rnxsim 0.1.370 → 0.1.372

package/dist-lib/vite.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.370 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.372 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rnxsim",
-  "version": "0.1.370",
+  "version": "0.1.372",
   "description": "rnx CLI, Vite and Metro plugins, and agent skills for driving React Native apps in the browser.",
   "author": "Tamagui LLC",
   "license": "SEE LICENSE IN LICENSE",

package/scripts/dev-server-scanner.ts

@@ -18,10 +18,6 @@ import { readlink } from 'fs/promises'
 import http from 'http'
 import net from 'net'
 import { resolve } from 'node:path'
-import { promisify } from 'util'
-import type { AppSettingsSpecifier } from '@sootsim/globals'
-
-const execP = promisify(exec)
 import {
   buildLoopbackProbeBaseUrl,
   LOOPBACK_PROBE_HOSTNAMES,
@@ -37,6 +33,50 @@ import {
   readAppSettingsBundle,
 } from '../src/settings-bundle.ts'
 import { loadOptionalDemoApps, optionalDemoAppsSync } from './optional-demo-registry.ts'
+import type { AppSettingsSpecifier } from '@sootsim/globals'
+
+// how long past a command's own budget we wait before deciding its exit event is
+// never coming. generous, because this only fires when the child is already
+// overdue and we are choosing between a wrong answer and a hang.
+const EXEC_EXIT_GRACE_MS = 2_000
+
+/** every subprocess in this file goes through here.
+ *
+ *  `exec`'s own `timeout` option is NOT a backstop. it kills the child and then
+ *  STILL waits for a 'close' event to settle the promise, so when that event is
+ *  lost the promise never settles — the timeout is already spent and nothing is
+ *  left to rescue it. (same failure m10843 pinned in `CheckoutFilePlane.refresh`.)
+ *  `lsof` walks every open fd on the machine, which makes it a realistic victim.
+ *
+ *  a hung scan is worse than a slow one: `inflightScan` never clears, so
+ *  `/__server-scan` stops answering at all instead of answering "could not
+ *  look". so we race the child against a real wall-clock deadline and reject
+ *  with `killed`, which callers already read as could-not-look. */
+function execGuarded(
+  command: string,
+  timeout: number,
+  extra: { maxBuffer?: number } = {},
+): Promise<{ stdout: string }> {
+  let child: ReturnType<typeof exec> | undefined
+  const ran = new Promise<{ stdout: string }>((resolve, reject) => {
+    child = exec(command, { encoding: 'utf8', timeout, ...extra }, (err, stdout) => {
+      if (err) reject(err)
+      else resolve({ stdout })
+    })
+  })
+  const deadline = new Promise<never>((_resolve, reject) => {
+    const timer = setTimeout(() => {
+      child?.kill('SIGKILL')
+      const err = new Error(`\`${command}\` did not exit within ${timeout}ms`)
+      // matches the shape `wasKilledByTimeout` reads off a real exec timeout, so
+      // a lost exit event and a genuine timeout reach callers as the same fact.
+      Object.assign(err, { killed: true })
+      reject(err)
+    }, timeout + EXEC_EXIT_GRACE_MS)
+    timer.unref?.()
+  })
+  return Promise.race([ran, deadline])
+}
 
 export interface DiscoveredServer {
   port: number
@@ -51,6 +91,11 @@ export interface DiscoveredServer {
   settingsBundle?: readonly AppSettingsSpecifier[]
   settingsStorageScopeUrl?: string
   patched?: boolean
+  /** true when `bundleUrl` was NOT derived from the server's own manifest —
+   *  the manifest probe got no answer, so this is the generic `/index.bundle`
+   *  guess. good enough to LIST the server; never good enough to open it. see
+   *  `manifestState` below for why the two are different answers. */
+  bundleUrlProvisional?: boolean
   /** absolute cwd of the owning node/bun process — resolved from `lsof -d cwd`
    *  when the scanner can see the pid. used to auto-attach the project for
    *  agent sessions without requiring a manual `sootsim agent attach`. */
@@ -58,6 +103,18 @@ export interface DiscoveredServer {
   pid?: number
 }
 
