native-sim 0.1.0 → 0.1.1

package/README.md

@@ -111,9 +111,29 @@ Requirements:
   fine. Signed URLs expire, so fetch a fresh one per session.
 - `.tar.gz` or `.zip` containing the `.app`.
 
+### Choosing where builds live
+
+Two things decide who can download your build: **where it is hosted**, and — for the
+default backend — **whether the repo is public**. Those axes interact, and the useful
+combinations are:
+
+| Repo | Hosting | Your build is | macOS minutes |
+| --- | --- | --- | --- |
+| private | GitHub release *(default)* | private | bill at [**10×**](#cost) |
+| public | GitHub release *(default)* | **downloadable by anyone** | free, unlimited |
+| public | `--r2` | private — 2h signed URL | free, unlimited |
+
+That last row is the reason `--r2` exists. A public repo is what makes macOS minutes free
+and unlimited, and the default backend inherits *repo* visibility — so on a public repo it
+publishes your binary. R2 is the only combination that keeps both the free minutes and a
+private build. The cost is a Cloudflare account and the `aws` CLI.
+
+If you are already on a private repo, the default backend is private too and `--r2` buys
+you nothing.
+
 ### Hosting your own builds
 
-By default a local build is uploaded as an asset on a **draft release of the same repo the
+By default a local build is uploaded as an asset on a **release of the same repo the
 workflow runs in**, and the runner fetches it with the job's own `GITHUB_TOKEN`:
 
 ```sh
@@ -126,9 +146,19 @@ This needs no third-party account and no credentials file. It works for **public
 repos alike**: a private repo's release assets are readable only by people who can read the
 repo, and there is no signed URL to expire mid-session.
 
-The release is created as a **draft**, which is not listed publicly — so a public repo does
-not start publishing your binaries as a side effect. If a release ever would be publicly
-downloadable, the CLI says so.
+The release is **published, not a draft**. GitHub only shows draft releases to callers with
+push access, and the workflow job runs with `contents: read` on purpose — so a draft is
+something the runner cannot fetch at all. Granting the job `contents: write` to work around
+that would give repo write access to a job that also opens a public tunnel, which is a worse
+trade than publishing a release.
+
+What that means for you:
+
+- **Private repo** — nothing changes. Release assets inherit repo visibility, so the build is
+  readable only by people who can already read the repo.
+- **Public repo** — the asset *is* downloadable by anyone, and the CLI warns you when it
+  uploads. Use [`--r2`](#hosting-on-r2-instead) to keep the build private — see
+  [Choosing where builds live](#choosing-where-builds-live).
 
 All builds land on one reused tag, `native-sim-build`, with the asset clobbered each time,
 so the release list does not fill up with build noise. Deleting that release is safe.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "native-sim",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Stream a live iOS Simulator of your React Native or Expo app from a GitHub-hosted macOS runner to your browser — and let a coding agent drive it.",
   "keywords": [
     "expo",

package/src/commands/up.js

@@ -83,15 +83,18 @@ export async function up(cwd, flags) {
   }
 
   // Now that the repo exists, a local build can be hosted on its own release.
-  // The runner fetches it with the job's own token — no third-party account,
-  // and nothing publicly downloadable when the release stays a draft.
+  // The runner fetches it with the job's own token — no third-party account
+  // and no presigned URL to expire mid-session. The release is published rather
+  // than a draft because the job token is `contents: read`, which cannot see
+  // drafts; on a private repo the asset is private either way.
