callstack
diff --git a/‎CHANGELOG.md‎
Lines changed: 31 additions & 0 deletions b/‎CHANGELOG.md‎
Lines changed: 31 additions & 0 deletions
diff --git a/‎CONTRIBUTING.md‎
Lines changed: 11 additions & 0 deletions b/‎CONTRIBUTING.md‎
Lines changed: 11 additions & 0 deletions
diff --git a/‎package.json‎
Lines changed: 4 additions & 3 deletions b/‎package.json‎
Lines changed: 4 additions & 3 deletions
diff --git a/‎scripts/__tests__/test-file-size-ratchet.test.ts‎
Lines changed: 1 addition & 1 deletion b/‎scripts/__tests__/test-file-size-ratchet.test.ts‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎scripts/release-mark-dev.mjs‎
Lines changed: 67 additions & 0 deletions b/‎scripts/release-mark-dev.mjs‎
Lines changed: 67 additions & 0 deletions
diff --git a/‎server.json‎
Lines changed: 2 additions & 2 deletions b/‎server.json‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎src/__tests__/npm-package-scripts.test.ts‎
Lines changed: 15 additions & 2 deletions b/‎src/__tests__/npm-package-scripts.test.ts‎
Lines changed: 15 additions & 2 deletions
diff --git a/‎src/commands/command-contract.ts‎
Lines changed: 7 additions & 0 deletions b/‎src/commands/command-contract.ts‎
Lines changed: 7 additions & 0 deletions
diff --git a/‎src/commands/command-input.ts‎
Lines changed: 5 additions & 0 deletions b/‎src/commands/command-input.ts‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎src/commands/field-command-contract.ts‎
Lines changed: 7 additions & 1 deletion b/‎src/commands/field-command-contract.ts‎
Lines changed: 7 additions & 1 deletion
@@ -2,6 +2,37 @@
 
 ## Unreleased
 
+- Security (MCP/AI-SDK tool surface): the operator-owned endpoint and path inputs — `daemonBaseUrl`,
+  the Metro `proxyBaseUrl`, `stateDir`, `cwd`, `iosSimulatorDeviceSet`, `iosXctestrunFile`,
+  `iosXctestDerivedDataPath`, `iosXctestEnvDir` — follow the credential inputs off the
+  model-writable tool surface: no longer advertised, refused as explicit input with guidance, and
+  resolved from env/config only (a model-writable `daemonBaseUrl`/`proxyBaseUrl` would redirect the
+  env-resolved token to an arbitrary server). Dropping these plus the credential fields shrinks
+  `tools/list` by roughly half. CLI flags and the SDK client options are unchanged.
+- MCP tool descriptions now declare their enforced client timeout envelope (90s default, 180s
+  install, 300s+ lease allocation, unbounded only for the streaming `test` runner), sourced from
+  the descriptor registry's timeout policy so the declared number cannot drift from the enforced
+  one.
+- Security (MCP/AI-SDK tool surface): the shared command-tool executor now enforces the advertised
+  tool schema as an admission boundary — every raw `tools/call` argument must appear in the tool's
+  advertised (`additionalProperties: false`) schema, or it is refused before config/env resolution.
+  Hiding a key from `tools/list` alone was insufficient: the router forwards raw arguments verbatim
+  and the MCP config resolver read `config`/`remoteConfig` as CLI flags, so a model-supplied config
+  file could load `daemonBaseUrl`/`daemonAuthToken` and redirect the operator's token to an
+  arbitrary endpoint. Deny-by-default closes that, the operator keys, and any unknown key at once;
+  operator env/config defaults still resolve (they never arrive as tool input). Retired keys are
+  still admitted so their migration guidance answers.
+- Security (MCP/AI-SDK tool surface): `daemonAuthToken` and the Metro `bearerToken` are no longer
+  advertised as tool input properties, and an explicit value is refused with guidance instead of
+  being forwarded. Credentials are operator-owned: set `AGENT_DEVICE_DAEMON_AUTH_TOKEN` (or
+  `daemonAuthToken` in `~/.agent-device/config.json`) and `AGENT_DEVICE_METRO_BEARER_TOKEN` on the
+  process serving the tools. The model both reads untrusted app UI text and picks tool arguments,
+  so a model-writable credential parameter was a prompt-injection exfiltration path. CLI flags
+  (`--daemon-auth-token`, `--bearer-token`) and env/config resolution are unchanged.
+- Release hygiene: after `npm publish`, `release:mark-dev` moves `main` to the next patch with a
+  `-dev` prerelease marker so the version on `main` never equals a published version (registry
+  scanners diff the tool surface per version string, and a moving surface under a released number
+  reads as a republish). `release:prepare` refuses to publish while the `-dev` marker is in place.
 - Parameterized `fill --record-as` protection is now recording-session-scoped instead of
   fill-step-scoped (ADR 0017 amendment): a later, unrelated recorded action (`wait`, `is`, `get`) can no
   longer re-serialize an app-rendered echo of an already-parameterized value into its own result or
 
