peachsim 0.1.1641 → 0.1.1653

package/cli/commands/upload.ts

@@ -1,3 +1,5 @@
+import { createHash, randomUUID } from 'crypto'
+import { readFileSync, rmSync } from 'fs'
 // peach record upload — publish a recording from a running simulator. scene
 // recordings carry their own content identity; --live-bundle adds the app
 // bundle for interactive playback under the existing bundle identity.
@@ -7,44 +9,19 @@
 // owner turns on Public link from the preview page's share menu. uploads
 // require a signed-in desktop session or an api key so the share is
 // associated with the user's account.
-
-import { createHash, randomUUID } from 'crypto'
-import { readFileSync, rmSync } from 'fs'
 import { tmpdir } from 'os'
 import path from 'path'
 import { gzipSync, gunzipSync } from 'zlib'
 import { readProfileTrace } from '@peach/globals/profile-trace'
 import { toProfileFile, type ProfileFile } from '@peach/globals/profiler'
-import { resolveAppFontsWire } from 'peach-engine/engine/config-plugin-fonts'
-import { shouldCompress } from 'peach-engine/preview/compress'
-import { brotliBundle } from 'peach-engine/preview/compress-node'
-import {
-  canonicalPublicPreviewOrigin,
-  runPresignedUpload,
-  type InitRequestBody,
-} from 'peach-engine/preview/presigned-upload'
-import {
-  hasShareableStorage,
-  type ShareableStorageSnapshot,
-} from 'peach-engine/preview/storage-snapshot-contract'
-import {
-  TRACE_CAPTURE_POSTROLL_MS,
-  TRACE_CAPTURE_PREROLL_MS,
-  isTraceTimelineEvent,
-  parseTraceTimelineJsonl,
-} from 'peach-engine/preview/trace'
-import {
-  mergeProfileTimeline,
-  profileFrameSummary,
-} from 'peach-engine/profiler/profile-trace'
-import { readSceneRecordingUpload } from 'peach-engine/remote-stream/scene-recording'
-import {
-  resolvedExpoAppIconUrl,
-  expoConfigFromManifest,
-} from '../../../peach-engine/src/engine/expo-manifest'
 import { loopbackOriginOf } from '../../src/backend-origin'
+import { getCliRuntime } from '../../src/cli-runtime.ts'
 import { parseExpoManifestBody } from '../../src/expo-manifest-body'
 import { rnxPublicBrand } from '../../src/public-brand'
+import {
+  hasShareableStorage,
+  ShareableStorageSnapshot,
+} from '../../src/storageSnapshotContract.ts'
 import { fetchAppFontFiles } from '../app-fonts'
 import { fetchAppSplashImages } from '../app-splash'
 import { authHeaderValue, githubUploadIdentity, resolveCliAuth } from '../auth'
@@ -59,8 +36,9 @@ import {
   evalInBridge,
   parseBridgeCliArgs,
 } from '../ws-bridge'
+import type { BundleSnapshot } from '#peach-cli-contract/preview/capture-bundle'
+import type { InitRequestBody } from '#peach-cli-contract/preview/presigned-upload'
 import type { SootSimTimelineEvent } from '@peach/globals'
-import type { BundleSnapshot } from 'peach-engine/preview/capture-bundle'
 
 interface UploadOptions {
   port?: number
@@ -375,9 +353,13 @@ function traceTimelineQuery(args: {
 }): { since?: number; until?: number; limit: number } {
   if (args.recordedDurationMs && args.recordingStartedAtMs) {
     return {
-      since: args.recordingStartedAtMs - TRACE_CAPTURE_PREROLL_MS,
+      since:
+        args.recordingStartedAtMs -
+        getCliRuntime().preview_trace.TRACE_CAPTURE_PREROLL_MS,
       until:
-        args.recordingStartedAtMs + args.recordedDurationMs + TRACE_CAPTURE_POSTROLL_MS,
+        args.recordingStartedAtMs +
+        args.recordedDurationMs +
+        getCliRuntime().preview_trace.TRACE_CAPTURE_POSTROLL_MS,
       limit: 2000,
     }
   }
@@ -388,7 +370,7 @@ function readTraceTimelineEventsFile(filePath: string): SootSimTimelineEvent[] {
   const bytes = readFileSync(filePath)
   const isGzip = bytes[0] === 0x1f && bytes[1] === 0x8b
   const text = (isGzip ? gunzipSync(bytes) : bytes).toString('utf8')
-  return parseTraceTimelineJsonl(text)
+  return getCliRuntime().preview_trace.parseTraceTimelineJsonl(text)
 }
 
