sootsim 0.1.239 → 0.1.241

package/dist-lib/skills.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.239 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.241 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;
@@ -12894,12 +12894,6 @@ function formatFetchProxyError(targetUrl, err) {
   }
   return message;
 }
-function isTextProxyContentType(contentType) {
-  const value = Array.isArray(contentType) ? contentType[0] : contentType;
-  const normalized = value?.split(";", 1)[0]?.trim().toLowerCase();
-  if (!normalized) return false;
-  return normalized.startsWith("text/") || normalized === "application/json" || normalized.endsWith("+json") || normalized === "application/x-www-form-urlencoded" || normalized === "application/xml" || normalized.endsWith("+xml") || normalized === "application/javascript" || normalized === "application/graphql";
-}
 function buildFetchProxyHeaders(reqHeaders, targetUrl) {
   const headers = {};
   for (const [key, value] of Object.entries(reqHeaders)) {
@@ -12958,7 +12952,6 @@ async function handleFetchProxyRequest(req, res) {
     res.end("invalid url param");
     return;
   }
-  const headers = buildFetchProxyHeaders(req.headers, upstreamUrl);
   let body;
   if (req.method !== "GET" && req.method !== "HEAD") {
     const chunks = [];
@@ -12966,39 +12959,89 @@ async function handleFetchProxyRequest(req, res) {
       chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
     }
     if (chunks.length > 0) {
-      const bytes = Buffer.concat(chunks);
-      body = isTextProxyContentType(req.headers["content-type"]) ? bytes.toString("utf8") : bytes;
+      body = Buffer.concat(chunks);
     }
   }
-  let upstream;
-  try {
-    upstream = await fetch(upstreamUrl.href, {
-      method: req.method,
-      headers,
-      body,
-      redirect: "follow"
+  const originalMethod = req.method || "GET";
+  const proxy = async (targetUrl2, method, nextBody, redirects) => {
+    const transport = targetUrl2.protocol === "https:" ? import_https.default : import_http2.default;
+    const targetHeaders = buildFetchProxyHeaders(req.headers, targetUrl2);
+    if (targetUrl2.origin !== upstreamUrl.origin) {
+      delete targetHeaders.authorization;
+      delete targetHeaders["proxy-authorization"];
+    }
+    if (method === "GET" || method === "HEAD") {
+      delete targetHeaders["content-length"];
+      delete targetHeaders["content-type"];
+    } else if (nextBody) {
+      targetHeaders["content-length"] = String(nextBody.byteLength);
+    }
+    const proxyRes = await new Promise((resolve5, reject) => {
+      const proxyReq = transport.request(
+        {
+          hostname: targetUrl2.hostname,
+          port: targetUrl2.port || (targetUrl2.protocol === "https:" ? 443 : 80),
+          path: targetUrl2.pathname + targetUrl2.search,
+          method,
+          headers: targetHeaders
+        },
+        resolve5
+      );
+      const abort = () => proxyReq.destroy(new Error("fetch proxy client disconnected"));
+      req.once("aborted", abort);
+      proxyReq.once("close", () => req.off("aborted", abort));
+      proxyReq.once("error", reject);
+      if (nextBody === void 0) proxyReq.end();
+      else proxyReq.end(nextBody);
     });
+    const status = proxyRes.statusCode ?? 502;
+    const location = proxyRes.headers.location;
+    if (location && (status === 301 || status === 302 || status === 303 || status === 307 || status === 308)) {
