gloomberb 0.19.1 → 0.19.3

package/src/plugins/peer-imports.ts

@@ -0,0 +1,201 @@
+import { readFileSync, realpathSync } from "fs";
+import { dirname, extname, isAbsolute, join, relative } from "path";
+import type { BunPlugin } from "bun";
+
+import { installedPeerPlugins } from "./host-link";
+
+/**
+ * A plugin's imports of a sibling plugin it declares as a peer (IBKR Gateway
+ * imports `gloom-ibkr/gateway-bridge`), read from the sibling's own folder
+ * instead of through the link in the plugin's `node_modules`.
+ *
+ * That link is a junction on Windows, and a process can be unable to follow
+ * a junction at all. On the first launch after an update the gateway failed
+ * with its link in place and pointing at Interactive Brokers: the loader wrote
+ * it again four times, never saw it resolve, and an import that looked again
+ * failed the same way, while Interactive Brokers itself loaded from its folder
+ * in the same process. The next launch worked.
+ *
+ * So the host resolves those imports itself and hands Bun the sibling's file
+ * by its absolute path: the file the link leads to, under the module key the
+ * sibling's own imports give it, so the plugin still shares the sibling's
+ * modules. The terminal and the desktop's Bun process rewrite the plugin's
+ * source as Bun loads it; the desktop's compile for the view resolves them in
+ * the bundler. The link stays, for editors, `tsc`, and older Gloom versions.
+ */
+
+type SourceLoader = "ts" | "tsx" | "js" | "jsx";
+
+/** What Bun loads a plugin's own source files with, by extension. */
+export const SOURCE_LOADERS: Readonly<Record<string, SourceLoader>> = {
+  ".ts": "ts",
+  ".mts": "ts",
+  ".tsx": "tsx",
+  ".js": "js",
+  ".mjs": "js",
+  ".jsx": "jsx",
+};
+
+export function sourceLoader(file: string): SourceLoader {
+  return SOURCE_LOADERS[extname(file).toLowerCase()] ?? "js";
+}
+
+export function isInside(root: string, path: string): boolean {
+  const inside = relative(root, path);
+  return !!inside && !inside.startsWith("..") && !isAbsolute(inside);
+}
+
+function escapeRegExp(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/** Where a module is named: after `from`, `import` or `import(`, and in `require(`. */
+const IMPORTED_AT = String.raw`(\bfrom\s*|\bimport\s*(?:\(\s*)?|\brequire\s*\(\s*)`;
+
+/**
+ * `contents` with `specifier` replaced by `replacement` where it is imported.
+ * The same text in a string anywhere else stays.
+ */
+export function replaceSpecifier(contents: string, specifier: string, replacement: string): string {
+  const imported = new RegExp(`${IMPORTED_AT}(["'\`])${escapeRegExp(specifier)}\\2`, "g");
+  return contents.replace(imported, (_match, at: string) => `${at}${JSON.stringify(replacement)}`);
+}
+
+function realFolder(path: string): string {
+  try {
+    return realpathSync(path);
+  } catch {
+    // Intentional ignore: a folder that cannot be resolved is matched as spelled.
+    return path;
+  }
+}
+
+/** Each registered plugin's real folder, with its siblings' folders by package name. */
+const siblingsByPlugin = new Map<string, ReadonlyMap<string, string>>();
+/** Real plugin folders whose source Bun loads through the hook below. */
+const hookedFolders = new Set<string>();
+
+/**
+ * The installed siblings `pluginDir` declares, by package name, each with its
+ * real folder. A sibling that maps its paths with `exports` is left out: only
+ * a lookup through `node_modules` reads that map.
+ */
+function siblingFolders(pluginDir: string, pluginsDir: string = dirname(pluginDir)): Map<string, string> {
+  const folders = new Map<string, string>();
+  for (const { peer, directory } of installedPeerPlugins(pluginDir, pluginsDir)) {
+    const folder = join(pluginsDir, directory);
+    try {
+      const pkg = JSON.parse(readFileSync(join(folder, "package.json"), "utf8")) as { exports?: unknown };
+      if (pkg.exports !== undefined) continue;
+    } catch {
+      // Intentional ignore: a sibling without a readable package.json has no export map.
+    }
+    folders.set(peer, realFolder(folder));
+  }
+  return folders;
+}
+
+/** The file `specifier` names in the sibling `peer`, as Bun resolves it from inside its folder; null when there is none. */
