sootsim 0.1.295 → 0.1.296

package/dist-lib/vite.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.295 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.296 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;
@@ -85,7 +85,7 @@ function readDaemonLockfile() {
       const bytesRead = import_node_fs.default.readSync(fd, buf, 0, DAEMON_LOCKFILE_MAX_BYTES, 0);
       const raw = buf.subarray(0, bytesRead).toString("utf8");
       const parsed = JSON.parse(raw);
-      if (parsed && parsed.schema === 1 && typeof parsed.pid === "number" && typeof parsed.bridgePort === "number" && typeof parsed.runtimePort === "number" && typeof parsed.startedAt === "number" && typeof parsed.heartbeatAt === "number") {
+      if (parsed && parsed.schema === 1 && typeof parsed.pid === "number" && typeof parsed.bridgePort === "number" && typeof parsed.runtimePort === "number" && typeof parsed.startedAt === "number" && typeof parsed.heartbeatAt === "number" && (parsed.servedRuntimes === void 0 || Array.isArray(parsed.servedRuntimes) && parsed.servedRuntimes.every((version) => typeof version === "string"))) {
         return parsed;
       }
       return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sootsim",
-  "version": "0.1.295",
+  "version": "0.1.296",
   "description": "sootsim CLI + vite/metro plugins + skills registry. bridge client for driving the proprietary sootsim-engine over WebSocket.",
   "author": "Tamagui LLC",
   "license": "MIT",
@@ -169,6 +169,7 @@
   },
   "dependencies": {
     "@expo/plist": "^0.5.4",
+    "jiti": "2.7.0",
     "ws": "^8.18.0"
   },
   "peerDependencies": {

package/scripts/postinstall.cjs

@@ -1,79 +1,3 @@
 #!/usr/bin/env node
-// postinstall — best-effort runtime install after npm/npx fetches sootsim.
-//
-// runs as a child of npm. failures here are non-fatal; setup/open/runtime
-// commands can install the runtime later.
-//
-// skipped when running as root via sudo: $HOME would be /root, but the user
-// who actually wants the runtime probably isn't root. their first sootsim
-// invocation will install into their own ~/.sootsim instead.
-
-const { spawnSync } = require('child_process')
-const fs = require('fs')
-const os = require('os')
-const path = require('path')
-
-if (process.env.SOOTSIM_SKIP_POSTINSTALL === '1') {
-  process.exit(0)
-}
-
-// in dev / workspace installs (i.e. running inside the Contrast monorepo, not
-// installed as a dep), the package dir is `<repo>/packages/sootsim/` rather
-// than `.../node_modules/sootsim/`. skip the runtime fetch in that case —
-// the workspace already has the engine source.
-const pkgDir = path.resolve(__dirname, '..')
-if (!pkgDir.includes(`${path.sep}node_modules${path.sep}`)) {
-  process.exit(0)
-}
-
-const isRoot = typeof process.getuid === 'function' && process.getuid() === 0
-if (isRoot && process.env.SUDO_USER) {
-  console.log(
-    'sootsim: postinstall skipped under sudo — runtime will install on first run',
-  )
-  process.exit(0)
-}
-
-const existingActiveRuntime = readExistingActiveRuntime()
-if (existingActiveRuntime) {
-  console.log(
-    `sootsim: postinstall skipped — active runtime ${existingActiveRuntime} already installed`,
-  )
-  process.exit(0)
-}
-
-const RUNTIME_INSTALL_TIMEOUT_MS = 60_000
-
-const bin = path.join(__dirname, '..', 'dist-cli', 'bin.js')
-const res = spawnSync(process.execPath, [bin, 'runtime', 'install'], {
-  stdio: 'inherit',
-  timeout: RUNTIME_INSTALL_TIMEOUT_MS,
-})
-
-if (res.error && res.error.code === 'ETIMEDOUT') {
-  // the runtime tarball is ~48MB; on a slow link it does not finish inside the
-  // npm-install budget above. say that plainly instead of implying we chose to
-  // defer — the user has to run the install themselves for it to complete.
-  console.log(
-    `sootsim: runtime download did not finish within ${RUNTIME_INSTALL_TIMEOUT_MS / 1000}s, so npm install could return — run \`sootsim upgrade\` to finish it`,
-  )
-} else if (res.status !== 0) {
-  console.log('sootsim: runtime install deferred to first run')
-}
-process.exit(0)
-
-function readExistingActiveRuntime() {
-  const home =
-    process.env.SOOTSIM_HOME && process.env.SOOTSIM_HOME.length > 0
-      ? path.resolve(process.env.SOOTSIM_HOME)
-      : path.join(os.homedir(), '.sootsim')
-  const runtimesDir = path.join(home, 'runtimes')
-  try {
-    const active = fs.readFileSync(path.join(runtimesDir, 'active'), 'utf8').trim()
-    if (!active) return null
-    const indexPath = path.join(runtimesDir, active, 'index.html')
-    return fs.existsSync(indexPath) ? active : null
-  } catch {
-    return null
-  }
-}
+// npm installs package code only. `sootsim setup` owns runtime and machine
+// changes so installs never download a runtime or register a service implicitly.