 async function readTraceProfileFile(filePath: string): Promise<ProfileFile> {
@@ -693,14 +675,17 @@ export async function runUpload(
       : []
     traceTimelineEvents = [
       ...traceTimelineEvents,
-      ...timelineEvents.filter(isTraceTimelineEvent),
+      ...timelineEvents.filter(getCliRuntime().preview_trace.isTraceTimelineEvent),
     ].sort((a, b) => a.t - b.t || a.seq - b.seq)
   } finally {
     bridge.close()
   }
 
   if (traceProfile)
-    traceTimelineEvents = mergeProfileTimeline(traceTimelineEvents, traceProfile)
+    traceTimelineEvents = getCliRuntime().profiler_profile_trace.mergeProfileTimeline(
+      traceTimelineEvents,
+      traceProfile,
+    )
 
   if (!snapshot) {
     console.error(
@@ -881,7 +866,10 @@ export async function runUpload(
   let sceneStream: InitRequestBody['sceneStream']
   if (scenePath) {
     sceneBytes = readFileSync(scenePath)
-    const { header, slot } = await readSceneRecordingUpload(sceneBytes)
+    const { header, slot } =
+      await getCliRuntime().remote_stream_scene_recording.readSceneRecordingUpload(
+        sceneBytes,
+      )
     sceneStream = slot
     console.log(
       `  attaching scene stream: ${(sceneBytes.byteLength / 1024).toFixed(1)} KiB, ${header.frameCount} frames over ${Math.round(header.durationMs)}ms`,
@@ -949,7 +937,7 @@ export async function runUpload(
     responseHeaders?: Array<{ name: string; value: string }>,
     requestVaryHash?: string,
   ): PreparedFile => {
-    const compress = shouldCompress(contentType)
+    const compress = getCliRuntime().preview_compress.shouldCompress(contentType)
     const bytes = compress ? gzipSync(raw) : raw
     return {
       url,
@@ -972,7 +960,10 @@ export async function runUpload(
   // pipelines store identical bytes keyed by sha256(url).
   const appFontFiles: PreparedFile[] = []
   const appFontsWire = hasBundle
-    ? await resolveAppFontsWire(appFontsWireFromPageHref(snapshot.pageHref), fetch)
+    ? await getCliRuntime().engine_config_plugin_fonts.resolveAppFontsWire(
+        appFontsWireFromPageHref(snapshot.pageHref),
+        fetch,
+      )
     : ''
   if (appFontsWire) {
     const fonts = await fetchAppFontFiles(appFontsWire, {
@@ -1043,7 +1034,7 @@ export async function runUpload(
     })
     if (response.ok && !response.headers.get('content-type')?.includes('html')) {
       const manifest: unknown = parseExpoManifestBody(await response.text())
-      const config = expoConfigFromManifest(manifest)
+      const config = getCliRuntime().engine_expo_manifest.expoConfigFromManifest(manifest)
       if (config) {
         appManifest = manifestUrl
         appIdentityFiles.push(
@@ -1056,7 +1047,11 @@ export async function runUpload(
             'application/json',
           ),
         )
-        const iconUrl = resolvedExpoAppIconUrl(config, platform, snapshot.bundleUrl)
+        const iconUrl = getCliRuntime().engine_expo_manifest.resolvedExpoAppIconUrl(
+          config,
+          platform,
+          snapshot.bundleUrl,
+        )
         if (iconUrl) {
           try {
             const icon = await fetch(iconUrl, { signal: AbortSignal.timeout(30_000) })
@@ -1116,7 +1111,9 @@ export async function runUpload(
   // brotli source bytes for the upload. finalize verifies the source hash,
   // minifies in the node build container, and stores one canonical brotli
   // bundle. assets stay gzip below.
-  const bundleBr = bundleBytes ? brotliBundle(bundleBytes) : undefined
+  const bundleBr = bundleBytes
+    ? getCliRuntime().preview_compress_node.brotliBundle(bundleBytes)
+    : undefined
   const identityBytes = bundleBytes ?? sceneBytes
   if (!identityBytes) throw new Error('upload requires a bundle or scene recording')
   const contentHash = createHash('sha256').update(identityBytes).digest('hex')
@@ -1181,7 +1178,9 @@ export async function runUpload(
     storage: storageGz
       ? { sizeBytes: storageGz.byteLength, encoding: 'gzip' }
       : undefined,
-    traceFrameStats: traceProfile ? profileFrameSummary(traceProfile) : undefined,
+    traceFrameStats: traceProfile
+      ? getCliRuntime().profiler_profile_trace.profileFrameSummary(traceProfile)
+      : undefined,
     recordedDurationMs,
     recordingStartedAtMs,
     capture,
@@ -1250,7 +1249,7 @@ export async function runUpload(
 
