@shipvo/cli 0.1.5 → 0.1.6

package/dist/run-net.js

@@ -0,0 +1,266 @@
+import { createRequire } from "node:module";
+import { hostAllowed, isLoopback, originAllowed, tokenMatches } from "./run-protocol.js";
+export const NET_PATH = "/__shipvo/net";
+/** One cookie jar per phone session, like the cookies of one installed app. */
+export class CookieJar {
+    list = [];
+    set(url, header, now = Date.now()) {
+        const [pair, ...attrs] = header.split(";").map((x) => x.trim());
+        const eq = pair.indexOf("=");
+        if (eq < 1)
+            return;
+        const c = { name: pair.slice(0, eq), value: pair.slice(eq + 1), domain: url.hostname, hostOnly: true, path: defaultPath(url.pathname), secure: false };
+        for (const a of attrs) {
+            const i = a.indexOf("=");
+            const k = (i < 0 ? a : a.slice(0, i)).toLowerCase();
+            const v = i < 0 ? "" : a.slice(i + 1);
+            if (k === "domain" && v) {
+                c.domain = v.replace(/^\./, "").toLowerCase();
+                c.hostOnly = false;
+            }
+            else if (k === "path" && v.startsWith("/"))
+                c.path = v;
+            else if (k === "secure")
+                c.secure = true;
+            else if (k === "expires" && c.expires === undefined) {
+                const t = Date.parse(v);
+                if (!Number.isNaN(t))
+                    c.expires = t;
+            }
+            else if (k === "max-age" && /^-?\d+$/.test(v))
+                c.expires = now + Number(v) * 1000;
+        }
+        if (!c.hostOnly && !(url.hostname === c.domain || url.hostname.endsWith("." + c.domain)))
+            return;
+        this.list = this.list.filter((o) => !(o.name === c.name && o.domain === c.domain && o.path === c.path));
+        if (c.expires === undefined || c.expires > now)
+            this.list.push(c);
+    }
+    header(url, now = Date.now()) {
+        this.list = this.list.filter((c) => c.expires === undefined || c.expires > now);
+        return this.list
+            .filter((c) => (c.hostOnly ? url.hostname === c.domain : url.hostname === c.domain || url.hostname.endsWith("." + c.domain)) && url.pathname.startsWith(c.path) && (!c.secure || url.protocol === "https:"))
+            .sort((a, b) => b.path.length - a.path.length)
+            .map((c) => `${c.name}=${c.value}`).join("; ");
+    }
+}
+const defaultPath = (p) => { const i = p.lastIndexOf("/"); return i <= 0 ? "/" : p.slice(0, i); };
+const FALLBACK = {
+    online: { latencyMs: 0, downKbps: Infinity, failureRate: 0 }, offline: { latencyMs: 0, downKbps: 0, failureRate: 1 },
+    "2g": { latencyMs: 800, downKbps: 50, failureRate: 0.02 }, "3g": { latencyMs: 300, downKbps: 750, failureRate: 0.01 },
+    "slow-4g": { latencyMs: 150, downKbps: 1600, failureRate: 0 }, spotty: { latencyMs: 400, downKbps: 500, failureRate: 0.3 },
+    "low-end-4g": { latencyMs: 100, downKbps: 6300, failureRate: 0.005 },
+};
+/** The profile table from @shipvo/sim (one source of truth); a built-in copy if that file cannot be loaded. */
+export async function loadProfiles() {
+    try {
+        const file = createRequire(import.meta.url).resolve("@shipvo/sim/network-profiles.mjs");
+        const mod = await import(new URL(`file://${file.startsWith("/") ? "" : "/"}${file.replace(/\\/g, "/")}`).href);
+        return mod.PROFILES;
+    }
+    catch {
+        return FALLBACK;
+    }
+}
+const HOP = new Set(["connection", "keep-alive", "transfer-encoding", "upgrade", "proxy-connection", "te", "trailer", "content-length", "content-encoding", "set-cookie", "host"]);
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const readBody = (req) => new Promise((ok, fail) => { const b = []; req.on("data", (c) => b.push(c)); req.on("end", () => ok(Buffer.concat(b))); req.on("error", fail); });
