yaver-feedback-react-native 0.8.8 → 0.8.10

package/dist/FeedbackModal.js

@@ -1049,7 +1049,15 @@ const RunnerAuthNativeModal = ({ runner, onClose }) => {
     const [session, setSession] = (0, react_1.useState)(null);
     const [startError, setStartError] = (0, react_1.useState)(null);
     const [copied, setCopied] = (0, react_1.useState)(false);
+    const [pasteCode, setPasteCode] = (0, react_1.useState)('');
+    const [submitting, setSubmitting] = (0, react_1.useState)(false);
+    const [submitError, setSubmitError] = (0, react_1.useState)(null);
     const startedRef = (0, react_1.useRef)(false);
+    // Claude is the only runner that needs the user to paste a verifier
+    // code back from platform.claude.com's callback page; Codex device-
+    // auth and OpenCode (no OAuth at all) bypass this. Mirrors the
+    // requiresPasteBack check in iOS YaverRunnerAuthFlowPane.swift.
+    const needsPasteBack = runner === 'claude' || runner === 'claude-code';
     (0, react_1.useEffect)(() => {
         if (startedRef.current)
             return;
@@ -1164,9 +1172,68 @@ const RunnerAuthNativeModal = ({ runner, onClose }) => {
                     </react_native_1.Text>
                   </react_native_1.Pressable>
                 </react_native_1.View>) : null}
+              {needsPasteBack ? (<react_native_1.View style={{ marginTop: 14 }}>
+                  <react_native_1.Text style={runnerAuthModalStyles.codeLabel}>
+                    PASTE CODE FROM CLAUDE.COM
+                  </react_native_1.Text>
+                  <react_native_1.View style={{ flexDirection: 'row', gap: 8, marginTop: 6 }}>
+                    <react_native_1.View style={{
+                    flex: 1,
+                    backgroundColor: 'rgba(148,163,184,0.10)',
+                    borderRadius: 10,
+                    paddingHorizontal: 10,
+                }}>
+                      {/* Lazy-import TextInput so the SDK doesn't pull
+                    extra surface from react-native at module load. */}
+                      {(() => {
+                    const { TextInput } = require('react-native');
+                    return (<TextInput value={pasteCode} onChangeText={(t) => {
+                            setPasteCode(t);
+                            setSubmitError(null);
+                        }} placeholder="paste code here" placeholderTextColor="#64748b" autoCapitalize="none" autoCorrect={false} spellCheck={false} style={{ color: '#f1f5f9', fontSize: 14, paddingVertical: 10 }}/>);
+                })()}
+                    </react_native_1.View>
+                    <react_native_1.Pressable disabled={!pasteCode.trim() || submitting} onPress={async () => {
+                    if (!session || !pasteCode.trim())
+                        return;
+                    setSubmitting(true);
+                    setSubmitError(null);
+                    try {
+                        const next = await YaverFeedback_1.YaverFeedback.submitRunnerBrowserAuthCode(session.id, pasteCode.trim());
+                        setSession(next);
+                        setPasteCode('');
+                    }
+                    catch (err) {
+                        setSubmitError(err instanceof Error ? err.message : String(err));
+                    }
+                    finally {
+                        setSubmitting(false);
+                    }
+                }} style={{
+                    paddingHorizontal: 14,
+                    justifyContent: 'center',
+                    backgroundColor: !pasteCode.trim() || submitting
+                        ? 'rgba(124,58,237,0.4)'
+                        : '#7c3aed',
+                    borderRadius: 10,
+                }}>
+                      <react_native_1.Text style={{ color: 'white', fontWeight: '600' }}>
+                        {submitting ? '…' : 'Submit'}
+                      </react_native_1.Text>
+                    </react_native_1.Pressable>
+                  </react_native_1.View>
+                  {submitError ? (<react_native_1.Text style={{
+                        marginTop: 6,
+                        color: '#fca5a5',
+                        fontSize: 12,
+                    }}>
+                      {submitError}
+                    </react_native_1.Text>) : null}
+                </react_native_1.View>) : null}
               <react_native_1.Text style={runnerAuthModalStyles.phishingHint}>
-                Device codes are a common phishing target. Never share this code. This dialog
-                turns green automatically once sign-in completes.
+                {needsPasteBack
+                ? 'After authorising on platform.claude.com, copy the code from the callback page and paste it above. Never share this code.'
+                : 'Device codes are a common phishing target. Never share this code. This dialog turns green automatically once sign-in completes.'}
               </react_native_1.Text>
             </react_native_1.View>)}
         </react_native_1.View>

