windows-development-sandbox 1.27.3 → 1.29.0

package/dist/cli/commands/launch/launch.js

@@ -417,7 +417,7 @@ class Launcher {
             console.log(headsUp + '\nFollow along: sandbox logs -f');
         if (hidden)
             console.log((await hidden)
-                ? 'Sandbox running headless. Open the window: sbx-show   Attach here: sandbox claude -t'
+                ? 'Sandbox running headless. Open the window: sandbox show   Attach here: sandbox claude -t'
                 : 'Could not find the sandbox window to hide (it may still be starting); run sandbox hide in a moment.');
         else
             console.log('Sandbox starting. ' +

package/dist/cli/commands/launch/running.js

@@ -114,7 +114,7 @@ export async function openSession(ctx, ready, joined, o) {
         session.id +
         ' opened in a new tab inside the sandbox. Attach here with: sandbox attach ' +
         session.id +
-        (ready.headless ? '   (headless: sbx-show opens the window)' : ''));
+        (ready.headless ? '   (headless: sandbox show opens the window)' : ''));
     return 0;
 }
 /** The sessions a launch asks for: each --session, else one (the agent, in this folder). */
@@ -169,7 +169,7 @@ async function openSessions(ctx, ready, list) {
     if (!first)
         return 1;
     console.log('Each has its own tab inside the sandbox' +
-        (ready.headless ? ' (headless: sbx-show opens the window)' : '') +
+        (ready.headless ? ' (headless: sandbox show opens the window)' : '') +
         '. Attach to any of them, from any terminal: sandbox attach');
     return results.every((r) => r.status === 'fulfilled') ? 0 : 1;
 }

package/dist/cli/index.js

@@ -17,7 +17,7 @@ import { versionText } from './version.js';
 import { HANDLERS } from './commands/index.js';
 import { definitionHandler, operationHandler } from './operations/index.js';
 import { runUpdate } from '../app/features/updates/index.js';
-const entry = path.join(PACKAGE_ROOT, 'dist', 'bin', 'agent-sandbox.js');
+const entry = path.join(PACKAGE_ROOT, 'dist', 'bin', 'sandbox.js');
 /** A first word that is no command and no agent, but close to one: "Did you mean: sandbox status?". */
 function failOnTypo(word, agents) {
     const names = [...COMMANDS.filter((c) => !c.hidden).map((c) => c.name), ...agents];

package/dist/cli/menu/pages/agents-page.js

@@ -152,7 +152,7 @@ export function agentsOptions(m, cwd = process.cwd()) {
                 category: 'options',
                 section: 'This start',
                 hint: WINDOW_TEXT[m.window],
-                description: 'Hide or show the Windows Sandbox window (sbx-show brings a hidden one back).',
+                description: 'Hide or show the Windows Sandbox window (sandbox show brings a hidden one back).',
             },
             {
                 value: 'opt:folder',

package/dist/cli/services/sandbox-service.js

@@ -71,7 +71,7 @@ export class SandboxService {
     }
     async hideWindow() {
         if (!(await hideSandboxWindow(this.ctx.storageRoot, 5)))
-            fail('Could not find a visible Windows Sandbox window.', 'It may already be hidden (sbx-show brings it back).');
+            fail('Could not find a visible Windows Sandbox window.', 'It may already be hidden (sandbox show brings it back).');
     }
     /** What stopping ends. Fails when this sandbox was not started by this tool. */
     stopPlan() {

