rnxsim 0.1.343 → 0.1.345

package/dist-lib/host/replacement-module-handler.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.343 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.345 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;
@@ -41,6 +41,17 @@ module.exports = __toCommonJS(replacement_module_handler_exports);
 var import_promises = __toESM(require("node:fs/promises"), 1);
 var import_node_path = __toESM(require("node:path"), 1);
 var import_esbuild = require("esbuild");
+
+// src/backend-origin.ts
+function normalizeHostname(hostname) {
+  return hostname.replace(/^\[|\]$/g, "").toLowerCase();
+}
+function isLoopbackHost(hostname) {
+  const normalized = normalizeHostname(hostname);
+  return normalized === "localhost" || normalized.endsWith(".localhost") || normalized === "0.0.0.0" || normalized === "::1" || /^127(?:\.\d{1,3}){3}$/.test(normalized);
+}
+
+// src/host/replacement-module-handler.ts
 var REPLACEMENT_MODULE_ROUTE = "/__sootsim-replacement-module";
 var REPLACEMENT_RUNTIME_PREFIX = "/__sootsim-replacement-runtime";
 function getReplacementLoader(filePath) {
@@ -141,9 +152,18 @@ export const Appearance = rn.Appearance
 `;
 }
 function sendJavaScript(req, res, source) {
+  const origin = req.headers.origin;
+  let allowedOrigin;
+  if (origin) {
+    try {
+      if (isLoopbackHost(new URL(origin).hostname)) allowedOrigin = origin;
+    } catch {
+    }
+  }
   res.writeHead(200, {
     "Content-Type": "application/javascript; charset=utf-8",
-    "Cache-Control": "no-cache"
+    "Cache-Control": "no-cache",
+    ...allowedOrigin ? { "Access-Control-Allow-Origin": allowedOrigin, Vary: "Origin" } : {}
   });
   res.end(req.method === "HEAD" ? void 0 : source);
 }
@@ -164,6 +184,23 @@ async function handleReplacementModuleRequest(req, res, options = {}) {
   } catch {
     return false;
   }
+  if (options.requireLoopbackOrigin) {
+    const origin = req.headers.origin;
+    const remoteAddress = req.socket.remoteAddress?.replace(/^::ffff:/, "");
+    let allowed = Boolean(remoteAddress && isLoopbackHost(remoteAddress));
+    if (allowed && origin) {
+      try {
+        allowed = isLoopbackHost(new URL(origin).hostname);
+      } catch {
+        allowed = false;
+      }
+    }
+    if (!allowed) {
+      res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end("replacement modules are available only to loopback origins");
+      return true;
+    }
+  }
   if (url.pathname === `${REPLACEMENT_RUNTIME_PREFIX}/react`) {
     sendJavaScript(req, res, reactRuntimeSource(options.reactBridgeUrl));
     return true;
@@ -173,6 +210,11 @@ async function handleReplacementModuleRequest(req, res, options = {}) {
     return true;
   }
   if (url.pathname !== REPLACEMENT_MODULE_ROUTE) return false;
+  if (options.requestToken && url.searchParams.get("token") !== options.requestToken) {
+    res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+    res.end("replacement module request token is invalid");
+    return true;
+  }
   const targetPath = url.searchParams.get("path");
   if (!targetPath) {
     res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
@@ -185,17 +227,42 @@ async function handleReplacementModuleRequest(req, res, options = {}) {
     res.end("replacement files must be .js, .jsx, .ts, or .tsx");
     return true;
   }
+  if (!import_node_path.default.isAbsolute(targetPath)) {
+    res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+    res.end("replacement file path must be absolute");
+    return true;
+  }
+  let resolvedProjectRoot;
+  if (options.projectRoot) {
+    const lexicalProjectRoot = import_node_path.default.resolve(options.projectRoot);
+    resolvedProjectRoot = await import_promises.default.realpath(options.projectRoot);
+    const lexicalTarget = import_node_path.default.relative(lexicalProjectRoot, targetPath);
+    if (lexicalTarget.startsWith("..") || import_node_path.default.isAbsolute(lexicalTarget)) {
+      res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end("replacement file must be inside the project root");
+      return true;
+    }
+  }
+  let resolvedTargetPath;
   try {
-    await import_promises.default.access(targetPath);
