stim 1.20.2 → 1.21.0

package/dist/{workspaces-C36s2jb9.mjs → workspaces-BccMFmGQ.mjs}

@@ -1,38 +1,60 @@
-import { A as acquireAvdClaim, D as withConfigLock$1, F as listMountedVolumes, I as measuredDirectorySize, N as formatBytes, P as isOnMountedVolume, V as deviceSlotPlatforms, W as projectDeviceSlots, _ as loadConfig$1, d as getConfigDir, g as isPathPrefix, j as ownership_claim_exports, k as process_identity_exports, p as getProject } from "./config-BYDxlMY3.mjs";
-import { t as getExecutor } from "./exec-DqKo9GKJ.mjs";
-import { Dt as repoRoot, ct as resolveTailscaleBinary } from "./settings-B717odTD.mjs";
-import { h as listBuildLocks } from "./device-lease-BX1sJQ2E.mjs";
-import { T as workspaceName, r as readWorkspaceState$1, s as workspaceLastUsed, x as workspaceDir, y as workspaceAgentDeviceDir } from "./workspace-state-DJt_MMvf.mjs";
+import { c as stopDeclaringSpawnsOn, f as ownership_claim_exports, i as declareSpawnsOn, p as process_identity_exports, t as getExecutor } from "./exec-_UbtCQcG.mjs";
+import { d as workspaceDir, h as workspaceName$1, l as workspaceAgentDeviceDir } from "./paths-DQtTgsBf.mjs";
+import { D as withConfigLock$1, F as isOnMountedVolume, I as listMountedVolumes, K as projectDeviceSlots, O as withConfigLockAsync$1, P as formatBytes, R as measuredDirectorySizeAsync, U as deviceSlotPlatforms, _ as loadConfig$1, d as getConfigDir, g as isPathPrefix, j as acquireAvdClaim, p as getProject } from "./config-CYcBF478.mjs";
 import { t as createLineReader } from "./process-output-Fpl8PYi8.mjs";
-import { a as formatElapsed, l as phaseLine } from "./command-output-BTy8hZ0F.mjs";
-import { B as ownedAvdSystemImage, I as ownedAvdDirectory, J as resolveOwnedAvdSerial, L as ownedAvdMatchesConfiguration, M as listOrphanedAvdDirectories, O as listAdbDevices, X as shutdownAndroidEmulator, Z as sleepSync, _ as avdStorageRoots, ct as eraseParkedAfter, et as waitForAndroidEmulatorShutdown, f as assertOwnedAvdStopped, ft as readParked, h as avdPathExists, nt as wipeAvdUserData, pt as removeParkedAfter, rt as isStimOwnedAvd, ut as parkSim, x as deleteAvd } from "./android-Mz_Inn3w.mjs";
-import { n as readCreatedDevices$1, r as recordCreatedDevice, t as forgetCreatedDevice } from "./created-devices-Dzd5C2LF.mjs";
-import { d as signalProcessTree, s as pidExists } from "./metro-DnCEjCxs.mjs";
-import { n as declareSpawnsOn, o as stopDeclaringSpawnsOn } from "./spawn-claims-DVS5RkMS.mjs";
-import { a as withWorkspaceProcessLock, o as workspaceProcessLockError, r as releaseBrowserPort, s as workspaceProcessLockPath } from "./named-ports-4WopRPg-.mjs";
-import { _ as removeSingletonFiles, c as webClaimRoot, f as webProfileDir, g as liveProfileHolder, h as chromeProcessState, i as clearWebRecord, o as readWebRecord, t as CDP_PORT_LABEL, u as webFacts } from "./state-D1Icyjlu.mjs";
-import { t as agentDeviceDaemon, u as readAgentDeviceRecords } from "./activity-BSV745Kz.mjs";
-import { E as resolveOwnedIosSim, O as shutdownIosSim, S as renameIosSim, c as eraseIosSim, o as deleteIosSim, p as listIosDeviceTypes, s as deleteParkedIosSim, v as parkedSimName, y as parseRuntimeVersion } from "./ios-RkW4pnQf.mjs";
-import { a as macosRuntimeClaim, n as macosDir } from "./state-CG_OFoaA.mjs";
-import { closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync } from "node:fs";
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { basename as basename$1, isAbsolute as isAbsolute$1, join as join$1, relative as relative$1, resolve as resolve$1 } from "path";
-import { buildSlotsDir, hostedNativeRecords, isJsonObject, macosAppState, parseHostedNativePlacement, readJsonFile, readMacosRecord, requireAutomaticMachine, tryAcquireBuildSlotClaim, unreadableHostedNative } from "@stim-cli/core/state";
-import { existsSync as existsSync$1, lstatSync as lstatSync$1, readdirSync as readdirSync$1, realpathSync as realpathSync$1, rmSync as rmSync$1, statSync as statSync$1 } from "fs";
+import { a as formatElapsed, l as phaseLine } from "./command-output-B1UrjZHL.mjs";
+import { l as withWorkspaceStateLockAsync, r as readWorkspaceState$1, u as workspaceLastUsed } from "./workspace-state-Cjuigeeu.mjs";
+import { It as repoRootAsync, Qt as cancellableSleep, en as throwIfCancelled, ut as resolveTailscaleBinary } from "./settings-CsJDEXgK.mjs";
+import { a as macosRuntimeClaim, n as macosDir } from "./state-XMziexv2.mjs";
+import { l as pidExists, m as signalProcessTreeAsync, p as signalProcessTree } from "./metro-DEXpIhHC.mjs";
+import { _ as chromeProcessStateAsync, c as webClaimRoot, i as clearWebRecord, o as readWebRecord, p as webProfileDir, t as CDP_PORT_LABEL, u as webFacts, v as liveProfileHolder, y as removeSingletonFiles } from "./state-C4ZtUisW.mjs";
+import { t as canonicalPath } from "./paths-BsJMoPP2.mjs";
+import { N as listBuildLocks, d as readAgentDeviceRecords, t as agentDeviceDaemon } from "./activity-BzVfHSrY.mjs";
+import { n as readCreatedDevices$1, r as recordCreatedDevice, t as forgetCreatedDevice } from "./created-devices-CqeBlrEn.mjs";
+import { A as listAdbDevicesAsync, B as ownedAvdMatchesConfiguration, F as listOrphanedAvdDirectories, Q as resolveOwnedAvdSerialAsync, W as ownedAvdSystemImage, _ as avdStorageRoots, _t as removeParkedAfter, at as wipeAvdUserData, et as shutdownAndroidEmulator, f as assertOwnedAvdStopped, ft as eraseParkedAfter, gt as readParked, h as avdPathExists, mt as parkSim, rt as waitForAndroidEmulatorShutdown, st as isStimOwnedAvd, x as deleteAvd, z as ownedAvdDirectory } from "./android-DUYkNF4u.mjs";
+import { E as resolveOwnedIosSim, O as shutdownIosSim, S as renameIosSim, c as eraseIosSim, f as listAllIosSimsAsync, o as deleteIosSim, p as listIosDeviceTypesAsync, s as deleteParkedIosSim, v as parkedSimName, y as parseRuntimeVersion } from "./ios-CpByZy12.mjs";
+import { n as workspaceProcessLockError, r as workspaceProcessLockPath, t as withWorkspaceProcessLock } from "./workspace-process-lock-1_1OoVW5.mjs";
+import { r as releaseBrowserPort } from "./named-ports-BWTzt6mu.mjs";
 import { createHash, randomUUID } from "node:crypto";
+import { closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, watch, writeFileSync } from "node:fs";
+import { isDeepStrictEqual } from "node:util";
 import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { ambientContext, ambientEnv, ambientWrite } from "@stim-cli/core";
+import { buildSlotsDir, hostedNativeRecords, isJsonObject, macosAppState, parseHostedNativePlacement, readJsonFile, readMacosRecord, requireAutomaticMachine, tryAcquireBuildSlotClaim, unreadableHostedNative } from "@stim-cli/core/state";
+import { basename as basename$1, isAbsolute as isAbsolute$1, join as join$1, relative as relative$1 } from "path";
 import chalk from "chalk";
-import { isDeepStrictEqual } from "node:util";
+import { existsSync as existsSync$1, lstatSync as lstatSync$1, readdirSync as readdirSync$1, rmSync as rmSync$1, statSync as statSync$1 } from "fs";
 import { resolve4 } from "node:dns/promises";
 import { request } from "node:https";
+//#region src/commands/gc/results.ts
+const results = [];
+function recordGcResult(kind, status, label, { id = null, bytes = null, detail = null } = {}) {
+	results.push({
+		kind,
+		status,
+		label,
+		id,
+		bytes,
+		detail
+	});
+}
+function takeGcResults() {
+	return results.splice(0);
+}
+const GC_OUTPUT = {
+	log: (line) => console.log(line),
+	record: recordGcResult,
+	fail: () => {
+		process.exitCode = 1;
+	}
+};
+//#endregion
 //#region src/engine/build-slots.ts
 const SLOT_PREFIX = "slot-";
 const SLOT_POLL_MS = 1e3;
 const SLOT_PROGRESS_MS = 3e4;
 const SLOT_CEILING_MS = 54e5;
-function sleepAsync$1(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
-}
 function toRecord(holder) {
 	const details = holder.details;
 	return {
@@ -56,7 +78,7 @@ function tryAcquireBuildSlot({ max, root = null, logFile = null }) {
 		}
 	});
 	if (!got) return null;
-	declareSpawnsOn(got.claim);
+	declareSpawnsOn(ambientContext(), got.claim);
 	return {
 		acquired: true,
 		path: got.path,
@@ -74,7 +96,11 @@ function tryAcquireBuildSlot({ max, root = null, logFile = null }) {
 function slotWaitingLine({ max, elapsedMs }) {
 	return `${"build".padEnd(11)} waiting for a build slot (all ${max} in use, ${formatElapsed(elapsedMs)} elapsed) -- stim guide lifecycle concurrency`;
 }
-async function acquireBuildSlot({ max, root = null, logFile = null, now = Date.now, out = () => {}, waitingFor = () => {}, sleep = sleepAsync$1, intervalMs = SLOT_POLL_MS, progressMs = SLOT_PROGRESS_MS, ceilingMs = SLOT_CEILING_MS, automatic = false }) {
+async function acquireBuildSlot({ max, root = null, logFile = null, now = Date.now, out = () => {}, waitingFor = () => {}, signal, sleep = (ms) => cancellableSleep(ms, {
+	signal,
+	what: "build slot"
+}), intervalMs = SLOT_POLL_MS, progressMs = SLOT_PROGRESS_MS, ceilingMs = SLOT_CEILING_MS, automatic = false }) {
+	throwIfCancelled(signal, "build slot");
 	if (automatic) requireAutomaticMachine("build", "local");
 	if (!max || max <= 0) return {
 		acquired: true,
@@ -85,6 +111,7 @@ async function acquireBuildSlot({ max, root = null, logFile = null, now = Date.n
 	let waited = false;
 	try {
 		for (;;) {
+			throwIfCancelled(signal, "build slot");
 			if (automatic) requireAutomaticMachine("build", "local");
 			const got = tryAcquireBuildSlot({
 				max,
@@ -123,7 +150,7 @@ async function acquireBuildSlot({ max, root = null, logFile = null, now = Date.n
 }
 function releaseBuildSlot(handle) {
 	if (!handle || handle.unlimited) return false;
-	stopDeclaringSpawnsOn(handle.claim);
+	stopDeclaringSpawnsOn(ambientContext(), handle.claim);
 	return (0, ownership_claim_exports.releaseClaim)(handle.claim);
 }
 function listBuildSlots() {
@@ -162,59 +189,49 @@ function listBuildSlots() {
 	return slots;
 }
 //#endregion
-//#region src/supervisor/ownership.ts
-function resolveSupervisorTarget({ state, record, reservedPort, isAlive = pidExists, inspectIdentity = process_identity_exports.inspectProcessIdentity } = {}) {
-	const statePid = numberOrNull(state?.pid);
-	const recordPid = numberOrNull(record?.pid);
-	const pid = statePid ?? recordPid;
-	if (!pid) return { status: "none" };
-	if (statePid && recordPid && statePid !== recordPid) return {
-		status: "unverified",
-		pid,
-		reason: `workspace state.json records supervisor pid ${statePid} but the registry records pid ${recordPid}`
-	};
-	if (!isAlive(pid)) return {
-		status: "stale",
-		pid
-	};
-	const port = numberOrNull(state?.port) ?? numberOrNull(record?.port);
-	if (reservedPort !== null && reservedPort !== void 0 && port !== null && port !== reservedPort) return {
-		status: "unverified",
-		pid,
-		reason: `supervisor pid ${pid} records port ${port}, but this project reserved port ${reservedPort}`
-	};
-	if (reservedPort !== null && reservedPort !== void 0 && port === null) return {
-		status: "unverified",
-		pid,
-		reason: `supervisor pid ${pid} has no recorded port, so it cannot be matched against reserved port ${reservedPort}`
-	};
-	const identityRecord = statePid ? state : record;
-	if (statePid && recordPid && state?.processToken !== record?.processToken) return {
-		status: "unverified",
-		pid,
-		reason: "workspace state and registry process identities disagree"
-	};
-	const identity = inspectIdentity(identityRecord);
-	if (identity === "gone" || identity === "different") return {
-		status: "stale",
-		pid
-	};
-	if (identity !== "same") return {
-		status: "unverified",
-		pid,
-		reason: "the recorded process identity could not be verified"
-	};
+//#region src/devices/report-only-usage.ts
+function canonical$1(path) {
+	try {
+		return realpathSync.native(path);
+	} catch {
+		return resolve(path);
+	}
+}
+function parseDu(output) {
+	const sizes = /* @__PURE__ */ new Map();
+	for (const line of output.split("\n")) {
+		const match = /^(\d+)\t(.+?)\r?$/.exec(line);
+		if (match) sizes.set(resolve(match[2]), Number(match[1]) * 1024);
+	}
+	return sizes;
+}
+async function measureDu(args) {
+	let output = "";
+	let complete = true;
+	try {
+		output = await getExecutor().runFileAsync("du", args, { timeoutMs: 2e4 });
+	} catch (error) {
+		complete = false;
+		const failure = error;
+		if (failure.status === 1 && !failure.code && typeof failure.stdout === "string") output = failure.stdout;
+	}
 	return {
-		status: "ours",
-		processToken: identityRecord.processToken,
-		pid,
-		port,
-		mode: state?.mode ?? record?.mode ?? null,
-		startedAt: state?.startedAt ?? record?.startedAt ?? null
+		sizes: parseDu(output),
+		complete
 	};
 }
-function numberOrNull(v) {
-	return typeof v === "number" && Number.isSafeInteger(v) && v > 0 ? v : null;
+function writeUsageCache(file, value, signal) {
+	signal?.throwIfAborted();
+	const temporary = `${file}.${randomUUID()}.tmp`;
+	try {
+		mkdirSync(dirname(file), { recursive: true });
+		writeFileSync(temporary, JSON.stringify(value));
+		renameSync(temporary, file);
+	} catch {
+		try {
+			rmSync(temporary, { force: true });
+		} catch {}
+	}
 }
 //#endregion
 //#region src/engine/public-http-probe.ts
@@ -275,1012 +292,545 @@ async function probePublicHttp(url, signal) {
 	});
 }
 //#endregion
-//#region src/engine/tunnel.ts
-function tunnelArgv(provider, port, ngrokUrl, logFile, tailscaleBinary = "tailscale") {
-	if (provider === "tailscale") return {
-		bin: tailscaleBinary,
-		args: [
-			"serve",
-			`--https=${port}`,
-			`http://127.0.0.1:${port}`
-		]
-	};
-	if (provider === "cloudflared") return {
-		bin: "cloudflared",
-		args: [
-			"tunnel",
-			"--url",
-			`http://127.0.0.1:${port}`,
-			...logFile ? ["--logfile", logFile] : []
-		]
-	};
-	return {
-		bin: "ngrok",
-		args: [
-			"http",
-			String(port),
