yaver-feedback-react-native 0.8.13 → 0.9.2

package/dist/__tests__/BlackBox.relayPassword.test.js

@@ -0,0 +1,105 @@
+"use strict";
+// BlackBox relay-password sourcing.
+//
+// This exists because BlackBox.start() used to read the relay password off
+// the feedback config:
+//
+//     BlackBox.relayPassword =
+//       (feedbackConfig as { relayPassword?: string }).relayPassword ?? '';
+//
+// `relayPassword` is not a key on FeedbackConfig. The cast is what stopped
+// the compiler from saying so, and the field was therefore permanently ''.
+// Since every X-Relay-Password header is written behind an
+// `if (BlackBox.relayPassword)` guard, the header was never sent, and the
+// relay 401s an empty password (relay/server.go). Net effect: on cellular
+// (the only time the relay is used at all) the SSE command channel died,
+// so the reload that lands after an agent fix never fired. On-LAN the
+// password is unused, so this was invisible in local dev — it only ever
+// broke remote users.
+//
+// The contract pinned here: BlackBox takes its relay password from
+// YaverFeedback.getRelayPassword(), the same source P2PClient uses.
+Object.defineProperty(exports, "__esModule", { value: true });
+const BlackBox_1 = require("../BlackBox");
+const YaverFeedback_1 = require("../YaverFeedback");
+jest.mock('react-native', () => ({
+    Platform: { OS: 'ios' },
+}));
+jest.useFakeTimers();
+const mockFetch = jest.fn();
+global.fetch = mockFetch;
+class MockAbortController {
+    constructor() {
+        this.signal = { aborted: false };
+        this.abort = jest.fn(() => {
+            this.signal.aborted = true;
+        });
+    }
+}
+global.AbortController = MockAbortController;
+function emptySse() {
+    return new ReadableStream({
+        start(controller) {
+            controller.close();
+        },
+    });
+}
+beforeEach(() => {
+    jest.clearAllMocks();
+    mockFetch.mockImplementation((url) => {
+        if (String(url).includes('/blackbox/command-stream')) {
+            return Promise.resolve({ ok: true, body: emptySse() });
+        }
+        return Promise.resolve({ ok: true, json: () => Promise.resolve({}) });
+    });
+    // A relay-routed agent URL — the shape discovery produces off-LAN.
+    YaverFeedback_1.YaverFeedback.init({
+        agentUrl: 'https://public.yaver.io/d/macmini-1',
+        authToken: 'tok',
+    });
+});
+afterEach(() => {
+    BlackBox_1.BlackBox.stop();
+    jest.restoreAllMocks();
+});
+describe('BlackBox relay password', () => {
+    it('sends X-Relay-Password on the SSE command stream, sourced from getRelayPassword()', async () => {
+        jest.spyOn(YaverFeedback_1.YaverFeedback, 'getRelayPassword').mockReturnValue('s3cret-relay-pw');
+        BlackBox_1.BlackBox.start({ deviceId: 'dev-abc', appName: 'talos-mobile' });
+        await Promise.resolve();
+        await Promise.resolve();
+        const sseCall = mockFetch.mock.calls.find(([url]) => String(url).includes('/blackbox/command-stream'));
+        expect(sseCall).toBeDefined();
+        const [, init] = sseCall;
+        expect(init.headers).toEqual(expect.objectContaining({ 'X-Relay-Password': 's3cret-relay-pw' }));
+    });
+    it('sends X-Relay-Password on the event flush', async () => {
+        jest.spyOn(YaverFeedback_1.YaverFeedback, 'getRelayPassword').mockReturnValue('s3cret-relay-pw');
+        // maxBufferSize:1 makes push() flush synchronously on the first event,
+        // so this doesn't hang on interval semantics.
+        BlackBox_1.BlackBox.start({ deviceId: 'dev-abc', maxBufferSize: 1 });
+        BlackBox_1.BlackBox.log('hello');
+        await Promise.resolve();
+        const flush = mockFetch.mock.calls.find(([url]) => String(url).includes('/blackbox/events'));
+        expect(flush).toBeDefined();
+        const [, init] = flush;
+        expect(init.headers).toEqual(expect.objectContaining({ 'X-Relay-Password': 's3cret-relay-pw' }));
+    });
+    it('omits the header entirely when there is no relay password (direct LAN)', async () => {
+        // An empty header value is itself a 401 at the relay, so "no password"
+        // must mean "no header", not "empty header".
+        jest.spyOn(YaverFeedback_1.YaverFeedback, 'getRelayPassword').mockReturnValue('');
+        BlackBox_1.BlackBox.start({ deviceId: 'dev-abc' });
+        await Promise.resolve();
+        await Promise.resolve();
+        const sseCall = mockFetch.mock.calls.find(([url]) => String(url).includes('/blackbox/command-stream'));
+        expect(sseCall).toBeDefined();
+        const [, init] = sseCall;
+        expect(init.headers).not.toHaveProperty('X-Relay-Password');
+    });
+    it('does not read a relayPassword key off the feedback config', () => {
+        // The original bug in one assertion: FeedbackConfig has no such key, so
+        // anyone reintroducing that read gets '' and silently breaks the relay.
+        expect(YaverFeedback_1.YaverFeedback.getConfig()).not.toHaveProperty('relayPassword');
+    });
+});

