rnxsim 0.1.370 → 0.1.372

package/dist-lib/host/bridge-host.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.370 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.372 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;
@@ -114,7 +114,6 @@ var import_promises2 = require("fs/promises");
 var import_http = __toESM(require("http"), 1);
 var import_net = __toESM(require("net"), 1);
 var import_node_path3 = require("node:path");
-var import_util = require("util");
 
 // src/backend-origin.ts
 var LOOPBACK_PROBE_HOSTNAMES = ["::1", "127.0.0.1"];
@@ -301,9 +300,9 @@ function safeChildPlistName(value) {
     name: file.toLowerCase().endsWith(".plist") ? file : `${file}.plist`
   };
 }
-async function readableSettingsBundle(path10) {
+async function readableSettingsBundle(path12) {
   try {
-    const root = await (0, import_promises.stat)((0, import_node_path.join)(path10, "Root.plist"));
+    const root = await (0, import_promises.stat)((0, import_node_path.join)(path12, "Root.plist"));
     return root.isFile() && root.size <= MAX_PLIST_BYTES;
   } catch {
     return false;
@@ -348,11 +347,11 @@ async function settingsBundleFingerprint(bundlePath) {
     return null;
   }
 }
-async function parsePlistRecord(path10) {
+async function parsePlistRecord(path12) {
   try {
-    const metadata = await (0, import_promises.stat)(path10);
+    const metadata = await (0, import_promises.stat)(path12);
     if (!metadata.isFile() || metadata.size > MAX_PLIST_BYTES) return null;
-    const source = await (0, import_promises.readFile)(path10, "utf8");
+    const source = await (0, import_promises.readFile)(path12, "utf8");
     const parsed = parsePlistSource(source);
     return isRecord2(parsed) ? parsed : null;
   } catch {
@@ -538,10 +537,30 @@ async function readAppSettingsBundle(projectRoot) {
 
 // scripts/dev-server-scanner.ts
 init_optional_demo_registry();
-var execP = (0, import_util.promisify)(import_child_process.exec);
+var EXEC_EXIT_GRACE_MS = 2e3;
+function execGuarded(command, timeout, extra = {}) {
+  let child;
+  const ran = new Promise((resolve2, reject) => {
+    child = (0, import_child_process.exec)(command, { encoding: "utf8", timeout, ...extra }, (err, stdout) => {
+      if (err) reject(err);
+      else resolve2({ stdout });
+    });
+  });
+  const deadline = new Promise((_resolve, reject) => {
+    const timer = setTimeout(() => {
+      child?.kill("SIGKILL");
+      const err = new Error(`\`${command}\` did not exit within ${timeout}ms`);
+      Object.assign(err, { killed: true });
+      reject(err);
+    }, timeout + EXEC_EXIT_GRACE_MS);
+    timer.unref?.();
+  });
+  return Promise.race([ran, deadline]);
+}
 var TIMEOUT_MS = 250;
 var MANIFEST_TIMEOUT_MS = 1500;
 var TCP_GATE_MS = 120;
+var BODY_TIMEOUT_MS = 3e4;
 async function tcpPing(port, timeout = TCP_GATE_MS) {
   try {
     return await Promise.any(
@@ -568,36 +587,46 @@ async function tcpPing(port, timeout = TCP_GATE_MS) {
     return null;
   }
 }
-function httpGet(hostname, port, path10, method = "GET", timeout = TIMEOUT_MS, headers = {}) {
+function httpGet(hostname, port, path12, method = "GET", timeout = TIMEOUT_MS, headers = {}) {
   return new Promise((resolve2) => {
-    const req = import_http.default.request(
-      { hostname, port, path: path10, method, timeout, headers },
-      (res) => {
-        let body = "";
-        res.on("data", (c) => body += c.toString());
-        const contentType = (() => {
-          const raw = res.headers["content-type"];
-          if (typeof raw === "string") return raw;
-          if (Array.isArray(raw)) return raw[0];
-          return void 0;
-        })();
-        res.on(
-          "end",
-          () => resolve2({
-            statusCode: res.statusCode || 0,
-            body,
-            contentType,
-            hostname
-          })
-        );
-      }
-    );
-    req.on("error", () => resolve2(null));
