stim 1.27.0 → 1.29.0

package/dist/{build-plan-CBqYbzYM.mjs → build-plan-CWyjMPKo.mjs}

@@ -1,10 +1,10 @@
 import { T as trackReportResource } from "./exec-aULwtNly.mjs";
-import { i as formatDuration, l as phaseLine, m as shortHash, u as plural } from "./command-output-Dj-WT4BP.mjs";
-import { $t as makeTemporaryDirectory, tn as removeTemporaryEntryAsync } from "./settings-BDVI8Ivc.mjs";
-import { jn as easAuthNote } from "./ccache-BWTze1Ls.mjs";
-import { W as estimateBuild, nt as readStats } from "./workspaces-DFbj07jp.mjs";
-import { s as entryDir, t as artifactIn } from "./build-cache-gBJ-WKzA.mjs";
-import { l as predictBuildMiss, o as staleNativeDirRefusal } from "./prebuild-BDpToDgR.mjs";
+import { i as formatDuration, l as phaseLine, m as shortHash, u as plural } from "./command-output-DjCsmzLZ.mjs";
+import { an as makeTemporaryDirectory, sn as removeTemporaryEntryAsync } from "./settings-D776ygML.mjs";
+import { jn as easAuthNote } from "./ccache-DsDkdP72.mjs";
+import { at as readStats, q as estimateBuild } from "./workspaces-CvSYD_78.mjs";
+import { s as entryDir, t as artifactIn } from "./build-cache-BGwTsIEa.mjs";
+import { l as predictBuildMiss, o as staleNativeDirRefusal } from "./prebuild-Bqp0LFGN.mjs";
 import chalk from "chalk";
 import { PROVIDER_LOAD_TIMEOUT_ENV, PROVIDER_LOAD_TIMEOUT_MS, buildResolveTimeoutMs, resolveTieredBuild, timeoutFromEnv } from "@stim-cli/cache";
 //#region src/commands/build-plan.ts

package/dist/{cache-manifest-DEjqGGat.mjs → cache-manifest-evF_zJ9U.mjs}

@@ -1,4 +1,4 @@
-import { d as getConfigDir } from "./config-Cn94Jc0g.mjs";
+import { d as getConfigDir } from "./config-AbUjIBOQ.mjs";
 import { cacheDirRefusal, readCacheManifest, updateCacheManifest } from "@stim-cli/core";
 import { join, resolve } from "path";
 import { existsSync } from "fs";

package/dist/cache-manifest.mjs

@@ -1,2 +1,2 @@
-import { a as unregister, i as registeredCaches, n as readManifest, r as register, t as manifestPath } from "./cache-manifest-DEjqGGat.mjs";
+import { a as unregister, i as registeredCaches, n as readManifest, r as register, t as manifestPath } from "./cache-manifest-evF_zJ9U.mjs";
 export { manifestPath, readManifest, register, registeredCaches, unregister };

