@akanjs/devkit 3.0.0-alpha.1 → 3.0.0-alpha.100

package/biome.base.json

@@ -0,0 +1,340 @@
+{
+  "$schema": "https://biomejs.dev/schemas/2.5.12/schema.json",
+  "vcs": {
+    "enabled": true,
+    "clientKind": "git",
+    "useIgnoreFile": false
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 120
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "preset": "recommended",
+      "suspicious": {
+        "noConsole": {
+          "level": "error",
+          "options": {
+            "allow": ["assert", "error", "info", "warn"]
+          }
+        },
+        "noArrayIndexKey": "off",
+        "noShadowRestrictedNames": "off",
+        "noUnnecessaryConditions": {
+          "level": "warn"
+        }
+      },
+      "correctness": {
+        "noUnusedFunctionParameters": "off",
+        "noUnusedImports": {
+          "level": "error",
+          "fix": "safe"
+        },
+        "useParseIntRadix": "off",
+        "useExhaustiveDependencies": "off",
+        "useHookAtTopLevel": "off"
+      },
+      "nursery": {
+        "useSortedClasses": {
+          "level": "error",
+          "fix": "safe",
+          "options": {
+            "attributes": ["classList"],
+            "functions": ["cn"]
+          }
+        }
+      },
+      "a11y": "off",
+      "complexity": {
+        "noStaticOnlyClass": "off"
+      },
+      "style": {
+        "useTemplate": {
+          "level": "warn",
+          "fix": "safe"
+        }
+      }
+    },
+    "domains": {
+      "project": "recommended",
+      "react": "recommended",
+      "test": "recommended",
+      "types": "all"
+    }
+  },
+  "javascript": {
+    "parser": {
+      "unsafeParameterDecoratorsEnabled": true
+    },
+    "formatter": {
+      "quoteStyle": "double"
+    }
+  },
+  "assist": {
+    "enabled": true,
+    "actions": {
+      "source": {
+        "organizeImports": "on"
+      }
+    }
+  },
+  "overrides": [
+    {
+      "includes": [
+        "**/env.client.local.ts",
+        "**/env.client.debug.ts",
+        "**/env.client.develop.ts",
+        "**/env.client.main.ts",
+        "**/env.client.testing.ts",
+        "**/env.server.local.ts",
+        "**/env.server.develop.ts",
+        "**/env.server.main.ts",
+        "**/env.server.testing.ts",
+        "**/env.server.type.ts",
+        "apps/*/lib/cnst.ts",
+        "apps/*/lib/dict.ts",
+        "apps/*/lib/db.ts",
+        "apps/*/lib/srv.ts",
+        "apps/*/lib/st.ts",
+        "apps/*/lib/sig.ts",
+        "apps/*/lib/useClient.ts",
+        "apps/*/lib/useServer.ts",
+        "apps/*/client.ts",
+        "apps/*/server.ts",
+        "apps/*/lib/*/index.tsx",
+        "libs/*/lib/cnst.ts",
+        "libs/*/lib/dict.ts",
+        "libs/*/lib/db.ts",
+        "libs/*/lib/srv.ts",
+        "libs/*/lib/st.ts",
+        "libs/*/lib/sig.ts",
+        "libs/*/lib/useClient.ts",
+        "libs/*/lib/useServer.ts",
+        "libs/*/client.ts",
+        "libs/*/server.ts",
+        "libs/*/index.ts",
+        "libs/*/lib/*/index.tsx",
+        "apps/*/lib/__lib/**",
+        "libs/*/lib/__lib/**"
+      ],
+      "linter": { "enabled": false },
+      "formatter": { "enabled": false },
+      "assist": { "enabled": false }
+    },
+    {
+      "includes": [
+        "apps/**/*.ts",
+        "apps/**/*.tsx",
+        "libs/**/*.ts",
+        "libs/**/*.tsx",
+        "!**/*.test.ts",
+        "!**/*.test.tsx",
