rnxsim 0.1.343 → 0.1.345

package/src/home-paths.ts

@@ -233,8 +233,8 @@ export function readPrivacyPreferences(): PrivacyPreferences {
   const productAnalytics = settings?.productAnalytics
   const crashReports = settings?.crashReports
   return {
-    productAnalytics: typeof productAnalytics === 'boolean' ? productAnalytics : true,
-    crashReports: typeof crashReports === 'boolean' ? crashReports : true,
+    productAnalytics: typeof productAnalytics === 'boolean' ? productAnalytics : false,
+    crashReports: typeof crashReports === 'boolean' ? crashReports : false,
     configured:
       typeof productAnalytics === 'boolean' && typeof crashReports === 'boolean',
   }
@@ -401,6 +401,13 @@ export interface DevBridgeLockfile {
 }
 
 const DAEMON_LOCKFILE_MAX_BYTES = 16 * 1024
+const DAEMON_CLAIM_STALE_MS = 30_000
+
+interface DaemonClaim {
+  pid: number
+  startedAt: number
+  createdAt: number
+}
 
 export function readDaemonLockfile(): DaemonLockfile | null {
   try {
@@ -549,9 +556,28 @@ export function readLiveRuntimeVersions(): string[] {
 
 export function writeDaemonLockfile(data: DaemonLockfile): void {
   ensureSootsimHome()
-  const tmp = `${daemonLockfilePath()}.tmp`
+  const lockfilePath = daemonLockfilePath()
+  const existing = readDaemonLockfile()
+  if (!existing) {
+    if (createDaemonLockfileExclusive(data)) return
+    throw new Error('another rnx daemon claimed the lockfile before this write')
+  }
+  if (!sameDaemonOwner(existing, data)) {
+    throw new Error('refusing to overwrite another rnx daemon lockfile')
+  }
+  const tmp = `${lockfilePath}.${data.pid}.${randomUUID()}.tmp`
   fs.writeFileSync(tmp, `${JSON.stringify(data, null, 2)}\n`, 'utf8')
-  fs.renameSync(tmp, daemonLockfilePath())
+  try {
+    const current = readDaemonLockfile()
+    if (!current || !sameDaemonOwner(current, data)) {
+      throw new Error('rnx daemon lock ownership changed during heartbeat')
+    }
+    fs.renameSync(tmp, lockfilePath)
+  } finally {
+    try {
+      fs.unlinkSync(tmp)
+    } catch {}
+  }
 }
 
 export function writeDevBridgeLockfile(data: DevBridgeLockfile): void {
@@ -562,23 +588,150 @@ export function writeDevBridgeLockfile(data: DevBridgeLockfile): void {
   fs.renameSync(tmp, lockfilePath)
 }
 