   if (appFile && !flags.r2) {
     step(`Uploading ${bold(appFile)} to ${bold(repo)}`);
     const uploaded = ghrelease.upload(cwd, repo, appFile);
     appReleaseAsset = uploaded.asset;
     ok(`uploaded ${(uploaded.bytes / 1048576).toFixed(1)} MB ${dim(`as ${uploaded.asset}`)}`);
     if (ghrelease.isPubliclyReadable(cwd, repo)) {
-      warn('published release on a public repo — the build is downloadable by anyone');
+      warn(`this repo is public, so ${uploaded.asset} is downloadable by anyone`);
+      warn(`keep the build private with ${bold('--r2')} ${dim('(native-sim r2)')}`);
     }
   }
 

package/src/commands/upload.js

@@ -33,9 +33,10 @@ function uploadToGitHub(cwd, file) {
 
   ok(`uploaded ${mb(result.bytes)} as ${dim(result.asset)}`);
   if (ghrelease.isPubliclyReadable(cwd, repo)) {
-    warn('this release is published on a public repo — the build is downloadable by anyone');
+    warn('this repo is public — the build is downloadable by anyone');
+    warn(`keep it private with ${bold('--r2')} ${dim('(native-sim r2)')}`);
   } else {
-    info('draft release on this repo — only people who can read the repo can fetch it');
+    info('release on this repo — only people who can read the repo can fetch it');
   }
   console.log('');
   console.log(dim(`  run it:  native-sim up --app-release ${result.asset}`));

package/src/lib/gh.js

@@ -1,8 +1,14 @@
-import { sh, shx } from './proc.js';
+import { sh, shx, has } from './proc.js';
+
+const INSTALL_GH = process.platform === 'win32'
+  ? 'Install it: winget install --id GitHub.cli'
+  : process.platform === 'darwin'
+    ? 'Install it: brew install gh'
+    : 'Install it: https://github.com/cli/cli#installation';
 
 export function requireAuth() {
-  if (!sh('which', ['gh']).ok) {
-    throw new Error('GitHub CLI not found. Install it: brew install gh');
+  if (!has('gh')) {
+    throw new Error(`GitHub CLI not found on PATH. ${INSTALL_GH}`);
   }
   if (!sh('gh', ['auth', 'status']).ok) {
     throw new Error('Not logged in to GitHub. Run: gh auth login');
@@ -152,7 +158,8 @@ export function setSecret(cwd, name, value) {
 
 export function listSecrets(cwd) {
   const r = sh('gh', ['secret', 'list', '--json', 'name', '-q', '.[].name'], { cwd });
-  return r.ok ? r.out.split('\n').filter(Boolean) : [];
+  // gh emits CRLF on Windows; a trailing \r would corrupt every secret name.
+  return r.ok ? r.out.split(/\r?\n/).map((n) => n.trim()).filter(Boolean) : [];
 }
 
 export function cancelRun(cwd, id) {

package/src/lib/ghrelease.js

@@ -16,26 +16,49 @@ import { ensureArchive } from './r2.js';
  */
 export const TAG = 'native-sim-build';
 
-/** Draft releases are not listed publicly, so a public repo does not publish your binary. */
-export function ensureRelease(cwd, repo, { draft = true } = {}) {
-  const existing = sh('gh', ['release', 'view', TAG, '--repo', repo, '--json', 'tagName'], { cwd });
-  if (existing.ok) return { created: false };
+/**
+ * The release is published, not a draft.
+ *
+ * A draft looks like the safer default — it is not listed publicly — but the
+ * runner cannot read it. Draft releases are only returned to callers with push
+ * access, and the workflow's job token is deliberately `contents: read`, so
+ * `gh release download` 404'd on every `--app-file` run. Raising the job to
+ * `contents: write` to fix that would hand write access to a job that also
+ * opens a public tunnel, which is a far worse trade than publishing a release.
+ *
+ * On a private repo a published release is private anyway — the asset inherits
+ * repo visibility, so nothing is given up. On a public repo it is genuinely
+ * readable by anyone, so `up` warns and points at `--r2`.
+ */
+export function ensureRelease(cwd, repo) {
+  const existing = sh('gh', [
+    'release', 'view', TAG, '--repo', repo, '--json', 'isDraft', '-q', '.isDraft',
+  ], { cwd });
+
+  if (existing.ok) {
+    // Repos set up by an earlier native-sim still carry a draft release, which
+    // the runner cannot fetch from. Publish it rather than failing on the runner.
