sootsim 0.0.4 → 0.1.37

package/dist-lib/host/bridge-host.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.0.4 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.37 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;
@@ -35,156 +35,12 @@ __export(bridge_host_exports, {
   SootSimBridgeHost: () => SootSimBridgeHost
 });
 module.exports = __toCommonJS(bridge_host_exports);
-var import_child_process2 = require("child_process");
-var import_fs2 = __toESM(require("fs"), 1);
-var import_http2 = require("http");
-var import_path2 = __toESM(require("path"), 1);
+var import_child_process4 = require("child_process");
+var import_fs3 = __toESM(require("fs"), 1);
+var import_http3 = require("http");
+var import_path3 = __toESM(require("path"), 1);
 var import_ws = require("ws");
 
-// src/bridge-constants.ts
-var DEFAULT_SOOTSIM_BRIDGE_PORT = 7668;
-
-// src/home-paths.ts
-var import_fs = __toESM(require("fs"), 1);
-var import_os = require("os");
-var import_path = __toESM(require("path"), 1);
-var SOOTSIM_HOME_ENV = "SOOTSIM_HOME";
-var ACTIVE_RUNTIME_FILE = "active";
-var DAEMON_LOCKFILE = "daemon.json";
-var DAEMON_HEARTBEAT_STALE_MS = 3e4;
-function sootsimHomeDir() {
-  const override = process.env[SOOTSIM_HOME_ENV];
-  if (override && override.length > 0) return import_path.default.resolve(override);
-  return import_path.default.join((0, import_os.homedir)(), ".sootsim");
-}
-function runtimesDir() {
-  return import_path.default.join(sootsimHomeDir(), "runtimes");
-}
-function runtimeDir(version) {
-  return import_path.default.join(runtimesDir(), version);
-}
-function activeRuntimeFile() {
-  return import_path.default.join(runtimesDir(), ACTIVE_RUNTIME_FILE);
-}
-function cacheDir() {
-  return import_path.default.join(sootsimHomeDir(), "cache");
-}
-function daemonLockfilePath() {
-  return import_path.default.join(sootsimHomeDir(), DAEMON_LOCKFILE);
-}
-function ensureSootsimHome() {
-  import_fs.default.mkdirSync(sootsimHomeDir(), { recursive: true });
-  import_fs.default.mkdirSync(runtimesDir(), { recursive: true });
-  import_fs.default.mkdirSync(cacheDir(), { recursive: true });
-}
-function readActiveRuntime() {
-  try {
-    const value = import_fs.default.readFileSync(activeRuntimeFile(), "utf8").trim();
-    return value.length > 0 ? value : null;
-  } catch {
-    return null;
-  }
-}
-function writeActiveRuntime(version) {
-  import_fs.default.mkdirSync(runtimesDir(), { recursive: true });
-  import_fs.default.writeFileSync(activeRuntimeFile(), `${version}
-`, "utf8");
-}
-function listInstalledRuntimes() {
-  try {
-    return import_fs.default.readdirSync(runtimesDir(), { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort(compareSemver);
-  } catch {
-    return [];
-  }
-}
-function compareSemver(a, b) {
-  const parse = (v) => {
-    const hyphen = v.indexOf("-");
-    const core = hyphen >= 0 ? v.slice(0, hyphen) : v;
-    const pre = hyphen >= 0 ? v.slice(hyphen + 1) : "";
-    const parts = core.split(".").map((n) => Number.parseInt(n, 10));
-    if (parts.some((n) => !Number.isFinite(n))) return [[Number.POSITIVE_INFINITY], v];
-    return [parts, pre];
-  };
-  const [an, ap] = parse(a);
-  const [bn, bp] = parse(b);
-  for (let i = 0; i < Math.max(an.length, bn.length); i++) {
-    const av = an[i] ?? 0;
-    const bv = bn[i] ?? 0;
-    if (av !== bv) return av - bv;
-  }
-  if (ap === bp) return 0;
-  if (!ap) return 1;
-  if (!bp) return -1;
-  return ap < bp ? -1 : 1;
-}
-function activeRuntimeDir() {
-  const version = readActiveRuntime();
-  if (!version) return null;
-  const dir = runtimeDir(version);
-  try {
-    if (import_fs.default.statSync(dir).isDirectory()) return dir;
-  } catch {
-  }
-  return null;
-}
-var DAEMON_LOCKFILE_MAX_BYTES = 16 * 1024;
-function readDaemonLockfile() {
-  try {
-    const fd = import_fs.default.openSync(daemonLockfilePath(), "r");
-    try {
-      const buf = Buffer.alloc(DAEMON_LOCKFILE_MAX_BYTES);
-      const bytesRead = import_fs.default.readSync(fd, buf, 0, DAEMON_LOCKFILE_MAX_BYTES, 0);
-      const raw = buf.subarray(0, bytesRead).toString("utf8");
-      const parsed = JSON.parse(raw);
-      if (parsed && parsed.schema === 1 && typeof parsed.pid === "number" && typeof parsed.bridgePort === "number" && typeof parsed.runtimePort === "number" && typeof parsed.startedAt === "number" && typeof parsed.heartbeatAt === "number") {
-        return parsed;
-      }
-      return null;
-    } finally {
-      import_fs.default.closeSync(fd);
-    }
-  } catch {
-    return null;
-  }
-}
-function isDaemonLockfileFresh(lock, now = Date.now()) {
-  if (!lock) return false;
-  if (now - lock.heartbeatAt > DAEMON_HEARTBEAT_STALE_MS) return false;
-  try {
-    process.kill(lock.pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function writeDaemonLockfile(data) {
-  ensureSootsimHome();
-  const tmp = `${daemonLockfilePath()}.tmp`;
-  import_fs.default.writeFileSync(tmp, `${JSON.stringify(data, null, 2)}
-`, "utf8");
-  import_fs.default.renameSync(tmp, daemonLockfilePath());
-}
-function claimDaemonLockfile(data) {
-  ensureSootsimHome();
-  const existing = readDaemonLockfile();
-  if (existing && isDaemonLockfileFresh(existing) && existing.pid !== data.pid) {
-    return false;
-  }
-  writeDaemonLockfile(data);
-  return true;
-}
-function removeDaemonLockfile() {
-  try {
-    import_fs.default.unlinkSync(daemonLockfilePath());
-  } catch {
-  }
-}
-
-// src/host/agent-host.ts
-var import_node_fs4 = __toESM(require("node:fs"), 1);
-var import_node_path4 = __toESM(require("node:path"), 1);
-
 // scripts/dev-server-scanner.ts
 var import_child_process = require("child_process");
 var import_http = __toESM(require("http"), 1);
@@ -198,7 +54,7 @@ function hasOwnKeys(value) {
 }
 function hasSootSimConfig(config) {
   if (!config) return false;
-  return hasOwnKeys(config.modules) || hasOwnKeys(config.turboModules) || hasOwnKeys(config.env) || hasOwnKeys(config.settings) || hasOwnKeys(config.initialState);
+  return hasOwnKeys(config.modules) || hasOwnKeys(config.turboModules) || hasOwnKeys(config.nativeModules) || hasOwnKeys(config.env) || hasOwnKeys(config.settings) || hasOwnKeys(config.initialState);
 }
 function applySootSimConfigToUrl(url, config) {
   const parsed = new URL(url);
@@ -221,11 +77,9 @@ function normalizeNativeDevBundleUrl(bundleUrl) {
   try {
     const isAbsolute = isAbsoluteHttpUrl(bundleUrl);
     const parsed = new URL(bundleUrl, "http://soot.local");
+    parsed.pathname = parsed.pathname.replace(/\.\.bundle$/, ".bundle");
     if (!isNativeDevBundlePath(parsed.pathname)) return bundleUrl;
-    if (!parsed.searchParams.has("dev")) parsed.searchParams.set("dev", "true");
-    if (!parsed.searchParams.has("minify")) {
-      parsed.searchParams.set("minify", "false");
-    }
+    parsed.searchParams.delete("transform.bytecode");
     if (isAbsolute) return parsed.toString();
     return `${parsed.pathname}${parsed.search}${parsed.hash}`;
   } catch {
@@ -273,11 +127,28 @@ var getExpensifyProxyScript = () => resolveWorkspaceScriptPath(
   "packages/sootsim-engine/scripts/expensify-web-proxy.ts",
   "scripts/expensify-web-proxy.ts"
 );
+var getRainbowMetadataProxyScript = () => resolveWorkspaceScriptPath(
+  "packages/sootsim-engine/scripts/rainbow-metadata-proxy.ts",
+  "scripts/rainbow-metadata-proxy.ts"
+);
+var getMattermostRNUtilsNativeModule = () => resolveWorkspaceScriptPath(
+  "packages/compat/src/stubs/mattermost-rnutils-native.ts",
+  "../compat/src/stubs/mattermost-rnutils-native.ts"
+);
+var getMattermostKeychainNativeModule = () => resolveWorkspaceScriptPath(
+  "packages/compat/src/stubs/native-seams/react-native-keychain-manager.ts",
+  "../compat/src/stubs/native-seams/react-native-keychain-manager.ts"
+);
+var getMattermostNetworkClientNativeModule = () => resolveWorkspaceScriptPath(
+  "packages/compat/src/stubs/mattermost-network-client-native.ts",
+  "../compat/src/stubs/mattermost-network-client-native.ts"
+);
 var EXPENSIFY_NATIVE_PROXY_ENV = {
   USE_NGROK: "true",
   NGROK_URL: "http://localhost:9000/",
   SECURE_NGROK_URL: "http://localhost:9000/"
 };
+var MATTERMOST_DIR = (0, import_node_path.join)(HOME, "github/mattermost-mobile");
 var UNISWAP_REPO_DIR = (0, import_node_path.join)(HOME, "github/uniswap-interface");
 var UNISWAP_APP_DIR = (0, import_node_path.join)(UNISWAP_REPO_DIR, "apps/mobile");
 var UNISWAP_ENV_LOCAL_FILE = (0, import_node_path.join)(UNISWAP_REPO_DIR, ".env.defaults.local");
@@ -433,6 +304,217 @@ function ensureUniswapForceUpgradePatched() {
     notificationLegacyPatch
   );
 }
+var JOPLIN_DIR = (0, import_node_path.join)(HOME, "github/joplin");
+var JOPLIN_APP_DIR = (0, import_node_path.join)(JOPLIN_DIR, "packages/app-mobile");
+var JOPLIN_WATCH_ROOTS = [
+  "packages/lib",
+  "packages/renderer",
+  "packages/turndown",
+  "packages/turndown-plugin-gfm",
+  "packages/editor",
+  "packages/tools",
+  "packages/utils",
+  "packages/fork-htmlparser2",
+  "packages/fork-uslug",
+  "packages/fork-sax",
+  "packages/htmlpack",
+  "packages/react-native-saf-x",
+  "packages/react-native-alarm-notification"
+];
+function ensureJoplinWatchmanConfigs() {
+  if (!(0, import_node_fs.existsSync)(JOPLIN_DIR)) return;
+  for (const rel of JOPLIN_WATCH_ROOTS) {
+    const dir = (0, import_node_path.join)(JOPLIN_DIR, rel);
+    if (!(0, import_node_fs.existsSync)(dir)) continue;
+    const cfg = (0, import_node_path.join)(dir, ".watchmanconfig");
+    if (!(0, import_node_fs.existsSync)(cfg)) (0, import_node_fs.writeFileSync)(cfg, "{}\n");
+  }
+}
+var JOPLIN_BUILD_SENTINELS = [
+  "packages/lib/models/Setting.js",
+  "packages/turndown/lib/turndown.cjs.js",
+  "packages/app-mobile/pluginAssets/index.js"
+];
+function ensureJoplinBuilt() {
+  if (!(0, import_node_fs.existsSync)(JOPLIN_DIR)) return;
+  const missing = JOPLIN_BUILD_SENTINELS.filter(
+    (rel) => !(0, import_node_fs.existsSync)((0, import_node_path.join)(JOPLIN_DIR, rel))
+  );
+  if (missing.length === 0) return;
+  const { execSync } = require("node:child_process");
+  execSync("yarn buildParallel", {
+    cwd: JOPLIN_DIR,
+    stdio: "inherit",
+    env: { ...process.env, NO_FLIPPER: "1", CI: "" }
+  });
+  const stillMissing = JOPLIN_BUILD_SENTINELS.filter(
+    (rel) => !(0, import_node_fs.existsSync)((0, import_node_path.join)(JOPLIN_DIR, rel))
+  );
+  if (stillMissing.length > 0) {
+    throw new Error(
+      `joplin demo: yarn buildParallel did not produce: ${stillMissing.join(", ")}`
+    );
+  }
+}
+var RAINBOW_DIR = (0, import_node_path.join)(HOME, "github/rainbow");
+var RAINBOW_GRAPHQL_DIR = (0, import_node_path.join)(RAINBOW_DIR, "src/graphql");
+var RAINBOW_GRAPHQL_CONFIG_FILE = (0, import_node_path.join)(RAINBOW_GRAPHQL_DIR, "config.js");
+var RAINBOW_NETWORKS_FILE = (0, import_node_path.join)(RAINBOW_DIR, "src/references/networks.json");
+var RAINBOW_METADATA_BASE_URL = "https://metadata.p.rainbow.me";
+var RAINBOW_METADATA_PROXY_PORT = 9011;
+var RAINBOW_DEMO_METADATA_BASE_URL = `http://127.0.0.1:${RAINBOW_METADATA_PROXY_PORT}`;
+var RAINBOW_PUBLIC_ENS_GRAPHQL_URL = "https://api.thegraph.com/subgraphs/name/ensdomains/ens";
+var RAINBOW_DEMO_QUOTE_SIGNER = "0x0000000000000000000000000000000000000000";
+var RAINBOW_DEMO_RELAY_URL = "https://relay.rainbow.me";
+var RAINBOW_DEMO_MASTER_KEY = "sootsim-rainbow-demo-master-key-do-not-use-for-real-wallets";
+var RAINBOW_DEMO_RPC_PROXY_BASE_URL = "https://rpc.rainbow.me/v1";
+var RAINBOW_DEMO_RPC_API_KEY = "";
+var RAINBOW_DEMO_PUBLIC_RPC_URLS = {
+  "1": "https://ethereum-rpc.publicnode.com"
+};
+var RAINBOW_DEMO_SERVICE_API_KEY = "sootsim-rainbow-demo-api-key";
+var RAINBOW_DEMO_SECURE_WALLET_HASH_KEY = "0x736f6f7473696d2d7261696e626f772d64656d6f2d686173682d6b6579000000";
+var RAINBOW_GRAPHQL_SENTINELS = [
+  "src/graphql/__generated__/ens.ts",
+  "src/graphql/__generated__/metadata.ts",
+  "src/graphql/__generated__/metadataPOST.ts"
+];
+function runRainbowSetupCommand(command, cwd) {
+  const { execSync } = require("node:child_process");
+  execSync(command, {
+    cwd,
+    stdio: "inherit",
+    env: {
+      ...process.env,
+      METADATA_BASE_URL: RAINBOW_METADATA_BASE_URL,
+      RAINBOW_RELAY_QUOTE_SIGNER: process.env.RAINBOW_RELAY_QUOTE_SIGNER ?? RAINBOW_DEMO_QUOTE_SIGNER
+    }
+  });
+}
+function ensureRainbowGraphqlConfig() {
+  if (!(0, import_node_fs.existsSync)(RAINBOW_GRAPHQL_DIR)) return;
+  const source = (0, import_node_fs.existsSync)(RAINBOW_GRAPHQL_CONFIG_FILE) ? (0, import_node_fs.readFileSync)(RAINBOW_GRAPHQL_CONFIG_FILE, "utf8") : "";
+  if (source.includes(RAINBOW_PUBLIC_ENS_GRAPHQL_URL) && source.includes(RAINBOW_METADATA_BASE_URL)) {
+    return;
+  }
+  (0, import_node_fs.writeFileSync)(
+    RAINBOW_GRAPHQL_CONFIG_FILE,
+    `exports.config = {
+  ens: {
+    __name: 'ens',
+    document: './queries/ens.graphql',
+    schema: {
+      method: 'POST',
+      url: '${RAINBOW_PUBLIC_ENS_GRAPHQL_URL}',
+    },
+  },
+  metadata: {
+    __name: 'metadata',
+    document: './queries/metadata.graphql',
+    schema: { method: 'GET', url: '${RAINBOW_METADATA_BASE_URL}/v1/graph' },
+  },
+  metadataPOST: {
+    __name: 'metadataPOST',
+    document: './queries/metadata.graphql',
+    schema: { method: 'POST', url: '${RAINBOW_METADATA_BASE_URL}/v1/graph' },
+  },
+  arc: {
+    __name: 'arc',
+    document: './queries/arc.graphql',
+    schema: {
+      method: 'GET',
+      url: 'https://arc-graphql.rainbow.me/graphql',
+      headers: {
+        'x-api-key': 'ARC_GRAPHQL_API_KEY',
+      },
+    },
+  },
+  arcDev: {
+    __name: 'arcDev',
+    document: './queries/arc.graphql',
+    schema: {
+      method: 'GET',
+      url: 'https://arc-graphql.rainbowdotme.workers.dev/graphql',
+      headers: {},
+    },
+  },
+};
+`
+  );
+}
+function resolveRainbowDemoEnv() {
+  const env = {
+    ENABLE_DEV_MODE: "1",
+    IS_TESTING: "false",
+    METADATA_BASE_URL: process.env.RAINBOW_METADATA_BASE_URL ?? RAINBOW_DEMO_METADATA_BASE_URL,
+    ADDYS_API_KEY: process.env.ADDYS_API_KEY ?? RAINBOW_DEMO_SERVICE_API_KEY,
+    ADDYS_BASE_URL: process.env.ADDYS_BASE_URL ?? RAINBOW_DEMO_METADATA_BASE_URL,
+    PLATFORM_API_KEY: process.env.PLATFORM_API_KEY ?? RAINBOW_DEMO_SERVICE_API_KEY,
+    PLATFORM_BASE_URL: process.env.PLATFORM_BASE_URL ?? RAINBOW_DEMO_METADATA_BASE_URL,
+    RAINBOW_MASTER_KEY: process.env.RAINBOW_MASTER_KEY ?? RAINBOW_DEMO_MASTER_KEY,
+    RAINBOW_RELAY_QUOTE_SIGNER: process.env.RAINBOW_RELAY_QUOTE_SIGNER ?? RAINBOW_DEMO_QUOTE_SIGNER,
+    RAINBOW_RELAY_URL: process.env.RAINBOW_RELAY_URL ?? RAINBOW_DEMO_RELAY_URL,
+    RPC_PROXY_API_KEY_PROD: RAINBOW_DEMO_RPC_API_KEY,
+    RPC_PROXY_BASE_URL_PROD: process.env.RAINBOW_RPC_PROXY_BASE_URL ?? process.env.RPC_PROXY_BASE_URL_PROD ?? RAINBOW_DEMO_RPC_PROXY_BASE_URL,
+    SECURE_WALLET_HASH_KEY: process.env.SECURE_WALLET_HASH_KEY ?? RAINBOW_DEMO_SECURE_WALLET_HASH_KEY
+  };
+  const optionalEnvVars = [
+    "ADDYS_API_KEY",
+    "ADDYS_BASE_URL",
+    "IMGIX_DOMAIN",
+    "IMGIX_TOKEN",
+    "PLATFORM_API_KEY",
+    "PLATFORM_BASE_URL",
+    "RAINBOW_TEST_WALLET",
+    "RAINBOW_RELAY_API_KEY",
+    "RAINBOW_RELAY_URL",
+    "SECURE_WALLET_HASH_KEY",
+    "TOKEN_SEARCH_URL",
+    "WC_PROJECT_ID"
+  ];
+  for (const key of optionalEnvVars) {
+    const value = process.env[key];
+    if (value) env[key] = value;
+  }
+  if (!env.WC_PROJECT_ID && process.env.RAINBOW_WALLETCONNECT_PROJECT_ID) {
+    env.WC_PROJECT_ID = process.env.RAINBOW_WALLETCONNECT_PROJECT_ID;
+  }
+  return env;
+}
+function ensureRainbowDemoNetworks() {
+  if (!(0, import_node_fs.existsSync)(RAINBOW_NETWORKS_FILE)) return;
+  const payload = JSON.parse((0, import_node_fs.readFileSync)(RAINBOW_NETWORKS_FILE, "utf8"));
+  if (!Array.isArray(payload.networks)) return;
+  let changed = false;
+  for (const network of payload.networks) {
+    const url = network.id ? RAINBOW_DEMO_PUBLIC_RPC_URLS[network.id] : void 0;
+    if (!url || !network.defaultRPC) continue;
+    if (network.defaultRPC.url === url) continue;
+    network.defaultRPC.url = url;
+    changed = true;
+  }
+  if (changed) {
+    (0, import_node_fs.writeFileSync)(RAINBOW_NETWORKS_FILE, `${JSON.stringify(payload)}
+`);
+  }
+}
+function ensureRainbowSetup() {
+  if (!(0, import_node_fs.existsSync)(RAINBOW_DIR)) return;
+  ensureRainbowGraphqlConfig();
+  if (!(0, import_node_fs.existsSync)((0, import_node_path.join)(RAINBOW_GRAPHQL_DIR, "node_modules/.bin/graphql-codegen"))) {
+    runRainbowSetupCommand("fnm exec --using=22 yarn install", RAINBOW_GRAPHQL_DIR);
+  }
+  const missingGraphql = RAINBOW_GRAPHQL_SENTINELS.some(
+    (rel) => !(0, import_node_fs.existsSync)((0, import_node_path.join)(RAINBOW_DIR, rel))
+  );
+  if (missingGraphql) {
+    runRainbowSetupCommand("fnm exec --using=22 yarn codegen", RAINBOW_GRAPHQL_DIR);
+  }
+  if (!(0, import_node_fs.existsSync)(RAINBOW_NETWORKS_FILE)) {
+    runRainbowSetupCommand("fnm exec --using=22 yarn fetch:networks", RAINBOW_DIR);
+  }
+  ensureRainbowDemoNetworks();
+}
 var ARTSY_DIR = (0, import_node_path.join)(HOME, "github/eigen");
 var ARTSY_KEYS_FILE = (0, import_node_path.join)(ARTSY_DIR, "keys.shared.json");
 var ARTSY_METAFLAGS_FILE = (0, import_node_path.join)(ARTSY_DIR, "metaflags.json");
@@ -559,7 +641,24 @@ var APPS = [
     dir: (0, import_node_path.join)(HOME, "takeout"),
     preferredPort: 8086,
     framework: "one",
-    command: (p) => ({ cmd: "npx one dev", env: { ONE_PORT: String(p) } })
+    // takeout needs more than Metro for the demo to actually work: better-auth
+    // (login), zero-cache (sync), and a postgres for both. `bun lite` brings
+    // up the orez-backed stack (PG + zero + s3 in one binary) plus the One
+    // dev server. takeout's env system shifts every port (web, pg, zero,
+    // minio) uniformly by PORT_OFFSET, so we derive offset = port - 8081
+    // (the base web port) to keep all backend ports clear of the default
+    // dev stack while pinning One to the demo slot. OREZ_DATA_DIR is isolated
+    // to a per-demo path so we don't fight a soot dev orez that may already
+    // be holding pglite locks on ~/takeout/.orez (soot can attach takeout as
+    // a project and spin up its own orez against the same data dir).
