stim 1.30.0 → 1.32.0

package/dist/{guide-DkepBgHT.mjs → guide-CwpsGWTJ.mjs}

@@ -1,8 +1,8 @@
-import { t as ANDROID_AVD_CONFIG_HELP } from "./settings-D776ygML.mjs";
-import { i as findProjectRoot$1 } from "./project-DPQjnpcI.mjs";
-import { h as RECENT_LAUNCH_MS } from "./eas-session-ledger-CW3l-inB.mjs";
-import { o as guideStatus, t as WATCHMAN_NESTED_WORKTREES } from "./doctor-watchman-D1IyMle9.mjs";
-import "./status-watch-CnSyXUmj.mjs";
+import { t as ANDROID_AVD_CONFIG_HELP } from "./settings-C6UTYW2K.mjs";
+import { i as findProjectRoot$1 } from "./project-Crtcbfl0.mjs";
+import { h as RECENT_LAUNCH_MS } from "./eas-session-ledger-B-nTfdfk.mjs";
+import { o as guideStatus, t as WATCHMAN_NESTED_WORKTREES } from "./doctor-watchman-CCuboyj1.mjs";
+import "./status-watch-DSu_hhg6.mjs";
 import { SETTINGS, SETTINGS_SCHEMA_URL, TUTORIAL_VERSION } from "@stim-cli/core/state";
 import chalk from "chalk";
 //#region src/guide/agent.ts
@@ -291,7 +291,8 @@ replacement runs while one is queued. See \`stim guide lifecycle concurrency\`.
 After maintenance.idleStopHours (default 6) with no Stim command, native run,
 Metro bundle or HMR request, agent-device command or live view, automatic
 maintenance stops the workspace as stim stop does. Device and app logs do not
-count. After a long pause, run stim ios or android again before driving the
+count. A device hosted on a remote Mac stops with it, and stim-server stops a hosted
+session whose client has been gone that long. After a long pause, run stim ios or android again before driving the
 app; see \`stim guide cleanup\`.
 
 Treat a refusal as an ownership or state mismatch: read its code and remedy.
@@ -2504,8 +2505,9 @@ RULES
   \`guide lifecycle\`), so the sums can differ from what they sum.
 
   capacity.load is always present. capacity.builds is present only while
-  concurrency.maxBuilds is set, and capacity.devices only while
-  concurrency.maxDevices is set (see \`guide lifecycle concurrency\`):
+  concurrency.maxBuilds is set, capacity.devices only while
+  concurrency.maxDevices is set, and capacity.platformDevices only for the
+  platforms whose cap is set (see \`guide lifecycle concurrency\`):
 
   load     { cpus, loadPerCore, busyAt, limit, state }. loadPerCore is the
            5-minute load average divided by cpus, to one decimal. busyAt is
@@ -2528,6 +2530,11 @@ RULES
            device, with its device slot; for a device no workspace records,
            label is its name and workspace and slot are null. inUse is null
            and unknown says why when the devices could not be listed.
+  platformDevices  { ios?: { max, inUse, unknown? }, android?: { max, inUse,
+           unknown? } }, the booted owned simulators and emulators counted
+           against concurrency.maxIosDevices and concurrency.maxAndroidDevices.
+           Each key is present only while its cap is set, whether or not
+           concurrency.maxDevices is.
 
