peachsim 0.1.1644 → 0.1.1653

package/cli/commands/upload.ts

@@ -1,3 +1,5 @@
+import { createHash, randomUUID } from 'crypto'
+import { readFileSync, rmSync } from 'fs'
 // peach record upload — publish a recording from a running simulator. scene
 // recordings carry their own content identity; --live-bundle adds the app
 // bundle for interactive playback under the existing bundle identity.
@@ -7,44 +9,19 @@
 // owner turns on Public link from the preview page's share menu. uploads
 // require a signed-in desktop session or an api key so the share is
 // associated with the user's account.
-
-import { createHash, randomUUID } from 'crypto'
-import { readFileSync, rmSync } from 'fs'
 import { tmpdir } from 'os'
 import path from 'path'
 import { gzipSync, gunzipSync } from 'zlib'
 import { readProfileTrace } from '@peach/globals/profile-trace'
 import { toProfileFile, type ProfileFile } from '@peach/globals/profiler'
-import { resolveAppFontsWire } from 'peach-engine/engine/config-plugin-fonts'
-import { shouldCompress } from 'peach-engine/preview/compress'
-import { brotliBundle } from 'peach-engine/preview/compress-node'
-import {
-  canonicalPublicPreviewOrigin,
-  runPresignedUpload,
-  type InitRequestBody,
-} from 'peach-engine/preview/presigned-upload'
-import {
-  hasShareableStorage,
-  type ShareableStorageSnapshot,
-} from 'peach-engine/preview/storage-snapshot-contract'
-import {
-  TRACE_CAPTURE_POSTROLL_MS,
-  TRACE_CAPTURE_PREROLL_MS,
-  isTraceTimelineEvent,
-  parseTraceTimelineJsonl,
-} from 'peach-engine/preview/trace'
-import {
-  mergeProfileTimeline,
-  profileFrameSummary,
-} from 'peach-engine/profiler/profile-trace'
-import { readSceneRecordingUpload } from 'peach-engine/remote-stream/scene-recording'
-import {
-  resolvedExpoAppIconUrl,
-  expoConfigFromManifest,
-} from '../../../peach-engine/src/engine/expo-manifest'
 import { loopbackOriginOf } from '../../src/backend-origin'
+import { getCliRuntime } from '../../src/cli-runtime.ts'
 import { parseExpoManifestBody } from '../../src/expo-manifest-body'
 import { rnxPublicBrand } from '../../src/public-brand'
+import {
+  hasShareableStorage,
+  ShareableStorageSnapshot,
+} from '../../src/storageSnapshotContract.ts'
 import { fetchAppFontFiles } from '../app-fonts'
 import { fetchAppSplashImages } from '../app-splash'
 import { authHeaderValue, githubUploadIdentity, resolveCliAuth } from '../auth'
@@ -59,8 +36,9 @@ import {
   evalInBridge,
   parseBridgeCliArgs,
 } from '../ws-bridge'
+import type { BundleSnapshot } from '#peach-cli-contract/preview/capture-bundle'
+import type { InitRequestBody } from '#peach-cli-contract/preview/presigned-upload'
 import type { SootSimTimelineEvent } from '@peach/globals'
-import type { BundleSnapshot } from 'peach-engine/preview/capture-bundle'
 