+const hostOf = (u) => u.host;
+/** The request handler for `NET_PATH`. `tokens` are the credentials it accepts; `port()` is the bound port. */
+export function createNetProxy(o) {
+    const jars = new Map();
+    const log = [];
+    const doFetch = o.fetchImpl ?? fetch;
+    let draw = 1;
+    const random = () => { draw = (Math.imul(draw, 1664525) + 1013904223) >>> 0; return draw / 4294967296; };
+    const refuse = (res, code, msg) => { res.writeHead(code, { "content-type": "text/plain" }); res.end(msg); };
+    async function handle(req, res) {
+        const port = o.port();
+        if (!isLoopback(req.socket.remoteAddress) || !hostAllowed(req.headers.host, port) || req.headers.origin === undefined || !originAllowed(req.headers.origin, port))
+            return refuse(res, 403, "Forbidden");
+        const given = req.headers["x-shipvo-token"];
+        if (typeof given !== "string" || !o.tokens.some((t) => tokenMatches(given, t)))
+            return refuse(res, 401, "Unauthorized");
+        if (req.method !== "POST")
+            return refuse(res, 405, "Use POST");
+        let spec;
+        try {
+            spec = JSON.parse(decodeURIComponent(String(req.headers["x-shipvo-req"])));
+            new URL(spec.url);
+        }
+        catch {
+            return refuse(res, 400, "Bad request description");
+        }
+        const url = new URL(spec.url);
+        if (url.protocol !== "http:" && url.protocol !== "https:")
+            return refuse(res, 400, "Only http and https");
+        const session = String(req.headers["x-shipvo-session"] ?? "default").slice(0, 64);
+        const profileName = String(req.headers["x-shipvo-profile"] ?? "online");
+        const profile = o.profiles[profileName] ?? o.profiles.online;
+        const method = String(spec.method || "GET").toUpperCase();
+        const started = Date.now();
+        const record = (status, error) => { const r = { at: started, session, method, host: hostOf(url), status, ms: Date.now() - started, profile: profileName, ...(error ? { error } : {}) }; log.push(r); o.onRecord?.(r); };
+        const body = await readBody(req);
+        const failed = profile.failureRate >= 1 || random() < profile.failureRate;
+        const bytesMs = (n) => (n && Number.isFinite(profile.downKbps) && profile.downKbps > 0 ? (n * 8) / profile.downKbps : 0);
+        await sleep(profile.latencyMs + bytesMs(body.length));
+        // XMLHttpRequest cannot tell a 599 from a reply, so drop the connection and let the browser raise its own `error` event.
+        const dropForXhr = () => { if (req.headers["x-shipvo-xhr"]) {
+            req.socket.destroy();
+            return true;
+        } return false; };
+        if (failed) {
+            record(599, "network request failed");
+            if (dropForXhr())
+                return;
+            res.writeHead(599, { "x-shipvo-net-error": "1", "content-type": "text/plain" });
+            return void res.end("network request failed");
+        }
+        let jar = jars.get(session);
+        if (!jar)
+            jars.set(session, jar = new CookieJar());
+        const headers = new Headers();
+        for (const [k, v] of Object.entries(spec.headers ?? {}))
+            if (!HOP.has(k.toLowerCase()) && !["cookie", "origin", "referer"].includes(k.toLowerCase()))
+                headers.set(k, v);
+        let up;
+        let cur = url;
+        let curMethod = method;
+        let curBody = method === "GET" || method === "HEAD" || body.length === 0 ? undefined : new Uint8Array(body);
+        try {
+            // Redirects are followed here so each hop's Set-Cookie reaches the jar and its cookies go out on the next hop.
