sootsim 0.1.294 → 0.1.296

package/dist-lib/home-paths.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.294 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.296 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;
@@ -61,9 +61,10 @@ __export(home_paths_exports, {
   readActiveRuntime: () => readActiveRuntime,
   readDaemonLockfile: () => readDaemonLockfile,
   readDevBridgeLockfile: () => readDevBridgeLockfile,
+  readLiveRuntimeVersions: () => readLiveRuntimeVersions,
   readOrCreateAnonymousId: () => readOrCreateAnonymousId,
+  readPrivacyPreferences: () => readPrivacyPreferences,
   readSharedConfig: () => readSharedConfig,
-  readTelemetryEnabled: () => readTelemetryEnabled,
   removeDaemonLockfile: () => removeDaemonLockfile,
   removeDevBridgeLockfile: () => removeDevBridgeLockfile,
   runtimeDir: () => runtimeDir,
@@ -74,9 +75,9 @@ __export(home_paths_exports, {
   writeActiveRuntime: () => writeActiveRuntime,
   writeDaemonLockfile: () => writeDaemonLockfile,
   writeDevBridgeLockfile: () => writeDevBridgeLockfile,
+  writePrivacyPreferences: () => writePrivacyPreferences,
   writeRuntimeUpgradeNotice: () => writeRuntimeUpgradeNotice,
-  writeSharedConfig: () => writeSharedConfig,
-  writeTelemetryEnabled: () => writeTelemetryEnabled
+  writeSharedConfig: () => writeSharedConfig
 });
 module.exports = __toCommonJS(home_paths_exports);
 var import_node_crypto = require("node:crypto");
@@ -182,8 +183,23 @@ function writeSharedConfig(patch) {
   import_node_fs.default.renameSync(tmp, configFilePath());
   return next;
 }
-function readTelemetryEnabled() {
-  return readSharedConfig().telemetry !== false;
+function readPrivacyPreferences() {
+  const settings = readSharedConfig().settings;
+  const productAnalytics = settings?.productAnalytics;
+  const crashReports = settings?.crashReports;
+  return {
+    productAnalytics: typeof productAnalytics === "boolean" ? productAnalytics : true,
+    crashReports: typeof crashReports === "boolean" ? crashReports : true,
+    configured: typeof productAnalytics === "boolean" && typeof crashReports === "boolean"
+  };
+}
+function writePrivacyPreferences(preferences) {
+  writeSharedConfig({
+    settings: {
+      productAnalytics: preferences.productAnalytics,
+      crashReports: preferences.crashReports
+    }
+  });
 }
 function readOrCreateAnonymousId() {
   const existing = readSharedConfig().anonymousId;
@@ -192,9 +208,6 @@ function readOrCreateAnonymousId() {
   writeSharedConfig({ anonymousId: created });
   return created;
 }
-function writeTelemetryEnabled(enabled) {
-  writeSharedConfig({ telemetry: enabled });
-}
 function runtimeUpgradeNoticePath() {
   return import_node_path.default.join(sootsimHomeDir(), "runtime-upgraded.json");
 }
@@ -259,7 +272,7 @@ function readDaemonLockfile() {
       const bytesRead = import_node_fs.default.readSync(fd, buf, 0, DAEMON_LOCKFILE_MAX_BYTES, 0);
       const raw = buf.subarray(0, bytesRead).toString("utf8");
       const parsed = JSON.parse(raw);
-      if (parsed && parsed.schema === 1 && typeof parsed.pid === "number" && typeof parsed.bridgePort === "number" && typeof parsed.runtimePort === "number" && typeof parsed.startedAt === "number" && typeof parsed.heartbeatAt === "number") {
+      if (parsed && parsed.schema === 1 && typeof parsed.pid === "number" && typeof parsed.bridgePort === "number" && typeof parsed.runtimePort === "number" && typeof parsed.startedAt === "number" && typeof parsed.heartbeatAt === "number" && (parsed.servedRuntimes === void 0 || Array.isArray(parsed.servedRuntimes) && parsed.servedRuntimes.every((version) => typeof version === "string"))) {
         return parsed;
       }
       return null;
@@ -278,7 +291,7 @@ function readDevBridgeLockfile() {
