clawdex-mobile 5.0.1 → 5.0.2

package/README.md

@@ -45,6 +45,8 @@ Published npm releases bundle prebuilt Rust bridge binaries for `darwin-arm64`,
 
 `clawdex init` does not run a project-local `npm install`. The global package install is the only npm install needed for the published bridge flow.
 
+The published CLI package is bridge-only. It does not install Expo, React Native, or the mobile app source tree.
+
 `clawdex init` guides you through:
 
 1. bridge mode selection: `Local (LAN)` or `Tailscale`
@@ -148,6 +150,8 @@ Keep `npm run secure:bridge` running in foreground. It prints pairing QR and bri
 
 On supported published installs, this uses the bundled bridge binary directly instead of compiling Rust on startup. Source checkouts still build from Cargo when a packaged binary is unavailable.
 
+Published CLI installs write `.env.secure` for the bridge and skip repo-only mobile env files.
+
 Then open the installed mobile app and pair it:
 
 - preferred: scan the bridge QR to autofill URL + token

package/docs/setup-and-operations.md

@@ -15,6 +15,8 @@ Published npm releases bundle prebuilt bridge binaries for `darwin-arm64`, `darw
 
 `clawdex init` does not run a project-local `npm install` for the published CLI path. The only required npm install there is `npm install -g clawdex-mobile@latest`.
 
+Published CLI installs are bridge-only. They do not include the Expo workspace or mobile app source files.
+
 ## Manual Secure Setup (No Wizard)
 
 ### 1) Install dependencies
@@ -32,7 +34,7 @@ npm run secure:setup
 Creates/updates:
 
 - `.env.secure` (bridge runtime config + token)
-- `apps/mobile/.env` (mobile token + optional runtime knobs)
+- `apps/mobile/.env` (repo checkout only, for local mobile dev builds)
 
 ### 3) Start bridge
 

package/docs/troubleshooting.md

@@ -5,6 +5,7 @@
 - `clawdex init` no longer starts Expo for the shipped app.
 - Published npm installs should use a bundled bridge binary on `darwin-arm64`, `darwin-x64`, `linux-x64`, and `win32-x64`.
 - `clawdex init` should not run a repo `npm install` on the published CLI path.
+- Published CLI installs should not pull Expo/React Native or ship the mobile source tree.
 - If startup is still compiling Rust, you are usually on a source checkout, an unsupported host, or a package without bundled bridge binaries.
 - The slow parts are usually npm dependency install/repair or the first Rust bridge build on source-based setups.
 - If you want to skip the interactive wizard after initial setup, use `npm run secure:bridge`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawdex-mobile",
-  "version": "5.0.1",
+  "version": "5.0.2",
   "homepage": "https://github.com/Mohit-Patil/clawdex-mobile#readme",
   "repository": {
     "type": "git",
@@ -12,6 +12,23 @@
   "bin": {
     "clawdex": "./bin/clawdex.js"
   },
+  "files": [
+    "CHANGELOG.md",
+    "LICENSE",
+    "README.md",
+    "bin/clawdex.js",
+    "docs/setup-and-operations.md",
+    "docs/troubleshooting.md",
+    "scripts/bridge-binary.js",
+    "scripts/setup-secure-dev.sh",
+    "scripts/setup-wizard.sh",
+    "scripts/start-bridge-secure.js",
+    "scripts/stop-services.sh",
+    "services/rust-bridge/Cargo.lock",
+    "services/rust-bridge/Cargo.toml",
+    "services/rust-bridge/src",
+    "vendor/bridge-binaries"
+  ],
   "workspaces": [
     "apps/*",
     "services/*"
@@ -34,12 +51,5 @@
     "lint": "npm run --workspaces lint",
     "test": "npm run test -w @codex/mac-bridge && npm run test -w apps/mobile && npm run test -w @codex/rust-bridge",
     "teardown": "./scripts/teardown.sh"
-  },
-  "dependencies": {
-    "@types/react": "~19.2.10",
-    "expo": "^55.0.8",
-    "react": "19.2.0",
-    "react-dom": "19.2.0",
-    "react-native": "0.83.2"
   }
 }

package/scripts/setup-secure-dev.sh

@@ -9,8 +9,6 @@ fi
 SECURE_ENV_FILE="$ROOT_DIR/.env.secure"
 MOBILE_ENV_FILE="$ROOT_DIR/apps/mobile/.env"
 MOBILE_ENV_EXAMPLE="$ROOT_DIR/apps/mobile/.env.example"
-RUST_ENV_FILE="$ROOT_DIR/services/rust-bridge/.env"
-RUST_ENV_EXAMPLE="$ROOT_DIR/services/rust-bridge/.env.example"
 
 upsert_env_key() {
   local file="$1"
@@ -199,19 +197,20 @@ resolve_local_ipv4() {
   printf '%s' "$ip"
 }
 
