sootsim 0.0.3 → 0.1.36

package/dist-lib/host/bridge-host.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.0.3 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.36 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;
@@ -35,10 +35,10 @@ __export(bridge_host_exports, {
   SootSimBridgeHost: () => SootSimBridgeHost
 });
 module.exports = __toCommonJS(bridge_host_exports);
-var import_child_process2 = require("child_process");
-var import_fs2 = __toESM(require("fs"), 1);
+var import_child_process4 = require("child_process");
+var import_fs4 = __toESM(require("fs"), 1);
 var import_http2 = require("http");
-var import_path2 = __toESM(require("path"), 1);
+var import_path4 = __toESM(require("path"), 1);
 var import_ws = require("ws");
 
 // src/bridge-constants.ts
@@ -51,6 +51,7 @@ var import_path = __toESM(require("path"), 1);
 var SOOTSIM_HOME_ENV = "SOOTSIM_HOME";
 var ACTIVE_RUNTIME_FILE = "active";
 var DAEMON_LOCKFILE = "daemon.json";
+var CONFIG_FILE = "config.json";
 var DAEMON_HEARTBEAT_STALE_MS = 3e4;
 function sootsimHomeDir() {
   const override = process.env[SOOTSIM_HOME_ENV];
@@ -72,6 +73,9 @@ function cacheDir() {
 function daemonLockfilePath() {
   return import_path.default.join(sootsimHomeDir(), DAEMON_LOCKFILE);
 }
+function configFilePath() {
+  return import_path.default.join(sootsimHomeDir(), CONFIG_FILE);
+}
 function ensureSootsimHome() {
   import_fs.default.mkdirSync(sootsimHomeDir(), { recursive: true });
   import_fs.default.mkdirSync(runtimesDir(), { recursive: true });
@@ -181,12 +185,223 @@ function removeDaemonLockfile() {
   }
 }
 
+// src/runtime-delivery.ts
+var import_child_process = require("child_process");
+var import_crypto = __toESM(require("crypto"), 1);
+var import_fs2 = __toESM(require("fs"), 1);
+var import_path2 = __toESM(require("path"), 1);
+var import_stream = require("stream");
+var import_promises = require("stream/promises");
+var DEFAULT_RUNTIME_CDN_ORIGIN = "https://sootbean.com";
+var RUNTIME_CDN_ORIGIN_ENV = "SOOTSIM_CDN_ORIGIN";
+var RUNTIME_CHANNEL_ENV = "SOOTSIM_RUNTIME_CHANNEL";
+function readConfig() {
+  try {
+    const parsed = JSON.parse(import_fs2.default.readFileSync(configFilePath(), "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function resolveRuntimeCdnOrigin(input) {
+  const config = readConfig();
+  const value = input || process.env[RUNTIME_CDN_ORIGIN_ENV] || config.cdnOrigin || DEFAULT_RUNTIME_CDN_ORIGIN;
+  return value.replace(/\/+$/, "");
+}
+function resolveRuntimeChannel(input) {
+  const config = readConfig();
+  return input || process.env[RUNTIME_CHANNEL_ENV] || config.runtimeChannel || "stable";
+}
+function runtimeManifestUrl(cdnOrigin) {
+  const url = new URL(`${resolveRuntimeCdnOrigin(cdnOrigin)}/runtimes/manifest.json`);
+  url.searchParams.set("t", String(Date.now()));
+  return url.toString();
+}
+function runtimeTarballUrl(version, cdnOrigin) {
+  return `${resolveRuntimeCdnOrigin(cdnOrigin)}/runtimes/sootsim-runtime-${version}.tar.gz`;
+}
+async function fetchRuntimeManifest(cdnOrigin) {
+  const url = runtimeManifestUrl(cdnOrigin);
+  const res = await fetch(url, { headers: { Accept: "application/json" } });
+  if (!res.ok) {
+    throw new Error(`manifest fetch failed: ${res.status} ${res.statusText} (${url})`);
+  }
+  return await res.json();
+}
+function resolveRuntimeVersion(manifest, opts = {}) {
+  const channel = resolveRuntimeChannel(opts.channel);
+  const version = opts.version || manifest.channels[channel]?.latest;
+  if (!version) {
+    throw new Error(
+      `no version specified and channel '${channel}' has no latest entry in the manifest`
+    );
+  }
+  const entry = manifest.versions[version];
+  if (!entry) {
+    throw new Error(
+      `version ${version} not found in manifest; available: ${Object.keys(manifest.versions).slice(-10).join(", ") || "(none)"}`
+    );
+  }
+  return { version, channel, entry };