package/dist/P2PClient.d.ts

@@ -47,6 +47,12 @@ export declare class P2PClient {
     startRunnerBrowserAuth(runner: string): Promise<RunnerBrowserAuthSession>;
     getRunnerBrowserAuthStatus(sessionId: string): Promise<RunnerBrowserAuthSession>;
     cancelRunnerBrowserAuth(sessionId: string): Promise<void>;
+    /** Submit the verifier code Anthropic shows on the callback page so
+     *  the agent can finalise claude CLI's OAuth handshake. Codex doesn't
+     *  use this — its device-auth flow auto-resolves via polling — but
+     *  the SDK still exposes it for symmetry with mobile/src/components/
+     *  RunnerAuthModal.tsx and the Swift YaverRunnerAuthFlowPane. */
+    submitRunnerBrowserAuthCode(sessionId: string, code: string): Promise<RunnerBrowserAuthSession>;
     capabilitySnapshot(): Promise<CapabilitySnapshot | null>;
     incidents(opts?: {
         category?: string;

package/dist/P2PClient.js

@@ -155,6 +155,25 @@ class P2PClient {
         }
         catch { /* best-effort */ }
     }
+    /** Submit the verifier code Anthropic shows on the callback page so
+     *  the agent can finalise claude CLI's OAuth handshake. Codex doesn't
+     *  use this — its device-auth flow auto-resolves via polling — but
+     *  the SDK still exposes it for symmetry with mobile/src/components/
+     *  RunnerAuthModal.tsx and the Swift YaverRunnerAuthFlowPane. */
+    async submitRunnerBrowserAuthCode(sessionId, code) {
+        const url = `${this.baseUrl}/runner-auth/browser/submit-code`;
+        const resp = await fetch(url, {
+            method: 'POST',
+            headers: { ...this.authHeaders(), 'Content-Type': 'application/json' },
+            body: JSON.stringify({ id: sessionId, code }),
+        });
+        if (!resp.ok) {
+            const text = await resp.text().catch(() => '');
+            throw new Error(`submitRunnerBrowserAuthCode HTTP ${resp.status}: ${text}`);
+        }
+        const data = await resp.json();
+        return data.session;
+    }
     async capabilitySnapshot() {
         try {
             const resp = await fetch(`${this.baseUrl}/capabilities/snapshot`, { headers: this.authHeaders() });

package/dist/YaverFeedback.d.ts

@@ -78,6 +78,10 @@ export declare class YaverFeedback {
     static startRunnerBrowserAuth(runner: string): Promise<import('./types').RunnerBrowserAuthSession>;
     static getRunnerBrowserAuthStatus(sessionId: string): Promise<import('./types').RunnerBrowserAuthSession>;
     static cancelRunnerBrowserAuth(sessionId: string): Promise<void>;
+    /** Submit the Claude paste-back verifier so the agent can finalise the
+     *  OAuth handshake. RunnerAuthModal calls this after the user copies
+     *  the code from platform.claude.com's callback page. */
+    static submitRunnerBrowserAuthCode(sessionId: string, code: string): Promise<import('./types').RunnerBrowserAuthSession>;
     /**
      * Sign out: clear cached token + device, tear down the P2P client. The
      * SDK stays enabled; the next feedback trigger will re-prompt for login.

