rnxsim 0.1.343 → 0.1.345

package/README.md

@@ -53,7 +53,7 @@ internally splits into shell, compositor, and tenant workers.
 ```mermaid
 graph TD
   subgraph cli["rnx CLI process (short-lived, cli/)"]
-    BIN["bin.ts (dispatcher + telemetry)"]
+    BIN["bin.ts (dispatcher + privacy choice)"]
     SETUP["commands/setup.ts (guided daemon setup)"]
     RUNTIMECMD["commands/runtime.ts (runtime install/use)"]
     INSPECT["commands/inspect/* (describe/find/do/get/wait)"]
@@ -131,12 +131,10 @@ graph TD
   SKILLS --> INSPECT
 ```
 
-**The CLI process** (`cli/bin.ts`) parses argv, emits invocation telemetry, and
-lazy-imports exactly one command module per run. Bare `rnx` and
-`rnx setup` own guided one-time machine work: ask which package manager you
-use for app commands, explain repo-pinned Node versions, recommend a global
-`rnxsim` install, and install the faster background daemon when it is
-missing. `rnx open`
+**The CLI process** (`cli/bin.ts`) parses argv and lazy-imports exactly one
+command module per run. Bare `rnx` discovers a running React Native development
+server and opens it directly. `rnx setup` remains the explicit path for
+repository preparation and the optional background daemon. `rnx open`
 ensures the engine runtime exists and starts a local foreground bridge when no
 daemon is reachable, then opens a `WsBridge` (`cli/ws-bridge.ts`) on **port
 7668** and sends JSON commands. Inspection/interaction verbs live in
@@ -172,8 +170,8 @@ bridge always addresses the **shell worker**, never an undifferentiated sim.
 
 - The published **`rnxsim/vite`** (`src/vite-plugin-one.ts`, `rnxPlugin`)
   and **`rnxsim/metro`** plugins do one thing: serve the installed runtime at
-  `/__soot/` so an app's own dev server can host the sim shell. The vite
-  plugin's `open: true` option also launches the simulator when the dev server
+  `/__soot/` so an app's own dev server can host the sim shell. Both accept an
+  opt-in `open` option that launches a named Electron window when the dev server
   starts (skipped when `CI` or `SOOTSIM_NO_OPEN` is set).
 - The internal **`sootsim()`** plugin (`src/vite-plugin.ts`) is a separate, much
   larger RN-resolution / native-stub plugin: it aliases `react-native` to the
@@ -186,7 +184,7 @@ bridge always addresses the **shell worker**, never an undifferentiated sim.
 
 | component | role | key files |
 | --- | --- | --- |
-| rnx CLI (bin + dispatcher) | Short-lived terminal entry point. Parses argv, emits telemetry, lazy-imports one command per run, and routes guided setup/open/runtime/inspection flows without a hidden bootstrap path. | `cli/bin.ts`, `cli/parse-args.ts`, `cli/help.ts`, `cli/commands/setup.ts`, `cli/commands/control.ts` |
+| rnx CLI (bin + dispatcher) | Short-lived terminal entry point. Parses argv, owns the private-by-default one-time choice, lazy-imports one command per run, and routes direct open/runtime/inspection flows. | `cli/bin.ts`, `cli/privacy.ts`, `cli/parse-args.ts`, `cli/help.ts`, `cli/commands/setup.ts`, `cli/commands/control.ts` |
 | WsBridge client | Client side of the CLI→daemon link. Resolves the daemon port from the lockfile, opens a WS to `:7668`, sends JSON commands and awaits `{id,result}`/`{id,error}`. Used by every interactive command. | `cli/ws-bridge.ts`, `src/bridge-constants.ts`, `cli/current-sim.ts` |
 | inspect / SDK command surface | Runtime inspection + interaction verbs (describe, find, do tap, get errors, wait, layout, settle). Re-exported as `rnxsim/sdk` so programmatic callers drive a sim the same way the CLI does. | `cli/commands/inspect/core.ts`, `cli/commands/inspect/actions.ts`, `cli/commands/inspect.ts`, `src/sdk.ts` |
 | Maestro / Detox runners | Drop-in test compatibility. `bridge-flow-runner.ts` runs Maestro YAML and recorded flows over the bridge; `detox/` provides a `by`/`element`/`expect`/`device` driver + jest preset so existing Detox suites run unchanged. | `cli/bridge-flow-runner.ts`, `cli/commands/maestro.ts`, `cli/commands/detox.ts`, `detox/index.ts`, `detox/jest-preset.cjs` |
@@ -195,19 +193,22 @@ bridge always addresses the **shell worker**, never an undifferentiated sim.
