[build-tools] clarify Google Play app setup errors

# Why

We recently changed the default Android system image from API 30 to API 35. Looks like API 35 needs more RAM to be working well.

<details>
<summary>Details</summary>

Android 35 Google APIs x86_64 can lose ADB during large APK transfers. Guest tracing shows `adbd` getting `ENOMEM` from `write()`, then closing VSOCK before the emulator closes host TCP. Six fresh live EAS devices with 4 GiB passed six Maestro tests and 60 additional APK downloads. Two of three corrected lower-memory control devices lost ADB.

</details>

# How

Use 4096 MB when the resolved system-image package starts with `system-images;android-35` or newer.

# Test Plan

- Existing emulator utility and startup suites: 30 tests passed. No tests added. Updated one existing API 35 AOSP RAM expectation from 2048 to 4096.
- Type checks for all 13 projects, repository lint, targeted formatting, and `git diff --check` passed.
- [Live validation of the 4 GiB setting](https://expo.dev/accounts/sjchmiela/projects/sdk-57-production/workflows/01a165c0-9d4d-777b-920f-3827ff2f89b4): three devices, three Maestro tests, 30 APK downloads passed.
- [Default API 30 comparison](https://expo.dev/accounts/sjchmiela/projects/sdk-57-production/workflows/01a16833-cf25-7eac-b472-e64dc6084c3d): 2/3/4 GiB, three fresh workers per setting, complete.
- [API 34 comparison](https://expo.dev/accounts/sjchmiela/projects/sdk-57-production/workflows/01a16833-cf57-70be-a4e8-72a20ca8d6b2): 2/4 GiB, three fresh workers per setting, complete.
- [API 35 comparison](https://expo.dev/accounts/sjchmiela/projects/sdk-57-production/workflows/01a16837-36ae-7bfe-9518-28fe72b9cd5c): 2/3/4 GiB, three fresh workers per setting, complete.

| Image | RAM request | Full passes (flow plus ten downloads) |
| --- | --- | --- |
| Default API 30 | 2 / 3 / 4 GiB | 3/3 / 3/3 / 3/3 |
| API 34 Google APIs x86_64 | 2 / 4 GiB | 3/3 / 3/3 |
| API 35 Google APIs x86_64 | 2 / 3 / 4 GiB | 1/3 / 0/3 / 3/3 |

API 35 at 2 and 3 GiB each had two Maestro failures with `device offline`. One 3 GiB device passed Maestro but lost ADB during extra download four. All 4 GiB devices passed all 30 extra downloads. Three devices per cell do not establish a long-term failure rate.

.changeset/android-35-adb-memory.md

@@ -0,0 +1,5 @@
+---
+'@expo/build-tools': patch
+---
+
+Default Android emulators to 4 GiB of RAM to reduce ADB disconnects during large transfers. Retain the 2 GiB default for API 34 and below outside interactive device sessions, and preserve explicit emulator configuration overrides.

.changeset/clear-play-setup-errors.md

@@ -0,0 +1,5 @@
+---
+'@expo/build-tools': patch
+---
+
+Explain Google Play failures caused by missing app declarations, a disabled API, or an upload certificate that is not yet active.

.changeset/download-build-network-retries.md

@@ -0,0 +1,5 @@
+---
+'@expo/build-tools': patch
+---
+
+Retry the build lookup and the archive download of `eas/download_build` on transient failures, and name the failure cause in the build log.

.changeset/help-description-style.md

@@ -0,0 +1,5 @@
+---
+'eas-cli': none
+---
+
+Make command descriptions in `eas --help` consistently lowercase without trailing periods.

.changeset/native-hooks-log-group.md

@@ -0,0 +1,6 @@
+---
+'@expo/build-tools': patch
+'@expo/steps': patch
+---
+
+Stop printing workflow hook parsing messages in build logs: native builds showed them under an "Unknown build phase" group, and custom builds warned about unknown hook keys and hooks on steps that never run.

.changeset/node-22-23-4.md

@@ -0,0 +1,6 @@
+---
+'eas-cli': none
+'@expo/build-tools': none
+---
+
+Bump Node.js to 22.23.4 to fix the CVEs in the [October 2026 Node.js security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases).

.changeset/sandbox-duration.md

@@ -0,0 +1,5 @@
+---
+'@expo/build-tools': minor
+---
+
+Stop sandboxes after an optional maximum duration measured from readiness.

.changeset/shared-graphql-client.md

@@ -0,0 +1,5 @@
+---
+'eas-cli': patch
+---
+
+Share one GraphQL client between the project ID check and the command, so commands send one fewer app query.

.changeset/worker-mask-xcode-build-logs.md

@@ -1,5 +0,0 @@
----
-'@expo/worker': patch
----
-
-Apply the job log's secret masking to uploaded Xcode build logs.

.changeset/workflow-artifact-types.md

@@ -0,0 +1,6 @@
+---
+'@expo/eas-build-job': major
+'@expo/build-tools': major
+---
+
+Remove legacy artifact type exports and route workflow uploads through workflow storage without file-type categories. Preserve workflow uploads and Maestro reports.

CLAUDE.md

@@ -215,7 +215,7 @@ if: ${{ steps.previous_step.outputs.success == 'true' && env.ENVIRONMENT == 'pro
 Artifacts tracked as `ArtifactToUpload`:
 
 - Managed artifacts (APK, IPA, AAB) with specific handling
-- Generic artifacts for any file
+- Workflow artifacts for any file
 - Upload via `ctx.uploadArtifact()` or `upload-artifact` step
 
 ## Package Interdependencies

mise.toml

@@ -6,4 +6,4 @@ MISE_NODE_COREPACK = "true"
 actionlint = "1.7.12"
 gcloud = "570.0.0"
 jq = "1.8.1"
-node = "22.23.3"
+node = "22.23.4"

packages/build-tools/package.json

@@ -26,7 +26,7 @@
     "build:egress-guard": "resources/egress-guard/build.sh",
     "test:egress-guard": "resources/egress-guard/tests/run-policy-tests.sh && resources/egress-guard/tests/run-guard-tests.sh",
     "typecheck": "tsc",
-    "generate-appium-commands": "mise exec [email protected]2.0 -- node scripts/generate-appium-commands.js",
+    "generate-appium-commands": "mise exec [email protected]3.4 -- node scripts/generate-appium-commands.js",
     "prepack": "rimraf dist \"*.tsbuildinfo\" && yarn gql && tsc -p tsconfig.build.json",
     "jest-unit": "jest --config jest/unit-config.ts",
     "jest-integration": "jest --config jest/integration-config.ts",

packages/build-tools/src/common/__tests__/jobHooks.test.ts

@@ -16,11 +16,13 @@ function createCtx(
   { workingdir = '/tmp/wd' }: { workingdir?: string } = {}
 ): {
   ctx: BuildContext<Ios.Job>;
+  info: jest.Mock;
   warn: jest.Mock;
 } {
+  const info = jest.fn();
   const warn = jest.fn();
   const logger = {
-    info: jest.fn(),
+    info,
     debug: jest.fn(),
     error: jest.fn(),
     warn,
@@ -36,7 +38,7 @@ function createCtx(
       workingdir,
     }
   );
-  return { ctx, warn };
+  return { ctx, info, warn };
 }
 
 // Project checkout lives at <workingdir>/build (job projectRootDirectory is '.').
@@ -79,22 +81,31 @@ describe(parseJobHooksAsync, () => {
     });
   });
 
-  it('treats an unknown hook key as inert and warns', async () => {
-    const { ctx, warn } = createCtx({
+  it('writes nothing to the build log while parsing', async () => {
+    const { ctx, info, warn } = createCtx({
+      before_install_node_modules: [{ run: 'echo hi' }],
+      before_submit: [{ run: 'echo hi' }],
+      before_bogus: [{ run: 'echo hi' }],
+    });
+    await parseJobHooksAsync(ctx, INSTALL);
+    expect(info).not.toHaveBeenCalled();
+    expect(warn).not.toHaveBeenCalled();
+  });
+
+  it('treats an unknown hook key as inert', async () => {
+    const { ctx } = createCtx({
       before_bogus: [{ run: 'echo hi' }],
     });
     const parsed = await parseJobHooksAsync(ctx, INSTALL);
     expect(parsed!.hookEntriesByKey).toEqual({});
-    expect(warn).toHaveBeenCalledWith(expect.stringContaining('unknown hook key "before_bogus"'));
   });
 
-  it('shape-checks a registered-but-unwrapped key, then warns and skips it', async () => {
-    const { ctx, warn } = createCtx({
+  it('shape-checks a registered-but-unwrapped key, then skips it', async () => {
+    const { ctx } = createCtx({
       before_submit: [{ run: 'echo hi' }],
     });
     const parsed = await parseJobHooksAsync(ctx, INSTALL);
     expect(parsed!.hookEntriesByKey.before_submit).toBeUndefined();
-    expect(warn).toHaveBeenCalledWith(expect.stringContaining('hooks.before_submit'));
   });
 
   it('shape-validates a registered-but-unwrapped key even though it is skipped', async () => {
@@ -192,10 +203,9 @@ describe(parseJobHooksAsync, () => {
   });
 
   it('never loads a composite function referenced under a registered-but-unwrapped key', async () => {
-    const { ctx, warn } = createCtx({ before_submit: [{ uses: './.eas/functions/missing' }] });
+    const { ctx } = createCtx({ before_submit: [{ uses: './.eas/functions/missing' }] });
     const parsed = await parseJobHooksAsync(ctx, INSTALL);
     expect(parsed!.hookEntriesByKey).toEqual({});
-    expect(warn).toHaveBeenCalledWith(expect.stringContaining('hooks.before_submit'));
   });
 
   it('wraps a cross-key duplicate step id in the aggregate error', async () => {

packages/build-tools/src/common/hookableBuildPhase.ts

@@ -44,9 +44,8 @@ export async function runHookableBuildPhaseAsync<TJob extends BuildJob, T>({
     if (hooks) {
       try {
         await runHookEntriesAsync({ ctx, hooks, timing: 'after', anchor, anchorFailed: true });
-      } catch (hookError) {
-        // The phase error wins; still surface the after-hook failure in the log.
-        ctx.logger.error({ err: hookError }, `after_${anchor} hook failed`);
+      } catch {
+        // The phase error wins.
       }
     }
     throw phaseError;

packages/build-tools/src/common/jobHooks.ts

@@ -53,19 +53,17 @@ export async function parseJobHooksAsync<TJob extends BuildJob>(
   const globalContext = new BuildStepGlobalContext(customBuildContext, false);
   // Hook steps run in the checked-out project directory, not the pre-checkout
   // target directory the global context defaults to.
-  globalContext.markAsCheckedOut(ctx.logger);
+  globalContext.markAsCheckedOut();
 
   const externalFunctions = getEasFunctions(customBuildContext);
   const externalFunctionGroups = getEasFunctionGroups(customBuildContext);
 
   // Shape-validate every REGISTERED key, reachable or not (steps-world parity:
-  // a malformed `before_submit` fails a steps build, so it fails here too), and
-  // warn on keys this build won't run. An unknown key is inert — a key newer
-  // than this worker must be ignored, never fail the job.
+  // a malformed `before_submit` fails a steps build, so it fails here too). An
+  // unknown key is inert — a key newer than this worker must be ignored, never
+  // fail the job.
   for (const [key, steps] of Object.entries(hooks)) {
-    const parsed = parseHookKey(key);
-    if (parsed === null) {
-      ctx.logger.warn(`Ignoring unknown hook key "${key}".`);
+    if (parseHookKey(key) === null) {
       continue;
     }
     if (Array.isArray(steps) && steps.length === 0) {
@@ -81,15 +79,6 @@ export async function parseJobHooksAsync<TJob extends BuildJob>(
         { cause: err }
       );
     }
-    // Registered but not wrapped by this build: shape-checked above, then
-    // skipped. Function existence is deliberately NOT checked (that happens only
-    // during construction) — an unknown `uses:` under an unwrapped key warns
-    // rather than failing the build.
-    if (!wrappedAnchors.includes(parsed.anchorId)) {
-      ctx.logger.warn(
-        `Ignoring "hooks.${key}": this build does not run the "${parsed.anchorId}" step.`
-      );
-    }
   }
 
   // Construct entries for the wrapped anchors in EXECUTION order (per anchor,

packages/build-tools/src/context.ts

@@ -4,13 +4,11 @@ import {
   BuildPhaseResult,
   Env,
   EnvironmentSecretType,
-  GenericArtifactType,
   Job,
   LogMarker,
   ManagedArtifactType,
   Metadata,
   errors,
-  isGenericArtifact,
 } from '@expo/eas-build-job';
 import { BuildTrigger } from '@expo/eas-build-job/dist/common';
 import { bunyan } from '@expo/logger';
@@ -42,7 +40,7 @@ export type ArtifactToUpload =
       paths: string[];
     }
   | {
-      type: GenericArtifactType;
+      type: null;
       name: string;
       paths: string[];
       metadata?: Record<string, unknown>;
@@ -241,7 +239,7 @@ export class BuildContext<TJob extends Job = Job> {
     logger: bunyan;
   }): Promise<{ artifactId: string | null }> {
     const result = await this._uploadArtifact({ artifact, logger });
-    if (result.filename && !isGenericArtifact(artifact)) {
+    if (result.filename && artifact.type !== null) {
       this.artifacts[artifact.type] = result.filename;
     }
     return { artifactId: result.artifactId ?? null };

packages/build-tools/src/steps/functions/__tests__/checkout.test.ts

@@ -48,7 +48,10 @@ describe(createCheckoutBuildFunction, () => {
   });
 
   it('moves project sources to the target directory when no inputs are given', async () => {
+    const logger = createMockLogger();
+    jest.mocked(logger.child).mockReturnValue(logger);
     const { globalCtx, executeAsync } = createCheckoutStep({
+      logger,
       projectArchive: GIT_PROJECT_ARCHIVE,
     });
 
@@ -56,6 +59,9 @@ describe(createCheckoutBuildFunction, () => {
 
     expect(await vol.promises.readFile(`${projectTargetDirectory}/app.json`, 'utf8')).toBe('{}');
     expect(globalCtx.wasCheckedOut()).toBe(true);
+    expect(logger.info).toHaveBeenCalledWith(
+      expect.stringContaining('Changing default working directory to')
+    );
     expect(fetchAndCheckoutRefAsync).not.toHaveBeenCalled();
   });
 
@@ -96,14 +102,11 @@ describe(createCheckoutBuildFunction, () => {
   });
 
   it('rejects the ref input when the project is already checked out', async () => {
-    const logger = createMockLogger();
-    jest.mocked(logger.child).mockReturnValue(logger);
     const { globalCtx, executeAsync } = createCheckoutStep({
-      logger,
       projectArchive: GIT_PROJECT_ARCHIVE,
       callInputs: { ref: 'feature/add-icon' },
     });
-    globalCtx.markAsCheckedOut(logger);
+    globalCtx.markAsCheckedOut();
 
     await expect(executeAsync()).rejects.toMatchObject({
       errorCode: 'EAS_CHECKOUT_REF_AFTER_CHECKOUT',

packages/build-tools/src/steps/functions/__tests__/downloadBuild.test.ts

@@ -11,6 +11,7 @@ import * as tar from 'tar';
 
 import { createGlobalContextMock } from '../../../__tests__/utils/context';
 import { createMockLogger } from '../../../__tests__/utils/logger';
+import { Datadog } from '../../../datadog';
 import * as files from '../../../utils/files';
 import { createDownloadBuildFunction, downloadBuildAsync } from '../downloadBuild';
 