package/dist/__tests__/BlackBoxAutoStart.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/BlackBoxAutoStart.test.js

@@ -0,0 +1,91 @@
+"use strict";
+// BlackBox auto-start config passthrough.
+//
+// The natural way to configure the flight recorder — and the one the README's
+// own snippet shows — is:
+//
+//     YaverFeedback.init({ trigger: 'shake' });
+//     BlackBox.start({ appName: 'my-app' });
+//
+// That start() early-returns: a zero-config init has no agentUrl yet, because
+// discovery resolves it asynchronously. The SDK's autoStartBlackBox then fires
+// ~500ms later once the agent and token exist — and used to call start() with
+// no arguments, quietly replacing the host's config with defaults and leaving
+// appName as ''. Hosts had no way to tell: the recorder streamed, just
+// anonymously.
+//
+// config.blackBox is now the supported channel, and auto-start honours it.
+Object.defineProperty(exports, "__esModule", { value: true });
+const BlackBox_1 = require("../BlackBox");
+const YaverFeedback_1 = require("../YaverFeedback");
+jest.mock('react-native', () => ({
+    Platform: { OS: 'ios' },
+    DeviceEventEmitter: { emit: jest.fn(), addListener: jest.fn() },
+    NativeModules: {},
+}));
+jest.mock('../ShakeDetector', () => ({
+    ShakeDetector: jest.fn().mockImplementation(() => ({
+        start: jest.fn(),
+        stop: jest.fn(),
+    })),
+}));
+jest.useFakeTimers();
+const mockFetch = jest.fn(() => Promise.resolve({ ok: true, json: () => Promise.resolve({}), body: null }));
+global.fetch = mockFetch;
+class MockAbortController {
+    constructor() {
+        this.signal = { aborted: false };
+        this.abort = jest.fn();
+    }
+}
+global.AbortController = MockAbortController;
+beforeEach(() => {
+    jest.clearAllMocks();
+    YaverFeedback_1.YaverFeedback.destroy();
+});
+afterEach(() => {
+    BlackBox_1.BlackBox.stop();
+    YaverFeedback_1.YaverFeedback.destroy();
+});
+describe('autoStartBlackBox config passthrough', () => {
+    it('starts BlackBox with the config passed on init', async () => {
+        const startSpy = jest.spyOn(BlackBox_1.BlackBox, 'start').mockImplementation(() => { });
+        YaverFeedback_1.YaverFeedback.init({
+            trigger: 'shake',
+            agentUrl: 'http://localhost:18080',
+            authToken: 'tok',
+            blackBox: { appName: 'talos-mobile', flushInterval: 3000, maxBufferSize: 25 },
+        });
+        await jest.advanceTimersByTimeAsync(600);
+        expect(startSpy).toHaveBeenCalledWith(expect.objectContaining({
+            appName: 'talos-mobile',
+            flushInterval: 3000,
+            maxBufferSize: 25,
+        }));
+        startSpy.mockRestore();
+    });
+    it('still auto-starts when no blackBox config is given', async () => {
+        const startSpy = jest.spyOn(BlackBox_1.BlackBox, 'start').mockImplementation(() => { });
+        YaverFeedback_1.YaverFeedback.init({
+            trigger: 'shake',
+            agentUrl: 'http://localhost:18080',
+            authToken: 'tok',
+        });
+        await jest.advanceTimersByTimeAsync(600);
+        expect(startSpy).toHaveBeenCalled();
+        startSpy.mockRestore();
+    });
+    it('does not auto-start when autoStartBlackBox is false', async () => {
+        const startSpy = jest.spyOn(BlackBox_1.BlackBox, 'start').mockImplementation(() => { });
+        YaverFeedback_1.YaverFeedback.init({
+            trigger: 'shake',
+            agentUrl: 'http://localhost:18080',
+            authToken: 'tok',
+            autoStartBlackBox: false,
+            blackBox: { appName: 'talos-mobile' },
+        });
+        await jest.advanceTimersByTimeAsync(600);
+        expect(startSpy).not.toHaveBeenCalled();
+        startSpy.mockRestore();
+    });
+});