 interface UploadOptions {
   port?: number
@@ -375,9 +353,13 @@ function traceTimelineQuery(args: {
 }): { since?: number; until?: number; limit: number } {
   if (args.recordedDurationMs && args.recordingStartedAtMs) {
     return {
-      since: args.recordingStartedAtMs - TRACE_CAPTURE_PREROLL_MS,
+      since:
+        args.recordingStartedAtMs -
+        getCliRuntime().preview_trace.TRACE_CAPTURE_PREROLL_MS,
       until:
-        args.recordingStartedAtMs + args.recordedDurationMs + TRACE_CAPTURE_POSTROLL_MS,
+        args.recordingStartedAtMs +
+        args.recordedDurationMs +
+        getCliRuntime().preview_trace.TRACE_CAPTURE_POSTROLL_MS,
       limit: 2000,
     }
   }
@@ -388,7 +370,7 @@ function readTraceTimelineEventsFile(filePath: string): SootSimTimelineEvent[] {
   const bytes = readFileSync(filePath)
   const isGzip = bytes[0] === 0x1f && bytes[1] === 0x8b
   const text = (isGzip ? gunzipSync(bytes) : bytes).toString('utf8')
-  return parseTraceTimelineJsonl(text)
+  return getCliRuntime().preview_trace.parseTraceTimelineJsonl(text)
 }
 
 async function readTraceProfileFile(filePath: string): Promise<ProfileFile> {
@@ -693,14 +675,17 @@ export async function runUpload(
       : []
     traceTimelineEvents = [
       ...traceTimelineEvents,
-      ...timelineEvents.filter(isTraceTimelineEvent),
+      ...timelineEvents.filter(getCliRuntime().preview_trace.isTraceTimelineEvent),
     ].sort((a, b) => a.t - b.t || a.seq - b.seq)
   } finally {
     bridge.close()
   }
 
   if (traceProfile)
-    traceTimelineEvents = mergeProfileTimeline(traceTimelineEvents, traceProfile)
+    traceTimelineEvents = getCliRuntime().profiler_profile_trace.mergeProfileTimeline(
+      traceTimelineEvents,
+      traceProfile,
+    )
 
   if (!snapshot) {
     console.error(
@@ -881,7 +866,10 @@ export async function runUpload(
   let sceneStream: InitRequestBody['sceneStream']
   if (scenePath) {
     sceneBytes = readFileSync(scenePath)
-    const { header, slot } = await readSceneRecordingUpload(sceneBytes)
+    const { header, slot } =
+      await getCliRuntime().remote_stream_scene_recording.readSceneRecordingUpload(
+        sceneBytes,
+      )
     sceneStream = slot
     console.log(
       `  attaching scene stream: ${(sceneBytes.byteLength / 1024).toFixed(1)} KiB, ${header.frameCount} frames over ${Math.round(header.durationMs)}ms`,
@@ -949,7 +937,7 @@ export async function runUpload(
     responseHeaders?: Array<{ name: string; value: string }>,
     requestVaryHash?: string,
   ): PreparedFile => {
-    const compress = shouldCompress(contentType)
+    const compress = getCliRuntime().preview_compress.shouldCompress(contentType)
     const bytes = compress ? gzipSync(raw) : raw
     return {
       url,
@@ -972,7 +960,10 @@ export async function runUpload(
   // pipelines store identical bytes keyed by sha256(url).
   const appFontFiles: PreparedFile[] = []
   const appFontsWire = hasBundle
-    ? await resolveAppFontsWire(appFontsWireFromPageHref(snapshot.pageHref), fetch)
+    ? await getCliRuntime().engine_config_plugin_fonts.resolveAppFontsWire(
+        appFontsWireFromPageHref(snapshot.pageHref),
+        fetch,
+      )
     : ''
   if (appFontsWire) {
     const fonts = await fetchAppFontFiles(appFontsWire, {
@@ -1043,7 +1034,7 @@ export async function runUpload(
     })
     if (response.ok && !response.headers.get('content-type')?.includes('html')) {
       const manifest: unknown = parseExpoManifestBody(await response.text())
-      const config = expoConfigFromManifest(manifest)
+      const config = getCliRuntime().engine_expo_manifest.expoConfigFromManifest(manifest)
       if (config) {
         appManifest = manifestUrl
         appIdentityFiles.push(
@@ -1056,7 +1047,11 @@ export async function runUpload(
             'application/json',
           ),
         )
-        const iconUrl = resolvedExpoAppIconUrl(config, platform, snapshot.bundleUrl)
+        const iconUrl = getCliRuntime().engine_expo_manifest.resolvedExpoAppIconUrl(
+          config,
+          platform,
+          snapshot.bundleUrl,
+        )
         if (iconUrl) {
           try {
             const icon = await fetch(iconUrl, { signal: AbortSignal.timeout(30_000) })
@@ -1116,7 +1111,9 @@ export async function runUpload(
   // brotli source bytes for the upload. finalize verifies the source hash,
   // minifies in the node build container, and stores one canonical brotli
   // bundle. assets stay gzip below.
-  const bundleBr = bundleBytes ? brotliBundle(bundleBytes) : undefined
+  const bundleBr = bundleBytes
+    ? getCliRuntime().preview_compress_node.brotliBundle(bundleBytes)
+    : undefined
   const identityBytes = bundleBytes ?? sceneBytes
   if (!identityBytes) throw new Error('upload requires a bundle or scene recording')
   const contentHash = createHash('sha256').update(identityBytes).digest('hex')
@@ -1181,7 +1178,9 @@ export async function runUpload(
     storage: storageGz
       ? { sizeBytes: storageGz.byteLength, encoding: 'gzip' }
       : undefined,
-    traceFrameStats: traceProfile ? profileFrameSummary(traceProfile) : undefined,
+    traceFrameStats: traceProfile
+      ? getCliRuntime().profiler_profile_trace.profileFrameSummary(traceProfile)
+      : undefined,
     recordedDurationMs,
     recordingStartedAtMs,
     capture,
@@ -1250,7 +1249,7 @@ export async function runUpload(
 
