windows-development-sandbox 1.28.0 → 1.29.0

package/dist/cli/commands/launch/launch.js

@@ -417,7 +417,7 @@ class Launcher {
             console.log(headsUp + '\nFollow along: sandbox logs -f');
         if (hidden)
             console.log((await hidden)
-                ? 'Sandbox running headless. Open the window: sbx-show   Attach here: sandbox claude -t'
+                ? 'Sandbox running headless. Open the window: sandbox show   Attach here: sandbox claude -t'
                 : 'Could not find the sandbox window to hide (it may still be starting); run sandbox hide in a moment.');
         else
             console.log('Sandbox starting. ' +

package/dist/cli/commands/launch/running.js

@@ -114,7 +114,7 @@ export async function openSession(ctx, ready, joined, o) {
         session.id +
         ' opened in a new tab inside the sandbox. Attach here with: sandbox attach ' +
         session.id +
-        (ready.headless ? '   (headless: sbx-show opens the window)' : ''));
+        (ready.headless ? '   (headless: sandbox show opens the window)' : ''));
     return 0;
 }
 /** The sessions a launch asks for: each --session, else one (the agent, in this folder). */
@@ -169,7 +169,7 @@ async function openSessions(ctx, ready, list) {
     if (!first)
         return 1;
     console.log('Each has its own tab inside the sandbox' +
-        (ready.headless ? ' (headless: sbx-show opens the window)' : '') +
+        (ready.headless ? ' (headless: sandbox show opens the window)' : '') +
         '. Attach to any of them, from any terminal: sandbox attach');
     return results.every((r) => r.status === 'fulfilled') ? 0 : 1;
 }

package/dist/cli/index.js

@@ -17,7 +17,7 @@ import { versionText } from './version.js';
 import { HANDLERS } from './commands/index.js';
 import { definitionHandler, operationHandler } from './operations/index.js';
 import { runUpdate } from '../app/features/updates/index.js';
-const entry = path.join(PACKAGE_ROOT, 'dist', 'bin', 'agent-sandbox.js');
+const entry = path.join(PACKAGE_ROOT, 'dist', 'bin', 'sandbox.js');
 /** A first word that is no command and no agent, but close to one: "Did you mean: sandbox status?". */
 function failOnTypo(word, agents) {
     const names = [...COMMANDS.filter((c) => !c.hidden).map((c) => c.name), ...agents];

package/dist/cli/menu/pages/agents-page.js

@@ -152,7 +152,7 @@ export function agentsOptions(m, cwd = process.cwd()) {
                 category: 'options',
                 section: 'This start',
                 hint: WINDOW_TEXT[m.window],
-                description: 'Hide or show the Windows Sandbox window (sbx-show brings a hidden one back).',
+                description: 'Hide or show the Windows Sandbox window (sandbox show brings a hidden one back).',
             },
             {
                 value: 'opt:folder',

package/dist/cli/services/sandbox-service.js

@@ -71,7 +71,7 @@ export class SandboxService {
     }
     async hideWindow() {
         if (!(await hideSandboxWindow(this.ctx.storageRoot, 5)))
-            fail('Could not find a visible Windows Sandbox window.', 'It may already be hidden (sbx-show brings it back).');
+            fail('Could not find a visible Windows Sandbox window.', 'It may already be hidden (sandbox show brings it back).');
     }
     /** What stopping ends. Fails when this sandbox was not started by this tool. */
     stopPlan() {

package/dist/core/schema/sandbox.js

@@ -62,7 +62,7 @@ export const SandboxSchema = z.strictObject({
     protectedClient: z.boolean().describe('Run the sandbox window in Protected Client mode (recommended).'),
     headless: z
         .boolean()
-        .describe('Hide the sandbox window (sbx-show brings it back). A headless sandbox shuts down when its last session ends.'),
+        .describe('Hide the sandbox window ("Show the window" brings it back). A headless sandbox shuts down when its last session ends.'),
     keepAwake: z
         .boolean()
         .describe('Keep this PC from sleeping while a sandbox runs, so agents left working overnight keep going (the screen may still turn off; closing a laptop lid still sleeps it).'),

