rnxsim 0.1.381 → 0.1.383

package/dist-lib/skills.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.381 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.383 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;
@@ -1808,9 +1808,9 @@ var init_registry = __esm({
             coverage: 0.97,
             coverageSource: "estimated",
             capabilityCoverage: CAPABILITY_INVENTORY_PACKAGE_COVERAGE["react-native-reanimated"],
-            note: "core animations, gestures, scroll, layout transitions, keyboard, sensors, reduced motion, native view property reads, and direct static style snapshots",
-            working: "useSharedValue, useAnimatedStyle/Props/Reaction, useDerivedValue, useAnimatedScrollHandler, useScrollViewOffset, useFrameCallback, useAnimatedRef, useAnimatedKeyboard, useAnimatedSensor, useReducedMotion, entering/exiting/layout transitions, withTiming/Spring/Decay/Delay/Sequence/Repeat/Clamp, interpolate, interpolateColor, runOnJS/UI, measure, scrollTo, getViewProp (layout, opacity, zIndex, backgroundColor, boxShadow), direct setViewStyle snapshots, Easing, createAnimatedComponent, Animated.View/Text/Image/ScrollView/FlatList",
-            missing: "Reanimated 4 native CSS keyframes and transitions remain incomplete"
+            note: "core animations, gestures, scroll, layout transitions, common CSS opacity and transform transitions and keyframes, keyboard, sensors, reduced motion, native view property reads, and direct static style snapshots",
+            working: "useSharedValue, useAnimatedStyle/Props/Reaction, useDerivedValue, useAnimatedScrollHandler, useScrollViewOffset, useFrameCallback, useAnimatedRef, useAnimatedKeyboard, useAnimatedSensor, useReducedMotion, entering/exiting/layout transitions, common CSS opacity and transform transitions with continuous interruption and settled endpoints, opacity and transform keyframes with retained forwards fill, withTiming/Spring/Decay/Delay/Sequence/Repeat/Clamp, interpolate, interpolateColor, runOnJS/UI, measure, scrollTo, getViewProp (layout, opacity, zIndex, backgroundColor, boxShadow), direct setViewStyle snapshots, Easing, createAnimatedComponent, Animated.View/Text/Image/ScrollView/FlatList",
+            missing: "Reanimated 4 CSS transitions and keyframes beyond opacity and transform remain incomplete"
           }
         ]
       },
@@ -1991,7 +1991,7 @@ var init_registry = __esm({
             capabilityCoverage: CAPABILITY_INVENTORY_PACKAGE_COVERAGE["react-native-keyboard-controller"],
             note: "native bindings stubbed (KeyboardControllerNative, KeyboardEvents, FocusedInputEvents, WindowDimensionsEvents, KeyboardControllerView + sibling native views); upstream pure-JS components, hooks, animated module, and KeyboardAvoidingView resolve from node_modules unchanged",
             working: "every upstream JS export runs through reanimated worklets; Android KeyboardGestureArea drives the existing keyboard owner through drag progress, velocity/distance settling, cancellation, focus retention, and cleanup; supported exports include KeyboardProvider, KeyboardAvoidingView, KeyboardStickyView, KeyboardAwareScrollView, KeyboardToolbar, KeyboardGestureArea, useReanimatedKeyboardAnimation, useKeyboardAnimation, useKeyboardHandler, useGenericKeyboardHandler, useKeyboardController, useKeyboardState, useKeyboardContext, useReanimatedFocusedInput, useFocusedInputHandler, useResizeMode, useWindowDimensions, KeyboardEvents, FocusedInputEvents, WindowDimensionsEvents resize events, KeyboardController (dismiss/setFocusTo/isVisible/state/preload/setInputMode/setDefaultMode), KeyboardControllerView, OverKeyboardView, KeyboardBackgroundView, KeyboardExtender, ClippingScrollView, KeyboardToolbarGroupView, and AndroidSoftInputModes",
-            missing: "preload is a noop; KeyboardGestureArea lacks its iOS textInputNativeID/offset effect; OverKeyboardView, KeyboardBackgroundView, and KeyboardExtender are passthrough views without their native platform effects"
+            missing: "KeyboardGestureArea lacks its iOS textInputNativeID/offset effect; OverKeyboardView, KeyboardBackgroundView, and KeyboardExtender are passthrough views without their native platform effects"
           }
         ]
       },
@@ -3458,9 +3458,9 @@ var init_registry = __esm({
           {
             range: ">=13.0.0",
             coverage: 0.8,
-            note: 'native-seam: upstream expo-calendar JS runs from the bundle over an in-memory EventKit-shaped store seeded faithfully to a fresh iOS Simulator \u2014 a writable local "Calendar" on the "Default" local source plus the always-present read-only "Birthdays" calendar, so getCalendarsAsync/getDefaultCalendarAsync match what a real RN app sees on the conformance Simulator (no sootsim brand names leak into guest calendar pickers). create/read/update/delete then mutate that store like EKEventStore.',
-            working: 'reference-Simulator default calendar set (writable "Calendar" + read-only "Birthdays", faithful "Default" local source); real RN + sootsim validated event permission/create/read/update/range-query/attendee-read/delete smoke, upstream enums and JS validation, create/update/delete calendars, create/list/get/update/delete events with date-range filtering, attendee reads, create/list/get/update/delete reminders, open/edit dialog functions safely resolve, all permission functions',
-            missing: 'real EventKit / CalendarContract access (the in-memory store does not surface events the user actually owns), calendar sync across processes/reloads, native calendar UI dialogs (presentEvent/createEventDialog), recurrence rule expansion (RRULE), attendee response/availability semantics, exact per-iOS-version Simulator calendar set (the seeded "Calendar"/"Birthdays" pair is the stable baseline)'
+            note: 'native-seam: upstream expo-calendar JS runs from the bundle over an in-memory EventKit-shaped store seeded faithfully to a fresh iOS Simulator \u2014 a writable local "Calendar" on the "Default" local source plus the always-present read-only "Birthdays" calendar, so getCalendarsAsync/getDefaultCalendarAsync match what a real RN app sees on the conformance Simulator (no sootsim brand names leak into guest calendar pickers). create/read/update/delete then mutate that store like EKEventStore. daily recurrence queries expand lazily inside the requested range and preserve local wall times across named-zone offset changes.',
+            working: 'reference-Simulator default calendar set (writable "Calendar" + read-only "Birthdays", faithful "Default" local source); real RN + sootsim validated event permission/create/read/update/range-query/attendee-read/delete smoke; upstream enums and JS validation, create/update/delete calendars, create/list/get/update/delete events with date-range filtering; sootsim-validated bounded daily recurrence expansion with interval/count rules, inclusive overlap boundaries, named time zones, and whole-series update/delete; attendee reads, create/list/get/update/delete reminders, open/edit dialog functions safely resolve, all permission functions',
+            missing: 'real EventKit / CalendarContract access (the in-memory store does not surface events the user actually owns), calendar sync across processes/reloads, native calendar UI dialogs (presentEvent/createEventDialog), weekly/monthly/yearly and advanced recurrence rule expansion, detached-instance and future-split mutation semantics, attendee response/availability semantics, exact per-iOS-version Simulator calendar set (the seeded "Calendar"/"Birthdays" pair is the stable baseline)'
           }
         ]
       },
@@ -14147,7 +14147,7 @@ function scanDepsWithData(pkg, data) {
         version,
         coverage: 0.3,
         status: "auto-stub",
-        note: "not yet verified; it may work through SootSim's generic native seam",
+        note: "not yet verified; it may work through rnx's generic native seam",
         rnx
       });
       continue;
@@ -15689,6 +15689,7 @@ var init_cli_version = __esm({
 var home_paths_exports = {};
