windows-development-sandbox 1.28.0 → 1.29.0

package/dist/selftest/generate.test.js

@@ -3,7 +3,8 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { LocalOverridesSchema } from '../core/schema/index.js';
-import { buildWsb, gitIdentity, logonEnv, resolveMemoryMb } from '../host/launch/index.js';
+import { buildWsb, gitIdentity, isSandboxSourceRepo, launchHasSandboxSource, logonEnv, resolveMemoryMb, stagePcLogs, } from '../host/launch/index.js';
+import { pcLogsGuideLine } from '../guest/boot/guide-lines.js';
 export const generateSuite = {
     name: 'generate',
     title: 'generated .wsb, launch folder and session.json',
@@ -90,5 +91,69 @@ export const generateSuite = {
             resolveMemoryMb({ ...auto, maxMemoryPercent: 50 }, 60000 * MB, pcRam),
         ], [31744, 21504, 32768], "memory 'auto' follows free RAM minus the reserve and never takes more than maxMemoryPercent of the PC's RAM");
         await t.throws(() => resolveMemoryMb(auto, 9000 * MB, pcRam), 'Not enough free RAM', "memory 'auto' refuses when too little RAM is free");
+        t.section('PC logs for developing the sandbox');
+        const root = path.join(t.temp, 'pc-logs');
+        const URL = 'git+https://github.com/JoshDiDuca/windows-development-sandbox.git';
+        const project = (name, pkg) => {
+            t.write(path.join(root, name, 'package.json'), pkg);
+            return path.join(root, name);
+        };
+        const own = project('own', JSON.stringify({ name: 'windows-development-sandbox', repository: { type: 'git', url: URL } }));
+        const pkgOf = (url, name = 'windows-development-sandbox') => JSON.stringify({ name, repository: { url } });
+        const variants = [
+            project('v-https', pkgOf('https://github.com/joshdiduca/windows-development-sandbox')),
+            project('v-dotgit', pkgOf('https://github.com/JoshDiDuca/windows-development-sandbox.git')),
+            project('v-string', JSON.stringify({ name: 'windows-development-sandbox', repository: URL })),
+        ];
+        t.equal([isSandboxSourceRepo(own, own), ...variants.map((v) => isSandboxSourceRepo(v, own))], [true, true, true, true], 'a folder with the sandbox name and repository url is its source (git+, .git and case variants too)');
+        const big = project('big', pkgOf(URL) + ' '.repeat(300 * 1024));
+        const link = path.join(root, 'linked');
+        let linked = false;
+        try {
+            fs.symlinkSync(path.join(root, 'own'), link, 'junction');
+            linked = true;
+        }
+        catch {
+            // No permission for links here: that case is skipped.
+        }
+        t.equal([
+            isSandboxSourceRepo(project('wrong-url', pkgOf('https://github.com/someone/windows-development-sandbox')), own),
+            isSandboxSourceRepo(project('wrong-name', pkgOf(URL, 'other')), own),
+            isSandboxSourceRepo(project('invalid', '{ nope'), own),
+            isSandboxSourceRepo(path.join(root, 'missing'), own),
+            isSandboxSourceRepo(big, own),
+            linked ? isSandboxSourceRepo(link, own) : false,
+        ], [false, false, false, false, false, false], 'a wrong url or name, a missing, oversized or invalid package.json and a link are not the sandbox source');
+        t.check(launchHasSandboxSource([f.workA, own], own) && !launchHasSandboxSource([f.workA, f.workB], own), 'any project of the launch can be the source; a launch without it has none');
+        t.check(!fs.existsSync(path.join(gen.launchPath, 'pc-logs')), 'a launch of another project gets no pc-logs');
+        const storage = path.join(root, 'storage');
+        const dataPath = path.join(root, 'data-x');
+        for (let i = 0; i < 12; i++)
+            t.write(path.join(storage, 'logs', 'crashes', 'crash-2026-01-' + String(10 + i) + '.txt'), 'report ' + i);
+        t.write(path.join(storage, 'logs', 'host-memory-data-x.log'), 'start\n' + 'm'.repeat(600 * 1024) + 'END');
+        t.write(path.join(storage, 'logs', 'host-sync-data-x.log'), 'small');
+        t.write(path.join(storage, 'state', 'live-folders.log'), 'live');
+        t.write(path.join(storage, 'state', 'logins.json'), 'SECRET');
+        t.write(path.join(storage, 'secrets', 'x.json'), 'SECRET');
+        const launch = path.join(root, 'launch');
+        const out = stagePcLogs(storage, dataPath, launch);
+        const listing = (dir) => fs
+            .readdirSync(dir, { recursive: true, withFileTypes: true })
+            .flatMap((e) => e.isFile() ? [path.relative(out, path.join(e.parentPath, e.name)).replaceAll('\\', '/')] : []);
+        const copied = listing(out).sort();
+        const reports = copied.filter((n) => n.startsWith('crashes/'));
+        const memory = fs.readFileSync(path.join(out, 'host-memory.log'), 'utf8');
+        t.check(reports.length === 10 &&
+            reports.includes('crashes/crash-2026-01-21.txt') &&
+            !reports.includes('crashes/crash-2026-01-11.txt') &&
+            fs.statSync(path.join(out, 'host-memory.log')).size <= 256 * 1024 &&
+            memory.endsWith('END') &&
+            fs.readFileSync(path.join(out, 'README.txt'), 'utf8').includes('never commit'), 'the newest 10 crash reports, the last 256 KB of the memory log and a README are copied', copied.join(', '));
+        t.equal(copied.filter((n) => !n.startsWith('crashes/')), ['README.txt', 'host-memory.log', 'host-sync.log', 'live-folders.log'], 'nothing else from the storage folder is copied (no state, logins or secrets)');
+        t.section('the guide line for the PC logs');
+        t.equal([pcLogsGuideLine('C:\\AgentLaunch', () => false), pcLogsGuideLine('C:\\AgentLaunch', () => true)], [
+            [],
+            ['- PC crash reports and logs (this project only, read-only, never commit them): `C:\\AgentLaunch\\pc-logs`'],
+        ], 'the guide mentions the PC logs only when the folder exists');
     },
 };

