stim 1.27.0 → 1.28.0

package/dist/{guide-_rfEh_zM.mjs → guide-C4I46XAk.mjs}

@@ -1,8 +1,8 @@
-import { t as ANDROID_AVD_CONFIG_HELP } from "./settings-BDVI8Ivc.mjs";
-import { i as findProjectRoot$1 } from "./project-DYj-HVx6.mjs";
-import { h as RECENT_LAUNCH_MS } from "./eas-session-ledger-DrP4OuuM.mjs";
-import { o as guideStatus, t as WATCHMAN_NESTED_WORKTREES } from "./doctor-watchman-CxDbyrrt.mjs";
-import "./status-watch-BfabQn03.mjs";
+import { t as ANDROID_AVD_CONFIG_HELP } from "./settings-CY5JZlNN.mjs";
+import { i as findProjectRoot$1 } from "./project-Sui52ywT.mjs";
+import { h as RECENT_LAUNCH_MS } from "./eas-session-ledger-CBFo_Uo1.mjs";
+import { o as guideStatus, t as WATCHMAN_NESTED_WORKTREES } from "./doctor-watchman-BTW82PDC.mjs";
+import "./status-watch-BmsPqYSU.mjs";
 import { SETTINGS, SETTINGS_SCHEMA_URL, TUTORIAL_VERSION } from "@stim-cli/core/state";
 import chalk from "chalk";
 //#region src/guide/agent.ts
@@ -1834,8 +1834,8 @@ RULES
   reason is null for an entry --delete acts on, and otherwise a stable code
   to branch on; detail is the text line, for the user. Never parse detail.
   A linked worktree's detail is never null.
-    workspaceBuildOutputs   unresolved | in-use | last-use-unknown |
-                            recently-used
+    workspaceBuildOutputs   unresolved | locked | lock-unknown | in-use |
+                            last-use-unknown | recently-used
     workspaceLogs           unresolved | in-use | collector
     recordings              unresolved | retained | recently-recorded
     memory                  in-use | busy | unknown | build-running |
@@ -2480,7 +2480,35 @@ RULES
 
   capacity.committedMb sums memoryMb; in a \`status --watch --json\` line each
   figure, including an environment's memoryMb, is held on its own (see
-  \`guide lifecycle\`), so the sums can differ from what they sum. The memory budget plans before a boot
+  \`guide lifecycle\`), so the sums can differ from what they sum.
+
+  capacity.load is always present. capacity.builds is present only while
+  concurrency.maxBuilds is set, and capacity.devices only while
+  concurrency.maxDevices is set (see \`guide lifecycle concurrency\`):
+
+  load     { cpus, loadPerCore, busyAt, limit, state }. loadPerCore is the
+           5-minute load average divided by cpus, to one decimal. busyAt is
+           server.maxLoadPerCore (\`guide settings\`). state is free under
+           busyAt, busy at or over it, where automatic placement prefers
+           another machine, or holding at or over limit. limit is null
+           because no setting sets it yet, so state is never holding.
+
+  builds   { max, inUse, holders: [{ slot, workspace, client, since,
+           unresolved? }] }. inUse counts the slots below max that a new
+           build cannot take. workspace is the root of the local build in
+           the slot; client is the device id of the client whose offloaded
+           build this machine runs in it. An unresolved slot has a claim
+           whose holder Stim cannot identify; both are null, and the slot
+           stays in use until that claim is removed.
+  devices  { max, inUse, unknown?, holders: [{ platform, label, workspace,
+           slot, booting? }] }, the owned devices the cap counts: booted or
+           booting stim simulators, owned emulators adb lists, and boots in
+           progress. label is the label of the workspace that records the
+           device, with its device slot; for a device no workspace records,
+           label is its name and workspace and slot are null. inUse is null
+           and unknown says why when the devices could not be listed.
+
+  The memory budget plans before a boot
   and always uses the estimate. What is using CPU and memory now is the
   top-level machine section:
 
@@ -2779,19 +2807,19 @@ comes from \`start --remote\`, eas/proxy in \`ios.remote\`, or \`android.remote\
 
 HOSTED IOS METRO
   ios --remote <machine> keeps Metro local and needs no start --remote.
-  The supervisor watches private gateway requests in workspace state, binds
-  only this machine's Tailscale address and accepts only the pinned hosting peer
-  with a per-session secret. The host's bridge is loopback-only. For an Expo
-  dev client it listens on this machine's Metro port, which the dev server
+  The supervisor watches hosted Metro requests in workspace state and keeps a
+  few authenticated connections open to the host for each session. The host
+  pairs one with each connection the device makes to its loopback-only bridge,
+  and the supervisor forwards it to this Metro, so the host never connects back
+  to this machine and a shared or ACL-restricted host works. For an Expo
+  dev client the bridge listens on this machine's Metro port, which the dev server
   writes into the manifest. ios --remote starts Metro on a port free on both
   Macs; a running Metro or a pin on a port the host uses refuses the run before
-  the build. Port and secret
-  stay in 0600 workspace state and never appear in status, JSON or logs.
-  metro.tunnel and metro.publicUrl are ignored. Supervisor restart recreates
-  the recorded gateway; stop or a stopped hosted session closes it. A recorded
+  the build. metro.tunnel and metro.publicUrl are ignored. Supervisor restart
+  reopens the recorded links; stop or a stopped hosted session closes them. A recorded
   hosted session prevents Metro idle stop. Release runs skip the bridge.
-  Hosted Debug runs require the supervisor's private gateway support before
-  reservation. --no-metro-check refuses; restart a missing or older supervisor
+  Hosted Debug runs require a supervisor and a stim-server that support these
+  links before reservation. --no-metro-check refuses; restart a missing or older supervisor
   with stim stop; stim start.
   Native iOS and Android logs are pulled from the host by stim logs, including --errors;
   JavaScript logs still arrive through Metro. Stop pulls native logs before
@@ -2853,8 +2881,8 @@ BUNDLE WARMUP
   device logs may prove a request, but bundle completion may stay unverified.
 