 __export(home_paths_exports, {
   ACTIVE_RUNTIME_FILE: () => ACTIVE_RUNTIME_FILE,
+  CLI_UPDATE_FILE: () => CLI_UPDATE_FILE,
   CONFIG_FILE: () => CONFIG_FILE,
   DAEMON_HEARTBEAT_STALE_MS: () => DAEMON_HEARTBEAT_STALE_MS,
   DAEMON_LOCKFILE: () => DAEMON_LOCKFILE,
@@ -15699,6 +15700,7 @@ __export(home_paths_exports, {
   cacheDir: () => cacheDir,
   cameraFixturesDir: () => cameraFixturesDir,
   claimDaemonLockfile: () => claimDaemonLockfile,
+  cliUpdateFilePath: () => cliUpdateFilePath,
   configFilePath: () => configFilePath,
   consumeRuntimeUpgradeNotice: () => consumeRuntimeUpgradeNotice,
   daemonAppBundlePath: () => daemonAppBundlePath,
@@ -15817,6 +15819,9 @@ function devBridgeLockfilePath(bridgePort) {
 function configFilePath() {
   return import_node_path4.default.join(rnxHomeDir(), CONFIG_FILE);
 }
+function cliUpdateFilePath() {
+  return import_node_path4.default.join(rnxHomeDir(), CLI_UPDATE_FILE);
+}
 function readSharedConfig() {
   try {
     const raw = import_node_fs4.default.readFileSync(configFilePath(), "utf8");
@@ -16200,7 +16205,7 @@ function removeDevBridgeLockfile(owner) {
   } catch {
   }
 }
-var import_node_crypto, import_node_fs4, import_node_os, import_node_path4, RNX_HOME_ENV, ACTIVE_RUNTIME_FILE, DAEMON_LOCKFILE, DEV_BRIDGES_DIR, CONFIG_FILE, DAEMON_HEARTBEAT_STALE_MS, CURRENT_ONBOARDING_VERSION, DAEMON_LOCKFILE_MAX_BYTES, DAEMON_CLAIM_STALE_MS;
+var import_node_crypto, import_node_fs4, import_node_os, import_node_path4, RNX_HOME_ENV, ACTIVE_RUNTIME_FILE, DAEMON_LOCKFILE, DEV_BRIDGES_DIR, CONFIG_FILE, CLI_UPDATE_FILE, DAEMON_HEARTBEAT_STALE_MS, CURRENT_ONBOARDING_VERSION, DAEMON_LOCKFILE_MAX_BYTES, DAEMON_CLAIM_STALE_MS;
 var init_home_paths = __esm({
   "src/home-paths.ts"() {
     "use strict";
@@ -16213,6 +16218,7 @@ var init_home_paths = __esm({
     DAEMON_LOCKFILE = "daemon.json";
     DEV_BRIDGES_DIR = "dev-bridges";
     CONFIG_FILE = "config.json";
+    CLI_UPDATE_FILE = "cli-update.json";
     DAEMON_HEARTBEAT_STALE_MS = 3e4;
     CURRENT_ONBOARDING_VERSION = 1;
     DAEMON_LOCKFILE_MAX_BYTES = 16 * 1024;
@@ -18560,7 +18566,7 @@ var init_open_url = __esm({
   }
 });
 
-// ../contrast-harness/src/planeProtocol.ts
+// ../rnx-box/src/planeProtocol.ts
 function encodeBase64(bytes) {
   let binary = "";
   const CHUNK = 32768;
@@ -18635,47 +18641,47 @@ async function dispatchPlaneCommand(plane, type, msg, mutationOptions) {
 }
 var PLANE_FLAG_READ_ONLY, PLANE_FLAG_BINARY;
 var init_planeProtocol = __esm({
-  "../contrast-harness/src/planeProtocol.ts"() {
+  "../rnx-box/src/planeProtocol.ts"() {
     "use strict";
     PLANE_FLAG_READ_ONLY = 1;
     PLANE_FLAG_BINARY = 2;
   }
 });
 
-// ../contrast-harness/src/projectFileCache.ts
+// ../rnx-box/src/projectFileCache.ts
 var init_projectFileCache = __esm({
-  "../contrast-harness/src/projectFileCache.ts"() {
+  "../rnx-box/src/projectFileCache.ts"() {
     "use strict";
   }
 });
 
-// ../contrast-harness/src/planeClient.ts
+// ../rnx-box/src/planeClient.ts
 var init_planeClient = __esm({
-  "../contrast-harness/src/planeClient.ts"() {
+  "../rnx-box/src/planeClient.ts"() {
     "use strict";
     init_planeProtocol();
     init_projectFileCache();
   }
 });
 
-// ../contrast-harness/src/projectFilePlaneRpc.ts
+// ../rnx-box/src/projectFilePlaneRpc.ts
 var init_projectFilePlaneRpc = __esm({
-  "../contrast-harness/src/projectFilePlaneRpc.ts"() {
+  "../rnx-box/src/projectFilePlaneRpc.ts"() {
     "use strict";
     init_planeProtocol();
   }
 });
 
-// ../contrast-harness/src/planeTransport.browser.ts
+// ../rnx-box/src/planeTransport.browser.ts
 var init_planeTransport_browser = __esm({
-  "../contrast-harness/src/planeTransport.browser.ts"() {
+  "../rnx-box/src/planeTransport.browser.ts"() {
     "use strict";
   }
 });
 
-// ../contrast-harness/src/plane.ts
+// ../rnx-box/src/plane.ts
 var init_plane = __esm({
-  "../contrast-harness/src/plane.ts"() {
+  "../rnx-box/src/plane.ts"() {
     "use strict";
     init_planeProtocol();
     init_planeClient();
@@ -18719,9 +18725,11 @@ var init_checkout_plane = __esm({
       // long a wedged git is waited on, never whether it is waited on, so proving
       // the kill does not have to cost the production deadline.
       listTimeoutMs;
+      trackedOnly;
       constructor(root, options = {}) {
         this.root = import_node_path10.default.resolve(root);
         this.listTimeoutMs = options.listTimeoutMs ?? LIST_FILES_TIMEOUT_MS;
+        this.trackedOnly = options.trackedOnly ?? false;
       }
       index() {
         return this.entries;
@@ -18729,7 +18737,8 @@ var init_checkout_plane = __esm({
       async refresh() {
         let stdout;
         try {
-          stdout = (0, import_node_child_process5.execFileSync)("git", ["ls-files", "-co", "--exclude-standard", "-z"], {
+          const args = this.trackedOnly ? ["ls-files", "-z"] : ["ls-files", "-co", "--exclude-standard", "-z"];
+          stdout = (0, import_node_child_process5.execFileSync)("git", args, {
             cwd: this.root,
             encoding: "utf8",
             maxBuffer: 64 * 1024 * 1024,
@@ -18749,7 +18758,7 @@ var init_checkout_plane = __esm({
         }
         if (stdout.length === 0) {
           throw new CheckoutRequiresGitError(
-            `git listed no files in ${this.root}. either git tracks nothing there and nothing untracked is visible to it, or this machine could not read the child process's output.`
+            `git listed no ${this.trackedOnly ? "tracked " : ""}files in ${this.root}. either the checkout contains no eligible files, or this machine could not read the child process's output.`
           );
         }
         const next = /* @__PURE__ */ new Map();
@@ -19490,8 +19499,8 @@ var init_bridge_host = __esm({
       static USER_BOOT_LEASE_TTL_MS = 6e4;
       static SIM_RECONNECT_TTL_MS = 3e4;
       // abandoned-tab GC. the ws heartbeat only reaps sims whose socket went
-      // dead — but a background tab from a prior `sootsim open` / QA / test run
-      // keeps its socket alive (the page still pongs) forever, so `sootsim list`
+      // dead — but a background tab from a prior `rnx open` / QA / test run
+      // keeps its socket alive (the page still pongs) forever, so `rnx list`
       // accretes dozens of zombie sims that all time out on every command (QA
       // F21-3, carried F19-2). reap a sim only when it is provably nobody's:
       // not primary, not user-focused, no CLI attached, no active lease, and no
@@ -19499,7 +19508,7 @@ var init_bridge_host = __esm({
       // terminal 4001 code, so the client closes the abandoned window instead
       // of reconnecting the zombie straight back in.
       static SIM_IDLE_REAP_TTL_MS = 30 * 6e4;
-      // automation sims (spawned by the playwright driver: `sootsim open --driver
+      // automation sims (spawned by the playwright driver: `rnx open --driver
       // playwright`, the factory/screenshot capture path — `meta.sootsimHostDriver
       // === 'playwright'`) are unattended one-shot browsers, never a human's tab. a
       // capture run opens one per slide/app/retry and the 30-min human/dev TTL lets
@@ -19529,7 +19538,7 @@ var init_bridge_host = __esm({
       // dropped, sim crashed) leave their server-side WebSocket sitting "open"
       // forever. ping every WS_HEARTBEAT_INTERVAL_MS; if the previous round's
       // ping was never answered, terminate(). that fires 'close' which runs the
-      // sim-cleanup path and stops `sootsim list` from showing 8 zombie
+      // sim-cleanup path and stops `rnx list` from showing 8 zombie
       // sims that all time out on every command.
       wsHeartbeatTimer = null;
       wsIsAlive = /* @__PURE__ */ new WeakMap();
@@ -20733,7 +20742,7 @@ var init_bridge_host = __esm({
         this.sweepRestorableSims(now);
         this.reapIdleSims(now);
       }
-      // GC abandoned sims so `sootsim list` stays usable across long dev / QA /
+      // GC abandoned sims so `rnx list` stays usable across long dev / QA /
       // test sessions (F21-3). conservative on purpose: a sim is only reaped
       // when every "someone cares about this" signal is absent.
