sootsim 0.1.85 → 0.1.87

package/dist-cli/chunks/{what-happened-PATQRJ5T.js → what-happened-57G5T2GM.js}

@@ -1,5 +1,5 @@
-/*! sootsim v0.1.85 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
-import{A as y,L as x,y as F,z as T}from"./chunk-ZO3VHP6W.js";import{c as S,e as N}from"./chunk-EKXK3SWK.js";import{b as k}from"./chunk-OISHLFON.js";import"./chunk-QQAECG5B.js";import"./chunk-WGDL5V6C.js";import"./chunk-H44IQHKZ.js";function _(n){let e=[];for(let t=0;t<n.length;t++)if(n[t]==="--since"&&t+1<n.length){e.push(t,t+1);let s=n[t+1].trim(),l=/^(\d+(?:\.\d+)?)(ms|s|m)?$/.exec(s);if(l){let a=Number(l[1]),m=l[2]??"ms",$=m==="s"?a*1e3:m==="m"?a*6e4:a;return{since:Date.now()-$,consumed:e}}let o=Number(s);if(Number.isFinite(o)&&o>1e12)return{since:o,consumed:e}}return{consumed:e}}function K(n){let e=[];for(let t=0;t<n.length;t++)if(n[t]==="--kinds"&&t+1<n.length)return e.push(t,t+1),{kinds:n[t+1].split(",").map(s=>s.trim()).filter(Boolean),consumed:e};return{consumed:e}}function O(n){let e=[];for(let t=0;t<n.length;t++)if(n[t]==="--limit"&&t+1<n.length){e.push(t,t+1);let s=Number(n[t+1]);if(Number.isFinite(s)&&s>0)return{limit:s,consumed:e}}return{consumed:e}}function j(n,e){if(e===null)return new Date(n).toLocaleTimeString();let t=(n-e)/1e3;return`${t>=0?"+":""}${t.toFixed(2)}s`}function B(n,e){switch(n){case"app-launch":return e.phase==="launch"?`launch ${e.appName??e.toAppId??""}`:`dismiss ${e.appName??e.fromAppId??""} \u2192 ${e.toAppId??""}`;case"toast":return`"${e.text??""}"${e.durationMs?` (${e.durationMs}ms)`:""}`;case"keyboard":return`${e.phase??"?"}${e.heightPx?` h=${e.heightPx}`:""}${e.mode?` ${e.mode}`:""}`;case"screen":return`${e.phase??"?"} ${e.name??e.activeName??""}`;case"route":return`${e.phase??"?"} ${e.path??e.pathname??""}`;case"alert":case"actionsheet":case"picker":return`${e.phase??"?"} ${e.title??e.message??""}`;case"notification":return`${e.title??""}${e.body?` \u2014 ${e.body}`:""}`;case"fetch":return`${e.method??"GET"} ${e.url??""}${e.status?` -> ${e.status}`:""}`;case"console":return`${e.level??"log"}: ${(e.message??"").toString().slice(0,120)}`;case"shell":return`${e.event??e.type??e.phase??""}`;case"scroll":return`${e.phase??"?"} ${e.target??""}`;case"gesture":return`${e.phase??"?"} ${e.type??""}`;case"text-input":return`${e.phase??"?"}${e.value!==void 0?` "${String(e.value).slice(0,40)}"`:""}`;case"layout":return`${e.kind??"?"} ${e.testID??e.type??""}${e.skipped?` skipped:${e.reason??"unknown"}`:""}`;case"react-commit":{let t=e.slowest;return`${e.fiberCount??"?"} fibers ${e.durationMs??"?"}ms${t?.displayName?` \xB7 ${t.displayName} ${t.durationMs??"?"}ms`:""}`}case"reanimated":case"animation":return`${e.kind??""} ${e.target??""}${e.durationMs?` ${e.durationMs}ms`:""}`}}function A(n,e){let t=j(n.t,e).padStart(8),s=n.context.padEnd(6),l=`[${n.kind}]`.padEnd(15),o="",a=n.data;return a&&typeof a=="object"&&(o=B(n.kind,a)),`  ${t}  ${s}  ${l} ${o}`}function M(n){let e=[],t={label:"initial state",events:[],startedAt:n[0]?.t??null};e.push(t);for(let s of n)if(t.events.push(s),s.kind==="screen"||s.kind==="route"){let l=s.data,o=l?.phase;if(!o||o==="enter"||o==="appear"||o==="active"){let a=l?.name||l?.activeName||l?.path||l?.pathname||s.kind;e.length===1&&t.events.length===1?t.label=`${s.kind}: ${a}`:(t={label:`${s.kind}: ${a}`,events:[],startedAt:s.t},e.push(t))}}return e}async function J(n,e){let t=S(n,{port:e.port,stripBooleanFlags:["--summary","--all","--json","--no-advance","--help","-h","--flow","--noisy"],stripValueFlags:["--since","--kinds","--limit"]});(n.includes("--help")||n.includes("-h"))&&(console.log(`