package/dist/__tests__/BlackBoxAutoStartColdStart.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/BlackBoxAutoStartColdStart.test.js

@@ -0,0 +1,156 @@
+"use strict";
+// BlackBox auto-start on a COLD start — the case that decides whether Hermes
+// hot reload works at all.
+//
+// The command channel that carries the agent's `reload_bundle` is BlackBox's
+// SSE stream. If BlackBox never starts, a fix pushed from the dev machine has
+// nowhere to land and the phone just sits there.
+//
+// Auto-start used to be a single 500ms timeout gated on `agentUrl && token`.
+// A real app passes NEITHER to init() — they're restored from storage — so on
+// a cold start the sequence is:
+//
+//     init() -> void hydrateSession()
+//                 -> AsyncStorage read (token)
+//                 -> AsyncStorage read (deviceId)
+//                 -> await discoverAgent()   <- Convex round trip + LAN probe
+//
+// which does not complete in 500ms. The one-shot check found no agentUrl, gave
+// up, and hot reload was silently dead until the user shook the device and
+// drove discovery by hand. These tests pin the retry that fixes it, and the
+// bounds that keep it from becoming a forever-poll or a 401 storm.
+Object.defineProperty(exports, "__esModule", { value: true });
+const BlackBox_1 = require("../BlackBox");
+const YaverFeedback_1 = require("../YaverFeedback");
+jest.mock('react-native', () => ({
+    Platform: { OS: 'ios' },
+    DeviceEventEmitter: { emit: jest.fn(), addListener: jest.fn() },
+    NativeModules: {},
+}));
+jest.mock('../ShakeDetector', () => ({
+    ShakeDetector: jest.fn().mockImplementation(() => ({
+        start: jest.fn(),
+        stop: jest.fn(),
+    })),
+}));
+// Discovery is the slow step we're modelling. Resolves only after the test
+// flips `discovered`, standing in for "the Convex round trip finally landed".
+let discovered = null;
+jest.mock('../Discovery', () => ({
+    YaverDiscovery: {
+        discover: jest.fn(() => Promise.resolve(discovered ? { url: discovered } : null)),
+    },
+}));
+// The token cache hydrateSession() reads.
+let storedToken = null;
+jest.mock('../auth', () => ({
+    ...jest.requireActual('../auth'),
+    getToken: jest.fn(() => Promise.resolve(storedToken)),
+    getSelectedDeviceId: jest.fn(() => Promise.resolve(null)),
+    configureAuthEndpoints: jest.fn(),
+    setStrictNativeAuth: jest.fn(),
+}));
+jest.useFakeTimers();
+const mockFetch = jest.fn(() => Promise.resolve({ ok: true, json: () => Promise.resolve({}), body: null }));
+class MockAbortController {
+    constructor() {
+        this.signal = { aborted: false };
+        this.abort = jest.fn();
+    }
+}
+// fetch and AbortController are process-globals, not per-file module state:
+// jest gives each test FILE its own module registry but they share one worker
+// process. Assigning them at module scope (as the sibling auto-start suite
+// does) leaves them mocked for every file that runs afterwards in the same
+// worker. Save and restore instead, so this suite can't be the reason some
+// unrelated file sees a stubbed fetch.
+const realFetch = global.fetch;
+const realAbortController = global.AbortController;
+beforeAll(() => {
+    global.fetch = mockFetch;
+    global.AbortController = MockAbortController;
+});
+afterAll(() => {
+    global.fetch = realFetch;
+    global.AbortController = realAbortController;
+    // Leave no timer chain behind for the next file in this worker.
+    YaverFeedback_1.YaverFeedback.destroy();
+    jest.useRealTimers();
+});
+beforeEach(() => {
+    jest.clearAllMocks();
+    discovered = null;
+    storedToken = null;
+    YaverFeedback_1.YaverFeedback.destroy();
+});
+afterEach(() => {
+    BlackBox_1.BlackBox.stop();