       //
@@ -20749,7 +20758,7 @@ var init_bridge_host = __esm({
       // using is the primary and/or holds a fresh user-active lease; one that is
       // none of those and idle past the TTL is abandoned regardless of a stale
       // focus flag.
-      // automation sims are spawned by the playwright driver (`sootsim open
+      // automation sims are spawned by the playwright driver (`rnx open
       // --driver playwright`, the factory/screenshot capture path), which tags them
       // with `meta.sootsimHostDriver === 'playwright'` via the host's addInitScript.
       // they are unattended one-shot browsers, never a human's tab, so they get a
@@ -21252,6 +21261,8 @@ var init_bridge_host = __esm({
             return "evaluated page state";
           case "screenshot":
             return "captured screenshot";
+          case "capture":
+            return "captured app screen";
           case "tap":
             return "sent tap event";
           case "keyboard":
@@ -21416,6 +21427,234 @@ var init_cli_constants = __esm({
   }
 });
 
+// src/cloud-contract.ts
+var RNX_CLOUD_MAX_ARTIFACT_BYTES, RNX_CLOUD_DESIGN_MAX_STORAGE_BYTES;
+var init_cloud_contract = __esm({
+  "src/cloud-contract.ts"() {
+    "use strict";
+    RNX_CLOUD_MAX_ARTIFACT_BYTES = 20 * 1024 * 1024;
+    RNX_CLOUD_DESIGN_MAX_STORAGE_BYTES = 1024 * 1024;
+  }
+});
+
+// cli/cloud-session.ts
+function isRecord3(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function normalizeCloudOrigin(source) {
+  let parsed;
+  try {
+    parsed = new URL(source);
+  } catch {
+    throw new Error(`invalid RNX Cloud origin: ${source}`);
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+    throw new Error(`RNX Cloud origin must be an HTTP(S) origin: ${source}`);
+  }
+  if (parsed.protocol === "http:" && !isLoopbackHost(parsed.hostname)) {
+    throw new Error(`RNX Cloud origin requires HTTPS outside loopback: ${source}`);
+  }
+  return parsed.origin;
+}
+function createCloudSession(input) {
+  const session = {
+    version: CLOUD_SESSION_VERSION,
+    simId: input.simId.trim(),
+    apiOrigin: normalizeCloudOrigin(input.apiOrigin.trim()),
+    claimId: input.claimId.trim(),
+    token: input.token
+  };
+  if (!session.simId || !session.claimId || !session.token) {
+    throw new Error("cloud session requires simulator, origin, claim, and token");
+  }
+  return session;
+}
+function parseCloudSession(encoded) {
+  const value = encoded.trim();
+  if (!value || value.length > MAX_ENCODED_SESSION_BYTES || !/^[A-Za-z0-9_-]+$/.test(value)) {
+    throw new Error(`${RNX_CLOUD_SESSION_ENV} is invalid`);
+  }
+  let parsed;
+  try {
+    const bytes = Buffer.from(value, "base64url");
+    if (bytes.toString("base64url") !== value) {
+      throw new Error("non-canonical cloud session");
+    }
+    parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch {
+    throw new Error(`${RNX_CLOUD_SESSION_ENV} is invalid`);
+  }
+  if (!isRecord3(parsed) || parsed.version !== CLOUD_SESSION_VERSION) {
+    throw new Error(`${RNX_CLOUD_SESSION_ENV} is invalid`);
+  }
+  const simId = parsed.simId;
+  const apiOrigin = parsed.apiOrigin;
+  const claimId = parsed.claimId;
+  const token = parsed.token;
+  if (typeof simId !== "string" || typeof apiOrigin !== "string" || typeof claimId !== "string" || typeof token !== "string") {
+    throw new Error(`${RNX_CLOUD_SESSION_ENV} is invalid`);
+  }
+  try {
+    return createCloudSession({ simId, apiOrigin, claimId, token });
+  } catch {
+    throw new Error(`${RNX_CLOUD_SESSION_ENV} is invalid`);
+  }
+}
+function readCloudSession(environment = process.env) {
+  const encoded = environment[RNX_CLOUD_SESSION_ENV];
+  return encoded?.trim() ? parseCloudSession(encoded) : null;
+}
+var CLOUD_SESSION_VERSION, MAX_ENCODED_SESSION_BYTES, RNX_CLOUD_SESSION_ENV, RNX_SHELL_UPDATE_PREFIX, RNX_SHELL_UPDATE_SET_PREFIX, RNX_SHELL_UPDATE_UNSET;
+var init_cloud_session = __esm({
+  "cli/cloud-session.ts"() {
+    "use strict";
+    init_backend_origin();
+    CLOUD_SESSION_VERSION = 1;
+    MAX_ENCODED_SESSION_BYTES = 32 * 1024;
+    RNX_CLOUD_SESSION_ENV = "RNX_CLOUD_SESSION";
+    RNX_SHELL_UPDATE_PREFIX = "__RNX_SHELL_UPDATE_V1__";
+    RNX_SHELL_UPDATE_SET_PREFIX = `${RNX_SHELL_UPDATE_PREFIX}set:`;
+    RNX_SHELL_UPDATE_UNSET = `${RNX_SHELL_UPDATE_PREFIX}unset`;
+  }
+});
+
+// cli/cloud-client.ts
+function isRecord4(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function responseError(status, text) {
+  if (text) {
+    try {
+      const parsed = JSON.parse(text);
+      const error = isRecord4(parsed) ? parsed.error : null;
+      if (isRecord4(error) && typeof error.message === "string") {
+        return new Error(`RNX Cloud request failed (${status}): ${error.message}`);
+      }
+    } catch {
+    }
+  }
+  return new Error(
+    `RNX Cloud request failed (${status})${text.trim() ? `: ${text.trim()}` : ""}`
+  );
+}
+function resolveCloudSessionForParsed(parsed) {
+  const session = readCloudSession();
+  if (!session) return null;
+  if (parsed.simIdSource === "flag" && parsed.simId !== session.simId) {
+    throw new Error(
+      `this shell is connected to RNX Cloud simulator ${session.simId}; ${parsed.simId ? `--sim ${parsed.simId}` : "the requested simulator"} is not available in this shell`
+    );
+  }
+  return session;
+}
+function cloudCommand(command) {
+  const clean = {};
+  for (const [key, value] of Object.entries(command)) {
+    if (key !== "id" && key !== "simId") clean[key] = value;
+  }
+  if (command.type === "query") {
+    const query = command.query;
+    if (!isRecord4(query) || query.kind !== "tree" && query.kind !== "find" && query.kind !== "count") {
+      throw new Error("RNX Cloud supports only structured tree, node, and count queries");
+    }
+    return clean;
+  }
+  if (command.type === "waitFor") {
+    const options = command.waitForOptions;
+    const condition = isRecord4(options) ? options.condition : null;
+    if (!isRecord4(condition) || condition.type !== "ready" && condition.type !== "present" && condition.type !== "absent") {
+      throw new Error("RNX Cloud supports only ready and selector waits");
+    }
+    return clean;
+  }
+  if (command.type === "state") return clean;
+  if (command.type === "capture" || command.type === "captureRegions") return clean;
+  if (command.type === "setAppearance" || command.type === "openUrl") return clean;
+  if (command.type === "screenshot" && command.crop === void 0 && command.captureFilter === void 0 && (command.layers === void 0 || command.layers === "tenant")) {
+    return clean;
+  }
+  throw new Error(`RNX Cloud does not support bridge command type ${command.type}`);
+}
+function createCloudBridgeForParsed(parsed) {
+  const session = resolveCloudSessionForParsed(parsed);
+  return session ? new CloudBridge(session) : null;
+}
+var import_node_crypto5, DEFAULT_RNX_CLOUD_ORIGIN, CloudBridge;
+var init_cloud_client = __esm({
+  "cli/cloud-client.ts"() {
+    "use strict";
+    import_node_crypto5 = require("node:crypto");
+    init_cloud_contract();
+    init_public_brand();
+    init_cloud_session();
+    DEFAULT_RNX_CLOUD_ORIGIN = rnxPublicBrand.origin;
+    CloudBridge = class {
+      constructor(session) {