+      if (redirects >= 10) {
+        proxyRes.destroy();
+        throw new Error("too many redirects");
+      }
+      const switchToGet = (status === 301 || status === 302) && method === "POST" || status === 303 && method !== "GET" && method !== "HEAD";
+      const redirectUrl = new URL(location, targetUrl2);
+      proxyRes.resume();
+      await (0, import_promises2.finished)(proxyRes);
+      await proxy(
+        redirectUrl,
+        switchToGet ? "GET" : method,
+        switchToGet ? void 0 : nextBody,
+        redirects + 1
+      );
+      return;
+    }
+    for (const [key, value] of Object.entries(proxyRes.headers)) {
+      const lowerKey = key.toLowerCase();
+      if (value === void 0 || lowerKey === "set-cookie" || lowerKey === "connection" || lowerKey === "keep-alive" || lowerKey === "proxy-authenticate" || lowerKey === "proxy-authorization" || lowerKey === "te" || lowerKey === "trailer" || lowerKey === "transfer-encoding" || lowerKey === "upgrade" || lowerKey.startsWith("access-control-")) {
+        continue;
+      }
+      res.setHeader(key, value);
+    }
+    applyFetchProxyCors(res);
+    const setCookie = proxyRes.headers["set-cookie"] ?? [];
+    if (setCookie.length > 0) {
+      res.setHeader(
+        "x-sootsim-set-cookie",
+        (Array.isArray(setCookie) ? setCookie : [setCookie]).join(", ")
+      );
+    }
+    res.statusCode = status;
+    await (0, import_promises2.pipeline)(proxyRes, res);
+  };
+  try {
+    await proxy(upstreamUrl, originalMethod, body, 0);
   } catch (err) {
+    if (res.headersSent) {
+      res.destroy(err instanceof Error ? err : new Error(String(err)));
+      return;
+    }
     applyFetchProxyCors(res);
     res.writeHead(502, { "Content-Type": "text/plain" });
     res.end(`fetch proxy error: ${formatFetchProxyError(upstreamUrl.href, err)}`);
-    return;
-  }
-  upstream.headers.forEach((value, key) => {
-    const lowerKey = key.toLowerCase();
-    if (lowerKey === "content-encoding" || lowerKey === "transfer-encoding" || lowerKey === "content-length" || lowerKey === "set-cookie" || lowerKey.startsWith("access-control-")) {
-      return;
-    }
-    res.setHeader(key, value);
-  });
-  applyFetchProxyCors(res);
-  const setCookie = upstream.headers.getSetCookie?.() ?? [];
-  if (setCookie.length > 0) {
-    res.setHeader("x-sootsim-set-cookie", setCookie.join(", "));
   }
-  res.statusCode = upstream.status;
-  const buf = Buffer.from(await upstream.arrayBuffer());
-  res.end(buf);
 }
 function handleAppApiRequest(req, res) {
   const reqUrl = req.url || "";
@@ -13068,12 +13111,13 @@ function handleAppApiRequest(req, res) {
   req.pipe(proxyReq);
   return true;
 }
-var import_http2, import_https, STRIP_FETCH_PROXY_HEADERS, FETCH_PROXY_CORS_HEADERS, APP_API_HEADER_REWRITES;
+var import_http2, import_https, import_promises2, STRIP_FETCH_PROXY_HEADERS, FETCH_PROXY_CORS_HEADERS, APP_API_HEADER_REWRITES;
 var init_fetch_proxy_handler = __esm({
   "src/host/fetch-proxy-handler.ts"() {
     "use strict";
     import_http2 = __toESM(require("http"), 1);
     import_https = __toESM(require("https"), 1);
+    import_promises2 = require("stream/promises");
     init_fetch_proxy_overrides();
     STRIP_FETCH_PROXY_HEADERS = /* @__PURE__ */ new Set([
       "host",
@@ -16385,6 +16429,101 @@ var init_app_state_reset = __esm({
 });
 