 | AgentHost + sessions | Agent-routing extension of the host: owns the single FIFO reader per agent session and fans `agent:event`/`session-status` pushes to every WS subscriber. Backed by agent-sessions + attached-projects stores. | `src/host/agent-host.ts`, `src/agent-sessions.ts`, `src/attached-projects.ts`, `src/agent-daemon-client.ts` |
 | host proxies + dev-server scan | Host-side helpers so a cross-origin tenant worker can reach local dev servers and same-origin APIs: `/__server-scan` discovers running metro/expo/vxrn/one servers; fetch + websocket proxies relay guest-app network through the daemon. | `src/host/fetch-proxy-handler.ts`, `src/host/websocket-proxy.ts`, `scripts/dev-server-scanner.ts`, `src/dev-bundle-resolution.ts` |
 | runtime delivery + rnx home | Versioned engine runtime management. The shared machinery owns manifest fetch, sha256 verification, channels, and auto-update. rnx binds it to `https://contrast.dev` and `~/.sootsim/runtimes/<version>`. A repo can select `runtimeVersion` without changing the machine default. | `src/runtime-delivery.ts`, `packages/contrast-runtime-delivery/`, `src/home-paths.ts`, `src/runtime-assets.ts`, `scripts/postinstall.cjs` |
-| `rnxsim/vite` + `rnxsim/metro` (runtime serving) | Published bundler plugins. Both serve the installed engine runtime at `/__soot/` from `~/.sootsim/runtimes/<version>` so an app's own dev server can host the sim shell; the vite plugin can also launch the Electron app. | `src/vite-plugin-one.ts`, `src/metro-plugin.ts`, `src/runtime-assets.ts` |
+| `rnxsim/vite` + `rnxsim/metro` (runtime serving) | Published bundler plugins. Both serve the installed engine runtime at `/__soot/` from `~/.sootsim/runtimes/<version>` so an app's own dev server can host the sim shell; either plugin can opt into a named Electron window. | `src/vite-plugin-one.ts`, `src/metro-plugin.ts`, `src/runtime-assets.ts` |
 | `sootsim()` vite resolver plugin (internal) | The large RN-resolution / native-stub vite plugin: aliases `react-native` to the engine shim, native packages to `@sootsim/compat` stubs, applies worklets/babel transforms, and instantiates `SootSimBridgeHost` in its dev server. Distinct from the published `rnxsim/vite` export. | `src/vite-plugin.ts`, `src/worklets-babel.ts`, `packages/compat/src/stub-manifest.ts` |
 | skills registry | rnx agent skills (`rnx-setup`, `rnx-debug`, `rnx-test`, `rnx-visual`, and the generated `contrast` index) installable with `rnx skill`. | `skills/*.md`, `src/skills/registry.ts`, `src/skills/types.ts` |
 
 ## Getting started
 
 ```sh
-curl -fsSL https://rnxsim.com/install.sh | sh
-rnx setup           # guided one-time machine setup
-rnx open 8081       # load a running metro/expo dev server
+npx rnxsim           # discover your running app and open it in the simulator
 rnx open /settings  # dispatch a React Native deep link into that app
 ```
 
+Start Metro, Expo, One, or another supported React Native development server
+the way you normally do, then run `npx rnxsim` from any directory. If one app is
+running, rnx opens it immediately. If several are running, a human terminal gets
+one short choice; CI and agents choose deterministically and never prompt.
+
 The first `rnx open` launches an isolated Chrome for Testing sim. The CLI
 resolves Playwright from the app or CLI install, asks that exact package for
 its required browser executable, and runs that package's installer once when
@@ -217,21 +218,40 @@ requested target. Use `rnx do reload` when the target has not changed.