package/dist/guest/apps/app-installer.js

@@ -140,7 +140,7 @@ export class AppInstaller {
         }
         catch (e) {
             warn(entry.name + ' could not be installed and is skipped; the other apps are not affected. Reason: ' + errMsg(e));
-            this.env.summary.push(entry.name + ': FAILED');
+            this.env.summary.push('store' in entry.source ? entry.name + ': not installed - ' + errMsg(e).slice(0, 300) : entry.name + ': FAILED');
         }
     }
     /** The command line an app's shortcut starts it with (Comet: its own profile, DevTools on 127.0.0.1). */

package/dist/guest/apps/store-check.d.ts

@@ -4,5 +4,7 @@ export interface CheckedPackage {
     readonly main: string;
     readonly dependencies: string[];
 }
+/** Why a Store app has no package here, and what to do (the PC's launch notes say what went wrong there). */
+export declare const MISSING_PACKAGE = "this PC did not hand over its package (it could not fetch it: see the launch notes). Fix: on this PC run \"winget download --id <product id> --source msstore\", then launch again";
 /** The package in `dir` when its manifest is valid and every file is there as hashed; throws otherwise. */
 export declare function checkedPackage(dir: string): Promise<CheckedPackage>;

package/dist/guest/apps/store-check.js

@@ -16,11 +16,13 @@ export function fileSha256(file) {
         stream.on('end', () => resolve(hash.digest('hex')));
     });
 }
+/** Why a Store app has no package here, and what to do (the PC's launch notes say what went wrong there). */
+export const MISSING_PACKAGE = 'this PC did not hand over its package (it could not fetch it: see the launch notes). Fix: on this PC run "winget download --id <product id> --source msstore", then launch again';
 /** The package in `dir` when its manifest is valid and every file is there as hashed; throws otherwise. */
 export async function checkedPackage(dir) {
     const manifest = readValid(StorePackageManifestSchema, path.join(dir, STORE_PACKAGE_MANIFEST));
     if (!manifest)
-        throw new Error('the package was not handed over (this PC could not fetch it: see the launch notes)');
+        throw new Error(MISSING_PACKAGE);
     for (const f of manifest.files) {
         if ((await fileSha256(path.join(dir, f.name)).catch(() => '')) !== f.sha256)
             throw new Error(f.name + ' is missing or changed');

package/dist/guest/boot/guide-lines.d.ts

@@ -23,3 +23,5 @@ export declare function projectFolderLines(workspace: string, workspaceHost: str
  * (a project that has not been set up yet is not listed: its tools are decided from its own files).
  */
 export declare function toolLines(primaryName: string, toolSummary: readonly string[], projects: readonly GuideProject[]): string[];
+/** The PC logs line, only when the launch folder has them (a launch of the sandbox's own source repo). */
+export declare function pcLogsGuideLine(launchDir: string, exists: (dir: string) => boolean): string[];

package/dist/guest/boot/guide-lines.js

@@ -39,3 +39,10 @@ export function toolLines(primaryName, toolSummary, projects) {
         "- Tools by project: each project gets the tools its own files ask for; python and rust already installed here are on every project's PATH.",
     ];
 }
+/** The PC logs line, only when the launch folder has them (a launch of the sandbox's own source repo). */
+export function pcLogsGuideLine(launchDir, exists) {
+    const dir = path.win32.join(launchDir, 'pc-logs');
+    return exists(dir)
+        ? ['- PC crash reports and logs (this project only, read-only, never commit them): `' + dir + '`']
+        : [];
+}