   let finalize
   try {
-    const result = await runPresignedUpload({
+    const result = await getCliRuntime().preview_presigned_upload.runPresignedUpload({
       originBase: origin,
       initBody,
       bundleBytes: bundleBr,
@@ -1308,7 +1307,7 @@ export async function runUpload(
     peachExit(1, message)
   }
 
-  const previewUrl = `${canonicalPublicPreviewOrigin(publicOrigin)}${finalize.url}`
+  const previewUrl = `${getCliRuntime().preview_presigned_upload.canonicalPublicPreviewOrigin(publicOrigin)}${finalize.url}`
   console.log(`\n  stored ${finalize.filesStored ?? 0} extra files`)
   console.log(`  preview: ${previewUrl}`)
 

package/cli/current-sim.ts

@@ -191,6 +191,7 @@ export function readCurrentTarget(): LocalCurrentTarget | null {
       rmSync(filepath, { force: true })
       return null
     }
+    if (Reflect.get(parsed, 'pendingOpen') === true) return null
     const version = Reflect.get(parsed, 'version')
     const plane = Reflect.get(parsed, 'plane')
     const simId = Reflect.get(parsed, 'simId')
@@ -241,3 +242,40 @@ export function saveCurrentSimId(simId: string) {
 export function clearCurrentSimId() {
   rmSync(getCurrentSimPath(), { force: true })
 }
+
+// `peach open` has started choosing a new target and none is pinned yet. the
+// mark holds until a successful open/use pins a sim or the pin is cleared, so
+// a failed open cannot hand later mutating commands to whichever other tab the
+// bridge happens to hold.
+export function markOpenPending() {
+  writeSecureJsonAtomic(getCurrentSimPath(), {
+    version: CURRENT_SIM_VERSION,
+    plane: 'local',
+    pendingOpen: true,
+    updatedAt: new Date().toISOString(),
+  })
+}
+
+// refuses a command that would choose its own sim while an open is pending.
+// callers pass it only for commands with no sim the user named.
+export function assertNoPendingOpen() {
+  if (!isOpenPending()) return
+  throw new Error(
+    'the last `peach open` did not pin a sim, so this command would land on whichever tab is connected. run `peach open` again, `peach use <sim>`, or pass --sim <id>',
+  )
+}
+
+function isOpenPending(): boolean {
+  const filepath = getCurrentSimPath()
+  if (!existsSync(filepath)) return false
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(filepath, 'utf8'))
+    return (
+      parsed !== null &&
+      typeof parsed === 'object' &&
+      Reflect.get(parsed, 'pendingOpen') === true
+    )
+  } catch {
+    return false
+  }
+}

