zeno-mobile-runner 0.2.16 → 0.2.17

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (75) hide show
  1. package/CHANGELOG.md +33 -0
  2. package/CONTRIBUTING.md +20 -7
  3. package/FEATURES.md +29 -20
  4. package/README.md +73 -57
  5. package/SECURITY.md +11 -6
  6. package/clients/README.md +8 -7
  7. package/clients/go/README.md +2 -2
  8. package/clients/kotlin/README.md +2 -2
  9. package/clients/kotlin/build.gradle.kts +1 -1
  10. package/clients/python/README.md +2 -1
  11. package/clients/python/pyproject.toml +1 -1
  12. package/clients/rust/Cargo.lock +1 -1
  13. package/clients/rust/Cargo.toml +1 -1
  14. package/clients/rust/README.md +2 -2
  15. package/clients/swift/README.md +2 -2
  16. package/clients/typescript/README.md +2 -1
  17. package/clients/typescript/package.json +1 -1
  18. package/docs/adr/0001-agent-native-runner-boundary.md +1 -1
  19. package/docs/adr/README.md +7 -5
  20. package/docs/agent-discovery.md +15 -15
  21. package/docs/ai-agents.md +30 -20
  22. package/docs/app-integration.md +59 -27
  23. package/docs/benchmarking.md +16 -8
  24. package/docs/benchmarks/README.md +3 -1
  25. package/docs/benchmarks/benchmark-lab-v1.md +1 -1
  26. package/docs/client-installation.md +18 -9
  27. package/docs/clients.md +7 -6
  28. package/docs/config.md +29 -15
  29. package/docs/demo.md +14 -9
  30. package/docs/expo-smoke.md +12 -18
  31. package/docs/frameworks.md +30 -21
  32. package/docs/install.md +63 -13
  33. package/docs/npm.md +45 -27
  34. package/docs/production-readiness.md +32 -17
  35. package/docs/protocol-fixtures/core-session.responses.jsonl +1 -1
  36. package/docs/protocol-versioning.md +5 -3
  37. package/docs/protocol.md +33 -18
  38. package/docs/scenario-authoring.md +15 -8
  39. package/docs/support-matrix.md +38 -0
  40. package/docs/trace-privacy.md +5 -3
  41. package/docs/troubleshooting.md +17 -14
  42. package/npm/app-config.mjs +2 -0
  43. package/npm/commands.mjs +4 -4
  44. package/npm/scaffold.mjs +2 -2
  45. package/package.json +2 -2
  46. package/prebuilds/darwin-arm64/zmr +0 -0
  47. package/prebuilds/darwin-x64/zmr +0 -0
  48. package/prebuilds/linux-arm64/zmr +0 -0
  49. package/prebuilds/linux-x64/zmr +0 -0
  50. package/schemas/README.md +6 -3
  51. package/schemas/import-output.schema.json +1 -1
  52. package/schemas/scenario.schema.json +2 -0
  53. package/schemas/zmr-config.schema.json +2 -1
  54. package/scripts/public-metadata-guard.sh +101 -0
  55. package/shims/android/README.md +4 -3
  56. package/shims/android/protocol.md +3 -2
  57. package/shims/ios/README.md +5 -5
  58. package/shims/ios/protocol.md +2 -1
  59. package/skills/zmr-mobile-testing/SKILL.md +9 -8
  60. package/src/android_emulator.zig +54 -5
  61. package/src/cli_import.zig +15 -2
  62. package/src/cli_output.zig +2 -0
  63. package/src/cli_run.zig +8 -0
  64. package/src/config.zig +3 -0
  65. package/src/errors.zig +3 -0
  66. package/src/ios_devices.zig +100 -0
  67. package/src/main.zig +1 -1
  68. package/src/mcp_protocol.zig +12 -9
  69. package/src/run_options.zig +4 -0
  70. package/src/scaffold.zig +10 -8
  71. package/src/scenario.zig +43 -0
  72. package/src/selector.zig +53 -9
  73. package/src/trace_json.zig +4 -0
  74. package/src/validation.zig +5 -0
  75. package/src/version.zig +1 -1
package/CHANGELOG.md CHANGED
@@ -4,6 +4,39 @@ All notable changes to Zeno Mobile Runner are tracked here.
4
4
 