-/** try to claim the lockfile atomically on daemon boot. returns true if
- *  we now own it. returns false when another fresh daemon beat us to the
- *  punch — callers should refuse to start. a stale lockfile (dead pid or
- *  old heartbeat) is overwritten. race-safe: the final fs.renameSync is
- *  atomic on POSIX and on NTFS. */
+function sameDaemonOwner(
+  left: Pick<DaemonLockfile, 'pid' | 'startedAt'>,
+  right: Pick<DaemonLockfile, 'pid' | 'startedAt'>,
+): boolean {
+  return left.pid === right.pid && left.startedAt === right.startedAt
+}
+
+function isAlreadyExists(error: unknown): boolean {
+  return (
+    error instanceof Error && 'code' in error && Reflect.get(error, 'code') === 'EEXIST'
+  )
+}
+
+function createDaemonLockfileExclusive(data: DaemonLockfile): boolean {
+  const lockfilePath = daemonLockfilePath()
+  const tmp = `${lockfilePath}.${data.pid}.${randomUUID()}.claim`
+  fs.writeFileSync(tmp, `${JSON.stringify(data, null, 2)}\n`, 'utf8')
+  try {
+    fs.linkSync(tmp, lockfilePath)
+    return true
+  } catch (error) {
+    if (isAlreadyExists(error)) return false
+    throw error
+  } finally {
+    try {
+      fs.unlinkSync(tmp)
+    } catch {}
+  }
+}
+
+function daemonClaimPath(): string {
+  return `${daemonLockfilePath()}.claim`
+}
+
+function parseDaemonClaim(raw: string): DaemonClaim | null {
+  try {
+    const value: unknown = JSON.parse(raw)
+    if (
+      value !== null &&
+      typeof value === 'object' &&
+      typeof Reflect.get(value, 'pid') === 'number' &&
+      typeof Reflect.get(value, 'startedAt') === 'number' &&
+      typeof Reflect.get(value, 'createdAt') === 'number'
+    ) {
+      return {
+        pid: Reflect.get(value, 'pid'),
+        startedAt: Reflect.get(value, 'startedAt'),
+        createdAt: Reflect.get(value, 'createdAt'),
+      }
+    }
+  } catch {}
+  return null
+}
+
+function readDaemonClaim(): DaemonClaim | null {
+  try {
+    return parseDaemonClaim(fs.readFileSync(daemonClaimPath(), 'utf8'))
+  } catch {
+    return null
+  }
+}
+
+function isDaemonClaimFresh(claim: DaemonClaim, now = Date.now()): boolean {
+  if (now - claim.createdAt > DAEMON_CLAIM_STALE_MS) return false
+  try {
+    process.kill(claim.pid, 0)
+    return true
+  } catch {
+    return false
+  }
+}
+
+function acquireDaemonClaim(data: DaemonLockfile): boolean {
+  const claim: DaemonClaim = {
+    pid: data.pid,
+    startedAt: data.startedAt,
+    createdAt: Date.now(),
+  }
+  const serialized = `${JSON.stringify(claim)}\n`
+  for (let attempt = 0; attempt < 8; attempt++) {
+    try {
+      fs.writeFileSync(daemonClaimPath(), serialized, { encoding: 'utf8', flag: 'wx' })
+      return true
+    } catch (error) {
+      if (!isAlreadyExists(error)) throw error
+    }
+    const existing = readDaemonClaim()
+    if (existing && sameDaemonOwner(existing, claim)) return true
+    if (existing && isDaemonClaimFresh(existing)) return false
+    let before: string
+    try {
+      before = fs.readFileSync(daemonClaimPath(), 'utf8')
+      const latest = parseDaemonClaim(before)
+      if (latest && isDaemonClaimFresh(latest)) return false
+      if (fs.readFileSync(daemonClaimPath(), 'utf8') !== before) continue
+      fs.unlinkSync(daemonClaimPath())
+    } catch {}
+  }
+  return false
+}
+
+function releaseDaemonClaim(owner: Pick<DaemonLockfile, 'pid' | 'startedAt'>): void {
+  try {
+    const claim = readDaemonClaim()
+    if (!claim || !sameDaemonOwner(claim, owner)) return
+    fs.unlinkSync(daemonClaimPath())
+  } catch {}
+}
+
+/** try to claim the lockfile atomically on daemon boot. a short-lived,
+ *  process-owned election file serializes concurrent fallback-port binds;
+ *  the complete lock snapshot is then installed with an exclusive hard link. */
 export function claimDaemonLockfile(data: DaemonLockfile): boolean {
   ensureSootsimHome()
-  const existing = readDaemonLockfile()
-  if (existing && isDaemonLockfileFresh(existing) && existing.pid !== data.pid) {
-    return false
+  if (!acquireDaemonClaim(data)) return false
+  try {
+    const existing = readDaemonLockfile()
+    if (existing && sameDaemonOwner(existing, data)) {
+      writeDaemonLockfile(data)
+      return true
+    }
+    if (existing && isDaemonLockfileFresh(existing)) return false
+    if (existing) {
+      const latest = readDaemonLockfile()
+      if (!latest || !sameDaemonOwner(latest, existing)) return false
+      if (isDaemonLockfileFresh(latest)) return false
+      try {
+        fs.unlinkSync(daemonLockfilePath())
+      } catch {
+        return false
+      }
+    }
+    return createDaemonLockfileExclusive(data)
+  } finally {
+    releaseDaemonClaim(data)
   }
-  writeDaemonLockfile(data)
-  return true
 }
 