package/cli/desktop-companion.ts

@@ -134,12 +134,15 @@ function retiredElectronApps(): string[] {
 }
 
 // existing Electron apps stay on disk; CLI users receive the migration once.
-// the notice names those apps and does not reject a native host beside them.
+// the notice names those apps and does not reject a native host beside them;
+// it recommends installing only when no native host is selected and present.
 export function notifyDesktopMigration(): void {
   if (process.platform !== 'darwin' && process.platform !== 'linux') return
   const legacy = retiredElectronApps()
   const marker = join(rnxHomeDir(), 'electron-native-migration')
   if (legacy.length === 0 || existsSync(marker)) return
+  const nativeApp = nativeDesktopOverrideError() ? null : getNativeDesktopAppPath()
+  const nativeReady = nativeApp !== null && existsSync(nativeExecutable(nativeApp))
   mkdirSync(rnxHomeDir(), { recursive: true })
   try {
     writeFileSync(marker, '', { flag: 'wx' })
@@ -148,7 +151,10 @@ export function notifyDesktopMigration(): void {
     throw error
   }
   console.error(
-    `  Electron has retired on Mac and Linux (${legacy.join(', ')}). Install the native app: peach desktop install`,
+    `  Electron has retired on Mac and Linux (${legacy.join(', ')}). ` +
+      (nativeReady
+        ? `The native app at ${nativeApp} is in use.`
+        : 'Install the native app: peach desktop install'),
   )
 }
 
@@ -198,7 +204,21 @@ export function nativeDesktopIsDefault(): boolean {
   )
 }
 
+// why PEACH_DESKTOP_APP cannot select a host; launch rejects it, the installer
+// and the migration notice do not use it
+function nativeDesktopOverrideError(): string | null {
+  const explicitApp = process.env.PEACH_DESKTOP_APP
+  if (!explicitApp) return null
+  if (process.platform === 'darwin' && !explicitApp.endsWith('.app'))
+    return 'PEACH_DESKTOP_APP must name a Mac .app bundle'
+  if (process.platform !== 'darwin' && process.platform !== 'linux')
+    return 'native desktop requires macOS or Linux'
+  return null
+}
+
 export function getNativeDesktopAppPath(): string | null {
+  const overrideError = nativeDesktopOverrideError()
+  if (overrideError) throw new Error(overrideError)
   const explicitApp = process.env.PEACH_DESKTOP_APP
   if (!explicitApp)
     return process.platform === 'linux'
@@ -206,18 +226,20 @@ export function getNativeDesktopAppPath(): string | null {
         ? '/usr/bin/peach-desktop'
         : null
       : activeDesktopHostApp()
-  if (process.platform === 'darwin' && !explicitApp.endsWith('.app'))
-    throw new Error('PEACH_DESKTOP_APP must name a Mac .app bundle')
-  if (process.platform !== 'darwin' && process.platform !== 'linux')
-    throw new Error('native desktop requires macOS or Linux')
   return resolve(explicitApp)
 }
 
+function nativeExecutable(appPath: string): string {
+  return process.platform === 'darwin'
+    ? join(appPath, 'Contents/MacOS/PeachDesktop')
+    : appPath
+}
+
 function findNativeDesktopCompanion(): DesktopCompanionInstall | null {
   const appPath = getNativeDesktopAppPath()
   if (!appPath) return null
   const mac = process.platform === 'darwin'
-  if (!existsSync(mac ? join(appPath, 'Contents/MacOS/PeachDesktop') : appPath)) {
+  if (!existsSync(nativeExecutable(appPath))) {
     throw new Error(
       `native desktop executable missing in ${appPath}${mac ? ' (run `peach desktop install --native --force`)' : ''}`,
     )
@@ -394,6 +416,7 @@ export async function launchDesktopCompanion(
   if (opts.ownerPid && opts.ownerPid > 1) extraArgs.push(`--owner-pid=${opts.ownerPid}`)
 
