Fix ios tests

.github/workflows/ci.yml

@@ -177,7 +177,7 @@ jobs:
 
       - name: Swift tests
         working-directory: packages/nativescript-wasm3/platforms/ios/NSCWasm3
-        run: swift test
+        run: swift test --disable-sandbox
 
       - name: Build for iOS device
         working-directory: packages/nativescript-wasm3/platforms/ios/NSCWasm3
@@ -210,6 +210,13 @@ jobs:
           java-version: '21'
 
       - uses: gradle/actions/setup-gradle@v4.4.4
+        with:
+          # The built-in wrapper validation scans the entire workspace and
+          # flags every gradle-wrapper.jar it finds — including the one
+          # bundled inside node_modules/nativescript. That jar is an npm
+          # package dependency, not ours to validate. Our own wrapper is
+          # committed in the repo at platforms/android/wasm3-android/.
+          validate-wrappers: false
 
       # GitHub's ubuntu-latest runner ships clang; the slim act image does not.
       - name: Install build tools (if missing)

.github/workflows/code-review.yml

@@ -1,61 +1,64 @@
-name: DeepSeek CR
-
-# AI code review on pull requests via hustcer/deepseek-review.
-#
-# Setup: add a repository secret named CHAT_TOKEN with your DeepSeek API key
-# (Settings → Secrets and variables → Actions). Optionally override the model
-# or base-url with the `with:` inputs below (e.g. a SiliconFlow / GitHub Models
-# endpoint — see https://github.com/hustcer/deepseek-review for options).
-#
-# Skip a review by adding "skip cr" / "skip review" to the PR title or body,
-# or lock the PR conversation.
-
-on:
-  pull_request_target:
-    types:
-      - opened # Triggers when a PR is opened
-      - reopened # Triggers when a PR is reopened
-      - synchronize # Triggers when a commit is pushed to the PR
-  issue_comment:
-    types:
-      - created # Triggers when a comment is created on a PR (watch-mention)
-
-permissions:
-  pull-requests: write
-
-jobs:
-  setup-deepseek-review:
-    timeout-minutes: 30
-    runs-on: ubuntu-latest
-    name: DeepSeek Code Review
-    steps:
-      - name: DeepSeek Code Review
-        uses: hustcer/deepseek-review@v1
-        with:
-          chat-token: ${{ secrets.CHAT_TOKEN }}
-          # A prompt tuned to this monorepo: NativeScript plugin (TypeScript +
-          # Kotlin/Swift), a Rust wasm fixture, and an Nx workspace.
-          sys-prompt: |
-            You are a senior code reviewer for a NativeScript monorepo built
-            with Nx. The codebase spans: a TypeScript NativeScript plugin
-            (packages/nativescript-wasm3) that bridges WebAssembly (wasm3) to
-            iOS (Swift) and Android (Kotlin + JavaCPP JNI); a Rust wasm-pack
-            fixture crate (packages/nativescript-wasm-fixture); and a
-            NativeScript test app (apps/nativescript-wasm-test) running mocha
-            on device/emulator.
-
-            Review the diff for: correctness across the JS↔native wire
-            protocol (i64 must stay lossless as decimal strings, signed Java
-            byte[] handling, NSArray/NSData marshalling), memory safety in
-            wasm3 C interop, resource leaks (native runtimes must be
-            disposed/closed), TypeScript strictness, Rust unsafe usage, CI
-            workflow correctness, and test coverage. Flag security issues
-            (injection, secrets, unsafe FFI) first. Be concise; list concrete
-            problems with file:line references and actionable fixes.
-          # DeepSeek's own API is the default; uncomment to switch provider:
-          # model: deepseek-v4-flash
-          # base-url: https://api.deepseek.com
-          # exclude-patterns: pnpm-lock.yaml,package-lock.json,*.lock
-          # Trigger a review by commenting "@github-actions" on the PR
-          # (requires the issue_comment event above):
-          # watch-mention: "@github-actions"
+name: DeepSeek CR
+
+# AI code review on pull requests via hustcer/deepseek-review.
+#
+# Setup: add a repository secret named CHAT_TOKEN with your DeepSeek API key
+# (Settings → Secrets and variables → Actions). Optionally override the model
+# or base-url with the `with:` inputs below (e.g. a SiliconFlow / GitHub Models
+# endpoint — see https://github.com/hustcer/deepseek-review for options).
+#
+# Skip a review by adding "skip cr" / "skip review" to the PR title or body,
+# or lock the PR conversation.
+
+on:
+  # Disabled — change to workflow_dispatch to run manually.
+  # Previously: pull_request_target + issue_comment triggers.
+  workflow_dispatch:
+  # pull_request_target:
+  #   types:
+  #     - opened # Triggers when a PR is opened
+  #     - reopened # Triggers when a PR is reopened
+  #     - synchronize # Triggers when a commit is pushed to the PR
+  # issue_comment:
+  #   types:
+  #     - created # Triggers when a comment is created on a PR (watch-mention)
+
+permissions:
+  pull-requests: write
+
+jobs:
+  setup-deepseek-review:
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    name: DeepSeek Code Review
+    steps:
+      - name: DeepSeek Code Review
+        uses: hustcer/deepseek-review@v1
+        with:
+          chat-token: ${{ secrets.CHAT_TOKEN }}
+          # A prompt tuned to this monorepo: NativeScript plugin (TypeScript +
+          # Kotlin/Swift), a Rust wasm fixture, and an Nx workspace.
+          sys-prompt: |
+            You are a senior code reviewer for a NativeScript monorepo built
+            with Nx. The codebase spans: a TypeScript NativeScript plugin
+            (packages/nativescript-wasm3) that bridges WebAssembly (wasm3) to
+            iOS (Swift) and Android (Kotlin + JavaCPP JNI); a Rust wasm-pack
+            fixture crate (packages/nativescript-wasm-fixture); and a
+            NativeScript test app (apps/nativescript-wasm-test) running mocha
+            on device/emulator.
+
+            Review the diff for: correctness across the JS↔native wire
+            protocol (i64 must stay lossless as decimal strings, signed Java
+            byte[] handling, NSArray/NSData marshalling), memory safety in
+            wasm3 C interop, resource leaks (native runtimes must be
+            disposed/closed), TypeScript strictness, Rust unsafe usage, CI
+            workflow correctness, and test coverage. Flag security issues
+            (injection, secrets, unsafe FFI) first. Be concise; list concrete
+            problems with file:line references and actionable fixes.
+          # DeepSeek's own API is the default; uncomment to switch provider:
+          # model: deepseek-v4-flash
+          # base-url: https://api.deepseek.com
+          # exclude-patterns: pnpm-lock.yaml,package-lock.json,*.lock
+          # Trigger a review by commenting "@github-actions" on the PR
+          # (requires the issue_comment event above):
+          # watch-mention: "@github-actions"

