vibeview 0.10.0 → 0.10.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibeview",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "VibeView CLI -- run mobile tests from CI/CD pipelines",
   "type": "module",
   "bin": {

package/skills/vibeview-agent/SKILL.md

@@ -50,6 +50,11 @@ https://vibeview.io/docs/preparing-your-build.
    fires once the session accepts commands (device up, app installed) —
    no need to poll `dev-status` first. If the app ships no native changes
    since the last run, skip step 1 and just do steps 2–4.
+5. **Immediately tell the developer the session `url`** — "watch or take
+   over at any time: `<url>`". The page is a live, fully interactive view
+   of the device; the developer watching along is a feature, not a risk.
+   (For a session you attached to with `--session` instead of starting,
+   the page is `https://vibeview.io/sandbox/<session_id>`.)
 
 Running `dev` writes two things into the project root: a `.vibeview/`
 directory (live session state — local machine state, never commit) and a
@@ -150,7 +155,26 @@ it rather than letting it appear unexplained in their `git status`.
   focus directly with `tap-focused` (moves focus AND activates) / `focus`
   (moves focus only, no activation).
 
-## 4. Cleanup
+## 4. When only a human can act — stop and hand off
+
+Some screens need things you must never guess or invent: **login
+credentials, 2FA/OTP codes, CAPTCHAs, destructive confirmations
+("Delete account?"), anything payment- or real-account-shaped.** When you
+hit one:
+
+1. **Stop driving.** Do not type guessed credentials, do not tap through a
+   destructive confirmation to "see what happens".
+2. **Ask the developer, naming exactly what you need and where**: "I'm at
+   the login screen — please sign in at `<session url>` and tell me when
+   you're done." The session page is fully interactive; the developer can
+   drive the device directly while you wait.
+3. **On resume, run `ui-tree` FIRST** — the human just changed the screen,
+   so every ref you held is stale — and **verify the blocker is actually
+   gone from the tree** (e.g. the login form is absent) instead of trusting
+   the confirmation alone. If it's still there, say what you still see and
+   ask again.
+
+## 5. Cleanup
 
 **Always** stop the session when done verifying — a running session bills
 streaming minutes even when idle:
@@ -158,7 +182,7 @@ streaming minutes even when idle:
 vibeview dev-stop
 ```
 
-## 5. Command reference
+## 6. Command reference
 
 Every verb accepts `--session <id>` to target a specific session (falls
 back to the current project's `vibeview dev --detach` session if omitted)
@@ -194,7 +218,7 @@ Dev-loop lifecycle commands (not registry verbs, but needed for every run):
 | `dev-status` | Check on the current project's detached dev session. |
 | `dev-stop` | End the current project's detached dev session. |
 
-## 6. If you're calling VibeView over MCP
+## 7. If you're calling VibeView over MCP
 
 Everything above is also exposed as MCP tools by `vibeview mcp`, so an agent
 with no shell can run the whole loop. Tool names are the CLI verbs with
@@ -210,7 +234,7 @@ steps the CLI does with plain shell commands:
 | MCP tool | Args | Purpose |
 |----------|------|---------|
 | `upload_app` | `file` (required path), `name` | Upload a debug build. The MCP equivalent of `vibeview upload-app`, so step 1 of the loop needs no shell. Returns the `app_id` to pass to `dev_start`. |
-| `dev_start` | `platform` (required: `ios`/`android`/`tvos`/`androidtv`), `app`, `metro_port` | Start a dev-loop session held open by the MCP server. The MCP equivalent of `vibeview dev --detach`. |
+| `dev_start` | `platform` (required: `ios`/`android`/`tvos`/`androidtv`), `app`, `metro_port` | Start a dev-loop session held open by the MCP server. The MCP equivalent of `vibeview dev --detach`. Returns `page_url` — relay it to the developer immediately, same as step 5 of the loop. |
 | `dev_stop` | — | Stop the session `dev_start` started. The MCP equivalent of `vibeview dev-stop`. |
 
 **`dev_start` is stateful — it changes the default session for every later