 // cli/commands/inspect/core.ts
+function scoreLayoutTextContrast(input) {
+  const required = input.fontSize >= 18 || input.fontSize >= 14 && (input.fontWeight ?? 400) >= 700 ? 3 : 4.5;
+  const { normal, background } = input;
+  if (normal.width <= 0 || normal.height <= 0 || normal.width !== background.width || normal.height !== background.height) {
+    return { ratio: null, required, reason: "capture dimensions do not match" };
+  }
+  const left = Math.max(0, Math.floor(input.box.x));
+  const top = Math.max(0, Math.floor(input.box.y));
+  const right = Math.min(normal.width, Math.ceil(input.box.x + input.box.w));
+  const bottom = Math.min(normal.height, Math.ceil(input.box.y + input.box.h));
+  if (right <= left || bottom <= top) {
+    return { ratio: null, required, reason: "text is outside the captured frame" };
+  }
+  const linear = (value) => {
+    const channel = value / 255;
+    return channel <= 0.04045 ? channel / 12.92 : Math.pow((channel + 0.055) / 1.055, 2.4);
+  };
+  const ratioOf = (foreground, behind) => {
+    const foregroundLuminance = 0.2126 * linear(foreground[0]) + 0.7152 * linear(foreground[1]) + 0.0722 * linear(foreground[2]);
+    const backgroundLuminance = 0.2126 * linear(behind[0]) + 0.7152 * linear(behind[1]) + 0.0722 * linear(behind[2]);
+    return (Math.max(foregroundLuminance, backgroundLuminance) + 0.05) / (Math.min(foregroundLuminance, backgroundLuminance) + 0.05);
+  };
+  const hex = (color) => `#${color.slice(0, 3).map((value) => Math.round(value).toString(16).padStart(2, "0")).join("")}`;
+  const area = (right - left) * (bottom - top);
+  const step = Math.max(1, Math.floor(Math.sqrt(area / 12e3)));
+  const offsetAt = (x, y) => (y * normal.width + x) * 4;
+  const deltaAt = (offset) => Math.max(
+    Math.abs(normal.data[offset] - background.data[offset]),
+    Math.abs(normal.data[offset + 1] - background.data[offset + 1]),
+    Math.abs(normal.data[offset + 2] - background.data[offset + 2])
+  );
+  let strongestDelta = 0;
+  let strongestForeground = null;
+  let opaqueBackground = null;
+  for (let y = top; y < bottom; y += step) {
+    for (let x = left; x < right; x += step) {
+      const offset = offsetAt(x, y);
+      if (background.data[offset + 3] < 250) continue;
+      const behind = [
+        background.data[offset],
+        background.data[offset + 1],
+        background.data[offset + 2]
+      ];
+      opaqueBackground ??= behind;
+      const delta = deltaAt(offset);
+      if (delta <= strongestDelta) continue;
+      strongestDelta = delta;
+      strongestForeground = [
+        normal.data[offset],
+        normal.data[offset + 1],
+        normal.data[offset + 2]
+      ];
+    }
+  }
+  let bestRatio = Infinity;
+  let bestForeground = null;
+  let bestBackground = null;
+  const consider = (foreground, behind) => {
+    const ratio = ratioOf(foreground, behind);
+    if (ratio >= bestRatio) return;
+    bestRatio = ratio;
+    bestForeground = foreground;
+    bestBackground = behind;
+  };
+  if (strongestDelta >= 2 && strongestForeground) {
+    for (let y = top; y < bottom; y += step) {
+      for (let x = left; x < right; x += step) {
+        const offset = offsetAt(x, y);
+        if (background.data[offset + 3] < 250 || deltaAt(offset) < 2) {
+          continue;
+        }
+        consider(strongestForeground, [
+          background.data[offset],
+          background.data[offset + 1],
+          background.data[offset + 2]
+        ]);
+      }
+    }
+  } else if (opaqueBackground) {
+    consider(opaqueBackground, opaqueBackground);
+  }
+  if (!bestForeground || !bestBackground || !Number.isFinite(bestRatio)) {
+    return {
+      ratio: null,
+      required,
+      reason: "could not isolate opaque rendered text pixels"
+    };
+  }
+  return {
+    ratio: Math.round(bestRatio * 100) / 100,
+    required,
+    foreground: hex(bestForeground),
+    background: hex(bestBackground)
+  };
+}
 function layoutGetNativeEval(opts = {}) {
   const includeStyle = opts.styling === true;
   const filter = opts.filter?.trim().toLowerCase() ?? "";
@@ -16394,6 +16533,7 @@ function layoutGetNativeEval(opts = {}) {
       const list = await t.listInspectable({})
       if (!Array.isArray(list)) return []
       const includeStyle = ${JSON.stringify(includeStyle)}
+      const scoreContrast = ${scoreLayoutTextContrast.toString()}
       // narrows by ELEMENT, not by style field: fewer rows, full detail on each.
       const filter = ${JSON.stringify(filter)}
       const matchesFilter = (n, text) => {
@@ -16438,7 +16578,7 @@ function layoutGetNativeEval(opts = {}) {
       }
       const weightOf = (style) => {
         const w = style && style.fontWeight
-        const n = typeof w === 'number' ? w : (typeof w === 'string' ? parseInt(w, 10) : NaN)
+        const n = w === 'bold' ? 700 : (typeof w === 'number' ? w : (typeof w === 'string' ? parseInt(w, 10) : NaN))
         return Number.isFinite(n) && n >= 600 ? n : undefined
       }
       const decoOf = (style) => {
@@ -16481,7 +16621,7 @@ function layoutGetNativeEval(opts = {}) {
         return abs.x + layout.width > 0 && abs.y + layout.height > 0 && abs.x < screenW && abs.y < screenH
       }
 
