windows-development-sandbox 1.27.1 → 1.28.0

package/dist/bin/{chunk-RSIX7C6D.js → chunk-CB44HTTN.js}

@@ -22806,10 +22806,10 @@ var esm_default2 = createPrompt((config3, done) => {
     const answer = theme.style.answer(theme.style.renderSelectedChoices(selection, items));
     return [prefix, message, answer].filter(Boolean).join(" ");
   }
-  let helpLine;
+  let helpLine2;
   if (theme.helpMode !== "never" && instructions !== false) {
     if (typeof instructions === "string") {
-      helpLine = instructions;
+      helpLine2 = instructions;
     } else {
       const keys = [
         ["\u2191\u2193", "navigate"],
@@ -22820,7 +22820,7 @@ var esm_default2 = createPrompt((config3, done) => {
       if (shortcuts.invert)
         keys.push([shortcuts.invert, "invert"]);
       keys.push(["\u23CE", "submit"]);
-      helpLine = theme.style.keysHelpTip(keys);
+      helpLine2 = theme.style.keysHelpTip(keys);
     }
   }
   const lines = [
@@ -22829,7 +22829,7 @@ var esm_default2 = createPrompt((config3, done) => {
     " ",
     description ? theme.style.description(description) : "",
     errorMsg ? theme.style.error(errorMsg) : "",
-    helpLine
+    helpLine2
   ].filter(Boolean).join("\n").trimEnd();
   return `${lines}${cursorHide}`;
 });
@@ -23687,13 +23687,13 @@ var esm_default10 = createPrompt((config3, done) => {
     }
   });
   const message = theme.style.message(config3.message, status);
-  let helpLine;
+  let helpLine2;
   if (theme.helpMode !== "never") {
     if (config3.instructions) {
       const { pager, navigation } = config3.instructions;
-      helpLine = theme.style.help(searchResults.length > pageSize ? pager : navigation);
+      helpLine2 = theme.style.help(searchResults.length > pageSize ? pager : navigation);
     } else {
-      helpLine = theme.style.keysHelpTip([
+      helpLine2 = theme.style.keysHelpTip([
         ["\u2191\u2193", "navigate"],
         ["\u23CE", "select"]
       ]);
@@ -23735,7 +23735,7 @@ var esm_default10 = createPrompt((config3, done) => {
     error62 ?? page,
     " ",
     description ? theme.style.description(description) : "",
-    helpLine
+    helpLine2
   ].filter(Boolean).join("\n").trimEnd();
   return [header, body];
 });
@@ -23857,13 +23857,13 @@ var esm_default11 = createPrompt((config3, done) => {
     clearTimeout(searchTimeoutRef.current);
   }, []);
   const message = theme.style.message(config3.message, status);
-  let helpLine;
+  let helpLine2;
   if (theme.helpMode !== "never") {
     if (config3.instructions) {
       const { pager, navigation } = config3.instructions;
-      helpLine = theme.style.help(items.length > pageSize ? pager : navigation);
+      helpLine2 = theme.style.help(items.length > pageSize ? pager : navigation);
     } else {
-      helpLine = theme.style.keysHelpTip([
+      helpLine2 = theme.style.keysHelpTip([
         ["\u2191\u2193", "navigate"],
         ["\u23CE", "select"]
       ]);
@@ -23899,7 +23899,7 @@ var esm_default11 = createPrompt((config3, done) => {
     page,
     " ",
     description ? theme.style.description(description) : "",
-    helpLine
+    helpLine2
   ].filter(Boolean).join("\n").trimEnd();
   return `${lines}${cursorHide}`;
 });
@@ -46223,7 +46223,7 @@ var SandboxSchema = external_exports.strictObject({
     'The last resort that keeps the sandbox up, in MB below its commit limit (RAM plus paging file): builds are slowed down long before (sandbox.pressureResponse); only if everything the agents start together would take the sandbox to the very edge of its memory, where Windows inside it would start failing, is a build refused memory instead of Windows. "auto" = the larger of 1536 MB and 3 % of the commit limit; "none" = no backstop. Yours only: a project file cannot change it.'
   ),
   pressureResponse: external_exports.boolean().describe(
-    "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. Yours only: a project file cannot change it."
+    "When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. A memory gate also holds new compilers and linkers for a moment when the memory of the build programs grows faster than 4 GB in 3 seconds (3 GB with vGPU), and lets them go one at a time. Yours only: a project file cannot change it."
   ),
   vGpu: external_exports.boolean().describe(
     "Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it). Browsers in the sandbox never use it (they draw in software)."
@@ -46814,6 +46814,7 @@ var GAMEDEV_APPS = [
     size: "100 MB",
     source: { github: "f3d-app/f3d", asset: "^F3D-[\\d.]+-Windows-x86_64\\.zip$" },
     exe: "f3d.exe",
+    onPath: true,
     needs: ["mesa"]
   },
   {
@@ -47961,7 +47962,7 @@ var SERVICE_SPECS = {
   },
   steam: {
     kind: "steam",
-    label: "Steam (SteamCMD)",
+    label: "Steam",
     usedBy: ["steam"],
     sources: ["file", "sandbox"],
     singleHolder: true,
@@ -47997,7 +47998,7 @@ var SERVICE_SPECS = {
   },
   cfx: {
     kind: "cfx",
-    label: "Cfx.re (FiveM / RedM server key)",
+    label: "FiveM key",
     usedBy: ["fivem"],
     sources: ["typed", "file"],
     singleHolder: false,
@@ -48026,7 +48027,7 @@ var SERVICE_SPECS = {
   },
   keystore: {
     kind: "keystore",
-    label: "Android upload keystore",
+    label: "Android keystore",
     usedBy: ["android"],
     sources: ["file"],
     singleHolder: false,
@@ -48041,7 +48042,7 @@ var SERVICE_SPECS = {
   },
   play: {
     kind: "play",
-    label: "Google Play (service account)",
+    label: "Google Play",
     usedBy: ["android"],
     sources: ["file"],
     singleHolder: false,
@@ -48052,7 +48053,7 @@ var SERVICE_SPECS = {
   },
   expo: {
     kind: "expo",
-    label: "Expo (EAS)",
+    label: "Expo",
     usedBy: ["reactNative"],
     sources: ["typed"],
     singleHolder: false,
@@ -48063,7 +48064,7 @@ var SERVICE_SPECS = {
   },
   appstore: {
     kind: "appstore",
-    label: "App Store Connect API key",
+    label: "App Store Connect",
     usedBy: ["reactNative", "flutter"],
     sources: ["file", "typed"],
     singleHolder: false,
@@ -48077,7 +48078,7 @@ var SERVICE_SPECS = {
   },
   perplexity: {
     kind: "perplexity",
-    label: "Perplexity API key",
+    label: "Perplexity API",
     usedBy: ["perplexity"],
     sources: ["pc", "file", "typed"],
     singleHolder: false,
@@ -48101,7 +48102,7 @@ var SERVICE_SPECS = {
   },
   comet: {
     kind: "comet",
-    label: "Comet (Perplexity browser)",
+    label: "Comet",
     usedBy: ["comet"],
     sources: ["sandbox"],
     singleHolder: false,
@@ -48117,7 +48118,7 @@ var SERVICE_SPECS = {
   },
   perplexityapp: {
     kind: "perplexityapp",
-    label: "Perplexity desktop app",
+    label: "Perplexity app",
     usedBy: ["perplexityapp"],
     sources: ["sandbox"],
     singleHolder: false,
@@ -48940,6 +48941,8 @@ var PressureStatusSchema = external_exports.object({
   lowered: external_exports.number().int().min(0).max(1024),
   /** Compilers waiting their turn right now (name, process id, seconds until they may go on). */
   paused: external_exports.array(external_exports.object({ name: Text(64), pid: external_exports.number().int(), seconds: external_exports.number().int().min(0).max(60) })).max(8),
+  /** Build programs the memory gate holds right now (let go one at a time). */
+  held: external_exports.number().int().min(0).max(1024).optional(),
   /** The CPU share the compilers get together (percent; 100 = no cap). */
   cpuPercent: external_exports.number().int().min(0).max(100).optional(),
   /** The PC itself asked for slowing down (its memory or CPU is low). */
@@ -48960,6 +48963,8 @@ var HeartbeatSchema = external_exports.object({
   topProcesses: external_exports.array(external_exports.object({ name: Text(64), privateMb: external_exports.number().int().min(0).max(1e7) })).max(5),
   /** The disk queue this PC last reported while asking the sandbox to slow down. */
   diskQueueReported: external_exports.number().min(0).max(1e5).optional(),
+  /** Build programs the memory gate holds right now (let go one at a time). */
+  held: external_exports.number().int().min(0).max(1024).optional(),
   /** "ending": the sandbox is shutting down in order (idle shutdown, sandbox stop, Windows shutting down). */
   phase: external_exports.enum(["ready", "working", "ending"])
 });
@@ -53742,7 +53747,7 @@ var clock = (iso) => {
 };
 function heartbeatLine(hb) {
   const top = hb.topProcesses.map((p) => safeText(p.name) + " " + p.privateMb + " MB").join(", ");
-  return "last seen inside at " + clock(hb.at) + ": up " + Math.round(hb.uptimeS / 60) + " min, " + hb.ramFreePct + "% RAM free, " + hb.commitPct + "% commit used, builds at step " + hb.step + (hb.hostStep > 0 ? " (this PC asked for step " + hb.hostStep + ")" : "") + (hb.diskQueueReported !== void 0 ? ", this PC disk queue " + hb.diskQueueReported : "") + (top ? "; biggest: " + top : "");
+  return "last seen inside at " + clock(hb.at) + ": up " + Math.round(hb.uptimeS / 60) + " min, " + hb.ramFreePct + "% RAM free, " + hb.commitPct + "% commit used, builds at step " + hb.step + (hb.hostStep > 0 ? " (this PC asked for step " + hb.hostStep + ")" : "") + (hb.diskQueueReported !== void 0 ? ", this PC disk queue " + hb.diskQueueReported : "") + (hb.held ? ", " + hb.held + " builds held by the memory gate" : "") + (top ? "; biggest: " + top : "");
 }
 function guessReason(hb) {
   if (hb && hb.diskQueueReported !== void 0 && hb.hostStep > 0)
@@ -53816,7 +53821,12 @@ function findingLines(events) {
     );
   if (has2((e) => lower(e).startsWith("hyper-v")))
     lines.push("Hyper-V events: the sandbox's virtual machine (or the service that runs it) reported a problem.");
-  if (has2((e) => /^(application error|windows error reporting)$/i.test(e.provider)))
+  const isAppCrash = (e) => /^(application error|windows error reporting)$/i.test(e.provider);
+  if (has2((e) => isAppCrash(e) && /vmwp\.exe/i.test(e.process)))
+    lines.push(
+      "vmwp.exe, the Windows program that runs the sandbox's VM, crashed. That is a fault in Windows' Hyper-V code or a driver it uses (with vGPU on, usually the graphics driver), not a program inside the sandbox running out of memory."
+    );
+  else if (has2(isAppCrash))
     lines.push("A crash report names vmwp.exe or vmmem, the programs that hold the sandbox's VM.");
   return lines;
 }
@@ -53866,6 +53876,17 @@ function hostMemoryTail(storageRoot, dataPath) {
     return "";
   }
 }
+function memoryWasFineLine(hostMemoryLog) {
+  const last = hostMemoryLog.split(/\r?\n/).filter((l) => l.trim() !== "").pop();
+  if (!last) return null;
+  const ram = /RAM free\/total MB (\d{1,9})\/(\d{1,9})/.exec(last);
+  const commit = /commit free\/limit MB (\d{1,9})\/(\d{1,9})/.exec(last);
+  if (!ram || !commit) return null;
+  const freeRam = Number(ram[1]);
+  const freeCommit = Number(commit[1]);
+  if (freeRam < 4096 || freeCommit < 4096) return null;
+  return "This PC still had " + Math.floor(freeRam / 1024) + " GB of RAM and " + Math.floor(freeCommit / 1024) + " GB of memory (RAM plus paging file) free just before, so it did not run out of memory.";
+}
 function crashReportText(cause, events, memoryLog, lastSeen, extra = {}) {
   const seen = /* @__PURE__ */ new Set();
   const unique = events.filter((e) => {
@@ -53881,6 +53902,7 @@ function crashReportText(cause, events, memoryLog, lastSeen, extra = {}) {
   const hostLines = (extra.hostMemoryLog ?? "").split(/\r?\n/).filter(Boolean).slice(-20).map((l) => "  " + safeText(l));
   const freeze = freezeLine(cause, lastSeen);
   const meaning = findingLines(unique);
+  const fine = memoryWasFineLine(extra.hostMemoryLog ?? "");
   const dumps = extra.dumps ?? [];
   const vgpu = extra.vgpu ? ["vGPU was on for this sandbox. " + vgpuWarning("its launch settings"), ""] : [];
   return [
@@ -53894,6 +53916,7 @@ function crashReportText(cause, events, memoryLog, lastSeen, extra = {}) {
     ...vgpu,
     "What that usually means:",
     ...meaning.length ? meaning.map((l) => "  " + l) : ["  (no memory, blue screen or hardware event was logged)"],
+    ...fine ? ["  " + fine] : [],
     "",
     "Crash dumps Windows left (C:\\Windows\\Minidump, MEMORY.DMP):",
     ...dumps.length ? dumps.map((d) => "  " + d.name + "  " + d.at) : ["  (none from that time)"],
@@ -56560,7 +56583,7 @@ function clearLiveRecord(storageRoot, dataPath) {
 import fs71 from "node:fs";
 import path94 from "node:path";
 import crypto14 from "node:crypto";
-import os16 from "node:os";
+import os17 from "node:os";
 