+    resolvedTargetPath = await import_promises.default.realpath(targetPath);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
     res.end(`replacement file not found: ${message}`);
     return true;
   }
+  if (resolvedProjectRoot) {
+    const relativeTarget = import_node_path.default.relative(resolvedProjectRoot, resolvedTargetPath);
+    if (relativeTarget.startsWith("..") || import_node_path.default.isAbsolute(relativeTarget)) {
+      res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end("replacement file must be inside the project root");
+      return true;
+    }
+  }
   try {
     const result = await (0, import_esbuild.build)({
-      entryPoints: [targetPath],
+      entryPoints: [resolvedTargetPath],
       bundle: true,
       write: false,
       format: "esm",

package/dist-lib/host/websocket-proxy.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.343 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.345 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;

package/dist-lib/index.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.343 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.345 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;
@@ -2879,19 +2879,183 @@ async function connect(options = {}) {
 }
 
 // src/vite-plugin-one.ts
-var import_child_process2 = require("child_process");
 var import_fs4 = __toESM(require("fs"), 1);
+var import_node_crypto2 = require("node:crypto");
 var import_path3 = __toESM(require("path"), 1);
-var import_url2 = require("url");
+
+// src/dev-server-open.ts
+var import_node_child_process = require("node:child_process");
+var import_node_crypto = require("node:crypto");
+var import_node_fs3 = __toESM(require("node:fs"), 1);
+var import_node_http = __toESM(require("node:http"), 1);
+var import_node_path3 = __toESM(require("node:path"), 1);
+var import_node_url = require("node:url");
+var scheduledMetroOpens = /* @__PURE__ */ new Set();
+function resolveRnxDesktopAppName(open, projectRoot) {
+  if (!open) return null;
+  if (typeof open === "object") {
+    const appName = open.appName.trim();
+    if (!appName) throw new Error("rnx: open.appName must not be empty");
+    return appName;
+  }
+  const packageJsonPath = import_node_path3.default.join(projectRoot, "package.json");
+  const packageJson = JSON.parse(import_node_fs3.default.readFileSync(packageJsonPath, "utf8"));
+  const packageName = packageJson && typeof packageJson === "object" ? Reflect.get(packageJson, "name") : void 0;
+  if (typeof packageName !== "string" || !packageName.trim()) {
+    throw new Error(`rnx: ${packageJsonPath} must declare a package name`);
+  }
+  return packageName.trim();
+}
+function tagRnxBundleForPlugin(bundleUrl, replacementOrigin, replacementToken, projectRoot, appName) {
+  const absolute = /^[a-z][a-z\d+.-]*:\/\//i.test(bundleUrl);
+  const url = new URL(bundleUrl, absolute ? void 0 : "http://rnx.local");
+  if (appName) {
+    url.searchParams.set("rnxAppName", appName);
+    url.searchParams.set(
+      "rnxProjectId",
+      (0, import_node_crypto.createHash)("sha256").update(import_node_fs3.default.realpathSync(projectRoot)).digest("hex").slice(0, 32)
+    );
+  }
+  url.searchParams.set("rnxReplacementOrigin", replacementOrigin);
+  url.searchParams.set("rnxReplacementToken", replacementToken);
+  return absolute ? url.toString() : `${url.pathname}${url.search}${url.hash}`;
+}
+function resolveRnxDesktopLaunchTarget(port, bundleUrl) {
+  return new URL(bundleUrl, `http://localhost:${port}`).toString();
+}
+function buildRnxDesktopOpenArgs(bundleUrl) {
+  return ["open", bundleUrl, "--new", "--driver", "electron", "--no-describe"];
+}
+function observeRnxDesktopLaunch(child, appName) {
+  let stderr = "";
+  let spawnFailed = false;
+  child.stderr?.setEncoding("utf8");
+  child.stderr?.on("data", (chunk) => {
+    stderr = `${stderr}${chunk}`.slice(-16384);
+  });
+  child.once("error", (error) => {
+    spawnFailed = true;
+    console.error(`[rnx] could not open ${appName}: ${error.message}`);
+  });
+  child.once("close", (code, signal) => {
+    if (spawnFailed) return;
+    if (code === 0) {
+      console.log(`[rnx] opened ${appName} in the desktop simulator`);
+      return;
+    }
+    const detail = stderr.trim() || (signal ? `signal ${signal}` : `exit ${code}`);
