rnxsim 0.1.432 → 0.1.434

package/cli/cloud-dispatch.ts

@@ -121,7 +121,7 @@ function refuseCloudInvocation(
 ): CloudBoundaryResult {
   const verb = firstVerb(positional)
   const name = verb ? `${command} ${verb}` : command
-  console.error(`  rnx ${name} is not available for an RNX Cloud simulator`)
+  console.error(`  rnx ${name} is not available for a remote simulator`)
   return { handled: true, code: 1 }
 }
 
@@ -129,18 +129,13 @@ export async function dispatchCloudBoundary({
   command,
   args,
 }: CloudBoundaryInvocation): Promise<CloudBoundaryResult> {
-  if (command === 'ios' && (args.includes('--nano') || args.includes('--cloud')))
-    return { handled: false }
-  if (command === 'android' && (args.includes('--nano') || args.includes('--cloud'))) {
+  if (command === 'ios' && args.includes('--remote')) return { handled: false }
+  if (command === 'android' && args.includes('--remote')) {
     console.error(
-      '  rnx android --nano is not available; RNX Cloud currently supports iOS',
+      '  rnx android --remote is not available; remote simulators are iOS only',
     )
     return { handled: true, code: 1 }
   }
-  if ((command === 'ios' || command === 'android') && args.includes('--micro')) {
-    console.error(`  rnx ${command} --micro is not implemented`)
-    return { handled: true, code: 1 }
-  }
   if (!CLOUD_TARGET_COMMANDS.has(command)) return { handled: false }
 
   const [{ parseBridgeCliArgs }, cloudClient, cloudSession] = await Promise.all([
@@ -189,7 +184,7 @@ export async function dispatchCloudBoundary({
       const descriptor = cloudSession.requireCloudSessionShellUpdate()
       await cloudClient.closeCloudBox(session)
       cloudSession.publishCloudSessionToShell(null, descriptor)
-      console.log(`  closed: box ${session.boxId} and simulator ${session.simId}`)
+      console.log(`  closed: remote simulator ${session.simId}`)
       return { handled: true, code: 0 }
     } catch (error) {
       console.error(

package/cli/cloud-session.ts

@@ -10,7 +10,7 @@ export const RNX_SHELL_UPDATE_PREFIX = '__RNX_SHELL_UPDATE_V1__'
 export const RNX_SHELL_UPDATE_SET_PREFIX = `${RNX_SHELL_UPDATE_PREFIX}set:`
 export const RNX_SHELL_UPDATE_UNSET = `${RNX_SHELL_UPDATE_PREFIX}unset`
 
-// the shell's target: one nano box, addressed by the box token, and the
+// the shell's target: one remote host, addressed by the box token, and the
 // simulator inside it that ordinary commands reach with the simulator token
 export interface CloudSession {
   version: 2
@@ -31,7 +31,7 @@ export function normalizeCloudOrigin(source: string): string {
   try {
     parsed = new URL(source)
   } catch {
-    throw new Error(`invalid RNX Cloud origin: ${source}`)
+    throw new Error(`invalid remote simulator origin: ${source}`)
   }
   if (
     (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') ||
@@ -41,10 +41,10 @@ export function normalizeCloudOrigin(source: string): string {
     parsed.search ||
     parsed.hash
   ) {
-    throw new Error(`RNX Cloud origin must be an HTTP(S) origin: ${source}`)
+    throw new Error(`remote simulator origin must be an HTTP(S) origin: ${source}`)
   }
   if (parsed.protocol === 'http:' && !isLoopbackHost(parsed.hostname)) {
-    throw new Error(`RNX Cloud origin requires HTTPS outside loopback: ${source}`)
+    throw new Error(`remote simulator origin requires HTTPS outside loopback: ${source}`)
   }
   return parsed.origin
 }
@@ -157,7 +157,7 @@ export function requireCloudSessionShellUpdate(): number {
   const descriptor = shellUpdateFd()
   if (descriptor === null) {
     throw new Error(
-      'RNX shell integration is required so this cloud session stays in the current shell; restart the shell after installing RNX',
+      'RNX shell integration is required so this remote simulator stays connected to the current shell; restart the shell after installing RNX',
     )
   }
   return descriptor