 // src/shared/accounts/fingerprint.ts
 import crypto8 from "node:crypto";
@@ -58861,10 +58884,20 @@ function scriptArgs(name2, args = []) {
 }
 
 // src/shared/download/spawn.ts
+import os14 from "node:os";
 import { spawn as spawn9 } from "node:child_process";
+function lowerPriority(pid) {
+  if (pid === void 0) return;
+  try {
+    os14.setPriority(pid, os14.constants.priority.PRIORITY_BELOW_NORMAL);
+  } catch {
+  }
+}
 function spawnAsync(file2, args, options = {}) {
+  const { lowPriority, ...spawnOptions } = options;
   return new Promise((resolve, reject) => {
-    const child = spawn9(file2, args, { stdio: "ignore", windowsHide: true, ...options });
+    const child = spawn9(file2, args, { stdio: "ignore", windowsHide: true, ...spawnOptions });
+    if (lowPriority) lowerPriority(child.pid);
     child.once("error", reject);
     child.once("close", (code) => resolve(code ?? -1));
   });
@@ -58885,13 +58918,16 @@ function extractArchive(archive, destination, members2 = []) {
 }
 async function extract(archive, destination, members2) {
   fs57.mkdirSync(destination, { recursive: true });
-  let status = await spawnAsync(SYSTEM.tar(), ["-xf", archive, "-C", destination, ...members2]);
+  let status = await spawnAsync(SYSTEM.tar(), ["-xf", archive, "-C", destination, ...members2], {
+    lowPriority: true
+  });
   if (status !== 0 && /\.(zip|nupkg)$/i.test(archive)) {
     const zip = archive.endsWith(".zip") ? archive : archive + ".zip";
     if (zip !== archive) fs57.copyFileSync(archive, zip);
     status = await spawnAsync(
       SYSTEM.powershell(),
-      scriptArgs("expand-archive.ps1", ["-Archive", zip, "-Destination", destination])
+      scriptArgs("expand-archive.ps1", ["-Archive", zip, "-Destination", destination]),
+      { lowPriority: true }
     );
   }
   if (status !== 0) throw new Error("Could not extract " + archive);
@@ -59789,10 +59825,10 @@ function pcHasPwsh(env = process.env, exists2 = fs60.existsSync) {
 
 // src/host/launch/pc-scan.ts
 import fs61 from "node:fs";
-import os14 from "node:os";
+import os15 from "node:os";
 import path84 from "node:path";
 function msvcRust() {
-  const settings = path84.join(process.env.RUSTUP_HOME ?? path84.join(os14.homedir(), ".rustup"), "settings.toml");
+  const settings = path84.join(process.env.RUSTUP_HOME ?? path84.join(os15.homedir(), ".rustup"), "settings.toml");
   try {
     return /default_host_triple\s*=\s*"[^"]*-msvc"/.test(fs61.readFileSync(settings, "utf8").slice(0, 64 * 1024));
   } catch {
@@ -59959,7 +59995,7 @@ function databasePlanner(config3, compose2) {
 import path89 from "node:path";
 