   let finalize
   try {
-    const result = await runPresignedUpload({
+    const result = await getCliRuntime().preview_presigned_upload.runPresignedUpload({
       originBase: origin,
       initBody,
       bundleBytes: bundleBr,
@@ -1308,7 +1307,7 @@ export async function runUpload(
     peachExit(1, message)
   }
 
-  const previewUrl = `${canonicalPublicPreviewOrigin(publicOrigin)}${finalize.url}`
+  const previewUrl = `${getCliRuntime().preview_presigned_upload.canonicalPublicPreviewOrigin(publicOrigin)}${finalize.url}`
   console.log(`\n  stored ${finalize.filesStored ?? 0} extra files`)
   console.log(`  preview: ${previewUrl}`)
 

package/cli/current-sim.ts

@@ -191,6 +191,7 @@ export function readCurrentTarget(): LocalCurrentTarget | null {
       rmSync(filepath, { force: true })
       return null
     }
+    if (Reflect.get(parsed, 'pendingOpen') === true) return null
     const version = Reflect.get(parsed, 'version')
     const plane = Reflect.get(parsed, 'plane')
     const simId = Reflect.get(parsed, 'simId')
@@ -241,3 +242,40 @@ export function saveCurrentSimId(simId: string) {
 export function clearCurrentSimId() {
   rmSync(getCurrentSimPath(), { force: true })
 }
+
+// `peach open` has started choosing a new target and none is pinned yet. the
+// mark holds until a successful open/use pins a sim or the pin is cleared, so
+// a failed open cannot hand later mutating commands to whichever other tab the
+// bridge happens to hold.
+export function markOpenPending() {
+  writeSecureJsonAtomic(getCurrentSimPath(), {
+    version: CURRENT_SIM_VERSION,
+    plane: 'local',
+    pendingOpen: true,
+    updatedAt: new Date().toISOString(),
+  })
+}
+
+// refuses a command that would choose its own sim while an open is pending.
+// callers pass it only for commands with no sim the user named.
+export function assertNoPendingOpen() {
+  if (!isOpenPending()) return
+  throw new Error(
+    'the last `peach open` did not pin a sim, so this command would land on whichever tab is connected. run `peach open` again, `peach use <sim>`, or pass --sim <id>',
+  )
+}
+
+function isOpenPending(): boolean {
+  const filepath = getCurrentSimPath()
+  if (!existsSync(filepath)) return false
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(filepath, 'utf8'))
+    return (
+      parsed !== null &&
+      typeof parsed === 'object' &&
+      Reflect.get(parsed, 'pendingOpen') === true
+    )
+  } catch {
+    return false
+  }
+}