5
5
  ## Unreleased
6
6
 
7
+ ## 0.2.17 (2026-06-29)
8
+
9
+ ### Added
10
+
11
+ - Added a curl-first `install.sh` for framework-neutral native binary installs,
12
+ including OS/arch release archive selection, mandatory `SHA256SUMS`
13
+ verification, dry-run output, and installer coverage in CI/release gates.
14
+ - Added a public metadata guard that fails CI/release gates when public docs,
15
+ current branch metadata, remote branch metadata, or tag metadata reintroduce
16
+ unwanted contributor identity strings.
17
+ - Added a support matrix covering Android, iPhone, iPad, tvOS, watchOS, cloud
18
+ device farms, and the evidence required before making stronger product
19
+ claims.
20
+
21
+ ### Changed
22
+
23
+ - Reworked onboarding, agent workflow, app integration, support, readiness,
24
+ troubleshooting, benchmarking, client, shim, schema, and contribution docs
25
+ around DX-friendly setup paths, evidence-first product claims, and
26
+ agent-first mobile verification.
27
+ - Repositioned public onboarding around `curl | sh` plus `zmr init --app`,
28
+ with npm documented as the JavaScript-team convenience path instead of the
29
+ default install story.
30
+ - MCP tool schemas now expose strict selector shapes, including `stableId`, so
31
+ agents can discover supported selector fields directly from tool metadata.
32
+
33
+ ### Fixed
34
+
35
+ - Scenario parsing and validation now reject unknown root, step, and selector
36
+ fields instead of silently accepting typos.
37
+ - Selectors now reject empty selector objects and support `stableId` matching as
38
+ a live-session fallback from semantic snapshots.
39
+
7
40
  ## 0.2.16 (2026-06-25)
8
41
 
9
42
  ### Fixed
package/CONTRIBUTING.md CHANGED
@@ -1,12 +1,13 @@
1
1
  # Contributing
2
2
 
3
- ZMR is a Zig-based mobile test runner for external agents and local test files.
4
- Keep changes small, typed, traceable, and covered by tests.
3
+ ZMR is a Zig-based mobile runner for AI agents, app teams, and deterministic
4
+ CI scenarios. Contributions should keep the public surface small, typed,
5
+ traceable, and backed by tests or evidence.
5
6
 
6
7
  ## Local Checks
7
8
 
8
- Run the focused checks for your change first, then run the release gate before a
9
- PR:
9
+ Run focused checks for the files you touched first. Before a PR or release
10
+ candidate, run the broader gate:
10
11
 
