gemini-cli/packages/core/scripts/compile-windows-sandbox.js

/**
 * @license
 * Copyright 2026 Google LLC
 * SPDX-License-Identifier: Apache-2.0
 */

import { spawnSync } from 'node:child_process';
import path from 'node:path';
import fs from 'node:fs';
import os from 'node:os';
import { fileURLToPath } from 'node:url';

const __filename = fileURLToPath(import.meta.url);
const __dirname = path.dirname(__filename);

/**
 * Compiles the GeminiSandbox C# helper on Windows.
 * This is used to provide native restricted token sandboxing.
 */
function compileWindowsSandbox() {
  if (os.platform() !== 'win32') {
    return;
  }

  const srcHelperPath = path.resolve(__dirname, '../src/services/scripts/GeminiSandbox.exe');
  const distHelperPath = path.resolve(__dirname, '../dist/src/services/scripts/GeminiSandbox.exe');
  const sourcePath = path.resolve(__dirname, '../src/services/scripts/GeminiSandbox.cs');

  if (!fs.existsSync(sourcePath)) {
    console.error(`Sandbox source not found at ${sourcePath}`);
    return;
  }

  // Ensure directories exist
  [srcHelperPath, distHelperPath].forEach(p => {
    const dir = path.dirname(p);
    if (!fs.existsSync(dir)) {
      fs.mkdirSync(dir, { recursive: true });
    }
  });

  // Find csc.exe (C# Compiler) which is built into Windows .NET Framework
  const systemRoot = process.env['SystemRoot'] || 'C:\\Windows';
  const cscPaths = [
    path.join(systemRoot, 'Microsoft.NET', 'Framework64', 'v4.0.30319', 'csc.exe'),
    path.join(systemRoot, 'Microsoft.NET', 'Framework', 'v4.0.30319', 'csc.exe'),
  ];

  const csc = cscPaths.find(p => fs.existsSync(p));

  if (!csc) {
    console.warn('Windows C# compiler (csc.exe) not found. Native sandboxing will attempt to compile on first run.');
    return;
  }

  console.log(`Compiling native Windows sandbox helper...`);
  // Compile to src
  let result = spawnSync(csc, [`/out:${srcHelperPath}`, '/optimize', sourcePath], {
    stdio: 'inherit',
  });

  if (result.status === 0) {
    console.log('Successfully compiled GeminiSandbox.exe to src');
    // Copy to dist if dist exists
    const distDir = path.resolve(__dirname, '../dist');
    if (fs.existsSync(distDir)) {
       const distScriptsDir = path.dirname(distHelperPath);
       if (!fs.existsSync(distScriptsDir)) {
         fs.mkdirSync(distScriptsDir, { recursive: true });
       }
       fs.copyFileSync(srcHelperPath, distHelperPath);
       console.log('Successfully copied GeminiSandbox.exe to dist');
    }
  } else {
    console.error('Failed to compile Windows sandbox helper.');
  }
}

compileWindowsSandbox();