 // src/host/launch/wsb-file.ts
-import os15 from "node:os";
+import os16 from "node:os";
 var GUEST = {
   launch: "C:\\AgentLaunch",
   data: "C:\\AgentData",
@@ -60002,7 +60038,7 @@ function memoryNote(decision) {
   if (decision.limitedBy !== "commit" || decision.withoutCommitMb - decision.mb < 2048) return null;
   return "The sandbox gets " + decision.mb / 1024 + " GB of memory instead of " + decision.withoutCommitMb / 1024 + " GB: this PC has only " + Math.floor((decision.commitAvailableMb ?? 0) / 1024) + " GB of memory (RAM plus paging file) left to hand out, and if it runs out Windows closes the sandbox. A bigger Windows paging file, or closing other programs, gives it more.";
 }
-function resolveMemoryMb(sandbox, freeMemoryBytes = os15.freemem(), totalMemoryBytes = os15.totalmem(), commitAvailableMb = null) {
+function resolveMemoryMb(sandbox, freeMemoryBytes = os16.freemem(), totalMemoryBytes = os16.totalmem(), commitAvailableMb = null) {
   if (sandbox.memoryMb !== "auto") return sandbox.memoryMb;
   const decision = decideMemory(
     sandbox,
@@ -60915,7 +60951,7 @@ function generateSandbox(given, opened) {
     resolveMemoryMb(config3.sandbox, o.freeMemoryBytes, void 0, commitAvailableMb),
     ...others.map((p) => typeof p.config.sandbox.memoryMb === "number" ? p.config.sandbox.memoryMb : 0)
   );
-  const memoryMb = cappedMemoryMb(askedMb, config3.sandbox, Math.floor(os16.totalmem() / 1048576));
+  const memoryMb = cappedMemoryMb(askedMb, config3.sandbox, Math.floor(os17.totalmem() / 1048576));
   const launchId = o.launchId ?? newLaunchId();
   const launchPath = path94.join(storageRoot, "launches", launchId);
   ensureDir(dataPath);
@@ -60988,8 +61024,8 @@ function generateSandbox(given, opened) {
     memoryNote: residentNote(askedMb, memoryMb) ?? (config3.sandbox.memoryMb === "auto" ? memoryNote(
       decideMemory(
         config3.sandbox,
-        Math.floor((o.freeMemoryBytes ?? os16.freemem()) / 1048576),
-        Math.floor(os16.totalmem() / 1048576),
+        Math.floor((o.freeMemoryBytes ?? os17.freemem()) / 1048576),
+        Math.floor(os17.totalmem() / 1048576),
         commitAvailableMb
       )
     ) : null),
@@ -62927,16 +62963,19 @@ function howToSave(spec) {
   if (spec.returns) return "sign in once in this sandbox, or: sandbox account import " + spec.kind;
   return spec.sources.includes("typed") ? "save one: sandbox account login " + spec.kind : "save one: sandbox account import " + spec.kind + " --from <file>";
 }
-function takeFromPc(kind, pc, store) {
+function takeFromPc(kind, pc, store, saved) {
   const source = HOST_SOURCES[kind];
-  if (!pc || !source.fromPc) return null;
+  if (!pc || !source.fromPc) return saved;
+  if (saved && store.info(kind)?.source !== "pc") return saved;
   let payload = null;
   try {
     payload = source.fromPc(pc);
   } catch {
-    return null;
+    return saved;
   }
-  if (payload) store.save(kind, payload, "pc", source.summary(payload));
+  if (!payload) return saved;
+  if (!saved || fingerprint(payload) !== fingerprint(saved))
+    store.save(kind, payload, "pc", source.summary(payload));
   return payload;
 }
 function prepareServiceAccounts(i) {
@@ -62968,7 +63007,7 @@ function prepareServiceAccounts(i) {
       } catch {
         unreadable = true;
       }
-      if (!payload && !unreadable) payload = takeFromPc(kind, i.pc, store);
+      if (!unreadable) payload = takeFromPc(kind, i.pc, store, payload);
       if (spec.singleHolder) {
         const claim2 = leases.claim(kind, dataSet, i.launchId, payload ? fingerprint(payload) : null, i.isRunning);
         if (!claim2.ok) {
@@ -63178,9 +63217,6 @@ async function prepareStorePackages(apps, o) {
   return { notes };
 }
 
-// src/host/pc-installs/epic.ts
-import path117 from "node:path";
-
 // src/shared/unreal/engines.ts
 import path113 from "node:path";
 var win = path113.win32;
@@ -63226,6 +63262,9 @@ var stripBom2 = (text) => text.replace(/^\uFEFF/, "");
 function launcherInstalledFile(programData) {
   return win2.join(programData, "Epic", "UnrealEngineLauncher", "LauncherInstalled.dat");
 }
+function launcherManifestsDir(programData) {
+  return win2.join(programData, "Epic", "EpicGamesLauncher", "Data", "Manifests");
+}
 var EntrySchema = external_exports.looseObject({
   InstallLocation: external_exports.string().max(1024),
   AppName: external_exports.string().max(200),
@@ -63261,6 +63300,41 @@ var ItemSchema = external_exports.looseObject({
   InstallSize: external_exports.number().int().min(0).optional(),
   bIsIncompleteInstall: external_exports.boolean().optional()
 });
+function itemInstallLocation(text) {
+  return itemInfo(text)?.installLocation ?? null;
+}
+function itemInfo(text) {
+  try {
+    const item = ItemSchema.parse(JSON.parse(stripBom2(text)));
+    const at = item.InstallLocation;
+    return at && win2.isAbsolute(at) ? { installLocation: at, sizeBytes: item.InstallSize ?? null } : null;
+  } catch {
+    return null;
+  }
+}
+var ITEM_NAME = /^[A-Za-z0-9_-]{1,80}\.item$/;
+function relocateItem(text, from, to) {
+  let item;
+  try {
+    item = JSON.parse(stripBom2(text));
+  } catch {
+    return null;
+  }
+  if (!item || typeof item !== "object" || Array.isArray(item)) return null;
+  const base = win2.resolve(from).toLowerCase();
+  const out = {};
+  for (const [key3, value] of Object.entries(item)) {
+    if (typeof value !== "string" || !win2.isAbsolute(value)) {
+      out[key3] = value;
+      continue;
+    }
+    const full = win2.resolve(value);
+    const low = full.toLowerCase();
+    if (low === base || low.startsWith(base + "\\")) out[key3] = to + full.slice(base.length);
+  }
+  const at = typeof out.InstallLocation === "string" ? out.InstallLocation : "";
+  return at.toLowerCase() === to.toLowerCase() ? JSON.stringify(out, null, "	") : null;
+}
 
 // src/shared/unreal/status.ts
 var UNREAL_STATUS_FILE = "status.json";
@@ -63404,6 +63478,7 @@ function vaultPacks(vault, fs141) {
 }
 
 // src/host/pc-installs/epic.ts
+import path117 from "node:path";
 var APP = /^[A-Za-z0-9._-]{1,100}$/;
 function findEpicGames(text, wanted) {
   const names = wanted === true ? null : new Set(wanted.map((w) => String(w).toLowerCase()));
@@ -63925,6 +64000,25 @@ var versionOf = (dir, files) => {
   const bytes = files.read(win9.join(dir, "Engine", "Build", "Build.version"), 64 * 1024);
   return bytes ? parseBuildVersion(bytes.toString("utf8")) : null;
 };
+var MAX_ITEM_BYTES2 = 64 * 1024;
+function launcherItemOf(dir, files) {
+  if (!files.manifests) return {};
+  const want = win9.resolve(dir).toLowerCase();
+  for (const name2 of files.list(files.manifests).filter((n) => ITEM_NAME.test(n))) {
+    const bytes = files.read(win9.join(files.manifests, name2), MAX_ITEM_BYTES2);
+    const at = bytes ? itemInstallLocation(bytes.toString("utf8")) : null;
+    if (bytes && at && win9.resolve(at).toLowerCase() === want)
+      return { launcherItem: { name: name2, text: bytes.toString("utf8") } };
+  }
+  return {};
+}
+function launcherIdsOf(dir, files) {
+  const want = win9.resolve(dir).toLowerCase();
+  const entry = (files.launcherInstalled ? launcherInstallations(files.launcherInstalled) : []).find(
+    (i) => APP_NAME.test(i.appName) && i.ids && win9.resolve(i.installLocation).toLowerCase() === want
+  );
+  return entry?.ids ? { launcher: entry.ids } : {};
+}
 var isWanted = (wanted, v) => wanted === true || wanted.map((w) => String(w).replace(/^UE_/i, "")).includes(v.major + "." + v.minor);
 function findUnrealInstalls(files, wanted) {
   const found = [];
@@ -63944,7 +64038,8 @@ function findUnrealInstalls(files, wanted) {
       version: versionText(v),
       host: win9.normalize(dir),
       guest: "",
-      ...ids ? { launcher: ids } : {}
+      ...ids ? { launcher: ids } : {},
+      ...launcherItemOf(dir, files)
     });
   };
   const listed = files.launcherInstalled ? launcherInstallations(files.launcherInstalled) : [];
@@ -63989,7 +64084,10 @@ function findEngineFolders(files, folders) {
       host: dir,
       guest: "",
       writable: true,
-      ...source ? { buildId: source.buildId } : {}
+      ...source ? { buildId: source.buildId } : {},
+      // An engine the launcher installed keeps its ids and manifest, so the sandbox's launcher lists it too.
+      ...launcherIdsOf(dir, { launcherInstalled: files.launcherInstalled ?? null }),
+      ...files.list ? launcherItemOf(dir, { manifests: files.manifests, list: files.list, read: files.read }) : {}
     });
   }
   return found;
@@ -64017,6 +64115,7 @@ function unrealPcFiles(pc) {
       win9.join(d, "Program Files", "Epic Games"),
       win9.join(d, "Epic Games")
     ]),
+    manifests: launcherManifestsDir(pc.programData),
     list: listDir2,
     read: readBoundedFile
   };
@@ -64155,8 +64254,9 @@ function discoverPcInstalls(s3, o, pc = pcEnv()) {
           readOnly: !writable,
           label: writable ? "this PC, writable" : "this PC, read-only"
         });
-        const { host: _host, ...shown } = install;
-        items.push({ ...shown, guest });
+        const { host: _host, launcherItem, ...shown } = install;
+        const moved = launcherItem ? relocateItem(launcherItem.text, install.host, guest) : null;
+        items.push({ ...shown, guest, ...moved ? { launcherItem: { name: launcherItem.name, text: moved } } : {} });
       } catch (e) {
         notes.push("pcInstalls: " + install.name + " is not mapped: " + errMsg(e));
       }
@@ -64866,7 +64966,7 @@ var SandboxChannel = class {
 