11
12
  ```bash
12
13
  zig fmt --check build.zig src
@@ -35,8 +36,20 @@ npm pack --dry-run
35
36
 
36
37
  ## Design Expectations
37
38
 
38
- - Keep the public interface in scenario files, JSON-RPC, and documented CLI
39
- flags.
39
+ - Keep public behavior in scenario JSON, JSON-RPC, MCP schemas, and documented
40
+ CLI flags.
40
41
  - Keep platform shims behind adapter boundaries.
41
- - Preserve ADB/simctl fallback behavior until native shims are proven stable.
42
+ - Preserve ADB, UI Automator, `simctl`, and `devicectl` fallback behavior until
43
+ native shims have evidence on the target class.
42
44
  - Prefer deterministic trace evidence over terminal-only diagnostics.
45
+ - Keep product claims tied to [docs/support-matrix.md](docs/support-matrix.md)
46
+ and [docs/production-readiness.md](docs/production-readiness.md).
47
+
48
+ ## Documentation Expectations
49
+
50
+ - Lead onboarding docs with the user outcome, then give copy-paste commands.
51
+ - Keep protocol, schema, ADR, and benchmark docs precise rather than promotional.
52
+ - Use app-owned selectors in examples before `stableId` or coordinate fallback.
53
+ - Mark unsupported or evidence-needed platforms explicitly.
54
+ - Run `bash tests/docs-readiness-test.sh` and
55
+ `bash tests/public-safety-test.sh` before publishing docs.
package/FEATURES.md CHANGED
@@ -1,9 +1,10 @@
1
- # Features
1
+ # Feature Overview
2
2
 
3
- Zeno Mobile Runner is a local, agent-native mobile test runner for Android,
4
- iOS simulators, and physical iOS devices. It is designed for external agents and normal test files: ZMR
5
- controls devices, exposes typed observations, executes actions, waits for UI
6
- state, and writes deterministic traces. It does not embed an LLM.
3
+ Zeno Mobile Runner is a local mobile automation runner for AI agents, app
4
+ teams, and CI systems. It controls Android and iOS/iPadOS targets, exposes typed
5
+ observations and actions, validates JSON scenarios, and writes deterministic
6
+ trace evidence. It does not embed an LLM; external agents stay in charge of
7
+ planning.
7
8
 
8
9
  ## Platform Support
9
10
 
@@ -11,21 +12,26 @@ state, and writes deterministic traces. It does not embed an LLM.
11
12
  optional app-local instrumentation shim.
12
13
  - Android emulator lifecycle helpers for boot, wait-ready, reset, snapshot
13
14
  restore, optional AVD creation, and optional screen recording.
14
- - iOS simulators through `xcrun simctl` for lifecycle, install, launch, deep
15
- links, screenshots, logs, clear-state-by-uninstall, and device discovery.
16
- - Physical iOS devices through `xcrun devicectl` for discovery, install,
17
- launch, deep-link launch, clear-state-by-uninstall, and best-effort stop.
18
- - iOS selector actions through an app-local XCTest/XCUIAutomation shim on
19
- simulators and physical devices.
15
+ - iOS and iPadOS simulators through `xcrun simctl` for lifecycle, install,
16
+ launch, deep links, screenshots, logs, clear-state-by-uninstall, and device
17
+ discovery.
18
+ - Physical iPhone and iPad devices through `xcrun devicectl` for discovery,
19
+ install, launch, deep-link launch, clear-state-by-uninstall, and best-effort
20
+ stop.
21
+ - iOS/iPadOS selector actions through an app-local XCTest/XCUIAutomation shim
22
+ on simulators and physical devices.
23
+ - Explicit claim boundaries for iPad, tvOS, watchOS, physical devices, and
24
+ cloud device farms in [docs/support-matrix.md](docs/support-matrix.md).
20
25
 
21
26
  ## App Integration
22
27
 
23
- - npm-first installation with `zeno-mobile-runner` as a dev dependency.
24
- - `npx zmr-wizard` scaffolds `.zmr/config.json`, Android and iOS smoke
25
- scenarios, optional app package scripts, HTML/JUnit report scripts, and
26
- `traces/` gitignore rules.
27
- - `zmr init --app` provides the same app-local bootstrap for source and archive
28
- installs.
28
+ - Curl-first installation of the native `zmr` binary for React Native, Expo,
29
+ Flutter, native Android, native iOS, and mixed mobile repositories.
30
+ - `zmr init --app` scaffolds `.zmr/config.json`, Android and iOS smoke
31
+ scenarios, HTML/JUnit report scripts, and `traces/` gitignore rules without
32