-			`--log=${logFile || "stdout"}`,
-			"--log-format=json",
-			...ngrokUrl ? ["--url", ngrokUrl] : []
-		]
-	};
+//#region src/devices/agent-device-cleanup.ts
+function parseAgentDeviceSessions(output) {
+	const result = JSON.parse(output);
+	if (result?.success !== true || !Array.isArray(result.data?.sessions)) throw new Error("agent-device did not return a successful session list");
+	return result.data.sessions.flatMap((entry) => {
+		if (!entry || typeof entry !== "object") return [];
+		const row = entry;
+		const id = row.platform === "ios" ? row.device_udid : row.id;
+		if (row.platform !== "ios" && row.platform !== "android" || typeof row.name !== "string" || !row.name.trim() || typeof id !== "string" || !id || typeof row.createdAt !== "number" || !Number.isFinite(row.createdAt) || row.platform === "ios" && row.id !== void 0 && row.id !== id) return [];
+		return [{
+			name: typeof row.address === "string" && row.address.trim() ? row.address : row.name,
+			platform: row.platform,
+			id,
+			device: typeof row.device === "string" ? row.device : null,
+			createdAt: row.createdAt
+		}];
+	});
 }
-const CLOUDFLARED_URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/i;
-function parseCloudflaredLine(line) {
-	const match = line.match(CLOUDFLARED_URL_RE);
-	return match ? match[0] : null;
+function isOwnDeviceSession(session, device, owner) {
+	if (session.platform !== device.platform || device.id !== null && session.id !== device.id) return false;
+	if (device.platform === "android" && session.device !== device.avdName.replaceAll("_", " ")) return false;
+	if (!owner) return true;
+	return owner.claims.some((claim) => claim.deviceId === session.id && claim.session === session.name && claim.workspace !== null && (within(owner.workspace, claim.workspace) || claim.workspace === owner.repoRoot));
 }
-function parseNgrokLine(line) {
-	let data;
+function within(root, path) {
+	const rest = relative(root, path);
+	return rest === "" || !isAbsolute(rest) && rest.split(sep)[0] !== "..";
+}
+function canonical(path) {
 	try {
-		data = JSON.parse(line);
+		return realpathSync(path);
 	} catch {
 		return null;
 	}
-	if (typeof data !== "object" || data === null) return null;
-	const url = data.url;
-	return typeof url === "string" && /^https?:\/\//i.test(url) ? url : null;
-}
-function parseTailscaleLine(line) {
-	return /^https:\/\/[^\s/]+\.ts\.net(:\d+)?\/?$/.test(line) ? line : null;
-}
-function parserFor(provider) {
-	if (provider === "tailscale") return parseTailscaleLine;
-	return provider === "cloudflared" ? parseCloudflaredLine : parseNgrokLine;
 }
-const URL_TIMEOUT_MS = 15e3;
-const REACHABLE_TIMEOUT_MS = 24e4;
-const REACHABLE_POLL_MS = 2e3;
-const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
-async function withManagedTunnelLock(root, fn, options = {}) {
-	return withWorkspaceProcessLock(managedTunnelLockRoot(root), "metro-tunnel", fn, {
-		...options,
-		rejectOwnerPurposes: ["workspace removal"]
-	});
-}
-async function withManagedTunnelRemovalLock(root, fn, options = {}) {
-	return withWorkspaceProcessLock(managedTunnelLockRoot(root), "metro-tunnel", fn, {
-		...options,
-		ownerPurpose: "workspace removal"
-	});
-}
-async function withManagedRemoteWorktreeLock(worktreeRoot, fn, options = {}) {
-	return withWorkspaceProcessLock(managedRemoteWorktreeLockRoot(worktreeRoot), "managed-remote", fn, {
-		...options,
-		external: true,
-		rejectOwnerPurposes: ["worktree removal"]
-	});
-}
-async function withManagedRemoteWorktreeRemovalLock(worktreeRoot, fn, options = {}) {
-	return withWorkspaceProcessLock(managedRemoteWorktreeLockRoot(worktreeRoot), "managed-remote", fn, {
-		...options,
-		external: true,
-		ownerPurpose: "worktree removal"
-	});
+function deviceClaims(device) {
+	return readAgentDeviceRecords(ambientEnv().HOME || ambientEnv().USERPROFILE || homedir(), ambientEnv()).filter((record) => record.kind === "claim" && (device.id === null || record.deviceId === device.id)).map((record) => ({
+		deviceId: record.deviceId,
+		session: record.session,
+		workspace: record.workspace && canonical(record.workspace)
+	}));
 }
-function managedLockHolders(root) {
-	const locks = [{
-		label: "managed tunnel",
-		path: workspaceProcessLockPath(managedTunnelLockRoot(root), "metro-tunnel", false)
-	}, {
-		label: "managed remote",
-		path: workspaceProcessLockPath(managedRemoteWorktreeLockRoot(root), "managed-remote", true)
-	}];
-	const reasons = [];
-	for (const { label, path } of locks) {
-		const claims = (0, ownership_claim_exports.readClaimSet)(path);
-		const holder = claims.live[0];
-		if (holder) {
-			const purpose = typeof holder.details.purpose === "string" ? ` for ${holder.details.purpose}` : "";
-			reasons.push(`the ${label} lock is held${purpose}`);
-		} else if (claims.unresolved[0]) reasons.push(`the ${label} lock cannot be resolved: ${claims.unresolved[0].reason}`);
+function explainFailure(error) {
+	const stdout = error?.stdout;
+	let failure;
+	try {
+		failure = typeof stdout === "string" ? JSON.parse(stdout)?.error : void 0;
+	} catch {
+		failure = void 0;
 	}
-	return reasons;
-}
-function managedTunnelLockRoot(root) {
-	const key = createHash("sha256").update(resolve(root)).digest("hex");
-	return join(getConfigDir(), "process-locks", key);
-}
-function managedRemoteWorktreeLockRoot(worktreeRoot) {
-	const key = createHash("sha256").update(resolve(worktreeRoot)).digest("hex");
-	return join(getConfigDir(), "process-locks", "worktrees", key);
+	if (typeof failure?.message !== "string" || !failure.message) return error;
+	const reason = typeof failure.details?.reason === "string" ? ` (${failure.details.reason})` : "";
+	return /* @__PURE__ */ new Error(`agent-device refused: ${failure.message}${reason}`);
 }
-async function defaultProbeReachable(url, signal) {
-	const status = await probePublicHttp(url, signal);
-	return status !== null && status > 0;
+function report(message) {
+	ambientWrite("stderr", `${phaseLine("device", message)}\n`);
 }
-function waitForUrl(child, parseLine, timeoutMs) {
-	return new Promise((resolve) => {
-		let settled = false;
-		let lastLine = null;
-		let timer;
-		let onOut;
-		let onErr;
-		let onError;
-		let onExit;
-		const finish = (url, exited = false) => {
-			if (settled) return;
-			settled = true;
-			clearTimeout(timer);
-			child.stdout?.removeListener("data", onOut);
-			child.stderr?.removeListener("data", onErr);
-			child.removeListener("error", onError);
-			child.removeListener("exit", onExit);
-			resolve({
-				url,
-				exited,
-				lastLine
-			});
-		};
-		const onLine = (line) => {
-			if (settled) return;
-			if (line.trim()) lastLine = line.trim();
-			const url = parseLine(line);
-			if (url) finish(url);
-		};
-		const outReader = createLineReader(onLine);
-		const errReader = createLineReader(onLine);
-		onOut = (chunk) => outReader.push(chunk);
-		onErr = (chunk) => errReader.push(chunk);
-		onError = () => finish(null);
-		onExit = () => {
-			outReader.flush();
-			errReader.flush();
-			finish(null, true);
-		};
-		child.stdout?.setEncoding?.("utf-8");
-		child.stderr?.setEncoding?.("utf-8");
-		child.stdout?.on("data", onOut);
-		child.stderr?.on("data", onErr);
-		child.on("error", onError);
-		child.on("exit", onExit);
-		timer = setTimeout(() => finish(null), timeoutMs);
-	});
-}
-function waitForFileUrl(child, logFile, parseLine, timeoutMs) {
-	return new Promise((resolve) => {
-		let settled = false;
-		const finish = (url, exited = false) => {
-			if (settled) return;
-			settled = true;
-			clearInterval(interval);
-			clearTimeout(timer);
-			child.removeListener("error", onError);
-			child.removeListener("exit", onExit);
-			resolve({
-				url,
-				exited
-			});
+async function closeOwnedDeviceSessions(device, stillOwned, workspace, repoRoot) {
+	const exec = getExecutor();
+	try {
+		if (!exec.findExecutable("agent-device")) return;
+		const root = workspace === void 0 ? void 0 : canonical(workspace);
+		if (root === null) return;
+		const owner = root === void 0 ? void 0 : {
+			workspace: root,
+			repoRoot: repoRoot && (canonical(repoRoot) ?? void 0),
+			claims: deviceClaims(device)
 		};
-		const probe = () => {
+		const stateDir = root === void 0 ? void 0 : workspaceAgentDeviceDir(root);
+		const stateDirs = [void 0, ...stateDir && !["none", "dead"].includes(agentDeviceDaemon(stateDir)) ? [stateDir] : []];
+		for (const dir of stateDirs) {
+			const deadline = Date.now() + 15e3;
+			const run = async (args) => {
+				const remaining = deadline - Date.now();
+				if (remaining <= 0) throw new Error("agent-device cleanup timed out");
+				try {
+					return await exec.runFileAsync("agent-device", [
+						...args,
+						...dir ? ["--state-dir", dir] : [],
+						"--json",
+						"--daemon-transport",
+						"socket"
+					], {
+						timeoutMs: Math.min(5e3, remaining),
+						killSignal: "SIGKILL"
+					});
+				} catch (error) {
+					throw explainFailure(error);
+				}
+			};
+			const list = async () => parseAgentDeviceSessions(await run([
+				"session",
+				"list",
+				"--session",
+				"stim-teardown-inventory"
+			]));
 			try {
-				for (const line of readFileSync(logFile, "utf-8").split(/\r?\n/)) {
-					const url = parseLine(line);
-					if (url) return finish(url);
+				const sessions = (await list()).filter((session) => isOwnDeviceSession(session, device, owner));
+				for (const session of sessions) try {
+					if (!(await list()).some((current) => current.name === session.name && current.platform === session.platform && current.id === session.id && current.createdAt === session.createdAt)) continue;
+					if (!await stillOwned(session.id)) continue;
+					if (JSON.parse(await run([
+						"close",
+						"--session",
+						session.name,
+						"--session-lock",
+						"reject",
+						"--platform",
+						device.platform,
+						device.platform === "ios" ? "--udid" : "--serial",
+						session.id
+					]))?.success !== true) throw new Error("agent-device did not confirm session close");
+					report(`closed agent-device session ${session.name} on ${session.id}`);
+				} catch (error) {
+					report(`could not close agent-device session ${session.name} on ${session.id}: ${error.message}`);
 				}
-			} catch {}
-		};
-		const onError = () => finish(null);
-		const onExit = () => finish(null, true);
-		child.on("error", onError);
-		child.on("exit", onExit);
-		const interval = setInterval(probe, 25);
-		const timer = setTimeout(() => finish(null), timeoutMs);
-		probe();
-	});
-}
-function createTunnelLogFile(provider) {
-	const dir = join(getConfigDir(), "tunnel-logs");
-	mkdirSync(dir, { recursive: true });
-	const path = join(dir, `${provider}-${randomUUID()}.log`);
-	closeSync(openSync(path, "wx", 384));
-	return path;
+			} catch (error) {
+				report(`could not list agent-device sessions for ${device.platform === "ios" ? device.id : device.id ?? device.avdName}: ${error.message}`);
+			}
+		}
+	} catch (error) {
+		report(`could not list agent-device sessions for ${device.platform === "ios" ? device.id : device.id ?? device.avdName}: ${error.message}`);
+	}
 }
-function removeTunnelLogFile(path) {
-	if (!path) return;
+//#endregion
+//#region src/devices/teardown.ts
+async function teardownParkedAvd(avdName) {
 	try {
-		unlinkSync(path);
-	} catch {}
-}
-function removeRecordedTunnelLogFile(path) {
-	if (!path) return;
-	const dir = resolve(join(getConfigDir(), "tunnel-logs"));
-	const resolved = resolve(path);
-	if (!resolved.startsWith(`${dir}${sep}`) || resolve(join(dir, basename(resolved))) !== resolved) return;
-	removeTunnelLogFile(resolved);
-}
-async function waitUntilReachable({ url, now, sleep, probe, timeoutMs }) {
-	const deadline = now() + timeoutMs;
-	for (;;) {
-		if (await probe(url, new AbortController().signal).catch(() => false)) return true;
-		if (now() >= deadline) return false;
-		await sleep(REACHABLE_POLL_MS);
+		return await removeParkedAfter("android", avdName, async () => {
+			const result = await teardownOwnedAvd(avdName, {
+				del: true,
+				owner: { pool: true }
+			});
+			if (result.status !== "torn-down" && result.status !== "missing") throw new Error(result.reason);
+		}) ? {
+			status: "torn-down",
+			label: avdName
+		} : {
+			status: "skipped",
+			kind: "not-parked",
+			reason: "emulator is no longer parked"
+		};
+	} catch (error) {
+		return {
+			status: "failed",
+			reason: String(error?.message || error)
+		};
 	}
 }
-const CLEANUP_TIMEOUT_MS = 1e3;
-const CLEANUP_POLL_MS = 25;
-async function startTunnel({ provider, port, spawnFn = null, urlTimeoutMs = URL_TIMEOUT_MS, reachableTimeoutMs = REACHABLE_TIMEOUT_MS, probeReachable = defaultProbeReachable, now = Date.now, sleep = defaultSleep, ngrokUrl = null, requireReachable = true, cleanupTimeoutMs = CLEANUP_TIMEOUT_MS, isChildAlive = pidExists, readProcessToken = process_identity_exports.captureProcessToken, logFile = null }) {
-	const spawn = spawnFn || ((cmd, args, opts) => getExecutor().spawn(cmd, args, opts));
-	const outputFile = provider === "tailscale" ? null : logFile || (spawnFn ? null : createTunnelLogFile(provider));
-	let child;
+async function teardownParkedIosSim(udid, { label, deleteSim = deleteParkedIosSim } = {}) {
 	try {
-		const binary = provider === "tailscale" ? resolveTailscaleBinary((bin) => getExecutor().findExecutable(bin)) : provider;
-		if (!binary) throw new Error("Install Tailscale and sign in to your tailnet.");
-		const { bin, args } = tunnelArgv(provider, port, ngrokUrl, outputFile, binary);
-		child = spawn(bin, args, {
-			stdio: outputFile ? [
-				"ignore",
-				"ignore",
-				"ignore"
-			] : [
-				"ignore",
-				"pipe",
-				"pipe"
-			],
-			detached: true
