e2e Files

Patch Changes

• #711 a3da00d Thanks @okwasniewski! - device.installApp() no longer pins the build's file path as the app when agent-device reports no bundle id or package for it, which on Android made app.open() fail with "Android runtime hints require an installed package name". It fails at the install with ENGINE_FAILURE naming app.bundleId or installApp's app option; the mobile docs' Troubleshooting covers the Android cause (agent-device 0.21.18 reads an aapt2-built APK's package only through the SDK's aapt, which it does not find in the macOS default SDK location, or when the install added the package). app.open() on a device now keeps the engine's own reason it cannot launch, such as a build not installed yet with device.installApp(), instead of a generic "pin one with app.bundleId or app.appPath".

• #791 b3e1fd1 Thanks @DimaMishchenko! - Update agent-device to 0.21.20 so sibling-sized iOS toolbar containers no longer falsely mark nearby controls as covered.

• #801 ae3dc64 Thanks @thymikee! - Recognize agent-device's stale-ref refusals by their details.reason instead of matching their message, so a reworded message in a later agent-device release cannot turn a stale ref into an engine failure. Every ref-frame reason agent-device 0.21.20 sends is covered, including the three whose messages the old pattern did not match.

• #722 f0f9c8d Thanks @okwasniewski! - Explicit navigation now uses an allowlist instead of a denylist: app.open, browser.goto, and the agent's navigate verb admit http:, https:, and the exact about:blank, and every other scheme (chrome:, blob:, about:srcdoc, ...) is POLICY_DENIED. A wrapped scheme such as view-source:file:///... no longer loads a local file; it is POLICY_DENIED like file: itself. device.openLink and device.openApp also refuse view-source:, blob:, and filesystem: links. browser.setCookies refuses an about:blank cookie URL with POLICY_DENIED.

• #793 4db7d6d Thanks @DeryFerd! - device.openLink no longer echoes the string it refused in its INVALID_ARGUMENT message. A malformed link can carry a magic-link token in its query, path, or userinfo, so the message names no part of the input, matching what device.openApp already does.