+/*! sootsim v0.1.87 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+import{A as y,L as x,y as F,z as T}from"./chunk-KHCGD2SK.js";import{c as S,e as N}from"./chunk-356M3TGV.js";import{b as k}from"./chunk-JIGBO7T2.js";import"./chunk-SFGIFF2S.js";import"./chunk-Y2H2L6L7.js";import"./chunk-PRQGETWQ.js";function _(n){let e=[];for(let t=0;t<n.length;t++)if(n[t]==="--since"&&t+1<n.length){e.push(t,t+1);let s=n[t+1].trim(),l=/^(\d+(?:\.\d+)?)(ms|s|m)?$/.exec(s);if(l){let a=Number(l[1]),m=l[2]??"ms",$=m==="s"?a*1e3:m==="m"?a*6e4:a;return{since:Date.now()-$,consumed:e}}let o=Number(s);if(Number.isFinite(o)&&o>1e12)return{since:o,consumed:e}}return{consumed:e}}function K(n){let e=[];for(let t=0;t<n.length;t++)if(n[t]==="--kinds"&&t+1<n.length)return e.push(t,t+1),{kinds:n[t+1].split(",").map(s=>s.trim()).filter(Boolean),consumed:e};return{consumed:e}}function O(n){let e=[];for(let t=0;t<n.length;t++)if(n[t]==="--limit"&&t+1<n.length){e.push(t,t+1);let s=Number(n[t+1]);if(Number.isFinite(s)&&s>0)return{limit:s,consumed:e}}return{consumed:e}}function j(n,e){if(e===null)return new Date(n).toLocaleTimeString();let t=(n-e)/1e3;return`${t>=0?"+":""}${t.toFixed(2)}s`}function B(n,e){switch(n){case"app-launch":return e.phase==="launch"?`launch ${e.appName??e.toAppId??""}`:`dismiss ${e.appName??e.fromAppId??""} \u2192 ${e.toAppId??""}`;case"toast":return`"${e.text??""}"${e.durationMs?` (${e.durationMs}ms)`:""}`;case"keyboard":return`${e.phase??"?"}${e.heightPx?` h=${e.heightPx}`:""}${e.mode?` ${e.mode}`:""}`;case"screen":return`${e.phase??"?"} ${e.name??e.activeName??""}`;case"route":return`${e.phase??"?"} ${e.path??e.pathname??""}`;case"alert":case"actionsheet":case"picker":return`${e.phase??"?"} ${e.title??e.message??""}`;case"notification":return`${e.title??""}${e.body?` \u2014 ${e.body}`:""}`;case"fetch":return`${e.method??"GET"} ${e.url??""}${e.status?` -> ${e.status}`:""}`;case"console":return`${e.level??"log"}: ${(e.message??"").toString().slice(0,120)}`;case"shell":return`${e.event??e.type??e.phase??""}`;case"scroll":return`${e.phase??"?"} ${e.target??""}`;case"gesture":return`${e.phase??"?"} ${e.type??""}`;case"text-input":return`${e.phase??"?"}${e.value!==void 0?` "${String(e.value).slice(0,40)}"`:""}`;case"layout":return`${e.kind??"?"} ${e.testID??e.type??""}${e.skipped?` skipped:${e.reason??"unknown"}`:""}`;case"react-commit":{let t=e.slowest;return`${e.fiberCount??"?"} fibers ${e.durationMs??"?"}ms${t?.displayName?` \xB7 ${t.displayName} ${t.durationMs??"?"}ms`:""}`}case"reanimated":case"animation":return`${e.kind??""} ${e.target??""}${e.durationMs?` ${e.durationMs}ms`:""}`}}function A(n,e){let t=j(n.t,e).padStart(8),s=n.context.padEnd(6),l=`[${n.kind}]`.padEnd(15),o="",a=n.data;return a&&typeof a=="object"&&(o=B(n.kind,a)),`  ${t}  ${s}  ${l} ${o}`}function M(n){let e=[],t={label:"initial state",events:[],startedAt:n[0]?.t??null};e.push(t);for(let s of n)if(t.events.push(s),s.kind==="screen"||s.kind==="route"){let l=s.data,o=l?.phase;if(!o||o==="enter"||o==="appear"||o==="active"){let a=l?.name||l?.activeName||l?.path||l?.pathname||s.kind;e.length===1&&t.events.length===1?t.label=`${s.kind}: ${a}`:(t={label:`${s.kind}: ${a}`,events:[],startedAt:s.t},e.push(t))}}return e}async function J(n,e){let t=S(n,{port:e.port,stripBooleanFlags:["--summary","--all","--json","--no-advance","--help","-h","--flow","--noisy"],stripValueFlags:["--since","--kinds","--limit"]});(n.includes("--help")||n.includes("-h"))&&(console.log(`
 sootsim what-happened \u2014 show recent events from the semantic timeline
 