+            for (let hop = 0;; hop++) {
+                const h = new Headers(headers);
+                h.delete("cookie");
+                const c = jar.header(cur);
+                if (c)
+                    h.set("cookie", c);
+                up = await doFetch(cur, { method: curMethod, headers: h, body: curBody, redirect: "manual" });
+                for (const sc of up.headers.getSetCookie())
+                    jar.set(cur, sc);
+                const loc = up.headers.get("location");
+                if (![301, 302, 303, 307, 308].includes(up.status) || !loc)
+                    break;
+                if (hop >= 20)
+                    throw new Error("too many redirects");
+                const next = new URL(loc, cur);
+                if (next.protocol !== "http:" && next.protocol !== "https:")
+                    throw new Error("redirect to an unsupported address");
+                void up.body?.cancel().catch(() => { });
+                if (next.origin !== cur.origin)
+                    headers.delete("authorization");
+                if (up.status === 303 ? curMethod !== "HEAD" : (up.status === 301 || up.status === 302) && curMethod === "POST") {
+                    curMethod = "GET";
+                    curBody = undefined;
+                }
+                cur = next;
+            }
+        }
+        catch (e) {
+            record(599, e.message);
+            if (dropForXhr())
+                return;
+            res.writeHead(599, { "x-shipvo-net-error": "1", "content-type": "text/plain" });
+            return void res.end(`network request failed: ${e.message}`);
+        }
+        const out = { "x-shipvo-final-url": cur.href, "cache-control": "no-store" };
+        up.headers.forEach((v, k) => { if (!HOP.has(k))
+            out[k] = v; });
+        res.writeHead(up.status, out);
+        record(up.status);
+        if (!up.body || method === "HEAD")
+            return void res.end();
+        res.on("close", () => { void up.body?.cancel().catch(() => { }); });
+        const reader = up.body.getReader();
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            const wait = bytesMs(value.length);
+            if (wait > 0)
+                await sleep(wait);
+            if (!res.write(value))
+                await new Promise((r) => res.once("drain", r));
+        }
+        res.end();
+    }
+    return { handle: (req, res) => handle(req, res).catch(() => { if (!res.headersSent)
+            refuse(res, 500, "Proxy error");
+        else
+            res.destroy(); }), log };
+}
+/** The script that runs inside the app's page: sends cross-origin fetch and XMLHttpRequest through `NET_PATH`. */
+export function netClientSource() { return `(${netClientMain.toString()})`; }
+function netClientMain(win, cfg) {
+    const origin = win.location.origin;
+    const abs = (u) => new win.URL(u, win.location.href);
+    const proxied = (u) => { try {
+        const x = abs(String(u));
+        return (x.protocol === "http:" || x.protocol === "https:") && x.origin !== origin ? x : null;
+    }
+    catch {
+        return null;
+    } };
+    const meta = (url, method, headers) => ({
+        "x-shipvo-token": cfg.token, "x-shipvo-session": cfg.session, "x-shipvo-profile": cfg.profile(),
+        "x-shipvo-req": encodeURIComponent(JSON.stringify({ url: url.href, method, headers })),
+    });
+    const origFetch = win.fetch.bind(win);
+    win.fetch = async function (input, init) {
+        const isReq = input instanceof win.Request;
+        // Decide before building a Request: building one from a Request with a body would use up the original.
+        if (!proxied(isReq ? input.url : input))
+            return origFetch(input, init);
+        const req = new win.Request(input, init);
+        const url = proxied(req.url);
+        if (!url)
+            return origFetch(input, init);
+        const t0 = Date.now();
+        const headers = {};
+        req.headers.forEach((v, k) => { headers[k] = v; });
+        const fail = () => { cfg.log({ method: req.method, host: url.host, status: 0, ms: Date.now() - t0 }); throw new TypeError("Network request failed"); };
+        if (!cfg.online())
+            fail();
+        const body = req.method === "GET" || req.method === "HEAD" ? undefined : await req.arrayBuffer();
+        let res;
+        try {
+            res = await origFetch("/__shipvo/net", { method: "POST", headers: meta(url, req.method, headers), body, signal: req.signal, cache: "no-store" });
+        }
+        catch {
+            fail();
+        }
+        if (res.headers.get("x-shipvo-net-error"))
+            fail();
+        cfg.log({ method: req.method, host: url.host, status: res.status, ms: Date.now() - t0 });
+        return res;
+    };
+    const X = win.XMLHttpRequest;
+    if (X) {
+        const open = X.prototype.open, send = X.prototype.send, setH = X.prototype.setRequestHeader;