   The memory budget plans before a boot
   and always uses the estimate. What is using CPU and memory now is the
@@ -2668,7 +2675,9 @@ CAPACITY REFUSALS
   capacityRefusals?: [{ at, kind: "device", platform: "ios" | "android",
                        max, workspace }]
   Only device refusals with STIM_AT_CAPACITY are recorded; build caps wait.
-  at is the ISO timestamp, max is concurrency.maxDevices, and workspace is
+  at is the ISO timestamp, max is the cap of the limit that was full
+  (concurrency.maxDevices, or the platform's concurrency.maxIosDevices or
+  concurrency.maxAndroidDevices), and workspace is
   the workspace id used by status and Desktop. The list is newest first:
   the last 50 from the last 7 days, omitted when empty. Desktop uses events
   within 6 hours for its device-limit suggestion, including terminal runs.
@@ -2838,7 +2847,7 @@ HOSTED IOS METRO
   Macs; a running Metro or a pin on a port the host uses refuses the run before
   the build. metro.tunnel and metro.publicUrl are ignored. Supervisor restart
   reopens the recorded links; stop or a stopped hosted session closes them. A recorded
-  hosted session prevents Metro idle stop. Release runs skip the bridge.
+  hosted session prevents Metro idle stop; maintenance.idleStopHours still stops the workspace and its hosted session (guide cleanup). Release runs skip the bridge.
   Hosted Debug runs require a supervisor and a stim-server that support these
   links before reservation. --no-metro-check refuses; restart a missing or older supervisor
   with stim stop; stim start.
@@ -4779,8 +4788,10 @@ so a Debug run on one is wired to a LAN origin instead of localhost.`,
 		STIM_AT_CAPACITY: {
 			summary: "owned-device slot wait timed out, or --no-wait reached the cap or queue",
 			body: () => `STIM_AT_CAPACITY
-  Only when concurrency.maxDevices is set (unset by default). New owned
-  devices queue in FIFO order across $STIM_HOME for 600 seconds by default.
+  Only when concurrency.maxDevices, concurrency.maxIosDevices or
+  concurrency.maxAndroidDevices is set (all unset by default). A boot must fit
+  its platform cap and concurrency.maxDevices; the message names the limit that
+  was full with its count and cap. New owned devices queue in FIFO order across $STIM_HOME for 600 seconds by default.
   This refusal means the wait expired, or \`--no-wait\` / \`--wait 0\`
   found the cap full or another run queued. The message gives the current
   count and, on timeout, how long it waited. iOS waits beside its build,
@@ -4798,7 +4809,10 @@ so a Debug run on one is wired to a LAN origin instead of localhost.`,
   --no-wait and --wait 0 refuse at once. Builds under remote-only refuse with
   STIM_OFFLOAD_REFUSED instead.
   Stop an environment (\`stim stop\`), pass a longer \`--wait <seconds>\`,
-  or raise concurrency.maxDevices. With --remote auto, remote.machines and
+  or raise the limit the message names (concurrency.maxDevices, or the
+  platform's concurrency.maxIosDevices / maxAndroidDevices). On a stim-server
+  worker the hosted offer and reserve name the full limit too, including
+  concurrency.maxMacosApps. With --remote auto, remote.machines and
   the opt-in remote.easFallback (billed EAS Simulator) are tried before this
   wait; \`stim logs --source placement\` says why neither took the run. Waiting prints holder names and elapsed
   time; status JSON exposes build.waitingFor independently of phase.
@@ -5660,6 +5674,17 @@ not on any remote"  (worktree remove)
 };
 //#endregion
 //#region src/guide/lifecycle.ts
+const HOSTED_RECORDING = (noun) => `\
+agent-device record start [path] --remote-config <file> records the ${noun};
+record stop downloads the video to path, or ./recording-<time>.mp4, on this
+machine. The host writes it only under the session's private agent-device state
+and deletes the files after the download, on stim stop or session teardown and
+when its daemon restarts. One recording runs per session; a second start, a host output
+path, record inside batch and a record stop from another agent-device session
+are refused. The host stops a recording after 10 minutes; a record stop within
+the next 15 minutes downloads it. A finished recording over 512 MiB is deleted
+instead. A host whose Stim predates hosted recording refuses
+record as a command outside its allowed list.`;
 const lifecycle = {
 	summary: "The full worktree -> start -> ios/android -> logs -> teardown flow, with sections for builds, devices and flags",
 	preamble: () => `ENVIRONMENT LIFECYCLE
@@ -6205,7 +6230,7 @@ Status adds android.host { machine, session, selected, agent, device: { name,
 systemImage, api }, state } per slot. The public name is the profile and API
 level, never the host serial or AVD name. ready, stopped and unverified are
 session probe states; a conflicting local emulator remains visible with a
-warning. A recorded placement keeps the workspace in use and blocks idle stop.
+warning. A recorded placement keeps the workspace in use and blocks the supervisor's idle stop and device reclaim; maintenance.idleStopHours still stops it once the host confirms the session (guide cleanup, IDLE STOP).
 
 stop and worktree remove wait for device-host.stop, park the host's eligible owned
 emulator within pool.androidParkedMax (delete otherwise), close the Metro links and clear placement. stop --json reports
@@ -6227,6 +6252,11 @@ The host verifies the policy digest and android-instance backend before granting
 control. An older host, missing binary or unsupported policy reports driver: none;
 the host's notice explains unavailable control.
 
+On a local: machine, daemonBaseUrl is http://127.0.0.1:<port> of this
+workspace's Metro supervisor, which carries each request to the host over its
+own authenticated device-host connection (host feature hosted-agent-link). It
+works for Debug runs while stim start runs; Release runs report driver: none.
+
 android.host.agent in stim status --json provides driver, remoteConfig and
 command, never its token. Each slot has a separate 0600 file under the workspace
 state directory at hosted-android/<slot>/agent-device-remote.json. Use that file:
@@ -6242,12 +6272,15 @@ session's tenant. devices is permitted for the client's open flow; inventory
 contains only this emulator. Never use its serial with a local agent-device.
 Allowed commands are devices, open, close, snapshot, diff, wait, find, get, is,
 click, fill, press, type, focus, scroll, screenshot, longpress, swipe, back, home,
-orientation, appstate, alert and batch. Stim installs; install, reinstall,
-uninstall, boot, shutdown, close --shutdown, record, logs, uploads and device-wide
-actions are refused. Other serials in commands, flags, inputs, nested batches or
-lease requests are refused. Ambient client paths and owner fields are stripped;
-the host pins platform, serial, tenant, runId, clientId, deviceKey and backend.
-Host paths and launch inputs are refused. Screenshots use only remote artifacts.
+orientation, appstate, alert, batch, record start and record stop. Stim installs;
+install, reinstall, uninstall, boot, shutdown, close --shutdown, logs, uploads and
+device-wide actions are refused. Other serials in commands, flags, inputs, nested
+batches or lease requests are refused. Ambient client paths and owner fields are
+stripped; the host pins platform, serial, tenant, runId, clientId, deviceKey and
+backend. Host paths and launch inputs are refused. Screenshots use only remote
+artifacts.
+
+${HOSTED_RECORDING("emulator")}
 
 Stop closes the matching agent-device connection and removes the slot file only
 once the host confirms stop or revocation. Reinstall, stop, revocation and server
@@ -6319,7 +6352,7 @@ The same setup serves macos --remote and macos.remote. Approval is separate from
 and phone control. Set ios.remote to the machine name for a default (machine scope for every app on this machine);
 no flag or setting runs here. eas and proxy keep their remote backend meanings.
 --remote auto (or ios.remote = auto / android.remote = auto) stays here when
-there is a free concurrency.maxDevices slot (0 means unlimited), no device
+there is a free concurrency.maxDevices slot and platform cap slot (0 means unlimited), no device
 waiter ahead, normal host memory pressure, no budget shortfall,
 and 5-minute load per core below server.maxLoadPerCore. Without remote.machines,
 auto and remote are local and remote-only refuses with STIM_HOSTING_REFUSED. An unknown local device count also stays local; boot admission
@@ -6354,7 +6387,7 @@ when it names a machine, then remote.machines order, so the first listed host wi
 room fills before the next gets a run. Load and free memory do not rank hosts.
 Automatic build offload resolves later, after the device architecture is known.
 