 usage:

package/dist-cli/chunks/{whoami-CXVY26VV.js → whoami-3ICC26FV.js}

@@ -1,2 +1,2 @@
-/*! sootsim v0.1.85 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
-import{d as i}from"./chunk-5N3V7OCG.js";import{d as n}from"./chunk-OUNLJM56.js";import"./chunk-WGDL5V6C.js";import"./chunk-H44IQHKZ.js";async function u(){let o=i();if(o||(console.log("  not signed in"),console.log("  set SOOTSIM_API_KEY=sk_sootsim_\u2026 or run `sootsim login`"),process.exit(1)),o.kind==="api-key"){let r=`${o.secret.slice(0,14)}\u2026`,t=o.source==="env"?"SOOTSIM_API_KEY env var":"saved key (~/.config/sootsim/credentials.json)";console.log(`  api key ${r}`),console.log(`  source: ${t}`);return}if(o.kind==="github"){console.log(`  github token (${o.source})`),console.log(`  repo: ${o.repoId}`);return}let e=await n(),s=e?.user;console.log(`  ${s?.email||s?.name||s?.id||"signed in"}`),console.log(`  origin: ${e?.origin??o.origin}`),e?.updatedAt&&console.log(`  updated: ${e.updatedAt}`)}export{u as runWhoami};
+/*! sootsim v0.1.87 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+import{d as i}from"./chunk-HSIKVDO7.js";import{d as n}from"./chunk-L7NMKMAC.js";import"./chunk-Y2H2L6L7.js";import"./chunk-PRQGETWQ.js";async function u(){let o=i();if(o||(console.log("  not signed in"),console.log("  set SOOTSIM_API_KEY=sk_sootsim_\u2026 or run `sootsim login`"),process.exit(1)),o.kind==="api-key"){let r=`${o.secret.slice(0,14)}\u2026`,t=o.source==="env"?"SOOTSIM_API_KEY env var":"saved key (~/.config/sootsim/credentials.json)";console.log(`  api key ${r}`),console.log(`  source: ${t}`);return}if(o.kind==="github"){console.log(`  github token (${o.source})`),console.log(`  repo: ${o.repoId}`);return}let e=await n(),s=e?.user;console.log(`  ${s?.email||s?.name||s?.id||"signed in"}`),console.log(`  origin: ${e?.origin??o.origin}`),e?.updatedAt&&console.log(`  updated: ${e.updatedAt}`)}export{u as runWhoami};

package/dist-lib/agent-daemon-client.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.85 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.87 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;

package/dist-lib/agent-events.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.85 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.87 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;

package/dist-lib/agent-sessions.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.85 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.87 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;

package/dist-lib/attached-projects.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.85 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.87 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;

package/dist-lib/auth/shared-session.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.85 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.87 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;

package/dist-lib/backend-origin.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.85 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.87 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;

package/dist-lib/beta.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.85 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.87 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;

package/dist-lib/beta.mjs

@@ -0,0 +1,15 @@
+/*! sootsim v0.1.87 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+
+// src/beta.ts
+var IS_BETA = true;
+var BETA_VERSION_TARGET = "1.0.0";
+var BETA_LABEL = "public beta";
+var BETA_TAGLINE = `${BETA_LABEL} \xB7 free until ${BETA_VERSION_TARGET}`;
+var BETA_ASK_HEADLINE = "free for everyone until 1.0 \u2014 we send anonymous error and dependency data while you use it";
+export {
+  BETA_ASK_HEADLINE,
+  BETA_LABEL,
+  BETA_TAGLINE,
+  BETA_VERSION_TARGET,
+  IS_BETA
+};

