windows-development-sandbox 1.27.0 → 1.27.3

package/dist/selftest/service-accounts.test.js

@@ -18,9 +18,10 @@ import { clearSecrets, SecretStore } from '../host/secrets/index.js';
 import { applyServiceAccounts, readDelivered } from '../guest/accounts/apply.js';
 import { AccountWatch } from '../guest/accounts/watch.js';
 import { epicAdapter } from '../guest/accounts/kinds/epic.js';
-import { epicSettingsFile, fingerprint, readEpicLogin, SERVICE_KINDS, SERVICE_SPECS, serviceWanted, withEpicLogin, } from '../shared/accounts/index.js';
+import { epicSettingsFile, epicSettingsFiles, fingerprint, readEpicLogin, SERVICE_KINDS, serviceWanted, withEpicLogin, } from '../shared/accounts/index.js';
 import { RunDir } from '../shared/channel/index.js';
 import { decodeText, encodeText, readBoundedFile } from '../shared/io/index.js';
+import { isKindReady } from '../shared/readiness.js';
 const SIGN_IN = 'PlantedEpicSignIn' + 'AbCdEf0123456789+/'.repeat(6) + '==';
 const RENEWED = 'PlantedRenewed' + 'ZyXw9876543210'.repeat(6);
 const CFX = 'cfxk_PlantedServerKey_0123456789';
@@ -141,6 +142,22 @@ export const serviceAccountsSuite = {
         signIns.remove('epic');
         const first = deliver();
         t.check(!first.payloads.epic && first.leased.includes('epic') && launchLeases.holder('epic')?.launchId === 'L-boot', 'nothing saved yet: the lease is claimed anyway, so a first sign-in made there can come back');
+        const pcLocal = t.dir('svc-pc-local');
+        for (const file of epicSettingsFiles(pcLocal)) {
+            fs.mkdirSync(path.dirname(file), { recursive: true });
+            fs.writeFileSync(file, INI);
+        }
+        const thisPc = { localAppData: pcLocal, appData: t.dir('svc-pc-roaming'), programData: t.dir('svc-pc-data') };
+        signIns.remove('epic');
+        const fromPc = deliver({ pc: thisPc });
+        t.check(fromPc.payloads.epic?.data === SIGN_IN && signIns.info('epic')?.source === 'pc', "shared with nothing saved: this PC's own sign-in is taken and saved, as import would");
+        for (const file of epicSettingsFiles(pcLocal))
+            fs.writeFileSync(file, INI.replace(SIGN_IN, RENEWED));
+        t.check(deliver({ pc: thisPc }).payloads.epic?.data === RENEWED && signIns.read('epic')?.data === RENEWED, "one taken from this PC follows it: the PC's renewed sign-in replaces the stale copy");
+        signIns.save('epic', { data: SIGN_IN }, 'sandbox');
+        t.check(deliver({ pc: thisPc }).payloads.epic?.data === SIGN_IN && signIns.info('epic')?.source === 'sandbox', 'one a sandbox handed back is newer than the PC’s and is kept');
+        signIns.remove('epic');
+        t.check(!deliver().payloads.epic, 'without this PC (pc left out) nothing is taken');
         const sharedRun = await f.run({}, config);
         const launched = generateSandbox({
             packageRoot: t.packageRoot,
@@ -314,8 +331,77 @@ export const serviceAccountsSuite = {
         t.section('the accounts page');
         const row = serviceRow('epic', { ...config, accounts: { ...config.accounts, epic: { share: true } } }, signIns, launchLeases);
         const lines = pageLines(servicePage(row)).join('\n');
-        t.check(lines.includes('Epic Games') && lines.includes(SERVICE_SPECS.epic.warnings[1]) && !lines.includes(SIGN_IN), 'a service shows its state and its warnings, never the sign-in');
+        t.check(lines.includes('Epic Games') &&
+            servicePage(row).sections[0].facts?.some((f) => f.description === 'The agent can use it.') === true &&
+            !lines.includes(SIGN_IN), 'a service shows its state and one short warning, never the sign-in');
         t.check(Object.values(accountsView.queries).some((q) => q.id === 'accounts.services') &&
             ['accounts.service.import', 'accounts.service.login', 'accounts.service.logout', 'settings.set'].every((id) => accountsView.operations.some((o) => o.id === id)), 'the accounts view offers the services and their actions on every surface');
+        t.section('every action a service page shows works from the menu');
+        const shareOn = { ...config, accounts: { ...config.accounts, perplexity: { share: true } } };
+        const pcFound = { localAppData: t.dir('svc-pc-found'), appData: '', programData: '', env: {} };
+        t.write(epicSettingsFile(pcFound.localAppData), INI);
+        const pcNone = { localAppData: t.dir('svc-pc-none'), appData: '', programData: '', env: {} };
+        const pageStore = new ServiceAccountStore(t.dir('svc-page'), SecretStore.memory());
+        const pageLeases = new AccountLeases(t.dir('svc-page-leases'));
+        const rowOn = (kind, pc, c = config) => serviceRow(kind, c, pageStore, pageLeases, pc);
