appduct 0.9.0 → 0.10.0

package/README.md

@@ -22,7 +22,7 @@ appduct link --scheme myapp --qr
 
 `link` needs your app's deep-link scheme: pass `--scheme` (the app's `expo.scheme`, or its bare-RN equivalent), or set `"scheme"` once in `~/.appduct/config.json` and omit the flag. Without either, the command exits with a usage error.
 
-Scan the QR (or open the deep link) in a Appduct-enabled app, then:
+Scan the QR (or open the deep link) in an Appduct-enabled app, then:
 
 ```bash
 appduct tools

package/dist/artifact-inspect.d.ts

@@ -31,7 +31,7 @@
  *   future stub could ship them) without the real implementation being present, exactly the reason
  *   the Android signals below aren't all treated as equally authoritative either.
  * - Android: the primary signal is `AppductNativeMarker`
- *   (`packages/native/android/core/src/main/java/com/callstackincubator/appduct/AppductNativeMarker.kt`,
+ *   (`packages/native/android/core/src/main/java/com/callstack/appduct/AppductNativeMarker.kt`,
  *   vendored into `@appduct/react-native` at `android/core/src/main/java/...`), a marker class with no
  *   other purpose. Its fully-qualified name is kept unminified and unremoved by a `-keep` rule in
  *   `consumer-rules.pro` (same vendoring path), shipped to every consuming app via `consumerProguardFiles`
@@ -41,10 +41,12 @@
  *   minification in every supported consumer setup.
  *
  *   Two more signals are kept as fallbacks for artifacts built before this marker existed: the
- *   `com.callstackincubator.appduct` package string in the dex string pool (survives as long as
+ *   `com.callstack.appduct` package string in the dex string pool (and its pre-rename spelling,
+ *   `com.callstackincubator.appduct` — every Android marker below is matched against both, so an
+ *   app built against Appduct 0.9.0 or earlier is still detected) (survives as long as
  *   R8/ProGuard minification+obfuscation isn't applied to it — an aggressive release config with no keep
  *   rule for this package can rename it away) and the plugin-authored meta-data key names in
- *   `AndroidManifest.xml` (`com.callstackincubator.appduct.CLI_PINS`/`TRUST`/`ALLOW_PRIVATE_LAN_ONLY`):
+ *   `AndroidManifest.xml` (`com.callstack.appduct.CLI_PINS`/`TRUST`/`ALLOW_PRIVATE_LAN_ONLY`):
  *   those are XML attribute string values written by the config plugin at prebuild time, not compiled
  *   identifiers, so R8 never touches them, but they only exist at all if the config plugin ran. Both
  *   encodings AAPT2 can choose for the manifest string pool (UTF-8 or UTF-16LE) are checked.

package/dist/artifact-inspect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-inspect.d.ts","sourceRoot":"","sources":["../src/artifact-inspect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AAQH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,SAAS,CAAC;AACjD,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAE3D,MAAM,MAAM,eAAe,GACvB,wBAAwB,GACxB,uBAAuB,GACvB,qBAAqB,GACrB,0BAA0B,GAC1B,4BAA4B,GAC5B,iCAAiC,CAAC;AAEtC,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB;;mCAE+B;IAC/B,OAAO,EAAE,eAAe,EAAE,CAAC;CAC5B,CAAC;AAkCF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;YAEY;AACZ,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAE1F;;4EAE4E;AAC5E,eAAO,MAAM,iBAAiB,EAAE,YAgB/B,CAAC;AA8NF,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB,CAAC;AAEF;;;mEAGmE;AACnE,eAAO,MAAM,eAAe,GAC1B,cAAc,MAAM,EACpB,UAAS,sBAA2B,KACnC,OAAO,CAAC,kBAAkB,CA+C5B,CAAC"}
+{"version":3,"file":"artifact-inspect.d.ts","sourceRoot":"","sources":["../src/artifact-inspect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAQH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,SAAS,CAAC;AACjD,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAE3D,MAAM,MAAM,eAAe,GACvB,wBAAwB,GACxB,uBAAuB,GACvB,qBAAqB,GACrB,0BAA0B,GAC1B,4BAA4B,GAC5B,iCAAiC,CAAC;AAEtC,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB;;mCAE+B;IAC/B,OAAO,EAAE,eAAe,EAAE,CAAC;CAC5B,CAAC;AAoDF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;YAEY;AACZ,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAE1F;;4EAE4E;AAC5E,eAAO,MAAM,iBAAiB,EAAE,YAgB/B,CAAC;AAiOF,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB,CAAC;AAEF;;;mEAGmE;AACnE,eAAO,MAAM,eAAe,GAC1B,cAAc,MAAM,EACpB,UAAS,sBAA2B,KACnC,OAAO,CAAC,kBAAkB,CA+C5B,CAAC"}

package/dist/artifact-inspect.js

@@ -31,7 +31,7 @@
  *   future stub could ship them) without the real implementation being present, exactly the reason
  *   the Android signals below aren't all treated as equally authoritative either.
