@stim-cli/server 1.18.0 → 1.20.0

package/README.md

@@ -37,7 +37,8 @@ runs (see [Tailscale](#tailscale)). Stim Desktop starts its own server with the
 unless it serves phones.
 
 `--env KEY=VALUE` and `--path-prepend <dir>` (each repeatable) apply to the
-serving command: see [Run as a service](#run-as-a-service).
+serving command: see [Run as a service](#run-as-a-service). When serving, a bare
+`--env KEY` takes the value from the server's own environment.
 
 `pair --json` prints `{ "qr": <payload>, "expiresAt": "<ISO time>" }`, and
 `devices --json` prints `{ "devices": [...] }` with each device's `id`, `name`,
@@ -280,6 +281,10 @@ loopback port: a forwarder that omits that header, such as `tailscale serve
 
 A connection must send `hello` within 5 seconds. Five failed attempts from the
 same peer within a minute block new connections from it for up to a minute.
+The server answers 403 to a WebSocket upgrade that carries `Sec-Fetch-Site`, or
+an `Origin` other than the requested host (`http:` on loopback, `https:`
+through the route), and counts no failed attempt, so a web page can neither
+connect nor block this Mac's clients.
 
 Paired devices live in `$STIM_HOME/server/devices.json`. Revoking a device
 closes its open connections. The server checks registrations on file changes
@@ -1048,9 +1053,15 @@ created a route to another `--port`, run `uninstall` first.
 the server. stim-server replaces its environment with the login shell's at
 start, so a `PATH` or `GEM_HOME` in the plist alone is lost and an entry in
 `~/.zshrc` changes the terminal too. These flags apply after that capture, to
-the server and to the builds it starts, and the plist stores them as
-`ProgramArguments`. `--path-prepend` puts directories in front of PATH in the
-order given; `--env` cannot set `STIM_HOME`. The values sit in plain text in the plist and in the process arguments, so do not pass secrets. For a private CocoaPods:
+the server and to the builds it starts. The plist stores each `--env` value in
+`EnvironmentVariables`, so it stays out of the server's process arguments, and
+passes only the name as `--env KEY`; the server reads that variable from the
+environment launchd gives it. The values sit in plain text in the plist. A
+plist written by an earlier release keeps `--env KEY=VALUE` in its
+`ProgramArguments` until the next `service install`. `--path-prepend` puts
+directories in front of PATH in the order given, as `ProgramArguments`; `--env`
+cannot set `STIM_HOME` or `SHELL`, which the job takes from the installing
+process. For a private CocoaPods:
 
 ```bash
 stim-server service install --serve \
@@ -1119,7 +1130,9 @@ methods need that approval, not `read`:
   it does not run as a `stim-server service` and so cannot update itself),
   `acceptsClientBuilds`, `running` (the update in progress, with its `state`,
   `missing` package bytes and the last lines of its `log`) and `last` (how the
-  label's last `service update` ended, whoever ran it).
+  label's last `service update` ended, whoever ran it, or how the update this
+  server started ended when that is newer, such as one the update lock refused,
+  with the last line of its log).
 - `server.update.start` takes `{ "release": "<version>" }`, an exact version
   that `stim-server service update --release` installs, or
   `{ "packages": [{ "name", "size", "sha256" }] }`, at most 8 `.tgz` packages
@@ -1189,7 +1202,11 @@ closes its connections and cancels its builds.
   while the worker root's volume has less than 10 GiB free, while `builds`
   reaches a non-zero `maxBuilds`, or while `loadPerCore` is at or above
   `maxLoadPerCore`. The toolchain is read at most once a minute per Ruby context; capacity on
-  every offer.
+  every offer. With the `native-xcode-toolchain` feature, an offer can set
+  `native: "xcode"` to collect only Stim, CPU, Xcode, iPhoneSimulator SDK and
+  simulator-runtime facts. Unused report fields are null. This report has its own
+  cache, ignores Ruby selection, and is reused for native Xcode build admission.
+  Clients use the complete report on older native-build-capable hosts.
 - `build.sync` takes `repo`, `files` and `done`. `files` is one page of the
   manifest, each `{ "path", "kind": "file"|"exec"|"link", "size", "sha256" }`,
   a link's blob being its target. Pages accumulate until `done`; the next
@@ -1329,7 +1346,7 @@ Events are `{ "event", "subscription", ... }`.
   (none without `control`), the paired device, and the new `deviceToken` when
   the hello paired. `server.home` is the home folder
   of the user the server runs as, so clients can show paths under it as
-  `~/...`.
+  `~/...`. A pending approval result omits it.
 - `status.subscribe` returns a subscription id. Each `status` event carries a
   full payload as `stim status --watch --json` prints it, including each
   environment's `physicalDevices`, the phones it leases, and its `agents`, the

package/dist/{protocol-qo5TTavl.mjs → protocol-CjUChTWJ.mjs}

@@ -120,7 +120,11 @@ function protocolJsonSchema() {
 					session: { type: "string" },
 					attempt: { type: "string" },
 					bundleId: { type: "string" },
-					mode: { enum: ["development", "release"] },
+					mode: { enum: [
+						"development",
+						"release",
+						"process"
+					] },
 					devClientScheme: {
 						type: "string",
 						pattern: "^[a-zA-Z][a-zA-Z0-9+.-]{0,127}$"
@@ -864,8 +868,7 @@ function protocolJsonSchema() {
 						required: [
 							"name",
 							"version",
-							"stim",
-							"home"
+							"stim"
 						],
 						additionalProperties: false,
 						properties: {
@@ -1706,7 +1709,11 @@ function protocolJsonSchema() {
 						pattern: "^[a-zA-Z0-9_-]{1,128}$"
 					},
 					bundleId: { type: "string" },
-					mode: { enum: ["development", "release"] },
+					mode: { enum: [
+						"development",
+						"release",
+						"process"
+					] },
 					devClientScheme: {
 						type: "string",
 						pattern: "^[a-zA-Z][a-zA-Z0-9+.-]{0,127}$"
@@ -2217,7 +2224,8 @@ function protocolJsonSchema() {
 						rubyVersion: {
 							type: "string",
 							pattern: BUILD_RUBY_VERSION_PATTERN
-						}
+						},
+						native: { enum: ["xcode", "gradle"] }
 					}
 				}),
 				request("build.sync", {
@@ -2249,7 +2257,8 @@ function protocolJsonSchema() {
 									kind: { enum: [
 										"file",
 										"exec",
-										"link"
+										"link",
+										"directory"
 									] },
 									size: {
 										type: "integer",
@@ -2264,6 +2273,18 @@ function protocolJsonSchema() {
 				}),
 				request("build.start", {
 					type: "object",
+					if: {
+						required: ["native"],
+						properties: { native: { properties: { provider: { const: "gradle" } } } }
+					},
+					then: { properties: {
+						platform: { const: "android" },
+						fingerprint: { type: "null" }
+					} },
+					else: { properties: { fingerprint: {
+						type: "string",
+						minLength: 1
+					} } },
 					required: [
 						"repo",
 						"project",
@@ -2307,9 +2328,75 @@ function protocolJsonSchema() {
 							minLength: 1
 						},
 						fingerprint: {
-							type: "string",
+							type: ["string", "null"],
 							minLength: 1
 						},
+						native: { oneOf: [{
+							type: "object",
+							required: [
+								"provider",
+								"sourceDigest",
+								"cacheKey",
+								"arch",
+								"parameters"
+							],
+							additionalProperties: false,
+							properties: {
+								provider: { const: "xcode" },
+								sourceDigest: sha256,
+								cacheKey: {
+									type: "string",
+									minLength: 1
+								},
+								arch: { enum: [
+									"arm64",
+									"x86_64",
+									null
+								] },
+								parameters: {
+									type: "object",
+									description: "The non-file parameters of the client artifact identity, to name what differs."