+/** how the manifest probe (`GET /` with expo-platform) actually went. the same
+ *  three answers `dev-bundle-resolution.ts` uses, deliberately spelled the same
+ *  way: a second vocabulary for one question is how the two resolvers drift.
+ *
+ *  the rule this encodes, which the whole scanner depends on: A PROBE THAT
+ *  COULD NOT LOOK MUST NEVER ANSWER AS THOUGH IT LOOKED. silence, timeout and
+ *  empty are three different answers, and only `no-manifest` means "there is
+ *  nothing there". reading `no-answer` as `no-manifest` is what made
+ *  `rnx open` hand back `<base>/index.bundle` for a One app whose manifest
+ *  names a different entry point entirely. */
+type ManifestState = 'resolved' | 'no-manifest' | 'no-answer'
+
 // localhost dev servers respond in well under 100ms when alive. drop dead
 // branches fast so a non-bundler process doesn't drag scan latency.
 const TIMEOUT_MS = 250
@@ -74,6 +131,11 @@ const MANIFEST_TIMEOUT_MS = 1500
 // within this budget the port isn't actually reachable, and all 5 HTTP probes
 // would just time out for nothing.
 const TCP_GATE_MS = 120
+// once a server has sent response headers we never abort it (see httpGet). this
+// only bounds a response that never ends, so it is deliberately far above any
+// real manifest: aborting a slow-but-answering server is the defect this whole
+// path exists to avoid.
+const BODY_TIMEOUT_MS = 30_000
 
 interface HttpResult {
   statusCode: number
@@ -122,33 +184,65 @@ function httpGet(
   headers: Record<string, string> = {},
 ): Promise<HttpResult | null> {
   return new Promise((resolve) => {
-    const req = http.request(
-      { hostname, port, path, method, timeout, headers },
-      (res) => {
-        let body = ''
-        res.on('data', (c: Buffer) => (body += c.toString()))
-        const contentType = (() => {
-          const raw = res.headers['content-type']
-          if (typeof raw === 'string') return raw
-          if (Array.isArray(raw)) return raw[0]
-          return undefined
-        })()
-        res.on('end', () =>
-          resolve({
-            statusCode: res.statusCode || 0,
-            body,
-            contentType,
-            hostname,
-          }),
-        )
-      },
-    )
-    req.on('error', () => resolve(null))
-    req.setTimeout(timeout, () => {
-      req.destroy()
-      resolve(null)
+    // first answer wins: the response, the deadline, and the connection closing
+    // all race, and every one of them can arrive after another has decided.
+    let settled = false
+    const settle = (value: HttpResult | null) => {
+      if (settled) return
+      settled = true
+      resolve(value)
+    }
+    // NO socket timeout here, deliberately. `options.timeout` / `req.setTimeout`
+    // make node DESTROY the connection when the budget expires, and destroying a
+    // dev server's connection while it is still assembling its manifest fires
+    // "Cannot pipe to a closed or destroyed stream" into One's manifest
+    // middleware as an unhandled rejection — the hazard the knownOne comment
+    // below already documents, which can exit the user's dev server. measured:
+    // six probes with a socket timeout produced six of those errors, six probes
+    // that give up in JS produced none, and the request completes later with the
+    // server none the wiser.
+    //
+    // giving up WAITING and KILLING THE REQUEST are different acts, and only the
+    // first one is ours to take. the deadline below resolves the scan on time;
+    // the request runs itself out in the background and its result is discarded.
+    const req = http.request({ hostname, port, path, method, headers }, (res) => {
+      let body = ''
+      res.on('data', (c: Buffer) => (body += c.toString()))
+      const contentType = (() => {
+        const raw = res.headers['content-type']
+        if (typeof raw === 'string') return raw
+        if (Array.isArray(raw)) return raw[0]
+        return undefined
+      })()
+      res.on('end', () =>
+        settle({
+          statusCode: res.statusCode || 0,
+          body,
+          contentType,
+          hostname,
+        }),
+      )
     })
+    req.on('error', () => settle(null))
     req.end()
+    const giveUp = setTimeout(() => {
+      settle(null)
+      // nothing is waiting on it now, so it must not hold a CLI process open.
+      req.socket?.unref()
+    }, timeout)
+    // the only thing that ever destroys a connection here. by BODY_TIMEOUT_MS a
+    // server has long since answered or died, so there is no live write to cut.
+    const abandon = setTimeout(() => req.destroy(), BODY_TIMEOUT_MS)
+    abandon.unref?.()
+    req.on('close', () => {
+      clearTimeout(giveUp)
+      clearTimeout(abandon)
+      // `close` on the request fires BEFORE the response's own `end` handler,
+      // so settling synchronously here turns every successful probe into a
+      // null. defer one tick and let a real answer win; this only settles the
+      // case where the connection closed without one.
+      setImmediate(() => settle(null))
+    })
   })
 }
 
