rnxsim 0.1.380 → 0.1.382

package/cli/commands/upload.ts

@@ -1,5 +1,5 @@
 // rnx record upload — capture the currently-loaded bundle + device spec from
-// a running sootsim sim and POST it to the Contrast upload endpoint. returns a
+// a running rnx sim and POST it to the Contrast upload endpoint. returns a
 // /preview/<id> url that anyone can open to load this bundle in a frame.
 //
 // uploads are unlisted-public (unguessable id) but require a signed-in
@@ -29,7 +29,7 @@ import { openUrl } from '../open-url'
 import { resolveRunProvenance } from '../run-registry'
 import { rnxExit } from '../run-rnx'
 import { createBridgeFromParsed, evalInBridge, parseBridgeCliArgs } from '../ws-bridge'
-import type { SootSimTimelineEvent } from '@sootsim/globals'
+import type { SootSimTimelineEvent } from '@rnx/globals'
 
 interface UploadOptions {
   port?: number
@@ -110,7 +110,7 @@ function readSnapshotManifest(manifestPath: string): AttachedInteractionSnapshot
 
 const REMOTE_DEFAULT_ORIGIN = process.env.RNX_UPLOAD_ORIGIN || 'https://contrast.dev'
 // the canonical public preview link. Uploads go to the contrast backend, but
-// reviewers/users open SootSim preview pages on sootsim.com.
+// reviewers/users open rnx preview pages on rnxsim.com.
 const REMOTE_DEFAULT_PUBLIC_PREVIEW_ORIGIN =
   process.env.RNX_PREVIEW_ORIGIN || rnxPublicBrand.origin
 export async function resolveDefaultUploadOrigin(

package/cli/commands/version.ts

@@ -1,9 +1,9 @@
 // rnx version — one overview of both halves you're running.
 //
-// the `sootsim` CLI (npm package) and the engine runtime (versioned tarball
+// the rnx CLI and the engine runtime (versioned tarball
 // rendered in the browser/electron shell) are versioned independently, which
 // is a frequent "I upgraded but the version didn't change" trap. the terse
-// `sootsim --version` flag prints both for scripts; this command adds the
+// `rnx --version` flag prints both for scripts; this command adds the
 // channel, a "newer runtime available" hint, and a what's-new pointer.
 
 import fs from 'node:fs'
@@ -12,9 +12,14 @@ import { getCliVersion } from '../../src/cli-version'
 import { runtimeDir } from '../../src/home-paths'
 import { RNX_CHANGELOG_URL, rnxRuntime } from '../../src/runtime-delivery'
 import { resolveRNXAppConfig } from '../app-config'
+import { readCachedCliUpdate, refreshCliUpdateCache } from '../cli-update'
 import { getRuntimeSummary } from '../runtime-summary'
+import { IS_STANDALONE } from '../standalone'
 
 export async function runVersion(_args: string[]): Promise<void> {
+  const cliUpdatePromise = IS_STANDALONE
+    ? refreshCliUpdateCache().catch(() => readCachedCliUpdate())
+    : Promise.resolve(null)
   const { IS_BETA, BETA_LABEL } = await import('../../src/beta')
   const suffix = IS_BETA ? ` · ${BETA_LABEL}` : ''
   console.log(`rnx v${getCliVersion()}${suffix}`)
@@ -43,7 +48,13 @@ export async function runVersion(_args: string[]): Promise<void> {
   }
 
   // best-effort network check; never fail the command on a flaky network.
-  const check = await rnxRuntime.checkUpToDate({ channel })
+  const [check, cliUpdate] = await Promise.all([
+    rnxRuntime.checkUpToDate({ channel }),
+    cliUpdatePromise,
+  ])
+  if (cliUpdate?.outdated) {
+    console.log(`\n  ↑ CLI v${cliUpdate.latestVersion} available; run \`rnx upgrade\``)
+  }
   if (check.outdated && check.latest) {
     console.log(`\n  ↑ default runtime v${check.latest} available; run \`rnx upgrade\``)
   }

