[pull] master from microsoft:master

Tools/SandboxTest.ps1

@@ -23,6 +23,7 @@ param(
     [Parameter(HelpMessage = 'The folder to map in the Sandbox.')]
     [ValidateScript({
             if (-not (Test-Path -Path $_ -PathType Container)) { throw "$_ is not a folder." }
+            if ($_ -match '[''"<>&]') { throw "MapFolder path contains forbidden characters (' `" < > &): $_" }
             return $true
         })]
     [String] $MapFolder = $pwd,
@@ -31,6 +32,41 @@ param(
     [string] $WinGetVersion,
     # WinGetOptions
     [Parameter(HelpMessage = 'Additional options for WinGet')]
+    [ValidateScript({
+            # Parse allowed flags only from flag definition lines in winget install --help
+            # These lines start with whitespace followed by a dash (e.g., "  -h,--silent  ...")
+            if (-not (Get-Command 'winget.exe' -ErrorAction SilentlyContinue)) {
+                Write-Warning 'WinGet is not installed on the host. Skipping WinGetOptions validation.'
+                return $true
+            }
+            $helpLines = winget install --help 2>&1 | Where-Object { $_ -match '^\s+-' }
+            $allowedFlags = @()
+            foreach ($line in $helpLines) {
+                # Extract the flag portion before the description (everything up to two consecutive spaces)
+                $flagPart = ($line.Trim() -split '\s{2,}')[0]
+                $parsedTokens = $flagPart -split ',' | ForEach-Object { $_.Trim() }
+                Write-Debug "WinGetOptions: Parsed line '$($line.Trim())' -> flags: $($parsedTokens -join ', ')"
+                $allowedFlags += $parsedTokens
+            }
+            $allowedFlags = $allowedFlags | Where-Object { $_ } | Select-Object -Unique
+            if (-not $allowedFlags) {
+                throw 'Could not parse winget install flags from --help output. Ensure winget is installed.'
+            }
+            Write-Debug "WinGetOptions: Allow-list ($($allowedFlags.Count) flags): $($allowedFlags -join ', ')"
+            $tokens = $_ -split '\s+'
+            foreach ($token in $tokens) {
+                if ($token.StartsWith('-')) {
+                    $isAllowed = $token -in $allowedFlags
+                    Write-Debug "WinGetOptions: Checking token '$token' -> $(if ($isAllowed) { 'ALLOWED' } else { 'BLOCKED' })"
+                    if (-not $isAllowed) {
+                        throw "WinGetOptions contains disallowed flag: $token. Allowed flags: $($allowedFlags -join ', ')"
+                    }
+                } else {
+                    Write-Debug "WinGetOptions: Skipping value token '$token'"
+                }
+            }
+            return $true
+        })]
     [string] $WinGetOptions,
     # Switches
     [switch] $SkipManifestValidation,
@@ -872,19 +908,23 @@ Pop-Location
 # Create the WSB file
 # Although this could be done using the native XML processor, it's easier to just write the content directly as a string
 Write-Verbose 'Creating WSB file for launching the sandbox'
+$escapedTestDataFolder = [System.Security.SecurityElement]::Escape($script:TestDataFolder)
+$escapedPrimaryMappedFolder = [System.Security.SecurityElement]::Escape($script:PrimaryMappedFolder)
+$escapedSandboxWorkingDirectory = [System.Security.SecurityElement]::Escape($script:SandboxWorkingDirectory)
+$escapedSandboxBootstrapFile = [System.Security.SecurityElement]::Escape($script:SandboxBootstrapFile)
 @"
 <Configuration>
   <Networking>Enable</Networking>
   <MappedFolders>
     <MappedFolder>
-      <HostFolder>$($script:TestDataFolder)</HostFolder>
+      <HostFolder>$($escapedTestDataFolder)</HostFolder>
     </MappedFolder>
     <MappedFolder>
-      <HostFolder>$($script:PrimaryMappedFolder)</HostFolder>
+      <HostFolder>$($escapedPrimaryMappedFolder)</HostFolder>
     </MappedFolder>
   </MappedFolders>
   <LogonCommand>
-  <Command>PowerShell Start-Process PowerShell -WindowStyle Maximized -WorkingDirectory '$($script:SandboxWorkingDirectory)' -ArgumentList '-ExecutionPolicy Bypass -NoExit -NoLogo -File $($script:SandboxBootstrapFile)'</Command>
+  <Command>PowerShell Start-Process PowerShell -WindowStyle Maximized -WorkingDirectory '$($escapedSandboxWorkingDirectory)' -ArgumentList '-ExecutionPolicy Bypass -NoExit -NoLogo -File $($escapedSandboxBootstrapFile)'</Command>
   </LogonCommand>
   <AudioInput>Disable</AudioInput>
   <VideoInput>Disable</VideoInput>