+    if (existing.out.trim() === 'true') {
+      shx('gh', ['release', 'edit', TAG, '--repo', repo, '--draft=false'], { cwd });
+      return { created: false, published: true };
+    }
+    return { created: false, published: false };
+  }
 
   shx('gh', [
     'release', 'create', TAG,
     '--repo', repo,
     '--title', 'native-sim builds',
     '--notes', 'Simulator builds uploaded by `native-sim`. Managed automatically; safe to delete.',
-    ...(draft ? ['--draft'] : []),
   ], { cwd });
-  return { created: true };
+  return { created: true, published: false };
 }
 
 /** Uploads (or replaces) one archive. Returns what the workflow needs to fetch it. */
-export function upload(cwd, repo, filePath, { draft = true } = {}) {
+export function upload(cwd, repo, filePath) {
   const archive = ensureArchive(filePath);
   const asset = basename(archive);
-  ensureRelease(cwd, repo, { draft });
+  ensureRelease(cwd, repo);
   // --clobber so re-running with the same build name replaces rather than fails.
   shx('gh', ['release', 'upload', TAG, archive, '--repo', repo, '--clobber'], { cwd });
   return { repo, tag: TAG, asset, bytes: statSync(archive).size };
@@ -44,7 +67,7 @@ export function upload(cwd, repo, filePath, { draft = true } = {}) {
 /** True when the repo would expose this asset to anyone (published release on a public repo). */
 export function isPubliclyReadable(cwd, repo) {
   const vis = sh('gh', ['repo', 'view', repo, '--json', 'visibility', '-q', '.visibility'], { cwd });
-  if (!vis.ok || vis.out.trim() !== 'PUBLIC') return false;
+  if (!vis.ok || vis.out.trim().toUpperCase() !== 'PUBLIC') return false;
   const rel = sh('gh', ['release', 'view', TAG, '--repo', repo, '--json', 'isDraft', '-q', '.isDraft'], { cwd });
   return rel.ok && rel.out.trim() === 'false';
 }

package/src/lib/proc.js

@@ -1,8 +1,78 @@
 import { spawnSync, spawn } from 'node:child_process';
+import { accessSync, constants, statSync } from 'node:fs';
+import { join, extname } from 'node:path';
+
+const isWindows = process.platform === 'win32';
+
+/**
+ * Windows has no `which`, so the old `sh('which', cmd)` probe reported every
+ * tool as missing even when it was installed and on PATH — `native-sim up`
+ * died with "GitHub CLI not found" on machines where gh worked fine.
+ * Resolve against PATH ourselves instead: no subprocess, same answer on
+ * every platform.
+ */
+export function resolve(cmd) {
+  if (cmd.includes('/') || (isWindows && cmd.includes('\\'))) {
+    return isExecutable(cmd) ? cmd : null;
+  }
+
+  // PATHEXT is what makes `gh` mean `gh.exe` and `agent-device` mean
+  // `agent-device.cmd`; on POSIX the only candidate is the bare name.
+  const pathext = isWindows
+    ? (process.env.PATHEXT ?? '.COM;.EXE;.BAT;.CMD').split(';').filter(Boolean)
+    : [];
+  // A command that already carries one of those extensions is tried as-is.
+  const exts = !isWindows || pathext.some((e) => e.toUpperCase() === extname(cmd).toUpperCase())
+    ? ['']
+    : pathext;
+
+  // PATH only, never the working directory: cmd.exe would search `.` first,
+  // which would let a checked-out repo shadow gh or git with its own binary.
+  const delimiter = isWindows ? ';' : ':';
+  for (const dir of (process.env.PATH ?? '').split(delimiter).filter(Boolean)) {
+    for (const ext of exts) {
+      const candidate = join(dir, cmd + ext);
+      if (isExecutable(candidate)) return candidate;
+    }
+  }
+  return null;
+}
+
+function isExecutable(path) {
+  try {
+    if (!statSync(path).isFile()) return false;
+    // X_OK is meaningless on Windows: every readable file reports executable,
+    // which is why the PATHEXT filter above carries the check there.
+    accessSync(path, isWindows ? constants.F_OK : constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * `.cmd`/`.bat` shims — how npm installs CLIs like agent-device and how the
+ * MSI installs aws on Windows — are scripts, not executables, so spawn cannot
+ * run them directly. Route those through cmd.exe, quoting the arguments here
+ * rather than letting cmd.exe re-split a path that contains spaces.
