yaver-cli 1.99.446 → 1.99.448

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yaver-cli",
-  "version": "1.99.446",
+  "version": "1.99.448",
   "mcpName": "io.github.yaver-io/yaver",
   "description": "Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime",
   "bin": {
@@ -49,5 +49,8 @@
   "dependencies": {
     "semver": "^7.6.0",
     "yaver-mobile-headless": "^0.1.2"
+  },
+  "overrides": {
+    "@modelcontextprotocol/sdk": "^1.30.0"
   }
 }

package/sdk-manifest.json

@@ -1,6 +1,6 @@
 {
   "sdkVersion": "1.0.0",
-  "expo": "54.0.33",
+  "expo": "54.0.37",
   "reactNative": "0.81.5",
   "react": "19.1.0",
   "hermes": {
@@ -16,9 +16,9 @@
   "runtimeFamilies": [
     {
       "id": "family-a",
-      "label": "Family A · Expo 54.0.33 / RN 0.81.5 / React 19.1.0 / BC96",
+      "label": "Family A · Expo 54.0.37 / RN 0.81.5 / React 19.1.0 / BC96",
       "sdkVersion": "1.0.0",
-      "expoVersion": "54.0.33",
+      "expoVersion": "54.0.37",
       "reactNativeVersion": "0.81.5",
       "reactVersion": "19.1.0",
       "hermesVersion": "0.81.5",
@@ -31,7 +31,6 @@
     }
   ],
   "nativeModules": {
-    "@amplitude/analytics-react-native": "1.5.52",
     "@intercom/intercom-react-native": "10.0.0",
     "@notifee/react-native": "9.1.8",
     "@react-native-async-storage/async-storage": "2.2.0",
@@ -44,10 +43,9 @@
     "@react-native-ml-kit/text-recognition": "2.0.0",
     "@react-native-picker/picker": "2.11.1",
     "@react-native-segmented-control/segmented-control": "2.5.7",
-    "@sentry/react-native": "8.8.0",
     "@shopify/react-native-skia": "2.2.12",
     "expo-apple-authentication": "8.0.8",
-    "expo-asset": "12.0.12",
+    "expo-asset": "12.0.13",
     "expo-av": "16.0.8",
     "expo-background-fetch": "14.0.9",
     "expo-battery": "10.0.8",
@@ -56,28 +54,28 @@
     "expo-calendar": "15.0.8",
     "expo-camera": "17.0.10",
     "expo-clipboard": "8.0.8",
-    "expo-constants": "18.0.13",
+    "expo-constants": "18.0.14",
     "expo-contacts": "15.0.11",
-    "expo-crypto": "15.0.8",
+    "expo-crypto": "15.0.9",
     "expo-device": "8.0.10",
     "expo-document-picker": "14.0.8",
-    "expo-file-system": "19.0.21",
-    "expo-font": "14.0.11",
-    "expo-glass-effect": "55.0.11",
+    "expo-file-system": "19.0.24",
+    "expo-font": "14.0.12",
+    "expo-glass-effect": "0.1.10",
     "expo-haptics": "15.0.8",
     "expo-image": "3.0.11",
     "expo-image-manipulator": "14.0.8",
-    "expo-image-picker": "17.0.10",
+    "expo-image-picker": "17.0.11",
     "expo-keep-awake": "15.0.8",
     "expo-linear-gradient": "15.0.8",
-    "expo-linking": "8.0.11",
-    "expo-local-authentication": "17.0.8",
-    "expo-localization": "17.0.8",
+    "expo-linking": "8.0.12",
+    "expo-local-authentication": "17.0.9",
+    "expo-localization": "17.0.9",
     "expo-location": "19.0.8",
-    "expo-mail-composer": "55.0.13",
-    "expo-notifications": "0.32.16",
+    "expo-mail-composer": "15.0.8",
+    "expo-notifications": "0.32.17",
     "expo-print": "15.0.8",
-    "expo-screen-orientation": "9.0.8",
+    "expo-screen-orientation": "9.0.9",
     "expo-secure-store": "15.0.8",
     "expo-sensors": "15.0.8",
     "expo-share-intent": "5.1.1",
@@ -87,17 +85,17 @@
     "expo-sqlite": "16.0.10",
     "expo-system-ui": "6.0.9",
     "expo-task-manager": "14.0.9",
-    "expo-updates": "29.0.16",
+    "expo-updates": "29.0.20",
     "expo-video": "3.0.16",
     "expo-video-thumbnails": "10.0.8",
-    "expo-web-browser": "15.0.10",
+    "expo-web-browser": "15.0.11",
     "lottie-react-native": "7.3.6",
     "react-native-audio-api": "0.11.7",
     "react-native-ble-plx": "3.5.1",
     "react-native-device-info": "15.0.2",
     "react-native-gesture-handler": "2.28.0",
     "react-native-get-random-values": "1.11.0",
-    "react-native-keyboard-controller": "1.21.5",
+    "react-native-keyboard-controller": "1.18.5",
     "react-native-maps": "1.20.1",
     "react-native-mmkv": "4.3.0",
     "react-native-nitro-image": "0.13.1",
@@ -116,17 +114,10 @@
     "react-native-view-shot": "4.0.3",
     "react-native-vision-camera": "4.7.3",
     "react-native-webview": "13.15.0",
-    "react-native-worklets": "0.7.4",
+    "react-native-worklets": "0.5.1",
     "whisper.rn": "0.5.5"
   },
   "moduleSupport": {
-    "@amplitude/analytics-react-native": {
