its result file. */
 export declare const SaveResultSchema: z.ZodObject<{
     copied: z.ZodArray<z.ZodEnum<{
+        Shared: "Shared";
         Community: "Community";
         BuildTools: "BuildTools";
         WindowsKits10: "WindowsKits10";
@@ -109,7 +110,6 @@ export declare const SaveResultSchema: z.ZodObject<{
         "MicrosoftSDKs-v10.0A": "MicrosoftSDKs-v10.0A";
         ReferenceAssemblies: "ReferenceAssemblies";
         Installer: "Installer";
-        Shared: "Shared";
         Setup: "Setup";
         instance: "instance";
     }>>;

package/dist/guest/toolchains/signature.d.ts

@@ -3,3 +3,5 @@ import { type AppSigner, type Signature } from '../../shared/signer.js';
 export declare function signatureOf(file: string): Signature | null;
 /** Whether a file's valid signature is the expected signer's. */
 export declare function signedBy(file: string, signer: AppSigner): boolean;
+/** signedBy without blocking the event loop: a boot check of a big download must not stall the other tasks. */
+export declare function signedByAsync(file: string, signer: AppSigner): Promise<boolean>;

package/dist/guest/toolchains/signature.js

@@ -1,11 +1,14 @@
 // A file's Authenticode signature (sandbox\scripts\get-signature.ps1) checked against the signer a download names.
 import { z } from 'zod';
 import { signerMatches } from '../../shared/signer.js';
-import { scriptOutput } from '../runtime/process.js';
+import { scriptOutput, scriptOutputAsync } from '../runtime/process.js';
 const SignatureSchema = z.object({ subject: z.string().max(4096), issuer: z.string().max(4096) });
 /** The names on a file's valid signature, or null when it is unsigned, tampered with, or cannot be read. */
 export function signatureOf(file) {
-    const text = scriptOutput('get-signature.ps1', ['-Path', file]).trim();
+    return parseSignature(scriptOutput('get-signature.ps1', ['-Path', file]));
+}
+function parseSignature(output) {
+    const text = output.trim();
     if (!text)
         return null;
     try {
@@ -20,3 +23,7 @@ export function signatureOf(file) {
 export function signedBy(file, signer) {
     return signerMatches(signatureOf(file), signer);
 }
+/** signedBy without blocking the event loop: a boot check of a big download must not stall the other tasks. */
+export async function signedByAsync(file, signer) {
+    return signerMatches(parseSignature(await scriptOutputAsync('get-signature.ps1', ['-Path', file])), signer);
+}

package/dist/guest/toolchains/step-scheduler.js

@@ -5,7 +5,7 @@ import { downloader } from '../../shared/download/index.js';
 import { errMsg } from '../../core/util/errors.js';
 import { emptyEnv } from './tool-env.js';
 /** How many installers run at once: enough to overlap downloads with installs, few enough not to thrash the disk. */
-const PARALLEL = 4;
+const PARALLEL = 3;
 /** Runs one installer; a failure is reported and skipped so it never blocks the other toolchains. */
 async function runReported(sink, name, env, work) {
     try {

package/dist/host/accounts/deliver.d.ts

@@ -2,6 +2,7 @@ import type { BootWant } from '../../core/local-config/index.js';
 import type { Config } from '../../core/types.js';
 import { type Payloads, type ServiceKind, type UsedBy } from '../../shared/accounts/index.js';
 import { AccountLeases } from './leases.js';
+import type { PcEnv } from './source.js';
 import { ServiceAccountStore } from './store.js';
 export interface AccountDelivery {
     readonly payloads: Payloads;
@@ -22,5 +23,7 @@ export interface DeliveryInput {
     readonly isRunning: (dataSet: string) => boolean;
     readonly store?: ServiceAccountStore;
     readonly leases?: AccountLeases;
+    /** This PC's folders: a shared kind with nothing saved takes this PC's own sign-in (left out: never). */
+    readonly pc?: PcEnv;
 }
 export declare function prepareServiceAccounts(i: DeliveryInput): AccountDelivery;

