yaver-feedback-react-native 0.9.2 → 0.9.3

package/dist/_core/ansi.test.js

@@ -0,0 +1,225 @@
+"use strict";
+// AUTO-SYNCED from shared/client-core/src/ansi.test.ts.
+// DO NOT EDIT IN PLACE. Edit the source and re-run
+// scripts/sync-client-core.sh. CI checks drift via `--check`.
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * ansi.test.ts — guards for the shared ANSI tokenizer.
+ *
+ * The bug this exists for (2026-08-09): the dashboard and mobile app both
+ * flattened opencode's raw ANSI stream to plain text with stripAnsi, losing
+ * every colour the console has, while the xterm Terminal view kept the
+ * bytes — two surfaces, two looks, one product. The tokenizer below is the
+ * single classifier both chat renderers consume; these tests pin the tokens
+ * so a renderer drift (web spans vs mobile nested Text) can never silently
+ * change what a user sees.
+ *
+ * Run: npx tsx shared/client-core/src/ansi.test.ts
+ */
+const ansi_1 = require("./ansi");
+let failures = 0;
+const eq = (got, want, label) => {
+    if (JSON.stringify(got) === JSON.stringify(want))
+        console.log(`ok   ${label}`);
+    else {
+        console.error(`FAIL ${label}:\n  got  ${JSON.stringify(got)}\n  want ${JSON.stringify(want)}`);
+        failures++;
+    }
+};
+const ok = (c, label) => eq(Boolean(c), true, label);
+// ── plain text passes through untouched ─────────────────────────────────
+{
+    const t = (0, ansi_1.tokenizeAnsi)("hello world");
+    eq(t, [{ text: "hello world" }], "plain text → single unstyled token");
+}
+// ── SGR colours ──────────────────────────────────────────────────────────
+{
+    const t = (0, ansi_1.tokenizeAnsi)("\x1b[31mred\x1b[0m plain");
+    eq(t, [
+        { text: "red", fg: { kind: "named", index: 1 } },
+        { text: " plain" },
+    ], "red text then reset → two tokens");
+}
+{
+    const t = (0, ansi_1.tokenizeAnsi)("\x1b[32m+\x1b[0m added");
+    eq(t, [
+        { text: "+", fg: { kind: "named", index: 2 } },
+        { text: " added" },
+    ], "green + line (git patch)");
+}
+{
+    const t = (0, ansi_1.tokenizeAnsi)("\x1b[1m\x1b[33m$ ls\x1b[0m");
+    eq(t, [
+        { text: "$ ls", fg: { kind: "named", index: 3 }, bold: true },
+    ], "bold yellow $ prompt");
+}
+// ── 256-colour palette ──────────────────────────────────────────────────
+{
+    const t = (0, ansi_1.tokenizeAnsi)("\x1b[38;5;208morange\x1b[0m");
+    eq(t, [
+        { text: "orange", fg: { kind: "palette", index: 208 } },
+    ], "xterm-256 orange (208)");
+}
+{
+    const [r, g, b] = (0, ansi_1.paletteRgb)(208);
+    ok(r > 200 && g > 80 && g < 160 && b < 60, "palette 208 is orange-ish RGB");
+}
+{
+    const [r, g, b] = (0, ansi_1.paletteRgb)(2);
+    eq([r, g, b], [...ansi_1.ANSI_16_RGB[2]], "palette index <16 maps to the standard 16");
+}
+// ── truecolor ───────────────────────────────────────────────────────────
+{
+    const t = (0, ansi_1.tokenizeAnsi)("\x1b[38;2;255;120;50mtrue\x1b[0m");
+    eq(t, [
+        { text: "true", fg: { kind: "rgb", rgb: [255, 120, 50] } },
+    ], "truecolor SGR 38;2;r;g;b");
+}
+// ── background ──────────────────────────────────────────────────────────
+{
+    const t = (0, ansi_1.tokenizeAnsi)("\x1b[48;5;236mgray bg\x1b[0m");
+    eq(t, [
+        { text: "gray bg", bg: { kind: "palette", index: 236 } },
+    ], "xterm-256 background (patch gray)");
+}
+// ── bold / dim / underline / strike ─────────────────────────────────────
+{
+    const t = (0, ansi_1.tokenizeAnsi)("\x1b[1mbold\x1b[22m \x1b[2mdim\x1b[0m \x1b[4munder\x1b[0m \x1b[9mstrike\x1b[0m");
+    eq(t, [
+        { text: "bold", bold: true },
+        { text: " " },
+        { text: "dim", dim: true },
+        { text: " " },
+        { text: "under", underline: true },
+        { text: " " },
+        { text: "strike", strike: true },
+    ], "bold/dim/underline/strike attributes");
+}