+		const removed = await removeParkedAfter("ios", udid, async () => {
+			await closeOwnedDeviceSessions({
+				platform: "ios",
+				id: udid
+			}, async () => Boolean((await resolveOwnedIosSimNow(udid)).sim));
+			await deleteSim(udid);
 		});
-	} catch (err) {
-		removeTunnelLogFile(outputFile);
+		if (!removed) return {
+			status: "skipped",
+			kind: "not-parked",
+			reason: "simulator is no longer parked"
+		};
 		return {
-			failed: true,
-			reason: `Could not start ${provider}: ${describe(err)}`
+			status: "torn-down",
+			label: label ?? removed.name
+		};
+	} catch (error) {
+		return {
+			status: "failed",
+			reason: String(error?.message || error)
 		};
 	}
-	let childExited = false;
-	child.once("exit", () => {
-		childExited = true;
-	});
-	const cleanup = async (alreadyExited = childExited) => {
-		const stopped = await terminateChild(child, {
-			alreadyExited,
-			timeoutMs: cleanupTimeoutMs,
-			now,
-			sleep,
-			isAlive: isChildAlive
+}
+async function eraseParkedIosSim(udid, { label } = {}) {
+	try {
+		const erased = await eraseParkedAfter("ios", udid, async (_record, eraseStarted) => {
+			await closeOwnedDeviceSessions({
+				platform: "ios",
+				id: udid
+			}, async () => Boolean((await resolveOwnedIosSimNow(udid)).sim));
+			const resolved = resolveOwnedIosSim(udid, await listAllIosSimsAsync());
+			if (resolved.missing) throw new Error(`simulator ${udid} is not on this machine`);
+			if (resolved.notOwned) throw new Error(`simulator ${udid} is now named ${JSON.stringify(resolved.notOwned)}`);
+			const state = resolved.sim.state;
+			if (state !== "Shutdown") throw new Error(`simulator ${udid} is ${state}, not Shutdown; it was kept`);
+			eraseStarted();
+			await eraseIosSim(udid);
 		});
-		if (stopped) removeTunnelLogFile(outputFile);
-		return stopped ? { status: "stopped" } : {
+		if (!erased) return {
+			status: "skipped",
+			kind: "not-parked",
+			reason: "simulator is no longer parked"
+		};
+		return {
+			status: "torn-down",
+			label: label ?? erased.name
+		};
+	} catch (error) {
+		return {
 			status: "failed",
-			reason: `Sent SIGKILL but could not confirm that pid ${child.pid ?? "unknown"} exited.`
+			reason: String(error?.message || error)
 		};
-	};
-	const failAfterCleanup = async (reason, alreadyExited = childExited) => {
-		const stopped = await cleanup(alreadyExited);
-		return stopped.status === "stopped" ? {
-			failed: true,
-			reason
+	}
+}
+async function eraseParkedAvd(avdName) {
+	try {
+		return await eraseParkedAfter("android", avdName, async (_record, eraseStarted) => {
+			if ((await resolveOwnedAvdSerialAsync(avdName, { timeoutMs: AVD_INVENTORY_TIMEOUT_MS })).serial) throw new Error(`AVD ${avdName} is running; it was kept`);
+			const result = await teardownOwnedAvd(avdName, {
+				wipe: true,
+				owner: { pool: true },
+				onWipeStart: eraseStarted
+			});
+			if (result.status !== "torn-down") throw new Error(result.reason ?? `AVD ${avdName} is ${result.status}`);
+		}) ? {
+			status: "torn-down",
+			label: avdName
 		} : {
-			failed: true,
-			reason: `${reason} ${stopped.reason}`,
-			cleanupFailed: true
+			status: "skipped",
+			kind: "not-parked",
+			reason: "emulator is no longer parked"
 		};
-	};
-	const pid = child.pid;
-	if (!pid) return failAfterCleanup(`${provider} started but reported no pid.`);
-	const captureChildIdentity = () => {
-		try {
-			return readProcessToken(pid);
-		} catch {
-			return null;
-		}
-	};
-	const initialProcessToken = captureChildIdentity();
-	if (!initialProcessToken) return failAfterCleanup(`${provider} started but its process identity token could not be read.`);
-	const { url, exited, lastLine } = outputFile ? await waitForFileUrl(child, outputFile, parserFor(provider), urlTimeoutMs) : await waitForUrl(child, parserFor(provider), urlTimeoutMs);
-	if (!url) return failAfterCleanup(exited ? provider === "tailscale" && lastLine ? `${provider} exited before printing a tunnel URL: ${lastLine}` : `${provider} exited before printing a tunnel URL.` : `${provider} did not print a tunnel URL within ${urlTimeoutMs}ms.`, exited || childExited);
-	if (!outputFile) resumeChildPipes(child);
-	if (requireReachable) {
-		if (!await waitUntilReachable({
-			url,
-			now,
-			sleep,
-			probe: probeReachable,
-			timeoutMs: reachableTimeoutMs
-		})) return failAfterCleanup(`${url} did not become reachable within ${reachableTimeoutMs}ms; ${provider} may still be registering, or the network path is blocked.`);
-	}
-	const finalProcessToken = captureChildIdentity();
-	if (!finalProcessToken || finalProcessToken !== initialProcessToken) return failAfterCleanup(`${provider} process identity changed before its tunnel could be recorded.`);
-	if (!outputFile) unrefChildPipes(child);
-	child.unref?.();
-	if (childExited) return failAfterCleanup(`${provider} exited before its tunnel could be recorded.`, true);
-	return {
-		url,
-		pid,
-		processToken: initialProcessToken,
-		logFile: outputFile,
-		cleanup: () => cleanup()
-	};
-}
-async function startTunnelSequence({ providers, port, ngrokUrl = null, requireReachable = true, start = startTunnel }) {
-	const failures = [];
-	for (const provider of providers) {
-		const result = await start({
-			provider,
-			port,
-			ngrokUrl: provider === "ngrok" ? ngrokUrl : null,
-			requireReachable
-		});
-		if (!("failed" in result)) return {
-			provider,
-			...result
-		};
-		failures.push(`${provider}: ${result.reason}`);
-		if (result.cleanupFailed) return {
-			failed: true,
-			reason: failures.join(" ")
+	} catch (error) {
+		return {
+			status: "failed",
+			reason: String(error?.message || error)
 		};
 	}
-	return {
-		failed: true,
-		reason: failures.join(" ") || "No managed tunnel provider was selected."
-	};
-}
-function closeChildPipes(child) {
-	child.stdout?.destroy?.();
-	child.stderr?.destroy?.();
-}
-function unrefChildPipes(child) {
-	resumeChildPipes(child);
-	for (const stream of [child.stdout, child.stderr]) stream?.unref?.();
-}
-function resumeChildPipes(child) {
-	child.stdout?.resume?.();
-	child.stderr?.resume?.();
 }
-async function signalAndWaitForExit(child, signal, { timeoutMs, now, sleep, isAlive, platform }) {
-	let exited = false;
-	const onExit = () => {
-		exited = true;
-	};
-	child.once("exit", onExit);
+const IOS_SHUTDOWN_SETTLE_MS = 15e3;
+const ADB_RELEASE_WAIT_MS = 3e3;
+const AVD_INVENTORY_TIMEOUT_MS = 15e3;
+async function repoRootAbove(workspace) {
+	if (workspace === void 0 || !getExecutor().findExecutable("agent-device")) return void 0;
+	const root = await repoRootAsync(workspace);
 	try {
-		if (platform === "win32" && child.pid) signalProcessTree(child.pid, signal, { platform });
-		child.kill(signal);
-	} catch (err) {
-		child.removeListener("exit", onExit);
-		return isEsrch(err);
+		return root && realpathSync(root) !== realpathSync(workspace) ? root : void 0;
+	} catch {
+		return;
 	}
-	const hasExited = () => exited;
-	const deadline = now() + timeoutMs;
-	while (!hasExited() && now() < deadline) await sleep(CLEANUP_POLL_MS);
-	if (!hasExited() && child.pid && !isAlive(child.pid)) exited = true;
-	child.removeListener("exit", onExit);
-	return hasExited();
 }
-async function terminateChild(child, { alreadyExited, timeoutMs, now, sleep, isAlive, platform = process.platform }) {
-	if (alreadyExited) {
-		closeChildPipes(child);
-		return true;
-	}
-	if (await signalAndWaitForExit(child, "SIGTERM", {
-		timeoutMs,
-		now,
-		sleep,
-		isAlive,
-		platform
-	})) {
-		closeChildPipes(child);
-		return true;
-	}
-	const killed = await signalAndWaitForExit(child, "SIGKILL", {
-		timeoutMs,
-		now,
-		sleep,
-		isAlive,
-		platform
-	});
-	closeChildPipes(child);
-	return killed;
+const IOS_SHUTDOWN_POLL_MS = 250;
+const IOS_SHUTDOWN_ATTEMPTS = 2;
+async function resolveOwnedIosSimNow(udid) {
+	return resolveOwnedIosSim(udid, await listAllIosSimsAsync());
 }
-function describe(err) {
-	return err?.message || String(err);
+async function settleIosSimShutdown(udid, { now = Date.now, sleep = sleepAsync }) {
+	let resolved = await resolveOwnedIosSimNow(udid);
+	for (let attempt = 1;; attempt++) {
+		const deadline = now() + IOS_SHUTDOWN_SETTLE_MS;
+		while (resolved.sim && resolved.sim.state !== "Shutdown" && now() < deadline) {
+			await sleep(IOS_SHUTDOWN_POLL_MS);
+			resolved = await resolveOwnedIosSimNow(udid);
+		}
+		if (!resolved.sim || resolved.sim.state === "Shutdown" || attempt === IOS_SHUTDOWN_ATTEMPTS) return resolved;
+		await shutdownIosSim(udid);
+		resolved = await resolveOwnedIosSimNow(udid);
+	}
 }
-const STOP_TIMEOUT_MS = 5e3;
-const STOP_POLL_MS = 100;
-function isEsrch(err) {
-	return err?.code === "ESRCH";
+function iosShutdownFailureReason(udid, state) {
+	return `simulator ${udid} is still ${state} after ${IOS_SHUTDOWN_ATTEMPTS} shutdown attempts and ${IOS_SHUTDOWN_ATTEMPTS * IOS_SHUTDOWN_SETTLE_MS / 1e3}s of waiting`;
 }
-async function stopTunnel(record, { isAlive = pidExists, inspectIdentity = process_identity_exports.inspectProcessIdentity, platform = process.platform, kill = (pid) => signalProcessTree(pid, "SIGTERM", { platform }), now = Date.now, sleep = defaultSleep, timeoutMs = STOP_TIMEOUT_MS } = {}) {
-	const missing = () => {
-		removeRecordedTunnelLogFile(record?.logFile);
-		return { status: "missing" };
-	};
-	const pid = record?.pid;
-	if (!pid || !isAlive(pid)) return missing();
-	if (!record.processToken) return {
-		status: "failed",
-		reason: `tunnel pid ${pid} has no process identity token, so Stim cannot verify ownership. Keep the record. Inspect the process, stop it with the provider tooling, remove the stale metroTunnel state, and retry.`
+async function parkOwnedIosSim(settled, udid, park) {
+	if (settled.missing) throw new Error(`simulator ${udid} disappeared after shutdown`);
+	if (settled.notOwned) throw new Error(`simulator ${udid} is now named ${JSON.stringify(settled.notOwned)}`);
+	const sim = settled.sim;
+	if (sim.state !== "Shutdown") throw new Error(iosShutdownFailureReason(udid, sim.state));
+	const model = (await listIosDeviceTypesAsync()).find((d) => d.identifier === sim.deviceTypeIdentifier)?.name ?? null;
+	const runtime = parseRuntimeVersion(sim.runtime);
+	const name = parkedSimName(sim.udid, {
+		model,
+		runtime
+	});
+	await renameIosSim(sim.udid, name);
+	const record = {
+		udid: sim.udid,
+		name,
+		deviceTypeIdentifier: sim.deviceTypeIdentifier,
+		runtimeIdentifier: sim.runtime,
+		parkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		simslimManaged: Boolean(park.simslimManaged),
+		...park.appId ? { bundleId: park.appId } : {},
+		...park.cacheKey ? { cacheKey: park.cacheKey } : {}
 	};
-	const identity = inspectIdentity(record);
-	if (identity === "gone" || identity === "different") return missing();
-	if (identity !== "same") return {
-		status: "failed",
-		reason: `could not verify the process identity for tunnel pid ${pid}; refusing to signal it.`
+	return {
+		record,
+		evicted: parkSim({
+			platform: "ios",
+			projectPath: park.projectPath,
+			slot: park.slot,
+			record,
+			max: park.max
+		})
 	};
+}
+async function teardownOwnedIosSim(udid, { del = false, label, park, workspace, shutdownClock = {} } = {}) {
+	let parkFallback;
 	try {
-		kill(pid);
-	} catch (err) {
-		return isEsrch(err) ? missing() : {
+		const resolved = await resolveOwnedIosSimNow(udid);
+		if (resolved.notOwned) return {
+			status: "skipped",
+			kind: "not-owned",
+			reason: `sim "${resolved.notOwned}" is not Stim-owned: Stim has no record of creating it`
+		};
+		if (resolved.missing) return { status: "missing" };
+		await closeOwnedDeviceSessions({
+			platform: "ios",
+			id: udid
+		}, async () => Boolean((await resolveOwnedIosSimNow(udid)).sim), workspace);
+		const current = await resolveOwnedIosSimNow(udid);
+		if (current.missing) return { status: "missing" };
+		if (current.notOwned) return {
+			status: "skipped",
+			kind: "not-owned",
+			reason: "simulator ownership changed before shutdown"
+		};
+		await shutdownIosSim(udid);
+		const sim = resolved.sim;
+		if (del && park && park.max > 0) try {
+			const { record, evicted } = await parkOwnedIosSim(await settleIosSimShutdown(udid, shutdownClock), udid, park);
+			const removed = [];
+			const failures = [];
+			for (const entry of evicted) {
+				const result = await teardownParkedIosSim(entry.udid, { label: entry.name });
+				if (result.status === "torn-down") removed.push({
+					udid: entry.udid,
+					name: entry.name
+				});
+				else if (result.status === "failed") failures.push(`could not delete evicted ${entry.name} (${entry.udid}): ${result.reason}`);
+			}
+			return {
+				status: "torn-down",
+				label: label ?? sim.name ?? udid,
+				parked: {
+					udid: record.udid,
+					name: record.name
+				},
+				evicted: removed,
+				...failures.length ? { evictionFailures: failures } : {}
+			};
+		} catch (e) {
+			parkFallback = String(e?.message || e);
+		}
+		if (del) {
+			await deleteIosSim(udid);
+			return {
+				status: "torn-down",
+				label: label ?? sim.name ?? udid,
+				...parkFallback ? { parkFallback } : {}
+			};
+		}
+		const settled = await settleIosSimShutdown(udid, shutdownClock);
+		if (settled.sim && settled.sim.state !== "Shutdown") return {
 			status: "failed",
-			reason: describe(err)
+			label: label ?? sim.name ?? udid,
+			reason: iosShutdownFailureReason(udid, settled.sim.state)
+		};
+		const root = sim.state === "Shutdown" ? void 0 : await repoRootAbove(workspace);
+		if (root && settled.sim) await closeOwnedDeviceSessions({
+			platform: "ios",
+			id: udid
+		}, async () => (await resolveOwnedIosSimNow(udid)).sim?.state === "Shutdown", workspace, root);
+		return {
+			status: "torn-down",
+			label: label ?? sim.name ?? udid