package/cli/commands/what-happened.ts

@@ -1,6 +1,6 @@
 // rnx what-happened — show recent events from the semantic timeline
 //
-// the agent-facing read verb for SootSim.bridges.timeline. by default
+// the agent-facing read verb for the SootSim.bridges.timeline API. by default
 // shows everything since the previous CLI call from the same agent
 // identity (cursor model). after rendering, advances the cursor past
 // the events it displayed so the next call shows only new events.
@@ -25,7 +25,7 @@ import {
   inspectTimelineSummary,
   NOISY_TIMELINE_KINDS,
 } from './inspect/core'
-import type { SootSimTimelineEvent, SootSimTimelineQuery } from '@sootsim/globals'
+import type { SootSimTimelineEvent, SootSimTimelineQuery } from '@rnx/globals'
 
 interface WhatHappenedOptions {
   port?: number

package/cli/current-sim.ts

@@ -1,13 +1,15 @@
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'fs'
+import { existsSync, readFileSync, rmSync } from 'fs'
 import { tmpdir } from 'os'
-import { dirname, join, resolve } from 'path'
+import { basename, dirname, join, resolve } from 'path'
 import { getParentPid, getProcessComm } from './parent-pid'
+import { writeSecureJsonAtomic } from './secure-file'
 
-const CURRENT_SIM_VERSION = 1 as const
+const CURRENT_SIM_VERSION = 2 as const
 const CURRENT_SIM_PATH_ENV = 'SOOTSIM_CLI_CURRENT_SIM_PATH'
 
-interface CurrentSimState {
-  version: 1
+export interface LocalCurrentTarget {
+  version: 2
+  plane: 'local'
   simId: string
   updatedAt: string
 }
@@ -148,55 +150,66 @@ export function getCurrentSimPath() {
   return join(tmpdir(), `rnx-current-sim-${key}.json`)
 }
 
-export function readCurrentSim(): CurrentSimState | null {
+function legacyCloudCredentialDirectory(filepath: string): string {
+  return join(dirname(filepath), `${basename(filepath)}.credentials`)
+}
+
+export function readCurrentTarget(): LocalCurrentTarget | null {
   const filepath = getCurrentSimPath()
+  rmSync(legacyCloudCredentialDirectory(filepath), { recursive: true, force: true })
   if (!existsSync(filepath)) return null
 
   try {
-    const parsed = JSON.parse(readFileSync(filepath, 'utf8')) as Partial<CurrentSimState>
+    const parsed: unknown = JSON.parse(readFileSync(filepath, 'utf8'))
+    if (parsed === null || typeof parsed !== 'object') {
+      rmSync(filepath, { force: true })
+      return null
+    }
+    const version = Reflect.get(parsed, 'version')
+    const plane = Reflect.get(parsed, 'plane')
+    const simId = Reflect.get(parsed, 'simId')
+    const updatedAt = Reflect.get(parsed, 'updatedAt')
     if (
-      parsed.version !== CURRENT_SIM_VERSION ||
-      typeof parsed.simId !== 'string' ||
-      !parsed.simId.trim() ||
-      typeof parsed.updatedAt !== 'string'
+      (version !== 1 && version !== CURRENT_SIM_VERSION) ||
+      (version === CURRENT_SIM_VERSION && plane !== 'local') ||
+      typeof simId !== 'string' ||
+      !simId.trim() ||
+      typeof updatedAt !== 'string'
     ) {
       rmSync(filepath, { force: true })
       return null
     }
 
-    return {
+    const target = {
       version: CURRENT_SIM_VERSION,
-      simId: parsed.simId.trim(),
-      updatedAt: parsed.updatedAt,
-    }
+      plane: 'local',
+      simId: simId.trim(),
+      updatedAt,
+    } satisfies LocalCurrentTarget
+    if (version === 1) writeSecureJsonAtomic(filepath, target)
+    return target
   } catch {
     rmSync(filepath, { force: true })
     return null
   }
 }
 