@@ -30,11 +31,17 @@ const APPLICATION_ARCHIVE_URL = `https://expo.dev/artifacts/eas/${randomUUID()}.
 function createMockGraphqlClient({
   applicationArchiveUrl,
   error,
+  transientError,
 }: {
   applicationArchiveUrl?: string | null;
   error?: Error;
+  transientError?: Error;
 }): Client {
-  const toPromise = jest.fn().mockResolvedValue(
+  const toPromise = jest.fn();
+  if (transientError) {
+    toPromise.mockResolvedValueOnce({ error: transientError, data: undefined });
+  }
+  toPromise.mockResolvedValue(
     error
       ? { error, data: undefined }
       : {
@@ -62,7 +69,7 @@ function createSuccessfulResponse({
   url,
   headers,
 }: {
-  body: Buffer;
+  body: Buffer | Readable;
   url: string;
   headers?: Record<string, string>;
 }): Response {
@@ -72,7 +79,7 @@ function createSuccessfulResponse({
 
   return {
     ok: true,
-    body: Readable.from(body),
+    body: body instanceof Readable ? body : Readable.from(body),
     url,
     headers: {
       get: (name: string): string | null => normalizedHeaders[name.toLowerCase()] ?? null,
@@ -80,6 +87,47 @@ function createSuccessfulResponse({
   } as unknown as Response;
 }
 
+function createUndiciNetworkError(code: string): CombinedError {
+  return new CombinedError({
+    networkError: Object.assign(new TypeError('fetch failed'), {
+      cause: Object.assign(new Error(`read ${code}`), { code }),
+    }),
+  });
+}
+
+const { FetchError: ActualFetchError } = jest.requireActual(
+  'node-fetch'
+) as typeof import('node-fetch');
+
+function createSocketFetchError(url: string, code: string): Error {
+  return new ActualFetchError(`request to ${url} failed, reason: connect ${code}`, 'system', {
+    code,
+  } as any);
+}
+
+function useFakeBackoffTimers(): void {
+  // Streams and fs callbacks need the real nextTick and setImmediate; only the backoff timers are faked.
+  jest.useFakeTimers({ doNotFake: ['nextTick', 'setImmediate', 'queueMicrotask'] });
+}
+
+const MAX_IO_TURNS_BEFORE_BACKOFF = 1000;
+
+async function waitForBackoffTimerAsync(): Promise<void> {
+  for (let turns = 0; jest.getTimerCount() === 0; turns++) {
+    if (turns === MAX_IO_TURNS_BEFORE_BACKOFF) {
+      throw new Error('No backoff timer was scheduled.');
+    }
+    await new Promise(resolve => setImmediate(resolve));
+  }
+}
+
+async function fireBackoffTimersAsync(count: number): Promise<void> {
+  for (let i = 0; i < count; i++) {
+    await waitForBackoffTimerAsync();
+    await jest.advanceTimersToNextTimerAsync();
+  }
+}
+
 async function createFlatAppTarGzBufferAsync(): Promise<Buffer> {
   const sourceDirectory = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'flat-app-source-'));
   const archivePath = path.join(os.tmpdir(), `${randomUUID()}.tar.gz`);
@@ -108,6 +156,11 @@ async function createFlatAppTarGzBufferAsync(): Promise<Buffer> {
   }
 }
 
+afterEach(() => {
+  jest.useRealTimers();
+  jest.restoreAllMocks();
+});
+
 describe('downloadBuild', () => {
   it('downloads from applicationArchiveUrl returned by GraphQL', async () => {
     const buildId = randomUUID();
@@ -465,13 +518,13 @@ describe('downloadBuild', () => {
     expect(jest.mocked(fetch)).not.toHaveBeenCalled();
   });
 
-  it('throws SystemError when GraphQL request fails with a network error', async () => {
+  it('throws SystemError with the cause code after retrying a failing build lookup', async () => {
+    useFakeBackoffTimers();
     const buildId = randomUUID();
     const graphqlClient = createMockGraphqlClient({
-      error: new CombinedError({
-        networkError: new Error('Network request failed'),
-      }),
+      error: createUndiciNetworkError('ECONNRESET'),
     });
+    const datadogLog = jest.spyOn(Datadog, 'log');
 
     const promise = downloadBuildAsync({
       logger: createLogger({ name: 'test' }),
@@ -480,19 +533,81 @@ describe('downloadBuild', () => {
       robotAccessToken: null,
       extensions: ['app'],
     });
+    const rejection = expect(promise).rejects.toBeInstanceOf(SystemError);
+    await fireBackoffTimersAsync(5);
 
-    await expect(promise).rejects.toBeInstanceOf(SystemError);
+    await rejection;
     await expect(promise).rejects.toMatchObject({
-      message: `Could not fetch build ${buildId}: [Network] Network request failed`,
+      message: `Could not fetch build ${buildId}: [Network] fetch failed (ECONNRESET)`,
+    });
+    expect(graphqlClient.query).toHaveBeenCalledTimes(6);
+    expect(datadogLog).toHaveBeenCalledWith('download_build.build_lookup failed on attempt 6', {
+      event: 'network_retry',
+      operation: 'download_build.build_lookup',
+      outcome: 'failed',
+      attempts: '6',
+      code: 'ECONNRESET',
     });
-
     expect(jest.mocked(fetch)).not.toHaveBeenCalled();
   });
 
-  it('throws SystemError when GraphQL request returns 5xx', async () => {
+  it.each([
+    ['a network error', createUndiciNetworkError('ECONNRESET'), 'ECONNRESET'],
+    [
+      'a transient GraphQL error',
+      new CombinedError({
+        graphQLErrors: [
+          {
+            message: 'Too many requests',
+            extensions: { isTransient: true, errorCode: 'TOO_MANY_REQUESTS' },
+          },
+        ],
+        response: { status: 200 },
+      }),
+      'TOO_MANY_REQUESTS',
+    ],
+  ])('downloads after a build lookup that failed once with %s', async (_, transientError, code) => {
+    useFakeBackoffTimers();
     const buildId = randomUUID();
     const graphqlClient = createMockGraphqlClient({
-      error: Object.assign(new Error('Internal Server Error'), {
+      applicationArchiveUrl: APPLICATION_ARCHIVE_URL,
+      transientError,
+    });
+    jest
+      .mocked(fetch)
+      .mockResolvedValue(
+        createSuccessfulResponse({ body: Buffer.from('hello'), url: 'https://cdn.test/app.apk' })
+      );
+
+    const datadogLog = jest.spyOn(Datadog, 'log');
+
+    const promise = downloadBuildAsync({
+      logger: createLogger({ name: 'test' }),
+      buildId,
+      graphqlClient,
+      robotAccessToken: null,
+      extensions: ['apk'],
+    });
+    await fireBackoffTimersAsync(1);
+
+    const { artifactPath } = await promise;
+    expect(path.basename(artifactPath)).toBe('app.apk');
+    expect(graphqlClient.query).toHaveBeenCalledTimes(2);
+    expect(datadogLog).toHaveBeenCalledWith('download_build.build_lookup recovered on attempt 2', {
+      event: 'network_retry',
+      operation: 'download_build.build_lookup',
+      outcome: 'recovered',
+      attempts: '2',
+      code,
+    });
+  });
+
+  it('throws SystemError when GraphQL request returns 5xx', async () => {
+    useFakeBackoffTimers();
+    const buildId = randomUUID();
+    const graphqlClient = createMockGraphqlClient({
+      error: new CombinedError({
+        graphQLErrors: [{ message: 'Internal Server Error' }],
         response: { status: 500 },
       }),
     });
@@ -504,12 +619,14 @@ describe('downloadBuild', () => {
       robotAccessToken: null,
       extensions: ['app'],
     });
+    const rejection = expect(promise).rejects.toBeInstanceOf(SystemError);
+    await fireBackoffTimersAsync(5);
 
-    await expect(promise).rejects.toBeInstanceOf(SystemError);
+    await rejection;
     await expect(promise).rejects.toMatchObject({
-      message: `Could not fetch build ${buildId}: Internal Server Error`,
+      message: `Could not fetch build ${buildId}: [GraphQL] Internal Server Error`,
     });
-
+    expect(graphqlClient.query).toHaveBeenCalledTimes(6);
     expect(jest.mocked(fetch)).not.toHaveBeenCalled();
   });
 
@@ -534,10 +651,193 @@ describe('downloadBuild', () => {
       errorCode: 'EAS_DOWNLOAD_BUILD_FETCH_FAILED',
       message: `Could not fetch build ${buildId}: [GraphQL] Build not found`,
     });
-
+    expect(graphqlClient.query).toHaveBeenCalledTimes(1);
     expect(jest.mocked(fetch)).not.toHaveBeenCalled();
   });
 
+  it('downloads after an archive request that failed once with a socket error', async () => {
+    useFakeBackoffTimers();
+    const graphqlClient = createMockGraphqlClient({});
+    jest
+      .mocked(fetch)
+      .mockRejectedValueOnce(createSocketFetchError(APPLICATION_ARCHIVE_URL, 'ECONNRESET'))
+      .mockResolvedValueOnce(
+        createSuccessfulResponse({ body: Buffer.from('hello'), url: 'https://cdn.test/app.apk' })
+      );
+
+    const promise = downloadBuildAsync({
+      logger: createLogger({ name: 'test' }),
+      applicationArchiveUrl: APPLICATION_ARCHIVE_URL,
+      graphqlClient,
+      robotAccessToken: null,
+      extensions: ['apk'],
+    });
+    await fireBackoffTimersAsync(1);
+
+    const { artifactPath } = await promise;
+    expect(path.basename(artifactPath)).toBe('app.apk');
+    expect(jest.mocked(fetch)).toHaveBeenCalledTimes(2);
+  });
+
+  it('throws SystemError with the cause code after retrying a failing build archive request', async () => {
+    useFakeBackoffTimers();
+    const graphqlClient = createMockGraphqlClient({
+      applicationArchiveUrl: APPLICATION_ARCHIVE_URL,
+    });
+    jest
+      .mocked(fetch)
+      .mockRejectedValue(createSocketFetchError(APPLICATION_ARCHIVE_URL, 'ETIMEDOUT'));
+    const datadogLog = jest.spyOn(Datadog, 'log');
+
+    const promise = downloadBuildAsync({
+      logger: createLogger({ name: 'test' }),
+      buildId: randomUUID(),
+      graphqlClient,
+      robotAccessToken: null,
+      extensions: ['apk'],
+    });
+    const rejection = expect(promise).rejects.toBeInstanceOf(SystemError);
+    await fireBackoffTimersAsync(5);
+
+    await rejection;
+    await expect(promise).rejects.toMatchObject({
+      message: `Could not download the application archive: request to ${APPLICATION_ARCHIVE_URL} failed, reason: connect ETIMEDOUT`,
+    });
+    expect(jest.mocked(fetch)).toHaveBeenCalledTimes(6);
+    expect(datadogLog).toHaveBeenCalledWith('download_build.archive_download failed on attempt 6', {
+      event: 'network_retry',
+      operation: 'download_build.archive_download',
+      outcome: 'failed',
+      attempts: '6',
+      code: 'ETIMEDOUT',
+    });
+  });
+
+  function createBrokenBody(code: string): Readable {
+    return Readable.from(
+      (async function* () {
+        yield Buffer.from('he');
+        throw Object.assign(new Error(`body failed with ${code}`), { code });
+      })()
+    );
+  }
+
+  it.each(['ERR_STREAM_PREMATURE_CLOSE', 'ECONNRESET'])(
+    'downloads again when the archive body breaks off with %s after the headers arrived',
+    async code => {
+      useFakeBackoffTimers();
+      const graphqlClient = createMockGraphqlClient({});
+      const brokenBody = createBrokenBody(code);
+      jest
+        .mocked(fetch)
+        .mockResolvedValueOnce(
+          createSuccessfulResponse({ body: brokenBody, url: 'https://cdn.test/app.apk' })
+        )
+        .mockResolvedValueOnce(
+          createSuccessfulResponse({ body: Buffer.from('hello'), url: 'https://cdn.test/app.apk' })
+        );
+      const datadogLog = jest.spyOn(Datadog, 'log');
+
+      const promise = downloadBuildAsync({
+        logger: createLogger({ name: 'test' }),
+        applicationArchiveUrl: APPLICATION_ARCHIVE_URL,
+        graphqlClient,
+        robotAccessToken: null,
+        extensions: ['apk'],
+      });
+      await fireBackoffTimersAsync(1);
+
+      const { artifactPath } = await promise;
+      expect(await fs.promises.readFile(artifactPath, 'utf-8')).toBe('hello');
+      expect(jest.mocked(fetch)).toHaveBeenCalledTimes(2);
+      expect(datadogLog).toHaveBeenCalledWith(
+        'download_build.archive_download recovered on attempt 2',
+        expect.objectContaining({ outcome: 'recovered', code })
+      );
+    }
+  );
+
+  it('throws SystemError when the build archive body keeps breaking off', async () => {
+    useFakeBackoffTimers();
+    const graphqlClient = createMockGraphqlClient({
+      applicationArchiveUrl: APPLICATION_ARCHIVE_URL,
+    });
+    jest.mocked(fetch).mockImplementation(async () =>
+      createSuccessfulResponse({
+        body: createBrokenBody('ECONNRESET'),
+        url: 'https://cdn.test/app.apk',
+      })
+    );
+    const datadogLog = jest.spyOn(Datadog, 'log');
+
+    const promise = downloadBuildAsync({
+      logger: createLogger({ name: 'test' }),
+      buildId: randomUUID(),
+      graphqlClient,
+      robotAccessToken: null,
+      extensions: ['apk'],
+    });
+    const rejection = expect(promise).rejects.toBeInstanceOf(SystemError);
+    await fireBackoffTimersAsync(5);
+
+    await rejection;
+    await expect(promise).rejects.toMatchObject({
+      message: 'Could not download the application archive: body failed with ECONNRESET',
+    });
+    expect(jest.mocked(fetch)).toHaveBeenCalledTimes(6);
+    expect(datadogLog).toHaveBeenCalledWith(
+      'download_build.archive_download failed on attempt 6',
+      expect.objectContaining({ outcome: 'failed', code: 'ECONNRESET' })
+    );
+  });
+
+  it('does not start another archive attempt after an abort during the backoff', async () => {
+    useFakeBackoffTimers();
+    const graphqlClient = createMockGraphqlClient({});
+    jest
+      .mocked(fetch)
+      .mockRejectedValueOnce(createSocketFetchError(APPLICATION_ARCHIVE_URL, 'ECONNRESET'));
+    const controller = new AbortController();
+    const reason = new Error('step timed out');
+
+    const promise = downloadBuildAsync({
+      logger: createLogger({ name: 'test' }),
+      applicationArchiveUrl: APPLICATION_ARCHIVE_URL,
+      graphqlClient,
+      robotAccessToken: null,
+      extensions: ['apk'],
+      signal: controller.signal,
+    });
+    const rejection = expect(promise).rejects.toBe(reason);
+    await waitForBackoffTimerAsync();
+    controller.abort(reason);
+    await jest.advanceTimersToNextTimerAsync();
+
+    await rejection;
+    expect(jest.mocked(fetch)).toHaveBeenCalledTimes(1);
+  });
+
+  it('rethrows the raw error of a failing user-supplied archive URL after the retries', async () => {
+    useFakeBackoffTimers();
+    const graphqlClient = createMockGraphqlClient({});
+    jest
+      .mocked(fetch)
+      .mockRejectedValue(createSocketFetchError(APPLICATION_ARCHIVE_URL, 'ENOTFOUND'));
+
+    const promise = downloadBuildAsync({
+      logger: createLogger({ name: 'test' }),
+      applicationArchiveUrl: APPLICATION_ARCHIVE_URL,
+      graphqlClient,
+      robotAccessToken: null,
+      extensions: ['apk'],
+    });
+    const rejection = expect(promise).rejects.toBeInstanceOf(ActualFetchError);
+    await fireBackoffTimersAsync(5);
+
+    await rejection;
+    expect(jest.mocked(fetch)).toHaveBeenCalledTimes(6);
+  });
+
   it('should throw an error if no matching files are found', async () => {
     const graphqlClient = createMockGraphqlClient({
       applicationArchiveUrl: APPLICATION_ARCHIVE_URL,
@@ -605,6 +905,21 @@ describe('createDownloadBuildFunction', () => {
       };
     }
 