+}
+async function installRuntime(opts = {}) {
+  ensureSootsimHome();
+  const cdnOrigin = resolveRuntimeCdnOrigin(opts.cdnOrigin);
+  const manifest = await fetchRuntimeManifest(cdnOrigin);
+  const { version, channel, entry } = resolveRuntimeVersion(manifest, opts);
+  const destDir = runtimeDir(version);
+  const setActive = opts.setActive !== false;
+  if (!opts.force && import_fs2.default.existsSync(import_path2.default.join(destDir, "index.html"))) {
+    if (setActive) writeActiveRuntime(version);
+    return {
+      version,
+      channel,
+      cdnOrigin,
+      runtimeDir: destDir,
+      installed: false,
+      activated: setActive,
+      manifest
+    };
+  }
+  const tarUrl = entry.tarball || runtimeTarballUrl(version, cdnOrigin);
+  const tarCachePath = import_path2.default.join(cacheDir(), `sootsim-runtime-${version}.tar.gz`);
+  process.stderr.write(`sootsim: downloading runtime ${version}\u2026
+`);
+  await downloadToFile(tarUrl, tarCachePath);
+  process.stderr.write(`sootsim: extracting runtime ${version}\u2026
+`);
+  const actualSha = await sha256File(tarCachePath);
+  if (actualSha !== entry.sha256) {
+    import_fs2.default.rmSync(tarCachePath, { force: true });
+    throw new Error(
+      `sha256 mismatch for runtime ${version}: expected ${entry.sha256}, actual ${actualSha}`
+    );
+  }
+  const tmpDir = import_path2.default.join(import_path2.default.dirname(destDir), `.installing-${version}-${process.pid}`);
+  import_fs2.default.rmSync(tmpDir, { recursive: true, force: true });
+  import_fs2.default.mkdirSync(tmpDir, { recursive: true });
+  try {
+    await extractTarball(tarCachePath, tmpDir);
+    if (!import_fs2.default.existsSync(import_path2.default.join(tmpDir, "index.html"))) {
+      throw new Error(`extracted tarball for runtime ${version} is missing index.html`);
+    }
+    import_fs2.default.rmSync(destDir, { recursive: true, force: true });
+    import_fs2.default.renameSync(tmpDir, destDir);
+  } catch (err) {
+    import_fs2.default.rmSync(tmpDir, { recursive: true, force: true });
+    throw err;
+  }
+  if (setActive) writeActiveRuntime(version);
+  return {
+    version,
+    channel,
+    cdnOrigin,
+    runtimeDir: destDir,
+    installed: true,
+    activated: setActive,
+    manifest
+  };
+}
+async function updateRuntimeToLatest(opts = {}) {
+  ensureSootsimHome();
+  const cdnOrigin = resolveRuntimeCdnOrigin(opts.cdnOrigin);
+  const channel = resolveRuntimeChannel(opts.channel);
+  const manifest = await fetchRuntimeManifest(cdnOrigin);
+  const latestVersion = manifest.channels[channel]?.latest;
+  if (!latestVersion) {
+    return {
+      checked: true,
+      updated: false,
+      reason: `channel '${channel}' has no latest runtime`,
+      activeVersion: readActiveRuntime()
+    };
+  }
+  const entry = manifest.versions[latestVersion];
+  if (!entry) {
+    return {
+      checked: true,
+      updated: false,
+      reason: `manifest is missing version ${latestVersion}`,
+      activeVersion: readActiveRuntime(),
+      latestVersion
+    };
+  }
+  const activeVersion = readActiveRuntime();
+  const activeDir = activeVersion ? runtimeDir(activeVersion) : null;
+  const activeInstalled = activeDir ? import_fs2.default.existsSync(import_path2.default.join(activeDir, "index.html")) : false;
+  const shouldInstall = !activeVersion || !activeInstalled || compareSemver(latestVersion, activeVersion) > 0;
+  if (!shouldInstall) {
+    return {
+      checked: true,
+      updated: false,
+      reason: "active runtime is current",
+      activeVersion,
+      latestVersion
+    };
+  }
+  const install = await installRuntime({
+    version: latestVersion,
+    channel,
+    cdnOrigin,
+    setActive: false
+  });
+  return {
+    checked: true,
+    updated: true,
+    activeVersion: latestVersion,
+    latestVersion,
+    install
+  };
+}
+async function downloadToFile(url, destPath) {