package/cli/commands/auth.ts

@@ -1,5 +1,8 @@
-import { refreshSharedDesktopAuthSession } from '../../src/auth/shared-session'
-import { resolveCliAuth } from '../auth'
+import {
+  refreshSharedDesktopAuthSession,
+  sharedDesktopAuthAccounts,
+} from '../../src/auth/shared-session'
+import { CHOOSE_ACCOUNT_HINT, resolveCliAuth } from '../auth'
 import { rnxExit } from '../run-rnx'
 
 function printHelp(): void {
@@ -36,7 +39,15 @@ async function printStatus(): Promise<number> {
 
   const current = await refreshSharedDesktopAuthSession(auth.origin)
   const user = current?.user
+  const accounts = sharedDesktopAuthAccounts(user)
+  const accountId = current?.accountId ?? auth.accountId
+  const account = accounts.find((candidate) => candidate.id === accountId)
   console.log(`  ${user?.email || user?.name || user?.id || 'signed in'}`)
+  console.log(
+    `  account: ${
+      account ? `${account.name} (${account.id})` : (accountId ?? CHOOSE_ACCOUNT_HINT)
+    }`,
+  )
   console.log(`  origin: ${current?.origin ?? auth.origin}`)
   if (current?.updatedAt) console.log(`  updated: ${current.updatedAt}`)
   return 0

package/cli/commands/box.ts

@@ -2,9 +2,11 @@
 //
 // bare `rnx box` is LOCAL and mounts the current checkout at /project. cloud
 // create provisions through the shared client and enters the same shell unless
-// --json asks for a noninteractive result. reconnect still needs an authorized
-// provider lookup from public box identity to the provider reference.
+// --json asks for a noninteractive result. connect asks the account service to
+// turn a Box name into an authorized reference and enters that same shell, so
+// this process never stores a Box token.
 
+import { spawn } from 'node:child_process'
 import path from 'node:path'
 import { createInterface } from 'node:readline'
 import { BoxClientError, createBoxClient } from '@rnx/box/client'
@@ -16,9 +18,16 @@ import {
   sourceControlBoxTemplate,
   terminalBoxTemplate,
 } from '@rnx/box/template'
-import { createCloudBoxProvider, heartbeatSession } from 'rnx-cloud-box/client'
+import {
+  cloudBoxBrowserLiveView,
+  cloudBoxConnectUrl,
+  createCloudBoxProvider,
+  ensureCloudBoxBrowser,
+  heartbeatSession,
+  resolveCloudBoxReference,
+} from 'rnx-cloud-box/client'
 import { rnxPublicBrand } from '../../src/public-brand'
-import { authHeaderOrExit } from '../auth'
+import { authHeaderOrExit, cloudAccountIdOrExit, type CliAuth } from '../auth'
 import { findRepositoryPackageRoot } from '../setup-repository'
 import { resolvePlacement } from '../ws-bridge'
 import { CheckoutFilePlane, CheckoutRequiresGitError } from './box/checkout-plane'
@@ -58,6 +67,13 @@ function usage(): void {
                                    the box service to create it in, or set
                                    ${ENDPOINT_ENV}
     ${rnx} box create --json       create without entering the shell
+    ${rnx} box connect <id>        enter the shell of a cloud box you own
+    ${rnx} box connect <id> --json print its reference without a shell
+    ${rnx} box send                send the running local app to a nano box
+    ${rnx} box send --name=<n>     name the box it creates
+    ${rnx} box send --no-auth      leave the signed-in session behind
+    ${rnx} box open <id>           watch a cloud box in your browser
+    ${rnx} box open <id> --print   print the viewing URL instead of opening it
     ${rnx} box ls                  cloud boxes running on this account
     ${rnx} box stop --name=<n>     stop a cloud box and its billing
     ${rnx} box delete --name=<n>   stop it and wipe its files
@@ -91,13 +107,9 @@ export async function runBox(
 