package/skills/contrast/SKILL.md

@@ -52,6 +52,7 @@ automation, inspecting the render tree, and managing sims.
 | `sootsim close` | close a connected sim |
 | `sootsim setup` | check local setup and install the recommended bridge daemon |
 | `sootsim compat` | check package compatibility |
+| `sootsim report-issue` | send an explicitly approved compatibility report |
 | `sootsim desktop` | launch or install the desktop companion |
 | `sootsim daemon` | manage the optional background bridge service |
 | `sootsim version` | show the CLI + engine runtime versions you are running |

package/skills/sootsim-setup/SKILL.md

@@ -36,6 +36,7 @@ debugging or `/sootsim-test` for writing tests.
 
 ```sh
 sootsim setup                    # one-time guided setup; installs daemon
+sootsim compat --json            # scan the app's native package compatibility
 sootsim open 8081                # load a metro/expo dev server
 sootsim list                     # confirm exactly one sim is reachable
 sootsim use <id>                 # pin it for the rest of the workflow
@@ -59,6 +60,30 @@ sootsim open https://my-app.local  # load a hosted bundle
   every subsequent command
 - `sootsim get errors 5` and `sootsim get requests 5` are quiet (or the
   warnings are ones you understand)
+- the compatibility scan's partial, unsupported, unknown, and version-mismatched
+  packages have been summarized without treating its aggregate score as a pass/fail gate
+
+## compatibility feedback requires approval
+
+run `sootsim compat --json` from the app project root during setup. if the scan
+identifies a plausible missing SootSim seam, or the running app gives concrete
+evidence that behavior is missing or broken specifically in SootSim, summarize
+the package, expected behavior, actual behavior, and runtime evidence for the
+user. then offer to send that finding with `sootsim report-issue`.
+
+**never submit a report automatically or behind the user's back.** wait for an
+explicit yes. only then run this from the app project root:
+
+```sh
+sootsim report-issue --yes "<package; expected behavior; actual behavior; runtime evidence>"
+```
+
+the command automatically attaches the local compatibility scan plus bounded
+CLI, runtime, operating-system, and architecture metadata. it does not attach
+source files, environment variables, terminal output, logs, screenshots, git
+data, or app data. `--dry-run` previews the attachment summary without sending.
+do not use `--yes` merely because the agent believes a report would be useful;
+it records the user's approval after the offer.
 
 ## recovery — common failure modes
 

package/src/config.ts

@@ -18,6 +18,8 @@ export type NativeModuleResolution = ModuleResolution | Record<string, any> // d
 export interface SootSimConfig<
   Settings extends Record<string, any> = Record<string, any>,
 > {
+  // host-only engine selection. omitted means the current stable runtime.
+  runtimeVersion?: string
   modules?: Record<string, ModuleResolution>
   turboModules?: Record<string, NativeModuleResolution>
   nativeModules?: Record<string, NativeModuleResolution>
@@ -61,6 +63,7 @@ export function hasSootSimConfig<
 >(config?: SootSimConfig<Settings> | null): config is SootSimConfig<Settings> {
   if (!config) return false
   return (
+    (typeof config.runtimeVersion === 'string' && config.runtimeVersion.length > 0) ||
     hasOwnKeys(config.modules as Record<string, unknown> | undefined) ||
     hasOwnKeys(config.turboModules as Record<string, unknown> | undefined) ||
     hasOwnKeys(config.nativeModules as Record<string, unknown> | undefined) ||
@@ -82,6 +85,7 @@ export function mergeSootSimConfig<
   if (!hasSootSimConfig(override)) return base ? { ...base } : undefined
 
   return {
+    runtimeVersion: override.runtimeVersion ?? base.runtimeVersion,
     modules: { ...(base.modules || {}), ...(override.modules || {}) },
     turboModules: { ...(base.turboModules || {}), ...(override.turboModules || {}) },
     nativeModules: {

package/src/disk-cleanup.ts

@@ -1,12 +1,7 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import { isDisposableBrowserCacheDir } from './browser-cache'
-import {
-  ensureSootsimHome,
-  isDaemonLockfileFresh,
-  readDaemonLockfile,
-  sootsimHomeDir,
-} from './home-paths'
+import { ensureSootsimHome, readLiveRuntimeVersions, sootsimHomeDir } from './home-paths'
 import { sootsimRuntime } from './runtime-delivery'
 
