yaver-feedback-react-native 0.7.6 → 0.7.8

package/dist/FeedbackModal.js

@@ -105,18 +105,27 @@ const FeedbackModal = () => {
             await fn(client);
         }
         catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            // 401 / 403 "invalid token" — the cached session is stale
-            // (common after a Convex deployment migration). Sign out so
-            // the next interaction surfaces the login sheet, then bubble
-            // a readable error up to the user.
-            const authFailed = /\b(401|403)\b.*invalid token|invalid token|unauthor/i.test(msg);
+            const msg = (err instanceof Error ? err.message : String(err)) || '';
+            // Avoid unbounded `.*` in regex — on RN 0.81 / Hermes rope
+            // strings plus a background SSE reconnect, that pattern has
+            // reliably SIGSEGV'd Hermes's string-view flattening path.
+            // Split into short, literal-only alternations.
+            const lower = msg.toLowerCase();
+            const authFailed = lower.indexOf('invalid token') >= 0 ||
+                lower.indexOf('unauthor') >= 0 ||
+                lower.indexOf(' 401') >= 0 ||
+                lower.indexOf(' 403') >= 0;
             if (authFailed) {
                 await YaverFeedback_1.YaverFeedback.signOut();
                 YaverFeedback_1.YaverFeedback.showLogin();
                 throw new Error('Session expired — please sign in again.');
             }
-            const transient = /Network request failed|timeout|ECONNREFUSED|Failed to fetch|fetch failed|aborted/i.test(msg);
+            const transient = lower.indexOf('network request failed') >= 0 ||
+                lower.indexOf('econnrefused') >= 0 ||
+                lower.indexOf('failed to fetch') >= 0 ||
+                lower.indexOf('fetch failed') >= 0 ||
+                lower.indexOf('aborted') >= 0 ||
+                lower.indexOf('timeout') >= 0;
             if (!transient)
                 throw err;
             const ok = await YaverFeedback_1.YaverFeedback.reconnect();

package/dist/MachinePickerScreen.js

@@ -37,6 +37,7 @@ exports.YaverMachinePickerScreen = void 0;
 const react_1 = __importStar(require("react"));
 const react_native_1 = require("react-native");
 const auth_1 = require("./auth");
+const PairDeviceModal_1 = require("./PairDeviceModal");
 /**
  * List of remote dev machines the signed-in user can reach. Split into
  *   - Owned machines (user is the host)
@@ -51,6 +52,7 @@ const YaverMachinePickerScreen = ({ token, currentDeviceId, onPick, onCancel, })
     const [refreshing, setRefreshing] = (0, react_1.useState)(false);
     const [error, setError] = (0, react_1.useState)(null);
     const [list, setList] = (0, react_1.useState)({ owned: [], shared: [] });
+    const [pairingDevice, setPairingDevice] = (0, react_1.useState)(null);
     const load = (0, react_1.useCallback)(async (silent = false) => {
         if (!silent)
             setLoading(true);
@@ -74,6 +76,15 @@ const YaverMachinePickerScreen = ({ token, currentDeviceId, onPick, onCancel, })
         void load();
     }, [load]);
     const handlePick = async (device) => {
+        // Needs-auth device — show the in-SDK pair modal instead of
+        // treating the tap as a "pick". The user enters the 6-char code
+        // from their Mac terminal; the SDK POSTs it to /auth/pair/submit
+        // on the agent directly. Once the device flips out of bootstrap
+        // mode, the next load() picks up the fresh state.
+        if (device.isOnline && device.needsAuth) {
+            setPairingDevice(device);
+            return;
+        }
         await (0, auth_1.saveSelectedDeviceId)(device.deviceId);
         onPick(device);
     };
@@ -94,15 +105,33 @@ const YaverMachinePickerScreen = ({ token, currentDeviceId, onPick, onCancel, })
             : device.needsAuth
                 ? '#f59e0b'
                 : '#22c55e';
+        // Derive a single short status phrase the user can act on.
+        let statusLine = device.platform;
+        if (!device.isOnline) {
+            statusLine = 'Offline — start `yaver serve` on the Mac';
+        }
+        else if (device.needsAuth) {
+            statusLine =
+                'Needs pairing — open the Yaver app to adopt this machine';
+        }
+        else if (device.runnerDown) {
+            statusLine = 'Runner down — restart the coding agent on the Mac';
+        }
+        else {
+            // Happy-path subtitle: platform + optional host/share hint.
+            statusLine = device.platform;
+            if (device.isGuest && device.hostEmail) {
+                statusLine = `${statusLine} • ${device.hostEmail}`;
+            }
+            else if (device.accessScope === 'shared-scoped') {
+                statusLine = `${statusLine} • paylaşılan`;
+            }
+        }
         return (<react_native_1.TouchableOpacity key={device.deviceId} style={[styles.deviceRow, selected && styles.deviceSelected]} onPress={() => handlePick(device)}>
         <react_native_1.View style={[styles.health, { backgroundColor: healthColor }]}/>
         <react_native_1.View style={{ flex: 1 }}>
           <react_native_1.Text style={styles.deviceName}>{device.name || device.deviceId}</react_native_1.Text>
-          <react_native_1.Text style={styles.deviceMeta}>
-            {device.platform}
-            {device.isGuest && device.hostEmail ? `  •  ${device.hostEmail}` : ''}
-            {device.accessScope === 'shared-scoped' ? '  •  paylaşılan' : ''}
-          </react_native_1.Text>
+          <react_native_1.Text style={styles.deviceMeta}>{statusLine}</react_native_1.Text>
         </react_native_1.View>
         {selected && <react_native_1.Text style={styles.selectedBadge}>seçili</react_native_1.Text>}
       </react_native_1.TouchableOpacity>);
@@ -131,6 +160,13 @@ const YaverMachinePickerScreen = ({ token, currentDeviceId, onPick, onCancel, })
             {error && <react_native_1.Text style={styles.error}>{error}</react_native_1.Text>}
           </>)}
       </react_native_1.ScrollView>
+
+      <PairDeviceModal_1.PairDeviceModal device={pairingDevice} onClose={() => setPairingDevice(null)} onPaired={() => {
+            // Give the agent a moment to flip bootstrap → owner mode,
+            // then reload the list so the now-authenticated device shows
+            // up with a green dot and can be selected normally.
+            setTimeout(() => void load(true), 1500);
+        }}/>
     </react_native_1.SafeAreaView>);
 };
 exports.YaverMachinePickerScreen = YaverMachinePickerScreen;