   const subcommand = args.find((arg) => !arg.startsWith('-'))
   if (subcommand === 'create') return runCloudBoxCreate(args, opts)
-  if (subcommand === 'connect') {
-    console.error(
-      `  ${rnxPublicBrand.commandName} box connect: the cloud provider cannot yet resolve a Box ID or name to an authorized Box reference.\n` +
-        `  the shared Box client requires that reference's access token, and the CLI does not persist Box tokens.`,
-    )
-    return 1
-  }
+  if (subcommand === 'connect') return runCloudBoxConnect(args)
+  if (subcommand === 'send') return runBoxSend(args, opts)
+  if (subcommand === 'open') return runCloudBoxOpen(args)
   if (subcommand === 'stop' || subcommand === 'delete') {
     return runCloudBoxStop(args, subcommand === 'delete')
   }
@@ -130,12 +142,15 @@ function flag(args: string[], name: string): string | undefined {
   return undefined
 }
 
-function apiOrigin(args: string[]): string {
+// the account service, which owns /api/v1/rnx/sessions and the box connect
+// route. a login session names the origin it was issued by; an api key
+// carries none, so it goes where every other key-authenticated command goes.
+function apiOrigin(args: string[], auth: CliAuth): string {
   return (
     flag(args, 'api-origin') ??
     process.env[API_ORIGIN_ENV]?.trim() ??
-    rnxPublicBrand.origin
-  )
+    (auth.kind === 'session' ? auth.origin : 'https://contrast.dev')
+  ).replace(/\/+$/, '')
 }
 
 function requireEndpoint(args: string[], label: string): string | null {
@@ -149,6 +164,46 @@ function requireEndpoint(args: string[], label: string): string | null {
   return null
 }
 
+// `rnx box send` — the CLI half of "send to box". the shell's rail button runs
+// the same function inside the daemon; this is the same send for an agent or a
+// terminal, and it prints the id and URL either way.
+async function runBoxSend(args: string[], opts: BoxCommandOptions): Promise<number> {
+  const rnx = rnxPublicBrand.commandName
+  const { auth, header } = authHeaderOrExit('box send')
+  const accountId = cloudAccountIdOrExit(auth)
+  const { createBridgeFromParsed, parseBridgeCliArgs } = await import('../ws-bridge')
+  const parsed = parseBridgeCliArgs(
+    args.filter((arg) => arg !== 'send'),
+    {
+      port: opts.port,
+      stripBooleanFlags: ['--no-auth', '--json'],
+      stripValueFlags: ['--name', '--assets', '--api-origin'],
+    },
+  )
+  const bridge = createBridgeFromParsed(parsed)
+  try {
+    const { sendToBox } = await import('../send-to-box')
+    const result = await sendToBox({
+      send: (command) => bridge.send(command),
+      authorization: header,
+      accountId,
+      carryAuth: !args.includes('--no-auth'),
+      boxName: flag(args, 'name') ?? null,
+      assetsPath: flag(args, 'assets') ?? null,
+      apiOrigin: flag(args, 'api-origin'),
+    })
+    if (args.includes('--json')) console.log(JSON.stringify(result))
+    return 0
+  } catch (error) {
+    console.error(
+      `  ${rnx} box send: ${error instanceof Error ? error.message : String(error)}`,
+    )
+    return 1
+  } finally {
+    bridge.close()
+  }
+}
+
 async function runCloudBoxStop(args: string[], purge: boolean): Promise<number> {
   const rnx = rnxPublicBrand.commandName
   const label = purge ? 'delete' : 'stop'
@@ -160,12 +215,13 @@ async function runCloudBoxStop(args: string[], purge: boolean): Promise<number>
     console.error(`  ${rnx} box ${label}: which box? pass --name=<n>.`)
     return 1
   }
-  const { header } = authHeaderOrExit(`box ${label}`)
+  const { auth, header } = authHeaderOrExit(`box ${label}`)
   const apiKey = header.replace(/^Bearer /, '')
+  const accountId = cloudAccountIdOrExit(auth)
   const client = createBoxClient(
     createCloudBoxProvider({
       endpoint,
-      authority: { kind: 'account', apiOrigin: apiOrigin(args), apiKey },
+      authority: { kind: 'account', apiOrigin: apiOrigin(args, auth), apiKey, accountId },
     }),
   )
   try {
@@ -189,12 +245,13 @@ async function runCloudBoxStop(args: string[], purge: boolean): Promise<number>
 