+  const res = await fetch(url);
+  if (!res.ok || !res.body) {
+    throw new Error(`download failed: ${res.status} ${res.statusText} (${url})`);
+  }
+  import_fs2.default.mkdirSync(import_path2.default.dirname(destPath), { recursive: true });
+  const tmp = `${destPath}.partial`;
+  try {
+    await (0, import_promises.pipeline)(
+      import_stream.Readable.fromWeb(res.body),
+      import_fs2.default.createWriteStream(tmp)
+    );
+    import_fs2.default.renameSync(tmp, destPath);
+  } catch (err) {
+    try {
+      import_fs2.default.unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+function sha256File(filePath) {
+  return new Promise((resolve2, reject) => {
+    const hash = import_crypto.default.createHash("sha256");
+    const stream = import_fs2.default.createReadStream(filePath);
+    stream.on("data", (chunk) => hash.update(chunk));
+    stream.on("error", reject);
+    stream.on("end", () => resolve2(hash.digest("hex")));
+  });
+}
+function extractTarball(tarPath, destDir) {
+  return new Promise((resolve2, reject) => {
+    const child = (0, import_child_process.spawn)("tar", ["-xzf", tarPath, "-C", destDir], {
+      stdio: ["ignore", "inherit", "inherit"]
+    });
+    child.on("error", reject);
+    child.on("exit", (code) => {
+      if (code === 0) resolve2();
+      else reject(new Error(`tar exited with code ${code}`));
+    });
+  });
+}
+
 // src/host/agent-host.ts
 var import_node_fs4 = __toESM(require("node:fs"), 1);
 var import_node_path4 = __toESM(require("node:path"), 1);
 
 // scripts/dev-server-scanner.ts
-var import_child_process = require("child_process");
+var import_child_process2 = require("child_process");
 var import_http = __toESM(require("http"), 1);
 var import_net = __toESM(require("net"), 1);
 var import_util = require("util");
@@ -221,11 +436,13 @@ function normalizeNativeDevBundleUrl(bundleUrl) {
   try {
     const isAbsolute = isAbsoluteHttpUrl(bundleUrl);
     const parsed = new URL(bundleUrl, "http://soot.local");
+    parsed.pathname = parsed.pathname.replace(/\.\.bundle$/, ".bundle");
     if (!isNativeDevBundlePath(parsed.pathname)) return bundleUrl;
     if (!parsed.searchParams.has("dev")) parsed.searchParams.set("dev", "true");
     if (!parsed.searchParams.has("minify")) {
       parsed.searchParams.set("minify", "false");
     }
+    parsed.searchParams.delete("transform.bytecode");
     if (isAbsolute) return parsed.toString();
     return `${parsed.pathname}${parsed.search}${parsed.hash}`;
   } catch {
@@ -610,7 +827,7 @@ var APPS = [
 ];
 
 // scripts/dev-server-scanner.ts
-var execP = (0, import_util.promisify)(import_child_process.exec);
+var execP = (0, import_util.promisify)(import_child_process2.exec);
 var TIMEOUT_MS = 250;
 var TCP_GATE_MS = 120;
 function tcpPing(port, timeout = TCP_GATE_MS) {
@@ -630,10 +847,10 @@ function tcpPing(port, timeout = TCP_GATE_MS) {
     sock.connect(port, "localhost");
   });
 }
-function httpGet(port, path6, method = "GET", timeout = TIMEOUT_MS, headers = {}) {
+function httpGet(port, path7, method = "GET", timeout = TIMEOUT_MS, headers = {}) {
   return new Promise((resolve2) => {
     const req = import_http.default.request(
-      { hostname: "localhost", port, path: path6, method, timeout, headers },
+      { hostname: "localhost", port, path: path7, method, timeout, headers },
       (res) => {
         let body = "";
         res.on("data", (c) => body += c.toString());
@@ -766,9 +983,9 @@ function applyManifest(result, manifestRes, buildIconProxyUrl) {
     if (client.name) result.projectName = client.name;
     if (client.ios?.bundleIdentifier) result.bundleId = client.ios.bundleIdentifier;
     if (result.framework === "metro" && client.sdkVersion) result.framework = "expo";
-    const launchUrl = manifest?.launchAsset?.url;
-    if (launchUrl && !result.patched && !isDirectOneBundleUrl(result.bundleUrl)) {
