vibeview 0.16.0 → 0.17.1

package/README.md

@@ -34,6 +34,43 @@ vibeview dev
 
 [Live Development docs →](https://vibeview.io/docs/live-development)
 
+## Cloud Builds (beta)
+
+Build your React Native app on VibeView's build fleet — no Mac, no CI
+pipeline, no local toolchain:
+
+```bash
+vibeview build --cloud                  # simulator/emulator build
+vibeview build --cloud --production     # signed release build (.ipa / .aab)
+```
+
+A regular cloud build lands in your app's Build History, ready to run on a
+cloud device. Add `--production` for a **signed release build** on iOS,
+tvOS, Android, or Android TV, using signing credentials you store once:
+
+```bash
+# Apple: your distribution certificate + provisioning profile
+vibeview credentials add --platform ios --file cert.p12 --profile app.mobileprovision
+
+# Android: upload a keystore — or have VibeView generate one (no Java needed)
+vibeview credentials generate --platform android --name release
+```
+
+Credentials are stored encrypted and never readable back. Build-time
+secrets work the same way:
+
+```bash
+vibeview env set NPM_TOKEN "..."        # secret by default, injected into builds
+vibeview webhooks add --url https://ci.example.com/hooks/vibeview
+```
+
+Webhooks POST a signed payload to your endpoint whenever a build finishes.
+Manage running builds with `vibeview builds list | logs | download | cancel`.
+
+[Cloud Builds docs →](https://vibeview.io/docs/cloud-builds) ·
+[App Signing →](https://vibeview.io/docs/app-signing) ·
+[Build Webhooks →](https://vibeview.io/docs/build-webhooks)
+
 ## Let your AI agent drive the device
 
 The same session can be driven by a coding agent, so it can verify its own
@@ -88,9 +125,13 @@ Output formats: `human`, `json`, and `junit` for any CI system. The exit code re
 
 | Command | Purpose |
 | --- | --- |
-| `vibeview login` | Authenticate via browser |
+| `vibeview login` / `logout` / `whoami` | Authenticate via browser, sign out, show who you are |
 | `vibeview dev` | Live development on a cloud device |
-| `vibeview build` | Build your app and upload it |
+| `vibeview build` | Build your app — locally, or on the build fleet with `--cloud` (add `--production` for a signed release) |
+| `vibeview builds list/logs/download/cancel/delete-artifact` | Manage cloud builds and their artifacts |
+| `vibeview credentials add/generate/list/rm` | App-signing credentials for production builds |
+| `vibeview env list/set/rm/pull` | Build variables and secrets injected into cloud builds |
+| `vibeview webhooks add/list/rm/test` | Notify your systems when builds finish (signed payloads) |
 | `vibeview dev-status` / `dev-stop` | Check on, or stop, a backgrounded dev session |
 | `vibeview agent-setup` | Make VibeView discoverable to your coding agent (skill + MCP) |
 | `vibeview mcp` | Run the MCP server so an agent can drive the device |

package/dist/{chunk-BQRAY3BV.js → chunk-3IMJ7FNN.js}

@@ -5,7 +5,7 @@ import {
   loadConfig,
   resolveAuth,
   uploadAppBuild
-} from "./chunk-2WTLJ66O.js";
+} from "./chunk-SYFMOPJW.js";
 
 // src/lib/dev-state.ts
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";

