build(deps): bump io.github.oculix-org:oculixapi from 3.0.4 to 4.0.0 in /jvm-bridge

[dependabot]

Bumps io.github.oculix-org:oculixapi from 3.0.4 to 4.0.0.

Release notes

Sourced from io.github.oculix-org:oculixapi's releases.

OculiX 4.0.0

Major-version release — the API becomes a proper library (no bundled scripting runtime, no RunTime god-object), the reactor gets a shared in-JVM CVE injector, OCR gains a persistent lastSeen cache in the ×25-×150 range on repeated lookups, the SSH/VNC posture becomes a named consent instead of a compromise, and 22 IDE locales land with native reviews from the community.

Highlights

• RunTime dismantled, API demoted to a library — a 46-commit refactor finally kills the ~2200-line org.sikuli.script.support.RunTime god-object after 15 years of accretion. The entire scripting runtime (Runner, JythonSupport, JRubySupport, SikulixForJython, Sikulix launcher) moves from API into IDE, so nothing running against oculixapi on the classpath can accidentally boot an IDE any more.

• ×25-×150 speedup on repeated OCR lookups — the new TesseractLastSeen persistent cache mirrors #353's image lastSeen PNG-chunk trick on the text side: eight consecutive findText("Espagne") on Notepad drop from 48 s to <400 ms after warm-up, full-screen findText from >1 s cold to <50 ms warm, with per-resolution safety and atomic writes so a crash never leaves corrupt JSON.

• Cross-distribution SSH/VNC posture — RemoteMode gives the AppLauncher an explicit named consent (CONFIDENTIAL default = sshpass -e + strict host-key check; YOLO = single-operator lab targets), while DependencyManagementInjector pins Bouncy Castle 1.84 across all four standalone artifacts (oculixapi, oculixide, oculix-mcp, oculix-reporter) in one place, killing four Jython-transitive GHSAs without introducing a parent pom.

• i18n foundation on 22 locales with native reviews — Google-Translate-seeded pipeline (scripts/translate-bundles.py, sentinels for placeholders and brand tokens) plus a merge-staging-to-live.py that never overwrites native work; native passes landed for zh_TW, zh_CN, pt_BR, it, uk, de in this cycle, with LanguagePicker in the sidebar and OculixFonts falling back on non-Latin locales so glyphs stop rendering as tofu boxes.

What's new for users

New features

• 🤖 Android/ADB overhaul — we closed the epic #297 backlog (four bugs: inputKeyEvent format-string crash #293, swipe ignoring durationMs #294, missing dragAndDrop overload #295, eager OpenCV load moved to lazy captureDeviceScreenMat #296) and rebuilt ADBClient's adb binary resolution holistically — system PATH, then ANDROID_HOME/ANDROID_SDK_ROOT/platform-tools, then per-OS install paths (~/Library/Android/sdk, ~/Android/Sdk, %LOCALAPPDATA%/Android/Sdk, /opt/homebrew/bin, …), so the headless -r Jython mode no longer needs a hardcoded path.

  On top of that:

  • serial-based device selection (getDeviceBySerial / initBySerial / startBySerial) honoring the #229 API
  • multi-session support via lazy jadb connect so new ADBScreen(0) / new ADBScreen(1) can drive two devices from one process
  • wakeUp() decoupled from dumpsys power (idempotent KEYCODE_WAKEUP — no more 4 dumpsys probes on the hot path)
  • getDisplayDimension() now reads adb shell wm size (the stable Physical size: WxH contract) with the old dumpsys display parse kept only as a fallback — so LDPlayer / BlueStacks emulators and non-stock ROMs stop returning null on ADBScreen.start() (#229)

  Validated end-to-end on a real Samsung Galaxy S20 FE (Android 13, One UI 5) over ADB WiFi. (#297 #293 #294 #295 #296 #229)

• 📦 File > Export sub-menu revived (.zip / .jar / runnable .jar) — SikuliX's original "pack compiled Jython into a runnable jar" flow (java -jar oculix.jar -r script.jar) still worked in OculiX but had been dormant since the menu cleanup — the FileAction.ASJAR / ASRUNJAR methods lived on with no menu entry to reach them (confirmed in #393).