   if (install.kind === 'native-mac-app') {
+    const explicitApp = Boolean(process.env.PEACH_DESKTOP_APP)
     const launchUrl =
       url ||
       opts.profileId ||
@@ -404,6 +427,7 @@ export async function launchDesktopCompanion(
         ? buildMacLaunchUrl(url, opts, true)
         : ''
     if (
+      !explicitApp &&
       opts.bridgePort &&
       launchUrl &&
       (await openInConnectedMacApp(opts.bridgePort, launchUrl))
@@ -413,7 +437,11 @@ export async function launchDesktopCompanion(
     // `open -n -a` spawns an instance bound to this caller's PEACH_HOME and
     // bridge port rather than handing the URL to another session's running
     // PeachDesktop process; subsequent opens on the same bridge reuse that
-    // instance via openInConnectedMacApp above.
+    // instance via openInConnectedMacApp above unless a build is explicitly selected.
+    // a connected host cannot establish the selected build or its launch preferences.
+    if (explicitApp) {
+      extraArgs.push('-SUEnableAutomaticChecks', 'NO', '-SUAutomaticallyUpdate', 'NO')
+    }
     extraArgs.push('--no-personal-home')
     // a CLI launch builds its windows from its own args: skip appkit's restore of a prior
     // crashed session, whose reopen alert blocks boot, without clearing the saved state

package/cli/device-option.ts

@@ -1,4 +1,4 @@
-import { devices, listSelectableDeviceModels } from 'peach-engine/settings/devices'
+import { devices, listSelectableDeviceModels } from '../src/device-catalog.ts'
 
 export function validateDeviceOption(device: string | undefined): boolean {
   if (!device || device in devices) return true

package/cli/drivers/playwright.ts

@@ -274,6 +274,7 @@ async function launch(opts: DriverLaunchOptions): Promise<DriverLaunchResult> {
       launched: true,
       message: `playwright ${hostCommand ? 'native host' : 'Chromium'} launched → ${targetUrl.href}${ownerNote}`,
       pid: child.pid,
+      process: child,
       target: resolved.spec,
       attachUrl: targetUrl.href,
       connectAckFile,

package/cli/drivers/types.ts

@@ -2,6 +2,8 @@
 // playwright-owned profile. desktop launches the native host; electron the
 // Electron companion.
 
+import type { ChildProcess } from 'node:child_process'
+
 export type DriverId = 'desktop' | 'electron' | 'playwright'
 
 // broad category for grouping / filtering. "native" is a desktop host;
@@ -85,6 +87,8 @@ export interface DriverLaunchResult {
   // expose what makes sense for its environment. pid for spawned processes,
   // `target` for an install path, `attachUrl` for automation drivers.
   pid?: number
+  // the spawned handle, for drivers whose process tree the caller must stop.
+  process?: ChildProcess
   target?: string
   attachUrl?: string
   connectAckFile?: string

package/cli/help-core.ts

@@ -4,11 +4,11 @@ import {
   renderCliGroupHelp,
   renderCliIndexHelp,
 } from '@peach/skills/cli/renderers'
-import { formatFlagHelp } from 'peach-engine/settings/cli-flags'
 import {
   DEFAULT_SOOTSIM_BRIDGE_PORT,
   DEFAULT_SOOTSIM_BRIDGE_URL,
 } from '../src/bridge-constants'
+import { formatFlagHelp } from '../src/settings-flags.ts'
 import {
   getRnxCommandAvailability,
   getRnxFirstPositional,