+        this.session = session;
+      }
+      plane = "cloud";
+      async send(command, options) {
+        const body = {
+          id: (0, import_node_crypto5.randomUUID)(),
+          claimId: this.session.claimId,
+          command: cloudCommand(command)
+        };
+        let response;
+        try {
+          response = await fetch(
+            `${this.session.apiOrigin}/v1/sims/${encodeURIComponent(this.session.simId)}/commands`,
+            {
+              method: "POST",
+              headers: {
+                authorization: `Bearer ${this.session.token}`,
+                "content-type": "application/json"
+              },
+              body: JSON.stringify(body),
+              ...options?.timeoutMs ? { signal: AbortSignal.timeout(options.timeoutMs) } : {}
+            }
+          );
+        } catch (error) {
+          throw new Error(
+            `could not reach RNX Cloud at ${this.session.apiOrigin}: ${error instanceof Error ? error.message : String(error)}`
+          );
+        }
+        const text = await response.text();
+        if (!response.ok) throw responseError(response.status, text);
+        let parsed;
+        try {
+          parsed = JSON.parse(text);
+        } catch {
+          throw new Error("RNX Cloud command returned unreadable JSON");
+        }
+        if (!isRecord4(parsed) || parsed.id !== body.id) {
+          throw new Error("RNX Cloud command returned an invalid command receipt");
+        }
+        if (typeof parsed.error === "string" && parsed.error) throw new Error(parsed.error);
+        if (!Object.hasOwn(parsed, "result")) {
+          throw new Error("RNX Cloud command receipt has no result");
+        }
+        return parsed.result;
+      }
+      listSims() {
+        return Promise.reject(new Error("RNX Cloud does not expose a local simulator list"));
+      }
+      focusSim() {
+        return Promise.reject(
+          new Error("RNX Cloud simulators have no browser window to focus")
+        );
+      }
+      closeSim() {
+        return Promise.reject(new Error("RNX Cloud close uses the simulator DELETE route"));
+      }
+      claim() {
+        return Promise.reject(new Error("RNX Cloud claim uses the simulator claim route"));
+      }
+      close() {
+      }
+    };
+  }
+});
+
 // cli/parent-pid.ts
 function getParentPid(pid) {
   if (!cached3) cached3 = build2();
@@ -21575,6 +21814,36 @@ var init_parent_pid = __esm({
   }
 });
 
+// cli/secure-file.ts
+function writeSecureJsonAtomic(filepath, value) {
+  (0, import_node_fs12.mkdirSync)((0, import_node_path13.dirname)(filepath), { recursive: true });
+  const temporary = `${filepath}.tmp-${process.pid}-${(0, import_node_crypto6.randomUUID)()}`;
+  let descriptor = null;
+  try {
+    descriptor = (0, import_node_fs12.openSync)(temporary, "wx", 384);
+    (0, import_node_fs12.fchmodSync)(descriptor, 384);
+    (0, import_node_fs12.writeFileSync)(descriptor, `${JSON.stringify(value, null, 2)}
+`);
+    (0, import_node_fs12.fsyncSync)(descriptor);
+    (0, import_node_fs12.closeSync)(descriptor);
+    descriptor = null;
+    (0, import_node_fs12.renameSync)(temporary, filepath);
+  } catch (error) {
+    if (descriptor !== null) (0, import_node_fs12.closeSync)(descriptor);
+    (0, import_node_fs12.rmSync)(temporary, { force: true });
+    throw error;
+  }
+}
+var import_node_crypto6, import_node_fs12, import_node_path13;
+var init_secure_file = __esm({
+  "cli/secure-file.ts"() {
+    "use strict";
+    import_node_crypto6 = require("node:crypto");
+    import_node_fs12 = require("node:fs");
+    import_node_path13 = require("node:path");
+  }
+});
+
 // cli/current-sim.ts
 function findTopAncestor(start, maxDepth = 20) {
   let prev = start;
@@ -21621,50 +21890,57 @@ function getCurrentSimPath() {
   const key = getCliIdentityKey();
   return (0, import_path3.join)((0, import_os.tmpdir)(), `rnx-current-sim-${key}.json`);
 }
-function readCurrentSim() {
+function legacyCloudCredentialDirectory(filepath) {
+  return (0, import_path3.join)((0, import_path3.dirname)(filepath), `${(0, import_path3.basename)(filepath)}.credentials`);
+}
+function readCurrentTarget() {
   const filepath = getCurrentSimPath();
+  (0, import_fs4.rmSync)(legacyCloudCredentialDirectory(filepath), { recursive: true, force: true });
   if (!(0, import_fs4.existsSync)(filepath)) return null;
   try {
     const parsed = JSON.parse((0, import_fs4.readFileSync)(filepath, "utf8"));
-    if (parsed.version !== CURRENT_SIM_VERSION || typeof parsed.simId !== "string" || !parsed.simId.trim() || typeof parsed.updatedAt !== "string") {
+    if (parsed === null || typeof parsed !== "object") {
       (0, import_fs4.rmSync)(filepath, { force: true });
       return null;
     }
-    return {
+    const version = Reflect.get(parsed, "version");
+    const plane = Reflect.get(parsed, "plane");
+    const simId = Reflect.get(parsed, "simId");
+    const updatedAt = Reflect.get(parsed, "updatedAt");
+    if (version !== 1 && version !== CURRENT_SIM_VERSION || version === CURRENT_SIM_VERSION && plane !== "local" || typeof simId !== "string" || !simId.trim() || typeof updatedAt !== "string") {
+      (0, import_fs4.rmSync)(filepath, { force: true });
+      return null;
+    }
+    const target = {
       version: CURRENT_SIM_VERSION,
-      simId: parsed.simId.trim(),
-      updatedAt: parsed.updatedAt
+      plane: "local",
+      simId: simId.trim(),
+      updatedAt
     };
+    if (version === 1) writeSecureJsonAtomic(filepath, target);
+    return target;
   } catch {
     (0, import_fs4.rmSync)(filepath, { force: true });
     return null;
   }
 }
 function readCurrentSimId() {
-  return readCurrentSim()?.simId || null;
+  return readCurrentTarget()?.simId ?? null;
 }
 function saveCurrentSimId(simId) {
   const normalized = simId.trim();
   if (!normalized) return;
-  const filepath = getCurrentSimPath();
-  (0, import_fs4.mkdirSync)((0, import_path3.dirname)(filepath), { recursive: true });
-  (0, import_fs4.writeFileSync)(
-    filepath,
-    JSON.stringify(
-      {
-        version: CURRENT_SIM_VERSION,
-        simId: normalized,
-        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-      },
-      null,
-      2
-    ) + "\n"
-  );
+  writeSecureJsonAtomic(getCurrentSimPath(), {
+    version: CURRENT_SIM_VERSION,
+    plane: "local",
+    simId: normalized,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
 }
 function clearCurrentSimId() {
   (0, import_fs4.rmSync)(getCurrentSimPath(), { force: true });
 }
-var import_fs4, import_os, import_path3, CURRENT_SIM_VERSION, CURRENT_SIM_PATH_ENV, IDENTITY_ENV_VARS, IMMORTAL_HOST_COMM_RE;
+var import_fs4, import_os, import_path3, CURRENT_SIM_VERSION, CURRENT_SIM_PATH_ENV, IDENTITY_ENV_VARS, IMMORTAL_HOST_COMM_RE, readCurrentSim;
 var init_current_sim = __esm({
   "cli/current-sim.ts"() {
     "use strict";
@@ -21672,7 +21948,8 @@ var init_current_sim = __esm({
     import_os = require("os");
     import_path3 = require("path");
     init_parent_pid();
-    CURRENT_SIM_VERSION = 1;
+    init_secure_file();
+    CURRENT_SIM_VERSION = 2;
     CURRENT_SIM_PATH_ENV = "SOOTSIM_CLI_CURRENT_SIM_PATH";
     IDENTITY_ENV_VARS = [
       "RNX_CLI_IDENTITY",