package/dist/{chunk-2WTLJ66O.js → chunk-SYFMOPJW.js}

@@ -424,6 +424,38 @@ var ApiClient = class {
   async deleteSigningCredential(id) {
     await this.requestRaw("DELETE", `/signing-credentials/${id}`);
   }
+  /**
+   * POST /api/v1/signing-credentials/generate. Requires ADMIN role. Generates an Android
+   * keystore server-side and stores it as a credential; the response is the
+   * ONLY time the keystore bytes and passwords are ever returned. As with
+   * addSigningCredential, the CLI's camelCase (`keyAlias`) is converted to
+   * the route's snake_case at this boundary and nowhere else.
+   */
+  async generateSigningCredential(body) {
+    return this.requestRaw("POST", "/signing-credentials/generate", {
+      name: body.name,
+      ...body.app !== void 0 ? { app: body.app } : {},
+      ...body.keyAlias !== void 0 ? { key_alias: body.keyAlias } : {},
+      ...body.overwrite !== void 0 ? { overwrite: body.overwrite } : {}
+    });
+  }
+  async listWebhooks() {
+    return this.requestRaw("GET", "/webhooks");
+  }
+  async addWebhook(body) {
+    return this.requestRaw("POST", "/webhooks", {
+      url: body.url,
+      ...body.secret !== void 0 ? { secret: body.secret } : {}
+    });
+  }
+  async deleteWebhook(id) {
+    await this.requestRaw("DELETE", `/webhooks/${id}`);
+  }
+  /** Kicks off an async `ping` delivery; the result lands in the endpoint's
+   *  last_delivery within ~10–15 s — poll listWebhooks() for it. */
+  async testWebhook(id) {
+    return this.requestRaw("POST", `/webhooks/${id}/test`);
+  }
 };
 function parseContentDispositionFilename(header) {
   if (!header) return void 0;

package/dist/cli.js

@@ -13,7 +13,7 @@ import {
   readDevState,
   readMetroState,
   runAgentVerb
-} from "./chunk-BQRAY3BV.js";
+} from "./chunk-3IMJ7FNN.js";
 import {
   ApiClient,
   EXIT_INFRA_ERROR,
@@ -26,7 +26,7 @@ import {
   resolveAuth,
   saveConfig,
   uploadApp
-} from "./chunk-2WTLJ66O.js";
+} from "./chunk-SYFMOPJW.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -1173,13 +1173,13 @@ function formatBuildsHuman(builds2) {
   ]);
   const widths = HEADERS.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
   const padCells = (cells) => cells.map((c, i) => c.padEnd(widths[i]));
-  const join2 = (cells) => cells.join("  ").trimEnd();
-  const lines = [chalk10.bold(join2(padCells(HEADERS)))];
+  const join3 = (cells) => cells.join("  ").trimEnd();
+  const lines = [chalk10.bold(join3(padCells(HEADERS)))];
   for (const row of rows) {
     const padded = padCells(row);
     const colorFn = STATUS_COLOR[row[2]] ?? ((s) => s);
     padded[2] = colorFn(row[2]) + padded[2].slice(row[2].length);
-    lines.push(join2(padded));
+    lines.push(join3(padded));
   }
   return lines.join("\n") + "\n";
 }
@@ -1526,9 +1526,9 @@ function formatEnvVarsHuman(variables) {
   ]);
   const widths = HEADERS3.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
   const padCells = (cells) => cells.map((c, i) => c.padEnd(widths[i]));
-  const join2 = (cells) => cells.join("  ").trimEnd();
-  const lines = [chalk13.bold(join2(padCells(HEADERS3)))];
-  for (const row of rows) lines.push(join2(padCells(row)));
+  const join3 = (cells) => cells.join("  ").trimEnd();
+  const lines = [chalk13.bold(join3(padCells(HEADERS3)))];
+  for (const row of rows) lines.push(join3(padCells(row)));
   return lines.join("\n") + "\n";
 }
 async function envSet(name, value, opts, deps) {
@@ -1662,8 +1662,14 @@ function printError2(opts, err) {
 }
 