package/cli/internal-child.ts

@@ -195,7 +195,8 @@ export async function runScript(scriptPath: string, args: string[]): Promise<voi
  *  an absolute path the driver hands it in the environment, launches chrome,
  *  and keeps this process alive until the browser goes away. */
 async function playwrightHost(): Promise<void> {
-  const { PLAYWRIGHT_SIM_HOST } = await import('./drivers/playwright-sim-host')
+  const { getCliRuntime } = await import('../src/cli-runtime')
+  const { PLAYWRIGHT_SIM_HOST } = getCliRuntime().playwright_sim_host
   const run: unknown = vm.runInThisContext(
     `(function(require){${PLAYWRIGHT_SIM_HOST}\n})`,
     { filename: 'rnx-playwright-host.js' },

package/cli/main.ts

@@ -1,9 +1,9 @@
+import { Console } from 'node:console'
 // the peach CLI proper: argv parsing, the one-time privacy choice, and the
 // single lazy-imported command a run dispatches to. `./bin` imports this only
 // when none of its hidden entry points claimed the process.
-
-import { Console } from 'node:console'
 import { automaticPeachUpdatesEnabled } from '../src/automatic-update-policy'
+import { getCliRuntime } from '../src/cli-runtime.ts'
 import { exitWithFlushedOutput } from '../src/process-output'
 import { rnxPublicBrand } from '../src/public-brand'
 import { levenshtein } from './levenshtein'
@@ -330,7 +330,7 @@ if (theme && theme !== 'light' && theme !== 'dark' && theme !== 'auto') {
 
 // apply device/theme to settings store if provided
 if (device || theme) {
-  const { settingsStore } = await import('peach-engine/settings/store')
+  const { settingsStore } = await Promise.resolve(getCliRuntime().settings_store)
   const overrides: Record<string, any> = {}
   if (device) overrides.deviceModel = device
   if (theme) overrides.colorScheme = theme
@@ -708,6 +708,12 @@ try {
         break
       }
 
+      case 'coverage': {
+        const { runCoverage } = await import('./commands/coverage')
+        process.exitCode = await runCoverage(parsed.commandArgs)
+        break
+      }
+
       case 'project-report': {
         const { runProjectReport } = await import('./commands/project-report')
         await exitWithFlush(runProjectReport(parsed.commandArgs))

package/cli/outbound-endpoints.ts

@@ -216,6 +216,14 @@ export const OUTBOUND_ENDPOINTS: Record<string, OutboundEndpointDeclaration> = {
     payload:
       'HTTP GET of a pinned, sha256-checked toolchain file; fires only when the user builds a Kotlin app and the file is not cached',
   },
+  coverage_parser_download: {
+    category: 'explicit-user-action',
+    destination:
+      'https://registry.npmjs.org/@typescript/typescript-<platform>/-/ pinned parser tarball',
+    preConsent: false,
+    payload:
+      'HTTP GET of the pinned, sha512-checked native parser when peach coverage has no matching installed or cached parser; version, platform and architecture only, with no source or project data',
+  },
   linux_browser_libs_download: {
     category: 'runtime-delivery',
     destination:
@@ -658,7 +666,7 @@ export const DECLARED_OUTBOUND_CALLS: Record<string, OutboundCallDeclaration> =
   },
   "packages/peach-engine/src/settings/persistence.ts :: fetch :: '/__sootsim/shared-config'":
     { category: 'same_origin_runtime', count: 1 },
-  'packages/peachsim/cli/app-fonts.ts :: fetch :: `${origin}/`': {
+  'packages/peachsim/src/metro-project-root.ts :: fetch :: `${origin}/`': {
     category: 'local_development',
     count: 1,
   },
@@ -791,7 +799,7 @@ export const DECLARED_OUTBOUND_CALLS: Record<string, OutboundCallDeclaration> =
   },
   'packages/peach-engine/src/components/native-ui/ShareSheetView.tsx :: fetch-alias :: `/__fetch-proxy?url=${encodeURIComponent()}`':
     { category: 'guest_app_network', count: 1 },
-  'packages/peachsim/src/dev-bundle-resolution.ts :: fetch :: `/__fetch-proxy?url=${encodeURIComponent()}`':
+  'packages/peachsim/src/dev-bundle-resolution.ts :: fetch :: `${pageOrigin}/__fetch-proxy?url=${encodeURIComponent()}`':
     { category: 'guest_app_network', count: 1 },
   'packages/peachsim/src/dev-bundle-resolution.ts :: fetch :: targetUrl': {
     category: 'guest_app_network',
@@ -839,7 +847,7 @@ export const DECLARED_OUTBOUND_CALLS: Record<string, OutboundCallDeclaration> =
     category: 'guest_app_network',
     count: 1,
   },
-  'packages/peachsim/cli/app-fonts.ts :: fetch :: `${origin}/status`': {
+  'packages/peachsim/src/metro-project-root.ts :: fetch :: `${origin}/status`': {
     category: 'local_development',
     count: 1,
   },