-export function removeDaemonLockfile(): void {
+export function removeDaemonLockfile(
+  owner: Pick<DaemonLockfile, 'pid' | 'startedAt'>,
+): void {
   try {
+    const lockfile = readDaemonLockfile()
+    if (!lockfile || !sameDaemonOwner(lockfile, owner)) return
     fs.unlinkSync(daemonLockfilePath())
   } catch {}
 }

package/src/host/bridge-host.ts

@@ -1525,7 +1525,7 @@ export class SootSimBridgeHost {
   removeLockfile() {
     if (!this.shouldWriteLockfile) return
     try {
-      removeDaemonLockfile()
+      removeDaemonLockfile({ pid: process.pid, startedAt: this.startedAt })
     } catch {}
   }
 
@@ -2229,7 +2229,7 @@ export class SootSimBridgeHost {
     }
     if (this.shouldWriteLockfile) {
       try {
-        removeDaemonLockfile()
+        removeDaemonLockfile({ pid: process.pid, startedAt: this.startedAt })
       } catch {}
     }
     if (this.shouldWriteDevLockfile) {

package/src/host/replacement-module-handler.ts

@@ -1,6 +1,7 @@
 import fs from 'node:fs/promises'
 import path from 'node:path'
 import { build } from 'esbuild'
+import { isLoopbackHost } from '../backend-origin.ts'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 
 export const REPLACEMENT_MODULE_ROUTE = '/__sootsim-replacement-module'
@@ -8,6 +9,9 @@ export const REPLACEMENT_RUNTIME_PREFIX = '/__sootsim-replacement-runtime'
 
 export interface ReplacementModuleHandlerOptions {
   reactBridgeUrl?: string
+  projectRoot?: string
+  requireLoopbackOrigin?: boolean
+  requestToken?: string
 }
 
 function getReplacementLoader(filePath: string): 'js' | 'jsx' | 'ts' | 'tsx' | null {
@@ -113,9 +117,19 @@ export const Appearance = rn.Appearance
 }
 
 function sendJavaScript(req: IncomingMessage, res: ServerResponse, source: string): void {
+  const origin = req.headers.origin
+  let allowedOrigin: string | undefined
+  if (origin) {
+    try {
+      if (isLoopbackHost(new URL(origin).hostname)) allowedOrigin = origin
+    } catch {}
+  }
   res.writeHead(200, {
     'Content-Type': 'application/javascript; charset=utf-8',
     'Cache-Control': 'no-cache',
+    ...(allowedOrigin
+      ? { 'Access-Control-Allow-Origin': allowedOrigin, Vary: 'Origin' }
+      : {}),
   })
   res.end(req.method === 'HEAD' ? undefined : source)
 }
@@ -146,6 +160,24 @@ export async function handleReplacementModuleRequest(
     return false
   }
 
+  if (options.requireLoopbackOrigin) {
+    const origin = req.headers.origin
+    const remoteAddress = req.socket.remoteAddress?.replace(/^::ffff:/, '')
+    let allowed = Boolean(remoteAddress && isLoopbackHost(remoteAddress))
+    if (allowed && origin) {
+      try {
+        allowed = isLoopbackHost(new URL(origin).hostname)
+      } catch {
+        allowed = false
+      }
+    }
+    if (!allowed) {
+      res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' })
+      res.end('replacement modules are available only to loopback origins')
+      return true
+    }
+  }
+
   if (url.pathname === `${REPLACEMENT_RUNTIME_PREFIX}/react`) {
     sendJavaScript(req, res, reactRuntimeSource(options.reactBridgeUrl))
     return true
@@ -156,6 +188,12 @@ export async function handleReplacementModuleRequest(
   }
   if (url.pathname !== REPLACEMENT_MODULE_ROUTE) return false
 
+  if (options.requestToken && url.searchParams.get('token') !== options.requestToken) {
+    res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' })
+    res.end('replacement module request token is invalid')
+    return true
+  }
+
   const targetPath = url.searchParams.get('path')
   if (!targetPath) {
     res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' })
@@ -170,8 +208,27 @@ export async function handleReplacementModuleRequest(
     return true
   }
 
+  if (!path.isAbsolute(targetPath)) {
+    res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' })
+    res.end('replacement file path must be absolute')
+    return true
+  }
+
+  let resolvedProjectRoot: string | undefined
+  if (options.projectRoot) {
+    const lexicalProjectRoot = path.resolve(options.projectRoot)
+    resolvedProjectRoot = await fs.realpath(options.projectRoot)
+    const lexicalTarget = path.relative(lexicalProjectRoot, targetPath)
+    if (lexicalTarget.startsWith('..') || path.isAbsolute(lexicalTarget)) {
+      res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' })
+      res.end('replacement file must be inside the project root')
+      return true
+    }
+  }
+
+  let resolvedTargetPath: string
   try {
-    await fs.access(targetPath)
+    resolvedTargetPath = await fs.realpath(targetPath)
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error)
     res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' })
@@ -179,9 +236,18 @@ export async function handleReplacementModuleRequest(
     return true
   }
 
