peachsim 0.1.668 → 0.1.670

package/cli/commands/control.ts

@@ -92,6 +92,7 @@ import {
 } from '../ws-bridge'
 import { inspectDescribe, inspectReadySnapshot, waitReadyReason } from './inspect/core'
 import { isAgentEnv } from './inspect/env'
+import { hasInstalledPeachSkills } from './skills'
 import type { DriverId, DriverLaunchResult } from '../drivers/types'
 
 interface ControlCommandOptions {
@@ -1329,9 +1330,11 @@ export function printOpenedSim(
   console.log(JSON.stringify({ simId: sim.id, url: printableSimUrl }, null, 2))
 }
 
-function printAgentListenHint(quiet: boolean): void {
-  if (!quiet) {
-    console.log('  inspect messages: run `peach agent listen` when you finish your turn')
+function printAgentHints(quiet: boolean): void {
+  if (quiet) return
+  console.log('  inspect messages: run `peach agent listen` when you finish your turn')
+  if (!hasInstalledPeachSkills()) {
+    console.log('  driving peach from an agent? `peach skill install` adds its workflows')
   }
 }
 
@@ -1968,7 +1971,7 @@ export async function runOpenCommand(
           quiet,
         )
         await maybeDescribeAfterOpen(parsed.wsPort, targetSim.id, args)
-        printAgentListenHint(quiet)
+        printAgentHints(quiet)
         return { simId: targetSim.id, launched: false }
       }
     } finally {
@@ -2055,7 +2058,7 @@ export async function runOpenCommand(
   signalDriverLaunchConnected(result)
   printOpenedSim(openUrl, match, `${driver.name} driver`, quiet)
   await maybeDescribeAfterOpen(parsed.wsPort, match.id, args)
-  printAgentListenHint(quiet)
+  printAgentHints(quiet)
   return { simId: match.id, launched: true }
 }
 

package/cli/commands/inspect/core.ts

@@ -40,12 +40,14 @@ import type {
 } from '@peach/globals'
 import type { KeyboardLayoutSnapshot } from 'peach-engine/render-worker/native-ui-protocol'
 
-// resolve a `--max-ms <n>` flag, tolerating the spellings agents and humans
-// actually type (`--maxMs`, `--maxms`, `--max_ms`). a silently-ignored
-// timeout flag is a sharp edge: the call doesn't error, it just uses the
-// default, so the operator thinks their bound applied when it didn't.
+// resolve a wait's `--max-ms <n>` budget, tolerating the spellings agents and
+// humans actually type (`--maxMs`, `--maxms`, `--max_ms`). `--timeout`, the
+// global per-command budget, means the same thing for a command whose whole
+// job is to wait. a silently-ignored timeout flag is a sharp edge: the call
+// doesn't error, it just uses the default, so the operator thinks their bound
+// applied when it didn't.
 export function resolveMaxMsFlag(args: string[], fallbackMs: number): number {
-  const aliases = ['--max-ms', '--maxMs', '--maxms', '--max_ms']
+  const aliases = ['--max-ms', '--maxMs', '--maxms', '--max_ms', '--timeout']
   for (const flag of aliases) {
     const i = args.indexOf(flag)
     if (i >= 0 && args[i + 1]) {

package/cli/commands/inspect/wait-selector.ts

@@ -1,5 +1,5 @@
 import { rnxExit } from '../../run-rnx'
-import { inspectWaitSelector } from './core'
+import { inspectWaitSelector, resolveMaxMsFlag } from './core'
 import type { WsBridge } from '../../ws-bridge'
 
 // blocks until a node with the given testID is visible and laid out, or — with
@@ -27,16 +27,7 @@ export async function runWaitSelectorSubcommand(opts: {
     rnxExit(1)
   }
   const testId = rawTestId.replace(/^#/, '')
-  // the wait budget. `--max-ms` names it, and `--timeout` (the global
-  // per-command budget) means the same thing for a command whose whole job is
-  // to wait — without this it parsed away and the wait silently stayed at 5s,
-  // reporting a false timeout.
-  const maxMsIdx = args.indexOf('--max-ms')
-  const budgetIdx = maxMsIdx >= 0 ? maxMsIdx : args.indexOf('--timeout')
-  const timeoutMs =
-    budgetIdx >= 0 && args[budgetIdx + 1]
-      ? Math.max(100, Number(args[budgetIdx + 1]))
-      : 5000
+  const timeoutMs = resolveMaxMsFlag(args, 5000)
   const gone = args.includes('--gone')
   const structural = args.includes('--structural')
 

package/cli/commands/inspect.ts

@@ -2003,10 +2003,15 @@ export async function runInspect(args: string[], opts: InspectOptions) {
         break
       }
 
+      // `tap-id` is `tap` with an exact testID, so a numeric id stays an id.
+      case 'tap-id':
       case 'tap': {
         let x = Number(positional[1])
         let y = Number(positional[2])
-        const target = readTargetFlag(args, positional)
+        const target =
+          subcommand === 'tap-id'
+            ? readTargetFlag(['--testid', positional[1] ?? ''])
+            : readTargetFlag(args, positional)
         if (target) {
           const outcome = await tapResolvedTarget(bridge, {
             agent: isAgentEnv(),
@@ -2460,64 +2465,6 @@ export async function runInspect(args: string[], opts: InspectOptions) {
         break
       }
 
-      case 'tap-id': {
-        const query = positional[1]
-        if (!query) {
-          console.error(inspectUsage('tap-id', '<id>'))
-          rnxExit(1)
-        }
-
-        const outcome = await tapById(bridge, query, { agent: isAgentEnv() })
-        const payload = outcome.payload
-        if (!payload || typeof payload.cx !== 'number') {
-          console.error(`  not found: ${query}`)
-          // when the testID didn't match, fall back to a fuzzy list of
-          // nearby testIDs in the live tree so the agent can pick the
-          // intended one without dumping the whole tree first.
-          await printSimilarTestIds(bridge, query)
-          rnxExit(1)
-        }
-        if (!isTapSuccess(outcome.result)) {
-          printTapFailure(`id "${query}"`, outcome)
-          rnxExit(1)
-        }
-        const candidate = buildTapCandidateFromNode(
-          query,
-          {
-            id: payload.target?.id ?? null,
-            testID: payload.target?.testID ?? null,
-            type: payload.target?.type ?? null,
-            cx: payload.cx,
-            cy: payload.cy,
-          },
-          'id',
-        )
-        await recordInspectAction('inspect tap-id', candidate.step, candidate.summary)
-        console.log(
-          JSON.stringify(
-            {
-              matched: payload.match,
-              tapped: {
-                nodeId: payload.target?.nodeId ?? null,
-                id: payload.target?.id ?? null,
-                testID: payload.target?.testID ?? null,
-                type: payload.target?.type ?? null,
-                cx: payload.cx,
-                cy: payload.cy,
-              },
-              ...(payload.strategy && payload.strategy !== 'matched-node'
-                ? { strategy: payload.strategy }
-                : {}),
-              ...(outcome.attempts > 1 ? { attempts: outcome.attempts } : {}),
-              result: outcome.result,
-            },
-            null,
-            2,
-          ),
-        )
-        break
-      }
-
       case 'type-into': {
         const targetId = positional[1]
         const text = positional.slice(2).join(' ')

package/cli/commands/kotlin.ts

@@ -6,7 +6,7 @@ import { WebSocket, WebSocketServer } from 'ws'
 import { kotlinGuestBundle } from '../../src/guest-bundle'
 import {
   readKotlinApp,
-  type ComposeAndroidPins,
+  type AndroidPins,
   type KotlinAppProject,
 } from '../../src/kotlin-app'
 import { PeachExit } from '../run-rnx'
@@ -19,7 +19,7 @@ const HMR_PATH = '/__peach/kotlin-hmr'
 // and in the built CLI (dist-cli/chunks)
 const MODULE_ROOT = path.resolve(import.meta.dirname, '../../kotlin')
 
-function composePins(): ComposeAndroidPins {
+function androidPins(): AndroidPins {
   const toolchain: unknown = JSON.parse(
     fs.readFileSync(path.join(MODULE_ROOT, 'toolchain.json'), 'utf8'),
   )
@@ -30,7 +30,7 @@ function composePins(): ComposeAndroidPins {
   const pin = (name: string) => {
     const value: unknown = android ? Reflect.get(android, name) : undefined
     if (typeof value !== 'string')
-      throw new Error(`Kotlin toolchain has no Compose ${name} pin`)
+      throw new Error(`Kotlin toolchain has no Android ${name} pin`)
     return value
   }
   return {
@@ -38,6 +38,8 @@ function composePins(): ComposeAndroidPins {
     foundation: pin('foundation'),
     runtime: pin('runtime'),
     material3: pin('material3'),
+    navigation: pin('navigation'),
+    activity: pin('activity'),
   }
 }
 
@@ -91,7 +93,7 @@ export async function runKotlin(
     throw new Error(
       `peach kotlin runs an Android app; ${device} is not an Android device`,
     )
-  const pins = composePins()
+  const pins = androidPins()
   let project: KotlinAppProject = readKotlinApp(modulePath, { activity, pins })
   const host = await import('../../src/kotlin-host')
   const controller = new AbortController()

package/cli/commands/skills.ts

@@ -40,7 +40,13 @@ function getSkillsDir(): string {
   }
 }
 
-const SKILLS_DIR = getSkillsDir()
+// resolved on first use: the standalone binary writes its skills when the
+// directory is resolved, and importing this module must never touch disk.
+let skillsDirPath: string | undefined
+function skillsDir(): string {
+  skillsDirPath ??= getSkillsDir()
+  return skillsDirPath
+}
 const AGENT_TARGET_IDS = new Set(['all', 'codex', 'claude'])
 
 interface SkillInfo {
@@ -109,6 +115,21 @@ function defaultAgentTargets(): InstallTarget[] {
   ]
 }
 
+// whether any bundled skill is installed in a default agent skills directory.
+// reads the names without materializing the binary's skills, so a command
+// that only prints a hint writes nothing.
+export function hasInstalledPeachSkills(): boolean {
+  const names =
+    typeof __PEACH_BUNDLED_SKILLS__ !== 'undefined'
+      ? Object.keys(__PEACH_BUNDLED_SKILLS__).flatMap(
+          (file) => /^([^/]+)\/SKILL\.md$/.exec(file)?.[1] ?? [],
+        )
+      : listSkills().map((skill) => skill.name)
+  return defaultAgentTargets().some(({ dir }) =>
+    names.some((name) => fs.existsSync(path.join(dir, name, 'SKILL.md'))),
+  )
+}
+
 function agentTarget(target: string): InstallTarget[] {
   if (target === 'all') return defaultAgentTargets()
   if (target === 'codex') {
@@ -173,10 +194,10 @@ function readFrontmatterField(frontmatter: string, field: string): string | null
 // bundled skills live in the standard agent layout: skills/<name>/SKILL.md.
 // the directory name is the skill name; frontmatter is the display metadata.
 function listSkills(): SkillInfo[] {
-  if (!fs.existsSync(SKILLS_DIR)) return []
+  if (!fs.existsSync(skillsDir())) return []
   const skills: SkillInfo[] = []
-  for (const entry of fs.readdirSync(SKILLS_DIR)) {
-    const skillMd = path.join(SKILLS_DIR, entry, 'SKILL.md')
+  for (const entry of fs.readdirSync(skillsDir())) {
+    const skillMd = path.join(skillsDir(), entry, 'SKILL.md')
     if (!fs.existsSync(skillMd)) continue
     const meta = parseSkillFrontmatter(fs.readFileSync(skillMd, 'utf8'))
     if (meta) {
@@ -266,7 +287,7 @@ function isOwnLegacyInstall(stat: fs.Stats, dest: string, srcDir: string): boole
 }
 
 function linkSkill(skill: SkillInfo, targetDir: string, force: boolean): LinkResult {
-  const src = path.join(SKILLS_DIR, skill.name)
+  const src = path.join(skillsDir(), skill.name)
   const dest = path.join(targetDir, skill.name)
   fs.mkdirSync(targetDir, { recursive: true })
 
@@ -306,7 +327,7 @@ function removeLegacyBundledSkills(targetDir: string) {
     if (!stat) continue
     if (
       stat.isSymbolicLink() ||
-      isOwnLegacyInstall(stat, dest, path.join(SKILLS_DIR, name))
+      isOwnLegacyInstall(stat, dest, path.join(skillsDir(), name))
     ) {
       fs.rmSync(dest, { recursive: true, force: true })
     }
@@ -435,7 +456,7 @@ function runShow(args: string[]) {
     return
   }
   const [skill] = matchSkills(skills, [name])
-  const content = fs.readFileSync(path.join(SKILLS_DIR, skill.name, 'SKILL.md'), 'utf8')
+  const content = fs.readFileSync(path.join(skillsDir(), skill.name, 'SKILL.md'), 'utf8')
   console.log(content)
 }
 