+function siblingModule(peer: string, peerDir: string, specifier: string): string | null {
+  const subpath = specifier.slice(peer.length + 1);
+  try {
+    return Bun.resolveSync(subpath ? `./${subpath}` : ".", peerDir);
+  } catch {
+    // Intentional ignore: left as written, the import fails the way it always did.
+    return null;
+  }
+}
+
+/**
+ * `contents` of `file` with its imports of the siblings its plugin declares
+ * naming the siblings' files by absolute path. Anything else is left as
+ * written: a file outside a registered plugin, and an import the sibling
+ * cannot satisfy, which then fails the way it always did.
+ */
+export function withSiblingImports(file: string, contents: string): string {
+  let siblings: ReadonlyMap<string, string> | undefined;
+  for (const [root, folders] of siblingsByPlugin) {
+    if (isInside(root, file)) siblings = folders;
+  }
+  if (!siblings) return contents;
+  let next = contents;
+  for (const [peer, peerDir] of siblings) {
+    if (!next.includes(peer)) continue;
+    const imported = new RegExp(`${IMPORTED_AT}(["'\`])(${escapeRegExp(peer)}(?:/[^"'\`\\s]*)?)\\2`, "g");
+    next = next.replace(imported, (match, at: string, _quote: string, specifier: string) => {
+      const target = siblingModule(peer, peerDir, specifier);
+      return target ? `${at}${JSON.stringify(target)}` : match;
+    });
+  }
+  return next;
+}
+
+function pathPattern(path: string): string {
+  return path.split(/[\\/]+/).map(escapeRegExp).join("[\\\\/]+");
+}
+
+/**
+ * The plugin's own source files, with an entry imported fresh (`?reload=`,
+ * or the installer's `?validate=`); not its dependencies, and not a retried
+ * import's files, which the retry's own hook loads the same way
+ * (peer-retry.ts).
+ */
+function pluginSourceFilter(root: string): RegExp {
+  return new RegExp(
+    `^${pathPattern(root)}[\\\\/](?!(?:[^?]*[\\\\/])?node_modules[\\\\/])[^?]*\\.(?:tsx?|mts|jsx?|mjs)(?:\\?(?:reload|validate)=\\d+)?$`,
+    process.platform === "win32" ? "i" : "",
+  );
+}
+
+function hookPluginSource(root: string): boolean {
+  if (hookedFolders.has(root)) return true;
+  if (typeof Bun === "undefined" || typeof Bun.plugin !== "function") return false;
+  Bun.plugin({
+    name: "gloomberb-sibling-imports",
+    setup(build) {
+      build.onLoad({ filter: pluginSourceFilter(root) }, (args) => {
+        const file = args.path.replace(/\?.*$/, "");
+        return { contents: withSiblingImports(file, readFileSync(file, "utf8")), loader: sourceLoader(file) };
+      });
+    },
+  });
+  hookedFolders.add(root);
+  return true;
+}
+
+/**
+ * Makes this process import the siblings `pluginDir` declares from their own
+ * folders, from the next import of the plugin on. Returns whether it does: a
+ * plugin with no installed sibling, and a process without Bun's runtime
+ * plugins, go through the links as before.
+ */
+export function importSiblingsFromTheirFolders(pluginDir: string, pluginsDir?: string): boolean {
+  const siblings = siblingFolders(pluginDir, pluginsDir);
+  const root = realFolder(pluginDir);
+  if (siblings.size === 0) {
+    siblingsByPlugin.delete(root);
+    return false;
+  }
+  siblingsByPlugin.set(root, siblings);
+  return hookPluginSource(root);
+}
+
+/**
+ * The same for a bundle of `pluginDir`: a bundler plugin that resolves the
+ * siblings it declares in their folders, or null when none is installed.
+ */
+export function siblingImportsBundlerPlugin(pluginDir: string, pluginsDir?: string): BunPlugin | null {
+  const siblings = siblingFolders(pluginDir, pluginsDir);
+  if (siblings.size === 0) return null;
+  const filter = new RegExp(`^(?:${[...siblings.keys()].map(escapeRegExp).join("|")})(?:/.*)?$`);
+  return {
+    name: "gloomberb-sibling-imports",
+    setup(build) {
+      build.onResolve({ filter }, (args) => {
+        const peer = [...siblings.keys()].find((name) => args.path === name || args.path.startsWith(`${name}/`));
+        const path = peer ? siblingModule(peer, siblings.get(peer)!, args.path) : null;
+        return path ? { path } : undefined;
+      });
+    },
+  };
+}