+// ── bare \x1b[m resets (the opencode banner emits this constantly) ─────
+{
+    const t = (0, ansi_1.tokenizeAnsi)("\x1b[0m\n> build · deepseek-v4-flash\n\x1b[0m\n");
+    eq(t, [
+        { text: "\n> build · deepseek-v4-flash\n\n" },
+    ], "bare [0m sequences are dropped, text survives");
+}
+// ── $ prompt lines in a real opencode run ───────────────────────────────
+{
+    const raw = "\x1b[0m\n> build · deepseek-v4-flash\n\x1b[0m\n\x1b[0m$ \x1b[0mls -la\n";
+    const t = (0, ansi_1.tokenizeAnsi)(raw);
+    eq((0, ansi_1.ansiToPlain)(raw), "\n> build · deepseek-v4-flash\n\n$ ls -la\n", "plain extraction matches the visible console text");
+    const lines = (0, ansi_1.tokenStreamToLines)(t);
+    ok(lines.length >= 4, "token stream splits into lines at newlines");
+    const last = lines[lines.length - 1];
+    ok(last.tokens.some((tk) => tk.text.includes("$ ls -la")), "last line carries the $ prompt text");
+}
+// ── OSC-8 hyperlink extraction ──────────────────────────────────────────
+{
+    const t = (0, ansi_1.tokenizeAnsi)("\x1b]8;;https://example.com\x07link text\x1b]8;;\x07 rest");
+    eq(t[0]?.href, "https://example.com", "OSC-8 link URL carried on the token");
+    eq(t[0]?.text, "link text", "OSC-8 link inner text kept");
+    eq(t[1]?.text, " rest", "text after link kept unstyled");
+}
+// ── OSC-8 scheme allowlist (the audit XSS finding, §6.1) ───────────────
+// A prompt-injected \x1b]8;;javascript:…\x07 link used to reach the renderer
+// verbatim and become an <a href> in the dashboard origin. The tokenizer now
+// drops every scheme except http(s):// and mailto:// — the link becomes plain
+// text, never a clickable/executable URL.
+{
+    const evil = "\x1b]8;;javascript:alert(1)\x07click\x1b]8;;\x07";
+    const t = (0, ansi_1.tokenizeAnsi)(evil);
+    eq(t[0]?.href, undefined, "javascript: OSC-8 link is not carried as href");
+    eq(t[0]?.text, "click", "the inner text survives as plain text");
+    const data = (0, ansi_1.tokenizeAnsi)("\x1b]8;;data:text/html,<script>1</script>\x07x\x1b]8;;\x07");
+    eq(data[0]?.href, undefined, "data: OSC-8 link is dropped");
+    const proto = (0, ansi_1.tokenizeAnsi)("\x1b]8;;//evil.example/path\x07x\x1b]8;;\x07");
+    eq(proto[0]?.href, undefined, "protocol-relative OSC-8 link is dropped");
+    const bare = (0, ansi_1.tokenizeAnsi)("\x1b]8;;alert(1)\x07x\x1b]8;;\x07");
+    eq(bare[0]?.href, undefined, "scheme-less OSC-8 string is dropped");
+    const mail = (0, ansi_1.tokenizeAnsi)("\x1b]8;;mailto:a@b.co\x07mail\x1b]8;;\x07");
+    eq(mail[0]?.href, "mailto:a@b.co", "mailto: OSC-8 link is allowed");
+}
+// ── cursor/erase sequences become line breaks (TUI repaint) ─────────────
+{
+    const t = (0, ansi_1.tokenizeAnsi)("line1\x1b[2Kline2");
+    const plain = t.map((x) => x.text).join("");
+    ok(plain.includes("\n"), "erase-line (K) leaves a line boundary for a repaint");
+}
+// ── unknown SGR codes are ignored, text survives ────────────────────────
+{
+    const t = (0, ansi_1.tokenizeAnsi)("\x1b[999mweird\x1b[0m ok");
+    eq(t, [
+        { text: "weird ok" },
+    ], "unknown SGR code ignored, adjacent runs merge (no visible style change)");
+}
+if (failures > 0) {
+    console.error(`\n${failures} FAILURE(s)`);
+    process.exit(1);
+}
+// ── structural console-line classification ──────────────────────────────
+{
+    eq((0, ansi_1.classifyAnsiLine)("> build · deepseek-v4-flash"), "banner", "opencode build banner");
+    eq((0, ansi_1.classifyAnsiLine)("> plan · gpt-5.4"), "banner", "opencode plan banner");
+    eq((0, ansi_1.classifyAnsiLine)("$ ls -la"), "prompt", "$ prompt");
+    eq((0, ansi_1.classifyAnsiLine)("$"), "plain", "lone $ is plain (no command)");
+    eq((0, ansi_1.classifyAnsiLine)("diff --git a/x.ts b/x.ts"), "diff-header", "git diff header");
+    eq((0, ansi_1.classifyAnsiLine)("+++ b/src/x.ts"), "diff-file", "+++ file line");