+    YaverFeedback_1.YaverFeedback.destroy();
+});
+describe('BlackBox auto-start on a cold start', () => {
+    it('starts once discovery resolves well after the old 500ms window', async () => {
+        const startSpy = jest.spyOn(BlackBox_1.BlackBox, 'start').mockImplementation(() => { });
+        storedToken = 'tok-from-storage';
+        // Nothing passed in — the real cold-start shape.
+        YaverFeedback_1.YaverFeedback.init({ trigger: 'shake', blackBox: { appName: 'talos-mobile' } });
+        // The window the old implementation checked, and only that window.
+        await jest.advanceTimersByTimeAsync(600);
+        expect(startSpy).not.toHaveBeenCalled();
+        // Discovery lands late, as it does on a real cold, off-LAN start.
+        discovered = 'http://10.0.0.5:18080';
+        await jest.advanceTimersByTimeAsync(4000);
+        expect(startSpy).toHaveBeenCalledWith(expect.objectContaining({ appName: 'talos-mobile' }));
+        startSpy.mockRestore();
+    });
+    it('never starts without a token, however long it waits', async () => {
+        // The guard that matters: starting tokenless makes the SSE channel 401 and
+        // retry with backoff — the string-concat + JSON-parse loop that SIGSEGV'd
+        // Hermes on iOS 18.3.1. Retrying must not erode it.
+        const startSpy = jest.spyOn(BlackBox_1.BlackBox, 'start').mockImplementation(() => { });
+        storedToken = null;
+        discovered = 'http://10.0.0.5:18080';
+        YaverFeedback_1.YaverFeedback.init({ trigger: 'shake' });
+        await jest.advanceTimersByTimeAsync(90000);
+        expect(startSpy).not.toHaveBeenCalled();
+        startSpy.mockRestore();
+    });
+    it('gives up rather than polling forever', async () => {
+        const startSpy = jest.spyOn(BlackBox_1.BlackBox, 'start').mockImplementation(() => { });
+        storedToken = null;
+        YaverFeedback_1.YaverFeedback.init({ trigger: 'shake' });
+        // Past the ~60s bound.
+        await jest.advanceTimersByTimeAsync(90000);
+        // Credentials arrive after the window closed — the poll is done.
+        storedToken = 'late';
+        discovered = 'http://10.0.0.5:18080';
+        await jest.advanceTimersByTimeAsync(10000);
+        expect(startSpy).not.toHaveBeenCalled();
+        startSpy.mockRestore();
+    });
+    it('signing in re-arms after the bound has passed', async () => {
+        // Giving up is only acceptable because this path exists: a user who signs
+        // in later gets the channel without restarting the app.
+        const startSpy = jest.spyOn(BlackBox_1.BlackBox, 'start').mockImplementation(() => { });
+        YaverFeedback_1.YaverFeedback.init({ trigger: 'shake' });
+        await jest.advanceTimersByTimeAsync(90000);
+        expect(startSpy).not.toHaveBeenCalled();
+        discovered = 'http://10.0.0.5:18080';
+        await YaverFeedback_1.YaverFeedback.setAuthToken('tok-from-login');
+        await jest.advanceTimersByTimeAsync(2000);
+        expect(startSpy).toHaveBeenCalled();
+        startSpy.mockRestore();
+    });
+    it('destroy() cancels a pending retry', async () => {
+        // A retry chain firing against a torn-down config would start the recorder
+        // for an SDK the host believes is off.
+        const startSpy = jest.spyOn(BlackBox_1.BlackBox, 'start').mockImplementation(() => { });
+        storedToken = 'tok';
+        YaverFeedback_1.YaverFeedback.init({ trigger: 'shake' });
+        await jest.advanceTimersByTimeAsync(600);
+        YaverFeedback_1.YaverFeedback.destroy();
+        discovered = 'http://10.0.0.5:18080';
+        await jest.advanceTimersByTimeAsync(10000);
+        expect(startSpy).not.toHaveBeenCalled();
+        startSpy.mockRestore();
+    });
+});