package/dist/P2PClient.js

@@ -13,21 +13,28 @@ const react_native_1 = require("react-native");
  * running on the host machine".
  */
 function friendlyReloadError(status, body) {
-    const lower = body.toLowerCase();
-    if (/connection refused|econnrefused/.test(lower) &&
-        /127\.0\.0\.1|localhost/.test(lower)) {
+    // Plain .indexOf instead of regex — short literal tests sidestep
+    // a Hermes rope-flatten SIGSEGV we saw on RN 0.81 / iOS 18.3.1
+    // when the same body was already being processed by a concurrent
+    // SSE reconnect loop.
+    const lower = (body || '').toLowerCase();
+    const hasRefused = lower.indexOf('connection refused') >= 0 ||
+        lower.indexOf('econnrefused') >= 0;
+    const hasLoopback = lower.indexOf('127.0.0.1') >= 0 || lower.indexOf('localhost') >= 0;
+    if (hasRefused && hasLoopback) {
         return ('No dev server running on your machine. ' +
             'Start Metro with `yaver dev start` or use "Screenshot & Fix" instead.');
     }
-    if (/no dev server/.test(lower) || /not running/.test(lower)) {
+    if (lower.indexOf('no dev server') >= 0 ||
+        lower.indexOf('not running') >= 0) {
         return 'No dev server running on your machine. Start Metro first.';
     }
-    if (status === 403)
+    if (status === 401 || status === 403) {
         return 'Agent rejected the session — please sign in again.';
-    if (status === 401)
-        return 'Agent rejected the session — please sign in again.';
-    if (status >= 500)
+    }
+    if (status >= 500) {
         return 'Agent hit an internal error while reloading. Check `yaver logs`.';
+    }
     return `Reload failed (${status}).`;
 }
 /**

package/dist/PairDeviceModal.d.ts

@@ -0,0 +1,28 @@
+import React from 'react';
+import type { RemoteDevice } from './auth';
+/**
+ * In-SDK remote-pair modal. Shown when the user taps a device in the
+ * machine picker that's in `needsAuth` state.
+ *
+ * Flow:
+ *   1. User types the 6-char bootstrap passkey printed in the
+ *      `yaver serve` terminal on the Mac (also shown in Yaver mobile
+ *      app when pairing interactively).
+ *   2. SDK POSTs to `http://<device.quicHost>:<device.httpPort>/auth/pair/submit?code=XXXXXX`
+ *      with the user's Convex session token (same one the SDK already
+ *      has after Apple / Google / email sign-in).
+ *   3. Agent validates the token against Convex, persists it, flips
+ *      out of bootstrap mode — within a couple of seconds it'll
+ *      report `needsAuth=false` in /devices/list.
+ *
+ * This avoids making the user bounce to the Yaver mobile app just to
+ * adopt a machine. Works for owners and shared-scope guests since the
+ * pair endpoint accepts any valid Convex session that matches the
+ * expected account type.
+ */
+export interface PairDeviceModalProps {
+    device: RemoteDevice | null;
+    onClose: () => void;
+    onPaired?: (device: RemoteDevice) => void;
+}
+export declare const PairDeviceModal: React.FC<PairDeviceModalProps>;