       const bytesRead = import_node_fs.default.readSync(fd, buf, 0, DAEMON_LOCKFILE_MAX_BYTES, 0);
       const raw = buf.subarray(0, bytesRead).toString("utf8");
       const parsed = JSON.parse(raw);
-      if (parsed && parsed.schema === 1 && parsed.source === "vite-dev" && typeof parsed.pid === "number" && typeof parsed.bridgePort === "number" && typeof parsed.runtimePort === "number" && typeof parsed.cwd === "string" && typeof parsed.startedAt === "number" && typeof parsed.heartbeatAt === "number" && (parsed.shellPort === void 0 || typeof parsed.shellPort === "number")) {
+      if (parsed && parsed.schema === 1 && parsed.source === "vite-dev" && typeof parsed.pid === "number" && typeof parsed.bridgePort === "number" && typeof parsed.runtimePort === "number" && typeof parsed.cwd === "string" && typeof parsed.startedAt === "number" && typeof parsed.heartbeatAt === "number" && (parsed.shellPort === void 0 || typeof parsed.shellPort === "number") && (parsed.servedRuntimes === void 0 || Array.isArray(parsed.servedRuntimes) && parsed.servedRuntimes.every((version) => typeof version === "string"))) {
         return parsed;
       }
       return null;
@@ -309,6 +322,19 @@ function isDevBridgeLockfileFresh(lock, now = Date.now()) {
     return false;
   }
 }
+function readLiveRuntimeVersions() {
+  const versions = /* @__PURE__ */ new Set();
+  const daemon = readDaemonLockfile();
+  if (isDaemonLockfileFresh(daemon)) {
+    if (daemon.activeRuntime) versions.add(daemon.activeRuntime);
+    for (const version of daemon.servedRuntimes ?? []) versions.add(version);
+  }
+  const devBridge = readDevBridgeLockfile();
+  if (isDevBridgeLockfileFresh(devBridge)) {
+    for (const version of devBridge.servedRuntimes ?? []) versions.add(version);
+  }
+  return [...versions].sort();
+}
 function writeDaemonLockfile(data) {
   ensureSootsimHome();
   const tmp = `${daemonLockfilePath()}.tmp`;
@@ -375,9 +401,10 @@ function removeDevBridgeLockfile() {
   readActiveRuntime,
   readDaemonLockfile,
   readDevBridgeLockfile,
+  readLiveRuntimeVersions,
   readOrCreateAnonymousId,
+  readPrivacyPreferences,
   readSharedConfig,
-  readTelemetryEnabled,
   removeDaemonLockfile,
   removeDevBridgeLockfile,
   runtimeDir,
@@ -388,7 +415,7 @@ function removeDevBridgeLockfile() {
   writeActiveRuntime,
   writeDaemonLockfile,
   writeDevBridgeLockfile,
+  writePrivacyPreferences,
   writeRuntimeUpgradeNotice,
-  writeSharedConfig,
-  writeTelemetryEnabled
+  writeSharedConfig
 });

package/dist-lib/host/bridge-host.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.294 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.296 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;
@@ -99,7 +99,7 @@ function hasOwnKeys(value) {
 }
 function hasSootSimConfig(config) {
   if (!config) return false;
-  return hasOwnKeys(config.modules) || hasOwnKeys(config.turboModules) || hasOwnKeys(config.nativeModules) || hasOwnKeys(config.env) || hasOwnKeys(config.network?.remap) || hasOwnKeys(config.settings) || hasOwnKeys(config.initialState);
+  return typeof config.runtimeVersion === "string" && config.runtimeVersion.length > 0 || hasOwnKeys(config.modules) || hasOwnKeys(config.turboModules) || hasOwnKeys(config.nativeModules) || hasOwnKeys(config.env) || hasOwnKeys(config.network?.remap) || hasOwnKeys(config.settings) || hasOwnKeys(config.initialState);
 }
 function applySootSimConfigToUrl(url, config) {
   const parsed = new URL(url);
@@ -920,6 +920,7 @@ async function scanDevServers(opts = {}) {
 
 // src/bridge-constants.ts
 var DEFAULT_SOOTSIM_BRIDGE_PORT = 7668;
+var DEFAULT_SOOTSIM_BRIDGE_URL = `http://localhost:${DEFAULT_SOOTSIM_BRIDGE_PORT}/`;
 var SOOTSIM_BRIDGE_SIM_CLOSE_CODE = 4001;