-    req.setTimeout(timeout, () => {
-      req.destroy();
-      resolve2(null);
+    let settled = false;
+    const settle = (value) => {
+      if (settled) return;
+      settled = true;
+      resolve2(value);
+    };
+    const req = import_http.default.request({ hostname, port, path: path12, method, headers }, (res) => {
+      let body = "";
+      res.on("data", (c) => body += c.toString());
+      const contentType = (() => {
+        const raw = res.headers["content-type"];
+        if (typeof raw === "string") return raw;
+        if (Array.isArray(raw)) return raw[0];
+        return void 0;
+      })();
+      res.on(
+        "end",
+        () => settle({
+          statusCode: res.statusCode || 0,
+          body,
+          contentType,
+          hostname
+        })
+      );
     });
+    req.on("error", () => settle(null));
     req.end();
+    const giveUp = setTimeout(() => {
+      settle(null);
+      req.socket?.unref();
+    }, timeout);
+    const abandon = setTimeout(() => req.destroy(), BODY_TIMEOUT_MS);
+    abandon.unref?.();
+    req.on("close", () => {
+      clearTimeout(giveUp);
+      clearTimeout(abandon);
+      setImmediate(() => settle(null));
+    });
   });
 }
 var FALLBACK_PORTS = [
@@ -611,61 +640,83 @@ var FALLBACK_PORTS = [
   3001,
   19e3
 ].map((port) => ({ port, pid: 0 }));
+var SELF_PORT_RANGE_START = 5170;
+var SELF_PORT_RANGE_END = 5200;
+function isOwnShellPort(port) {
+  const offset = Number(process.env.PORT_OFFSET) || 0;
+  if (port >= SELF_PORT_RANGE_START && port <= SELF_PORT_RANGE_END) return true;
+  return offset > 0 && port >= SELF_PORT_RANGE_START + offset && port <= SELF_PORT_RANGE_END + offset;
+}
 function acceptPort(port, excluded) {
   if (port <= 0 || port >= 2e4) return false;
   if (excluded.has(port)) return false;
-  if (port >= 5170 && port <= 5200) return false;
+  if (isOwnShellPort(port)) return false;
   return true;
 }
-async function discoverListeningProcesses(excludePorts = []) {
+var DevServerScanUnavailableError = class extends Error {
+  constructor() {
+    super("could not enumerate listening processes (lsof/ss unavailable or timed out)");
+    this.name = "DevServerScanUnavailableError";
+  }
+};
+var LISTING_TIMEOUT_MS = 1e4;
+function wasKilledByTimeout(err) {
+  return !!(err && typeof err === "object" && err.killed);
+}
+async function scanListeningProcesses(excludePorts = []) {
   const excluded = new Set(excludePorts);
+  let timedOut = false;
   try {
-    const { stdout } = await execP(
+    const { stdout } = await execGuarded(
       `lsof -iTCP -sTCP:LISTEN -P -n 2>/dev/null | grep -E '^(node|bun)'`,
-      { encoding: "utf8", timeout: 2e3 }
+      LISTING_TIMEOUT_MS
     );
-    if (stdout.trim()) {
-      const seen = /* @__PURE__ */ new Map();
-      for (const line of stdout.trim().split("\n")) {
-        const parts = line.trim().split(/\s+/);
-        if (parts.length < 9) continue;
-        const pid = Number(parts[1]);
-        const addr = parts[8];
-        const m = addr.match(/:(\d+)$/);
-        if (!m) continue;
-        const port = Number(m[1]);
-        if (!acceptPort(port, excluded)) continue;
-        if (!seen.has(port)) seen.set(port, pid);
-      }
-      if (seen.size > 0) {
-        return [...seen.entries()].map(([port, pid]) => ({ port, pid }));
-      }
+    const seen = /* @__PURE__ */ new Map();
+    for (const line of stdout.trim() ? stdout.trim().split("\n") : []) {
+      const parts = line.trim().split(/\s+/);
+      if (parts.length < 9) continue;
+      const pid = Number(parts[1]);
+      const addr = parts[8];
+      const m = addr.match(/:(\d+)$/);
+      if (!m) continue;
+      const port = Number(m[1]);
+      if (!acceptPort(port, excluded)) continue;
+      if (!seen.has(port)) seen.set(port, pid);
     }
-  } catch {
+    return {
+      state: "looked",
+      processes: [...seen.entries()].map(([port, pid]) => ({ port, pid }))
+    };