  We split File > Export into a proper sub-menu (As .zip / As .jar script library / As runnable .jar) and wired the sidebar's Export button through the same handler, so the runnable-jar path is discoverable again. Sidebar was fully invisible for jar export since the Phase 1b migration, which meant the revived feature was reachable by no one.

  Under the hood:

  • exportAsJar() was still reading EditorPane.editorPaneFile, a field left null-initialised since the PaneContext refactor — rewritten to speak PaneContext (temp/non-bundle scripts get a polite popup instead of an NPE, saved bundles get a compiled _sikuli.jar).
  • Fixed a stale prolog import (org.sikuli.script.SikulixForJython → org.sikuli.support.SikulixForJython) that would have made every exported runnable jar die at runtime with ImportError: No module named org.sikuli.script.
  • makeScriptjar tightened to actually pack compiled .py bytecode.

  The menuFileExport i18n key is dropped in favour of EN-only inline labels across all 22 active locales (three sibling menu entries in EN keep the JMenu definition in sync without stale RU / BG / AR translations). (#392 #393)

• 🤖 MCP surface grows from 9 to 13 tools + locale-aware OCR + tolerant waitForStable — we added four new MCP tools so an LLM agent can drive a real UI in one round-trip per intent instead of orchestrating find-then-act loops client-side:

  • oculix_click_at_point — raw x,y click
  • oculix_click_text — OCR find + click, returns the bounding box so the caller can verify which match was hit when the text repeats
  • oculix_scroll
  • oculix_wait_for_stable — a server-side page-settle observer that polls a region and returns stable=true once the byte delta stays under min_pixel_delta for settle_window_ms continuous (defaults tuned for a Chrome half-pane: 800 ms window, 5000-byte threshold, 150 ms poll, 10 s timeout), replacing the arbitrary Bash sleeps agents used to stitch between steps.

... (truncated)

Changelog

Sourced from io.github.oculix-org:oculixapi's changelog.

[v4.0.0] - 2026-07-01

Major-version release — the API becomes a proper library (no bundled scripting runtime, no RunTime god-object), the reactor gets a shared in-JVM CVE injector, OCR gains a persistent lastSeen cache in the ×25-×150 range on repeated lookups, the SSH/VNC posture becomes a named consent instead of a compromise, and 22 IDE locales land with native reviews from the community.

Highlights

• RunTime dismantled, API demoted to a library — a 46-commit refactor finally kills the ~2200-line org.sikuli.script.support.RunTime god-object after 15 years of accretion. The entire scripting runtime (Runner, JythonSupport, JRubySupport, SikulixForJython, Sikulix launcher) moves from API into IDE, so nothing running against oculixapi on the classpath can accidentally boot an IDE any more.

• ×25-×150 speedup on repeated OCR lookups — the new TesseractLastSeen persistent cache mirrors #353's image lastSeen PNG-chunk trick on the text side: eight consecutive findText("Espagne") on Notepad drop from 48 s to <400 ms after warm-up, full-screen findText from >1 s cold to <50 ms warm, with per-resolution safety and atomic writes so a crash never leaves corrupt JSON.

• Cross-distribution SSH/VNC posture — RemoteMode gives the AppLauncher an explicit named consent (CONFIDENTIAL default = sshpass -e + strict host-key check; YOLO = single-operator lab targets), while DependencyManagementInjector pins Bouncy Castle 1.84 across all four standalone artifacts (oculixapi, oculixide, oculix-mcp, oculix-reporter) in one place, killing four Jython-transitive GHSAs without introducing a parent pom.

• i18n foundation on 22 locales with native reviews — Google-Translate-seeded pipeline (scripts/translate-bundles.py, sentinels for placeholders and brand tokens) plus a merge-staging-to-live.py that never overwrites native work; native passes landed for zh_TW, zh_CN, pt_BR, it, uk, de in this cycle, with LanguagePicker in the sidebar and OculixFonts falling back on non-Latin locales so glyphs stop rendering as tofu boxes.

What's new for users

New features

• 🤖 Android/ADB overhaul — we closed the epic #297 backlog (four bugs: inputKeyEvent format-string crash #293, swipe ignoring durationMs #294, missing dragAndDrop overload #295, eager OpenCV load moved to lazy captureDeviceScreenMat #296) and rebuilt ADBClient's adb binary resolution holistically — system PATH, then ANDROID_HOME/ANDROID_SDK_ROOT/platform-tools, then per-OS install paths (~/Library/Android/sdk, ~/Android/Sdk, %LOCALAPPDATA%/Android/Sdk, /opt/homebrew/bin, …), so the headless -r Jython mode no longer needs a hardcoded path.