 // src/commands/credentials.ts
-import { readFile as readFileAsync2 } from "fs/promises";
-import { basename as basename2, extname } from "path";
+import {
+  access,
+  chmod as chmodAsync,
+  readFile as readFileAsync2,
+  writeFile as writeFileAsync
+} from "fs/promises";
+import { mkdirSync } from "fs";
+import { basename as basename2, extname, join } from "path";
 import chalk14 from "chalk";
 import { input, password as password2 } from "@inquirer/prompts";
 function clientFor2(opts) {
@@ -1703,9 +1709,19 @@ function defaultDeps4(client) {
       }
       await client.deleteSigningCredential(match.id);
     },
+    generateCredential: (body) => client.generateSigningCredential(body),
     prompt: ({ message, hidden }) => hidden ? password2({ message }) : input({ message }),
     isTTY: Boolean(process.stdin.isTTY),
     readFile: (path) => readFileAsync2(path),
+    fileExists: (path) => access(path).then(
+      () => true,
+      () => false
+    ),
+    // Same precedent as api-client.ts's artifact download: recursive, so an
+    // already-existing directory is a no-op rather than an error.
+    mkdir: (dir) => mkdirSync(dir, { recursive: true }),
+    writeFile: (path, data, mode) => writeFileAsync(path, data, mode !== void 0 ? { mode } : void 0),
+    chmod: (path, mode) => chmodAsync(path, mode),
     warn: (message) => console.error(chalk14.yellow(`warning: ${message}`))
   };
 }
@@ -1783,15 +1799,86 @@ async function credentialsAdd(opts, deps) {
     process.exitCode = 1;
   }
 }
+async function credentialsGenerate(opts, deps) {
+  const d = deps ?? defaultDeps4(clientFor2(opts));
+  if (!opts.platform) {
+    throw new UsageError('--platform is required ("android" is the only platform available)');
+  }
+  if (opts.platform !== "android") {
+    throw new UsageError(
+      "iOS/tvOS generation isn't available yet because it requires an Apple Developer account; upload an exported certificate with `vibeview credentials add` instead"
+    );
+  }
+  if (!opts.name) {
+    throw new UsageError("--name is required");
+  }
+  const outDir = opts.out ?? process.cwd();
+  try {
+    d.mkdir(outDir);
+    const expectedPath = join(outDir, `${opts.name}.keystore`);
+    if (await d.fileExists(expectedPath)) {
+      throw new Error(
+        `${expectedPath} already exists \u2014 refusing to overwrite it. Move it away or pass a different --out/--name.`
+      );
+    }
+    const result = await d.generateCredential({
+      name: opts.name,
+      ...opts.app !== void 0 ? { app: opts.app } : {},
+      ...opts.alias !== void 0 ? { keyAlias: opts.alias } : {},
+      // Only ever sent as `overwrite: true` — omitting the field entirely
+      // otherwise keeps the server's default (409 on a name collision) in
+      // charge, so a stale CLI can never accidentally opt out of it.
+      ...opts.force ? { overwrite: true } : {}
+    });
+    const savedTo = join(outDir, basename2(result.filename));
+    if (opts.json) {
+      console.log(JSON.stringify({ ...result, saved_to: savedTo }));
+    }
+    try {
+      if (await d.fileExists(savedTo)) {
+        throw new Error(`${savedTo} already exists \u2014 refusing to overwrite it.`);
+      }
+      await d.writeFile(savedTo, Buffer.from(result.keystore_base64, "base64"), 384);
+      await d.chmod(savedTo, 384);
+    } catch (writeErr) {
+      printKeystoreWriteFailure(opts, writeErr, result);
+      process.exitCode = 1;
+      return;
+    }
+    if (opts.json) {
+    } else {
+      console.log(chalk14.green(`\u2713 generated ${result.name} (android)`));
+      console.log("");
+      console.log(`  Keystore saved to: ${chalk14.bold(savedTo)}`);
+      console.log(`  Key alias:         ${chalk14.bold(result.key_alias)}`);
+      console.log(`  Store password:    ${chalk14.bold(result.store_password)}`);
+      console.log(`  Key password:      ${chalk14.bold(result.key_password)}`);
+      console.log("");
+      console.log(
+        chalk14.yellow(
+          "  These are shown ONCE \u2014 VibeView cannot recover the keystore file or its passwords. Back them up somewhere safe."