+export const readCurrentSim = readCurrentTarget
+
 export function readCurrentSimId() {
-  return readCurrentSim()?.simId || null
+  return readCurrentTarget()?.simId ?? null
 }
 
 export function saveCurrentSimId(simId: string) {
   const normalized = simId.trim()
   if (!normalized) return
 
-  const filepath = getCurrentSimPath()
-  mkdirSync(dirname(filepath), { recursive: true })
-  writeFileSync(
-    filepath,
-    JSON.stringify(
-      {
-        version: CURRENT_SIM_VERSION,
-        simId: normalized,
-        updatedAt: new Date().toISOString(),
-      } satisfies CurrentSimState,
-      null,
-      2,
-    ) + '\n',
-  )
+  writeSecureJsonAtomic(getCurrentSimPath(), {
+    version: CURRENT_SIM_VERSION,
+    plane: 'local',
+    simId: normalized,
+    updatedAt: new Date().toISOString(),
+  } satisfies LocalCurrentTarget)
 }
 
 export function clearCurrentSimId() {

package/cli/desktop-companion.ts

@@ -241,7 +241,7 @@ export interface LaunchCompanionOptions {
   profileId?: string
   ephemeralProfile?: boolean
   // set by `rnx open`, whose native window belongs to the launching
-  // session. `sootsim desktop` omits it and remains a persistent desktop app.
+  // session. `rnx desktop` omits it and remains a persistent desktop app.
   ownerPid?: number
 }
 

package/cli/drivers/electron.ts

@@ -1,5 +1,5 @@
 // electron driver — wraps the existing desktop-companion helper. availability
-// is "is the sootsim desktop app installed on this machine". launch delegates
+// is "is the rnx desktop app installed on this machine". launch delegates
 // to launchDesktopCompanion, which already handles mac `open -a`, linux
 // AppImage, and the --device seed.
 

package/cli/drivers/playwright.ts

@@ -9,7 +9,7 @@
 // returns the moment the sim connects, and playwright tears its browser
 // down when the launching process exits. an in-process launch would mean
 // the sim vanished the instant `open` finished. the detached host keeps the
-// test browser alive until the sim's page closes (e.g. via `sootsim close`).
+// test browser alive until the sim's page closes (e.g. via `rnx close`).
 
 import { spawn } from 'child_process'
 import { closeSync, mkdtempSync, openSync, readFileSync } from 'fs'
@@ -286,7 +286,7 @@ const cleanupProfile = () => {
   // we are spawned detached + unref'd so \`rnx open\` returns immediately,
   // which means nothing in the OS process tree ties Chrome's lifetime to the
   // session that asked for it. once the sim connects, the connect-timeout
-  // safety net is cleared, so absent an explicit \`sootsim close\` (or the
+  // safety net is cleared, so absent an explicit \`rnx close\` (or the
   // daemon's idle reaper closing the sim socket) the host would hold Chrome
   // open forever after its owner exits. poll the owning session's pid and tear
   // down when it's gone. ESRCH (kill throws) = owner exited; EPERM = alive but
@@ -601,7 +601,7 @@ async function launch(opts: DriverLaunchOptions): Promise<DriverLaunchResult> {
   const connectAckFile = `${errLog}.connected`
   const errFd = openSync(errLog, 'a')
   try {
-    // spawn the browser host detached so Chrome outlives `sootsim
+    // spawn the browser host detached so Chrome outlives `rnx
     // open`. stdout is dropped; stderr is captured to errLog so an early
     // crash (bad profile dir, missing browser binary) produces a real
     // message instead of a silent "timed out waiting for sim".

package/cli/drivers/types.ts

@@ -1,4 +1,4 @@
-// driver / runner abstraction for sootsim. browser sims run in an isolated
+// driver / runner abstraction for rnx. browser sims run in an isolated
 // playwright-owned profile. electron remains the native desktop surface.
 