+  if (resolvedProjectRoot) {
+    const relativeTarget = path.relative(resolvedProjectRoot, resolvedTargetPath)
+    if (relativeTarget.startsWith('..') || path.isAbsolute(relativeTarget)) {
+      res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' })
+      res.end('replacement file must be inside the project root')
+      return true
+    }
+  }
+
   try {
     const result = await build({
-      entryPoints: [targetPath],
+      entryPoints: [resolvedTargetPath],
       bundle: true,
       write: false,
       format: 'esm',

package/src/metro-plugin.ts

@@ -10,7 +10,19 @@
 
 import fs from 'fs'
 import { createRequire } from 'module'
+import { randomUUID } from 'node:crypto'
 import path from 'path'
+import {
+  openRnxDesktopWhenMetroIsReady,
+  resolveRnxDesktopAppName,
+  resolveRnxDesktopLaunchTarget,
+  tagRnxBundleForPlugin,
+  type RnxDesktopOpenOption,
+} from './dev-server-open'
+import {
+  handleReplacementModuleRequest,
+  isReplacementModuleRequestUrl,
+} from './host/replacement-module-handler'
 import {
   RNXSIM_METRO_PRODUCTION_BUNDLE_OPTION,
   createRNXMetroModulePathsFooter,
@@ -79,6 +91,7 @@ type MetroSerializer = (
 export interface RNXMetroOptions {
   bundleUrl?: string
   devServer?: boolean
+  open?: RnxDesktopOpenOption
   productionBundles?: boolean
 }
 
@@ -97,6 +110,7 @@ type MetroConfigWithServer = {
   }
   server?: {
     enhanceMiddleware?: (middleware: unknown, server: unknown) => unknown
+    port?: number
     [key: string]: unknown
   }
 }
@@ -210,15 +224,25 @@ export function withRNX<T extends Record<string, unknown>>(
   config: T,
   options: RNXMetroOptions = {},
 ): T {
-  if (!options.devServer && !options.productionBundles) return config
+  if (!options.devServer && !options.open && !options.productionBundles) return config
 
-  const bundleUrl =
+  const cfgProjectRoot = (config as MetroConfigWithServer).projectRoot || process.cwd()
+  const appName = resolveRnxDesktopAppName(options.open, cfgProjectRoot)
+  const configuredBundleUrl =
     options.bundleUrl || '/index.bundle?platform=ios&dev=true&hot=true&minify=false'
 
   const cfgServer = (config as MetroConfigWithServer).server
+  const port = resolveMetroPort(cfgServer)
+  const metroServerId = randomUUID()
+  const bundleUrl = tagRnxBundleForPlugin(
+    configuredBundleUrl,
+    `http://localhost:${port}`,
+    metroServerId,
+    cfgProjectRoot,
+    appName,
+  )
   const cfgResolver = (config as MetroConfigWithServer).resolver
   const cfgSerializer = (config as MetroConfigWithServer).serializer
-  const cfgProjectRoot = (config as MetroConfigWithServer).projectRoot || process.cwd()
   const existingEnhance = cfgServer?.enhanceMiddleware
   const existingResolveRequest = cfgResolver?.resolveRequest
   const existingSerializer = cfgSerializer?.customSerializer
@@ -299,9 +323,40 @@ export function withRNX<T extends Record<string, unknown>>(
       const server = connect()
 
       server.use((req: any, res: any, next: any) => {
+        if (isReplacementModuleRequestUrl(req.url)) {
+          void handleReplacementModuleRequest(req, res, {
+            projectRoot: cfgProjectRoot,
+            requestToken: metroServerId,
+            requireLoopbackOrigin: true,
+          }).then((handled) => {
+            if (!handled) next()
+          })
+          return
+        }
+
         const url = req.url || ''
         const pathname = url.split('?')[0]
 