+    eq((0, ansi_1.classifyAnsiLine)("--- a/src/x.ts"), "diff-file", "--- file line");
+    eq((0, ansi_1.classifyAnsiLine)("@@ -1,2 +1,3 @@"), "diff-hunk", "hunk header");
+    eq((0, ansi_1.classifyAnsiLine)("+const x = 1;"), "diff-add", "patch add");
+    eq((0, ansi_1.classifyAnsiLine)("-const y = 2;"), "diff-del", "patch del");
+    eq((0, ansi_1.classifyAnsiLine)("  + indented keeps leading"), "plain", "indented + is not a patch add");
+    eq((0, ansi_1.classifyAnsiLine)("⎿  run npx tsc"), "tool-call", "opencode tool tail");
+    eq((0, ansi_1.classifyAnsiLine)("✓ 3 files changed"), "tool-call", "checkmark status");
+    eq((0, ansi_1.classifyAnsiLine)("normal output line"), "plain", "ordinary line");
+}
+{
+    const styled = (0, ansi_1.styleAnsiLines)("\x1b[0m\n> build · deepseek-v4-flash\n\x1b[0m\n$ \x1b[0mls\n");
+    ok(styled.length >= 4, "styleAnsiLines splits into lines");
+    const hints = styled.map((l) => l.hint);
+    ok(hints.includes("banner"), "banner line classified through the one-stop helper");
+    ok(hints.includes("prompt"), "$ prompt classified through the one-stop helper");
+}
+// ── summarizeRawConsole (shared noisy-console reducer) ──────────────────
+{
+    const raw = [
+        "> build · deepseek-v4-flash", // banner — kept
+        "$ npm run build", // prompt echo — dropped
+        "workdir: /repo", // runner config banner — dropped
+        "compiled 42 files", // real output — kept
+        "compiled 42 files", // repeat
+        "compiled 42 files", // 3rd repeat — collapsed
+        "compiled 42 files", // 4th — dropped
+        "diff --git a/x.ts b/x.ts", // diff hunk — dropped
+        "──────────", // TUI redraw edge — dropped
+        "✓ done", // status — kept
+    ].join("\n");
+    const out = (0, ansi_1.summarizeRawConsole)(raw, false);
+    ok(out.includes("> build · deepseek-v4-flash"), "banner survives");
+    ok(!out.includes("$ npm run build"), "$ echo dropped");
+    ok(!out.includes("workdir:"), "config banner dropped");
+    ok(out.includes("compiled 42 files"), "real output kept");
+    ok(!out.includes("diff --git"), "diff hunk dropped");
+    ok(!out.includes("──────────"), "TUI redraw edge dropped");
+    ok(out.includes("✓ done"), "status kept");
+    ok(out.includes("noisy lines collapsed"), "collapse count reported");
+    // Running budget is tighter than finished.
+    const big = Array.from({ length: 200 }, (_, i) => `line ${i}`).join("\n");
+    const running = (0, ansi_1.summarizeRawConsole)(big, true).split("\n").length;
+    const finished = (0, ansi_1.summarizeRawConsole)(big, false).split("\n").length;
+    ok(running < finished, "running budget tighter than finished budget");
+    // KEEP THE TAIL (2026-08-13): the summarizer evicts the OLDEST kept line
+    // when the budget is full, so a live console follows the newest output —
+    // never drops it. The old head-keeping bug froze the web task console at
+    // the START of a long run while the header claimed it was live.
+    const tail = (0, ansi_1.summarizeRawConsole)(big, true).split("\n");
+    ok(tail.some((l) => l.startsWith("line 199")), "newest output survives the budget (tail kept)");
+    ok(!tail.some((l) => l.startsWith("line 0")), "oldest output evicted to make room");
+    // The tail must still be recognizably the END of the stream, and the
+    // collapse marker must not masquerade as a kept line.
+    const noMarker = tail.filter((l) => !l.startsWith("… "));
+    ok(noMarker[0].startsWith("line 160"), "first kept line is the oldest evicted window start (budget 40 of 200)");
+    // ANSI on kept lines survives (so AnsiConsoleText can still paint them).
+    const ansiLine = "\x1b[31mred text\x1b[0m";
+    ok((0, ansi_1.summarizeRawConsole)(ansiLine, false).includes("\x1b[31m"), "kept lines keep their escapes");
+}
+console.log("\nall ansi tests pass");