+        "!**/*.spec.ts",
+        "!**/*.spec.tsx",
+        "!**/*.constant.ts",
+        "!**/common/**",
+        "!**/env/**"
+      ],
+      "plugins": ["./node_modules/@akanjs/devkit/lint/no-throw-raw-error.grit"]
+    },
+    {
+      "includes": [
+        "{apps,libs}/**/page/**/*.ts",
+        "{apps,libs}/**/page/**/*.tsx",
+        "{apps,libs}/**/*.Unit.tsx",
+        "{apps,libs}/**/*.View.tsx"
+      ],
+      "plugins": [
+        "./node_modules/@akanjs/devkit/lint/no-import-client-functions.grit",
+        "./node_modules/@akanjs/devkit/lint/no-use-client-in-server.grit"
+      ]
+    },
+    {
+      "includes": ["{apps,libs}/**/page/**/*.ts", "{apps,libs}/**/page/**/*.tsx"],
+      "plugins": ["./node_modules/@akanjs/devkit/lint/non-scalar-props-restricted.grit"]
+    },
+    {
+      "includes": [
+        "{apps,libs}/**/*.constant.ts",
+        "{apps,libs}/**/*.document.ts",
+        "{apps,libs}/**/*.service.ts",
+        "{apps,libs}/**/*.store.ts"
+      ],
+      "plugins": ["./node_modules/@akanjs/devkit/lint/no-js-private-class-method.grit"]
+    },
+    {
+      "includes": ["{apps,libs}/**/*.store.ts"],
+      "plugins": ["./node_modules/@akanjs/devkit/lint/no-return-in-store-action.grit"]
+    },
+    {
+      "includes": ["{apps,libs}/**/*.ts", "{apps,libs}/**/*.tsx"],
+      "plugins": ["./node_modules/@akanjs/devkit/lint/no-deprecated-log-level.grit"]
+    },
+    {
+      "includes": ["{apps,libs}/**/*.signal.ts"],
+      "plugins": ["./node_modules/@akanjs/devkit/lint/no-redeclare-predefined-endpoint.grit"]
+    },
+    {
+      "includes": ["{apps,libs}/**/*.Util.tsx", "{apps,libs}/**/*.Zone.tsx"],
+      "plugins": ["./node_modules/@akanjs/devkit/lint/no-model-type-in-util-zone.grit"]
+    },
+    {
+      "includes": ["{apps,libs}/**/ui/**/*.tsx", "!**/*.test.tsx", "!**/*.spec.tsx"],
+      "plugins": ["./node_modules/@akanjs/devkit/lint/no-async-component-in-ui.grit"]
+    },
+    {
+      "includes": ["{apps,libs}/**/*.tsx", "!**/*.test.tsx", "!**/*.spec.tsx"],
+      "plugins": ["./node_modules/@akanjs/devkit/lint/no-unpublished-form-setter.grit"]
+    },
+    {
+      "includes": [
+        "{apps,libs}/**/*.ts",
+        "{apps,libs}/**/*.tsx",
+        "!**/*.test.ts",
+        "!**/*.test.tsx",
+        "!**/*.spec.ts",
+        "!**/*.spec.tsx"
+      ],
+      "plugins": ["./node_modules/@akanjs/devkit/lint/no-init-fetch-in-client.grit"]
+    },
+    {
+      "includes": [
+        "**/ui/**/*.ts",
+        "**/ui/**/*.tsx",
+        "**/webkit/**/*.ts",
+        "**/webkit/**/*.tsx",
+        "**/common/**/*.ts",
+        "**/page/**/*.tsx",
+        "**/*.constant.ts",
+        "**/*.store.ts",
+        "**/*.Template.tsx",
+        "**/*.Unit.tsx",
+        "**/*.Util.tsx",
+        "**/*.View.tsx",
+        "**/*.Zone.tsx",
+        "!**/*.test.ts",
+        "!**/*.test.tsx",
+        "!**/*.spec.ts",
+        "!**/*.spec.tsx"
+      ],
+      "plugins": ["./node_modules/@akanjs/devkit/lint/no-bang-comment-in-client.grit"]
+    },
+    {
+      "includes": [
+        "{apps,libs}/**/*.constant.ts",
+        "{apps,libs}/**/*.dictionary.ts",
+        "{apps,libs}/**/*.document.ts",
+        "{apps,libs}/**/*.service.ts",
+        "{apps,libs}/**/*.signal.ts",
+        "{apps,libs}/**/*.store.ts",
+        "{apps,libs}/**/*.Template.tsx",
+        "{apps,libs}/**/*.Unit.tsx",
+        "{apps,libs}/**/*.Util.tsx",