-      "version": "1.5.52",
-      "hostApp": true,
-      "cliPush": true,
-      "agentOpenInYaver": true,
-      "pluginEnabled": false
-    },
     "@intercom/intercom-react-native": {
       "version": "10.0.0",
       "hostApp": true,
@@ -211,13 +202,6 @@
       "agentOpenInYaver": true,
       "pluginEnabled": false
     },
-    "@sentry/react-native": {
-      "version": "8.8.0",
-      "hostApp": true,
-      "cliPush": true,
-      "agentOpenInYaver": true,
-      "pluginEnabled": false
-    },
     "@shopify/react-native-skia": {
       "version": "2.2.12",
       "hostApp": true,
@@ -233,7 +217,7 @@
       "pluginEnabled": true
     },
     "expo-asset": {
-      "version": "12.0.12",
+      "version": "12.0.13",
       "hostApp": true,
       "cliPush": true,
       "agentOpenInYaver": true,
@@ -296,7 +280,7 @@
       "pluginEnabled": false
     },
     "expo-constants": {
-      "version": "18.0.13",
+      "version": "18.0.14",
       "hostApp": true,
       "cliPush": true,
       "agentOpenInYaver": true,
@@ -310,7 +294,7 @@
       "pluginEnabled": false
     },
     "expo-crypto": {
-      "version": "15.0.8",
+      "version": "15.0.9",
       "hostApp": true,
       "cliPush": true,
       "agentOpenInYaver": true,
@@ -331,21 +315,21 @@
       "pluginEnabled": false
     },
     "expo-file-system": {
-      "version": "19.0.21",
+      "version": "19.0.24",
       "hostApp": true,
       "cliPush": true,
       "agentOpenInYaver": true,
       "pluginEnabled": false
     },
     "expo-font": {
-      "version": "14.0.11",
+      "version": "14.0.12",
       "hostApp": true,
       "cliPush": true,
       "agentOpenInYaver": true,
       "pluginEnabled": true
     },
     "expo-glass-effect": {
-      "version": "55.0.11",
+      "version": "0.1.10",
       "hostApp": true,
       "cliPush": true,
       "agentOpenInYaver": true,
@@ -373,7 +357,7 @@
       "pluginEnabled": false
     },
     "expo-image-picker": {
-      "version": "17.0.10",
+      "version": "17.0.11",
       "hostApp": true,
       "cliPush": true,
       "agentOpenInYaver": true,
@@ -394,21 +378,21 @@
       "pluginEnabled": false
     },
     "expo-linking": {
-      "version": "8.0.11",
+      "version": "8.0.12",
       "hostApp": true,
       "cliPush": true,
       "agentOpenInYaver": true,
       "pluginEnabled": false
     },
     "expo-local-authentication": {
-      "version": "17.0.8",
+      "version": "17.0.9",
       "hostApp": true,
       "cliPush": true,
       "agentOpenInYaver": true,
       "pluginEnabled": false
     },
     "expo-localization": {
-      "version": "17.0.8",
+      "version": "17.0.9",
       "hostApp": true,
       "cliPush": true,
       "agentOpenInYaver": true,
@@ -422,14 +406,14 @@
       "pluginEnabled": true
     },
     "expo-mail-composer": {
-      "version": "55.0.13",
+      "version": "15.0.8",
       "hostApp": true,
       "cliPush": true,
       "agentOpenInYaver": true,
       "pluginEnabled": true
     },
     "expo-notifications": {
-      "version": "0.32.16",
+      "version": "0.32.17",
       "hostApp": true,
       "cliPush": true,
       "agentOpenInYaver": true,
@@ -443,7 +427,7 @@
       "pluginEnabled": false
     },
     "expo-screen-orientation": {
-      "version": "9.0.8",
+      "version": "9.0.9",
       "hostApp": true,
       "cliPush": true,
       "agentOpenInYaver": true,
@@ -513,7 +497,7 @@
       "pluginEnabled": false
     },
     "expo-updates": {
-      "version": "29.0.16",
+      "version": "29.0.20",
       "hostApp": true,
       "cliPush": true,
       "agentOpenInYaver": true,
@@ -534,7 +518,7 @@
       "pluginEnabled": false
     },
     "expo-web-browser": {
-      "version": "15.0.10",
+      "version": "15.0.11",
       "hostApp": true,
       "cliPush": true,
       "agentOpenInYaver": true,
@@ -583,7 +567,7 @@
       "pluginEnabled": false
     },
     "react-native-keyboard-controller": {
-      "version": "1.21.5",
+      "version": "1.18.5",
       "hostApp": true,
       "cliPush": true,
       "agentOpenInYaver": true,
@@ -716,7 +700,7 @@
       "pluginEnabled": false
     },
     "react-native-worklets": {
-      "version": "0.7.4",
+      "version": "0.5.1",
       "hostApp": true,
       "cliPush": true,
       "agentOpenInYaver": true,

