Skip to content

Mobile companions: adb, expo and eas, installed on request - #62

Merged
ralyodio merged 1 commit into
masterfrom
worktree-mobile-clis
Sep 8, 2026
Merged

Mobile companions: adb, expo and eas, installed on request#62
ralyodio merged 1 commit into
masterfrom
worktree-mobile-clis

Conversation

@ralyodio

@ralyodio ralyodio commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

Adds adb (with fastboot), expo and eas to the companion set, and the two bits of machinery they needed.

A fourth install kind: archive

adb is not on npm. What is published under those names is either a Node reimplementation of the wire protocol (adbkit) or somebody's mirror of Google's zip, and a debugging bridge that gets a root shell on every attached device is the last thing to take from a mirror. Google publishes no installer either, only platform-tools-latest-<os>.zip.

So archive joins npm, script and go. scripts/install-archive.ts fetches the zip, unpacks it under vendor/platform-tools and links adb and fastboot — the arrangement install.sh already has with the Stripe CLI, moved somewhere cli-tools update can reach. The careful parts:

  • an adb already on PATH (apt's, or an Android Studio SDK's) is left alone; --force installs anyway and names what it is now competing with rather than claiming a takeover
  • a real file in the prefix is never overwritten, --force or not
  • staging happens inside vendor/ (a rename does not cross filesystems, and /tmp is a tmpfs here), and the tree is swapped in last, so a failed download leaves a working install where it was
  • there is no checksum to check — Google publishes none beside that alias — so the sha256 of what landed is printed instead of the silence
  • no Windows entry on purpose: this install is symlinks into a vendor directory. Android Studio's SDK Manager is the answer there.

Groups, because Expo is 500MB

expo (343MB) and eas-cli (165MB) on every box that runs curl | sh is exactly the surprise diskpush --cli-only exists to avoid. Companions can now name a group, and a grouped one is installed only when asked for:

cli-tools companions --install mobile     # adb, expo, eas
cli-tools companions --install eas        # or one by name
cli-tools companions --install all

update follows the same rule — it updates the mobile commands a box has and never adopts the ones it does not. link and install.sh name the group once rather than nagging.

Verified

  • archive install lands adb 1.0.41 / platform-tools 37.0.1 plus fastboot, is idempotent on a second run, steps aside for a foreign adb on PATH, and reports the shadowing under --force
  • expo --version → 57.0.22 and eas --version → 23.2.0 from a throwaway global prefix
  • 834 tests pass; the three tsc errors in src/argontv.ts and src/free-names.ts are pre-existing and untouched

The npm-companion test insisting on a scoped package is relaxed: that held only while every npm companion was ours or Bitwarden's.

Deliberately not included, and documented as such in the README: scrcpy (a distro package), the Android cmdline-tools that carry sdkmanager and the emulator (JDK plus a licence-acceptance flow — Android Studio's job), and Maestro (a bash installer that appends to your shell rc files and needs Java).

🤖 Generated with Claude Code

https://claude.ai/code/session_01RsvBXsJ6X3KU6bfC5H4m9J

`adb` forces a fourth kind of companion install. It is not on npm -- what is
published under those names is either a Node reimplementation of the wire
protocol or somebody's mirror of Google's zip, and a debugging bridge that gets
a root shell on every attached device is the last thing to take from a mirror.
Google publishes no installer either, only platform-tools-latest-<os>.zip. So
`archive` joins npm, script and go: scripts/install-archive.ts fetches it,
unpacks it under vendor/platform-tools and links `adb` and `fastboot`, which is
the arrangement install.sh already has with the Stripe CLI moved somewhere
`cli-tools update` can reach. An adb already on PATH is left alone rather than
shadowed, a real file in the prefix is never overwritten, and the unpacked tree
is swapped in at the end so a failed download leaves a working install alone.
There is no checksum to check -- Google publishes none beside that alias -- so
the sha256 of what landed is printed instead of the silence.

`expo` and `eas` are why companions now have groups. Between them they are
about half a gigabyte, and a web server has no use for either, so installing
them because somebody ran the installer is exactly the surprise `diskpush
--cli-only` exists to avoid. Grouped companions are installed when asked for --
`cli-tools companions --install mobile`, or a name, or `all` -- and `update`
follows the same rule: it updates the mobile commands a box has and never
adopts the ones it does not. `link` and install.sh name the group once rather
than nagging.

Verified end to end: the archive install lands adb 1.0.41 and fastboot from
platform-tools 37.0.1, is idempotent on a second run, and steps aside for a
foreign adb on PATH; expo 57.0.22 and eas-cli 23.2.0 both give working global
binaries. The npm-companion test insisting on a scoped package is relaxed --
that held only while every one was ours or Bitwarden's.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RsvBXsJ6X3KU6bfC5H4m9J
@github-actions

github-actions Bot commented Sep 8, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

12 finding(s)

HIGH/CRITICAL: 4 | MEDIUM: 4 | LOW: 4

Severity Rule Location
HIGH sh-remote-script-execution root-ubuntu.sh:3227
HIGH sh-remote-script-execution root-ubuntu.sh:3228
HIGH sh-remote-script-execution root-ubuntu.sh:4840
HIGH sh-remote-script-execution root-ubuntu.sh:4844
MEDIUM sh-remote-script-execution root-ubuntu.sh:4993
MEDIUM sh-remote-script-execution root-ubuntu.sh:6055
MEDIUM redos-nested-quantifier src/domain-free.ts:56
MEDIUM redos-nested-quantifier src/mail.ts:1042
LOW secret-generic-credential src/credentials.ts:36
LOW secret-generic-api-key test/credentials.test.ts:208
LOW secret-generic-credential test/mail.test.ts:135
LOW secret-generic-credential test/shorten.test.ts:36

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 9d9ba62 into master Sep 8, 2026
5 checks passed
@ralyodio ralyodio mentioned this pull request Sep 9, 2026
ralyodio added a commit that referenced this pull request Sep 9, 2026
Four changes since v0.29.0, three of which have been sitting on master
unreleased:

- argontv: the shared line, and whether there is room to sell (#61)
- mobile companions: adb, expo and eas, installed on request (#62)
- telnyx, because a number bought by clicking is not reproducible (#63)
- agenticjobs: the job board, as a command on every box (#64)


Claude-Session: https://claude.ai/code/session_01WxWrsbLuaSaZqQ7FFTrdVW

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant