rnxsim 0.1.313 → 0.1.314

package/src/host/bridge-host.ts

@@ -27,6 +27,7 @@ import {
   writeDevBridgeLockfile,
   writeRuntimeUpgradeNotice,
   writeSharedConfig,
+  cameraFixturesDir,
   sootsimHomeDir,
   type DaemonLockfile,
   type DevBridgeLockfile,
@@ -173,7 +174,14 @@ interface BridgeCliLease {
 // `call` used to acquire a lease too, but most call paths are queries
 // (`__sootsimTest.findByTestId`, state reads, etc.). the CLI opts write
 // calls into lease acquisition via msg.acquireLock=true.
-const WRITE_COMMAND_TYPES = new Set(['tap', 'keyboard'])
+const WRITE_COMMAND_TYPES = new Set([
+  'tap',
+  'keyboard',
+  'longPress',
+  'perform',
+  'reset',
+  'camera',
+])
 
 // how long a `close` waits for the sim page to tear itself down before the
 // host disconnects the sim socket. the close code is part of the protocol:
@@ -227,10 +235,11 @@ export interface BridgeHostOptions {
    *  anything embedded should leave it off to avoid clobbering a real
    *  daemon's lockfile. defaults to false. */
   writeLockfile?: boolean
-  /** when true, write ~/.sootsim/dev-bridge.json on successful bind + update
-   *  it on a heartbeat interval + remove it on close. the Vite dev shell sets
-   *  this so local CLI commands prefer the live source bridge over a standalone
-   *  daemon or stale default-port listener. */
+  /** when true, write an owner-scoped record under ~/.sootsim/dev-bridges on
+   *  successful bind, update it on a heartbeat interval, and remove only that
+   *  record on close. the Vite dev shell sets this so local CLI commands can
+   *  address every live source bridge without concurrent worktrees replacing
+   *  one shared pointer. */
   writeDevLockfile?: boolean
   /** resolve the http port of the vite shell dev server that hosts this
    *  bridge (e.g. 5173). called on every dev-lockfile write so the port
@@ -291,8 +300,21 @@ const HTTP_MIME_TYPES: Record<string, string> = {
   '.woff2': 'font/woff2',
   '.map': 'application/json',
   '.txt': 'text/plain; charset=utf-8',
+  '.mp4': 'video/mp4',
+  '.m4v': 'video/mp4',
+  '.webm': 'video/webm',
+  '.mov': 'video/quicktime',
 }
 
+// `rnxsim camera play` stages a video under ~/.sootsim/camera-fixtures and the
+// simulator plays it as the camera feed. the route below serves that one
+// directory, addressed by basename only.
+const CAMERA_FIXTURE_ROUTE = '/__camera-fixtures/'
+// no slashes, no dots leading a segment, no traversal to express. a name that
+// does not match is rejected rather than normalized, so there is nothing to
+// get the normalization wrong about.
+const CAMERA_FIXTURE_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/
+
 /** inject host-provided globals into the served runtime html:
  *   - `window.__sootsimSharedConfig` — parsed `~/.sootsim/config.json`,
  *     read during engine settingsStore module init (see
@@ -1259,6 +1281,96 @@ export class SootSimBridgeHost {
     return this.inflightScan
   }
 