package/dist-lib/bridge-constants.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.85 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.87 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;

package/dist-lib/cli-constants.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.85 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.87 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;

package/dist-lib/config.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.85 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.87 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;

package/dist-lib/detox/index.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.85 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.87 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;

package/dist-lib/dev-bundle-resolution.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.85 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.87 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;

package/dist-lib/home-paths.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.85 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.87 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;

package/dist-lib/host/bridge-host.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.85 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.87 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;
@@ -39,7 +39,7 @@ var import_child_process4 = require("child_process");
 var import_fs3 = __toESM(require("fs"), 1);
 var import_http3 = require("http");
 var import_path3 = __toESM(require("path"), 1);
-var import_ws = require("ws");
+var import_ws2 = require("ws");
 
 // scripts/dev-server-scanner.ts
 var import_child_process = require("child_process");
@@ -663,11 +663,22 @@ var APPS = [
     // be holding pglite locks on ~/takeout/.orez (soot can attach takeout as
     // a project and spin up its own orez against the same data dir).
     readyTimeoutMs: 24e4,
+    managedPorts: (p) => {
+      const offset = p - 8081;
+      return [5433 + offset, 4848 + offset, 9200 + offset];
+    },
     command: (p) => ({
-      cmd: "bun lite",
+      cmd: "bun lite:demo",
       env: {
+        TAKEOUT_ENV_MODE: "development",
         PORT_OFFSET: String(p - 8081),
-        OREZ_DATA_DIR: `${HOME}/.cache/sootsim-demo/takeout-orez`
+        OREZ_DATA_DIR: `${HOME}/.cache/sootsim-demo/takeout-orez`,
+        VITE_DEMO_MODE: "1",
+        ZERO_APP_ID: "takeout",
+        ZERO_APP_PUBLICATIONS: "zero_takeout",
+        ZERO_CVR_MAX_CONNS: "4",
+        ZERO_NUM_SYNC_WORKERS: "2",
+        ZERO_UPSTREAM_MAX_CONNS: "8"
       }
     })
   },
@@ -2910,6 +2921,14 @@ var FETCH_PROXY_CORS_HEADERS = {
   "access-control-expose-headers": "*",
   "access-control-max-age": "3600"
 };
+var APP_API_HEADER_REWRITES = /* @__PURE__ */ new Set([
+  "host",
+  "origin",
+  "referer",
+  "sec-fetch-site",
+  "sec-fetch-mode",
+  "sec-fetch-dest"
+]);
 function applyFetchProxyCors(res) {
   for (const [key, value] of Object.entries(FETCH_PROXY_CORS_HEADERS)) {
     res.setHeader(key, value);
@@ -2942,6 +2961,18 @@ function buildFetchProxyHeaders(reqHeaders, targetUrl) {
   );
   return headers;
 }
+function buildAppApiProxyHeaders(reqHeaders, targetUrl) {
+  const headers = {};
+  for (const [key, value] of Object.entries(reqHeaders)) {
+    if (!value) continue;
+    if (APP_API_HEADER_REWRITES.has(key.toLowerCase())) continue;
+    headers[key] = value;
+  }
+  headers.host = targetUrl.host;
+  headers.origin = targetUrl.origin;
+  headers.referer = `${targetUrl.origin}/`;
+  return headers;
+}
 function isFetchProxyRequestUrl(rawUrl) {
   return rawUrl?.startsWith("/__fetch-proxy?") || rawUrl?.startsWith("/__proxy?") || false;
 }
@@ -3052,9 +3083,7 @@ function handleAppApiRequest(req, res) {
     return true;
   }
   const transport = targetUrl.protocol === "https:" ? import_https.default : import_http2.default;
-  const fwdHeaders = { ...req.headers };
-  delete fwdHeaders.host;
-  fwdHeaders.host = targetUrl.host;
+  const fwdHeaders = buildAppApiProxyHeaders(req.headers, targetUrl);
   const proxyReq = transport.request(
     {
       hostname: targetUrl.hostname,
@@ -3232,6 +3261,180 @@ async function openUrl(url, options = {}) {
   await launchUrl(url, options);
 }
 