+  } catch (err) {
+    if (wasKilledByTimeout(err)) timedOut = true;
   }
   try {
-    const { stdout } = await execP(`ss -tlnp 2>/dev/null | grep -E '"(node|bun)"'`, {
-      encoding: "utf8",
-      timeout: 2e3
-    });
-    if (stdout.trim()) {
-      const seen = /* @__PURE__ */ new Map();
-      for (const line of stdout.trim().split("\n")) {
-        const portMatch = line.match(/:(\d+)\s/);
-        const pidMatch = line.match(/pid=(\d+)/);
-        if (!portMatch) continue;
-        const port = Number(portMatch[1]);
-        const pid = pidMatch ? Number(pidMatch[1]) : 0;
-        if (!acceptPort(port, excluded)) continue;
-        if (!seen.has(port)) seen.set(port, pid);
-      }
-      if (seen.size > 0) {
-        return [...seen.entries()].map(([port, pid]) => ({ port, pid }));
-      }
+    const { stdout } = await execGuarded(
+      `ss -tlnp 2>/dev/null | grep -E '"(node|bun)"'`,
+      LISTING_TIMEOUT_MS
+    );
+    const seen = /* @__PURE__ */ new Map();
+    for (const line of stdout.trim() ? stdout.trim().split("\n") : []) {
+      const portMatch = line.match(/:(\d+)\s/);
+      const pidMatch = line.match(/pid=(\d+)/);
+      if (!portMatch) continue;
+      const port = Number(portMatch[1]);
+      const pid = pidMatch ? Number(pidMatch[1]) : 0;
+      if (!acceptPort(port, excluded)) continue;
+      if (!seen.has(port)) seen.set(port, pid);
     }
-  } catch {
+    return {
+      state: "looked",
+      processes: [...seen.entries()].map(([port, pid]) => ({ port, pid }))
+    };
+  } catch (err) {
+    if (wasKilledByTimeout(err)) timedOut = true;
   }
-  return FALLBACK_PORTS.filter((p) => acceptPort(p.port, excluded));
+  if (timedOut) return { state: "could-not-look" };
+  return {
+    state: "looked",
+    processes: FALLBACK_PORTS.filter((p) => acceptPort(p.port, excluded))
+  };
 }
 function pidFromNetstat(stdout, port) {
   for (const line of stdout.split("\n")) {
@@ -685,9 +736,7 @@ function pidFromNetstat(stdout, port) {
 async function resolveListeningPid(port) {
   if (!Number.isInteger(port) || port <= 0) return null;
   try {
-    const { stdout } = await execP("netstat -anv -p tcp 2>/dev/null", {
-      encoding: "utf8",
-      timeout: 8e3,
+    const { stdout } = await execGuarded("netstat -anv -p tcp 2>/dev/null", 8e3, {
       maxBuffer: 16 * 1024 * 1024
     });
     const pid = pidFromNetstat(stdout, port);
@@ -695,9 +744,7 @@ async function resolveListeningPid(port) {
   } catch {
   }
   try {
-    const { stdout } = await execP(`ss -tlnp 2>/dev/null`, {
-      encoding: "utf8",
-      timeout: 8e3,
+    const { stdout } = await execGuarded(`ss -tlnp 2>/dev/null`, 8e3, {
       maxBuffer: 16 * 1024 * 1024
     });
     for (const line of stdout.split("\n")) {
@@ -723,10 +770,10 @@ async function resolveProcessCwd(pid) {
   } catch {
   }
   try {
-    const { stdout } = await execP(`lsof -b -w -p ${pid} -a -d cwd -Fn 2>/dev/null`, {
-      encoding: "utf8",
-      timeout: 8e3
-    });
+    const { stdout } = await execGuarded(
+      `lsof -b -w -p ${pid} -a -d cwd -Fn 2>/dev/null`,
+      8e3
+    );
     for (const line of stdout.split("\n")) {
       if (line.startsWith("n") && line.length > 1) {
         const cwd = line.slice(1).trim();
@@ -894,7 +941,8 @@ async function probePort(port, buildIconProxyUrl, listeningProcess) {
   const manifestParsed = manifestRes ? safeParseManifest(manifestRes.body) : null;
   const manifestLaunchUrl = typeof manifestParsed?.launchAsset?.url === "string" ? manifestParsed.launchAsset.url : null;
   const manifestClient = manifestParsed?.extra?.expoClient || manifestParsed?.extra || {};
-  if (manifestParsed && (manifestLaunchUrl || typeof manifestClient.name === "string")) {
+  const manifestState = !manifestRes ? "no-answer" : manifestParsed && (manifestLaunchUrl || typeof manifestClient.name === "string") ? "resolved" : "no-manifest";
+  if (manifestState === "resolved") {
