v1.1.0

New

• NativeScript support (#11 by @NathanWalker, with #17 and #20). Routes are read from Angular Router, Core XML pages, and Octane, React, Vue, Svelte and Solid apps. Deep links come from routes.links in .screenmap/config.json. A NativeScript build runs with no Metro and no dev client: build it with ns build and pass it as app_path. See the README's "NativeScript apps" section.
• bun projects install with bun install --frozen-lockfile. The Action sets up bun when the runner has none (#18).
• waits.relaunch sets the wait after an app relaunch (default 4000 ms), for dev clients that load their bundle slowly (#19).
• agent_cli_version input overrides the pinned agent CLI version (#24).
• Monorepos (#15):
  • Changed files are matched project-relative, so suspects work with project: apps/mobile.
  • Dependencies install from the nearest directory with a lockfile, up to the repo root.
  • A UDID in SCREENMAP_DEVICE_IOS (or device) pins the simulator.

Security

• PR titles, branch names and step outputs reach the Action's shell steps through env:, never pasted into scripts. Bundle file names are sanitised, and URL schemes are validated (#21).
• The agent runs with an allowlisted environment: only its own API key, never GH_TOKEN, EXPO_TOKEN or runner tokens (#24).
• Agent CLIs, eas-cli and oven-sh/setup-bun are pinned to exact versions (#24).
• Route parsing skips files over 1 MB, and the NativeScript parser can no longer be made to hang by a crafted repo (#20, #21).
• The README has a new Security section. Run on pull_request, never pull_request_target.

Behaviour changes

• opencode gets its key only through the variable named in agent.keyEnv. Set it if you use agent_provider: opencode.
• Other provider settings beyond the key no longer reach the agent, such as ANTHROPIC_BASE_URL, Bedrock or Vertex credentials, and proxy variables.
• A URL scheme that isn't a valid RFC 3986 scheme is ignored, so an Expo baseline then fails with "no deep-link scheme".
• A PR run that can't diff against its base commit now fails with "cannot determine changed files" instead of reporting no changes.

Fixes

• The viewer no longer crashes on nodes with urlPath: null, and the static map renders v2 flow sidecars (#14).

Validated on CI before release: the baseline and PR lanes passed on aleqsio/expo-map-sample (Expo, EAS lane) and aleqsio/nativescript-map-sample (NativeScript, app_path).