+        )
+      );
+      console.log(
+        chalk14.yellow(
+          "  The credential is already uploaded and active for android and androidtv production builds."
+        )
+      );
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError3(opts, err);
+    process.exitCode = 1;
+  }
+}
 async function credentialsList(opts, deps) {
   const d = deps ?? defaultDeps4(clientFor2(opts));
   try {
     const { credentials: credentials2 } = await d.listCredentials(opts.app);
     for (const c of credentials2) {
       if (c.expires_soon) {
-        d.warn(
-          `${c.name} (${c.platform}) is expiring soon${c.expires_at ? ` \u2014 ${c.expires_at}` : ""}.`
-        );
+        const soonest = earliestExpiry(c);
+        d.warn(`${c.name} (${c.platform}) is expiring soon${soonest ? ` \u2014 ${soonest}` : ""}.`);
       }
     }
     if (opts.json) {
@@ -1813,6 +1900,23 @@ function formatIdentity(c) {
   if (tag === "file-sha256") return `keystore-file sha256:${value}`;
   return c.platform === "android" ? `keystore-file sha256:${c.fingerprint}` : `cert sha1:${c.fingerprint}`;
 }
+function earliestExpiry(c) {
+  const dates = [c.expires_at, c.profile_expires_at].filter((d) => d != null);
+  if (dates.length === 0) return null;
+  return dates.sort()[0];
+}
+function formatExpires(c) {
+  const parts = [];
+  if (c.profile_expires_at) {
+    if (c.expires_at) parts.push(`cert ${c.expires_at}`);
+    parts.push(`profile ${c.profile_expires_at}`);
+  } else if (c.expires_at) {
+    parts.push(c.expires_at);
+  }
+  if (parts.length === 0) return "";
+  const cell = parts.join(" \xB7 ");
+  return c.expires_soon ? `${cell} (soon)` : cell;
+}
 function formatCredentialsHuman(credentials2) {
   if (credentials2.length === 0) {
     return "No signing credentials found.\n";
@@ -1823,13 +1927,13 @@ function formatCredentialsHuman(credentials2) {
     c.platform,
     c.app_public_id ?? "org-wide",
     formatIdentity(c),
-    c.expires_at ? c.expires_soon ? `${c.expires_at} (soon)` : c.expires_at : ""
+    formatExpires(c)
   ]);
   const widths = HEADERS3.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
   const padCells = (cells) => cells.map((c, i) => c.padEnd(widths[i]));
-  const join2 = (cells) => cells.join("  ").trimEnd();
-  const lines = [chalk14.bold(join2(padCells(HEADERS3)))];
-  for (const row of rows) lines.push(join2(padCells(row)));
+  const join3 = (cells) => cells.join("  ").trimEnd();
+  const lines = [chalk14.bold(join3(padCells(HEADERS3)))];
+  for (const row of rows) lines.push(join3(padCells(row)));
   return lines.join("\n") + "\n";
 }
 async function credentialsRm(name, opts, deps) {
@@ -1847,14 +1951,198 @@ async function credentialsRm(name, opts, deps) {
     process.exitCode = 1;
   }
 }
+function printKeystoreWriteFailure(opts, err, result) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (opts.json) {
+    console.log(JSON.stringify({ event: "error", message }));
+    console.error(chalk14.red(`error: ${message}`));
+    return;
+  }
+  console.error(chalk14.red(`error: ${message}`));
+  console.error(
+    chalk14.red(
+      `The keystore could NOT be saved locally, but the credential "${result.name}" WAS created server-side and its key material can never be re-fetched.`
+    )
+  );
+  console.error(chalk14.red("Recover it NOW from the values below \u2014 they will not be shown again:"));
+  console.error("");
+  console.error(`  Key alias:         ${result.key_alias}`);
+  console.error(`  Store password:    ${result.store_password}`);
+  console.error(`  Key password:      ${result.key_password}`);
+  console.error(`  Keystore (base64): ${result.keystore_base64}`);
+  console.error("");
+  console.error(
+    `  Restore the file with: echo '${result.keystore_base64}' | base64 -d > ${result.name}.keystore`
+  );
+}
 function printError3(opts, err) {
   const message = err instanceof Error ? err.message : String(err);
   if (opts.json) console.log(JSON.stringify({ event: "error", message }));
   console.error(chalk14.red(`error: ${message}`));
 }
 