-      result.bundleUrl = withRuntimeConfig(result.port, launchUrl);
+    const launchUrl2 = manifest?.launchAsset?.url;
+    if (launchUrl2 && !result.patched && !isDirectOneBundleUrl(result.bundleUrl)) {
+      result.bundleUrl = withRuntimeConfig(result.port, launchUrl2);
     }
     const rawIconUrl = client.iconUrl || client.ios?.iconUrl || client.icon || client.ios?.icon;
     if (rawIconUrl) {
@@ -837,13 +1054,13 @@ async function probePort(port, buildIconProxyUrl) {
       const manifest = JSON.parse(manifestRes.body);
       const client = manifest?.extra?.expoClient || {};
       if (client.name) {
-        const launchUrl = manifest?.launchAsset?.url || `http://localhost:${port}/index.bundle?platform=ios&dev=true&hot=true&minify=false`;
+        const launchUrl2 = manifest?.launchAsset?.url || `http://localhost:${port}/index.bundle?platform=ios&dev=true&hot=true&minify=false`;
         knownNonPatched.add(port);
         return applyManifest(
           {
             port,
             framework: "one",
-            bundleUrl: withRuntimeConfig(port, launchUrl),
+            bundleUrl: withRuntimeConfig(port, launchUrl2),
             hmrUrl: `ws://localhost:${port}/hot`,
             lastSeen: Date.now()
           },
@@ -1556,6 +1773,7 @@ async function startSession(opts) {
     ];
     if (opts.codexBin) wrapperArgs.push("--codex-bin", opts.codexBin);
     if (opts.claudeBin) wrapperArgs.push("--claude-bin", opts.claudeBin);
+    if (opts.freshThread) wrapperArgs.push("--fresh-thread");
     if (claudeSessionUuid) {
       wrapperArgs.push("--claude-session-uuid", claudeSessionUuid);
     }
@@ -2157,6 +2375,155 @@ function mapFrameworkToProjectFramework(fw) {
   return "unknown";
 }
 
+// src/host/open-url.ts
+var import_child_process3 = require("child_process");
+var import_fs3 = require("fs");
+var import_os2 = require("os");
+var import_path3 = require("path");
+var MAC_CHROMIUM_CANDIDATES = [
+  "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+  "~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+  "/Applications/Chromium.app/Contents/MacOS/Chromium",
+  "~/Applications/Chromium.app/Contents/MacOS/Chromium",
+  "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge",
+  "~/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge",
+  "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser",
+  "~/Applications/Brave Browser.app/Contents/MacOS/Brave Browser",
+  "/Applications/Arc.app/Contents/MacOS/Arc",
+  "~/Applications/Arc.app/Contents/MacOS/Arc"
+];
+var LINUX_CHROMIUM_CANDIDATES = [
+  "/usr/bin/google-chrome",
+  "/usr/bin/chromium",
+  "/usr/bin/chromium-browser",
+  "/usr/bin/microsoft-edge",
+  "/usr/bin/brave-browser",
+  "/snap/bin/chromium"
+];
+var WINDOWS_CHROMIUM_CANDIDATES = [
+  "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
+  "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
+  "C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe",
+  "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
+  "C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\brave.exe",
+  "C:\\Program Files (x86)\\BraveSoftware\\Brave-Browser\\Application\\brave.exe"
+];
+var UNIX_CHROMIUM_COMMANDS = [
+  "google-chrome",
+  "chromium",
+  "chromium-browser",
+  "microsoft-edge",
+  "brave-browser"
+];
+var WINDOWS_CHROMIUM_COMMANDS = ["chrome", "msedge", "brave"];
+function expandHome(candidate) {
+  return candidate.startsWith("~/") ? (0, import_path3.join)((0, import_os2.homedir)(), candidate.slice(2)) : candidate;
+}
+function firstExisting(candidates) {
+  for (const candidate of candidates) {
+    const expanded = expandHome(candidate);
+    if ((0, import_fs3.existsSync)(expanded)) return expanded;
+  }
+  return null;
+}
+function lookupExecutable(command, platform) {
+  try {
+    const tool = platform === "win32" ? "where" : "which";
+    const out = (0, import_child_process3.execFileSync)(tool, [command], {