 // src/host/channel/attach.ts
 import net4 from "node:net";
-import os17 from "node:os";
+import os18 from "node:os";
 
 // src/shared/pty/protocol.ts
 var FrameType = {
@@ -65114,8 +65214,37 @@ var OutputFilter = class {
   }
 };
 
-// src/shared/pty/console-input.ts
+// src/shared/pty/clipboard-watch.ts
 import { spawn as spawn11 } from "node:child_process";
+var MAX_PENDING = 1024;
+function watchClipboard(onChange) {
+  if (process.platform !== "win32") return { stop: () => void 0 };
+  let child = null;
+  try {
+    child = spawn11(SYSTEM.powershell(), scriptArgs("watch-clipboard.ps1", ["-ProcessId", String(process.pid)]), {
+      stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true
+    });
+  } catch {
+    return { stop: () => void 0 };
+  }
+  let pending = "";
+  child.stdout?.setEncoding("latin1");
+  child.stdout?.on("data", (text) => {
+    const lines = (pending + text).split("\n");
+    pending = (lines.pop() ?? "").slice(-MAX_PENDING);
+    for (const line of lines) if (line.trim() === "changed") onChange();
+  });
+  child.on("error", () => void 0);
+  return {
+    stop: () => {
+      if (child && child.exitCode === null && child.signalCode === null) child.kill();
+    }
+  };
+}
+
+// src/shared/pty/console-input.ts
+import { spawn as spawn12 } from "node:child_process";
 function enableVtInput() {
   if (process.platform !== "win32" || !process.stdin.isTTY)
     return { ready: Promise.resolve(false), stop: () => Promise.resolve() };
@@ -65123,7 +65252,7 @@ function enableVtInput() {
   let exited = Promise.resolve();
   const ready = new Promise((resolve) => {
     try {
-      child = spawn11(SYSTEM.powershell(), scriptArgs("enable-vt-input.ps1", ["-ProcessId", String(process.pid)]), {
+      child = spawn12(SYSTEM.powershell(), scriptArgs("enable-vt-input.ps1", ["-ProcessId", String(process.pid)]), {
         stdio: "ignore",
         windowsHide: true
       });
@@ -65182,30 +65311,118 @@ function unfinishedSequence(data) {
   return data.length;
 }
 
-// src/shared/pty/ctrl-c.ts
+// src/shared/web/protocol.ts
+var CSRF_HEADER = "x-sandbox-web";
+var CSRF_VALUE = "1";
+var COOKIE_NAME = "sbxweb";
+var MIN_COLS = 10;
+var MAX_COLS = 500;
+var MIN_ROWS = 2;
+var MAX_ROWS = 300;
+var MAX_CLIENT_MESSAGE_BYTES = 256 * 1024;
+function parseClientMessage(text) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (typeof value !== "object" || value === null) return null;
+  const m = value;
+  if (m.t !== "resize") return null;
+  const { cols, rows } = m;
+  if (!Number.isInteger(cols) || !Number.isInteger(rows)) return null;
+  const c2 = cols;
+  const r = rows;
+  if (c2 < MIN_COLS || c2 > MAX_COLS || r < MIN_ROWS || r > MAX_ROWS) return null;
+  return { t: "resize", cols: c2, rows: r };
+}
+
+// src/shared/web/ctrl-c.ts
 var CTRL_C_CONFIRM_MS = 1500;
 var CTRL_C_HINT = "Ctrl+C again to send it to the program (Esc stops an agent)";
-var OSC_TITLE = /\x1b\][02];([^\x07\x1b]{0,256})(?:\x07|\x1b\\)/g;
-var CtrlCGuard = class {
+var CTRL_C_COPY_HINT = "Copied: Ctrl+C after selecting text is not sent to the program (Esc stops an agent)";
+var CtrlCDecider = class {
+  constructor(confirm = true) {
+    this.confirm = confirm;
+  }
+  confirm;
   armedAt = Number.NEGATIVE_INFINITY;
-  lastTitle = "";
-  /** What to send for one read from the keyboard: a lone Ctrl+C only when another came just before. */
-  push(chunk, nowMs) {
-    if (chunk.length !== 1 || chunk[0] !== 3) return { send: chunk, held: false };
+  selected = false;
+  /** Text was selected in the program: Ctrl+C is "copy" from now on. */
+  selection() {
+    this.selected = true;
+    this.armedAt = Number.NEGATIVE_INFINITY;
+  }
+  /** Any other key or a click: Ctrl+C is an interrupt again. */
+  otherInput() {
+    this.selected = false;
+  }
+  /** What to do with a lone Ctrl+C pressed at `nowMs`. */
+  ctrlC(nowMs) {
+    if (this.selected) return "copy";
+    if (!this.confirm) return "send";
     if (nowMs - this.armedAt <= CTRL_C_CONFIRM_MS) {
       this.armedAt = Number.NEGATIVE_INFINITY;
-      return { send: chunk, held: false };
+      return "send";
     }
     this.armedAt = nowMs;
-    return { send: Buffer.alloc(0), held: true };
+    return "hold";
+  }
+};
+var MOUSE_REPORT = /\x1b\[<(\d{1,4});\d{1,5};\d{1,5}([Mm])|\x1b\[M([\s\S])[\s\S]{2}/g;
+function classifyInput(text) {
+  let drag = false;
+  let click = false;
+  for (const m of text.matchAll(MOUSE_REPORT)) {
+    const sgr = m[1] !== void 0;
+    const b = sgr ? Number(m[1]) : (m[3] ?? " ").charCodeAt(0) - 32;
+    if (b & 64) continue;
+    if (b & 32) {
+      if ((b & 3) !== 3) drag = true;
+    } else if (sgr ? m[2] === "M" : (b & 3) !== 3) click = true;
+  }
+  return { mouse: drag ? "drag" : click ? "click" : null, keys: text.replace(MOUSE_REPORT, "").length > 0 };
+}
+function hasClipboardWrite(text) {
+  return /\x1b\]0{0,2}52;/.test(text) || /\u009d0{0,2}52;/.test(text);
+}
+
+// src/shared/pty/ctrl-c.ts
+var OSC_TITLE = /\x1b\][02];([^\x07\x1b]{0,256})(?:\x07|\x1b\\)/g;
+var CtrlCGuard = class {
+  decider;
+  lastTitle = "";
+  constructor(options = {}) {
+    this.decider = new CtrlCDecider(options.confirm !== false);
+  }
+  /** What to send for one read from the keyboard: a lone Ctrl+C only when it is not held back or taken as "copy". */
+  push(chunk, nowMs) {
+    if (chunk.length === 1 && chunk[0] === 3) {
+      const action2 = this.decider.ctrlC(nowMs);
+      if (action2 === "send") return { send: chunk, held: false, copied: false };
+      return { send: Buffer.alloc(0), held: action2 === "hold", copied: action2 === "copy" };
+    }
+    const c2 = classifyInput(chunk.toString("latin1"));
+    if (c2.keys || c2.mouse === "click") this.decider.otherInput();
+    else if (c2.mouse === "drag") this.decider.selection();
+    return { send: chunk, held: false, copied: false };
+  }
+  /** The clipboard changed since the last key: you just copied. */
+  clipboardChanged() {
+    this.decider.selection();
+  }
+  /** The program wrote to the clipboard: that is a selection too. */
+  watchClipboard(raw) {
+    if (hasClipboardWrite(raw)) this.decider.selection();
   }
   /** Remembers the title the program last set (from its output), to put it back after the hint. */
   watchOutput(text) {
     for (const m of text.matchAll(OSC_TITLE)) this.lastTitle = m[1];
   }
   /** The escape sequence that shows the hint, and the one that puts the program's title back. */
-  hintTitle() {
-    return "\x1B]0;" + CTRL_C_HINT + "\x07";
+  hintTitle(kind = "hold") {
+    return "\x1B]0;" + (kind === "copy" ? CTRL_C_COPY_HINT : CTRL_C_HINT) + "\x07";
   }
   restoreTitle() {
     return "\x1B]0;" + this.lastTitle.replace(/[\x00-\x1f\x7f]/g, "") + "\x07";
@@ -65409,6 +65626,7 @@ function runTerminalClient(socket, token, options = {}) {
       clearTimeout(joinTimer);
       clearTimeout(hintTimer);
       clearTimeout(vtTimer);
+      clipboard.stop();
       socket.destroy();
       const tracked = mouse.tracking();
       const reset = "\x1B[0m\x1B[?25h" + MOUSE_OFF + (mouse.has(2004) ? "\x1B[?2004l" : "") + "\r\n";
@@ -65426,23 +65644,22 @@ function runTerminalClient(socket, token, options = {}) {
       if (data.length && !done) socket.write(encodeFrame(FrameType.Input, data));
     };
     const sendInput = (data) => write(keys.push(passthrough ? mouse.filter(data) : data));
-    const guard2 = options.confirmCtrlC ? new CtrlCGuard() : null;
+    const guard2 = new CtrlCGuard({ confirm: options.confirmCtrlC !== false });
     let hintTimer;
+    const clipboard = watchClipboard(() => guard2.clipboardChanged());
     const onInput = (chunk) => {
       if (options.detachKey !== void 0 && chunk.includes(options.detachKey)) {
         finish({ reason: "detach" });
         return;
       }
-      if (guard2) {
-        const decided = guard2.push(chunk, Date.now());
-        clearTimeout(hintTimer);
-        if (decided.held) {
-          stdout.write(guard2.hintTitle());
-          hintTimer = setTimeout(() => stdout.write(guard2.restoreTitle()), CTRL_C_CONFIRM_MS);
-          return;
-        }
-        if (decided.send.length === 1 && decided.send[0] === 3) stdout.write(guard2.restoreTitle());
+      const decided = guard2.push(chunk, Date.now());
+      clearTimeout(hintTimer);
+      if (decided.held || decided.copied) {
+        stdout.write(guard2.hintTitle(decided.copied ? "copy" : "hold"));
+        hintTimer = setTimeout(() => stdout.write(guard2.restoreTitle()), CTRL_C_CONFIRM_MS);
+        return;
       }
+      if (decided.send.length === 1 && decided.send[0] === 3) stdout.write(guard2.restoreTitle());
       clearTimeout(joinTimer);
       sendInput(joiner.push(chunk));
       if (joiner.holding()) joinTimer = setTimeout(() => sendInput(joiner.flush()), JOIN_MS);
@@ -65475,9 +65692,10 @@ function runTerminalClient(socket, token, options = {}) {
       }
       for (const frame of frames) {
         if (frame.type === FrameType.Output) {
+          guard2.watchClipboard(frame.payload.toString("latin1"));
           const out = filter.push(frame.payload);
           mouse.watch(out);
-          guard2?.watchOutput(out.toString("latin1"));
+          guard2.watchOutput(out.toString("latin1"));
           stdout.write(out);
         } else if (frame.type === FrameType.Console) passthrough = frame.payload.toString("latin1") === "conpty.dll";
         else if (frame.type === FrameType.Restarting) {
@@ -65512,7 +65730,7 @@ function runTerminalClient(socket, token, options = {}) {
 