package/dist/__tests__/BrowserLaneIcon.test.d.ts

@@ -0,0 +1,3 @@
+declare function installFakeDom(): {
+    els: Record<string, any>;
+};

package/dist/__tests__/BrowserLaneIcon.test.js

@@ -0,0 +1,80 @@
+"use strict";
+/**
+ * Browser-lane DOM icon (feedback-sdk-lanes audit 2026-07-28). RN-web inside
+ * Yaver's fullScreen preview WebView: native shake can't fire and the container
+ * overlay is occluded, so the SDK mounts an occlusion-proof DOM icon. Node env,
+ * so we stub Platform.OS='web' + a minimal DOM.
+ */
+jest.mock('react-native', () => ({
+    Platform: { OS: 'web' },
+    NativeModules: {},
+}));
+// Minimal DOM stub — enough for mountBrowserLaneIcon's createElement/appendChild.
+function installFakeDom() {
+    const els = {};
+    const makeEl = () => ({
+        id: '',
+        textContent: '',
+        title: '',
+        style: {},
+        _handlers: {},
+        setAttribute() { },
+        setPointerCapture() { },
+        releasePointerCapture() { },
+        getBoundingClientRect: () => ({ left: 0, top: 0, width: 44, height: 44 }),
+        addEventListener(k, fn) { this._handlers[k] = fn; },
+    });
+    globalThis.window = {
+        innerWidth: 390, innerHeight: 844,
+        addEventListener() { },
+        __yaverLane: 'browser',
+    };
+    globalThis.localStorage = { getItem: () => null, setItem() { } };
+    globalThis.document = {
+        body: { appendChild(el) { els[el.id] = el; } },
+        getElementById: (id) => els[id] || null,
+        createElement: () => makeEl(),
+    };
+    return { els };
+}
+describe('RN SDK browser-lane icon', () => {
+    afterEach(() => {
+        delete globalThis.window;
+        delete globalThis.document;
+        delete globalThis.localStorage;
+        jest.resetModules();
+    });
+    it('detectWebLane reads window.__yaverLane on web', () => {
+        installFakeDom();
+        const { YaverFeedback } = require('../YaverFeedback');
+        expect(YaverFeedback.detectWebLane()).toBe('browser');
+    });
+    it('mounts a fixed, max-z-index, draggable DOM icon in the browser lane', () => {
+        const { els } = installFakeDom();
+        const { YaverFeedback } = require('../YaverFeedback');
+        YaverFeedback.mountBrowserLaneIcon();
+        const btn = els['yaver-feedback-btn'];
+        expect(btn).toBeTruthy();
+        expect(btn.textContent).toBe('Y');
+        expect(btn.style.cssText).toContain('position:fixed');
+        expect(btn.style.cssText).toContain('z-index:99999');
+        // Draggable: pointer handlers wired.
+        expect(typeof btn._handlers['pointerdown']).toBe('function');
+        expect(typeof btn._handlers['pointerup']).toBe('function');
+    });
+    it('is idempotent — a second mount does not stack a second icon', () => {
+        const { els } = installFakeDom();
+        const { YaverFeedback } = require('../YaverFeedback');
+        YaverFeedback.mountBrowserLaneIcon();
+        const first = els['yaver-feedback-btn'];
+        YaverFeedback.mountBrowserLaneIcon();
+        expect(els['yaver-feedback-btn']).toBe(first);
+    });
+    it('no-ops when not in a browser lane', () => {
+        const { els } = installFakeDom();
+        globalThis.window.__yaverLane = undefined;
+        const { YaverFeedback } = require('../YaverFeedback');
+        YaverFeedback.mountBrowserLaneIcon();
+        expect(els['yaver-feedback-btn']).toBeUndefined();
+    });
+});