-When no host admits and this machine is at its concurrency.maxDevices cap (or runs
+When no host admits and this machine is at its concurrency.maxDevices or per-platform cap (or runs
 are queued ahead), remote.easFallback (default false; EAS Simulator is billed)
 runs the device on an EAS Simulator exactly as --remote eas would: the build
 stays here, nothing starts an EAS cloud build, stop ends the session, and
@@ -6395,7 +6428,8 @@ refuses. The host boots headless and ignores this Mac's iosSimulatorApp setting.
 the offered simulator architecture, not this machine's. --remote-build remains
 independent and selects a compatible build worker for a Debug cache miss.
 
-The host's own owned devices count toward concurrency.maxDevices.
+The host's own owned devices count toward concurrency.maxDevices and its per-platform cap
+(concurrency.maxIosDevices, concurrency.maxAndroidDevices; hosted macOS apps use concurrency.maxMacosApps).
 
 The host's person sees Hosted here rows in stim-server devices; --json adds
 hostedSessions beside devices. Rows show client, platform, device, installed
@@ -6526,6 +6560,11 @@ session and rotates its grant; rerun stim ios to reattach and refresh the config
 An unresolved proxy or daemon retains its claim and blocks reinstall and native
 teardown; clear a named claim only after proving its owner and child are gone.
 
+On a local: machine, daemonBaseUrl is http://127.0.0.1:<port> of this
+workspace's Metro supervisor, which carries each request to the host over its
+own authenticated device-host connection (host feature hosted-agent-link). It
+works for Debug runs while stim start runs; Release runs report driver: none.
+
 The client writes a separate 0600 remote-config file for each workspace slot.
 Status prints agent: <command>; ios.host.agent in --json carries driver,
 remoteConfig and command, never the token. Use the returned file:
@@ -6547,13 +6586,13 @@ targeting its exact simulator UDID before deleting the simulator, even without c
 
 Allowed: devices, open, close, snapshot, diff, wait, find, get, is, click, fill,
 press, type, focus, scroll, screenshot, longpress, swipe, back, home, orientation,
-appstate, alert and batch. These inspect or interact with the simulator and
-installed apps. devices lists only the session's simulator, filtered by the
-daemon policy. Its device claims are session-local and record / as the workspace;
+appstate, alert, batch, record start and record stop. These inspect, interact
+with or record the simulator and installed apps. devices lists only the
+session's simulator, filtered by the daemon policy. Its device claims are session-local and record / as the workspace;
 a host-side agent-device using the same simulator is not visible to the hosted daemon.
 Client device selectors are stripped and requests are pinned to iOS and that
 UDID; an explicitly named foreign UDID is refused. Selecting another device,
-boot/shutdown/erase, installs, uninstall, uploads, push, record, logs, network,
+boot/shutdown/erase, installs, uninstall, uploads, push, logs, network,
 perf, trace, clipboard and settings are refused. Stim installs; the agent cannot
 enumerate other host devices or write host files. Ambient client fields (cwd,
 stateDir, config and remoteConfig) are stripped, including inside batch steps.
@@ -6563,6 +6602,8 @@ Only agent-device's generated screenshot temp artifact is accepted and returned
 to the client; arbitrary host screenshot destinations are refused. Runtime
 hints are dropped and only reporting/artifact metadata passes through.
 
+${HOSTED_RECORDING("simulator")}
+
 If hosting.agentDriver is none, the driver cannot enforce its policy, or the
 host does not advertise hosted-ios-agent, agent reports
 { driver: 'none', setting: 'hosting.agentDriver' }. Update the host and check
@@ -7739,7 +7780,8 @@ OPT-IN CONCURRENCY LIMITS (UNLIMITED BY DEFAULT)
                             wait also records a capacityWaits event in stats,
                             with reclaimed when one or more devices were
                             shut down for it.
-                            While at the cap, only the queue head reclaims:
+                            While at the cap, only the queue head reclaims (or a run behind a
+                            head held back only by its own platform's cap):
                             it shuts down the longest-idle eligible owned
                             device in another workspace of this Stim home,
                             one per attempt, at most once every 15 seconds,
@@ -7759,6 +7801,35 @@ OPT-IN CONCURRENCY LIMITS (UNLIMITED BY DEFAULT)
                             and the command to remove that exact claim.
                             See \`guide errors STIM_AT_CAPACITY\`.
 
+    concurrency.maxIosDevices      booted owned iOS simulators at once.
+    concurrency.maxAndroidDevices  booted owned Android emulators at once.
+    concurrency.maxMacosApps       hosted macOS apps on a worker at once.
+                            Each is 0 (no per-platform limit) unless set, and
+                            each only tightens: a run must fit its platform's
+                            cap AND concurrency.maxDevices. maxDevices counts
+                            simulators and emulators together, local and
+                            hosted, and counts hosted macOS apps as a pool of
+                            their own, so a macOS app is bounded by
+                            maxMacosApps and by maxDevices, and never adds to
+                            the simulator and emulator total. Leaving the new
+                            settings unset changes no existing cap.
+                            Local admission applies the iOS and Android caps
+                            with the same queue and reclaim as maxDevices; a
+                            waiter held back only by its own platform's cap
+                            does not hold up a waiter of another platform.
+                            Reclaim for a full platform cap only shuts down
+                            devices of that platform. Hosted admission on a
+                            worker (offer and reserve) applies all three,
+                            counting the worker's local devices too.
+                            Local \`stim macos\` runs are not counted, so
+                            maxMacosApps limits hosted macOS apps only.
+                            A refusal names the full limit, its count and its
+                            cap, for example "1 Stim iOS simulator(s) are
+                            already booted and concurrency.maxIosDevices is 1".
+                            Status JSON capacity.platformDevices reports
+                            { max, inUse } for each of ios and android whose
+                            cap is set.
+
   \`stim doctor\` prints one note echoing the caps and the current active count,
   but ONLY when a cap is set. \`stim gc\` reports stale build slots the way it
   reports stale build locks, and \`gc --delete\` clears them. Set the caps
@@ -8805,7 +8876,7 @@ status's maintenance block and the maintenance log.
 