 var SOOTSIM_BRIDGE_SIM_CLOSE_REASON = "sootsim close";
 
@@ -1081,7 +1082,7 @@ function readDaemonLockfile() {
       const bytesRead = import_node_fs2.default.readSync(fd, buf, 0, DAEMON_LOCKFILE_MAX_BYTES, 0);
       const raw = buf.subarray(0, bytesRead).toString("utf8");
       const parsed = JSON.parse(raw);
-      if (parsed && parsed.schema === 1 && typeof parsed.pid === "number" && typeof parsed.bridgePort === "number" && typeof parsed.runtimePort === "number" && typeof parsed.startedAt === "number" && typeof parsed.heartbeatAt === "number") {
+      if (parsed && parsed.schema === 1 && typeof parsed.pid === "number" && typeof parsed.bridgePort === "number" && typeof parsed.runtimePort === "number" && typeof parsed.startedAt === "number" && typeof parsed.heartbeatAt === "number" && (parsed.servedRuntimes === void 0 || Array.isArray(parsed.servedRuntimes) && parsed.servedRuntimes.every((version) => typeof version === "string"))) {
         return parsed;
       }
       return null;
@@ -1142,35 +1143,12 @@ function removeDevBridgeLockfile() {
 var import_fs = __toESM(require("fs"), 1);
 var import_path = __toESM(require("path"), 1);
 var import_url = require("url");
-var _monorepoRootCache;
-function findMonorepoRoot() {
-  if (_monorepoRootCache !== void 0) return _monorepoRootCache;
-  let dir = import_path.default.dirname((0, import_url.fileURLToPath)(__sootsim_import_meta_url));
-  for (let i = 0; i < 12 && dir !== import_path.default.dirname(dir); i++) {
-    if (import_fs.default.existsSync(import_path.default.join(dir, "packages/sootsim-engine/package.json")) && import_fs.default.existsSync(import_path.default.join(dir, "public/sootsim"))) {
-      _monorepoRootCache = dir;
-      return dir;
-    }
-    dir = import_path.default.dirname(dir);
-  }
-  _monorepoRootCache = null;
-  return null;
-}
-function resolveDevCheckoutRuntimeRoot() {
-  if (process.env.SOOTSIM_HOME && readActiveRuntime()) return null;
-  const root = findMonorepoRoot();
-  if (!root) return null;
-  const devBuild = import_path.default.join(root, "public/sootsim");
-  if (import_fs.default.existsSync(import_path.default.join(devBuild, "index.html")) && import_fs.default.existsSync(import_path.default.join(devBuild, "engine/index.html")) && import_fs.default.existsSync(import_path.default.join(devBuild, "engine-tenant/worker.js"))) {
-    return devBuild;
-  }
-  return null;
-}
 
 // ../contrast-runtime-delivery/src/index.ts
 var import_node_child_process = require("node:child_process");
 var import_node_crypto = __toESM(require("node:crypto"), 1);
 var import_node_fs4 = __toESM(require("node:fs"), 1);
+var import_node_os2 = __toESM(require("node:os"), 1);
 var import_node_path4 = __toESM(require("node:path"), 1);
 var import_node_stream = require("node:stream");
 var import_promises2 = require("node:stream/promises");
@@ -1178,6 +1156,9 @@ var import_promises2 = require("node:stream/promises");
 // ../contrast-runtime-delivery/src/product.ts
 var import_node_fs3 = __toESM(require("node:fs"), 1);
 var import_node_path3 = __toESM(require("node:path"), 1);
+function isValidRuntimeVersion(value) {
+  return value.length <= 100 && /^[0-9A-Za-z][0-9A-Za-z._+-]*$/.test(value);
+}
 function listInstalledRuntimes(product) {
   try {
     return import_node_fs3.default.readdirSync(product.runtimesDir(), { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort(compareSemver);
@@ -1233,6 +1214,7 @@ function createRuntimeDelivery(product) {
     return input || process.env[product.env.channel] || config.runtimeChannel || "stable";
   }
   function resolvePin() {
+    if (!product.env.pin) return null;
     const env = process.env[product.env.pin];
     if (env && env.trim()) return env.trim();
     const config = readConfig();