+								}
+							}
+						}, {
+							type: "object",
+							required: [
+								"provider",
+								"sourceDigest",
+								"inputs"
+							],
+							additionalProperties: false,
+							properties: {
+								provider: { const: "gradle" },
+								sourceDigest: sha256,
+								inputs: {
+									type: "object",
+									required: [
+										"complete",
+										"ignored",
+										"outputs"
+									],
+									additionalProperties: false,
+									properties: {
+										complete: { const: true },
+										ignored: {
+											type: "array",
+											items: {
+												type: "string",
+												minLength: 1
+											}
+										},
+										outputs: {
+											type: "array",
+											items: {
+												type: "string",
+												minLength: 1
+											}
+										}
+									}
+								}
+							}
+						}] },
 						packageName: { type: ["string", "null"] },
 						isExpo: { type: "boolean" },
 						optimizations: { type: ["object", "null"] },

package/dist/protocol.mjs

@@ -1,3 +1,3 @@
-import { t as protocolJsonSchema } from "./protocol-qo5TTavl.mjs";
+import { t as protocolJsonSchema } from "./protocol-CjUChTWJ.mjs";
 export * from "@stim-cli/core/protocol";
 export { protocolJsonSchema };

package/dist/protocol.schema.json

@@ -70,7 +70,8 @@
         "mode": {
           "enum": [
             "development",
-            "release"
+            "release",
+            "process"
           ]
         },
         "devClientScheme": {
@@ -1260,8 +1261,7 @@
           "required": [
             "name",
             "version",
-            "stim",
-            "home"
+            "stim"
           ],
           "additionalProperties": false,
           "properties": {
@@ -1312,7 +1312,12 @@
               "workspace-diff",
               "hosted-congestion",
               "hosted-ios-data",
+              "hosted-ios-process",
+              "native-xcode-build",
+              "native-xcode-toolchain",
+              "native-gradle-build",
               "hosted-android-data",
+              "hosted-android-process",
               "server-update"
             ]
           }
@@ -2778,7 +2783,8 @@
                 "mode": {
                   "enum": [
                     "development",
-                    "release"
+                    "release",
+                    "process"
                   ]
                 },
                 "devClientScheme": {
@@ -5224,6 +5230,12 @@
                 "rubyVersion": {
                   "type": "string",
                   "pattern": "^(?!\\.{1,2}$)[^/\\\\\\u0000\\r\\n]+$"
+                },
+                "native": {
+                  "enum": [
+                    "xcode",
+                    "gradle"
+                  ]
                 }
               }
             }
@@ -5280,7 +5292,8 @@
                         "enum": [
                           "file",
                           "exec",
-                          "link"
+                          "link",
+                          "directory"
                         ]
                       },
                       "size": {
@@ -5321,6 +5334,38 @@
             },
             "params": {
               "type": "object",
+              "if": {
+                "required": [
+                  "native"
+                ],
+                "properties": {
+                  "native": {
+                    "properties": {
+                      "provider": {
+                        "const": "gradle"
+                      }
+                    }
+                  }
+                }
+              },
+              "then": {
+                "properties": {
+                  "platform": {
+                    "const": "android"
+                  },
+                  "fingerprint": {
+                    "type": "null"
+                  }
+                }
+              },
+              "else": {
+                "properties": {
+                  "fingerprint": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                }
+              },
               "required": [
                 "repo",
                 "project",
@@ -5398,9 +5443,97 @@
                   "minLength": 1
                 },
                 "fingerprint": {
-                  "type": "string",
+                  "type": [
+                    "string",
+                    "null"
+                  ],
                   "minLength": 1
                 },
+                "native": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "required": [
+                        "provider",
+                        "sourceDigest",
+                        "cacheKey",
+                        "arch",
+                        "parameters"
+                      ],
+                      "additionalProperties": false,
+                      "properties": {
+                        "provider": {
+                          "const": "xcode"
+                        },
+                        "sourceDigest": {
+                          "type": "string",
+                          "pattern": "^[0-9a-f]{64}$"
+                        },
+                        "cacheKey": {
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "arch": {
+                          "enum": [
+                            "arm64",
+                            "x86_64",
+                            null
+                          ]
+                        },
+                        "parameters": {
+                          "type": "object",
+                          "description": "The non-file parameters of the client artifact identity, to name what differs."