package/cli/desktop-companion.ts

@@ -134,12 +134,15 @@ function retiredElectronApps(): string[] {
 }
 
 // existing Electron apps stay on disk; CLI users receive the migration once.
-// the notice names those apps and does not reject a native host beside them.
+// the notice names those apps and does not reject a native host beside them;
+// it recommends installing only when no native host is selected and present.
 export function notifyDesktopMigration(): void {
   if (process.platform !== 'darwin' && process.platform !== 'linux') return
   const legacy = retiredElectronApps()
   const marker = join(rnxHomeDir(), 'electron-native-migration')
   if (legacy.length === 0 || existsSync(marker)) return
+  const nativeApp = nativeDesktopOverrideError() ? null : getNativeDesktopAppPath()
+  const nativeReady = nativeApp !== null && existsSync(nativeExecutable(nativeApp))
   mkdirSync(rnxHomeDir(), { recursive: true })
   try {
     writeFileSync(marker, '', { flag: 'wx' })
@@ -148,7 +151,10 @@ export function notifyDesktopMigration(): void {
     throw error
   }
   console.error(
-    `  Electron has retired on Mac and Linux (${legacy.join(', ')}). Install the native app: peach desktop install`,
+    `  Electron has retired on Mac and Linux (${legacy.join(', ')}). ` +
+      (nativeReady
+        ? `The native app at ${nativeApp} is in use.`
+        : 'Install the native app: peach desktop install'),
   )
 }
 
@@ -198,7 +204,21 @@ export function nativeDesktopIsDefault(): boolean {
   )
 }
 
+// why PEACH_DESKTOP_APP cannot select a host; launch rejects it, the installer
+// and the migration notice do not use it
+function nativeDesktopOverrideError(): string | null {
+  const explicitApp = process.env.PEACH_DESKTOP_APP
+  if (!explicitApp) return null
+  if (process.platform === 'darwin' && !explicitApp.endsWith('.app'))
+    return 'PEACH_DESKTOP_APP must name a Mac .app bundle'
+  if (process.platform !== 'darwin' && process.platform !== 'linux')
+    return 'native desktop requires macOS or Linux'
+  return null
+}
+
 export function getNativeDesktopAppPath(): string | null {
+  const overrideError = nativeDesktopOverrideError()
+  if (overrideError) throw new Error(overrideError)
   const explicitApp = process.env.PEACH_DESKTOP_APP
   if (!explicitApp)
     return process.platform === 'linux'
@@ -206,18 +226,20 @@ export function getNativeDesktopAppPath(): string | null {
         ? '/usr/bin/peach-desktop'
         : null
       : activeDesktopHostApp()
-  if (process.platform === 'darwin' && !explicitApp.endsWith('.app'))
-    throw new Error('PEACH_DESKTOP_APP must name a Mac .app bundle')
-  if (process.platform !== 'darwin' && process.platform !== 'linux')
-    throw new Error('native desktop requires macOS or Linux')
   return resolve(explicitApp)
 }
 
+function nativeExecutable(appPath: string): string {
+  return process.platform === 'darwin'
+    ? join(appPath, 'Contents/MacOS/PeachDesktop')
+    : appPath
+}
+
 function findNativeDesktopCompanion(): DesktopCompanionInstall | null {
   const appPath = getNativeDesktopAppPath()
   if (!appPath) return null
   const mac = process.platform === 'darwin'
-  if (!existsSync(mac ? join(appPath, 'Contents/MacOS/PeachDesktop') : appPath)) {
+  if (!existsSync(nativeExecutable(appPath))) {
     throw new Error(
       `native desktop executable missing in ${appPath}${mac ? ' (run `peach desktop install --native --force`)' : ''}`,
     )
@@ -394,6 +416,7 @@ export async function launchDesktopCompanion(
   if (opts.ownerPid && opts.ownerPid > 1) extraArgs.push(`--owner-pid=${opts.ownerPid}`)
 
   if (install.kind === 'native-mac-app') {
+    const explicitApp = Boolean(process.env.PEACH_DESKTOP_APP)
     const launchUrl =
       url ||
       opts.profileId ||
@@ -404,6 +427,7 @@ export async function launchDesktopCompanion(
         ? buildMacLaunchUrl(url, opts, true)
         : ''
     if (
+      !explicitApp &&
       opts.bridgePort &&
       launchUrl &&
       (await openInConnectedMacApp(opts.bridgePort, launchUrl))
@@ -413,7 +437,11 @@ export async function launchDesktopCompanion(
     // `open -n -a` spawns an instance bound to this caller's PEACH_HOME and
     // bridge port rather than handing the URL to another session's running
     // PeachDesktop process; subsequent opens on the same bridge reuse that
-    // instance via openInConnectedMacApp above.
+    // instance via openInConnectedMacApp above unless a build is explicitly selected.
+    // a connected host cannot establish the selected build or its launch preferences.
+    if (explicitApp) {
+      extraArgs.push('-SUEnableAutomaticChecks', 'NO', '-SUAutomaticallyUpdate', 'NO')
+    }
     extraArgs.push('--no-personal-home')
     // a CLI launch builds its windows from its own args: skip appkit's restore of a prior
     // crashed session, whose reopen alert blocks boot, without clearing the saved state