package/dist/core/schema/sandbox.js

@@ -48,7 +48,7 @@ export const SandboxSchema = z.strictObject({
         .describe('The last resort that keeps the sandbox up, in MB below its commit limit (RAM plus paging file): builds are slowed down long before (sandbox.pressureResponse); only if everything the agents start together would take the sandbox to the very edge of its memory, where Windows inside it would start failing, is a build refused memory instead of Windows. "auto" = the larger of 1536 MB and 3 % of the commit limit; "none" = no backstop. Yours only: a project file cannot change it.'),
     pressureResponse: z
         .boolean()
-        .describe('When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. Yours only: a project file cannot change it.'),
+        .describe('When the sandbox (or this PC) runs low on memory, slow builds down in steps, like a PC that gets slower instead of failing: build programs get lower CPU and memory priority, then less CPU, then compilers take turns (the waiting ones briefly suspended and trimmed to the paging file). Nothing is stopped or killed, and the agents themselves are never touched. A memory gate also holds new compilers and linkers for a moment when the memory of the build programs grows faster than 4 GB in 3 seconds (3 GB with vGPU), and lets them go one at a time. Yours only: a project file cannot change it.'),
     vGpu: z
         .boolean()
         .describe("Virtual GPU. Off by default: Microsoft notes it widens the sandbox attack surface. The sandbox then uses this PC's graphics card, and with some graphics drivers heavy use can freeze the whole PC: turn it on only when a program in the sandbox needs the GPU (the mesa toolchain gives software OpenGL without it). Browsers in the sandbox never use it (they draw in software)."),
@@ -62,7 +62,7 @@ export const SandboxSchema = z.strictObject({
     protectedClient: z.boolean().describe('Run the sandbox window in Protected Client mode (recommended).'),
     headless: z
         .boolean()
-        .describe('Hide the sandbox window (sbx-show brings it back). A headless sandbox shuts down when its last session ends.'),
+        .describe('Hide the sandbox window ("Show the window" brings it back). A headless sandbox shuts down when its last session ends.'),
     keepAwake: z
         .boolean()
         .describe('Keep this PC from sleeping while a sandbox runs, so agents left working overnight keep going (the screen may still turn off; closing a laptop lid still sleeps it).'),

package/dist/guest/apps/app-installer.js

@@ -140,7 +140,7 @@ export class AppInstaller {
         }
         catch (e) {
             warn(entry.name + ' could not be installed and is skipped; the other apps are not affected. Reason: ' + errMsg(e));
-            this.env.summary.push(entry.name + ': FAILED');
+            this.env.summary.push('store' in entry.source ? entry.name + ': not installed - ' + errMsg(e).slice(0, 300) : entry.name + ': FAILED');
         }
     }
     /** The command line an app's shortcut starts it with (Comet: its own profile, DevTools on 127.0.0.1). */

package/dist/guest/apps/store-check.d.ts

@@ -4,5 +4,7 @@ export interface CheckedPackage {
     readonly main: string;
     readonly dependencies: string[];
 }
+/** Why a Store app has no package here, and what to do (the PC's launch notes say what went wrong there). */
+export declare const MISSING_PACKAGE = "this PC did not hand over its package (it could not fetch it: see the launch notes). Fix: on this PC run \"winget download --id <product id> --source msstore\", then launch again";
 /** The package in `dir` when its manifest is valid and every file is there as hashed; throws otherwise. */
 export declare function checkedPackage(dir: string): Promise<CheckedPackage>;

package/dist/guest/apps/store-check.js

@@ -16,11 +16,13 @@ export function fileSha256(file) {
         stream.on('end', () => resolve(hash.digest('hex')));
     });
 }
+/** Why a Store app has no package here, and what to do (the PC's launch notes say what went wrong there). */
+export const MISSING_PACKAGE = 'this PC did not hand over its package (it could not fetch it: see the launch notes). Fix: on this PC run "winget download --id <product id> --source msstore", then launch again';
 /** The package in `dir` when its manifest is valid and every file is there as hashed; throws otherwise. */
 export async function checkedPackage(dir) {
     const manifest = readValid(StorePackageManifestSchema, path.join(dir, STORE_PACKAGE_MANIFEST));
     if (!manifest)
-        throw new Error('the package was not handed over (this PC could not fetch it: see the launch notes)');
+        throw new Error(MISSING_PACKAGE);
     for (const f of manifest.files) {
         if ((await fileSha256(path.join(dir, f.name)).catch(() => '')) !== f.sha256)
             throw new Error(f.name + ' is missing or changed');

package/dist/guest/boot/guide-lines.d.ts

@@ -23,3 +23,5 @@ export declare function projectFolderLines(workspace: string, workspaceHost: str
  * (a project that has not been set up yet is not listed: its tools are decided from its own files).
  */
 export declare function toolLines(primaryName: string, toolSummary: readonly string[], projects: readonly GuideProject[]): string[];
+/** The PC logs line, only when the launch folder has them (a launch of the sandbox's own source repo). */
+export declare function pcLogsGuideLine(launchDir: string, exists: (dir: string) => boolean): string[];