 Reserve `--new` for a genuinely concurrent sim; repeated new browser trees
 consume memory and CPU on shared machines.
 
-The public shell script is the recommended, inspectable bootstrap path;
-`rnx` is the normal path afterward. Manual installs can use `npm install
---global rnxsim`, `bun add --global rnxsim`, or `pnpm add --global rnxsim`,
-followed by `rnx setup`. There is no per-app install:
+There is no required global or per-app install. Optional global installs can
+use `npm install --global rnxsim`, `bun add --global rnxsim`, or
+`pnpm add --global rnxsim`. `rnx setup` is optional machine/repository tuning:
 start your Metro, Expo, or One dev server the way you already do, then open it
 from the CLI. There is no iOS native build in the inner loop; Metro alone is
-enough. `rnx open` starts a local bridge when no daemon is reachable; the
-guided setup installs the faster background daemon so later CLI commands reuse
-one server. A desktop GUI (Electron) is optional on top, via `rnx desktop
+enough. The manifest bundle path and query remain authoritative. When both the
+discovery request and manifest target are loopback addresses, RNX keeps the
+loopback host that answered discovery so an IPv6-only listener is not reopened
+through an unreachable IPv4 address. `rnx open` starts a local bridge when no
+daemon is reachable; the guided setup installs the faster background daemon so
+later CLI commands reuse one server. A desktop GUI (Electron) is optional on
+top, via `rnx desktop
 install`. Native Electron windows created by `rnx open` belong to that CLI
 session and close when the session exits; `rnx desktop` keeps the persistent
 desktop-app lifecycle. In Electron, `File > New Window`
 duplicates the focused simulator, while `File > New Simulator >` opens a new
 window for a selected device (same device list as the `Window >` menu).
 
+### Privacy
+
+rnx does not phone home by default. On an unsigned-in first run, its only
+internet request is the runtime manifest/archive it is about to execute. The
+first human run asks once, defaults to no, and never prompts in a non-TTY shell,
+CI, or an agent. An automated first run is declined for that process without
+consuming the later human choice. Legacy browser and Electron telemetry senders
+are removed rather than being enabled by this consent.
+
+Opt-in diagnostics are limited to package name/version/unsupported API or error
+class. rnx never sends source, file paths, project names, app content, commands,
+identity, screenshots, or recordings as diagnostics. Cloud commands such as
+login, upload, billing, issue reporting, generated flows, and screenshot decks
+contact their documented service only when explicitly invoked. The complete
+enforced network contract is in [`specs/rnx-privacy.md`](../../specs/rnx-privacy.md).
+
 To uninstall the machine daemon and cached runtimes, run
 `rnx daemon uninstall`. It stops current and legacy launchd / systemd
 services, removes daemon logs, and removes `~/.sootsim/` (runtimes, profiles,
@@ -308,7 +328,7 @@ The Vite plugin serves the installed RNX runtime from your existing dev server.
 import { rnxPlugin } from 'rnxsim/vite'
 
 export default {
-  plugins: [rnxPlugin()],
+  plugins: [rnxPlugin({ open: { appName: 'My App' } })],
 }
 ```
 
@@ -319,13 +339,18 @@ const { withRNX } = require('rnxsim/metro')
 
 const config = getDefaultConfig(__dirname)
 
-module.exports = withRNX(config, { devServer: true })
+module.exports = withRNX(config, { open: { appName: 'My App' } })
 ```
 
-The Metro wrapper has two independent opt-ins. `devServer` serves the RNX shell
-from the Metro process. `productionBundles` lets explicitly marked production
-bundle requests use the RNX host implementations of React and React Native
-while the rest of the app receives production transforms.
+The `open` option serves the RNX shell and opens the app in its own named
+Electron window. `open: true` derives the name from `package.json`; use the
+object form when the display name differs. Run `rnx desktop install` once before
+enabling it. `SOOTSIM_NO_OPEN=1` keeps the server headless. The Metro wrapper
+also has two independent non-window opt-ins.