+has_local_mobile_workspace() {
+  [[ -f "$MOBILE_ENV_EXAMPLE" ]]
+}
+
 if ! command -v openssl >/dev/null 2>&1; then
   echo "error: openssl not found. Install OpenSSL first." >&2
   exit 1
 fi
 
-mkdir -p "$(dirname "$MOBILE_ENV_FILE")" "$(dirname "$RUST_ENV_FILE")"
-
-if [[ ! -f "$MOBILE_ENV_FILE" ]]; then
-  cp "$MOBILE_ENV_EXAMPLE" "$MOBILE_ENV_FILE"
-fi
-
-if [[ ! -f "$RUST_ENV_FILE" ]]; then
-  cp "$RUST_ENV_EXAMPLE" "$RUST_ENV_FILE"
+if has_local_mobile_workspace; then
+  mkdir -p "$(dirname "$MOBILE_ENV_FILE")"
+  if [[ ! -f "$MOBILE_ENV_FILE" ]]; then
+    cp "$MOBILE_ENV_EXAMPLE" "$MOBILE_ENV_FILE"
+  fi
 fi
 
 BRIDGE_HOST="${BRIDGE_HOST_OVERRIDE:-}"
@@ -264,11 +263,13 @@ EOT
 
 chmod 600 "$SECURE_ENV_FILE"
 
-upsert_env_key "$MOBILE_ENV_FILE" "EXPO_PUBLIC_HOST_BRIDGE_TOKEN" "$BRIDGE_TOKEN"
-# Backward compatibility for older app builds that still read MAC_BRIDGE token key.
-upsert_env_key "$MOBILE_ENV_FILE" "EXPO_PUBLIC_MAC_BRIDGE_TOKEN" "$BRIDGE_TOKEN"
-upsert_env_key "$MOBILE_ENV_FILE" "EXPO_PUBLIC_ALLOW_QUERY_TOKEN_AUTH" "true"
-upsert_env_key "$MOBILE_ENV_FILE" "EXPO_PUBLIC_ALLOW_INSECURE_REMOTE_BRIDGE" "true"
+if has_local_mobile_workspace; then
+  upsert_env_key "$MOBILE_ENV_FILE" "EXPO_PUBLIC_HOST_BRIDGE_TOKEN" "$BRIDGE_TOKEN"
+  # Backward compatibility for older app builds that still read MAC_BRIDGE token key.
+  upsert_env_key "$MOBILE_ENV_FILE" "EXPO_PUBLIC_MAC_BRIDGE_TOKEN" "$BRIDGE_TOKEN"
+  upsert_env_key "$MOBILE_ENV_FILE" "EXPO_PUBLIC_ALLOW_QUERY_TOKEN_AUTH" "true"
+  upsert_env_key "$MOBILE_ENV_FILE" "EXPO_PUBLIC_ALLOW_INSECURE_REMOTE_BRIDGE" "true"
+fi
 
 echo "Secure dev setup complete."
 echo ""
@@ -276,8 +277,16 @@ echo "Bridge network mode: $BRIDGE_NETWORK_MODE"
 echo "Bridge host: $BRIDGE_HOST ($HOST_SOURCE)"
 echo "Bridge port: $BRIDGE_PORT"
 echo "Token source: $SECURE_ENV_FILE"
-echo "Mobile env updated: $MOBILE_ENV_FILE"
+if has_local_mobile_workspace; then
+  echo "Mobile env updated: $MOBILE_ENV_FILE"
+else
+  echo "Local mobile env: skipped (installed mobile app flow)"
+fi
 echo ""
 echo "Next steps:"
 echo "  1) npm run secure:bridge"
-echo "  2) npm run mobile"
+if has_local_mobile_workspace; then
+  echo "  2) npm run mobile"
+else
+  echo "  2) Open the installed mobile app and pair with the QR"
+fi

package/services/rust-bridge/Cargo.lock

@@ -149,7 +149,7 @@ dependencies = [
 
 [[package]]
 name = "codex-rust-bridge"
-version = "5.0.1"
+version = "5.0.2"
 dependencies = [
  "axum",
  "base64",

package/services/rust-bridge/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "codex-rust-bridge"
-version = "5.0.1"
+version = "5.0.2"
 edition = "2021"
 