package/dist/guest/boot/guide.js

@@ -6,7 +6,7 @@ import { claudeDir, session, stateDir, workspace } from '../runtime/session.js';
 import { dataDir, launchDir, logsDir, toolsDir } from '../runtime/paths.js';
 import { addonGuideLine, APPS, headroomGuideLine, RTK_GUIDE_LINE } from '../../shared/apps/index.js';
 import { installedAddon, installedRtk } from '../setup/agent-addons.js';
-import { projectFolderLines, toolLines } from './guide-lines.js';
+import { pcLogsGuideLine, projectFolderLines, toolLines } from './guide-lines.js';
 import { sandboxScriptsDir } from '../../shared/scripts.js';
 import { findUproject, unrealGuideLines } from '../../shared/unreal/index.js';
 import { DISK } from '../toolchains/engines/unreal-engines.js';
@@ -84,6 +84,7 @@ export function sandboxGuide(toolSummary, lan = 'blocked', projects = [], addons
             '`',
         '- RO: `' + launchDir + "` (this boot's scripts) · lost on close: everything else, incl. `C:\\nvm` (Node symlink)",
         ...mirrorLine(),
+        ...pcLogsGuideLine(launchDir, fs.existsSync),
         ...toolLines(session.project, toolSummary, projects),
         ...unrealLines(projects),
         ...unityLines(projects),

package/dist/guest/toolchains/native/unreal.js

@@ -1,23 +1,20 @@
 // Unreal Engine development, machine-wide (toolchains.unreal, once per boot): the DirectX End-User Runtime the engine
 // lists and the Epic Games Launcher (real installers: they run every boot), the launcher pointed at the data disk for
-// engines and given back the engines it installed there, the Windows SDK debuggers for crash dumps, a check that
-// UnrealBuildTool finds Visual Studio the way it looks (the Setup Configuration API), and its parallel compiles capped.
-// Visual Studio itself is its own step (visual-studio.ts), which the plan runs first; each project's engine is set up
-// by engines/unreal-engines.ts.
+// engines and given back the engines it installed there, the Windows SDK debuggers for crash dumps, and a check that
+// UnrealBuildTool finds Visual Studio the way it looks (the Setup Configuration API). Visual Studio itself is its own
+// step (visual-studio.ts), which the plan runs first; each project's engine is set up by engines/unreal-engines.ts.
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { errMsg } from '../../../core/util/errors.js';
 import { readValid } from '../../../shared/io/json.js';
 import { safeRemove } from '../../../shared/io/safe-remove.js';
-import { buildJobs, ubtBuildConfiguration, usableCpus } from '../../../shared/memory/index.js';
 import { VsSetupReportSchema, vsVerdict } from '../../../shared/unreal/index.js';
 import { runInstaller } from '../../runtime/pools.js';
 import { dryRun } from '../../runtime/paths.js';
 import { exists, mkdirp } from '../../runtime/fs.js';
 import { log, warn } from '../../runtime/log.js';
 import { runScriptAsync } from '../../runtime/process.js';
-import { session } from '../../runtime/session.js';
 import { ensureLauncher, fetchLauncher, placeEngines, restoreLauncherItems } from '../engines/epic-launcher.js';
 import { resetUnrealStatus, updateUnrealStatus } from '../engines/unreal-status.js';
 import { SIGNERS, signedInstaller } from '../installers.js';
@@ -71,18 +68,6 @@ async function checkVisualStudio() {
         fs.rmSync(dir, { recursive: true, force: true });
     }
 }
-/**
- * UnrealBuildTool's per-user BuildConfiguration.xml (%APPDATA%, wiped with the sandbox): compiles at once from the
- * sandbox's build budget, so a build start cannot outrun the memory Windows backs the sandbox with. Returns the cap.
- */
-function capUnrealBuilds() {
-    const cpus = usableCpus(os.cpus().length, session.cpuLimitPercent ?? null);
-    const jobs = buildJobs(cpus, os.totalmem() / 1024 ** 3);
-    const appData = process.env.APPDATA ?? 'C:\\Users\\WDAGUtilityAccount\\AppData\\Roaming';
-    const dir = mkdirp(path.join(appData, 'Unreal Engine', 'UnrealBuildTool'));
-    fs.writeFileSync(path.join(dir, 'BuildConfiguration.xml'), ubtBuildConfiguration(jobs), 'utf8');
-    return jobs;
-}
 /** Runs one part, warning (not failing the step) when it does not work. */
 async function part(what, work, fallback) {
     try {
@@ -101,9 +86,6 @@ export async function setupUnreal(env, config, _ctx) {
         return;
     }
     resetUnrealStatus();
-    const jobs = await part('capping parallel compiles', async () => capUnrealBuilds(), 0);
-    if (jobs)
-        log('Unreal: UnrealBuildTool runs at most ' + jobs + ' compiles at once (the build budget)');
     await part('the DirectX End-User Runtime', installDirectX, undefined);
     const launcher = await part('the Epic Games Launcher', ensureLauncher, null);
     // Before anyone opens the launcher: engines go to the data disk, and it knows the ones it installed there before.
@@ -149,7 +131,6 @@ export async function setupUnreal(env, config, _ctx) {
                 vs.version +
                 (check.ok ? ' (UnrealBuildTool finds it)' : ' (UnrealBuildTool would NOT find it)')
             : 'no Visual Studio') +
-        (jobs ? ', at most ' + jobs + ' compiles at once' : '') +
         ', DirectX End-User Runtime' +
         (launcher ? ', Epic Games Launcher' : '') +
         (debuggers ? ', cdb/windbg' : ''));