+    readyTimeoutMs: 24e4,
+    command: (p) => ({
+      cmd: "bun lite",
+      env: {
+        PORT_OFFSET: String(p - 8081),
+        OREZ_DATA_DIR: `${HOME}/.cache/sootsim-demo/takeout-orez`
+      }
+    })
   },
   {
     name: "expensify",
@@ -606,6 +705,151 @@ var APPS = [
       envVars: ["SOOTSIM_ARTSY_EMAIL", "SOOTSIM_ARTSY_PASSWORD"],
       note: "auto-login reuses Artsy\u2019s built-in Maestro launch-arguments hook"
     }
+  },
+  {
+    name: "rainbow",
+    label: "Rainbow",
+    dir: RAINBOW_DIR,
+    preferredPort: 8089,
+    framework: "rock",
+    sidecars: [
+      {
+        name: "metadata-proxy",
+        port: RAINBOW_METADATA_PROXY_PORT,
+        readyPath: "/health",
+        command: () => ({
+          cmd: `bun ${JSON.stringify(getRainbowMetadataProxyScript())}`,
+          env: {
+            PORT: String(RAINBOW_METADATA_PROXY_PORT),
+            RAINBOW_PUBLIC_RPC_URLS: JSON.stringify(RAINBOW_DEMO_PUBLIC_RPC_URLS),
+            RAINBOW_UPSTREAM_METADATA_BASE_URL: RAINBOW_METADATA_BASE_URL
+          }
+        })
+      }
+    ],
+    prepare: () => {
+      ensureRainbowSetup();
+    },
+    command: (p) => ({
+      cmd: `fnm exec --using=22 yarn start --port ${p} --reset-cache`,
+      env: resolveRainbowDemoEnv()
+    }),
+    credentials: {
+      envVars: [
+        "RAINBOW_TEST_WALLET",
+        "RAINBOW_WALLETCONNECT_PROJECT_ID",
+        "WC_PROJECT_ID",
+        "IMGIX_DOMAIN",
+        "IMGIX_TOKEN"
+      ],
+      note: "launcher supplies a demo encryption key and public mainnet RPC; use only a public throwaway mnemonic for RAINBOW_TEST_WALLET"
+    }
+  },
+  {
+    name: "rocket-chat",
+    label: "Rocket.Chat",
+    dir: (0, import_node_path.join)(HOME, "github/Rocket.Chat.ReactNative"),
+    preferredPort: 8093,
+    framework: "expo",
+    command: (p) => ({
+      cmd: `npx react-native start --port ${p}`,
+      env: { RUNNING_E2E_TESTS: "true" }
+    }),
+    credentials: {
+      envVars: [
+        "ROCKET_CHAT_DEMO_SERVER",
+        "ROCKET_CHAT_DEMO_USERNAME",
+        "ROCKET_CHAT_DEMO_PASSWORD"
+      ],
+      known: { SERVER: "https://mobile.qa.rocket.chat" },
+      note: "use packages/sootsim-engine/scripts/rocket-chat-demo-auth.ts to create/login a disposable QA user and print the rocketchat://auth deep link"
+    }
+  },
+  {
+    name: "mattermost",
+    label: "Mattermost",
+    dir: MATTERMOST_DIR,
+    preferredPort: 8090,
+    framework: "expo",
+    runtimeConfig: {
+      modules: {
+        // mattermost patches react-native-keychain's JS entry in its own
+        // repo; run that package and provide only the native manager seam.
+        "react-native-keychain": false,
+        "dist/assets/config.json": {
+          inline: {
+            AuthUrlScheme: "mmauth://",
+            AuthUrlSchemeDev: "mmauthbeta://",
+            DefaultServerUrl: "http://localhost:8065",
+            DefaultServerName: "Mattermost Demo",
+            TestServerUrl: "http://localhost:8065",
+            AutoSelectServerUrl: true,
+            WebsiteURL: "https://mattermost.com",
+            ServerNoticeURL: "https://github.com/mattermost/mattermost-server/blob/master/NOTICE.txt",
+            MobileNoticeURL: "https://github.com/mattermost/mattermost-mobile/blob/master/NOTICE.txt",
+            RudderApiKey: "",
+            SentryEnabled: false,
+            SentryDsnIos: "",
+            SentryDsnAndroid: "",
+            SentryOptions: {
+              deactivateStacktraceMerging: true,
+              autoBreadcrumbs: {
+                xhr: false,
+                console: true
+              },
+              severityLevelFilter: ["fatal"]
+            },
+            ShowReview: false,
+            ShowOnboarding: false,
+            ExperimentalNormalizeMarkdownLinks: false,
+            CustomRequestHeaders: {},
+            CollectNetworkMetrics: false
+          }
+        }
+      },
+      nativeModules: {
+        RNKeychainManager: { file: getMattermostKeychainNativeModule() },
+        RNUtils: { file: getMattermostRNUtilsNativeModule() },
+        GenericClient: { file: getMattermostNetworkClientNativeModule() },
+        ApiClient: { file: getMattermostNetworkClientNativeModule() },
+        WebSocketClient: { file: getMattermostNetworkClientNativeModule() }
+      }
+    },
+    command: (p) => ({
+      cmd: `npx react-native start --host 127.0.0.1 --port ${p}`
+    }),
+    credentials: {
+      known: {
+        SERVER: "http://localhost:8065",
+        USERNAME: "demo",
+        PASSWORD: "DemoPassword1!"
+      },
+      note: "local mattermost-preview seeded through the real REST API; no signup or OTP needed"
+    }
+  },
+  {
+    name: "joplin",
+    label: "Joplin",
+    dir: JOPLIN_APP_DIR,
+    preferredPort: 8084,
+    framework: "expo",
+    // joplin is local-first: sync.target defaults to 0 ("None") and the
+    // mobile startup runs WelcomeUtils.install() on first launch, which
+    // seeds a "Welcome!" folder + welcome notes. no login or external
+    // credentials are needed for a usable demo — just boot it. tenant
+    // bedrock SQLite (via react-native-sqlite-storage stub) carries the
+    // seeded notes across reloads.
+    prepare: () => {
+      ensureJoplinWatchmanConfigs();
+      ensureJoplinBuilt();
+    },
+    command: (p) => ({
+      cmd: `npx expo start --port ${p}`,
+      env: { BROWSERSLIST_IGNORE_OLD_DATA: "true" }
+    }),
+    credentials: {
+      note: "no login required \u2014 sync.target=0 (None), seed via WelcomeUtils"
+    }
   }
 ];
 
@@ -630,10 +874,10 @@ function tcpPing(port, timeout = TCP_GATE_MS) {
     sock.connect(port, "localhost");
   });
 }
-function httpGet(port, path6, method = "GET", timeout = TIMEOUT_MS, headers = {}) {
+function httpGet(port, path7, method = "GET", timeout = TIMEOUT_MS, headers = {}) {
   return new Promise((resolve2) => {
     const req = import_http.default.request(
-      { hostname: "localhost", port, path: path6, method, timeout, headers },
+      { hostname: "localhost", port, path: path7, method, timeout, headers },
       (res) => {
         let body = "";
         res.on("data", (c) => body += c.toString());
@@ -766,9 +1010,9 @@ function applyManifest(result, manifestRes, buildIconProxyUrl) {
     if (client.name) result.projectName = client.name;
     if (client.ios?.bundleIdentifier) result.bundleId = client.ios.bundleIdentifier;
     if (result.framework === "metro" && client.sdkVersion) result.framework = "expo";
-    const launchUrl = manifest?.launchAsset?.url;
-    if (launchUrl && !result.patched && !isDirectOneBundleUrl(result.bundleUrl)) {
-      result.bundleUrl = withRuntimeConfig(result.port, launchUrl);
+    const launchUrl2 = manifest?.launchAsset?.url;
+    if (launchUrl2 && !result.patched && !isDirectOneBundleUrl(result.bundleUrl)) {
+      result.bundleUrl = withRuntimeConfig(result.port, launchUrl2);
     }
     const rawIconUrl = client.iconUrl || client.ios?.iconUrl || client.icon || client.ios?.icon;
     if (rawIconUrl) {
@@ -792,6 +1036,7 @@ function applyManifest(result, manifestRes, buildIconProxyUrl) {
 }
 var knownNonPatched = /* @__PURE__ */ new Set();
 var knownNonExpo = /* @__PURE__ */ new Set();
+var knownOne = /* @__PURE__ */ new Set();
 async function probePort(port, buildIconProxyUrl) {
   if (!await tcpPing(port)) return null;
   const onePath = `/node_modules/one/metro-entry.bundle?platform=ios&dev=true`;
@@ -799,7 +1044,7 @@ async function probePort(port, buildIconProxyUrl) {
     knownNonPatched.has(port) ? Promise.resolve(null) : httpGet(port, "/__soot/"),
     httpGet(port, "/status"),
     httpGet(port, onePath, "HEAD"),
-    httpGet(port, "/", "GET", TIMEOUT_MS, { "expo-platform": "ios" }),
+    knownOne.has(port) ? Promise.resolve(null) : httpGet(port, "/", "GET", TIMEOUT_MS, { "expo-platform": "ios" }),
     knownNonExpo.has(port) ? Promise.resolve(null) : httpGet(port, "/_expo/status")
   ]);
   if (expoRes && expoRes.statusCode === 200) {
@@ -809,6 +1054,7 @@ async function probePort(port, buildIconProxyUrl) {
   }
   if (oneRes && oneRes.statusCode > 0 && oneRes.statusCode < 400) {
     knownNonPatched.add(port);
+    knownOne.add(port);
     return applyManifest(
       {
         port,
@@ -837,13 +1083,13 @@ async function probePort(port, buildIconProxyUrl) {
       const manifest = JSON.parse(manifestRes.body);
       const client = manifest?.extra?.expoClient || {};
       if (client.name) {
-        const launchUrl = manifest?.launchAsset?.url || `http://localhost:${port}/index.bundle?platform=ios&dev=true&hot=true&minify=false`;
+        const launchUrl2 = manifest?.launchAsset?.url || `http://localhost:${port}/index.bundle?platform=ios&dev=true&hot=true&minify=false`;
         knownNonPatched.add(port);
         return applyManifest(
           {
             port,
             framework: "one",
-            bundleUrl: withRuntimeConfig(port, launchUrl),
+            bundleUrl: withRuntimeConfig(port, launchUrl2),
             hmrUrl: `ws://localhost:${port}/hot`,
             lastSeen: Date.now()
           },
@@ -912,6 +1158,9 @@ async function scanDevServers(opts = {}) {
   for (const p of [...knownNonExpo]) {
     if (!currentPorts.has(p)) knownNonExpo.delete(p);
   }
+  for (const p of [...knownOne]) {
+    if (!currentPorts.has(p)) knownOne.delete(p);
+  }
   const results = [];
   const toProbe = [];
   for (const { port, pid } of processes) {
@@ -923,6 +1172,7 @@ async function scanDevServers(opts = {}) {
     if (cached && cached.pid !== pid) {
       knownNonPatched.delete(port);
       knownNonExpo.delete(port);
+      knownOne.delete(port);
     }
     toProbe.push({ port, pid });
   }
@@ -940,27 +1190,422 @@ async function scanDevServers(opts = {}) {
   for (const { port, pid } of processes) {
     if (pid > 0) pidByPort.set(port, pid);
   }
-  await Promise.all(
-    results.map(async (result) => {
-      const pid = pidByPort.get(result.port);
-      if (!pid) return;
-      result.pid = pid;
-      const cwd = await resolveProcessCwd(pid);
-      if (cwd) result.cwd = cwd;
-    })
-  );
-  const livePids = new Set(pidByPort.values());
-  for (const pid of [...cwdByPid.keys()]) {
-    if (!livePids.has(pid)) cwdByPid.delete(pid);
+  await Promise.all(
+    results.map(async (result) => {
+      const pid = pidByPort.get(result.port);
+      if (!pid) return;
+      result.pid = pid;
+      const cwd = await resolveProcessCwd(pid);
+      if (cwd) result.cwd = cwd;
+    })
+  );
+  const livePids = new Set(pidByPort.values());
+  for (const pid of [...cwdByPid.keys()]) {
+    if (!livePids.has(pid)) cwdByPid.delete(pid);
+  }
+  return results.filter((r) => !isSootSelfServer(r));
+}
+
+// src/bridge-constants.ts
+var DEFAULT_SOOTSIM_BRIDGE_PORT = 7668;
+
+// src/home-paths.ts
+var import_node_fs2 = __toESM(require("node:fs"), 1);
+var import_node_os2 = require("node:os");
+var import_node_path2 = __toESM(require("node:path"), 1);
+var SOOTSIM_HOME_ENV = "SOOTSIM_HOME";
+var ACTIVE_RUNTIME_FILE = "active";
+var DAEMON_LOCKFILE = "daemon.json";
+var CONFIG_FILE = "config.json";
+var DAEMON_HEARTBEAT_STALE_MS = 3e4;
+function sootsimHomeDir() {
+  const override = process.env[SOOTSIM_HOME_ENV];
+  if (override && override.length > 0) return import_node_path2.default.resolve(override);
+  return import_node_path2.default.join((0, import_node_os2.homedir)(), ".sootsim");
+}
+function runtimesDir() {
+  return import_node_path2.default.join(sootsimHomeDir(), "runtimes");
+}
+function runtimeDir(version) {
+  return import_node_path2.default.join(runtimesDir(), version);
+}
+function activeRuntimeFile() {
+  return import_node_path2.default.join(runtimesDir(), ACTIVE_RUNTIME_FILE);
+}
+function electronDir() {
+  return import_node_path2.default.join(sootsimHomeDir(), "electron");
+}
+function electronUserDataDir() {
+  return import_node_path2.default.join(electronDir(), "userData");
+}
+function profilesDir() {
+  return import_node_path2.default.join(sootsimHomeDir(), "profiles");
+}
+function cacheDir() {
+  return import_node_path2.default.join(sootsimHomeDir(), "cache");
+}
+function daemonLockfilePath() {
+  return import_node_path2.default.join(sootsimHomeDir(), DAEMON_LOCKFILE);
+}
+function configFilePath() {
+  return import_node_path2.default.join(sootsimHomeDir(), CONFIG_FILE);
+}
+function readSharedConfig() {
+  try {
+    const raw = import_node_fs2.default.readFileSync(configFilePath(), "utf8");
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function writeSharedConfig(patch) {
+  ensureSootsimHome();
+  const current = readSharedConfig();
+  const next = { ...current, ...patch };
+  if (patch.settings && typeof patch.settings === "object") {
+    next.settings = {
+      ...current.settings && typeof current.settings === "object" ? current.settings : {},
+      ...patch.settings
+    };
+  }
+  const tmp = `${configFilePath()}.tmp`;
+  import_node_fs2.default.writeFileSync(tmp, `${JSON.stringify(next, null, 2)}
+`, "utf8");
+  import_node_fs2.default.renameSync(tmp, configFilePath());
+  return next;
+}
+function ensureSootsimHome() {
+  import_node_fs2.default.mkdirSync(sootsimHomeDir(), { recursive: true });
+  import_node_fs2.default.mkdirSync(runtimesDir(), { recursive: true });
+  import_node_fs2.default.mkdirSync(electronDir(), { recursive: true });
+  import_node_fs2.default.mkdirSync(profilesDir(), { recursive: true });
+  import_node_fs2.default.mkdirSync(cacheDir(), { recursive: true });
+}
+function readActiveRuntime() {
+  try {
+    const value = import_node_fs2.default.readFileSync(activeRuntimeFile(), "utf8").trim();
+    return value.length > 0 ? value : null;
+  } catch {
+    return null;
+  }
+}
+function writeActiveRuntime(version) {
+  import_node_fs2.default.mkdirSync(runtimesDir(), { recursive: true });
+  import_node_fs2.default.writeFileSync(activeRuntimeFile(), `${version}
+`, "utf8");
+}
+function listInstalledRuntimes() {
+  try {
+    return import_node_fs2.default.readdirSync(runtimesDir(), { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort(compareSemver);
+  } catch {
+    return [];
+  }
+}
+function compareSemver(a, b) {
+  const parse = (v) => {
+    const hyphen = v.indexOf("-");
+    const core = hyphen >= 0 ? v.slice(0, hyphen) : v;
+    const pre = hyphen >= 0 ? v.slice(hyphen + 1) : "";
+    const parts = core.split(".").map((n) => Number.parseInt(n, 10));
+    if (parts.some((n) => !Number.isFinite(n))) return [[Number.POSITIVE_INFINITY], v];
+    return [parts, pre];
+  };
+  const [an, ap] = parse(a);
+  const [bn, bp] = parse(b);
+  for (let i = 0; i < Math.max(an.length, bn.length); i++) {
+    const av = an[i] ?? 0;
+    const bv = bn[i] ?? 0;
+    if (av !== bv) return av - bv;
+  }
+  if (ap === bp) return 0;
+  if (!ap) return 1;
+  if (!bp) return -1;
+  return ap < bp ? -1 : 1;
+}
+function activeRuntimeDir() {
+  const version = readActiveRuntime();
+  if (!version) return null;
+  const dir = runtimeDir(version);
+  try {
+    if (import_node_fs2.default.statSync(dir).isDirectory()) return dir;