 [dependencies]

package/.github/workflows/ci.yml

@@ -1,80 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches:
-      - main
-    tags:
-      - "v*"
-  pull_request:
-  workflow_dispatch:
-
-concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  js-workspaces:
-    name: JS - ${{ matrix.workspace }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    strategy:
-      fail-fast: false
-      matrix:
-        workspace:
-          - "@codex/mac-bridge"
-          - "clawdex-mobile"
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v5
-        with:
-          node-version: "20"
-          cache: npm
-          cache-dependency-path: package-lock.json
-          package-manager-cache: false
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Lint
-        run: npm run lint -w "${{ matrix.workspace }}"
-
-      - name: Typecheck
-        run: npm run typecheck -w "${{ matrix.workspace }}"
-
-      - name: Test
-        run: npm run test -w "${{ matrix.workspace }}"
-
-  rust-bridge:
-    name: Rust Bridge
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Setup Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt
-
-      - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
-
-      - name: Rust fmt
-        working-directory: services/rust-bridge
-        run: cargo fmt --check
-
-      - name: Rust check
-        working-directory: services/rust-bridge
-        run: cargo check
-
-      - name: Rust test
-        working-directory: services/rust-bridge
-        run: cargo test

package/.github/workflows/npm-release.yml

@@ -1,208 +0,0 @@
-name: NPM Release
-
-on:
-  push:
-    branches:
-      - main
-    tags:
-      - "v*"
-  workflow_dispatch:
-
-concurrency:
-  group: npm-release-${{ github.ref }}
-  cancel-in-progress: false
-
-permissions:
-  contents: write
-
-jobs:
-  build_bridge_binaries:
-    name: Build bridge binary (${{ matrix.package_target }})
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: macos-26
-            package_target: darwin-arm64
-            rust_target: aarch64-apple-darwin
-            binary_path: services/rust-bridge/target/aarch64-apple-darwin/release/codex-rust-bridge
-          - runner: macos-26-intel
-            package_target: darwin-x64
-            rust_target: x86_64-apple-darwin
-            binary_path: services/rust-bridge/target/x86_64-apple-darwin/release/codex-rust-bridge
-          - runner: ubuntu-latest
-            package_target: linux-x64
-            rust_target: x86_64-unknown-linux-gnu
-            binary_path: services/rust-bridge/target/x86_64-unknown-linux-gnu/release/codex-rust-bridge
-          - runner: windows-latest
-            package_target: win32-x64
-            rust_target: x86_64-pc-windows-msvc
-            binary_path: services/rust-bridge/target/x86_64-pc-windows-msvc/release/codex-rust-bridge.exe
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v5
-        with:
-          node-version: "20"
-          package-manager-cache: false
-
-      - name: Setup Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.rust_target }}
-
-      - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
-
-      - name: Build bridge binary
-        working-directory: services/rust-bridge
-        run: cargo build --release --locked --target ${{ matrix.rust_target }}
-
-      - name: Stage packaged bridge binary
-        run: node scripts/bridge-binary.js stage --target ${{ matrix.package_target }} --from ${{ matrix.binary_path }}
-
-      - name: Upload bridge artifact
-        uses: actions/upload-artifact@v6
-        with:
-          name: bridge-binaries-${{ matrix.package_target }}
-          path: vendor/bridge-binaries/${{ matrix.package_target }}/
-
-  publish:
-    name: Publish package to npm
-    needs: build_bridge_binaries
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v5
-        with:
-          node-version: "20"
-          registry-url: "https://registry.npmjs.org"
-          cache: npm
-          cache-dependency-path: package-lock.json
-          package-manager-cache: false
-
-      - name: Setup Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Download packaged bridge binaries
-        uses: actions/download-artifact@v7
-        with:
-          pattern: bridge-binaries-*
-          path: .artifacts/bridge-binaries
-
-      - name: Restage packaged bridge binaries
-        run: |
-          rm -rf vendor/bridge-binaries
-          mkdir -p vendor/bridge-binaries
-          for target in darwin-arm64 darwin-x64 linux-x64 win32-x64; do
-            case "$target" in
-              win32-x64) binary_name="codex-rust-bridge.exe" ;;
-              *) binary_name="codex-rust-bridge" ;;