package/dist/_core/buildFeedbackPrompt.d.ts

@@ -1,13 +1,8 @@
-export interface BuildFeedbackPromptInput {
+export interface FeedbackPromptInput {
     userPrompt: string;
-    /** Hot-Reload project name when running inside Yaver mobile, OR
-     *  the host app's bundle/package name when running standalone. */
     projectName?: string;
-    /** Absolute path on the host where the project lives (only known
-     *  when running inside Yaver mobile via Hot Reload). */
     projectPath?: string;
-    /** True when the caller has attached a screenshot of the current
-     *  screen as the first image in the task's images array. */
-    hasScreenshot: boolean;
+    hasScreenshot?: boolean;
 }
-export declare function buildFeedbackPrompt(input: BuildFeedbackPromptInput): string;
+/** Shared, deterministic feedback-task prompt used by every client surface. */
+export declare function buildFeedbackPrompt(input: FeedbackPromptInput): string;

package/dist/_core/buildFeedbackPrompt.js

@@ -1,77 +1,23 @@
 "use strict";
-// buildFeedbackPrompt — shared prompt enrichment used by every Yaver
-// feedback surface, in-Yaver native pane (mirrored in Swift + Kotlin)
-// AND the standalone RN feedback SDK (this file). Keep all three
-// implementations in lockstep — the wording is what the AI on the
-// remote is conditioned to expect.
-//
-// The bare user text on its own loses crucial context: WHICH app the
-// user is testing, WHICH screen they're looking at, and whether a
-// screenshot is attached for visual reference. Without that the agent
-// guesses, edits the wrong project, or asks clarifying questions
-// instead of acting. The wrapper below tells the agent:
-//   - this feedback comes from the in-app drawer while the user is
-//     mid-test,
-//   - which project the user is in (when known),
-//   - that the FIRST attached image (when present) is a snapshot of
-//     the current screen — open it to see what the user is pointing
-//     at,
-//   - that changes should be applied to that project's source +
-//     saved so the user can trigger a Hermes reload to see them.
-//
-// Cross-reference: mobile/ios/Yaver/YaverFeedbackPane.swift's
-// `buildFeedbackPrompt` and mobile/android/.../YaverFeedbackPane.kt's
-// `buildFeedbackPrompt`. All three must match.
+// AUTO-SYNCED from shared/client-core/src/buildFeedbackPrompt.ts.
+// DO NOT EDIT IN PLACE. Edit the source and re-run
+// scripts/sync-client-core.sh. CI checks drift via `--check`.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildFeedbackPrompt = buildFeedbackPrompt;
+/** Shared, deterministic feedback-task prompt used by every client surface. */
 function buildFeedbackPrompt(input) {
-    const userPrompt = input.userPrompt ?? "";
-    const projectName = (input.projectName ?? "").trim();
-    const projectPath = (input.projectPath ?? "").trim();
-    const hasScreenshot = !!input.hasScreenshot;
-    const lines = [];
-    lines.push("[Mobile feedback from inside Yaver]");
-    lines.push("The user is providing this feedback while running a mobile app inside the Yaver mobile container " +
-        "and is currently looking at a specific screen of that app.");
-    lines.push("");
-    if (projectName || projectPath) {
-        lines.push("App being tested:");
-        if (projectName)
-            lines.push(`  name: ${projectName}`);
-        if (projectPath)
-            lines.push(`  path: ${projectPath}`);
-        lines.push("");
-    }
-    if (hasScreenshot) {
-        lines.push("A screenshot of the current screen is attached as the first image. " +
-            "Open it before deciding what to change — the user is pointing at what they SEE, " +
-            "not necessarily what is named most prominently in the source.");
-        lines.push("");
-    }
-    else {
-        lines.push("(The user chose not to attach a screenshot for this round.)");
-        lines.push("");
-    }
-    lines.push("Operation contract:");
-    lines.push("1. Locate the file(s) responsible for what the user described and EDIT them in place. " +
-        "Save the changes — that is the deliverable.");
-    lines.push("2. Stream a CONCISE Claude-Code / Codex-style narration as you work: " +
-        "one short line per step (e.g. \"Reading app/index.tsx\", " +
-        "\"Editing safe.backgroundColor\", \"Saved app/index.tsx\"). Show small diffs only — " +
-        "never dump entire files, never paste node_modules contents, never echo build / install logs.");
-    lines.push("3. Do NOT run npm install / yarn / pnpm / git clone / cargo build / docker pull or any other " +
-        "long-running install / fetch command. The repo is already prepared on this machine. " +
-        "If a dependency is genuinely missing, say so in one line and stop — the user will install it.");
-    lines.push("4. Do NOT trigger a Hermes reload yourself. The user has a Reload button in the drawer " +
-        "and decides when to refresh.");
-    lines.push("5. Keep total output under a few hundred lines. Heavy ripgrep / find / cat with no filter " +
-        "are usually the wrong tool — use targeted reads.");
-    if (!projectName && !projectPath) {
-        lines.push("6. If you can identify the project from the prompt or the screenshot, work there. " +
-            "Otherwise ask the user briefly which project to target — one short line, no exhaustive list.");
-    }
-    lines.push("");
-    lines.push("User feedback:");
-    lines.push(userPrompt);
-    return lines.join("\n");
+    const request = String(input.userPrompt || '').trim();
+    const context = [];
+    if (input.projectName?.trim())
+        context.push(`Project: ${input.projectName.trim()}`);
+    if (input.projectPath?.trim())
+        context.push(`Working directory: ${input.projectPath.trim()}`);
+    if (input.hasScreenshot)
+        context.push('A screenshot is attached; use it as visual evidence.');
+    return [
+        'Investigate and implement this feedback request in the named project.',
+        ...context,
+        '',
+        request || 'Inspect the attached evidence and fix the visible issue.',
+    ].join('\n');
 }