@@ -1262,6 +1244,9 @@ function createRuntimeDelivery(product) {
         `no version specified and channel '${channel}' has no latest entry in the manifest`
       );
     }
+    if (!isValidRuntimeVersion(version)) {
+      throw new Error(`invalid runtime version: ${version}`);
+    }
     const entry = manifest.versions[version];
     if (!entry) {
       throw new Error(
@@ -1277,10 +1262,11 @@ function createRuntimeDelivery(product) {
     const { version, channel, entry } = resolveVersion(manifest, opts);
     const destDir = product.runtimeDir(version);
     const setActive = opts.setActive !== false;
-    pruneLocalRetention({ protectVersions: [version] });
+    const protectVersions = [version, ...opts.protectVersions ?? []];
+    pruneLocalRetention({ protectVersions });
     if (!opts.force && import_node_fs4.default.existsSync(import_node_path4.default.join(destDir, product.installedMarker))) {
       if (setActive) product.writeActiveRuntime(version);
-      pruneLocalRetention({ protectVersions: [version] });
+      pruneLocalRetention({ protectVersions });
       return {
         version,
         channel,
@@ -1292,29 +1278,32 @@ function createRuntimeDelivery(product) {
       };
     }
     const tarUrl = entry.tarball || tarballUrl(version, cdnOrigin);
-    const tarCachePath = import_node_path4.default.join(
-      product.cacheDir(),
+    const downloadDir = import_node_fs4.default.mkdtempSync(
+      import_node_path4.default.join(import_node_os2.default.tmpdir(), `${product.id}-runtime-download-`)
+    );
+    const runtimeArchivePath = import_node_path4.default.join(
+      downloadDir,
       runtimeTarballCacheName(product, version)
     );
-    process.stderr.write(`${product.id}: downloading runtime ${version}\u2026
-`);
-    await downloadToFile(tarUrl, tarCachePath);
-    process.stderr.write(`${product.id}: extracting runtime ${version}\u2026
-`);
     const tmpDir = import_node_path4.default.join(
       import_node_path4.default.dirname(destDir),
       `.installing-${version}-${process.pid}`
     );
     import_node_fs4.default.rmSync(tmpDir, { recursive: true, force: true });
     try {
-      const actualSha = await sha256File(tarCachePath);
+      process.stderr.write(`${product.id}: downloading runtime ${version}\u2026
+`);
+      await downloadToFile(tarUrl, runtimeArchivePath);
+      process.stderr.write(`${product.id}: extracting runtime ${version}\u2026
+`);
+      const actualSha = await sha256File(runtimeArchivePath);
       if (actualSha !== entry.sha256) {
         throw new Error(
           `sha256 mismatch for runtime ${version}: expected ${entry.sha256}, actual ${actualSha}`
         );
       }
       import_node_fs4.default.mkdirSync(tmpDir, { recursive: true });
-      await extractTarball(tarCachePath, tmpDir);
+      await extractTarball(runtimeArchivePath, tmpDir);
       if (!import_node_fs4.default.existsSync(import_node_path4.default.join(tmpDir, product.installedMarker))) {
         throw new Error(
           `extracted tarball for runtime ${version} is missing ${product.installedMarker}`
@@ -1326,10 +1315,10 @@ function createRuntimeDelivery(product) {
       import_node_fs4.default.rmSync(tmpDir, { recursive: true, force: true });
       throw err;
     } finally {
-      import_node_fs4.default.rmSync(tarCachePath, { force: true });
+      import_node_fs4.default.rmSync(downloadDir, { recursive: true, force: true });
     }
     if (setActive) product.writeActiveRuntime(version);
-    pruneLocalRetention({ protectVersions: [version] });
+    pruneLocalRetention({ protectVersions });
     return {
       version,
       channel,
@@ -1342,7 +1331,7 @@ function createRuntimeDelivery(product) {
   }
   async function updateToLatest(opts = {}) {