+        if (pathname === '/__server-scan') {
+          const absoluteBundleUrl = bundleUrl.startsWith('http')
+            ? bundleUrl
+            : `http://localhost:${port}${bundleUrl}`
+          res.setHeader('content-type', 'application/json')
+          res.end(
+            JSON.stringify([
+              {
+                port,
+                framework: 'metro',
+                rnxServerId: metroServerId,
+                bundleUrl: absoluteBundleUrl,
+                ...(appName ? { projectName: appName } : {}),
+                lastSeen: Date.now(),
+              },
+            ]),
+          )
+          return
+        }
+
         const runtimeRoot = resolveRuntimeRootForRequestHost(req.headers?.host)
 
         if (!runtimeRoot) {
@@ -350,7 +405,7 @@ export function withRNX<T extends Record<string, unknown>>(
             let html = fs.readFileSync(htmlPath, 'utf8')
             html = html.replace(
               '</head>',
-              `<script>history.replaceState(null,'','${prefix}/?bundle=${encodeURIComponent(bundleUrl)}')</script></head>`,
+              `<script>(function(){var u=new URL(location.href);if(!u.searchParams.has('bundle'))u.searchParams.set('bundle',${JSON.stringify(bundleUrl)});history.replaceState(null,'','${prefix}/'+u.search)})()</script></head>`,
             )
             res.setHeader('content-type', 'text/html')
             res.end(html)
@@ -368,11 +423,34 @@ export function withRNX<T extends Record<string, unknown>>(
     },
   }
 
+  if (appName && !process.env.CI && !process.env.SOOTSIM_NO_OPEN) {
+    void openRnxDesktopWhenMetroIsReady({
+      port,
+      bundleUrl: resolveRnxDesktopLaunchTarget(port, bundleUrl),
+      appName,
+      projectRoot: cfgProjectRoot,
+      serverId: metroServerId,
+    })
+  }
+
   return {
     ...config,
     ...productionConfig,
-    ...(options.devServer ? { server: serverConfig } : {}),
+    ...(options.devServer || options.open ? { server: serverConfig } : {}),
   } as T
 }
 
+function resolveMetroPort(server: MetroConfigWithServer['server']): number {
+  const inlinePort = process.argv.find((arg) => arg.startsWith('--port='))?.slice(7)
+  const portIndex = process.argv.indexOf('--port')
+  const splitPort = portIndex >= 0 ? process.argv[portIndex + 1] : undefined
+  const rawPort =
+    inlinePort || splitPort || process.env.RCT_METRO_PORT || server?.port || 8081
+  const port = Number(rawPort)
+  if (!Number.isInteger(port) || port <= 0) {
+    throw new Error(`rnx: Metro port must be a positive integer, got ${rawPort}`)
+  }
+  return port
+}
+
 export default withRNX

package/src/native-dev-bundle-url.ts

@@ -1,3 +1,5 @@
+import { isLoopbackHost } from './backend-origin'
+
 // canonical entry path for a plain Metro packager that serves no Expo
 // manifest. only used when `/status` confirms `packager-status:running` and
 // the server reports nothing else — never as a guess for a manifest-capable
@@ -13,6 +15,26 @@ function isNativeDevBundlePath(pathname: string): boolean {
   return pathname.endsWith('.bundle')
 }
 
+// expo can advertise an IPv4 loopback launch URL even when its --localhost
+// listener resolved to IPv6 only. keep the manifest's path and query, but bind
+// its loopback host to the base URL that answered the discovery request.
+export function alignLoopbackBundleUrlWithProbe(
+  bundleUrl: string,
+  probeBaseUrl: string,
+): string {
+  try {
+    const bundle = new URL(bundleUrl)
+    const probe = new URL(probeBaseUrl)
+    if (!isLoopbackHost(bundle.hostname) || !isLoopbackHost(probe.hostname)) {
+      return bundleUrl
+    }
+    bundle.hostname = probe.hostname
+    return bundle.toString()
+  } catch {
+    return bundleUrl
+  }
+}
+
 // opt-in (contrastbot preview-recording context only): serve a production
 // minified bundle instead of the default dev=true unminified one. a
 // preview run just records the app — it never needs fast-refresh or dev

package/src/vite-plugin-one.ts

@@ -6,11 +6,17 @@
 //   import { rnxPlugin } from 'rnxsim/vite'
 //   export default { plugins: [one(), rnxPlugin()] }
 