package/dist/{ccache-BWTze1Ls.mjs → ccache-DsDkdP72.mjs}

@@ -1,26 +1,26 @@
 import { D as ownership_claim_exports, E as debugLog, S as process_identity_exports, b as operationState, c as throwIfCancelled, d as workspaceProcessLockError, l as WorkspaceProcessCleanupError, n as isTimeoutError, o as cancellableSleep, s as cancelledError, t as getExecutor, u as withWorkspaceProcessLock, y as isTermination } from "./exec-aULwtNly.mjs";
-import { D as workspaceId$1, E as workspaceDir, M as withDirLock$1, b as sharedCcache$1, d as writeWorkspaceState, j as workspaceStateFile$1, k as workspaceLogsDir$1, l as withWorkspaceStateLockAsync, r as readWorkspaceState$1, t as clearWorkspaceStateKey, y as sharedBuildCache } from "./workspace-state-BjqdjnJR.mjs";
-import { F as isOnMountedVolume, G as projectDeviceSlots, H as deviceSlotPlatforms, L as measuredDirectorySizeAsync, M as directorySize, N as directorySizeAsync, O as withConfigLockAsync$1, P as formatBytes, R as volumeRootFor, _ as loadConfig$1, a as clearDevice, d as getConfigDir, o as clearSupervisor, p as getProject } from "./config-Cn94Jc0g.mjs";
+import { D as workspaceId$1, E as workspaceDir, M as withDirLock$1, b as sharedCcache$1, d as writeWorkspaceState, j as workspaceStateFile$1, k as workspaceLogsDir$1, l as withWorkspaceStateLockAsync, r as readWorkspaceState$1, t as clearWorkspaceStateKey, y as sharedBuildCache } from "./workspace-state-DGwkPXwq.mjs";
+import { F as isOnMountedVolume, G as projectDeviceSlots, H as deviceSlotPlatforms, L as measuredDirectorySizeAsync, M as directorySize, N as directorySizeAsync, O as withConfigLockAsync$1, P as formatBytes, R as volumeRootFor, _ as loadConfig$1, a as clearDevice, d as getConfigDir, o as clearSupervisor, p as getProject } from "./config-AbUjIBOQ.mjs";
 import { n as stripAnsi } from "./process-output-Fpl8PYi8.mjs";
-import { a as formatElapsed, l as phaseLine, o as formatLongDuration, s as isAppLaunchError, u as plural } from "./command-output-Dj-WT4BP.mjs";
+import { a as formatElapsed, l as phaseLine, o as formatLongDuration, s as isAppLaunchError, u as plural } from "./command-output-DjCsmzLZ.mjs";
 import { a as killOnAbort, n as runOperationFileQuiet, r as childEnvironment, t as runOperationFile } from "./operation-exec-Dp4FuIGR.mjs";
-import { Z as resolveProjectSettingsAsync, d as androidLayoutSetting, ft as planMetroReach, m as defaultAndroidLayout } from "./settings-BDVI8Ivc.mjs";
-import { C as resolvePackageJson, M as readMetroTunnel, N as readPidFile, P as readRemoteSession, i as findProjectRoot$1, j as clearWorkspaceSupervisor, k as clearRemoteSession, s as ownedDeviceLabel, v as detectIsExpo } from "./project-DYj-HVx6.mjs";
-import { F as listAvdsAsync, G as ownedAvdSerialResolverAsync, I as listInstalledSystemImages, J as parseAvdSystemImage, V as ownedAvdDirectory, d as androidToolPath, dt as isStimOwnedSim, m as avdIniPaths, mt as dropParked, o as androidHome, q as parseAvdDeviceProfile, ut as isStimOwnedAvd, v as avdStorageRoots, yt as readParked } from "./android-DriNoAVy.mjs";
-import { a as listeningPidsAsync, c as pidExists, d as resolveProjectMetro, h as isMetroRunning, r as killMetroTreeAsync, u as processCwds } from "./metro-CvyD-xwe.mjs";
-import { c as readNdjsonGenerations$1, i as createNdjsonWriter, r as createNdjsonTail } from "./ndjson-Dy2W4vRa.mjs";
-import { C as environmentState, a as removeEasSessionClaim, d as parseWatchRoots, f as parseWatchmanClients, i as recordEasSessionClaim, l as parseSubscriberNames, n as easMachineStateRoot$1, o as removeEasSessionClaimAsync, p as parseWatchmanPid, r as readEasSessionLedger$1, s as compareStimVersions, t as assertEasMachineRootWritable, u as parseTriggerCount, w as formatSpace, y as capacity } from "./eas-session-ledger-DrP4OuuM.mjs";
-import { i as registeredCaches, r as register } from "./cache-manifest-DEjqGGat.mjs";
-import { A as collectIdleDevicesAsync, Ct as createGcResults, Et as mapLimited, I as shutDownIdleDevices, L as workspaceBuildInProgress, M as collectOwnedDeviceActivityAsync, Ot as sizeConcurrency, P as idleShutdownCandidates, St as GC_OUTPUT, _ as withIdleWorkspace, _t as measureDu, b as resolveSupervisorTarget, bt as listBuildSlots, ct as eraseParkedIosSim, ft as teardownOwnedIosSim, gt as canonical$1, ht as probePublicHttp, i as clearWorkspaceOutputs, mt as teardownParkedIosSim, o as collectWorkspaceOutputs, pt as teardownParkedAvd, st as eraseParkedAvd, ut as teardownOwnedAvd, vt as writeUsageCache } from "./workspaces-DFbj07jp.mjs";
+import { Z as resolveProjectSettingsAsync, d as androidLayoutSetting, ft as planMetroReach, m as defaultAndroidLayout } from "./settings-D776ygML.mjs";
+import { C as resolvePackageJson, M as readMetroTunnel, N as readPidFile, P as readRemoteSession, i as findProjectRoot$1, j as clearWorkspaceSupervisor, k as clearRemoteSession, s as ownedDeviceLabel, v as detectIsExpo } from "./project-D1n0K4yg.mjs";
+import { F as listAvdsAsync, G as ownedAvdSerialResolverAsync, I as listInstalledSystemImages, J as parseAvdSystemImage, V as ownedAvdDirectory, d as androidToolPath, dt as isStimOwnedSim, m as avdIniPaths, mt as dropParked, o as androidHome, q as parseAvdDeviceProfile, ut as isStimOwnedAvd, v as avdStorageRoots, yt as readParked } from "./android-BHKgeOuq.mjs";
+import { a as listeningPidsAsync, c as pidExists, d as resolveProjectMetro, h as isMetroRunning, r as killMetroTreeAsync, u as processCwds } from "./metro-BMQHczcf.mjs";
+import { c as readNdjsonGenerations$1, i as createNdjsonWriter, r as createNdjsonTail } from "./ndjson-CrjIsGzw.mjs";
+import { T as formatSpace, a as removeEasSessionClaim, d as parseWatchRoots, f as parseWatchmanClients, i as recordEasSessionClaim, l as parseSubscriberNames, n as easMachineStateRoot$1, o as removeEasSessionClaimAsync, p as parseWatchmanPid, r as readEasSessionLedger$1, s as compareStimVersions, t as assertEasMachineRootWritable, u as parseTriggerCount, w as environmentState, y as capacity } from "./eas-session-ledger-B0KLZx5m.mjs";
+import { i as registeredCaches, r as register } from "./cache-manifest-evF_zJ9U.mjs";
+import { At as mapLimited, B as workspaceBuildInProgress, Dt as createGcResults, Et as GC_OUTPUT, F as collectOwnedDeviceActivityAsync, L as idleShutdownCandidates, Mt as sizeConcurrency, N as collectIdleDevicesAsync, _t as teardownParkedIosSim, bt as measureDu, dt as eraseParkedIosSim, gt as teardownParkedAvd, ht as teardownOwnedIosSim, i as clearWorkspaceOutputs, l as keptByLock, o as collectWorkspaceOutputs, pt as teardownOwnedAvd, ut as eraseParkedAvd, v as withIdleWorkspace, vt as probePublicHttp, wt as listBuildSlots, x as resolveSupervisorTarget, xt as writeUsageCache, yt as canonical$1, z as shutDownIdleDevices } from "./workspaces-CvSYD_78.mjs";
 import { t as canonicalPath } from "./paths-BsJMoPP2.mjs";
-import { lt as claimForEmptying, ot as runCancellationSignal, rt as nativeRunWaitNotice } from "./toolchain-CbCG6C5Z.mjs";
-import { N as listBuildLocks, b as leaseIsExpired, g as workspaceActivity, o as envDir, p as readHostProcessTableAsync, x as listLeaseFiles } from "./activity-Cd-ysFes.mjs";
-import { l as expoConfigContents } from "./build-cache-gBJ-WKzA.mjs";
-import { G as deviceHoldsBundle, O as sanitizeDeviceLabel, W as deviceHoldsApk, b as parseSimctlList, f as listAllIosSimsAsync, g as listUserApps, j as uninstallIosApp, p as listIosDeviceTypesAsync, u as iosSimulatorFailureAdvice, y as parseRuntimeVersion } from "./ios-E26qSpkb.mjs";
+import { lt as claimForEmptying, ot as runCancellationSignal, rt as nativeRunWaitNotice } from "./toolchain-CLGnEUgT.mjs";
+import { N as listBuildLocks, b as leaseIsExpired, g as workspaceActivity, o as envDir, p as readHostProcessTableAsync, x as listLeaseFiles } from "./activity-BR5oHSO5.mjs";
+import { l as expoConfigContents } from "./build-cache-BGwTsIEa.mjs";
+import { G as deviceHoldsBundle, O as sanitizeDeviceLabel, W as deviceHoldsApk, b as parseSimctlList, f as listAllIosSimsAsync, g as listUserApps, j as uninstallIosApp, p as listIosDeviceTypesAsync, u as iosSimulatorFailureAdvice, y as parseRuntimeVersion } from "./ios-CoMCWfub.mjs";
 import { n as supervisorError } from "./errors-DHm_U5gv.mjs";
-import { c as findBinUpward, n as expoBinFromPackage, r as expoBinPath, s as expoTelemetryEnv } from "./server-expo-ABQs2XFA.mjs";
+import { c as findBinUpward, n as expoBinFromPackage, r as expoBinPath, s as expoTelemetryEnv } from "./server-expo-bB1VV2k-.mjs";
 import { t as DEV_MENU_LAUNCH_ARGS } from "./ios-device-CiBA-er9.mjs";
-import { t as resolveMaintenanceSettings } from "./settings-Djl-mpjX.mjs";
+import { t as resolveMaintenanceSettings } from "./settings-D9LtQaUw.mjs";
 import { createRequire } from "node:module";
 import { createHash, randomUUID } from "node:crypto";
 import { closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, statfsSync, unlinkSync, writeFileSync } from "node:fs";
@@ -8039,9 +8039,10 @@ async function reclaimWorkspaceOutputs({ root, dryRun, now, note, record, diskRe
 		targets: clearable.map((entry) => entry.projectRoot),
 		failures: 0
 	};
+	const locked = report.workspaces.filter((entry) => keptByLock(entry) && entry.projectRoot !== null && other(entry.projectRoot));
 	const targets = [];
 	let failures = 0;
-	for (const entry of clearable) {
+	for (const entry of [...locked, ...clearable]) {
 		const result = await clearWorkspaceOutputs({
 			...report,
 			workspaces: [entry]