package/dist/host/accounts/deliver.js

@@ -2,6 +2,7 @@ import { fingerprint, SERVICE_KINDS, SERVICE_SPECS, serviceWanted, } from '../..
 import { setNameOf } from '../storage/index.js';
 import { takeHandoffs } from './handoff.js';
 import { AccountLeases } from './leases.js';
+import { HOST_SOURCES } from './sources.js';
 import { ServiceAccountStore } from './store.js';
 /** How to get a first sign-in of a kind, for the note when none is saved. */
 function howToSave(spec) {
@@ -21,6 +22,30 @@ function howToSave(spec) {
         ? 'save one: sandbox account login ' + spec.kind
         : 'save one: sandbox account import ' + spec.kind + ' --from <file>';
 }
+/**
+ * This PC's own sign-in, saved like `sandbox account import`: when nothing is saved, and when the saved one was taken
+ * from this PC and the PC's has changed since (Epic replaces its token whenever the launcher here renews it, so the
+ * old copy no longer signs in). One a sandbox handed back is newer than the PC's and is kept.
+ */
+function takeFromPc(kind, pc, store, saved) {
+    const source = HOST_SOURCES[kind];
+    if (!pc || !source.fromPc)
+        return saved;
+    if (saved && store.info(kind)?.source !== 'pc')
+        return saved;
+    let payload = null;
+    try {
+        payload = source.fromPc(pc);
+    }
+    catch {
+        return saved; // This PC's program has no usable sign-in: the saved one (or the note) stands.
+    }
+    if (!payload)
+        return saved;
+    if (!saved || fingerprint(payload) !== fingerprint(saved))
+        store.save(kind, payload, 'pc', source.summary(payload));
+    return payload;
+}
 export function prepareServiceAccounts(i) {
     const store = i.store ?? new ServiceAccountStore(i.storageRoot);
     const leases = i.leases ?? new AccountLeases(i.storageRoot);
@@ -53,6 +78,8 @@ export function prepareServiceAccounts(i) {
             catch {
                 unreadable = true;
             }
+            if (!unreadable)
+                payload = takeFromPc(kind, i.pc, store, payload);
             if (spec.singleHolder) {
                 const claim = leases.claim(kind, dataSet, i.launchId, payload ? fingerprint(payload) : null, i.isRunning);
                 if (!claim.ok) {

package/dist/host/accounts/source.d.ts

@@ -10,6 +10,8 @@ export interface PcEnv {
     readonly env?: Readonly<Record<string, string | undefined>>;
     /** A variable of this Windows user's saved environment (HKCU\Environment), or null when it is not set. */
     readonly userVariable?: (name: string) => string | null;
+    /** This PC's local drives ("D:\\"), asked only by the searches that look on every drive. */
+    readonly drives?: () => readonly string[];
 }
 /** The value of `name` in `reg query <key> /v <name>` output, or null. */
 export declare function parseRegValue(text: string, name: string): string | null;

package/dist/host/accounts/source.js

@@ -2,6 +2,7 @@
 // (fromFile, `sandbox account import <kind> --from <file>`), or typed (fromAnswers, `sandbox account login <kind>`).
 // One module per kind under kinds/; sources.ts lists them.
 import { spawnSync } from 'node:child_process';
+import { diskUsage } from '../../core/disk.js';
 import { fail } from '../../core/util/index.js';
 import { SYSTEM } from '../../shared/system.js';
 import { refuseInSelfTest } from '../test-guard.js';
@@ -35,6 +36,7 @@ export function pcEnv() {
         programFiles: env.ProgramFiles ?? 'C:\\Program Files',
         env,
         userVariable: savedUserVariable,
+        drives: () => diskUsage(env.ProgramData ?? 'C:\\').map((d) => d.drive),
     };
 }
 /** What a kind whose host side is not written yet says. */