package/cli/device-option.ts

@@ -1,4 +1,4 @@
-import { devices, listSelectableDeviceModels } from 'peach-engine/settings/devices'
+import { devices, listSelectableDeviceModels } from '../src/device-catalog.ts'
 
 export function validateDeviceOption(device: string | undefined): boolean {
   if (!device || device in devices) return true

package/cli/drivers/playwright.ts

@@ -18,6 +18,7 @@ import { createServer } from 'net'
 import { tmpdir } from 'os'
 import { join } from 'path'
 import { AUTOMATION_SIM_IDLE_REAP_TTL_MS } from '../../src/bridge-constants'
+import { getCliVersion } from '../../src/cli-version'
 import {
   desktopHostDelivery,
   desktopHostPlatform,
@@ -54,6 +55,38 @@ function probe(): DriverAvailability {
   }
 }
 
+// every bridge since the fetch transport landed serves its route, so a 404
+// from a server whose /healthz identifies a peach bridge means that bridge
+// predates this cli. without that identity the port may hold something else,
+// and the message says only what was observed. restarting closes every sim
+// the bridge hosts, so the cli never does it.
+async function olderBridgeMessage(bridgePort: number): Promise<string> {
+  const restart = `run \`peach daemon restart\` to load the matching bridge; it closes every sim that bridge hosts, so it was not restarted.`
+  let health: unknown = null
+  try {
+    const response = await fetch(`http://127.0.0.1:${bridgePort}/healthz`, {
+      signal: AbortSignal.timeout(10_000),
+    })
+    health = await response.json()
+  } catch {
+    // an unreadable /healthz leaves the server unidentified
+  }
+  const field = (key: string) =>
+    health && typeof health === 'object' ? Reflect.get(health, key) : null
+  const pid = field('pid')
+  if (field('ok') !== true || typeof pid !== 'number') {
+    return `port ${bridgePort} has no fetch transport route and its /healthz did not identify a peach bridge, so this peach cli ${getCliVersion()} cannot use it. if an older peach bridge holds that port, ${restart}`
+  }
+  const runtime = field('activeRuntime')
+  const details = [
+    `pid ${pid}`,
+    typeof runtime === 'string' ? `runtime ${runtime}` : null,
+  ]
+    .filter((part) => part !== null)
+    .join(', ')
+  return `the peach bridge on port ${bridgePort} (${details}) has no fetch transport route, so it predates this peach cli ${getCliVersion()}. ${restart}`
+}
+
 // resolve the Chrome user-data dir for a profiled launch. a non-empty
 // return means the host should use a persistent context; '' means a plain
 // (in-memory) browser launch.
@@ -111,6 +144,12 @@ async function launch(opts: DriverLaunchOptions): Promise<DriverLaunchResult> {
         `http://127.0.0.1:${opts.bridgePort}/__peach/fetch-transport`,
         { signal: AbortSignal.timeout(10_000) },
       )
+      if (response.status === 404) {
+        return {
+          launched: false,
+          message: await olderBridgeMessage(opts.bridgePort),
+        }
+      }
       if (!response.ok) throw new Error(`transport discovery returned ${response.status}`)
       const descriptor: unknown = await response.json()
       if (!descriptor || typeof descriptor !== 'object')
@@ -235,6 +274,7 @@ async function launch(opts: DriverLaunchOptions): Promise<DriverLaunchResult> {
       launched: true,
       message: `playwright ${hostCommand ? 'native host' : 'Chromium'} launched → ${targetUrl.href}${ownerNote}`,
       pid: child.pid,
+      process: child,
       target: resolved.spec,
       attachUrl: targetUrl.href,
       connectAckFile,

package/cli/drivers/types.ts

@@ -2,6 +2,8 @@
 // playwright-owned profile. desktop launches the native host; electron the
 // Electron companion.
 