+`devServer` serves the RNX shell from the Metro process. `productionBundles`
+lets explicitly marked production bundle requests use the RNX host
+implementations of React and React Native while the rest of the app receives
+production transforms.
 
 ```js
 module.exports = withRNX(config, { productionBundles: true })
@@ -516,10 +541,13 @@ serves its selected version from a version-specific localhost origin, so a
 background activation cannot mix an already loaded shell with chunks from the
 next runtime. Without config, each new open selects the active stable version.
 When `sootsim.config.ts` sets `runtimeVersion`, `rnx open` installs that
-version without changing the machine default. Running from a monorepo root
-resolves the only React Native app from package workspaces, then shares that app
-root across config, font, and splash discovery. The fallback scan is bounded and
-prunes dependency, build, native, fixture, and example trees.
+version without changing the machine default. App config, native-linked fonts,
+and splash assets all resolve from the project root advertised by the selected
+development server. Bare Metro, which has no Expo manifest project root, uses
+the listening development process's cwd inside that same resolver. The invoking
+CLI's cwd is never an asset/config fallback. Asset wires stay on each opened
+project URL, so one daemon can serve several attached projects without sharing
+font or splash state between them.
 
 The first interactive CLI command after this cleanup generation finishes its
 requested work, then launches the same safe default plan in a detached

package/cli/app-fonts.ts

@@ -36,44 +36,26 @@ function localOriginOf(value: string): string | null {
   return null
 }
 
-function hasPackageJson(dir: string): boolean {
-  try {
-    return fs.statSync(path.join(dir, 'package.json')).isFile()
-  } catch {
-    return false
-  }
-}
 export function discoverNativeLinkedAppFonts(opts: {
   bundleUrl: string
-  repoDir?: string
-  exactProjectDir?: boolean
+  projectDir: string
   platform?: string
 }): DiscoveredAppFontSpec[] {
   const metroOrigin = localOriginOf(opts.bundleUrl)
   if (!metroOrigin) return []
 
-  const explicit = opts.repoDir || process.env.CONTRAST_REPO_DIR
-  const startDir = explicit ? path.resolve(explicit) : process.cwd()
-
-  // if we're using cwd() (no explicit repo) and there's no package.json,
-  // assume we're not in a project tree — bail immediately instead of
-  // recursing the filesystem.
-  if (!explicit && !hasPackageJson(startDir)) return []
-
-  const project = resolveAppProject(startDir, { trustStart: opts.exactProjectDir })
+  const project = resolveAppProject(opts.projectDir)
   const selectedAppDir = project?.appDir ?? null
   if (!selectedAppDir) return []
 
   const platform = (opts.platform || process.env.CONTRAST_PLATFORM || 'ios').toLowerCase()
 
   let getConfig: ExpoConfigGetter | null = null
-  // use the app config dirs + startDir as resolve paths. real repos hoist
-  // @expo/config to the root node_modules so startDir is sufficient; tests
-  // that mock @expo/config can set CONTRAST_REPO_DIR to point where the mock lives.
-  if (explicit || project) {
+  // resolve from the exact app root advertised by the development server.
+  if (project) {
     try {
       const modulePath = require.resolve('@expo/config', {
-        paths: [selectedAppDir, startDir],
+        paths: [selectedAppDir],
       })
       const mod = require(modulePath) as { getConfig?: unknown }
       if (typeof mod.getConfig === 'function') {
@@ -283,11 +265,9 @@ export function discoverNativeLinkedAppFonts(opts: {
 // `sootsim open 8081` run from ~/soot against a 3pc metro), so scanning cwd for
 // font declarations finds nothing.
 //
-// a bare react-native packager serves no such manifest — it answers `/` with an
-// HTML page — so fall back to asking the OS which directory the listening
-// process runs from. bare apps are exactly the ones that link fonts through
-// react-native.config.js `assets`, so without this their fonts are never
-// discoverable and the appFonts wire comes out empty.