+ requiring Node in the app repo.
33
+ - npm remains a JavaScript-team convenience: `npx zmr-wizard` scaffolds the
34
+ same app-local state plus optional package scripts and helper bins.
29
35
  - `.zmr/config.json` is schema validated, auto-discovered from app checkouts,
30
36
  and overridden by explicit CLI flags.
31
37
  - Android and iOS shim installers generate app-local commands and source files
@@ -79,8 +85,8 @@ state, and writes deterministic traces. It does not embed an LLM.
79
85
 
80
86
  ## Scenario Execution
81
87
 
82
- - JSON scenarios with launch, stop, clear state, open link, tap, type, erase
83
- text, hide keyboard, swipe, back/home-equivalent navigation, waits,
88
+ - Strict JSON scenarios with launch, stop, clear state, open link, tap, type,
89
+ erase text, hide keyboard, swipe, back/home-equivalent navigation, waits,
84
90
  assertions, snapshots, optional steps, conditionals, repeats, sleeps, and
85
91
  scroll-until-visible.
86
92
  - Selector matching for text, text contains, content description, resource id,
@@ -142,10 +148,13 @@ state, and writes deterministic traces. It does not embed an LLM.
142
148
 
143
149
  ## Current Limitations
144
150
 
145
- - Current release status is `0.2.16`, a public developer preview rather than
151
+ - Current release status is `0.2.17`, a public developer preview rather than
146
152
  a production-stable `1.0.0`.
147
153
  - Physical iOS log capture is still simulator-first. Physical iOS screenshots
148
154
  are available when the XCTest/XCUIAutomation shim is configured.
155
+ - iPad uses the same iOS/iPadOS automation path, but tablet production claims
156
+ require separate evidence because layout and size-class behavior can diverge.
157
+ - tvOS and watchOS are not supported in this preview.
149
158
  - Broad cloud device farm certification is out of scope for this preview.
150
159
  - Public benchmark fixtures are generic. Performance claims for a real app
151
160
  should come from equivalent app-local candidate and baseline runs.
package/README.md CHANGED
@@ -1,19 +1,19 @@
1
1
  # Zeno Mobile Runner
2
2
 
3
- > The verification loop for AI coding agents building Expo, React Native,
4
- > Flutter, and native Android/iOS apps.
3
+ > Mobile UI automation built for AI coding agents, deterministic CI scenarios,
4
+ > and traceable product evidence.
5
5
 
6
6
  [![CI](https://github.com/johnmikel/zeno-mobile-runner/actions/workflows/ci.yml/badge.svg)](https://github.com/johnmikel/zeno-mobile-runner/actions/workflows/ci.yml)
7
7
  [![Release](https://img.shields.io/github/v/release/johnmikel/zeno-mobile-runner?include_prereleases)](https://github.com/johnmikel/zeno-mobile-runner/releases)
8
8
  [![npm](https://img.shields.io/npm/v/zeno-mobile-runner)](https://www.npmjs.com/package/zeno-mobile-runner)
9
9
  [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
10
10
 
11
- Your coding agent can write mobile code, but it cannot see the phone. ZMR is
12
- its eyes and hands: a typed mobile control plane that installs and launches
13
- apps, observes the UI, taps and types, waits for the screen to settle, asserts
14
- state, and exports a replayable trace as proof. The runner does not embed an
15
- LLM. Agents stay outside and drive ZMR through MCP, JSON-RPC, CLI JSON, or
16
- JSON scenarios.
11
+ AI agents can edit mobile apps quickly, but they need a reliable way to see the
12
+ screen, act on native UI, and prove the result. Zeno Mobile Runner (ZMR) is that
13
+ control plane: one local binary that installs and launches apps, captures
14
+ semantic UI state, performs typed actions, waits and asserts, and exports a
15
+ replayable trace. ZMR does not embed an LLM. Agents, scripts, and CI systems
16
+ drive it through MCP, JSON-RPC, CLI JSON, or committed JSON scenarios.
17
17
 
18
18
  ![ZMR trace viewer showing a passed iOS run with timeline, device screenshot, UI tree, and selector payload](docs/assets/viewer-hero.png)
19
19
 
@@ -26,24 +26,24 @@ JSON scenarios.
26
26
  <p align="center"><em>Real on-device screenshots from ZMR traces: the same demo flow
27
27
  driven on an iOS simulator and an Android emulator.</em></p>
28
28
 
29
- ## Why agents need this
29