 HOSTED ANDROID
-  android --remote <machine> keeps Metro here through the private tailnet
-  gateway. The host reverses the client Metro port into its loopback bridge
+  android --remote <machine> keeps Metro here through the same client-opened
+  links as hosted iOS. The host reverses the client Metro port into its loopback bridge
   on the exact owned emulator. Each run and reload restores that reverse;
   no adb command for the host serial runs here. metro.tunnel and metro.publicUrl
   are ignored. See guide lifecycle hosted-android.
@@ -3487,7 +3515,15 @@ msg and
   failure         failed or cancelled runs: { code, message, remedy, phase }
   device          { name, runtime? } of the simulator, emulator or device;
                   never its serial or UDID
+  loadPerCore     this machine's 5-minute load average per CPU when the run
+                  started, to one decimal
+  boot            { startedAt, loadPerCore } of the run's first owned
+                  simulator or emulator boot: epoch milliseconds when it
+                  started, once any concurrency.maxDevices wait was over,
+                  and the load per core then. Absent when the run booted
+                  nothing.
   stimVersion     the stim that ran the build
+Records written before these fields existed lack loadPerCore and boot.
 A run that stopped before it had an app to build (a refused flag, a missing
 project) writes no record. Writing the record never changes the run's result.
 
@@ -5661,7 +5697,7 @@ STIM_SUPERVISOR_EXITED, ...) before any build work. Release builds and
 \`--no-metro-check\` neither check nor start the dev server; hosted Debug iOS
 refuses --no-metro-check with STIM_BAD_ARG. \`--remote\`
 with eas or proxy starts it the way \`stim start --remote\` does. A named
-hosting Mac keeps Metro local through a private bridge; see hosted-ios. Step 2 remains useful to warm
+hosting Mac keeps Metro local through links this machine opens; see hosted-ios. Step 2 remains useful to warm
 Metro while other work happens.
 
 Each time Stim boots an owned local simulator or emulator, it mutes it: iOS
@@ -5841,7 +5877,8 @@ WAITING FOR A CHANGE
   status payload per line: one at once, then one each time the payload
   changes, never two identical ones in a row. In a watch line, a usage
   figure repeats its value in the previous line until it moves by a step: an owner's cpuPercent 5 points, an
-  owner's or environment's memoryMb and capacity.committedMb 16 MB. An owner's row
+  owner's or environment's memoryMb and capacity.committedMb 16 MB, and
+  capacity.load as a whole until its loadPerCore moves 1 per core or its state changes. An owner's row
   changes as a whole, so its residentMb and processes update with it. A change
   in only a bookkeeping timestamp prints no line: each pullRequest.checkedAt,
   maintenance.lastChecks, maintenance.lastPass.startedAt and durationMs, and
@@ -6087,8 +6124,8 @@ soon as it exists, then delivers one App.apk. The emulator boots headless;
 androidEmulatorApp is ignored with a note.
 
 React Native Debug requires the local Metro supervisor. metro.publicUrl and metro.tunnel
-are ignored with a note. A private tailnet gateway reaches the host loopback
-bridge; the host reverses the client's Metro port into that bridge on its exact
+are ignored with a note. Connections this machine opens to the host carry each
+device connection from the host loopback bridge to local Metro; the host reverses the client's Metro port into that bridge on its exact
 ledger-owned serial and sets debug_http_host to localhost:<clientMetroPort>.
 Each run and stim reload android restores the reverse, including after a host
 adb server restart. Reload broadcasts through the local Metro and never runs
@@ -6111,7 +6148,7 @@ session probe states; a conflicting local emulator remains visible with a
 warning. A recorded placement keeps the workspace in use and blocks idle stop.
 
 stop and worktree remove wait for device-host.stop, park the host's eligible owned
-emulator within pool.androidParkedMax (delete otherwise), close the gateway and clear placement. stop --json reports
+emulator within pool.androidParkedMax (delete otherwise), close the Metro links and clear placement. stop --json reports
 outcomes.device["android:host:<slot>"]. Forbidden or unknown-session also clears
 placement; an unreachable host keeps it and fails cleanup. A clean host restart
 parks eligible devices; a later reserve by the same client adopts a compatible
@@ -6317,9 +6354,10 @@ sessions.
 
 
 Stim builds or fetches before reserving, records the session immediately, then
-uploads the app on every run. React Native and Expo Debug keep Metro here; the supervisor owns a
-private gateway bound to this machine's Tailscale address, pinned to the host peer
-and protected by a per-session secret. The host exposes only a loopback bridge.
+uploads the app on every run. React Native and Expo Debug keep Metro here; the supervisor keeps
+authenticated connections open to the host, and the host pairs one with each
+connection the simulator makes to its loopback-only bridge. The host never
+connects back to this machine.
 For an Expo dev client the bridge listens on this machine's Metro port, because
 the dev server writes that port into the manifest's bundle URL. When this run
 starts Metro, it asks the host and picks a port free on both Macs, moving the
@@ -6327,8 +6365,8 @@ recorded port if the host uses it. A running Metro or a metro.port pin on a port
 the host uses refuses before the build: run stim stop, then stim ios --remote
 <machine> without stim start, or pin a port free on both Macs.
 No start --remote is needed; metro.tunnel and metro.publicUrl are ignored.
-Debug requires a running supervisor with private gateway support before reserving
-a simulator. --no-metro-check refuses with STIM_BAD_ARG for hosted Debug runs.
+Debug requires a running supervisor and a host stim-server that support these
+links before reserving a simulator. --no-metro-check refuses with STIM_BAD_ARG for hosted Debug runs.
 If its supervisor is missing or older, run stim stop; stim start, then retry.
 Non-Debug runs skip Metro. Launch is unverified until this workspace's Metro
 provides bundle evidence, or the host proves a live release process. Native Xcode
@@ -6341,14 +6379,14 @@ hosting Mac, refuses for that slot: run stim stop first.
 Status adds ios.host { machine, session, selected, device: { name, runtime },
 agent, state } per slot. A shutdown local simulator is replaced in status; a
 booted or unknown local simulator stays visible alongside ios.host with a warning.
-The default slot appears only in ios, never in slots[]. No host UDID or gateway secret enters local device state or
+The default slot appears only in ios, never in slots[]. No host UDID enters local device state or
 status. Ready is normal; stopped has a rerun hint; unknown or unreachable is
 unverified. A clean host server restart stops its sessions and retains eligible
 parked devices. A running session left by a crash stays unknown until explicit
 stop; the restarted server never re-attaches to a booted device.
 