package/dist/host/accounts/deliver.js

@@ -1,4 +1,4 @@
-import { fingerprint, SERVICE_KINDS, SERVICE_SPECS, serviceWanted, } from '../../shared/accounts/index.js';
+import { appsNeededFor, fingerprint, SERVICE_KINDS, SERVICE_SPECS, serviceWanted, usedByText, } from '../../shared/accounts/index.js';
 import { setNameOf } from '../storage/index.js';
 import { takeHandoffs } from './handoff.js';
 import { AccountLeases } from './leases.js';
@@ -62,8 +62,22 @@ export function prepareServiceAccounts(i) {
     }
     for (const kind of SERVICE_KINDS) {
         const spec = SERVICE_SPECS[kind];
-        if (!i.config.accounts[kind].share || !serviceWanted(kind, i.on))
+        if (!i.config.accounts[kind].share)
             continue;
+        if (!serviceWanted(kind, i.on)) {
+            const apps = appsNeededFor(kind);
+            if (apps.length)
+                notes.push('Your ' +
+                    spec.label +
+                    ' sign-in is on (accounts.' +
+                    kind +
+                    '.share) but ' +
+                    usedByText(spec.usedBy) +
+                    ' is not installed, so there is nothing to hand it to. Fix: turn the app on in Apps (apps.install: ' +
+                    apps.join(', ') +
+                    ').');
+            continue;
+        }
         const off = i.others.find((o) => !o.config.accounts[kind].share);
         if (off) {
             notes.push('Your ' + spec.label + ' sign-in was not handed over: ' + off.name + ' (also in this sandbox) turns it off.');

package/dist/host/apps/store-package.d.ts

@@ -12,6 +12,8 @@ export declare const spawnStoreRunner: StoreRunner;
 /** What an app needs fetched (catalogue source.store). */
 export interface StoreApp {
     readonly id: string;
+    /** The name the notes use (the catalogue's); the id when not given. */
+    readonly name?: string;
     readonly productId: string;
     readonly packageName: string;
 }