@@ -21703,6 +21980,7 @@ var init_current_sim = __esm({
       // vscode integrated terminal
     ];
     IMMORTAL_HOST_COMM_RE = /^(?:tmux|screen)|^tm$/i;
+    readCurrentSim = readCurrentTarget;
   }
 });
 
@@ -21736,17 +22014,17 @@ function liveDevBridgeLockfiles() {
   return readDevBridgeLockfiles().filter((lockfile) => isDevBridgeLockfileFresh(lockfile));
 }
 function checkoutRoot(cwd) {
-  let current = import_node_path13.default.resolve(cwd);
+  let current = import_node_path14.default.resolve(cwd);
   while (true) {
-    if (import_node_fs12.default.existsSync(import_node_path13.default.join(current, ".git"))) return current;
-    const parent = import_node_path13.default.dirname(current);
+    if (import_node_fs13.default.existsSync(import_node_path14.default.join(current, ".git"))) return current;
+    const parent = import_node_path14.default.dirname(current);
     if (parent === current) return null;
     current = parent;
   }
 }
 function pathContains(parent, child) {
-  const relative = import_node_path13.default.relative(parent, child);
-  return relative === "" || relative !== ".." && !relative.startsWith(`..${import_node_path13.default.sep}`) && !import_node_path13.default.isAbsolute(relative);
+  const relative = import_node_path14.default.relative(parent, child);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${import_node_path14.default.sep}`) && !import_node_path14.default.isAbsolute(relative);
 }
 function resolveDefaultDevBridgeLockfile() {
   const lockfiles = liveDevBridgeLockfiles();
@@ -21933,9 +22211,9 @@ function parseBridgeCliArgs(args, opts = {}) {
     }
   }
   if (!simId) {
-    const savedSimId = readCurrentSimId();
-    if (savedSimId) {
-      simId = savedSimId.trim() || void 0;
+    const savedSim = readCurrentSim();
+    if (savedSim) {
+      simId = savedSim.simId.trim() || void 0;
       simIdSource = "saved";
     }
   }
@@ -22031,6 +22309,7 @@ function createBridge(wsPort, opts = {}) {
     }
   });
   return {
+    plane: "local",
     async send(cmd, callOpts) {
       const effectiveTimeoutMs = callOpts?.timeoutMs ?? commandTimeoutMs;
       const sendOnce = async (defaultSimId) => {
@@ -22113,6 +22392,8 @@ function createBridge(wsPort, opts = {}) {
   };
 }
 function createBridgeFromParsed(parsed) {
+  const cloudBridge = createCloudBridgeForParsed(parsed);
+  if (cloudBridge) return cloudBridge;
   return createBridge(parsed.wsPort, {
     commandTimeoutMs: parsed.commandTimeoutMs,
     simId: parsed.simId,
@@ -22175,16 +22456,17 @@ async function callInBridge(bridge, path20, ...args) {
 async function callInBridgeWrite(bridge, path20, ...args) {
   return bridge.send({ type: "call", path: path20, args, acquireLock: true });
 }
-var import_node_fs12, import_node_path13, import_ws3, RNX_PLACEMENT_ENV, resolvedWorld, BridgeSimLockedError;
+var import_node_fs13, import_node_path14, import_ws3, RNX_PLACEMENT_ENV, resolvedWorld, BridgeSimLockedError;
 var init_ws_bridge = __esm({
   "cli/ws-bridge.ts"() {
     "use strict";
-    import_node_fs12 = __toESM(require("node:fs"), 1);
-    import_node_path13 = __toESM(require("node:path"), 1);
+    import_node_fs13 = __toESM(require("node:fs"), 1);
+    import_node_path14 = __toESM(require("node:path"), 1);
     import_ws3 = require("ws");
     init_bridge_constants();
     init_cli_constants();
     init_home_paths();
+    init_cloud_client();
     init_current_sim();
     RNX_PLACEMENT_ENV = "RNX_PLACEMENT";
     resolvedWorld = null;
@@ -22220,9 +22502,8 @@ function isAppDeepLinkTarget(target) {
 async function openAppUrl(bridge, target) {
   const normalized = normalizeAppUrlTarget(target);
   const result = await bridge.send({
-    type: "call",
-    path: "SootSim.bridges.test.openDeepLink",
-    args: [normalized]
+    type: "openUrl",
+    url: normalized
   });
   if (result !== null && typeof result === "object" && Reflect.get(result, "ok") === false) {
     const error = Reflect.get(result, "error");
@@ -22543,9 +22824,9 @@ var init_profiles = __esm({
 // cli/app-project.ts
 function firstNamedFile(dir, names) {
   for (const name2 of names) {
-    const candidate = import_node_path14.default.join(dir, name2);
+    const candidate = import_node_path15.default.join(dir, name2);
     try {
-      if (import_node_fs13.default.statSync(candidate).isFile()) return candidate;
+      if (import_node_fs14.default.statSync(candidate).isFile()) return candidate;
     } catch {
     }
   }
@@ -22558,24 +22839,24 @@ function findRNXAppConfig(dir) {
   return firstNamedFile(dir, RNX_APP_CONFIG_NAMES);
 }
 function resolveAppProject(projectRoot) {
-  const appDir = import_node_path14.default.resolve(projectRoot);
+  const appDir = import_node_path15.default.resolve(projectRoot);
   try {
-    if (!import_node_fs13.default.statSync(appDir).isDirectory()) return null;
+    if (!import_node_fs14.default.statSync(appDir).isDirectory()) return null;
   } catch {
     return null;
   }
   const configPath = findRNXAppConfig(appDir);
-  if (!configPath && !findExpoAppConfig(appDir) && !import_node_fs13.default.existsSync(import_node_path14.default.join(appDir, "package.json"))) {
+  if (!configPath && !findExpoAppConfig(appDir) && !import_node_fs14.default.existsSync(import_node_path15.default.join(appDir, "package.json"))) {
     return null;
   }
   return { appDir, configPath };
 }
-var import_node_fs13, import_node_path14, EXPO_APP_CONFIG_NAMES, RNX_APP_CONFIG_NAMES;
+var import_node_fs14, import_node_path15, EXPO_APP_CONFIG_NAMES, RNX_APP_CONFIG_NAMES;
 var init_app_project = __esm({
   "cli/app-project.ts"() {
     "use strict";
-    import_node_fs13 = __toESM(require("node:fs"), 1);
-    import_node_path14 = __toESM(require("node:path"), 1);
+    import_node_fs14 = __toESM(require("node:fs"), 1);
+    import_node_path15 = __toESM(require("node:path"), 1);
     EXPO_APP_CONFIG_NAMES = [
       "app.config.js",
       "app.config.ts",
@@ -22604,13 +22885,13 @@ function isRNXConfig(value) {
 }
 function resolveConfigReplacementFiles(config, configPath) {
   if (!config.modules) return config;
-  const configDir = import_node_path15.default.dirname(configPath);
+  const configDir = import_node_path16.default.dirname(configPath);
   return {
     ...config,
     modules: Object.fromEntries(
       Object.entries(config.modules).map(([name2, resolution]) => [
         name2,
-        resolution && typeof resolution === "object" && "file" in resolution ? { ...resolution, file: import_node_path15.default.resolve(configDir, resolution.file) } : resolution
+        resolution && typeof resolution === "object" && "file" in resolution ? { ...resolution, file: import_node_path16.default.resolve(configDir, resolution.file) } : resolution
       ])
     )
   };
@@ -22640,12 +22921,12 @@ async function resolveRNXAppConfig(startDir = process.cwd()) {
   const project = resolveAppProject(startDir);
   return { project, config: await loadRNXAppConfig(project) };
 }
-var import_node_module, import_node_path15, import_jiti, require2;
+var import_node_module, import_node_path16, import_jiti, require2;
 var init_app_config = __esm({
   "cli/app-config.ts"() {
     "use strict";
     import_node_module = require("node:module");