 stop and worktree remove wait for the host to stop, park its eligible owned
-simulator within pool.iosParkedMax (delete otherwise), close the gateway and clear placement. stop --json
+simulator within pool.iosParkedMax (delete otherwise), close the Metro links and clear placement. stop --json
 reports each hosted slot under outcomes.device["ios:host:<slot>"], retaining
 local device outcomes and successful siblings when another slot fails. Revoked or
 missing sessions clear placement too. An unreachable host retains placement
@@ -8751,8 +8789,8 @@ DISK PRESSURE LEVELS
        gradle-versions, run again after step 5 so a daemon that did not exit
        still keeps them
   A directory is cleared only when it is a real directory inside its
-  worktree, git tracks nothing in it, its worktree is not in use, holds no
-  lock or build and is not pinned, and, for the node_modules and ios/Pods of
+  worktree, git tracks nothing in it, its worktree is not in use, is not
+  locked with git worktree lock, holds no build lock and is not pinned, and, for the node_modules and ios/Pods of
   level 3, nothing under it, nor the worktree's git index, HEAD or Stim
   state, changed within the short window. A build directory of level 2 also
   stays in a worktree where no Stim workspace has recorded any state; a build
@@ -9729,7 +9767,12 @@ WORKSPACE BUILD OUTPUTS
   detected cache, "Workspace build outputs", with a per-workspace size, last
   use and verdict. Plain \`gc --delete\` lightens every workspace, before
   anything else, by clearing them, and prints the bytes freed per workspace.
-  A running dev server, a booted or hosted simulator or emulator and a managed
+  A workspace whose worktree is locked with git worktree lock is never
+  lightened: not its outputs, not its project's build directories, at any
+  disk pressure level, including gc --older-than and the budget, and gc and
+  the maintenance log name the lock. The outputs also stay when git lists
+  nothing for a project inside a git checkout (code lock-unknown). A
+  running dev server, a booted or hosted simulator or emulator and a managed
   tunnel no longer keep them. They stay while the workspace is building (its
   native-run.lock is held, a live or unresolvable build lock or slot names
   it, or its build claim is live), while its macOS app or build runs or cannot
@@ -9768,10 +9811,11 @@ WORKTREE DEPENDENCIES
   Plain \`gc --delete\` also lightens linked worktrees: it deletes the
   node_modules and ios/Pods at the root or a project root of a linked
   worktree that has a Stim workspace, never the source checkout. A worktree
-  keeps them while it is in use (its dev server runs, a native run or build
-  holds it), while it was used in the last 15 minutes (a git index, HEAD or
-  reflog write, a Stim state or log write, or a write at the top of the
-  directory), while git tracks a file in them, while a stim-server service
+  locked with git worktree lock keeps them always, so a rollback checkout
+  stays runnable. Otherwise a worktree keeps them while it is in use (its
+  dev server runs, a native run or build holds it), while it was used in
+  the last 15 minutes (a git index, HEAD or reflog write, a Stim state or
+  log write, or a write at the top of the directory), while git tracks a file in them, while a stim-server service
   or the stim on PATH runs from it, while a live process has its command
   line or working directory in it, and when the running processes cannot be
   listed (always on Windows). It also keeps them when \`stim worktree warm\`
@@ -10893,7 +10937,8 @@ the ones it offloaded.
 \`server.maxLoadPerCore\` (default 2) is also the busy threshold for
 automatic iOS, Android and macOS placement. It is the load per core at which a
 machine counts as saturated: each machine applies its own value, and a remote
-machine past it is skipped like a full one.
+machine past it is skipped like a full one. \`stim status\` shows this machine's
+load per core against it, as \`capacity.load\` in JSON.
 
 Device, Release and
 \`--remote eas|proxy\` builds, Android builds with the Apple Clang CAS compiler cache,
@@ -11625,7 +11670,10 @@ owned app, including copies opened through LaunchServices (open, agent-device
 open). stim macos, stim stop, stim worktree remove and stim gc --delete stop all
 of them: SIGTERM, up to 5 s, then SIGKILL, and success only once each has
 exited. When an app cannot be verified or does not exit, stop reports
-STIM_MACOS_OWNER_UNVERIFIED or a failure, and removal keeps the workspace.
+STIM_MACOS_OWNER_UNVERIFIED or a failure, and removal keeps the workspace. For
+a hosted session the same rule covers every app bundle the session received, so
+stop and a replacement launch also end a copy that LaunchServices started from
+an earlier attempt.
 Local stim macos starts the app in the background without activating it or
 changing focus: it sets STIM_BACKGROUND_LAUNCH=1 in the app's environment, which
 Stim Desktop honors, including for reopen events from open -g. An app that
@@ -12015,6 +12063,12 @@ method the relay does not forward, is refused with an agent-device UNAUTHORIZED
 error whose details.reason is STIM_AGENT_REQUEST_REFUSED and whose message names
 the refused command or method; do not retry it.
 