package/dist/PairDeviceModal.js

@@ -0,0 +1,198 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PairDeviceModal = void 0;
+const react_1 = __importStar(require("react"));
+const react_native_1 = require("react-native");
+const auth_1 = require("./auth");
+const PairDeviceModal = ({ device, onClose, onPaired, }) => {
+    const [code, setCode] = (0, react_1.useState)('');
+    const [busy, setBusy] = (0, react_1.useState)(false);
+    const [error, setError] = (0, react_1.useState)(null);
+    const [success, setSuccess] = (0, react_1.useState)(false);
+    (0, react_1.useEffect)(() => {
+        if (device) {
+            setCode('');
+            setError(null);
+            setSuccess(false);
+        }
+    }, [device?.deviceId]);
+    const handleSubmit = async () => {
+        if (!device)
+            return;
+        const trimmed = code.trim().toUpperCase();
+        if (trimmed.length !== 6) {
+            setError('Code must be 6 characters.');
+            return;
+        }
+        const token = await (0, auth_1.getToken)();
+        if (!token) {
+            setError('Not signed in.');
+            return;
+        }
+        const host = (device.quicHost || '').trim();
+        const port = device.httpPort || device.quicPort || 18080;
+        if (!host) {
+            setError('No reachable address for this machine.');
+            return;
+        }
+        setBusy(true);
+        setError(null);
+        try {
+            const url = `http://${host}:${port}/auth/pair/submit?code=${encodeURIComponent(trimmed)}`;
+            const res = await fetch(url, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    token,
+                    convexSiteUrl: (0, auth_1.getConvexSiteUrl)(),
+                    // Backend reads userId from the session, but older agents
+                    // expect it in the body. Pass empty string if unknown.
+                    userId: '',
+                }),
+            });
+            if (!res.ok) {
+                let msg = `Agent rejected pair (HTTP ${res.status}).`;
+                try {
+                    const body = await res.json();
+                    if (body?.error)
+                        msg = String(body.error);
+                }
+                catch {
+                    // body not JSON
+                }
+                throw new Error(msg);
+            }
+            setSuccess(true);
+            onPaired?.(device);
+            setTimeout(() => {
+                onClose();
+            }, 1200);
+        }
+        catch (err) {
+            setError(err instanceof Error ? err.message : String(err));
+        }
+        finally {
+            setBusy(false);
+        }
+    };
+    return (<react_native_1.Modal visible={!!device} animationType="slide" transparent onRequestClose={onClose}>
+      <react_native_1.Pressable style={styles.overlay} onPress={onClose}>
+        <react_native_1.Pressable style={styles.card} onPress={(e) => e.stopPropagation()}>
+          <react_native_1.View style={styles.header}>
+            <react_native_1.Text style={styles.title}>Pair this Mac</react_native_1.Text>
+            <react_native_1.Pressable onPress={onClose} hitSlop={12} style={styles.closeBtn}>
+              <react_native_1.Text style={styles.closeIcon}>×</react_native_1.Text>
+            </react_native_1.Pressable>
+          </react_native_1.View>
+
+          <react_native_1.Text style={styles.deviceName}>{device?.name || device?.deviceId}</react_native_1.Text>
+          <react_native_1.Text style={styles.body}>
+            On the Mac where `yaver serve` is running, look for the 6-character code in the terminal output. Enter it here to adopt this machine.
+          </react_native_1.Text>
+
+          <react_native_1.TextInput style={styles.codeInput} value={code} onChangeText={(v) => setCode(v.toUpperCase().replace(/[^A-Z0-9]/g, '').slice(0, 6))} placeholder="ABCDEF" placeholderTextColor="#555" autoCapitalize="characters" autoCorrect={false} maxLength={6} keyboardType={react_native_1.Platform.OS === 'ios' ? 'ascii-capable' : 'visible-password'}/>
+
+          {error && <react_native_1.Text style={styles.error}>{error}</react_native_1.Text>}
+          {success && <react_native_1.Text style={styles.success}>Paired ✓</react_native_1.Text>}
+
+          <react_native_1.Pressable onPress={handleSubmit} disabled={busy || success || code.length !== 6} style={({ pressed }) => [
+            styles.submit,
+            (busy || success || code.length !== 6) && styles.submitDisabled,
+            pressed && { opacity: 0.7 },
+        ]}>
+            {busy ? (<react_native_1.ActivityIndicator color="#fff"/>) : (<react_native_1.Text style={styles.submitText}>{success ? 'Paired' : 'Pair'}</react_native_1.Text>)}
+          </react_native_1.Pressable>
+        </react_native_1.Pressable>
+      </react_native_1.Pressable>
+    </react_native_1.Modal>);
+};
+exports.PairDeviceModal = PairDeviceModal;
+const styles = react_native_1.StyleSheet.create({
+    overlay: {
+        flex: 1,
+        backgroundColor: 'rgba(0,0,0,0.55)',
+        justifyContent: 'flex-end',
+    },
+    card: {
+        backgroundColor: '#141422',
+        borderTopLeftRadius: 22,
+        borderTopRightRadius: 22,
+        padding: 24,
+        paddingBottom: 36,
+        gap: 14,
+    },
+    header: {
+        flexDirection: 'row',
+        alignItems: 'center',
+        justifyContent: 'space-between',
+    },
+    title: { fontSize: 20, fontWeight: '700', color: '#fff' },
+    closeBtn: {
+        width: 36,
+        height: 36,
+        borderRadius: 18,
+        alignItems: 'center',
+        justifyContent: 'center',
+        backgroundColor: 'rgba(255,255,255,0.08)',
+    },
+    closeIcon: { color: '#fff', fontSize: 22, lineHeight: 24 },
+    deviceName: { fontSize: 15, fontWeight: '600', color: '#c7c8ff' },
+    body: { fontSize: 13, color: '#9ca3af', lineHeight: 18 },
+    codeInput: {
+        backgroundColor: 'rgba(255,255,255,0.06)',
+        borderWidth: 1,
+        borderColor: 'rgba(255,255,255,0.14)',
+        borderRadius: 12,
+        paddingHorizontal: 16,
+        paddingVertical: 16,
+        fontSize: 22,
+        fontWeight: '700',
+        letterSpacing: 4,
+        textAlign: 'center',
+        color: '#fff',
+        fontFamily: react_native_1.Platform.OS === 'ios' ? 'Menlo' : 'monospace',
+    },
+    error: { color: '#ef4444', fontSize: 13 },
+    success: { color: '#22c55e', fontSize: 14, fontWeight: '600' },
+    submit: {
+        backgroundColor: '#818cf8',
+        borderRadius: 12,
+        paddingVertical: 14,
+        alignItems: 'center',
+    },
+    submitDisabled: { opacity: 0.35 },
+    submitText: { color: '#fff', fontSize: 16, fontWeight: '700' },
+});