 IDLE STOP: the idle check, and gc --delete unless maintenance.mode is off (its
 dry run lists them in the maintenance plan), stop a workspace whose dev server
-runs or whose owned simulator or emulator is booted once it has had no real
+runs, whose owned simulator or emulator is booted, or whose device is hosted on a remote Mac once it has had no real
 activity for maintenance.idleStopHours (default 6; 0 never; machine or project
 layers; STIM_MAINTENANCE_IDLE_STOP_HOURS overrides; fractions work). Six hours
 outlasts a lunch break, a meeting or an agent's pause between tasks, and still
@@ -8820,7 +8891,7 @@ only stays connected does not either. The stop is stim stop's: the dev
 server stops, the owned devices shut down through centralized teardown
 (never deleted), and the port is released; device leases stay. A build, a
 held native-run or metro-start lock, a build lock or slot, a running macOS
-app, a hosted or remote session, an unexpired device lease, a managed tunnel
+app, a remote (EAS) session, an unexpired device lease, a managed tunnel
 or remote lock, a running owned Chrome, a device driver other than
 agent-device, a live agent-device claim with no session activity to judge,
 device activity, an emulator list or an emulator's AVD name that cannot be read keeps
@@ -8833,7 +8904,21 @@ after stim stop, and the supervisor_stopped line in metro.ndjson names
 automatic maintenance and the idle time as the requester. The next start, ios or android starts it
 again. An owned emulator the activity check missed keeps the workspace while
 adb lists it, and so does any emulator adb lists without an AVD name, such as
-a stale offline entry that adb kill-server clears. A dev server that may still run after its supervisor
+a stale offline entry that adb kill-server clears. A workspace whose iOS, Android or macOS device is hosted on a remote Mac is
+stopped the same way once the host confirms the session is ready; stim stop's
+hosted path ends the session and the host parks or tears down the device. A host
+that does not answer, a session it cannot confirm (unknown, as after a worker
+crash) and a placement that cannot be read keep the workspace, and a live view of
+the hosted device is not seen here. On the host, stim-server stops a ready session
+whose client has had no connection, live stream or Metro link and sent no
+agent-device request for the host's own machine maintenance.idleStopHours (default 6; 0
+never; STIM_MAINTENANCE_IDLE_STOP_HOURS overrides), only while its maintenance.mode is on;
+a project value or maintenance.keep on the client does not reach it. Server downtime is not
+counted. It uses the stop a person uses, never touches a session whose journal state is
+preparing, stopping or unknown, or one with a native operation or a claim it cannot prove free
+(a session a crashed server left ready counts once its claim is proven free),
+and writes the reason to the server log and the session's idleStop journal field.
+The count is per client, not per session. A dev server that may still run after its supervisor
 exited is kept until stim stop ends it. So is a dev server whose requests Stim
 does not record: an Expo project before SDK 54, which cannot load Stim's Metro config
 adapter, or a dev server an older Stim started, until stim stop and stim start
@@ -10415,8 +10500,9 @@ ${ANDROID_AVD_CONFIG_HELP.map((line) => `                          ${line}`).joi
                         lifecycle hosted-android.
   remote.easFallback    true lets "auto" or "remote" (ios.remote, android.remote
                         or --remote) run the simulator or emulator on a
-                        billed EAS Simulator when this machine is at its
-                        concurrency.maxDevices cap (or has runs queued) and no
+                        billed EAS Simulator when this machine is at a
+                        device cap (concurrency.maxDevices or a per-platform
+                        cap, or has runs queued) and no
                         remote.machines entry takes the run, instead of waiting
                         or refusing with STIM_AT_CAPACITY. Default false. A
                         busy machine with a free slot never uses it. Stim checks
@@ -10650,12 +10736,20 @@ machine's. They live under a top-level \`concurrency\` key in
     "concurrency": { "maxBuilds": 2, "maxDevices": 3 }
   }
 
-The keys are concurrency.maxBuilds and concurrency.maxDevices.
+The keys are concurrency.maxBuilds and concurrency.maxDevices, plus the
+per-platform device caps concurrency.maxIosDevices,
+concurrency.maxAndroidDevices and concurrency.maxMacosApps. A boot must fit
+its platform cap and concurrency.maxDevices; the per-platform caps only
+tighten (see \`guide lifecycle concurrency\`).
 
 or via the environment, which overrides the file:
 
   STIM_MAX_BUILDS=2 STIM_MAX_DEVICES=3 stim ios
 
+  concurrency.maxIosDevices      STIM_MAX_IOS_DEVICES
+  concurrency.maxAndroidDevices  STIM_MAX_ANDROID_DEVICES
+  concurrency.maxMacosApps       STIM_MAX_MACOS_APPS
+
 Unset, 0, or any non-positive value means NO enforcement -- the default, where
 Stim limits nothing. See \`guide lifecycle concurrency\` for what each cap
 does.
@@ -10691,7 +10785,8 @@ STIM_HOME and CI make the mode off unless STIM_MAINTENANCE is set.
 maintenance.keep is a project setting: pin a workspace so a pass never clears
 its build outputs or removes its worktree.
 maintenance.idleStopHours takes machine or project layers, so one workspace can
-stop sooner, later or never.
+stop sooner, later or never. On a hosting Mac stim-server reads its machine value
+to stop a hosted session whose client has been gone that long.
 See \`guide cleanup\` for checks, plans and log paths.
 
