mobile-automator 0.28.1 → 0.28.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mobile-automator",
-  "version": "0.28.1",
+  "version": "0.28.2",
   "description": "Host-agnostic mauto CLI for AI-driven mobile QA automation — analyzes a mobile project and drives devices through mobile-mcp.",
   "homepage": "https://github.com/sh3lan93/mobile-automator#readme",
   "repository": {

package/src/cli.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const fs = require('fs');
+const path = require('path');
 const { Command } = require('commander');
 
 const { version: PKG_VERSION } = require('../package.json');
@@ -190,9 +191,12 @@ async function handleElements({ deviceBridge }) {
   }
 }
 
-async function handleScreenshot({ deviceBridge }, destPath) {
+// Relative paths resolve against the caller's cwd HERE, not in the daemon: the
+// daemon runs from the project root, which is not where a verb run from a
+// subdirectory meant `./shot.png` (#214).
+async function handleScreenshot({ deviceBridge, cwd = process.cwd() }, destPath) {
   try {
-    const savedPath = await deviceBridge.screenshot(destPath);
+    const savedPath = await deviceBridge.screenshot(path.resolve(cwd, destPath));
     return { envelope: ok({ path: savedPath }), exitKind: 'ok' };
   } catch (err) {
     return {
@@ -380,7 +384,10 @@ async function handleLaunch({ deviceBridge }, appId) {
   }
 }
 
-async function handleInstall({ deviceBridge }, appPath) {
+// Resolved against the caller's cwd for the same reason as handleScreenshot
+// (#214). The empty-path guard runs first: path.resolve(cwd, '') is the cwd
+// itself, which would turn a missing argument into a bogus install attempt.
+async function handleInstall({ deviceBridge, cwd = process.cwd() }, appPath) {
   const p = String(appPath == null ? '' : appPath);
   if (!p) {
     return {
@@ -388,9 +395,10 @@ async function handleInstall({ deviceBridge }, appPath) {
       exitKind: 'invalid_input',
     };
   }
+  const abs = path.resolve(cwd, p);
   try {
-    await deviceBridge.installApp(p);
-    return { envelope: ok({ installed: p }), exitKind: 'ok' };
+    await deviceBridge.installApp(abs);
+    return { envelope: ok({ installed: abs }), exitKind: 'ok' };
   } catch (err) {
     return deviceFail(err);
   }
@@ -1807,7 +1815,7 @@ function buildProgram(deps = {}) {
     .command('install <path>')
     .description('Install an app from a local .apk/.app/.ipa path')
     .option('--device <id>', 'target device id')
-    .action(withEnvelope((path, opts) => withBridge(opts.device, (bridge) => handleInstall({ deviceBridge: bridge }, path))));
+    .action(withEnvelope((appPath, opts) => withBridge(opts.device, (bridge) => handleInstall({ deviceBridge: bridge }, appPath))));
 
   program
     .command('uninstall <appId>')

package/src/device/engine-hints.js

@@ -66,6 +66,14 @@ function deviceNotFoundHint(id) {
   );
 }
 
+// B3 (#214): mobile-mcp's validateOutputPath only allows screenshots under the
+// engine's cwd or the temp dir, and its message calls the former "the current
+// directory". The engine runs from the project root (the daemon is spawned
+// there), which is not necessarily the directory the user ran the verb from.
+const OUTSIDE_ALLOWED_DIRS_HINT =
+  'Screenshots must be saved under the project root (the directory containing mobile-automator/) ' +
+  'or the system temp directory. Choose a path inside one of them and retry.';
+
 function engineHint(message, { mobilecliVersion = resolveMobilecliVersion } = {}) {
   try {
     if (typeof message !== 'string' || !message) return null;
@@ -74,6 +82,7 @@ function engineHint(message, { mobilecliVersion = resolveMobilecliVersion } = {}
     }
     const notFound = /Device "([^"]+)" not found/.exec(message);
     if (notFound) return deviceNotFoundHint(notFound[1]);
+    if (/not in the list of allowed directories/.test(message)) return OUTSIDE_ALLOWED_DIRS_HINT;
     return null;
   } catch {
     return null;

package/src/device/session-spawn.js

@@ -54,7 +54,12 @@ async function spawnDaemon({
   try {
     // The root in argv is an identity marker only (see paths.daemonArgv): env
     // stays the daemon's source of truth, but `ps` can only see argv.
+    // cwd: the engine inherits the daemon's cwd, and mobile-mcp's
+    // validateOutputPath only allows screenshots under its own process.cwd()
+    // (or the temp dir). Pin it to the project root so the allow-list never
+    // depends on which subdirectory happened to spawn the daemon (#214).
     const child = spawn(process.execPath, [DAEMON_BIN, ...paths.daemonArgv(projectRoot)], {
+      cwd: projectRoot,
       detached: true,
       stdio: log.stdio,
       env,