manifests/a/Alibaba/OpenCodeReview/1.3.11/Alibaba.OpenCodeReview.installer.yaml

@@ -0,0 +1,18 @@
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.12.0.schema.json
+
+PackageIdentifier: Alibaba.OpenCodeReview
+PackageVersion: 1.3.11
+InstallerType: portable
+Commands:
+- opencodereview
+ReleaseDate: 2026-06-15
+Installers:
+- Architecture: x64
+  InstallerUrl: https://github.com/alibaba/open-code-review/releases/download/v1.3.11/opencodereview-windows-amd64.exe
+  InstallerSha256: 267C6345DE3CE629A3809DEDEC380336467640BBEBB85977ECBEB08FF37AC738
+- Architecture: arm64
+  InstallerUrl: https://github.com/alibaba/open-code-review/releases/download/v1.3.11/opencodereview-windows-arm64.exe
+  InstallerSha256: 54B54BDC83AC901801B9D13893F507B2D4AE096C623C50C65E68AE4DE0E79234
+ManifestType: installer
+ManifestVersion: 1.12.0

manifests/a/Alibaba/OpenCodeReview/1.3.11/Alibaba.OpenCodeReview.locale.en-US.yaml

@@ -0,0 +1,34 @@
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.12.0.schema.json
+
+PackageIdentifier: Alibaba.OpenCodeReview
+PackageVersion: 1.3.11
+PackageLocale: en-US
+Publisher: Alibaba
+PublisherUrl: https://github.com/alibaba
+PublisherSupportUrl: https://github.com/alibaba/open-code-review/issues
+PackageName: Open Code Review
+PackageUrl: https://github.com/alibaba/open-code-review
+License: Apache-2.0
+LicenseUrl: https://github.com/alibaba/open-code-review/blob/HEAD/LICENSE
+Copyright: Copyright 2026 Alibaba
+ShortDescription: The open source AI code review agent.
+Description: |-
+  Open Code Review is an AI-powered code review CLI tool. It originated as Alibaba Group's internal official AI code review assistant — over the past two years, it has served tens of thousands of developers and identified millions of code defects. After thorough validation at massive scale, we incubated it into an open source project for the community. Simply configure a model endpoint to get started.
+  It reads Git diffs, sends changed files to a configurable LLM via an agent with tool-use capabilities, and generates structured review comments with line-level precision. The agent can read full file contents, search the codebase, inspect other changed files for context, and produce deep reviews — not just surface-level diff feedback.
+Tags:
+- ai
+- code
+- review
+ReleaseNotes: |-
+  What's Changed
+  - fix: remove non-existent Claude Sonnet 4.7 & 4.8 models by @hetaoBackend in https://github.com/alibaba/open-code-review/pull/133
+  - refactor: sort provider selection list by @MuoDoo in https://github.com/alibaba/open-code-review/pull/135
+  - feat(llm): add volcengine and kimi providers by @5wxwxwxw5 in https://github.com/alibaba/open-code-review/pull/134
+  New Contributors
+  - @hetaoBackend made their first contribution in https://github.com/alibaba/open-code-review/pull/133
+  - @5wxwxwxw5 made their first contribution in https://github.com/alibaba/open-code-review/pull/134
+  Full Changelog: https://github.com/alibaba/open-code-review/compare/v1.3.10...v1.3.11
+ReleaseNotesUrl: https://github.com/alibaba/open-code-review/releases/tag/v1.3.11
+ManifestType: defaultLocale
+ManifestVersion: 1.12.0

manifests/a/Alibaba/OpenCodeReview/1.3.11/Alibaba.OpenCodeReview.locale.zh-CN.yaml