+		};
+	} catch (e) {
+		return {
+			status: "failed",
+			reason: String(e?.message || e),
+			...parkFallback ? { parkFallback } : {}
 		};
-	}
-	const deadline = now() + timeoutMs;
-	const exited = () => {
-		if (!isAlive(pid)) return true;
-		const current = inspectIdentity(record);
-		return current === "gone" || current === "different";
-	};
-	while (now() < deadline && !exited()) await sleep(STOP_POLL_MS);
-	if (!exited()) return {
-		status: "failed",
-		reason: `pid ${pid} did not exit within ${timeoutMs}ms.`
-	};
-	removeRecordedTunnelLogFile(record.logFile);
-	return { status: "stopped" };
-}
-//#endregion
-//#region src/commands/gc/paths.ts
-function canonicalPath(p) {
-	try {
-		return realpathSync$1(p);
-	} catch {
-		return resolve$1(p);
 	}
 }
-//#endregion
-//#region src/commands/gc/results.ts
-const results = [];
-function recordGcResult(kind, status, label, { id = null, bytes = null, detail = null } = {}) {
-	results.push({
-		kind,
-		status,
-		label,
-		id,
-		bytes,
-		detail
-	});
-}
-function takeGcResults() {
-	return results.splice(0);
+function assertAvdReferences(avdName, owner) {
+	const config = loadConfig$1();
+	if (!config) throw new Error("Cannot verify AVD references without a Stim config; the data was kept.");
+	if (owner && "projectPath" in owner && owner.expectedRecord && !isDeepStrictEqual(deviceSlotPlatforms(config.projects[owner.projectPath], owner.slot)?.android, owner.expectedRecord)) throw new Error(`AVD ${avdName} has a changed workspace record; its data was kept.`);
+	for (const [projectPath, project] of Object.entries(config.projects)) for (const { slot, platforms } of projectDeviceSlots(project)) {
+		if (platforms.android?.avdName?.toLowerCase() !== avdName.toLowerCase()) continue;
+		if (!owner || !("projectPath" in owner) || owner.projectPath !== projectPath || (owner.slot ?? "default") !== slot || !platforms.android.owned) throw new Error(`AVD ${avdName} is referenced by ${projectPath} (${slot}); its data was kept.`);
+	}
+	if (readParked("android", { config }).some((entry) => entry.name.toLowerCase() === avdName.toLowerCase()) && !(owner && "pool" in owner)) throw new Error(`AVD ${avdName} is in the emulator pool; its data was kept.`);
 }
-//#endregion
-//#region src/devices/agent-device-cleanup.ts
-function parseAgentDeviceSessions(output) {
-	const result = JSON.parse(output);
-	if (result?.success !== true || !Array.isArray(result.data?.sessions)) throw new Error("agent-device did not return a successful session list");
-	return result.data.sessions.flatMap((entry) => {
-		if (!entry || typeof entry !== "object") return [];
-		const row = entry;
-		const id = row.platform === "ios" ? row.device_udid : row.id;
-		if (row.platform !== "ios" && row.platform !== "android" || typeof row.name !== "string" || !row.name.trim() || typeof id !== "string" || !id || typeof row.createdAt !== "number" || !Number.isFinite(row.createdAt) || row.platform === "ios" && row.id !== void 0 && row.id !== id) return [];
-		return [{
-			name: typeof row.address === "string" && row.address.trim() ? row.address : row.name,
-			platform: row.platform,
-			id,
-			device: typeof row.device === "string" ? row.device : null,
-			createdAt: row.createdAt
-		}];
+function removeOrphanedAvdDirectory(candidate, owner) {
+	const surveyed = listOrphanedAvdDirectories(candidate.name).find((entry) => entry.directory === candidate.directory);
+	if (!surveyed || surveyed.name !== candidate.name || surveyed.dev !== candidate.dev || surveyed.ino !== candidate.ino) throw new Error(`AVD data at ${candidate.directory} changed or is registered; it was kept.`);
+	assertOwnedAvdStopped(candidate.name, { resolveDirectory: () => candidate.directory });
+	const detached = withConfigLock$1(() => {
+		const current = lstatSync(candidate.directory);
+		if (!current.isDirectory() || current.dev !== candidate.dev || current.ino !== candidate.ino) throw new Error(`AVD data at ${candidate.directory} changed or is registered; it was kept.`);
+		assertAvdReferences(candidate.name, owner);
+		const name = `stim-gc-${randomUUID()}`;
+		recordCreatedDevice("android", name);
+		const destination = join(dirname(candidate.directory), `${name}.avd`);
+		try {
+			renameSync(candidate.directory, destination);
+		} catch (error) {
+			forgetCreatedDevice("android", name);
+			throw error;
+		}
+		forgetCreatedDevice("android", candidate.name);
+		return destination;
 	});
-}
-function isOwnDeviceSession(session, device, owner) {
-	if (session.platform !== device.platform || device.id !== null && session.id !== device.id) return false;
-	if (device.platform === "android" && session.device !== device.avdName.replaceAll("_", " ")) return false;
-	if (!owner) return true;
-	return owner.claims.some((claim) => claim.deviceId === session.id && claim.session === session.name && claim.workspace !== null && (within(owner.workspace, claim.workspace) || claim.workspace === owner.repoRoot));
-}
-function within(root, path) {
-	const rest = relative(root, path);
-	return rest === "" || !isAbsolute(rest) && rest.split(sep)[0] !== "..";
-}
-function canonical(path) {
+	const current = lstatSync(detached);
+	if (!current.isDirectory() || current.dev !== candidate.dev || current.ino !== candidate.ino) throw new Error(`Detached AVD data changed at ${detached}; it was kept.`);
 	try {
-		return realpathSync(path);
-	} catch {
-		return null;
+		rmSync(detached, { recursive: true });
+	} catch (error) {
+		throw new Error(`Could not remove AVD data at ${detached}; retry gc --delete: ${error.message}`, { cause: error });
 	}
+	forgetCreatedDevice("android", basename(detached, ".avd"));
 }
-function deviceClaims(device) {
-	return readAgentDeviceRecords(homedir()).filter((record) => record.kind === "claim" && (device.id === null || record.deviceId === device.id)).map((record) => ({
-		deviceId: record.deviceId,
-		session: record.session,
-		workspace: record.workspace && canonical(record.workspace)
-	}));
-}
-function explainFailure(error) {
-	const stdout = error?.stdout;
-	let failure;
-	try {
-		failure = typeof stdout === "string" ? JSON.parse(stdout)?.error : void 0;
-	} catch {
-		failure = void 0;
+function teardownUnregisteredAvd(avdName, del, owner, surveyed) {
+	const candidates = surveyed ? [surveyed] : listOrphanedAvdDirectories(avdName);
+	if (candidates.length === 0) {
+		if (avdStorageRoots().some((root) => avdPathExists(join(root, `${avdName}.ini`)) || avdPathExists(join(root, `${avdName}.avd`)))) throw new Error(`AVD ${avdName} is not listed but its storage remains; it was kept.`);
+		return { status: "missing" };
 	}
-	if (typeof failure?.message !== "string" || !failure.message) return error;
-	const reason = typeof failure.details?.reason === "string" ? ` (${failure.details.reason})` : "";
-	return /* @__PURE__ */ new Error(`agent-device refused: ${failure.message}${reason}`);
-}
-function report(message) {
-	process.stderr.write(`${phaseLine("device", message)}\n`);
-}
-function closeOwnedDeviceSessions(device, stillOwned, workspace, repoRoot) {
-	const exec = getExecutor();
-	try {
-		if (!exec.findExecutable("agent-device")) return;
-		const root = workspace === void 0 ? void 0 : canonical(workspace);
-		if (root === null) return;
-		const owner = root === void 0 ? void 0 : {
-			workspace: root,
-			repoRoot: repoRoot && (canonical(repoRoot) ?? void 0),
-			claims: deviceClaims(device)
-		};
-		const stateDir = root === void 0 ? void 0 : workspaceAgentDeviceDir(root);
-		const stateDirs = [void 0, ...stateDir && !["none", "dead"].includes(agentDeviceDaemon(stateDir)) ? [stateDir] : []];
-		for (const dir of stateDirs) {
-			const deadline = Date.now() + 15e3;
-			const run = (args) => {
-				const remaining = deadline - Date.now();
-				if (remaining <= 0) throw new Error("agent-device cleanup timed out");
-				try {
-					return exec.runFile("agent-device", [
-						...args,
-						...dir ? ["--state-dir", dir] : [],
-						"--json",
-						"--daemon-transport",
-						"socket"
-					], {
-						timeoutMs: Math.min(5e3, remaining),
-						killSignal: "SIGKILL"
-					});
-				} catch (error) {
-					throw explainFailure(error);
-				}
-			};
-			const list = () => parseAgentDeviceSessions(run([
-				"session",
-				"list",
-				"--session",
-				"stim-teardown-inventory"
-			]));
-			try {
-				const sessions = list().filter((session) => isOwnDeviceSession(session, device, owner));
-				for (const session of sessions) try {
-					if (!list().some((current) => current.name === session.name && current.platform === session.platform && current.id === session.id && current.createdAt === session.createdAt)) continue;
-					if (!stillOwned(session.id)) continue;
-					if (JSON.parse(run([
-						"close",
-						"--session",
-						session.name,
-						"--session-lock",
-						"reject",
-						"--platform",
-						device.platform,
-						device.platform === "ios" ? "--udid" : "--serial",
-						session.id
-					]))?.success !== true) throw new Error("agent-device did not confirm session close");
-					report(`closed agent-device session ${session.name} on ${session.id}`);
-				} catch (error) {
-					report(`could not close agent-device session ${session.name} on ${session.id}: ${error.message}`);
-				}
-			} catch (error) {
-				report(`could not list agent-device sessions for ${device.platform === "ios" ? device.id : device.id ?? device.avdName}: ${error.message}`);
-			}
-		}
-	} catch (error) {
-		report(`could not list agent-device sessions for ${device.platform === "ios" ? device.id : device.id ?? device.avdName}: ${error.message}`);
+	if (!del) return {
+		status: "skipped",
+		reason: "AVD registration is missing; its data was kept."
+	};
+	for (const candidate of candidates) {
+		if (candidate.name !== avdName) throw new Error(`AVD data does not match ${avdName}; it was kept.`);
+		removeOrphanedAvdDirectory(candidate, owner);
 	}
+	return {
+		status: "torn-down",
+		label: avdName
+	};
 }
-//#endregion
-//#region src/devices/teardown.ts
-function teardownParkedAvd(avdName) {
+async function teardownOwnedAvd(avdName, options = {}) {
+	let claim;
 	try {
-		return removeParkedAfter("android", avdName, () => {
-			const result = teardownOwnedAvd(avdName, {
-				del: true,
-				owner: { pool: true }
-			});
-			if (result.status !== "torn-down" && result.status !== "missing") throw new Error(result.reason);
-		}) ? {
-			status: "torn-down",
-			label: avdName
-		} : {
+		if (!isStimOwnedAvd(avdName)) return {
 			status: "skipped",
-			kind: "not-parked",
-			reason: "emulator is no longer parked"
+			kind: "not-owned",
+			reason: `AVD ${avdName} is not Stim-owned: Stim has no record of creating it`
 		};
+		claim = acquireAvdClaim(avdName);
+		const result = await teardownClaimedAvd(avdName, claim, options);
+		if (result.status === "torn-down" || result.status === "missing") options.onRemoved?.();
+		return result;
 	} catch (error) {
 		return {
 			status: "failed",
 			reason: String(error?.message || error)
 		};
+	} finally {
+		(0, ownership_claim_exports.releaseClaim)(claim);
 	}
 }
-function teardownParkedIosSim(udid, { label, deleteSim = deleteParkedIosSim } = {}) {
+async function serialFree(serial, timeoutMs = AVD_INVENTORY_TIMEOUT_MS) {
+	const adb = await listAdbDevicesAsync({ timeoutMs });
+	return ![
+		...adb.emulators,
+		...adb.physical,
+		...adb.unhealthy
+	].some((entry) => entry.serial === serial);
+}
+async function teardownClaimedAvd(avdName, claim, { del = false, wipe = false, park, owner, workspace, orphanedDirectory, onlyIfMissing = false, onWipeStart, waitForShutdown = waitForAndroidEmulatorShutdown, assertStopped = assertOwnedAvdStopped, resolveAvd = (name) => resolveOwnedAvdSerialAsync(name, { timeoutMs: AVD_INVENTORY_TIMEOUT_MS }) }) {
+	let parkFallback;
 	try {
-		const removed = removeParkedAfter("ios", udid, () => {
-			closeOwnedDeviceSessions({
-				platform: "ios",
-				id: udid
-			}, () => Boolean(resolveOwnedIosSim(udid).sim));
-			deleteSim(udid);
-		});
-		if (!removed) return {
+		if (del || wipe) await withConfigLockAsync$1(() => assertAvdReferences(avdName, owner));
+		const resolved = await resolveAvd(avdName);
+		if (resolved.notOwned) return {
 			status: "skipped",
-			kind: "not-parked",
-			reason: "simulator is no longer parked"
-		};
-		return {
-			status: "torn-down",
-			label: label ?? removed.name
-		};
-	} catch (error) {
-		return {
-			status: "failed",
-			reason: String(error?.message || error)
+			kind: "not-owned",
+			reason: `AVD ${avdName} is not Stim-owned: Stim has no record of creating it`
 		};
-	}
-}
-function eraseParkedIosSim(udid, { label } = {}) {
-	try {
-		const erased = eraseParkedAfter("ios", udid, (_record, eraseStarted) => {
-			closeOwnedDeviceSessions({
-				platform: "ios",
-				id: udid
-			}, () => Boolean(resolveOwnedIosSim(udid).sim));
-			const resolved = resolveOwnedIosSim(udid);
-			if (resolved.missing) throw new Error(`simulator ${udid} is not on this machine`);
-			if (resolved.notOwned) throw new Error(`simulator ${udid} is now named ${JSON.stringify(resolved.notOwned)}`);
-			const state = resolved.sim.state;
-			if (state !== "Shutdown") throw new Error(`simulator ${udid} is ${state}, not Shutdown; it was kept`);
-			eraseStarted();
-			eraseIosSim(udid);
-		});
-		if (!erased) return {
+		if (resolved.missing) {
+			if (wipe) throw new Error(`AVD ${avdName} is not registered; its data was kept.`);
+			return teardownUnregisteredAvd(avdName, del, owner, orphanedDirectory);
+		}
+		if (onlyIfMissing) return {
 			status: "skipped",
-			kind: "not-parked",
-			reason: "simulator is no longer parked"
+			reason: "AVD registration appeared; its record was kept."
