Merge pull request #150 from Lykhoyda/fix/issue-91-mutation-absence-config-override

fix(gh-91): per-project verification config override + hot-path memoization

Author: Lykhoyda

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "rn-dev-agent",
       "description": "AI agent that fully tests React Native features on simulator/emulator — navigates the app, verifies UI, walks user flows, and confirms internal state.",
-      "version": "0.44.36",
+      "version": "0.44.37",
       "source": "./",
       "category": "mobile-development",
       "homepage": "https://github.com/Lykhoyda/rn-dev-agent"

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rn-dev-agent",
-  "version": "0.44.36",
+  "version": "0.44.37",
   "description": "AI agent that fully tests React Native features on simulator/emulator — navigates the app, verifies UI, walks user flows, and confirms internal state.",
   "author": {
     "name": "Anton Lykhoyda",

CHANGELOG.md

@@ -4,6 +4,41 @@ All notable changes to rn-dev-agent will be documented in this file.
 
 Format follows [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.44.37] — 2026-05-12
+
+### Added (GH #91 acceptance #3 closeout — per-project verification config)
+
+- **`verification.successShapes` and `verification.mutationMethods` per-project
+  overrides** in `.rn-agent/config.json` for the mutation-absence detector.
+  Closes the last open acceptance criterion on GH #91. Detector itself shipped
+  in `fed0dd0` (Apr 28).
+- New `loadVerificationConfig(projectRoot)` reads the config once per project
+  root and caches the result. Defaults are preserved (no behavior change) on
+  missing file, parse error, missing `verification` block, empty arrays, or
+  all-invalid regex strings — apps that don't opt in see zero change.
+- **ReDoS-via-typo guard** (Codex review conf 90): patterns longer than 200
+  chars are dropped before compilation, and matched-input length is capped
+  at 256 chars in `isSuccessShape`. Bounds regex evaluation cost on the
+  `cdp_navigate` / `cdp_navigation_state` / `proof_step` hot path so a
+  developer typo can't stall the MCP event loop.
+- **Empty-array means defaults**, not "disable detection" (Codex review conf
+  92). Silent loss of a safety net is the worse failure mode; explicit disable
+  is reserved for a future `verification.disable: true` flag.
+- **Observability**: one stderr log line on first config load per project root
+  (`[verification] loaded config from .../.rn-agent/config.json (patterns: N,
+  methods: M)`). Makes "is my config picked up?" a one-line check, without
+  needing SIGHUP/watcher reload machinery.
+- 18 new tests cover the loader, overrides, ReDoS guards, cache behavior, and
+  the observability log. Suite: 1312 → 1330 tests, all passing.
+
+### Notes
+
+- `device_press` / `cdp_interact` wirings remain **intentionally deferred** as
+  documented in the original `fed0dd0` commit message: these tools don't carry
+  nav-state intent, and the success-shape signal is captured downstream by the
+  next `cdp_navigation_state` call. Adding nav-state fetches per tap would
+  bloat the hot path for noise this PR considers low-value.
+
 ## [0.44.36] — 2026-05-12
 
 ### Fixed (Phase 134.2-followup — device_deeplink url injection)