Add GitHub Actions simulator provider workflow

.github/workflows/simdeck-provider.yml

@@ -0,0 +1,202 @@
+name: SimDeck Provider
+
+on:
+  workflow_dispatch:
+    inputs:
+      preview_id:
+        description: SimDeck Cloud preview deployment id
+        required: true
+      provider_token:
+        description: One-time provider registration token
+        required: true
+      simdeck_cloud_url:
+        description: SimDeck Cloud control plane URL
+        required: true
+      artifact_id:
+        description: GitHub Actions artifact id containing a simulator .app
+        required: false
+      source_run_id:
+        description: Source workflow run id that uploaded the simulator artifact
+        required: false
+      bundle_id:
+        description: iOS app bundle id to launch after install
+        required: false
+      simdeck_artifact_url:
+        description: Optional URL to a prebuilt simdeck binary tarball
+        required: false
+
+permissions:
+  actions: read
+  contents: read
+
+jobs:
+  provider:
+    runs-on: macos-latest
+    timeout-minutes: 360
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Download simulator artifact
+        if: ${{ inputs.artifact_id != '' }}
+        uses: actions/download-artifact@v4
+        with:
+          artifact-ids: ${{ inputs.artifact_id }}
+          run-id: ${{ inputs.source_run_id || github.run_id }}
+          github-token: ${{ github.token }}
+          path: simdeck-artifact
+
+      - name: Install cloudflared
+        shell: bash
+        run: |
+          set -euo pipefail
+          brew install cloudflare/cloudflare/cloudflared
+
+      - name: Register provider workflow
+        shell: bash
+        env:
+          SIMDECK_CLOUD_URL: ${{ inputs.simdeck_cloud_url }}
+          PREVIEW_ID: ${{ inputs.preview_id }}
+          PROVIDER_TOKEN: ${{ inputs.provider_token }}
+        run: |
+          set -euo pipefail
+          curl -fsS \
+            -H 'content-type: application/json' \
+            -d "{
+              \"previewId\":\"$PREVIEW_ID\",
+              \"providerToken\":\"$PROVIDER_TOKEN\",
+              \"providerRunId\":\"$GITHUB_RUN_ID\",
+              \"providerRunUrl\":\"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\",
+              \"status\":\"running\",
+              \"simulatorName\":\"GitHub Actions macOS runner\"
+            }" \
+            "$SIMDECK_CLOUD_URL/api/actions/providers/register"
+
+      - name: Build or download SimDeck
+        shell: bash
+        env:
+          SIMDECK_ARTIFACT_URL: ${{ inputs.simdeck_artifact_url }}
+        run: |
+          set -euo pipefail
+          if [[ -n "${SIMDECK_ARTIFACT_URL:-}" ]]; then
+            mkdir -p build
+            curl -fsSL "$SIMDECK_ARTIFACT_URL" | tar -xz -C build
+            chmod +x build/simdeck
+          elif [[ -x ./scripts/build-client.sh && -x ./scripts/build-cli.sh ]]; then
+            ./scripts/build-client.sh
+            ./scripts/build-cli.sh
+          else
+            git clone --depth 1 https://github.com/NativeScript/SimDeck.git simdeck-src
+            ./simdeck-src/scripts/build-client.sh
+            ./simdeck-src/scripts/build-cli.sh
+            mkdir -p build
+            cp simdeck-src/build/simdeck build/simdeck
+            chmod +x build/simdeck
+          fi
+
+      - name: Start simulator provider
+        shell: bash
+        env:
+          SIMDECK_CLOUD_URL: ${{ inputs.simdeck_cloud_url }}
+          PREVIEW_ID: ${{ inputs.preview_id }}
+          PROVIDER_TOKEN: ${{ inputs.provider_token }}
+          BUNDLE_ID: ${{ inputs.bundle_id }}
+          SIMDECK_ALLOWED_ORIGINS: ${{ inputs.simdeck_cloud_url }}
+        run: |
+          set -euo pipefail
+
+          ios_udid="$(xcrun simctl list devices available --json | python3 -c '
+          import json, sys
+          data = json.load(sys.stdin)
+          for runtime, devices in data.get("devices", {}).items():
+              if "iOS" not in runtime:
+                  continue
+              for device in devices:
+                  if device.get("isAvailable"):
+                      print(device["udid"])
+                      raise SystemExit(0)
+          raise SystemExit("No available iOS simulator")
+          ')"
+
+          xcrun simctl boot "$ios_udid" || true
+          xcrun simctl bootstatus "$ios_udid" -b
+
+          app_path=""
+          if [[ -d simdeck-artifact ]]; then
+            app_path="$(find simdeck-artifact -maxdepth 6 -type d -name '*.app' | head -n 1 || true)"
+          fi
+          if [[ -n "$app_path" ]]; then
+            xcrun simctl install "$ios_udid" "$app_path"
+          fi
+          if [[ -n "${BUNDLE_ID:-}" ]]; then
+            xcrun simctl launch "$ios_udid" "$BUNDLE_ID" || true
+          fi
+
+          ./build/simdeck serve \
+            --port 4310 \
+            --bind 127.0.0.1 \
+            --access-token "$PROVIDER_TOKEN" \
+            --video-codec h264-software \
+            > simdeck.log 2>&1 &
+          simdeck_pid="$!"
+
+          for _ in {1..120}; do
+            if curl -fsS http://127.0.0.1:4310/api/health >/dev/null; then
+              break
+            fi
+            sleep 1
+          done
+
+          cloudflared tunnel --url http://127.0.0.1:4310 \
+            > cloudflared.log 2>&1 &
+          cloudflared_pid="$!"
+
+          tunnel_url=""
+          for _ in {1..120}; do
+            tunnel_url="$(grep -Eo 'https://[-a-zA-Z0-9.]+\.trycloudflare\.com' cloudflared.log | head -n 1 || true)"
+            if [[ -n "$tunnel_url" ]]; then
+              break
+            fi
+            sleep 1
+          done
+
+          if [[ -z "$tunnel_url" ]]; then
+            echo "cloudflared did not print a trycloudflare.com URL"
+            cat cloudflared.log || true
+            exit 1
+          fi
+
+          register() {
+            curl -fsS \
+              -H 'content-type: application/json' \
+              -d "{
+                \"previewId\":\"$PREVIEW_ID\",
+                \"providerToken\":\"$PROVIDER_TOKEN\",
+                \"providerRunId\":\"$GITHUB_RUN_ID\",
+                \"providerRunUrl\":\"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\",
+                \"baseUrl\":\"$tunnel_url/?simdeckToken=$PROVIDER_TOKEN&transport=webrtc&device=$ios_udid\",
+                \"simulatorUdid\":\"$ios_udid\",
+                \"simulatorName\":\"GitHub Actions macOS runner\",
+                \"runtimeName\":\"$(xcrun simctl getenv "$ios_udid" SIMULATOR_RUNTIME_VERSION 2>/dev/null || true)\",
+                \"status\":\"ready\",
+                \"simulatorCount\":1
+              }" \
+              "$SIMDECK_CLOUD_URL/api/actions/providers/register"
+          }
+
+          register
+          echo "SimDeck tunnel: $tunnel_url"
+          while true; do
+            sleep 30
+            if ! kill -0 "$simdeck_pid" 2>/dev/null; then
+              echo "simdeck exited"
+              cat simdeck.log || true
+              exit 1
+            fi
+            if ! kill -0 "$cloudflared_pid" 2>/dev/null; then
+              echo "cloudflared exited"
+              cat cloudflared.log || true
+              exit 1
+            fi
+            register
+          done