 		};
-		return {
-			status: "torn-down",
-			label: label ?? erased.name
+		if (orphanedDirectory) return {
+			status: "skipped",
+			reason: "AVD registration appeared; its data was kept."
 		};
-	} catch (error) {
-		return {
-			status: "failed",
-			reason: String(error?.message || error)
-		};
-	}
-}
-function eraseParkedAvd(avdName) {
-	try {
-		return eraseParkedAfter("android", avdName, (_record, eraseStarted) => {
-			if (resolveOwnedAvdSerial(avdName, { timeoutMs: AVD_INVENTORY_TIMEOUT_MS }).serial) throw new Error(`AVD ${avdName} is running; it was kept`);
-			const result = teardownOwnedAvd(avdName, {
-				wipe: true,
-				owner: { pool: true },
-				onWipeStart: eraseStarted
-			});
-			if (result.status !== "torn-down") throw new Error(result.reason ?? `AVD ${avdName} is ${result.status}`);
-		}) ? {
-			status: "torn-down",
-			label: avdName
-		} : {
-			status: "skipped",
-			kind: "not-parked",
-			reason: "emulator is no longer parked"
-		};
-	} catch (error) {
-		return {
-			status: "failed",
-			reason: String(error?.message || error)
-		};
-	}
-}
-const IOS_SHUTDOWN_SETTLE_MS = 15e3;
-const ADB_RELEASE_WAIT_MS = 3e3;
-const AVD_INVENTORY_TIMEOUT_MS = 15e3;
-function repoRootAbove(workspace) {
-	if (workspace === void 0 || !getExecutor().findExecutable("agent-device")) return void 0;
-	const root = repoRoot(workspace);
-	try {
-		return root && realpathSync(root) !== realpathSync(workspace) ? root : void 0;
-	} catch {
-		return;
-	}
-}
-const IOS_SHUTDOWN_POLL_MS = 250;
-const IOS_SHUTDOWN_ATTEMPTS = 2;
-function settleIosSimShutdown(udid, { now = Date.now, sleep = sleepSync }) {
-	let resolved = resolveOwnedIosSim(udid);
-	for (let attempt = 1;; attempt++) {
-		const deadline = now() + IOS_SHUTDOWN_SETTLE_MS;
-		while (resolved.sim && resolved.sim.state !== "Shutdown" && now() < deadline) {
-			sleep(IOS_SHUTDOWN_POLL_MS);
-			resolved = resolveOwnedIosSim(udid);
-		}
-		if (!resolved.sim || resolved.sim.state === "Shutdown" || attempt === IOS_SHUTDOWN_ATTEMPTS) return resolved;
-		shutdownIosSim(udid);
-		resolved = resolveOwnedIosSim(udid);
-	}
-}
-function iosShutdownFailureReason(udid, state) {
-	return `simulator ${udid} is still ${state} after ${IOS_SHUTDOWN_ATTEMPTS} shutdown attempts and ${IOS_SHUTDOWN_ATTEMPTS * IOS_SHUTDOWN_SETTLE_MS / 1e3}s of waiting`;
-}
-function parkOwnedIosSim(settled, udid, park) {
-	if (settled.missing) throw new Error(`simulator ${udid} disappeared after shutdown`);
-	if (settled.notOwned) throw new Error(`simulator ${udid} is now named ${JSON.stringify(settled.notOwned)}`);
-	const sim = settled.sim;
-	if (sim.state !== "Shutdown") throw new Error(iosShutdownFailureReason(udid, sim.state));
-	const model = listIosDeviceTypes().find((d) => d.identifier === sim.deviceTypeIdentifier)?.name ?? null;
-	const runtime = parseRuntimeVersion(sim.runtime);
-	const name = parkedSimName(sim.udid, {
-		model,
-		runtime
-	});
-	renameIosSim(sim.udid, name);
-	const record = {
-		udid: sim.udid,
-		name,
-		deviceTypeIdentifier: sim.deviceTypeIdentifier,
-		runtimeIdentifier: sim.runtime,
-		parkedAt: (/* @__PURE__ */ new Date()).toISOString(),
-		simslimManaged: Boolean(park.simslimManaged),
-		...park.appId ? { bundleId: park.appId } : {},
-		...park.cacheKey ? { cacheKey: park.cacheKey } : {}
-	};
-	return {
-		record,
-		evicted: parkSim({
-			platform: "ios",
-			projectPath: park.projectPath,
-			slot: park.slot,
-			record,
-			max: park.max
-		})
-	};
-}
-function teardownOwnedIosSim(udid, { del = false, label, park, workspace, shutdownClock = {} } = {}) {
-	let parkFallback;
-	try {
-		const resolved = resolveOwnedIosSim(udid);
-		if (resolved.notOwned) return {
-			status: "skipped",
-			kind: "not-owned",
-			reason: `sim "${resolved.notOwned}" is not Stim-owned: Stim has no record of creating it`
-		};
-		if (resolved.missing) return { status: "missing" };
-		closeOwnedDeviceSessions({
-			platform: "ios",
-			id: udid
-		}, () => Boolean(resolveOwnedIosSim(udid).sim), workspace);
-		const current = resolveOwnedIosSim(udid);
-		if (current.missing) return { status: "missing" };
-		if (current.notOwned) return {
-			status: "skipped",
-			kind: "not-owned",
-			reason: "simulator ownership changed before shutdown"
-		};
-		shutdownIosSim(udid);
-		const sim = resolved.sim;
-		if (del && park && park.max > 0) try {
-			const { record, evicted } = parkOwnedIosSim(settleIosSimShutdown(udid, shutdownClock), udid, park);
-			const removed = [];
-			const failures = [];
-			for (const entry of evicted) {
-				const result = teardownParkedIosSim(entry.udid, { label: entry.name });
-				if (result.status === "torn-down") removed.push({
-					udid: entry.udid,
-					name: entry.name
-				});
-				else if (result.status === "failed") failures.push(`could not delete evicted ${entry.name} (${entry.udid}): ${result.reason}`);
-			}
-			return {
-				status: "torn-down",
-				label: label ?? sim.name ?? udid,
-				parked: {
-					udid: record.udid,
-					name: record.name
-				},
-				evicted: removed,
-				...failures.length ? { evictionFailures: failures } : {}
-			};
-		} catch (e) {
-			parkFallback = String(e?.message || e);
-		}
-		if (del) {
-			deleteIosSim(udid);
-			return {
-				status: "torn-down",
-				label: label ?? sim.name ?? udid,
-				...parkFallback ? { parkFallback } : {}
-			};
-		}
-		const settled = settleIosSimShutdown(udid, shutdownClock);
-		if (settled.sim && settled.sim.state !== "Shutdown") return {
-			status: "failed",
-			label: label ?? sim.name ?? udid,
-			reason: iosShutdownFailureReason(udid, settled.sim.state)
-		};
-		const root = sim.state === "Shutdown" ? void 0 : repoRootAbove(workspace);
-		if (root && settled.sim) closeOwnedDeviceSessions({
-			platform: "ios",
-			id: udid
-		}, () => resolveOwnedIosSim(udid).sim?.state === "Shutdown", workspace, root);
-		return {
-			status: "torn-down",
-			label: label ?? sim.name ?? udid
-		};
-	} catch (e) {
-		return {
-			status: "failed",
-			reason: String(e?.message || e),
-			...parkFallback ? { parkFallback } : {}
-		};
-	}
-}
-function assertAvdReferences(avdName, owner) {
-	const config = loadConfig$1();
-	if (!config) throw new Error("Cannot verify AVD references without a Stim config; the data was kept.");
-	if (owner && "projectPath" in owner && owner.expectedRecord && !isDeepStrictEqual(deviceSlotPlatforms(config.projects[owner.projectPath], owner.slot)?.android, owner.expectedRecord)) throw new Error(`AVD ${avdName} has a changed workspace record; its data was kept.`);
-	for (const [projectPath, project] of Object.entries(config.projects)) for (const { slot, platforms } of projectDeviceSlots(project)) {
-		if (platforms.android?.avdName?.toLowerCase() !== avdName.toLowerCase()) continue;
-		if (!owner || !("projectPath" in owner) || owner.projectPath !== projectPath || (owner.slot ?? "default") !== slot || !platforms.android.owned) throw new Error(`AVD ${avdName} is referenced by ${projectPath} (${slot}); its data was kept.`);
-	}
-	if (readParked("android", { config }).some((entry) => entry.name.toLowerCase() === avdName.toLowerCase()) && !(owner && "pool" in owner)) throw new Error(`AVD ${avdName} is in the emulator pool; its data was kept.`);
-}
-function removeOrphanedAvdDirectory(candidate, owner) {
-	const surveyed = listOrphanedAvdDirectories(candidate.name).find((entry) => entry.directory === candidate.directory);
-	if (!surveyed || surveyed.name !== candidate.name || surveyed.dev !== candidate.dev || surveyed.ino !== candidate.ino) throw new Error(`AVD data at ${candidate.directory} changed or is registered; it was kept.`);
-	assertOwnedAvdStopped(candidate.name, { resolveDirectory: () => candidate.directory });
-	const detached = withConfigLock$1(() => {
-		const current = lstatSync(candidate.directory);
-		if (!current.isDirectory() || current.dev !== candidate.dev || current.ino !== candidate.ino) throw new Error(`AVD data at ${candidate.directory} changed or is registered; it was kept.`);
-		assertAvdReferences(candidate.name, owner);
-		const name = `stim-gc-${randomUUID()}`;
-		recordCreatedDevice("android", name);
-		const destination = join(dirname(candidate.directory), `${name}.avd`);
-		try {
-			renameSync(candidate.directory, destination);
-		} catch (error) {
-			forgetCreatedDevice("android", name);
-			throw error;
-		}
-		forgetCreatedDevice("android", candidate.name);
-		return destination;
-	});
-	const current = lstatSync(detached);
-	if (!current.isDirectory() || current.dev !== candidate.dev || current.ino !== candidate.ino) throw new Error(`Detached AVD data changed at ${detached}; it was kept.`);
-	try {
-		rmSync(detached, { recursive: true });
-	} catch (error) {
-		throw new Error(`Could not remove AVD data at ${detached}; retry gc --delete: ${error.message}`, { cause: error });
-	}
-	forgetCreatedDevice("android", basename(detached, ".avd"));
-}
-function teardownUnregisteredAvd(avdName, del, owner, surveyed) {
-	const candidates = surveyed ? [surveyed] : listOrphanedAvdDirectories(avdName);
-	if (candidates.length === 0) {
-		if (avdStorageRoots().some((root) => avdPathExists(join(root, `${avdName}.ini`)) || avdPathExists(join(root, `${avdName}.avd`)))) throw new Error(`AVD ${avdName} is not listed but its storage remains; it was kept.`);
-		return { status: "missing" };
-	}
-	if (!del) return {
-		status: "skipped",
-		reason: "AVD registration is missing; its data was kept."
-	};
-	for (const candidate of candidates) {
-		if (candidate.name !== avdName) throw new Error(`AVD data does not match ${avdName}; it was kept.`);
-		removeOrphanedAvdDirectory(candidate, owner);
-	}
-	return {
-		status: "torn-down",
-		label: avdName
-	};
-}
-function teardownOwnedAvd(avdName, options = {}) {
-	let claim;
-	try {
-		if (!isStimOwnedAvd(avdName)) return {
-			status: "skipped",
-			kind: "not-owned",
-			reason: `AVD ${avdName} is not Stim-owned: Stim has no record of creating it`
-		};
-		claim = acquireAvdClaim(avdName);
-		const result = teardownClaimedAvd(avdName, claim, options);
-		if (result.status === "torn-down" || result.status === "missing") options.onRemoved?.();
-		return result;
-	} catch (error) {
-		return {
-			status: "failed",
-			reason: String(error?.message || error)
-		};
-	} finally {
-		(0, ownership_claim_exports.releaseClaim)(claim);
-	}
-}
-function serialFree(serial, timeoutMs = AVD_INVENTORY_TIMEOUT_MS) {
-	const adb = listAdbDevices({ timeoutMs });
-	return ![
-		...adb.emulators,
-		...adb.physical,
-		...adb.unhealthy
-	].some((entry) => entry.serial === serial);
-}
-function teardownClaimedAvd(avdName, claim, { del = false, wipe = false, park, owner, workspace, orphanedDirectory, onlyIfMissing = false, onWipeStart, waitForShutdown = waitForAndroidEmulatorShutdown, assertStopped = assertOwnedAvdStopped, resolveAvd = (name) => resolveOwnedAvdSerial(name, { timeoutMs: AVD_INVENTORY_TIMEOUT_MS }) }) {
-	let parkFallback;
-	try {
-		if (del || wipe) withConfigLock$1(() => assertAvdReferences(avdName, owner));
-		const resolved = resolveAvd(avdName);
-		if (resolved.notOwned) return {
-			status: "skipped",
-			kind: "not-owned",
-			reason: `AVD ${avdName} is not Stim-owned: Stim has no record of creating it`
-		};
-		if (resolved.missing) {
-			if (wipe) throw new Error(`AVD ${avdName} is not registered; its data was kept.`);
-			return teardownUnregisteredAvd(avdName, del, owner, orphanedDirectory);
-		}
-		if (onlyIfMissing) return {
-			status: "skipped",
-			reason: "AVD registration appeared; its record was kept."
-		};
-		if (orphanedDirectory) return {
-			status: "skipped",
-			reason: "AVD registration appeared; its data was kept."