@@ -165,70 +259,143 @@ const FALLBACK_PORTS: ListeningProcess[] = [
   8081, 8082, 8083, 8084, 8085, 8086, 3000, 3001, 19000,
 ].map((port) => ({ port, pid: 0 }))
 
+// sootsim's own dev server range at PORT_OFFSET=0. an isolated stack shifts its
+// shell by the same offset as every other port it owns, so the guard has to
+// shift with it: at PORT_OFFSET=90 the shell listens on :5263 and a range fixed
+// at 5170-5200 does not cover it, which lets a scan discover ITSELF and offer
+// the shell as though it were an app's dev server. a guard that is only correct
+// at offset 0 is wrong for everyone running an isolated stack, which is exactly
+// who runs concurrent scans.
+const SELF_PORT_RANGE_START = 5170
+const SELF_PORT_RANGE_END = 5200
+
+function isOwnShellPort(port: number): boolean {
+  const offset = Number(process.env.PORT_OFFSET) || 0
+  // the unshifted range still counts: another checkout's default-offset shell is
+  // no more an app dev server than our own is.
+  if (port >= SELF_PORT_RANGE_START && port <= SELF_PORT_RANGE_END) return true
+  return (
+    offset > 0 &&
+    port >= SELF_PORT_RANGE_START + offset &&
+    port <= SELF_PORT_RANGE_END + offset
+  )
+}
+
 function acceptPort(port: number, excluded: Set<number>): boolean {
   if (port <= 0 || port >= 20000) return false
   if (excluded.has(port)) return false
-  // sootsim's own dev server range — we never want to discover ourselves.
-  if (port >= 5170 && port <= 5200) return false
+  if (isOwnShellPort(port)) return false
   return true
 }
 
+/** ran the listing tool and these are the listeners, versus could not run it at
+ *  all. an empty `processes` here means the tool looked and there was genuinely
+ *  nothing; `could-not-look` means we have no information. substituting the
+ *  hardcoded FALLBACK_PORTS for the second case is what made `/__server-scan`
+ *  answer `[]` — "there are no dev servers" — to a user running three of them. */
+export type ListeningProcessScan =
+  | { state: 'looked'; processes: ListeningProcess[] }
+  | { state: 'could-not-look' }
+
+/** thrown by `scanDevServers` when listener enumeration itself failed. callers
+ *  must treat it as "no information" — keep whatever list they already had, or
+ *  answer their own caller with a failure — never as an empty result. */
+export class DevServerScanUnavailableError extends Error {
+  constructor() {
+    super('could not enumerate listening processes (lsof/ss unavailable or timed out)')
+    this.name = 'DevServerScanUnavailableError'
+  }
+}
+
+// lsof walks every open fd on the machine, so on a busy host it is genuinely
+// slow — measured between 1.2s and 5.0s here with 58 matching listeners. the
+// budget has to fit the real worst case, because the alternative is not a
+// faster answer, it is a WRONG one.
+const LISTING_TIMEOUT_MS = 10_000
+
+/** true when a failed exec was killed by our own timeout rather than by the
+ *  command being absent or erroring — the difference between "could not look"
+ *  and "this tool is not available here". */
+function wasKilledByTimeout(err: unknown): boolean {
+  return !!(err && typeof err === 'object' && (err as { killed?: boolean }).killed)
+}
+
 export async function discoverListeningProcesses(
   excludePorts: number[] = [],
 ): Promise<ListeningProcess[]> {
+  const scan = await scanListeningProcesses(excludePorts)
+  return scan.state === 'looked' ? scan.processes : []
+}
+
+export async function scanListeningProcesses(
+  excludePorts: number[] = [],
+): Promise<ListeningProcessScan> {
   const excluded = new Set(excludePorts)
+  let timedOut = false
 