package/dist/guest/boot/guide-lines.js

@@ -39,3 +39,10 @@ export function toolLines(primaryName, toolSummary, projects) {
         "- Tools by project: each project gets the tools its own files ask for; python and rust already installed here are on every project's PATH.",
     ];
 }
+/** The PC logs line, only when the launch folder has them (a launch of the sandbox's own source repo). */
+export function pcLogsGuideLine(launchDir, exists) {
+    const dir = path.win32.join(launchDir, 'pc-logs');
+    return exists(dir)
+        ? ['- PC crash reports and logs (this project only, read-only, never commit them): `' + dir + '`']
+        : [];
+}

package/dist/guest/boot/guide.js

@@ -6,7 +6,7 @@ import { claudeDir, session, stateDir, workspace } from '../runtime/session.js';
 import { dataDir, launchDir, logsDir, toolsDir } from '../runtime/paths.js';
 import { addonGuideLine, APPS, headroomGuideLine, RTK_GUIDE_LINE } from '../../shared/apps/index.js';
 import { installedAddon, installedRtk } from '../setup/agent-addons.js';
-import { projectFolderLines, toolLines } from './guide-lines.js';
+import { pcLogsGuideLine, projectFolderLines, toolLines } from './guide-lines.js';
 import { sandboxScriptsDir } from '../../shared/scripts.js';
 import { findUproject, unrealGuideLines } from '../../shared/unreal/index.js';
 import { DISK } from '../toolchains/engines/unreal-engines.js';
@@ -84,6 +84,7 @@ export function sandboxGuide(toolSummary, lan = 'blocked', projects = [], addons
             '`',
         '- RO: `' + launchDir + "` (this boot's scripts) · lost on close: everything else, incl. `C:\\nvm` (Node symlink)",
         ...mirrorLine(),
+        ...pcLogsGuideLine(launchDir, fs.existsSync),
         ...toolLines(session.project, toolSummary, projects),
         ...unrealLines(projects),
         ...unityLines(projects),

package/dist/guest/daemon/heartbeat.js

@@ -23,6 +23,7 @@ export function buildHeartbeat(snapshot, sessionCount, uptimeSeconds, freeBytes,
         ...(snapshot?.diskQueue !== null && snapshot?.diskQueue !== undefined
             ? { diskQueueReported: snapshot.diskQueue }
             : {}),
+        ...(snapshot && snapshot.held > 0 ? { held: Math.min(1024, snapshot.held) } : {}),
         phase: ending ? 'ending' : sessionCount > 0 ? 'working' : 'ready',
     };
 }

package/dist/guest/governor/core.d.ts

@@ -1,12 +1,62 @@
 import type { PressureStatus } from '../../shared/channel/schema.js';
-import type { LoadProfile } from '../../shared/memory/index.js';
+import { z } from 'zod';
+import { type LoadProfile } from '../../shared/memory/index.js';
 import { type GovernorState, type MemSample } from './decide.js';
+/** memgov.exe's arguments: samples every 2 s and the memory gate for this profile. */
+export declare function memgovArgs(profile: LoadProfile): string[];
+/** What the memory gate in memgov reports on its stdout (one JSON line each). */
+export declare const GateEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"ready">;
+    mode: z.ZodEnum<{
+        notify: "notify";
+        poll: "poll";
+    }>;
+    growthMb: z.ZodNumber;
+    windowMs: z.ZodNumber;
+    event: z.ZodLiteral<"gate">;
+    at: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"off">;
+    reason: z.ZodString;
+    event: z.ZodLiteral<"gate">;
+    at: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"trip">;
+    grewMb: z.ZodNumber;
+    ms: z.ZodNumber;
+    jobMb: z.ZodNumber;
+    held: z.ZodArray<z.ZodObject<{
+        pid: z.ZodNumber;
+        name: z.ZodString;
+    }, z.core.$strict>>;
+    event: z.ZodLiteral<"gate">;
+    at: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"hold">;
+    pid: z.ZodNumber;
+    name: z.ZodString;
+    event: z.ZodLiteral<"gate">;
+    at: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"release">;
+    pid: z.ZodNumber;
+    name: z.ZodString;
+    heldMs: z.ZodNumber;
+    forced: z.ZodBoolean;
+    event: z.ZodLiteral<"gate">;
+    at: z.ZodNumber;
+}, z.core.$strict>], "kind">;
+export type GateEvent = z.output<typeof GateEventSchema>;
+/** One memory-log line for a gate event (names cut to 64 characters). */
+export declare function gateLine(e: GateEvent): string;
 /** The newest numbers the governor saw (for the heartbeat file). */
 export interface GovernorSnapshot {
     readonly ramFreePercent: number;
     readonly commitPercent: number;
     readonly step: number;
     readonly hostStep: number;
+    /** Build programs the memory gate holds now. */
+    readonly held: number;
     readonly diskQueue: number | null;
     readonly top: readonly {
         readonly name: string;
@@ -57,6 +107,8 @@ export declare class GovernorCore {
     get snapshot(): GovernorSnapshot | null;
     get current(): GovernorState;
     onSample(sample: MemSample): void;
+    /** An event from the memory gate in memgov: goes to the memory log. */
+    onGate(event: GateEvent): void;
     private apply;
     private note;
 }