package/dist/__tests__/P2PClient.test.js

@@ -119,7 +119,7 @@ describe('P2PClient', () => {
             const bundle = {
                 metadata: {
                     timestamp: '2026-03-24T00:00:00Z',
-                    device: {
+                    deviceInfo: {
                         platform: 'ios',
                         osVersion: '18.0',
                         model: 'iPhone 16',
@@ -145,7 +145,7 @@ describe('P2PClient', () => {
             const bundle = {
                 metadata: {
                     timestamp: '2026-03-24T00:00:00Z',
-                    device: { platform: 'ios', osVersion: '18', model: 'iPhone', screenWidth: 393, screenHeight: 852 },
+                    deviceInfo: { platform: 'ios', osVersion: '18', model: 'iPhone', screenWidth: 393, screenHeight: 852 },
                     app: {},
                 },
                 screenshots: [],

package/dist/__tests__/ReportIdentity.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/ReportIdentity.test.js

@@ -0,0 +1,168 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+// resolveAppIdentity() has always fed /vibing/execute and /dev/reload-app so
+// the agent could route "vibe on THIS app" to the right repo, but nothing fed
+// /feedback — reports carried no identity at all, so the agent's fix router
+// had nothing to resolve and fell back to whatever directory it was sitting
+// in. resolveReportIdentity() closes that gap for the feedback path.
+jest.mock('react-native', () => ({
+    Platform: { OS: 'ios' },
+    NativeModules: {},
+}));
+/** Mirrors mobile/app.json in the Talos repo — the SDK's first external consumer. */
+const EXPO_CONFIG = {
+    name: 'Talos',
+    slug: 'talos-mobile',
+    version: '1.9.157',
+    ios: { bundleIdentifier: 'works.talos.mobile', buildNumber: '427' },
+    android: { package: 'works.talos.mobile', versionCode: 423 },
+};
+function mockExpoConstants(expoConfig, extra = {}) {
+    jest.doMock('expo-constants', () => ({ default: { expoConfig, ...extra } }), { virtual: true });
+}
+beforeEach(() => {
+    jest.resetModules();
+});
+describe('resolveReportIdentity', () => {
+    it('resolves app name and bundle id from the Expo config', () => {
+        mockExpoConstants(EXPO_CONFIG);
+        const { resolveReportIdentity: resolve } = require('../P2PClient');
+        const identity = resolve();
+        // The agent's fix router reads DeviceInfo.AppName first.
+        expect(identity.appName).toBe('Talos');
+        // ...and resolves the project by bundle id, the only unambiguous key.
+        expect(identity.project?.bundleId).toBe('works.talos.mobile');
+        expect(identity.project?.projectName).toBe('Talos');
+        expect(identity.project?.appName).toBe('Talos');
+        expect(identity.project?.surface).toBe('mobile');
+        expect(identity.app.bundleId).toBe('works.talos.mobile');
+    });
+    it('never reports a project path', () => {
+        mockExpoConstants(EXPO_CONFIG);
+        const { resolveReportIdentity: resolve } = require('../P2PClient');
+        // The agent ignores client-supplied paths on feedback reports (an
+        // untrusted guest could otherwise aim the fix task's CWD at ~/.ssh).
+        // Sending one would be misleading at best.
+        expect(resolve().project?.projectPath).toBeUndefined();
+    });
+    it('prefers the native runtime version over the manifest version', () => {
+        mockExpoConstants(EXPO_CONFIG, { nativeAppVersion: '1.9.158', nativeBuildVersion: '428' });