     knownNonPatched.add(port);
     const launchUrl2 = manifestLaunchUrl || `${buildLoopbackProbeBaseUrl("http:", probeHostname, port)}/index.bundle?platform=ios&dev=true&hot=true&minify=false`;
     const framework = launchUrl2.includes(
@@ -915,17 +963,15 @@ async function probePort(port, buildIconProxyUrl, listeningProcess) {
   }
   if (statusRes && statusRes.body.includes("packager-status:running")) {
     knownNonPatched.add(port);
+    const result = makeResult(
+      probeHostname,
+      port,
+      expoRes && expoRes.statusCode === 200 ? "expo" : "metro",
+      owner
+    );
+    if (manifestState === "no-answer") result.bundleUrlProvisional = true;
     return enrichWithManifest(
-      applyManifest(
-        makeResult(
-          probeHostname,
-          port,
-          expoRes && expoRes.statusCode === 200 ? "expo" : "metro",
-          owner
-        ),
-        manifestRes,
-        buildIconProxyUrl
-      ),
+      applyManifest(result, manifestRes, buildIconProxyUrl),
       buildIconProxyUrl
     );
   }
@@ -1021,7 +1067,9 @@ async function attachAppSettingsBundle(result, projectRoot) {
 }
 async function scanDevServers(opts = {}) {
   await loadOptionalDemoApps();
-  const processes = await discoverListeningProcesses(opts.excludePorts);
+  const scan = await scanListeningProcesses(opts.excludePorts);
+  if (scan.state === "could-not-look") throw new DevServerScanUnavailableError();
+  const processes = scan.processes;
   const currentPorts = new Set(processes.map((p) => p.port));
   for (const p of [...portCache.keys()]) {
     if (!currentPorts.has(p)) portCache.delete(p);
@@ -3708,13 +3756,283 @@ async function openUrl(url, options = {}) {
   await launchUrl(url, options);
 }
 
+// src/host/plane-host.ts
+var import_node_fs10 = __toESM(require("node:fs"), 1);
+var import_node_path11 = __toESM(require("node:path"), 1);
+var import_plane = require("@contrast/harness/plane");
+
+// cli/commands/box/checkout-plane.ts
+var import_node_child_process4 = require("node:child_process");
+var import_node_fs9 = __toESM(require("node:fs"), 1);
+var import_node_path10 = __toESM(require("node:path"), 1);
+var CheckoutRequiresGitError = class extends Error {
+};
+var BINARY_SNIFF_BYTES = 8192;
+var LIST_FILES_TIMEOUT_MS = 1e4;
+function looksBinary(filePath, size) {
+  if (size === 0) return false;
+  let fd;
+  try {
+    fd = import_node_fs9.default.openSync(filePath, "r");
+    const buffer = Buffer.alloc(Math.min(BINARY_SNIFF_BYTES, size));
+    const read = import_node_fs9.default.readSync(fd, buffer, 0, buffer.length, 0);
+    return buffer.subarray(0, read).includes(0);
+  } catch {
+    return false;
+  } finally {
+    if (fd !== void 0) import_node_fs9.default.closeSync(fd);
+  }
+}
+var CheckoutFilePlane = class {
+  root;
+  entries = /* @__PURE__ */ new Map();
+  sniffed = /* @__PURE__ */ new Map();
+  // the deadline above, as a number a caller can set. what it changes is how
+  // long a wedged git is waited on, never whether it is waited on, so proving
+  // the kill does not have to cost the production deadline.
+  listTimeoutMs;
+  constructor(root, options = {}) {
+    this.root = import_node_path10.default.resolve(root);
+    this.listTimeoutMs = options.listTimeoutMs ?? LIST_FILES_TIMEOUT_MS;
+  }
+  index() {
+    return this.entries;
+  }
+  async refresh() {
+    let stdout;
+    try {
+      stdout = (0, import_node_child_process4.execFileSync)("git", ["ls-files", "-co", "--exclude-standard", "-z"], {
+        cwd: this.root,
+        encoding: "utf8",
+        maxBuffer: 64 * 1024 * 1024,
+        timeout: this.listTimeoutMs,
+        // stating the environment is not redundant here. bun 1.3.14 resolves
+        // the binary for the synchronous form against the PATH it captured at
+        // startup and ignores a later change to `process.env.PATH`, so without
+        // this it runs a different git than every other call in the process.