@@ -0,0 +1,16 @@
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.locale.1.12.0.schema.json
+
+PackageIdentifier: Alibaba.OpenCodeReview
+PackageVersion: 1.3.11
+PackageLocale: zh-CN
+ShortDescription: 开源的 AI 代码审查智能体。
+Description: |-
+  Open Code Review 是一款 AI 驱动的代码审查 CLI 工具。它的前身是阿里集团内部官方 AI 代码审查助手，过去两年在内部服务了数万开发者，识别了数百万个代码缺陷。经过大规模充分验证后，我们将其孵化为开源项目，对社区开放。只需配置一个模型端点即可使用。
+  它读取 Git diff，通过具备工具调用能力的 Agent 将变更文件发送至可配置的 LLM，生成具有行级精度的结构化审查意见。Agent 可以读取完整文件内容、搜索代码库、检查其他变更文件以获取上下文，从而进行深度审查——而非仅停留在表面的 diff 反馈。
+Tags:
+- 人工智能
+- 代码
+- 审查
+ManifestType: locale
+ManifestVersion: 1.12.0

manifests/x/XiaoweiCloud/CalendarTask/3.29.285.8979/XiaoweiCloud.CalendarTask.yaml → manifests/a/Alibaba/OpenCodeReview/1.3.11/Alibaba.OpenCodeReview.yaml

@@ -1,8 +1,8 @@
-# Automatically updated by the winget bot at 2026/Jun/04
-# yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.12.0.schema.json
-
-PackageIdentifier: XiaoweiCloud.CalendarTask
-PackageVersion: 3.29.285.8979
-DefaultLocale: en-US
-ManifestType: version
-ManifestVersion: 1.12.0
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.12.0.schema.json
+
+PackageIdentifier: Alibaba.OpenCodeReview
+PackageVersion: 1.3.11
+DefaultLocale: en-US
+ManifestType: version
+ManifestVersion: 1.12.0

manifests/a/AmN/yasb/2.0.4/AmN.yasb.installer.yaml

@@ -0,0 +1,27 @@
+# Created using wingetcreate 1.12.8.0
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.12.0.schema.json
+
+PackageIdentifier: AmN.yasb
+PackageVersion: 2.0.4
+InstallerLocale: en-US
+InstallerType: msi
+Installers:
+- Architecture: x64
+  InstallerUrl: https://github.com/amnweb/yasb/releases/download/v2.0.4/yasb-2.0.4-x64.msi
+  InstallerSha256: 85E41D377E994F37EEB2CFCB38943BCC0204CC10F85822EAF0856FF903359345
+  ProductCode: '{0524DE13-FAAF-4DF5-BEE3-A13A479EEA97}'
+  AppsAndFeaturesEntries:
+  - DisplayName: YASB Reborn
+    ProductCode: '{0524DE13-FAAF-4DF5-BEE3-A13A479EEA97}'
+    UpgradeCode: '{3F620CF5-07B5-47FD-8E37-9CA8AD14B608}'
+- Architecture: arm64
+  InstallerUrl: https://github.com/amnweb/yasb/releases/download/v2.0.4/yasb-2.0.4-aarch64.msi
+  InstallerSha256: 5583F0355BEC890DB5CDE5285B92BB50A094B47B2EF3ECD76F031507579540A1
+  ProductCode: '{A370D0AA-AFD0-4E45-AFB8-E8D912EF93B9}'
+  AppsAndFeaturesEntries:
+  - DisplayName: YASB Reborn
+    ProductCode: '{A370D0AA-AFD0-4E45-AFB8-E8D912EF93B9}'
+    UpgradeCode: '{3F620CF5-07B5-47FD-8E37-9CA8AD14B608}'
+ManifestType: installer
+ManifestVersion: 1.12.0
+ReleaseDate: 2026-06-15