-		};
-		const serial = resolved.serial;
-		const stillStopped = (sessionSerial) => {
-			const current = resolveAvd(avdName);
-			return !current.notOwned && !current.missing && !current.serial && serialFree(sessionSerial);
+		const serial = resolved.serial;
+		const stillStopped = async (sessionSerial) => {
+			const current = await resolveAvd(avdName);
+			return !current.notOwned && !current.missing && !current.serial && await serialFree(sessionSerial);
 		};
 		if (serial) {
-			const stillOwned = () => {
-				const current = resolveAvd(avdName);
+			const stillOwned = async () => {
+				const current = await resolveAvd(avdName);
 				return !current.notOwned && !current.missing && current.serial === serial;
 			};
-			closeOwnedDeviceSessions({
+			await closeOwnedDeviceSessions({
 				platform: "android",
 				id: serial,
 				avdName
 			}, stillOwned, workspace);
-			if (!stillOwned()) throw new Error(`Owned AVD ${avdName} changed before shutdown; it was kept.`);
-			waitForShutdown(avdName, (timeoutMs) => {
+			if (!await stillOwned()) throw new Error(`Owned AVD ${avdName} changed before shutdown; it was kept.`);
+			await waitForShutdown(avdName, async (timeoutMs) => {
 				(0, ownership_claim_exports.markClaimChildPending)(claim);
 				try {
-					shutdownAndroidEmulator(serial, timeoutMs);
+					await shutdownAndroidEmulator(serial, timeoutMs);
 				} finally {
 					(0, ownership_claim_exports.clearClaimChild)(claim);
 				}
 			});
-			const root = repoRootAbove(workspace);
+			const root = await repoRootAbove(workspace);
 			if (root) {
 				const deadline = Date.now() + ADB_RELEASE_WAIT_MS;
-				while (!serialFree(serial, Math.max(1, deadline - Date.now())) && Date.now() < deadline) sleepSync(250);
-				closeOwnedDeviceSessions({
+				while (!await serialFree(serial, Math.max(1, deadline - Date.now())) && Date.now() < deadline) await sleepAsync(250);
+				await closeOwnedDeviceSessions({
 					platform: "android",
 					id: serial,
 					avdName
 				}, stillStopped, workspace, root);
 			}
 		} else {
-			closeOwnedDeviceSessions({
+			await closeOwnedDeviceSessions({
 				platform: "android",
 				id: null,
 				avdName
 			}, stillStopped, workspace);
-			waitForShutdown(avdName, null);
+			await waitForShutdown(avdName, null);
 		}
 		if (wipe && !del) {
-			const current = resolveAvd(avdName);
+			const current = await resolveAvd(avdName);
 			if (current.notOwned || current.missing) throw new Error(`AVD ${avdName} changed before its data was wiped.`);
 			if (current.serial) throw new Error(`Owned AVD ${avdName} started again before its data was wiped.`);
 			assertStopped(avdName);
-			withConfigLock$1(() => assertAvdReferences(avdName, owner));
+			await withConfigLockAsync$1(() => assertAvdReferences(avdName, owner));
 			const directory = ownedAvdDirectory(avdName);
 			if (!directory) throw new Error(`The data directory of AVD ${avdName} could not be resolved.`);
 			onWipeStart?.();
 			wipeAvdUserData(directory);
 		}
 		if (del) {
-			const current = resolveAvd(avdName);
+			const current = await resolveAvd(avdName);
 			if (current.notOwned) return {
 				status: "skipped",
 				kind: "not-owned",
@@ -1289,7 +839,7 @@ function teardownClaimedAvd(avdName, claim, { del = false, wipe = false, park, o
 			if (current.missing) return teardownUnregisteredAvd(avdName, del, owner);
 			if (current.serial) throw new Error(`Owned AVD ${avdName} started again before deletion.`);
 			assertStopped(avdName);
-			withConfigLock$1(() => assertAvdReferences(avdName, owner));
+			await withConfigLockAsync$1(() => assertAvdReferences(avdName, owner));
 			if (park && park.max > 0) try {
 				const systemImage = ownedAvdSystemImage(avdName);
 				if (!systemImage || !park.configuration || !ownedAvdMatchesConfiguration(avdName, park.configuration)) throw new Error("the AVD has no verified creation configuration");
@@ -1311,7 +861,7 @@ function teardownClaimedAvd(avdName, claim, { del = false, wipe = false, park, o
 				const removed = [];
 				const failures = [];
 				for (const entry of evicted) {
-					const result = teardownParkedAvd(entry.name);
+					const result = await teardownParkedAvd(entry.name);
 					if (result.status === "torn-down") removed.push({
 						udid: entry.name,
 						name: entry.name,
@@ -1338,7 +888,7 @@ function teardownClaimedAvd(avdName, claim, { del = false, wipe = false, park, o
 			if (directory) paths.push(directory);
 			(0, ownership_claim_exports.markClaimChildPending)(claim);
 			try {
-				deleteAvd(avdName);
+				await deleteAvd(avdName);
 			} finally {
 				(0, ownership_claim_exports.clearClaimChild)(claim);
 			}
@@ -1362,16 +912,16 @@ const BROWSER_EXIT_WAIT_MS = 15e3;
 const CHROME_KILL_WAIT_MS = 5e3;
 async function stopOwnedChrome(record, profile) {
 	for (const signal of ["SIGTERM", "SIGKILL"]) {
-		const state = chromeProcessState(record, profile);
+		const state = await chromeProcessStateAsync(record, profile);
 		if (state === "gone") return true;
 		if (state === "unknown") return false;
 		try {
-			signalProcessTree(record.pid, signal, { group: true });
+			await signalProcessTreeAsync(record.pid, signal, { group: true });
 		} catch {}
 		const deadline = Date.now() + CHROME_KILL_WAIT_MS;
-		while (chromeProcessState(record, profile) !== "gone" && Date.now() < deadline) await sleepAsync(50);
+		while (await chromeProcessStateAsync(record, profile) !== "gone" && Date.now() < deadline) await sleepAsync(50);
 	}
-	return chromeProcessState(record, profile) === "gone";
+	return await chromeProcessStateAsync(record, profile) === "gone";
 }
 const sleepAsync = (ms) => new Promise((done) => setTimeout(done, ms));
 /**
@@ -1433,7 +983,7 @@ async function teardownBrowserHeld(root, { deleteProfile = false } = {}) {
 				kind: "not-verified",
 				reason: claims.status === "held" ? `the browser supervisor claim is still held${claims.holder ? ` by pid ${claims.holder.owner.pid}` : ""}` : `the browser supervisor claim could not be cleared (${claims.reason}); remove it with ${(0, ownership_claim_exports.claimRemoveCommand)(webClaimRoot(root))}`
 			};
-			clearWebRecord(root, record);
+			await withWorkspaceStateLockAsync(root, () => clearWebRecord(root, record));
 			await releaseBrowserPort(root, record.cdpPort);
 		} else {
 			const holder = liveProfileHolder(profile);
@@ -1469,82 +1019,620 @@ async function teardownBrowserHeld(root, { deleteProfile = false } = {}) {
 		};
 	}
 }
-//#endregion
-//#region src/macos/instances.ts
-const BUNDLE_EXECUTABLE = /^[^/]+\.app\/Contents\/MacOS\/[^/]+$/;
-function bundleDirs(root) {
-	const dir = macosDir(root);
-	if (process.platform !== "darwin" || !existsSync(dir)) return [];
-	return [.../* @__PURE__ */ new Set([dir, realpathSync(dir)])];
+//#endregion
+//#region src/macos/instances.ts
+const BUNDLE_EXECUTABLE = /^[^/]+\.app\/Contents\/MacOS\/[^/]+$/;
+function bundleDirs(root) {
+	const dir = macosDir(root);
+	if (process.platform !== "darwin" || !existsSync(dir)) return [];
+	return [.../* @__PURE__ */ new Set([dir, realpathSync(dir)])];
+}
+function isBundleExecutable(path, dirs) {
+	return dirs.some((dir) => path.startsWith(`${dir}/`) && BUNDLE_EXECUTABLE.test(path.slice(dir.length + 1)));
+}
+/** Pids from `ps -axww -o pid=,comm=` output whose command names a bundle executable inside `dirs`. */
+function bundleCandidates(psOutput, dirs) {
+	const pids = [];
+	for (const line of psOutput.split("\n")) {
+		const match = /^\s*(\d+)\s+(.+)$/.exec(line);
+		if (match && isBundleExecutable(match[2], dirs)) pids.push(Number(match[1]));
+	}
+	return pids;
+}
+/** Whether `lsof -Fn -d txt` output for one process names a bundle executable inside `dirs`. */
+function lsofNamesBundleExecutable(lsofOutput, dirs) {
+	return lsofOutput.split("\n").some((line) => line.startsWith("n") && isBundleExecutable(line.slice(1), dirs));
+}
+function candidatePids(dirs) {
+	if (!dirs.length) return [];
+	return bundleCandidates(getExecutor().runFile("ps", [
+		"-axww",
+		"-o",
+		"pid=,comm="
+	], { timeoutMs: 1e4 }), dirs).filter((pid) => pid !== process.pid);
+}
+/** Pids that claim to run an app bundle from the workspace's macOS directory. `ps` reports argv[0], so this is a lead. */
+function bundleInstancePids(root) {
+	return candidatePids(bundleDirs(root));
+}
+function unverified(pid, why) {
+	return Object.assign(/* @__PURE__ */ new Error(`Cannot verify macOS app pid ${pid}: ${why}; no signal was sent.`), { code: "STIM_MACOS_OWNER_UNVERIFIED" });
+}
+function bundleRecord(pid) {
+	const processToken = (0, process_identity_exports.captureProcessToken)(pid);
+	const start = (0, process_identity_exports.processStartMicros)(pid);
+	if (!processToken || start.status !== "running") {
+		if (start.status === "gone") return null;
+		throw unverified(pid, "its identity cannot be captured");
+	}
+	return {
+		pid,
+		processToken,
+		startedAtMicros: start.startedAtMicros
+	};
+}
+function failedBundleListing(record, error) {
+	if (["gone", "different"].includes((0, process_identity_exports.inspectProcessIdentity)(record))) return null;
+	const open = String(error.stdout ?? "");
+	if (!open.trim()) throw unverified(record.pid, `lsof failed (${error.message.split("\n")[0]})`);
+	return open;
+}
+/** Verifies owned bundle instances without blocking on process and executable probes. */
+async function runningBundleInstancesAsync(root) {
+	const dirs = bundleDirs(root);
+	if (!dirs.length) return [];
+	const listing = await getExecutor().runFileAsync("ps", [
+		"-axww",
+		"-o",
+		"pid=,comm="
+	], {
+		timeoutMs: 1e4,
+		killSignal: "SIGKILL"
+	});
+	const instances = [];
+	for (const pid of bundleCandidates(listing, dirs).filter((candidate) => candidate !== process.pid)) {
+		const record = bundleRecord(pid);
+		if (!record) continue;
+		let open;
+		try {
+			open = await getExecutor().runFileAsync("lsof", [
+				"-a",
+				"-p",
+				String(pid),
+				"-d",
+				"txt",
+				"-Fn"
+			], {
+				timeoutMs: 1e4,
+				killSignal: "SIGKILL"
+			});
+		} catch (error) {
+			const partial = failedBundleListing(record, error);
+			if (partial === null) continue;
+			open = partial;
+		}
+		if (lsofNamesBundleExecutable(open, dirs)) instances.push(record);
+	}
+	return instances;
+}
+//#endregion
+//#region src/engine/tunnel.ts
+function tunnelArgv(provider, port, ngrokUrl, logFile, tailscaleBinary = "tailscale") {
+	if (provider === "tailscale") return {
+		bin: tailscaleBinary,
+		args: [
+			"serve",
+			`--https=${port}`,
+			`http://127.0.0.1:${port}`
+		]
+	};
+	if (provider === "cloudflared") return {
+		bin: "cloudflared",
+		args: [
+			"tunnel",
+			"--url",
+			`http://127.0.0.1:${port}`,
+			...logFile ? ["--logfile", logFile] : []
+		]
+	};
+	return {
+		bin: "ngrok",
+		args: [
+			"http",
+			String(port),
+			`--log=${logFile || "stdout"}`,
+			"--log-format=json",
+			...ngrokUrl ? ["--url", ngrokUrl] : []
+		]
+	};
+}
+const CLOUDFLARED_URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/i;
+function parseCloudflaredLine(line) {
+	const match = line.match(CLOUDFLARED_URL_RE);
+	return match ? match[0] : null;
+}
+function parseNgrokLine(line) {
+	let data;
+	try {
+		data = JSON.parse(line);
+	} catch {
+		return null;
+	}
+	if (typeof data !== "object" || data === null) return null;
+	const url = data.url;
+	return typeof url === "string" && /^https?:\/\//i.test(url) ? url : null;
+}
+function parseTailscaleLine(line) {
+	return /^https:\/\/[^\s/]+\.ts\.net(:\d+)?\/?$/.test(line) ? line : null;
+}
+function parserFor(provider) {
+	if (provider === "tailscale") return parseTailscaleLine;
+	return provider === "cloudflared" ? parseCloudflaredLine : parseNgrokLine;
+}
+const URL_TIMEOUT_MS = 15e3;
+const REACHABLE_TIMEOUT_MS = 24e4;
+const REACHABLE_POLL_MS = 2e3;
+const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function withManagedTunnelLock(root, fn, options = {}) {
+	return withWorkspaceProcessLock(managedTunnelLockRoot(root), "metro-tunnel", fn, {
+		...options,
+		rejectOwnerPurposes: ["workspace removal"]
+	});
+}
+async function withManagedTunnelRemovalLock(root, fn, options = {}) {
+	return withWorkspaceProcessLock(managedTunnelLockRoot(root), "metro-tunnel", fn, {
+		...options,
+		ownerPurpose: "workspace removal"
+	});
+}
+async function withManagedRemoteWorktreeLock(worktreeRoot, fn, options = {}) {
+	return withWorkspaceProcessLock(managedRemoteWorktreeLockRoot(worktreeRoot), "managed-remote", fn, {
+		...options,
+		external: true,
+		rejectOwnerPurposes: ["worktree removal"]
+	});
+}
+async function withManagedRemoteWorktreeRemovalLock(worktreeRoot, fn, options = {}) {
+	return withWorkspaceProcessLock(managedRemoteWorktreeLockRoot(worktreeRoot), "managed-remote", fn, {
+		...options,
+		external: true,
+		ownerPurpose: "worktree removal"
+	});
+}
+function managedLockHolders(root) {
+	const locks = [{
+		label: "managed tunnel",
+		path: workspaceProcessLockPath(managedTunnelLockRoot(root), "metro-tunnel", false)
+	}, {
+		label: "managed remote",
+		path: workspaceProcessLockPath(managedRemoteWorktreeLockRoot(root), "managed-remote", true)
+	}];
+	const reasons = [];
+	for (const { label, path } of locks) {
+		const claims = (0, ownership_claim_exports.readClaimSet)(path);
+		const holder = claims.live[0];
+		if (holder) {
+			const purpose = typeof holder.details.purpose === "string" ? ` for ${holder.details.purpose}` : "";
+			reasons.push(`the ${label} lock is held${purpose}`);
+		} else if (claims.unresolved[0]) reasons.push(`the ${label} lock cannot be resolved: ${claims.unresolved[0].reason}`);
+	}