+        env: process.env
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const killed = error instanceof Error && "signal" in error && error.signal === "SIGTERM";
+      throw new CheckoutRequiresGitError(
+        killed ? `git did not list the project's files in ${this.root} within ${this.listTimeoutMs / 1e3}s, so the box has no file set to serve. the checkout may be on a stalled filesystem, or this machine may be too loaded to start a subprocess.` : `could not list the project's files with git in ${this.root}: ${message}`
+      );
+    }
+    if (stdout.length === 0) {
+      throw new CheckoutRequiresGitError(
+        `git listed no files in ${this.root}. either git tracks nothing there and nothing untracked is visible to it, or this machine could not read the child process's output.`
+      );
+    }
+    const next = /* @__PURE__ */ new Map();
+    const nextSniffed = /* @__PURE__ */ new Map();
+    for (const relative of stdout.split("\0")) {
+      if (!relative) continue;
+      let stat2;
+      try {
+        stat2 = import_node_fs9.default.statSync(import_node_path10.default.join(this.root, relative));
+      } catch {
+        continue;
+      }
+      if (!stat2.isFile()) continue;
+      const seen = this.sniffed.get(relative);
+      const binary = seen && seen.size === stat2.size && seen.mtimeMs === stat2.mtimeMs ? seen.binary : looksBinary(import_node_path10.default.join(this.root, relative), stat2.size);
+      nextSniffed.set(relative, { size: stat2.size, mtimeMs: stat2.mtimeMs, binary });
+      next.set(relative, {
+        size: stat2.size,
+        // a checkout carries no write policy of its own; if the user can write
+        // the file, so can the shell
+        readOnly: false,
+        binary
+      });
+    }
+    this.entries = next;
+    this.sniffed = nextSniffed;
+  }
+  absolute(planePath) {
+    const resolved = import_node_path10.default.resolve(this.root, planePath);
+    if (resolved !== this.root && !resolved.startsWith(`${this.root}${import_node_path10.default.sep}`)) {
+      throw new Error(`path escapes the project: ${planePath}`);
+    }
+    return resolved;
+  }
+  async read(planePath) {
+    return import_node_fs9.default.promises.readFile(this.absolute(planePath), "utf8");
+  }
+  async readBytes(planePath) {
+    return import_node_fs9.default.promises.readFile(this.absolute(planePath));
+  }
+  async write(planePath, content) {
+    const absolute = this.absolute(planePath);
+    await import_node_fs9.default.promises.mkdir(import_node_path10.default.dirname(absolute), { recursive: true });
+    await import_node_fs9.default.promises.writeFile(absolute, content);
+    this.entries.set(planePath, {
+      size: content.byteLength,
+      readOnly: false,
+      // the bytes are in hand, so the same NUL test costs nothing here
+      binary: content.subarray(0, BINARY_SNIFF_BYTES).includes(0)
+    });
+  }
+  async delete(planePath) {
+    await import_node_fs9.default.promises.rm(this.absolute(planePath), { force: true });
+    this.entries.delete(planePath);
+  }
+};
+
+// src/host/plane-host.ts
+var WS_OPEN2 = 1;
+var PlaneNotRegisteredError = class extends Error {
+};
+var PlaneHost = class {
+  // roots a box authorized, each tied to the socket that authorized it
+  registered = /* @__PURE__ */ new Map();
+  open = /* @__PURE__ */ new Map();
+  byRoot = /* @__PURE__ */ new Map();
+  nextPlaneId = 1;
+  /** handle a plane:* message. returns true iff it was one. */
+  async handleMessage(ws, msg) {
+    if (typeof msg !== "object" || msg === null) return false;
+    const record = { ...msg };
+    const type = record.type;
+    if (typeof type !== "string" || !type.startsWith("plane:")) return false;
+    const id = record.id;
+    try {
+      this.respond(ws, id, await this.dispatch(ws, type, record));
+    } catch (err) {
+      const code = err instanceof PlaneNotRegisteredError ? "plane-not-registered" : void 0;