package/dist/{cli-ftXDLto1.mjs → cli-3fjOg-Oc.mjs}

@@ -1,27 +1,27 @@
 import { E as debugLog } from "./exec-aULwtNly.mjs";
-import { y as refuseRelativeStimPaths } from "./config-Cn94Jc0g.mjs";
+import { y as refuseRelativeStimPaths } from "./config-AbUjIBOQ.mjs";
 import { readFileSync } from "node:fs";
 import { runId, trace } from "@stim-cli/core/state";
 import { Command } from "commander";
 //#region bin/cli.ts
 const commands = /* @__PURE__ */ new Map([
-	["doctor", () => import("./doctor-Dbx1ZpD2.mjs")],
-	["worktree", () => import("./worktree-JGUd_53L.mjs")],
-	["start", () => import("./start-DcqnF9p8.mjs")],
-	["ports", () => import("./ports-uUrghqWN.mjs")],
-	["stop", () => import("./stop-x1Yu3He4.mjs")],
-	["ios", () => import("./ios-Bk4mWbtS.mjs")],
-	["android", () => import("./android--HBgpvpW.mjs")],
-	["web", () => import("./web-Je6abcpz.mjs")],
-	["macos", () => import("./macos-BGmTpnv9.mjs")],
-	["reload", () => import("./reload-DJBeF_rC.mjs")],
-	["device", () => import("./device-BJm0irrq.mjs")],
-	["logs", () => import("./logs-aJQb-RDg.mjs")],
-	["settings", () => import("./settings-CMHhQNwI.mjs")],
-	["status", () => import("./status-Bj7ZYvvc.mjs")],
-	["stats", () => import("./stats-GxuCbles.mjs")],
-	["gc", () => import("./gc-BRwAY3qT.mjs")],
-	["guide", () => import("./guide-_rfEh_zM.mjs")]
+	["doctor", () => import("./doctor-BO_kaFWX.mjs")],
+	["worktree", () => import("./worktree-DTOIohFe.mjs")],
+	["start", () => import("./start-Cr-c3Xhq.mjs")],
+	["ports", () => import("./ports-VQSAPZhl.mjs")],
+	["stop", () => import("./stop-CHtAiv79.mjs")],
+	["ios", () => import("./ios-CNDH6fNF.mjs")],
+	["android", () => import("./android-BPmCmyAy.mjs")],
+	["web", () => import("./web-BxSo493O.mjs")],
+	["macos", () => import("./macos-BOQrKYeJ.mjs")],
+	["reload", () => import("./reload-CDKEzzaf.mjs")],
+	["device", () => import("./device-BvpasThQ.mjs")],
+	["logs", () => import("./logs-BND8MiBq.mjs")],
+	["settings", () => import("./settings-BcVCcAT5.mjs")],
+	["status", () => import("./status-DbQv--Yb.mjs")],
+	["stats", () => import("./stats-D5c-uIBp.mjs")],
+	["gc", () => import("./gc-DjXwQXHK.mjs")],
+	["guide", () => import("./guide-CeRlWVsS.mjs")]
 ]);
 const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf-8"));
 const program = new Command();
@@ -53,7 +53,7 @@ try {
 			}));
 		}
 		try {
-			const { triggerMaintenance } = await import("./trigger-qp2ji5wE.mjs");
+			const { triggerMaintenance } = await import("./trigger-DBZ-GBrl.mjs");
 			triggerMaintenance(action.name());
 		} catch {}
 	});