+        const labelsOf = (row) => servicePage(row).sections[0].actions.map((a) => a.label);
+        const descriptionsOf = (r) => (servicePage(r).sections[0].facts ?? []).map((f) => ' ' + (f.description ?? '')).join('');
+        const epicFound = rowOn('epic', pcFound);
+        const epicText = pageLines(servicePage(epicFound)).join('\n') + descriptionsOf(epicFound);
+        t.check(epicFound.onPc === true &&
+            /On this PC\s+found/.test(epicText) &&
+            epicText.includes("takes this PC's") &&
+            !epicText.includes(SIGN_IN), 'a kind that comes from this PC says it is found there (never the sign-in), and what sharing does');
+        t.check(rowOn('epic', pcNone).onPc === false &&
+            /On this PC\s+not found/.test(pageLines(servicePage(rowOn('epic', pcNone))).join('\n')), 'and says not found when this PC has none');
+        t.check(labelsOf(epicFound).includes("Take this PC's sign-in") &&
+            !labelsOf(epicFound).some((l) => l.startsWith('Import…')), 'taking it from this PC has a plain name');
+        const perplexityLabels = labelsOf(rowOn('perplexity', pcFound, shareOn));
+        t.check(perplexityLabels.includes("Take this PC's sign-in") &&
+            perplexityLabels.includes('Import from a file…') &&
+            perplexityLabels.includes('Type the sign-in…'), 'the API key can be taken from this PC, read from a file or typed');
+        const cometRow = rowOn('comet', pcFound);
+        const cometText = pageLines(servicePage(cometRow)).join('\n') + descriptionsOf(cometRow);
+        t.check(cometRow.onPc === null &&
+            cometRow.sandboxOnly &&
+            labelsOf(cometRow).every((l) => l === 'Share with sandboxes') &&
+            cometText.includes('Sign in once inside a sandbox; it is kept for the next ones.'), 'Comet offers only sharing and says plainly to sign in once inside a sandbox');
+        // Every action a page shows is one its kind can do (import: a PC or file way; sign in: a typed way).
+        for (const kind of SERVICE_KINDS.filter(isKindReady)) {
+            const r = rowOn(kind, pcFound);
+            for (const a of servicePage(r).sections[0].actions ?? []) {
+                if (a.kind !== 'operation')
+                    continue;
+                const src = HOST_SOURCES[kind];
+                const ok = a.op === 'accounts.service.import'
+                    ? Boolean(src.fromPc || src.fromFile)
+                    : a.op === 'accounts.service.login'
+                        ? Boolean(src.fromAnswers)
+                        : ['accounts.service.logout', 'settings.set'].includes(a.op);
+                t.check(ok, kind + ': "' + a.label + '" is something this kind can do');
+            }
+        }
+        // The paths themselves, through the menu's questions (fakeIO): a file, typed, forgotten.
+        const envFile = t.write(t.at('svc-page', 'keys.env'), 'PERPLEXITY_API_KEY=pplx-PlantedKey0123456789\n');
+        const fileIO = fakeIO([envFile, true]);
+        const fromFile = await importServiceFlow(fileIO.io, 'perplexity', undefined, { store: pageStore, pc: pcNone, share: true }, true);
+        t.check(pageStore.info('perplexity')?.source === 'file' &&
+            fileIO.seen.questions[0].kind === 'path' &&
+            !fromFile.message.includes('PlantedKey'), 'Import from a file asks for the file even when this PC could give one, and saves it');
+        await logoutServiceFlow(fakeIO([true]).io, 'perplexity', t.dir('svc-page-root'), pageStore, pageLeases);
+        const pcWithKey = { ...pcNone, env: { PERPLEXITY_API_KEY: 'pplx-FromThisPc0123456789' } };
+        const keyRow = rowOn('perplexity', pcWithKey);
+        t.check(keyRow.onPc === true, 'the API key in this terminal is found on this PC');
+        await importServiceFlow(fakeIO([true]).io, 'perplexity', undefined, {
+            store: pageStore,
+            pc: pcWithKey,
+            share: true,
+        });
+        t.check(pageStore.info('perplexity')?.source === 'pc', "Take this PC's sign-in saves the PC's key");
+        await loginServiceFlow(fakeIO(['pplx-Typed0123456789']).io, 'perplexity', { store: pageStore, share: true });
+        t.check(pageStore.info('perplexity')?.source === 'typed', 'Type the sign-in saves what was typed');
+        const savedRow = rowOn('perplexity', pcWithKey);
+        t.check(labelsOf(savedRow).includes('Forget…') && savedRow.state === 'saved', 'a saved sign-in offers Forget');
+        await t.throws(() => importServiceFlow(fakeIO([true]).io, 'comet', undefined, { store: pageStore, pc: pcWithKey, share: true }), 'inside a sandbox', 'Comet has nothing to import: the error says to sign in inside a sandbox');
     },
 };