+        X.prototype.open = function (method, u, ...rest) {
+            const url = proxied(u);
+            this.__net = url ? { url, method: String(method).toUpperCase(), headers: {} } : undefined;
+            return this.__net ? open.call(this, "POST", "/__shipvo/net", ...rest) : open.call(this, method, u, ...rest);
+        };
+        X.prototype.setRequestHeader = function (k, v) { if (this.__net) {
+            this.__net.headers[k] = v;
+            return;
+        } return setH.call(this, k, v); };
+        X.prototype.send = function (body) {
+            const n = this.__net;
+            if (!n)
+                return send.call(this, body);
+            const t0 = Date.now();
+            if (!cfg.online()) {
+                cfg.log({ method: n.method, host: n.url.host, status: 0, ms: 0 });
+                win.setTimeout(() => { this.dispatchEvent(new win.ProgressEvent("error")); }, 0);
+                return;
+            }
+            const m = { ...meta(n.url, n.method, n.headers), "x-shipvo-xhr": "1" };
+            for (const k of Object.keys(m))
+                setH.call(this, k, m[k]);
+            this.addEventListener("loadend", () => cfg.log({ method: n.method, host: n.url.host, status: this.status, ms: Date.now() - t0 }));
+            return send.call(this, n.method === "GET" || n.method === "HEAD" ? null : body);
+        };
+    }
+}

package/dist/run.d.ts

@@ -1,11 +1,17 @@
+import { networkInterfaces } from "node:os";
 import { type Server } from "node:http";
+import { type NetRecord } from "./run-net.js";
 export type Platform = "android" | "ios";
 export type RunOptions = {
     platform: Platform;
     open: boolean;
     port?: number;
     native: boolean;
+    lan: boolean;
 };
+export declare const RUN_USAGE = "Usage: shipvo run android|ios [options]\n\nOptions:\n  --no-open     do not open the browser\n  --port <n>    serve on this port (default: a free port)\n  --native      run on a real emulator or simulator with `npx expo run:<platform>`\n\nExample: shipvo run android";
+/** True when this project has no earlier web build, so Metro starts with an empty cache. */
+export declare const isFirstBuild: (root: string) => boolean;
 /** Parses `run` arguments. Throws a plain message for anything it does not know. */
 export declare function parseRunArgs(argv: string[]): RunOptions;
 /** The command `--native` runs. */
@@ -42,6 +48,8 @@ export type RenderFrame = ((o: {
     dark?: boolean;
     status?: object;
     screen?: string;
+    lumi?: boolean;
+    guide?: boolean;
 }) => {
     width: number;
     height: number;
@@ -57,6 +65,12 @@ export type RenderFrame = ((o: {
 export declare function loadFrameRenderer(bases?: string[]): Promise<RenderFrame>;
 /** The page that shows the app in an Android or iOS frame at its real logical size, scaled to fit the window. The phone body comes from @shipvo/sim's renderFrame. */
 export declare function runFramePage(platform: Platform, name: string, render: RenderFrame, dark?: boolean, token?: string): string;
+/** True for a phone or tablet browser, by user agent. */
+export declare const isMobileUserAgent: (ua: string | undefined) => boolean;
+/** The page for a real phone's browser: the app fills the screen, no phone frame. */
+export declare function runBarePage(name: string, dark?: boolean): string;
+/** The first private IPv4 address of this machine (or any non-internal one), or undefined. */
+export declare function lanAddress(ifaces?: ReturnType<typeof networkInterfaces>): string | undefined;
 /** Adds `.shipvo/` to `<dir>/.gitignore` when it is not already ignored. */
 export declare function ensureShipvoIgnored(dir: string): void;
 /**
@@ -69,18 +83,27 @@ export declare function startRunServer(opts: {
     dir: string;
     platform: Platform;
     name: string;
+    appId?: string;
     port?: number;
     projectDir?: string;
     render?: RenderFrame;
+    lan?: {
+        host: string;
+    };
+    onNet?: (r: NetRecord) => void;
+    fetchImpl?: typeof fetch;
 }): Promise<{
     server: Server;
     port: number;
     token: string;
+    lanToken?: string;
+    netLog: NetRecord[];
     close: () => Promise<void>;
 }>;
 /** Names the module or file a web build failed on, from the build's error output. */
 export declare function describeWebBuildFailure(output: string): string;
 /** Builds the web export with `rebuildInto` from sim.ts (the same build as `shipvo sim`) into `<root>/sim-dist`. */
 export declare function buildWeb(root: string, command?: string): Promise<void>;
+export declare function openBrowser(url: string): void;
 /** Returns the exit code. */
 export declare function run(argv: string[]): Promise<number>;

package/dist/run.js

@@ -2,6 +2,7 @@
 // open a phone frame page in the default browser. No browser automation. `--native` runs `npx expo run:<platform>`.