+// a bare react-native packager serves no such manifest, so the same resolver
+// asks the OS for the listening process's cwd. that is still the development
+// server's project identity; the invoking CLI's cwd is never consulted.
 export async function resolveMetroProjectRoot(
   bundleUrl: string,
   opts?: { timeoutMs?: number },

package/cli/app-project.ts

@@ -16,30 +16,6 @@ export const SOOTSIM_APP_CONFIG_NAMES = [
   'sootsim.config.cjs',
 ] as const
 
-const SKIP_DIR_NAMES = new Set([
-  'node_modules',
-  'artifacts',
-  'dist',
-  'build',
-  'out',
-  'coverage',
-  'tmp',
-  'public',
-  'ios',
-  'android',
-  'macos',
-  'windows',
-  '__fixtures__',
-  '__tests__',
-  'fixtures',
-  'fixture',
-  'examples',
-  'example',
-])
-
-const MAX_SCANNED_DIRECTORIES = 256
-const MAX_SCAN_DEPTH = 4
-
 export interface ResolvedAppProject {
   appDir: string
   configPath: string | null
@@ -63,169 +39,21 @@ export function findSootSimAppConfig(dir: string): string | null {
   return firstNamedFile(dir, SOOTSIM_APP_CONFIG_NAMES)
 }
 
-function readWorkspacePatterns(rootDir: string): string[] {
+export function resolveAppProject(projectRoot: string): ResolvedAppProject | null {
+  const appDir = path.resolve(projectRoot)
   try {
-    const value = JSON.parse(fs.readFileSync(path.join(rootDir, 'package.json'), 'utf8'))
-    if (!value || typeof value !== 'object') return []
-    const workspaces = Reflect.get(value, 'workspaces')
-    if (Array.isArray(workspaces)) {
-      return workspaces.filter((entry): entry is string => typeof entry === 'string')
-    }
-    if (!workspaces || typeof workspaces !== 'object') return []
-    const packages = Reflect.get(workspaces, 'packages')
-    return Array.isArray(packages)
-      ? packages.filter((entry): entry is string => typeof entry === 'string')
-      : []
+    if (!fs.statSync(appDir).isDirectory()) return null
   } catch {
-    return []
-  }
-}
-
-interface DirectoryScan {
-  directories: string[]
-  complete: boolean
-}
-
-function workspaceDirectories(rootDir: string): DirectoryScan {
-  const directories = new Set<string>()
-  let expanded = 0
-  let complete = true
-  for (const pattern of readWorkspacePatterns(rootDir)) {
-    if (expanded >= MAX_SCANNED_DIRECTORIES) {
-      complete = false
-      break
-    }
-    if (!pattern || path.isAbsolute(pattern)) continue
-    const segments = pattern.split(/[\\/]+/).filter(Boolean)
-    if (segments.length === 0 || segments.length > MAX_SCAN_DEPTH) continue
-    if (segments.some((segment) => segment === '..' || segment === '**')) continue
-
-    let current = [rootDir]
-    for (const segment of segments) {
-      const next: string[] = []
-      for (const parent of current) {
-        if (expanded >= MAX_SCANNED_DIRECTORIES) {
-          complete = false
-          break
-        }
-        expanded++
-        if (segment === '*') {
-          let entries: fs.Dirent[]
-          try {
-            entries = fs.readdirSync(parent, { withFileTypes: true })
-          } catch {
-            continue
-          }
-          for (const entry of entries) {
-            if (!entry.isDirectory() || entry.isSymbolicLink()) continue
-            if (entry.name.startsWith('.') || SKIP_DIR_NAMES.has(entry.name)) continue
-            next.push(path.join(parent, entry.name))
-          }
-        } else if (!segment.includes('*')) {
-          const candidate = path.join(parent, segment)
-          try {
-            const stat = fs.lstatSync(candidate)
-            if (stat.isDirectory() && !stat.isSymbolicLink()) next.push(candidate)
-          } catch {}
-        }
-      }
-      current = next
-      if (current.length > MAX_SCANNED_DIRECTORIES) {
-        current.length = MAX_SCANNED_DIRECTORIES
-        complete = false
-      }
-    }
-    for (const directory of current) directories.add(directory)