package/dist/host/apps/store-package.js

@@ -10,7 +10,7 @@ import { spawn } from 'node:child_process';
 import { z } from 'zod';
 import { assertNoLinks, errMsg } from '../../core/util/index.js';
 import { readValid } from '../../shared/io/index.js';
-import { isStorePackageFile, STORE_PACKAGE_MANIFEST, StorePackageManifestSchema, storePackageRole, } from '../../shared/apps/index.js';
+import { isStorePackageFile, STORE_PACKAGE_MANIFEST, StorePackageManifestSchema, assignStoreRoles, storePackageFitsX64, } from '../../shared/apps/index.js';
 import { SYSTEM } from '../../shared/system.js';
 import { nativeScript } from '../native.js';
 import { hostDataFolder } from '../storage/contained/index.js';
@@ -24,6 +24,8 @@ const ScriptResultSchema = z.object({
     ok: z.boolean(),
     message: z.string().max(2000),
     files: z.array(z.string().max(300)).max(64),
+    /** The files that came from winget's Dependencies folder (the frameworks); the rest is the app. */
+    dependencies: z.array(z.string().max(300)).max(64).default([]),
 });
 export const spawnStoreRunner = (exe, args, timeoutMs) => new Promise((resolve) => {
     const child = spawn(exe, [...args], { windowsHide: true });
@@ -117,16 +119,15 @@ export class StorePackages {
         }
         if (!parsed.ok)
             throw new Error(parsed.message);
-        const files = parsed.files
-            .filter((n) => isStorePackageFile(n) && n === path.basename(n) && fs.existsSync(path.join(work, n)))
-            .map((name) => {
+        const frameworks = new Set(parsed.dependencies.map((n) => n.toLowerCase()));
+        // Only the builds that run on this sandbox (64-bit): the 32-bit and ARM frameworks winget may add are left out.
+        const names = parsed.files.filter((n) => isStorePackageFile(n) &&
+            n === path.basename(n) &&
+            fs.existsSync(path.join(work, n)) &&
+            !(frameworks.has(n.toLowerCase()) && !storePackageFitsX64(n)));
+        const files = assignStoreRoles(names, app.packageName, parsed.dependencies).map(({ name, role }) => {
             const full = path.join(work, name);
-            return {
-                name,
-                role: storePackageRole(name, app.packageName),
-                sha256: sha256Of(full),
-                bytes: fs.statSync(full).size,
-            };
+            return { name, role, sha256: sha256Of(full), bytes: fs.statSync(full).size };
         });
         const manifest = StorePackageManifestSchema.parse({
             productId: app.productId,
@@ -197,12 +198,12 @@ export async function prepareStorePackages(apps, o) {
             notes.push(app.id + ': package ' + note + ' (' + manifest.files.length + ' files)');
         }
         catch (e) {
-            notes.push(app.id +
-                ' is not prepared: ' +
-                errMsg(e) +
-                ' Fix: sign in to the Microsoft Store on this PC and check that winget works (winget download --id ' +
+            notes.push((app.name ?? app.id) +
+                ': NOT installed in this sandbox. ' +
+                errMsg(e).replace(/\.$/, '') +
+                '. Fix: sign in to the Microsoft Store on this PC and check that winget works (winget download --id ' +
                 app.productId +
-                ' --source msstore), then launch again.');
+                ' --source msstore --architecture x64 --download-directory <an empty folder>), then launch again.');
         }
     }
     return { notes };

package/dist/host/channel/attach.js

@@ -61,7 +61,7 @@ export async function attachTerminal(session, o = {}) {
     const endpoint = hostEndpoint(session) ??
         fail("Refusing to connect: the sandbox reported no address on this PC's Hyper-V (vEthernet) network (" +
             session.attach.addresses.join(', ') +
-            ').', 'Use the sandbox window instead (sbx-show); if this keeps happening, run sandbox doctor.');
+            ').', 'Use the sandbox window instead (sandbox show); if this keeps happening, run sandbox doctor.');
     const socket = await connect(endpoint);
     console.log('Attaching to ' +
         safeText(session.harness) +