-// src/lib/formatters/devices.ts
+// src/commands/webhooks.ts
 import chalk15 from "chalk";
+function clientFor3(opts) {
+  const { token, baseUrl } = resolveAuth(opts);
+  return new ApiClient(baseUrl, token);
+}
+function defaultDeps5(client) {
+  return {
+    addWebhook: (body) => client.addWebhook(body),
+    listWebhooks: () => client.listWebhooks(),
+    deleteWebhook: (id) => client.deleteWebhook(id),
+    testWebhook: (id) => client.testWebhook(id),
+    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+    now: Date.now
+  };
+}
+async function webhooksAdd(opts, deps) {
+  if (!opts.url) {
+    throw new UsageError("--url is required");
+  }
+  if (!opts.url.startsWith("https://")) {
+    throw new UsageError(`--url must start with https:// (got "${opts.url}")`);
+  }
+  const d = deps ?? defaultDeps5(clientFor3(opts));
+  try {
+    const result = await d.addWebhook({
+      url: opts.url,
+      ...opts.secret !== void 0 ? { secret: opts.secret } : {}
+    });
+    if (opts.json) {
+      console.log(JSON.stringify(result));
+    } else {
+      console.log(chalk15.green(`\u2713 added ${result.id} ${result.url}`));
+      console.log("");
+      console.log(`  Signing secret: ${chalk15.bold(result.secret)}`);
+      if (opts.secret !== void 0) {
+        console.log(chalk15.yellow("  (This is the secret you provided.)"));
+      }
+      console.log(
+        chalk15.yellow("  This secret is shown ONCE and cannot be retrieved again \u2014 store it now.")
+      );
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError4(opts, err);
+    process.exitCode = 1;
+  }
+}
+function formatLastDelivery(ld) {
+  if (!ld) return "\u2014";
+  if (ld.status === "pending") return "pending";
+  const code = ld.response_code != null ? ` (${ld.response_code})` : "";
+  const at = ld.at != null ? ` ${ld.at}` : "";
+  return `${ld.status}${code}${at}`;
+}
+function formatWebhooksHuman(webhooks2) {
+  if (webhooks2.length === 0) {
+    return "No webhooks found.\n";
+  }
+  const HEADERS3 = ["ID", "URL", "ACTIVE", "LAST DELIVERY", "CREATED"];
+  const rows = webhooks2.map((w) => [
+    w.id,
+    w.url,
+    w.active ? "yes" : "no",
+    formatLastDelivery(w.last_delivery),
+    w.created_at
+  ]);
+  const widths = HEADERS3.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+  const padCells = (cells) => cells.map((c, i) => c.padEnd(widths[i]));
+  const join3 = (cells) => cells.join("  ").trimEnd();
+  const lines = [chalk15.bold(join3(padCells(HEADERS3)))];
+  for (const row of rows) lines.push(join3(padCells(row)));
+  return lines.join("\n") + "\n";
+}
+async function webhooksList(opts, deps) {
+  const d = deps ?? defaultDeps5(clientFor3(opts));
+  try {
+    const { webhooks: webhooks2 } = await d.listWebhooks();
+    if (opts.json) {
+      console.log(JSON.stringify(webhooks2, null, 2));
+    } else {
+      process.stdout.write(formatWebhooksHuman(webhooks2));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError4(opts, err);
+    process.exitCode = 1;
+  }
+}
+async function webhooksRm(id, opts, deps) {
+  const d = deps ?? defaultDeps5(clientFor3(opts));
+  try {
+    await d.deleteWebhook(id);
+    if (opts.json) {
+      console.log(JSON.stringify({ event: "deleted", id }));
+    } else {
+      console.log(chalk15.green(`\u2713 removed ${id}`));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError4(opts, err);
+    process.exitCode = 1;
+  }
+}
+function parseUtcTimestamp(iso) {
+  if (iso.endsWith("Z") || iso.endsWith("z")) {
+    return Date.parse(iso);
+  }
+  const timePart = iso.slice(10);
+  if (timePart.includes("+") || timePart.includes("-")) {
+    return Date.parse(iso);
+  }
+  return Date.parse(iso + "Z");
+}
+var TEST_POLL_INTERVAL_MS = 3e3;
+var TEST_POLL_BUDGET_MS = 6e4;
+async function webhooksTest(id, opts, deps) {
+  const d = deps ?? defaultDeps5(clientFor3(opts));
+  try {
+    const startedAt = d.now();
+    await d.testWebhook(id);
+    while (d.now() - startedAt < TEST_POLL_BUDGET_MS) {
+      await d.sleep(TEST_POLL_INTERVAL_MS);
+      const { webhooks: webhooks2 } = await d.listWebhooks();
+      const ld = webhooks2.find((w) => w.id === id)?.last_delivery;
+      if (ld && ld.status !== "pending" && ld.at != null && parseUtcTimestamp(ld.at) >= startedAt) {
+        if (opts.json) console.log(JSON.stringify(ld));
+        if (ld.status === "succeeded") {
+          if (!opts.json) {
+            console.log(chalk15.green(`\u2713 Delivered (HTTP ${ld.response_code})`));
+          }
+          process.exitCode = 0;
+        } else {
+          if (!opts.json) {
+            const code = ld.response_code != null ? `HTTP ${ld.response_code}` : "no response";
+            console.error(chalk15.red(`\u2717 Failed (${code}) at ${ld.at}`));
+          }
+          process.exitCode = 1;
+        }
+        return;
+      }
+    }
+    if (opts.json) console.log(JSON.stringify({ status: "pending" }));
+    console.error(
+      chalk15.yellow(
+        `Delivery still pending after ${TEST_POLL_BUDGET_MS / 1e3}s \u2014 check \`vibeview webhooks list\` later for the result.`
+      )
+    );
+    process.exitCode = 1;
+  } catch (err) {
+    printError4(opts, err);
+    process.exitCode = 1;
+  }
+}
+function printError4(opts, err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (opts.json) console.log(JSON.stringify({ event: "error", message }));
+  console.error(chalk15.red(`error: ${message}`));
+}
+
+// src/lib/formatters/devices.ts
+import chalk16 from "chalk";
 var HEADERS2 = ["DEVICE_ID", "NAME", "TYPE", "CATEGORY", "OS", "STATUS"];
 function formatDevicesHuman(devices) {
   if (devices.length === 0) {
@@ -1870,9 +2158,9 @@ function formatDevicesHuman(devices) {
   ]);
   const widths = HEADERS2.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
   const fmt = (cells) => cells.map((c, i) => c.padEnd(widths[i])).join("  ").trimEnd();
-  const lines = [chalk15.bold(fmt(HEADERS2))];
+  const lines = [chalk16.bold(fmt(HEADERS2))];
   for (const row of rows.sort(rowSort)) {
-    const statusColored = row[5] === "available" ? chalk15.green(row[5]) : row[5] === "busy" ? chalk15.yellow(row[5]) : chalk15.dim(row[5]);
+    const statusColored = row[5] === "available" ? chalk16.green(row[5]) : row[5] === "busy" ? chalk16.yellow(row[5]) : chalk16.dim(row[5]);
     lines.push(fmt([row[0], row[1], row[2], row[3], row[4], statusColored]));
   }
   return lines.join("\n") + "\n";
@@ -1956,28 +2244,28 @@ function readMetadataFile(path) {
 }
 