 // src/host/channel/attach.ts
 var ipToInt = (ip) => ip.split(".").reduce((n, part) => n * 256 + Number(part), 0);
-function isSandboxAddress(ip, interfaces = os17.networkInterfaces()) {
+function isSandboxAddress(ip, interfaces = os18.networkInterfaces()) {
   if (!net4.isIPv4(ip)) return false;
   return Object.entries(interfaces).some(
     ([name2, list2]) => /^vEthernet/i.test(name2) && !/WSL/i.test(name2) && (list2 ?? []).some((i) => {
@@ -66353,7 +66571,7 @@ var AuditCollector = class {
 };
 
 // src/sync/watcher.ts
-import os18 from "node:os";
+import os19 from "node:os";
 var WATCH_INTERVAL_MS = 60 * 1e3;
 var FIRST_SYNC_MS = 3e4;
 var AUDIT_FLUSH_MS = 1e4;
@@ -66412,7 +66630,7 @@ var Watcher = class {
   memoryStream = null;
   watchdog = WATCHDOG_START;
   watchdogBusy = false;
-  lastCpu = os18.cpus();
+  lastCpu = os19.cpus();
   lastHostLog = 0;
   /** Runs until the sandbox has closed and the final sync is done (or the end deadline passed). */
   async run() {
@@ -66532,7 +66750,7 @@ var Watcher = class {
     try {
       const settings = readLoadSettings(this.storageRoot, this.dataPath);
       const memory = this.memoryStream?.latest() ?? await readHostMemoryAsync(this.storageRoot);
-      const cpus = os18.cpus();
+      const cpus = os19.cpus();
       const cpuPercent = cpuPercentBetween(this.lastCpu, cpus);
       this.lastCpu = cpus;
       const nowMs = Date.now();
@@ -69257,7 +69475,7 @@ function continuesAfterFailedMigration(command2) {
 
 // src/cli/services/update-service.ts
 import fs112 from "node:fs";
-import os19 from "node:os";
+import os20 from "node:os";
 import path156 from "node:path";
 
 // src/host/update/release-source.ts
@@ -69692,7 +69910,7 @@ var Updater = class {
 var NPM_UPDATE_COMMAND = "npm install -g windows-development-sandbox";
 var AUTO_CHECK_HOURS = 24;
 var SeenSchema = external_exports.object({ seen: external_exports.string() });
-function runsAsSystem(env = process.env, username = os19.userInfo().username) {
+function runsAsSystem(env = process.env, username = os20.userInfo().username) {
   return username.toUpperCase() === "SYSTEM" || (env.USERNAME ?? "").endsWith("$");
 }
 var UpdateService = class _UpdateService {
@@ -70315,7 +70533,7 @@ import { spawnSync as spawnSync29 } from "node:child_process";
 
 // src/cli/commands/setup/facts.ts
 var import_lodash27 = __toESM(require_lodash(), 1);
-import os20 from "node:os";
+import os21 from "node:os";
 var FEATURE = "Containers-DisposableClientVM";
 var ENABLE_COMMAND = "Enable-WindowsOptionalFeature -Online -FeatureName " + FEATURE + " -All -NoRestart";
 function parseRegQuery(text) {
@@ -70363,7 +70581,7 @@ function gatherFacts(storageRoot) {
     sandboxExe: fileExists(system32("WindowsSandbox.exe")),
     virtualizationFirmware: probe.virtualizationFirmware ?? null,
     hypervisorPresent: probe.hypervisorPresent ?? null,
-    totalRamBytes: os20.totalmem(),
+    totalRamBytes: os21.totalmem(),
     freeDiskBytes: freeBytesAt(storageRoot),
     storageRoot,
     nodeVersion: process.version
@@ -71381,6 +71599,12 @@ import path162 from "node:path";
 
 // src/app/context.ts
 var implement = implementer();
+function reloadSettings(ctx) {
+  try {
+    ctx.loaded = loadConfig(ctx.loaded.configPath ?? ctx.options.config);
+  } catch {
+  }
+}
 function typedConfirm(io) {
   return (prompt, expected) => io.confirm({
     title: prompt,
@@ -72949,7 +73173,7 @@ var AccessStore = class _AccessStore {
 };
 