+                        }
+                      }
+                    },
+                    {
+                      "type": "object",
+                      "required": [
+                        "provider",
+                        "sourceDigest",
+                        "inputs"
+                      ],
+                      "additionalProperties": false,
+                      "properties": {
+                        "provider": {
+                          "const": "gradle"
+                        },
+                        "sourceDigest": {
+                          "type": "string",
+                          "pattern": "^[0-9a-f]{64}$"
+                        },
+                        "inputs": {
+                          "type": "object",
+                          "required": [
+                            "complete",
+                            "ignored",
+                            "outputs"
+                          ],
+                          "additionalProperties": false,
+                          "properties": {
+                            "complete": {
+                              "const": true
+                            },
+                            "ignored": {
+                              "type": "array",
+                              "items": {
+                                "type": "string",
+                                "minLength": 1
+                              }
+                            },
+                            "outputs": {
+                              "type": "array",
+                              "items": {
+                                "type": "string",
+                                "minLength": 1
+                              }
+                            }
+                          }
+                        }
+                      }
+                    }
+                  ]
+                },
                 "packageName": {
                   "type": [
                     "string",

package/dist/stim-frames/EmulatorFrameArtwork.swift

@@ -66,6 +66,15 @@ private struct SkinNode {
 
 @MainActor
 enum EmulatorFrameArtwork {
+  private static var cache: [String: DeviceFrameArtwork] = [:]
+
+  static func cached(avdName: String) -> DeviceFrameArtwork? {
+    if let hit = cache[avdName] { return hit }
+    let artwork = load(avdName: avdName)
+    if let artwork { cache[avdName] = artwork }
+    return artwork
+  }
+
   static func load(avdName: String) -> DeviceFrameArtwork? {
     let environment = ProcessInfo.processInfo.environment
     let home = FileManager.default.homeDirectoryForCurrentUser

package/dist/stim-frames/SimulatorDisplay.swift

@@ -66,7 +66,10 @@ public enum CoreSimulator {
   }
 
   static func simulatorKitPath(_ developerDir: String) -> String {
-    "\(developerDir)/../SharedFrameworks/SimulatorKit.framework/SimulatorKit"
+    let shared = "\(developerDir)/../SharedFrameworks/SimulatorKit.framework/SimulatorKit"
+    let legacy = "\(developerDir)/Library/PrivateFrameworks/SimulatorKit.framework/SimulatorKit"
+    return FileManager.default.fileExists(atPath: shared) || !FileManager.default.fileExists(atPath: legacy)
+      ? shared : legacy
   }
 
   static let deviceSet: NSObject? = {

package/dist/stim-frames/SimulatorFrameArtwork.swift

@@ -7,6 +7,15 @@ import AppKit
 
 @MainActor
 enum SimulatorFrameArtwork {
+  private static var cache: [String: DeviceFrameArtwork] = [:]
+
+  static func cached(udid: String) -> DeviceFrameArtwork? {
+    if let hit = cache[udid] { return hit }
+    let artwork = load(udid: udid)
+    if let artwork { cache[udid] = artwork }
+    return artwork
+  }
+
   static func load(udid: String) -> DeviceFrameArtwork? {
     guard let resources = resources(udid: udid) else { return nil }
     let profile = plist(resources.appendingPathComponent("profile.plist"))

package/dist/{stim-server-BR9FPA63.mjs → stim-server-C5iKxjba.mjs}

@@ -1,4 +1,4 @@
-import { n as protocol_exports } from "./protocol-qo5TTavl.mjs";
+import { n as protocol_exports } from "./protocol-CjUChTWJ.mjs";
 import { createRequire } from "node:module";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -187,6 +187,13 @@ const MAX_CLIENT_NAME = 64;
 function validClientName(name) {
 	return name.length <= MAX_CLIENT_NAME && !/[\p{Cc}\p{Cf}]/u.test(name);
 }
+/**
+* A phone sends its OS device name, which the person cannot edit in the app, so pairing cleans it up instead of
+* refusing it. U+200D stays because emoji sequences join with it.
+*/
+function pairingName(name) {
+	return name.replace(/(?![\u200d\s])[\p{Cc}\p{Cf}]/gu, "").replace(/\s+/g, " ").trim().slice(0, MAX_CLIENT_NAME).replace(/[\ud800-\udbff]$/, "").trim() || "Phone";
+}
 function newDeviceId() {
 	const taken = new Set([
 		...readDevices(),
@@ -331,7 +338,7 @@ function spendPairingToken(token, name, identity, now = Date.now()) {
 		const at = new Date(now).toISOString();
 		const device = {
 			id: newDeviceId(),
-			name,
+			name: pairingName(name),
 			tokenHash: hashToken(deviceToken),
 			identity,
 			pairedAt: at,
@@ -659,6 +666,7 @@ const DEFAULT_PORT = 7787;
 const THROTTLE_SECONDS = 30;
 const LABEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 const ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const JOB_KEYS = ["STIM_HOME", "SHELL"];
 function validateLabel(label) {
 	return LABEL_PATTERN.test(label) ? null : `--label must be letters, digits, ".", "_" or "-", got "${label}".`;
 }
@@ -679,13 +687,17 @@ const illegal = (value) => [...value].some((char) => {
 	const code = char.codePointAt(0);
 	return code < 32 && code !== 9 && code !== 10 && code !== 13;
 });
-/** Returns the first problem in the `--env` and `--path-prepend` values, or null when both are usable. */
-function validateServeEnvironment(env, pathPrepend) {
+/**
+* Returns the first problem in the `--env` and `--path-prepend` values, or null when both are usable. `serving` also
+* accepts a bare `KEY`, which the serving command reads from its own environment, and tolerates `STIM_HOME` and
+* `SHELL`, which a plist written by an earlier release can carry and `applyServeEnvironment` ignores.
+*/
+function validateServeEnvironment(env, pathPrepend, serving = false) {
 	if ([...env, ...pathPrepend].some(illegal)) return "--env and --path-prepend values cannot contain control characters.";
 	for (const entry of env) {
-		const parsed = parseEnvAssignment(entry);
+		const parsed = serving && ENV_KEY_PATTERN.test(entry) ? { key: entry } : parseEnvAssignment(entry);
 		if (typeof parsed === "string") return parsed;
-		if (parsed.key === "STIM_HOME") return "--env cannot set STIM_HOME; start stim-server with STIM_HOME set instead.";
+		if (!serving && JOB_KEYS.includes(parsed.key)) return `--env cannot set ${parsed.key}; start stim-server with ${parsed.key} set instead.`;
 	}
 	for (const dir of pathPrepend) if (!isAbsolute(dir) || dir.includes(delimiter)) return `--path-prepend takes one absolute directory, got "${dir}".`;
 	return null;
@@ -693,22 +705,43 @@ function validateServeEnvironment(env, pathPrepend) {
 /**
 * The environment stim-server runs with: the login shell's, then each `--env` entry, then the `--path-prepend`
 * directories in front of `PATH`, first directory first. Both flags apply after the login shell's environment
-* replaces the process environment, so they survive it.
+* replaces the process environment, so they survive it. A bare `KEY` entry takes its value from `source`, the
+* environment launchd gave the process; one that `source` lacks is skipped with a line on stderr. `STIM_HOME` and
+* `SHELL` entries are skipped the same way: the job takes them from the installing process.