package/dist/selftest/ui-text.test.js

@@ -104,6 +104,10 @@ function serviceRow(over) {
         canImport: true,
         canLogin: true,
         needsFile: false,
+        fromPc: false,
+        hasFileSource: false,
+        onPc: null,
+        sandboxOnly: false,
         ready: true,
         ...over,
     };

package/dist/shared/accounts/kinds.js

@@ -55,7 +55,7 @@ export const SERVICE_SPECS = {
     },
     steam: {
         kind: 'steam',
-        label: 'Steam (SteamCMD)',
+        label: 'Steam',
         usedBy: ['steam'],
         sources: ['file', 'sandbox'],
         singleHolder: true,
@@ -91,7 +91,7 @@ export const SERVICE_SPECS = {
     },
     cfx: {
         kind: 'cfx',
-        label: 'Cfx.re (FiveM / RedM server key)',
+        label: 'FiveM key',
         usedBy: ['fivem'],
         sources: ['typed', 'file'],
         singleHolder: false,
@@ -120,7 +120,7 @@ export const SERVICE_SPECS = {
     },
     keystore: {
         kind: 'keystore',
-        label: 'Android upload keystore',
+        label: 'Android keystore',
         usedBy: ['android'],
         sources: ['file'],
         singleHolder: false,
@@ -135,7 +135,7 @@ export const SERVICE_SPECS = {
     },
     play: {
         kind: 'play',
-        label: 'Google Play (service account)',
+        label: 'Google Play',
         usedBy: ['android'],
         sources: ['file'],
         singleHolder: false,
@@ -146,7 +146,7 @@ export const SERVICE_SPECS = {
     },
     expo: {
         kind: 'expo',
-        label: 'Expo (EAS)',
+        label: 'Expo',
         usedBy: ['reactNative'],
         sources: ['typed'],
         singleHolder: false,
@@ -157,7 +157,7 @@ export const SERVICE_SPECS = {
     },
     appstore: {
         kind: 'appstore',
-        label: 'App Store Connect API key',
+        label: 'App Store Connect',
         usedBy: ['reactNative', 'flutter'],
         sources: ['file', 'typed'],
         singleHolder: false,
@@ -171,7 +171,7 @@ export const SERVICE_SPECS = {
     },
     perplexity: {
         kind: 'perplexity',
-        label: 'Perplexity API key',
+        label: 'Perplexity API',
         usedBy: ['perplexity'],
         sources: ['pc', 'file', 'typed'],
         singleHolder: false,
@@ -195,7 +195,7 @@ export const SERVICE_SPECS = {
     },
     comet: {
         kind: 'comet',
-        label: 'Comet (Perplexity browser)',
+        label: 'Comet',
         usedBy: ['comet'],
         sources: ['sandbox'],
         singleHolder: false,
@@ -212,7 +212,7 @@ export const SERVICE_SPECS = {
     },
     perplexityapp: {
         kind: 'perplexityapp',
-        label: 'Perplexity desktop app',
+        label: 'Perplexity app',
         usedBy: ['perplexityapp'],
         sources: ['sandbox'],
         singleHolder: false,

