rnxsim 0.1.344 → 0.1.346

package/cli/outbound-endpoints.ts

@@ -0,0 +1,586 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import ts from 'typescript'
+
+export type OutboundCategory =
+  | 'runtime-delivery'
+  | 'bounded-diagnostics'
+  | 'explicit-user-action'
+  | 'local-development'
+  | 'same-origin-runtime'
+  | 'guest-app-network'
+
+export interface OutboundEndpointDeclaration {
+  category: OutboundCategory
+  destination: string
+  preConsent: boolean
+  payload: string
+}
+
+export const OUTBOUND_ENDPOINTS: Record<string, OutboundEndpointDeclaration> = {
+  runtime_delivery: {
+    category: 'runtime-delivery',
+    destination:
+      'https://contrast.dev/runtimes/manifest.json and selected runtime tarball',
+    preConsent: true,
+    payload: 'HTTP runtime version request; no project or app data',
+  },
+  bounded_diagnostics: {
+    category: 'bounded-diagnostics',
+    destination: 'configured PostHog ingestion host',
+    preConsent: false,
+    payload: 'package name/version/unsupported API or error class only',
+  },
+  contrast_user_action: {
+    category: 'explicit-user-action',
+    destination: 'configured Contrast origin',
+    preConsent: false,
+    payload:
+      'explicit auth, billing, preview, issue report, test, or generated-flow request; a stored login may refresh auth/subscription state',
+  },
+  npm_update_check: {
+    category: 'explicit-user-action',
+    destination: 'https://registry.npmjs.org/rnxsim/latest',
+    preConsent: false,
+    payload: 'package update request only',
+  },
+  release_notes: {
+    category: 'explicit-user-action',
+    destination: 'https://contrast.dev/api/changelog/sootsim',
+    preConsent: false,
+    payload: 'requested runtime version only',
+  },
+  electron_download: {
+    category: 'explicit-user-action',
+    destination: 'https://contrast.dev/api/electron-release/',
+    preConsent: false,
+    payload: 'platform, architecture, and requested desktop release',
+  },
+  local_development: {
+    category: 'local-development',
+    destination:
+      'loopback development server, bridge, browser debugging, or app asset URL',
+    preConsent: true,
+    payload:
+      'local protocol traffic needed to discover, load, and drive the selected app',
+  },
+  same_origin_runtime: {
+    category: 'same-origin-runtime',
+    destination: 'the origin already serving the rnx runtime',
+    preConsent: true,
+    payload: 'runtime assets and shared local settings',
+  },
+  guest_app_network: {
+    category: 'guest-app-network',
+    destination: 'URLs requested by the user app or supplied explicitly by the user',
+    preConsent: true,
+    payload: 'the app request itself; rnx does not add telemetry fields',
+  },
+  presigned_upload: {
+    category: 'explicit-user-action',
+    destination: 'server-issued presigned object upload URL',
+    preConsent: false,
+    payload: 'preview objects selected by the user for upload',
+  },
+}
+
+export interface OutboundCallDeclaration {
+  category: keyof typeof OUTBOUND_ENDPOINTS
+  count: number
+}
+
+// generated from the AST-level check below, then reviewed and classified.
+// a new fetch, websocket, node HTTP request, or TCP connection has no entry and
+// fails the package test until its destination and consent behavior are declared.