 */
-function applyServeEnvironment(base, env, pathPrepend) {
+function applyServeEnvironment(base, env, pathPrepend, source = process.env) {
 	const result = { ...base };
 	for (const entry of env) {
 		const parsed = parseEnvAssignment(entry);
-		if (typeof parsed !== "string") result[parsed.key] = parsed.value;
+		const name = typeof parsed === "string" ? entry : parsed.key;
+		if (JOB_KEYS.includes(name)) console.error(`stim-server: ignoring --env ${name}; the service takes it from the process that installed it.`);
+		else if (typeof parsed !== "string") result[name] = parsed.value;
+		else if (ENV_KEY_PATTERN.test(entry)) {
+			const value = source[entry];
+			if (value === void 0) console.error(`stim-server: --env ${entry} has no value in the service environment; skipping it.`);
+			else result[entry] = value;
+		}
 	}
 	if (pathPrepend.length) result.PATH = [...pathPrepend, ...result.PATH ? [result.PATH] : []].join(delimiter);
 	return result;
 }
+function environmentValues(env) {
+	const values = /* @__PURE__ */ new Map();
+	for (const entry of env) {
+		const parsed = parseEnvAssignment(entry);
+		if (typeof parsed !== "string" && !JOB_KEYS.includes(parsed.key)) values.set(parsed.key, parsed.value);
+	}
+	return values;
+}
+/** `env` as the plist stores it: one `KEY=VALUE` per key, the last value winning, without the keys the job supplies. */
+function normalizeEnv(env) {
+	return [...environmentValues(env)].map(([name, value]) => `${name}=${value}`);
+}
 function serverArguments(spec) {
 	return [
 		"--port",
 		String(spec.port),
-		...spec.env.flatMap((entry) => ["--env", entry]),
+		...[...environmentValues(spec.env).keys()].flatMap((name) => ["--env", name]),
 		...spec.pathPrepend.flatMap((dir) => ["--path-prepend", dir])
 	];
 }
@@ -736,8 +769,9 @@ function renderPlist(spec) {
 		].map((argument) => string(argument, "		")),
 		"	</array>"
 	];
-	const environment = Object.entries(spec.environment);
-	if (environment.length) {
+	const environment = new Map(Object.entries(spec.environment));
+	for (const [name, value] of environmentValues(spec.env)) environment.set(name, value);
+	if (environment.size) {
 		lines.push(key("EnvironmentVariables", "	"), "	<dict>");
 		for (const [name, value] of environment) lines.push(key(name, "		"), string(value, "		"));
 		lines.push("	</dict>");
@@ -758,6 +792,7 @@ function parseInstalledPlist(value) {
 	const programArguments = strings(value.ProgramArguments);
 	const host = programArguments[1] === "run" && programArguments[0]?.endsWith("/Contents/MacOS/stim-host") ? programArguments[0] : null;
 	const [node = null, script = null, ...args] = host ? programArguments.slice(2) : programArguments;
+	const environment = isJsonObject(value.EnvironmentVariables) ? value.EnvironmentVariables : {};
 	const env = [];
 	const pathPrepend = [];
 	let port = null;
@@ -766,10 +801,13 @@ function parseInstalledPlist(value) {
 		const next = args[index + 1];
 		if (next === void 0) break;
 		if (flag === "--port") port = Number(next);
-		if (flag === "--env") env.push(next);
+		if (flag === "--env") {
+			const stored = environment[next];
+			if (next.includes("=")) env.push(next);
+			else if (typeof stored === "string") env.push(`${next}=${stored}`);
+		}
 		if (flag === "--path-prepend") pathPrepend.push(next);
 	}
-	const environment = isJsonObject(value.EnvironmentVariables) ? value.EnvironmentVariables : {};
 	const meta = isJsonObject(value.StimService) ? value.StimService : {};
 	const servePort = meta.ServePort;
 	return {
@@ -1582,7 +1620,7 @@ async function installJob(options, setup) {
 	};
 	const path = plistPath(options.label);
 	const tailscale = findTailscale(process.env) ?? "tailscale";
-	if (setup && previous?.script === script && previous.port === options.port && previous.host === spec.host && JSON.stringify(previous.env) === JSON.stringify(spec.env) && JSON.stringify(previous.pathPrepend) === JSON.stringify(spec.pathPrepend)) {
+	if (setup && previous?.script === script && previous.port === options.port && previous.host === spec.host && JSON.stringify(normalizeEnv(previous.env)) === JSON.stringify(normalizeEnv(spec.env)) && JSON.stringify(previous.pathPrepend) === JSON.stringify(spec.pathPrepend)) {
 		const health = await fetchHealth(options.port);
 		if (health && health.startup?.state !== "pending" && health.startup?.state !== "degraded") return [`${options.label} already runs stim-server ${health.version}.`];
 	}
@@ -2521,7 +2559,8 @@ function validBuildPath(path) {
 }
 function validFile(file) {
 	if (!isJsonObject(file) || !validBuildPath(file.path)) return false;
-	if (file.kind !== "file" && file.kind !== "exec" && file.kind !== "link") return false;
+	if (file.kind !== "file" && file.kind !== "exec" && file.kind !== "link" && file.kind !== "directory") return false;
+	if (file.kind === "directory" && (file.size !== 0 || file.sha256 !== createHash("sha256").update("").digest("hex"))) return false;
 	const size = file.size;
 	if (typeof size !== "number" || !Number.isInteger(size) || size < 0 || size > MAX_FILE_BYTES) return false;
 	return typeof file.sha256 === "string" && /^[0-9a-f]{64}$/.test(file.sha256);
@@ -2530,21 +2569,27 @@ const validRepo = (repo) => typeof repo === "string" && new RegExp(protocol_expo
 const gb = (bytes) => (bytes / 1024 ** 3).toFixed(1);
 const optional = (value) => typeof value === "string" ? value : null;
 const GRADLE_NAME = /^[A-Za-z0-9_-]{1,100}$/;
+const GRADLE_ROOT = /^[A-Za-z0-9._/ -]{1,200}$/;
+const GRADLE_MODULE = /^(:(?!\.\.?(?::|$))[A-Za-z0-9._-]+){1,20}$/;
 /** The Gradle choices of an Android `build.start`, or null when they are malformed. */
 function androidOptions(value) {
 	if (!isJsonObject(value)) return null;
-	const { variant, abi, gradleBuildCache, pch, compilerCache } = value;
+	const { variant, abi, gradleBuildCache, pch, compilerCache, gradleRoot = null, module = null } = value;
 	if (variant !== null && !(typeof variant === "string" && GRADLE_NAME.test(variant))) return null;
 	if (abi !== null && !(typeof abi === "string" && GRADLE_NAME.test(abi))) return null;
 	if (typeof gradleBuildCache !== "boolean") return null;
 	if (pch !== "auto" && pch !== "on" && pch !== "off") return null;
 	if (compilerCache !== "ccache" && compilerCache !== "none") return null;
