@anuraghq/mobius 0.1.0 → 0.1.2

package/dist/policy/policy.d.ts

@@ -49,6 +49,10 @@ export interface PolicyContext {
     targetApp?: string;
     /** Tap given as x,y rather than an element id. */
     coordinate?: boolean;
+    /** Back / home / recents: always allowed, even inside a blocked app, so the agent can leave. */
+    nav?: boolean;
+    /** A sideways scroll: the same finger motion as a "slide to pay" swipe. */
+    horizontal?: boolean;
     /** Everything on the current screen, for context rules (checkout screens raise risk). */
     screen?: Element[];
     /** Every element under the tap point (an overlay may sit on top of the real button). */

package/dist/policy/policy.js

@@ -128,9 +128,13 @@ export class Policy {
         const amount = decl?.amount ?? amountInvolved(t, ctx.screen);
         let v = { ...base, action_class: cls, rule_id: base.rule_id, amount };
         if (base.decision !== 'blocked' && ctx.mutating) {
+            // A ceiling rule ("allow payments up to ₹200") is checked against the largest amount on screen too: a label
+            // saying "Pay ₹1" must not unlock a ₹50,000 checkout.
+            const shown = (ctx.screen ?? []).flatMap(e => [...`${e.text ?? ''} ${e.label ?? ''}`.matchAll(/(?:₹|rs\.?|inr|\$|€|£)\s?([\d,]+(?:\.\d+)?)/gi)].map(m => Number(m[1].replace(/,/g, ''))));
+            const ceiling = amount === null ? null : Math.max(amount, ...shown);
             const r = this.config.rules.find(r => (!r.app || appRe([r.app]).test(ctx.app ?? '')) && (!r.tool || r.tool.includes(ctx.tool))
                 && (!r.action_class || r.action_class.includes(cls)) && (!r.target || new RegExp(r.target, 'i').test(words))
-                && (r.max_amount === undefined || (amount !== null && amount <= r.max_amount)));
+                && (r.max_amount === undefined || (ceiling !== null && ceiling <= r.max_amount)));
             if (r)
                 v = { ...v, decision: r.effect, reason: `rule ${r.id}${r.description ? `: ${r.description}` : ''} (was: ${base.reason})`, rule_id: r.id };
         }
@@ -142,6 +146,8 @@ export class Policy {
         const out = (decision, reason, action_class = 'unknown', rule_id = `builtin.${decision}`) => ({ decision, reason, action_class, rule_id });
         if (this.appBlocked(ctx.targetApp ?? null))
             return out('blocked', `${ctx.targetApp} is in a blocked app category (finance/credentials)`);
+        if (ctx.nav)
+            return out('allow', 'navigation key');
         if (this.appBlocked(ctx.app))
             return out('blocked', `${ctx.app} is in a blocked app category (finance/credentials)`);
         if (!ctx.mutating)
@@ -157,7 +163,8 @@ export class Policy {
         if (ctx.secretField)
             return out(this.config.secret_entry, 'typing into a password/PIN/OTP field', 'secret');
         const t = ctx.target;
-        const wordsOf = (e) => readable(`${e.text ?? ''} ${e.label ?? ''} ${e.resource_id ?? ''}`).replace(/[_.]/g, ' ');
+        // camelCase ids split into words: btnPayNow, placeOrderButton.
+        const wordsOf = (e) => readable(`${e.text ?? ''} ${e.label ?? ''} ${e.resource_id ?? ''}`).replace(/([a-z])([A-Z])/g, '$1 $2').replace(/[_.]/g, ' ');
         const words = t ? wordsOf(t) : '';
         const gesture = ctx.tool === 'tap' || ctx.tool === 'swipe' || ctx.tool === 'scroll';
         // Layer 0: the app itself declared this control sensitive. Trust the app over any label.
@@ -195,6 +202,7 @@ export class Policy {
             device_setting_write: ['changing a system setting', 'account'],
             set_permission: ['changing an app permission', 'permission'],
             start_screen_recording: ['recording the screen (video cannot be masked)', 'secret'],
+            record_flow_start: ["recording the user's own taps (it can capture a PIN or unlock pattern)", 'secret'],
             reboot_device: ['rebooting the device', 'unknown'],
         };
         const power = POWER[ctx.tool];
@@ -213,7 +221,7 @@ export class Policy {
         }
         // Layer 4: a swipe on a screen that offers "slide to …" commits. Sliders that only navigate ("Slide to switch" gender
         // toggle on Slikk, live run) don't count; any other verb, or none we can read, still asks (fail closed).
-        if (ctx.tool === 'swipe' && ctx.screen?.some(e => { const m = /\b(?:slide|swipe) to\b\s*(\p{L}*)/iu.exec(wordsOf(e)); return !!m && !NAV_SLIDER.test(m[1]); })) {
+        if ((ctx.tool === 'swipe' || (ctx.tool === 'scroll' && ctx.horizontal)) && ctx.screen?.some(e => { const m = /\b(?:slide|swipe) to\b\s*(\p{L}*)/iu.exec(wordsOf(e)); return !!m && !NAV_SLIDER.test(m[1]); })) {
             return out('approval_required', 'swipe on a screen with a "slide to …" control (swipe-to-pay/book)', 'payment');
         }
         if (ctx.submit)