 // src/commands/agent-setup.ts
-import { copyFileSync, existsSync as existsSync2, mkdirSync } from "fs";
+import { copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
 import { homedir } from "os";
-import { dirname, join } from "path";
+import { dirname, join as join2 } from "path";
 import { fileURLToPath } from "url";
 import { spawnSync } from "child_process";
 import { confirm } from "@inquirer/prompts";
-import chalk16 from "chalk";
+import chalk17 from "chalk";
 function resolveShippedSkillPath(fromDir) {
-  for (const rel of ["..", join("..", "..")]) {
-    const candidate = join(fromDir, rel, "skills", "vibeview-agent", "SKILL.md");
+  for (const rel of ["..", join2("..", "..")]) {
+    const candidate = join2(fromDir, rel, "skills", "vibeview-agent", "SKILL.md");
     if (existsSync2(candidate)) return candidate;
   }
   return null;
 }
 function skillInstallDir(project, cwd, home) {
   const base = project ? cwd : home;
-  return join(base, ".claude", "skills", "vibeview-agent");
+  return join2(base, ".claude", "skills", "vibeview-agent");
 }
 function installSkill(shippedPath, targetDir) {
-  const target = join(targetDir, "SKILL.md");
+  const target = join2(targetDir, "SKILL.md");
   const existed = existsSync2(target);
-  mkdirSync(targetDir, { recursive: true });
+  mkdirSync2(targetDir, { recursive: true });
   copyFileSync(shippedPath, target);
   return existed ? "updated" : "installed";
 }
@@ -1990,23 +2278,23 @@ function registerMcp() {
     encoding: "utf8"
   });
   if (res.status === 0) {
-    console.log(chalk16.green("\u2713 MCP server registered with Claude Code (claude mcp add vibeview)"));
+    console.log(chalk17.green("\u2713 MCP server registered with Claude Code (claude mcp add vibeview)"));
     return;
   }
   const out = `${res.stderr ?? ""}${res.stdout ?? ""}`;
   if (out.includes("already exists")) {
-    console.log(chalk16.dim("MCP server already registered with Claude Code \u2014 nothing to do"));
+    console.log(chalk17.dim("MCP server already registered with Claude Code \u2014 nothing to do"));
     return;
   }
-  console.error(chalk16.yellow(`\u26A0 could not register the MCP server: ${out.trim() || res.error}`));
-  console.error(chalk16.yellow("  register it manually: claude mcp add vibeview -- vibeview mcp"));
+  console.error(chalk17.yellow(`\u26A0 could not register the MCP server: ${out.trim() || res.error}`));
+  console.error(chalk17.yellow("  register it manually: claude mcp add vibeview -- vibeview mcp"));
 }
 async function agentSetup(opts) {
   const moduleDir = dirname(fileURLToPath(import.meta.url));
   const shipped = resolveShippedSkillPath(moduleDir);
   if (!shipped) {
     console.error(
-      chalk16.red(
+      chalk17.red(
         "error: could not find the packaged skill (skills/vibeview-agent/SKILL.md) \u2014 is this a complete install of the vibeview package?"
       )
     );
@@ -2015,9 +2303,9 @@ async function agentSetup(opts) {
   }
   const targetDir = skillInstallDir(opts.project ?? false, process.cwd(), homedir());
   const result = installSkill(shipped, targetDir);
-  console.log(chalk16.green(`\u2713 vibeview-agent skill ${result}: ${join(targetDir, "SKILL.md")}`));
+  console.log(chalk17.green(`\u2713 vibeview-agent skill ${result}: ${join2(targetDir, "SKILL.md")}`));
   console.log(
-    chalk16.dim(
+    chalk17.dim(
       opts.project ? "  Claude Code discovers it automatically for anyone working in this project." : "  Claude Code discovers it automatically in every project on this machine."
     )
   );
@@ -2025,7 +2313,7 @@ async function agentSetup(opts) {
     if (!claudeCliAvailable()) {
       if (opts.mcp === true) {
         console.error(
-          chalk16.yellow(
+          chalk17.yellow(
             "\u26A0 claude CLI not found \u2014 install Claude Code, then run: claude mcp add vibeview -- vibeview mcp"
           )
         );
@@ -2039,7 +2327,7 @@ async function agentSetup(opts) {
   }
   console.log(
     `
-Suggested line for your project's ${chalk16.bold("CLAUDE.md")} (or ${chalk16.bold(
+Suggested line for your project's ${chalk17.bold("CLAUDE.md")} (or ${chalk17.bold(
       "AGENTS.md"
     )} for other agents):
 `
@@ -2047,7 +2335,7 @@ Suggested line for your project's ${chalk16.bold("CLAUDE.md")} (or ${chalk16.bol
   console.log(`  ${CLAUDE_MD_SUGGESTION}
 `);