package/dist/YaverFeedback.js

@@ -13,10 +13,13 @@ const preferences_1 = require("./preferences");
 // (mobile/ios/Yaver/YaverInfo.{swift,m} + Android counterpart); a
 // standalone app bundled by its own developer has no such module.
 // When the SDK is loaded through Yaver's Hermes-push guest runtime we
-// deliberately no-op every public entry point — Yaver owns the shake
-// gesture ("Reload / Back to Yaver" overlay), the feedback capture
-// flow, and the BlackBox streaming; running a second copy from inside
-// the guest just produces duplicate UIs and double P2P sessions.
+// run in HOST MODE: dormant by default (no shake detector, no auto
+// BlackBox, no QuickActionIcon — Yaver's host shell owns those), but
+// we DO register a DeviceEventEmitter listener so Yaver's overlay can
+// flip the SDK live at runtime. When the user shakes inside the guest
+// app and taps "Feedback" on the Yaver overlay, AppDelegate dispatches
+// `yaverFeedback:startReport` into this bridge; the listener wakes the
+// SDK and opens the modal in-place over the running guest UI.
 function isRunningInsideYaverHost() {
     try {
         return !!react_native_1.NativeModules?.YaverInfo;
@@ -25,11 +28,108 @@ function isRunningInsideYaverHost() {
         return false;
     }
 }
-// Suppresses SDK activation when inside Yaver super-host. Callers of
-// YaverFeedback.init / startReport / startBatchRecording / … early-out
-// by checking this first so the SDK's side effects (accelerometer,
-// BlackBox HTTP, SSE command channel, FeedbackModal mount) never start.
-const YAVER_HOST_SUPPRESS = isRunningInsideYaverHost();
+// Two distinct compile-time modes for a guest app like sfmg / talos:
+//
+//   YAVER_HOST_MODE  — bundled by Yaver's agent (/dev/build-native) for
+//                      loading inside Yaver mobile. SDK code is in the
+//                      bundle but boots PASSIVE: no shake detector, no
+//                      auto-BlackBox, no container UI. Yaver's host
+//                      overlay owns the shake gesture; when the user
+//                      taps "Feedback" on Yaver's overlay, AppDelegate
+//                      dispatches yaverFeedback:hostActivate into this
+//                      bridge and the SDK runtime-flips active for a
+//                      single feedback session.
+//
+//   YAVER_SDK_MODE   — sfmg's own standalone TestFlight / Play Store
+//                      build, with the Yaver SDK embedded. SDK boots
+//                      active: shake → modal directly, no Yaver host
+//                      involved. Default for normal `expo build`.
+//
+// Both can be forced at build time via process.env. When neither is
+// set, fall back to runtime detection: if the YaverInfo native module
+// exists (we're inside Yaver), assume HOST_MODE; else SDK_MODE. This
+// keeps older bundles (built before the agent learned to set the env)
+// working unchanged.
+const YAVER_HOST_MODE_BUILD = (() => {
+    try {
+        const v = process.env?.YAVER_HOST_MODE;
+        return v === 'true' || v === '1' || v === true || v === 1;
+    }
+    catch {
+        return false;
+    }
+})();
+const YAVER_SDK_MODE_BUILD = (() => {
+    try {
+        const v = process.env?.YAVER_SDK_MODE;
+        return v === 'true' || v === '1' || v === true || v === 1;
+    }
+    catch {
+        return false;
+    }
+})();
+// Effective mode after considering build flags AND runtime detection.
+const IS_HOST_MODE = YAVER_HOST_MODE_BUILD ||
+    (!YAVER_SDK_MODE_BUILD && isRunningInsideYaverHost());
+// Tracks whether we've been runtime-activated by the host (sfmg-in-Yaver
+// case). Independent of `enabled` so we can tell "host turned us on for
+// one shot" apart from "developer toggled enabled programmatically".
+let hostActivated = false;
+// Host-activation listener. Always registered when in HOST mode so a
+// Yaver overlay tap can wake the SDK even before the guest's
+// YaverFeedback.init() runs. AppDelegate (mobile/ios/Yaver/AppDelegate.
+// swift::handleFeedbackTap) sends `yaverFeedback:startReport` into the
+// guest bridge when the user picks Feedback on the shake overlay.
+//
+// Activation flow:
+//   1. Try Yaver's existing bearer (NativeModules.YaverInfo.
+//      inheritedAuthToken, populated by Yaver mobile's auth.ts on
+//      sign-in). Validate against /auth/validate before trusting.
+//   2. If valid: setAuthToken + open feedback modal in-place (the
+//      modal already supports hot reload, screenshot, vibing chat).
+//   3. If missing or invalid: open the SDK's own login screen.
+if (IS_HOST_MODE) {
+    try {
+        const { DeviceEventEmitter } = require('react-native');
+        DeviceEventEmitter.addListener('yaverFeedback:startReport', () => {
+            hostActivated = true;
+            enabled = true;