package/src/plugins/peer-retry.ts

@@ -1,5 +1,8 @@
-import { readdirSync, readFileSync, type Dirent } from "fs";
-import { dirname, extname, isAbsolute, join, relative } from "path";
+import { existsSync, readdirSync, readFileSync, type Dirent } from "fs";
+import { dirname, extname, join } from "path";
+
+import { isInside, replaceSpecifier, SOURCE_LOADERS, sourceLoader, withSiblingImports } from "./peer-imports";
+import { pluginDirectoryNames } from "./plugin-names";
 
 /**
  * A second import of a plugin whose first one failed on a sibling plugin it
@@ -19,19 +22,15 @@ import { dirname, extname, isAbsolute, join, relative } from "path";
  * nothing from the failed attempt is reused. Imports that leave the plugin,
  * the sibling's files included, resolve to the same modules as always, so the
  * plugin shares the sibling's state as on a normal load.
+ *
+ * A plugin's imports of its siblings no longer go through the link at all
+ * (peer-imports.ts), so what is left for the retry is a plugin that Bun
+ * already failed in this process, imported before its sibling was there.
  */
 
 /** The query that gives a plugin's files their new module keys. */
 const RETRY_PARAM = "gloom-plugin-retry";
 const RETRY_QUERY = new RegExp(`[?&]${RETRY_PARAM}=(\\d+)(?:&|$)`);
-const SOURCE_LOADERS: Readonly<Record<string, "ts" | "tsx" | "js" | "jsx">> = {
-  ".ts": "ts",
-  ".mts": "ts",
-  ".tsx": "tsx",
-  ".js": "js",
-  ".mjs": "js",
-  ".jsx": "jsx",
-};
 /** A file name that is never there: looking it up is what clears a folder. */
 const MISSING_FILE = "./.gloom-resolver-refresh";
 const SKIPPED_FOLDERS = new Set(["node_modules", ".git", "dist"]);
@@ -49,11 +48,6 @@ const retryRoots = new Map<number, string>();
 let retries = 0;
 let installed = false;
 
-function isInside(root: string, path: string): boolean {
-  const inside = relative(root, path);
-  return !!inside && !inside.startsWith("..") && !isAbsolute(inside);
-}
-
 /** The plugin's own folders, without dependencies or build output. */
 function sourceFolders(dir: string, out: string[] = [], depth = 0): string[] {
   out.push(dir);
@@ -72,11 +66,11 @@ function sourceFolders(dir: string, out: string[] = [], depth = 0): string[] {
 }
 