package/dist/host/pc-installs/discover.js

@@ -1,6 +1,7 @@
 import { assertSafeMapping } from '../../core/safe-paths.js';
 import { dirExists, errMsg } from '../../core/util/index.js';
 import { pcInstallGuest } from '../../shared/paths/index.js';
+import { relocateItem } from '../../shared/unreal/index.js';
 import { pcEnv } from '../accounts/index.js';
 import { epicInstalls } from './epic.js';
 import { steamInstalls } from './steam.js';
@@ -10,12 +11,13 @@ import { unrealFolders, unrealInstalls } from './unreal.js';
 import { unrealVault } from './unreal-vault.js';
 /** At most this many installs are mapped (each one is a mapping in the .wsb). */
 export const MAX_PC_INSTALLS = 40;
+// Engines first: a folder is mapped once, as the first source that finds it.
 export const PC_INSTALL_SOURCES = [
-    steamInstalls,
-    epicInstalls,
     unrealFolders,
     unrealInstalls,
     unrealVault,
+    steamInstalls,
+    epicInstalls,
     unityInstalls,
     unityAssets,
 ];
@@ -73,8 +75,10 @@ export function discoverPcInstalls(s, o, pc = pcEnv()) {
                     readOnly: !writable,
                     label: writable ? 'this PC, writable' : 'this PC, read-only',
                 });
-                const { host: _host, ...shown } = install;
-                items.push({ ...shown, guest });
+                const { host: _host, launcherItem, ...shown } = install;
+                // The manifest names the sandbox's folder, or it is left out: no path of this PC goes to the sandbox.
+                const moved = launcherItem ? relocateItem(launcherItem.text, install.host, guest) : null;
+                items.push({ ...shown, guest, ...(moved ? { launcherItem: { name: launcherItem.name, text: moved } } : {}) });
             }
             catch (e) {
                 notes.push('pcInstalls: ' + install.name + ' is not mapped: ' + errMsg(e));

package/dist/host/pc-installs/epic.js

@@ -11,6 +11,9 @@ export function findEpicGames(text, wanted) {
     for (const i of text ? launcherInstallations(text) : []) {
         if (!APP.test(i.appName) || /^\.+$/.test(i.appName) || /^UE_\d/.test(i.appName))
             continue;
+        // Engines and what the launcher puts into one (the Fab plugin lists the engine's folder) are unreal.ts's.
+        if (i.ids?.namespaceId.toLowerCase() === 'ue' || /^UE_\d/i.test(path.win32.basename(i.installLocation)))
+            continue;
         if (names && !names.has(i.appName.toLowerCase()))
             continue;
         if (found.some((f) => f.id.toLowerCase() === i.appName.toLowerCase()))

package/dist/host/pc-installs/unity.d.ts

@@ -10,6 +10,8 @@ export interface UnityPcFiles {
     list(dir: string): string[];
     readonly appData: string;
     readonly programFiles: string;
+    /** Hub's folder on every other drive (D:\Program Files\Unity\Hub\Editor, D:\Unity\Hub\Editor ...). */
+    readonly otherHubFolders?: readonly string[];
 }
 /** The editors of this PC: all of them (true) or the listed versions. Each version once, each folder once. */
 export declare function findUnityEditorsOnPc(files: UnityPcFiles, wanted: true | readonly string[]): PcInstall[];

package/dist/host/pc-installs/unity.js

@@ -1,4 +1,5 @@
-// Unity editors of this PC (pcInstalls.unityEditors): Unity Hub's default folder (<Program Files>\Unity\Hub\Editor),
+// Unity editors of this PC (pcInstalls.unityEditors): Unity Hub's default folder on every drive
+// (<drive>\Program Files\Unity\Hub\Editor, <drive>\Unity\Hub\Editor),
 // the folder named by %APPDATA%\UnityHub\secondaryInstallPath.json and the editors in editors-v2.json. An editor counts
 // only with Editor\Unity.exe; its folder is mapped read-only at C:\PcInstalls\unity\<version>. Every file is read
 // bounded and every name is checked: what Hub wrote is data, never trusted.
@@ -67,8 +68,12 @@ function listedEditors(files) {
 /** The editors of this PC: all of them (true) or the listed versions. Each version once, each folder once. */
 export function findUnityEditorsOnPc(files, wanted) {
     const candidates = [];
-    const hubFolders = [win.join(files.programFiles, 'Unity', 'Hub', 'Editor'), secondaryRoot(files)].filter((d) => d !== null);
-    for (const folder of hubFolders)
+    const hubFolders = [
+        win.join(files.programFiles, 'Unity', 'Hub', 'Editor'),
+        secondaryRoot(files),
+        ...(files.otherHubFolders ?? []),
+    ].filter((d) => d !== null);
+    for (const folder of new Set(hubFolders.map((d) => win.resolve(d))))
         for (const name of files.list(folder).slice(0, MAX_LISTED).sort())
             if (UNITY_VERSION.test(name))
                 candidates.push({ version: name, root: win.join(folder, name) });
@@ -125,6 +130,10 @@ export function unityPcFiles(pc) {
         list: listDir,
         appData: pc.appData,
         programFiles: pc.programFiles ?? 'C:\\Program Files',
+        otherHubFolders: (pc.drives?.() ?? []).flatMap((d) => [
+            win.join(d, 'Program Files', 'Unity', 'Hub', 'Editor'),
+            win.join(d, 'Unity', 'Hub', 'Editor'),
+        ]),
     };
 }
 /** The cache root the environment names: this terminal's variable, else the saved user one. */