@@ -72,6 +72,17 @@ when a running daemon needs to pick up a new TypeScript build.
 `pnpm package:npm` is a release guard, not a routine development command. Use the specific commands
 above while iterating.
 
+### The version on main never equals a published version
+
+`release:publish` runs `release:mark-dev` right after `npm publish`, moving `package.json` (and the
+synchronized `server.json`) to the next patch with a `-dev` prerelease marker (for example
+`0.20.11-dev`). Commit that bump as part of the release. The invariant it protects: MCP registry
+scanners diff the repository's tool surface per version string, so a released number left on `main`
+while `main` keeps changing is indistinguishable from a republished ("rug-pull") version.
+`release:prepare` enforces the inverse direction and refuses to publish while the `-dev` marker is
+still in place — set the real release version first (for example `npm version patch`, which strips
+the prerelease marker), commit, then publish.
+
 ### Released-surface baselines roll forward on publish
 
 Compatibility gates baseline against the last **released tag**, not against `main`, so publishing is
 
@@ -1,6 +1,6 @@
 {
   "name": "agent-device",
-  "version": "0.20.10",
+  "version": "0.20.11-dev",
   "description": "Mobile app automation and verification for AI coding agents. CLI, MCP server, and typed Node.js API for iOS, Android, HarmonyOS, TV, web, macOS, and Linux.",
   "mcpName": "io.github.callstack/agent-device",
   "license": "MIT",
@@ -109,8 +109,9 @@
     "build:macos-helper:clean": "node --experimental-strip-types scripts/swift-toolchain-tmpdir.ts swift package --package-path apple/macos-helper clean && pnpm build:macos-helper",
     "build:package": "pnpm build && pnpm build:xcuitest:ios && pnpm build:xcuitest:macos && pnpm build:xcuitest:tvos && pnpm build:xcuitest:visionos && pnpm build:macos-helper:clean && pnpm package:apple-runner:npm && pnpm build:android",
     "package:npm": "pnpm build:package && pnpm check:package",
-    "release:prepare": "rm -rf .tmp/release && pnpm check:mcp-metadata && pnpm build:package && pnpm check:package -- --pack-destination .tmp/release",
-    "release:publish": "pnpm release:prepare && npm publish --ignore-scripts .tmp/release/*.tgz",
+    "release:prepare": "node scripts/release-mark-dev.mjs --check-release-version && rm -rf .tmp/release && pnpm check:mcp-metadata && pnpm build:package && pnpm check:package -- --pack-destination .tmp/release",
+    "release:publish": "pnpm release:prepare && npm publish --ignore-scripts .tmp/release/*.tgz && pnpm release:mark-dev",
+    "release:mark-dev": "node scripts/release-mark-dev.mjs",
     "ad": "node bin/agent-device.mjs",
     "bench:help-conformance": "node scripts/help-conformance-bench.mjs",
     "maestro:conformance": "node --experimental-strip-types scripts/node-test-tmpdir.ts --experimental-strip-types --test scripts/maestro-conformance/format-generated-json.test.mjs packages/maestro/test/conformance/verify.test.ts packages/maestro/test/conformance/differential/engine-process.test.ts packages/maestro/test/conformance/differential/report-output.test.ts packages/maestro/test/conformance/differential/run.test.ts packages/maestro/test/conformance/differential/invariants.test.ts",
 