+export const DECLARED_OUTBOUND_CALLS: Record<string, OutboundCallDeclaration> = {
+  'packages/contrast-runtime-delivery/src/index.ts :: fetch :: url': {
+    category: 'runtime_delivery',
+    count: 2,
+  },
+  "packages/sootsim/scripts/demo-app-registry.ts :: fetch :: 'http://localhost:1986/'": {
+    category: 'local_development',
+    count: 1,
+  },
+  'packages/sootsim/scripts/dev-server-scanner.ts :: http.request :: { hostname, port, path, method, timeout, headers }':
+    {
+      category: 'local_development',
+      count: 1,
+    },
+  'packages/sootsim/scripts/dev-server-scanner.ts :: sock.connect :: port': {
+    category: 'local_development',
+    count: 1,
+  },
+  'packages/sootsim-engine/src/auth/openLogin.ts :: fetch :: `${CONTRAST_ORIGIN}/api/dev-login`':
+    { category: 'contrast_user_action', count: 1 },
+  'packages/sootsim-engine/src/auth/shared-session.ts :: fetch :: `${CONTRAST_ORIGIN}/api/auth/me`':
+    { category: 'contrast_user_action', count: 1 },
+  'packages/sootsim-engine/src/auth/shared-session.ts :: fetch :: `${CONTRAST_ORIGIN}/api/auth/sign-out`':
+    { category: 'contrast_user_action', count: 1 },
+  'packages/sootsim-engine/src/auth/UploadsMenu.tsx :: fetch :: `${CONTRAST_ORIGIN}/api/preview/uploads?limit=20`':
+    { category: 'contrast_user_action', count: 1 },
+  "packages/sootsim-engine/src/billing/client.ts :: fetch :: apiUrl('/api/sootsim/billing/checkout')":
+    { category: 'contrast_user_action', count: 1 },
+  'packages/sootsim-engine/src/billing/client.ts :: fetch :: apiUrl(path)': {
+    category: 'contrast_user_action',
+    count: 3,
+  },
+  'packages/sootsim-engine/src/components/native-ui/LottieHost.tsx :: fetch :: descriptor.value':
+    { category: 'guest_app_network', count: 1 },
+  'packages/sootsim-engine/src/demo/demo-share-register.ts :: fetch :: shareUrl': {
+    category: 'guest_app_network',
+    count: 1,
+  },
+  'packages/sootsim-engine/src/engine/android-emoji-font.ts :: fetch :: url': {
+    category: 'same_origin_runtime',
+    count: 1,
+  },
+  'packages/sootsim-engine/src/engine/app-font-loader.ts :: fetch :: manifestFetchUrl(origin)':
+    { category: 'local_development', count: 1 },
+  'packages/sootsim-engine/src/engine/app-font-loader.ts :: fetch :: resolvedUrl': {
+    category: 'guest_app_network',
+    count: 1,
+  },
+  'packages/sootsim-engine/src/engine/config-plugin-splash-loader.ts :: fetch :: manifestFetchUrl(origin)':
+    { category: 'local_development', count: 1 },
+  'packages/sootsim-engine/src/engine/emoji-metrics-font-loader.ts :: fetch :: attemptedBundledUrl':
+    { category: 'same_origin_runtime', count: 1 },
+  'packages/sootsim-engine/src/engine/expo-app-config.ts :: fetch :: manifestFetchUrl(origin)':
+    { category: 'local_development', count: 1 },
+  'packages/sootsim-engine/src/engine/image-loader.ts :: fetch :: resolveImageFetchUri(uri)':
+    { category: 'guest_app_network', count: 1 },
+  'packages/sootsim-engine/src/engine/language-font-loader.ts :: fetch :: url': {
+    category: 'same_origin_runtime',
+    count: 1,
+  },
+  'packages/sootsim-engine/src/engine/sf-symbols-font.ts :: fetch :: url': {
+    category: 'same_origin_runtime',
+    count: 1,
+  },
+  'packages/sootsim-engine/src/ExternalApp.tsx :: fetch :: getBundleProxyUrl(devServerUrl)':
+    { category: 'guest_app_network', count: 1 },
+  'packages/sootsim-engine/src/ExternalApp.tsx :: fetch :: requestUrl': {
+    category: 'guest_app_network',
+    count: 1,
+  },
+  'packages/sootsim-engine/src-electron/tray.ts :: client.get :: parsed': {
+    category: 'guest_app_network',
+    count: 1,
+  },
+  'packages/sootsim-engine/src/mcp/ws-bridge.ts :: fetch :: bridgeHealthUrl': {
+    category: 'local_development',
+    count: 1,
+  },
+  'packages/sootsim-engine/src/mcp/ws-bridge.ts :: websocket :: resolveSootsimBridgeWebSocketUrl({ bridgePort, href: window.location.href, })':