 export type DriverId = 'electron' | 'playwright'
@@ -29,7 +29,7 @@ export interface DriverLaunchOptions {
   url?: string
   // run in headless mode where the driver supports it. ignored by electron.
   headless?: boolean
-  // initial device model seed forwarded to the sootsim shell. the electron
+  // initial device model seed forwarded to the rnx shell. the electron
   // driver forwards it via argv (--device=<model>); browser drivers receive
   // it already stamped on the URL (?device=<model>) by runOpenCommand.
   device?: string
@@ -51,7 +51,7 @@ export interface DriverLaunchOptions {
   // stable pid for the session that owns a CLI-opened host. electron closes
   // only that session's windows when the owner exits; playwright requires it
   // so a detached browser can never outlive its session. omitted only for the
-  // persistent `sootsim desktop` app lifecycle.
+  // persistent `rnx desktop` app lifecycle.
   ownerPid?: number
   // expose Chrome's remote-debugging endpoint on this port so a
   // bridge-driven sim can also be cpu-profiled. only the playwright driver
@@ -60,7 +60,7 @@ export interface DriverLaunchOptions {
   // maximum time the detached host should wait for the launched sim to
   // register with the bridge before it tears itself down.
   connectTimeoutMs?: number
-  // the sootsim WS bridge port the launched sim page should register with,
+  // the rnx WS bridge port the launched sim page should register with,
   // injected as window.__sootsimBridgePort. load-bearing when the dev bridge
   // drifted off the shell-port-implied default (e.g. :7668 taken at the shell's
   // boot -> bridge on :7669 while the shell kept :5173): the page's own

package/cli/flow-file.ts

@@ -9,7 +9,7 @@ export interface FlowFrontmatter {
   // theme-sensitive; a dark capture can never match a light baseline)
   theme?: 'light' | 'dark'
   electron?: boolean
-  // maestro-compatible: appId is accepted but not used by sootsim (ios bundle id)
+  // maestro-compatible: appId is accepted but not used by rnx (ios bundle id)
   appId?: string
   // maestro-compatible: flow-level env vars, defined into the flow's JS
   // context before the first step runs
@@ -20,10 +20,10 @@ export interface FlowFrontmatter {
 
 // parse flow file. accepts three shapes:
 //   1. plain yaml array of steps (no frontmatter)
-//   2. sootsim style: ---\n<fm>\n---\n<steps>
+//   2. rnx style: ---\n<fm>\n---\n<steps>
 //   3. maestro style: <fm>\n---\n<steps>   (multi-doc yaml, fm first)
 // maestro compat matters because real users have real .maestro/*.yaml files
-// and shouldn't have to rewrite them to drive sootsim.
+// and shouldn't have to rewrite them to drive rnx.
 //
 // `${...}` templates are NOT resolved here — interpolation happens per-step
 // at execution time in the flow runner's JS context (matching maestro), so

package/cli/help-core.ts

@@ -1,9 +1,9 @@
-import { cliCommandMetas } from '@sootsim/skills/cli'
+import { cliCommandMetas } from '@rnx/skills/cli'
 import {
   renderCliCommandHelp,
   renderCliGroupHelp,
   renderCliIndexHelp,
-} from '@sootsim/skills/cli/renderers'
+} from '@rnx/skills/cli/renderers'
 import { formatFlagHelp } from 'sootsim-engine/settings/cli-flags'
 import {
   DEFAULT_SOOTSIM_BRIDGE_PORT,
@@ -37,14 +37,14 @@ function backendLabel(command: string, args: readonly string[]): string {
   return `available backends: ${available.join(', ')}`
 }
 
-function renderWebHelp(): string {
-  return `rnx web — select or ensure the current branch's existing web preview
+function renderPreviewHelp(command: 'web' | 'ios' | 'android'): string {
+  return `rnx ${command} — select or ensure the current branch's existing ${command} preview
 
 usage:
-  rnx web
+  rnx ${command}
 
-The browser backend selects the Factory-owned web iframe. It never launches a
-browser, host process, or Cloudflare runtime.`
+The browser backend selects the Factory-owned ${command} iframe. It never launches a
+host process or Cloudflare runtime.`
 }
 
 function renderFactoryBrowserLeaves(command: string): string | null {
@@ -70,7 +70,12 @@ function renderFactoryBrowserLeaves(command: string): string | null {
 }
 