+      this.respondError(ws, id, err instanceof Error ? err.message : String(err), code);
+    }
+    return true;
+  }
+  unregisterSocket(ws) {
+    for (const [root, sockets] of [...this.registered]) {
+      if (!sockets.delete(ws)) continue;
+      if (sockets.size > 0) continue;
+      this.registered.delete(root);
+      const planeId = this.byRoot.get(root);
+      if (planeId) {
+        this.open.delete(planeId);
+        this.byRoot.delete(root);
+      }
+    }
+    for (const [planeId, entry] of [...this.open]) {
+      entry.sockets.delete(ws);
+      if (entry.sockets.size === 0 && !this.registered.has(entry.root)) {
+        this.open.delete(planeId);
+        this.byRoot.delete(entry.root);
+      }
+    }
+  }
+  /** roots currently reachable, for the daemon's status output. */
+  registeredRoots() {
+    return [...this.registered.keys()];
+  }
+  async dispatch(ws, type, msg) {
+    switch (type) {
+      case "plane:register": {
+        const root = this.realRoot(String(msg.root ?? ""));
+        const sockets = this.registered.get(root) ?? /* @__PURE__ */ new Set();
+        sockets.add(ws);
+        this.registered.set(root, sockets);
+        return { root, holders: sockets.size };
+      }
+      // READ ONLY, and that is the whole point of it existing beside the
+      // `holders` field on plane:register.
+      //
+      // registration is the AUTHORIZATION step: it is what permits any page on
+      // this machine to open that root over a loopback socket that CORS does
+      // not protect. so a caller asking "is anyone else in this checkout"
+      // cannot be made to authorize the root in order to find out, even
+      // briefly. it also means the count is the honest one: no box reads 0 and
+      // a single box reads 1, where asking through register would have made
+      // every answer one higher and forced a threshold that counts the asker.
+      case "plane:status": {
+        const root = this.realRoot(String(msg.root ?? ""));
+        const sockets = this.registered.get(root);
+        return { root, holders: sockets?.size ?? 0, registered: Boolean(sockets) };
+      }
+      case "plane:open": {
+        const root = this.realRoot(String(msg.root ?? ""));
+        if (!this.registered.has(root)) {
+          throw new PlaneNotRegisteredError(
+            `no box has registered ${root}; start one with \`rnx box\` there`
+          );
+        }
+        const existingId = this.byRoot.get(root);
+        const existing = existingId ? this.open.get(existingId) : void 0;
+        if (existingId && existing) {
+          existing.sockets.add(ws);
+          return { planeId: existingId, version: existing.version };
+        }
+        const plane = new CheckoutFilePlane(root);
+        await plane.refresh();
+        const planeId = `plane-${this.nextPlaneId++}`;
+        const entry = {
+          root,
+          plane,
+          version: (0, import_plane.indexVersion)(plane.index()),
+          sockets: /* @__PURE__ */ new Set([ws])
+        };
+        this.open.set(planeId, entry);
+        this.byRoot.set(root, planeId);
+        return { planeId, version: entry.version };
+      }
+      case "plane:close": {
+        const entry = this.open.get(String(msg.planeId ?? ""));
+        if (entry) entry.sockets.delete(ws);
+        return { ok: true };
+      }
+      default: {
+        const entry = this.entry(msg);
+        const handled = await (0, import_plane.dispatchPlaneCommand)(entry.plane, type, msg);
+        if (!handled) throw new Error(`unknown plane command: ${type}`);
+        if (handled.version) entry.version = handled.version;
+        return handled.result;
+      }
+    }
+  }
+  entry(msg) {
+    const entry = this.open.get(String(msg.planeId ?? ""));
+    if (!entry) throw new Error(`unknown planeId: ${String(msg.planeId)}`);
+    return entry;
+  }
+  // resolve symlinks and relative segments before comparing, so a registered
+  // root and an opened one cannot disagree about the same directory.