package/src/agent-runtime.js

@@ -237,23 +237,17 @@ async function downloadAndCacheAgent(asset, { quiet }) {
   if (process.platform !== 'win32') {
     fs.chmodSync(binaryPath, 0o755);
   }
-  // Proactively strip macOS quarantine + re-adhoc-sign on
-  // freshly-downloaded binaries. Without this:
-  //   - Gatekeeper SIGKILLs the first exec because Yaver release
-  //     tarballs are not notarized (adhoc-signed at link time only).
-  //   - If the Go linker's adhoc signature didn't survive the tarball
-  //     round-trip, the kernel refuses to load it ("load code
-  //     signature error 2"). codesign --force --sign - rebuilds a
-  //     valid adhoc signature against the current bytes.
-  // Doing both here means the happy path never sees SIGKILL in the
-  // first place.
+  // Strip quarantine, but preserve a valid release signature. Since CLI
+  // 1.99.446 the macOS artifacts are Developer ID signed and notarized in
+  // release-cli.yml. The old unconditional `codesign --sign -` below erased
+  // that identity after every download and silently downgraded the installed
+  // binary to ad-hoc. Only repair the signature when verification proves the
+  // archive produced an invalid Mach-O.
   if (process.platform === 'darwin') {
     try {
       spawnSync('xattr', ['-dr', 'com.apple.quarantine', binaryPath], { stdio: 'ignore' });
     } catch (_err) {}
-    try {
-      spawnSync('codesign', ['--force', '--sign', '-', binaryPath], { stdio: 'ignore' });
-    } catch (_err) {}
+    ensureValidMacSignature(binaryPath);
   }
   // Sanity-check the extracted binary. A truncated tarball or an
   // HTML error page saved as ".tar.gz" can leave us with a file that
@@ -402,25 +396,14 @@ async function attemptSigkillRecovery(binaryPath, { quiet = false } = {}) {
     } catch (_err) {}
     try { fs.chmodSync(binaryPath, 0o755); } catch (_err) {}
 
-    // 3. Re-adhoc-sign. When the agent's own self-update rewrites the
-    // binary in place, the original adhoc signature no longer
-    // matches the new contents and the kernel refuses to exec it
-    // (dmesg: "load code signature error 2"). `codesign --force
-    // --sign -` rebuilds the adhoc signature against the current
-    // bytes, which is all the kernel needs to let exec proceed.
-    try {
-      const result = spawnSync('codesign', ['--force', '--sign', '-', binaryPath], {
-        stdio: ['ignore', 'pipe', 'pipe'],
-        encoding: 'utf8',
-      });
-      if (result.status === 0) {
-        // Verify the resigned binary actually passes the kernel check
-        // now. If codesign succeeded we're done — the retry will work.
-        return 'resign-macos-adhoc';
-      }
-      // If codesign failed (e.g. missing developer tools), fall through
-      // to the quarantine-only return below.
-    } catch (_err) {}
+    // 3. Preserve a valid Developer ID signature. Only an actually invalid
+    // signature is replaced with an ad-hoc one. This keeps notarized release
+    // identity intact while retaining the self-heal for interrupted updates.
+    const signatureAction = ensureValidMacSignature(binaryPath);
+    if (signatureAction === 'preserve-valid-signature') {
+      return 'strip-macos-quarantine-preserve-signature';
+    }
+    if (signatureAction === 'resign-macos-adhoc') return signatureAction;
 
     return 'strip-macos-quarantine';
   }
@@ -746,10 +729,30 @@ async function extractTarball(archivePath, destDir) {
 
 module.exports = {
   ensureAgentBinary,
+  ensureValidMacSignature,
   resolveAgentInfo,
   runAgentCommand,
 };
 