 /**
- * Makes Bun read the plugin's folders and its links to `peers` from disk
- * again. Bun drops a folder from its resolver cache when a lookup in it
- * misses, so this looks up a file that is not there in each one. The
- * bundler shares the cache, which is why the desktop's compile of the same
- * plugin failed in the same session too.
+ * Makes Bun read the plugin's folders, its links to `peers` and the peers'
+ * own folders from disk again. Bun drops a folder from its resolver cache
+ * when a lookup in it misses, so this looks up a file that is not there in
+ * each one. The bundler shares the cache, which is why the desktop's compile
+ * of the same plugin failed in the same session too.
  */
 export function refreshResolverFolders(pluginDir: string, peers: readonly string[]): void {
   const modules = join(pluginDir, "node_modules");
@@ -84,6 +78,10 @@ export function refreshResolverFolders(pluginDir: string, peers: readonly string
   for (const peer of peers) {
     if (peer.startsWith("@")) folders.push(join(modules, peer.split("/")[0]!));
     folders.push(join(modules, peer));
+    for (const name of pluginDirectoryNames(peer)) {
+      const peerDir = join(dirname(pluginDir), name);
+      if (existsSync(peerDir)) folders.push(...sourceFolders(peerDir));
+    }
   }
   for (const folder of folders) {
     try {
@@ -97,15 +95,17 @@ export function refreshResolverFolders(pluginDir: string, peers: readonly string
 /**
  * The plugin's file at `path` (with the retry query), its relative imports
  * of other source files in the plugin given the same query, so they load
- * under new keys as well. Imports that leave the plugin keep their keys.
+ * under new keys as well. Imports that leave the plugin keep their keys,
+ * and those of a sibling plugin name its file in the sibling's folder, as
+ * on a first import (peer-imports.ts).
  */
-function rekeyedSource(path: string): { contents: string; loader: "ts" | "tsx" | "js" | "jsx" } {
+function rekeyedSource(path: string): { contents: string; loader: ReturnType<typeof sourceLoader> } {
   const match = RETRY_QUERY.exec(path);
   const file = match ? path.slice(0, match.index) : path;
-  const loader = SOURCE_LOADERS[extname(file).toLowerCase()] ?? "js";
+  const loader = sourceLoader(file);
   let contents = readFileSync(file, "utf8");
   const root = match ? retryRoots.get(Number(match[1])) : undefined;
-  if (!match || !root) return { contents, loader };
+  if (!match || !root) return { contents: withSiblingImports(file, contents), loader };
   const retry = Number(match[1]);
   const specifiers = new Set(
     new Bun.Transpiler({ loader }).scanImports(contents)
@@ -121,12 +121,9 @@ function rekeyedSource(path: string): { contents: string; loader: "ts" | "tsx" |
       continue;
     }
     if (!isInside(root, target) || !SOURCE_LOADERS[extname(target).toLowerCase()]) continue;
-    const rekeyed = `${specifier}?${RETRY_PARAM}=${retry}`;
-    for (const quote of ["\"", "'", "`"]) {
-      contents = contents.split(`${quote}${specifier}${quote}`).join(`${quote}${rekeyed}${quote}`);
-    }
+    contents = replaceSpecifier(contents, specifier, `${specifier}?${RETRY_PARAM}=${retry}`);
   }
-  return { contents, loader };
+  return { contents: withSiblingImports(file, contents), loader };
 }
 