 function renderRootAvailability(backend: RnxBackendKind): string {
-  const visibleCommands = new Set([...cliCommandMetas.map((meta) => meta.id), 'web'])
+  const visibleCommands = new Set([
+    ...cliCommandMetas.map((meta) => meta.id),
+    'web',
+    'ios',
+    'android',
+  ])
   const visibleRegistry = RNX_COMMAND_REGISTRY.filter((entry) =>
     visibleCommands.has(entry.name),
   )
@@ -94,15 +99,17 @@ export function renderRnxHelp(options: RnxHelpOptions): string {
   if (!command) {
     return `${renderCliIndexHelp(HELP_CONTEXT, formatFlagHelp()).trimEnd()}
 
-browser preview selector:
+browser preview selectors:
   rnx web                     select the existing Factory web preview
+  rnx ios                     select the existing Factory iOS preview
+  rnx android                 select the existing Factory Android preview
 
 ${renderRootAvailability(options.backend)}`
   }
 
   let body: string | null
-  if (command === 'web') {
-    body = renderWebHelp()
+  if (command === 'web' || command === 'ios' || command === 'android') {
+    body = renderPreviewHelp(command)
   } else if (options.group === command && !options.prefer) {
     body = renderCliGroupHelp(command, HELP_CONTEXT, formatFlagHelp())
   } else {

package/cli/hidden-runtime-alias.ts

@@ -1,4 +1,4 @@
-import { getCliInspectVerbMetaByPath } from '@sootsim/skills/cli'
+import { getCliInspectVerbMetaByPath } from '@rnx/skills/cli'
 import type { ParsedArgs } from './parse-args'
 
 const HIDDEN_RUNTIME_ALIAS_GROUPS = ['do', 'get'] as const

package/cli/hints.ts

@@ -1,4 +1,4 @@
-// configurable, identity-scoped hint registry for the sootsim CLI.
+// configurable, identity-scoped hint registry for the rnx CLI.
 //
 // two problems this solves:
 //   1. the CLI scatters "hint: ..." console.logs across many command files,
@@ -205,7 +205,7 @@ defineHint<[string]>('subtree-root-not-found', {
 })
 
 defineHint<[]>('clean-uninstall', {
-  // shown once on the first `sootsim --help` run so users learn the clean
+  // shown once on the first `rnx --help` run so users learn the clean
   // teardown path. package-manager uninstall hooks are best-effort, so the
   // hint documents the explicit daemon cleanup command.
   frequency: 'once-ever',

package/cli/maestro-js.ts

@@ -14,9 +14,9 @@
 //   time (maestro-orchestra-models util/Env.kt): regex (?<!\\)\$\{([^$]*)},
 //   result stringified, `\${...}` escapes to a literal, blank exprs become ''.
 //
-// divergences (deliberate, sootsim-side ergonomics — keep this list short):
+// divergences (deliberate, rnx-side ergonomics — keep this list short):
 //   1. envBinding is seeded from the full process.env, not just MAESTRO_*.
-//      sootsim flows historically resolve `${SOOTSIM_*}` credentials from the
+//      rnx flows historically resolve `${SOOTSIM_*}` credentials from the
 //      shell environment and `rnx maestro --env K=V` writes process.env.
 //   2. a *bare identifier* template (`${NAME}`) that evaluates to undefined
 //      throws a loud "missing variable" error instead of interpolating the

package/cli/outbound-endpoints.ts

@@ -102,6 +102,14 @@ export const OUTBOUND_ENDPOINTS: Record<string, OutboundEndpointDeclaration> = {
     payload:
       'every file git reports for the current checkout, then shell commands and file reads and writes for as long as the box shell is open',
   },
+  rnx_cloud_sim: {
+    category: 'explicit-user-action',
+    destination:
+      'https://rnxsim.com by default, or the test or disposable origin named by RNX_CLOUD_ORIGIN',
+    preConsent: false,
+    payload:
+      'the Metro JavaScript bundle selected by rnx ios --cloud, then structured simulator commands and lifecycle requests',
+  },
 }
 