+longpress, swipe, back and the other gestures are not in that list; the
+longpress and swipe that stim guide lifecycle lists belong to hosted Android and
+iOS sessions. click <ref> --button secondary reaches agent-device, but its native
+macOS backend, which the lease requires, answers UNSUPPORTED_OPERATION, so a
+hosted macOS app has no right click or context menu yet.
+
 Agents that built, launched and drove test copies on another Mac with an SSH
 script such as mini-desktop.sh use these instead:
 
@@ -12023,7 +12077,8 @@ script such as mini-desktop.sh use these instead:
   launch                     the same command; the host launches it under the
                              session's own home
   shot <out.png>             agent-device screenshot --remote-config <path>
-  click, rclick, key, type   agent-device click, press or type --remote-config <path>
+  click, key, type           agent-device click, press or type --remote-config <path>
+  rclick                     unavailable: secondary click is not supported
   quit                       stim stop (verified stop; the host frees the slot
                              and removes the app's defaults)
   clean                      stim worktree remove
@@ -12034,6 +12089,15 @@ The host's own owned devices count toward concurrency.maxDevices.
 
 The agent-device rows work once the host's agent field names agent-device.
 
+On macOS 27, agent-device screenshot of a hosted app can return an image of the
+window-sharing indicator (66x20 points, 132x40 pixels) instead of the app
+window. macOS adds that small window to the app while something captures the
+app, and agent-device picks it as the front window (callstack/agent-device#3961).
+snapshot -i lists it as an axdialog named "Window" with a
+WindowSharingSessionButton before the real window. Read the UI with snapshot
+until agent-device selects the app's main window. Commands that use the front
+window's frame, such as scroll, may also target the indicator.
+
 DESKTOP DOGFOOD
 
 This repository's apps/desktop/.stim.json selects the full StimDesktop app,

package/dist/{hosted-android-BMKzUNnY.mjs → hosted-android-DlaKLbW0.mjs}

@@ -1,7 +1,7 @@
 import { c as throwIfCancelled } from "./exec-aULwtNly.mjs";
-import { c as call, l as connectHost } from "./hosted-client-D7Pk_Oo1.mjs";
-import { i as requestHostedMetro } from "./metro-gateway-BnHdqMO_.mjs";
-import { a as stopHostedNative, i as prepareHostedNative, r as placeHostedNative } from "./hosted-native-CdgaiuyP.mjs";
+import { c as call, l as connectHost } from "./hosted-client-DDRm9hPJ.mjs";
+import { i as requestHostedMetro } from "./metro-request-DXyKjVDF.mjs";
+import { a as stopHostedNative, i as prepareHostedNative, r as placeHostedNative } from "./hosted-native-CDe33CSr.mjs";
 //#region src/device-host/hosted-android.ts
 async function prepareHostedAndroid(machine, selectors, recorded, mode) {
 	return await prepareHostedNative(machine, selectors, recorded, "android", false, mode);
@@ -19,12 +19,11 @@ async function stopHostedAndroid(root, slot, signal) {
 async function reopenHostedAndroidMetro(root, placement, clientMetroPort, signal) {
 	const host = await connectHost(placement.machine, void 0, true, signal);
 	try {
-		const gateway = await requestHostedMetro(root, placement.session, host.credential, signal);
+		await requestHostedMetro(root, placement.session, host.credential, signal);
 		throwIfCancelled(signal, "reload");
 		await call(host, "device-host.metro.open", {
 			session: placement.session,
-			clientMetroPort,
-			...gateway
+			clientMetroPort
 		});
 	} finally {
 		host.connection.close();