+    { category: 'local_development', count: 1 },
+  'packages/sootsim-engine/src/menu/menuActions.ts :: fetch :: screenshot': {
+    category: 'guest_app_network',
+    count: 1,
+  },
+  'packages/sootsim-engine/src/preview/fetch-recorder.ts :: fetch :: absolute': {
+    category: 'guest_app_network',
+    count: 2,
+  },
+  'packages/sootsim-engine/src/preview/presigned-upload.ts :: fetch :: `${origin}/api/preview/upload/finalize`':
+    { category: 'contrast_user_action', count: 1 },
+  'packages/sootsim-engine/src/preview/presigned-upload.ts :: fetch :: `${origin}/api/preview/upload/init`':
+    { category: 'contrast_user_action', count: 1 },
+  'packages/sootsim-engine/src/preview/presigned-upload.ts :: fetch :: job.url': {
+    category: 'presigned_upload',
+    count: 1,
+  },
+  'packages/sootsim-engine/src/preview/warm-bundle-cache.ts :: fetch :: url': {
+    category: 'guest_app_network',
+    count: 1,
+  },
+  "packages/sootsim-engine/src/projects/projects-persistence.ts :: fetch :: '/__sootsim/shared-config'":
+    { category: 'same_origin_runtime', count: 1 },
+  'packages/sootsim-engine/src/react-native/index.ts :: fetch :: resource': {
+    category: 'guest_app_network',
+    count: 1,
+  },
+  'packages/sootsim-engine/src/react-native/Keyboard.ts :: fetch :: url': {
+    category: 'guest_app_network',
+    count: 1,
+  },
+  'packages/sootsim-engine/src/render-worker/canvaskit-shared.ts :: fetch :: fontUrl': {
+    category: 'same_origin_runtime',
+    count: 1,
+  },
+  'packages/sootsim-engine/src/render-worker/canvaskit-shared.ts :: fetch :: wasmUrl': {
+    category: 'same_origin_runtime',
+    count: 1,
+  },
+  'packages/sootsim-engine/src/render-worker/compositor-worker.ts :: fetch :: `${engineDistBase}canvaskit-graphite-pipelines.bin`':
+    { category: 'same_origin_runtime', count: 1 },
+  'packages/sootsim-engine/src/render-worker/host.ts :: fetch :: msg.url': {
+    category: 'guest_app_network',
+    count: 1,
+  },
+  'packages/sootsim-engine/src/render-worker/video-host.ts :: fetch :: uri': {
+    category: 'guest_app_network',
+    count: 1,
+  },
+  'packages/sootsim-engine/src/render-worker/worker-font-loader.ts :: fetch :: url': {
+    category: 'same_origin_runtime',
+    count: 1,
+  },
+  'packages/sootsim-engine/src/render-worker/worker-handlers/lifecycle.ts :: fetch :: url':
+    { category: 'guest_app_network', count: 1 },
+  'packages/sootsim-engine/src/screenshots/capture-store.ts :: fetch :: cap.dataUrl': {
+    category: 'same_origin_runtime',
+    count: 1,
+  },
+  "packages/sootsim-engine/src/screenshots/capture-store.ts :: fetch :: captureApiUrl(ref, 'grid')":
+    { category: 'contrast_user_action', count: 1 },
+  'packages/sootsim-engine/src/screenshots/capture-store.ts :: fetch :: captureApiUrl(ref, variant)':
+    { category: 'contrast_user_action', count: 1 },
+  'packages/sootsim-engine/src/screenshots/capture-store.ts :: fetch :: captureApiUrl(ref)':
+    { category: 'contrast_user_action', count: 1 },
+  "packages/sootsim-engine/src/server-discovery.ts :: fetch :: '/__server-scan'": {
+    category: 'local_development',
+    count: 1,
+  },
+  'packages/sootsim-engine/src/server-discovery.ts :: fetch :: `${gatewayOrigin}/__scan`':
+    { category: 'local_development', count: 1 },
+  "packages/sootsim-engine/src/settings/persistence.ts :: fetch :: '/__sootsim/shared-config'":
+    { category: 'same_origin_runtime', count: 2 },
+  'packages/sootsim/cli/app-fonts.ts :: fetch :: `${origin}/`': {
+    category: 'local_development',
+    count: 1,
+  },
+  'packages/sootsim/cli/app-fonts.ts :: fetch :: url': {
+    category: 'local_development',
+    count: 1,
+  },
+  'packages/sootsim/cli/app-splash.ts :: fetch :: url': {
+    category: 'local_development',
+    count: 1,
+  },
+  'packages/sootsim/cli/commands/control.ts :: fetch :: imageUrl': {
+    category: 'local_development',