+            void (async () => {
+                const yi = react_native_1.NativeModules?.YaverInfo;
+                const inheritedToken = String(yi?.inheritedAuthToken || '').trim();
+                const inheritedAgent = String(yi?.inheritedAgentUrl || '').trim();
+                const inheritedDevice = String(yi?.inheritedDeviceId || '').trim();
+                if (inheritedToken) {
+                    // Lazy-import auth.ts so module load doesn't drag the auth
+                    // network code into the active set when the SDK is dormant.
+                    const { validateToken } = require('./auth');
+                    const user = await validateToken(inheritedToken).catch(() => null);
+                    if (user) {
+                        // Seed config + connect the SDK to the host's auth.
+                        if (!config) {
+                            YaverFeedback.init({
+                                authToken: inheritedToken,
+                                agentUrl: inheritedAgent || undefined,
+                                preferredDeviceId: inheritedDevice || undefined,
+                            });
+                        }
+                        await YaverFeedback.setAuthToken(inheritedToken);
+                        await YaverFeedback.startReport();
+                        return;
+                    }
+                }
+                // No token, or token invalid — fall through to the SDK's own
+                // login screen. The user picks an OAuth provider; on success
+                // the modal continues with the new token.
+                if (!config) {
+                    YaverFeedback.init({});
+                }
+                YaverFeedback.showLogin();
+            })();
+        });
+    }
+    catch { /* react-native unavailable in jsdom unit tests */ }
+}
 let config = null;
 let enabled = false;
 let p2pClient = null;
@@ -102,17 +202,34 @@ class YaverFeedback {
      * via `YaverDiscovery` on the first `startReport()` call.
      */
     static init(cfg) {
-        if (YAVER_HOST_SUPPRESS) {
-            // Running inside Yaver's super-host — yield to Yaver's native UX.
-            enabled = false;
-            return;
-        }
         config = {
             trigger: 'shake',
             maxRecordingDuration: 120,
             autoLogin: true,
             ...cfg,
         };
+        if (IS_HOST_MODE) {
+            // sfmg / talos / etc. running inside Yaver mobile (compile-time
+            // YAVER_HOST_MODE or runtime-detected). Store config so a later
+            // host activation (yaverFeedback:startReport from AppDelegate)
+            // can open the modal — but skip the side effects Yaver's host
+            // shell owns: shake detector, auto-BlackBox, QuickActionIcon.
+            enabled = false;
+            // Configure auth endpoints + strict-native-auth even in passive
+            // mode so a host-activated session uses the same login routing
+            // the standalone path would.
+            (0, auth_1.configureAuthEndpoints)({
+                convexSiteUrl: cfg.authConvexSiteUrl,
+                webBaseUrl: cfg.authWebBaseUrl,
+            });
+            (0, auth_1.setStrictNativeAuth)(cfg.strictNativeAuth === true);
+            if (!config.convexUrl) {
+                config.convexUrl = cfg.authConvexSiteUrl ?? auth_1.DEFAULT_CONVEX_SITE_URL;
+            }
+            maxErrors = cfg.maxCapturedErrors ?? 5;
+            errorBuffer = [];
+            return;
+        }
         if (config.disableShakeGesture && (!config.quickIcon || config.quickIcon === 'auto')) {
             config.quickIcon = 'always';
         }
@@ -454,6 +571,15 @@ class YaverFeedback {
             return;
         await p2pClient.cancelRunnerBrowserAuth(sessionId);
     }
+    /** Submit the Claude paste-back verifier so the agent can finalise the
+     *  OAuth handshake. RunnerAuthModal calls this after the user copies
+     *  the code from platform.claude.com's callback page. */
+    static async submitRunnerBrowserAuthCode(sessionId, code) {
+        if (!p2pClient) {
+            throw new Error('Not connected to any agent.');
+        }
+        return p2pClient.submitRunnerBrowserAuthCode(sessionId, code);
+    }
     /**
      * Sign out: clear cached token + device, tear down the P2P client. The
      * SDK stays enabled; the next feedback trigger will re-prompt for login.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yaver-feedback-react-native",
-  "version": "0.8.8",
+  "version": "0.8.10",
   "description": "Visual feedback SDK for Yaver \u2014 bug reports, screen recording, voice annotations, and local-first developer workflows",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/FeedbackModal.tsx