+      encoding: "utf8",
+      timeout: 1500,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    return out ? out.split(/\r?\n/)[0] : null;
+  } catch {
+    return null;
+  }
+}
+function resolveChromiumBinary(platform = process.platform) {
+  const envCandidate = process.env.CHROME_PATH || process.env.CHROMIUM_PATH;
+  if (envCandidate && (0, import_fs3.existsSync)(envCandidate)) return envCandidate;
+  const direct = platform === "darwin" ? firstExisting(MAC_CHROMIUM_CANDIDATES) : platform === "win32" ? firstExisting(WINDOWS_CHROMIUM_CANDIDATES) : firstExisting(LINUX_CHROMIUM_CANDIDATES);
+  if (direct) return direct;
+  const commands = platform === "win32" ? WINDOWS_CHROMIUM_COMMANDS : UNIX_CHROMIUM_COMMANDS;
+  for (const command of commands) {
+    const found = lookupExecutable(command, platform);
+    if (found) return found;
+  }
+  return null;
+}
+function buildOpenUrlCommand(url, options = {}) {
+  if (!url) throw new Error("openUrl requires a url");
+  const platform = options.platform ?? process.platform;
+  if (options.newWindow) {
+    return buildChromiumUrlCommand(url, { ...options, platform, newWindow: true });
+  }
+  if (platform === "darwin") {
+    return {
+      command: "open",
+      args: options.background === false ? [url] : ["-g", url],
+      via: "system"
+    };
+  }
+  if (platform === "win32") {
+    return {
+      command: "cmd",
+      args: ["/c", "start", "", url],
+      via: "system"
+    };
+  }
+  return {
+    command: "xdg-open",
+    args: [url],
+    via: "system"
+  };
+}
+function buildChromiumUrlCommand(url, options = {}) {
+  if (!url) throw new Error("openUrl requires a url");
+  const platform = options.platform ?? process.platform;
+  const chromiumBinary = "chromiumBinary" in options ? options.chromiumBinary : resolveChromiumBinary(platform);
+  if (!chromiumBinary) {
+    throw new Error("browser launch requires Chrome, Chromium, Edge, Brave, or Arc");
+  }
+  const args = [];
+  if (options.headless) {
+    args.push("--headless=new");
+  } else if (options.newWindow !== false) {
+    args.push("--new-window");
+  }
+  args.push(url);
+  return {
+    command: chromiumBinary,
+    args,
+    via: "chromium",
+    target: chromiumBinary
+  };
+}
+async function spawnLaunch(command, args, detached) {
+  return new Promise((resolve2, reject) => {
+    const child = (0, import_child_process3.spawn)(command, args, {
+      detached,
+      stdio: "ignore"
+    });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      if (detached) child.unref();
+      resolve2(child.pid);
+    });
+  });
+}
+async function launchUrl(url, options = {}) {
+  const command = buildOpenUrlCommand(url, options);
+  const pid = await spawnLaunch(command.command, command.args, options.detached ?? true);
+  return {
+    ...command,
+    pid,
+    attachUrl: url
+  };
+}
+async function openUrl(url, options = {}) {
+  await launchUrl(url, options);
+}
+
 // src/host/bridge-host.ts
 var WRITE_COMMAND_TYPES = /* @__PURE__ */ new Set(["tap", "keyboard", "close"]);
 function shouldAcquireLease(msg) {
@@ -2166,6 +2533,8 @@ function shouldAcquireLease(msg) {
   return WRITE_COMMAND_TYPES.has(msg.type);
 }
 var DAEMON_HEARTBEAT_INTERVAL_MS = 5e3;
+var DEFAULT_RUNTIME_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
+var RUNTIME_UPDATE_INTERVAL_ENV = "SOOTSIM_RUNTIME_UPDATE_INTERVAL_MS";
 var HTTP_MIME_TYPES = {
   ".html": "text/html; charset=utf-8",
   ".js": "application/javascript",
@@ -2211,6 +2580,10 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
   static CLI_IDLE_TIMEOUT_MS = 6e4;
   static CLI_LEASE_TTL_MS = 6e5;
   static USER_ACTIVE_LEASE_TTL_MS = 8e3;
+  // explicit user actions (clicking Boot, focusing the tab to take it over)
+  // hold the tab longer than passive canvas interaction so reconnecting clis
+  // can't immediately reclaim while the user gets oriented.