+  } catch {
+  }
+  return null;
+}
+var DAEMON_LOCKFILE_MAX_BYTES = 16 * 1024;
+function readDaemonLockfile() {
+  try {
+    const fd = import_node_fs2.default.openSync(daemonLockfilePath(), "r");
+    try {
+      const buf = Buffer.alloc(DAEMON_LOCKFILE_MAX_BYTES);
+      const bytesRead = import_node_fs2.default.readSync(fd, buf, 0, DAEMON_LOCKFILE_MAX_BYTES, 0);
+      const raw = buf.subarray(0, bytesRead).toString("utf8");
+      const parsed = JSON.parse(raw);
+      if (parsed && parsed.schema === 1 && typeof parsed.pid === "number" && typeof parsed.bridgePort === "number" && typeof parsed.runtimePort === "number" && typeof parsed.startedAt === "number" && typeof parsed.heartbeatAt === "number") {
+        return parsed;
+      }
+      return null;
+    } finally {
+      import_node_fs2.default.closeSync(fd);
+    }
+  } catch {
+    return null;
+  }
+}
+function isDaemonLockfileFresh(lock, now = Date.now()) {
+  if (!lock) return false;
+  if (now - lock.heartbeatAt > DAEMON_HEARTBEAT_STALE_MS) return false;
+  try {
+    process.kill(lock.pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function writeDaemonLockfile(data) {
+  ensureSootsimHome();
+  const tmp = `${daemonLockfilePath()}.tmp`;
+  import_node_fs2.default.writeFileSync(tmp, `${JSON.stringify(data, null, 2)}
+`, "utf8");
+  import_node_fs2.default.renameSync(tmp, daemonLockfilePath());
+}
+function claimDaemonLockfile(data) {
+  ensureSootsimHome();
+  const existing = readDaemonLockfile();
+  if (existing && isDaemonLockfileFresh(existing) && existing.pid !== data.pid) {
+    return false;
+  }
+  writeDaemonLockfile(data);
+  return true;
+}
+function removeDaemonLockfile() {
+  try {
+    import_node_fs2.default.unlinkSync(daemonLockfilePath());
+  } catch {
+  }
+}
+
+// src/runtime-delivery.ts
+var import_child_process2 = require("child_process");
+var import_crypto = __toESM(require("crypto"), 1);
+var import_fs = __toESM(require("fs"), 1);
+var import_path = __toESM(require("path"), 1);
+var import_stream = require("stream");
+var import_promises = require("stream/promises");
+var DEFAULT_RUNTIME_CDN_ORIGIN = "https://sootbean.com";
+var RUNTIME_CDN_ORIGIN_ENV = "SOOTSIM_CDN_ORIGIN";
+var RUNTIME_CHANNEL_ENV = "SOOTSIM_RUNTIME_CHANNEL";
+function readConfig() {
+  try {
+    const parsed = JSON.parse(import_fs.default.readFileSync(configFilePath(), "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function resolveRuntimeCdnOrigin(input) {
+  const config = readConfig();
+  const value = input || process.env[RUNTIME_CDN_ORIGIN_ENV] || config.cdnOrigin || DEFAULT_RUNTIME_CDN_ORIGIN;
+  return value.replace(/\/+$/, "");
+}
+function resolveRuntimeChannel(input) {
+  const config = readConfig();
+  return input || process.env[RUNTIME_CHANNEL_ENV] || config.runtimeChannel || "stable";
+}
+function runtimeManifestUrl(cdnOrigin) {
+  const url = new URL(`${resolveRuntimeCdnOrigin(cdnOrigin)}/runtimes/manifest.json`);
+  url.searchParams.set("t", String(Date.now()));
+  return url.toString();
+}
+function runtimeTarballUrl(version, cdnOrigin) {
+  return `${resolveRuntimeCdnOrigin(cdnOrigin)}/runtimes/sootsim-runtime-${version}.tar.gz`;
+}
+async function fetchRuntimeManifest(cdnOrigin) {
+  const url = runtimeManifestUrl(cdnOrigin);
+  const res = await fetch(url, { headers: { Accept: "application/json" } });
+  if (!res.ok) {
+    throw new Error(`manifest fetch failed: ${res.status} ${res.statusText} (${url})`);
+  }
+  return await res.json();
+}
+function resolveRuntimeVersion(manifest, opts = {}) {
+  const channel = resolveRuntimeChannel(opts.channel);
+  const version = opts.version || manifest.channels[channel]?.latest;
+  if (!version) {
+    throw new Error(
+      `no version specified and channel '${channel}' has no latest entry in the manifest`
+    );
+  }
+  const entry = manifest.versions[version];
+  if (!entry) {
+    throw new Error(
+      `version ${version} not found in manifest; available: ${Object.keys(manifest.versions).slice(-10).join(", ") || "(none)"}`
+    );
+  }
+  return { version, channel, entry };
+}
+async function installRuntime(opts = {}) {
+  ensureSootsimHome();
+  const cdnOrigin = resolveRuntimeCdnOrigin(opts.cdnOrigin);
+  const manifest = await fetchRuntimeManifest(cdnOrigin);
+  const { version, channel, entry } = resolveRuntimeVersion(manifest, opts);
+  const destDir = runtimeDir(version);
+  const setActive = opts.setActive !== false;
+  if (!opts.force && import_fs.default.existsSync(import_path.default.join(destDir, "index.html"))) {
+    if (setActive) writeActiveRuntime(version);
+    return {
+      version,
+      channel,
+      cdnOrigin,
+      runtimeDir: destDir,
+      installed: false,
+      activated: setActive,
+      manifest
+    };
+  }
+  const tarUrl = entry.tarball || runtimeTarballUrl(version, cdnOrigin);
+  const tarCachePath = import_path.default.join(cacheDir(), `sootsim-runtime-${version}.tar.gz`);
+  process.stderr.write(`sootsim: downloading runtime ${version}\u2026
+`);
+  await downloadToFile(tarUrl, tarCachePath);
+  process.stderr.write(`sootsim: extracting runtime ${version}\u2026
+`);
+  const actualSha = await sha256File(tarCachePath);
+  if (actualSha !== entry.sha256) {
+    import_fs.default.rmSync(tarCachePath, { force: true });
+    throw new Error(
+      `sha256 mismatch for runtime ${version}: expected ${entry.sha256}, actual ${actualSha}`
+    );
+  }
+  const tmpDir = import_path.default.join(import_path.default.dirname(destDir), `.installing-${version}-${process.pid}`);
+  import_fs.default.rmSync(tmpDir, { recursive: true, force: true });
+  import_fs.default.mkdirSync(tmpDir, { recursive: true });
+  try {
+    await extractTarball(tarCachePath, tmpDir);
+    if (!import_fs.default.existsSync(import_path.default.join(tmpDir, "index.html"))) {
+      throw new Error(`extracted tarball for runtime ${version} is missing index.html`);
+    }
+    import_fs.default.rmSync(destDir, { recursive: true, force: true });
+    import_fs.default.renameSync(tmpDir, destDir);
+  } catch (err) {
+    import_fs.default.rmSync(tmpDir, { recursive: true, force: true });
+    throw err;
+  }
+  if (setActive) writeActiveRuntime(version);
+  return {
+    version,
+    channel,
+    cdnOrigin,
+    runtimeDir: destDir,
+    installed: true,
+    activated: setActive,
+    manifest
+  };
+}
+async function updateRuntimeToLatest(opts = {}) {
+  ensureSootsimHome();
+  const cdnOrigin = resolveRuntimeCdnOrigin(opts.cdnOrigin);
+  const channel = resolveRuntimeChannel(opts.channel);
+  const manifest = await fetchRuntimeManifest(cdnOrigin);
+  const latestVersion = manifest.channels[channel]?.latest;
+  if (!latestVersion) {
+    return {
+      checked: true,
+      updated: false,
+      reason: `channel '${channel}' has no latest runtime`,
+      activeVersion: readActiveRuntime()
+    };
+  }
+  const entry = manifest.versions[latestVersion];
+  if (!entry) {
+    return {
+      checked: true,
+      updated: false,
+      reason: `manifest is missing version ${latestVersion}`,
+      activeVersion: readActiveRuntime(),
+      latestVersion
+    };
+  }
+  const activeVersion = readActiveRuntime();
+  const activeDir = activeVersion ? runtimeDir(activeVersion) : null;
+  const activeInstalled = activeDir ? import_fs.default.existsSync(import_path.default.join(activeDir, "index.html")) : false;
+  const shouldInstall = !activeVersion || !activeInstalled || compareSemver(latestVersion, activeVersion) > 0;
+  if (!shouldInstall) {
+    return {
+      checked: true,
+      updated: false,
+      reason: "active runtime is current",
+      activeVersion,
+      latestVersion
+    };
+  }
+  const install = await installRuntime({
+    version: latestVersion,
+    channel,
+    cdnOrigin,
+    setActive: false
+  });
+  return {
+    checked: true,
+    updated: true,
+    activeVersion: latestVersion,
+    latestVersion,
+    install
+  };
+}
+async function downloadToFile(url, destPath) {
+  const res = await fetch(url);
+  if (!res.ok || !res.body) {
+    throw new Error(`download failed: ${res.status} ${res.statusText} (${url})`);
   }
-  return results.filter((r) => !isSootSelfServer(r));
+  import_fs.default.mkdirSync(import_path.default.dirname(destPath), { recursive: true });
+  const tmp = `${destPath}.partial`;
+  try {
+    await (0, import_promises.pipeline)(
+      import_stream.Readable.fromWeb(res.body),
+      import_fs.default.createWriteStream(tmp)
+    );
+    import_fs.default.renameSync(tmp, destPath);
+  } catch (err) {
+    try {
+      import_fs.default.unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+function sha256File(filePath) {
+  return new Promise((resolve2, reject) => {
+    const hash = import_crypto.default.createHash("sha256");
+    const stream = import_fs.default.createReadStream(filePath);
+    stream.on("data", (chunk) => hash.update(chunk));
+    stream.on("error", reject);
+    stream.on("end", () => resolve2(hash.digest("hex")));
+  });
+}
+function extractTarball(tarPath, destDir) {
+  return new Promise((resolve2, reject) => {
+    const child = (0, import_child_process2.spawn)("tar", ["-xzf", tarPath, "-C", destDir], {
+      stdio: ["ignore", "inherit", "inherit"]
+    });
+    child.on("error", reject);
+    child.on("exit", (code) => {
+      if (code === 0) resolve2();
+      else reject(new Error(`tar exited with code ${code}`));
+    });
+  });
 }
 
+// src/host/agent-host.ts
+var import_node_fs5 = __toESM(require("node:fs"), 1);
+var import_node_path5 = __toESM(require("node:path"), 1);
+
 // src/agent-sessions.ts
 var import_node_child_process = require("node:child_process");
 var import_node_crypto2 = require("node:crypto");
-var import_node_fs3 = __toESM(require("node:fs"), 1);
-var import_node_path3 = __toESM(require("node:path"), 1);
+var import_node_fs4 = __toESM(require("node:fs"), 1);
+var import_node_path4 = __toESM(require("node:path"), 1);
 var import_node_readline = __toESM(require("node:readline"), 1);
 
 // src/agent-events.ts
@@ -1004,37 +1649,20 @@ function encodeAgentPromptEnvelope(input) {
 
 // src/attached-projects.ts
 var import_node_crypto = require("node:crypto");
-var import_node_fs2 = __toESM(require("node:fs"), 1);
-var import_node_os2 = __toESM(require("node:os"), 1);
-var import_node_path2 = __toESM(require("node:path"), 1);
+var import_node_fs3 = __toESM(require("node:fs"), 1);
+var import_node_path3 = __toESM(require("node:path"), 1);
 var overrideDir = null;
 function userDataDir() {
   if (overrideDir) return overrideDir;
   const fromEnv = process.env.SOOTSIM_USER_DATA_DIR;
   if (fromEnv) return fromEnv;
-  try {
-    const electron = require("electron");
-    if (electron.app?.getPath) return electron.app.getPath("userData");
-  } catch {
-  }
-  return platformDefaultUserDataDir();
-}
-function platformDefaultUserDataDir() {
-  const home = import_node_os2.default.homedir();
-  if (process.platform === "darwin") {
-    return import_node_path2.default.join(home, "Library", "Application Support", "sootsim");
-  }
-  if (process.platform === "win32") {
-    return import_node_path2.default.join(process.env.APPDATA || home, "sootsim");
-  }
-  const xdg = process.env.XDG_CONFIG_HOME || import_node_path2.default.join(home, ".config");
-  return import_node_path2.default.join(xdg, "sootsim");
+  return electronUserDataDir();
 }
 function getUserDataDir() {
   return userDataDir();
 }
 function storeFile() {
-  return import_node_path2.default.join(userDataDir(), "attached-projects.json");
+  return import_node_path3.default.join(userDataDir(), "attached-projects.json");
 }
 function cloneEmpty() {
   return {
@@ -1048,7 +1676,7 @@ function loadStore() {
   const file = storeFile();
   let raw;
   try {
-    raw = import_node_fs2.default.readFileSync(file, "utf8");
+    raw = import_node_fs3.default.readFileSync(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return cloneEmpty();
     throw err;
@@ -1065,7 +1693,7 @@ function loadStore() {
   } catch (err) {
     const quarantine = `${file}.corrupt-${Date.now()}`;
     try {
-      import_node_fs2.default.renameSync(file, quarantine);
+      import_node_fs3.default.renameSync(file, quarantine);
       console.warn(
         `[sootsim] attached-projects.json was unparseable; quarantined to ${quarantine}. original error: ${err.message}`
       );
@@ -1076,16 +1704,16 @@ function loadStore() {
 }
 function writeStore(store) {
   const file = storeFile();
-  import_node_fs2.default.mkdirSync(import_node_path2.default.dirname(file), { recursive: true });
+  import_node_fs3.default.mkdirSync(import_node_path3.default.dirname(file), { recursive: true });
   const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
-  const fd = import_node_fs2.default.openSync(tmp, "w", 384);
+  const fd = import_node_fs3.default.openSync(tmp, "w", 384);
   try {
-    import_node_fs2.default.writeFileSync(fd, JSON.stringify(store, null, 2));
-    import_node_fs2.default.fsyncSync(fd);
+    import_node_fs3.default.writeFileSync(fd, JSON.stringify(store, null, 2));
+    import_node_fs3.default.fsyncSync(fd);
   } finally {
-    import_node_fs2.default.closeSync(fd);
+    import_node_fs3.default.closeSync(fd);
   }
-  import_node_fs2.default.renameSync(tmp, file);
+  import_node_fs3.default.renameSync(tmp, file);
 }
 function mutateStore(fn) {
   const store = loadStore();
@@ -1094,13 +1722,13 @@ function mutateStore(fn) {
   return store;
 }
 function projectIdForCwd(cwd) {
-  return (0, import_node_crypto.createHash)("sha256").update(import_node_path2.default.resolve(cwd)).digest("hex").slice(0, 16);
+  return (0, import_node_crypto.createHash)("sha256").update(import_node_path3.default.resolve(cwd)).digest("hex").slice(0, 16);
 }
 function newSessionId() {
   return `s_${(0, import_node_crypto.randomBytes)(10).toString("hex")}`;
 }
 function upsertProject(input) {
-  const cwd = import_node_path2.default.resolve(input.cwd);
+  const cwd = import_node_path3.default.resolve(input.cwd);
   const id = projectIdForCwd(cwd);
   let result;
   mutateStore((store) => {
@@ -1126,7 +1754,7 @@ function upsertProject(input) {
     const now = Date.now();
     const created = {
       id,
-      name: input.name ?? import_node_path2.default.basename(cwd),
+      name: input.name ?? import_node_path3.default.basename(cwd),
       cwd,
       repoRoot: input.repoRoot,
       sourceRoots: input.sourceRoots ?? [cwd],
@@ -1266,8 +1894,8 @@ async function seedFromDemoAppRegistry() {
   const apps = APPS2;
   mutateStore((store) => {
     for (const app of apps) {
-      if (!import_node_fs2.default.existsSync(app.dir)) continue;
-      const cwd = import_node_path2.default.resolve(app.dir);
+      if (!import_node_fs3.default.existsSync(app.dir)) continue;
+      const cwd = import_node_path3.default.resolve(app.dir);
       const id = projectIdForCwd(cwd);
       if (store.attachedProjects.some((p) => p.id === id)) continue;
       const now = Date.now();
@@ -1291,16 +1919,16 @@ async function seedFromDemoAppRegistry() {
 
 // src/agent-sessions.ts
