Manual dependabot fixes.
## Details
<details>
**Lockfile-only.** `package.json` is unchanged; all bumps are within
parents' already-declared semver ranges (API-compatible by semver
contract). Refreshing the stale lock to the in-range patched versions:
- `fast-uri` 3.1.0 → **3.1.2** — *shipped*
- `path-to-regexp` 0.1.12 → **0.1.13** — *shipped* (upstream fix = two
`backtrack = ''` resets)
- `hono` 4.12.3 → 4.12.19, `@hono/node-server` 1.19.9 → 1.19.14,
`express-rate-limit` 8.2.1 → 8.5.2, `router`'s `path-to-regexp` 8.3.0 →
8.4.2 — *not shipped* (SDK HTTP/SSE transport; argent uses stdio only →
tree-shaken out of bundles). Same low-risk stale-lock class, bumped in
the same pass.
- `ip-address` 10.0.1 → 10.2.0 — benign in-range cascade from
`express-rate-limit@8.5.2`'s own manifest.
`npm audit` HIGH for shipped/runtime deps: **7 → 0**.
## Scope
In scope (the QA finding): the two shipped HIGH advisories — fixed and
proven present in freshly-built bundles.
Out of scope (deliberately): the remaining ~7 `npm audit` entries are
**exclusively the dev-only vitest toolchain** (`vite`, `vite-node`,
`esbuild`, `postcss`, `picomatch`, `@vitest/mocker`, `vitest`). Not
shipped, not runtime. Their fix requires a `vitest` **semver-major** — a
separate, breaking change.
## Verification
- `tsc --build` clean; **998 tests pass** across all 7 workspaces;
`prettier --check .` clean.
- Bundles rebuilt from the patched tree; MCP stdio + tool-server E2E
confirmed working.
- 4 independent reviews (correctness / scope / edge-cases / ripple): all
PASS. Edge-case review ran an **offline differential** of every
tool-server express route under 0.1.12 vs 0.1.13 (byte-identical
`RegExp` source + keys) and a **live E2E** on the running patched
tool-server — route matching is unchanged. `fast-uri` 3.1.2 only rejects
more malformed URIs; `ajv` uses it solely for schema `$id`/`$ref`, never
runtime data.
- `npm ci` is byte-stable against this lockfile (does not regenerate
it); `npm pack --dry-run -w @swmansion/argent` passes.
## Residual `npm audit`
7 vulns remain (2 high, 5 moderate) — all dev-only vitest toolchain,
tracked separately (needs `vitest` major).
</details>
## Summary
- Bumps all 9 published packages from `0.6.0` → `0.6.1`.
- Affected: `@swmansion/argent`, `@argent/cli`, `@argent/installer`,
`@argent/mcp`, `@argent/tools-client`, `@argent/native-devtools-ios`,
`@argent/registry`, `@argent/skills`, `@argent/tool-server`.
- `packages/ui` (`0.0.1`) is on a separate version track and left as-is.
- Lockfile updated via `npm install`; `npm run format` was a no-op.
## Test plan
- [ ] CI green
- [ ] Run the stable publish workflow against this commit and confirm
publish succeeds
This PR fixes stale `package-lock.json` on main.
It's been adding noise to my other PRs so i'm fixing it in this one.
### Why?
#158 forgot to regenerate `package-lock.json`
## Summary
- Bumps all 9 published packages from `0.6.0-next.2` → `0.6.0` (stable)
in preparation for the `0.6.0` release.
- Affected: `@swmansion/argent`, `@argent/cli`, `@argent/installer`,
`@argent/mcp`, `@argent/tools-client`, `@argent/native-devtools-ios`,
`@argent/registry`, `@argent/skills`, `@argent/tool-server`.
`packages/ui` (`0.0.1`) is on a separate version track and left as-is.
- Lockfile updated via `npm install`; `npm run format` was a no-op.
## Test plan
- [ ] CI green
- [ ] Run the stable publish workflow against this commit and confirm
publish succeeds
## Summary
- Bumps all 9 published packages from `0.6.0-next.1` → `0.6.0-next.2` in
preparation for the next prerelease publish.
- Affected: `@swmansion/argent`, `@argent/cli`, `@argent/installer`,
`@argent/mcp`, `@argent/tools-client`, `@argent/native-devtools-ios`,
`@argent/registry`, `@argent/skills`, `@argent/tool-server`.
`packages/ui` (`0.0.1`) is on a separate version track and left as-is.
- Lockfile updated via `npm install`; `npm run format` was a no-op.
## Test plan
- [ ] CI green
- [ ] Run `Publish prerelease to npm (next)` workflow against this
commit and confirm publish succeeds
## Summary
- Bumps all 9 published packages from `0.6.0-next.0` → `0.6.0-next.1` in
preparation for the next prerelease publish (the `0.6.0-next.0` train
was blocked by the build-config and update-checker fixes in #172 and
#173).
- Affected: `@swmansion/argent`, `@argent/cli`, `@argent/installer`,
`@argent/mcp`, `@argent/tools-client`, `@argent/native-devtools-ios`,
`@argent/registry`, `@argent/skills`, `@argent/tool-server`.