+// src/host/websocket-proxy.ts
+var import_ws = require("ws");
+var WEBSOCKET_PROXY_PATH = "/__websocket-proxy";
+var STRIP_UPSTREAM_HEADERS = /* @__PURE__ */ new Set([
+  "host",
+  "connection",
+  "upgrade",
+  "transfer-encoding",
+  "content-length",
+  "sec-websocket-accept",
+  "sec-websocket-extensions",
+  "sec-websocket-key",
+  "sec-websocket-protocol",
+  "sec-websocket-version"
+]);
+function rejectUpgrade(socket, status, message) {
+  try {
+    socket.write(
+      `HTTP/1.1 ${status} ${message}\r
+Connection: close\r
+Content-Type: text/plain\r
+Content-Length: ${message.length}\r
+\r
+${message}`
+    );
+  } catch {
+  }
+  socket.destroy();
+}
+function isSameOriginUpgrade(req) {
+  const origin = req.headers.origin;
+  const host = req.headers.host;
+  if (!origin || !host) return false;
+  try {
+    return new URL(origin).host === host;
+  } catch {
+    return false;
+  }
+}
+function decodeProxyHeaders(encoded) {
+  if (!encoded) return {};
+  const base64 = encoded.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+  const parsed = JSON.parse(Buffer.from(padded, "base64").toString("utf8"));
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+  const headers = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    if (value == null) continue;
+    if (STRIP_UPSTREAM_HEADERS.has(key.toLowerCase())) continue;
+    headers[key] = Array.isArray(value) ? value.join(", ") : String(value);
+  }
+  return headers;
+}
+function getDefaultWebSocketOrigin(targetUrl) {
+  const origin = new URL(targetUrl.href);
+  origin.protocol = targetUrl.protocol === "wss:" ? "https:" : "http:";
+  return origin.origin;
+}
+function getRequestedProtocols(req) {
+  const header = req.headers["sec-websocket-protocol"];
+  const value = Array.isArray(header) ? header.join(",") : header || "";
+  return value.split(",").map((part) => part.trim()).filter(Boolean);
+}
+function safeClose(ws, code, reason) {
+  if (ws.readyState === import_ws.WebSocket.CLOSED || ws.readyState === import_ws.WebSocket.CLOSING) {
+    return;
+  }
+  try {
+    ws.close(code, reason);
+  } catch {
+    ws.terminate();
+  }
+}
+function connectProxyPair(clientWs, upstream) {
+  let closing = false;
+  const closeBoth = (source, target, code, reason) => {
+    if (closing) return;
+    closing = true;
+    safeClose(target, code, reason.toString());
+    if (source.readyState === import_ws.WebSocket.OPEN) {
+      safeClose(source, code, reason.toString());
+    }
+  };
+  clientWs.on("message", (data, isBinary) => {
+    if (upstream.readyState === import_ws.WebSocket.OPEN) {
+      upstream.send(data, { binary: isBinary });
+    }
+  });
+  upstream.on("message", (data, isBinary) => {
+    if (clientWs.readyState === import_ws.WebSocket.OPEN) {
+      clientWs.send(data, { binary: isBinary });
+    }
+  });
+  clientWs.on("close", (code, reason) => closeBoth(clientWs, upstream, code, reason));
+  upstream.on("close", (code, reason) => closeBoth(upstream, clientWs, code, reason));
+  clientWs.on("error", () => safeClose(upstream, 1011, "proxy client error"));
+  upstream.on("error", () => safeClose(clientWs, 1011, "upstream websocket error"));
+}
+function createUpstreamWebSocket(targetUrl, protocols, headers) {
+  const upstreamHeaders = { ...headers };
+  if (!Object.keys(upstreamHeaders).some((key) => key.toLowerCase() === "origin")) {
+    upstreamHeaders.origin = getDefaultWebSocketOrigin(targetUrl);
+  }
+  return new import_ws.WebSocket(targetUrl.href, protocols, {
+    headers: upstreamHeaders
+  });
+}
+function isWebSocketProxyRequestUrl(rawUrl) {
+  if (!rawUrl) return false;
+  try {
+    return new URL(rawUrl, "http://localhost").pathname === WEBSOCKET_PROXY_PATH;
+  } catch {
+    return false;
+  }
+}
+function handleWebSocketProxyUpgrade(req, socket, head) {
+  if (!isWebSocketProxyRequestUrl(req.url)) return false;
+  if (!isSameOriginUpgrade(req)) {
+    rejectUpgrade(socket, 403, "forbidden websocket proxy origin");
+    return true;
+  }
+  let targetUrl;
+  let headers;
+  try {
+    const requestUrl = new URL(req.url || "/", "http://localhost");
+    const target = requestUrl.searchParams.get("url");
+    if (!target) {
+      rejectUpgrade(socket, 400, "missing websocket proxy url");
+      return true;
+    }
+    targetUrl = new URL(target);
+    if (targetUrl.protocol !== "ws:" && targetUrl.protocol !== "wss:") {
+      rejectUpgrade(socket, 400, "invalid websocket proxy protocol");