+	if (gradleRoot !== null && !(typeof gradleRoot === "string" && GRADLE_ROOT.test(gradleRoot))) return null;
+	if (module !== null && !(typeof module === "string" && GRADLE_MODULE.test(module))) return null;
 	return {
 		variant,
 		abi,
 		gradleBuildCache,
 		pch,
-		compilerCache
+		compilerCache,
+		gradleRoot,
+		module
 	};
 }
 function freeBytes(path) {
@@ -2649,17 +2694,15 @@ var BuildHost = class {
 	clientDir(client) {
 		return join(this.root(), client);
 	}
-	toolchain(rubyVersion = null) {
+	toolchain(rubyVersion = null, native) {
+		const key = JSON.stringify([native ?? null, native ? null : rubyVersion]);
 		const now = Date.now();
 		for (const [context, entry] of this.toolchains) if (now - entry.at >= this.limits.toolchainTtlMs) this.toolchains.delete(context);
-		const cached = this.toolchains.get(rubyVersion);
+		const cached = this.toolchains.get(key);
 		if (cached) return cached.value;
 		const value = new Promise((resolve) => {
-			const child = spawn(process.execPath, [
-				this.options.worker,
-				"offer",
-				...rubyVersion ? [rubyVersion] : []
-			], {
+			const args = native ? [`offer-native-${native}`] : ["offer", ...rubyVersion ? [rubyVersion] : []];
+			const child = spawn(process.execPath, [this.options.worker, ...args], {
 				env: this.options.env,
 				stdio: [
 					"ignore",
@@ -2682,19 +2725,20 @@ var BuildHost = class {
 				}
 			});
 		});
-		this.toolchains.set(rubyVersion, {
+		this.toolchains.set(key, {
 			at: now,
 			value
 		});
 		value.then((result) => {
-			if (!result && this.toolchains.get(rubyVersion)?.value === value) this.toolchains.delete(rubyVersion);
+			if (!result && this.toolchains.get(key)?.value === value) this.toolchains.delete(key);
 		});
 		return value;
 	}
 	async offer(client, params) {
 		if (!isJsonObject(params) || !validRepo(params.repo)) return refusal("bad-request", "build.offer needs params.repo.");
 		if (params.rubyVersion !== void 0 && (typeof params.rubyVersion !== "string" || !new RegExp(protocol_exports.BUILD_RUBY_VERSION_PATTERN).test(params.rubyVersion))) return refusal("bad-request", "build.offer needs a Ruby installation name without path separators.");
-		const toolchain = await this.toolchain(params.rubyVersion ?? null);
+		if (params.native !== void 0 && params.native !== "xcode" && params.native !== "gradle") return refusal("bad-request", "build.offer supports native Xcode or Gradle toolchains.");
+		const toolchain = await this.toolchain(params.rubyVersion ?? null, params.native);
 		if (!toolchain) return refusal("build-refused", "This Mac could not read its build toolchain.");
 		const root = this.root();
 		mkdirSync(root, {
@@ -2920,7 +2964,7 @@ var BuildHost = class {
 				job: id,
 				record: value.record
 			});
-			else if (value.type === "result") entry.outcome = workerOutcome(value);
+			else if (value.type === "result") entry.outcome = workerOutcome(value, isJsonObject(job.native) && job.native.provider === "gradle" ? "gradle" : void 0);
 		});
 		this.jobs.add(entry);
 		this.owned.set(id, entry);
@@ -3079,18 +3123,20 @@ var BuildHost = class {
 		await this.sweeping;
 	}
 };
-function workerOutcome(value) {
+function workerOutcome(value, native) {
 	const timings = isJsonObject(value.timings) ? value.timings : {};
 	if (value.ok === true && isJsonObject(value.artifact)) {
 		const { name, size, sha256 } = value.artifact;
-		if (typeof name === "string" && typeof size === "number" && typeof sha256 === "string") return {
+		if (typeof name === "string" && typeof size === "number" && typeof sha256 === "string" && (native !== "gradle" || value.fingerprint === null && typeof value.androidPackage === "string" && /^[A-Za-z_][\w]*(?:\.[A-Za-z_][\w]*)+$/.test(value.androidPackage))) return {
 			ok: true,
 			artifact: {
 				name,
 				size,
 				sha256
 			},
-			fingerprint: String(value.fingerprint),
+			fingerprint: native === "gradle" ? null : String(value.fingerprint),
+			...native === "gradle" ? { androidPackage: value.androidPackage } : {},
+			...typeof value.sourceDigest === "string" ? { sourceDigest: value.sourceDigest } : {},
 			compilationCache: isJsonObject(value.compilationCache) ? value.compilationCache : {},
 			timings
 		};
@@ -3191,11 +3237,34 @@ var BuildSession = class {
 	}
 	async start(params) {
 		if (!isJsonObject(params) || !validRepo(params.repo)) return refusal("bad-request", "build.start needs params.repo.");
-		const strings = ["fingerprint", "stimBuild"];
+		const strings = ["stimBuild"];
 		if (strings.some((key) => typeof params[key] !== "string" || !params[key])) return refusal("bad-request", `build.start needs params.${strings.join(", params.")}.`);
 		const platform = params.platform;
 		if (platform !== "ios" && platform !== "android" && platform !== "macos") return refusal("bad-request", "params.platform must be ios, android or macos.");
 		if (platform === "ios" && (typeof params.runtime !== "string" || !params.runtime)) return refusal("bad-request", "An ios build needs params.runtime.");
+		let native;
+		if (params.native !== void 0) {
+			const input = params.native;
+			if (!isJsonObject(input) || typeof input.sourceDigest !== "string" || !/^[0-9a-f]{64}$/.test(input.sourceDigest)) return refusal("bad-request", "A native build needs its source transfer digest.");
+			if (input.provider === "gradle") {
+				const inputs = input.inputs;
+				if (platform !== "android" || params.fingerprint !== null || !isJsonObject(inputs) || inputs.complete !== true || Object.keys(inputs).some((key) => ![
+					"complete",
+					"ignored",
+					"outputs"
+				].includes(key)) || !Array.isArray(inputs.ignored) || !inputs.ignored.every(validBuildPath) || !Array.isArray(inputs.outputs) || !inputs.outputs.every(validBuildPath)) return refusal("bad-request", "A native Gradle build needs declared complete inputs and a null artifact fingerprint.");
+			} else {
+				const optimizations = params.optimizations;
+				if (platform !== "ios" || input.provider !== "xcode" || typeof input.cacheKey !== "string" || !input.cacheKey || ![
+					null,
+					"arm64",
+					"x86_64"