package/dist/host/pc-installs/unreal.d.ts

@@ -11,6 +11,10 @@ export interface UnrealPcFiles {
     readonly builds: string;
     /** The launcher's default engines folder (<Program Files>\Epic Games). */
     readonly defaultRoot: string;
+    /** More folders that may hold UE_x.y folders: the same places on every drive (D:\Program Files\Epic Games ...). */
+    readonly otherRoots?: readonly string[];
+    /** The launcher's Data\Manifests folder (its .item files), or none. */
+    readonly manifests?: string;
     readonly list: (dir: string) => string[];
     readonly read: (file: string, max: number) => Buffer | null;
 }
@@ -31,7 +35,7 @@ export interface PcSourceBuild {
 export declare function pcSourceBuilds(files: Pick<UnrealPcFiles, 'read' | 'builds'>): PcSourceBuild[];
 /** The engine folders you registered (pcInstalls.unrealEngineFolders), mapped writable. A folder that is a source
  * build of this PC keeps the PC's build id. */
-export declare function findEngineFolders(files: Pick<UnrealPcFiles, 'read' | 'builds'>, folders: readonly (string | number)[]): PcInstall[];
+export declare function findEngineFolders(files: Pick<UnrealPcFiles, 'read' | 'builds'> & Partial<Pick<UnrealPcFiles, 'launcherInstalled' | 'manifests' | 'list'>>, folders: readonly (string | number)[]): PcInstall[];
 /** This PC's files (reg.exe through system32, bounded reads). */
 export declare function unrealPcFiles(pc: PcEnv): UnrealPcFiles;
 export declare const unrealInstalls: PcInstallSource;