package/dist/shared/apps/catalogue-gamedev.js

@@ -49,6 +49,7 @@ export const GAMEDEV_APPS = [
         size: '100 MB',
         source: { github: 'f3d-app/f3d', asset: '^F3D-[\\d.]+-Windows-x86_64\\.zip$' },
         exe: 'f3d.exe',
+        onPath: true,
         needs: ['mesa'],
     },
     {

package/dist/shared/apps/catalogue.d.ts

@@ -73,6 +73,8 @@ export interface AppEntry {
     exe: string;
     /** A command-line tool: its folder goes on PATH (no desktop shortcut). */
     cli?: boolean;
+    /** A desktop program an agent also runs by name (F3D renders previews): its folder goes on PATH, shortcut kept. */
+    onPath?: boolean;
     /** Needs these first: 7-Zip to unpack an installer, Mesa for OpenGL without a GPU. */
     needs?: ('7zip' | 'mesa')[];
     /**

package/dist/shared/concurrency/pools.js

@@ -2,7 +2,7 @@
 // them to the downloader and extractor (guest/runtime/pools.ts installPools).
 import { Limiter } from './limiter.js';
 /** HTTP bodies. */
-export const net = new Limiter(4, 'net');
+export const net = new Limiter(3, 'net');
 /** extractArchive, 7-Zip/NSIS unpack, npm ci/install, uv/pip, Steam, robocopy of big layouts, rustup/cargo. */
 export const heavy = new Limiter(2, 'heavy');
 /** Every msiexec, vcredist, DXSETUP and the Visual Studio bootstrapper: Windows runs one install at a time. */

package/dist/shared/download/archive.js

@@ -34,12 +34,14 @@ export function extractArchive(archive, destination, members = []) {
 }
 async function extract(archive, destination, members) {
     fs.mkdirSync(destination, { recursive: true });
-    let status = await spawnAsync(SYSTEM.tar(), ['-xf', archive, '-C', destination, ...members]);
+    let status = await spawnAsync(SYSTEM.tar(), ['-xf', archive, '-C', destination, ...members], {
+        lowPriority: true,
+    });
     if (status !== 0 && /\.(zip|nupkg)$/i.test(archive)) {
         const zip = archive.endsWith('.zip') ? archive : archive + '.zip';
         if (zip !== archive)
             fs.copyFileSync(archive, zip);
-        status = await spawnAsync(SYSTEM.powershell(), scriptArgs('expand-archive.ps1', ['-Archive', zip, '-Destination', destination]));
+        status = await spawnAsync(SYSTEM.powershell(), scriptArgs('expand-archive.ps1', ['-Archive', zip, '-Destination', destination]), { lowPriority: true });
     }
     if (status !== 0)
         throw new Error('Could not extract ' + archive);