+				].includes(input.arch) || !isJsonObject(input.parameters) || !isJsonObject(optimizations) || typeof optimizations.compilationCache !== "boolean" || typeof optimizations.prefixMapping !== "boolean" || optimizations.swiftCompilationCache !== null && typeof optimizations.swiftCompilationCache !== "boolean") return refusal("bad-request", "A native Xcode build needs its source digest, cache key, architecture and compiler options.");
+			}
+			native = input;
+		}
+		if (native?.provider !== "gradle" && (typeof params.fingerprint !== "string" || !params.fingerprint)) return refusal("bad-request", "build.start needs params.fingerprint.");
+		if (!native && [...this.files.values()].some((file) => file.kind === "directory")) return refusal("bad-request", "Directory entries require a native build request.");
 		const android = platform === "android" ? androidOptions(params.android) : null;
 		if (platform === "android" && !android) return refusal("bad-request", "An android build needs params.android: variant and abi (string or null), gradleBuildCache, pch and compilerCache.");
 		let macos = null;
@@ -3215,7 +3284,7 @@ var BuildSession = class {
 		if (!this.done || this.repo !== params.repo) return refusal("bad-request", "Send the whole manifest of this repo with build.sync first.");
 		if (this.incoming || [...this.files.values()].some((file) => this.expected.has(file.sha256))) return refusal("bad-request", "Some files of the manifest were not uploaded.");
 		for (const file of this.files.values()) if (!existsSync(this.blobPath(file.sha256))) return refusal("bad-request", `The blob of ${file.path} is missing; sync again.`);
-		const toolchain = await this.host.toolchain();
+		const toolchain = await this.host.toolchain(null, native?.provider);
 		if (this.closed) return refusal("build-refused", "The connection closed.");
 		if (!toolchain || toolchain.stimBuild !== params.stimBuild) return refusal("build-refused", `This Mac runs Stim build ${toolchain?.stimBuild ?? "unknown"}.`);
 		const launched = this.host.launch({
@@ -3226,6 +3295,7 @@ var BuildSession = class {
 			job: {
 				manifest: [...this.files.values()],
 				platform,
+				...native ? { native } : {},
 				android,
 				macos,
 				project: params.project,
@@ -3233,6 +3303,7 @@ var BuildSession = class {
 				isExpo: params.isExpo === true,
 				configuration: optional(params.configuration),
 				scheme: optional(params.scheme),
+				iosProjectPath: optional(params.iosProjectPath),
 				runtime: optional(params.runtime),
 				expectedFingerprint: params.fingerprint,
 				optimizations: isJsonObject(params.optimizations) ? params.optimizations : null
@@ -6535,9 +6606,11 @@ var DeviceHost = class {
 	reconciling;
 	draining = null;
 	limits;
+	debug;
 	options;
 	constructor(options) {
 		this.options = options;
+		this.debug = createDebugLog("server", { env: options.env });
 		this.limits = {
 			prepareMs: 3e5,
 			offerMs: 3e4,
@@ -7098,12 +7171,13 @@ var DeviceHost = class {
 	appOffer(client, params) {
 		if (!this.options.allowed(client)) return refused$1("forbidden", "Current device-host approval is required.");
 		const offer = parseHostedAppOffer(params);
-		if (!offer) return refused$1("bad-request", "App offers need a bounded normalized bundle manifest, bundleId, development or release mode and, optionally, at most 32 arguments of 1024 characters (8192 in total) without NUL or line breaks.");
+		if (!offer) return refused$1("bad-request", "App offers need a bounded normalized bundle manifest, bundleId, development, release or process mode and, optionally, at most 32 arguments of 1024 characters (8192 in total) without NUL or line breaks.");
 		try {
 			const record = this.appSession(client, offer);
+			if (offer.mode === "process" && record.platform === "macos") throw new Error("Process-mode app offers require a hosted iOS or Android session.");
 			if (record.platform !== "macos" && offer.arguments !== void 0) throw new Error("App arguments are supported only for hosted macOS sessions.");
 			if (record.platform === "macos") {
-				if (offer.mode === "development" || offer.devClientScheme !== void 0) throw new Error("Hosted macOS apps require release mode without a development client scheme.");
+				if (offer.mode !== "release" || offer.devClientScheme !== void 0) throw new Error("Hosted macOS apps require release mode without a development client scheme.");
 				if (offer.bundleId.startsWith("com.apple.")) throw new Error("Hosted macOS apps cannot use a com.apple. bundle identity.");
 				if (hostedMacosBundleId(offer.bundleId, record.appSlot).length + 6 > 255) throw new Error("The hosted macOS bundle identity exceeds 249 characters for its preferences plist.");
 			}
@@ -7687,6 +7761,15 @@ var DeviceHost = class {
 			if (options.claim) clearClaimChild(options.claim);
 			throw error;
 		}
+		const started = performance.now();
+		const mode = "mode" in options.input && typeof options.input.mode === "string" ? options.input.mode : void 0;
+		const diagnostic = (event, fields = {}) => this.debug.log(`device-host.worker.${event}`, {
+			mode,
+			workerPid: child.pid,
+			ms: Math.round(performance.now() - started),
+			...fields
+		});
+		diagnostic("start", { timeoutMs: options.timeoutMs });
 		let identity = null;
 		const output = [];
 		let outputBytes = 0;
@@ -7709,7 +7792,14 @@ var DeviceHost = class {
 			clearTimeout(killTimer);
 			clearTimeout(finishTimer);
 			clearTimeout(groupTimer);
-			const settled = closed && (!child.pid || !processGroupAlive(child.pid));
+			const groupAlive = closed && child.pid ? processGroupAlive(child.pid) : null;
+			const settled = closed && groupAlive !== true;
+			diagnostic("settled", {
+				closed,
+				groupAlive,
+				settled,
+				cancelling
+			});
 			if (settled && options.claim) clearClaimChild(options.claim);
 			let value = null;
 			try {
@@ -7737,9 +7827,10 @@ var DeviceHost = class {
 				process.kill(-child.pid, name);
 			} catch {}
 		};
-		const cancel = () => {
+		const cancel = (reason = "requested") => {
 			if (finished || cancelling) return;
 			cancelling = true;
+			diagnostic("cancel", { reason });
 			notice ??= "Hosted worker was cancelled or exceeded its deadline.";
 			signal("SIGTERM");
 			killTimer = setTimeout(() => signal("SIGKILL"), this.limits.killGraceMs);
@@ -7749,15 +7840,15 @@ var DeviceHost = class {
 			if (finished) return;