@@ -50,7 +50,7 @@ const PINNED_TEST_FILE_LINES: Readonly<Record<string, number>> = Object.freeze({
   'src/__tests__/cli-config.test.ts': 1282,
   'src/daemon/handlers/__tests__/find.test.ts': 1202,
   'src/platforms/apple/core/__tests__/perf.test.ts': 1222,
-  'src/mcp/__tests__/command-tools.test.ts': 1218,
+  'src/mcp/__tests__/command-tools.test.ts': 1216,
   'src/daemon/handlers/__tests__/session-replay-divergence.test.ts': 1137,
   'src/platforms/apple/core/__tests__/apps.test.ts': 1210,
   'src/daemon/handlers/__tests__/session-replay-repair-transaction.test.ts': 1208,
 
@@ -0,0 +1,67 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+
+// The version on main must never equal a published version: registry scanners
+// diff the repository's tool surface per version string, so a released number
+// left in place while main keeps moving reads as a rug-pull republish
+// (AS-012). `release:publish` runs this right after `npm publish` to move
+// main to the next patch with a `-dev` prerelease marker; `--check-release-version`
+// is the inverse guard in `release:prepare`, refusing to publish a `-dev`
+// version because the maintainer has not set the release version yet.
+const root = process.cwd();
+const checkReleaseVersion = process.argv.includes('--check-release-version');
+const packagePath = path.join(root, 'package.json');
+
+const raw = fs.readFileSync(packagePath, 'utf8');
+const pkg = JSON.parse(raw);
+const version = pkg.version;
+
+if (typeof version !== 'string' || version.length === 0) {
+  fail('package.json must define version.');
+}
+
+if (checkReleaseVersion) {
+  if (version.includes('-')) {
+    fail(
+      `package.json version ${version} is a prerelease marker. Set the release version first ` +
+        '(e.g. `npm version patch`), commit, then publish.',
+    );
+  }
+  process.exit(0);
+}
+
+if (version.includes('-')) {
+  process.stdout.write(`Version ${version} already carries a prerelease marker; nothing to do.\n`);
+  process.exit(0);
+}
+
+const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+if (!match) {
+  fail(`Unsupported version format: ${version}`);
+}
+const nextVersion = `${match[1]}.${match[2]}.${Number(match[3]) + 1}-dev`;
+
+const versionField = `"version": "${version}"`;
+if (raw.split(versionField).length !== 2) {
+  fail(`Expected exactly one ${versionField} in package.json.`);
+}
+fs.writeFileSync(packagePath, raw.replace(versionField, `"version": "${nextVersion}"`));
+
+const sync = spawnSync(process.execPath, [path.join(root, 'scripts', 'sync-mcp-metadata.mjs')], {
+  stdio: 'inherit',
+});
+if (sync.status !== 0) {
+  fail('sync-mcp-metadata failed after the version bump.');
+}
+
+process.stdout.write(
+  `Marked main as unreleased: ${version} -> ${nextVersion} (package.json + server.json).\n` +
+    `Commit and push this so the version on main never equals the published ${version}.\n`,
+);
+
+function fail(message) {
+  process.stderr.write(`${message}\n`);
+  process.exit(1);
+}
@@ -7,12 +7,12 @@
     "url": "https://github.com/callstack/agent-device",
     "source": "github"
   },
-  "version": "0.20.10",
+  "version": "0.20.11-dev",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "agent-device",
-      "version": "0.20.10",
+      "version": "0.20.11-dev",
       "transport": {
         "type": "stdio"
       }
 