package/dist/selftest/hcs.test.js

@@ -514,7 +514,7 @@ export const hcsSuite = {
             LEFTOVER_DEPS.current = null;
         }
         t.section('sandbox engine check hcs');
-        const out = await f.runBin('agent-sandbox', ['engine', 'check', 'hcs', '--config', t.writeJson(t.at('hcs-config.json'), {})], {
+        const out = await f.runBin('sandbox', ['engine', 'check', 'hcs', '--config', t.writeJson(t.at('hcs-config.json'), {})], {
             cwd: f.workA,
             env: { ...process.env, NO_COLOR: '1', AGENT_SANDBOX_HOME: t.dir('hcs-home'), AGENT_SANDBOX_HOST_ONLY: '1' },
         });

package/dist/selftest/health.test.js

@@ -14,7 +14,7 @@ import { logText, writeRepairLog } from '../cli/commands/repair/log.js';
 import { HealthPrinter, summaryText } from '../cli/commands/repair/printer.js';
 import { runHealth } from '../cli/commands/repair/run.js';
 import { configBackups, findCommandCopies, fileOnDisk, groupEntries, inspectPointers, lineDiff, orphanWatchers, parseGroupMembers, parseIcacls, parseRegPath, pathHas, privacyProblems, repairPointers, runStateProblems, shimProblems, staleActiveRecords, staleLaunchFolders, watcherRecords, } from '../host/health/index.js';
-import { InstallLayout, writeShims } from '../host/install/index.js';
+import { InstallLayout, REMOVED_COMMANDS, shimText, writeShims } from '../host/install/index.js';
 import { ActiveRecords } from '../host/sharing/index.js';
 const SID = 'S-1-5-21-1-2-3-1001';
 function fakeSystem(over = {}) {
@@ -225,7 +225,7 @@ function installChecks(t, mode) {
         t.writeJson(path.join(layout.packageDir(v), 'package.json'), { name: 'x', version: v, bin });
     };
     pkg('1.4.0', { sandbox: 'dist/bin/sandbox.js' });
-    pkg('1.5.0', { sandbox: 'dist/bin/sandbox.js', 'agent-sandbox': 'dist/bin/agent-sandbox.js' });
+    pkg('1.5.0', { sandbox: 'dist/bin/sandbox.js', 'other-tool': 'dist/bin/other-tool.js' });
     t.dir('health', 'install-' + mode, 'WindowsDevelopmentSandbox', 'versions', '1.6.0', 'staging');
     t.write(layout.nodeExe('v22.1.0'), 'x');
     t.write(layout.nodeExe('v22.11.0'), 'x');
@@ -257,13 +257,13 @@ async function pointers(t, layout, env) {
 async function shims(t, layout, env) {
     t.section('install: shims');
     layout.setActive('1.5.0', 'v22.11.0');
-    const bins = { sandbox: 'dist/bin/sandbox.js', 'agent-sandbox': 'dist/bin/agent-sandbox.js' };
+    const bins = { sandbox: 'dist/bin/sandbox.js', 'other-tool': 'dist/bin/other-tool.js' };
     writeShims(layout, bins);
     t.equal(shimProblems(layout, bins), { missing: [], different: [] }, 'freshly written shims are fine');
     fs.rmSync(path.join(layout.binDir, 'sandbox.cmd'));
-    fs.writeFileSync(path.join(layout.binDir, 'agent-sandbox'), '#!/bin/sh\necho old\n');
+    fs.writeFileSync(path.join(layout.binDir, 'other-tool'), '#!/bin/sh\necho old\n');
     const problems = shimProblems(layout, bins);
-    t.equal([problems.missing, problems.different], [['sandbox.cmd'], ['agent-sandbox']], 'a missing and an out-of-date shim are found');
+    t.equal([problems.missing, problems.different], [['sandbox.cmd'], ['other-tool']], 'a missing and an out-of-date shim are found');
     const { run, result } = await lookAt(env, 'install-shims');
     t.check(result.status === 'needs-you' && result.fixable, 'the shims check offers to rewrite them');
     const fixed = await run.fix([result]);
@@ -271,6 +271,19 @@ async function shims(t, layout, env) {
     t.equal(shimProblems(layout, bins), { missing: [], different: [] }, 'the shims read the active version again');
     fs.writeFileSync(path.join(layout.binDir, 'extra.cmd'), 'echo mine');
     t.check(fs.existsSync(path.join(layout.binDir, 'extra.cmd')), 'a file that is not one of ours is left alone');
+    t.section('install: shims of removed commands');
+    for (const [name, target] of Object.entries(REMOVED_COMMANDS)) {
+        fs.writeFileSync(path.join(layout.binDir, name + '.cmd'), shimText(name, 'cmd', target));
+        fs.writeFileSync(path.join(layout.binDir, name), shimText(name, 'sh', target));
+    }
+    fs.writeFileSync(path.join(layout.binDir, 'claude-sbx.cmd'), '@echo off rem mine');
+    writeShims(layout, bins);
+    const left = Object.keys(REMOVED_COMMANDS).flatMap((name) => [name + '.cmd', name].filter((file) => fs.existsSync(path.join(layout.binDir, file))));
+    t.equal(left, ['claude-sbx.cmd'], 'writing the shims removes the shims of old commands, but not a file that is not ours');
+    const kept = { ...bins, 'claude-sbx': 'dist/bin/claude-sbx.js' };
+    writeShims(layout, kept);
+    t.check(fs.readFileSync(path.join(layout.binDir, 'claude-sbx'), 'utf8') ===
+        shimText('claude-sbx', 'sh', kept['claude-sbx']), 'a package that still declares an old command keeps its shim (a rollback)');
 }
 async function copiesOnPath(t) {
     t.section('install: copies of the commands on the PATH');
@@ -282,9 +295,7 @@ async function copiesOnPath(t) {
     t.write(path.join(npmBin, 'sandbox'), '#!/bin/sh');
     t.write(path.join(npmBin, 'node_modules', 'windows-development-sandbox', 'package.json'), '{}');
     t.write(path.join(managedBin, 'sandbox.cmd'), '@echo off');
-    t.write(path.join(managedBin, 'claude-sbx.cmd'), '@echo off');
-    t.write(path.join(managedBin, 'claude-sbx.exe'), '');
-    t.write(path.join(oldBin, 'claude-sbx.cmd'), '@echo off');
+    t.write(path.join(oldBin, 'sandbox.cmd'), '@echo off');
     const machinePath = [npmBin, managedBin].join(';');
     const userPath = [oldBin, npmBin, t.dir('copies', 'empty')].join(';');
     const pathext = '.COM;.EXE;.BAT;.CMD';
@@ -298,8 +309,8 @@ async function copiesOnPath(t) {
     });
     t.equal(found.map((c) => [c.kind, c.files.join(',')]), [
         ['npm', 'sandbox.cmd'],
-        ['managed-machine', 'sandbox.cmd,claude-sbx.exe'],
-        ['old-scripts', 'claude-sbx.cmd'],
+        ['managed-machine', 'sandbox.cmd'],
+        ['old-scripts', 'sandbox.cmd'],
     ], 'copies come in PATH order (machine first, a folder once), each command as its PATHEXT match, extensionless files ignored');
     const asked = [];
     const saved = process.env.ProgramFiles;