+	return reasons;
+}
+function managedTunnelLockRoot(root) {
+	const key = createHash("sha256").update(resolve(root)).digest("hex");
+	return join(getConfigDir(), "process-locks", key);
+}
+function managedRemoteWorktreeLockRoot(worktreeRoot) {
+	const key = createHash("sha256").update(resolve(worktreeRoot)).digest("hex");
+	return join(getConfigDir(), "process-locks", "worktrees", key);
+}
+async function defaultProbeReachable(url, signal) {
+	const status = await probePublicHttp(url, signal);
+	return status !== null && status > 0;
+}
+function waitForUrl(child, parseLine, timeoutMs) {
+	return new Promise((resolve) => {
+		let settled = false;
+		let lastLine = null;
+		let timer;
+		let onOut;
+		let onErr;
+		let onError;
+		let onExit;
+		const finish = (url, exited = false) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			child.stdout?.removeListener("data", onOut);
+			child.stderr?.removeListener("data", onErr);
+			child.removeListener("error", onError);
+			child.removeListener("exit", onExit);
+			resolve({
+				url,
+				exited,
+				lastLine
+			});
+		};
+		const onLine = (line) => {
+			if (settled) return;
+			if (line.trim()) lastLine = line.trim();
+			const url = parseLine(line);
+			if (url) finish(url);
+		};
+		const outReader = createLineReader(onLine);
+		const errReader = createLineReader(onLine);
+		onOut = (chunk) => outReader.push(chunk);
+		onErr = (chunk) => errReader.push(chunk);
+		onError = () => finish(null);
+		onExit = () => {
+			outReader.flush();
+			errReader.flush();
+			finish(null, true);
+		};
+		child.stdout?.setEncoding?.("utf-8");
+		child.stderr?.setEncoding?.("utf-8");
+		child.stdout?.on("data", onOut);
+		child.stderr?.on("data", onErr);
+		child.on("error", onError);
+		child.on("exit", onExit);
+		timer = setTimeout(() => finish(null), timeoutMs);
+	});
+}
+function waitForFileUrl(child, logFile, parseLine, timeoutMs) {
+	return new Promise((resolve) => {
+		let settled = false;
+		let watcher = null;
+		const finish = (url, exited = false) => {
+			if (settled) return;
+			settled = true;
+			watcher?.close();
+			clearInterval(interval);
+			clearTimeout(timer);
+			child.removeListener("error", onError);
+			child.removeListener("exit", onExit);
+			resolve({
+				url,
+				exited
+			});
+		};
+		const probe = () => {
+			try {
+				for (const line of readFileSync(logFile, "utf-8").split(/\r?\n/)) {
+					const url = parseLine(line);
+					if (url) return finish(url);
+				}
+			} catch {}
+		};
+		const onError = () => finish(null);
+		const onExit = () => finish(null, true);
+		child.on("error", onError);
+		child.on("exit", onExit);
+		try {
+			watcher = watch(dirname(logFile), (_event, name) => {
+				if (name === null || name.toString() === basename(logFile)) probe();
+			});
+			watcher.on("error", () => {
+				watcher?.close();
+				watcher = null;
+			});
+			watcher.unref();
+		} catch {}
+		const interval = setInterval(probe, Math.min(1e3, timeoutMs));
+		const timer = setTimeout(() => finish(null), timeoutMs);
+		probe();
+	});
+}
+function createTunnelLogFile(provider) {
+	const dir = join(getConfigDir(), "tunnel-logs");
+	mkdirSync(dir, { recursive: true });
+	const path = join(dir, `${provider}-${randomUUID()}.log`);
+	closeSync(openSync(path, "wx", 384));
+	return path;
+}
+function removeTunnelLogFile(path) {
+	if (!path) return;
+	try {
+		unlinkSync(path);
+	} catch {}
+}
+function removeRecordedTunnelLogFile(path) {
+	if (!path) return;
+	const dir = resolve(join(getConfigDir(), "tunnel-logs"));
+	const resolved = resolve(path);
+	if (!resolved.startsWith(`${dir}${sep}`) || resolve(join(dir, basename(resolved))) !== resolved) return;
+	removeTunnelLogFile(resolved);
+}
+async function waitUntilReachable({ url, now, sleep, probe, timeoutMs }) {
+	const deadline = now() + timeoutMs;
+	for (;;) {
+		if (await probe(url, new AbortController().signal).catch(() => false)) return true;
+		if (now() >= deadline) return false;
+		await sleep(REACHABLE_POLL_MS);
+	}
+}
+const CLEANUP_TIMEOUT_MS = 1e3;
+const CLEANUP_POLL_MS = 25;
+async function startTunnel({ provider, port, spawnFn = null, urlTimeoutMs = URL_TIMEOUT_MS, reachableTimeoutMs = REACHABLE_TIMEOUT_MS, probeReachable = defaultProbeReachable, now = Date.now, sleep = defaultSleep, ngrokUrl = null, requireReachable = true, cleanupTimeoutMs = CLEANUP_TIMEOUT_MS, isChildAlive = pidExists, readProcessToken = process_identity_exports.captureProcessToken, logFile = null }) {
+	const spawn = spawnFn || ((cmd, args, opts) => getExecutor().spawn(cmd, args, opts));
+	const outputFile = provider === "tailscale" ? null : logFile || (spawnFn ? null : createTunnelLogFile(provider));
+	let child;
+	try {
+		const binary = provider === "tailscale" ? resolveTailscaleBinary((bin) => getExecutor().findExecutable(bin)) : provider;
+		if (!binary) throw new Error("Install Tailscale and sign in to your tailnet.");
+		const { bin, args } = tunnelArgv(provider, port, ngrokUrl, outputFile, binary);
+		child = spawn(bin, args, {
+			stdio: outputFile ? [
+				"ignore",
+				"ignore",
+				"ignore"
+			] : [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			detached: true
+		});
+	} catch (err) {
+		removeTunnelLogFile(outputFile);
+		return {
+			failed: true,
+			reason: `Could not start ${provider}: ${describe(err)}`
+		};
+	}
+	let childExited = false;
+	child.once("exit", () => {
+		childExited = true;
+	});
+	const cleanup = async (alreadyExited = childExited) => {
+		const stopped = await terminateChild(child, {
+			alreadyExited,
+			timeoutMs: cleanupTimeoutMs,
+			now,
+			sleep,
+			isAlive: isChildAlive
+		});
+		if (stopped) removeTunnelLogFile(outputFile);
+		return stopped ? { status: "stopped" } : {
+			status: "failed",
+			reason: `Sent SIGKILL but could not confirm that pid ${child.pid ?? "unknown"} exited.`
+		};
+	};
+	const failAfterCleanup = async (reason, alreadyExited = childExited) => {
+		const stopped = await cleanup(alreadyExited);
+		return stopped.status === "stopped" ? {
+			failed: true,
+			reason
+		} : {
+			failed: true,
+			reason: `${reason} ${stopped.reason}`,
+			cleanupFailed: true
+		};
+	};
+	const pid = child.pid;
+	if (!pid) return failAfterCleanup(`${provider} started but reported no pid.`);
+	const captureChildIdentity = () => {
+		try {
+			return readProcessToken(pid);
+		} catch {
+			return null;
+		}
+	};
+	const initialProcessToken = captureChildIdentity();
+	if (!initialProcessToken) return failAfterCleanup(`${provider} started but its process identity token could not be read.`);
+	const { url, exited, lastLine } = outputFile ? await waitForFileUrl(child, outputFile, parserFor(provider), urlTimeoutMs) : await waitForUrl(child, parserFor(provider), urlTimeoutMs);
+	if (!url) return failAfterCleanup(exited ? provider === "tailscale" && lastLine ? `${provider} exited before printing a tunnel URL: ${lastLine}` : `${provider} exited before printing a tunnel URL.` : `${provider} did not print a tunnel URL within ${urlTimeoutMs}ms.`, exited || childExited);
+	if (!outputFile) resumeChildPipes(child);
+	if (requireReachable) {
+		if (!await waitUntilReachable({
+			url,
+			now,
+			sleep,
+			probe: probeReachable,
+			timeoutMs: reachableTimeoutMs
+		})) return failAfterCleanup(`${url} did not become reachable within ${reachableTimeoutMs}ms; ${provider} may still be registering, or the network path is blocked.`);
+	}
+	const finalProcessToken = captureChildIdentity();
+	if (!finalProcessToken || finalProcessToken !== initialProcessToken) return failAfterCleanup(`${provider} process identity changed before its tunnel could be recorded.`);
+	if (!outputFile) unrefChildPipes(child);
+	child.unref?.();
+	if (childExited) return failAfterCleanup(`${provider} exited before its tunnel could be recorded.`, true);
+	return {
+		url,
+		pid,
+		processToken: initialProcessToken,
+		logFile: outputFile,
+		cleanup: () => cleanup()
+	};
+}
+async function startTunnelSequence({ providers, port, ngrokUrl = null, requireReachable = true, start = startTunnel }) {
+	const failures = [];
+	for (const provider of providers) {
+		const result = await start({
+			provider,
+			port,
+			ngrokUrl: provider === "ngrok" ? ngrokUrl : null,
+			requireReachable
+		});
+		if (!("failed" in result)) return {
+			provider,
+			...result
+		};
+		failures.push(`${provider}: ${result.reason}`);
+		if (result.cleanupFailed) return {
+			failed: true,
+			reason: failures.join(" ")
+		};
+	}
+	return {
+		failed: true,
+		reason: failures.join(" ") || "No managed tunnel provider was selected."
+	};
+}
+function closeChildPipes(child) {
+	child.stdout?.destroy?.();
+	child.stderr?.destroy?.();
 }
-function isBundleExecutable(path, dirs) {
-	return dirs.some((dir) => path.startsWith(`${dir}/`) && BUNDLE_EXECUTABLE.test(path.slice(dir.length + 1)));
+function unrefChildPipes(child) {
+	resumeChildPipes(child);
+	for (const stream of [child.stdout, child.stderr]) stream?.unref?.();
 }
-/** Pids from `ps -axww -o pid=,comm=` output whose command names a bundle executable inside `dirs`. */
-function bundleCandidates(psOutput, dirs) {
-	const pids = [];
-	for (const line of psOutput.split("\n")) {
-		const match = /^\s*(\d+)\s+(.+)$/.exec(line);
-		if (match && isBundleExecutable(match[2], dirs)) pids.push(Number(match[1]));
+function resumeChildPipes(child) {
+	child.stdout?.resume?.();
+	child.stderr?.resume?.();
+}
+async function signalAndWaitForExit(child, signal, { timeoutMs, now, sleep, isAlive, platform }) {
+	let exited = false;
+	const onExit = () => {
+		exited = true;
+	};
+	child.once("exit", onExit);
+	try {
+		if (platform === "win32" && child.pid) signalProcessTree(child.pid, signal, { platform });
+		child.kill(signal);
+	} catch (err) {
+		child.removeListener("exit", onExit);
+		return isEsrch(err);
 	}
-	return pids;
+	const hasExited = () => exited;
+	const deadline = now() + timeoutMs;
+	while (!hasExited() && now() < deadline) await sleep(CLEANUP_POLL_MS);
+	if (!hasExited() && child.pid && !isAlive(child.pid)) exited = true;
+	child.removeListener("exit", onExit);
+	return hasExited();
 }
-/** Whether `lsof -Fn -d txt` output for one process names a bundle executable inside `dirs`. */
-function lsofNamesBundleExecutable(lsofOutput, dirs) {
-	return lsofOutput.split("\n").some((line) => line.startsWith("n") && isBundleExecutable(line.slice(1), dirs));
+async function terminateChild(child, { alreadyExited, timeoutMs, now, sleep, isAlive, platform = process.platform }) {
+	if (alreadyExited) {
+		closeChildPipes(child);
+		return true;
+	}
+	if (await signalAndWaitForExit(child, "SIGTERM", {
+		timeoutMs,
+		now,
+		sleep,
+		isAlive,
+		platform
+	})) {
+		closeChildPipes(child);
+		return true;
+	}
+	const killed = await signalAndWaitForExit(child, "SIGKILL", {
+		timeoutMs,
+		now,
+		sleep,
+		isAlive,
+		platform
+	});
+	closeChildPipes(child);
+	return killed;
 }
-function candidatePids(dirs) {
-	if (!dirs.length) return [];
-	return bundleCandidates(getExecutor().runFile("ps", [
-		"-axww",
-		"-o",
-		"pid=,comm="
-	], { timeoutMs: 1e4 }), dirs).filter((pid) => pid !== process.pid);
+function describe(err) {
+	return err?.message || String(err);
 }
-/** Pids that claim to run an app bundle from the workspace's macOS directory. `ps` reports argv[0], so this is a lead. */
-function bundleInstancePids(root) {
-	return candidatePids(bundleDirs(root));
+const STOP_TIMEOUT_MS = 5e3;
+const STOP_POLL_MS = 100;
+function isEsrch(err) {
+	return err?.code === "ESRCH";
 }
-function unverified(pid, why) {
-	return Object.assign(/* @__PURE__ */ new Error(`Cannot verify macOS app pid ${pid}: ${why}; no signal was sent.`), { code: "STIM_MACOS_OWNER_UNVERIFIED" });
+async function stopTunnel(record, { isAlive = pidExists, inspectIdentity = process_identity_exports.inspectProcessIdentity, platform = process.platform, kill = (pid) => signalProcessTreeAsync(pid, "SIGTERM", { platform }), now = Date.now, sleep = defaultSleep, timeoutMs = STOP_TIMEOUT_MS } = {}) {
+	const missing = () => {
+		removeRecordedTunnelLogFile(record?.logFile);
+		return { status: "missing" };
+	};
+	const pid = record?.pid;
+	if (!pid || !isAlive(pid)) return missing();
+	if (!record.processToken) return {
+		status: "failed",
+		reason: `tunnel pid ${pid} has no process identity token, so Stim cannot verify ownership. Keep the record. Inspect the process, stop it with the provider tooling, remove the stale metroTunnel state, and retry.`
+	};
+	const identity = inspectIdentity(record);
+	if (identity === "gone" || identity === "different") return missing();
+	if (identity !== "same") return {
+		status: "failed",
+		reason: `could not verify the process identity for tunnel pid ${pid}; refusing to signal it.`
+	};
+	try {
+		await kill(pid);
+	} catch (err) {
+		return isEsrch(err) ? missing() : {
+			status: "failed",
+			reason: describe(err)
+		};
+	}
+	const deadline = now() + timeoutMs;
+	const exited = () => {
+		if (!isAlive(pid)) return true;
+		const current = inspectIdentity(record);
+		return current === "gone" || current === "different";
+	};
+	while (now() < deadline && !exited()) await sleep(STOP_POLL_MS);
+	if (!exited()) return {
+		status: "failed",
+		reason: `pid ${pid} did not exit within ${timeoutMs}ms.`
+	};
+	removeRecordedTunnelLogFile(record.logFile);
+	return { status: "stopped" };
 }
-/**
-* Every running process whose executable is an app bundle Stim built in the workspace's macOS directory, however it
-* was launched. Each identity is captured before its executable is confirmed with lsof.