 ${SETTINGS.filter((setting) => setting.key.startsWith("maintenance.") || /^caches\..*MaxGb$/.test(setting.key)).map((setting) => `  ${setting.key}  ${setting.env ?? "project setting"}  ${setting.default === void 0 ? "unset" : `default ${setting.default}`}
@@ -10888,7 +10983,10 @@ ticket, which is a credential: whoever spends it first, after setup stores it,
 gets the approval, and on a local network that takes only the ticket and a
 route to the worker, not tailnet membership. Agents show it only to the user.
 Offloaded builds and hosted Debug and
-Release runs work there; agent control of hosted apps needs a tailnet machine.
+Release runs work there. Agent control of hosted iOS and Android Debug runs
+goes through a loopback port of this workspace's Metro supervisor, which
+carries it over its own authenticated connection; Release runs and hosted macOS
+apps there report agent control as none.
 \`stim-server pair\` puts \`ws://<address>:<port>\` in the phone pairing code
 when Tailscale is not running and \`server.lanAddresses\` is set.
 
@@ -12180,6 +12278,10 @@ backend. Reserved names are case-insensitive and trimmed; they refuse with
 STIM_BAD_ARG before state access or a connection. The device pool switches
 (remote.devicePoolDisabled) also apply to automatic macOS placement.
 
+A hosted app is not kept forever: the idle workspace stop ends its hosted session
+after maintenance.idleStopHours without activity, and stim-server stops a session
+whose client has been gone that long (guide cleanup, IDLE STOP).
+
 Logs: the host records the hosted app's stdout, stderr and exit like a local run.
 stim logs, including --errors, --json and --follow, asks the host over the same
 approved connection, copies the records it has not copied yet into the
@@ -12284,9 +12386,9 @@ script such as mini-desktop.sh use these instead:
   quit                       stim stop (verified stop; the host frees the slot
                              and removes the app's defaults)
   clean                      stim worktree remove
-  3 concurrent slots         concurrency.maxDevices on the host, counted apart
-                             from simulators and emulators; one bundle id
-                             slot per session
+  3 concurrent slots         concurrency.maxMacosApps and concurrency.maxDevices
+                             on the host, counted apart from simulators and
+                             emulators; one bundle id slot per session
 
 The agent-device rows work once the host's agent field names agent-device.
 

package/dist/{hosted-android-Du7NxufJ.mjs → hosted-android-c5nPJA6S.mjs}

@@ -1,7 +1,7 @@
 import { c as throwIfCancelled } from "./exec-aULwtNly.mjs";
-import { c as call, l as connectHost } from "./hosted-client-Cect92SZ.mjs";
-import { i as requestHostedMetro } from "./metro-request-BtF7ox53.mjs";
-import { a as stopHostedNative, i as prepareHostedNative, r as placeHostedNative } from "./hosted-native-DmdLSmvu.mjs";
+import { c as call, l as connectHost } from "./hosted-client-Hs-fD4L3.mjs";
+import { a as requestHostedMetro } from "./metro-request-DODHNXCN.mjs";
+import { a as stopHostedNative, i as prepareHostedNative, r as placeHostedNative } from "./hosted-native-Bh9IJ_t5.mjs";
 //#region src/device-host/hosted-android.ts
 async function prepareHostedAndroid(machine, selectors, recorded, mode) {
 	return await prepareHostedNative(machine, selectors, recorded, "android", false, mode);