+    function createApplicationResponse(buildId: string): Response {
+      return new ActualResponse(
+        JSON.stringify({
+          data: {
+            build: {
+              id: buildId,
+              gitCommitHash: null,
+              applicationArchiveUrl: APPLICATION_ARCHIVE_URL,
+            },
+          },
+        }),
+        { status: 200 }
+      );
+    }
+
     function createStep(ctx: any, callInputs: Record<string, unknown>) {
       return createDownloadBuildFunction(ctx).createBuildStepFromFunctionCall(
         createGlobalContextMock({
@@ -620,18 +935,7 @@ describe('createDownloadBuildFunction', () => {
       const graphqlClient = createMockGraphqlClient({});
       jest.mocked(fetch).mockImplementation(async url => {
         if (url === workerApiUrl) {
-          return new ActualResponse(
-            JSON.stringify({
-              data: {
-                build: {
-                  id: buildId,
-                  gitCommitHash: null,
-                  applicationArchiveUrl: APPLICATION_ARCHIVE_URL,
-                },
-              },
-            }),
-            { status: 200 }
-          );
+          return createApplicationResponse(buildId);
         }
         return {
           ok: false,
@@ -661,6 +965,33 @@ describe('createDownloadBuildFunction', () => {
       expect(graphqlClient.query).not.toHaveBeenCalled();
     });
 
+    it('retries the worker API lookup after a 5xx response', async () => {
+      useFakeBackoffTimers();
+      const buildId = randomUUID();
+      const graphqlClient = createMockGraphqlClient({});
+      jest
+        .mocked(fetch)
+        .mockResolvedValueOnce(new ActualResponse('Service Unavailable', { status: 503 }))
+        .mockResolvedValueOnce(createApplicationResponse(buildId))
+        .mockResolvedValueOnce(
+          createSuccessfulResponse({ body: Buffer.from('hello'), url: 'https://cdn.test/app.apk' })
+        );
+
+      const execution = createStep(createSessionCtx(graphqlClient), {
+        build_id: buildId,
+        extensions: ['apk'],
+      }).executeAsync();
+      await fireBackoffTimersAsync(1);
+
+      await execution;
+      expect(jest.mocked(fetch)).toHaveBeenCalledTimes(3);
+      expect(jest.mocked(fetch).mock.calls.map(([url]) => url)).toEqual([
+        workerApiUrl,
+        workerApiUrl,
+        APPLICATION_ARCHIVE_URL,
+      ]);
+    });
+
     it('does not call the worker API for an application_archive_url input', async () => {
       const graphqlClient = createMockGraphqlClient({});
       jest.mocked(fetch).mockResolvedValue({

packages/build-tools/src/steps/functions/__tests__/maestroTests.test.ts

@@ -1,4 +1,4 @@
-import { GenericArtifactType, SystemError, UserError } from '@expo/eas-build-job';
+import { SystemError, UserError } from '@expo/eas-build-job';
 import spawn from '@expo/turtle-spawn';
 import fs from 'fs/promises';
 import os from 'os';
@@ -305,7 +305,6 @@ describe('createMaestroTestsBuildFunction', () => {
       expect(mockUploadArtifact).toHaveBeenCalledWith(
         expect.objectContaining({
           artifact: expect.objectContaining({
-            type: GenericArtifactType.OTHER,
             name:
               format === 'html' ? 'Maestro Runner HTML Report' : 'Maestro Runner Allure Results',
             paths: [
@@ -1091,7 +1090,6 @@ describe('createMaestroTestsBuildFunction', () => {
     expect(mockUploadArtifact).toHaveBeenCalledWith(
       expect.objectContaining({
         artifact: expect.objectContaining({
-          type: GenericArtifactType.OTHER,
           name: 'Maestro HTML Report',
           paths: ['/home/expo/.maestro/tests/android-maestro-html.html'],
         }),
@@ -1420,7 +1418,6 @@ describe('createMaestroTestsBuildFunction', () => {
     expect(mockUploadArtifact).toHaveBeenCalledWith(
       expect.objectContaining({
         artifact: expect.objectContaining({
-          type: GenericArtifactType.OTHER,
           name: shot.displayName,
           metadata: shot.metadata,
         }),

packages/build-tools/src/steps/functions/__tests__/startSandbox.test.ts

@@ -1,4 +1,4 @@
-import { SystemError } from '@expo/eas-build-job';
+import { SystemError, UserError } from '@expo/eas-build-job';
 import { Client, fetchExchange } from '@urql/core';
 
 import * as sandboxDaemon from '../../utils/sandboxDaemon';
@@ -6,6 +6,90 @@ import * as sandboxDaemon from '../../utils/sandboxDaemon';
 import { createStartSandboxBuildFunction, markSandboxReadyAsync } from '../startSandbox';
 
 describe('sandbox build functions', () => {
+  it.each([
+    { completion: 'duration', duration: 0.02 },
+    { completion: 'cancellation', duration: 60 },
+    { completion: 'duration', duration: 0.0001 },
+  ])(
+    'stops after $completion with $duration seconds only after readiness',
+    async ({ completion, duration }) => {
+      const controller = new AbortController();
+      let ready!: () => void;
+      const stopAsync = jest.fn(async () => {});
+      const start = jest.spyOn(sandboxDaemon, 'startSandboxDaemonAsync').mockResolvedValue({
+        ready: new Promise<void>(resolve => {
+          ready = resolve;
+        }),
+        stopAsync,
+      });
+      const mutation = jest.fn(() => ({ toPromise: async () => ({ data: {} }) }));
+      const logger = { info: jest.fn(), child: jest.fn() };
+      logger.child.mockReturnValue(logger);
+      const fn = createStartSandboxBuildFunction({
+        mcpServerUrl: 'ws://localhost:8787',
+        graphqlClient: { mutation },
+      } as any);
+      try {
+        const pending = fn.fn!({ logger } as any, {
+          inputs: {
+            sandbox_id: { value: 'sandbox-id' },
+            max_duration_seconds: { value: duration },
+          },
+          outputs: {},
+          env: { __EAS_SANDBOX_MCP_TOKEN: 'token' },
+          signal: controller.signal,
+        });
+        await new Promise(resolve => setTimeout(resolve, 40));
+        expect(mutation).not.toHaveBeenCalled();
+        expect(stopAsync).not.toHaveBeenCalled();
+        ready();
+        if (completion === 'cancellation') {
+          await new Promise(resolve => setImmediate(resolve));
+          expect(stopAsync).not.toHaveBeenCalled();
+          controller.abort();
+        }
+        await pending;
+        expect(mutation).toHaveBeenCalledTimes(1);
+        expect(stopAsync).toHaveBeenCalledTimes(1);
+        const timeoutMessage = `Sandbox reached its maximum runtime of ${duration} seconds. Stopping.`;
+        if (completion === 'duration') {
+          expect(logger.info).toHaveBeenCalledWith(timeoutMessage);
+        } else {
+          expect(logger.info).not.toHaveBeenCalledWith(timeoutMessage);
+        }
+      } finally {
+        start.mockRestore();
+      }
+    }
+  );
+
+  it.each([0, -1, Infinity, NaN])(
+    'rejects invalid maximum duration %s before starting the daemon',
+    async duration => {
+      const start = jest.spyOn(sandboxDaemon, 'startSandboxDaemonAsync');
+      const fn = createStartSandboxBuildFunction({
+        mcpServerUrl: 'ws://localhost:8787',
+      } as any);
+      try {
+        const result = fn.fn!({} as any, {
+          inputs: {
+            sandbox_id: { value: 'sandbox-id' },
+            max_duration_seconds: { value: duration },
+          },
+          outputs: {},
+          env: { __EAS_SANDBOX_MCP_TOKEN: 'token' },
+        });
+        await expect(result).rejects.toBeInstanceOf(UserError);
+        await expect(result).rejects.toThrow(
+          `Invalid sandbox maximum duration: ${duration}. Provide a finite number greater than zero, or omit max_duration_seconds.`
+        );
+        expect(start).not.toHaveBeenCalled();
+      } finally {
+        start.mockRestore();
+      }
+    }
+  );
+
   it('aborts an active ready request and keeps its authentication headers', async () => {
     const controller = new AbortController();
     let requestStarted!: () => void;

packages/build-tools/src/steps/functions/__tests__/uploadArtifact.test.ts

@@ -121,26 +121,32 @@ describe(createUploadArtifactBuildFunction, () => {
     expect(typeInput.isRawValueOneOfAllowedValues()).toBe(false);
   });
 
-  it('passes the metadata input through to runtimeApi.uploadArtifact', async () => {
-    contextUploadArtifact.mockClear();
-    const metadata = { kind: 'screen-recording', startedAtMs: '123', device: 'emulator-5554' };
-    const buildStep = uploadArtifact.createBuildStepFromFunctionCall(createGlobalContextMock({}), {
-      callInputs: {
-        // Generic ('other') artifact: only generic artifacts persist metadata in the worker
-        // (the managed-type upload paths drop it), so that's the type metadata is meant for.
-        type: 'other',
-        key: 'Screen Recording',
-        path: '/',
-        metadata,
-      },
-    });
+  it.each(['other', 'android-apk', 'android-aab', 'ios-simulator-app', 'ios-ipa'])(
+    'uploads %s as a workflow artifact with metadata',
+    async type => {
+      contextUploadArtifact.mockClear();
+      const metadata = { kind: 'screen-recording', startedAtMs: '123', device: 'emulator-5554' };
+      const buildStep = uploadArtifact.createBuildStepFromFunctionCall(
+        createGlobalContextMock({}),
+        {
+          callInputs: {
+            type,
+            key: 'Screen Recording',
+            path: '/',
+            metadata,
+          },
+        }
+      );
 
-    await buildStep.executeAsync();
+      await buildStep.executeAsync();
 
-    expect(contextUploadArtifact).toHaveBeenCalledWith(
-      expect.objectContaining({ artifact: expect.objectContaining({ metadata }) })
-    );
-  });
+      expect(contextUploadArtifact).toHaveBeenCalledWith(
+        expect.objectContaining({
+          artifact: expect.objectContaining({ type: null, metadata }),
+        })
+      );
+    }
+  );
 
   it('does not attach metadata to managed artifact types (the worker drops it)', async () => {
     contextUploadArtifact.mockClear();

packages/build-tools/src/steps/functions/checkout.ts

@@ -58,7 +58,11 @@ export function createCheckoutBuildFunction(): BuildFunction {
         });
       }
 
-      stepsCtx.global.markAsCheckedOut(stepsCtx.logger);
+      const previousWorkingDirectory = stepsCtx.global.defaultWorkingDirectory;
+      stepsCtx.global.markAsCheckedOut();
+      stepsCtx.logger.info(
+        `Changing default working directory to ${stepsCtx.global.defaultWorkingDirectory} (was ${previousWorkingDirectory})`
+      );
     },
   });
 }

packages/build-tools/src/steps/functions/downloadBuild.ts

@@ -7,7 +7,7 @@ import {
   BuildStepInputValueTypeName,
   BuildStepOutput,
 } from '@expo/steps';
-import { Client } from '@urql/core';
+import { Client, CombinedError } from '@urql/core';
 import contentDisposition from 'content-disposition';
 import { glob } from 'fast-glob';
 import { graphql } from 'gql.tada';
@@ -26,10 +26,16 @@ import { CustomBuildContext } from '../../customBuildContext';
 import { formatBytes } from '../../utils/artifacts';
 import { decompressTarAsync, isFileTarGzAsync } from '../../utils/files';
 import { graphqlAbortContext } from '../../utils/graphqlAbort';
-import { retryOnDNSFailure } from '../../utils/retryOnDNSFailure';
+import {
+  describeError,
+  isTransferFailure,
+  isTransientGraphqlError,
+} from '../../utils/networkErrors';
+import { retryOnNetworkFailureAsync } from '../../utils/retryOnNetworkFailure';
 import { pluralize } from '../../utils/strings';
 import {
   type DeviceRunSessionWorkerApi,
+  DeviceRunSessionWorkerApiError,
   getDeviceRunSessionWorkerApi,
 } from '../utils/deviceRunSessionWorkerApi';
 
@@ -152,21 +158,34 @@ async function fetchApplicationArchiveUrlAsync({
       signal,
     });
   }
-  const result = await graphqlClient
-    .query(BUILD_BY_ID_QUERY, { buildId }, graphqlAbortContext(signal))
-    .toPromise();
+  let data;
+  try {
+    data = await retryOnNetworkFailureAsync(
+      async () => {
+        const queryResult = await graphqlClient
+          .query(BUILD_BY_ID_QUERY, { buildId }, graphqlAbortContext(signal))
+          .toPromise();
+        if (queryResult.error) {
+          throw queryResult.error;
+        }
+        return queryResult.data;
+      },
+      {
+        operation: 'download_build.build_lookup',
+        signal,
+        isRetryable: error => error instanceof CombinedError && isTransientGraphqlError(error),
+      }
+    );
+  } catch (error) {
+    signal?.throwIfAborted();
+    const message = `Could not fetch build ${buildId}: ${describeError(error)}`;
+    throw error instanceof CombinedError && !isTransientGraphqlError(error)
+      ? new UserError('EAS_DOWNLOAD_BUILD_FETCH_FAILED', message, { cause: error })
+      : new SystemError(message, { cause: error });
+  }
   signal?.throwIfAborted();
 