 // src/host/remote/door-client.ts
-import { spawn as spawn12 } from "node:child_process";
+import { spawn as spawn13 } from "node:child_process";
 var NOT_OWNER = 3;
 var NO_PIPE = 4;
 var NO_USER = 5;
@@ -72976,7 +73200,7 @@ async function knockOnDoor(storageRoot, owner) {
   const exe = hostToolsExe(storageRoot);
   if (!exe) fail("Windows sign-in needs HostTools, which could not be built on this PC.", "Run sandbox doctor.");
   return new Promise((resolve) => {
-    const child = spawn12(exe, ["door-client", "--owner", owner], { windowsHide: true });
+    const child = spawn13(exe, ["door-client", "--owner", owner], { windowsHide: true });
     let out = "";
     child.stdout.on("data", (d) => {
       if (out.length < 1024) out += d.toString("utf8");
@@ -73088,13 +73312,13 @@ function fingerprintOf(der) {
 // src/host/remote/firewall.ts
 import crypto22 from "node:crypto";
 import fs119 from "node:fs";
-import os22 from "node:os";
+import os23 from "node:os";
 import path168 from "node:path";
-import { spawn as spawn13 } from "node:child_process";
+import { spawn as spawn14 } from "node:child_process";
 
 // src/host/remote/lan.ts
 import net7 from "node:net";
-import os21 from "node:os";
+import os22 from "node:os";
 var toInt = (ip) => ip.split(".").reduce((n, part) => n * 256 + Number(part), 0) >>> 0;
 function isPrivateIPv4(ip) {
   if (!net7.isIPv4(ip)) return false;
@@ -73111,7 +73335,7 @@ function plainIPv4(ip) {
 function virtualAdapter(name2) {
   return /^vEthernet/i.test(name2) || /Hyper-V|WSL/i.test(name2);
 }
-function privateAddresses(interfaces = os21.networkInterfaces()) {
+function privateAddresses(interfaces = os22.networkInterfaces()) {
   const out = [];
   for (const [adapter, list2] of Object.entries(interfaces)) {
     if (virtualAdapter(adapter)) continue;
@@ -73121,7 +73345,7 @@ function privateAddresses(interfaces = os21.networkInterfaces()) {
   }
   return out;
 }
-function chooseLanAddress(configured, interfaces = os21.networkInterfaces()) {
+function chooseLanAddress(configured, interfaces = os22.networkInterfaces()) {
   const own2 = privateAddresses(interfaces);
   if (configured) {
     if (!isPrivateIPv4(configured))
@@ -73149,7 +73373,7 @@ function sameSubnet(a, b, netmask) {
   const mask = toInt(netmask);
   return mask !== 0 && (toInt(a) & mask) === (toInt(b) & mask);
 }
-function lanPeerProblem(peer, local, bound, interfaces = os21.networkInterfaces()) {
+function lanPeerProblem(peer, local, bound, interfaces = os22.networkInterfaces()) {
   const ip = plainIPv4(peer);
   if (plainIPv4(local) !== bound.address) return "reached another address of this PC";
   if (!isPrivateIPv4(ip)) return "not a private address";
@@ -73182,7 +73406,7 @@ function removeRuleRequest() {
   return { action: "remove", ruleName: FIREWALL_RULE_NAME };
 }
 var spawnRunner3 = (exe, args, timeoutMs) => new Promise((resolve) => {
-  const child = spawn13(exe, [...args], { windowsHide: true });
+  const child = spawn14(exe, [...args], { windowsHide: true });
   let stdout = "";
   let stderr = "";
   const timer = setTimeout(() => child.kill(), timeoutMs);
@@ -73200,7 +73424,7 @@ var OutcomeSchema3 = external_exports.object({
   commands: external_exports.array(external_exports.string().max(1e3)).max(4).optional()
 });
 async function runScript2(request2, dryRun, run3) {
-  const dir = fs119.mkdtempSync(path168.join(os22.tmpdir(), "agent-sandbox-firewall-"));
+  const dir = fs119.mkdtempSync(path168.join(os23.tmpdir(), "agent-sandbox-firewall-"));
   try {
     const file2 = path168.join(dir, "request.json");
     fs119.writeFileSync(file2, JSON.stringify(request2, null, 2), "utf8");
@@ -73259,35 +73483,6 @@ import https from "node:https";
 
 // src/host/web/auth.ts
 import crypto23 from "node:crypto";
-
-// src/shared/web/protocol.ts
-var CSRF_HEADER = "x-sandbox-web";
-var CSRF_VALUE = "1";
-var COOKIE_NAME = "sbxweb";
-var MIN_COLS = 10;
-var MAX_COLS = 500;
-var MIN_ROWS = 2;
-var MAX_ROWS = 300;
-var MAX_CLIENT_MESSAGE_BYTES = 256 * 1024;
-function parseClientMessage(text) {
-  let value;
-  try {
-    value = JSON.parse(text);
-  } catch {
-    return null;
-  }
-  if (typeof value !== "object" || value === null) return null;
-  const m = value;
-  if (m.t !== "resize") return null;
-  const { cols, rows } = m;
-  if (!Number.isInteger(cols) || !Number.isInteger(rows)) return null;
-  const c2 = cols;
-  const r = rows;
-  if (c2 < MIN_COLS || c2 > MAX_COLS || r < MIN_ROWS || r > MAX_ROWS) return null;
-  return { t: "resize", cols: c2, rows: r };
-}
-
-// src/host/web/auth.ts
 var COOKIE_LIFETIME_MS = 12 * 60 * 60 * 1e3;
 var MAX_COOKIES = 50;
 var MAX_FAILURES = 8;
@@ -73367,17 +73562,17 @@ function cookieHeader(value) {
 }
 
 // src/host/web/browser.ts
-import { spawn as spawn14 } from "node:child_process";
+import { spawn as spawn15 } from "node:child_process";
 function openBrowser(url2) {
   refuseInSelfTest("open a browser");
   if (!/^http:\/\/127\.0\.0\.1:\d{1,5}\/(#[kw]=[0-9a-f]{64})?$/.test(url2)) throw new Error("Not a web UI address.");
-  spawn14(SYSTEM.cmd(), ["/c", "start", "", url2], { detached: true, stdio: "ignore", windowsHide: true }).unref();
+  spawn15(SYSTEM.cmd(), ["/c", "start", "", url2], { detached: true, stdio: "ignore", windowsHide: true }).unref();
 }
 var ISSUE_URL = /^https:\/\/github\.com\/[\w.-]+\/[\w.-]+\/issues\/new\?[\w%.~&=+-]*$/;
 function openIssuePage(url2) {
   refuseInSelfTest("open a browser");
   if (!ISSUE_URL.test(url2) || url2.length > 2e3) throw new Error("Not a GitHub new-issue address.");
-  spawn14(system32("rundll32.exe"), ["url.dll,FileProtocolHandler", url2], {
+  spawn15(system32("rundll32.exe"), ["url.dll,FileProtocolHandler", url2], {
     detached: true,
     stdio: "ignore",
     windowsHide: true
@@ -74357,7 +74552,7 @@ var WebRunner = class {
 };
 
 // src/host/remote/windows-helper.ts
-import { spawn as spawn15 } from "node:child_process";
+import { spawn as spawn16 } from "node:child_process";
 import readline3 from "node:readline";
 var SID2 = /^S-1-[0-9-]{1,180}$/;
 var MEDIUM_INTEGRITY = 8192;
@@ -74396,7 +74591,7 @@ var HostToolsHelper = class _HostToolsHelper {
   answer = async () => "refused Windows sign-in is off.";
   problem = () => void 0;
   constructor(exe, pipe2) {
-    this.child = spawn15(exe, ["web-helper", "--pipe", pipe2 ?? "", "--server-pid", String(process.pid)], {
+    this.child = spawn16(exe, ["web-helper", "--pipe", pipe2 ?? "", "--server-pid", String(process.pid)], {
       windowsHide: true,
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -74793,7 +74988,7 @@ var RemoteGate = class {
 };
 