package/dist/guest/governor/core.js

@@ -1,6 +1,94 @@
 import { now } from '../../shared/channel/run-dir.js';
+import { z } from 'zod';
+import { BURST_GATE } from '../../shared/memory/index.js';
 import { errMsg } from '../../core/util/errors.js';
-import { decide, HOLD_MS, INITIAL_STATE } from './decide.js';
+import { decide, GATE_NAMES, HOLD_MS, INITIAL_STATE, } from './decide.js';
+/** memgov.exe's arguments: samples every 2 s and the memory gate for this profile. */
+export function memgovArgs(profile) {
+    const g = BURST_GATE[profile];
+    return [
+        'serve',
+        '--interval',
+        '2',
+        '--gate',
+        [g.growthMb, g.windowMs, g.releaseMs, g.maxHoldMs].join(':'),
+        '--gate-names',
+        GATE_NAMES.join(','),
+    ];
+}
+const GateBase = { event: z.literal('gate'), at: z.number() };
+const GateName = z.string().max(128);
+const GateCount = z.number().int().min(0);
+/** What the memory gate in memgov reports on its stdout (one JSON line each). */
+export const GateEventSchema = z.discriminatedUnion('kind', [
+    z.strictObject({
+        ...GateBase,
+        kind: z.literal('ready'),
+        mode: z.enum(['notify', 'poll']),
+        growthMb: GateCount,
+        windowMs: GateCount,
+    }),
+    z.strictObject({ ...GateBase, kind: z.literal('off'), reason: z.string().max(200) }),
+    z.strictObject({
+        ...GateBase,
+        kind: z.literal('trip'),
+        grewMb: GateCount,
+        ms: GateCount,
+        jobMb: GateCount,
+        held: z.array(z.strictObject({ pid: z.number().int(), name: GateName })).max(64),
+    }),
+    z.strictObject({ ...GateBase, kind: z.literal('hold'), pid: z.number().int(), name: GateName }),
+    z.strictObject({
+        ...GateBase,
+        kind: z.literal('release'),
+        pid: z.number().int(),
+        name: GateName,
+        heldMs: GateCount,
+        forced: z.boolean(),
+    }),
+]);
+/** One memory-log line for a gate event (names cut to 64 characters). */
+export function gateLine(e) {
+    const cut = (s) => s.slice(0, 64);
+    switch (e.kind) {
+        case 'ready':
+            return ('gate: on (' +
+                e.mode +
+                "): new compilers wait when the agents' programs grow by more than " +
+                e.growthMb +
+                ' MB within ' +
+                e.windowMs / 1000 +
+                ' s');
+        case 'off':
+            return 'gate: off (' + e.reason + '): builds are only slowed down by the dial';
+        case 'trip':
+            return ("gate: the agents' programs grew " +
+                e.grewMb +
+                ' MB in ' +
+                (e.ms / 1000).toFixed(1) +
+                ' s (now ' +
+                e.jobMb +
+                ' MB); holding ' +
+                e.held.length +
+                ': ' +
+                e.held
+                    .slice(0, 8)
+                    .map((p) => cut(p.name) + ' (' + p.pid + ')')
+                    .join(', ') +
+                (e.held.length > 8 ? ' …' : ''));
+        case 'hold':
+            return 'gate: ' + cut(e.name) + ' (' + e.pid + ') waits at start while a build burst goes through in turn';
+        case 'release':
+            return ('gate: ' +
+                cut(e.name) +
+                ' (' +
+                e.pid +
+                ') goes on after ' +
+                (e.heldMs / 1000).toFixed(1) +
+                ' s' +
+                (e.forced ? ' (the longest it may wait)' : ''));
+    }
+}
 const STEP_TEXT = [
     'builds back to normal',
     'build programs at lower priority',
@@ -55,6 +143,7 @@ export class GovernorCore {
             commitPercent: d.commitPercent,
             step: d.state.step,
             hostStep: nowMs < d.state.hostUntil ? d.state.hostStep : 0,
+            held: sample.gateHeld ?? 0,
             diskQueue: null,
             top: [...sample.procs]
                 .sort((a, b) => b.mb - a.mb)
@@ -89,6 +178,7 @@ export class GovernorCore {
             paused: [...this.held]
                 .slice(0, 8)
                 .map(([pid, name]) => ({ name: name.slice(0, 64), pid, seconds: HOLD_MS / 1000 })),
+            held: sample.gateHeld ?? 0,
             cpuPercent: d.state.cpuRate,
             pcLow: nowMs < d.state.hostUntil,
             lastAction: this.lastAction.slice(0, 300),
@@ -102,6 +192,10 @@ export class GovernorCore {
             this.deps.saveStatus(status);
         }
     }
+    /** An event from the memory gate in memgov: goes to the memory log. */
+    onGate(event) {
+        this.note(gateLine(event));
+    }
     apply(action) {
         const port = this.deps.port;
         try {