+ ## Why This Exists
30
30
 
31
- - **Agents can't verify what they can't observe.** ZMR returns semantic UI
32
- trees with stable selectors, screenshots, and typed action results an agent
33
- can reason about not raw pixels it has to guess at.
34
- - **Evidence, not vibes.** Every session can write a deterministic trace:
35
- events, screenshots, UI hierarchies, timings, assertion results, HTML and
36
- JUnit reports, and a redacted shareable bundle.
37
- - **Tests fall out for free.** After a live agent session, `zmr discover`
38
- turns the trace into a reviewable JSON scenario that replays in CI without
39
- an LLM in the loop.
31
+ - **Agents need structured mobile state.** ZMR returns semantic UI trees,
32
+ stable selectors, screenshots, and typed action results, so an agent can
33
+ reason from product state instead of guessing from terminal output.
34
+ - **Product claims need evidence.** Every traced session can include events,
35
+ screenshots, UI hierarchies, timings, assertion results, HTML and JUnit
36
+ reports, and a redacted bundle for review.
37
+ - **Exploration should become tests.** After a live agent session,
38
+ `zmr discover` converts trace evidence into reviewable JSON scenarios that
39
+ replay in CI without an LLM in the loop.
40
40
 
41
- ## How it works
41
+ ## How It Works
42
42
 
43
43
  ```mermaid
44
44
  flowchart LR
45
- A["AI coding agent<br/>Claude Code · Cursor · custom harness"]
46
- subgraph zmr["ZMR one small Zig binary"]
45
+ A["AI coding agent<br/>AI IDE · Cursor · custom MCP harness"]
46
+ subgraph zmr["ZMR - one small Zig binary"]
47
47
  MCP["MCP server<br/><code>zmr mcp</code>"]
48
48
  RPC["JSON-RPC stdio/TCP<br/><code>zmr serve</code>"]
49
49
  CLI["CLI + JSON scenarios<br/><code>zmr run</code>"]
@@ -65,33 +65,37 @@ flowchart LR
65
65
  CORE --> TRACE
66
66
  ```
67
67
 
68
- No app instrumentation is required on Android. iOS selector actions use an
69
- app-local XCTest shim that the wizard scaffolds. ZMR works below the
70
- JavaScript/Dart layer, so React Native, Expo, Flutter, and fully native apps
71
- are all driven the same way. See [docs/frameworks.md](docs/frameworks.md).
68
+ Android can run with no app instrumentation, with an optional app-local shim for
69
+ faster native actions. iOS and iPadOS selector actions use an app-local
70
+ XCTest/XCUIAutomation shim scaffolded by the wizard. ZMR works below the
71
+ JavaScript and Dart layer, so React Native, Expo, Flutter, and native apps share
72
+ the same runner model. See [docs/frameworks.md](docs/frameworks.md).
72
73
 
73
- ## Five-minute start
74
+ ## Five-Minute Start
74
75
 
75
- Inside a mobile app repo:
76
+ Run this from the mobile app repository. It installs the native `zmr` binary,
77
+ creates app-local configuration, and verifies the setup before a device run:
76
78
 
77
79
  ```bash
78
- npm install --save-dev zeno-mobile-runner # bun add --dev zeno-mobile-runner
79
- npx zmr-wizard --app-id com.example.mobiletest --package-json
80
- npx zmr doctor --strict --json --config .zmr/config.json
80
+ curl -fsSL https://raw.githubusercontent.com/johnmikel/zeno-mobile-runner/main/install.sh | sh
81
+ export PATH="$HOME/.local/bin:$PATH"
82
+ zmr init --app --app-id com.example.mobiletest
83
+ zmr doctor --strict --json --config .zmr/config.json
81
84
  ```
82
85
 
83
- Hook it up to your coding agent (Claude Code shown; any MCP client works):
86
+ JavaScript teams can keep ZMR versioned inside the app repo and generate npm
87
+ scripts instead:
84
88
 
85
89
  ```bash
86
- claude mcp add zmr -- npx zmr mcp --config .zmr/config.json --trace-dir traces/zmr-agent
90
+ npm install --save-dev zeno-mobile-runner
91
+ npx zmr-wizard --app-id com.example.mobiletest --package-json
87
92
  ```
88
93
 
89
- Claude Code users can instead install the plugin, which bundles the MCP server
90
- and a mobile-testing skill:
94
+ Hook it up to any MCP-capable coding agent by pointing the client at the local
95
+ binary:
91
96
 
92
- ```text
93
- /plugin marketplace add johnmikel/zeno-mobile-runner
94
- /plugin install zmr@zmr-marketplace
97
+ ```bash
98
+ zmr mcp --config .zmr/config.json --trace-dir traces/zmr-agent
95
99
  ```
96
100
 