-    import_node_path15 = __toESM(require("node:path"), 1);
+    import_node_path16 = __toESM(require("node:path"), 1);
     init_src();
     import_jiti = require("jiti");
     init_public_brand();
@@ -22713,13 +22994,13 @@ function discoverNativeLinkedAppFonts(opts) {
       scannedFontDirectories++;
       let entries;
       try {
-        entries = import_node_fs14.default.readdirSync(current.dir, { withFileTypes: true });
+        entries = import_node_fs15.default.readdirSync(current.dir, { withFileTypes: true });
       } catch {
         continue;
       }
       for (const entry of entries) {
         if (entry.isSymbolicLink()) continue;
-        const fullPath = import_node_path16.default.join(current.dir, entry.name);
+        const fullPath = import_node_path17.default.join(current.dir, entry.name);
         if (entry.isDirectory()) {
           if (current.depth < 4 && pending.length < 64 && !entry.name.startsWith(".")) {
             pending.push({ dir: fullPath, depth: current.depth + 1 });
@@ -22727,15 +23008,15 @@ function discoverNativeLinkedAppFonts(opts) {
           continue;
         }
         if (!entry.isFile() || !/\.(ttf|otf|woff|woff2)$/i.test(entry.name)) continue;
-        const relative = import_node_path16.default.relative(root, fullPath).split(import_node_path16.default.sep).join("/");
-        fontPaths.push(import_node_path16.default.posix.join(metroPathPrefix, relative));
+        const relative = import_node_path17.default.relative(root, fullPath).split(import_node_path17.default.sep).join("/");
+        fontPaths.push(import_node_path17.default.posix.join(metroPathPrefix, relative));
         if (fontPaths.length >= 256) break;
       }
     }
   };
   try {
     const packageJson = JSON.parse(
-      import_node_fs14.default.readFileSync(import_node_path16.default.join(selectedAppDir, "package.json"), "utf8")
+      import_node_fs15.default.readFileSync(import_node_path17.default.join(selectedAppDir, "package.json"), "utf8")
     );
     const dependencyNames = /* @__PURE__ */ new Set();
     for (const field of ["dependencies", "devDependencies", "optionalDependencies"]) {
@@ -22750,24 +23031,24 @@ function discoverNativeLinkedAppFonts(opts) {
       const config = Reflect.get(packageJson, "reactNativeVectorIcons");
       const configuredFontDir = config && typeof config === "object" ? Reflect.get(config, "fontDir") : null;
       const configuredDir = typeof configuredFontDir === "string" ? configuredFontDir : "rnvi-fonts";
-      const root = import_node_path16.default.resolve(selectedAppDir, configuredDir);
-      const relativeRoot = import_node_path16.default.relative(selectedAppDir, root);
-      if (!relativeRoot.startsWith("..") && !import_node_path16.default.isAbsolute(relativeRoot)) {
-        collectFontFiles(root, relativeRoot.split(import_node_path16.default.sep).join("/"));
+      const root = import_node_path17.default.resolve(selectedAppDir, configuredDir);
+      const relativeRoot = import_node_path17.default.relative(selectedAppDir, root);
+      if (!relativeRoot.startsWith("..") && !import_node_path17.default.isAbsolute(relativeRoot)) {
+        collectFontFiles(root, relativeRoot.split(import_node_path17.default.sep).join("/"));
       }
-      const vectorIconRequire = (0, import_node_module2.createRequire)(import_node_path16.default.join(selectedAppDir, "package.json"));
+      const vectorIconRequire = (0, import_node_module2.createRequire)(import_node_path17.default.join(selectedAppDir, "package.json"));
       for (const dependencyName of vectorIconDependencies) {
         try {
           const entryPath = vectorIconRequire.resolve(dependencyName);
-          const dependencyPath = dependencyName.split("/").join(import_node_path16.default.sep);
-          const marker = `${import_node_path16.default.sep}node_modules${import_node_path16.default.sep}${dependencyPath}${import_node_path16.default.sep}`;
+          const dependencyPath = dependencyName.split("/").join(import_node_path17.default.sep);
+          const marker = `${import_node_path17.default.sep}node_modules${import_node_path17.default.sep}${dependencyPath}${import_node_path17.default.sep}`;
           const markerIndex = entryPath.lastIndexOf(marker);
           if (markerIndex === -1) continue;
           const packageRoot = entryPath.slice(0, markerIndex + marker.length - 1);
           const fontsDir = dependencyName === "react-native-vector-icons" ? "Fonts" : "fonts";
           collectFontFiles(
-            import_node_path16.default.join(packageRoot, fontsDir),
-            import_node_path16.default.posix.join("node_modules", dependencyName, fontsDir)
+            import_node_path17.default.join(packageRoot, fontsDir),
+            import_node_path17.default.posix.join("node_modules", dependencyName, fontsDir)
           );
         } catch {
         }
@@ -22776,37 +23057,37 @@ function discoverNativeLinkedAppFonts(opts) {
   } catch {
   }
   try {
-    const configPath = import_node_path16.default.join(selectedAppDir, "react-native.config.js");
-    if (import_node_fs14.default.statSync(configPath).isFile()) {
-      const appConfigRequire = (0, import_node_module2.createRequire)(import_node_path16.default.join(selectedAppDir, "package.json"));
+    const configPath = import_node_path17.default.join(selectedAppDir, "react-native.config.js");
+    if (import_node_fs15.default.statSync(configPath).isFile()) {
+      const appConfigRequire = (0, import_node_module2.createRequire)(import_node_path17.default.join(selectedAppDir, "package.json"));
       const rnConfig = appConfigRequire(configPath);
       const assets = rnConfig && typeof rnConfig === "object" ? Reflect.get(rnConfig, "assets") : null;
       if (Array.isArray(assets)) {
         for (const assetDir of assets) {
           if (typeof assetDir !== "string") continue;
-          const root = import_node_path16.default.resolve(selectedAppDir, assetDir);
-          const relativeRoot = import_node_path16.default.relative(selectedAppDir, root);
-          if (relativeRoot.startsWith("..") || import_node_path16.default.isAbsolute(relativeRoot)) continue;
-          collectFontFiles(root, relativeRoot.split(import_node_path16.default.sep).join("/"));
+          const root = import_node_path17.default.resolve(selectedAppDir, assetDir);
+          const relativeRoot = import_node_path17.default.relative(selectedAppDir, root);
+          if (relativeRoot.startsWith("..") || import_node_path17.default.isAbsolute(relativeRoot)) continue;
+          collectFontFiles(root, relativeRoot.split(import_node_path17.default.sep).join("/"));
         }
       }
     }
   } catch {
   }
   if (platform === "ios") {
-    const iosDir = import_node_path16.default.join(selectedAppDir, "ios");
+    const iosDir = import_node_path17.default.join(selectedAppDir, "ios");
     try {
-      const targetDirs = import_node_fs14.default.readdirSync(iosDir, { withFileTypes: true }).filter(
+      const targetDirs = import_node_fs15.default.readdirSync(iosDir, { withFileTypes: true }).filter(
         (entry) => entry.isDirectory() && !entry.isSymbolicLink() && entry.name !== "Pods" && entry.name !== "build" && !entry.name.startsWith(".")
