mobile-automator 0.28.0 → 0.28.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mobile-automator",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "description": "Host-agnostic mauto CLI for AI-driven mobile QA automation — analyzes a mobile project and drives devices through mobile-mcp.",
   "homepage": "https://github.com/sh3lan93/mobile-automator#readme",
   "repository": {
@@ -41,8 +41,7 @@
   "devDependencies": {
     "jest": "^29.7.0",
     "jest-environment-jsdom": "^29.7.0",
-    "js-yaml": "^4.3.2",
-    "toml": "^3.0.0"
+    "js-yaml": "^4.3.2"
   },
   "engines": {
     "node": ">=22.12.0"

package/src/device/mobile-mcp-client.js

@@ -46,6 +46,31 @@ function resolveServerEntry() {
   return path.join(pkgDir, binRel);
 }
 
+// The environment mauto's own engine process is spawned with. Pure: returns a
+// new object and never mutates baseEnv.
+//
+// MOBILEMCP_ALLOW_UNSAFE_URLS defaults to "1" (#212). mobile-mcp rejects every
+// non-http(s) URL in mobile_open_url unless it is set, which blocks the
+// documented `open_url` deep-link capability (myapp://...). That guard exists to
+// stop an LLM whose ONLY reach is MCP from opening arbitrary schemes; an agent
+// driving mauto already has a shell and could open the same URL via adb or
+// simctl, so under mauto it protects nothing. The URL reaches the device as an
+// argv element on the default mobilecli robot (no shell), and the legacy adb
+// robot escapes shell metacharacters. A user-set value wins: the engine only
+// accepts the exact string "1", so MOBILEMCP_ALLOW_UNSAFE_URLS=0 restores the
+// guard. The env is read when the engine spawns, so a running session daemon
+// must be ended (`mauto session end`) before a change takes effect.
+function buildEngineEnv({ device = null, baseEnv = process.env } = {}) {
+  const env = {
+    ...baseEnv,
+    MOBILEMCP_ALLOW_UNSAFE_URLS: baseEnv.MOBILEMCP_ALLOW_UNSAFE_URLS ?? '1',
+  };
+  // mobile-mcp reads the target device from the environment / its own
+  // selection; we pass it through when provided so callers can pin a device.
+  if (device) env.MOBILE_MCP_DEVICE = device;
+  return env;
+}
+
 // The SDK transport, remembering the engine pid the moment the child is spawned
 // (#156). It has to be remembered: on a failed connect the SDK runs
 // `void this.close()`, and StdioClientTransport.close() clears its pid
@@ -84,9 +109,7 @@ async function createCall({
   const transport = new Transport({
     command,
     args,
-    // mobile-mcp reads the target device from the environment / its own
-    // selection; we pass it through when provided so callers can pin a device.
-    env: device ? { ...process.env, MOBILE_MCP_DEVICE: device } : process.env,
+    env: buildEngineEnv({ device }),
   });
 
   const client = new sdk.Client({ name: 'mauto', version: '0.1.0' }, { capabilities: {} });
@@ -255,4 +278,5 @@ module.exports = {
   resolveServerEntry,
   CONNECT_TIMEOUT_MS,
   ENGINE_REAP_MAX_MS,
+  buildEngineEnv,
 };

package/src/guide/content/generate.agnostic.md

@@ -112,7 +112,7 @@ Translate user language to action types and `mauto` verbs:
 | **"allow permission", "grant the permission"** | **`grant_permission`** | **`mauto press grant_permission`** | **Semantic — set optional `permission_name` if specific.** |
 | **"deny permission", "don't allow"** | **`deny_permission`** | **`mauto press deny_permission`** | **Semantic.** |
 | "navigate to [tab]" | `tap` | `mauto elements` to find the tab, then `mauto tap --at <x,y>` | |
-| "open URL", "navigate to URL" | `open_url` | `mauto press` / open the URL | |
+| "open URL", "open deep link", "navigate to URL" | `open_url` | `mauto open-url <url>` | |
 | "wait until visible" | `wait_for_element` | Poll `mauto elements` until present | Set `wait_config.type: "element_visible"` |
 | "wait until gone" | `wait_for_element_gone` | Poll `mauto elements` until absent | |
 | "wait until loaded", "wait for shimmer to stop" | `wait_for_loading_complete` | Poll `mauto screenshot <path>` + visual check | Set `wait_config.indicator` to match project's loading style |

package/src/guide/content/generate.aware.md

@@ -241,7 +241,7 @@ Translate user language to `mauto` verbs and schema actions:
 | "scroll to", "scroll until visible", "scroll down to find" | `scroll_to_element` | `mauto swipe --direction <dir>` (repeated) | Target is the element to scroll to |
 | "go back", "press back" | `press_button` | `mauto press <button>` | Use the back button |
 | "navigate to [tab]" | `tap` | `mauto elements` to find the tab, then `mauto tap --at <x,y>` | |
-| "open URL", "navigate to URL" | `open_url` | `mauto press` / open the URL | |
+| "open URL", "open deep link", "navigate to URL" | `open_url` | `mauto open-url <url>` | |
 | "wait until visible", "wait for [element] to appear" | `wait_for_element` | Poll `mauto elements` until present | Set `wait_config.type: "element_visible"` |
 | "wait until gone", "wait for [element] to disappear" | `wait_for_element_gone` | Poll `mauto elements` until absent | Set `wait_config.type: "element_gone"` |
 | "wait until loaded", "wait for shimmer to stop", "wait for loading to complete" | `wait_for_loading_complete` | Poll `mauto screenshot <path>` + visual check | Set `wait_config.indicator` to match project's loading style (shimmer/spinner/skeleton) |