@@ -1251,7 +1251,15 @@ const RunnerAuthNativeModal: React.FC<{
   const [session, setSession] = useState<import('./types').RunnerBrowserAuthSession | null>(null);
   const [startError, setStartError] = useState<string | null>(null);
   const [copied, setCopied] = useState(false);
+  const [pasteCode, setPasteCode] = useState('');
+  const [submitting, setSubmitting] = useState(false);
+  const [submitError, setSubmitError] = useState<string | null>(null);
   const startedRef = useRef(false);
+  // Claude is the only runner that needs the user to paste a verifier
+  // code back from platform.claude.com's callback page; Codex device-
+  // auth and OpenCode (no OAuth at all) bypass this. Mirrors the
+  // requiresPasteBack check in iOS YaverRunnerAuthFlowPane.swift.
+  const needsPasteBack = runner === 'claude' || runner === 'claude-code';
 
   useEffect(() => {
     if (startedRef.current) return;
@@ -1380,9 +1388,92 @@ const RunnerAuthNativeModal: React.FC<{
                   </Pressable>
                 </View>
               ) : null}
+              {needsPasteBack ? (
+                <View style={{ marginTop: 14 }}>
+                  <Text style={runnerAuthModalStyles.codeLabel}>
+                    PASTE CODE FROM CLAUDE.COM
+                  </Text>
+                  <View style={{ flexDirection: 'row', gap: 8, marginTop: 6 }}>
+                    <View
+                      style={{
+                        flex: 1,
+                        backgroundColor: 'rgba(148,163,184,0.10)',
+                        borderRadius: 10,
+                        paddingHorizontal: 10,
+                      }}
+                    >
+                      {/* Lazy-import TextInput so the SDK doesn't pull
+                          extra surface from react-native at module load. */}
+                      {(() => {
+                        const { TextInput } = require('react-native');
+                        return (
+                          <TextInput
+                            value={pasteCode}
+                            onChangeText={(t: string) => {
+                              setPasteCode(t);
+                              setSubmitError(null);
+                            }}
+                            placeholder="paste code here"
+                            placeholderTextColor="#64748b"
+                            autoCapitalize="none"
+                            autoCorrect={false}
+                            spellCheck={false}
+                            style={{ color: '#f1f5f9', fontSize: 14, paddingVertical: 10 }}
+                          />
+                        );
+                      })()}
+                    </View>
+                    <Pressable
+                      disabled={!pasteCode.trim() || submitting}
+                      onPress={async () => {
+                        if (!session || !pasteCode.trim()) return;
+                        setSubmitting(true);
+                        setSubmitError(null);
+                        try {
+                          const next = await YaverFeedback.submitRunnerBrowserAuthCode(
+                            session.id,
+                            pasteCode.trim(),
+                          );
+                          setSession(next);
+                          setPasteCode('');
+                        } catch (err) {
+                          setSubmitError(err instanceof Error ? err.message : String(err));
+                        } finally {
+                          setSubmitting(false);
+                        }
+                      }}
+                      style={{
+                        paddingHorizontal: 14,
+                        justifyContent: 'center',
+                        backgroundColor:
+                          !pasteCode.trim() || submitting
+                            ? 'rgba(124,58,237,0.4)'
+                            : '#7c3aed',
+                        borderRadius: 10,
+                      }}
+                    >
+                      <Text style={{ color: 'white', fontWeight: '600' }}>
+                        {submitting ? '…' : 'Submit'}
+                      </Text>
+                    </Pressable>
+                  </View>
+                  {submitError ? (
+                    <Text
+                      style={{
+                        marginTop: 6,
+                        color: '#fca5a5',
+                        fontSize: 12,
+                      }}
+                    >
+                      {submitError}
+                    </Text>
+                  ) : null}
+                </View>
+              ) : null}
               <Text style={runnerAuthModalStyles.phishingHint}>
-                Device codes are a common phishing target. Never share this code. This dialog
-                turns green automatically once sign-in completes.
+                {needsPasteBack
+                  ? 'After authorising on platform.claude.com, copy the code from the callback page and paste it above. Never share this code.'
+                  : 'Device codes are a common phishing target. Never share this code. This dialog turns green automatically once sign-in completes.'}
               </Text>
             </View>
           )}