package/dist/{hosted-client-D7Pk_Oo1.mjs → hosted-client-DDRm9hPJ.mjs}

@@ -1,7 +1,7 @@
 import { c as throwIfCancelled, o as cancellableSleep } from "./exec-aULwtNly.mjs";
 import { Y as diagnoseConnectFailure, ot as resolveEndpoint } from "./config-Cn94Jc0g.mjs";
-import { t as BuildConnection } from "./client-xsdxrhWA.mjs";
-import { g as configuredMachines } from "./selection-Bs8phwhN.mjs";
+import { t as BuildConnection } from "./client-YxCer6ab.mjs";
+import { g as configuredMachines } from "./selection-CXgM_VK_.mjs";
 import { createHash } from "node:crypto";
 import { lstatSync, readFileSync, readdirSync, readlinkSync } from "node:fs";
 import { join } from "node:path";
@@ -42,6 +42,11 @@ function hostingCredential(machine) {
 	}
 	return credential;
 }
+function turnedAway(machine, opened) {
+	if (opened.code === "server-outdated") return `${machine} runs a stim-server that speaks an older protocol than this Stim. Run stim doctor for the command that updates it there, then retry.`;
+	if (opened.refused) return `${machine} refused this machine: ${opened.failure.replace(/\.+$/, "")}. Run stim doctor.`;
+	return null;
+}
 /** Connects only to the stim-server that proves it holds the approved machine's pinned key, and only for `device-host`. */
 async function connectHost(machine, timeoutMs = CONNECT_TIMEOUT_MS, strict = false, signal) {
 	signal?.throwIfAborted();
@@ -55,8 +60,9 @@ async function connectHost(machine, timeoutMs = CONNECT_TIMEOUT_MS, strict = fal
 	if (signal?.aborted && opened instanceof BuildConnection) opened.close();
 	signal?.throwIfAborted();
 	if (!(opened instanceof BuildConnection)) {
-		const diagnosis = opened.refused || opened.code === "server-outdated" ? null : await diagnoseConnectFailure(machine, opened, signal);
-		throw Object.assign(new Error(opened.code === "server-outdated" ? `${machine} runs a stim-server that speaks an older protocol than this Stim. Run stim doctor for the command that updates it there, then retry.` : opened.refused ? `${machine} refused this machine: ${opened.failure.replace(/\.+$/, "")}. Run stim doctor.` : diagnosis?.message ?? `${machine} is unreachable: ${opened.failure}. Run stim doctor to see which layer failed.`), {
+		const refusal = turnedAway(machine, opened);
+		const diagnosis = refusal === null ? await diagnoseConnectFailure(machine, opened, signal) : null;
+		throw Object.assign(new Error(refusal ?? diagnosis?.message ?? `${machine} is unreachable: ${opened.failure}. Run stim doctor to see which layer failed.`), {
 			code: strict ? "STIM_HOSTING_REFUSED" : opened.refused ? "STIM_HOSTING_REFUSED" : opened.code ?? "closed",
 			hostCode: opened.code,
 			...diagnosis ? { remedy: diagnosis.remedy } : {}
@@ -68,24 +74,45 @@ async function connectHost(machine, timeoutMs = CONNECT_TIMEOUT_MS, strict = fal
 		connection: opened
 	};
 }
+/**
+* Opens `device-host` connections to `machine` for a caller that retries on its own, as `connectHost` does but without
+* diagnosing failures, resolving the machine's address again only after one fails. Only a failure a retry cannot fix,
+* such as a refusal or a missing approval, carries a `STIM_` code; Tailscale not running or not listing the machine is
+* worth retrying.
+*/
+function hostConnector(machine) {
+	let resolving;
+	return async () => {
+		const credential = hostingCredential(machine);
+		const pending = resolving ??= resolveEndpoint(credential);
+		const target = await pending.catch((error) => {
+			if (resolving === pending) resolving = void 0;
+			throw error;
+		});
+		if (typeof target === "string") {
+			if (resolving === pending) resolving = void 0;
+			throw Object.assign(/* @__PURE__ */ new Error(`Stim does not connect to ${machine}: ${target}.`), { code: "closed" });
+		}
+		const opened = await BuildConnection.open(target, credential.serverKey, CONNECT_TIMEOUT_MS, "device-host").catch((error) => ({
+			failure: error instanceof Error ? error.message : String(error),
+			refused: false
+		}));
+		if (opened instanceof BuildConnection) return opened;
+		const refusal = turnedAway(machine, opened);
+		if (refusal !== null) throw credentialRefusal(refusal);
+		if (resolving === pending) resolving = void 0;
+		throw Object.assign(/* @__PURE__ */ new Error(`${machine} is unreachable: ${opened.failure}. Run stim doctor to see which layer failed.`), { code: opened.code ?? "closed" });
+	};
+}
 function requireHostedAppMode(host, platform, mode) {
 	if (mode !== "process") return;
 	if (!host.connection.supports(platform === "ios" ? "hosted-ios-process" : "hosted-android-process")) throw credentialRefusal(`${host.machine} does not support hosted ${platform} process apps.`, `Update stim-server on ${host.machine} to a version supporting hosted ${platform} process apps, then retry.`);
 }
-const gatewaySecrets = /* @__PURE__ */ new WeakMap();
-function redactHostText(host, message) {
-	const secret = gatewaySecrets.get(host);
-	return secret ? message.replaceAll(secret, "[redacted]") : message;
-}
 async function call(host, method, params, timeoutMs) {
-	if (method === "device-host.metro.open" && isJsonObject(params) && typeof params.secret === "string") gatewaySecrets.set(host, params.secret);
 	const reply = await host.connection.request(method, params, timeoutMs);
-	if ("error" in reply) throw Object.assign(/* @__PURE__ */ new Error(`${host.machine} refused ${method}: ${redactHostText(host, reply.error.message)}`), { code: reply.error.code });
+	if ("error" in reply) throw Object.assign(/* @__PURE__ */ new Error(`${host.machine} refused ${method}: ${reply.error.message}`), { code: reply.error.code });
 	if (!isJsonObject(reply.result)) throw new Error(`${host.machine} answered ${method} without a result.`);
-	return typeof reply.result.notice === "string" ? {
-		...reply.result,
-		notice: redactHostText(host, reply.result.notice)
-	} : reply.result;
+	return reply.result;
 }
 function hostedSession(host, value, platform = "macos") {
 	if (typeof value.id !== "string" || typeof value.state !== "string" || value.platform !== platform) throw new Error(`${host.machine} answered with a session that is not a hosted ${platform} session.`);
@@ -226,4 +253,4 @@ async function upload(host, ids, missing, content) {
 	}
 }
 //#endregion
-export { unknownSession as _, SESSION_TIMEOUT_MS as a, call as c, hostedSession as d, probeHostedSession as f, stoppedSession as g, sha256 as h, RESERVE_TIMEOUT_MS as i, connectHost as l, settle as m, OFFER_TIMEOUT_MS as n, attach as o, requireHostedAppMode as p, PREPARE_TIMEOUT_MS as r, bundleManifest as s, INSTALL_TIMEOUT_MS as t, heldNoLonger as u, upload as v };
+export { stoppedSession as _, SESSION_TIMEOUT_MS as a, call as c, hostConnector as d, hostedSession as f, sha256 as g, settle as h, RESERVE_TIMEOUT_MS as i, connectHost as l, requireHostedAppMode as m, OFFER_TIMEOUT_MS as n, attach as o, probeHostedSession as p, PREPARE_TIMEOUT_MS as r, bundleManifest as s, INSTALL_TIMEOUT_MS as t, heldNoLonger as u, unknownSession as v, upload as y };

package/dist/{hosted-logs-B1gqQuva.mjs → hosted-logs-bSebOKbz.mjs}

@@ -1,11 +1,11 @@
 import { t as getExecutor } from "./exec-aULwtNly.mjs";
-import { E as workspaceDir, k as workspaceLogsDir$1 } from "./workspace-state-BjqdjnJR.mjs";
+import { E as workspaceDir, k as workspaceLogsDir$1 } from "./workspace-state-kIZrdlSg.mjs";
 import { B as deviceSlotFileKey, q as validateDeviceSlot, rt as parseMachine$1 } from "./config-Cn94Jc0g.mjs";
-import { l as phaseLine } from "./command-output-Dj-WT4BP.mjs";
-import { n as macosDir } from "./state-CZxLyetD.mjs";
-import { n as androidLogGroups, r as isAndroidCrashText } from "./android-Deb9X3_Y.mjs";
+import { l as phaseLine } from "./command-output-C8R1KIvi.mjs";
+import { n as macosDir } from "./state-BXC1Lfxw.mjs";
+import { n as androidLogGroups, r as isAndroidCrashText } from "./android-D577ApKG.mjs";
 import { c as readNdjsonGenerations$1, i as createNdjsonWriter } from "./ndjson-Dy2W4vRa.mjs";
-import { c as call } from "./hosted-client-D7Pk_Oo1.mjs";
+import { c as call } from "./hosted-client-DDRm9hPJ.mjs";
 import { mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { LOG_ROTATE_BYTES, ambientWrite, withDirLockAsync } from "@stim-cli/core";