   // lsof layout: COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
   // NAME looks like "*:8081" or "127.0.0.1:8081" for a LISTEN line.
   // async exec — sync blocked CrBrowserMain for ~600ms/scan on macOS.
   try {
-    const { stdout } = await execP(
+    const { stdout } = await execGuarded(
       `lsof -iTCP -sTCP:LISTEN -P -n 2>/dev/null | grep -E '^(node|bun)'`,
-      { encoding: 'utf8', timeout: 2000 },
+      LISTING_TIMEOUT_MS,
     )
-    if (stdout.trim()) {
-      const seen = new Map<number, number>()
-      for (const line of stdout.trim().split('\n')) {
-        const parts = line.trim().split(/\s+/)
-        if (parts.length < 9) continue
-        const pid = Number(parts[1])
-        const addr = parts[8]
-        const m = addr.match(/:(\d+)$/)
-        if (!m) continue
-        const port = Number(m[1])
-        if (!acceptPort(port, excluded)) continue
-        if (!seen.has(port)) seen.set(port, pid)
-      }
-      if (seen.size > 0) {
-        return [...seen.entries()].map(([port, pid]) => ({ port, pid }))
-      }
+    const seen = new Map<number, number>()
+    for (const line of stdout.trim() ? stdout.trim().split('\n') : []) {
+      const parts = line.trim().split(/\s+/)
+      if (parts.length < 9) continue
+      const pid = Number(parts[1])
+      const addr = parts[8]
+      const m = addr.match(/:(\d+)$/)
+      if (!m) continue
+      const port = Number(m[1])
+      if (!acceptPort(port, excluded)) continue
+      if (!seen.has(port)) seen.set(port, pid)
     }
-  } catch {}
+    // lsof ran. an empty result is a real answer: nothing is listening.
+    return {
+      state: 'looked',
+      processes: [...seen.entries()].map(([port, pid]) => ({ port, pid })),
+    }
+  } catch (err) {
+    if (wasKilledByTimeout(err)) timedOut = true
+  }
 
   // ss layout: State Recv-Q Send-Q Local-Address:Port Peer-Addr:Port users:(("node",pid=1234,fd=5))
   try {
-    const { stdout } = await execP(`ss -tlnp 2>/dev/null | grep -E '"(node|bun)"'`, {
-      encoding: 'utf8',
-      timeout: 2000,
-    })
-    if (stdout.trim()) {
-      const seen = new Map<number, number>()
-      for (const line of stdout.trim().split('\n')) {
-        const portMatch = line.match(/:(\d+)\s/)
-        const pidMatch = line.match(/pid=(\d+)/)
-        if (!portMatch) continue
-        const port = Number(portMatch[1])
-        const pid = pidMatch ? Number(pidMatch[1]) : 0
-        if (!acceptPort(port, excluded)) continue
-        if (!seen.has(port)) seen.set(port, pid)
-      }
-      if (seen.size > 0) {
-        return [...seen.entries()].map(([port, pid]) => ({ port, pid }))
-      }
+    const { stdout } = await execGuarded(
+      `ss -tlnp 2>/dev/null | grep -E '"(node|bun)"'`,
+      LISTING_TIMEOUT_MS,
+    )
+    const seen = new Map<number, number>()
+    for (const line of stdout.trim() ? stdout.trim().split('\n') : []) {
+      const portMatch = line.match(/:(\d+)\s/)
+      const pidMatch = line.match(/pid=(\d+)/)
+      if (!portMatch) continue
+      const port = Number(portMatch[1])
+      const pid = pidMatch ? Number(pidMatch[1]) : 0
+      if (!acceptPort(port, excluded)) continue
+      if (!seen.has(port)) seen.set(port, pid)
     }
-  } catch {}
+    return {
+      state: 'looked',
+      processes: [...seen.entries()].map(([port, pid]) => ({ port, pid })),
+    }
+  } catch (err) {
+    if (wasKilledByTimeout(err)) timedOut = true
+  }
+
+  // a tool that timed out told us nothing, so say so rather than substituting
+  // the guess list below and reporting its emptiness as fact.
+  if (timedOut) return { state: 'could-not-look' }
 
-  return FALLBACK_PORTS.filter((p) => acceptPort(p.port, excluded))
+  // neither tool exists here, so probe the conventional bundler ports directly.
+  // that is a real (if narrow) look, not a substitute for one.
+  return {
+    state: 'looked',
+    processes: FALLBACK_PORTS.filter((p) => acceptPort(p.port, excluded)),
+  }
 }
 
 // kept for backwards compatibility with any external callers that only need
@@ -284,9 +451,7 @@ export async function resolveListeningPid(port: number): Promise<number | null>
   // the local address uses a dot before the port, and the owner column is the
   // only token shaped "<name>:<pid>".
   try {
-    const { stdout } = await execP('netstat -anv -p tcp 2>/dev/null', {
-      encoding: 'utf8',
-      timeout: 8000,
+    const { stdout } = await execGuarded('netstat -anv -p tcp 2>/dev/null', 8000, {
       maxBuffer: 16 * 1024 * 1024,
     })
     const pid = pidFromNetstat(stdout, port)
@@ -295,9 +460,7 @@ export async function resolveListeningPid(port: number): Promise<number | null>
 