package/dist/host/pc-installs/unreal.js

@@ -1,6 +1,7 @@
 // Unreal Engine versions of this PC (pcInstalls.unrealEngines): the launcher's LauncherInstalled.dat (engines it
-// installed, with its own ids) and the launcher's default folders (<Program Files>\Epic Games\UE_*, for an install
-// whose LauncherInstalled.dat is gone). Each must hold Engine\Build\Build.version; it is mapped read-only at
+// installed, with its own ids) and folders named UE_x.y in the launcher's default places on every drive
+// (<drive>\Program Files\Epic Games, <drive>\Epic Games) and next to what it lists (an install whose entry is gone).
+// Each must hold Engine\Build\Build.version; it is mapped read-only at
 // C:\PcInstalls\unreal\UE_5.4. Source builds (HKCU\Software\Epic Games\Unreal Engine\Builds) are NOT mapped by
 // themselves, as UBT writes inside an engine. pcInstalls.unrealEngineFolders: folders you registered, mapped writable
 // (dir-<name>; a source build of this PC keeps its build id). Every file is read bounded.
@@ -9,7 +10,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { readBoundedFile } from '../../shared/io/index.js';
 import { SYSTEM } from '../../shared/system.js';
-import { BUILDS_KEY, launcherInstallations, launcherInstalledFile, MAX_LAUNCHER_FILE_BYTES, parseBuildVersion, versionText, } from '../../shared/unreal/index.js';
+import { BUILDS_KEY, itemInstallLocation, ITEM_NAME, launcherInstallations, launcherInstalledFile, launcherManifestsDir, MAX_LAUNCHER_FILE_BYTES, parseBuildVersion, versionText, } from '../../shared/unreal/index.js';
 const win = path.win32;
 /** At most this many engines of this PC are mapped. */
 export const MAX_PC_ENGINES = 8;
@@ -28,6 +29,27 @@ const versionOf = (dir, files) => {
     const bytes = files.read(win.join(dir, 'Engine', 'Build', 'Build.version'), 64 * 1024);
     return bytes ? parseBuildVersion(bytes.toString('utf8')) : null;
 };
+/** At most this much of a manifest goes into session.json (an engine's is a few KB). */
+const MAX_ITEM_BYTES = 64 * 1024;
+/** The launcher's manifest of the app in `dir` (with this PC's paths), or nothing. */
+function launcherItemOf(dir, files) {
+    if (!files.manifests)
+        return {};
+    const want = win.resolve(dir).toLowerCase();
+    for (const name of files.list(files.manifests).filter((n) => ITEM_NAME.test(n))) {
+        const bytes = files.read(win.join(files.manifests, name), MAX_ITEM_BYTES);
+        const at = bytes ? itemInstallLocation(bytes.toString('utf8')) : null;
+        if (bytes && at && win.resolve(at).toLowerCase() === want)
+            return { launcherItem: { name, text: bytes.toString('utf8') } };
+    }
+    return {};
+}
+/** The launcher's ids for the app in `dir` (from LauncherInstalled.dat), or nothing. */
+function launcherIdsOf(dir, files) {
+    const want = win.resolve(dir).toLowerCase();
+    const entry = (files.launcherInstalled ? launcherInstallations(files.launcherInstalled) : []).find((i) => APP_NAME.test(i.appName) && i.ids && win.resolve(i.installLocation).toLowerCase() === want);
+    return entry?.ids ? { launcher: entry.ids } : {};
+}
 const isWanted = (wanted, v) => wanted === true || wanted.map((w) => String(w).replace(/^UE_/i, '')).includes(v.major + '.' + v.minor);
 /** The engines of this PC that `wanted` maps, each folder once, at most MAX_PC_ENGINES. */
 export function findUnrealInstalls(files, wanted) {
@@ -52,16 +74,28 @@ export function findUnrealInstalls(files, wanted) {
             host: win.normalize(dir),
             guest: '',
             ...(ids ? { launcher: ids } : {}),
+            ...launcherItemOf(dir, files),
         });
     };
-    for (const i of files.launcherInstalled ? launcherInstallations(files.launcherInstalled) : [])
+    const listed = files.launcherInstalled ? launcherInstallations(files.launcherInstalled) : [];
+    for (const i of listed)
         if (APP_NAME.test(i.appName))
             installed(i.installLocation, i.ids ?? undefined);
-    for (const name of files
-        .list(files.defaultRoot)
-        .filter((n) => APP_NAME.test(n))
-        .sort())
-        installed(win.join(files.defaultRoot, name));
+    // Folders named like an engine: the default places, and the folders that hold what the launcher installed (an
+    // engine whose entry is gone often sits next to one that is listed, or next to a game).
+    const roots = [files.defaultRoot, ...(files.otherRoots ?? []), ...listed.map((i) => win.dirname(i.installLocation))];
+    const seen = new Set();
+    for (const root of roots) {
+        const key = win.resolve(root).toLowerCase();
+        if (seen.has(key) || seen.size >= 32)
+            continue;
+        seen.add(key);
+        for (const name of files
+            .list(root)
+            .filter((n) => APP_NAME.test(n))
+            .sort())
+            installed(win.join(root, name));
+    }
     return found;
 }
 /** Source builds this PC registered (the Builds key). They are not mapped by themselves: UBT writes inside them. */
@@ -105,6 +139,9 @@ export function findEngineFolders(files, folders) {
             guest: '',
             writable: true,
             ...(source ? { buildId: source.buildId } : {}),
+            // An engine the launcher installed keeps its ids and manifest, so the sandbox's launcher lists it too.
+            ...launcherIdsOf(dir, { launcherInstalled: files.launcherInstalled ?? null }),
+            ...(files.list ? launcherItemOf(dir, { manifests: files.manifests, list: files.list, read: files.read }) : {}),
         });
     }
     return found;
@@ -130,6 +167,11 @@ export function unrealPcFiles(pc) {
         launcherInstalled: dat ? dat.toString('utf8') : null,
         builds: query.status === 0 ? String(query.stdout ?? '') : '',
         defaultRoot: win.join(pc.programFiles ?? 'C:\\Program Files', 'Epic Games'),
+        otherRoots: (pc.drives?.() ?? []).flatMap((d) => [
+            win.join(d, 'Program Files', 'Epic Games'),
+            win.join(d, 'Epic Games'),
+        ]),
+        manifests: launcherManifestsDir(pc.programData),
         list: listDir,
         read: readBoundedFile,
     };