+        "{apps,libs}/**/*.View.tsx",
+        "{apps,libs}/**/*.Zone.tsx"
+      ],
+      "plugins": ["./node_modules/@akanjs/devkit/lint/no-deep-internal-import.grit"]
+    },
+    {
+      "includes": [
+        "{apps,libs}/**/page/**/*.ts",
+        "{apps,libs}/**/page/**/*.tsx",
+        "{apps,libs}/**/index.ts",
+        "{apps,libs}/**/index.tsx",
+        "{apps,libs}/**/cnst.ts",
+        "{apps,libs}/**/db.ts",
+        "{apps,libs}/**/dict.ts",
+        "{apps,libs}/**/option.ts",
+        "{apps,libs}/**/sig.ts",
+        "{apps,libs}/**/srv.ts",
+        "{apps,libs}/**/st.ts",
+        "{apps,libs}/**/*.constant.ts",
+        "{apps,libs}/**/*.dictionary.ts",
+        "{apps,libs}/**/*.document.ts",
+        "{apps,libs}/**/*.service.ts",
+        "{apps,libs}/**/*.signal.ts",
+        "{apps,libs}/**/*.signal.test.ts",
+        "{apps,libs}/**/*.service.test.ts",
+        "{apps,libs}/**/*.store.ts",
+        "{apps,libs}/**/*.Template.tsx",
+        "{apps,libs}/**/*.Unit.tsx",
+        "{apps,libs}/**/*.Util.tsx",
+        "{apps,libs}/**/*.View.tsx",
+        "{apps,libs}/**/*.Zone.tsx"
+      ],
+      "plugins": [
+        "./node_modules/@akanjs/devkit/lint/no-import-external-library.grit",
+        "./node_modules/@akanjs/devkit/lint/no-deep-internal-import.grit"
+      ]
+    },
+    {
+      "includes": [
+        "apps/**/*.tsx",
+        "libs/**/*.tsx",
+        "apps/**/ui/**/*.ts",
+        "libs/**/ui/**/*.ts",
+        "apps/**/webkit/**/*.ts",
+        "libs/**/webkit/**/*.ts",
+        "apps/**/page/**/*.ts",
+        "libs/**/page/**/*.ts",
+        "apps/**/common/**/*.ts",
+        "libs/**/common/**/*.ts",
+        "apps/**/*.store.ts",
+        "libs/**/*.store.ts",
+        "apps/**/*.constant.ts",
+        "libs/**/*.constant.ts",
+        "!**/*.test.ts",
+        "!**/*.test.tsx",
+        "!**/*.spec.ts",
+        "!**/*.spec.tsx"
+      ],
+      "plugins": ["./node_modules/@akanjs/devkit/lint/no-import-server-in-client.grit"]
+    },
+    {
+      "includes": [
+        "apps/**/*.document.ts",
+        "libs/**/*.document.ts",
+        "apps/**/*.dictionary.ts",
+        "libs/**/*.dictionary.ts",
+        "apps/**/*.service.ts",
+        "libs/**/*.service.ts",
+        "apps/**/*.signal.ts",
+        "libs/**/*.signal.ts",
+        "apps/**/srvkit/**/*.ts",
+        "libs/**/srvkit/**/*.ts",
+        "apps/**/common/**/*.ts",
+        "libs/**/common/**/*.ts",
+        "apps/**/*.constant.ts",
+        "libs/**/*.constant.ts",
+        "!**/*.test.ts",
+        "!**/*.test.tsx",
+        "!**/*.spec.ts",
+        "!**/*.spec.tsx"
+      ],
+      "plugins": ["./node_modules/@akanjs/devkit/lint/no-import-client-in-server.grit"]
+    },
+    {
+      "includes": [
+        "apps/**/*.ts",
+        "apps/**/*.tsx",
+        "libs/**/*.ts",
+        "libs/**/*.tsx",
+        "!**/*.test.ts",
+        "!**/*.test.tsx",
+        "!**/*.spec.ts",
+        "!**/*.spec.tsx"
+      ],
+      "plugins": [
+        "./node_modules/@akanjs/devkit/lint/no-raw-palette-class.grit",
+        "./node_modules/@akanjs/devkit/lint/no-arbitrary-color.grit",
+        "./node_modules/@akanjs/devkit/lint/no-daisyui-legacy-class.grit",
+        "./node_modules/@akanjs/devkit/lint/no-inline-color.grit",
+        "./node_modules/@akanjs/devkit/lint/no-interpolated-arbitrary-class.grit"
+      ]
+    }
+  ]
+}