 export interface OutboundCallDeclaration {
@@ -113,22 +121,47 @@ export interface OutboundCallDeclaration {
 // a new fetch, websocket, node HTTP request, or TCP connection has no entry and
 // fails the package test until its destination and consent behavior are declared.
 export const DECLARED_OUTBOUND_CALLS: Record<string, OutboundCallDeclaration> = {
+  'packages/sootsim/cli/cloud-client.ts :: fetch :: `${apiOrigin}/v1/sims`': {
+    category: 'rnx_cloud_sim',
+    count: 1,
+  },
+  'packages/sootsim/cli/cloud-client.ts :: fetch :: `${session.apiOrigin}/v1/sims/${encodeURIComponent(session.simId)}/claim`':
+    { category: 'rnx_cloud_sim', count: 1 },
+  'packages/sootsim/cli/cloud-client.ts :: fetch :: `${session.apiOrigin}/v1/sims/${encodeURIComponent(session.simId)}`':
+    { category: 'rnx_cloud_sim', count: 1 },
+  'packages/sootsim/cli/cloud-client.ts :: fetch :: `${this.session.apiOrigin}/v1/sims/${encodeURIComponent(this.session.simId)}/commands`':
+    { category: 'rnx_cloud_sim', count: 1 },
   // `rnx box create` uploads the checkout to the box service and then talks to
   // it. the destination is whatever the user named; there is no default.
-  'packages/sootsim/cli/commands/box/cloud-box.ts :: fetch :: endpointOf(base, name, verb)':
-    { category: 'rnx_cloud_box', count: 1 },
-  'packages/sootsim/cli/commands/box/cloud-box.ts :: websocket :: url': {
+  'packages/rnx-cloud-box/src/client.ts :: fetch :: endpointOf(base, name, verb, search)':
+    {
+      category: 'rnx_cloud_box',
+      count: 1,
+    },
+  'packages/rnx-cloud-box/src/client.ts :: websocket :: url': {
     category: 'rnx_cloud_box',
     count: 1,
   },
   // the account's own session meter: starting, listing and heartbeating the
   // session a cloud box is billed against. no project content.
-  "packages/sootsim/cli/commands/box/cloud-box.ts :: fetch :: `${options.apiOrigin.replace(/\\/+$/, '')}/v1/rnx/sessions`":
+  "packages/rnx-cloud-box/src/client.ts :: fetch :: `${options.apiOrigin.replace(/\\/+$/, '')}/v1/rnx/sessions`":
     { category: 'contrast_user_action', count: 1 },
-  'packages/sootsim/cli/commands/box/cloud-box.ts :: fetch :: url': {
+  'packages/rnx-cloud-box/src/client.ts :: fetch :: url': {
+    category: 'contrast_user_action',
+    count: 1,
+  },
+  'packages/rnx-cloud-box/src/box-do.ts :: fetch :: `${origin}/v1/rnx/sessions`': {
     category: 'contrast_user_action',
     count: 1,
   },
+  'packages/rnx-cloud-box/src/box-do.ts :: fetch :: `${origin}/v1/rnx/sessions/${encodeURIComponent(sessionId)}`':
+    { category: 'contrast_user_action', count: 1 },
+  // the Cloudflare Worker forwards the already-authenticated request to the
+  // selected Durable Object in the same service.
+  'packages/rnx-cloud-box/src/worker.ts :: fetch :: request': {
+    category: 'same_origin_runtime',
+    count: 1,
+  },
   // a LOCAL box authorizing its own checkout with the loopback bridge daemon.
   // this one refuses to guess a port, so it cannot reach anything but a bridge
   // the user's own session is running; see the note on ws-bridge.ts below
@@ -340,7 +373,7 @@ export const DECLARED_OUTBOUND_CALLS: Record<string, OutboundCallDeclaration> =
     { category: 'contrast_user_action', count: 1 },
   'packages/sootsim/cli/commands/screenshots-capture.ts :: fetch :: `${apiOrigin}/api/sootsim/screenshot-decks?org=${encodeURIComponent(org)}&repo=${encodeURIComponent(repo)}`':
     { category: 'contrast_user_action', count: 1 },
-  'packages/sootsim/cli/commands/upgrade.ts :: fetch :: url': {
+  'packages/sootsim/cli/cli-update.ts :: fetch :: url': {
     category: 'cli_delivery',
     count: 1,
   },
@@ -589,6 +622,7 @@ export function detectOutboundCalls(repositoryRoot: string): DetectedOutboundCal
     path.join(repositoryRoot, 'packages/sootsim-engine/src'),
     path.join(repositoryRoot, 'packages/sootsim-engine/src-electron'),
     path.join(repositoryRoot, 'packages/contrast-runtime-delivery/src'),
+    path.join(repositoryRoot, 'packages/rnx-cloud-box/src'),
   ]
   const counts = new Map<string, number>()
   for (const file of roots.flatMap(sourceFilesUnder)) {