+  static USER_BOOT_LEASE_TTL_MS = 6e4;
   static BROWSER_RECONNECT_TTL_MS = 3e4;
   preferredPort;
   portFallbackCount;
@@ -2218,14 +2591,15 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
   effectivePort = 0;
   startedAt = 0;
   heartbeatTimer = null;
+  runtimeUpdateTimer = null;
+  runtimeUpdateInFlight = null;
   activeRuntimeVersion = null;
   activeRuntimeDirPath = null;
   constructor(opts = {}) {
     this.preferredPort = opts.port || DEFAULT_SOOTSIM_BRIDGE_PORT;
     this.port = this.preferredPort;
     this.shouldWriteLockfile = opts.writeLockfile === true;
-    const defaultFallback = this.shouldWriteLockfile ? 1 : 10;
-    this.portFallbackCount = Math.max(1, opts.portFallbackCount ?? defaultFallback);
+    this.portFallbackCount = Math.max(1, opts.portFallbackCount ?? 10);
     this.openUrlHandler = opts.openUrl;
     this.agentHost = new AgentHost({ getExcludePorts: opts.agentScanExcludes });
   }
@@ -2315,6 +2689,8 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       const origin = req.headers.origin;
       const role = origin ? "browser" : "cli";
       let browser = null;
+      ws.on("error", () => {
+      });
       this.agentHost.registerSocket(ws);
       if (role === "browser") {
         browser = {
@@ -2458,15 +2834,18 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
               }
             }
             const hadLease = !!browser.cliLease;
-            browser.cliLease = void 0;
-            if (booted.length > 0 || hadLease) {
-              process.stderr.write(
-                `sootsim booted ${booted.length} cli client(s)${hadLease ? " + cleared lease" : ""} from [${browser.id}]
+            browser.cliLease = {
+              kind: "user-active",
+              cliSessionKey: "__user-active__",
+              cliLabel: "active user",
+              expiresAt: Date.now() + _SootSimBridgeHost.USER_BOOT_LEASE_TTL_MS
+            };
+            process.stderr.write(
+              `sootsim booted ${booted.length} cli client(s)${hadLease ? " (overrode prior lease)" : ""}; held tab for user [${browser.id}]
 `
-              );
-              this.recordBrowserAction(browser.id, "browser booted cli clients");
-              this.broadcastBrowserClientStates();
-            }
+            );
+            this.recordBrowserAction(browser.id, "browser booted cli clients");
+            this.broadcastBrowserClientStates();
             return;
           }
           const internalPending = this.pendingCommands.get(msg.id);
@@ -2539,7 +2918,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
               if (typeof msg.url !== "string" || !msg.url) {
                 throw new Error("bridge:open requires a url");
               }
-              await this.openUrl(msg.url);
+              await this.openUrl(msg.url, { newWindow: msg.newWindow === true });
               if (ws.readyState === import_ws.WebSocket.OPEN) {
                 ws.send(
                   JSON.stringify({
@@ -2703,9 +3082,11 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
         }
       }, DAEMON_HEARTBEAT_INTERVAL_MS);
       this.heartbeatTimer.unref();
+      this.startRuntimeUpdater();
     }
     void this.agentHost.seedOnBoot();
   }
+  bootstrapping = true;
   buildLockfileSnapshot() {
     return {
       schema: 1,
@@ -2716,7 +3097,8 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       activeRuntime: this.activeRuntimeVersion,
       activeRuntimeDir: this.activeRuntimeDirPath,
       startedAt: this.startedAt,
-      heartbeatAt: Date.now()
+      heartbeatAt: Date.now(),
+      bootstrapping: this.bootstrapping
     };
   }
   writeLockfileSnapshot() {
@@ -2726,6 +3108,61 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
     this.activeRuntimeVersion = readActiveRuntime();
     this.activeRuntimeDirPath = activeRuntimeDir();
   }
+  resolveRuntimeUpdateIntervalMs() {
+    const raw = Number(process.env[RUNTIME_UPDATE_INTERVAL_ENV]);
+    if (Number.isFinite(raw) && raw > 0) return Math.max(100, Math.round(raw));
+    return DEFAULT_RUNTIME_UPDATE_INTERVAL_MS;
+  }
+  startRuntimeUpdater() {
+    if (!this.shouldWriteLockfile || this.runtimeUpdateTimer) return;
+    void this.runRuntimeUpdate("startup");
+    const intervalMs = this.resolveRuntimeUpdateIntervalMs();
+    this.runtimeUpdateTimer = setInterval(() => {
