runcloud 0.1.107 → 0.1.108

package/dist/commands/run-cloud.js

@@ -99,7 +99,7 @@ export function consumeSimulatorLogSse(raw) {
 function writeSimulatorLogEntry(entry, json) {
     console.log(json ? JSON.stringify(entry) : entry.message);
 }
-function parseLabels(labels) {
+function parseTags(labels) {
     const out = {};
     for (const raw of labels ?? []) {
         const idx = raw.indexOf('=');
@@ -307,7 +307,7 @@ async function createSimulatorSession(platform, opts) {
         model: opts.model,
         region: opts.region,
         displayName: opts.displayName,
-        labels: parseLabels(opts.label),
+        tags: parseTags(opts.label),
         installAssets,
         inactivityTimeout: opts.inactivityTimeout,
         hardTimeout: opts.hardTimeout,

package/dist/version.js

@@ -1 +1 @@
-export const CLI_VERSION = '0.1.107';
+export const CLI_VERSION = '0.1.108';

package/examples/eight-device-mosaic/demo.mjs

@@ -71,9 +71,14 @@ function escapeHtml(value) {
     .replaceAll('>', '>');
 }
 
+function scriptData(value) {
+  return JSON.stringify(value).replaceAll('<', '\\u003c');
+}
+
 function embedUrl(value) {
   const url = new URL(value);
   url.searchParams.set('embed', '1');
+  url.searchParams.set('loadingGuard', '1');
   return url.toString();
 }
 
@@ -130,6 +135,7 @@ export function mosaicViewerHtml(sessions, deadline = Date.now() + DEMO_LEASE_MS
       const deadline = ${deadline};
       const tiles = [...document.querySelectorAll('.tile')];
       const frames = [...document.querySelectorAll('iframe')];
+      const frameOrigins = ${scriptData(sessions.map((session) => new URL(session.url).origin))};
       const ready = new Set();
       const count = document.querySelector('#ready-count');
       const timer = document.querySelector('#timer');
@@ -141,7 +147,12 @@ export function mosaicViewerHtml(sessions, deadline = Date.now() + DEMO_LEASE_MS
       setInterval(tick, 250);
       window.addEventListener('message', (event) => {
         const index = frames.findIndex((frame) => frame.contentWindow === event.source);
-        if (index < 0 || !event.data || typeof event.data !== 'object') return;
+        if (
+          index < 0
+          || event.origin !== frameOrigins[index]
+          || !event.data
+          || typeof event.data !== 'object'
+        ) return;
         if (event.data.type === 'ios-simulator:status' && event.data.streaming === true) {
           ready.add(index);
           tiles[index].dataset.ready = 'true';

package/examples/eight-device-mosaic/verify.mjs

@@ -35,8 +35,11 @@ test('renders eight signed embeds without printing them into the viewer URL', as
   }));
   const html = mosaicViewerHtml(sessions, 601_000);
   assert.equal((html.match(/<iframe /g) || []).length, 8);
-  assert.match(html, /embed=1/);
-  assert.doesNotMatch(html, /loadingGuard=1/);
+  assert.equal((html.match(/embed=1/g) || []).length, 8);
+  assert.equal((html.match(/loadingGuard=1/g) || []).length, 8);
+  assert.match(html, /const frameOrigins = \["https:\/\/sim\.example"/);
+  assert.match(html, /frame\.contentWindow === event\.source/);
+  assert.match(html, /event\.origin !== frameOrigins\[index\]/);
   assert.match(html, /const deadline = 601000/);
 
   const viewer = await startMosaicViewer(sessions, 601_000);

package/examples/live-camera-relay/demo.mjs

@@ -87,6 +87,7 @@ function scriptData(value) {
 function embedUrl(value) {
   const url = new URL(value);
   url.searchParams.set('embed', '1');
+  url.searchParams.set('loadingGuard', '1');
   return url.toString();
 }
 