97
101
  Or in an `.mcp.json` / MCP client config:
@@ -100,17 +104,17 @@ Or in an `.mcp.json` / MCP client config:
100
104
  {
101
105
  "mcpServers": {
102
106
  "zmr": {
103
- "command": "npx",
104
- "args": ["zmr", "mcp", "--config", ".zmr/config.json", "--trace-dir", "traces/zmr-agent"]
107
+ "command": "zmr",
108
+ "args": ["mcp", "--config", ".zmr/config.json", "--trace-dir", "traces/zmr-agent"]
105
109
  }
106
110
  }
107
111
  }
108
112
  ```
109
113
 
110
- Then ask the agent to verify its own work: *"launch the app, walk through
111
- onboarding, and show me the trace."*
114
+ Then ask the agent to verify its own work: "launch the app, walk through
115
+ onboarding, and show me the trace."
112
116
 
113
- ## The agent verification loop
117
+ ## Agent Verification Loop
114
118
 
115
119
  ```mermaid
116
120
  sequenceDiagram
@@ -130,7 +134,7 @@ sequenceDiagram
130
134
  ZMR-->>Agent: .zmrtrace evidence bundle
131
135
  ```
132
136
 
133
- The MCP server exposes the full loop as mobile-native tools:
137
+ The MCP server exposes the loop as mobile-native tools:
134
138
 
135
139
  | Group | Tools |
136
140
  | --- | --- |
@@ -142,16 +146,16 @@ The MCP server exposes the full loop as mobile-native tools:
142
146
  | Evidence | `trace_events`, `trace_explain`, `trace_discover`, `trace_explore`, `trace_export`, `scenario_validate` |
143
147
 
144
148
  The same surface is available over JSON-RPC for harnesses that embed ZMR
145
- directly see [docs/protocol.md](docs/protocol.md) and
149
+ directly. See [docs/protocol.md](docs/protocol.md) and
146
150
  [docs/ai-agents.md](docs/ai-agents.md). When a run fails, `zmr explain`
147
151
  diagnoses the trace for humans and agents alike:
148
152
 
149
153
  ![Terminal session showing a failed run, zmr explain diagnosing the failure with visible texts, and the fixed run passing](docs/assets/cli-run-explain.png)
150
154
 
151
- ## Deterministic scenarios for CI
155
+ ## Deterministic Scenarios For CI
152
156
 
153
- Scenarios are plain JSON agents and build scripts generate, validate, and
154
- mutate them without a second DSL, and they replay in CI with no LLM cost:
157
+ Scenarios are plain JSON. Agents and build scripts can generate, validate, and
158
+ mutate them without a second DSL, then replay them in CI with no LLM cost:
155
159
 
156
160
  ```json
157
161
  {
@@ -176,8 +180,9 @@ zmr report traces/login-smoke --out traces/login-smoke/report.html --junit trace
176
180
  zmr export traces/login-smoke --out login-smoke-redacted.zmrtrace --redact
177
181
  ```
178
182
 
179
- Traced `zmr run --json` responses include executable `nextCommands` so agents
180
- can continue to reporting, explanation, discovery, or export without guessing.
183
+ Traced `zmr run --json` responses include executable `nextCommands`, so agents
184
+ can continue to reporting, explanation, discovery, or export without rebuilding
185
+ paths from text.
181
186
  Open any exported bundle in the static [trace viewer](viewer/index.html) — or
182
187
  serve it and link straight to it with `viewer/index.html?bundle=<url>`.
183
188
 
@@ -186,23 +191,26 @@ comparisons against your current E2E tool, and multi-device matrices, see
186
191
  [docs/benchmarking.md](docs/benchmarking.md) and the public
187
192
  [Benchmark Lab](docs/benchmarks/README.md) evidence.
188
193
 
189
- ## Platform support
194
+ ## Platform Support
190
195
 
191
196
  | Target | Status | Notes |
192
197
  | --- | --- | --- |
193
198
  | Android emulator | Supported | ADB/UI Automator, optional Android shim, emulator lifecycle helpers |
194
199
  | Android physical device | Supported | Requires ADB connection and app build/install surface |
195
- | iOS simulator | Supported | `simctl` plus app-local XCTest/XCUIAutomation shim for native selector actions |
196
- | iOS physical device | Supported, validate locally | `devicectl` lifecycle plus XCTest shim; pilot on your own app/device before relying on it in CI |
200
+ | iPhone simulator | Supported | `simctl` plus app-local XCTest/XCUIAutomation shim for native selector actions |
201
+ | iPad simulator | Supported, evidence-needed | Same iOS simulator path; validate tablet layouts and size-class branches before production claims |
202
+ | iPhone physical device | Supported, validate locally | `devicectl` lifecycle plus XCTest shim; pilot on your app/device before relying on it in CI |
203
+ | iPad physical device | Supported, evidence-needed | Same iOS/iPadOS physical path; collect separate iPad pilot evidence before claiming production readiness |
204
+ | Apple TV / Apple Watch | Not supported in this preview | Requires separate platform lifecycle, shim, destination, and trace evidence |
197
205
  | Cloud device farms | Not included | ZMR focuses on local and self-managed device targets in this preview |
198
206
 
199
207
  Slow CI hardware can extend the generated iOS shim build timeout with
200
208
  `ZMR_IOS_SHIM_BUILD_TIMEOUT_SECONDS`; `ZMR_IOS_SHIM_RESPONSE_TIMEOUT_SECONDS`
201
209
  bounds each in-flight request, and `ZMR_IOS_SHIM_TIMEOUT_MS` remains the outer
202
- process ceiling. Current release: `0.2.16` developer preview.
210
+ process ceiling. Current release: `0.2.17` developer preview.
203
211
  Protocol version: `2026-04-28`.
204
212
 
205
- ## Optional protocol clients
213
+ ## Optional Protocol Clients
206
214
 
207
215
  TypeScript and Python clients are the common starting points; Go, Rust, Swift,
208
216
  and Kotlin reference clients embed the same JSON-RPC protocol from those
@@ -212,15 +220,24 @@ ecosystems. All are thin wrappers around `zmr serve --transport stdio`. See
212
220
 
213
221
  ## Documentation
214
222
 
223
+ **Start here**
224
+
225
+ - [docs/install.md](docs/install.md): install paths and first setup checks