package/cli/commands/upgrade.ts

@@ -15,17 +15,21 @@ import {
   fetchCliReleaseFile,
   refreshCliUpdateCache,
 } from '../cli-update'
+import { rnxExit } from '../run-rnx'
 import { fetchRuntimeReleaseNotes, formatRuntimeReleaseNotes } from '../runtime-notes'
 import { IS_STANDALONE } from '../standalone'
 import { runRuntime } from './runtime'
 
 const SHA256_PATTERN = /^[a-f0-9]{64}$/
+const VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[\w.]+)?$/
 
 export interface UpgradeOptions {
   cliExecutablePath?: string
   cliReleaseOrigin?: string
   standalone?: boolean
   includeReleaseNotes?: boolean
+  // install exactly this cli release, newer or older, instead of the latest.
+  cliVersion?: string
 }
 
 export async function runUpgrade(
@@ -35,6 +39,12 @@ export async function runUpgrade(
   const channelIdx = args.indexOf('--channel')
   const channel =
     channelIdx >= 0 && args[channelIdx + 1] ? args[channelIdx + 1] : undefined
+  const toIdx = args.indexOf('--to')
+  const cliVersion = toIdx >= 0 ? args[toIdx + 1]?.replace(/^v/, '') : undefined
+  if (toIdx >= 0 && !(cliVersion && VERSION_PATTERN.test(cliVersion))) {
+    console.error('  peach upgrade: --to takes a CLI version such as 0.1.669')
+    rnxExit(1)
+  }
 
   console.log('peach upgrade\n')
 
@@ -79,7 +89,7 @@ export async function runUpgrade(
       : null
 
   console.log('\ncli:')
-  await upgradeCli(options)
+  await upgradeCli({ ...options, cliVersion })
 
   if (installedRuntime && options.includeReleaseNotes !== false) {
     console.log(`\n${formatRuntimeReleaseNotes(installedRuntime, releaseNotes)}`)
@@ -103,8 +113,13 @@ export async function upgradeCli(options: UpgradeOptions = {}): Promise<void> {
     '',
   )
   const current = getCliVersion()
-  const { latestVersion: latest } = await refreshCliUpdateCache({ releaseOrigin })
-  if (compareSemver(latest, current) <= 0) {
+  const latest =
+    options.cliVersion ?? (await refreshCliUpdateCache({ releaseOrigin })).latestVersion
+  if (options.cliVersion === current) {
+    console.log(`  v${current} (requested)`)
+    return
+  }
+  if (!options.cliVersion && compareSemver(latest, current) <= 0) {
     console.log(`  v${current} (latest)`)
     return
   }

package/cli/main.ts

@@ -74,6 +74,18 @@ process.on('unhandledRejection', handleTopLevelError)
 process.on('uncaughtException', handleTopLevelError)
 
 let parsed = parseArgs(process.argv)
+// `--redact` reads the same before or after the command name, and masks from
+// the first line printed, parser warnings included.
+const redact =
+  parsed.globalFlags['redact'] === true || parsed.commandArgs.includes('--redact')
+if (redact) {
+  parsed = {
+    ...parsed,
+    commandArgs: parsed.commandArgs.filter((arg) => arg !== '--redact'),
+  }
+  const { redactProcessOutput } = await import('./output-redaction')
+  redactProcessOutput()
+}
 for (const warning of parsed.warnings) process.stderr.write(`${warning}\n`)
 
 // runtime actions and reads also work as hidden root aliases. resolve only
@@ -83,6 +95,15 @@ if (!parsed.command && parsed.commandArgs.length > 0) {
   const { resolveHiddenRuntimeAlias } = await import('./hidden-runtime-alias')
   parsed = resolveHiddenRuntimeAlias(parsed)
 }
+if (redact) {
+  const { REDACTABLE_COMMANDS } = await import('./output-redaction')
+  if (!REDACTABLE_COMMANDS.has(parsed.command ?? '')) {
+    process.stderr.write(
+      `  --redact applies to ${[...REDACTABLE_COMMANDS].join(', ')}; this command can print output it cannot mask\n`,
+    )
+    process.exit(1)
+  }
+}
 