.tool-versions

@@ -0,0 +1,18 @@
+# ── Runtimes ────────────────────────────────────────────────────────────────
+# Install the plugins once:
+#   asdf plugin add nodejs
+#   asdf plugin add java
+#   asdf plugin add gradle
+
+nodejs      24.18.1
+java        temurin-21.0.2
+gradle      9.6.1
+
+# ── Version policy ──────────────────────────────────────────────────────────
+# nodejs  – CI uses node-version: 24 (actions/setup-node@v5)
+# java    – CI uses java-version: '21', distribution: temurin
+# gradle  – wrapper at packages/nativescript-wasm3/platforms/android/
+#           wasm3-android/gradle/wrapper/gradle-wrapper.properties → 9.6.1
+#
+# Swift 6.3+ and Xcode 16+ are managed by macOS / Xcode.app, not asdf.
+# Kotlin 2.4.x and Android NDK 29 are pulled by the Gradle project.

AGENTS.md

@@ -29,6 +29,11 @@
 - MCP server: https://docs.nativescript.org/mcp
 - Verify current API signatures via the API reference before writing code:
   https://docs.nativescript.org/api/
+- The `ns` CLI is installed locally as a devDependency. Always run it with
+  `npx ns` (not a bare `ns`), e.g. `npx ns test ios --emulator`.
+  `npx ns` automatically resolves to the project-local `node_modules/.bin/ns`
+  and never hits a broken global install or macOS permission walls on
+  `~/.local/share/.nativescript-cli`.
 
 <!-- code-review-graph MCP tools -->
 ## MCP Tools: code-review-graph

apps/nativescript-wasm-test/AGENTS.md

@@ -152,22 +152,29 @@ must have run before the app is bundled. Both `ns test` targets declare
 
 ## Running the tests
 
+The `ns` CLI is a local devDependency — always invoke it with `npx ns` so it
+resolves to `node_modules/.bin/ns` and never hits macOS permission issues on
+`~/.local/share/.nativescript-cli`.
+
 From the workspace root:
 
 ```bash
+# Via Nx (preferred — auto-builds dependencies)
 npm exec nx run nativescript-wasm-test:test.ios
 npm exec nx run nativescript-wasm-test:test.android
 npm exec nx run nativescript-wasm-test:typecheck
-```
 
-or from this directory, `npm run test.ios` / `npm run test.android`.
+# Or with the CLI directly (from this directory)
+npx ns test ios --emulator
+npx ns test android --emulator
+```
 
 Both target a simulator/emulator via `--emulator`. To pin a specific one, run the
 CLI directly with `--device <id>` — `--device` and `--emulator` are mutually
 exclusive:
 
 ```bash
-ns test ios --device 73F3C71E-982C-4C2A-9AE3-CE75BC8FA2A2
+npx ns test ios --device 73F3C71E-982C-4C2A-9AE3-CE75BC8FA2A2
 ```
 
 ### Gotchas

apps/nativescript-wasm-test/package.json

@@ -23,7 +23,7 @@
     "@nativescript/webpack": "~5.0.25",
     "@types/chai": "^4.3.20",
     "@types/karma-chai": "0.1.8",
-    "@types/mocha": "10.0.10",
+    "@types/mocha": "^10.0.10",
     "chai": "^4.5.0",
     "karma": "6.4.4",
     "karma-chai": "0.1.0",