 function sessionDir(sessionId) {
-  return import_node_path3.default.join(getUserDataDir(), "sessions", sessionId);
+  return import_node_path4.default.join(getUserDataDir(), "sessions", sessionId);
 }
 function promptFifoPath(sessionId) {
-  return import_node_path3.default.join(sessionDir(sessionId), "prompt.in");
+  return import_node_path4.default.join(sessionDir(sessionId), "prompt.in");
 }
 function eventsFifoPath(sessionId) {
-  return import_node_path3.default.join(sessionDir(sessionId), "events.out");
+  return import_node_path4.default.join(sessionDir(sessionId), "events.out");
 }
 function transcriptPath(sessionId) {
-  return import_node_path3.default.join(getUserDataDir(), "transcripts", `${sessionId}.log`);
+  return import_node_path4.default.join(getUserDataDir(), "transcripts", `${sessionId}.log`);
 }
 function pidIsAlive(pid, sessionId) {
   if (!pid) return false;
@@ -1310,7 +1938,7 @@ function pidIsAlive(pid, sessionId) {
     return false;
   }
   if (sessionId) {
-    if (!import_node_fs3.default.existsSync(sessionDir(sessionId))) return false;
+    if (!import_node_fs4.default.existsSync(sessionDir(sessionId))) return false;
   }
   return true;
 }
@@ -1322,11 +1950,11 @@ function resolveSootsimInvocation() {
     const resourcesPath = process.resourcesPath;
     if (resourcesPath) {
       const candidates = [
-        import_node_path3.default.join(resourcesPath, "bin", "sootsim"),
-        import_node_path3.default.join(resourcesPath, "bin", `sootsim-${process.platform}-${process.arch}`)
+        import_node_path4.default.join(resourcesPath, "bin", "sootsim"),
+        import_node_path4.default.join(resourcesPath, "bin", `sootsim-${process.platform}-${process.arch}`)
       ];
       for (const c of candidates) {
-        if (import_node_fs3.default.existsSync(c)) return { cmd: c, prefixArgs: [] };
+        if (import_node_fs4.default.existsSync(c)) return { cmd: c, prefixArgs: [] };
       }
     }
   }
@@ -1349,15 +1977,15 @@ function tryWorkspaceSootsim() {
     const sootsimDir = resolveSootsimPackageDir();
     if (!sootsimDir) return null;
     const binaryName = `sootsim-${process.platform}-${process.arch}`;
-    const distBinary = import_node_path3.default.join(sootsimDir, "dist-bin", binaryName);
-    if (import_node_fs3.default.existsSync(distBinary)) return { cmd: distBinary, prefixArgs: [] };
-    const distBin = import_node_path3.default.join(sootsimDir, "dist-cli", "bin.js");
-    if (import_node_fs3.default.existsSync(distBin)) {
+    const distBinary = import_node_path4.default.join(sootsimDir, "dist-bin", binaryName);
+    if (import_node_fs4.default.existsSync(distBinary)) return { cmd: distBinary, prefixArgs: [] };
+    const distBin = import_node_path4.default.join(sootsimDir, "dist-cli", "bin.js");
+    if (import_node_fs4.default.existsSync(distBin)) {
       try {
-        const src = import_node_path3.default.join(sootsimDir, "cli", "commands", "agent-wrapper.ts");
-        if (import_node_fs3.default.existsSync(src)) {
-          const srcMtime = import_node_fs3.default.statSync(src).mtimeMs;
-          const buildMtime = import_node_fs3.default.statSync(distBin).mtimeMs;
+        const src = import_node_path4.default.join(sootsimDir, "cli", "commands", "agent-wrapper.ts");
+        if (import_node_fs4.default.existsSync(src)) {
+          const srcMtime = import_node_fs4.default.statSync(src).mtimeMs;
+          const buildMtime = import_node_fs4.default.statSync(distBin).mtimeMs;
           if (buildMtime < srcMtime) {
             console.warn(
               `[sootsim] dist-cli/bin.js is older than agent-wrapper.ts \u2014 rebuild with \`bun run --cwd packages/sootsim build:cli\` (watch:cli:binary builds dist-bin/ instead).`
@@ -1376,22 +2004,22 @@ function tryWorkspaceSootsim() {
 function resolveSootsimPackageDir() {
   try {
     const resolved = require.resolve("sootsim/package.json");
-    return import_node_path3.default.dirname(resolved);
+    return import_node_path4.default.dirname(resolved);
   } catch {
   }
   const here = fileFromImportMeta();
   if (!here) return null;
-  let cur = import_node_path3.default.dirname(here);
+  let cur = import_node_path4.default.dirname(here);
   for (let i = 0; i < 8; i++) {
-    const pkg = import_node_path3.default.join(cur, "package.json");
+    const pkg = import_node_path4.default.join(cur, "package.json");
     try {
-      if (import_node_fs3.default.existsSync(pkg)) {
-        const parsed = JSON.parse(import_node_fs3.default.readFileSync(pkg, "utf8"));
+      if (import_node_fs4.default.existsSync(pkg)) {
+        const parsed = JSON.parse(import_node_fs4.default.readFileSync(pkg, "utf8"));
         if (parsed.name === "sootsim") return cur;
       }
     } catch {
     }
-    const parent = import_node_path3.default.dirname(cur);
+    const parent = import_node_path4.default.dirname(cur);
     if (parent === cur) break;
     cur = parent;
   }
@@ -1407,28 +2035,28 @@ function fileFromImportMeta() {
   }
 }
 async function withStartLock(projectId, provider, fn) {
-  const lockDir = import_node_path3.default.join(getUserDataDir(), "locks");
-  import_node_fs3.default.mkdirSync(lockDir, { recursive: true });
+  const lockDir = import_node_path4.default.join(getUserDataDir(), "locks");
+  import_node_fs4.default.mkdirSync(lockDir, { recursive: true });
   try {
-    import_node_fs3.default.chmodSync(lockDir, 448);
+    import_node_fs4.default.chmodSync(lockDir, 448);
   } catch {
   }
-  const lockPath = import_node_path3.default.join(lockDir, `start-${projectId}-${provider}.lock`);
+  const lockPath = import_node_path4.default.join(lockDir, `start-${projectId}-${provider}.lock`);
   const deadline = Date.now() + 4e3;
   let fd = null;
   while (fd === null) {
     try {
-      fd = import_node_fs3.default.openSync(
+      fd = import_node_fs4.default.openSync(
         lockPath,
-        import_node_fs3.constants.O_WRONLY | import_node_fs3.constants.O_CREAT | import_node_fs3.constants.O_EXCL,
+        import_node_fs4.constants.O_WRONLY | import_node_fs4.constants.O_CREAT | import_node_fs4.constants.O_EXCL,
         384
       );
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
       try {
-        const stale = Number(import_node_fs3.default.readFileSync(lockPath, "utf8").trim());
+        const stale = Number(import_node_fs4.default.readFileSync(lockPath, "utf8").trim());
         if (stale && !isProcessAlive(stale)) {
-          import_node_fs3.default.unlinkSync(lockPath);
+          import_node_fs4.default.unlinkSync(lockPath);
           continue;
         }
       } catch {
@@ -1442,15 +2070,15 @@ async function withStartLock(projectId, provider, fn) {
     }
   }
   try {
-    import_node_fs3.default.writeFileSync(fd, String(process.pid));
+    import_node_fs4.default.writeFileSync(fd, String(process.pid));
     return await fn();
   } finally {
     try {
-      import_node_fs3.default.closeSync(fd);
+      import_node_fs4.default.closeSync(fd);
     } catch {
     }
     try {
-      import_node_fs3.default.unlinkSync(lockPath);
+      import_node_fs4.default.unlinkSync(lockPath);
     } catch {
     }
   }
@@ -1464,25 +2092,25 @@ function isProcessAlive(pid) {
   }
 }
 function mkfifoSync(p) {
-  const parent = import_node_path3.default.dirname(p);
-  import_node_fs3.default.mkdirSync(parent, { recursive: true });
+  const parent = import_node_path4.default.dirname(p);
+  import_node_fs4.default.mkdirSync(parent, { recursive: true });
   try {
-    import_node_fs3.default.chmodSync(parent, 448);
+    import_node_fs4.default.chmodSync(parent, 448);
   } catch {
   }
-  if (import_node_fs3.default.existsSync(p)) {
+  if (import_node_fs4.default.existsSync(p)) {
     try {
-      const stat = import_node_fs3.default.statSync(p);
+      const stat = import_node_fs4.default.statSync(p);
       if (stat.isFIFO()) {
         try {
-          import_node_fs3.default.chmodSync(p, 384);
+          import_node_fs4.default.chmodSync(p, 384);
         } catch {
         }
         return;
       }
-      import_node_fs3.default.unlinkSync(p);
+      import_node_fs4.default.unlinkSync(p);
     } catch {
-      import_node_fs3.default.unlinkSync(p);
+      import_node_fs4.default.unlinkSync(p);
     }
   }
   const result = (0, import_node_child_process.spawnSync)("mkfifo", ["-m", "600", p]);
@@ -1529,10 +2157,10 @@ async function startSession(opts) {
     const transcript = transcriptPath(session.id);
     mkfifoSync(promptIn);
     mkfifoSync(eventsOut);
-    const transcriptDir = import_node_path3.default.dirname(transcript);
-    import_node_fs3.default.mkdirSync(transcriptDir, { recursive: true });
+    const transcriptDir = import_node_path4.default.dirname(transcript);
+    import_node_fs4.default.mkdirSync(transcriptDir, { recursive: true });
     try {
-      import_node_fs3.default.chmodSync(transcriptDir, 448);
+      import_node_fs4.default.chmodSync(transcriptDir, 448);
     } catch {
     }
     const { cmd, prefixArgs } = resolveSootsimInvocation();
@@ -1556,6 +2184,7 @@ async function startSession(opts) {
     ];
     if (opts.codexBin) wrapperArgs.push("--codex-bin", opts.codexBin);
     if (opts.claudeBin) wrapperArgs.push("--claude-bin", opts.claudeBin);
+    if (opts.freshThread) wrapperArgs.push("--fresh-thread");
     if (claudeSessionUuid) {
       wrapperArgs.push("--claude-session-uuid", claudeSessionUuid);
     }
@@ -1582,7 +2211,7 @@ async function startSession(opts) {
         }
       }
       try {
-        import_node_fs3.default.rmSync(sessionDir(session.id), { recursive: true, force: true });
+        import_node_fs4.default.rmSync(sessionDir(session.id), { recursive: true, force: true });
       } catch {
       }
       updateSessionStatus(session.id, { status: "ended" });
@@ -1610,18 +2239,18 @@ async function sendPrompt(sessionId, prompt) {
     );
   }
   const fifo = promptFifoPath(sessionId);
-  if (!import_node_fs3.default.existsSync(fifo)) {
+  if (!import_node_fs4.default.existsSync(fifo)) {
     throw new AgentSessionError("NO_FIFO", `prompt FIFO missing: ${fifo}`);
   }
-  const fd = import_node_fs3.default.openSync(fifo, import_node_fs3.constants.O_WRONLY);
+  const fd = import_node_fs4.default.openSync(fifo, import_node_fs4.constants.O_WRONLY);
   try {
     const wireText = encodeAgentPromptEnvelope(prompt);
     if (!wireText) {
       throw new AgentSessionError("EMPTY_PROMPT", "prompt text is empty");
     }
-    import_node_fs3.default.writeSync(fd, wireText + "\n");
+    import_node_fs4.default.writeSync(fd, wireText + "\n");
   } finally {
-    import_node_fs3.default.closeSync(fd);
+    import_node_fs4.default.closeSync(fd);
   }
   updateSessionStatus(sessionId, {
     lastPrompt: prompt.displayText ?? prompt.text,
@@ -1643,7 +2272,7 @@ async function endSession(sessionId) {
   const base = getUserDataDir();
   if (dir.startsWith(base)) {
     try {
-      import_node_fs3.default.rmSync(dir, { recursive: true, force: true });
+      import_node_fs4.default.rmSync(dir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -1651,11 +2280,11 @@ async function endSession(sessionId) {
 }
 function subscribeEvents(sessionId, onEvent) {
   const fifo = eventsFifoPath(sessionId);
-  if (!import_node_fs3.default.existsSync(fifo)) {
+  if (!import_node_fs4.default.existsSync(fifo)) {
     throw new AgentSessionError("NO_FIFO", `events FIFO missing: ${fifo}`);
   }
-  const fd = import_node_fs3.default.openSync(fifo, import_node_fs3.constants.O_RDWR);
-  const stream = import_node_fs3.default.createReadStream("", { fd, autoClose: true });
+  const fd = import_node_fs4.default.openSync(fifo, import_node_fs4.constants.O_RDWR);
+  const stream = import_node_fs4.default.createReadStream("", { fd, autoClose: true });
   const rl = import_node_readline.default.createInterface({ input: stream, crlfDelay: Infinity });
   rl.on("line", (line) => {
     const event = parseAgentEventLine(line);
@@ -1676,7 +2305,7 @@ function subscribeEvents(sessionId, onEvent) {
   };
 }
 async function waitForFirstEvent(fifo, predicate, timeoutMs) {
-  const fd = import_node_fs3.default.openSync(fifo, import_node_fs3.constants.O_RDWR | import_node_fs3.constants.O_NONBLOCK);
+  const fd = import_node_fs4.default.openSync(fifo, import_node_fs4.constants.O_RDWR | import_node_fs4.constants.O_NONBLOCK);
   const buf = Buffer.alloc(8192);
   let leftover = "";
   const deadline = Date.now() + timeoutMs;
@@ -1684,7 +2313,7 @@ async function waitForFirstEvent(fifo, predicate, timeoutMs) {
     while (Date.now() < deadline) {
       let n = 0;
       try {
-        n = import_node_fs3.default.readSync(fd, buf, 0, buf.length, null);
+        n = import_node_fs4.default.readSync(fd, buf, 0, buf.length, null);
       } catch (err) {
         if (err.code !== "EAGAIN") throw err;
         n = 0;
@@ -1704,7 +2333,7 @@ async function waitForFirstEvent(fifo, predicate, timeoutMs) {
     }
     return null;
   } finally {
-    import_node_fs3.default.closeSync(fd);
+    import_node_fs4.default.closeSync(fd);
   }
 }
 
@@ -1875,7 +2504,7 @@ var AgentHost = class {
     );
     const project = upsertProject({
       cwd: match.cwd,
-      name: match.projectName ?? import_node_path4.default.basename(match.cwd),
+      name: match.projectName ?? import_node_path5.default.basename(match.cwd),
       preferredProvider: input.provider ?? existing?.preferredProvider,
       sourceRoots: existing?.sourceRoots ?? [match.cwd],
       knownBundleUrls,
@@ -1886,18 +2515,18 @@ var AgentHost = class {
   }
   getTranscript(sessionId) {
     const p = transcriptPath(sessionId);
-    if (!import_node_fs4.default.existsSync(p)) {
+    if (!import_node_fs5.default.existsSync(p)) {
       return { error: "transcript not found", code: "NO_TRANSCRIPT" };
     }
-    return import_node_fs4.default.readFileSync(p, "utf8");
+    return import_node_fs5.default.readFileSync(p, "utf8");
   }
   getPaths() {
     const dir = getUserDataDir();
     return {
       userDataDir: dir,
-      storeFile: import_node_path4.default.join(dir, "attached-projects.json"),
-      sessionsDir: import_node_path4.default.join(dir, "sessions"),
-      transcriptsDir: import_node_path4.default.join(dir, "transcripts")
+      storeFile: import_node_path5.default.join(dir, "attached-projects.json"),
+      sessionsDir: import_node_path5.default.join(dir, "sessions"),
+      transcriptsDir: import_node_path5.default.join(dir, "transcripts")
     };
   }
   // --- subscription management ---
@@ -2157,6 +2786,356 @@ function mapFrameworkToProjectFramework(fw) {
   return "unknown";
 }
 
+// src/host/fetch-proxy-handler.ts
+var import_http2 = __toESM(require("http"), 1);
+var import_https = __toESM(require("https"), 1);
+var FETCH_PROXY_USER_AGENT = "sootsim";
+var STRIP_FETCH_PROXY_HEADERS = /* @__PURE__ */ new Set([
+  "host",
+  "origin",
+  "referer",
+  "user-agent",
+  "cookie",
+  "connection",
+  "keep-alive",
+  "transfer-encoding",
+  "upgrade",
+  "content-length",
+  "sec-fetch-site",
+  "sec-fetch-mode",
+  "sec-fetch-dest",