package/dist/cli.mjs

@@ -4,6 +4,6 @@ const encode = (version) => version.split(".", 3).reduce((sum, part) => sum * 1e
 if (encode(process.versions.node) < encode("22.12.0")) {
 	process.stderr.write(`STIM_NODE_UNSUPPORTED: Stim needs Node 22.12.0 or later; this is Node ${process.versions.node} at ${process.execPath}. To run Stim where a project pins an older Node, see https://stim.appandflow.com/docs/requirements#older-node-pins\n`);
 	process.exitCode = 1;
-} else import("./cli-ftXDLto1.mjs");
+} else import("./cli-3fjOg-Oc.mjs");
 //#endregion
 export {};

package/dist/{client-xsdxrhWA.mjs → client-BTUH8TF1.mjs}

@@ -1,11 +1,11 @@
 import { C as reportSignal, E as debugLog, b as operationState, c as throwIfCancelled, t as getExecutor } from "./exec-aULwtNly.mjs";
-import { _ as loadConfig$1, ot as resolveEndpoint, st as sayHello, tt as openAuthenticated } from "./config-Cn94Jc0g.mjs";
+import { _ as loadConfig$1, ct as sayHello, nt as openAuthenticated, st as resolveEndpoint } from "./config-AbUjIBOQ.mjs";
 import { o as git, s as gitAsync } from "./operation-exec-Dp4FuIGR.mjs";
-import { G as planCacheEmptying, R as maintenanceLogger, n as CCACHE_UNAVAILABLE, t as CCACHE_NOT_RUN, ur as discoverCaches, z as emptyCaches } from "./ccache-BWTze1Ls.mjs";
+import { G as planCacheEmptying, R as maintenanceLogger, n as CCACHE_UNAVAILABLE, t as CCACHE_NOT_RUN, ur as discoverCaches, z as emptyCaches } from "./ccache-DsDkdP72.mjs";
 import { t as canonicalPath } from "./paths-BsJMoPP2.mjs";
-import { A as COMPILATION_CACHE_UNAVAILABLE, E as readRubyVersion, a as cocoapodsDifference, k as COMPILATION_CACHE_NOT_RUN, ot as runCancellationSignal, s as iosToolchainAsync, v as toolchainMismatches, x as workerToolchain, y as toolchainNotes } from "./toolchain-CbCG6C5Z.mjs";
-import { t as resolveMaintenanceSettings } from "./settings-Djl-mpjX.mjs";
-import { f as workerFailureReason, m as pairedMachines, o as namedBuildMachine, t as OffloadRefusal } from "./selection-Bs8phwhN.mjs";
+import { A as COMPILATION_CACHE_UNAVAILABLE, E as readRubyVersion, a as cocoapodsDifference, k as COMPILATION_CACHE_NOT_RUN, ot as runCancellationSignal, s as iosToolchainAsync, v as toolchainMismatches, x as workerToolchain, y as toolchainNotes } from "./toolchain-CLGnEUgT.mjs";
+import { t as resolveMaintenanceSettings } from "./settings-D9LtQaUw.mjs";
+import { f as workerFailureReason, m as pairedMachines, o as namedBuildMachine, t as OffloadRefusal } from "./selection-D1ZDzHFX.mjs";
 import { n as fingerprintNativeInputs, r as manifestDigest } from "./native-inputs-TRTTTRxt.mjs";
 import { a as sourceManifest, i as nativeTransferManifest, n as gitVisiblePaths, r as nativeFileDigest, t as checkNativeTransferMembership } from "./native-source-D1AzWiuP.mjs";
 import { createHash, webcrypto } from "node:crypto";
@@ -599,7 +599,10 @@ var BuildConnection = class BuildConnection {
 	writeWaiters = /* @__PURE__ */ new Set();
 	progress = null;
 	binary = null;
+	event = null;
+	dropped = null;
 	closed = null;
+	lastWrite = Promise.resolve();
 	heard = Date.now();
 	watched = false;
 	ended = false;
@@ -631,6 +634,7 @@ var BuildConnection = class BuildConnection {
 			}
 			if (!isJsonObject(message)) return;
 			if (message.event === "build.progress") return this.progress?.(message);
+			if (typeof message.event === "string") return this.event?.(message);
 			const resolve = typeof message.id === "number" ? this.pending.get(message.id) : void 0;
 			if (resolve) {
 				this.pending.delete(message.id);
@@ -655,6 +659,7 @@ var BuildConnection = class BuildConnection {
 					message: this.closed
 				}
 			});
+			this.dropped?.(code);
 		});
 		socket.on("error", () => {});
 	}
@@ -771,8 +776,11 @@ var BuildConnection = class BuildConnection {
 		if (this.closed) return;
 		let completed = false;
 		let resume;
+		let written;
+		this.lastWrite = new Promise((resolve) => written = resolve);
 		this.socket.send(frame, { binary: true }, () => {
 			completed = true;
+			written?.();
 			resume?.();
 		});
 		if (completed || this.closed || this.socket.bufferedAmount <= MAX_BUFFERED) return;
@@ -785,12 +793,31 @@ var BuildConnection = class BuildConnection {
 			this.writeWaiters.add(wake);
 		});
 	}
+	/** Resolves once the last binary frame left this process, or at once when the connection has ended. */
+	flushed() {
+		return this.closed ? Promise.resolve() : this.lastWrite;
+	}
+	/** Stops reading frames from the machine until `resume()`, so the machine's sends wait on the network. */
+	pause() {
+		this.socket.pause();
+	}
+	resume() {
+		this.socket.resume();
+	}
 	onProgress(listener) {
 		this.progress = listener;
 	}
 	onBinary(listener) {
 		this.binary = listener;
 	}
+	/** Server events other than `build.progress`, such as `device-host.metro.link.open`. */
+	onEvent(listener) {
+		this.event = listener;
+	}
+	/** Called once with the close code when the machine or the network ends the connection; never after `close()` or `drop()`. */
+	onDropped(listener) {
+		this.dropped = listener;
+	}
 	get failure() {
 		return this.closed;
 	}
@@ -802,14 +829,18 @@ var BuildConnection = class BuildConnection {
 		this.heard = Date.now();
 		this.watched = true;
 	}
+	/** Stops treating silence as a dropped connection, as before `watch()`. */
+	unwatch() {
+		this.watched = false;
+	}
 	/** Closes with a close frame, which tells the machine to cancel this connection's jobs. */
-	close() {
+	close(code = 1e3) {
 		if (this.ended) return;
 		this.forget();
 		if (this.socket.readyState === WebSocket.CLOSED) return;
 		const timer = setTimeout(() => this.socket.terminate(), CLOSE_TIMEOUT_MS);
 		this.socket.once("close", () => clearTimeout(timer));
-		this.socket.close(1e3);
+		this.socket.close(code);
 	}
 	/** Ends the connection without a close frame, which leaves its jobs on the machine for a new connection. */
 	drop() {
@@ -828,6 +859,8 @@ var BuildConnection = class BuildConnection {
 		this.pending.clear();
 		this.progress = null;
 		this.binary = null;
+		this.event = null;
+		this.dropped = null;
 		clearInterval(this.keepalive);
 		this.socket.removeAllListeners("close");
 		this.unregisterExitCleanup?.();
@@ -1251,7 +1284,7 @@ async function fetchArtifact({ connection, method, params, artifact, request, st
 	if (badFrame) return { failure: "fetch: an artifact frame had another digest or could not be written here" };
 	if (digest !== artifact.sha256 || declared.sha256 !== digest || declared.size !== received) return { failure: `fetch: the artifact's sha256 ${digest.slice(0, 12)} does not match ${String(artifact.sha256).slice(0, 12)}` };
 	if (cacheHit) {
-		if ((await getExecutor().runFileAsync("tar", ["-tf", archive], { timeoutMs: 6e5 })).split("\n").filter(Boolean).some((member) => {
+		if ((await getExecutor().runFileAsync("tar", ["-tf", archive], { timeoutMs: 6e5 })).split(/\r?\n/).filter(Boolean).some((member) => {
 			const clean = member.replace(/^\.\//, "");
 			return !(clean === name || clean.startsWith(`${name}/`)) || clean.split("/").includes("..");
 		})) return { failure: "fetch: the archive contains paths outside its app" };