 import { spawn, spawnSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
+import { networkInterfaces } from "node:os";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { createServer } from "node:http";
 import { createRequire } from "node:module";
@@ -10,14 +11,28 @@ import { join, extname, normalize, resolve, sep } from "node:path";
 import { loadConfig } from "./config.js";
 import { AGENT_PATH, hostAllowed, isAgentRole, isLoopback, originAllowed, tokenMatches } from "./run-protocol.js";
 import { bridgeScript } from "./run-bridge.js";
+import { NET_PATH, createNetProxy, loadProfiles, netClientSource } from "./run-net.js";
 import { acceptWebSocket } from "./run-ws.js";
+import { qrMatrix, qrToTerminal } from "./qr.js";
+import { spawnBin } from "./spawn-bin.js";
 import { portFree, rebuildInto } from "./sim.js";
+export const RUN_USAGE = `Usage: shipvo run android|ios [options]
+
+Options:
+  --no-open     do not open the browser
+  --port <n>    serve on this port (default: a free port)
+  --native      run on a real emulator or simulator with \`npx expo run:<platform>\`
+
+Example: shipvo run android`;
+/** True when this project has no earlier web build, so Metro starts with an empty cache. */
+export const isFirstBuild = (root) => !existsSync(join(root, "sim-dist"));
 /** Parses `run` arguments. Throws a plain message for anything it does not know. */
 export function parseRunArgs(argv) {
     let platform;
     let open = true;
     let port;
     let native = false;
+    let lan = false;
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
         if (a === "android" || a === "ios")
@@ -26,6 +41,8 @@ export function parseRunArgs(argv) {
             open = false;
         else if (a === "--native")
             native = true;
+        else if (a === "--lan")
+            lan = true;
         else if (a === "--port") {
             const v = argv[++i];
             if (!v || !/^\d+$/.test(v) || Number(v) > 65535)
@@ -33,11 +50,13 @@ export function parseRunArgs(argv) {
             port = Number(v);
         }
         else
-            throw new Error(`Unknown argument "${a}". Usage: shipvo run android|ios [--no-open] [--port <n>] [--native]`);
+            throw new Error(`Unknown argument "${a}". Usage: shipvo run android|ios [--no-open] [--port <n>] [--native] [--lan]`);
     }
     if (!platform)
-        throw new Error("Say which phone: shipvo run android or shipvo run ios.");
-    return { platform, open, port, native };
+        throw new Error("Say which phone: shipvo run android or shipvo run ios. Try: shipvo run android");
+    if (lan && native)
+        throw new Error("--lan serves the simulated phone; it cannot be combined with --native.");
+    return { platform, open, port, native, lan };
 }
 /** The command `--native` runs. */
 export const nativeCommand = (p) => ({ cmd: "npx", args: ["expo", `run:${p}`] });
@@ -68,7 +87,7 @@ export function runFramePage(platform, name, render, dark = false, token) {
     const f = FRAMES[platform];
     const title = name.replace(/[<>&"']/g, "");
     const sheet = `<div class="sheet" id="sheet" role="dialog" aria-label="${f.label} system sheet" data-part="system-sheet"><div class="box"><p>${f.sheet.title}</p><button type="button" data-act="allow">${f.sheet.allow}</button><button type="button" data-act="deny">${f.sheet.deny}</button></div></div>`;
-    const frame = render({ skin: platform, dark, screen: `<iframe id="app" src="/app/" title="${title}"></iframe>${sheet}` });
+    const frame = render({ skin: platform, dark, guide: true, screen: `<iframe id="app" src="/app/" title="${title}"></iframe>${sheet}` });
     return `<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
 <title>${title} on ${f.label} (simulated)</title>
@@ -96,6 +115,23 @@ function fit(){var s=Math.min(1,(innerWidth-24)/${frame.outerWidth},(innerHeight
 addEventListener("resize",fit);fit();
 </script>${render.statusScript ? `<script>${render.statusScript("app", platform).replace(/<\/script/gi, "<\\/script")}</script>` : ""}${token ? `<script src="/__shipvo/bridge.js" data-token="${token}"></script>` : ""}</body></html>`;
 }
+/** True for a phone or tablet browser, by user agent. */
+export const isMobileUserAgent = (ua) => /Android|iPhone|iPad|iPod|Mobile/i.test(ua ?? "");
+/** The page for a real phone's browser: the app fills the screen, no phone frame. */
+export function runBarePage(name, dark = false) {
+    const title = name.replace(/[<>&"']/g, "");
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
+<title>${title}</title>
+<style>html,body{margin:0;height:100%;overflow:hidden;background:${dark ? "#15171a" : "#fff"}}iframe{position:fixed;inset:0;width:100%;height:100%;border:0}</style></head><body>
+<iframe id="app" src="/app/" title="${title}" data-part="bare-app"></iframe>