package/cli/parse-args.ts

@@ -60,7 +60,7 @@ export const HYPHENATED_GROUPING_VERBS = new Set(['do', 'get', 'wait', 'shell',
 
 // known commands — if first positional arg matches, it's a command.
 // every entry here must have a `cliCommandMetas` entry in
-// `packages/sootsim-skills/src/cli/meta.ts` (or sit on the internal
+// `packages/rnx-skills/src/cli/meta.ts` (or sit on the internal
 // allowlist in `test/sootsimCliRegistry.test.ts`), so help, website docs,
 // and agent skills can never drift from what the parser accepts.
 export const COMMANDS = new Set(RNX_NODE_COMMAND_NAMES)

package/cli/registry.ts

@@ -1,2 +1,2 @@
-export * from '@sootsim/skills/cli'
+export * from '@rnx/skills/cli'
 export * from './command-registry'

package/cli/resolve-assets.ts

@@ -1,4 +1,4 @@
-// resolve sootsim's bundled assets (fonts, icons, sounds)
+// resolve rnx's bundled assets (fonts, icons, sounds)
 // regardless of how the package was installed (source checkout, npm install, bunx).
 //
 // uses import.meta.url to derive the package root, then checks both
@@ -13,7 +13,7 @@ import { rnxPublicBrand } from '../src/public-brand'
 // when running from source, this file lives at cli/resolve-assets.ts
 const thisDir = dirname(fileURLToPath(import.meta.url))
 
-// walk up to find package root: look for package.json with name "sootsim"
+// walk up to find package root: look for package.json with the rnxsim package name
 function findPackageRoot(): string {
   let dir = thisDir
   for (let i = 0; i < 5; i++) {

package/cli/secure-file.ts

@@ -0,0 +1,31 @@
+import { randomUUID } from 'node:crypto'
+import {
+  closeSync,
+  fchmodSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs'
+import { dirname } from 'node:path'
+
+export function writeSecureJsonAtomic(filepath: string, value: unknown): void {
+  mkdirSync(dirname(filepath), { recursive: true })
+  const temporary = `${filepath}.tmp-${process.pid}-${randomUUID()}`
+  let descriptor: number | null = null
+  try {
+    descriptor = openSync(temporary, 'wx', 0o600)
+    fchmodSync(descriptor, 0o600)
+    writeFileSync(descriptor, `${JSON.stringify(value, null, 2)}\n`)
+    fsyncSync(descriptor)
+    closeSync(descriptor)
+    descriptor = null
+    renameSync(temporary, filepath)
+  } catch (error) {
+    if (descriptor !== null) closeSync(descriptor)
+    rmSync(temporary, { force: true })
+    throw error
+  }
+}