 function installRekeyingLoader(): boolean {

package/src/plugins/plugin-process.ts

@@ -0,0 +1,128 @@
+/**
+ * The `process` a plugin sees in the desktop view and the web app.
+ *
+ * A plugin written for the terminal runs in Bun and reads `process.env`,
+ * `process.platform` and friends without a second thought. The desktop view
+ * and the browser are not Node: there is no `process`, so the same plugin
+ * died on load with `ReferenceError: process is not defined`. Defining a global
+ * `process` would be simpler, but the host itself looks at `globalThis.process`
+ * to tell a Node runtime from a browser (updater, platform labels, libc
+ * detection), so every plugin would change how the host behaves. The bundler
+ * (`bundle.ts`) gives each plugin bundle its own copy instead, as a module
+ * level constant that only that bundle's references to `process` read.
+ *
+ * What it holds is the harmless half of `process`: a copy of `env` with only
+ * `NODE_ENV` in it (never the host's real environment, which the view cannot
+ * read and a plugin should not receive by RPC), the platform of the window it
+ * runs in, empty `argv` and `versions`, and timers and listeners that work or
+ * do nothing. What cannot exist in a view (`exit`, `kill`, `chdir`, memory
+ * and CPU readings) throws an error naming the plugin, instead of "is not a
+ * function". Anything else is left undefined, so feature detection such as
+ * `process.stdin?.isTTY` keeps working.
+ */
+
+/** The name the bundler gives the shim; no plugin source declares it. */
+export const PLUGIN_PROCESS_IDENTIFIER = "__gloomPluginProcess";
+
+/**
+ * Builds the shim. This function is serialised into the plugin bundle with
+ * `toString()`, so it has to stay self-contained: no imports and no module
+ * level names, only globals the view provides.
+ */
+function createPluginProcess(pluginName: string): Record<string, unknown> {
+  const nav = (globalThis as {
+    navigator?: { userAgentData?: { platform?: string }; platform?: string; userAgent?: string };
+  }).navigator;
+  const hint = String(nav?.userAgentData?.platform || nav?.platform || nav?.userAgent || "").toLowerCase();
+  // Mac is tested before Windows because "darwin" contains "win".
+  const platform = /android/.test(hint)
+    ? "android"
+    : /mac|iphone|ipad|darwin/.test(hint)
+      ? "darwin"
+      : /win/.test(hint)
+        ? "win32"
+        : /linux|x11|cros/.test(hint)
+          ? "linux"
+          : "browser";
+
+  const hrtime = (previous?: readonly [number, number]): [number, number] => {
+    const ms = performance.now();
+    let seconds = Math.floor(ms / 1000);
+    let nanos = Math.floor((ms % 1000) * 1e6);
+    if (previous) {
+      seconds -= previous[0];
+      nanos -= previous[1];
+      if (nanos < 0) {
+        seconds -= 1;
+        nanos += 1e9;
+      }
+    }
+    return [seconds, nanos];
+  };
+  const stream = (log: (line: string) => void) => ({
+    isTTY: false,
+    write: (chunk: unknown) => {
+      log(String(chunk).replace(/\n$/, ""));
+      return true;
+    },
+  });
+
+  const proc: Record<string, unknown> = {
+    env: { NODE_ENV: "production" },
+    platform,
+    browser: true,
+    title: "browser",
+    argv: [],
+    execArgv: [],
+    execPath: "",
+    version: "",
+    versions: {},
+    pid: 0,
+    ppid: 0,
+    cwd: () => "/",
+    uptime: () => performance.now() / 1000,
+    hrtime: Object.assign(hrtime, { bigint: () => BigInt(Math.round(performance.now() * 1e6)) }),
+    nextTick: (callback: (...args: unknown[]) => void, ...args: unknown[]) => {
+      queueMicrotask(() => callback(...args));
+    },
+    emitWarning: (warning: unknown) => {
+      console.warn(String((warning as { message?: string } | null)?.message ?? warning));
+    },
+    stdout: stream((line) => console.log(line)),
+    stderr: stream((line) => console.error(line)),
+    emit: () => false,
+    listeners: () => [],
+    listenerCount: () => 0,
+  };
+  // Nothing exits or signals in a view, so a handler would never run.
+  for (const name of [
+    "on", "once", "off", "addListener", "removeListener", "removeAllListeners",
+    "prependListener", "prependOnceListener", "setMaxListeners",
+  ]) {
+    proc[name] = () => proc;
+  }
+  for (const name of [
+    "exit", "abort", "kill", "chdir", "umask", "binding", "memoryUsage", "cpuUsage", "resourceUsage",
+  ]) {
+    proc[name] = () => {
+      throw new Error(
+        `Plugin "${pluginName}" called process.${name}(), which is only available in the terminal app, not in the desktop or web app.`,
+      );
+    };
+  }
+  return proc;
+}
+
+/** The declaration the bundler puts at the top of a bundle that reads `process`. */
+export function pluginProcessDeclaration(pluginName: string): string {
+  return `const ${PLUGIN_PROCESS_IDENTIFIER} = (${createPluginProcess.toString()})(${JSON.stringify(pluginName)});\n`;
+}
+
+/** Source of `import process from "node:process"`, for a plugin that imports it. */
+export function pluginProcessModuleSource(): string {
+  const names = Object.keys(createPluginProcess(""));
+  return [
+    "export default process;",
+    ...names.map((name) => `export const ${name} = process.${name};`),
+  ].join("\n");
+}

package/src/plugins/redirection-guard.ts

@@ -0,0 +1,45 @@
+/**
+ * Whether Windows lets this process follow a junction a standard user made,
+ * which is what every link to a sibling plugin is (host-link.ts).
+ *
+ * Windows 11's RedirectionGuard stops a process that runs with it from
+ * following such a junction at all: the junction is there, points where it
+ * should, and every read through it fails. That is how the gateway's link
+ * looked on the first launch after an update. Some Windows services run with
+ * it; whether that launch did is not known, so the report of a link that does
+ * not resolve carries the answer.
+ */
+
+/** `ProcessRedirectionTrustPolicy` in Windows' PROCESS_MITIGATION_POLICY. */
+const PROCESS_REDIRECTION_TRUST_POLICY = 16;
+const CURRENT_PROCESS = -1;
+const ENFORCE = 0x1;
+const AUDIT = 0x2;
+
+let answer: string | null | undefined;
+
+/** `enforce`, `audit` (only logged), `off`, or `unknown` when Windows does not say. Null on other systems. */
+export function redirectionGuard(): string | null {
+  if (process.platform !== "win32") return null;
+  if (answer !== undefined) return answer;
+  answer = "unknown";
+  try {
+    // Required when asked, not imported: the pane screenshot page bundles the
+    // plugin loader for a browser, which has no `bun:ffi`.
+    const { dlopen, ptr } = import.meta.require("bun:ffi") as typeof import("bun:ffi");
+    const kernel32 = dlopen("kernel32.dll", {
+      GetProcessMitigationPolicy: { args: ["i64", "i32", "ptr", "u64"], returns: "i32" },
+    });
+    try {
+      const flags = new Uint32Array(1);
+      if (kernel32.symbols.GetProcessMitigationPolicy(CURRENT_PROCESS, PROCESS_REDIRECTION_TRUST_POLICY, ptr(flags), 4)) {
+        answer = (flags[0]! & ENFORCE) ? "enforce" : (flags[0]! & AUDIT) ? "audit" : "off";
+      }
+    } finally {
+      kernel32.close();
+    }
+  } catch {
+    // Intentional ignore: a Windows without the policy leaves the answer unknown.
+  }
+  return answer;
+}