+</body></html>`;
+}
+/** The first private IPv4 address of this machine (or any non-internal one), or undefined. */
+export function lanAddress(ifaces = networkInterfaces()) {
+    const all = Object.values(ifaces).flatMap((l) => l ?? []).filter((i) => i.family === "IPv4" && !i.internal).map((i) => i.address);
+    return all.find((a) => /^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/.test(a)) ?? all[0];
+}
 const TYPES = {
     ".html": "text/html; charset=utf-8", ".js": "text/javascript; charset=utf-8", ".css": "text/css; charset=utf-8", ".json": "application/json",
     ".png": "image/png", ".jpg": "image/jpeg", ".gif": "image/gif", ".svg": "image/svg+xml", ".webp": "image/webp", ".ico": "image/x-icon",
@@ -123,12 +159,27 @@ export async function startRunServer(opts) {
     const render = opts.render ?? await loadFrameRenderer();
     const pages = { light: runFramePage(opts.platform, opts.name, render, false, pageToken), dark: runFramePage(opts.platform, opts.name, render, true, pageToken) };
     const bridge = bridgeScript();
+    // With --lan every request needs this token, in `?t=` or in the cookie the first valid request sets.
+    const lanToken = opts.lan ? randomBytes(16).toString("hex") : undefined;
     let boundPort = -1; // set once the server listens; Host and Origin must match it
+    // App requests to other origins go through /__shipvo/net, so the browser applies no CORS (see run-net.ts). Only the page's token opens it.
+    const net = createNetProxy({ tokens: [pageToken, token], port: () => boundPort, profiles: await loadProfiles(), onRecord: opts.onNet, fetchImpl: opts.fetchImpl });
+    const netSnippet = `<script>(${netClientSource()})(window,{token:${JSON.stringify(pageToken)},session:(function(){try{var k="shipvo_net_session";return sessionStorage.getItem(k)||(sessionStorage.setItem(k,crypto.randomUUID()),sessionStorage.getItem(k))}catch(e){return "tab"}})(),profile:function(){return window.__pnNet?window.__pnNet.profile():"online"},online:function(){return window.__pnNet?window.__pnNet.online():true},log:function(d){if(window.__pnNet)window.__pnNet.log(d)}})</script>`;
     const server = createServer((req, res) => {
-        if (!hostAllowed(req.headers.host, boundPort)) {
+        if (!hostAllowed(req.headers.host, boundPort) && !(opts.lan && req.headers.host === `${opts.lan.host}:${boundPort}`)) {
             res.writeHead(403);
             return void res.end("Forbidden");
         }
+        if (lanToken) {
+            const given = new URL(req.url ?? "/", "http://x").searchParams.get("t");
+            const cookie = /(?:^|;\s*)shipvo_t=([0-9a-f]+)/.exec(req.headers.cookie ?? "")?.[1] ?? null;
+            if (tokenMatches(given, lanToken))
+                res.setHeader("set-cookie", `shipvo_t=${lanToken}; Path=/; HttpOnly; SameSite=Lax`);
+            else if (!tokenMatches(cookie, lanToken)) {
+                res.writeHead(403);
+                return void res.end("Forbidden: open the address shipvo run printed, it has the token.");
+            }
+        }
         let path;
         try {
             path = decodeURIComponent((req.url ?? "/").split("?")[0]);
@@ -143,9 +194,12 @@ export async function startRunServer(opts) {
         }
         if (path === "/" || path === "/index.html") {
             const dark = new URL(req.url ?? "/", "http://x").searchParams.get("dark") === "1";
-            res.writeHead(200, { "content-type": TYPES[".html"] });
-            return void res.end(dark ? pages.dark : pages.light);
+            const bare = isMobileUserAgent(req.headers["user-agent"]);
+            res.writeHead(200, { "content-type": TYPES[".html"], vary: "user-agent" });
+            return void res.end(bare ? runBarePage(opts.name, dark) : dark ? pages.dark : pages.light);
         }
+        if (path === NET_PATH)
+            return void net.handle(req, res);
         if (path === "/__shipvo/bridge.js") {
             res.writeHead(200, { "content-type": TYPES[".js"], "cache-control": "no-store" });
             return void res.end(bridge);
@@ -168,7 +222,14 @@ export async function startRunServer(opts) {
             }
             target = spa;
         }
-        res.writeHead(200, { "content-type": TYPES[extname(target).toLowerCase()] ?? "application/octet-stream" });
+        const type = TYPES[extname(target).toLowerCase()] ?? "application/octet-stream";
+        res.writeHead(200, { "content-type": type });
+        if (extname(target).toLowerCase() === ".html") {
+            const html = readFileSync(target, "utf8"); // first script in the page, so it wraps fetch before the app's code runs
+            // A real phone (not loopback) cannot use the route, which only serves the local page: leave its requests direct.