+  realRoot(root) {
+    if (!root) throw new Error("root is required");
+    const resolved = import_node_path11.default.resolve(root);
+    let real;
+    try {
+      real = import_node_fs10.default.realpathSync(resolved);
+    } catch {
+      throw new Error(`no such directory: ${resolved}`);
+    }
+    if (!import_node_fs10.default.statSync(real).isDirectory()) throw new Error(`not a directory: ${real}`);
+    return real;
+  }
+  respond(ws, id, result) {
+    if (ws.readyState !== WS_OPEN2) return;
+    try {
+      ws.send(JSON.stringify({ id, result }));
+    } catch {
+    }
+  }
+  respondError(ws, id, error, code) {
+    if (ws.readyState !== WS_OPEN2) return;
+    try {
+      ws.send(JSON.stringify({ id, error, ...code ? { code } : {} }));
+    } catch {
+    }
+  }
+};
+
 // src/host/replacement-module-handler.ts
 var import_promises5 = __toESM(require("node:fs/promises"), 1);
-var import_node_path10 = __toESM(require("node:path"), 1);
+var import_node_path12 = __toESM(require("node:path"), 1);
 var import_esbuild = require("esbuild");
 var REPLACEMENT_MODULE_ROUTE = "/__sootsim-replacement-module";
 function getReplacementLoader(filePath) {
-  const ext = import_node_path10.default.extname(filePath).toLowerCase();
+  const ext = import_node_path12.default.extname(filePath).toLowerCase();
   switch (ext) {
     case ".js":
       return "js";
@@ -3796,7 +4114,7 @@ async function handleReplacementModuleRequest(req, res, options = {}) {
     res.end("replacement files must be .js, .jsx, .ts, or .tsx");
     return true;
   }
-  if (!import_node_path10.default.isAbsolute(targetPath)) {
+  if (!import_node_path12.default.isAbsolute(targetPath)) {
     res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
     res.end("replacement file path must be absolute");
     return true;
@@ -3804,10 +4122,10 @@ async function handleReplacementModuleRequest(req, res, options = {}) {
   const runtimePackages = new Set(url.searchParams.getAll("runtimePackage"));
   let resolvedProjectRoot;
   if (options.projectRoot) {
-    const lexicalProjectRoot = import_node_path10.default.resolve(options.projectRoot);
+    const lexicalProjectRoot = import_node_path12.default.resolve(options.projectRoot);
     resolvedProjectRoot = await import_promises5.default.realpath(options.projectRoot);
-    const lexicalTarget = import_node_path10.default.relative(lexicalProjectRoot, targetPath);
-    if (lexicalTarget.startsWith("..") || import_node_path10.default.isAbsolute(lexicalTarget)) {
+    const lexicalTarget = import_node_path12.default.relative(lexicalProjectRoot, targetPath);
+    if (lexicalTarget.startsWith("..") || import_node_path12.default.isAbsolute(lexicalTarget)) {
       res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
       res.end("replacement file must be inside the project root");
       return true;
@@ -3823,8 +4141,8 @@ async function handleReplacementModuleRequest(req, res, options = {}) {
     return true;
   }
   if (resolvedProjectRoot) {
-    const relativeTarget = import_node_path10.default.relative(resolvedProjectRoot, resolvedTargetPath);
-    if (relativeTarget.startsWith("..") || import_node_path10.default.isAbsolute(relativeTarget)) {
+    const relativeTarget = import_node_path12.default.relative(resolvedProjectRoot, resolvedTargetPath);
+    if (relativeTarget.startsWith("..") || import_node_path12.default.isAbsolute(relativeTarget)) {
       res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
       res.end("replacement file must be inside the project root");
       return true;
@@ -4183,6 +4501,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
   nextCliFallbackId = 1;
   cliIdleTimer = null;
   agentHost;
+  planeHost = new PlaneHost();
   static CLI_IDLE_TIMEOUT_MS = 6e4;
   static CLI_LEASE_TTL_MS = 6e5;
   static USER_ACTIVE_LEASE_TTL_MS = 8e3;
@@ -4414,6 +4733,10 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
           void this.agentHost.handleMessage(ws, msg);
           return;
         }
+        if (typeof msg.type === "string" && msg.type.startsWith("plane:")) {
+          void this.planeHost.handleMessage(ws, msg);
+          return;
+        }
         if (msg.type === "runtime:list") {
           const versions = sootsimRuntime.listInstalled();
           const active = this.getActiveRuntime();
@@ -4736,6 +5059,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       });
       ws.on("close", () => {
         this.agentHost.unregisterSocket(ws);
+        this.planeHost.unregisterSocket(ws);
         if (role === "sim" && sim) {
           this.rememberDisconnectedSim(sim);
           if (this.primarySimId === sim.id) {