-  if (result.error) {
-    const { error } = result;
-    const message = `Could not fetch build ${buildId}: ${error.message}`;
-
-    throw error.networkError || result.error.response?.status >= 500
-      ? new SystemError(message, { cause: error })
-      : new UserError('EAS_DOWNLOAD_BUILD_FETCH_FAILED', message, { cause: error });
-  }
-
-  const applicationArchiveUrl = result.data?.builds.byId?.artifacts?.applicationArchiveUrl;
+  const applicationArchiveUrl = data?.builds.byId?.artifacts?.applicationArchiveUrl;
   if (!applicationArchiveUrl) {
     throw new UserError(
       'EAS_DOWNLOAD_BUILD_NO_APPLICATION_ARCHIVE',
@@ -195,13 +214,18 @@ async function fetchDeviceRunSessionApplicationArchiveUrlAsync({
 }): Promise<string> {
   let application;
   try {
-    application = await deviceRunSessionWorkerApi.getApplicationAsync({ signal });
+    application = await retryOnNetworkFailureAsync(
+      () => deviceRunSessionWorkerApi.getApplicationAsync({ signal }),
+      {
+        operation: 'download_build.session_build_lookup',
+        signal,
+        isRetryable: error => error instanceof DeviceRunSessionWorkerApiError && error.isTransient,
+      }
+    );
   } catch (err) {
     signal?.throwIfAborted();
     throw new SystemError(
-      `Could not fetch build ${buildId} for this device run session: ${
-        err instanceof Error ? err.message : String(err)
-      }`,
+      `Could not fetch build ${buildId} for this device run session: ${describeError(err)}`,
       { cause: err }
     );
   }
@@ -281,18 +305,34 @@ export async function downloadBuildAsync(
   );
 
   signal?.throwIfAborted();
-  const response = await retryOnDNSFailure(fetch)(downloadUrl, { headers, signal });
-
-  if (!response.ok) {
-    const textResult = await asyncResult(response.text());
-    throw new Error(`Unexpected response from server (${response.status}): ${textResult.value}`);
+  let archivePath: string;
+  try {
+    archivePath = await retryOnNetworkFailureAsync(
+      async () => {
+        const response = await fetch(downloadUrl, { headers, signal });
+        if (!response.ok) {
+          const textResult = await asyncResult(response.text());
+          throw new Error(
+            `Unexpected response from server (${response.status}): ${textResult.value}`
+          );
+        }
+        const archiveFilename = resolveArchiveFilename({ response, extensions });
+        const attemptArchivePath = path.join(downloadDestinationDirectory, archiveFilename);
+        // On abort, node-fetch emits an error on the body stream, which fails the pipeline.
+        await streamPipeline(response.body, fs.createWriteStream(attemptArchivePath));
+        return attemptArchivePath;
+      },
+      { operation: 'download_build.archive_download', signal, isRetryable: isTransferFailure }
+    );
+  } catch (error) {
+    signal?.throwIfAborted();
+    if (params.buildId && isTransferFailure(error)) {
+      throw new SystemError(`Could not download the application archive: ${describeError(error)}`, {
+        cause: error,
+      });
+    }
+    throw error;
   }
-
-  const archiveFilename = resolveArchiveFilename({ response, extensions });
-  const archivePath = path.join(downloadDestinationDirectory, archiveFilename);
-
-  // On abort, node-fetch emits an error on the body stream, which fails the pipeline.
-  await streamPipeline(response.body, fs.createWriteStream(archivePath));
   signal?.throwIfAborted();
 
   const { size } = await fs.promises.stat(archivePath);

packages/build-tools/src/steps/functions/maestroTests.ts

@@ -1,4 +1,4 @@
-import { GenericArtifactType, SystemError, UserError } from '@expo/eas-build-job';
+import { SystemError, UserError } from '@expo/eas-build-job';
 import { bunyan } from '@expo/logger';
 import {
   BuildFunction,
@@ -631,7 +631,7 @@ export function createMaestroTestsBuildFunction(ctx: CustomBuildContext): BuildF
         try {
           await ctx.runtimeApi.uploadArtifact({
             artifact: {
-              type: GenericArtifactType.OTHER,
+              type: null,
               name: selectedReport.name,
               paths: [selectedReport.artifactPath],
             },
@@ -738,7 +738,7 @@ async function uploadFailureScreenshotsAsync({
         await fs.copyFile(shot.fileAbsPath, safePath);
         await ctx.runtimeApi.uploadArtifact({
           artifact: {
-            type: GenericArtifactType.OTHER,
+            type: null,
             name: shot.displayName,
             paths: [safePath],
             metadata: shot.metadata,

packages/build-tools/src/steps/functions/startSandbox.ts

@@ -1,4 +1,4 @@
-import { SystemError } from '@expo/eas-build-job';
+import { SystemError, UserError } from '@expo/eas-build-job';
 import { BuildFunction, BuildStepInput, BuildStepInputValueTypeName } from '@expo/steps';
 import { graphql } from 'gql.tada';
 
@@ -32,6 +32,11 @@ export function createStartSandboxBuildFunction(ctx: CustomBuildContext): BuildF
         required: true,
         allowedValueTypeName: BuildStepInputValueTypeName.STRING,
       }),
+      BuildStepInput.createProvider({
+        id: 'max_duration_seconds',
+        required: false,
+        allowedValueTypeName: BuildStepInputValueTypeName.NUMBER,
+      }),
     ],
     fn: async (stepCtx, { inputs, signal, env }) => {
       // The daemon needs this credential, but shell commands do not.
@@ -44,6 +49,18 @@ export function createStartSandboxBuildFunction(ctx: CustomBuildContext): BuildF
         throw new SystemError('MCP server URL is required to start the sandbox daemon.');
       }
       const sandboxId = String(inputs.sandbox_id.value);
+      const maxDurationSeconds = inputs.max_duration_seconds?.value;
+      if (
+        maxDurationSeconds !== undefined &&
+        (typeof maxDurationSeconds !== 'number' ||
+          !Number.isFinite(maxDurationSeconds) ||
+          maxDurationSeconds <= 0)
+      ) {
+        throw new UserError(
+          'EAS_SANDBOX_INVALID_DURATION',
+          `Invalid sandbox maximum duration: ${String(maxDurationSeconds)}. Provide a finite number greater than zero, or omit max_duration_seconds.`
+        );
+      }
       const daemon = await startSandboxDaemonAsync({
         credential: sandboxToken,
         serverUrl: mcpServerUrl,
@@ -63,7 +80,21 @@ export function createStartSandboxBuildFunction(ctx: CustomBuildContext): BuildF
         stepCtx.logger.info('Sandbox daemon started.');
 
         await withLogPhaseAsync(stepCtx.logger, AWAIT_SANDBOX_STEP_NAME, async () => {
-          await waitForCancellationAsync(signal);
+          const timeoutSignal =
+            maxDurationSeconds === undefined
+              ? undefined
+              : AbortSignal.timeout(Math.ceil(maxDurationSeconds * 1000));
+          await waitForCompletionAsync(
+            AbortSignal.any([
+              ...(signal ? [signal] : []),
+              ...(timeoutSignal ? [timeoutSignal] : []),
+            ])
+          );
+          if (timeoutSignal?.aborted) {
+            stepCtx.logger.info(
+              `Sandbox reached its maximum runtime of ${maxDurationSeconds} seconds. Stopping.`
+            );
+          }
         });
       } finally {
         await daemon.stopAsync();
@@ -89,11 +120,11 @@ export async function markSandboxReadyAsync(
   }
 }
 
-async function waitForCancellationAsync(signal?: AbortSignal): Promise<void> {
-  if (signal?.aborted) {
+async function waitForCompletionAsync(signal: AbortSignal): Promise<void> {
+  if (signal.aborted) {
     return;
   }
   await new Promise<void>(resolve => {
-    signal?.addEventListener('abort', () => resolve(), { once: true });
+    signal.addEventListener('abort', () => resolve(), { once: true });
   });
 }

packages/build-tools/src/steps/functions/uploadArtifact.ts

@@ -1,9 +1,4 @@
-import {
-  GenericArtifactType,
-  Job,
-  ManagedArtifactType,
-  isGenericArtifact,
-} from '@expo/eas-build-job';
+import { Job, ManagedArtifactType } from '@expo/eas-build-job';
 import {
   BuildFunction,
   BuildStepInput,
@@ -33,7 +28,12 @@ export function createUploadArtifactBuildFunction(ctx: CustomBuildContext): Buil
           ManagedArtifactType.APPLICATION_ARCHIVE,
           ManagedArtifactType.BUILD_ARTIFACTS,
           ...Object.keys(artifactTypeInputToManagedArtifactType),
-          ...Object.values(GenericArtifactType),
+          // Keep accepting these legacy artifact types for compatibility.
+          'android-apk',
+          'android-aab',
+          'ios-simulator-app',
+          'ios-ipa',
+          'other',
         ],
         required: false,
         allowedValueTypeName: BuildStepInputValueTypeName.STRING,
@@ -126,12 +126,13 @@ export function createUploadArtifactBuildFunction(ctx: CustomBuildContext): Buil
         paths: artifactPaths,
         name: (inputs.name.value || inputs.key.value) as string,
       };
-      const artifact = isGenericArtifact(artifactSpec)
-        ? {
-            ...artifactSpec,
-            metadata: inputs.metadata.value as Record<string, unknown> | undefined,
-          }
-        : artifactSpec;
+      const artifact =
+        artifactSpec.type === null
+          ? {
+              ...artifactSpec,
+              metadata: inputs.metadata.value as Record<string, unknown> | undefined,
+            }
+          : artifactSpec;
 
       try {
         const { artifactId } = await ctx.runtimeApi.uploadArtifact({ artifact, logger });
@@ -141,7 +142,7 @@ export function createUploadArtifactBuildFunction(ctx: CustomBuildContext): Buil
         }
       } catch (error) {
         if (inputs.ignore_error.value) {
-          logger.error({ err: error }, `Failed to upload ${artifact.type}. Ignoring error.`);
+          logger.error({ err: error }, 'Failed to upload artifact. Ignoring error.');
           // Ignoring error.
           return;
         }
@@ -158,7 +159,7 @@ export function createUploadArtifactBuildFunction(ctx: CustomBuildContext): Buil
  * values. This makes sure we support all:
  * - kebab-case managed artifact types (the original)
  * - snake-caps-case managed artifact types (the mistake)
- * - generic artifact types.
+ * - workflow artifact types.
  */
 function parseArtifactTypeInput({
   inputValue,
@@ -166,19 +167,15 @@ function parseArtifactTypeInput({
 }: {
   inputValue: string;
   platform: Job['platform'];
-}): GenericArtifactType | ManagedArtifactType {
+}): ManagedArtifactType | null {
   if (!inputValue) {
     // In build jobs the default artifact type is application-archive.
-    return platform ? ManagedArtifactType.APPLICATION_ARCHIVE : GenericArtifactType.OTHER;
+    return platform ? ManagedArtifactType.APPLICATION_ARCHIVE : null;
   }
 
-  // Step's allowedValues ensures input is either
-  // a key of artifactTypeInputToManagedArtifactType
-  // or a value of an artifact type.
-  const translatedManagedArtifactType = artifactTypeInputToManagedArtifactType[inputValue];
-  if (translatedManagedArtifactType) {
-    return translatedManagedArtifactType;
-  }
-
-  return inputValue as GenericArtifactType | ManagedArtifactType;
+  return (
+    artifactTypeInputToManagedArtifactType[inputValue] ??
+    Object.values(ManagedArtifactType).find(type => type === inputValue) ??
+    null
+  );
 }

packages/build-tools/src/steps/utils/__tests__/deviceRunSessionWorkerApi.test.ts

@@ -330,7 +330,8 @@ describe(DeviceRunSessionWorkerApi, () => {
   });
 
   it('reports a request that failed before www responded', async () => {
-    jest.mocked(turtleFetch).mockRejectedValueOnce(new Error('socket hang up'));
+    const reason = new Error('socket hang up');
+    jest.mocked(turtleFetch).mockRejectedValueOnce(reason);
 
     const error = await createApi()
       .getSessionAsync()
@@ -338,6 +339,7 @@ describe(DeviceRunSessionWorkerApi, () => {
 
     expect(error).toBeInstanceOf(DeviceRunSessionWorkerApiError);
     expect(error.status).toBeUndefined();
+    expect(error.cause).toBe(reason);
     expect(error.message).toContain('failed before www responded: socket hang up');
   });
 

packages/build-tools/src/steps/utils/android/GooglePlayUtils.ts

@@ -302,6 +302,28 @@ export namespace GooglePlayUtils {
       code = 'EAS_GOOGLE_PLAY_DRAFT_APP';
       detail =
         'This app is still a draft in Play Console. Submit a draft release without a rollout, or complete the app setup in Play Console before submitting a release to testers. Use releaseStatus: "draft" in eas.json, or release_status: "draft" in a workflow.';
+    } else if (/must declare the use of advertising ID/i.test(message)) {
+      code = 'EAS_GOOGLE_PLAY_ADVERTISING_ID_DECLARATION_REQUIRED';
+      detail =
+        'Google Play requires an advertising ID declaration for this app. Complete the declaration in Play Console so it matches the app and its SDKs, then submit again.';
+    } else if (
+      /must let us know whether your app uses any Foreground Service permissions/i.test(message)
+    ) {
+      code = 'EAS_GOOGLE_PLAY_FOREGROUND_SERVICE_DECLARATION_REQUIRED';
+      detail =
+        'Google Play requires a foreground service declaration for this app. Complete the declaration in Play Console for the permissions used by the app, then submit again.';
+    } else if (
+      /Google Play Android Developer API has not been used in project .* before or it is disabled/i.test(
+        message
+      )
+    ) {
+      code = 'EAS_GOOGLE_PLAY_API_DISABLED';
+      detail =
+        'The Google Play Android Developer API is not enabled for the Google Cloud project used by this service account. Enable the API in that project, wait for the change to take effect, then submit again.';
+    } else if (/upload certificate.*not yet valid.*recently reset/i.test(message)) {
+      code = 'EAS_GOOGLE_PLAY_UPLOAD_CERTIFICATE_NOT_YET_VALID';
+      detail =
+        'Google Play has not activated the upload certificate after its reset. Check the activation time in Play Console or the reset confirmation, wait until the certificate is active, then submit again. Do not reset the key again to resolve this wait.';
     } else if (error.status === 409 || /edit.*(?:expired|invalid|not found)/i.test(message)) {
       code = 'EAS_GOOGLE_PLAY_EDIT_INVALID';
       detail =

packages/build-tools/src/steps/utils/android/__tests__/GooglePlaySubmission.test.ts