226
+ - [docs/support-matrix.md](docs/support-matrix.md): platform support, evidence
227
+ levels, and Apple-platform scope
228
+ - [docs/production-readiness.md](docs/production-readiness.md): release,
229
+ reliability, privacy, and claim gates
230
+
215
231
  **For agents**
216
232
 
217
233
  - [docs/ai-agents.md](docs/ai-agents.md): JSON-RPC and MCP agent workflows
218
- - [docs/agent-discovery.md](docs/agent-discovery.md): agent-led discovery, `zmr explore`/`discover`/`draft`, and the trace-to-test loop
234
+ - [docs/agent-discovery.md](docs/agent-discovery.md): agent-led discovery,
235
+ `zmr explore`/`discover`/`draft`, and the trace-to-test loop
219
236
  - [skills/zmr-mobile-testing/SKILL.md](skills/zmr-mobile-testing/SKILL.md): reusable agent skill
220
237
 
221
238
  **For test authors**
222
239
 
223
- - [docs/install.md](docs/install.md): source, npm, Homebrew, and app setup
240
+ - [docs/install.md](docs/install.md): curl, npm, Homebrew, and app setup
224
241
  - [docs/frameworks.md](docs/frameworks.md): React Native, Expo, Flutter, and native app guidance
225
242
  - [docs/scenario-authoring.md](docs/scenario-authoring.md): selectors, waits, and scenario design
226
243
  - [docs/app-integration.md](docs/app-integration.md): app-side Android/iOS shims
@@ -232,7 +249,6 @@ ecosystems. All are thin wrappers around `zmr serve --transport stdio`. See
232
249
  - [FEATURES.md](FEATURES.md): complete feature list and limitations
233
250
  - [docs/protocol.md](docs/protocol.md): JSON-RPC methods and schemas
234
251
  - [docs/trace-privacy.md](docs/trace-privacy.md): safe trace export
235
- - [docs/production-readiness.md](docs/production-readiness.md): release, reliability, and agent-readiness gates
236
252
  - [docs/troubleshooting.md](docs/troubleshooting.md): common setup and runtime issues
237
253
  - [docs/benchmarks](docs/benchmarks/README.md): public-safe benchmark evidence
238
254
 
package/SECURITY.md CHANGED
@@ -1,13 +1,15 @@
1
1
  # Security Policy
2
2
 
3
3
  ZMR is a local mobile automation runner. It can collect screenshots, UI trees,
4
- logs, app ids, device metadata, and scenario inputs. Treat raw traces as
5
- sensitive.
4
+ logs, app identifiers, device metadata, scenario inputs, and trace events.
5
+ Treat raw traces as sensitive by default, especially when they come from a
6
+ private app or a signed device build.
6
7
 
7
8
  ## Supported Versions
8
9
 
9
- The current supported line is `0.1.x` dev preview. Security fixes should target
10
- the latest dev-preview branch until a stable release exists.
10
+ The current supported line is the latest `0.2.x` developer preview. Security
11
+ fixes should target `main` and the latest published preview release until a
12
+ stable release exists.
11
13
 
12
14
  ## Reporting A Vulnerability
13
15
 
@@ -21,14 +23,17 @@ Include:
21
23
  - Reproduction steps.
22
24
  - Whether the issue exposes screenshots, logs, trace data, credentials, or
23
25
  device access.
24
- - A minimal scenario or redacted trace bundle when possible.
26
+ - A minimal scenario or redacted `.zmrtrace` bundle when possible.
25
27
 
26
28
  Do not publish raw traces from private apps in public issues.
27
29
 
28
30
  ## Trace Handling
29
31
 
30
32
  - Use `zmr export --redact` before sharing trace bundles.
33
+ - Add `--omit-screenshots` when visual artifacts may include personal,
34
+ customer, or proprietary data.
31
35
  - Do not share raw screenshot artifacts from private apps.
32
36
  - Do not paste logs that include tokens, emails, API keys, or device identifiers.
37
+ - Keep `.zmr/` app configuration free of secrets; use the app's normal secure
38
+ configuration path for credentials.
33
39
  - Prefer fake-device reproductions for public bug reports.
34
-
package/clients/README.md CHANGED
@@ -1,17 +1,18 @@
1
1
  # ZMR Language Clients
2
2
 
3
- ZMR clients are small wrappers around the same newline-delimited JSON-RPC
4
- protocol exposed by:
3
+ ZMR language clients are small host-side wrappers around the same
4
+ newline-delimited JSON-RPC protocol exposed by:
5
5
 
6
6
  ```bash
7
7
  zmr serve --transport stdio --config .zmr/config.json --trace-dir traces/zmr-agent
8
8
  ```
9
9
 
10
- They are intended for AI agents, CI harnesses, and app teams that want typed
11
- or idiomatic calls without reimplementing JSON-RPC framing. TypeScript and
12
- Python are the most direct starting points for app and agent automation. Go,
13
- Rust, Swift, and Kotlin stay available as reference integrations for teams that
14
- want to embed host-side orchestration in those ecosystems.
10
+ They are intended for AI agents, CI harnesses, and app teams that want typed or
11
+ idiomatic calls without reimplementing JSON-RPC framing. The `zmr` binary still
12
+ does the device work. TypeScript and Python are the most direct starting points
13
+ for app and agent automation. Go, Rust, Swift, and Kotlin stay available as
14
+ reference integrations for teams that want host-side orchestration in those
15
+ ecosystems.
15
16
  Each client includes `devices()` for `device.list`, including the portable
16
17
  `ready` boolean, and a semantic snapshot helper for `observe.semanticSnapshot`
17
18
  so agents can work from normalized roles, selectors, bounds, and recommended
@@ -1,7 +1,7 @@
1
1
  # ZMR Go Client
2
2
 
3
- Small standard-library JSON-RPC client for driving `zmr serve --transport stdio`
4
- from Go agents and test harnesses.
3
+ Small standard-library JSON-RPC client for Go agents and host-side test
4
+ harnesses that drive `zmr serve --transport stdio`.
5
5
 
6
6
  ```go
7
7
  client, err := zmr.Start(ctx, "zmr", "serve", "--transport", "stdio")
@@ -1,6 +1,6 @@
1
1
  # ZMR Kotlin Client
2
2
 