package/dist/_core/constants.d.ts

@@ -27,13 +27,26 @@ export declare const DEFAULT_BEACON_UDP_PORT = 19837;
 /**
  * How old an agent's last heartbeat can be before the device is
  * considered offline. Mirrors `backend/convex/devices.ts` so
- * Convex + every client agree on the same threshold. The agent
- * heartbeats every 5 min (see `desktop/agent/main.go::heartbeatLoop`),
- * so 6 min tolerates one missed beat + 60 s of jitter without
- * flapping. Sub-minute death detection comes from the P2P bus, not
- * this threshold.
+ * Convex + every client agree on the same threshold.
+ *
+ * 900_000, not 90_000. This file said 90_000 while the authority named in the
+ * comment — `backend/convex/devices.ts:112`, `const HEARTBEAT_STALE_MS = 900 *
+ * 1000` — and `mobile/src/_core/constants.ts` both said 900_000. A 10x drift in
+ * the constant whose own docstring promises it does not drift is exactly the
+ * "green on one, yellow on the other" glitch described above (2026-07-20).
+ *
+ * Sub-minute death detection is not this threshold's job — it comes from the
+ * P2P bus and from an actual reachability probe. Shortening this here would
+ * only make a live box flap offline between 5-minute heartbeats.
+ */
+export declare const HEARTBEAT_STALE_MS = 900000;
+/**
+ * How long after the last relay-presence ping a device still counts as
+ * having a "live bus signal". Same product number as the web dashboard's
+ * hasRecentLiveSignal default (`web/lib/device-lifecycle.ts`, maxAgeMs =
+ * 360_000) so the phone and the browser agree on what "live" means.
  */
-export declare const HEARTBEAT_STALE_MS = 360000;
+export declare const BUS_PRESENCE_STALE_MS = 360000;
 /**
  * How long after the last UDP beacon an agent is still considered
  * "locally present". Re-broadcast interval is 3 s, so 10 s covers