package/src/P2PClient.ts

@@ -199,6 +199,29 @@ export class P2PClient {
     try { await fetch(url, { method: 'POST', headers: this.authHeaders() }); } catch { /* best-effort */ }
   }
 
+  /** Submit the verifier code Anthropic shows on the callback page so
+   *  the agent can finalise claude CLI's OAuth handshake. Codex doesn't
+   *  use this — its device-auth flow auto-resolves via polling — but
+   *  the SDK still exposes it for symmetry with mobile/src/components/
+   *  RunnerAuthModal.tsx and the Swift YaverRunnerAuthFlowPane. */
+  async submitRunnerBrowserAuthCode(
+    sessionId: string,
+    code: string,
+  ): Promise<RunnerBrowserAuthSession> {
+    const url = `${this.baseUrl}/runner-auth/browser/submit-code`;
+    const resp = await fetch(url, {
+      method: 'POST',
+      headers: { ...this.authHeaders(), 'Content-Type': 'application/json' },
+      body: JSON.stringify({ id: sessionId, code }),
+    });
+    if (!resp.ok) {
+      const text = await resp.text().catch(() => '');
+      throw new Error(`submitRunnerBrowserAuthCode HTTP ${resp.status}: ${text}`);
+    }
+    const data = await resp.json();
+    return data.session as RunnerBrowserAuthSession;
+  }
+
   async capabilitySnapshot(): Promise<CapabilitySnapshot | null> {
     try {
       const resp = await fetch(`${this.baseUrl}/capabilities/snapshot`, { headers: this.authHeaders() });

package/src/YaverFeedback.ts

@@ -28,10 +28,13 @@ import {
 // (mobile/ios/Yaver/YaverInfo.{swift,m} + Android counterpart); a
 // standalone app bundled by its own developer has no such module.
 // When the SDK is loaded through Yaver's Hermes-push guest runtime we
-// deliberately no-op every public entry point — Yaver owns the shake
-// gesture ("Reload / Back to Yaver" overlay), the feedback capture
-// flow, and the BlackBox streaming; running a second copy from inside
-// the guest just produces duplicate UIs and double P2P sessions.
+// run in HOST MODE: dormant by default (no shake detector, no auto
+// BlackBox, no QuickActionIcon — Yaver's host shell owns those), but
+// we DO register a DeviceEventEmitter listener so Yaver's overlay can
+// flip the SDK live at runtime. When the user shakes inside the guest
+// app and taps "Feedback" on the Yaver overlay, AppDelegate dispatches
+// `yaverFeedback:startReport` into this bridge; the listener wakes the
+// SDK and opens the modal in-place over the running guest UI.
 function isRunningInsideYaverHost(): boolean {
   try {
     return !!(NativeModules as any)?.YaverInfo;
@@ -40,11 +43,105 @@ function isRunningInsideYaverHost(): boolean {
   }
 }
 