package/biomeBase.ts

@@ -0,0 +1,9 @@
+/** `extends` target for a workspace `biome.json`; Biome resolves it through node_modules. */
+export const biomeBaseConfig = "@akanjs/devkit/biome.base.json";
+
+// Biome moves rules between groups across minors — `noUnnecessaryConditions` sat in `nursery` at 2.4 and moved to
+// `suspicious` at 2.5 — and the stale position is a hard "unknown key" error, not a warning. A workspace whose
+// Biome disagrees with the shipped base config therefore fails to load it at all, which is why the version is
+// pinned here instead of resolved to latest at create time. Bump this and `biome.base.json` in one commit, and run
+// `biome migrate --write` in the workspace root and in `pkgs/@akanjs/devkit` so both configs move together.
+export const biomeVersion = "2.5.12";

package/capacitorApp.test.ts

@@ -11,6 +11,7 @@ import {
   clearRootCapacitorConfigs,
   formatAndroidReleaseSigningError,
   getAdbDeviceStateIssues,
+  getAndroidLocalServerHost,
   getMissingAndroidReleaseSigningKeys,
   isPlaceholderAppId,
   materializeCapacitorConfig,
@@ -339,6 +340,13 @@ describe("Android signing diagnostics", () => {
       "Android device abc123 is unauthorized. Confirm USB debugging authorization on the device.",
       "Android device xyz is offline. Reconnect the device or restart adb.",
     ]);
+    expect(getAndroidLocalServerHost("List of devices attached\nemulator-5554 device\n", "192.168.0.5")).toBe(
+      "10.0.2.2",
+    );
+    expect(getAndroidLocalServerHost("List of devices attached\nabc123 device\n", "192.168.0.5")).toBe("192.168.0.5");
+    expect(
+      getAndroidLocalServerHost("List of devices attached\nemulator-5554 device\nabc123 device\n", "192.168.0.5"),
+    ).toBe("192.168.0.5");
   });
 });
 

package/capacitorApp.ts

@@ -24,7 +24,9 @@ interface RunIosConfig extends RunConfig {
   iosDeviceId?: string;
 }
 
-interface PrepareConfig extends RunConfig {}
+interface PrepareConfig extends RunConfig {
+  iosRunTargetKind?: IosRunTargetKind;
+}
 
 type MobileCommandEnv = Record<string, string | undefined>;
 
@@ -119,10 +121,21 @@ interface MaterializeCapacitorConfigOptions {
   localServerUrl?: string;
   localIp?: string;
 }
+type MobilePlatform = "ios" | "android";
+
+/**
+ * `AppExecutor.spawn`'s own options plus the two the Capacitor config is written from before the spawn:
+ * the platform the command targets, and — for iOS — whether it targets a device or a simulator, which
+ * decide the `capacitor.config.json` that command reads.
+ */
+type SpawnMobileOptions = Parameters<AppExecutor["spawn"]>[2] & {
+  platform?: MobilePlatform;
+  iosRunTargetKind?: IosRunTargetKind;
+};
 
 export interface LocalDevHostResolution {
   host: string;
-  source: "override" | "detected" | "loopback";
+  source: "override" | "detected" | "loopback" | "platform";
   candidates: { name: string; address: string }[];
 }
 
@@ -565,6 +578,16 @@ export function getAdbDeviceStateIssues(output: string) {
     });
 }
 