package/dist/{hosted-client-Cect92SZ.mjs → hosted-client-Hs-fD4L3.mjs}

@@ -1,7 +1,7 @@
 import { c as throwIfCancelled, o as cancellableSleep } from "./exec-aULwtNly.mjs";
-import { Y as diagnoseConnectFailure, st as resolveEndpoint } from "./config-AbUjIBOQ.mjs";
-import { t as BuildConnection } from "./client-DrHykA24.mjs";
-import { g as configuredMachines } from "./selection-PCMT97XD.mjs";
+import { X as diagnoseConnectFailure, ct as resolveEndpoint } from "./config-D5qNWJEP.mjs";
+import { t as BuildConnection } from "./client-lDmA-5jx.mjs";
+import { g as configuredMachines } from "./selection-C4ZQz_ER.mjs";
 import { createHash } from "node:crypto";
 import { lstatSync, readFileSync, readdirSync, readlinkSync } from "node:fs";
 import { join } from "node:path";
@@ -232,25 +232,49 @@ function bundleManifest(bundle) {
 		content
 	};
 }
+/** stim-server answers one connection's requests in arrival order, so chunks sent in order reach it in order. */
+const UPLOAD_WINDOW = 64;
 async function upload(host, ids, missing, content) {
 	if (!Array.isArray(missing)) throw new Error(`${host.machine} answered device-host.app.offer without missing content.`);
-	for (const entry of missing) {
+	const files = missing.map((entry) => {
 		const read = isJsonObject(entry) && typeof entry.sha256 === "string" ? content.get(entry.sha256) : void 0;
-		if (!read || !isJsonObject(entry) || typeof entry.offset !== "number") throw new Error(`${host.machine} asked for content this app does not have.`);
-		const bytes = read();
-		let offset = entry.offset;
-		do {
-			const data = bytes.subarray(offset, offset + HOSTED_APP_CHUNK_BYTES).toString("base64");
+		if (!read || !isJsonObject(entry) || typeof entry.sha256 !== "string" || typeof entry.offset !== "number") throw new Error(`${host.machine} asked for content this app does not have.`);
+		return {
+			digest: entry.sha256,
+			start: entry.offset,
+			read
+		};
+	});
+	const inFlight = /* @__PURE__ */ new Set();
+	let failure;
+	const send = async (digest, offset, end, data) => {
+		try {
 			const next = (await call(host, "device-host.app.chunk", {
 				...ids,
-				sha256: entry.sha256,
+				sha256: digest,
 				offset,
 				data
 			})).offset;
-			if (typeof next !== "number" || next <= offset && next !== bytes.length) throw new Error(`${host.machine} did not accept app content at byte ${offset}.`);
-			offset = next;
+			if (typeof next !== "number" || next < end) throw new Error(`${host.machine} did not accept app content at byte ${offset}.`);
+		} catch (error) {
+			failure ??= error instanceof Error ? error : new Error(String(error));
+		}
+	};
+	for (const { digest, start, read } of files) {
+		if (failure) break;
+		const bytes = read();
+		let offset = start;
+		do {
+			if (inFlight.size >= UPLOAD_WINDOW) await Promise.race(inFlight);
+			if (failure) break;
+			const end = Math.min(offset + HOSTED_APP_CHUNK_BYTES, bytes.length);
+			const pending = send(digest, offset, end, bytes.subarray(offset, end).toString("base64")).finally(() => inFlight.delete(pending));
+			inFlight.add(pending);
+			offset = end;
 		} while (offset < bytes.length);
 	}
+	await Promise.all(inFlight);
+	if (failure) throw failure;
 }
 //#endregion
 export { stoppedSession as _, SESSION_TIMEOUT_MS as a, call as c, hostConnector as d, hostedSession as f, sha256 as g, settle as h, RESERVE_TIMEOUT_MS as i, connectHost as l, requireHostedAppMode as m, OFFER_TIMEOUT_MS as n, attach as o, probeHostedSession as p, PREPARE_TIMEOUT_MS as r, bundleManifest as s, INSTALL_TIMEOUT_MS as t, heldNoLonger as u, unknownSession as v, upload as y };

package/dist/{hosted-logs-Opcjv1Lr.mjs → hosted-logs-BteXG8rm.mjs}

@@ -1,11 +1,11 @@
 import { t as getExecutor } from "./exec-aULwtNly.mjs";
-import { E as workspaceDir, k as workspaceLogsDir$1 } from "./workspace-state-DGwkPXwq.mjs";
-import { B as deviceSlotFileKey, it as parseMachine$1, q as validateDeviceSlot } from "./config-AbUjIBOQ.mjs";
-import { l as phaseLine } from "./command-output-BBW8eWPL.mjs";
-import { n as macosDir } from "./state-C2AUjjhg.mjs";
-import { n as androidLogGroups, r as isAndroidCrashText } from "./android-BEQUDpOg.mjs";
+import { E as workspaceDir, k as workspaceLogsDir$1 } from "./workspace-state-3bF4TB8P.mjs";
+import { J as validateDeviceSlot, V as deviceSlotFileKey, at as parseMachine$1 } from "./config-D5qNWJEP.mjs";
+import { l as phaseLine } from "./command-output-CfPW1bKP.mjs";
+import { n as macosDir } from "./state-CiflgxTP.mjs";
+import { n as androidLogGroups, r as isAndroidCrashText } from "./android-BeeC15Ve.mjs";
 import { c as readNdjsonGenerations$1, i as createNdjsonWriter } from "./ndjson-CrjIsGzw.mjs";
-import { c as call } from "./hosted-client-Cect92SZ.mjs";
+import { c as call } from "./hosted-client-Hs-fD4L3.mjs";
 import { mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { LOG_ROTATE_BYTES, ambientWrite, withDirLockAsync } from "@stim-cli/core";
@@ -46,10 +46,16 @@ async function removeAgentAccess(file, keep) {
 		if (path !== keep) rmSync(path, { force: true });
 	}
 }
-async function agentAccess(file, credential, grant, note, platform = "macos") {
+/**
+* Writes the remote config that lets agent-device drive a hosted app and says how to use it. A tailnet machine is
+* reached at its `tailscale serve` route. A local network machine is reached only through `relay`, the loopback port
+* of this workspace's supervisor relay, or not at all when `relay` is the reason there is none.
+*/
+async function agentAccess(file, credential, grant, note, platform = "macos", relay = `Agent control of apps hosted on ${credential.machine} over the local network is relayed only for hosted iOS and Android Debug runs.`) {
 	const machine = parseMachine$1(credential.machine);
-	if (machine?.transport === "local") {
-		if (grant !== void 0) note(`Agent control of apps hosted on ${credential.machine} needs a tailnet machine; the local network does not carry it.`);
+	const local = machine?.transport === "local";
+	if (local && typeof relay === "string") {
+		if (grant !== void 0) note(relay);
 		await removeAgentAccess(file);
 		return {
 			driver: "none",
@@ -65,7 +71,7 @@ async function agentAccess(file, credential, grant, note, platform = "macos") {
 	const target = client ? join(dirname(file), client.configFile) : file;
 	const access = client && issued ? client.access({
 		grant: issued,
-		baseUrl: `https://${credential.address}${port === 443 ? "" : `:${port}`}${issued.path}`,
+		baseUrl: local ? `http://127.0.0.1:${relay}${issued.path}` : `https://${credential.address}${port === 443 ? "" : `:${port}`}${issued.path}`,
 		file: target,
 		platform
 	}) : null;