 const isAutomaticCleanupWorker =
   parsed.command === 'cleanup' &&

package/cli/output-redaction.ts

@@ -0,0 +1,182 @@
+// `--redact` masks secrets and account identifiers in what a command prints,
+// so logs, network dumps and timelines can be pasted where others read them.
+// each value becomes `<redacted:xxxx>`, a short digest, so one value still
+// matches itself across lines without revealing it.
+
+import { createHash } from 'node:crypto'
+import { format, inspect } from 'node:util'
+
+// the commands that print only through this process's console and streams.
+// anything else may hand its output to a child process, which no wrapper here
+// can see, so it refuses the flag instead of printing secrets it claims to hide.
+export const REDACTABLE_COMMANDS = new Set([
+  'logs',
+  'network',
+  'what-happened',
+  'history',
+  'get',
+])
+
+// names whose values grant access or identify an account, in json, js object
+// output, query strings and headers. operational ids stay readable: a bare
+// `id` addresses `network get <id>`, a sim's `sessionId` names the sim, and a
+// keyboard `key` is the key pressed.
+const SECRET_NAME =
+  /^(?:[\w-]*(?:api[-_]?key|token|secret|password|passwd|authorization|cookie|signature|credential)s?|auth|sig|email|uid|[\w-]*(?:user|account|local|device|installation|client|app|project|sender|measurement|tenant)[-_]?id)$/i
+
+const JWT = /\beyJ[\w-]{6,}\.[\w-]{6,}\.[\w-]{6,}/g
+const GOOGLE_API_KEY = /\bAIza[\w-]{30,}/g
+const BEARER = /\b(Bearer|Basic)\s+[\w.~+/=-]{8,}/gi
+const EMAIL = /\b[\w.+-]+@[\w-]+(?:\.[\w-]+)+\b/g
+// a name and its value: a quoted json name or a bare js object key, then a
+// json or js string, a whole number token, or an array of strings. a string is
+// matched at its own escaping level only; a json document escaped inside it is
+// reached by decoding the string, since escaped quotes cannot show where an
+// escaped value ends.
+const STRING = String.raw`(?:"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*')`
+const NUMBER = String.raw`-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?`
+const PAIR = new RegExp(
+  String.raw`((?:"([\w-]+)"|\b([\w-]+))\s*:\s*)(${STRING}|${NUMBER}\b|\[\s*${STRING}(?:\s*,\s*${STRING})*\s*\])`,
+  'g',
+)
+const STRING_TOKEN = new RegExp(STRING, 'g')
+const QUERY_PAIR = /([?&;]([\w.%-]+)=)([^&#\s"']+)/g
+const HEADER_LINE = /^(\s*([\w-]+)\s*:\s+)(\S.*)$/gm
+const MASKED = /^<redacted:[0-9a-f]{4}>$/
+
+// a value an earlier rule already masked keeps its digest.
+function mask(value: string): string {
+  if (MASKED.test(value)) return value
+  return `<redacted:${createHash('sha256').update(value).digest('hex').slice(0, 4)}>`
+}
+
+// masks a quoted value inside its own quotes, so json stays json.
+function maskQuoted(quoted: string): string {
+  return `${quoted[0]}${mask(quoted.slice(1, -1))}${quoted[0]}`
+}
+
+// a string can carry a document of its own: json escaped inside a json string,
+// or json inside a js string. its decoded contents are redacted and encoded
+// back the same way; each level is shorter, so this ends.
+function redactString(quoted: string): string {
+  if (quoted.startsWith("'")) {
+    const inner = quoted.slice(1, -1)
+    const redacted = redactForSharing(inner)
+    return redacted === inner ? quoted : `'${redacted}'`
+  }
+  let decoded: string
+  try {
+    decoded = JSON.parse(quoted)
+  } catch {
+    decoded = quoted.slice(1, -1).replace(/\\(["\\/])/g, '$1')
+  }
+  const redacted = redactForSharing(decoded)
+  return redacted === decoded ? quoted : JSON.stringify(redacted)
+}
+
+function decodeOrSelf(value: string): string {
+  try {
+    return decodeURIComponent(value)
+  } catch {
+    return value
+  }
+}
+
+// a non-secret string, or each string of a non-secret array, is searched
+// for pairs of its own.
+function redactPair(
+  pair: string,
+  prefix: string,
+  quotedName: string | undefined,
+  bareName: string,
+  value: string,
+): string {
+  if (!SECRET_NAME.test(quotedName ?? bareName)) {
+    if (!/^["'[]/.test(value)) return pair
+    const inner = value.startsWith('[')
+      ? value.replace(STRING_TOKEN, redactString)
+      : redactString(value)
+    return inner === value ? pair : `${prefix}${inner}`
+  }
+  if (value.startsWith('[')) return `${prefix}${value.replace(STRING_TOKEN, maskQuoted)}`
+  return `${prefix}${/^["']/.test(value) ? maskQuoted(value) : `"${mask(value)}"`}`
+}
+
+export function redactForSharing(text: string): string {
+  return text
+    .replace(JWT, mask)
+    .replace(GOOGLE_API_KEY, mask)
+    .replace(BEARER, (match, scheme: string) => `${scheme} ${mask(match)}`)
+    .replace(PAIR, redactPair)
+    .replace(QUERY_PAIR, (pair, prefix: string, name: string, value: string) => {
+      if (SECRET_NAME.test(decodeOrSelf(name))) return `${prefix}${mask(value)}`
+      // a launch url can carry a whole config object, or another url with its
+      // own query, as one encoded value; each decode is shorter, so this ends.
+      if (!/%[0-9a-f]{2}/i.test(value)) return pair
+      const decoded = decodeOrSelf(value)
+      const redacted = redactForSharing(decoded)
+      return redacted === decoded ? pair : `${prefix}${encodeURIComponent(redacted)}`
+    })
+    .replace(HEADER_LINE, (line, prefix: string, name: string, value: string) =>
+      SECRET_NAME.test(name) ? `${prefix}${mask(value)}` : line,
+    )
+    .replace(EMAIL, mask)
+}
+
+const utf8 = new TextDecoder('utf-8', { fatal: true })
+
+// applies to both streams and the console for the rest of the process; bun's
+// console writes without passing through the streams. text is masked a whole
+// line at a time, so a value split across writes is still seen whole; binary
+// output passes through untouched.
+export function redactProcessOutput(): void {
+  for (const stream of [process.stdout, process.stderr]) {
+    const write = stream.write.bind(stream)
+    let pending = ''
+    stream.write = (
+      chunk: string | Uint8Array,
+      encodingOrCallback?: BufferEncoding | ((error?: Error | null) => void),
+      callback?: (error?: Error | null) => void,
+    ): boolean => {
+      const done =
+        typeof encodingOrCallback === 'function' ? encodingOrCallback : callback
+      let text: string
+      if (typeof chunk === 'string') text = chunk
+      else {
+        try {
+          text = utf8.decode(chunk)
+        } catch {
+          return write(chunk, done)
+        }
+      }
+      const buffered = pending + text
+      const end = buffered.lastIndexOf('\n') + 1
+      pending = buffered.slice(end)
+      if (end === 0) {
+        done?.()
+        return true
+      }
+      return write(redactForSharing(buffered.slice(0, end)), done)
+    }
+    process.on('exit', () => {
+      if (pending) write(redactForSharing(pending))
+    })
+  }
+  const methods: ('log' | 'info' | 'debug' | 'warn' | 'error' | 'trace')[] = [
+    'log',
+    'info',
+    'debug',
+    'warn',
+    'error',
+    'trace',
+  ]
+  for (const method of methods) {
+    const print = console[method].bind(console)
+    console[method] = (...args: unknown[]) => print(redactForSharing(format(...args)))
+  }
+  console.dir = (value: unknown, options?: object) =>
+    console.log(redactForSharing(inspect(value, options)))
+  console.assert = (condition?: boolean, ...args: unknown[]) => {
+    if (!condition) console.error('Assertion failed:', ...args)
+  }
+}