package/dist/selftest/heavy-load.test.js

@@ -8,7 +8,7 @@ import { DEFAULTS } from '../core/config/index.js';
 import { isWin } from '../core/util/index.js';
 import { SYSTEM } from '../shared/system.js';
 import { GuestRequestSchema, PressureStatusSchema } from '../shared/channel/index.js';
-import { BURST_GATE, compilersAllowed, DIAL_CALM_SAMPLES, DIAL_STEPS, HOST_THRESHOLDS, buildJobs, cargoJobs, linkSlotsFor, usableCpus, effectiveCpuLimit, gentleCpuLimit, maxCompilers, chooseTargetDir, cargoLinkerVar, ubtBuildConfiguration, } from '../shared/memory/index.js';
+import { BURST_GATE, compilersAllowed, DIAL_CALM_SAMPLES, DIAL_STEPS, HOST_THRESHOLDS, buildJobs, cargoJobs, linkSlotsFor, usableCpus, effectiveCpuLimit, gentleCpuLimit, maxCompilers, chooseTargetDir, cargoLinkerVar, } from '../shared/memory/index.js';
 import { HeartbeatSchema } from '../shared/channel/index.js';
 import { heartbeatLine, lastEndOf, vanishedCause, stopWarning } from '../host/life/index.js';
 import { cappedMemoryMb, decideMemory, memoryNote, residentCapMb, residentNote, resolveMemoryMb, } from '../host/launch/index.js';
@@ -96,10 +96,6 @@ export const heavyLoadSuite = {
         t.check(cargoJobs(16, 32, 3) === 2 && cargoJobs(16, 32, 8) === 1, 'fewer when several sessions build');
         t.check(cargoJobs(32, 32, 1) === 8, '32 processors, 32 GB: 8 jobs for one session');
         t.check(buildJobs(32, 32) === 8 && buildJobs(32, 64) === 19 && buildJobs(4, 64) === 4 && buildJobs(16, 4) === 2, 'the build budget: 3 GB per job after 6 GB, never more than the processors, at least 2');
-        const ubt = ubtBuildConfiguration(buildJobs(20, 36));
-        t.check(ubt.includes('<MaxParallelActions>10</MaxParallelActions>') &&
-            ubt.includes('xmlns="https://www.unrealengine.com/BuildConfiguration"') &&
-            ubtBuildConfiguration(0).includes('<MaxParallelActions>1</MaxParallelActions>'), "UnrealBuildTool's compiles at once follow the build budget (at least 1)", ubt);
         t.check(linkSlotsFor(32) === 8 && linkSlotsFor(16) === 3 && linkSlotsFor(8) === 2 && linkSlotsFor(128) === 8, 'links at once ("auto"): one per 3 GB after 6 GB, 2 to 8');
         t.check(usableCpus(32, 80) === 25 && usableCpus(32, null) === 32 && usableCpus(4, 10) === 2 && usableCpus(8, 100) === 8, 'the processors programs see follow the CPU cap (at least 2)');
         t.section('the governor: which programs');