`packages/ui` (`0.0.1`) is on a separate version track and left as-is,
matching #171.
- Lockfile updated via `npm install` — only the 9 workspace `version`
entries changed.
## Test plan
- [ ] CI green
- [ ] Run `Publish prerelease to npm (next)` workflow against this
commit (after #172 and #173 land) and confirm publish succeeds
## Summary
- The homegrown `parseSemver` in
`packages/tool-server/src/utils/update-checker.ts` only matched plain
`MAJOR.MINOR.PATCH` and returned `null` for prerelease strings. After
[#171](https://github.com/software-mansion/argent/pull/171) bumped the
local version to `0.6.0-next.0`, `isNewerVersion` started returning
`false` for **any** value of `latest`, because the *current* side failed
to parse. Two consequences:
- Users on the `next` dist-tag are never notified of new releases
(silent feature degradation, not a crash).
- The `detects an available update on startup` unit test broke because
its asserted state now reads `{ updateAvailable: false, latestVersion:
"99.0.0" }` instead of `{ true, "99.0.0" }` — see [run
25161184594](https://github.com/software-mansion/argent/actions/runs/25161184594/job/73755770427).
- Replaces the regex parser with the `semver` package (already pinned at
`^7.7.4` and present in the lockfile via `@argent/installer`). Adds it
as a dep of `@argent/tool-server` along with `@types/semver`.
- Keeps the existing UX rule: don't notify when upstream `latest` is
itself a prerelease — npm's `latest` dist-tag should be stable, and we
shouldn't push betas to stable users. `semver.gt` correctly treats a
stable version as greater than its own prereleases, so a user on
`0.6.0-next.0` will be notified when `0.6.0` ships.
## Behavior matrix
| current | npm `latest` | before (broken) | after |
|---|---|---|---|
| `0.6.0-next.0` | `99.0.0` | not flagged | **flagged** |
| `0.6.0-next.0` | `0.6.0` | not flagged | **flagged** |
| `0.6.0` | `99.0.0` | flagged | flagged |
| `0.6.0` | `1.0.0-beta.1` | not flagged | not flagged |
| anything | invalid string | not flagged | not flagged |
## Test plan
- [x] `npm test -w @argent/tool-server -- test/update-checker.test.ts` —
all 10 tests pass (was 9/10).
- [x] `npm test -w @argent/tool-server` — full suite 444/444 passes.
- [x] `npx tsc --build` clean from the repo root.
- [ ] CI green on this branch.
## Summary
- Bump all published packages to `0.6.0-next.0` in preparation for the
next prerelease train.
- Affected: `@swmansion/argent`, `@argent/cli`, `@argent/installer`,
`@argent/mcp`, `@argent/tools-client`, `@argent/native-devtools-ios`,
`@argent/registry`, `@argent/skills`, `@argent/tool-server`.
`@argent/native-devtools-ios` was at `0.5.1`; aligned with the rest.
`packages/ui` (`0.0.1`) is on a separate version track and left as-is.
## Test plan
- [ ] CI green
- [ ] `npm next` prerelease publish workflow picks up the new version
Closes#165.
`argent init` was wiping users' `~/.config/zed/settings.json` - Zed's
settings format is JSONC, so `readJson` used `JSON.parse` and silently
fell back to `{}` on any parse failure, after which the Zed adapter
would overwrite the file with an argent-only stub.
Co-authored-by: Filip131311 <contact@filipkaminski.com>
Previously the CLI checked `latest !== version`, which triggered an
update prompt (and recommended a downgrade) whenever a locally installed
prerelease was newer than the published release. Switch to semver-aware
comparison so update prompts only appear for genuine upgrades.
* feat: add MCP config adapter for Hermes
Add hermesAdapter to the MCP config registry so `argent init` can write
the mcp_servers.argent entry into ~/.hermes/config.yaml.
- Uses the yaml Document API (parseDocument/setIn/toString) to preserve
user comments and formatting on round-trip.
- remove() cleans up by deleting the argent key from mcp_servers, or the
entire mcp_servers block when argent is the only entry.
- readYamlDocument throws on malformed YAML instead of silently
clobbering; writeYamlDocument uses lineWidth: 0 to avoid re-wrapping
long user strings.
- Adds symmetric local→global fallback in the init write loop so
global-only adapters (Hermes, Windsurf) are not silently skipped when
the user picks scope=local.
* refactor: drop unused readYaml POJO flavor, unify yaml util names
readYaml (POJO round-trip) was added to utils.ts but never called — the
hermes adapter uses the Document-returning helpers exclusively. Drop it
and rename readYamlDocument/writeYamlDocument to readYaml/writeYaml so
the naming matches the readJson/readToml pairs; with only one flavor
left, the Document suffix no longer disambiguates anything.
* feat(init): flag adapters that only have one config scope
For adapters like Hermes and Windsurf that only expose a global config
path (or conversely, only a project path), the multiselect menu now
shows an italic cyan note next to the adapter name so users understand
up front which scope the entry will land in, instead of discovering it
after selection.