package/dist/host/channel/channel.js

@@ -50,7 +50,7 @@ export class SandboxChannel {
                 fail('Windows Sandbox closed (or is not running).', 'Start it again with sandbox claude; sandbox logs shows what happened.');
             await sleep(500);
         }
-        fail(timeoutMessage, 'Check what the sandbox is doing with sandbox logs -f (or sbx-show to see its window).');
+        fail(timeoutMessage, 'Check what the sandbox is doing with sandbox logs -f (or sandbox show to see its window).');
     }
     /** Deletes an answer once read; a planted link means the answer is read and nothing is deleted. */
     dropResponse(requestId) {
@@ -73,7 +73,7 @@ export class SandboxChannel {
             const status = this.run.readSandboxStatus();
             if (!status || (launchId !== null && status.launchId !== launchId)) {
                 if (bootSilent(Date.now() - started, seen))
-                    fail('The sandbox has not reported anything for ' + Math.round(FIRST_STATUS_MS / 60000) + ' minutes.', 'It may still be starting, or it cannot reach its folders. Look at its window (sbx-show), the run folder ' +
+                    fail('The sandbox has not reported anything for ' + Math.round(FIRST_STATUS_MS / 60000) + ' minutes.', 'It may still be starting, or it cannot reach its folders. Look at its window (sandbox show), the run folder ' +
                         this.run.root +
                         ' and the data folder ' +
                         this.dataPath +
@@ -87,7 +87,7 @@ export class SandboxChannel {
                 last = status.message;
             }
             if (status.phase === 'failed')
-                fail('The sandbox failed to start: ' + status.message, 'See sandbox logs for details; the sandbox window shows the error too (sbx-show if headless).');
+                fail('The sandbox failed to start: ' + status.message, 'See sandbox logs for details; the sandbox window shows the error too (sandbox show if headless).');
             return status.phase === 'ready' ? status : null;
         }, 'Timed out waiting for the sandbox to finish provisioning.');
     }

package/dist/host/guard/commands.js

@@ -16,6 +16,7 @@ export const COMMANDS = new RegExp('^(' +
         // this tool's own commands (package.json "bin")
         'sandbox',
         'windows-development-sandbox',
+        // Removed commands, still blocked: a planted claude-sbx.cmd would run on a PC where nothing else has that name.
         'agent-sandbox',
         'claude-sbx',
         'claude-sandbox',

package/dist/host/health/path-copies.d.ts

@@ -1,4 +1,4 @@
-export declare const COMMAND_NAMES: readonly ["sandbox", "agent-sandbox", "claude-sbx"];
+export declare const COMMAND_NAMES: readonly ["sandbox"];
 export type CopyKind = 'managed-machine' | 'managed-user' | 'npm' | 'old-scripts' | 'other';
 /** One folder on the PATH that holds the commands. */
 export interface CommandCopy {

package/dist/host/health/path-copies.js

@@ -1,10 +1,10 @@
-// Every copy of the sandbox commands on the PATH (sandbox, agent-sandbox, claude-sbx), in the order Windows finds them:
+// Every copy of the sandbox commands on the PATH (sandbox), in the order Windows finds them:
 // the machine PATH, then yours, and in each folder PATHEXT order. Read only: nothing is run, and a file is only checked
 // for existing. Used by doctor to say which copy runs and how to remove each of the others.
 import fs from 'node:fs';
 import path from 'node:path';
 import { expandVariables } from '../../core/util/index.js';
-export const COMMAND_NAMES = ['sandbox', 'agent-sandbox', 'claude-sbx'];
+export const COMMAND_NAMES = ['sandbox'];
 const normal = (p) => path
     .normalize(expandVariables(p.trim().replace(/^"|"$/g, '')))
     .replace(/[\\/]+$/, '')

package/dist/host/install/index.d.ts

@@ -1,5 +1,5 @@
 export { type InstallScope, InstallLayout, compareVersions, VERSION_PATTERN, NODE_PATTERN } from './layout.js';
-export { shimText, readBins, writeShims } from './shims.js';
+export { shimText, readBins, writeShims, removeStaleShims, REMOVED_COMMANDS } from './shims.js';
 export { InstallRecordFile, InstallRecordSchema, type InstallRecord } from './install-record.js';
 export { UpdateTask } from './scheduled-task.js';
 export { machineInstall, userInstall, managedInstalls, describeCopy, hiddenInstallLine, takeHiddenInstallNotice, } from './copies.js';