-import { spawn } from 'child_process'
 import fs from 'fs'
+import { randomUUID } from 'node:crypto'
 import path from 'path'
-import { fileURLToPath } from 'url'
 import { DEFAULT_SOOTSIM_BRIDGE_PORT } from './bridge-constants'
+import {
+  launchRnxDesktop,
+  resolveRnxDesktopAppName,
+  resolveRnxDesktopLaunchTarget,
+  tagRnxBundleForPlugin,
+  type RnxDesktopOpenOption,
+} from './dev-server-open'
 import { isDaemonLockfileFresh, readDaemonLockfile } from './home-paths'
 import { handleReplacementModuleRequest } from './host/replacement-module-handler'
 import {
@@ -31,7 +37,7 @@ export interface RnxPluginOptions {
   enabled?: boolean
   // launch the sootsim simulator loading this server's bundle once the dev
   // server is listening. skipped when CI or SOOTSIM_NO_OPEN is set.
-  open?: boolean
+  open?: RnxDesktopOpenOption
 }
 
 export function rnxPlugin(options: RnxPluginOptions = {}): Plugin {
@@ -45,6 +51,21 @@ export function rnxPlugin(options: RnxPluginOptions = {}): Plugin {
       const bundleUrl =
         options.bundleUrl ||
         '/node_modules/one/metro-entry.bundle?platform=ios&dev=true&minify=false'
+      const appName = resolveRnxDesktopAppName(options.open, server.config.root)
+      const replacementToken = randomUUID()
+      const configuredPort = server.config.server.port || 8081
+      const listeningPort = (): number => {
+        const address = server.httpServer?.address()
+        return address && typeof address === 'object' ? address.port : configuredPort
+      }
+      const bundleForPort = (port: number): string =>
+        tagRnxBundleForPlugin(
+          bundleUrl,
+          `http://localhost:${port}`,
+          replacementToken,
+          server.config.root,
+          appName,
+        )
 
       // build the shell HTML, injecting the bundle URL (so main.tsx loads this
       // app's bundle) AND window.__sootsimBridgePort. the bridge-port injection
@@ -70,7 +91,7 @@ export function rnxPlugin(options: RnxPluginOptions = {}): Plugin {
         // `open` timed out after 60s.
         const inject =
           `<script>(function(){var u=new URL(location.href);` +
-          `if(!u.searchParams.has('bundle'))u.searchParams.set('bundle',${JSON.stringify(bundleUrl)});` +
+          `if(!u.searchParams.has('bundle'))u.searchParams.set('bundle',${JSON.stringify(bundleForPort(listeningPort()))});` +
           `window.__sootsimBridgePort=${bridgePort};` +
           `history.replaceState(null,'','${prefix}/'+u.search)})()</script>`
         return html.replace('</head>', inject + '</head>')
@@ -107,10 +128,11 @@ export function rnxPlugin(options: RnxPluginOptions = {}): Plugin {
       // internals. shape matches DiscoveredServer enough for the resolver.
       server.middlewares.use((req, res, next) => {
         if ((req.url || '').split('?')[0] !== '/__server-scan') return next()
-        const scanPort = server.config.server.port || 8081
-        const absoluteBundleUrl = bundleUrl.startsWith('http')
-          ? bundleUrl
-          : `http://localhost:${scanPort}${bundleUrl}`
+        const scanPort = listeningPort()
+        const pluginBundleUrl = bundleForPort(scanPort)
+        const absoluteBundleUrl = pluginBundleUrl.startsWith('http')
+          ? pluginBundleUrl
+          : `http://localhost:${scanPort}${pluginBundleUrl}`
         res.setHeader('content-type', 'application/json')
         res.end(
           JSON.stringify([
@@ -118,6 +140,7 @@ export function rnxPlugin(options: RnxPluginOptions = {}): Plugin {
               port: scanPort,
               framework: 'one',
               bundleUrl: absoluteBundleUrl,
+              ...(appName ? { projectName: appName } : {}),
               lastSeen: Date.now(),
             },
           ]),
@@ -125,7 +148,11 @@ export function rnxPlugin(options: RnxPluginOptions = {}): Plugin {
       })
 
       server.middlewares.use((req, res, next) => {
-        void handleReplacementModuleRequest(req, res).then((handled) => {
+        void handleReplacementModuleRequest(req, res, {
+          projectRoot: server.config.root,
+          requestToken: replacementToken,
+          requireLoopbackOrigin: true,
+        }).then((handled) => {
           if (!handled) next()
         })
       })
@@ -189,30 +216,17 @@ export function rnxPlugin(options: RnxPluginOptions = {}): Plugin {
         next()
       })
 