@@ -73,15 +73,28 @@ test('the npm package build covers every package-owned output before verificatio
 test('release publishing uploads the tarball that passed the package gate', () => {
   assert.equal(
     script('release:prepare'),
-    'rm -rf .tmp/release && pnpm check:mcp-metadata && pnpm build:package && pnpm check:package -- --pack-destination .tmp/release',
+    'node scripts/release-mark-dev.mjs --check-release-version && rm -rf .tmp/release && pnpm check:mcp-metadata && pnpm build:package && pnpm check:package -- --pack-destination .tmp/release',
   );
   assert.equal(
     script('release:publish'),
-    'pnpm release:prepare && npm publish --ignore-scripts .tmp/release/*.tgz',
+    'pnpm release:prepare && npm publish --ignore-scripts .tmp/release/*.tgz && pnpm release:mark-dev',
   );
   assert.doesNotMatch(script('release:publish'), /prepack|package:npm/);
 });
 
+// AS-012: registry scanners diff the repository's tool surface per version string, so the
+// version on main must never equal a published version. Publishing marks main as unreleased
+// (`-dev` prerelease on the next patch) right after the upload, and preparation refuses to
+// publish while that marker is still in place.
+test('release publishing moves main off the released version', () => {
+  assert.match(
+    script('release:prepare'),
+    /^node scripts\/release-mark-dev\.mjs --check-release-version && /,
+  );
+  assert.match(script('release:publish'), / && pnpm release:mark-dev$/);
+  assert.equal(script('release:mark-dev'), 'node scripts/release-mark-dev.mjs');
+});
+
 test('the package checker can retain the tarball it verifies for publishing', () => {
   const gate = fs.readFileSync(path.join(repoRoot, 'scripts', 'check-package.ts'), 'utf8');
   assert.match(gate, /--pack-destination/);
 
@@ -27,6 +27,13 @@ export type CommandMetadata<Name extends string, Input> = {
   mcpDetail?: string;
   inputSchema: JsonSchema;
   readInput: (input: unknown) => Input;
+  /**
+   * Released input keys the command removed. Excluded from `inputSchema` (not
+   * advertised), but still recognized: `readInput` throws migration guidance
+   * when one is supplied. The MCP admission boundary reads this so it lets a
+   * retired key reach that message instead of rejecting it as unknown.
+   */
+  retiredInputKeys?: readonly string[];
 };
 
 export type ExecutableCommandContract<Name extends string, Input, Result> = CommandMetadata<
 
@@ -568,6 +568,11 @@ function requiredFieldNames(fields: CommandFieldMap): string[] {
   return Object.entries(fields).flatMap(([key, field]) => (field.required ? [key] : []));
 }
 
+/** Names of the retired fields — declared for migration guidance, absent from the schema. */
+export function retiredFieldNames(fields: CommandFieldMap): string[] {
+  return Object.entries(fields).flatMap(([key, field]) => (field.retired ? [key] : []));
+}
+
 function optionalRecord(
   record: Record<string, unknown>,
   key: string,
 
@@ -1,5 +1,10 @@
 import { defineCommandMetadata } from './command-contract.ts';
-import { fieldsInputSchema, readFieldInput, type CommandFieldMap } from './command-input.ts';
+import {
+  fieldsInputSchema,
+  readFieldInput,
+  retiredFieldNames,
+  type CommandFieldMap,
+} from './command-input.ts';
 
 export function defineFieldCommandMetadata<
   const TName extends string,
@@ -10,5 +15,6 @@ export function defineFieldCommandMetadata<
     description,
     inputSchema: fieldsInputSchema(fields),
     readInput: (input) => readFieldInput(input, fields),
+    retiredInputKeys: retiredFieldNames(fields),
   });
 }