Files
Michał Pierzchała 4f95ca8881 fix(daemon): timing-safe token comparison, daemon.json hardening, shell-quote CVE (#731)
* fix(daemon): timing-safe token comparison and daemon.json permission hardening

Use crypto.timingSafeEqual (via SHA-256 digests, length-independent) for the
three daemon token checks, and chmod daemon.json to 0600 after writes since
writeFileSync only applies mode on creation.

https://claude.ai/code/session_01LXZXzxi55sZ11DSyqWyBA2

* fix(deps): clear CVE-2026-9277 by overriding shell-quote to >=1.8.4 in test-app

Override added to examples/test-app/pnpm-workspace.yaml (package.json-level
overrides are silently ignored for this nested app, see the comment there).
Lockfile change is limited to shell-quote 1.8.3 -> 1.8.4; pnpm audit is clean.

https://claude.ai/code/session_01LXZXzxi55sZ11DSyqWyBA2

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-06-10 11:00:19 +02:00
..
2026-04-26 20:49:59 -04:00
2026-04-26 20:49:59 -04:00
2026-04-26 20:49:59 -04:00

Agent Device Tester

Agent Device Tester is a minimal Expo Router fixture app for agent-device and skillgym experiments.

It is intentionally small, but each surface is dense with durable accessibility targets so a few screens cover a large share of the workflows we care about.

Why this app exists

  • It gives agent-device a stable React Native target that we control.
  • It makes skillgym prompts concrete: the agent can inspect real app files instead of answering against an imagined UI.
  • It keeps the number of screens low while still covering roughly 50 practical interaction and verification cases.

Screens

  • Home: visible-text checks, dismissible banner, modal open/close, async loading, status badge, switch state
  • Catalog: search debounce, filter chips, long-list scroll, favorite toggles, cart updates, drill-in navigation
  • Product detail: back navigation, quantity stepper, multiline notes, save action
  • Checkout form: required-field validation, fill vs type, checkbox state, choice groups, keyboard dismiss, success summary
  • Settings: switch rows, accordion content, loading and error states, retry flow, destructive-confirm modal

Navigation uses Expo Router native bottom tabs, so the tab bar itself is also part of the test surface.

Coverage map

These are the main case families this app can support without adding more screens:

  • app open and close
  • visible text verification with plain snapshot
  • interactive discovery with snapshot -i
  • press on stable buttons, pills, and rows
  • fill on single-line and multiline fields
  • type after focus for append flows
  • get text on headings, badges, summaries, and accordion content
  • is visible and is exists assertions
  • wait for async loading and success states
  • diff snapshot after dismissals and submits
  • long-list scrolling and scrollintoview
  • selector-based navigation across repeated cards
  • modal open, cancel, and confirm flows
  • switch and checkbox state changes
  • validation-error and recovery loops
  • retryable error banners
  • cart counters and quantity changes
  • screenshot and recording proof capture

Run locally

From the repo root:

pnpm test-app:install
pnpm test-app:ios

Or on Android:

pnpm test-app:install
pnpm test-app:android

If you prefer to work from inside the app folder:

cd examples/test-app
pnpm install --ignore-workspace
pnpm ios

Or on Android:

cd examples/test-app
pnpm install --ignore-workspace
pnpm android

Once the app is running, use agent-device against Agent Device Tester like any other target app.

Local Agent Device suites

The repo includes two local suites for iterating on the fixture app:

pnpm test-app:replay:ios
pnpm test-app:replay:android

These run the .ad replay suite in examples/test-app/replays.

gesture-lab.ad verifies gesture pan, gesture fling, gesture pinch, and gesture rotate against the gesture metrics rendered by the Home screen on iOS and Android. Android and iOS simulator sessions also support gesture transform for a combined pan/zoom/rotate gesture. On Android, treat combined transform assertions as qualitative because recognizers can report non-exact centroid, scale, and rotation values for one simultaneous two-finger gesture.

To target a specific iOS simulator or an installed Expo development build, run the underlying command directly so global flags stay before replay inputs:

node bin/agent-device.mjs test examples/test-app/replays \
  --platform ios \
  --device "iPhone 17 Pro" \
  --env APP_TARGET=dev.expo.easagentdevice \
  --env APP_URL=<project-url> \
  --artifacts-dir .tmp/test-app-replay/ios

Use APP_TARGET=com.callstack.agentdevicelab when the standalone fixture app is installed instead of an Expo development shell.

The Maestro prototype suite lives in examples/test-app/maestro and runs through agent-device replay --maestro:

pnpm test-app:maestro:ios -- --open "Agent Device Tester"
pnpm test-app:maestro:android -- --open "Agent Device Tester"

When running through Expo Go, start the project first and pass the shell that is already showing the app, for example:

pnpm test-app:maestro:ios -- --open "Expo Go"

The suite intentionally covers the compat layer syntax used by public Maestro suites: runFlow file/inline blocks, when.platform, config hooks, deterministic repeat.times, flow env, selectors, input, assertions, and swipe.