package/dist/runtime/agent.js

@@ -26093,6 +26093,7 @@ var GAMEDEV_APPS = [
     size: "100 MB",
     source: { github: "f3d-app/f3d", asset: "^F3D-[\\d.]+-Windows-x86_64\\.zip$" },
     exe: "f3d.exe",
+    onPath: true,
     needs: ["mesa"]
   },
   {
@@ -27192,7 +27193,7 @@ var SERVICE_SPECS = {
   },
   steam: {
     kind: "steam",
-    label: "Steam (SteamCMD)",
+    label: "Steam",
     usedBy: ["steam"],
     sources: ["file", "sandbox"],
     singleHolder: true,
@@ -27228,7 +27229,7 @@ var SERVICE_SPECS = {
   },
   cfx: {
     kind: "cfx",
-    label: "Cfx.re (FiveM / RedM server key)",
+    label: "FiveM key",
     usedBy: ["fivem"],
     sources: ["typed", "file"],
     singleHolder: false,
@@ -27257,7 +27258,7 @@ var SERVICE_SPECS = {
   },
   keystore: {
     kind: "keystore",
-    label: "Android upload keystore",
+    label: "Android keystore",
     usedBy: ["android"],
     sources: ["file"],
     singleHolder: false,
@@ -27272,7 +27273,7 @@ var SERVICE_SPECS = {
   },
   play: {
     kind: "play",
-    label: "Google Play (service account)",
+    label: "Google Play",
     usedBy: ["android"],
     sources: ["file"],
     singleHolder: false,
@@ -27283,7 +27284,7 @@ var SERVICE_SPECS = {
   },
   expo: {
     kind: "expo",
-    label: "Expo (EAS)",
+    label: "Expo",
     usedBy: ["reactNative"],
     sources: ["typed"],
     singleHolder: false,
@@ -27294,7 +27295,7 @@ var SERVICE_SPECS = {
   },
   appstore: {
     kind: "appstore",
-    label: "App Store Connect API key",
+    label: "App Store Connect",
     usedBy: ["reactNative", "flutter"],
     sources: ["file", "typed"],
     singleHolder: false,
@@ -27308,7 +27309,7 @@ var SERVICE_SPECS = {
   },
   perplexity: {
     kind: "perplexity",
-    label: "Perplexity API key",
+    label: "Perplexity API",
     usedBy: ["perplexity"],
     sources: ["pc", "file", "typed"],
     singleHolder: false,
@@ -27332,7 +27333,7 @@ var SERVICE_SPECS = {
   },
   comet: {
     kind: "comet",
-    label: "Comet (Perplexity browser)",
+    label: "Comet",
     usedBy: ["comet"],
     sources: ["sandbox"],
     singleHolder: false,
@@ -27348,7 +27349,7 @@ var SERVICE_SPECS = {
   },
   perplexityapp: {
     kind: "perplexityapp",
-    label: "Perplexity desktop app",
+    label: "Perplexity app",
     usedBy: ["perplexityapp"],
     sources: ["sandbox"],
     singleHolder: false,
@@ -28074,7 +28075,7 @@ import path12 from "node:path";
 
 // src/guest/runtime/process.ts
 import fs10 from "node:fs";
-import os3 from "node:os";
+import os4 from "node:os";
 import path11 from "node:path";
 import { spawn as spawn2, spawnSync } from "node:child_process";
 