+    count: 1,
+  },
+  'packages/sootsim/cli/commands/control.ts :: fetch :: spec.url': {
+    category: 'local_development',
+    count: 1,
+  },
+  'packages/sootsim/cli/commands/control.ts :: websocket :: `ws://127.0.0.1:${port}`': {
+    category: 'local_development',
+    count: 1,
+  },
+  'packages/sootsim/cli/commands/cpu-profile.ts :: fetch :: `http://localhost:${cdpPort}/json/list`':
+    { category: 'local_development', count: 1 },
+  'packages/sootsim/cli/commands/cpu-profile.ts :: websocket :: wsUrl': {
+    category: 'local_development',
+    count: 1,
+  },
+  'packages/sootsim/cli/commands/install-desktop.ts :: fetch :: url': {
+    category: 'electron_download',
+    count: 1,
+  },
+  "packages/sootsim/cli/commands/login.ts :: fetch :: `${origin.replace(/\\/$/, '')}/api/dev-login`":
+    { category: 'local_development', count: 1 },
+  "packages/sootsim/cli/commands/logout.ts :: fetch :: `${current.origin.replace(/\\/$/, '')}/api/auth/sign-out`":
+    { category: 'contrast_user_action', count: 1 },
+  "packages/sootsim/cli/commands/maestro-generate.ts :: fetch :: `${args.origin.replace(/\\/$/, '')}/api/llm`":
+    { category: 'contrast_user_action', count: 1 },
+  'packages/sootsim/cli/commands/report-issue.ts :: fetch :: url': {
+    category: 'contrast_user_action',
+    count: 1,
+  },
+  'packages/sootsim/cli/commands/runtime.ts :: websocket :: `ws://127.0.0.1:${port}`': {
+    category: 'local_development',
+    count: 1,
+  },
+  'packages/sootsim/cli/commands/screenshots-capture.ts :: fetch :: `${apiOrigin}/api/sootsim/screenshot-capture?ref=${encodeURIComponent(ref)}&org=${encodeURIComponent(org)}`':
+    { category: 'contrast_user_action', count: 1 },
+  'packages/sootsim/cli/commands/screenshots-capture.ts :: fetch :: `${apiOrigin}/api/sootsim/screenshot-decks?org=${encodeURIComponent(org)}&repo=${encodeURIComponent(repo)}`':
+    { category: 'contrast_user_action', count: 1 },
+  'packages/sootsim/cli/commands/upgrade.ts :: fetch :: REGISTRY_LATEST_URL': {
+    category: 'npm_update_check',
+    count: 1,
+  },
+  'packages/sootsim/cli/commands/upload.ts :: fetch :: url': {
+    category: 'presigned_upload',
+    count: 1,
+  },
+  'packages/sootsim/cli/recording-access.ts :: fetch :: `${billingOrigin}/api/sootsim/billing/subscription`':
+    { category: 'contrast_user_action', count: 1 },
+  "packages/sootsim/cli/run-registry.ts :: fetch :: `${args.origin.replace(/\\/$/, '')}/api/sootsim/test-runs`":
+    { category: 'contrast_user_action', count: 1 },
+  'packages/sootsim/cli/runtime-notes.ts :: fetch-alias :: url': {
+    category: 'release_notes',
+    count: 1,
+  },
+  'packages/sootsim/cli/telemetry.ts :: fetch :: `${config.host}/batch/`': {
+    category: 'bounded_diagnostics',
+    count: 1,
+  },
+  'packages/sootsim/cli/ws-bridge.ts :: websocket :: `ws://localhost:${wsPort}`': {
+    category: 'local_development',
+    count: 1,
+  },
+  'packages/sootsim/src/agent-daemon-client.ts :: socket.connect :: port': {
+    category: 'local_development',
+    count: 1,
+  },
+  'packages/sootsim/src/agent-daemon-client.ts :: websocket :: `ws://localhost:${this.port}`':
+    { category: 'local_development', count: 1 },
+  "packages/sootsim/src/auth/shared-session.ts :: fetch :: `${origin.replace(/\\/$/, '')}/api/auth/me`":
+    { category: 'contrast_user_action', count: 1 },
+  "packages/sootsim/src/dev-bundle-resolution.ts :: fetch :: '/__server-scan'": {
+    category: 'local_development',
+    count: 1,
+  },
+  'packages/sootsim/src/dev-bundle-resolution.ts :: fetch :: `/__fetch-proxy?url=${encodeURIComponent(targetUrl)}`':
+    { category: 'guest_app_network', count: 1 },
+  'packages/sootsim/src/dev-bundle-resolution.ts :: fetch :: targetUrl': {
+    category: 'guest_app_network',
+    count: 1,
+  },
+  'packages/sootsim/src/dev-server-open.ts :: http.get :: `http://127.0.0.1:${port}/__server-scan`':