package/cli/parse-args.ts

@@ -29,6 +29,7 @@ const GLOBAL_FLAGS: Record<
   // `--session <id>`). normalized to the sim target in bin.ts.
   '--session': { type: 'string' },
   '--tab': { type: 'string' },
+  '--redact': { type: 'boolean' },
 }
 
 // every spelling parseRnxArgs consumes before the command name, mapped to

package/dist-lib/agent-daemon-client.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.668 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.670 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;

package/dist-lib/agent-events.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.668 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.670 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;

package/dist-lib/agent-identity.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.668 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.670 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;

package/dist-lib/agent-sessions.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.668 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.670 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;

package/dist-lib/attached-projects.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.668 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.670 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;

package/dist-lib/auth/shared-session.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.668 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.670 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;

package/dist-lib/backend-origin.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.668 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.670 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;

package/dist-lib/beta.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.668 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.670 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;

package/dist-lib/beta.mjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.668 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.670 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 
 // src/beta.ts
 var IS_BETA = true;

package/dist-lib/bridge-constants.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.668 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.670 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;

package/dist-lib/bridge-contract-input.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.668 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.670 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;

package/dist-lib/bridge-contract-input.mjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.668 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.670 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 
 // src/bridge-contract.ts
 var SIM_LONG_PRESS_MAX_MS = 5e3;