package/src/remote/endpoint.ts

@@ -1,5 +1,6 @@
-import { readFile, rm, writeFile, mkdir } from "fs/promises";
+import { readFile, rename, rm } from "fs/promises";
 import { dirname, join } from "path";
+import { makePrivateDir, writePrivateFile } from "../utils/private-files";
 import type { RemoteAppKind, RemoteEndpoint } from "./types";
 
 const DEFAULT_ENDPOINT_FILE = "remote-control.json";
@@ -25,9 +26,21 @@ export async function removeRemoteEndpointFiles(dataDir: string, endpoint: Remot
   ]);
 }
 
+/**
+ * Readable by the user alone, an older copy replaced: it holds the token that
+ * controls the app. Written beside it and moved into place, so a client that
+ * finds the file never reads it half written.
+ */
 async function writeRemoteEndpoint(filePath: string, endpoint: RemoteEndpoint): Promise<void> {
-  await mkdir(dirname(filePath), { recursive: true });
-  await writeFile(filePath, JSON.stringify(endpoint, null, 2), { encoding: "utf-8", mode: 0o600 });
+  await makePrivateDir(dirname(filePath));
+  const temporary = `${filePath}.${process.pid}.tmp`;
+  try {
+    await writePrivateFile(temporary, JSON.stringify(endpoint, null, 2));
+    await rename(temporary, filePath);
+  } catch (error) {
+    await rm(temporary, { force: true });
+    throw error;
+  }
 }
 
 async function removeRemoteEndpointIfOwned(filePath: string, endpoint: RemoteEndpoint): Promise<void> {

package/src/renderers/browser/main.tsx

@@ -31,7 +31,7 @@ import {
   readOrCreateBrowserInstallId,
 } from "../../telemetry/crash-reports-dom";
 import { currentTelemetryConfig } from "../../telemetry/live-config";
-import { attentionCountsEnabled, installAttentionCounter } from "../../telemetry/attention-counts";
+import { installAttentionCounter } from "../../telemetry/attention-counts";
 import { installUsageCounter, recordRestoredFunctions, usageCountsEnabled } from "../../telemetry/usage-counts";
 import { installWindowUsageFlush } from "../../telemetry/usage-counts-dom";
 import type { AppConfig } from "../../types/config";
@@ -71,7 +71,7 @@ async function boot(): Promise<void> {
     getInstallId: () => readOrCreateBrowserInstallId(),
     officialPluginIds: loadOfficialPluginIds,
   });
-  installAttentionCounter(() => !browserDoNotTrack() && attentionCountsEnabled(currentTelemetryConfig(loadedConfig)));
+  installAttentionCounter({ allowed: () => !browserDoNotTrack(), launchConfig: () => loadedConfig });
   // A document reload does not unmount React. Flush both config and session
   // timers while localStorage is still available, including background tabs.
   window.addEventListener("pagehide", () => { void flushPendingPersistence(); });
@@ -114,6 +114,7 @@ async function boot(): Promise<void> {
           plugins={getBrowserPlugins(externalPlugins)}
           desktopDeepLinkBridge={deepLinkBridge}
           updatesEnabled={false}
+          setupEnabled={false}
         />
       </DomHostProviders>
     </DomErrorBoundary>,