.gitignore

@@ -11,6 +11,7 @@ packages/nativescript-inspector/dist/
 packages/react-native-inspector/dist/
 docs/.vitepress/dist/
 docs/.vitepress/cache/
+cloud/
 .playwright-mcp/
 simdeck-snapshot.md
 

AGENTS.md

@@ -20,6 +20,8 @@ The native side should own anything that depends on macOS frameworks, `xcrun sim
   Defines REST routes for simulator control, health, metrics, and chrome assets.
 - `server/src/transport/webtransport.rs`
   Exposes one WebTransport session path per simulator and streams binary video packets.
+- `server/src/transport/webrtc.rs`
+  Exposes an experimental H.264 WebRTC offer/answer endpoint for browser-to-runner preview tunnels.
 - `server/src/simulators/registry.rs`
   Tracks Rust-side simulator session state and lazy native attachment by UDID.
 - `cli/XCWSimctl.*`
@@ -140,7 +142,7 @@ Useful direct commands:
 - If you change a CLI flag, REST route, packet format, or inspector method, update the matching page under `docs/` in the same pass.
 - If you expand the private framework bridge, document the Xcode/runtime assumptions here.
 - If a feature depends on a booted simulator, fail with a clear JSON error instead of silently returning an empty asset.
-- Do not reintroduce legacy `/stream.h264` handling. The supported live path is Rust-managed WebTransport.
+- Do not reintroduce legacy `/stream.h264` handling. The supported live paths are Rust-managed WebTransport and the experimental WebRTC offer endpoint.
 
 ## Near-Term Roadmap
 

README.md

@@ -9,7 +9,7 @@ npm i -g simdeck@latest
 
 ## Features
 
-- WebTransport based streaming server in Rust, hardware encoded HVEC/H264 video stream
+- WebTransport streaming server in Rust, plus experimental WebRTC for runner previews, using hardware encoded HEVC/H.264 video
 - Simulator control & inspection using private accessibility APIs
 - CoreSimulator chrome asset rendering for device bezels
 - NativeScript and React Native runtime inspector plugins, plus a native UIKit inspector framework for other apps
@@ -55,6 +55,10 @@ simdeck ui --open
 
 This starts or reuses the project daemon, enables the browser UI, and opens the authenticated local URL.
 To focus a specific simulator, add `?device=UDID` to the opened URL.
+SimDeck Cloud uses the same server binary as its GitHub Actions provider. The
+provider workflow starts `simdeck serve` on the runner, exposes it through a
+tunnel, and lets the hosted control plane connect to the simulator with a
+one-time access token.
 
 The daemon exposes HTTP on the requested port and WebTransport on `port + 1`.
 The browser bootstrap comes from `GET /api/health`, which returns the WebTransport URL template,

client/src/api/client.ts

@@ -1,12 +1,29 @@
 import { API_ROOT } from "../shared/constants";
 
+export function accessTokenFromLocation(): string {
+  if (typeof window === "undefined") {
+    return "";
+  }
+  return new URLSearchParams(window.location.search).get("simdeckToken") ?? "";
+}
+
+export function apiHeaders(headers: HeadersInit = {}): HeadersInit {
+  const token = accessTokenFromLocation();
+  return {
+    "Content-Type": "application/json",
+    ...(token ? { "X-SimDeck-Token": token } : {}),
+    ...headers,
+  };
+}
+
 export async function apiRequest<T>(
   path: string,
   options: RequestInit = {},
 ): Promise<T> {
+  const { headers, ...rest } = options;
   const response = await fetch(`${API_ROOT}${path}`, {
-    headers: { "Content-Type": "application/json" },
-    ...options,
+    ...rest,
+    headers: apiHeaders(headers),
   });
 
   const contentType = response.headers.get("content-type") ?? "";