package/dist/selftest/host-sim.test.js

@@ -27,9 +27,9 @@ const SANDBOX_ONLY_VARS = [
     'AGENT_SANDBOX_CONFIG',
 ];
 const PARALLEL = 2;
-const sandbox = (label, ...args) => ({ bin: 'agent-sandbox', label, args, config: true });
+const sandbox = (label, ...args) => ({ bin: 'sandbox', label, args, config: true });
 const COMMANDS = [
-    { bin: 'agent-sandbox', label: '--help', args: ['--help'] },
+    { bin: 'sandbox', label: '--help', args: ['--help'] },
     sandbox('status', 'status'),
     sandbox('status --json', 'status', '--json'),
     sandbox('sessions', 'sessions'),
@@ -38,26 +38,25 @@ const COMMANDS = [
     sandbox('vpn status', 'vpn', 'status'),
     sandbox('vpn status --json', 'vpn', 'status', '--json'),
     sandbox('account use nobody', 'account', 'use', 'nobody'),
-    { bin: 'agent-sandbox', label: 'config path', args: ['config', 'path'] },
+    { bin: 'sandbox', label: 'config path', args: ['config', 'path'] },
     sandbox('config show', 'config', 'show'),
-    { bin: 'agent-sandbox', label: 'config schema', args: ['config', 'schema'] },
+    { bin: 'sandbox', label: 'config schema', args: ['config', 'schema'] },
     sandbox('clean', 'clean'),
     sandbox('sync', 'sync'),
     sandbox('logs', 'logs'),
     sandbox('attach', 'attach'),
-    { bin: 'agent-sandbox', label: 'exec', args: ['exec'], after: ['--', 'echo', 'hi'], config: true },
+    { bin: 'sandbox', label: 'exec', args: ['exec'], after: ['--', 'echo', 'hi'], config: true },
     sandbox('restart', 'restart'),
     sandbox('stop', 'stop'),
     sandbox('show', 'show'),
     sandbox('hide', 'hide'),
     sandbox('generate', 'generate'),
     sandbox('launch', 'launch'),
-    { bin: 'agent-sandbox', label: 'unknown command', args: ['frobnicate'] },
-    { bin: 'claude-sbx', label: 'claude-sbx --headless --continue', args: ['--headless', '--continue'], config: true },
-    { bin: 'codex-sbx', label: 'codex-sbx', args: [], config: true },
-    { bin: 'gemini-sbx', label: 'gemini-sbx', args: [], config: true },
-    { bin: 'sbx-show', label: 'sbx-show', args: [], config: true },
-    { bin: 'claude-host', label: 'claude-host --version', args: ['--version'] },
+    { bin: 'sandbox', label: 'unknown command', args: ['frobnicate'] },
+    { bin: 'sandbox', label: 'claude --headless --continue', args: ['claude', '--headless', '--continue'], config: true },
+    { bin: 'sandbox', label: 'codex', args: ['codex'], config: true },
+    { bin: 'sandbox', label: 'gemini', args: ['gemini'], config: true },
+    { bin: 'sandbox', label: 'host claude --version', args: ['host', 'claude', '--', '--version'] },
 ];
 export const hostSimSuite = {
     name: 'host-sim',
@@ -93,7 +92,7 @@ export const hostSimSuite = {
             const args = command.config ? [...command.args, '--config', pc.config, ...(command.after ?? [])] : command.args;
             const r = await f.runBin(command.bin, args, { cwd: project, env: envFor(pc.home), timeoutMs: 120000 });
             const crashed = r.status === null || r.status > 1 || /Unexpected error|node:internal|^\s+at .+:\d+:\d+\)?$/m.test(r.out);
-            const unexplained = r.status === 1 && !/(^|\n)(Error: |error: )/.test(r.out) && command.bin !== 'claude-host';
+            const unexplained = r.status === 1 && !/(^|\n)(Error: |error: )/.test(r.out) && !command.label.startsWith('host ');
             if (crashed || unexplained)
                 broken.push(command.label +
                     ' (exit ' +
@@ -110,8 +109,8 @@ export const hostSimSuite = {
                 await runOne(next.command, next.index);
         });
         const initRuns = (async () => {
-            await runOne({ bin: 'agent-sandbox', label: 'config init', args: ['config', 'init'] }, 1000, initPc);
-            await runOne({ bin: 'agent-sandbox', label: 'config init (again)', args: ['config', 'init'] }, 1001, initPc);
+            await runOne({ bin: 'sandbox', label: 'config init', args: ['config', 'init'] }, 1000, initPc);
+            await runOne({ bin: 'sandbox', label: 'config init (again)', args: ['config', 'init'] }, 1001, initPc);
         })();
         await Promise.all([...workers, initRuns]);
         t.equal(broken, [], 'all ' + (COMMANDS.length + 2) + ' commands work or fail with a clear message when run outside a sandbox');

package/dist/selftest/install.test.js

@@ -3,7 +3,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
-import { shimText } from '../host/install/index.js';
+import { REMOVED_COMMANDS, shimText } from '../host/install/index.js';
 import { nativeScript } from '../host/native.js';
 import { SYSTEM } from '../shared/system.js';
 /** The text install.ps1 writes for one shim, run by powershell.exe as a script file. */
@@ -39,11 +39,15 @@ function installerText(t, script) {
     const cases = [
         ['sandbox', undefined],
         ['claude-sbx', 'dist/bin/claude-sbx.js'],
-        ['agent-sandbox', 'dist/bin/agent-sandbox.js'],
+        ['sbx-show', undefined],
     ];
     for (const [name, target] of cases)
         for (const kind of ['cmd', 'sh'])
             t.equal(printedShim(script, kind, name, target), shimText(name, kind, target), name + '.' + kind + ' is identical');
+    t.section('install.ps1 and package.json: the commands');
+    const bin = JSON.parse(fs.readFileSync(path.join(t.packageRoot, 'package.json'), 'utf8')).bin;
+    t.equal(Object.keys(bin).sort(), ['sandbox', 'windows-development-sandbox'], 'the package declares only those commands');
+    t.equal(Object.keys(REMOVED_COMMANDS).filter((name) => !source.includes("'" + name + "'")), [], 'the installer removes the shim of every removed command');
     t.includes(printedShim(script, 'cmd', 'x y'), 'exit', 'a name that is not a command name is refused');
 }
 export const installSuite = {