+import type { ChildProcess } from 'node:child_process'
+
 export type DriverId = 'desktop' | 'electron' | 'playwright'
 
 // broad category for grouping / filtering. "native" is a desktop host;
@@ -85,6 +87,8 @@ export interface DriverLaunchResult {
   // expose what makes sense for its environment. pid for spawned processes,
   // `target` for an install path, `attachUrl` for automation drivers.
   pid?: number
+  // the spawned handle, for drivers whose process tree the caller must stop.
+  process?: ChildProcess
   target?: string
   attachUrl?: string
   connectAckFile?: string

package/cli/help-core.ts

@@ -4,11 +4,11 @@ import {
   renderCliGroupHelp,
   renderCliIndexHelp,
 } from '@peach/skills/cli/renderers'
-import { formatFlagHelp } from 'peach-engine/settings/cli-flags'
 import {
   DEFAULT_SOOTSIM_BRIDGE_PORT,
   DEFAULT_SOOTSIM_BRIDGE_URL,
 } from '../src/bridge-constants'
+import { formatFlagHelp } from '../src/settings-flags.ts'
 import {
   getRnxCommandAvailability,
   getRnxFirstPositional,

package/cli/internal-child.ts

@@ -195,7 +195,8 @@ export async function runScript(scriptPath: string, args: string[]): Promise<voi
  *  an absolute path the driver hands it in the environment, launches chrome,
  *  and keeps this process alive until the browser goes away. */
 async function playwrightHost(): Promise<void> {
-  const { PLAYWRIGHT_SIM_HOST } = await import('./drivers/playwright-sim-host')
+  const { getCliRuntime } = await import('../src/cli-runtime')
+  const { PLAYWRIGHT_SIM_HOST } = getCliRuntime().playwright_sim_host
   const run: unknown = vm.runInThisContext(
     `(function(require){${PLAYWRIGHT_SIM_HOST}\n})`,
     { filename: 'rnx-playwright-host.js' },

package/cli/main.ts

@@ -1,9 +1,9 @@
+import { Console } from 'node:console'
 // the peach CLI proper: argv parsing, the one-time privacy choice, and the
 // single lazy-imported command a run dispatches to. `./bin` imports this only
 // when none of its hidden entry points claimed the process.
-
-import { Console } from 'node:console'
 import { automaticPeachUpdatesEnabled } from '../src/automatic-update-policy'
+import { getCliRuntime } from '../src/cli-runtime.ts'
 import { exitWithFlushedOutput } from '../src/process-output'
 import { rnxPublicBrand } from '../src/public-brand'
 import { levenshtein } from './levenshtein'
@@ -330,7 +330,7 @@ if (theme && theme !== 'light' && theme !== 'dark' && theme !== 'auto') {
 
 // apply device/theme to settings store if provided
 if (device || theme) {
-  const { settingsStore } = await import('peach-engine/settings/store')
+  const { settingsStore } = await Promise.resolve(getCliRuntime().settings_store)
   const overrides: Record<string, any> = {}
   if (device) overrides.deviceModel = device
   if (theme) overrides.colorScheme = theme
@@ -708,6 +708,12 @@ try {
         break
       }
 
+      case 'coverage': {
+        const { runCoverage } = await import('./commands/coverage')
+        process.exitCode = await runCoverage(parsed.commandArgs)
+        break
+      }
+
       case 'project-report': {
         const { runProjectReport } = await import('./commands/project-report')
         await exitWithFlush(runProjectReport(parsed.commandArgs))