package/dist/_core/constants.js

@@ -3,7 +3,7 @@
 // DO NOT EDIT IN PLACE. Edit the source and re-run
 // scripts/sync-client-core.sh. CI checks drift via `--check`.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAUTH_REDIRECT = exports.RELAY_PROBE_TIMEOUT_MS = exports.PROBE_TIMEOUT_MS = exports.BEACON_STALE_MS = exports.HEARTBEAT_STALE_MS = exports.DEFAULT_BEACON_UDP_PORT = exports.DEFAULT_AGENT_HTTP_PORT = exports.WEB_BASE_URL = exports.CONVEX_SITE_URL = void 0;
+exports.OAUTH_REDIRECT = exports.RELAY_PROBE_TIMEOUT_MS = exports.PROBE_TIMEOUT_MS = exports.BEACON_STALE_MS = exports.BUS_PRESENCE_STALE_MS = exports.HEARTBEAT_STALE_MS = exports.DEFAULT_BEACON_UDP_PORT = exports.DEFAULT_AGENT_HTTP_PORT = exports.WEB_BASE_URL = exports.CONVEX_SITE_URL = void 0;
 /**
  * Canonical client-side constants shared between:
  *   - Yaver mobile (`mobile/`)
@@ -51,13 +51,26 @@ exports.DEFAULT_BEACON_UDP_PORT = 19837;
 /**
  * How old an agent's last heartbeat can be before the device is
  * considered offline. Mirrors `backend/convex/devices.ts` so
- * Convex + every client agree on the same threshold. The agent
- * heartbeats every 5 min (see `desktop/agent/main.go::heartbeatLoop`),
- * so 6 min tolerates one missed beat + 60 s of jitter without
- * flapping. Sub-minute death detection comes from the P2P bus, not
- * this threshold.
+ * Convex + every client agree on the same threshold.
+ *
+ * 900_000, not 90_000. This file said 90_000 while the authority named in the
+ * comment — `backend/convex/devices.ts:112`, `const HEARTBEAT_STALE_MS = 900 *
+ * 1000` — and `mobile/src/_core/constants.ts` both said 900_000. A 10x drift in
+ * the constant whose own docstring promises it does not drift is exactly the
+ * "green on one, yellow on the other" glitch described above (2026-07-20).
+ *
+ * Sub-minute death detection is not this threshold's job — it comes from the
+ * P2P bus and from an actual reachability probe. Shortening this here would
+ * only make a live box flap offline between 5-minute heartbeats.
+ */
+exports.HEARTBEAT_STALE_MS = 900000;
+/**
+ * How long after the last relay-presence ping a device still counts as
+ * having a "live bus signal". Same product number as the web dashboard's
+ * hasRecentLiveSignal default (`web/lib/device-lifecycle.ts`, maxAgeMs =
+ * 360_000) so the phone and the browser agree on what "live" means.
  */
-exports.HEARTBEAT_STALE_MS = 360000;
+exports.BUS_PRESENCE_STALE_MS = 360000;
 /**
  * How long after the last UDP beacon an agent is still considered
  * "locally present". Re-broadcast interval is 3 s, so 10 s covers

package/dist/_core/device.d.ts

@@ -10,10 +10,6 @@ export interface CoreDevice {
     runnerDown: boolean;
     /** Unix ms of the latest heartbeat the agent sent to Convex. */
     lastHeartbeat: number;
-    isGuest: boolean;
-    hostName?: string;
-    hostEmail?: string;
-    accessScope?: 'owner' | 'shared-scoped' | 'shared-legacy';
     /** Primary LAN IP (or tunnel host) the agent advertised. */
     quicHost: string;
     quicPort: number;
@@ -39,28 +35,18 @@ export declare function mergeDeviceEntries(a: CoreDevice, b: CoreDevice): CoreDe
  */
 export declare function collapseDevices(devices: CoreDevice[]): CoreDevice[];
 /**
- * "Fresh" matches the mobile app: online + heartbeat within
- * HEARTBEAT_STALE_MS. Clients read Convex's `isOnline` first (the backend
- * applies the same gate from the server clock), then use this helper when
- * they need the phone-side freshness opinion too — e.g. for auto-connect
- * picks.
+ * "Fresh" matches the mobile app: online + heartbeat < 90 s. Clients
+ * read Convex's `isOnline` first (backend already applies its own 90 s
+ * gate from the server clock), then use this helper when they need the
+ * phone-side freshness opinion too — e.g. for auto-connect picks.
  */
 export declare function isDeviceFresh(d: CoreDevice, now?: number): boolean;
 /**
- * Choose the best candidate for an auto-connect attempt.
- *
- * An explicit `preferredDeviceId` is honoured by id ALONE, or not at all:
- *   - A missing `quicHost` is not grounds to reroute. Relay transport
- *     addresses a device by id (`<relay>/d/<deviceId>`), so the entry is
- *     still reachable off-LAN — which is precisely when quicHost is absent.
- *   - If the id is not in the list, return null. Falling through to another
- *     machine silently lands the user's fix on the wrong host: they pick the
- *     Mac mini, the commit shows up on the laptop, and nothing reports an
- *     error. Not connecting is the better failure — the caller surfaces
- *     "selected machine missing, re-select it".
- *
- * With no preference, fall back: fresh + quicHost → online + quicHost →
- * first with a quicHost.
+ * Choose the best candidate for an auto-connect attempt. Preference:
+ *   1. explicit `preferredDeviceId`, by identity alone; missing means fail
+ *   2. fresh (online + recent heartbeat) + has a quicHost
+ *   3. online + has a quicHost
+ *   4. first with a quicHost
  */
 export declare function pickTargetDevice(devices: CoreDevice[], preferredDeviceId?: string): CoreDevice | null;
 /**