  * - Android: the primary signal is `AppductNativeMarker`
- *   (`packages/native/android/core/src/main/java/com/callstackincubator/appduct/AppductNativeMarker.kt`,
+ *   (`packages/native/android/core/src/main/java/com/callstack/appduct/AppductNativeMarker.kt`,
  *   vendored into `@appduct/react-native` at `android/core/src/main/java/...`), a marker class with no
  *   other purpose. Its fully-qualified name is kept unminified and unremoved by a `-keep` rule in
  *   `consumer-rules.pro` (same vendoring path), shipped to every consuming app via `consumerProguardFiles`
@@ -41,10 +41,12 @@
  *   minification in every supported consumer setup.
  *
  *   Two more signals are kept as fallbacks for artifacts built before this marker existed: the
- *   `com.callstackincubator.appduct` package string in the dex string pool (survives as long as
+ *   `com.callstack.appduct` package string in the dex string pool (and its pre-rename spelling,
+ *   `com.callstackincubator.appduct` — every Android marker below is matched against both, so an
+ *   app built against Appduct 0.9.0 or earlier is still detected) (survives as long as
  *   R8/ProGuard minification+obfuscation isn't applied to it — an aggressive release config with no keep
  *   rule for this package can rename it away) and the plugin-authored meta-data key names in
- *   `AndroidManifest.xml` (`com.callstackincubator.appduct.CLI_PINS`/`TRUST`/`ALLOW_PRIVATE_LAN_ONLY`):
+ *   `AndroidManifest.xml` (`com.callstack.appduct.CLI_PINS`/`TRUST`/`ALLOW_PRIVATE_LAN_ONLY`):
  *   those are XML attribute string values written by the config plugin at prebuild time, not compiled
  *   identifiers, so R8 never touches them, but they only exist at all if the config plugin ran. Both
  *   encodings AAPT2 can choose for the manifest string pool (UTF-8 or UTF-16LE) are checked.
@@ -87,15 +89,33 @@ const IOS_CORE_MARKER = "AppductCoreMarker";
 const IOS_OBJC_CLASS_MARKER = "RCTNativeAppduct";
 const IOS_INFO_PLIST_KEY_MARKERS = ["AppductCliPins", "AppductTrust", "AppductAllowPrivateLanOnly"];
 // Fully-qualified name of `AppductNativeMarker`
-// (packages/native/android/core/src/main/java/com/callstackincubator/appduct/AppductNativeMarker.kt,
-// vendored into packages/react-native/android/core/src/main/java/com/callstackincubator/appduct/AppductNativeMarker.kt
+// (packages/native/android/core/src/main/java/com/callstack/appduct/AppductNativeMarker.kt,
+// vendored into packages/react-native/android/core/src/main/java/com/callstack/appduct/AppductNativeMarker.kt
 // by scripts/sync-native-core.mjs), kept unminified by packages/native/android/core/consumer-rules.pro
 // (vendored to packages/react-native/android/core/consumer-rules.pro the same way). Checked as a dex
 // type descriptor (`Lcom/.../AppductNativeMarker;`) — see detectAndroidSignals — which is how the
 // class's fully-qualified name is actually encoded in classes.dex.