@@ -193,6 +194,7 @@ export function cameraViewerHtml(sessions, duration, roomId, now = Date.now()) {
       const deadline = ${deadline};
       const devices = [...document.querySelectorAll('.device')];
       const frames = [...document.querySelectorAll('iframe')];
+      const frameOrigins = ${scriptData(sessions.map((session) => new URL(session.url).origin))};
       const ready = new Set();
       const count = document.querySelector('#ready-count');
       const timer = document.querySelector('#timer');
@@ -287,7 +289,12 @@ export function cameraViewerHtml(sessions, duration, roomId, now = Date.now()) {
       setInterval(tick, 250);
       window.addEventListener('message', (event) => {
         const index = frames.findIndex((frame) => frame.contentWindow === event.source);
-        if (index < 0 || !event.data || typeof event.data !== 'object') return;
+        if (
+          index < 0
+          || event.origin !== frameOrigins[index]
+          || !event.data
+          || typeof event.data !== 'object'
+        ) return;
         if (event.data.type === 'ios-simulator:status' && event.data.streaming === true) {
           ready.add(index);
           devices[index].dataset.ready = 'true';

package/examples/live-camera-relay/verify.mjs

@@ -67,8 +67,11 @@ test('renders three signed embeds while keeping credentials out of the local URL
   const demoSessions = sessions();
   const html = cameraViewerHtml(demoSessions, 60, 'room-12345678', 1_000);
   assert.equal((html.match(/<iframe /g) || []).length, 3);
-  assert.match(html, /embed=1/);
-  assert.doesNotMatch(html, /loadingGuard=1/);
+  assert.equal((html.match(/embed=1/g) || []).length, 3);
+  assert.equal((html.match(/loadingGuard=1/g) || []).length, 3);
+  assert.match(html, /const frameOrigins = \["https:\/\/sim\.example"/);
+  assert.match(html, /frame\.contentWindow === event\.source/);
+  assert.match(html, /event\.origin !== frameOrigins\[index\]/);
   assert.match(html, /Connect webcam/);
   assert.match(html, /com\.apple\.mobilesafari/);
   assert.match(html, /audio: false/);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runcloud",
-  "version": "0.1.107",
+  "version": "0.1.108",
   "description": "Create and control run.cloud remote mobile simulators and cloud sandboxes",
   "license": "Apache-2.0",
   "keywords": [

package/skills/run-cloud-ios-simulator/SKILL.md

@@ -134,7 +134,7 @@ import { Client } from "@run-cloud/sdk";
 const cloud = new Client();
 const session = await cloud.ios.create({
   displayName: "Agent smoke",
-  labels: { owner: "agent" },
+  tags: { owner: "agent" },
   inactivityTimeout: "60s",
   hardTimeout: "10m",
   codec: "auto",
@@ -159,7 +159,7 @@ The mobile SDK surface is:
   `delete`
 - `cloud.assets`: `upload`, `list`, `delete`
 
-Create options include `model`, `region`, `displayName`, `labels`,
+Create options include `model`, `region`, `displayName`, `tags`,
 `installAssets`, `inactivityTimeout`, `hardTimeout`, and `codec`.
 
 Do not invent SDK methods for scripted taps, typing, recording, app lifecycle,
@@ -180,10 +180,13 @@ Delete uploaded assets when they are no longer needed.
 
 ## Embed a Session
 
+- In React, use `RemoteControl` from `@runcloud/ui` with the signed session URL.
 - Add `embed=1` to the signed session URL for the clean iframe UI.
 - Add `loadingGuard=1` when the iframe should block interaction until streaming
   and app launch are ready.
-- Verify `event.source` is the expected iframe before processing messages.
+- For raw iframes, verify both `event.source` and the exact signed-URL origin
+  before processing messages, and use that exact origin as the command
+  `postMessage` target.
 - Handle `ios-simulator:status`, `ios-simulator:auth-error`,
   `ios-simulator:session-ended`, and
   `ios-simulator:session-restart-requested`.