package/dist/shared/download/index.d.ts

@@ -2,5 +2,5 @@ export { fetchRetry, fetchJson, fetchText } from './http.js';
 export { fetchBounded, fetchBoundedResponse, type BoundedResponse, type Fetcher, type RequestFetcher, } from './bounded-fetch.js';
 export { stagingFolder, moveIntoPlace, extractArchive, findFile, limitExtraction } from './archive.js';
 export { type ArchiveOptions, type Checksums, type DownloadWatcher, Downloader, downloader } from './downloader.js';
-export { spawnAsync } from './spawn.js';
+export { spawnAsync, lowerPriority, type SpawnAsyncOptions } from './spawn.js';
 export { type ReleaseAsset, githubAsset, parseReleasePage, latestGithubTag, parseReleaseTags } from './github.js';

package/dist/shared/download/index.js

@@ -2,5 +2,5 @@ export { fetchRetry, fetchJson, fetchText } from './http.js';
 export { fetchBounded, fetchBoundedResponse, } from './bounded-fetch.js';
 export { stagingFolder, moveIntoPlace, extractArchive, findFile, limitExtraction } from './archive.js';
 export { Downloader, downloader } from './downloader.js';
-export { spawnAsync } from './spawn.js';
+export { spawnAsync, lowerPriority } from './spawn.js';
 export { githubAsset, parseReleasePage, latestGithubTag, parseReleaseTags } from './github.js';

package/dist/shared/download/spawn.d.ts

@@ -1,3 +1,9 @@
 import { type SpawnOptions } from 'node:child_process';
+export interface SpawnAsyncOptions extends SpawnOptions {
+    /** Below-normal priority for the program and what it starts: unpacking must not make the desktop sluggish. */
+    readonly lowPriority?: boolean;
+}
+/** Lowers a process to below-normal priority; best effort (it may have ended already). */
+export declare function lowerPriority(pid: number | undefined): void;
 /** Runs a program without blocking the event loop (parallel downloads keep going); resolves with its exit code. */
-export declare function spawnAsync(file: string, args: string[], options?: SpawnOptions): Promise<number>;
+export declare function spawnAsync(file: string, args: string[], options?: SpawnAsyncOptions): Promise<number>;

package/dist/shared/download/spawn.js

@@ -1,8 +1,23 @@
+import os from 'node:os';
 import { spawn } from 'node:child_process';
+/** Lowers a process to below-normal priority; best effort (it may have ended already). */
+export function lowerPriority(pid) {
+    if (pid === undefined)
+        return;
+    try {
+        os.setPriority(pid, os.constants.priority.PRIORITY_BELOW_NORMAL);
+    }
+    catch {
+        /* a normal priority only makes it a little slower to share the machine */
+    }
+}
 /** Runs a program without blocking the event loop (parallel downloads keep going); resolves with its exit code. */
 export function spawnAsync(file, args, options = {}) {
+    const { lowPriority, ...spawnOptions } = options;
     return new Promise((resolve, reject) => {
-        const child = spawn(file, args, { stdio: 'ignore', windowsHide: true, ...options });
+        const child = spawn(file, args, { stdio: 'ignore', windowsHide: true, ...spawnOptions });
+        if (lowPriority)
+            lowerPriority(child.pid);
         child.once('error', reject);
         child.once('close', (code) => resolve(code ?? -1));
     });

package/dist/shared/paths/pc-installs.d.ts

@@ -22,6 +22,14 @@ export interface PcInstall {
         readonly artifactId: string;
         readonly appVersion: string;
     };
+    /**
+     * The launcher's manifest of an engine (its Data\Manifests\<name>.item on this PC): without one the sandbox's
+     * launcher drops the engine from its library. Its paths name the sandbox's folder by the time it is in session.json.
+     */
+    readonly launcherItem?: {
+        readonly name: string;
+        readonly text: string;
+    };
 }
 /** What session.json says about them: no host paths. */
 export interface PcInstallManifest {