 			if (!child.pid || !processGroupAlive(child.pid)) finish();
 			else {
-				cancel();
+				cancel("group-after-close");
 				groupTimer = setTimeout(finishGroup, 25);
 			}
 		};
-		const timer = setTimeout(cancel, options.timeoutMs);
+		const timer = setTimeout(() => cancel("deadline"), options.timeoutMs);
 		child.stdout?.on("data", (chunk) => {
 			if (outputBytes + chunk.length > options.maxOutputBytes) {
 				notice = "Hosted worker output exceeded its bound.";
-				cancel();
+				cancel("output-bound");
 			} else {
 				output.push(chunk);
 				outputBytes += chunk.length;
@@ -7766,13 +7857,18 @@ var DeviceHost = class {
 		child.stderr?.on("data", (chunk) => {
 			stderr = (stderr + chunk.toString()).slice(-8192);
 		});
-		child.stdin?.on("error", () => cancel());
+		child.stdin?.on("error", () => cancel("stdin-error"));
 		child.once("error", (error) => {
+			diagnostic("error", { code: error.code });
 			notice = error.message;
 			closed = true;
 			finishGroup();
 		});
-		child.once("close", (code) => {
+		child.once("close", (code, closeSignal) => {
+			diagnostic("close", {
+				code,
+				signal: closeSignal
+			});
 			if (code !== 0) notice ??= stderr.trim() || `Hosted worker exited ${code}.`;
 			closed = true;
 			finishGroup();
@@ -7781,7 +7877,7 @@ var DeviceHost = class {
 		if (!captured?.ok || child.pid === void 0) {
 			notice = "The worker process identity could not be captured; no native request was sent.";
 			child.kill("SIGKILL");
-			cancel();
+			cancel("identity-unavailable");
 		} else {
 			identity = {
 				pid: child.pid,
@@ -7792,7 +7888,7 @@ var DeviceHost = class {
 				child.stdin?.end(JSON.stringify(options.input));
 			} catch (error) {
 				notice = error.message;
-				cancel();
+				cancel("request-write");
 			}
 		}
 		return {
@@ -11515,16 +11611,28 @@ const INTERVAL_MS = 15e3;
 const POINTS = 40;
 /**
 * Per-environment and per-device CPU and memory from the status payloads stim-server receives, in 15-second slots, the cadence at which `status --watch` rereads machine usage,
-* over the last 10 minutes. A later payload in the same slot replaces the earlier one. An environment sums every
+* over the last 10 minutes. A later payload in the same slot replaces the earlier one. `status --watch` prints no line
+* while usage stays within a step, so the slots between two payloads repeat the readings of the series the earlier
+* payload held, and those series continue to now until a payload drops them. An environment sums every
 * machine owner of its workspace; a device is a simulator or emulator owner, keyed by its UDID or AVD name.
 */
 var UsageRecorder = class {
 	environments = /* @__PURE__ */ new Map();
 	devices = /* @__PURE__ */ new Map();
+	lastSlot = 0;
+	liveEnvironments = /* @__PURE__ */ new Set();
+	liveDevices = /* @__PURE__ */ new Set();
 	record(payload, at = Date.now()) {
-		const owners = payload?.machine?.owners;
-		if (!Array.isArray(owners)) return;
 		const slot = Math.floor(at / INTERVAL_MS);
+		const owners = payload?.machine?.owners;
+		this.holdThrough(slot - 1);
+		this.lastSlot = Math.max(this.lastSlot, slot);
+		this.liveEnvironments = /* @__PURE__ */ new Set();
+		this.liveDevices = /* @__PURE__ */ new Set();
+		if (!Array.isArray(owners)) {
+			this.prune(slot);
+			return;
+		}
 		const sums = /* @__PURE__ */ new Map();
 		for (const owner of owners) {
 			const reading = {
@@ -11554,20 +11662,24 @@ var UsageRecorder = class {
 					meta,
 					slots: slots.set(slot, reading)
 				});
+				this.liveDevices.add(key);
 			}
 		}
-		for (const [workspace, reading] of sums) this.environments.set(workspace, (this.environments.get(workspace) ?? /* @__PURE__ */ new Map()).set(slot, reading));
+		for (const [workspace, reading] of sums) {
+			this.environments.set(workspace, (this.environments.get(workspace) ?? /* @__PURE__ */ new Map()).set(slot, reading));
+			this.liveEnvironments.add(workspace);
+		}
 		this.prune(slot);
 	}
 	/** The last 10 minutes ending at `now`'s slot, or null when no series has a reading in them. */
 	history(now = Date.now()) {
 		const end = Math.floor(now / INTERVAL_MS);
 		this.prune(end);
-		const series = (slots) => {
+		const series = (slots, live) => {
 			const cpuPercent = [];
 			const memoryMb = [];
 			for (let slot = end - POINTS + 1; slot <= end; slot++) {
-				const reading = slots.get(slot);
+				const reading = slots.get(slot) ?? (live && slot > this.lastSlot ? slots.get(this.lastSlot) : void 0);
 				cpuPercent.push(reading ? Math.round(reading.cpuPercent * 10) / 10 : null);
 				memoryMb.push(reading ? Math.round(reading.memoryMb) : null);
 			}
@@ -11576,8 +11688,8 @@ var UsageRecorder = class {
 				memoryMb
 			};
 		};
-		const environments = [...this.environments].map(([workspace, slots]) => Object.assign({ workspace }, series(slots)));
-		const devices = [...this.devices.values()].map(({ meta, slots }) => Object.assign({}, meta, series(slots)));
+		const environments = [...this.environments].map(([workspace, slots]) => Object.assign({ workspace }, series(slots, this.liveEnvironments.has(workspace))));
+		const devices = [...this.devices].map(([key, { meta, slots }]) => Object.assign({}, meta, series(slots, this.liveDevices.has(key))));
 		if (!environments.length && !devices.length) return null;
 		return {
 			intervalMs: INTERVAL_MS,
@@ -11586,13 +11698,27 @@ var UsageRecorder = class {
 			devices
 		};
 	}
+	/** Ends the live series where the last payload left them: nothing is recorded, or held, while nobody listens. */
+	pause() {
+		this.liveEnvironments = /* @__PURE__ */ new Set();
+		this.liveDevices = /* @__PURE__ */ new Set();
+	}
+	holdThrough(slot) {
+		const hold = (slots) => {
+			const reading = slots?.get(this.lastSlot);
+			if (!slots || !reading) return;
+			for (let at = Math.max(this.lastSlot + 1, slot - POINTS + 1); at <= slot; at++) slots.set(at, reading);
+		};
+		for (const key of this.liveEnvironments) hold(this.environments.get(key));
+		for (const key of this.liveDevices) hold(this.devices.get(key)?.slots);
+	}
 	prune(slot) {
-		const trim = (slots) => {
-			for (const at of slots.keys()) if (at <= slot - POINTS) slots.delete(at);
+		const trim = (slots, live) => {
+			for (const at of slots.keys()) if (at <= slot - POINTS && !(live && at === this.lastSlot)) slots.delete(at);