 async function runCloudBoxList(args: string[]): Promise<number> {
   const rnx = rnxPublicBrand.commandName
-  const { header } = authHeaderOrExit('box ls')
+  const { auth, header } = authHeaderOrExit('box ls')
   const apiKey = header.replace(/^Bearer /, '')
+  const accountId = cloudAccountIdOrExit(auth)
   const client = createBoxClient(
     createCloudBoxProvider({
       endpoint: flag(args, 'endpoint') ?? process.env[ENDPOINT_ENV]?.trim() ?? '',
-      authority: { kind: 'account', apiOrigin: apiOrigin(args), apiKey },
+      authority: { kind: 'account', apiOrigin: apiOrigin(args, auth), apiKey, accountId },
     }),
   )
   try {
@@ -219,6 +276,161 @@ async function runCloudBoxList(args: string[]): Promise<number> {
   }
 }
 
+async function runCloudBoxConnect(args: string[]): Promise<number> {
+  const rnx = rnxPublicBrand.commandName
+  const json = args.includes('--json')
+  // the first positional is `connect`; the second is the Box.
+  const boxId = args.filter((arg) => !arg.startsWith('-'))[1]
+  if (!boxId) {
+    console.error(
+      `  ${rnx} box connect: which box? pass its ID or name, as \`${rnx} box ls\` prints it.`,
+    )
+    return 1
+  }
+
+  // the ACCOUNT's credential. the account service is the only thing that knows
+  // which account a Box belongs to, so it resolves the name and hands back the
+  // Box's own token; nothing here writes that token down.
+  const { auth, header } = authHeaderOrExit('box connect')
+  const apiKey = header.replace(/^Bearer /, '')
+  const origin = apiOrigin(args, auth)
+
+  let session: BoxShellSession | null = null
+  let heartbeat: { stop: () => void } | null = null
+  try {
+    const reference = await resolveCloudBoxReference({ apiOrigin: origin, apiKey, boxId })
+    const box = await createBoxClient(
+      createCloudBoxProvider({
+        endpoint: reference.endpoint,
+        authority: { kind: 'attach' },
+      }),
+    ).attach({
+      // no stack here on purpose: the Box reports the one it was created
+      // with, and holding somebody else's Box to a stack this process guessed
+      // would offer primitives it does not actually have.
+      reference: { boxId: reference.boxId, accessToken: reference.token },
+    })
+    if (json) {
+      // the reference without its token. a caller scripting against this gets
+      // the Box's identity; the credential stays out of stdout and out of
+      // whatever collects it.
+      console.log(JSON.stringify({ endpoint: reference.endpoint, ...box.description }))
+      return 0
+    }
+    console.log(`  ...connected to Box ${box.id}`)
+    if (box.description.pageUrl) {
+      console.log(`  ...open ${box.description.pageUrl}`)
+    }
+    console.log(`  ...accessing shell\n`)
+    session = await box.connect()
+    // the same reason `create` heartbeats: the box holds no account credential,
+    // so the client using it is what keeps its session alive.
+    const sessionId = box.description.sessionId
+    if (!sessionId) throw new BoxClientError('the box service returned no session id')
+    heartbeat = heartbeatSession({ apiOrigin: origin, apiKey, sessionId })
+    return await repl(session, '')
+  } catch (error) {
+    if (error instanceof BoxClientError) {
+      console.error(`  ${rnx} box connect: ${error.message}`)
+      return 1
+    }
+    throw error
+  } finally {
+    heartbeat?.stop()
+    session?.close()
+  }
+}
+
+/**
+ * watch a cloud box in a browser.
+ *
+ * the box is already running its page in a headless Browser Run tab; this