package/dist/_core/device.js

@@ -50,10 +50,6 @@ function deviceIdentityKey(d) {
         return `hwid:${d.hwid}`;
     if (d.publicKey)
         return `pub:${d.publicKey}`;
-    if (d.isGuest) {
-        const scope = d.hostEmail || d.hostName || 'guest';
-        return `guest:${scope}:${d.deviceId || d.name}`;
-    }
     const n = normName(d.name);
     const os = String(d.platform || '').trim().toLowerCase();
     if (n && os)
@@ -63,8 +59,6 @@ function deviceIdentityKey(d) {
     return `name:${d.name}`;
 }
 function deviceAliasKey(d) {
-    if (d.isGuest)
-        return null;
     const n = normName(d.name);
     const os = String(d.platform || '').trim().toLowerCase();
     if (!n || !os)
@@ -72,8 +66,6 @@ function deviceAliasKey(d) {
     return `${os}:${n}`;
 }
 function deviceEndpointKey(d) {
-    if (d.isGuest)
-        return null;
     const h = normHost(d.quicHost);
     if (!h)
         return null;
@@ -182,11 +174,10 @@ function collapseDevices(devices) {
 }
 // ── Freshness + target pick ───────────────────────────────────────────
 /**
- * "Fresh" matches the mobile app: online + heartbeat within
- * HEARTBEAT_STALE_MS. Clients read Convex's `isOnline` first (the backend
- * applies the same gate from the server clock), then use this helper when
- * they need the phone-side freshness opinion too — e.g. for auto-connect
- * picks.
+ * "Fresh" matches the mobile app: online + heartbeat < 90 s. Clients
+ * read Convex's `isOnline` first (backend already applies its own 90 s
+ * gate from the server clock), then use this helper when they need the
+ * phone-side freshness opinion too — e.g. for auto-connect picks.
  */
 function isDeviceFresh(d, now = Date.now()) {
     if (!d.isOnline)
@@ -196,26 +187,20 @@ function isDeviceFresh(d, now = Date.now()) {
     return now - d.lastHeartbeat < constants_1.HEARTBEAT_STALE_MS;
 }
 /**
- * Choose the best candidate for an auto-connect attempt.
- *
- * An explicit `preferredDeviceId` is honoured by id ALONE, or not at all:
- *   - A missing `quicHost` is not grounds to reroute. Relay transport
- *     addresses a device by id (`<relay>/d/<deviceId>`), so the entry is
- *     still reachable off-LAN — which is precisely when quicHost is absent.
- *   - If the id is not in the list, return null. Falling through to another
- *     machine silently lands the user's fix on the wrong host: they pick the
- *     Mac mini, the commit shows up on the laptop, and nothing reports an
- *     error. Not connecting is the better failure — the caller surfaces
- *     "selected machine missing, re-select it".
- *
- * With no preference, fall back: fresh + quicHost → online + quicHost →
- * first with a quicHost.
+ * Choose the best candidate for an auto-connect attempt. Preference:
+ *   1. explicit `preferredDeviceId`, by identity alone; missing means fail
+ *   2. fresh (online + recent heartbeat) + has a quicHost
+ *   3. online + has a quicHost
+ *   4. first with a quicHost
  */
 function pickTargetDevice(devices, preferredDeviceId) {
     if (!devices.length)
         return null;
     if (preferredDeviceId) {
-        return devices.find((d) => d.deviceId === preferredDeviceId) ?? null;
+        // An off-LAN device normally has no quicHost; the relay addresses it by
+        // id. Never fall through to a different healthy machine after the user
+        // selected one explicitly — failure is safer than misrouting their work.
+        return devices.find((d) => d.deviceId === preferredDeviceId) || null;
     }
     const fresh = devices.find((d) => isDeviceFresh(d) && d.quicHost);
     if (fresh)