 const AUTOMATIC_CLEANUP_GENERATION = 1
@@ -38,7 +33,6 @@ export interface SootsimCleanupOptions {
 export interface SootsimCleanupPlan {
   home: string
   activeRuntime: string | null
-  pinnedRuntime: string | null
   entries: SootsimCleanupEntry[]
   reclaimableBytes: number
   protectedBytes: number
@@ -183,18 +177,11 @@ function collectRecordingEntries(
   })
 }
 
-function inUseRuntimeVersions(): string[] {
-  const lock = readDaemonLockfile()
-  if (!isDaemonLockfileFresh(lock) || !lock.activeRuntime) return []
-  return [lock.activeRuntime]
-}
-
 function runtimeEntries(aggressive: boolean): {
   activeRuntime: string | null
-  pinnedRuntime: string | null
   entries: SootsimCleanupEntry[]
 } {
-  const inUseVersions = new Set(inUseRuntimeVersions())
+  const inUseVersions = new Set(readLiveRuntimeVersions())
   const protectVersions = [...inUseVersions]
   const normal = sootsimRuntime.planLocalRetention({
     retainVersions: 2,
@@ -218,13 +205,9 @@ function runtimeEntries(aggressive: boolean): {
     const runtimePath = sootsimRuntime.product.runtimeDir(version)
     let state: SootsimCleanupState = 'retained'
     let detail = 'retained runtime'
-    if (
-      inUseVersions.has(version) &&
-      version !== normal.activeVersion &&
-      version !== normal.pinnedVersion
-    ) {
+    if (inUseVersions.has(version) && version !== normal.activeVersion) {
       state = 'in-use'
-      detail = 'runtime is served by the running daemon'
+      detail = 'runtime is serving a connected simulator'
     } else if (normallyRemoved.has(version)) {
       state = 'safe'
       detail = 'inactive runtime outside the two-version rollback window'
@@ -233,8 +216,6 @@ function runtimeEntries(aggressive: boolean): {
       detail = 'most recent rollback runtime'
     } else if (version === normal.activeVersion) {
       detail = 'active runtime; always protected'
-    } else if (version === normal.pinnedVersion) {
-      detail = 'pinned runtime; always protected'
     }
     entries.push({
       path: runtimePath,
@@ -259,7 +240,6 @@ function runtimeEntries(aggressive: boolean): {
 
   return {
     activeRuntime: normal.activeVersion,
-    pinnedRuntime: normal.pinnedVersion,
     entries,
   }
 }
@@ -279,7 +259,6 @@ export function planSootsimCleanup(
   return {
     home,
     activeRuntime: runtimes.activeRuntime,
-    pinnedRuntime: runtimes.pinnedRuntime,
     entries,
     reclaimableBytes: entries.reduce(
       (total, entry) => total + (entry.selected ? entry.bytes : 0),
@@ -307,7 +286,7 @@ export function applySootsimCleanup(
   const retainVersions = options.aggressive === true ? 1 : 2
   sootsimRuntime.pruneLocalRetention({
     retainVersions,
-    protectVersions: inUseRuntimeVersions(),
+    protectVersions: readLiveRuntimeVersions(),
   })
 
   for (const entry of plan.entries) {

package/src/home-paths.ts

@@ -20,8 +20,8 @@
 //   │                      by the next interactive CLI run
 //   ├── automatic-cleanup-v1.json  completion marker for the one-time safe
 //   │                      cleanup introduced for legacy unbounded data
-//   └── config.json        user prefs: runtime pin, update channel, cdn
-//                          origin override, telemetry, engine settings
+//   └── config.json        user prefs: update channel, cdn origin override,
+//                          telemetry, engine settings
 
 import { randomUUID } from 'node:crypto'
 import fs from 'node:fs'
@@ -167,19 +167,9 @@ export function configFilePath(): string {
 // ~/.sootsim/config.json is the single user-level config file every sootsim
 // surface (cli, electron renderer, dev browser via electron ipc) agrees on.
 //
-//   {
-//     "telemetry": true,                 // splash checkbox; cli + electron
-//     "settings": {                      // engine settings persisted across
-//       "onboardingComplete": true,      // sessions. shape mirrors the
-//       "betaConsentVersion": 1,         // PERSISTED_KEYS slice of
-//       "detailedTelemetry": false,      // SettingsValues — see
-//       ...                              // sootsim-engine/settings/schema.ts
-//     }
-//   }
-//
-// telemetry default is opt-in (missing/corrupt config means "enabled") so a
-// fresh install never silently drops error reports. settings default is empty
-// (the engine's getDefaults() fills the rest).
+// privacy preferences live in the nested settings object so the cli, desktop