package/dist/{hosted-logs-sync-Dg3qrZmV.mjs → hosted-logs-sync-B0c53W_c.mjs}

@@ -1,8 +1,8 @@
-import { n as pullHostedNativeLogs, r as readHostedNativeLogs, t as pullHostedMacosLogs } from "./hosted-logs-B1gqQuva.mjs";
-import { l as phaseLine } from "./command-output-Dj-WT4BP.mjs";
-import { l as connectHost } from "./hosted-client-D7Pk_Oo1.mjs";
-import { n as readHostedIos, t as readHostedAndroid } from "./ios-state-BZ03NFgF.mjs";
-import "./hosted-macos-B9w4H8hc.mjs";
+import { n as pullHostedNativeLogs, r as readHostedNativeLogs, t as pullHostedMacosLogs } from "./hosted-logs-bSebOKbz.mjs";
+import { l as phaseLine } from "./command-output-C8R1KIvi.mjs";
+import { l as connectHost } from "./hosted-client-DDRm9hPJ.mjs";
+import { n as readHostedIos, t as readHostedAndroid } from "./ios-state-BPHqMDdZ.mjs";
+import "./hosted-macos-B7-8Pv4H.mjs";
 import { watch } from "node:fs";
 import { dirname, relative, resolve, sep } from "node:path";
 import { ambientWrite, configDir } from "@stim-cli/core";

package/dist/{hosted-macos-B9w4H8hc.mjs → hosted-macos-B7-8Pv4H.mjs}

@@ -1,9 +1,9 @@
 import { o as cancellableSleep } from "./exec-aULwtNly.mjs";
-import { a as agentAccess, i as closeAgentConnection, o as removeAgentAccess, t as pullHostedMacosLogs } from "./hosted-logs-B1gqQuva.mjs";
-import { l as phaseLine } from "./command-output-Dj-WT4BP.mjs";
-import { n as macosDir } from "./state-CZxLyetD.mjs";
-import { ot as runCancellationSignal } from "./toolchain-CbCG6C5Z.mjs";
-import { _ as unknownSession, a as SESSION_TIMEOUT_MS, c as call, d as hostedSession, g as stoppedSession, h as sha256, i as RESERVE_TIMEOUT_MS, l as connectHost, m as settle, o as attach, r as PREPARE_TIMEOUT_MS, s as bundleManifest, t as INSTALL_TIMEOUT_MS, u as heldNoLonger, v as upload } from "./hosted-client-D7Pk_Oo1.mjs";
+import { a as agentAccess, i as closeAgentConnection, o as removeAgentAccess, t as pullHostedMacosLogs } from "./hosted-logs-bSebOKbz.mjs";
+import { l as phaseLine } from "./command-output-C8R1KIvi.mjs";
+import { n as macosDir } from "./state-BXC1Lfxw.mjs";
+import { ot as runCancellationSignal } from "./toolchain-mLA_km-b.mjs";
+import { _ as stoppedSession, a as SESSION_TIMEOUT_MS, c as call, f as hostedSession, g as sha256, h as settle, i as RESERVE_TIMEOUT_MS, l as connectHost, o as attach, r as PREPARE_TIMEOUT_MS, s as bundleManifest, t as INSTALL_TIMEOUT_MS, u as heldNoLonger, v as unknownSession, y as upload } from "./hosted-client-DDRm9hPJ.mjs";
 import { randomUUID } from "node:crypto";
 import { join } from "node:path";
 import { ambientContext, ambientWrite } from "@stim-cli/core";