-      const port = server.config.server.port || 8081
+      const port = configuredPort
       const sootsimUrl = `http://localhost:${port}${prefix}/`
       console.log(`[rnx] serving at ${sootsimUrl}`)
 
-      if (options.open && !process.env.CI && !process.env.SOOTSIM_NO_OPEN) {
+      if (appName && !process.env.CI && !process.env.SOOTSIM_NO_OPEN) {
         server.httpServer?.once('listening', () => {
-          // this package's own cli (package.json bin: dist-cli/bin.js),
-          // resolved from this file so it works from both the workspace
-          // source export and the published dist-lib build.
-          const packageRoot = path.resolve(
-            path.dirname(fileURLToPath(import.meta.url)),
-            '..',
+          const openPort = listeningPort()
+          launchRnxDesktop(
+            resolveRnxDesktopLaunchTarget(openPort, bundleForPort(openPort)),
+            appName,
           )
-          const binPath = path.join(packageRoot, 'dist-cli', 'bin.js')
-          const openPort = server.config.server.port || port
-          console.log(`[rnx] opening simulator for :${openPort}`)
-          // invoke the cli script through the current node binary rather
-          // than the bin shim so the same spawn works on windows, macos,
-          // and linux without a shell.
-          spawn(process.execPath, [binPath, 'open', String(openPort)], {
-            detached: true,
-            stdio: 'ignore',
-            windowsHide: true,
-          }).unref()
         })
       }
     },

package/dist-cli/chunks/chunk-44LRQEU3.js

@@ -1,4 +0,0 @@
-/*! rnx v0.1.343 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
-import { createRequire as __sootsimCreateRequire } from 'node:module'
-var require = __sootsimCreateRequire(import.meta.url)
-import{a as c}from"./chunk-W7EXE22C.js";import{J as u,l}from"./chunk-4RKTGL63.js";function m(t){return t.replace(/^\[|\]$/g,"").toLowerCase()}function R(t){let n=m(t);return n==="localhost"||n.endsWith(".localhost")||n==="0.0.0.0"||n==="::1"||/^127(?:\.\d{1,3}){3}$/.test(n)}import o from"fs";import e from"path";import{fileURLToPath as d}from"url";var s;function g(){if(s!==void 0)return s;let t=e.dirname(d(import.meta.url));for(let n=0;n<12&&t!==e.dirname(t);n++){if(o.existsSync(e.join(t,"packages/sootsim-engine/package.json"))&&o.existsSync(e.join(t,"public/sootsim")))return s=t,t;t=e.dirname(t)}return s=null,null}function p(){if(process.env.SOOTSIM_HOME&&u())return null;let t=g();if(!t)return null;let n=e.join(t,"public/sootsim");return o.existsSync(e.join(n,"index.html"))&&o.existsSync(e.join(n,"engine/index.html"))&&o.existsSync(e.join(n,"engine-tenant/worker.js"))?n:null}function x(){let t=p();if(t)return t;let n=u();if(!n)return null;let i=l(n);return o.existsSync(e.join(i,"index.html"))?i:null}var a=".runtime.localhost";function H(t){let n=t.trim();if(!c(n))throw new Error(`invalid rnx runtime version: ${t}`);let r=Buffer.from(n,"utf8").toString("hex").match(/.{1,60}/g);if(!r)throw new Error(`invalid rnx runtime version: ${t}`);return`${r.join(".")}${a}`}function f(t){return t.toLowerCase().endsWith(a)}function h(t){if(!f(t))return null;let n=t.slice(0,-a.length).split(".");if(n.length===0||n.some(r=>!/^[0-9a-f]{1,60}$/i.test(r)))return null;let i=n.join("");if(i.length%2!==0)return null;try{let r=Buffer.from(i,"hex").toString("utf8");return c(r)?r:null}catch{return null}}function v(t){let n=l(t);return o.existsSync(e.join(n,"index.html"))?n:null}function T(t){if(!f(t))return x();let n=h(t);return n?v(n):null}export{R as a,p as b,H as c,f as d,h as e,T as f};