[cryptotavares]

Summary: Upgrade @metamask/device-mcp to ^0.6.0. 0.6.0 gives correct iOS trees (nested idb format) and fast, correct Android snapshots on busy screens (signed helper first). #44 and #67 were measured with these changes.

Stack context: mm CLI v2, Phase 1, P1-30. Base: #68, the top of the stack; review that first.

Problem

Core pins @metamask/device-mcp ^0.5.0 (#58). On 0.x a caret range does not pick up 0.6.0. Without 0.6.0:

• iOS: device-mcp cannot read the nested idb ui describe-all format, so the element tree loses its hierarchy (device-mcp#38).
• Android: snapshots start with uiautomator dump. On busy screens this waits about 11 s for an idle state, then fails with "could not get idle state" (device-mcp#39).

#44 (flat mobile tree) and #67 (mobile snapshot filtering) were measured against yalc builds of those two device-mcp PRs.

Solution

Adopt the device-mcp 0.6.0 release through the dependency range and the lockfile. Add one README sentence about the new Android helper install.

flowchart TD
    A[Mobile describe / observation] --> B[Core MobilePlatformDriver]
    B --> C{device-mcp 0.6.0 snapshot}
    C -->|iOS| D[idb describe-all, nested format read]
    C -->|Android default helper-first| E[Signed helper APK, no idle wait]
    E -->|non-trust failure| F[1 uiautomator dump attempt]
    D --> G[Core flat tree, refs, testIds]
    E --> G
    F --> G

    classDef new fill:#fff3cd,stroke:#d39e00
    class D,E,F new

Loading

Yellow boxes are new in 0.6.0.

What changes

Boundary	Before	After
package.json dependency range	@metamask/device-mcp ^0.5.0	^0.6.0
yarn.lock resolution	npm 0.5.0	npm 0.6.0 (dependencies unchanged)
Android snapshot on the consumer's ADB backend	uiautomator dump first	Signed test-only helper first, installed on first use. DEVICE_MCP_ADB_SNAPSHOT=dump restores the old path
README.md	No mention of the helper	One sentence: helper install, first snapshot slower, how to opt out

Decisions for reviewers

Decision	Reason
New PR on top of the stack instead of amending #58	Amending #58 would rebase the whole stack again. 0.6.0 was not released when the stack was built.
chore:, not breaking	Every symbol core imports from device-mcp is unchanged. SnapshotResult only gains optional fields (source, captureMs), and core reads only hierarchy. The new Android default is a dependency runtime change on the consumer's backend, not a change to core's API.
Core does not set snapshotMode	The consumer creates the DeviceBackend (Mobile uses AdbBackend directly). Core only documents the default and the opt-out.

Review guide

#	File	What to check
1	package.json	The production dependency range is ^0.6.0.
2	yarn.lock	Only the device-mcp entry and the workspace range change.
3	README.md	The helper sentence in the mobile snapshot paragraph.

Testing

Unit and lint (at afaf75c, device-mcp 0.6.0 from npm, no yalc): yarn build OK, yarn test 51 files / 1793 tests pass, yarn lint passes (including the dedupe and constraints checks).

Device proof: Mobile with this branch's core (yalc) and device-mcp 0.6.0 from npm (no yalc device-mcp). Real-funds wallets; only read actions, tab bar Home/Explore, account list open/back and settings list (no row opened).

Check	Extension	iOS	Android
Smoke: launch, unlock, describe, list-testids, get-state, cdp, screenshot	PASS	PASS	PASS
A timed-out click does not block the next call; click by ref after it	n/a	PASS	PASS
Two describes give identical refs	n/a	67 / 67	242 / 242
Unchanged screen diff	n/a	+0 −0	+0 −0
Ref from the latest describe clicks the intended element	n/a	PASS	PASS

Node counts are identical to the yalc device-mcp measurements used for #44 (measure-tree.sh):

Screen	iOS nodes	Android nodes
Wallet home	67 → 67	242 → 242
Account list	35 → 35	33 → 33
Settings	26 → 26	65 → 65

Android helper path: the emulator had helper 0.5.0. On the first snapshot, device-mcp 0.6.0 installed its bundled, signed 0.6.0 helper, and the signer check passed. During the smoke run, logcat shows 106 helper runs and 0 uiautomator runs.

Known and unchanged: on Android, 3 of 4 navigation observations still show the previous screen (same as before this bump). That is tracked separately.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​metamask/​device-mcp@​0.5.0 ⏵ 0.6.0	-14			+1

View full report