+      void this.runRuntimeUpdate("periodic");
+    }, intervalMs);
+    this.runtimeUpdateTimer.unref();
+  }
+  runRuntimeUpdate(reason) {
+    if (this.runtimeUpdateInFlight) return this.runtimeUpdateInFlight;
+    this.runtimeUpdateInFlight = (async () => {
+      try {
+        if (reason === "startup") {
+          process.stderr.write("sootsim: checking for runtime updates\u2026\n");
+        }
+        const result = await updateRuntimeToLatest();
+        if (!result.updated || !result.latestVersion) {
+          if (reason === "startup") {
+            process.stderr.write(
+              `sootsim: runtime ${this.activeRuntimeVersion ?? "(none)"} is current
+`
+            );
+          }
+          return;
+        }
+        const active = this.setActiveRuntime(result.latestVersion);
+        process.stderr.write(`sootsim runtime updated to ${active.version} (${reason})
+`);
+      } catch (err) {
+        process.stderr.write(
+          `sootsim runtime update failed (${reason}): ${err instanceof Error ? err.message : String(err)}
+`
+        );
+      } finally {
+        this.runtimeUpdateInFlight = null;
+        if (reason === "startup" && this.bootstrapping) {
+          this.bootstrapping = false;
+          if (this.shouldWriteLockfile && this.httpServer) {
+            try {
+              this.writeLockfileSnapshot();
+            } catch {
+            }
+          }
+          process.stderr.write("sootsim: ready\n");
+        }
+      }
+    })();
+    return this.runtimeUpdateInFlight;
+  }
   /** update the active runtime on disk + in memory. the caller guarantees
    *  the version directory exists. pushes a runtime:changed message to all
    *  connected browsers so electron (or any renderer) can reload. */
@@ -2883,47 +3320,50 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
         return;
       }
     }
-    const resolved = import_path2.default.resolve(baseDir, "." + rel);
-    const baseWithSep = baseDir.endsWith(import_path2.default.sep) ? baseDir : baseDir + import_path2.default.sep;
+    const resolved = import_path4.default.resolve(baseDir, "." + rel);
+    const baseWithSep = baseDir.endsWith(import_path4.default.sep) ? baseDir : baseDir + import_path4.default.sep;
     if (!resolved.startsWith(baseWithSep) && resolved !== baseDir) {
       res.writeHead(403);
       res.end("forbidden");
       return;
     }
-    import_fs2.default.realpath(resolved, (realErr, realResolved) => {
+    import_fs4.default.realpath(resolved, (realErr, realResolved) => {
       const servePath = realErr ? resolved : realResolved;
-      const servePathWithSep = servePath.endsWith(import_path2.default.sep) ? servePath : servePath + import_path2.default.sep;
+      const servePathWithSep = servePath.endsWith(import_path4.default.sep) ? servePath : servePath + import_path4.default.sep;
       if (!realErr) {
         const realBaseWithSep = (() => {
           try {
-            const rb = import_fs2.default.realpathSync(baseDir);
-            return rb.endsWith(import_path2.default.sep) ? rb : rb + import_path2.default.sep;
+            const rb = import_fs4.default.realpathSync(baseDir);
+            return rb.endsWith(import_path4.default.sep) ? rb : rb + import_path4.default.sep;
           } catch {
             return baseWithSep;
           }
         })();
-        if (!servePathWithSep.startsWith(realBaseWithSep) && servePath + import_path2.default.sep !== realBaseWithSep) {
+        if (!servePathWithSep.startsWith(realBaseWithSep) && servePath + import_path4.default.sep !== realBaseWithSep) {
           res.writeHead(403);
           res.end("forbidden");
           return;
         }
       }
-      import_fs2.default.stat(servePath, (err, stats) => {
+      import_fs4.default.stat(servePath, (err, stats) => {
         if (err || !stats?.isFile()) {
-          const ext2 = import_path2.default.extname(rel).toLowerCase();
+          const ext2 = import_path4.default.extname(rel).toLowerCase();
           if (ext2 && ext2 !== ".html") {
             res.writeHead(404);
             res.end("not found");
             return;
           }
-          const indexPath = import_path2.default.join(baseDir, "index.html");
-          import_fs2.default.readFile(indexPath, (err2, data) => {
