Merge remote-tracking branch 'origin/main' into claude/review-issues-1431-1429-xpehmi

Author: claude

package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-device",
-  "version": "0.20.6",
+  "version": "0.20.7",
   "description": "Agent-native CLI for AI app automation across iOS, Android, tvOS, Android TV, macOS, Linux, and web.",
   "mcpName": "io.github.callstack/agent-device",
   "license": "MIT",

scripts/check-package.ts

@@ -52,6 +52,7 @@ const consumerDir = path.join(workDir, 'consumer');
 function run(command: string, args: string[], cwd: string): string {
   return execFileSync(command, args, {
     cwd,
+    env: { ...process.env, AGENT_DEVICE_NO_UPDATE_NOTIFIER: '1' },
     encoding: 'utf8',
     maxBuffer: 64 * 1024 * 1024,
     stdio: ['ignore', 'pipe', 'inherit'],
@@ -148,8 +149,10 @@ if (failures.length > 0) {
  * `devices` and `doctor --remote` are the cheapest commands that load the daemon bundle and the
  * remote-config graph — the lazily imported halves of the CLI that no `--version` or `help` run
  * reaches, and where the 0.20.4 unresolved import actually surfaced. Every command is device-free and
- * offline. `--state-dir` keeps the daemon they start out of the developer's `~/.agent-device`, and
- * `daemon stop` leaves nothing running behind the check.
+ * offline. The subprocess environment disables the detached update notifier so the non-JSON
+ * `daemon stop` probe cannot recreate files while the temporary consumer is being removed.
+ * `--state-dir` keeps the daemon they start out of the developer's `~/.agent-device`, and `daemon
+ * stop` leaves nothing running behind the check.
  */
 function smokeTestBin(installedRoot: string, manifest: PackedManifest): void {
   const binPath = path.join(installedRoot, manifest.bin['agent-device']!);

server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/callstack/agent-device",
     "source": "github"
   },
-  "version": "0.20.6",
+  "version": "0.20.7",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "agent-device",
-      "version": "0.20.6",
+      "version": "0.20.7",
       "transport": {
         "type": "stdio"
       }

src/__tests__/npm-package-scripts.test.ts

@@ -101,6 +101,11 @@ test('the package gate runs the closure audit and both runtime probes', () => {
   }
 });
 
+test('the package gate disables the detached update notifier for its smoke probes', () => {
+  const gate = fs.readFileSync(path.join(repoRoot, 'scripts', 'check-package.ts'), 'utf8');
+  assert.match(gate, /env: \{ \.\.\.process\.env, AGENT_DEVICE_NO_UPDATE_NOTIFIER: '1' \}/);
+});
+
 // The gate reads the packed tarball, so `prepack` is the last point where a broken package can still
 // be stopped. Publishing runs it; nothing else guarantees the tarball is ever verified.
 test('publishing cannot skip the package gate', () => {