 // src/host/remote/tls-store.ts
-import os23 from "node:os";
+import os24 from "node:os";
 import path171 from "node:path";
 var TlsFileSchema = external_exports.strictObject({
   cert: external_exports.string().max(8e3),
@@ -74835,7 +75030,7 @@ var TlsStore = class {
   }
   /** A new certificate (the old one is gone). */
   renew(addresses) {
-    const made = makeCertificate({ addresses, dnsNames: [os23.hostname()], now: this.now() });
+    const made = makeCertificate({ addresses, dnsNames: [os24.hostname()], now: this.now() });
     this.file.write({
       cert: made.cert,
       key: this.secrets.seal(made.key),
@@ -76331,12 +76526,16 @@ var ServiceRowSchema = external_exports.object({
   canImport: external_exports.boolean().describe("It can be taken from this PC or a file (sandbox account import)"),
   canLogin: external_exports.boolean().describe("It can be typed (sandbox account login)"),
   needsFile: external_exports.boolean().describe("Importing it needs --from <file>"),
+  fromPc: external_exports.boolean().describe("This PC's own program can give it (the next launch takes it when sharing is on)"),
+  hasFileSource: external_exports.boolean().describe("It can be read from a file you name"),
+  onPc: external_exports.boolean().nullable().describe("This PC has one to take (null: it cannot be taken from this PC). Only the presence, never the sign-in"),
+  sandboxOnly: external_exports.boolean().describe("Only a sandbox can give it: sign in once inside one and it is kept"),
   ready: external_exports.boolean().describe("Its sign-in is written; false: the menu and the web leave it out (the CLI says coming)")
 });
 var ServicesListSchema = external_exports.object({ services: external_exports.array(ServiceRowSchema) });
 var STATE_TEXT = {
   none: "not saved",
-  saved: "saved (encrypted)",
+  saved: "saved",
   unreadable: "cannot be read"
 };
 var STATE_TONE = {
@@ -76345,10 +76544,10 @@ var STATE_TONE = {
   unreadable: "danger"
 };
 var SOURCE_TEXT = {
-  pc: "taken from this PC",
+  pc: "from this PC",
   file: "from a file",
-  typed: "typed in",
-  sandbox: "signed in (or renewed) in a sandbox"
+  typed: "by typing it",
+  sandbox: "from a sandbox"
 };
 var day = (iso) => iso ? iso.slice(0, 10) : "";
 function servicesText(o) {
@@ -76381,7 +76580,8 @@ var serviceImport = defineOperation({
   summary: "save a service sign-in from this PC's program or a file, for sandboxes",
   input: external_exports.object({
     name: KindSchema,
-    from: external_exports.string().max(1e3).optional().describe("(import) the file or folder to take the sign-in from")
+    from: external_exports.string().max(1e3).optional().describe("(import) the file or folder to take the sign-in from"),
+    file: external_exports.boolean().optional().describe("(import) ask for a file even when this PC has one to take")
   }),
   output: MessageSchema2,
   text: (o) => o.message,
@@ -76410,6 +76610,12 @@ var SERVICE_OPERATIONS = [serviceImport, serviceLogin, serviceLogout];
 function serviceCategory(kind) {
   return "service:" + kind;
 }
+var PC_HELP = {
+  epic: "Sign in to the Epic launcher here, with Remember me on.",
+  steam: "Log in once with SteamCMD in C:\\steamcmd.",
+  unity: "Sign in to the Unity Hub here.",
+  perplexity: "Set PERPLEXITY_API_KEY for your Windows user."
+};
 function serviceActions(s3) {
   return [
     action(
@@ -76422,51 +76628,75 @@ function serviceActions(s3) {
         importance: 1
       }
     ),
-    ...s3.canImport ? [action(serviceImport, { name: s3.kind }, { key: "i", verb: "import", importance: 1 })] : [],
-    ...s3.canLogin ? [action(serviceLogin, { name: s3.kind }, { key: "n", verb: "sign in", importance: 1 })] : [],
+    ...s3.fromPc ? [
+      action(
+        serviceImport,
+        { name: s3.kind },
+        { key: "i", verb: "take from this PC", label: "Take this PC's sign-in", importance: 1 }
+      )
+    ] : [],
+    ...s3.hasFileSource ? [
+      action(
+        serviceImport,
+        { name: s3.kind, file: true },
+        {
+          key: s3.fromPc ? "f" : "i",
+          verb: "import a file",
+          label: "Import from a file\u2026",
+          importance: s3.fromPc ? 2 : 1
+        }
+      )
+    ] : [],
+    ...s3.canLogin ? [
+      action(
+        serviceLogin,
+        { name: s3.kind },
+        { key: "n", verb: "type it in", label: "Type the sign-in\u2026", importance: 1 }
+      )
+    ] : [],
     ...s3.state !== "none" ? [action(serviceLogout, { name: s3.kind }, { key: "x", verb: "forget", importance: 2 })] : []
   ];
 }
-function howTo(s3) {
-  const ways = [...s3.canImport ? ["import it"] : [], ...s3.canLogin ? ["type it in"] : []];
-  return ways.length ? ways.join(" or ") : "sign in once inside a sandbox (it can't be copied from this PC: Windows locks it to your PC account)";
+function helpLine(s3) {
+  if (s3.state !== "none") return void 0;
+  if (s3.sandboxOnly) return "Sign in once inside a sandbox; it is kept for the next ones.";
+  if (s3.fromPc && s3.onPc)
+    return s3.share ? "The next sandbox takes this PC's." : "Share it and the next sandbox takes this PC's.";
+  if (s3.fromPc) return PC_HELP[s3.kind] ?? "Not found on this PC.";
+  return s3.canLogin ? "Type it in, or import it from a file." : "Import it from a file.";
 }
 function serviceSection(s3) {
   const facts2 = [
     {
       id: s3.kind + ":share",
-      label: "Shared with sandboxes",
+      label: "Shared",
       value: s3.share ? "on" : "off",
       tone: s3.share ? "ok" : "muted",
-      description: "For sandboxes that use " + s3.usedFor + ". " + s3.warnings.join(" ")
+      description: "The agent can use it."
     },
     {
       id: s3.kind + ":state",
       label: "Sign-in",
       value: STATE_TEXT[s3.state] + (s3.savedAt ? "  " + day(s3.savedAt) : ""),
       tone: STATE_TONE[s3.state],
-      description: s3.state === "none" ? "Save one: " + howTo(s3) + "." : void 0
+      description: s3.state === "unreadable" ? "Only the Windows user that saved it can read it: save it again." : helpLine(s3) ?? (s3.source ? "Saved " + (SOURCE_TEXT[s3.source] ?? s3.source) + "." : void 0)
     },
-    ...s3.source ? [{ id: s3.kind + ":source", label: "From", value: SOURCE_TEXT[s3.source] ?? s3.source }] : [],
+    ...s3.onPc === null ? [] : [
+      {
+        id: s3.kind + ":pc",
+        label: "On this PC",
+        value: s3.onPc ? "found" : "not found",
+        tone: s3.onPc ? "ok" : "muted"
+      }
+    ],
     ...s3.summary ? [{ id: s3.kind + ":summary", label: "Account", value: s3.summary }] : [],
     ...s3.heldBy ? [{ id: s3.kind + ":held", label: "In use by", value: "sandbox " + s3.heldBy, tone: "accent" }] : []
   ];
-  const warnings = s3.warnings.map((w, i) => ({
-    id: s3.kind + ":warning:" + i,
-    label: w,
-    tone: "warn",
-    group: "Before you share it"
-  }));
-  const notes = [
-    ...s3.state === "unreadable" ? [{ text: "Only the Windows user that saved it can read it: save it again.", tone: "muted" }] : []
-  ];
   return {
     id: serviceCategory(s3.kind),
     title: s3.label,
     summary: (s3.share ? "shared" : "not shared") + " \xB7 " + STATE_TEXT[s3.state],
     facts: facts2,
-    items: warnings,
-    notes,
     actions: serviceActions(s3)
   };
 }
@@ -76781,7 +77011,17 @@ var accountsView = defineView({
 // src/app/features/accounts/services.run.ts
 import fs124 from "node:fs";
 import path174 from "node:path";
-function serviceRow(kind, config3, store, leases) {
+function presentOnPc(kind, pc) {
+  const source = HOST_SOURCES[kind];
+  if (!source.fromPc) return null;
+  if (!pc) return false;
+  try {
+    return source.fromPc(pc) !== null;
+  } catch {
+    return false;
+  }
+}
+function serviceRow(kind, config3, store, leases, pc) {
   const spec = SERVICE_SPECS[kind];
   const source = HOST_SOURCES[kind];
   const state = store.state(kind);
@@ -76802,6 +77042,10 @@ function serviceRow(kind, config3, store, leases) {
     canImport: Boolean(source.fromPc || source.fromFile),
     canLogin: Boolean(source.fromAnswers),
     needsFile: Boolean(source.fromFile && !source.fromPc),
+    fromPc: Boolean(source.fromPc),
+    hasFileSource: Boolean(source.fromFile),
+    onPc: presentOnPc(kind, pc),
+    sandboxOnly: !source.fromPc && !source.fromFile && !source.fromAnswers,
     ready: isKindReady(kind)
   };
 }
@@ -76849,7 +77093,7 @@ function refuseSandboxOnly(spec) {
 function savedMessage(kind, share2) {
   return "Saved your " + SERVICE_SPECS[kind].label + " sign-in (encrypted for your Windows user)." + (share2 ? "" : " Sandboxes get it once you turn on Share with sandboxes.");
 }
-async function importServiceFlow(io, kind, from, deps) {
+async function importServiceFlow(io, kind, from, deps, wantFile = false) {
   const spec = SERVICE_SPECS[kind];
   const source = HOST_SOURCES[kind];
   if (!source.fromPc && !source.fromFile) refuseSandboxOnly(spec);
@@ -76857,7 +77101,7 @@ async function importServiceFlow(io, kind, from, deps) {
     failWith(spec.label + " cannot be imported.", "Type it instead.", {
       op: "accounts.service.login",
       input: { name: kind },
-      label: "Sign in\u2026",
+      label: "Type the sign-in\u2026",
       cli: "sandbox account login " + kind
     });
   let file2 = from === void 0 ? void 0 : path174.resolve(from);
@@ -76868,7 +77112,7 @@ async function importServiceFlow(io, kind, from, deps) {
       return false;
     }
   };
-  const useFile = Boolean(source.fromFile && (file2 ? isFile(file2) : !source.fromPc));
+  const useFile = Boolean(source.fromFile && (file2 ? isFile(file2) : wantFile || !source.fromPc));
   if (useFile && !file2) {
     const asked = await io.path({ title: "The " + spec.label + " file:", pathKind: "file" });
     if (asked === void 0) cancelled();
@@ -76945,7 +77189,8 @@ var listServicesRun = implement(listServices, async (ctx, input2) => {
   if (name2 !== void 0 && name2 !== "" && !isServiceKind(name2))
     fail('There is no service called "' + safeText(input2.name ?? "") + '".', "Use one of: " + SERVICE_KINDS.join(", "));
   const kinds = name2 ? [name2] : [...SERVICE_KINDS];
-  return { services: kinds.map((k) => serviceRow(k, ctx.loaded.config, store, leases)) };
+  const pc = pcEnv();
+  return { services: kinds.map((k) => serviceRow(k, ctx.loaded.config, store, leases, pc)) };
 });
 var serviceImportRun = implement(serviceImport, async (ctx, input2, io) => {
   requireOnPc("account import");
@@ -76955,11 +77200,17 @@ var serviceImportRun = implement(serviceImport, async (ctx, input2, io) => {
     "import",
     (s3) => Boolean(HOST_SOURCES[s3.kind].fromPc || HOST_SOURCES[s3.kind].fromFile)
   );
-  return importServiceFlow(io, kind, input2.from, {
-    store: new ServiceAccountStore(ctx.storageRoot),
-    pc: pcEnv(),
-    share: ctx.loaded.config.accounts[kind].share
-  });
+  return importServiceFlow(
+    io,
+    kind,
+    input2.from,
+    {
+      store: new ServiceAccountStore(ctx.storageRoot),
+      pc: pcEnv(),
+      share: ctx.loaded.config.accounts[kind].share
+    },
+    input2.file ?? false
+  );
 });
 var serviceLoginRun = implement(serviceLogin, async (ctx, input2, io) => {
   requireOnPc("account login");
@@ -80011,6 +80262,9 @@ var SETTINGS = {
   theme: "dark",
   firstWindowPreference: "defaultProfile",
   confirmCloseAllTabs: false,
+  // Copied the moment the mouse is released, so an agent's redraw cannot clear the selection first.
+  copyOnSelect: true,
+  copyFormatting: "none",
   // New tabs pick up the PATH and variables the runner writes machine-wide after the window opened.
   compatibility: { reloadEnvironmentVariables: true },
   warning: { confirmCloseAllTabs: false, largePaste: false, multiLinePaste: false },
@@ -80049,6 +80303,10 @@ function withReloadEnvironment(settings) {
   if (compatibility?.reloadEnvironmentVariables === true) return null;
   return { ...settings, compatibility: { ...compatibility, reloadEnvironmentVariables: true } };
 }
+function withCopyOnSelect(settings) {
+  if ("copyOnSelect" in settings) return null;
+  return { ...settings, copyOnSelect: true };
+}
 function syncPwshProfile(dataPath, allowed) {
   const file2 = path185.join(terminalDir(dataPath), "settings", "settings.json");
   assertTestWritable2(file2);
@@ -80066,15 +80324,18 @@ function syncPwshProfile(dataPath, allowed) {
   }
   const withProfile = withPwshProfile(parsed, visible);
   if (withProfile) {
-    writeJson(file2, withReloadEnvironment(withProfile) ?? withProfile);
+    const reloaded = withReloadEnvironment(withProfile) ?? withProfile;
+    writeJson(file2, withCopyOnSelect(reloaded) ?? reloaded);
     return;
   }
-  if (withReloadEnvironment(parsed)) {
-    const edits = modify(text, ["compatibility", "reloadEnvironmentVariables"], true, {
-      formattingOptions: { insertSpaces: true, tabSize: 4 }
-    });
-    writeFileAtomic(file2, applyEdits(text, edits));
-  }
+  const missing = [];
+  if (withReloadEnvironment(parsed)) missing.push([["compatibility", "reloadEnvironmentVariables"], true]);
+  if (withCopyOnSelect(parsed)) missing.push([["copyOnSelect"], true]);
+  if (missing.length === 0) return;
+  let edited = text;
+  for (const [at, value] of missing)
+    edited = applyEdits(edited, modify(edited, at, value, { formattingOptions: { insertSpaces: true, tabSize: 4 } }));
+  writeFileAtomic(file2, edited);
 }
 async function ensureTerminal(dataPath, refresh, options = {}) {
   const result = await installTerminal(dataPath, refresh);
@@ -83319,7 +83580,7 @@ var vpnLogoutRun = implement(vpnLogout, async (ctx, _input, io) => {
 });
 