package/dist/selftest/store-app.test.js

@@ -8,11 +8,12 @@ import { DEFAULTS } from '../core/config/index.js';
 import { OFF_IS_SAFER } from '../core/local-config/index.js';
 import { HOST_SOURCES } from '../host/accounts/index.js';
 import { prepareStorePackages, stagedPackageDir, StorePackages } from '../host/apps/index.js';
+import { prepareServiceAccounts } from '../host/accounts/index.js';
 import { checkedPackage } from '../guest/apps/store-check.js';
 import { peekPendingPerplexityApp, perplexityAppPendingFile } from '../guest/accounts/kinds/perplexityapp.js';
 import { perplexityAppShortcutArgs, restoreAppSignIn } from '../guest/browser/perplexity-app.js';
-import { appsToInstall, appById, isStorePackageFile, PERPLEXITY_DESKTOP_FAMILY, PERPLEXITY_DESKTOP_PACKAGE, PERPLEXITY_DESKTOP_PRODUCT_ID, storeApps, StorePackageManifestSchema, storePackageRole, } from '../shared/apps/index.js';
-import { appUsersOn, PAYLOADS, SERVICE_SPECS, serviceWanted, usedByText, } from '../shared/accounts/index.js';
+import { appsToInstall, appById, isStorePackageFile, PERPLEXITY_DESKTOP_FAMILY, PERPLEXITY_DESKTOP_PACKAGE, PERPLEXITY_DESKTOP_PRODUCT_ID, assignStoreRoles, storeApps, StorePackageManifestSchema, storePackageFitsX64, storePackageRole, } from '../shared/apps/index.js';
+import { appsNeededFor, appUsersOn, PAYLOADS, SERVICE_SPECS, serviceWanted, usedByText, } from '../shared/accounts/index.js';
 const MAIN = 'PerplexityAI.PerplexityApp_1.2.3.0_x64__3jh4kjrg4dzr2.msix';
 const FRAMEWORK = 'Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe.appx';
 const sha = (text) => crypto.createHash('sha256').update(text).digest('hex');
@@ -137,7 +138,9 @@ export const storeAppSuite = {
             run: fakeStore({}, false).run,
         });
         t.check(outcome.notes.length === 1 &&
-            outcome.notes[0].includes('is not prepared') &&
+            outcome.notes[0].includes('NOT installed in this sandbox') &&
+            outcome.notes[0].includes('no Store access') &&
+            outcome.notes[0].startsWith('perplexity-desktop:') &&
             outcome.notes[0].includes('winget download --id 9P9XG917PWCJ'), 'with nothing kept the launch goes on, with a note that says what to fix');
         const good = await prepareStorePackages([app], {
             storageRoot: emptyRoot,
@@ -145,12 +148,67 @@ export const storeAppSuite = {
             run: fakeStore({ [MAIN]: 'a' }).run,
         });
         t.check(good.notes[0].includes('downloaded') && fs.existsSync(path.join(stagedPackageDir(emptyData, app.id), MAIN)), 'and a working Store stages it');
+        t.section('frameworks: the right builds, and the app told from them');
+        const VCLIBS_X86 = 'Microsoft.VCLibs.140.00_14.0.33519.0_x86__8wekyb3d8bbwe.appx';
+        const VCLIBS_ARM = 'Microsoft.VCLibs.140.00_14.0.33519.0_arm64__8wekyb3d8bbwe.appx';
+        t.check(storePackageFitsX64(FRAMEWORK) &&
+            !storePackageFitsX64(VCLIBS_X86) &&
+            !storePackageFitsX64(VCLIBS_ARM) &&
+            storePackageFitsX64('Microsoft.WindowsAppRuntime.1.6_6000.311.0_neutral__8wekyb3d8bbwe.msix'), '32-bit and ARM frameworks are left out, x64 and neutral ones stay');
+        t.equal(assignStoreRoles(['Perplexity_x64.msixbundle', FRAMEWORK], PERPLEXITY_DESKTOP_PACKAGE, [FRAMEWORK]).map((f) => f.role), ['main', 'dependency'], 'an app winget names another way is still found: it is the file outside Dependencies');
+        t.check((() => {
+            try {
+                assignStoreRoles([FRAMEWORK], PERPLEXITY_DESKTOP_PACKAGE, [FRAMEWORK]);
+                return false;
+            }
+            catch (e) {
+                return String(e).includes('only frameworks');
+            }
+        })(), 'frameworks without the app are refused with a plain reason');
+        const rich = await new StorePackages({
+            storageRoot: t.dir('pc3', 'storage'),
+            dataPath: t.dir('pc3', 'storage', 'data', 'set'),
+            run: (_exe, args) => {
+                const out = args[args.indexOf('-OutDir') + 1];
+                fs.mkdirSync(out, { recursive: true });
+                for (const n of ['Perplexity_1.2_x64.msixbundle', FRAMEWORK, VCLIBS_X86, VCLIBS_ARM])
+                    fs.writeFileSync(path.join(out, n), n);
+                return Promise.resolve({
+                    status: 0,
+                    stdout: JSON.stringify({
+                        ok: true,
+                        message: 'ok',
+                        files: ['Perplexity_1.2_x64.msixbundle', FRAMEWORK, VCLIBS_X86, VCLIBS_ARM],
+                        dependencies: [FRAMEWORK, VCLIBS_X86, VCLIBS_ARM],
+                    }),
+                    stderr: '',
+                });
+            },
+        }).fetch(app);
+        t.check(rich.files.map((f) => f.role).join() === 'main,dependency' &&
+            rich.files.every((f) => storePackageFitsX64(f.name)), 'a fetch keeps the app and only the x64 framework, with the roles the script reported');
+        t.section('a sign-in for an app that is not installed says so');
+        t.equal(appsNeededFor('perplexityapp'), ['perplexity-desktop'], 'the app a sign-in needs');
+        t.equal(appsNeededFor('epic'), [], 'a sign-in a toolchain uses needs no app');
+        const sharing = { ...DEFAULTS, accounts: { ...DEFAULTS.accounts, perplexityapp: { share: true } } };
+        const deliverFor = (on) => prepareServiceAccounts({
+            config: sharing,
+            others: [],
+            on: new Set(on),
+            storageRoot: t.dir('pc4', 'storage'),
+            dataPath: t.dir('pc4', 'storage', 'data', 'set'),
+            launchId: 'L-1',
+            isRunning: () => false,
+        });
+        const missing = deliverFor([]);
+        t.check(missing.notes.some((n) => n.includes('accounts.perplexityapp.share') && n.includes('Fix: turn the app on in Apps')) && !missing.leased.length, 'share on with the app off: a launch note names the setting and the app to turn on');
+        t.check(!deliverFor(['perplexityapp']).notes.some((n) => n.includes('is not installed')), 'with the app on there is no such note');
         t.section('the sandbox checks the kept files');
         const checked = await checkedPackage(staged);
         t.check(path.basename(checked.main) === MAIN && checked.dependencies.map((d) => path.basename(d)).join() === FRAMEWORK, 'the app and its frameworks, in order');
         fs.writeFileSync(path.join(staged, FRAMEWORK), 'tampered');
         t.check((await t.thrownMessage(() => checkedPackage(staged))).includes('missing or changed'), 'a changed file stops the install');
-        t.check((await t.thrownMessage(() => checkedPackage(t.dir('nothing')))).includes('not handed over'), 'no package says so');
+        t.check((await t.thrownMessage(() => checkedPackage(t.dir('nothing')))).includes('did not hand over its package'), 'no package says so');
         t.section('the shortcut');
         const args = perplexityAppShortcutArgs('C:\\AgentLaunch\\sandbox\\scripts\\start-store-app.ps1', 'C:\\Users\\X\\profile');
         t.check(args.includes('-File "C:\\AgentLaunch\\sandbox\\scripts\\start-store-app.ps1"') &&