+      return true;
+    }
+    headers = decodeProxyHeaders(requestUrl.searchParams.get("headers"));
+  } catch {
+    rejectUpgrade(socket, 400, "invalid websocket proxy request");
+    return true;
+  }
+  const protocols = getRequestedProtocols(req);
+  const upstream = createUpstreamWebSocket(targetUrl, protocols, headers);
+  let completed = false;
+  socket.once("close", () => {
+    if (!completed) upstream.terminate();
+  });
+  upstream.once("open", () => {
+    if (completed) return;
+    completed = true;
+    const selectedProtocol = upstream.protocol;
+    const proxyServer = new import_ws.WebSocketServer({
+      noServer: true,
+      clientTracking: false,
+      handleProtocols(requestedProtocols) {
+        return selectedProtocol || requestedProtocols.values().next().value || false;
+      }
+    });
+    proxyServer.handleUpgrade(req, socket, head, (clientWs) => {
+      connectProxyPair(clientWs, upstream);
+    });
+  });
+  upstream.once("error", () => {
+    if (completed) return;
+    completed = true;
+    rejectUpgrade(socket, 502, "upstream websocket error");
+  });
+  upstream.once("close", () => {
+    if (completed) return;
+    completed = true;
+    rejectUpgrade(socket, 502, "upstream websocket closed");
+  });
+  return true;
+}
+
 // src/host/bridge-host.ts
 var WRITE_COMMAND_TYPES = /* @__PURE__ */ new Set(["tap", "keyboard"]);
 var FORCE_CLOSE_GRACE_MS = 2e3;
@@ -3446,8 +3649,14 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
 `);
         });
         this.httpServer = server;
-        this.wss = new import_ws.WebSocketServer({ server });
+        this.wss = new import_ws2.WebSocketServer({ noServer: true });
         this.wireWebSocketServer();
+        server.on("upgrade", (req, socket, head) => {
+          if (handleWebSocketProxyUpgrade(req, socket, head)) return;
+          this.wss?.handleUpgrade(req, socket, head, (ws) => {
+            this.wss?.emit("connection", ws, req);
+          });
+        });
         resolve2();
       });
     });
@@ -3611,7 +3820,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
               config: next
             });
             for (const peer of this.sims.values()) {
-              if (peer.ws.readyState !== import_ws.WebSocket.OPEN) continue;
+              if (peer.ws.readyState !== import_ws2.WebSocket.OPEN) continue;
               try {
                 peer.ws.send(payload);
               } catch {
@@ -3667,7 +3876,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
           const entry = this.cliBySentId.get(msg.id);
           if (entry) {
             this.cliBySentId.delete(msg.id);
-            if (entry.ws.readyState === import_ws.WebSocket.OPEN) {
+            if (entry.ws.readyState === import_ws2.WebSocket.OPEN) {
               const otherCliCount = this.getOtherCliIdentityCount(entry.ws, entry.simId);
               const response = otherCliCount > 0 ? { ...msg, id: entry.originalId, _otherCliCount: otherCliCount } : { ...msg, id: entry.originalId };
               entry.ws.send(JSON.stringify(response));
@@ -3695,7 +3904,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
               if (typeof msg.cliLabel === "string" && msg.cliLabel.trim()) {
                 this.cliLabelBySocket.set(ws, msg.cliLabel.trim());
               }
-              if (ws.readyState === import_ws.WebSocket.OPEN) {
+              if (ws.readyState === import_ws2.WebSocket.OPEN) {
                 ws.send(
                   JSON.stringify({
                     id: msg.id,
@@ -3710,7 +3919,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
               return;
             }
             if (msg.type === "bridge:list-sims") {
-              if (ws.readyState === import_ws.WebSocket.OPEN) {
+              if (ws.readyState === import_ws2.WebSocket.OPEN) {
                 ws.send(
                   JSON.stringify({
                     id: msg.id,
@@ -3725,7 +3934,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
                 throw new Error("bridge:open requires a url");
               }
               await this.openUrl(msg.url, { newWindow: msg.newWindow === true });
-              if (ws.readyState === import_ws.WebSocket.OPEN) {
+              if (ws.readyState === import_ws2.WebSocket.OPEN) {
                 ws.send(
                   JSON.stringify({
                     id: msg.id,
@@ -3741,7 +3950,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