@@ -194,6 +194,48 @@ it.each([
     expect((mapped as Error).message).toContain('releaseStatus: "draft" in eas.json');
   }
 });
+it.each([
+  [
+    400,
+    'Your app targets Android 13 (API 33) or above. You must declare the use of advertising ID in Play Console.',
+    'EAS_GOOGLE_PLAY_ADVERTISING_ID_DECLARATION_REQUIRED',
+    'advertising ID declaration',
+  ],
+  [
+    403,
+    'You must let us know whether your app uses any Foreground Service permissions.',
+    'EAS_GOOGLE_PLAY_FOREGROUND_SERVICE_DECLARATION_REQUIRED',
+    'foreground service declaration',
+  ],
+  [
+    403,
+    'Google Play Android Developer API has not been used in project 123 before or it is disabled. Enable it by visiting https://console.developers.google.com/',
+    'EAS_GOOGLE_PLAY_API_DISABLED',
+    'Google Cloud project',
+  ],
+  [
+    403,
+    'The upload certificate this APK is signed with is not yet valid because it has been recently reset.',
+    'EAS_GOOGLE_PLAY_UPLOAD_CERTIFICATE_NOT_YET_VALID',
+    'activation time',
+  ],
+] as const)('gives a specific app-setup remedy for %s %s', (status, message, code, remedy) => {
+  const original = new GooglePlayApiError(status, message, [], {
+    requestPath: '/example',
+    responseBody: 'diagnostic',
+  });
+  const mapped = GooglePlayUtils.mapGooglePlayError(original, packageName);
+  expect(mapped).toMatchObject({
+    errorCode: code,
+    cause: original,
+    metadata: { googlePlayRequestPath: '/example', googlePlayErrorResponse: 'diagnostic' },
+  });
+  expect((mapped as Error).message).toContain(remedy);
+  expect((mapped as Error).message).toContain(`App: ${packageName}`);
+  expect((mapped as Error).message).toContain('https://play.google.com/console/');
+  expect((mapped as Error).message).not.toContain('Check the track');
+});
+
 it('maps a rejected OAuth key to a credential error', () => {
   const original = new GooglePlayAuthRequestError(400, 'invalid_grant');
   expect(GooglePlayUtils.mapGooglePlayError(original, packageName)).toMatchObject({

packages/build-tools/src/steps/utils/deviceRunSessionWorkerApi.ts

@@ -88,11 +88,16 @@ export class DeviceRunSessionWorkerApiError extends Error {
   constructor(
     message: string,
     /** The HTTP status of the response, or undefined when no response arrived. */
-    readonly status: number | undefined
+    readonly status: number | undefined,
+    options?: ErrorOptions
   ) {
-    super(message);
+    super(message, options);
     this.name = 'DeviceRunSessionWorkerApiError';
   }
+
+  get isTransient(): boolean {
+    return this.status === undefined || this.status >= 500;
+  }
 }
 
 /**
@@ -218,7 +223,8 @@ export class DeviceRunSessionWorkerApi {
         `${routeDescription} failed before www responded: ${
           reason instanceof Error ? reason.message : String(reason)
         }. Check the network connection of the worker.`,
-        undefined
+        undefined,
+        { cause: reason }
       );
     }
     const response = responseResult.value;

packages/build-tools/src/utils/AndroidEmulatorUtils.ts

@@ -154,8 +154,9 @@ export namespace AndroidEmulatorUtils {
     try {
       let configIniFileContent = await fs.promises.readFile(configIniFile, 'utf-8');
 
-      // Give interactive sessions more headroom for guest VSOCK packet allocations.
-      const ramSize = env.DEVICE_RUN_SESSION_ID ? 4096 : 2048;
+      // Keep the lower RAM default for older images; newer guests need more headroom for ADB.
+      const apiLevel = systemImagePackage.match(/^system-images;android-(\d+)/)?.[1];
+      const ramSize = !env.DEVICE_RUN_SESSION_ID && apiLevel && Number(apiLevel) < 35 ? 2048 : 4096;
       logger.info(`Setting hw.ramSize to ${ramSize}.`);
       configIniFileContent = `${configIniFileContent}\nhw.ramSize=${ramSize}\n`;
 

packages/build-tools/src/utils/__tests__/AndroidEmulatorUtils.test.ts

@@ -121,7 +121,7 @@ describe('AndroidEmulatorUtils', () => {
           'hw.lcd.density=420',
           'skin.path=pixel_9',
           'showDeviceFrame=yes',
-          'hw.ramSize=2048',
+          'hw.ramSize=4096',
           '',
           'hw.lcd.density=220',
           '',

packages/build-tools/src/utils/__tests__/networkErrors.test.ts

@@ -1,4 +1,16 @@
-import { isConnectFailure, isConnectionInterruptedError } from '../networkErrors';
+import { CombinedError } from '@urql/core';
+
+import {
+  describeError,
+  findErrorCode,
+  findGraphqlErrorCode,
+  isConnectFailure,
+  isConnectionInterruptedError,
+  isTransferFailure,
+  isTransientGraphqlError,
+} from '../networkErrors';
+
+const { FetchError } = jest.requireActual('node-fetch') as typeof import('node-fetch');
 
 it.each([
   'EAI_AGAIN',
@@ -34,3 +46,77 @@ it.each(['ETIMEDOUT', 'CERT_HAS_EXPIRED', undefined])('does not automatically re
   expect(isConnectFailure(error)).toBe(false);
   expect(isConnectionInterruptedError(error)).toBe(false);
 });
+
+it('finds the errno code on the cause of an undici fetch failure', () => {
+  const error = new CombinedError({
+    networkError: new TypeError('fetch failed', {
+      cause: Object.assign(new Error('read ECONNRESET'), { code: 'ECONNRESET' }),
+    }),
+  });
+  expect(findErrorCode(error)).toBe('ECONNRESET');
+  expect(findErrorCode(new Error('Request failed'))).toBeUndefined();
+  expect(findErrorCode('Request failed')).toBeUndefined();
+});
+
+it('finds the www error code on a GraphQL error', () => {
+  const error = new CombinedError({
+    graphQLErrors: [
+      { message: 'Too many requests', extensions: { errorCode: 'TOO_MANY_REQUESTS' } },
+    ],
+  });
+  expect(findGraphqlErrorCode(error)).toBe('TOO_MANY_REQUESTS');
+  expect(
+    findGraphqlErrorCode(new CombinedError({ graphQLErrors: ['Build not found'] }))
+  ).toBeUndefined();
+  expect(findGraphqlErrorCode(new Error('Request failed'))).toBeUndefined();
+});
+
+it.each([
+  ['Request failed', 'ECONNRESET', 'Request failed (ECONNRESET)'],
+  ['read ECONNRESET', 'ECONNRESET', 'read ECONNRESET'],
+  ['Request failed', undefined, 'Request failed'],
+])('describes %p with code %p as %p', (message, code, expected) => {
+  expect(describeError(Object.assign(new Error(message), { code }))).toBe(expected);
+});
+
+it('treats a missing response, a 5xx response or an isTransient GraphQL error as transient', () => {
+  expect(
+    isTransientGraphqlError(new CombinedError({ networkError: new Error('fetch failed') }))
+  ).toBe(true);
+  expect(
+    isTransientGraphqlError(
+      new CombinedError({ graphQLErrors: ['Internal Server Error'], response: { status: 503 } })
+    )
+  ).toBe(true);
+  expect(
+    isTransientGraphqlError(
+      new CombinedError({
+        graphQLErrors: [{ message: 'Database unavailable', extensions: { isTransient: true } }],
+        response: { status: 200 },
+      })
+    )
+  ).toBe(true);
+  expect(
+    isTransientGraphqlError(
+      new CombinedError({ graphQLErrors: ['Build not found'], response: { status: 200 } })
+    )
+  ).toBe(false);
+});
+
+it.each([
+  [
+    'a node-fetch socket failure',
+    new FetchError('request failed', 'system', { code: 'ECONNRESET' } as any),
+    true,
+  ],
+  ['a node-fetch body size failure', new FetchError('too large', 'max-size'), false],
+  ['a body reset', Object.assign(new Error('aborted'), { code: 'ECONNRESET' }), true],
+  [
+    'a body closed early',
+    Object.assign(new Error('closed'), { code: 'ERR_STREAM_PREMATURE_CLOSE' }),
+    true,
+  ],
+  ['an HTTP error response', new Error('Unexpected response from server (500)'), false],
+])('classifies %s as a transfer failure or not', (_label, error, expected) => {
+  expect(isTransferFailure(error)).toBe(expected);
+});

packages/build-tools/src/utils/networkErrors.ts

@@ -1,3 +1,5 @@
+import { CombinedError } from '@urql/core';
+
 const CONNECT_FAILURE_CODES = new Set([
   'EAI_AGAIN',
   'ECONNREFUSED',
@@ -30,3 +32,50 @@ export function isConnectionInterruptedError(error: unknown): boolean {
   }
   return false;
 }
+
+/** Errno code of the error or its causes; undici keeps it on cause, urql on networkError. */
+export function findErrorCode(error: unknown): string | undefined {
+  let current: unknown = error;
+  while (current instanceof Error) {
+    if ('code' in current && typeof current.code === 'string') {
+      return current.code;
+    }
+    current = current instanceof CombinedError ? current.networkError : current.cause;
+  }
+  return undefined;
+}
+
+export function findGraphqlErrorCode(error: unknown): string | undefined {
+  if (!(error instanceof CombinedError)) {
+    return undefined;
+  }
+  const code = error.graphQLErrors.at(0)?.extensions.errorCode;
+  return typeof code === 'string' ? code : undefined;
+}
+
+export function describeError(error: unknown): string {
+  const message = error instanceof Error ? error.message : String(error);
+  const code = findErrorCode(error);
+  return code && !message.includes(code) ? `${message} (${code})` : message;
+}
+
+export function isTransientGraphqlError(error: CombinedError): boolean {
+  return (
+    Boolean(error.networkError) ||
+    error.response?.status >= 500 ||
+    error.graphQLErrors.some(graphqlError => graphqlError.extensions.isTransient === true)
+  );
+}
+
+// node-fetch throws type 'system' for a socket failure before the headers; after them it forwards
+// ECONNRESET or ERR_STREAM_PREMATURE_CLOSE to the body. HTTP error responses never throw.
+export function isTransferFailure(error: unknown): boolean {
+  return (
+    (error instanceof Error &&
+      error.name === 'FetchError' &&
+      'type' in error &&
+      error.type === 'system') ||
+    isConnectionInterruptedError(error) ||
+    findErrorCode(error) === 'ERR_STREAM_PREMATURE_CLOSE'
+  );
+}

packages/build-tools/src/utils/retryOnNetworkFailure.ts

@@ -0,0 +1,53 @@
+import { Datadog } from '../datadog';
+import { findErrorCode, findGraphqlErrorCode } from './networkErrors';
+import { promiseRetryWithCondition } from './promiseRetryWithCondition';
+
+export async function retryOnNetworkFailureAsync<T>(
+  attemptAsync: () => Promise<T>,
+  {
+    operation,
+    signal,
+    isRetryable,
+  }: {
+    operation: string;
+    signal?: AbortSignal;
+    isRetryable: (error: unknown) => boolean;
+  }
+): Promise<T> {
+  const shouldRetry = (error: unknown): boolean => !signal?.aborted && isRetryable(error);
+  let attempts = 1;
+  let lastError: unknown;
+  const report = (outcome: 'recovered' | 'failed', error: unknown): void => {
+    Datadog.log(`${operation} ${outcome} on attempt ${attempts}`, {
+      event: 'network_retry',
+      operation,
+      outcome,
+      attempts: String(attempts),
+      code: findErrorCode(error) ?? findGraphqlErrorCode(error) ?? 'unknown',
+    });
+  };
+
+  try {
+    const result = await promiseRetryWithCondition(
+      async () => {
+        signal?.throwIfAborted();
+        return await attemptAsync();
+      },
+      shouldRetry,
+      { retries: 5, minTimeout: 1_000, factor: 2 },
+      ({ attemptNumber, error }) => {
+        attempts = attemptNumber;
+        lastError = error;
+      }
+    )();
+    if (attempts > 1) {
+      report('recovered', lastError);
+    }
+    return result;
+  } catch (error) {
+    if (attempts > 1 && !signal?.aborted) {
+      report('failed', error);
+    }
+    throw error;
+  }
+}

packages/eas-build-job/src/artifacts.ts

@@ -7,24 +7,3 @@ export enum ManagedArtifactType {
    */
   XCODE_BUILD_LOGS = 'XCODE_BUILD_LOGS',
 }
-
-export enum GenericArtifactType {
-  ANDROID_APK = 'android-apk',
-  ANDROID_AAB = 'android-aab',
-
-  IOS_SIMULATOR_APP = 'ios-simulator-app',
-  IOS_IPA = 'ios-ipa',
-
-  OTHER = 'other',
-}
-
-export const isGenericArtifact = <
-  TSpec extends { type: GenericArtifactType | ManagedArtifactType },
->(
-  artifactSpec: TSpec
-): artifactSpec is TSpec & { type: GenericArtifactType } => {
-  if (Object.values(GenericArtifactType).includes(artifactSpec.type as GenericArtifactType)) {
-    return true;
-  }
-  return false;
-};

packages/eas-cli/package.json

@@ -252,7 +252,7 @@
     },
     "update": {
       "node": {
-        "version": "22.23.3"
+        "version": "22.23.4"
       },
       "s3": {
         "templates": {

packages/eas-cli/src/commandUtils/context/LoggedInContextField.ts

@@ -1,5 +1,5 @@
 import ContextField, { ContextOptions } from './ContextField';
-import { ExpoGraphqlClient, createGraphqlClient } from './contextUtils/createGraphqlClient';
+import { ExpoGraphqlClient } from './contextUtils/createGraphqlClient';
 import { LoggedInAuthenticationInfo } from '../../user/SessionManager';
 import { Actor } from '../../user/User';
 import FeatureGateEnvOverrides from '../gating/FeatureGateEnvOverrides';
@@ -22,7 +22,7 @@ export default class LoggedInContextField extends ContextField<LoggedInContextTy
     });
     const featureGateServerValues: { [key: string]: boolean } = actor?.featureGates ?? {};
 
-    const graphqlClient = createGraphqlClient(authenticationInfo);
+    const graphqlClient = sessionManager.getGraphqlClient(authenticationInfo);
 
     return {
       actor,

packages/eas-cli/src/commandUtils/context/MaybeLoggedInContextField.ts

@@ -1,5 +1,5 @@
 import ContextField, { ContextOptions } from './ContextField';
-import { ExpoGraphqlClient, createGraphqlClient } from './contextUtils/createGraphqlClient';
+import { ExpoGraphqlClient } from './contextUtils/createGraphqlClient';
 import { Actor } from '../../user/User';
 import FeatureGateEnvOverrides from '../gating/FeatureGateEnvOverrides';
 import FeatureGating from '../gating/FeatureGating';
@@ -21,7 +21,7 @@ export default class MaybeLoggedInContextField extends ContextField<MaybeLoggedI
       sessionSecret: sessionManager.getSessionSecret(),
     };
 