package/dist/{hosted-logs-sync-wsI7N1Hv.mjs → hosted-logs-sync-B8bjLEMs.mjs}

@@ -1,8 +1,8 @@
-import { n as pullHostedNativeLogs, r as readHostedNativeLogs, t as pullHostedMacosLogs } from "./hosted-logs-Opcjv1Lr.mjs";
-import { l as phaseLine } from "./command-output-BBW8eWPL.mjs";
-import { l as connectHost } from "./hosted-client-Cect92SZ.mjs";
-import { n as readHostedIos, t as readHostedAndroid } from "./ios-state-Ce_dystM.mjs";
-import "./hosted-macos-BP9Kucat.mjs";
+import { n as pullHostedNativeLogs, r as readHostedNativeLogs, t as pullHostedMacosLogs } from "./hosted-logs-BteXG8rm.mjs";
+import { l as phaseLine } from "./command-output-CfPW1bKP.mjs";
+import { l as connectHost } from "./hosted-client-Hs-fD4L3.mjs";
+import { n as readHostedIos, t as readHostedAndroid } from "./ios-state-BEIJRJ7P.mjs";
+import "./hosted-macos-B4byscei.mjs";
 import { watch } from "node:fs";
 import { dirname, relative, resolve, sep } from "node:path";
 import { ambientWrite, configDir } from "@stim-cli/core";

package/dist/{hosted-macos-BP9Kucat.mjs → hosted-macos-B4byscei.mjs}

@@ -1,9 +1,9 @@
 import { o as cancellableSleep } from "./exec-aULwtNly.mjs";
-import { a as agentAccess, i as closeAgentConnection, o as removeAgentAccess, t as pullHostedMacosLogs } from "./hosted-logs-Opcjv1Lr.mjs";
-import { l as phaseLine } from "./command-output-BBW8eWPL.mjs";
-import { n as macosDir } from "./state-C2AUjjhg.mjs";
-import { st as runCancellationSignal } from "./toolchain-DLdoyxIt.mjs";
-import { _ as stoppedSession, a as SESSION_TIMEOUT_MS, c as call, f as hostedSession, g as sha256, h as settle, i as RESERVE_TIMEOUT_MS, l as connectHost, o as attach, r as PREPARE_TIMEOUT_MS, s as bundleManifest, t as INSTALL_TIMEOUT_MS, u as heldNoLonger, v as unknownSession, y as upload } from "./hosted-client-Cect92SZ.mjs";
+import { a as agentAccess, i as closeAgentConnection, o as removeAgentAccess, t as pullHostedMacosLogs } from "./hosted-logs-BteXG8rm.mjs";
+import { l as phaseLine } from "./command-output-CfPW1bKP.mjs";
+import { n as macosDir } from "./state-CiflgxTP.mjs";
+import { st as runCancellationSignal } from "./toolchain-Bnm8vUCV.mjs";
+import { _ as stoppedSession, a as SESSION_TIMEOUT_MS, c as call, f as hostedSession, g as sha256, h as settle, i as RESERVE_TIMEOUT_MS, l as connectHost, o as attach, r as PREPARE_TIMEOUT_MS, s as bundleManifest, t as INSTALL_TIMEOUT_MS, u as heldNoLonger, v as unknownSession, y as upload } from "./hosted-client-Hs-fD4L3.mjs";
 import { randomUUID } from "node:crypto";
 import { join } from "node:path";
 import { ambientContext, ambientWrite } from "@stim-cli/core";

package/dist/{hosted-native-DmdLSmvu.mjs → hosted-native-Bh9IJ_t5.mjs}

@@ -1,10 +1,10 @@
 import { o as cancellableSleep, x as withDrainingCancellation } from "./exec-aULwtNly.mjs";
-import { E as workspaceDir, l as withWorkspaceStateLockAsync, r as readWorkspaceState$1 } from "./workspace-state-DGwkPXwq.mjs";
-import { a as agentAccess, i as closeAgentConnection, n as pullHostedNativeLogs, o as removeAgentAccess } from "./hosted-logs-Opcjv1Lr.mjs";
-import { st as runCancellationSignal } from "./toolchain-DLdoyxIt.mjs";
-import { _ as stoppedSession, a as SESSION_TIMEOUT_MS, c as call, f as hostedSession, g as sha256, h as settle, i as RESERVE_TIMEOUT_MS, l as connectHost, m as requireHostedAppMode, n as OFFER_TIMEOUT_MS, o as attach, r as PREPARE_TIMEOUT_MS, s as bundleManifest, t as INSTALL_TIMEOUT_MS, u as heldNoLonger, v as unknownSession, y as upload } from "./hosted-client-Cect92SZ.mjs";
-import { a as requireHostedMetro, i as requestHostedMetro, n as closeHostedMetro } from "./metro-request-BtF7ox53.mjs";
-import { s as writeHostedNative } from "./ios-state-Ce_dystM.mjs";
+import { E as workspaceDir, l as withWorkspaceStateLockAsync, r as readWorkspaceState$1 } from "./workspace-state-3bF4TB8P.mjs";
+import { a as agentAccess, i as closeAgentConnection, n as pullHostedNativeLogs, o as removeAgentAccess } from "./hosted-logs-BteXG8rm.mjs";
+import { st as runCancellationSignal } from "./toolchain-Bnm8vUCV.mjs";
+import { _ as stoppedSession, a as SESSION_TIMEOUT_MS, c as call, f as hostedSession, g as sha256, h as settle, i as RESERVE_TIMEOUT_MS, l as connectHost, m as requireHostedAppMode, n as OFFER_TIMEOUT_MS, o as attach, r as PREPARE_TIMEOUT_MS, s as bundleManifest, t as INSTALL_TIMEOUT_MS, u as heldNoLonger, v as unknownSession, y as upload } from "./hosted-client-Hs-fD4L3.mjs";
+import { a as requestHostedMetro, n as closeHostedMetro, o as requireHostedMetro, r as hostedAgentPort } from "./metro-request-DODHNXCN.mjs";
+import { s as writeHostedNative } from "./ios-state-BEIJRJ7P.mjs";
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -268,7 +268,7 @@ async function placeHostedNativeOnce(target, { root, slot, bundle, handoff, bund
 		if (typeof delivery.notice === "string") note(delivery.notice);
 		placement = {
 			...placement,
-			agent: await agentAccess(platform === "ios" ? iosAgentRemoteConfig(root, slot) : androidAgentRemoteConfig(root, slot), host.credential, host.connection.supports(platform === "ios" ? "hosted-ios-agent" : "hosted-android-agent") ? delivery.agent : void 0, note, platform)
+			agent: await agentAccess(platform === "ios" ? iosAgentRemoteConfig(root, slot) : androidAgentRemoteConfig(root, slot), host.credential, host.connection.supports(platform === "ios" ? "hosted-ios-agent" : "hosted-android-agent") ? delivery.agent : void 0, note, platform, mode !== "development" ? void 0 : !host.connection.supports("hosted-agent-link") ? `${host.machine} runs a stim-server that cannot carry agent control over the local network. Update stim-server there, then retry.` : hostedAgentPort(root, session.id) ?? `The Metro supervisor has no agent relay ready for ${host.machine}. Rerun this command; if it persists, run stim stop; stim start, then retry.`)
 		};
 		return {
 			placement,

