@@ -0,0 +1,109 @@
+#!/usr/bin/env bun
+// Boots a real sandbox end-to-end on Windows: serves a locally built rootfs
+// tarball over loopback HTTP, creates the distribution (download -> verify ->
+// wsl --import), starts the guest server, and waits for the codev server's
+// authenticated health check over WSL2's localhost forwarding. Dev utility.
+//
+// Run from packages/codev-sandbox on the Windows machine:
+//   bun script/e2e-wsl.ts --image dist-images\bwrap-x64.tar.gz ^
+//     --bundle ..\opencode\dist\node [--project dir] [--hold] [--keep]
+//
+// --hold keeps the distribution running so you can poke at it; --keep skips the
+// unregister so it survives the run (clean up with `wsl --unregister codev-e2e`).
+import { createHash } from "node:crypto"
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises"
+import { tmpdir } from "node:os"
+import { basename, join, resolve } from "node:path"
+import { checkSandboxHealth } from "../src/boot"
+import type { SandboxConfig } from "../src/provider"
+import { createWslProvider } from "../src/wsl/provider"
+
+// Both paths cross into the distribution through wslpath, which resolves
+// relative paths against the guest's cwd — so they have to be absolute here.
+const image = resolve(requireArg("--image"))
+const bundle = resolve(requireArg("--bundle"))
+const hold = process.argv.includes("--hold")
+const keep = process.argv.includes("--keep")
+
+const work = await mkdtemp(join(tmpdir(), "codev-wsl-e2e-"))
+const projectDir = argValue("--project") ? resolve(argValue("--project")!) : join(work, "project")
+await mkdir(projectDir, { recursive: true })
+await writeFile(join(projectDir, "hello.txt"), "hello from the host project\n")
+
+// Digest once, outside resolveImage: a hash object cannot be digested twice, so
+// computing it inside the callback breaks the moment the provider asks again.
+const payload = Bun.file(image)
+const hash = createHash("sha256")
+for await (const chunk of payload.stream()) hash.update(chunk)
+const sha256 = hash.digest("hex")
+
+const server = Bun.serve({ port: 0, fetch: () => new Response(Bun.file(image)) })
+
+const provider = createWslProvider({
+  dataDir: join(work, "data"),
+  cacheDir: join(work, "cache"),
+  bundleDir: bundle,
+  resolveImage: async () => ({
+    url: `http://127.0.0.1:${server.port}/${basename(image)}`,
+    sha256,
+    bytes: payload.size,
+  }),
+  startTimeoutMs: 180_000,
+})
+
+const availability = await provider.availability()
+console.log("availability:", availability)
+if (!availability.supported) {
+  console.error(`cannot run here: ${availability.message}`)
+  await cleanup()
+  process.exit(1)
+}
+if (availability.warning) console.log(`warning: ${availability.warning}`)
+
+const config: SandboxConfig = { id: "sandbox:e2e", name: "e2e", backend: "wsl", projectDir }
+
+console.time("create")
+await provider.create(config)
+console.timeEnd("create")
+
+console.time("start")
+const sandbox = await provider.start(config)
+console.timeEnd("start")
+console.log(`server: ${sandbox.url} (user ${sandbox.username})`)
+
+const healthy = await checkSandboxHealth(sandbox.url, { username: sandbox.username ?? "", password: sandbox.password })
+console.log(`health: ${healthy ? "OK" : "FAILED"}`)
+
+if (hold) {
+  console.log("holding the distribution up; Ctrl-C to stop")
+  await new Promise(() => {})
+}
+
+const exited = new Promise<void>((resolve) => sandbox.onExit(() => resolve()))
+sandbox.stop()
+await Promise.race([exited, new Promise((resolve) => setTimeout(resolve, 10_000))])
+if (keep) console.log(`keeping the distribution; remove it with: wsl --unregister codev-${config.name}`)
+if (!keep) await provider.destroy(config)
+await cleanup()
+if (!healthy) process.exit(1)
+console.log("e2e OK")
+process.exit(0)
+
+async function cleanup() {
+  server.stop(true)
+  await rm(work, { recursive: true, force: true })
+}
+
+function argValue(flag: string) {
+  const index = process.argv.indexOf(flag)
+  return index >= 0 ? process.argv[index + 1] : undefined
+}
+
+function requireArg(flag: string) {
+  const value = argValue(flag)
+  if (!value) {
+    console.error(`${flag} is required`)
+    process.exit(1)
+  }
+  return value
+}