       ).slice(0, 64);
-      const plistPaths = [import_node_path16.default.join(iosDir, "Info.plist")];
+      const plistPaths = [import_node_path17.default.join(iosDir, "Info.plist")];
       for (const entry of targetDirs) {
-        plistPaths.push(import_node_path16.default.join(iosDir, entry.name, "Info.plist"));
+        plistPaths.push(import_node_path17.default.join(iosDir, entry.name, "Info.plist"));
       }
       for (const plistPath of plistPaths) {
         let parsed;
         try {
-          parsed = parsePlistSource(import_node_fs14.default.readFileSync(plistPath, "utf8"));
+          parsed = parsePlistSource(import_node_fs15.default.readFileSync(plistPath, "utf8"));
         } catch {
           continue;
         }
@@ -22816,21 +23097,21 @@ function discoverNativeLinkedAppFonts(opts) {
         for (const declaredFont of declaredFonts) {
           if (typeof declaredFont !== "string") continue;
           const candidates = [
-            import_node_path16.default.resolve(import_node_path16.default.dirname(plistPath), declaredFont),
-            import_node_path16.default.resolve(iosDir, declaredFont)
+            import_node_path17.default.resolve(import_node_path17.default.dirname(plistPath), declaredFont),
+            import_node_path17.default.resolve(iosDir, declaredFont)
           ];
           const fontPath = candidates.find((candidate) => {
-            const relative = import_node_path16.default.relative(selectedAppDir, candidate);
-            if (relative.startsWith("..") || import_node_path16.default.isAbsolute(relative)) return false;
+            const relative = import_node_path17.default.relative(selectedAppDir, candidate);
+            if (relative.startsWith("..") || import_node_path17.default.isAbsolute(relative)) return false;
             try {
-              return import_node_fs14.default.statSync(candidate).isFile();
+              return import_node_fs15.default.statSync(candidate).isFile();
             } catch {
               return false;
             }
           });
           if (!fontPath) continue;
           fontPaths.push(
-            import_node_path16.default.relative(selectedAppDir, fontPath).split(import_node_path16.default.sep).join("/")
+            import_node_path17.default.relative(selectedAppDir, fontPath).split(import_node_path17.default.sep).join("/")
           );
         }
       }
@@ -22869,13 +23150,13 @@ async function resolveMetroProjectRoot(bundleUrl, opts) {
 function encodeAppFontsWire(specs) {
   return specs.map((spec) => `${encodeURIComponent(spec.url)}::${encodeURIComponent(spec.family)}`).join(",");
 }
-var import_node_fs14, import_node_module2, import_node_path16, import_config_plugin_fonts, require3;
+var import_node_fs15, import_node_module2, import_node_path17, import_config_plugin_fonts, require3;
 var init_app_fonts = __esm({
   "cli/app-fonts.ts"() {
     "use strict";
-    import_node_fs14 = __toESM(require("node:fs"), 1);
+    import_node_fs15 = __toESM(require("node:fs"), 1);
     import_node_module2 = require("node:module");
-    import_node_path16 = __toESM(require("node:path"), 1);
+    import_node_path17 = __toESM(require("node:path"), 1);
     import_config_plugin_fonts = require("sootsim-engine/engine/config-plugin-fonts");
     init_dev_server_scanner();
     init_plist();
@@ -23953,7 +24234,7 @@ var init_browser_cache = __esm({
 });
 
 // cli/drivers/playwright-provisioning.ts
-function isRecord3(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvePlaywright() {
@@ -23966,20 +24247,20 @@ function resolvePlaywright() {
         try {
           const modulePath = requireFromRoot.resolve(spec);
           const packageJsonPath = requireFromRoot.resolve(`${spec}/package.json`);
-          const parsed = JSON.parse((0, import_node_fs15.readFileSync)(packageJsonPath, "utf8"));
-          if (!isRecord3(parsed) || typeof parsed.version !== "string") continue;
+          const parsed = JSON.parse((0, import_node_fs16.readFileSync)(packageJsonPath, "utf8"));
+          if (!isRecord5(parsed) || typeof parsed.version !== "string") continue;
           const bin = parsed.bin;
           let binPath = null;
           if (typeof bin === "string") {
             binPath = bin;
-          } else if (isRecord3(bin)) {
+          } else if (isRecord5(bin)) {
             const named = bin.playwright ?? bin["playwright-core"];
             const first = Object.values(bin).find((value) => typeof value === "string");
             binPath = typeof named === "string" ? named : typeof first === "string" ? first : null;
           }
           if (!binPath) continue;
-          const cliPath = (0, import_node_path17.join)((0, import_node_path17.dirname)(packageJsonPath), binPath);
-          if (!(0, import_node_fs15.existsSync)(cliPath)) continue;
+          const cliPath = (0, import_node_path18.join)((0, import_node_path18.dirname)(packageJsonPath), binPath);
+          if (!(0, import_node_fs16.existsSync)(cliPath)) continue;
           return {
             spec,
             modulePath,
@@ -24012,13 +24293,13 @@ function probeBrowser(resolved, env) {
   }
   try {
     const parsed = JSON.parse(probe3.stdout);
-    if (!isRecord3(parsed) || typeof parsed.executablePath !== "string" || typeof parsed.exists !== "boolean") {
+    if (!isRecord5(parsed) || typeof parsed.executablePath !== "string" || typeof parsed.exists !== "boolean") {
       throw new Error("probe returned an invalid result");
     }
     return {
       ok: true,
       executablePath: parsed.executablePath,
-      exists: parsed.exists && (0, import_node_fs15.existsSync)(parsed.executablePath)
+      exists: parsed.exists && (0, import_node_fs16.existsSync)(parsed.executablePath)
     };
   } catch (error) {
     return {
@@ -24057,14 +24338,14 @@ ${detail}` : ""}`
   }
   return { ok: true, executablePath: after.executablePath, installed: true };
 }
-var import_node_child_process6, import_node_fs15, import_node_module4, import_node_path17, PLAYWRIGHT_BROWSER_PROBE;
+var import_node_child_process6, import_node_fs16, import_node_module4, import_node_path18, PLAYWRIGHT_BROWSER_PROBE;
 var init_playwright_provisioning = __esm({
   "cli/drivers/playwright-provisioning.ts"() {
     "use strict";
     import_node_child_process6 = require("node:child_process");
-    import_node_fs15 = require("node:fs");
+    import_node_fs16 = require("node:fs");
     import_node_module4 = require("node:module");
-    import_node_path17 = require("node:path");
+    import_node_path18 = require("node:path");
     PLAYWRIGHT_BROWSER_PROBE = `
 const { existsSync } = require('node:fs');
 const modulePath = process.env.SOOTSIM_PW_MODULE;
@@ -24474,7 +24755,7 @@ const cleanupProfile = () => {
   // we are spawned detached + unref'd so \`rnx open\` returns immediately,
   // which means nothing in the OS process tree ties Chrome's lifetime to the
   // session that asked for it. once the sim connects, the connect-timeout
-  // safety net is cleared, so absent an explicit \`sootsim close\` (or the
+  // safety net is cleared, so absent an explicit \`rnx close\` (or the
   // daemon's idle reaper closing the sim socket) the host would hold Chrome
   // open forever after its owner exits. poll the owning session's pid and tear
   // down when it's gone. ESRCH (kill throws) = owner exited; EPERM = alive but
@@ -24765,10 +25046,10 @@ var init_run_rnx = __esm({
 });
 
 // cli/commands/inspect/env.ts
-function isAgentEnv() {
-  if (process.env.RNX_AGENT === "0") return false;
+function isAgentEnv(env = process.env) {
+  if (env.RNX_AGENT === "0") return false;
   for (const name2 of AGENT_ENV_VARS) {
-    const v = process.env[name2];
+    const v = env[name2];
     if (v && v.trim() && v !== "0") return true;
   }
   return false;
@@ -24933,7 +25214,7 @@ async function activateVersion(version) {
   const notified = await tellDaemonRuntimeChanged(version);
   if (!notified) {
     console.log(
-      `  (no daemon running \u2014 next sootsim/electron launch will pick up ${version})`
+      `  (no daemon running \u2014 next rnx/electron launch will pick up ${version})`
     );