* feat: first implementation integration of ax-service for enhanced accessibility support
* feat: enhance ax-service with automation enablement and daemon management
* feat: export ensureAutomationEnabled function for improved accessibility automation in simulator server
* feat: add new build scripts for native development and update binary files
* feat: enhance describe tool to support native-devtools fallback and introduce DescribeResult interface
* chore: bump version to 0.4.1
* chore: bump argent-private to main; list ax-service in LICENSE
- Point packages/argent-private at current main and set submodule branch.
- Declare packages/native-devtools-ios/bin/ax-service as proprietary alongside simulator-server and dylibs.
Made-with: Cursor
* docs: document ax-service as proprietary across LICENSE and README
- Extend root README and CONTRIBUTING requirements (mcp README syncs from root at build).
- List bin/ax-service in @swmansion/argent and native-devtools-ios LICENSE.
- Assert ax-service is present and executable in publish workflow.
Made-with: Cursor
---------
Co-authored-by: Filip131311 <Filip.kaminski@swmansion.com>
Bootstraps the first restricted npm release from GitHub Actions, which cannot complete interactive 2FA, and aligns the package version with the planned 0.4.0 tag.
Made-with: Cursor
- Adds native-devtools-ios package with pre-built dylibs (libNativeDevtoolsIos, libKeyboardPatch, libInjectionBootstrap)
- Passive simulator watcher injects dylibs into all booted simulators on tool-server startup, eliminating manual restart requirement
- Lazy network activation: NSURLProtocol interception is opt-in per bundleId via Control socket command, re-activated on reconnect
- New tools: native-find-views, native-full-hierarchy, native-network-logs, native-devtools-status
- dev script: non-fatal argent-private submodule (uses pre-built dylibs when source unavailable)
- Adds Prettier config and format script
- Updates CONTRIBUTING.md with npm run dev workflow and project structure
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: add Codex CLI adapter for MCP config management
Add support for OpenAI's Codex CLI alongside existing editors. The adapter
reads/writes TOML config at ~/.codex/config.toml and <root>/.codex/config.toml,
using the smol-toml library. Includes full test coverage and docs update.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: remove incorrect Codex rules/agents copy targets
Codex's .codex/rules/ is for execpolicy (Starlark security rules), not
model instructions. Codex uses AGENTS.md and .agents/skills/ for context
injection, so directory-based rules/agents copying doesn't apply.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: inject argent rules into Codex developer_instructions
Codex has no rules/ directory for model instructions — .codex/rules/ is
for execpolicy (Starlark security rules). Instead, inject rule content
into the developer_instructions field in config.toml, delimited by
markers for clean update/removal.
- Reads .md rule files, strips YAML frontmatter, concatenates content
- Injects into developer_instructions with argent section markers
- Preserves existing user developer_instructions
- Replaces argent section on re-inject (idempotent)
- Uninstall cleans up argent section from config.toml
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: rename RADON references to ARGENT across the codebase
* Merge main into branch and complete ARGENT rename in new files
Merges main's changes: modular CLI architecture, UI package deprecation,
db tool removal, skills/agents prefix rename, and MCP server consolidation.
Extends the RADON→ARGENT rename to cover new files introduced in main
(ARGENT_MCP_LOG, ARGENT_TOOLS_URL env vars, argent-skills bin).
Made-with: Cursor
* fix: rename RADON_MCP_LOG in observe.cjs, regenerate lockfile for argent-skills bin
Made-with: Cursor
* chore: remove accidental PUBLIC_RELEASE_AUDIT.md
* feat: first improved CLI implementation
* feat: add ASCII banner to `argent init` and installation guide
Add a gradient ASCII art banner displayed at the start of `argent init`.
Add docs/install-guide.md with concise instructions for installing from
the GitHub Packages registry (including PAT generation) and from a local
tarball.
Made-with: Cursor
* refactor: update ASCII banner in `init.ts` for improved aesthetics
- packages/mcp: thin MCP stdio bridge that discovers tools dynamically
from GET /tools and proxies calls; screenshot outputHint fetches PNG
and returns base64 image content to the MCP client
- packages/skills: 4 Claude Code skills for simulator setup, screenshot,
interaction, and UI test flow automation
- packages/tools: 7 new interaction tools (screenshot, tap, swipe,
gesture, button, paste, rotate) all using ensureServer() for
transparent auto-spawn
- simulator-registry.ts: unified process + WebSocket registry shared
across all tools
- Fix zodTypeToJsonSchema to preserve .describe() text and handle
ZodEnum/ZodObject; add outputHint to Tool interface and registry.list()
- .claude/mcp.json: registers radon-lite MCP server for Claude Code
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The tools server (port 3001) supersedes the original Express server.
packages/tools and packages/ui have no imports from packages/server,
and the vscode extension never used the dependency either.
- Delete packages/server/ (src, tests, openapi spec, duplicate binary)
- Remove build:server, start, dev scripts from root package.json
- Remove packages/server reference from root tsconfig.json
- Remove @radon-lite/server dependency from packages/vscode/package.json
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Ignacy Łątka