+ * attaches a viewer to that same tab rather than starting a second one. the
+ * URL it mints is a short-lived bearer capability, so it is handed straight to
+ * the browser and this output is the only place it ever exists.
+ */
+async function runCloudBoxOpen(args: string[]): Promise<number> {
+  const rnx = rnxPublicBrand.commandName
+  const json = args.includes('--json')
+  const print = args.includes('--print')
+  // the first positional is `open`; the second is the Box.
+  const boxId = args.filter((arg) => !arg.startsWith('-'))[1] ?? flag(args, 'name')
+  if (!boxId) {
+    console.error(
+      `  ${rnx} box open: which box? pass its ID or name, as \`${rnx} box ls\` prints it.`,
+    )
+    return 1
+  }
+
+  // the ACCOUNT's credential, for the same reason connect takes one: the
+  // account service is what knows which account owns this Box, and it hands
+  // back the Box's own token rather than this process storing one.
+  const { auth, header } = authHeaderOrExit('box open')
+  const apiKey = header.replace(/^Bearer /, '')
+
+  try {
+    const reference = await resolveCloudBoxReference({
+      apiOrigin: apiOrigin(args, auth),
+      apiKey,
+      boxId,
+    })
+    const connectUrl = cloudBoxConnectUrl(reference.endpoint, reference.boxId)
+    // ensure first: it is what navigates the generation's tab to the Box page,
+    // so a box whose browser lapsed gets a new generation with its page
+    // restored before anybody is looking at it.
+    const browser = await ensureCloudBoxBrowser({
+      connectUrl,
+      accessToken: reference.token,
+    })
+    if (!browser.reused && !json && !print) {
+      console.log(`  ...started this box's browser`)
+    }
+    const view = await cloudBoxBrowserLiveView({
+      connectUrl,
+      accessToken: reference.token,
+      mode: 'tab',
+    })
+    if (json) {
+      console.log(
+        JSON.stringify({
+          url: view.url,
+          expiresAt: new Date(Date.now() + view.expiresInMs).toISOString(),
+        }),
+      )
+      return 0
+    }
+    if (print) {
+      console.log(view.url)
+      return 0
+    }
+    return await openInBrowser(view.url)
+  } catch (error) {
+    if (error instanceof BoxClientError) {
+      console.error(`  ${rnx} box open: ${error.message}`)
+      return 1
+    }
+    throw error
+  }
+}
+
+/**
+ * hand a URL to the operating system's browser.
+ *
+ * argv rather than a shell string, because this URL is a bearer capability and
+ * a shell would take it through history, expansion and quoting on the way. when
+ * `open` cannot run it is printed instead: this process is the only place the
+ * URL exists, so dropping it would cost the caller another mint.
+ */
+async function openInBrowser(url: string): Promise<number> {
+  const child = spawn('open', [url], { stdio: 'ignore' })
+  const opened = await new Promise<boolean>((resolve) => {
+    child.once('error', () => resolve(false))
+    child.once('close', (code) => resolve(code === 0))
+  })
+  if (!opened) console.log(url)
+  return 0
+}
+
 async function runCloudBoxCreate(
   args: string[],
   opts: BoxCommandOptions,
@@ -270,14 +482,15 @@ async function runCloudBoxCreate(
   // the ACCOUNT's key. the box service forwards it to /v1/rnx/sessions, which
   // is what authenticates this caller, names the account, and starts the
   // session the box is billed against.
-  const { header } = authHeaderOrExit('box create')
+  const { auth, header } = authHeaderOrExit('box create')
   const apiKey = header.replace(/^Bearer /, '')
+  const accountId = cloudAccountIdOrExit(auth)
 