package/cli/outbound-endpoints.ts

@@ -38,7 +38,7 @@ export const OUTBOUND_ENDPOINTS: Record<string, OutboundEndpointDeclaration> = {
   runtime_delivery: {
     category: 'runtime-delivery',
     destination:
-      'https://contrast.dev/runtimes/manifest.json and selected runtime tarball; with `peach desktop install --native`, https://r2.rnxsim.com/releases/native/<channel>/ manifest and versioned host zip',
+      'https://peachsim.com/runtimes/manifest.json and selected runtime tarball; with `peach desktop install --native`, https://r2.rnxsim.com/releases/native/<channel>/ manifest and versioned host zip',
     preConsent: true,
     payload: 'HTTP runtime or desktop host version request; no project or app data',
   },
@@ -107,7 +107,7 @@ export const OUTBOUND_ENDPOINTS: Record<string, OutboundEndpointDeclaration> = {
   },
   release_notes: {
     category: 'explicit-user-action',
-    destination: 'https://contrast.dev/api/changelog/sootsim',
+    destination: 'https://peachsim.com/api/changelog/sootsim',
     preConsent: false,
     payload: 'requested runtime version only',
   },
@@ -216,6 +216,14 @@ export const OUTBOUND_ENDPOINTS: Record<string, OutboundEndpointDeclaration> = {
     payload:
       'HTTP GET of a pinned, sha256-checked toolchain file; fires only when the user builds a Kotlin app and the file is not cached',
   },
+  coverage_parser_download: {
+    category: 'explicit-user-action',
+    destination:
+      'https://registry.npmjs.org/@typescript/typescript-<platform>/-/ pinned parser tarball',
+    preConsent: false,
+    payload:
+      'HTTP GET of the pinned, sha512-checked native parser when peach coverage has no matching installed or cached parser; version, platform and architecture only, with no source or project data',
+  },
   linux_browser_libs_download: {
     category: 'runtime-delivery',
     destination:
@@ -639,6 +647,8 @@ export const DECLARED_OUTBOUND_CALLS: Record<string, OutboundCallDeclaration> =
     { category: 'local_development', count: 1 },
   'packages/peachsim/cli/drivers/playwright.ts :: fetch :: `http://127.0.0.1:${opts.bridgePort}/__peach/fetch-transport`':
     { category: 'local_development', count: 1 },
+  'packages/peachsim/cli/drivers/playwright.ts :: fetch :: `http://127.0.0.1:${bridgePort}/healthz`':
+    { category: 'local_development', count: 1 },
   "packages/peach-engine/src/screenshots/capture-store.ts :: fetch :: captureApiUrl(ref, 'grid')":
     { category: 'contrast_user_action', count: 1 },
   'packages/peach-engine/src/screenshots/capture-store.ts :: fetch :: captureApiUrl(ref, variant)':
@@ -656,7 +666,7 @@ export const DECLARED_OUTBOUND_CALLS: Record<string, OutboundCallDeclaration> =
   },
   "packages/peach-engine/src/settings/persistence.ts :: fetch :: '/__sootsim/shared-config'":
     { category: 'same_origin_runtime', count: 1 },
-  'packages/peachsim/cli/app-fonts.ts :: fetch :: `${origin}/`': {
+  'packages/peachsim/src/metro-project-root.ts :: fetch :: `${origin}/`': {
     category: 'local_development',
     count: 1,
   },
@@ -789,7 +799,7 @@ export const DECLARED_OUTBOUND_CALLS: Record<string, OutboundCallDeclaration> =
   },
   'packages/peach-engine/src/components/native-ui/ShareSheetView.tsx :: fetch-alias :: `/__fetch-proxy?url=${encodeURIComponent()}`':
     { category: 'guest_app_network', count: 1 },
-  'packages/peachsim/src/dev-bundle-resolution.ts :: fetch :: `/__fetch-proxy?url=${encodeURIComponent()}`':
+  'packages/peachsim/src/dev-bundle-resolution.ts :: fetch :: `${pageOrigin}/__fetch-proxy?url=${encodeURIComponent()}`':
     { category: 'guest_app_network', count: 1 },
   'packages/peachsim/src/dev-bundle-resolution.ts :: fetch :: targetUrl': {
     category: 'guest_app_network',
@@ -837,7 +847,7 @@ export const DECLARED_OUTBOUND_CALLS: Record<string, OutboundCallDeclaration> =
     category: 'guest_app_network',
     count: 1,
   },
-  'packages/peachsim/cli/app-fonts.ts :: fetch :: `${origin}/status`': {
+  'packages/peachsim/src/metro-project-root.ts :: fetch :: `${origin}/status`': {
     category: 'local_development',
     count: 1,
   },