-  }
-  return { directories: [...directories], complete }
-}
-
-function boundedConfigDirectories(rootDir: string): DirectoryScan {
-  const queue: Array<{ dir: string; depth: number }> = [{ dir: rootDir, depth: 0 }]
-  const matches: string[] = []
-  let visited = 0
-  let nextIndex = 0
-  let complete = true
-
-  while (nextIndex < queue.length && visited < MAX_SCANNED_DIRECTORIES) {
-    const current = queue[nextIndex++]
-    if (!current) break
-    visited++
-    if (current.depth > 0 && findExpoAppConfig(current.dir)) {
-      matches.push(current.dir)
-      if (matches.length > 1) return { directories: matches, complete: true }
-    }
-    if (current.depth >= MAX_SCAN_DEPTH) continue
-
-    let entries: fs.Dirent[]
-    try {
-      entries = fs.readdirSync(current.dir, { withFileTypes: true })
-    } catch {
-      continue
-    }
-    for (const entry of entries) {
-      if (!entry.isDirectory() || entry.isSymbolicLink()) continue
-      if (entry.name.startsWith('.') || SKIP_DIR_NAMES.has(entry.name)) continue
-      if (queue.length >= MAX_SCANNED_DIRECTORIES) {
-        complete = false
-        break
-      }
-      queue.push({ dir: path.join(current.dir, entry.name), depth: current.depth + 1 })
-    }
+    return null
   }
 
-  return { directories: matches, complete: complete && nextIndex === queue.length }
-}
-
-export function resolveAppProject(
-  startDir: string,
-  opts: { trustStart?: boolean } = {},
-): ResolvedAppProject | null {
-  const rootDir = path.resolve(startDir)
-  const rootConfigPath = findSootSimAppConfig(rootDir)
-  if (findExpoAppConfig(rootDir) || (opts.trustStart && fs.existsSync(rootDir))) {
-    let configPath = rootConfigPath
-    if (!configPath && opts.trustStart) {
-      let parent = path.dirname(rootDir)
-      for (
-        let depth = 0;
-        depth < MAX_SCAN_DEPTH && parent !== path.dirname(parent);
-        depth++
-      ) {
-        configPath = findSootSimAppConfig(parent)
-        if (configPath) break
-        parent = path.dirname(parent)
-      }
-    }
-    return { appDir: rootDir, configPath }
+  const configPath = findSootSimAppConfig(appDir)
+  if (
+    !configPath &&
+    !findExpoAppConfig(appDir) &&
+    !fs.existsSync(path.join(appDir, 'package.json'))
+  ) {
+    return null
   }
-
-  const workspaceScan = workspaceDirectories(rootDir)
-  const workspaceApps = workspaceScan.directories.filter((directory) =>
-    findExpoAppConfig(directory),
-  )
-  if (workspaceApps.length > 1) return null
-  if (!workspaceScan.complete) return null
-  if (workspaceApps.length === 1) {
-    const workspaceAppDir = workspaceApps[0]
-    return {
-      appDir: workspaceAppDir,
-      configPath: rootConfigPath ?? findSootSimAppConfig(workspaceAppDir),
-    }
-  }
-
-  const fallbackScan = boundedConfigDirectories(rootDir)
-  const scannedApps = fallbackScan.directories
-  if (scannedApps.length > 1) return null
-  if (!fallbackScan.complete) return null
-  if (scannedApps.length === 1) {
-    const scannedAppDir = scannedApps[0]
-    return {
-      appDir: scannedAppDir,
-      configPath: rootConfigPath ?? findSootSimAppConfig(scannedAppDir),
-    }
-  }
-
-  if (rootConfigPath) return { appDir: rootDir, configPath: rootConfigPath }
-  return null
+  return { appDir, configPath }
 }

package/cli/app-splash.ts

@@ -33,32 +33,18 @@ function localOriginOf(value: string): string | null {
   return null
 }
 
-function hasPackageJson(dir: string): boolean {
-  try {
-    return fs.statSync(path.join(dir, 'package.json')).isFile()
-  } catch {
-    return false
-  }
-}
-
 // discover the app's configured splash by evaluating its expo config on the
 // filesystem (mirrors discoverNativeLinkedAppFonts exactly). returns null when
 // no splash is configured, no app config is found, or the bundle isn't local.