   // linux ss: 'LISTEN 0 511 0.0.0.0:8081 0.0.0.0:* users:(("node",pid=1234,fd=5))'
   try {
-    const { stdout } = await execP(`ss -tlnp 2>/dev/null`, {
-      encoding: 'utf8',
-      timeout: 8000,
+    const { stdout } = await execGuarded(`ss -tlnp 2>/dev/null`, 8000, {
       maxBuffer: 16 * 1024 * 1024,
     })
     for (const line of stdout.split('\n')) {
@@ -344,10 +507,10 @@ export async function resolveProcessCwd(pid: number): Promise<string | null> {
     //   p<pid>
     //   fcwd
     //   n<absolute path>
-    const { stdout } = await execP(`lsof -b -w -p ${pid} -a -d cwd -Fn 2>/dev/null`, {
-      encoding: 'utf8',
-      timeout: 8000,
-    })
+    const { stdout } = await execGuarded(
+      `lsof -b -w -p ${pid} -a -d cwd -Fn 2>/dev/null`,
+      8000,
+    )
     for (const line of stdout.split('\n')) {
       if (line.startsWith('n') && line.length > 1) {
         const cwd = line.slice(1).trim()
@@ -672,7 +835,16 @@ export async function probePort(
     (manifestParsed?.extra?.expoClient as { name?: unknown } | undefined) ||
     (manifestParsed?.extra as { name?: unknown } | undefined) ||
     {}
-  if (manifestParsed && (manifestLaunchUrl || typeof manifestClient.name === 'string')) {
+  // `manifestRes === null` means the probe got NO answer — it timed out or the
+  // connection failed. that is not the same fact as a server that answered and
+  // turned out to have no manifest, and only the second one licenses the
+  // generic `/index.bundle` entry point below.
+  const manifestState: ManifestState = !manifestRes
+    ? 'no-answer'
+    : manifestParsed && (manifestLaunchUrl || typeof manifestClient.name === 'string')
+      ? 'resolved'
+      : 'no-manifest'
+  if (manifestState === 'resolved') {
     knownNonPatched.add(port)
     const launchUrl =
       manifestLaunchUrl ||
@@ -708,17 +880,23 @@ export async function probePort(
   // never fire the HEAD against them.
   if (statusRes && statusRes.body.includes('packager-status:running')) {
     knownNonPatched.add(port)
+    // `makeResult` builds the generic `<base>/index.bundle` entry point. that is
+    // the RIGHT answer for a vanilla Metro or plain Expo packager, which is a
+    // server that ANSWERED `/` and had no manifest to give. it is a guess when
+    // the manifest simply never answered: this server may well be a One app
+    // whose manifest names `node_modules/one/metro-entry.bundle`, and opening
+    // the generic path instead makes metro build the whole app a second time
+    // under a module graph the app never named. flag it so `open` refuses to
+    // act on it, while the dock still lists the server it can plainly see.
+    const result = makeResult(
+      probeHostname,
+      port,
+      expoRes && expoRes.statusCode === 200 ? 'expo' : 'metro',
+      owner,
+    )
+    if (manifestState === 'no-answer') result.bundleUrlProvisional = true
     return enrichWithManifest(
-      applyManifest(
-        makeResult(
-          probeHostname,
-          port,
-          expoRes && expoRes.statusCode === 200 ? 'expo' : 'metro',
-          owner,
-        ),
-        manifestRes,
-        buildIconProxyUrl,
-      ),
+      applyManifest(result, manifestRes, buildIconProxyUrl),
       buildIconProxyUrl,
     )
   }
@@ -914,7 +1092,12 @@ export async function scanDevServers(
   // disk contention delays the import. memoized, so this is free after the
   // first call.
   await loadOptionalDemoApps()
-  const processes = await discoverListeningProcesses(opts.excludePorts)
+  const scan = await scanListeningProcesses(opts.excludePorts)
+  // we could not enumerate listeners, so we know nothing about what is running.
+  // returning [] here would evict every cache entry and report "no dev servers"
+  // to a user who has several — the caller must be able to tell the two apart.
+  if (scan.state === 'could-not-look') throw new DevServerScanUnavailableError()
+  const processes = scan.processes
   const currentPorts = new Set(processes.map((p) => p.port))
 
   // evict cache entries for ports that disappeared. a restarted process may