 			return slots.size > 0;
 		};
-		for (const [key, slots] of this.environments) if (!trim(slots)) this.environments.delete(key);
-		for (const [key, { slots }] of this.devices) if (!trim(slots)) this.devices.delete(key);
+		for (const [key, slots] of this.environments) if (!trim(slots, this.liveEnvironments.has(key))) this.environments.delete(key);
+		for (const [key, { slots }] of this.devices) if (!trim(slots, this.liveDevices.has(key))) this.devices.delete(key);
 	}
 };
 //#endregion
@@ -12427,6 +12553,7 @@ var ServerUpdates = class {
 	running = null;
 	upload = null;
 	idle = null;
+	ended = null;
 	constructor(options) {
 		this.options = options;
 		this.sweepIncoming();
@@ -12480,9 +12607,14 @@ var ServerUpdates = class {
 			service: service ? label : null,
 			acceptsClientBuilds: this.options.acceptsClientBuilds(),
 			running: this.progress(),
-			last: service && label ? readLastUpdate(label) : null
+			last: service && label ? this.latest(readLastUpdate(label)) : null
 		};
 	}
+	latest(recorded) {
+		if (!this.ended) return recorded;
+		if (!recorded) return this.ended;
+		return Date.parse(recorded.at) >= Date.parse(this.ended.at) ? recorded : this.ended;
+	}
 	async start(by, params) {
 		const parsed = parseUpdateStart(params);
 		if (typeof parsed === "string") return refused("bad-request", parsed);
@@ -12641,6 +12773,12 @@ var ServerUpdates = class {
 		const settle = (ok, message) => {
 			this.options.drain(null);
 			this.clear();
+			this.ended = {
+				at: (/* @__PURE__ */ new Date()).toISOString(),
+				target,
+				ok,
+				message
+			};
 			this.options.audit({
 				by: running.by,
 				target,
@@ -12653,7 +12791,11 @@ var ServerUpdates = class {
 		child.once("exit", (code) => {
 			const last = readLastUpdate(this.options.label);
 			const fresh = last && Date.parse(last.at) >= Date.parse(running.startedAt);
-			settle(code === 0, fresh ? last.message : `The update exited with code ${String(code)}; see ${log}.`);
+			let reason = "";
+			try {
+				reason = readFileSync(log, "utf8").split("\n").findLast((line) => line.trim() !== "") ?? "";
+			} catch {}
+			settle(code === 0, fresh ? last.message : `The update exited with code ${String(code)}${reason ? `: ${reason}` : ""}; see ${log}.`);
 		});
 		return null;
 	}
@@ -13144,6 +13286,28 @@ function peerAddress(request) {
 	const forwarded = request.headers["x-forwarded-for"];
 	return (Array.isArray(forwarded) ? forwarded[0] : forwarded)?.split(",")[0]?.trim() || null;
 }
+const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+	"127.0.0.1",
+	"localhost",
+	"[::1]"
+]);
+/**
+* Whether a WebSocket upgrade comes from a web page. Browsers send `Sec-Fetch-Site` and the page's own `Origin`.
+* React Native derives `Origin` from the ws URL, so an app's `Origin` names the requested host: over `http:` on loopback,
+* and `https:` through `tailscale serve`. SocketRocket omits the brackets of an IPv6 origin, so an iOS app on
+* `ws://[::1]` is refused.
+*/
+function upgradeFromWebPage(headers, local) {
+	if (headers["sec-fetch-site"] !== void 0) return true;
+	if (headers.origin === void 0) return false;
+	const scheme = local ? "http:" : "https:";
+	try {
+		const own = new URL(`${scheme}//${headers.host ?? ""}`);
+		return new URL(headers.origin).origin !== own.origin || local && !LOOPBACK_HOSTS.has(own.hostname);
+	} catch {
+		return true;
+	}
+}
 var FailureLimiter = class {
 	failures = /* @__PURE__ */ new Map();
 	max;
@@ -13391,6 +13555,7 @@ async function startServer(options) {
 			if (recorders > 0) return;
 			stopRecording?.();
 			stopRecording = null;
+			usage.pause();
 		};
 	};
 	const controllers = /* @__PURE__ */ new Map();
@@ -13750,8 +13915,7 @@ async function startServer(options) {
 						server: {
 							name: options.name,
 							version: options.serverVersion,
-							stim: options.stimVersion,
-							home: homedir()
+							stim: options.stimVersion
 						},
 						capabilities: [],
 						features: [...protocol_exports.FEATURES],
@@ -15139,6 +15303,10 @@ async function startServer(options) {
 			socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
 			return;
 		}
+		if (upgradeFromWebPage(request.headers, peer === null)) {
+			socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
+			return;
+		}
 		if (limiter.blocked(peer ?? "local")) {
 			socket.end("HTTP/1.1 429 Too Many Requests\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
 			return;
@@ -15736,7 +15904,7 @@ async function main() {
 	const service = command === "service";
 	if ((values.env || values["path-prepend"]) && command !== void 0 && !service) fail(`--env and --path-prepend apply only to serving and \`service install\`.\n${USAGE}`);
 	if (values.env || values["path-prepend"]) {
-		const problem = validateServeEnvironment(extraEnv, pathPrepend);
+		const problem = validateServeEnvironment(extraEnv, pathPrepend, command === void 0);
 		if (problem) fail(problem);
 	}
 	if ((values.label !== void 0 || values.serve) && !service) fail(`--label and --serve apply only to \`service\`.\n${USAGE}`);

package/dist/stim-server.mjs

@@ -4,6 +4,6 @@ const encode = (version) => version.split(".", 3).reduce((sum, part) => sum * 1e
 if (encode(process.versions.node) < encode("22.12.0")) {
 	process.stderr.write(`STIM_NODE_UNSUPPORTED: stim-server needs Node 22.12.0 or later; this is Node ${process.versions.node} at ${process.execPath}. To run stim-server where a project pins an older Node, see https://stim.appandflow.com/docs/requirements#older-node-pins\n`);
 	process.exitCode = 1;
-} else import("./stim-server-BR9FPA63.mjs");
+} else import("./stim-server-C5iKxjba.mjs");
 //#endregion
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stim-cli/server",
-  "version": "1.18.0",
+  "version": "1.20.0",
   "description": "Serves Stim status to paired clients over Tailscale, and runs reload and stop for clients granted control.",
   "license": "MIT",
   "repository": {
@@ -28,8 +28,8 @@
     "./protocol.schema.json": "./dist/protocol.schema.json"
   },
   "dependencies": {
-    "@stim-cli/core": "^1.18.0",
-    "stim": "1.18.0",
+    "@stim-cli/core": "^1.20.0",
+    "stim": "1.20.0",
     "ws": "^8.21.3"
   },
   "devDependencies": {