+    { category: 'local_development', count: 1 },
+  'packages/sootsim/src/host/bridge-host.ts :: fetch :: parsedTarget.toString()': {
+    category: 'guest_app_network',
+    count: 1,
+  },
+  "packages/sootsim/src/host/fetch-proxy-handler.ts :: transport.request :: { hostname: targetUrl.hostname, port: targetUrl.port || (targetUrl.protocol === 'https:' ? 443 : 80), path: targetUrl.pathname + targetUrl.search, method, headers: targetHeaders, ...loopbackTlsOptions(targetUrl), }":
+    { category: 'guest_app_network', count: 1 },
+  "packages/sootsim/src/host/fetch-proxy-handler.ts :: transport.request :: { hostname: targetUrl.hostname, port: targetUrl.port || (targetUrl.protocol === 'https:' ? 443 : 80), path: targetUrl.pathname + targetUrl.search, method: req.method, headers: fwdHeaders, ...loopbackTlsOptions(targetUrl), }":
+    { category: 'guest_app_network', count: 1 },
+  'packages/sootsim/src/host/websocket-proxy.ts :: websocket :: targetUrl.href': {
+    category: 'guest_app_network',
+    count: 2,
+  },
+  'packages/sootsim/src/screenshots/org-deck.ts :: fetch :: url': {
+    category: 'contrast_user_action',
+    count: 1,
+  },
+}
+
+interface DetectedOutboundCall {
+  key: string
+  count: number
+}
+
+function sourceFilesUnder(root: string): string[] {
+  const files: string[] = []
+  const pending = [root]
+  while (pending.length > 0) {
+    const current = pending.pop()
+    if (!current) continue
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      const fullPath = path.join(current, entry.name)
+      if (entry.isDirectory()) {
+        if (entry.name !== 'vendor' && entry.name !== 'test-fixtures')
+          pending.push(fullPath)
+        continue
+      }
+      if (/\.(?:ts|tsx)$/.test(entry.name) && !entry.name.endsWith('.d.ts')) {
+        files.push(fullPath)
+      }
+    }
+  }
+  return files.sort()
+}
+
+interface NetworkNames {
+  fetch: Set<string>
+  httpClient: Set<string>
+  netClient: Set<string>
+  socket: Set<string>
+  nodeRequest: Set<string>
+  nodeGet: Set<string>
+}
+
+function networkNames(source: ts.SourceFile): NetworkNames {
+  const names: NetworkNames = {
+    fetch: new Set(['fetch']),
+    httpClient: new Set(['http', 'https']),
+    netClient: new Set(['net']),
+    socket: new Set(),
+    nodeRequest: new Set(),
+    nodeGet: new Set(),
+  }
+  const isClientExpression = (node: ts.Expression, clients: Set<string>): boolean => {
+    if (ts.isIdentifier(node)) return clients.has(node.text)
+    if (ts.isParenthesizedExpression(node))
+      return isClientExpression(node.expression, clients)
+    return (
+      ts.isConditionalExpression(node) &&
+      isClientExpression(node.whenTrue, clients) &&
+      isClientExpression(node.whenFalse, clients)
+    )
+  }
+  const visit = (node: ts.Node): void => {
+    if (
+      (ts.isParameter(node) || ts.isVariableDeclaration(node)) &&
+      ts.isIdentifier(node.name) &&
+      node.initializer &&
+      ts.isIdentifier(node.initializer) &&
+      names.fetch.has(node.initializer.text)
+    ) {
+      names.fetch.add(node.name.text)
+    }
+    if (
+      ts.isImportDeclaration(node) &&
+      ts.isStringLiteral(node.moduleSpecifier) &&
+      /^(?:node:)?https?$/.test(node.moduleSpecifier.text)
+    ) {
+      const bindings = node.importClause?.namedBindings
+      if (bindings && ts.isNamedImports(bindings)) {
+        for (const element of bindings.elements) {
+          const imported = (element.propertyName ?? element.name).text
+          if (imported === 'request') {
+            names.nodeRequest.add(element.name.text)
+          }
+          if (imported === 'get') names.nodeGet.add(element.name.text)
+        }
+      }
+    }
+    if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) {
+      const moduleName = node.moduleSpecifier.text.replace(/^node:/, '')
+      const local =
+        node.importClause?.name ??