+        const { resolveReportIdentity: resolve } = require('../P2PClient');
+        const identity = resolve();
+        // A stale manifest shouldn't misreport which build is actually running.
+        expect(identity.app.version).toBe('1.9.158');
+        expect(identity.app.buildNumber).toBe('428');
+    });
+    it('falls back to the manifest version when no native version is exposed', () => {
+        mockExpoConstants(EXPO_CONFIG);
+        const { resolveReportIdentity: resolve } = require('../P2PClient');
+        const identity = resolve();
+        expect(identity.app.version).toBe('1.9.157');
+        expect(identity.app.buildNumber).toBe('427');
+    });
+    // Inside Yaver's container the ambient runtime IS Yaver. These are the
+    // cases where getting it wrong routes a fix task into yaver.io and edits
+    // the SDK instead of the app under test.
+    describe('inside the Yaver container (Hermes guest)', () => {
+        const YAVER_CONFIG = {
+            name: 'Yaver',
+            version: '1.99.306',
+            ios: { bundleIdentifier: 'io.yaver.mobile' },
+            android: { package: 'io.yaver.mobile' },
+        };
+        function mockContainer(yaverInfo) {
+            jest.doMock('react-native', () => ({
+                Platform: { OS: 'ios' },
+                NativeModules: { YaverInfo: { isYaver: true, ...yaverInfo } },
+            }));
+            // The host's manifest — what expo-constants answers for a guest bundle.
+            mockExpoConstants(YAVER_CONFIG);
+        }
+        it("never reports the host's bundle id as the guest's", () => {
+            mockContainer({ inheritedGuestProjectName: 'talos / mobile' });
+            const { resolveReportIdentity: resolve } = require('../P2PClient');
+            const identity = resolve();
+            // The agent routes on bundle id FIRST. Leaking io.yaver.mobile here
+            // would resolve to yaver.io and the project name would never be read.
+            expect(identity.project?.bundleId).toBeUndefined();
+            expect(identity.app.bundleId).toBeUndefined();
+            // Nor should the host's version masquerade as the guest's build.
+            expect(identity.app.version).toBeUndefined();
+        });
+        it('reports the guest project Yaver pinned', () => {
+            mockContainer({ inheritedGuestProjectName: 'talos / mobile' });
+            const { resolveReportIdentity: resolve } = require('../P2PClient');
+            const identity = resolve();
+            expect(identity.appName).toBe('talos / mobile');
+            expect(identity.project?.projectName).toBe('talos / mobile');
+        });
+        it("lets the app's own declaration win over the pinned project", () => {
+            mockContainer({ inheritedGuestProjectName: 'something-else' });
+            const { resolveReportIdentity: resolve } = require('../P2PClient');
+            // A bundle knows its own identity; nothing ambient should override it.
+            const identity = resolve({ projectName: 'Talos', bundleId: 'works.talos.mobile' });
+            expect(identity.appName).toBe('Talos');
+            expect(identity.project?.bundleId).toBe('works.talos.mobile');
+        });
+        it('reports nothing rather than something wrong when no project is pinned', () => {
+            mockContainer({});
+            const { resolveReportIdentity: resolve } = require('../P2PClient');