package/dist/collector-run.mjs

@@ -1,11 +1,11 @@
 import { S as process_identity_exports } from "./exec-aULwtNly.mjs";
-import { k as workspaceLogsDir } from "./workspace-state-BjqdjnJR.mjs";
-import { V as deviceSlotKey, q as validateDeviceSlot } from "./config-Cn94Jc0g.mjs";
+import { k as workspaceLogsDir } from "./workspace-state-DGwkPXwq.mjs";
+import { V as deviceSlotKey, q as validateDeviceSlot } from "./config-AbUjIBOQ.mjs";
 import { t as createLineReader } from "./process-output-Fpl8PYi8.mjs";
-import { c as watchAppPid, i as parseLogcatLine, o as startAndroidLogcat, s as waitForAppPid, t as androidClockOffset } from "./android-Deb9X3_Y.mjs";
-import { i as createNdjsonWriter } from "./ndjson-Dy2W4vRa.mjs";
+import { c as watchAppPid, i as parseLogcatLine, o as startAndroidLogcat, s as waitForAppPid, t as androidClockOffset } from "./android-CLU_MMnb.mjs";
+import { i as createNdjsonWriter } from "./ndjson-CrjIsGzw.mjs";
 import { a as startIosDeviceConsole, i as parseDeviceConsoleLine } from "./ios-device-CiBA-er9.mjs";
-import { a as unregisterCollector, i as registerCollector, r as readCollectors, t as collectorProcessTitle } from "./ownership-Bx-0cku-.mjs";
+import { a as unregisterCollector, i as registerCollector, r as readCollectors, t as collectorProcessTitle } from "./ownership-Dtz9G5Gl.mjs";
 import { n as parseLogStreamLine, r as startIosLogStream, t as appNameFromBundleId } from "./ios-CsRVik64.mjs";
 import { existsSync } from "node:fs";
 import { isAbsolute, join, resolve } from "node:path";

package/dist/{command-output-Dj-WT4BP.mjs → command-output-DjCsmzLZ.mjs}

@@ -1,5 +1,5 @@
 import { n as stripAnsi } from "./process-output-Fpl8PYi8.mjs";
-import { t as NO_PROJECT_REFUSAL } from "./project-DYj-HVx6.mjs";
+import { t as NO_PROJECT_REFUSAL } from "./project-D1n0K4yg.mjs";
 import { quotedPath as quotedPath$1 } from "@stim-cli/core";
 import chalk from "chalk";
 //#region src/diagnostics/launch-error-preview.ts