+            if (isLoopback(req.socket.remoteAddress) && /<head[^>]*>/i.test(html))
+                return void res.end(html.replace(/<head[^>]*>/i, (m) => m + netSnippet));
+        }
         res.end(readFileSync(target));
     });
     const peers = {};
@@ -210,15 +271,15 @@ export async function startRunServer(opts) {
         rmSync(infoPath, { force: true }); };
     return new Promise((ok, fail) => {
         server.once("error", fail);
-        server.listen(opts.port ?? 0, "127.0.0.1", () => {
+        server.listen(opts.port ?? 0, opts.lan ? "0.0.0.0" : "127.0.0.1", () => {
             const port = server.address().port;
             boundPort = port;
             if (infoPath) {
-                const info = { port, platform: opts.platform, app: opts.name, token, pid: process.pid };
+                const info = { port, platform: opts.platform, app: opts.appId ?? opts.name, token, pid: process.pid };
                 mkdirSync(join(infoPath, ".."), { recursive: true });
                 writeFileSync(infoPath, JSON.stringify(info, null, 2) + "\n", { mode: 0o600 });
             }
-            ok({ server, port, token, close: () => new Promise((r) => { cleanup(); for (const p of Object.values(peers))
+            ok({ server, port, token, lanToken, netLog: net.log, close: () => new Promise((r) => { cleanup(); for (const p of Object.values(peers))
                     p?.close(); server.close(() => r()); server.closeAllConnections?.(); }) });
         });
     });
@@ -243,7 +304,7 @@ export async function buildWeb(root, command) {
         throw new Error(describeWebBuildFailure(e.output ?? e.message));
     }
 }
-function openBrowser(url) {
+export function openBrowser(url) {
     const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
     const p = spawn(cmd, args, { stdio: "ignore", detached: true });
     p.on("error", () => console.error(`Could not open a browser. Open ${url} yourself.`));
@@ -251,6 +312,10 @@ function openBrowser(url) {
 }
 /** Returns the exit code. */
 export async function run(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(RUN_USAGE);
+        return 0;
+    }
     let o;
     try {
         o = parseRunArgs(argv);
@@ -262,11 +327,14 @@ export async function run(argv) {
     if (o.native) {
         const { cmd, args } = nativeCommand(o.platform);
         console.error(`Running natively: ${cmd} ${args.join(" ")} (not the simulated device)`);
-        return spawnSync(cmd, args, { stdio: "inherit" }).status ?? 1;
+        const call = spawnBin(cmd, args);
+        return spawnSync(call.command, call.args, { stdio: "inherit", shell: call.shell }).status ?? 1;
     }
-    let name;
+    let name, appId;
     try {
-        name = loadConfig().name;
+        const c = loadConfig();
+        name = c.name;
+        appId = c.appId;
     }
     catch (e) {
         console.error(e.message);
@@ -277,6 +345,8 @@ export async function run(argv) {
         return 1;
     }
     const out = join(process.cwd(), "sim-dist");
+    if (isFirstBuild(process.cwd()))
+        console.error("First build, this can take a minute.");
     console.error(`Building ${name} for web with the simulated device…`);
     try {
         await buildWeb(process.cwd());
@@ -289,8 +359,22 @@ export async function run(argv) {
         ensureShipvoIgnored(process.cwd());
     }
     catch { /* read-only project: the session still works */ }
-    const s = await startRunServer({ dir: out, platform: o.platform, name, port: o.port, projectDir: process.cwd() });
-    const url = `http://127.0.0.1:${s.port}/`;
+    let lan;
+    if (o.lan) {
+        const host = lanAddress();
+        if (!host) {
+            console.error("--lan needs a network address and this computer has none. Connect to Wi-Fi and try again.");
+            return 1;
+        }
+        lan = { host };
+    }
+    const s = await startRunServer({ dir: out, platform: o.platform, name, appId, port: o.port, projectDir: process.cwd(), lan });