+  "sec-ch-ua",
+  "sec-ch-ua-mobile",
+  "sec-ch-ua-platform"
+]);
+var FETCH_PROXY_CORS_HEADERS = {
+  "access-control-allow-origin": "*",
+  "access-control-allow-methods": "GET,POST,PUT,DELETE,PATCH,OPTIONS",
+  "access-control-allow-headers": "*",
+  "access-control-expose-headers": "*",
+  "access-control-max-age": "3600"
+};
+function applyFetchProxyCors(res) {
+  for (const [key, value] of Object.entries(FETCH_PROXY_CORS_HEADERS)) {
+    res.setHeader(key, value);
+  }
+}
+function formatFetchProxyError(targetUrl, err) {
+  const details = [];
+  const error = err;
+  if (error?.code) details.push(error.code);
+  if (error?.message) details.push(error.message);
+  if (error?.cause?.code) details.push(error.cause.code);
+  if (error?.cause?.message) details.push(error.cause.message);
+  const uniqueDetails = [...new Set(details.filter(Boolean))];
+  const message = uniqueDetails.join(" | ") || String(err);
+  if (targetUrl.includes("stored-in-.env.local")) {
+    return `${message} | upstream url still contains placeholder env values`;
+  }
+  return message;
+}
+function buildFetchProxyHeaders(reqHeaders) {
+  const headers = {};
+  for (const [key, value] of Object.entries(reqHeaders)) {
+    if (!value) continue;
+    if (STRIP_FETCH_PROXY_HEADERS.has(key.toLowerCase())) continue;
+    headers[key] = Array.isArray(value) ? value.join(", ") : value;
+  }
+  headers["user-agent"] = FETCH_PROXY_USER_AGENT;
+  return headers;
+}
+function isFetchProxyRequestUrl(rawUrl) {
+  return rawUrl?.startsWith("/__fetch-proxy?") || rawUrl?.startsWith("/__proxy?") || false;
+}
+function isAppApiRequestUrl(rawUrl) {
+  if (!rawUrl) return false;
+  if (rawUrl.startsWith("/__app-api?")) return true;
+  if (rawUrl.startsWith("/__app-api/")) return true;
+  return false;
+}
+async function handleFetchProxyRequest(req, res) {
+  if (req.method === "OPTIONS") {
+    applyFetchProxyCors(res);
+    res.writeHead(204);
+    res.end();
+    return;
+  }
+  const params = new URLSearchParams((req.url || "").split("?")[1] || "");
+  const targetUrl = params.get("url");
+  if (!targetUrl) {
+    applyFetchProxyCors(res);
+    res.writeHead(400, { "Content-Type": "text/plain" });
+    res.end("missing url param");
+    return;
+  }
+  let upstreamUrl;
+  try {
+    upstreamUrl = new URL(targetUrl);
+  } catch {
+    applyFetchProxyCors(res);
+    res.writeHead(400, { "Content-Type": "text/plain" });
+    res.end("invalid url param");
+    return;
+  }
+  const headers = buildFetchProxyHeaders(req.headers);
+  let body;
+  if (req.method !== "GET" && req.method !== "HEAD") {
+    const chunks = [];
+    for await (const chunk of req) {
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    if (chunks.length > 0) body = Buffer.concat(chunks);
+  }
+  let upstream;
+  try {
+    upstream = await fetch(upstreamUrl.href, {
+      method: req.method,
+      headers,
+      body,
+      redirect: "follow"
+    });
+  } catch (err) {
+    applyFetchProxyCors(res);
+    res.writeHead(502, { "Content-Type": "text/plain" });
+    res.end(`fetch proxy error: ${formatFetchProxyError(upstreamUrl.href, err)}`);
+    return;
+  }
+  upstream.headers.forEach((value, key) => {
+    const lowerKey = key.toLowerCase();
+    if (lowerKey === "content-encoding" || lowerKey === "transfer-encoding" || lowerKey === "content-length" || lowerKey === "set-cookie" || lowerKey.startsWith("access-control-")) {
+      return;
+    }
+    res.setHeader(key, value);
+  });
+  applyFetchProxyCors(res);
+  const setCookie = upstream.headers.getSetCookie?.() ?? [];
+  if (setCookie.length > 0) {
+    res.setHeader("x-sootsim-set-cookie", setCookie.join(", "));
+  }
+  res.statusCode = upstream.status;
+  const buf = Buffer.from(await upstream.arrayBuffer());
+  res.end(buf);
+}
+function handleAppApiRequest(req, res) {
+  const reqUrl = req.url || "";
+  let targetPath = "";
+  let targetOrigin = "";
+  if (reqUrl.startsWith("/__app-api?")) {
+    const parsed = new URL(reqUrl, "http://sootsim.local");
+    targetPath = parsed.searchParams.get("path") || "";
+    targetOrigin = parsed.searchParams.get("origin")?.trim() || "";
+  } else if (reqUrl.startsWith("/__app-api/")) {
+    targetPath = reqUrl.slice("/__app-api".length);
+  } else {
+    return false;
+  }
+  if (!targetOrigin) {
+    res.writeHead(400, { "Content-Type": "text/plain" });
+    res.end("app-api: missing origin query param");
+    return true;
+  }
+  if (req.method === "OPTIONS") {
+    res.writeHead(204, {
+      "Access-Control-Allow-Origin": req.headers.origin || "*",
+      "Access-Control-Allow-Methods": "GET,POST,PUT,PATCH,DELETE,OPTIONS",
+      "Access-Control-Allow-Headers": req.headers["access-control-request-headers"] || "*",
+      "Access-Control-Allow-Credentials": "true",
+      "Access-Control-Max-Age": "86400"
+    });
+    res.end();
+    return true;
+  }
+  let targetUrl;
+  try {
+    targetUrl = new URL(targetPath, targetOrigin);
+  } catch {
+    res.writeHead(400, { "Content-Type": "text/plain" });
+    res.end("app-api: invalid origin or path");
+    return true;
+  }
+  const transport = targetUrl.protocol === "https:" ? import_https.default : import_http2.default;
+  const fwdHeaders = { ...req.headers };
+  delete fwdHeaders.host;
+  fwdHeaders.host = targetUrl.host;
+  const proxyReq = transport.request(
+    {
+      hostname: targetUrl.hostname,
+      port: targetUrl.port || (targetUrl.protocol === "https:" ? 443 : 80),
+      path: targetUrl.pathname + targetUrl.search,
+      method: req.method,
+      headers: fwdHeaders
+    },
+    (proxyRes) => {
+      const exposedHeaders = Object.keys(proxyRes.headers).filter((name) => {
+        const lower = name.toLowerCase();
+        return !lower.startsWith("access-control-") && lower !== "set-cookie";
+      }).join(", ");
+      res.writeHead(proxyRes.statusCode ?? 502, {
+        ...proxyRes.headers,
+        "access-control-allow-origin": req.headers.origin || "*",
+        "access-control-allow-credentials": "true",
+        "access-control-expose-headers": exposedHeaders
+      });
+      proxyRes.pipe(res);
+    }
+  );
+  proxyReq.on("error", (err) => {
+    res.statusCode = 502;
+    res.end(`app proxy error: ${err.message}`);
+  });
+  req.pipe(proxyReq);
+  return true;
+}
+
+// src/host/open-url.ts
+var import_child_process3 = require("child_process");
+var import_fs2 = require("fs");
+var import_os = require("os");
+var import_path2 = require("path");
+var MAC_CHROMIUM_CANDIDATES = [
+  "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+  "~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+  "/Applications/Chromium.app/Contents/MacOS/Chromium",
+  "~/Applications/Chromium.app/Contents/MacOS/Chromium",
+  "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge",
+  "~/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge",
+  "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser",
+  "~/Applications/Brave Browser.app/Contents/MacOS/Brave Browser",
+  "/Applications/Arc.app/Contents/MacOS/Arc",
+  "~/Applications/Arc.app/Contents/MacOS/Arc"
+];
+var LINUX_CHROMIUM_CANDIDATES = [
+  "/usr/bin/google-chrome",
+  "/usr/bin/chromium",
+  "/usr/bin/chromium-browser",
+  "/usr/bin/microsoft-edge",
+  "/usr/bin/brave-browser",
+  "/snap/bin/chromium"
+];
+var WINDOWS_CHROMIUM_CANDIDATES = [
+  "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
+  "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
+  "C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe",
+  "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
+  "C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\brave.exe",
+  "C:\\Program Files (x86)\\BraveSoftware\\Brave-Browser\\Application\\brave.exe"
+];
+var UNIX_CHROMIUM_COMMANDS = [
+  "google-chrome",
+  "chromium",
+  "chromium-browser",
+  "microsoft-edge",
+  "brave-browser"
+];
+var WINDOWS_CHROMIUM_COMMANDS = ["chrome", "msedge", "brave"];
+function expandHome(candidate) {
+  return candidate.startsWith("~/") ? (0, import_path2.join)((0, import_os.homedir)(), candidate.slice(2)) : candidate;
+}
+function firstExisting(candidates) {
+  for (const candidate of candidates) {
+    const expanded = expandHome(candidate);
+    if ((0, import_fs2.existsSync)(expanded)) return expanded;
+  }
+  return null;
+}
+function lookupExecutable(command, platform) {
+  try {
+    const tool = platform === "win32" ? "where" : "which";
+    const out = (0, import_child_process3.execFileSync)(tool, [command], {
+      encoding: "utf8",
+      timeout: 1500,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    return out ? out.split(/\r?\n/)[0] : null;
+  } catch {
+    return null;
+  }
+}
+function resolveChromiumBinary(platform = process.platform) {
+  const envCandidate = process.env.CHROME_PATH || process.env.CHROMIUM_PATH;
+  if (envCandidate && (0, import_fs2.existsSync)(envCandidate)) return envCandidate;
+  const direct = platform === "darwin" ? firstExisting(MAC_CHROMIUM_CANDIDATES) : platform === "win32" ? firstExisting(WINDOWS_CHROMIUM_CANDIDATES) : firstExisting(LINUX_CHROMIUM_CANDIDATES);
+  if (direct) return direct;
+  const commands = platform === "win32" ? WINDOWS_CHROMIUM_COMMANDS : UNIX_CHROMIUM_COMMANDS;
+  for (const command of commands) {
+    const found = lookupExecutable(command, platform);
+    if (found) return found;
+  }
+  return null;
+}
+function buildOpenUrlCommand(url, options = {}) {
+  if (!url) throw new Error("openUrl requires a url");
+  const platform = options.platform ?? process.platform;
+  if (options.newWindow) {
+    return buildChromiumUrlCommand(url, { ...options, platform, newWindow: true });
+  }
+  if (platform === "darwin") {
+    return {
+      command: "open",
+      args: options.background === false ? [url] : ["-g", url],
+      via: "system"
+    };
+  }
+  if (platform === "win32") {
+    return {
+      command: "cmd",
+      args: ["/c", "start", "", url],
+      via: "system"
+    };
+  }
+  return {
+    command: "xdg-open",
+    args: [url],
+    via: "system"
+  };
+}
+function buildChromiumUrlCommand(url, options = {}) {
+  if (!url) throw new Error("openUrl requires a url");
+  const platform = options.platform ?? process.platform;
+  const chromiumBinary = "chromiumBinary" in options ? options.chromiumBinary : resolveChromiumBinary(platform);
+  if (!chromiumBinary) {
+    throw new Error("browser launch requires Chrome, Chromium, Edge, Brave, or Arc");
+  }
+  const args = [];
+  if (options.headless) {
+    args.push("--headless=new");
+  } else if (options.newWindow !== false) {
+    args.push("--new-window");
+  }
+  args.push(url);
+  return {
+    command: chromiumBinary,
+    args,
+    via: "chromium",
+    target: chromiumBinary
+  };
+}
+async function spawnLaunch(command, args, detached) {
+  return new Promise((resolve2, reject) => {
+    const child = (0, import_child_process3.spawn)(command, args, {
+      detached,
+      stdio: "ignore"
+    });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      if (detached) child.unref();
+      resolve2(child.pid);
+    });
+  });
+}
+async function launchUrl(url, options = {}) {
+  const command = buildOpenUrlCommand(url, options);
+  const pid = await spawnLaunch(command.command, command.args, options.detached ?? true);
+  return {
+    ...command,
+    pid,
+    attachUrl: url
+  };
+}
+async function openUrl(url, options = {}) {
+  await launchUrl(url, options);
+}
+
 // src/host/bridge-host.ts
 var WRITE_COMMAND_TYPES = /* @__PURE__ */ new Set(["tap", "keyboard", "close"]);
 function shouldAcquireLease(msg) {
@@ -2166,6 +3145,8 @@ function shouldAcquireLease(msg) {
   return WRITE_COMMAND_TYPES.has(msg.type);
 }
 var DAEMON_HEARTBEAT_INTERVAL_MS = 5e3;
+var DEFAULT_RUNTIME_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
+var RUNTIME_UPDATE_INTERVAL_ENV = "SOOTSIM_RUNTIME_UPDATE_INTERVAL_MS";
 var HTTP_MIME_TYPES = {
   ".html": "text/html; charset=utf-8",
   ".js": "application/javascript",
@@ -2189,43 +3170,80 @@ var HTTP_MIME_TYPES = {
   ".map": "application/json",
   ".txt": "text/plain; charset=utf-8"
 };
+function injectSharedConfigIntoHtml(data) {
+  let payload;
+  try {
+    const cfg = readSharedConfig();
+    payload = JSON.stringify(cfg);
+  } catch {
+    payload = "{}";
+  }
+  const tag = `<script>window.__sootsimSharedConfig=${payload};</script>`;
+  const html = data.toString("utf8");
+  if (html.includes("</head>")) return html.replace("</head>", tag + "</head>");
+  if (html.includes("</body>")) return html.replace("</body>", tag + "</body>");
+  return tag + html;
+}
 var SootSimBridgeHost = class _SootSimBridgeHost {
   port;
   openUrlHandler;
   httpServer = null;
   wss = null;
   nextCommandId = 1;
-  nextBrowserId = 1;
-  browsers = /* @__PURE__ */ new Map();
-  primaryBrowserId = null;
+  nextSimNumber = 161;
+  sims = /* @__PURE__ */ new Map();
+  primarySimId = null;
   pendingCommands = /* @__PURE__ */ new Map();
   cliBySentId = /* @__PURE__ */ new Map();
-  cliBrowserBySocket = /* @__PURE__ */ new Map();
+  cliSimBySocket = /* @__PURE__ */ new Map();
   cliLastCommandAt = /* @__PURE__ */ new Map();
-  cliSessionKeyBySocket = /* @__PURE__ */ new Map();
+  cliIdentityKeyBySocket = /* @__PURE__ */ new Map();
   cliLabelBySocket = /* @__PURE__ */ new Map();
-  restorableBrowsers = /* @__PURE__ */ new Map();
+  restorableSims = /* @__PURE__ */ new Map();
   nextCliFallbackId = 1;
   cliIdleTimer = null;
   agentHost;
   static CLI_IDLE_TIMEOUT_MS = 6e4;
   static CLI_LEASE_TTL_MS = 6e5;
   static USER_ACTIVE_LEASE_TTL_MS = 8e3;
-  static BROWSER_RECONNECT_TTL_MS = 3e4;
+  // explicit user actions (clicking Boot, focusing the sim to take it over)
+  // hold the sim longer than passive canvas interaction so reconnecting clis
+  // can't immediately reclaim while the user gets oriented.
+  static USER_BOOT_LEASE_TTL_MS = 6e4;
+  static SIM_RECONNECT_TTL_MS = 3e4;
   preferredPort;
   portFallbackCount;
   shouldWriteLockfile;
   effectivePort = 0;
   startedAt = 0;
   heartbeatTimer = null;
+  // ws-level heartbeat: sims that hang up uncleanly (page navigated, network
+  // dropped, sim crashed) leave their server-side WebSocket sitting "open"
+  // forever. ping every WS_HEARTBEAT_INTERVAL_MS; if the previous round's
+  // ping was never answered, terminate(). that fires 'close' which runs the
+  // sim-cleanup path and stops `sootsim list` from showing 8 zombie
+  // sims that all time out on every command.
+  wsHeartbeatTimer = null;
+  wsIsAlive = /* @__PURE__ */ new WeakMap();
+  static WS_HEARTBEAT_INTERVAL_MS = 3e4;
+  runtimeUpdateTimer = null;
+  runtimeUpdateInFlight = null;
   activeRuntimeVersion = null;
   activeRuntimeDirPath = null;
+  // /__server-scan cache. mirrors the shell vite dev-middleware so engine
+  // ConnectRN / DemoConnectApp see the same JSON shape whether they boot
+  // from vite dev or from this daemon. without this, the SPA fallback below
+  // would serve index.html for /__server-scan and tenant-worker .json()
+  // crashes with "Unexpected token '<', "<!doctype "... is not valid JSON".