+    console.error(`[rnx] could not open ${appName}: ${detail}`);
+  });
+}
+function launchRnxDesktop(bundleUrl, appName) {
+  const packageRoot = import_node_path3.default.resolve(import_node_path3.default.dirname((0, import_node_url.fileURLToPath)(__sootsim_import_meta_url)), "..");
+  const binPath = import_node_path3.default.join(packageRoot, "dist-cli", "bin.js");
+  console.log(`[rnx] opening ${appName} in the desktop simulator`);
+  const child = (0, import_node_child_process.spawn)(
+    process.execPath,
+    [binPath, ...buildRnxDesktopOpenArgs(bundleUrl)],
+    {
+      stdio: ["ignore", "ignore", "pipe"],
+      windowsHide: true
+    }
+  );
+  observeRnxDesktopLaunch(child, appName);
+}
+function openRnxDesktopWhenMetroIsReady({
+  port,
+  bundleUrl,
+  appName,
+  projectRoot,
+  serverId,
+  intervalMs = 100,
+  timeoutMs = 3e4,
+  launch = launchRnxDesktop
+}) {
+  const key = `${projectRoot}\0${port}`;
+  if (scheduledMetroOpens.has(key)) return Promise.resolve(false);
+  scheduledMetroOpens.add(key);
+  const deadline = Date.now() + timeoutMs;
+  return new Promise((resolve2) => {
+    let finished = false;
+    const finish = (opened) => {
+      if (finished) return;
+      finished = true;
+      scheduledMetroOpens.delete(key);
+      resolve2(opened);
+    };
+    const retry = () => {
+      if (finished) return;
+      if (Date.now() >= deadline) {
+        console.error(
+          `[rnx] could not open ${appName}: Metro did not become ready on port ${port}`
+        );
+        finish(false);
+        return;
+      }
+      const timer = setTimeout(check, intervalMs);
+      timer.unref();
+    };
+    const check = () => {
+      const request = import_node_http.default.get(
+        `http://127.0.0.1:${port}/__server-scan`,
+        { headers: { Accept: "application/json" } },
+        (response) => {
+          let body = "";
+          response.setEncoding("utf8");
+          response.on("data", (chunk) => {
+            body = `${body}${chunk}`.slice(0, 65536);
+          });
+          response.once("end", () => {
+            try {
+              const scan = JSON.parse(body);
+              const matches = response.statusCode === 200 && Array.isArray(scan) && scan.some((entry) => {
+                if (!entry || typeof entry !== "object") return false;
+                const scannedPort = Reflect.get(entry, "port");
+                const projectName = Reflect.get(entry, "projectName");
+                const scannedServerId = Reflect.get(entry, "rnxServerId");
+                const scannedBundle = Reflect.get(entry, "bundleUrl");
+                if (scannedPort !== port || projectName !== appName || scannedServerId !== serverId || typeof scannedBundle !== "string") {
+                  return false;
+                }
+                return new URL(scannedBundle).searchParams.get("rnxAppName") === appName;
+              });
+              if (matches) {
+                launch(bundleUrl, appName);
+                finish(true);
+                return;
+              }
+            } catch {
+            }
+            retry();
+          });
+        }
+      );
+      request.setTimeout(Math.min(1e3, timeoutMs), () => request.destroy());
+      request.once("error", retry);
+    };
+    check();
+  });
+}
 
 // src/host/replacement-module-handler.ts
 var import_promises = __toESM(require("node:fs/promises"), 1);
-var import_node_path3 = __toESM(require("node:path"), 1);
+var import_node_path4 = __toESM(require("node:path"), 1);
 var import_esbuild = require("esbuild");
+
+// src/backend-origin.ts
+function normalizeHostname(hostname) {
+  return hostname.replace(/^\[|\]$/g, "").toLowerCase();
+}
+function isLoopbackHost(hostname) {
+  const normalized = normalizeHostname(hostname);
+  return normalized === "localhost" || normalized.endsWith(".localhost") || normalized === "0.0.0.0" || normalized === "::1" || /^127(?:\.\d{1,3}){3}$/.test(normalized);
+}
+
+// src/host/replacement-module-handler.ts
 var REPLACEMENT_MODULE_ROUTE = "/__sootsim-replacement-module";
 var REPLACEMENT_RUNTIME_PREFIX = "/__sootsim-replacement-runtime";
 function getReplacementLoader(filePath) {
-  const ext = import_node_path3.default.extname(filePath).toLowerCase();