-            esac
-            source_path=".artifacts/bridge-binaries/bridge-binaries-${target}/${binary_name}"
-            if [ ! -f "$source_path" ]; then
-              echo "Missing downloaded bridge artifact for ${target}: ${source_path}"
-              exit 1
-            fi
-            node scripts/bridge-binary.js stage --target "$target" --from "$source_path"
-          done
-
-      - name: Verify packaged bridge bundle layout
-        run: |
-          test -f vendor/bridge-binaries/darwin-arm64/codex-rust-bridge
-          test -f vendor/bridge-binaries/darwin-x64/codex-rust-bridge
-          test -f vendor/bridge-binaries/linux-x64/codex-rust-bridge
-          test -f vendor/bridge-binaries/win32-x64/codex-rust-bridge.exe
-
-      - name: Verify Rust bridge compiles
-        working-directory: services/rust-bridge
-        run: cargo check --locked
-
-      - name: Run monorepo quality gates
-        run: |
-          npm run lint
-          npm run typecheck
-          npm run test
-
-      - name: Verify package is publishable
-        run: |
-          node -e "const p=require('./package.json'); if (p.private) { throw new Error('package.json has private=true; cannot publish'); } if (!p.name || !p.version) { throw new Error('package.json must include name + version'); }"
-
-      - name: Verify tag version matches package version
-        if: startsWith(github.ref, 'refs/tags/')
-        run: |
-          TAG_VERSION="${GITHUB_REF_NAME#v}"
-          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
-          if [ "${TAG_VERSION}" != "${PACKAGE_VERSION}" ]; then
-            echo "Tag version (${TAG_VERSION}) does not match package.json version (${PACKAGE_VERSION})."
-            exit 1
-          fi
-
-      - name: Show package contents
-        run: npm pack --dry-run
-
-      - name: Verify tarball contains packaged bridge targets
-        run: |
-          TMPDIR="$(mktemp -d)"
-          TARBALL="$(npm pack --silent --pack-destination "$TMPDIR" | tail -n 1)"
-          tar -tzf "$TMPDIR/$TARBALL" | grep -q '^package/vendor/bridge-binaries/darwin-arm64/codex-rust-bridge$'
-          tar -tzf "$TMPDIR/$TARBALL" | grep -q '^package/vendor/bridge-binaries/darwin-x64/codex-rust-bridge$'
-          tar -tzf "$TMPDIR/$TARBALL" | grep -q '^package/vendor/bridge-binaries/linux-x64/codex-rust-bridge$'
-          tar -tzf "$TMPDIR/$TARBALL" | grep -q '^package/vendor/bridge-binaries/win32-x64/codex-rust-bridge.exe$'
-
-      - name: Resolve publish target
-        id: publish_target
-        run: |
-          PACKAGE_NAME="$(node -p "require('./package.json').name")"
-          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
-          echo "package_name=${PACKAGE_NAME}" >> "$GITHUB_OUTPUT"
-          echo "package_version=${PACKAGE_VERSION}" >> "$GITHUB_OUTPUT"
-          if npm view "${PACKAGE_NAME}@${PACKAGE_VERSION}" version >/dev/null 2>&1; then
-            echo "publish_needed=false" >> "$GITHUB_OUTPUT"
-            echo "Package ${PACKAGE_NAME}@${PACKAGE_VERSION} is already published; skipping npm publish."
-          else
-            echo "publish_needed=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Verify NPM token secret
-        if: steps.publish_target.outputs.publish_needed == 'true'
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: |
-          if [ -z "${NODE_AUTH_TOKEN}" ]; then
-            echo "NPM_TOKEN secret is missing."
-            exit 1
-          fi
-
-      - name: Publish to npm
-        if: steps.publish_target.outputs.publish_needed == 'true'
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: npm publish --access public
-
-      - name: Create or update GitHub release
-        if: startsWith(github.ref, 'refs/tags/')
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          if gh release view "${GITHUB_REF_NAME}" >/dev/null 2>&1; then
-            gh release edit "${GITHUB_REF_NAME}" --latest
-          else
-            gh release create "${GITHUB_REF_NAME}" --title "${GITHUB_REF_NAME}" --generate-notes --latest
-          fi

package/.github/workflows/pages.yml

@@ -1,41 +0,0 @@
-name: Pages
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - ".github/workflows/pages.yml"
-      - "site/**"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
-concurrency:
-  group: pages
-  cancel-in-progress: true
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Configure Pages
-        uses: actions/configure-pages@v5
-
-      - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v3
-        with:
-          path: site
-
-      - name: Deploy Pages
-        id: deployment
-        uses: actions/deploy-pages@v4