+  scanCache = null;
+  scanCacheAt = 0;
+  inflightScan = null;
+  static SCAN_FRESH_MS = 2e3;
   constructor(opts = {}) {
     this.preferredPort = opts.port || DEFAULT_SOOTSIM_BRIDGE_PORT;
     this.port = this.preferredPort;
     this.shouldWriteLockfile = opts.writeLockfile === true;
-    const defaultFallback = this.shouldWriteLockfile ? 1 : 10;
-    this.portFallbackCount = Math.max(1, opts.portFallbackCount ?? defaultFallback);
+    this.portFallbackCount = Math.max(1, opts.portFallbackCount ?? 10);
     this.openUrlHandler = opts.openUrl;
     this.agentHost = new AgentHost({ getExcludePorts: opts.agentScanExcludes });
   }
@@ -2278,7 +3296,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
   }
   bindOnce(port, _silent) {
     return new Promise((resolve2, reject) => {
-      const server = (0, import_http2.createServer)((req, res) => this.handleHttpRequest(req, res));
+      const server = (0, import_http3.createServer)((req, res) => this.handleHttpRequest(req, res));
       let settled = false;
       const onError = (err) => {
         if (settled) return;
@@ -2313,12 +3331,18 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
     if (!this.wss) return;
     this.wss.on("connection", (ws, req) => {
       const origin = req.headers.origin;
-      const role = origin ? "browser" : "cli";
-      let browser = null;
+      const role = origin ? "sim" : "cli";
+      let sim = null;
+      ws.on("error", () => {
+      });
+      this.wsIsAlive.set(ws, true);
+      ws.on("pong", () => {
+        this.wsIsAlive.set(ws, true);
+      });
       this.agentHost.registerSocket(ws);
-      if (role === "browser") {
-        browser = {
-          id: `tab-${this.nextBrowserId++}`,
+      if (role === "sim") {
+        sim = {
+          id: this.allocateSimId(),
           ws,
           origin,
           connectedAt: Date.now(),
@@ -2326,15 +3350,15 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
           lastActiveAt: 0,
           recentActions: []
         };
-        this.browsers.set(browser.id, browser);
-        if (this.shouldPromoteBrowser(browser)) {
-          this.primaryBrowserId = browser.id;
+        this.sims.set(sim.id, sim);
+        if (this.shouldPromoteSim(sim)) {
+          this.primarySimId = sim.id;
         }
-        this.broadcastBrowserAssignments();
-        this.broadcastBrowserClientStates();
+        this.broadcastSimAssignments();
+        this.broadcastSimClientStates();
       } else {
         const fallbackKey = `ws-${this.nextCliFallbackId++}`;
-        this.cliSessionKeyBySocket.set(ws, fallbackKey);
+        this.cliIdentityKeyBySocket.set(ws, fallbackKey);
       }
       ws.on("message", (data) => {
         let msg;
@@ -2409,29 +3433,55 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
           }
           return;
         }
-        if (role === "browser") {
-          if (browser) {
-            browser.lastSeenAt = Date.now();
+        if (role === "sim") {
+          if (sim) {
+            sim.lastSeenAt = Date.now();
           }
-          if (msg.type === "bridge:register" && browser) {
+          if (msg.type === "bridge:register" && sim) {
             const registration = msg;
-            const restored = this.tryRestoreBrowserId(browser, registration.browserId);
-            browser.url = registration.url;
-            browser.title = registration.title;
-            browser.userAgent = registration.userAgent;
+            const restored = this.tryRestoreSimId(sim, registration.simId);
+            sim.url = registration.url;
+            sim.title = registration.title;
+            sim.userAgent = registration.userAgent;
             if (restored) {
-              this.broadcastBrowserAssignments();
-              this.broadcastBrowserClientStates();
+              this.broadcastSimAssignments();
+              this.broadcastSimClientStates();
             }
             return;
           }
-          if (msg.type === "bridge:user-focus-state" && browser) {
+          if (msg.type === "bridge:user-focus-state" && sim) {
             const focusState = msg;
-            this.updateUserFocusLease(browser, focusState.focused === true);
+            this.updateUserFocusLease(sim, focusState.focused === true);
+            return;
+          }
+          if (msg.type === "bridge:user-interact" && sim) {
+            this.updateUserActivity(sim);
             return;
           }
-          if (msg.type === "bridge:user-interact" && browser) {
-            this.updateUserActivity(browser);
+          if (msg.type === "bridge:write-shared-config") {
+            const patch = msg.patch && typeof msg.patch === "object" ? msg.patch : null;
+            if (!patch) return;
+            let next;
+            try {
+              next = writeSharedConfig(patch);
+            } catch (err) {
+              process.stderr.write(
+                `sootsim: bridge:write-shared-config failed: ${err instanceof Error ? err.message : String(err)}
+`
+              );
+              return;
+            }
+            const payload = JSON.stringify({
+              type: "bridge:shared-config-changed",
+              config: next
+            });
+            for (const peer of this.sims.values()) {
+              if (peer.ws.readyState !== import_ws.WebSocket.OPEN) continue;
+              try {
+                peer.ws.send(payload);
+              } catch {
+              }
+            }
             return;
           }
           if (msg.type === "bridge:open-path") {
@@ -2443,30 +3493,33 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
             }
             return;
           }
-          if (msg.type === "bridge:boot-clients" && browser) {
+          if (msg.type === "bridge:boot-clients" && sim) {
             const booted = [];
-            for (const [cliWs, attachedBrowserId] of this.cliBrowserBySocket) {
-              if (attachedBrowserId === browser.id) {
+            for (const [cliWs, attachedSimId] of this.cliSimBySocket) {
+              if (attachedSimId === sim.id) {
                 booted.push(cliWs);
               }
             }
             for (const cliWs of booted) {
-              this.cliBrowserBySocket.delete(cliWs);
+              this.cliSimBySocket.delete(cliWs);
               try {
-                cliWs.close(1e3, "booted by browser");
+                cliWs.close(1e3, "booted by sim");
               } catch {
               }
             }
-            const hadLease = !!browser.cliLease;
-            browser.cliLease = void 0;
-            if (booted.length > 0 || hadLease) {
-              process.stderr.write(
-                `sootsim booted ${booted.length} cli client(s)${hadLease ? " + cleared lease" : ""} from [${browser.id}]
+            const hadLease = !!sim.cliLease;
+            sim.cliLease = {
+              kind: "user-active",
+              cliIdentityKey: "__user-active__",
+              cliLabel: "active user",
+              expiresAt: Date.now() + _SootSimBridgeHost.USER_BOOT_LEASE_TTL_MS
+            };
+            process.stderr.write(
+              `sootsim booted ${booted.length} cli client(s)${hadLease ? " (overrode prior lease)" : ""}; held sim for user [${sim.id}]
 `
-              );
-              this.recordBrowserAction(browser.id, "browser booted cli clients");
-              this.broadcastBrowserClientStates();
-            }
+            );
+            this.recordSimAction(sim.id, "sim booted cli clients");
+            this.broadcastSimClientStates();
             return;
           }
           const internalPending = this.pendingCommands.get(msg.id);
@@ -2480,10 +3533,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
           if (entry) {
             this.cliBySentId.delete(msg.id);
             if (entry.ws.readyState === import_ws.WebSocket.OPEN) {
-              const otherCliCount = this.getOtherCliSessionCount(
-                entry.ws,
-                entry.browserId
-              );
+              const otherCliCount = this.getOtherCliIdentityCount(entry.ws, entry.simId);
               const response = otherCliCount > 0 ? { ...msg, id: entry.originalId, _otherCliCount: otherCliCount } : { ...msg, id: entry.originalId };
               entry.ws.send(JSON.stringify(response));
             }
@@ -2494,19 +3544,19 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
           this.cliLastCommandAt.set(ws, Date.now());
           try {
             if (msg.type === "bridge:bye") {
-              const hadBrowser = this.cliBrowserBySocket.delete(ws);
+              const hadSim = this.cliSimBySocket.delete(ws);
               this.cliLastCommandAt.delete(ws);
-              this.cliSessionKeyBySocket.delete(ws);
+              this.cliIdentityKeyBySocket.delete(ws);
               this.cliLabelBySocket.delete(ws);
               for (const [sentId2, entry] of this.cliBySentId) {
                 if (entry.ws === ws) this.cliBySentId.delete(sentId2);
               }
-              if (hadBrowser) this.broadcastBrowserClientStates();
+              if (hadSim) this.broadcastSimClientStates();
               return;
             }
             if (msg.type === "bridge:hello") {
-              const key = typeof msg.cliSessionKey === "string" && msg.cliSessionKey.trim() ? msg.cliSessionKey.trim() : this.cliSessionKeyBySocket.get(ws) || `ws-${this.nextCliFallbackId++}`;
-              this.cliSessionKeyBySocket.set(ws, key);
+              const key = typeof msg.cliIdentityKey === "string" && msg.cliIdentityKey.trim() ? msg.cliIdentityKey.trim() : this.cliIdentityKeyBySocket.get(ws) || `ws-${this.nextCliFallbackId++}`;
+              this.cliIdentityKeyBySocket.set(ws, key);
               if (typeof msg.cliLabel === "string" && msg.cliLabel.trim()) {
                 this.cliLabelBySocket.set(ws, msg.cliLabel.trim());
               }
@@ -2515,7 +3565,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
                   JSON.stringify({
                     id: msg.id,
                     result: {
-                      cliSessionKey: key,
+                      cliIdentityKey: key,
                       leaseTtlMs: _SootSimBridgeHost.CLI_LEASE_TTL_MS,
                       leasing: true
                     }
@@ -2524,12 +3574,12 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
               }
               return;
             }
-            if (msg.type === "bridge:list-browsers") {
+            if (msg.type === "bridge:list-sims") {
               if (ws.readyState === import_ws.WebSocket.OPEN) {
                 ws.send(
                   JSON.stringify({
                     id: msg.id,
-                    result: this.listBrowsers()
+                    result: this.listSims()
                   })
                 );
               }
@@ -2539,7 +3589,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
               if (typeof msg.url !== "string" || !msg.url) {
                 throw new Error("bridge:open requires a url");
               }
-              await this.openUrl(msg.url);
+              await this.openUrl(msg.url, { newWindow: msg.newWindow === true });
               if (ws.readyState === import_ws.WebSocket.OPEN) {
                 ws.send(
                   JSON.stringify({
@@ -2551,8 +3601,8 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
               return;
             }
             if (msg.type === "bridge:claim") {
-              const targetBrowser2 = await this.waitForBrowser(msg.browserId);
-              const outcome = this.tryAcquireLease(ws, targetBrowser2, {
+              const targetSim2 = await this.waitForSim(msg.simId);
+              const outcome = this.tryAcquireLease(ws, targetSim2, {
                 force: msg.force === true
               });
               if (!outcome.granted) {
@@ -2560,25 +3610,25 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
                   ws.send(
                     JSON.stringify({
                       id: msg.id,
-                      error: `tab ${targetBrowser2.id} is locked by another cli`,
+                      error: `sim ${targetSim2.id} is locked by another cli`,
                       _locked: outcome.lock
                     })
                   );
                 }
                 return;
               }
-              this.setCliBrowserTarget(ws, targetBrowser2.id);
-              this.recordBrowserAction(
-                targetBrowser2.id,
-                outcome.bootedCount > 0 ? `cli force-claimed tab (booted ${outcome.bootedCount})` : "cli claimed tab"
+              this.setCliSimTarget(ws, targetSim2.id);
+              this.recordSimAction(
+                targetSim2.id,
+                outcome.bootedCount > 0 ? `cli force-claimed sim (booted ${outcome.bootedCount})` : "cli claimed sim"
               );
               if (ws.readyState === import_ws.WebSocket.OPEN) {
                 ws.send(
                   JSON.stringify({
                     id: msg.id,
                     result: {
-                      browserId: targetBrowser2.id,
-                      lockedBy: outcome.lease.cliSessionKey,
+                      simId: targetSim2.id,
+                      lockedBy: outcome.lease.cliIdentityKey,
                       lockExpiresAt: outcome.lease.expiresAt,
                       bootedCount: outcome.bootedCount
                     }
@@ -2587,15 +3637,15 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
               }
               return;
             }
-            const targetBrowser = await this.waitForBrowser(msg.browserId);
+            const targetSim = await this.waitForSim(msg.simId);
             if (shouldAcquireLease(msg)) {
-              const outcome = this.tryAcquireLease(ws, targetBrowser);
+              const outcome = this.tryAcquireLease(ws, targetSim);
               if (!outcome.granted) {
                 if (ws.readyState === import_ws.WebSocket.OPEN) {
                   ws.send(
                     JSON.stringify({
                       id: msg.id,
-                      error: `tab ${targetBrowser.id} is locked by another cli \u2014 use \`sootsim claim ${targetBrowser.id} --force\` or \`sootsim open --new\``,
+                      error: `sim ${targetSim.id} is locked by another cli \u2014 use \`sootsim claim ${targetSim.id} --force\` or \`sootsim open --new\``,
                       _locked: outcome.lock
                     })
                   );
@@ -2603,18 +3653,18 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
                 return;
               }
             } else {
-              this.ensureCliSessionKey(ws);
+              this.ensureCliIdentityKey(ws);
             }
-            this.setCliBrowserTarget(ws, targetBrowser.id);
-            this.recordBrowserAction(targetBrowser.id, this.describeForwardedCommand(msg));
+            this.setCliSimTarget(ws, targetSim.id);
+            this.recordSimAction(targetSim.id, this.describeForwardedCommand(msg));
             const sentId = this.nextCommandId++;
             this.cliBySentId.set(sentId, {
-              browserId: targetBrowser.id,
+              simId: targetSim.id,
               ws,
               originalId: msg.id
             });
-            const { browserId: _browserId, ...forwarded } = msg;
-            targetBrowser.ws.send(JSON.stringify({ ...forwarded, id: sentId }));
+            const { simId: _simId, ...forwarded } = msg;
+            targetSim.ws.send(JSON.stringify({ ...forwarded, id: sentId }));
           } catch (err) {
             if (ws.readyState === import_ws.WebSocket.OPEN) {
               ws.send(
@@ -2629,40 +3679,40 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       });
       ws.on("close", () => {
         this.agentHost.unregisterSocket(ws);
-        if (role === "browser" && browser) {
-          this.rememberDisconnectedBrowser(browser);
-          if (this.primaryBrowserId === browser.id) {
-            this.primaryBrowserId = this.getOpenBrowser()?.id ?? null;
+        if (role === "sim" && sim) {
+          this.rememberDisconnectedSim(sim);
+          if (this.primarySimId === sim.id) {
+            this.primarySimId = this.getOpenSim()?.id ?? null;
           }
           for (const [id, pending] of this.pendingCommands) {
-            if (pending.browserId !== browser.id) continue;
-            pending.reject(new Error("browser disconnected"));
+            if (pending.simId !== sim.id) continue;
+            pending.reject(new Error("sim disconnected"));
             this.pendingCommands.delete(id);
           }
           for (const [sentId, entry] of this.cliBySentId) {
-            if (entry.browserId !== browser.id) continue;
+            if (entry.simId !== sim.id) continue;
             if (entry.ws.readyState === import_ws.WebSocket.OPEN) {
               entry.ws.send(
                 JSON.stringify({
                   id: entry.originalId,
-                  error: "browser disconnected before responding"
+                  error: "sim disconnected before responding"
                 })
               );
             }
             this.cliBySentId.delete(sentId);
           }
-          this.broadcastBrowserAssignments();
-          this.broadcastBrowserClientStates();
+          this.broadcastSimAssignments();
+          this.broadcastSimClientStates();
         } else if (role === "cli") {
-          const detached = this.cliBrowserBySocket.delete(ws);
+          const detached = this.cliSimBySocket.delete(ws);
           this.cliLastCommandAt.delete(ws);
-          this.cliSessionKeyBySocket.delete(ws);
+          this.cliIdentityKeyBySocket.delete(ws);
           this.cliLabelBySocket.delete(ws);
           for (const [sentId, entry] of this.cliBySentId) {
             if (entry.ws === ws) this.cliBySentId.delete(sentId);
           }
           if (detached) {
-            this.broadcastBrowserClientStates();
+            this.broadcastSimClientStates();
           }
         }
       });
@@ -2680,6 +3730,11 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       3e4
     );
     this.cliIdleTimer.unref();
+    this.wsHeartbeatTimer = setInterval(
+      () => this.sweepDeadWebSockets(),
+      _SootSimBridgeHost.WS_HEARTBEAT_INTERVAL_MS
+    );
+    this.wsHeartbeatTimer.unref();
     if (this.shouldWriteLockfile) {
       try {
         ensureSootsimHome();
@@ -2703,9 +3758,11 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
         }
       }, DAEMON_HEARTBEAT_INTERVAL_MS);
       this.heartbeatTimer.unref();
+      this.startRuntimeUpdater();
     }
     void this.agentHost.seedOnBoot();
   }
+  bootstrapping = true;
   buildLockfileSnapshot() {
     return {
       schema: 1,
@@ -2716,7 +3773,8 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       activeRuntime: this.activeRuntimeVersion,
       activeRuntimeDir: this.activeRuntimeDirPath,
       startedAt: this.startedAt,
-      heartbeatAt: Date.now()
+      heartbeatAt: Date.now(),
+      bootstrapping: this.bootstrapping
     };
   }
   writeLockfileSnapshot() {
@@ -2726,9 +3784,104 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
     this.activeRuntimeVersion = readActiveRuntime();
     this.activeRuntimeDirPath = activeRuntimeDir();
   }
+  runServerScan() {
+    if (this.inflightScan) return this.inflightScan;
+    const excludePorts = this.effectivePort > 0 ? [this.effectivePort] : [];
+    this.inflightScan = scanDevServers({
+      excludePorts,
+      buildIconProxyUrl: (externalUrl) => `/__bundle-proxy?url=${encodeURIComponent(externalUrl)}`
+    }).then((results) => {
+      this.scanCache = results;
+      this.scanCacheAt = Date.now();
+      return results;
+    }).catch((err) => {
+      const message = err instanceof Error ? err.message : String(err);
+      console.error("[sootsim] /__server-scan failed:", message);
+      return this.scanCache ?? [];
+    }).finally(() => {
+      this.inflightScan = null;
+    });
+    return this.inflightScan;
+  }
+  handleServerScan(res) {
+    const sendJson = (body) => {
+      res.writeHead(200, {
+        "Content-Type": "application/json; charset=utf-8",
+        "Cache-Control": "no-store"
+      });
+      res.end(JSON.stringify(body));
+    };
+    const age = Date.now() - this.scanCacheAt;
+    if (this.scanCache && age < _SootSimBridgeHost.SCAN_FRESH_MS) {
+      sendJson(this.scanCache);
+      return;
+    }
+    if (this.scanCache) {
+      sendJson(this.scanCache);
+      void this.runServerScan().catch(() => {
+      });
+      return;
+    }
+    void this.runServerScan().then((results) => sendJson(results));
+  }
+  resolveRuntimeUpdateIntervalMs() {
+    const raw = Number(process.env[RUNTIME_UPDATE_INTERVAL_ENV]);