package/dist/YaverFeedback.js

@@ -171,19 +171,18 @@ class YaverFeedback {
                     });
                 }
             });
-            // Auto-open the command-stream SSE channel so `status` +
-            // `reload_bundle` messages from the agent actually reach us.
-            // Host apps can still call BlackBox.start(...) themselves to
-            // customise deviceId / appName, but they don't have to.
-            if (!BlackBox_1.BlackBox.isStreaming) {
-                try {
-                    BlackBox_1.BlackBox.start();
-                }
-                catch {
-                    // BlackBox.start throws if agentUrl/token aren't ready yet;
-                    // a later setAuthToken() / discoverAgent() tick will retry.
-                }
-            }
+            // NOTE: BlackBox.start() is intentionally NOT auto-called here.
+            // An earlier version (0.7.6) did auto-start it, and when the
+            // agent was in bootstrap / needs-auth mode — which can happen
+            // any time after `yaver serve` restarts before the user pairs —
+            // the SSE channel retried with exponential backoff on 401s,
+            // producing a tight loop of string concatenation + JSON parse
+            // that tripped a Hermes rope-string SIGSEGV on iOS 18.3.1
+            // during any other JS-thread regex work (e.g. react-native-
+            // view-shot's internal string handling during Screenshot &
+            // Fix). Host apps call BlackBox.start() explicitly once they
+            // know the agent URL + token are valid (SFMG does this inside
+            // its YaverFeedbackWidget after auth).
         }
         // NOTE: We intentionally do NOT hook ErrorUtils.setGlobalHandler().
         // Sentry, Crashlytics, Bugsnag, and other tools all compete for that

package/dist/index.d.ts

@@ -38,6 +38,8 @@ export { YaverLoginScreen } from './LoginScreen';
 export type { YaverLoginScreenProps } from './LoginScreen';
 export { YaverMachinePickerScreen } from './MachinePickerScreen';
 export type { YaverMachinePickerProps } from './MachinePickerScreen';
+export { PairDeviceModal } from './PairDeviceModal';
+export type { PairDeviceModalProps } from './PairDeviceModal';
 export { AuthOverlay } from './AuthOverlay';
 export { ShakeDetector } from './ShakeDetector';
 export { FloatingButton } from './FloatingButton';