     product.ensureHome();
-    pruneLocalRetention();
+    pruneLocalRetention({ protectVersions: opts.protectVersions });
     const cdnOrigin = resolveCdnOrigin(opts.cdnOrigin);
     const channel = resolveChannel(opts.channel);
     const pin = resolvePin();
@@ -1364,7 +1353,8 @@ function createRuntimeDelivery(product) {
         version: pin,
         channel,
         cdnOrigin,
-        setActive: false
+        setActive: false,
+        protectVersions: opts.protectVersions
       });
       return {
         checked: true,
@@ -1412,7 +1402,8 @@ function createRuntimeDelivery(product) {
       version: latestVersion,
       channel,
       cdnOrigin,
-      setActive: false
+      setActive: false,
+      protectVersions: opts.protectVersions
     });
     return {
       checked: true,
@@ -1555,6 +1546,53 @@ function extractTarball(tarPath, destDir) {
   });
 }
 
+// src/runtime-assets.ts
+var _monorepoRootCache;
+function findMonorepoRoot() {
+  if (_monorepoRootCache !== void 0) return _monorepoRootCache;
+  let dir = import_path.default.dirname((0, import_url.fileURLToPath)(__sootsim_import_meta_url));
+  for (let i = 0; i < 12 && dir !== import_path.default.dirname(dir); i++) {
+    if (import_fs.default.existsSync(import_path.default.join(dir, "packages/sootsim-engine/package.json")) && import_fs.default.existsSync(import_path.default.join(dir, "public/sootsim"))) {
+      _monorepoRootCache = dir;
+      return dir;
+    }
+    dir = import_path.default.dirname(dir);
+  }
+  _monorepoRootCache = null;
+  return null;
+}
+function resolveDevCheckoutRuntimeRoot() {
+  if (process.env.SOOTSIM_HOME && readActiveRuntime()) return null;
+  const root = findMonorepoRoot();
+  if (!root) return null;
+  const devBuild = import_path.default.join(root, "public/sootsim");
+  if (import_fs.default.existsSync(import_path.default.join(devBuild, "index.html")) && import_fs.default.existsSync(import_path.default.join(devBuild, "engine/index.html")) && import_fs.default.existsSync(import_path.default.join(devBuild, "engine-tenant/worker.js"))) {
+    return devBuild;
+  }
+  return null;
+}
+function runtimeVersionFromHostname(hostname) {
+  const suffix = ".runtime.localhost";
+  if (!hostname.toLowerCase().endsWith(suffix)) return null;
+  const labels = hostname.slice(0, -suffix.length).split(".");
+  if (labels.length === 0 || labels.some((label) => !/^[0-9a-f]{1,60}$/i.test(label))) {
+    return null;
+  }
+  const encoded = labels.join("");
+  if (encoded.length % 2 !== 0) return null;
+  try {
+    const version = Buffer.from(encoded, "hex").toString("utf8");
+    return isValidRuntimeVersion(version) ? version : null;
+  } catch {
+    return null;
+  }
+}
+function resolveInstalledRuntimeRoot(version) {
+  const dir = runtimeDir(version);
+  if (!import_fs.default.existsSync(import_path.default.join(dir, "index.html"))) return null;
+  return dir;
+}
+
 // src/runtime-delivery.ts
 var DEFAULT_RUNTIME_CDN_ORIGIN = "https://contrast.dev";
 var SOOTSIM_RUNTIME_PRODUCT = {
@@ -1568,8 +1606,7 @@ var SOOTSIM_RUNTIME_PRODUCT = {
   installedMarker: "index.html",
   env: {
     cdnOrigin: "SOOTSIM_CDN_ORIGIN",
-    channel: "SOOTSIM_RUNTIME_CHANNEL",
-    pin: "SOOTSIM_RUNTIME_VERSION"
+    channel: "SOOTSIM_RUNTIME_CHANNEL"
   },
   ensureHome: ensureSootsimHome,
   configFile: configFilePath,
@@ -3862,6 +3899,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
           recentActions: []
         };
         this.sims.set(sim.id, sim);
+        this.writeConnectedRuntimeSnapshot();
         if (this.shouldPromoteSim(sim)) {
           this.primarySimId = sim.id;
         }
@@ -3953,6 +3991,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
           sim = null;