+            // Better for the agent to reject/fall back than to confidently edit
+            // the wrong repo.
+            const identity = resolve();
+            expect(identity.project).toBeUndefined();
+            expect(identity.appName).toBeUndefined();
+            expect(identity.app).toEqual({});
+        });
+    });
+    it('lets an explicit declaration override the ambient identity', () => {
+        mockExpoConstants(EXPO_CONFIG);
+        const { resolveReportIdentity: resolve } = require('../P2PClient');
+        const identity = resolve({ projectName: 'Override', bundleId: 'com.override.app' });
+        expect(identity.appName).toBe('Override');
+        expect(identity.project?.bundleId).toBe('com.override.app');
+    });
+    it('passes declared surfaces stacks and voice metadata through', () => {
+        mockExpoConstants(EXPO_CONFIG);
+        const { resolveReportIdentity: resolve } = require('../P2PClient');
+        const identity = resolve({
+            projectName: 'Omni',
+            bundleId: 'io.example.omni',
+            surface: 'vision',
+            surfaces: ['mobile', 'web', 'watch', 'tv', 'car', 'vision'],
+            stack: 'react-native-expo',
+            stacks: ['react-native-expo', 'nextjs', 'yaver-xml'],
+            testSurfaces: ['rn-hermes', 'browser', 'visionos-simulator'],
+            feedbackSdk: 'yaver-feedback-react-native',
+            feedbackTransport: 'device-sdk',
+            voiceCapabilities: ['stt', 'tts', 'device-mic'],
+            sttProvider: 'deepgram',
+            ttsProvider: 'local',
+        });
+        expect(identity.project).toMatchObject({
+            surface: 'vision',
+            surfaces: ['mobile', 'web', 'watch', 'tv', 'car', 'vision'],
+            stack: 'react-native-expo',
+            stacks: ['react-native-expo', 'nextjs', 'yaver-xml'],
+            testSurfaces: ['rn-hermes', 'browser', 'visionos-simulator'],
+            feedbackSdk: 'yaver-feedback-react-native',
+            feedbackTransport: 'device-sdk',
+            voiceCapabilities: ['stt', 'tts', 'device-mic'],
+            sttProvider: 'deepgram',
+            ttsProvider: 'local',
+        });
+        expect(identity.project?.projectPath).toBeUndefined();
+    });
+    it('omits the project block when nothing identifies the app', () => {
+        // Bare RN with no expo-constants and no native modules. The report must
+        // still upload — the agent just resolves it by its own means.
+        jest.doMock('expo-constants', () => {
+            throw new Error('not installed');
+        }, { virtual: true });
+        const { resolveReportIdentity: resolve } = require('../P2PClient');
+        const identity = resolve();
+        expect(identity.project).toBeUndefined();
+        expect(identity.appName).toBeUndefined();
+        expect(identity.app).toEqual({});
+    });
+});

package/dist/__tests__/SDKToken.test.js

@@ -32,7 +32,7 @@ describe('SDK Token Auth', () => {
             const bundle = {
                 metadata: {
                     timestamp: '2026-03-25T00:00:00Z',
-                    device: { platform: 'ios', osVersion: '18', model: 'iPhone', screenWidth: 393, screenHeight: 852 },
+                    deviceInfo: { platform: 'ios', osVersion: '18', model: 'iPhone', screenWidth: 393, screenHeight: 852 },
                     app: {},
                 },
                 screenshots: [],

package/dist/__tests__/ShakeToggle.test.d.ts

@@ -0,0 +1 @@
+export {};