package/dist/{hosted-native-CdgaiuyP.mjs → hosted-native-CDe33CSr.mjs}

@@ -1,10 +1,10 @@
 import { o as cancellableSleep, x as withDrainingCancellation } from "./exec-aULwtNly.mjs";
-import { E as workspaceDir, l as withWorkspaceStateLockAsync, r as readWorkspaceState$1 } from "./workspace-state-BjqdjnJR.mjs";
-import { a as agentAccess, i as closeAgentConnection, n as pullHostedNativeLogs, o as removeAgentAccess } from "./hosted-logs-B1gqQuva.mjs";
-import { ot as runCancellationSignal } from "./toolchain-CbCG6C5Z.mjs";
-import { _ as unknownSession, a as SESSION_TIMEOUT_MS, c as call, d as hostedSession, g as stoppedSession, h as sha256, i as RESERVE_TIMEOUT_MS, l as connectHost, m as settle, n as OFFER_TIMEOUT_MS, o as attach, p as requireHostedAppMode, r as PREPARE_TIMEOUT_MS, s as bundleManifest, t as INSTALL_TIMEOUT_MS, u as heldNoLonger, v as upload } from "./hosted-client-D7Pk_Oo1.mjs";
-import { a as requireHostedMetro, i as requestHostedMetro, n as closeHostedMetro } from "./metro-gateway-BnHdqMO_.mjs";
-import { s as writeHostedNative } from "./ios-state-BZ03NFgF.mjs";
+import { E as workspaceDir, l as withWorkspaceStateLockAsync, r as readWorkspaceState$1 } from "./workspace-state-kIZrdlSg.mjs";
+import { a as agentAccess, i as closeAgentConnection, n as pullHostedNativeLogs, o as removeAgentAccess } from "./hosted-logs-bSebOKbz.mjs";
+import { ot as runCancellationSignal } from "./toolchain-mLA_km-b.mjs";
+import { _ as stoppedSession, a as SESSION_TIMEOUT_MS, c as call, f as hostedSession, g as sha256, h as settle, i as RESERVE_TIMEOUT_MS, l as connectHost, m as requireHostedAppMode, n as OFFER_TIMEOUT_MS, o as attach, r as PREPARE_TIMEOUT_MS, s as bundleManifest, t as INSTALL_TIMEOUT_MS, u as heldNoLonger, v as unknownSession, y as upload } from "./hosted-client-DDRm9hPJ.mjs";
+import { a as requireHostedMetro, i as requestHostedMetro, n as closeHostedMetro } from "./metro-request-DXyKjVDF.mjs";
+import { s as writeHostedNative } from "./ios-state-BPHqMDdZ.mjs";
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -139,6 +139,10 @@ async function placeHostedNativeOnce(target, { root, slot, bundle, handoff, bund
 		host = await connectHost(host.machine, void 0, true, signal);
 		target.host = host;
 		requireHostedAppMode(host, platform, mode);
+		if (mode === "development" && !host.connection.supports("hosted-metro-link")) throw Object.assign(/* @__PURE__ */ new Error(`${host.machine} runs a stim-server that cannot link Metro.`), {
+			code: "STIM_HOSTING_REFUSED",
+			remedy: `Update stim-server on ${host.machine}, then retry.`
+		});
 		let session = (target.session ? await attach(host, target.session.id, void 0, platform) : null) ?? await reserveHostedNative(host, target, {
 			platform,
 			workspace: root,
@@ -174,10 +178,9 @@ async function placeHostedNativeOnce(target, { root, slot, bundle, handoff, bund
 		};
 		await reserved(placement);
 		if (mode === "development") {
-			const gateway = await metro(root, session.id, host.credential);
+			await metro(root, session.id, host.credential);
 			await call(host, "device-host.metro.open", {
 				session: session.id,
-				...gateway,
 				...platform === "android" || devClientScheme ? { clientMetroPort: metroPort } : {}
 			}).catch((error) => {
 				if (platform === "ios" && devClientScheme && error.code === "device-busy") throw Object.assign(error, { remedy: devClientPortRemedy(host.machine) });

package/dist/{idle-shutdown-Cbvo5KEh.mjs → idle-shutdown-CQ0QwU9J.mjs}

@@ -1,11 +1,11 @@
-import { k as workspaceLogsDir$1, r as readWorkspaceState$1, s as updateWorkspaceStateAsync } from "./workspace-state-BjqdjnJR.mjs";
+import { k as workspaceLogsDir$1, r as readWorkspaceState$1, s as updateWorkspaceStateAsync } from "./workspace-state-kIZrdlSg.mjs";
 import { V as deviceSlotKey, _ as loadConfig$1 } from "./config-Cn94Jc0g.mjs";
-import { o as formatLongDuration } from "./command-output-Dj-WT4BP.mjs";
+import { o as formatLongDuration } from "./command-output-C8R1KIvi.mjs";
 import { i as createNdjsonWriter } from "./ndjson-Dy2W4vRa.mjs";
-import { L as workspaceBuildInProgress, ft as teardownOwnedIosSim, j as collectOwnedDeviceActivity, ut as teardownOwnedAvd } from "./workspaces-DFbj07jp.mjs";
+import { B as workspaceBuildInProgress, P as collectOwnedDeviceActivity, ht as teardownOwnedIosSim, pt as teardownOwnedAvd } from "./workspaces-CmOcceDN.mjs";
 import { t as canonicalPath } from "./paths-BsJMoPP2.mjs";
-import { _ as workspaceDeviceLastUseAt } from "./activity-Cd-ysFes.mjs";
-import { d as listAllIosSims } from "./ios-E26qSpkb.mjs";
+import { _ as workspaceDeviceLastUseAt } from "./activity-DRMg4_mD.mjs";
+import { d as listAllIosSims } from "./ios-B1DYuOjh.mjs";
 import { join } from "node:path";
 import { LOG_ROTATE_BYTES } from "@stim-cli/core";
 import { DEVICE_IDLE_SHUTDOWN_KEY, DEVICE_RECLAIM_REASON, readDeviceIdleShutdowns } from "@stim-cli/core/state";

package/dist/{ios-E26qSpkb.mjs → ios-B1DYuOjh.mjs}

@@ -3,8 +3,8 @@ import { P as formatBytes, _ as loadConfig$1 } from "./config-Cn94Jc0g.mjs";
 import { n as stripAnsi, r as waitForChild, t as createLineReader } from "./process-output-Fpl8PYi8.mjs";
 import { n as runOperationFileQuiet, t as runOperationFile } from "./operation-exec-Dp4FuIGR.mjs";
 import { i as stimDesktopInstalledAsync, n as settingDefault, t as STIM_DESKTOP_OPEN_OPTIONS } from "./stim-desktop-CbWo21kb.mjs";
-import { Ct as forgetCreatedDeviceAsync, Et as recordCreatedDeviceAsync, dt as isStimOwnedSim } from "./android-DriNoAVy.mjs";
-import { n as signedTailFor } from "./apk-signed-tail-BHQHx3Rm.mjs";
+import { Ct as forgetCreatedDeviceAsync, Et as recordCreatedDeviceAsync, dt as isStimOwnedSim } from "./android-CsPs-7Mg.mjs";
+import { n as signedTailFor } from "./apk-signed-tail-CQbwM0qO.mjs";
 import { createHash } from "node:crypto";
 import { closeSync, existsSync, lstatSync, mkdtempSync, openSync, readSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir, totalmem } from "node:os";