           role = "cli";
           this.cliIdentityKeyBySocket.set(ws, `ws-${this.nextCliFallbackId++}`);
+          this.writeConnectedRuntimeSnapshot();
           this.broadcastSimAssignments();
           this.broadcastSimClientStates();
         }
@@ -3966,6 +4005,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
             sim.url = registration.url;
             sim.title = registration.title;
             sim.userAgent = registration.userAgent;
+            this.writeConnectedRuntimeSnapshot();
             if (typeof registration.kind === "string" && registration.kind.trim()) {
               sim.kind = registration.kind.trim();
             }
@@ -3990,11 +4030,14 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
             return;
           }
           if (msg.type === "bridge:write-shared-config") {
-            const patch = msg.patch && typeof msg.patch === "object" ? msg.patch : null;
-            if (!patch) return;
-            let next;
+            if (!msg.patch || typeof msg.patch !== "object" || Array.isArray(msg.patch)) {
+              return;
+            }
+            const patch = Object.fromEntries(
+              Object.entries(msg.patch)
+            );
             try {
-              next = writeSharedConfig(patch);
+              this.writeAndBroadcastSharedConfig(patch);
             } catch (err) {
               process.stderr.write(
                 `sootsim: bridge:write-shared-config failed: ${err instanceof Error ? err.message : String(err)}
@@ -4002,17 +4045,6 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
               );
               return;
             }
-            const payload = JSON.stringify({
-              type: "bridge:shared-config-changed",
-              config: next
-            });
-            for (const peer of this.sims.values()) {
-              if (peer.ws.readyState !== import_ws2.WebSocket.OPEN) continue;
-              try {
-                peer.ws.send(payload);
-              } catch {
-              }
-            }
             return;
           }
           if (msg.type === "bridge:open-path") {
@@ -4327,6 +4359,18 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
     void this.agentHost.seedOnBoot();
   }
   bootstrapping = true;
+  connectedRuntimeVersions() {
+    const versions = /* @__PURE__ */ new Set();
+    for (const sim of this.sims.values()) {
+      try {
+        const url = new URL(sim.url || sim.origin || "http://localhost");
+        const version = runtimeVersionFromHostname(url.hostname);
+        if (version) versions.add(version);
+      } catch {
+      }
+    }
+    return [...versions].sort();
+  }
   buildLockfileSnapshot() {
     return {
       schema: 1,
@@ -4336,6 +4380,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       runtimePort: this.effectivePort,
       activeRuntime: this.activeRuntimeVersion,
       activeRuntimeDir: this.activeRuntimeDirPath,
+      servedRuntimes: this.connectedRuntimeVersions(),
       startedAt: this.startedAt,
       heartbeatAt: Date.now(),
       bootstrapping: this.bootstrapping
@@ -4353,7 +4398,8 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       cwd: process.cwd(),
       startedAt: this.startedAt,
       heartbeatAt: Date.now(),
-      source: "vite-dev"
+      source: "vite-dev",
+      servedRuntimes: this.connectedRuntimeVersions()
     };
   }
   writeLockfileSnapshot() {
@@ -4362,6 +4408,20 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
   writeDevLockfileSnapshot() {
     writeDevBridgeLockfile(this.buildDevLockfileSnapshot());
   }
+  writeConnectedRuntimeSnapshot() {
+    if (this.shouldWriteLockfile && this.httpServer) {
+      try {
+        this.writeLockfileSnapshot();