package/dist/index.js

@@ -28,7 +28,7 @@
  * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.uploadFeedback = exports.isVideoRecording = exports.stopVideoRecording = exports.startVideoRecording = exports.captureScreenshot = exports.DEFAULT_OAUTH_REDIRECT = exports.DEFAULT_WEB_BASE_URL = exports.DEFAULT_CONVEX_SITE_URL = exports.listReachableDevices = exports.loginWithEmail = exports.signupWithEmail = exports.signInWithOAuth = exports.signInWithApple = exports.validateToken = exports.clearSelectedDeviceId = exports.saveSelectedDeviceId = exports.getSelectedDeviceId = exports.saveUser = exports.getUser = exports.clearToken = exports.saveToken = exports.getToken = exports.getWebBaseUrl = exports.getConvexSiteUrl = exports.configureAuthEndpoints = exports.FixReport = exports.FeedbackModal = exports.FloatingButton = exports.ShakeDetector = exports.AuthOverlay = exports.YaverMachinePickerScreen = exports.YaverLoginScreen = exports.YaverConnectionScreen = exports.P2PClient = exports.YaverDiscovery = exports.initExpo = exports.YaverUpdates = exports.BlackBox = exports.YaverFeedback = void 0;
+exports.uploadFeedback = exports.isVideoRecording = exports.stopVideoRecording = exports.startVideoRecording = exports.captureScreenshot = exports.DEFAULT_OAUTH_REDIRECT = exports.DEFAULT_WEB_BASE_URL = exports.DEFAULT_CONVEX_SITE_URL = exports.listReachableDevices = exports.loginWithEmail = exports.signupWithEmail = exports.signInWithOAuth = exports.signInWithApple = exports.validateToken = exports.clearSelectedDeviceId = exports.saveSelectedDeviceId = exports.getSelectedDeviceId = exports.saveUser = exports.getUser = exports.clearToken = exports.saveToken = exports.getToken = exports.getWebBaseUrl = exports.getConvexSiteUrl = exports.configureAuthEndpoints = exports.FixReport = exports.FeedbackModal = exports.FloatingButton = exports.ShakeDetector = exports.AuthOverlay = exports.PairDeviceModal = exports.YaverMachinePickerScreen = exports.YaverLoginScreen = exports.YaverConnectionScreen = exports.P2PClient = exports.YaverDiscovery = exports.initExpo = exports.YaverUpdates = exports.BlackBox = exports.YaverFeedback = void 0;
 var YaverFeedback_1 = require("./YaverFeedback");
 Object.defineProperty(exports, "YaverFeedback", { enumerable: true, get: function () { return YaverFeedback_1.YaverFeedback; } });
 var BlackBox_1 = require("./BlackBox");
@@ -47,6 +47,8 @@ var LoginScreen_1 = require("./LoginScreen");
 Object.defineProperty(exports, "YaverLoginScreen", { enumerable: true, get: function () { return LoginScreen_1.YaverLoginScreen; } });
 var MachinePickerScreen_1 = require("./MachinePickerScreen");
 Object.defineProperty(exports, "YaverMachinePickerScreen", { enumerable: true, get: function () { return MachinePickerScreen_1.YaverMachinePickerScreen; } });
+var PairDeviceModal_1 = require("./PairDeviceModal");
+Object.defineProperty(exports, "PairDeviceModal", { enumerable: true, get: function () { return PairDeviceModal_1.PairDeviceModal; } });
 var AuthOverlay_1 = require("./AuthOverlay");
 Object.defineProperty(exports, "AuthOverlay", { enumerable: true, get: function () { return AuthOverlay_1.AuthOverlay; } });
 var ShakeDetector_1 = require("./ShakeDetector");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yaver-feedback-react-native",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "description": "Visual feedback SDK for Yaver — bug reports, screen recording, voice annotations, and local-first developer workflows",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/FeedbackModal.tsx

@@ -116,18 +116,29 @@ export const FeedbackModal: React.FC = () => {
       try {
         await fn(client);
       } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        // 401 / 403 "invalid token" — the cached session is stale
-        // (common after a Convex deployment migration). Sign out so
-        // the next interaction surfaces the login sheet, then bubble
-        // a readable error up to the user.
-        const authFailed = /\b(401|403)\b.*invalid token|invalid token|unauthor/i.test(msg);
+        const msg = (err instanceof Error ? err.message : String(err)) || '';
+        // Avoid unbounded `.*` in regex — on RN 0.81 / Hermes rope
+        // strings plus a background SSE reconnect, that pattern has
+        // reliably SIGSEGV'd Hermes's string-view flattening path.
+        // Split into short, literal-only alternations.
+        const lower = msg.toLowerCase();
+        const authFailed =
+          lower.indexOf('invalid token') >= 0 ||
+          lower.indexOf('unauthor') >= 0 ||
+          lower.indexOf(' 401') >= 0 ||
+          lower.indexOf(' 403') >= 0;
         if (authFailed) {
           await YaverFeedback.signOut();
           YaverFeedback.showLogin();
           throw new Error('Session expired — please sign in again.');
         }
-        const transient = /Network request failed|timeout|ECONNREFUSED|Failed to fetch|fetch failed|aborted/i.test(msg);
+        const transient =
+          lower.indexOf('network request failed') >= 0 ||
+          lower.indexOf('econnrefused') >= 0 ||
+          lower.indexOf('failed to fetch') >= 0 ||
+          lower.indexOf('fetch failed') >= 0 ||
+          lower.indexOf('aborted') >= 0 ||
+          lower.indexOf('timeout') >= 0;
         if (!transient) throw err;
         const ok = await YaverFeedback.reconnect();
         if (!ok) throw err;

package/src/MachinePickerScreen.tsx

@@ -15,6 +15,7 @@ import {
   listReachableDevices,
   saveSelectedDeviceId,
 } from './auth';
+import { PairDeviceModal } from './PairDeviceModal';
 
 export interface YaverMachinePickerProps {
   token: string;
@@ -43,6 +44,7 @@ export const YaverMachinePickerScreen: React.FC<YaverMachinePickerProps> = ({
   const [refreshing, setRefreshing] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [list, setList] = useState<DeviceList>({ owned: [], shared: [] });
+  const [pairingDevice, setPairingDevice] = useState<RemoteDevice | null>(null);
 