package/cli/output-redaction.ts

@@ -5,6 +5,7 @@
 
 import { createHash } from 'node:crypto'
 import { format, inspect } from 'node:util'
+import { PEACH_CONFIG_QUERY_PARAM } from '../src/config'
 
 // the commands that print only through this process's console and streams.
 // anything else may hand its output to a child process, which no wrapper here
@@ -45,7 +46,7 @@ const PAIR = new RegExp(
   'g',
 )
 const STRING_TOKEN = new RegExp(STRING, 'g')
-const QUERY_PAIR = /([?&;]([\w.%-]+)=)([^&#\s"']+)/g
+const QUERY_PAIR = /([?&;]([\w.%-]+)=)([^&#\s"'\\]+)/g
 const HEADER_LINE = /^(\s*([\w-]+)\s*:\s+)(\S.*)$/gm
 const MASKED = /^<redacted:[0-9a-f]{4}>$/
 
@@ -63,10 +64,10 @@ function maskQuoted(quoted: string): string {
 // a string can carry a document of its own: json escaped inside a json string,
 // or json inside a js string. its decoded contents are redacted and encoded
 // back the same way; each level is shorter, so this ends.
-function redactString(quoted: string): string {
+function redactString(quoted: string, configurationOnly: boolean): string {
   if (quoted.startsWith("'")) {
     const inner = quoted.slice(1, -1)
-    const redacted = redactForSharing(inner)
+    const redacted = redactText(inner, configurationOnly)
     return redacted === inner ? quoted : `'${redacted}'`
   }
   let decoded: string
@@ -75,7 +76,7 @@ function redactString(quoted: string): string {
   } catch {
     decoded = quoted.slice(1, -1).replace(/\\(["\\/])/g, '$1')
   }
-  const redacted = redactForSharing(decoded)
+  const redacted = redactText(decoded, configurationOnly)
   return redacted === decoded ? quoted : JSON.stringify(redacted)
 }
 
@@ -95,33 +96,57 @@ function redactPair(
   quotedName: string | undefined,
   bareName: string,
   value: string,
+  configurationOnly: boolean,
 ): string {
-  if (!SECRET_NAME.test(quotedName ?? bareName)) {
+  const name = quotedName ?? bareName
+  if (name === PEACH_CONFIG_QUERY_PARAM) return `${prefix}"[redacted]"`
+  if (configurationOnly || !SECRET_NAME.test(name)) {
     if (!/^["'[]/.test(value)) return pair
     const inner = value.startsWith('[')
-      ? value.replace(STRING_TOKEN, redactString)
-      : redactString(value)
+      ? value.replace(STRING_TOKEN, (quoted) => redactString(quoted, configurationOnly))
+      : redactString(value, configurationOnly)
     return inner === value ? pair : `${prefix}${inner}`
   }
   if (value.startsWith('[')) return `${prefix}${value.replace(STRING_TOKEN, maskQuoted)}`
   return `${prefix}${/^["']/.test(value) ? maskQuoted(value) : `"${mask(value)}"`}`
 }
 