-      return list.filter(isVisible).filter((n) => {
+      const elements = list.filter(isVisible).filter((n) => {
         const t = typeof n.text === 'string' && n.text.trim() ? n.text.trim() : undefined
         return matchesFilter(n, t)
       }).map((n) => {
@@ -16516,7 +16656,7 @@ function layoutGetNativeEval(opts = {}) {
           ...base,
           borderRadius: radiusOf(style),
           padding: { t: round(pad.top), r: round(pad.right), b: round(pad.bottom), l: round(pad.left) },
-          fontSize: fontSizeOf(style),
+          fontSize: text ? (fontSizeOf(style) || 14) : 0,
           color: text ? colorStr(style.color) : undefined,
           bg: colorStr(style.backgroundColor),
           opacity: opacityOf(style),
@@ -16527,6 +16667,50 @@ function layoutGetNativeEval(opts = {}) {
           borderColor: borderWidth ? borderColorOf(style) : undefined,
         }
       })
+      const textElements = elements.filter((element) => element.text && element.fontSize > 0)
+      if (!includeStyle || textElements.length === 0) return elements
+
+      const screenshot = window.SootSim && window.SootSim.bridges && window.SootSim.bridges.screenshot
+      if (typeof screenshot !== 'function') {
+        throw new Error('styled native layout requires the SootSim capture bridge')
+      }
+      const device = list.find((node) => node && node.device)?.device || {}
+      const width = Math.round(Number(device.width) || window.innerWidth || 0)
+      const height = Math.round(Number(device.height) || window.innerHeight || 0)
+      if (!width || !height) throw new Error('native layout has no capture dimensions')
+      const capture = async (suppressText) => {
+        const dataUrl = await screenshot({
+          format: 'png',
+          outputWidth: width,
+          outputHeight: height,
+          ...(suppressText ? { suppressText: true } : {}),
+        })
+        const image = await new Promise((resolve, reject) => {
+          const next = new Image()
+          next.onload = () => resolve(next)
+          next.onerror = () => reject(new Error('could not decode native layout pixels'))
+          next.src = dataUrl
+        })
+        const canvas = document.createElement('canvas')
+        canvas.width = image.naturalWidth
+        canvas.height = image.naturalHeight
+        const context = canvas.getContext('2d', { willReadFrequently: true })
+        if (!context) throw new Error('could not read native layout pixels')
+        context.drawImage(image, 0, 0)
+        return context.getImageData(0, 0, canvas.width, canvas.height)
+      }
+      const normal = await capture(false)
+      const background = await capture(true)
+      for (const element of textElements) {
+        element.contrast = scoreContrast({
+          normal,
+          background,
+          box: element.box,
+          fontSize: element.fontSize,
+          fontWeight: element.fontWeight,
+        })
+      }
+      return elements
     })()`;
 }
 function readyProbeHasContent(probe) {