+  const ext = import_node_path4.default.extname(filePath).toLowerCase();
   switch (ext) {
     case ".js":
       return "js";
@@ -2988,12 +3152,30 @@ export const Appearance = rn.Appearance
 `;
 }
 function sendJavaScript(req, res, source) {
+  const origin = req.headers.origin;
+  let allowedOrigin;
+  if (origin) {
+    try {
+      if (isLoopbackHost(new URL(origin).hostname)) allowedOrigin = origin;
+    } catch {
+    }
+  }
   res.writeHead(200, {
     "Content-Type": "application/javascript; charset=utf-8",
-    "Cache-Control": "no-cache"
+    "Cache-Control": "no-cache",
+    ...allowedOrigin ? { "Access-Control-Allow-Origin": allowedOrigin, Vary: "Origin" } : {}
   });
   res.end(req.method === "HEAD" ? void 0 : source);
 }
+function isReplacementModuleRequestUrl(rawUrl) {
+  if (!rawUrl) return false;
+  try {
+    const pathname = new URL(rawUrl, "http://rnx.local").pathname;
+    return pathname === REPLACEMENT_MODULE_ROUTE || pathname.startsWith(`${REPLACEMENT_RUNTIME_PREFIX}/`);
+  } catch {
+    return false;
+  }
+}
 async function handleReplacementModuleRequest(req, res, options = {}) {
   const rawUrl = req.url || "";
   let url;
@@ -3002,6 +3184,23 @@ async function handleReplacementModuleRequest(req, res, options = {}) {
   } catch {
     return false;
   }
+  if (options.requireLoopbackOrigin) {
+    const origin = req.headers.origin;
+    const remoteAddress = req.socket.remoteAddress?.replace(/^::ffff:/, "");
+    let allowed = Boolean(remoteAddress && isLoopbackHost(remoteAddress));
+    if (allowed && origin) {
+      try {
+        allowed = isLoopbackHost(new URL(origin).hostname);
+      } catch {
+        allowed = false;
+      }
+    }
+    if (!allowed) {
+      res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end("replacement modules are available only to loopback origins");
+      return true;
+    }
+  }
   if (url.pathname === `${REPLACEMENT_RUNTIME_PREFIX}/react`) {
     sendJavaScript(req, res, reactRuntimeSource(options.reactBridgeUrl));
     return true;
@@ -3011,6 +3210,11 @@ async function handleReplacementModuleRequest(req, res, options = {}) {
     return true;
   }
   if (url.pathname !== REPLACEMENT_MODULE_ROUTE) return false;
+  if (options.requestToken && url.searchParams.get("token") !== options.requestToken) {
+    res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+    res.end("replacement module request token is invalid");
+    return true;
+  }
   const targetPath = url.searchParams.get("path");
   if (!targetPath) {
     res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
@@ -3023,17 +3227,42 @@ async function handleReplacementModuleRequest(req, res, options = {}) {
     res.end("replacement files must be .js, .jsx, .ts, or .tsx");
     return true;
   }
+  if (!import_node_path4.default.isAbsolute(targetPath)) {
+    res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+    res.end("replacement file path must be absolute");
+    return true;
+  }
+  let resolvedProjectRoot;
+  if (options.projectRoot) {
+    const lexicalProjectRoot = import_node_path4.default.resolve(options.projectRoot);
+    resolvedProjectRoot = await import_promises.default.realpath(options.projectRoot);
+    const lexicalTarget = import_node_path4.default.relative(lexicalProjectRoot, targetPath);
+    if (lexicalTarget.startsWith("..") || import_node_path4.default.isAbsolute(lexicalTarget)) {
+      res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end("replacement file must be inside the project root");
+      return true;
+    }
+  }
+  let resolvedTargetPath;
   try {
-    await import_promises.default.access(targetPath);
+    resolvedTargetPath = await import_promises.default.realpath(targetPath);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
     res.end(`replacement file not found: ${message}`);
     return true;
   }
+  if (resolvedProjectRoot) {
+    const relativeTarget = import_node_path4.default.relative(resolvedProjectRoot, resolvedTargetPath);
+    if (relativeTarget.startsWith("..") || import_node_path4.default.isAbsolute(relativeTarget)) {
+      res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end("replacement file must be inside the project root");
+      return true;
+    }