+    const url = `http://127.0.0.1:${s.port}/${s.lanToken ? `?t=${s.lanToken}` : ""}`;
+    if (lan && s.lanToken) {
+        const lanUrl = `http://${lan.host}:${s.port}/?t=${s.lanToken}`;
+        console.error(`\nOpen this on your phone (same Wi-Fi):\n${lanUrl}\n\n${qrToTerminal(qrMatrix(lanUrl))}\n`);
+        console.error("Warning: anyone on this network who has this address can open the page. The token in it is the only lock. Press Ctrl+C to stop sharing.");
+    }
     console.error(`Simulated ${FRAMES[o.platform].label} phone at ${url}  (Ctrl+C to stop)`);
     if (o.open)
         openBrowser(url);

package/dist/signing.js

@@ -5,6 +5,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "n
 import { join } from "node:path";
 import { b64, keyFromSeed } from "./index.js";
 import { args, loadConfig, seed } from "./config.js";
+import { rotate, RotateError } from "./rotation.js";
 const pub = (s) => b64(keyFromSeed(s).publicKey);
 const valid = (s) => { try {
     return /^[A-Za-z0-9+/=_-]{43,44}$/.test(s) && !!pub(s);
@@ -15,6 +16,18 @@ catch {
 export async function signingKey(argv) {
     const [sub, ...rest] = argv, a = args(rest);
     const cfg = loadConfig();
+    if (sub === "rotate") {
+        try {
+            await rotate(rest, cfg);
+        }
+        catch (e) {
+            if (!(e instanceof RotateError))
+                throw e;
+            console.error(e.message);
+            process.exit(1);
+        }
+        return;
+    }
     if (sub === "export") {
         const s = seed();
         if (pub(s) !== cfg.publicKey) {

package/dist/sim.js

@@ -1,5 +1,6 @@
 // `shipvo sim`: build the app's web bundle with the simulated device and serve it in the simulator.
 import { execSync, spawn } from "node:child_process";
+import { spawnBin } from "./spawn-bin.js";
 import { existsSync, mkdirSync, renameSync, rmSync, watch } from "node:fs";
 import { join } from "node:path";
 import { createRequire } from "node:module";
@@ -91,12 +92,15 @@ export function watchAndRebuild(opts) {
  */
 export function rebuildInto(opts = {}) {
     const root = opts.root ?? process.cwd();
-    const command = opts.command ?? "npx expo export --platform web --clear --output-dir";
     const next = join(root, ".shipvo", "sim-next"), live = join(root, "sim-dist"), prev = join(root, ".shipvo", "sim-prev");
     return new Promise((resolve, reject) => {
         mkdirSync(join(root, ".shipvo"), { recursive: true });
         rmSync(next, { recursive: true, force: true });
-        const p = spawn(`${command} "${next}"`, { cwd: root, shell: true, env: { ...process.env, PN_SIM: "1" }, stdio: ["ignore", "pipe", "pipe"] });
+        // A custom command is a shell string. The default goes through spawnBin so Windows runs npx.cmd.
+        const call = opts.command
+            ? { command: `${opts.command} "${next}"`, args: [], shell: true }
+            : spawnBin("npx", ["expo", "export", "--platform", "web", "--clear", "--output-dir", next]);
+        const p = spawn(call.command, call.args, { cwd: root, shell: call.shell, env: { ...process.env, PN_SIM: "1" }, stdio: ["ignore", "pipe", "pipe"] });
         let tail = "";
         // Metro and Expo print resolve errors to either stream, so keep both. `echo` also shows them.
         for (const [stream, out] of [[p.stdout, process.stdout], [p.stderr, process.stderr]]) {
@@ -143,7 +147,7 @@ export async function sim(argv) {
     }
     if (a["skip-build"] !== "true" || !existsSync("sim-dist/index.html")) {
         console.error(`Building ${cfg.name} for the simulator…`);
-        execSync("PN_SIM=1 npx expo export --platform web --output-dir sim-dist --clear", { stdio: "inherit", env: { ...process.env, PN_SIM: "1" } });
+        execSync("npx expo export --platform web --output-dir sim-dist --clear", { stdio: "inherit", env: { ...process.env, PN_SIM: "1" } });
     }
     try {
         ensurePlaywright({ cwd: process.cwd() });