package/dist-lib/vite.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.239 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.241 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sootsim",
-  "version": "0.1.239",
+  "version": "0.1.241",
   "description": "sootsim CLI + vite/metro plugins + skills registry. bridge client for driving the proprietary sootsim-engine over WebSocket.",
   "author": "Tamagui LLC",
   "license": "MIT",

package/skills/contrast/SKILL.md

@@ -29,7 +29,7 @@ automation, inspecting the render tree, and managing sims.
 | `sootsim find` | locate nodes by text / testID / role / type / predicate |
 | `sootsim assert` | run any read verb and convert its output into an exit code |
 | `sootsim screenshot` | capture PNGs and manage App Store screenshot assets |
-| `sootsim get` | read runtime state (tree, a11y, url, count, errors, …) |
+| `sootsim get` | read runtime state (tree, a11y, layout, url, count, errors, …) |
 | `sootsim do` | drive the app (tap, type, scroll, swipe, key, reload, …) |
 | `sootsim wait` | block until the runtime reaches a known state |
 | `sootsim shell` | drive shell state and simulator chrome |

package/skills/sootsim-debug/SKILL.md

@@ -239,17 +239,19 @@ watch out for:
 ## branch — accessibility
 
 ```sh
-sootsim get a11y                          # full a11y tree
-sootsim get a11y --issues                 # only nodes with problems
+sootsim get a11y                          # roles, labels, hints, and target geometry
+sootsim get layout --styling              # boxes, styles, and native pixel contrast
 sootsim describe --a11y                   # inline a11y info on every node
 ```
 
-issue summary format:
+native styled layout reads rendered pixels rather than inferring contrast from
+tokens. it compares the normal frame with one CanvasKit capture where text is
+suppressed and adds each text score to the existing layout row and issue list.
+
+contrast summary format:
 
 ```
-[input] "" role=none label=null                ⚠ missing label
-[button] "➜" @(340,280) 20x20 (tap)            ⚠ touch target <44×44
-<text> "Sign in" color=#777 bg=#888            ⚠ contrast 1.4:1 (need 4.5:1)
+#loginButton @(24,347) 120x24 font:16 color:#777 contrast:1.4/4.5 FAIL on:#888888 "Sign in"
 ```
 
 finding offenders fast:
@@ -266,7 +268,8 @@ what gets checked:
 - **missing roles** — `Pressable`/`Touchable` without `accessibilityRole`
 - **missing hints** — complex interactions without `accessibilityHint`
 - **touch target size** — tappable nodes with hitSlop-expanded rect <44×44
-- **contrast** — text color vs detectable background
+- **contrast** — run `sootsim get layout --styling`; it samples final text and
+  text-suppressed background pixels, including gradients and composited opacity
 - **label / visible-text mismatch** — label that reads differently from
   the text VoiceOver would fall back to (often a translation bug)
 - **duplicate labels** — two reachable nodes with identical labels on
@@ -282,10 +285,13 @@ triage order:
 fix → verify loop (the same shape as debugging):
 
 ```sh
-sootsim get a11y --issues > before.txt
+sootsim get a11y > before-a11y.txt
+sootsim get layout --styling --json > before-layout.json
 # apply the fix
-sootsim get a11y --issues > after.txt
-diff before.txt after.txt
+sootsim get a11y > after-a11y.txt
+sootsim get layout --styling --json > after-layout.json
+diff before-a11y.txt after-a11y.txt
+diff before-layout.json after-layout.json
 ```
 
 fixing common cases:
@@ -340,8 +346,11 @@ type names sneak in).
   `--visible`, or both.
 - **`perf shell` reports zero frames** — you didn't run `perf shell start`
   first, or the capture window closed before any frame committed.
-- **`get a11y --issues` returns 100+ items** — sort by P0 first; fixing
-  one label often cascades to a parent's a11y subtree.
+- **`get a11y` returns 100+ items** — narrow with `find --role`,
+  `find --pressable`, or `find --no-label`; the a11y tree is descriptive and
+  intentionally does not invent an `--issues` grading mode.
+- **styled layout cannot capture pixels** — open a tenant app, dismiss system
+  overlays, and let the launch transition finish before retrying.
 - **timeline footer keeps showing 1 error but `get errors` is empty** —
   the footer reads "since last cursor advance"; `get errors` is absolute.
   the error already scrolled out of the absolute ring buffer.