package/dist/{ios-Bk4mWbtS.mjs → ios-B1HvafEG.mjs}

@@ -1,9 +1,9 @@
-import { h as shortUdid, i as formatDuration, l as phaseLine, m as shortHash } from "./command-output-Dj-WT4BP.mjs";
-import { xn as schemesFromInfoPlist, yn as pickDevClientScheme } from "./ccache-BWTze1Ls.mjs";
-import { f as podAction, h as resolveDeviceType, i as deviceLabel, m as resolveConfiguration, n as buildLogFile, s as iosConfigurationSetting, t as appNameFromPath, u as isReleaseConfiguration, v as resolveRuntime } from "./support-Be0UeVZU.mjs";
-import { n as ensureWorkspaceStorageSafely } from "./native-runtime-DqaIBO5w.mjs";
-import { t as devClientScheme } from "./dev-client-BMca82xo.mjs";
-import { c as writeLastBuild, i as iosFacts, n as cacheDescription, o as lastBuildRecord } from "./ios-project-D8Jcy_br.mjs";
-import { d as replaceCollector, u as collectorEntry } from "./dependencies-BGokZ-Ng.mjs";
-import { n as registerIos, r as runIosOperation, t as iosCommand } from "./ios-B5HlVMhQ.mjs";
+import { h as shortUdid, i as formatDuration, l as phaseLine, m as shortHash } from "./command-output-C8R1KIvi.mjs";
+import { xn as schemesFromInfoPlist, yn as pickDevClientScheme } from "./ccache-Bm_A1xX9.mjs";
+import { f as podAction, h as resolveDeviceType, i as deviceLabel, m as resolveConfiguration, n as buildLogFile, s as iosConfigurationSetting, t as appNameFromPath, u as isReleaseConfiguration, v as resolveRuntime } from "./support-BtlJKjyQ.mjs";
+import { n as ensureWorkspaceStorageSafely } from "./native-runtime-DG4Rodzj.mjs";
+import { t as devClientScheme } from "./dev-client-D-BW5uiq.mjs";
+import { c as writeLastBuild, i as iosFacts, n as cacheDescription, o as lastBuildRecord } from "./ios-project-CR4mZ7CH.mjs";
+import { d as replaceCollector, u as collectorEntry } from "./dependencies-DKeMzwXY.mjs";
+import { n as registerIos, r as runIosOperation, t as iosCommand } from "./ios-tg4tp3q1.mjs";
 export { appNameFromPath, buildLogFile, cacheDescription, collectorEntry, iosCommand as default, devClientScheme, deviceLabel, ensureWorkspaceStorageSafely, formatDuration, iosConfigurationSetting, iosFacts, isReleaseConfiguration, lastBuildRecord, phaseLine, pickDevClientScheme, podAction, registerIos, replaceCollector, resolveConfiguration, resolveDeviceType, resolveRuntime, runIosOperation, schemesFromInfoPlist, shortHash, shortUdid, writeLastBuild };

package/dist/{ios-device-C_QkIf1Z.mjs → ios-device-B4elVFKi.mjs}

@@ -1,5 +1,5 @@
 import { t as getExecutor } from "./exec-aULwtNly.mjs";
-import { $t as INSTALL_ERROR, rn as appProcessFromPid } from "./ccache-BWTze1Ls.mjs";
+import { $t as INSTALL_ERROR, rn as appProcessFromPid } from "./ccache-Bm_A1xX9.mjs";
 import { n as TOOL_ERROR_PREFIX } from "./ios-device-CiBA-er9.mjs";
 import { mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";

package/dist/{ios-project-D8Jcy_br.mjs → ios-project-CR4mZ7CH.mjs}

@@ -1,10 +1,10 @@
-import { w as workspaceAgentDeviceDir } from "./workspace-state-BjqdjnJR.mjs";
-import { i as formatDuration, l as phaseLine } from "./command-output-Dj-WT4BP.mjs";
+import { w as workspaceAgentDeviceDir } from "./workspace-state-kIZrdlSg.mjs";
+import { i as formatDuration, l as phaseLine } from "./command-output-C8R1KIvi.mjs";
 import { a as workspaceLinkLine } from "./stim-desktop-CbWo21kb.mjs";
-import { Mn as isEasAuthFailureText, On as UPLOAD_TIMEOUT_MS, jn as easAuthNote, kn as cacheLevel } from "./ccache-BWTze1Ls.mjs";
-import { q as recordFinishedBuild } from "./workspaces-DFbj07jp.mjs";
-import { P as compilationCacheActivityLine, k as COMPILATION_CACHE_NOT_RUN } from "./toolchain-CbCG6C5Z.mjs";
-import { i as deviceLabel } from "./support-Be0UeVZU.mjs";
+import { Mn as isEasAuthFailureText, On as UPLOAD_TIMEOUT_MS, jn as easAuthNote, kn as cacheLevel } from "./ccache-Bm_A1xX9.mjs";
+import { X as recordFinishedBuild } from "./workspaces-CmOcceDN.mjs";
+import { P as compilationCacheActivityLine, k as COMPILATION_CACHE_NOT_RUN } from "./toolchain-mLA_km-b.mjs";
+import { i as deviceLabel } from "./support-BtlJKjyQ.mjs";
 import { buildDiagnostics } from "@stim-cli/core/state";
 import chalk from "chalk";
 //#region src/commands/ios/result.ts

package/dist/{ios-state-BZ03NFgF.mjs → ios-state-BPHqMDdZ.mjs}

@@ -1,4 +1,4 @@
-import { l as withWorkspaceStateLockAsync, o as updateWorkspaceState, r as readWorkspaceState$1 } from "./workspace-state-BjqdjnJR.mjs";
+import { l as withWorkspaceStateLockAsync, o as updateWorkspaceState, r as readWorkspaceState$1 } from "./workspace-state-kIZrdlSg.mjs";
 import { HOSTED_METRO_REQUESTS_KEY, hostedMetroRequests, hostedNativeRecords, isJsonObject, parseHostedNativePlacement, unreadableHostedNative } from "@stim-cli/core/state";
 //#region src/device-host/ios-state.ts
 function readHostedNative(root, platform, slot) {