 export function discoverConfigPluginAppSplash(opts: {
   bundleUrl: string
-  repoDir?: string
-  exactProjectDir?: boolean
+  projectDir: string
   platform?: string
 }): DiscoveredAppSplashSpec | null {
   const metroOrigin = localOriginOf(opts.bundleUrl)
   if (!metroOrigin) return null
 
-  const explicit = opts.repoDir || process.env.CONTRAST_REPO_DIR
-  const startDir = explicit ? path.resolve(explicit) : process.cwd()
-
-  if (!explicit && !hasPackageJson(startDir)) return null
-
-  const project = resolveAppProject(startDir, { trustStart: opts.exactProjectDir })
+  const project = resolveAppProject(opts.projectDir)
   const selectedAppDir = project?.appDir ?? null
   if (!selectedAppDir) return null
 
@@ -67,7 +53,7 @@ export function discoverConfigPluginAppSplash(opts: {
   let getConfig: ExpoConfigGetter | null = null
   try {
     const modulePath = require.resolve('@expo/config', {
-      paths: [selectedAppDir, startDir],
+      paths: [selectedAppDir],
     })
     const mod = require(modulePath) as { getConfig?: unknown }
     if (typeof mod.getConfig === 'function') {

package/cli/bin.ts

@@ -89,22 +89,15 @@ const isAutomaticCleanupWorker =
   parsed.commandArgs.length === 1 &&
   parsed.commandArgs[0] === '--automatic-worker'
 
-// invocation telemetry. enqueued here, flushed by command-specific paths
-// (most commands run long enough that the beforeExit drain catches the
-// event; fast-exit paths like --version/--help explicitly flush below).
-if (!isAutomaticCleanupWorker) {
-  const { trackCliEvent } = await import('./telemetry')
-  trackCliEvent({
-    event: 'cli_command_invoked',
-    properties: {
-      command:
-        parsed.command || (parsed.version ? 'version' : parsed.help ? 'help' : 'none'),
-      arg_count: parsed.commandArgs.length,
-      platform: process.platform,
-      arch: process.arch,
-      node_version: process.versions.node,
-    },
-  })
+if (
+  !isAutomaticCleanupWorker &&
+  !parsed.help &&
+  !parsed.version &&
+  parsed.command !== 'config' &&
+  parsed.command !== 'telemetry'
+) {
+  const { ensurePrivacyChoice } = await import('./privacy')
+  await ensurePrivacyChoice({ prompt: true })
 }
 
 // one-shot "engine upgraded in the background" banner. the daemon's hourly
@@ -176,9 +169,8 @@ async function scheduleAutomaticCleanup(): Promise<void> {
   }
 }
 
-// fast-exit helper: every path that calls process.exit before reaching a
-// command function would lose the cli_command_invoked event because node
-// doesn't await pending fetches on exit. flush first, then exit.
+// fast-exit helper: diagnostic error shapes are best-effort, but explicit exit
+// paths still give a permitted queued diagnostic a chance to drain.
 async function exitWithFlush(code: number): Promise<never> {
   const { flushCliTelemetry } = await import('./telemetry')
   await flushCliTelemetry()
@@ -236,16 +228,11 @@ if (device || theme) {
   settingsStore.apply(overrides)
 }
 
-// no command, no args: show the clean surface. setup/open own actual work.
+// no command, no args: discover the running app and open it directly. explicit
+// `rnx setup` remains available for repository and background-service choices.
 if (!parsed.command && parsed.commandArgs.length === 0) {
-  const { runSetup, shouldRunSetupForBareCommand } = await import('./commands/setup')
-  if (shouldRunSetupForBareCommand()) {
-    await runSetup(['--from-welcome'])
-    await exitWithFlush(0)
-  }
-  const { printHelp } = await import('./help')
-  printHelp()
-  await exitWithFlush(0)
+  const { runWelcome } = await import('./commands/welcome')
+  await exitWithFlush(await runWelcome())
 }
 
 // route to command. an empty command at this point only happens if the