   console.log(
-    chalk16.dim(
+    chalk17.dim(
       "Other agents (Cursor, Copilot, Codex, ...): point them at the skill file above, or\nadd the MCP server per client \u2014 see https://vibeview.io/docs/agent-control"
     )
   );
@@ -2239,14 +2527,35 @@ credentials.command("add").description(
   "--profile <path>",
   "ios/tvos: the .mobileprovision file (required; tvOS profiles are distinct from iOS ones)"
 ).option("--app <id>", "Scope to a single app (default: org-wide)").option("--name <name>", "Credential name (default: the file basename without extension)").action((opts) => credentialsAdd(opts));
+credentials.command("generate").description(
+  "Generate an Android keystore server-side and store it as a signing credential. Saves the keystore file locally and prints its passwords ONCE \u2014 they can never be retrieved again."
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option(
+  "--platform <platform>",
+  "android (iOS/tvOS certificates require an Apple Developer account)"
+).option("--name <name>", "Credential name").option("--app <id>", "Scope to a single app (default: org-wide)").option("--alias <alias>", "Key alias (default: server-chosen)").option("--out <dir>", "Directory to save the keystore file into (default: current directory)").option(
+  "--force",
+  "Replace an existing credential of the same name \u2014 irreversible; breaks Play Store updates signed with the old key",
+  false
+).option(
+  "--json",
+  "Print the raw generation response (including the one-time secrets) as JSON",
+  false
+).action((opts) => credentialsGenerate(opts));
 credentials.command("list").description("List signing credentials (never prints key material)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide credentials only)").option("--json", "Print the raw credential list as a JSON array", false).action((opts) => credentialsList(opts));
 credentials.command("rm <name>").description("Remove a signing credential (replace by rm then add)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide)").option("--json", "Print the result as one JSON line", false).action((name, opts) => credentialsRm(name, opts));
+var webhooks = program.command("webhooks").description("Manage build-completion webhook endpoints");
+webhooks.command("add").description(
+  "Add a webhook endpoint (HTTPS only). Prints the signing secret ONCE \u2014 it can never be retrieved again."
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--url <url>", "The HTTPS URL to POST build events to").option("--secret <secret>", "Your own signing secret (default: server-generated)").option("--json", "Print the raw creation response (including the secret) as JSON", false).action((opts) => webhooksAdd(opts));
+webhooks.command("list").description("List webhook endpoints with their last delivery status (never prints secrets)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the raw webhook list as a JSON array", false).action((opts) => webhooksList(opts));
+webhooks.command("rm <id>").description("Remove a webhook endpoint (rotate the secret by rm then add)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the result as one JSON line", false).action((id, opts) => webhooksRm(id, opts));
+webhooks.command("test <id>").description("Send a ping delivery and wait up to 60s for the result").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the final delivery result as one JSON line", false).action((id, opts) => webhooksTest(id, opts));
 program.command("dev-status").description("Show the status of a `vibeview dev --detach` session in this project").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print as one JSON line", false).action((opts) => devStatus(opts));
 program.command("dev-stop").description("Stop a `vibeview dev --detach` session in this project").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print as one JSON line", false).action((opts) => devStop(opts));
 program.command("mcp").description(
   "Run an MCP stdio server exposing the agent verbs (tap, swipe, type, ...) plus dev_start/dev_stop as tools"
 ).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").action(async (opts) => {
-  const { runMcpServer } = await import("./server-GFRDOV2H.js");
+  const { runMcpServer } = await import("./server-AZLB25BY.js");
   await runMcpServer(opts);
 });
 program.command("agent-setup").description(