+      } catch {
+      }
+    }
+    if (this.shouldWriteDevLockfile && this.httpServer) {
+      try {
+        this.writeDevLockfileSnapshot();
+      } catch {
+      }
+    }
+  }
   refreshActiveRuntime() {
     this.activeRuntimeVersion = readActiveRuntime();
     this.activeRuntimeDirPath = resolveDevCheckoutRuntimeRoot() ?? activeRuntimeDir();
@@ -4413,6 +4473,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
   }
   startRuntimeUpdater() {
     if (!this.shouldWriteLockfile || this.runtimeUpdateTimer) return;
+    if (import_fs3.default.existsSync(import_path3.default.join(sootsimHomeDir(), "runtime-update-disabled"))) return;
     if (process.env.SOOTSIM_HOME && isSootsimDevCheckout() && !readActiveRuntime()) {
       return;
     }
@@ -4430,7 +4491,9 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
         if (reason === "startup") {
           process.stderr.write("sootsim: checking for runtime updates\u2026\n");
         }
-        const result = await sootsimRuntime.updateToLatest();
+        const result = await sootsimRuntime.updateToLatest({
+          protectVersions: this.connectedRuntimeVersions()
+        });
         if (!result.updated || !result.latestVersion) {
           if (reason === "startup") {
             process.stderr.write(
@@ -4491,6 +4554,11 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       runtimeDir: this.activeRuntimeDirPath
     });
     for (const sim of this.sims.values()) {
+      try {
+        const simUrl = new URL(sim.url || sim.origin || "http://localhost");
+        if (runtimeVersionFromHostname(simUrl.hostname)) continue;
+      } catch {
+      }
       if (sim.ws.readyState === import_ws2.WebSocket.OPEN) {
         try {
           sim.ws.send(payload);
@@ -4534,12 +4602,77 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       return;
     }
     const method = (req.method || "GET").toUpperCase();
+    let url;
+    try {
+      url = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);
+    } catch {
+      res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end("invalid request URL or host");
+      return;
+    }
+    if (url.pathname === "/__sootsim/shared-config") {
+      res.setHeader("Access-Control-Allow-Origin", "*");
+      res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+      res.setHeader("Cache-Control", "no-store");
+      if (method === "OPTIONS") {
+        res.writeHead(204, { Allow: "GET, HEAD, POST, OPTIONS" });
+        res.end();
+        return;
+      }
+      if (method === "GET" || method === "HEAD") {
+        let body = "{}";
+        try {
+          body = JSON.stringify(readSharedConfig());
+        } catch {
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        if (method === "HEAD") res.end();
+        else res.end(body);
+        return;
+      }
+      if (method === "POST") {
+        void (async () => {
+          try {
+            const chunks = [];
+            let size = 0;
+            for await (const chunk of req) {
+              const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+              size += buffer.byteLength;
+              if (size > 8 * 1024 * 1024) {
+                res.writeHead(413, { "Content-Type": "text/plain; charset=utf-8" });
+                res.end("shared config patch is too large");
+                return;
+              }
+              chunks.push(buffer);
+            }
+            const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+              throw new Error("shared config patch must be an object");
+            }
+            const patch = Object.fromEntries(
+              Object.entries(parsed)
+            );
+            const next = this.writeAndBroadcastSharedConfig(patch);