+  }
   try {
     const result = await (0, import_esbuild.build)({
-      entryPoints: [targetPath],
+      entryPoints: [resolvedTargetPath],
       bundle: true,
       write: false,
       format: "esm",
@@ -3220,11 +3449,25 @@ function rnxPlugin(options = {}) {
     configureServer(server) {
       if (options.enabled === false) return;
       const bundleUrl = options.bundleUrl || "/node_modules/one/metro-entry.bundle?platform=ios&dev=true&minify=false";
+      const appName = resolveRnxDesktopAppName(options.open, server.config.root);
+      const replacementToken = (0, import_node_crypto2.randomUUID)();
+      const configuredPort = server.config.server.port || 8081;
+      const listeningPort = () => {
+        const address = server.httpServer?.address();
+        return address && typeof address === "object" ? address.port : configuredPort;
+      };
+      const bundleForPort = (port2) => tagRnxBundleForPlugin(
+        bundleUrl,
+        `http://localhost:${port2}`,
+        replacementToken,
+        server.config.root,
+        appName
+      );
       const buildShellHtml = (runtimeRoot) => {
         const html = import_fs4.default.readFileSync(import_path3.default.join(runtimeRoot, "index.html"), "utf8");
         const lock = readDaemonLockfile();
         const bridgePort = lock && isDaemonLockfileFresh(lock) && lock.bridgePort > 0 ? lock.bridgePort : DEFAULT_SOOTSIM_BRIDGE_PORT;
-        const inject = `<script>(function(){var u=new URL(location.href);if(!u.searchParams.has('bundle'))u.searchParams.set('bundle',${JSON.stringify(bundleUrl)});window.__sootsimBridgePort=${bridgePort};history.replaceState(null,'','${prefix2}/'+u.search)})()</script>`;
+        const inject = `<script>(function(){var u=new URL(location.href);if(!u.searchParams.has('bundle'))u.searchParams.set('bundle',${JSON.stringify(bundleForPort(listeningPort()))});window.__sootsimBridgePort=${bridgePort};history.replaceState(null,'','${prefix2}/'+u.search)})()</script>`;
         return html.replace("</head>", inject + "</head>");
       };
       server.middlewares.use((req, res, next) => {
@@ -3245,8 +3488,9 @@ function rnxPlugin(options = {}) {
       });
       server.middlewares.use((req, res, next) => {
         if ((req.url || "").split("?")[0] !== "/__server-scan") return next();
-        const scanPort = server.config.server.port || 8081;
-        const absoluteBundleUrl = bundleUrl.startsWith("http") ? bundleUrl : `http://localhost:${scanPort}${bundleUrl}`;
+        const scanPort = listeningPort();
+        const pluginBundleUrl = bundleForPort(scanPort);
+        const absoluteBundleUrl = pluginBundleUrl.startsWith("http") ? pluginBundleUrl : `http://localhost:${scanPort}${pluginBundleUrl}`;
         res.setHeader("content-type", "application/json");
         res.end(
           JSON.stringify([
@@ -3254,13 +3498,18 @@ function rnxPlugin(options = {}) {
               port: scanPort,
               framework: "one",
               bundleUrl: absoluteBundleUrl,
+              ...appName ? { projectName: appName } : {},
               lastSeen: Date.now()
             }
           ])
         );
       });
       server.middlewares.use((req, res, next) => {
-        void handleReplacementModuleRequest(req, res).then((handled) => {
+        void handleReplacementModuleRequest(req, res, {
+          projectRoot: server.config.root,
+          requestToken: replacementToken,
+          requireLoopbackOrigin: true
+        }).then((handled) => {
           if (!handled) next();
         });
       });
@@ -3307,23 +3556,16 @@ function rnxPlugin(options = {}) {
         }
         next();
       });
-      const port = server.config.server.port || 8081;
+      const port = configuredPort;
       const sootsimUrl = `http://localhost:${port}${prefix2}/`;
       console.log(`[rnx] serving at ${sootsimUrl}`);
-      if (options.open && !process.env.CI && !process.env.SOOTSIM_NO_OPEN) {
+      if (appName && !process.env.CI && !process.env.SOOTSIM_NO_OPEN) {
         server.httpServer?.once("listening", () => {
-          const packageRoot = import_path3.default.resolve(
-            import_path3.default.dirname((0, import_url2.fileURLToPath)(__sootsim_import_meta_url)),
-            ".."