+export function getAndroidLocalServerHost(adbDevicesOutput: string | undefined, fallbackHost: string) {
+  const onlineDeviceIds =
+    adbDevicesOutput
+      ?.split(/\r?\n/)
+      .map((line) => line.trim().split(/\s+/))
+      .filter(([id, state]) => id && state === "device")
+      .map(([id]) => id) ?? [];
+  return onlineDeviceIds.length === 1 && onlineDeviceIds[0]?.startsWith("emulator-") ? "10.0.2.2" : fallbackHost;
+}
+
 export const ANDROID_MIN_SDK_VERSION = 26;
 export function raiseGradleMinSdkVersion(content: string, floor: number = ANDROID_MIN_SDK_VERSION): string | null {
   const match = content.match(/minSdkVersion\s*=\s*(\d+)/);
@@ -748,7 +771,7 @@ export class CapacitorApp {
   async save() {
     await this.project.commit();
   }
-  async #prepareIos({ operation, env, regenerate = false }: PrepareConfig) {
+  async #prepareIos({ operation, env, regenerate = false, iosRunTargetKind }: PrepareConfig) {
     await this.init({ platform: "ios", operation, env, regenerate });
     await this.#prepareTargetAssets();
     await this.#prepareExternalFiles("ios");
@@ -757,9 +780,10 @@ export class CapacitorApp {
     await this.#applyDeepLinks("ios", { operation, env });
     await this.#flushIosEntitlements();
     await this.project.commit();
+    await this.#setCodeSignEntitlementsInIosIfExists("App/App.entitlements");
     await this.#generateAssets({ operation, env });
     this.app.verbose(`syncing iOS`);
-    await this.#spawnMobile("npx", ["cap", "sync", "ios"], { operation, env });
+    await this.#spawnMobile("npx", ["cap", "sync", "ios"], { operation, env }, { iosRunTargetKind });
     this.app.verbose(`sync completed.`);
   }
   async buildIos({ env = "debug", regenerate = false }: { env?: RunConfig["env"]; regenerate?: boolean } = {}) {
@@ -777,14 +801,14 @@ export class CapacitorApp {
   }
   async runIos({ operation, env, regenerate = false, noAllowProvisioningUpdates = false, iosDeviceId }: RunIosConfig) {
     if (operation === "release") await this.prepareWww();
-    await this.#prepareIos({ operation, env, regenerate });
     const runTarget = await this.#selectIosRunTarget(iosDeviceId);
+    await this.#prepareIos({ operation, env, regenerate, iosRunTargetKind: runTarget.kind });
     if (runTarget.kind === "simulator") {
       await this.#spawnMobile(
         "npx",
-        ["cap", "run", "ios", "--target", runTarget.id],
+        ["cap", "run", "ios", "--target", runTarget.id, "--no-sync"],
         { operation, env },
-        { stdio: "inherit" },
+        { stdio: "inherit", platform: "ios", iosRunTargetKind: runTarget.kind },
       );
       return;
     }
@@ -878,7 +902,10 @@ export class CapacitorApp {
     noAllowProvisioningUpdates: boolean;
   }) {
     const mobileEnv = sanitizeIosNativeRunEnv(await this.#commandEnv(operation, env));
-    const configContent = await this.#writeCapacitorConfig({ operation }, mobileEnv);
+    const configContent = await this.#writeCapacitorConfig(
+      { operation, platform: "ios", iosRunTargetKind: runTarget.kind },
+      mobileEnv,
+    );
     await this.#writeRootCapacitorConfig(configContent);
     const scheme = this.#iosScheme();
     const command = buildIosNativeRunCommand({
@@ -943,6 +970,7 @@ export class CapacitorApp {
     await this.#applyAndroidMinSdkVersion();
     await this.#applyPermissions({ operation, env });
     await this.#applyDeepLinks("android", { operation, env });
+    await this.#disableNativeKeyboardResizeInAndroid();
     await this.project.commit();
     await this.#generateAssets({ operation, env });
     await this.#ensureAndroidAssetsDir();
@@ -1010,6 +1038,24 @@ export class CapacitorApp {
   async openAndroid() {
     await this.#spawnMobile("npx", ["cap", "open", "android"], { operation: "local", env: "local" });
   }
+  async #disableNativeKeyboardResizeInAndroid() {
+    const manifestPath = path.join(this.app.cwdPath, this.androidRootPath, "app/src/main/AndroidManifest.xml");
+    let manifest = await readFile(manifestPath, "utf8");
+    let changed = false;
+    manifest = manifest.replace(/<activity\b[^>]*android:name="\.MainActivity"[^>]*>/, (activityTag) => {
+      if (activityTag.includes("android:windowSoftInputMode=")) {
+        const nextTag = activityTag.replace(
+          /android:windowSoftInputMode="[^"]*"/,
+          'android:windowSoftInputMode="adjustNothing"',
+        );
+        changed ||= nextTag !== activityTag;
+        return nextTag;
+      }
+      changed = true;
+      return activityTag.replace(/>$/, '\n            android:windowSoftInputMode="adjustNothing">');
+    });
+    if (changed) await writeFile(manifestPath, manifest);
+  }
   async #ensureAndroidAssetsDir() {
     await mkdir(path.join(this.app.cwdPath, this.androidAssetsPath), { recursive: true });
   }
@@ -1100,12 +1146,19 @@ export class CapacitorApp {
     if (html.includes("window.__AKAN_MOBILE_TARGET__")) return html;
     return html.replace(/<\/head\s*>/i, `${script}\n</head>`);
   }
-  async #writeCapacitorConfig({ operation }: Pick<RunConfig, "operation">, commandEnv: MobileCommandEnv) {
+  async #writeCapacitorConfig(
+    {
+      operation,
+      platform,
+      iosRunTargetKind,
+    }: Pick<RunConfig, "operation"> & { platform?: MobilePlatform; iosRunTargetKind?: IosRunTargetKind },
+    commandEnv: MobileCommandEnv,
+  ) {
     await mkdir(this.targetRoot, { recursive: true });
     let localIp: string | undefined;
     if (operation === "local") {
       const override = commandEnv.AKAN_PUBLIC_CLIENT_HOST ?? process.env.AKAN_PUBLIC_CLIENT_HOST;