package/dist/shared/unreal/launcher-files.d.ts

@@ -71,6 +71,13 @@ export declare function itemInfo(text: string): {
 export declare function incompleteDirs(...manifestDirs: string[]): Set<string>;
 /** The sizes the saved manifests give their engine folders (lower-case folder -> bytes). */
 export declare function itemSizes(saved: string): Map<string, number>;
+/** A launcher manifest's file name (<hex id>.item). */
+export declare const ITEM_NAME: RegExp;
+/**
+ * A launcher manifest moved from folder `from` to `to`: every path in it under `from` (either slash) is under `to`, and
+ * a path elsewhere is dropped (it would only name this PC). Null when the text is not a manifest of `from`.
+ */
+export declare function relocateItem(text: string, from: string, to: string): string | null;
 /** Whether the text is a launcher manifest of an app installed under `root`. */
 export declare function isItemUnder(text: string, root: string): boolean;
 /** Copies the launcher's manifests of apps under `root` into `saved` (changed ones only). Returns the file names. */

package/dist/shared/unreal/launcher-files.js

@@ -191,6 +191,37 @@ export function itemSizes(saved) {
     }
     return sizes;
 }
+/** A launcher manifest's file name (<hex id>.item). */
+export const ITEM_NAME = /^[A-Za-z0-9_-]{1,80}\.item$/;
+/**
+ * A launcher manifest moved from folder `from` to `to`: every path in it under `from` (either slash) is under `to`, and
+ * a path elsewhere is dropped (it would only name this PC). Null when the text is not a manifest of `from`.
+ */
+export function relocateItem(text, from, to) {
+    let item;
+    try {
+        item = JSON.parse(stripBom(text));
+    }
+    catch {
+        return null; // Not JSON: not a manifest.
+    }
+    if (!item || typeof item !== 'object' || Array.isArray(item))
+        return null;
+    const base = win.resolve(from).toLowerCase();
+    const out = {};
+    for (const [key, value] of Object.entries(item)) {
+        if (typeof value !== 'string' || !win.isAbsolute(value)) {
+            out[key] = value;
+            continue;
+        }
+        const full = win.resolve(value);
+        const low = full.toLowerCase();
+        if (low === base || low.startsWith(base + '\\'))
+            out[key] = to + full.slice(base.length);
+    }
+    const at = typeof out.InstallLocation === 'string' ? out.InstallLocation : '';
+    return at.toLowerCase() === to.toLowerCase() ? JSON.stringify(out, null, '\t') : null;
+}
 /** Whether the text is a launcher manifest of an app installed under `root`. */
 export function isItemUnder(text, root) {
     const at = itemInstallLocation(text);
@@ -198,7 +229,7 @@ export function isItemUnder(text, root) {
 }
 function itemFiles(dir) {
     try {
-        return fs.readdirSync(dir).filter((f) => /^[A-Za-z0-9_-]{1,80}\.item$/.test(f));
+        return fs.readdirSync(dir).filter((f) => ITEM_NAME.test(f));
     }
     catch {
         return [];

package/dist/shared/unreal/status.d.ts

@@ -28,6 +28,7 @@ export declare const UnrealStatusSchema: z.ZodObject<{
     }, z.core.$strip>>;
     launcher: z.ZodObject<{
         installed: z.ZodBoolean;
+        exe: z.ZodDefault<z.ZodNullable<z.ZodString>>;
         installLocation: z.ZodNullable<z.ZodString>;
         problem: z.ZodNullable<z.ZodString>;
         freeBytes: z.ZodNullable<z.ZodNumber>;

package/dist/shared/unreal/status.js

@@ -30,6 +30,8 @@ export const UnrealStatusSchema = z.object({
         .max(64),
     launcher: z.object({
         installed: z.boolean(),
+        /** Its program (Program Files or Program Files (x86), by launcher version); null when there is none. */
+        exe: Text().nullable().default(null),
         /** Where the launcher installs engines; null when it could not be set. */
         installLocation: Text().nullable(),
         /** Why engines would not go to the data disk (shown loudly), null when they do. */

package/dist/web/index.html

@@ -6,7 +6,7 @@
     <title>Sandbox</title>
     <link rel="icon" href="data:," />
     <link rel="stylesheet" href="/main-XT7T6ODM.css" />
-    <script type="module" src="/main-VPMYTSUL.js"></script>
+    <script type="module" src="/main-NKM7ECSB.js"></script>
   </head>
   <body>
     <div id="root"></div>