package/dist/{idle-shutdown-BcMN_cLm.mjs → idle-shutdown-BaeCo4ps.mjs}

@@ -1,11 +1,11 @@
-import { k as workspaceLogsDir$1, r as readWorkspaceState$1, s as updateWorkspaceStateAsync } from "./workspace-state-DGwkPXwq.mjs";
-import { V as deviceSlotKey, _ as loadConfig$1 } from "./config-AbUjIBOQ.mjs";
-import { o as formatLongDuration } from "./command-output-BBW8eWPL.mjs";
+import { k as workspaceLogsDir$1, r as readWorkspaceState$1, s as updateWorkspaceStateAsync } from "./workspace-state-3bF4TB8P.mjs";
+import { H as deviceSlotKey, v as loadConfig$1 } from "./config-D5qNWJEP.mjs";
+import { o as formatLongDuration } from "./command-output-CfPW1bKP.mjs";
 import { i as createNdjsonWriter } from "./ndjson-CrjIsGzw.mjs";
-import { B as workspaceBuildInProgress, P as collectOwnedDeviceActivity, ht as teardownOwnedIosSim, pt as teardownOwnedAvd } from "./workspaces-7_RWoi6c.mjs";
+import { B as workspaceBuildInProgress, P as collectOwnedDeviceActivity, ht as teardownOwnedIosSim, pt as teardownOwnedAvd } from "./workspaces-C59v9bpD.mjs";
 import { t as canonicalPath } from "./paths-BsJMoPP2.mjs";
-import { _ as workspaceDeviceLastUseAt } from "./activity-BTaUf0tc.mjs";
-import { d as listAllIosSims } from "./ios-CXnoVO_z.mjs";
+import { _ as workspaceDeviceLastUseAt } from "./activity-yjH7Q3zn.mjs";
+import { d as listAllIosSims } from "./ios-CdAV4-1E.mjs";
 import { join } from "node:path";
 import { LOG_ROTATE_BYTES } from "@stim-cli/core";
 import { DEVICE_IDLE_SHUTDOWN_KEY, DEVICE_RECLAIM_REASON, readDeviceIdleShutdowns } from "@stim-cli/core/state";

package/dist/{ios-CXnoVO_z.mjs → ios-CdAV4-1E.mjs}

@@ -1,10 +1,10 @@
 import { l as WorkspaceProcessCleanupError, n as isTimeoutError, o as cancellableSleep, t as getExecutor } from "./exec-aULwtNly.mjs";
-import { P as formatBytes, _ as loadConfig$1 } from "./config-AbUjIBOQ.mjs";
+import { F as formatBytes, v as loadConfig$1 } from "./config-D5qNWJEP.mjs";
 import { n as stripAnsi, r as waitForChild, t as createLineReader } from "./process-output-Fpl8PYi8.mjs";
 import { n as runOperationFileQuiet, t as runOperationFile } from "./operation-exec-Dp4FuIGR.mjs";
-import { i as stimDesktopInstalledAsync, n as settingDefault, t as STIM_DESKTOP_OPEN_OPTIONS } from "./stim-desktop-CYXLFpFS.mjs";
-import { Ct as forgetCreatedDeviceAsync, Et as recordCreatedDeviceAsync, dt as isStimOwnedSim } from "./android-DdKG6lyD.mjs";
-import { n as signedTailFor } from "./apk-signed-tail-B8kw4a8K.mjs";
+import { i as stimDesktopInstalledAsync, n as settingDefault, t as STIM_DESKTOP_OPEN_OPTIONS } from "./stim-desktop-1XxET4S8.mjs";
+import { Ot as recordCreatedDeviceAsync, Tt as forgetCreatedDeviceAsync, pt as isStimOwnedSim } from "./android-DsEj2CCs.mjs";
+import { n as signedTailFor } from "./apk-signed-tail-B9Usseps.mjs";
 import { createHash } from "node:crypto";
 import { closeSync, existsSync, lstatSync, mkdtempSync, openSync, readSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir, totalmem } from "node:os";