-      const resolution = selectLocalDevHost(os.networkInterfaces(), { override });
+      const resolution = await this.#resolveLocalDevHost({ override, platform, iosRunTargetKind });
       localIp = resolution.host;
       this.#logDevHostResolution(resolution, commandEnv);
     }
@@ -1118,11 +1171,36 @@ export class CapacitorApp {
     await Bun.write(path.join(this.targetRoot, "capacitor.config.json"), content);
     return content;
   }
+  // An explicit override always wins; an emulator/simulator run reaches the host machine through a
+  // loopback alias (10.0.2.2 / localhost), so LAN detection only applies to physical-device runs.
+  async #resolveLocalDevHost({
+    override,
+    platform,
+    iosRunTargetKind,
+  }: {
+    override?: string;
+    platform?: MobilePlatform;
+    iosRunTargetKind?: IosRunTargetKind;
+  }): Promise<LocalDevHostResolution> {
+    const resolution = selectLocalDevHost(os.networkInterfaces(), { override });
+    if (resolution.source === "override") return resolution;
+    if (platform === "ios" && iosRunTargetKind === "simulator")
+      return { ...resolution, host: "localhost", source: "platform" };
+    if (platform === "android") {
+      try {
+        const host = getAndroidLocalServerHost(await this.#spawn("adb", ["devices"]), resolution.host);
+        return host === resolution.host ? resolution : { ...resolution, host, source: "platform" };
+      } catch {
+        return resolution;
+      }
+    }
+    return resolution;
+  }
   // Surface the live-reload URL a physical device must reach, and warn when auto-detection landed on
   // a likely-unreachable host so a blank WebView is not mistaken for an app bug.
   #logDevHostResolution(resolution: LocalDevHostResolution, commandEnv: MobileCommandEnv) {
     this.app.log(`Mobile live-reload server: ${this.#localCsrUrl(resolution.host, commandEnv)}`);
-    if (resolution.source === "override") return;
+    if (resolution.source === "override" || resolution.source === "platform") return;
     const suspicious = resolution.host === "127.0.0.1" || resolution.host.startsWith("169.254.");
     const alternatives = resolution.candidates.filter((candidate) => candidate.address !== resolution.host);
     if (!suspicious && alternatives.length === 0) return;
@@ -1332,20 +1410,29 @@ export class CapacitorApp {
     command: string,
     args: string[] = [],
     { operation, env }: Pick<RunConfig, "operation" | "env">,
-    options: Parameters<AppExecutor["spawn"]>[2] = {},
+    options: SpawnMobileOptions = {},
   ) {
+    const { iosRunTargetKind, platform, ...spawnOptions } = options;
     const mobileEnv = { ...(await this.#commandEnv(operation, env)), ...options.env };
-    const configContent = await this.#writeCapacitorConfig({ operation }, mobileEnv);
+    const configContent = await this.#writeCapacitorConfig(
+      { operation, platform: platform ?? this.#inferMobilePlatform(args), iosRunTargetKind },
+      mobileEnv,
+    );
     await this.#writeRootCapacitorConfig(configContent);
     try {
       return await this.#spawn(command, args, {
-        ...options,
+        ...spawnOptions,
         env: mobileEnv,
       });
     } finally {
       await this.#clearRootCapacitorConfigs();
     }
   }
+  #inferMobilePlatform(args: string[]): MobilePlatform | undefined {
+    if (args.includes("android")) return "android";
+    if (args.includes("ios")) return "ios";
+    return undefined;
+  }
   async addCamera() {
     await this.#setPermissionInIos({
       cameraUsageDescription: "$(PRODUCT_NAME) requires access to the camera to take photos.",
@@ -1446,14 +1533,31 @@ export class CapacitorApp {
       let end = index;
       while (end < lines.length && !/^\s*\};\s*$/.test(lines[end] ?? "")) end++;
       const settings = lines.slice(start, end + 1);
-      if (settings.some((setting) => setting.includes("CODE_SIGN_ENTITLEMENTS"))) continue;
+      const configName = lines.slice(end + 1, end + 8).find((setting) => setting.includes("name = ")) ?? "";
       const indent = line.match(/^\s*/)?.[0] ?? "";
-      lines.splice(index, 0, `${indent}CODE_SIGN_ENTITLEMENTS = ${entitlementsRelPath};`);
-      index++;
-      changed = true;
+      const insertSettings = [];
+      if (!settings.some((setting) => setting.includes("CODE_SIGN_ENTITLEMENTS"))) {
+        insertSettings.push(`${indent}CODE_SIGN_ENTITLEMENTS = ${entitlementsRelPath};`);
+      }
+      if (
+        configName.includes("name = Debug;") &&
+        !settings.some((setting) => setting.includes("CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION"))
+      ) {
+        insertSettings.push(`${indent}CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION = YES;`);
+      }
+      if (insertSettings.length > 0) {
+        lines.splice(index, 0, ...insertSettings);
+        index += insertSettings.length;
+        changed = true;
+      }
     }
     if (changed) await writeFile(pbxprojPath, lines.join("\n"));
   }
+  async #setCodeSignEntitlementsInIosIfExists(entitlementsRelPath: string) {
+    const entitlementsPath = path.join(this.app.cwdPath, this.iosProjectPath, entitlementsRelPath);
+    if (!(await Bun.file(entitlementsPath).exists())) return;
+    await this.#setCodeSignEntitlementsInIos(entitlementsRelPath);
+  }
   async #setUrlSchemesInAndroid(schemes: string[]) {
     const manifestPath = path.join(this.app.cwdPath, this.androidRootPath, "app/src/main/AndroidManifest.xml");
     let manifest = await readFile(manifestPath, "utf8");

