Skip to content

v0.3.7

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Aug 13:10
· 9 commits to main since this release
v0.3.7
5048add

Trusted input on real devices, a class of silent asset-loading failures fixed, and a security update.

✨ Features

  • Trusted input on physical devices. Agent-driven taps, drags and typing on a connected device can now be real OS-level events (isTrusted) rather than synthetic ones, so anything gated on trusted input — native gestures, some framework handlers — behaves exactly as it does under a human finger.
    • Android needs only adb and a debuggable WebView (true of debug builds), and gets the trusted path out of the box.
    • iOS goes through WebDriverAgent, which is provisioned as a Build Support item: it is not bundled in the app — it is fetched from a pinned source and compiled + code-signed on your machine, so it needs Xcode and an Apple team. It also auto-installs only when it can actually succeed, rather than failing halfway.
    • Without either, device input still works. Synthetic input remains the fallback everywhere, now fronted by a banner naming the cause and the consequence — as a prefix, not a trailing marker that was easy to skim past. Nothing silently degrades.
    • Two gestures have no trusted form and say so instead of pretending: hover (a touchscreen has no hover state) and scroll (it could only be a touch drag, which on a game canvas is a real gameplay gesture).
  • iOS out-of-app screenshots. Capture works outside the app's own webview, so system UI and out-of-app states are visible.

🐛 Fixes

  • A missing asset no longer reads as a corrupt one. A dev server answers a missing file with 200 OK and an HTML error page; the loaders parsed that as content and reported a corrupt scene, sending you after the wrong bug. Fixed for scenes and for the seven other asset fetches that had the same hole (#91).
  • Security: uuid bumped to ^11.1.1 — GHSA-w5hq-g745-h8pq (CVE-2026-41907).
  • Native builds no longer ship stale plugin code. Engine Capacitor plugins are re-vendored on every native build, with a guard against a stale tarball — previously a build could succeed and silently install the previous native code (#90).
  • The debug bridge releases port 9095 when the app is backgrounded, so the foreground app owns it (#95).
  • Synthetic input hit-tests its target canvas instead of assuming it (#93).

📝 Other notable

  • Windows and e2e now run on every push via the free public runner, alongside a DMG + Windows installer build — coverage that had been off for cost reasons.
  • Publishing hardening. The OSS snapshot no longer ships device identifiers or LFS pointer stubs, and it now carries line-ending pins (without them, Windows saw every generated file as stale).
  • modoki-engine.com moved to a Cloudflare Worker, retiring the GCP load balancer.

Editor-only release: no engine API changes. Existing installs will pick this up through the in-app updater.

Full Changelog: v0.3.6...v0.3.7

Assets 9
Loading