package/dist/guest/governor/decide.d.ts

@@ -16,6 +16,8 @@ export interface MemSample {
     readonly commitAvailMb: number;
     /** Only the processes in the agents' job. */
     readonly procs: readonly ProcSample[];
+    /** Build programs the memory gate holds now (memgov). */
+    readonly gateHeld?: number;
 }
 export declare const isNeverTouched: (name: string) => boolean;
 export declare const canLower: (name: string) => boolean;
@@ -24,6 +26,8 @@ export declare const isLinker: (name: string) => boolean;
 export declare function linkerSlots(totalMb: number, cpus: number): number;
 export declare const isHeavyCompiler: (name: string) => boolean;
 export declare const canPause: (name: string) => boolean;
+/** What the memory gate in memgov may freeze (compilers, linkers, Unreal's shader workers); passed as --gate-names. */
+export declare const GATE_NAMES: readonly string[];
 export type Level = 'ok' | 'throttled' | 'suspending';
 export interface GovernorState {
     /** The dial: 0 nothing wrong, 1 lower priority, 2 less CPU and fewer compilers, 3 and 4 harder. */

package/dist/guest/governor/decide.js

@@ -109,6 +109,8 @@ export function linkerSlots(totalMb, cpus) {
 }
 export const isHeavyCompiler = (name) => !isNeverTouched(name) && HEAVY.has(key(name));
 export const canPause = (name) => !isNeverTouched(name) && COMPILERS.has(key(name));
+/** What the memory gate in memgov may freeze (compilers, linkers, Unreal's shader workers); passed as --gate-names. */
+export const GATE_NAMES = [...COMPILERS, 'shadercompileworker'].filter((n) => !NEVER.has(n)).sort();
 export const INITIAL_STATE = {
     step: 0,
     calm: 0,