   if (!json) console.log(`  ...creating cloud box ${name}`)
   const client = createBoxClient(
     createCloudBoxProvider({
       endpoint,
-      authority: { kind: 'account', apiOrigin: apiOrigin(args), apiKey },
+      authority: { kind: 'account', apiOrigin: apiOrigin(args, auth), apiKey, accountId },
     }),
   )
   let session: BoxShellSession | null = null
@@ -303,13 +516,16 @@ async function runCloudBoxCreate(
       return 0
     }
     console.log(`  ...created Box ${box.id}`)
-    if (box.description.stableUrl) {
-      console.log(`  ...live ${box.description.stableUrl}`)
-    }
     console.log(`  ...seeded ${box.description.files} project files`)
     // shown once and never stored: this process does not own a credential
     // store, and inventing one here would be a second place secrets live.
     console.log(`  ...box token (shown once): ${box.accessToken}`)
+    // last, so it is the line still on screen when the shell takes over. it
+    // carries no credential: opening it signed in resolves the box through the
+    // account service.
+    if (box.description.pageUrl) {
+      console.log(`  ...open ${box.description.pageUrl}`)
+    }
     console.log(`  ...accessing shell\n`)
     session = await box.connect()
     // bank the wall clock while the shell is open. the box holds no account
@@ -318,7 +534,7 @@ async function runCloudBoxCreate(
     const sessionId = box.description.sessionId
     if (!sessionId) throw new BoxClientError('the box service returned no session id')
     heartbeat = heartbeatSession({
-      apiOrigin: apiOrigin(args),
+      apiOrigin: apiOrigin(args, auth),
       apiKey,
       sessionId,
     })
@@ -473,15 +689,30 @@ async function repl(
   let inputEnded = false
   // the user typed `exit`: abandon anything still queued behind it.
   let stopped = false
+  // the command running right now, so Ctrl-C interrupts it rather than the CLI.
+  let interrupt: AbortController | null = null
 
   const run = async (command: string) => {
     if (stopped) return
+    const controller = new AbortController()
+    interrupt = controller
     try {
       await beforeCommand?.()
-      const result = await session.exec(command)
-      if (result.text && result.text !== '(no output)') console.log(result.text)
+      const result = await session.exec(command, {
+        signal: controller.signal,
+        // written as it arrives rather than collected: a terminal shows a
+        // command's output while it runs, and stderr keeps its own stream so
+        // piping the shell's stdout somewhere still separates the two.
+        onOutput: (stream, chunk) => {
+          if (stream === 'stdout') process.stdout.write(chunk)
+          else process.stderr.write(chunk)
+        },
+      })
+      if (result.exitCode !== 0) console.log(`exit code: ${result.exitCode}`)
     } catch (error) {
       console.error(error instanceof Error ? error.message : String(error))
+    } finally {
+      interrupt = null
     }
     if (!inputEnded && !stopped) prompt()
   }
@@ -489,6 +720,19 @@ async function repl(
   return new Promise<number>((resolve) => {
     prompt()
 
+    // Ctrl-C while a command is running interrupts the command. at an idle
+    // prompt there is nothing to interrupt, so it still leaves the shell,
+    // which is the only way out of a box that has stopped answering.
+    rl.on('SIGINT', () => {
+      if (interrupt) {
+        process.stdout.write('^C\n')
+        interrupt.abort()
+        return
+      }
+      stopped = true
+      rl.close()
+    })
+
     rl.on('line', (line) => {
       const command = line.trim()
       if (!command) {

package/cli/commands/control.ts

@@ -62,11 +62,11 @@ import { rethrowIfExit, rnxExit } from '../run-rnx'
 import { rnxSelfInvocation } from '../self-invocation'
 import {
   BridgeSimLockedError,
-  bridgePortForShellBaseUrl,
   createBridge,
   createBridgeFromParsed,
   parseBridgeCliArgs,
   printBridgeWorldNotice,
+  resolveBridgePortForPin,
   resolveBridgeWorld,
   worldForBridgePort,
   type BridgeSimInfo,
@@ -747,6 +747,16 @@ export interface BuildShellUrlOptions {
   device?: string
   resolvedBundle?: ResolvedDevBundle
   project?: ResolvedAppProject | null
+  // deterministic-capture mode, stamped onto the engine URL as ?proof=1. the
+  // shell worker, compositor worker and tenant worker each read it off the
+  // host page URL at boot (syncProofModeFromInitUrl) and pin everything that
+  // would otherwise differ frame to frame: the TextInput caret stops blinking
+  // and stays visible, and notifications stop auto-dismissing. capture-frame
+  // also reads the raw param and stops clipping the device corners, so a
+  // capture matches simctl's rectangular framebuffer. without it a
+  // screen holding a focused text field never reaches three identical idle
+  // frames, so the screenshot guard burns all 12 attempts and then fails.
+  proof?: boolean
 }
 