-    const graphqlClient = createGraphqlClient(authenticationInfo);
+    const graphqlClient = sessionManager.getGraphqlClient(authenticationInfo);
     const actor = await sessionManager.getUserAsync();
     const featureGateServerValues: { [key: string]: boolean } = actor?.featureGates ?? {};
 

packages/eas-cli/src/commandUtils/context/__tests__/LoggedInContextField-test.ts

@@ -0,0 +1,63 @@
+import nock from 'nock';
+
+import { AnalyticsWithOrchestration } from '../../../analytics/AnalyticsManager';
+import { getExpoApiBaseUrl } from '../../../api';
+import { AppQuery } from '../../../graphql/queries/AppQuery';
+import SessionManager from '../../../user/SessionManager';
+import { ContextOptions } from '../ContextField';
+import LoggedInContextField from '../LoggedInContextField';
+import { getProjectIdAsync } from '../contextUtils/getProjectIdAsync';
+
+const app = {
+  __typename: 'App',
+  id: 'PROJECT_ID',
+  name: 'app',
+  fullName: '@owner/app',
+  slug: 'app',
+  ownerAccount: { __typename: 'Account', id: 'ACCOUNT_ID', name: 'owner' },
+  githubRepository: null,
+};
+
+beforeEach(() => {
+  nock.disableNetConnect();
+});
+
+afterEach(() => {
+  nock.cleanAll();
+  nock.enableNetConnect();
+});
+
+describe(LoggedInContextField, () => {
+  it('shares the GraphQL cache with the project ID check', async () => {
+    const analytics: AnalyticsWithOrchestration = {
+      logEvent: jest.fn(),
+      setActor: jest.fn(),
+      flushAsync: jest.fn(),
+      getDeviceId: jest.fn(() => null),
+    };
+    const sessionManager = new SessionManager(analytics);
+    jest.spyOn(sessionManager, 'ensureLoggedInAsync').mockResolvedValue({
+      actor: { __typename: 'User', id: 'USER_ID', username: 'owner' } as any,
+      authenticationInfo: { accessToken: 'token', sessionSecret: null },
+    });
+    const scope = nock(getExpoApiBaseUrl())
+      .post('/graphql')
+      .once()
+      .reply(200, { data: { app: { __typename: 'AppQuery', byId: app } } });
+
+    const projectId = await getProjectIdAsync(
+      sessionManager,
+      { name: 'app', slug: 'app', extra: { eas: { projectId: 'PROJECT_ID' } } },
+      { nonInteractive: true }
+    );
+    const { graphqlClient } = await new LoggedInContextField().getValueAsync({
+      sessionManager,
+      nonInteractive: true,
+    } as ContextOptions);
+
+    expect(await AppQuery.byIdAsync(graphqlClient, projectId)).toMatchObject({
+      fullName: '@owner/app',
+    });
+    expect(scope.isDone()).toBe(true);
+  });
+});

packages/eas-cli/src/commandUtils/context/contextUtils/__tests__/getProjectIdAsync-test.ts

@@ -10,6 +10,7 @@ import { fetchOrCreateProjectIDForWriteToConfigWithConfirmationAsync } from '../
 import { isExpoInstalled } from '../../../../project/projectUtils';
 import { promptAsync } from '../../../../prompts';
 import SessionManager from '../../../../user/SessionManager';
+import { ExpoGraphqlClient } from '../createGraphqlClient';
 import { findProjectRootAsync } from '../findProjectDirAndVerifyProjectSetupAsync';
 import { getProjectIdAsync } from '../getProjectIdAsync';
 
@@ -40,6 +41,8 @@ describe(getProjectIdAsync, () => {
       .mockReturnValue({ staticConfigPath: null, dynamicConfigPath: null });
 
     const sessionManagerMock = mock<SessionManager>();
+
+    when(sessionManagerMock.getGraphqlClient(anything())).thenReturn({} as ExpoGraphqlClient);
     when(sessionManagerMock.ensureLoggedInAsync(anything())).thenResolve({
       actor: {
         __typename: 'User',
@@ -186,6 +189,7 @@ describe(getProjectIdAsync, () => {
 
     it('throws when the owner is not specified and is different than logged in user which is a robot', async () => {
       const sessionManagerMock = mock<SessionManager>();
+      when(sessionManagerMock.getGraphqlClient(anything())).thenReturn({} as ExpoGraphqlClient);
       when(sessionManagerMock.ensureLoggedInAsync(anything())).thenResolve({
         actor: {
           __typename: 'Robot',
@@ -410,6 +414,7 @@ describe(getProjectIdAsync, () => {
 
     it('uses the only account without prompting when the user has a single account', async () => {
       const sessionManagerMock = mock<SessionManager>();
+      when(sessionManagerMock.getGraphqlClient(anything())).thenReturn({} as ExpoGraphqlClient);
       when(sessionManagerMock.ensureLoggedInAsync(anything())).thenResolve({
         actor: {
           __typename: 'User',
@@ -448,6 +453,7 @@ describe(getProjectIdAsync, () => {
 
     it('throws for a robot user when no owner is set', async () => {
       const sessionManagerMock = mock<SessionManager>();
+      when(sessionManagerMock.getGraphqlClient(anything())).thenReturn({} as ExpoGraphqlClient);
       when(sessionManagerMock.ensureLoggedInAsync(anything())).thenResolve({
         actor: {
           __typename: 'Robot',
@@ -509,6 +515,7 @@ describe(getProjectIdAsync, () => {
 
     it('defers to the project fetch in non-interactive mode when the account is already known', async () => {
       const sessionManagerMock = mock<SessionManager>();
+      when(sessionManagerMock.getGraphqlClient(anything())).thenReturn({} as ExpoGraphqlClient);
       when(sessionManagerMock.ensureLoggedInAsync(anything())).thenResolve({
         actor: {
           __typename: 'User',

packages/eas-cli/src/commandUtils/context/contextUtils/getProjectIdAsync.ts

@@ -3,7 +3,7 @@ import { Env } from '@expo/eas-build-job';
 import chalk from 'chalk';
 import semver from 'semver';
 
-import { ExpoGraphqlClient, createGraphqlClient } from './createGraphqlClient';
+import { ExpoGraphqlClient } from './createGraphqlClient';
 import { findProjectRootAsync } from './findProjectDirAndVerifyProjectSetupAsync';
 import { AppQuery } from '../../../graphql/queries/AppQuery';
 import Log, { learnMore } from '../../../log';
@@ -92,7 +92,7 @@ export async function getProjectIdAsync(
   const { actor, authenticationInfo } = await sessionManager.ensureLoggedInAsync({
     nonInteractive: options.nonInteractive,
   });
-  const graphqlClient = createGraphqlClient(authenticationInfo);
+  const graphqlClient = sessionManager.getGraphqlClient(authenticationInfo);
 
   const projectId = await validateOrSetProjectIdAsync({ exp, graphqlClient, actor, options });
   return projectId;

packages/eas-cli/src/commands/browse.ts

@@ -33,7 +33,7 @@ const PROJECT_PAGES: Record<string, string> = {
 
 export default class Browse extends EasCommand {
   static override description =
-    'Transition from the terminal to the web browser to view and interact with your project on https://expo.dev';
+    'transition from the terminal to the web browser to view and interact with your project on https://expo.dev';
 
   static override args = {
     page: Args.string({

packages/eas-cli/src/commands/channel/delete.ts

@@ -13,7 +13,7 @@ import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
 import { pollForBackgroundJobReceiptAsync } from '../../utils/pollForBackgroundJobReceiptAsync';
 
 export default class ChannelDelete extends EasCommand {
-  static override description = 'Delete a channel';
+  static override description = 'delete a channel';
 
   static override args = {
     name: Args.string({

packages/eas-cli/src/commands/channel/rollout.ts

@@ -50,7 +50,7 @@ type ChannelRolloutArgsAndFlags = {
   Partial<CreateRolloutNonInteractiveOptions>;
 
 export default class ChannelRollout extends EasCommand {
-  static override description = 'Roll a new branch out on a channel incrementally.';
+  static override description = 'roll a new branch out on a channel incrementally';
 
   static override args = {
     channel: Args.string({

packages/eas-cli/src/commands/credentials/configure-build.ts

@@ -7,7 +7,7 @@ import { SetUpBuildCredentialsCommandAction } from '../../credentials/manager/Se
 import { selectPlatformAsync } from '../../platform';
 
 export default class InitializeBuildCredentials extends EasCommand {
-  static override description = 'Set up credentials for building your project.';
+  static override description = 'set up credentials for building your project';
 
   static override flags = {
     platform: Flags.option({

packages/eas-cli/src/commands/deploy/alias/delete.ts

@@ -22,7 +22,7 @@ interface DeployAliasDeleteFlags {
 }
 
 export default class WorkerAliasDelete extends EasCommand {
-  static override description = 'Delete deployment aliases.';
+  static override description = 'delete deployment aliases';
   static override aliases = ['worker:alias:delete'];
   static override state = 'preview';
 

packages/eas-cli/src/commands/deploy/alias/index.ts

@@ -39,7 +39,7 @@ interface RawDeployAliasFlags {
 }
 
 export default class WorkerAlias extends EasCommand {
-  static override description = 'Assign deployment aliases.';
+  static override description = 'assign deployment aliases';
   static override aliases = ['worker:alias', 'deploy:promote'];
   static override state = 'preview';
 

packages/eas-cli/src/commands/deploy/delete.ts

@@ -23,7 +23,7 @@ interface RawDeployDeleteFlags {
 }
 
 export default class WorkerDelete extends EasCommand {
-  static override description = 'Delete a deployment.';
+  static override description = 'delete a deployment';
   static override aliases = ['worker:delete'];
   static override state = 'preview';
 

packages/eas-cli/src/commands/go.ts

@@ -100,7 +100,7 @@ async function withSuppressedOutputAsync<T>(fn: () => Promise<T>): Promise<T> {
 /* eslint-enable no-console */
 
 export default class Go extends EasCommand {
-  static override description = 'Create a custom Expo Go and submit to TestFlight';
+  static override description = 'create a custom Expo Go and submit to TestFlight';
   static override hidden = true;
 
   static override flags = {

packages/eas-cli/src/commands/observe/event.ts

@@ -22,7 +22,7 @@ import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
 
 export default class ObserveEvent extends EasCommand {
   static override description =
-    'display a single Observe event (metric, log, or error) by its ID. IDs are included in event data when the `--json` flag is passed to `eas observe:session`, `eas observe:metrics`, or `eas observe:events`.';
+    'display a single Observe event (metric, log, or error) by its ID. IDs are included in event data when the `--json` flag is passed to `eas observe:session`, `eas observe:metrics`, or `eas observe:events`';
 
   static override args = {
     id: Args.string({

packages/eas-cli/src/commands/observe/events.ts

@@ -36,7 +36,7 @@ const DEFAULT_EVENTS_LIMIT = 10;
 
 export default class ObserveEvents extends EasCommand {
   static override description =
-    'display individual events emitted by the app via `logEvent`, filtered by the event name in the argument. With no arguments, a list of the available event names and associated event counts is returned.';
+    'display individual events emitted by the app via `logEvent`, filtered by the event name in the argument. With no arguments, a list of the available event names and associated event counts is returned';
 
   static override args = {
     eventName: Args.string({

packages/eas-cli/src/commands/project/new.ts

@@ -134,7 +134,7 @@ export default class New extends EasCommand {
   static override aliases = ['new'];
 
   static override description =
-    'Create a new project configured with Expo Application Services (EAS)';
+    'create a new project configured with Expo Application Services (EAS)';
 
   static override args = {
     path: Args.string({

packages/eas-cli/src/commands/simulator/control.ts

@@ -35,7 +35,7 @@ import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
 export default class SimulatorControl extends EasCommand {
   static override aliases = ['sim:control'];
   static override description =
-    '[EXPERIMENTAL] run a serve-sim action on a remote iOS simulator session on EAS. Run without an action to list the actions the session supports. To save a screenshot locally, run `eas simulator:control screenshot.capture --output ./screenshot.png`.';
+    '[EXPERIMENTAL] run a serve-sim action on a remote iOS simulator session on EAS. Run without an action to list the actions the session supports. To save a screenshot locally, run `eas simulator:control screenshot.capture --output ./screenshot.png`';
   static override strict = false;
 
   static override examples = [

packages/eas-cli/src/commands/simulator/get.ts

@@ -39,7 +39,7 @@ type DeviceRunSessionArtifact = DeviceRunSessionById['artifacts'][number];
 export default class SimulatorGet extends EasCommand {
   static override aliases = ['sim:get'];
   static override description =
-    "[EXPERIMENTAL] get info about a remote simulator session on EAS by its simulator session ID. Preview links follow the session's saved sharing preference.";
+    "[EXPERIMENTAL] get info about a remote simulator session on EAS by its simulator session ID. Preview links follow the session's saved sharing preference";
 
   static override flags = {
     id: Flags.string({

packages/eas-cli/src/commands/simulator/index.ts

@@ -83,7 +83,7 @@ export default class Simulator extends EasCommand {
   static override aliases = ['simulator:start', 'sim:start'];
   static override hiddenAliases = ['sim'];
   static override description =
-    '[EXPERIMENTAL] start a remote simulator session on EAS and get instructions to connect to it. The default browser preview link requires sign-in.';
+    '[EXPERIMENTAL] start a remote simulator session on EAS and get instructions to connect to it. The default browser preview link requires sign-in';
 
   static override flags = {
     platform: Flags.option({

packages/eas-cli/src/commands/workflow/cancel.ts

@@ -9,7 +9,7 @@ import { promptAsync } from '../../prompts';
 
 export default class WorkflowRunCancel extends EasCommand {
   static override description =
-    'Cancel one or more workflow runs. If no workflow run IDs are provided, you will be prompted to select IN_PROGRESS runs to cancel.';
+    'cancel one or more workflow runs. If no workflow run IDs are provided, you will be prompted to select IN_PROGRESS runs to cancel';
 
   static override strict = false;
 

packages/eas-cli/src/commands/workflow/list.ts

@@ -9,7 +9,7 @@ import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
 export default class WorkflowList extends EasCommand {
   static override hidden = true;
 