@@ -28134,10 +28135,20 @@ function scriptArgs(name, args = []) {
 }
 
 // src/shared/download/spawn.ts
+import os3 from "node:os";
 import { spawn } from "node:child_process";
+function lowerPriority(pid) {
+  if (pid === void 0) return;
+  try {
+    os3.setPriority(pid, os3.constants.priority.PRIORITY_BELOW_NORMAL);
+  } catch {
+  }
+}
 function spawnAsync(file2, args, options = {}) {
+  const { lowPriority, ...spawnOptions } = options;
   return new Promise((resolve, reject) => {
-    const child = spawn(file2, args, { stdio: "ignore", windowsHide: true, ...options });
+    const child = spawn(file2, args, { stdio: "ignore", windowsHide: true, ...spawnOptions });
+    if (lowPriority) lowerPriority(child.pid);
     child.once("error", reject);
     child.once("close", (code) => resolve(code ?? -1));
   });
@@ -28158,13 +28169,16 @@ function extractArchive(archive, destination, members2 = []) {
 }
 async function extract(archive, destination, members2) {
   fs8.mkdirSync(destination, { recursive: true });
-  let status = await spawnAsync(SYSTEM.tar(), ["-xf", archive, "-C", destination, ...members2]);
+  let status = await spawnAsync(SYSTEM.tar(), ["-xf", archive, "-C", destination, ...members2], {
+    lowPriority: true
+  });
   if (status !== 0 && /\.(zip|nupkg)$/i.test(archive)) {
     const zip = archive.endsWith(".zip") ? archive : archive + ".zip";
     if (zip !== archive) fs8.copyFileSync(archive, zip);
     status = await spawnAsync(
       SYSTEM.powershell(),
-      scriptArgs("expand-archive.ps1", ["-Archive", zip, "-Destination", destination])
+      scriptArgs("expand-archive.ps1", ["-Archive", zip, "-Destination", destination]),
+      { lowPriority: true }
     );
   }
   if (status !== 0) throw new Error("Could not extract " + archive);
@@ -28381,13 +28395,15 @@ function logLines(stream) {
   stream.on("end", () => logOutput(partial2));
 }
 async function execAsync(file2, args, options = {}) {
+  const { lowPriority, ...spawnOptions } = options;
   const code = captureOutput() ? await new Promise((resolve, reject) => {
-    const child = spawn2(file2, args, { stdio: ["inherit", "pipe", "pipe"], windowsHide: true, ...options });
+    const child = spawn2(file2, args, { stdio: ["inherit", "pipe", "pipe"], windowsHide: true, ...spawnOptions });
+    if (lowPriority) lowerPriority(child.pid);
     logLines(child.stdout);
     logLines(child.stderr);
     child.once("error", reject);
     child.once("close", (c) => resolve(c ?? -1));
-  }) : await spawnAsync(file2, args, { stdio: "inherit", ...options });
+  }) : await spawnAsync(file2, args, { stdio: "inherit", ...spawnOptions, ...lowPriority ? { lowPriority } : {} });
   if (code !== 0)
     throw new Error(path11.basename(file2) + " " + args.slice(0, 3).join(" ") + " failed with exit code " + code);
 }
@@ -28416,7 +28432,7 @@ function runScript(name, args = []) {
     throw new Error(name + " failed with exit code " + result.status + (errors ? ": " + errors.slice(0, 400) : ""));
 }
 function runScriptWithJson(name, param, data, args = []) {
-  const dir = fs10.mkdtempSync(path11.join(os3.tmpdir(), "sbx-"));
+  const dir = fs10.mkdtempSync(path11.join(os4.tmpdir(), "sbx-"));
   const file2 = path11.join(dir, "input.json");
   try {
     fs10.writeFileSync(file2, JSON.stringify(data), "utf8");
@@ -28492,9 +28508,6 @@ async function setupUv(env) {
   env.prepend.push(mkdirp(tool("uv-bin")));
 }
 
-// src/guest/runtime/pools.ts
-import os4 from "node:os";
-
 // src/shared/concurrency/limiter.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 var held = new AsyncLocalStorage2();
@@ -28554,14 +28567,13 @@ var Limiter = class {
 };
 
 // src/shared/concurrency/pools.ts
-var net = new Limiter(4, "net");
+var net = new Limiter(3, "net");
 var heavy = new Limiter(2, "heavy");
 var installer = new Limiter(1, "installer");
 
 // src/guest/runtime/pools.ts
-var BELOW_NORMAL = os4.constants.priority.PRIORITY_BELOW_NORMAL;
 function execHeavy(file2, args, options = {}) {
-  return heavy.run(() => execAsync(file2, args, options));
+  return heavy.run(() => execAsync(file2, args, { ...options, lowPriority: true }));
 }
 
 // src/guest/runtime/session.ts