   const load = useCallback(async (silent = false) => {
     if (!silent) setLoading(true);
@@ -66,6 +68,15 @@ export const YaverMachinePickerScreen: React.FC<YaverMachinePickerProps> = ({
   }, [load]);
 
   const handlePick = async (device: RemoteDevice) => {
+    // Needs-auth device — show the in-SDK pair modal instead of
+    // treating the tap as a "pick". The user enters the 6-char code
+    // from their Mac terminal; the SDK POSTs it to /auth/pair/submit
+    // on the agent directly. Once the device flips out of bootstrap
+    // mode, the next load() picks up the fresh state.
+    if (device.isOnline && device.needsAuth) {
+      setPairingDevice(device);
+      return;
+    }
     await saveSelectedDeviceId(device.deviceId);
     onPick(device);
   };
@@ -87,6 +98,24 @@ export const YaverMachinePickerScreen: React.FC<YaverMachinePickerProps> = ({
       : device.needsAuth
         ? '#f59e0b'
         : '#22c55e';
+    // Derive a single short status phrase the user can act on.
+    let statusLine = device.platform;
+    if (!device.isOnline) {
+      statusLine = 'Offline — start `yaver serve` on the Mac';
+    } else if (device.needsAuth) {
+      statusLine =
+        'Needs pairing — open the Yaver app to adopt this machine';
+    } else if (device.runnerDown) {
+      statusLine = 'Runner down — restart the coding agent on the Mac';
+    } else {
+      // Happy-path subtitle: platform + optional host/share hint.
+      statusLine = device.platform;
+      if (device.isGuest && device.hostEmail) {
+        statusLine = `${statusLine} • ${device.hostEmail}`;
+      } else if (device.accessScope === 'shared-scoped') {
+        statusLine = `${statusLine} • paylaşılan`;
+      }
+    }
     return (
       <TouchableOpacity
         key={device.deviceId}
@@ -96,11 +125,7 @@ export const YaverMachinePickerScreen: React.FC<YaverMachinePickerProps> = ({
         <View style={[styles.health, { backgroundColor: healthColor }]} />
         <View style={{ flex: 1 }}>
           <Text style={styles.deviceName}>{device.name || device.deviceId}</Text>
-          <Text style={styles.deviceMeta}>
-            {device.platform}
-            {device.isGuest && device.hostEmail ? `  •  ${device.hostEmail}` : ''}
-            {device.accessScope === 'shared-scoped' ? '  •  paylaşılan' : ''}
-          </Text>
+          <Text style={styles.deviceMeta}>{statusLine}</Text>
         </View>
         {selected && <Text style={styles.selectedBadge}>seçili</Text>}
       </TouchableOpacity>
@@ -151,6 +176,17 @@ export const YaverMachinePickerScreen: React.FC<YaverMachinePickerProps> = ({
           </>
         )}
       </ScrollView>
+
+      <PairDeviceModal
+        device={pairingDevice}
+        onClose={() => setPairingDevice(null)}
+        onPaired={() => {
+          // Give the agent a moment to flip bootstrap → owner mode,
+          // then reload the list so the now-authenticated device shows
+          // up with a green dot and can be selected normally.
+          setTimeout(() => void load(true), 1500);
+        }}
+      />
     </SafeAreaView>
   );
 };

package/src/P2PClient.ts

@@ -18,22 +18,34 @@ export interface FeedbackEvent {
  * running on the host machine".
  */
 function friendlyReloadError(status: number, body: string): string {
-  const lower = body.toLowerCase();
-  if (
-    /connection refused|econnrefused/.test(lower) &&
-    /127\.0\.0\.1|localhost/.test(lower)
-  ) {
+  // Plain .indexOf instead of regex — short literal tests sidestep
+  // a Hermes rope-flatten SIGSEGV we saw on RN 0.81 / iOS 18.3.1
+  // when the same body was already being processed by a concurrent
+  // SSE reconnect loop.
+  const lower = (body || '').toLowerCase();
+  const hasRefused =
+    lower.indexOf('connection refused') >= 0 ||
+    lower.indexOf('econnrefused') >= 0;
+  const hasLoopback =
+    lower.indexOf('127.0.0.1') >= 0 || lower.indexOf('localhost') >= 0;
+  if (hasRefused && hasLoopback) {
     return (
       'No dev server running on your machine. ' +
       'Start Metro with `yaver dev start` or use "Screenshot & Fix" instead.'
     );
   }
-  if (/no dev server/.test(lower) || /not running/.test(lower)) {
+  if (
+    lower.indexOf('no dev server') >= 0 ||
+    lower.indexOf('not running') >= 0
+  ) {
     return 'No dev server running on your machine. Start Metro first.';
   }
-  if (status === 403) return 'Agent rejected the session — please sign in again.';
-  if (status === 401) return 'Agent rejected the session — please sign in again.';
-  if (status >= 500) return 'Agent hit an internal error while reloading. Check `yaver logs`.';
+  if (status === 401 || status === 403) {
+    return 'Agent rejected the session — please sign in again.';
+  }
+  if (status >= 500) {
+    return 'Agent hit an internal error while reloading. Check `yaver logs`.';
+  }
   return `Reload failed (${status}).`;
 }
 