package/ios-agent/setup.sh

@@ -15,12 +15,18 @@ cd "$DIR"
 # Mobius fast touch (tap/swipe without WebDriverAgent's app lookup and settle wait). BSD-3 allows shipping a modified build.
 PATCH="$HERE/wda-mobius-fast-touch.patch"
 git apply --check "$PATCH" 2>/dev/null && git apply "$PATCH" && echo "applied Mobius fast-touch patch"
-xcodebuild build-for-testing -project WebDriverAgent.xcodeproj -scheme WebDriverAgentRunner \
+# Run xcodebuild into a log and stop on failure: piping it through grep would hide a failed build, and a stale
+# .xctestrun from an earlier build would then pass the final check.
+build() { # build <log name> <xcodebuild args...>
+  log="$DIR/$1.log"; shift
+  if xcodebuild "$@" >"$log" 2>&1; then grep -E "\*\* " "$log" || true; else grep -E "error:|\*\* " "$log"; echo "xcodebuild failed (full log: $log)" >&2; exit 1; fi
+}
+build build-device build-for-testing -project WebDriverAgent.xcodeproj -scheme WebDriverAgentRunner \
   -destination 'generic/platform=iOS' DEVELOPMENT_TEAM="$TEAM" CODE_SIGN_STYLE=Automatic \
   PRODUCT_BUNDLE_IDENTIFIER="${MOBIUS_WDA_BUNDLE:-dev.mobius.wda}" \
-  -allowProvisioningUpdates -allowProvisioningDeviceRegistration -derivedDataPath "$DIR/build" | grep -E "error:|\*\* " || true
+  -allowProvisioningUpdates -allowProvisioningDeviceRegistration -derivedDataPath "$DIR/build"
 "$HERE/brand.sh"
 # Simulators: an unsigned simulator build (no team needed).
-xcodebuild build-for-testing -project WebDriverAgent.xcodeproj -scheme WebDriverAgentRunner \
-  -destination 'generic/platform=iOS Simulator' -derivedDataPath "$DIR/build-sim" CODE_SIGNING_ALLOWED=NO | grep -E "error:|\*\* " || true
+build build-sim build-for-testing -project WebDriverAgent.xcodeproj -scheme WebDriverAgentRunner \
+  -destination 'generic/platform=iOS Simulator' -derivedDataPath "$DIR/build-sim" CODE_SIGNING_ALLOWED=NO
 ls "$DIR"/build/Build/Products/*.xctestrun >/dev/null && echo "WebDriverAgent ready in $DIR"

package/package.json

@@ -1,18 +1,47 @@
 {
   "name": "@anuraghq/mobius",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Let AI agents use a real phone, safely. MCP server + its own fast device driver for Android, iPhones and iOS simulators: 75 tools, approvals, policy, masking, signed audit, performance and accessibility reports.",
   "license": "Apache-2.0",
   "type": "module",
-  "bin": { "mobius": "dist/cli.js" },
-  "files": ["dist", "bin", "ios-agent", "README.md", "LICENSE"],
-  "engines": { "node": ">=22.5" },
-  "keywords": ["mcp", "model-context-protocol", "android", "ios", "iphone", "simulator", "emulator", "mobile", "ai-agent", "agent-safety", "claude", "automation", "testing", "qa", "performance", "accessibility"],
+  "bin": {
+    "mobius": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "bin",
+    "ios-agent",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22.5"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "android",
+    "ios",
+    "iphone",
+    "simulator",
+    "emulator",
+    "mobile",
+    "ai-agent",
+    "agent-safety",
+    "claude",
+    "automation",
+    "testing",
+    "qa",
+    "performance",
+    "accessibility"
+  ],
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json",
     "prepack": "npm run build && node scripts/prepack.mjs"
   },
-  "publishConfig": { "access": "public" },
+  "publishConfig": {
+    "access": "public"
+  },
   "repository": "github:Anu-Code07/mobius",
   "homepage": "https://github.com/Anu-Code07/mobius#readme",
   "dependencies": {