   }
 }
@@ -25240,14 +25521,14 @@ function assertExplicitBridgeLock(preferredPort, explicitPort, lock) {
 }
 async function ensureRuntimeForOpen() {
   const active = readActiveRuntime();
-  if (active && import_node_fs16.default.existsSync(runtimeDir(active))) return;
+  if (active && import_node_fs17.default.existsSync(runtimeDir(active))) return;
   console.error("  installing rnx engine runtime...");
   const { runRuntime: runRuntime2 } = await Promise.resolve().then(() => (init_runtime(), runtime_exports));
   await runRuntime2(["install"], {});
 }
 function spawnSootsim(args) {
   const entry = process.argv[1];
-  if (entry && import_node_fs16.default.existsSync(entry)) {
+  if (entry && import_node_fs17.default.existsSync(entry)) {
     return (0, import_node_child_process7.spawn)(process.execPath, [entry, ...args], {
       detached: true,
       stdio: "ignore",
@@ -25394,10 +25675,10 @@ async function buildResolvedBundleOpenUrl(target, baseUrl, opts = {}) {
 }
 function normalizeReplacementPath(filePath) {
   if (filePath.startsWith("~/")) {
-    return import_node_path18.default.join(import_node_os3.default.homedir(), filePath.slice(2));
+    return import_node_path19.default.join(import_node_os3.default.homedir(), filePath.slice(2));
   }
-  if (import_node_path18.default.isAbsolute(filePath)) return filePath;
-  return import_node_path18.default.resolve(process.cwd(), filePath);
+  if (import_node_path19.default.isAbsolute(filePath)) return filePath;
+  return import_node_path19.default.resolve(process.cwd(), filePath);
 }
 function parseOpenRuntimeConfig(args) {
   const modules = {};
@@ -25416,7 +25697,7 @@ function parseOpenRuntimeConfig(args) {
       }
       const moduleName = raw.slice(0, eqIndex).trim();
       const filePath = normalizeReplacementPath(raw.slice(eqIndex + 1).trim());
-      if (!import_node_fs16.default.existsSync(filePath)) {
+      if (!import_node_fs17.default.existsSync(filePath)) {
         console.error(`  rnx open: replacement file not found: ${filePath}`);
         rnxExit(1);
       }
@@ -25447,7 +25728,7 @@ async function resolveOpenAppProject(resolvedBundle) {
   return advertisedRoot ? resolveAppProject(advertisedRoot) : null;
 }
 async function ensureConfiguredRuntime(version) {
-  if (import_node_fs16.default.existsSync(import_node_path18.default.join(runtimeDir(version), "index.html"))) return;
+  if (import_node_fs17.default.existsSync(import_node_path19.default.join(runtimeDir(version), "index.html"))) return;
   console.error(`  installing configured engine runtime ${version}...`);
   const result = await rnxRuntime.install({
     version,
@@ -25807,7 +26088,7 @@ function playwrightHostPidForSim(sim) {
 function signalDriverLaunchConnected(result) {
   if (!result.connectAckFile) return false;
   try {
-    import_node_fs16.default.writeFileSync(
+    import_node_fs17.default.writeFileSync(
       result.connectAckFile,
       `${JSON.stringify({ connectedAt: Date.now(), pid: result.pid ?? null })}
 `,
@@ -25821,19 +26102,19 @@ function signalDriverLaunchConnected(result) {
 function printDriverDiagnosticLogTail(result) {
   if (!result.diagnosticLogPath) return;
   try {
-    const detail = import_node_fs16.default.readFileSync(result.diagnosticLogPath, "utf8").trim();
+    const detail = import_node_fs17.default.readFileSync(result.diagnosticLogPath, "utf8").trim();
     if (!detail) {
-      console.error(`  ${import_node_path18.default.basename(result.diagnosticLogPath)} was empty`);
+      console.error(`  ${import_node_path19.default.basename(result.diagnosticLogPath)} was empty`);
       return;
     }
     const shown = detail.length > 4e3 ? `\u2026
 ${detail.slice(-4e3)}` : detail;
-    console.error(`  ${import_node_path18.default.basename(result.diagnosticLogPath)}:`);
+    console.error(`  ${import_node_path19.default.basename(result.diagnosticLogPath)}:`);
     console.error(shown);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `  failed to read ${import_node_path18.default.basename(result.diagnosticLogPath)}: ${message}`
+      `  failed to read ${import_node_path19.default.basename(result.diagnosticLogPath)}: ${message}`
     );
   }
 }
@@ -26644,14 +26925,14 @@ async function runCloseCommand(args, opts = {}) {
     bridge.close();
   }
 }
-var import_node_child_process7, import_node_fs16, import_node_os3, import_node_path18, import_settings, import_ws5, DEFAULT_DRIVER_CONNECT_TIMEOUT_MS, DRIVER_CONNECT_INTERVAL_MS, DRIVER_CONNECT_HOST_GRACE_MS, OPEN_BRIDGE_SPAWN_TIMEOUT_MS, SHELL_APPS;
+var import_node_child_process7, import_node_fs17, import_node_os3, import_node_path19, import_settings, import_ws5, DEFAULT_DRIVER_CONNECT_TIMEOUT_MS, DRIVER_CONNECT_INTERVAL_MS, DRIVER_CONNECT_HOST_GRACE_MS, OPEN_BRIDGE_SPAWN_TIMEOUT_MS, SHELL_APPS;
 var init_control = __esm({
   "cli/commands/control.ts"() {
     "use strict";
     import_node_child_process7 = require("node:child_process");
-    import_node_fs16 = __toESM(require("node:fs"), 1);
+    import_node_fs17 = __toESM(require("node:fs"), 1);
     import_node_os3 = __toESM(require("node:os"), 1);
-    import_node_path18 = __toESM(require("node:path"), 1);
+    import_node_path19 = __toESM(require("node:path"), 1);
     import_settings = require("sootsim-engine/settings");
     import_ws5 = require("ws");
     init_dev_server_scanner();
@@ -27515,14 +27796,14 @@ process.stdin.on('end', async () => {
 function getBaseDir() {
   const explicit = process.env[SESSION_FILE_ENV];
   if (explicit?.trim()) {
-    return (0, import_node_path19.dirname)((0, import_node_path19.resolve)(explicit));
+    return (0, import_node_path20.dirname)((0, import_node_path20.resolve)(explicit));
   }
   return electronUserDataDir();
 }
 function getSharedDesktopAuthFilePath() {
   const explicit = process.env[SESSION_FILE_ENV];
-  if (explicit?.trim()) return (0, import_node_path19.resolve)(explicit);
-  return (0, import_node_path19.join)(getBaseDir(), "desktop-auth.json");
+  if (explicit?.trim()) return (0, import_node_path20.resolve)(explicit);
+  return (0, import_node_path20.join)(getBaseDir(), "desktop-auth.json");
 }
 function normalizeUser(input) {
   if (!input || typeof input !== "object") return null;
@@ -27569,26 +27850,26 @@ function normalizeSession(input) {
 }
 function readSharedDesktopAuthSession() {
   const filepath = getSharedDesktopAuthFilePath();
-  if (!(0, import_node_fs17.existsSync)(filepath)) return null;
+  if (!(0, import_node_fs18.existsSync)(filepath)) return null;
   try {
-    const parsed = JSON.parse((0, import_node_fs17.readFileSync)(filepath, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs18.readFileSync)(filepath, "utf8"));
     const normalized = normalizeSession(parsed);
     if (!normalized) {
-      (0, import_node_fs17.rmSync)(filepath, { force: true });
+      (0, import_node_fs18.rmSync)(filepath, { force: true });
       return null;
     }
     return normalized;
   } catch {
-    (0, import_node_fs17.rmSync)(filepath, { force: true });
+    (0, import_node_fs18.rmSync)(filepath, { force: true });
     return null;
   }
 }
-var import_node_fs17, import_node_path19, SESSION_VERSION, SESSION_FILE_ENV, DEFAULT_ORIGIN;
+var import_node_fs18, import_node_path20, SESSION_VERSION, SESSION_FILE_ENV, DEFAULT_ORIGIN;
 var init_shared_session = __esm({
   "src/auth/shared-session.ts"() {
     "use strict";
-    import_node_fs17 = require("node:fs");
-    import_node_path19 = require("node:path");
+    import_node_fs18 = require("node:fs");
+    import_node_path20 = require("node:path");
     init_home_paths();
     SESSION_VERSION = 1;
     SESSION_FILE_ENV = "SOOTSIM_SHARED_AUTH_FILE";
@@ -29176,7 +29457,7 @@ var init_bridge_flow_runner = __esm({
         await this.resetGuestAppData();
         await this.rearmCaptureAfterRuntimeReload();
       }
-      // maestro clearKeychain: there is no real keychain in sootsim's browser
+      // maestro clearKeychain: there is no real keychain in rnx's browser
       // sandbox. log loudly so the author notices, then continue — matching the
       // "loud warning, not silent skip" policy in the plan.
       clearKeychain() {