 // src/app/features/github/github.run.ts
-import os24 from "node:os";
+import os25 from "node:os";
 async function saveGithubTokenFlow(io, store, verify = verifyGithubToken) {
   io.log("Make a GitHub token only for sandboxes:");
   GITHUB_STEPS.forEach((s3, i) => io.log("  " + (i + 1) + ". " + s3));
@@ -83380,7 +83641,7 @@ var githubStatusRun = implement(githubStatus, async (ctx) => {
     expiresAt: token === "none" ? null : store.check()?.expiresAt ?? null,
     repoCount: token === "none" ? null : store.check()?.repoCount ?? null,
     checkedAt: token === "none" ? null : store.check()?.checkedAt ?? null,
-    tokenUrl: tokenUrlFor(os24.hostname())
+    tokenUrl: tokenUrlFor(os25.hostname())
   };
 });
 var githubLoginRun = implement(githubLogin, async (ctx, _input, io) => {
@@ -84736,7 +84997,14 @@ function implementationOf(id) {
 function runDefinition(id, ctx, input2, io) {
   const impl = implementationOf(id);
   if (!impl) throw new Error("No implementation for " + id);
-  return invoke(impl, ctx, input2, io);
+  return invokeAndRefresh(impl, ctx, input2, io);
+}
+async function invokeAndRefresh(impl, ctx, input2, io) {
+  try {
+    return await invoke(impl, ctx, input2, io);
+  } finally {
+    if (impl.def.kind === "operation") reloadSettings(ctx);
+  }
 }
 async function readQuery(def, ctx, input2 = {}) {
   return await runDefinition(def.id, ctx, input2, NO_QUESTIONS);
@@ -84761,7 +85029,7 @@ function createRpcHost(ctx) {
       if (!impl) throw new Error("Not allowed on the web: " + id);
       const need = accessNeeded(impl.def, input2);
       if (!allows(caller, need)) fail(refusalText(caller, need));
-      return invoke(impl, ctx, input2, io);
+      return invokeAndRefresh(impl, ctx, input2, io);
     }
   };
 }
@@ -85188,7 +85456,7 @@ async function attachOpened(ctx, session) {
     nextStep("sandbox attach " + session);
     return 0;
   }
-  const { attach: attach2 } = await import("./chunk-4TLSWPG7.js");
+  const { attach: attach2 } = await import("./chunk-UZ5S3EMB.js");
   return attach2({ ...ctx, options: { ...ctx.options, positionals: [session] } });
 }
 function definitionHandler(def) {
@@ -86148,6 +86416,9 @@ export {
   NAV,
   withOperationCommands,
   SandboxChannel,
+  CSRF_HEADER,
+  CSRF_VALUE,
+  reloadSettings,
   esm_default4 as esm_default,
   esm_default11 as esm_default2,
   askChoice,
@@ -86206,8 +86477,6 @@ export {
   settingRow,
   ProjectsService,
   StorageService,
-  CSRF_HEADER,
-  CSRF_VALUE,
   openBrowser,
   import_websocket,
   INSTALL,