manifests/a/AmN/yasb/2.0.4/AmN.yasb.locale.en-US.yaml

@@ -0,0 +1,28 @@
+# Created using wingetcreate 1.12.8.0
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.12.0.schema.json
+
+PackageIdentifier: AmN.yasb
+PackageVersion: 2.0.4
+PackageLocale: en-US
+Publisher: AmN
+PublisherUrl: https://github.com/amnweb
+PublisherSupportUrl: https://github.com/amnweb/yasb/issues
+Author: AmN
+PackageName: yasb
+PackageUrl: https://github.com/amnweb/yasb
+License: MIT License
+LicenseUrl: https://github.com/amnweb/yasb/blob/HEAD/LICENSE
+Copyright: Copyright 2024 AmN. All rights reserved.
+CopyrightUrl: https://github.com/amnweb/yasb/blob/main/LICENSE
+ShortDescription: A configurable Windows status bar.
+Description: A configurable Windows status bar.
+Tags:
+- status bar
+- topbar
+ReleaseNotesUrl: https://github.com/amnweb/yasb/releases/tag/v2.0.4
+InstallationNotes: https://github.com/amnweb/yasb
+Documentations:
+- DocumentLabel: Wiki
+  DocumentUrl: https://github.com/amnweb/yasb/wiki
+ManifestType: defaultLocale
+ManifestVersion: 1.12.0

manifests/a/AmN/yasb/2.0.4/AmN.yasb.yaml

@@ -0,0 +1,8 @@
+# Created using wingetcreate 1.12.8.0
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.12.0.schema.json
+
+PackageIdentifier: AmN.yasb
+PackageVersion: 2.0.4
+DefaultLocale: en-US
+ManifestType: version
+ManifestVersion: 1.12.0

manifests/a/Amazon/AWSCLI/2.35.5/Amazon.AWSCLI.installer.yaml

@@ -0,0 +1,25 @@
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.12.0.schema.json
+
+PackageIdentifier: Amazon.AWSCLI
+PackageVersion: 2.35.5
+InstallerType: wix
+Scope: machine
+InstallerSwitches:
+  InstallLocation: AWSCLIV2="<INSTALLPATH>"
+UpgradeBehavior: install
+Commands:
+- aws
+ProductCode: '{919C0DCB-AB87-4402-8C85-CE16E0BC8EA1}'
+AppsAndFeaturesEntries:
+- DisplayName: AWS Command Line Interface v2
+  ProductCode: '{919C0DCB-AB87-4402-8C85-CE16E0BC8EA1}'
+  UpgradeCode: '{E1C1971C-384E-4D6D-8D02-F1AC48281CF8}'
+InstallationMetadata:
+  DefaultInstallLocation: '%ProgramFiles%\Amazon\AWSCLIV2'
+Installers:
+- Architecture: x64
+  InstallerUrl: https://awscli.amazonaws.com/AWSCLIV2-2.35.5.msi
+  InstallerSha256: 648B9854FFC71147223D98FBEA53D82612E724C56C98531AD66C9DF668CE14A9
+ManifestType: installer
+ManifestVersion: 1.12.0

manifests/a/Amazon/AWSCLI/2.35.5/Amazon.AWSCLI.locale.en-US.yaml

@@ -0,0 +1,28 @@
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.12.0.schema.json
+
+PackageIdentifier: Amazon.AWSCLI
+PackageVersion: 2.35.5
+PackageLocale: en-US
+Publisher: Amazon Web Services
+PublisherUrl: https://aws.amazon.com/
+PublisherSupportUrl: https://github.com/aws/aws-cli/issues
+PrivacyUrl: https://aws.amazon.com/privacy/
+Author: Amazon Web Services, Inc
+PackageName: AWS Command Line Interface
+PackageUrl: https://aws.amazon.com/cli/
+License: Apache-2.0
+LicenseUrl: https://github.com/aws/aws-cli/blob/HEAD/LICENSE.txt
+Copyright: Copyright 2012-2026 Amazon.com, Inc.
+CopyrightUrl: https://aws.amazon.com/agreement/
+ShortDescription: Universal Command Line Interface for Amazon Web Services
+Description: The AWS Command Line Interface (AWS CLI) is an open source tool that enables you to interact with AWS services using commands in your command-line shell. With minimal configuration, the AWS CLI enables you to start running commands that implement functionality equivalent to that provided by the browser-based AWS Management Console from the command prompt in your terminal program.
+Tags:
+- aws
+- awscli
+- cli
+- cloud
+- s3
+- web
+ManifestType: defaultLocale
+ManifestVersion: 1.12.0