3
- Small JVM client for Kotlin agents and test harnesses that drive
3
+ Small JVM client for Kotlin agents and host-side test harnesses that drive
4
4
  `zmr serve --transport stdio`.
5
5
 
6
6
  For now, build it from a local checkout and consume the generated jar:
@@ -27,7 +27,7 @@ gradle -p clients/kotlin runFakeSession \
27
27
  ```
28
28
 
29
29
  ```kotlin
30
- implementation(files("path/to/zeno-mobile-runner/clients/kotlin/build/libs/zmr-client-0.2.16.jar"))
30
+ implementation(files("path/to/zeno-mobile-runner/clients/kotlin/build/libs/zmr-client-0.2.17.jar"))
31
31
  ```
32
32
 
33
33
  ```kotlin
@@ -4,7 +4,7 @@ plugins {
4
4
  }
5
5
 
6
6
  group = "dev.zmr"
7
- version = "0.2.16"
7
+ version = "0.2.17"
8
8
 
9
9
  kotlin {
10
10
  jvmToolchain(17)
@@ -1,6 +1,7 @@
1
1
  # ZMR Python Reference Client
2
2
 
3
- Standard-library Python client for ZMR's newline-delimited JSON-RPC protocol.
3
+ Standard-library Python client for host-side agents and harnesses using ZMR's
4
+ newline-delimited JSON-RPC protocol.
4
5
 
5
6
  ```python
6
7
  from zmr_client import ZmrClient
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
4
4
 
5
5
  [project]
6
6
  name = "zmr-client"
7
- version = "0.2.16.dev1"
7
+ version = "0.2.17.dev1"
8
8
  description = "Python JSON-RPC client for Zeno Mobile Runner."
9
9
  requires-python = ">=3.9"
10
10
  license = { text = "MIT" }
@@ -100,7 +100,7 @@ checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
100
100
 
101
101
  [[package]]
102
102
  name = "zmr-client"
103
- version = "0.2.16"
103
+ version = "0.2.17"
104
104
  dependencies = [
105
105
  "serde",
106
106
  "serde_json",
@@ -1,6 +1,6 @@
1
1
  [package]
2
2
  name = "zmr-client"
3
- version = "0.2.16"
3
+ version = "0.2.17"
4
4
  edition = "2021"
5
5
  license = "MIT"
6
6
  description = "Rust JSON-RPC client for Zeno Mobile Runner."
@@ -1,7 +1,7 @@
1
1
  # ZMR Rust Client
2
2
 
3
- Small synchronous JSON-RPC client for driving `zmr serve --transport stdio`
4
- from Rust agents and test harnesses.
3
+ Small synchronous JSON-RPC client for Rust agents and host-side test harnesses
4
+ that drive `zmr serve --transport stdio`.
5
5
 
6
6
  ```rust
7
7
  let mut client = zmr_client::Client::start(
@@ -1,7 +1,7 @@
1
1
  # ZMR Swift Client
2
2
 
3
- Small Foundation-based client for macOS test harnesses and agents that drive
4
- `zmr serve --transport stdio`.
3
+ Small Foundation-based client for macOS agents and host-side test harnesses that
4
+ drive `zmr serve --transport stdio`.
5
5
 
6
6
  Add it to a Swift package. Until this client is published as a standalone Swift
7
7
  package, consume it from a local checkout:
@@ -1,6 +1,7 @@
1
1
  # ZMR TypeScript Reference Client
2
2
 
3
- Zero-dependency ESM client for ZMR's newline-delimited JSON-RPC protocol.
3
+ Zero-dependency ESM client for host-side agents and harnesses using ZMR's
4
+ newline-delimited JSON-RPC protocol.
4
5
 
5
6
  ```js
6
7
  import { createZmrClient } from "./index.mjs";
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@zmr/client",
3
- "version": "0.2.16",
3
+ "version": "0.2.17",
4
4
  "type": "module",
5
5
  "main": "index.mjs",
6
6
  "types": "index.d.ts",
@@ -1,4 +1,4 @@
1
- # 0001: Agent-Native Runner Boundary
1
+ # 0001: Agent-First Runner Boundary
2
2
 
3
3
  ## Status
4
4
 
@@ -1,12 +1,14 @@
1
1
  # Architecture Decisions
2
2
 
3
- Accepted architecture decisions for ZMR are recorded here so product docs,
4
- protocol docs, and implementation choices stay aligned.
3
+ Accepted architecture decisions for ZMR are recorded here so product claims,
4
+ protocol docs, implementation boundaries, and support-matrix wording stay
5
+ aligned.
5
6
 
6
- - [0001: Agent-Native Runner Boundary](0001-agent-native-runner-boundary.md)
7
+ - [0001: Agent-First Runner Boundary](0001-agent-native-runner-boundary.md)
7
8
  - [0002: App-Local `.zmr/` Contract](0002-app-local-zmr-contract.md)
8
9
  - [0003: iOS XCTest Shim](0003-ios-simulator-xctest-shim.md)
9
10
  - [0004: Benchmark Claims And Baseline Collection](0004-benchmark-claims-and-baseline-collection.md)
10
11
 
11
- ADRs describe current decisions, not permanent constraints. A later ADR can
12
- supersede an earlier decision when the product or support matrix changes.
12
+ ADRs describe current decisions, not permanent constraints. Add a new ADR when
13
+ the product direction, public protocol, or support matrix changes enough to
14
+ supersede an earlier decision.