+ */
+function spawnArgs(cmd, args) {
+  const path = resolve(cmd);
+  if (!path) return { file: cmd, args, opts: {} };
+  if (!isWindows || !/\.(cmd|bat)$/i.test(path)) return { file: path, args, opts: {} };
+  return {
+    file: process.env.COMSPEC ?? 'cmd.exe',
+    args: ['/d', '/s', '/c', `"${[path, ...args].map(quote).join(' ')}"`],
+    opts: { windowsVerbatimArguments: true },
+  };
+}
+
+const quote = (arg) => (/[\s"]/.test(arg) ? `"${String(arg).replace(/"/g, '""')}"` : String(arg));
 
 /** Run a command, capture output. Never throws. */
 export function sh(cmd, args = [], opts = {}) {
-  const r = spawnSync(cmd, args, { encoding: 'utf8', ...opts });
+  const spec = spawnArgs(cmd, args);
+  const r = spawnSync(spec.file, spec.args, { encoding: 'utf8', ...spec.opts, ...opts });
   return {
     ok: r.status === 0,
     code: r.status,
@@ -22,16 +92,26 @@ export function shx(cmd, args = [], opts = {}) {
 
 /** Run a command with inherited stdio (user sees live output). */
 export function run(cmd, args = [], opts = {}) {
-  const r = spawnSync(cmd, args, { stdio: 'inherit', ...opts });
+  const spec = spawnArgs(cmd, args);
+  const r = spawnSync(spec.file, spec.args, { stdio: 'inherit', ...spec.opts, ...opts });
   if (r.status !== 0) throw new Error(`${cmd} ${args.join(' ')} exited ${r.status}`);
 }
 
 export function has(cmd) {
-  return sh('which', [cmd]).ok;
+  return resolve(cmd) !== null;
 }
 
 export function open(url) {
-  spawn('open', [url], { detached: true, stdio: 'ignore' }).unref();
+  // `open` is macOS-only. Without a listener the ENOENT on other platforms
+  // surfaces as an uncaught exception *after* the session is already up.
+  const [cmd, args] = isWindows
+    ? [process.env.COMSPEC ?? 'cmd.exe', ['/d', '/s', '/c', 'start', '""', url.replace(/&/g, '^&')]]
+    : process.platform === 'darwin'
+      ? ['open', [url]]
+      : ['xdg-open', [url]];
+  const child = spawn(cmd, args, { detached: true, stdio: 'ignore' });
+  child.on('error', () => {});
+  child.unref();
 }
 
 export const sleep = (ms) => new Promise((r) => setTimeout(r, ms));

package/templates/native-sim.yml

@@ -1,4 +1,4 @@
-# native-sim-template-version: 18
+# native-sim-template-version: 19
 # Generated by `native-sim init`. Boots an iOS Simulator on a GitHub-hosted macOS
 # runner, builds this Expo app into it, and streams it back over a tunnel using
 # @expo/serve-sim. The tunnel URL is published as a commit status, which is the
@@ -454,14 +454,26 @@ jobs:
 
           if [ -n "$APP_RELEASE_ASSET" ]; then
             # Hosted on this repo's own release. The job token is already scoped
-            # here, so a private repo costs no extra credential and a draft
-            # release is not downloadable by the public.
+            # here, so a private repo costs no extra credential.
+            #
+            # This job runs with `contents: read`, and GitHub only returns draft
+            # releases to callers with push access — so a draft `native-sim-build`
+            # release 404s here no matter how healthy the upload looked. native-sim
+            # publishes the release for that reason; say so plainly if one is still
+            # a draft, rather than dying on a bare "release not found".
             echo "Downloading $APP_RELEASE_ASSET from release $APP_RELEASE_TAG"
-            gh release download "$APP_RELEASE_TAG" \
+            if ! gh release download "$APP_RELEASE_TAG" \
               --repo "$GITHUB_REPOSITORY" \
               --pattern "$APP_RELEASE_ASSET" \
               --output download.bin \
               --clobber
+            then
+              echo "::error::could not download $APP_RELEASE_ASSET from release $APP_RELEASE_TAG."
+              echo "::error::If that release is a draft, this job cannot read it (contents: read)."
+              echo "::error::Publish it:  gh release edit $APP_RELEASE_TAG --draft=false"
+              echo "::error::Or upgrade native-sim, which now publishes it for you."
+              exit 1
+            fi
           else
             echo "Downloading prebuilt app"
             curl -fsSL --retry 3 -o download.bin "$APP_URL"