manifests/a/Amazon/AWSCLI/2.35.5/Amazon.AWSCLI.locale.zh-CN.yaml

@@ -0,0 +1,14 @@
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.locale.1.12.0.schema.json
+
+PackageIdentifier: Amazon.AWSCLI
+PackageVersion: 2.35.5
+PackageLocale: zh-CN
+PublisherUrl: https://aws.amazon.com/cn/
+PrivacyUrl: https://aws.amazon.com/cn/privacy/
+PackageUrl: https://aws.amazon.com/cn/cli/
+CopyrightUrl: https://aws.amazon.com/cn/agreement/
+ShortDescription: Amazon Web Services 的通用命令行界面
+Description: AWS 命令行界面（AWS CLI）是一种开源工具，让您能够使用命令行 Shell 中的命令与 AWS 服务进行交互。AWS CLI 让您只需极少的配置，就能从终端程序的命令提示符中运行命令，以实施与基于浏览器的 AWS 管理控制台提供的功能等效的命令。
+ManifestType: locale
+ManifestVersion: 1.12.0

manifests/a/Amazon/AWSCLI/2.35.5/Amazon.AWSCLI.yaml

@@ -0,0 +1,8 @@
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.12.0.schema.json
+
+PackageIdentifier: Amazon.AWSCLI
+PackageVersion: 2.35.5
+DefaultLocale: en-US
+ManifestType: version
+ManifestVersion: 1.12.0

manifests/a/AppByTroye/KoodoReader/2.3.7/AppByTroye.KoodoReader.installer.yaml

@@ -0,0 +1,48 @@
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.12.0.schema.json
+
+PackageIdentifier: AppByTroye.KoodoReader
+PackageVersion: 2.3.7
+InstallerType: nullsoft
+InstallerSwitches:
+  Upgrade: --updated
+FileExtensions:
+- azw
+- azw3
+- cb7
+- cbr
+- cbt
+- cbz
+- epub
+- fb2
+- mobi
+- pdf
+ProductCode: 233610fa-2bda-5a09-a37b-75e0bafa7920
+ReleaseDate: 2026-06-15
+Installers:
+- Architecture: x64
+  Scope: user
+  InstallerUrl: https://dl.koodoreader.com/v2.3.7/Koodo-Reader-2.3.7-x64.exe
+  InstallerSha256: 4FADFE6DD441E77F758943230A293914DAD185D0A71C153AD46995B11883BBE6
+  InstallerSwitches:
+    Custom: /currentuser
+- Architecture: x64
+  Scope: machine
+  InstallerUrl: https://dl.koodoreader.com/v2.3.7/Koodo-Reader-2.3.7-x64.exe
+  InstallerSha256: 4FADFE6DD441E77F758943230A293914DAD185D0A71C153AD46995B11883BBE6
+  InstallerSwitches:
+    Custom: /allusers
+- Architecture: arm64
+  Scope: user
+  InstallerUrl: https://dl.koodoreader.com/v2.3.7/Koodo-Reader-2.3.7-arm64.exe
+  InstallerSha256: 6C755D23957A990E6C003C9EB54D3EE705BBC34928958F658DD0CD8AEBB572AC
+  InstallerSwitches:
+    Custom: /currentuser
+- Architecture: arm64
+  Scope: machine
+  InstallerUrl: https://dl.koodoreader.com/v2.3.7/Koodo-Reader-2.3.7-arm64.exe
+  InstallerSha256: 6C755D23957A990E6C003C9EB54D3EE705BBC34928958F658DD0CD8AEBB572AC
+  InstallerSwitches:
+    Custom: /allusers
+ManifestType: installer
+ManifestVersion: 1.12.0