+    if (Number.isFinite(raw) && raw > 0) return Math.max(100, Math.round(raw));
+    return DEFAULT_RUNTIME_UPDATE_INTERVAL_MS;
+  }
+  startRuntimeUpdater() {
+    if (!this.shouldWriteLockfile || this.runtimeUpdateTimer) return;
+    void this.runRuntimeUpdate("startup");
+    const intervalMs = this.resolveRuntimeUpdateIntervalMs();
+    this.runtimeUpdateTimer = setInterval(() => {
+      void this.runRuntimeUpdate("periodic");
+    }, intervalMs);
+    this.runtimeUpdateTimer.unref();
+  }
+  runRuntimeUpdate(reason) {
+    if (this.runtimeUpdateInFlight) return this.runtimeUpdateInFlight;
+    this.runtimeUpdateInFlight = (async () => {
+      try {
+        if (reason === "startup") {
+          process.stderr.write("sootsim: checking for runtime updates\u2026\n");
+        }
+        const result = await updateRuntimeToLatest();
+        if (!result.updated || !result.latestVersion) {
+          if (reason === "startup") {
+            process.stderr.write(
+              `sootsim: runtime ${this.activeRuntimeVersion ?? "(none)"} is current
+`
+            );
+          }
+          return;
+        }
+        const active = this.setActiveRuntime(result.latestVersion);
+        process.stderr.write(`sootsim runtime updated to ${active.version} (${reason})
+`);
+      } catch (err) {
+        process.stderr.write(
+          `sootsim runtime update failed (${reason}): ${err instanceof Error ? err.message : String(err)}
+`
+        );
+      } finally {
+        this.runtimeUpdateInFlight = null;
+        if (reason === "startup" && this.bootstrapping) {
+          this.bootstrapping = false;
+          if (this.shouldWriteLockfile && this.httpServer) {
+            try {
+              this.writeLockfileSnapshot();
+            } catch {
+            }
+          }
+          process.stderr.write("sootsim: ready\n");
+        }
+      }
+    })();
+    return this.runtimeUpdateInFlight;
+  }
   /** update the active runtime on disk + in memory. the caller guarantees
    *  the version directory exists. pushes a runtime:changed message to all
-   *  connected browsers so electron (or any renderer) can reload. */
+   *  connected sims so electron (or any renderer) can reload. */
   setActiveRuntime(version) {
     writeActiveRuntime(version);
     this.refreshActiveRuntime();
@@ -2743,10 +3896,10 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       version,
       runtimeDir: this.activeRuntimeDirPath
     });
-    for (const browser of this.browsers.values()) {
-      if (browser.ws.readyState === import_ws.WebSocket.OPEN) {
+    for (const sim of this.sims.values()) {
+      if (sim.ws.readyState === import_ws.WebSocket.OPEN) {
         try {
-          browser.ws.send(payload);
+          sim.ws.send(payload);
         } catch {
         }
       }
@@ -2775,6 +3928,13 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
    *  non-upgrade routes that don't match serve index.html (SPA behavior) so
    *  electron's webContents can navigate freely inside the runtime. */
   handleHttpRequest(req, res) {
+    if (isFetchProxyRequestUrl(req.url)) {
+      void handleFetchProxyRequest(req, res);
+      return;
+    }
+    if (isAppApiRequestUrl(req.url) && handleAppApiRequest(req, res)) {
+      return;
+    }
     const method = (req.method || "GET").toUpperCase();
     if (method !== "GET" && method !== "HEAD") {
       res.writeHead(405, { Allow: "GET, HEAD" });
@@ -2834,6 +3994,10 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       })();
       return;
     }
+    if (url.pathname === "/__server-scan") {
+      this.handleServerScan(res);
+      return;
+    }
     if (url.pathname === "/healthz") {
       res.writeHead(200, {
         "Content-Type": "application/json",
@@ -2853,6 +4017,24 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       );
       return;
     }
+    if (url.pathname === "/__sootsim/shared-config") {
+      res.setHeader("Access-Control-Allow-Origin", "*");
+      res.setHeader("Cache-Control", "no-store");
+      if (method === "GET" || method === "HEAD") {
+        let body = "{}";
+        try {
+          body = JSON.stringify(readSharedConfig());
+        } catch {
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        if (method === "HEAD") res.end();
+        else res.end(body);
+        return;
+      }
+      res.writeHead(405, { Allow: "GET, HEAD" });
+      res.end("method not allowed (use the bridge over WS for writes)");
+      return;
+    }
     this.refreshActiveRuntime();
     const baseDir = this.activeRuntimeDirPath;
     if (!baseDir) {
@@ -2883,63 +4065,87 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
         return;
       }
     }
-    const resolved = import_path2.default.resolve(baseDir, "." + rel);
-    const baseWithSep = baseDir.endsWith(import_path2.default.sep) ? baseDir : baseDir + import_path2.default.sep;
+    const resolved = import_path3.default.resolve(baseDir, "." + rel);
+    const baseWithSep = baseDir.endsWith(import_path3.default.sep) ? baseDir : baseDir + import_path3.default.sep;
     if (!resolved.startsWith(baseWithSep) && resolved !== baseDir) {
       res.writeHead(403);
       res.end("forbidden");
       return;
     }
-    import_fs2.default.realpath(resolved, (realErr, realResolved) => {
+    import_fs3.default.realpath(resolved, (realErr, realResolved) => {
       const servePath = realErr ? resolved : realResolved;
-      const servePathWithSep = servePath.endsWith(import_path2.default.sep) ? servePath : servePath + import_path2.default.sep;
+      const servePathWithSep = servePath.endsWith(import_path3.default.sep) ? servePath : servePath + import_path3.default.sep;
       if (!realErr) {
         const realBaseWithSep = (() => {
           try {
-            const rb = import_fs2.default.realpathSync(baseDir);
-            return rb.endsWith(import_path2.default.sep) ? rb : rb + import_path2.default.sep;
+            const rb = import_fs3.default.realpathSync(baseDir);
+            return rb.endsWith(import_path3.default.sep) ? rb : rb + import_path3.default.sep;
           } catch {
             return baseWithSep;
           }
         })();
-        if (!servePathWithSep.startsWith(realBaseWithSep) && servePath + import_path2.default.sep !== realBaseWithSep) {
+        if (!servePathWithSep.startsWith(realBaseWithSep) && servePath + import_path3.default.sep !== realBaseWithSep) {
           res.writeHead(403);
           res.end("forbidden");
           return;
         }
       }
-      import_fs2.default.stat(servePath, (err, stats) => {
+      import_fs3.default.stat(servePath, (err, stats) => {
         if (err || !stats?.isFile()) {
-          const ext2 = import_path2.default.extname(rel).toLowerCase();
+          const ext2 = import_path3.default.extname(rel).toLowerCase();
           if (ext2 && ext2 !== ".html") {
             res.writeHead(404);
             res.end("not found");
             return;
           }
-          const indexPath = import_path2.default.join(baseDir, "index.html");
-          import_fs2.default.readFile(indexPath, (err2, data) => {
+          if (rel.startsWith("/__") || rel.startsWith("/api/") || rel === "/api") {
+            res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+            res.end("not found");
+            return;
+          }
+          const indexPath = import_path3.default.join(baseDir, "index.html");
+          import_fs3.default.readFile(indexPath, (err2, data) => {
             if (err2) {
               res.writeHead(404);
               res.end("not found");
               return;
             }
-            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+            res.writeHead(200, {
+              "Content-Type": "text/html; charset=utf-8",
+              "Cache-Control": "no-store"
+            });
             if (method === "HEAD") {
               res.end();
               return;
             }
-            res.end(data);
+            res.end(injectSharedConfigIntoHtml(data));
           });
           return;
         }
-        const ext = import_path2.default.extname(servePath).toLowerCase();
+        const ext = import_path3.default.extname(servePath).toLowerCase();
         const contentType = HTTP_MIME_TYPES[ext] || "application/octet-stream";
-        res.writeHead(200, { "Content-Type": contentType });
+        res.writeHead(200, {
+          "Content-Type": contentType,
+          "Cache-Control": "no-store"
+        });
         if (method === "HEAD") {
           res.end();
           return;
         }
-        const stream = import_fs2.default.createReadStream(servePath);
+        if (ext === ".html") {
+          import_fs3.default.readFile(servePath, (readErr, data) => {
+            if (readErr) {
+              try {
+                res.end();
+              } catch {
+              }
+              return;
+            }
+            res.end(injectSharedConfigIntoHtml(data));
+          });
+          return;
+        }
+        const stream = import_fs3.default.createReadStream(servePath);
         stream.pipe(res);
         stream.on("error", () => {
           try {
@@ -2953,10 +4159,10 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
   sweepIdleCliClients() {
     const now = Date.now();
     let swept = false;
-    for (const [ws, browserId] of this.cliBrowserBySocket) {
+    for (const [ws, simId] of this.cliSimBySocket) {
       const lastCommand = this.cliLastCommandAt.get(ws) ?? 0;
       if (now - lastCommand < _SootSimBridgeHost.CLI_IDLE_TIMEOUT_MS) continue;
-      this.cliBrowserBySocket.delete(ws);
+      this.cliSimBySocket.delete(ws);
       this.cliLastCommandAt.delete(ws);
       for (const [sentId, entry] of this.cliBySentId) {
         if (entry.ws === ws) this.cliBySentId.delete(sentId);
@@ -2968,61 +4174,87 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       swept = true;
     }
     if (swept) {
-      this.broadcastBrowserClientStates();
+      this.broadcastSimClientStates();
+    }
+    this.sweepRestorableSims(now);
+  }
+  // ping every connected ws; if the previous round's ping went unanswered,
+  // terminate the socket so 'close' fires and the sim cleanup path
+  // runs. matches the recommended ws-library heartbeat pattern.
+  sweepDeadWebSockets() {
+    if (!this.wss) return;
+    for (const ws of this.wss.clients) {
+      if (ws.readyState !== import_ws.WebSocket.OPEN) continue;
+      const alive = this.wsIsAlive.get(ws);
+      if (alive === false) {
+        try {
+          ws.terminate();
+        } catch {
+        }
+        continue;
+      }
+      this.wsIsAlive.set(ws, false);
+      try {
+        ws.ping();
+      } catch {
+        try {
+          ws.terminate();
+        } catch {
+        }
+      }
     }
-    this.sweepRestorableBrowsers(now);
   }
-  listBrowsers() {
-    return Array.from(this.browsers.values()).sort((a, b) => {
-      if (a.id === this.primaryBrowserId) return -1;
-      if (b.id === this.primaryBrowserId) return 1;
+  listSims() {
+    return Array.from(this.sims.values()).sort((a, b) => {
+      if (a.id === this.primarySimId) return -1;
+      if (b.id === this.primarySimId) return 1;
       return a.connectedAt - b.connectedAt;
-    }).map((browser) => this.describeBrowser(browser));
+    }).map((sim) => this.describeSim(sim));
   }
   async sendCommand(cmd) {
-    const browser = await this.waitForBrowser(cmd.browserId);
+    const sim = await this.waitForSim(cmd.simId);
     const id = this.nextCommandId++;
     return new Promise((resolve2, reject) => {
       const timeout = setTimeout(() => {
         this.pendingCommands.delete(id);
-        this.broadcastBrowserClientStates();
+        this.broadcastSimClientStates();
         reject(new Error("command timed out after 30s"));
       }, 3e4);
       this.pendingCommands.set(id, {
-        browserId: browser.id,
+        simId: sim.id,
         resolve: (value) => {
           clearTimeout(timeout);
           this.pendingCommands.delete(id);
-          this.broadcastBrowserClientStates();
+          this.broadcastSimClientStates();
           resolve2(value);
         },
         reject: (error) => {
           clearTimeout(timeout);
           this.pendingCommands.delete(id);
-          this.broadcastBrowserClientStates();
+          this.broadcastSimClientStates();
           reject(error);
         }
       });
-      this.broadcastBrowserClientStates();
-      const { browserId: _browserId, ...forwarded } = cmd;
-      browser.ws.send(JSON.stringify({ ...forwarded, id }));
+      this.broadcastSimClientStates();
+      const { simId: _simId, ...forwarded } = cmd;
+      sim.ws.send(JSON.stringify({ ...forwarded, id }));
     });
   }
-  async evaluate(code, browserId) {
-    return this.sendCommand({ type: "evaluate", code, browserId });
+  async evaluate(code, simId) {
+    return this.sendCommand({ type: "evaluate", code, simId });
   }
-  async focusBrowser(browserId) {
-    return this.sendCommand({ type: "focus", browserId });
+  async focusSim(simId) {
+    return this.sendCommand({ type: "focus", simId });
   }
-  async closeBrowser(browserId) {
-    return this.sendCommand({ type: "close", browserId });
+  async closeSim(simId) {
+    return this.sendCommand({ type: "close", simId });
   }
   async openPathInEditor(filePath, line, column) {
     const loc = line != null ? `:${line}${column != null ? `:${column}` : ""}` : "";
     const target = `${filePath}${loc}`;
     const trySpawn = (cmd, args) => new Promise((resolve2) => {
       try {
-        const child = (0, import_child_process2.spawn)(cmd, args, { detached: true, stdio: "ignore" });
+        const child = (0, import_child_process4.spawn)(cmd, args, { detached: true, stdio: "ignore" });
         let settled = false;
         child.on("error", () => {
           if (settled) return;
@@ -3049,26 +4281,12 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
     if (await trySpawn("code", ["-g", target])) return;
     await this.openUrl(filePath);
   }
-  async openUrl(url) {
+  async openUrl(url, options = {}) {
     if (this.openUrlHandler) {
-      await this.openUrlHandler(url);
+      await this.openUrlHandler(url, options);
       return;
     }
-    if (process.platform === "darwin") {
-      const child2 = (0, import_child_process2.spawn)("open", ["-g", url], { detached: true, stdio: "ignore" });
-      child2.unref();
-      return;
-    }
-    if (process.platform === "win32") {
-      const child2 = (0, import_child_process2.spawn)("cmd", ["/c", "start", "", url], {
-        detached: true,
-        stdio: "ignore"
-      });
-      child2.unref();
-      return;
-    }
-    const child = (0, import_child_process2.spawn)("xdg-open", [url], { detached: true, stdio: "ignore" });
-    child.unref();
+    await openUrl(url, options);
   }
   async close() {
     if (this.cliIdleTimer) {
@@ -3079,6 +4297,14 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       clearInterval(this.heartbeatTimer);
       this.heartbeatTimer = null;
     }
+    if (this.wsHeartbeatTimer) {
+      clearInterval(this.wsHeartbeatTimer);
+      this.wsHeartbeatTimer = null;
+    }
+    if (this.runtimeUpdateTimer) {
+      clearInterval(this.runtimeUpdateTimer);
+      this.runtimeUpdateTimer = null;
+    }
     if (this.shouldWriteLockfile) {
       try {
         removeDaemonLockfile();
@@ -3092,11 +4318,11 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       pending.reject(new Error("server closing"));
       this.pendingCommands.delete(id);
     }
-    for (const browser of this.browsers.values()) {
-      browser.ws.close();
+    for (const sim of this.sims.values()) {
+      sim.ws.close();
     }
-    this.browsers.clear();
-    this.primaryBrowserId = null;
+    this.sims.clear();
+    this.primarySimId = null;
     const wss = this.wss;
     const httpServer = this.httpServer;
     this.wss = null;
@@ -3114,69 +4340,69 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       }
     }
   }
-  describeBrowser(browser) {
+  describeSim(sim) {
     let readyState;
     try {
-      readyState = browser.ws.readyState;
+      readyState = sim.ws.readyState;
     } catch {
       readyState = import_ws.WebSocket.CLOSED;
     }
-    const lease = this.getActiveLease(browser);
+    const lease = this.getActiveLease(sim);
     return {
-      id: browser.id,
-      origin: browser.origin,
-      url: browser.url,
-      title: browser.title,
-      userAgent: browser.userAgent,
-      connectedAt: browser.connectedAt,
-      lastSeenAt: browser.lastSeenAt,
-      lastActiveAt: browser.lastActiveAt || void 0,
-      isPrimary: browser.id === this.primaryBrowserId,
+      id: sim.id,
+      origin: sim.origin,
+      url: sim.url,
+      title: sim.title,
+      userAgent: sim.userAgent,
+      connectedAt: sim.connectedAt,
+      lastSeenAt: sim.lastSeenAt,
+      lastActiveAt: sim.lastActiveAt || void 0,
+      isPrimary: sim.id === this.primarySimId,
       readyState: readyState === import_ws.WebSocket.OPEN ? "open" : readyState === import_ws.WebSocket.CLOSING ? "closing" : "closed",
-      attachedCliCount: this.getAttachedCliCount(browser.id),
-      lockedBy: lease ? lease.cliLabel || lease.cliSessionKey : void 0,
+      attachedCliCount: this.getAttachedCliCount(sim.id),
+      lockedBy: lease ? lease.cliLabel || lease.cliIdentityKey : void 0,
       lockedByKind: lease ? lease.kind : void 0,
       lockExpiresAt: lease ? lease.expiresAt : void 0,
-      userFocused: browser.userFocused || void 0
+      userFocused: sim.userFocused || void 0
     };
   }
-  getActiveLease(browser) {
-    const lease = browser.cliLease;
+  getActiveLease(sim) {
+    const lease = sim.cliLease;
     if (!lease) return null;
     if (Date.now() >= lease.expiresAt) {
-      browser.cliLease = void 0;
+      sim.cliLease = void 0;
       return null;
     }
     return lease;
   }
-  tryAcquireLease(ws, browser, opts = {}) {
-    const cliSessionKey = this.cliSessionKeyBySocket.get(ws) ?? (() => {
+  tryAcquireLease(ws, sim, opts = {}) {
+    const cliIdentityKey = this.cliIdentityKeyBySocket.get(ws) ?? (() => {
       const fallback = `ws-${this.nextCliFallbackId++}`;
-      this.cliSessionKeyBySocket.set(ws, fallback);
+      this.cliIdentityKeyBySocket.set(ws, fallback);
       return fallback;
     })();
     const cliLabel = this.cliLabelBySocket.get(ws);
     const now = Date.now();
-    const existing = this.getActiveLease(browser);
-    const ownerMatches = existing && existing.cliSessionKey === cliSessionKey;
+    const existing = this.getActiveLease(sim);
+    const ownerMatches = existing && existing.cliIdentityKey === cliIdentityKey;
     let bootedCount = 0;
     if (existing && !ownerMatches && !opts.force) {
       return {
         granted: false,
         lease: existing,
         lock: {
-          by: existing.cliLabel || existing.cliSessionKey,
+          by: existing.cliLabel || existing.cliIdentityKey,
           expiresInMs: Math.max(0, existing.expiresAt - now)
         },
         bootedCount: 0
       };
     }
     if (existing && !ownerMatches && opts.force) {
-      for (const [cliWs, attachedBrowserId] of this.cliBrowserBySocket) {
-        if (attachedBrowserId !== browser.id) continue;
-        const otherKey = this.cliSessionKeyBySocket.get(cliWs);
-        if (otherKey && otherKey !== cliSessionKey) {
-          this.cliBrowserBySocket.delete(cliWs);
+      for (const [cliWs, attachedSimId] of this.cliSimBySocket) {
+        if (attachedSimId !== sim.id) continue;
+        const otherKey = this.cliIdentityKeyBySocket.get(cliWs);
+        if (otherKey && otherKey !== cliIdentityKey) {
+          this.cliSimBySocket.delete(cliWs);
           try {
             cliWs.close(1e3, "lease claimed by another cli");
           } catch {
@@ -3187,132 +4413,129 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
     }
     const lease = {
       kind: "cli",
-      cliSessionKey,
+      cliIdentityKey,
       cliLabel,
       expiresAt: now + _SootSimBridgeHost.CLI_LEASE_TTL_MS
     };
-    browser.cliLease = lease;
+    sim.cliLease = lease;
     return { granted: true, lease, bootedCount };
   }
-  // user focus is advisory: we track it on the browser record so list/UI can
+  // user focus is advisory: we track it on the sim record so list/UI can
   // show "focused" alongside any cli lease, but focus alone never creates a
-  // blocking lease. the old 15s user-focus lease meant clicking on the tab
+  // blocking lease. the old 15s user-focus lease meant clicking on the sim
   // locked out agent inspect calls for 15s — the opposite of what you want
   // when debugging something the user is actively looking at. use
   // updateUserActivity() to lock on real interaction instead.