package/dist/guest/governor/governor.js

@@ -1,6 +1,7 @@
 // The memory governor: samples the sandbox's memory every 2 seconds (memgov.exe, sandbox/csharp/MemGov.cs) and turns
 // a dial as it fills: the build programs the agents started get lower priority, lower memory priority, less CPU, and
-// take turns (decide.ts). Builds slow down; nothing fails. What it does goes to the memory log and run\pressure.json.
+// take turns (decide.ts). A memory gate in memgov also holds new compilers when memory grows faster than a few GB in
+// seconds. Builds slow down; nothing fails. What it does goes to the memory log and run\pressure.json.
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -8,14 +9,14 @@ import { spawn } from 'node:child_process';
 import { createInterface } from 'node:readline';
 import { z } from 'zod';
 import { writeJsonAtomic } from '../../shared/io/json.js';
-import { DIAL_STEPS, maxCompilers } from '../../shared/memory/index.js';
+import { BURST_GATE, DIAL_STEPS, maxCompilers } from '../../shared/memory/index.js';
 import { ensureCompiled } from '../runtime/csc.js';
 import { dataDir } from '../runtime/paths.js';
 import { warn } from '../runtime/log.js';
 import { run } from '../runtime/paths.js';
 import { session } from '../runtime/session.js';
 import { errMsg } from '../../core/util/errors.js';
-import { GovernorCore } from './core.js';
+import { GateEventSchema, GovernorCore, memgovArgs, } from './core.js';
 const SampleSchema = z.object({
     ramTotalMb: z.number(),
     ramAvailMb: z.number(),
@@ -29,27 +30,36 @@ const SampleSchema = z.object({
         prio: z.enum(['idle', 'below', 'normal']).catch('normal'),
     }))
         .max(1024),
+    gateHeld: z.number().int().min(0).max(1024).optional().catch(undefined),
 });
 /** memgov.exe as a child process: samples come out of its stdout, commands go into its stdin. */
 class MemGovProcess {
+    args;
     onSample;
+    onGate;
     child = null;
-    constructor(onSample) {
+    constructor(args, onSample, onGate) {
+        this.args = args;
         this.onSample = onSample;
+        this.onGate = onGate;
     }
     start() {
         try {
-            const child = spawn(ensureCompiled('memgov'), ['serve', '--interval', '2'], {
+            const child = spawn(ensureCompiled('memgov'), [...this.args], {
                 stdio: ['pipe', 'pipe', 'ignore'],
                 windowsHide: true,
             });
             this.child = child;
             createInterface({ input: child.stdout }).on('line', (line) => {
                 try {
-                    this.onSample(SampleSchema.parse(JSON.parse(line)));
+                    const raw = JSON.parse(line);
+                    if (typeof raw === 'object' && raw !== null && raw.event === 'gate')
+                        this.onGate(GateEventSchema.parse(raw));
+                    else
+                        this.onSample(SampleSchema.parse(raw));
                 }
                 catch (e) {
-                    warn('governor: bad sample: ' + errMsg(e));
+                    warn('governor: bad line from memgov: ' + errMsg(e));
                 }
             });
             child.stdin.on('error', () => undefined);
@@ -120,13 +130,17 @@ export class Governor {
                 first.availablePercent +
                 '% free RAM or ' +
                 first.commitPercent +
-                '% commit, in steps';
+                '% commit, in steps; holds new compilers when memory grows faster than ' +
+                BURST_GATE[profile].growthMb +
+                ' MB in ' +
+                BURST_GATE[profile].windowMs / 1000 +
+                ' s';
     }
     start() {
         if (session.pressureResponse === false)
             return;
         const profile = session.loadProfile === 'gentle' ? 'gentle' : 'normal';
-        const proc = new MemGovProcess((s) => this.core?.onSample(s));
+        const proc = new MemGovProcess(memgovArgs(profile), (s) => this.core?.onSample(s), (e) => this.core?.onGate(e));
         this.core = new GovernorCore({
             port: proc,
             profile,

package/dist/guest/toolchains/runtimes.js

@@ -28,12 +28,13 @@ export async function setupSingleExe(env, name, repo, pattern, exeName, dir, opt
 }
 export async function setupBun(env) {
     await setupSingleExe(env, 'bun', 'oven-sh/bun', arch === 'arm64' ? /^bun-windows-aarch64\.zip$/ : /^bun-windows-x64\.zip$/, 'bun.exe', tool('bun', 'bin'), { size: '35 MB' });
-    // Bun cannot keep its cache or temp files on a mapped folder (EINVAL); they go to the sandbox's own disk.
-    Object.assign(env.vars, {
-        BUN_INSTALL: tool('bun'),
-        BUN_INSTALL_CACHE_DIR: path.join(localDir, 'bun-cache'),
-        BUN_TMPDIR: path.join(localDir, 'bun-tmp'),
-    });
+    // Bun cannot keep its cache or temp files on a mapped folder (EINVAL); they go to the sandbox's own disk. The temp
+    // folder must exist: programs compiled with Bun (opencode) unpack their DLLs there and fail when it is missing.
+    const cache = path.join(localDir, 'bun-cache');
+    const temp = path.join(localDir, 'bun-tmp');
+    if (!dryRun)
+        [cache, temp].forEach((dir) => mkdirp(dir));
+    Object.assign(env.vars, { BUN_INSTALL: tool('bun'), BUN_INSTALL_CACHE_DIR: cache, BUN_TMPDIR: temp });
 }
 export async function setupDeno(env) {
     await setupSingleExe(env, 'deno', 'denoland/deno', arch === 'arm64' ? /^deno-aarch64-pc-windows-msvc[.]zip$/ : /^deno-x86_64-pc-windows-msvc[.]zip$/, 'deno.exe', tool('deno', 'bin'), { size: '40 MB' });