package/src/host/fetch-proxy-handler.ts

@@ -25,6 +25,7 @@
 
 import http, { type IncomingMessage, type ServerResponse } from 'http'
 import https from 'https'
+import { finished, pipeline } from 'stream/promises'
 import {
   FETCH_PROXY_BROWSER_USER_AGENT,
   getFetchProxyTargetHeaders,
@@ -98,22 +99,6 @@ function formatFetchProxyError(targetUrl: string, err: unknown): string {
   return message
 }
 
-function isTextProxyContentType(contentType: string | string[] | undefined): boolean {
-  const value = Array.isArray(contentType) ? contentType[0] : contentType
-  const normalized = value?.split(';', 1)[0]?.trim().toLowerCase()
-  if (!normalized) return false
-  return (
-    normalized.startsWith('text/') ||
-    normalized === 'application/json' ||
-    normalized.endsWith('+json') ||
-    normalized === 'application/x-www-form-urlencoded' ||
-    normalized === 'application/xml' ||
-    normalized.endsWith('+xml') ||
-    normalized === 'application/javascript' ||
-    normalized === 'application/graphql'
-  )
-}
-
 export function buildFetchProxyHeaders(
   reqHeaders: Record<string, string | string[] | undefined>,
   targetUrl?: URL,
@@ -190,60 +175,127 @@ export async function handleFetchProxyRequest(
     return
   }
 
-  const headers = buildFetchProxyHeaders(req.headers, upstreamUrl)
-
-  let body: BodyInit | undefined
+  let body: Buffer | undefined
   if (req.method !== 'GET' && req.method !== 'HEAD') {
     const chunks: Buffer[] = []
     for await (const chunk of req) {
       chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk))
     }
     if (chunks.length > 0) {
-      const bytes = Buffer.concat(chunks)
-      body = isTextProxyContentType(req.headers['content-type'])
-        ? bytes.toString('utf8')
-        : bytes
+      body = Buffer.concat(chunks)
     }
   }
 
-  let upstream: Response
-  try {
-    upstream = await fetch(upstreamUrl.href, {
-      method: req.method,
-      headers,
-      body: body as BodyInit | undefined,
-      redirect: 'follow',
+  const originalMethod = req.method || 'GET'
+  const proxy = async (
+    targetUrl: URL,
+    method: string,
+    nextBody: Buffer | undefined,
+    redirects: number,
+  ): Promise<void> => {
+    const transport = targetUrl.protocol === 'https:' ? https : http
+    const targetHeaders = buildFetchProxyHeaders(req.headers, targetUrl)
+    if (targetUrl.origin !== upstreamUrl.origin) {
+      delete targetHeaders.authorization
+      delete targetHeaders['proxy-authorization']
+    }
+    if (method === 'GET' || method === 'HEAD') {
+      delete targetHeaders['content-length']
+      delete targetHeaders['content-type']
+    } else if (nextBody) {
+      targetHeaders['content-length'] = String(nextBody.byteLength)
+    }
+
+    const proxyRes = await new Promise<IncomingMessage>((resolve, reject) => {
+      const proxyReq = transport.request(
+        {
+          hostname: targetUrl.hostname,
+          port: targetUrl.port || (targetUrl.protocol === 'https:' ? 443 : 80),
+          path: targetUrl.pathname + targetUrl.search,
+          method,
+          headers: targetHeaders,
+        },
+        resolve,
+      )
+      const abort = () => proxyReq.destroy(new Error('fetch proxy client disconnected'))
+      req.once('aborted', abort)
+      proxyReq.once('close', () => req.off('aborted', abort))
+      proxyReq.once('error', reject)
+      if (nextBody === undefined) proxyReq.end()
+      else proxyReq.end(nextBody)
     })
-  } catch (err) {
-    applyFetchProxyCors(res)
-    res.writeHead(502, { 'Content-Type': 'text/plain' })
-    res.end(`fetch proxy error: ${formatFetchProxyError(upstreamUrl.href, err)}`)
-    return
-  }
 