-  updateUserFocusLease(browser, focused) {
+  updateUserFocusLease(sim, focused) {
     const next = focused;
-    if (browser.userFocused === next) return;
-    browser.userFocused = next;
-    this.broadcastBrowserClientStates();
+    if (sim.userFocused === next) return;
+    sim.userFocused = next;
+    this.broadcastSimClientStates();
   }
-  // called when the browser reports a real user interaction (pointerdown,
+  // called when the sim reports a real user interaction (pointerdown,
   // keydown, wheel, touch). creates or refreshes a short `user-active` lease
-  // that keeps agent writes from trampling a user who is driving the tab.
+  // that keeps agent writes from trampling a user who is driving the sim.
   // reads still pass through — shouldAcquireLease only blocks on writes.
-  updateUserActivity(browser) {
-    const existing = this.getActiveLease(browser);
+  updateUserActivity(sim) {
+    const existing = this.getActiveLease(sim);
     if (existing && existing.kind === "cli") {
       return;
     }
-    browser.cliLease = {
+    const now = Date.now();
+    const refreshed = now + _SootSimBridgeHost.USER_ACTIVE_LEASE_TTL_MS;
+    const expiresAt = existing && existing.kind === "user-active" ? Math.max(existing.expiresAt, refreshed) : refreshed;
+    sim.cliLease = {
       kind: "user-active",
-      cliSessionKey: "__user-active__",
+      cliIdentityKey: "__user-active__",
       cliLabel: "active user",
-      expiresAt: Date.now() + _SootSimBridgeHost.USER_ACTIVE_LEASE_TTL_MS
+      expiresAt
     };
-    this.broadcastBrowserClientStates();
+    this.broadcastSimClientStates();
   }
-  ensureCliSessionKey(ws) {
-    const existing = this.cliSessionKeyBySocket.get(ws);
+  ensureCliIdentityKey(ws) {
+    const existing = this.cliIdentityKeyBySocket.get(ws);
     if (existing) return existing;
     const fallback = `ws-${this.nextCliFallbackId++}`;
-    this.cliSessionKeyBySocket.set(ws, fallback);
+    this.cliIdentityKeyBySocket.set(ws, fallback);
     return fallback;
   }
-  getOpenBrowser(browserId) {
-    if (browserId) {
-      const browser = this.browsers.get(browserId);
-      if (browser?.ws.readyState === import_ws.WebSocket.OPEN) return browser;
+  getOpenSim(simId) {
+    if (simId) {
+      const sim = this.sims.get(simId);
+      if (sim?.ws.readyState === import_ws.WebSocket.OPEN) return sim;
       return null;
     }
-    const primary = this.primaryBrowserId != null ? this.browsers.get(this.primaryBrowserId) : null;
+    const primary = this.primarySimId != null ? this.sims.get(this.primarySimId) : null;
     if (primary?.ws.readyState === import_ws.WebSocket.OPEN) return primary;
-    for (const browser of this.browsers.values()) {
-      if (browser.ws.readyState === import_ws.WebSocket.OPEN) return browser;
+    for (const sim of this.sims.values()) {
+      if (sim.ws.readyState === import_ws.WebSocket.OPEN) return sim;
     }
     return null;
   }
-  async waitForBrowser(browserId, options = {}) {
+  async waitForSim(simId, options = {}) {
     const attempts = options.attempts ?? 10;
     const intervalMs = options.intervalMs ?? 200;
     for (let attempt = 0; attempt < attempts; attempt++) {
-      const browser = this.getOpenBrowser(browserId);
-      if (browser) return browser;
+      const sim = this.getOpenSim(simId);
+      if (sim) return sim;
       await new Promise((resolve2) => setTimeout(resolve2, intervalMs));
     }
-    throw new Error(
-      browserId ? `no browser connected with id ${browserId}` : "no browser connected"
-    );
+    throw new Error(simId ? `no sim connected with id ${simId}` : "no sim connected");
   }
-  shouldPromoteBrowser(browser) {
-    const current = this.primaryBrowserId ? this.browsers.get(this.primaryBrowserId) : null;
-    const isPrimaryCandidate = browser.origin?.includes(":5173");
+  shouldPromoteSim(sim) {
+    const current = this.primarySimId ? this.sims.get(this.primarySimId) : null;
+    const isPrimaryCandidate = sim.origin?.includes(":5173");
     const currentIsPrimary = current?.origin?.includes(":5173");
     return !current || current.ws.readyState !== import_ws.WebSocket.OPEN || !!isPrimaryCandidate || !currentIsPrimary;
   }
-  broadcastBrowserAssignments() {
-    for (const browser of this.browsers.values()) {
-      if (browser.ws.readyState !== import_ws.WebSocket.OPEN) continue;
-      browser.ws.send(
+  broadcastSimAssignments() {
+    for (const sim of this.sims.values()) {
+      if (sim.ws.readyState !== import_ws.WebSocket.OPEN) continue;
+      sim.ws.send(
         JSON.stringify({
           type: "bridge:welcome",
-          browserId: browser.id,
-          isPrimary: browser.id === this.primaryBrowserId
+          simId: sim.id,
+          isPrimary: sim.id === this.primarySimId
         })
       );
     }
   }
-  broadcastBrowserClientStates() {
-    for (const browser of this.browsers.values()) {
-      if (browser.ws.readyState !== import_ws.WebSocket.OPEN) continue;
-      const lease = this.getActiveLease(browser);
+  broadcastSimClientStates() {
+    for (const sim of this.sims.values()) {
+      if (sim.ws.readyState !== import_ws.WebSocket.OPEN) continue;
+      const lease = this.getActiveLease(sim);
       const message = {
         type: "bridge:client-state",
-        attachedCliCount: this.getAttachedCliCount(browser.id),
-        activeAgentCommandCount: this.getActiveAgentCommandCount(browser.id),
-        recentActions: browser.recentActions,
-        lockedBy: lease ? lease.cliLabel || lease.cliSessionKey : void 0,
+        attachedCliCount: this.getAttachedCliCount(sim.id),
+        activeAgentCommandCount: this.getActiveAgentCommandCount(sim.id),
+        recentActions: sim.recentActions,
+        lockedBy: lease ? lease.cliLabel || lease.cliIdentityKey : void 0,
         lockedByKind: lease ? lease.kind : void 0,
         lockExpiresAt: lease ? lease.expiresAt : void 0,
-        userFocused: browser.userFocused || void 0
+        userFocused: sim.userFocused || void 0
       };
-      browser.ws.send(JSON.stringify(message));
+      sim.ws.send(JSON.stringify(message));
     }
   }
-  setCliBrowserTarget(ws, browserId) {
-    const prevBrowserId = this.cliBrowserBySocket.get(ws);
-    if (prevBrowserId === browserId) return;
-    this.cliBrowserBySocket.set(ws, browserId);
-    this.recordBrowserAction(
-      browserId,
-      prevBrowserId ? "cli switched tabs" : "cli connected",
-      false
-    );
-    this.broadcastBrowserClientStates();
+  setCliSimTarget(ws, simId) {
+    const prevSimId = this.cliSimBySocket.get(ws);
+    if (prevSimId === simId) return;
+    this.cliSimBySocket.set(ws, simId);
+    this.recordSimAction(simId, prevSimId ? "cli switched sims" : "cli connected", false);
+    this.broadcastSimClientStates();
   }
-  recordBrowserAction(browserId, label, broadcast = true) {
+  recordSimAction(simId, label, broadcast = true) {
     const normalized = label?.trim();
     if (!normalized) return;
-    const browser = this.browsers.get(browserId);
-    if (!browser) return;
+    const sim = this.sims.get(simId);
+    if (!sim) return;
     const now = Date.now();
-    browser.lastActiveAt = now;
-    browser.recentActions = [
+    sim.lastActiveAt = now;
+    sim.recentActions = [
       { label: normalized, at: now },
-      ...browser.recentActions.filter((entry) => entry.label !== normalized)
+      ...sim.recentActions.filter((entry) => entry.label !== normalized)
     ].slice(0, 4);
-    if (broadcast) this.broadcastBrowserClientStates();
+    if (broadcast) this.broadcastSimClientStates();
   }
   describeForwardedCommand(msg) {
     switch (msg?.type) {
@@ -3327,90 +4550,97 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       case "tree":
         return "dumped tree";
       case "focus":
-        return "focused tab";
+        return "focused sim";
       case "close":
         return "requested close";
       default:
         return typeof msg?.type === "string" ? msg.type : null;
     }
   }
-  // count distinct cli session keys attached to a browser, not raw sockets.
+  // count distinct cli identity keys attached to a sim, not raw sockets.
   // a single agent firing sequential cli commands opens a new ws per call —
   // counting sockets would report phantom peers until idle cleanup catches up.
-  getAttachedCliCount(browserId) {
+  getAttachedCliCount(simId) {
     const keys = /* @__PURE__ */ new Set();
-    for (const [ws, attachedBrowserId] of this.cliBrowserBySocket) {
-      if (attachedBrowserId !== browserId) continue;
+    for (const [ws, attachedSimId] of this.cliSimBySocket) {
+      if (attachedSimId !== simId) continue;
       if (ws.readyState !== import_ws.WebSocket.OPEN) continue;
-      const key = this.cliSessionKeyBySocket.get(ws);
+      const key = this.cliIdentityKeyBySocket.get(ws);
       keys.add(key ?? `ws-unknown-${keys.size}`);
     }
     return keys.size;
   }
-  // count distinct session keys attached to this browser other than `selfWs`.
-  // used to warn a cli that other agents/sessions are also targeting the tab.
-  getOtherCliSessionCount(selfWs, browserId) {
-    const selfKey = this.cliSessionKeyBySocket.get(selfWs);
+  // count distinct identity keys attached to this sim other than `selfWs`.
+  // used to warn a cli that other agents/identities are also targeting the sim.
+  getOtherCliIdentityCount(selfWs, simId) {
+    const selfKey = this.cliIdentityKeyBySocket.get(selfWs);
     const keys = /* @__PURE__ */ new Set();
-    for (const [ws, attachedBrowserId] of this.cliBrowserBySocket) {
-      if (attachedBrowserId !== browserId) continue;
+    for (const [ws, attachedSimId] of this.cliSimBySocket) {
+      if (attachedSimId !== simId) continue;
       if (ws.readyState !== import_ws.WebSocket.OPEN) continue;
-      const key = this.cliSessionKeyBySocket.get(ws);
+      const key = this.cliIdentityKeyBySocket.get(ws);
       if (key && key === selfKey) continue;
       keys.add(key ?? `ws-unknown-${keys.size}`);
     }
     return keys.size;
   }
-  getActiveAgentCommandCount(browserId) {
+  getActiveAgentCommandCount(simId) {
     let count = 0;
     for (const pending of this.pendingCommands.values()) {
-      if (pending.browserId === browserId) count++;
+      if (pending.simId === simId) count++;
     }
     return count;
   }
-  tryRestoreBrowserId(browser, requestedId) {
+  allocateSimId() {
+    for (; ; ) {
+      const id = this.nextSimNumber.toString(16);
+      this.nextSimNumber++;
+      if (!this.sims.has(id) && !this.restorableSims.has(id)) return id;
+    }
+  }
+  tryRestoreSimId(sim, requestedId) {
     const nextId = requestedId?.trim();
-    if (!nextId || nextId === browser.id) return false;
-    const existing = this.browsers.get(nextId);
-    if (existing && existing !== browser && existing.ws.readyState === import_ws.WebSocket.OPEN) {
+    if (!nextId || nextId === sim.id) return false;
+    const existing = this.sims.get(nextId);
+    if (existing && existing !== sim && existing.ws.readyState === import_ws.WebSocket.OPEN) {
       return false;
     }
-    const restorable = this.getRestorableBrowserState(nextId);
-    const prevId = browser.id;
-    this.browsers.delete(prevId);
-    browser.id = nextId;
+    const restorable = this.getRestorableSimState(nextId);
+    const prevId = sim.id;
+    this.sims.delete(prevId);
+    sim.id = nextId;
     if (restorable) {
-      browser.recentActions = restorable.recentActions.map((entry) => ({ ...entry }));
-      browser.lastActiveAt = restorable.lastActiveAt;
-      browser.cliLease = restorable.cliLease ? { ...restorable.cliLease } : void 0;
-      this.restorableBrowsers.delete(nextId);
+      sim.recentActions = restorable.recentActions.map((entry) => ({ ...entry }));
+      sim.lastActiveAt = restorable.lastActiveAt;
+      sim.cliLease = restorable.cliLease ? { ...restorable.cliLease } : void 0;
+      this.restorableSims.delete(nextId);
     }
-    this.browsers.set(browser.id, browser);
-    if (this.primaryBrowserId === prevId) {
-      this.primaryBrowserId = browser.id;
+    this.sims.set(sim.id, sim);
+    if (this.primarySimId === prevId) {
+      this.primarySimId = sim.id;
     }
-    for (const [ws, attachedBrowserId] of this.cliBrowserBySocket) {
-      if (attachedBrowserId === prevId) {
-        this.cliBrowserBySocket.set(ws, browser.id);
+    for (const [ws, attachedSimId] of this.cliSimBySocket) {
+      if (attachedSimId === prevId) {
+        this.cliSimBySocket.set(ws, sim.id);
       }
     }
     return true;
   }
-  rememberDisconnectedBrowser(browser) {
-    const lease = this.getActiveLease(browser);
-    this.restorableBrowsers.set(browser.id, {
-      recentActions: browser.recentActions.map((entry) => ({ ...entry })),
-      lastActiveAt: browser.lastActiveAt,
+  rememberDisconnectedSim(sim) {
+    const lease = this.getActiveLease(sim);
+    this.restorableSims.set(sim.id, {
+      recentActions: sim.recentActions.map((entry) => ({ ...entry })),
+      lastActiveAt: sim.lastActiveAt,
       cliLease: lease && lease.kind === "cli" ? { ...lease } : void 0,
-      expiresAt: Date.now() + _SootSimBridgeHost.BROWSER_RECONNECT_TTL_MS
+      expiresAt: Date.now() + _SootSimBridgeHost.SIM_RECONNECT_TTL_MS
     });
-    this.browsers.delete(browser.id);
+    this.sims.delete(sim.id);
   }
-  getRestorableBrowserState(browserId) {
-    const snapshot = this.restorableBrowsers.get(browserId);
+  getRestorableSimState(simId) {
+    const snapshot = this.restorableSims.get(simId);
     if (!snapshot) return null;
     if (snapshot.expiresAt <= Date.now()) {
-      this.restorableBrowsers.delete(browserId);
+      this.restorableSims.delete(simId);
       return null;
     }
     if (snapshot.cliLease && snapshot.cliLease.expiresAt <= Date.now()) {
@@ -3418,13 +4648,13 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
     }
     return snapshot;
   }
-  sweepRestorableBrowsers(now = Date.now()) {
-    for (const [browserId, snapshot] of this.restorableBrowsers) {
+  sweepRestorableSims(now = Date.now()) {
+    for (const [simId, snapshot] of this.restorableSims) {
       if (snapshot.expiresAt > now) continue;
-      this.restorableBrowsers.delete(browserId);
-      for (const [cliWs, attachedBrowserId] of this.cliBrowserBySocket) {
-        if (attachedBrowserId === browserId) {
-          this.cliBrowserBySocket.delete(cliWs);
+      this.restorableSims.delete(simId);
+      for (const [cliWs, attachedSimId] of this.cliSimBySocket) {
+        if (attachedSimId === simId) {
+          this.cliSimBySocket.delete(cliWs);
         }
       }
     }
@@ -3434,6 +4664,14 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       clearInterval(this.cliIdleTimer);
       this.cliIdleTimer = null;
     }
+    if (this.wsHeartbeatTimer) {
+      clearInterval(this.wsHeartbeatTimer);
+      this.wsHeartbeatTimer = null;
+    }
+    if (this.runtimeUpdateTimer) {
+      clearInterval(this.runtimeUpdateTimer);
+      this.runtimeUpdateTimer = null;
+    }
     const wss = this.wss;
     const httpServer = this.httpServer;
     this.wss = null;