+          const indexPath = import_path4.default.join(baseDir, "index.html");
+          import_fs4.default.readFile(indexPath, (err2, data) => {
             if (err2) {
               res.writeHead(404);
               res.end("not found");
               return;
             }
-            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+            res.writeHead(200, {
+              "Content-Type": "text/html; charset=utf-8",
+              "Cache-Control": "no-store"
+            });
             if (method === "HEAD") {
               res.end();
               return;
@@ -2932,14 +3372,17 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
           });
           return;
         }
-        const ext = import_path2.default.extname(servePath).toLowerCase();
+        const ext = import_path4.default.extname(servePath).toLowerCase();
         const contentType = HTTP_MIME_TYPES[ext] || "application/octet-stream";
-        res.writeHead(200, { "Content-Type": contentType });
+        res.writeHead(200, {
+          "Content-Type": contentType,
+          "Cache-Control": "no-store"
+        });
         if (method === "HEAD") {
           res.end();
           return;
         }
-        const stream = import_fs2.default.createReadStream(servePath);
+        const stream = import_fs4.default.createReadStream(servePath);
         stream.pipe(res);
         stream.on("error", () => {
           try {
@@ -3022,7 +3465,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
     const target = `${filePath}${loc}`;
     const trySpawn = (cmd, args) => new Promise((resolve2) => {
       try {
-        const child = (0, import_child_process2.spawn)(cmd, args, { detached: true, stdio: "ignore" });
+        const child = (0, import_child_process4.spawn)(cmd, args, { detached: true, stdio: "ignore" });
         let settled = false;
         child.on("error", () => {
           if (settled) return;
@@ -3049,26 +3492,12 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
     if (await trySpawn("code", ["-g", target])) return;
     await this.openUrl(filePath);
   }
-  async openUrl(url) {
+  async openUrl(url, options = {}) {
     if (this.openUrlHandler) {
-      await this.openUrlHandler(url);
+      await this.openUrlHandler(url, options);
       return;
     }
-    if (process.platform === "darwin") {
-      const child2 = (0, import_child_process2.spawn)("open", ["-g", url], { detached: true, stdio: "ignore" });
-      child2.unref();
-      return;
-    }
-    if (process.platform === "win32") {
-      const child2 = (0, import_child_process2.spawn)("cmd", ["/c", "start", "", url], {
-        detached: true,
-        stdio: "ignore"
-      });
-      child2.unref();
-      return;
-    }
-    const child = (0, import_child_process2.spawn)("xdg-open", [url], { detached: true, stdio: "ignore" });
-    child.unref();
+    await openUrl(url, options);
   }
   async close() {
     if (this.cliIdleTimer) {
@@ -3079,6 +3508,10 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       clearInterval(this.heartbeatTimer);
       this.heartbeatTimer = null;
     }
+    if (this.runtimeUpdateTimer) {
+      clearInterval(this.runtimeUpdateTimer);
+      this.runtimeUpdateTimer = null;
+    }
     if (this.shouldWriteLockfile) {
       try {
         removeDaemonLockfile();
@@ -3215,11 +3648,14 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
     if (existing && existing.kind === "cli") {
       return;
     }
+    const now = Date.now();
+    const refreshed = now + _SootSimBridgeHost.USER_ACTIVE_LEASE_TTL_MS;
+    const expiresAt = existing && existing.kind === "user-active" ? Math.max(existing.expiresAt, refreshed) : refreshed;
     browser.cliLease = {
       kind: "user-active",
       cliSessionKey: "__user-active__",
       cliLabel: "active user",
-      expiresAt: Date.now() + _SootSimBridgeHost.USER_ACTIVE_LEASE_TTL_MS
+      expiresAt
     };
     this.broadcastBrowserClientStates();
   }
@@ -3434,6 +3870,10 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       clearInterval(this.cliIdleTimer);
       this.cliIdleTimer = null;
     }
+    if (this.runtimeUpdateTimer) {
+      clearInterval(this.runtimeUpdateTimer);
+      this.runtimeUpdateTimer = null;
+    }
     const wss = this.wss;
     const httpServer = this.httpServer;
     this.wss = null;