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(next));
+          } catch (error) {
+            res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+            res.end(
+              `invalid shared config patch: ${error instanceof Error ? error.message : String(error)}`
+            );
+          }
+        })();
+        return;
+      }
+      res.writeHead(405, { Allow: "GET, HEAD, POST, OPTIONS" });
+      res.end("method not allowed");
+      return;
+    }
     if (method !== "GET" && method !== "HEAD") {
       res.writeHead(405, { Allow: "GET, HEAD" });
       res.end("method not allowed");
       return;
     }
-    const url = new URL(req.url || "/", "http://localhost");
     if (url.pathname === "/__bundle-proxy") {
       const target = url.searchParams.get("url");
       if (!target) {
@@ -4616,30 +4749,13 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       );
       return;
     }
-    if (url.pathname === "/__sootsim/shared-config") {
-      res.setHeader("Access-Control-Allow-Origin", "*");
-      res.setHeader("Cache-Control", "no-store");
-      if (method === "GET" || method === "HEAD") {
-        let body = "{}";
-        try {
-          body = JSON.stringify(readSharedConfig());
-        } catch {
-        }
-        res.writeHead(200, { "Content-Type": "application/json" });
-        if (method === "HEAD") res.end();
-        else res.end(body);
-        return;
-      }
-      res.writeHead(405, { Allow: "GET, HEAD" });
-      res.end("method not allowed (use the bridge over WS for writes)");
-      return;
-    }
-    this.refreshActiveRuntime();
-    const baseDir = this.activeRuntimeDirPath;
+    const requestedRuntime = runtimeVersionFromHostname(url.hostname);
+    if (!requestedRuntime) this.refreshActiveRuntime();
+    const baseDir = requestedRuntime ? resolveInstalledRuntimeRoot(requestedRuntime) : this.activeRuntimeDirPath;
     if (!baseDir) {
       res.writeHead(503, { "Content-Type": "text/plain; charset=utf-8" });
       res.end(
-        "sootsim: no active runtime installed. run `sootsim runtime install` to fetch one."
+        requestedRuntime ? `sootsim: runtime ${requestedRuntime} is not installed. run \`sootsim open\` from that app again.` : "sootsim: no active runtime installed. run `sootsim runtime install` to fetch one."
       );
       return;
     }
@@ -5246,6 +5362,21 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       );
     }
   }
+  writeAndBroadcastSharedConfig(patch) {
+    const next = writeSharedConfig(patch);
+    const payload = JSON.stringify({
+      type: "bridge:shared-config-changed",
+      config: next
+    });
+    for (const peer of this.sims.values()) {
+      if (peer.ws.readyState !== import_ws2.WebSocket.OPEN) continue;
+      try {
+        peer.ws.send(payload);
+      } catch {
+      }
+    }
+    return next;
+  }
   broadcastSimClientStates() {
     for (const sim of this.sims.values()) {
       if (sim.ws.readyState !== import_ws2.WebSocket.OPEN) continue;
@@ -5384,6 +5515,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       expiresAt: Date.now() + _SootSimBridgeHost.SIM_RECONNECT_TTL_MS
     });
     this.sims.delete(sim.id);
+    this.writeConnectedRuntimeSnapshot();
   }
   getRestorableSimState(simId) {
     const snapshot = this.restorableSims.get(simId);

package/dist-lib/host/fetch-proxy-handler.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.294 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.296 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;

package/dist-lib/host/fetch-proxy-overrides.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.294 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.296 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;