-// Suppresses SDK activation when inside Yaver super-host. Callers of
-// YaverFeedback.init / startReport / startBatchRecording / … early-out
-// by checking this first so the SDK's side effects (accelerometer,
-// BlackBox HTTP, SSE command channel, FeedbackModal mount) never start.
-const YAVER_HOST_SUPPRESS = isRunningInsideYaverHost();
+// Two distinct compile-time modes for a guest app like sfmg / talos:
+//
+//   YAVER_HOST_MODE  — bundled by Yaver's agent (/dev/build-native) for
+//                      loading inside Yaver mobile. SDK code is in the
+//                      bundle but boots PASSIVE: no shake detector, no
+//                      auto-BlackBox, no container UI. Yaver's host
+//                      overlay owns the shake gesture; when the user
+//                      taps "Feedback" on Yaver's overlay, AppDelegate
+//                      dispatches yaverFeedback:hostActivate into this
+//                      bridge and the SDK runtime-flips active for a
+//                      single feedback session.
+//
+//   YAVER_SDK_MODE   — sfmg's own standalone TestFlight / Play Store
+//                      build, with the Yaver SDK embedded. SDK boots
+//                      active: shake → modal directly, no Yaver host
+//                      involved. Default for normal `expo build`.
+//
+// Both can be forced at build time via process.env. When neither is
+// set, fall back to runtime detection: if the YaverInfo native module
+// exists (we're inside Yaver), assume HOST_MODE; else SDK_MODE. This
+// keeps older bundles (built before the agent learned to set the env)
+// working unchanged.
+const YAVER_HOST_MODE_BUILD = (() => {
+  try {
+    const v = (process.env as any)?.YAVER_HOST_MODE;
+    return v === 'true' || v === '1' || v === true || v === 1;
+  } catch { return false; }
+})();
+const YAVER_SDK_MODE_BUILD = (() => {
+  try {
+    const v = (process.env as any)?.YAVER_SDK_MODE;
+    return v === 'true' || v === '1' || v === true || v === 1;
+  } catch { return false; }
+})();
+
+// Effective mode after considering build flags AND runtime detection.
+const IS_HOST_MODE =
+  YAVER_HOST_MODE_BUILD ||
+  (!YAVER_SDK_MODE_BUILD && isRunningInsideYaverHost());
+
+// Tracks whether we've been runtime-activated by the host (sfmg-in-Yaver
+// case). Independent of `enabled` so we can tell "host turned us on for
+// one shot" apart from "developer toggled enabled programmatically".
+let hostActivated = false;
+
+// Host-activation listener. Always registered when in HOST mode so a
+// Yaver overlay tap can wake the SDK even before the guest's
+// YaverFeedback.init() runs. AppDelegate (mobile/ios/Yaver/AppDelegate.
+// swift::handleFeedbackTap) sends `yaverFeedback:startReport` into the
+// guest bridge when the user picks Feedback on the shake overlay.
+//
+// Activation flow:
+//   1. Try Yaver's existing bearer (NativeModules.YaverInfo.
+//      inheritedAuthToken, populated by Yaver mobile's auth.ts on
+//      sign-in). Validate against /auth/validate before trusting.
+//   2. If valid: setAuthToken + open feedback modal in-place (the
+//      modal already supports hot reload, screenshot, vibing chat).
+//   3. If missing or invalid: open the SDK's own login screen.
+if (IS_HOST_MODE) {
+  try {
+    const { DeviceEventEmitter } = require('react-native');
+    DeviceEventEmitter.addListener('yaverFeedback:startReport', () => {
+      hostActivated = true;
+      enabled = true;
+      void (async () => {
+        const yi = (NativeModules as any)?.YaverInfo;
+        const inheritedToken = String(yi?.inheritedAuthToken || '').trim();
+        const inheritedAgent = String(yi?.inheritedAgentUrl || '').trim();
+        const inheritedDevice = String(yi?.inheritedDeviceId || '').trim();
+        if (inheritedToken) {
+          // Lazy-import auth.ts so module load doesn't drag the auth
+          // network code into the active set when the SDK is dormant.
+          const { validateToken } = require('./auth');
+          const user = await validateToken(inheritedToken).catch(() => null);
+          if (user) {
+            // Seed config + connect the SDK to the host's auth.
+            if (!config) {
+              YaverFeedback.init({
+                authToken: inheritedToken,
+                agentUrl: inheritedAgent || undefined,
+                preferredDeviceId: inheritedDevice || undefined,
+              } as FeedbackConfig);
+            }
+            await YaverFeedback.setAuthToken(inheritedToken);
+            await YaverFeedback.startReport();
+            return;
+          }
+        }
+        // No token, or token invalid — fall through to the SDK's own
+        // login screen. The user picks an OAuth provider; on success
+        // the modal continues with the new token.
+        if (!config) {
+          YaverFeedback.init({} as FeedbackConfig);
+        }
+        YaverFeedback.showLogin();
+      })();
+    });
+  } catch { /* react-native unavailable in jsdom unit tests */ }
+}
 