package/dist/host/install/index.js

@@ -1,5 +1,5 @@
 export { InstallLayout, compareVersions, VERSION_PATTERN, NODE_PATTERN } from './layout.js';
-export { shimText, readBins, writeShims } from './shims.js';
+export { shimText, readBins, writeShims, removeStaleShims, REMOVED_COMMANDS } from './shims.js';
 export { InstallRecordFile, InstallRecordSchema } from './install-record.js';
 export { UpdateTask } from './scheduled-task.js';
 export { machineInstall, userInstall, managedInstalls, describeCopy, hiddenInstallLine, takeHiddenInstallNotice, } from './copies.js';

package/dist/host/install/shims.d.ts

@@ -6,5 +6,12 @@ import type { InstallLayout } from './layout.js';
 export declare function shimText(name: string, kind: 'cmd' | 'sh', target?: string): string;
 /** The commands a package.json declares (name -> program path inside the package). Invalid names are refused. */
 export declare function readBins(packageJson: unknown): Record<string, string>;
-/** Writes <bin>.cmd and <bin> for every command in `bins` (name -> program path inside the package). */
+/** Commands earlier versions installed (name -> program they ran). Their shims go when nothing declares them. */
+export declare const REMOVED_COMMANDS: Readonly<Record<string, string>>;
+/** Deletes the shim of a removed command, only when the file is exactly the text we wrote for it. */
+export declare function removeStaleShims(layout: InstallLayout, keep?: Readonly<Record<string, string>>): void;
+/**
+ * Writes <bin>.cmd and <bin> for every command in `bins` (name -> program path inside the package), and removes the
+ * shims of commands that no longer exist.
+ */
 export declare function writeShims(layout: InstallLayout, bins: Record<string, string>): void;

package/dist/host/install/shims.js

@@ -1,6 +1,7 @@
 // The commands on PATH. Each one is a tiny script that reads the two pointer files and runs the version they name, so
 // an update never has to rewrite a shim: it only moves the pointers. A .cmd for cmd.exe and PowerShell, and a POSIX
 // script (same name, no extension) for Git Bash.
+import fs from 'node:fs';
 import path from 'node:path';
 import { z } from 'zod';
 import { fail } from '../../core/util/index.js';
@@ -46,10 +47,47 @@ export function readBins(packageJson) {
             fail('package.json declares a command with an invalid name: ' + name);
     return bins;
 }
-/** Writes <bin>.cmd and <bin> for every command in `bins` (name -> program path inside the package). */
+/** Commands earlier versions installed (name -> program they ran). Their shims go when nothing declares them. */
+export const REMOVED_COMMANDS = {
+    'agent-sandbox': 'dist/bin/agent-sandbox.js',
+    'claude-sbx': 'dist/bin/claude-sbx.js',
+    'claude-sandbox': 'dist/bin/claude-sbx.js',
+    'codex-sbx': 'dist/bin/codex-sbx.js',
+    'codex-sandbox': 'dist/bin/codex-sbx.js',
+    'gemini-sbx': 'dist/bin/gemini-sbx.js',
+    'gemini-sandbox': 'dist/bin/gemini-sbx.js',
+    'claude-host': 'dist/bin/claude-host.js',
+    'sbx-show': 'dist/bin/sbx-show.js',
+    'sbx-hide': 'dist/bin/sbx-hide.js',
+};
+/** Deletes the shim of a removed command, only when the file is exactly the text we wrote for it. */
+export function removeStaleShims(layout, keep = {}) {
+    for (const [name, target] of Object.entries(REMOVED_COMMANDS)) {
+        if (name in keep)
+            continue;
+        for (const [file, kind] of [
+            [name + '.cmd', 'cmd'],
+            [name, 'sh'],
+        ]) {
+            const full = path.join(layout.binDir, file);
+            try {
+                if (fs.readFileSync(full, 'utf8') === shimText(name, kind, target))
+                    fs.rmSync(full, { force: true });
+            }
+            catch {
+                // Not there, or not readable: nothing of ours to remove.
+            }
+        }
+    }
+}
+/**
+ * Writes <bin>.cmd and <bin> for every command in `bins` (name -> program path inside the package), and removes the
+ * shims of commands that no longer exist.
+ */
 export function writeShims(layout, bins) {
     for (const [name, target] of Object.entries(bins)) {
         writeFileAtomic(path.join(layout.binDir, name + '.cmd'), shimText(name, 'cmd', target));
         writeFileAtomic(path.join(layout.binDir, name), shimText(name, 'sh', target));
     }
+    removeStaleShims(layout, bins);
 }