+        (node.importClause?.namedBindings &&
+        ts.isNamespaceImport(node.importClause.namedBindings)
+          ? node.importClause.namedBindings.name
+          : undefined)
+      if (local && (moduleName === 'http' || moduleName === 'https')) {
+        names.httpClient.add(local.text)
+      }
+      if (local && moduleName === 'net') names.netClient.add(local.text)
+    }
+    if (
+      ts.isVariableDeclaration(node) &&
+      ts.isIdentifier(node.name) &&
+      node.initializer
+    ) {
+      if (isClientExpression(node.initializer, names.httpClient)) {
+        names.httpClient.add(node.name.text)
+      }
+      if (isClientExpression(node.initializer, names.netClient)) {
+        names.netClient.add(node.name.text)
+      }
+      if (
+        ts.isNewExpression(node.initializer) &&
+        ts.isPropertyAccessExpression(node.initializer.expression) &&
+        node.initializer.expression.name.text === 'Socket' &&
+        isClientExpression(node.initializer.expression.expression, names.netClient)
+      ) {
+        names.socket.add(node.name.text)
+      }
+    }
+    ts.forEachChild(node, visit)
+  }
+  visit(source)
+  return names
+}
+
+function callKind(node: ts.Node, names: NetworkNames): string | null {
+  if (ts.isNewExpression(node) && ts.isIdentifier(node.expression)) {
+    if (node.expression.text === 'WebSocket') return 'websocket'
+    if (node.expression.text === 'EventSource') return 'event-source'
+    if (node.expression.text === 'XMLHttpRequest') return 'xml-http-request'
+    return null
+  }
+  if (!ts.isCallExpression(node)) return null
+  const expression = node.expression
+  if (ts.isIdentifier(expression)) {
+    if (names.fetch.has(expression.text)) {
+      return expression.text === 'fetch' ? 'fetch' : 'fetch-alias'
+    }
+    if (names.nodeRequest.has(expression.text)) return 'node-request'
+    if (names.nodeGet.has(expression.text)) return 'node-get'
+    return null
+  }
+  if (!ts.isPropertyAccessExpression(expression)) return null
+  const method = expression.name.text
+  if (method === 'fetch') return 'fetch'
+  if (method === 'sendBeacon') return 'send-beacon'
+  const ownerExpression = expression.expression
+  const owner = ownerExpression.getText().replace(/\s+/g, ' ')
+  const knownHttpClient =
+    ts.isIdentifier(ownerExpression) && names.httpClient.has(ownerExpression.text)
+  const knownNetClient =
+    ts.isIdentifier(ownerExpression) && names.netClient.has(ownerExpression.text)
+  const knownSocket =
+    ts.isIdentifier(ownerExpression) && names.socket.has(ownerExpression.text)
+  if (method === 'request' && (knownHttpClient || owner === 'transport')) {
+    return `${owner}.request`
+  }
+  if (method === 'get' && knownHttpClient) return `${owner}.get`
+  if (
+    (method === 'connect' || method === 'createConnection') &&
+    (knownNetClient || knownSocket)
+  ) {
+    return `${owner}.${method}`
+  }
+  return null
+}
+
+function firstArgument(node: ts.Node): string {
+  const args =
+    ts.isCallExpression(node) || ts.isNewExpression(node) ? node.arguments : null
+  const first = args?.[0]
+  return first ? first.getText().replace(/\s+/g, ' ').trim() : '<none>'
+}
+
+export function detectOutboundCalls(repositoryRoot: string): DetectedOutboundCall[] {
+  const roots = [
+    path.join(repositoryRoot, 'packages/sootsim/cli'),
+    path.join(repositoryRoot, 'packages/sootsim/scripts'),
+    path.join(repositoryRoot, 'packages/sootsim/src'),
+    path.join(repositoryRoot, 'packages/sootsim-engine/src'),
+    path.join(repositoryRoot, 'packages/sootsim-engine/src-electron'),
+    path.join(repositoryRoot, 'packages/contrast-runtime-delivery/src'),
+  ]
+  const counts = new Map<string, number>()
+  for (const file of roots.flatMap(sourceFilesUnder)) {
+    if (file.endsWith('/outbound-endpoints.ts')) continue