-*/
-function runningBundleInstances(root) {
-	const dirs = bundleDirs(root);
-	const instances = [];
-	for (const pid of candidatePids(dirs)) {
-		const processToken = (0, process_identity_exports.captureProcessToken)(pid);
-		const start = (0, process_identity_exports.processStartMicros)(pid);
-		if (!processToken || start.status !== "running") {
-			if (start.status === "gone") continue;
-			throw unverified(pid, "its identity cannot be captured");
-		}
-		const record = {
+//#endregion
+//#region src/supervisor/ownership.ts
+function resolveSupervisorTarget({ state, record, reservedPort, isAlive = pidExists, inspectIdentity = process_identity_exports.inspectProcessIdentity } = {}) {
+	const statePid = numberOrNull(state?.pid);
+	const recordPid = numberOrNull(record?.pid);
+	const pid = statePid ?? recordPid;
+	if (!pid) return { status: "none" };
+	if (statePid && recordPid && statePid !== recordPid) {
+		const gone = (entry) => ["gone", "different"].includes(inspectIdentity(entry));
+		if (gone(state) && gone(record)) return {
+			status: "stale",
+			pid
+		};
+		return {
+			status: "unverified",
 			pid,
-			processToken,
-			startedAtMicros: start.startedAtMicros
+			reason: `workspace state.json records supervisor pid ${statePid} but the registry records pid ${recordPid}`
 		};
-		let open;
-		try {
-			open = getExecutor().runFile("lsof", [
-				"-a",
-				"-p",
-				String(pid),
-				"-d",
-				"txt",
-				"-Fn"
-			], { timeoutMs: 1e4 });
-		} catch (error) {
-			if (["gone", "different"].includes((0, process_identity_exports.inspectProcessIdentity)(record))) continue;
-			open = String(error.stdout ?? "");
-			if (!open.trim()) throw unverified(pid, `lsof failed (${error.message.split("\n")[0]})`);
-		}
-		if (lsofNamesBundleExecutable(open, dirs)) instances.push(record);
 	}
-	return instances;
+	if (!isAlive(pid)) return {
+		status: "stale",
+		pid
+	};
+	const port = numberOrNull(state?.port) ?? numberOrNull(record?.port);
+	if (reservedPort !== null && reservedPort !== void 0 && port !== null && port !== reservedPort) return {
+		status: "unverified",
+		pid,
+		reason: `supervisor pid ${pid} records port ${port}, but this project reserved port ${reservedPort}`
+	};
+	if (reservedPort !== null && reservedPort !== void 0 && port === null) return {
+		status: "unverified",
+		pid,
+		reason: `supervisor pid ${pid} has no recorded port, so it cannot be matched against reserved port ${reservedPort}`
+	};
+	const identityRecord = statePid ? state : record;
+	if (statePid && recordPid && state?.processToken !== record?.processToken) return {
+		status: "unverified",
+		pid,
+		reason: "workspace state and registry process identities disagree"
+	};
+	const identity = inspectIdentity(identityRecord);
+	if (identity === "gone" || identity === "different") return {
+		status: "stale",
+		pid
+	};
+	if (identity !== "same") return {
+		status: "unverified",
+		pid,
+		reason: "the recorded process identity could not be verified"
+	};
+	return {
+		status: "ours",
+		processToken: identityRecord.processToken,
+		pid,
+		port,
+		mode: state?.mode ?? record?.mode ?? null,
+		startedAt: state?.startedAt ?? record?.startedAt ?? null
+	};
+}
+function numberOrNull(v) {
+	return typeof v === "number" && Number.isSafeInteger(v) && v > 0 ? v : null;
 }
 //#endregion
 //#region src/workspace/in-use.ts
@@ -1666,7 +1754,7 @@ function readRecordedRoot(dir, name) {
 		projectRoot: null,
 		problem: "its workspace.json records no absolute project root"
 	};
-	if (workspaceName(projectRoot) !== name) return {
+	if (workspaceName$1(projectRoot) !== name) return {
 		projectRoot: null,
 		problem: `its workspace.json records ${projectRoot}, whose workspace directory has another name`
 	};
@@ -1760,10 +1848,21 @@ function collectOrphanedWorkspaces(registryKeys, mountedVolumes, { measure = tru
 		isMounted: (path) => isOnMountedVolume(path, mountedVolumes),
 		inUse: (root) => workspaceInUse(root)
 	});
-	return {
-		orphaned: measure ? classified.orphaned.map((entry) => Object.assign({}, entry, { bytes: sizeOf(entry.dir) })) : classified.orphaned,
-		skipped: classified.skipped
-	};
+	if (!measure) return classified;
+	return (async () => {
+		const orphaned = [];
+		for (const entry of classified.orphaned) {
+			const bytes = await measuredDirectorySizeAsync(entry.dir, { timeoutMs: SIZE_TIMEOUT_MS });
+			orphaned.push({
+				...entry,
+				bytes
+			});
+		}
+		return {
+			orphaned,
+			skipped: classified.skipped
+		};
+	})();
 }
 const REBUILD_COST = "The next build of an unchanged app installs from the shared build cache; after a native change the compilation cache speeds the rebuild, but on React Native 0.86 Swift does not use it (explicit modules are off), so that build recompiles Swift. The next stim macos in a cleared workspace is a full Swift build.";
 const WORKSPACE_OUTPUT_DIRS = [
@@ -1789,9 +1888,6 @@ function planWorkspaceOutputs(entries, { olderThan, now }) {
 	});
 }
 const SIZE_TIMEOUT_MS = 6e4;
-function sizeOf(dir, timeoutMs = SIZE_TIMEOUT_MS) {
-	return measuredDirectorySize(dir, { timeoutMs });
-}
 function outputPaths(dir) {
 	const paths = WORKSPACE_OUTPUT_DIRS.map((name) => join$1(dir, name)).filter((path) => existsSync$1(path));
 	const macos = join$1(dir, "macos");
@@ -1801,10 +1897,10 @@ function outputPaths(dir) {
 	} catch {}
 	return paths;
 }
-function outputBytes(paths, timeoutMs) {
+async function outputBytes(paths, timeoutMs) {
 	let total = 0;
 	for (const path of paths) {
-		const size = sizeOf(path, timeoutMs);
+		const size = await measuredDirectorySizeAsync(path, { timeoutMs });
 		if (size === null) return null;
 		total += size;
 	}
@@ -1812,19 +1908,32 @@ function outputBytes(paths, timeoutMs) {
 }
 function collectWorkspaceOutputs({ olderThan, now, exclude = [], measure = true, sizeTimeoutMs = SIZE_TIMEOUT_MS }) {
 	const mountedVolumes = listMountedVolumes();
-	const entries = listWorkspaceDirs().filter((entry) => !exclude.includes(entry.dir)).filter((entry) => entry.projectRoot === null || isOnMountedVolume(entry.projectRoot, mountedVolumes)).map((entry) => Object.assign({}, entry, { paths: outputPaths(entry.dir) })).filter((entry) => entry.paths.length > 0).map(({ paths, ...entry }) => Object.assign({}, entry, { bytes: measure ? outputBytes(paths, sizeTimeoutMs) : null })).map((entry) => Object.assign({}, entry, {
-		lastUsed: entry.projectRoot === null ? NaN : workspaceLastUsed(entry.projectRoot),
-		inUse: entry.projectRoot === null ? [] : workspaceInUse(entry.projectRoot)
-	}));
-	return {
+	const entries = listWorkspaceDirs().filter((entry) => !exclude.includes(entry.dir)).filter((entry) => entry.projectRoot === null || isOnMountedVolume(entry.projectRoot, mountedVolumes)).map((entry) => Object.assign({}, entry, { paths: outputPaths(entry.dir) })).filter((entry) => entry.paths.length > 0);
+	const report = (sizes) => ({
 		root: workspacesRoot(),
-		workspaces: planWorkspaceOutputs(entries, {
+		workspaces: planWorkspaceOutputs(sizes.map((entry) => ({
+			...entry,
+			lastUsed: entry.projectRoot === null ? NaN : workspaceLastUsed(entry.projectRoot),
+			inUse: entry.projectRoot === null ? [] : workspaceInUse(entry.projectRoot)
+		})), {
 			olderThan,
 			now
 		})
-	};
+	});
+	if (!measure) return report(entries.map(({ paths: _paths, ...entry }) => ({
+		...entry,
+		bytes: null
+	})));
+	return (async () => {
+		const sizes = [];
+		for (const { paths, ...entry } of entries) sizes.push({
+			...entry,
+			bytes: await outputBytes(paths, sizeTimeoutMs)
+		});
+		return report(sizes);
+	})();
 }
-async function clearWorkspaceOutputs(report, { olderThan, now = Date.now() }) {
+async function clearWorkspaceOutputs(report, { olderThan, now = Date.now() }, { log, record } = GC_OUTPUT) {
 	let failures = 0;
 	let cleared = 0;
 	const clearedRoots = [];
@@ -1832,8 +1941,8 @@ async function clearWorkspaceOutputs(report, { olderThan, now = Date.now() }) {
 		const root = entry.projectRoot;
 		if (!entry.willClear || root === null) {
 			if (entry.keptReason) {
-				console.log(chalk.dim(`Kept the build outputs of ${root ?? entry.dir}: ${entry.keptReason}`));
-				recordGcResult("workspaceOutputs", "kept", root ?? entry.dir, {
+				log(chalk.dim(`Kept the build outputs of ${root ?? entry.dir}: ${entry.keptReason}`));
+				record("workspaceOutputs", "kept", root ?? entry.dir, {
 					bytes: entry.bytes,
 					detail: entry.keptReason
 				});
@@ -1861,8 +1970,8 @@ async function clearWorkspaceOutputs(report, { olderThan, now = Date.now() }) {
 			}, { purpose: "gc" });
 		} catch (error) {
 			failures++;
-			console.log(chalk.red(`Could not clear the build outputs of ${root}: ${error?.message || String(error)}`));
-			recordGcResult("workspaceOutputs", "failed", root, {
+			log(chalk.red(`Could not clear the build outputs of ${root}: ${error?.message || String(error)}`));
+			record("workspaceOutputs", "failed", root, {
 				bytes: entry.bytes,
 				detail: error?.message || String(error)
 			});
@@ -1870,8 +1979,8 @@ async function clearWorkspaceOutputs(report, { olderThan, now = Date.now() }) {
 		}
 		const kept = run.ran ? run.value : `in use: ${run.reasons.join("; ")}`;
 		if (kept) {
-			console.log(chalk.yellow(`Kept the build outputs of ${root}: ${kept}`));
-			recordGcResult("workspaceOutputs", "kept", root, {
+			log(chalk.yellow(`Kept the build outputs of ${root}: ${kept}`));
+			record("workspaceOutputs", "kept", root, {
 				bytes: entry.bytes,
 				detail: kept
 			});
@@ -1879,10 +1988,10 @@ async function clearWorkspaceOutputs(report, { olderThan, now = Date.now() }) {
 		}
 		cleared += entry.bytes ?? 0;
 		clearedRoots.push(root);
-		console.log(chalk.green(`Cleared the build outputs of ${root} (${sizeText(entry.bytes)})`));
-		recordGcResult("workspaceOutputs", "done", root, { bytes: entry.bytes });
+		log(chalk.green(`Cleared the build outputs of ${root} (${sizeText(entry.bytes)})`));
+		record("workspaceOutputs", "done", root, { bytes: entry.bytes });
 	}
-	if (cleared) console.log(chalk.dim(`Cleared ${formatBytes(cleared)} of workspace build outputs. ${REBUILD_COST}`));
+	if (cleared) log(chalk.dim(`Cleared ${formatBytes(cleared)} of workspace build outputs. ${REBUILD_COST}`));
 	return {
 		failures,
 		cleared: clearedRoots
@@ -1940,4 +2049,4 @@ function sizeText(bytes) {
 	return bytes === null ? "size unknown" : formatBytes(bytes);
 }
 //#endregion
-export { withManagedRemoteWorktreeRemovalLock as A, recordGcResult as C, stopTunnel as D, startTunnelSequence as E, acquireBuildSlot as F, listBuildSlots as I, releaseBuildSlot as L, withManagedTunnelRemovalLock as M, probePublicHttp as N, terminateChild as O, resolveSupervisorTarget as P, teardownParkedIosSim as S, canonicalPath as T, teardownBrowserHeld as _, collectWorkspaceOutputs as a, teardownOwnedIosSim as b, listWorkspaceDirs as c, emptyWorkspaceDir as d, withIdleWorkspace as f, eraseParkedIosSim as g, eraseParkedAvd as h, collectOrphanedWorkspaces as i, withManagedTunnelLock as j, withManagedRemoteWorktreeLock as k, rootPresence as l, runningBundleInstances as m, WORKSPACE_OUTPUT_DIRS as n, deleteOrphanedWorkspaces as o, workspaceInUse as p, clearWorkspaceOutputs as r, isInsideWorkspaces as s, REBUILD_COST as t, sizeText as u, teardownOwnedAvd as v, takeGcResults as w, teardownParkedAvd as x, teardownOwnedBrowser as y };
+export { teardownParkedIosSim as A, takeGcResults as B, eraseParkedAvd as C, teardownOwnedBrowser as D, teardownOwnedAvd as E, acquireBuildSlot as F, listBuildSlots as I, releaseBuildSlot as L, canonical$1 as M, measureDu as N, teardownOwnedIosSim as O, writeUsageCache as P, GC_OUTPUT as R, runningBundleInstancesAsync as S, teardownBrowserHeld as T, terminateChild as _, collectWorkspaceOutputs as a, withManagedTunnelLock as b, listWorkspaceDirs as c, emptyWorkspaceDir as d, withIdleWorkspace as f, stopTunnel as g, startTunnelSequence as h, collectOrphanedWorkspaces as i, probePublicHttp as j, teardownParkedAvd as k, rootPresence as l, resolveSupervisorTarget as m, WORKSPACE_OUTPUT_DIRS as n, deleteOrphanedWorkspaces as o, workspaceInUse as p, clearWorkspaceOutputs as r, isInsideWorkspaces as s, REBUILD_COST as t, sizeText as u, withManagedRemoteWorktreeLock as v, eraseParkedIosSim as w, withManagedTunnelRemovalLock as x, withManagedRemoteWorktreeRemovalLock as y, recordGcResult as z };