[cryptotavares]

Description

Core pins @metamask/device-mcp ^0.4.2 (package.json:65). 0.4.2 opens the Hermes debugger WebSocket without an Origin header, and Metro rejects that with Connection from DevTools failed to be established for origin 'undefined'. device-mcp 0.5.0 sends an Origin derived from the target WebSocket URL (ws:→http:, loopback → 127.0.0.1, port kept). It also accepts an override (RunHermesCdpInput.origin / HERMES_CDP_ORIGIN).

• Bump @metamask/device-mcp to ^0.5.0 (lockfile resolves 0.5.0; yarn dedupe finds nothing to change).
• No code change: the device-mcp CHANGELOG lists only the Origin fix between 0.4.2 and 0.5.0, with no API or type changes.

Part of the mm CLI v2 effort: ticket P1-02 (Phase 1).
Stacked on #57 (review that first).

Breaking changes

None.

Consumer impact

Consumer	Change needed	Done on branch
Extension test/e2e/playwright/llm-workflow/	None (no Hermes)	n/a
Mobile tests/llm-workflow/	Bump @metamask/device-mcp to ^0.5.0. Also, the iOS JS liveness probe (ios/hermes-health.ts verifyJsLiveness) opened its own debugger WebSocket with no Origin, so Metro rejected it on every iOS launch and launch fell back to target-presence-only health. It now sends the same Origin as device-mcp.	cryptotavares/mm-cli-v2-mobile a4ee5a0de18

Proof

Tested with a yalc build of this branch (core 0.12.0+923eaf77, device-mcp 0.5.0 from npm) in the Extension (e2e test build 13.56.0, headless) and Mobile (dev client 8.19.0, iOS sim + Android emulator, Metro on 8085).

Check	Before (device-mcp 0.4.2)	After (0.5.0)
core yarn test / yarn lint with npm 0.5.0	n/a	pass / pass
iOS mm cdp Runtime.evaluate 1+1	"value": 2	"value": 2 (4 calls)
Android mm cdp Runtime.evaluate 1+1	"value": 2	"value": 2 (2 calls)
New Metro origin 'undefined' errors from mm cdp (iOS + Android)	n/a	0
New Metro errors per iOS mm launch (consumer liveness probe)	1 per app boot (7/7 boots in the Metro log)	0 (2/2 boots, with the consumer fix)
Extension smoke	all steps exit 0	all steps exit 0

The device-mcp path was isolated in a separate iOS session: the launch window logged 1 error (consumer probe), and 3 cdp calls logged 0.

Transcripts

# iOS, after the consumer fix
$ yarn mm launch --platform ios --device-id <sim> --metro-port 8085   -> exit 0
$ yarn mm cdp Runtime.evaluate '{"expression":"1+1","returnByValue":true}' --metro-port 8085
      "value": 2
new "origin 'undefined'" errors in the Metro log since launch: 0

# Metro log timeline (iOS boots)
 ...  iOS Bundled 905ms index.js (1 module)
3310: ERROR  Connection from DevTools failed to be established (origin undefined)   <- before fix
3444: iOS Bundled 39720ms index.js (1 module)                                          <- after fix: no error
3476: iOS Bundled 37442ms index.js (1 module)                                          <- after fix: no error

# Android
$ yarn mm cdp Runtime.evaluate '{"expression":"1+1","returnByValue":true}' --metro-port 8085
      "value": 2
new "origin 'undefined'" errors: 0 (361 new Metro lines)

Unit tests

 Test Files  49 passed (49)
      Tests  1639 passed (1639)
Type Errors  no errors
All files          |    96.4 |    91.64 |   94.71 |   96.64 |

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​metamask/​device-mcp@​0.4.2 ⏵ 0.5.0	-4		+1

View full report