+    const source = ts.createSourceFile(
+      file,
+      fs.readFileSync(file, 'utf8'),
+      ts.ScriptTarget.Latest,
+      true,
+      file.endsWith('.tsx') ? ts.ScriptKind.TSX : ts.ScriptKind.TS,
+    )
+    const names = networkNames(source)
+    const relative = path.relative(repositoryRoot, file).split(path.sep).join('/')
+    const visit = (node: ts.Node): void => {
+      const kind = callKind(node, names)
+      if (kind) {
+        const key = `${relative} :: ${kind} :: ${firstArgument(node)}`
+        counts.set(key, (counts.get(key) ?? 0) + 1)
+      }
+      ts.forEachChild(node, visit)
+    }
+    visit(source)
+  }
+  return [...counts.entries()]
+    .map(([key, count]) => ({ key, count }))
+    .sort((a, b) => a.key.localeCompare(b.key))
+}
+
+export function undeclaredOutboundCalls(repositoryRoot: string): string[] {
+  const detected = detectOutboundCalls(repositoryRoot)
+  const failures: string[] = []
+  const seen = new Set<string>()
+  for (const call of detected) {
+    seen.add(call.key)
+    const declaration = DECLARED_OUTBOUND_CALLS[call.key]
+    if (!declaration) {
+      failures.push(`undeclared: ${call.key} (count ${call.count})`)
+      continue
+    }
+    if (declaration.count !== call.count) {
+      failures.push(
+        `count changed: ${call.key} (declared ${declaration.count}, found ${call.count})`,
+      )
+    }
+  }
+  for (const key of Object.keys(DECLARED_OUTBOUND_CALLS)) {
+    if (!seen.has(key)) failures.push(`stale declaration: ${key}`)
+  }
+  return failures
+}

package/cli/privacy.ts

@@ -0,0 +1,53 @@
+import {
+  readPrivacyPreferences,
+  writePrivacyPreferences,
+  type PrivacyPreferences,
+} from '../src/home-paths'
+import { isAgentEnv } from './commands/inspect/env'
+import { confirm } from './prompt'
+
+function isCi(): boolean {
+  return (
+    process.env.CI === '1' ||
+    process.env.CI === 'true' ||
+    process.env.GITHUB_ACTIONS === 'true'
+  )
+}
+
+export function canPromptForPrivacyChoice(): boolean {
+  return process.stdin.isTTY === true && !isCi() && !isAgentEnv()
+}
+
+export function diagnosticsAllowedForCurrentProcess(
+  preferences: PrivacyPreferences = readPrivacyPreferences(),
+): boolean {
+  const doNotTrack = process.env.DO_NOT_TRACK
+  if (doNotTrack === '1' || doNotTrack === 'true') return false
+  if (!canPromptForPrivacyChoice()) return false
+  return preferences.configured && preferences.productAnalytics
+}
+
+export async function ensurePrivacyChoice(options: {
+  prompt: boolean
+}): Promise<PrivacyPreferences> {
+  const current = readPrivacyPreferences()
+  if (current.configured) return current
+
+  if (!options.prompt || !canPromptForPrivacyChoice()) {
+    return {
+      productAnalytics: false,
+      crashReports: false,
+      configured: false,
+    }
+  }
+
+  const allowed = await confirm(
+    'Share anonymous package incompatibilities and error classes to improve rnx?',
+    false,
+  )
+  // the engine's historical analytics and crash transports carry broader
+  // payloads, so crashReports stays off. productAnalytics is now consent for
+  // the bounded CLI diagnostic transport only.
+  writePrivacyPreferences({ productAnalytics: allowed, crashReports: false })
+  return readPrivacyPreferences()
+}

package/cli/runtime-notes.ts

@@ -26,12 +26,12 @@ function isChangelogEntry(value: unknown): value is ChangelogEntry {
 
 export async function fetchRuntimeReleaseNotes(
   version: string,
-  request: typeof fetch = fetch,
+  fetchImpl: typeof fetch = fetch,
 ): Promise<ChangelogEntry | null> {
   try {
     const url = new URL(SOOTSIM_CHANGELOG_API_URL)
     url.searchParams.set('version', version)
-    const response = await request(url, {
+    const response = await fetchImpl(url, {
       headers: { accept: 'application/json' },
       signal: AbortSignal.timeout(5000),
     })