package/dist/{server-GFRDOV2H.js → server-AZLB25BY.js}

@@ -11,11 +11,11 @@ import {
   readDevState,
   renderEnvelope,
   startDevSession
-} from "./chunk-BQRAY3BV.js";
+} from "./chunk-3IMJ7FNN.js";
 import {
   ApiClient,
   resolveAuth
-} from "./chunk-2WTLJ66O.js";
+} from "./chunk-SYFMOPJW.js";
 
 // src/mcp/server.ts
 import { writeFileSync } from "fs";
@@ -239,7 +239,7 @@ async function handleUploadApp(args, deps) {
   }
   const name = typeof args.name === "string" && args.name ? args.name : void 0;
   const upload = deps.uploadApp ?? (async (f, n) => {
-    const { uploadAppBuild } = await import("./upload-app-NVPQ7KRO.js");
+    const { uploadAppBuild } = await import("./upload-app-XRB7CKA3.js");
     const { result: result2 } = await uploadAppBuild(f, { ...deps.auth, name: n });
     return result2;
   });

package/dist/{upload-app-NVPQ7KRO.js → upload-app-XRB7CKA3.js}

@@ -2,7 +2,7 @@
 import {
   uploadApp,
   uploadAppBuild
-} from "./chunk-2WTLJ66O.js";
+} from "./chunk-SYFMOPJW.js";
 export {
   uploadApp,
   uploadAppBuild

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibeview",
-  "version": "0.16.0",
+  "version": "0.17.1",
   "description": "VibeView CLI -- run mobile tests from CI/CD pipelines",
   "type": "module",
   "bin": {