-  static override description = 'List workflows for the current project';
+  static override description = 'list workflows for the current project';
 
   static override flags = {
     ...EasJsonOnlyFlag,

packages/eas-cli/src/commands/workflow/logs.ts

@@ -26,7 +26,7 @@ function printLogsForAllSteps(logs: JobLogs): void {
 
 export default class WorkflowLogView extends EasCommand {
   static override description =
-    'view logs for a workflow run, selecting a job and step to view. You can pass in either a workflow run ID or a job ID. If no ID is passed in, you will be prompted to select from recent workflow runs for the current project.';
+    'view logs for a workflow run, selecting a job and step to view. You can pass in either a workflow run ID or a job ID. If no ID is passed in, you will be prompted to select from recent workflow runs for the current project';
 
   static override flags = {
     ...EasJsonOnlyFlag,

packages/eas-cli/src/commands/workflow/run.ts

@@ -93,7 +93,7 @@ export function resolveWorkflowRunSshInput({
 
 export default class WorkflowRun extends EasCommand {
   static override description =
-    'run an EAS workflow. The entire local project directory will be packaged and uploaded to EAS servers for the workflow run, unless the --ref flag is used.';
+    'run an EAS workflow. The entire local project directory will be packaged and uploaded to EAS servers for the workflow run, unless the --ref flag is used';
 
   static override args = {
     file: Args.string({

packages/eas-cli/src/commands/workflow/status.ts

@@ -32,7 +32,7 @@ import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
 
 export default class WorkflowStatus extends EasCommand {
   static override description =
-    'show the status of an existing workflow run. If no run ID is provided, you will be prompted to select from recent workflow runs for the current project.';
+    'show the status of an existing workflow run. If no run ID is provided, you will be prompted to select from recent workflow runs for the current project';
 
   static override args = {
     WORKFLOW_RUN_ID: Args.string({

packages/eas-cli/src/commands/workflow/view.ts

@@ -59,7 +59,7 @@ const processedOutputs: (job: WorkflowJobResult) => FormatFieldsItem[] = job =>
 
 export default class WorkflowView extends EasCommand {
   static override description =
-    'view details for a workflow run, including jobs. If no run ID is provided, you will be prompted to select from recent workflow runs for the current project.';
+    'view details for a workflow run, including jobs. If no run ID is provided, you will be prompted to select from recent workflow runs for the current project';
 
   static override flags = {
     ...EasJsonOnlyFlag,

packages/eas-cli/src/user/SessionManager.ts

@@ -9,7 +9,10 @@ import { fetchUserAsync } from './fetchUser';
 import { ApiV2Error } from '../ApiV2Error';
 import { AnalyticsWithOrchestration } from '../analytics/AnalyticsManager';
 import { ApiV2Client } from '../api';
-import { createGraphqlClient } from '../commandUtils/context/contextUtils/createGraphqlClient';
+import {
+  ExpoGraphqlClient,
+  createGraphqlClient,
+} from '../commandUtils/context/contextUtils/createGraphqlClient';
 import { CurrentUserQuery } from '../graphql/generated';
 import { UserQuery } from '../graphql/queries/UserQuery';
 import Log, { learnMore } from '../log';
@@ -43,6 +46,7 @@ type Actor = NonNullable<CurrentUserQuery['meActor']>;
 
 export default class SessionManager {
   private currentActor: Actor | undefined;
+  private graphqlClient: { credential: string | null; client: ExpoGraphqlClient } | undefined;
 
   constructor(private readonly analytics: AnalyticsWithOrchestration) {}
 
@@ -87,6 +91,21 @@ export default class SessionManager {
     await this.setSessionAsync(undefined);
   }
 
+  /**
+   * Returns one GraphQL client per credential, so context fields of one command share
+   * the urql cache. For example, the project ID check and the command both query the app.
+   */
+  public getGraphqlClient(authenticationInfo: {
+    accessToken: string | null;
+    sessionSecret: string | null;
+  }): ExpoGraphqlClient {
+    const credential = authenticationInfo.accessToken ?? authenticationInfo.sessionSecret;
+    if (this.graphqlClient?.credential !== credential) {
+      this.graphqlClient = { credential, client: createGraphqlClient(authenticationInfo) };
+    }
+    return this.graphqlClient.client;
+  }
+
   /**
    * @param requestTimeoutMs caps the actor lookup when no actor is cached yet. Callers that must
    * not delay a command past a deadline pass it; the default has no timeout. A capped lookup

packages/eas-cli/src/user/__tests__/SessionManager-test.ts

@@ -5,7 +5,10 @@ import path from 'path';
 import { ApiV2Error } from '../../ApiV2Error';
 import { AnalyticsWithOrchestration } from '../../analytics/AnalyticsManager';
 import { ApiV2Client } from '../../api';
-import { createGraphqlClient } from '../../commandUtils/context/contextUtils/createGraphqlClient';
+import {
+  ExpoGraphqlClient,
+  createGraphqlClient,
+} from '../../commandUtils/context/contextUtils/createGraphqlClient';
 import { UserQuery } from '../../graphql/queries/UserQuery';
 import Log from '../../log';
 import { promptAsync } from '../../prompts';
@@ -113,6 +116,28 @@ describe(SessionManager, () => {
     });
   });
 
+  describe('getGraphqlClient', () => {
+    beforeEach(() => {
+      jest.mocked(createGraphqlClient).mockImplementation(() => ({}) as ExpoGraphqlClient);
+    });
+
+    it('returns the same client for the same credential', () => {
+      const sessionManager = new SessionManager(analytics);
+      const client = sessionManager.getGraphqlClient({ accessToken: 'token', sessionSecret: null });
+      expect(
+        sessionManager.getGraphqlClient({ accessToken: 'token', sessionSecret: 'secret' })
+      ).toBe(client);
+    });
+
+    it('returns a new client when the credential changes', () => {
+      const sessionManager = new SessionManager(analytics);
+      const client = sessionManager.getGraphqlClient({ accessToken: null, sessionSecret: 'a' });
+      expect(sessionManager.getGraphqlClient({ accessToken: null, sessionSecret: 'b' })).not.toBe(
+        client
+      );
+    });
+  });
+
   describe('getUserAsync', () => {
     it('skips fetching user without access token or session secret', async () => {
       const sessionManager = new SessionManager(analytics);

packages/steps/src/BuildStepContext.ts

@@ -202,11 +202,8 @@ export class BuildStepGlobalContext {
     return new BuildStepContext(this, options);
   }
 
-  public markAsCheckedOut(logger: bunyan): void {
+  public markAsCheckedOut(): void {
     this.didCheckOut = true;
-    logger.info(
-      `Changing default working directory to ${this.defaultWorkingDirectory} (was ${this.projectTargetDirectory})`
-    );
   }
 
   public get hasAnyPreviousStepFailed(): boolean {

packages/steps/src/StepsConfigParser.ts

@@ -38,7 +38,7 @@ import {
   parseLocalCompositeFunctionPath,
 } from './utils/localCompositeFunctions';
 
-type ValidatedHooks = ReadonlyMap<HookKey, { anchorId: HookAnchorId; steps: Step[] }>;
+type ValidatedHooks = ReadonlyMap<HookKey, Step[]>;
 
 export class StepsConfigParser extends AbstractConfigParser {
   private readonly steps: Step[];
@@ -114,7 +114,6 @@ export class StepsConfigParser extends AbstractConfigParser {
     // step ids identical across the splicing→engine rollout.
     const buildSteps: BuildStep[] = [];
     const hooksByAnchorStep = new Map<BuildStep, AnchorHooks>();
-    const seenAnchorIds = new Set<HookAnchorId>();
 
     for (const stepConfig of validatedSteps) {
       const maybeFunctionGroup =
@@ -135,7 +134,6 @@ export class StepsConfigParser extends AbstractConfigParser {
           if (anchorId === undefined) {
             continue;
           }
-          seenAnchorIds.add(anchorId);
           const anchorHooks = await this.constructAnchorHooksAsync(
             anchorId,
             validatedHooks,
@@ -162,7 +160,6 @@ export class StepsConfigParser extends AbstractConfigParser {
           'Hook anchors are not supported on local composite function steps.'
         );
       }
-      seenAnchorIds.add(anchorId);
       const before = await this.constructHookSideEntriesAsync(
         anchorId,
         'before',
@@ -190,14 +187,6 @@ export class StepsConfigParser extends AbstractConfigParser {
       }
     }
 
-    for (const [hookKey, { anchorId }] of validatedHooks) {
-      if (!seenAnchorIds.has(anchorId)) {
-        this.ctx.baseLogger.warn(
-          `Ignoring "hooks.${hookKey}": this build does not run the "${anchorId}" step.`
-        );
-      }
-    }
-
     return {
       buildSteps,
       buildFunctionById,
@@ -206,14 +195,13 @@ export class StepsConfigParser extends AbstractConfigParser {
   }
 
   private validateHooks(): ValidatedHooks {
-    const validatedHooks = new Map<HookKey, { anchorId: HookAnchorId; steps: Step[] }>();
+    const validatedHooks = new Map<HookKey, Step[]>();
     for (const [hookKey, hookSteps] of Object.entries(this.hooks)) {
       // A worker must not fail on a hook key newer than itself, so unregistered
       // keys skip validation entirely (their steps may reference functions this
       // worker lacks).
       const parsed = parseHookKey(hookKey);
       if (parsed === null) {
-        this.ctx.baseLogger.warn(`Ignoring unknown hook key "${hookKey}".`);
         continue;
       }
       // An empty array is a deliberate no-op (e.g. opting out of a default);
@@ -223,10 +211,7 @@ export class StepsConfigParser extends AbstractConfigParser {
         continue;
       }
       try {
-        validatedHooks.set(`${parsed.side}_${parsed.anchorId}`, {
-          anchorId: parsed.anchorId,
-          steps: validateSteps(hookSteps),
-        });
+        validatedHooks.set(`${parsed.side}_${parsed.anchorId}`, validateSteps(hookSteps));
       } catch (err) {
         throw new BuildConfigError(
           `Invalid steps in "hooks.${hookKey}": ${err instanceof Error ? err.message : String(err)}`
@@ -286,7 +271,7 @@ export class StepsConfigParser extends AbstractConfigParser {
     validatedHooks: ValidatedHooks,
     compositeFunctionExpander: CompositeFunctionExpander
   ): Promise<HookEntry[]> {
-    const hookSteps = validatedHooks.get(`${side}_${anchorId}`)?.steps;
+    const hookSteps = validatedHooks.get(`${side}_${anchorId}`);
     if (hookSteps === undefined) {
       return [];
     }

packages/steps/src/__tests__/BuildStep-test.ts

@@ -130,7 +130,7 @@ describe(BuildStep, () => {
         projectTargetDirectory: '/a/b',
         relativeWorkingDirectory: 'c',
       });
-      ctx.markAsCheckedOut(ctx.baseLogger);
+      ctx.markAsCheckedOut();
 
       const id = 'test1';
       const command = 'ls -la';
@@ -150,7 +150,7 @@ describe(BuildStep, () => {
         projectTargetDirectory: '/a/b',
         relativeWorkingDirectory: 'c',
       });
-      ctx.markAsCheckedOut(ctx.baseLogger);
+      ctx.markAsCheckedOut();
 
       const id = 'test1';
       const command = 'ls -la';

packages/steps/src/__tests__/BuildStepContext-test.ts

@@ -65,7 +65,7 @@ describe(BuildStepGlobalContext, () => {
         ),
         false
       );
-      ctx.markAsCheckedOut(ctx.baseLogger);
+      ctx.markAsCheckedOut();
       expect(ctx.defaultWorkingDirectory).toBe(workingDirectory);
     });
   });
@@ -136,7 +136,7 @@ describe(BuildStepGlobalContext, () => {
         },
         createMockLogger()
       );
-      ctx.markAsCheckedOut(ctx.baseLogger);
+      ctx.markAsCheckedOut();
       expect(ctx.stepsInternalBuildDirectory).toBe('/m/n/o');
       expect(ctx.defaultWorkingDirectory).toBe('/g/h/i');
       expect(ctx.runtimePlatform).toBe(BuildRuntimePlatform.DARWIN);
@@ -199,7 +199,7 @@ describe(BuildStepGlobalContext, () => {
       const ctx = createGlobalContextMock({
         relativeWorkingDirectory: 'apps/mobile',
       });
-      ctx.markAsCheckedOut(ctx.baseLogger);
+      ctx.markAsCheckedOut();
 
       const relativeChildCtx = ctx.stepCtx({
         relativeWorkingDirectory: 'scripts',
@@ -230,7 +230,7 @@ describe(BuildStepGlobalContext, () => {
         projectTargetDirectory: tempDir,
         relativeWorkingDirectory: '',
       });
-      ctx.markAsCheckedOut(ctx.baseLogger);
+      ctx.markAsCheckedOut();
     });
 
     afterEach(() => {

packages/steps/src/__tests__/StepsConfigParser-hooks-test.ts

@@ -283,9 +283,6 @@ describe('StepsConfigParser hook construction', () => {
     });
     expect(orderedDisplayNames(workflow)).toEqual(['Checkout']);
     expect(workflow.hooksByAnchorStep.size).toBe(0);
-    expect(ctx.baseLogger.warn).toHaveBeenCalledWith(
-      'Ignoring "hooks.before_install_node_modules": this build does not run the "install_node_modules" step.'
-    );
   });
 
   it('rejects a hook step using a composite function missing from the catalog with BuildConfigError', async () => {
@@ -858,26 +855,17 @@ describe('StepsConfigParser lazy hook composite loading', () => {
     expect(orderedDisplayNames(workflow)).toEqual(['Checkout']);
   });
 
-  it('warns for a registered hook key whose anchor never appeared', async () => {
-    await parseWorkflowAsync({
+  it('ignores unknown and unrun hook keys without warning', async () => {
+    const workflow = await parseWorkflowAsync({
       ctx,
       steps: [{ uses: 'eas/checkout' }],
-      hooks: { before_install_node_modules: [{ run: 'echo never' }] },
+      hooks: {
+        before_install_node_modules: [{ run: 'echo never' }],
+        before_install_node_module: [{ run: 'echo typo' }],
+      },
     });
-    expect(ctx.baseLogger.warn).toHaveBeenCalledWith(
-      'Ignoring "hooks.before_install_node_modules": this build does not run the "install_node_modules" step.'
-    );
-  });
-
-  it('warns for an unknown hook key', async () => {
-    await parseWorkflowAsync({
-      ctx,
-      steps: [{ uses: 'eas/checkout' }],
-      hooks: { before_install_node_module: [{ run: 'echo typo' }] },
-    });
-    expect(ctx.baseLogger.warn).toHaveBeenCalledWith(
-      'Ignoring unknown hook key "before_install_node_module".'
-    );
+    expect(workflow.hooksByAnchorStep.size).toBe(0);
+    expect(ctx.baseLogger.warn).not.toHaveBeenCalled();
   });
 
   it('wraps a loader failure in a BuildConfigError naming the before-side hook key', async () => {

packages/worker/src/__unit__/context.test.ts

@@ -5,7 +5,7 @@ import config from '../config';
 import { createBuildContext } from '../context';
 import { getBuildEnv } from '../env';
 import { prepareRuntimeEnvironmentConfigFiles } from '../runtimeEnvironment';
-import { uploadSourceMapAsync } from '../upload';
+import { uploadSourceMapAsync, uploadWorkflowArtifactAsync } from '../upload';
 
 jest.mock('../env', () => ({
   getBuildEnv: jest.fn(() => ({
@@ -18,6 +18,7 @@ jest.mock('../runtimeEnvironment', () => ({
 }));
 jest.mock('../upload', () => ({
   ...jest.requireActual('../upload'),
+  uploadWorkflowArtifactAsync: jest.fn(async () => ({ artifactId: 'artifact-id' })),
   uploadSourceMapAsync: jest.fn(async () => ({ filename: null })),
   uploadWithAnalyticsAsync: jest.fn(async fn => await fn()),
 }));
@@ -39,7 +40,6 @@ describe(createBuildContext.name, () => {
     buildId: 'build-id',
     buildLogger,
     addBuildLogMask: jest.fn(),
-    createLogMaskingStream: jest.fn(),
   };
 
   beforeEach(() => {
@@ -130,4 +130,28 @@ describe(createBuildContext.name, () => {
       logger: childLogger,
     });
   });
+  it('uploads named artifacts to workflow storage and returns their ID', async () => {
+    const ctx = await createBuildContext({
+      ...baseOptions,
+      job: {
+        type: Workflow.GENERIC,
+        secrets: { environmentSecrets: [] },
+      } as any,
+    });
+    const metadata = { kind: 'maestro-report' };
+
+    const result = await ctx.uploadArtifact({
+      artifact: { type: null, name: 'Report', paths: ['/workingdir/report'], metadata },
+      logger: childLogger,
+    });
+
+    expect(uploadWorkflowArtifactAsync).toHaveBeenCalledWith(ctx, {
+      artifactPaths: ['/workingdir/report'],
+      name: 'Report',
+      metadata,
+      logger: childLogger,
+    });
+    expect(result).toEqual({ artifactId: 'artifact-id' });
+    expect(ctx.artifacts).toEqual({});
+  });
 });

packages/worker/src/__unit__/logger.test.ts

@@ -1,5 +1,4 @@
-import { Readable, Transform, TransformCallback, Writable } from 'node:stream';
-import { pipeline } from 'node:stream/promises';
+import { TransformCallback, Writable } from 'node:stream';
 import { EnvironmentSecretType } from '@expo/eas-build-job';
 import z from 'zod';
 