+function ensureValidMacSignature(binaryPath, spawnImpl = spawnSync) {
+  try {
+    const verified = spawnImpl('codesign', ['--verify', '--strict', binaryPath], {
+      stdio: ['ignore', 'pipe', 'pipe'],
+      encoding: 'utf8',
+    });
+    if (verified.status === 0) return 'preserve-valid-signature';
+  } catch (_err) {}
+
+  try {
+    const repaired = spawnImpl('codesign', ['--force', '--sign', '-', binaryPath], {
+      stdio: ['ignore', 'pipe', 'pipe'],
+      encoding: 'utf8',
+    });
+    if (repaired.status === 0) return 'resign-macos-adhoc';
+  } catch (_err) {}
+  return 'signature-repair-failed';
+}
+
 function repoRoot() {
   return path.resolve(__dirname, '..', '..');
 }

package/src/discovery.js

@@ -1,7 +1,10 @@
 const http = require('http');
 const dgram = require('dgram');
 
-const YAVER_PORT = 8347;
+// Keep this aligned with desktop/agent's canonical HTTP listener. The old
+// mobile-prototype port (8347) made every manual/LAN probe miss a healthy
+// desktop agent on 18080.
+const YAVER_PORT = 18080;
 const BEACON_PORT = 19837;
 const DISCOVERY_TIMEOUT = 1500;
 const HEALTH_TIMEOUT = 1200;
@@ -25,12 +28,31 @@ async function discoverDevice(manualIp) {
 
   throw new Error(
     'No yaver.io device found on network.\n' +
-    '  Make sure the yaver.io app is open on your phone (same WiFi).\n' +
+    '  Make sure the Yaver desktop agent is running on the same Wi-Fi.\n' +
     '  Or specify device IP: yaver push --device <ip>'
   );
 }
 
-/** Listen for UDP beacon from yaver.io app */
+function deviceFromBeacon(msg, rinfo) {
+  try {
+    const beacon = JSON.parse(Buffer.isBuffer(msg) ? msg.toString() : String(msg));
+    if (beacon.v !== 1 || !beacon.p) return null;
+    const sender = rinfo && typeof rinfo.address === 'string' ? rinfo.address.trim() : '';
+    const advertised = typeof beacon.ip === 'string' ? beacon.ip.trim() : '';
+    const ip = advertised || sender;
+    if (!ip) return null;
+    return {
+      ip,
+      port: beacon.p,
+      name: beacon.n || 'Unknown Device',
+      id: beacon.id,
+    };
+  } catch {
+    return null;
+  }
+}
+
+/** Listen for UDP beacon from the Yaver desktop agent. */
 function listenForBeacon(timeout) {
   return new Promise((resolve) => {
     const socket = dgram.createSocket({ type: 'udp4', reuseAddr: true });
@@ -39,20 +61,13 @@ function listenForBeacon(timeout) {
       resolve(null);
     }, timeout);
 
-    socket.on('message', (msg) => {
-      try {
-        const beacon = JSON.parse(msg.toString());
-        if (beacon.v === 1 && beacon.p) {
-          clearTimeout(timer);
-          socket.close();
-          resolve({
-            ip: beacon.ip || socket.remoteAddress,
-            port: beacon.p,
-            name: beacon.n || 'Unknown Device',
-            id: beacon.id,
-          });
-        }
-      } catch {}
+    socket.on('message', (msg, rinfo) => {
+      const device = deviceFromBeacon(msg, rinfo);
+      if (device) {
+        clearTimeout(timer);
+        socket.close();
+        resolve(device);
+      }
     });
 
     socket.on('error', () => {
@@ -135,4 +150,4 @@ async function runLimited(items, limit, fn) {
   await Promise.all(workers);
 }
 
-module.exports = { discoverDevice, fetchHealth, scanLAN, YAVER_PORT };
+module.exports = { discoverDevice, deviceFromBeacon, fetchHealth, listenForBeacon, scanLAN, YAVER_PORT };