                 force: msg.force === true
               });
               if (!outcome.granted) {
-                if (ws.readyState === import_ws.WebSocket.OPEN) {
+                if (ws.readyState === import_ws2.WebSocket.OPEN) {
                   ws.send(
                     JSON.stringify({
                       id: msg.id,
@@ -3757,7 +3966,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
                 targetSim2.id,
                 outcome.bootedCount > 0 ? `cli force-claimed sim (booted ${outcome.bootedCount})` : "cli claimed sim"
               );
-              if (ws.readyState === import_ws.WebSocket.OPEN) {
+              if (ws.readyState === import_ws2.WebSocket.OPEN) {
                 ws.send(
                   JSON.stringify({
                     id: msg.id,
@@ -3776,7 +3985,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
             if (shouldAcquireLease(msg)) {
               const outcome = this.tryAcquireLease(ws, targetSim);
               if (!outcome.granted) {
-                if (ws.readyState === import_ws.WebSocket.OPEN) {
+                if (ws.readyState === import_ws2.WebSocket.OPEN) {
                   ws.send(
                     JSON.stringify({
                       id: msg.id,
@@ -3802,7 +4011,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
             targetSim.ws.send(JSON.stringify({ ...forwarded, id: sentId }));
             if (forwarded.type === "close") {
               this.cliBySentId.delete(sentId);
-              if (ws.readyState === import_ws.WebSocket.OPEN) {
+              if (ws.readyState === import_ws2.WebSocket.OPEN) {
                 ws.send(
                   JSON.stringify({
                     id: msg.id,
@@ -3817,7 +4026,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
               unrefTimer(closeTimer);
             }
           } catch (err) {
-            if (ws.readyState === import_ws.WebSocket.OPEN) {
+            if (ws.readyState === import_ws2.WebSocket.OPEN) {
               ws.send(
                 JSON.stringify({
                   id: msg.id,
@@ -3842,7 +4051,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
           }
           for (const [sentId, entry] of this.cliBySentId) {
             if (entry.simId !== sim.id) continue;
-            if (entry.ws.readyState === import_ws.WebSocket.OPEN) {
+            if (entry.ws.readyState === import_ws2.WebSocket.OPEN) {
               entry.ws.send(
                 JSON.stringify({
                   id: entry.originalId,
@@ -4048,7 +4257,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       runtimeDir: this.activeRuntimeDirPath
     });
     for (const sim of this.sims.values()) {
-      if (sim.ws.readyState === import_ws.WebSocket.OPEN) {
+      if (sim.ws.readyState === import_ws2.WebSocket.OPEN) {
         try {
           sim.ws.send(payload);
         } catch {
@@ -4373,7 +4582,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
   sweepDeadWebSockets() {
     if (!this.wss) return;
     for (const ws of this.wss.clients) {
-      if (ws.readyState !== import_ws.WebSocket.OPEN) continue;
+      if (ws.readyState !== import_ws2.WebSocket.OPEN) continue;
       const alive = this.wsIsAlive.get(ws);
       if (alive === false) {
         try {
@@ -4394,7 +4603,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
     }
   }
   closeSimSocketFromHost(ws) {
-    if (ws.readyState !== import_ws.WebSocket.OPEN) return;
+    if (ws.readyState !== import_ws2.WebSocket.OPEN) return;
     try {
       ws.close(SOOTSIM_BRIDGE_SIM_CLOSE_CODE, SOOTSIM_BRIDGE_SIM_CLOSE_REASON);
     } catch {
@@ -4405,7 +4614,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       return;
     }
     const terminateTimer = setTimeout(() => {
-      if (ws.readyState === import_ws.WebSocket.CLOSED) return;
+      if (ws.readyState === import_ws2.WebSocket.CLOSED) return;
       try {
         ws.terminate();
       } catch {
@@ -4554,7 +4763,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
     try {
       readyState = sim.ws.readyState;
     } catch {
-      readyState = import_ws.WebSocket.CLOSED;
+      readyState = import_ws2.WebSocket.CLOSED;
     }
     const lease = this.getActiveLease(sim);
     return {
@@ -4567,7 +4776,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
       lastSeenAt: sim.lastSeenAt,
       lastActiveAt: sim.lastActiveAt || void 0,