+// configuration is always private, including arbitrary env names. share the
+// string/query traversal with optional account redaction so nested encodings
+// receive the same policy before persistence and when printing launch urls.
+export function redactConfigurationForDiagnostics(text: string): string {
+  return redactText(text, true)
+}
+
 export function redactForSharing(text: string): string {
-  return text
-    .replace(JWT, mask)
-    .replace(GOOGLE_API_KEY, mask)
-    .replace(BEARER, (match, scheme: string) => `${scheme} ${mask(match)}`)
-    .replace(PAIR, redactPair)
+  return redactText(text, false)
+}
+
+function redactText(text: string, configurationOnly: boolean): string {
+  if (!configurationOnly) {
+    text = text
+      .replace(JWT, mask)
+      .replace(GOOGLE_API_KEY, mask)
+      .replace(BEARER, (match, scheme: string) => `${scheme} ${mask(match)}`)
+  }
+  const redacted = text
+    .replace(PAIR, (pair, prefix, quotedName, bareName, value) =>
+      redactPair(pair, prefix, quotedName, bareName, value, configurationOnly),
+    )
     .replace(QUERY_PAIR, (pair, prefix: string, name: string, value: string) => {
-      if (SECRET_NAME.test(decodeOrSelf(name))) return `${prefix}${mask(value)}`
+      const decodedName = decodeOrSelf(name)
+      if (decodedName === PEACH_CONFIG_QUERY_PARAM) return `${prefix}%5Bredacted%5D`
+      if (!configurationOnly && SECRET_NAME.test(decodedName))
+        return `${prefix}${mask(value)}`
       // a launch url can carry a whole config object, or another url with its
       // own query, as one encoded value; each decode is shorter, so this ends.
       if (!/%[0-9a-f]{2}/i.test(value)) return pair
       const decoded = decodeOrSelf(value)
-      const redacted = redactForSharing(decoded)
+      const redacted = redactText(decoded, configurationOnly)
       return redacted === decoded ? pair : `${prefix}${encodeURIComponent(redacted)}`
     })
+  if (configurationOnly) return redacted
+  return redacted
     .replace(HEADER_LINE, (line, prefix: string, name: string, value: string) =>
       SECRET_NAME.test(name) ? `${prefix}${mask(value)}` : line,
     )

package/cli/remote-simulators.ts

@@ -106,7 +106,10 @@ export async function stopAccountRemoteSimulator(
   })
   await deleteCloudBox({
     connectUrl: cloudBoxConnectUrl(reference.endpoint, reference.boxId),
-    accessToken: account.authorization.replace(/^Bearer /, ''),
+    authority: {
+      kind: 'account',
+      credential: account.authorization.replace(/^Bearer /, ''),
+    },
   })
   return { simId: sim.simId }
 }

package/cli/scene-video.ts

@@ -1,7 +1,7 @@
 import { writeFile } from 'node:fs/promises'
 import { createRequire } from 'node:module'
-import { readSceneRecordingUpload } from 'peach-engine/remote-stream/scene-recording'
 import { launchReapedChrome } from '../../../scripts/lib/reap-browser'
+import { getCliRuntime } from '../src/cli-runtime.ts'
 import {
   ensurePlaywrightBrowser,
   provisionPlaywright,
@@ -19,7 +19,10 @@ export async function renderSceneToVideo(options: {
   renderTimeMs: number
   sizeBytes: number
 }> {
-  const { header } = await readSceneRecordingUpload(options.scene)
+  const { header } =
+    await getCliRuntime().remote_stream_scene_recording.readSceneRecordingUpload(
+      options.scene,
+    )
   const resolved = await provisionPlaywright()
   const installed = await ensurePlaywrightBrowser(resolved, true)
   if (!installed.ok) throw new Error(installed.message)