package/dist/{config-Cn94Jc0g.mjs → config-AbUjIBOQ.mjs}

@@ -2,11 +2,12 @@ import { C as reportSignal, D as ownership_claim_exports, S as process_identity_
 import { t as runOperationFile } from "./operation-exec-Dp4FuIGR.mjs";
 import { join } from "node:path";
 import { ambientEnv, configDir, ensurePrivateDir } from "@stim-cli/core";
-import { allMetroPorts, cannotHost, clientIdentity, configCorruptRepair, endpoint, endpoint as endpoint$1, findEnclosingWorktreeRoot, findPeer, findPeer as findPeer$1, getConcurrencyLimits, getConfigPath, getConfigPath as getConfigPath$1, getProject, getProjectSettings, getRepoSettings, isJsonObject, isPathPrefix as isPathPrefix$1, loadConfig, loadConfig as loadConfig$1, machineEndpoint, parseMachine, parseMachine as parseMachine$1, validateAutomaticPool, withConfigLock, withConfigLock as withConfigLock$1, withConfigLockAsync, withConfigLockAsync as withConfigLockAsync$1 } from "@stim-cli/core/state";
+import { DEFAULT_SERVER_PORT, allMetroPorts, cannotHost, clientIdentity, configCorruptRepair, endpoint, endpoint as endpoint$1, findEnclosingWorktreeRoot, findPeer, findPeer as findPeer$1, getConcurrencyLimits, getConfigPath, getConfigPath as getConfigPath$1, getProject, getProjectSettings, getRepoSettings, isJsonObject, isPathPrefix as isPathPrefix$1, loadConfig, loadConfig as loadConfig$1, machineEndpoint, parseMachine, parseMachine as parseMachine$1, validateAutomaticPool, withConfigLock, withConfigLock as withConfigLock$1, withConfigLockAsync, withConfigLockAsync as withConfigLockAsync$1 } from "@stim-cli/core/state";
 import { dirname as dirname$1, isAbsolute as isAbsolute$1, join as join$1, normalize, parse, sep as sep$1 } from "path";
-import { request } from "node:https";
+import { request } from "node:http";
+import { request as request$1 } from "node:https";
 import { WebSocket } from "ws";
-import { HandshakeRefusal, MAX_SERVER_MESSAGE_BYTES, TRANSPORT_OVERHEAD_BYTES, decodeSecret, initiateNoise, newSecret } from "@stim-cli/core/noise-session";
+import { HandshakeRefusal, MAX_SERVER_MESSAGE_BYTES, TRANSPORT_OVERHEAD_BYTES, decodeSecret, initiateNoise, keyFingerprint, newSecret } from "@stim-cli/core/noise-session";
 import { existsSync, lstatSync, readdirSync, readlinkSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { InvalidArgumentError } from "commander";
 //#region src/offload/access-ticket.ts
@@ -203,6 +204,52 @@ function diagnoseUnreachable(input) {
 		remedy: `On ${entry}, run \`stim-server service status\`. To keep it running there, run \`stim-server service install --serve\`.`
 	};
 }
+/**
+* Why a `local:` machine did not connect. Nothing below stim-server's own port is in the way, so the causes are the
+* network, the machine's firewall, or a server that does not listen on that address.
+*/
+function diagnoseLocalUnreachable(input) {
+	const { entry, port, transport } = input;
+	if (transport?.kind === "refused") return {
+		layer: "server",
+		code: "lan-not-listening",
+		title: "Not listening on the local network",
+		message: `${entry} answers on the local network, but nothing accepts connections on port ${port}: its stim-server is not running or does not listen on that address.`,
+		remedy: `On ${entry}, run \`stim-server service status\`, and check that server.lanAddresses names the network interface or address this machine reaches (\`npx --yes stim settings get server.lanAddresses\`). Its stim-server log names each entry it cannot use.`
+	};
+	if (transport?.kind === "silent") return {
+		layer: "peer",
+		code: "lan-no-answer",
+		title: "Not answering",
+		message: `${entry} did not answer a connection on port ${port}.`,
+		remedy: `Check that ${entry} is awake, on the same network as this machine and has that address. On a Mac, the macOS firewall drops connections until a person allows incoming connections for stim-server's node there (System Settings > Network > Firewall > Options).`
+	};
+	if (transport?.kind === "http" && transport.status === 503) return diagnoseUnreachable({
+		...input,
+		peer: {
+			nodeId: "",
+			dnsName: entry,
+			address: entry
+		}
+	});
+	return {
+		layer: "server",
+		code: "connect-failed",
+		title: "Not answering",
+		message: `Could not connect to stim-server on ${entry}: ${sentence(input.reason)}`,
+		remedy: `On ${entry}, run \`stim-server service status\`. To keep it running there, run \`stim-server service install\`.`
+	};
+}
+/** The doctor finding for a `local:` machine whose server key no person has confirmed, so Stim has not pinned it. */
+function unconfirmedKeyFinding(code, entry, fingerprint) {
+	return {
+		code,
+		level: "note",
+		title: `Remote machine ${entry} needs its server key confirmed`,
+		detail: `${entry} approved this machine and answered with the stim-server key fingerprint ${fingerprint}. On the local network nothing vouches for that key, so Stim pins it only after a person checks it against the fingerprint \`stim-server setup\` printed there. Until then this machine does not use ${entry}.`,
+		fix: `Run \`stim doctor --fix\` in a terminal here and answer y only if the fingerprint matches. If it does not, another machine answered at that address: do not confirm, and check the address in remote.machines.`
+	};
+}
 function diagnosisFinding(code, entry, diagnosis) {
 	return {
 		code,
@@ -241,11 +288,12 @@ function rawTailscaleStatus() {
 function peerStartup({ url, servername, host }) {
 	return new Promise((resolve) => {
 		const base = new URL(url);
-		const request$1 = request({
+		const plain = base.protocol === "ws:";