+  // serves one staged camera fixture. addressed by basename inside
+  // ~/.sootsim/camera-fixtures, never by a caller-supplied path, so there is
+  // no traversal surface to defend: a name that is not a plain basename is
+  // rejected outright. range support is not optional here — chrome asks for
+  // byte ranges on media and cannot seek or loop a fixture without it.
+  private handleCameraFixture(name: string, req: IncomingMessage, res: ServerResponse) {
+    const method = (req.method || 'GET').toUpperCase()
+    const cors = {
+      'Access-Control-Allow-Origin': '*',
+      'Cache-Control': 'no-store',
+    }
+    if (method === 'OPTIONS') {
+      res.writeHead(204, {
+        ...cors,
+        'Access-Control-Allow-Methods': 'GET, HEAD, OPTIONS',
+        'Access-Control-Allow-Headers': 'range',
+      })
+      res.end()
+      return
+    }
+    if (method !== 'GET' && method !== 'HEAD') {
+      res.writeHead(405, cors)
+      res.end()
+      return
+    }
+    if (!CAMERA_FIXTURE_NAME_RE.test(name)) {
+      res.writeHead(400, { ...cors, 'Content-Type': 'text/plain; charset=utf-8' })
+      res.end('bad fixture name')
+      return
+    }
+
+    const root = cameraFixturesDir()
+    const filePath = path.join(root, name)
+    let stats: fs.Stats
+    try {
+      // a symlink dropped into the fixtures dir is the one way out of it.
+      // lstat rather than stat so a link is refused instead of followed.
+      stats = fs.lstatSync(filePath)
+    } catch {
+      res.writeHead(404, { ...cors, 'Content-Type': 'text/plain; charset=utf-8' })
+      res.end('not found')
+      return
+    }
+    if (!stats.isFile()) {
+      res.writeHead(403, { ...cors, 'Content-Type': 'text/plain; charset=utf-8' })
+      res.end('forbidden')
+      return
+    }
+
+    const contentType =
+      HTTP_MIME_TYPES[path.extname(filePath).toLowerCase()] || 'application/octet-stream'
+    const total = stats.size
+    const range = /^bytes=(\d*)-(\d*)$/.exec(req.headers.range || '')
+    if (range) {
+      const [, startRaw, endRaw] = range
+      const start = startRaw ? Number(startRaw) : 0
+      const end = endRaw ? Math.min(Number(endRaw), total - 1) : total - 1
+      if (!Number.isFinite(start) || start > end || start >= total) {
+        res.writeHead(416, { ...cors, 'Content-Range': `bytes */${total}` })
+        res.end()
+        return
+      }
+      res.writeHead(206, {
+        ...cors,
+        'Content-Type': contentType,
+        'Content-Range': `bytes ${start}-${end}/${total}`,
+        'Accept-Ranges': 'bytes',
+        'Content-Length': String(end - start + 1),
+      })
+      if (method === 'HEAD') {
+        res.end()
+        return
+      }
+      fs.createReadStream(filePath, { start, end }).pipe(res)
+      return
+    }
+
+    res.writeHead(200, {
+      ...cors,
+      'Content-Type': contentType,
+      'Accept-Ranges': 'bytes',
+      'Content-Length': String(total),
+    })
+    if (method === 'HEAD') {
+      res.end()
+      return
+    }
+    fs.createReadStream(filePath).pipe(res)
+  }
+
   private handleServerScan(res: ServerResponse) {
     const sendJson = (body: DiscoveredServer[]) => {
       res.writeHead(200, {
@@ -1522,6 +1634,18 @@ export class SootSimBridgeHost {
       return
     }
 
+    // /__camera-fixtures/<name> — the staged video behind `rnxsim camera play`.
+    // the shell page is a different origin from this daemon (vite dev on 5173,
+    // daemon on 7668+), and the camera pipeline draws the <video> to a canvas
+    // and reads it back, so this needs real CORS or the canvas taints and
+    // createImageBitmap throws. it sits above the read-only guard below
+    // because it answers its own OPTIONS preflight with the CORS headers that
+    // guard's bare 405 would omit.
+    if (url.pathname.startsWith(CAMERA_FIXTURE_ROUTE)) {
+      this.handleCameraFixture(url.pathname.slice(CAMERA_FIXTURE_ROUTE.length), req, res)
+      return
+    }
+
     // every other daemon route is read-only unless its owning proxy handled
     // the mutation above.
     if (method !== 'GET' && method !== 'HEAD') {
@@ -2101,7 +2225,11 @@ export class SootSimBridgeHost {
     }
     if (this.shouldWriteDevLockfile) {
       try {
-        removeDevBridgeLockfile()
+        removeDevBridgeLockfile({
+          bridgePort: this.effectivePort,
+          pid: process.pid,
+          startedAt: this.startedAt,
+        })
       } catch {}
     }
     this.effectivePort = 0

package/src/index.ts

@@ -1,8 +1,34 @@
-// sootsim public package — CLI + framework integrations.
+// sootsim public package — SDK client, CLI + framework integrations.
 //
 // the bridge client and plugins live here. the canvas rendering engine lives
 // in the private `sootsim-engine` workspace package.
 
+export { connect, type ConnectOptions } from './connect'
+export {
+  SimClient,
+  SimClientError,
+  SimConnectError,
+  SimKeyboardError,
+  SimPerformError,
+  SimReadyTimeoutError,
+  SimResetError,
+  SimTapError,
+  type SimClientOptions,
+  type SimFindOptions,
+  type SimPerformStep,
+  type SimScreenshot,
+  type SimTapTarget,
+} from './sim-client'
+export type {
+  PerformOptions,
+  PerformResult,
+  PerformStep,
+  ResetOptions,
+  ResetResult,
+  SimStateOptions,
+  SimStateResult,
+} from './bridge-contract'
+
 export { sootsimPlugin } from './vite-plugin-one'
 export { default as metroPlugin } from './metro-plugin'
 export { default as jumpToSourceBabelPlugin } from './jump-to-source-babel'

package/src/sdk.ts

@@ -1,3 +1,11 @@
+// rnxsim/sdk — the scriptable sim-driving surface.
+//
+// exports the SimClient class plus the transport-agnostic inspect verbs it is
+// built from. this entry MUST stay browser-safe (Contrast's in-browser agent
+// imports it against an in-process preview bridge), so the node-only ws
+// `connect()` lives on the ROOT `rnxsim` entry, not here.
+
+export * from './sim-client'
 export * from '../cli/commands/inspect/core'
 export * from '../cli/commands/inspect/actions'
 export { waitForSootsimIdle } from '../cli/commands/inspect/settling'