package/dist/host/launch/generate.js

@@ -15,6 +15,7 @@ import { folderAttachment } from '../storage/providers/index.js';
 import { assertTestWritable } from '../test-guard.js';
 import { writeLoadSettings } from '../life/watchdog.js';
 import { loadProfileOf } from './risk-notes.js';
+import { launchHasSandboxSource, stagePcLogs } from './pc-logs.js';
 import { planBootProjects } from './boot-projects.js';
 import { planDatabases } from './database-plan.js';
 import { collectMappings } from './mappings.js';
@@ -135,6 +136,9 @@ opened) {
     fs.writeFileSync(path.join(launchPath, 'env.cmd'), logonEnv(session.workspace), 'utf8');
     copyRuntime(o.packageRoot, launchPath);
     stageHooks(o.packageRoot, launchPath, o.run.scripts);
+    // Developing the sandbox inside a sandbox: this PC's recent crash reports and logs (never for other projects).
+    if (launchHasSandboxSource([workspaceHost, ...boot.projects.map((p) => p.host)], o.packageRoot))
+        stagePcLogs(storageRoot, dataPath, launchPath);
     const enginePlan = engine.plan(buildLaunchPlan({
         config,
         memoryMb,

package/dist/host/launch/index.d.ts

@@ -10,3 +10,4 @@ export { msvcHint, projectEntries, readProjectFiles, uvHint } from './project-sc
 export { hostDatabases, pcLanguages } from './pc-scan.js';
 export { collectMappings } from './mappings.js';
 export { RUNTIME_FILES, copyRuntime, gitIdentity, stageGitIdentity, stageHooks, stageScripts } from './stage.js';
+export { isSandboxSourceRepo, launchHasSandboxSource, stagePcLogs } from './pc-logs.js';

package/dist/host/launch/index.js

@@ -10,3 +10,4 @@ export { msvcHint, projectEntries, readProjectFiles, uvHint } from './project-sc
 export { hostDatabases, pcLanguages } from './pc-scan.js';
 export { collectMappings } from './mappings.js';
 export { RUNTIME_FILES, copyRuntime, gitIdentity, stageGitIdentity, stageHooks, stageScripts } from './stage.js';
+export { isSandboxSourceRepo, launchHasSandboxSource, stagePcLogs } from './pc-logs.js';

package/dist/host/launch/pc-logs.d.ts

@@ -0,0 +1,6 @@
+/** Whether a folder is a checkout (or git worktree) of this sandbox's own source repo, judged by the installed copy. */
+export declare function isSandboxSourceRepo(folder: string, packageRoot: string): boolean;
+/** Whether this launch has the sandbox's own source repo among its projects (the launch folder or a mapped project). */
+export declare function launchHasSandboxSource(folders: readonly string[], packageRoot: string): boolean;
+/** Copies the PC's recent crash reports and log tails into <launchPath>\pc-logs. Returns the folder. */
+export declare function stagePcLogs(storageRoot: string, dataPath: string, launchPath: string): string;