package/dist/_core/endpoints.d.ts

@@ -51,13 +51,6 @@ export declare const CONVEX_ENDPOINTS: {
     readonly authLogin: "/auth/login";
     readonly userSettings: "/settings";
     readonly platformConfig: "/config";
-    readonly guestsList: "/guests/list";
-    readonly guestsHosts: "/guests/hosts";
-    readonly guestsAllowed: "/guests/allowed";
-    readonly guestsInvite: "/guests/invite";
-    readonly guestsAccept: "/guests/accept";
-    readonly guestsAcceptCode: "/guests/accept-code";
-    readonly guestsRevoke: "/guests/revoke";
 };
 /** Routes on a relay server. */
 export declare const RELAY_ENDPOINTS: {

package/dist/_core/endpoints.js

@@ -57,13 +57,6 @@ exports.CONVEX_ENDPOINTS = {
     authLogin: '/auth/login',
     userSettings: '/settings',
     platformConfig: '/config',
-    guestsList: '/guests/list',
-    guestsHosts: '/guests/hosts',
-    guestsAllowed: '/guests/allowed',
-    guestsInvite: '/guests/invite',
-    guestsAccept: '/guests/accept',
-    guestsAcceptCode: '/guests/accept-code',
-    guestsRevoke: '/guests/revoke',
 };
 /** Routes on a relay server. */
 exports.RELAY_ENDPOINTS = {

package/dist/_core/index.d.ts

@@ -13,3 +13,7 @@
 export * from './constants';
 export * from './endpoints';
 export * from './device';
+export * from './ansi';
+export * from './trace';
+export * from './remoteless';
+export * from './buildFeedbackPrompt';

package/dist/_core/index.js

@@ -32,3 +32,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./constants"), exports);
 __exportStar(require("./endpoints"), exports);
 __exportStar(require("./device"), exports);
+__exportStar(require("./ansi"), exports);
+__exportStar(require("./trace"), exports);
+__exportStar(require("./remoteless"), exports);
+__exportStar(require("./buildFeedbackPrompt"), exports);

package/dist/_core/remoteless.d.ts

@@ -0,0 +1,44 @@
+export type RemotelessCapability = "analysis-chat" | "code-edit" | "git-read" | "git-commit" | "git-push" | "static-preflight" | "existing-web-artifact" | "dev-server" | "web-build" | "flutter-render" | "native-build" | "simulator" | "shell" | "test" | "deploy" | "container";
+export type RemotelessSupport = "supported" | "bounded" | "unavailable";
+export type RemotelessCapabilityResult = {
+    capability: RemotelessCapability;
+    support: RemotelessSupport;
+    code: string;
+    summary: string;
+    detail: string;
+    route: {
+        label: string;
+        path: "/devices" | "/cloud-onboarding";
+    };
+    alternateRoute?: {
+        label: string;
+        path: "/devices" | "/cloud-onboarding";
+    };
+};
+export type ExecutionCandidate = {
+    id: string;
+    name: string;
+    role: "explicit" | "primary" | "secondary" | "focused";
+    connected: boolean;
+};
+export type RemotelessPlacement = {
+    lane: "remote";
+    target: ExecutionCandidate;
+    degraded: boolean;
+    banner: string | null;
+} | {
+    lane: "remoteless";
+    capability: RemotelessCapabilityResult;
+    banner: string;
+} | {
+    lane: "blocked";
+    capability: RemotelessCapabilityResult;
+    banner: string;
+};
+export declare function remotelessCapability(capability: RemotelessCapability, surface: "ios" | "android" | "web" | "companion"): RemotelessCapabilityResult;
+export declare function resolveRemotelessPlacement(input: {
+    capability: RemotelessCapability;
+    surface: "ios" | "android" | "web" | "companion";
+    candidates: ExecutionCandidate[];
+    forceLocal?: boolean;
+}): RemotelessPlacement;