package/src/PairDeviceModal.tsx

@@ -0,0 +1,228 @@
+import React, { useEffect, useState } from 'react';
+import {
+  ActivityIndicator,
+  Modal,
+  Platform,
+  Pressable,
+  StyleSheet,
+  Text,
+  TextInput,
+  View,
+} from 'react-native';
+import type { RemoteDevice } from './auth';
+import { getConvexSiteUrl, getToken } from './auth';
+
+/**
+ * In-SDK remote-pair modal. Shown when the user taps a device in the
+ * machine picker that's in `needsAuth` state.
+ *
+ * Flow:
+ *   1. User types the 6-char bootstrap passkey printed in the
+ *      `yaver serve` terminal on the Mac (also shown in Yaver mobile
+ *      app when pairing interactively).
+ *   2. SDK POSTs to `http://<device.quicHost>:<device.httpPort>/auth/pair/submit?code=XXXXXX`
+ *      with the user's Convex session token (same one the SDK already
+ *      has after Apple / Google / email sign-in).
+ *   3. Agent validates the token against Convex, persists it, flips
+ *      out of bootstrap mode — within a couple of seconds it'll
+ *      report `needsAuth=false` in /devices/list.
+ *
+ * This avoids making the user bounce to the Yaver mobile app just to
+ * adopt a machine. Works for owners and shared-scope guests since the
+ * pair endpoint accepts any valid Convex session that matches the
+ * expected account type.
+ */
+export interface PairDeviceModalProps {
+  device: RemoteDevice | null;
+  onClose: () => void;
+  onPaired?: (device: RemoteDevice) => void;
+}
+
+export const PairDeviceModal: React.FC<PairDeviceModalProps> = ({
+  device,
+  onClose,
+  onPaired,
+}) => {
+  const [code, setCode] = useState('');
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [success, setSuccess] = useState(false);
+
+  useEffect(() => {
+    if (device) {
+      setCode('');
+      setError(null);
+      setSuccess(false);
+    }
+  }, [device?.deviceId]);
+
+  const handleSubmit = async () => {
+    if (!device) return;
+    const trimmed = code.trim().toUpperCase();
+    if (trimmed.length !== 6) {
+      setError('Code must be 6 characters.');
+      return;
+    }
+    const token = await getToken();
+    if (!token) {
+      setError('Not signed in.');
+      return;
+    }
+    const host = (device.quicHost || '').trim();
+    const port = device.httpPort || device.quicPort || 18080;
+    if (!host) {
+      setError('No reachable address for this machine.');
+      return;
+    }
+    setBusy(true);
+    setError(null);
+    try {
+      const url = `http://${host}:${port}/auth/pair/submit?code=${encodeURIComponent(
+        trimmed,
+      )}`;
+      const res = await fetch(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          token,
+          convexSiteUrl: getConvexSiteUrl(),
+          // Backend reads userId from the session, but older agents
+          // expect it in the body. Pass empty string if unknown.
+          userId: '',
+        }),
+      });
+      if (!res.ok) {
+        let msg = `Agent rejected pair (HTTP ${res.status}).`;
+        try {
+          const body = await res.json();
+          if (body?.error) msg = String(body.error);
+        } catch {
+          // body not JSON
+        }
+        throw new Error(msg);
+      }
+      setSuccess(true);
+      onPaired?.(device);
+      setTimeout(() => {
+        onClose();
+      }, 1200);
+    } catch (err: unknown) {
+      setError(err instanceof Error ? err.message : String(err));
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  return (
+    <Modal
+      visible={!!device}
+      animationType="slide"
+      transparent
+      onRequestClose={onClose}
+    >
+      <Pressable style={styles.overlay} onPress={onClose}>
+        <Pressable style={styles.card} onPress={(e) => e.stopPropagation()}>
+          <View style={styles.header}>
+            <Text style={styles.title}>Pair this Mac</Text>
+            <Pressable onPress={onClose} hitSlop={12} style={styles.closeBtn}>
+              <Text style={styles.closeIcon}>×</Text>
+            </Pressable>
+          </View>
+
+          <Text style={styles.deviceName}>{device?.name || device?.deviceId}</Text>
+          <Text style={styles.body}>
+            On the Mac where `yaver serve` is running, look for the 6-character code in the terminal output. Enter it here to adopt this machine.
+          </Text>
+
+          <TextInput
+            style={styles.codeInput}
+            value={code}
+            onChangeText={(v) => setCode(v.toUpperCase().replace(/[^A-Z0-9]/g, '').slice(0, 6))}
+            placeholder="ABCDEF"
+            placeholderTextColor="#555"
+            autoCapitalize="characters"
+            autoCorrect={false}
+            maxLength={6}
+            keyboardType={Platform.OS === 'ios' ? 'ascii-capable' : 'visible-password'}
+          />
+
+          {error && <Text style={styles.error}>{error}</Text>}
+          {success && <Text style={styles.success}>Paired ✓</Text>}
+
+          <Pressable
+            onPress={handleSubmit}
+            disabled={busy || success || code.length !== 6}
+            style={({ pressed }) => [
+              styles.submit,
+              (busy || success || code.length !== 6) && styles.submitDisabled,
+              pressed && { opacity: 0.7 },
+            ]}
+          >
+            {busy ? (
+              <ActivityIndicator color="#fff" />
+            ) : (
+              <Text style={styles.submitText}>{success ? 'Paired' : 'Pair'}</Text>
+            )}
+          </Pressable>
+        </Pressable>
+      </Pressable>
+    </Modal>
+  );
+};
+
+const styles = StyleSheet.create({
+  overlay: {
+    flex: 1,
+    backgroundColor: 'rgba(0,0,0,0.55)',
+    justifyContent: 'flex-end',
+  },
+  card: {
+    backgroundColor: '#141422',
+    borderTopLeftRadius: 22,
+    borderTopRightRadius: 22,
+    padding: 24,
+    paddingBottom: 36,
+    gap: 14,
+  },
+  header: {
+    flexDirection: 'row',
+    alignItems: 'center',
+    justifyContent: 'space-between',
+  },
+  title: { fontSize: 20, fontWeight: '700', color: '#fff' },
+  closeBtn: {
+    width: 36,
+    height: 36,
+    borderRadius: 18,
+    alignItems: 'center',
+    justifyContent: 'center',
+    backgroundColor: 'rgba(255,255,255,0.08)',
+  },
+  closeIcon: { color: '#fff', fontSize: 22, lineHeight: 24 },
+  deviceName: { fontSize: 15, fontWeight: '600', color: '#c7c8ff' },
+  body: { fontSize: 13, color: '#9ca3af', lineHeight: 18 },
+  codeInput: {
+    backgroundColor: 'rgba(255,255,255,0.06)',
+    borderWidth: 1,
+    borderColor: 'rgba(255,255,255,0.14)',
+    borderRadius: 12,
+    paddingHorizontal: 16,
+    paddingVertical: 16,
+    fontSize: 22,
+    fontWeight: '700',
+    letterSpacing: 4,
+    textAlign: 'center',
+    color: '#fff',
+    fontFamily: Platform.OS === 'ios' ? 'Menlo' : 'monospace',
+  },
+  error: { color: '#ef4444', fontSize: 13 },
+  success: { color: '#22c55e', fontSize: 14, fontWeight: '600' },
+  submit: {
+    backgroundColor: '#818cf8',
+    borderRadius: 12,
+    paddingVertical: 14,
+    alignItems: 'center',
+  },
+  submitDisabled: { opacity: 0.35 },
+  submitText: { color: '#fff', fontSize: 16, fontWeight: '700' },
+});