+		const request$2 = (plain ? request : request$1)({
 			host: base.hostname.replace(/^\[|\]$/g, ""),
-			port: base.port || 443,
+			port: base.port || (plain ? 80 : 443),
 			path: "/health",
-			servername,
+			...plain ? {} : { servername },
 			headers: { Host: host },
 			timeout: HEALTH_TIMEOUT_MS
 		}, (response) => {
@@ -253,15 +301,15 @@ function peerStartup({ url, servername, host }) {
 			let size = 0;
 			response.on("data", (chunk) => {
 				size += chunk.length;
-				if (size > 4096) request$1.destroy();
+				if (size > 4096) request$2.destroy();
 				else chunks.push(chunk);
 			});
 			response.on("end", () => resolve(parsePeerStartup(parseJson(Buffer.concat(chunks).toString("utf8")))));
 			response.on("error", () => resolve(null));
 		});
-		request$1.on("timeout", () => request$1.destroy());
-		request$1.on("error", () => resolve(null));
-		request$1.end();
+		request$2.on("timeout", () => request$2.destroy());
+		request$2.on("error", () => resolve(null));
+		request$2.end();
 	});
 }
 function tailscaleStatus() {
@@ -388,8 +436,9 @@ function openAuthenticated(target, auth, timeoutMs, signal, operation) {
 		}), timeoutMs);
 		signal?.addEventListener("abort", cancel, { once: true });
 		if (signal?.aborted) return cancel();
+		const served = target.url.startsWith("wss:");
 		const failed = (error, status) => finish({
-			failure: status === 502 ? "no stim-server answers behind its tailscale serve route (HTTP 502)" : status === 503 ? "stim-server answers behind its tailscale serve route but is not serving clients (HTTP 503)" : status !== void 0 ? `its tailscale serve route answered HTTP ${status}` : error.message,
+			failure: status === 502 && served ? "no stim-server answers behind its tailscale serve route (HTTP 502)" : status === 503 ? `stim-server answers${served ? " behind its tailscale serve route" : ""} but is not serving clients (HTTP 503)` : status !== void 0 ? `${served ? "its tailscale serve route" : "it"} answered HTTP ${status}` : error.message,
 			refused: false,
 			transport: opened && status === void 0 ? {
 				kind: "other",
@@ -556,6 +605,17 @@ async function diagnoseOutcome(io, input) {
 async function diagnoseConnectFailure(machine, failure, signal) {
 	const parsed = parseMachine(machine);
 	if (!parsed) return null;
+	if (parsed.transport === "local") {
+		const target = machineEndpoint(machine, null);
+		const startup = typeof target !== "string" && failure.transport?.kind === "http" && failure.transport.status === 503 ? await peerStartup(target) : null;
+		return diagnoseLocalUnreachable({
+			entry: machine,
+			port: parsed.port,
+			reason: failure.failure,
+			startup,
+			...failure.transport ? { transport: failure.transport } : {}
+		});
+	}
 	const peer = findPeer(await tailscaleStatusAsync(signal), parsed.name);
 	if (typeof peer === "string") return null;
 	return diagnoseOutcome({ startup: peerStartup }, {
@@ -574,19 +634,45 @@ async function diagnoseTailscale(io) {
 }
 /** Where to reach a paired machine now, or why Stim cannot; the handshake then checks its pinned key. */
 async function resolveEndpoint(credential, status = () => tailscaleStatusAsync(signal), signal) {
-	return machineEndpoint(credential.machine, parseMachine(credential.machine) ? await status() : null);
+	return machineEndpoint(credential.machine, parseMachine(credential.machine)?.transport === "tailscale" ? await status() : null);
+}
+/**
+* Shows a local network machine's server key fingerprint and asks a person whether it matches the one
+* `stim-server setup` printed there. Questions go one at a time, and each machine and key is asked once per doctor
+* run, so its build and device-host checks share the answer. Without a terminal every answer is no.
+*/
+function keyConfirmer(ask) {
+	const answers = /* @__PURE__ */ new Map();
+	let queue = Promise.resolve();
+	return (machine, serverKey) => {
+		if (!ask) return Promise.resolve(false);
+		const id = `${machine}\0${serverKey}`;
+		let answer = answers.get(id);
+		if (!answer) {
+			const fingerprint = keyFingerprint(Buffer.from(serverKey, "base64url"));
+			answer = queue.then(() => ask(`${machine} answered with this stim-server key fingerprint:\n  ${fingerprint}\nDoes it match the fingerprint \`stim-server setup\` printed on ${machine}? Only then does Stim trust it. [y/N] `));
+			queue = answer.catch(() => false);
+			answers.set(id, answer);
+		}
+		return answer;
+	};
 }
 /** The remedy for a pending request: the printed setup command, or where the person finds it. */
 function setupRemedy(entry, command) {
 	return command ? `A person on ${entry} runs this there to approve this machine: ${command}\nAfter approving, run \`stim doctor\` on this machine to reconnect.` : `A person on ${entry} runs the \`stim-server setup\` command Stim Desktop showed for this machine.`;
 }
-function setupCommand(ticket, expiresAt, flags, version) {
-	return `STIM_SETUP_TICKET=${ticket} STIM_SETUP_ORIGIN=doctor npx --yes --package @stim-cli/server@${version} stim-server setup --expires ${expiresAt} ${flags.map((flag) => `--${flag}`).join(" ")}`;
+function setupCommand(machine, ticket, expiresAt, flags, version) {
+	const parsed = parseMachine(machine);
+	const port = parsed?.transport === "local" && parsed.port !== DEFAULT_SERVER_PORT ? ` --port ${parsed.port}` : "";
+	return `STIM_SETUP_TICKET=${ticket} STIM_SETUP_ORIGIN=doctor npx --yes --package @stim-cli/server@${version} stim-server setup --expires ${expiresAt} ${flags.map((flag) => `--${flag}`).join(" ")}${port}`;
+}
+function transportOf(machine) {