package/dist/host/accounts/deliver.js

@@ -1,4 +1,4 @@
-import { fingerprint, SERVICE_KINDS, SERVICE_SPECS, serviceWanted, } from '../../shared/accounts/index.js';
+import { appsNeededFor, fingerprint, SERVICE_KINDS, SERVICE_SPECS, serviceWanted, usedByText, } from '../../shared/accounts/index.js';
 import { setNameOf } from '../storage/index.js';
 import { takeHandoffs } from './handoff.js';
 import { AccountLeases } from './leases.js';
@@ -62,8 +62,22 @@ export function prepareServiceAccounts(i) {
     }
     for (const kind of SERVICE_KINDS) {
         const spec = SERVICE_SPECS[kind];
-        if (!i.config.accounts[kind].share || !serviceWanted(kind, i.on))
+        if (!i.config.accounts[kind].share)
             continue;
+        if (!serviceWanted(kind, i.on)) {
+            const apps = appsNeededFor(kind);
+            if (apps.length)
+                notes.push('Your ' +
+                    spec.label +
+                    ' sign-in is on (accounts.' +
+                    kind +
+                    '.share) but ' +
+                    usedByText(spec.usedBy) +
+                    ' is not installed, so there is nothing to hand it to. Fix: turn the app on in Apps (apps.install: ' +
+                    apps.join(', ') +
+                    ').');
+            continue;
+        }
         const off = i.others.find((o) => !o.config.accounts[kind].share);
         if (off) {
             notes.push('Your ' + spec.label + ' sign-in was not handed over: ' + off.name + ' (also in this sandbox) turns it off.');

package/dist/host/apps/store-package.d.ts

@@ -12,6 +12,8 @@ export declare const spawnStoreRunner: StoreRunner;
 /** What an app needs fetched (catalogue source.store). */
 export interface StoreApp {
     readonly id: string;
+    /** The name the notes use (the catalogue's); the id when not given. */
+    readonly name?: string;
     readonly productId: string;
     readonly packageName: string;
 }

package/dist/host/apps/store-package.js

@@ -10,7 +10,7 @@ import { spawn } from 'node:child_process';
 import { z } from 'zod';
 import { assertNoLinks, errMsg } from '../../core/util/index.js';
 import { readValid } from '../../shared/io/index.js';
-import { isStorePackageFile, STORE_PACKAGE_MANIFEST, StorePackageManifestSchema, storePackageRole, } from '../../shared/apps/index.js';
+import { isStorePackageFile, STORE_PACKAGE_MANIFEST, StorePackageManifestSchema, assignStoreRoles, storePackageFitsX64, } from '../../shared/apps/index.js';
 import { SYSTEM } from '../../shared/system.js';
 import { nativeScript } from '../native.js';
 import { hostDataFolder } from '../storage/contained/index.js';
@@ -24,6 +24,8 @@ const ScriptResultSchema = z.object({
     ok: z.boolean(),
     message: z.string().max(2000),
     files: z.array(z.string().max(300)).max(64),
+    /** The files that came from winget's Dependencies folder (the frameworks); the rest is the app. */
+    dependencies: z.array(z.string().max(300)).max(64).default([]),
 });
 export const spawnStoreRunner = (exe, args, timeoutMs) => new Promise((resolve) => {
     const child = spawn(exe, [...args], { windowsHide: true });
@@ -117,16 +119,15 @@ export class StorePackages {
         }
         if (!parsed.ok)
             throw new Error(parsed.message);
-        const files = parsed.files
-            .filter((n) => isStorePackageFile(n) && n === path.basename(n) && fs.existsSync(path.join(work, n)))
-            .map((name) => {
+        const frameworks = new Set(parsed.dependencies.map((n) => n.toLowerCase()));
+        // Only the builds that run on this sandbox (64-bit): the 32-bit and ARM frameworks winget may add are left out.
+        const names = parsed.files.filter((n) => isStorePackageFile(n) &&
+            n === path.basename(n) &&
+            fs.existsSync(path.join(work, n)) &&
+            !(frameworks.has(n.toLowerCase()) && !storePackageFitsX64(n)));
+        const files = assignStoreRoles(names, app.packageName, parsed.dependencies).map(({ name, role }) => {
             const full = path.join(work, name);
-            return {
-                name,
-                role: storePackageRole(name, app.packageName),
-                sha256: sha256Of(full),
-                bytes: fs.statSync(full).size,
-            };
+            return { name, role, sha256: sha256Of(full), bytes: fs.statSync(full).size };
         });
         const manifest = StorePackageManifestSchema.parse({
             productId: app.productId,
@@ -197,12 +198,12 @@ export async function prepareStorePackages(apps, o) {
             notes.push(app.id + ': package ' + note + ' (' + manifest.files.length + ' files)');
         }
         catch (e) {
-            notes.push(app.id +
-                ' is not prepared: ' +
-                errMsg(e) +
-                ' Fix: sign in to the Microsoft Store on this PC and check that winget works (winget download --id ' +
+            notes.push((app.name ?? app.id) +
+                ': NOT installed in this sandbox. ' +
+                errMsg(e).replace(/\.$/, '') +
+                '. Fix: sign in to the Microsoft Store on this PC and check that winget works (winget download --id ' +
                 app.productId +
-                ' --source msstore), then launch again.');
+                ' --source msstore --architecture x64 --download-directory <an empty folder>), then launch again.');
         }
     }
     return { notes };