package/dist/selftest/support/web-preview.js

@@ -563,7 +563,7 @@ export function sampleAuditLog(dir) {
         proc(94, 'C:\\AgentData\\tools\\uv\\uv.exe', 'uv tool install aider-chat', {}),
         { t: at(90), k: 'session', a: 'start', p: 'claude', w: SESSIONS[0].cwd, c: claude.s, ...claude, sv: undefined },
         proc(88, git, 'git status --short', claude),
-        proc(87, node, 'node dist/bin/agent-sandbox.js self-test audit', claude, 2),
+        proc(87, node, 'node dist/bin/sandbox.js self-test audit', claude, 2),
         file(80, 'src/host/audit/collect.ts', ws, claude),
         file(79, 'src/app/features/audit/audit.def.ts', ws, claude),
         proc(70, 'C:\\nvm\\nodejs\\npm.cmd', 'npm run build', claude),
@@ -613,7 +613,7 @@ export function sampleAuditLog(dir) {
             ...codex,
             sv: undefined,
         },
-        proc(5, node, 'node dist/bin/agent-sandbox.js self-test app', claude),
+        proc(5, node, 'node dist/bin/sandbox.js self-test app', claude),
         { t: at(4), k: 'remote', p: 'sessions.restart', a: 'ok', au: "device Josh's iPhone" },
         { t: at(3), k: 'remote', p: 'settings.set', a: 'refused', au: 'Windows user DESKTOP-JOSH\\sam' },
     ]);

package/dist/shared/accounts/kinds.d.ts

@@ -58,3 +58,8 @@ export declare function usedByText(usedBy: readonly string[]): string;
 export declare function appUsersOn(install: readonly string[]): AppUser[];
 /** Whether a sign-in is wanted when these toolchains (and apps) are on. */
 export declare function serviceWanted(kind: ServiceKind, on: ReadonlySet<UsedBy>): boolean;
+/**
+ * For a sign-in that only apps use (Perplexity API, Comet, the Perplexity app): the apps.install ids to turn on for it
+ * to be handed over; empty for a kind a toolchain uses. A sign-in shared with its app off would otherwise do nothing.
+ */
+export declare function appsNeededFor(kind: ServiceKind): string[];