package/cloud/globalConfig.ts

@@ -1,4 +1,4 @@
-import { mkdir } from "node:fs/promises";
+import { chmod, mkdir } from "node:fs/promises";
 import dayjs from "dayjs";
 import { FileSys } from "../fileSys";
 import {
@@ -29,9 +29,16 @@ export class GlobalConfig {
       remoteEnvServers: akanConfig.remoteEnvServers ?? defaultAkanGlobalConfig.remoteEnvServers,
     };
   }
+  /**
+   * This file holds the cloud jwt, a refresh token that does not expire, and the LLM api key, so it is
+   * written owner-only — the same `0600` the runtime gives its control socket. `Bun.write` takes no mode
+   * and lands on `0666 & ~umask` (0644 on a default shell), so the mode is applied after the write; an
+   * existing world-readable file is tightened by the next write rather than left as it was found.
+   */
   static async #setAkanGlobalConfig(akanConfig: AkanGlobalConfig) {
-    await mkdir(basePath, { recursive: true });
+    await mkdir(basePath, { recursive: true, mode: 0o700 });
     await Bun.write(configPath, JSON.stringify(akanConfig, null, 2));
+    await chmod(configPath, 0o600);
   }
   static async getHostConfig(host = GlobalConfig.akanCloudHost): Promise<HostConfig> {
     const akanConfig = await GlobalConfig.#getAkanGlobalConfig();