-  upstream.headers.forEach((value, key) => {
-    const lowerKey = key.toLowerCase()
+    const status = proxyRes.statusCode ?? 502
+    const location = proxyRes.headers.location
     if (
-      lowerKey === 'content-encoding' ||
-      lowerKey === 'transfer-encoding' ||
-      lowerKey === 'content-length' ||
-      lowerKey === 'set-cookie' ||
-      lowerKey.startsWith('access-control-')
+      location &&
+      (status === 301 ||
+        status === 302 ||
+        status === 303 ||
+        status === 307 ||
+        status === 308)
     ) {
+      if (redirects >= 10) {
+        proxyRes.destroy()
+        throw new Error('too many redirects')
+      }
+      const switchToGet =
+        ((status === 301 || status === 302) && method === 'POST') ||
+        (status === 303 && method !== 'GET' && method !== 'HEAD')
+      const redirectUrl = new URL(location, targetUrl)
+      proxyRes.resume()
+      await finished(proxyRes)
+      await proxy(
+        redirectUrl,
+        switchToGet ? 'GET' : method,
+        switchToGet ? undefined : nextBody,
+        redirects + 1,
+      )
       return
     }
-    res.setHeader(key, value)
-  })
-  applyFetchProxyCors(res)
 
-  const setCookie = upstream.headers.getSetCookie?.() ?? []
-  if (setCookie.length > 0) {
-    res.setHeader('x-sootsim-set-cookie', setCookie.join(', '))
+    for (const [key, value] of Object.entries(proxyRes.headers)) {
+      const lowerKey = key.toLowerCase()
+      if (
+        value === undefined ||
+        lowerKey === 'set-cookie' ||
+        lowerKey === 'connection' ||
+        lowerKey === 'keep-alive' ||
+        lowerKey === 'proxy-authenticate' ||
+        lowerKey === 'proxy-authorization' ||
+        lowerKey === 'te' ||
+        lowerKey === 'trailer' ||
+        lowerKey === 'transfer-encoding' ||
+        lowerKey === 'upgrade' ||
+        lowerKey.startsWith('access-control-')
+      ) {
+        continue
+      }
+      res.setHeader(key, value)
+    }
+    applyFetchProxyCors(res)
+    const setCookie = proxyRes.headers['set-cookie'] ?? []
+    if (setCookie.length > 0) {
+      res.setHeader(
+        'x-sootsim-set-cookie',
+        (Array.isArray(setCookie) ? setCookie : [setCookie]).join(', '),
+      )
+    }
+    res.statusCode = status
+    await pipeline(proxyRes, res)
   }
 
-  res.statusCode = upstream.status
-  const buf = Buffer.from(await upstream.arrayBuffer())
-  res.end(buf)
+  try {
+    await proxy(upstreamUrl, originalMethod, body, 0)
+  } catch (err) {
+    if (res.headersSent) {
+      res.destroy(err instanceof Error ? err : new Error(String(err)))
+      return
+    }
+    applyFetchProxyCors(res)
+    res.writeHead(502, { 'Content-Type': 'text/plain' })
+    res.end(`fetch proxy error: ${formatFetchProxyError(upstreamUrl.href, err)}`)
+  }
 }
 
 export function handleAppApiRequest(req: IncomingMessage, res: ServerResponse): boolean {

package/dist-cli/chunks/beta-BH6RPXQU.js

@@ -1,2 +0,0 @@
-/*! sootsim v0.1.239 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
-import{a,b,c,d}from"./chunk-BKDHODNB.js";import"./chunk-BWKVAEAJ.js";export{d as BETA_ASK_HEADLINE,b as BETA_LABEL,c as BETA_TAGLINE,a as IS_BETA};