package/dist/shared/accounts/kinds.js

@@ -256,3 +256,11 @@ export function serviceWanted(kind, on) {
         return true;
     return spec.usedBy.includes('android') && ANDROID_USERS.some((u) => on.has(u));
 }
+/**
+ * For a sign-in that only apps use (Perplexity API, Comet, the Perplexity app): the apps.install ids to turn on for it
+ * to be handed over; empty for a kind a toolchain uses. A sign-in shared with its app off would otherwise do nothing.
+ */
+export function appsNeededFor(kind) {
+    const { usedBy } = SERVICE_SPECS[kind];
+    return usedBy.every((u) => u in APP_USERS) ? usedBy.flatMap((u) => [...APP_USERS[u]]) : [];
+}

package/dist/shared/apps/index.d.ts

@@ -5,4 +5,4 @@ export { exeMatcher, appsToInstall, appsNeedMesa, appsNeedUv, storeApps } from '
 export { signerMatches, type AppSigner, type Signature } from '../signer.js';
 export { AGENTS_WEB_APPS, BROWSER_USE_VERSION, CHROME_DEVTOOLS_MCP_VERSION, COMET_DOWNLOAD_URL, PERPLEXITY_DESKTOP_FAMILY, PERPLEXITY_DESKTOP_PACKAGE, PERPLEXITY_DESKTOP_PRODUCT_ID, COMET_MCP_VERSION, COMET_SIGNER, PERPLEXITY_COMPUTER_MCP_URL, PERPLEXITY_MCP_VERSION, } from './catalogue-agents-web.js';
 export { ADDON_MCP_PREFIX, addonGuideLine, addonMcpServer, type AddonPlace, claudeManagedSettings, codexWithAddonMcpServers, type CodexMcpServer, HEADROOM_ENV, HEADROOM_PORT, HEADROOM_UPSTREAM, headroomArgs, headroomEnv, headroomGuideLine, headroomUrl, type ManagedSettings, type McpServerConfig, rtkHookCommand, RTK_GUIDE_LINE, withAddonMcpServers, } from './agent-addons.js';
-export { isStorePackageFile, STORE_PACKAGE_MANIFEST, StorePackageFileSchema, StorePackageManifestSchema, storePackageRole, type StorePackageFile, type StorePackageManifest, } from './store-package.js';
+export { isStorePackageFile, STORE_PACKAGE_MANIFEST, StorePackageFileSchema, StorePackageManifestSchema, storePackageRole, storePackageFitsX64, assignStoreRoles, type StorePackageFile, type StorePackageManifest, } from './store-package.js';

package/dist/shared/apps/index.js

@@ -5,4 +5,4 @@ export { exeMatcher, appsToInstall, appsNeedMesa, appsNeedUv, storeApps } from '
 export { signerMatches } from '../signer.js';
 export { AGENTS_WEB_APPS, BROWSER_USE_VERSION, CHROME_DEVTOOLS_MCP_VERSION, COMET_DOWNLOAD_URL, PERPLEXITY_DESKTOP_FAMILY, PERPLEXITY_DESKTOP_PACKAGE, PERPLEXITY_DESKTOP_PRODUCT_ID, COMET_MCP_VERSION, COMET_SIGNER, PERPLEXITY_COMPUTER_MCP_URL, PERPLEXITY_MCP_VERSION, } from './catalogue-agents-web.js';
 export { ADDON_MCP_PREFIX, addonGuideLine, addonMcpServer, claudeManagedSettings, codexWithAddonMcpServers, HEADROOM_ENV, HEADROOM_PORT, HEADROOM_UPSTREAM, headroomArgs, headroomEnv, headroomGuideLine, headroomUrl, rtkHookCommand, RTK_GUIDE_LINE, withAddonMcpServers, } from './agent-addons.js';
-export { isStorePackageFile, STORE_PACKAGE_MANIFEST, StorePackageFileSchema, StorePackageManifestSchema, storePackageRole, } from './store-package.js';
+export { isStorePackageFile, STORE_PACKAGE_MANIFEST, StorePackageFileSchema, StorePackageManifestSchema, storePackageRole, storePackageFitsX64, assignStoreRoles, } from './store-package.js';

package/dist/shared/apps/selection.d.ts

@@ -14,6 +14,7 @@ export declare function appsNeedMesa(apps: Config['apps'] | undefined): boolean;
 /** The chosen apps that come from the Microsoft Store: what this PC has to fetch for them. */
 export declare function storeApps(install: readonly string[]): {
     id: string;
+    name: string;
     productId: string;
     packageName: string;
 }[];

package/dist/shared/apps/selection.js

@@ -50,9 +50,10 @@ export function appsNeedMesa(apps) {
 /** The chosen apps that come from the Microsoft Store: what this PC has to fetch for them. */
 export function storeApps(install) {
     return install.flatMap((id) => {
-        const source = appById(id)?.source;
-        return source !== undefined && 'store' in source
-            ? [{ id, productId: source.store.productId, packageName: source.store.packageName }]
+        const entry = appById(id);
+        const source = entry?.source;
+        return entry && source !== undefined && 'store' in source
+            ? [{ id, name: entry.name, productId: source.store.productId, packageName: source.store.packageName }]
             : [];
     });
 }

package/dist/shared/apps/store-package.d.ts

@@ -29,3 +29,16 @@ export declare const STORE_PACKAGE_MANIFEST = "store-package.json";
 export declare function isStorePackageFile(name: string): boolean;
 /** The app itself (named <package name>_<version>_...), as opposed to a framework it depends on (VCLibs ...). */
 export declare function storePackageRole(fileName: string, packageName: string): 'main' | 'dependency';
+/**
+ * Whether a dependency package suits this sandbox (64-bit Windows): winget may also fetch the 32-bit and ARM builds
+ * of a framework, and Add-AppxPackage is only handed the builds that can run here.
+ */
+export declare function storePackageFitsX64(fileName: string): boolean;
+/**
+ * Which fetched file is the app and which are its frameworks. The app is named after its package; when winget names
+ * it otherwise, the one file that did not come from the Dependencies folder is the app. Throws when that is unclear.
+ */
+export declare function assignStoreRoles(names: readonly string[], packageName: string, dependencyNames: readonly string[]): {
+    name: string;
+    role: 'main' | 'dependency';
+}[];