+	return parseMachine(machine)?.transport ?? "tailscale";
 }
 function newPending(input, ticket, expiresAt, now) {
 	return {
 		machine: input.machine,
-		transport: "tailscale",
+		transport: transportOf(input.machine),
 		address: input.address,
 		state: "pending",
 		requestedAt: new Date(now).toISOString(),
@@ -599,7 +685,7 @@ function approved(input, reply, requestedAt) {
 		state: "approved",
 		credential: {
 			machine: input.machine,
-			transport: "tailscale",
+			transport: transportOf(input.machine),
 			address: input.address,
 			state: "approved",
 			requestedAt,
@@ -644,11 +730,13 @@ async function reachMachine(input) {
 			});
 			if ("result" in resumed && resumed.result.capabilities.includes(access)) return approved(input, resumed, pending.requestedAt);
 		}
+		const known = (serverKey) => pending.serverKey === serverKey || input.other()?.serverKey === serverKey;
 		const reply = await io.hello(input.endpoint, {
 			access,
 			ticket: pending.ticket,
 			name: input.deviceName,
 			onServerKey: (serverKey) => {
+				if (input.confirmKey && !known(serverKey)) return;
 				pending = {
 					...pending,
 					serverKey
@@ -656,8 +744,22 @@ async function reachMachine(input) {
 				return input.persist(pending);
 			}
 		});
-		if ("result" in reply && reply.result.capabilities.includes(access)) return approved(input, reply, pending.requestedAt);
-		const command = pending.expiresAt ? setupCommand(pending.ticket, pending.expiresAt, input.setupFlags, input.serverVersion) : null;
+		if ("result" in reply && reply.result.capabilities.includes(access)) {
+			if (input.confirmKey && !known(reply.serverKey)) {
+				if (!await input.confirmKey(reply.serverKey)) return {
+					state: "unconfirmed",
+					credential: pending,
+					fingerprint: keyFingerprint(Buffer.from(reply.serverKey, "base64url"))
+				};
+				pending = {
+					...pending,
+					serverKey: reply.serverKey
+				};
+				await input.persist(pending);
+			}
+			return approved(input, reply, pending.requestedAt);
+		}
+		const command = pending.expiresAt ? setupCommand(input.machine, pending.ticket, pending.expiresAt, input.setupFlags, input.serverVersion) : null;
 		if ("error" in reply && reply.error.code === "server-outdated") return {
 			state: "outdated",
 			credential: pending,
@@ -1277,4 +1379,4 @@ function allConsolePortsAndSerials({ isMounted = isOnMountedVolume } = {}) {
 	return result;
 }
 //#endregion
-export { endpoint$1 as $, writeConfigSettingAsync as A, deviceSlotFileKey as B, saveConfig as C, withConfigLock$1 as D, upsertProject as E, isOnMountedVolume as F, projectDeviceSlots as G, deviceSlotPlatforms as H, listMountedVolumes as I, SERVER_OUTDATED as J, removeSlotDevice as K, measuredDirectorySizeAsync as L, directorySize as M, directorySizeAsync as N, withConfigLockAsync$1 as O, formatBytes as P, doctorIo as Q, volumeRootFor as R, removeProject as S, setSupervisor as T, parseDeviceSlotKey as U, deviceSlotKey as V, parseDeviceSlotOption as W, diagnoseOutcome as X, diagnoseConnectFailure as Y, diagnoseTailscale as Z, loadConfig$1 as _, clearDevice as a, realIo as at, releaseAndroidConsolePort as b, ensureConfig as c, setupRemedy as ct, getConfigDir as d, notOnTailnetDiagnosis as dt, findPeer$1 as et, getConfigPath$1 as f, readHostPermissions as ft, isPathPrefix$1 as g, getRepoSettings as h, clearAndroidBootPending as i, reachMachine as it, acquireAvdClaim as j, writeConfigSetting as k, findEnclosingWorktreeRoot as l, tailscaleStatusAsync as lt, getProjectSettings as m, allMetroPorts as n, outdatedServer as nt, clearSupervisor as o, resolveEndpoint as ot, getProject as p, validateDeviceSlot as q, claimMetroPort as r, parseMachine$1 as rt, configCorruptRepair as s, sayHello as st, allConsolePortsAndSerials as t, openAuthenticated as tt, getConcurrencyLimits as u, diagnosisFinding as ut, recordIosSchemeApprovals as v, setDevice as w, releaseMetroPort as x, refuseRelativeStimPaths as y, assignSlotDevice as z };
+export { endpoint$1 as $, writeConfigSettingAsync as A, deviceSlotFileKey as B, saveConfig as C, withConfigLock$1 as D, upsertProject as E, isOnMountedVolume as F, projectDeviceSlots as G, deviceSlotPlatforms as H, listMountedVolumes as I, SERVER_OUTDATED as J, removeSlotDevice as K, measuredDirectorySizeAsync as L, directorySize as M, directorySizeAsync as N, withConfigLockAsync$1 as O, formatBytes as P, doctorIo as Q, volumeRootFor as R, removeProject as S, setSupervisor as T, parseDeviceSlotKey as U, deviceSlotKey as V, parseDeviceSlotOption as W, diagnoseOutcome as X, diagnoseConnectFailure as Y, diagnoseTailscale as Z, loadConfig$1 as _, clearDevice as a, reachMachine as at, releaseAndroidConsolePort as b, ensureConfig as c, sayHello as ct, getConfigDir as d, diagnoseLocalUnreachable as dt, findPeer$1 as et, getConfigPath$1 as f, diagnosisFinding as ft, isPathPrefix$1 as g, getRepoSettings as h, readHostPermissions as ht, clearAndroidBootPending as i, parseMachine$1 as it, acquireAvdClaim as j, writeConfigSetting as k, findEnclosingWorktreeRoot as l, setupRemedy as lt, getProjectSettings as m, unconfirmedKeyFinding as mt, allMetroPorts as n, openAuthenticated as nt, clearSupervisor as o, realIo as ot, getProject as p, notOnTailnetDiagnosis as pt, validateDeviceSlot as q, claimMetroPort as r, outdatedServer as rt, configCorruptRepair as s, resolveEndpoint as st, allConsolePortsAndSerials as t, keyConfirmer as tt, getConcurrencyLimits as u, tailscaleStatusAsync as ut, recordIosSchemeApprovals as v, setDevice as w, releaseMetroPort as x, refuseRelativeStimPaths as y, assignSlotDevice as z };