package/src/YaverFeedback.ts

@@ -185,18 +185,18 @@ export class YaverFeedback {
           });
         }
       });
-      // Auto-open the command-stream SSE channel so `status` +
-      // `reload_bundle` messages from the agent actually reach us.
-      // Host apps can still call BlackBox.start(...) themselves to
-      // customise deviceId / appName, but they don't have to.
-      if (!BlackBox.isStreaming) {
-        try {
-          BlackBox.start();
-        } catch {
-          // BlackBox.start throws if agentUrl/token aren't ready yet;
-          // a later setAuthToken() / discoverAgent() tick will retry.
-        }
-      }
+      // NOTE: BlackBox.start() is intentionally NOT auto-called here.
+      // An earlier version (0.7.6) did auto-start it, and when the
+      // agent was in bootstrap / needs-auth mode — which can happen
+      // any time after `yaver serve` restarts before the user pairs —
+      // the SSE channel retried with exponential backoff on 401s,
+      // producing a tight loop of string concatenation + JSON parse
+      // that tripped a Hermes rope-string SIGSEGV on iOS 18.3.1
+      // during any other JS-thread regex work (e.g. react-native-
+      // view-shot's internal string handling during Screenshot &
+      // Fix). Host apps call BlackBox.start() explicitly once they
+      // know the agent URL + token are valid (SFMG does this inside
+      // its YaverFeedbackWidget after auth).
     }
 
     // NOTE: We intentionally do NOT hook ErrorUtils.setGlobalHandler().

package/src/index.ts

@@ -39,6 +39,8 @@ export { YaverLoginScreen } from './LoginScreen';
 export type { YaverLoginScreenProps } from './LoginScreen';
 export { YaverMachinePickerScreen } from './MachinePickerScreen';
 export type { YaverMachinePickerProps } from './MachinePickerScreen';
+export { PairDeviceModal } from './PairDeviceModal';
+export type { PairDeviceModalProps } from './PairDeviceModal';
 export { AuthOverlay } from './AuthOverlay';
 export { ShakeDetector } from './ShakeDetector';
 export { FloatingButton } from './FloatingButton';