package/dist/shared/apps/store-package.js

@@ -32,3 +32,27 @@ export function isStorePackageFile(name) {
 export function storePackageRole(fileName, packageName) {
     return fileName.toLowerCase().startsWith(packageName.toLowerCase() + '_') ? 'main' : 'dependency';
 }
+/**
+ * Whether a dependency package suits this sandbox (64-bit Windows): winget may also fetch the 32-bit and ARM builds
+ * of a framework, and Add-AppxPackage is only handed the builds that can run here.
+ */
+export function storePackageFitsX64(fileName) {
+    return !/[_.-](x86|arm|arm64)(?=[_.-]|$)/i.test(fileName.replace(/\.(msix|appx|msixbundle|appxbundle)$/i, ''));
+}
+/**
+ * Which fetched file is the app and which are its frameworks. The app is named after its package; when winget names
+ * it otherwise, the one file that did not come from the Dependencies folder is the app. Throws when that is unclear.
+ */
+export function assignStoreRoles(names, packageName, dependencyNames) {
+    const listed = new Set(dependencyNames.map((n) => n.toLowerCase()));
+    let mains = names.filter((n) => storePackageRole(n, packageName) === 'main');
+    if (mains.length === 0)
+        mains = names.filter((n) => !listed.has(n.toLowerCase()));
+    if (mains.length > 1)
+        mains = mains.filter(storePackageFitsX64);
+    if (mains.length !== 1)
+        throw new Error(mains.length === 0
+            ? 'winget gave only frameworks, not the app itself (' + names.join(', ') + ')'
+            : 'winget gave more than one app package and it is not clear which to install (' + mains.join(', ') + ')');
+    return names.map((name) => ({ name, role: name === mains[0] ? 'main' : 'dependency' }));
+}

package/dist/shared/memory/index.d.ts

@@ -1,2 +1 @@
 export * from './policy.js';
-export * from './unreal-build.js';

package/dist/shared/memory/index.js

@@ -1,2 +1 @@
 export * from './policy.js';
-export * from './unreal-build.js';

package/native/csharp/HcsHost/AssemblyInfo.cs

@@ -8,9 +8,9 @@ using System.Runtime.InteropServices;
 [assembly: AssemblyCompany("windows-development-sandbox (open source)")]
 [assembly: AssemblyProduct("Windows Development Sandbox")]
 [assembly: AssemblyCopyright("MIT License, windows-development-sandbox contributors")]
-[assembly: AssemblyVersion("1.28.0.0")]
-[assembly: AssemblyFileVersion("1.28.0.0")]
-[assembly: AssemblyInformationalVersion("1.28.0")]
+[assembly: AssemblyVersion("1.29.0.0")]
+[assembly: AssemblyFileVersion("1.29.0.0")]
+[assembly: AssemblyInformationalVersion("1.29.0")]
 [assembly: ComVisible(false)]
 // computecore.dll and computestorage.dll are not KnownDLLs: load them from System32 only, never from the exe's folder.
 [assembly: DefaultDllImportSearchPaths(DllImportSearchPath.System32)]

package/native/csharp/HostTools/AssemblyInfo.cs

@@ -8,7 +8,7 @@ using System.Runtime.InteropServices;
 [assembly: AssemblyCompany("windows-development-sandbox (open source)")]
 [assembly: AssemblyProduct("Windows Development Sandbox")]
 [assembly: AssemblyCopyright("MIT License, windows-development-sandbox contributors")]
-[assembly: AssemblyVersion("1.28.0.0")]
-[assembly: AssemblyFileVersion("1.28.0.0")]
-[assembly: AssemblyInformationalVersion("1.28.0")]
+[assembly: AssemblyVersion("1.29.0.0")]
+[assembly: AssemblyFileVersion("1.29.0.0")]
+[assembly: AssemblyInformationalVersion("1.29.0")]
 [assembly: ComVisible(false)]

package/native/csharp/HostTools/Window.cs

@@ -1,4 +1,4 @@
-// The Windows Sandbox client window: hidden for a headless sandbox (the VM keeps running), shown again by sbx-show.
+// The Windows Sandbox client window: hidden for a headless sandbox (the VM keeps running), shown again by sandbox show.
 // HostTools hide-window / show-window, or Add-Type from scripts\*-window.ps1 when HostTools cannot be built. C# 5.
 using System;
 using System.Collections.Generic;

package/native/csharp/StorageHelper/AssemblyInfo.cs

@@ -9,7 +9,7 @@ using System.Runtime.InteropServices;
 [assembly: AssemblyCompany("windows-development-sandbox (open source)")]
 [assembly: AssemblyProduct("Windows Development Sandbox")]
 [assembly: AssemblyCopyright("MIT License, windows-development-sandbox contributors")]
-[assembly: AssemblyVersion("1.28.0.0")]
-[assembly: AssemblyFileVersion("1.28.0.0")]
-[assembly: AssemblyInformationalVersion("1.28.0")]
+[assembly: AssemblyVersion("1.29.0.0")]
+[assembly: AssemblyFileVersion("1.29.0.0")]
+[assembly: AssemblyInformationalVersion("1.29.0")]
 [assembly: ComVisible(false)]