  On top of that:

  • serial-based device selection (getDeviceBySerial / initBySerial / startBySerial) honoring the #229 API
  • multi-session support via lazy jadb connect so new ADBScreen(0) / new ADBScreen(1) can drive two devices from one process
  • wakeUp() decoupled from dumpsys power (idempotent KEYCODE_WAKEUP — no more 4 dumpsys probes on the hot path)
  • getDisplayDimension() now reads adb shell wm size (the stable Physical size: WxH contract) with the old dumpsys display parse kept only as a fallback — so LDPlayer / BlueStacks emulators and non-stock ROMs stop returning null on ADBScreen.start() (#229)

  Validated end-to-end on a real Samsung Galaxy S20 FE (Android 13, One UI 5) over ADB WiFi. (#297 #293 #294 #295 #296 #229)

• 📦 File > Export sub-menu revived (.zip / .jar / runnable .jar) — SikuliX's original "pack compiled Jython into a runnable jar" flow (java -jar oculix.jar -r script.jar) still worked in OculiX but had been dormant since the menu cleanup — the FileAction.ASJAR / ASRUNJAR methods lived on with no menu entry to reach them (confirmed in #393).

  We split File > Export into a proper sub-menu (As .zip / As .jar script library / As runnable .jar) and wired the sidebar's Export button through the same handler, so the runnable-jar path is discoverable again. Sidebar was fully invisible for jar export since the Phase 1b migration, which meant the revived feature was reachable by no one.

  Under the hood:

  • exportAsJar() was still reading EditorPane.editorPaneFile, a field left null-initialised since the PaneContext refactor — rewritten to speak PaneContext (temp/non-bundle scripts get a polite popup instead of an NPE, saved bundles get a compiled _sikuli.jar).
  • Fixed a stale prolog import (org.sikuli.script.SikulixForJython → org.sikuli.support.SikulixForJython) that would have made every exported runnable jar die at runtime with ImportError: No module named org.sikuli.script.
  • makeScriptjar tightened to actually pack compiled .py bytecode.

  The menuFileExport i18n key is dropped in favour of EN-only inline labels across all 22 active locales (three sibling menu entries in EN keep the JMenu definition in sync without stale RU / BG / AR translations). (#392 #393)

• 🤖 MCP surface grows from 9 to 13 tools + locale-aware OCR + tolerant waitForStable — we added four new MCP tools so an LLM agent can drive a real UI in one round-trip per intent instead of orchestrating find-then-act loops client-side:

  • oculix_click_at_point — raw x,y click
  • oculix_click_text — OCR find + click, returns the bounding box so the caller can verify which match was hit when the text repeats
  • oculix_scroll
  • oculix_wait_for_stable — a server-side page-settle observer that polls a region and returns stable=true once the byte delta stays under min_pixel_delta for settle_window_ms continuous (defaults tuned for a Chrome half-pane: 800 ms window, 5000-byte threshold, 150 ms poll, 10 s timeout), replacing the arbitrary Bash sleeps agents used to stitch between steps.

... (truncated)

Commits

• bc10260 fix(i18n/de): drop stray <br> from welcomeHero to fix literal display
• 919eb26 chore(deps): bump jackson-core/databind 2.21.3 → 2.22.0 to close 6 CVEs
• fd4aa7f Merge branch 'claude/i18n-phase3' into master — v4.0.0
• 93d38d4 ci: add CodeQL workflow — weekly + push + PR triggers
• 17b016e ci: add CodeQL config with focused path exclusions
• 1a1bb95 chore(release): bump version 3.0.4 → 4.0.0 across all reactor modules
• 575ee9b docs(changelog): add v4.0.0 release notes section
• 52769d2 feat(basics): route Debug.action/error through ActionLogRenderer (#424)
• 605dd4a feat(basics): add Settings.ActionLogMode — personality knob for action/error ...
• 9a4b0eb feat(support): add ActionLogRenderer — Debug.action/error line renderer (#424)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, jvm-bridge. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.