Merge origin/main into codex/2198-runner-demand

Main moved the command descriptor registry into @agent-device/command-registry (#2348) and split
src/daemon/types.ts (#2346): the planned-operations module and its test follow the registry into
the package (exported as ./planned-operations), the executionPlan carrier moves to
daemon-request.ts, and the batch step context lands on the new BatchInvoke signature.

Author: thymikee

.fallowrc.json

@@ -256,7 +256,7 @@
     },
     {
       "comment": "Type-level `AssertTrue<...>` registry-totality guards. Exported only so `noUnusedLocals` keeps them alive; a consumer would defeat the point.",
-      "file": "{src/core/command-descriptor/registry.ts,src/core/interactors/register-builtins.ts,src/core/platform-descriptor/registry.ts,src/daemon/request-platform-providers.ts}",
+      "file": "{packages/command-registry/src/registry.ts,src/core/interactors/register-builtins.ts,src/core/platform-descriptor/registry.ts,src/daemon/request-platform-providers.ts}",
       "exports": [
         "CommandOwnerFileClaimsAreComplete",
         "BuiltinPluginsCoverAllPlatforms",

.github/actions/setup-fixture-app/action.yml

@@ -172,7 +172,10 @@ runs:
       run: |
         set -euo pipefail
         pnpm --dir examples/test-app exec expo prebuild --platform android --no-install
-        echo "org.gradle.jvmargs=-Xmx4g" >> examples/test-app/android/gradle.properties
+        # expo prebuild's generated gradle.properties has no trailing newline, so a bare
+        # `echo >>` corrupts its last line (e.g. `expo.inlineModules.watchedDirectories=[]org.gradle.jvmargs=...`),
+        # which fails Gradle's JSON.parse of that property at configure time. Lead with a newline.
+        printf '\n%s\n' 'org.gradle.jvmargs=-Xmx4g' >> examples/test-app/android/gradle.properties
         (
           cd examples/test-app/android
           ./gradlew :app:assembleRelease

.github/workflows/test-app-build-cache.yml

@@ -188,7 +188,10 @@ jobs:
         run: |
           set -euo pipefail
           pnpm --dir examples/test-app exec expo prebuild --platform android --no-install
-          echo "org.gradle.jvmargs=-Xmx4g" >> examples/test-app/android/gradle.properties
+          # expo prebuild's generated gradle.properties has no trailing newline, so a bare
+          # `echo >>` corrupts its last line (e.g. `expo.inlineModules.watchedDirectories=[]org.gradle.jvmargs=...`),
+          # which fails Gradle's JSON.parse of that property at configure time. Lead with a newline.
+          printf '\n%s\n' 'org.gradle.jvmargs=-Xmx4g' >> examples/test-app/android/gradle.properties
           (
             cd examples/test-app/android
             ./gradlew :app:assembleRelease

AGENTS.md

@@ -21,5 +21,5 @@
   // prior build, workspace link, or publish step. Running an example for real
   // still resolves `agent-device` as a self-referencing package (needs
   // `pnpm build`), matching how a real consumer would import it.
-  "include": [".", "../../src/global.d.ts"]
+  "include": [".", "../../packages/command-registry/src/global.d.ts"]
 }

CHANGELOG.md

@@ -20,6 +20,7 @@ module.exports = {
     buildCacheProvider: { plugin: 'expo-build-disk-cache' },
     plugins: [
       'expo-router',
+      'expo-secure-store',
       [
         'expo-audio',
         {

examples/sdk/tsconfig.json

@@ -20,6 +20,7 @@
     "expo-linking": "56.0.14",
     "expo-modules-core": "56.0.17",
     "expo-router": "~56.2.11",
+    "expo-secure-store": "~56.0.4",
     "expo-status-bar": "~56.0.4",
     "react": "19.2.3",
     "react-dom": "19.2.3",

examples/test-app/app.config.js

@@ -14,10 +14,17 @@ import {
 } from 'react-native';
 import { getRecordingPermissionsAsync, requestRecordingPermissionsAsync } from 'expo-audio';
 import { requireOptionalNativeModule } from 'expo-modules-core';
+import * as SecureStore from 'expo-secure-store';
 
 import { ActionButton, ScreenTitle, SectionCard } from '../components';
 import { useAppColors, type AppColors } from '../theme';
 
+// A fixed key/value pair standing in for a real login token: this screen only
+// needs to prove keychain-backed state survives `clear-app-state` but not
+// `reset-keychain`, not to model an actual auth flow.
+const KEYCHAIN_AUTH_KEY = 'automation-keychain-auth-token';
+const KEYCHAIN_AUTH_VALUE = 'demo-auth-token';
+
 type PushBroadcastLabModule = {
   lastPushBroadcast(): string;
 };
@@ -45,6 +52,7 @@ export function AutomationLabScreen(props: {
   const [microphonePermission, setMicrophonePermission] = useState('checking');
   const [lastPushBroadcast, setLastPushBroadcast] = useState('none');
   const [sheetVisible, setSheetVisible] = useState(false);
+  const [keychainAuthStatus, setKeychainAuthStatus] = useState('checking');
   const permissionReadGeneration = useRef(0);
   const windowMode = dimensions.width > dimensions.height ? 'landscape' : 'portrait';
 
@@ -125,6 +133,26 @@ export function AutomationLabScreen(props: {
     setLastPushBroadcast(pushBroadcastLab?.lastPushBroadcast() ?? 'unavailable');
   }
 
+  useEffect(() => {
+    let mounted = true;
+    void SecureStore.getItemAsync(KEYCHAIN_AUTH_KEY)
+      .then((value) => {
+        if (mounted)
+          setKeychainAuthStatus(value === KEYCHAIN_AUTH_VALUE ? 'signed-in' : 'signed-out');
+      })
+      .catch(() => {
+        if (mounted) setKeychainAuthStatus('error');
+      });
+    return () => {
+      mounted = false;
+    };
+  }, []);
+
+  async function signInWithKeychain() {
+    await SecureStore.setItemAsync(KEYCHAIN_AUTH_KEY, KEYCHAIN_AUTH_VALUE);
+    setKeychainAuthStatus('signed-in');
+  }
+
   return (
     <ScrollView contentContainerStyle={styles.content} showsVerticalScrollIndicator={false}>
       <ScreenTitle
@@ -235,6 +263,19 @@ export function AutomationLabScreen(props: {
         />
       </SectionCard>
 
+      <SectionCard title="Keychain-backed auth">
+        <ActionButton
+          label="Sign in (write keychain)"
+          onPress={() => void signInWithKeychain()}
+          testID="automation-keychain-signin"
+        />
+        <StateRow
+          label="Auth status"
+          testID="automation-keychain-status"
+          value={keychainAuthStatus}
+        />
+      </SectionCard>
+
       <SectionCard title="Android push broadcast">
         <ActionButton
           kind="secondary"