Release v1.5.1 — Community bug-fix roundup (Windows, foldables, path traversal) · ghost-in-the-droid/android-agent

A community-driven maintenance release. Every fix in this release came from an external contributor. 🙏

🛡️ Security

CWE-22 path traversal hardened in test-recording endpoints (#31 by @sebastiondev). Severity: moderate. No known exploitation. Recommend upgrading.

All from a first-time contributor, @aaratisharma-star, in a single well-scoped PR (#32):

Windows boot fix — gitd/bots/common/ios.py couldn't import on Windows because fcntl is POSIX-only. Guarded import + no-op flock on nt. Server now starts on Windows.
Foldable screencap fix — on multi-display Android devices (Fold/Flip series, some tablets), adb exec-out screencap -p prepends a [Warning] Multiple displays were found... line to stdout, corrupting naive PNG reads. Now trimming to the PNG signature.
Vite dev-proxy port fix — frontend/vite.config.ts had 5056; backend defaults to 5055. Frontend dev proxy now hits the right port out of the box.
Pillow explicit dep — was implicit transitive; now declared.

mcp<2.0 pin (#36) — mcp 2.0.0 (released between v1.5.0 and today) removed the mcp.server.fastmcp import path. Pinned dep so pip install resolves to a compatible version. Proper migration to mcp 2.x is on the v1.6.0 roadmap.

pip install -U ghost-in-the-droid

Thanks to everyone who pushed patches this window. 🙏