+          const openPort = listeningPort();
+          launchRnxDesktop(
+            resolveRnxDesktopLaunchTarget(openPort, bundleForPort(openPort)),
+            appName
           );
-          const binPath = import_path3.default.join(packageRoot, "dist-cli", "bin.js");
-          const openPort = server.config.server.port || port;
-          console.log(`[rnx] opening simulator for :${openPort}`);
-          (0, import_child_process2.spawn)(process.execPath, [binPath, "open", String(openPort)], {
-            detached: true,
-            stdio: "ignore",
-            windowsHide: true
-          }).unref();
         });
       }
     }
@@ -3333,6 +3575,7 @@ function rnxPlugin(options = {}) {
 // src/metro-plugin.ts
 var import_fs5 = __toESM(require("fs"), 1);
 var import_module2 = require("module");
+var import_node_crypto3 = require("node:crypto");
 var import_path4 = __toESM(require("path"), 1);
 
 // src/metro-production-bundle.ts
@@ -3423,12 +3666,22 @@ function prependRNXModulePaths(result, graph, options, projectRoot) {
   return typeof result === "string" ? result + footer : { ...result, code: result.code + footer };
 }
 function withRNX(config, options = {}) {
-  if (!options.devServer && !options.productionBundles) return config;
-  const bundleUrl = options.bundleUrl || "/index.bundle?platform=ios&dev=true&hot=true&minify=false";
+  if (!options.devServer && !options.open && !options.productionBundles) return config;
+  const cfgProjectRoot = config.projectRoot || process.cwd();
+  const appName = resolveRnxDesktopAppName(options.open, cfgProjectRoot);
+  const configuredBundleUrl = options.bundleUrl || "/index.bundle?platform=ios&dev=true&hot=true&minify=false";
   const cfgServer = config.server;
+  const port = resolveMetroPort(cfgServer);
+  const metroServerId = (0, import_node_crypto3.randomUUID)();
+  const bundleUrl = tagRnxBundleForPlugin(
+    configuredBundleUrl,
+    `http://localhost:${port}`,
+    metroServerId,
+    cfgProjectRoot,
+    appName
+  );
   const cfgResolver = config.resolver;
   const cfgSerializer = config.serializer;
-  const cfgProjectRoot = config.projectRoot || process.cwd();
   const existingEnhance = cfgServer?.enhanceMiddleware;
   const existingResolveRequest = cfgResolver?.resolveRequest;
   const existingSerializer = cfgSerializer?.customSerializer;
@@ -3485,8 +3738,35 @@ function withRNX(config, options = {}) {
       }
       const server = connect2();
       server.use((req, res, next) => {
+        if (isReplacementModuleRequestUrl(req.url)) {
+          void handleReplacementModuleRequest(req, res, {
+            projectRoot: cfgProjectRoot,
+            requestToken: metroServerId,
+            requireLoopbackOrigin: true
+          }).then((handled) => {
+            if (!handled) next();
+          });
+          return;
+        }
         const url = req.url || "";
         const pathname = url.split("?")[0];
+        if (pathname === "/__server-scan") {
+          const absoluteBundleUrl = bundleUrl.startsWith("http") ? bundleUrl : `http://localhost:${port}${bundleUrl}`;
+          res.setHeader("content-type", "application/json");
+          res.end(
+            JSON.stringify([
+              {
+                port,
+                framework: "metro",
+                rnxServerId: metroServerId,
+                bundleUrl: absoluteBundleUrl,
+                ...appName ? { projectName: appName } : {},
+                lastSeen: Date.now()
+              }
+            ])
+          );
+          return;
+        }
         const runtimeRoot = resolveRuntimeRootForRequestHost(req.headers?.host);
         if (!runtimeRoot) {
           if (pathname === prefix || pathname === prefix + "/") {
@@ -3521,7 +3801,7 @@ function withRNX(config, options = {}) {
             let html = import_fs5.default.readFileSync(htmlPath, "utf8");
             html = html.replace(
               "</head>",
-              `<script>history.replaceState(null,'','${prefix}/?bundle=${encodeURIComponent(bundleUrl)}')</script></head>`
+              `<script>(function(){var u=new URL(location.href);if(!u.searchParams.has('bundle'))u.searchParams.set('bundle',${JSON.stringify(bundleUrl)});history.replaceState(null,'','${prefix}/'+u.search)})()</script></head>`
             );
             res.setHeader("content-type", "text/html");
             res.end(html);
@@ -3535,22 +3815,42 @@ function withRNX(config, options = {}) {
       return server;
     }
   };
+  if (appName && !process.env.CI && !process.env.SOOTSIM_NO_OPEN) {
+    void openRnxDesktopWhenMetroIsReady({
+      port,
+      bundleUrl: resolveRnxDesktopLaunchTarget(port, bundleUrl),
+      appName,
+      projectRoot: cfgProjectRoot,
+      serverId: metroServerId
+    });
+  }
   return {
     ...config,
     ...productionConfig,
-    ...options.devServer ? { server: serverConfig } : {}
+    ...options.devServer || options.open ? { server: serverConfig } : {}
   };
 }
+function resolveMetroPort(server) {
+  const inlinePort = process.argv.find((arg) => arg.startsWith("--port="))?.slice(7);
+  const portIndex = process.argv.indexOf("--port");
+  const splitPort = portIndex >= 0 ? process.argv[portIndex + 1] : void 0;
+  const rawPort = inlinePort || splitPort || process.env.RCT_METRO_PORT || server?.port || 8081;
+  const port = Number(rawPort);
+  if (!Number.isInteger(port) || port <= 0) {
+    throw new Error(`rnx: Metro port must be a positive integer, got ${rawPort}`);
+  }
+  return port;
+}
 var metro_plugin_default = withRNX;
 
 // src/jump-to-source-babel.ts
-function normalizeSourcePath(path7) {
-  const queryStart = path7.indexOf("?");
-  const clean = queryStart >= 0 ? path7.slice(0, queryStart) : path7;
+function normalizeSourcePath(path8) {
+  const queryStart = path8.indexOf("?");
+  const clean = queryStart >= 0 ? path8.slice(0, queryStart) : path8;
   return clean.replace(/\\/g, "/");
 }
-function matchesPath(path7, matcher) {
-  return typeof matcher === "string" ? path7.includes(matcher) : matcher.test(path7);
+function matchesPath(path8, matcher) {
+  return typeof matcher === "string" ? path8.includes(matcher) : matcher.test(path8);
 }
 function shouldStampFile(filename, options) {
   const normalized = normalizeSourcePath(filename);
@@ -3583,11 +3883,11 @@ function sootsimJumpToSourceBabelPlugin(api, options = {}) {
   return {
     name: "sootsim-jump-to-source",
     visitor: {
-      JSXOpeningElement(path7, state) {
+      JSXOpeningElement(path8, state) {
         if (options.enabled === false) return;
         const filename = state.file?.opts?.filename;
         if (!filename || !shouldStampFile(filename, options)) return;
-        const node = path7.node;
+        const node = path8.node;
         const tagName = getJSXName(node.name);
         if (!tagName || tagName === "Fragment" || tagName.endsWith(".Fragment")) return;
         if (hasAttribute(node, attrName)) return;

package/dist-lib/jump-to-source-babel.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.343 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.345 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;

package/dist-lib/menu.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.343 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.345 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;