@@ -357,99 +356,3 @@ describe('logger', () => {
     expect(outputStream.readableLength).toBe(0);
   });
 });
-
-describe('createLogMaskingStream', () => {
-  async function maskAsync(stream: Transform, chunks: Buffer[]): Promise<Buffer> {
-    const output: Buffer[] = [];
-    await pipeline(
-      Readable.from(chunks),
-      stream,
-      new Writable({
-        write(chunk: Buffer, _encoding: BufferEncoding, callback: (error?: Error | null) => void) {
-          output.push(chunk);
-          callback();
-        },
-      })
-    );
-    return Buffer.concat(output);
-  }
-
-  it('masks secrets, secrets as Xcode prints them in build settings, and decoded secrets', async () => {
-    const { createLogMaskingStream } = await createBuildLoggerWithSecretsFilter({
-      environmentSecrets: [
-        { name: 'API_KEY', value: 'ab cd=ef$gh', type: EnvironmentSecretType.STRING },
-        {
-          name: 'ANOTHER_SECRET_BASE64',
-          value: 'YW5vdGhlclNlY3JldA==',
-          type: EnvironmentSecretType.STRING,
-        },
-      ],
-    });
-    const log = [
-      '    export API_KEY\\=ab\\ cd\\=ef\\$gh',
-      'token is ab cd=ef$gh',
-      'decoded anotherSecret here',
-      '',
-    ].join('\n');
-
-    const masked = await maskAsync(createLogMaskingStream(), [Buffer.from(log)]);
-
-    expect(masked.toString()).toBe(
-      [
-        `    export API_KEY\\=${'*'.repeat(14)}`,
-        `token is ${'*'.repeat(11)}`,
-        `decoded ${'*'.repeat(13)} here`,
-        '',
-      ].join('\n')
-    );
-  });
-
-  it('masks secrets split across chunks, including masks added after the logger was created', async () => {
-    const { createLogMaskingStream, addBuildLogMask } = await createBuildLoggerWithSecretsFilter(
-      {}
-    );
-    addBuildLogMask('leased-token');
-
-    const masked = await maskAsync(createLogMaskingStream(), [
-      Buffer.from('first line leased-'),
-      Buffer.from('token\nsecond '),
-      Buffer.from('leased-token without a newline'),
-    ]);
-
-    expect(masked.toString()).toBe(
-      `first line ${'*'.repeat(12)}\nsecond ${'*'.repeat(12)} without a newline`
-    );
-  });
-
-  it('keeps everything except secrets byte for byte, including multibyte and invalid UTF-8', async () => {
-    const { createLogMaskingStream } = await createBuildLoggerWithSecretsFilter({
-      environmentSecrets: [
-        { name: 'PASSWORD', value: 'pässwörd', type: EnvironmentSecretType.STRING },
-      ],
-    });
-    const log = Buffer.concat([
-      Buffer.from('✓ Compiling café.swift\r\n'),
-      Buffer.from([0xff, 0xfe, 0x0a]),
-      Buffer.from('password: pässwörd\n'),
-    ]);
-    // Split inside the multibyte characters.
-    const chunks = [
-      log.subarray(0, 1),
-      log.subarray(1, 20),
-      log.subarray(20, 40),
-      log.subarray(40),
-    ];
-
-    const masked = await maskAsync(createLogMaskingStream(), chunks);
-
-    const passwordBytes = Buffer.byteLength('pässwörd');
-    expect(masked).toEqual(
-      Buffer.concat([
-        Buffer.from('✓ Compiling café.swift\r\n'),
-        Buffer.from([0xff, 0xfe, 0x0a]),
-        Buffer.from(`password: ${'*'.repeat(passwordBytes)}\n`),
-      ])
-    );
-    expect(masked.length).toBe(log.length);
-  });
-});

packages/worker/src/__unit__/service.test.ts

@@ -115,7 +115,6 @@ describe('BuildService Datadog setup', () => {
     createBuildLoggerWithSecretsFilterMock.mockResolvedValue({
       logger: buildLogger,
       addBuildLogMask: jest.fn(),
-      createLogMaskingStream: jest.fn(),
       cleanUp: jest.fn(async () => {}),
       logBuffer: { getLogs: () => [], getPhaseLogs: () => [] } as any,
       outputStream: {} as any,

packages/worker/src/__unit__/xcodeLogs.test.ts

@@ -1,82 +0,0 @@
-import { RemoteLoggerStream, uploadWithSignedUrl } from '@expo/build-tools';
-import fs from 'fs-extra';
-import os from 'os';
-import path from 'path';
-import { Readable } from 'stream';
-import zlib from 'zlib';
-
-import config from '../config';
-import { uploadXcodeBuildLogs } from '../ios/xcodeLogs';
-import { createTextMaskingStream } from '../logger';
-
-// These tests use real fs and directories in os.tmpdir(), since memfs read streams can't be closed.
-jest.unmock('fs');
-jest.unmock('node:fs');
-
-const logger = { warn: jest.fn() } as any;
-
-async function readAllAsync(stream: Readable): Promise<Buffer> {
-  const chunks: Buffer[] = [];
-  for await (const chunk of stream) {
-    chunks.push(Buffer.from(chunk));
-  }
-  return Buffer.concat(chunks);
-}
-
-describe(uploadXcodeBuildLogs, () => {
-  const originalGcs = { ...config.loggers.gcs };
-  let tmpDir: string;
-
-  beforeEach(async () => {
-    tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'xcode-logs-test-'));
-    config.loggers.gcs.signedUploadUrlForXcodeBuildLogs = {
-      url: 'https://gcs.expo.test/xcode-logs',
-      headers: {},
-    };
-  });
-
-  afterEach(async () => {
-    Object.assign(config.loggers.gcs, originalGcs);
-    jest.mocked(uploadWithSignedUrl).mockReset();
-    await fs.remove(tmpDir);
-  });
-
-  it.each([
-    ['no compression', null, (body: Buffer) => body],
-    ['gzip', RemoteLoggerStream.CompressionMethod.GZIP, zlib.gunzipSync],
-    ['brotli', RemoteLoggerStream.CompressionMethod.BR, zlib.brotliDecompressSync],
-  ])('uploads the log with secrets masked (%s)', async (_name, compressionMethod, decompress) => {
-    config.loggers.gcs.compressionMethod = compressionMethod as any;
-    const logsPath = path.join(tmpDir, 'xcodebuild.log');
-    await fs.writeFile(logsPath, '    export API_KEY\\=ab\\ cd\\=ef\\$gh\n** BUILD SUCCEEDED **\n');
-    let uploaded: Buffer | undefined;
-    jest.mocked(uploadWithSignedUrl).mockImplementation(async ({ srcGeneratorAsync }) => {
-      uploaded = await readAllAsync((await srcGeneratorAsync()) as Readable);
-      return 'https://gcs.expo.test/xcode-logs';
-    });
-
-    await uploadXcodeBuildLogs(logger, logsPath, () =>
-      createTextMaskingStream(new Set(['ab cd=ef$gh']))
-    );
-
-    expect(decompress(uploaded!).toString()).toBe(
-      `    export API_KEY\\=${'*'.repeat(14)}\n** BUILD SUCCEEDED **\n`
-    );
-  });
-
-  it.each([
-    ['no compression', null],
-    ['gzip', RemoteLoggerStream.CompressionMethod.GZIP],
-  ])('fails the upload when the log cannot be read (%s)', async (_name, compressionMethod) => {
-    config.loggers.gcs.compressionMethod = compressionMethod as any;
-    jest.mocked(uploadWithSignedUrl).mockImplementation(async ({ srcGeneratorAsync }) => {
-      await readAllAsync((await srcGeneratorAsync()) as Readable);
-      return 'https://gcs.expo.test/xcode-logs';
-    });
-
-    // A directory can be stat'ed but not read.
-    await expect(
-      uploadXcodeBuildLogs(logger, tmpDir, () => createTextMaskingStream(new Set(['secret'])))
-    ).rejects.toThrow('EISDIR');
-  });
-});

packages/worker/src/context.ts

@@ -2,7 +2,6 @@ import { BuildContext, BuildContextOptions, LogBuffer, RuntimeSettings } from '@
 import { Job, ManagedArtifactType, Metadata, Platform } from '@expo/eas-build-job';
 import { bunyan } from '@expo/logger';
 import assert from 'assert';
-import { Transform } from 'stream';
 
 import { GCSCacheManager } from './CacheManager';
 import config from './config';
@@ -28,7 +27,6 @@ export async function createBuildContext<TJob extends Job>({
   buildId,
   buildLogger,
   addBuildLogMask,
-  createLogMaskingStream,
 }: {
   job: TJob;
   logBuffer: LogBuffer;
@@ -38,7 +36,6 @@ export async function createBuildContext<TJob extends Job>({
   buildId: string;
   buildLogger: bunyan;
   addBuildLogMask: (secret: string) => void;
-  createLogMaskingStream: () => Transform;
 }): Promise<BuildContext<TJob>> {
   const childLogger = buildLogger.child({ buildId });
   await RuntimeSettings.loadAsync({
@@ -54,7 +51,7 @@ export async function createBuildContext<TJob extends Job>({
     switch (type) {
       case ManagedArtifactType.XCODE_BUILD_LOGS: {
         if (job.platform === Platform.IOS) {
-          await uploadXcodeBuildLogs(logger, paths[0], createLogMaskingStream);
+          await uploadXcodeBuildLogs(logger, paths[0]);
           return { filename: null };
         }
         throw new Error('Uploading Xcode logs in non-iOS builds is not supported');

packages/worker/src/ios/xcodeLogs.ts

@@ -3,18 +3,14 @@ import { bunyan } from '@expo/logger';
 import fs from 'fs-extra';
 import os from 'os';
 import path from 'path';
-import { Readable, Transform, pipeline } from 'stream';
+import { Readable, pipeline } from 'stream';
 import { promisify } from 'util';
 import { v4 as uuid } from 'uuid';
 import zlib from 'zlib';
 
 import config from '../config';
 
-export async function uploadXcodeBuildLogs(
-  logger: bunyan,
-  logsPath: string,
-  createLogMaskingStream: () => Transform
-): Promise<void> {
+export async function uploadXcodeBuildLogs(logger: bunyan, logsPath: string): Promise<void> {
   if (!config.loggers.gcs.signedUploadUrlForXcodeBuildLogs) {
     logger.warn('GCS Presigned URL for Xcode logs was not specified, skipping upload');
   } else {
@@ -22,15 +18,8 @@ export async function uploadXcodeBuildLogs(
       signedUrl: config.loggers.gcs.signedUploadUrlForXcodeBuildLogs,
       srcGeneratorAsync: async () => {
         const stat = await fs.stat(logsPath);
-        // Masking replaces each byte of a secret with one byte, so the size stays the same.
-        // pipeline passes read errors on to the masked stream, which fails the upload.
-        const maskedStream = pipeline(
-          fs.createReadStream(logsPath),
-          createLogMaskingStream(),
-          () => {}
-        );
         const { stream } = await compress(
-          { stream: maskedStream, length: stat.size },
+          { stream: fs.createReadStream(logsPath), length: stat.size },
           config.loggers.gcs.compressionMethod
         );
         return stream;

packages/worker/src/logger.ts

@@ -102,40 +102,6 @@ function createTransformStream(secretPatterns: ReadonlySet<string>): Transform {
   });
 }
 
-// Characters that Xcode escapes with a backslash when it prints build settings.
-const XCODE_ESCAPED_CHARACTERS = /[\t !"#$&'()*;<=>?[\\\]^`{|}~]/g;
-
-/**
- * Masks secrets in a text file's contents, line by line, including secrets written the way Xcode
- * prints build settings. Masking works on bytes, so everything else stays unchanged.
- */
-export function createTextMaskingStream(secretPatterns: ReadonlySet<string>): Transform {
-  const patterns = [
-    ...new Set(
-      [...secretPatterns].flatMap(secret => [
-        secret,
-        secret.replace(XCODE_ESCAPED_CHARACTERS, '\\$&'),
-      ])
-    ),
-  ].map(pattern => Buffer.from(pattern).toString('latin1'));
-  const maskLine = (line: string): string =>
-    patterns.some(pattern => line.includes(pattern)) ? maskSecrets(line, patterns) : line;
-  let partialLine = '';
-  return new Transform({
-    transform(chunk: Buffer, _encoding: BufferEncoding, callback: TransformCallback) {
-      const lines = (partialLine + chunk.toString('latin1')).split('\n');
-      partialLine = lines.pop() ?? '';
-      callback(
-        null,
-        lines.length > 0 ? Buffer.from(`${lines.map(maskLine).join('\n')}\n`, 'latin1') : undefined
-      );
-    },
-    flush(callback: TransformCallback) {
-      callback(null, partialLine ? Buffer.from(maskLine(partialLine), 'latin1') : undefined);
-    },
-  });
-}
-
 function maskSecrets(message: string, secrets: Iterable<string>): string {
   const characters = message.split('');
   for (const secret of secrets) {
@@ -204,7 +170,6 @@ function createDiscardStream(): Writable {
 export async function createBuildLoggerWithSecretsFilter(secrets: Job['secrets']): Promise<{
   logger: bunyan;
   addBuildLogMask: (secret: string) => void;
-  createLogMaskingStream: () => Transform;
   cleanUp: () => Promise<void>;
   logBuffer: WorkerLogBuffer;
   outputStream: Readable;
@@ -274,8 +239,6 @@ export async function createBuildLoggerWithSecretsFilter(secrets: Job['secrets']
   return {
     logger: buildLogger,
     addBuildLogMask,
-    // Reads the masks when the stream is created, so it includes masks added during the job.
-    createLogMaskingStream: () => createTextMaskingStream(secretPatterns),
     cleanUp: async () => {
       await Promise.all([remoteLoggerStream?.cleanUp?.(), httpLogStream?.cleanUp?.()]);
     },

packages/worker/src/service.ts

@@ -275,7 +275,6 @@ export default class BuildService {
       const {
         logger: buildLogger,
         addBuildLogMask,
-        createLogMaskingStream,
         cleanUp,
         logBuffer,
       } = await createBuildLoggerWithSecretsFilter(job.secrets ?? {});
@@ -316,7 +315,6 @@ export default class BuildService {
         buildId: this.buildId,
         buildLogger,
         addBuildLogMask,
-        createLogMaskingStream,
       });
       this.buildContext = ctx;