package/cli/shell-init.ts

@@ -0,0 +1,98 @@
+import {
+  RNX_CLOUD_SESSION_ENV,
+  RNX_SHELL_UPDATE_SET_PREFIX,
+  RNX_SHELL_UPDATE_UNSET,
+} from './cloud-session'
+
+export function renderRnxShellInit(shell: string): string {
+  if (shell !== 'bash' && shell !== 'zsh') {
+    throw new Error('RNX shell integration supports bash and zsh')
+  }
+  return `rnx() {
+  local -a _rnx_shell_args
+  local _rnx_shell_command _rnx_shell_create _rnx_shell_update
+  local _rnx_shell_session _rnx_shell_status _rnx_shell_traced
+  _rnx_shell_args=("$@")
+  _rnx_shell_command=''
+  _rnx_shell_create=0
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      -h|--help|-V|--version|-v|--verbose|--headless) shift ;;
+      -p|--port|-d|--device|-t|--theme|--driver|--sim|--session|--tab)
+        if [ "$#" -ge 2 ]; then shift 2; else shift; fi
+        ;;
+      --) break ;;
+      -*) shift ;;
+      *) _rnx_shell_command="$1"; shift; break ;;
+    esac
+  done
+  case "$_rnx_shell_command" in
+    claim|close) ;;
+    ios)
+      for _rnx_shell_session in "$@"; do
+        if [ "$_rnx_shell_session" = '--cloud' ]; then
+          _rnx_shell_create=1
+          break
+        fi
+      done
+      if [ "$_rnx_shell_create" -ne 1 ]; then
+        command rnx "\${_rnx_shell_args[@]}"
+        return $?
+      fi
+      ;;
+    *)
+      command rnx "\${_rnx_shell_args[@]}"
+      return $?
+      ;;
+  esac
+
+  if { [ -n "\${BASH_VERSION:-}" ] && [ "\${BASH_SUBSHELL:-0}" -ne 0 ]; } ||
+     { [ -n "\${ZSH_VERSION:-}" ] && [ "\${ZSH_SUBSHELL:-0}" -ne 0 ]; }; then
+    printf '%s\\n' 'rnx cloud lifecycle commands must run directly in the current shell, not in a pipeline or command substitution' >&2
+    return 1
+  fi
+  if ( : >&9 ) 2>/dev/null; then
+    printf '%s\\n' 'rnx cloud shell integration requires file descriptor 9 to be unused' >&2
+    return 1
+  fi
+  if ! ( export ${RNX_CLOUD_SESSION_ENV}=__rnx_shell_probe && unset ${RNX_CLOUD_SESSION_ENV} ) 2>/dev/null; then
+    printf '%s\\n' 'rnx cloud shell integration cannot update RNX_CLOUD_SESSION in this shell' >&2
+    return 1
+  fi
+
+  case "$-" in
+    *x*) _rnx_shell_traced=1; set +x ;;
+    *) _rnx_shell_traced=0 ;;
+  esac
+  exec 9>&1
+  _rnx_shell_update="$(RNX_SHELL_UPDATE_FD=3 command rnx "\${_rnx_shell_args[@]}" 3>&1 1>&9)"
+  _rnx_shell_status=$?
+  exec 9>&-
+
+  if [ "$_rnx_shell_status" -eq 0 ]; then
+    case "$_rnx_shell_update" in
+      ${RNX_SHELL_UPDATE_SET_PREFIX}*)
+        _rnx_shell_session="\${_rnx_shell_update#${RNX_SHELL_UPDATE_SET_PREFIX}}"
+        case "$_rnx_shell_session" in
+          ''|*$'\\n'*) _rnx_shell_status=1 ;;
+          *) export ${RNX_CLOUD_SESSION_ENV}="$_rnx_shell_session" || _rnx_shell_status=$? ;;
+        esac
+        ;;
+      ${RNX_SHELL_UPDATE_UNSET})
+        unset ${RNX_CLOUD_SESSION_ENV} || _rnx_shell_status=$?
+        ;;
+      *) _rnx_shell_status=1 ;;
+    esac
+    if [ "$_rnx_shell_status" -ne 0 ]; then
+      printf '%s\\n' 'rnx refused an invalid shell session update' >&2
+    elif [ "$_rnx_shell_create" -eq 1 ]; then
+      command rnx __cloud-confirm
+      _rnx_shell_status=$?
+    fi
+  fi
+
+  if [ "$_rnx_shell_traced" -eq 1 ]; then set -x; fi
+  return "$_rnx_shell_status"
+}
+`
+}