 let config: FeedbackConfig | null = null;
 let enabled = false;
@@ -126,17 +223,34 @@ export class YaverFeedback {
    * via `YaverDiscovery` on the first `startReport()` call.
    */
   static init(cfg: FeedbackConfig): void {
-    if (YAVER_HOST_SUPPRESS) {
-      // Running inside Yaver's super-host — yield to Yaver's native UX.
-      enabled = false;
-      return;
-    }
     config = {
       trigger: 'shake',
       maxRecordingDuration: 120,
       autoLogin: true,
       ...cfg,
     };
+    if (IS_HOST_MODE) {
+      // sfmg / talos / etc. running inside Yaver mobile (compile-time
+      // YAVER_HOST_MODE or runtime-detected). Store config so a later
+      // host activation (yaverFeedback:startReport from AppDelegate)
+      // can open the modal — but skip the side effects Yaver's host
+      // shell owns: shake detector, auto-BlackBox, QuickActionIcon.
+      enabled = false;
+      // Configure auth endpoints + strict-native-auth even in passive
+      // mode so a host-activated session uses the same login routing
+      // the standalone path would.
+      configureAuthEndpoints({
+        convexSiteUrl: cfg.authConvexSiteUrl,
+        webBaseUrl: cfg.authWebBaseUrl,
+      });
+      setStrictNativeAuth(cfg.strictNativeAuth === true);
+      if (!config.convexUrl) {
+        config.convexUrl = cfg.authConvexSiteUrl ?? DEFAULT_CONVEX_SITE_URL;
+      }
+      maxErrors = cfg.maxCapturedErrors ?? 5;
+      errorBuffer = [];
+      return;
+    }
     if (config.disableShakeGesture && (!config.quickIcon || config.quickIcon === 'auto')) {
       config.quickIcon = 'always';
     }
@@ -482,6 +596,19 @@ export class YaverFeedback {
     await p2pClient.cancelRunnerBrowserAuth(sessionId);
   }
 
+  /** Submit the Claude paste-back verifier so the agent can finalise the
+   *  OAuth handshake. RunnerAuthModal calls this after the user copies
+   *  the code from platform.claude.com's callback page. */
+  static async submitRunnerBrowserAuthCode(
+    sessionId: string,
+    code: string,
+  ): Promise<import('./types').RunnerBrowserAuthSession> {
+    if (!p2pClient) {
+      throw new Error('Not connected to any agent.');
+    }
+    return p2pClient.submitRunnerBrowserAuthCode(sessionId, code);
+  }
+
   /**
    * Sign out: clear cached token + device, tear down the P2P client. The
    * SDK stays enabled; the next feedback trigger will re-prompt for login.