 function bundleUrlOf(urlStr: string): string | undefined {
@@ -771,9 +781,10 @@ export async function buildShellUrl(
   const project =
     opts.project ?? (await resolveAppProjectForBundleUrl(bundleUrlOf(resolved)))
   const stamped = await stampAppSplash(await stampAppFonts(resolved, project), project)
-  if (!opts.device) return stamped
+  if (!opts.device && !opts.proof) return stamped
   const url = new URL(stamped)
-  url.searchParams.set('device', opts.device)
+  if (opts.device) url.searchParams.set('device', opts.device)
+  if (opts.proof) url.searchParams.set('proof', '1')
   return url.toString()
 }
 
@@ -1417,6 +1428,7 @@ export async function runOpenCommand(
       '--no-hmr',
       '--no-describe',
       '--quiet',
+      '--proof',
     ],
     stripValueFlags: [
       '--base-url',
@@ -1516,14 +1528,25 @@ export async function runOpenCommand(
     await ensureConfiguredRuntime(configuredRuntimeVersion)
   }
 
-  // keep the bridge port and the shell base URL in one world: an explicit
-  // --base-url without --port retargets polling at THAT world's bridge
-  // (otherwise open builds the page against one runtime while polling the
-  // other bridge for registration and times out after ~125s).
+  // keep the bridge port and the shell base URL in one world: --base-url
+  // retargets polling at THAT world's bridge (otherwise open builds the page
+  // against one runtime while polling the other bridge for registration and
+  // times out after ~125s), and a pin nothing serves is refused rather than
+  // falling back to the discovered default, which used to send
+  // ensureBridgeForOpen below off to start a second shell.
   const explicitBaseUrl = args.find((_, i) => args[i - 1] === '--base-url')
-  if (explicitBaseUrl && !parsed.explicitPort) {
-    const matched = bridgePortForShellBaseUrl(explicitBaseUrl)
-    if (matched) parsed.wsPort = matched
+  if (explicitBaseUrl) {
+    const pinned = resolveBridgePortForPin({
+      baseUrl: explicitBaseUrl,
+      wsPort: parsed.wsPort,
+      explicitPort: parsed.explicitPort,
+    })
+    if (pinned.error !== undefined) {
+      console.error(`  error: ${pinned.error}`)
+      rnxExit(1)
+    } else {
+      parsed.wsPort = pinned.port
+    }
   }
 
   parsed.wsPort = await ensureBridgeForOpen(parsed.wsPort, parsed.explicitPort)
@@ -1597,6 +1620,7 @@ export async function runOpenCommand(
     device: deviceArg,
     resolvedBundle,
     project,
+    proof: args.includes('--proof'),
   }
 
   // resolve the shell base URL from the bridge port we settled on, so the page
@@ -1762,9 +1786,12 @@ export async function runOpenCommand(
   const result = await driver.launch({
     url: openUrl,
     // the shell serves the sim page but its WS bridge may have drifted off
-    // the shell-port-implied default. inject the resolved bridge port so the
-    // page does not reconnect to a stale world.
-    bridgePort: bridgePortForShellBaseUrl(baseUrl) ?? parsed.wsPort,
+    // the shell-port-implied default. inject the bridge this command settled
+    // on so the page does not reconnect to a stale world. re-deriving it from
+    // the shell URL could name a third port, since a bridge with no lockfile
+    // resolves back to the default shell URL and that shell may belong to a
+    // live world of its own.
+    bridgePort: parsed.wsPort,
     headless: driverHeadless,
     profileId,
     ephemeralProfile,

package/cli/commands/device.ts

@@ -36,7 +36,7 @@ usage:
 
 examples:
   rnx device
-  rnx device set iphone-14
+  rnx device set iphone-16
   rnx device set iphone-16-pro-max --sim a7
 `)
 }