       isPrimary: sim.id === this.primarySimId,
-      readyState: readyState === import_ws.WebSocket.OPEN ? "open" : readyState === import_ws.WebSocket.CLOSING ? "closing" : "closed",
+      readyState: readyState === import_ws2.WebSocket.OPEN ? "open" : readyState === import_ws2.WebSocket.CLOSING ? "closing" : "closed",
       attachedCliCount: this.getAttachedCliCount(sim.id),
       lockedBy: lease ? lease.cliLabel || lease.cliIdentityKey : void 0,
       lockedByKind: lease ? lease.kind : void 0,
@@ -4684,18 +4893,18 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
   getOpenSim(simId) {
     if (simId) {
       const sim = this.sims.get(simId);
-      if (sim?.ws.readyState === import_ws.WebSocket.OPEN) return sim;
+      if (sim?.ws.readyState === import_ws2.WebSocket.OPEN) return sim;
       return null;
     }
     const primary = this.primarySimId != null ? this.sims.get(this.primarySimId) : null;
-    if (primary?.ws.readyState === import_ws.WebSocket.OPEN && primary.url) return primary;
+    if (primary?.ws.readyState === import_ws2.WebSocket.OPEN && primary.url) return primary;
     let pagelessFallback = null;
     for (const sim of this.sims.values()) {
-      if (sim.ws.readyState !== import_ws.WebSocket.OPEN) continue;
+      if (sim.ws.readyState !== import_ws2.WebSocket.OPEN) continue;
       if (sim.url) return sim;
       pagelessFallback ??= sim;
     }
-    if (primary?.ws.readyState === import_ws.WebSocket.OPEN) return primary;
+    if (primary?.ws.readyState === import_ws2.WebSocket.OPEN) return primary;
     return pagelessFallback;
   }
   async waitForSim(simId, options = {}) {
@@ -4711,7 +4920,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
   shouldPromoteSim(sim) {
     const current = this.primarySimId ? this.sims.get(this.primarySimId) : null;
     if (!sim.url) return !current;
-    const currentAlive = current?.ws.readyState === import_ws.WebSocket.OPEN;
+    const currentAlive = current?.ws.readyState === import_ws2.WebSocket.OPEN;
     if (!current || !currentAlive || !current.url) return true;
     const isPrimaryCandidate = sim.origin?.includes(":5173");
     const currentIsPrimary = current.origin?.includes(":5173");
@@ -4719,7 +4928,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
   }
   broadcastSimAssignments() {
     for (const sim of this.sims.values()) {
-      if (sim.ws.readyState !== import_ws.WebSocket.OPEN) continue;
+      if (sim.ws.readyState !== import_ws2.WebSocket.OPEN) continue;
       sim.ws.send(
         JSON.stringify({
           type: "bridge:welcome",
@@ -4731,7 +4940,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
   }
   broadcastSimClientStates() {
     for (const sim of this.sims.values()) {
-      if (sim.ws.readyState !== import_ws.WebSocket.OPEN) continue;
+      if (sim.ws.readyState !== import_ws2.WebSocket.OPEN) continue;
       const lease = this.getActiveLease(sim);
       const message = {
         type: "bridge:client-state",
@@ -4796,7 +5005,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
     const keys = /* @__PURE__ */ new Set();
     for (const [ws, attachedSimId] of this.cliSimBySocket) {
       if (attachedSimId !== simId) continue;
-      if (ws.readyState !== import_ws.WebSocket.OPEN) continue;
+      if (ws.readyState !== import_ws2.WebSocket.OPEN) continue;
       const key = this.cliIdentityKeyBySocket.get(ws);
       keys.add(key ?? `ws-unknown-${keys.size}`);
     }
@@ -4809,7 +5018,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
     const keys = /* @__PURE__ */ new Set();
     for (const [ws, attachedSimId] of this.cliSimBySocket) {
       if (attachedSimId !== simId) continue;
-      if (ws.readyState !== import_ws.WebSocket.OPEN) continue;
+      if (ws.readyState !== import_ws2.WebSocket.OPEN) continue;
       const key = this.cliIdentityKeyBySocket.get(ws);
       if (key && key === selfKey) continue;
       keys.add(key ?? `ws-unknown-${keys.size}`);
@@ -4834,7 +5043,7 @@ var SootSimBridgeHost = class _SootSimBridgeHost {
     const nextId = requestedId?.trim();
     if (!nextId || nextId === sim.id) return false;
     const existing = this.sims.get(nextId);
-    if (existing && existing !== sim && existing.ws.readyState === import_ws.WebSocket.OPEN) {
+    if (existing && existing !== sim && existing.ws.readyState === import_ws2.WebSocket.OPEN) {
       return false;
     }
     const restorable = this.getRestorableSimState(nextId);