-const ANDROID_KEEP_RULE_MARKER_CLASS = "com/callstackincubator/appduct/AppductNativeMarker";
-const ANDROID_DEX_PACKAGE_MARKERS = ["com/callstackincubator/appduct", "com.callstackincubator.appduct"];
-const ANDROID_MANIFEST_KEY_MARKER = "com.callstackincubator.appduct.";
+//
+// Each of the three Android markers is matched against BOTH the current `com.callstack.*` namespace
+// and the legacy `com.callstackincubator.*` one that every release up to and including 0.9.0
+// shipped. `doctor` inspects artifacts it did not build -- including an app built against an older
+// Appduct, which is exactly the case a release gate runs into -- and reporting `absent` for an app
+// that genuinely bundles Appduct is the one failure mode this tool must never have: it would
+// rubber-stamp shipping Appduct to production. docs/CI.md states the rule ("a broken check must
+// fail loudly, not rubber-stamp a release"); the cost of honouring it here is one extra buffer
+// scan per signal. The legacy entries are load-bearing and must not be dropped while any artifact
+// built before the rename can still be inspected.
+const ANDROID_KEEP_RULE_MARKER_CLASSES = [
+    "com/callstack/appduct/AppductNativeMarker",
+    "com/callstackincubator/appduct/AppductNativeMarker",
+];
+const ANDROID_DEX_PACKAGE_MARKERS = [
+    "com/callstack/appduct",
+    "com.callstack.appduct",
+    "com/callstackincubator/appduct",
+    "com.callstackincubator.appduct",
+];
+const ANDROID_MANIFEST_KEY_MARKERS = ["com.callstack.appduct.", "com.callstackincubator.appduct."];
 const bufferIncludesAscii = (haystack, needle) => {
     return haystack.includes(Buffer.from(needle, "utf8"));
 };
@@ -257,14 +277,13 @@ const detectAndroidSignals = (bytes) => {
     // in every supported consumer setup (see the file-level doc comment). Matched as a dex type
     // descriptor (`L` + fully-qualified-name-with-slashes + `;`) since that's the actual encoding of
     // a class name inside classes.dex, not just a loose substring check.
-    if (bufferIncludesAscii(bytes, `L${ANDROID_KEEP_RULE_MARKER_CLASS};`)) {
+    if (ANDROID_KEEP_RULE_MARKER_CLASSES.some((klass) => bufferIncludesAscii(bytes, `L${klass};`))) {
         signals.push("android-keep-rule-marker");
     }
     if (ANDROID_DEX_PACKAGE_MARKERS.some((marker) => bufferIncludesAscii(bytes, marker))) {
         signals.push("android-dex-package-symbol");
     }
-    if (bufferIncludesAscii(bytes, ANDROID_MANIFEST_KEY_MARKER) ||
-        bufferIncludesUtf16le(bytes, ANDROID_MANIFEST_KEY_MARKER)) {
+    if (ANDROID_MANIFEST_KEY_MARKERS.some((marker) => bufferIncludesAscii(bytes, marker) || bufferIncludesUtf16le(bytes, marker))) {
         signals.push("android-manifest-meta-data-keys");
     }
     return signals;

package/dist/cli/create-cli.js

@@ -14,7 +14,7 @@ export const createCli = () => {
         "an ambient value into a committed file.")
         .option("--force", "Replace the scheme already recorded in the project config.");
     cli
-        .command("keygen", "Generate a Appduct host private key and print its app fingerprint.")
+        .command("keygen", "Generate an Appduct host private key and print its app fingerprint.")
         .option("--out <path>", "Destination path (default: <state-dir>/key.pem).")
         .option("--force", "Overwrite an existing key at the destination path.");
     cli

package/dist/mcp/connect-tool.js

@@ -41,7 +41,7 @@ const QR_INSTRUCTIONS = "This link was NOT delivered to a device — a human has
     "gives no output while it waits, so calling it before you have asked will look like a hang.";
 export const CONNECT_TOOL_DESCRIPTOR = {
     name: CONNECT_TOOL_NAME,
-    description: "Mint a Appduct session link and get it onto a device. With no \"target\", auto-detects a " +
+    description: "Mint an Appduct session link and get it onto a device. With no \"target\", auto-detects a " +
         "booted iOS simulator or attached Android device and delivers the link to it, returning " +
         "{ sessionId, delivered: true, autoDetected: true } — this is the normal agent path and needs " +
         "no human. Pass target \"android\" or \"ios-sim\" (optionally with \"device\") to choose " +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "appduct",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Driving React Native tools without in-app debug UI.",
   "type": "module",
   "main": "./dist/index.js",
@@ -45,7 +45,7 @@
     "reflect-metadata": "^0.2.2",
     "toqr": "^0.1.1",
     "ws": "^8.18.3",
-    "@appduct/shared": "0.9.0"
+    "@appduct/shared": "0.10.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",