+// main process, renderer, daemon-served browser, and settings UI all read and
+// write one persisted value per choice.
 
 export interface SharedConfig {
   telemetry?: boolean
@@ -218,8 +208,33 @@ export function writeSharedConfig(patch: Partial<SharedConfig>): SharedConfig {
   return next
 }
 
-export function readTelemetryEnabled(): boolean {
-  return readSharedConfig().telemetry !== false
+export interface PrivacyPreferences {
+  productAnalytics: boolean
+  crashReports: boolean
+  configured: boolean
+}
+
+export function readPrivacyPreferences(): PrivacyPreferences {
+  const settings = readSharedConfig().settings
+  const productAnalytics = settings?.productAnalytics
+  const crashReports = settings?.crashReports
+  return {
+    productAnalytics: typeof productAnalytics === 'boolean' ? productAnalytics : true,
+    crashReports: typeof crashReports === 'boolean' ? crashReports : true,
+    configured:
+      typeof productAnalytics === 'boolean' && typeof crashReports === 'boolean',
+  }
+}
+
+export function writePrivacyPreferences(
+  preferences: Pick<PrivacyPreferences, 'productAnalytics' | 'crashReports'>,
+): void {
+  writeSharedConfig({
+    settings: {
+      productAnalytics: preferences.productAnalytics,
+      crashReports: preferences.crashReports,
+    },
+  })
 }
 
 // stable per-machine anonymous telemetry id. every signed-out cli used to
@@ -234,10 +249,6 @@ export function readOrCreateAnonymousId(): string {
   return created
 }
 
-export function writeTelemetryEnabled(enabled: boolean): void {
-  writeSharedConfig({ telemetry: enabled })
-}
-
 // --- background-upgrade notice --------------------------------------------
 //
 // the daemon auto-updates the engine runtime in the background (hourly), so
@@ -342,6 +353,8 @@ export interface DaemonLockfile {
   activeRuntime: string | null
   /** absolute path to the active runtime's dist directory, or null. */
   activeRuntimeDir: string | null
+  /** repo-selected runtime versions currently served to connected sims. */
+  servedRuntimes?: string[]
   /** epoch-ms of daemon start. */
   startedAt: number
   /** epoch-ms of last heartbeat. daemons update this every ~5s; readers
@@ -369,6 +382,8 @@ export interface DevBridgeLockfile {
   startedAt: number
   heartbeatAt: number
   source: 'vite-dev'
+  /** repo-selected runtime versions currently served to connected sims. */
+  servedRuntimes?: string[]
 }
 
 const DAEMON_LOCKFILE_MAX_BYTES = 16 * 1024
@@ -390,7 +405,10 @@ export function readDaemonLockfile(): DaemonLockfile | null {
         typeof parsed.bridgePort === 'number' &&
         typeof parsed.runtimePort === 'number' &&
         typeof parsed.startedAt === 'number' &&
-        typeof parsed.heartbeatAt === 'number'
+        typeof parsed.heartbeatAt === 'number' &&
+        (parsed.servedRuntimes === undefined ||
+          (Array.isArray(parsed.servedRuntimes) &&
+            parsed.servedRuntimes.every((version) => typeof version === 'string')))
       ) {
         return parsed as DaemonLockfile
       }
@@ -421,7 +439,10 @@ export function readDevBridgeLockfile(): DevBridgeLockfile | null {
         typeof parsed.cwd === 'string' &&
         typeof parsed.startedAt === 'number' &&
         typeof parsed.heartbeatAt === 'number' &&
-        (parsed.shellPort === undefined || typeof parsed.shellPort === 'number')
+        (parsed.shellPort === undefined || typeof parsed.shellPort === 'number') &&
+        (parsed.servedRuntimes === undefined ||
+          (Array.isArray(parsed.servedRuntimes) &&
+            parsed.servedRuntimes.every((version) => typeof version === 'string')))
       ) {
         return parsed as DevBridgeLockfile
       }
@@ -475,6 +496,20 @@ export function isDevBridgeLockfileFresh(
   }
 }
 
+export function readLiveRuntimeVersions(): string[] {
+  const versions = new Set<string>()
+  const daemon = readDaemonLockfile()
+  if (isDaemonLockfileFresh(daemon)) {
+    if (daemon.activeRuntime) versions.add(daemon.activeRuntime)
+    for (const version of daemon.servedRuntimes ?? []) versions.add(version)
+  }
+  const devBridge = readDevBridgeLockfile()
+  if (isDevBridgeLockfileFresh(devBridge)) {
+    for (const version of devBridge.servedRuntimes ?? []) versions.add(version)
+  }
+  return [...versions].sort()
+}
+
 export function writeDaemonLockfile(data: DaemonLockfile): void {
   ensureSootsimHome()
   const tmp = `${daemonLockfilePath()}.tmp`