package/dist/host/channel/attach.js

@@ -61,7 +61,7 @@ export async function attachTerminal(session, o = {}) {
     const endpoint = hostEndpoint(session) ??
         fail("Refusing to connect: the sandbox reported no address on this PC's Hyper-V (vEthernet) network (" +
             session.attach.addresses.join(', ') +
-            ').', 'Use the sandbox window instead (sbx-show); if this keeps happening, run sandbox doctor.');
+            ').', 'Use the sandbox window instead (sandbox show); if this keeps happening, run sandbox doctor.');
     const socket = await connect(endpoint);
     console.log('Attaching to ' +
         safeText(session.harness) +

package/dist/host/channel/channel.js

@@ -50,7 +50,7 @@ export class SandboxChannel {
                 fail('Windows Sandbox closed (or is not running).', 'Start it again with sandbox claude; sandbox logs shows what happened.');
             await sleep(500);
         }
-        fail(timeoutMessage, 'Check what the sandbox is doing with sandbox logs -f (or sbx-show to see its window).');
+        fail(timeoutMessage, 'Check what the sandbox is doing with sandbox logs -f (or sandbox show to see its window).');
     }
     /** Deletes an answer once read; a planted link means the answer is read and nothing is deleted. */
     dropResponse(requestId) {
@@ -73,7 +73,7 @@ export class SandboxChannel {
             const status = this.run.readSandboxStatus();
             if (!status || (launchId !== null && status.launchId !== launchId)) {
                 if (bootSilent(Date.now() - started, seen))
-                    fail('The sandbox has not reported anything for ' + Math.round(FIRST_STATUS_MS / 60000) + ' minutes.', 'It may still be starting, or it cannot reach its folders. Look at its window (sbx-show), the run folder ' +
+                    fail('The sandbox has not reported anything for ' + Math.round(FIRST_STATUS_MS / 60000) + ' minutes.', 'It may still be starting, or it cannot reach its folders. Look at its window (sandbox show), the run folder ' +
                         this.run.root +
                         ' and the data folder ' +
                         this.dataPath +
@@ -87,7 +87,7 @@ export class SandboxChannel {
                 last = status.message;
             }
             if (status.phase === 'failed')
-                fail('The sandbox failed to start: ' + status.message, 'See sandbox logs for details; the sandbox window shows the error too (sbx-show if headless).');
+                fail('The sandbox failed to start: ' + status.message, 'See sandbox logs for details; the sandbox window shows the error too (sandbox show if headless).');
             return status.phase === 'ready' ? status : null;
         }, 'Timed out waiting for the sandbox to finish provisioning.');
     }